BudgetCheck - Releases

Added

• Mobile companion API v5: workspace-bound attachment download/preview endpoint (GET /api/mobile/v1/workspaces/{workspaceId}/attachments/{attachmentId}/download) streaming receipt bytes with nosniff, no-store, sanitized Content-Disposition, strict CSP for inline previews, and per-user rate limiting.
• Mobile companion API v4: monthly/yearly/period glance summaries (scope=month|year|all with new household span aggregation) and app-admin workspace creation mirroring the web permission model.
• Home category overview chips now carry a direction field and include income categories with activity, so the companion can split spending and income views.

Security / integrity

• Attachment delivery for the companion is bound to the requested workspace (resolveForDeliveryInWorkspace): a crafted attachment id from another workspace, or from a deleted transaction, is rejected with an opaque access-denied error (IDOR closed).
• Year/scope summary parameters are strictly validated (four-digit year window, whitelisted scopes) with 422 validation errors.

Fixed

• Mobile transaction list shape normalized; home category overview no longer drops income rows with activity.

Tests

• New behavior/contract suites for attachment download (workspace mismatch, deleted transaction, rate limit, header hygiene) and glance summaries; mobile-companion mutation harness extended (attachment workspace-bind and download mutations all killed).

Security / integrity

• Mobile mutation channel now requires a cryptographically valid CSRF token (IRequest::passesCSRFCheck()); forged non-empty requesttoken strings are rejected. Basic/Bearer app-password clients are unaffected.
• New exclusive workspace row lock (SELECT … FOR UPDATE) serializes monthly close/reopen against ledger writers: snapshot summary and hash are computed under the lock, and budget-target and attachment writes re-check closed state under the same lock (TOCTOU closed).
• Budget upsert collapses historical duplicate (workspace, month, category) rows under the write lock (NULL category_id is not uniquely indexed on all engines).
• Attachment overwrite (receipt crop bake) snapshots prior bytes and restores the stored file when the DB metadata update fails — disk never stays ahead of durable metadata.
• Adding or removing attachments on a transaction of a closed month is rejected.

Fixed

• Layout overflow hardening: cards, warnings list, and empty states wrap long titles instead of widening the app shell (min-width: 0 / max-width: 100% grid constraints).

Tests

• New snapshot-close serialization contract test; expanded update/delete CAS, mobile-channel, design-system CSS, and frontend-hardening suites; closeout and mobile-companion mutation harnesses cover the new gates.

Added

• In-app Support & Us admin surface with Partner CTAs.
• Public billing facades for InvoiceCheck (BillingReadFacade / BillingWriteFacade, including paid-state handshake).
• Mobile companion API surface (MobileApiController, capabilities, idempotent mutations).
• Playwright shell a11y smoke and epic-gate / closeout / billing mutation harnesses.

Security / integrity

• Transaction create/update/delete optimistic locking (version required; CAS on update/delete).
• CSRF-required mutation coverage; opaque AccessDenied IDOR gates.

Fixed

• Budgets navigation restored; warning recovery actions aligned with Dashboard.
• Money envelopes include decimals (zero-decimal currencies); header month follows selected month.
• Transaction dialog horizontal scrollbar; GET favorites remain read-only.
• Uninstall cleanup limited to upgrade-backup snapshots.

Changed

• Nextcloud compatibility 32–34; version sources aligned to 1.1.1.
• Stabilized money formatting; dropped versioned asset filename suffixes.

Fixed

• Monatsübersicht (Kategorieverbrauch): Der „Include one-off (special) transactions“-Schalter wird jetzt für die geplanten-vs.-tatsächlichen Kategorien korrekt angewendet, damit die Anzeige verständlich und konsistent ist.
• Audit-Härtung: Monatsabschluss-Snapshots (Close/Reopen) bleiben weiterhin kanonisch und unabhängig von der persönlichen Anzeige-Einstellung für „special“; dadurch bleibt der Berechnungs-Hash deterministisch.
• Robustheit: Wechseln der Anzeige-Einstellung lädt die Monatsdaten konsistent neu und ignoriert veraltete Antworten (vermeidet UI-Race-Conditions).

Changed

• Receipt gallery toolbar: grouped controls with tooltips, clearer hover/focus states, busy guards while saving, and a corrected rotate-clockwise icon.
• Gallery translations: attachment gallery strings are now translated across all supported locales (including regional variants).

Fixed

• Upgrade backup: snapshot folder creation failures (permissions, quota) now surface as UpgradeBackupException instead of escaping the backup handler.

Fixed

• Planned entries in summaries: dashboard, monthly, yearly, and close snapshots now exclude is_planned placeholder rows from income/expense/budget actual totals (they remain visible on the ledger until matched).
• Recurring generate: batch generation runs in a DB transaction, skips duplicate dates idempotently, blocks closed months, and deactivates rules that have passed their end date.
• Budget planned sync: month sync is transactional; zero-target categories no longer throw a misleading 403 when no budget row exists.

Changed

• Recurring rules table shows end date; modal adds active/inactive toggle and stronger end-date warnings (live region + save confirm).
• Yearly month cards show text badges for over-budget and closed states; recurring action buttons have unique accessible names.
• Modal focus lands on the first form field; dashboard warnings include severity text for screen readers.

Added

• Shared transaction editor: dashboard and ledger pages use a common inline editor for creating and editing bookings (transaction-editor.js).
• Dashboard quick actions: household dashboards show month-scoped shortcuts (new transaction, open ledger) with a compact recent-ledger preview.
• Transaction title fallback: blank titles default to the selected category name; unit tests cover resolution rules (TransactionTitleTest).

Changed

• Workspace settings for all members: non-managers can open settings to view workspace details and personal planning-total preferences; managers retain full configuration access.
• Transactions default window: the ledger opens on the current month instead of all time.
• Full translations (da, de, en, es, fr, it, nb, nl, pl, sv) updated for new UI strings.

Added

• Planning-total preferences: special transactions can be excluded from everyday planning totals by default, with per-user, server-persisted overrides and a manager-set workspace default (SummaryViewPreferencesService).
• Savings-transfer and planned-entry aggregation: summaries now match planned entries against actual transactions and aggregate savings transfers (PlannedTransactionMatchService).
• Dashboard transaction notes: transaction notes are shown on the dashboard.

Changed

• Special transactions are excluded from everyday planning totals by default; full translations (da, de, en, es, fr, it, nb, nl, pl, sv) updated accordingly.

Fixed

• Unbounded household transaction lists: household transaction lists are now properly bounded.

Added

• Import preferences API: server-synced CSV import defaults (ImportPreferencesService) with unit tests.
• Transaction import hardening: UTF-8 and legacy encoding fallback, fingerprint-based duplicate skip, expanded reference column aliases, and higher rate limits for split imports.

Changed

• CSV import UI: remove bank-type column from direction mapping; improved import page layout and validation feedback.

Fixed

• App access permissions (#2): users and groups on the directory allow-list can open BudgetCheck without a pre-existing workspace membership. Workspace data remains gated by per-workspace role checks.
• Group workspace membership counting: only honour group rows with assignable roles (viewer, contributor) when resolving effective access.

Added

• CSV transaction import: guided import page with preview validation and atomic commit (TransactionImportService, /import, API preview/commit endpoints).
• Unit tests for AccessControlService::canUseApp() allow-list behaviour (AccessControlAppAccessTest).
• Integration test for AppAccessMiddleware deny/allow flows against live app config (AppAccessGateIntegrationTest).

Changed

• Removed unused DENIAL_NO_WORKSPACE denial path; directory restriction is the sole app-entry gate.

Fixed

• Data loss after Nextcloud upgrade: UninstallDropTables preserves tables and settings on disable; full cleanup runs only on app removal.

Fixed

• EnsureBudgetCheckSchema: use the core Connection from the server container for MigrationService, so install/post-migration repair runs reliably on upgrade.

Added

• Integration tests for repair steps (UpgradeRepairIntegrationTest) and PHPUnit bootstrap support when tests run against a Nextcloud tree (NEXTCLOUD_ROOT / monorepo lib/base.php).

Changed

• Confirm Nextcloud 33 as max-version in appinfo/info.xml (aligned with latest stable server).

Added

• Searchable timezone and currency pickers on workspace and app settings: js/common/catalog-pickers.js with keyboard navigation, live filtering, and accessible combobox/listbox semantics; shared partials templates/common/bc-timezone-picker.php and bc-currency-picker.php.
• CurrencyCatalog: single source for supported ISO codes (including RUB, UAH, KZT); TimezoneCatalog: full IANA list exposed via catalog API.
• OCA\BudgetCheck\Repair\UninstallDropTables and EnsureBudgetCheckSchema wired in appinfo/info.xml for complete uninstall cleanup and idempotent schema repair on upgrade.
• Migration Version1009: schema/repair hardening for production installs; BudgetCheckTableCatalog centralizes table names.
• Tests: CurrencyCatalogTest, TimezoneCatalogTest, EnsureBudgetCheckSchemaTest, UninstallDropTablesTest, WorkspaceServiceUpdatePayloadTest.

Changed

• Workspace settings: server-side validation for timezone/currency; currency lock after the first transaction.
• App settings / settings UI: migrated to catalog pickers instead of plain text fields; styling in css/app.css.

• Fix App Store info.xml validation: screenshots before donation/dependencies, settings before navigations, drop unsupported keywords, cap at 10 screenshots (schema limit).

Added

• Mobile companion API v5: workspace-bound attachment download/preview endpoint (GET /api/mobile/v1/workspaces/{workspaceId}/attachments/{attachmentId}/download) streaming receipt bytes with nosniff, no-store, sanitized Content-Disposition, strict CSP for inline previews, and per-user rate limiting.
• Mobile companion API v4: monthly/yearly/period glance summaries (scope=month|year|all with new household span aggregation) and app-admin workspace creation mirroring the web permission model.
• Home category overview chips now carry a direction field and include income categories with activity, so the companion can split spending and income views.

Security / integrity

• Attachment delivery for the companion is bound to the requested workspace (resolveForDeliveryInWorkspace): a crafted attachment id from another workspace, or from a deleted transaction, is rejected with an opaque access-denied error (IDOR closed).
• Year/scope summary parameters are strictly validated (four-digit year window, whitelisted scopes) with 422 validation errors.

Fixed

• Mobile transaction list shape normalized; home category overview no longer drops income rows with activity.

Tests

• New behavior/contract suites for attachment download (workspace mismatch, deleted transaction, rate limit, header hygiene) and glance summaries; mobile-companion mutation harness extended (attachment workspace-bind and download mutations all killed).

Security / integrity

• Mobile mutation channel now requires a cryptographically valid CSRF token (IRequest::passesCSRFCheck()); forged non-empty requesttoken strings are rejected. Basic/Bearer app-password clients are unaffected.
• New exclusive workspace row lock (SELECT … FOR UPDATE) serializes monthly close/reopen against ledger writers: snapshot summary and hash are computed under the lock, and budget-target and attachment writes re-check closed state under the same lock (TOCTOU closed).
• Budget upsert collapses historical duplicate (workspace, month, category) rows under the write lock (NULL category_id is not uniquely indexed on all engines).
• Attachment overwrite (receipt crop bake) snapshots prior bytes and restores the stored file when the DB metadata update fails — disk never stays ahead of durable metadata.
• Adding or removing attachments on a transaction of a closed month is rejected.

Fixed

• Layout overflow hardening: cards, warnings list, and empty states wrap long titles instead of widening the app shell (min-width: 0 / max-width: 100% grid constraints).

Tests

• New snapshot-close serialization contract test; expanded update/delete CAS, mobile-channel, design-system CSS, and frontend-hardening suites; closeout and mobile-companion mutation harnesses cover the new gates.

Added

• In-app Support & Us admin surface with Partner CTAs.
• Public billing facades for InvoiceCheck (BillingReadFacade / BillingWriteFacade, including paid-state handshake).
• Mobile companion API surface (MobileApiController, capabilities, idempotent mutations).
• Playwright shell a11y smoke and epic-gate / closeout / billing mutation harnesses.

Security / integrity

• Transaction create/update/delete optimistic locking (version required; CAS on update/delete).
• CSRF-required mutation coverage; opaque AccessDenied IDOR gates.

Fixed

• Budgets navigation restored; warning recovery actions aligned with Dashboard.
• Money envelopes include decimals (zero-decimal currencies); header month follows selected month.
• Transaction dialog horizontal scrollbar; GET favorites remain read-only.
• Uninstall cleanup limited to upgrade-backup snapshots.

Changed

• Nextcloud compatibility 32–34; version sources aligned to 1.1.1.
• Stabilized money formatting; dropped versioned asset filename suffixes.

Fixed

• Monatsübersicht (Kategorieverbrauch): Der „Include one-off (special) transactions“-Schalter wird jetzt für die geplanten-vs.-tatsächlichen Kategorien korrekt angewendet, damit die Anzeige verständlich und konsistent ist.
• Audit-Härtung: Monatsabschluss-Snapshots (Close/Reopen) bleiben weiterhin kanonisch und unabhängig von der persönlichen Anzeige-Einstellung für „special“; dadurch bleibt der Berechnungs-Hash deterministisch.
• Robustheit: Wechseln der Anzeige-Einstellung lädt die Monatsdaten konsistent neu und ignoriert veraltete Antworten (vermeidet UI-Race-Conditions).

Changed

• Receipt gallery toolbar: grouped controls with tooltips, clearer hover/focus states, busy guards while saving, and a corrected rotate-clockwise icon.
• Gallery translations: attachment gallery strings are now translated across all supported locales (including regional variants).

Fixed

• Upgrade backup: snapshot folder creation failures (permissions, quota) now surface as UpgradeBackupException instead of escaping the backup handler.

Fixed

• Planned entries in summaries: dashboard, monthly, yearly, and close snapshots now exclude is_planned placeholder rows from income/expense/budget actual totals (they remain visible on the ledger until matched).
• Recurring generate: batch generation runs in a DB transaction, skips duplicate dates idempotently, blocks closed months, and deactivates rules that have passed their end date.
• Budget planned sync: month sync is transactional; zero-target categories no longer throw a misleading 403 when no budget row exists.

Changed

• Recurring rules table shows end date; modal adds active/inactive toggle and stronger end-date warnings (live region + save confirm).
• Yearly month cards show text badges for over-budget and closed states; recurring action buttons have unique accessible names.
• Modal focus lands on the first form field; dashboard warnings include severity text for screen readers.

Added

• Shared transaction editor: dashboard and ledger pages use a common inline editor for creating and editing bookings (transaction-editor.js).
• Dashboard quick actions: household dashboards show month-scoped shortcuts (new transaction, open ledger) with a compact recent-ledger preview.
• Transaction title fallback: blank titles default to the selected category name; unit tests cover resolution rules (TransactionTitleTest).

Changed

• Workspace settings for all members: non-managers can open settings to view workspace details and personal planning-total preferences; managers retain full configuration access.
• Transactions default window: the ledger opens on the current month instead of all time.
• Full translations (da, de, en, es, fr, it, nb, nl, pl, sv) updated for new UI strings.

Added

• Planning-total preferences: special transactions can be excluded from everyday planning totals by default, with per-user, server-persisted overrides and a manager-set workspace default (SummaryViewPreferencesService).
• Savings-transfer and planned-entry aggregation: summaries now match planned entries against actual transactions and aggregate savings transfers (PlannedTransactionMatchService).
• Dashboard transaction notes: transaction notes are shown on the dashboard.

Changed

• Special transactions are excluded from everyday planning totals by default; full translations (da, de, en, es, fr, it, nb, nl, pl, sv) updated accordingly.

Fixed

• Unbounded household transaction lists: household transaction lists are now properly bounded.

Added

• Import preferences API: server-synced CSV import defaults (ImportPreferencesService) with unit tests.
• Transaction import hardening: UTF-8 and legacy encoding fallback, fingerprint-based duplicate skip, expanded reference column aliases, and higher rate limits for split imports.

Changed

• CSV import UI: remove bank-type column from direction mapping; improved import page layout and validation feedback.

Fixed

• App access permissions (#2): users and groups on the directory allow-list can open BudgetCheck without a pre-existing workspace membership. Workspace data remains gated by per-workspace role checks.
• Group workspace membership counting: only honour group rows with assignable roles (viewer, contributor) when resolving effective access.

Added

• CSV transaction import: guided import page with preview validation and atomic commit (TransactionImportService, /import, API preview/commit endpoints).
• Unit tests for AccessControlService::canUseApp() allow-list behaviour (AccessControlAppAccessTest).
• Integration test for AppAccessMiddleware deny/allow flows against live app config (AppAccessGateIntegrationTest).

Changed

• Removed unused DENIAL_NO_WORKSPACE denial path; directory restriction is the sole app-entry gate.

Fixed

• Data loss after Nextcloud upgrade: UninstallDropTables preserves tables and settings on disable; full cleanup runs only on app removal.

Fixed

• EnsureBudgetCheckSchema: use the core Connection from the server container for MigrationService, so install/post-migration repair runs reliably on upgrade.

Added

• Integration tests for repair steps (UpgradeRepairIntegrationTest) and PHPUnit bootstrap support when tests run against a Nextcloud tree (NEXTCLOUD_ROOT / monorepo lib/base.php).

Changed

• Confirm Nextcloud 33 as max-version in appinfo/info.xml (aligned with latest stable server).

Added

• Searchable timezone and currency pickers on workspace and app settings: js/common/catalog-pickers.js with keyboard navigation, live filtering, and accessible combobox/listbox semantics; shared partials templates/common/bc-timezone-picker.php and bc-currency-picker.php.
• CurrencyCatalog: single source for supported ISO codes (including RUB, UAH, KZT); TimezoneCatalog: full IANA list exposed via catalog API.
• OCA\BudgetCheck\Repair\UninstallDropTables and EnsureBudgetCheckSchema wired in appinfo/info.xml for complete uninstall cleanup and idempotent schema repair on upgrade.
• Migration Version1009: schema/repair hardening for production installs; BudgetCheckTableCatalog centralizes table names.
• Tests: CurrencyCatalogTest, TimezoneCatalogTest, EnsureBudgetCheckSchemaTest, UninstallDropTablesTest, WorkspaceServiceUpdatePayloadTest.

Changed

• Workspace settings: server-side validation for timezone/currency; currency lock after the first transaction.
• App settings / settings UI: migrated to catalog pickers instead of plain text fields; styling in css/app.css.

• Fix App Store info.xml validation: screenshots before donation/dependencies, settings before navigations, drop unsupported keywords, cap at 10 screenshots (schema limit).