Switched password hashing algorithm

* add support for data: URI images for external barcode lookup plugins

* Adapt existing code style

---------

Co-authored-by: Bernd Bestel <bernd@berrnd.de>

.devtools/create_release_package.bat

@@ -10,9 +10,9 @@ for /f "tokens=*" %%a in ('jq .Version versiontemp.json --raw-output') do set ve
 del versiontemp.json
 
 del "%releasePath%\grocy_%version%.zip"
-7za a -r "%releasePath%\grocy_%version%.zip" "%projectPath%\*" -xr!.* -xr!build.bat -xr!composer.json -xr!composer.lock -xr!package.json -xr!yarn.lock -xr!publication_assets
+7za a -r "%releasePath%\grocy_%version%.zip" "%projectPath%\*" -xr!.* -xr!build.bat -xr!composer.json -xr!composer.lock -xr!package.json -xr!yarn.lock -xr!docs -xr!test -x!public\packages\@fortawesome\fontawesome-free\js -x!public\packages\@fortawesome\fontawesome-free\less -x!public\packages\@fortawesome\fontawesome-free\metadata -x!public\packages\@fortawesome\fontawesome-free\scss -x!public\packages\@fortawesome\fontawesome-free\sprites -x!public\packages\@fortawesome\fontawesome-free\svgs
 7za a "%releasePath%\grocy_%version%.zip" "%projectPath%\public\.htaccess"
 7za rn "%releasePath%\grocy_%version%.zip" .htaccess public\.htaccess
-7za d "%releasePath%\grocy_%version%.zip" data\*.* data\storage data\viewcache\*
+7za d "%releasePath%\grocy_%version%.zip" data\*.* data\storage data\viewcache\* changelog\__TEMPLATE.md
 7za a "%releasePath%\grocy_%version%.zip" "%projectPath%\data\.htaccess"
 7za rn "%releasePath%\grocy_%version%.zip" .htaccess data\.htaccess

.devtools/data_generation_scripts/9999_big_stock.php

@@ -0,0 +1,27 @@
+<?php
+
+// This is executed inside DatabaseMigrationService class/context
+
+use Grocy\Services\StockService;
+
+$PRODUCTS = [3, 4, 5, 6, 7, 8];
+
+$i = 1;
+$days = -1;
+while ($i <= 500)
+{
+	$productId = $PRODUCTS[array_rand($PRODUCTS)];
+	$transactionId1 = $this->getStockService()->AddProduct($productId, 1, date('Y-m-d', strtotime('+180 days')), StockService::TRANSACTION_TYPE_PURCHASE, date('Y-m-d', strtotime("$days days")), XRandomPrice());
+	$transactionId2 = $this->getStockService()->ConsumeProduct($productId, 1, false, StockService::TRANSACTION_TYPE_CONSUME);
+
+	$this->getDatabaseService()->ExecuteDbStatement("UPDATE stock_log SET row_created_timestamp = DATETIME(row_created_timestamp, '$days days') WHERE transaction_id = '$transactionId1'");
+	$this->getDatabaseService()->ExecuteDbStatement("UPDATE stock_log SET row_created_timestamp = DATETIME(row_created_timestamp, '$days days') WHERE transaction_id = '$transactionId2'");
+
+	$days--;
+	$i++;
+}
+
+function XRandomPrice()
+{
+	return mt_rand(2 * 100, 25 * 100) / 100 / 4;
+}

.devtools/data_generation_scripts/9999_lots_recipes.php

@@ -0,0 +1,16 @@
+<?php
+
+// This is executed inside DatabaseMigrationService class/context
+
+use Grocy\Services\RecipesService;
+
+$recipesService = RecipesService::getInstance();
+
+for ($i = 1; $i <= 87; $i++)
+{
+	$recipesService->CopyRecipe(1);
+	$recipesService->CopyRecipe(2);
+	$recipesService->CopyRecipe(3);
+	$recipesService->CopyRecipe(4);
+	$recipesService->CopyRecipe(5);
+}

.devtools/data_generation_scripts/9999_reset_admin_password.php

@@ -0,0 +1,19 @@
+<?php
+
+// This is executed inside DatabaseMigrationService class/context
+
+$db = $this->getDatabaseService()->GetDbConnection();
+
+// Reset the password of the user "admin" to "admin"
+$adminUserRow = $db->users()->where('username', 'admin')->fetch();
+
+if ($adminUserRow == null)
+{
+	$adminUserRow = $db->users()->createRow([
+		'username' => 'admin'
+	]);
+}
+
+$adminUserRow->update([
+	'password' => password_hash('admin', PASSWORD_ARGON2ID)
+]);

.devtools/install_dependencies.bat

@@ -1,4 +1,5 @@
 pushd ..
+set COMPOSER_FUND=0
 call composer install
-yarn install
+call yarn install
 popd

.devtools/transifex_check_for_new_languages.bat

@@ -0,0 +1,3 @@
+pushd ..
+tx pull --all --resources grocy.strings --minimum-perc=70
+popd

.devtools/transifex_download.bat

@@ -1,9 +1,17 @@
 pushd ..
-tx pull --all --minimum-perc=80
-tx pull --language en_GB
+
+for /d %%d in (localization\*) do (
+	if %%~nxd neq en (
+		tx pull --languages %%~nxd --force
+	)
+)
+
 copy /Y localization\en\userfield_types.po localization\en_GB\userfield_types.po
 copy /Y localization\en\stock_transaction_types.po localization\en_GB\stock_transaction_types.po
 copy /Y localization\en\component_translations.po localization\en_GB\component_translations.po
 copy /Y localization\en\chore_period_types.po localization\en_GB\chore_period_types.po
 copy /Y localization\en\chore_assignment_types.po localization\en_GB\chore_assignment_types.po
+copy /Y localization\en\permissions.po localization\en_GB\permissions.po
+copy /Y localization\en\locales.po localization\en_GB\locales.po
+
 popd

.devtools/transifex_upload.bat

@@ -1,3 +1,3 @@
 pushd ..
-tx push --source
+tx push --source --force
 popd

.devtools/update_dependencies.bat

@@ -1,4 +1,5 @@
 pushd ..
+set COMPOSER_FUND=0
 call composer update
-yarn upgrade --latest
+call yarn upgrade
 popd

.github/CONTRIBUTING.md

@@ -0,0 +1,14 @@
+## Help & Usage Questions
+→  [r/grocy on Reddit](https://www.reddit.com/r/grocy)
+
+## Bug Reports & Feature Requests
+→ [Issue Tracker](https://github.com/grocy/grocy/issues/new/choose)
+
+## Say thanks
+&rarr; <https://grocy.info/#say-thanks>
+
+## Translations
+&rarr; [Transifex](https://explore.transifex.com/grocy/grocy/)
+
+## Pull Requests
+This project does not accept code contributions.

.github/FUNDING.yml

@@ -0,0 +1 @@
+custom: ["https://grocy.info/#say-thanks"]

.github/ISSUE_TEMPLATE/bug-report.md

@@ -0,0 +1,21 @@
+---
+name: Bug Report
+about: If you've found something that does not work, please report it to help improve Grocy
+title: 'Bug: '
+labels: bug
+assignees: ''
+
+---
+
+<!--
+Please make sure to:
+
+- Describe the bug as detailed as possible by providing the exact steps how to reproduce it
+- Attach screenshots where useful
+- Check if the problem was maybe already reported or fixed by searching open and also already closed requests here
+- Keep it to one topic per request
+
+Please also try to reproduce the problem on the pre-release demo: => https://demo-prerelease.grocy.info
+- Use a private demo instance to make your example persistent
+- If the problem is not reproducible there, it's most likely not a bug - please use the r/grocy subreddit for general help and usage questions: => https://www.reddit.com/r/grocy
+-->

.github/ISSUE_TEMPLATE/config.yml

@@ -0,0 +1,5 @@
+blank_issues_enabled: false
+contact_links:
+    - name: Help & Usage Questions
+      url: https://www.reddit.com/r/grocy
+      about: Please use the r/grocy subreddit for general help and usage questions

.github/ISSUE_TEMPLATE/feature-request.md

@@ -0,0 +1,16 @@
+---
+name: Feature Request
+about: Ideas for improvements or new things which you would find useful are always welcome
+title: 'Feature Request: '
+labels: enhancement
+assignees: ''
+
+---
+
+<!--
+Please make sure to:
+
+- Describe what you would find useful as detailed as possible
+- Check if your idea was maybe already requested by searching open and also already closed requests here
+- Keep it to one topic per request
+-->

.github/PULL_REQUEST_TEMPLATE.md

@@ -0,0 +1 @@
+This project does not accept code contributions.

.github/SECURITY.md

@@ -0,0 +1,5 @@
+Grocy is not an enterprise application and neither one you (should) host publicly (means without authentication) on the internet.
+
+So unless something really bad can be abused _unauthenticated_, it's considered practically irrelevant for the target use case of Grocy and therefore not even worth reporting that.
+
+If you really think you've found something critical and valid for the target use case of Grocy and you feel the need to contact me privately on that, please see [berrnd.de](https://berrnd.de) for any contact information.

.gitignore

@@ -1,4 +1,4 @@
-/public/node_modules
-/vendor
-/.release
 embedded.txt
+/.release
+/packages
+/public/packages

.php-cs-fixer.php

@@ -0,0 +1,54 @@
+<?php
+
+$finder = PhpCsFixer\Finder::create()
+	->exclude(['packages'])
+	->ignoreVCSIgnored(true)
+	->files()->name('*.php')
+	->in(__DIR__);
+
+$cfg = new PhpCsFixer\Config();
+return $cfg
+	->setRules([
+		'@PSR2' => true,
+		'array_indentation' => true,
+		'array_syntax' => ['syntax' => 'short'],
+		'combine_consecutive_unsets' => true,
+		'class_attributes_separation' => true,
+		'class_attributes_separation' => ['elements' => ['const' => 'none', 'property' => 'none']],
+		'multiline_whitespace_before_semicolons' => false,
+		'single_quote' => true,
+		'blank_line_after_opening_tag' => true,
+		'curly_braces_position' => [
+			'control_structures_opening_brace' => 'next_line_unless_newline_at_signature_end',
+			'anonymous_functions_opening_brace' => 'next_line_unless_newline_at_signature_end'
+		],
+		'control_structure_continuation_position' => [
+			'position' => 'next_line'
+		],
+		'cast_spaces' => [
+			'space' => 'none'
+		],
+		'concat_space' => ['spacing' => 'one'],
+		'declare_equal_normalize' => true,
+		'type_declaration_spaces' => true,
+		'single_line_comment_style' => ['comment_types' => ['hash']],
+		'include' => true,
+		'lowercase_cast' => true,
+		'no_leading_import_slash' => true,
+		'no_leading_namespace_whitespace' => true,
+		'no_multiline_whitespace_around_double_arrow' => true,
+		'no_spaces_around_offset' => true,
+		'no_whitespace_before_comma_in_array' => true,
+		'no_whitespace_in_blank_line' => true,
+		'object_operator_without_whitespace' => true,
+		'blank_lines_before_namespace' => true,
+		'ternary_operator_spaces' => true,
+		'trim_array_spaces' => true,
+		'unary_operator_spaces' => true,
+		'whitespace_after_comma_in_array' => true,
+		'no_trailing_comma_in_singleline' => true
+	])
+	->setIndent("\t")
+	->setLineEnding("\n")
+	->setUsingCache(false)
+	->setFinder($finder);

.tx/config

@@ -1,44 +1,56 @@
 [main]
 host = https://www.transifex.com
 
-[grocy.chore_period_types]
-file_filter = localization/<lang>/chore_period_types.po
-source_file = localization/chore_period_types.pot
-source_lang = en
-type = PO
-
-[grocy.chore_assignment_types]
+[o:grocy:p:grocy:r:chore_assignment_types]
 file_filter = localization/<lang>/chore_assignment_types.po
 source_file = localization/chore_assignment_types.pot
 source_lang = en
-type = PO
+type        = PO
 
-[grocy.component_translations]
+[o:grocy:p:grocy:r:chore_period_types]
+file_filter = localization/<lang>/chore_period_types.po
+source_file = localization/chore_period_types.pot
+source_lang = en
+type        = PO
+
+[o:grocy:p:grocy:r:component_translations]
 file_filter = localization/<lang>/component_translations.po
 source_file = localization/component_translations.pot
 source_lang = en
-type = PO
+type        = PO
 
-[grocy.demo_data]
+[o:grocy:p:grocy:r:demo_data]
 file_filter = localization/<lang>/demo_data.po
 source_file = localization/demo_data.pot
 source_lang = en
-type = PO
+type        = PO
 
-[grocy.stock_transaction_types]
+[o:grocy:p:grocy:r:locales]
+file_filter = localization/<lang>/locales.po
+source_file = localization/locales.pot
+source_lang = en
+type        = PO
+
+[o:grocy:p:grocy:r:permissions]
+file_filter = localization/<lang>/permissions.po
+source_file = localization/permissions.pot
+source_lang = en
+type        = PO
+
+[o:grocy:p:grocy:r:stock_transaction_types]
 file_filter = localization/<lang>/stock_transaction_types.po
 source_file = localization/stock_transaction_types.pot
 source_lang = en
-type = PO
+type        = PO
 
-[grocy.strings]
+[o:grocy:p:grocy:r:strings]
 file_filter = localization/<lang>/strings.po
 source_file = localization/strings.pot
 source_lang = en
-type = PO
+type        = PO
 
-[grocy.userfield_types]
+[o:grocy:p:grocy:r:userfield_types]
 file_filter = localization/<lang>/userfield_types.po
 source_file = localization/userfield_types.pot
 source_lang = en
-type = PO
+type        = PO

.yarnrc

@@ -1,4 +1,4 @@
---modules-folder public/node_modules
+--modules-folder public/packages
 --install.production true
 --install.ignore-scripts true
 --install.ignore-optional true

LICENSE.md

@@ -1,6 +1,6 @@
 MIT License
 
-Copyright (c) 2017 Bernd Bestel
+Copyright (c) 2017-2026 Bernd Bestel (<https://berrnd.de>)
 
 Permission is hereby granted, free of charge, to any person obtaining a copy
 of this software and associated documentation files (the "Software"), to deal

README.md

@@ -1,125 +1,197 @@
-# grocy
-ERP beyond your fridge
+-----
+
+<div align="center">
+<img alt="Logo" height="50" src="https://raw.githubusercontent.com/grocy/grocy/master/public/img/logo.svg?sanitize=true" />
+<h2>ERP beyond your fridge</h2>
+<h3>Grocy is a web-based self-hosted groceries & household management solution for your home</h3>
+<em><h4>This is a hobby project by <a href="https://berrnd.de">Bernd Bestel</a></h4></em>
+</div>
+
+-----
 
 ## Give it a try
+
 - Public demo of the latest stable version (`release` branch) &rarr; [https://demo.grocy.info](https://demo.grocy.info)
-- Public demo of the latest pre-release version (`master` branch) &rarr; [https://demo-prerelease.grocy.info](https://demo-prerelease.grocy.info)
+- Public demo of the current development version (`master` branch) &rarr; [https://demo-prerelease.grocy.info](https://demo-prerelease.grocy.info)
 
-## Questions / Help / Bug reporting / Feature requests
-There is the [r/grocy subreddit](https://www.reddit.com/r/grocy) to connect with other grocy users and getting help.
+## Features
 
-If you've found something that does not work or if you have an idea for an improvement or new things which you would find useful, feel free to open an issue in the [issue tracker](https://github.com/grocy/grocy/issues) here.
+See the website. &rarr; <https://grocy.info>
+
+## Questions / Help / Bug Reports / Feature Requests
+
+- General help and usage questions &rarr;  [r/grocy on Reddit](https://www.reddit.com/r/grocy)
+- Bug Reports and Feature Requests &rarr; [Issue Tracker](https://github.com/grocy/grocy/issues/new/choose)
+
+_Please don't send me private messages or call me regarding anything Grocy. I check the issue tracker and the subreddit pretty much daily, but don't provide any support beyond that._
 
 ## Community contributions
-See the website for a list of community contributed Add-ons / Tools: [https://grocy.info/#addons](https://grocy.info/#addons)
 
-## Motivation
-A household needs to be managed. I did this so far (almost 10 years) with my first self written software (a C# windows forms application) and with a bunch of Excel sheets. The software is a pain to use and Excel is Excel. So I searched for and tried different things for a (very) long time, nothing 100 % fitted, so this is my aim for a "complete household management"-thing. ERP your fridge!
+See the website for a list of community contributed Add-ons / Tools. &rarr; [https://grocy.info/addons](https://grocy.info/addons)
 
 ## How to install
-> Checkout grocy-desktop, if you want to run grocy without a webserver just like a normal (windows) desktop application.
+
+> Checkout [Grocy Desktop](https://github.com/grocy/grocy-desktop), if you want to run Grocy without having to manage a webserver just like a normal (Windows) desktop application.
 >
-> See https://github.com/grocy/grocy-desktop or directly download the [latest release](https://releases.grocy.info/latest-desktop) - the installation is nothing more than just clicking 2 times "next"...
+> Directly download the [latest release](https://releases.grocy.info/latest-desktop) (also [available via the Microsoft Store](https://apps.microsoft.com/detail/9NWB1TRNNKSF)) - the installation is nothing more than just clicking 2 times "next".
 
-Just unpack the [latest release](https://releases.grocy.info/latest) on your PHP (SQLite (3.8.3 or higher) extension required, currently only tested with PHP 7.4) enabled webserver (webservers root should point to the `public` directory), copy `config-dist.php` to `data/config.php`, edit it to your needs, ensure that the `data` directory is writable and you're ready to go, (to make it writable, maybe use `chown -R www-data:www-data data/`). Default login is user `admin` with password `admin`, please change the password immediately (see user menu).
+Grocy is technically a pretty simple PHP application, so the basic notes to get it running are:
+- Unpack the [latest release](https://releases.grocy.info/latest)
+- Copy `config-dist.php` to `data/config.php` + edit to your needs
+- Ensure that the `data` directory is writable
+- The webserver root should point to the `public` directory
+- Include `try_files $uri /index.php$is_args$query_string;` in your location block if you use nginx
+  - Or disable URL rewriting (see the option `DISABLE_URL_REWRITING` in `data/config.php`)
+- &rarr; Default login is user `admin` with password `admin`, please change the password immediately (user menu at the top right corner)
 
-Alternatively clone this repository (the `release` branch always references the latest released version, or checkout the latest tagged revision) and install Composer and Yarn dependencies manually.
+Alternatively clone this repository (the `release` branch always references the latest released version) and install Composer and Yarn dependencies manually.
 
-If you use nginx as your webserver, please include `try_files $uri /index.php$is_args$query_string;` in your location block.
+See the website for more installation guides and troubleshooting help. &rarr; [https://grocy.info/links](https://grocy.info/links)
 
-If, however, your webserver does not support URL rewriting, set `DISABLE_URL_REWRITING` in `data/config.php` (`Setting('DISABLE_URL_REWRITING', true);`).
+### Platform support
 
-See the website for further installation guides and troubleshooting help: https://grocy.info/links
+- PHP 8.5 (with SQLite 3.40+)
+  - Required PHP extensions: `fileinfo`, `pdo_sqlite`, `gd`, `ctype`, `intl`, `zlib`, `mbstring`
+- Recent Firefox, Chrome or Edge
 
 ## How to run using Docker
 
-See [grocy/grocy-docker](https://github.com/grocy/grocy-docker) or [linuxserver/docker-grocy](https://github.com/linuxserver/docker-grocy) for instructions.
+&rarr; https://hub.docker.com/r/linuxserver/grocy
 
 ## How to update
-Just overwrite everything with the latest release while keeping the `data` directory, check `config-dist.php` for new configuration options and add them to your `data/config.php` where appropriate (the default values from `config-dist.php` will be used for not in `data/config.php` defined settings). Just to be sure, please empty `data/viewcache`.
 
-If you run grocy on Linux, there is also `update.sh` (remember to make the script executable (`chmod +x update.sh`) and ensure that you have `unzip` installed) which does exactly this and additionally creates a backup (`.tgz` archive) of the current installation in `data/backups` (backups older than 60 days will be deleted during the update).
+- Overwrite everything with the [latest release](https://releases.grocy.info/latest) while keeping the `data` directory
+- Check `config-dist.php` for new configuration options and add them to your `data/config.php` where appropriate (the default values from `config-dist.php` will be used for not in `data/config.php` defined settings)
+
+If you run Grocy on Linux, there is also `update.sh` (remember to make the script executable via `chmod +x update.sh` and ensure that you have `unzip` installed) which does exactly this and additionally creates a backup (`.tgz` archive) of the current installation in `data/backups` (backups older than 60 days will be deleted during the update).
 
 ## Localization
-grocy is fully localizable - the default language is English (integrated into code), a German localization is always maintained by me.
-You can easily help translating grocy at https://www.transifex.com/grocy/grocy, if your language is incomplete or not available yet.
-(Language can be changed in `data/config.php`, e. g. `Setting('CULTURE', 'it');`)
 
-The [pre-release demo](https://demo-prerelease.grocy.info) is available for any translation which is at least 80 % complete and will pull the translations from Transifex 10 minutes past every hour, so you can have a kind of instant preview of your contributed translations. Thank you!
+Grocy is fully localizable - the default language is English (integrated into code), a German localization is always maintained by me.
 
-Also any translation which reached a completion level of 80 % will be included in releases.
+You can easily help translating Grocy on [Transifex](https://explore.transifex.com/grocy/grocy/) if your language is incomplete or not available yet.
+
+The default language can be set in `data/config.php`, e. g. `Setting('DEFAULT_LOCALE', 'de');` and there is also a user setting (see the user settings page) to set a different language per user.
+
+The [pre-release demo](https://demo-prerelease.grocy.info) is available for any translation which is at least 70 % complete and will pull the translations from Transifex 10 minutes past every hour, so you can have a kind of instant preview of your contributed translations. Thank you!
+
+Also any translation which once reached a completion level of 70 % ([`strings` resource](https://app.transifex.com/grocy/grocy/strings/)) will be included in releases.
+
+_RTL languages are not yet supported._
+
+## Motivation
+
+A household needs to be managed. Before Grocy I did this (for almost 10 years) using my first self written software (a C# Windows forms application) and with a bunch of Excel sheets. The software was a pain to use at the end and Excel is Excel. So I searched for and tried different things for a (very) long time, nothing 100 % fitted, so this is my aim for a "complete household management"-thing. ERP your fridge!
 
 ## Things worth to know
 
-### REST API & data model documentation
+### REST API
+
 See the integrated Swagger UI instance on [/api](https://demo.grocy.info/api).
 
+The web frontend uses exactly this API for pretty much everything. So everything you can do there is also possible via the API.
+
 ### Barcode readers & camera scanning
-Some fields (with a barcode icon above) also allow to select a value by scanning a barcode. It works best when your barcode reader prefixes every barcode with a letter which is normally not part of a item name (I use a `$`) and sends a `TAB` after a scan.
 
-Additionally it's also possible to use your device camera to scan a barcode by using the camera button on the right side of the corresponding field (powered by [QuaggaJS](https://github.com/serratus/quaggaJS), totally offline / client-side camera stream processing, please note due to browser security restrictions, this only works when serving grocy via a secure connection (`https://`)). Quick video demo: https://www.youtube.com/watch?v=Y5YH6IJFnfc
+Some fields (with a barcode icon) also allow to select a value by scanning a barcode. It works best when your barcode reader prefixes every barcode with a letter which is normally not part of a item name (I use a `$`) and sends a `TAB` after a scan.
 
-My personal recommendation: Use a USB barcode laser scanner. They are cheap and work 1000 % better, faster, under any lighting condition and from any angle.
+Additionally it's also possible to use your device camera to scan a barcode by using the camera button on the right side of the corresponding input field (powered by [ZXing](https://github.com/zxing-js/library), totally offline / client-side camera stream processing. Please note due to browser security restrictions, this only works when serving Grocy via a secure connection (`https://`)). [Here](https://www.youtube.com/watch?v=veezFX4X1JU) and [there](https://www.youtube.com/watch?v=Y5YH6IJFnfc) are quick video demos of that.
+
+_My personal recommendation: Use a USB barcode laser scanner. They are cheap and work 1000% better, faster, under any lighting condition and from any angle._
+
+### Barcode lookup via external services
+
+Products can be directly added to the database via looking them up against external services by a barcode.
+
+This can be done in-place using the product picker workflow "External barcode lookup" (the workflow dialog is displayed when entering something unknown in any product input field) Quick video demo: <https://www.youtube.com/watch?v=-moXPA-VvGc>
+
+A plugin for [Open Food Facts](https://world.openfoodfacts.org/) is included and used by default (see the `data/config.php` option `STOCK_BARCODE_LOOKUP_PLUGIN`).
+
+See that plugin or `plugins/DemoBarcodeLookupPlugin.php` for a commented example implementation if you want to build a plugin.
 
 ### Input shorthands for date fields
+
 For (productivity) reasons all date (and time) input (and display) fields use the ISO-8601 format regardless of localization.
 The following shorthands are available:
 - `MMDD` gets expanded to the given day on the current year, if > today, or to the given day next year, if < today, in proper notation
-  - Example: `0517` will be converted to `2018-05-17`
+  - Example: `0517` will be converted to `2026-05-17`
 - `YYYYMMDD` gets expanded to the proper ISO-8601 notation
-  - Example: `20190417` will be converted to `2019-04-17`
+  - Example: `20260417` will be converted to `2026-04-17`
 - `YYYYMMe` or `YYYYMM+` gets expanded to the end of the given month in the given year in proper notation
-  - Example: `201807e` will be converted to `2018-07-31`
-- `x` gets expanded to `2999-12-31` (which I use for products which never expire)
+  - Example: `202607e` will be converted to `2026-07-31`
+- `[+/-]n[d/m/y]` gets expanded to a date relative to today, while adding (**+**) or subtracting (**-**) the **n**umber of **d**ays/**m**onths/**y**ears, in proper notation
+  - Example: `+1m` will be converted to the same day next month
+- `x` gets expanded to `2999-12-31` (which is an alias for "never overdue")
 - Down/up arrow keys will increase/decrease the date by 1 day
 - Right/left arrow keys will increase/decrease the date by 1 week
 - Shift + down/up arrow keys will increase/decrease the date by 1 month
 - Shift + right/left arrow keys will increase/decrease the date by 1 year
 
 ### Keyboard shorthands for buttons
-Wherever a button contains a bold highlighted letter, this is a shortcut key.
-Example: Button "Add as new **p**roduct" can be "pressed" by using the `P` key on your keyboard.
 
-### Barcode lookup via external services
-Products can be directly added to the database via looking them up against external services by a barcode.
-This is currently only possible through the REST API.
-There is no plugin included for any service, see the reference implementation in `data/plugins/DemoBarcodeLookupPlugin.php`.
+Wherever a button contains a bold highlighted letter, this is a shortcut key.
+Example: Button "**P** Add as new product" can be "pressed" by using the `P` key on your keyboard.
+
+### Installable web app (PWA)
+
+Grocy's web frontend is responsive and an "installable web app" ([PWA](https://en.wikipedia.org/wiki/Progressive_web_app), without providing any offline usage capabilities), that provides a pretty native mobile app-like experience without the need for additional tools.
+
+- Quick video demo on Android/Firefox: <https://www.youtube.com/watch?v=L38drVZfwHs>
+- Quick video demo on Android/Chrome: <https://www.youtube.com/watch?v=rjLdXUFDNuk>
 
 ### Database migrations
-Database schema migration is automatically done when visiting the root (`/`) route (click on the logo in the left upper edge).
+
+Database schema migration is done when visiting the root (`/`) route (click on the logo in the left upper edge) as needed and is also triggered automatically if the version has changed (so when an update has been made).
+
+_Please note: Database migrations are supposed to work between releases, not between every commit. If you want to run the current `master` branch (which is the development version), you need to handle that (and more) yourself._
 
 ### Disable certain features
-If you don't use certain feature sets of grocy (for example if you don't need "Chores"), there are feature flags per major feature set to hide/disable the related UI elements (see `config-dist.php`)
+
+If you don't use certain feature sets of Grocy (for example if you don't need "Chores"), there are feature flags per major feature set to hide/disable the related UI elements (see `config-dist.php`).
 
 ### Adding your own CSS or JS without to have to modify the application itself
+
 - When the file `data/custom_js.html` exists, the contents of the file will be added just before `</body>` (end of body) on every page
 - When the file `data/custom_css.html` exists, the contents of the file will be added just before `</head>` (end of head) on every page
 
 ### Demo mode
-When the `MODE` setting is set to `dev`, `demo` or `prerelease`, the application will work in a demo mode which means authentication is disabled and some demo data will be generated during the database schema migration.
+
+When the `MODE` setting is set to `dev`, `demo` or `prerelease`, the application will work in a demo mode which means authentication is disabled and some demo data will be generated during the database schema migration (pass the query parameter `nodemodata`, e.g. `https://grocy.example.com/?nodemodata` to skip that).
 
 ### Embedded mode
-When the file `embedded.txt` exists, it must contain a valid and writable path which will be used as the data directory instead of `data` and authentication will be disabled (used in [grocy-desktop](https://github.com/grocy/grocy-desktop)).
+
+When the file `embedded.txt` exists, it must contain a valid and writable path which will be used as the data directory instead of `data` and authentication will be disabled (used in [Grocy Desktop](https://github.com/grocy/grocy-desktop)).
 
 In embedded mode, settings can be overridden by text files in `data/settingoverrides`, the file name must be `<SettingName>.txt` (e. g. `BASE_URL.txt`) and the content must be the setting value (normally one single line).
 
-## Contributing / Say thanks
-Any help is more than appreciated. Feel free to pick any open unassigned issue and submit a pull request, but please leave a short comment or assign the issue yourself, to avoid working on the same thing.
+## Contributing / Say Thanks
 
-See https://grocy.info/#say-thanks for more ideas if you just want to say thanks.
+See <https://grocy.info/#say-thanks> if you just want to say thanks or [Contributing](https://github.com/grocy/grocy?tab=contributing-ov-file#contributing-ov-file) for anything else.
 
 ## Roadmap
-There is none. grocy is only my hobby, one I like, but not the only one, and because of that, there are no release dates, no schedules for when anything is ready, it's done when it's done, maybe tomorrow, maybe tomorrow next year, everyone is invited to contribute - I appreciate all ideas and contributions. The progress of a specific bug/enhancement is always tracked in the corresponding issue, at least by commit comment references.
+
+There is none. The progress of a specific bug/enhancement is always tracked in the corresponding request, at least by commit comment references.
+
+[Milestones](https://github.com/grocy/grocy/milestones) are used to indicate in which version the corresponding request was done (`vNEXT` means it's currently planned to do that for the next release).
 
 ## Screenshots
-#### Dashboard
-![Dashboard](https://github.com/grocy/grocy/raw/master/publication_assets/dashboard.png "Dashboard")
 
-#### Purchase - with barcode scan
-![Purchase - with barcode scan](https://github.com/grocy/grocy/raw/master/publication_assets/purchase-with-barcode.gif "purchase-with-barcode")
+### Stock overview
 
-#### Consume - with manual search
-![Consume - with manual search](https://github.com/grocy/grocy/raw/master/publication_assets/consume.gif "consume")
+![Stock overview](https://github.com/grocy/grocy/raw/master/.github/publication_assets/stock.png "Stock overview")
+
+### Shopping List
+
+![Shopping List](https://github.com/grocy/grocy/raw/master/.github/publication_assets/shoppinglist.png "Shopping List")
+
+### Meal Plan
+
+![Meal Plan](https://github.com/grocy/grocy/raw/master/.github/publication_assets/mealplan.png "Meal Plan")
+
+### Chores overview
+
+![Chores overview](https://github.com/grocy/grocy/raw/master/.github/publication_assets/chores.png "Chores overview")
 
 ## License
+
 The MIT License (MIT)

app.php

@@ -1,20 +1,30 @@
 <?php
 
-use Psr\Http\Message\ServerRequestInterface as Request;
-use Psr\Http\Message\ResponseInterface as Response;
+use Grocy\Controllers\ExceptionController;
+use Grocy\Helpers\UrlManager;
+use Grocy\Helpers\SlimBladeView;
+use Grocy\Middleware\LocaleMiddleware;
+use Grocy\Middleware\CorsMiddleware;
 use Psr\Container\ContainerInterface as Container;
 use Slim\Factory\AppFactory;
 
-use Grocy\Helpers\UrlManager;
-use Grocy\Controllers\LoginController;
-
 // Load composer dependencies
-require_once __DIR__ . '/vendor/autoload.php';
+require_once __DIR__ . '/packages/autoload.php';
 
 // Load config files
 require_once GROCY_DATAPATH . '/config.php';
 require_once __DIR__ . '/config-dist.php'; // For not in own config defined values we use the default ones
 
+// Error reporting definitions
+if (GROCY_MODE === 'dev')
+{
+	error_reporting(E_ALL);
+}
+else
+{
+	error_reporting(E_ALL ^ (E_NOTICE | E_WARNING | E_DEPRECATED));
+}
+
 // Definitions for dev/demo/prerelease mode
 if ((GROCY_MODE === 'dev' || GROCY_MODE === 'demo' || GROCY_MODE === 'prerelease') && !defined('GROCY_USER_ID'))
 {
@@ -30,24 +40,59 @@ if (GROCY_DISABLE_AUTH === true)
 	}
 }
 
+// Check if any invalid entries in config.php have been made
+try
+{
+	(new Grocy\Helpers\ConfigurationValidator())->validateConfig();
+}
+catch (\Grocy\Helpers\EInvalidConfig $ex)
+{
+	exit('Invalid setting in config.php: ' . $ex->getMessage());
+}
+
+// Create data/viewcache folder if it doesn't exist
+$viewcachePath = GROCY_DATAPATH . '/viewcache';
+if (!file_exists($viewcachePath))
+{
+	mkdir($viewcachePath);
+}
+
+// Empty data/viewcache when and trigger database migrations when:
+// The version changed (so when an update was done)
+// GROCY_BASE_URL OR GROCY_BASE_PATH changed
+$hash = hash('sha256', file_get_contents(__DIR__ . '/version.json') . GROCY_BASE_URL . GROCY_BASE_PATH);
+$hashCacheFile = $viewcachePath . "/$hash.txt";
+if (!file_exists($hashCacheFile))
+{
+	EmptyFolder($viewcachePath);
+	touch($hashCacheFile);
+
+	if (function_exists('opcache_reset'))
+	{
+		opcache_reset();
+	}
+
+	// Schema migration happens on the root route, so redirect to there
+	header('Location: ' . (new UrlManager(GROCY_BASE_URL))->ConstructUrl('/'));
+	exit();
+}
+
 // Setup base application
 AppFactory::setContainer(new DI\Container());
 $app = AppFactory::create();
 
 $container = $app->getContainer();
-$container->set('view', function(Container $container)
+$container->set('view', function (Container $container)
 {
-	return new Slim\Views\Blade(__DIR__ . '/views', GROCY_DATAPATH . '/viewcache');
+	return new SlimBladeView(__DIR__ . '/views', GROCY_DATAPATH . '/viewcache');
 });
-$container->set('LoginControllerInstance', function(Container $container)
-{
-	return new LoginController($container, 'grocy_session');
-});
-$container->set('UrlManager', function(Container $container)
+
+$container->set('UrlManager', function (Container $container)
 {
 	return new UrlManager(GROCY_BASE_URL);
 });
-$container->set('ApiKeyHeaderName', function(Container $container)
+
+$container->set('ApiKeyHeaderName', function (Container $container)
 {
 	return 'GROCY-API-KEY';
 });
@@ -61,8 +106,27 @@ if (!empty(GROCY_BASE_PATH))
 	$app->setBasePath(GROCY_BASE_PATH);
 }
 
+if (GROCY_MODE === 'production' || GROCY_MODE === 'dev')
+{
+	$app->add(new LocaleMiddleware($container));
+}
+else
+{
+	define('GROCY_LOCALE', GROCY_DEFAULT_LOCALE);
+}
+
+$authMiddlewareClass = GROCY_AUTH_CLASS;
+$app->add(new $authMiddlewareClass($container, $app->getResponseFactory()));
 // Add default middleware
 $app->addRoutingMiddleware();
-$app->addErrorMiddleware(true, false, false);
+$errorMiddleware = $app->addErrorMiddleware(true, false, false);
+$errorMiddleware->setDefaultErrorHandler(
+	new ExceptionController($app, $container)
+);
 
+$app->add(new CorsMiddleware($app->getResponseFactory()));
+
+$app->getRouteCollector()->setCacheFile(GROCY_DATAPATH . '/viewcache/route_cache.php');
+
+ob_clean(); // No response output before here
 $app->run();

changelog/15_1.8.0_2018-04-16.md

@@ -1 +1 @@
-- grocy is now fully localizable and ships by default with English and German translations
+- Grocy is now fully localizable and ships by default with English and German translations

changelog/25_1.13.0_2018-07-12.md

@@ -1,3 +1,3 @@
-- Upgraded Bootstrap and some other dependencies (grocy now looks even better!)
+- Upgraded Bootstrap and some other dependencies (Grocy now looks even better!)
 - Added Italian translation (thanks @davidoskky)
   - => Demo for this language available at: https://it.demo.grocy.info

changelog/26_1.13.1_2018-07-12.md

@@ -1,5 +1,5 @@
 This was released shortly after the last release to fix a small regression bug, original changes from Version 1.13.0:
 
-- Upgraded Bootstrap and some other dependencies (grocy now looks even better!)
+- Upgraded Bootstrap and some other dependencies (Grocy now looks even better!)
 - Added Italian translation (thanks @davidoskky)
   - => Demo for this language available at: https://it.demo.grocy.info

changelog/27_1.14.0_2018-07-15.md

@@ -10,4 +10,4 @@
   - Sidebar collapse state is now remembered
   - Fixed datetimepicker border
   - Keep the parent sidebar menu item expanded if the active page is a sub menu item
-- Custom JS/CSS file names have changed [see README](https://github.com/berrnd/grocy#adding-your-own-css-or-js-without-to-have-to-modify-the-application-itself)
+- Custom JS/CSS file names have changed [see README](https://github.com/grocy/grocy#adding-your-own-css-or-js-without-to-have-to-modify-the-application-itself)

changelog/28_1.15.0_2018-07-22.md

@@ -1,9 +1,9 @@
-- New related project: **grocy-desktop**
-  - => https://github.com/berrnd/grocy-desktop
-  - Run grocy without a webserver just like a normal (windows) desktop application
-  - New "embedded mode" for grocy to help running in "desktop application mode" [see README](https://github.com/berrnd/grocy#embedded-mode)
+- New related project: **Grocy Desktop**
+  - => https://github.com/grocy/grocy-desktop
+  - Run Grocy without a webserver just like a normal (Windows) desktop application
+  - New "embedded mode" for Grocy to help running in "desktop application mode" [see README](https://github.com/grocy/grocy#embedded-mode)
 - New datepicker shorthands and improvements
   - `YYYYMMe` or `YYYYMM+` gets expanded to the end of the given month in the given year in proper notation
   - Changed: `MMDD` will be expanded to the given day next year if > today
-  - [see README](https://github.com/berrnd/grocy#input-shorthands-for-date-fields)
+  - [see README](https://github.com/grocy/grocy#input-shorthands-for-date-fields)
 - Some other small bug fixes

changelog/29_1.16.0_2018-07-25.md

@@ -2,7 +2,7 @@
   - The currently defined user will automatically be migrated, please remove `HTTP_USER` and `HTTP_PASSWORD` from your config file afterwards
   - For this it was necessary to delete all sessions and API keys during the migration
 - Added an update script (`/update.sh`) to make updates (on Linux machines) easier
-  - See also ["How to update" in README](https://github.com/berrnd/grocy#how-to-update)
+  - See also ["How to update" in README](https://github.com/grocy/grocy#how-to-update)
 - Added the possibility to track who did a habit
 - Added a rudimentary habit analysis possibility
 - Different small UI, code and translation improvements

changelog/37_1.21.0_2018-10-06.md

@@ -2,5 +2,5 @@
   - Manage all your household equipment/devices in one place and have the information/instruction manual at hand when needed
 - New feature: Products can now have pictures
   - Add them in the product edit page
-  - Will be shown in the productcard (purchase/consume/etc. pages) and when you click the product name on the stock overview page (a little image icon next to the product name indicates if the product has an image)
+  - Will be shown in the product card (purchase/consume/etc. pages) and when you click the product name on the stock overview page (a little image icon next to the product name indicates if the product has an image)
 - Recipes and the new equipment edit page now have a little editor with text formatting capabilities

changelog/43_2.0.0_2019-03-06.md

@@ -19,5 +19,5 @@
 - Other improvements
   - The calendar can now be shared/integrated in iCal format (button in the header on the calendar page)
   - Added feature flags to hide/disable certain parts of grocy when you don't use them (for example hide "Chores" and all related UI elements, when you don't use it, see `config-dist.php`)
-  - Added a "Apple Touch Icon" and a "Web App Manifest" which should improve grocy on mobile devices and also enables "Add to Home screen" on major mobile browsers
+  - Added a "Apple Touch Icon" and a "Web App Manifest" which should improve Grocy on mobile devices and also enables "Add to Home screen" on major mobile browsers
   - A lot of other minor small and bigger UI improvements

changelog/46_2.3.0_2019-04-06.md

@@ -11,7 +11,5 @@
   - Some other small CSS fixes (context menus were not fully displayed when the parent container was to small, improved padding for text inputs)
 - As always: Updated translations (thanks all the translators)
 
-### Self promotion
-[grocy-desktop](https://github.com/grocy/grocy-desktop) is now also available through the Microsoft Store 
-
-<a href="//www.microsoft.com/store/apps/9nwb1trnnksf?cid=storebadge&ocid=badge"><img src="https://assets.windowsphone.com/85864462-9c82-451e-9355-a3d5f874397a/English_get-it-from-MS_InvariantCulture_Default.png" alt="Get it from Microsoft" width="150px" /></a>
+### Other
+- [Grocy Desktop](https://github.com/grocy/grocy-desktop) is now also available through the Microsoft Store: https://apps.microsoft.com/detail/9NWB1TRNNKSF

changelog/47_2.4.0_2019-05-10.md

@@ -29,6 +29,6 @@
   - Also applies to quantity units, n-plural forms can be entered on the quantity unit edit page
   - It's not required to install the PHP gettext extension, on both, server and client, managed implementations of gettext are used ([oscarotero/Gettext](https://github.com/oscarotero/Gettext) & [oscarotero/gettext-translator](https://github.com/oscarotero/gettext-translator))
 - Some other small fixes and improvements
-  - The "Add as barcode to existing product" productpicker workflow failed to add the barcode to the given product
+  - The "Add as barcode to existing product" product picker workflow failed to add the barcode to the given product
   - Recipes can now be filter by stock availability
   - Added a feature flag (`config.php` setting) to also be able to hide all stock related UI elements and routes

changelog/49_2.4.2_2019-06-09.md

@@ -2,7 +2,7 @@
 - Fixed a problem that the user settings were not properly initialized for the frontend JS part when not logged only (so potentially affected only the login page)
 - Fixed an issue that the shopping list did not load when a plural translation for a quantity unit was missing
 - Fixed that tooltips were visible forever when consuming all products on the stock overview page
-- Fixed that login did not work when "Stay logged in permanently" was set and grocy runs on a 32-bit system (thanks @matejdro)
+- Fixed that login did not work when "Stay logged in permanently" was set and Grocy runs on a 32-bit system (thanks @matejdro)
 - Fixed page reloads when "Auto reload on external changes" is enabled and there is unsaved form data (the detection did not work for forms in modal dialogs, e. g. when adding a entry to the meal plan)
 - Fixed (again) that the product picker did not work properly when the product name contains single quotes
 - Fixed that a entered barcode on the product edit page was only saved when "adding" it to the barcodes list by pressing `TAB` (is now automatically added to the list also when just leaving the field)

changelog/52_2.5.0_2019-09-22.md

@@ -1,14 +1,15 @@
-### New feature: Custom entities / objects / lists
-- Custom entities are based on Userfields and can be used to add any custom lists you want to have in grocy
+### New Feature: Custom entities / objects / lists
+
+- Custom entities are based on Userfields and can be used to add any custom lists you want to have in Grocy
 - They can have an own menu entry in the sidebar
 - => See "Manage master data" -> "Userentities" or try it on the demo: https://demo.grocy.info/userobjects/exampleuserentity
 
-### New feature: Use the device camera for barcode scanning
+### New Feature: Use the device camera for barcode scanning
 - Available on any barcode-enabled field (so currently only for picking products) - a new camera button at the right of side the text field
 - Implemented using [QuaggaJS](https://github.com/serratus/quaggaJS) - camera stream processing happens totally offline / client-side
-- Please note due to browser security restrictions, this only works when serving grocy via a secure connection (`https://`)
+- Please note due to browser security restrictions, this only works when serving Grocy via a secure connection (`https://`)
 - There is also a `config.php` setting `DISABLE_BROWSER_BARCODE_CAMERA_SCANNING` to disable this, if you don't need it at all (defaults to `false`)
-- I you have problems that barcodes are not recognized properly, there is a little "barcode scanner testing page" at [/barcodescannertesting](https://demo.grocy.info/barcodescannertesting)
+- If you have problems that barcodes are not recognized properly, there is a little "barcode scanner testing page" at [/barcodescannertesting](https://demo.grocy.info/barcodescannertesting)
 - => Quick video demo: https://www.youtube.com/watch?v=Y5YH6IJFnfc
 
 ### Stock improvements/fixes
@@ -20,7 +21,7 @@
 - Quantity units can now be linked (related measurements / unit conversion)
   - On the quantity unit edit page default conversion can be defined for each unit
   - Products "inherit" the default conversion and additionally can have their own / override the default ones
-- It's now possible to print a "Location Content Sheet" with the current stock per location - new button at the top of the stock overview page (thought to hang it at the location, note used amounts on paper and track it in grocy later)
+- It's now possible to print a "Location Content Sheet" with the current stock per location - new button at the top of the stock overview page (thought to hang it at the location, note used amounts on paper and track it in Grocy later)
 - Stock overview page improvements
   - Options in the more/context-menu to directly open the purchase/consume/inventory pages prefilled with the current product in a popup/dialog
   - Option in the more/context-menu to add the current product directly to a shopping list
@@ -66,7 +67,7 @@
 ### Userfield improvements/fixes
 - New Userfield type "Select list" for a list of predefined values where a single or also multiple values can then be selected on the entity object
 - New Userfield type "Link" - a single-line-textbox where the content will be rendered as a clickable link
-- Userfields of type "checkbox" are rendered as a checkmark in tables when checked (instead of "1" as till now)
+- Userfields of type "Checkbox" are rendered as a checkmark in tables when checked (instead of "1" as till now)
 - Product Userfields are now also rendered on the shopping list (for items which have a product referenced)
 - Fixed that the Userfield type "Preset list" had always the caption "Product group" instead of the configured one (thanks @oncleben31)
 
@@ -104,4 +105,4 @@
 - It's now also possible to provide the API key via a query parameter (same name as the header, so `GROCY-API-KEY`)
 
 #### Say thanks
-Because there were some questions about that in the past: If grocy is useful for you, [say thanks](https://grocy.info/#say-thanks)!
+Because there were some questions about that in the past: If Grocy is useful for you, [say thanks](https://grocy.info/#say-thanks)!

changelog/53_2.5.1_2019-09-28.md

@@ -3,7 +3,7 @@
 - Fixed that the "X products are already expired" count on the stock overview page was wrong
 - Fixed that after product actions (consume/purchase/etc.) on the stock overview page the highlighting of the row was maybe wrong
 - After product actions (consume/purchase/etc.) on the stock overview page on a sub product, now also the parent product (row) is refreshed
-- It's now possible to accumulate min. stock amounts on parent product level (new option per product, means the sub product will never be "missing" then, only the parent product)
+- It's now possible to accumulate min. stock amounts on parent product level (new option per product, means the sub product will never be missing then, only the parent product)
 - On the purchase page there is now an option to select that the price is the total price (for the whole amount) - below the price field, defaults to "Unit price" (as it was until now), when set to "Total price", the entered price will be divided by the amount before posting
 - "Average shelf life" on the product card now displays just "Unlimited" when the resulting value would be > 200 years (for products which never expire, as they have a best before date of 2999-12-31)
 

changelog/55_2.6.0_2020-01-31.md

@@ -1,10 +1,10 @@
-### New feature: Transfer products between locations and edit stock entries
+### New Feature: Transfer products between locations and edit stock entries
 - New menu entry in the sidebar to transfer products (or as a shortcut in the more/context menu per line on the stock overview page)
 - New button "Stock entries" in the header of the stock overview page (or as a shortcut in the more/context menu per line) to show the detail stock entries behind each product
   - From there you can also edit the stock entries
 - (A huge THANK YOU goes to @kriddles for the work on this feature)
 
-### New feature: Scan mode
+### New Feature: Scan mode
 - Just scan one product after another, no manual input required and audio feedback is provided
 - New switch-button on the purchase and consume page
 - When enabled
@@ -14,25 +14,25 @@
   - Audio feedback is provided after scanning and on success/error of the transaction
 - => Quick video demo: https://www.youtube.com/watch?v=83dm9iD718k
 
-### New feature: Self produced products
+### New Feature: Self produced products
 - To a recipe a product can be attached
   - This products needs a "Default best before date"
 - On using "Consume all ingredients needed by this recipe" and when it has a product attached, one unit of that product (per serving in purchase quantity unit) will be added to stock (with the proper price based on the recipe ingredients)
-- (Thanks @kriddles for the intial work on this)
+- (Thanks @kriddles for the initial work on this)
 
-### New feature: Freeze/Thaw products
+### New Feature: Freeze/Thaw products
 - New product options "Default best before days after freezing/thawing" to set how the best before date should be changed on freezing/thawing
 - New location option "Is freezer" to indicate if the location is a freezer
 - => When moving a product from/to a freezer location, the best before date is changed accordingly
 - There is also a new sub feature flag `FEATURE_FLAG_STOCK_PRODUCT_FREEZING` to disable this if you don't need it (defaults to `true`)
 
 ### Stock improvements/fixes
-- The productcard gets now also refreshed after a transaction was posted (purchase/consume/etc.) (thanks @kriddles)
+- The product card gets now also refreshed after a transaction was posted (purchase/consume/etc.) (thanks @kriddles)
 - The product field calories (kcal) now also allows decimal numbers
 - On the inventory page, "New amount" is now prefilled with the current stock amount of the selected product
 - Fixed that entering partial amounts was not possible on the inventory page (only applies if the product option "Allow partial units in stock" is enabled)
 - Fixed that on purchase a wrong minimum amount was enforced for products with enabled tare weight handling in combination with different purchase/stock quantity units
-- Fixed that the productcard did not load correctly when `FEATURE_FLAG_STOCK_LOCATION_TRACKING` was set to `false` (thanks @kriddles)
+- Fixed that the product card did not load correctly when `FEATURE_FLAG_STOCK_LOCATION_TRACKING` was set to `false` (thanks @kriddles)
 - Fixed that the "Add as barcode to existing product" workflow did not work twice when not switching the page inbetween
 
 ### Shopping list improvements/fixes

changelog/56_2.6.1_2020-03-06.md

@@ -1,5 +1,5 @@
 ## !! Important notice
-If you run grocy in a subdirectory, you need to set a new `config.php` setting (`BASE_PATH`, see `config-dist.php`)
+If you run Grocy in a subdirectory, you need to set a new `config.php` setting (`BASE_PATH`, see `config-dist.php`)
 
 ### Stock fixes
 - Fixed purchase/consume/inventory problems when `FEATURE_FLAG_STOCK_LOCATION_TRACKING` was set to `false`

changelog/58_2.7.0_2020-04-16.md

@@ -1,4 +1,4 @@
-### New feature: Price history per store
+### New Feature: Price history per store
 - Define stores under master data
 - New product option to set the default store
 - Track on purchase/inventory in which store you bought the product (gets prefilled by the last store you purchased the product, or the default store of the product if you never bought it)
@@ -56,7 +56,7 @@
   - Various display/CSS improvements (thanks @Mik-)
 - Prerequisites (PHP extensions, critical files/folders) will now be checked and properly reported if there are problems (thanks @Forceu)
 - Improved the the overview pages on mobile devices (main column was hidden) (thanks @Mik-)
-- The general search field now searches accent insensitive
+- The general search field now searches accent insensitive (and table sorting is also accent insensitive)
 - Fixed that all number inputs are always prefilled in the browser locale number format
 - Optimized the handling of settings provided by `data/settingoverrides` files (thanks @dacto)
 - Optimized the update script (`update.sh`) to create the backup tar archive before writing to it (was a problem on Btrfs file systems) (thanks @shane-kerr)

changelog/60_3.0.0_2020-12-22.md

@@ -0,0 +1,279 @@
+> ⚠️ The major version bump is due to breaking API changes, please see below if you use the API
+
+> ⚠️⚠️ SQLite >= 3.9.0 (was released in late 2015) is required
+>
+> [Here](https://github.com/grocy/grocy/issues/1209#issuecomment-749760765) is a workaround if you still run a SQLite version >= 3.8.3 < 3.9.0
+>
+> _PHP 7.2 (with SQLite 3.8.3+) was the formerly minimum runtime requirement, any future release will only support PHP 7.4 (with SQLite 3.27.2+) - supporting those (very) old runtime stuff is too time consuming..._
+
+> ❗ If some pages/tables doesn't load at all, please check that your `/data/config.php` setting `CURRENCY` is a valid ISO 4217 currency code - that's most probably the issue then.
+
+### New Feature: Use any product related quantity unit anywhere
+- Finally it's possible to use any product related quantity unit on any page
+- Products still have one quantity unit stock and one (default) quantity unit purchase, but any QU, which has a direct or indirect conversion for that product, can be used to pick an amount
+  - Because the stock quantity unit is now the base for everything, it cannot be changed after the product was once added to stock (for now, maybe there will be a possibilty to change it in a future release)
+
+### New Feature: Prefill purchase data by barcodes
+- Imagine you buy for example eggs in different pack sizes and they have different barcodes
+- Each product barcode can be assigned an amount, quantity unit and store (on the product edit page), which is then automatically prefilled on the purchase page
+- Additionally, the last price per barcode will be tracked and prefilled as a "Total price" on purchase
+- (Thanks @kriddles for the initial work on this)
+
+### New Feature: User permissions
+- Users can now have permissions, can be configured per user on the "Manage users" page (lock icon)
+- Default permissions for new users can be set via a new `config.php` setting `DEFAULT_PERMISSIONS` (defaults to `ADMIN`, so no changed behavior when not configured)
+- All currently existing users will get all permissions (`ADMIN`) during the update/migration
+- Creating API keys on the "Manage API keys"-page (top right corner settings menu) now requires the `ADMIN` permission
+  - Other users only see their API keys on that page
+- (Thanks @fipwmaqzufheoxq92ebc for the initial work on this)
+
+### New Feature: External authentication support
+- New `config.php` setting `AUTH_CLASS` to change the used authentication provider
+- Via LDAP
+  - New `config.php` settings `LDAP_DOMAIN`, `LDAP_ADDRESS` and `LDAP_BASE_DN`
+  - If you set `AUTH_CLASS` to `Grocy\Middleware\LdapAuthMiddleware`, users will be authenticated against your directory (and will also be created (in Grocy), if not already present)
+- Via a reverse proxy
+  - New `config.php` setting `REVERSE_PROXY_AUTH_HEADER`
+  - If you set `AUTH_CLASS` to `Grocy\Middleware\ReverseProxyAuthMiddleware` and your reverse proxy sends a username in the HTTP header `REMOTE_USER` (header name can be changed by the setting `REVERSE_PROXY_AUTH_HEADER`), the user is automatically authenticated (and will also be created (in Grocy), if not already present)
+  - (Thanks @fipwmaqzufheoxq92ebc for the initial work on this)
+
+### Stock improvements/fixes
+- Changes about best before dates: It's now possible to distinguish between best before dates and expiration dates:
+  - New product option "Due date type" (defaults to "Best before date")
+  - Wording changes:
+    - All current places where "Best before date" was used now use "Due date"
+    - Products with `Due date type = Best before date` (so all existing products) are "due" or "overdue" (they don't "expire" or are "expired")
+    - Products with `Due date type = Expiration date` (new option) can "expire" or are "expired"
+  - Color changes:
+    - Products which are due soon or expire soon are (still) highlighted in yellow
+    - Products which are overdue are highlighted in grey (there is also a new filter button on the stock overview page for them)
+    - Products which are expired (new option) are highlighted in red
+- When creating a quantity unit conversion it's now possible to automatically create the inverse conversion (thanks @kriddles)
+- The product option "Allow partial units in stock" was removed, partial amounts are now possible by default for all products
+- On purchase there is now a warning shown, when the due date of the purchased product is earlier than the next due date in stock (enabled by default, can be disabled by a new stock setting (top right corner settings menu))
+- The amount to be used for the "quick consume/open buttons" on the stock overview page can now be configured per product (new product option "Quick consume amount", defaults to 1)
+  - This "Quick consume amount" can optionally also be used as the default on the consume page (new stock setting / top right corner settings menu)
+- Products can now be duplicated (new dropdown menu item on the products list page, all fields will be preset from the copied product, except the name)
+- Products can now be merged (new dropdown menu item on the products list page)
+  - Useful if you have two products which are basically the same and want to replace all occurrences of one with the other one
+- When consuming or opening a parent product, which is currently not in stock, any in stock sub product will now be consumed/opened (like already automatically done when consuming recipes)
+- Opened stock entries get now consumed first by default when no specific stock entry is used/selected
+  - So the default consume rule is now "Opened first, then first due first, then first in first out"
+- Optimized/clarified what the total/unit price on the purchase page is (thanks @kriddles)
+- On the purchase page the amount field is now displayed above/before the due date for better `TAB` handling (thanks @kriddles)
+- Changed that when `FEATURE_FLAG_STOCK_BEST_BEFORE_DATE_TRACKING` is disabled, products now get internally a due date of "never overdue" (aka `2999-12-31`) instead of today (thanks @kriddles)
+- Products can now be disabled to keep the history/journal, but hide it everywhere, without deleting it (new product option "Active", deleting a product now explicitly also deletes its journal and all other references) (thanks @kriddles for the initial work on this)
+- Products can now be hidden from the stock overview page, even if they are in stock (new product option "Never show on stock overview", disabled by default, so no changed behavior when not configured)
+  - That's maybe useful for parent products you only use as a kind of "container"
+- The due date is now also prefilled on the inventory page based on the products "Default due days" (was only done on the purchase page before)
+- On the stock journal page, it's now visible if a consume-booking was spoiled
+- It's now tracked who made a stock change (currently logged in user, visible on the stock journal page) (thanks @fipwmaqzufheoxq92ebc)
+- Product edit page improvements ("Save & continue" button, deleting and adding a product picuture is now possible in one go) (thanks @Ma27)
+- For products with tare weight handling enabled, it's now optionally possible to consume a fixed/exact amount (just like for "normal" products) in case you don't want to weigh the whole container this time (new checkbox on the consume page) (thanks @fipwmaqzufheoxq92ebc)
+- The stock overview page now also shows the value - new column and also the total value in the header (thanks @kriddles)
+- It's now possible to set a custom purchased date on purchase (new field on the purchase and inventory page, hidden by default - enable it by a new stock setting (top right corner settings menu)) (thanks @kriddles)
+- The decimal places for all amount and price inputs can now be configured (stock settings / top right corner settings menu, default for amounts is `4`, for prices `2`)
+- When clicking the product name on the shopping list, the product card will now be displayed (like on the stock overview page) (thanks @kriddles)
+- On the product card there is now also a button to jump directly to the stock entries of the corresponding product (thanks @kriddles)
+- The product picker workflows can now also be started by `ENTER` (additionally to `TAB`)
+- Added a "retry camera barcode scan" button (button with camera icon, shortcut `C`) to the product picker workflow dialog
+- Added more filters on the stock journal page
+- Added a grouped/summarized stock journal (new button "Journal summary" at the top of the stock journal page) (thanks @fipwmaqzufheoxq92ebc)
+  - Provides an overview of summarized transactions per product, transaction type and user + summarized amount
+- The product option "Default due days after freezing" now also supports `-1` (like the option "Default due days") to set the product to "never due" on freezing
+- Fixed that changing the products "Factor purchase to stock quantity unit" not longer messes up historical prices (which results for example in wrong recipe costs) (thanks @kriddles)
+- Fixed that when adding products through a product picker workflow and when the created products contains special characters, the product was not preselected on the previous page (thanks @Forceu)
+- Fixed that when editing a product the default store was not visible / always empty regardless if the product had one set (thanks @kriddles)
+- Fixed that `FEATURE_SETTING_STOCK_COUNT_OPENED_PRODUCTS_AGAINST_MINIMUM_STOCK_AMOUNT` (option to configure if opened products should be considered for minimum stock amounts) was not handled correctly (thanks @teddybeermaniac)
+- Fixed that the "Due soon" sum (yellow filter button) on the stock overview page didn't include products which are due today (thanks @fipwmaqzufheoxq92ebc)
+- Fixed that the shopping cart icon on the stock overview page was also shown if the product was on an already deleted shopping list (if enabled) (thanks @fipwmaqzufheoxq92ebc)
+- Fixed that when editing a stock entry without a price, the price field was prefilled with `1`
+- Fixed that the location & product groups filter on the stock overview page used a contains search instead of an exact search
+- Fixed that the amount on the success popup was wrong when consuming a product with "Tare weight handling" enabled
+- Fixed that the aggregated amount of parent products was wrong on the stock overview page when the child products had not the same stock quantity units
+- Fixed that edited stock entries were not considered for the price history chart on the product card
+- Fixed that `FEATURE_FLAG_STOCK_BEST_BEFORE_DATE_TRACKING` is set to `false`, the purchase page validation failed (thanks @fipwmaqzufheoxq92ebc)
+- Fixed that consuming (and editing the amount of) products with enabled tare weight handling did not work on the stock entries page
+- Fixed that the recipes dropdown on the consume page also displayed internal recipes (thanks @kriddles)
+- Fixed that opening tare weight handling enabled products is prevented via the UI and the API (as this makes no sense)
+- Fixed that undoing a consume transaction of an opened item added it back to stock unopened
+- Fixed that a "Total price" on purchase was not handled correctly for tare weight handling enabled products (the total price was wrongly related to the amount including the tare weight)
+
+### Shopping list improvements
+- Added a button to add all currently in stock but overdue and expired products to the shopping list (thanks @m-byte)
+- Improved that when `FEATURE_FLAG_STOCK` is disabled, all product/stock related inputs and buttons are now hidden on the shopping list page (thanks @fipwmaqzufheoxq92ebc)
+- Shopping list items can now have their own Userfields (entity `shopping_list`), on the shopping list table those fields are rendered additionally to the product Userfields
+- The print view is now configurable (new dialog before printing - option to hide header, group products by their product group, alternative list layout)
+- Fixed that "Add products that are below defined min. stock amount" always rounded up the missing amount to an integral number, this now allows decimal numbers
+
+### Recipe improvements/fixes
+- It's now possible to print recipes (button next to the recipe title) (thanks @zsarnett)
+- Changed that recipe costs are now based on the costs of the products picked by the default consume rule ("Opened first, then first due first, then first in first out") (thanks @kriddles)
+  - Recipe costs were based on the last purchase price per product before, so this now better reflects the current real costs
+- Improved the recipe add workflow (a recipe called "New recipe" is now not automatically created when starting to add a recipe) (thanks @zsarnett)
+- On the recipe page, the calories and costs per ingredient are now shown to get a better overview of how much each ingredient contributed
+- Fixed that images on the recipe gallery view were not scaled correctly on larger screens (thanks @zsarnett)
+- Fixed that decimal ingredient amounts maybe resulted in wrong conversions or truncated decimal places if your locale does not use a dot as the decimal separator (thanks @m-byte)
+- Fixed that a recipe cannot be included in itself (because this will cause an infinite loop) (thanks @fipwmaqzufheoxq92ebc)
+- Fixed that when editing a recipe ingredient the checkbox "Disable stock fulfillment checking for this ingredient" was not initaliased with the saved value
+- Fixed that the status filter ("Enough in stock", etc.) on the recipes page did not filter recipes on the gallery tab (thanks @fipwmaqzufheoxq92ebc)
+- Fixed that consuming a recipe ingredient with tare weight handling enabled consumed a wrong amount (thanks @fipwmaqzufheoxq92ebc)
+- Fixed that consuming a parent product recipe ingredient did not consider quantity unit conversion when effectively consuming a child product
+
+### Meal plan fixes
+- Fixed that for products the quantity unit purchase was displayed instead of the products quantity unit stock (thanks @BenoitAnastay)
+
+### Chores improvements/fixes
+- Chores can now be disabled to keep the history/journal, but hide it everywhere, without deleting it (new chore option "Active", deleting a chore now explicitly also deletes its journal and all other references)
+- Changed that not assigned chores on the chores overview page display now just a dash instead of an ellipsis in the "Assigned to" column to make this more clear (thanks @Germs2004)
+- The assignment type "Random" now don't prevents anymore that the last user will be assigned next
+- Fixed (again) that weekly chores, where the next execution should be in the same week, were scheduled (not) always (but sometimes) for the next week only (thanks @shadow7412)
+- Fixed that the assignment type "In alphabetic order" did not work correctly (the last person in the list was always assigned next once reached) (thanks @fipwmaqzufheoxq92ebc)
+
+### Equipment improvements
+- There is now a button to download the instruction manual (next to the "expand to fullscreen"-button)
+
+### Calendar improvements/fixes
+- Events are now links to the corresponding page (thanks @zsarnett)
+- Fixed a PHP warning when using the "Share/Integrate calendar (iCal)" button (thanks @tsia)
+- Fixed that "Track date only"-chores were always displayed at 12am (are now displayed as all-day events)
+- Fixed that it was not possible to switch to an other view than the default one on mobile (thanks @PhyberApex)
+
+### Tasks improvements
+- Tasks don't need to unique anymore (name field)
+
+### Batteries improvements
+- Batteries can now be disabled to keep the history/journal, but hide it everywhere, without deleting it (new battery option "Active", deleting a battery now explicitly also deletes its journal and all other references)
+
+### Userfield improvements/fixes
+- New Userfield type "File" to attach any file, will be rendered as a link to the file in tables (if enabled) (thanks @fipwmaqzufheoxq92ebc)
+- New Userfield type "Picture" to attach a picture, the picture will be rendered (small) in tables (if enabled) (thanks @fipwmaqzufheoxq92ebc)
+- New Userfield type "Link (with title)" - a link with a title (two input fields), so that the title is rendered in tables (if enabled) instead of the link itself
+- Userfields can now be reordered on the input form (new field "Sort number" per Userfield, fields will be ordered by that number, if any)
+- Users can now also have Userfields
+
+### General & other improvements/fixes
+- UI refresh / style improvements (thanks @zsarnett for the idea and initial work on this)
+- Improved mobile views (thanks @4lloyd for the idea and initial work on this)
+  - The buttons on the top of each page and the filter row is now collapsed (use the ellipsis/filter button to show them, this also superseded the shopping list compact view)
+  - Tables are horizontally scrollable (instead of collapsing columns which don't fit)
+- All tables are now customizable (new little eye icon on the top left corner on each table)
+  - Table columns be shown/hidden
+    - There are also new columns on some pages, hidden by default
+      - Stock overview: Value, Product group, Calories, Last purchased, Last price, Min. stock amount
+      - Products list: Default store
+      - Shopping list: Last price (Unit), Last price (Total), Default store, Barcodes (as scannable code-image)
+  - Row grouping can be customized to use any available column (thanks @edenhaus)
+- Table states (visible columns, sorting, column order and so on) are now saved server side (in user settings) means that this stays the same when using different browsers
+- Dialogs are now used everywhere where appropriate instead of jumping between pages (for example when adding/editing shopping list items)
+- Added a "Clear filter"-button on all pages (with filters) to quickly reset applied filters
+- Users can now have a picture (will then be shown next to the current user name instead of the generic user icon)
+- Prefilled number inputs now use sensible decimal places (max. the configured decimals while hiding trailing zeros where appropriate, means if you never use partial amounts for a product, you'll never see decimals for it)
+- Improved / more precise validation messages for number inputs
+- Optimized what's hidden when `GROCY_FEATURE_FLAG_STOCK` is disabled
+  - Products, quantity units and product groups are possible to use now
+  - Means you can use for example the shopping list, recipes and the meal plan with products while the "stock handling part" is hidden
+- Ordering now happens case-insensitive
+- The data path (previously fixed to the `data` folder) is now configurable, making it possible to run multiple Grocy instances from the same directory (with different `config.php` files / different database, etc.) (thanks @fgrsnau)
+  - Via an environment variable `GROCY_DATAPATH` (higher priority)
+  - Via an FastCGI parameter `GROCY_DATAPATH` (lower priority)
+- The language can now be set per user (see the new user settings page / top right corner settings menu) (thanks @fipwmaqzufheoxq92ebc)
+  - Additionally, the language is now also auto-guessed based on the browser locale (HTTP-Header `Accept-Language`)
+  - The `config.php` option `CULTURE` was renamed to `DEFAULT_LOCALE`
+  - So the used language is based on (in that order)
+    - The user setting
+    - If not set, then based on browser locale
+    - If no matching localizaton was found, `DEFAULT_LOCALE` from `config.php` is used
+- Performance improvements (page loading time) of the stock overview page (thanks @fipwmaqzufheoxq92ebc)
+- The prerequisites checker now also checks for the minimum required SQLite version (thanks @Forceu)
+- Replaced (again, added before in v2.7.0, then reverted in v2.7.1 due to some problems) [QuaggaJS](https://github.com/serratus/quaggaJS) (seems to be unmaintained) by [Quagga2](https://github.com/ericblade/quagga2)
+- More `config.php` settings (see the section `Component configuration for Quagga2`) to tweak Quagga2 (this is the component used for device camera for barcode scanning) (thanks @andrelam)
+- Some localization string fixes (thanks @duckfullstop)
+- Better error pages
+- Fixed that numeric and date-time sorting of table columns did not work correctly
+- Fixed that XSS / HTML injection was possible through some user input fields (low severity / not really a problem as this could not be abused unauthenticated)
+- New translations: (thanks all the translators)
+  - Greek (demo available at https://el.demo.grocy.info)
+  - Korean (demo available at https://ko.demo.grocy.info)
+  - Chinese (China) (demo available at https://zh-cn.demo.grocy.info)
+  - Tamil (demo available at https://ta.demo.grocy.info)
+  - Finnish (demo available at https://fi.demo.grocy.info)
+
+### API improvements/fixes
+- ⚠️ **Breaking changes**:
+  - All prices are now related to the products stock quantity unit (instead of the products purchase QU)
+  - All (product) amounts are now related to the products stock quantity unit (was related to the products purchase QU for the shopping list before)
+  - The product object no longer has a field `barcodes` with a comma separated barcode list, instead barcodes are now stored in a separate table/entity `product_barcodes` (use the existing "Generic entity interactions" endpoints to access them)
+  - The endpoint `/objects/{entity}/search` was removed (use the existing `/objects/{entity}` endpoint with the new filter capabilities mentioned below)
+  - The output / field names of `ProductDetailsResponse` have slightly changed (endpoint `/stock/products/{productId}`)
+  - Endpoint `/stock/volatile`
+    - The query parameter `expring_days` was renamed to `due_soon_days`
+    - The field `expiring_products` was renamed to `due_products`
+    - The field `expired_products` now only contains expired products (so them with `Due date type = Expiration date`)
+    - The new field `overdue_products` contains only overdue products (so them with `Due date type = Best before date`)
+  - The following endpoints now return all bookings of the transaction (so the response is now an array, was before a single stock booking - and a random one if the transaction affected multiple stock entries)
+    - PUT `/stock/entry/{entryId}`
+    - POST `/stock/products/{productId}/add`
+    - POST `/stock/products/{productId}/consume`
+    - POST `/stock/products/{productId}/transfer`
+    - POST `/stock/products/{productId}/inventory`
+    - POST `/stock/products/{productId}/open`
+    - POST `/stock/products/by-barcode/{barcode}/add`
+    - POST `/stock/products/by-barcode/{barcode}/consume`
+    - POST `/stock/products/by-barcode/{barcode}/transfer`
+    - POST `/stock/products/by-barcode/{barcode}/inventory`
+    - POST `/stock/products/by-barcode/{barcode}/open`
+    - (The response is the same as if you would fetch the stock transaction via `/stock/transactions/{transactionId}`)
+- For better integration (apps), it's now possible to show a QR-Code for API keys (thanks @fipwmaqzufheoxq92ebc)
+  - New QR-Code button on the "Manage API keys"-page (top right corner settings menu), the QR-Codes contains `<API-Url>|<API-Key>`
+  - And on the calendar page when using the button "Share/Integrate calendar (iCal)", there the QR-Codes contains the Share-URL (which is displayed in the textbox above)
+- The output of the following endpoints can now be filtered (by any field), ordered and paginated (thanks for the initial work on this @fipwmaqzufheoxq92ebc)
+  - `/objects/{entity}`
+  - `/stock/products/{productId}/entries`
+  - `/stock/products/{productId}/locations`
+  - `/recipes/fulfillment`
+  - `/users`
+  - `/tasks`
+  - `/chores`
+  - `/batteries`
+  - There are 4 new (optional) query parameters to utilize that
+    - `order` The field to order by (use the separator `:` to specify the sort order - `asc` or `desc`, defaults to `asc` when omitted)
+    - `limit` The maximum number of objects to return
+    - `offset` The number of objects to skip
+    - `query[]` An array of conditions, each of them is a string in the form of `<field><condition><value>`, where
+      - `<field>` is a field name
+      - `<condition>` is a comparison operator, one of
+        - `=` equal
+		- `!=` not equal
+        - `~` LIKE
+        - `!~` not LIKE
+        - `<` less
+        - `>` greater
+        - `<=` less or equal
+        - `>=` greater or equal
+        - `§` regular expression
+      - `<value>` is the value to search for
+- New endpoint `/stock/shoppinglist/add-overdue-products` to add all currently in stock but overdue products to a shopping list (thanks @m-byte)
+- New endpoint `/stock/shoppinglist/add-expired-products` to add all currently in stock but expired products to a shopping list
+- New endpoints GET/POST/PUT `/users/{userId}/permissions` for the new user permissions feature mentioned above
+- New endpoint `/user` to get the currently authenticated user
+- New endpoint DELETE `/user/settings/{settingKey}` to delete a user setting
+- New endpoint POST `/stock/products/{productIdToKeep}/merge/{productIdToRemove}` for the new product merging feature mentioned above
+- The following entities are now also available via the endpoint `/objects/{entity}` (only listing, no edit)
+  - `stock_log` (the stock journal)
+  - `stock` (the "raw" stock entries)
+  - `stock_current_locations` (info how much of each product is currently stored at which location)
+- Performance improvements of the `/stock/products/*` endpoints (thanks @fipwmaqzufheoxq92ebc)
+- The endpoint `/stock/products/{productId}/locations` now also has an optional query parameter `include_sub_products` to optionally also return locations of sub products of the given product
+- The following endpoints  now have an optional request body parameter `allow_subproduct_substitution` to consume/open any child product when the given product is a parent product and currently not in stock
+  - `/stock/products/{productId}/consume`
+  - `/stock/products/by-barcode/{barcode}/consume`
+  - `/stock/products/{productId}/open`
+  - `/stock/products/by-barcode/{barcode}/open`
+- Fixed that the endpoint `/objects/{entity}/{objectId}` always returned successfully, even when the given object not exists (now returns `404` when the object is not found) (thanks @fipwmaqzufheoxq92ebc)
+- Fixed that the endpoint `/stock/volatile` didn't include products which are due today (thanks @fipwmaqzufheoxq92ebc)
+- Fixed that the endpoint `/objects/{entity}` did not include Userfields for Userentities (so the effective endpoint `/objects/userobjects`)
+- Fixed that the endpoint `/stock/consume` returned the response code `200` and an empty response body when `stock_entry_id` was set (consuming a specific stock entry) but invalid (now returns the response code `400`) (thanks @fipwmaqzufheoxq92ebc)
+- Fixed that the endpoint `/user/settings/{settingKey}` didn't return the default setting if it was not configured for the current user (same behavior as the endpoint `/user/settings` now)
+- Endpoint `/calendar/ical`: Fixed that "Track date only"-chores were always set to happen at 12am (are treated as all-day events now)
+- Fixed (again) that CORS was broken

changelog/61_3.0.1_2021-01-05.md

@@ -0,0 +1,19 @@
+> ⚠️⚠️ SQLite >= 3.9.0 (was released in late 2015) is required
+>
+> [Here](https://github.com/grocy/grocy/issues/1209#issuecomment-749760765) is a workaround if you still run a SQLite version >= 3.8.3 < 3.9.0
+>
+> _PHP 7.2 (with SQLite 3.8.3+) was the formerly minimum runtime requirement, any future release will only support PHP 7.4 (with SQLite 3.27.2+) - supporting those (very) old runtime stuff is too time consuming..._
+
+- Improved the prerequisites checker (added missing required PHP extension `ctype`) (thanks @Forceu)
+- Added validation checks for most `data/config.php` settings to prevent using invalid ones (thanks @Forceu)
+- When using reverse proxy authentication (`ReverseProxyAuthMiddleware`), _additionally_ a valid API key can now also be used for authentication (if you don't want to protect the API endpoints via your reverse proxy, however)
+- Added a new API endpoint `/system/time` to get the current server time (thanks @Forceu)
+- An amount attached to a barcode is now also prefiled when scanning the product on the Consume/Transfer/Inventory page
+- Fixed that some number inputs were broken when the new decimal places setting were set to `0`
+- Fixed that browser camera barcode scanning did not work on the product edit page for adding product barcodes
+- Fixed that indirect unit conversions (those between units, not product overrides) could not be used/selected
+- Fixed that the new product option "Never show on stock overview" was unintentionally set by default for new products
+- Fixed that adding items to the shopping list from the context/more menu on the stock overview page did not work
+- Fixed that consuming was not possible when `FEATURE_FLAG_STOCK_LOCATION_TRACKING` was disabled
+- Fixed that adding images in text editor fields did not work
+- Fixed some other minor UI glitches

changelog/62_3.1.0_2021-07-16.md

@@ -0,0 +1,128 @@
+> ⚠️ The following PHP extensions are now additionally required: `json`, `intl`, `zlib`
+
+> ⚠️ PHP 8.0 (with SQLite 3.27.2+) is from now on the only supported runtime version.
+
+### New Feature: Grocycode / label printer support
+
+#### (Own) Product/stock entry/chores/batteries labels/barcodes
+- Print own labels/barcodes for products/stock entries/chores/batteries and then scan that code on every place a product/stock entry/chore/battery can be selected
+- Can be printed (or downloaded) via
+  - The product/chore/battery edit page
+  - The context/more menu per line on the overview pages and for stock entries on the stock entries page
+  - Automatically on purchase (new option on the purchase page, defaults can be configured per product) for stock entries
+- The used barcode type can be configured via the `config.php` option `GROCYCODE_TYPE`:
+  - `1D` (default) will produce a `Code128` 1D barcode (supported by the integrated camera barcode scanner)
+  - `2D` will produce a `DataMatrix` 2D barcode (currently not supported by the integrated camera barcode scanner, but can be probably printed smaller)
+- Label printer functionality can be enabled via the new feature flag `FEATURE_FLAG_LABEL_PRINTER` (defaults to disabled)
+- Label printer communication happens via WebHooks - see the new `LABEL_PRINTER*` `config.php` options
+- grocycodes can also be used without a label printer - you can view or download thm as pictures and print them manually
+- More information:
+  - https://github.com/grocy/grocy/tree/v3.1.0/docs/grocycode.md
+  - https://github.com/grocy/grocy/tree/v3.1.0/docs/label-printing.md
+- (Thanks a lot @mistressofjellyfish for the initial work on this)
+
+### New Feature: Meal plan sections
+- Split the meal plan into sections like Breakfast/Lunch/Dinner
+  - => New button "Configure sections" on the meal plan page to configure the sections (top right corner)
+  - => Each meal plan entry can be assigned to a section
+
+### New Feature: Shopping list thermal printer support
+- The shopping list can now be printed on a thermal printer
+  - The printer must be compatible to the `ESC/POS` protocol and needs to be locally attached or network reachable to/by the machine hosting Grocy (so the server)
+  - See the new `TPRINTER*` `config.php` options to configure the printer connection and other options
+  - => New button on the shopping list print dialog
+- Can be enabled via the new feature flag `FEATURE_FLAG_THERMAL_PRINTER` (defaults to disabled)
+- (Thanks a lot @Forceu)
+
+### Stock improvements/fixes
+- Product barcodes are now enforced to be unique across products
+- On the stock overview page it's now also possible to search/filter by product barcodes (via the general search field)
+- The product picker on the consume and transfer page now only shows products which are currently in stock
+- Added a filter option to only show currently in stock products on the stock overview and products list (master data) page
+- Added new columns on the stock overview page (hidden by default): Product description, product default location, parent product, product picture
+- Added a new product option "Should not be frozen" (defaults to disabled and only visible when `FEATURE_FLAG_STOCK_PRODUCT_FREEZING` is enabled)
+  - When enabled, on moving the product to a freezer location (so when freezing it), a corresponding warning will be shown
+- Optimized that when opening a product which has "Default due days after opened" set, the resulting date now never extends the original due date
+- Added a new stock setting (top right corner settings menu) "Add decimal separator automatically for price inputs" (defaults to disabled)
+  - When enabled, you always have to enter the value including decimal places, the decimal separator will be automatically added based on the amount of allowed decimal places
+- Fixed that editing stock entries was not possible
+- Fixed that consuming with Scan Mode was not possible
+- Fixed that the current stock total value (header of the stock overview page) didn't include decimal amounts (thanks @Ape)
+- Fixed that the transfer page was not fully populated when opening it from the stock entries page
+- Fixed that undoing a consume/open action from the success notification on the stock entries page was not possible
+- Fixed that adding a barcode to a product didn't save the selected quantity unit when the product only has a single one
+- Fixed that the store information on a stock entry was lost when transferring a partial amount to a different location
+- Fixed that the "Spoil rate" on the product card was wrong in some cases
+- Fixed that the stock journal showed always the products default location (instead of the location of the transaction)
+- Fixed that the aggregated amount of parent products was wrong when indirect quantity unit conversions were used
+
+### Shopping list improvements/fixes
+- The amount now defaults to `1` for adding items quicker
+- Added a status filter for only _done_ items
+- The total value is now also shown (based on "Last price (Total)" per item, displayed on the page header and only when `FEATURE_FLAG_STOCK_PRICE_TRACKING` is enabled)
+- Fixed that shopping list prints had a grey background (thanks @Forceu)
+- Fixed the form validation on the shopping list item page (thanks @Forceu)
+- Fixed that when adding products to the shopping list from the stock overview page, the used quantity unit was always the products default purchase QU (and not the selected one)
+- Fixed that the displayed last unit/total price was wrong when the used quantity unit was not the products stock QU
+- Fixed that the "Add as barcode to existing product" product picker workflow did not work
+
+### Recipe improvements/fixes
+- Recipe printing improvements (thanks @Ape)
+- Calories are now always displayed per single serving (on the recipe and meal plan page)
+- The note of an ingredient will now also be added to the corresponding shopping list item when using "Put missing products on the shopping list"
+- It's now possible to copy a recipe (button/dropdown menu item per recipe)
+- Fixed that the recipe page was slow when there were a lot meal plan recipe entries
+- Fixed that "Only check if any amount is in stock" (recipe ingredient option) didn't work for stock amounts < 1
+- Fixed that when adding missing items to the shopping list, on the popup deselected items got also added
+- Fixed that the amount of self produced products with tare weight handling enabled was wrong ("Produces product" recipe option)
+- Fixed that the ingredient amount calculation for included/nested recipes was (for most cases) wrong
+- Fixed that the ingredient amount was wrong when using a to the product indirectly related quantity unit
+- Fixed that the calories amount calculation was wrong when quantity unit conversions were involved
+
+### Meal plan improvements/fixes
+- Improved the meal plan page loading time (drastically when having a big history of meal plan entries)
+- Meal plan entries can now be visually marked as "done" (new button per entry)
+  - This happens automatically on consuming a recipe/product from the meal plan page
+- It's now possible to copy all entries of a day to another day (in the dropdown of the add button in the header of each day column)
+- The "Display recipe" button was removed, instead clicking the recipe title now displays the recipe (and this now also works for products; shows the product card)
+- Fixed that stock fulfillment checking used the desired servings of the recipe (those selected on the recipes page, not them from the meal plan entry)
+
+### Chores improvements/fixes
+- It's now possible to track any addtional info on a chore execution by using Userfields
+  - => Configure the desired Userfields for the entity `chores_log`
+  - => The on chore execution tracking entered information is then visible on the corresponding chore journal entry
+- Fixed that tracking chores with "Done by" a different user was not possible
+
+### Userfield improvements/fixes
+- Userfields can now be configured as mandatory (new Userfield option, defaults to disabled)
+- Fixed that numeric Userfields were initialised with `1.0`
+- Fixed that shortcuts (up/down key) and the format did not work correctly when using multiple date/time Userfields per object
+- Fixed that Userfields were not saved when adding a product or a recipe (only on editing)
+
+### General & other improvements/fixes
+- LDAP authentication improvements / OpenLDAP support (thanks @tank0226)
+  - A read only service account can now be used for binding
+  - The username attribute is now configurable
+  - Filtering of accounts is now possible
+  - => See the new `LDAP*` `config.php` options
+- Improved the page loading time of all journal pages (stock/chores/batteries) by adding a new date range filter
+- Some night mode style improvements (thanks @BlizzWave and @KTibow)
+- Help tooltips are now additionally also triggered by clicking on them (instead of only hovering them, which doesn't work on mobile / touch devices)
+- The camera barcode scanner now also supports Code 39 barcodes (used for example in Germany on pharma products (PZN)) (thanks @andreheuer)
+- Fixed that the number picker up/down buttons did not work when the input field was empty or contained an invalid number
+- Fixed that links and embeds (e.g. YouTube videos) did not work in the text editor
+- Fixed that the "Manage users" and "Manage API keys" menu was not shown when using reverse proxy authentication
+
+### API improvements/fixes
+> ~~❗ Numbers are now returned as numbers (so technically without quotes around them, were strings for nearly all endpoints before - should practically be no real difference)~~
+>
+> => ❗❗❗ This has been reverted after this (v3.1.0) release since it had unintended side effects
+- Added a new endpoint `/system/localization-strings` to get the localization strings (gettext JSON representation; in the by the user desired language)
+- Added a new endpoint `/recipes/{recipeId}/copy` to copy a recipe
+- The `GET /chores` endpoint now also returns the `next_execution_assigned_user` object per chore (like the endpoint `GET /chores​/{choreId}` already did for a single chore)
+- The `GET /tasks` endpoint now also returns the assigned user and category object per task
+- Empty Userfields are now also returned (were previously omitted, endpoint `GET /objects/{entity}` and `GET /objects/{entity}/{objectId}`)
+- Fixed that due soon products with `due_type` = "Expiration date" were missing in `due_products` of the `/stock/volatile` endpoint
+- Fixed that `PUT/DELETE /objects/{entity}/{objectId}` produced an internal server error when the given object id was invalid (now returns `400 Bad Request`)
+- Fixed that hyphens in filter values did not work
+- Fixed that cyrillic letters were not allowed in filter values

changelog/63_3.1.1_2021-08-21.md

@@ -0,0 +1,16 @@
+- Fixed that the upgrade failed when having "> 2 times duplicate" (means the same barcode was added more than 2 times) product barcodes
+- Fixed that the upgrade failed when having unsupported parent/child product nesting levels
+  - More information on this: Only 1 level is currently supported; creating > 1 level nestings was _never_ possible via the UI/frontend, but not checked/enforced by the backend before `v3.0.0` - so it was potentially possible via the API (or any third party app/tool which utilizes it) to create such a nesting which then made this upgrade to fail
+- Fixed that it was not possible to select a chore/battery on the corresponding tracking pages by mouse/touch
+- Fixed that grouping by columns in tables may caused duplicate groups
+- Fixed that Grocycode camera barcode scanning didn't recognize the scanned code for chore/battery tracking
+- Fixed that when having any "Track date only" chore on the calendar, the iCal export was broken
+- Optimized the meal plan page to be properly printable (thanks @MrKrisKrisu)
+
+### API
+> ❗ The release before (v3.1.0) introduced that "numbers are now returned as numbers": **This was reverted** since it had unintended side effects (so all fields are technically strings now again, just like before - sorry for that)
+- Fixed that `missing_products` of the `/stock/volatile` endpoint also contained inactive products
+- Fixed that when having multiple Userfields for an entity, the `/objects/{entity}` endpoint returned wrong Userfield values
+- Fixed that the `/stock/products/by-barcode/{barcode}/consume` and `/stock/products/by-barcode/{barcode}/transfer` endpoints haven't used the stock entry given by a stock entry Grocycode (thanks @lowlee for the initial work on this)
+- Fixed that the "Stock by-barcode" API routes were broken for normal barcodes (only grocycodes were accepted) (thanks @larsverp)
+- Fixed that the "Stock by-barcode" API routes also accepted chore or battery grocycodes (thanks @lowlee)

changelog/64_3.1.2_2021-09-27.md

@@ -0,0 +1,12 @@
+- Fixed that the "Add all list items to stock" shopping list workflow did not work for more than ~6 items (thanks @tjhowse)
+- Fixed that plural form handling (e.g. for quantity units) was wrong for negative numbers
+- Fixed that the context menu entries `Consume` and `Transfer` on the stock overview page were disabled when the amount in stock was < 1
+- Fixed that on consuming a product from not the products default location, the products default location was recorded in the stock journal
+- Fixed that when undoing a stock consume transaction from not the products default location, the corresponding amount was always added back to to the products defaullt location
+- Fixed that when having multiple quantity unit conversions for a products default QU purchase, on purchase was potentially a wrong conversion factor picked
+- Fixed that when there was any chore with a schedule, but without a "next estimated tracking" date/time, the iCal export was broken
+- The product and chore edit pages now have bottom-sticky save buttons
+- A product picture can now be added when creating a product (was currently only possible when editing a product)
+
+### API
+- Fixed that international characters and spaces were not allowed in API query filters

changelog/65_3.1.3_2021-11-14.md

@@ -0,0 +1,19 @@
+- The "Below min. stock amount" filter on the stock overview page now also includes due-soon, overdue or already expired products
+- The default shopping list (named "Shopping list"; localized) can now be renamed
+- Added the products average price as a (hidden by default) column on the stock overview page
+- Added a new "Presets for new products" stock setting for the "Default due days" option of new products
+- When adding (purchase) a product with "Default due days after freezing" set directly to a freezer location, the due date is now prefilled by that (instead of the normal "Default due days") (thanks @grahamc for the initial work on this)
+- Chores can now be merged (new item in the context-/more-menu on the chores list page)
+- Fixed that "Label per unit" stock entry labels (on purchase) weren't unique per unit
+- Fixed that the "Add as new product" product picker workflow, started from the shopping list item form, always selected the default shopping list after finishing the flow
+- Fixed that when undoing a product opened transaction and when the product has "Default due days after opened" set, the original due date wasn't restored
+- Fixed that "Track date only"-chores were shown as overdue on the due day on the chores overview page
+- Fixed that dropdown filters for tables maybe did not work after reordering columns
+- Fixed that auto night mode over midnight did not always work
+- Fixed that the labels of context-/more-menu items were not readable in Night Mode (thanks @corbolais)
+- Fixed that the "Stay logged in permanently" checkbox on the login page had no effect (thanks @0)
+
+### API
+- New endpoint `/chores/{choreIdToKeep}/merge/{choreIdToRemove}` for merging chores
+- Endpoint `/stock/products/{productId}/add` API endpoint: The (optional) request body parameter `print_stock_label` was renamed to `stock_label_type`
+- Fixed that backslashes were not allowed in API query filters

changelog/66_3.2.0_2022-02-11.md

@@ -0,0 +1,79 @@
+### Stock
+
+- The `config.php` option `FEATURE_SETTING_STOCK_COUNT_OPENED_PRODUCTS_AGAINST_MINIMUM_STOCK_AMOUNT` was removed and is now a new product option `Treat opened as out of stock`, means, if opened stock entries will be counted as missing for calculating if a product is below its minimum stock amount, can now be configured per product
+  - The existing option will be migrated to all existing products, so no changed behavior after the update
+  - There is also a new stock setting (section "Presets for new products") which can be used to configure the default when adding products (also that will be set based on the old setting on migration)
+- When using/scanning a stock entry Grocycode on the consume page, the amount is now prefilled by the stock entry amount (making it essentially possible to consume the corresponding stock entry in one go)
+- Stock entry labels get now also printed on inventory (only when adding products, same option "Stock entry label" like on the purchase page)
+- Fixed that stock entry labels on purchase were printed, even when "No label" was selected (was only a problem when running label printer WebHooks server side)
+- Fixed that formatted (HTML) text for the (hidden by default) product description column on the stock overview page was not correctly displayed
+- Fixed that numeric and date-time sorting of table columns on the stock entries page did not work correctly (thanks @MasterofJOKers)
+- Fixed that the consume page/dialog wasn't properly initialized when opening it from the stock entries page
+- Fixed that entries for not existing users were missing on the stock journal
+
+### Recipes
+
+- Optimized recipe costs calculation to better reflect the current real costs: Out of stock ingredients now use the last price
+  - Background: Before v3.0.0 recipe costs were only based on the last price per product and since v3.0.0 the "real costs" (based on the default consume rule "Opened first, then first due first, then first in first out") are used, means out of stock items have no price - so using the last price for out of stock items should reflect the current real costs better
+- Added a new recipes setting (top right corner settings menu) "Show the recipe list and the recipe side by side" (defaults to enabled, so no changed behaviour when not configured)
+  - When disabled, on the recipes page, the recipe list is displayed full-width and the recipe will be shown in a popup instead of on the right side
+- Recipes are now also Grocycode enabled (works like any other Grocycode; download/print it via the recipes edit page or the more/context menu on the recipes page; use/scan it at any place a recipe can be selected)
+- Performance improvements (page loading time) of the recipes page
+- Fixed that when adding missing recipe ingredients, with the option "Only check if any amount is in stock" enabled, to the shopping list, unit conversions (if any) weren't considered
+- Fixed that the recipe stock fulfillment information about shopping list amounts was not correct when the ingredient had a decimal amount
+
+### Meal plan
+
+- Meal plan sections can now (optionally) define a time, which will then be displayed on the meal plan section header and used for the corresponding calendar events
+  - Additionally the correspnding calendar event now also mentions the meal plan section name
+- The day/week view can now be toggled
+  - New button on top right corner of the meal plan (only visible on bigger screens)
+  - On smaller screen the day view is still the default (no change)
+- Fixed that the meal plan showed the total calories per recipe (instead of per serving as stated by the suffix)
+
+### Chores
+
+- Chore schedules can now be skipped
+  - New button on the chores overview and chore tracking page
+  - Skipped schedules will be highlighted accordingly on the chore journal
+- Added a new chore option "Start date" which is used as a schedule starting point when the chore was never tracked
+  - Until now, the schedule starting point was the first tracked execution
+  - For all existing chores, the start date will be set to the first tracked execution time (or today, for chores which were never tracked) on migration
+- The `Yearly` period type has been changed to be schedule the chore on the _same day_ each year
+  - This period type scheduled chores 1 year _after the last execution_ before, which is also possible by using the `Daily` period type and a period interval of 365 days; all existing `Yearly` schedules will be converted to that on migration
+- Added a new `Hourly` period type (to schedule chores every `x` hours)
+- Added a new `Adaptive` period type (to schedule chores dynamically based on the past average execution frequency)
+- Removed the period type `Dynamic regular`, since it's the same as `Daily`
+  - All existing `Dynamic regular` schedules will be converted to that on migration
+- The chorecard now also shows the average execution frequency (how often the chore was executed in the past on average)
+
+### Calendar
+
+- Fixed that when having a task without a due date, the iCal export was broken
+
+### Tasks
+
+- Added a "Save & add another task"-button on the add task dialog to quickly create multiple tasks without having to close/reopen the dialog
+- Fixed that when editing a task without a due date, `1970-01-01` was shown
+
+### General
+
+- Added a separate status filter and table row highlighting (blue) on the chores, tasks and batteries overview pages for items due today
+  - Additionally, the "due soon" days of chores/tasks/batteries (top right corner settings menu) can be set to `0` to disable that filter/highlighting
+- Optimized relative time display (also fixed a phrasing problem for some languages, e.g. Hungarian) (thanks @Tallyrald)
+- New input shorthand `[+/-]n[d/m/y]` for date fields to quickly input a date relative to today (adding (**+**) or subtracting (**-**) the **n**umber of **d**ays/**m**onths/**y**ears, see the full list of available shorthands [here](https://github.com/grocy/grocy#input-shorthands-for-date-fields))
+- When using LDAP authentication, the configured `LDAP_UID_ATTR` is now used to compare if the user already exists instead of the username entered on the login page (that prevents creating multiple users if you enter the username in different notations) (thanks @FloSet)
+- When using reverse proxy authentication (`ReverseProxyAuthMiddleware`), it's now also possible to pass the username in an environment variable instead of an HTTP header (new `config.php` option `REVERSE_PROXY_AUTH_USE_ENV`) (thanks @Forceu)
+- The `config.php` option `DISABLE_BROWSER_BARCODE_CAMERA_SCANNING` has been renamed to `FEATURE_FLAG_DISABLE_BROWSER_BARCODE_CAMERA_SCANNING`
+- Fixed that when having a quantity unit matching any application string, the translation of that string was used to display that unit
+- Fixed that the logout button/menu was missing when using external authentication (e.g. LDAP)
+- New translations: (thanks all the translators)
+  - Catalan (demo available at https://ca.demo.grocy.info)
+
+### API
+
+- The API endpoint `/stock/shoppinglist/clear` has now a new optional request body parameter `done_only` (to only remove done items from the given shopping list, defaults to `false`)
+- The API endpoint `/chores/{choreId}/execute` has now a new optional request body parameter `skipped` (to skip the next chore schedule, defaults to `false`)
+- The API endpoint `/chores/{choreId}` has new response field/property `average_execution_frequency_hours` (contains the average past execution frequency in hours or `null`, when the chore was never executed before)
+- New API endpoint `/recipes/{recipeId}/printlabel` (to print recipe grocycodes on the configured label printer)
+- Fixed that the barcode lookup for the "Stock by-barcode" API endpoints was case sensitive

changelog/67_3.3.0_2022-04-08.md

@@ -0,0 +1,121 @@
+### New Feature: Notes and Userfields for stock entries
+
+- Stock entries can now have notes
+  - For example to distinguish between same, yet different products (e.g. having only a generic product "Chocolate" and note in that field what special one it is exactly this time - as an alternative to have sub products)
+  - Or for example to track ownership of stock items when sharing the fridge with your flatmates
+  - => New field on the purchase and inventory (and stock entry edit) page
+  - => New column on the stock entries and stock journal page
+  - => Visible also in the "Use a specific stock item" dropdown on the consume and transfer page
+- Additionally it's also possible to add arbitrary own fields by using Userfields
+  - => Configure the desired Userfields for the entity `stock`
+  - => Those Userfields are then visible on the same places as mentioned above for the built-in "Note" field
+
+### New Feature: Recipes "Due score"
+
+- A number (new column on the recipes page) which represents a score which is higher the more ingredients, of the corresponding recipe, currently in stock are due soon, overdue or already expired
+  - Or in other words: A score to see which recipes to cook to not waste already overdue/expired or due soon products
+- The score is in detail based on:
+  - 1 point for each due soon ingredient (based on the stock setting "Due soon days")
+  - 10 points per overdue ingredient
+  - 20 points per expired ingredient
+  - (or else 0)
+- The corresponding ingredient is also highlighted in red/yellow/grey (same colors as on the stock overview page)
+
+### Stock
+
+- It's now possible to change a products stock QU, even after it was once added to stock
+  - When the product was once added to stock, there needs to exist a corresponding unit conversion for the new QU
+- Product card, stock overiew and stock entries page optimizations regarding displaying prices:
+  - Prices are now shown per default purchase quantity unit, instead of per stock QU and when clicking/hovering, a tooltip shows the price per stock QU
+  - The price history chart is now based on the value per purchase QU, instead of per stock QU
+- New product option "Default consume location" (not mandatory, defaults to not set / empty)
+  - When set, stock entries at that location will be consumed first
+  - => This will be automatically taken into account when consuming from the stock overview page and all other places where no specific location can be selected
+  - => On the consume page the location is preselected in the following order:
+    1. The new default consume location, if the product currently has any stock there, otherwise
+    2. The products default location, if the product currently has any stock there, otherwise
+    3. The first location where the product currently has any stock
+- Optimized quantity unit conversion handling:
+  - The option "Create inverse QU conversion" was removed when creating a QU conversion
+  - => Instead the corresponding inverse conversion is now always created/updated/deleted automatically
+- New product option "Disable own stock" (defaults to disabled)
+  - When enabled, the corresponding product can't have own stock, means it will not be selectable on purchase (useful for parent products which are just used as a summary/total view of the sub products)
+- The location content sheet can now optionally list also out of stock products (at the products default location, new checkbox "Show only in stock products" at the top of the page, defaults to enabled)
+- Added a location filter to the stock entries page
+- Added the product Grocycode as a (hidden by default) column to the products list (master data)
+- The price entered on the inventory page is now related to the selected quantity unit (like on the purchase page, was always related to the products stock QU before)
+- Fixed that consuming via the consume page was not possible when `FEATURE_FLAG_STOCK_LOCATION_TRACKING` was disabled
+
+### Shopping list
+
+- Added a new shopping list setting (top right corner settings menu) to automatically add products, that are below their defined min. stock amount, to the shopping list (defaults to disabled)
+- Fixed that when using "Add products that are below defined min. stock amount", the calculated missing amount was wrong for products which had the new product option `Treat opened as out of stock` set and when having at least one opened stock entry
+
+### Recipes
+
+- When a parent product is used as an ingredient, which is currently not in stock itself, the substituted product (so the one which was already taken into account when consuming the recipe) is now displayed below the ingredient and the costs (and calories) are taken from that one, to reflect the current real costs even better
+- Added a new recipes setting (top right corner settings menu) "Show a little checkbox next to each ingredient to mark it as done" (defaults to disabled)
+  - When enabled, next to each ingredient a little checkbox will be shown
+  - When clicked, the ingredient is crossed out
+  - This status is not saved, means reset when the page is reloaded
+- Fixed that consuming recipes was possible when not all ingredients were in stock (and this potentially consumed some of the in stock ingredients; not matching the message "nothing removed")
+- Fixed that the price of the "Produces product"-product, which is added to stock on consuming a recipe, was wrong (was the recipe total costs multiplied by the serving amount instead of only the recipe total costs)
+- Fixed that calories of recipe ingredients were displayed with an indefinite number of decimal places
+- Fixed that ingredient amounts were wrong for multi-nested (> 2 levels) recipes, when the included recipe used an serving amount other than 1
+- Fixed that searching/filtering the recipe gallery view did not work correctly
+- Fixed that searching/filtering recipes by products did not work (e.g. via the context-/more menu option "Search for recipes containing this product" on the stock overview page)
+
+### Meal plan
+
+- The day is now editable on the edit dialog of any meal plan entry, which makes it possible to move entries to a different day
+- Fixed that it was not possible to print the meal plan (and other pages) in landscape (thanks @miguelangel-nubla)
+
+### Chores
+
+- The `Daily` period type has been changed to schedule the chore at the _same time_ (based on the start date) each `n` days
+  - This period type scheduled chores `n` days _after the last execution_ before, which is also possible by using the `Hourly` period type and a corresponding period interval; all existing `Daily` schedules will be converted to that on migration
+- It's now possible to manually reschedule / assign chores
+  - New entry "Reschedule next execution" in the context/more menu on the chores overview page
+  - If you have rescheduled a chore and want to continue the normal schedule/assignment instead, use the "Clear" button in the same dialog
+  - Rescheduled/reassigned chores will be highlighted with an corresponding icon next to the "Next estimated tracking date" / "Assigned to"
+- Optimized that when skipping chores via the chore tracking page, the given time is used as the "skipped time", not the scheduled next estimated tracking time of the corresponding chore (making it essentially possible to skip more then one schedule at once)
+- Fixed that when consuming a parent product on chore execution (chore option "Consume product on chore execution"), no child products were used if the parent product itself is not in stock
+- Fixed that the upgrade to v3.2.0 failed when having any former "Dynamic Regular" chore with a "Period interval" of `0` (which makes absolutely no sense in reality)
+
+### Tasks
+
+- Fixed that tasks without a due date were highlighted in red (like overdue tasks)
+
+### Batteries
+
+- Fixed that the batteries overview page was broken when there was any battery Userfield with enabled "Show as column in tables" option
+- Fixed that Grocycode label printer printing didn't work from the battery edit page (master data) (thanks @andreheuer)
+- Fixed that undoing a battery charge cycle had no effect on "Last charged" and "Next planned charge cycle" of the corresponding battery
+
+### Equipment
+
+- It's now possible to add multiple files (PDFs / manuals) to each equipment
+  - Define as many Userfields for the entity `equipment` and use the type `File`
+  - => Each of those File-Userfields will be shown as a separate tab on the equipment page
+
+### Userfields
+
+- Userfields of type "Date & time" and "Date (without time)" have now the option to default to now / today for new objects (new Userfield option "Default value")
+
+### General
+
+- Optimized form validation: Save / submit buttons are now not disabled when the form is invalid, the invalid / missing fields are instead highlighted when trying to submit / save the form (making it more obvious which fields are invalid / missing exactly)
+- Night mode can now use / follow the system preferred color scheme
+  - The view/user setting "Enable night mode" has been removed and replaced by "Night mode" which now defaults to "Use system setting" (which uses the system preferred color scheme, "On" and "Off" are other possible options to always enable/disable night mode)
+- Some night mode style refinements
+- Fixed an server error (on every page) when not having any quantity unit
+- New translations: (thanks all the translators)
+  - Slovenian (demo available at <https://sl.demo.grocy.info>)
+
+### API
+
+- Added a new endpoint `GET /stock/locations/{locationId}/entries` to get all stock entries of a given location (similar to the already existing endpoint `GET /stock/products/{productId}/entries`)
+- Endpoint `/recipes/{recipeId}/consume`: Fixed that consuming partially fulfilled recipes was possible, although an error was already returned in that case (and potentially some of the in stock ingredients were consumed in fact)
+- Endpoint `/stock/products/{productId}`:
+  - New field/property `current_price` which returns the current price of the corresponding product, based on the stock entry to use next (defined by the default consume rule "Opened first, then first due first, then first in first out") or on the last price if the product is currently not in stock
+  - The field/property  `oldest_price` is deprecated and will be removed in a future version (this had no real sense, currently returns the same as `current_price`)

changelog/68_3.3.1_2022-06-10.md

@@ -0,0 +1,33 @@
+### Stock
+
+- New product option "Move on open" (defaults to disabled)
+  - When enabled, on marking the product as opened, the corresponding amount will be moved to the products default consume location
+  - (Thanks @RosemaryOrchard)
+- The stock setting "Decimal places allowed for prices" has been split into separate settings for input and displaying prices (the existing setting will be set for both new options on migration, so no changed behavior when not configured)
+- Optimized that when the plural form(s) of a quantity unit is/are not provided, the singular form is used to display plural amounts
+- Fixed that "Automatically add products that are below their defined min. stock amount to the shopping list" (stock setting) was only done when consuming products, not when opening them
+- Fixed that the price history chart (product card) showed the price on a wrong date when having multiple purchases on the same date from different stores
+
+### Recipes
+
+- Fixed that when a substituted product is used to display costs and calories (so when a parent product ingredient is currently not in stock itself), no unit conversions were considered for costs/calories calculation
+- Fixed that the displayed "already on the shopping list"-amount (for missing ingredients) was wrong when the products "Factor purchase to stock quantity unit" wasn't 1
+
+### Chores
+
+- Fixed that rescheduling of "Track date only"-chores for today was not possible
+
+### Calendar
+
+- Fixed that clicking on meal plan product and notes calendar entries redirected to an invalid page
+
+### General
+
+- LDAP authentication: Optimized that it's not required that LDAP accounts need to have a first-/lastname
+
+### API
+
+- Endpoint `/stock/products/{productId}`: New field/property `default_consume_location` (contains the products default consume location object)
+- Endpoint `/stock/products/{productId}/add`: Fixed that the request body parameter `transaction_type` was ignored / always set to `purchase`
+- Fixed that the endpoint `/stock/products/by-barcode/{barcode}/open` didn't handle stock entries provided by a Grocycode (thanks @jtommi)
+- Fixed that less or equal (`<=`) and greater or equal (`>=`) filter comparisons didn't work (optional `query[]` request query parameter on most endpoints)

changelog/69_3.3.2_2022-11-12.md

@@ -0,0 +1,42 @@
+### Stock
+
+- Improved that when editing a unit conversion, the "Quantity unit from" and "Quantity unit to" of the corresponding inverse conversion is now also updated accordingly if changed (until now only the factor was updated automatically)
+- Changed that the "Move on open" product option can now always be used/set, even when the "Default location" and "Default consume location" are the same
+- Fixed that stock entry notes were lost when consuming/opening/transferring a partial amount of the corresponding stock entry (thanks @akoshpinter)
+- Fixed that the average shelf life of a product (on the product card) was wrong when the corresponding stock entry was edited
+- Fixed that when the stock setting "Decimal places allowed for amounts" was set to `0`, unit conversion (if any) failed when adding the corresponding product to stock
+- Fixed that consuming a parent product which is not in stock itself (so essentially using any of the child products) may failed when unit conversions were involved (the current stock amount check was wrong in that case)
+- Fixed that the status button counters on the stock overview page ("X products are overdue" and so on) included products which have the option `Never show on stock overview` enabled
+- Fixed that adding Userfields to existing stock entries was not possible (only editing existing Userfield values, e.g. added during purchase or inventory, was possible)
+- Fixed that it was not possible to change a products stock QU, when the needed unit conversion (old QU => new QU) was only defined globally (means on QU level) or by the products "Factor purchase to stock quantity unit"
+- Fixed that when changing a products stock QU, the products "Quick consume mount", "Energy (kcal)" and "Tare weight" wasn't updated according to the corresponding unit conversion factor
+- Fixed that when changing a products stock QU, the product barcode amounts were also changed based on the corresponding unit conversion factor
+
+### Shopping list
+
+- Fixed that products could not be added to the shopping list via barcode scanning
+
+### Recipes
+
+- Fixed that headlines in the recipe description (preparation text) were removed on saving
+- Fixed that the default consume rule was not always applied correctly when a recipe consumed a substituted ingredient (so when having a parent product in the recipe which is currently not in stock itself)
+
+### Userfields
+
+- Fixed that edit forms were broken when editing an object with `null` Userfields (so when the field for that object was not set before / on the initial object creation)
+
+### General
+
+- It's now possible to edit a user without necessarily updating the users password
+- Fixed that column reordering didn't work on the stock overview, stock entries and shopping list page when showing columns which are not shown by default
+- Fixed that when running label printer WebHooks client side (so when `LABEL_PRINTER_RUN_SERVER` = `false`), the setting `LABEL_PRINTER_HOOK_JSON` was ignored (the WebHook data was always sent as form data)
+- Fixed that granular user permissions (like "Shopping list / Add items" or "Equipment") didn't allow to add/edit the corresponding items without also having the "Edit master data" permission
+- New translations: (thanks all the translators)
+  - Lithuanian (demo available at <https://lt.demo.grocy.info>)
+  - Ukrainian (demo available at <https://uk.demo.grocy.info>)
+
+### API
+
+- Endpoint `/stock/volatile`
+  - The field/property `missing_products` now also contains the `product` object
+- Endpoint `/recipes/{recipeId}/consume`: Fixed (again) that consuming partially fulfilled recipes was possible, although an error was already returned in that case (and potentially some of the in stock ingredients were consumed in fact)

changelog/70_4.0.0_2023-07-29.md

@@ -0,0 +1,118 @@
+> ⚠️ PHP 8.1 (with SQLite 3.34.0+) is from now on the only supported runtime version.
+
+> ❗ The major version bump is due to breaking API changes, please see below if you use the API.
+
+> _Recommendation: Benchmark tests showed that e.g. unit conversion handling is up to 5 times faster when using a more recent (3.39.4+) SQLite version._
+
+### New Feature: Indirect quantity unit conversions with unlimited levels
+
+- Quantity unit conversions now support indirect conversions with unlimited levels (thanks a lot @esclear)
+  - _Explained by a practical example: When a conversion between Teaspoons and Milliliters and another one between Milliliters and Liters exists (and so forth; unlimited levels), Grocy can now calculate Teaspoons to Liters (before a direct conversion definition between Teaspoons and Liters was required)_
+  - **Heads up:** If you have such "each to each absolute conversion definitions" currently (for the example above the conversion between Teaspoons and Liters), you should clean them up, since they are no longer needed
+- The product option "Factor purchase to stock quantity unit" was removed
+  - => Use normal product specific QU conversions instead, if needed
+  - An existing "Factor purchase to stock quantity unit" was automatically migrated to a product specific QU conversion
+
+### New Feature: Stock reports
+
+- New button "Reports" on the stock overview page
+- The first report (more to come) "Spendings" makes it possible to explore (pie chart and table data) the total value spend by product or product group in any time range
+- (Thanks for the initial work on this @raupie)
+
+### Stock
+
+- New product option "Default quantity unit consume"
+  - Will be used/selected as the default quantity unit on the consume page
+  - The product's "Quick consume amount" is now displayed related to this quantity unit ("quick consume/open buttons" on the stock overview page)
+  - Defaults to the product's "Quantity unit stock" (so no changed behavior when not configured)
+- New product option "Quantity unit for prices"
+  - Prices are now shown related to this quantity unit (instead of per "Default quantity unit purchase") on the product card, price history chart, stock overiew and stock entries page
+  - Defaults to the product's "Default quantity unit purchase" (so no changed behavior when not configured)
+- Changed that when the ingredient option "Only check if any amount is in stock" is enabled, costs and calories are now based on the original entered amount instead of an "virtual" fixed amount of `1`
+- When using the "Add as barcode to existing product" workflow on a purchase transaction, the selected quantity unit and the entered amount and note are now also added to the new barcode
+- New product option "Auto reprint stock entry label"
+  - When enabled, auto-changing the due date of a stock entry (by opening/freezing/thawing and having corresponding default due days set) will reprint its label (only server side label printer WebHooks are supported)
+  - Defaults to disabled, so no changed behavior when not configured
+- Added a new option "Reprint stock entry label" on the stock entry edit page (will print the corresponding stock entry label on save)
+  - This option will be automatically set on changing the entry's due date
+- The product option "Quick consume amount" (the amount used for the "quick consume/open buttons" on the stock overview page) has been split into another option "Quick open amount", to be able to set different amounts for consume and open (defaults to the "Quick consume amount" per product, so no changed behavior when not configured)
+- Changed that for the product's average and last price (and for the price history chart) stock transactions with an empty or `0` price are ignored
+- Added a filter option to only show currently out of stock products on the products list (master data) page
+- When clicking a product name on the products list (master data) or on the stock journal page, the product card will now be displayed (like on the stock overview page)
+- When using/scanning a product barcode and the purchase or inventory page, the barcode's note will now also be prefilled (if any)
+- Each row on the stock journal now also has a context-/more menu for quick access to product related actions (the same as on the stock overview page)
+- The amount of "Label per unit" stock entry labels (on purchase and inventory) is now displayed, to help prevent printing a lot of labels where this maybe is not intended
+- Fixed that hiding the "Purchased date" column (table options) on the stock entries page didn't work
+- Fixed that sorting by the "Value" and "Min. stock amount" columns on the stock overview page didn't work
+- Fixed that the consumed amount was wrong, when consuming multiple substituted subproducts at once and when multiple/different conversion factors were involved
+- Fixed that for a product's average price, only currently in stock items were considered, not already consumed ones
+- Fixed that when copying a product, some fields (like "Default consume location" or "Disable own stock) weren't copied along
+- Fixed that the total product count on the stock overview page also included products with "Never show on stock overview" enabled
+
+### Shopping list
+
+- Added a new button "Clear done items" (to clear all done items with one click)
+
+### Recipes
+
+- Added a new entry "Add to meal plan" in the context/more menu per recipe to directly add a recipe to the meal plan from the recipes page
+- Changed that when a ingredient has a "Variable amount" set, the text entered there now also replaces the unit when displaying the recipe (not only the amount as before)
+- When displaying a recipe in fullscreen mode, the ingredients and preparation is now shown side by side (or below each other on small screens) instead of in tabs
+- When consuming a recipe which has a "Produces product" set and when the product's "Default stock entry label" is configured accordingly, the corresponding label will now be printed on that action (only server side label printer WebHooks are supported)
+- Fixed that hiding the "Requirements fulfilled" column (table options) on the recipes page didn't work
+- Fixed that ingredient costs and calories were wrong when product substitution and unit conversions were involved at the same time
+
+### Meal plan
+
+- Added a new sub feature flag `FEATURE_FLAG_RECIPES_MEALPLAN` (in `config.php`) to only disable the meal plan if not needed (thanks @webysther)
+- The `config.php` setting `MEAL_PLAN_FIRST_DAY_OF_WEEK` can now be set to `-1` to dynamically start the meal plan week on _today_
+- Fixed that consuming a recipe from the meal plan didn't add its "Produces product"-product to stock (if any)
+- Fixed that the "Put missing products on shopping list"-button in the header (to put all missing products on the shopping list for a whole week) was missing under certain circumstances (related to locale week numbers and turn of the year)
+
+### Chores
+
+- Changed the handling of the tracking buttons on the chores overview page
+  - The green button now tracks an execution of the corresponding chore on the next scheduled time, rather than for now/today
+  - New context-/more menu option "Track chore execution now" to track an execution for now/today (so the same what the green button did before)
+- Removed the limitation on the chore tracking page that the tracked time couldn't be in the future
+- Fixed that "assidgned to" was not recalculated when undoing chores
+
+### Calendar
+
+- Added a button to jump to today (between the prev/next buttons, top right corner)
+
+### Tasks
+
+- Fixed that hiding the "Category" column (table options) on the tasks page didn't work
+
+### Userfields
+
+- Product group Userfields are now also rendered on the shopping list
+- Fixed that when having e.g. a Userfield for the `stock` entity and using the "Never overdue" shortcut checkbox for the due date on purchase, this Userfield would also be set to the corresponding "never overdue date"
+
+### General
+
+- Like already possible for products/chores/batteries, locations, stores, quantity units, product groups and task categories can now be disabled to keep them for existing references without deleting them, but to hide them everywhere for selections and so on (new option "Active")
+- Added a new `config.php` setting `ENERGY_UNIT` to customize the label to display energy values (was fixed `kcal` before and defaults to that, so no changed behavior when not configured)
+- New logo and "Grocy" is now officially spelled with a capital initial letter (before everything was lowercase)
+- Various frontend performance enhancements
+- Fixed that users were unable to delete their own API keys (when not having the `All permissions` permission)
+- Fixed that button tooltips on some places didn't disappear after clicking the corresponding button
+- New translations: (thanks all the translators)
+  - Estonian (demo available at <https://et.demo.grocy.info>)
+  - Romanian (demo available at <https://ro.demo.grocy.info>)
+
+### API
+
+- ⚠️ **Breaking changes**:
+  - The product property `qu_factor_purchase_to_stock` was removed (existing factors were migrated to normal product specific QU conversions, see above)
+  - Numbers are now returned as numbers (so technically without quotes around them, were strings for nearly all endpoints before)
+- Endpoint `/stock/products/{productId}`:
+  - Added a new field/property `qu_conversion_factor_purchase_to_stock` for convenience (contains the conversion factor of the corresponding QU conversion from the product's `qu_id_purchase` to `qu_id_stock`)
+  - Added a new field/property `qu_conversion_factor_price_to_stock` for convenience (contains the conversion factor of the corresponding QU conversion from the product's `qu_id_price` to `qu_id_stock`)
+  - Added a new field/property `default_quantity_unit_consume` (contains the quantity unit object of the product's "Default quantity unit consume")
+- The following entities are now also available via the endpoint `/objects/{entity}` (only listing, no edit)
+  - `quantity_unit_conversions_resolved` (returns all final/resolved conversion factors per product and any directly or indirectly related quantity units)
+  - `recipes_pos_resolved` (returns stock fulfilment information for all recipe ingredients)
+- The endpoint `/batteries` now also returns the corresponding battery object (as field/property `battery`)
+- API keys can now have a description (to e.g. track where the corresponding key is used)

changelog/71_4.0.1_2023-08-06.md

@@ -0,0 +1,19 @@
+> 💡 PHP 8.2 is from now on (additionally to PHP 8.1) supported.
+
+### Stock
+
+- Fixed performance issues affecting all places where quantity unit conversions / prices are involved
+- Fixed that the upgrade failed when having improperly defined product specific quantity unit conversions
+- Fixed that edited stock entries were not considered in some cases (affecting the product's last price, average price, the price history and the stock reports)
+
+### Shopping list
+
+- Changed that unit prices on the shopping list (table column "Last price (Unit)") are now related to the there selected quantity unit (instead of to the product's QU stock as before)
+
+### Meal plan
+
+- Fixed that the meal plan did initially not display the current week when the settings `MEAL_PLAN_FIRST_DAY_OF_WEEK` and `CALENDAR_FIRST_DAY_OF_WEEK` were set to different values
+
+### API
+
+- Fixed performance issues on the endpoint `/stock/products/{productId}`

changelog/72_4.0.2_2023-08-19.md

@@ -0,0 +1,13 @@
+### Stock
+
+- The stock report "Spendings" now also supports grouping by stores
+- Fixed that the upgrade failed when having (a lot of) redundant ("each to each") default quantity unit conversion definitions (thanks a lot @alkuzman and @esclear)
+  - More on that by a practical example: When a conversion between Teaspoons and Milliliters and another one between Milliliters and Liters exists (and so forth; unlimited levels), Grocy can now (since v4.0.0) calculate the derived factor to convert Teaspoons to Liters on its own (before a direct conversion definition between Teaspoons and Liters was required)
+  - So you might have a lot of such "each to each absolute conversion definitions" currently, when you were affected by failed upgrades (timeout problems due to that resolving indirect conversion factors took very long)
+  - **Heads up:** This is now fixed, but you should clean up those redundant "each to each" definitions (in the example above the conversion between Teaspoons and Liters), since they are no longer needed
+- Fixed that the "Mark this stock entry as open"-button on the stock entries page opened always one unit instead of the whole stock entry
+- Fixed that edited stock entries were not considered in some cases (affecting the product's average price and the stock reports)
+
+### Recipes
+
+- Fixed that ingredient cost/energy values were wrong when unit conversions but _no_ product substitutions were involved

changelog/73_4.0.3_2023-09-02.md

@@ -0,0 +1,12 @@
+### Stock
+
+- Performance improvements related to the stock overview page / displaying a product card
+- Performance improvements related to consuming products (thanks @alkuzman)
+
+### Userfields
+
+- New Userfield type "Number (currency)", just like the type "Number (decimal)", but it will render the value according to / with the configured currency
+
+### General
+
+- Performance improvements related to table (layout) loading handling

changelog/74_4.1.0_2024-02-09.md

@@ -0,0 +1,43 @@
+> 💡 PHP 8.3 is from now on (additionally to PHP 8.2) supported.
+>
+> ⚠️ PHP 8.1 is no longer supported.
+
+### Stock
+
+- Fixed that the location dropdown on the consume page contained the same location multiple times if there are currently stock entries at multiple locations of the corresponding product
+- Fixed that the status filter "_n_ products are overdue" on the stock overview page also counted/included stock entries due today or tomorrow
+- Fixed that the stock report "Spendings" did not take products without an assigned product group into account (thanks @Torqu3Wr3nch for the initial work on this)
+- Fixed that the success message after opening a stock entry on the stock entries page displayed always an amount of `1` instead of the actual amount opened
+- Fixed that the "Consume this stock entry as spoiled" context menu action on the stock entries page consumed always an amount of `1` instead of the whole stock entry
+
+### Recipes
+
+- Fixed that copying recipes with special characters in the name was not possible
+
+### Meal plan
+
+- Fixed that the meal plan page was broken after deleting all meal plan items of a week
+
+### Calendar
+
+- The different event types (due products, chores, tasks and so on) can now have different colors
+  - => New button "Configure colors" on the calendar page to configure these colors (top right corner)
+
+### Tasks
+
+- Added a new table filter for categories (thanks @geoffwright240 for the initial work on this)
+
+### Userfields
+
+- Fixed that when having a userfield of type "Select list (multiple items can be selected)" and selecting no item, editing of the corresponding form was broken
+
+### General
+
+- Night mode is now also used on the login page if that's the system preferred color scheme (generally if night mode is on or not is based on user settings and before logging in no user context is available)
+- Optimized sidebar icon spacing (thanks @chris-thorn)
+- Fixed that file uploads (product pictures and so on) didn't work for files where the file name contains multiple spaces
+- Fixed that some dialogs were not properly (too small) displayed (mostly affecting Firefox >= 121)
+
+### API
+
+- Optimized that the endpoints `GET /objects/{entity}` and `GET /objects/{entity}/{objectId}` now also return Userfields for the entity `stock`

changelog/75_4.2.0_2024-03-15.md

@@ -0,0 +1,26 @@
+### Stock
+
+- When using/scanning a stock entry Grocycode on the transfer page, the "Use specific stock item" dropdown (and "From location") is now also prefilled accordingly
+- Fixed that for the product's last price stock transactions with an empty or `0` price weren't ignored
+- Fixed that when copying a product, the field "Move on open" wasn't copied along
+
+### Shopping list
+
+- The shopping lists dropdown on the shopping list page now also shows the number of items on the corresponding shopping list
+
+### Recipes
+
+- Optimized that when creating a recipe, the desired serving amount is now initially prefilled by the recipe's base serving amount
+
+### Batteries
+
+- It's now possible to track any addtional info on a battery charge cycle by using Userfields (thanks @TheDodger)
+  - => Configure the desired Userfields for the entity `battery_charge_cycles`
+  - => The on a battery charge cycle tracking entered information is then visible on the corresponding battery charge cycle journal entry
+
+### General
+
+- Optimized that file uploads are no longer completely buffered in memory before writing them to disk (thanks @bbx0)
+- Optimized top right corner menus icon spacing (thanks @TheDodger for the initial work on this)
+- Fixed again that some dialogs were not properly (too small) displayed (this time mostly affecting Chrome/Edge)
+- Fixed that table states (visible columns, sorting, column order and so on) could be reset to default after not accessing/using the corresponding page for a certain amount of time

changelog/76_4.3.0_2024-12-23.md

@@ -0,0 +1,28 @@
+### Stock
+
+- Optimized form validation (max amount checks) related to unit conversion with a lot of decimal places on the consume and transfer page
+- Optimized that the stock report "Spendings" now excludes self produced products (thanks @danielr18 for the initial work on this)
+- Fixed that when copying a product, the field "Treat opened as out of stock" wasn't copied along (thanks @TheDodger)
+- Fixed that the product groups filter on the master data products page used a contains search instead of an exact search
+- Fixed that Scan Mode on the purchase and consume page didn't work (not all fields were properly populated) when using/scanning a product Grocycode
+
+### Shopping list
+
+- Fixed that when printing a shoppping list, the table/list wasn't sorted (will now be sorted alphabetically by the product name of the corresponding list item)
+- Fixed that when deleting a shopping list item and marking another one as done while not reloading the page in-between, the deleted item reappeared (was only a visual problem, there was no problem on deleting the item on the backend / in the database)
+
+### Recipes
+
+- When self producing a product ("Produces product" recipe option) the name of the recipe is now added to the note field of the created stock entry
+- Fixed that when `FEATURE_FLAG_STOCK_STOCK` was set to `false`, the "Put missing products on shopping list"-button was not visible
+- Fixed that scanning a product barcode on the recipe ingredient edit page didn't work
+- Fixed that the recipe edit button on the recipes page gallery view didn't work
+
+### Userfields
+
+- Userentity tables (custom objects / lists) now also have the table options icon (top left corner eye icon, to e.g. add a grouping condition)
+- Userfield names can now also contain underscores
+
+### API
+
+- Optimized that uploading files where the file name contains non-ASCII characters is now also possible

changelog/77_4.4.0_2025-01-24.md

@@ -0,0 +1,86 @@
+### New Feature: External Barcode Lookups as a product picker workflow + a built-in Plugin for Open Food Facts
+
+- Added a new product picker workflow "External barcode lookup"
+  - This executes the configured barcode lookup plugin with the given barcode
+  - If the lookup was successful, the product edit page of the created product is displayed where the product setup can be completed (if required)
+  - After that, the transaction is continued with that product as usual
+  - A plugin for [Open Food Facts](https://world.openfoodfacts.org/) is now included and used by default (see the `config.php` option `STOCK_BARCODE_LOOKUP_PLUGIN` and maybe change it as needed)
+    - The product name and image (and of course the barcode itself) are taken over from Open Food Facts to the product being looked up
+  - => Quick video demo (using a Barcode Laser Scanner): https://www.youtube.com/watch?v=-moXPA-VvGc
+  - => Quick video demo (using Browser Camera Barcode Scanning): https://www.youtube.com/watch?v=veezFX4X1JU
+
+### Stock
+
+- Added a new stock setting (top right corner settings menu) "Show all out of stock products" to optionally also show all out of stock products on the stock overview page (defaults to disabled, so no changed behavior when not configured)
+  - By default the stock overview page lists all products which are currently in stock or below their min. stock amount
+  - When this new setting is enabled, all (active) products are always shown
+- Added a new product option "Can't be opened"
+  - When enabled the product open functionality for that product is disabled
+  - Defaults to disabled, so no changed behavior when not configured
+- Added a new product option "Default purchase price type"
+  - Can be used to set the default price type (Unit price / Total price) on the purchase page per product
+  - Previously "Unit price" was the default on purchase and the selection was not saved and not reset when selecting another product, means the price type selection was retained when doing multiple purchase transactions in one go
+  - The default for the new product option is "Unspecified" which keeps the previous behavior
+- When products are automatically added to the shopping list (e.g. by the "below defined min. stock amount"-functionality or when adding missing recipe ingredients) the product's "Default quantity unit purchase" is now used (instead of the product's "Quantity unit stock")
+- Product barcode matching is now case-insensitive
+- Added a new column "Product picture" on the products list (master data) page (hidden by default)
+- Optimized that when navigation between the different "Group by"-variants on the stock report "Spendings", the selected date range now remains persistent
+- Added a new "Presets for new products" stock setting for the "Default stock entry label" option of new products
+- Added a trendline to the price history chart (product card)
+- Added a "Add to shopping list"-button on the product card
+- Optimized that when moving a product to a freezer location (so when freezing it) the due date will no longer be replaced when the product option "Default due days after freezing" is set to `0`
+- The "Decimal places allowed" stock settings now have an upper limit of 10 (since such a high number makes not so much sense in reality and causes form validation problems)
+- Fixed that a once set quantity unit on a product barcode could not be removed on edit
+- Fixed that when consuming a specific stock entry which is opened, and which originated from a before partly opened stock entry, the unopened one was wrongly consumed instead
+
+### Shopping list
+
+- Added a new shopping list setting (top right corner settings menu) "Round up quantity amounts to the nearest whole number"
+  - When enabled, all quantity amounts on the shopping list are always displayed rounded up to the nearest whole number
+  - Defaults to disabled, so no changed behavior when not configured
+
+### Recipes
+
+- Consuming a recipe is now also possible when not all needed ingredients are currently in stock (the in stock amount, if any, of the corresponding ingredient will be consumed in that case)
+- For in stock ingredients, the amount actually in stock is now displayed next to the hint "Enough in stock"
+- Added a new recipe ingredient option "Round up quantity amounts to the nearest whole number"
+  - When enabled, resulting quantity amounts (after scaling according the desired serving amount) are always rounded up to the nearest whole number
+  - Defaults to disabled, so no changed behavior when not configured
+- Optimizations/changes when adding missing recipe ingredients to the shopping list:
+  - When the ingredient option "Only check if any amount is in stock" is enabled and when no corresponding unit conversion exists, the amount/unit is now taken "as is" (as defined in the recipe ingredient) into the created shopping list item
+  - The shopping list item no longer gets a note "Added for recipe" set and the ingredient note is no longer appended
+  - When the corresponding product is already on the shopping list, the amount of the existing item is incremented instead of creating a new shopping list item
+  - When a new shopping list item is created, the product's "Default quantity unit purchase" is now used (instead of the product's "Quantity unit stock")
+- When no price information is available for at least one ingredient, a red exclamation mark is now displayed next to the recipe total cost information
+- When clicking a recipe ingredient / product name, the product card will now be opened like on many other places throughout Grocy
+- Fixed that calories/costs of recipe ingredients were wrong when the ingredient option "Only check if any amount is in stock" was set and the on the ingredient used quantity unit was different from the product's QU stock
+- Fixed that multi-nested recipes (at least 3 levels of "included recipes") resulted in wrong amounts/costs/calories calculated for the ingredients originating in those nested recipes (also affected the meal plan)
+
+### Meal plan
+
+- Fixed that amounts/costs/calories were wrong for recipes which had at least 2 levels of "included recipes"
+
+### Chores
+
+- Added a possibility to see if a scheduled chore was tracked/done on time or not:
+  - When tracking chores, the "Next estimated tracking date" (so the current scheduled time) is now also stored in the corresponding chore journal entry and displayed in a new column "Scheduled tracking time" on the chores journal page
+  - When the "Tracked time" is later than the "Scheduled tracking time", the corresponding chore journal entry is now highlighted in red on the chores journal page
+- Added a new column "Time of tracking" on the chores journal page (displays the time when the tracking actually happened, hidden by default)
+- Added a new option "Swap track next schedule / track now buttons" (chores settings / top right corner settings menu) to swap the "Track next chore schedule" / "Track chore execution now" buttons/menu items on the chores overview page (defaults to disabled, so no changed behavior when not configured)
+
+### Userfields
+
+- Optimized Userfields of type "Checkbox"
+  - When it's a mandatory Userfield, the initial state of the corresponding checkbox is now indeterminate, means it's now also possible to actively not check it (previously mandatory meant the checkbox has to be set)
+- Fixed that Userfield default values were not initialized for the `stock` entity (so affecting the purchase and inventory page)
+- Fixed that uploading bigger or multiple files (so when the upload usually takes a little longer) didn't work (Userfield type "File")
+
+### General
+
+- Optimized nested modal dialogs:
+  - Nested dialogs are now no longer displayed "in each other" and instead "on top of each other"
+  - Dialogs can now be closed with the `ESC` key on the keyboard
+  - There is no longer a close button at the bottom (outside of the displayed `iframe`) and instead one at the top right corner of the dialog
+  - Wide dialogs (e.g. all showing a table, like showing stock entries of a product from the stock overview more/context menu per line) now use the full screen width
+- Improved the handling of the initial field focus on form pages
+- The previously manually necessary update steps (e.g. emptying the `data/viewcache` directory) are now fully automated, so no need to do this manually after this and future updates

changelog/78_4.4.1_2025-01-31.md

@@ -0,0 +1,21 @@
+### Stock
+
+- Fixed that the built-in Open Food Facts external barcode lookup plugin used the staging environment of the Open Food Facts API instead of the production one
+- Fixed that the product group filter on the products page (master data) didn't work when the selected product group contained special characters
+- Fixed that the product filter on the stock journal summary page didn't work when the selected product contained special characters
+
+### Shopping list
+
+- Optimized that non-number amounts are now prevented on database level (was infamously a problem when using specific community contributed alternative clients)
+
+### Tasks
+
+- Fixed that set table filters were not applied after editing or adding a task
+
+### Userfields
+
+- Fixed that saving Userfields of type "Select list (multiple items can be selected)" did not work
+
+### General
+
+- Optimized that when navigating between form input fields via the keyboard (`TAB`) there was an unwanted delay at some places

changelog/79_4.4.2_2025-02-28.md

@@ -0,0 +1,28 @@
+### Stock
+
+- Optimized that the built-in Open Food Facts external barcode lookup plugin now uses the localized product name (if provided by the Open Food Facts API, based on the set Grocy language of the current user)
+- Fixed that the product filter on the stock entires page didn't work when the product column was reordered / not the second one
+
+### Shopping list
+
+- When the shopping list setting (top right corner settings menu) "Round up quantity amounts to the nearest whole number" is enabled, the "Last price (Total)" of each shopping list item and the total value of the shopping list are now also scaled up accordingly
+- The print options (show header, layout type etc.) are now saved (as user settings, so global defaults can also defined in `config.php` as usual)
+
+### Userfields
+
+- Fixed that saving Userfields of type "Link (with title)" did not work
+
+### General
+
+- Fixed that most dialogs didn't work when hosting Grocy "embedded" in an `iframe` (affecting e.g. the [Home Assistant Add-on](https://github.com/hassio-addons/addon-grocy))
+
+### API
+
+- Exposed the `permission_hierarchy` entity (read only, => `GET /objects/permission_hierarchy`) to provide a permission name / id mapping
+
+### Other
+- A quick reminder about official native Grocy app experiences:
+  - Grocy's web frontend is responsive and an "installable web app" ([PWA](https://en.wikipedia.org/wiki/Progressive_web_app), without providing any offline usage capabilities), that provides a pretty native mobile app-like experience without the need for additional tools
+    - => Quick video demo on Android/Firefox: https://www.youtube.com/watch?v=L38drVZfwHs
+    - => Quick video demo on Android/Chrome: https://www.youtube.com/watch?v=rjLdXUFDNuk
+  - [Grocy Desktop](https://github.com/grocy/grocy-desktop) is a way to run Grocy without having to manage a webserver, just like a normal (Windows) desktop application - available as a [classic `.msi` installation package](https://releases.grocy.info/latest-desktop) or as a [Microsoft Store App](https://apps.microsoft.com/detail/9NWB1TRNNKSF)

changelog/80_4.5.0_2025-03-28.md

@@ -0,0 +1,16 @@
+### Stock
+
+- Optimizations in the built-in Open Food Facts external barcode lookup plugin:
+  - A provided but empty localized product name is now ignored
+  - Non-ASCII characters in product names are now ignored (e.g. line breaks caused problems)
+- Optimized that when an external barcode lookup plugin returned an image URL with query parameters, an invalid picture (file name) was added to the created product
+- Added a new column "Default store" on the stock overview page (hidden by default)
+
+### General
+
+- Optimized that the default font of the web frontend is now also used for non-latin characters
+- Label printer WebHooks now include a new property/field `details` (that's the full product/chore/battery/etc. object)
+  - And also `stock_entry` (containing the full stock entry object) when printing a stock entry label
+- The component used (so far [Quagga2](https://github.com/ericblade/quagga2)) that powers the camera barcode scanner was replaced by [ZXing](https://github.com/zxing-js/library) which should perform overall better and it also supports 2D barcodes (QRCode/DataMatrix) (thanks @gergof)
+- New translations: (thanks all the translators)
+  - Bulgarian (demo available at <https://bg.demo.grocy.info>)

changelog/81_4.6.0_2026-03-06.md

@@ -0,0 +1,36 @@
+> ⚠️ PHP 8.5 (with SQLite 3.40+) is from now on the only supported runtime version.
+
+### Stock
+
+- Optimized product definition quantity unit handling:
+  - As long as a product was not once in stock, the product options "Default quantity unit purchase", "Default quantity unit consume" and "Quantity unit for prices" can now be changed to any other unit
+  - When necessary (means when no default quantity unit conversions apply), "1:1" product specific quantity unit conversion between the product's QU stock and the corresponding other unit will now be created automatically after editing a product (like already done when initially creating a product with different unit definitions)
+  - For convenience, when changing a product's QU stock and when all other unit properties ("Default quantity unit purchase" etc.) are the same, they will now be changed in tandem (like already done when creating a new product and initially setting the product's QU stock)
+  - (This should drastically improve the workflow of completing a product setup looked up via an external barcode lookup plugin)
+- Optimized the line plot markers color of the price history chart (product card) (thanks @DeepCoreSystem)
+- External barcode lookup plugin optimizations:
+  - When an image URL without a file extension is returned, the file extension is now determined by the Content-Type header (if any) (thanks @jordy-u for the idea)
+  - Data URLs for images are now supported (`data:image/png;base64,xxxx`) (thanks @GammaC0de)
+- Fixed that German Umlauts and other special characters were removed from product names when looking up a barcode via the built-in Open Food Facts external barcode lookup plugin
+- Fixed that when using/scanning a barcode on the purchase page with a note attached (which prefills the note field) and when manually selecting another product afterwards, the note of the previously used barcode was incorrectly prefilled again
+- Fixed that the "next input focus handling" (jumping to the next input after entering a value) didn't work at some places (e.g. after entering a purchased date on the purchase page)
+- Fixed that changing the stock setting "Due soon days" wasn't saved/applied
+- Fixed that "Reprint stock entry label" on the stock entry edit page didn't actually print the corresponding label
+
+### Shopping list
+
+- An amount of `0` is now allowed for shopping list items (just a convenience optimization, it was already possible to leave the amount field empty which implicitly resulted in an amount of `0`)
+- Fixed that the "Add all list items to stock" workflow closed the dialog after every item instead only after the last one was added
+
+### Chores
+
+- Fixed that changing the chore setting "Due soon days" wasn't saved/applied
+
+### Userfields
+
+- Fixed that the corresponding form was broken when using a `%` in an Userfield caption (only affected numeric and date-time Userfields)
+
+### General
+
+- Added a workaround for different SQL errors when running Grocy on FreeBSD and SQLite 3.41+
+- Fixed that the date input shorthand `[+/-]n[d/m/y]` didn't work when the value length was >= 4 (e.g. `+10d`)

changelog/__TEMPLATE.md

@@ -0,0 +1,57 @@
+> ⚠️ xxxBREAKING CHANGESxxx
+
+> ❗ xxxImportant upgrade informationXXX
+
+> 💡 xxxMinor upgrade informationXXX
+
+### New Feature: xxxx
+
+- xxx
+
+### Stock
+
+- xxx
+
+### Shopping list
+
+- xxx
+
+### Recipes
+
+- xxx
+
+### Meal plan
+
+- xxx
+
+### Chores
+
+- xxx
+
+### Calendar
+
+- xxx
+
+### Tasks
+
+- xxx
+
+### Batteries
+
+- xxx
+
+### Equipment
+
+- xxx
+
+### Userfields
+
+- xxx
+
+### General
+
+- xxx
+
+### API
+
+- xxx

composer.json

@@ -1,17 +1,32 @@
 {
 	"require": {
-		"php": ">=7.2",
-		"slim/slim": "^4.0",
-		"slim/psr7": "^1.0",
-		"slim/http": "^1.0",
-		"php-di/php-di": "^6.0",
-		"rubellum/slim-blade-view": "^0.1.1",
-		"morris/lessql": "^0.4.1",
-		"gettext/gettext": "^4.8",
-		"eluceo/ical": "^0.16.0",
+		"php": "8.5.*",
+		"eluceo/ical": "^2.2.0",
 		"erusev/parsedown": "^1.7",
-		"gumlet/php-image-resize": "^1.9"
+		"ezyang/htmlpurifier": "^4.13",
+		"gettext/gettext": "dev-4.x-fork",
+		"gumlet/php-image-resize": "^2.0",
+		"guzzlehttp/guzzle": "^7.0",
+		"interficieis/php-barcode": "^2.0.2",
+		"mike42/escpos-php": "^4.0",
+		"morris/lessql": "dev-master-fork",
+		"php-di/php-di": "^7.0.3",
+		"slim/http": "^1.0",
+		"slim/psr7": "^1.0",
+		"slim/slim": "^4.0",
+		"webman/blade": "^1.5",
+		"ramsey/uuid": "^4.9"
 	},
+	"repositories": [
+		{
+			"type": "vcs",
+			"url": "https://github.com/berrnd/lessql"
+		},
+		{
+			"type": "vcs",
+			"url": "https://github.com/berrnd/php-gettext"
+		}
+	],
 	"autoload": {
 		"psr-4": {
 			"Grocy\\Services\\": "services/",
@@ -22,5 +37,10 @@
 		"files": [
 			"helpers/extensions.php"
 		]
+	},
+	"config": {
+		"vendor-dir": "packages",
+		"platform-check": false,
+		"optimize-autoloader": true
 	}
 }

config-dist.php

@@ -1,140 +1,134 @@
 <?php
 
-# Settings can also be overwritten in two ways
-#
-# First priority
-# A .txt file with the same name as the setting in /data/settingoverrides
-# the content of the file is used as the setting value
-#
-# Second priority
-# An environment variable with the same name as the setting and prefix "GROCY_"
-# so for example "GROCY_BASE_URL"
-#
-# Third priority
-# The settings defined here below
+// Settings can also be overwritten in two ways:
+//
+// First priority:
+// A .txt file with the same name as the setting in /data/settingoverrides
+// the content of the file is used as the setting value
+//
+// Second priority:
+// An environment variable with the same name as the setting and prefix "GROCY_"
+// so for example "GROCY_BASE_URL"
+//
+// Third priority:
+// The settings defined here below
 
-
-# Either "production", "dev", "demo" or "prerelease"
-# When not "production", authentication will be disabled and
-# demo data will be populated during database migrations
+// Either "production", "dev", "demo" or "prerelease"
+// When not "production", the application will work in a demo mode which means
+// authentication is disabled and some demo data will be generated during the database schema migration
+// (pass the query parameter "nodemodata", e.g. https://grocy.example.com/?nodemodata to skip that)
 Setting('MODE', 'production');
 
-# Either "en" or "de" or the directory name of
-# one of the other available localization folders in the "/localization" directory
-Setting('CULTURE', 'en');
+// The directory name of one of the available localization folders
+// in the "/localization" directory (e.g. "en" or "de")
+Setting('DEFAULT_LOCALE', 'en');
 
-# This is used to define the first day of a week for calendar views in the frontend,
-# leave empty to use the locale default
-# Needs to be a number where Sunday = 0, Monday = 1 and so forth
+// This is used to define the first day of a week for calendar views,
+// leave empty to use the locale default
+// Needs to be a number where Sunday = 0, Monday = 1 and so forth
 Setting('CALENDAR_FIRST_DAY_OF_WEEK', '');
 
-# If calendars should show week numbers
+// If calendars should show week numbers
 Setting('CALENDAR_SHOW_WEEK_OF_YEAR', true);
 
-# To keep it simple: grocy does not handle any currency conversions,
-# this here is used to format all money values,
-# so doesn't really matter, but should be the
-# ISO 4217 code of the currency ("USD", "EUR", "GBP", etc.)
-Setting('CURRENCY', 'USD');
-
-# When running grocy in a subdirectory, this should be set to the relative path, otherwise empty
-# Example:
-#  Webserver root directory = /var/www
-#  grocy directory = /var/www/grocy
-#  => BASE_PATH = /grocy
-Setting('BASE_PATH', '');
-
-# The base url of your installation,
-# should be just "/" when running directly under the root of a (sub)domain
-# or for example "https://example.com/grocy" when using a subdirectory
-Setting('BASE_URL', '/');
-
-# The plugin to use for external barcode lookups,
-# must be the filename without .php extension and must be located in /data/plugins,
-# see /data/plugins/DemoBarcodeLookupPlugin.php for an example implementation
-Setting('STOCK_BARCODE_LOOKUP_PLUGIN', 'DemoBarcodeLookupPlugin');
-
-# If, however, your webserver does not support URL rewriting, set this to true
-Setting('DISABLE_URL_REWRITING', false);
-
-# Specify an custom homepage if desired - by default the homepage will be set to the stock overview,
-# this needs to be one of the following values:
-# stock, shoppinglist, recipes, chores, tasks, batteries, equipment, calendar, mealplan
-Setting('ENTRY_PAGE', 'stock');
-
-# Set this to true if you want to disable authentication / the login screen,
-# places where user context is needed will then use the default (first existing) user
-Setting('DISABLE_AUTH', false);
-
-# Set this to true if you want to disable the ability to scan a barcode via the device camera (Browser API)
-Setting('DISABLE_BROWSER_BARCODE_CAMERA_SCANNING', false);
-
-# Set this if you want to have a different start day for the weekly meal plan view,
-# leave empty to use CALENDAR_FIRST_DAY_OF_WEEK (see above)
-# Needs to be a number where Sunday = 0, Monday = 1 and so forth
+// Set this if you want to have a different start day for the weekly meal plan view,
+// leave empty to use CALENDAR_FIRST_DAY_OF_WEEK (see above)
+// Needs to be a number where Sunday = 0, Monday = 1 and so forth
+// Can also be set to -1 to dynamically start the meal plan week on "today"
 Setting('MEAL_PLAN_FIRST_DAY_OF_WEEK', '');
 
+// To keep it simple: Grocy does not handle any currency conversions,
+// this here is used to format all money values,
+// so doesn't really matter, but needs to be the
+// ISO 4217 code of the currency ("USD", "EUR", "GBP", etc.)
+Setting('CURRENCY', 'USD');
 
-# Default user settings
-# These settings can be changed per user, here the defaults
-# are defined which are used when the user has not changed the setting so far
+// Your preferred unit for energy
+// E.g. "kcal" or "kJ" or something else (doesn't really matter, it's only used to display energy values)
+Setting('ENERGY_UNIT', 'kcal');
 
-# Night mode related
-DefaultUserSetting('night_mode_enabled', false); // If night mode is enabled always
-DefaultUserSetting('auto_night_mode_enabled', false); // If night mode is enabled automatically when inside a given time range (see the two settings below)
-DefaultUserSetting('auto_night_mode_time_range_from', "20:00"); // Format HH:mm
-DefaultUserSetting('auto_night_mode_time_range_to', "07:00"); // Format HH:mm
-DefaultUserSetting('auto_night_mode_time_range_goes_over_midnight', true); // If the time range above goes over midnight
-DefaultUserSetting('currently_inside_night_mode_range', false); // If we're currently inside of night mode time range (this is not user configurable, but stored as a user setting because it's evaluated client side to be able to use the client time instead of the maybe different server time)
+// When running Grocy in a subdirectory, this should be set to the relative path, otherwise empty
+// It needs to be set to the part (of the URL) AFTER the document root,
+// if URL rewriting is disabled, including index.php
+// Example with URL Rewriting support:
+//  Root URL = https://example.com/grocy
+//  => BASE_PATH = /grocy
+// Example without URL Rewriting support:
+//  Root URL = https://example.com/grocy/public/index.php/
+//  => BASE_PATH = /grocy/public/index.php
+Setting('BASE_PATH', '');
 
-# Keep screen on settings
-DefaultUserSetting('keep_screen_on', false); // Keep the screen always on
-DefaultUserSetting('keep_screen_on_when_fullscreen_card', false); // Keep the screen on when a "fullscreen-card" is displayed
+// The base URL of your installation,
+// should be just "/" when running directly under the root of a (sub)domain
+// or for example "https://example.com/grocy" when using a subdirectory
+Setting('BASE_URL', '/');
 
-# Stock settings
-DefaultUserSetting('product_presets_location_id', -1); // Default location id for new products (-1 means no location is preset)
-DefaultUserSetting('product_presets_product_group_id', -1); // Default product group id for new products (-1 means no product group is preset)
-DefaultUserSetting('product_presets_qu_id', -1); // Default quantity unit id for new products (-1 means no quantity unit is preset)
-DefaultUserSetting('stock_expring_soon_days', 5);
-DefaultUserSetting('stock_default_purchase_amount', 0);
-DefaultUserSetting('stock_default_consume_amount', 1);
-DefaultUserSetting('scan_mode_consume_enabled', false);
-DefaultUserSetting('scan_mode_purchase_enabled', false);
-DefaultUserSetting('show_icon_on_stock_overview_page_when_product_is_on_shopping_list', true);
+// The plugin to use for external barcode lookups,
+// must be the filename (folder "/plugins" for built-in plugins or "/data/plugins" for user plugins) without the .php extension,
+// see /plugins/DemoBarcodeLookupPlugin.php for a commented example implementation
+// Leave empty to disable external barcode lookups
+Setting('STOCK_BARCODE_LOOKUP_PLUGIN', 'OpenFoodFactsBarcodeLookupPlugin');
 
-# Shopping list settings
-DefaultUserSetting('shopping_list_to_stock_workflow_auto_submit_when_prefilled', false); // Automatically do the booking using the last price and the amount of the shopping list item, if the product has "Default best before days" set
-DefaultUserSetting('shopping_list_show_calendar', false);
-DefaultUserSetting('shopping_list_disable_auto_compact_view_on_mobile', false);
+// If, however, your webserver does not support URL rewriting, set this to true
+Setting('DISABLE_URL_REWRITING', false);
 
-# Recipe settings
-DefaultUserSetting('recipe_ingredients_group_by_product_group', false); // Group recipe ingredients by their product group
+// Specify an custom homepage if desired, by default the homepage will be set to the stock overview page
+// This needs to be one of the following values:
+// stock, shoppinglist, recipes, chores, tasks, batteries, equipment, calendar, mealplan
+Setting('ENTRY_PAGE', 'stock');
 
-# Chores settings
-DefaultUserSetting('chores_due_soon_days', 5);
+// Set this to true if you want to disable authentication / the login screen,
+// places where user context is needed will then use the default (first existing) user
+Setting('DISABLE_AUTH', false);
 
-# Batteries settings
-DefaultUserSetting('batteries_due_soon_days', 5);
+// Either "Grocy\Middleware\DefaultAuthMiddleware", "Grocy\Middleware\ReverseProxyAuthMiddleware"
+// or any class that implements Grocy\Middleware\AuthMiddleware
+Setting('AUTH_CLASS', 'Grocy\Middleware\DefaultAuthMiddleware');
 
-# Tasks settings
-DefaultUserSetting('tasks_due_soon_days', 5);
+// Options when using ReverseProxyAuthMiddleware
+Setting('REVERSE_PROXY_AUTH_HEADER', 'REMOTE_USER'); // The name of the HTTP header which your reverse proxy uses to pass the username (on successful authentication)
+Setting('REVERSE_PROXY_AUTH_USE_ENV', false); // Set to true if the username is passed as environment variable
 
-# If the page should be automatically reloaded when there was
-# an external change
-DefaultUserSetting('auto_reload_on_db_change', true);
+// Options when using LdapAuthMiddleware
+Setting('LDAP_ADDRESS', ''); // Example value "ldap://vm-dc2019.local.berrnd.net"
+Setting('LDAP_BASE_DN', ''); // Example value "DC=local,DC=berrnd,DC=net"
+Setting('LDAP_BIND_DN', ''); // Example value "CN=grocy_bind_account,OU=service_accounts,DC=local,DC=berrnd,DC=net"
+Setting('LDAP_BIND_PW', ''); // Password for the above account
+Setting('LDAP_USER_FILTER', ''); // Example value "(OU=grocy_users)"
+Setting('LDAP_UID_ATTR', ''); // Windows AD: "sAMAccountName", OpenLDAP: "uid", GLAuth: "cn"
 
-# Show a clock in the header next to the logo or not
-DefaultUserSetting('show_clock_in_header', false);
+// Default permissions for new users
+// the array needs to contain the technical/constant names
+// See the file controllers/Users/User.php for possible values
+Setting('DEFAULT_PERMISSIONS', ['ADMIN']);
 
-# Component configuration
-DefaultUserSetting('quagga2_numofworkers', 4);
+// "1D" (=> Code128) or "2D" (=> DataMatrix)
+Setting('GROCYCODE_TYPE', '2D');
 
 
-# Feature flags
-# grocy was initially about "stock management for your household", many other things
-# came and still come by, because they are useful - here you can disable the parts
-# which you don't need to have a less cluttered UI
-# (set the setting to "false" to disable the corresponding part, which should be self explanatory)
+// Label printer settings
+Setting('LABEL_PRINTER_WEBHOOK', ''); // The URI that Grocy will POST to when asked to print a label
+Setting('LABEL_PRINTER_RUN_SERVER', true); // Whether the webhook will be called server- or client-side
+Setting('LABEL_PRINTER_PARAMS', ['font_family' => 'Source Sans Pro (Regular)']); // Additional parameters supplied to the webhook
+Setting('LABEL_PRINTER_HOOK_JSON', true); // TRUE to use JSON or FALSE to use normal POST request variables
+
+
+// Thermal printer options
+// Thermal printers are receipt printers, not regular printers,
+// the printer must support the ESC/POS protocol, see https://github.com/mike42/escpos-php
+Setting('TPRINTER_IS_NETWORK_PRINTER', false); // Set to true if it's a network printer
+Setting('TPRINTER_PRINT_QUANTITY_NAME', true); // Set to false if you do not want to print the quantity names (related to the shopping list)
+Setting('TPRINTER_PRINT_NOTES', true); // Set to false if you do not want to print notes (related to the shopping list)
+Setting('TPRINTER_IP', '127.0.0.1'); // IP of the network printer (does only matter if it's a network printer)
+Setting('TPRINTER_PORT', 9100); // Port of the network printer (does only matter if it's a network printer)
+Setting('TPRINTER_CONNECTOR', '/dev/usb/lp0'); // Printer device (does only matter if you use a locally attached printer)
+// For USB on Linux this is often '/dev/usb/lp0', for serial printers it could be similar to '/dev/ttyS0'
+// Make sure that the user that runs the webserver has permissions to write to the printer - on Linux add your webserver user to the LP group with usermod -a -G lp www-data
+
+
+// Feature flags
+// Here you can disable the parts which you don't need to have a less cluttered UI
+// (set the setting to "false" to disable the corresponding part, which should be self explanatory)
 Setting('FEATURE_FLAG_STOCK', true);
 Setting('FEATURE_FLAG_SHOPPINGLIST', true);
 Setting('FEATURE_FLAG_RECIPES', true);
@@ -143,19 +137,93 @@ Setting('FEATURE_FLAG_TASKS', true);
 Setting('FEATURE_FLAG_BATTERIES', true);
 Setting('FEATURE_FLAG_EQUIPMENT', true);
 Setting('FEATURE_FLAG_CALENDAR', true);
+Setting('FEATURE_FLAG_LABEL_PRINTER', false);
 
-
-# Sub feature flags
+// Sub feature flags
 Setting('FEATURE_FLAG_STOCK_PRICE_TRACKING', true);
 Setting('FEATURE_FLAG_STOCK_LOCATION_TRACKING', true);
 Setting('FEATURE_FLAG_STOCK_BEST_BEFORE_DATE_TRACKING', true);
 Setting('FEATURE_FLAG_STOCK_PRODUCT_OPENED_TRACKING', true);
 Setting('FEATURE_FLAG_STOCK_PRODUCT_FREEZING', true);
-Setting('FEATURE_FLAG_STOCK_BEST_BEFORE_DATE_FIELD_NUMBER_PAD', true); // Activate the number pad in best-before-date fields on (supported) mobile browsers
+Setting('FEATURE_FLAG_STOCK_BEST_BEFORE_DATE_FIELD_NUMBER_PAD', true); // Activate the number pad in due date fields on (supported) mobile browsers
 Setting('FEATURE_FLAG_SHOPPINGLIST_MULTIPLE_LISTS', true);
+Setting('FEATURE_FLAG_RECIPES_MEALPLAN', true);
 Setting('FEATURE_FLAG_CHORES_ASSIGNMENTS', true);
+Setting('FEATURE_FLAG_THERMAL_PRINTER', false);
+
+// Feature settings
+Setting('FEATURE_FLAG_DISABLE_BROWSER_BARCODE_CAMERA_SCANNING', false); // Set this to true if you want to disable the ability to scan a barcode via the device camera (Browser API)
+Setting('FEATURE_FLAG_AUTO_TORCH_ON_WITH_CAMERA', true); // Enables the torch automatically (if the device has one)
 
 
-# Feature settings
-Setting('FEATURE_SETTING_STOCK_COUNT_OPENED_PRODUCTS_AGAINST_MINIMUM_STOCK_AMOUNT', true); // When set to false, opened products will not be considered for minimum stock amounts
-Setting('FEATURE_FLAG_AUTO_TORCH_ON_WITH_CAMERA', true); // Enables the torch automaticaly in every camera barcode scanner.
+// Default user settings
+// These settings can be changed per user and via the UI,
+// below are the defaults which are used when the user has not changed the setting so far
+
+// Night mode related
+DefaultUserSetting('night_mode', 'follow-system'); // "on" = Night mode is always on ; "off" = Night mode is always off / "follow-system" = System preferred color schema is used
+DefaultUserSetting('auto_night_mode_enabled', false); // If night mode is enabled automatically when inside a given time range (see the two settings below)
+DefaultUserSetting('auto_night_mode_time_range_from', '20:00'); // Format HH:mm
+DefaultUserSetting('auto_night_mode_time_range_to', '07:00'); // Format HH:mm
+DefaultUserSetting('auto_night_mode_time_range_goes_over_midnight', true); // If the time range above goes over midnight
+DefaultUserSetting('night_mode_enabled_internal', false); // Internal setting if night mode is actually enabled (based on the other settings)
+
+// Generic settings
+DefaultUserSetting('auto_reload_on_db_change', false); // If the page should be automatically reloaded when there was an external change
+DefaultUserSetting('show_clock_in_header', false); // Show a clock in the header next to the logo or not
+DefaultUserSetting('keep_screen_on', false); // If the screen should always be kept on
+DefaultUserSetting('keep_screen_on_when_fullscreen_card', false); // If the screen should be kept on when a "fullscreen-card" is displayed
+
+// Stock settings
+DefaultUserSetting('product_presets_location_id', -1); // Default location id for new products (-1 means no location is preset)
+DefaultUserSetting('product_presets_product_group_id', -1); // Default product group id for new products (-1 means no product group is preset)
+DefaultUserSetting('product_presets_qu_id', -1); // Default quantity unit id for new products (-1 means no quantity unit is preset)
+DefaultUserSetting('product_presets_default_due_days', 0); // Default due days for new products (-1 means that the product will be never overdue)
+DefaultUserSetting('product_presets_treat_opened_as_out_of_stock', true); // Default "Treat opened as out of stock" option for new products
+DefaultUserSetting('product_presets_default_stock_label_type', 0); // "Default stock entry label" option for new products (0 = No label, 1 = Single Label, 2 = Label per unit)
+DefaultUserSetting('stock_decimal_places_amounts', 4); // Default decimal places allowed for amounts
+DefaultUserSetting('stock_decimal_places_prices_input', 2); // Default decimal places allowed for prices (input)
+DefaultUserSetting('stock_decimal_places_prices_display', 2); // Default decimal places allowed for prices (display)
+DefaultUserSetting('stock_auto_decimal_separator_prices', false);  // If the decimal separator should be set automatically for amount inputs
+DefaultUserSetting('stock_due_soon_days', 5); // The "expiring soon" days
+DefaultUserSetting('stock_default_purchase_amount', 0); // The default amount prefilled on the purchase page
+DefaultUserSetting('stock_default_consume_amount', 1); // The default amount prefilled on the consume page
+DefaultUserSetting('stock_default_consume_amount_use_quick_consume_amount', false); // If the products quick consume amount should be prefilled on the consume page
+DefaultUserSetting('scan_mode_consume_enabled', false); // If scan mode on the consume page is enabled
+DefaultUserSetting('scan_mode_purchase_enabled', false); // If scan mode on the purchase page is enabled
+DefaultUserSetting('show_icon_on_stock_overview_page_when_product_is_on_shopping_list', true); // When enabled, an icon is shown on the stock overview page (next to the product name) when the prodcut is currently on a shopping list
+DefaultUserSetting('stock_overview_show_all_out_of_stock_products', false); // By default the stock overview page lists all products which are currently in stock or below their min. stock amount - when this is enabled, all (active) products are always shown
+DefaultUserSetting('show_purchased_date_on_purchase', false); // Whether the purchased date should be editable on purchase (defaults to today otherwise)
+DefaultUserSetting('show_warning_on_purchase_when_due_date_is_earlier_than_next', true); // Show a warning on purchase when the due date of the purchased product is earlier than the next due date in stock
+
+// Shopping list settings
+DefaultUserSetting('shopping_list_to_stock_workflow_auto_submit_when_prefilled', false); // Automatically do the booking using the last price and the amount of the shopping list item, if the product has "Default due days" set
+DefaultUserSetting('shopping_list_show_calendar', false); // When enabled, a small (month view) calendar will be shown on the shopping list page
+DefaultUserSetting('shopping_list_round_up', false); // When enabled, all quantity amounts on the shopping list are always displayed rounded up to the nearest whole number
+DefaultUserSetting('shopping_list_auto_add_below_min_stock_amount', false); // If products should be automatically added to the shopping list when they are below their min. stock amount
+DefaultUserSetting('shopping_list_auto_add_below_min_stock_amount_list_id', 1); // When the above setting is enabled, the id of the shopping list to which the products will be added
+DefaultUserSetting('shopping_list_print_show_header', true); // Default for the shopping list print option "Show header"
+DefaultUserSetting('shopping_list_print_group_by_product_group', true); // Default for the shopping list print option "Group by product group"
+DefaultUserSetting('shopping_list_print_layout_type', 'table'); // Default for the shopping list print option "Layout type" (table or list)
+
+// Recipe settings
+DefaultUserSetting('recipe_ingredients_group_by_product_group', false); // Group recipe ingredients by their product group
+DefaultUserSetting('recipes_show_list_side_by_side', true); // If the recipe should be displayed next to recipe list on the recipes page
+DefaultUserSetting('recipes_show_ingredient_checkbox', false); // When enabled, a little checkbox will be shown next to each ingredient to mark it as done
+
+// Chores settings
+DefaultUserSetting('chores_due_soon_days', 5); // The "due soon" days
+DefaultUserSetting('chores_overview_swap_tracking_buttons', false); // When enabled, the "Track next chore schedule" and "Track chore execution now" buttons/menu items are swapped
+
+// Batteries settings
+DefaultUserSetting('batteries_due_soon_days', 5); // The "due soon" days
+
+// Tasks settings
+DefaultUserSetting('tasks_due_soon_days', 5); // The "due soon" days
+
+// Calendar settings
+DefaultUserSetting('calendar_color_products', '#007bff'); // The event color (hex code) for due products
+DefaultUserSetting('calendar_color_tasks', '#28a745'); // The event color (hex code) for due tasks
+DefaultUserSetting('calendar_color_chores', '#ffc107'); // The event color (hex code) for due chores
+DefaultUserSetting('calendar_color_batteries', '#17a2b8'); // The event color (hex code) for due battery charge cycles
+DefaultUserSetting('calendar_color_meal_plan', '#6c757d'); // The event color (hex code) for meal plan items

controllers/BaseApiController.php

@@ -2,40 +2,195 @@
 
 namespace Grocy\Controllers;
 
+use LessQL\Result;
+use Psr\Http\Message\ResponseInterface as Response;
+use Slim\Exception\HttpException;
+
 class BaseApiController extends BaseController
 {
-
-	public function __construct(\DI\Container $container)
-	{
-		parent::__construct($container);
-	}
+	const PATTERN_FIELD = '[A-Za-z_][A-Za-z0-9_]+';
+	const PATTERN_OPERATOR = '!?((>=)|(<=)|=|~|<|>|(§))';
+	const PATTERN_VALUE = '[A-Za-z\p{L}\p{M}0-9*_.$#^| -\\\]+';
 
 	protected $OpenApiSpec = null;
 
-	protected function getOpenApispec()
+	protected function ApiResponse(Response $response, $data, $cache = false)
 	{
-		if($this->OpenApiSpec == null)
+		if ($cache)
 		{
-			$this->OpenApiSpec = json_decode(file_get_contents(__DIR__ . '/../grocy.openapi.json'));
+			$response = $response->withHeader('Cache-Control', 'max-age=2592000');
 		}
-		return $this->OpenApiSpec;
-	}
 
-	protected function ApiResponse(\Psr\Http\Message\ResponseInterface $response, $data)
-	{
 		$response->getBody()->write(json_encode($data));
 		return $response;
 	}
 
-	protected function EmptyApiResponse(\Psr\Http\Message\ResponseInterface $response, $status = 204)
+	protected function EmptyApiResponse(Response $response, $status = 204)
 	{
 		return $response->withStatus($status);
 	}
 
-	protected function GenericErrorResponse(\Psr\Http\Message\ResponseInterface $response, $errorMessage, $status = 400)
+	protected function GenericErrorResponse(Response $response, $errorMessage, $status = 400)
 	{
-		return $response->withStatus($status)->withJson(array(
+		return $response->withStatus($status)->withJson([
 			'error_message' => $errorMessage
-		));
+		]);
+	}
+
+	public function FilteredApiResponse(Response $response, Result $data, array $query)
+	{
+		$data = $this->queryData($data, $query);
+		return $this->ApiResponse($response, $data);
+	}
+
+	protected function queryData(Result $data, array $query)
+	{
+		if (isset($query['query']))
+		{
+			$data = $this->filter($data, $query['query']);
+		}
+
+		if (isset($query['limit']) || isset($query['offset']))
+		{
+			if (!isset($query['limit']))
+			{
+				$query['limit'] = -1;
+			}
+
+			$data = $data->limit(intval($query['limit']), intval($query['offset'] ?? 0));
+		}
+
+		if (isset($query['order']))
+		{
+			$parts = explode(':', $query['order']);
+
+			if (count($parts) == 1)
+			{
+				$data = $data->orderBy($parts[0]);
+			}
+			else
+			{
+				if ($parts[1] != 'asc' && $parts[1] != 'desc')
+				{
+					throw new \Exception('Invalid sort order ' . $parts[1]);
+				}
+
+				$data = $data->orderBy($parts[0], $parts[1]);
+			}
+		}
+
+		return $data;
+	}
+
+	protected function filter(Result $data, array $query): Result
+	{
+		foreach ($query as $q)
+		{
+			$matches = [];
+			preg_match(
+				'/(?P<field>' . self::PATTERN_FIELD . ')'
+				. '(?P<op>' . self::PATTERN_OPERATOR . ')'
+				. '(?P<value>' . self::PATTERN_VALUE . ')/u',
+				$q,
+				$matches
+			);
+
+			if (!array_key_exists('field', $matches) || !array_key_exists('op', $matches) || !array_key_exists('value', $matches))
+			{
+				throw new \Exception('Invalid query');
+			}
+
+			$sqlOrNull = '';
+			if (strtolower($matches['value']) == 'null')
+			{
+				$sqlOrNull = ' OR ' . $matches['field'] . ' IS NULL';
+			}
+
+			switch ($matches['op'])
+			{
+				case '=':
+					$data = $data->where($matches['field'] . ' = ?' . $sqlOrNull, $matches['value']);
+					break;
+				case '!=':
+					$data = $data->where($matches['field'] . ' != ?' . $sqlOrNull, $matches['value']);
+					break;
+				case '~':
+					$data = $data->where($matches['field'] . ' LIKE ?', '%' . $matches['value'] . '%');
+					break;
+				case '!~':
+					$data = $data->where($matches['field'] . ' NOT LIKE ?', '%' . $matches['value'] . '%');
+					break;
+				case '<':
+					$data = $data->where($matches['field'] . ' < ?', $matches['value']);
+					break;
+				case '>':
+					$data = $data->where($matches['field'] . ' > ?', $matches['value']);
+					break;
+				case '>=':
+					$data = $data->where($matches['field'] . ' >= ?', $matches['value']);
+					break;
+				case '<=':
+					$data = $data->where($matches['field'] . ' <= ?', $matches['value']);
+					break;
+				case '§':
+					$data = $data->where($matches['field'] . ' REGEXP ?', $matches['value']);
+					break;
+			}
+		}
+
+		return $data;
+	}
+
+	protected function getOpenApispec()
+	{
+		if ($this->OpenApiSpec == null)
+		{
+			$this->OpenApiSpec = json_decode(file_get_contents(__DIR__ . '/../grocy.openapi.json'));
+		}
+
+		return $this->OpenApiSpec;
+	}
+
+	private static $htmlPurifierInstance = null;
+	protected function GetParsedAndFilteredRequestBody($request)
+	{
+		if ($request->getHeaderLine('Content-Type') != 'application/json')
+		{
+			throw new HttpException($request, 'Bad Content-Type', 400);
+		}
+
+		if (self::$htmlPurifierInstance == null)
+		{
+			$htmlPurifierConfig = \HTMLPurifier_Config::createDefault();
+			$htmlPurifierConfig->set('Cache.SerializerPath', GROCY_DATAPATH . '/viewcache');
+			$htmlPurifierConfig->set('HTML.Allowed', 'div,b,strong,i,em,u,a[href|title|target],iframe[src|width|height|frameborder],ul,ol,li,p[style],br,span[style],img[style|width|height|alt|src],table[border|width|style],tbody,tr,td,th,blockquote,*[style|class|id],h1,h2,h3,h4,h5,h6');
+			$htmlPurifierConfig->set('Attr.EnableID', true);
+			$htmlPurifierConfig->set('HTML.SafeIframe', true);
+			$htmlPurifierConfig->set('CSS.AllowedProperties', 'font,font-size,font-weight,font-style,font-family,text-decoration,padding-left,color,background-color,text-align,width,height');
+			$htmlPurifierConfig->set('URI.AllowedSchemes', ['data' => true, 'http' => true, 'https' => true]);
+			$htmlPurifierConfig->set('URI.SafeIframeRegexp', '%^.*%'); // Allow any iframe source
+			$htmlPurifierConfig->set('CSS.MaxImgLength', null);
+
+			self::$htmlPurifierInstance = new \HTMLPurifier($htmlPurifierConfig);
+		}
+
+		$requestBody = $request->getParsedBody();
+		foreach ($requestBody as $key => &$value)
+		{
+			// HTMLPurifier removes boolean values (true/false) and arrays, so explicitly keep them
+			// Maybe also possible through HTMLPurifier config (http://htmlpurifier.org/live/configdoc/plain.html)
+			if (!is_bool($value) && !is_array($value))
+			{
+				$value = self::$htmlPurifierInstance->purify($value);
+
+				// Allow some special chars
+				// Maybe also possible through HTMLPurifier config (http://htmlpurifier.org/live/configdoc/plain.html)
+				$value = str_replace('&amp;', '&', $value);
+				$value = str_replace('&gt;', '>', $value);
+				$value = str_replace('&lt;', '<', $value);
+			}
+		}
+
+		return $requestBody;
 	}
 }

controllers/BaseController.php

@@ -2,49 +2,148 @@
 
 namespace Grocy\Controllers;
 
-use \Grocy\Services\DatabaseService;
-use \Grocy\Services\ApplicationService;
-use \Grocy\Services\LocalizationService;
-use \Grocy\Services\StockService;
-use \Grocy\Services\UsersService;
-use \Grocy\Services\UserfieldsService;
-use \Grocy\Services\BatteriesService;
-use \Grocy\Services\CalendarService;
-use \Grocy\Services\SessionService;
-use \Grocy\Services\RecipesService;
-use \Grocy\Services\TasksService;
-use \Grocy\Services\FilesService;
-use \Grocy\Services\ChoresService;
-use \Grocy\Services\ApiKeyService;
+use Grocy\Controllers\Users\User;
+use Grocy\Services\ApiKeyService;
+use Grocy\Services\ApplicationService;
+use Grocy\Services\BatteriesService;
+use Grocy\Services\CalendarService;
+use Grocy\Services\ChoresService;
+use Grocy\Services\DatabaseService;
+use Grocy\Services\FilesService;
+use Grocy\Services\LocalizationService;
+use Grocy\Services\PrintService;
+use Grocy\Services\RecipesService;
+use Grocy\Services\SessionService;
+use Grocy\Services\StockService;
+use Grocy\Services\TasksService;
+use Grocy\Services\UserfieldsService;
+use Grocy\Services\UsersService;
+use DI\Container;
 
 class BaseController
 {
-	public function __construct(\DI\Container $container) {
-
+	public function __construct(Container $container)
+	{
 		$this->AppContainer = $container;
 		$this->View = $container->get('view');
 	}
 
-	protected function render($response, $page, $data = [])
+	protected $AppContainer;
+	protected $View;
+
+	protected function getApiKeyService()
+	{
+		return ApiKeyService::getInstance();
+	}
+
+	protected function getApplicationservice()
+	{
+		return ApplicationService::getInstance();
+	}
+
+	protected function getBatteriesService()
+	{
+		return BatteriesService::getInstance();
+	}
+
+	protected function getCalendarService()
+	{
+		return CalendarService::getInstance();
+	}
+
+	protected function getChoresService()
+	{
+		return ChoresService::getInstance();
+	}
+
+	protected function getDatabase()
+	{
+		return $this->getDatabaseService()->GetDbConnection();
+	}
+
+	protected function getDatabaseService()
+	{
+		return DatabaseService::getInstance();
+	}
+
+	protected function getFilesService()
+	{
+		return FilesService::getInstance();
+	}
+
+	protected function getLocalizationService()
+	{
+		if (!defined('GROCY_LOCALE'))
+		{
+			define('GROCY_LOCALE', GROCY_DEFAULT_LOCALE);
+		}
+
+		return LocalizationService::getInstance(GROCY_LOCALE);
+	}
+
+	protected function getRecipesService()
+	{
+		return RecipesService::getInstance();
+	}
+
+	protected function getSessionService()
+	{
+		return SessionService::getInstance();
+	}
+
+	protected function getStockService()
+	{
+		return StockService::getInstance();
+	}
+
+	protected function getPrintService()
+	{
+		return PrintService::getInstance();
+	}
+
+	protected function getTasksService()
+	{
+		return TasksService::getInstance();
+	}
+
+	protected function getUserfieldsService()
+	{
+		return UserfieldsService::getInstance();
+	}
+
+	protected function getUsersService()
+	{
+		return UsersService::getInstance();
+	}
+
+	protected function render($response, $viewName, $data = [])
 	{
 		$container = $this->AppContainer;
 
 		$versionInfo = $this->getApplicationService()->GetInstalledVersion();
 		$this->View->set('version', $versionInfo->Version);
-		$this->View->set('releaseDate', $versionInfo->ReleaseDate);
 
-        $localizationService = $this->getLocalizationService();
-		$this->View->set('__t', function(string $text, ...$placeholderValues) use($localizationService)
+		$localizationService = $this->getLocalizationService();
+		$this->View->set('__t', function (string $text, ...$placeholderValues) use ($localizationService)
 		{
 			return $localizationService->__t($text, $placeholderValues);
 		});
-		$this->View->set('__n', function($number, $singularForm, $pluralForm) use($localizationService)
+		$this->View->set('__n', function ($number, $singularForm, $pluralForm, $isQu = false) use ($localizationService)
 		{
-			return $localizationService->__n($number, $singularForm, $pluralForm);
+			return $localizationService->__n($number, $singularForm, $pluralForm, $isQu);
 		});
-		$this->View->set('GettextPo', $localizationService->GetPoAsJsonString());
+		$this->View->set('LocalizationStrings', $localizationService->GetPoAsJsonString());
+		$this->View->set('LocalizationStringsQu', $localizationService->GetPoAsJsonStringQu());
 
-		$this->View->set('U', function($relativePath, $isResource = false) use($container)
+		// TODO: Better handle this generically based on the current language (header in .po file?)
+		$dir = 'ltr';
+		if (GROCY_LOCALE == 'he_IL')
+		{
+			$dir = 'rtl';
+		}
+		$this->View->set('dir', $dir);
+
+		$this->View->set('U', function ($relativePath, $isResource = false) use ($container)
 		{
 			return $container->get('UrlManager')->ConstructUrl($relativePath, $isResource);
 		});
@@ -66,10 +165,28 @@ class BaseController
 		}
 		$this->View->set('featureFlags', $constants);
 
-		return $this->View->render($response, $page, $data);
+		if (GROCY_AUTHENTICATED)
+		{
+			$this->View->set('permissions', User::PermissionList());
+
+			$decimalPlacesAmounts = $this->getUsersService()->GetUserSetting(GROCY_USER_ID, 'stock_decimal_places_amounts');
+			if ($decimalPlacesAmounts <= 0)
+			{
+				$defaultMinAmount = 1;
+			}
+			else
+			{
+				$defaultMinAmount = '0.' . str_repeat('0', $decimalPlacesAmounts - 1) . '1';
+			}
+			$this->View->set('DEFAULT_MIN_AMOUNT', $defaultMinAmount);
+		}
+
+		$this->View->set('viewName', $viewName);
+
+		return $this->View->render($response, $viewName, $data);
 	}
 
-	protected function renderPage($response, $page, $data = [])
+	protected function renderPage($response, $viewName, $data = [])
 	{
 		$this->View->set('userentitiesForSidebar', $this->getDatabase()->userentities()->where('show_in_sidebar_menu = 1')->orderBy('name'));
 		try
@@ -89,83 +206,6 @@ class BaseController
 			// Happens when database is not initialised or migrated...
 		}
 
-		return $this->render($response, $page, $data);
+		return $this->render($response, $viewName, $data);
 	}
-
-    protected function getDatabaseService()
-	{
-		return DatabaseService::getInstance();
-	}
-
-    protected function getDatabase()
-	{
-		return $this->getDatabaseService()->GetDbConnection();
-	}
-
-	protected function getLocalizationService()
-	{
-		return LocalizationService::getInstance(GROCY_CULTURE);
-	}
-
-	protected function getApplicationservice()
-	{
-		return ApplicationService::getInstance();
-	}
-
-	protected function getBatteriesService()
-	{
-		return BatteriesService::getInstance();
-	}
-
-	protected function getCalendarService()
-	{
-		return CalendarService::getInstance();
-	}
-
-    protected function getSessionService()
-	{
-		return SessionService::getInstance();
-	}
-
-	protected function getRecipesService()
-	{
-		return RecipesService::getInstance();
-	}
-
-	protected function getStockService()
-	{
-		return StockService::getInstance();
-	}
-
-    protected function getTasksService()
-	{
-		return TasksService::getInstance();
-	}
-
-    protected function getUsersService()
-	{
-		return UsersService::getInstance();
-	}
-
-	protected function getUserfieldsService()
-	{
-		return UserfieldsService::getInstance();
-	}
-
-	protected function getApiKeyService()
-	{
-		return ApiKeyService::getInstance();
-	}
-
-	protected function getChoresService()
-	{
-		return ChoresService::getInstance();
-	}
-
-	protected function getFilesService()
-	{
-		return FilesService::getInstance();
-	}
-	
-	protected $AppContainer;
 }

controllers/BatteriesApiController.php

@@ -2,16 +2,36 @@
 
 namespace Grocy\Controllers;
 
+use Grocy\Controllers\Users\User;
+use Grocy\Helpers\WebhookRunner;
+use Grocy\Helpers\Grocycode;
+use Psr\Http\Message\ResponseInterface as Response;
+use Psr\Http\Message\ServerRequestInterface as Request;
+
 class BatteriesApiController extends BaseApiController
 {
-	public function __construct(\DI\Container $container)
+	public function BatteryDetails(Request $request, Response $response, array $args)
 	{
-		parent::__construct($container);
+		try
+		{
+			return $this->ApiResponse($response, $this->getBatteriesService()->GetBatteryDetails($args['batteryId']));
+		}
+		catch (\Exception $ex)
+		{
+			return $this->GenericErrorResponse($response, $ex->getMessage());
+		}
 	}
 
-	public function TrackChargeCycle(\Psr\Http\Message\ServerRequestInterface $request, \Psr\Http\Message\ResponseInterface $response, array $args)
+	public function Current(Request $request, Response $response, array $args)
 	{
-		$requestBody = $request->getParsedBody();
+		return $this->FilteredApiResponse($response, $this->getBatteriesService()->GetCurrent(), $request->getQueryParams());
+	}
+
+	public function TrackChargeCycle(Request $request, Response $response, array $args)
+	{
+		User::checkPermission($request, User::PERMISSION_BATTERIES_TRACK_CHARGE_CYCLE);
+
+		$requestBody = $this->GetParsedAndFilteredRequestBody($request);
 
 		try
 		{
@@ -30,25 +50,10 @@ class BatteriesApiController extends BaseApiController
 		}
 	}
 
-	public function BatteryDetails(\Psr\Http\Message\ServerRequestInterface $request, \Psr\Http\Message\ResponseInterface $response, array $args)
+	public function UndoChargeCycle(Request $request, Response $response, array $args)
 	{
-		try
-		{
-			return $this->ApiResponse($response, $this->getBatteriesService()->GetBatteryDetails($args['batteryId']));
-		}
-		catch (\Exception $ex)
-		{
-			return $this->GenericErrorResponse($response, $ex->getMessage());
-		}
-	}
+		User::checkPermission($request, User::PERMISSION_BATTERIES_UNDO_CHARGE_CYCLE);
 
-	public function Current(\Psr\Http\Message\ServerRequestInterface $request, \Psr\Http\Message\ResponseInterface $response, array $args)
-	{
-		return $this->ApiResponse($response, $this->getBatteriesService()->GetCurrent());
-	}
-
-	public function UndoChargeCycle(\Psr\Http\Message\ServerRequestInterface $request, \Psr\Http\Message\ResponseInterface $response, array $args)
-	{
 		try
 		{
 			$this->ApiResponse($response, $this->getBatteriesService()->UndoChargeCycle($args['chargeCycleId']));
@@ -59,4 +64,29 @@ class BatteriesApiController extends BaseApiController
 			return $this->GenericErrorResponse($response, $ex->getMessage());
 		}
 	}
+
+	public function BatteryPrintLabel(Request $request, Response $response, array $args)
+	{
+		try
+		{
+			$batteryDetails = (object)$this->getBatteriesService()->GetBatteryDetails($args['batteryId']);
+
+			$webhookData = array_merge([
+				'battery' => $batteryDetails->battery->name,
+				'grocycode' => (string)(new Grocycode(Grocycode::BATTERY, $args['batteryId'])),
+				'details' => $batteryDetails,
+			], GROCY_LABEL_PRINTER_PARAMS);
+
+			if (GROCY_LABEL_PRINTER_RUN_SERVER)
+			{
+				(new WebhookRunner())->run(GROCY_LABEL_PRINTER_WEBHOOK, $webhookData, GROCY_LABEL_PRINTER_HOOK_JSON);
+			}
+
+			return $this->ApiResponse($response, $webhookData);
+		}
+		catch (\Exception $ex)
+		{
+			return $this->GenericErrorResponse($response, $ex->getMessage());
+		}
+	}
 }

controllers/BatteriesController.php

@@ -2,44 +2,38 @@
 
 namespace Grocy\Controllers;
 
+use Grocy\Helpers\Grocycode;
+use Psr\Http\Message\ResponseInterface as Response;
+use Psr\Http\Message\ServerRequestInterface as Request;
+
 class BatteriesController extends BaseController
 {
-	public function __construct(\DI\Container $container)
-	{
-		parent::__construct($container);
-	}
+	use GrocycodeTrait;
 
-	public function Overview(\Psr\Http\Message\ServerRequestInterface $request, \Psr\Http\Message\ResponseInterface $response, array $args)
+	public function BatteriesList(Request $request, Response $response, array $args)
 	{
-		$usersService = $this->getUsersService();
-		$nextXDays = $usersService->GetUserSettings(GROCY_USER_ID)['batteries_due_soon_days'];
+		if (isset($request->getQueryParams()['include_disabled']))
+		{
+			$batteries = $this->getDatabase()->batteries()->orderBy('name', 'COLLATE NOCASE');
+		}
+		else
+		{
+			$batteries = $this->getDatabase()->batteries()->where('active = 1')->orderBy('name', 'COLLATE NOCASE');
+		}
 
-		return $this->renderPage($response, 'batteriesoverview', [
-			'batteries' => $this->getDatabase()->batteries()->orderBy('name'),
-			'current' => $this->getBatteriesService()->GetCurrent(),
-			'nextXDays' => $nextXDays,
-			'userfields' => $this->getUserfieldsService()->GetFields('batteries'),
-			'userfieldValues' => $this->getUserfieldsService()->GetAllValues('batteries')
-		]);
-	}
-
-	public function TrackChargeCycle(\Psr\Http\Message\ServerRequestInterface $request, \Psr\Http\Message\ResponseInterface $response, array $args)
-	{
-		return $this->renderPage($response, 'batterytracking', [
-			'batteries' =>  $this->getDatabase()->batteries()->orderBy('name')
-		]);
-	}
-
-	public function BatteriesList(\Psr\Http\Message\ServerRequestInterface $request, \Psr\Http\Message\ResponseInterface $response, array $args)
-	{
 		return $this->renderPage($response, 'batteries', [
-			'batteries' => $this->getDatabase()->batteries()->orderBy('name'),
+			'batteries' => $batteries,
 			'userfields' => $this->getUserfieldsService()->GetFields('batteries'),
 			'userfieldValues' => $this->getUserfieldsService()->GetAllValues('batteries')
 		]);
 	}
 
-	public function BatteryEditForm(\Psr\Http\Message\ServerRequestInterface $request, \Psr\Http\Message\ResponseInterface $response, array $args)
+	public function BatteriesSettings(Request $request, Response $response, array $args)
+	{
+		return $this->renderPage($response, 'batteriessettings');
+	}
+
+	public function BatteryEditForm(Request $request, Response $response, array $args)
 	{
 		if ($args['batteryId'] == 'new')
 		{
@@ -51,23 +45,86 @@ class BatteriesController extends BaseController
 		else
 		{
 			return $this->renderPage($response, 'batteryform', [
-				'battery' =>  $this->getDatabase()->batteries($args['batteryId']),
+				'battery' => $this->getDatabase()->batteries($args['batteryId']),
 				'mode' => 'edit',
 				'userfields' => $this->getUserfieldsService()->GetFields('batteries')
 			]);
 		}
 	}
 
-	public function Journal(\Psr\Http\Message\ServerRequestInterface $request, \Psr\Http\Message\ResponseInterface $response, array $args)
+	public function Journal(Request $request, Response $response, array $args)
 	{
+		if (isset($request->getQueryParams()['months']) && filter_var($request->getQueryParams()['months'], FILTER_VALIDATE_INT) !== false)
+		{
+			$months = $request->getQueryParams()['months'];
+			$where = "tracked_time > DATE(DATE('now', 'localtime'), '-$months months')";
+		}
+		else
+		{
+			// Default 2 years
+			$where = "tracked_time > DATE(DATE('now', 'localtime'), '-24 months')";
+		}
+
+		if (isset($request->getQueryParams()['battery']) && filter_var($request->getQueryParams()['battery'], FILTER_VALIDATE_INT) !== false)
+		{
+			$batteryId = $request->getQueryParams()['battery'];
+			$where .= " AND battery_id = $batteryId";
+		}
+
 		return $this->renderPage($response, 'batteriesjournal', [
-			'chargeCycles' => $this->getDatabase()->battery_charge_cycles()->orderBy('tracked_time', 'DESC'),
-			'batteries' => $this->getDatabase()->batteries()->orderBy('name')
+			'chargeCycles' => $this->getDatabase()->battery_charge_cycles()->where($where)->orderBy('tracked_time', 'DESC'),
+			'batteries' => $this->getDatabase()->batteries()->where('active = 1')->orderBy('name', 'COLLATE NOCASE'),
+			'userfields' => $this->getUserfieldsService()->GetFields('battery_charge_cycles'),
+			'userfieldValues' => $this->getUserfieldsService()->GetAllValues('battery_charge_cycles')
 		]);
 	}
 
-	public function BatteriesSettings(\Psr\Http\Message\ServerRequestInterface $request, \Psr\Http\Message\ResponseInterface $response, array $args)
+	public function Overview(Request $request, Response $response, array $args)
 	{
-		return $this->renderPage($response, 'batteriessettings');
+		$usersService = $this->getUsersService();
+		$nextXDays = $usersService->GetUserSettings(GROCY_USER_ID)['batteries_due_soon_days'];
+
+		$batteries = $this->getDatabase()->batteries()->where('active = 1');
+		$currentBatteries = $this->getBatteriesService()->GetCurrent();
+		foreach ($currentBatteries as $currentBattery)
+		{
+			if (FindObjectInArrayByPropertyValue($batteries, 'id', $currentBattery->battery_id)->charge_interval_days > 0)
+			{
+				if ($currentBattery->next_estimated_charge_time < date('Y-m-d H:i:s'))
+				{
+					$currentBattery->due_type = 'overdue';
+				}
+				elseif ($currentBattery->next_estimated_charge_time <= date('Y-m-d 23:59:59'))
+				{
+					$currentBattery->due_type = 'duetoday';
+				}
+				elseif ($nextXDays > 0 && $currentBattery->next_estimated_charge_time <= date('Y-m-d H:i:s', strtotime('+' . $nextXDays . ' days')))
+				{
+					$currentBattery->due_type = 'duesoon';
+				}
+			}
+		}
+
+		return $this->renderPage($response, 'batteriesoverview', [
+			'batteries' => $batteries,
+			'current' => $currentBatteries,
+			'nextXDays' => $nextXDays,
+			'userfields' => $this->getUserfieldsService()->GetFields('batteries'),
+			'userfieldValues' => $this->getUserfieldsService()->GetAllValues('batteries')
+		]);
+	}
+
+	public function TrackChargeCycle(Request $request, Response $response, array $args)
+	{
+		return $this->renderPage($response, 'batterytracking', [
+			'batteries' => $this->getDatabase()->batteries()->where('active = 1')->orderBy('name', 'COLLATE NOCASE'),
+			'userfields' => $this->getUserfieldsService()->GetFields('battery_charge_cycles')
+		]);
+	}
+
+	public function BatteryGrocycodeImage(Request $request, Response $response, array $args)
+	{
+		$gc = new Grocycode(Grocycode::BATTERY, $args['batteryId']);
+		return $this->ServeGrocycodeImage($request, $response, $gc);
 	}
 }

controllers/CalendarApiController.php

@@ -2,44 +2,87 @@
 
 namespace Grocy\Controllers;
 
+use Grocy\Services\ApiKeyService;
+use Eluceo\iCal\Domain\Entity\Calendar;
+use Eluceo\iCal\Domain\Entity\Event;
+use Eluceo\iCal\Domain\Entity\TimeZone;
+use Eluceo\iCal\Domain\ValueObject\Date;
+use Eluceo\iCal\Domain\ValueObject\DateTime;
+use Eluceo\iCal\Domain\ValueObject\SingleDay;
+use Eluceo\iCal\Domain\ValueObject\TimeSpan;
+use Eluceo\iCal\Presentation\Factory\CalendarFactory;
+use Psr\Http\Message\ResponseInterface as Response;
+use Psr\Http\Message\ServerRequestInterface as Request;
+
 class CalendarApiController extends BaseApiController
 {
-	public function __construct(\DI\Container $container)
-	{
-		parent::__construct($container);
-	}
-
-	public function Ical(\Psr\Http\Message\ServerRequestInterface $request, \Psr\Http\Message\ResponseInterface $response, array $args)
+	public function Ical(Request $request, Response $response, array $args)
 	{
 		try
 		{
-			$vCalendar = new \Eluceo\iCal\Component\Calendar('grocy');
-
 			$events = $this->getCalendarService()->GetEvents();
-			foreach($events as $event)
-			{
-				$date = new \DateTime($event['start']);
-				$date->setTimezone(date_default_timezone_get());
+			$minDate = null;
+			$maxDate = null;
 
-				if ($event['date_format'] === 'date')
+			$vCalendar = new Calendar();
+			$vCalendar->setProductIdentifier('Grocy');
+
+			foreach ($events as $event)
+			{
+				if (!isset($event['start']) || empty($event['start']))
 				{
-					$date->setTime(23, 59, 59);
+					continue;
 				}
 
-				$vEvent = new \Eluceo\iCal\Component\Event();
-				$vEvent->setDtStart($date)
-					->setDtEnd($date)
-					->setSummary($event['title'])
-					->setDescription($event['description'])
-					->setNoTime($event['date_format'] === 'date')
-					->setUseTimezone(true);
+				$description = '';
+				if (isset($event['description']))
+				{
+					$description = $event['description'];
+				}
 
-				$vCalendar->addComponent($vEvent);
+				if ($event['date_format'] === 'date' || (isset($event['allDay']) && $event['allDay']))
+				{
+					// All-day event
+					$date = new Date(\DateTimeImmutable::createFromFormat('Y-m-d', substr($event['start'], 0, 10)));
+					$vEventOccurrence = new SingleDay($date);
+
+					$compareDate = \DateTimeImmutable::createFromFormat('Y-m-d', substr($event['start'], 0, 10));
+				}
+				else
+				{
+					// Time-point event
+					$start = new DateTime(\DateTimeImmutable::createFromFormat('Y-m-d H:i:s', $event['start']), true);
+					$end = new DateTime(\DateTimeImmutable::createFromFormat('Y-m-d H:i:s', $event['start']), true);
+					$vEventOccurrence = new TimeSpan($start, $end);
+
+					$compareDate = \DateTimeImmutable::createFromFormat('Y-m-d H:i:s', $event['start']);
+				}
+
+				$vEvent = new Event();
+				$vEvent->setOccurrence($vEventOccurrence)
+					->setSummary($event['title'])
+					->setDescription($description);
+
+				$vCalendar->addEvent($vEvent);
+
+				if ($minDate == null || $compareDate < $minDate)
+				{
+					$minDate = $compareDate;
+				}
+				if ($maxDate == null || $compareDate > $maxDate)
+				{
+					$maxDate = $compareDate;
+				}
 			}
 
-			$response->write($vCalendar->render());
+			if ($minDate != null && $maxDate != null)
+			{
+				$vCalendar->addTimeZone(TimeZone::createFromPhpDateTimeZone(new \DateTimeZone(date_default_timezone_get()), $minDate, $maxDate));
+			}
+
+			$response->write((new CalendarFactory())->createCalendar($vCalendar));
 			$response = $response->withHeader('Content-Type', 'text/calendar; charset=utf-8');
-			return $response->withHeader('Content-Disposition', 'attachment; filename="grocy.ics"');
+			return $response->withHeader('Content-Disposition', 'attachment; filename="Grocy.ics"');
 		}
 		catch (\Exception $ex)
 		{
@@ -47,13 +90,13 @@ class CalendarApiController extends BaseApiController
 		}
 	}
 
-	public function IcalSharingLink(\Psr\Http\Message\ServerRequestInterface $request, \Psr\Http\Message\ResponseInterface $response, array $args)
+	public function IcalSharingLink(Request $request, Response $response, array $args)
 	{
 		try
 		{
-			return $this->ApiResponse($response, array(
-				'url' => $this->AppContainer->get('UrlManager')->ConstructUrl('/api/calendar/ical?secret=' . $this->getApiKeyService()->GetOrCreateApiKey(\Grocy\Services\ApiKeyService::API_KEY_TYPE_SPECIAL_PURPOSE_CALENDAR_ICAL))
-			));
+			return $this->ApiResponse($response, [
+				'url' => $this->AppContainer->get('UrlManager')->ConstructUrl('/api/calendar/ical?secret=' . $this->getApiKeyService()->GetOrCreateApiKey(ApiKeyService::API_KEY_TYPE_SPECIAL_PURPOSE_CALENDAR_ICAL))
+			]);
 		}
 		catch (\Exception $ex)
 		{

controllers/CalendarController.php

@@ -2,14 +2,12 @@
 
 namespace Grocy\Controllers;
 
+use Psr\Http\Message\ResponseInterface as Response;
+use Psr\Http\Message\ServerRequestInterface as Request;
+
 class CalendarController extends BaseController
 {
-	public function __construct(\DI\Container $container)
-	{
-		parent::__construct($container);
-	}
-
-	public function Overview(\Psr\Http\Message\ServerRequestInterface $request, \Psr\Http\Message\ResponseInterface $response, array $args)
+	public function Overview(Request $request, Response $response, array $args)
 	{
 		return $this->renderPage($response, 'calendar', [
 			'fullcalendarEventSources' => $this->getCalendarService()->GetEvents()

controllers/ChoresApiController.php

@@ -2,77 +2,22 @@
 
 namespace Grocy\Controllers;
 
+use Grocy\Controllers\Users\User;
+use Grocy\Helpers\WebhookRunner;
+use Grocy\Helpers\Grocycode;
+use Psr\Http\Message\ResponseInterface as Response;
+use Psr\Http\Message\ServerRequestInterface as Request;
+
 class ChoresApiController extends BaseApiController
 {
-	public function __construct(\DI\Container $container)
-	{
-		parent::__construct($container);
-	}
-
-	public function TrackChoreExecution(\Psr\Http\Message\ServerRequestInterface $request, \Psr\Http\Message\ResponseInterface $response, array $args)
-	{
-		$requestBody = $request->getParsedBody();
-
-		try
-		{
-			$trackedTime = date('Y-m-d H:i:s');
-			if (array_key_exists('tracked_time', $requestBody) && (IsIsoDateTime($requestBody['tracked_time']) || IsIsoDate($requestBody['tracked_time'])))
-			{
-				$trackedTime = $requestBody['tracked_time'];
-			}
-
-			$doneBy = GROCY_USER_ID;
-			if (array_key_exists('done_by', $requestBody) && !empty($requestBody['done_by']))
-			{
-				$doneBy = $requestBody['done_by'];
-			}
-
-			$choreExecutionId = $this->getChoresService()->TrackChore($args['choreId'], $trackedTime, $doneBy);
-			return $this->ApiResponse($response, $this->getDatabase()->chores_log($choreExecutionId));
-		}
-		catch (\Exception $ex)
-		{
-			return $this->GenericErrorResponse($response, $ex->getMessage());
-		}
-	}
-
-	public function ChoreDetails(\Psr\Http\Message\ServerRequestInterface $request, \Psr\Http\Message\ResponseInterface $response, array $args)
+	public function CalculateNextExecutionAssignments(Request $request, Response $response, array $args)
 	{
 		try
 		{
-			return $this->ApiResponse($response, $this->getChoresService()->GetChoreDetails($args['choreId']));
-		}
-		catch (\Exception $ex)
-		{
-			return $this->GenericErrorResponse($response, $ex->getMessage());
-		}
-	}
-
-	public function Current(\Psr\Http\Message\ServerRequestInterface $request, \Psr\Http\Message\ResponseInterface $response, array $args)
-	{
-		return $this->ApiResponse($response, $this->getChoresService()->GetCurrent());
-	}
-
-	public function UndoChoreExecution(\Psr\Http\Message\ServerRequestInterface $request, \Psr\Http\Message\ResponseInterface $response, array $args)
-	{
-		try
-		{
-			$this->ApiResponse($response, $this->getChoresService()->UndoChoreExecution($args['executionId']));
-			return $this->EmptyApiResponse($response);
-		}
-		catch (\Exception $ex)
-		{
-			return $this->GenericErrorResponse($response, $ex->getMessage());
-		}
-	}
-
-	public function CalculateNextExecutionAssignments(\Psr\Http\Message\ServerRequestInterface $request, \Psr\Http\Message\ResponseInterface $response, array $args)
-	{
-		try
-		{
-			$requestBody = $request->getParsedBody();
+			$requestBody = $this->GetParsedAndFilteredRequestBody($request);
 
 			$choreId = null;
+
 			if (array_key_exists('chore_id', $requestBody) && !empty($requestBody['chore_id']) && is_numeric($requestBody['chore_id']))
 			{
 				$choreId = intval($requestBody['chore_id']);
@@ -98,4 +43,121 @@ class ChoresApiController extends BaseApiController
 			return $this->GenericErrorResponse($response, $ex->getMessage());
 		}
 	}
+
+	public function ChoreDetails(Request $request, Response $response, array $args)
+	{
+		try
+		{
+			return $this->ApiResponse($response, $this->getChoresService()->GetChoreDetails($args['choreId']));
+		}
+		catch (\Exception $ex)
+		{
+			return $this->GenericErrorResponse($response, $ex->getMessage());
+		}
+	}
+
+	public function Current(Request $request, Response $response, array $args)
+	{
+		return $this->FilteredApiResponse($response, $this->getChoresService()->GetCurrent(), $request->getQueryParams());
+	}
+
+	public function TrackChoreExecution(Request $request, Response $response, array $args)
+	{
+		$requestBody = $this->GetParsedAndFilteredRequestBody($request);
+
+		try
+		{
+			User::checkPermission($request, User::PERMISSION_CHORE_TRACK_EXECUTION);
+
+			$trackedTime = date('Y-m-d H:i:s');
+			if (array_key_exists('tracked_time', $requestBody) && (IsIsoDateTime($requestBody['tracked_time']) || IsIsoDate($requestBody['tracked_time'])))
+			{
+				$trackedTime = $requestBody['tracked_time'];
+			}
+
+			$skipped = false;
+			if (array_key_exists('skipped', $requestBody) && filter_var($requestBody['skipped'], FILTER_VALIDATE_BOOLEAN) !== false)
+			{
+				$skipped = $requestBody['skipped'];
+			}
+
+			$doneBy = GROCY_USER_ID;
+			if (array_key_exists('done_by', $requestBody) && !empty($requestBody['done_by']))
+			{
+				$doneBy = $requestBody['done_by'];
+			}
+
+			if ($doneBy != GROCY_USER_ID)
+			{
+				User::checkPermission($request, User::PERMISSION_CHORE_TRACK_EXECUTION);
+			}
+
+			$choreExecutionId = $this->getChoresService()->TrackChore($args['choreId'], $trackedTime, $doneBy, $skipped);
+			return $this->ApiResponse($response, $this->getDatabase()->chores_log($choreExecutionId));
+		}
+		catch (\Exception $ex)
+		{
+			return $this->GenericErrorResponse($response, $ex->getMessage());
+		}
+	}
+
+	public function UndoChoreExecution(Request $request, Response $response, array $args)
+	{
+		try
+		{
+			User::checkPermission($request, User::PERMISSION_CHORE_UNDO_EXECUTION);
+
+			$this->ApiResponse($response, $this->getChoresService()->UndoChoreExecution($args['executionId']));
+			return $this->EmptyApiResponse($response);
+		}
+		catch (\Exception $ex)
+		{
+			return $this->GenericErrorResponse($response, $ex->getMessage());
+		}
+	}
+
+	public function ChorePrintLabel(Request $request, Response $response, array $args)
+	{
+		try
+		{
+			$choreDetails = (object)$this->getChoresService()->GetChoreDetails($args['choreId']);
+
+			$webhookData = array_merge([
+				'chore' => $choreDetails->chore->name,
+				'grocycode' => (string)(new Grocycode(Grocycode::CHORE, $args['choreId'])),
+				'details' => $choreDetails,
+			], GROCY_LABEL_PRINTER_PARAMS);
+
+			if (GROCY_LABEL_PRINTER_RUN_SERVER)
+			{
+				(new WebhookRunner())->run(GROCY_LABEL_PRINTER_WEBHOOK, $webhookData, GROCY_LABEL_PRINTER_HOOK_JSON);
+			}
+
+			return $this->ApiResponse($response, $webhookData);
+		}
+		catch (\Exception $ex)
+		{
+			return $this->GenericErrorResponse($response, $ex->getMessage());
+		}
+	}
+
+	public function MergeChores(Request $request, Response $response, array $args)
+	{
+		User::checkPermission($request, User::PERMISSION_MASTER_DATA_EDIT);
+
+		try
+		{
+			if (filter_var($args['choreIdToKeep'], FILTER_VALIDATE_INT) === false || filter_var($args['choreIdToRemove'], FILTER_VALIDATE_INT) === false)
+			{
+				throw new \Exception('Provided {choreIdToKeep} or {choreIdToRemove} is not a valid integer');
+			}
+
+			$this->ApiResponse($response, $this->getChoresService()->MergeChores($args['choreIdToKeep'], $args['choreIdToRemove']));
+			return $this->EmptyApiResponse($response);
+		}
+		catch (\Exception $ex)
+		{
+			return $this->GenericErrorResponse($response, $ex->getMessage());
+		}
+	}
 }

controllers/ChoresController.php

@@ -2,55 +2,15 @@
 
 namespace Grocy\Controllers;
 
+use Grocy\Helpers\Grocycode;
+use Psr\Http\Message\ResponseInterface as Response;
+use Psr\Http\Message\ServerRequestInterface as Request;
+
 class ChoresController extends BaseController
 {
-	public function __construct(\DI\Container $container)
-	{
-		parent::__construct($container);
-	}
+	use GrocycodeTrait;
 
-	public function Overview(\Psr\Http\Message\ServerRequestInterface $request, \Psr\Http\Message\ResponseInterface $response, array $args)
-	{
-		$usersService = $this->getUsersService();
-		$nextXDays = $usersService->GetUserSettings(GROCY_USER_ID)['chores_due_soon_days'];
-
-		return $this->renderPage($response, 'choresoverview', [
-			'chores' => $this->getDatabase()->chores()->orderBy('name'),
-			'currentChores' => $this->getChoresService()->GetCurrent(),
-			'nextXDays' => $nextXDays,
-			'userfields' => $this->getUserfieldsService()->GetFields('chores'),
-			'userfieldValues' => $this->getUserfieldsService()->GetAllValues('chores'),
-			'users' => $usersService->GetUsersAsDto()
-		]);
-	}
-
-	public function TrackChoreExecution(\Psr\Http\Message\ServerRequestInterface $request, \Psr\Http\Message\ResponseInterface $response, array $args)
-	{
-		return $this->renderPage($response, 'choretracking', [
-			'chores' => $this->getDatabase()->chores()->orderBy('name'),
-			'users' => $this->getDatabase()->users()->orderBy('username')
-		]);
-	}
-
-	public function ChoresList(\Psr\Http\Message\ServerRequestInterface $request, \Psr\Http\Message\ResponseInterface $response, array $args)
-	{
-		return $this->renderPage($response, 'chores', [
-			'chores' => $this->getDatabase()->chores()->orderBy('name'),
-			'userfields' => $this->getUserfieldsService()->GetFields('chores'),
-			'userfieldValues' => $this->getUserfieldsService()->GetAllValues('chores')
-		]);
-	}
-
-	public function Journal(\Psr\Http\Message\ServerRequestInterface $request, \Psr\Http\Message\ResponseInterface $response, array $args)
-	{
-		return $this->renderPage($response, 'choresjournal', [
-			'choresLog' => $this->getDatabase()->chores_log()->orderBy('tracked_time', 'DESC'),
-			'chores' => $this->getDatabase()->chores()->orderBy('name'),
-			'users' => $this->getDatabase()->users()->orderBy('username')
-		]);
-	}
-
-	public function ChoreEditForm(\Psr\Http\Message\ServerRequestInterface $request, \Psr\Http\Message\ResponseInterface $response, array $args)
+	public function ChoreEditForm(Request $request, Response $response, array $args)
 	{
 		$usersService = $this->getUsersService();
 		$users = $usersService->GetUsersAsDto();
@@ -63,25 +23,122 @@ class ChoresController extends BaseController
 				'userfields' => $this->getUserfieldsService()->GetFields('chores'),
 				'assignmentTypes' => GetClassConstants('\Grocy\Services\ChoresService', 'CHORE_ASSIGNMENT_TYPE_'),
 				'users' => $users,
-				'products' => $this->getDatabase()->products()->orderBy('name')
+				'products' => $this->getDatabase()->products()->orderBy('name', 'COLLATE NOCASE')
 			]);
 		}
 		else
 		{
 			return $this->renderPage($response, 'choreform', [
-				'chore' =>  $this->getDatabase()->chores($args['choreId']),
+				'chore' => $this->getDatabase()->chores($args['choreId']),
 				'periodTypes' => GetClassConstants('\Grocy\Services\ChoresService', 'CHORE_PERIOD_TYPE_'),
 				'mode' => 'edit',
 				'userfields' => $this->getUserfieldsService()->GetFields('chores'),
 				'assignmentTypes' => GetClassConstants('\Grocy\Services\ChoresService', 'CHORE_ASSIGNMENT_TYPE_'),
 				'users' => $users,
-				'products' => $this->getDatabase()->products()->orderBy('name')
+				'products' => $this->getDatabase()->products()->orderBy('name', 'COLLATE NOCASE')
 			]);
 		}
 	}
 
-	public function ChoresSettings(\Psr\Http\Message\ServerRequestInterface $request, \Psr\Http\Message\ResponseInterface $response, array $args)
+	public function ChoresList(Request $request, Response $response, array $args)
+	{
+		if (isset($request->getQueryParams()['include_disabled']))
+		{
+			$chores = $this->getDatabase()->chores()->orderBy('name', 'COLLATE NOCASE');
+		}
+		else
+		{
+			$chores = $this->getDatabase()->chores()->where('active = 1')->orderBy('name', 'COLLATE NOCASE');
+		}
+
+		return $this->renderPage($response, 'chores', [
+			'chores' => $chores,
+			'userfields' => $this->getUserfieldsService()->GetFields('chores'),
+			'userfieldValues' => $this->getUserfieldsService()->GetAllValues('chores')
+		]);
+	}
+
+	public function ChoresSettings(Request $request, Response $response, array $args)
 	{
 		return $this->renderPage($response, 'choressettings');
 	}
+
+	public function Journal(Request $request, Response $response, array $args)
+	{
+		if (isset($request->getQueryParams()['months']) && filter_var($request->getQueryParams()['months'], FILTER_VALIDATE_INT) !== false)
+		{
+			$months = $request->getQueryParams()['months'];
+			$where = "tracked_time > DATE(DATE('now', 'localtime'), '-$months months')";
+		}
+		else
+		{
+			// Default 1 year
+			$where = "tracked_time > DATE(DATE('now', 'localtime'), '-12 months')";
+		}
+
+		if (isset($request->getQueryParams()['chore']) && filter_var($request->getQueryParams()['chore'], FILTER_VALIDATE_INT) !== false)
+		{
+			$choreId = $request->getQueryParams()['chore'];
+			$where .= " AND chore_id = $choreId";
+		}
+
+		return $this->renderPage($response, 'choresjournal', [
+			'choresLog' => $this->getDatabase()->chores_log()->where($where)->orderBy('tracked_time', 'DESC'),
+			'chores' => $this->getDatabase()->chores()->where('active = 1')->orderBy('name', 'COLLATE NOCASE'),
+			'users' => $this->getDatabase()->users()->orderBy('username'),
+			'userfields' => $this->getUserfieldsService()->GetFields('chores_log'),
+			'userfieldValues' => $this->getUserfieldsService()->GetAllValues('chores_log')
+		]);
+	}
+
+	public function Overview(Request $request, Response $response, array $args)
+	{
+		$usersService = $this->getUsersService();
+		$nextXDays = $usersService->GetUserSettings(GROCY_USER_ID)['chores_due_soon_days'];
+
+		$chores = $this->getDatabase()->chores()->orderBy('name', 'COLLATE NOCASE');
+		$currentChores = $this->getChoresService()->GetCurrent();
+		foreach ($currentChores as $currentChore)
+		{
+			if (!empty($currentChore->next_estimated_execution_time))
+			{
+				if ($currentChore->next_estimated_execution_time < date('Y-m-d H:i:s'))
+				{
+					$currentChore->due_type = 'overdue';
+				}
+				elseif ($currentChore->next_estimated_execution_time <= date('Y-m-d 23:59:59'))
+				{
+					$currentChore->due_type = 'duetoday';
+				}
+				elseif ($nextXDays > 0 && $currentChore->next_estimated_execution_time <= date('Y-m-d H:i:s', strtotime('+' . $nextXDays . ' days')))
+				{
+					$currentChore->due_type = 'duesoon';
+				}
+			}
+		}
+
+		return $this->renderPage($response, 'choresoverview', [
+			'chores' => $chores,
+			'currentChores' => $currentChores,
+			'nextXDays' => $nextXDays,
+			'userfields' => $this->getUserfieldsService()->GetFields('chores'),
+			'userfieldValues' => $this->getUserfieldsService()->GetAllValues('chores'),
+			'users' => $usersService->GetUsersAsDto()
+		]);
+	}
+
+	public function TrackChoreExecution(Request $request, Response $response, array $args)
+	{
+		return $this->renderPage($response, 'choretracking', [
+			'chores' => $this->getDatabase()->chores()->where('active = 1')->orderBy('name', 'COLLATE NOCASE'),
+			'users' => $this->getDatabase()->users()->orderBy('username'),
+			'userfields' => $this->getUserfieldsService()->GetFields('chores_log'),
+		]);
+	}
+
+	public function ChoreGrocycodeImage(Request $request, Response $response, array $args)
+	{
+		$gc = new Grocycode(Grocycode::CHORE, $args['choreId']);
+		return $this->ServeGrocycodeImage($request, $response, $gc);
+	}
 }

controllers/EquipmentController.php

@@ -2,25 +2,14 @@
 
 namespace Grocy\Controllers;
 
+use Psr\Http\Message\ResponseInterface as Response;
+use Psr\Http\Message\ServerRequestInterface as Request;
+
 class EquipmentController extends BaseController
 {
-	public function __construct(\DI\Container $container)
-	{
-		parent::__construct($container);
-	}
-
 	protected $UserfieldsService;
 
-	public function Overview(\Psr\Http\Message\ServerRequestInterface $request, \Psr\Http\Message\ResponseInterface $response, array $args)
-	{
-		return $this->renderPage($response, 'equipment', [
-			'equipment' => $this->getDatabase()->equipment()->orderBy('name'),
-			'userfields' => $this->getUserfieldsService()->GetFields('equipment'),
-			'userfieldValues' => $this->getUserfieldsService()->GetAllValues('equipment')
-		]);
-	}
-
-	public function EditForm(\Psr\Http\Message\ServerRequestInterface $request, \Psr\Http\Message\ResponseInterface $response, array $args)
+	public function EditForm(Request $request, Response $response, array $args)
 	{
 		if ($args['equipmentId'] == 'new')
 		{
@@ -32,10 +21,19 @@ class EquipmentController extends BaseController
 		else
 		{
 			return $this->renderPage($response, 'equipmentform', [
-				'equipment' =>  $this->getDatabase()->equipment($args['equipmentId']),
+				'equipment' => $this->getDatabase()->equipment($args['equipmentId']),
 				'mode' => 'edit',
 				'userfields' => $this->getUserfieldsService()->GetFields('equipment')
 			]);
 		}
 	}
+
+	public function Overview(Request $request, Response $response, array $args)
+	{
+		return $this->renderPage($response, 'equipment', [
+			'equipment' => $this->getDatabase()->equipment()->orderBy('name', 'COLLATE NOCASE'),
+			'userfields' => $this->getUserfieldsService()->GetFields('equipment'),
+			'userfieldValues' => $this->getUserfieldsService()->GetAllValues('equipment')
+		]);
+	}
 }

controllers/ExceptionController.php

@@ -0,0 +1,82 @@
+<?php
+
+namespace Grocy\Controllers;
+
+use DI\Container;
+use Psr\Http\Message\ServerRequestInterface;
+use Psr\Log\LoggerInterface;
+use Slim\Exception\HttpException;
+use Slim\Exception\HttpForbiddenException;
+use Slim\Exception\HttpNotFoundException;
+use Throwable;
+
+class ExceptionController extends BaseApiController
+{
+	public function __construct(\Slim\App $app, Container $container)
+	{
+		parent::__construct($container);
+		$this->app = $app;
+	}
+
+	private $app;
+
+	public function __invoke(ServerRequestInterface $request, Throwable $exception, bool $displayErrorDetails, bool $logErrors, bool $logErrorDetails, ?LoggerInterface $logger = null)
+	{
+		$response = $this->app->getResponseFactory()->createResponse();
+		$isApiRoute = string_starts_with($request->getUri()->getPath(), '/api/');
+
+		if (!defined('GROCY_AUTHENTICATED'))
+		{
+			define('GROCY_AUTHENTICATED', false);
+		}
+
+		if ($isApiRoute)
+		{
+			$status = 500;
+
+			if ($exception instanceof HttpException)
+			{
+				$status = $exception->getCode();
+			}
+
+			$data = [
+				'error_message' => $exception->getMessage()
+			];
+
+			if ($displayErrorDetails)
+			{
+				$data['error_details'] = [
+					'stack_trace' => $exception->getTraceAsString(),
+					'file' => $exception->getFile(),
+					'line' => $exception->getLine()
+				];
+			}
+
+			return $this->ApiResponse($response->withStatus($status)->withHeader('Content-Type', 'application/json'), $data);
+		}
+
+		if ($exception instanceof HttpNotFoundException)
+		{
+			if (!defined('GROCY_AUTHENTICATED'))
+			{
+				define('GROCY_AUTHENTICATED', false);
+			}
+
+			return $this->renderPage($response->withStatus(404), 'errors/404', [
+				'exception' => $exception
+			]);
+		}
+
+		if ($exception instanceof HttpForbiddenException)
+		{
+			return $this->renderPage($response->withStatus(403), 'errors/403', [
+				'exception' => $exception
+			]);
+		}
+
+		return $this->renderPage($response->withStatus(500), 'errors/500', [
+			'exception' => $exception,
+			'systemInfo' => $this->getApplicationService()->GetSystemInfo()
+		]);
+	}
+}

controllers/FilesApiController.php

@@ -2,19 +2,23 @@
 
 namespace Grocy\Controllers;
 
-use \Grocy\Services\FilesService;
+use Grocy\Services\FilesService;
+use Psr\Http\Message\ResponseInterface as Response;
+use Psr\Http\Message\ServerRequestInterface as Request;
+use Slim\Exception\HttpNotFoundException;
+use Slim\Psr7\Stream;
 
 class FilesApiController extends BaseApiController
 {
-	public function __construct(\DI\Container $container)
-	{
-		parent::__construct($container);
-	}
-
-	public function UploadFile(\Psr\Http\Message\ServerRequestInterface $request, \Psr\Http\Message\ResponseInterface $response, array $args)
+	public function DeleteFile(Request $request, Response $response, array $args)
 	{
 		try
 		{
+			if (!in_array($args['group'], $this->getOpenApiSpec()->components->schemas->FileGroups->enum))
+			{
+				throw new \Exception('Invalid file group');
+			}
+
 			if (IsValidFileName(base64_decode($args['fileName'])))
 			{
 				$fileName = base64_decode($args['fileName']);
@@ -24,8 +28,7 @@ class FilesApiController extends BaseApiController
 				throw new \Exception('Invalid filename');
 			}
 
-			$data = $request->getBody()->getContents();
-			file_put_contents($this->getFilesService()->GetFilePath($args['group'], $fileName), $data);
+			$this->getFilesService()->DeleteFile($args['group'], $fileName);
 
 			return $this->EmptyApiResponse($response);
 		}
@@ -35,81 +38,97 @@ class FilesApiController extends BaseApiController
 		}
 	}
 
-	public function ServeFile(\Psr\Http\Message\ServerRequestInterface $request, \Psr\Http\Message\ResponseInterface $response, array $args)
+	public function ServeFile(Request $request, Response $response, array $args)
 	{
 		try
 		{
-			if (IsValidFileName(base64_decode($args['fileName'])))
+			if (!in_array($args['group'], $this->getOpenApiSpec()->components->schemas->FileGroups->enum))
 			{
-				$fileName = base64_decode($args['fileName']);
-			}
-			else
-			{
-				throw new \Exception('Invalid filename');
+				throw new \Exception('Invalid file group');
 			}
 
-			$forceServeAs = null;
-			if (isset($request->getQueryParams()['force_serve_as']) && !empty($request->getQueryParams()['force_serve_as']))
-			{
-				$forceServeAs = $request->getQueryParams()['force_serve_as'];
-			}
-
-			if ($forceServeAs == FilesService::FILE_SERVE_TYPE_PICTURE)
-			{
-				$bestFitHeight = null;
-				if (isset($request->getQueryParams()['best_fit_height']) && !empty($request->getQueryParams()['best_fit_height']) && is_numeric($request->getQueryParams()['best_fit_height']))
-				{
-					$bestFitHeight = $request->getQueryParams()['best_fit_height'];
-				}
-
-				$bestFitWidth = null;
-				if (isset($request->getQueryParams()['best_fit_width']) && !empty($request->getQueryParams()['best_fit_width']) && is_numeric($request->getQueryParams()['best_fit_width']))
-				{
-					$bestFitWidth = $request->getQueryParams()['best_fit_width'];
-				}
-
-				$filePath = $this->getFilesService()->DownscaleImage($args['group'], $fileName, $bestFitHeight, $bestFitWidth);
-			}
-			else
-			{
-				$filePath = $this->getFilesService()->GetFilePath($args['group'], $fileName);
-			}
+			$fileName = $this->checkFileName($args['fileName']);
+			$filePath = $this->getFilePath($args['group'], $fileName, $request->getQueryParams());
 
 			if (file_exists($filePath))
 			{
-				$response->write(file_get_contents($filePath));
 				$response = $response->withHeader('Cache-Control', 'max-age=2592000');
 				$response = $response->withHeader('Content-Type', mime_content_type($filePath));
-				return $response->withHeader('Content-Disposition', 'inline; filename="' . $fileName . '"');
+				$response = $response->withHeader('Content-Disposition', 'inline; filename="' . $fileName . '"');
+				return $response->withBody(new Stream(fopen($filePath, 'rb')));
 			}
 			else
 			{
-				return $this->GenericErrorResponse($response, 'File not found', 404);
+				throw new HttpNotFoundException($request, 'File not found');
 			}
 		}
 		catch (\Exception $ex)
 		{
-			return $this->GenericErrorResponse($response, $ex->getMessage());
+			throw new HttpNotFoundException($request, $ex->getMessage(), $ex);
 		}
 	}
 
-	public function DeleteFile(\Psr\Http\Message\ServerRequestInterface $request, \Psr\Http\Message\ResponseInterface $response, array $args)
+	public function ShowFile(Request $request, Response $response, array $args)
 	{
 		try
 		{
-			if (IsValidFileName(base64_decode($args['fileName'])))
+			if (!in_array($args['group'], $this->getOpenApiSpec()->components->schemas->FileGroups->enum))
 			{
-				$fileName = base64_decode($args['fileName']);
+				throw new \Exception('Invalid file group');
+			}
+
+			$fileInfo = explode('_', $args['fileName']);
+			$fileName = $this->checkFileName($fileInfo[1]);
+			$filePath = $this->getFilePath($args['group'], base64_decode($fileInfo[0]), $request->getQueryParams());
+
+			if (file_exists($filePath))
+			{
+				$response = $response->withHeader('Cache-Control', 'max-age=2592000');
+				$response = $response->withHeader('Content-Type', mime_content_type($filePath));
+				$response = $response->withHeader('Content-Disposition', 'inline; filename="' . $fileName . '"');
+				return $response->withBody(new Stream(fopen($filePath, 'rb')));
 			}
 			else
 			{
-				throw new \Exception('Invalid filename');
+				throw new HttpNotFoundException($request, 'File not found');
+			}
+		}
+		catch (\Exception $ex)
+		{
+			throw new HttpNotFoundException($request, $ex->getMessage(), $ex);
+		}
+	}
+
+	public function UploadFile(Request $request, Response $response, array $args)
+	{
+		try
+		{
+			if (!in_array($args['group'], $this->getOpenApiSpec()->components->schemas->FileGroups->enum))
+			{
+				throw new \Exception('Invalid file group');
 			}
 
-			$filePath = $this->getFilesService()->GetFilePath($args['group'], $fileName);
-			if (file_exists($filePath))
+			$fileName = $this->checkFileName($args['fileName']);
+
+			$fileHandle = fopen($this->getFilesService()->GetFilePath($args['group'], $fileName), 'xb');
+			if($fileHandle === false)
 			{
-				unlink($filePath);
+				throw new \Exception("Error while creating file $fileName");
+			}
+
+			// Save the file to disk in chunks of 1 MB
+			$requestBody = $request->getBody();
+			while ($data = $requestBody->read(1048576))
+			{
+				if (fwrite($fileHandle, $data) === false)
+				{
+					throw new \Exception("Error while writing file $fileName");
+				}
+			}
+
+			if (fclose($fileHandle) === false)
+			{
+				throw new \Exception("Error while closing file $fileName");
 			}
 
 			return $this->EmptyApiResponse($response);
@@ -119,4 +138,50 @@ class FilesApiController extends BaseApiController
 			return $this->GenericErrorResponse($response, $ex->getMessage());
 		}
 	}
+
+	protected function checkFileName(string $fileName)
+	{
+		if (IsValidFileName(base64_decode($fileName)))
+		{
+			$fileName = base64_decode($fileName);
+		}
+		else
+		{
+			throw new \Exception('Invalid filename');
+		}
+
+		return $fileName;
+	}
+
+	protected function getFilePath(string $group, string $fileName, array $queryParams = [])
+	{
+		$forceServeAs = null;
+		if (isset($queryParams['force_serve_as']) && !empty($queryParams['force_serve_as']))
+		{
+			$forceServeAs = $queryParams['force_serve_as'];
+		}
+
+		if ($forceServeAs == FilesService::FILE_SERVE_TYPE_PICTURE)
+		{
+			$bestFitHeight = null;
+			if (isset($queryParams['best_fit_height']) && !empty($queryParams['best_fit_height']) && is_numeric($queryParams['best_fit_height']))
+			{
+				$bestFitHeight = $queryParams['best_fit_height'];
+			}
+
+			$bestFitWidth = null;
+			if (isset($queryParams['best_fit_width']) && !empty($queryParams['best_fit_width']) && is_numeric($queryParams['best_fit_width']))
+			{
+				$bestFitWidth = $queryParams['best_fit_width'];
+			}
+
+			$filePath = $this->getFilesService()->DownscaleImage($group, $fileName, $bestFitHeight, $bestFitWidth);
+		}
+		else
+		{
+			$filePath = $this->getFilesService()->GetFilePath($group, $fileName);
+		}
+
+		return $filePath;
+	}
 }

controllers/GenericEntityApiController.php

@@ -2,69 +2,43 @@
 
 namespace Grocy\Controllers;
 
+use Grocy\Controllers\Users\User;
+use Psr\Http\Message\ResponseInterface as Response;
+use Psr\Http\Message\ServerRequestInterface as Request;
+
 class GenericEntityApiController extends BaseApiController
 {
-	public function __construct(\DI\Container $container)
+	public function AddObject(Request $request, Response $response, array $args)
 	{
-		parent::__construct($container);
-	}
-
-	public function GetObjects(\Psr\Http\Message\ServerRequestInterface $request, \Psr\Http\Message\ResponseInterface $response, array $args)
-	{
-		$objects = $this->getDatabase()->{$args['entity']}();
-		$allUserfields = $this->getUserfieldsService()->GetAllValues($args['entity']);
-
-		foreach ($objects as $object)
+		if ($args['entity'] == 'shopping_list' || $args['entity'] == 'shopping_lists')
 		{
-			$userfields = FindAllObjectsInArrayByPropertyValue($allUserfields, 'object_id', $object->id);
-			$userfieldKeyValuePairs = null;
-			if (count($userfields) > 0)
-			{
-				foreach ($userfields as $userfield)
-				{
-					$userfieldKeyValuePairs[$userfield->name] = $userfield->value;
-				}
-			}
-
-			$object->userfields = $userfieldKeyValuePairs;
+			User::checkPermission($request, User::PERMISSION_SHOPPINGLIST_ITEMS_ADD);
 		}
-
-		if ($this->IsValidEntity($args['entity']) && !$this->IsEntityWithPreventedListing($args['entity']))
+		elseif ($args['entity'] == 'recipes' || $args['entity'] == 'recipes_pos' || $args['entity'] == 'recipes_nestings')
 		{
-			return $this->ApiResponse($response, $objects);
+			User::checkPermission($request, User::PERMISSION_RECIPES);
+		}
+		elseif ($args['entity'] == 'meal_plan')
+		{
+			User::checkPermission($request, User::PERMISSION_RECIPES_MEALPLAN);
+		}
+		elseif ($args['entity'] == 'equipment')
+		{
+			User::checkPermission($request, User::PERMISSION_EQUIPMENT);
 		}
 		else
 		{
-			return $this->GenericErrorResponse($response, 'Entity does not exist or is not exposed');
+			User::checkPermission($request, User::PERMISSION_MASTER_DATA_EDIT);
 		}
-	}
 
-	public function GetObject(\Psr\Http\Message\ServerRequestInterface $request, \Psr\Http\Message\ResponseInterface $response, array $args)
-	{
-		if ($this->IsValidEntity($args['entity']) && !$this->IsEntityWithPreventedListing($args['entity']))
+		if ($this->IsValidExposedEntity($args['entity']) && !$this->IsEntityWithNoEdit($args['entity']))
 		{
-			$userfields = $this->getUserfieldsService()->GetValues($args['entity'], $args['objectId']);
-			if (count($userfields) === 0)
+			if ($this->IsEntityWithEditRequiresAdmin($args['entity']))
 			{
-				$userfields = null;
+				User::checkPermission($request, User::PERMISSION_ADMIN);
 			}
 
-			$object = $this->getDatabase()->{$args['entity']}($args['objectId']);
-			$object['userfields'] = $userfields;
-
-			return $this->ApiResponse($response, $object);
-		}
-		else
-		{
-			return $this->GenericErrorResponse($response, 'Entity does not exist or is not exposed');
-		}
-	}
-
-	public function AddObject(\Psr\Http\Message\ServerRequestInterface $request, \Psr\Http\Message\ResponseInterface $response, array $args)
-	{
-		if ($this->IsValidEntity($args['entity']))
-		{
-			$requestBody = $request->getParsedBody();
+			$requestBody = $this->GetParsedAndFilteredRequestBody($request);
 
 			try
 			{
@@ -75,10 +49,17 @@ class GenericEntityApiController extends BaseApiController
 
 				$newRow = $this->getDatabase()->{$args['entity']}()->createRow($requestBody);
 				$newRow->save();
-				$success = $newRow->isClean();
-				return $this->ApiResponse($response, array(
-					'created_object_id' => $this->getDatabase()->lastInsertId()
-				));
+				$newObjectId = $this->getDatabase()->lastInsertId();
+
+				// TODO: This should be better done somehow in StockService
+				if ($args['entity'] == 'products' && boolval($this->getUsersService()->GetUserSetting(GROCY_USER_ID, 'shopping_list_auto_add_below_min_stock_amount')))
+				{
+					$this->getStockService()->AddMissingProductsToShoppingList($this->getUsersService()->GetUserSetting(GROCY_USER_ID, 'shopping_list_auto_add_below_min_stock_amount_list_id'));
+				}
+
+				return $this->ApiResponse($response, [
+					'created_object_id' => $newObjectId
+				]);
 			}
 			catch (\Exception $ex)
 			{
@@ -91,11 +72,87 @@ class GenericEntityApiController extends BaseApiController
 		}
 	}
 
-	public function EditObject(\Psr\Http\Message\ServerRequestInterface $request, \Psr\Http\Message\ResponseInterface $response, array $args)
+	public function DeleteObject(Request $request, Response $response, array $args)
 	{
-		if ($this->IsValidEntity($args['entity']))
+		if ($args['entity'] == 'shopping_list' || $args['entity'] == 'shopping_lists')
 		{
-			$requestBody = $request->getParsedBody();
+			User::checkPermission($request, User::PERMISSION_SHOPPINGLIST_ITEMS_DELETE);
+		}
+		elseif ($args['entity'] == 'recipes' || $args['entity'] == 'recipes_pos' || $args['entity'] == 'recipes_nestings')
+		{
+			User::checkPermission($request, User::PERMISSION_RECIPES);
+		}
+		elseif ($args['entity'] == 'meal_plan')
+		{
+			User::checkPermission($request, User::PERMISSION_RECIPES_MEALPLAN);
+		}
+		elseif ($args['entity'] == 'equipment')
+		{
+			User::checkPermission($request, User::PERMISSION_EQUIPMENT);
+		}
+		elseif ($args['entity'] == 'api_keys')
+		{
+			// Always allowed
+		}
+		else
+		{
+			User::checkPermission($request, User::PERMISSION_MASTER_DATA_EDIT);
+		}
+
+		if ($this->IsValidExposedEntity($args['entity']) && !$this->IsEntityWithNoDelete($args['entity']))
+		{
+			if ($this->IsEntityWithEditRequiresAdmin($args['entity']))
+			{
+				User::checkPermission($request, User::PERMISSION_ADMIN);
+			}
+
+			$row = $this->getDatabase()->{$args['entity']}($args['objectId']);
+			if ($row == null)
+			{
+				return $this->GenericErrorResponse($response, 'Object not found', 400);
+			}
+
+			$row->delete();
+
+			return $this->EmptyApiResponse($response);
+		}
+		else
+		{
+			return $this->GenericErrorResponse($response, 'Invalid entity');
+		}
+	}
+
+	public function EditObject(Request $request, Response $response, array $args)
+	{
+		if ($args['entity'] == 'shopping_list' || $args['entity'] == 'shopping_lists')
+		{
+			User::checkPermission($request, User::PERMISSION_SHOPPINGLIST_ITEMS_ADD);
+		}
+		elseif ($args['entity'] == 'recipes' || $args['entity'] == 'recipes_pos' || $args['entity'] == 'recipes_nestings')
+		{
+			User::checkPermission($request, User::PERMISSION_RECIPES);
+		}
+		elseif ($args['entity'] == 'meal_plan')
+		{
+			User::checkPermission($request, User::PERMISSION_RECIPES_MEALPLAN);
+		}
+		elseif ($args['entity'] == 'equipment')
+		{
+			User::checkPermission($request, User::PERMISSION_EQUIPMENT);
+		}
+		else
+		{
+			User::checkPermission($request, User::PERMISSION_MASTER_DATA_EDIT);
+		}
+
+		if ($this->IsValidExposedEntity($args['entity']) && !$this->IsEntityWithNoEdit($args['entity']))
+		{
+			if ($this->IsEntityWithEditRequiresAdmin($args['entity']))
+			{
+				User::checkPermission($request, User::PERMISSION_ADMIN);
+			}
+
+			$requestBody = $this->GetParsedAndFilteredRequestBody($request);
 
 			try
 			{
@@ -105,8 +162,19 @@ class GenericEntityApiController extends BaseApiController
 				}
 
 				$row = $this->getDatabase()->{$args['entity']}($args['objectId']);
+				if ($row == null)
+				{
+					return $this->GenericErrorResponse($response, 'Object not found', 400);
+				}
+
 				$row->update($requestBody);
-				$success = $row->isClean();
+
+				// TODO: This should be better done somehow in StockService
+				if ($args['entity'] == 'products' && boolval($this->getUsersService()->GetUserSetting(GROCY_USER_ID, 'shopping_list_auto_add_below_min_stock_amount')))
+				{
+					$this->getStockService()->AddMissingProductsToShoppingList($this->getUsersService()->GetUserSetting(GROCY_USER_ID, 'shopping_list_auto_add_below_min_stock_amount_list_id'));
+				}
+
 				return $this->EmptyApiResponse($response);
 			}
 			catch (\Exception $ex)
@@ -120,41 +188,80 @@ class GenericEntityApiController extends BaseApiController
 		}
 	}
 
-	public function DeleteObject(\Psr\Http\Message\ServerRequestInterface $request, \Psr\Http\Message\ResponseInterface $response, array $args)
+	public function GetObject(Request $request, Response $response, array $args)
 	{
-		if ($this->IsValidEntity($args['entity']))
-		{
-			$row = $this->getDatabase()->{$args['entity']}($args['objectId']);
-			$row->delete();
-			$success = $row->isClean();
-			return $this->EmptyApiResponse($response);
-		}
-		else
-		{
-			return $this->GenericErrorResponse($response, $ex->getMessage());
-		}
-	}
-
-	public function SearchObjects(\Psr\Http\Message\ServerRequestInterface $request, \Psr\Http\Message\ResponseInterface $response, array $args)
-	{
-		if ($this->IsValidEntity($args['entity']) && !$this->IsEntityWithPreventedListing($args['entity']))
-		{
-			try
-			{
-				return $this->ApiResponse($response, $this->getDatabase()->{$args['entity']}()->where('name LIKE ?', '%' . $args['searchString'] . '%'));
-			}
-			catch (\PDOException $ex)
-			{
-				return $this->GenericErrorResponse($response, 'The given entity has no field "name"');
-			}
-		}
-		else
+		if (!$this->IsValidExposedEntity($args['entity']) || $this->IsEntityWithNoListing($args['entity']))
 		{
 			return $this->GenericErrorResponse($response, 'Entity does not exist or is not exposed');
 		}
+
+		$object = $this->getDatabase()->{$args['entity']}($args['objectId']);
+		if ($object == null)
+		{
+			return $this->GenericErrorResponse($response, 'Object not found', 404);
+		}
+
+		// TODO: Handle this somehow more generically
+		$referencingId = $args['objectId'];
+		if ($args['entity'] == 'stock')
+		{
+			$referencingId = $object->stock_id;
+		}
+		$userfields = $this->getUserfieldsService()->GetValues($args['entity'], $referencingId);
+		if (count($userfields) === 0)
+		{
+			$userfields = null;
+		}
+		$object['userfields'] = $userfields;
+
+		return $this->ApiResponse($response, $object);
 	}
 
-	public function GetUserfields(\Psr\Http\Message\ServerRequestInterface $request, \Psr\Http\Message\ResponseInterface $response, array $args)
+	public function GetObjects(Request $request, Response $response, array $args)
+	{
+		if (!$this->IsValidExposedEntity($args['entity']) || $this->IsEntityWithNoListing($args['entity']))
+		{
+			return $this->GenericErrorResponse($response, 'Entity does not exist or is not exposed');
+		}
+
+		$objects = $this->queryData($this->getDatabase()->{$args['entity']}(), $request->getQueryParams());
+
+		$userfields = $this->getUserfieldsService()->GetFields($args['entity']);
+		if (count($userfields) > 0)
+		{
+			$allUserfieldValues = $this->getUserfieldsService()->GetAllValues($args['entity']);
+
+			foreach ($objects as $object)
+			{
+				$userfieldKeyValuePairs = null;
+				foreach ($userfields as $userfield)
+				{
+					// TODO: Handle this somehow more generically
+					$userfieldReference = 'id';
+					if ($args['entity'] == 'stock')
+					{
+						$userfieldReference = 'stock_id';
+					}
+
+					$value = FindObjectInArrayByPropertyValue(FindAllObjectsInArrayByPropertyValue($allUserfieldValues, 'object_id', $object->{$userfieldReference}), 'name', $userfield->name);
+					if ($value)
+					{
+						$userfieldKeyValuePairs[$userfield->name] = $value->value;
+					}
+					else
+					{
+						$userfieldKeyValuePairs[$userfield->name] = null;
+					}
+				}
+
+				$object->userfields = $userfieldKeyValuePairs;
+			}
+		}
+
+		return $this->ApiResponse($response, $objects);
+	}
+
+	public function GetUserfields(Request $request, Response $response, array $args)
 	{
 		try
 		{
@@ -166,9 +273,11 @@ class GenericEntityApiController extends BaseApiController
 		}
 	}
 
-	public function SetUserfields(\Psr\Http\Message\ServerRequestInterface $request, \Psr\Http\Message\ResponseInterface $response, array $args)
+	public function SetUserfields(Request $request, Response $response, array $args)
 	{
-		$requestBody = $request->getParsedBody();
+		User::checkPermission($request, User::PERMISSION_MASTER_DATA_EDIT);
+
+		$requestBody = $this->GetParsedAndFilteredRequestBody($request);
 
 		try
 		{
@@ -186,13 +295,28 @@ class GenericEntityApiController extends BaseApiController
 		}
 	}
 
-	private function IsValidEntity($entity)
+	private function IsEntityWithEditRequiresAdmin($entity)
 	{
-		return in_array($entity, $this->getOpenApiSpec()->components->internalSchemas->ExposedEntity->enum);
+		return in_array($entity, $this->getOpenApiSpec()->components->schemas->ExposedEntityEditRequiresAdmin->enum);
 	}
 
-	private function IsEntityWithPreventedListing($entity)
+	private function IsEntityWithNoListing($entity)
 	{
-		return !in_array($entity, $this->getOpenApiSpec()->components->internalSchemas->ExposedEntityButNoListing->enum);
+		return in_array($entity, $this->getOpenApiSpec()->components->schemas->ExposedEntityNoListing->enum);
+	}
+
+	private function IsEntityWithNoEdit($entity)
+	{
+		return in_array($entity, $this->getOpenApiSpec()->components->schemas->ExposedEntityNoEdit->enum);
+	}
+
+	private function IsEntityWithNoDelete($entity)
+	{
+		return in_array($entity, $this->getOpenApiSpec()->components->schemas->ExposedEntityNoDelete->enum);
+	}
+
+	private function IsValidExposedEntity($entity)
+	{
+		return in_array($entity, $this->getOpenApiSpec()->components->schemas->ExposedEntity->enum);
 	}
 }

controllers/GenericEntityController.php

@@ -2,41 +2,36 @@
 
 namespace Grocy\Controllers;
 
+use Psr\Http\Message\ResponseInterface as Response;
+use Psr\Http\Message\ServerRequestInterface as Request;
+
 class GenericEntityController extends BaseController
 {
-	public function __construct(\DI\Container $container)
-	{
-		parent::__construct($container);
-	}
-
-	public function UserfieldsList(\Psr\Http\Message\ServerRequestInterface $request, \Psr\Http\Message\ResponseInterface $response, array $args)
-	{
-		return $this->renderPage($response, 'userfields', [
-			'userfields' => $this->getUserfieldsService()->GetAllFields(),
-			'entities' => $this->getUserfieldsService()->GetEntities()
-		]);
-	}
-
-	public function UserentitiesList(\Psr\Http\Message\ServerRequestInterface $request, \Psr\Http\Message\ResponseInterface $response, array $args)
+	public function UserentitiesList(Request $request, Response $response, array $args)
 	{
 		return $this->renderPage($response, 'userentities', [
-			'userentities' => $this->getDatabase()->userentities()->orderBy('name')
+			'userentities' => $this->getDatabase()->userentities()->orderBy('name', 'COLLATE NOCASE')
 		]);
 	}
 
-	public function UserobjectsList(\Psr\Http\Message\ServerRequestInterface $request, \Psr\Http\Message\ResponseInterface $response, array $args)
+	public function UserentityEditForm(Request $request, Response $response, array $args)
 	{
-		$userentity = $this->getDatabase()->userentities()->where('name = :1', $args['userentityName'])->fetch();
-
-		return $this->renderPage($response, 'userobjects', [
-			'userentity' => $userentity,
-			'userobjects' => $this->getDatabase()->userobjects()->where('userentity_id = :1', $userentity->id),
-			'userfields' => $this->getUserfieldsService()->GetFields('userentity-' . $args['userentityName']),
-			'userfieldValues' => $this->getUserfieldsService()->GetAllValues('userentity-' . $args['userentityName'])
-		]);
+		if ($args['userentityId'] == 'new')
+		{
+			return $this->renderPage($response, 'userentityform', [
+				'mode' => 'create'
+			]);
+		}
+		else
+		{
+			return $this->renderPage($response, 'userentityform', [
+				'mode' => 'edit',
+				'userentity' => $this->getDatabase()->userentities($args['userentityId'])
+			]);
+		}
 	}
 
-	public function UserfieldEditForm(\Psr\Http\Message\ServerRequestInterface $request, \Psr\Http\Message\ResponseInterface $response, array $args)
+	public function UserfieldEditForm(Request $request, Response $response, array $args)
 	{
 		if ($args['userfieldId'] == 'new')
 		{
@@ -50,31 +45,22 @@ class GenericEntityController extends BaseController
 		{
 			return $this->renderPage($response, 'userfieldform', [
 				'mode' => 'edit',
-				'userfield' =>  $this->getUserfieldsService()->GetField($args['userfieldId']),
+				'userfield' => $this->getUserfieldsService()->GetField($args['userfieldId']),
 				'userfieldTypes' => $this->getUserfieldsService()->GetFieldTypes(),
 				'entities' => $this->getUserfieldsService()->GetEntities()
 			]);
 		}
 	}
 
-	public function UserentityEditForm(\Psr\Http\Message\ServerRequestInterface $request, \Psr\Http\Message\ResponseInterface $response, array $args)
+	public function UserfieldsList(Request $request, Response $response, array $args)
 	{
-		if ($args['userentityId'] == 'new')
-		{
-			return $this->renderPage($response, 'userentityform', [
-				'mode' => 'create'
-			]);
-		}
-		else
-		{
-			return $this->renderPage($response, 'userentityform', [
-				'mode' => 'edit',
-				'userentity' =>  $this->getDatabase()->userentities($args['userentityId'])
-			]);
-		}
+		return $this->renderPage($response, 'userfields', [
+			'userfields' => $this->getUserfieldsService()->GetAllFields(),
+			'entities' => $this->getUserfieldsService()->GetEntities()
+		]);
 	}
 
-	public function UserobjectEditForm(\Psr\Http\Message\ServerRequestInterface $request, \Psr\Http\Message\ResponseInterface $response, array $args)
+	public function UserobjectEditForm(Request $request, Response $response, array $args)
 	{
 		$userentity = $this->getDatabase()->userentities()->where('name = :1', $args['userentityName'])->fetch();
 
@@ -91,9 +77,21 @@ class GenericEntityController extends BaseController
 			return $this->renderPage($response, 'userobjectform', [
 				'userentity' => $userentity,
 				'mode' => 'edit',
-				'userobject' =>  $this->getDatabase()->userobjects($args['userobjectId']),
+				'userobject' => $this->getDatabase()->userobjects($args['userobjectId']),
 				'userfields' => $this->getUserfieldsService()->GetFields('userentity-' . $args['userentityName'])
 			]);
 		}
 	}
+
+	public function UserobjectsList(Request $request, Response $response, array $args)
+	{
+		$userentity = $this->getDatabase()->userentities()->where('name = :1', $args['userentityName'])->fetch();
+
+		return $this->renderPage($response, 'userobjects', [
+			'userentity' => $userentity,
+			'userobjects' => $this->getDatabase()->userobjects()->where('userentity_id = :1', $userentity->id),
+			'userfields' => $this->getUserfieldsService()->GetFields('userentity-' . $args['userentityName']),
+			'userfieldValues' => $this->getUserfieldsService()->GetAllValues('userentity-' . $args['userentityName'])
+		]);
+	}
 }

controllers/GrocycodeTrait.php

@@ -0,0 +1,45 @@
+<?php
+
+namespace Grocy\Controllers;
+
+use Grocy\Helpers\Grocycode;
+use jucksearm\barcode\lib\BarcodeFactory;
+use jucksearm\barcode\lib\DatamatrixFactory;
+use Psr\Http\Message\ResponseInterface as Response;
+use Psr\Http\Message\ServerRequestInterface as Request;
+
+trait GrocycodeTrait
+{
+	public function ServeGrocycodeImage(Request $request, Response $response, Grocycode $grocycode)
+	{
+		$size = $request->getQueryParam('size', null);
+
+		if (GROCY_GROCYCODE_TYPE == '2D')
+		{
+			$png = (new DatamatrixFactory())->setCode((string)$grocycode)->setSize($size)->getDatamatrixPngData();
+		}
+		else
+		{
+			$png = (new BarcodeFactory())->setType('C128')->setCode((string)$grocycode)->setHeight($size)->getBarcodePngData();
+		}
+
+		$isDownload = $request->getQueryParam('download', false);
+		if ($isDownload)
+		{
+			$response = $response->withHeader('Content-Type', 'application/octet-stream')
+				->withHeader('Content-Disposition', 'attachment; filename=Grocycode.png')
+				->withHeader('Content-Length', strlen($png))
+				->withHeader('Cache-Control', 'no-cache')
+				->withHeader('Last-Modified', gmdate('D, d M Y H:i:s') . ' GMT');
+		}
+		else
+		{
+			$response = $response->withHeader('Content-Type', 'image/png')
+				->withHeader('Content-Length', strlen($png))
+				->withHeader('Cache-Control', 'no-cache')
+				->withHeader('Last-Modified', gmdate('D, d M Y H:i:s') . ' GMT');
+		}
+		$response->getBody()->write($png);
+		return $response;
+	}
+}

controllers/LoginController.php

@@ -2,62 +2,33 @@
 
 namespace Grocy\Controllers;
 
+use Grocy\Services\SessionService;
+use Psr\Http\Message\ResponseInterface as Response;
+use Psr\Http\Message\ServerRequestInterface as Request;
+
 class LoginController extends BaseController
 {
-	public function __construct(\DI\Container $container, string $sessionCookieName)
+	public function LoginPage(Request $request, Response $response, array $args)
 	{
-		parent::__construct($container);
-		$this->SessionCookieName = $sessionCookieName;
+		return $this->renderPage($response, 'login');
 	}
-	protected $SessionCookieName;
 
-	public function ProcessLogin(\Psr\Http\Message\ServerRequestInterface $request, \Psr\Http\Message\ResponseInterface $response, array $args)
+	public function Logout(Request $request, Response $response, array $args)
 	{
-		$postParams = $request->getParsedBody();
-		if (isset($postParams['username']) && isset($postParams['password']))
+		$this->getSessionService()->RemoveSession($_COOKIE[SessionService::SESSION_COOKIE_NAME]);
+		return $response->withRedirect($this->AppContainer->get('UrlManager')->ConstructUrl('/'));
+	}
+
+	public function ProcessLogin(Request $request, Response $response, array $args)
+	{
+		$authMiddlewareClass = GROCY_AUTH_CLASS;
+		if ($authMiddlewareClass::ProcessLogin($request->getParsedBody()))
 		{
-			$user = $this->getDatabase()->users()->where('username', $postParams['username'])->fetch();
-			$inputPassword = $postParams['password'];
-			$stayLoggedInPermanently = $postParams['stay_logged_in'] == 'on';
-
-			if ($user !== null && password_verify($inputPassword, $user->password))
-			{
-				$sessionKey = $this->getSessionService()->CreateSession($user->id, $stayLoggedInPermanently);
-				setcookie($this->SessionCookieName, $sessionKey, PHP_INT_SIZE == 4 ? PHP_INT_MAX : PHP_INT_MAX>>32); // Cookie expires never, but session validity is up to SessionService
-
-				if (password_needs_rehash($user->password, PASSWORD_DEFAULT))
-				{
-					$user->update(array(
-						'password' => password_hash($inputPassword, PASSWORD_DEFAULT)
-					));
-				}
-
-				return $response->withRedirect($this->AppContainer->get('UrlManager')->ConstructUrl('/'));
-			}
-			else
-			{
-				return $response->withRedirect($this->AppContainer->get('UrlManager')->ConstructUrl('/login?invalid=true'));
-			}
+			return $response->withRedirect($this->AppContainer->get('UrlManager')->ConstructUrl('/'));
 		}
 		else
 		{
 			return $response->withRedirect($this->AppContainer->get('UrlManager')->ConstructUrl('/login?invalid=true'));
 		}
 	}
-
-	public function LoginPage(\Psr\Http\Message\ServerRequestInterface $request, \Psr\Http\Message\ResponseInterface $response, array $args)
-	{
-		return $this->renderPage($response, 'login');
-	}
-
-	public function Logout(\Psr\Http\Message\ServerRequestInterface $request, \Psr\Http\Message\ResponseInterface $response, array $args)
-	{
-		$this->getSessionService()->RemoveSession($_COOKIE[$this->SessionCookieName]);
-		return $response->withRedirect($this->AppContainer->get('UrlManager')->ConstructUrl('/'));
-	}
-
-	public function GetSessionCookieName()
-	{
-		return $this->SessionCookieName;
-	}
 }

controllers/OpenApiController.php

@@ -2,42 +2,111 @@
 
 namespace Grocy\Controllers;
 
+use Grocy\Controllers\Users\User;
+use Grocy\Services\ApiKeyService;
+use Psr\Http\Message\ResponseInterface as Response;
+use Psr\Http\Message\ServerRequestInterface as Request;
+
 class OpenApiController extends BaseApiController
 {
-	public function __construct(\DI\Container $container)
+	public function ApiKeysList(Request $request, Response $response, array $args)
 	{
-		parent::__construct($container);
-	}
+		$selectedKeyId = -1;
+		if (isset($request->getQueryParams()['key']) && filter_var($request->getQueryParams()['key'], FILTER_VALIDATE_INT))
+		{
+			$selectedKeyId = $request->getQueryParams()['key'];
+		}
 
-	public function DocumentationUi(\Psr\Http\Message\ServerRequestInterface $request, \Psr\Http\Message\ResponseInterface $response, array $args)
-	{
-		return $this->render($response, 'openapiui');
-	}
+		$apiKeys = $this->getDatabase()->api_keys();
+		if (!User::hasPermissions(User::PERMISSION_ADMIN))
+		{
+			$apiKeys = $apiKeys->where('user_id', GROCY_USER_ID);
+		}
 
-	public function DocumentationSpec(\Psr\Http\Message\ServerRequestInterface $request, \Psr\Http\Message\ResponseInterface $response, array $args)
-	{
-		$applicationService = $this->getApplicationService();
-
-		$versionInfo = $applicationService->GetInstalledVersion();
-		$this->getOpenApiSpec()->info->version = $versionInfo->Version;
-		$this->getOpenApiSpec()->info->description = str_replace('PlaceHolderManageApiKeysUrl', $this->AppContainer->get('UrlManager')->ConstructUrl('/manageapikeys'), $this->getOpenApiSpec()->info->description);
-		$this->getOpenApiSpec()->servers[0]->url = $this->AppContainer->get('UrlManager')->ConstructUrl('/api');
-
-		return $this->ApiResponse($response, $this->getOpenApiSpec());
-	}
-
-	public function ApiKeysList(\Psr\Http\Message\ServerRequestInterface $request, \Psr\Http\Message\ResponseInterface $response, array $args)
-	{
 		return $this->renderPage($response, 'manageapikeys', [
-			'apiKeys' => $this->getDatabase()->api_keys(),
-			'users' => $this->getDatabase()->users()
+			'apiKeys' => $apiKeys,
+			'users' => $this->getDatabase()->users(),
+			'selectedKeyId' => $selectedKeyId
 		]);
 	}
 
-	public function CreateNewApiKey(\Psr\Http\Message\ServerRequestInterface $request, \Psr\Http\Message\ResponseInterface $response, array $args)
+	public function CreateNewApiKey(Request $request, Response $response, array $args)
 	{
-		$newApiKey = $this->getApiKeyService()->CreateApiKey();
+		$description = null;
+		if (isset($request->getQueryParams()['description']))
+		{
+			$description = $request->getQueryParams()['description'];
+		}
+
+		$newApiKey = $this->getApiKeyService()->CreateApiKey(ApiKeyService::API_KEY_TYPE_DEFAULT, $description);
 		$newApiKeyId = $this->getApiKeyService()->GetApiKeyId($newApiKey);
-		return $response->withRedirect($this->AppContainer->get('UrlManager')->ConstructUrl("/manageapikeys?CreatedApiKeyId=$newApiKeyId"));
+		return $response->withRedirect($this->AppContainer->get('UrlManager')->ConstructUrl("/manageapikeys?key=$newApiKeyId"));
+	}
+
+	public function DocumentationSpec(Request $request, Response $response, array $args)
+	{
+		$spec = $this->getOpenApiSpec();
+
+		$applicationService = $this->getApplicationService();
+		$versionInfo = $applicationService->GetInstalledVersion();
+		$spec->info->version = $versionInfo->Version;
+		$spec->info->description = str_replace('PlaceHolderManageApiKeysUrl', $this->AppContainer->get('UrlManager')->ConstructUrl('/manageapikeys'), $spec->info->description);
+		$spec->servers[0]->url = $this->AppContainer->get('UrlManager')->ConstructUrl('/api');
+
+		$spec->components->schemas->ExposedEntity_IncludingUserEntities = clone $spec->components->schemas->StringEnumTemplate;
+		;
+		foreach ($this->getUserfieldsService()->GetEntities() as $userEntity)
+		{
+			array_push($spec->components->schemas->ExposedEntity_IncludingUserEntities->enum, $userEntity);
+		}
+		sort($spec->components->schemas->ExposedEntity_IncludingUserEntities->enum);
+
+		$spec->components->schemas->ExposedEntity_NotIncludingNotEditable = clone $spec->components->schemas->StringEnumTemplate;
+		foreach ($spec->components->schemas->ExposedEntity->enum as $value)
+		{
+			if (!in_array($value, $spec->components->schemas->ExposedEntityNoEdit->enum))
+			{
+				array_push($spec->components->schemas->ExposedEntity_NotIncludingNotEditable->enum, $value);
+			}
+		}
+		sort($spec->components->schemas->ExposedEntity_NotIncludingNotEditable->enum);
+
+		$spec->components->schemas->ExposedEntity_IncludingUserEntities_NotIncludingNotEditable = clone $spec->components->schemas->StringEnumTemplate;
+		foreach ($spec->components->schemas->ExposedEntity_IncludingUserEntities->enum as $value)
+		{
+			if (!in_array($value, $spec->components->schemas->ExposedEntityNoEdit->enum))
+			{
+				array_push($spec->components->schemas->ExposedEntity_IncludingUserEntities_NotIncludingNotEditable->enum, $value);
+			}
+		}
+		array_push($spec->components->schemas->ExposedEntity_IncludingUserEntities_NotIncludingNotEditable->enum, 'stock'); // TODO: Don't hardcode this here - stock entries are normally not editable, but the corresponding Userfields are
+		sort($spec->components->schemas->ExposedEntity_IncludingUserEntities_NotIncludingNotEditable->enum);
+
+		$spec->components->schemas->ExposedEntity_NotIncludingNotDeletable = clone $spec->components->schemas->StringEnumTemplate;
+		foreach ($spec->components->schemas->ExposedEntity->enum as $value)
+		{
+			if (!in_array($value, $spec->components->schemas->ExposedEntityNoDelete->enum))
+			{
+				array_push($spec->components->schemas->ExposedEntity_NotIncludingNotDeletable->enum, $value);
+			}
+		}
+		sort($spec->components->schemas->ExposedEntity_NotIncludingNotDeletable->enum);
+
+		$spec->components->schemas->ExposedEntity_NotIncludingNotListable = clone $spec->components->schemas->StringEnumTemplate;
+		foreach ($spec->components->schemas->ExposedEntity->enum as $value)
+		{
+			if (!in_array($value, $spec->components->schemas->ExposedEntityNoListing->enum))
+			{
+				array_push($spec->components->schemas->ExposedEntity_NotIncludingNotListable->enum, $value);
+			}
+		}
+		sort($spec->components->schemas->ExposedEntity_NotIncludingNotListable->enum);
+
+		return $this->ApiResponse($response, $spec);
+	}
+
+	public function DocumentationUi(Request $request, Response $response, array $args)
+	{
+		return $this->render($response, 'openapiui');
 	}
 }

controllers/PrintApiController.php

@@ -0,0 +1,38 @@
+<?php
+
+namespace Grocy\Controllers;
+
+use Grocy\Controllers\Users\User;
+use Psr\Http\Message\ResponseInterface as Response;
+use Psr\Http\Message\ServerRequestInterface as Request;
+
+class PrintApiController extends BaseApiController
+{
+	public function PrintShoppingListThermal(Request $request, Response $response, array $args)
+	{
+		try
+		{
+			User::checkPermission($request, User::PERMISSION_SHOPPINGLIST);
+
+			$params = $request->getQueryParams();
+
+			$listId = 1;
+			if (isset($params['list']))
+			{
+				$listId = $params['list'];
+			}
+
+			$printHeader = true;
+			if (isset($params['printHeader']))
+			{
+				$printHeader = ($params['printHeader'] === 'true');
+			}
+			$items = $this->getStockService()->GetShoppinglistInPrintableStrings($listId);
+			return $this->ApiResponse($response, $this->getPrintService()->printShoppingList($printHeader, $items));
+		}
+		catch (\Exception $ex)
+		{
+			return $this->GenericErrorResponse($response, $ex->getMessage());
+		}
+	}
+}

controllers/RecipesApiController.php

@@ -2,16 +2,19 @@
 
 namespace Grocy\Controllers;
 
+use Grocy\Controllers\Users\User;
+use Grocy\Helpers\WebhookRunner;
+use Grocy\Helpers\Grocycode;
+use Psr\Http\Message\ResponseInterface as Response;
+use Psr\Http\Message\ServerRequestInterface as Request;
+
 class RecipesApiController extends BaseApiController
 {
-	public function __construct(\DI\Container $container)
+	public function AddNotFulfilledProductsToShoppingList(Request $request, Response $response, array $args)
 	{
-		parent::__construct($container);
-	}
+		User::checkPermission($request, User::PERMISSION_SHOPPINGLIST_ITEMS_ADD);
 
-	public function AddNotFulfilledProductsToShoppingList(\Psr\Http\Message\ServerRequestInterface $request, \Psr\Http\Message\ResponseInterface $response, array $args)
-	{
-		$requestBody = $request->getParsedBody();
+		$requestBody = $this->GetParsedAndFilteredRequestBody($request);
 		$excludedProductIds = null;
 
 		if ($requestBody !== null && array_key_exists('excludedProductIds', $requestBody))
@@ -23,8 +26,10 @@ class RecipesApiController extends BaseApiController
 		return $this->EmptyApiResponse($response);
 	}
 
-	public function ConsumeRecipe(\Psr\Http\Message\ServerRequestInterface $request, \Psr\Http\Message\ResponseInterface $response, array $args)
+	public function ConsumeRecipe(Request $request, Response $response, array $args)
 	{
+		User::checkPermission($request, User::PERMISSION_STOCK_CONSUME);
+
 		try
 		{
 			$this->getRecipesService()->ConsumeRecipe($args['recipeId']);
@@ -36,17 +41,18 @@ class RecipesApiController extends BaseApiController
 		}
 	}
 
-	public function GetRecipeFulfillment(\Psr\Http\Message\ServerRequestInterface $request, \Psr\Http\Message\ResponseInterface $response, array $args)
+	public function GetRecipeFulfillment(Request $request, Response $response, array $args)
 	{
 		try
 		{
-			if(!isset($args['recipeId']))
+			if (!isset($args['recipeId']))
 			{
-				return $this->ApiResponse($response, $this->getRecipesService()->GetRecipesResolved());
+				return $this->FilteredApiResponse($response, $this->getRecipesService()->GetRecipesResolved(), $request->getQueryParams());
 			}
 
 			$recipeResolved = FindObjectInArrayByPropertyValue($this->getRecipesService()->GetRecipesResolved(), 'recipe_id', $args['recipeId']);
-			if(!$recipeResolved)
+
+			if (!$recipeResolved)
 			{
 				throw new \Exception('Recipe does not exist');
 			}
@@ -60,4 +66,43 @@ class RecipesApiController extends BaseApiController
 			return $this->GenericErrorResponse($response, $ex->getMessage());
 		}
 	}
+
+	public function CopyRecipe(Request $request, Response $response, array $args)
+	{
+		try
+		{
+			return $this->ApiResponse($response, [
+				'created_object_id' => $this->getRecipesService()->CopyRecipe($args['recipeId'])
+			]);
+		}
+		catch (\Exception $ex)
+		{
+			return $this->GenericErrorResponse($response, $ex->getMessage());
+		}
+	}
+
+	public function RecipePrintLabel(Request $request, Response $response, array $args)
+	{
+		try
+		{
+			$recipe = $this->getDatabase()->recipes()->where('id', $args['recipeId'])->fetch();
+
+			$webhookData = array_merge([
+				'recipe' => $recipe->name,
+				'grocycode' => (string)(new Grocycode(Grocycode::RECIPE, $args['recipeId'])),
+				'details' => $recipe
+			], GROCY_LABEL_PRINTER_PARAMS);
+
+			if (GROCY_LABEL_PRINTER_RUN_SERVER)
+			{
+				(new WebhookRunner())->run(GROCY_LABEL_PRINTER_WEBHOOK, $webhookData, GROCY_LABEL_PRINTER_HOOK_JSON);
+			}
+
+			return $this->ApiResponse($response, $webhookData);
+		}
+		catch (\Exception $ex)
+		{
+			return $this->GenericErrorResponse($response, $ex->getMessage());
+		}
+	}
 }

controllers/RecipesController.php

@@ -2,154 +2,38 @@
 
 namespace Grocy\Controllers;
 
-use \Grocy\Services\RecipesService;
+use Grocy\Services\RecipesService;
+use Grocy\Helpers\Grocycode;
+use Psr\Http\Message\ResponseInterface as Response;
+use Psr\Http\Message\ServerRequestInterface as Request;
 
 class RecipesController extends BaseController
 {
-	public function __construct(\DI\Container $container)
+	use GrocycodeTrait;
+
+	public function MealPlan(Request $request, Response $response, array $args)
 	{
-		parent::__construct($container);
-	}
-
-	public function Overview(\Psr\Http\Message\ServerRequestInterface $request, \Psr\Http\Message\ResponseInterface $response, array $args)
-	{
-		$recipes = $this->getDatabase()->recipes()->where('type', RecipesService::RECIPE_TYPE_NORMAL)->orderBy('name');
-		$recipesResolved = $this->getRecipesService()->GetRecipesResolved();
-
-		$selectedRecipe = null;
-		$selectedRecipePositionsResolved = null;
-		if (isset($request->getQueryParams()['recipe']))
+		$start = date('Y-m-d');
+		if (isset($request->getQueryParams()['start']) && IsIsoDate($request->getQueryParams()['start']))
 		{
-			$selectedRecipe = $this->getDatabase()->recipes($request->getQueryParams()['recipe']);
-			$selectedRecipePositionsResolved = $this->getDatabase()->recipes_pos_resolved()->where('recipe_id = :1 AND is_nested_recipe_pos = 0', $request->getQueryParams()['recipe'])->orderBy('ingredient_group', 'ASC', 'product_group', 'ASC');
-		}
-		else
-		{
-			foreach ($recipes as $recipe)
-			{
-				$selectedRecipe = $recipe;
-				$selectedRecipePositionsResolved = $this->getDatabase()->recipes_pos_resolved()->where('recipe_id = :1 AND is_nested_recipe_pos = 0', $recipe->id)->orderBy('ingredient_group', 'ASC', 'product_group', 'ASC');
-				break;
-			}
+			$start = $request->getQueryParams()['start'];
 		}
 
-		if ($selectedRecipe)
+		$days = 6;
+		if (isset($request->getQueryParams()['days']) && filter_var($request->getQueryParams()['days'], FILTER_VALIDATE_INT) !== false)
 		{
-			$selectedRecipeSubRecipes = $this->getDatabase()->recipes()->where('id IN (SELECT includes_recipe_id FROM recipes_nestings_resolved WHERE recipe_id = :1 AND includes_recipe_id != :1)', $selectedRecipe->id)->orderBy('name')->fetchAll();
-			$selectedRecipeSubRecipesPositions = $this->getDatabase()->recipes_pos_resolved()->where('recipe_id = :1', $selectedRecipe->id)->orderBy('ingredient_group', 'ASC', 'product_group', 'ASC')->fetchAll();
-
-			$includedRecipeIdsAbsolute = array();
-			$includedRecipeIdsAbsolute[] = $selectedRecipe->id;
-			foreach($selectedRecipeSubRecipes as $subRecipe)
-			{
-				$includedRecipeIdsAbsolute[] = $subRecipe->id;
-			}
-
-			$renderArray = [
-				'recipes' => $recipes,
-				'recipesResolved' => $recipesResolved,
-				'recipePositionsResolved' => $this->getDatabase()->recipes_pos_resolved()->where('recipe_type', RecipesService::RECIPE_TYPE_NORMAL),
-				'selectedRecipe' => $selectedRecipe,
-				'selectedRecipePositionsResolved' => $selectedRecipePositionsResolved,
-				'products' => $this->getDatabase()->products(),
-				'quantityUnits' => $this->getDatabase()->quantity_units(),
-				'selectedRecipeSubRecipes' => $selectedRecipeSubRecipes,
-				'selectedRecipeSubRecipesPositions' => $selectedRecipeSubRecipesPositions,
-				'includedRecipeIdsAbsolute' => $includedRecipeIdsAbsolute,
-				'selectedRecipeTotalCosts' => FindObjectInArrayByPropertyValue($recipesResolved, 'recipe_id', $selectedRecipe->id)->costs,
-				'selectedRecipeTotalCalories' => FindObjectInArrayByPropertyValue($recipesResolved, 'recipe_id', $selectedRecipe->id)->calories,
-				'userfields' => $this->getUserfieldsService()->GetFields('recipes'),
-				'userfieldValues' => $this->getUserfieldsService()->GetAllValues('recipes'),
-				'quantityUnitConversionsResolved' => $this->getDatabase()->quantity_unit_conversions_resolved()
-			];
-		}
-		else
-		{
-			$renderArray = [
-				'recipes' => $recipes,
-				'recipesResolved' => $recipesResolved,
-				'recipePositionsResolved' => $this->getDatabase()->recipes_pos_resolved()->where('recipe_type', RecipesService::RECIPE_TYPE_NORMAL),
-				'selectedRecipe' => $selectedRecipe,
-				'selectedRecipePositionsResolved' => $selectedRecipePositionsResolved,
-				'products' => $this->getDatabase()->products(),
-				'quantityUnits' => $this->getDatabase()->quantity_units(),
-				'userfields' => $this->getUserfieldsService()->GetFields('recipes'),
-				'userfieldValues' => $this->getUserfieldsService()->GetAllValues('recipes'),
-				'quantityUnitConversionsResolved' => $this->getDatabase()->quantity_unit_conversions_resolved()
-			];
+			$days = $request->getQueryParams()['days'];
 		}
 
-		return $this->renderPage($response, 'recipes', $renderArray);
-	}
+		$mealPlanWhereTimespan = "day BETWEEN DATE('$start', '-$days days') AND DATE('$start', '+$days days')";
 
-	public function RecipeEditForm(\Psr\Http\Message\ServerRequestInterface $request, \Psr\Http\Message\ResponseInterface $response, array $args)
-	{
-		$recipeId = $args['recipeId'];
-		if ($recipeId  == 'new')
-		{
-			$newRecipe = $this->getDatabase()->recipes()->where('type', RecipesService::RECIPE_TYPE_NORMAL)->createRow(array(
-				'name' => $this->getLocalizationService()->__t('New recipe')
-			));
-			$newRecipe->save();
-
-			$recipeId = $this->getDatabase()->lastInsertId();
-		}
-
-		return $this->renderPage($response, 'recipeform', [
-			'recipe' =>  $this->getDatabase()->recipes($recipeId),
-			'recipePositions' =>  $this->getDatabase()->recipes_pos()->where('recipe_id', $recipeId),
-			'mode' => 'edit',
-			'products' => $this->getDatabase()->products()->orderBy('name'),
-			'quantityunits' => $this->getDatabase()->quantity_units(),
-			'recipePositionsResolved' => $this->getRecipesService()->GetRecipesPosResolved(),
-			'recipesResolved' => $this->getRecipesService()->GetRecipesResolved(),
-			'recipes' =>  $this->getDatabase()->recipes()->where('type', RecipesService::RECIPE_TYPE_NORMAL)->orderBy('name'),
-			'recipeNestings' =>  $this->getDatabase()->recipes_nestings()->where('recipe_id', $recipeId),
-			'userfields' => $this->getUserfieldsService()->GetFields('recipes'),
-			'quantityUnitConversionsResolved' => $this->getDatabase()->quantity_unit_conversions_resolved()
-		]);
-	}
-
-	public function RecipePosEditForm(\Psr\Http\Message\ServerRequestInterface $request, \Psr\Http\Message\ResponseInterface $response, array $args)
-	{
-		if ($args['recipePosId'] == 'new')
-		{
-			return $this->renderPage($response, 'recipeposform', [
-				'mode' => 'create',
-				'recipe' => $this->getDatabase()->recipes($args['recipeId']),
-				'recipePos' => new \stdClass(),
-				'products' => $this->getDatabase()->products()->orderBy('name'),
-				'quantityUnits' => $this->getDatabase()->quantity_units()->orderBy('name'),
-				'quantityUnitConversionsResolved' => $this->getDatabase()->quantity_unit_conversions_resolved()
-			]);
-		}
-		else
-		{
-			return $this->renderPage($response, 'recipeposform', [
-				'mode' => 'edit',
-				'recipe' =>  $this->getDatabase()->recipes($args['recipeId']),
-				'recipePos' => $this->getDatabase()->recipes_pos($args['recipePosId']),
-				'products' => $this->getDatabase()->products()->orderBy('name'),
-				'quantityUnits' => $this->getDatabase()->quantity_units()->orderBy('name'),
-				'quantityUnitConversionsResolved' => $this->getDatabase()->quantity_unit_conversions_resolved()
-			]);
-		}
-	}
-
-	public function RecipesSettings(\Psr\Http\Message\ServerRequestInterface $request, \Psr\Http\Message\ResponseInterface $response, array $args)
-	{
-		return $this->renderPage($response, 'recipessettings');
-	}
-
-	public function MealPlan(\Psr\Http\Message\ServerRequestInterface $request, \Psr\Http\Message\ResponseInterface $response, array $args)
-	{
 		$recipes = $this->getDatabase()->recipes()->where('type', RecipesService::RECIPE_TYPE_NORMAL)->fetchAll();
-
-		$events = array();
-		foreach($this->getDatabase()->meal_plan() as $mealPlanEntry)
+		$events = [];
+		foreach ($this->getDatabase()->meal_plan()->where($mealPlanWhereTimespan) as $mealPlanEntry)
 		{
 			$recipe = FindObjectInArrayByPropertyValue($recipes, 'id', $mealPlanEntry['recipe_id']);
 			$title = '';
+
 			if ($recipe !== null)
 			{
 				$title = $recipe->name;
@@ -161,7 +45,7 @@ class RecipesController extends BaseController
 				$productDetails = $this->getStockService()->GetProductDetails($mealPlanEntry['product_id']);
 			}
 
-			$events[] = array(
+			$events[] = [
 				'id' => $mealPlanEntry['id'],
 				'title' => $title,
 				'start' => $mealPlanEntry['day'],
@@ -170,17 +54,185 @@ class RecipesController extends BaseController
 				'mealPlanEntry' => json_encode($mealPlanEntry),
 				'type' => $mealPlanEntry['type'],
 				'productDetails' => json_encode($productDetails)
-			);
+			];
+		}
+
+		$weekRecipe = $this->getDatabase()->recipes()->where("type = 'mealplan-week' AND name = LTRIM(STRFTIME('%Y-%W', DATE('$start')), '0')")->fetch();
+		$weekRecipeId = 0;
+		if ($weekRecipe != null)
+		{
+			$weekRecipeId = $weekRecipe->id;
 		}
 
 		return $this->renderPage($response, 'mealplan', [
 			'fullcalendarEventSources' => $events,
 			'recipes' => $recipes,
-			'internalRecipes' => $this->getDatabase()->recipes()->whereNot('type', RecipesService::RECIPE_TYPE_NORMAL)->fetchAll(),
-			'recipesResolved' => $this->getRecipesService()->GetRecipesResolved(),
-			'products' => $this->getDatabase()->products()->orderBy('name'),
-			'quantityUnits' => $this->getDatabase()->quantity_units()->orderBy('name'),
-			'quantityUnitConversionsResolved' => $this->getDatabase()->quantity_unit_conversions_resolved()
+			'internalRecipes' => $this->getDatabase()->recipes()->where("id IN (SELECT recipe_id FROM meal_plan_internal_recipe_relation WHERE $mealPlanWhereTimespan) OR id = $weekRecipeId")->fetchAll(),
+			'recipesResolved' => $this->getRecipesService()->GetRecipesResolved("recipe_id IN (SELECT recipe_id FROM meal_plan_internal_recipe_relation WHERE $mealPlanWhereTimespan) OR recipe_id = $weekRecipeId"),
+			'products' => $this->getDatabase()->products()->orderBy('name', 'COLLATE NOCASE'),
+			'quantityUnits' => $this->getDatabase()->quantity_units()->orderBy('name', 'COLLATE NOCASE'),
+			'quantityUnitConversionsResolved' => $this->getDatabase()->cache__quantity_unit_conversions_resolved(),
+			'mealplanSections' => $this->getDatabase()->meal_plan_sections()->orderBy('sort_number'),
+			'usedMealplanSections' => $this->getDatabase()->meal_plan_sections()->where("id IN (SELECT section_id FROM meal_plan WHERE $mealPlanWhereTimespan)")->orderBy('sort_number'),
+			'weekRecipe' => $weekRecipe
 		]);
 	}
+
+	public function Overview(Request $request, Response $response, array $args)
+	{
+		$recipes = $this->getDatabase()->recipes()->where('type', RecipesService::RECIPE_TYPE_NORMAL)->orderBy('name', 'COLLATE NOCASE');
+		$recipesResolved = $this->getRecipesService()->GetRecipesResolved('recipe_id > 0');
+
+		$selectedRecipe = null;
+		if (isset($request->getQueryParams()['recipe']))
+		{
+			$selectedRecipe = $this->getDatabase()->recipes($request->getQueryParams()['recipe']);
+		}
+		else
+		{
+			foreach ($recipes as $recipe)
+			{
+				$selectedRecipe = $recipe;
+				break;
+			}
+		}
+
+		$totalCosts = null;
+		$totalCalories = null;
+		if ($selectedRecipe)
+		{
+			$totalCosts = FindObjectInArrayByPropertyValue($recipesResolved, 'recipe_id', $selectedRecipe->id)->costs;
+			$totalCalories = FindObjectInArrayByPropertyValue($recipesResolved, 'recipe_id', $selectedRecipe->id)->calories;
+		}
+
+		$viewData = [
+			'recipes' => $recipes,
+			'recipesResolved' => $recipesResolved,
+			'recipePositionsResolved' => $this->getDatabase()->recipes_pos_resolved()->where('recipe_id', $selectedRecipe->id),
+			'selectedRecipe' => $selectedRecipe,
+			'products' => $this->getDatabase()->products(),
+			'quantityUnits' => $this->getDatabase()->quantity_units(),
+			'userfields' => $this->getUserfieldsService()->GetFields('recipes'),
+			'userfieldValues' => $this->getUserfieldsService()->GetAllValues('recipes'),
+			'quantityUnitConversionsResolved' => $this->getDatabase()->cache__quantity_unit_conversions_resolved(),
+			'selectedRecipeTotalCosts' => $totalCosts,
+			'selectedRecipeTotalCalories' => $totalCalories,
+			'mealplanSections' => $this->getDatabase()->meal_plan_sections()->orderBy('sort_number')
+		];
+
+		if ($selectedRecipe)
+		{
+			$selectedRecipeSubRecipes = $this->getDatabase()->recipes()->where('id IN (SELECT includes_recipe_id FROM recipes_nestings_resolved WHERE recipe_id = :1 AND includes_recipe_id != :1)', $selectedRecipe->id)->orderBy('name', 'COLLATE NOCASE')->fetchAll();
+
+			$includedRecipeIdsAbsolute = [];
+			$includedRecipeIdsAbsolute[] = $selectedRecipe->id;
+			foreach ($selectedRecipeSubRecipes as $subRecipe)
+			{
+				$includedRecipeIdsAbsolute[] = $subRecipe->id;
+			}
+
+			// TODO: Why not directly use recipes_pos_resolved for all recipe positions here (parent and child)?
+			// This view already correctly recolves child recipe amounts...
+			$allRecipePositions = [];
+			foreach ($includedRecipeIdsAbsolute as $id)
+			{
+				$allRecipePositions[$id] = $this->getDatabase()->recipes_pos_resolved()->where('recipe_id = :1 AND is_nested_recipe_pos = 0', $id)->orderBy('ingredient_group', 'ASC', 'product_group', 'ASC');
+				foreach ($allRecipePositions[$id] as $pos)
+				{
+					if ($id != $selectedRecipe->id)
+					{
+						$pos2 = $this->getDatabase()->recipes_pos_resolved()->where('recipe_id = :1  AND recipe_pos_id = :2 AND is_nested_recipe_pos = 1', $selectedRecipe->id, $pos->recipe_pos_id)->fetch();
+						$pos->recipe_amount = $pos2->recipe_amount;
+						$pos->missing_amount = $pos2->missing_amount;
+					}
+				}
+			}
+
+			$viewData['selectedRecipeSubRecipes'] = $selectedRecipeSubRecipes;
+			$viewData['includedRecipeIdsAbsolute'] = $includedRecipeIdsAbsolute;
+			$viewData['allRecipePositions'] = $allRecipePositions;
+		}
+
+		return $this->renderPage($response, 'recipes', $viewData);
+	}
+
+	public function RecipeEditForm(Request $request, Response $response, array $args)
+	{
+		$recipeId = $args['recipeId'];
+
+		return $this->renderPage($response, 'recipeform', [
+			'recipe' => $this->getDatabase()->recipes($recipeId),
+			'recipePositions' => $this->getDatabase()->recipes_pos()->where('recipe_id', $recipeId),
+			'mode' => $recipeId == 'new' ? 'create' : 'edit',
+			'products' => $this->getDatabase()->products()->orderBy('name', 'COLLATE NOCASE'),
+			'quantityunits' => $this->getDatabase()->quantity_units(),
+			'recipes' => $this->getDatabase()->recipes()->where('type', RecipesService::RECIPE_TYPE_NORMAL)->orderBy('name', 'COLLATE NOCASE'),
+			'recipeNestings' => $this->getDatabase()->recipes_nestings()->where('recipe_id', $recipeId),
+			'userfields' => $this->getUserfieldsService()->GetFields('recipes'),
+			'quantityUnitConversionsResolved' => $this->getDatabase()->cache__quantity_unit_conversions_resolved()
+		]);
+	}
+
+	public function RecipePosEditForm(Request $request, Response $response, array $args)
+	{
+		if ($args['recipePosId'] == 'new')
+		{
+			return $this->renderPage($response, 'recipeposform', [
+				'mode' => 'create',
+				'recipe' => $this->getDatabase()->recipes($args['recipeId']),
+				'recipePos' => new \stdClass(),
+				'products' => $this->getDatabase()->products()->where('active = 1')->orderBy('name', 'COLLATE NOCASE'),
+				'barcodes' => $this->getDatabase()->product_barcodes_comma_separated(),
+				'quantityUnits' => $this->getDatabase()->quantity_units()->orderBy('name', 'COLLATE NOCASE'),
+				'quantityUnitConversionsResolved' => $this->getDatabase()->cache__quantity_unit_conversions_resolved()
+			]);
+		}
+		else
+		{
+			return $this->renderPage($response, 'recipeposform', [
+				'mode' => 'edit',
+				'recipe' => $this->getDatabase()->recipes($args['recipeId']),
+				'recipePos' => $this->getDatabase()->recipes_pos($args['recipePosId']),
+				'products' => $this->getDatabase()->products()->orderBy('name', 'COLLATE NOCASE'),
+				'barcodes' => $this->getDatabase()->product_barcodes_comma_separated(),
+				'quantityUnits' => $this->getDatabase()->quantity_units()->orderBy('name', 'COLLATE NOCASE'),
+				'quantityUnitConversionsResolved' => $this->getDatabase()->cache__quantity_unit_conversions_resolved()
+			]);
+		}
+	}
+
+	public function RecipesSettings(Request $request, Response $response, array $args)
+	{
+		return $this->renderPage($response, 'recipessettings');
+	}
+
+	public function MealPlanSectionEditForm(Request $request, Response $response, array $args)
+	{
+		if ($args['sectionId'] == 'new')
+		{
+			return $this->renderPage($response, 'mealplansectionform', [
+				'mode' => 'create'
+			]);
+		}
+		else
+		{
+			return $this->renderPage($response, 'mealplansectionform', [
+				'mealplanSection' => $this->getDatabase()->meal_plan_sections($args['sectionId']),
+				'mode' => 'edit'
+			]);
+		}
+	}
+
+	public function MealPlanSectionsList(Request $request, Response $response, array $args)
+	{
+		return $this->renderPage($response, 'mealplansections', [
+			'mealplanSections' => $this->getDatabase()->meal_plan_sections()->where('id > 0')->orderBy('sort_number')
+		]);
+	}
+
+	public function RecipeGrocycodeImage(Request $request, Response $response, array $args)
+	{
+		$gc = new Grocycode(Grocycode::RECIPE, $args['recipeId']);
+		return $this->ServeGrocycodeImage($request, $response, $gc);
+	}
 }

controllers/StockController.php

@@ -2,212 +2,102 @@
 
 namespace Grocy\Controllers;
 
+use Grocy\Helpers\Grocycode;
+use Grocy\Services\RecipesService;
+use DI\Container;
+use Psr\Http\Message\ResponseInterface as Response;
+use Psr\Http\Message\ServerRequestInterface as Request;
+
 class StockController extends BaseController
 {
+	use GrocycodeTrait;
 
-	public function __construct(\DI\Container $container)
+	public function __construct(Container $container)
 	{
 		parent::__construct($container);
+
+		try
+		{
+			$externalBarcodeLookupPluginName = $this->getStockService()->GetExternalBarcodeLookupPluginName();
+		}
+		catch (\Exception)
+		{
+			$externalBarcodeLookupPluginName = '';
+		}
+		finally
+		{
+			$this->View->set('ExternalBarcodeLookupPluginName', $externalBarcodeLookupPluginName);
+		}
 	}
 
-	public function Overview(\Psr\Http\Message\ServerRequestInterface $request, \Psr\Http\Message\ResponseInterface $response, array $args)
-	{
-		$usersService = $this->getUsersService();
-		$nextXDays = $usersService->GetUserSettings(GROCY_USER_ID)['stock_expring_soon_days'];
-
-		return $this->renderPage($response, 'stockoverview', [
-			'products' => $this->getDatabase()->products()->orderBy('name'),
-			'quantityunits' => $this->getDatabase()->quantity_units()->orderBy('name'),
-			'locations' => $this->getDatabase()->locations()->orderBy('name'),
-			'currentStock' => $this->getStockService()->GetCurrentStock(true),
-			'currentStockLocations' => $this->getStockService()->GetCurrentStockLocations(),
-			'missingProducts' => $this->getStockService()->GetMissingProducts(),
-			'nextXDays' => $nextXDays,
-			'productGroups' => $this->getDatabase()->product_groups()->orderBy('name'),
-			'userfields' => $this->getUserfieldsService()->GetFields('products'),
-			'userfieldValues' => $this->getUserfieldsService()->GetAllValues('products'),
-			'shoppingListItems' => $this->getDatabase()->shopping_list(),
-		]);
-	}
-
-	public function Stockentries(\Psr\Http\Message\ServerRequestInterface $request, \Psr\Http\Message\ResponseInterface $response, array $args)
-	{
-		$usersService = $this->getUsersService();
-		$nextXDays = $usersService->GetUserSettings(GROCY_USER_ID)['stock_expring_soon_days'];
-
-		return $this->renderPage($response, 'stockentries', [
-			'products' => $this->getDatabase()->products()->orderBy('name'),
-			'quantityunits' => $this->getDatabase()->quantity_units()->orderBy('name'),
-			'locations' => $this->getDatabase()->locations()->orderBy('name'),
-			'shoppinglocations' => $this->getDatabase()->shopping_locations()->orderBy('name'),
-			'stockEntries' => $this->getDatabase()->stock()->orderBy('product_id'),
-			'currentStockLocations' => $this->getStockService()->GetCurrentStockLocations(),
-			'nextXDays' => $nextXDays,
-			'userfields' => $this->getUserfieldsService()->GetFields('products'),
-			'userfieldValues' => $this->getUserfieldsService()->GetAllValues('products')
-		]);
-	}
-
-	public function Purchase(\Psr\Http\Message\ServerRequestInterface $request, \Psr\Http\Message\ResponseInterface $response, array $args)
-	{
-		return $this->renderPage($response, 'purchase', [
-			'products' => $this->getDatabase()->products()->orderBy('name'),
-			'shoppinglocations' => $this->getDatabase()->shopping_locations()->orderBy('name'),
-			'locations' => $this->getDatabase()->locations()->orderBy('name')
-		]);
-	}
-
-	public function Consume(\Psr\Http\Message\ServerRequestInterface $request, \Psr\Http\Message\ResponseInterface $response, array $args)
+	public function Consume(Request $request, Response $response, array $args)
 	{
 		return $this->renderPage($response, 'consume', [
-			'products' => $this->getDatabase()->products()->orderBy('name'),
-			'recipes' => $this->getDatabase()->recipes()->orderBy('name'),
-			'locations' => $this->getDatabase()->locations()->orderBy('name')
+			'products' => $this->getDatabase()->products()->where('active = 1')->where('id IN (SELECT product_id from stock_current WHERE amount_aggregated > 0)')->orderBy('name'),
+			'barcodes' => $this->getDatabase()->product_barcodes_comma_separated(),
+			'recipes' => $this->getDatabase()->recipes()->where('type', RecipesService::RECIPE_TYPE_NORMAL)->orderBy('name', 'COLLATE NOCASE'),
+			'locations' => $this->getDatabase()->locations()->orderBy('name', 'COLLATE NOCASE'),
+			'quantityUnits' => $this->getDatabase()->quantity_units()->orderBy('name', 'COLLATE NOCASE'),
+			'quantityUnitConversionsResolved' => $this->getDatabase()->cache__quantity_unit_conversions_resolved()
 		]);
 	}
 
-	public function Transfer(\Psr\Http\Message\ServerRequestInterface $request, \Psr\Http\Message\ResponseInterface $response, array $args)
-	{
-		return $this->renderPage($response, 'transfer', [
-			'products' => $this->getDatabase()->products()->orderBy('name'),
-			'recipes' => $this->getDatabase()->recipes()->orderBy('name'),
-			'locations' => $this->getDatabase()->locations()->orderBy('name')
-		]);
-	}
-
-	public function Inventory(\Psr\Http\Message\ServerRequestInterface $request, \Psr\Http\Message\ResponseInterface $response, array $args)
+	public function Inventory(Request $request, Response $response, array $args)
 	{
 		return $this->renderPage($response, 'inventory', [
-			'products' => $this->getDatabase()->products()->orderBy('name'),
-			'shoppinglocations' => $this->getDatabase()->shopping_locations()->orderBy('name'),
-			'locations' => $this->getDatabase()->locations()->orderBy('name')
+			'products' => $this->getDatabase()->products()->where('active = 1 AND no_own_stock = 0')->orderBy('name', 'COLLATE NOCASE'),
+			'barcodes' => $this->getDatabase()->product_barcodes_comma_separated(),
+			'shoppinglocations' => $this->getDatabase()->shopping_locations()->where('active = 1')->orderBy('name', 'COLLATE NOCASE'),
+			'locations' => $this->getDatabase()->locations()->where('active = 1')->orderBy('name', 'COLLATE NOCASE'),
+			'quantityUnits' => $this->getDatabase()->quantity_units()->orderBy('name', 'COLLATE NOCASE'),
+			'quantityUnitConversionsResolved' => $this->getDatabase()->cache__quantity_unit_conversions_resolved(),
+			'userfields' => $this->getUserfieldsService()->GetFields('stock')
 		]);
 	}
 
-	public function StockEntryEditForm(\Psr\Http\Message\ServerRequestInterface $request, \Psr\Http\Message\ResponseInterface $response, array $args)
+	public function Journal(Request $request, Response $response, array $args)
 	{
-		return $this->renderPage($response, 'stockentryform', [
-			'stockEntry' => $this->getDatabase()->stock()->where('id', $args['entryId'])->fetch(),
-			'products' => $this->getDatabase()->products()->orderBy('name'),
-			'shoppinglocations' => $this->getDatabase()->shopping_locations()->orderBy('name'),
-			'locations' => $this->getDatabase()->locations()->orderBy('name')
-		]);
-	}
-
-	public function ShoppingList(\Psr\Http\Message\ServerRequestInterface $request, \Psr\Http\Message\ResponseInterface $response, array $args)
-	{
-		$listId = 1;
-		if (isset($request->getQueryParams()['list']))
+		if (isset($request->getQueryParams()['months']) && filter_var($request->getQueryParams()['months'], FILTER_VALIDATE_INT) !== false)
 		{
-			$listId = $request->getQueryParams()['list'];
-		}
-
-		return $this->renderPage($response, 'shoppinglist', [
-			'listItems' => $this->getDatabase()->shopping_list()->where('shopping_list_id = :1', $listId),
-			'products' => $this->getDatabase()->products()->orderBy('name'),
-			'quantityunits' => $this->getDatabase()->quantity_units()->orderBy('name'),
-			'missingProducts' => $this->getStockService()->GetMissingProducts(),
-			'productGroups' => $this->getDatabase()->product_groups()->orderBy('name'),
-			'shoppingLists' => $this->getDatabase()->shopping_lists()->orderBy('name'),
-			'selectedShoppingListId' => $listId,
-			'userfields' => $this->getUserfieldsService()->GetFields('products'),
-			'userfieldValues' => $this->getUserfieldsService()->GetAllValues('products')
-		]);
-	}
-
-	public function ProductsList(\Psr\Http\Message\ServerRequestInterface $request, \Psr\Http\Message\ResponseInterface $response, array $args)
-	{
-		return $this->renderPage($response, 'products', [
-			'products' => $this->getDatabase()->products()->orderBy('name'),
-			'locations' => $this->getDatabase()->locations()->orderBy('name'),
-			'quantityunits' => $this->getDatabase()->quantity_units()->orderBy('name'),
-			'productGroups' => $this->getDatabase()->product_groups()->orderBy('name'),
-			'userfields' => $this->getUserfieldsService()->GetFields('products'),
-			'userfieldValues' => $this->getUserfieldsService()->GetAllValues('products')
-		]);
-	}
-
-	public function StockSettings(\Psr\Http\Message\ServerRequestInterface $request, \Psr\Http\Message\ResponseInterface $response, array $args)
-	{
-		return $this->renderPage($response, 'stocksettings', [
-			'locations' => $this->getDatabase()->locations()->orderBy('name'),
-			'quantityunits' => $this->getDatabase()->quantity_units()->orderBy('name'),
-			'productGroups' => $this->getDatabase()->product_groups()->orderBy('name')
-		]);
-	}
-
-	public function LocationsList(\Psr\Http\Message\ServerRequestInterface $request, \Psr\Http\Message\ResponseInterface $response, array $args)
-	{
-		return $this->renderPage($response, 'locations', [
-			'locations' => $this->getDatabase()->locations()->orderBy('name'),
-			'userfields' => $this->getUserfieldsService()->GetFields('locations'),
-			'userfieldValues' => $this->getUserfieldsService()->GetAllValues('locations')
-		]);
-	}
-
-	public function ShoppingLocationsList(\Psr\Http\Message\ServerRequestInterface $request, \Psr\Http\Message\ResponseInterface $response, array $args)
-	{
-		return $this->renderPage($response, 'shoppinglocations', [
-			'shoppinglocations' => $this->getDatabase()->shopping_locations()->orderBy('name'),
-			'userfields' => $this->getUserfieldsService()->GetFields('shopping_locations'),
-			'userfieldValues' => $this->getUserfieldsService()->GetAllValues('shopping_locations')
-		]);
-	}
-
-	public function ProductGroupsList(\Psr\Http\Message\ServerRequestInterface $request, \Psr\Http\Message\ResponseInterface $response, array $args)
-	{
-		return $this->renderPage($response, 'productgroups', [
-			'productGroups' => $this->getDatabase()->product_groups()->orderBy('name'),
-			'products' => $this->getDatabase()->products()->orderBy('name'),
-			'userfields' => $this->getUserfieldsService()->GetFields('product_groups'),
-			'userfieldValues' => $this->getUserfieldsService()->GetAllValues('product_groups')
-		]);
-	}
-
-	public function QuantityUnitsList(\Psr\Http\Message\ServerRequestInterface $request, \Psr\Http\Message\ResponseInterface $response, array $args)
-	{
-		return $this->renderPage($response, 'quantityunits', [
-			'quantityunits' => $this->getDatabase()->quantity_units()->orderBy('name'),
-			'userfields' => $this->getUserfieldsService()->GetFields('quantity_units'),
-			'userfieldValues' => $this->getUserfieldsService()->GetAllValues('quantity_units')
-		]);
-	}
-
-	public function ProductEditForm(\Psr\Http\Message\ServerRequestInterface $request, \Psr\Http\Message\ResponseInterface $response, array $args)
-	{
-		if ($args['productId'] == 'new')
-		{
-			return $this->renderPage($response, 'productform', [
-				'locations' =>  $this->getDatabase()->locations()->orderBy('name'),
-				'quantityunits' =>  $this->getDatabase()->quantity_units()->orderBy('name'),
-				'shoppinglocations' => $this->getDatabase()->shopping_locations()->orderBy('name'),
-				'productgroups' => $this->getDatabase()->product_groups()->orderBy('name'),
-				'userfields' => $this->getUserfieldsService()->GetFields('products'),
-				'products' => $this->getDatabase()->products()->where('parent_product_id IS NULL')->orderBy('name'),
-				'isSubProductOfOthers' => false,
-				'mode' => 'create'
-			]);
+			$months = $request->getQueryParams()['months'];
+			$where = "row_created_timestamp > DATE(DATE('now', 'localtime'), '-$months months')";
 		}
 		else
 		{
-			$product = $this->getDatabase()->products($args['productId']);
-
-			return $this->renderPage($response, 'productform', [
-				'product' =>  $product,
-				'locations' =>  $this->getDatabase()->locations()->orderBy('name'),
-				'quantityunits' =>  $this->getDatabase()->quantity_units()->orderBy('name'),
-				'shoppinglocations' => $this->getDatabase()->shopping_locations()->orderBy('name'),
-				'productgroups' => $this->getDatabase()->product_groups()->orderBy('name'),
-				'userfields' => $this->getUserfieldsService()->GetFields('products'),
-				'products' => $this->getDatabase()->products()->where('id != :1 AND parent_product_id IS NULL', $product->id)->orderBy('name'),
-				'isSubProductOfOthers' => $this->getDatabase()->products()->where('parent_product_id = :1', $product->id)->count() !== 0,
-				'mode' => 'edit',
-				'quConversions' => $this->getDatabase()->quantity_unit_conversions()
-			]);
+			// Default 6 months
+			$where = "row_created_timestamp > DATE(DATE('now', 'localtime'), '-6 months')";
 		}
+
+		if (isset($request->getQueryParams()['product']) && filter_var($request->getQueryParams()['product'], FILTER_VALIDATE_INT) !== false)
+		{
+			$productId = $request->getQueryParams()['product'];
+			$where .= " AND product_id = $productId";
+		}
+
+		$usersService = $this->getUsersService();
+
+		return $this->renderPage($response, 'stockjournal', [
+			'stockLog' => $this->getDatabase()->uihelper_stock_journal()->where($where)->orderBy('row_created_timestamp', 'DESC'),
+			'products' => $this->getDatabase()->products()->where('active = 1')->orderBy('name', 'COLLATE NOCASE'),
+			'locations' => $this->getDatabase()->locations()->orderBy('name', 'COLLATE NOCASE'),
+			'users' => $usersService->GetUsersAsDto(),
+			'transactionTypes' => GetClassConstants('\Grocy\Services\StockService', 'TRANSACTION_TYPE_'),
+			'userfieldsStock' => $this->getUserfieldsService()->GetFields('stock'),
+			'userfieldValuesStock' => $this->getUserfieldsService()->GetAllValues('stock')
+		]);
 	}
 
-	public function LocationEditForm(\Psr\Http\Message\ServerRequestInterface $request, \Psr\Http\Message\ResponseInterface $response, array $args)
+	public function LocationContentSheet(Request $request, Response $response, array $args)
+	{
+		return $this->renderPage($response, 'locationcontentsheet', [
+			'products' => $this->getDatabase()->products()->where('active = 1')->orderBy('name', 'COLLATE NOCASE'),
+			'quantityunits' => $this->getDatabase()->quantity_units()->orderBy('name', 'COLLATE NOCASE'),
+			'locations' => $this->getDatabase()->locations()->orderBy('name', 'COLLATE NOCASE'),
+			'currentStockLocationContent' => $this->getStockService()->GetCurrentStockLocationContent(isset($request->getQueryParams()['include_out_of_stock']))
+		]);
+	}
+
+	public function LocationEditForm(Request $request, Response $response, array $args)
 	{
 		if ($args['locationId'] == 'new')
 		{
@@ -219,33 +109,137 @@ class StockController extends BaseController
 		else
 		{
 			return $this->renderPage($response, 'locationform', [
-				'location' =>  $this->getDatabase()->locations($args['locationId']),
+				'location' => $this->getDatabase()->locations($args['locationId']),
 				'mode' => 'edit',
 				'userfields' => $this->getUserfieldsService()->GetFields('locations')
 			]);
 		}
 	}
 
-	public function ShoppingLocationEditForm(\Psr\Http\Message\ServerRequestInterface $request, \Psr\Http\Message\ResponseInterface $response, array $args)
+	public function LocationsList(Request $request, Response $response, array $args)
 	{
-		if ($args['shoppingLocationId'] == 'new')
+		if (isset($request->getQueryParams()['include_disabled']))
 		{
-			return $this->renderPage($response, 'shoppinglocationform', [
+			$locations = $this->getDatabase()->locations()->orderBy('name', 'COLLATE NOCASE');
+		}
+		else
+		{
+			$locations = $this->getDatabase()->locations()->where('active = 1')->orderBy('name', 'COLLATE NOCASE');
+		}
+
+		return $this->renderPage($response, 'locations', [
+			'locations' => $locations,
+			'userfields' => $this->getUserfieldsService()->GetFields('locations'),
+			'userfieldValues' => $this->getUserfieldsService()->GetAllValues('locations')
+		]);
+	}
+
+	public function Overview(Request $request, Response $response, array $args)
+	{
+		$usersService = $this->getUsersService();
+		$userSettings = $usersService->GetUserSettings(GROCY_USER_ID);
+		$nextXDays = $userSettings['stock_due_soon_days'];
+
+		$where = 'is_in_stock_or_below_min_stock = 1';
+		if (boolval($userSettings['stock_overview_show_all_out_of_stock_products']))
+		{
+			$where = '1=1';
+		}
+
+		return $this->renderPage($response, 'stockoverview', [
+			'currentStock' => $this->getDatabase()->uihelper_stock_current_overview()->where($where),
+			'locations' => $this->getDatabase()->locations()->where('active = 1')->orderBy('name', 'COLLATE NOCASE'),
+			'currentStockLocations' => $this->getStockService()->GetCurrentStockLocations(),
+			'nextXDays' => $nextXDays,
+			'productGroups' => $this->getDatabase()->product_groups()->where('active = 1')->orderBy('name', 'COLLATE NOCASE'),
+			'userfields' => $this->getUserfieldsService()->GetFields('products'),
+			'userfieldValues' => $this->getUserfieldsService()->GetAllValues('products')
+		]);
+	}
+
+	public function ProductBarcodesEditForm(Request $request, Response $response, array $args)
+	{
+		$product = null;
+		if (isset($request->getQueryParams()['product']))
+		{
+			$product = $this->getDatabase()->products($request->getQueryParams()['product']);
+		}
+
+		if ($args['productBarcodeId'] == 'new')
+		{
+			return $this->renderPage($response, 'productbarcodeform', [
 				'mode' => 'create',
-				'userfields' => $this->getUserfieldsService()->GetFields('shopping_locations')
+				'barcodes' => $this->getDatabase()->product_barcodes()->orderBy('barcode'),
+				'product' => $product,
+				'shoppinglocations' => $this->getDatabase()->shopping_locations()->where('active = 1')->orderBy('name', 'COLLATE NOCASE'),
+				'quantityUnits' => $this->getDatabase()->quantity_units()->orderBy('name', 'COLLATE NOCASE'),
+				'quantityUnitConversionsResolved' => $this->getDatabase()->cache__quantity_unit_conversions_resolved(),
+				'userfields' => $this->getUserfieldsService()->GetFields('product_barcodes')
 			]);
 		}
 		else
 		{
-			return $this->renderPage($response, 'shoppinglocationform', [
-				'shoppinglocation' =>  $this->getDatabase()->shopping_locations($args['shoppingLocationId']),
+			return $this->renderPage($response, 'productbarcodeform', [
 				'mode' => 'edit',
-				'userfields' => $this->getUserfieldsService()->GetFields('shopping_locations')
+				'barcode' => $this->getDatabase()->product_barcodes($args['productBarcodeId']),
+				'product' => $product,
+				'shoppinglocations' => $this->getDatabase()->shopping_locations()->where('active = 1')->orderBy('name', 'COLLATE NOCASE'),
+				'quantityUnits' => $this->getDatabase()->quantity_units()->orderBy('name', 'COLLATE NOCASE'),
+				'quantityUnitConversionsResolved' => $this->getDatabase()->cache__quantity_unit_conversions_resolved(),
+				'userfields' => $this->getUserfieldsService()->GetFields('product_barcodes')
 			]);
 		}
 	}
 
-	public function ProductGroupEditForm(\Psr\Http\Message\ServerRequestInterface $request, \Psr\Http\Message\ResponseInterface $response, array $args)
+	public function ProductEditForm(Request $request, Response $response, array $args)
+	{
+		if ($args['productId'] == 'new')
+		{
+			$quantityunits = $this->getDatabase()->quantity_units()->where('active = 1')->orderBy('name', 'COLLATE NOCASE');
+
+			return $this->renderPage($response, 'productform', [
+				'locations' => $this->getDatabase()->locations()->where('active = 1')->orderBy('name'),
+				'barcodes' => $this->getDatabase()->product_barcodes()->orderBy('barcode'),
+				'quantityunitsAll' => $quantityunits,
+				'quantityunitsReferenced' => $quantityunits,
+				'shoppinglocations' => $this->getDatabase()->shopping_locations()->where('active = 1')->orderBy('name', 'COLLATE NOCASE'),
+				'productgroups' => $this->getDatabase()->product_groups()->where('active = 1')->orderBy('name', 'COLLATE NOCASE'),
+				'userfields' => $this->getUserfieldsService()->GetFields('products'),
+				'products' => $this->getDatabase()->products()->where('parent_product_id IS NULL and active = 1')->orderBy('name', 'COLLATE NOCASE'),
+				'isSubProductOfOthers' => false,
+				'mode' => 'create'
+			]);
+		}
+		else
+		{
+			$product = $this->getDatabase()->products($args['productId']);
+
+			return $this->renderPage($response, 'productform', [
+				'product' => $product,
+				'locations' => $this->getDatabase()->locations()->where('active = 1')->orderBy('name', 'COLLATE NOCASE'),
+				'barcodes' => $this->getDatabase()->product_barcodes()->orderBy('barcode'),
+				'quantityunitsAll' => $this->getDatabase()->quantity_units()->where('active = 1')->orderBy('name', 'COLLATE NOCASE'),
+				'quantityunitsReferenced' => $this->getDatabase()->quantity_units()->where('id IN (SELECT to_qu_id FROM cache__quantity_unit_conversions_resolved WHERE product_id = :1) OR NOT EXISTS(SELECT 1 FROM stock_log WHERE product_id = :1)', $product->id)->orderBy('name', 'COLLATE NOCASE'),
+				'shoppinglocations' => $this->getDatabase()->shopping_locations()->where('active = 1')->orderBy('name', 'COLLATE NOCASE'),
+				'productgroups' => $this->getDatabase()->product_groups()->where('active = 1')->orderBy('name', 'COLLATE NOCASE'),
+				'userfields' => $this->getUserfieldsService()->GetFields('products'),
+				'products' => $this->getDatabase()->products()->where('id != :1 AND parent_product_id IS NULL and active = 1', $product->id)->orderBy('name', 'COLLATE NOCASE'),
+				'isSubProductOfOthers' => $this->getDatabase()->products()->where('parent_product_id = :1', $product->id)->count() !== 0,
+				'mode' => 'edit',
+				'quConversions' => $this->getDatabase()->quantity_unit_conversions()->where('product_id', $product->id),
+				'productBarcodeUserfields' => $this->getUserfieldsService()->GetFields('product_barcodes'),
+				'productBarcodeUserfieldValues' => $this->getUserfieldsService()->GetAllValues('product_barcodes')
+			]);
+		}
+	}
+
+	public function ProductGrocycodeImage(Request $request, Response $response, array $args)
+	{
+		$gc = new Grocycode(Grocycode::PRODUCT, $args['productId']);
+		return $this->ServeGrocycodeImage($request, $response, $gc);
+	}
+
+	public function ProductGroupEditForm(Request $request, Response $response, array $args)
 	{
 		if ($args['productGroupId'] == 'new')
 		{
@@ -257,14 +251,114 @@ class StockController extends BaseController
 		else
 		{
 			return $this->renderPage($response, 'productgroupform', [
-				'group' =>  $this->getDatabase()->product_groups($args['productGroupId']),
+				'group' => $this->getDatabase()->product_groups($args['productGroupId']),
 				'mode' => 'edit',
 				'userfields' => $this->getUserfieldsService()->GetFields('product_groups')
 			]);
 		}
 	}
 
-	public function QuantityUnitEditForm(\Psr\Http\Message\ServerRequestInterface $request, \Psr\Http\Message\ResponseInterface $response, array $args)
+	public function ProductGroupsList(Request $request, Response $response, array $args)
+	{
+		if (isset($request->getQueryParams()['include_disabled']))
+		{
+			$productGroups = $this->getDatabase()->product_groups()->orderBy('name', 'COLLATE NOCASE');
+		}
+		else
+		{
+			$productGroups = $this->getDatabase()->product_groups()->where('active = 1')->orderBy('name', 'COLLATE NOCASE');
+		}
+
+		return $this->renderPage($response, 'productgroups', [
+			'productGroups' => $productGroups,
+			'products' => $this->getDatabase()->products()->where('active = 1')->orderBy('name', 'COLLATE NOCASE'),
+			'userfields' => $this->getUserfieldsService()->GetFields('product_groups'),
+			'userfieldValues' => $this->getUserfieldsService()->GetAllValues('product_groups')
+		]);
+	}
+
+	public function ProductsList(Request $request, Response $response, array $args)
+	{
+		$products = $this->getDatabase()->products();
+		if (!isset($request->getQueryParams()['include_disabled']))
+		{
+			$products = $products->where('active = 1');
+		}
+
+		if (isset($request->getQueryParams()['only_in_stock']))
+		{
+			$products = $products->where('id IN (SELECT product_id from stock_current WHERE amount_aggregated > 0)');
+		}
+		if (isset($request->getQueryParams()['only_out_of_stock']))
+		{
+			$products = $products->where('id NOT IN (SELECT product_id from stock_current WHERE amount_aggregated > 0)');
+		}
+
+		$products = $products->orderBy('name', 'COLLATE NOCASE');
+
+		return $this->renderPage($response, 'products', [
+			'products' => $products,
+			'locations' => $this->getDatabase()->locations()->orderBy('name', 'COLLATE NOCASE'),
+			'quantityunits' => $this->getDatabase()->quantity_units()->orderBy('name', 'COLLATE NOCASE'),
+			'productGroups' => $this->getDatabase()->product_groups()->where('active = 1')->orderBy('name', 'COLLATE NOCASE'),
+			'shoppingLocations' => $this->getDatabase()->shopping_locations()->orderBy('name', 'COLLATE NOCASE'),
+			'userfields' => $this->getUserfieldsService()->GetFields('products'),
+			'userfieldValues' => $this->getUserfieldsService()->GetAllValues('products')
+		]);
+	}
+
+	public function Purchase(Request $request, Response $response, array $args)
+	{
+		return $this->renderPage($response, 'purchase', [
+			'products' => $this->getDatabase()->products()->where('active = 1 AND no_own_stock = 0')->orderBy('name', 'COLLATE NOCASE'),
+			'barcodes' => $this->getDatabase()->product_barcodes_comma_separated(),
+			'shoppinglocations' => $this->getDatabase()->shopping_locations()->where('active = 1')->orderBy('name', 'COLLATE NOCASE'),
+			'locations' => $this->getDatabase()->locations()->where('active = 1')->orderBy('name', 'COLLATE NOCASE'),
+			'quantityUnits' => $this->getDatabase()->quantity_units()->where('active = 1')->orderBy('name', 'COLLATE NOCASE'),
+			'quantityUnitConversionsResolved' => $this->getDatabase()->cache__quantity_unit_conversions_resolved(),
+			'userfields' => $this->getUserfieldsService()->GetFields('stock')
+		]);
+	}
+
+	public function QuantityUnitConversionEditForm(Request $request, Response $response, array $args)
+	{
+		$product = null;
+		if (isset($request->getQueryParams()['product']))
+		{
+			$product = $this->getDatabase()->products($request->getQueryParams()['product']);
+		}
+
+		$defaultQuUnit = null;
+
+		if (isset($request->getQueryParams()['qu-unit']))
+		{
+			$defaultQuUnit = $this->getDatabase()->quantity_units($request->getQueryParams()['qu-unit']);
+		}
+
+		if ($args['quConversionId'] == 'new')
+		{
+			return $this->renderPage($response, 'quantityunitconversionform', [
+				'mode' => 'create',
+				'userfields' => $this->getUserfieldsService()->GetFields('quantity_unit_conversions'),
+				'quantityunits' => $this->getDatabase()->quantity_units()->where('active = 1')->orderBy('name', 'COLLATE NOCASE'),
+				'product' => $product,
+				'defaultQuUnit' => $defaultQuUnit
+			]);
+		}
+		else
+		{
+			return $this->renderPage($response, 'quantityunitconversionform', [
+				'quConversion' => $this->getDatabase()->quantity_unit_conversions($args['quConversionId']),
+				'mode' => 'edit',
+				'userfields' => $this->getUserfieldsService()->GetFields('quantity_unit_conversions'),
+				'quantityunits' => $this->getDatabase()->quantity_units()->where('active = 1')->orderBy('name', 'COLLATE NOCASE'),
+				'product' => $product,
+				'defaultQuUnit' => $defaultQuUnit
+			]);
+		}
+	}
+
+	public function QuantityUnitEditForm(Request $request, Response $response, array $args)
 	{
 		if ($args['quantityunitId'] == 'new')
 		{
@@ -280,7 +374,7 @@ class StockController extends BaseController
 			$quantityUnit = $this->getDatabase()->quantity_units($args['quantityunitId']);
 
 			return $this->renderPage($response, 'quantityunitform', [
-				'quantityUnit' =>  $quantityUnit,
+				'quantityUnit' => $quantityUnit,
 				'mode' => 'edit',
 				'userfields' => $this->getUserfieldsService()->GetFields('quantity_units'),
 				'pluralCount' => $this->getLocalizationService()->GetPluralCount(),
@@ -291,110 +385,257 @@ class StockController extends BaseController
 		}
 	}
 
-	public function ShoppingListItemEditForm(\Psr\Http\Message\ServerRequestInterface $request, \Psr\Http\Message\ResponseInterface $response, array $args)
+	public function QuantityUnitPluralFormTesting(Request $request, Response $response, array $args)
 	{
-		if ($args['itemId'] == 'new')
+		return $this->renderPage($response, 'quantityunitpluraltesting', [
+			'quantityUnits' => $this->getDatabase()->quantity_units()->where('active = 1')->orderBy('name', 'COLLATE NOCASE')
+		]);
+	}
+
+	public function QuantityUnitsList(Request $request, Response $response, array $args)
+	{
+		if (isset($request->getQueryParams()['include_disabled']))
 		{
-			return $this->renderPage($response, 'shoppinglistitemform', [
-				'products' =>  $this->getDatabase()->products()->orderBy('name'),
-				'shoppingLists' => $this->getDatabase()->shopping_lists()->orderBy('name'),
-				'mode' => 'create'
-			]);
+			$quantityUnits = $this->getDatabase()->quantity_units()->orderBy('name', 'COLLATE NOCASE');
 		}
 		else
 		{
-			return $this->renderPage($response, 'shoppinglistitemform', [
-				'listItem' =>  $this->getDatabase()->shopping_list($args['itemId']),
-				'products' =>  $this->getDatabase()->products()->orderBy('name'),
-				'shoppingLists' => $this->getDatabase()->shopping_lists()->orderBy('name'),
-				'mode' => 'edit'
-			]);
+			$quantityUnits = $this->getDatabase()->quantity_units()->where('active = 1')->orderBy('name', 'COLLATE NOCASE');
 		}
+
+		return $this->renderPage($response, 'quantityunits', [
+			'quantityunits' => $quantityUnits,
+			'userfields' => $this->getUserfieldsService()->GetFields('quantity_units'),
+			'userfieldValues' => $this->getUserfieldsService()->GetAllValues('quantity_units')
+		]);
 	}
 
-	public function ShoppingListEditForm(\Psr\Http\Message\ServerRequestInterface $request, \Psr\Http\Message\ResponseInterface $response, array $args)
+	public function ShoppingList(Request $request, Response $response, array $args)
+	{
+		$listId = 1;
+		if (isset($request->getQueryParams()['list']))
+		{
+			$listId = $request->getQueryParams()['list'];
+		}
+
+		return $this->renderPage($response, 'shoppinglist', [
+			'listItems' => $this->getDatabase()->uihelper_shopping_list()->where('shopping_list_id = :1', $listId)->orderBy('product_name', 'COLLATE NOCASE'),
+			'products' => $this->getDatabase()->products()->where('active = 1')->orderBy('name', 'COLLATE NOCASE'),
+			'quantityunits' => $this->getDatabase()->quantity_units()->orderBy('name', 'COLLATE NOCASE'),
+			'missingProducts' => $this->getStockService()->GetMissingProducts(),
+			'shoppingLists' => $this->getDatabase()->shopping_lists_view()->orderBy('name', 'COLLATE NOCASE'),
+			'selectedShoppingListId' => $listId,
+			'quantityUnitConversionsResolved' => $this->getDatabase()->cache__quantity_unit_conversions_resolved(),
+			'productUserfields' => $this->getUserfieldsService()->GetFields('products'),
+			'productUserfieldValues' => $this->getUserfieldsService()->GetAllValues('products'),
+			'productGroupUserfields' => $this->getUserfieldsService()->GetFields('product_groups'),
+			'productGroupUserfieldValues' => $this->getUserfieldsService()->GetAllValues('product_groups'),
+			'userfields' => $this->getUserfieldsService()->GetFields('shopping_list'),
+			'userfieldValues' => $this->getUserfieldsService()->GetAllValues('shopping_list')
+		]);
+	}
+
+	public function ShoppingListEditForm(Request $request, Response $response, array $args)
 	{
 		if ($args['listId'] == 'new')
 		{
 			return $this->renderPage($response, 'shoppinglistform', [
-				'mode' => 'create'
+				'mode' => 'create',
+				'userfields' => $this->getUserfieldsService()->GetFields('shopping_lists')
 			]);
 		}
 		else
 		{
 			return $this->renderPage($response, 'shoppinglistform', [
-				'shoppingList' =>  $this->getDatabase()->shopping_lists($args['listId']),
-				'mode' => 'edit'
+				'shoppingList' => $this->getDatabase()->shopping_lists($args['listId']),
+				'mode' => 'edit',
+				'userfields' => $this->getUserfieldsService()->GetFields('shopping_lists')
 			]);
 		}
 	}
 
-	public function ShoppingListSettings(\Psr\Http\Message\ServerRequestInterface $request, \Psr\Http\Message\ResponseInterface $response, array $args)
+	public function ShoppingListItemEditForm(Request $request, Response $response, array $args)
 	{
-		return $this->renderPage($response, 'shoppinglistsettings');
+		if ($args['itemId'] == 'new')
+		{
+			return $this->renderPage($response, 'shoppinglistitemform', [
+				'products' => $this->getDatabase()->products()->where('active = 1')->orderBy('name', 'COLLATE NOCASE'),
+				'barcodes' => $this->getDatabase()->product_barcodes_comma_separated(),
+				'shoppingLists' => $this->getDatabase()->shopping_lists()->orderBy('name', 'COLLATE NOCASE'),
+				'mode' => 'create',
+				'quantityUnits' => $this->getDatabase()->quantity_units()->where('active = 1')->orderBy('name', 'COLLATE NOCASE'),
+				'quantityUnitConversionsResolved' => $this->getDatabase()->cache__quantity_unit_conversions_resolved(),
+				'userfields' => $this->getUserfieldsService()->GetFields('shopping_list')
+			]);
+		}
+		else
+		{
+			return $this->renderPage($response, 'shoppinglistitemform', [
+				'listItem' => $this->getDatabase()->shopping_list($args['itemId']),
+				'products' => $this->getDatabase()->products()->where('active = 1')->orderBy('name', 'COLLATE NOCASE'),
+				'barcodes' => $this->getDatabase()->product_barcodes_comma_separated(),
+				'shoppingLists' => $this->getDatabase()->shopping_lists()->orderBy('name', 'COLLATE NOCASE'),
+				'mode' => 'edit',
+				'quantityUnits' => $this->getDatabase()->quantity_units()->where('active = 1')->orderBy('name', 'COLLATE NOCASE'),
+				'quantityUnitConversionsResolved' => $this->getDatabase()->cache__quantity_unit_conversions_resolved(),
+				'userfields' => $this->getUserfieldsService()->GetFields('shopping_list')
+			]);
+		}
 	}
 
-	public function Journal(\Psr\Http\Message\ServerRequestInterface $request, \Psr\Http\Message\ResponseInterface $response, array $args)
+	public function ShoppingListSettings(Request $request, Response $response, array $args)
 	{
-		return $this->renderPage($response, 'stockjournal', [
-			'stockLog' => $this->getDatabase()->stock_log()->orderBy('row_created_timestamp', 'DESC'),
-			'locations' => $this->getDatabase()->locations()->orderBy('name'),
-			'products' => $this->getDatabase()->products()->orderBy('name'),
-			'quantityunits' => $this->getDatabase()->quantity_units()->orderBy('name')
+		return $this->renderPage($response, 'shoppinglistsettings', [
+			'shoppingLists' => $this->getDatabase()->shopping_lists()->orderBy('name', 'COLLATE NOCASE')
 		]);
 	}
 
-	public function LocationContentSheet(\Psr\Http\Message\ServerRequestInterface $request, \Psr\Http\Message\ResponseInterface $response, array $args)
+	public function ShoppingLocationEditForm(Request $request, Response $response, array $args)
 	{
-		return $this->renderPage($response, 'locationcontentsheet', [
-			'products' => $this->getDatabase()->products()->orderBy('name'),
-			'quantityunits' => $this->getDatabase()->quantity_units()->orderBy('name'),
-			'locations' => $this->getDatabase()->locations()->orderBy('name'),
-			'currentStockLocationContent' => $this->getStockService()->GetCurrentStockLocationContent()
+		if ($args['shoppingLocationId'] == 'new')
+		{
+			return $this->renderPage($response, 'shoppinglocationform', [
+				'mode' => 'create',
+				'userfields' => $this->getUserfieldsService()->GetFields('shopping_locations')
+			]);
+		}
+		else
+		{
+			return $this->renderPage($response, 'shoppinglocationform', [
+				'shoppingLocation' => $this->getDatabase()->shopping_locations($args['shoppingLocationId']),
+				'mode' => 'edit',
+				'userfields' => $this->getUserfieldsService()->GetFields('shopping_locations')
+			]);
+		}
+	}
+
+	public function ShoppingLocationsList(Request $request, Response $response, array $args)
+	{
+		if (isset($request->getQueryParams()['include_disabled']))
+		{
+			$shoppingLocations = $this->getDatabase()->shopping_locations()->orderBy('name', 'COLLATE NOCASE');
+		}
+		else
+		{
+			$shoppingLocations = $this->getDatabase()->shopping_locations()->where('active = 1')->orderBy('name', 'COLLATE NOCASE');
+		}
+
+		return $this->renderPage($response, 'shoppinglocations', [
+			'shoppinglocations' => $shoppingLocations,
+			'userfields' => $this->getUserfieldsService()->GetFields('shopping_locations'),
+			'userfieldValues' => $this->getUserfieldsService()->GetAllValues('shopping_locations')
 		]);
 	}
 
-	public function QuantityUnitConversionEditForm(\Psr\Http\Message\ServerRequestInterface $request, \Psr\Http\Message\ResponseInterface $response, array $args)
+	public function StockEntryEditForm(Request $request, Response $response, array $args)
+	{
+		return $this->renderPage($response, 'stockentryform', [
+			'stockEntry' => $this->getDatabase()->stock()->where('id', $args['entryId'])->fetch(),
+			'products' => $this->getDatabase()->products()->where('active = 1')->orderBy('name', 'COLLATE NOCASE'),
+			'shoppinglocations' => $this->getDatabase()->shopping_locations()->where('active = 1')->orderBy('name', 'COLLATE NOCASE'),
+			'locations' => $this->getDatabase()->locations()->where('active = 1')->orderBy('name', 'COLLATE NOCASE'),
+			'userfields' => $this->getUserfieldsService()->GetFields('stock')
+		]);
+	}
+
+	public function StockEntryGrocycodeImage(Request $request, Response $response, array $args)
+	{
+		$stockEntry = $this->getDatabase()->stock()->where('id', $args['entryId'])->fetch();
+		$gc = new Grocycode(Grocycode::PRODUCT, $stockEntry->product_id, [$stockEntry->stock_id]);
+		return $this->ServeGrocycodeImage($request, $response, $gc);
+	}
+
+	public function StockEntryGrocycodeLabel(Request $request, Response $response, array $args)
+	{
+		$stockEntry = $this->getDatabase()->stock()->where('id', $args['entryId'])->fetch();
+		return $this->renderPage($response, 'stockentrylabel', [
+			'stockEntry' => $stockEntry,
+			'product' => $this->getDatabase()->products($stockEntry->product_id),
+		]);
+	}
+
+	public function StockSettings(Request $request, Response $response, array $args)
+	{
+		return $this->renderPage($response, 'stocksettings', [
+			'locations' => $this->getDatabase()->locations()->where('active = 1')->orderBy('name', 'COLLATE NOCASE'),
+			'quantityunits' => $this->getDatabase()->quantity_units()->where('active = 1')->orderBy('name', 'COLLATE NOCASE'),
+			'productGroups' => $this->getDatabase()->product_groups()->where('active = 1')->orderBy('name', 'COLLATE NOCASE')
+		]);
+	}
+
+	public function Stockentries(Request $request, Response $response, array $args)
+	{
+		$usersService = $this->getUsersService();
+		$nextXDays = $usersService->GetUserSettings(GROCY_USER_ID)['stock_due_soon_days'];
+
+		return $this->renderPage($response, 'stockentries', [
+			'products' => $this->getDatabase()->products()->where('active = 1')->orderBy('name', 'COLLATE NOCASE'),
+			'quantityunits' => $this->getDatabase()->quantity_units()->where('active = 1')->orderBy('name', 'COLLATE NOCASE'),
+			'locations' => $this->getDatabase()->locations()->where('active = 1')->orderBy('name', 'COLLATE NOCASE'),
+			'shoppinglocations' => $this->getDatabase()->shopping_locations()->where('active = 1')->orderBy('name', 'COLLATE NOCASE'),
+			'stockEntries' => $this->getDatabase()->uihelper_stock_entries()->orderBy('product_id'),
+			'currentStockLocations' => $this->getStockService()->GetCurrentStockLocations(),
+			'nextXDays' => $nextXDays,
+			'userfieldsProducts' => $this->getUserfieldsService()->GetFields('products'),
+			'userfieldValuesProducts' => $this->getUserfieldsService()->GetAllValues('products'),
+			'userfieldsStock' => $this->getUserfieldsService()->GetFields('stock'),
+			'userfieldValuesStock' => $this->getUserfieldsService()->GetAllValues('stock')
+		]);
+	}
+
+	public function Transfer(Request $request, Response $response, array $args)
+	{
+		return $this->renderPage($response, 'transfer', [
+			'products' => $this->getDatabase()->products()->where('active = 1')->where('no_own_stock = 0 AND id IN (SELECT product_id from stock_current WHERE amount_aggregated > 0)')->orderBy('name', 'COLLATE NOCASE'),
+			'barcodes' => $this->getDatabase()->product_barcodes_comma_separated(),
+			'locations' => $this->getDatabase()->locations()->where('active = 1')->orderBy('name', 'COLLATE NOCASE'),
+			'quantityUnits' => $this->getDatabase()->quantity_units()->where('active = 1')->orderBy('name', 'COLLATE NOCASE'),
+			'quantityUnitConversionsResolved' => $this->getDatabase()->cache__quantity_unit_conversions_resolved()
+		]);
+	}
+
+	public function JournalSummary(Request $request, Response $response, array $args)
+	{
+		$entries = $this->getDatabase()->uihelper_stock_journal_summary();
+		if (isset($request->getQueryParams()['product_id']))
+		{
+			$entries = $entries->where('product_id', $request->getQueryParams()['product_id']);
+		}
+		if (isset($request->getQueryParams()['user_id']))
+		{
+			$entries = $entries->where('user_id', $request->getQueryParams()['user_id']);
+		}
+		if (isset($request->getQueryParams()['transaction_type']))
+		{
+			$entries = $entries->where('transaction_type', $request->getQueryParams()['transaction_type']);
+		}
+
+		$usersService = $this->getUsersService();
+		return $this->renderPage($response, 'stockjournalsummary', [
+			'entries' => $entries,
+			'products' => $this->getDatabase()->products()->where('active = 1')->orderBy('name', 'COLLATE NOCASE'),
+			'users' => $usersService->GetUsersAsDto(),
+			'transactionTypes' => GetClassConstants('\Grocy\Services\StockService', 'TRANSACTION_TYPE_')
+		]);
+	}
+
+	public function QuantityUnitConversionsResolved(Request $request, Response $response, array $args)
 	{
 		$product = null;
 		if (isset($request->getQueryParams()['product']))
 		{
 			$product = $this->getDatabase()->products($request->getQueryParams()['product']);
-		}
-
-		$defaultQuUnit = null;
-		if (isset($request->getQueryParams()['qu-unit']))
-		{
-			$defaultQuUnit = $this->getDatabase()->quantity_units($request->getQueryParams()['qu-unit']);
-		}
-
-		if ($args['quConversionId'] == 'new')
-		{
-			return $this->renderPage($response, 'quantityunitconversionform', [
-				'mode' => 'create',
-				'userfields' => $this->getUserfieldsService()->GetFields('quantity_unit_conversions'),
-				'quantityunits' => $this->getDatabase()->quantity_units()->orderBy('name'),
-				'product' => $product,
-				'defaultQuUnit' => $defaultQuUnit
-			]);
+			$quantityUnitConversionsResolved = $this->getDatabase()->cache__quantity_unit_conversions_resolved()->where('product_id', $product->id);
 		}
 		else
 		{
-			return $this->renderPage($response, 'quantityunitconversionform', [
-				'quConversion' =>  $this->getDatabase()->quantity_unit_conversions($args['quConversionId']),
-				'mode' => 'edit',
-				'userfields' => $this->getUserfieldsService()->GetFields('quantity_unit_conversions'),
-				'quantityunits' => $this->getDatabase()->quantity_units()->orderBy('name'),
-				'product' => $product,
-				'defaultQuUnit' => $defaultQuUnit
-			]);
+			$quantityUnitConversionsResolved = $this->getDatabase()->cache__quantity_unit_conversions_resolved()->where('product_id IS NULL');
 		}
-	}
 
-	public function QuantityUnitPluralFormTesting(\Psr\Http\Message\ServerRequestInterface $request, \Psr\Http\Message\ResponseInterface $response, array $args)
-	{
-		return $this->renderPage($response, 'quantityunitpluraltesting', [
-			'quantityUnits' => $this->getDatabase()->quantity_units()->orderBy('name')
+		return $this->renderPage($response, 'quantityunitconversionsresolved', [
+			'product' => $product,
+			'quantityUnits' => $this->getDatabase()->quantity_units()->where('active = 1')->orderBy('name', 'COLLATE NOCASE'),
+			'quantityUnitConversionsResolved' => $quantityUnitConversionsResolved
 		]);
 	}
 }

controllers/StockReportsController.php

@@ -0,0 +1,105 @@
+<?php
+
+namespace Grocy\Controllers;
+
+use Psr\Http\Message\ResponseInterface as Response;
+use Psr\Http\Message\ServerRequestInterface as Request;
+
+class StockReportsController extends BaseController
+{
+	public function Spendings(Request $request, Response $response, array $args)
+	{
+		$where = "pph.transaction_type != 'self-production'";
+
+		if (isset($request->getQueryParams()['start_date']) && isset($request->getQueryParams()['end_date']) && IsIsoDate($request->getQueryParams()['start_date']) && IsIsoDate($request->getQueryParams()['end_date']))
+		{
+			$startDate = $request->getQueryParams()['start_date'];
+			$endDate = $request->getQueryParams()['end_date'];
+			$where .= " AND pph.purchased_date BETWEEN '$startDate' AND '$endDate'";
+		}
+		else
+		{
+			// Default to this month
+			$where .= " AND pph.purchased_date >= DATE(DATE('now', 'localtime'), 'start of month')";
+		}
+
+		$groupBy = 'product';
+		if (isset($request->getQueryParams()['group-by']) && in_array($request->getQueryParams()['group-by'], ['product', 'productgroup', 'store']))
+		{
+			$groupBy = $request->getQueryParams()['group-by'];
+		}
+
+		if ($groupBy == 'product')
+		{
+			if (isset($request->getQueryParams()['product-group']))
+			{
+				if ($request->getQueryParams()['product-group'] == 'ungrouped')
+				{
+					$where .= ' AND pg.id IS NULL';
+				}
+				elseif ($request->getQueryParams()['product-group'] != 'all')
+				{
+					$where .= ' AND pg.id = ' . $request->getQueryParams()['product-group'];
+				}
+			}
+
+			$sql = "
+			SELECT
+				p.id AS id,
+				p.name AS name,
+				pg.id AS group_id,
+				pg.name AS group_name,
+				SUM(pph.amount * pph.price) AS total
+			FROM products_price_history pph
+			JOIN products p
+				ON pph.product_id = p.id
+			LEFT JOIN product_groups pg
+				ON p.product_group_id = pg.id
+			WHERE $where
+			GROUP BY p.id, p.name, pg.id, pg.name
+			ORDER BY p.name COLLATE NOCASE
+			";
+		}
+		elseif ($groupBy == 'productgroup')
+		{
+			$sql = "
+			SELECT
+				pg.id AS id,
+				pg.name AS name,
+				SUM(pph.amount * pph.price) AS total
+			FROM products_price_history pph
+			JOIN products p
+				ON pph.product_id = p.id
+			LEFT JOIN product_groups pg
+				ON p.product_group_id = pg.id
+			WHERE $where
+			GROUP BY pg.id, pg.name
+			ORDER BY pg.name COLLATE NOCASE
+			";
+		}
+		elseif ($groupBy == 'store')
+		{
+			$sql = "
+			SELECT
+				sl.id AS id,
+				sl.name AS name,
+				SUM(pph.amount * pph.price) AS total
+			FROM products_price_history pph
+			JOIN products p
+				ON pph.product_id = p.id
+			LEFT JOIN shopping_locations sl
+				ON pph.shopping_location_id = sl.id
+			WHERE $where
+			GROUP BY sl.id, sl.name
+			ORDER BY sl.NAME COLLATE NOCASE
+			";
+		}
+
+		return $this->renderPage($response, 'stockreportspendings', [
+			'metrics' => $this->getDatabaseService()->ExecuteDbQuery($sql)->fetchAll(\PDO::FETCH_OBJ),
+			'productGroups' => $this->getDatabase()->product_groups()->where('active = 1')->orderBy('name', 'COLLATE NOCASE'),
+			'selectedGroup' => isset($request->getQueryParams()['product-group']) ? $request->getQueryParams()['product-group'] : null,
+			'groupBy' => $groupBy
+		]);
+	}
+}

controllers/SystemApiController.php

@@ -2,33 +2,22 @@
 
 namespace Grocy\Controllers;
 
+use Psr\Http\Message\ResponseInterface as Response;
+use Psr\Http\Message\ServerRequestInterface as Request;
+
 class SystemApiController extends BaseApiController
 {
-	public function __construct(\DI\Container $container)
-	{
-		parent::__construct($container);
-	}
-
-	public function GetDbChangedTime(\Psr\Http\Message\ServerRequestInterface $request, \Psr\Http\Message\ResponseInterface $response, array $args)
-	{
-        return $this->ApiResponse($response, array(
-            'changed_time' => $this->getDatabaseService()->GetDbChangedTime()
-        ));
-	}
-
-	public function GetConfig(\Psr\Http\Message\ServerRequestInterface $request, \Psr\Http\Message\ResponseInterface $response, array $args)
+	public function GetConfig(Request $request, Response $response, array $args)
 	{
 		try
 		{
 			$constants = get_defined_constants();
 
 			// Some GROCY_* constants are not really config settings and therefore should not be exposed
-			unset($constants['GROCY_AUTHENTICATED']);
-			unset($constants['GROCY_DATAPATH']);
-			unset($constants['GROCY_IS_EMBEDDED_INSTALL']);
-			unset($constants['GROCY_USER_ID']);
+			unset($constants['GROCY_AUTHENTICATED'], $constants['GROCY_DATAPATH'], $constants['GROCY_IS_EMBEDDED_INSTALL'], $constants['GROCY_USER_ID']);
+
+			$returnArray = [];
 
-			$returnArray = array();
 			foreach ($constants as $constant => $value)
 			{
 				if (substr($constant, 0, 6) === 'GROCY_')
@@ -45,13 +34,49 @@ class SystemApiController extends BaseApiController
 		}
 	}
 
-	public function LogMissingLocalization(\Psr\Http\Message\ServerRequestInterface $request, \Psr\Http\Message\ResponseInterface $response, array $args)
+	public function GetDbChangedTime(Request $request, Response $response, array $args)
+	{
+		return $this->ApiResponse($response, [
+			'changed_time' => $this->getDatabaseService()->GetDbChangedTime()
+		]);
+	}
+
+	public function GetSystemInfo(Request $request, Response $response, array $args)
+	{
+		return $this->ApiResponse($response, $this->getApplicationService()->GetSystemInfo());
+	}
+
+	public function GetSystemTime(Request $request, Response $response, array $args)
+	{
+		try
+		{
+			$offset = 0;
+			$params = $request->getQueryParams();
+			if (isset($params['offset']))
+			{
+				if (filter_var($params['offset'], FILTER_VALIDATE_INT) === false)
+				{
+					throw new \Exception('Query parameter "offset" is not a valid integer');
+				}
+
+				$offset = $params['offset'];
+			}
+
+			return $this->ApiResponse($response, $this->getApplicationService()->GetSystemTime($offset));
+		}
+		catch (\Exception $ex)
+		{
+			return $this->GenericErrorResponse($response, $ex->getMessage());
+		}
+	}
+
+	public function LogMissingLocalization(Request $request, Response $response, array $args)
 	{
 		if (GROCY_MODE === 'dev')
 		{
 			try
 			{
-				$requestBody = $request->getParsedBody();
+				$requestBody = $this->GetParsedAndFilteredRequestBody($request);
 
 				$this->getLocalizationService()->CheckAndAddMissingTranslationToPot($requestBody['text']);
 				return $this->EmptyApiResponse($response);
@@ -63,8 +88,8 @@ class SystemApiController extends BaseApiController
 		}
 	}
 
-	public function GetSystemInfo(\Psr\Http\Message\ServerRequestInterface $request, \Psr\Http\Message\ResponseInterface $response, array $args)
+	public function GetLocalizationStrings(Request $request, Response $response, array $args)
 	{
-		return $this->ApiResponse($response, $this->getApplicationService()->GetSystemInfo());
+		return $this->ApiResponse($response, json_decode($this->getLocalizationService()->GetPoAsJsonString()), true);
 	}
 }

controllers/SystemController.php

@@ -2,18 +2,28 @@
 
 namespace Grocy\Controllers;
 
-use \Grocy\Services\DatabaseMigrationService;
-use \Grocy\Services\DemoDataGeneratorService;
+use Grocy\Services\DatabaseMigrationService;
+use Grocy\Services\DemoDataGeneratorService;
+use Psr\Http\Message\ResponseInterface as Response;
+use Psr\Http\Message\ServerRequestInterface as Request;
 
 class SystemController extends BaseController
 {
-
-	public function __construct(\DI\Container $container)
+	public function About(Request $request, Response $response, array $args)
 	{
-		parent::__construct($container);
+		return $this->renderPage($response, 'about', [
+			'systemInfo' => $this->getApplicationService()->GetSystemInfo(),
+			'versionInfo' => $this->getApplicationService()->GetInstalledVersion(),
+			'changelog' => $this->getApplicationService()->GetChangelog()
+		]);
 	}
 
-	public function Root(\Psr\Http\Message\ServerRequestInterface $request, \Psr\Http\Message\ResponseInterface $response, array $args)
+	public function BarcodeScannerTesting(Request $request, Response $response, array $args)
+	{
+		return $this->renderPage($response, 'barcodescannertesting');
+	}
+
+	public function Root(Request $request, Response $response, array $args)
 	{
 		// Schema migration is done here
 		$databaseMigrationService = DatabaseMigrationService::getInstance();
@@ -22,85 +32,98 @@ class SystemController extends BaseController
 		if (GROCY_MODE === 'dev' || GROCY_MODE === 'demo' || GROCY_MODE === 'prerelease')
 		{
 			$demoDataGeneratorService = DemoDataGeneratorService::getInstance();
-			$demoDataGeneratorService->PopulateDemoData();
+			$demoDataGeneratorService->PopulateDemoData(isset($request->getQueryParams()['nodemodata']));
 		}
 
 		return $response->withRedirect($this->AppContainer->get('UrlManager')->ConstructUrl($this->GetEntryPageRelative()));
 	}
 
-	/**
-	 * Get the entry page of the application based on the value of the entry page setting.
-	 *
-	 * We fallback to the about page when no entry page is specified or
-	 * when the specified entry page has been disabled.
-	 *
-	 * @return string
-	 */
+	public function Manifest(Request $request, Response $response, array $args)
+	{
+		$data = explode('#', base64_decode($request->getQueryParams()['data']));
+
+		$manifest = [
+			'name' => 'Grocy ' . $data[0],
+			'short_name' => 'Grocy ' . $data[0],
+			'icons' => [[
+				'src' => './img/icon-1024.png',
+				'sizes'=> '1024x1024',
+				'type' => 'image/png'
+			]],
+			'start_url' => $data[1],
+			'background_color' => '#333131',
+			'theme_color' => '#333131',
+			'display' => 'standalone'
+		];
+
+		$response->getBody()->write(json_encode($manifest));
+		return $response->withHeader('Content-Type', 'application/json');
+	}
+
 	private function GetEntryPageRelative()
 	{
-		if (defined('GROCY_ENTRY_PAGE')) {
+		if (defined('GROCY_ENTRY_PAGE'))
+		{
 			$entryPage = constant('GROCY_ENTRY_PAGE');
-		} else {
+		}
+		else
+		{
 			$entryPage = 'stock';
 		}
 
 		// Stock
-		if ($entryPage === 'stock' && constant('GROCY_FEATURE_FLAG_STOCK')) {
+		if ($entryPage === 'stock' && constant('GROCY_FEATURE_FLAG_STOCK'))
+		{
 			return '/stockoverview';
 		}
 
 		// Shoppinglist
-		if ($entryPage === 'shoppinglist' && constant('GROCY_FEATURE_FLAG_SHOPPINGLIST')) {
+		if ($entryPage === 'shoppinglist' && constant('GROCY_FEATURE_FLAG_SHOPPINGLIST'))
+		{
 			return '/shoppinglist';
 		}
 
 		// Recipes
-		if ($entryPage === 'recipes' && constant('GROCY_FEATURE_FLAG_RECIPES')) {
+		if ($entryPage === 'recipes' && constant('GROCY_FEATURE_FLAG_RECIPES'))
+		{
 			return '/recipes';
 		}
 
 		// Chores
-		if ($entryPage === 'chores' && constant('GROCY_FEATURE_FLAG_CHORES')) {
+		if ($entryPage === 'chores' && constant('GROCY_FEATURE_FLAG_CHORES'))
+		{
 			return '/choresoverview';
 		}
 
 		// Tasks
-		if ($entryPage === 'tasks' && constant('GROCY_FEATURE_FLAG_TASKS')) {
+		if ($entryPage === 'tasks' && constant('GROCY_FEATURE_FLAG_TASKS'))
+		{
 			return '/tasks';
 		}
 
 		// Batteries
-		if ($entryPage === 'batteries' && constant('GROCY_FEATURE_FLAG_BATTERIES')) {
+		if ($entryPage === 'batteries' && constant('GROCY_FEATURE_FLAG_BATTERIES'))
+		{
 			return '/batteriesoverview';
 		}
 
-		if ($entryPage === 'equipment' && constant('GROCY_FEATURE_FLAG_EQUIPMENT')) {
+		if ($entryPage === 'equipment' && constant('GROCY_FEATURE_FLAG_EQUIPMENT'))
+		{
 			return '/equipment';
 		}
 
 		// Calendar
-		if ($entryPage === 'calendar' && constant('GROCY_FEATURE_FLAG_CALENDAR')) {
+		if ($entryPage === 'calendar' && constant('GROCY_FEATURE_FLAG_CALENDAR'))
+		{
 			return '/calendar';
 		}
 
 		// Meal Plan
-		if ($entryPage === 'mealplan' && constant('GROCY_FEATURE_FLAG_RECIPES')) {
+		if ($entryPage === 'mealplan' && constant('GROCY_FEATURE_FLAG_RECIPES_MEALPLAN'))
+		{
 			return '/mealplan';
 		}
 
 		return '/about';
 	}
-
-	public function About(\Psr\Http\Message\ServerRequestInterface $request, \Psr\Http\Message\ResponseInterface $response, array $args)
-	{
-		return $this->renderPage($response, 'about', [
-			'system_info' => $this->getApplicationService()->GetSystemInfo(),
-			'changelog' => $this->getApplicationService()->GetChangelog()
-		]);
-	}
-
-	public function BarcodeScannerTesting(\Psr\Http\Message\ServerRequestInterface $request, \Psr\Http\Message\ResponseInterface $response, array $args)
-	{
-		return $this->renderPage($response, 'barcodescannertesting');
-	}
 }

controllers/TasksApiController.php

@@ -2,25 +2,27 @@
 
 namespace Grocy\Controllers;
 
+use Grocy\Controllers\Users\User;
+use Psr\Http\Message\ResponseInterface as Response;
+use Psr\Http\Message\ServerRequestInterface as Request;
+
 class TasksApiController extends BaseApiController
 {
-	public function __construct(\DI\Container $container)
+	public function Current(Request $request, Response $response, array $args)
 	{
-		parent::__construct($container);
+		return $this->FilteredApiResponse($response, $this->getTasksService()->GetCurrent(), $request->getQueryParams());
 	}
 
-	public function Current(\Psr\Http\Message\ServerRequestInterface $request, \Psr\Http\Message\ResponseInterface $response, array $args)
+	public function MarkTaskAsCompleted(Request $request, Response $response, array $args)
 	{
-		return $this->ApiResponse($response, $this->getTasksService()->GetCurrent());
-	}
+		User::checkPermission($request, User::PERMISSION_TASKS_MARK_COMPLETED);
 
-	public function MarkTaskAsCompleted(\Psr\Http\Message\ServerRequestInterface $request, \Psr\Http\Message\ResponseInterface $response, array $args)
-	{
-		$requestBody = $request->getParsedBody();
+		$requestBody = $this->GetParsedAndFilteredRequestBody($request);
 
 		try
 		{
 			$doneTime = date('Y-m-d H:i:s');
+
 			if (array_key_exists('done_time', $requestBody) && IsIsoDateTime($requestBody['done_time']))
 			{
 				$doneTime = $requestBody['done_time'];
@@ -35,8 +37,10 @@ class TasksApiController extends BaseApiController
 		}
 	}
 
-	public function UndoTask(\Psr\Http\Message\ServerRequestInterface $request, \Psr\Http\Message\ResponseInterface $response, array $args)
+	public function UndoTask(Request $request, Response $response, array $args)
 	{
+		User::checkPermission($request, User::PERMISSION_TASKS_UNDO_EXECUTION);
+
 		try
 		{
 			$this->getTasksService()->UndoTask($args['taskId']);

controllers/TasksController.php

@@ -2,70 +2,74 @@
 
 namespace Grocy\Controllers;
 
+use Psr\Http\Message\ResponseInterface as Response;
+use Psr\Http\Message\ServerRequestInterface as Request;
+
 class TasksController extends BaseController
 {
-	public function __construct(\DI\Container $container)
+	public function Overview(Request $request, Response $response, array $args)
 	{
-		parent::__construct($container);
-	}
+		$usersService = $this->getUsersService();
+		$nextXDays = $usersService->GetUserSettings(GROCY_USER_ID)['tasks_due_soon_days'];
 
-	public function Overview(\Psr\Http\Message\ServerRequestInterface $request, \Psr\Http\Message\ResponseInterface $response, array $args)
-	{
 		if (isset($request->getQueryParams()['include_done']))
 		{
-			$tasks = $this->getDatabase()->tasks()->orderBy('name');
+			$tasks = $this->getDatabase()->tasks()->orderBy('name', 'COLLATE NOCASE');
 		}
 		else
 		{
 			$tasks = $this->getTasksService()->GetCurrent();
 		}
 
-		$usersService = $this->getUsersService();
-		$nextXDays = $usersService->GetUserSettings(GROCY_USER_ID)['tasks_due_soon_days'];
+		foreach ($tasks as $task)
+		{
+			if (empty($task->due_date))
+			{
+				$task->due_type = '';
+			}
+			elseif ($task->due_date < date('Y-m-d 23:59:59', strtotime('-1 days')))
+			{
+				$task->due_type = 'overdue';
+			}
+			elseif ($task->due_date <= date('Y-m-d 23:59:59'))
+			{
+				$task->due_type = 'duetoday';
+			}
+			elseif ($nextXDays > 0 && $task->due_date <= date('Y-m-d 23:59:59', strtotime('+' . $nextXDays . ' days')))
+			{
+				$task->due_type = 'duesoon';
+			}
+		}
 
 		return $this->renderPage($response, 'tasks', [
 			'tasks' => $tasks,
 			'nextXDays' => $nextXDays,
-			'taskCategories' => $this->getDatabase()->task_categories()->orderBy('name'),
+			'taskCategories' => $this->getDatabase()->task_categories()->where('active = 1')->orderBy('name', 'COLLATE NOCASE'),
 			'users' => $this->getDatabase()->users(),
 			'userfields' => $this->getUserfieldsService()->GetFields('tasks'),
 			'userfieldValues' => $this->getUserfieldsService()->GetAllValues('tasks')
 		]);
 	}
 
-	public function TaskEditForm(\Psr\Http\Message\ServerRequestInterface $request, \Psr\Http\Message\ResponseInterface $response, array $args)
+	public function TaskCategoriesList(Request $request, Response $response, array $args)
 	{
-		if ($args['taskId'] == 'new')
+		if (isset($request->getQueryParams()['include_disabled']))
 		{
-			return $this->renderPage($response, 'taskform', [
-				'mode' => 'create',
-				'taskCategories' => $this->getDatabase()->task_categories()->orderBy('name'),
-				'users' => $this->getDatabase()->users()->orderBy('username'),
-				'userfields' => $this->getUserfieldsService()->GetFields('tasks')
-			]);
+			$categories = $this->getDatabase()->task_categories()->orderBy('name', 'COLLATE NOCASE');
 		}
 		else
 		{
-			return $this->renderPage($response, 'taskform', [
-				'task' =>  $this->getDatabase()->tasks($args['taskId']),
-				'mode' => 'edit',
-				'taskCategories' => $this->getDatabase()->task_categories()->orderBy('name'),
-				'users' => $this->getDatabase()->users()->orderBy('username'),
-				'userfields' => $this->getUserfieldsService()->GetFields('tasks')
-			]);
+			$categories = $this->getDatabase()->task_categories()->where('active = 1')->orderBy('name', 'COLLATE NOCASE');
 		}
-	}
 
-	public function TaskCategoriesList(\Psr\Http\Message\ServerRequestInterface $request, \Psr\Http\Message\ResponseInterface $response, array $args)
-	{
 		return $this->renderPage($response, 'taskcategories', [
-			'taskCategories' => $this->getDatabase()->task_categories()->orderBy('name'),
+			'taskCategories' => $categories,
 			'userfields' => $this->getUserfieldsService()->GetFields('task_categories'),
 			'userfieldValues' => $this->getUserfieldsService()->GetAllValues('task_categories')
 		]);
 	}
 
-	public function TaskCategoryEditForm(\Psr\Http\Message\ServerRequestInterface $request, \Psr\Http\Message\ResponseInterface $response, array $args)
+	public function TaskCategoryEditForm(Request $request, Response $response, array $args)
 	{
 		if ($args['categoryId'] == 'new')
 		{
@@ -77,14 +81,37 @@ class TasksController extends BaseController
 		else
 		{
 			return $this->renderPage($response, 'taskcategoryform', [
-				'category' =>  $this->getDatabase()->task_categories($args['categoryId']),
+				'category' => $this->getDatabase()->task_categories($args['categoryId']),
 				'mode' => 'edit',
 				'userfields' => $this->getUserfieldsService()->GetFields('task_categories')
 			]);
 		}
 	}
 
-	public function TasksSettings(\Psr\Http\Message\ServerRequestInterface $request, \Psr\Http\Message\ResponseInterface $response, array $args)
+	public function TaskEditForm(Request $request, Response $response, array $args)
+	{
+		if ($args['taskId'] == 'new')
+		{
+			return $this->renderPage($response, 'taskform', [
+				'mode' => 'create',
+				'taskCategories' => $this->getDatabase()->task_categories()->where('active = 1')->orderBy('name', 'COLLATE NOCASE'),
+				'users' => $this->getDatabase()->users()->orderBy('username'),
+				'userfields' => $this->getUserfieldsService()->GetFields('tasks')
+			]);
+		}
+		else
+		{
+			return $this->renderPage($response, 'taskform', [
+				'task' => $this->getDatabase()->tasks($args['taskId']),
+				'mode' => 'edit',
+				'taskCategories' => $this->getDatabase()->task_categories()->where('active = 1')->orderBy('name', 'COLLATE NOCASE'),
+				'users' => $this->getDatabase()->users()->orderBy('username'),
+				'userfields' => $this->getUserfieldsService()->GetFields('tasks')
+			]);
+		}
+	}
+
+	public function TasksSettings(Request $request, Response $response, array $args)
 	{
 		return $this->renderPage($response, 'taskssettings');
 	}

controllers/Users/PermissionMissingException.php

@@ -0,0 +1,15 @@
+<?php
+
+namespace Grocy\Controllers\Users;
+
+use Psr\Http\Message\ServerRequestInterface;
+use Slim\Exception\HttpForbiddenException;
+use Throwable;
+
+class PermissionMissingException extends HttpForbiddenException
+{
+	public function __construct(ServerRequestInterface $request, string $permission, ?Throwable $previous = null)
+	{
+		parent::__construct($request, 'Permission missing: ' . $permission, $previous);
+	}
+}

controllers/Users/User.php

@@ -0,0 +1,92 @@
+<?php
+
+namespace Grocy\Controllers\Users;
+
+use Grocy\Services\DatabaseService;
+use LessQL\Result;
+
+class User
+{
+	const PERMISSION_ADMIN = 'ADMIN';
+	const PERMISSION_BATTERIES = 'BATTERIES';
+	const PERMISSION_BATTERIES_TRACK_CHARGE_CYCLE = 'BATTERIES_TRACK_CHARGE_CYCLE';
+	const PERMISSION_BATTERIES_UNDO_CHARGE_CYCLE = 'BATTERIES_UNDO_CHARGE_CYCLE';
+	const PERMISSION_CALENDAR = 'CALENDAR';
+	const PERMISSION_CHORES = 'CHORES';
+	const PERMISSION_CHORE_TRACK_EXECUTION = 'CHORE_TRACK_EXECUTION';
+	const PERMISSION_CHORE_UNDO_EXECUTION = 'CHORE_UNDO_EXECUTION';
+	const PERMISSION_EQUIPMENT = 'EQUIPMENT';
+	const PERMISSION_MASTER_DATA_EDIT = 'MASTER_DATA_EDIT';
+	const PERMISSION_RECIPES = 'RECIPES';
+	const PERMISSION_RECIPES_MEALPLAN = 'RECIPES_MEALPLAN';
+	const PERMISSION_SHOPPINGLIST = 'SHOPPINGLIST';
+	const PERMISSION_SHOPPINGLIST_ITEMS_ADD = 'SHOPPINGLIST_ITEMS_ADD';
+	const PERMISSION_SHOPPINGLIST_ITEMS_DELETE = 'SHOPPINGLIST_ITEMS_DELETE';
+	const PERMISSION_STOCK = 'STOCK';
+	const PERMISSION_STOCK_CONSUME = 'STOCK_CONSUME';
+	const PERMISSION_STOCK_EDIT = 'STOCK_EDIT';
+	const PERMISSION_STOCK_INVENTORY = 'STOCK_INVENTORY';
+	const PERMISSION_STOCK_OPEN = 'STOCK_OPEN';
+	const PERMISSION_STOCK_PURCHASE = 'STOCK_PURCHASE';
+	const PERMISSION_STOCK_TRANSFER = 'STOCK_TRANSFER';
+	const PERMISSION_TASKS = 'TASKS';
+	const PERMISSION_TASKS_MARK_COMPLETED = 'TASKS_MARK_COMPLETED';
+	const PERMISSION_TASKS_UNDO_EXECUTION = 'TASKS_UNDO_EXECUTION';
+	const PERMISSION_USERS = 'USERS';
+	const PERMISSION_USERS_CREATE = 'USERS_CREATE';
+	const PERMISSION_USERS_EDIT = 'USERS_EDIT';
+	const PERMISSION_USERS_EDIT_SELF = 'USERS_EDIT_SELF';
+	const PERMISSION_USERS_READ = 'USERS_READ';
+
+	public function __construct()
+	{
+		$this->db = DatabaseService::getInstance()->GetDbConnection();
+	}
+
+	protected $db;
+
+	public static function PermissionList()
+	{
+		$user = new self();
+		return $user->getPermissionList();
+	}
+
+	public static function checkPermission($request, string $permission): void
+	{
+		$user = new self();
+		if (!$user->hasPermission($permission))
+		{
+			throw new PermissionMissingException($request, $permission);
+		}
+	}
+
+	public function getPermissionList()
+	{
+		return $this->db->uihelper_user_permissions()->where('user_id', GROCY_USER_ID);
+	}
+
+	public function hasPermission(string $permission): bool
+	{
+		return $this->getPermissions()->where('permission_name', $permission)->fetch() !== null;
+	}
+
+	public static function hasPermissions(string ...$permissions)
+	{
+		$user = new self();
+
+		foreach ($permissions as $permission)
+		{
+			if (!$user->hasPermission($permission))
+			{
+				return false;
+			}
+		}
+
+		return true;
+	}
+
+	protected function getPermissions(): Result
+	{
+		return $this->db->user_permissions_resolved()->where('user_id', GROCY_USER_ID);
+	}
+}

controllers/UsersApiController.php

@@ -2,18 +2,28 @@
 
 namespace Grocy\Controllers;
 
+use Grocy\Controllers\Users\User;
+use Psr\Http\Message\ResponseInterface as Response;
+use Psr\Http\Message\ServerRequestInterface as Request;
+
 class UsersApiController extends BaseApiController
 {
-	public function __construct(\DI\Container $container)
-	{
-		parent::__construct($container);
-	}
-
-	public function GetUsers(\Psr\Http\Message\ServerRequestInterface $request, \Psr\Http\Message\ResponseInterface $response, array $args)
+	public function AddPermission(Request $request, Response $response, array $args)
 	{
 		try
 		{
-			return $this->ApiResponse($response, $this->getUsersService()->GetUsersAsDto());
+			User::checkPermission($request, User::PERMISSION_ADMIN);
+			$requestBody = $this->GetParsedAndFilteredRequestBody($request);
+
+			$this->getDatabase()->user_permissions()->createRow([
+				'user_id' => $args['userId'],
+				'permission_id' => $requestBody['permission_id']
+			])->save();
+			return $this->EmptyApiResponse($response);
+		}
+		catch (\Slim\Exception\HttpSpecializedException $ex)
+		{
+			return $this->GenericErrorResponse($response, $ex->getMessage(), $ex->getCode());
 		}
 		catch (\Exception $ex)
 		{
@@ -21,9 +31,10 @@ class UsersApiController extends BaseApiController
 		}
 	}
 
-	public function CreateUser(\Psr\Http\Message\ServerRequestInterface $request, \Psr\Http\Message\ResponseInterface $response, array $args)
+	public function CreateUser(Request $request, Response $response, array $args)
 	{
-		$requestBody = $request->getParsedBody();
+		User::checkPermission($request, User::PERMISSION_USERS_CREATE);
+		$requestBody = $this->GetParsedAndFilteredRequestBody($request);
 
 		try
 		{
@@ -32,7 +43,7 @@ class UsersApiController extends BaseApiController
 				throw new \Exception('Request body could not be parsed (probably invalid JSON format or missing/wrong Content-Type header)');
 			}
 
-			$this->getUsersService()->CreateUser($requestBody['username'], $requestBody['first_name'], $requestBody['last_name'], $requestBody['password']);
+			$this->getUsersService()->CreateUser($requestBody['username'], $requestBody['first_name'], $requestBody['last_name'], $requestBody['password'], $requestBody['picture_file_name']);
 			return $this->EmptyApiResponse($response);
 		}
 		catch (\Exception $ex)
@@ -41,8 +52,9 @@ class UsersApiController extends BaseApiController
 		}
 	}
 
-	public function DeleteUser(\Psr\Http\Message\ServerRequestInterface $request, \Psr\Http\Message\ResponseInterface $response, array $args)
+	public function DeleteUser(Request $request, Response $response, array $args)
 	{
+		User::checkPermission($request, User::PERMISSION_USERS_EDIT);
 		try
 		{
 			$this->getUsersService()->DeleteUser($args['userId']);
@@ -54,13 +66,22 @@ class UsersApiController extends BaseApiController
 		}
 	}
 
-	public function EditUser(\Psr\Http\Message\ServerRequestInterface $request, \Psr\Http\Message\ResponseInterface $response, array $args)
+	public function EditUser(Request $request, Response $response, array $args)
 	{
-		$requestBody = $request->getParsedBody();
+		if ($args['userId'] == GROCY_USER_ID)
+		{
+			User::checkPermission($request, User::PERMISSION_USERS_EDIT_SELF);
+		}
+		else
+		{
+			User::checkPermission($request, User::PERMISSION_USERS_EDIT);
+		}
+
+		$requestBody = $this->GetParsedAndFilteredRequestBody($request);
 
 		try
 		{
-			$this->getUsersService()->EditUser($args['userId'], $requestBody['username'], $requestBody['first_name'], $requestBody['last_name'], $requestBody['password']);
+			$this->getUsersService()->EditUser($args['userId'], $requestBody['username'], $requestBody['first_name'], $requestBody['last_name'], $requestBody['password'], $requestBody['picture_file_name']);
 			return $this->EmptyApiResponse($response);
 		}
 		catch (\Exception $ex)
@@ -69,7 +90,20 @@ class UsersApiController extends BaseApiController
 		}
 	}
 
-	public function GetUserSettings(\Psr\Http\Message\ServerRequestInterface $request, \Psr\Http\Message\ResponseInterface $response, array $args)
+	public function GetUserSetting(Request $request, Response $response, array $args)
+	{
+		try
+		{
+			$value = $this->getUsersService()->GetUserSetting(GROCY_USER_ID, $args['settingKey']);
+			return $this->ApiResponse($response, ['value' => $value]);
+		}
+		catch (\Exception $ex)
+		{
+			return $this->GenericErrorResponse($response, $ex->getMessage());
+		}
+	}
+
+	public function GetUserSettings(Request $request, Response $response, array $args)
 	{
 		try
 		{
@@ -81,12 +115,12 @@ class UsersApiController extends BaseApiController
 		}
 	}
 
-	public function GetUserSetting(\Psr\Http\Message\ServerRequestInterface $request, \Psr\Http\Message\ResponseInterface $response, array $args)
+	public function GetUsers(Request $request, Response $response, array $args)
 	{
+		User::checkPermission($request, User::PERMISSION_USERS_READ);
 		try
 		{
-			$value = $this->getUsersService()->GetUserSetting(GROCY_USER_ID, $args['settingKey']);
-			return $this->ApiResponse($response, array('value' => $value));
+			return $this->FilteredApiResponse($response, $this->getUsersService()->GetUsersAsDto(), $request->getQueryParams());
 		}
 		catch (\Exception $ex)
 		{
@@ -94,11 +128,89 @@ class UsersApiController extends BaseApiController
 		}
 	}
 
-	public function SetUserSetting(\Psr\Http\Message\ServerRequestInterface $request, \Psr\Http\Message\ResponseInterface $response, array $args)
+	public function CurrentUser(Request $request, Response $response, array $args)
 	{
 		try
 		{
+			return $this->ApiResponse($response, $this->getUsersService()->GetUsersAsDto()->where('id', GROCY_USER_ID));
+		}
+		catch (\Exception $ex)
+		{
+			return $this->GenericErrorResponse($response, $ex->getMessage());
+		}
+	}
+
+	public function ListPermissions(Request $request, Response $response, array $args)
+	{
+		try
+		{
+			User::checkPermission($request, User::PERMISSION_ADMIN);
+
+			return $this->ApiResponse(
+				$response,
+				$this->getDatabase()->user_permissions()->where('user_id', $args['userId'])
+			);
+		}
+		catch (\Slim\Exception\HttpSpecializedException $ex)
+		{
+			return $this->GenericErrorResponse($response, $ex->getMessage(), $ex->getCode());
+		}
+		catch (\Exception $ex)
+		{
+			return $this->GenericErrorResponse($response, $ex->getMessage());
+		}
+	}
+
+	public function SetPermissions(Request $request, Response $response, array $args)
+	{
+		try
+		{
+			User::checkPermission($request, User::PERMISSION_ADMIN);
+
 			$requestBody = $request->getParsedBody();
+			$db = $this->getDatabase();
+			$db->user_permissions()
+				->where('user_id', $args['userId'])
+				->delete();
+
+			$perms = [];
+			if (GROCY_MODE === 'demo' || GROCY_MODE === 'prerelease')
+			{
+				// For demo mode always all users have and keep the ADMIN permission
+				$perms[] = [
+					'user_id' => $args['userId'],
+					'permission_id' => 1
+				];
+			}
+			else
+			{
+				foreach ($requestBody['permissions'] as $perm_id)
+				{
+					$perms[] = [
+						'user_id' => $args['userId'],
+						'permission_id' => $perm_id
+					];
+				}
+			}
+			$db->insert('user_permissions', $perms, 'batch');
+
+			return $this->EmptyApiResponse($response);
+		}
+		catch (\Slim\Exception\HttpSpecializedException $ex)
+		{
+			return $this->GenericErrorResponse($response, $ex->getMessage(), $ex->getCode());
+		}
+		catch (\Exception $ex)
+		{
+			return $this->GenericErrorResponse($response, $ex->getMessage());
+		}
+	}
+
+	public function SetUserSetting(Request $request, Response $response, array $args)
+	{
+		try
+		{
+			$requestBody = $this->GetParsedAndFilteredRequestBody($request);
 
 			$value = $this->getUsersService()->SetUserSetting(GROCY_USER_ID, $args['settingKey'], $requestBody['value']);
 			return $this->EmptyApiResponse($response);
@@ -108,4 +220,17 @@ class UsersApiController extends BaseApiController
 			return $this->GenericErrorResponse($response, $ex->getMessage());
 		}
 	}
+
+	public function DeleteUserSetting(Request $request, Response $response, array $args)
+	{
+		try
+		{
+			$value = $this->getUsersService()->DeleteUserSetting(GROCY_USER_ID, $args['settingKey']);
+			return $this->EmptyApiResponse($response);
+		}
+		catch (\Exception $ex)
+		{
+			return $this->GenericErrorResponse($response, $ex->getMessage());
+		}
+	}
 }

controllers/UsersController.php

@@ -2,29 +2,74 @@
 
 namespace Grocy\Controllers;
 
+use Grocy\Controllers\Users\User;
+use Psr\Http\Message\ResponseInterface as Response;
+use Psr\Http\Message\ServerRequestInterface as Request;
+
 class UsersController extends BaseController
 {
-	public function UsersList(\Psr\Http\Message\ServerRequestInterface $request, \Psr\Http\Message\ResponseInterface $response, array $args)
+	public function PermissionList(Request $request, Response $response, array $args)
 	{
-		return $this->renderPage($response, 'users', [
-			'users' => $this->getDatabase()->users()->orderBy('username')
+		User::checkPermission($request, User::PERMISSION_USERS_READ);
+		return $this->renderPage($response, 'userpermissions', [
+			'user' => $this->getDatabase()->users($args['userId']),
+			'permissions' => $this->getDatabase()->uihelper_user_permissions()
+				->where('parent IS NULL')->where('user_id', $args['userId'])
 		]);
 	}
 
-	public function UserEditForm(\Psr\Http\Message\ServerRequestInterface $request, \Psr\Http\Message\ResponseInterface $response, array $args)
+	public function UserEditForm(Request $request, Response $response, array $args)
 	{
 		if ($args['userId'] == 'new')
 		{
+			User::checkPermission($request, User::PERMISSION_USERS_CREATE);
 			return $this->renderPage($response, 'userform', [
-				'mode' => 'create'
+				'mode' => 'create',
+				'userfields' => $this->getUserfieldsService()->GetFields('users')
 			]);
 		}
 		else
 		{
+			if ($args['userId'] == GROCY_USER_ID)
+			{
+				User::checkPermission($request, User::PERMISSION_USERS_EDIT_SELF);
+			}
+			else
+			{
+				User::checkPermission($request, User::PERMISSION_USERS_EDIT);
+			}
+
 			return $this->renderPage($response, 'userform', [
-				'user' =>  $this->getDatabase()->users($args['userId']),
-				'mode' => 'edit'
+				'user' => $this->getDatabase()->users($args['userId']),
+				'mode' => 'edit',
+				'userfields' => $this->getUserfieldsService()->GetFields('users'),
+				'userfieldValues' => $this->getUserfieldsService()->GetAllValues('users')
 			]);
 		}
 	}
+
+	public function UserSettings(Request $request, Response $response, array $args)
+	{
+		return $this->renderPage($response, 'usersettings', [
+			'languages' => array_filter(scandir(__DIR__ . '/../localization'), function ($item)
+			{
+				if ($item == '.' || $item == '..')
+				{
+					return false;
+				}
+
+				return is_dir(__DIR__ . '/../localization/' . $item);
+			})
+		]);
+	}
+
+	public function UsersList(Request $request, Response $response, array $args)
+	{
+		User::checkPermission($request, User::PERMISSION_USERS_READ);
+		return $this->renderPage($response, 'users', [
+			'users' => $this->getDatabase()->users()->orderBy('username'),
+			'userfields' => $this->getUserfieldsService()->GetFields('users'),
+			'userfieldValues' => $this->getUserfieldsService()->GetAllValues('users')
+		]);
+	}
 }