devdocs/build/RELEASE-PROCEDURE.md replaces John's notes from several info
cases: release order with subscription droplets upgraded before the
announcement, git tagging, scp uploads, the download-back check, upgrade
commands with curl -f, the one-time 8.3.0 droplet steps (harden-830.sh), the
weekly OS update and the full version bump list. BUILD.md's partial version
table now points to it.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Install: program files read only for the service account, config.json 640,
systemd security settings in the service file, and a final step binding
AyaNova to 127.0.0.1 once NGINX works. Upgrade: the pre-8.3.0 step sets the
same permissions instead of re-adding group write on the program folder,
offers the security settings as a drop-in, and the upgrade commands use
curl -fO so a failed download stops before the program files are deleted.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Turn two-factor authentication off on the AyaNova 8 SuperUser for the
migration (the V8 Migrate plugin can not log in with it). On a server with a
purchased license the SuperUser password must first be changed from the
default (case 4725).
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
The erased-database section said "all user entered data ... except"; it now
lists what is erased and what is kept, from the erase code (tax codes are
erased by the migration, AyaNova 7's replace them).
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Records created before a True / False custom field was enabled have no value,
so data tables show nothing for them until it is set and saved.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Removed the advice to use song lyrics, quotes or poem lines (guessing tools
try those and digit-for-letter swaps first). Now: no length or character
rules; use a password manager or six dice-chosen words from the EFF long
word list; two-factor authentication.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Confirmed fixed by the port (pg_dump run directly, no shell): a backup with
AYANOVA_BACKUP_PG_DUMP_PATH in a folder path with spaces works. No manual
workaround to remove; changelog line extended.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
pg_restore --no-owner --no-privileges --role=<user>, so the restored tables
belong to that user (otherwise the integrity check stops AyaNova).
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
The manual had users create ~/.ayanova-data with sudo, but AyaNova runs with
sudo so ~ is root's home and that folder was never used. AyaNova creates the
data folder itself; the step now says where it is (/root/.ayanova-data) and
how to choose another location.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
The request's link to the work order item blocked the delete with a database
error (500). Deleting the item now unlinks any request accepted into it and
sets it back to Open, in the same transaction, with a history entry and no
notification. Service request manual page and changelog.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
The backup time is stored as the UTC moment it meant on the day it was set
and was run at that UTC hour every day, so on servers with daylight saving it
ran an hour off the chosen time for part of the year. SetNextBackup now
recovers the clock time with the stored date's offset and runs it on the
server's local days. No migration. Backup manual page and changelog.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
The page log showed console.error objects only as JSHandle@object and errors
without their stack. Each ERROR line is still logged at once; object and
Error arguments are then fetched from the page and added as detail lines
(object JSON, error stack without Puppeteer frames and with file names only).
A failing render waits up to 2 s for pending details. Page log appends are
locked. Report designer manual (Script errors) and changelog.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Run, RunWindows (cmd.exe /C), RunLinuxShell (/bin/sh -c) and RunOSX have had
no callers since the backup moved to RunNoShell. Backup through the API and
the integration suite unchanged.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
DoFetchAsync rethrew a connection error after the fourth server, so
sockeye.ayanova.com was never tried; it now rethrows after the last one. The
trial request (rvr) went to rockfish only and now uses the same fallback.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Token date ranges (*today*, *lastmonth* ...) are built from the user's local
time in clientTimeStamp but were converted to UTC with ToUniversalTime(), the
server's time zone. They are now converted with clientTimeStamp.Offset. Lists
and dashboard widgets share this builder. Deferred: daylight saving edge and
dashboard grouping by UTC day (both need the client's time zone name).
Changelog.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
msvcp140.dll, vcruntime140.dll and vcruntime140_1.dll (14.44.35211.0,
Microsoft-signed) in postgres-standalone\bin, app-local, so the embedded
PostgreSQL starts on Windows without the Visual C++ runtime. Changelog;
BUILD.md notes they are replaced by hand.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
The 8.2.4 and older launchers left PostgreSQL running after the in-app
shutdown, so every standalone upgrade stopped at "files in use" and could not
close it. PrepareToInstall and uninstall now run the installed pg_ctl stop.
Changelog; BUILD.md.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Audit of every documented role right against BizRoles, decided with John:
Tech restricted reads tax codes, projects, unit models and meter readings;
Business administration reads server metrics; Accounting no longer enters
meter readings (both meter reading routes checked Unit rights, now meter
reading rights); no Subcontractor roles on memos; integrations: data
operations open to all full staff roles, switching Active and deleting are
Business administration only. Integrated applications page and changelog.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Direct messages are general notifications with no object, so the 12-hour
repeat check in CoreJobNotify (case 3917, keyed on subscription and object)
dropped every message to a user after the first. For general notifications
the check now applies only to the job's own delivery error messages
(DELIVERY_ERROR_NAME). Changelog.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
UserBiz.ValidateCanDelete refused a delete only when the user had related
records, so SuperUser with none could be deleted and nothing could bring it
back. User 1 is now refused (2004) before any other check. Changelog.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
The report page gets placeholders for the token and download key; request
interception (ReportApiRelay, now in every kind of install) puts the real
values only on the page's requests to ayApiUrl, then relays them (IIS) or
lets the browser continue. Requests to other addresses go out unchanged,
without credentials. Notification reports keep their rights. Report
scripting manual and changelog updated. F20 fixed.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Business administration - restricted could create, edit and import report
templates, although the roles page uses exactly this as its example of a
view-only restricted role. A template's script runs with the rights of
whoever renders it (SuperUser for customer notifications), so changing one
is an administrator right (F20). Report templates page and changelog
updated. Deferred: audit every documented role right against BizRoles.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Inside IIS (in-process) AyaNova has no port of its own, so the report page
could not reach the API: user reports called http://127.0.0.1:<request port>
(reset on https), notification reports 127.0.0.1:7575 (refused). Under IIS the
page's requests under the API URL are now intercepted and made by the server
(util/ReportApiRelay.cs) to the local address and port a user's request
arrived on, with its host name and scheme; notification reports use the
latest signed-in request, else the override. Outside IIS nothing changes.
The notification token check requires a request from this machine, no longer
host 127.0.0.1. Manual (IIS install, override page) and changelog updated.
Deferred: emailed PDF content type application/pdf/pdf.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Both installers drop users-modify from the program folder (and local-postgres
in the single-user installer) and run icacls to remove the Users group's own
grants (by SID) from the program folder after copying files, so upgrades over
8.2.4 lose them too. The data folder keeps users-modify and config.json stays
readable by local users (the running account is not known at install time);
both documented in the single-user and LAN install pages. Changelog updated.
F2 fixed (write access), the rest accepted. Deferred: report on a missing
record fails with a generic error.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
New config setting AYANOVA_TRUSTED_PROXIES (IP addresses or CIDR networks)
for reverse proxies on another computer: their X-Forwarded-For is used, a
chain of trusted proxies is followed, invalid entries are warned at boot.
X-Forwarded-For from a proxy that is not trusted logs one warning per server
start naming the proxy's address. Without the setting nothing changes (only
a loopback proxy is trusted). Shown in server info; manual page, Linux install
note, changelog. F6 follow-up recorded.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Since c2f2f922 the script opens raven-client's root in VS Code, and the
window running appdev.bat inherited that folder, so npm run serve could
not find package.json. Start that window in raven-client\ayanova.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
dist/docker (a runtime dockerfile and a compose file that published
PostgreSQL with a fixed password) was from early development and never
offered. Removed with its commented-out lines in build-release.bat and
the BUILD.md mention; the build-environment Dockerfiles for the docs and
the client stay. F38 (4727 step 7, the last step).
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Every response carries X-Content-Type-Options: nosniff, X-Frame-Options:
SAMEORIGIN and Referrer-Policy: strict-origin, so self-hosted installs
get them too (the hosted nginx sends the same values). F35 (4727 step 6).
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
OverrideUserId on attachment upload is used only from SuperUser or a user
with change rights on User, otherwise ignored. Export files carry the
user's id in their name and export/download serves only the key user's
own export files. F25 (4727 step 5).
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
