Foundation
- Pull in Tailwind via CDN with the full Stitch design tokens
(palette, typography, spacing, radius) inline in <head>. Preflight
disabled so the rest of the legacy inline CSS keeps applying until
each screen is migrated.
- Add Hanken Grotesk + JetBrains Mono + Material Symbols Outlined
via Google Fonts.
- Replace the page header with the Stitch dark-slate top bar: brand
on the left, segmented tab nav in the middle, user pill + logout
on the right. Floating userBadge removed; renderUserBadge() now
writes the display name into #headerUserName and wires the
existing logout button.
Login
- Single card mirroring the Stitch login mockup with icon-prefixed
inputs (person/lock), focus ring, error banner and a primary CTA
that includes the login glyph. Setup mode swaps the heading,
shows the orange info bar with admin_panel_settings glyph and
changes the button to "Administrator anlegen".
Wizard (Schaltung erfassen)
- Step 1: anbieter button grid in Stitch style — bordered cards
with a material icon, hover lift and primary-coloured outline.
- Step 2: white card with a "← Anbieter ändern" pill in the
header, two-column layout (Aktivierungsdaten / Vertragsdaten),
label-caps form labels, JetBrains-Mono numeric inputs for
dates/ID/phone and a dashed file-drop zone. Save button gains
the save glyph.
Other screens (Übersicht, Provisionen, Gelöschte, Administration,
Benutzer) still render in the legacy style — those migrations
follow in the next steps.
Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
Bug fixes
- Sync database.js schema with actual production DB (tarifoptionen
shape was wrong; new installs would have broken).
- Fix SQL syntax error `SELECT to.*` (reserved keyword) in single-
schaltung provision endpoint, plus the dead fallback hierarchy
that selected columns that were never in the query.
- Fix PUT /api/tarifoptionen/:id writing to non-existent column
provision_betrag (should be provision_euro).
- Fix race condition in PUT /api/schaltungen/:id where forEach with
async db.run inside a transaction could send duplicate responses.
- Delete dokumente rows explicitly before deleting schaltung
(existing DBs lack ON DELETE CASCADE on dokumente FK).
- Replace hardcoded basisBetrag=100 for percent rules; basis is now
configurable per rule via the new basis_euro column.
Security
- Multi-user authentication: users table, bcryptjs, express-session
with SQLite store, login/logout/me/setup/change-password endpoints.
- Auth gate on all /api/* except /api/auth/*.
- CLI to create users: npm run create-user -- <user> <pass> [--admin].
- helmet for security headers.
- CORS restricted to ALLOWED_ORIGINS env (default same-origin).
- Rate limits: 300/min global, 20/15min on login.
- Path-traversal validation on document download/delete.
- XSS hardening in frontend: escapeHtml helper applied to all
DB-derived innerHTML interpolations; inline onclick handlers that
embedded user-controlled strings replaced with data-* attrs +
addEventListener.
Architecture
- Provision calculation centralised in provisionService.js as the
single source of truth (was duplicated and inconsistent).
- server.js cut from 2138 to ~140 lines; routes split into per-
resource modules under routes/.
- Promise wrapper db.js for sqlite3 callbacks; async/await in routes.
- middleware/ for auth and async error handling.
Tests
- 14 unit tests for provisionService covering fallback hierarchy,
percent calculation, tarifoptionen, hardware logic, employee
commission. All green.
Config
- dotenv loads .env.local at startup (gitignored).
- .gitignore extended for sessions.db and .env*.
Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
kerimatilganandClaude Opus 4.7