Commit graph

271 commits

Author SHA1 Message Date
Till JS
c33339b0cf rename(taktik): rebrand to Times
Rename taktik → times across the entire app: package names (@taktik →
@times), appId, localStorage keys, export filenames, type names
(TaktikSettings → TimesSettings), monorepo scripts, shared-branding,
mana-auth trustedOrigins, docker-compose, and documentation.

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
2026-03-30 15:44:18 +02:00
Till JS
1eb370eaaa feat(manacore): tiling layout — resizable, splittable dashboard panels
Replace the fixed CSS Grid widget layout with a recursive tiling system
using a binary tree data model. Each node is either a leaf (widget) or
a split (horizontal/vertical) with a draggable resize handle.

New components:
- TilingLayout: Recursive renderer (leaf→TilePanel, split→flex+handle)
- TilePanel: Widget wrapper with edit controls (split H/V, change, close)
- TileResizeHandle: Draggable divider, H+V, keyboard accessible, 10-90%

Architecture:
- Binary tree model (TileNode = TileLeaf | TileSplit)
- Immutable tree operations in tiling-tree.ts (splitLeaf, removeLeaf, etc.)
- Tiling store with debounced IndexedDB persistence
- Widget registry extracted from WidgetContainer for shared use
- Mobile fallback: flattened vertical stack under 768px
- Default: Clock | Tasks | Calendar (3 panels)

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
2026-03-30 15:43:19 +02:00
Till JS
7f2b9f893b docs(todo,calendar): document smart duration settings
Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
2026-03-30 15:02:53 +02:00
Till JS
1bbf0ef41e feat: integrate shared-links into Calendar, Contacts, and ManaCore
Add @manacore/shared-links to Calendar, Contacts, and ManaCore apps.
Link store initializes alongside tag store in each app's layout, syncs
when authenticated, and is ready for cross-app linking.

Also fix broken workspace references in moodlit (shared-feedback-service
→ feedback, shared-feedback-ui removed, shared-subscription-ui →
subscriptions).

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
2026-03-30 10:53:44 +02:00
Till JS
aee0934caf feat(manacore): migrate all remaining widgets to local-first IndexedDB
Migrate 9 more dashboard widgets from REST API polling to direct
IndexedDB reads: Chat, Zitare, Picture, Clock, Storage, Mukke,
Presi, Context, ManaDeck.

All 13 data widgets now use reactive liveQuery reads. Only Credits
and Transactions remain API-based (server-authoritative data).

Added cross-app stores for: chat, zitare, picture, clock, storage,
mukke, presi, context, manadeck — with typed collection accessors
and reactive query hooks for each.

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
2026-03-30 10:45:30 +02:00
Till JS
80ea301ac1 feat(manacore): cross-app IndexedDB readers for dashboard widgets
Replace REST API polling with direct IndexedDB reads for 4 dashboard
widgets: TasksToday, TasksUpcoming, CalendarEvents, ContactsFavorites.

Data is now reactive via Dexie liveQuery — updates instantly when any
app writes to its IndexedDB (sync, other tabs, local edits). No more
30-60s polling intervals or retry logic needed.

New files:
- cross-app-stores.ts: Opens todo/calendar/contacts IndexedDB databases
- cross-app-queries.ts: Reactive queries (useOpenTasks, useUpcomingEvents, etc.)

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
2026-03-30 01:21:32 +02:00
Till JS
62e1353503 feat(manacore): migrate settings, dashboard, and tags to local-first
Move ManaCore from server-only data fetching to local-first architecture
using @manacore/local-store (IndexedDB + mana-sync). Dashboard config
now syncs across devices instead of being localStorage-only, and tags
use the shared local-first tag store consistent with all other apps.

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
2026-03-29 19:36:08 +02:00
Till JS
f5cd77b2b0 feat(infra): smart build memory check and baseline monitoring script
build-app.sh now checks available RAM before builds and only stops
monitoring containers when free memory is below 3 GB threshold.
New memory-baseline.sh script measures per-container and per-category
RAM usage for capacity planning.

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
2026-03-29 15:07:20 +02:00
Till JS
559025bfc9 feat: Colima migration script, devlog & capacity docs update
- Add migrate-to-colima.sh: full migration script with volume backup,
  restore, LaunchAgent setup, dry-run mode, and rollback support
- Add devlog post: GPU offload, Colima migration & Organic Growth Gate
- Update MAC_MINI_SERVER.md: document Colima as container runtime
- Update CAPACITY_PLANNING.md: mark Colima migration as done

Colima (MIT) replaces Docker Desktop, saving ~10 GB RAM on Mac Mini.
The entire self-hosted stack now uses only open-source-licensed components.

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
2026-03-28 22:18:59 +01:00
Till JS
45ebfea59d refactor(docker): standardize all web Dockerfiles to use sveltekit-base
Migrate 17 app Dockerfiles from standalone builds (each copying 20+
packages individually) to use the shared sveltekit-base:local image.

Benefits:
- No more missing package COPY errors
- Single base image to maintain
- Consistent build pattern across all apps
- Faster builds (shared deps pre-installed)

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
2026-03-28 21:56:44 +01:00
Till JS
bb85a8d63d fix(landing): vertical columns layout - each category as a column
Categories are now side-by-side columns with heading on top and apps
stacked vertically below. 7 columns on desktop, wraps on smaller screens.

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
2026-03-28 21:48:38 +01:00
Till JS
fb25900bff fix(docker): fix broken COPY line concatenation in all web Dockerfiles
Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
2026-03-28 21:47:12 +01:00
Till JS
de54af658e fix(landing): full-width category headings above app grid rows
Each category now has a full-width heading bar on top, with the app
tiles flowing in the grid below it.

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
2026-03-28 21:42:41 +01:00
Till JS
5477e6eb74 fix(docker): add eslint-config + remove stale patches from all web Dockerfiles 2026-03-28 21:42:06 +01:00
Till JS
f4cbbccb49 feat(landing): replace emojis with Phosphor icons on apps page
Add @iconify-json/ph for Phosphor icons via astro-icon. Each app tile
now shows a clean Phosphor icon instead of an emoji.

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
2026-03-28 21:35:33 +01:00
Till JS
466f7f3478 fix(landing): heading tiles span only 1 cell like app tiles
Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
2026-03-28 21:19:27 +01:00
Till JS
357521126f feat(landing): add thematic cluster headings to apps grid
Group apps into 7 clusters (KI & Kreativ, Organisieren, Lernen, Medien,
Alltag & Gesundheit, Unterwegs, Kommunikation) with heading tiles that
span 3 columns in the same grid.

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
2026-03-28 21:15:28 +01:00
Till JS
16367384c7 fix(docker): use --no-frozen-lockfile in all web Dockerfiles
After extensive package restructuring (deletions, consolidations, new
packages), the frozen lockfile causes resolution failures in Docker.
Use --no-frozen-lockfile until lockfile stabilizes.

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
2026-03-28 21:12:03 +01:00
Till JS
dbf7121a43 fix(landing): remove gaps, rounded corners, and heading from apps grid
Clean brick layout: no spacing between cells, square corners, no title/subtitle.
Just the grid directly after navbar.

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
2026-03-28 21:11:53 +01:00
Till JS
9643c9bb3d fix(docker): regenerate Dockerfiles for consolidated packages
The package consolidation (feedback, help, subscription, credits)
renamed packages but Dockerfiles still referenced old names.
Ran scripts/generate-dockerfiles.mjs to update all 16 web app
Dockerfiles with correct COPY statements.

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
2026-03-28 21:09:44 +01:00
Till JS
83a51d0569 fix(landing): fix content schema errors for manascore and devlog entries
Add missing required fields (score, scores, status) to architecture-update
manascore entry. Fix invalid 'architecture' category to 'infrastructure'
in two devlog entries.

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
2026-03-28 20:28:14 +01:00
Till JS
353f284085 refactor(landing): simplify apps page to responsive grid with real app URLs
Replace bloated multi-section layout (Available/Beta/Coming Soon with gradients,
feature lists, mana usage info) with a clean brick grid of all 22 apps linking
directly to {app}.mana.how. Responsive: 2 cols mobile → 6 cols large desktop.

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
2026-03-28 18:33:05 +01:00
Till JS
be0e5c6e83 docs: update devlog with Phase 3 — mana-media migration, load testing, CI/CD
Add Phase 3 section covering: mana-core-auth cleanup (15 files),
mana-media NestJS→Hono migration (last NestJS service), k6 load
testing suite for mana-sync, and CI/CD pipeline finalization for
all Go + Hono services.

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
2026-03-28 18:28:05 +01:00
Till JS
1cb48b797a docs: update devlog + migration report with Phase 2 results
Updated both:
- Content collection devlog (landing page)
- docs/ARCHITECTURE_MIGRATION_REPORT.md

Added Phase 2 sections: package consolidation (58→43), auth store
centralization (6,800→182 LOC), mana-sync hardening, port schema,
type-safety fixes, Expo SDK alignment. Updated stats to reflect
full ~88,600 LOC net reduction.

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
2026-03-28 18:18:54 +01:00
Till JS
27b70e8197 chore(mobile): align all 7 Expo apps to SDK 55
Upgraded 6 apps from SDK 52/54 to SDK 55 (matrix was already on 55).
All apps now consistently use:
- Expo SDK ~55.0.5
- React Native 0.83.2
- React 19.2.0
- expo-router ~55.0.5
- NativeWind ~4.2.3

Before: 3 different SDK versions (52, 54, 55)
After:  1 version (55) across all 7 mobile apps

Added docs/EXPO_SDK_UPGRADE.md with testing checklist.

Note: pnpm install + device testing required to validate the upgrades.

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
2026-03-28 18:10:14 +01:00
Till JS
e7bcb230be refactor(auth): centralize auth stores — 21 apps use createManaAuthStore factory
Created createManaAuthStore in @manacore/shared-auth-stores that replaces
~350 lines of duplicated auth.svelte.ts per app with a ~10 line factory call.

The factory handles: SSO, passkeys, 2FA, magic links, token management,
password reset, sign up/in/out — everything the old stores did.

Each app only provides devBackendPort and optional onAuthenticated callback.

Before: 21 apps × ~350 lines = 6,800 lines of duplicated auth code
After:  21 apps × ~10 lines  = 182 lines total (97% reduction)

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
2026-03-28 18:04:27 +01:00
Till JS
82fee019f6 docs(manascore): update scores after Local-First + Hono migration
All 19 apps score higher after the architecture migration:
- Average: 75.1 → 84.8 (+9.7 points)
- Biggest gains: Photos (+14), CityCorners (+14), Planta (+13)
- Key improvements: Local-First, Guest-Mode, Offline CRUD, Hono servers

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
2026-03-28 18:03:08 +01:00
Till JS
4aa8d870a6 chore: commit remaining changes from recent sessions
- Mana page updates across 12 apps (credit display improvements)
- Todo board view editor + view selector components
- Docker Hono server base Dockerfile
- Matrix web vite config update
- Docker compose updates
- Feedback types.ts (recovered)

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
2026-03-28 17:54:51 +01:00
Till JS
11db6c60dc refactor(packages): consolidate 3 credit packages into @manacore/credits
Merged credit-operations + shared-credit-service + shared-credit-ui
into @manacore/credits with sub-path exports:
- @manacore/credits — operations, costs, service
- @manacore/credits/web — Svelte components
- @manacore/credits/mobile — React Native components

Package count: 47 → 44

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
2026-03-28 17:46:26 +01:00
Till JS
b7e67aef21 docs: add devlog for Local-First + NestJS elimination migration
Comprehensive devlog article covering the entire architecture
transformation: Local-First migration (19 apps), auth service split
(5 Hono services), app backend replacement (14 compute servers),
and NestJS elimination (~80k LOC removed).

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
2026-03-28 17:45:46 +01:00
Till JS
1f3208384b refactor(packages): consolidate 2 subscription packages into @manacore/subscriptions
Merged shared-subscription-types + shared-subscription-ui into
@manacore/subscriptions. Updated imports in 15 web apps.

Package count: 49 → 47

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
2026-03-28 17:40:47 +01:00
Till JS
d70ab97a66 refactor(packages): consolidate 4 help packages into @manacore/help
Merged shared-help-types + shared-help-content + shared-help-ui into
@manacore/help. Deleted shared-help-mobile (0 consumers).

Updated imports in all 20 web apps.

Package count: 53 → 49

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
2026-03-28 17:36:32 +01:00
Till JS
1aeb987cb6 refactor(packages): consolidate 3 feedback packages into @manacore/feedback
Merged shared-feedback-types + shared-feedback-service + shared-feedback-ui
into a single @manacore/feedback package. Updated imports in all 21 apps.

Before: 3 packages (types, service, ui) with cross-dependencies
After:  1 package with direct imports, no circular refs

Note: ESLint warnings from pre-existing unused vars in chat/mukke
servers are unrelated to this change.

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
2026-03-28 16:27:11 +01:00
Till JS
8ccf8ff818 chore: misc fixes, new services, lockfile cleanup
Assorted changes from recent sessions:
- .gitignore: add mana-sync binary, Forgejo data
- chat/web: add isSidebarMode to navigation store
- clock/web: fix alarm page markup
- contacts/mukke/presi/questions: add svelte.config.js aliases
- context/web: add missing dependency
- manacore/landing: update pricing page
- manacore/web + todo/web: update mana dashboard pages
- planta/web: fix dashboard layout
- pnpm-lock.yaml: cleanup after backend removals
- docs/APP_GAP_ANALYSIS.md: new gap analysis doc
- services/mana-analytics: add Dockerfile
- services/mana-subscriptions: new Go subscription service

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
2026-03-28 10:27:35 +01:00
Till JS
79080d6654 fix(apps): use explicit AuthServiceInterface in all 21 auth stores, re-enable type-check
Replace ReturnType<typeof initializeWebAuth>['authService'] with the
explicit AuthServiceInterface in all 21 web app auth stores. This
ensures svelte-check sees all 37 auth methods instead of TS inferring
a truncated type (~27 methods visible).

Re-enabled type-check in 5 apps that were skipping it:
- chat/web: svelte-kit sync && svelte-check --threshold error
- clock/web: svelte-kit sync && svelte-check --threshold error
- context/web: svelte-kit sync && svelte-check --threshold error
- presi/web: svelte-kit sync && svelte-check --threshold error
- picture/mobile: tsc --noEmit

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
2026-03-28 10:15:23 +01:00
Till JS
819568c3df feat(infra): consolidate 21 Matrix bots into Go binary + add Go API gateway
Replace 21 separate NestJS Matrix bot processes (~2.1 GB RAM, ~4.2 GB Docker images)
with a single Go binary using plugin architecture (8.6 MB binary, ~30 MB RAM).

New services:
- services/mana-matrix-bot/ — Go Matrix bot with 21 plugins (mautrix-go, Redis sessions)
- services/mana-api-gateway-go/ — Go API gateway (rate limiting, API keys, credit billing)

Deleted:
- 21 services/matrix-*-bot/ directories
- packages/bot-services/ and packages/matrix-bot-common/
- Legacy deploy scripts and CI build jobs

Updated:
- docker-compose.macmini.yml: new Go services, legacy bots removed
- CI/CD: change detection + build jobs for Go services
- Root package.json: new dev:matrix, build:matrix, test:matrix scripts

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
2026-03-27 21:03:00 +01:00
Till JS
d4c6f257b3 docs: add devlog for 2026-03-25 and update 2026-03-26
Add missing devlog for March 25 (analytics, help system, CityCorners,
ManaLink, infra). Expand March 26 devlog to include all 61 commits
(Storage sprint, Passkeys/2FA, Tags, Zitare) alongside architecture planning.

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
2026-03-27 12:33:06 +01:00
Till JS
fe8f0a227d fix(pricing): update remaining content pages to Mana Quelle naming and new prices
Update branchen pages (privat, selbststaendige, vereine), memoro-de content,
and onboarding CreditsStep to use new Mana Quelle S-XXL tiers and Mana Trank prices.

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
2026-03-27 11:55:32 +01:00
Till JS
8f56feb115 feat(auth): session management UI and improved account lockout feedback
Session management:
- GET /auth/sessions and DELETE /auth/sessions/:id endpoints
- listSessions() and revokeSession() in shared-auth client
- SessionManager component: active sessions list with device info,
  "Aktuell" badge, revoke individual or all other sessions
- Integrated in ManaCore settings page

Account lockout UX:
- Dedicated amber lockout banner (distinct from generic rate-limit)
- "Konto vorübergehend gesperrt" with MM:SS countdown
- "Passwort zurücksetzen" link as alternative action
- formatCountdown helper for clean time display

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
2026-03-27 11:55:32 +01:00
Till JS
2624e5a6b7 feat(pricing): migrate to Mana Quelle S-XXL subscription tiers with new Stripe products
Replace old 3-tier model (Plus/Pro/Ultra) with 5 size-based tiers (S/M/L/XL/XXL).
New naming: "Mana Quelle" for subscriptions, "Mana Trank" for one-time purchases.
Create new Stripe products and prices, archive old ones, update all UI and seed data.

Subscription tiers: S (500 Mana, 4.99€), M (1000, 9.99€), L (2000, 19.99€),
XL (4000, 39.99€), XXL (10000, 99.99€). Yearly: 20% discount.

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
2026-03-27 11:54:58 +01:00
Till JS
cc50c0c2ab feat(auth): add password strength indicator and magic links
Password strength (zxcvbn-ts):
- PasswordStrength component with 4-segment color bar and German feedback
- Lazy-loaded with 150ms debounce to avoid SSR/bundle issues
- Integrated into RegisterPage and ChangePassword components

Magic Links (passwordless email):
- Better Auth magicLink plugin (10-minute expiry)
- sendMagicLinkEmail() in email service (German template)
- Passthrough route for /magic-link/* endpoints
- sendMagicLink() in shared-auth client
- "Login-Link per E-Mail senden" button on all 20 login pages
- All 21 auth stores have sendMagicLink() method

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
2026-03-27 11:23:09 +01:00
Till JS
86d1da3587 feat(inventar): add configurable inventory management app
SvelteKit web app with schema-less collections, 8 field types,
8 templates (electronics, books, furniture, etc.), 3 views (list/grid/table),
hierarchical locations, categories, full-text search, and localStorage persistence.
Includes ManaScore audit (28/100 Alpha), Dockerfile, SSO prep, and i18n (DE/EN).

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
2026-03-27 11:21:36 +01:00
Till JS
2e4bb9bad7 feat(local-first): add local-first architecture with Dexie.js, Go sync server, and Todo pilot
Implement the foundational local-first data layer for ManaCore apps:

- New @manacore/local-store package (Dexie.js IndexedDB, sync engine, Svelte 5 reactive queries)
- New mana-sync Go service (sync protocol, WebSocket push, field-level LWW conflict resolution)
- Todo app migrated as pilot: stores read/write IndexedDB, guest mode with onboarding seed data
- PillNavigation: prominent login pill for unauthenticated users
- SyncIndicator component showing local/syncing/offline status
- GuestWelcomeModal on first visit for Todo app
- Removed demo-mode auth_required checks from Todo components (all writes are now local)
- CSP fix for local development (localhost:3001, localhost:3050)

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
2026-03-27 11:17:58 +01:00
Till JS
0dfd603892 feat(auth): rate limit feedback, audit log UI, and E2E tests
Rate-limiting feedback:
- LoginPage detects 429/account-locked errors and shows countdown timer
- Submit button disabled during cooldown period

Audit log:
- GET /auth/security-events endpoint (JWT-protected) in auth controller
- getSecurityEvents() in BetterAuthService + shared-auth client
- AuditLog component with event type labels, relative dates, UA parsing
- Integrated in ManaCore settings page

E2E tests (passkey-2fa.e2e-spec.ts):
- Passkey registration/authentication flow tests
- Auth guard enforcement (protected vs public endpoints)
- 2FA passthrough route existence tests
- Edge cases (cross-user access, missing fields, token shape)

CSRF note: Already covered by Better Auth (SameSite + HttpOnly +
Trusted Origins). Token refresh already has 4-retry + offline detection.

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
2026-03-26 21:58:56 +01:00
Till JS
91116bf0f1 feat(apps): integrate shared TagStrip into all 15 remaining apps
Migrated apps with existing local tags (photos, storage, picture):
- Replace local tag stores with createTagStore wrapper
- Add shared TagStrip to layouts with tag filtering support
- Storage: new tag store, /tags management page
- Picture: migrated from Svelte 4 writables to createTagStore

New TagStrip added to 12 apps without prior tag system:
- chat, citycorners, clock, context, manadeck, manacore, matrix,
  mukke, planta, presi, questions, zitare
- Each gets: tag store, Tags toggle pill in PillNav, TagStrip overlay,
  /tags management page, fetchTags on auth ready
- All backed by central mana-core-auth Tags API

All 18 apps now have:
- Tags pill in PillNav (toggles TagStrip overlay)
- Shared TagStrip component from @manacore/shared-ui
- Tag store using createTagStore from @manacore/shared-stores
- /tags management page
- Cross-app tags via central mana-core-auth

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
2026-03-26 21:41:14 +01:00
Till JS
f5a9edcfb6 feat(auth): add TOTP two-factor authentication across all apps
Uses Better Auth's built-in twoFactor plugin for TOTP + backup codes:

Backend (mana-core-auth):
- twoFactor plugin in better-auth.config.ts (issuer: ManaCore)
- twoFactorEnabled field on users table, backupCodes as encrypted text
- 2FA redirect detection in signIn flow
- Passthrough controller forwards /two-factor/* to Better Auth
- Security event types for 2FA operations

Client (shared-auth):
- enableTwoFactor, disableTwoFactor, verifyTwoFactor, verifyBackupCode,
  generateBackupCodes methods with session-to-token exchange

UI (shared-auth-ui):
- LoginPage: 2FA code input view after password login, backup code toggle
- TwoFactorSetup: settings component with enable/disable/QR code/backup codes

App integration:
- All 19 auth stores have verifyTwoFactor() and verifyBackupCode()
- All 19 login pages pass onVerifyTwoFactor and onVerifyBackupCode callbacks
- ManaCore settings page has TwoFactorSetup component

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
2026-03-26 19:55:09 +01:00
Till JS
cf9cbebd34 feat(apps): add missing help, feedback, profile, themes, auth pages for cross-app consistency
New pages created:
- Help: citycorners, matrix (with i18n help content)
- Feedback: citycorners, matrix, photos, planta, questions
- Profile: citycorners, mukke, photos, planta, questions, todo, zitare
- Themes: citycorners, photos, planta, questions, zitare
- Forgot-password: citycorners
- Reset-password: citycorners, picture, storage

PillNavigation updated in all 18 layouts:
- helpHref, profileHref, themesHref, feedbackHref consistently set
- Dependencies added (shared-profile-ui, shared-theme-ui, shared-feedback-ui)

All 17 standard apps now have: help, feedback, profile, themes, settings,
forgot-password, reset-password, offline pages. Matrix excluded for profile/themes/auth
(uses own Matrix protocol auth).

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
2026-03-26 14:33:34 +01:00
Till JS
40ace53867 feat(help): improve help content across all 18 apps, add shared Mana & Privacy FAQs
- Expand FAQ entries from ~5 to 8-14 per app with app-specific feature documentation
- Add comprehensive features, shortcuts, and keyboard shortcut sections
- Integrate shared getManaFAQs() in 10 apps with /mana page
- Integrate shared getPrivacyFAQs() in all 18 apps with app-specific data types
- Add unit tests for help content in all 18 apps (72 tests total)
- Tests verify: DE/EN content, matching FAQ/feature counts, unique IDs, contact info

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
2026-03-26 14:32:23 +01:00
Till JS
13681df76c feat(shared): add helpHref/themesHref to PillNav, shared Mana & Privacy FAQs
- PillNavigation: add helpHref and themesHref props with help icon in account dropdown
- PillDropdown: add help icon (question mark circle) to iconPaths
- shared-help-types: add getManaFAQs/getManaFeature for shared Mana credit FAQs
- shared-help-types: add getPrivacyFAQs for shared privacy/GDPR/tech independence FAQs
- ManaScore: add Help-Seite and Feedback-Seite as UX criteria, shared-help-ui and
  shared-feedback-ui as Core cross-app packages

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
2026-03-26 14:28:38 +01:00
Till JS
e676ba6873 fix(web): use JSON.stringify for env var injection in all hooks.server.ts
Prevents potential XSS by safely serializing env values instead of using
raw string interpolation. Also creates missing hooks.server.ts for context
app and standardizes citycorners to use the same injection pattern.

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
2026-03-26 14:23:29 +01:00