ArbeitszeitCheck - Releases

Changed

• Release packaging refresh: Bumped app metadata to 1.2.5 and regenerated the signed release artifact set for App Store and GitHub publication.

Changed

• Publishable release refresh: Bumped app metadata to 1.2.4 and generated a new signed release artifact set (archive, checksums, and App Store signature) for App Store/GitHub publication.

Changed

• Release packaging refresh: Prepared a new signed App Store/GitHub release archive for the current code line using the Docker-based signing workflow.

Fixed

• Localized decimal inputs in admin settings: Daily working-hour inputs now reliably accept comma-decimals like 7,74 and preserve two-decimal precision.
• Legacy hours API payload parsing: Time-entry endpoints now parse optional decimal hour fields consistently for both comma and dot separators, preventing silent truncation in backward-compatible request formats.

Changed

• Input precision hints: Updated settings input steps/help text to align with two-decimal hour values used in 38.7-hour week scenarios.

Fixed

• Paused-entry recovery and lifecycle: Paused entries can now be accessed again in edit/delete workflows and are consistently finalized as completed when edited with an end time.
• Resume behavior for same-day paused sessions: Clock-in now resumes a same-day paused entry instead of creating duplicate automatic entries, while preserving the pause gap as break history.
• Historical paused leftovers: Added migration Version1020Date20260421000000 to repair all remaining orphaned paused rows (including cases not covered by the earlier one-time migration).

Added

• Vacation entitlement policy engine: New policy-driven calculation flow with support for manual_fixed, model_based_simple, tariff_rule_based, and manual_exception, plus admin simulation endpoint.
• Tariff rule data model and APIs: Added versioned tariff rule sets/modules and admin endpoints to create, update, activate, retire, and assign policies to users.
• Entitlement computation snapshots: Added persistent entitlement snapshots (at_entitlement_snapshots) with calculation trace/policy fingerprint for auditability and diagnostics.
• Admin notifications page: New dedicated admin UI (/admin/notifications) with HR recipient + event matrix management and a dedicated notifications settings API.

Changed

• Vacation allocation integration: Year allocation now resolves entitlement via VacationEntitlementEngine and returns entitlement source/rule-set/trace metadata in allocation payloads.
• Policy migration compatibility: Existing user model vacation values are backfilled into policy assignments during migration (Version1018Date20260420123000) to keep legacy installs consistent.
• Admin settings flow: Absence notification-related controls (carryover expiry/cap, rollover switches, substitute-required types, iCal and substitution-mail toggles) are centralized on admin notifications APIs/UI.
• Working time model schema: Added work_days_per_week to at_models (Version1019Date20260420150000) to support entitlement formulas.

Fixed

• User deletion cleanup: Deleting a user now also removes vacation policy assignments and entitlement snapshots, preventing orphaned policy/computation data.

Fixed

• Approver deadlock (app teams): Absence and time-entry correction workflows no longer treat “has colleagues” as “has a manager”. Auto-approval when no assignable approver exists now follows TeamResolverService::hasAssignableManagerForEmployee() (explicit team managers in app-teams mode; legacy group mode still uses colleagues as a proxy). Prevents requests stuck in “awaiting manager approval” when nobody can approve.
• Time entry corrections: Same assignability rule as absences (previously used colleague IDs only).
• Admin users API requests on /index.php instances: Refresh/edit/history/update actions now reliably resolve app URLs and no longer produce invalid requests like search=[object PointerEvent].
• Admin teams and settings API reliability on rewrite-less setups: Central URL resolution now includes a robust /index.php fallback when OC.generateUrl() is unavailable/incomplete in page context.

Added

• Repair step ReleaseStuckPendingAbsences: post-migration repair auto-approves legacy pending absences that still match the “no assignable approver” condition (idempotent).
• Frontend URL security guardrails: Shared AJAX layer now blocks external cross-origin calls by default (explicit allowExternal: true required), with unit tests covering URL normalization and external URL handling.
• Lint guardrails: ESLint rules now prevent introducing raw fetch('/apps/arbeitszeitcheck/...') and implicit external fetch(...) patterns outside approved abstractions.

Changed

• UX: Absences UI shows an informational callout when app teams are enabled and no approver is assigned; detail view shows a defensive warning if an old pending row is still stuck (until repair/admin fixes team setup).
• Frontend architecture: ArbeitszeitCheckUtils now provides centralized getRequestToken(), resolveUrl(), and isExternalUrl() primitives used by page scripts (admin-users, reports, settings, validation).
• Mobile UX consistency (WCAG 2.1 AA focused): iPhone-safe-area-aware spacing, improved touch targets, clearer section rhythm, and better visual hierarchy for normal user pages (dashboard, time-entries, absences) and manager pages (manager-dashboard, manager-time-entries, employee absences view).

Documentation

• User manuals (EN/DE), tests/WORKFLOW_ROLE_MATRIX.md, and developer documentation updated for assignable-manager semantics and repair step.
• README and developer documentation updated with centralized frontend URL policy, strict external-call behavior, and mobile/iOS layout guidance.

Added

• Month closure grace period and auto-finalization: Admin setting month_closure_grace_days_after_eom (0–90, default 0). After end-of-month, employees have that many calendar days to finalize manually; if the month is still open afterward, a daily background job finalizes it automatically (same snapshot as manual finalize). Pending time entry approvals and open absence workflow states block auto-finalization. Reopening remains admin-only.
• App-admin allowlist: New admin setting app_admin_user_ids to restrict ArbeitszeitCheck administration to a selected subset of Nextcloud admins. Empty selection keeps backward-compatible behavior (all Nextcloud admins can administer the app).
• Security role-gating Docker test target: Added scripts/test-security-role-gating-docker.sh wiring via make test-security-role-gating-docker and composer test:security-role-gating:docker for fast authorization regression checks in containerized setups.

Changed

• Month closure UX and API: Employee UI uses a clearer card layout, visible feedback for success/errors (WCAG-friendly), server-driven canFinalize with localized block reasons (feature off, future month, pending approvals). Manual finalize rejects future calendar months. Absence workflow (pending, substitute_pending, substitute_declined) is enforced alongside pending time entry corrections. Unauthorized API access returns 401 where appropriate. Admin settings: dedicated “Month closure” section; grace-days field stays editable with copy explaining it is saved even when closure is off; reopen uses searchable employee picker and clearer administrator vs. employee wording. Form validation error callouts use higher-contrast text and tinted surfaces across themes. Auto-finalize job logs per-user failures for operations.
• Release/signing workflow hardened for integrity checks: make release-signed now signs the extracted release archive payload (not the local development checkout), validates forbidden development paths are excluded, and repacks the signed archive for deployment/App Store upload.
• Admin authorization enforcement: Access to AdminController routes now uses middleware-level app-admin checks with a dedicated exception and a consistent 403 response page for authenticated users without app-admin rights.

Documentation

• Deployment guidance: Release docs now explicitly require production deployment from the signed tarball only and document the common integrity-failure pattern (.git/* / node_modules/* lists) caused by signing a dev tree.
• Deployment helper script: Added release/deploy-from-release.sh to deploy from signed release archives with safety checks (forbidden path scan, required signature.json, optional app disable/enable and occ integrity:check-app).
• Admin operations: User/developer docs now describe how to configure app-admin allowlisting, what the default fallback is, and how to verify authorization gating in Docker-based test runs.

Added

• Revision-safe month finalization (optional): Admin toggle month_closure_enabled (default off). Employees can finalize a full calendar month; the app stores a canonical JSON snapshot, SHA-256 hash chain, append-only revision rows, audit events, and a minimal PDF download. Finalized months are read-only through normal app APIs; administrators may reopen a month with a mandatory reason (audit). Monthly reports for a finalized month use the stored snapshot. Database: at_month_closure, at_month_closure_revision (migration Version1014Date20260409120000).

Documentation

• User manuals (EN/DE), developer documentation, and compliance notes updated for month closure, retention context, and limits (in-app tamper evidence, not QES).

Added

• Manager employee absences view: New in-app page and API for managers/admins to review employee absences with secure scope filtering, pagination, and localized status labels.
• Working time model copy flow: Added copy action with modal UX, unique default naming, and safeguards against duplicate submits.

Changed

• Manager navigation structure: Sidebar regrouped into clearer manager/admin submenus; reports moved under manager context; compliance link placement adjusted for reduced top-level clutter.
• Manager employee time entries UX: Date defaults and formatting/translation handling improved for clearer filtering behavior.
• Calendar behavior (rollback cleanup): Removed in-progress direct calendar-write functionality and related admin controls/status/test endpoints. The supported behavior remains unchanged: no Nextcloud Calendar app sync; optional .ics attachments are sent by email for configured absence workflows.

Fixed

• Working time model modals: Corrected copy modal interaction flow, source-model presentation, and delete-confirmation localization/rendering issues.
• Absence iCal hardening: Added stricter status/date guards, recipient deduplication, and privacy-safe event descriptions for substitute/manager recipients.

Documentation

• User manuals and changelogs updated to reflect the final calendar model (email .ics optional, no direct Nextcloud Calendar app sync) and current manager/admin UX structure.

Added

• Vacation rollover: VacationRolloverService, background job, occ arbeitszeitcheck:vacation-rollover, migration Version1013Date20260407120000 with at_vacation_rollover_log; unit tests.

Changed

• Frontend l10n: Shared templates/common/main-ui-l10n.php and teams-l10n.php so translated strings are available early across pages; related template and JS updates.

Fixed

• Manager dashboard — pending absences: API includes summary.typeLabel (server-localized absence type); UI prefers it so cards show translated labels (e.g. German Urlaub) instead of raw codes like vacation.

Documentation

• docs/Developer-Documentation.en.md: pending-approvals API note for typeLabel; user manuals (EN/DE): manager pending approvals show localized absence types.

Added

• Development tooling: occ arbeitszeitcheck:generate-test-data CLI for deterministic demo data (time entries, absences, optional violations, demo app team) to exercise UI, reports, and workflows locally.

Fixed

• Reports UI: Report type cards are no longer incorrectly disabled when a team-related scope is selected (team scopes still use the team report API where applicable).
• Reports (tests): Team report CSV download test now reads download bodies via DataDownloadResponse::render() (Nextcloud API).
• Team reports: Deduplicate user IDs before permission checks and aggregation to avoid double-counting when users appear in multiple teams.
• Absence type badges: Stronger, theme-safe contrast for vacation / sick / home office / other badges (readable on pale Nextcloud palettes).

Changed

• Compatibility (dev): Local development stacks aligned with Nextcloud 33.x (example: official nextcloud Docker image).
• Reports layout: Reverted an overly aggressive “full width” parameter form rule that could interfere with scrolling/layout on the reports page.

Fixed

• Admin settings API URL handling: Prevented duplicate index.php/index.php path generation when a route URL is already pre-generated by Nextcloud.
• Frontend error handling: Avoided unhandled Promise rejections in callback-based Utils.ajax() consumers after expected API failures.

Fixed

• Routing/compatibility: Added indexApi() compatibility aliases for legacy endpoints to prevent 500 errors in the Nextcloud log.
• PHP fatal errors: Fixed constructor signature issues in AbsenceService and ComplianceService that could crash the app when loading services or saving settings.
• Reports security hardening: Hardened report preview endpoints with start <= end validation and a maximum date-range limit to reduce DoS risk from untrusted parameters.
• Admin “whole organization” scope: Correctly handle admin organization scope (userId="" = all enabled users) and enforce access checks so preview/download data stays consistent.
• Reports rendering: Improved Preview rendering for absence and compliance reports to match the actual report data structure.

Changed

• Reports UI semantics: Team scope is limited to the team overview/export semantics that the backend actually returns (prevents misleading previews/downloads).
• Organization download guidance: Added explicit UI messaging for organization scope download limitations until organization-wide export endpoints are implemented.

Fixed

• ArbZG compliance: Corrected break check logic (9h/45min branch now reachable; check ≥9h before ≥6h)
• Manager logic: employeeHasManager() now uses getManagerIdsForEmployee() instead of getColleagueIds()
• Reporting: getTeamHoursSummary() respects period parameter (week/month)
• Admin users: hasTimeEntriesToday is now per-user, not system-wide
• UserSettingsMapper: Fixed falsy zero/empty-string handling in getIntegerSetting, getFloatSetting, getStringSetting
• Routing: Moved exportUsers route above getUser to fix route shadowing
• Version1009 migration: Replaced MySQL backtick SQL with portable QueryBuilder; use OCP\DB\Types
• Duplicate notifier: Removed double registration from Application.php boot()
• API security: Generic error messages instead of raw exception output (SubstituteController, GdprController)
• PDF export: Returns HTTP 422 with clear message instead of silent CSV fallback
• LIKE injection: WorkingTimeModelMapper::searchByName() uses escapeLikeParameter()
• XSS: Modal titles escaped in components.js; compliance-violations.js innerHTML escaped
• Admin-settings form: Added CSRF requesttoken
• AbsenceService DI: Fixed constructor argument order (IDBConnection)
• Admin holidays and settings: English source strings for l10n keys
• UserDeletedListener: inject TeamMemberMapper and TeamManagerMapper
• XSS: sanitise team names in admin-teams.js

Changed

• CSS: Shadow-light variable, scoped resets, dark-mode color-mix fixes, semantic color variables, navigation height/z-index
• Clock buttons: Double-submit guard (disabled during API calls)
• initTimeline(): Max retry count (20) to prevent infinite loop
• Accessibility: aria-label on header buttons, label for admin user search, aria-modal on welcome dialog, English l10n keys in navigation
• Docs: Removed internal docs; added docs/README; corrected repo URLs
• Manager dashboard: Injected l10n from PHP so JS translations work
• Constants.php for magic numbers; user-facing error messages

Added

• Version1010 migration: Compound indices on at_entries, at_violations, at_holidays, at_absences

Changed

• Long-term refactor: Replaced all \OC::$server usage with proper OCP APIs and constructor injection
• CSPService: Injected ContentSecurityPolicyNonceManager via constructor
• Controllers: Removed manual cspNonce (configureCSP handles it); injected IURLGenerator, IConfig where needed
• PageController: Injected IURLGenerator, IConfig; passes urlGenerator to templates
• HealthController: Injected IDBConnection for database check
• ProjectCheckIntegrationService: Injected LoggerInterface instead of OC::$server->getLogger()
• Templates: Replaced \OC::$server with \OCP\Server::get() (OCP public API)
• Added GitHub Actions release workflow (.github/workflows/release.yml)
• Updated PageControllerTest with full constructor mocks

Fixed

• Resolved duplicate route names in absence API (absence#store, absence#show, absence#update, absence#delete)
• Corrected settings class names in info.xml to use full OCA namespace
• Added declare(strict_types=1) to routes.php

Changed

• Removed non-existent screenshot references from info.xml until real screenshots are captured

Fixed

• Install and upgrade path hardened. appinfo/info.xml now declares MySQL/PostgreSQL under <dependencies> (required by MigrationService for correct schema checks). EnsureArbeitszeitCheckSchema runs on install and before every post-migration repair chain so missing tables are recreated and failures surface in occ upgrade logs instead of a half-updated app with no UI feedback. Schema checks use the active table set only (legacy at_absence_calendar was dropped in migration 1012 and must not block upgrades). Repair steps use OC\DB\Connection for MigrationService, matching core occ upgrade.
• Post-migration repair DI. ReleaseStuckPendingAbsences is registered in Application.php with AbsenceService (same as BackfillAbsenceDays + HolidayService) so occ upgrade never instantiates repair steps with wrong constructor arguments after partial deploys.
• Admin schema banner. All admin pages show a critical callout when tables are missing, with pluralized guidance to run occ upgrade and deploy the full app bundle.
• Onboarding API no longer fakes success when the database is incomplete — returns SCHEMA_NOT_READY (503) with a clear message instead of “will be saved after database migration”.
• Health endpoint reports incomplete schema (missing table count) before the generic connection check.

Added

• SchemaHealth, EnsureArbeitszeitCheckSchemaTest, and extended UpgradeRepairIntegrationTest for the production upgrade container path.

Added

• Organisation-wide time recording methods (#16): Administrators can disable clock in/out (stamping) and/or manual time entries for everyone under Admin → Global settings → Time recording methods. Per-employee restrictions remain under Admin → Employees → Edit → Time recording. Organisation rules are enforced on every API path (clock, manual entries, dashboard, mobile bootstrap, desklet). Missing clock-in reminders are suppressed when stamping is off. Audit log shows a dedicated label for organisation changes; integration and E2E tests cover org-vs-employee layering and API enforcement.

Fixed

• Nextcloud Administration settings panel: organisation time capture checkboxes now load persisted values (previously always showed both methods enabled).
• Employee time capture validation: disabling both methods is rejected before persistence (HTTP 400, not 500).
• Admin settings status badge: uses shared WCAG-AA .azc-badge variants instead of low-contrast solid fills.

Unreleased

Fixed

• Callouts and notification icons (all Nextcloud themes): unified templates/common/alert-callout.php and css/common/notification-surfaces.css with theme-safe panel tints and semantic icon wells (same contrast model as the page header). Replaced invisible Lucide h.01 SVG marks in IconCatalog with visible accent dots; added IconCatalog::renderCalloutWell() and variant classes (azc-notif-icon-well--warning, etc.) so warning/danger/info glyphs stay identifiable on light, dark, high-contrast, and custom themes. Admin notifications save feedback uses matching callout styling and role="alert" on errors.

• Admin → Teams: member/manager picker now finds people by name (#14): the people picker searched the directory by user id only (IUserManager::search()), so on instances where the user id is an email, employee number or UUID, typing a person's name returned nothing — most of the directory was effectively hidden. All admin/manager people search now matches user id OR display name (shared UserDirectorySearch helper) across Teams, the Employees list, the company-status dashboard, the manager month-PDF picker and the scoped-employee picker. The Teams picker additionally excludes already-assigned members/managers server-side (exclude[]) so a large unit can no longer fill the capped result page with people already on the team, and shows a clear "Showing the first N matches — keep typing to narrow it down" hint (announced to screen readers) when more matches exist.

• Admin → Employees and time-entry tables: inflexible width / clipped actions (#12): table-heavy pages now use the wide shell (time-entries, absences, manager lists, compliance lists); .table-container scrolls horizontally only when columns need more space; action columns use min-width: max-content so Edit/History buttons stay fully visible on desktop; mobile keeps card reflow (azc-table--responsive + data-label). Manager scope pages no longer cap list width at 56rem. Playwright regression: tests/e2e/table-width-desktop.spec.js.
• Admin → Holidays: auto-restore now respected when deleting statutory holidays (#17): deleting a statutory holiday while Auto-restore is disabled records a per-(state, date) suppression (at_holiday_suppress) so the day stays removed in both the admin list and the calendar after a reload; re-enabling auto-restore revives the day and clears the stale suppression. The admin list and the working-day calendar now read from the same DB-backed source, so they can no longer diverge.
• Admin → Holidays: "Default federal state" select is now functional: the control on the Holidays page was rendered but never wired up — choosing a state did nothing. It now persists the organisation default state immediately (with disabled/aria-busy state, success/error feedback, and rollback on failure) via the existing admin settings API.
• Admin → Holidays: statutory holidays are forced to full-day: saving a statutory holiday now always stores kind=full (the working-day engine already treats statutory days as full-day), so the table badge can no longer claim "half-day" for a day that is counted as full.
• Admin → Holidays: honest delete feedback: removing a statutory holiday while auto-restore is enabled now states the day will be added back automatically, instead of a misleading "Holiday was removed" message.
• Sachsen-Anhalt statutory holidays (#13): GermanStatutoryHolidayCatalog seeds Epiphany (6 Jan) and Reformation Day for ST while excluding Corpus Christi and All Saints; auto-restore prunes legacy generated rows that used nationwide rules. occ arbeitszeitcheck:holidays:verify now reads the DB without reconciling first and fails when extra statutory rows remain (not only when catalog dates are missing).
• Admin → Employees: entitlement preview UX: human-readable summary line for HR; full calculationTrace JSON only inside a collapsible Technical details (audit) block (WCAG-friendly, no raw dump in the main form).

• Unified date format for Stichtag: overtime tracking start date uses the same dd.mm.yyyy datepicker as assignment validity dates (admin edit dialog and Nextcloud “New account” panel); values are converted to ISO before save.

• Admin → Employees: overtime Stichtag / opening balance not saved: UserOvertimeSettingsService passed the Nextcloud user id (string) as the audit log entityId (must be ?int), causing a TypeError on every Stichtag or Eröffnungssaldo write — with the atomic profile save this rolled back the whole transaction and surfaced as “Benutzer konnte nicht aktualisiert werden”. Audit entries now use null entity id (same pattern as time-capture settings).

• Admin user pickers (Teams, month reopen, overtime audit, vacation simulator): replaced the old 50-user dropdown cap with a searchable combobox (GET /api/admin/users?picker=1), minimum 2-character search, enabled accounts only, and shared WCAG-friendly styling. Legacy GET /api/admin/vacation-layers/users delegates to the same picker API.
• Admin → Employees list: browse all accounts with Previous / Next pagination (50 per page) and honest search feedback; empty search no longer hides employees beyond the first page.
• Manager employee filters (time entries, absences, record-absence form): replaced large <select> lists with the shared searchable combobox scoped to the manager’s team (GET /api/manager/scoped-employees); admins search the directory, managers only see their team.
• Admin company-status dashboard widget: status totals now scan up to 500 enabled accounts (was 200) and note when the directory is larger, with a link hint to Employees for the full list.
• Admin → Employees: server validation errors from the atomic profile save are now mapped to the matching form fields (instead of only a generic toast), with focus moved to the first invalid control.

Changed

• Admin → Employees: clearer “Find an employee” search with help text; pagination status shows ranges (1–50 of 150) or match counts when searching.
• Admin → Employees (edit dialog load): vacation policy for future-dated work-schedule assignments is resolved as of the assignment start date, not only “today”, so opening and saving no longer mis-defaults to “inherit” and triggers a failed save.

Fixed

• Calendar day details panel (#11): side drawer sits below the Nextcloud header (close control no longer hidden under the profile menu); calendar and app navigation stay visible while the panel is open; switch days without closing; close via X, Escape, or click outside; live header offset via syncAzcOverlayMetrics(); Vitest coverage in js/calendar-day-panel.test.js.

Changed

• Overlay tokens (--azc-overlay-top / --azc-overlay-height) shared for fixed panels and mobile nav; theme-safe dashboard callouts (WCAG 2.1 AA contrast on all Nextcloud themes).

Added

• Unified layout system: css/common/page-patterns.css with .azc-page-stack, .azc-shell--wide / --minimal, shared filter grid, empty/loading states; shellWidth on page shell (auto-wide for dashboards, admin tables, manager lists).
• Shared filter panel partials (templates/common/azc-filter-panel.php) and admin app teams callouts when use_app_teams is off.
• Dialog API: ArbeitszeitCheckComponents.openDialog(); modals use inert on nav/main instead of aria-hidden on #app-content (live regions stay available).
• AzcApi.isApiSuccess() for consistent JSON success checks.
• E2E: tests/e2e/layout-smoke.spec.js, tests/e2e/a11y-smoke.spec.js (@axe-core/playwright, WCAG 2.1 AA tags).

Changed

• All routed pages wrapped in .azc-page-stack; legacy .section chrome reset inside the app shell; .btn aliases to .azc-btn styling under #app-content.azc-app.
• Admin teams page uses full page shell (buildAdminShellParams); navigation exposes a single skip link to app nav (main content skip remains in page-start).
• Personal settings (Nextcloud user settings) and SettingsController load assets via FrontEndAssetService::registerCore() only.
• tests/WORKFLOW_ROLE_MATRIX.md: manager role requires app teams; /reports is manager/admin only.

Fixed

• Admin users page: pagination label uses {shown} / {total} placeholders and TemplateL10n for JS export — fixes Internal Server Error from json_encode($l->t('Showing %d of %d employees')) without vsprintf arguments.
• Employee absence request form: azc-card layout, visible page title, workflow callouts (auto-approve vs manager/substitute path), fieldsets for request details and substitute (fixes duplicate “Substitute” label), side-by-side dates, clearer optional/required labels, azc-btn actions.
• Time entry create/edit form: page shell + assets via TimeEntryController; timezone and approval callouts; azc-card with fieldsets (date/time, breaks, note); aligned break matrix labels; dynamic breaks match PHP a11y; responsive fieldset layout (WCAG 2.1 AA).
• Absence create/edit/view routes: AbsenceController now uses PageShellTrait + form assets (same gap as time-entry create had — broken nav/header without shell); errors render on the list page with a visible callout instead of a blank layout.
• Time entry edit errors: denied or failed edits show the list layout with shell, assets, and an error callout (no half-rendered page).
• Navigation flags: centralized in NavigationFlagsService + NavigationFlagsTrait (all page controllers including Manager, Substitute, Compliance) — removes duplicated getNavigationFlags() implementations; compliance pages use forComplianceUser() (substitution nav hidden).
• Absences list filter: legacy .section filter replaced with azc-card / azc-filter-grid (matches time entries list UX).
• API compliance gate: blockingIssuesForCompletedEntry() + pre-save check in apiStore / update / store — ArbZG §4 break rules always block invalid manual entries server-side (strict mode adds further checks without writing violations before persist).
• Calendar absence indicators: month/week cells show readable chips (type label + approval status + tinted icon), not icon-only strokes; week view shows absences; day panel lists status; legend explains approved vs pending; forced-colors and theme-safe contrast.
• Manager month-closure PDF page: refactored to azc-card step wizard (numbered steps, person rows with azc-btn downloads, standard-width shell); removed narrow floating column layout.
• Manager absences & time entries: legacy .section / .btn layout replaced with azc-page-stack, azc-card filter/results blocks, shared azc-filter-grid, standard-width centered shell (like month-closures), and azc-empty-state / azc-btn patterns.
• Manager dashboard: migrated from legacy .section blocks (broken by shell section reset) to azc-card sections, admin-style stat tiles, standard-width centered layout, and azc-btn export action.
• Admin holidays: refactored to azc-card layout, shared azc-filter-grid toolbar, table-container / table--hover, scoped CSS under azc-app--admin-holidays, and azc-btn row actions (fixes broken .admin-holidays-page selectors).
• Admin vacation layers: azc-page-stack + azc-card sections (intro, L0/L1/L2, simulator), table-container / table--hover, scoped layout under azc-app--admin-vacation-layers (removes duplicate page padding and standalone .layer-card chrome), azc-btn / azc-badge throughout.
• Employee time entries (list): timezone callout, stats, month closure, filter panel, and entries table use azc-card / azc-callout / azc-filter-grid; toolbar buttons relocate to the page header; scoped layout under azc-app--time-entries (fixes double margins from legacy .section / .stats-grid).
• Dashboard overtime balance: negative and positive balances use main text on tinted pills instead of raw --color-error / --color-success, so large values stay readable in all Nextcloud themes (WCAG contrast).
• Unified data tables: page-patterns.css defines one table system under #app-content.azc-app (.table-container + .table.table--hover, action columns, empty/loading cells); all routed list templates and dynamic report/admin tables migrated off legacy table-responsive / bare grid-table; TableConventionTest guards the convention.
• Manager absences & time entries: filters moved into the list card as a flat toolbar directly above the table (no nested box or azc-filter-panel accent); dedicated filter grid alignment (no subgrid glitches); “Record approved absence” sits below the list.
• Audit pass (workflows / a11y / security): l10n for app-teams callouts (en/de); admin teams full shell; working time model delete fail-closed typed DELETE; calendar day panel inert + focus trap + Escape; admin settings azc-callout errors; manager dashboard error path includes team-mode URLs.
• Breadcrumb trail: simplified shell markup (no separator <li> nodes) and scoped styles so the trail reads as one line — primary link, muted section, bold current page — with CSS / dividers and ellipsis on long titles.
• Compliance dashboard cards: migrated status and violations blocks to azc-card header/body layout (title + help left, actions right, sized button icons); removed broken card-header--with-actions stacking.
• Admin dashboard layout: fixed styles targeting wrong .admin-dashboard class (shell uses azc-app--admin-dashboard); removed extra .section padding; azc-callout warning banner; stat cards grid; issues block in azc-card.
• Confirm dialog typed phrase (client): if the translated label still contains %s after t() (e.g. test stubs or missing substitution), the requested phrase (DELETE, REMOVE, …) is applied so destructive prompts never show a raw placeholder.
• GDPR delete UX: when confirmDialog is unavailable, settings now surfaces an assertive error instead of failing silently; confirmation results use shared isConfirmAccepted / confirmDialogReason helpers.
• Fail-closed destructive confirms: Utils.confirmDestructiveAction() blocks month finalization, month reopen, correction withdraw, and overtime payout (single/bulk) when the dialog API is missing or the user cancels — no silent proceed (audit-critical). All admin delete paths (holidays, teams, vacation layers, tariff retire) now use the same helper.
• Month closure lock notice (W7): shared templates/common/month-closure-lock.php with lock icon; shown on time entries when the selected month is finalized.
• Settings UX: sections use azc-card spacing and azc-btn controls for clearer visual hierarchy (WCAG-friendly grouping unchanged).
• Substitution requests page: removed duplicate <h1> and orphan </div> (invalid HTML); styles now target .azc-app--substitution-requests so the shell layout applies; empty state uses azc-empty-state pattern.
• Dashboard clock double-submit (W11): setLoadingState() sets aria-busy="true" on clock/break buttons while API calls are in flight (with disabled state and loading label).
• Reports DATEV discoverability (W23): administrators see help text under file format pointing to Global settings → Exports and reporting (CSV/JSON remain on this page).
• Admin notifications (W13): sticky save footer, beforeunload when the form has unsaved changes, and aria-busy on save while the request is in flight.
• E2E vacation seed (ensure-e2e-vacation): UserVacationPolicyAssignment no longer pre-initialises vacation_mode, so INSERT always persists the column (fixes SQL 1364 on strict MariaDB).
• Clock status API (ArbZG calendar-day): at_daily_maximum and session_hours_on_calendar_today are now always returned (including when clocked out) so clients can block clock-in without an active session; overnight E2E asserts the contract when daily max is reached.
• E2E clock seed (ensure-e2e-clock): dev/CI-only OCC command for e2e_* users clears active sessions and backdates the last completed entry when ArbZG §5 rest would block Playwright clock-in; wired into run-e2e-docker.sh.

Added

• Vitest: js/common/components.test.js (focus trap / aria-hidden / typed-confirm label) and isConfirmAccepted coverage in utils.test.js.

Fixed

• Production-grade audit hardening pass (UX-parity follow-up):
• Manager dashboard (js/manager-dashboard.js): fixed an unbalanced paren on the team-overtime “Payout eligible: %s h” line that prevented the file from parsing, hiding the entire team status panel.
• Admin users (js/admin-users.js): the two opening-balance year validation messages were calling an undefined t() helper; they now use the page-local auMsg() so the German/English text is announced correctly via the messaging live region.
• Icon catalog (js/common/catalog.js): removed a duplicate calendar-off entry that produced silent overrides on load.
• Confirm dialog typed phrase (js/common/components.js): when callers passed a non-default typedConfirmPhrase (e.g. REMOVE), the label still said Type DELETE to confirm because the translation already substituted %s. The label is now resolved with the requested phrase so destructive prompts are honest.
• Stylesheets: replaced the deprecated clip: rect(...) screen-reader pattern with clip-path: inset(50%) in css/app.css and css/manager-time-entries.css; reordered border-color before border-left-color on .inline-notice--warning/--info so the longhand override actually wins; replaced two empty /* */ block comments that tripped stylelint.
• GDPR data deletion now persists the user-supplied reason: GdprController::delete() reads the reason parameter posted by the destructive confirm dialog (js/settings.js already sent it), trims/clamps it to 500 chars, and writes it into the gdpr_data_deletion_request audit log entry alongside the existing IP/user-agent stamp. Retention-period enforcement is unchanged.
• Tariff rule sets now produce a complete audit trail: AdminController::createTariffRuleSet/updateTariffRuleSet/activateTariffRuleSet/retireTariffRuleSet/deleteTariffRuleSet each write a structured tariff_rule_set_* entry with old/new snapshots (code, version, jurisdiction, status, activation mode, validity window, module list). Previously these admin mutations went through unnoticed.
• Admin authorization now returns JSON for API/AJAX callers: AppAdminMiddleware no longer serves an HTML 403 page when an unauthorized admin endpoint is hit via fetch/XHR or /api/... URLs. AJAX consumers now receive { ok: false, error: { code: 'admin_required' } } with HTTP 403, while browser page loads still get the standard core/403 template. Defensive guards keep the path safe under CLI/test runners. Covered by AppAdminMiddlewareTest (HTML, /api/ path, XMLHttpRequest header) and AppAdminAuthorizationIntegrationTest.

• Single source of truth for front-end assets: removed the duplicate CSS/JS list from Application::boot() — every page entry point now goes through FrontEndAssetService::register{Core,Page}(), including app-vanilla.css which is now imported by css/app.css. This eliminates load-order surprises and silent drift between the bootstrap loader and the central asset bundle.

• Night / overnight shifts (Wachdienst): ArbZG §3 daily maximum and automatic clock-out now use a single DailyWorkingHoursCalculator (calendar-day clipping at midnight). All enforcement paths aligned: live sessions, clock-in, compliance checks, manual entries, automatic breaks, break reminders. Fixes false auto clock-out shortly after midnight. Frontend auto clock-out only when at_daily_maximum is true (never client extrapolation alone). User stats and manager week/month totals now use getWorkingHoursForPeriod() (same calculator). Compliance “excessive working hours” violations now use findAllCalendarDaysExceedingMaximum() (no false positives on legal 22:00–08:00 rows). Audit reference: docs/DAILY-HOURS-AUDIT.md. E2E: tests/e2e/overnight-daily-maximum.spec.js.

Fixed

• New account + overtime tracking start date: the start date is captured reliably when clicking Create (no longer bound to the wrong dialog); the OCS hook runs only for POST …/cloud/users without sub-paths (LoadUsersSettingsArbeitszeitListener).
• Manager correction: data-entry-summary is emitted like PHP with JSON hex-encoding; display times (displayStartTime / displayBreaks); empty clock values show -- instead of misleading 00:00.
• Overtime: a future tracking start date no longer produces a fictitious negative balance in the current period.
• Opening balance year: server validates exactly four digits (2000–2100); client validates before save (OpeningBalanceYearValidator).

Fixed

• App enable / migration on Oracle-compatible Nextcloud installs where physical table names must stay within the 30-character limit (dbtableprefix + logical name). The overtime opening-balance table is now at_user_ot_year_bal (migration 1025), and migration 1026 renames the legacy at_user_overtime_year_balance table in place on instances that already created it, including PostgreSQL sequence cleanup. No data is copied or dropped except dropping an empty stray target table left by a failed prior attempt (same safety model as ProjectCheck table renames).

Added

• Manager employee time entries & absences — accessible filter bar (templates/manager-time-entries.php, manager-absences.php, css/manager-time-entries.css, js/manager-time-entries.js, js/manager-absences.js): two-row CSS grid with aligned labels/controls, WCAG 2.1 AA patterns (fieldset, aria-live errors, visually hidden sublabels), client-side date validation, and a 365-day maximum range enforced in the browser and on list APIs (ManagerController).
• Manager direct correction dialog on employee time entries (js/manager-correction-dialog.js, js/common/time-entry-clock-form.js, lib/Support/TimeEntryClockPayloadBuilder.php, shared correction l10n partial): European date + clock matrix, optional breaks, server-side payload builder with unit tests.
• TemplateL10n + templates/common/manager-employee-list-l10n.php: safe server-side JS translations (single json_encode of plain strings) — fixes Internal Server Error from json_encode($l->t('…%d…')) without vsprintf arguments on manager list pages.

Fixed

• Employee time entries page crash (ValueError in L10NString / vsprintf) when loading manager list l10n; %d strings are now translated with explicit parameters before JSON output.
• Compliance violations filter/export UX and admin dashboard overtime onboarding tweaks included in this release train.

Changed

• User manual (docs/User-Manual.en.md, docs/User-Manual.de.md) updated for manager list filters and correction workflow.

Fixed

• completePausedEntry() preserves an existing end_time on legacy paused rows that already carry a frozen end timestamp (status/end_time mismatch). Without this guard the service could overwrite payroll-relevant hours with updated_at.
• RepairOrphanedPausedEntries now sets ended_reason and policy_applied when it only flips paused → completed for rows that already have end_time, keeping upgrade-time repairs audit-consistent with steps 2–3.

Tests

• New: testCompletePausedEntryPreservesExistingEndTime.
• All 568 unit tests pass.

Added

• One-click recovery for "paused" time entries (issue: time-tracking/paused-entry-recovery, addresses upstream reports of "pausierte Einträge nicht bearbeitbar/abschließbar" and "HTTP 500 beim Ausstempeln, keine UI-Methode zum Heilen"). A new dedicated endpoint POST /api/time-entries/{id}/complete finalises an entry stuck in paused in a single, race-safe step. The end time defaults to updated_at (the moment the broken clock-out froze the row) and falls back to start_time as a zero-duration safety net; ArbZG §4 (automatic break) and ArbZG §3 (daily maximum) are applied so the resulting completed row is compliance-equivalent to a normal clock-out. Every recovery is audit-logged with time_entry_paused_completed, ownership is enforced, and the per-user mutation lock is honoured.
• "Complete session" affordance on the dashboard and time-entries list. When a session is in paused, the dashboard status card now shows a clearly-labelled "Complete session" button next to "Resume after break", and the time-entries list shows a primary "Complete" button per affected row plus a role="status" banner explaining the state in plain language. WCAG 2.1 AA: minimum 44×44 touch target, ARIA labels/titles, never colour-only signalling.
• TimeTrackingService::completePausedEntry() as the canonical programmatic recovery path. The controller is now a thin shell that parses input, delegates to the service, and maps domain exceptions (BusinessRuleException → 400/403, MonthFinalizedException → 409, LockedException → 423, DoesNotExistException → 404) — never a generic HTTP 500 for a known business state.
• TimeEntryMapper::findAllPausedByUser() + post-migration repair step RepairOrphanedPausedEntries that idempotently closes any leftover paused row on every occ upgrade: rows with an end_time are flipped to completed, rows without one are closed at updated_at (or start_time as a fallback).
• Layered vacation entitlement — degraded-state trace flags & impact preview (issue: hr/vacation-entitlement-hierarchy follow-up). The resolution trace now carries explicit degraded_org_default_collision (REQ-ENT-10), partial_history (REQ-ENT-13 / EC-11), clamped + raw_* values (EC-08), rule_set_status_warning (EC-05), and degraded='model_lookup_failed' (EC-04) markers so auditors can see misconfigurations and best-effort historical resolutions instead of silent fallback. The admin simulator surfaces these flags as labelled chips alongside the result; the employee explainer surfaces a redacted subset (degraded, clamped, partial_history) without leaking any internal IDs (REQ-SEC-05).
• Impact preview endpoint GET /api/admin/vacation-layers/impact?scope={org,model,team}&targetId={int} (REQ-UX-03). The vacation-layer dialog now shows "Up to N employees may be re-resolved by this change" inline before the admin clicks Save, with WCAG-compliant colour states that are never colour-only (icon + status text + ARIA live region).

Changed

• TimeTrackingController::buildSafeErrorResponse() now catches OCP\Lock\LockedException explicitly and returns HTTP 423 with a translatable "Another change to your time tracking is in progress" message, eliminating the opaque HTTP 500 reported on parallel clock-out / break-start.
• Paused / break / rejected status badges in the time-entries list now use semantic warning / error styling with descriptive title attributes so the state is conveyed via icon, colour, and text (WCAG 1.4.1).
• LayeredVacationConflictException for lock contention (REQ-SEC-04 / EC-07). LayeredVacationDefaultsService now wraps Nextcloud's OCP\Lock\LockedException so the AdminController returns HTTP 409 with a translatable "another administrator is editing this layer" hint instead of a generic 500. The admin JS surfaces the message in the dialog feedback area rather than dismissing the form.

Fixed

• Navigation icons script — remove duplicate navigation-icons.js IIFE that registered a second DOMContentLoaded handler; expose window.ArbeitszeitCheckNavigationIcons.apply for dynamic [data-lucide] placeholders after page load (CSP-safe local SVGs).

Tests

• New: 5 cases in TimeTrackingServiceTest covering the paused-entry recovery path.
• New: LayeredVacationEntitlementEngineTest, LayeredVacationDefaultsServiceTest, and AdminControllerTest cases for degraded-state flags, impact preview, and 409 lock mapping.
• All 567 unit tests pass.

Security

• CSRF protection on all state-changing endpoints: Removed #[NoCSRFRequired] from POST/PUT/DELETE methods in AbsenceController, TimeEntryController, TimeTrackingController, ComplianceController, SubstituteController, SettingsController, MonthClosureController, GdprController, and AdminController. The frontend already submits requesttoken consistently via ArbeitszeitCheckUtils.ajax, so all mutating routes now reject cross-site requests by default. GET-only endpoints intentionally remain #[NoCSRFRequired] (CSRF is irrelevant for read-only GETs in Nextcloud's framework).
• No raw exception leakage in JSON responses: Hardened AbsenceController::getSafeErrorMessage so that exception messages are only forwarded when they are explicit business-rule \Exception instances; messages containing technical fingerprints (SQL fragments, file paths, stack traces, oversized payloads) are replaced with a generic localized error. Applied the hardened helper to AbsenceController::store/update. Replaced direct getMessage() leakage in AdminController::getTeams, SettingsController::index_api, and PageController page-render error paths with sanitized localized messages.
• Correct HTTP status for authentication errors: SettingsController::update now returns HTTP 401 Unauthorized (was HTTP 400 Bad Request) when the request is unauthenticated, matching what API clients and load balancers expect.

Changed

• Organization-scope monthly report downloads: reports.js now forwards user IDs resolved during preview to the report.team endpoint and falls back to a clear "no organization members had time entries in the selected period" message instead of the misleading "preview first" hint when an organization-wide preview yields zero results.
• Sanitized dashboard load errors: dashboard.js/dashboard.css now surface a localized "Some dashboard data could not be loaded." live-region message instead of raw widget exceptions.
• Resume-after-break clarity: Clock-in copy and l10n unified around "Resume after break" instead of the legacy clock_in_resume placeholder.

Accessibility (WCAG 2.1 AA)

• Main landmark on every page: 17 page templates now expose a single, properly labelled <main id="app-content" role="main" aria-label="..."> landmark for assistive technologies (dashboard, index, timeline, calendar, settings, personal-settings, reports, compliance-dashboard, compliance-reports, compliance-violations, working-time-models, admin-dashboard, admin-teams, admin-users, admin-holidays, manager-dashboard, manager-time-entries, manager-absences, manager-month-closures).
• Skip link / <main> consistency: time-entries, absences, admin-settings, admin-notifications, substitution-requests, and audit-log previously had id="app-content" on a plain <div> while role="main" lived on a child wrapper, so the "Skip to main content" target landed on a non-landmark. All six now use <main id="app-content" role="main"> directly. Removed redundant role="banner" from the <header> inside audit-log's main region.
• Accessible names on all data tables: Added aria-label/aria-labelledby and screen-reader captions to the holiday list table and to the two notification-matrix tables that previously had no accessible name.
• Live error announcement on dashboard: Dashboard error section now lives inside an aria-live region so partial widget failures are announced without disrupting focus.
• Manager dashboard team metrics now announced: Stat numbers (Team Members / Active Today / Hours Today / Pending Absences) had aria-hidden="true" on the value spans, which silenced every metric for screen reader users. Each card now exposes a single, fully readable accessible name (e.g. "5 team members active today") via a role="group" wrapper while keeping the visual layout intact.
• Alert vs live-region conflicts resolved: Removed conflicting aria-live="polite" from role="alert" containers in absences.php (form error), admin-settings.php (global error banner), and three time-entry inline form errors. role="alert" already implies assertive announcements, so the previous polite override could delay critical validation feedback for assistive technology.
• Page heading hierarchy normalized: Every primary page template now exposes exactly one <h1> (dashboard, time-entries, absences, calendar, timeline, reports, settings, personal-settings, compliance-dashboard, compliance-reports, compliance-violations, working-time-models, admin-dashboard, admin-users, admin-holidays, admin-settings, admin-notifications, manager-dashboard). Previously most pages started at <h2>. Subordinate section headings in time-entries and absences were promoted to h2/h3 so the ladder no longer skips levels. CSS rules for .section-header h1 were added to inherit the existing h2 styling.
• Manager dashboard breadcrumb: Added the standard "Dashboard › Manager Dashboard" breadcrumb to align with all other primary pages and improve orientation for keyboard and screen reader users.
• Calendar loading state announced: The "Loading calendar…" placeholder now uses role="status" with aria-live="polite" so the loading and ready transitions are announced. The decorative spinner is aria-hidden.
• Focus indicators restored: outline: none was used on the timeline filter checkboxes and the admin user-picker items, breaking keyboard focus visibility. Added :focus-visible outlines using the primary color for both, preserving hover styling.
• Mobile touch targets: .btn--sm was 36 × 36 px on mobile, below WCAG 2.5.5's 44 × 44 advisory. The mobile media query now enforces 44 × 44 px on small buttons; desktop sizing is unchanged.
• Empty-state row for legacy index.php time-entries view: Restored the missing empty-state row when no entries exist (parity with the other table views in the same template).
• Reports access fallback navigation: Replaced an inline onclick redirect in reports.php's no-access empty state with a real <a> anchor so the dashboard fallback works without JavaScript and inherits standard link semantics.

Removed

• Stale Nextcloud personal-settings panel placeholder: The old personal-settings.php panel rendered inside Nextcloud's user-settings shell with hardcoded vacation-days / working-hours fields and reminder checkboxes that were never wired to any backend. Replaced it with a clean, accurate panel pointing the user to the in-app personal settings page (where these preferences are actually persisted via SettingsController::update) plus a short GDPR data-rights note. Kept the legacy index.php "settings" branch (dead code, but still in the file) but pulled the previously hardcoded 1.0.1 version string from IAppManager::getAppVersion('arbeitszeitcheck').

Tests

• AccessibilityTest hardened: Replaced the "must contain <button>" assertion (which permitted pages without keyboard-reachable controls and false-flagged link-only panels) with two stricter checks: (1) explicitly forbid the <div onclick=…> anti-pattern and (2) require at least one <button> or <a href> per audited template. Total suite: 455 tests, 1 652 assertions, all green.

Added

• Critical workflow audit checklist: Added tests/WORKFLOW_AUDIT_CHECKLIST.md as a concise release checklist for time tracking, manual entry corrections, absences/approvals, month closure, reporting/compliance/export behavior, and public error-surface expectations.

Changed

• Time tracking mutation safety: Clock/break mutations now use user-scoped locks and transactions; status polling remains read-only while automatic break fallback and daily maximum enforcement run through explicit mutation paths/background jobs.
• API input and error hardening: Report, export, compliance, manager, and time tracking endpoints now use stricter date/time parsing, safer validation responses, and generic public error messages for unexpected failures.
• Month-closure enforcement: Absence update/delete/cancel/shorten/approval/substitute flows now re-check month mutability before applying workflow mutations.

Fixed

• Health endpoint fingerprinting: The public health response no longer exposes app or Nextcloud version fields.

Added

• Absence approval forensics: Added approved_by_user_id persistence on absence records (approve/reject/auto-approve), with schema migration and API summary output.

Changed

• Vacation entitlement snapshot integrity: Added deterministic key-based upsert on (user_id, period_key, as_of_date) and migration-backed unique index enforcement.
• Concurrency control in critical workflows: Absence create/update/approve/reject/substitute flows now use user-scoped mutation locks plus transactional rechecks/row locks to prevent race-based overlap and over-approval inconsistencies.
• Release safety: Workflow/unit/integration tests were updated and executed against the hardened mutation paths.

Fixed

• Legacy snapshot repair path: Upsert now handles historical malformed rows and concurrent unique-key conflicts safely by retrying as deterministic update.
• Vacation balance write races: VacationYearBalanceMapper::upsert now resolves concurrent unique-key collisions via re-read/update fallback.

Changed

• Release packaging refresh: Bumped app metadata to 1.2.5 and regenerated the signed release artifact set for App Store and GitHub publication.

Changed

• Publishable release refresh: Bumped app metadata to 1.2.4 and generated a new signed release artifact set (archive, checksums, and App Store signature) for App Store/GitHub publication.

Changed

• Release packaging refresh: Prepared a new signed App Store/GitHub release archive for the current code line using the Docker-based signing workflow.

Fixed

• Localized decimal inputs in admin settings: Daily working-hour inputs now reliably accept comma-decimals like 7,74 and preserve two-decimal precision.
• Legacy hours API payload parsing: Time-entry endpoints now parse optional decimal hour fields consistently for both comma and dot separators, preventing silent truncation in backward-compatible request formats.

Changed

• Input precision hints: Updated settings input steps/help text to align with two-decimal hour values used in 38.7-hour week scenarios.

Fixed

• Paused-entry recovery and lifecycle: Paused entries can now be accessed again in edit/delete workflows and are consistently finalized as completed when edited with an end time.
• Resume behavior for same-day paused sessions: Clock-in now resumes a same-day paused entry instead of creating duplicate automatic entries, while preserving the pause gap as break history.
• Historical paused leftovers: Added migration Version1020Date20260421000000 to repair all remaining orphaned paused rows (including cases not covered by the earlier one-time migration).

Added

• Vacation entitlement policy engine: New policy-driven calculation flow with support for manual_fixed, model_based_simple, tariff_rule_based, and manual_exception, plus admin simulation endpoint.
• Tariff rule data model and APIs: Added versioned tariff rule sets/modules and admin endpoints to create, update, activate, retire, and assign policies to users.
• Entitlement computation snapshots: Added persistent entitlement snapshots (at_entitlement_snapshots) with calculation trace/policy fingerprint for auditability and diagnostics.
• Admin notifications page: New dedicated admin UI (/admin/notifications) with HR recipient + event matrix management and a dedicated notifications settings API.

Changed

• Vacation allocation integration: Year allocation now resolves entitlement via VacationEntitlementEngine and returns entitlement source/rule-set/trace metadata in allocation payloads.
• Policy migration compatibility: Existing user model vacation values are backfilled into policy assignments during migration (Version1018Date20260420123000) to keep legacy installs consistent.
• Admin settings flow: Absence notification-related controls (carryover expiry/cap, rollover switches, substitute-required types, iCal and substitution-mail toggles) are centralized on admin notifications APIs/UI.
• Working time model schema: Added work_days_per_week to at_models (Version1019Date20260420150000) to support entitlement formulas.

Fixed

• User deletion cleanup: Deleting a user now also removes vacation policy assignments and entitlement snapshots, preventing orphaned policy/computation data.

Fixed

• Approver deadlock (app teams): Absence and time-entry correction workflows no longer treat “has colleagues” as “has a manager”. Auto-approval when no assignable approver exists now follows TeamResolverService::hasAssignableManagerForEmployee() (explicit team managers in app-teams mode; legacy group mode still uses colleagues as a proxy). Prevents requests stuck in “awaiting manager approval” when nobody can approve.
• Time entry corrections: Same assignability rule as absences (previously used colleague IDs only).
• Admin users API requests on /index.php instances: Refresh/edit/history/update actions now reliably resolve app URLs and no longer produce invalid requests like search=[object PointerEvent].
• Admin teams and settings API reliability on rewrite-less setups: Central URL resolution now includes a robust /index.php fallback when OC.generateUrl() is unavailable/incomplete in page context.

Added

• Repair step ReleaseStuckPendingAbsences: post-migration repair auto-approves legacy pending absences that still match the “no assignable approver” condition (idempotent).
• Frontend URL security guardrails: Shared AJAX layer now blocks external cross-origin calls by default (explicit allowExternal: true required), with unit tests covering URL normalization and external URL handling.
• Lint guardrails: ESLint rules now prevent introducing raw fetch('/apps/arbeitszeitcheck/...') and implicit external fetch(...) patterns outside approved abstractions.

Changed

• UX: Absences UI shows an informational callout when app teams are enabled and no approver is assigned; detail view shows a defensive warning if an old pending row is still stuck (until repair/admin fixes team setup).
• Frontend architecture: ArbeitszeitCheckUtils now provides centralized getRequestToken(), resolveUrl(), and isExternalUrl() primitives used by page scripts (admin-users, reports, settings, validation).
• Mobile UX consistency (WCAG 2.1 AA focused): iPhone-safe-area-aware spacing, improved touch targets, clearer section rhythm, and better visual hierarchy for normal user pages (dashboard, time-entries, absences) and manager pages (manager-dashboard, manager-time-entries, employee absences view).

Documentation

• User manuals (EN/DE), tests/WORKFLOW_ROLE_MATRIX.md, and developer documentation updated for assignable-manager semantics and repair step.
• README and developer documentation updated with centralized frontend URL policy, strict external-call behavior, and mobile/iOS layout guidance.

Added

• Month closure grace period and auto-finalization: Admin setting month_closure_grace_days_after_eom (0–90, default 0). After end-of-month, employees have that many calendar days to finalize manually; if the month is still open afterward, a daily background job finalizes it automatically (same snapshot as manual finalize). Pending time entry approvals and open absence workflow states block auto-finalization. Reopening remains admin-only.
• App-admin allowlist: New admin setting app_admin_user_ids to restrict ArbeitszeitCheck administration to a selected subset of Nextcloud admins. Empty selection keeps backward-compatible behavior (all Nextcloud admins can administer the app).
• Security role-gating Docker test target: Added scripts/test-security-role-gating-docker.sh wiring via make test-security-role-gating-docker and composer test:security-role-gating:docker for fast authorization regression checks in containerized setups.

Changed

• Month closure UX and API: Employee UI uses a clearer card layout, visible feedback for success/errors (WCAG-friendly), server-driven canFinalize with localized block reasons (feature off, future month, pending approvals). Manual finalize rejects future calendar months. Absence workflow (pending, substitute_pending, substitute_declined) is enforced alongside pending time entry corrections. Unauthorized API access returns 401 where appropriate. Admin settings: dedicated “Month closure” section; grace-days field stays editable with copy explaining it is saved even when closure is off; reopen uses searchable employee picker and clearer administrator vs. employee wording. Form validation error callouts use higher-contrast text and tinted surfaces across themes. Auto-finalize job logs per-user failures for operations.
• Release/signing workflow hardened for integrity checks: make release-signed now signs the extracted release archive payload (not the local development checkout), validates forbidden development paths are excluded, and repacks the signed archive for deployment/App Store upload.
• Admin authorization enforcement: Access to AdminController routes now uses middleware-level app-admin checks with a dedicated exception and a consistent 403 response page for authenticated users without app-admin rights.

Documentation

• Deployment guidance: Release docs now explicitly require production deployment from the signed tarball only and document the common integrity-failure pattern (.git/* / node_modules/* lists) caused by signing a dev tree.
• Deployment helper script: Added release/deploy-from-release.sh to deploy from signed release archives with safety checks (forbidden path scan, required signature.json, optional app disable/enable and occ integrity:check-app).
• Admin operations: User/developer docs now describe how to configure app-admin allowlisting, what the default fallback is, and how to verify authorization gating in Docker-based test runs.

Added

• Revision-safe month finalization (optional): Admin toggle month_closure_enabled (default off). Employees can finalize a full calendar month; the app stores a canonical JSON snapshot, SHA-256 hash chain, append-only revision rows, audit events, and a minimal PDF download. Finalized months are read-only through normal app APIs; administrators may reopen a month with a mandatory reason (audit). Monthly reports for a finalized month use the stored snapshot. Database: at_month_closure, at_month_closure_revision (migration Version1014Date20260409120000).

Documentation

• User manuals (EN/DE), developer documentation, and compliance notes updated for month closure, retention context, and limits (in-app tamper evidence, not QES).

Added

• Manager employee absences view: New in-app page and API for managers/admins to review employee absences with secure scope filtering, pagination, and localized status labels.
• Working time model copy flow: Added copy action with modal UX, unique default naming, and safeguards against duplicate submits.

Changed

• Manager navigation structure: Sidebar regrouped into clearer manager/admin submenus; reports moved under manager context; compliance link placement adjusted for reduced top-level clutter.
• Manager employee time entries UX: Date defaults and formatting/translation handling improved for clearer filtering behavior.
• Calendar behavior (rollback cleanup): Removed in-progress direct calendar-write functionality and related admin controls/status/test endpoints. The supported behavior remains unchanged: no Nextcloud Calendar app sync; optional .ics attachments are sent by email for configured absence workflows.

Fixed

• Working time model modals: Corrected copy modal interaction flow, source-model presentation, and delete-confirmation localization/rendering issues.
• Absence iCal hardening: Added stricter status/date guards, recipient deduplication, and privacy-safe event descriptions for substitute/manager recipients.

Documentation

• User manuals and changelogs updated to reflect the final calendar model (email .ics optional, no direct Nextcloud Calendar app sync) and current manager/admin UX structure.

Added

• Vacation rollover: VacationRolloverService, background job, occ arbeitszeitcheck:vacation-rollover, migration Version1013Date20260407120000 with at_vacation_rollover_log; unit tests.

Changed

• Frontend l10n: Shared templates/common/main-ui-l10n.php and teams-l10n.php so translated strings are available early across pages; related template and JS updates.

Fixed

• Manager dashboard — pending absences: API includes summary.typeLabel (server-localized absence type); UI prefers it so cards show translated labels (e.g. German Urlaub) instead of raw codes like vacation.

Documentation

• docs/Developer-Documentation.en.md: pending-approvals API note for typeLabel; user manuals (EN/DE): manager pending approvals show localized absence types.

Added

• Development tooling: occ arbeitszeitcheck:generate-test-data CLI for deterministic demo data (time entries, absences, optional violations, demo app team) to exercise UI, reports, and workflows locally.

Fixed

• Reports UI: Report type cards are no longer incorrectly disabled when a team-related scope is selected (team scopes still use the team report API where applicable).
• Reports (tests): Team report CSV download test now reads download bodies via DataDownloadResponse::render() (Nextcloud API).
• Team reports: Deduplicate user IDs before permission checks and aggregation to avoid double-counting when users appear in multiple teams.
• Absence type badges: Stronger, theme-safe contrast for vacation / sick / home office / other badges (readable on pale Nextcloud palettes).

Changed

• Compatibility (dev): Local development stacks aligned with Nextcloud 33.x (example: official nextcloud Docker image).
• Reports layout: Reverted an overly aggressive “full width” parameter form rule that could interfere with scrolling/layout on the reports page.

Fixed

• Admin settings API URL handling: Prevented duplicate index.php/index.php path generation when a route URL is already pre-generated by Nextcloud.
• Frontend error handling: Avoided unhandled Promise rejections in callback-based Utils.ajax() consumers after expected API failures.

Fixed

• Routing/compatibility: Added indexApi() compatibility aliases for legacy endpoints to prevent 500 errors in the Nextcloud log.
• PHP fatal errors: Fixed constructor signature issues in AbsenceService and ComplianceService that could crash the app when loading services or saving settings.
• Reports security hardening: Hardened report preview endpoints with start <= end validation and a maximum date-range limit to reduce DoS risk from untrusted parameters.
• Admin “whole organization” scope: Correctly handle admin organization scope (userId="" = all enabled users) and enforce access checks so preview/download data stays consistent.
• Reports rendering: Improved Preview rendering for absence and compliance reports to match the actual report data structure.

Changed

• Reports UI semantics: Team scope is limited to the team overview/export semantics that the backend actually returns (prevents misleading previews/downloads).
• Organization download guidance: Added explicit UI messaging for organization scope download limitations until organization-wide export endpoints are implemented.

Fixed

• ArbZG compliance: Corrected break check logic (9h/45min branch now reachable; check ≥9h before ≥6h)
• Manager logic: employeeHasManager() now uses getManagerIdsForEmployee() instead of getColleagueIds()
• Reporting: getTeamHoursSummary() respects period parameter (week/month)
• Admin users: hasTimeEntriesToday is now per-user, not system-wide
• UserSettingsMapper: Fixed falsy zero/empty-string handling in getIntegerSetting, getFloatSetting, getStringSetting
• Routing: Moved exportUsers route above getUser to fix route shadowing
• Version1009 migration: Replaced MySQL backtick SQL with portable QueryBuilder; use OCP\DB\Types
• Duplicate notifier: Removed double registration from Application.php boot()
• API security: Generic error messages instead of raw exception output (SubstituteController, GdprController)
• PDF export: Returns HTTP 422 with clear message instead of silent CSV fallback
• LIKE injection: WorkingTimeModelMapper::searchByName() uses escapeLikeParameter()
• XSS: Modal titles escaped in components.js; compliance-violations.js innerHTML escaped
• Admin-settings form: Added CSRF requesttoken
• AbsenceService DI: Fixed constructor argument order (IDBConnection)
• Admin holidays and settings: English source strings for l10n keys
• UserDeletedListener: inject TeamMemberMapper and TeamManagerMapper
• XSS: sanitise team names in admin-teams.js

Changed

• CSS: Shadow-light variable, scoped resets, dark-mode color-mix fixes, semantic color variables, navigation height/z-index
• Clock buttons: Double-submit guard (disabled during API calls)
• initTimeline(): Max retry count (20) to prevent infinite loop
• Accessibility: aria-label on header buttons, label for admin user search, aria-modal on welcome dialog, English l10n keys in navigation
• Docs: Removed internal docs; added docs/README; corrected repo URLs
• Manager dashboard: Injected l10n from PHP so JS translations work
• Constants.php for magic numbers; user-facing error messages

Added

• Version1010 migration: Compound indices on at_entries, at_violations, at_holidays, at_absences

Changed

• Long-term refactor: Replaced all \OC::$server usage with proper OCP APIs and constructor injection
• CSPService: Injected ContentSecurityPolicyNonceManager via constructor
• Controllers: Removed manual cspNonce (configureCSP handles it); injected IURLGenerator, IConfig where needed
• PageController: Injected IURLGenerator, IConfig; passes urlGenerator to templates
• HealthController: Injected IDBConnection for database check
• ProjectCheckIntegrationService: Injected LoggerInterface instead of OC::$server->getLogger()
• Templates: Replaced \OC::$server with \OCP\Server::get() (OCP public API)
• Added GitHub Actions release workflow (.github/workflows/release.yml)
• Updated PageControllerTest with full constructor mocks

Fixed

• Resolved duplicate route names in absence API (absence#store, absence#show, absence#update, absence#delete)
• Corrected settings class names in info.xml to use full OCA namespace
• Added declare(strict_types=1) to routes.php

Changed

• Removed non-existent screenshot references from info.xml until real screenshots are captured