- Facility: TravelCostMode (Pauschale/ProKilometer) + TravelCostPerKm, alongside
the existing flat rate; fixes FacilityService.UpdateAsync silently dropping all
Konditionen fields on update.
- New EmployeeFacilityDistance (Mitarbeiter x Einrichtung -> km) with full
office-side CRUD in omsorgapp, plus a self-service endpoint/UI so field staff
can maintain their own commute distance via OMSORG Connect (new
ModuleType.EmployeeFacilityDistances, Own-scope, no Facilities access needed).
- Roles can now be deleted (blocked with a 409 while still assigned to a user).
- Fix employeesApi.js missing the Date-object conversion for dateOfBirth/entryDate/
exitDate that crashed employee creation whenever a date was filled in; add a
clear/remove control for those date fields.
- Requirements: flesh out FR-REC-3 with a staged Akquise cadence, add FR-REC-5/6
for CRM feature scope and success metrics.
- Regenerate api-client-ts and api-client-php for all of the above.
Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>
The cookie-only refresh-token migration earlier this session broke both
mitarbeiter-app and mitarbeiter-app-legacy: they're server-to-server PHP
clients (cURL/Guzzle calling omsorgCore directly) with no browser cookie
jar, so dropping refreshToken from the login/refresh response body left
them with nothing to store - login appeared to succeed, redirected to
the dashboard, but the very next page's session check failed silently
(mitarbeiter-app's _ensure_fresh_token() bails out whenever
$_SESSION['omsorgcore_refresh_token'] is empty), bouncing the user back
to the login form every time.
Fix: dual-mode refresh token transport instead of cookie-only.
- LoginResponse includes refreshToken again (restores the pre-migration
contract PHP already expected) alongside the HttpOnly cookie.
- AuthController.Refresh/Logout accept an optional body-carried
RefreshRequest/LogoutRequest as a fallback: cookie is checked first
(browser/omsorgapp), body second (server-to-server clients).
- omsorgapp keeps ignoring the body's refreshToken and relies solely on
the cookie (XSS-safe) - only its authApi.js needed a small update since
the regenerated client now requires an explicit (empty) parameter
object for refresh/logout.
- Regenerated omsorgcore-client-ts; api-client-php's lib/ was already
consistent (never regenerated during the original migration, so it
still expected refreshToken all along - only the backend had stopped
providing it).
Verified end-to-end against a live instance: PHP login+refresh via
omsorgcore_login()/omsorgcore_refresh(), and the browser cookie-only
flow via curl with Origin/credentials headers - both work.
Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>
- omsorgapp now reads the omsorgCore URL from a runtime env-config.js
generated by the container entrypoint from OMSORG_CORE_URL, instead of
only baking it in at image build time - docker-compose.yml pulls
pre-built images from the registry, so a build-time-only value couldn't
be changed without a rebuild.
- docker-compose.yml: omsorgCore gets its own subdomain
(core.omsorg-pflegedienste.de) rather than being proxied under the
frontend's domain - omsorgWeb never needs browser-side access to it
anyway (server-side cURL only), and a dedicated API host is more
future-proof without being any less secure (backend still only bound to
127.0.0.1). Includes the nginx server-block snippet needed for the new
subdomain.
- Drop the now-unused OMSORG_CORE_PUBLIC_URL build-arg wiring from the
Gitea Actions workflow.
Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>
- omsorgapp: drop Electron, run as a plain Vite/React browser app; refresh
token moves to an HttpOnly cookie (omsorgCore), CORS added for the new
browser origin, document download/preview switched to Blob-based browser
APIs.
- Add Dockerfiles for omsorgCore, omsorgapp, and omsorgWeb, a docker-compose.yml
wiring Postgres/MySQL/all three apps together, and a Gitea Actions workflow
that builds and pushes images to the repo's container registry on push to
main and on version tags.
Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>
