kirche-einfach/CHANGELOG.md

Changelog

All notable changes to this project will be documented in this file. The format is based on Keep a Changelog, and this project adheres to Semantic Versioning.

[Unreleased]

Added

• Flow-Sync ist jetzt ein manueller Full-Pass: POST /api/flows/sync (Button "Aus Langflow synchronisieren" in der Verwaltung) holt erst alle Flows aus Langflow nach backend/flows/*.json und deployed sie danach automatisch (Report mit pulled-Liste). Der Hintergrund-Beobachter und der Startup-Sync bleiben dateibasiert. Die Verwaltung zeigt eine deutsche Schritt-Anleitung direkt beim Sync-Button.

Fixed

• Flow-Sync aus Langflow: neue Flows blieben unsichtbar, weil LFX-Uploads mit Permission denied scheiterten (named Volume root-owned, LFX läuft rootless). lfx-entrypoint.sh chownt /flows per gosu vor dem Start; zusätzlich Pull-Dedup (wiederverwendet gleichnamige/identische Dateien statt Bindestrich-Duplikate wie simple-rule.json, die jede Sync-Meldung mit Namenskonflikten füllten).
• LFX runtime user gets a home directory (useradd -m, HOME set): without one every flow run failed with "Settings service not found".

Security

• Production ops: scripts/check_prod.py validates .env secrets and modes before deploy (with tests); README production checklist (proxy gates for Langflow, secret rotation, upgrade runbook).

Security

• API authorization: flow management is admin-only, runs and run/approval reads require login with strict session-tenant scoping, approval decisions record the session user, and flow callbacks authenticate with a shared X-Callback-Token (CALLBACK_TOKEN). Request-controlled tenant_id, callback_base_url and continuation_flow_id were removed (SSRF / cross-tenant / flow-chaining hardening); continuations now resolve from the admin-authored definition.
• Frontend: /app/* routes require login; approver is the session user.
• Edge hardening: interactive API docs only with debug, security headers (nosniff/frame/Referrer-Policy), 2 MiB body cap, per-IP run throttle, generic upstream-error responses, magic links never logged.
• Containers run rootless (api/vite as uid 1000, lfx as lfx user); frontend fails closed to preview mode unless FRONTEND_MODE=dev.

Added

• Landing page: status-quo problem block, 5-step process with quote, portal overview with admin areas, AI platform parts, exception tiers, quantified benefits, integrations, use-case examples, pilot-program section, expanded FAQ (8 items incl. KI data usage, price model, responsibility).

Changed

• Landing page copy overhauled after 3 reviewer rounds (church-admin compliance wording: "entwickelt nach DSG-EKD/DSGVO" + AVV/TOMs, human release responsibility, honest pilot framing instead of invented testimonials; CTA now "Pilotgespräch vereinbaren").
• New photo pilot-meeting.webp (consultation scene, self-hosted).
• Backend lint + format standards via ruff (pinned dev dependency, enforced in CI): uv run ruff check ., uv run ruff format.

[0.1.0] - 2026-09-13

Added

• Repo scaffold: docker-compose dev/prod, version-pinned images, devcontainer.
• Magic-link auth, access requests, RBAC, frontend access-management UI.
• File-based flow source of truth + sync engine + LFX runtime.
• RJSF dynamic forms, router, Mantine dark-mode design system.
• Conversion landing page, automated screenshots, bell-tower favicon.
• Email-first login, branded multipart HTML magic-link mails.
• lfx level-4 validation on all canonical flows + regression test.