TimeSister - Releases

API unchanged (api: 2), only additions; the capability gains team_backup: 1.

• Team backup as a ZIP. On the admin page, every team has “Back up team (ZIP)” (GET /admin/teams/{id}/export): manifest.json with checksums, team.json (team, members, shares, consents), every record with its history under records/<kind>/<key>.json, status.json, absences.json and a fresh export of every active member's time calendar under calendars/. Person records carry their feed, so the ZIP is confidential (contains_secrets: true).
• Restore and move. “Restore from ZIP” uploads the ZIP for a preview (POST /admin/teams/{id}/import/preview): the people of the backup, whether their account exists here, and the accounts of this Nextcloud to map to. POST /admin/teams/{id}/import with token, mapping (old account → new account or null for “without account”) and mode merge or replace writes records with history, roles, shares, consents, absences and status in one transaction, puts mapped accounts into the team group and stores the calendars as backups per person (source: "import"), which people fetch in the Mac app under “Old events”. Before importing into a team with content, the server stores a backup of it (protected and with the backup owner under TimeSister Backups/_team/).
• Limits: ZIP 200 MB, entries 50 MB, 600 MB unpacked, no absolute paths or ..; only Nextcloud admins, write routes with brute-force protection.

Three findings of the security review; API unchanged (api: 2).

• The vacation calendar stays in the team. vacation_calendar in the settings record is accepted only when owner is a Team Admin of the team and url is a calendar of that owner (…/remote.php/dav/calendars/<owner>/<calendar>/), otherwise 422 invalid – on PUT, in a batch and on restore. The background job checks again (owner still a member, URL still theirs) and skips the team with a warning in the log; before, a Team Admin could point the mirror at any account's calendar.
• PUT /me/absences: control characters in source_uid, kind, start or end are refused with 400 invalid; in the written events a CR is escaped like a line break and other control characters are dropped. Before, a CR in source_uid made the job rewrite the event on every run.
• Brute-force protection: every writing route (PUT, POST, DELETE) carries #[BruteForceProtection(action: 'timesister')], and a refused write (403) counts for Nextcloud's throttling.

• API unchanged in form (api: 2), only additions; the capability gains absences: 1.
• The shared vacation calendar. A Team Admin creates the calendar «TimeSister – Vacation» in their own account from the Mac app and shares it: the team group read-only, every Team Admin with write access. The settings record (setting/settings) names it: vacation_calendar: {url, owner}; absence_calendar_kinds says which categories appear (vacation, sickness, parental, civil_service, unpaid; default ["vacation"]).
• PUT /me/absences: every client reports the complete state of its own absences for this and next year – items: [{source_uid, kind, start, end}], end exclusive, at most 400. The server replaces the person's rows (table ts_absences). A person with vacation_calendar_optout: true in their person record is stored nowhere, and what was there goes.
• Written by the server: a background job (every 15 minutes) puts the absences of every team with a calendar into the owner's calendar as all-day events «<Category> · Initials Name» with X-TIMESISTER-PERSON, X-TIMESISTER-QUELLE and X-TIMESISTER-ART, over the public calendar API (ICreateFromString, no Sabre). Absences that are gone are written again with STATUS:CANCELLED – the API cannot delete; a Team Admin's Mac tidies them up. Events without the marks are never touched.
• Migration: table ts_absences.

• Admin settings, new team: the short name is suggested from the name (lowercase, umlauts spelled out, hyphens), typing turns capitals and spaces into the allowed form, and a hint names the rule (lowercase letters, digits, hyphens, 2 to 32 characters). Before, the form only said “fill in this field”.

• App Store: the screenshots now come from bias.city/timesister. No code changes.

• App Store: current screenshots (teams in the admin settings, the Mac app's week and the team's capacity). No code changes.

• First release in the Nextcloud App Store, for the beta of the TimeSister Mac app 0.4.0.
• Contains everything listed below under 0.1.0 to 0.7.6; no further changes. API version 2.
• Modules (Jobs, Budgets, Clients) need no change here: the clients keep the switches in the settings record (setting/settings, field modules).

API unchanged (api: 2), only additions; the capability gains team_backup: 1.

• Team backup as a ZIP. On the admin page, every team has “Back up team (ZIP)” (GET /admin/teams/{id}/export): manifest.json with checksums, team.json (team, members, shares, consents), every record with its history under records/<kind>/<key>.json, status.json, absences.json and a fresh export of every active member's time calendar under calendars/. Person records carry their feed, so the ZIP is confidential (contains_secrets: true).
• Restore and move. “Restore from ZIP” uploads the ZIP for a preview (POST /admin/teams/{id}/import/preview): the people of the backup, whether their account exists here, and the accounts of this Nextcloud to map to. POST /admin/teams/{id}/import with token, mapping (old account → new account or null for “without account”) and mode merge or replace writes records with history, roles, shares, consents, absences and status in one transaction, puts mapped accounts into the team group and stores the calendars as backups per person (source: "import"), which people fetch in the Mac app under “Old events”. Before importing into a team with content, the server stores a backup of it (protected and with the backup owner under TimeSister Backups/_team/).
• Limits: ZIP 200 MB, entries 50 MB, 600 MB unpacked, no absolute paths or ..; only Nextcloud admins, write routes with brute-force protection.

Three findings of the security review; API unchanged (api: 2).

• The vacation calendar stays in the team. vacation_calendar in the settings record is accepted only when owner is a Team Admin of the team and url is a calendar of that owner (…/remote.php/dav/calendars/<owner>/<calendar>/), otherwise 422 invalid – on PUT, in a batch and on restore. The background job checks again (owner still a member, URL still theirs) and skips the team with a warning in the log; before, a Team Admin could point the mirror at any account's calendar.
• PUT /me/absences: control characters in source_uid, kind, start or end are refused with 400 invalid; in the written events a CR is escaped like a line break and other control characters are dropped. Before, a CR in source_uid made the job rewrite the event on every run.
• Brute-force protection: every writing route (PUT, POST, DELETE) carries #[BruteForceProtection(action: 'timesister')], and a refused write (403) counts for Nextcloud's throttling.

• API unchanged in form (api: 2), only additions; the capability gains absences: 1.
• The shared vacation calendar. A Team Admin creates the calendar «TimeSister – Vacation» in their own account from the Mac app and shares it: the team group read-only, every Team Admin with write access. The settings record (setting/settings) names it: vacation_calendar: {url, owner}; absence_calendar_kinds says which categories appear (vacation, sickness, parental, civil_service, unpaid; default ["vacation"]).
• PUT /me/absences: every client reports the complete state of its own absences for this and next year – items: [{source_uid, kind, start, end}], end exclusive, at most 400. The server replaces the person's rows (table ts_absences). A person with vacation_calendar_optout: true in their person record is stored nowhere, and what was there goes.
• Written by the server: a background job (every 15 minutes) puts the absences of every team with a calendar into the owner's calendar as all-day events «<Category> · Initials Name» with X-TIMESISTER-PERSON, X-TIMESISTER-QUELLE and X-TIMESISTER-ART, over the public calendar API (ICreateFromString, no Sabre). Absences that are gone are written again with STATUS:CANCELLED – the API cannot delete; a Team Admin's Mac tidies them up. Events without the marks are never touched.
• Migration: table ts_absences.

• Admin settings, new team: the short name is suggested from the name (lowercase, umlauts spelled out, hyphens), typing turns capitals and spaces into the allowed form, and a hint names the rule (lowercase letters, digits, hyphens, 2 to 32 characters). Before, the form only said “fill in this field”.

• App Store: the screenshots now come from bias.city/timesister. No code changes.

• App Store: current screenshots (teams in the admin settings, the Mac app's week and the team's capacity). No code changes.

• First release in the Nextcloud App Store, for the beta of the TimeSister Mac app 0.4.0.
• Contains everything listed below under 0.1.0 to 0.7.6; no further changes. API version 2.
• Modules (Jobs, Budgets, Clients) need no change here: the clients keep the switches in the settings record (setting/settings, field modules).