befundschani 0.1.0__tar.gz

befundschani-0.1.0/.env.example

@@ -0,0 +1,18 @@
+# Befund-Schani credential seed.
+# Copy to `.env` (in the working directory or ~/.config/befundschani/.env,
+# or point BEFUNDSCHANI_ENV at it) to pre-fill the setup dialog so you don't
+# have to type credentials every time. All keys are optional.
+
+HOMESERVER=
+MATRIX_USERNAME=
+MATRIX_PASSWORD=
+MATRIX_RECOVERY_KEY=
+
+# Optional — also seedable:
+# DAME_INBOX=
+# DAME_OUTBOX=
+# DAME_ARCHIVE=
+# ME_NUMBER=
+# medspeak API for ME/MXID lookups — defaults to the HOMESERVER itself;
+# set only if the API runs on a different host:
+# API_BASE_URL=

befundschani-0.1.0/.gitignore

@@ -0,0 +1,19 @@
+dame/*
+build/
+dist/
+*.spec
+__pycache__/
+*.pycsite/
+
+# Keep the hand-written PyInstaller spec (generated ones stay ignored)
+!befundschani.spec
+
+# Local credential seed — never commit
+.env
+
+# Demo befunde carry real ME numbers (PII) — never commit
+/tests/data/demo_befund_*.bef
+dist-windows/
+dist-wheels/
+packaging/windows/harvested.wxs
+dist-macos/

befundschani-0.1.0/.gitlab-ci.yml

@@ -0,0 +1,91 @@
+stages:
+  - build
+  - package
+  - publish
+
+# Windows MSI pipeline (three stages, no Windows runner needed):
+#   1. build-olm-windows-wheel  cross-compiles python-olm with mingw-w64
+#      (no Windows wheels exist upstream; libolm is linked statically).
+#   2. build-windows-bundle     runs PyInstaller inside Wine (Windows Python).
+#   3. build-windows-msi        compiles the WiX sources natively with wixl.
+# Runs automatically on tags and on pipelines started from the web UI
+# ("Run pipeline"). Individual `when: manual` jobs would not work here:
+# GitLab skips jobs whose `needs` point at an optional manual job that
+# was never started, so the three-job chain could never complete.
+.windows-rules: &windows-rules
+  rules:
+    - if: $CI_COMMIT_TAG
+    - if: $CI_PIPELINE_SOURCE == "web"
+
+build-olm-windows-wheel:
+  stage: build
+  image: debian:bookworm
+  <<: *windows-rules
+  before_script:
+    - apt-get update -qq
+    # gcc: olm's python/Makefile preprocesses headers with the HOST cc.
+    - apt-get install -yqq --no-install-recommends
+      gcc mingw-w64 cmake make curl ca-certificates unzip
+      python3 python3-cffi python3-setuptools
+  script:
+    - bash scripts/build_olm_windows_wheel.sh
+  artifacts:
+    paths:
+      - dist-wheels/
+
+build-windows-bundle:
+  stage: package
+  image: tobix/pywine:3.13
+  <<: *windows-rules
+  needs: [build-olm-windows-wheel]
+  script:
+    - bash scripts/build_windows_dist.sh
+  artifacts:
+    paths:
+      - dist-windows/befundschani/
+
+build-windows-msi:
+  stage: package
+  image: debian:bookworm
+  <<: *windows-rules
+  needs: [build-windows-bundle]
+  before_script:
+    - apt-get update -qq
+    - apt-get install -yqq --no-install-recommends msitools wixl python3
+  script:
+    - bash scripts/build_windows_msi.sh
+  artifacts:
+    paths:
+      - dist-windows/*.msi
+
+# macOS: no CI job — there is no macOS runner available (GitLab SaaS macOS
+# runners need Premium). Build locally on a Mac: `make dmg`
+# (scripts/build_macos_dmg.sh). Re-add a job with a runner tag if a Mac
+# runner is ever registered.
+
+build:
+  stage: build
+  image: python:3.13-slim
+  rules:
+    - if: $CI_COMMIT_TAG
+  script:
+    - pip install build
+    - python -m build
+  artifacts:
+    paths:
+      - dist/
+
+publish-pypi:
+  stage: publish
+  image: python:3.13-slim
+  rules:
+    - if: $CI_COMMIT_TAG
+  environment: pypi
+  # OIDC token for PyPI Trusted Publishing (no API key stored in CI).
+  # twine >= 6.1 detects PYPI_ID_TOKEN and exchanges it against PyPI itself.
+  id_tokens:
+    PYPI_ID_TOKEN:
+      aud: pypi
+  script:
+    - pip install -U "twine>=6.1"
+    - twine upload dist/*

befundschani-0.1.0/CHANGELOG.md

@@ -0,0 +1,63 @@
+# Changelog
+
+## Unreleased
+
+- CI: PyPI release pipeline on git tags via Trusted Publishing (OIDC, GitLab environment "pypi"), no stored token
+- Outbox pipeline: DaMe outbox → EDIFACT parse → ME→MXID lookup (medspeak API) → encrypted Matrix send → archive
+- Inbox pipeline: Matrix documents (.pdf/.lab/.bef/.req/.edf) → DaMe inbox + read receipt; auto-join invites
+- medspeak API client with Matrix-OpenID token lifecycle (request/cache/refresh, no API key)
+- Device verification: recovery-key (SSSS) self-signing and emoji/SAS verification in the settings dialog
+- Matrix layer migrated from mautrix to matrix-nio[e2e] with a real persistent crypto store (nio_store/)
+- Daemon rewritten as asyncio application; IPC wire protocol unchanged; setup-required gate + unverified warning
+- Settings dialog: archive folder picker; daemon is paused during Matrix setup (single-process store)
+- Packaging: hatchling build backend so console scripts and tests work from an installed package
+- Tray app: first-run auto-launches setup; Settings/Show-Hide/Quit context menu; open DaMe inbox
+- Own ME number: fetched from the medspeak API (GET /api/v1/me) at setup, manual fallback field
+- Outbox sender-check + inbox recipient-check against the own ME number (both off when unset)
+- PyInstaller bundle (befundschani.spec): setup wizard + daemon; setup installs the service then runs setup
+- Cross-platform service installer (systemd/launchd/Windows) with frozen-exe paths; daemon pause/resume via IPC
+- Setup: expired saved token no longer dead-ends — falls back to password entry instead of a hard error
+- .env credential seeding (HOMESERVER/MATRIX_USERNAME/MATRIX_PASSWORD/MATRIX_RECOVERY_KEY, folders, ME) to skip re-typing
+- Setup verification no longer hangs: SAS sync drops full_state, waits a bounded 3 min, then lets setup finish unverified
+- Request timeouts (20 s) on all setup HTTP calls (verification + medspeak API) so a slow homeserver can't stall setup
+- Quit now works even with the Settings dialog open: its background worker is stopped and process exit is guaranteed
+- Settings OK button enabled only after a fresh successful Test Connection; any credential/security-key change disables it
+- .env credentials override a saved config (fixes seeded HOMESERVER not showing); a seeded password logs in fresh instead of reusing a stale token
+- Username normalization: accepts @user, user, @user:domain or user:domain — logged in as a full MXID (missing domain from homeserver)
+- Default homeserver is https://medspeak.io (unless a saved config or .env overrides); homeserver input normalized to https://
+- Settings: Connection and Folder groups now use a form layout (aligned labels) instead of ad-hoc rows
+- Live per-keystroke field validation (Qt6 validators): homeserver/username/recovery-key turn red while invalid
+- ME/mailbox number is free text (any practice identifier; no ME-prefix required) — also in the EDIFACT parser
+- Main window redesigned for medical staff (German): connection status, medspeak-ID, ME number, and a colour-coded list of sent/received/failed documents
+- About dialog explains the app, credits the medspeak association, links to medspeak.io; shows the Befund-Schani + medspeak logos
+- Befund-Schani mascot (assets/logo.svg) is the app/window/taskbar/tray icon and the main-window header
+- Test Connection reuses a valid saved session (same device, no re-verification); a fresh device is created only on a real password login
+- Test helper to wrap a plain PDF into a sendable DaMe befund (tests/edifact_helpers.py: make_befund + random_me_number); scripts/make_demo_befunde.py generates demo befunde outside the repo
+- Dialogs say "DaMe/GNV/medicalNet" and note that Befund-Schani does not affect their normal operation
+- Recovery key field is masked (like the password) and validated live against its real format (base58 SSSS key)
+- Full Qt6 i18n: all UI strings via tr() (English source), German translation bundled (befundschani_de.qm); locale-aware loader also localizes Qt's standard buttons
+- Settings: "Automatic Start" group with "Set up as a service" button; OS-specifics encapsulated in ServiceManager classes
+- Fix: self-sent documents addressed to the own ME number now land in the DaMe inbox (sync echo was dropped before)
+- Fix: source-mode service unit starts the daemon as a module (relative imports broke every systemd/launchd start)
+- Settings: folder/ME-only changes save via OK without a new connection test; credential edits still require one
+- Settings: window is resizable now; the autostart button is only shown while the service is not installed yet
+- Main window lists skipped documents (wrong recipient) instead of dropping them silently
+- medspeak API base URL now follows the homeserver (test server talks to test API); .env API_BASE_URL overrides
+- Main window shows "Connected to <server>" with the real homeserver domain instead of a hardcoded "medspeak"
+- Settings: ME number is optional — own block with checkbox below the connection test; auto-fetched when enabled
+- Connection test checks the medspeak account: missing account/ME shows a danger notice + one-time browser login link
+- Settings: ME number entry is locked until a connection test has succeeded (or an untouched tested session exists)
+- ME number: info note on the checkbox; sending is only active with an ME number (daemon skips the outbox without one)
+- An API-verified ME number becomes read-only (own_me_verified persisted) — removable only by unchecking the box
+- Fix: a removed ME number (saved as null) is no longer re-enabled by the ME_NUMBER seed from .env
+- Split ME identity from function toggles: "send via medspeak" and "deliver to DaMe inbox" — daemon honors both
+- ME number is now fully API-driven: read-only field filled by the connection test; no checkbox/manual entry
+- Settings: ME auto-refresh on open, hint label, profile-link button beside the field; both toggles need an ME
+- Settings: start/stop buttons for the background service (state-aware, OS-independent via ServiceManager)
+- Spelling "medSpeak" in all user-visible texts; About: version, AGPL-3.0 license link, GitLab source link
+- Main window: 50% larger logo, version + medSpeak association under the title; Help menu opens GitLab issues
+- Main window: "medSpeak ID" label without "Your" (consistent with "ME number")
+- Wrong-recipient reports are delivered to the DaMe inbox anyway, with a clear "Recipient mismatch" log warning
+- Main window 50% wider; message list gets a context menu with "Copy message" (clipboard)
+- Windows MSI pipeline: mingw cross-built python-olm wheel, PyInstaller under Wine, WiX/wixl MSI packaging
+- macOS target: build script + `make dmg` (native .app/DMG on a Mac; manual CI job for macOS runners)