- README gains a "Datenschutz & Speicherung" section: local single-user tool,
unencrypted localStorage, avoid shared devices, export JSON to back up.
- Comments the generateId Math.random fallback as a non-crypto last resort,
acceptable for local employee ids.
Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
Adds sanitizeCell(): cell values starting with = + - @ or a control char are
prefixed with an apostrophe so spreadsheets render them as literal text
instead of executing them as formulas. Applied to the names column.
Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
- SheetJS <script> now carries a sha384 integrity hash and crossorigin so a
compromised/MITM'd CDN cannot inject code.
- Adds a CSP meta: default-src 'self'; script-src limited to self +
cdn.sheetjs.com; style-src self + Google Fonts (+inline for app styles);
font-src gstatic; object-src 'none'; base-uri 'self'.
Verified headless against localhost: no CSP violations, SheetJS loads with
a valid integrity digest, app.js renders normally.
Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
removeEmployee now also filters the deleted employee's history entries, so
no orphaned "(unbekannt)" rows remain. Adds a test.
Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
saveState now logs a console.warn on failure and alerts the user once per
session (storage full/unavailable) so they can export their data and avoid
silent data loss.
Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
- loadFromJSON and the localStorage startup load now run employees through
normalizeEmployees(): fills missing constraints, drops unusable rows,
de-duplicates ids, and discards invalid vacation ranges — preventing
later crashes (e.g. c.neverDays on undefined) and same-day double-books.
- Excel import is wrapped in try/catch with a typeof XLSX guard and user
feedback; the Excel export button gets the same guard.
- createEmployee reuses the shared defaultConstraints() factory.
Adds normalizeEmployees tests (defaults, dropping, dedup, vacations) and a
loadFromJSON normalization test.
Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
generatePlan gains a preAssigned parameter: manual entries occupy slots,
count toward eligibility (maxPerMonth/minGap) and are never double-booked;
only the remaining slots per day are auto-filled. The generate handler now
keeps manual:true entries for the month instead of wiping them.
Adds tests for slot occupation, fully-manual days, and maxPerMonth counting.
Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
currentYear now initializes to the current year and the year selector
offers a rolling range (this year -1 to +2) so plans can be created
for years other than 2026.
Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
- Move inline style.cssText to semantic classes (cal-legend, cal-header-cell,
cal-day-tag-label, cal-btn-row) in calendar.js
- Buttons "FT"/"BU" → "Feiertag"/"Betriebsurl." for clarity
- Decorative turntable/mixer SVG header art in index.html
- style.css build-out for the new classes
- Initial README content
- Dev port 3000 → 3001
Co-Authored-By: Claude Opus 4.7 <noreply@anthropic.com>
Globale Einstellung moderatorsPerDay (1-5), Top-N-Algorithmus, dynamische
N Slots pro Tag im Kalender, Excel joint Namen mit " & ", Verlauf zeigt
eine Zeile pro Person.
Co-Authored-By: Claude Opus 4.7 <noreply@anthropic.com>
ferdi2goandClaude Opus 4.8