10 Commits

Author	SHA1	Message	Date
Marijn	0ee15e3cbb	feat: add GDPR data export (download data) button (#198) ... * feat: add GDPR data export (download data) button Wires up the previously disabled "Download data" button on the settings page. Downloads a zip with a profile.xlsx (account + owned seasons), and per owned season a folder with each quiz's xlsx (questions, results, eliminations tabs) and a candidates.xlsx (candidates + season info tabs). Soft-deleted rows are included and flagged so the export reflects everything the app still holds about the user. * feat: include question bank in GDPR data export Adds a question-bank.xlsx per season folder with Questions (bank questions, answers, reusable/complete flags, labels, and which quizzes they've been used in) and Labels tabs, since BankQuestion/BankAnswer content was previously missing from the export. * fix: hard-delete quiz/audit-log data when deleting an account QuizCandidate, GivenAnswer, and Elimination are Gedmo\SoftDeleteable, so cascading their removal through Season -> Quiz/Candidate only set deletedAt instead of physically deleting the row. Since Candidate and Answer are hard-deleted via orphanRemoval, this broke their foreign keys and rolled back the entire account deletion whenever a candidate had actually participated in a quiz. Bulk DQL deletes now purge these rows before the cascade runs. Also purge BankQuestion audit-log rows (ext_log_entries), which store the editor's username/email but aren't foreign-keyed to the entity they log, so they were never cleaned up and would otherwise keep a deleted user's email around indefinitely. * style: make the download data button primary (blue) * feat: add raw answers crosstab to quiz export Adds a "Raw answers" tab to each quiz xlsx: one row per candidate, one column per question, with the given answer text in each cell — the raw data behind the aggregated Results tab. * i18n: translate new settings page string to Dutch * refactor: sanitize filenames with Symfony's AsciiSlugger instead of a hand-rolled regex Extracts a shared Tvdt\Helpers\FilenameSanitizer (backed by symfony/string's AsciiSlugger) and uses it everywhere user-controlled text (season/quiz names, account email) ends up in a zip entry path or a downloaded filename. AsciiSlugger is allowlist-based (only A-Z/0-9 survive; everything else, including unicode and path-traversal sequences, is folded or stripped) rather than a denylist of "unsafe" characters, and it's an officially maintained Symfony component already present as a transitive dependency. Also fixes BackofficeController::exportQuiz(), a pre-existing endpoint that built its Content-Disposition filename directly from an unsanitized quiz name — the same class of risk the data export already guarded against. Naming note: sanitized names are now slugs (spaces become dashes, unicode is ASCII-transliterated), e.g. "Krtek Weekend" -> "Krtek-Weekend". * fix: check ZipArchive open/close results and clean up temp files on failure Addresses CodeRabbit findings on the GDPR export: - ZipArchive::open() and close() can both return false without throwing; neither was checked, so a failure silently produced an empty or corrupt zip, and the temp zip path was never cleaned up on a mid-build exception. - writeToTempFile() leaked its tempnam()'d file if Writer\Xlsx::save() threw before the caller could track it for cleanup. * fix: drop public link identifier from the candidates export sheet The nameHash is a public quiz-access token, not something a data export should hand out — remove it from candidates.xlsx. * feat: add Quiz info tab covering dropouts, finalization, and disabled questions An entity-by-entity audit of the export vs. delete flows found the delete flow fully covered, but three Quiz/Question fields missing from the export: dropouts, finalizedAt, and Question.enabled. Adds a new "Quiz info" tab (first sheet) to each quiz's xlsx with this data, without touching the shared fillQuestionsSheet() used by the existing single-quiz template export/import feature. Deliberately left out per user decision: the BankQuestion audit log (would leak other owners' emails, consistent with hiding co-owner identities elsewhere in this export) and a few low-value timestamp fields already covered by existing Started/time-taken columns. * feat: require a confirmed email before exporting data Antispam measure: both the full data export (SettingsController::downloadData) and the single-quiz export (BackofficeController::exportQuiz) now redirect with a flash warning instead of exporting when the account's email isn't verified yet. Adds a matching hint on the settings page next to the download button.	2026-07-09 20:28:10 +00:00
Marijn	1d3e99d2b2	feat: user settings page (#191) ... * feat: user settings page (#182) - Settings link in the backoffice nav next to Logout - Language selector (Dutch only, noop save) - Change password form with current-password check - Change email form that re-triggers email confirmation - Resend confirmation email button for unconfirmed addresses - Disabled Download data button with Soon(tm) popover - Delete account with password confirmation modal, removes seasons the user is the sole owner of - Well-known URLs: change-password redirect and security.txt * feat: base security.txt Expires on the container build time The BUILD_TIME build arg is baked into the prod image as an env var and set by CI at image build. security.txt expires one year after the build, so the file goes stale when deployments stop. Dev and test fall back to one year from the request time. * refactor: extract shared controller functionality - AbstractController: authenticatedUser property hook and assertSameSeason() (moved from QuestionBankController) - EmailVerifier::sendDefaultConfirmation() replaces the duplicated confirmation email block in RegistrationController and SettingsController - QuizController: deduplicate candidate-data preparation into buildCandidateData() - Drop manual 422 status handling in QuizQuestionController, QuestionBankController and SettingsController: render() already returns 422 for submitted invalid forms passed as parameters * fix: address PR review comments - Catch UniqueConstraintViolationException when changing email to handle the race between the uniqueness check and the flush - Avoid else-only block in UserRepository::deleteUser - Align duplicate-email translation with the validators domain * fix: apply code-review findings for PR #191 - Invalidate outstanding ResetPasswordRequests after password or email change to close the account-takeover window (tokens otherwise remain valid) - Exclude the current user from email uniqueness check so submitting your own address no longer returns an error - Surface transport failures from sendDefaultConfirmation via a warning flash instead of silently showing success - Move Dockerfile ARG BUILD_TIME/ENV to after all build steps so changing the build timestamp no longer busts the composer/asset cache - Throw in prod when BUILD_TIME is missing (WellKnownController) so the security.txt Expires goes stale as intended when deployments stop; fall back to 'now' only in dev/test	2026-07-08 14:38:32 +02:00
Marijn	47077288d5	Quiz page: individual question rework (#181) (#183) ... * feat: quiz page question rework (#181) - Replace Bootstrap accordion with flat card list for questions - Add HTML5 drag-and-drop reordering with placeholder-between-cards UX and amber/green/red save status indicator next to the heading - Add edit button per question opening a Bootstrap modal (bo--modal-form Stimulus controller with X-Modal-Request header pattern) - Show read-only view button instead of edit for locked/finalized quizzes - Add BankQuestion edit modal in question bank tab using same infrastructure - Move modal action buttons into modal-footer via <template data-modal-footer> - Fix IS_AUTHENTICATED_FULLY 403: replace ROLE_USER with IS_AUTHENTICATED on all backoffice controllers and in security.yaml access_control * feat: answer field UX improvements - Auto-add one empty answer field when opening a blank question form - Auto-append new empty field when typing in the last answer field - Strip empty answer rows before submit (novalidate + JS cleanup) - Tab key skips correct/delete buttons, jumping straight to next answer * feat: add bank question via modal + dirty modal guard - Add question in question bank now opens a modal instead of navigating to a full-page form, consistent with the edit modal pattern - Modal closes are blocked by static backdrop once the user has made any change (input, checkbox, drag-reorder, sort, randomize, remove answer) - Dirty state resets when the modal is fully hidden * fix: modal save button + missing translations - Replace form="id" cross-element approach with requestSubmit() for reliable save button wiring in modal footer - Re-call _bindDirty after validation-error re-render so dirty guard is preserved across save attempts - Translate missing Dutch strings: Order saved, Error saving order, Question details, View * feat: replace fetch-based modal forms with Turbo Frames (#181) Enable @hotwired/turbo with Drive explicitly disabled, then migrate the bo--modal-form Stimulus controller (custom fetch + X-Modal-Request pattern) to a thin bo--modal controller that lets Turbo handle HTTP and DOM swap. Adds frame templates for quiz questions and bank questions; controllers now detect Turbo-Frame header instead of X-Modal-Request. * fix: exclude auto-generated reference.php from pre-commit CS-fixer * fix: use correct Turbo v8 session export to disable Drive * fix: address CodeRabbit review findings on PR #183 - Add SeasonVoter::EDIT guard to QuizQuestionController::view() - Add full-count check in reorder() to reject partial ordering payloads - Retry once in _persistOrder(); lock drag and show dismissible alert on failure - Remove tabindex="-1" from correct-answer toggle button (accessibility) - Replace 'EMPTY'|trans placeholder with proper copy - Add data-modal-title to question bank Edit button to prevent stale title * fix: correct Dutch translations flagged in review - 'Error saving order': 'Fout bij het opslaan van de volgorde' (consistent with sibling strings) - 'Owner(s)': 'Eigenaar/Eigenaren' (unambiguous, correct Dutch plural) * fix: set explicit form action URLs for Turbo Frame modal forms When a form has no explicit action, Symfony renders action="" which the browser resolves to the page URL, not the URL the Turbo Frame was fetched from. This caused edits submitted via the modal to POST to the wrong route and silently discard changes. * fix: preserve answer ordering on save and add coverage for all sort operations - Enable Turbo Drive and use visit() in modal controller so submit redirects to the page under the modal - Add removeAnswer() to Question entity so Symfony form can manage the collection with PHP 8.5 private(set) - Remove applyAnswerOrdering() from QuizQuestionController and QuestionBankController — it iterated the Doctrine collection in its old DB order and overwrote the ordering values submitted from the form - Add QuizQuestionControllerTest covering answer ordering preservation and question reordering within a quiz - Extend QuestionBankControllerTest with answer ordering tests for both new and edit bank questions * fix: translate three missing Dutch strings in nl.xliff * Updated CLAUDE.md * refactor: replace addEventListener with Stimulus data-action in modal and question-list controllers * refactor: replace addEventListener with Stimulus data-action in form-collection controller Move drag-and-drop and auto-expand event handling from imperative addEventListener calls to declarative data-action descriptors in answer_row.html.twig and the collection target templates. Stimulus MutationObserver picks up the descriptors on dynamically added rows, removing the need for _makeDraggable(). The ancestor-form submit listener stays as addEventListener since Stimulus data-action cannot reach elements outside the controller's subtree. * feat: show label colour badges in question bank edit form Replace plain checkbox text with coloured Bootstrap badge pills in the labels section of the bank question edit form (both standalone and modal frame variants). Adds choice_attr to pass data-colour to each checkbox, then renders the input manually so the label can hold the badge without the Bootstrap 5 form theme wrapping in a second plain-text label.	2026-07-07 22:37:15 +02:00
Marijn	404c0dcc26	Summer cleanup: XLSX export, WIDM-style quiz UI, CSS fixes (#162) ... * Add CLAUDE.md, replace Makefile with Justfile, remove .junie - Add CLAUDE.md with project overview, commands, architecture, and domain entity docs - Remove Makefile in favour of the existing Justfile - Remove .junie/AGENTS.md (knowledge transferred to CLAUDE.md) - Update .gitignore: drop .junie/ entries, add .claude/settings.local.json - Minor doc fixes in config/reference.php (typo, type correction) * Clean up templates and CSS - season.html.twig: remove dead empty column, drop redundant flex-row - tab_overview.html.twig: extract Twig macro for confirm modals, fix duplicate aria-labelledby IDs - tab_result.html.twig: remove dead comment, replace inline widths with CSS classes, simplify nested row/col forms to d-flex gap-1 - backoffice.scss: add col-result-xs/sm/md column width classes - quiz.scss: replace broken display:grid + justify-self:center with flexbox centering * Implement quizToXlsx() export and add export button - QuizSpreadsheetService: implement quizToXlsx() as the inverse of fillQuizFromArray() — writes quiz questions and answers to XLSX using the same column layout as the import template - BackofficeController: add exportQuiz() action at GET /backoffice/quiz/{quiz}/export - tab_overview.html.twig: add Export to XLSX button in Quick actions * Add unit tests for QuizSpreadsheetService 7 tests covering generateTemplate(), quizToXlsx(), and xlsxToQuiz(): - valid XLSX output and MIME type - template without example reimports as empty - template example data survives a reimport - round-trip (export → reimport) preserves questions, answers, and correct flags - empty quiz exports and reimports cleanly - invalid MIME type throws InvalidArgumentException - question with no answers throws SpreadsheetDataException with error list * Fix quiz page vertical centering regression The CSS cleanup broke vertical centering: flex on body causes main to stretch full-width; place-items:center on a grid body only centers items within their auto-sized track (not the track within body). Fix: move background/color to html (full-viewport grid that centers body), give body height:100% + display:grid + align-content:center (centers the content track within full-height body) + justify-self:center (shrink-wraps body width). Matches production behavior exactly. * Improve quiz page layouts: WIDM-style answers and responsive centering - Add green square answer buttons styled after the TV show - Two-column answer grid for 6+ answers, single column on mobile - fit-content centering for question pages so block matches question width - Narrow fixed-width centering for form pages (enter name, select season) * Use HeaderUtils::makeDisposition() for safe Content-Disposition filename * Fix quizToXlsx to support unlimited answers and add header count tests - Replace hardcoded 6-column arrays with dynamic Coordinate arithmetic - Write data rows first to determine max answer count, write headers last - Replace try/catch ErrorException in fillQuizFromArray with array_key_exists - Add data-provider test covering 2, 6, 7, and 10 answers - Add cross-question max-header and 7-answer round-trip tests * Fix Sass healthcheck * Improve quiz layout: add fixed topbar, include navigation, and clean up unused elements - Add `.quiz-topbar` with fixed positioning and spacing in `quiz.scss` - Update `base.html.twig` to include `quiz/nav.html.twig` in a new `nav` block - Remove unused "Manage Quiz" button from `select_season.html.twig` * Refactor generateTemplate to reuse quizToXlsx and add second example question - generateTemplate now builds an in-memory Quiz entity and delegates to quizToXlsx, eliminating duplicate spreadsheet-building logic - Adds a second example question "Wie is de mol?" with 10 Dutch names (5 male, 5 female) to better illustrate the import format - Updates tests to assert both example questions and adds a test for the blank-row halt behaviour in fillQuizFromArray (achieving 100% coverage) * Move PHPUnit cache to /tmp to avoid writing into the mounted volume * Update src/Service/QuizSpreadsheetService.php Co-authored-by: coderabbitai[bot] <136622811+coderabbitai[bot]@users.noreply.github.com> --------- Co-authored-by: coderabbitai[bot] <136622811+coderabbitai[bot]@users.noreply.github.com>	2026-07-02 20:25:02 +00:00
Marijn	1c1ce5e071	Update composer.lock with dependency upgrades and improvements (#79) ... * Update composer.lock with dependency upgrades and improvements Updated multiple dependencies in `composer.lock` to their latest versions, including upgrades for Doctrine, PHPUnit, Symfony components, and extended PostgreSQL support. * Fix sass compile	2026-03-22 22:26:56 +00:00
Marijn	bcd6a157a8	Create Testcoverage and upgrade Symfomy and PHP ... * Some tests * More tests! * Tests 3 * Move getScores from Candidate to Quiz * Add some suggestions for future refactoring * - **Add Gedmo doctrine-extensions and Stof bundle integration** - Added `stof/doctrine-extensions-bundle` and `gedmo/doctrine-extensions` dependencies. - Integrated `Timestampable` behavior for `Created` fields in entities. - Updated `bundles.php` to register StofDoctrineExtensionsBundle. - Added configuration for the Stof bundle. - Simplified `SeasonVoter` with `match` expression and added new tests. - Minor fixes and adjustments across various files. * WIP * All the tests * Base64 tests * Symfomny 7.4.0 * Update * Update recipe * PHP 8.5 * Rector changes * More 8.5 * Things	2025-11-28 22:56:09 +01:00
Marijn	b66d2f9e86	Refactor entities and codebase for native property usage ... - Replaced getters/setters with direct property access across entities and repositories. - Added and configured `martin-georgiev/postgresql-for-doctrine` for PostgreSQL enhancements. - Updated Doctrine configuration with types, mappings, and JSONB query functions. - Removed unused `EliminationService` and related YAML configurations.	2025-10-08 20:50:33 +02:00
Marijn	81e471a760	Change namespace to Tvdt	2025-09-28 18:14:58 +02:00
Marijn	ff6534fa81	Improve links	2025-06-07 22:24:38 +02:00
Marijn	d3e5cb0569	Refactor elimination feature and improve backoffice usability ... This commit introduces a refactored EliminationFactory for better modularity, updates the elimination preparation process, and adds functionality to view eliminations. Backoffice templates and forms have been reorganized, minor translations were corrected, and additional assets like styles and flashes were included for enhanced user experience.	2025-06-01 15:40:47 +02:00