* Add manual backup creation and delete buttons to Update Manager
- Add "Create Backup" button in the backups tab for on-demand backups
- Add delete buttons (trash icons) for update logs and backups
- New controller routes with CSRF protection and permission checks
- Use data-turbo-confirm for CSP-safe confirmation dialogs
- Add deleteLog() method to UpdateExecutor with filename validation
* Add Docker backup support: download button, SQLite restore fix, decouple from auto-update
- Decouple backup creation/restore UI from can_auto_update so Docker
and other non-git installations can use backup features
- Add backup download endpoint for saving backups externally
- Fix SQLite restore to use configured DATABASE_URL path instead of
hardcoded var/app.db (affects Docker and custom SQLite paths)
- Show Docker-specific warning about var/backups/ not being persisted
- Pass is_docker flag to template via InstallationTypeDetector
* Add tests for backup/update manager improvements
- Controller tests: auth, CSRF validation, 404 for missing backups, restore disabled check
- UpdateExecutor: deleteLog validation, non-existent file, successful deletion
- BackupManager: deleteBackup validation for missing/non-zip files
* Fix test failures: add locale prefix to URLs, correct log directory path
* Fix auth test: expect 401 instead of redirect for HTTP Basic auth
* Improve test coverage for update manager controller
Add happy-path tests for backup creation, deletion, download,
and log deletion with valid CSRF tokens. Also test the locked
state blocking backup creation.
* Fix CSRF tests: initialize session before getting tokens
* Fix CSRF tests: extract tokens from rendered page HTML
* Harden backup security: password confirmation, CSRF, env toggle
Address security review feedback from jbtronics:
- Add IS_AUTHENTICATED_FULLY to all sensitive endpoints (create/delete
backup, delete log, download backup, start update, restore)
- Change backup download from GET to POST with CSRF token
- Require password confirmation before downloading backups (backups
contain sensitive data like password hashes and secrets)
- Add DISABLE_BACKUP_DOWNLOAD env var (default: disabled) to control
whether backup downloads are allowed
- Add password confirmation modal with security warning in template
- Add comprehensive tests: auth checks, env var blocking, POST-only
enforcement, status/progress endpoint auth
* Fix download modal: use per-backup modals for CSP/Turbo compatibility
- Replace shared modal + inline JS with per-backup modals that have
filename pre-set in hidden fields (no JavaScript needed)
- Add data-turbo="false" to download forms for native browser handling
- Add data-bs-dismiss="modal" to submit button to auto-close modal
- Add hidden username field for Chrome accessibility best practice
- Fix test: GET on POST-only route returns 404 not 405
* Fixed translation keys
* Fixed text justification in download modal
* Hardenened security of deleteLogEndpoint
* Show whether backup, restores and updates are allowed or disabled by sysadmin on update manager
* Added documentation for update manager related env variables
---------
Co-authored-by: Jan Böhmer <mail@jan-boehmer.de>
After cache warmup, create a temporary PHP script in the public
directory and invoke it via HTTP to reset OPcache in the PHP-FPM
context. This prevents stale bytecode from causing 500 errors when
the progress page refreshes after code has been updated.
The reset is also performed after rollback and during restore.
Uses a random token in the filename for security, and the script
self-deletes after execution with a cleanup in the finally block.
* feat(parts table): add eda reference prefix and value columns
* Use better labels for column names and made it visible as default column selection
---------
Co-authored-by: Jan Böhmer <mail@jan-boehmer.de>
* Add stock quantity, datasheet URL, and HTTP caching to KiCad API
- Add Stock field showing total available quantity across all part lots
- Add Storage Location field when parts have stored locations
- Resolve actual datasheet PDF from attachments (by type name, attachment
name, or first PDF) instead of always linking to Part-DB page
- Keep Part-DB page URL as separate "Part-DB URL" field
- Add ETag and Cache-Control headers to all KiCad API endpoints
- Support conditional requests (If-None-Match) returning 304
- Categories/part lists cached 5 min, part details cached 1 min
* Add KiCadHelper unit tests and fix PDF detection for external URLs
- Add comprehensive KiCadHelperTest with 14 test cases covering:
- Stock quantity calculation (zero, single lot, multiple lots)
- Stock exclusion of expired and unknown-quantity lots
- Storage location display (present, absent, multiple)
- Datasheet URL resolution by type name, attachment name, PDF extension
- Datasheet fallback to Part-DB URL when no match
- "Data sheet" (with space) name variant matching
- Fix PDF extension detection for external attachments (getExtension()
returns null for external-only attachments, now also parses URL path)
* Fix 304 response body, parse_url safety, and location/stock consistency
- Use empty Response instead of JsonResponse(null) for 304 Not Modified
to avoid sending "null" as response body
- Guard parse_url() result with is_string() since it can return false
for malformed URLs
- Move storage location tracking inside the availability check so
expired and unknown-quantity lots don't contribute locations
* Fix testPartDetailsPart2 to actually test Part 2
The test was requesting /parts/1.json instead of /parts/2.json and had
Part 1's expected data. Now tests Part 2 which inherits EDA info from
its category and footprint, verifying the inheritance behavior.
* Use Symfony's built-in ETag handling for HTTP caching
Replace manual If-None-Match comparison with Response::setEtag() and
Response::isNotModified(), which properly handles ETag quoting, weak
vs strong comparison, and 304 response cleanup. Fixes PHPStan return
type error and CI test failures.
* Add configurable KiCad field export for part parameters
Add a kicad_export checkbox to parameters, allowing users to control
which specifications appear as fields in the KiCad HTTP library API.
Parameters with kicad_export enabled are included using their formatted
value, without overwriting hardcoded fields like description or Stock.
* Add partdb:kicad:populate command for bulk KiCad path assignment
Console command that populates KiCad footprint/symbol paths on Footprint
and Category entities based on name-to-library mappings. Supports dry-run,
force overwrite, and list modes. Includes 130+ footprint mappings and 30+
category symbol mappings for KiCad 9.x standard libraries.
* Add CSV import support for EDA/KiCad fields
Add user-friendly column aliases (kicad_symbol, kicad_footprint,
kicad_reference, kicad_value, eda_exclude_bom, etc.) to the CSV import
system. Users can now bulk-set KiCad symbols, footprints, and other EDA
metadata via CSV/Excel import without knowing the internal dot notation.
* Add batch EDA field editing from parts table
Users can now select multiple parts in any parts table and batch-edit
their EDA/KiCad fields (symbol, footprint, reference prefix, value,
visibility, exclude from BOM/board/sim). Each field has an "Apply"
checkbox so users control exactly which fields are changed.
* Remove unused counter variable in BatchEdaController
* Fix PHPStan errors in PopulateKicadCommand and BatchEdaController
Add @var type annotations for Doctrine repository findAll() calls so
PHPStan can resolve getEdaInfo() on Footprint/Category entities. Fix
array return type for numeric-string keys and add explicit callback to
array_filter to satisfy strict rules.
* Fix batch EDA edit: required validation and pre-populate shared values
- Add required=false to TriStateCheckboxType fields so HTML5 validation
doesn't force users to check visibility/BOM/board checkboxes
- Pre-populate form fields when all selected parts share the same EDA
value, so users can see current state before editing
* Add KiCad API v2, orderdetail export control, EDA status indicator, BOM improvements
- Add KiCad API v2 endpoints (/kicad-api/v2) with volatile field support
for stock and storage location (shown but not saved to schematic)
- Add kicad_export flag to Orderdetail entity for per-supplier SPN control
(backward compatible: if no flag set, all SPNs exported as before)
- Add EDA completeness indicator column in parts datatable (bolt icon)
- Add ?minimal=true query param for faster category parts loading
- Improve category descriptions (use comment instead of URL when available)
- Improve BOM importer multi-footprint support: merge entries by Part-DB
part ID when linked, tracking footprint variants in comments
- Fix KiCost manf/manf# fields always present (not conditional on orderdetails)
- Fix duplicate getEdaInfo() call in shouldPartBeVisible
- Consolidate supplier SPN and KiCost field generation into single loop
* Fix kicad_export column default for SQLite compatibility
Add options default to ORM column definition so schema:update
works correctly on SQLite test databases.
* Make EDA status bolt icon clickable to open EDA settings tab
* Fix EDA bolt link to correctly open EDA tab via data-turbo=false
* Add configurable datasheet URL mode for KiCad API
New setting "Datasheet field links to PDF" in KiCad EDA settings.
When enabled (default), the datasheet field resolves to the actual
PDF attachment URL. When disabled, it links to the Part-DB page
(old behavior). Configurable via settings UI or EDA_KICAD_DATASHEET_AS_PDF env var.
* Fix settings crash when upgrading: make datasheetAsPdf nullable
The settings bundle stores values in the database. When upgrading from
a version without datasheetAsPdf, the stored JSON lacks this key,
causing a TypeError when assigning null to a non-nullable bool.
Making it nullable with a fallback in KiCadHelper fixes the upgrade path.
* Add functional tests for KiCad API v2 and batch EDA controller
- KiCadApiV2ControllerTest: root, categories, parts, volatile fields,
v1 vs v2 comparison, cache headers, 304 conditional request, auth
- BatchEdaControllerTest: page load, empty redirect, form submission
* Fix test failures: correct ids format and anonymous access assertion
* Improve test coverage for BatchEdaController
Add tests for: applying all EDA fields at once, custom redirect URL,
and verifying unchecked fields are skipped.
* Address PR review: rename to eda_visibility, merge migrations, API versioning
Changes based on jbtronics' review of PR #1241:
- Rename kicad_export -> eda_visibility (entities, forms, templates,
translations, tests) with nullable bool for system default support
- Merge two database migrations into one (Version20260211000000)
- Rename createCachedJsonResponse -> createCacheableJsonResponse
- Change bool $apiV2 -> int $apiVersion with version validation
- EDA visibility field only shown for part parameters, not other entities
- PopulateKicadCommand: check alternative names of footprints/categories
- PopulateKicadCommand: support external JSON mapping file (--mapping-file)
- Ship default mappings JSON at contrib/kicad-populate/default_mappings.json
- Add system-wide defaultEdaVisibility setting in KiCadEDASettings
- Add KiCad HTTP Library v2 spec link in controller docs
* Fix duplicate loadMappingFile method causing PHP fatal error
* Add tests for mapping file and alternative name matching, update populate command docs
Add 5 new tests for PopulateKicadCommand covering:
- Custom mapping file overriding defaults
- Invalid JSON mapping file error handling
- Missing mapping file error handling
- Footprint alternative name matching
- Category alternative name matching
Update contrib README to document --mapping-file option,
alternative name matching, and custom JSON mapping format.
* Split out KiCad API v2 into separate PR as requested by maintainer
Remove v2 controller, tests, and volatile field support from this PR.
The v2 API will be submitted as a separate PR for focused discussion.
* Improve test coverage for KiCadHelper and PopulateKicadCommand
KiCadHelper: Add tests for orderdetail eda_visibility filtering,
backward compatibility when no flags set, manufacturer/KiCost fields,
and parameter with empty name skipping.
PopulateKicadCommand: Add tests for mapping file with both footprints
and categories sections, and mapping file with only categories.
* Load populate Kicad default mappings from json file
* Moved kicad:populate documentation to central docs
* Added introduced column to PartTableColumns to make it configurable in the settings
* Use TristateCheckboxes for parameter and orderdetail types
* Fixed translation keys
* Split up default eda visibility for parameters and purchase infos
---------
Co-authored-by: Jan Böhmer <mail@jan-boehmer.de>
* add option to disable keybindings
* add tests for disabling keybindings
* Fixed translation keys
* Added env to env configuration list
* Removed useless tests
The tests are already enforced by type declarations
---------
Co-authored-by: Jan Böhmer <mail@jan-boehmer.de>
* added handling of LCSC barcode decoding and part loading on Label Scanner
* when a part is scanned and not found, the scanner did not redraw so scanning subsequent parts was not possible without reloading the browser page. fixed the barcode scanner initialization and shutdown so it redraws properly after part not found
* added redirection to part page on successful scan of lcsc, digikey, and mouser barcodes. added create part button if part does not exist in database
* added augmented mode to label scanner to use vendor labels for part lookup to see part storage location quickly
* shrink camera height on mobile so augmented information can been viewed onscreen
* handle momentarily bad reads from qrcode library
* removed augmented checkbox and combined functionality into info mode checkbox. changed barcode scanner to use XHR callback for barcode decoding to avoid problems with form submission and camera caused by page reloaded when part not found.
* fix scanning of part-db barcodes to redirect to storage location or part lots. made scan result messages conditional for parts or other non-part barcodes
* fix static analysis errors
* added unit tests for meeting code coverage report
* fix @MayNiklas reported bug: when manually submitting the form (from a barcode scan or manual input) redirect to Create New part screen for the decoded information instead of showing 'Format Unknown' popup error message
* fix @d-buchmann bug: clear 'scan-augmented-result' field upon rescan of new barcode
* fix @d-buchmann bug: after scanning in Info mode, if Info mode is turned off when scanning a part that did not exist, it now redirects user to create part page
* fix @d-buchmann bug: make barcode decode table 100% width of page
* fix bug with manual form submission where a part does not exist but decodes properly which causes the camera to not redraw on page reload due to unclean shutdown. this is an existing bug in the scanner interface.
steps to produce the issue:
- have camera active
- put in code in Input
- info mode ticked
- click submit button
on page reload the camera does not reactivate
* fixed translation messages
* Use symfony native functions to generate the routes for part creation
* Use native request functions for request param parsing
* Refactored LCSCBarcocdeScanResult to be an value object like the other Barcode results
* Added test for LCSCBarcodeScanResult
* Fixed exception when submitting form for info mode
* Made BarcodeSourceType a backed enum, so that it can be used in Request::getEnum()
* Moved database queries from BarcodeRedirector to PartRepository
* Fixed modeEnum parsing
* Fixed test errors
* Refactored BarcodeRedirector logic to be more universal
* Fixed BarcodeScanResultHandler test
* Refactored BarcodeScanResultHandler to be able to resolve arbitary entities from scans
* Moved barcode to info provider logic from Controller to BarcodeScanResultHandler service
* Improved augmentented info styling and allow to use it with normal form submit too
* Correctly handle nullable infoURL in ScanController
* Replaced the custom controller for fragment replacements with symfony streams
This does not require a complete new endpoint
* Removed data-lookup-url attribute from scan read box
* Removed unused translations
* Added basic info block when an storage location was found for an barcode
* Fixed phpstan issues
* Fixed tests
* Fixed part image for mobile view
* Added more tests for BarcodeScanResultHandler service
* Fixed tests
---------
Co-authored-by: Jan Böhmer <mail@jan-boehmer.de>
* init API endpoint for generating labels
* Improved API docs for label endpoint
* Improved LabelGenerationProcessor
---------
Co-authored-by: Jan Böhmer <mail@jan-boehmer.de>
