Commit Graph

21 Commits

Author SHA1 Message Date
697854e406 Add ntfy notification for super admin login
Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
2026-03-22 01:26:42 -07:00
090ebc109e Add Ntfy push notifications for super admin events
Sends alerts to a configurable Ntfy topic on: new user registration,
account lockout after 5 failed login attempts, and login attempts on an
already-locked account. Fire-and-forget — never raises if Ntfy is down.

Configure via NTFY_URL and NTFY_TOKEN in .env.

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
2026-03-22 01:04:12 -07:00
3022bc328b Security hardening: go-live review fixes
- TV tokens upgraded from 4 to 6 digits; Regen Token button in Admin
- Nginx rate limiting on TV dashboard and WebSocket endpoints
- Login lockout after 5 failed attempts (15 min); clears on admin password reset
- HSTS header added; CSP unsafe-inline removed from script-src; CORS restricted to explicit methods/headers
- Dependency CVE fixes: PyJWT 2.12.0, aiomysql 0.3.0, cryptography 46.0.5, python-multipart 0.0.22
- datetime.utcnow() replaced with datetime.now(timezone.utc) throughout
- SQL identifier whitelist for startup migration queries
- README updated: security notes section, lockout docs, token regen, NPM proxy guidance

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
2026-03-22 00:00:14 -07:00
be86cae7fa Update README for PDF export, DOCS_ENABLED flag, and WebSocket URL change
Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
2026-03-20 23:56:19 -07:00
fdd85d3df5 Add per-block agenda overrides for daily sessions
- Add 📝 Agenda button to each block in Today's Schedule on the Dashboard
- Dialog allows setting a free-text activity/note for that block for the current day
- Agenda replaces subject options in the TV center panel while set; clears on session end
- Backend: new SessionBlockAgenda model, PUT /api/sessions/{id}/blocks/{block_id}/agenda
- Agendas included in dashboard snapshot and session_update WS broadcast
- New agenda_update WS event keeps TV in sync live when agenda is saved or cleared
- Update README with feature description, project structure, and WS event table

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
2026-03-19 07:58:30 -07:00
d724262e27 Add Rules & Expectations feature with TV overlay and dashboard layout updates
- Add Rules & Expectations admin section with drag-to-reorder, add/edit/delete
- Add Overlays card to Dashboard with Rules/Expectations toggle button (LIVE badge when active)
- Add full-screen rules overlay on TV view (green theme, numbered list, tap to dismiss)
- Backend: new RuleItem model, /api/rules CRUD + bulk reorder, /api/overlays WS broadcast endpoints
- Schedule store handles show_rules / hide_rules WebSocket events
- Rearrange Dashboard top row: TV Dashboard | 3 Strikes | Overlays (3-col, mobile stacks)
- Put Today's Session and Today's Schedule side-by-side at 50/50 width (mobile stacks)
- Update README with all new features, setup steps, WS events, and project structure

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
2026-03-19 07:21:50 -07:00
68a5e9cb4f Add random 4-digit TV token per child for obfuscated TV URLs
Each child is assigned a unique permanent tv_token on creation. The TV
dashboard URL (/tv/:tvToken) and WebSocket (/ws/:tvToken) now use this
token instead of the internal DB ID. Existing children are backfilled
on startup. README updated to reflect the change.

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
2026-03-10 22:53:26 -07:00
4bd9218bf5 Clarify CORS_ORIGINS config in README with reverse proxy warning
Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
2026-03-10 22:39:59 -07:00
75f1730947 Update README with home icon and support card mention
Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
2026-03-10 22:20:19 -07:00
ff9a863393 Add Done button, tablet controls, super admin management, midnight strike reset, and activity log improvements
- Done button snaps block to full duration, marks complete, logs "Marked Done by User"; Reset after Done fully un-completes the block
- Session action buttons stretch full-width and double height for tablet tapping
- Super admin: reset password, disable/enable accounts, delete user (with cascade), last active date per user's timezone
- Disabled account login returns specific error message instead of generic invalid credentials
- Users can change own password from Admin → Settings
- Strikes reset automatically at midnight in user's configured timezone (lazy reset on page load)
- Break timer state fully restored when navigating away and back to dashboard
- Timer no longer auto-starts on navigation if it wasn't running before
- Implicit pause guard: no duplicate pause events when switching already-paused blocks or starting a break
- Block selection events removed from activity log; all event types have human-readable labels
- House emoji favicon via inline SVG data URI
- README updated to reflect all changes

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
2026-03-06 00:08:15 -08:00
f645d78c83 Add Meeting system subject and notification system
- Auto-create a locked "Meeting" subject for every user on registration
  and seed it for all existing users on startup
- Meeting subject cannot be deleted or renamed (is_system flag)
- 5-minute corner toast warning on Dashboard and TV with live countdown,
  dismiss button, and 1-minute re-notify if dismissed
- At start time: full-screen TV overlay with 30-second auto-dismiss,
  automatic pause of running block, switch to Meeting block, and
  auto-start of Meeting timer
- Web Audio API chimes: rising on warnings, falling at meeting start
- Update README with Meeting subject and notification system docs

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
2026-03-04 23:44:21 -08:00
c560055b10 Add Super Admin panel with user impersonation
- New /super-admin/login and /super-admin routes with separate auth
- Super admin can view all registered accounts and impersonate any user
- Impersonation banner shows at top of screen with exit button
- ADMIN_USERNAME and ADMIN_PASSWORD config added to .env and docker-compose.yml
- Fixed auth store: export setToken, clearToken, and setUser so they are
  accessible from superAdmin store
- Updated README with super admin feature, new env vars, and setup notes

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
2026-03-04 22:30:44 -08:00
c05543d855 Rework day progress bar to use block-duration time instead of wall clock
Both the TV and parent dashboard progress bars now calculate % complete
based on total scheduled block time vs. remaining block + break time,
so the bar only advances while blocks are actively being worked.

TV bar labels changed to "🟢 Start" and "Finish 🏁".
Parent dashboard shows first block's scheduled start time on the left
and a live estimated finish time (now + remaining block/break time) on
the right.

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
2026-03-03 13:38:40 -08:00
87e5ab7b5b Update README with break time and break activities features
Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
2026-03-03 08:44:08 -08:00
13f3e08744 Update README with current feature set and timer controls
- Rewrote Daily Sessions feature to describe the select/start/pause/resume/reset
  workflow instead of the old auto-start-on-click behavior
- Added Dashboard Controls table documenting each button's condition and action
- Updated Activity Log to include reset events
- Added utils/timer.py to project structure
- Expanded WebSocket Events table with select, reset, prev_block_* fields
- Removed stale description of single-click auto-start block switching

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
2026-03-03 00:32:40 -08:00
115fe12886 Update README to reflect current feature set and project structure
- Add Morning Routine, strike event logging, block timer remaining,
  and single-click block switching to features
- Remove /schedules as a separate route (schedule management is in /admin)
- Remove docker-compose.override.yml and alembic/ references (neither exists)
- Replace Database Migrations section with accurate description of
  the create_all + idempotent ALTER TABLE startup approach
- Update project structure to show new model/router files
- Update setup steps and URL table to match current routes
- Add block_elapsed_seconds to WebSocket events table

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
2026-03-01 22:28:12 -08:00
a63674fe56 Update README to document block switching behavior
Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
2026-03-01 21:26:01 -08:00
63230149c5 Update README for activity log and session state improvements
Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
2026-03-01 19:22:02 -08:00
823260cdd8 Add timezone selector to Admin settings with full-stack support
- Add `timezone` column to User model (VARCHAR 64, default UTC) with
  idempotent startup migration
- Expose and persist timezone via PATCH /api/users/me
- Fix TimerEvent.occurred_at serialization to include UTC offset marker
  (+00:00) so JavaScript correctly parses timestamps as UTC
- Add frontend utility (src/utils/time.js) with timezone-aware
  formatTime, getHHMM, getDateInTZ, tzDateTimeToUTC helpers and a
  curated IANA timezone list
- Add Settings section to Admin page with timezone dropdown; saves to
  both the API and localStorage for the unauthenticated TV view
- Update Activity Log to display and edit times in the user's timezone
- Update TV dashboard clock to respect the saved timezone
- Update README: features, setup steps, usage table, WebSocket events

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
2026-03-01 14:16:37 -08:00
e92476db07 Add comprehensive README
Covers project overview, tech stack, directory structure, getting
started steps, usage guide, dev mode, database migrations, WebSocket
events, and environment variable reference.

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
2026-02-27 23:04:41 -08:00
93e0494864 Initial commit 2026-02-27 22:55:14 -08:00