Commit Graph

7 Commits

Author SHA1 Message Date
Simon a765d2d088 feat: iCal export, grade calculator, countdown pulse, session logout
- iCal feed at /api/ical/:token.ics — timetable (recurring), homework,
  class events, countdowns; subscribe in Google/Apple/Outlook Calendar
- POST /api/ical-token + /api/ical-token/regenerate for token management
- Grade calculator panel in Noten overlay: per-subject weighted average
  + "what score do I need?" solver (picks correct GRADE_WEIGHTS per type)
- Countdown urgency: items ≤2 days pulse red via CSS animation
- POST /api/me/logout-other — invalidates all other sessions by bumping
  token_version, re-issues JWT for current session
- Settings: iCal URL section + copy button; session management section
- Migration: users.ical_token, grades.created_at
2026-04-23 11:42:41 +02:00
Simon 480c3d09e5 fix: ql icons on load, text overflow in quicklink boxes 2026-04-22 22:53:04 +02:00
Simon 62ebc53875 feat: default quicklinks, static PDF downloads, improved app icon 2026-04-22 22:49:35 +02:00
Simon 6b54e3c813 feat: add PWA support (manifest, service worker, icons) 2026-04-22 22:28:17 +02:00
Simon 578dd4eab9 rebrand: Klassenportal, domain info1.ifb.lol, server status
- Replace INFO1 brand with Klassenportal everywhere (titles, nav,
  emails, TOTP issuer, recovery codes)
- Update domain from info1.simon0x.xyz to info1.ifb.lol
- Remove E2EE claims (e2ee.js was deleted, claims were false)
- Add GET /api/health endpoint (DB check + uptime)
- Add live server status section to landing page
- Fix README: domain, title, layout table
2026-04-22 21:31:03 +02:00
Simon 0dd915eeb2 fix: harden auth, admin, teacher, and e2ee endpoints
- Invalidate JWTs on password change/reset via token_version
- Constant-time login compare against dummy hash to prevent user enum
- Register validates subject against subjects table + user_subjects link
- Last-admin guard on account delete and admin role/status PATCH
- purgeUser unlinks teacher_materials storage files
- 2FA setup/regenerate require password, setup blocks while enabled
- Group sender keys: existing-distributor check + INSERT OR IGNORE
- class_events: type whitelist, ISO date regex, end >= start check
- Teacher absences DELETE: ownership check (teacher_id)
- class_timetable POST: HHMM validation, overlap detection
- class_timetable PUT: subject restricted to teacher list, HHMM + overlap
- Register VALID_SUBJECTS removed; dynamic subjects from DB
- /api/subjects made public (needed by register form)
2026-04-21 13:18:17 +02:00
Simon 5ff616e0d9 chore: remove school-brand impersonation from public pages
- Replace "IFB-Berufsfachschule Rosenheim" brand text with neutral "Klassenportal" labels in titles, brand headers, and footers.
- Rewrite privacy-policy responsible-party section to clarify this is a private, non-official project (no school/organization affiliation).
- Include prior uncommitted work on index.html and app.html.

Retain factual audience descriptors ("Nur für IFB-Schüler") and external links to the school website; these reference but do not impersonate.
2026-04-18 01:33:53 +02:00