Release 1.8.0: staff area with cataloguing, circulation and plugin content, offline catalogue and a loans calendar - #47

…calendar

Mobile API 1.6.0 support without any UI change yet: the staff_catalog, catalog_sync and calendar_feed health flags (off on older servers); the user role kept in SessionStore from login and GET /me, with StaffAccess deciding who sees the staff area; StaffApi and StaffRepository for every /staff route (a 403 drops the stored role); tolerant models for lookups, ISBN lookups, books, authors, publishers, genres and shelves; 409 duplicate and conflict context kept in ApiResult.Failure.meta.

Pure, unit-tested logic: IsbnCodec (EAN-13 and ISBN-10 checksums, ISBN-10 to 13), ScanDebouncer (two identical reads, 3 s suppression, pause), StaffBookForm with StaffBookWrite (create body, true patch for edits that re-sends preserved contributors), SyncMerge (last change wins, full resync, weekly forced pass) and CalendarLinks.

Room schema v2 replaces the 40-row snapshot with the whole catalogue plus cached loans, reservations, wishlist and sync bookkeeping. CatalogRepository.syncCatalog() pages through GET /catalog/sync, applies the result in one transaction and only then stores the watermark; servers without the endpoint keep the old snapshot. Loans and wishlist are written through on every fetch and purged on sign-out or a new sign-in. The sync worker refreshes the personal lists too, the cache database is excluded from backups and the foreground observer also refreshes the role.

Search falls back to the cached catalogue (title, author, publisher and identifier match, the same facets by value, offset paging, title or newest order) under an offline banner. A book page is built from the cache with a notice; Library and Wishlist show the last lists the server sent.

Availability cannot be guaranteed offline, so loan and reservation affordances are hidden, never disabled: no request or reserve button, no loan calendar, no cancel actions, no wishlist toggle or reviews. Cached availability is never shown as current: the book page says when it was last known (sync time), status pills are hidden on cached cards and the cached Home shelf is labelled as recently added instead of available now. OfflinePolicy holds the decision and is unit-tested.

Profile shows "Loans in your calendar" when the server advertises calendar_feed and loans are on. The sheet creates the private ICS link, leads with Copy link (Google Calendar on Android cannot subscribe from the device; the hint explains the website route), opens it as webcal:// with the HTTPS link as fallback, and offers Regenerate and Turn off, both behind a confirmation because existing subscriptions stop updating.

Profile also shows "Staff area" for admin and staff users on servers with staff_catalog, and GET /me now refreshes the stored role.

Staff hub (Profile, or the scan button on the Catalog tab) for admin and staff users on servers with staff_catalog. Books: searchable list of every record with edit and delete (refused with a clear message while loans or reservations are active). One create/edit form serves scanned titles and records without an ISBN: live identifier validation, author and publisher pickers with add-new, genre and subgenre, media type, language/format/acquisition suggestions from the lookups, shelf and level with the next free position, copies (create) or add copies (edit), and a cover from a URL, a photo or a picked image (resized, EXIF-rotated JPEG under 2 MB, uploaded after the save). A 409 duplicate offers Open existing, Add copy or Change identifier. Authors, publishers, genres (tree, find-or-create) and shelves with levels have their own screens.

Scanner: CameraX preview with a viewfinder, ZXing EAN-13 decoding on alternate rotated frames, checksum validation and the double-read debouncer. Batch mode remembers copies, shelf, level and an opt-in auto-confirm; preview, duplicate and not-found sheets lead to add, add copies, edit details or create manually. The manual ISBN/EAN field is always visible for emulators and denied permission. CAMERA is requested only here, with a rationale and a settings fallback when it is permanently denied; camera.any is optional so devices without a camera still install the app. Without a connection the scanner says that scanning needs one.

…oans calendar

Bump the version and record the new features, their server requirement (Mobile API 1.6.0) and what is not yet verified on a device in STATUS.md and the Uwe parity notes.

The feed URL carries a bearer-equivalent token. Copy link now flags the clip as sensitive (ClipDescription.EXTRA_IS_SENSITIVE on Android 13+, the same extra key before) with a neutral label, so the clipboard preview and keyboards do not show or keep it, and the sheet shows only the host and the last six characters instead of the full URL. The URL is never logged.

Blank fields became null and the shared Json drops null keys, so the server kept the old value and a pseudonym, date, website or GND id could never be emptied. Every editable field is now always sent, trimmed, with a cleared field as an empty string, which the server stores as empty (dates and the GND id as NULL). RecordWritesTest checks the encoded bodies.

A search or pull-to-refresh during a page load dropped that page through the generation check but left loadingMore set, so loadMore() never ran again. reload() now clears the flag.

Picking a shelf without a level sent null shelf and level ids, which cleared the stored location without a word. A shelf without a level is now a validation error with a message under the level field (all four languages); nulls are sent only when the shelf is set to none, and a stored location without a level is left untouched instead of making the form invalid.

When the record saved but the cover upload failed, the screen navigated away and the error was lost. It now stays on the saved record (switching a create into an edit of the new id), keeps the pending cover so the next Save retries it, and says so.

Search: rows store a folded search key (NFD, combining marks removed, lower case; identifiers without dashes or spaces) and queries are folded the same way, so Città, Über or ÆRØ match regardless of accents and case. LIKE metacharacters in the query and the author/publisher filters are escaped with ESCAPE, and identifier-like queries drop their separators. Room schema v3 (destructive, refilled by the next full sync).

Sync: a page with has_more and no cursor now fails the run instead of applying a partial result and advancing the watermark. Clearing the cache (forget instance) bumps a generation under a write lock that every sync write also takes, so a run in flight can no longer write the old library's rows or watermark after the clear. The book detail ETag cache is concurrent.

Any 403 counted as a revoked role, so a WAF or proxy block wiped the stored role and closed the form. ApiResult.Failure now records whether its code came from the server's envelope, and only an envelope error.code of forbidden drops the role.

A ConnectivityObserver (system default-network callback, Hilt singleton) now feeds Home, Search, book detail, Library and Wishlist. When the device goes offline, screens already loaded online hide availability pills, the available-now claim, loan and reservation buttons, the loan calendar, cancel and remove actions at once; when it comes back they reload and the offline catalogue syncs. Unit tests cover each screen state.

A NETWORK failure never reaches the UI as its IOException text: resolvedMessage() and the new uiText()/serverMessage() helpers give a localized offline message, Library and Wishlist without a saved copy show an offline empty state, Home shows the same wording, staff screens map their load errors likewise, and the desiderata, archive and article sections of Catalog search are hidden when they fail only for lack of a connection. The author, publisher and genre pickers and lists get their own search placeholders.

Counts read "Copies: 1" style in every language instead of a plural noun after the number ("1 copies"): batch copies, added this session, copies added, available of total and the offline last-known line. The calendar sheet now says the feed carries loans (due dates, books ready for pickup, booked loans), not reservations.

The header kept the role of the profile loaded when the screen opened, so a downgraded admin still read Admin while the staff entries had already gone. It now shows the stored role, refreshed by every GET /me, and Profile re-reads GET /me quietly when it comes back to the foreground.

A staff create runs the whole admin pipeline (scraper hooks, cover download) and took over 30 s on a loaded server during the live smoke test: the app timed out and reported a failure for a record the server had already saved. The read timeout is now 60 s; the connect timeout is unchanged, so an unreachable server is still detected quickly.

The new staffe2e suite drives the real app (MainActivity, real Hilt graph, ViewModels, repositories and Room) against FakePinakes, a MockWebServer on the device loopback that answers JSON fixtures from androidTest/assets/fixtures and records every request. UiAutomator handles the system camera prompt; airplane mode is real.

Covered: staff entry only for admin/staff with staff_catalog (hidden for standard users, without the flag and after a server-side downgrade, header included); scanner manual ISBN to preview to add with the counter, duplicate to add copies, not found to the manual form, invalid code rejected without a lookup, camera denied keeps manual entry; manual form with a missing title or a shelf without a level sends nothing, an edit sends only the changed key; offline search banner with cached results and no availability or loan actions, offline detail with the last-known wording and no loan buttons, Library and Wishlist offline empty state without raw exception text, going offline after an online load hides the loan button and reconnecting restores it; calendar link shown masked, copied as sensitive, regenerate and turn off both confirm. 18 tests, all green on Android 15 together with the 22 existing ones.

tools/e2e/live-smoke.sh drives the installed app on an emulator with adb and uiautomator (tools/e2e/ui.py) like a user: onboarding, sign-in, staff hub, scan-add of an ISBN with two copies, a copy through the duplicate sheet, a record without ISBN, its shelf and level on edit (checking that nothing else changed), airplane-mode search and detail, the calendar link and its feed. Every step is checked through the Mobile API, and cleanup removes only what the run created (books, a calendar link that did not exist before, device tokens issued during the run) and clears the app. Instance URL and credentials come only from PINAKES_E2E_* variables; texts follow the device language through i18n/*.json. STATUS.md documents how to run it and the device tests.

The administrator can now hide the gender and tax code fields. The app reads it from GET /me (hidden_fields, the keys themselves omitted), from the registration schema (profile_fields.*.visible) and from /health (registration.show_*): a hidden field is not rendered in the profile editor and never sent in PATCH /me. Servers that send none of these keep both fields, as before. Registration never asked for them and still does not. Profile re-reads the schema with /me when it comes back to the foreground.

Tests: ProfileFieldVisibilityTest for the decision and the payloads; ProfileFieldsFlowTest on the device for hidden and shown fields, registration, and the birth-date picker fitting a 360dp screen.

Staff Authors and Publishers rows now open a detail page: a padded info card (books in the catalogue, life dates, nationality, website, GND id or the publisher's contacts, and created/updated when the server sends them) and the record's books from GET /staff/books?author_id= (publishers by name), drawn with the whole-cover book cards. Editing moved to the page's edit action. The catalogue filtered by an author gets the same kind of card above the results. The pending cover preview in the book form and the covers in My reviews now fit instead of cropping.

The loan request used Material's DatePickerDialog, which is a fixed 360dp wide with a capped height, and day cells were a fixed 40dp: on 320-360dp phones the month was clipped and cells ran into each other. The request is now a plain dialog sized to the screen (16dp margins, at most 420dp, scrollable), day cells fill their column (at most 44dp), weekday headers share the grid's spacing, and the legend wraps. When availability cannot be loaded the same grid lets the user pick any future day instead of a second date picker. CalendarLayoutTest checks the 7 weekday columns, that every day cell stays inside the screen and inside a 320dp column, and month navigation.

With database access configured, the smoke test hides gender and tax code in the settings table, waits for /health to report it, checks that /me omits them and that the app's profile editor no longer shows them, then restores the previous values. STATUS.md lists the new device tests.

submitSearch(), setSort() and clearFilters() each started another connectivity collector that was never cancelled, so one reconnect re-ran the search once per earlier interaction. Only the collector started in init remains. ConnectivityCollectorTest checks that a single collector is left after repeated searches, sorts and filter resets.

Creating, regenerating or turning off the calendar link, saving the profile and changing the password showed the IOException text when offline. They now use the server's own message or the localized offline wording.

"Add copy" sent the form's copy count, which in edit mode is the edited record's own total: an ISBN change that collided with another book added that many copies to it. Editing now adds exactly one; creating keeps the copies the user asked for.

The 3 s window started when a code was accepted, but the lookup and the open sheet usually last longer, so after Skip or Add the book still under the camera reopened the same sheet. resume(now) restarts the window for the last accepted code; other codes are not held back.

At 360 dp the Reservations tab wrapped mid-word ("Reservation" / "s"), and German and Italian labels are just as long. The tabs are now a scrollable row with single-line labels, like the circulation desk.

Adds 24 screenshots of the 1.8.0 staff area (circulation desk, cataloguing and plugin content), captured on Android 15 at 360 dp against a local instance with demo data and resized to 720 px, and lists the staff area, circulation desk, offline catalogue and loans calendar in the features table.

The book page is its own destination above the tabs, so the Home/Catalogue/Library/Wishlist/Profile bar vanished there. The selected tab now lives in the nav host: the book page shows the same bar with the tab it was opened from, and a tap returns to that tab.

The draft kept only voting, current and archived and sent only those three, so renaming a label stripped every other flag the server stored (votable on proposed, or any flag a later plugin version adds). Each state now carries its original flags object and the editor overwrites only the three it controls.

Revoking a granted permission from inside the test kills the instrumentation process, which shares the app's UID, and the rest of the suite with it. The test now skips with the adb command that resets the permission, the README run steps include it, and STATUS.md names versionCode 22.