devdocs/build/RELEASE-PROCEDURE.md replaces John's notes from several info
cases: release order with subscription droplets upgraded before the
announcement, git tagging, scp uploads, the download-back check, upgrade
commands with curl -f, the one-time 8.3.0 droplet steps (harden-830.sh), the
weekly OS update and the full version bump list. BUILD.md's partial version
table now points to it.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Install: program files read only for the service account, config.json 640,
systemd security settings in the service file, and a final step binding
AyaNova to 127.0.0.1 once NGINX works. Upgrade: the pre-8.3.0 step sets the
same permissions instead of re-adding group write on the program folder,
offers the security settings as a drop-in, and the upgrade commands use
curl -fO so a failed download stops before the program files are deleted.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
The request's link to the work order item blocked the delete with a database
error (500). Deleting the item now unlinks any request accepted into it and
sets it back to Open, in the same transaction, with a history entry and no
notification. Service request manual page and changelog.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
The backup time is stored as the UTC moment it meant on the day it was set
and was run at that UTC hour every day, so on servers with daylight saving it
ran an hour off the chosen time for part of the year. SetNextBackup now
recovers the clock time with the stored date's offset and runs it on the
server's local days. No migration. Backup manual page and changelog.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
The page log showed console.error objects only as JSHandle@object and errors
without their stack. Each ERROR line is still logged at once; object and
Error arguments are then fetched from the page and added as detail lines
(object JSON, error stack without Puppeteer frames and with file names only).
A failing render waits up to 2 s for pending details. Page log appends are
locked. Report designer manual (Script errors) and changelog.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Run, RunWindows (cmd.exe /C), RunLinuxShell (/bin/sh -c) and RunOSX have had
no callers since the backup moved to RunNoShell. Backup through the API and
the integration suite unchanged.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
DoFetchAsync rethrew a connection error after the fourth server, so
sockeye.ayanova.com was never tried; it now rethrows after the last one. The
trial request (rvr) went to rockfish only and now uses the same fallback.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Token date ranges (*today*, *lastmonth* ...) are built from the user's local
time in clientTimeStamp but were converted to UTC with ToUniversalTime(), the
server's time zone. They are now converted with clientTimeStamp.Offset. Lists
and dashboard widgets share this builder. Deferred: daylight saving edge and
dashboard grouping by UTC day (both need the client's time zone name).
Changelog.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
msvcp140.dll, vcruntime140.dll and vcruntime140_1.dll (14.44.35211.0,
Microsoft-signed) in postgres-standalone\bin, app-local, so the embedded
PostgreSQL starts on Windows without the Visual C++ runtime. Changelog;
BUILD.md notes they are replaced by hand.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
The 8.2.4 and older launchers left PostgreSQL running after the in-app
shutdown, so every standalone upgrade stopped at "files in use" and could not
close it. PrepareToInstall and uninstall now run the installed pg_ctl stop.
Changelog; BUILD.md.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Audit of every documented role right against BizRoles, decided with John:
Tech restricted reads tax codes, projects, unit models and meter readings;
Business administration reads server metrics; Accounting no longer enters
meter readings (both meter reading routes checked Unit rights, now meter
reading rights); no Subcontractor roles on memos; integrations: data
operations open to all full staff roles, switching Active and deleting are
Business administration only. Integrated applications page and changelog.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Direct messages are general notifications with no object, so the 12-hour
repeat check in CoreJobNotify (case 3917, keyed on subscription and object)
dropped every message to a user after the first. For general notifications
the check now applies only to the job's own delivery error messages
(DELIVERY_ERROR_NAME). Changelog.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
UserBiz.ValidateCanDelete refused a delete only when the user had related
records, so SuperUser with none could be deleted and nothing could bring it
back. User 1 is now refused (2004) before any other check. Changelog.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
The report page gets placeholders for the token and download key; request
interception (ReportApiRelay, now in every kind of install) puts the real
values only on the page's requests to ayApiUrl, then relays them (IIS) or
lets the browser continue. Requests to other addresses go out unchanged,
without credentials. Notification reports keep their rights. Report
scripting manual and changelog updated. F20 fixed.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Business administration - restricted could create, edit and import report
templates, although the roles page uses exactly this as its example of a
view-only restricted role. A template's script runs with the rights of
whoever renders it (SuperUser for customer notifications), so changing one
is an administrator right (F20). Report templates page and changelog
updated. Deferred: audit every documented role right against BizRoles.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Inside IIS (in-process) AyaNova has no port of its own, so the report page
could not reach the API: user reports called http://127.0.0.1:<request port>
(reset on https), notification reports 127.0.0.1:7575 (refused). Under IIS the
page's requests under the API URL are now intercepted and made by the server
(util/ReportApiRelay.cs) to the local address and port a user's request
arrived on, with its host name and scheme; notification reports use the
latest signed-in request, else the override. Outside IIS nothing changes.
The notification token check requires a request from this machine, no longer
host 127.0.0.1. Manual (IIS install, override page) and changelog updated.
Deferred: emailed PDF content type application/pdf/pdf.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Both installers drop users-modify from the program folder (and local-postgres
in the single-user installer) and run icacls to remove the Users group's own
grants (by SID) from the program folder after copying files, so upgrades over
8.2.4 lose them too. The data folder keeps users-modify and config.json stays
readable by local users (the running account is not known at install time);
both documented in the single-user and LAN install pages. Changelog updated.
F2 fixed (write access), the rest accepted. Deferred: report on a missing
record fails with a generic error.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
New config setting AYANOVA_TRUSTED_PROXIES (IP addresses or CIDR networks)
for reverse proxies on another computer: their X-Forwarded-For is used, a
chain of trusted proxies is followed, invalid entries are warned at boot.
X-Forwarded-For from a proxy that is not trusted logs one warning per server
start naming the proxy's address. Without the setting nothing changes (only
a loopback proxy is trusted). Shown in server info; manual page, Linux install
note, changelog. F6 follow-up recorded.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
dist/docker (a runtime dockerfile and a compose file that published
PostgreSQL with a fixed password) was from early development and never
offered. Removed with its commented-out lines in build-release.bat and
the BUILD.md mention; the build-environment Dockerfiles for the docs and
the client stay. F38 (4727 step 7, the last step).
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Every response carries X-Content-Type-Options: nosniff, X-Frame-Options:
SAMEORIGIN and Referrer-Policy: strict-origin, so self-hosted installs
get them too (the hosted nginx sends the same values). F35 (4727 step 6).
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
OverrideUserId on attachment upload is used only from SuperUser or a user
with change rights on User, otherwise ignored. Export files carry the
user's id in their name and export/download serves only the key user's
own export files. F25 (4727 step 5).
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
report/export/{id} by download key gives a template only to a user whose
roles include one of the template's roles, or who may edit templates (a
user with no roles got any template). Job owner check accepted (no owner
recorded; random job ids). F22 (4727 step 4).
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
server-info returns the DB ID and licence, and global-biz-setting/client
the DB ID and licensee, only to Service and NotService users, as the About
form already shows them; customer contacts and subcontractors get empty
values. F29 fixed, AyaNova half of F39 done (4727 step 3).
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
The anonymous page at /api/v8/ shows the version and its links only: the
licence block is removed and the support link no longer carries the DB
ID and licensee. F11 fixed (4727 step 2).
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Logo upload and delete need change rights on Global (was read rights,
which BizAdminRestricted has). The image type is taken from the bytes:
PNG, JPEG, GIF, WebP or SVG, anything else refused; the claimed type is
not stored. Downloads send nosniff and a sandbox Content-Security-Policy,
so an SVG opened by its URL runs no script. F23 fixed (4727 step 1).
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
FormFieldReferenceList and FormFieldKeys built their static lists lazily
and published them before filling them, so requests arriving during the
first build after a restart saw a half-filled list ("is not valid").
Both are now built in a local and published when complete (volatile).
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Failed logins are counted in memory (util/LoginThrottle.cs): 10 per login
name or 50 per client address within 15 minutes, then attempts are refused
with 429 for the rest of the window without checking the password. A
correct password clears the login's count; loopback is not counted per
address. Each lockout is logged. F6 fixed (2FA part in case 4710).
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
A password set by someone else (reset code, administrator) or a disabled
login replaces the user's session token and download key; changing one's
own password keeps the session. PasswordResetCodeExpire is cleared (was
DlKeyExpire). The token middleware exempts only the exact login and
notify/hello routes and refuses inactive users and users who may not log
in. With a purchased licence, notify/hello no longer offers the default
SuperUser login and a SuperUser with the default password may only change
it (SuperUserDefaultPasswordRoutes). F7, F8 and F9 fixed. Manual and
changelog updated.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Mailer checks the SMTP server's certificate (trust and name; no revocation
check). New config setting AYANOVA_SMTP_ACCEPT_ANY_CERTIFICATE accepts any
certificate (boot warning, shown in server info, manual page).
The notification settings GET returns ******** instead of the SMTP
password; a PUT with ******** or empty keeps the stored password.
F30 and F31 fixed. Changelog and manual updated.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
notify/direct-smtp: customer contacts refused; an address taken from a
Customer, HeadOffice, Vendor or User record needs read rights on that type
(a contact's user record: User or Customer rights). Staff may still give any
address (report scripts use it). The delivery-on check runs after these.
notify/direct-message: customer contacts and subcontractors refused, as the
client already hides it from them. F3 and F4 fixed.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
