Merge remote-tracking branch 'origin/release/3.0.0' into feature/consolidate-migrations

# Conflicts:
#	CHANGELOG.md

Author: turegjorup

.env

@@ -30,12 +30,17 @@ TRUSTED_PROXIES=127.0.0.1,REMOTE_ADDR
 ###< symfony/framework-bundle ###
 
 ###> doctrine/doctrine-bundle ###
+# Doctrine `serverVersion` for dialect selection — must match the running
+# MariaDB. Default tracks the docker-compose default (mariadb:11.4);
+# override MARIADB_VERSION (and the matching MARIADB_IMAGE in compose) to
+# test against 10.11.
+MARIADB_VERSION=11.4.4-MariaDB
 # Database connection string for MariaDB/MySQL.
 # Format described at https://www.doctrine-project.org/projects/doctrine-dbal/en/latest/reference/configuration.html#connecting-using-a-url
 # IMPORTANT: You MUST configure your server version, either here or in config/packages/doctrine.yaml
 #
 # DATABASE_URL="sqlite:///%kernel.project_dir%/var/data.db"
-DATABASE_URL="mysql://db:db@mariadb:3306/db?serverVersion=10.11.5-MariaDB"
+DATABASE_URL="mysql://db:db@mariadb:3306/db?serverVersion=${MARIADB_VERSION}"
 #DATABASE_URL="postgresql://db_user:db_password@127.0.0.1:5432/db_name?serverVersion=13&charset=utf8"
 ###< doctrine/doctrine-bundle ###
 
@@ -72,6 +77,13 @@ JWT_SCREEN_REFRESH_TOKEN_TTL=2592000
 REDIS_CACHE_PREFIX=DisplayApiService
 # Connection string for Redis cache server.
 REDIS_CACHE_DSN=redis://redis:6379/0
+# Session storage backend, consumed by framework.session.handler_id.
+# A `redis://...` DSN makes Symfony auto-build a RedisSessionHandler (with
+# its own `sf_s` key prefix, so cache and session keys don't collide on
+# the same DB). Empty value = PHP's native file handler; pick that for
+# single-pod deployments that don't care about flock-induced tail latency
+# or container-restart session survival.
+SESSION_HANDLER_DSN=${REDIS_CACHE_DSN}
 ###< redis ###
 
 ###> Http Client ###
@@ -96,6 +108,9 @@ KEY_VAULT_JSON="{}"
 TRACK_SCREEN_INFO=false
 # Interval in seconds between screen info updates.
 TRACK_SCREEN_INFO_UPDATE_INTERVAL_SECONDS=300
+# Maximum media upload size in mebibytes (MiB). Read per-request, so no cache:clear needed.
+# Must stay aligned with NGINX_MAX_BODY_SIZE and php-fpm upload_max_filesize / post_max_size.
+MEDIA_MAX_UPLOAD_SIZE_MB=200
 # Toggle the relations checksum optimisation for content updates.
 RELATIONS_CHECKSUM_ENABLED=true
 ###< App ###
@@ -176,6 +191,10 @@ ADMIN_TOUCH_BUTTON_REGIONS=false
 ADMIN_LOGIN_METHODS='[{"type":"username-password","enabled":true,"provider":"username-password","label":""}]'
 # Enable enhanced preview mode with additional features.
 ADMIN_ENHANCED_PREVIEW=false
+# Optional HTML block shown in the login sidebar.
+# Allowed tags: strong, em, b, i, br, p, a, span. Allowed attrs: href, title, target, rel, class.
+# Leave empty to hide the sidebar text card entirely.
+ADMIN_LOGIN_SCREEN_TEXT=
 ###< Admin configuration ###
 
 ###> Client configuration ###

.env.test

@@ -5,7 +5,7 @@ SYMFONY_DEPRECATIONS_HELPER=999999
 PANTHER_APP_ENV=panther
 PANTHER_ERROR_SCREENSHOT_DIR=./var/error-screenshots
 
-DATABASE_URL="mysql://root:password@mariadb:3306/db_test?serverVersion=mariadb-10.5.13"
+DATABASE_URL="mysql://root:password@mariadb:3306/db_test?serverVersion=${MARIADB_VERSION}"
 
 ###> lexik/jwt-authentication-bundle ###
 JWT_SECRET_KEY=%kernel.project_dir%/config/jwt/private.pem
@@ -19,3 +19,6 @@ JWT_SCREEN_TOKEN_TTL=43200
 JWT_REFRESH_TOKEN_TTL=3600
 JWT_SCREEN_REFRESH_TOKEN_TTL=86400
 ###< gesdinet/jwt-refresh-token-bundle ###
+
+# Lowered so testMediaUploadRejectedWhenTooLarge can build a small tmp file.
+MEDIA_MAX_UPLOAD_SIZE_MB=1

.github/workflows/build-images.yml

@@ -98,6 +98,11 @@ jobs:
         uses: docker/metadata-action@v6
         with:
           images: ghcr.io/os2display/display-api-service-nginx
+          # Override the source-repo defaults; without this the Nginx image
+          # would publish title/description copied from display-api-service.
+          labels: |
+            org.opencontainers.image.title=display-api-service-nginx
+            org.opencontainers.image.description=Nginx reverse proxy fronting the OS2Display API image
           tags: |
             # develop branch → 'develop'
             type=ref,event=branch

.github/workflows/doctrine.yaml

@@ -19,7 +19,20 @@ env:
 jobs:
   validate-doctrine-shema:
     runs-on: ubuntu-latest
-    name: Validate Schema
+    strategy:
+      # Don't cancel the 11.x leg if 10.x fails (or vice versa); we want to
+      # see version-specific failures rather than mask one with the other.
+      fail-fast: false
+      matrix:
+        mariadb:
+          - image: mariadb:10.11
+            version: 10.11.13-MariaDB
+          - image: mariadb:11.4
+            version: 11.4.4-MariaDB
+    name: Validate Schema (${{ matrix.mariadb.image }})
+    env:
+      MARIADB_IMAGE: ${{ matrix.mariadb.image }}
+      MARIADB_VERSION: ${{ matrix.mariadb.version }}
     steps:
       - name: Checkout
         uses: actions/checkout@v6
@@ -38,7 +51,7 @@ jobs:
         run: docker compose run --rm -e APP_ENV=prod phpfpm composer install --no-dev -o
 
       - name: Run Doctrine Migrations
-        run: docker compose run --rm -e APP_ENV=prod phpfpm bin/console doctrine:migrations:migrate --no-interaction
+        run: docker compose run --rm -e APP_ENV=prod -e MARIADB_VERSION phpfpm bin/console doctrine:migrations:migrate --no-interaction
 
       - name: Validate Doctrine schema
-        run: docker compose run --rm -e APP_ENV=prod phpfpm bin/console doctrine:schema:validate
+        run: docker compose run --rm -e APP_ENV=prod -e MARIADB_VERSION phpfpm bin/console doctrine:schema:validate

.github/workflows/phpunit.yaml

@@ -19,7 +19,23 @@ env:
 jobs:
   phpunit:
     runs-on: ubuntu-latest
-    name: PHP Unit tests
+    strategy:
+      # Don't cancel the 11.x leg if 10.x fails (or vice versa); we want to
+      # see version-specific failures rather than mask one with the other.
+      fail-fast: false
+      matrix:
+        mariadb:
+          - image: mariadb:10.11
+            version: 10.11.13-MariaDB
+          - image: mariadb:11.4
+            version: 11.4.4-MariaDB
+    name: PHP Unit tests (${{ matrix.mariadb.image }})
+    env:
+      # Picked up by docker-compose.yml's `image: ${MARIADB_IMAGE:-…}`.
+      MARIADB_IMAGE: ${{ matrix.mariadb.image }}
+      # Forwarded into phpfpm via `-e MARIADB_VERSION` below; .env then
+      # interpolates it into Doctrine's `serverVersion` URL parameter.
+      MARIADB_VERSION: ${{ matrix.mariadb.version }}
     steps:
       - name: Checkout
         uses: actions/checkout@v6
@@ -38,7 +54,7 @@ jobs:
         run: docker compose run --rm phpfpm composer install
 
       - name: PHP Unit - Test setup
-        run: docker compose run --rm phpfpm composer run test-setup
+        run: docker compose run --rm -e MARIADB_VERSION phpfpm composer run test-setup
 
       - name: PHP Unit - Run tests
-        run: docker compose run --rm phpfpm composer run test
+        run: docker compose run --rm -e MARIADB_VERSION phpfpm composer run test

CHANGELOG.md

@@ -6,9 +6,40 @@ All notable changes to this project will be documented in this file.
 
 - Consolidated 25 historical 2.x Doctrine migrations into a single end-of-2.8 schema migration; upgraders run `doctrine:migrations:rollup` (see `UPGRADE.md` step 3).
 - Restored three deprecated `Template` properties (`icon`, `resources`, `description`) as write-only fields; scheduled for removal in 3.1.
+- Fixed admin toast leaking a raw `SyntaxError: Unexpected token '<'` when an upload was rejected
+  upstream (e.g. nginx 413); the toast now shows `HTTP <status>` instead.
+- Made the media upload max size configurable via the new `MEDIA_MAX_UPLOAD_SIZE_MB` env var.
+- Fixed playlist share-target dropdown silently truncating to 30 tenants; it now loads every page.
+- Refactored InteractiveController to use a typed `InteractiveSlideActionInput` DTO; regenerated API spec and RTK types.
+- Fixed multiple InstantBook bugs: interval boundary overlap, busy-interval timezone, per-resource spam-protect
+  throttling, duration validation, error responses (409/4xx), resource cache TTL, and assorted
+  typos/string-interpolation issues.
+- Added `getBusyIntervals` cache (PT15M) with a shared `validateResourceAccess()` helper, eliminating per-poll Graph
+  calls at the cost of up to 15-minute-stale availability in `quickBookOptions`.
+
+## [3.0.0-rc3] - 2026-05-11
+
+- Made the Admin login sidebar text configurable via the new `ADMIN_LOGIN_SCREEN_TEXT`
+  env var. The value accepts a small allow-list of HTML tags (sanitized client-side
+  with DOMPurify); when empty the sidebar card is hidden entirely. Removed the
+  bundled Danish "medarbejder/borger MitID" copy that previously rendered by default.
+- Fixed login screen styling issue resulting in header not filling parent in some breakpoints.
 - Fixed Calendar and Colibo feed configuration urls and added [] result when no locationEndpoint is set.
 - Fixed baked-in `.env` shipping `APP_ENV=dev` in the API image; rewritten to `prod` at build time so
   direct reads don't try to bootstrap a dev environment the prod-only dependencies can't satisfy.
+- Aligned API and Nginx image labels with the OCI image spec: dropped deprecated `LABEL maintainer`,
+  added `org.opencontainers.image.{authors,vendor,documentation,base.name}`, and fixed the Nginx image's
+  `title`/`description` so it stops inheriting the source-repo defaults.
+- Bumped the local dev Redis image from `redis:6` to `redis:8`. Production deployments are unaffected
+  (they bring their own Redis); Symfony 6.4's cache adapter and the bundled phpredis 6.3 work as-is.
+- Switched Symfony session storage to Redis (default `SESSION_HANDLER_DSN=${REDIS_CACHE_DSN}`); set
+  `SESSION_HANDLER_DSN=` empty to fall back to PHP's native file handler. Removes the per-session
+  `flock` that serialised parallel session-touching requests and lets sessions survive container
+  restarts; multi-pod deployments now share session state without sticky routing.
+- Switched local dev MariaDB to upstream `mariadb:11.4` LTS (was `itkdev/mariadb:latest`); both 10.11
+  and 11.4 LTS are now exercised by a CI matrix in the PHPUnit and Doctrine schema-validate workflows.
+  `MARIADB_IMAGE` and `MARIADB_VERSION` env vars override the compose image and Doctrine
+  `serverVersion`. Drops the previously-commented `ENCRYPT=1` toggle inherited from the itkdev wrapper.
 
 ## [3.0.0-rc2] - 2026-05-05
 

README.md

@@ -145,6 +145,22 @@ The fixtures have an editor user: <editor@example.com> with the password: "apass
 
 The fixtures have the image-text template, and two screen layouts: "full screen" and "two boxes".
 
+### Database (MariaDB)
+
+Local dev defaults to `mariadb:11.4` (LTS until May 2029). CI also exercises `mariadb:10.11` (LTS until
+Feb 2028) via a matrix in `phpunit.yaml` and `doctrine.yaml`. Two env vars control the version:
+
+- `MARIADB_IMAGE` — the docker image used by the `mariadb` compose service.
+- `MARIADB_VERSION` — the Doctrine `serverVersion` interpolated into `DATABASE_URL` in `.env` /
+  `.env.test`. Must match the running server, or Doctrine will emit dialect-incompatible SQL.
+
+To run the local stack against 10.11:
+
+```shell
+docker compose down -v
+MARIADB_IMAGE=mariadb:10.11 MARIADB_VERSION=10.11.13-MariaDB docker compose up -d
+```
+
 ## Production setup
 
 A JWT Auth keypair should be generated. See [JWT Auth](#jwt-auth).
@@ -436,6 +452,7 @@ KEY_VAULT_SOURCE=ENVIRONMENT
 KEY_VAULT_JSON="{}"
 TRACK_SCREEN_INFO=false
 TRACK_SCREEN_INFO_UPDATE_INTERVAL_SECONDS=300
+MEDIA_MAX_UPLOAD_SIZE_MB=200
 ###< App ###
 ```
 
@@ -451,6 +468,15 @@ TRACK_SCREEN_INFO_UPDATE_INTERVAL_SECONDS=300
 - EVENTDATABASE_API_V2_CACHE_EXPIRE_SECONDS: What should the expire be for cache entries in EventDatabaseApiV2FeedType?
 - TRACK_SCREEN_INFO: Should screen info be tracked (true|false)?
 - TRACK_SCREEN_INFO_UPDATE_INTERVAL_SECONDS: How often (seconds) should the screen info be tracked from API requests?
+- MEDIA_MAX_UPLOAD_SIZE_MB: Maximum allowed size (in megabytes, binary MiB) for media uploads. Enforced inside
+  `App\Controller\Api\MediaController` and exposed to the Admin via `/config/admin` so the dropzone size check and
+  the displayed "Max-size" label stay aligned. Must also be aligned with the nginx body-size limit and the PHP-FPM
+  upload/post limits — see [Configuring media upload size limits](#configuring-media-upload-size-limits) below.
+
+  **Default**: `200`.
+
+  Changes are picked up on the next request once PHP-FPM workers see the new env value (in production, restart the
+  php-fpm container or reload the workers). The admin UI re-fetches `/config/admin` on the next page load.
 
 ### Admin configuration
 
@@ -464,6 +490,7 @@ ADMIN_SHOW_SCREEN_STATUS=false
 ADMIN_TOUCH_BUTTON_REGIONS=false
 ADMIN_LOGIN_METHODS='[{"type":"username-password","enabled":true,"provider":"username-password","label":""}]'
 ADMIN_ENHANCED_PREVIEW=false
+ADMIN_LOGIN_SCREEN_TEXT=''
 ###< Admin configuration ###
 ```
 
@@ -513,6 +540,16 @@ ADMIN_ENHANCED_PREVIEW=false
   See [Preview mode in the Client](#preview-mode-in-the-client).
 
   **Default**: Disabled.
+- ADMIN_LOGIN_SCREEN_TEXT: Optional explanatory text rendered in the sidebar card on the Admin login page.
+  Accepts a small allow-list of HTML tags (`strong`, `em`, `b`, `i`, `br`, `p`, `a`, `span`) and attributes
+  (`href`, `title`, `target`, `rel`, `class`); the value is sanitized client-side with DOMPurify before being
+  rendered. Leave empty to hide the sidebar card entirely.
+
+  ```dotenv
+  ADMIN_LOGIN_SCREEN_TEXT='<p>Er du <strong>medarbejder</strong> skal du benytte medarbejderlogin.</p><p>Er du <strong>borger</strong> skal du benytte MitID login.</p>'
+  ```
+
+  **Default**: Empty (no sidebar card shown).
 
 ### Client configuration
 
@@ -561,6 +598,21 @@ CLIENT_DEBUG=false
 
   **Default**: Disabled.
 
+### Configuring media upload size limits
+
+The maximum size of an uploaded media file is enforced at three independent layers. They must be kept aligned —
+the strictest one wins, and when nginx or PHP-FPM rejects a request the user sees a generic 413 / network error
+rather than the friendly Symfony validator message. Keep them ordered as: **PHP-FPM ≥ nginx ≥ app**.
+
+| Layer | Knob | Where it lives |
+|---|---|---|
+| App (Symfony validator + Admin UI) | `MEDIA_MAX_UPLOAD_SIZE_MB` (megabytes, integer) | `.env` (committed default `200`) — override in `.env.local` for development or in the deployment environment for production |
+| Nginx request body | `NGINX_MAX_BODY_SIZE` (nginx size string, e.g. `200m`) | `docker-compose.yml` and `docker-compose.server.yml`; image default is `200m` (set in `infrastructure/nginx/Dockerfile`) |
+| PHP-FPM upload + post body | `PHP_UPLOAD_MAX_FILESIZE`, `PHP_POST_MAX_SIZE` (PHP size strings, e.g. `200M`) | Operator-managed env vars on the php-fpm container (supported by the `itkdev/php8.4-fpm` base image). Not set in this repo by default — base image defaults apply unless overridden |
+
+The app reads `MEDIA_MAX_UPLOAD_SIZE_MB` per-request, so a deploy / php-fpm worker reload is enough to pick up
+changes; no validator cache clear is needed.
+
 ### Other configuration options
 
 - See `docs/configuration/openid-connect.md` for configuration of OpenID Connect.

Taskfile.yml

@@ -217,7 +217,7 @@ tasks:
     desc: "Runs API tests (PHPUnit)."
     cmds:
       - task composer -- test-setup
-      - task compose -- exec --env SYMFONY_DEPRECATIONS_HELPER=disabled phpfpm vendor/bin/phpunit --stop-on-failure {{.CLI_ARGS}}
+      - task compose -- exec phpfpm vendor/bin/phpunit --stop-on-failure {{.CLI_ARGS}}
 
   test:frontend-built:
     desc: "Runs frontend tests (Playwright) on the built files. This temporarily stops the node container."

assets/admin/components/navigation/login-sidebar/login-sidebar.jsx

@@ -1,22 +1,37 @@
-import { useTranslation, Trans } from "react-i18next";
+import { useEffect, useState } from "react";
+import DOMPurify from "dompurify";
+import AdminConfigLoader from "../../util/admin-config-loader";
 import Logo from "../logo";
 
+const SANITIZE_OPTIONS = {
+  ALLOWED_TAGS: ["strong", "em", "b", "i", "br", "p", "a", "span"],
+  ALLOWED_ATTR: ["href", "title", "target", "rel", "class"],
+};
+
 const LoginSidebar = () => {
-  const { t } = useTranslation("common", { keyPrefix: "login-sidebar" });
+  const [customHtml, setCustomHtml] = useState("");
+
+  useEffect(() => {
+    AdminConfigLoader.loadConfig().then((cfg) => {
+      const raw = cfg?.loginScreenText?.trim();
+      if (raw) setCustomHtml(DOMPurify.sanitize(raw, SANITIZE_OPTIONS));
+    });
+  }, []);
 
   return (
     <div className="background-image-screens p-4 col-md-4">
       <Logo />
-      <div className="card text-white bg-dark mb-3 border border-color-white">
-        <div className="card-body">
-          <p className="card-text" id="ad-explanation">
-            <Trans>{t("internal-info-text")}</Trans>
-          </p>
-          <p className="card-text" id="mitid-explanation">
-            <Trans>{t("external-info-text")}</Trans>
-          </p>
+      {customHtml && (
+        <div className="card text-white bg-dark mb-3 border border-color-white">
+          <div className="card-body">
+            <div
+              className="card-text"
+              // eslint-disable-next-line react/no-danger
+              dangerouslySetInnerHTML={{ __html: customHtml }}
+            />
+          </div>
         </div>
-      </div>
+      )}
     </div>
   );
 };

assets/admin/components/playlist/playlist-form.jsx

@@ -1,9 +1,11 @@
-import { useContext } from "react";
+import { useContext, useEffect, useState } from "react";
 import { useTranslation } from "react-i18next";
+import { useDispatch } from "react-redux";
 import { Alert } from "react-bootstrap";
 import UserContext from "../../context/user-context";
 import Schedule from "../util/schedule/schedule";
-import { useGetV2TenantsQuery } from "../../../shared/redux/enhanced-api.ts";
+import { enhancedApi } from "../../../shared/redux/enhanced-api.ts";
+import getAllPages from "../util/helpers/get-all-pages.js";
 import ContentBody from "../util/content-body/content-body";
 import TenantsDropdown from "../util/forms/multiselect-dropdown/tenants/tenants-dropdown";
 
@@ -24,10 +26,20 @@ function PlaylistForm({
 }) {
   const { t } = useTranslation("common", { keyPrefix: "playlist-form" });
   const context = useContext(UserContext);
+  const dispatch = useDispatch();
+  const [tenants, setTenants] = useState(null);
 
-  const { data: tenants } = useGetV2TenantsQuery({
-    itemsPerPage: 30,
-  });
+  useEffect(() => {
+    let cancelled = false;
+    getAllPages(dispatch, enhancedApi.endpoints.getV2Tenants, {
+      itemsPerPage: 30,
+    }).then((all) => {
+      if (!cancelled) setTenants(all);
+    });
+    return () => {
+      cancelled = true;
+    };
+  }, [dispatch]);
 
   return (
     <>
@@ -51,7 +63,7 @@ function PlaylistForm({
               name="tenants"
               handleTenantSelection={handleInput}
               selected={playlist.tenants}
-              data={tenants["hydra:member"].filter(({ tenantKey }) => {
+              data={tenants.filter(({ tenantKey }) => {
                 return context.selectedTenant.get.tenantKey !== tenantKey;
               })}
             />