Release: merge development into beta

.github/workflows/code-quality.yml

@@ -9,6 +9,7 @@ on:
 
 jobs:
   quality:
+    if: (github.event_name != 'pull_request' || github.head_ref != 'development')
     # ConductionNL, NOT Conduction. Commit 5f4069ac ("org rename", 2026-06-01)
     # pointed every reusable-workflow call in this repo at `Conduction/.github`,
     # an org that does not exist. Actions cannot resolve it, so from that date
@@ -151,6 +152,17 @@ jobs:
       # and say why — it is still honoured. To roll back for everyone, revert on
       # ConductionNL/.github main.
       enable-hydra-gates: true
+      # ── Cost controls (see ConductionNL/.github#596, #599) ───────────────
+      # Run PHPUnit and Playwright only when the diff could change their
+      # verdict. Fails safe TOWARDS running: an unreadable diff, a force-push,
+      # a branch creation or a dispatch all run everything, and a filtered
+      # skip is a declared state in the Quality Report, not a missing one.
+      enable-path-filtering: true
+      # PR-time PHPUnit runs the primary PHP against the newest declared
+      # Nextcloud; the full matrix still runs on every push to a default
+      # branch and on the release PR into beta. Breadth moves from
+      # per-commit to per-merge, it is not dropped.
+      reduce-pr-matrix: true
 
   # Translation-completeness gate: every required European locale must carry a
   # real translation for every key in l10n/en.json. Dependency-free pure Node

appinfo/info.xml

@@ -42,7 +42,7 @@ Vrij en open source onder de EUPL-1.2-licentie.
 
 **Ondersteuning:** Voor ondersteuning, neem contact op via support@conduction.nl.
     ]]></description>
-    <version>0.2.17</version>
+    <version>0.2.23-unstable.20261003100000</version>
     <licence>EUPL-1.2</licence>
     <author mail="info@conduction.nl" homepage="https://www.conduction.nl/">Conduction</author>
     <namespace>Planninq</namespace>
@@ -161,7 +161,45 @@ Vrij en open source onder de EUPL-1.2-licentie.
             <step>OCA\Planninq\Repair\MigrateAppConfigKeys</step>
             <step>OCA\Planninq\Repair\MigrateUserPreferences</step>
             <step>OCA\Planninq\Repair\MigrateRegisterSlug</step>
+            <!--
+                ONE LEVEL DOWN FROM MigrateRegisterSlug, AND THE SAME TRAP.
+                `timeEntry` is a slug three apps declared — humaniq's HR
+                booking, pipelinq's billing record and this app's project
+                booking — and a slug is global per organisation, so
+                SchemaMapper::find() answered whichever row it reached first.
+                humaniq owns the hours; this record is the PLANNING side of one,
+                and keeps a `timeEntry` reference to the humaniq booking.
+
+                Renaming the row BEFORE InitializeSettings is what makes it a
+                rename: the import matches by (application, slug) and its
+                not-found branch CREATES a second schema, orphaning every
+                existing entry silently while the app reads an empty list.
+            -->
+            <step>OCA\Planninq\Repair\RenameTimeEntrySchemaSlug</step>
             <step>OCA\Planninq\Repair\InitializeSettings</step>
+            <!--
+                AFTER InitializeSettings, in BOTH blocks (planninq#681). The
+                import adds the `members` property that task, column,
+                projectPhase and plannedTimeEntry are now scoped by; before it
+                there is no column to fill. Rows stored before this release
+                have no list, and the new rule hides them from every member
+                until this step has run. Idempotent and never throws.
+            -->
+            <step>OCA\Planninq\Repair\BackfillProjectMembers</step>
+            <!--
+                AFTER InitializeSettings and BackfillProjectMembers, in BOTH
+                blocks (boards-configurable-columns). The board groups cards by
+                column now, and a task stored before this release has none, so
+                it would drop off the board. The import adds the column's
+                `status`; this step then creates default columns where a
+                project has none and places each column-less, not cancelled
+                task. Idempotent and never throws.
+            -->
+            <step>OCA\Planninq\Repair\AssignBoardColumns</step>
+            <!-- AFTER InitializeSettings (projects-lifecycle-policy): the import
+                 rewrites the project schema, so the reviewers of project
+                 requests are written back in. Never throws. -->
+            <step>OCA\Planninq\Repair\ApplyProjectPolicy</step>
             <step>OCA\Planninq\Repair\ReconcileDueReminderOverrides</step>
         </post-migration>
         <install>
@@ -178,7 +216,13 @@ Vrij en open source onder de EUPL-1.2-licentie.
                 happen here or the import below forks a second, empty register.
             -->
             <step>OCA\Planninq\Repair\MigrateRegisterSlug</step>
+            <!-- See the note in <post-migration>. -->
+            <step>OCA\Planninq\Repair\RenameTimeEntrySchemaSlug</step>
             <step>OCA\Planninq\Repair\InitializeSettings</step>
+            <!-- See the note in <post-migration>. -->
+            <step>OCA\Planninq\Repair\BackfillProjectMembers</step>
+            <step>OCA\Planninq\Repair\AssignBoardColumns</step>
+            <step>OCA\Planninq\Repair\ApplyProjectPolicy</step>
         </install>
     </repair-steps>
 

appinfo/routes.php

@@ -12,11 +12,13 @@
     // First-time setup wizard (ADR-042) - the standard CnSetupWizard contract.
     ['name' => 'setup#status',    'url' => '/api/setup/status',            'verb' => 'GET'],
     ['name' => 'setup#runAction', 'url' => '/api/setup/action/{actionId}', 'verb' => 'POST', 'requirements' => ['actionId' => '[a-z0-9\\-]+']],
+    ['name' => 'setup#saveConfig', 'url' => '/api/setup/config',           'verb' => 'POST'],
     ['name' => 'settings#updateUser', 'url' => '/api/settings/user', 'verb' => 'POST'],
 
     // Project creation policy check — enforces allow_project_creation server-side.
     ['name' => 'project#checkCreatePolicy', 'url' => '/api/projects/check-create-policy', 'verb' => 'GET'],
     // Project create proxy — C1: enforces policy then calls OR ObjectService server-side.
+    ['name' => 'project#keyAvailable', 'url' => '/api/projects/key-available', 'verb' => 'GET'],
     ['name' => 'project#create', 'url' => '/api/projects', 'verb' => 'POST'],
     // Leave-project proxy — C3: allows non-owner members to remove themselves (_rbac: false).
     ['name' => 'project#leaveProject', 'url' => '/api/projects/{projectId}/leave', 'verb' => 'POST', 'requirements' => ['projectId' => '[^/]+']],
@@ -32,6 +34,34 @@
     // Dependency edge delete — project-member guarded.
     ['name' => 'dependency#destroy', 'url' => '/api/dependencies/{id}', 'verb' => 'DELETE', 'requirements' => ['id' => '[^/]+']],
 
+    // Microsoft Project plan import: preview (writes nothing), then import. Owner or admin, checked per project.
+    ['name' => 'projectImport#preview', 'url' => '/api/projects/{projectId}/import/msproject/preview', 'verb' => 'POST', 'requirements' => ['projectId' => '[^/]+']],
+    ['name' => 'projectImport#import', 'url' => '/api/projects/{projectId}/import/msproject', 'verb' => 'POST', 'requirements' => ['projectId' => '[^/]+']],
+
+    // Case handover: copy a project's files and metadata to its linked case. Owner or admin, checked per project.
+    ['name' => 'caseHandover#status', 'url' => '/api/projects/{projectId}/case-handover', 'verb' => 'GET', 'requirements' => ['projectId' => '[^/]+']],
+    ['name' => 'caseHandover#handOver', 'url' => '/api/projects/{projectId}/case-handover', 'verb' => 'POST', 'requirements' => ['projectId' => '[^/]+']],
+
     // Read-only per-project timeline (Gantt) — RBAC-scoped through OR ObjectService.
     ['name' => 'timeline#forProject', 'url' => '/api/projects/{projectId}/timeline', 'verb' => 'GET', 'requirements' => ['projectId' => '[^/]+']],
+    // Several projects on one axis (portfolio timeline), same RBAC-scoped read per project.
+    ['name' => 'timeline#forProjects', 'url' => '/api/timeline', 'verb' => 'GET'],
+    // Cumulative flow and lead/cycle time, replayed from the audit trail (portfolio-flow-reports).
+    ['name' => 'flow#forProject', 'url' => '/api/projects/{projectId}/flow', 'verb' => 'GET', 'requirements' => ['projectId' => '[^/]+']],
+    ['name' => 'flow#forPortfolio', 'url' => '/api/portfolios/{portfolioId}/flow', 'verb' => 'GET', 'requirements' => ['portfolioId' => '[^/]+']],
+
+    // School timetable (school-timetable-target, decision D10): signed-in users
+    // read a cohort's, group's or teacher's sessions; admins upsert a batch by hand.
+    ['name' => 'timetable#sessions', 'url' => '/api/timetable/sessions', 'verb' => 'GET'],
+    ['name' => 'timetable#upsert', 'url' => '/api/timetable/sessions/upsert', 'verb' => 'POST'],
+    // Admins publish a source's draft lessons in a window (timetable-draft-review).
+    ['name' => 'timetable#publish', 'url' => '/api/timetable/sessions/publish', 'verb' => 'POST'],
+    // Admins upload the activities and rooms sheets for the timetable generator (timetabling-generator 2.2).
+    ['name' => 'timetableInput#upload', 'url' => '/api/timetable/input/upload', 'verb' => 'POST'],
+    // Admins start a generator run for a timetable scenario (timetabling-generator 5.2).
+    ['name' => 'timetableScenario#generate', 'url' => '/api/timetable/scenarios/{id}/generate', 'verb' => 'POST'],
+    // Admins take the current timetable into an imported scenario (timetabling-generator 6.1).
+    ['name' => 'timetableScenario#importCurrent', 'url' => '/api/timetable/scenarios/{id}/import', 'verb' => 'POST'],
+    // Admins publish a scenario as draft lessons for its window (timetabling-generator 8.1).
+    ['name' => 'timetableScenario#publishDrafts', 'url' => '/api/timetable/scenarios/{id}/publish-drafts', 'verb' => 'POST'],
 ]);

composer.json

@@ -19,10 +19,10 @@
     },
     "require-dev": {
         "conduction/coding-standard": "^1.0",
-        "conduction/hydra-gates": "^1.7.1",
+        "conduction/hydra-gates": "^1.14.0",
         "cyclonedx/cyclonedx-php-composer": "^6.2",
         "edgedesign/phpqa": "^1.27",
-        "nextcloud/ocp": "^34.0",
+        "nextcloud/ocp": "^35.0",
         "phpcsstandards/phpcsextra": "^1.4",
         "phpmd/phpmd": "^2.15",
         "phpmetrics/phpmetrics": "^2.8",
@@ -39,9 +39,9 @@
         "phpcs": "./vendor/bin/phpcs --standard=phpcs.xml",
         "phpcs:fix": "./vendor/bin/phpcbf --standard=phpcs.xml",
         "phpcs:output": "./vendor/bin/phpcs --standard=phpcs.xml --report=json lib/ 2>/dev/null | tail -1 > phpcs-output.json",
-        "phpmd": "E=0; ./vendor/bin/phpmd lib text phpmd.xml || E=$?; ./vendor/bin/phpmd lib text vendor/conduction/hydra-gates/quality-config/phpmd-unusedparams.xml || E=$?; exit $E",
+        "phpmd": "E=0; php -d memory_limit=2G ./vendor/bin/phpmd lib text phpmd.xml || E=$?; php -d memory_limit=2G ./vendor/bin/phpmd lib text vendor/conduction/hydra-gates/quality-config/phpmd-unusedparams.xml || E=$?; exit $E",
         "phpmetrics": "./vendor/bin/phpmetrics --report-html=phpmetrics lib/",
-        "psalm": "if [ -f vendor/bin/psalm ]; then ./vendor/bin/psalm --threads=1 --no-cache; else echo 'Psalm not installed, skipping...'; fi",
+        "psalm": "if [ -f vendor/bin/psalm ]; then ./vendor/bin/psalm --threads=1 --no-cache --memory-limit=2G; else echo 'Psalm not installed, skipping...'; fi",
         "phpstan": "if [ -f vendor/bin/phpstan ]; then ./vendor/bin/phpstan analyse --memory-limit=1G; else echo 'PHPStan not installed, skipping...'; fi",
         "test:unit": "if [ ! -f vendor/bin/phpunit ]; then echo 'phpunit not installed - run composer install' >&2; exit 1; elif [ -f ../../lib/base.php ]; then ./vendor/bin/phpunit -c phpunit.xml --colors=always; else echo 'No Nextcloud server tree (../../lib/base.php) - running the pure unit suite via phpunit-unit.xml, which stubs OCP from vendor/nextcloud/ocp.'; ./vendor/bin/phpunit -c phpunit-unit.xml --colors=always --no-coverage; fi",
         "test:all": "if [ ! -f vendor/bin/phpunit ]; then echo 'phpunit not installed - run composer install' >&2; exit 1; elif [ -f ../../lib/base.php ]; then ./vendor/bin/phpunit -c phpunit.xml --colors=always; else echo 'No Nextcloud server tree (../../lib/base.php) - running the pure unit suite via phpunit-unit.xml, which stubs OCP from vendor/nextcloud/ocp.'; ./vendor/bin/phpunit -c phpunit-unit.xml --colors=always --no-coverage; fi",