Client booking portal, separate chauffeur portal and security fixes (v1.95.0 to v1.126.1)

sb commented

2026-09-23 20:20:46 +10:00

Owner

Summary

Adds a client booking portal: a separate public app (clientportal/, port 3001, for book.alwaysclassiccars.com.au) where clients book weddings, general events and transfers themselves, built from the "ACC Booking Prototype" design. It talks to the main system only through a new key protected /api/portal/* API. Plan: plans/ClientBookingForm.md. Office guide: docs/client-portal.md.

Versions v1.95.0 to v1.126.1 (see CHANGELOG.md). The client portal shares the main system's version number (a unit test keeps both package.json files and both lock files in step).

Office app and chauffeur portal split (v1.116.0)

The office app and the chauffeur portal are now separate sites with separate logins, so the same email can have an office account and a chauffeur account. Details: docs/authentication.md.

One build, two processes: acc-admin (ACC_APP=admin, port 3000, admin.alwaysclassiccars.com.au) and acc-chauffeur (ACC_APP=chauffeur, port 3002, portal.alwaysclassiccars.com.au). The client portal stays on 3001 and still calls port 3000.
The app comes from the process env, never the hostname. Each process only serves its own routes; the other app's routes return 404 whether or not anyone is signed in. The office app still answers offer links and iCal feeds sent before the split.
Separate sessions: own cookie names (acc-admin-session, acc-chauffeur-session, plus CSRF and callback cookies), encryption keyed to the cookie name, and a realm claim in every token that ends the session if it doesn't match the app. Everyone signs in once after updating.
Same email, two accounts: User.email is unique per role (index User_email_role_key) instead of on its own; no rows change. Sign in, forgot password, the Admin accounts and Portal access duplicate checks, the Reports money setting and prisma/create-user.ts look accounts up by email and role. Reset and setup links only work on their own app.
Chauffeur links: offer and setup links use the new CHAUFFEUR_APP_URL; APP_URL stays the office app's address.
Behaviour change: API calls with no session get a 401 JSON reply instead of a redirect to /login.

Follow ups (v1.116.1 to v1.116.8)

Sign in screens say which site they are: "Office sign in" or "Chauffeur sign in" as the heading, the panel label ("Office sign in" / "Chauffeur portal", also on Forgot and Reset password) and the tab title. The old "The office and chauffeurs both sign in here" line is gone. (v1.116.2 added a line under the heading, a link to the other site and a line on failed sign in; v1.116.3 to v1.116.5 took those back out.)
Chauffeur portal sidebar styled like the admin sidebar (v1.116.7): logo and company name header, same width, burgundy marker on the current page, admin style offer count, ivory account card with DC licence status and sign out, legal name and version. Always expanded; phones keep the bottom tab bar. Logo, company name and avatar are shared with AdminSidebar.
Fixed: chauffeurs with a working login shown as "Invite expired" (v1.116.6): the v1.81.0 passwordSetAt backfill never ran on servers updated with db push. update.sh now runs it after db push (only fills empty values; unfinished invites keep their link and stay "Invite expired"). A chauffeur changing their own password and prisma/create-user.ts now record passwordSetAt too.
Fixed: sign in photo never showed (v1.116.8, broken since v1.113.8): Next 16 refuses to optimize local image URLs with a query string ("url" parameter is not allowed), and the photo is loaded as /api/login-hero?v=…. It is now loaded directly (unoptimized); it is already a resized WebP.
Docs: Cloudflare tunnel setup in docs/deployment.md section 12 (v1.116.1), including a check that the admin and portal routes aren't swapped.

Security and chauffeur fixes (v1.117.0)

A new password signs the account out everywhere: each session remembers when its password was set and every request checks it, so a reset, a chauffeur's own change or the office setting a password ends all of that account's sessions; deleting an account ends them too. The proxy now uses the full auth config (Prisma) to do this.
Current password needed to change it in My Profile; the chauffeur is asked to sign in again afterwards.
Fixed: Change Password in My Profile never worked: sessions didn't carry the account id. They do now.
Fixed: chauffeur job sheet links: job change, "notify chauffeurs" and the offer's Job Sheet button now link the portal's /api/chauffeur/booking-sheet/<booking> from CHAUFFEUR_APP_URL (the offer's is filled in when sent). Since the split they went to the office app.
Fixed: Verify button in My Profile: now uses a portal route for the signed in chauffeur's typed DC number.
Sign in returns you where you were going (callbackUrl, same site paths only); background requests without a session still get a 401.
Activity page by role: new nullable AuditLog.userRole records whether an office or chauffeur account acted; older entries fall back to email matching.

Chauffeur emails, portal fleet, schedule and fixes (v1.118.0 to v1.120.0)

Job change emails show what changed (v1.118.0): the Job Details Updated email to chauffeurs has a WHAT CHANGED table (Detail / Was / Now). Each chauffeur sees only their job sheet's details: the booking's and their own car's, never another car's or costs; a chauffeur on two cars sees each row named by its car. Default subject Job details updated - [DATE] - [CLIENT NAME]; new [CHANGES] and [CLIENT NAME] placeholders. A customised template sends without the table until [CHANGES] is added or it is reset.
Choose a car shows rego and CPV registration (v1.119.0, v1.119.1): fleet cards show the rego and, when the last CPV check came back active, "✓ Active on CPV register · Last checked today", linking to the Safe Transport Victoria public register. The portal fleet API sends the rego, a yes/no and the check date, not the raw status.
Choose a car shows three cars to a row (v1.119.2): two under 760px, one on phones.
Schedule columns fit their text and line up across dates (v1.119.3): Car, Chauffeur, Start, Finish and Hours size to their longest text on the page (measured across every date's table); Pickup → destination takes the rest of the width.
Fixed: Activity Log "Client link: Sent to" with no address (v1.119.4): it logged the booking's email, empty on an office-entered wedding. It now logs the address the link was sent to.
Fixed: stop type couldn't be changed on Edit Booking (v1.119.7): each stop's fields were drawn twice (desktop row and hidden phone list) under one form name, and the form read the hidden copy, so changes on a computer (type, address, time) were ignored. They are now drawn once.
Fixed: generated PDFs only showed after a reload (v1.119.7): Generate PDFs on Edit Booking now waits for the PDFs and shows the Client PDF and Chauffeur PDF links straight away (POST /api/bookings/[id]/pdfs returns them).
Adding a booking stays on it (v1.119.7): Add booking on New Booking opens the new booking's Edit Booking page instead of going back to the schedule.
Clients can change cars and hours on a Hold booking (v1.120.0): through the update link, until they sign: add and remove cars and wedding night transfers, hours down to the 3 hour minimum. Not a car with a chauffeur offer sent or accepted; at least one car; added cars must be free that day. Added cars priced from the booking's price list; deposit ($100 a hire) and holiday surcharge follow the car count unless set by hand. After Hold, cars lock and hours only go up, as before. Rules in src/lib/hold-car-changes.ts.

Test pass fixes, user manual and Send offer on Edit Booking (v1.120.1 to v1.122.2)

From a full browser test of the office app, chauffeur portal and client portal.

A bad id in a link is a 404, not a server error (v1.120.1): a non-numeric id (/bookings/abc, /api/cars/abc, an attachment id) reached Prisma as NaN and failed with a 500. Every [id] page and route now reads its id through parseId() (src/lib/route-params.ts).
Schedule handles a bad month (v1.120.1): ?month=garbage built an Invalid Date (500) and ?month=13 showed the next January; an invalid month or year now shows the current one.
Client portal: contact on the day is optional (v1.121.1): v1.120.1 had made it required to match its * and "All optional except the contact" wording; it is meant to be optional, so the check is gone and the wording no longer marks it required.
Booking form shows every error on the first try (v1.120.2): an unpicked car sent NaN, a type error ("expected number, received NaN") that also stopped the Email and Phone rules running until the other errors were fixed. It now reads "Car is required" and all errors show together.
Section tabs follow the part of Edit Booking you're reading (v1.120.2); Print opens the month you're viewing (v1.120.2); Chauffeur field full width except on weddings (v1.120.2).
Chauffeur portal (v1.120.2): a blank route shows "No route yet" instead of an empty box; Save Profile and Update Password use the portal's burgundy instead of a leftover blue.
Client portal review shows your details (v1.120.2): name, phone and email head the review and confirmation summaries.
Notes hint (v1.120.3): now says Notes show on the chauffeur's job too.
User manual with screenshots (v1.120.4): docs/user-manual/ has an office guide, a chauffeur guide and a client guide, with screenshots of demo bookings. Linked from docs/README.md. The screenshots show the car photos from the company website (v1.120.5). Adding a booking ends with sending the client link (v1.120.6). The chauffeur guide shows the emails chauffeurs get, with an "Emails you will get" table (v1.121.2).
Portal access email links to the chauffeur guide (v1.121.3): new [GUIDE LINK] placeholder in the Portal Welcome template, filled by Create login and Resend setup link. A customised copy of the template needs Reset to default to pick it up.
Office guide shows the emails the system sends (v1.121.4): offer accepted, car on hold, booking link and hold reminder inline, plus an Emails section with what the office and clients receive (new online booking, client updated booking, weekly report, client confirmation).
Client guide shows the emails clients get (v1.121.5): booking confirmation, car on hold, hold reminder and check over emails, a new "If the office booked for you" section and an "Emails you will get" table.
Send offer on Edit Booking (v1.122.0): a Send offer to [chauffeur] button under Chauffeur status on each saved car in Planning, using the schedule's dialog, route and email builder (moved to src/lib/offer-draft.ts). It waits for unsaved changes to be saved, and shows Offer sent after sending without dirtying the form. The office guide has a screenshot of it (v1.122.1).
No colour boxes on the schedule (v1.122.2): the car colour swatch at the start of each schedule row looked like an empty checkbox, so it is removed. Car availability keeps its swatches beside the colour filters.
User manual in each app (v1.121.0): served as HTML at /help/, linked as Help in the office and chauffeur sidebars (and My Profile on phones) and How to book online in the client portal footer. Each app serves only its own guide (the office app serves all of them), without signing in. Built from docs/user-manual by scripts/build-user-manual.mjs (new marked dev dependency) into the committed public/help/ and clientportal/public/help/; a unit test fails if the HTML is stale.

Security hardening (v1.123.0 to v1.124.10)

Browser security headers (v1.123.0)
Sign-in limits (v1.124.0) and sign-in timing doesn't reveal accounts (v1.124.9)
Tracking links only for the job's day (v1.124.1)
Permission changes apply straight away (v1.124.2)
Signature links can't reach the server's network (v1.124.3)
Overtime only on the day, and only once (v1.124.4)
Customer details and secrets kept out of logs (v1.124.5)
Other sites can't make changes through a staff browser (v1.124.6)
Docker runs as an unprivileged user on local ports, and the Docker image builds again (v1.124.7)
Job photo uploads take photos only (v1.124.8)
Client links expire on the day, a client's signature stays as signed, reset and setup links stored hashed, booking sheets once the job is offered (v1.124.10)

See CHANGELOG.md for the details of each.

User manual screenshots retaken, and "booking folder" wording, client confirmation, chauffeur guide additions, test pass fixes (v1.124.11 to v1.124.18)

Every office, chauffeur and client screenshot in the user manual is retaken on the current version: the office screens show the Help link, the schedule has no colour boxes, and the client portal footer shows How to book online. The HTML manual is rebuilt.
"Booking folder" instead of OneDrive (v1.124.12): the Attachments panel, its remove confirmation, the missing file chip and the attachment setup and error messages say "booking folder" rather than OneDrive, and the user manual matches. Storage is unchanged.
Client confirmation shows the deposit, not the total (v1.124.13): the client's booking confirmation email drops the booking total and balance amount (travel fees may still be added) and says "The final balance is due by" the date. A customised copy of the template needs Reset to default.
Chauffeur guide: photos, car locations and the home screen (v1.124.14): new Uploading photos and Where the other cars are sections (with screenshots, including the Traccar map), and home screen steps for iPhone and Android.
Overtime button stays put when the photos list opens (v1.124.15): the chauffeur job's action row is top-aligned, so opening the uploaded photos list no longer pulls the Overtime button down.
Car location button only shows when the map can be made (v1.124.16): the button needs two tracked cars on the booking, the same rule as the map link (shared trackedDeviceIds()), instead of showing and then failing when the chauffeur's own car isn't tracked.
Passwords never go in the address bar (v1.124.17, security): the sign-in, forgot and reset password forms now post, so a submit before the page's JavaScript loads can't put the password in the URL, history or proxy logs.
Adding a booking makes its PDFs (v1.124.17): bookings added in the office with any status but Hold now get their client and chauffeur sheets straight away, as on save.
Production build is a fifth of the size (v1.124.18): runtime file paths are marked /*turbopackIgnore: true*/, so .next/standalone drops from 362 MB to 62 MB and no longer carries docs/, clientportal/ or the src/lib sources.
Help pages served in production (v1.124.18): update.sh, install.sh and setup-portal.sh copied public into the existing standalone/public as public/public, so /help/ and the TinyMCE files gave 404. They now copy the folder's contents.
Signing in when already signed in goes to the app (v1.124.18): /login with a session redirects to the callbackUrl, the schedule or the chauffeur home instead of showing the form inside the app layout.
Deposit on the thank you page after signing a held booking (v1.124.18): the client portal shows the deposit, bank details and reference, as the confirmation email does.

Security audit fixes, setup docs and the v1.93.2 update guide (v1.124.19 to v1.124.22)

From a full security audit of the branch (no Critical or High findings, no way for one client to reach another's booking). The Medium and Low findings are fixed:

Signatures must be signature sized (v1.124.19): a portal, client link or overtime signature must be a real PNG of at most 2000 by 1000 pixels, or it is refused (400) before anything is saved. An 8 KB PNG claiming 8000 by 8000 pixels used about 590 MB when the PDFs were made, enough to stop the office app. Making PDFs also skips any PNG over 16 megapixels, whatever its source.
Clients attach PDFs and photos only (v1.124.19): anyone can make a booking and get a link, and client files sync to the office's PCs, so Word, Excel, text and CSV files (macros, remote templates, formulas) are no longer taken from the public. The office can still attach them.
Reset links use the configured address (v1.124.19): in production a forgot password email is built only from APP_URL / CHAUFFEUR_APP_URL, never from a forgeable Host or X-Forwarded-Host. Unset, nothing is sent and the failure is logged; the answer is the same either way.
Failed sign-ins can't lock out an account's owner (v1.124.19): the 10 failure limit is per account from each IP; the 30 per IP limit across accounts stays.
CLIENT_IP_HEADER (v1.124.19): names the one header the proxy always sets (cf-connecting-ip behind a Cloudflare tunnel), in all three apps, so rate limits can't be dodged with a forged X-Real-IP or X-Forwarded-For. Unset, behaviour is unchanged.
Turnstile required in production (v1.124.19): the portal refuses new bookings while TURNSTILE_SECRET_KEY is unset; development still skips it. setup-portal.sh no longer offers to skip the keys (v1.124.20).
Terms cleaned for the portal, signatures not kept by caches (Cache-Control: private) and sharp 0.35.5 in the client portal (v1.124.19).
Example settings and docs (v1.124.20, v1.124.22): example.env and clientportal/example.env list every setting the apps read; the authentication, deployment, environment, client portal and OneDrive docs match the fixes.
Guide to updating from v1.93.2 (v1.124.21): docs/upgrade-from-1.93.md, every step in order, with the dev server record.

Test pass fixes (v1.124.23)

Dates can be typed as digits: the date fields read 21112026 or 211126 as DDMMYYYY or DDMMYY (a phone's number pad has no slash), and a date that can't be used shows a message under the field instead of being cleared silently. Office app and client portal.
Thank you page says Received: the client portal header after a new booking said CONFIRMED; it now says RECEIVED, as the page does. Client guide screenshot and wording updated.
Pay counts a job as Done once it has finished: My Pay no longer counts the whole of today's jobs as Done from midnight.

Job videos (v1.125.0)

Chauffeurs can upload videos from a job: MP4, MOV or WebM up to 90 MB each, checked by content; photos stay at 20 MB, and the 300 per booking counts both. The phone refuses an oversized video before sending it and the button counts through several files. Buttons read Add photos or videos and Photos & videos.
95 MB requests: proxyClientMaxBodySize goes from 25 MB to 95 MB (each route keeps its own limit) and the chauffeur portal nginx example allows 95 MB, under the Cloudflare tunnel's 100 MB per request. Production nginx in front of the chauffeur portal needs client_max_body_size 95m.

Test pass fixes (v1.125.1)

Offer links keep their thank you: answering no longer refreshes the page into "You have already declined this offer".
Offer pages stand on their own: no signed in sidebar around them (the proxy passes the path to the layout), and the tab reads Contract Offer.
Edit Booking top row fits at 1280 px: two fields per line from 1280 to 1339 px.

Chauffeur portal privacy (v1.125.2)

No client emails on chauffeur jobs: the People list keeps Message and Call only, and the page no longer reads the email addresses, so none reach the phone. Chauffeur guide screenshot and text updated.

Office signatures per admin (v1.126.0)

Linked to admin accounts: an Admin account picker on each office signature (one signature per account). New optional OfficeSignature.userId, migration 20261009120000_office_signature_user. Production needs db push for the new column.
Added at the deposit: when a payment on the booking form reaches the deposit (or pays it off) and Office signature is empty, the signed in admin's signature fills it in, visible before saving. A chosen signature is kept; opening an already paid booking changes nothing.

Test pass fix (v1.126.1)

New payment amounts start blank: Add payment and Add refund rows started at 0, so clicking into the right aligned box and typing 100 could give 1000. The amount now starts empty and shows the 0.00 hint.

Main system

Stops per car (BookingCarStop): on the Booking form, both PDFs, chauffeur portal, schedule, Activity Log and chauffeur change emails. Existing bookings are unchanged; a save that doesn't send stops leaves them alone.
Fleet: car photo upload (resized WebP under CAR_PHOTOS_PATH), passenger count, "Show in client booking portal".
Settings, Company Info: Legal Name, contact details (phone, email, address) and bank details.
Settings, Client Portal (new tab): booking type visibility with direct links, header text, footer text, and header/card images.
Portal API: fleet, availability, car photos, settings, create booking (idempotent), and client link view/update. Portal bookings come in with a blank Source for the office to fill in.
Client link: "Send to client" / "Reset link" on Edit Booking. The client can complete, sign and later update a booking; date and cars are locked and hours can't go down. Changes are logged as "Client portal", regenerate PDFs, email the office a diff and follow the chauffeur notify setting. "Who you are" opens as the main contact. The online booking confirmation counts as sending the link, so the Client Link panel shows it as sent. "Send to client" sends a Car on Hold email for Hold bookings (7 day hold, complete and sign) and a check-over email otherwise; signing a held booking sends the client confirmation with the payment details.
Emails: six new editable templates (client confirmation, office notification, link email, car on hold link email, hold reminder, client update notification).
Client confirmation email design: a Next step block with the deposit, reference, bank details grid, total, balance and due date; the summary as a timeline of pickup and stops with the ceremony start on the Ceremony stop; an Outlook-safe "Update my booking" button; the company phone in the footer. New placeholders [TOTAL], [BALANCE], [BALANCE DUE DATE] and [COMPANY PHONE]. The office notification has its own layout: summary header, deposit/reference/total boxes, a To do list (deposit to watch for, check over the booking form and pricing), client email and phone links, each car with its chauffeur status and a stop table, and an "Open booking" button.
Main Contact: a dropdown in a wedding's Booking section on Edit Booking: Automatic (who booked) or a picked Partner 1, Partner 2, planner or other contact, with the email and phone the link emails go to. New mainContactRole column. Worked out from Signed By, then the booking's email, else the first named of planner, Partner 1, Partner 2, other; the update link uses the same check. On an office-entered wedding (no booking email) it uses the contact's own email and phone, so "Send to client" and hold reminders go to them.
Hold Until: a date next to Filled Out Date on Hold bookings (default 7 days from today), used by the Car on Hold email. New Booking.holdUntil column.
Hold reminders: a daily job (/api/cron/hold-reminders, CRON_SECRET, needs a crontab entry) emails the client 2 days before a hold ends. New holdSentAt and holdReminderSentAt columns.
Hold weddings: a wedding on Hold saves with just one contact (a partner, the planner or the other contact, with a name and an email or phone); the full rules apply once it leaves Hold.
Settings layout redesign (v1.96.0): grouped left-hand settings menu, an overview page with search (the menu on phones), shared page header, sections and fields, and a sticky save bar with Discard on form pages. Per-page updates, including drag-to-reorder for booking types and sources, email templates grouped by recipient, and one save bar for the client portal texts. Layout and presentation only: no API, schema or save logic changes.
Chauffeur and office emails (v1.96.2): the contract offer, welcome, password reset, offer accepted/declined, job updated, client updated booking and weekly report emails use the shared card layout (new src/lib/email-layout.ts), with job facts, notes and changes as tables and panels, and Outlook-safe buttons. New placeholders [COMPANY PHONE], [JOB SUMMARY], [BOOKING LINK], [BOOKING TYPE], [WEDDINGS COUNT].
Portal special instructions (v1.96.3): the same rich text editor as Edit Booking; client HTML is cleaned with sanitize-html before saving (safe formatting only). The portal gains a public/ folder for TinyMCE, copied into the build by the scripts and Dockerfile.
Job folders (v1.96.5): Booking.jobFolder records each booking's OneDrive folder so it follows date/name changes, Postponed/ and Cancelled/, and back (fixes postponed folders left behind). Groundwork for booking attachments (plans/BookingAttachments.md).
Booking attachments (v1.97.0): attach documents (e.g. a run sheet) under Documents on Edit Booking, stored in the booking's OneDrive job folder (Attachments/), checked by type and content, 20 MB each; per-file Share with chauffeur, shown on the job in the chauffeur portal. New BookingAttachment table; proxy body limit raised to 25 MB.
Client documents (v1.97.1): clients attach documents (run sheets etc.) on their update link's Details step, 10 MB each and 10 per booking; saved to the job folder, marked From client, office emailed and Activity Log. Portal routes rate limited and size capped.
Times (v1.97.2): all booking times stored as 24h HH:MM and shown 12h; diffs compare by meaning (no false "changed" times or blank rows); readable change labels; one-off prisma/normalize-times.ts to fix saved 12h times (run by hand, dry run first). Also: hyphens instead of long dashes in emails, pages and PDFs, and the office email footer names the company.
Chauffeur Offer reset: Reset to default now clears the saved offer, so it shows Default again.
Office email header: office emails are headed with the company name from Company Info instead of "ACC SYSTEM".
Time pickers on Edit Booking: every time field on the booking form uses the same time picker as the client portal.
Adding a car: after saving, a new car takes its saved id, so "Unsaved changes" clears and later saves no longer recreate the car.
Chauffeur portal redesign: phone first, with a tab bar on phones and a sidebar on wider screens. Today shows the next job with a countdown, route, Navigate and Call. My Jobs puts offers first with the estimated pay. Each job has a detail page. Overtime is recorded per job in three steps, availability is set by tapping days, and pay shows the month by week and per job.
Offer cards: a View job details button above Decline and Accept job; portal headings use Source Serif 4 (plain J).
People on a job: every contact on the booking, the main contact falling back to the booking's phone and email, plus contact on the day, photographer and videographer, with Email, Message and Call buttons.
Job page details: Ceremony & reception (addresses with Navigate, times, drink type) and the special instructions, cleaned to plain formatting.
Today: no month pay card (pay stays on My Pay); the next job uses the full width when there's nothing for the side column.
Date fields: our own day-first date field (DD/MM/YYYY, typed or picked from a Monday-first calendar) replaces the browser's date picker in both apps, which showed month first on US-English browsers.
Hold reminders: sent on the first daily run in the last 2 days of a hold (not only the exact day), so a missed run or a short hold still gets one; the email says "in 2 days", "tomorrow" or "today".
Hold reminder heading: "Hi [name], your car is only on hold until [day]."
Hold reminder record: "Hold reminder sent" on the Client Link panel and a System entry in the booking's Activity log.
Weekly report and hold reminder run logging: both cron endpoints now stamp every run with when it ran, and a run-level failure includes the real error message instead of a generic one. A successful weekly report send, a run-level failure, and a hold reminder that fails for one booking are all recorded to the Activity Log, not just the server console.
Activity log cars and payments: added/removed cars logged by name and pickup time and matched by id (not list position); no more "Payments: - → []" on every save.
Client Link history: Sent, Hold reminder sent, Completed and Last updated each on their own line.
Email template Save: only active once the subject or body changes, so saving an unchanged template (for example right after Reset to default) no longer marks it Customised.
Email template reset: Reset to default restarts the editor so it stays Default with nothing unsaved; a company name starting with "Always Classic Cars" no longer doubles in saved templates.
Expired reset link: "Back to sign in" alongside "Request a new link".
Reports redesign: revenue, received, owing and after chauffeur pay against last year; booking pace; a Needs attention list for the next 60 days; fleet and chauffeur tables; busiest dates, day of the week and lead time; CSV export and print.
Reports without money figures: limited admins without the new Show money figures option (under Reports in Settings → Admin accounts) get a version with no dollar amounts, built on the server so the money never reaches their browser, and a CSV without totals or payments.
Reports version per account: each admin account has its own Reports choice (with or without money figures) in Settings → Admin accounts, whatever its access; new accounts start without money, existing ones keep what they saw. Adds User.reportsMoney (nullable, safe with db push). Also Reports wording: "1 car", lead time in days/weeks/months, plain hyphens.
Lead time bars: 12-24 months, 24-36 months and Over 36 months replace Over 12 months.
Delete chauffeur: only for a chauffeur never given a job (deletes their availability and portal login too); otherwise disabled with a note to untick Active. The API refuses instead of quietly deactivating.
Duplicate chauffeurs blocked on create: adding a chauffeur with the same name as an existing one (active or inactive) is now rejected with an error instead of silently creating a second record.
Unavailable cars on the schedule: a date with a car marked unavailable (Fleet → car availability) shows an "unavailable" badge on that date's header, whether or not the car is actually booked that day; hovering shows the time range (or "All day") and the reason.
Branded chauffeur availability: /chauffeurs/availability matches the chauffeur portal's burgundy/gold/ivory branding, with month/week/day views showing accepted jobs and sent offers (not just unavailability) per day, a Saturday coverage strip, a 6am-midnight day timeline, same-day conflict flags, and a right-side edit drawer (bottom sheet on mobile) replacing the old modal.
Branded chauffeurs list and profile: /chauffeurs and /chauffeurs/[id] get the same branding, with a search box, an Active/Needs attention/Inactive/All filter, a "needs attention" panel for DC-licence and portal-login issues, and Next job/Jobs this month columns; the profile page adds a header card with status chips, summary tiles, an Upcoming jobs card and a Time off card. Same CPVV refresh, permissions, portal flows and delete rule throughout.
Copy a car's journey (client portal): "copy journey to another car" adds the picked car with the same pickup, times, stops, hours and who it's for; the copy is then edited on its own.
Who you are (portal): picking Wedding planner or Other takes the booker's details back off Partner 1.
Special instructions in change lists: shown as plain text in the client update email and Activity log, not the stored HTML document.
Legal name: used at the bottom of PDFs, the sidebar (with version underneath) and the portal footer.
PDF header: address, phone and email from Company Info (unchanged until filled in).
Edit Booking page layout: redesigned from the Proposed artboard. Header with client names, chips, date and the save/cancel/postpone/activity actions (sticky on large screens) plus section links; Booking, Couple or Client, one Contacts section, Ceremony & Reception combined, collapsible car cards with a summary line and grouped fields, shorter instructions editor, Signature, Delete at the end; sticky right column with Payment (balance due, paid progress), Chauffeur Pay, Documents and the Client Link panel. The New Booking page uses the same layout. Fields, validation and saving are unchanged; errors inside a collapsed car open it.
Fixed: the booking form counted as changed on load (fields starting undefined picked up "" from the page), so leaving warned and Cancel asked to discard even with no edits.
Chauffeur pay hidden on screen by default: the Chauffeur Pay card and the pay rate fields start hidden so clients in the office can't see them; Show/Hide is remembered per browser. Display only.

Client portal (`clientportal/`)

Five step wizard with fleet picker and availability, stops, night transfers, airport transfers with suggested pickup times, drawn signature, thank you page with deposit and bank details.
Direct links /wedding, /general, /transfer (work even when a type is hidden from the main page); edit mode at /b/<token>.
Footer, contact details, header text and images come from Settings.
Weddings show the couple's names (from "Who you are") on each car's chips, the ceremony arrival times and the summaries, instead of Partner 1 and Partner 2.
Per IP rate limits, body size limit, Cloudflare Turnstile (required in production from v1.124.19).

Deployment

v1.118.0 to v1.120.0: no database changes. Deploy the office app and the client portal together (the portal's fleet cards read the rego and CPV fields from the office app's fleet API).
v1.117.0: db push adds AuditLog.userRole (no data changes). Everyone signs in once more (sessions now carry a password stamp).
Account status backfill (v1.116.6): update.sh marks accounts with no outstanding setup or reset link as having set a password, on every run. Safe to repeat.
Office app and chauffeur portal (v1.116.0): update.sh replaces the acc-system PM2 app with acc-admin and acc-chauffeur, built from the existing entry so custom env values carry over (old file kept as ecosystem.config.js.bak). install.sh, setup-portal.sh, restore.sh and docker-compose.yml (new chauffeur service) use the two apps. New env vars ACC_APP (per process) and CHAUFFEUR_APP_URL. npm run dev:chauffeur runs the portal in development on 3002. Upgrade steps, Nginx sites for admin.* and portal.*, and rollback are in docs/deployment.md section 15.
Database changes are additive only; scripts/update.sh (db push) applies them. No data migration needed.
update.sh rebuilds and restarts the portal only where the acc-clientportal PM2 process exists, and prints how to add it otherwise.
New scripts/setup-portal.sh adds the portal to an existing server: shared key, both .env files, portal build, acc-clientportal in PM2, a connection check, and (for a local Nginx) the site and certbot. It asks whether the reverse proxy runs on the same server and sets the listen address to match (127.0.0.1 or 0.0.0.0). Safe to rerun; unchanged answers don't rebuild the main system.
install.sh sets CAR_PHOTOS_PATH and offers the portal setup at the end.
The portal's PM2 app is acc-clientportal. Servers that already run it as acc-portal are switched over by update.sh automatically.
Docker: clientportal/Dockerfile, portal service in docker-compose.yml, root .dockerignore.
New env vars: main PORTAL_API_KEY, PORTAL_URL, CAR_PHOTOS_PATH (and APP_URL for links); portal MAIN_API_URL, PORTAL_API_KEY, HOSTNAME, TURNSTILE_SECRET_KEY, NEXT_PUBLIC_TURNSTILE_SITE_KEY. They can go in the PM2 ecosystem files or in .env files (rebuild after changing .env; PORT and HOSTNAME stay in the ecosystem file). See docs/environment-variables.md and docs/deployment.md.

Testing

v1.116.0: 530 root tests (29 new: sign in per app, route access per app, token realm checks, password reset per app) and 38 portal tests; typecheck, lint, prisma validate and both builds clean. Migrations applied from scratch match the schema exactly. End to end, both built apps were run against a copy of the dev database with a dual account user. Each app signed in its own account and rejected the other password. Admin sessions got 404 on chauffeur routes and chauffeur sessions got 404 on admin routes. Cookies moved between apps and forged wrong-app tokens were refused. /api/portal/* works on 3000 and returns 404 on 3002, and the iCal feed works on both. The PM2 split has since run on the dev server; routing problems there were the tunnel routes, not the apps. Not tested: Docker.
v1.116.1 to v1.116.8: 532 root tests (a new one for the chauffeur password change); typecheck and lint clean. The passwordSetAt backfill was run twice on a scratch database (fills the missing value, leaves an unfinished invite alone, reads back through Prisma). The chauffeur sidebar and the sign in pages were checked as rendered HTML on the dev servers, signed in as a test chauffeur; the sign in photo was checked against the old optimizer URL (400) and the new direct URL (200 WebP). Not viewed in a browser.
v1.117.0: 542 tests; typecheck, lint and migrations from scratch clean. Both built apps were run against a scratch database. Wrong current password refused; a password change ended both chauffeur "devices"; old password refused and new one accepted; the same email's office account unaffected; an office password reset elsewhere ended that office session (redirect to sign in with callbackUrl). A signed out browser opening the job sheet link went to sign in; fetch got 401. The Activity who filter was checked against real SQLite rows (dual account office edit as office, offer answer as chauffeur, old rows by email). Not checked: the offer email link substitution (reviewed only), a real CPVV result, and any of it in a browser.
v1.118.0 to v1.120.0: 545 root tests (new ones for the job change table: own car only, no costs, 12 hour times, car names) and 40 portal tests (CPV check age); typecheck and lint clean in both. The job change email was rendered from the default template and checked for the table. Tested OK on the test server: the stops fix (v1.119.5), generated PDFs showing straight away (v1.119.6) and adding a booking staying on it (v1.119.7). Not checked in a browser: the fleet cards and the schedule column widths. v1.120.0: 559 root tests (new hold-car-changes tests) and 43 portal tests; the real client update was run against a scratch database (add, remove and lower hours on Hold; offered car not removable; car booked elsewhere refused; 3 hour minimum; deposit $200 to $300 and a hand-set deposit kept; non-Hold adding refused and hours only up), all passing. Not checked in a browser: the portal car step on a Hold booking.
npm test (245) in the root and npm test (28) in clientportal/; typecheck and lint clean in both.
Edit Booking page: checked in a browser (sticky header and column, save keeps all cars and stops, validation opens a collapsed car, New Booking and airport transfer pages, phone width, no unsaved-changes prompt without edits, pay hidden by default and saved unchanged).
PDFs: text for existing bookings identical before and after with the new Company Info fields empty; filled in values appear in the header and footer.
End to end against a copy of the dev database: wedding (desktop) and return airport transfer (390px mobile) booked through the portal in a headless browser; client link edit and signing; locked fields and hour reduction rejected; old token dead after reset; PDFs for existing bookings identical before and after.
Dev server: updated with update.sh on this branch and setup-portal.sh run; acc-clientportal online and connected to the main system.
Not tested: Docker images (no Docker locally) and real email delivery (no SMTP locally).
v1.124.19 to v1.124.22: 640 root tests and 50 portal tests (new ones for signature sizes, client upload types, reset links from a forged host, per account and IP lockout, CLIENT_IP_HEADER and Turnstile in production); typecheck and lint clean in both. Rebased onto v1.124.18 with no code conflicts. The dev server was updated from v1.93.2 (on main) to v1.124.20 with update.sh: the server's own v1.93.2 script built the new code but didn't split the apps, and the branch's script then split acc-system into acc-admin and acc-chauffeur; db push only added the three unique indexes, and booking and car counts were unchanged. setup-portal.sh stopped on a blank Turnstile key without writing anything, then installed acc-clientportal with Cloudflare's test keys. All three apps answered, /api/portal/ refused requests without the key, a booking without a Turnstile token was refused, and a booking with the 8000 by 8000 signature was refused with no booking or file created and the office app at about 200 MB. Not tried there: anything that sends email (the dev database has real clients and chauffeurs). v1.124.21 and v1.124.22 are docs only.
v1.124.23: 641 root tests and 51 portal tests (new: dates typed as digits). Full pass of both builds, a sweep of about 120 pages and APIs, and Chrome runs of adding a booking, the client link, accepting an offer and a portal booking.
v1.125.0: 643 root tests (new: video types by content). Uploaded MP4, MOV, WebM and a 40 MB video through the chauffeur portal; a fake .mp4, a 92 MB video and a 21 MB photo were refused.
v1.125.1: 643 root tests, both builds and a sweep of 106 requests. Offer page checked signed in to each app and signed out (accept message stays, no sidebar, title); field widths measured from 1024 to 1600 px.
v1.125.2: 643 root tests; both of a chauffeur's job pages checked for mailto links and any email address in the page data (none).
v1.126.0: 643 root tests and the build. On the demo stack: linking and moving links on Office Signatures, $100 on an unpaid booking fills and saves the admin's signature (client PDF remade with it), $50 fills nothing, a chosen signature is kept, an unlinked admin gets nothing, opening a paid booking changes nothing; PATCH refuses unknown signatures (404) and non admin accounts (400).
v1.126.1: full test pass (643 root and 51 portal tests, tsc, lint, both builds, demo sweep) plus Chrome on the demo stack for v1.126.0. After the fix: a new payment row is empty with the placeholder, clicking and typing 100 gives 100 and saves $100, a new refund row is empty.

Before go-live

For v1.116.0: back up, run the account checks in docs/deployment.md section 15, add DNS for admin.* and portal., and put APP_URL and CHAUFFEUR_APP_URL in /opt/acc-system/.env before running update.sh. Then add the two reverse proxy hosts (admin. to 3000, portal.* to 3002).
DNS for book.alwaysclassiccars.com.au, Turnstile keys (required: without the secret the portal refuses new bookings), then scripts/setup-portal.sh (or the manual steps in docs/deployment.md) and the reverse proxy.
Office setup per docs/client-portal.md: car photos and seats, portal images and wording, booking types, Company Info (legal name, ABN, contact and bank details), terms, email templates.
Add the daily hold reminder crontab entry (CRON_SECRET in .env), see "Hold reminders" in docs/client-portal.md.
Back up the database and run npx tsx prisma/normalize-times.ts (dry run), then with --apply.
Switch the website's booking links from the WPForms site to the portal.
Set CLIENT_IP_HEADER in all three apps for the proxy in front of them (cf-connecting-ip behind a Cloudflare tunnel), and make sure APP_URL and CHAUFFEUR_APP_URL are set, or password reset emails aren't sent.
Follow docs/upgrade-from-1.93.md when updating a v1.93.2 server: fetch the latest update.sh with curl rather than running the server's old copy.

## Summary Adds a client booking portal: a separate public app (`clientportal/`, port 3001, for `book.alwaysclassiccars.com.au`) where clients book weddings, general events and transfers themselves, built from the "ACC Booking Prototype" design. It talks to the main system only through a new key protected `/api/portal/*` API. Plan: `plans/ClientBookingForm.md`. Office guide: `docs/client-portal.md`. Versions v1.95.0 to v1.126.1 (see `CHANGELOG.md`). The client portal shares the main system's version number (a unit test keeps both `package.json` files and both lock files in step). ### Office app and chauffeur portal split (v1.116.0) The office app and the chauffeur portal are now separate sites with separate logins, so the same email can have an office account and a chauffeur account. Details: `docs/authentication.md`. - **One build, two processes**: `acc-admin` (`ACC_APP=admin`, port 3000, admin.alwaysclassiccars.com.au) and `acc-chauffeur` (`ACC_APP=chauffeur`, port 3002, portal.alwaysclassiccars.com.au). The client portal stays on 3001 and still calls port 3000. - **The app comes from the process env, never the hostname.** Each process only serves its own routes; the other app's routes return 404 whether or not anyone is signed in. The office app still answers offer links and iCal feeds sent before the split. - **Separate sessions**: own cookie names (`acc-admin-session`, `acc-chauffeur-session`, plus CSRF and callback cookies), encryption keyed to the cookie name, and a `realm` claim in every token that ends the session if it doesn't match the app. Everyone signs in once after updating. - **Same email, two accounts**: `User.email` is unique per role (index `User_email_role_key`) instead of on its own; no rows change. Sign in, forgot password, the Admin accounts and Portal access duplicate checks, the Reports money setting and `prisma/create-user.ts` look accounts up by email and role. Reset and setup links only work on their own app. - **Chauffeur links**: offer and setup links use the new `CHAUFFEUR_APP_URL`; `APP_URL` stays the office app's address. - **Behaviour change**: API calls with no session get a 401 JSON reply instead of a redirect to `/login`. ### Follow ups (v1.116.1 to v1.116.8) - **Sign in screens say which site they are**: "Office sign in" or "Chauffeur sign in" as the heading, the panel label ("Office sign in" / "Chauffeur portal", also on Forgot and Reset password) and the tab title. The old "The office and chauffeurs both sign in here" line is gone. (v1.116.2 added a line under the heading, a link to the other site and a line on failed sign in; v1.116.3 to v1.116.5 took those back out.) - **Chauffeur portal sidebar styled like the admin sidebar** (v1.116.7): logo and company name header, same width, burgundy marker on the current page, admin style offer count, ivory account card with DC licence status and sign out, legal name and version. Always expanded; phones keep the bottom tab bar. Logo, company name and avatar are shared with `AdminSidebar`. - **Fixed: chauffeurs with a working login shown as "Invite expired"** (v1.116.6): the v1.81.0 `passwordSetAt` backfill never ran on servers updated with `db push`. `update.sh` now runs it after `db push` (only fills empty values; unfinished invites keep their link and stay "Invite expired"). A chauffeur changing their own password and `prisma/create-user.ts` now record `passwordSetAt` too. - **Fixed: sign in photo never showed** (v1.116.8, broken since v1.113.8): Next 16 refuses to optimize local image URLs with a query string (`"url" parameter is not allowed`), and the photo is loaded as `/api/login-hero?v=…`. It is now loaded directly (`unoptimized`); it is already a resized WebP. - **Docs**: Cloudflare tunnel setup in `docs/deployment.md` section 12 (v1.116.1), including a check that the admin and portal routes aren't swapped. ### Security and chauffeur fixes (v1.117.0) - **A new password signs the account out everywhere**: each session remembers when its password was set and every request checks it, so a reset, a chauffeur's own change or the office setting a password ends all of that account's sessions; deleting an account ends them too. The proxy now uses the full auth config (Prisma) to do this. - **Current password needed** to change it in My Profile; the chauffeur is asked to sign in again afterwards. - **Fixed: Change Password in My Profile never worked**: sessions didn't carry the account id. They do now. - **Fixed: chauffeur job sheet links**: job change, "notify chauffeurs" and the offer's Job Sheet button now link the portal's `/api/chauffeur/booking-sheet/<booking>` from `CHAUFFEUR_APP_URL` (the offer's is filled in when sent). Since the split they went to the office app. - **Fixed: Verify button in My Profile**: now uses a portal route for the signed in chauffeur's typed DC number. - **Sign in returns you where you were going** (`callbackUrl`, same site paths only); background requests without a session still get a 401. - **Activity page by role**: new nullable `AuditLog.userRole` records whether an office or chauffeur account acted; older entries fall back to email matching. ### Chauffeur emails, portal fleet, schedule and fixes (v1.118.0 to v1.120.0) - **Job change emails show what changed** (v1.118.0): the Job Details Updated email to chauffeurs has a WHAT CHANGED table (Detail / Was / Now). Each chauffeur sees only their job sheet's details: the booking's and their own car's, never another car's or costs; a chauffeur on two cars sees each row named by its car. Default subject `Job details updated - [DATE] - [CLIENT NAME]`; new `[CHANGES]` and `[CLIENT NAME]` placeholders. A customised template sends without the table until `[CHANGES]` is added or it is reset. - **Choose a car shows rego and CPV registration** (v1.119.0, v1.119.1): fleet cards show the rego and, when the last CPV check came back active, "✓ Active on CPV register · Last checked today", linking to the Safe Transport Victoria public register. The portal fleet API sends the rego, a yes/no and the check date, not the raw status. - **Choose a car shows three cars to a row** (v1.119.2): two under 760px, one on phones. - **Schedule columns fit their text and line up across dates** (v1.119.3): Car, Chauffeur, Start, Finish and Hours size to their longest text on the page (measured across every date's table); Pickup → destination takes the rest of the width. - **Fixed: Activity Log "Client link: Sent to" with no address** (v1.119.4): it logged the booking's email, empty on an office-entered wedding. It now logs the address the link was sent to. - **Fixed: stop type couldn't be changed on Edit Booking** (v1.119.7): each stop's fields were drawn twice (desktop row and hidden phone list) under one form name, and the form read the hidden copy, so changes on a computer (type, address, time) were ignored. They are now drawn once. - **Fixed: generated PDFs only showed after a reload** (v1.119.7): Generate PDFs on Edit Booking now waits for the PDFs and shows the Client PDF and Chauffeur PDF links straight away (`POST /api/bookings/[id]/pdfs` returns them). - **Adding a booking stays on it** (v1.119.7): Add booking on New Booking opens the new booking's Edit Booking page instead of going back to the schedule. - **Clients can change cars and hours on a Hold booking** (v1.120.0): through the update link, until they sign: add and remove cars and wedding night transfers, hours down to the 3 hour minimum. Not a car with a chauffeur offer sent or accepted; at least one car; added cars must be free that day. Added cars priced from the booking's price list; deposit ($100 a hire) and holiday surcharge follow the car count unless set by hand. After Hold, cars lock and hours only go up, as before. Rules in `src/lib/hold-car-changes.ts`. ### Test pass fixes, user manual and Send offer on Edit Booking (v1.120.1 to v1.122.2) From a full browser test of the office app, chauffeur portal and client portal. - **A bad id in a link is a 404, not a server error** (v1.120.1): a non-numeric id (`/bookings/abc`, `/api/cars/abc`, an attachment id) reached Prisma as `NaN` and failed with a 500. Every `[id]` page and route now reads its id through `parseId()` (`src/lib/route-params.ts`). - **Schedule handles a bad month** (v1.120.1): `?month=garbage` built an Invalid Date (500) and `?month=13` showed the next January; an invalid month or year now shows the current one. - **Client portal: contact on the day is optional** (v1.121.1): v1.120.1 had made it required to match its * and "All optional except the contact" wording; it is meant to be optional, so the check is gone and the wording no longer marks it required. - **Booking form shows every error on the first try** (v1.120.2): an unpicked car sent `NaN`, a type error ("expected number, received NaN") that also stopped the Email and Phone rules running until the other errors were fixed. It now reads "Car is required" and all errors show together. - **Section tabs follow the part of Edit Booking you're reading** (v1.120.2); **Print opens the month you're viewing** (v1.120.2); **Chauffeur field full width** except on weddings (v1.120.2). - **Chauffeur portal** (v1.120.2): a blank route shows "No route yet" instead of an empty box; Save Profile and Update Password use the portal's burgundy instead of a leftover blue. - **Client portal review shows your details** (v1.120.2): name, phone and email head the review and confirmation summaries. - **Notes hint** (v1.120.3): now says Notes show on the chauffeur's job too. - **User manual with screenshots** (v1.120.4): `docs/user-manual/` has an office guide, a chauffeur guide and a client guide, with screenshots of demo bookings. Linked from `docs/README.md`. The screenshots show the car photos from the company website (v1.120.5). Adding a booking ends with sending the client link (v1.120.6). The chauffeur guide shows the emails chauffeurs get, with an "Emails you will get" table (v1.121.2). - **Portal access email links to the chauffeur guide** (v1.121.3): new `[GUIDE LINK]` placeholder in the Portal Welcome template, filled by Create login and Resend setup link. A customised copy of the template needs Reset to default to pick it up. - **Office guide shows the emails the system sends** (v1.121.4): offer accepted, car on hold, booking link and hold reminder inline, plus an Emails section with what the office and clients receive (new online booking, client updated booking, weekly report, client confirmation). - **Client guide shows the emails clients get** (v1.121.5): booking confirmation, car on hold, hold reminder and check over emails, a new "If the office booked for you" section and an "Emails you will get" table. - **Send offer on Edit Booking** (v1.122.0): a Send offer to [chauffeur] button under Chauffeur status on each saved car in Planning, using the schedule's dialog, route and email builder (moved to `src/lib/offer-draft.ts`). It waits for unsaved changes to be saved, and shows Offer sent after sending without dirtying the form. The office guide has a screenshot of it (v1.122.1). - **No colour boxes on the schedule** (v1.122.2): the car colour swatch at the start of each schedule row looked like an empty checkbox, so it is removed. Car availability keeps its swatches beside the colour filters. - **User manual in each app** (v1.121.0): served as HTML at `/help/`, linked as **Help** in the office and chauffeur sidebars (and My Profile on phones) and **How to book online** in the client portal footer. Each app serves only its own guide (the office app serves all of them), without signing in. Built from `docs/user-manual` by `scripts/build-user-manual.mjs` (new `marked` dev dependency) into the committed `public/help/` and `clientportal/public/help/`; a unit test fails if the HTML is stale. ### Security hardening (v1.123.0 to v1.124.10) - **Browser security headers** (v1.123.0) - **Sign-in limits** (v1.124.0) and **sign-in timing doesn't reveal accounts** (v1.124.9) - **Tracking links only for the job's day** (v1.124.1) - **Permission changes apply straight away** (v1.124.2) - **Signature links can't reach the server's network** (v1.124.3) - **Overtime only on the day, and only once** (v1.124.4) - **Customer details and secrets kept out of logs** (v1.124.5) - **Other sites can't make changes through a staff browser** (v1.124.6) - **Docker runs as an unprivileged user on local ports**, and the Docker image builds again (v1.124.7) - **Job photo uploads take photos only** (v1.124.8) - **Client links expire on the day**, a client's signature stays as signed, reset and setup links stored hashed, booking sheets once the job is offered (v1.124.10) See `CHANGELOG.md` for the details of each. ### User manual screenshots retaken, and "booking folder" wording, client confirmation, chauffeur guide additions, test pass fixes (v1.124.11 to v1.124.18) - Every office, chauffeur and client screenshot in the user manual is retaken on the current version: the office screens show the Help link, the schedule has no colour boxes, and the client portal footer shows How to book online. The HTML manual is rebuilt. - **"Booking folder" instead of OneDrive** (v1.124.12): the Attachments panel, its remove confirmation, the missing file chip and the attachment setup and error messages say "booking folder" rather than OneDrive, and the user manual matches. Storage is unchanged. - **Client confirmation shows the deposit, not the total** (v1.124.13): the client's booking confirmation email drops the booking total and balance amount (travel fees may still be added) and says "The final balance is due by" the date. A customised copy of the template needs Reset to default. - **Chauffeur guide: photos, car locations and the home screen** (v1.124.14): new Uploading photos and Where the other cars are sections (with screenshots, including the Traccar map), and home screen steps for iPhone and Android. - **Overtime button stays put when the photos list opens** (v1.124.15): the chauffeur job's action row is top-aligned, so opening the uploaded photos list no longer pulls the Overtime button down. - **Car location button only shows when the map can be made** (v1.124.16): the button needs two tracked cars on the booking, the same rule as the map link (shared `trackedDeviceIds()`), instead of showing and then failing when the chauffeur's own car isn't tracked. - **Passwords never go in the address bar** (v1.124.17, security): the sign-in, forgot and reset password forms now post, so a submit before the page's JavaScript loads can't put the password in the URL, history or proxy logs. - **Adding a booking makes its PDFs** (v1.124.17): bookings added in the office with any status but Hold now get their client and chauffeur sheets straight away, as on save. - **Production build is a fifth of the size** (v1.124.18): runtime file paths are marked `/*turbopackIgnore: true*/`, so `.next/standalone` drops from 362 MB to 62 MB and no longer carries `docs/`, `clientportal/` or the `src/lib` sources. - **Help pages served in production** (v1.124.18): `update.sh`, `install.sh` and `setup-portal.sh` copied `public` into the existing `standalone/public` as `public/public`, so `/help/` and the TinyMCE files gave 404. They now copy the folder's contents. - **Signing in when already signed in goes to the app** (v1.124.18): `/login` with a session redirects to the `callbackUrl`, the schedule or the chauffeur home instead of showing the form inside the app layout. - **Deposit on the thank you page after signing a held booking** (v1.124.18): the client portal shows the deposit, bank details and reference, as the confirmation email does. ### Security audit fixes, setup docs and the v1.93.2 update guide (v1.124.19 to v1.124.22) From a full security audit of the branch (no Critical or High findings, no way for one client to reach another's booking). The Medium and Low findings are fixed: - **Signatures must be signature sized** (v1.124.19): a portal, client link or overtime signature must be a real PNG of at most 2000 by 1000 pixels, or it is refused (400) before anything is saved. An 8 KB PNG claiming 8000 by 8000 pixels used about 590 MB when the PDFs were made, enough to stop the office app. Making PDFs also skips any PNG over 16 megapixels, whatever its source. - **Clients attach PDFs and photos only** (v1.124.19): anyone can make a booking and get a link, and client files sync to the office's PCs, so Word, Excel, text and CSV files (macros, remote templates, formulas) are no longer taken from the public. The office can still attach them. - **Reset links use the configured address** (v1.124.19): in production a forgot password email is built only from `APP_URL` / `CHAUFFEUR_APP_URL`, never from a forgeable `Host` or `X-Forwarded-Host`. Unset, nothing is sent and the failure is logged; the answer is the same either way. - **Failed sign-ins can't lock out an account's owner** (v1.124.19): the 10 failure limit is per account from each IP; the 30 per IP limit across accounts stays. - **`CLIENT_IP_HEADER`** (v1.124.19): names the one header the proxy always sets (`cf-connecting-ip` behind a Cloudflare tunnel), in all three apps, so rate limits can't be dodged with a forged `X-Real-IP` or `X-Forwarded-For`. Unset, behaviour is unchanged. - **Turnstile required in production** (v1.124.19): the portal refuses new bookings while `TURNSTILE_SECRET_KEY` is unset; development still skips it. `setup-portal.sh` no longer offers to skip the keys (v1.124.20). - **Terms cleaned for the portal**, **signatures not kept by caches** (`Cache-Control: private`) and **sharp 0.35.5 in the client portal** (v1.124.19). - **Example settings and docs** (v1.124.20, v1.124.22): `example.env` and `clientportal/example.env` list every setting the apps read; the authentication, deployment, environment, client portal and OneDrive docs match the fixes. - **Guide to updating from v1.93.2** (v1.124.21): `docs/upgrade-from-1.93.md`, every step in order, with the dev server record. ### Test pass fixes (v1.124.23) - **Dates can be typed as digits**: the date fields read `21112026` or `211126` as DDMMYYYY or DDMMYY (a phone's number pad has no slash), and a date that can't be used shows a message under the field instead of being cleared silently. Office app and client portal. - **Thank you page says Received**: the client portal header after a new booking said CONFIRMED; it now says RECEIVED, as the page does. Client guide screenshot and wording updated. - **Pay counts a job as Done once it has finished**: My Pay no longer counts the whole of today's jobs as Done from midnight. ### Job videos (v1.125.0) - **Chauffeurs can upload videos from a job**: MP4, MOV or WebM up to 90 MB each, checked by content; photos stay at 20 MB, and the 300 per booking counts both. The phone refuses an oversized video before sending it and the button counts through several files. Buttons read Add photos or videos and Photos & videos. - **95 MB requests**: `proxyClientMaxBodySize` goes from 25 MB to 95 MB (each route keeps its own limit) and the chauffeur portal nginx example allows 95 MB, under the Cloudflare tunnel's 100 MB per request. **Production nginx in front of the chauffeur portal needs `client_max_body_size 95m`.** ### Test pass fixes (v1.125.1) - **Offer links keep their thank you**: answering no longer refreshes the page into "You have already declined this offer". - **Offer pages stand on their own**: no signed in sidebar around them (the proxy passes the path to the layout), and the tab reads Contract Offer. - **Edit Booking top row fits at 1280 px**: two fields per line from 1280 to 1339 px. ### Chauffeur portal privacy (v1.125.2) - **No client emails on chauffeur jobs**: the People list keeps Message and Call only, and the page no longer reads the email addresses, so none reach the phone. Chauffeur guide screenshot and text updated. ### Office signatures per admin (v1.126.0) - **Linked to admin accounts**: an Admin account picker on each office signature (one signature per account). New optional `OfficeSignature.userId`, migration `20261009120000_office_signature_user`. **Production needs `db push` for the new column.** - **Added at the deposit**: when a payment on the booking form reaches the deposit (or pays it off) and Office signature is empty, the signed in admin's signature fills it in, visible before saving. A chosen signature is kept; opening an already paid booking changes nothing. ### Test pass fix (v1.126.1) - **New payment amounts start blank**: Add payment and Add refund rows started at 0, so clicking into the right aligned box and typing 100 could give 1000. The amount now starts empty and shows the 0.00 hint. ### Main system - **Stops per car** (`BookingCarStop`): on the Booking form, both PDFs, chauffeur portal, schedule, Activity Log and chauffeur change emails. Existing bookings are unchanged; a save that doesn't send stops leaves them alone. - **Fleet**: car photo upload (resized WebP under `CAR_PHOTOS_PATH`), passenger count, "Show in client booking portal". - **Settings, Company Info**: Legal Name, contact details (phone, email, address) and bank details. - **Settings, Client Portal** (new tab): booking type visibility with direct links, header text, footer text, and header/card images. - **Portal API**: fleet, availability, car photos, settings, create booking (idempotent), and client link view/update. Portal bookings come in with a blank Source for the office to fill in. - **Client link**: "Send to client" / "Reset link" on Edit Booking. The client can complete, sign and later update a booking; date and cars are locked and hours can't go down. Changes are logged as "Client portal", regenerate PDFs, email the office a diff and follow the chauffeur notify setting. "Who you are" opens as the main contact. The online booking confirmation counts as sending the link, so the Client Link panel shows it as sent. "Send to client" sends a Car on Hold email for Hold bookings (7 day hold, complete and sign) and a check-over email otherwise; signing a held booking sends the client confirmation with the payment details. - **Emails**: six new editable templates (client confirmation, office notification, link email, car on hold link email, hold reminder, client update notification). - **Client confirmation email design**: a Next step block with the deposit, reference, bank details grid, total, balance and due date; the summary as a timeline of pickup and stops with the ceremony start on the Ceremony stop; an Outlook-safe "Update my booking" button; the company phone in the footer. New placeholders [TOTAL], [BALANCE], [BALANCE DUE DATE] and [COMPANY PHONE]. The office notification has its own layout: summary header, deposit/reference/total boxes, a To do list (deposit to watch for, check over the booking form and pricing), client email and phone links, each car with its chauffeur status and a stop table, and an "Open booking" button. - **Main Contact**: a dropdown in a wedding's Booking section on Edit Booking: Automatic (who booked) or a picked Partner 1, Partner 2, planner or other contact, with the email and phone the link emails go to. New `mainContactRole` column. Worked out from Signed By, then the booking's email, else the first named of planner, Partner 1, Partner 2, other; the update link uses the same check. On an office-entered wedding (no booking email) it uses the contact's own email and phone, so "Send to client" and hold reminders go to them. - **Hold Until**: a date next to Filled Out Date on Hold bookings (default 7 days from today), used by the Car on Hold email. New `Booking.holdUntil` column. - **Hold reminders**: a daily job (`/api/cron/hold-reminders`, `CRON_SECRET`, needs a crontab entry) emails the client 2 days before a hold ends. New `holdSentAt` and `holdReminderSentAt` columns. - **Hold weddings**: a wedding on Hold saves with just one contact (a partner, the planner or the other contact, with a name and an email or phone); the full rules apply once it leaves Hold. - **Settings layout redesign (v1.96.0)**: grouped left-hand settings menu, an overview page with search (the menu on phones), shared page header, sections and fields, and a sticky save bar with Discard on form pages. Per-page updates, including drag-to-reorder for booking types and sources, email templates grouped by recipient, and one save bar for the client portal texts. Layout and presentation only: no API, schema or save logic changes. - **Chauffeur and office emails (v1.96.2)**: the contract offer, welcome, password reset, offer accepted/declined, job updated, client updated booking and weekly report emails use the shared card layout (new `src/lib/email-layout.ts`), with job facts, notes and changes as tables and panels, and Outlook-safe buttons. New placeholders [COMPANY PHONE], [JOB SUMMARY], [BOOKING LINK], [BOOKING TYPE], [WEDDINGS COUNT]. - **Portal special instructions (v1.96.3)**: the same rich text editor as Edit Booking; client HTML is cleaned with `sanitize-html` before saving (safe formatting only). The portal gains a `public/` folder for TinyMCE, copied into the build by the scripts and Dockerfile. - **Job folders (v1.96.5)**: `Booking.jobFolder` records each booking's OneDrive folder so it follows date/name changes, Postponed/ and Cancelled/, and back (fixes postponed folders left behind). Groundwork for booking attachments (`plans/BookingAttachments.md`). - **Booking attachments (v1.97.0)**: attach documents (e.g. a run sheet) under Documents on Edit Booking, stored in the booking's OneDrive job folder (`Attachments/`), checked by type and content, 20 MB each; per-file Share with chauffeur, shown on the job in the chauffeur portal. New `BookingAttachment` table; proxy body limit raised to 25 MB. - **Client documents (v1.97.1)**: clients attach documents (run sheets etc.) on their update link's Details step, 10 MB each and 10 per booking; saved to the job folder, marked From client, office emailed and Activity Log. Portal routes rate limited and size capped. - **Times (v1.97.2)**: all booking times stored as 24h HH:MM and shown 12h; diffs compare by meaning (no false "changed" times or blank rows); readable change labels; one-off `prisma/normalize-times.ts` to fix saved 12h times (run by hand, dry run first). Also: hyphens instead of long dashes in emails, pages and PDFs, and the office email footer names the company. - **Chauffeur Offer reset**: Reset to default now clears the saved offer, so it shows Default again. - **Office email header**: office emails are headed with the company name from Company Info instead of "ACC SYSTEM". - **Time pickers on Edit Booking**: every time field on the booking form uses the same time picker as the client portal. - **Adding a car**: after saving, a new car takes its saved id, so "Unsaved changes" clears and later saves no longer recreate the car. - **Chauffeur portal redesign**: phone first, with a tab bar on phones and a sidebar on wider screens. Today shows the next job with a countdown, route, Navigate and Call. My Jobs puts offers first with the estimated pay. Each job has a detail page. Overtime is recorded per job in three steps, availability is set by tapping days, and pay shows the month by week and per job. - **Offer cards**: a View job details button above Decline and Accept job; portal headings use Source Serif 4 (plain J). - **People on a job**: every contact on the booking, the main contact falling back to the booking's phone and email, plus contact on the day, photographer and videographer, with Email, Message and Call buttons. - **Job page details**: Ceremony & reception (addresses with Navigate, times, drink type) and the special instructions, cleaned to plain formatting. - **Today**: no month pay card (pay stays on My Pay); the next job uses the full width when there's nothing for the side column. - **Date fields**: our own day-first date field (DD/MM/YYYY, typed or picked from a Monday-first calendar) replaces the browser's date picker in both apps, which showed month first on US-English browsers. - **Hold reminders**: sent on the first daily run in the last 2 days of a hold (not only the exact day), so a missed run or a short hold still gets one; the email says "in 2 days", "tomorrow" or "today". - **Hold reminder heading**: "Hi [name], your car is only on hold until [day]." - **Hold reminder record**: "Hold reminder sent" on the Client Link panel and a System entry in the booking's Activity log. - **Weekly report and hold reminder run logging**: both cron endpoints now stamp every run with when it ran, and a run-level failure includes the real error message instead of a generic one. A successful weekly report send, a run-level failure, and a hold reminder that fails for one booking are all recorded to the Activity Log, not just the server console. - **Activity log cars and payments**: added/removed cars logged by name and pickup time and matched by id (not list position); no more "Payments: - → []" on every save. - **Client Link history**: Sent, Hold reminder sent, Completed and Last updated each on their own line. - **Email template Save**: only active once the subject or body changes, so saving an unchanged template (for example right after Reset to default) no longer marks it Customised. - **Email template reset**: Reset to default restarts the editor so it stays Default with nothing unsaved; a company name starting with "Always Classic Cars" no longer doubles in saved templates. - **Expired reset link**: "Back to sign in" alongside "Request a new link". - **Reports redesign**: revenue, received, owing and after chauffeur pay against last year; booking pace; a Needs attention list for the next 60 days; fleet and chauffeur tables; busiest dates, day of the week and lead time; CSV export and print. - **Reports without money figures**: limited admins without the new Show money figures option (under Reports in Settings → Admin accounts) get a version with no dollar amounts, built on the server so the money never reaches their browser, and a CSV without totals or payments. - **Reports version per account**: each admin account has its own Reports choice (with or without money figures) in Settings → Admin accounts, whatever its access; new accounts start without money, existing ones keep what they saw. Adds `User.reportsMoney` (nullable, safe with `db push`). Also Reports wording: "1 car", lead time in days/weeks/months, plain hyphens. - **Lead time bars**: 12-24 months, 24-36 months and Over 36 months replace Over 12 months. - **Delete chauffeur**: only for a chauffeur never given a job (deletes their availability and portal login too); otherwise disabled with a note to untick Active. The API refuses instead of quietly deactivating. - **Duplicate chauffeurs blocked on create**: adding a chauffeur with the same name as an existing one (active or inactive) is now rejected with an error instead of silently creating a second record. - **Unavailable cars on the schedule**: a date with a car marked unavailable (Fleet → car availability) shows an "unavailable" badge on that date's header, whether or not the car is actually booked that day; hovering shows the time range (or "All day") and the reason. - **Branded chauffeur availability**: `/chauffeurs/availability` matches the chauffeur portal's burgundy/gold/ivory branding, with month/week/day views showing accepted jobs and sent offers (not just unavailability) per day, a Saturday coverage strip, a 6am-midnight day timeline, same-day conflict flags, and a right-side edit drawer (bottom sheet on mobile) replacing the old modal. - **Branded chauffeurs list and profile**: `/chauffeurs` and `/chauffeurs/[id]` get the same branding, with a search box, an Active/Needs attention/Inactive/All filter, a "needs attention" panel for DC-licence and portal-login issues, and Next job/Jobs this month columns; the profile page adds a header card with status chips, summary tiles, an Upcoming jobs card and a Time off card. Same CPVV refresh, permissions, portal flows and delete rule throughout. - **Copy a car's journey (client portal)**: "copy journey to another car" adds the picked car with the same pickup, times, stops, hours and who it's for; the copy is then edited on its own. - **Who you are (portal)**: picking Wedding planner or Other takes the booker's details back off Partner 1. - **Special instructions in change lists**: shown as plain text in the client update email and Activity log, not the stored HTML document. - **Legal name**: used at the bottom of PDFs, the sidebar (with version underneath) and the portal footer. - **PDF header**: address, phone and email from Company Info (unchanged until filled in). - **Edit Booking page layout**: redesigned from the Proposed artboard. Header with client names, chips, date and the save/cancel/postpone/activity actions (sticky on large screens) plus section links; Booking, Couple or Client, one Contacts section, Ceremony & Reception combined, collapsible car cards with a summary line and grouped fields, shorter instructions editor, Signature, Delete at the end; sticky right column with Payment (balance due, paid progress), Chauffeur Pay, Documents and the Client Link panel. The New Booking page uses the same layout. Fields, validation and saving are unchanged; errors inside a collapsed car open it. - **Fixed**: the booking form counted as changed on load (fields starting undefined picked up "" from the page), so leaving warned and Cancel asked to discard even with no edits. - **Chauffeur pay hidden on screen by default**: the Chauffeur Pay card and the pay rate fields start hidden so clients in the office can't see them; Show/Hide is remembered per browser. Display only. ### Client portal (`clientportal/`) - Five step wizard with fleet picker and availability, stops, night transfers, airport transfers with suggested pickup times, drawn signature, thank you page with deposit and bank details. - Direct links `/wedding`, `/general`, `/transfer` (work even when a type is hidden from the main page); edit mode at `/b/<token>`. - Footer, contact details, header text and images come from Settings. - Weddings show the couple's names (from "Who you are") on each car's chips, the ceremony arrival times and the summaries, instead of Partner 1 and Partner 2. - Per IP rate limits, body size limit, Cloudflare Turnstile (required in production from v1.124.19). ### Deployment - **v1.118.0 to v1.120.0**: no database changes. Deploy the office app and the client portal together (the portal's fleet cards read the rego and CPV fields from the office app's fleet API). - **v1.117.0**: `db push` adds `AuditLog.userRole` (no data changes). Everyone signs in once more (sessions now carry a password stamp). - **Account status backfill (v1.116.6)**: `update.sh` marks accounts with no outstanding setup or reset link as having set a password, on every run. Safe to repeat. - **Office app and chauffeur portal (v1.116.0)**: `update.sh` replaces the `acc-system` PM2 app with `acc-admin` and `acc-chauffeur`, built from the existing entry so custom env values carry over (old file kept as `ecosystem.config.js.bak`). `install.sh`, `setup-portal.sh`, `restore.sh` and `docker-compose.yml` (new `chauffeur` service) use the two apps. New env vars `ACC_APP` (per process) and `CHAUFFEUR_APP_URL`. `npm run dev:chauffeur` runs the portal in development on 3002. Upgrade steps, Nginx sites for admin.* and portal.*, and rollback are in `docs/deployment.md` section 15. - Database changes are additive only; `scripts/update.sh` (`db push`) applies them. No data migration needed. - `update.sh` rebuilds and restarts the portal only where the `acc-clientportal` PM2 process exists, and prints how to add it otherwise. - New `scripts/setup-portal.sh` adds the portal to an existing server: shared key, both `.env` files, portal build, `acc-clientportal` in PM2, a connection check, and (for a local Nginx) the site and certbot. It asks whether the reverse proxy runs on the same server and sets the listen address to match (`127.0.0.1` or `0.0.0.0`). Safe to rerun; unchanged answers don't rebuild the main system. - `install.sh` sets `CAR_PHOTOS_PATH` and offers the portal setup at the end. - The portal's PM2 app is `acc-clientportal`. Servers that already run it as `acc-portal` are switched over by `update.sh` automatically. - Docker: `clientportal/Dockerfile`, `portal` service in `docker-compose.yml`, root `.dockerignore`. - New env vars: main `PORTAL_API_KEY`, `PORTAL_URL`, `CAR_PHOTOS_PATH` (and `APP_URL` for links); portal `MAIN_API_URL`, `PORTAL_API_KEY`, `HOSTNAME`, `TURNSTILE_SECRET_KEY`, `NEXT_PUBLIC_TURNSTILE_SITE_KEY`. They can go in the PM2 ecosystem files or in `.env` files (rebuild after changing `.env`; `PORT` and `HOSTNAME` stay in the ecosystem file). See `docs/environment-variables.md` and `docs/deployment.md`. ## Testing - **v1.116.0**: 530 root tests (29 new: sign in per app, route access per app, token realm checks, password reset per app) and 38 portal tests; typecheck, lint, `prisma validate` and both builds clean. Migrations applied from scratch match the schema exactly. End to end, both built apps were run against a copy of the dev database with a dual account user. Each app signed in its own account and rejected the other password. Admin sessions got 404 on chauffeur routes and chauffeur sessions got 404 on admin routes. Cookies moved between apps and forged wrong-app tokens were refused. `/api/portal/*` works on 3000 and returns 404 on 3002, and the iCal feed works on both. The PM2 split has since run on the dev server; routing problems there were the tunnel routes, not the apps. Not tested: Docker. - **v1.116.1 to v1.116.8**: 532 root tests (a new one for the chauffeur password change); typecheck and lint clean. The passwordSetAt backfill was run twice on a scratch database (fills the missing value, leaves an unfinished invite alone, reads back through Prisma). The chauffeur sidebar and the sign in pages were checked as rendered HTML on the dev servers, signed in as a test chauffeur; the sign in photo was checked against the old optimizer URL (400) and the new direct URL (200 WebP). Not viewed in a browser. - **v1.117.0**: 542 tests; typecheck, lint and migrations from scratch clean. Both built apps were run against a scratch database. Wrong current password refused; a password change ended both chauffeur "devices"; old password refused and new one accepted; the same email's office account unaffected; an office password reset elsewhere ended that office session (redirect to sign in with `callbackUrl`). A signed out browser opening the job sheet link went to sign in; fetch got 401. The Activity who filter was checked against real SQLite rows (dual account office edit as office, offer answer as chauffeur, old rows by email). Not checked: the offer email link substitution (reviewed only), a real CPVV result, and any of it in a browser. - **v1.118.0 to v1.120.0**: 545 root tests (new ones for the job change table: own car only, no costs, 12 hour times, car names) and 40 portal tests (CPV check age); typecheck and lint clean in both. The job change email was rendered from the default template and checked for the table. Tested OK on the test server: the stops fix (v1.119.5), generated PDFs showing straight away (v1.119.6) and adding a booking staying on it (v1.119.7). Not checked in a browser: the fleet cards and the schedule column widths. v1.120.0: 559 root tests (new hold-car-changes tests) and 43 portal tests; the real client update was run against a scratch database (add, remove and lower hours on Hold; offered car not removable; car booked elsewhere refused; 3 hour minimum; deposit $200 to $300 and a hand-set deposit kept; non-Hold adding refused and hours only up), all passing. Not checked in a browser: the portal car step on a Hold booking. - `npm test` (245) in the root and `npm test` (28) in `clientportal/`; typecheck and lint clean in both. - Edit Booking page: checked in a browser (sticky header and column, save keeps all cars and stops, validation opens a collapsed car, New Booking and airport transfer pages, phone width, no unsaved-changes prompt without edits, pay hidden by default and saved unchanged). - PDFs: text for existing bookings identical before and after with the new Company Info fields empty; filled in values appear in the header and footer. - End to end against a copy of the dev database: wedding (desktop) and return airport transfer (390px mobile) booked through the portal in a headless browser; client link edit and signing; locked fields and hour reduction rejected; old token dead after reset; PDFs for existing bookings identical before and after. - Dev server: updated with `update.sh` on this branch and `setup-portal.sh` run; `acc-clientportal` online and connected to the main system. - Not tested: Docker images (no Docker locally) and real email delivery (no SMTP locally). - **v1.124.19 to v1.124.22**: 640 root tests and 50 portal tests (new ones for signature sizes, client upload types, reset links from a forged host, per account and IP lockout, `CLIENT_IP_HEADER` and Turnstile in production); typecheck and lint clean in both. Rebased onto v1.124.18 with no code conflicts. The dev server was updated from v1.93.2 (on `main`) to v1.124.20 with `update.sh`: the server's own v1.93.2 script built the new code but didn't split the apps, and the branch's script then split `acc-system` into `acc-admin` and `acc-chauffeur`; `db push` only added the three unique indexes, and booking and car counts were unchanged. `setup-portal.sh` stopped on a blank Turnstile key without writing anything, then installed `acc-clientportal` with Cloudflare's test keys. All three apps answered, `/api/portal/` refused requests without the key, a booking without a Turnstile token was refused, and a booking with the 8000 by 8000 signature was refused with no booking or file created and the office app at about 200 MB. Not tried there: anything that sends email (the dev database has real clients and chauffeurs). v1.124.21 and v1.124.22 are docs only. - **v1.124.23**: 641 root tests and 51 portal tests (new: dates typed as digits). Full pass of both builds, a sweep of about 120 pages and APIs, and Chrome runs of adding a booking, the client link, accepting an offer and a portal booking. - **v1.125.0**: 643 root tests (new: video types by content). Uploaded MP4, MOV, WebM and a 40 MB video through the chauffeur portal; a fake .mp4, a 92 MB video and a 21 MB photo were refused. - **v1.125.1**: 643 root tests, both builds and a sweep of 106 requests. Offer page checked signed in to each app and signed out (accept message stays, no sidebar, title); field widths measured from 1024 to 1600 px. - **v1.125.2**: 643 root tests; both of a chauffeur's job pages checked for mailto links and any email address in the page data (none). - **v1.126.0**: 643 root tests and the build. On the demo stack: linking and moving links on Office Signatures, $100 on an unpaid booking fills and saves the admin's signature (client PDF remade with it), $50 fills nothing, a chosen signature is kept, an unlinked admin gets nothing, opening a paid booking changes nothing; PATCH refuses unknown signatures (404) and non admin accounts (400). - **v1.126.1**: full test pass (643 root and 51 portal tests, tsc, lint, both builds, demo sweep) plus Chrome on the demo stack for v1.126.0. After the fix: a new payment row is empty with the placeholder, clicking and typing 100 gives 100 and saves $100, a new refund row is empty. ## Before go-live 0. For v1.116.0: back up, run the account checks in `docs/deployment.md` section 15, add DNS for admin.* and portal.*, and put `APP_URL` and `CHAUFFEUR_APP_URL` in `/opt/acc-system/.env` before running `update.sh`. Then add the two reverse proxy hosts (admin.* to 3000, portal.* to 3002). 1. DNS for `book.alwaysclassiccars.com.au`, Turnstile keys (required: without the secret the portal refuses new bookings), then `scripts/setup-portal.sh` (or the manual steps in `docs/deployment.md`) and the reverse proxy. 2. Office setup per `docs/client-portal.md`: car photos and seats, portal images and wording, booking types, Company Info (legal name, ABN, contact and bank details), terms, email templates. 3. Add the daily hold reminder crontab entry (`CRON_SECRET` in `.env`), see "Hold reminders" in `docs/client-portal.md`. 4. Back up the database and run `npx tsx prisma/normalize-times.ts` (dry run), then with `--apply`. 5. Switch the website's booking links from the WPForms site to the portal. 6. Set `CLIENT_IP_HEADER` in all three apps for the proxy in front of them (`cf-connecting-ip` behind a Cloudflare tunnel), and make sure `APP_URL` and `CHAUFFEUR_APP_URL` are set, or password reset emails aren't sent. 7. Follow `docs/upgrade-from-1.93.md` when updating a v1.93.2 server: fetch the latest `update.sh` with curl rather than running the server's old copy.

sb added 10 commits

2026-09-23 20:20:46 +10:00

Bump to v1.95.0 — Add client booking portal plan 268b0dda83

Bump to v1.95.1 — Booking stops, car photos, bank details and portal API 85c5f4770a

Bump to v1.95.2 — Client update link and online booking emails 45affcc13d

Bump to v1.95.3 — Client booking portal app 207fceb4da

Bump to v1.95.4 — Client booking portal deployment and docs 90a12fdffb

Bump to v1.95.5 — Client portal header and booking type images 0f3fbfb312

Bump to v1.95.6 — Portal booking type links and visibility 54b91f5d31

Bump to v1.95.7 — Portal header text setting 9f727a43e6

Bump to v1.95.8 — Portal footer from company settings 725ec308a5

Bump to v1.95.9 — Legal name for PDFs, portal and sidebar footers fbb4a42f8c

sb commented

2026-09-23 20:23:34 +10:00

Author

Owner

To be fully tested before merge.

sb commented

2026-09-23 20:24:34 +10:00

Author

Owner

tomorrow 24-9-2026 i will deploy to test server to validation

sb self-assigned this

2026-09-23 20:24:39 +10:00

sb added 1 commit

2026-09-24 07:26:19 +10:00

Bump to v1.95.10 — Company contact details and portal footer text 11d04cc919

sb added 1 commit

2026-09-24 07:30:04 +10:00

Bump to v1.95.11 — PDF contact details from Company Info 45d53506df

sb changed title from ~~Client booking portal (v1.95.0 to v1.95.9)~~ to Client booking portal (v1.95.0 to v1.95.11)

2026-09-24 07:31:05 +10:00

sb added 1 commit

2026-09-24 08:53:43 +10:00

Bump to v1.95.12 — Portal setup script and install/update script changes aea0536de3

sb added 1 commit

2026-09-24 09:01:36 +10:00

Bump to v1.95.13 — Portal setup handles a remote reverse proxy aa870da861

sb changed title from ~~Client booking portal (v1.95.0 to v1.95.11)~~ to Client booking portal (v1.95.0 to v1.95.13)

2026-09-24 09:07:39 +10:00

sb added 1 commit

2026-09-24 09:18:48 +10:00

Bump to v1.95.14 — Portal shares the app version; PM2 app renamed acc-clientportal 00d01cdb58

sb changed title from ~~Client booking portal (v1.95.0 to v1.95.13)~~ to Client booking portal (v1.95.0 to v1.95.14)

2026-09-24 09:20:17 +10:00

sb added 1 commit

2026-09-24 09:58:32 +10:00

Bump to v1.95.15 — Edit Booking page layout; fix form counted as changed on load ddb5f20c06

sb added 1 commit

2026-09-24 10:07:29 +10:00

Bump to v1.95.16 — Chauffeur pay hidden on screen by default d443fc54fd

sb changed title from ~~Client booking portal (v1.95.0 to v1.95.14)~~ to Client booking portal (v1.95.0 to v1.95.16)

2026-09-24 10:08:18 +10:00

sb commented

2026-09-24 10:17:06 +10:00

Author

Owner

Requested Change for the chips will show the couple's names from the "Who you are" step, for example Sam Smith | Alex Jones | Party instant of "Partner 1"/"Partner 2"

sb added 1 commit

2026-09-24 10:18:46 +10:00

Bump to v1.95.17 — Couple's names on the client portal's car and ceremony labels 0dc92e47cf

sb changed title from ~~Client booking portal (v1.95.0 to v1.95.16)~~ to Client booking portal (v1.95.0 to v1.95.17)

2026-09-24 10:19:44 +10:00

sb added 1 commit

2026-09-24 12:25:40 +10:00

Bump to v1.95.18 — Redesigned online booking confirmation email 446c390878

sb added 1 commit

2026-09-24 12:47:55 +10:00

Bump to v1.95.19 — Blank source on online bookings; Partner 2 recognised on the update link c7b43eaad5

sb added 1 commit

2026-09-24 14:37:09 +10:00

Bump to v1.95.20 — Main Contact on Edit Booking d7affafe7f

sb added 1 commit

2026-09-24 19:08:11 +10:00

Bump to v1.95.21 — Office email for online bookings matches the client's c1313f101c

sb added 1 commit

2026-09-24 19:21:52 +10:00

Bump to v1.95.22 — Office email for online bookings redesigned for the office 5d26a8ddea

sb added 1 commit

2026-09-24 19:31:48 +10:00

Bump to v1.95.23 — Office email To do list simplified; online bookings show the client link as sent cd74d0abae

sb added 1 commit

2026-09-24 19:47:19 +10:00

Bump to v1.95.24 — Booking link emails by status; payment details after signing a held booking 0a98790f03

sb added 1 commit

2026-09-24 19:54:51 +10:00

Bump to v1.95.25 — Hold Until date on bookings b3afcb31bc

sb added 1 commit

2026-09-24 20:06:04 +10:00

Bump to v1.95.26 — Hold reminder email and daily job 6643701b8b

sb added 1 commit

2026-09-24 20:14:57 +10:00

Bump to v1.95.27 — Hold weddings need only one contact bde95506e7

sb added 1 commit

2026-09-24 20:19:09 +10:00

Bump to v1.95.28 — Send to client uses the Main Contact on office-entered weddings e14b9bdfeb

sb added 1 commit

2026-09-24 20:24:14 +10:00

Bump to v1.95.29 — Pick the Main Contact 82eef2be17

sb added 1 commit

2026-09-24 20:27:33 +10:00

Bump to v1.95.30 — Main Contact next to Filled Out Date a8429958da

sb added 1 commit

2026-09-24 20:36:56 +10:00

Bump to v1.95.31 — Price list shown in the Payment panel b624c58c7e

sb added 1 commit

2026-09-24 22:04:51 +10:00

Bump to v1.96.0 — Settings layout redesign b5d32931f8

sb added 1 commit

2026-09-24 22:08:40 +10:00

Bump to v1.96.1 — Date fields no longer overlap on iPad b49baf7a85

sb added 1 commit

2026-09-25 07:40:55 +10:00

Bump to v1.96.2 — Chauffeur and office emails redesigned c12b17b109

sb added 1 commit

2026-09-25 07:59:46 +10:00

Bump to v1.96.3 — Rich text special instructions in the client portal c5182925bb

sb added 1 commit

2026-09-25 08:06:03 +10:00

Bump to v1.96.4 — Taller special instructions editor in the client portal eb12866c4d

sb added 1 commit

2026-09-25 08:36:51 +10:00

Bump to v1.96.5 — Job folders tracked for every booking 594a170816

sb added 1 commit

2026-09-25 08:45:53 +10:00

Bump to v1.97.0 — Booking attachments cdeb9a2b01

sb added 1 commit

2026-09-25 08:53:46 +10:00

Bump to v1.97.1 — Clients can attach documents 843730c5ce

sb added 1 commit

2026-09-25 09:21:04 +10:00

Bump to v1.97.2 — Times stored one way and shown in 12-hour; hyphens instead of long dashes bd2651dec9

sb added 1 commit

2026-09-25 09:34:15 +10:00

Bump to v1.97.3 — Chauffeur Offer reset fixed; office emails headed with the company name d6ac8b32c1

sb commented

2026-09-25 09:40:38 +10:00

Author

Owner

Bug when i add a car to a booking and save it still show Unsaved changes

sb added 1 commit

2026-09-25 14:54:56 +10:00

Bump to v1.97.4 — Time pickers on Edit Booking aef111e4a1

sb added 1 commit

2026-09-25 15:01:06 +10:00

Bump to v1.97.5 — Unsaved changes cleared after adding a car 65db95f478

sb commented

2026-09-25 15:04:34 +10:00

Author

Owner

Fixed add a car to a booking and save it still show Unsaved changes. Test ok

sb added 1 commit

2026-09-25 17:46:04 +10:00

Bump to v1.98.0 — Chauffeur portal redesigned for phones d5f8fdc797

sb added 1 commit

2026-09-25 18:08:05 +10:00

Bump to v1.98.1 — View job details on offers; plainer heading font ce6f5d299a

sb added 1 commit

2026-09-25 18:14:53 +10:00

Bump to v1.98.2 — Every contact under People on a job c83ae313f0

sb added 1 commit

2026-09-25 18:19:50 +10:00

Bump to v1.98.3 — Ceremony, reception and special instructions on a chauffeur's job 0b667b0a41

sb added 1 commit

2026-09-25 18:35:03 +10:00

Bump to v1.98.4 — No pay card on Today 2891f82950

sb added 1 commit

2026-09-25 18:43:07 +10:00

Bump to v1.98.5 — Dates shown day, month, year everywhere 347ab1272a

sb added 1 commit

2026-09-25 18:53:14 +10:00

Bump to v1.98.6 — Hold reminders no longer missed 567b8d8550

sb added 1 commit

2026-09-25 19:02:43 +10:00

Bump to v1.98.7 — Hold reminder heading f959bdccd5

sb added 1 commit

2026-09-25 19:07:17 +10:00

Bump to v1.98.8 — Hold reminders show on the booking 63b0010928

sb added 1 commit

2026-09-25 19:12:56 +10:00

Bump to v1.98.9 — Activity log names the car added or removed 2cb0c8a464

sb added 1 commit

2026-09-25 19:17:29 +10:00

Bump to v1.98.10 — Client Link history one line each 009ee4b1d9

sb added 1 commit

2026-09-25 19:24:12 +10:00

Bump to v1.98.11 — Email templates no longer turn Customised by saving without a change 4c60356561

sb added 1 commit

2026-09-25 19:31:48 +10:00

Bump to v1.98.12 — Reset to default no longer shows Unsaved; company name no longer doubles 9b10c8ce78

sb added 1 commit

2026-09-25 19:35:49 +10:00

Bump to v1.98.13 — Back to sign in from an expired reset link 54c1434620

sb added 2 commits

2026-09-26 07:17:26 +10:00

Bump to v1.99.0 — Reports redesign: revenue, pace, needs attention, fleet/chauffeur tables, CSV export 95b59231ec

Bump to v1.100.0 — Reports without money figures for accounts without the Show money figures option e6dda4cc76

sb added 1 commit

2026-09-26 07:27:51 +10:00

Bump to v1.101.0 — Reports version chosen per account; Reports wording fixes ffd696aaa3

sb added 1 commit

2026-09-26 07:32:42 +10:00

Bump to v1.101.1 — Longer lead times on Reports b8409e4979

sb added 1 commit

2026-09-26 08:01:44 +10:00

Bump to v1.102.0 — Delete a chauffeur who's never had a job 58cc0dced9

sb added 1 commit

2026-09-26 08:17:09 +10:00

Bump to v1.103.0 — Copy a car's journey in the client portal 757a2f2e8b

sb added 1 commit

2026-09-26 08:28:31 +10:00

Bump to v1.103.1 — Wedding planner and Other details no longer copied to Partner 1 53cfabbf08

sb added 1 commit

2026-09-26 19:03:28 +10:00

Bump to v1.103.2 — Special instructions readable in change lists eafab1aa51

sb added 1 commit

2026-09-27 08:01:37 +10:00

Bump to v1.103.3 — Tidier booking form headings 58ca1f7e15

sb added 1 commit

2026-09-29 12:31:37 +10:00

Bump to v1.103.4 — Block duplicate chauffeur names on create 5d96132c46

Reject creating a chauffeur whose name matches an existing one (active or inactive), instead of silently creating a duplicate record.

sb added 1 commit

2026-09-29 12:48:47 +10:00

Bump to v1.103.5 — Log weekly report run outcome and time 9ec684d13a

Stamp every weekly-report cron run with when it ran and how it went (success, failure with the real error, or unauthorized), so the crontab's log file is actually useful for debugging a missed run. A successful send and a failure both land in the Activity Log too.

sb added 1 commit

2026-09-29 12:57:00 +10:00

Bump to v1.103.6 — Log hold reminder run outcome and time 7a64d911b9

Same as the weekly report: stamp every hold-reminder cron run with when it ran, and record a run-level failure with its real error. A per-booking send failure now also lands on that booking's Activity Log, not just the console.

sb added 1 commit

2026-09-29 13:13:00 +10:00

Bump to v1.104.0 — Show unavailable cars on the schedule 3a7630d9c9

Fetch CarUnavailability for the visible month, same pattern as the existing chauffeur-unavailability query, and show a badge on that date's header, whether or not the car is actually booked that day.

sb added 1 commit

2026-09-29 13:22:15 +10:00

Bump to v1.104.1 — Show night transfer count on the schedule 9f423bb1eb

The date header showed a car count that excludes night transfers with no count of their own. Add a matching "N night transfers" badge next to it.

sb added 1 commit

2026-09-29 13:38:24 +10:00

Bump to v1.104.2 — Show car and night transfer counts on the printed schedule 81a6ad972b

Add the same "N cars" and "N night transfers" badges to the print view's date header as the on-screen schedule.

sb added 1 commit

2026-09-29 14:02:50 +10:00

Bump to v1.105.0 — Branded chauffeur availability redesign 0d89afa8a5

Rebuild /chauffeurs/availability to match the chauffeur portal's burgundy/gold/ivory branding: month/week/day views with job and offer detail (not just unavailability), a Saturday coverage strip, a 6am-midnight day timeline, conflict flags, and a new edit drawer (bottom sheet on mobile) replacing the old modal. Sidebar and the chauffeur/client portals are untouched.

sb added 1 commit

2026-09-29 14:10:09 +10:00

Bump to v1.105.1 — Fix lock file version drift and a drawer type error c15818714f

npm test caught two issues: every version bump since 1.103.4 missed the lock files' packages[""].version field alongside the top-level one, and EditDrawer's handleRemove read a possibly-null outer variable inside a closure TypeScript couldn't narrow.

sb added 1 commit

2026-09-29 14:41:39 +10:00

Bump to v1.106.0 — Branded chauffeurs list and profile 9b46dbf9cc

Rebuild /chauffeurs and /chauffeurs/[id] (and /new) to match the chauffeur portal's burgundy/gold/ivory branding: a search + Active/Needs attention/Inactive/All filter and attention panel on the list, a header card with status chips and summary tiles plus Upcoming jobs/Time off cards on the profile. Same CPVV refresh, permissions, portal-access flows and delete rule throughout. Also fixes the Availability redesign never actually loading its branded font (src/app/chauffeurs/layout.tsx now loads it for the whole section).

sb added 1 commit

2026-09-29 15:48:36 +10:00

Bump to v1.107.0 — Branded fleet list and car profile e464dfcb5a

Rebuild /cars and /cars/[id] (and /new) to match the chauffeur portal's burgundy/gold/ivory branding: a grid/table list with search, a make filter, an Active/Needs attention/Inactive/All filter and attention panel, and a car profile with a hero card (overlaid photo editor, status chips, booking/pricing tiles), Upcoming bookings and Off the road cards. Same CPVV verification, permissions and pricing behaviour throughout.

sb added 1 commit

2026-09-29 16:54:12 +10:00

Bump to v1.107.1 — Fix car pages failing to open 9843b71b70

sb added 1 commit

2026-09-29 16:59:41 +10:00

Bump to v1.107.2 — Car photo shows again on the car profile 51eb185e25

sb added 1 commit

2026-09-29 17:05:45 +10:00

Bump to v1.107.3 — Side cards sit beside the form on car and chauffeur profiles e9e1683240

sb added 1 commit

2026-09-29 17:27:26 +10:00

Bump to v1.108.0 — Branded fleet availability redesign 624a2ee346

sb added 1 commit

2026-09-29 17:48:00 +10:00

Bump to v1.109.0 — Branded activity feed and booking history 4687539d57

sb added 1 commit

2026-09-29 17:57:13 +10:00

Bump to v1.110.0 — Branded admin sidebar 054412c0fc

sb added 1 commit

2026-09-29 17:58:16 +10:00

Bump to v1.110.1 — Chauffeur availability in sentence case b91dceb7c7

sb added 1 commit

2026-09-29 18:06:57 +10:00

Bump to v1.111.0 — Branded sign-in and password reset screens af04081bf2

sb added 1 commit

2026-09-29 18:18:49 +10:00

Bump to v1.111.1 — Office admins can reset their password b0332e5c1c

sb added 1 commit

2026-09-29 18:23:38 +10:00

Bump to v1.111.2 — Logo fills its circle on the sign-in screens 6a9cafc918

sb commented

2026-09-29 20:30:06 +10:00

Author

Owner

Add to settings

Optional sign-in photo — the brand panel can show a photo behind the name with a dark fade for legibility; add src/app/login-hero.jpg and switch it on in src/components/auth/hero.ts (see the TODO there). Until then the panel is plain burgundy

Add to settings - **Optional sign-in photo** — the brand panel can show a photo behind the name with a dark fade for legibility; add `src/app/login-hero.jpg` and switch it on in `src/components/auth/hero.ts` (see the TODO there). Until then the panel is plain burgundy

sb added 1 commit

2026-09-30 05:46:30 +10:00

Bump to v1.112.0 — Branded schedule b99e6dbaed

sb added 1 commit

2026-09-30 05:48:47 +10:00

Bump to v1.112.1 — Space above page headings on desktop db00c57a05

sb added 1 commit

2026-09-30 05:55:33 +10:00

Bump to v1.112.2 — Simpler schedule header 0463d29642

sb added 1 commit

2026-09-30 07:28:42 +10:00

Bump to v1.113.0 — Branded print schedule d2205ddda0

Rebuild /schedule/print to match the admin branding: black-on-white pages (no filled colour bars or chips), a burgundy letterhead, plain-text chauffeur status, and content-sized table columns. Adds a toolbar with quick date-range pills and show/hide toggles for payment status and notes. Data, queries and URL params are unchanged.

sb added 1 commit

2026-09-30 07:35:25 +10:00

Bump to v1.113.1 — Print button goes straight to the print page 5f7f04e046

The schedule page's Print button opened a popover asking for a date range, then landed on the print page, which now has its own full date-range and options toolbar. Skip the popover and open the print page directly.

sb added 1 commit

2026-09-30 07:42:30 +10:00

Bump to v1.113.2 — Fix overlapping header/footer on the printed schedule a3ccef59f4

The fixed-position running header and footer overlapped the letterhead and a stranded date heading in print preview. Replaced with a simpler, reliable layout: the letterhead once at the top, the printed-at line once at the end, and break-after: avoid on date headings so one can't be orphaned at the bottom of a page.

sb added 1 commit

2026-09-30 07:45:52 +10:00

Bump to v1.113.3 — Add a Today quick-range to the print schedule c35b7b6682

The date-range pills had This week/Next 7 days/{Month}/Next 30 days but nothing for just today.

sb added 1 commit

2026-09-30 07:50:51 +10:00

Bump to v1.113.4 — Print schedule's Next 7 days starts tomorrow e8af1cee1a

Previously ran today through 6 days out; now runs tomorrow through 7 days out, since Today is its own separate quick-range option.

sb added 1 commit

2026-09-30 07:56:04 +10:00

Bump to v1.113.5 — Print schedule forces a white background 6f2fc3c6a4

The app's <body> carries an ivory background for the on-screen admin shell, which showed through below the printed content and wasted ink on the empty remainder of the page.

sb commented

2026-09-30 10:16:18 +10:00

Author

Owner

need to remove type col from payment received as can't see full receipt no and date.

![image](/attachments/be789d71-f978-48dd-be58-1e0f99583816) need to remove type col from payment received as can't see full receipt no and date.

image.png

29 KiB

sb added 1 commit

2026-09-30 10:44:32 +10:00

Bump to v1.113.6 — Remove SharePoint/OneDrive fallback on missing booking sheets cd6b9e8c35

When a client or chauffeur booking sheet PDF wasn't found locally, both /api/booking-sheet and the chauffeur portal's booking-sheet route silently redirected to a hardcoded SharePoint URL. Both now just return a plain "not found" response instead.

sb added 2 commits

2026-09-30 11:13:43 +10:00

Bump to v1.113.7 — Payments Received drops its Type column bc36e5f07d

Receipt No and Date were getting truncated on the booking form's payment list. The Type column was redundant anyway (a refund already shows in red with a leading "-"), so it's gone, freeing the space.

Bump to v1.113.8 — Sign-in photo, uploaded from Settings cde2cf0c85

Settings → Company Info gets a "Sign-in photo" upload, replacing the old approach of manually adding src/app/login-hero.jpg and editing code. Served through a new dedicated public route (/api/login-hero), since the existing settings-photo route requires an admin session and this needs to load before anyone's signed in — Next 16's src/proxy.ts (renamed from middleware.ts) redirects any unauthenticated request otherwise.

sb added 1 commit

2026-09-30 11:28:09 +10:00

Bump to v1.113.9 — Logo and favicon, uploaded from Settings 6d1ea01350

Settings → Company Info's Branding section adds Logo and Favicon uploads alongside the sign-in photo. Each falls back to its bundled default when nothing's uploaded, served through two new public routes (/api/site-logo, /api/site-favicon) since they need to load before anyone's signed in. The favicon now uses metadata.icons in the root layout instead of the static favicon.ico convention, so it can be swapped dynamically; the default file moved to public/default-favicon.ico as the fallback asset.

sb commented

2026-09-30 11:36:17 +10:00

Author

Owner

cant see receipt no. make date smaller

![image](/attachments/246f288a-5e43-47c2-a4dc-721a6b927ac8) cant see receipt no. make date smaller

image.png

34 KiB

sb added 1 commit

2026-09-30 11:49:24 +10:00

Bump to v1.113.10 — Payments Received table columns squeeze the Receipt No field 9a54a7beed

Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>

sb added 1 commit

2026-09-30 16:23:43 +10:00

Bump to v1.114.0 — Branded settings pages 74849bfb19

Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>

sb added 1 commit

2026-09-30 16:58:09 +10:00

Bump to v1.115.0 — Branded booking page e1aa853ea7

sb added 1 commit

2026-09-30 16:59:06 +10:00

Bump to v1.115.1 — Rich-text editor loads for limited admins fbac79dd5d

sb added 1 commit

2026-09-30 17:10:29 +10:00

Bump to v1.115.2 — Client link panel back to its earlier layout f52f82227f

sb added 1 commit

2026-09-30 17:46:21 +10:00

Bump to v1.116.0 — Office app and chauffeur portal are separate sites with separate logins 659e973623

sb changed title from ~~Client booking portal (v1.95.0 to v1.95.17)~~ to Client booking portal and separate chauffeur portal (v1.95.0 to v1.116.0)

2026-09-30 17:50:12 +10:00

sb added 1 commit

2026-09-30 18:10:41 +10:00

Bump to v1.116.1 — Cloudflare tunnel setup in the deployment guide edaf007b05

sb added 1 commit

2026-09-30 18:14:48 +10:00

Bump to v1.116.2 — Sign in screens say which site they are b0923a1573

sb added 1 commit

2026-09-30 19:20:18 +10:00

Bump to v1.116.3 — No link to the other site on the sign in screens 8b79f41397

sb added 1 commit

2026-09-30 19:24:18 +10:00

Bump to v1.116.4 — Sign in screens without the line under the heading 0aceab3b1e

sb added 1 commit

2026-09-30 19:27:53 +10:00

Bump to v1.116.5 — Failed sign in message back to one line 26ec8b0bb0

sb added 1 commit

2026-09-30 19:38:34 +10:00

Bump to v1.116.6 — Chauffeurs with a working login no longer shown as Invite expired 3165da12f7

sb added 1 commit

2026-10-01 05:50:17 +10:00

Bump to v1.116.7 — Chauffeur portal sidebar styled like the admin sidebar 8a7e4ad667

sb added 1 commit

2026-10-01 05:54:50 +10:00

Bump to v1.116.8 — Sign-in photo shows again 0535227249

sb changed title from ~~Client booking portal and separate chauffeur portal (v1.95.0 to v1.116.0)~~ to Client booking portal and separate chauffeur portal (v1.95.0 to v1.116.8)

2026-10-01 05:57:55 +10:00

sb added 1 commit

2026-10-01 06:08:40 +10:00

Bump to v1.117.0 — Sessions end on password change, chauffeur links and Activity roles fixed 62968a3df7

sb changed title from ~~Client booking portal and separate chauffeur portal (v1.95.0 to v1.116.8)~~ to Client booking portal and separate chauffeur portal (v1.95.0 to v1.117.0)

2026-10-01 06:16:35 +10:00

sb added 1 commit

2026-10-01 19:12:20 +10:00

Bump to v1.118.0 — Job change emails show what changed abe28ba9e9

sb added 1 commit

2026-10-01 19:32:02 +10:00

Bump to v1.119.0 — Choose a car shows rego and CPV registration aa9774c949

sb added 1 commit

2026-10-01 19:39:03 +10:00

Bump to v1.119.1 — Choose a car shows when the CPV register was checked f3f75baf87

sb added 1 commit

2026-10-01 19:42:00 +10:00

Bump to v1.119.2 — Choose a car shows three cars to a row 0e3f81caa8

sb added 1 commit

2026-10-03 07:08:13 +10:00

Bump to v1.119.3 — Schedule columns fit their text and line up across dates 8fb5e91191

sb added 1 commit

2026-10-03 07:13:50 +10:00

Bump to v1.119.4 — Activity Log shows who the client link was sent to 3a86052523

sb commented

2026-10-03 12:03:28 +10:00

Author

Owner

can't sel any from dropdown

![image](/attachments/5f2eb681-394a-48a6-b0a9-59faaa3c0137) can't sel any from dropdown

image.png

45 KiB

sb added 1 commit

2026-10-04 07:35:34 +11:00

Bump to v1.119.5 — Stops on Edit Booking save what you pick f2da0cc975

sb changed title from ~~Client booking portal and separate chauffeur portal (v1.95.0 to v1.117.0)~~ to Client booking portal and separate chauffeur portal (v1.95.0 to v1.119.5)

2026-10-04 07:35:55 +11:00

sb added 1 commit

2026-10-04 07:53:22 +11:00

Bump to v1.119.6 — Generated PDFs show on Edit Booking straight away 4524c3102a

sb changed title from ~~Client booking portal and separate chauffeur portal (v1.95.0 to v1.119.5)~~ to Client booking portal and separate chauffeur portal (v1.95.0 to v1.119.6)

2026-10-04 07:53:27 +11:00

sb changed title from ~~Client booking portal and separate chauffeur portal (v1.95.0 to v1.119.6)~~ to Client booking portal and separate chauffeur portal (v1.95.0 to v1.119.7)

2026-10-04 07:55:06 +11:00

sb added 1 commit

2026-10-04 07:55:07 +11:00

Bump to v1.119.7 — Adding a booking stays on it 1f85aebe0f

sb added 1 commit

2026-10-04 08:10:14 +11:00

Bump to v1.120.0 — Clients can change cars and hours on a Hold booking e59015ae66

sb changed title from ~~Client booking portal and separate chauffeur portal (v1.95.0 to v1.119.7)~~ to Client booking portal and separate chauffeur portal (v1.95.0 to v1.120.0)

2026-10-04 08:10:23 +11:00

sb commented

2026-10-04 08:44:47 +11:00

Author

Owner

Needs fixing

Your local dev database was two migrations behind. 20260930120000_user_email_unique_per_role and 20261001090000_add_audit_log_user_role hadn't been applied, which broke prisma/create-user.ts. I applied them with prisma migrate deploy. Your memory notes say production uses db push, so check production has the User(email, role) unique index and the AuditLog.userRole column.
Non-numeric IDs crash with a 500 instead of a 404. Number("abc") gives NaN, which goes straight into Prisma:
- Pages: /bookings/abc, /cars/abc, /chauffeurs/abc
- API routes: /api/bookings/abc, /api/cars/abc, /api/chauffeurs/abc, /api/bookings/abc/chauffeur-sheet, /api/bookings/1/attachments/abc
The chauffeur portal pages already guard against this with Number(x) || 0, so the fix is to do the same here.
A bad ?month= crashes the schedule with a 500. /schedule?month=garbage produces an Invalid Date that reaches Prisma (src/app/schedule/page.tsx:93-98).
"Contact on the day" is marked required in the client portal but isn't enforced. The Details step says "All optional except the contact", but you can go on and submit with it blank (clientportal/components/steps/StepDetails.tsx). The server schema treats it as optional too.

UX and polish

Raw validation message on the car field. Submitting without a car shows "Invalid input: expected number, received NaN" instead of something like "Select a car".
Booking form errors come in two rounds. The required Email and Phone errors only appear after the first errors are fixed, because the schema's superRefine only runs once the basic checks pass.
Leftover blue buttons in the chauffeur portal. Save Profile and Change Password use bg-blue-600 (ProfileDetailsForm.tsx:182, PasswordCard.tsx:67), and MonthFilter.tsx has blue hovers.
The chauffeur job page is stale after Accept. The "New offer" badge, "This job is offered to you" and the My Jobs "1" count stay until you reload.
"Accepted · office notified" shows even when the email fails. The send is fire-and-forget. The client portal's "Sent to …" message has the same issue.
The chauffeur job page shows an empty ROUTE box when no route is set.
The Chauffeur dropdown on the booking card is about half the width of the Car dropdown.
The section tabs highlight "Contacts" while you're looking at the Cars section.
The schedule's Print button always opens the next 30 days, not the month you're viewing.
The client portal's "Review your changes" doesn't show the change. Contact details aren't in the summary.

Worth confirming

The office's internal Notes field appears to chauffeurs as "From the office", but the booking form says it "Shows on the schedule and the printout." Is that intended?

Working correctly

Booking create, edit, payments, balance, audit diffs, PDFs, schedule, search and print.
Send offer: it fails cleanly without SMTP and leaves the data unchanged.
Chauffeur: sign-in, accept flow, and access to other chauffeurs' jobs is correctly blocked.
Client portal: booking flow, signature, edit link, and bad-link handling.
Reports, Activity, Settings, and the mobile layouts.

Needs fixing 1. Your local dev database was two migrations behind. 20260930120000_user_email_unique_per_role and 20261001090000_add_audit_log_user_role hadn't been applied, which broke prisma/create-user.ts. I applied them with prisma migrate deploy. Your memory notes say production uses db push, so check production has the User(email, role) unique index and the AuditLog.userRole column. 2. Non-numeric IDs crash with a 500 instead of a 404. Number("abc") gives NaN, which goes straight into Prisma: - Pages: /bookings/abc, /cars/abc, /chauffeurs/abc - API routes: /api/bookings/abc, /api/cars/abc, /api/chauffeurs/abc, /api/bookings/abc/chauffeur-sheet, /api/bookings/1/attachments/abc The chauffeur portal pages already guard against this with Number(x) || 0, so the fix is to do the same here. 3. A bad ?month= crashes the schedule with a 500. /schedule?month=garbage produces an Invalid Date that reaches Prisma (src/app/schedule/page.tsx:93-98). 4. "Contact on the day" is marked required in the client portal but isn't enforced. The Details step says "All optional except the contact", but you can go on and submit with it blank (clientportal/components/steps/StepDetails.tsx). The server schema treats it as optional too. UX and polish 5. Raw validation message on the car field. Submitting without a car shows "Invalid input: expected number, received NaN" instead of something like "Select a car". 6. Booking form errors come in two rounds. The required Email and Phone errors only appear after the first errors are fixed, because the schema's superRefine only runs once the basic checks pass. 7. Leftover blue buttons in the chauffeur portal. Save Profile and Change Password use bg-blue-600 (ProfileDetailsForm.tsx:182, PasswordCard.tsx:67), and MonthFilter.tsx has blue hovers. 8. The chauffeur job page is stale after Accept. The "New offer" badge, "This job is offered to you" and the My Jobs "1" count stay until you reload. 9. "Accepted · office notified" shows even when the email fails. The send is fire-and-forget. The client portal's "Sent to …" message has the same issue. 10. The chauffeur job page shows an empty ROUTE box when no route is set. 11. The Chauffeur dropdown on the booking card is about half the width of the Car dropdown. 12. The section tabs highlight "Contacts" while you're looking at the Cars section. 13. The schedule's Print button always opens the next 30 days, not the month you're viewing. 14. The client portal's "Review your changes" doesn't show the change. Contact details aren't in the summary. Worth confirming - The office's internal Notes field appears to chauffeurs as "From the office", but the booking form says it "Shows on the schedule and the printout." Is that intended? Working correctly - Booking create, edit, payments, balance, audit diffs, PDFs, schedule, search and print. - Send offer: it fails cleanly without SMTP and leaves the data unchanged. - Chauffeur: sign-in, accept flow, and access to other chauffeurs' jobs is correctly blocked. - Client portal: booking flow, signature, edit link, and bad-link handling. - Reports, Activity, Settings, and the mobile layouts.

sb added 3 commits

2026-10-04 09:03:09 +11:00

Bump to v1.120.1 — Bad links give a 404, portal requires contact on the day c497f7946a

Bump to v1.120.2 — Booking form errors in one go, print the viewed month, portal polish 450543f27e

Bump to v1.120.3 — Notes hint says chauffeurs see it 19c94cbf52

sb changed title from ~~Client booking portal and separate chauffeur portal (v1.95.0 to v1.120.0)~~ to Client booking portal and separate chauffeur portal (v1.95.0 to v1.120.3)

2026-10-04 09:03:24 +11:00

sb added 1 commit

2026-10-04 12:13:57 +11:00

Bump to v1.120.4 — User manual with screenshots 963e31d9a4

sb changed title from ~~Client booking portal and separate chauffeur portal (v1.95.0 to v1.120.3)~~ to Client booking portal and separate chauffeur portal (v1.95.0 to v1.120.4)

2026-10-04 12:14:09 +11:00

sb added 1 commit

2026-10-04 17:00:26 +11:00

Bump to v1.120.5 — User manual screenshots show the real fleet 2bf7aad665

sb changed title from ~~Client booking portal and separate chauffeur portal (v1.95.0 to v1.120.4)~~ to Client booking portal and separate chauffeur portal (v1.95.0 to v1.120.5)

2026-10-04 17:00:36 +11:00

sb changed title from ~~Client booking portal and separate chauffeur portal (v1.95.0 to v1.120.5)~~ to Client booking portal and separate chauffeur portal (v1.95.0 to v1.120.6)

2026-10-04 17:03:25 +11:00

sb added 1 commit

2026-10-04 17:03:25 +11:00

Bump to v1.120.6 — User manual: send the client link after adding a booking 231cf5037b

sb added 1 commit

2026-10-04 18:26:40 +11:00

Bump to v1.121.0 — User manual in each app 70e4459a3d

sb changed title from ~~Client booking portal and separate chauffeur portal (v1.95.0 to v1.120.6)~~ to Client booking portal and separate chauffeur portal (v1.95.0 to v1.121.0)

2026-10-04 18:26:55 +11:00

sb changed title from ~~Client booking portal and separate chauffeur portal (v1.95.0 to v1.121.0)~~ to Client booking portal and separate chauffeur portal (v1.95.0 to v1.121.1)

2026-10-04 18:44:26 +11:00

sb added 1 commit

2026-10-04 18:44:26 +11:00

Bump to v1.121.1 — Client portal: contact on the day is optional a7de64d077

sb changed title from ~~Client booking portal and separate chauffeur portal (v1.95.0 to v1.121.1)~~ to Client booking portal and separate chauffeur portal (v1.95.0 to v1.121.2)

2026-10-04 20:02:54 +11:00

sb added 1 commit

2026-10-04 20:02:54 +11:00

Bump to v1.121.2 — Chauffeur guide shows the emails chauffeurs get 4c63b41df1

sb added 1 commit

2026-10-04 20:15:58 +11:00

Bump to v1.121.3 — Portal access email links to the chauffeur guide 46736e27bf

sb changed title from ~~Client booking portal and separate chauffeur portal (v1.95.0 to v1.121.2)~~ to Client booking portal and separate chauffeur portal (v1.95.0 to v1.121.3)

2026-10-04 20:15:58 +11:00

sb changed title from ~~Client booking portal and separate chauffeur portal (v1.95.0 to v1.121.3)~~ to Client booking portal and separate chauffeur portal (v1.95.0 to v1.121.4)

2026-10-04 20:23:39 +11:00

sb added 1 commit

2026-10-04 20:23:41 +11:00

Bump to v1.121.4 — Office guide shows the emails the system sends b14e9d1c91

sb changed title from ~~Client booking portal and separate chauffeur portal (v1.95.0 to v1.121.4)~~ to Client booking portal and separate chauffeur portal (v1.95.0 to v1.121.5)

2026-10-04 20:28:34 +11:00

sb added 1 commit

2026-10-04 20:28:34 +11:00

Bump to v1.121.5 — Client guide shows the emails clients get 190f9cee33

sb changed title from ~~Client booking portal and separate chauffeur portal (v1.95.0 to v1.121.5)~~ to Client booking portal and separate chauffeur portal (v1.95.0 to v1.122.0)

2026-10-04 20:38:33 +11:00

sb added 1 commit

2026-10-04 20:38:34 +11:00

Bump to v1.122.0 — Send offer on Edit Booking 6765a496ff

sb changed title from ~~Client booking portal and separate chauffeur portal (v1.95.0 to v1.122.0)~~ to Client booking portal and separate chauffeur portal (v1.95.0 to v1.122.1)

2026-10-05 06:25:26 +11:00

sb added 1 commit

2026-10-05 06:25:26 +11:00

Bump to v1.122.1 — User manual shows the Send offer button on Edit Booking 95bd97d458

sb changed title from ~~Client booking portal and separate chauffeur portal (v1.95.0 to v1.122.1)~~ to Client booking portal and separate chauffeur portal (v1.95.0 to v1.122.2)

2026-10-05 06:28:24 +11:00

sb added 1 commit

2026-10-05 06:28:25 +11:00

Bump to v1.122.2 — No colour boxes on the schedule 632faeeed2

sb added 1 commit

2026-10-05 11:54:39 +11:00

Bump to v1.122.3 — Special instructions are cleaned before the office sees them 0ad883c50e

sb added 1 commit

2026-10-05 12:04:36 +11:00

Bump to v1.122.4 — Dependency security updates 8f27055079

sb added 1 commit

2026-10-05 12:22:14 +11:00

Bump to v1.123.0 — Browser security headers 1327655361

sb added 1 commit

2026-10-05 12:28:57 +11:00

Bump to v1.124.0 — Sign-in limits ac0b4de55f

sb added 1 commit

2026-10-05 12:34:18 +11:00

Bump to v1.124.1 — Tracking links only for the job's day bea36ac3f8

sb added 1 commit

2026-10-05 12:49:28 +11:00

Bump to v1.124.2 — Permission changes apply straight away 7377be9108

sb added 1 commit

2026-10-05 12:56:52 +11:00

Bump to v1.124.3 — Signature links can't reach the server's network effe0e7736

sb added 1 commit

2026-10-05 13:07:52 +11:00

Bump to v1.124.4 — Overtime only on the day, and only once 76b784b349

sb added 1 commit

2026-10-05 13:18:39 +11:00

Bump to v1.124.5 — Customer details and secrets kept out of logs e1bba4aec1

sb added 1 commit

2026-10-05 13:30:38 +11:00

Bump to v1.124.6 — Other sites can't make changes through a staff browser d1a87cbdf4

sb added 1 commit

2026-10-05 14:02:56 +11:00

Bump to v1.124.7 — Docker runs as an unprivileged user on local ports 776423c8e1

sb added 1 commit

2026-10-05 14:13:42 +11:00

Bump to v1.124.8 — Job photo uploads take photos only d7631d68aa

sb added 1 commit

2026-10-05 14:37:21 +11:00

Bump to v1.124.9 — Sign-in timing doesn't reveal accounts 391615b92c

sb added 1 commit

2026-10-05 14:57:21 +11:00

Bump to v1.124.10 — Client links expire on the day, and smaller hardening 88dbf57911

sb added 1 commit

2026-10-05 17:15:01 +11:00

Bump to v1.124.11 — User manual screenshots retaken bdcbcf935f

sb changed title from ~~Client booking portal and separate chauffeur portal (v1.95.0 to v1.122.2)~~ to Client booking portal and separate chauffeur portal (v1.95.0 to v1.124.11)

2026-10-05 17:15:32 +11:00

sb added 1 commit

2026-10-05 17:53:24 +11:00

Bump to v1.124.12 — "Booking folder" instead of OneDrive 99579123ec

sb changed title from ~~Client booking portal and separate chauffeur portal (v1.95.0 to v1.124.11)~~ to Client booking portal and separate chauffeur portal (v1.95.0 to v1.124.12)

2026-10-05 17:53:36 +11:00

sb changed title from ~~Client booking portal and separate chauffeur portal (v1.95.0 to v1.124.12)~~ to Client booking portal and separate chauffeur portal (v1.95.0 to v1.124.13)

2026-10-05 18:08:35 +11:00

sb added 1 commit

2026-10-05 18:08:36 +11:00

Bump to v1.124.13 — Client confirmation shows the deposit, not the total e8388887ad

sb added 1 commit

2026-10-05 18:25:27 +11:00

Bump to v1.124.14 — Chauffeur guide: photos, car locations and the home screen 24b57b78b1

sb changed title from ~~Client booking portal and separate chauffeur portal (v1.95.0 to v1.124.13)~~ to Client booking portal and separate chauffeur portal (v1.95.0 to v1.124.14)

2026-10-05 18:25:27 +11:00

sb changed title from ~~Client booking portal and separate chauffeur portal (v1.95.0 to v1.124.14)~~ to Client booking portal and separate chauffeur portal (v1.95.0 to v1.124.15)

2026-10-05 18:29:00 +11:00

sb added 1 commit

2026-10-05 18:29:01 +11:00

Bump to v1.124.15 — Overtime button stays put when the photos list opens fdd6c15509

sb changed title from ~~Client booking portal and separate chauffeur portal (v1.95.0 to v1.124.15)~~ to Client booking portal and separate chauffeur portal (v1.95.0 to v1.124.16)

2026-10-05 18:38:57 +11:00

sb added 1 commit

2026-10-05 18:38:58 +11:00

Bump to v1.124.16 — Car location button only shows when the map can be made b47e2259a5

sb added 1 commit

2026-10-06 18:30:56 +11:00

Bump to v1.124.17 — Passwords never go in the address bar, and adding a booking makes its PDFs 5799dbaba6

sb changed title from ~~Client booking portal and separate chauffeur portal (v1.95.0 to v1.124.16)~~ to Client booking portal and separate chauffeur portal (v1.95.0 to v1.124.17)

2026-10-06 18:30:56 +11:00

sb added 1 commit

2026-10-06 18:47:56 +11:00

Bump to v1.124.18 — Smaller production build, help served in production, login redirect, deposit on held booking thank you b5e127e138

sb added 2 commits

2026-10-07 08:07:34 +11:00

Bump to v1.124.19 — Security fixes from the audit bf4a4113ee

Bump to v1.124.20 — Example env files, and docs match the security fixes aa0caac7af

sb added 2 commits

2026-10-07 14:17:26 +11:00

Bump to v1.124.21 — Guide to updating from v1.93.2 d915dd49dc

Bump to v1.124.22 — Example settings don't name OneDrive 0744b9aa4c

sb changed title from ~~Client booking portal and separate chauffeur portal (v1.95.0 to v1.124.17)~~ to Client booking portal, separate chauffeur portal and security fixes (v1.95.0 to v1.124.22)

2026-10-07 14:19:26 +11:00

sb added 1 commit

2026-10-09 06:30:53 +11:00

Bump to v1.124.23 — Dates typed as digits, Received on the thank you page, pay Done once a job finishes 28cb2cafdb

sb added 1 commit

2026-10-09 06:39:33 +11:00

Bump to v1.125.0 — Chauffeurs can upload videos from a job 80e5c5ed32

sb added 1 commit

2026-10-09 17:11:24 +11:00

Bump to v1.125.1 — Offer links keep their thank you and stand on their own, booking top row fits at 1280 px f657130a9d

sb added 1 commit

2026-10-09 17:14:13 +11:00

Bump to v1.125.2 — Client emails removed from chauffeur portal jobs be2f967c4f

sb added 1 commit

2026-10-09 17:25:29 +11:00

Bump to v1.126.0 — Office signatures linked to admin accounts and added at the deposit eb13acb6c6

sb added 1 commit

2026-10-09 19:39:16 +11:00

Bump to v1.126.1 — New payment amounts start blank 469e50876a

sb changed title from ~~Client booking portal, separate chauffeur portal and security fixes (v1.95.0 to v1.124.22)~~ to Client booking portal, separate chauffeur portal and security fixes (v1.95.0 to v1.126.1)

2026-10-09 19:44:55 +11:00

sb merged commit c2da0fd3af into main

2026-10-09 19:44:56 +11:00

sb referenced this pull request from a commit

2026-10-09 19:44:58 +11:00

Merge pull request 'Client booking portal, separate chauffeur portal and security fixes (v1.95.0 to v1.126.1)' (#8) from ClientBookingForm into main

Rows
Columns

Client booking portal, separate chauffeur portal and security fixes (v1.95.0 to v1.126.1) #8

Summary

Office app and chauffeur portal split (v1.116.0)

Follow ups (v1.116.1 to v1.116.8)

Security and chauffeur fixes (v1.117.0)

Chauffeur emails, portal fleet, schedule and fixes (v1.118.0 to v1.120.0)

Test pass fixes, user manual and Send offer on Edit Booking (v1.120.1 to v1.122.2)

Security hardening (v1.123.0 to v1.124.10)

User manual screenshots retaken, and "booking folder" wording, client confirmation, chauffeur guide additions, test pass fixes (v1.124.11 to v1.124.18)

Security audit fixes, setup docs and the v1.93.2 update guide (v1.124.19 to v1.124.22)

Test pass fixes (v1.124.23)

Job videos (v1.125.0)

Test pass fixes (v1.125.1)

Chauffeur portal privacy (v1.125.2)

Office signatures per admin (v1.126.0)

Test pass fix (v1.126.1)

Main system

Client portal (clientportal/)

Deployment

Testing

Before go-live

Client portal (`clientportal/`)