Install: program files read only for the service account, config.json 640,
systemd security settings in the service file, and a final step binding
AyaNova to 127.0.0.1 once NGINX works. Upgrade: the pre-8.3.0 step sets the
same permissions instead of re-adding group write on the program folder,
offers the security settings as a drop-in, and the upgrade commands use
curl -fO so a failed download stops before the program files are deleted.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Turn two-factor authentication off on the AyaNova 8 SuperUser for the
migration (the V8 Migrate plugin can not log in with it). On a server with a
purchased license the SuperUser password must first be changed from the
default (case 4725).
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
The erased-database section said "all user entered data ... except"; it now
lists what is erased and what is kept, from the erase code (tax codes are
erased by the migration, AyaNova 7's replace them).
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Records created before a True / False custom field was enabled have no value,
so data tables show nothing for them until it is set and saved.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Removed the advice to use song lyrics, quotes or poem lines (guessing tools
try those and digit-for-letter swaps first). Now: no length or character
rules; use a password manager or six dice-chosen words from the EFF long
word list; two-factor authentication.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Confirmed fixed by the port (pg_dump run directly, no shell): a backup with
AYANOVA_BACKUP_PG_DUMP_PATH in a folder path with spaces works. No manual
workaround to remove; changelog line extended.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
pg_restore --no-owner --no-privileges --role=<user>, so the restored tables
belong to that user (otherwise the integrity check stops AyaNova).
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
The manual had users create ~/.ayanova-data with sudo, but AyaNova runs with
sudo so ~ is root's home and that folder was never used. AyaNova creates the
data folder itself; the step now says where it is (/root/.ayanova-data) and
how to choose another location.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
The request's link to the work order item blocked the delete with a database
error (500). Deleting the item now unlinks any request accepted into it and
sets it back to Open, in the same transaction, with a history entry and no
notification. Service request manual page and changelog.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
The backup time is stored as the UTC moment it meant on the day it was set
and was run at that UTC hour every day, so on servers with daylight saving it
ran an hour off the chosen time for part of the year. SetNextBackup now
recovers the clock time with the stored date's offset and runs it on the
server's local days. No migration. Backup manual page and changelog.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
The page log showed console.error objects only as JSHandle@object and errors
without their stack. Each ERROR line is still logged at once; object and
Error arguments are then fetched from the page and added as detail lines
(object JSON, error stack without Puppeteer frames and with file names only).
A failing render waits up to 2 s for pending details. Page log appends are
locked. Report designer manual (Script errors) and changelog.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Token date ranges (*today*, *lastmonth* ...) are built from the user's local
time in clientTimeStamp but were converted to UTC with ToUniversalTime(), the
server's time zone. They are now converted with clientTimeStamp.Offset. Lists
and dashboard widgets share this builder. Deferred: daylight saving edge and
dashboard grouping by UTC day (both need the client's time zone name).
Changelog.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
msvcp140.dll, vcruntime140.dll and vcruntime140_1.dll (14.44.35211.0,
Microsoft-signed) in postgres-standalone\bin, app-local, so the embedded
PostgreSQL starts on Windows without the Visual C++ runtime. Changelog;
BUILD.md notes they are replaced by hand.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
The 8.2.4 and older launchers left PostgreSQL running after the in-app
shutdown, so every standalone upgrade stopped at "files in use" and could not
close it. PrepareToInstall and uninstall now run the installed pg_ctl stop.
Changelog; BUILD.md.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Audit of every documented role right against BizRoles, decided with John:
Tech restricted reads tax codes, projects, unit models and meter readings;
Business administration reads server metrics; Accounting no longer enters
meter readings (both meter reading routes checked Unit rights, now meter
reading rights); no Subcontractor roles on memos; integrations: data
operations open to all full staff roles, switching Active and deleting are
Business administration only. Integrated applications page and changelog.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Direct messages are general notifications with no object, so the 12-hour
repeat check in CoreJobNotify (case 3917, keyed on subscription and object)
dropped every message to a user after the first. For general notifications
the check now applies only to the job's own delivery error messages
(DELIVERY_ERROR_NAME). Changelog.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
UserBiz.ValidateCanDelete refused a delete only when the user had related
records, so SuperUser with none could be deleted and nothing could bring it
back. User 1 is now refused (2004) before any other check. Changelog.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
The report page gets placeholders for the token and download key; request
interception (ReportApiRelay, now in every kind of install) puts the real
values only on the page's requests to ayApiUrl, then relays them (IIS) or
lets the browser continue. Requests to other addresses go out unchanged,
without credentials. Notification reports keep their rights. Report
scripting manual and changelog updated. F20 fixed.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Business administration - restricted could create, edit and import report
templates, although the roles page uses exactly this as its example of a
view-only restricted role. A template's script runs with the rights of
whoever renders it (SuperUser for customer notifications), so changing one
is an administrator right (F20). Report templates page and changelog
updated. Deferred: audit every documented role right against BizRoles.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Inside IIS (in-process) AyaNova has no port of its own, so the report page
could not reach the API: user reports called http://127.0.0.1:<request port>
(reset on https), notification reports 127.0.0.1:7575 (refused). Under IIS the
page's requests under the API URL are now intercepted and made by the server
(util/ReportApiRelay.cs) to the local address and port a user's request
arrived on, with its host name and scheme; notification reports use the
latest signed-in request, else the override. Outside IIS nothing changes.
The notification token check requires a request from this machine, no longer
host 127.0.0.1. Manual (IIS install, override page) and changelog updated.
Deferred: emailed PDF content type application/pdf/pdf.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Both installers drop users-modify from the program folder (and local-postgres
in the single-user installer) and run icacls to remove the Users group's own
grants (by SID) from the program folder after copying files, so upgrades over
8.2.4 lose them too. The data folder keeps users-modify and config.json stays
readable by local users (the running account is not known at install time);
both documented in the single-user and LAN install pages. Changelog updated.
F2 fixed (write access), the rest accepted. Deferred: report on a missing
record fails with a generic error.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
New config setting AYANOVA_TRUSTED_PROXIES (IP addresses or CIDR networks)
for reverse proxies on another computer: their X-Forwarded-For is used, a
chain of trusted proxies is followed, invalid entries are warned at boot.
X-Forwarded-For from a proxy that is not trusted logs one warning per server
start naming the proxy's address. Without the setting nothing changes (only
a loopback proxy is trusted). Shown in server info; manual page, Linux install
note, changelog. F6 follow-up recorded.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
The anonymous page at /api/v8/ shows the version and its links only: the
licence block is removed and the support link no longer carries the DB
ID and licensee. F11 fixed (4727 step 2).
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Logo upload and delete need change rights on Global (was read rights,
which BizAdminRestricted has). The image type is taken from the bytes:
PNG, JPEG, GIF, WebP or SVG, anything else refused; the claimed type is
not stored. Downloads send nosniff and a sandbox Content-Security-Policy,
so an SVG opened by its URL runs no script. F23 fixed (4727 step 1).
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
FormFieldReferenceList and FormFieldKeys built their static lists lazily
and published them before filling them, so requests arriving during the
first build after a restart saw a half-filled list ("is not valid").
Both are now built in a local and published when complete (volatile).
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Failed logins are counted in memory (util/LoginThrottle.cs): 10 per login
name or 50 per client address within 15 minutes, then attempts are refused
with 429 for the rest of the window without checking the password. A
correct password clears the login's count; loopback is not counted per
address. Each lockout is logged. F6 fixed (2FA part in case 4710).
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
A password set by someone else (reset code, administrator) or a disabled
login replaces the user's session token and download key; changing one's
own password keeps the session. PasswordResetCodeExpire is cleared (was
DlKeyExpire). The token middleware exempts only the exact login and
notify/hello routes and refuses inactive users and users who may not log
in. With a purchased licence, notify/hello no longer offers the default
SuperUser login and a SuperUser with the default password may only change
it (SuperUserDefaultPasswordRoutes). F7, F8 and F9 fixed. Manual and
changelog updated.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Mailer checks the SMTP server's certificate (trust and name; no revocation
check). New config setting AYANOVA_SMTP_ACCEPT_ANY_CERTIFICATE accepts any
certificate (boot warning, shown in server info, manual page).
The notification settings GET returns ******** instead of the SMTP
password; a PUT with ******** or empty keeps the stored password.
F30 and F31 fixed. Changelog and manual updated.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
PickListSqlBuilder put the search text and the tag search text into the SQL
inside quotes with no escaping, reachable by any login (security review F18);
an apostrophe in a search also made the query fail. The builder now writes
@plq / @pltag and PickListFetcher adds them as Npgsql parameters (same %text%
match; wildcards typed by the user still apply).
Changelog: searching selection lists for text with an apostrophe now works.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
The LAN/IIS and Linux templates shipped a placeholder secret printed in the
manual, and installs that kept it signed logins with a public key; any setting
also invited short or reused values (security review F1). The setting is now
ignored (one warning at boot if still present): the server generates a key once
(48 random bytes) into jwt-signing.key in the data folder (beside the app if
there is none; owner-only on Linux) and reuses it, so sign-ins also survive a
restart where the server used to make a new key each boot (standalone, Linux
desktop). If the file cannot be used, a temporary key is used for that run.
Templates and dev launch configs drop the setting; manual updated (key page
rewritten, setting steps removed from install pages); changelog line.
Checked locally: token forged with the old placeholder 401; key file created
and reused after restart (old token 200); auth and 2FA tests pass.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
The 2FA step matched the user by temp token alone, and the token was left
empty after a successful 2FA login (null right after turning 2FA on), so an
empty or missing token skipped the password step (security review F5).
Now: an empty or missing temp token is refused before the lookup; the token is
cleared to null after success; after 5 wrong codes the token is cleared, so the
password must be entered again (counted in memory per user).
Changelog: general security notice for self-hosted upgrades, and the one
behaviour change users can see. SECURITY-REVIEW.md: F5 fixed.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Also removes the server-only /var/ayanova chown/chmod lines from the Linux desktop upgrade page.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
