Back to Changelog
Security
0.2.0v0.2.0 — Crew Day Pay, Weekly Overtime, and 100+ Fixes
This release resolves critical crew payment issues, ships weekly overtime calculations, and delivers over 100 fixes across inventory, finance, RBAC, and security. Highlights include accurate crew day contractor pay, day-rate handling for times-TBD calls, invoice import number preservation, complete RBAC template coverage, impersonation token security hardening, and pagination on major list pages.
What's new
- Weekly overtime now calculates correctly for crew pay. Hours worked across all projects in the same week count toward your weekly overtime threshold, and the premium applies to pay only (never shown to clients). The calculation follows the FLSA regular rate method and won't double-count hours already paid as daily overtime. (#1339, #1348, OVA-530)
- Day-rate crew assignments with times still TBD now bill and pay the committed day rate instead of $0. Before, a crew member with a locked day rate would show on quotes as $0 until call times were set. Hourly assignments still wait for times, but day/half-day/flat rates are no longer dependent on the clock. (#1343, OVA-529)
- The Location column on project equipment now shows the warehouse name for everyone. Previously, read-only users saw a UUID or nothing at all; now the source location is visible whether you can edit it or not. (#1327, #1334, OVA-680)
- Import now preserves the invoice number printed on the original document. When you import invoices or quotes, the system recovers the document number from the PDF even when the AI extraction misses it, and warns you during review if it genuinely cannot find one instead of silently renumbering. (#1287, OVA-645)
- You can now create and manage equipment categories and surcharge templates again. These endpoints returned HTTP 500 for months due to a missing database column; the fix has been deployed and verified live. (#1276, OVA-546)
- Pagination adopted on six major list pages. POS sales history, damage records, vendors, crew assignments, job templates, and inventory kits no longer truncate at 50–200 items; you can page through the full list. (#1338, #1347, #1357, OVA-688, OVA-689, OVA-697)
- 103 icon-only buttons now have accessible names for screen readers. Camera buttons show a loading state while uploading. Rating pickers are keyboard-navigable with a focus ring. Same-origin navigation no longer triggers full page reloads. (#1338, OVA-688)
- Changelog entries now display full release notes with markdown formatting, and 'Open' links go to the right place. Entries visible only in-app or on the beta portal now link to the app, not the public website where they would 404. (#1318, #1320)
- Equipment and container records created through agents now include all 93 writable fields—weight, dimensions, cable specs, depreciation inputs, packing geometry, and the entire production-visualization block. Previously only 15–17 fields were reachable. (#1344, OVA-692)
Billing, invoices & payments
- Quote-to-invoice conversion via client portal now strips managed-section metadata and cleans up non-billable items correctly. Previously this path inherited auto-managed tags (making sections read-only with no sync) and billed for items marked show_on_invoice=false. (#1328, OVA-683)
- Assignments can now be kept off the client's quote even when they're part of the job. A new include_on_quote flag lets you mark assignments (like comped supervisors) that bill $0 to the client while still tracking their cost and pay. (#1171, OVA-513)
- Agent tools for adding or updating invoice and quote line items now preserve duration and other item metadata. Previously any agent change to one line reset duration to 1 on every line document-wide, cutting rental revenue by two-thirds on multi-day items. (#1330, OVA-677)
Fixed & restored
- Crew day contractor pay calculations now cap each timesheet submission to the day's remaining budget, preventing double-pay. Measured on pilot data: two assignment-days that would have overpaid contractors by $1,295 now settle correctly at one day's rate regardless of how many approved submissions exist. (#1341, #1345, OVA-691)
- Crew day booking status now refreshes when crew advance through offered → accepted → checked in → completed. Previously the status froze at whatever it was when the day was first created, making accepted crew appear as 'draft' in the scheduling UI. (#1356, OVA-693)
- The open-task count on your dashboard now matches the task list you actually see. Members without tasks.view_all were seeing a whole-workspace count above a list showing only their own tasks; the KPI is now scoped the same way the list is. (#1326, OVA-679)
- All 196 permissions are now reachable through role templates. Permissions for CRM, tasks, iCal, POS, signing, QBO integrations, projects, locations, contractors, client portal, messaging, and webhooks were seeded into the database but missing from every system template, making them unassignable through the UI. (#1325, #1329, OVA-678, OVA-681)
- The general.view permission is now on all four system templates. Without it, members provisioned from Viewer, Crew Member, Manager, or Workspace Admin couldn't load a workspace at all—they'd see an empty workspace switcher. (#1329, OVA-681)
- Project equipment source location names are now sent by the API and displayed correctly on mobile. Read-only mobile users can now see which warehouse a line ships from; previously the location was visible only inside the edit sheet. (#1327, #1334, OVA-680)
Security & permissions
- Impersonation tokens no longer travel in URLs. Admin dashboard, mobile admin, and workspace impersonation now redeem one-time tokens via cross-origin form POST instead of query strings, keeping credentials out of browser history, Referer headers, and server access logs. (#1232, #1352, #1353, #1355, #1360, OVA-476, OVA-564, OVA-702, OVA-707)
- Workspace iCal feed credentials are now redacted from ical.view responses for users without ical.manage. Previously anyone with ical.view could read the workspace feed token—an unauthenticated, permanent, whole-workspace calendar credential that bypassed task-visibility scoping. (#1332, #1333, OVA-685)
- Impersonation origin guard now requires an exact match to the configured shadow host. The previous check accepted any hostname starting with 'shadow.', including domains not controlled by Ovation. (#1351, OVA-517)