cb46372e52af7b4b3e72180af4483a67355d576d
444 Commits
| Author | SHA1 | Message | Date | |
|---|---|---|---|---|
|
|
cb46372e52 |
fix(pitch-print): architecture diagram overflow — compact ServiceNode
Build pitch-deck / build-push-deploy (push) Successful in 2m1s
CI / go-lint (push) Has been skipped
CI / python-lint (push) Has been skipped
CI / nodejs-lint (push) Has been skipped
CI / test-go-consent (push) Successful in 41s
CI / test-python-voice (push) Successful in 36s
CI / test-bqas (push) Successful in 34s
Infrastructure layer was being cut off (only the chip showed; the 3 inference service cards never rendered). Root cause: each tier was double-wrapped — an outer tinted layer card AND inner bordered FlowNode cards — which inflated the total height past A4 landscape. Replaces inner FlowNode (border + padding + footer rule) with a new flat ServiceNode used only inside the tinted layer wrappers: - no own border / no own padding - title 11pt → 10pt, kicker 7pt → 6pt - caps inner items to 4 max - mono tech footer in 6pt with hairline separator Also tightened the connectors between tiers: was a 12mm row of three VArrow SVGs each with its own padding, now a 5mm row of three compact down-arrow SVGs. Saves ~14mm of vertical space. Layer chip sizing reduced (7.5pt → 7pt, padding 1.5mm → 1mm) so each chip takes less of its layer card. Result: all three layers fit on one A4 landscape page with the LLM Inference / Embeddings / AI Tools cards visible. Co-Authored-By: Claude Opus 4.7 <noreply@anthropic.com> |
||
|
|
f1814fe8ec |
fix(pitch-print): USP overflow, How It Works rail, Assumptions, Architecture layer cards
Build pitch-deck / build-push-deploy (push) Successful in 2m4s
CI / go-lint (push) Has been skipped
CI / python-lint (push) Has been skipped
CI / nodejs-lint (push) Has been skipped
CI / test-go-consent (push) Successful in 40s
CI / test-python-voice (push) Successful in 35s
CI / test-bqas (push) Successful in 30s
Five fixes per user review:
1. USP p1 overflow (stats were getting clipped). Tightened card spacing:
- icon tile 12mm → 9mm, moved inline next to title
- mono kicker for "SÄULE · COMPLIANCE" tags
- reduced paddings, title 13pt → 12pt, body 8.5pt → 8pt
- violet replaces indigo (already by alias, but explicit here)
2. USP p2 closing loop: was a plain tinted callout, now a 2-col hero panel
- left: violet circle around ∞, mono "DIE SCHLEIFE · ALWAYS IN SYNC",
bold headline (14pt), body
- right: white card containing the LoopDiagram with violet outline
- gradient violet→white→violet background for the panel
3. How It Works: replaced the floating-arrow StepStrip with a real
horizontal-rail timeline:
- Violet gradient connector line behind 4 numbered circles
- Each circle is a 14mm violet disc with the step number
- Title + body below each circle
Replaced the Time-to-Value callout with a dotted-rail timeline:
- 5 day markers (Tag 0/3/7/14/30) as violet pill chips on a dashed rail
- Stop label below each
- Mono header reads "Time-to-Value · Median 14 Tage · Worst Case 28 Tage"
4. Assumptions slide:
- "Skalare Annahmen" → "Treibervariablen des Finanzplans" (plain language)
- subtitle rewritten to explain the three-scenario sensitivity setup
instead of referencing internal fp_assumptions tables
- each category now a violet-bordered card with mono kicker + variable
count, italic instead of bare table
- sensitivity callout expanded with concrete runway impact numbers
5. Architecture diagram: layer chips per Claude Design pattern.
- Each tier wrapped in a tinted rounded card (violet for product +
inference, amber for gateway)
- "01 · APPLICATION LAYER" mono pill with italic sub-label
("User-facing services") next to it
- Gateway layer carries the LiteLLM Proxy title inline with subtitle
- Connector arrows kept between layers
Also fixes "Kleinstunternehmen" → "Kleinunternehmen" typo in solution
pillar 03 and the product pricing-logic callout.
Co-Authored-By: Claude Opus 4.7 <noreply@anthropic.com>
|
||
|
|
12a9fe1810 |
fix(pitch-print): drop Standort/HQ from cover key terms
Build pitch-deck / build-push-deploy (push) Successful in 1m51s
CI / go-lint (push) Has been skipped
CI / python-lint (push) Has been skipped
CI / nodejs-lint (push) Has been skipped
CI / test-go-consent (push) Successful in 54s
CI / test-python-voice (push) Successful in 43s
CI / test-bqas (push) Successful in 38s
3-column grid now: Funding · Pre-Money/Maturity · Instrument. Co-Authored-By: Claude Opus 4.7 <noreply@anthropic.com> |
||
|
|
8b5b9905a7 |
fix(pitch-print): port Claude Design tokens — violet, Inter+JBMono, dotted bg
Build pitch-deck / build-push-deploy (push) Successful in 1m50s
CI / go-lint (push) Has been skipped
CI / python-lint (push) Has been skipped
CI / nodejs-lint (push) Has been skipped
CI / test-go-consent (push) Successful in 33s
CI / test-python-voice (push) Successful in 30s
CI / test-bqas (push) Successful in 27s
Adapts the visual language from the Claude Design reference (light theme) while
preserving our left-rule Page header and split-block cover.
Color palette: indigo (#4f46e5) → violet (#7c3aed) as primary accent across all
slides. COLORS.indigo* aliases kept so the existing 9 slide files inherit the
new palette without edits. New explicit COLORS.violet50..900 names available
for future code.
Body text shifted from pure slate to deep purple-tinted (#1a0f34) per Claude
tokens.fg.
Typography:
- Body / headings: Inter (was Plus Jakarta Sans)
- Mono utility: JetBrains Mono — applied to kicker tags, page numbers, footer,
the "At a glance" stat block on the cover, and the cover key-term labels
- Mono class .print-mono added to print.css
Background:
- New .print-page-bg utility paints a violet-tinted radial gradient
(white → #f5efff → #ebdfff) with a subtle 24px dotted grid SVG overlay
- Applied to every Page and the cover's right pane
Page chrome:
- Kicker label switched to JetBrains Mono with wider letter-spacing (0.18em)
- Right-of-kicker rule fades violet→transparent (was flat slate)
- New 2px violet gradient bar (700→400→700) below the title/subtitle —
the Claude Design "purple bar" accent, scaled down for print
- Footer restyled: mono caps "BREAKPILOT · COMPLAI" left, version (violet) middle,
page number right
Cover:
- Left block now a violet vertical gradient (was flat indigo)
- All small labels ("Investor Brief", "Auf einen Blick", "Confidential",
"Key Terms", and the term labels) restyled to JetBrains Mono with wider tracking
- Right pane carries the violet-tinted dotted bg, matching the rest of the deck
Co-Authored-By: Claude Opus 4.7 <noreply@anthropic.com>
|
||
|
|
cd23ebc3ba |
fix(pitch-print): density on Problem/Solution/Strategy, Ask reconciliation
Build pitch-deck / build-push-deploy (push) Successful in 1m42s
CI / go-lint (push) Has been skipped
CI / python-lint (push) Has been skipped
CI / nodejs-lint (push) Has been skipped
CI / test-go-consent (push) Successful in 31s
CI / test-python-voice (push) Successful in 33s
CI / test-bqas (push) Successful in 34s
Per user review of the rendered PDF.
Problem: empty bottom-third on each card → added a bottom stat block per
column showing 3 pulled-out data points (e.g. "64% · 70% · 83%") with red
hero numerals. Description text trimmed since the stats now carry the punch.
Solution: pillar bodies were short, leaving large gaps between description
and the green stat at the bottom. Added 5 detail bullets per pillar (specific
tools, frameworks, behaviours) in the previously empty middle. Stat at the
bottom now reads as a real KPI tile, not a floating value.
Strategy: phase KPI was a tiny corner tag. Promoted it to a bottom
"Outcome" block with side-by-side 14pt numerals matching the phase tone
(2 Kunden / ARR €40k etc.). The bullets get more breathing room above.
The Ask reconciliation (was showing nonsense €4M pre / €5M post / 20%
investor share for a €200k Wandeldarlehen): detect convertible/SAFE/
Wandeldarlehen and swap the tiles to Funding / Discount / Maturity /
INVEST-grant. Equity rounds compute Pre/Post from amount × 20% assumed
investor share. Same conditional applied to the cover key-terms grid.
Pricing label "Was der Kunde zahlt vs. spart (KMU 50 MA, Jahr 1)" was
wrapping "1)" onto its own line — switched to a slash-separated form
("Kunde zahlt vs. spart · KMU 50 MA · Jahr 1") that fits on one line.
Co-Authored-By: Claude Opus 4.7 <noreply@anthropic.com>
|
||
|
|
f30ac73b79 |
fix(pitch-print): cover layout, Finanzplan data source, target_date
Build pitch-deck / build-push-deploy (push) Successful in 1m34s
CI / go-lint (push) Has been skipped
CI / python-lint (push) Has been skipped
CI / nodejs-lint (push) Has been skipped
CI / test-go-consent (push) Successful in 30s
CI / test-python-voice (push) Successful in 30s
CI / test-bqas (push) Successful in 28s
Three critical fixes after reviewing the rendered PDF: Cover (was: indigo block collapsed to top, white content stacked below): - The .print-page class in print.css forces flex-direction: column !important, which broke the horizontal split. Wrap the cover content in a single grid container — the column-flex parent then has only one child so direction is irrelevant. Indigo block now runs full-height on the left. - Title reduced 88pt -> 60pt so "BreakPilot ComplAI." fits without wrapping. - Funding amount formatter now handles sub-€1M cases (€200k vs €0.2M). Finanzplan (was: "nicht verfügbar" on both pages 20-21): - page.tsx was querying the legacy pitch_fm_results table which isn't populated by the current pipeline. The interactive deck reads from fp_* tables. - Wire in lib/finanzplan/adapter.ts (finanzplanToFMResults) which bridges the live fp_* tables to FMResult[] — same source the interactive deck uses. - Fall back to live default fp_scenario if the version snapshot's fm_scenarios is empty. - adapter.ts: populate total_customers + new_customers from fp_kunden_summary (was hardcoded 0). The Ask: - target_date was rendering as raw ISO timestamp "2026-08-01T00:00:00.000Z"; now formatted as "Aug 2026" (locale-aware). - Hero funding amount uses same sub-€1M formatter. Co-Authored-By: Claude Opus 4.7 <noreply@anthropic.com> |
||
|
|
bb85ee2e27 |
fix(pitch-print): page count, Finanzplan loading, visual energy
Build pitch-deck / build-push-deploy (push) Successful in 1m59s
CI / go-lint (push) Has been skipped
CI / python-lint (push) Has been skipped
CI / nodejs-lint (push) Has been skipped
CI / test-go-consent (push) Successful in 52s
CI / test-python-voice (push) Successful in 37s
CI / test-bqas (push) Successful in 36s
Two bug fixes plus the requested visual rework — the deck now looks like a pitch deck, not a research paper. Bugs: - BASE_PAGES corrected from 28 to 29; disclaimer no longer shows "29/28" - fmResults + fmAssumptions now load for the standard PDF, not only when financial=true; Finanzplan annex + KPI dashboard now render Visual rework (per user: "graphic elements, not just text"): - Cover: split layout — indigo block left (tagline + hero stats + version meta), white block right with oversized title and key terms - Modules: 12 lucide icons in indigo-50 tiles (ScanLine, ShieldCheck, FileText, ClipboardCheck, Users, UserCheck, AlertTriangle, Brain, Target, GraduationCap, TrendingUp, MessageSquare) - USP cards: icon-led card heads with FileSearch/ArrowLeftRight/Repeat/Layers/etc.; LoopDiagram SVG on the closing "Compliance ↔ Code" hub - How It Works: StepStrip primitive with visible right-arrows between steps - Market: nested-rectangle MarketFunnel (TAM > SAM > SOM) replaces three stacked boxes - Customer Savings: 4 hero KPIs + ComparisonBars (today vs. with BP) per cost item - The Ask: DonutChart for use-of-funds - Cap Table: DonutChart for equity distribution - Finanzplan p2: 2×2 chart grid — Revenue (bars), EBIT (bars, tone by sign), Cash balance (line+area), Headcount (bars) - Architecture: ArchitectureDiagram primitive (3 tiers, vertical arrows between tiers) - AI Pipeline: PipelineFlow primitive (4 stages, horizontal arrows) - Team: founder photos (32×32mm) added; falls back to initials if photo_url missing New primitives: - PrintCharts.tsx — BarChart, LineChart, ComparisonBars, DonutChart, ProgressBar, MarketFunnel - PrintDiagrams.tsx — FlowNode, VArrow, HArrow, StepStrip, ArchitectureDiagram, LoopDiagram, PipelineFlow All files under 500 LOC cap. Co-Authored-By: Claude Opus 4.7 <noreply@anthropic.com> |
||
|
|
0d5ebcd27a |
feat(pitch-print): redesign PDF investor brief from scratch
Build pitch-deck / build-push-deploy (push) Successful in 2m19s
CI / go-lint (push) Has been skipped
CI / python-lint (push) Has been skipped
CI / nodejs-lint (push) Has been skipped
CI / test-go-consent (push) Successful in 46s
CI / test-python-voice (push) Successful in 35s
CI / test-bqas (push) Successful in 34s
Throws away the screen-deck-derived print system. Builds a new institutional-research aesthetic: - 12-col grid on A4 landscape, hairline rules, no colored bars, no icons - 3-color discipline: indigo (structural), emerald (positive), red (problem) - Plus Jakarta Sans 800 for hero numerals + titles; tabular numerals everywhere - 1-to-1 content parity with the interactive deck: full USP (8 cards), full competition matrix (45 features, 12 AppSec features, 8+6 competitor profiles), Finanzplan P&L grid + KPI dashboard, full glossary - 2-page slides where content demands (Exec Summary, USP, Competition, Finanzplan) - 28 base pages; +1 for Financial detail; +1 for Cap Table (suppressed on Wandeldarlehen) Files: - New: PrintIntroSlides, PrintProductSlides, PrintMarketSlides, PrintCompetitionSlides - Rewritten: PrintLayout (new primitives Page/KpiRow/TwoCol/ThreeCol/DataTable/MatrixGlyph/Callout), PrintAnnexSlides, PrintFinancialSlides, PrintDeck - Removed: PrintCoreSlides.tsx, PrintExtraSlides.tsx (obsolete) - print.css now sets Plus Jakarta Sans as the print font family - All files under 500 LOC cap Co-Authored-By: Claude Opus 4.7 <noreply@anthropic.com> |
||
|
|
77993d0ea0 |
feat(pitch-deck): Finanzplan-Export nach Excel mit Live-Formeln und Charts
Build pitch-deck / build-push-deploy (push) Failing after 24s
CI / go-lint (push) Has been skipped
CI / python-lint (push) Has been skipped
CI / nodejs-lint (push) Has been skipped
CI / test-go-consent (push) Successful in 5m28s
CI / test-python-voice (push) Successful in 4m0s
CI / test-bqas (push) Successful in 32s
Generiert pro Szenario (Wandeldarlehen 200k/Bear/Bull, 1 Mio Base/Bear/Bull) ein .xlsx mit 10 Tabs (Dashboard, Kunden, Umsatzerlöse, Personalkosten, Investitionen, Materialaufwand, Betriebliche Aufwendungen, Liquidität, GuV, Formelübersicht). Editierbare Eingaben bleiben rohe Werte; abgeleitete Zellen werden zu echten Excel-Formeln über Tabs hinweg, sodass das Bearbeiten von Inputs Personal/Opex/Liquidität/GuV neu berechnet. Dashboard-Tab fasst Jahres-KPIs zusammen und enthält fünf Charts (Umsatz/Material/Personal/EBIT YoY, Jahresüberschuss YoY, Liquidität, Headcount, Personalkosten monatlich). Run: PG_CONN=... pitch-deck/scripts/export-finanzplan.sh Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com> |
||
|
|
9382d2a7a4 |
chore: bump next 15.1.0 → 15.5.16 across all apps (CVE-2026-44578)
Build pitch-deck / build-push-deploy (push) Failing after 23s
CI / go-lint (push) Has been skipped
CI / python-lint (push) Has been skipped
CI / nodejs-lint (push) Has been skipped
CI / test-go-consent (push) Successful in 1m29s
CI / test-python-voice (push) Successful in 1m35s
CI / test-bqas (push) Successful in 1m26s
Patches unauthenticated SSRF in WebSocket upgrade handler. Applies to admin-core, pitch-deck, levis-holzbau, marketing-website. GHSA-c4j6-fc7j-m34r. Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com> |
||
|
|
084beed348 |
feat(pitch-print): port remaining 15 slides for 1-to-1 PDF parity with deck
Build pitch-deck / build-push-deploy (push) Successful in 1m58s
CI / go-lint (push) Has been skipped
CI / python-lint (push) Has been skipped
CI / nodejs-lint (push) Has been skipped
CI / test-go-consent (push) Successful in 34s
CI / test-python-voice (push) Successful in 31s
CI / test-bqas (push) Successful in 28s
Adds print versions for executive-summary, usp, regulatory-landscape, how-it-works, business-model, competition, customer-savings, annex-strategy, annex-finanzplan, annex-regulatory, annex-architecture, annex-engineering, annex-aipipeline, risks, annex-glossary across two new files. PrintDeck.tsx now renders slides in SLIDE_ORDER (minus 3 interactive-only slides: intro-presenter, ai-qa, annex-sdk-demo). Standard PDF: 25 pages. Financial PDF: 27 pages (or 26 for Wandeldarlehen, no cap-table). Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com> |
||
|
|
5510689710 |
fix(print): override globals.css body overflow:hidden and dark background
Build pitch-deck / build-push-deploy (push) Successful in 1m57s
CI / go-lint (push) Has been skipped
CI / python-lint (push) Has been skipped
CI / nodejs-lint (push) Has been skipped
CI / test-go-consent (push) Successful in 34s
CI / test-python-voice (push) Successful in 33s
CI / test-bqas (push) Successful in 30s
globals.css sets html,body { height:100%; overflow:hidden; background:#0a0a1a }
with no media query. In print mode this clips all slides to one viewport
height (explaining the 2-page limit) and renders a black background.
Override with height:auto, overflow:visible, background:white in @media print.
Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
|
||
|
|
49e594bf38 |
fix(print): set height:210mm on block wrapper, not flex container
Build pitch-deck / build-push-deploy (push) Successful in 1m39s
CI / go-lint (push) Has been skipped
CI / python-lint (push) Has been skipped
CI / nodejs-lint (push) Has been skipped
CI / test-go-consent (push) Successful in 32s
CI / test-python-voice (push) Successful in 30s
CI / test-bqas (push) Successful in 29s
Firefox doesn't honor height on flex containers in print mode — the container collapses to content height, causing all slides to fit on 2 pages. Moved the authoritative height to the display:block wrapper (.print-page-break) and changed .print-page to height:100% so it fills its reliably-sized block parent. Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com> |
||
|
|
583e54fabc |
fix(print): use CSS named pages + break-before for reliable Firefox pagination
Build pitch-deck / build-push-deploy (push) Successful in 1m30s
CI / go-lint (push) Has been skipped
CI / python-lint (push) Has been skipped
CI / nodejs-lint (push) Has been skipped
CI / test-go-consent (push) Successful in 32s
CI / test-python-voice (push) Successful in 33s
CI / test-bqas (push) Successful in 30s
page: slide-page on each block wrapper forces Firefox to allocate a new physical page per slide — the spec-correct approach. break-before: page is belt-and-suspenders. Switched from break-after to break-before via adjacent sibling selector to avoid a blank trailing page. Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com> |
||
|
|
7f4b7da098 |
fix(print): add Firefox print-color-adjust prefix for background colors
Build pitch-deck / build-push-deploy (push) Successful in 1m34s
CI / go-lint (push) Has been skipped
CI / python-lint (push) Has been skipped
CI / nodejs-lint (push) Has been skipped
CI / test-go-consent (push) Successful in 32s
CI / test-python-voice (push) Successful in 32s
CI / test-bqas (push) Successful in 40s
-moz-print-color-adjust: exact ensures Firefox doesn't strip background colors from headers, badges, and accent elements when printing. Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com> |
||
|
|
f3e54180f0 |
fix(print): wrap flex pages in block container to fix Chrome page breaks
Build pitch-deck / build-push-deploy (push) Successful in 1m38s
CI / go-lint (push) Has been skipped
CI / python-lint (push) Has been skipped
CI / nodejs-lint (push) Has been skipped
CI / test-go-consent (push) Successful in 31s
CI / test-python-voice (push) Successful in 31s
CI / test-bqas (push) Successful in 32s
Chrome's print engine silently ignores break-after/page-break-after on flex containers. Wrapping each .print-page (flex) in a plain block .print-page-break element gives Chrome a reliable page break anchor. Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com> |
||
|
|
fc4d5d8c56 |
fix(pitch-deck): use imported CSS for print styles instead of inline style tag
Inline <style> tags in React body are unreliable for @media print in Chrome. Move all print CSS to app/pitch-print/print.css imported via a layout.tsx — Next.js injects this as a proper <link> in <head>, which is guaranteed to be applied before print rendering. Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com> |
||
|
|
cf18b1074a |
fix(pitch-deck): PDF print layout — fill page height, fix page breaks
Build pitch-deck / build-push-deploy (push) Successful in 2m2s
CI / go-lint (push) Has been skipped
CI / python-lint (push) Has been skipped
CI / nodejs-lint (push) Has been skipped
CI / test-go-consent (push) Successful in 44s
CI / test-python-voice (push) Successful in 32s
CI / test-bqas (push) Successful in 33s
- Switch from inline pageBreakAfter to CSS class `.print-page` with explicit `page-break-after: always !important` so Chrome print preview creates a new page per slide (was collapsing to 2 pages) - Remove margin/box-shadow in @media print so A4 boundaries align - Content areas now use flex:1 so cards/pillars stretch to fill the full page height (no more blank void below content) - Remove conditional rendering on data-dependent slides — always render all 9 core pages - Larger font sizes throughout (11px body, 13px card titles) Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com> |
||
|
|
2e8cbfff3f |
feat(pitch-deck): add per-version PDF export (standard + financial)
Build pitch-deck / build-push-deploy (push) Successful in 1m49s
CI / go-lint (push) Has been skipped
CI / python-lint (push) Has been skipped
CI / nodejs-lint (push) Has been skipped
CI / test-go-consent (push) Successful in 40s
CI / test-python-voice (push) Successful in 29s
CI / test-bqas (push) Successful in 29s
Adds /pitch-print/[versionId] — a server-rendered, print-CSS-optimized page that generates investor-ready PDFs via the browser's native print dialog (Save as PDF). Two variants per version: - Standard PDF (9 pages): Cover, Problem, Solution, Products, Market, Team, Milestones, The Ask - Financial PDF (+4 pages): adds Financials P&L table (aggregated from pitch_fm_results), Assumptions, Cap Table, Legal Disclaimer White background with indigo accents, A4 landscape via @page CSS, all color-rendered in print via print-color-adjust: exact. Auto-triggers window.print() 900ms after load. Admin toolbar visible on screen only. Export buttons added to /pitch-admin/versions/[id] detail page. Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com> |
||
|
|
572052285c |
fix: require button click to consume magic link token
Build pitch-deck / build-push-deploy (push) Successful in 1m54s
CI / go-lint (push) Has been skipped
CI / python-lint (push) Has been skipped
CI / nodejs-lint (push) Has been skipped
CI / test-go-consent (push) Successful in 47s
CI / test-python-voice (push) Successful in 37s
CI / test-bqas (push) Successful in 37s
Email security gateways follow GET redirects automatically and were consuming the token before the investor clicked through. The verify page now shows an 'Access Pitch Deck' button; the token is only consumed on explicit click, which scanners cannot trigger. Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com> |
||
|
|
1ef22e6f95 |
fix: use PITCH_BASE_URL for short link redirects instead of request.url
Build pitch-deck / build-push-deploy (push) Successful in 1m39s
CI / go-lint (push) Has been skipped
CI / python-lint (push) Has been skipped
CI / nodejs-lint (push) Has been skipped
CI / test-go-consent (push) Successful in 32s
CI / test-python-voice (push) Successful in 32s
CI / test-bqas (push) Successful in 29s
Behind Orca's reverse proxy, request.url resolves to http://127.0.0.1:3000 which causes redirects to go to the internal address instead of the public domain. Use PITCH_BASE_URL (already set in service.toml) as the base. Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com> |
||
|
|
d291af0e33 |
fix: whitelist /p/* in middleware so short links work without a session
Build pitch-deck / build-push-deploy (push) Successful in 1m38s
CI / go-lint (push) Has been skipped
CI / python-lint (push) Has been skipped
CI / nodejs-lint (push) Has been skipped
CI / test-go-consent (push) Successful in 33s
CI / test-python-voice (push) Successful in 33s
CI / test-bqas (push) Successful in 30s
Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com> |
||
|
|
76aad8b1d1 |
feat(pitch-deck): branded short links for magic URLs (pitch.breakpilot.ai/p/ab3xk2)
Build pitch-deck / build-push-deploy (push) Successful in 1m31s
CI / go-lint (push) Has been skipped
CI / python-lint (push) Has been skipped
CI / nodejs-lint (push) Has been skipped
CI / test-go-consent (push) Successful in 32s
CI / test-python-voice (push) Successful in 34s
CI / test-bqas (push) Successful in 30s
- New pitch_short_links table stores 6-char alphanumeric codes mapped to magic link tokens - GET /p/[code] redirects to /auth/verify?token=... (302, validates expiry) - All magic link generation points (invite, generate-link, resend) now create a short code - Emails (invite + resend) use the short URL — less token-like, cleaner for spam filters - Copy-link UI shows short URL prominently with full URL as fallback - Migration 008 added to /api/admin/migrate Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com> |
||
|
|
54f0919b73 |
feat(pitch-deck): translate financial plan row labels when lang=en
Build pitch-deck / build-push-deploy (push) Successful in 2m0s
CI / go-lint (push) Has been skipped
CI / python-lint (push) Has been skipped
CI / nodejs-lint (push) Has been skipped
CI / test-go-consent (push) Successful in 47s
CI / test-python-voice (push) Successful in 35s
CI / test-bqas (push) Successful in 32s
- Add ROW_LABEL_MAP (DE→EN) covering GuV, Liquidität, Kunden, Betriebliche Aufwendungen rows - Add FORMULA_TOOLTIPS_EN with English tooltip text for all formula-driven rows - Add MONTH_LABELS_EN (Mrz→Mar, Mai→May, Okt→Oct) - LabelWithTooltip now accepts `de` flag, translates display text and tooltip accordingly - Month column headers switch between DE/EN month abbreviations - Falls back to original German label for any row not in the map Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com> |
||
|
|
ec7eee8e3d |
feat(pitch-deck): change preferred_lang for existing investors from detail page
Build pitch-deck / build-push-deploy (push) Successful in 1m27s
CI / go-lint (push) Has been skipped
CI / python-lint (push) Has been skipped
CI / nodejs-lint (push) Has been skipped
CI / test-go-consent (push) Successful in 33s
CI / test-python-voice (push) Successful in 33s
CI / test-bqas (push) Successful in 34s
- GET /api/admin/investors/:id now returns preferred_lang - PATCH /api/admin/investors/:id accepts preferred_lang (de/en), validates value - Investor detail page: DE/EN toggle in the Pitch Version card, instant save on click Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com> |
||
|
|
b0d273d3ab |
feat(pitch-deck): add pitch version selection to investor invite form
Build pitch-deck / build-push-deploy (push) Successful in 1m33s
CI / go-lint (push) Has been skipped
CI / python-lint (push) Has been skipped
CI / nodejs-lint (push) Has been skipped
CI / test-go-consent (push) Successful in 33s
CI / test-python-voice (push) Successful in 36s
CI / test-bqas (push) Successful in 32s
- Version dropdown on the invite form shows all committed versions - Selected version is assigned to the investor at creation time (no separate step needed) - API validates version is committed before upserting - Leaving the dropdown empty keeps any existing assignment (COALESCE behavior) - version_id included in audit log Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com> |
||
|
|
17b9006b88 |
feat(pitch-deck): English email templates, investor language preference, link-only invite mode
Build pitch-deck / build-push-deploy (push) Successful in 1m55s
CI / go-lint (push) Has been skipped
CI / python-lint (push) Has been skipped
CI / nodejs-lint (push) Has been skipped
CI / test-go-consent (push) Successful in 36s
CI / test-python-voice (push) Successful in 35s
CI / test-bqas (push) Successful in 35s
- Add English email template variants (greeting, message, closing, subject, CTA copy) - Add `preferred_lang` column to `pitch_investors` — stored per investor, deck opens in that language by default - Invite form: DE/EN language toggle that switches email defaults and pitch language setting - Invite form: "Send email" toggle — when off, creates investor + returns magic link without sending email (for cold outreach attachment) - `app/page.tsx`: initializes pitch language from investor's `preferred_lang` before first render (no flash) - Migration 007 added to `/api/admin/migrate` route for production rollout Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com> |
||
|
|
f0a84e79ab |
fix(preview): return fp_scenarios key so version-specific scenario is resolved in admin preview
Build pitch-deck / build-push-deploy (push) Successful in 1m39s
CI / go-lint (push) Has been skipped
CI / python-lint (push) Has been skipped
CI / nodejs-lint (push) Has been skipped
CI / test-go-consent (push) Successful in 40s
CI / test-python-voice (push) Successful in 32s
CI / test-bqas (push) Successful in 33s
The preview-data API was returning `fm_scenarios` but PitchDeck reads `data.fp_scenarios`, so fpBaseScenarioId was always null and the Finanzplan slide fell back to the global default scenario (Base Case 200k) instead of the version's assigned scenario (e.g. 1 Mio. Euro Base). Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com> |
||
|
|
404963db77 |
feat(showcase): restore intro-presenter and executive-summary slides in showcase mode
Build pitch-deck / build-push-deploy (push) Successful in 1m22s
CI / go-lint (push) Has been skipped
CI / python-lint (push) Has been skipped
CI / nodejs-lint (push) Has been skipped
CI / test-go-consent (push) Successful in 31s
CI / test-python-voice (push) Successful in 33s
CI / test-bqas (push) Successful in 30s
Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com> |
||
|
|
0acbf25956 |
fix(showcase): hide Data Room link for showcase sessions
Build pitch-deck / build-push-deploy (push) Successful in 1m23s
CI / go-lint (push) Has been skipped
CI / python-lint (push) Has been skipped
CI / nodejs-lint (push) Has been skipped
CI / test-go-consent (push) Successful in 29s
CI / test-python-voice (push) Successful in 33s
CI / test-bqas (push) Successful in 30s
Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com> |
||
|
|
2bd9b015eb |
fix(showcase): block financial data from AI Q&A, fix FAB overflow, fix presenter slide mapping
Build pitch-deck / build-push-deploy (push) Successful in 1m47s
CI / go-lint (push) Has been skipped
CI / python-lint (push) Has been skipped
CI / nodejs-lint (push) Has been skipped
CI / test-go-consent (push) Successful in 41s
CI / test-python-voice (push) Successful in 32s
CI / test-bqas (push) Successful in 32s
AI Q&A: fetch is_showcase from DB; showcase sessions receive no financial/funding context and have an explicit LLM guard refusing to discuss investment details. FAQ context and financial slide IDs stripped from system prompt. FAB: flex layout so Fullscreen button is always visible regardless of panel height. Presenter: pass activeSlideOrder to usePresenterMode so buildSlideAudioPlan maps slideIdx → slideId from the filtered list, not the full SLIDE_ORDER. Progress calculation also filters to active scripts only. Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com> |
||
|
|
be126a7a39 |
fix(pitch): showcase sidebar shows only filtered slides + AI presenter via FAB
Build pitch-deck / build-push-deploy (push) Successful in 1m22s
CI / go-lint (push) Has been skipped
CI / python-lint (push) Has been skipped
CI / nodejs-lint (push) Has been skipped
CI / test-go-consent (push) Successful in 31s
CI / test-python-voice (push) Successful in 30s
CI / test-bqas (push) Successful in 31s
NavigationFAB and SlideOverview now accept slideNames prop and render only the active slide list (filtered for showcase mode). Adds AI presenter start button to the FAB footer so it's accessible even when intro-presenter slide is hidden. Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com> |
||
|
|
30a9165497 |
feat(pitch): showcase mode — per-investor toggle hides financial/investor slides for customer demos
Build pitch-deck / build-push-deploy (push) Successful in 1m35s
CI / go-lint (push) Has been skipped
CI / python-lint (push) Has been skipped
CI / nodejs-lint (push) Has been skipped
CI / test-go-consent (push) Successful in 39s
CI / test-python-voice (push) Successful in 32s
CI / test-bqas (push) Successful in 30s
Adds is_showcase boolean to pitch_investors; when set, filters out financials, the ask, cap table, assumptions, finanzplan, risks, and intro-presenter slides. Slide navigation is fully dynamic — progress bar and counts update accordingly. Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com> |
||
|
|
f2184be02f |
fix: tab row counts use investor's scenario, not always Base Case
Build pitch-deck / build-push-deploy (push) Successful in 1m34s
CI / go-lint (push) Has been skipped
CI / python-lint (push) Has been skipped
CI / nodejs-lint (push) Has been skipped
CI / test-go-consent (push) Successful in 36s
CI / test-python-voice (push) Successful in 35s
CI / test-bqas (push) Successful in 32s
/api/finanzplan now accepts ?scenarioId and uses it for the per-sheet row counts (the numbers in brackets on the tab bar). FinanzplanSlide passes fpBaseScenarioId when fetching the sheet list, so Wandeldarlehen investors see e.g. Personalkosten (9) instead of (35). Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com> |
||
|
|
06014d57b3 |
fix: derive fp_scenario IDs from version snapshot, eliminate hardcoded UUIDs
Build pitch-deck / build-push-deploy (push) Successful in 1m30s
CI / go-lint (push) Has been skipped
CI / python-lint (push) Has been skipped
CI / nodejs-lint (push) Has been skipped
CI / test-go-consent (push) Successful in 33s
CI / test-python-voice (push) Successful in 32s
CI / test-bqas (push) Successful in 31s
The fm_scenarios array in each pitch version snapshot already stores the fp_scenario IDs directly (same pattern 1 Mio used). Wandeldarlehen snapshots were missing Bear/Bull entries — updated in DB to add them. - /api/data: include fp_scenarios in version response (was omitted) - PitchDeck: derive fpBaseScenarioId from data.fp_scenarios - useFpKPIs: accept fpBaseScenarioId instead of isWandeldarlehen boolean - AssumptionsSlide: find Bear/Base/Bull by name from fpScenarios prop - FinanzplanSlide: initialize from fpBaseScenarioId, use version scenarios for selector - FinancialsSlide / ExecutiveSummarySlide: pass fpBaseScenarioId to hook - types: add FpScenarioRef + fp_scenarios field to PitchData No UUID hardcoded in any component. Adding a new pitch version only requires setting the correct fp_scenario IDs in its fm_scenarios snapshot. Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com> |
||
|
|
6c022d1a79 |
fix: allow investors to query fp_ scenarios by scenarioId
Build pitch-deck / build-push-deploy (push) Successful in 1m55s
CI / go-lint (push) Has been skipped
CI / python-lint (push) Has been skipped
CI / nodejs-lint (push) Has been skipped
CI / test-go-consent (push) Successful in 40s
CI / test-python-voice (push) Successful in 37s
CI / test-bqas (push) Successful in 34s
AssumptionsSlide sends ?scenarioId=<uuid> for Bear/Base/Bull cards but the route was silently dropping it for non-admin requests, making all three cards return the same default Base Case data. Since fp_ financial projections are already investor-facing, any valid scenarioId is allowed. Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com> |
||
|
|
f130c45ca8 |
feat(dataroom): bilingual descriptions, drag-drop multi-file upload, edit existing upload descriptions
Build pitch-deck / build-push-deploy (push) Successful in 1m47s
CI / go-lint (push) Has been skipped
CI / python-lint (push) Has been skipped
CI / nodejs-lint (push) Has been skipped
CI / test-go-consent (push) Successful in 39s
CI / test-python-voice (push) Successful in 32s
CI / test-bqas (push) Successful in 32s
- lib/translate.ts: LiteLLM DE<>EN translation utility - Migration 006: description_de/description_en on both dataroom tables - Admin + investor upload APIs: accept description+lang, auto-translate the other language on save - PATCH /api/admin/dataroom/documents/[id]: description path in addition to display_name path - PATCH /api/dataroom/uploads/[id]: investor can edit their own upload descriptions - PATCH /api/admin/dataroom/investors/[id]/uploads: admin can edit investor upload descriptions - All GET queries updated to return description fields - Admin dataroom: drop zone replaces upload button, multi-file, inline description editor per doc and per investor upload - Investor dataroom: drop zone, multi-file, description+lang textarea before upload, inline description editing on existing uploads Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com> |
||
|
|
370143b643 |
fix(dataroom): use getSessionFromCookie() instead of middleware headers; fix auth page overflow
Build pitch-deck / build-push-deploy (push) Successful in 1m33s
CI / go-lint (push) Has been skipped
CI / python-lint (push) Has been skipped
CI / nodejs-lint (push) Has been skipped
CI / test-go-consent (push) Successful in 37s
CI / test-python-voice (push) Successful in 31s
CI / test-bqas (push) Successful in 27s
Dataroom routes were reading x-investor-id from request headers which the middleware sets as response headers — these don't reach route handlers when the admin fallback path runs (NextResponse.next() without header). Switch to getSessionFromCookie() consistent with all other investor routes. Auth page DSGVO footer switched from absolute bottom-0 to normal flow so the expanded Art. 13 notice doesn't overlap the login card. Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com> |
||
|
|
07039cc408 |
fix(pitch-deck): pre-create /data/dataroom owned by nextjs in Dockerfile
Build pitch-deck / build-push-deploy (push) Successful in 1m18s
CI / go-lint (push) Has been skipped
CI / python-lint (push) Has been skipped
CI / nodejs-lint (push) Has been skipped
CI / test-go-consent (push) Successful in 29s
CI / test-python-voice (push) Successful in 30s
CI / test-bqas (push) Successful in 29s
Docker volume inherits directory ownership from the image on first mount. Without this, the volume mounts as root and the nextjs (uid 1001) process gets EACCES when trying to write dataroom uploads. Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com> |
||
|
|
af83e41494 |
feat(pitch-deck): add Data Room link for investors in top-right corner
Build pitch-deck / build-push-deploy (push) Successful in 1m19s
CI / go-lint (push) Has been skipped
CI / python-lint (push) Has been skipped
CI / nodejs-lint (push) Has been skipped
CI / test-go-consent (push) Successful in 32s
CI / test-python-voice (push) Successful in 31s
CI / test-bqas (push) Successful in 29s
Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com> |
||
|
|
9888b1b5d7 |
feat(pitch-deck): data room — file sharing and investor uploads
Build pitch-deck / build-push-deploy (push) Successful in 1m21s
CI / go-lint (push) Has been skipped
CI / python-lint (push) Has been skipped
CI / nodejs-lint (push) Has been skipped
CI / test-go-consent (push) Successful in 31s
CI / test-python-voice (push) Successful in 33s
CI / test-bqas (push) Successful in 32s
- lib/dataroom-storage.ts: local volume storage (DATAROOM_PATH env var, default /data/dataroom) replacing NextCloud WebDAV - Admin API: upload documents, rename, delete, manage per-investor releases - Investor API: list released documents, stream download with audit log, upload own documents (max DATAROOM_MAX_UPLOAD_MB, default 50MB) - /pitch-admin/dataroom: document list + release toggles + investor uploads tab - /dataroom: investor-facing document library + upload section - All reads and writes logged to pitch_audit_logs - Migration 005: dataroom_documents, dataroom_releases, dataroom_investor_uploads - AdminShell: Data Room nav link (FolderOpen icon) Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com> |
||
|
|
1bf1411c66 |
fix(pitch-deck): update email privacy notice to match GDPR changes
Build pitch-deck / build-push-deploy (push) Successful in 1m19s
CI / go-lint (push) Has been skipped
CI / python-lint (push) Has been skipped
CI / nodejs-lint (push) Has been skipped
CI / test-go-consent (push) Successful in 29s
CI / test-python-voice (push) Successful in 29s
CI / test-bqas (push) Successful in 29s
72 Stunden → 30 Tage, expand scope to include personal contact data, add Art. 15–21 rights, LfDI BW supervisory authority. Both DE + EN. Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com> |
||
|
|
5946aa47d5 |
fix(pitch-deck): GDPR compliance — automated cleanup, full Art. 13 notice
Build pitch-deck / build-push-deploy (push) Successful in 1m37s
CI / go-lint (push) Has been skipped
CI / python-lint (push) Has been skipped
CI / nodejs-lint (push) Has been skipped
CI / test-go-consent (push) Successful in 38s
CI / test-python-voice (push) Successful in 32s
CI / test-bqas (push) Successful in 30s
- runDataCleanup() replaces maskOverdueInvestors(): now also anonymizes never-activated invites after 90 days, deletes sessions + magic links older than 30 days, NULLs IPs in audit logs older than 30 days, and redacts email from audit log details JSONB for masked investors - New /api/admin/cleanup POST endpoint for scheduled invocation - New .gitea/workflows/pitch-cleanup.yml: daily cron at 02:00 UTC calls the cleanup endpoint so anonymization is genuinely automatic, not lazy - Switch masking window from first_activity_at to last_login_at (30 days of inactivity; resets on each login) - Both auth pages: DSGVO footer now covers all Art. 13 requirements — data categories, retention cutoffs, Art. 15–21 rights, contact address, LfDI Baden-Württemberg as supervisory authority Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com> |
||
|
|
2f861cd6d7 |
feat(pitch-admin): backfill first_activity_at for existing investors
Build pitch-deck / build-push-deploy (push) Successful in 1m22s
CI / go-lint (push) Has been skipped
CI / python-lint (push) Has been skipped
CI / nodejs-lint (push) Has been skipped
CI / test-go-consent (push) Successful in 30s
CI / test-python-voice (push) Successful in 31s
CI / test-bqas (push) Successful in 31s
Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com> |
||
|
|
23b233bda3 |
feat(pitch-admin): generate magic link + 72h investor data masking
Build pitch-deck / build-push-deploy (push) Successful in 1m30s
CI / go-lint (push) Has been skipped
CI / python-lint (push) Has been skipped
CI / nodejs-lint (push) Has been skipped
CI / test-go-consent (push) Successful in 29s
CI / test-python-voice (push) Successful in 29s
CI / test-bqas (push) Successful in 30s
- New POST /api/admin/investors/[id]/generate-link endpoint: creates a magic link without sending email, returns the URL for the admin to copy and share manually (for when email is filtered) - Adds 'Copy Link' button (emerald) to investor list and detail pages; link is copied to clipboard on click - New lib/masking.ts: maskOverdueInvestors() UPDATE that anonymizes email/name/company → revokes sessions 72h after first investor login - first_activity_at recorded on first verify (COALESCE, set once only) - migration 004 adds first_activity_at + data_masked_at columns with partial index; also wired into /api/admin/migrate for one-shot apply - Admin UI shows 'anonymized' badge, expiry countdown, and masked state; Copy Link + Resend are disabled for anonymized investors - verify route returns 410 if data_masked_at is set (belt-and-suspenders alongside the revoked status check) Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com> |
||
|
|
adfff6cfe4 |
fix(pitch-deck): exclude mcp-server from Next.js tsconfig + resolve FinanzplanSlide conflict
Build pitch-deck / build-push-deploy (push) Successful in 1m13s
CI / go-lint (push) Has been skipped
CI / python-lint (push) Has been skipped
CI / nodejs-lint (push) Has been skipped
CI / test-go-consent (push) Successful in 27s
CI / test-python-voice (push) Successful in 27s
CI / test-bqas (push) Successful in 31s
- tsconfig.json: add mcp-server to exclude list so the standalone MCP package's imports don't break the Next.js type-check build - FinanzplanSlide.tsx: resolve merge conflict, keep MonthlyGrid refactor from upstream (discards superseded inline table from stash) Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com> |
||
|
|
269464943e |
fix(pitch-deck): restore complete USPSlide with all helper functions
Build pitch-deck / build-push-deploy (push) Failing after 40s
CI / go-lint (push) Has been skipped
CI / python-lint (push) Has been skipped
CI / nodejs-lint (push) Has been skipped
CI / test-go-consent (push) Successful in 41s
CI / test-python-voice (push) Successful in 29s
CI / test-bqas (push) Successful in 26s
The previously committed version was missing useIsLight hook, all sub-components (PillarRow, ColHeader, CentralHub, BridgeConnectors, FeatureCard, DetailModal, StarField, ticker components) and their data/types. Only the main component shell was present, causing a CI build failure on type-check. Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com> |
||
|
|
28aa74b4b0 |
Merge remote-tracking branch 'gitea/main'
Build pitch-deck / build-push-deploy (push) Failing after 1m13s
CI / go-lint (push) Has been skipped
CI / python-lint (push) Has been skipped
CI / nodejs-lint (push) Has been skipped
CI / test-go-consent (push) Successful in 49s
CI / test-python-voice (push) Successful in 38s
CI / test-bqas (push) Successful in 31s
# Conflicts: # pitch-deck/components/slides/MilestonesSlide.tsx # pitch-deck/lib/finanzplan/engine.ts |
||
|
|
92c86ec6ba |
[split-required] [guardrail-change] Enforce 500 LOC budget across all services
Install LOC guardrails (check-loc.sh, architecture.md, pre-commit hook) and split all 44 files exceeding 500 LOC into domain-focused modules: - consent-service (Go): models, handlers, services, database splits - backend-core (Python): security_api, rbac_api, pdf_service, auth splits - admin-core (TypeScript): 5 page.tsx + sidebar extractions - pitch-deck (TypeScript): 6 slides, 3 UI components, engine.ts splits - voice-service (Python): enhanced_task_orchestrator split Result: 0 violations, 36 exempted (pipeline, tests, pure-data files). Go build verified clean. No behavior changes — pure structural splits. Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com> |
||
|
|
41bc522b5b |
fix(pitch-deck): close auth gaps, isolate finanzplan scenario access, enforce TS
Build pitch-deck / build-push-deploy (push) Failing after 1m4s
CI / go-lint (push) Has been skipped
CI / python-lint (push) Has been skipped
CI / nodejs-lint (push) Has been skipped
CI / test-go-consent (push) Successful in 57s
CI / test-python-voice (push) Successful in 42s
CI / test-bqas (push) Successful in 42s
D1: Remove /api/admin/fp-patch from PUBLIC_PATHS — it was returning live financial data (fp_liquiditaet rows) to any unauthenticated caller; middleware admin gate now applies as it does for all /api/admin/* paths. D2: Add PITCH_ADMIN_SECRET bearer guard to POST /api/financial-model (create scenario) and PUT /api/financial-model/assumptions (update assumptions) — any authenticated investor could previously create/modify global financial model data. D3: Add PITCH_ADMIN_SECRET bearer guard to POST /api/finanzplan/compute — any investor could trigger a full DB recomputation across all fp_* tables. Also replace String(error) in error response with a static message. D4: GET /api/finanzplan/[sheetName] now ignores ?scenarioId= for non-admin callers; investors always receive the default scenario only. Previously any investor could enumerate UUIDs and read any scenario's financials including other investors' plans. D9: Remove `name` from the non-admin /api/finanzplan response — scenario names like "Wandeldarlehen v2" reveal internal versioning to investors. D10: Remove hardcoded postgres://breakpilot:breakpilot123@localhost fallback from lib/db.ts — missing DATABASE_URL now fails loudly instead of silently using stale credentials that are committed to the repository. D6: Fix all 4 TypeScript errors that were masked by ignoreBuildErrors:true; bump tsconfig target to ES2018 (regex s flag in ChatFAB), type lang as 'de'|'en' in chat route, add 'as string' assertion in adapter.ts. Remove ignoreBuildErrors:true from next.config.js so future type errors fail the build rather than being silently shipped. Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com> |