Merge branch 'ulsklyc:main' into main

Author: joshuawowk

.env.example

@@ -80,6 +80,16 @@ SYNC_INTERVAL_MINUTES=15
 # WEBDAV_BACKUP_PATH=/oikos/backups/
 # WEBDAV_BACKUP_KEEP=10                # Remote backups to keep (default: 7)
 
+# WebDAV Document Storage (optional — stores newly uploaded document files remotely)
+# Non-empty values override the corresponding database settings. Existing WebDAV
+# documents remain readable when new WebDAV uploads are disabled. Use this trusted
+# deployment configuration for private/LAN WebDAV targets; UI-managed URLs must be public.
+# DOCUMENT_STORAGE_WEBDAV_ENABLED=false
+# DOCUMENT_STORAGE_WEBDAV_URL=https://cloud.example.com/remote.php/dav/files/username/
+# DOCUMENT_STORAGE_WEBDAV_USERNAME=username
+# DOCUMENT_STORAGE_WEBDAV_PASSWORD=secret
+# DOCUMENT_STORAGE_WEBDAV_PATH=yuvomi-documents
+
 # Security
 RATE_LIMIT_WINDOW_MS=60000
 RATE_LIMIT_MAX_ATTEMPTS=5

.gitignore

@@ -34,7 +34,6 @@ data/
 .idea/
 *.swp
 *.swo
-.codex 
 AGENTS.md
 
 # Claude Code — share skills/agents/rules/hooks/settings; keep local permissions and worktrees out

CHANGELOG.md

@@ -7,6 +7,39 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0
 
 ## [Unreleased]
 
+## [0.70.2] - 2026-06-10
+
+### Security
+- **WebDAV document storage**: UI-managed targets now reject private, loopback, link-local, internal-DNS, and DNS-rebinding destinations both before persistence and during socket lookup. Trusted private-network targets remain available through `DOCUMENT_STORAGE_WEBDAV_URL`.
+- **WebDAV path normalization**: replaced ambiguous trailing-slash regular expressions with linear path processing to prevent polynomial-time matching on attacker-controlled configuration.
+
+## [0.70.1] - 2026-06-10
+
+### Removed
+- **Repository metadata**: removed the last published reference to an internal development tool.
+
+## [0.70.0] - 2026-06-10
+
+### Added
+- **WebDAV document storage**: admins can select WebDAV as the global destination for new document files, including calendar attachments, with per-field environment overrides, connection tests, protected configuration changes, and clear local/WebDAV/DMS status throughout the interface.
+
+### Changed
+- **Document binary handling**: previews, downloads, calendar attachments, deletion, and Paperless/DMS uploads now share one storage layer. Existing local files stay local, failed WebDAV uploads never fall back silently, failed database writes clean up staged remote files, and database backups explicitly exclude WebDAV binaries, which must be backed up separately.
+
+## [0.69.0] - 2026-06-10
+
+### Added
+- **Documents — Paperless-ngx (DMS) integration**: admins can connect a Paperless-ngx document management system in Settings (server URL + API token, with a connection test). Multiple DMS accounts are supported.
+- **Link from DMS**: search a connected DMS and link existing documents into the Documents module as references — the binary stays in the DMS and is not duplicated. Previews and downloads of linked documents are proxied live from the DMS, while each document's family/restricted/private visibility is still enforced.
+- **Upload to DMS**: push a local document up into the connected DMS (asynchronous OCR ingestion); when several DMS accounts are configured, an account picker lets you choose the target.
+
+All DMS operations are admin-only, and the API token is never returned in responses. The integration uses a provider-pluggable adapter layer (Paperless-ngx is the first adapter) and requires no new environment variables — everything is configured in-app.
+
+## [0.68.4] - 2026-06-09
+
+### Fixed
+- **Documents**: PDF previews no longer fail with "This page was blocked by Chrome" in Chromium-based browsers. The preview iframe dropped its `sandbox` attribute (Chromium refuses to start its internal PDF viewer inside sandboxed frames) and the `/documents/:id/preview` endpoint now sends a PDF-specific Content-Security-Policy (`default-src 'self'`) instead of the strict `default-src 'none'` that blocked the native viewer. PDFs are still served same-origin as `application/pdf` with `X-Content-Type-Options: nosniff`, so no scripts can execute; non-PDF previews keep the strict policy.
+
 ## [0.68.3] - 2026-06-09
 
 ### Changed

README.md

@@ -158,7 +158,7 @@ Each module is independent. Use what fits, skip what doesn't.
 | ![meals](https://raw.githubusercontent.com/ulsklyc/yuvomi/main/docs/icons/meals.png) | **Meals** | Weekly drag-and-drop planner with multiple items per slot. Direct export to shopping list. |
 | ![recipes](https://raw.githubusercontent.com/ulsklyc/yuvomi/main/docs/icons/recipes.png) | **Recipes** | Create, duplicate, and scale recipes. Pre-fill meal slots or save any planned meal as a recipe. |
 | ![calendar](https://raw.githubusercontent.com/ulsklyc/yuvomi/main/docs/icons/calendar.png) | **Calendar** | Google Calendar (OAuth) and CalDAV sync (iCloud, Nextcloud, Radicale). ICS subscriptions, recurring events, file attachments, public & school holiday overlays (OpenHolidays), month and agenda views. |
-| ![documents](https://raw.githubusercontent.com/ulsklyc/yuvomi/main/docs/icons/documents.png) | **Documents** | Upload and organize family files. Folders, tags, per-document visibility controls, in-browser preview, drag-and-drop. |
+| ![documents](https://raw.githubusercontent.com/ulsklyc/yuvomi/main/docs/icons/documents.png) | **Documents** | Upload and organize family files. Folders, tags, per-document visibility controls, in-browser preview, drag-and-drop. New files, including calendar attachments, can optionally use WebDAV storage; Paperless-ngx (DMS) linking and uploads remain supported. |
 | ![budget](https://raw.githubusercontent.com/ulsklyc/yuvomi/main/docs/icons/budget.png) | **Budget** | Income, expenses, recurring entries, trend charts, CSV export. Split Expenses with automatic debt simplification. |
 | ![housekeeping](https://raw.githubusercontent.com/ulsklyc/yuvomi/main/docs/icons/housekeeping.png) | **Housekeeping** | Manage household staff — schedules, check-in/out, daily or hourly billing, chores, supply requests. |
 | ![notes](https://raw.githubusercontent.com/ulsklyc/yuvomi/main/docs/icons/notes.png) | **Notes & Contacts** | Colored sticky notes with Markdown. Contact directory with CardDAV sync. |
@@ -168,6 +168,10 @@ Each module is independent. Use what fits, skip what doesn't.
 | ![api-tokens](https://raw.githubusercontent.com/ulsklyc/yuvomi/main/docs/icons/api-tokens.png) | **API Tokens** | Named Bearer / X-API-Key tokens for integrations. OpenAPI 3.0 spec included. |
 | ![backup](https://raw.githubusercontent.com/ulsklyc/yuvomi/main/docs/icons/backup.png) | **Backup** | Manual and scheduled database backup and restore, with automatic pre-restore rollback. Optional WebDAV upload target (Nextcloud, ownCloud, Hetzner, etc.). |
 
+> **WebDAV document storage needs its own backup.** SQLite/database backups contain document metadata and links, but not document binaries stored on WebDAV. Back up the WebDAV target separately.
+> WebDAV targets configured in the admin UI must resolve to public network addresses. For a trusted
+> LAN or loopback target, set `DOCUMENT_STORAGE_WEBDAV_URL` through the deployment environment.
+
 ---
 
 ## Design & technology
@@ -259,7 +263,7 @@ Open `http://localhost:3000`. The first visit walks you through creating your ad
 
 [Installation](docs/installation.md)  ·  [Spec & data model](docs/SPEC.md)  ·  [Modules](MODULES.md)  ·  [Contributing](CONTRIBUTING.md)  ·  [Security](SECURITY.md)  ·  [Privacy for self-hosters](docs/PRIVACY-FOR-SELFHOSTERS.md)  ·  [Changelog](CHANGELOG.md)  ·  [Backlog](BACKLOG.md)
 
-If you self-host Yuvomi in a GDPR context (EU/EEA, processing other people's data), read [docs/PRIVACY-FOR-SELFHOSTERS.md](docs/PRIVACY-FOR-SELFHOSTERS.md) before going live: it covers third-country assessments for every external service (weather, CalDAV/CardDAV, OIDC, WebDAV backup), data-processing-agreement notes, log-retention guidance, and a records-of-processing template.
+If you self-host Yuvomi in a GDPR context (EU/EEA, processing other people's data), read [docs/PRIVACY-FOR-SELFHOSTERS.md](docs/PRIVACY-FOR-SELFHOSTERS.md) before going live: it covers third-country assessments for every external service (weather, CalDAV/CardDAV, OIDC, WebDAV backup and document storage), data-processing-agreement notes, log-retention guidance, and a records-of-processing template.
 
 ---
 

SECURITY.md

@@ -38,6 +38,8 @@ Vulnerabilities that require physical access to the host or root on the server a
 - API rate limiting (300 requests/min per IP)
 - Content Security Policy via Helmet (`self`-only)
 - Optional SQLCipher AES-256 database encryption (built into the official Docker image; enable by setting `DB_ENCRYPTION_KEY`. Bare-metal installs require a SQLCipher-enabled build of better-sqlite3.)
+- Existing WebDAV documents protect their connection configuration: changing the URL, username, password, or base path requires explicit admin confirmation and a successful read test against an existing object; required connection data cannot be removed while WebDAV documents exist
+- UI-managed WebDAV document-storage URLs are protected against SSRF: private, loopback, link-local, internal-DNS, and DNS-rebinding targets are rejected before persistence and during socket lookup. Trusted private-network targets require the deployment-controlled `DOCUMENT_STORAGE_WEBDAV_URL` override
 - No API endpoint accessible without session auth (except login)
 - `SESSION_SECRET` is mandatory - server refuses to start if unset
 

docs/PRIVACY-FOR-SELFHOSTERS.md

@@ -27,6 +27,7 @@
    - 2.3 [CalDAV/CardDAV-Sync](#23-caldavcarddav-sync)
    - 2.4 [OIDC-Provider (Single Sign-On)](#24-oidc-provider-single-sign-on)
    - 2.5 [WebDAV-Backup](#25-webdav-backup)
+   - 2.6 [WebDAV-Dokumentspeicher](#26-webdav-dokumentspeicher)
 3. [Logging und Speicherbegrenzung](#3-logging-und-speicherbegrenzung-art-5-abs-1-lit-e-dsgvo)
 4. [Haushaltsausnahme](#4-haushaltsausnahme-art-2-abs-2-lit-c-dsgvo)
 5. [Verarbeitungsverzeichnis-Vorlage (Art. 30 DSGVO)](#5-verarbeitungsverzeichnis-vorlage-art-30-dsgvo)
@@ -69,6 +70,7 @@ Betreiber daraus resultieren.
 | CalDAV/CardDAV-Server | `server/services/caldav-sync.js`, `server/services/cardav-sync.js` | nur wenn Nutzer einen Sync konfiguriert | abhängig vom Provider | ja, bei kommerziellen Anbietern (siehe 2.3) |
 | OIDC-Provider | `server/auth.js`, `server/services/oidc.js` | nur wenn konfiguriert | abhängig vom Provider | meistens ja (siehe 2.4) |
 | WebDAV-Backup | `server/services/backup-webdav.js` | nur wenn konfiguriert | abhängig vom Provider | ja, bei kommerziellen Anbietern (siehe 2.5) |
+| WebDAV-Dokumentspeicher | `server/services/document-storage.js` | nur wenn konfiguriert | abhängig vom Provider | ja, bei kommerziellen Anbietern (siehe 2.6) |
 
 ### 2.1 Open-Meteo (Wetter-Standard)
 
@@ -165,9 +167,11 @@ Konfiguration so, dass du auf einen EU-Provider umstellen könntest.
   `server/routes/backup.js` und `server/services/backup-scheduler.js`.
 - **Aktiv nur, wenn:** du WebDAV-Backups in deinen Backup-Einstellungen
   konfigurierst.
-- **Was wird übertragen:** Backup-Archive deiner Yuvomi-Instanz inkl. **aller
-  Nutzdaten** — Kontakte, Termine, Notizen, Dokumente. Das ist datenschutz-
-  rechtlich der sensibelste Datenstrom.
+- **Was wird übertragen:** Backup-Archive deiner Yuvomi-Instanz mit allen
+  SQLite-Nutzdaten — Kontakte, Termine, Notizen sowie Dokument-Metadaten und
+  lokal gespeicherte Dokumentdateien. Dateien aus dem separaten
+  WebDAV-Dokumentspeicher sind nicht enthalten. Das Backup ist
+  datenschutzrechtlich ein besonders sensibler Datenstrom.
 - **Drittland-Bewertung — abhängig vom Anbieter:**
   | Anbieter | Standort | Bewertung |
   |---|---|---|
@@ -183,6 +187,28 @@ Konfiguration so, dass du auf einen EU-Provider umstellen könntest.
   WebDAV-Provider zum reinen Speicheranbieter ohne Klartextzugriff. Halte
   die Verschlüsselungs-Passphrase getrennt vom Backup-Speicherort.
 
+### 2.6 WebDAV-Dokumentspeicher
+
+- **Code-Stelle:** `server/services/document-storage.js`, gesteuert über
+  `server/routes/documents.js`.
+- **Aktiv nur, wenn:** ein Admin WebDAV als Ziel für neue Dokumentdateien
+  aktiviert oder die entsprechenden `DOCUMENT_STORAGE_WEBDAV_*`-Variablen
+  setzt.
+- **Was wird übertragen:** neu hochgeladene Dokumentdateien einschließlich
+  neuer Kalenderanhänge, außerdem Basic-Auth-Zugangsdaten und die IP-Adresse
+  des Yuvomi-Servers. Dateinamen werden nicht als Objektpfad übernommen; die
+  Dateien können dennoch unmittelbar personenbezogene oder besonders
+  schützenswerte Inhalte enthalten.
+- **Drittland und AVV:** Es gelten dieselben providerabhängigen Bewertungen
+  wie beim WebDAV-Backup in Abschnitt 2.5. Bei einem kommerziellen Hoster ist
+  außerhalb der Haushaltsausnahme ein AVV erforderlich; bei Anbietern außerhalb
+  des EWR sind zusätzlich Angemessenheitsbeschluss, DPF oder SCCs mit TIA zu
+  prüfen.
+- **Empfehlung:** Bevorzuge einen selbst gehosteten oder in der EU betriebenen
+  WebDAV-Dienst, beschränke den Zugriff auf ein eigenes Verzeichnis und sichere
+  dieses Ziel separat. SQLite-Backups enthalten nur Metadaten und
+  Speicher-Schlüssel, nicht die dort abgelegten Binärdateien.
+
 ---
 
 ## 3. Logging und Speicherbegrenzung (Art. 5 Abs. 1 lit. e DSGVO)
@@ -299,7 +325,8 @@ konkrete Konfiguration ein und ergänze um eigene Verarbeitungen.
 | 3 | Kontakte / CardDAV | Adressbuch | Art. 6 Abs. 1 lit. b/f | Nutzer, Kontakte | Name, Adresse, Telefon, E-Mail | CardDAV-Server (falls Sync) | <<je nach Anbieter>> | bis Löschung | TLS, AVV |
 | 4 | Wetter | Anzeige Vorhersage | Art. 6 Abs. 1 lit. b | Nutzer | Koordinaten/Ortsname | Open-Meteo (CH); ggf. OpenWeather (UK) | CH/UK Angemessenheit | sofort nach Anfrage | TLS |
 | 5 | Backups | Datensicherung | Art. 6 Abs. 1 lit. f | Nutzer und alle Datensubjekte der App | Vollbackup der DB | <<WebDAV-Provider>> | <<Aufbewahrungs-Konzept, z. B. 30 Tage rollierend>> | Verschlüsselung vor Upload, AVV |
-| 6 | Sicherheits-/Betriebs-Logs | Missbrauchserkennung, Fehlersuche | Art. 6 Abs. 1 lit. f | Nutzer / Login-Versuchende | IP bei fehlgeschlagenen Logins, Fehler-Stacktraces | nur lokal | nein | **max. 30 Tage** | Rotation, Zugangsbeschränkung |
+| 6 | Dokumentablage | Gemeinsame Ablage und Kalenderanhänge | Art. 6 Abs. 1 lit. b/f | Nutzer und in Dokumenten genannte Personen | Dokumentdateien, Anhänge, Metadaten | <<WebDAV-Provider, falls aktiv>> | <<je nach Anbieter>> | bis Löschung durch Nutzer | TLS, eigener Pfad, AVV, separates Backup |
+| 7 | Sicherheits-/Betriebs-Logs | Missbrauchserkennung, Fehlersuche | Art. 6 Abs. 1 lit. f | Nutzer / Login-Versuchende | IP bei fehlgeschlagenen Logins, Fehler-Stacktraces | nur lokal | nein | **max. 30 Tage** | Rotation, Zugangsbeschränkung |
 
 ### 5.3 Auftragsverarbeiter (Art. 28)
 
@@ -308,7 +335,7 @@ konkrete Konfiguration ein und ergänze um eigene Verarbeitungen.
 | <<z. B. Hetzner Online GmbH>> | Server-Hosting | <<Datum>> | DE | AVV nach Art. 28; ISO 27001 |
 | <<OpenWeather Ltd.>> | Wetter-API (falls aktiv) | <<Datum>> | UK | Angemessenheit; DPA |
 | <<OIDC-Provider>> | Authentifizierung | <<Datum>> | <<EU/USA>> | <<AVV; ggf. DPF + SCCs>> |
-| <<WebDAV-Provider>> | Backup-Storage | <<Datum>> | <<je nach Anbieter>> | <<AVV; Verschlüsselung clientseitig>> |
+| <<WebDAV-Provider>> | Backup- und/oder Dokument-Storage | <<Datum>> | <<je nach Anbieter>> | <<AVV; Verschlüsselung für Backups; Zugriffsbeschränkung>> |
 
 ---