added support for 2fa login with browser flow

show classname instead of teacher name in teacher timetable view
enhanced route transition gate because of a syncfusion viewer bug
2026-08-10 20:00:38 +02:00 · 2026-08-09 12:19:57 +02:00 · 2026-08-08 22:13:19 +02:00 · 2026-08-07 21:36:09 +02:00 · 2026-08-07 21:25:08 +02:00 · 2026-08-06 20:30:20 +02:00
226 changed files with 6954 additions and 2098 deletions
@@ -65,5 +65,9 @@ flutter {

 dependencies {
    implementation 'com.android.support:multidex:2.0.1'
+    // Same version as workmanager_android pins — needed to enqueue its
+    // BackgroundWorker from native widget code (the plugin uses
+    // `implementation`, so androidx.work is not exposed transitively).
+    implementation 'androidx.work:work-runtime:2.11.2'
    coreLibraryDesugaring 'com.android.tools:desugar_jdk_libs:2.1.4'
 }
@@ -4,6 +4,7 @@ import android.appwidget.AppWidgetManager
 import android.appwidget.AppWidgetProvider
 import android.content.Context
 import android.os.Bundle
+import eu.mhsl.marianum.mobile.client.widgets.WidgetRefreshRequester
 import eu.mhsl.marianum.mobile.client.widgets.WidgetRenderer

 /**
@@ -11,6 +12,11 @@ import eu.mhsl.marianum.mobile.client.widgets.WidgetRenderer
 * Flutter plugin resolves the receiver class as `<app-package>.<androidName>`.
 */
 class TimetableDayWidget : AppWidgetProvider() {
+    override fun onEnabled(context: Context) {
+        // First widget of this kind placed → fetch fresh data right away.
+        WidgetRefreshRequester.enqueueOneOffRefresh(context)
+    }
+
    override fun onUpdate(
        context: Context,
        appWidgetManager: AppWidgetManager,
@@ -4,9 +4,15 @@ import android.appwidget.AppWidgetManager
 import android.appwidget.AppWidgetProvider
 import android.content.Context
 import android.os.Bundle
+import eu.mhsl.marianum.mobile.client.widgets.WidgetRefreshRequester
 import eu.mhsl.marianum.mobile.client.widgets.WidgetRenderer

 class TimetableWeekWidget : AppWidgetProvider() {
+    override fun onEnabled(context: Context) {
+        // First widget of this kind placed → fetch fresh data right away.
+        WidgetRefreshRequester.enqueueOneOffRefresh(context)
+    }
+
    override fun onUpdate(
        context: Context,
        appWidgetManager: AppWidgetManager,
@@ -33,6 +33,8 @@ data class WidgetLesson(
    val subjectShort: String,
    val subjectLong: String?,
    val room: String?,
+    // On teacher accounts this carries the class label ("7a") instead of the
+    // teacher short name (originalTeacher is null then) — mapped in Dart.
    val teacher: String?,
    val originalTeacher: String?,
    val status: WidgetLessonStatus,
@@ -0,0 +1,40 @@
+package eu.mhsl.marianum.mobile.client.widgets
+
+import android.content.Context
+import androidx.work.Constraints
+import androidx.work.Data
+import androidx.work.NetworkType
+import androidx.work.OneTimeWorkRequest
+import androidx.work.WorkManager
+import dev.fluttercommunity.workmanager.BackgroundWorker
+
+/**
+ * Enqueues the app's Dart one-off widget refresh from native code, so a
+ * freshly placed widget populates within seconds instead of waiting for the
+ * next periodic slot.
+ *
+ * DART_TASK_KEY is public plugin API but no semver guarantee — re-verify on
+ * workmanager upgrades. The Dart callback handle comes from SharedPreferences
+ * persisted by Workmanager().initialize(); if the app never ran, the worker
+ * fails gracefully and the widget keeps rendering its cached/empty state.
+ */
+object WidgetRefreshRequester {
+    // Mirrors WidgetBackgroundTask.oneOffTaskName on the Dart side.
+    private const val DART_ONE_OFF_TASK = "eu.mhsl.marianum.widget.refresh.once"
+
+    fun enqueueOneOffRefresh(context: Context) {
+        val request = OneTimeWorkRequest.Builder(BackgroundWorker::class.java)
+            .setInputData(
+                Data.Builder()
+                    .putString(BackgroundWorker.DART_TASK_KEY, DART_ONE_OFF_TASK)
+                    .build(),
+            )
+            .setConstraints(
+                Constraints.Builder()
+                    .setRequiredNetworkType(NetworkType.CONNECTED)
+                    .build(),
+            )
+            .build()
+        WorkManager.getInstance(context).enqueue(request)
+    }
+}
@@ -736,8 +736,11 @@ object WidgetRenderer {
        )
    }

+    // Mirrors lib/widget_data/widget_sync.dart (the canonical key list) — a
+    // schema bump must land in Dart, Swift (WidgetData.swift) and here
+    // together, or the out-of-sync platform silently renders empty.
    const val KEY_DAY_DATA = "widget_data_day_v1"
-    const val KEY_WEEK_DATA = "widget_data_week_v1"
+    const val KEY_WEEK_DATA = "widget_data_week_v2"
    const val KEY_LOGGED_IN = "widget_data_logged_in_v1"
    const val KEY_THEME_MODE = "widget_setting_theme_mode_v1"
 }
@@ -0,0 +1,40 @@
+---
+#
+# Hinweis: Die Steuerzeichen ("---") dürfen NICHT entfernt werden!
+# Nach dem zweiten Steuerzeichen wird als Markdown interpretiert und es sind keine Kommentare mehr möglich!
+# Kommentare sind nur innerhalb des Steuerblocks zugelassen, sowie die Variablen.
+#
+# Notfall-Nachricht der MarianumMobile-App
+#
+# Diese Datei wird bei jedem App-Start geladen.
+# Solange 'active' nicht true ist, wird NICHTS angezeigt (Normalzustand).
+#
+# Steuerfelder:
+#   active:      true schaltet die Anzeige ein   (Default: false)
+#   dismissible: true = wegklickbar & gecachte Inhalte der App weiterhin normal sichtbar, false = Vollbild & nicht schließbar (Default: true)
+#   title:       optionale Überschrift
+#
+# Im Notfall: 'active: false' auf 'active: true' setzen, unten Inhalt anpassen.
+# Der Textinhalt wird in Markdown ausgewertet. Siehe https://markdownlivepreview.com/
+# VORSICHT: Hashtags (#) sind in Markdown kein Kommentar sondern "Titel"!
+# Beispielkonfiguration:
+#
+#   ---
+#   # Ein Kommentar
+#   active: true
+#   dismissible: false
+#   title: Wichtiger Hinweis
+#   ---
+#   Hinweistext in Markdown
+#
+# ============================================================================
+
+active: false
+dismissible: true
+title: Hinweis
+---
+# Serverstörung
+Der Zugriff auf einige Funktionen ist derzeit großflächig **eingeschränkt**. Wir arbeiten an einer Lösung.
+Bitte prüfe unter folgendem Link auf aktuelle Informationen der Schulleitung.
+
+- Aktuelle Informationen: [www.marianum-fulda.de](https://www.marianum-fulda.de)
@@ -0,0 +1 @@
+#include "Generated.xcconfig"
@@ -0,0 +1 @@
+#include "Generated.xcconfig"
@@ -0,0 +1 @@
+#include "Generated.xcconfig"
@@ -31,7 +31,7 @@ class NotificationService: UNNotificationServiceExtension {
    /// Must exactly match `kPushKeychainGroup` in lib/push/push_secure_storage.dart
    /// and the `keychain-access-groups` entitlement of BOTH the Runner and this
    /// extension. Wrong value here => keychain reads return nil => placeholder.
-    private static let keychainAccessGroup = "group.eu.mhsl.marianum.mobile.client.widget"
+    private static let keychainAccessGroup = "MY55VF3KPG.eu.mhsl.marianum.mobile.client.push"

    private static let devicePrivateKeyAccount = "push_device_private_key_pem"
    private static let serverPublicKeyAccount = "push_server_public_key_pem"
@@ -233,7 +233,7 @@ class NotificationService: UNNotificationServiceExtension {
    ///   kSecClass       = kSecClassGenericPassword
    ///   kSecAttrAccount = the Dart key, verbatim
    ///   kSecAttrService = (unset — the Dart IOSOptions set no accountName)
-    ///   kSecAttrAccessGroup = the App Group id
+    ///   kSecAttrAccessGroup = the team-prefixed shared keychain group
    ///   value           = raw UTF-8 bytes of the string
    private func keychainString(_ account: String) -> String? {
        let query: [CFString: Any] = [
@@ -8,7 +8,7 @@
 	</array>
 	<key>keychain-access-groups</key>
 	<array>
-		<string>group.eu.mhsl.marianum.mobile.client.widget</string>
+		<string>$(AppIdentifierPrefix)eu.mhsl.marianum.mobile.client.push</string>
 	</array>
 </dict>
 </plist>
@@ -55,8 +55,9 @@ iOS zeigt die fertige Notification
 | `ios/Runner/AppDelegate.swift` | **geändert** | TALK_MESSAGE-Category + native Action-Behandlung |
 | `lib/push/push_registration_store.dart` | **geändert** | schreibt `nextcloud_username` + `nextcloud_base_url` group-scoped |
 | `lib/push/push_registration.dart` | **geändert** | `_persistNativeAuthContext()` bei `register()` |
-| **Xcode-Target „NotificationServiceExtension"** | **FEHLT** | muss in Xcode angelegt werden (Abschnitt 3) |
-| `ios/Runner.xcodeproj/project.pbxproj` | **unverändert** | bewusst NICHT von Hand editiert — Xcode legt das Target an |
+| **Xcode-Target „NotificationServiceExtension"** | **existiert** | programmatisch via `xcodeproj`-Gem angelegt (2026-07-07), gespiegelt an der Share-Extension |
+| `ios/Runner.xcodeproj/project.pbxproj` | **geändert** | NSE-Target, Dependency + „Embed Foundation Extensions" ergänzt |
+| `ios/Flutter/NotificationServiceExtension-{Debug,Release,Profile}.xcconfig` | **neu** | Base-Configs, inkludieren `Generated.xcconfig` (Flutter-Versionsvariablen) |

 > **Wichtig:** Die vier Dateien unter `ios/NotificationServiceExtension/` liegen
 > schon auf der Platte. Beim Anlegen des Targets erzeugt Xcode eigene
@@ -67,6 +68,15 @@ iOS zeigt die fertige Notification

 ## 3. Xcode-Checkliste (auf dem Mac)

+> **Stand 2026-07-07:** Abschnitte 3.1–3.2 (Target anlegen, Dateien zuordnen) sind
+> bereits **programmatisch** erledigt (via `xcodeproj`-Gem). Der unsignierte Build
+> aller Targets läuft durch (`flutter build ios --no-codesign`), die
+> `NotificationServiceExtension.appex` wird korrekt in `Runner.app/PlugIns/`
+> eingebettet. **Offen bleiben nur noch Signing/Capabilities (3.3–3.4, 3.6)** —
+> die brauchen den Apple-Developer-Account und einen signierten Build/Archive.
+> Die 3.1/3.2-Anleitung unten bleibt als Referenz stehen (falls das Target mal neu
+> aufgesetzt werden muss).
+
 ### 3.1 Target anlegen
 1. `ios/Runner.xcworkspace` in Xcode öffnen (nicht `.xcodeproj`).
 2. **File → New → Target… → iOS → Notification Service Extension**.
@@ -132,7 +142,18 @@ iOS zeigt die fertige Notification
 ## 4. Ermittelte Keychain-Details (verbindlich)

 Die Dart-Seite schreibt mit
-`IOSOptions(groupId: 'group.eu.mhsl.marianum.mobile.client.widget', accessibility: first_unlock)`.
+`IOSOptions(groupId: 'MY55VF3KPG.eu.mhsl.marianum.mobile.client.push', accessibility: first_unlock)`.
+
+> **Wichtig (Stand 2026-07-07):** Als Keychain-Access-Group wird **nicht** mehr die
+> App-Group (`group.*`) genutzt, sondern eine **team-prefixed** Group
+> (`$(AppIdentifierPrefix)eu.mhsl.marianum.mobile.client.push`). Grund: Die
+> Xcode-verwalteten Provisioning-Profile gewähren als `keychain-access-groups`
+> nur `<TeamID>.*` — eine `group.*`-App-Group fällt da **nicht** drunter, was
+> Automatic Signing mit „doesn't match the entitlements file's value for the
+> keychain-access-groups entitlement" abbricht. Runner und NSE teilen die Group,
+> weil sie mit demselben Team (`MY55VF3KPG`) signieren. Der `MY55VF3KPG.`-Prefix
+> ist der stabile AppIdentifierPrefix und in Dart/Swift hart hinterlegt.
+
 Aus dem Quellcode von **`flutter_secure_storage_darwin` 0.3.2** (gepinnt in
 `pubspec.lock`) ergibt sich die exakte Ablage im Keychain:

@@ -141,7 +162,7 @@ Aus dem Quellcode von **`flutter_secure_storage_darwin` 0.3.2** (gepinnt in
 | `kSecClass` | `kSecClassGenericPassword` |
 | `kSecAttrAccount` | der Dart-**Key**, **wortwörtlich** (kein Hash, kein Prefix) |
 | `kSecAttrService` | **nicht gesetzt** (die `IOSOptions` setzen kein `accountName`) |
-| `kSecAttrAccessGroup` | `group.eu.mhsl.marianum.mobile.client.widget` |
+| `kSecAttrAccessGroup` | `MY55VF3KPG.eu.mhsl.marianum.mobile.client.push` (team-prefixed) |
 | `kSecAttrAccessible` | `kSecAttrAccessibleAfterFirstUnlock` (aus `first_unlock`) |
 | Wert (`kSecValueData`) | **rohe UTF-8-Bytes** des Strings (PEM/Passwort im Klartext) |

@@ -278,9 +299,14 @@ ist der fragilste Teil und **muss auf dem Gerät verifiziert werden**:
   innerhalb des NSE-Budgets). Nicht implementiert.
 3. **`aps-environment = production`** ist noch nicht hart gesetzt (Abschnitt 3.6) —
   vor dem Release erledigen und im Archive gegenchecken (5.2).
-4. **Keychain-Access-Group-Schreibweise.** Die Entitlements listen die App-Group
-   ohne `$(AppIdentifierPrefix)` als `keychain-access-groups`. Das ist das von
-   `flutter_secure_storage` erwartete Verhalten (Access-Group == App-Group-ID).
-   Sollte der Keychain-Zugriff wider Erwarten scheitern (Status `-34018` /
-   `errSecMissingEntitlement`), in **beiden** Targets die Keychain-Sharing-
-   Capability über die Xcode-UI neu setzen und Provisioning-Profile erneuern.
+4. **Keychain-Access-Group-Schreibweise (gelöst 2026-07-07).** Die Entitlements
+   listen `$(AppIdentifierPrefix)eu.mhsl.marianum.mobile.client.push` als
+   `keychain-access-groups` (team-prefixed, **keine** App-Group). Damit greift das
+   `<TeamID>.*` der Xcode-Profile und Automatic Signing läuft ohne Portal-Änderung
+   durch (verifiziert: `flutter build ios --release` signiert Runner **und** NSE
+   mit `MY55VF3KPG.eu.mhsl.marianum.mobile.client.push`). Der frühere App-Group-
+   Ansatz (`group.*`) scheiterte an genau diesem Profil-Matching. Falls der
+   Keychain-Zugriff zur Laufzeit doch scheitert (Status `-34018` /
+   `errSecMissingEntitlement`), prüfen, dass Dart (`push_secure_storage.dart`) und
+   Swift (`AppDelegate.swift`, `NotificationService.swift`) **exakt denselben**
+   vollqualifizierten Group-String verwenden.
@@ -4,8 +4,6 @@ PODS:
  - Flutter (1.0.0)
  - flutter_app_badge (2.0.0):
    - Flutter
-  - home_widget (0.0.1):
-    - Flutter
  - open_filex (0.0.2):
    - Flutter
  - PhoneNumberKit (3.7.11):
@@ -14,8 +12,6 @@ PODS:
  - PhoneNumberKit/PhoneNumberKitCore (3.7.11)
  - PhoneNumberKit/UIKit (3.7.11):
    - PhoneNumberKit/PhoneNumberKitCore
-  - receive_sharing_intent (1.8.1):
-    - Flutter
  - workmanager_apple (0.0.1):
    - Flutter

@@ -23,10 +19,8 @@ DEPENDENCIES:
  - eraser (from `.symlinks/plugins/eraser/ios`)
  - Flutter (from `Flutter`)
  - flutter_app_badge (from `.symlinks/plugins/flutter_app_badge/ios`)
-  - home_widget (from `.symlinks/plugins/home_widget/ios`)
  - open_filex (from `.symlinks/plugins/open_filex/ios`)
  - PhoneNumberKit (~> 3.7.6)
-  - receive_sharing_intent (from `.symlinks/plugins/receive_sharing_intent/ios`)
  - workmanager_apple (from `.symlinks/plugins/workmanager_apple/ios`)

 SPEC REPOS:
@@ -40,12 +34,8 @@ EXTERNAL SOURCES:
    :path: Flutter
  flutter_app_badge:
    :path: ".symlinks/plugins/flutter_app_badge/ios"
-  home_widget:
-    :path: ".symlinks/plugins/home_widget/ios"
  open_filex:
    :path: ".symlinks/plugins/open_filex/ios"
-  receive_sharing_intent:
-    :path: ".symlinks/plugins/receive_sharing_intent/ios"
  workmanager_apple:
    :path: ".symlinks/plugins/workmanager_apple/ios"

@@ -53,10 +43,8 @@ SPEC CHECKSUMS:
  eraser: 83a4b06985f3702aa3d8dec816f9693266012937
  Flutter: cabc95a1d2626b1b06e7179b784ebcf0c0cde467
  flutter_app_badge: ca742dd659a157c1090ef7cd881cb78f48f3bcdf
-  home_widget: f169fc41fd807b4d46ab6615dc44d62adbf9f64f
  open_filex: 432f3cd11432da3e39f47fcc0df2b1603854eff1
  PhoneNumberKit: 9ff0c5ae9fe4770193b68a3d3e6c938fe976788c
-  receive_sharing_intent: 222384f00ffe7e952bbfabaa9e3967cb87e5fe00
  workmanager_apple: 904529ae31e97fc5be632cf628507652294a0778

 PODFILE CHECKSUM: 087d168982f24fb137e2d46f893b771b4b9955c6
@@ -12,14 +12,18 @@
 		3321F80F2FB1C00C0011C712 /* Share Extension.appex in Embed Foundation Extensions */ = {isa = PBXBuildFile; fileRef = 3321F8052FB1C00C0011C712 /* Share Extension.appex */; settings = {ATTRIBUTES = (RemoveHeadersOnCopy, ); }; };
 		33FDB0982EE9ABDC000B2391 /* GoogleService-Info.plist in Resources */ = {isa = PBXBuildFile; fileRef = 33FDB0972EE9ABDC000B2391 /* GoogleService-Info.plist */; };
 		3B3967161E833CAA004F5970 /* AppFrameworkInfo.plist in Resources */ = {isa = PBXBuildFile; fileRef = 3B3967151E833CAA004F5970 /* AppFrameworkInfo.plist */; };
+		725388B5C3A724B19BD6FD06 /* NotificationService.swift in Sources */ = {isa = PBXBuildFile; fileRef = 2960F029246C39E2A03F6D87 /* NotificationService.swift */; };
 		74858FAF1ED2DC5600515810 /* AppDelegate.swift in Sources */ = {isa = PBXBuildFile; fileRef = 74858FAE1ED2DC5600515810 /* AppDelegate.swift */; };
+		7832A860F2264966809A9402 /* NotificationServiceExtension.appex in Embed Foundation Extensions */ = {isa = PBXBuildFile; fileRef = C3B91710361EFED8934F0FDC /* NotificationServiceExtension.appex */; settings = {ATTRIBUTES = (RemoveHeadersOnCopy, ); }; };
+		78A318202AECB46A00862997 /* FlutterGeneratedPluginSwiftPackage in Frameworks */ = {isa = PBXBuildFile; productRef = 78A3181F2AECB46A00862997 /* FlutterGeneratedPluginSwiftPackage */; };
 		97C146FC1CF9000F007C117D /* Main.storyboard in Resources */ = {isa = PBXBuildFile; fileRef = 97C146FA1CF9000F007C117D /* Main.storyboard */; };
 		97C146FE1CF9000F007C117D /* Assets.xcassets in Resources */ = {isa = PBXBuildFile; fileRef = 97C146FD1CF9000F007C117D /* Assets.xcassets */; };
 		97C147011CF9000F007C117D /* LaunchScreen.storyboard in Resources */ = {isa = PBXBuildFile; fileRef = 97C146FF1CF9000F007C117D /* LaunchScreen.storyboard */; };
+		97D9AFE39CF2369A97F04721 /* PEM.swift in Sources */ = {isa = PBXBuildFile; fileRef = 509DCCD474353408FE5806C5 /* PEM.swift */; };
 		AA0101070000000011111111 /* TimetableWidgetExtension.appex in Embed Foundation Extensions */ = {isa = PBXBuildFile; fileRef = AA0101020000000011111111 /* TimetableWidgetExtension.appex */; settings = {ATTRIBUTES = (RemoveHeadersOnCopy, ); }; };
 		AA0102010000000022222222 /* SceneDelegate.swift in Sources */ = {isa = PBXBuildFile; fileRef = AA0102020000000022222222 /* SceneDelegate.swift */; };
 		B8263932DB64B022CCEE7A53 /* Pods_Runner.framework in Frameworks */ = {isa = PBXBuildFile; fileRef = 90960A132A5F91779B3FBE28 /* Pods_Runner.framework */; };
-		78A318202AECB46A00862997 /* FlutterGeneratedPluginSwiftPackage in Frameworks */ = {isa = PBXBuildFile; productRef = 78A3181F2AECB46A00862997 /* FlutterGeneratedPluginSwiftPackage */; };
+		C40CF71846788CD98CB99E2B /* Foundation.framework in Frameworks */ = {isa = PBXBuildFile; fileRef = F5B421EAF56B77B775E58E92 /* Foundation.framework */; };
 /* End PBXBuildFile section */

 /* Begin PBXContainerItemProxy section */
@@ -37,6 +41,13 @@
 			remoteGlobalIDString = AA0101010000000011111111;
 			remoteInfo = TimetableWidgetExtension;
 		};
+		AABEF26FF24F76E01DA5ADEA /* PBXContainerItemProxy */ = {
+			isa = PBXContainerItemProxy;
+			containerPortal = 97C146E61CF9000F007C117D /* Project object */;
+			proxyType = 1;
+			remoteGlobalIDString = AEDC710FEBFF2CC736D88AB2;
+			remoteInfo = NotificationServiceExtension;
+		};
 /* End PBXContainerItemProxy section */

 /* Begin PBXCopyFilesBuildPhase section */
@@ -48,6 +59,7 @@
 			files = (
 				3321F80F2FB1C00C0011C712 /* Share Extension.appex in Embed Foundation Extensions */,
 				AA0101070000000011111111 /* TimetableWidgetExtension.appex in Embed Foundation Extensions */,
+				7832A860F2264966809A9402 /* NotificationServiceExtension.appex in Embed Foundation Extensions */,
 			);
 			name = "Embed Foundation Extensions";
 			runOnlyForDeploymentPostprocessing = 0;
@@ -65,17 +77,24 @@
 /* End PBXCopyFilesBuildPhase section */

 /* Begin PBXFileReference section */
+		12B96C78930441C73F123636 /* Info.plist */ = {isa = PBXFileReference; includeInIndex = 1; lastKnownFileType = text.plist.xml; name = Info.plist; path = Info.plist; sourceTree = "<group>"; };
 		1498D2321E8E86230040F4C2 /* GeneratedPluginRegistrant.h */ = {isa = PBXFileReference; lastKnownFileType = sourcecode.c.h; path = GeneratedPluginRegistrant.h; sourceTree = "<group>"; };
 		1498D2331E8E89220040F4C2 /* GeneratedPluginRegistrant.m */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.objc; path = GeneratedPluginRegistrant.m; sourceTree = "<group>"; };
+		17E2EE012C4361AC05DCA4C9 /* NotificationServiceExtension-Release.xcconfig */ = {isa = PBXFileReference; includeInIndex = 1; lastKnownFileType = text.xcconfig; name = "NotificationServiceExtension-Release.xcconfig"; path = "Flutter/NotificationServiceExtension-Release.xcconfig"; sourceTree = "<group>"; };
+		2960F029246C39E2A03F6D87 /* NotificationService.swift */ = {isa = PBXFileReference; includeInIndex = 1; lastKnownFileType = sourcecode.swift; name = NotificationService.swift; path = NotificationService.swift; sourceTree = "<group>"; };
 		3321F8052FB1C00C0011C712 /* Share Extension.appex */ = {isa = PBXFileReference; explicitFileType = "wrapper.app-extension"; includeInIndex = 0; path = "Share Extension.appex"; sourceTree = BUILT_PRODUCTS_DIR; };
 		33FDB0972EE9ABDC000B2391 /* GoogleService-Info.plist */ = {isa = PBXFileReference; lastKnownFileType = text.plist.xml; path = "GoogleService-Info.plist"; sourceTree = "<group>"; };
+		36C6C71327C68B43F522F5B2 /* NotificationServiceExtension-Debug.xcconfig */ = {isa = PBXFileReference; includeInIndex = 1; lastKnownFileType = text.xcconfig; name = "NotificationServiceExtension-Debug.xcconfig"; path = "Flutter/NotificationServiceExtension-Debug.xcconfig"; sourceTree = "<group>"; };
 		3B3967151E833CAA004F5970 /* AppFrameworkInfo.plist */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = text.plist.xml; name = AppFrameworkInfo.plist; path = Flutter/AppFrameworkInfo.plist; sourceTree = "<group>"; };
 		4509EC31CB08BA9BF367AF6C /* Pods-Runner.profile.xcconfig */ = {isa = PBXFileReference; includeInIndex = 1; lastKnownFileType = text.xcconfig; name = "Pods-Runner.profile.xcconfig"; path = "Target Support Files/Pods-Runner/Pods-Runner.profile.xcconfig"; sourceTree = "<group>"; };
 		4F2428AC5384E0EF8DAB462A /* Pods_Share_Extension.framework */ = {isa = PBXFileReference; explicitFileType = wrapper.framework; includeInIndex = 0; path = Pods_Share_Extension.framework; sourceTree = BUILT_PRODUCTS_DIR; };
+		509DCCD474353408FE5806C5 /* PEM.swift */ = {isa = PBXFileReference; includeInIndex = 1; lastKnownFileType = sourcecode.swift; name = PEM.swift; path = PEM.swift; sourceTree = "<group>"; };
+		5C2F4C79DD573778092882AB /* NotificationServiceExtension.entitlements */ = {isa = PBXFileReference; includeInIndex = 1; lastKnownFileType = text.plist.entitlements; name = NotificationServiceExtension.entitlements; path = NotificationServiceExtension.entitlements; sourceTree = "<group>"; };
 		60E1803A3FB28FCC6F435E99 /* Pods-Share Extension.release.xcconfig */ = {isa = PBXFileReference; includeInIndex = 1; lastKnownFileType = text.xcconfig; name = "Pods-Share Extension.release.xcconfig"; path = "Target Support Files/Pods-Share Extension/Pods-Share Extension.release.xcconfig"; sourceTree = "<group>"; };
 		64801C012A9112D500E8B558 /* Runner.entitlements */ = {isa = PBXFileReference; lastKnownFileType = text.plist.entitlements; path = Runner.entitlements; sourceTree = "<group>"; };
 		74858FAD1ED2DC5600515810 /* Runner-Bridging-Header.h */ = {isa = PBXFileReference; lastKnownFileType = sourcecode.c.h; path = "Runner-Bridging-Header.h"; sourceTree = "<group>"; };
 		74858FAE1ED2DC5600515810 /* AppDelegate.swift */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.swift; path = AppDelegate.swift; sourceTree = "<group>"; };
+		78E0A7A72DC9AD7400C4905E /* FlutterGeneratedPluginSwiftPackage */ = {isa = PBXFileReference; lastKnownFileType = wrapper; name = FlutterGeneratedPluginSwiftPackage; path = Flutter/ephemeral/Packages/FlutterGeneratedPluginSwiftPackage; sourceTree = "<group>"; };
 		7AFA3C8E1D35360C0083082E /* Release.xcconfig */ = {isa = PBXFileReference; lastKnownFileType = text.xcconfig; name = Release.xcconfig; path = Flutter/Release.xcconfig; sourceTree = "<group>"; };
 		90960A132A5F91779B3FBE28 /* Pods_Runner.framework */ = {isa = PBXFileReference; explicitFileType = wrapper.framework; includeInIndex = 0; path = Pods_Runner.framework; sourceTree = BUILT_PRODUCTS_DIR; };
 		9740EEB21CF90195004384FC /* Debug.xcconfig */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = text.xcconfig; name = Debug.xcconfig; path = Flutter/Debug.xcconfig; sourceTree = "<group>"; };
@@ -94,10 +113,12 @@
 		BB0001040000000011111111 /* TimetableWidget-Debug.xcconfig */ = {isa = PBXFileReference; lastKnownFileType = text.xcconfig; name = "TimetableWidget-Debug.xcconfig"; path = "Flutter/TimetableWidget-Debug.xcconfig"; sourceTree = "<group>"; };
 		BB0001050000000011111111 /* TimetableWidget-Release.xcconfig */ = {isa = PBXFileReference; lastKnownFileType = text.xcconfig; name = "TimetableWidget-Release.xcconfig"; path = "Flutter/TimetableWidget-Release.xcconfig"; sourceTree = "<group>"; };
 		BB0001060000000011111111 /* TimetableWidget-Profile.xcconfig */ = {isa = PBXFileReference; lastKnownFileType = text.xcconfig; name = "TimetableWidget-Profile.xcconfig"; path = "Flutter/TimetableWidget-Profile.xcconfig"; sourceTree = "<group>"; };
+		C3B91710361EFED8934F0FDC /* NotificationServiceExtension.appex */ = {isa = PBXFileReference; explicitFileType = "wrapper.app-extension"; includeInIndex = 0; path = NotificationServiceExtension.appex; sourceTree = BUILT_PRODUCTS_DIR; };
 		C7E1879BE78835C7E3256316 /* Pods-Runner.debug.xcconfig */ = {isa = PBXFileReference; includeInIndex = 1; lastKnownFileType = text.xcconfig; name = "Pods-Runner.debug.xcconfig"; path = "Target Support Files/Pods-Runner/Pods-Runner.debug.xcconfig"; sourceTree = "<group>"; };
 		DD904D7C0FC0AD11449CEB80 /* Pods-Share Extension.debug.xcconfig */ = {isa = PBXFileReference; includeInIndex = 1; lastKnownFileType = text.xcconfig; name = "Pods-Share Extension.debug.xcconfig"; path = "Target Support Files/Pods-Share Extension/Pods-Share Extension.debug.xcconfig"; sourceTree = "<group>"; };
 		EF5279D9BF8FCBB117AF998E /* Pods-Share Extension.profile.xcconfig */ = {isa = PBXFileReference; includeInIndex = 1; lastKnownFileType = text.xcconfig; name = "Pods-Share Extension.profile.xcconfig"; path = "Target Support Files/Pods-Share Extension/Pods-Share Extension.profile.xcconfig"; sourceTree = "<group>"; };
-		78E0A7A72DC9AD7400C4905E /* FlutterGeneratedPluginSwiftPackage */ = {isa = PBXFileReference; lastKnownFileType = wrapper; name = FlutterGeneratedPluginSwiftPackage; path = Flutter/ephemeral/Packages/FlutterGeneratedPluginSwiftPackage; sourceTree = "<group>"; };
+		F5B421EAF56B77B775E58E92 /* Foundation.framework */ = {isa = PBXFileReference; lastKnownFileType = wrapper.framework; name = Foundation.framework; path = Platforms/iPhoneOS.platform/Developer/SDKs/iPhoneOS18.0.sdk/System/Library/Frameworks/Foundation.framework; sourceTree = DEVELOPER_DIR; };
+		F758339399E7B5FD1A88FC92 /* NotificationServiceExtension-Profile.xcconfig */ = {isa = PBXFileReference; includeInIndex = 1; lastKnownFileType = text.xcconfig; name = "NotificationServiceExtension-Profile.xcconfig"; path = "Flutter/NotificationServiceExtension-Profile.xcconfig"; sourceTree = "<group>"; };
 /* End PBXFileReference section */

 /* Begin PBXFileSystemSynchronizedBuildFileExceptionSet section */
@@ -169,6 +190,14 @@
 			);
 			runOnlyForDeploymentPostprocessing = 0;
 		};
+		D2447D92E9CCD96B3292B17B /* Frameworks */ = {
+			isa = PBXFrameworksBuildPhase;
+			buildActionMask = 2147483647;
+			files = (
+				C40CF71846788CD98CB99E2B /* Foundation.framework in Frameworks */,
+			);
+			runOnlyForDeploymentPostprocessing = 0;
+		};
 /* End PBXFrameworksBuildPhase section */

 /* Begin PBXGroup section */
@@ -185,15 +214,36 @@
 			path = Pods;
 			sourceTree = "<group>";
 		};
+		553E8F3190182FD2E527FEB5 /* NotificationServiceExtension */ = {
+			isa = PBXGroup;
+			children = (
+				2960F029246C39E2A03F6D87 /* NotificationService.swift */,
+				509DCCD474353408FE5806C5 /* PEM.swift */,
+				12B96C78930441C73F123636 /* Info.plist */,
+				5C2F4C79DD573778092882AB /* NotificationServiceExtension.entitlements */,
+			);
+			name = NotificationServiceExtension;
+			path = NotificationServiceExtension;
+			sourceTree = SOURCE_ROOT;
+		};
 		731388A08E3B330B216381D0 /* Frameworks */ = {
 			isa = PBXGroup;
 			children = (
 				90960A132A5F91779B3FBE28 /* Pods_Runner.framework */,
 				4F2428AC5384E0EF8DAB462A /* Pods_Share_Extension.framework */,
+				80D9B9919D3D7CCA2A80C8C5 /* iOS */,
 			);
 			name = Frameworks;
 			sourceTree = "<group>";
 		};
+		80D9B9919D3D7CCA2A80C8C5 /* iOS */ = {
+			isa = PBXGroup;
+			children = (
+				F5B421EAF56B77B775E58E92 /* Foundation.framework */,
+			);
+			name = iOS;
+			sourceTree = "<group>";
+		};
 		9740EEB11CF90186004384FC /* Flutter */ = {
 			isa = PBXGroup;
 			children = (
@@ -208,6 +258,9 @@
 				BB0001040000000011111111 /* TimetableWidget-Debug.xcconfig */,
 				BB0001050000000011111111 /* TimetableWidget-Release.xcconfig */,
 				BB0001060000000011111111 /* TimetableWidget-Profile.xcconfig */,
+				36C6C71327C68B43F522F5B2 /* NotificationServiceExtension-Debug.xcconfig */,
+				17E2EE012C4361AC05DCA4C9 /* NotificationServiceExtension-Release.xcconfig */,
+				F758339399E7B5FD1A88FC92 /* NotificationServiceExtension-Profile.xcconfig */,
 			);
 			name = Flutter;
 			sourceTree = "<group>";
@@ -222,6 +275,7 @@
 				97C146EF1CF9000F007C117D /* Products */,
 				345F4BD4143471FDA71626DE /* Pods */,
 				731388A08E3B330B216381D0 /* Frameworks */,
+				553E8F3190182FD2E527FEB5 /* NotificationServiceExtension */,
 			);
 			sourceTree = "<group>";
 		};
@@ -231,6 +285,7 @@
 				97C146EE1CF9000F007C117D /* Runner.app */,
 				3321F8052FB1C00C0011C712 /* Share Extension.appex */,
 				AA0101020000000011111111 /* TimetableWidgetExtension.appex */,
+				C3B91710361EFED8934F0FDC /* NotificationServiceExtension.appex */,
 			);
 			name = Products;
 			sourceTree = "<group>";
@@ -278,9 +333,6 @@
 			productType = "com.apple.product-type.app-extension";
 		};
 		97C146ED1CF9000F007C117D /* Runner */ = {
-			packageProductDependencies = (
-				78A3181F2AECB46A00862997 /* FlutterGeneratedPluginSwiftPackage */,
-			);
 			isa = PBXNativeTarget;
 			buildConfigurationList = 97C147051CF9000F007C117D /* Build configuration list for PBXNativeTarget "Runner" */;
 			buildPhases = (
@@ -299,8 +351,12 @@
 			dependencies = (
 				3321F80E2FB1C00C0011C712 /* PBXTargetDependency */,
 				AA0101090000000011111111 /* PBXTargetDependency */,
+				43763BD5552A36CA28890DFA /* PBXTargetDependency */,
 			);
 			name = Runner;
+			packageProductDependencies = (
+				78A3181F2AECB46A00862997 /* FlutterGeneratedPluginSwiftPackage */,
+			);
 			productName = Runner;
 			productReference = 97C146EE1CF9000F007C117D /* Runner.app */;
 			productType = "com.apple.product-type.application";
@@ -325,13 +381,27 @@
 			productReference = AA0101020000000011111111 /* TimetableWidgetExtension.appex */;
 			productType = "com.apple.product-type.app-extension";
 		};
+		AEDC710FEBFF2CC736D88AB2 /* NotificationServiceExtension */ = {
+			isa = PBXNativeTarget;
+			buildConfigurationList = C3A6F3FA3E3FD220B736D6E5 /* Build configuration list for PBXNativeTarget "NotificationServiceExtension" */;
+			buildPhases = (
+				DF8C1170E7DF96711030EAC0 /* Sources */,
+				D2447D92E9CCD96B3292B17B /* Frameworks */,
+				239068341DC6E6B36193EC96 /* Resources */,
+			);
+			buildRules = (
+			);
+			dependencies = (
+			);
+			name = NotificationServiceExtension;
+			productName = NotificationServiceExtension;
+			productReference = C3B91710361EFED8934F0FDC /* NotificationServiceExtension.appex */;
+			productType = "com.apple.product-type.app-extension";
+		};
 /* End PBXNativeTarget section */

 /* Begin PBXProject section */
 		97C146E61CF9000F007C117D /* Project object */ = {
-			packageReferences = (
-				781AD8BC2B33823900A9FFBB /* XCLocalSwiftPackageReference "Flutter/ephemeral/Packages/FlutterGeneratedPluginSwiftPackage" */,
-			);
 			isa = PBXProject;
 			attributes = {
 				BuildIndependentTargetsInParallel = YES;
@@ -360,6 +430,9 @@
 				Base,
 			);
 			mainGroup = 97C146E51CF9000F007C117D;
+			packageReferences = (
+				781AD8BC2B33823900A9FFBB /* XCLocalSwiftPackageReference "FlutterGeneratedPluginSwiftPackage" */,
+			);
 			productRefGroup = 97C146EF1CF9000F007C117D /* Products */;
 			projectDirPath = "";
 			projectRoot = "";
@@ -367,11 +440,19 @@
 				97C146ED1CF9000F007C117D /* Runner */,
 				3321F8042FB1C00C0011C712 /* Share Extension */,
 				AA0101010000000011111111 /* TimetableWidgetExtension */,
+				AEDC710FEBFF2CC736D88AB2 /* NotificationServiceExtension */,
 			);
 		};
 /* End PBXProject section */

 /* Begin PBXResourcesBuildPhase section */
+		239068341DC6E6B36193EC96 /* Resources */ = {
+			isa = PBXResourcesBuildPhase;
+			buildActionMask = 2147483647;
+			files = (
+			);
+			runOnlyForDeploymentPostprocessing = 0;
+		};
 		3321F8032FB1C00C0011C712 /* Resources */ = {
 			isa = PBXResourcesBuildPhase;
 			buildActionMask = 2147483647;
@@ -520,6 +601,15 @@
 			);
 			runOnlyForDeploymentPostprocessing = 0;
 		};
+		DF8C1170E7DF96711030EAC0 /* Sources */ = {
+			isa = PBXSourcesBuildPhase;
+			buildActionMask = 2147483647;
+			files = (
+				725388B5C3A724B19BD6FD06 /* NotificationService.swift in Sources */,
+				97D9AFE39CF2369A97F04721 /* PEM.swift in Sources */,
+			);
+			runOnlyForDeploymentPostprocessing = 0;
+		};
 /* End PBXSourcesBuildPhase section */

 /* Begin PBXTargetDependency section */
@@ -528,6 +618,12 @@
 			target = 3321F8042FB1C00C0011C712 /* Share Extension */;
 			targetProxy = 3321F80D2FB1C00C0011C712 /* PBXContainerItemProxy */;
 		};
+		43763BD5552A36CA28890DFA /* PBXTargetDependency */ = {
+			isa = PBXTargetDependency;
+			name = NotificationServiceExtension;
+			target = AEDC710FEBFF2CC736D88AB2 /* NotificationServiceExtension */;
+			targetProxy = AABEF26FF24F76E01DA5ADEA /* PBXContainerItemProxy */;
+		};
 		AA0101090000000011111111 /* PBXTargetDependency */ = {
 			isa = PBXTargetDependency;
 			target = AA0101010000000011111111 /* TimetableWidgetExtension */;
@@ -929,6 +1025,29 @@
 			};
 			name = Release;
 		};
+		A2B046F78AD55232F08583F3 /* Debug */ = {
+			isa = XCBuildConfiguration;
+			baseConfigurationReference = 36C6C71327C68B43F522F5B2 /* NotificationServiceExtension-Debug.xcconfig */;
+			buildSettings = {
+				CLANG_ENABLE_MODULES = YES;
+				CLANG_ENABLE_OBJC_WEAK = NO;
+				CODE_SIGN_ENTITLEMENTS = NotificationServiceExtension/NotificationServiceExtension.entitlements;
+				CODE_SIGN_STYLE = Automatic;
+				CURRENT_PROJECT_VERSION = "$(FLUTTER_BUILD_NUMBER)";
+				DEVELOPMENT_TEAM = MY55VF3KPG;
+				INFOPLIST_FILE = NotificationServiceExtension/Info.plist;
+				IPHONEOS_DEPLOYMENT_TARGET = 15.0;
+				MARKETING_VERSION = "$(FLUTTER_BUILD_NAME)";
+				PRODUCT_BUNDLE_IDENTIFIER = eu.mhsl.marianum.mobile.client.NotificationServiceExtension;
+				PRODUCT_NAME = "$(TARGET_NAME)";
+				SDKROOT = iphoneos;
+				SKIP_INSTALL = YES;
+				SWIFT_OPTIMIZATION_LEVEL = "-Onone";
+				SWIFT_VERSION = 5.0;
+				TARGETED_DEVICE_FAMILY = "1,2";
+			};
+			name = Debug;
+		};
 		AA01010A0000000011111111 /* Debug */ = {
 			isa = XCBuildConfiguration;
 			baseConfigurationReference = BB0001040000000011111111 /* TimetableWidget-Debug.xcconfig */;
@@ -1051,6 +1170,54 @@
 			};
 			name = Profile;
 		};
+		E5EE58583E83B7694F6C3C5E /* Release */ = {
+			isa = XCBuildConfiguration;
+			baseConfigurationReference = 17E2EE012C4361AC05DCA4C9 /* NotificationServiceExtension-Release.xcconfig */;
+			buildSettings = {
+				CLANG_ENABLE_MODULES = YES;
+				CLANG_ENABLE_OBJC_WEAK = NO;
+				CODE_SIGN_ENTITLEMENTS = NotificationServiceExtension/NotificationServiceExtension.entitlements;
+				CODE_SIGN_STYLE = Automatic;
+				CURRENT_PROJECT_VERSION = "$(FLUTTER_BUILD_NUMBER)";
+				DEVELOPMENT_TEAM = MY55VF3KPG;
+				INFOPLIST_FILE = NotificationServiceExtension/Info.plist;
+				IPHONEOS_DEPLOYMENT_TARGET = 15.0;
+				MARKETING_VERSION = "$(FLUTTER_BUILD_NAME)";
+				PRODUCT_BUNDLE_IDENTIFIER = eu.mhsl.marianum.mobile.client.NotificationServiceExtension;
+				PRODUCT_NAME = "$(TARGET_NAME)";
+				SDKROOT = iphoneos;
+				SKIP_INSTALL = YES;
+				SWIFT_OPTIMIZATION_LEVEL = "-O";
+				SWIFT_VERSION = 5.0;
+				TARGETED_DEVICE_FAMILY = "1,2";
+				VALIDATE_PRODUCT = YES;
+			};
+			name = Release;
+		};
+		F418DF43742DC2E30B161652 /* Profile */ = {
+			isa = XCBuildConfiguration;
+			baseConfigurationReference = F758339399E7B5FD1A88FC92 /* NotificationServiceExtension-Profile.xcconfig */;
+			buildSettings = {
+				CLANG_ENABLE_MODULES = YES;
+				CLANG_ENABLE_OBJC_WEAK = NO;
+				CODE_SIGN_ENTITLEMENTS = NotificationServiceExtension/NotificationServiceExtension.entitlements;
+				CODE_SIGN_STYLE = Automatic;
+				CURRENT_PROJECT_VERSION = "$(FLUTTER_BUILD_NUMBER)";
+				DEVELOPMENT_TEAM = MY55VF3KPG;
+				INFOPLIST_FILE = NotificationServiceExtension/Info.plist;
+				IPHONEOS_DEPLOYMENT_TARGET = 15.0;
+				MARKETING_VERSION = "$(FLUTTER_BUILD_NAME)";
+				PRODUCT_BUNDLE_IDENTIFIER = eu.mhsl.marianum.mobile.client.NotificationServiceExtension;
+				PRODUCT_NAME = "$(TARGET_NAME)";
+				SDKROOT = iphoneos;
+				SKIP_INSTALL = YES;
+				SWIFT_OPTIMIZATION_LEVEL = "-O";
+				SWIFT_VERSION = 5.0;
+				TARGETED_DEVICE_FAMILY = "1,2";
+				VALIDATE_PRODUCT = YES;
+			};
+			name = Profile;
+		};
 /* End XCBuildConfiguration section */

 /* Begin XCConfigurationList section */
@@ -1094,13 +1261,25 @@
 			defaultConfigurationIsVisible = 0;
 			defaultConfigurationName = Release;
 		};
+		C3A6F3FA3E3FD220B736D6E5 /* Build configuration list for PBXNativeTarget "NotificationServiceExtension" */ = {
+			isa = XCConfigurationList;
+			buildConfigurations = (
+				E5EE58583E83B7694F6C3C5E /* Release */,
+				A2B046F78AD55232F08583F3 /* Debug */,
+				F418DF43742DC2E30B161652 /* Profile */,
+			);
+			defaultConfigurationIsVisible = 0;
+			defaultConfigurationName = Release;
+		};
 /* End XCConfigurationList section */
+
 /* Begin XCLocalSwiftPackageReference section */
-		781AD8BC2B33823900A9FFBB /* XCLocalSwiftPackageReference "Flutter/ephemeral/Packages/FlutterGeneratedPluginSwiftPackage" */ = {
+		781AD8BC2B33823900A9FFBB /* XCLocalSwiftPackageReference "FlutterGeneratedPluginSwiftPackage" */ = {
 			isa = XCLocalSwiftPackageReference;
 			relativePath = Flutter/ephemeral/Packages/FlutterGeneratedPluginSwiftPackage;
 		};
 /* End XCLocalSwiftPackageReference section */
+
 /* Begin XCSwiftPackageProductDependency section */
 		78A3181F2AECB46A00862997 /* FlutterGeneratedPluginSwiftPackage */ = {
 			isa = XCSwiftPackageProductDependency;
@@ -14,8 +14,8 @@
      "kind" : "remoteSourceControl",
      "location" : "https://github.com/google/app-check.git",
      "state" : {
-        "revision" : "61b85103a1aeed8218f17c794687781505fbbef5",
-        "version" : "11.2.0"
+        "revision" : "3e33dd27dd4c69bd81c7c81fe61d8ccf58846902",
+        "version" : "11.3.1"
      }
    },
    {
@@ -50,8 +50,8 @@
      "kind" : "remoteSourceControl",
      "location" : "https://github.com/firebase/firebase-ios-sdk",
      "state" : {
-        "revision" : "d10045cace0b4c335c4efa8f7df7e9a9fc5a7c60",
-        "version" : "12.13.0"
+        "revision" : "42e81d245e30e49ea6a5830cf2842d44a1591270",
+        "version" : "12.15.0"
      }
    },
    {
@@ -59,8 +59,8 @@
      "kind" : "remoteSourceControl",
      "location" : "https://github.com/googleads/google-ads-on-device-conversion-ios-sdk",
      "state" : {
-        "revision" : "19dffda9a9caf8d86570ff846535902d8509d7bf",
-        "version" : "3.5.0"
+        "revision" : "dc39082d8881109d35b94b1c122164c0e8d08a55",
+        "version" : "3.6.1"
      }
    },
    {
@@ -68,8 +68,8 @@
      "kind" : "remoteSourceControl",
      "location" : "https://github.com/google/GoogleAppMeasurement.git",
      "state" : {
-        "revision" : "c2c76bebcfbb90d90ea10599f934f9af160e1604",
-        "version" : "12.13.0"
+        "revision" : "144855f40d8668927f256a3045f7fdc4c3f4338b",
+        "version" : "12.15.0"
      }
    },
    {
@@ -86,8 +86,8 @@
      "kind" : "remoteSourceControl",
      "location" : "https://github.com/google/GoogleUtilities.git",
      "state" : {
-        "revision" : "60da361632d0de02786f709bdc0c4df340f7613e",
-        "version" : "8.1.0"
+        "revision" : "9f183ae842be978784f2963a343682e0c46d8fb3",
+        "version" : "8.1.2"
      }
    },
    {
@@ -122,8 +122,8 @@
      "kind" : "remoteSourceControl",
      "location" : "https://github.com/firebase/leveldb.git",
      "state" : {
-        "revision" : "0706abcc6b0bd9cedfbb015ba840e4a780b5159b",
-        "version" : "1.22.2"
+        "revision" : "a0bc79961d7be727d258d33d5a6b2f1023270ba1",
+        "version" : "1.22.5"
      }
    },
    {
@@ -131,8 +131,8 @@
      "kind" : "remoteSourceControl",
      "location" : "https://github.com/firebase/nanopb.git",
      "state" : {
-        "revision" : "b7e1104502eca3a213b46303391ca4d3bc8ddec1",
-        "version" : "2.30910.0"
+        "revision" : "3851d94a41890dea16dc3db34caf60e585cb4163",
+        "version" : "2.30910.1"
      }
    },
    {
@@ -140,8 +140,8 @@
      "kind" : "remoteSourceControl",
      "location" : "https://github.com/google/promises.git",
      "state" : {
-        "revision" : "540318ecedd63d883069ae7f1ed811a2df00b6ac",
-        "version" : "2.4.0"
+        "revision" : "f4a19a3c313dc2616c70bb49d29a799fb16be837",
+        "version" : "2.4.1"
      }
    },
    {
@@ -1,6 +1,7 @@
 import Flutter
 import UIKit
 import UserNotifications
+import workmanager_apple

@main
@objc class AppDelegate: FlutterAppDelegate, FlutterImplicitEngineDelegate {
@@ -12,7 +13,7 @@ import UserNotifications
  private let markReadActionId = "TALK_MARK_READ"

  // Shared (App Group) keychain — same group as the NSE and the Dart side.
-  private let keychainAccessGroup = "group.eu.mhsl.marianum.mobile.client.widget"
+  private let keychainAccessGroup = "MY55VF3KPG.eu.mhsl.marianum.mobile.client.push"
  private let usernameAccount = "nextcloud_username"
  private let appPasswordAccount = "nextcloud_app_password"
  private let baseUrlAccount = "nextcloud_base_url"
@@ -23,6 +24,19 @@ import UserNotifications
  ) -> Bool {
    let result = super.application(application, didFinishLaunchingWithOptions: launchOptions)
    registerTalkCategory()
+    // BGAppRefresh for the home-screen widget. Must all happen before
+    // didFinishLaunching returns: with the UIScene lifecycle Flutter registers
+    // plugins only during scene connection, which is past BGTaskScheduler's
+    // registration deadline — registerLaunchHandlers() bridges that gap.
+    // The task identifier mirrors WidgetBackgroundTask.periodicTaskName; the
+    // plugin re-submits the refresh request itself after every run.
+    WorkmanagerPlugin.setPluginRegistrantCallback { registry in
+      GeneratedPluginRegistrant.register(with: registry)
+    }
+    WorkmanagerPlugin.registerPeriodicTask(
+      withIdentifier: "eu.mhsl.marianum.widget.refresh",
+      earliestBeginInSeconds: 1800)
+    WorkmanagerPlugin.registerLaunchHandlers()
    // FlutterAppDelegate conforms to UNUserNotificationCenterDelegate and
    // forwards these callbacks to the plugins (firebase_messaging,
    // flutter_local_notifications). We route Talk actions natively here — the
@@ -66,6 +66,10 @@
 		</dict>
 		<key>UIApplicationSupportsIndirectInputEvents</key>
 		<true/>
+		<key>BGTaskSchedulerPermittedIdentifiers</key>
+		<array>
+			<string>eu.mhsl.marianum.widget.refresh</string>
+		</array>
 		<key>UIBackgroundModes</key>
 		<array>
 			<string>fetch</string>
@@ -11,7 +11,7 @@
 	</array>
 	<key>keychain-access-groups</key>
 	<array>
-		<string>group.eu.mhsl.marianum.mobile.client.widget</string>
+		<string>$(AppIdentifierPrefix)eu.mhsl.marianum.mobile.client.push</string>
 	</array>
 </dict>
 </plist>
@@ -14,7 +14,7 @@ class SceneDelegate: FlutterSceneDelegate {
  ) {
    super.scene(scene, willConnectTo: session, options: connectionOptions)
    for context in connectionOptions.urlContexts {
-      _ = SwiftReceiveSharingIntentPlugin.instance.application(
+      _ = ReceiveSharingIntentPlugin.instance.application(
        UIApplication.shared,
        didFinishLaunchingWithOptions: [UIApplication.LaunchOptionsKey.url: context.url]
      )
@@ -23,7 +23,7 @@ class SceneDelegate: FlutterSceneDelegate {

  override func scene(_ scene: UIScene, openURLContexts URLContexts: Set<UIOpenURLContext>) {
    for context in URLContexts {
-      _ = SwiftReceiveSharingIntentPlugin.instance.application(
+      _ = ReceiveSharingIntentPlugin.instance.application(
        UIApplication.shared,
        open: context.url,
        options: [:]
@@ -3,7 +3,7 @@ import UniformTypeIdentifiers
 import AVFoundation

 // Datenmodell muss byte-für-byte zu dem passen, was
-// SwiftReceiveSharingIntentPlugin auf der Host-App-Seite decodiert.
+// ReceiveSharingIntentPlugin auf der Host-App-Seite decodiert.
 private enum SharedMediaType: String, Codable {
  case image, video, text, file, url
 }
@@ -0,0 +1,109 @@
+import Foundation
+
+/// Pure anchor/slicing logic mirroring `lib/widget_data/widget_data_mapper.dart`
+/// (resolveDayAnchor / resolveWeekAnchor). Keep both sides in sync — the Dart
+/// unit tests in test/widget_data/widget_data_mapper_test.dart double as the
+/// review checklist here:
+///   resolveDayAnchor(Wed 2026-05-06 10:00) == 2026-05-06   (before cutoff)
+///   resolveDayAnchor(Wed 2026-05-06 19:00) == 2026-05-07   (after cutoff)
+///   resolveDayAnchor(Fri 2026-05-08 18:00) == 2026-05-11   (Fri → Mon)
+///   resolveDayAnchor(Sat 2026-05-09 10:00) == 2026-05-11
+///   resolveDayAnchor(Sun 2026-05-10 22:00) == 2026-05-11
+///   resolveWeekAnchor(Tue 2026-05-05 10:00) == 2026-05-04
+///   resolveWeekAnchor(Sun 2026-05-10 10:00) == 2026-05-11
+enum TimetableAnchor {
+    /// After 17:00 the user's question shifts from "what's left today" to
+    /// "what's tomorrow", so the day widget rolls forward.
+    static let dayCutoffHour = 17
+
+    static func resolveDayAnchor(_ now: Date, calendar: Calendar = .current) -> Date {
+        var candidate = calendar.startOfDay(for: now)
+        let shiftToTomorrow =
+            calendar.component(.hour, from: now) >= dayCutoffHour || isWeekend(candidate, calendar: calendar)
+        if shiftToTomorrow {
+            candidate = nextDay(candidate, calendar: calendar)
+        }
+        while isWeekend(candidate, calendar: calendar) {
+            candidate = nextDay(candidate, calendar: calendar)
+        }
+        return candidate
+    }
+
+    static func resolveWeekAnchor(_ now: Date, calendar: Calendar = .current) -> Date {
+        let anchor = resolveDayAnchor(now, calendar: calendar)
+        // Swift weekday: 1 = Sunday … 7 = Saturday → distance back to Monday.
+        let daysFromMonday = (calendar.component(.weekday, from: anchor) + 5) % 7
+        let monday = calendar.date(byAdding: .day, value: -daysFromMonday, to: anchor) ?? anchor
+        return calendar.startOfDay(for: monday)
+    }
+
+    /// Future instants at which the rendered anchor can change: each day's
+    /// midnight (rollover) and 17:00 (cutoff), within the horizon. Sorted,
+    /// strictly after `now`.
+    static func boundaryDates(
+        from now: Date,
+        horizonDays: Int = 3,
+        calendar: Calendar = .current
+    ) -> [Date] {
+        var result: [Date] = []
+        let today = calendar.startOfDay(for: now)
+        for offset in 0...horizonDays {
+            guard let day = calendar.date(byAdding: .day, value: offset, to: today) else { continue }
+            let midnight = calendar.startOfDay(for: day)
+            if midnight > now { result.append(midnight) }
+            if let cutoff = calendar.date(
+                bySettingHour: dayCutoffHour, minute: 0, second: 0, of: day
+            ), cutoff > now {
+                result.append(cutoff)
+            }
+        }
+        return result.sorted()
+    }
+
+    /// Derives a day payload from the 14-day week payload — same shape the
+    /// Dart buildDayData produces, since the week payload runs through the
+    /// identical per-day merge/collision pipeline.
+    static func slice(
+        week: WidgetTimetableData,
+        forDay anchor: Date,
+        calendar: Calendar = .current
+    ) -> WidgetTimetableData {
+        let lessons = week.lessons.filter { calendar.isDate($0.start, inSameDayAs: anchor) }
+        // Every v2 week payload carries `days` — the key bump guarantees it.
+        let dayInfo = week.days?.first { calendar.isDate($0.date, inSameDayAs: anchor) }
+        return WidgetTimetableData(
+            fetchedAt: week.fetchedAt,
+            anchorDate: anchor,
+            lessons: lessons,
+            periods: week.periods,
+            isHoliday: dayInfo?.isHoliday ?? false,
+            holidayName: dayInfo?.holidayName,
+            days: nil
+        )
+    }
+
+    /// Week payload re-anchored to the week containing/following `anchorDate`.
+    /// The week view filters its five columns off `anchorDate`, so this alone
+    /// performs the Friday-evening/weekend jump to next week.
+    static func retarget(week: WidgetTimetableData, anchorDate: Date) -> WidgetTimetableData {
+        WidgetTimetableData(
+            fetchedAt: week.fetchedAt,
+            anchorDate: anchorDate,
+            lessons: week.lessons,
+            periods: week.periods,
+            isHoliday: week.isHoliday,
+            holidayName: week.holidayName,
+            days: week.days
+        )
+    }
+
+    private static func isWeekend(_ date: Date, calendar: Calendar) -> Bool {
+        let weekday = calendar.component(.weekday, from: date)
+        return weekday == 1 || weekday == 7
+    }
+
+    private static func nextDay(_ date: Date, calendar: Calendar) -> Date {
+        let next = calendar.date(byAdding: .day, value: 1, to: date) ?? date
+        return calendar.startOfDay(for: next)
+    }
+}
@@ -100,13 +100,13 @@ struct TimetableDayView: View {

    private func header(data: WidgetTimetableData) -> some View {
        HStack(spacing: 4) {
-            Text(dayLabel(for: data.anchorDate))
+            Text(dayLabel(for: data.anchorDate, relativeTo: entry.date))
                .font(.system(size: 13, weight: .semibold))
                .foregroundStyle(palette.textPrimary)
                .lineLimit(1)
                .minimumScaleFactor(0.7)
            Spacer(minLength: 4)
-            Text("Stand: \(freshnessLabel(for: data.fetchedAt))")
+            Text("Stand: \(freshnessLabel(for: data.fetchedAt, relativeTo: entry.date))")
                .font(.system(size: 9))
                .foregroundStyle(palette.textSecondary)
                .lineLimit(1)
@@ -383,6 +383,7 @@ struct TimeGridView: View {
        case .irregular: return Color(red: 143/255.0, green: 25/255.0, blue: 179/255.0)
        case .teacherChanged: return Color(red: 41/255.0, green: 99/255.0, blue: 155/255.0)
        case .event: return Color(red: 239/255.0, green: 108/255.0, blue: 0/255.0)
+        case .duty: return Color(red: 0/255.0, green: 121/255.0, blue: 107/255.0)
        }
    }
 }
@@ -400,9 +401,31 @@ func periodBoundaries(_ periods: [WidgetPeriod]) -> [Int] {
    return result.sorted()
 }

-func dayLabel(for date: Date) -> String {
+/// Fixed-locale formatters cached once — DateFormatter setup is the
+/// expensive part and the multi-entry timelines render up to ~8 entries per
+/// reload. Only touched from WidgetKit's archival rendering, so the shared
+/// instances are safe.
+enum WidgetDateFormatters {
+    static let shortDate = make("dd.MM.")
+    static let weekdayShort = make("EE")
+    static let weekdayDate = make("EEEE · dd.MM.")
+    static let time = make("HH:mm")
+    static let dateTime = make("dd.MM. HH:mm")
+
+    private static func make(_ format: String) -> DateFormatter {
+        let f = DateFormatter()
+        f.locale = Locale(identifier: "de_DE")
+        f.dateFormat = format
+        return f
+    }
+}
+
+/// `now` is the timeline entry's date, not `Date()`: WidgetKit archives
+/// entries ahead of time, so wall-clock reads would be wrong for every
+/// entry after the first.
+func dayLabel(for date: Date, relativeTo now: Date) -> String {
    let cal = Calendar.current
-    let today = cal.startOfDay(for: Date())
+    let today = cal.startOfDay(for: now)
    let anchor = cal.startOfDay(for: date)
    if anchor == today {
        return "Heute · \(shortDate(date))"
@@ -410,35 +433,23 @@ func dayLabel(for date: Date) -> String {
    if let tomorrow = cal.date(byAdding: .day, value: 1, to: today), anchor == tomorrow {
        return "Morgen · \(shortDate(date))"
    }
-    let formatter = DateFormatter()
-    formatter.locale = Locale(identifier: "de_DE")
-    formatter.dateFormat = "EEEE · dd.MM."
-    return formatter.string(from: date)
+    return WidgetDateFormatters.weekdayDate.string(from: date)
 }

 func shortDate(_ date: Date) -> String {
-    let f = DateFormatter()
-    f.locale = Locale(identifier: "de_DE")
-    f.dateFormat = "dd.MM."
-    return f.string(from: date)
+    WidgetDateFormatters.shortDate.string(from: date)
 }

-func freshnessLabel(for fetchedAt: Date) -> String {
+func freshnessLabel(for fetchedAt: Date, relativeTo now: Date) -> String {
    let cal = Calendar.current
-    let today = cal.startOfDay(for: Date())
+    let today = cal.startOfDay(for: now)
    let fetchedDay = cal.startOfDay(for: fetchedAt)
-    let timeFmt = DateFormatter()
-    timeFmt.locale = Locale(identifier: "de_DE")
-    timeFmt.dateFormat = "HH:mm"
    if fetchedDay == today {
-        return timeFmt.string(from: fetchedAt)
+        return WidgetDateFormatters.time.string(from: fetchedAt)
    }
    if let yesterday = cal.date(byAdding: .day, value: -1, to: today),
       fetchedDay == yesterday {
-        return "gestern \(timeFmt.string(from: fetchedAt))"
+        return "gestern \(WidgetDateFormatters.time.string(from: fetchedAt))"
    }
-    let dateTimeFmt = DateFormatter()
-    dateTimeFmt.locale = Locale(identifier: "de_DE")
-    dateTimeFmt.dateFormat = "dd.MM. HH:mm"
-    return dateTimeFmt.string(from: fetchedAt)
+    return WidgetDateFormatters.dateTime.string(from: fetchedAt)
 }
@@ -70,7 +70,7 @@ struct TimetableWeekView: View {
                .lineLimit(1)
                .minimumScaleFactor(0.8)
            Spacer()
-            Text("Stand: \(freshnessLabel(for: data.fetchedAt))")
+            Text("Stand: \(freshnessLabel(for: data.fetchedAt, relativeTo: entry.date))")
                .font(.system(size: 9))
                .foregroundStyle(palette.textSecondary)
                .lineLimit(1)
@@ -168,10 +168,7 @@ struct TimetableWeekView: View {
    }

    private func weekday(for date: Date) -> String {
-        let f = DateFormatter()
-        f.locale = Locale(identifier: "de_DE")
-        f.dateFormat = "EE"
-        return f.string(from: date)
+        WidgetDateFormatters.weekdayShort.string(from: date)
    }

    private func placeholder(_ message: String) -> some View {
@@ -41,11 +41,13 @@ struct TimetableDayProvider: TimelineProvider {
        in context: Context,
        completion: @escaping (Timeline<TimetableEntry>) -> Void
    ) {
-        let entry = TimetableEntry.current(variant: .day)
+        let now = Date()
        // 30 min mirrors the Dart workmanager cadence. iOS treats this as
-        // advisory; the "Stand:" label tells the user when data is stale.
-        let next = Calendar.current.date(byAdding: .minute, value: 30, to: Date()) ?? Date()
-        completion(Timeline(entries: [entry], policy: .after(next)))
+        // advisory; the boundary entries below keep the rendered day correct
+        // even when no reload is granted, and the "Stand:" label tells the
+        // user when the underlying data is stale.
+        let next = Calendar.current.date(byAdding: .minute, value: 30, to: now) ?? now
+        completion(Timeline(entries: TimetableEntry.dayEntries(now: now), policy: .after(next)))
    }
 }

@@ -80,9 +82,9 @@ struct TimetableWeekProvider: TimelineProvider {
        in context: Context,
        completion: @escaping (Timeline<TimetableEntry>) -> Void
    ) {
-        let entry = TimetableEntry.current(variant: .week)
-        let next = Calendar.current.date(byAdding: .minute, value: 30, to: Date()) ?? Date()
-        completion(Timeline(entries: [entry], policy: .after(next)))
+        let now = Date()
+        let next = Calendar.current.date(byAdding: .minute, value: 30, to: now) ?? now
+        completion(Timeline(entries: TimetableEntry.weekEntries(now: now), policy: .after(next)))
    }
 }

@@ -120,6 +122,58 @@ struct TimetableEntry: TimelineEntry {
            themeMode: WidgetDataLoader.themeMode()
        )
    }
+
+    /// Day timeline derived from the 14-day week payload, so the widget shows
+    /// the right day even when iOS grants no reload for days.
+    static func dayEntries(now: Date) -> [TimetableEntry] {
+        entries(now: now, variant: .day) { week, date in
+            TimetableAnchor.slice(week: week, forDay: TimetableAnchor.resolveDayAnchor(date))
+        }
+    }
+
+    /// Week timeline: re-anchoring performs the Friday-evening/weekend jump
+    /// into next week from cached data, and the midnight entries keep the
+    /// "Stand:" freshness label honest.
+    static func weekEntries(now: Date) -> [TimetableEntry] {
+        entries(now: now, variant: .week) { week, date in
+            TimetableAnchor.retarget(week: week, anchorDate: TimetableAnchor.resolveWeekAnchor(date))
+        }
+    }
+
+    /// Shared timeline skeleton: one entry now plus one per anchor boundary
+    /// (midnight rollover, 17:00 cutoff). Boundaries that cannot change the
+    /// render — same anchor and same calendar day for the header labels —
+    /// are dropped.
+    private static func entries(
+        now: Date,
+        variant: TimetableVariant,
+        transform: (WidgetTimetableData, Date) -> WidgetTimetableData
+    ) -> [TimetableEntry] {
+        guard WidgetDataLoader.isLoggedIn(), let week = WidgetDataLoader.loadWeek() else {
+            // Logged out, or no v2 week snapshot yet (fresh app update):
+            // fall back to the legacy single-entry payload.
+            return [TimetableEntry.current(variant: variant)]
+        }
+        let theme = WidgetDataLoader.themeMode()
+        let cal = Calendar.current
+        var result: [TimetableEntry] = []
+        for date in [now] + TimetableAnchor.boundaryDates(from: now) {
+            let data = transform(week, date)
+            if let previous = result.last, let previousData = previous.data,
+               cal.isDate(previousData.anchorDate, inSameDayAs: data.anchorDate),
+               cal.isDate(previous.date, inSameDayAs: date) {
+                continue
+            }
+            result.append(TimetableEntry(
+                date: date,
+                variant: variant,
+                data: data,
+                isLoggedIn: true,
+                themeMode: theme
+            ))
+        }
+        return result
+    }
 }

 extension View {
@@ -10,6 +10,15 @@ enum WidgetLessonStatus: String, Codable {
    case irregular
    case teacherChanged
    case event
+    case duty
+
+    /// Unknown future statuses degrade to `.regular` instead of failing the
+    /// whole payload decode (mirrors WidgetData.kt's fromWire fallback) — a
+    /// single new enum value must never blank the widget to the placeholder.
+    init(from decoder: Decoder) throws {
+        let raw = try decoder.singleValueContainer().decode(String.self)
+        self = WidgetLessonStatus(rawValue: raw) ?? .regular
+    }
 }

 struct WidgetLesson: Codable {
@@ -18,6 +27,8 @@ struct WidgetLesson: Codable {
    let subjectShort: String
    let subjectLong: String?
    let room: String?
+    // On teacher accounts this carries the class label ("7a") instead of the
+    // teacher short name (originalTeacher is nil then) — mapped in Dart.
    let teacher: String?
    let originalTeacher: String?
    let status: WidgetLessonStatus
@@ -33,6 +44,12 @@ struct WidgetPeriod: Codable {
    let virtualEndMinutes: Int
 }

+struct WidgetDayInfo: Codable {
+    let date: Date
+    let isHoliday: Bool
+    let holidayName: String?
+}
+
 struct WidgetTimetableData: Codable {
    let fetchedAt: Date
    let anchorDate: Date
@@ -40,12 +57,17 @@ struct WidgetTimetableData: Codable {
    let periods: [WidgetPeriod]
    let isHoliday: Bool
    let holidayName: String?
+    /// Week payload (v2) only; optional so day payloads keep decoding.
+    let days: [WidgetDayInfo]?
 }

+/// Mirrors lib/widget_data/widget_sync.dart (the canonical key list) — a
+/// schema bump must land in Dart, Kotlin (WidgetRenderer.kt) and here
+/// together, or the out-of-sync platform silently blanks to the placeholder.
 enum WidgetDataKey {
    static let appGroupId = "group.eu.mhsl.marianum.mobile.client.widget"
    static let dayData = "widget_data_day_v1"
-    static let weekData = "widget_data_week_v1"
+    static let weekData = "widget_data_week_v2"
    static let loggedIn = "widget_data_logged_in_v1"
    static let themeMode = "widget_setting_theme_mode_v1"
 }
@@ -1 +0,0 @@
-class ApiRequest {}
@@ -0,0 +1,17 @@
+import '../../marianumconnect/queries/absence/absence_prefill_response.dart';
+
+/// Demo fixtures for the absence-report form: the class dropdown and the
+/// identity/phone prefill. Typed (compile-checked) so a field rename can't
+/// silently drift the demo shape away from what the queries parse.
+class DemoAbsence {
+  const DemoAbsence._();
+
+  static List<String> classes() => const ['5a', '6b', '7c', '9d', '10a', 'Q1'];
+
+  static AbsencePrefillResponse prefill() => AbsencePrefillResponse(
+    firstName: 'Max',
+    lastName: 'Mustermann',
+    className: '10a',
+    phone: '0123 456789',
+  );
+}
@@ -2,13 +2,19 @@ import '../../../state/app/modules/capabilities/bloc/capabilities_state.dart';
 import '../../../state/app/modules/nextcloud_capabilities/bloc/nextcloud_capabilities_state.dart';

 /// Demo fixtures for the mobile capability flags — everything granted so the
-/// demo persona sees every feature (incl. push) as available.
+/// demo persona sees every feature (incl. push) as available and the timetable
+/// scroll range stays unlimited (null day counts).
 class DemoCapabilities {
  const DemoCapabilities._();

  static CapabilitiesState state() => const CapabilitiesState(
    viewForeignTimetables: true,
    pushNotifications: true,
+    timetablePastDays: null,
+    timetableFutureDays: null,
+    // Die Demo-Persona ist explizit Schüler — null hieße "Backend kennt das
+    // Feld nicht" (siehe CapabilitiesResponse.userType).
+    userType: 'STUDENT',
    loaded: true,
  );
 }
@@ -1,3 +1,4 @@
+import 'data/demo_absence.dart';
 import 'data/demo_breaker.dart';
 import 'data/demo_holidays.dart';
 import 'data/demo_timetable.dart';
@@ -39,6 +40,10 @@ class DemoMarianumConnect {
            .toList();
      case 'breaker':
        return DemoBreaker.none().toJson();
+      case 'absence/classes':
+        return DemoAbsence.classes();
+      case 'absence/prefill':
+        return DemoAbsence.prefill().toJson();
      case 'timetable/elements/teachers':
      case 'timetable/elements/students':
      case 'timetable/elements/classes':
@@ -0,0 +1,90 @@
+/// A backend-independent emergency notice loaded from a foreign server URL —
+/// frontmatter (control fields) plus a free Markdown body, so it stays
+/// hand-writable in an outage. See [parse] for the format.
+class EmergencyNotice {
+  /// `false` renders full-screen and blocks back/barrier taps.
+  final bool dismissible;
+  final String? title;
+  final String body;
+
+  const EmergencyNotice({
+    required this.dismissible,
+    required this.title,
+    required this.body,
+  });
+
+  /// Parses the raw file, or returns `null` when there is nothing to show.
+  /// Never throws — malformed input yields `null` so a broken file can't break
+  /// the app.
+  ///
+  /// ```
+  /// ---
+  /// active: true          # required truthy, else null; # lines are comments
+  /// dismissible: true     # default true
+  /// title: Störung        # optional
+  /// ---
+  /// Free **markdown** body (everything after the closing ---).
+  /// ```
+  static EmergencyNotice? parse(String raw) {
+    final lines = raw
+        .replaceAll('\r\n', '\n')
+        .replaceAll('\r', '\n')
+        .split('\n');
+
+    var i = 0;
+    while (i < lines.length && lines[i].trim().isEmpty) {
+      i++;
+    }
+    if (i >= lines.length || lines[i].trim() != '---') return null;
+    final openIndex = i;
+
+    var closeIndex = -1;
+    for (var j = openIndex + 1; j < lines.length; j++) {
+      if (lines[j].trim() == '---') {
+        closeIndex = j;
+        break;
+      }
+    }
+    if (closeIndex == -1) return null;
+
+    final meta = <String, String>{};
+    for (var j = openIndex + 1; j < closeIndex; j++) {
+      final line = lines[j].trim();
+      if (line.isEmpty || line.startsWith('#')) continue;
+      final sep = line.indexOf(':');
+      if (sep <= 0) continue;
+      final key = line.substring(0, sep).trim().toLowerCase();
+      final value = line.substring(sep + 1).trim();
+      meta[key] = value;
+    }
+
+    if (_parseBool(meta['active']) != true) return null;
+
+    final body = lines.sublist(closeIndex + 1).join('\n').trim();
+    if (body.isEmpty) return null;
+
+    final title = meta['title'];
+    return EmergencyNotice(
+      dismissible: _parseBool(meta['dismissible']) ?? true,
+      title: (title == null || title.isEmpty) ? null : title,
+      body: body,
+    );
+  }
+
+  static bool? _parseBool(String? value) {
+    switch (value?.trim().toLowerCase()) {
+      case 'true':
+      case 'yes':
+      case '1':
+      case 'on':
+        return true;
+      case 'false':
+      case 'no':
+      case '0':
+      case 'off':
+        return false;
+      default:
+        return null;
+    }
+  }
+}
@@ -0,0 +1,51 @@
+import 'package:dio/dio.dart';
+
+import 'emergency_notice.dart';
+
+/// Loads the emergency notice from a foreign URL over a standalone [Dio] — no
+/// MarianumConnect interceptors/base URL/auth, so it survives a backend outage.
+/// Never throws: any failure yields `null` (nothing shown).
+///
+/// A [cacheTtl] in-memory throttle keeps rapid resumes from hammering the host;
+/// it lives only for the process, so a cold start always fetches fresh.
+class EmergencyNoticeClient {
+  EmergencyNoticeClient();
+
+  static const Duration cacheTtl = Duration(minutes: 1);
+
+  EmergencyNotice? _cached;
+  String? _cachedUrl;
+  DateTime? _cachedAt;
+
+  Future<EmergencyNotice?> fetch(String url) async {
+    final cachedAt = _cachedAt;
+    if (cachedAt != null &&
+        _cachedUrl == url &&
+        DateTime.now().difference(cachedAt) < cacheTtl) {
+      return _cached;
+    }
+
+    EmergencyNotice? result;
+    try {
+      final dio = Dio(
+        BaseOptions(
+          connectTimeout: const Duration(seconds: 5),
+          receiveTimeout: const Duration(seconds: 5),
+          sendTimeout: const Duration(seconds: 5),
+          responseType: ResponseType.plain,
+        ),
+      );
+      final response = await dio.get<String>(url);
+      final raw = response.data;
+      result = (raw == null || raw.isEmpty) ? null : EmergencyNotice.parse(raw);
+    } catch (_) {
+      result = null;
+    }
+
+    // Cache failures too, so a down server isn't retried on every resume.
+    _cached = result;
+    _cachedUrl = url;
+    _cachedAt = DateTime.now();
+    return result;
+  }
+}
@@ -6,6 +6,7 @@ import 'package:http/http.dart' as http;
 import 'package:nextcloud/nextcloud.dart';

 import '../api_error.dart';
+import '../http_errors.dart';
 import '../marianumcloud/talk/talk_error.dart';
 import 'app_exception.dart';
 import 'auth_exception.dart';
@@ -59,9 +60,8 @@ AppException? _dioToAppException(DioException error) {
 /// status plus a trimmed body preview (same format as the Talk API errors).
 AppException _dynamiteToAppException(DynamiteApiException error) {
  final status = error.statusCode;
-  final body = error.body.replaceAll(RegExp(r'\s+'), ' ').trim();
-  final preview = body.length > 500 ? '${body.substring(0, 500)}…' : body;
-  final detail = body.isEmpty ? 'HTTP $status' : 'HTTP $status body=$preview';
+  final preview = previewBody(error.body);
+  final detail = preview.isEmpty ? 'HTTP $status' : 'HTTP $status body=$preview';
  switch (status) {
    case 401:
      return AuthException.unauthorized(technicalDetails: detail);
@@ -0,0 +1,53 @@
+import 'dart:async';
+import 'dart:io';
+
+import 'package:http/http.dart' as http;
+
+import 'errors/auth_exception.dart';
+import 'errors/network_exception.dart';
+import 'errors/not_found_exception.dart';
+import 'errors/server_exception.dart';
+
+/// Runs [send] and converts transport-level failures (socket/timeout/client
+/// errors) into a [NetworkException] tagged with [label] (e.g. `Talk <uri>`).
+/// Passes through whatever [send] produces, including `null` for the base-class
+/// request hooks that may skip the call.
+Future<http.Response?> sendGuarded(
+  String label,
+  Future<http.Response>? Function() send,
+) async {
+  try {
+    return await send();
+  } on SocketException catch (e) {
+    throw NetworkException(technicalDetails: '$label: ${e.message}');
+  } on TimeoutException catch (e) {
+    throw NetworkException.timeout(technicalDetails: '$label: $e');
+  } on http.ClientException catch (e) {
+    throw NetworkException(technicalDetails: '$label: ${e.message}');
+  }
+}
+
+/// Collapses whitespace and caps an HTTP error body at 500 chars so it can be
+/// embedded in an [AppException]'s technical details without dumping headers.
+String previewBody(String body) {
+  final collapsed = body.replaceAll(RegExp(r'\s+'), ' ').trim();
+  return collapsed.length > 500 ? '${collapsed.substring(0, 500)}…' : collapsed;
+}
+
+/// Builds a `<label> -> HTTP <status>[ body=<preview>]` technical detail line.
+String httpErrorDetail(String label, String body, int status) {
+  final preview = previewBody(body);
+  return preview.isEmpty
+      ? '$label -> HTTP $status'
+      : '$label -> HTTP $status body=$preview';
+}
+
+/// Throws the [AppException] matching a non-2xx HTTP [status], carrying
+/// [detail] as technical details: 401/403 map to auth errors, 404 to
+/// not-found, everything else to a generic server error.
+Never throwForStatus(int status, String detail) {
+  if (status == 401) throw AuthException.unauthorized(technicalDetails: detail);
+  if (status == 403) throw AuthException.forbidden(technicalDetails: detail);
+  if (status == 404) throw NotFoundException(technicalDetails: detail);
+  throw ServerException(statusCode: status, technicalDetails: detail);
+}
@@ -3,6 +3,7 @@ import 'dart:convert';
 import 'package:http/http.dart' as http;

 import '../../../model/account_data.dart';
+import '../../http_errors.dart';
 import '../nextcloud_ocs.dart';

 /// Exchanges the user's real Nextcloud password for a scoped app password via
@@ -18,21 +19,29 @@ class GetAppPassword {
  GetAppPassword({http.Client? client}) : _client = client ?? http.Client();

  /// Returns the freshly minted app password. Throws on any transport or
-  /// protocol error — callers treat push registration as best-effort and swallow
-  /// failures.
+  /// protocol error — a 401 becomes an [AuthException], which the login flow
+  /// reads as "Nextcloud rejects the password" (two-factor authentication or
+  /// password mismatch) and answers with the interactive Login Flow v2.
  Future<String> run() async {
-    final response = await _client.get(
-      NextcloudOcs.uri('core/getapppassword'),
-      headers: {
-        ...NextcloudOcs.headers(),
-        // Deliberately NOT the shared Authorization value: that one prefers
-        // the app password, but an app password cannot mint another one —
-        // this endpoint requires the real password.
-        'Authorization': AccountData().getRealPasswordBasicAuthHeader(),
-      },
-    );
+    const label = 'Nextcloud getapppassword';
+    final response = (await sendGuarded(
+      label,
+      () => _client.get(
+        NextcloudOcs.uri('core/getapppassword'),
+        headers: {
+          ...NextcloudOcs.headers(),
+          // Deliberately NOT the shared Authorization value: that one prefers
+          // the app password, but an app password cannot mint another one —
+          // this endpoint requires the real password.
+          'Authorization': AccountData().getRealPasswordBasicAuthHeader(),
+        },
+      ),
+    ))!;
    if (response.statusCode < 200 || response.statusCode >= 300) {
-      throw Exception('getapppassword HTTP ${response.statusCode}');
+      throwForStatus(
+        response.statusCode,
+        httpErrorDetail(label, response.body, response.statusCode),
+      );
    }
    final json = jsonDecode(utf8.decode(response.bodyBytes));
    final data = (json as Map)['ocs']?['data'];
@@ -1,4 +1,3 @@
-import 'dart:convert';
 import 'dart:io';

 import 'package:http/http.dart' as http;
@@ -38,9 +37,6 @@ class AutocompleteApi {
        technicalDetails: 'core/autocomplete/get: ${response.body}',
      );
    }
-    final decoded = jsonDecode(response.body) as Map<String, dynamic>;
-    return AutocompleteResponse.fromJson(
-      decoded['ocs'] as Map<String, dynamic>,
-    );
+    return AutocompleteResponse.fromJson(NextcloudOcs.decode(response.body));
  }
 }
@@ -1,18 +1,13 @@
-import 'dart:async';
 import 'dart:convert';
 import 'dart:developer';
-import 'dart:io';
 import 'dart:typed_data';

 import 'package:http/http.dart' as http;

 import '../../../model/account_data.dart';
 import '../../../model/endpoint_data.dart';
-import '../../errors/auth_exception.dart';
-import '../../errors/network_exception.dart';
-import '../../errors/not_found_exception.dart';
 import '../../errors/parse_exception.dart';
-import '../../errors/server_exception.dart';
+import '../../http_errors.dart';
 import '../nextcloud_ocs.dart';

 /// Mix of two Nextcloud surfaces:
@@ -42,30 +37,17 @@ Future<http.Response> _send(
 ) async {
  final headers = NextcloudOcs.headers();

-  final http.Response response;
-  try {
-    response = await perform(uri, headers);
-  } on SocketException catch (e) {
-    throw NetworkException(technicalDetails: 'Cloud $uri: ${e.message}');
-  } on TimeoutException catch (e) {
-    throw NetworkException.timeout(technicalDetails: 'Cloud $uri: $e');
-  } on http.ClientException catch (e) {
-    throw NetworkException(technicalDetails: 'Cloud $uri: ${e.message}');
-  }
+  final response = (await sendGuarded(
+    'Cloud $uri',
+    () => perform(uri, headers),
+  ))!;

  final status = response.statusCode;
  if (status >= 200 && status < 300) return response;

-  final body = response.body.replaceAll(RegExp(r'\s+'), ' ').trim();
-  final preview = body.length > 500 ? '${body.substring(0, 500)}…' : body;
-  final detail = body.isEmpty
-      ? 'Cloud $uri -> HTTP $status'
-      : 'Cloud $uri -> HTTP $status body=$preview';
+  final detail = httpErrorDetail('Cloud $uri', response.body, status);
  log(detail);
-  if (status == 401) throw AuthException.unauthorized(technicalDetails: detail);
-  if (status == 403) throw AuthException.forbidden(technicalDetails: detail);
-  if (status == 404) throw NotFoundException(technicalDetails: detail);
-  throw ServerException(statusCode: status, technicalDetails: detail);
+  throwForStatus(status, detail);
 }

 class SetUserAvatar {
@@ -0,0 +1,140 @@
+import 'dart:convert';
+
+import 'package:http/http.dart' as http;
+
+import '../../../model/endpoint_data.dart';
+import '../../http_errors.dart';
+import '../../marianumconnect/auth/device_token_name.dart';
+
+/// Nextcloud Login Flow v2 (`/index.php/login/v2`): interactive browser login
+/// that yields an app password. It is the only way to obtain working Nextcloud
+/// credentials when the account is protected by two-factor authentication —
+/// Basic auth with the real password is rejected server-side in that case.
+class LoginFlowApi {
+  final http.Client _client;
+
+  LoginFlowApi({http.Client? client}) : _client = client ?? http.Client();
+
+  /// Starts a new flow. Nextcloud displays the request's User-Agent as the
+  /// token name in the user's security settings, so the device token label is
+  /// sent (`"Marianum Fulda App (Pixel 10)"`).
+  Future<LoginFlowInit> start() async {
+    final userAgent = await DeviceTokenName.resolve();
+    final uri = _initUri();
+    const label = 'Nextcloud login flow init';
+    final response = (await sendGuarded(
+      label,
+      () => _client.post(
+        uri,
+        headers: {'Accept': 'application/json', 'User-Agent': userAgent},
+      ),
+    ))!;
+    if (response.statusCode < 200 || response.statusCode >= 300) {
+      throwForStatus(
+        response.statusCode,
+        httpErrorDetail(label, response.body, response.statusCode),
+      );
+    }
+    return LoginFlowInit.fromJson(
+      jsonDecode(utf8.decode(response.bodyBytes)) as Map<String, dynamic>,
+    );
+  }
+
+  /// Polls for the flow result: `null` while the browser login has not been
+  /// completed yet (HTTP 404), the final credentials once it has.
+  Future<LoginFlowCredentials?> poll(LoginFlowInit flow) async {
+    const label = 'Nextcloud login flow poll';
+    final response = (await sendGuarded(
+      label,
+      () => _client.post(
+        Uri.parse(flow.pollEndpoint),
+        headers: {'Accept': 'application/json'},
+        body: {'token': flow.pollToken},
+      ),
+    ))!;
+    if (response.statusCode == 404) return null;
+    if (response.statusCode < 200 || response.statusCode >= 300) {
+      throwForStatus(
+        response.statusCode,
+        httpErrorDetail(label, response.body, response.statusCode),
+      );
+    }
+    return LoginFlowCredentials.fromJson(
+      jsonDecode(utf8.decode(response.bodyBytes)) as Map<String, dynamic>,
+    );
+  }
+
+  static Uri _initUri() {
+    final endpoint = EndpointData().nextcloud();
+    return Uri.https(endpoint.domain, '${endpoint.path}/index.php/login/v2');
+  }
+
+  /// Whether the login name reported by the completed flow belongs to the
+  /// account this app session expects — the browser login could have been
+  /// completed with a different Nextcloud account.
+  static bool loginNameMatches({
+    required String expected,
+    required String actual,
+  }) => actual.trim().toLowerCase() == expected.trim().toLowerCase();
+}
+
+/// Response of the flow init call: the URL the user opens in the browser plus
+/// the token/endpoint pair the app polls until the login is confirmed.
+class LoginFlowInit {
+  final String loginUrl;
+  final String pollToken;
+  final String pollEndpoint;
+
+  const LoginFlowInit({
+    required this.loginUrl,
+    required this.pollToken,
+    required this.pollEndpoint,
+  });
+
+  factory LoginFlowInit.fromJson(Map<String, dynamic> json) {
+    final poll = json['poll'];
+    final loginUrl = json['login'] as String?;
+    final token = poll is Map ? poll['token'] as String? : null;
+    final endpoint = poll is Map ? poll['endpoint'] as String? : null;
+    if (loginUrl == null || loginUrl.isEmpty) {
+      throw const FormatException('login flow init: missing login url');
+    }
+    if (token == null || token.isEmpty || endpoint == null || endpoint.isEmpty) {
+      throw const FormatException('login flow init: missing poll token/endpoint');
+    }
+    return LoginFlowInit(
+      loginUrl: loginUrl,
+      pollToken: token,
+      pollEndpoint: endpoint,
+    );
+  }
+}
+
+/// Credentials returned once the user confirmed the login in the browser.
+class LoginFlowCredentials {
+  final String server;
+  final String loginName;
+  final String appPassword;
+
+  const LoginFlowCredentials({
+    required this.server,
+    required this.loginName,
+    required this.appPassword,
+  });
+
+  factory LoginFlowCredentials.fromJson(Map<String, dynamic> json) {
+    final loginName = json['loginName'] as String?;
+    final appPassword = json['appPassword'] as String?;
+    if (loginName == null || loginName.isEmpty) {
+      throw const FormatException('login flow poll: missing loginName');
+    }
+    if (appPassword == null || appPassword.isEmpty) {
+      throw const FormatException('login flow poll: missing appPassword');
+    }
+    return LoginFlowCredentials(
+      server: json['server'] as String? ?? '',
+      loginName: loginName,
+      appPassword: appPassword,
+    );
+  }
+}
@@ -1,3 +1,5 @@
+import 'dart:convert';
+
 import '../../model/account_data.dart';
 import '../../model/endpoint_data.dart';

@@ -6,6 +8,11 @@ import '../../model/endpoint_data.dart';
 class NextcloudOcs {
  NextcloudOcs._();

+  /// Decodes an OCS v2 JSON envelope and returns its `ocs` object (the wrapper
+  /// every response nests its `meta`/`data` under).
+  static Map<String, dynamic> decode(String raw) =>
+      (jsonDecode(raw) as Map<String, dynamic>)['ocs'] as Map<String, dynamic>;
+
  static Map<String, String> headers() => {
    'Accept': 'application/json',
    'OCS-APIRequest': 'true',
@@ -1,4 +1,3 @@
-import 'dart:convert';
 import 'dart:io';

 import 'package:http/http.dart' as http;
@@ -28,9 +27,7 @@ class SearchFiles {
        'Files search failed with ${response.statusCode}: ${response.body}',
      );
    }
-    final decoded = jsonDecode(response.body) as Map<String, dynamic>;
-    final ocs = decoded['ocs'] as Map<String, dynamic>;
-    final data = ocs['data'] as Map<String, dynamic>;
+    final data = NextcloudOcs.decode(response.body)['data'] as Map<String, dynamic>;
    return SearchFilesResponse.fromJson(data);
  }
 }
@@ -1,8 +1,7 @@
-import 'dart:convert';
-
 import 'package:http/http.dart' as http;
 import 'package:http/http.dart';

+import '../../nextcloud_ocs.dart';
 import '../talk_api.dart';
 import 'get_chat_params.dart';
 import 'get_chat_response.dart';
@@ -15,10 +14,8 @@ class GetChat extends TalkApi<GetChatResponse> {
    : super('v1/chat/$chatToken', null, getParameters: params.toJson());

  @override
-  GetChatResponse assemble(String raw) {
-    final decoded = jsonDecode(raw) as Map<String, dynamic>;
-    return GetChatResponse.fromJson(decoded['ocs'] as Map<String, dynamic>);
-  }
+  GetChatResponse assemble(String raw) =>
+      GetChatResponse.fromJson(NextcloudOcs.decode(raw));

  @override
  Future<Response> request(
@@ -16,7 +16,10 @@ class GetChatCache extends SimpleCache<GetChatResponse> {
           GetChatParams(
             lookIntoFuture: GetChatParamsSwitch.off,
             setReadMarker: GetChatParamsSwitch.on,
-             limit: 200,
+             // Small initial page; also the per-chat offline snapshot written to
+             // localstore. Older messages are paged in on scroll-up via
+             // GetChatHistory. Keep in sync with ChatBloc's _kInitialPageSize.
+             limit: 50,
           ),
         ).run(),
         fromJson: GetChatResponse.fromJson,
@@ -0,0 +1,56 @@
+import 'package:http/http.dart' as http;
+
+import '../../../errors/server_exception.dart';
+import '../../../http_errors.dart';
+import '../../nextcloud_ocs.dart';
+import 'get_chat_params.dart';
+import 'get_chat_response.dart';
+
+/// Backwards-paging variant of GetChat (`lookIntoFuture=0` + `lastKnownMessageId`)
+/// that fetches the page of messages *older* than a given id. Bypasses [TalkApi]
+/// because that layer treats non-2xx as errors, and the server answers HTTP 304
+/// when there are no older messages left — a normal "start of chat" outcome here.
+/// `setReadMarker=off` so paging into history never moves the read cursor.
+class GetChatHistory {
+  final String chatToken;
+  final int lastKnownMessageId;
+  final int limit;
+
+  GetChatHistory({
+    required this.chatToken,
+    required this.lastKnownMessageId,
+    required this.limit,
+  });
+
+  /// Returns the older page, or `null` on HTTP 304 (no older messages).
+  Future<GetChatResponse?> run() async {
+    final params = GetChatParams(
+      lookIntoFuture: GetChatParamsSwitch.off,
+      lastKnownMessageId: lastKnownMessageId,
+      includeLastKnown: GetChatParamsSwitch.off,
+      setReadMarker: GetChatParamsSwitch.off,
+      limit: limit,
+    );
+    final uri = NextcloudOcs.uri(
+      'apps/spreed/api/v1/chat/$chatToken',
+      queryParameters: params.toJson(),
+    );
+    final headers = NextcloudOcs.headers();
+
+    final response = (await sendGuarded(
+      'GetChatHistory $uri',
+      () => http.get(uri, headers: headers),
+    ))!;
+
+    final status = response.statusCode;
+    if (status == 304) return null;
+    if (status >= 200 && status < 300) {
+      return GetChatResponse.fromJson(NextcloudOcs.decode(response.body))
+        ..headers = response.headers;
+    }
+    throw ServerException(
+      statusCode: status,
+      technicalDetails: 'GetChatHistory $uri: HTTP $status',
+    );
+  }
+}
@@ -1,11 +1,7 @@
-import 'dart:async';
-import 'dart:convert';
-import 'dart:io';
-
 import 'package:http/http.dart' as http;

-import '../../../errors/network_exception.dart';
 import '../../../errors/server_exception.dart';
+import '../../../http_errors.dart';
 import '../../nextcloud_ocs.dart';
 import 'get_chat_params.dart';
 import 'get_chat_response.dart';
@@ -41,24 +37,17 @@ class LongPollChat {
    );
    final headers = NextcloudOcs.headers();

-    final http.Response response;
-    try {
-      response = await http
+    final response = (await sendGuarded(
+      'LongPollChat $uri',
+      () => http
          .get(uri, headers: headers)
-          .timeout(Duration(seconds: timeoutSeconds + 15));
-    } on TimeoutException catch (e) {
-      throw NetworkException.timeout(technicalDetails: 'LongPollChat $uri: $e');
-    } on SocketException catch (e) {
-      throw NetworkException(technicalDetails: 'LongPollChat $uri: ${e.message}');
-    } on http.ClientException catch (e) {
-      throw NetworkException(technicalDetails: 'LongPollChat $uri: ${e.message}');
-    }
+          .timeout(Duration(seconds: timeoutSeconds + 15)),
+    ))!;

    final status = response.statusCode;
    if (status == 304) return null;
    if (status >= 200 && status < 300) {
-      final decoded = jsonDecode(response.body) as Map<String, dynamic>;
-      return GetChatResponse.fromJson(decoded['ocs'] as Map<String, dynamic>)
+      return GetChatResponse.fromJson(NextcloudOcs.decode(response.body))
        ..headers = response.headers;
    }
    throw ServerException(
@@ -1,8 +1,7 @@
-import 'dart:convert';
-
 import 'package:http/http.dart' as http;

 import '../../../api_params.dart';
+import '../../nextcloud_ocs.dart';
 import '../get_poll/get_poll_state_response.dart';
 import '../talk_api.dart';

@@ -12,12 +11,8 @@ class ClosePoll extends TalkApi<GetPollStateResponse> {
    : super('v1/poll/$token/$pollId', null);

  @override
-  GetPollStateResponse assemble(String raw) {
-    final decoded = jsonDecode(raw) as Map<String, dynamic>;
-    return GetPollStateResponse.fromJson(
-      decoded['ocs'] as Map<String, dynamic>,
-    );
-  }
+  GetPollStateResponse assemble(String raw) =>
+      GetPollStateResponse.fromJson(NextcloudOcs.decode(raw));

  @override
  Future<http.Response> request(
@@ -1,8 +1,7 @@
-import 'dart:convert';
-
 import 'package:http/http.dart' as http;
 import 'package:http/http.dart';

+import '../../nextcloud_ocs.dart';
 import '../talk_api.dart';
 import 'create_room_params.dart';
 import 'create_room_response.dart';
@@ -13,10 +12,8 @@ class CreateRoom extends TalkApi<CreateRoomResponse> {
  CreateRoom(this.params) : super('v4/room', params);

  @override
-  CreateRoomResponse assemble(String raw) {
-    final decoded = jsonDecode(raw) as Map<String, dynamic>;
-    return CreateRoomResponse.fromJson(decoded['ocs'] as Map<String, dynamic>);
-  }
+  CreateRoomResponse assemble(String raw) =>
+      CreateRoomResponse.fromJson(NextcloudOcs.decode(raw));

  @override
  Future<Response>? request(
@@ -1,7 +1,6 @@
-import 'dart:convert';
-
 import 'package:http/http.dart' as http;

+import '../../nextcloud_ocs.dart';
 import '../talk_api.dart';
 import 'get_participants_response.dart';

@@ -10,12 +9,8 @@ class GetParticipants extends TalkApi<GetParticipantsResponse> {
  GetParticipants(this.token) : super('v4/room/$token/participants', null);

  @override
-  GetParticipantsResponse assemble(String raw) {
-    final decoded = jsonDecode(raw) as Map<String, dynamic>;
-    return GetParticipantsResponse.fromJson(
-      decoded['ocs'] as Map<String, dynamic>,
-    );
-  }
+  GetParticipantsResponse assemble(String raw) =>
+      GetParticipantsResponse.fromJson(NextcloudOcs.decode(raw));

  @override
  Future<http.Response> request(
@@ -1,7 +1,6 @@
-import 'dart:convert';
-
 import 'package:http/http.dart' as http;

+import '../../nextcloud_ocs.dart';
 import '../talk_api.dart';
 import 'get_poll_state_response.dart';

@@ -12,12 +11,8 @@ class GetPollState extends TalkApi<GetPollStateResponse> {
    : super('v1/poll/$token/$pollId', null);

  @override
-  GetPollStateResponse assemble(String raw) {
-    final decoded = jsonDecode(raw) as Map<String, dynamic>;
-    return GetPollStateResponse.fromJson(
-      decoded['ocs'] as Map<String, dynamic>,
-    );
-  }
+  GetPollStateResponse assemble(String raw) =>
+      GetPollStateResponse.fromJson(NextcloudOcs.decode(raw));

  @override
  Future<http.Response> request(
@@ -1,9 +1,8 @@
-import 'dart:convert';
-
 import 'package:http/http.dart' as http;
 import 'package:http/http.dart';

 import '../../../api_params.dart';
+import '../../nextcloud_ocs.dart';
 import '../talk_api.dart';
 import 'get_reactions_response.dart';

@@ -14,12 +13,8 @@ class GetReactions extends TalkApi<GetReactionsResponse> {
    : super('v1/reaction/$chatToken/$messageId', null);

  @override
-  GetReactionsResponse assemble(String raw) {
-    final decoded = jsonDecode(raw) as Map<String, dynamic>;
-    return GetReactionsResponse.fromJson(
-      decoded['ocs'] as Map<String, dynamic>,
-    );
-  }
+  GetReactionsResponse assemble(String raw) =>
+      GetReactionsResponse.fromJson(NextcloudOcs.decode(raw));

  @override
  Future<Response>? request(
@@ -0,0 +1,40 @@
+import 'package:http/http.dart' as http;
+
+import '../../nextcloud_ocs.dart';
+import '../talk_api.dart';
+import 'get_shared_items_response.dart';
+
+/// Fetches the messages that shared an item of a given [objectType] in a chat
+/// (Talk's `GET /chat/{token}/share`). Paginated via [lastKnownMessageId] using
+/// the `X-Chat-Last-Given` response header (see
+/// [GetSharedItemsResponse.lastGivenMessageId]).
+///
+/// Known [objectType]s: `media`, `file`, `audio`, `voice`, `location`,
+/// `deckcard`, `recording`, `other`.
+class GetSharedItems extends TalkApi<GetSharedItemsResponse> {
+  GetSharedItems(
+    String token, {
+    required String objectType,
+    int limit = 20,
+    int? lastKnownMessageId,
+  }) : super(
+         'v1/chat/$token/share',
+         null,
+         getParameters: {
+           'objectType': objectType,
+           'limit': limit,
+           'lastKnownMessageId': ?lastKnownMessageId,
+         },
+       );
+
+  @override
+  GetSharedItemsResponse assemble(String raw) =>
+      GetSharedItemsResponse.fromOcs(NextcloudOcs.decode(raw));
+
+  @override
+  Future<http.Response> request(
+    Uri uri,
+    Object? body,
+    Map<String, String>? headers,
+  ) => http.get(uri, headers: headers);
+}
@@ -0,0 +1,28 @@
+import 'package:http/http.dart' as http;
+
+import '../../nextcloud_ocs.dart';
+import '../talk_api.dart';
+import 'get_shared_items_overview_response.dart';
+
+/// Fetches the latest shared items of every type at once (Talk's
+/// `GET /chat/{token}/share/overview`). Used to decide which category tabs to
+/// show and to seed their first page. [limit] caps the items returned per type.
+class GetSharedItemsOverview extends TalkApi<GetSharedItemsOverviewResponse> {
+  GetSharedItemsOverview(String token, {int limit = 20})
+    : super(
+        'v1/chat/$token/share/overview',
+        null,
+        getParameters: {'limit': limit},
+      );
+
+  @override
+  GetSharedItemsOverviewResponse assemble(String raw) =>
+      GetSharedItemsOverviewResponse.fromOcs(NextcloudOcs.decode(raw));
+
+  @override
+  Future<http.Response> request(
+    Uri uri,
+    Object? body,
+    Map<String, String>? headers,
+  ) => http.get(uri, headers: headers);
+}
@@ -0,0 +1,32 @@
+import '../../../api_response.dart';
+import '../chat/get_chat_response.dart';
+
+/// Response of Talk's `GET /chat/{token}/share/overview`: the latest shared
+/// items grouped by object type (`media`, `file`, `voice`, `audio`, `location`,
+/// `recording`, `deckcard`, `other`). Reuses [GetChatResponseObject] for the
+/// message structure.
+class GetSharedItemsOverviewResponse extends ApiResponse {
+  final Map<String, List<GetChatResponseObject>> itemsByType;
+
+  GetSharedItemsOverviewResponse(this.itemsByType);
+
+  factory GetSharedItemsOverviewResponse.fromOcs(Map<String, dynamic> ocs) {
+    final data = ocs['data'];
+    final result = <String, List<GetChatResponseObject>>{};
+    if (data is Map<String, dynamic>) {
+      for (final entry in data.entries) {
+        final value = entry.value;
+        final raw = switch (value) {
+          List<dynamic> list => list,
+          Map<dynamic, dynamic> map => map.values,
+          _ => const <dynamic>[],
+        };
+        result[entry.key] = raw
+            .whereType<Map<String, dynamic>>()
+            .map(GetChatResponseObject.fromJson)
+            .toList();
+      }
+    }
+    return GetSharedItemsOverviewResponse(result);
+  }
+}
@@ -0,0 +1,35 @@
+import '../../../api_response.dart';
+import '../chat/get_chat_response.dart';
+
+/// Response of Talk's shared-items endpoints. The message objects carry the
+/// same structure as regular chat messages, so we reuse [GetChatResponseObject]
+/// (the shared file lives in `messageParameters['file']`).
+///
+/// The server returns `data` either as a list or as a message-id-keyed map
+/// depending on version; [fromOcs] normalises both to a list.
+class GetSharedItemsResponse extends ApiResponse {
+  final List<GetChatResponseObject> items;
+
+  GetSharedItemsResponse(this.items);
+
+  factory GetSharedItemsResponse.fromOcs(Map<String, dynamic> ocs) {
+    final data = ocs['data'];
+    final raw = switch (data) {
+      List<dynamic> list => list,
+      Map<dynamic, dynamic> map => map.values,
+      _ => const <dynamic>[],
+    };
+    final items = raw
+        .whereType<Map<String, dynamic>>()
+        .map(GetChatResponseObject.fromJson)
+        .toList();
+    return GetSharedItemsResponse(items);
+  }
+
+  /// Offset for the next page, taken from the `X-Chat-Last-Given` header.
+  /// Null when the header is absent (older server) — treat that as "stop".
+  int? get lastGivenMessageId {
+    final value = headers?['x-chat-last-given'];
+    return value == null ? null : int.tryParse(value);
+  }
+}
@@ -1,7 +1,6 @@
-import 'dart:convert';
-
 import 'package:http/http.dart' as http;

+import '../../nextcloud_ocs.dart';
 import '../talk_api.dart';
 import 'get_room_params.dart';
 import 'get_room_response.dart';
@@ -11,10 +10,8 @@ class GetRoom extends TalkApi<GetRoomResponse> {
  GetRoom(this.params) : super('v4/room', null, getParameters: params.toJson());

  @override
-  GetRoomResponse assemble(String raw) {
-    final decoded = jsonDecode(raw) as Map<String, dynamic>;
-    return GetRoomResponse.fromJson(decoded['ocs'] as Map<String, dynamic>);
-  }
+  GetRoomResponse assemble(String raw) =>
+      GetRoomResponse.fromJson(NextcloudOcs.decode(raw));

  @override
  Future<http.Response> request(
@@ -1,29 +1,20 @@
-import 'dart:async';
 import 'dart:developer';
-import 'dart:io';

 import 'package:http/http.dart' as http;

 import '../../api_params.dart';
-import '../../api_request.dart';
 import '../../api_response.dart';
-import '../../errors/auth_exception.dart';
 import '../../errors/network_exception.dart';
-import '../../errors/not_found_exception.dart';
 import '../../errors/parse_exception.dart';
-import '../../errors/server_exception.dart';
+import '../../http_errors.dart';
 import '../nextcloud_ocs.dart';

-enum TalkApiMethod { get, post, put, delete }
-
-abstract class TalkApi<T extends ApiResponse?> extends ApiRequest {
+abstract class TalkApi<T extends ApiResponse?> {
  String path;
  ApiParams? body;
  Map<String, String>? headers;
  Map<String, dynamic>? getParameters;

-  http.Response? response;
-
  TalkApi(this.path, this.body, {this.headers, this.getParameters});

  Future<http.Response>? request(
@@ -40,22 +31,15 @@ abstract class TalkApi<T extends ApiResponse?> extends ApiRequest {
    );
    final mergedHeaders = {...NextcloudOcs.headers(), ...?headers};

-    final http.Response data;
-    try {
-      final raw = await request(endpoint, body, mergedHeaders);
-      if (raw == null) {
-        throw const NetworkException(
-          userMessage: 'Keine Antwort vom Talk-Server erhalten.',
-          technicalDetails: 'Talk request returned null',
-        );
-      }
-      data = raw;
-    } on SocketException catch (e) {
-      throw NetworkException(technicalDetails: 'Talk $endpoint: ${e.message}');
-    } on TimeoutException catch (e) {
-      throw NetworkException.timeout(technicalDetails: 'Talk $endpoint: $e');
-    } on http.ClientException catch (e) {
-      throw NetworkException(technicalDetails: 'Talk $endpoint: ${e.message}');
+    final data = await sendGuarded(
+      'Talk $endpoint',
+      () => request(endpoint, body, mergedHeaders),
+    );
+    if (data == null) {
+      throw const NetworkException(
+        userMessage: 'Keine Antwort vom Talk-Server erhalten.',
+        technicalDetails: 'Talk request returned null',
+      );
    }

    final status = data.statusCode;
@@ -63,20 +47,9 @@ abstract class TalkApi<T extends ApiResponse?> extends ApiRequest {
      // Talk's OCS errors carry the real reason in the body (expired session,
      // removed participant, ...); include a trimmed preview so the dialog and
      // logs surface the cause instead of just the bare status code.
-      final body = data.body.replaceAll(RegExp(r'\s+'), ' ').trim();
-      final preview = body.length > 500 ? '${body.substring(0, 500)}…' : body;
-      final detail = body.isEmpty
-          ? 'Talk $endpoint -> HTTP $status'
-          : 'Talk $endpoint -> HTTP $status body=$preview';
+      final detail = httpErrorDetail('Talk $endpoint', data.body, status);
      log(detail);
-      if (status == 401) {
-        throw AuthException.unauthorized(technicalDetails: detail);
-      }
-      if (status == 403) {
-        throw AuthException.forbidden(technicalDetails: detail);
-      }
-      if (status == 404) throw NotFoundException(technicalDetails: detail);
-      throw ServerException(statusCode: status, technicalDetails: detail);
+      throwForStatus(status, detail);
    }

    try {
@@ -3,6 +3,7 @@ import 'dart:convert';
 import 'package:http/http.dart' as http;

 import '../../../api_params.dart';
+import '../../nextcloud_ocs.dart';
 import '../get_poll/get_poll_state_response.dart';
 import '../talk_api.dart';
 import 'vote_poll_params.dart';
@@ -22,12 +23,8 @@ class VotePoll extends TalkApi<GetPollStateResponse> {
       );

  @override
-  GetPollStateResponse assemble(String raw) {
-    final decoded = jsonDecode(raw) as Map<String, dynamic>;
-    return GetPollStateResponse.fromJson(
-      decoded['ocs'] as Map<String, dynamic>,
-    );
-  }
+  GetPollStateResponse assemble(String raw) =>
+      GetPollStateResponse.fromJson(NextcloudOcs.decode(raw));

  @override
  Future<http.Response>? request(
@@ -2,24 +2,36 @@ import 'package:nextcloud/nextcloud.dart';

 import '../../../model/account_data.dart';
 import '../../../model/endpoint_data.dart';
-import '../../api_request.dart';
 import '../../api_response.dart';

-abstract class WebdavApi<T> extends ApiRequest {
+abstract class WebdavApi<T> {
  T genericParams;

-  WebdavApi(this.genericParams) {
-    establishWebdavConnection();
-  }
+  WebdavApi(this.genericParams);

  Future<ApiResponse> run();

-  static Future<WebDavClient> webdav = establishWebdavConnection();
+  static Future<WebDavClient>? _webdav;
+  static String? _webdavSecret;
+
+  /// Shared WebDAV client. Rebuilt whenever the effective Nextcloud secret
+  /// changes (app password minted/renewed, account switch) so it never keeps
+  /// authenticating with stale credentials.
+  static Future<WebDavClient> get webdav {
+    final secret = AccountData().getNextcloudSecret();
+    if (_webdav == null || _webdavSecret != secret) {
+      _webdavSecret = secret;
+      _webdav = establishWebdavConnection();
+    }
+    return _webdav!;
+  }

  static Future<WebDavClient> establishWebdavConnection() async =>
      NextcloudClient(
        Uri.parse('https://${EndpointData().nextcloud().full()}'),
-        password: AccountData().getPassword(),
+        // App password preferred — with 2FA the real password is not accepted
+        // by Nextcloud at all (see AccountData.usesLoginFlow).
+        password: AccountData().getNextcloudSecret(),
        loginName: AccountData().getUsername(),
      ).webdav;

@@ -10,11 +10,25 @@ import 'auth/auth_interceptor.dart';
 class MarianumConnectApi {
  static const Duration _connectTimeout = Duration(seconds: 10);
  static const Duration _receiveTimeout = Duration(seconds: 20);
+  static const Duration _plainReceiveTimeout = Duration(seconds: 15);

  static final Dio _instance = _build();

  static Dio dio() => _instance;

+  /// A fresh dio with the standard JSON options but no interceptors — used by
+  /// the auth queries (login/verify) that must bypass the bearer/demo
+  /// interceptors to avoid a re-auth loop.
+  static Dio plainDio() => Dio(
+    BaseOptions(
+      connectTimeout: _connectTimeout,
+      sendTimeout: _connectTimeout,
+      receiveTimeout: _plainReceiveTimeout,
+      responseType: ResponseType.json,
+      contentType: 'application/json',
+    ),
+  );
+
  static Dio _build() {
    final dio = Dio(
      BaseOptions(
@@ -26,4 +26,36 @@ abstract class MarianumConnectQuery {
      throw mapMarianumConnectError(e);
    }
  }
+
+  /// GETs [path] and parses the JSON object body with [fromJson].
+  Future<T> getObject<T>(
+    String path,
+    T Function(Map<String, dynamic> json) fromJson, {
+    Map<String, dynamic>? queryParameters,
+  }) => guard(() async {
+    final response = await dio.get<Map<String, dynamic>>(
+      endpoint(path),
+      queryParameters: queryParameters,
+    );
+    return fromJson(response.data!);
+  });
+
+  /// GETs [path] and maps each element of the JSON array body with [fromJson].
+  Future<List<T>> getList<T>(
+    String path,
+    T Function(Map<String, dynamic> json) fromJson, {
+    Map<String, dynamic>? queryParameters,
+  }) => guard(() async {
+    final response = await dio.get<List<dynamic>>(
+      endpoint(path),
+      queryParameters: queryParameters,
+    );
+    return response.data!
+        .map((e) => fromJson(e as Map<String, dynamic>))
+        .toList();
+  });
+
+  /// Formats [d] as an ISO `yyyy-MM-dd` day for MarianumConnect query params.
+  String isoDate(DateTime d) =>
+      '${d.year.toString().padLeft(4, '0')}-${d.month.toString().padLeft(2, '0')}-${d.day.toString().padLeft(2, '0')}';
 }
@@ -0,0 +1,13 @@
+import '../../marianumconnect_query.dart';
+
+/// GETs the selectable classes for the absence form (`absence/classes`). The
+/// body is a bare JSON string array, so [getList] (which maps objects) does not
+/// fit — read the raw list and cast.
+class AbsenceClasses extends MarianumConnectQuery {
+  AbsenceClasses({super.dio});
+
+  Future<List<String>> run() => guard(() async {
+    final response = await dio.get<List<dynamic>>(endpoint('absence/classes'));
+    return response.data!.cast<String>();
+  });
+}
@@ -0,0 +1,10 @@
+import '../../marianumconnect_query.dart';
+import 'absence_prefill_response.dart';
+
+/// GETs the absence-report form prefill (`absence/prefill`, bearer-auth).
+class AbsencePrefill extends MarianumConnectQuery {
+  AbsencePrefill({super.dio});
+
+  Future<AbsencePrefillResponse> run() =>
+      getObject('absence/prefill', AbsencePrefillResponse.fromJson);
+}
@@ -0,0 +1,28 @@
+import 'package:json_annotation/json_annotation.dart';
+
+part 'absence_prefill_response.g.dart';
+
+/// Prefill for the absence-report form: identity from LDAP plus the phone
+/// number from the user's last report (empty strings when unknown).
+@JsonSerializable()
+class AbsencePrefillResponse {
+  @JsonKey(defaultValue: '')
+  final String firstName;
+  @JsonKey(defaultValue: '')
+  final String lastName;
+  @JsonKey(defaultValue: '')
+  final String className;
+  @JsonKey(defaultValue: '')
+  final String phone;
+
+  AbsencePrefillResponse({
+    required this.firstName,
+    required this.lastName,
+    required this.className,
+    required this.phone,
+  });
+
+  factory AbsencePrefillResponse.fromJson(Map<String, dynamic> json) =>
+      _$AbsencePrefillResponseFromJson(json);
+  Map<String, dynamic> toJson() => _$AbsencePrefillResponseToJson(this);
+}
@@ -0,0 +1,25 @@
+// GENERATED CODE - DO NOT MODIFY BY HAND
+
+part of 'absence_prefill_response.dart';
+
+// **************************************************************************
+// JsonSerializableGenerator
+// **************************************************************************
+
+AbsencePrefillResponse _$AbsencePrefillResponseFromJson(
+  Map<String, dynamic> json,
+) => AbsencePrefillResponse(
+  firstName: json['firstName'] as String? ?? '',
+  lastName: json['lastName'] as String? ?? '',
+  className: json['className'] as String? ?? '',
+  phone: json['phone'] as String? ?? '',
+);
+
+Map<String, dynamic> _$AbsencePrefillResponseToJson(
+  AbsencePrefillResponse instance,
+) => <String, dynamic>{
+  'firstName': instance.firstName,
+  'lastName': instance.lastName,
+  'className': instance.className,
+  'phone': instance.phone,
+};
@@ -0,0 +1,32 @@
+import '../../marianumconnect_query.dart';
+
+/// Submits an absence report (`POST absence`, bearer-auth, `source=mobile`).
+/// Empty identity fields are backfilled from LDAP server-side; validation
+/// (all fields required, class must exist, no past start date, end >= start)
+/// also runs server-side and mirrors the client checks.
+class AbsenceSubmit extends MarianumConnectQuery {
+  AbsenceSubmit({super.dio});
+
+  Future<void> run({
+    required String firstName,
+    required String lastName,
+    required String className,
+    required DateTime absentFrom,
+    required DateTime absentUntil,
+    required String phone,
+    required String note,
+  }) => guard(() async {
+    await dio.post<void>(
+      endpoint('absence'),
+      data: {
+        'firstName': firstName,
+        'lastName': lastName,
+        'className': className,
+        'absentFrom': isoDate(absentFrom),
+        'absentUntil': isoDate(absentUntil),
+        'phone': phone,
+        'note': note,
+      },
+    );
+  });
+}
@@ -1,6 +1,7 @@
 import 'package:dio/dio.dart';

 import '../../auth/token_storage.dart';
+import '../../marianumconnect_api.dart';
 import '../../marianumconnect_query.dart';
 import 'auth_login_response.dart';

@@ -9,9 +10,6 @@ import 'auth_login_response.dart';
 /// run through the shared dio instance — that one has the interceptor, which
 /// would attempt to re-auth us into a loop if our credentials are wrong.
 class AuthLogin extends MarianumConnectQuery {
-  static const Duration _connectTimeout = Duration(seconds: 10);
-  static const Duration _receiveTimeout = Duration(seconds: 15);
-
  final MarianumConnectTokenStorage _tokenStorage;

  AuthLogin({
@@ -19,17 +17,7 @@ class AuthLogin extends MarianumConnectQuery {
        const MarianumConnectTokenStorage(),
    Dio? dio,
  }) : _tokenStorage = tokenStorage,
-       super(dio: dio ?? _buildDio());
-
-  static Dio _buildDio() => Dio(
-    BaseOptions(
-      connectTimeout: _connectTimeout,
-      receiveTimeout: _receiveTimeout,
-      sendTimeout: _connectTimeout,
-      responseType: ResponseType.json,
-      contentType: 'application/json',
-    ),
-  );
+       super(dio: dio ?? MarianumConnectApi.plainDio());

  Future<AuthLoginResponse> run({
    required String username,
@@ -2,6 +2,7 @@ import 'package:dio/dio.dart';

 import '../../../errors/auth_exception.dart';
 import '../../auth/token_storage.dart';
+import '../../marianumconnect_api.dart';
 import '../../marianumconnect_query.dart';

 /// Probes that the stored bearer token still maps to the given credentials.
@@ -12,9 +13,6 @@ import '../../marianumconnect_query.dart';
 /// Bypasses the shared dio singleton so the auth interceptor doesn't kick in
 /// and obscure a real 401 with a silent re-login.
 class AuthVerify extends MarianumConnectQuery {
-  static const Duration _connectTimeout = Duration(seconds: 10);
-  static const Duration _receiveTimeout = Duration(seconds: 15);
-
  final MarianumConnectTokenStorage _tokenStorage;

  AuthVerify({
@@ -22,17 +20,7 @@ class AuthVerify extends MarianumConnectQuery {
        const MarianumConnectTokenStorage(),
    Dio? dio,
  }) : _tokenStorage = tokenStorage,
-       super(dio: dio ?? _buildDio());
-
-  static Dio _buildDio() => Dio(
-    BaseOptions(
-      connectTimeout: _connectTimeout,
-      sendTimeout: _connectTimeout,
-      receiveTimeout: _receiveTimeout,
-      responseType: ResponseType.json,
-      contentType: 'application/json',
-    ),
-  );
+       super(dio: dio ?? MarianumConnectApi.plainDio());

  /// Throws [AuthException] on 401 (credentials no longer match the token's
  /// user, token missing, or token rejected), other [AppException]s on
@@ -7,8 +7,6 @@ import 'get_breakers_response.dart';
 class GetBreakers extends MarianumConnectQuery {
  GetBreakers({super.dio});

-  Future<GetBreakersResponse> run() => guard(() async {
-    final response = await dio.get<Map<String, dynamic>>(endpoint('breaker'));
-    return GetBreakersResponse.fromJson(response.data!);
-  });
+  Future<GetBreakersResponse> run() =>
+      getObject('breaker', GetBreakersResponse.fromJson);
 }
@@ -7,10 +7,6 @@ import 'get_capabilities_response.dart';
 class GetCapabilities extends MarianumConnectQuery {
  GetCapabilities({super.dio});

-  Future<CapabilitiesResponse> run() => guard(() async {
-    final response = await dio.get<Map<String, dynamic>>(
-      endpoint('me/capabilities'),
-    );
-    return CapabilitiesResponse.fromJson(response.data!);
-  });
+  Future<CapabilitiesResponse> run() =>
+      getObject('me/capabilities', CapabilitiesResponse.fromJson);
 }
@@ -16,9 +16,23 @@ class CapabilitiesResponse {
  @JsonKey(defaultValue: false)
  final bool pushNotifications;

+  /// How many days into the past/future the user may view the timetable.
+  /// `null` (absent) means unlimited — the school year alone governs. The
+  /// backend widens both to at least cover the current Mon–Sun week.
+  final int? timetablePastDays;
+
+  final int? timetableFutureDays;
+
+  /// LDAP user type ('TEACHER' | 'STUDENT' | 'STAFF'). Null when the backend
+  /// predates the field or has no LDAP record for the user.
+  final String? userType;
+
  CapabilitiesResponse({
    required this.viewForeignTimetables,
    required this.pushNotifications,
+    this.timetablePastDays,
+    this.timetableFutureDays,
+    this.userType,
  });

  factory CapabilitiesResponse.fromJson(Map<String, dynamic> json) =>
@@ -11,6 +11,9 @@ CapabilitiesResponse _$CapabilitiesResponseFromJson(
 ) => CapabilitiesResponse(
  viewForeignTimetables: json['viewForeignTimetables'] as bool? ?? false,
  pushNotifications: json['pushNotifications'] as bool? ?? false,
+  timetablePastDays: (json['timetablePastDays'] as num?)?.toInt(),
+  timetableFutureDays: (json['timetableFutureDays'] as num?)?.toInt(),
+  userType: json['userType'] as String?,
 );

 Map<String, dynamic> _$CapabilitiesResponseToJson(
@@ -18,4 +21,7 @@ Map<String, dynamic> _$CapabilitiesResponseToJson(
 ) => <String, dynamic>{
  'viewForeignTimetables': instance.viewForeignTimetables,
  'pushNotifications': instance.pushNotifications,
+  'timetablePastDays': instance.timetablePastDays,
+  'timetableFutureDays': instance.timetableFutureDays,
+  'userType': instance.userType,
 };
@@ -4,10 +4,5 @@ import '../../models/mc_holiday.dart';
 class GetHolidays extends MarianumConnectQuery {
  GetHolidays({super.dio});

-  Future<List<McHoliday>> run() => guard(() async {
-    final response = await dio.get<List<dynamic>>(endpoint('holidays'));
-    return response.data!
-        .map((e) => McHoliday.fromJson(e as Map<String, dynamic>))
-        .toList();
-  });
+  Future<List<McHoliday>> run() => getList('holidays', McHoliday.fromJson);
 }
@@ -6,8 +6,6 @@ import 'get_ticker_response.dart';
 class GetTicker extends MarianumConnectQuery {
  GetTicker({super.dio});

-  Future<TickerResponse> run() => guard(() async {
-    final response = await dio.get<Map<String, dynamic>>(endpoint('ticker'));
-    return TickerResponse.fromJson(response.data!);
-  });
+  Future<TickerResponse> run() =>
+      getObject('ticker', TickerResponse.fromJson);
 }
@@ -6,10 +6,6 @@ import 'get_ticker_nav_response.dart';
 class GetTickerNav extends MarianumConnectQuery {
  GetTickerNav({super.dio});

-  Future<TickerNavResponse> run() => guard(() async {
-    final response = await dio.get<Map<String, dynamic>>(
-      endpoint('ticker/pages'),
-    );
-    return TickerNavResponse.fromJson(response.data!);
-  });
+  Future<TickerNavResponse> run() =>
+      getObject('ticker/pages', TickerNavResponse.fromJson);
 }
@@ -12,8 +12,9 @@ import 'telemetry_device_id.dart';

 /// Sends a telemetry heartbeat to MarianumConnect (`POST me/telemetry`) —
 /// upserts the stable install id, platform, app version and device info. Sent
-/// once on app start and again once push registration completes that session
-/// (so a fresh registration isn't under-reported until the next launch).
+/// on app start, again once push registration completes that session (so a
+/// fresh registration isn't under-reported until the next launch), and on
+/// resume after the app spent more than 15 minutes in the background.
 /// Bearer-authenticated via the shared dio interceptor. Replaces the legacy
 /// mhsl.eu `server/userIndex/update` call.
 class TelemetryHeartbeat extends MarianumConnectQuery {
@@ -21,7 +22,8 @@ class TelemetryHeartbeat extends MarianumConnectQuery {

  /// Fire-and-forget: schedules a heartbeat and swallows any error, so a failed
  /// send never disrupts app start. Used from the app shell's initState and
-  /// re-emitted once push registration completes (see `_MainState._syncPush`).
+  /// lifecycle handler, and re-emitted once push registration completes (see
+  /// `_MainState._syncPush`).
  static void report({required bool notificationsEnabled}) {
    unawaited(
      TelemetryHeartbeat()
@@ -4,10 +4,8 @@ import '../../marianumconnect_query.dart';
 class TimetableCustomEventsGet extends MarianumConnectQuery {
  TimetableCustomEventsGet({super.dio});

-  Future<GetCustomTimetableEventResponse> run() => guard(() async {
-    final response = await dio.get<Map<String, dynamic>>(
-      endpoint('timetable/custom-events'),
-    );
-    return GetCustomTimetableEventResponse.fromJson(response.data!);
-  });
+  Future<GetCustomTimetableEventResponse> run() => getObject(
+    'timetable/custom-events',
+    GetCustomTimetableEventResponse.fromJson,
+  );
 }
@@ -4,13 +4,11 @@ import 'timetable_get_classes_response.dart';
 class TimetableGetClasses extends MarianumConnectQuery {
  TimetableGetClasses({super.dio});

-  Future<TimetableGetClassesResponse> run() => guard(() async {
-    final response = await dio.get<List<dynamic>>(
-      endpoint('timetable/elements/classes'),
-    );
-    final list = response.data!
-        .map((e) => McTimetableClass.fromJson(e as Map<String, dynamic>))
-        .toList();
-    return TimetableGetClassesResponse(result: list);
-  });
+  Future<TimetableGetClassesResponse> run() async =>
+      TimetableGetClassesResponse(
+        result: await getList(
+          'timetable/elements/classes',
+          McTimetableClass.fromJson,
+        ),
+      );
 }
@@ -13,14 +13,9 @@ class TimetableGetElementWeek extends MarianumConnectQuery {
    required int id,
    required DateTime from,
    required DateTime until,
-  }) => guard(() async {
-    final response = await dio.get<Map<String, dynamic>>(
-      endpoint('timetable/${type.pathSegment}/$id'),
-      queryParameters: {'from': _format(from), 'until': _format(until)},
-    );
-    return TimetableGetWeekResponse.fromJson(response.data!);
-  });
-
-  String _format(DateTime d) =>
-      '${d.year.toString().padLeft(4, '0')}-${d.month.toString().padLeft(2, '0')}-${d.day.toString().padLeft(2, '0')}';
+  }) => getObject(
+    'timetable/${type.pathSegment}/$id',
+    TimetableGetWeekResponse.fromJson,
+    queryParameters: {'from': isoDate(from), 'until': isoDate(until)},
+  );
 }
@@ -4,13 +4,8 @@ import 'timetable_get_holidays_response.dart';
 class TimetableGetHolidays extends MarianumConnectQuery {
  TimetableGetHolidays({super.dio});

-  Future<TimetableGetHolidaysResponse> run() => guard(() async {
-    final response = await dio.get<List<dynamic>>(
-      endpoint('timetable/holidays'),
-    );
-    final list = response.data!
-        .map((e) => McHoliday.fromJson(e as Map<String, dynamic>))
-        .toList();
-    return TimetableGetHolidaysResponse(result: list);
-  });
+  Future<TimetableGetHolidaysResponse> run() async =>
+      TimetableGetHolidaysResponse(
+        result: await getList('timetable/holidays', McHoliday.fromJson),
+      );
 }
@@ -4,11 +4,7 @@ import 'timetable_get_rooms_response.dart';
 class TimetableGetRooms extends MarianumConnectQuery {
  TimetableGetRooms({super.dio});

-  Future<TimetableGetRoomsResponse> run() => guard(() async {
-    final response = await dio.get<List<dynamic>>(endpoint('timetable/rooms'));
-    final list = response.data!
-        .map((e) => McRoom.fromJson(e as Map<String, dynamic>))
-        .toList();
-    return TimetableGetRoomsResponse(result: list);
-  });
+  Future<TimetableGetRoomsResponse> run() async => TimetableGetRoomsResponse(
+    result: await getList('timetable/rooms', McRoom.fromJson),
+  );
 }
@@ -4,10 +4,6 @@ import 'timetable_get_schoolyear_response.dart';
 class TimetableGetSchoolyear extends MarianumConnectQuery {
  TimetableGetSchoolyear({super.dio});

-  Future<TimetableGetSchoolyearResponse> run() => guard(() async {
-    final response = await dio.get<Map<String, dynamic>>(
-      endpoint('timetable/schoolyear'),
-    );
-    return TimetableGetSchoolyearResponse.fromJson(response.data!);
-  });
+  Future<TimetableGetSchoolyearResponse> run() =>
+      getObject('timetable/schoolyear', TimetableGetSchoolyearResponse.fromJson);
 }
@@ -4,13 +4,11 @@ import 'timetable_get_students_response.dart';
 class TimetableGetStudents extends MarianumConnectQuery {
  TimetableGetStudents({super.dio});

-  Future<TimetableGetStudentsResponse> run() => guard(() async {
-    final response = await dio.get<List<dynamic>>(
-      endpoint('timetable/elements/students'),
-    );
-    final list = response.data!
-        .map((e) => McTimetableStudent.fromJson(e as Map<String, dynamic>))
-        .toList();
-    return TimetableGetStudentsResponse(result: list);
-  });
+  Future<TimetableGetStudentsResponse> run() async =>
+      TimetableGetStudentsResponse(
+        result: await getList(
+          'timetable/elements/students',
+          McTimetableStudent.fromJson,
+        ),
+      );
 }
@@ -4,13 +4,8 @@ import 'timetable_get_subjects_response.dart';
 class TimetableGetSubjects extends MarianumConnectQuery {
  TimetableGetSubjects({super.dio});

-  Future<TimetableGetSubjectsResponse> run() => guard(() async {
-    final response = await dio.get<List<dynamic>>(
-      endpoint('timetable/subjects'),
-    );
-    final list = response.data!
-        .map((e) => McSubject.fromJson(e as Map<String, dynamic>))
-        .toList();
-    return TimetableGetSubjectsResponse(result: list);
-  });
+  Future<TimetableGetSubjectsResponse> run() async =>
+      TimetableGetSubjectsResponse(
+        result: await getList('timetable/subjects', McSubject.fromJson),
+      );
 }
@@ -4,13 +4,11 @@ import 'timetable_get_teachers_response.dart';
 class TimetableGetTeachers extends MarianumConnectQuery {
  TimetableGetTeachers({super.dio});

-  Future<TimetableGetTeachersResponse> run() => guard(() async {
-    final response = await dio.get<List<dynamic>>(
-      endpoint('timetable/elements/teachers'),
-    );
-    final list = response.data!
-        .map((e) => McTimetableTeacherElement.fromJson(e as Map<String, dynamic>))
-        .toList();
-    return TimetableGetTeachersResponse(result: list);
-  });
+  Future<TimetableGetTeachersResponse> run() async =>
+      TimetableGetTeachersResponse(
+        result: await getList(
+          'timetable/elements/teachers',
+          McTimetableTeacherElement.fromJson,
+        ),
+      );
 }
@@ -4,13 +4,8 @@ import 'timetable_get_timegrid_response.dart';
 class TimetableGetTimegrid extends MarianumConnectQuery {
  TimetableGetTimegrid({super.dio});

-  Future<TimetableGetTimegridResponse> run() => guard(() async {
-    final response = await dio.get<List<dynamic>>(
-      endpoint('timetable/timegrid'),
-    );
-    final list = response.data!
-        .map((e) => McTimegridUnit.fromJson(e as Map<String, dynamic>))
-        .toList();
-    return TimetableGetTimegridResponse(result: list);
-  });
+  Future<TimetableGetTimegridResponse> run() async =>
+      TimetableGetTimegridResponse(
+        result: await getList('timetable/timegrid', McTimegridUnit.fromJson),
+      );
 }
@@ -7,14 +7,9 @@ class TimetableGetWeek extends MarianumConnectQuery {
  Future<TimetableGetWeekResponse> run({
    required DateTime from,
    required DateTime until,
-  }) => guard(() async {
-    final response = await dio.get<Map<String, dynamic>>(
-      endpoint('timetable/me'),
-      queryParameters: {'from': _format(from), 'until': _format(until)},
-    );
-    return TimetableGetWeekResponse.fromJson(response.data!);
-  });
-
-  String _format(DateTime d) =>
-      '${d.year.toString().padLeft(4, '0')}-${d.month.toString().padLeft(2, '0')}-${d.day.toString().padLeft(2, '0')}';
+  }) => getObject(
+    'timetable/me',
+    TimetableGetWeekResponse.fromJson,
+    queryParameters: {'from': isoDate(from), 'until': isoDate(until)},
+  );
 }
@@ -7,14 +7,11 @@ import 'user_search_response.dart';
 class UserSearch extends MarianumConnectQuery {
  UserSearch({super.dio});

-  Future<UserSearchResponse> run(String query) => guard(() async {
-    final response = await dio.get<List<dynamic>>(
-      endpoint('users/search'),
+  Future<UserSearchResponse> run(String query) async => UserSearchResponse(
+    result: await getList(
+      'users/search',
+      McUserSearchResult.fromJson,
      queryParameters: {'q': query},
-    );
-    final list = response.data!
-        .map((e) => McUserSearchResult.fromJson(e as Map<String, dynamic>))
-        .toList();
-    return UserSearchResponse(result: list);
-  });
+    ),
+  );
 }
@@ -1,21 +1,16 @@
-import 'dart:async';
 import 'dart:convert';
-import 'dart:io';

 import 'package:http/http.dart' as http;
-import 'package:jiffy/jiffy.dart';

-import '../api_request.dart';
 import '../errors/network_exception.dart';
 import '../errors/parse_exception.dart';
 import '../errors/server_exception.dart';
+import '../http_errors.dart';

-abstract class MhslApi<T> extends ApiRequest {
+abstract class MhslApi<T> {
  String subpath;
  MhslApi(this.subpath);

-  http.Response? response;
-
  Future<http.Response>? request(Uri uri);
  T assemble(String raw);

@@ -24,22 +19,12 @@ abstract class MhslApi<T> extends ApiRequest {
      'https://mhsl.eu/marianum/marianummobile/$subpath',
    );

-    final http.Response data;
-    try {
-      final raw = await request(endpoint);
-      if (raw == null) {
-        throw const NetworkException(
-          userMessage: 'Keine Antwort vom MHSL-Dienst erhalten.',
-          technicalDetails: 'mhsl request returned null',
-        );
-      }
-      data = raw;
-    } on SocketException catch (e) {
-      throw NetworkException(technicalDetails: 'mhsl $subpath: ${e.message}');
-    } on TimeoutException catch (e) {
-      throw NetworkException.timeout(technicalDetails: 'mhsl $subpath: $e');
-    } on http.ClientException catch (e) {
-      throw NetworkException(technicalDetails: 'mhsl $subpath: ${e.message}');
+    final data = await sendGuarded('mhsl $subpath', () => request(endpoint));
+    if (data == null) {
+      throw const NetworkException(
+        userMessage: 'Keine Antwort vom MHSL-Dienst erhalten.',
+        technicalDetails: 'mhsl request returned null',
+      );
    }

    if (data.statusCode > 299) {
@@ -55,8 +40,4 @@ abstract class MhslApi<T> extends ApiRequest {
      throw ParseException(technicalDetails: 'mhsl $subpath assemble: $e');
    }
  }
-
-  static String dateTimeToJson(DateTime time) =>
-      Jiffy.parseFromDateTime(time).format(pattern: 'yyyy-MM-dd HH:mm:ss');
-  static DateTime dateTimeFromJson(String time) => DateTime.parse(time);
 }
@@ -18,6 +18,7 @@ import 'routing/app_routes.dart';
 import 'share_intent/share_intent_listener.dart';
 import 'state/app/modules/app_modules.dart';
 import 'state/app/modules/breaker/bloc/breaker_bloc.dart';
+import 'state/app/modules/capabilities/bloc/capabilities_cubit.dart';
 import 'state/app/modules/chat_list/bloc/chat_list_bloc.dart';
 import 'state/app/modules/settings/bloc/settings_cubit.dart';
 import 'state/app/modules/timetable/bloc/timetable_bloc.dart';
@@ -46,9 +47,11 @@ class _AppState extends State<App> with WidgetsBindingObserver {
  int _knownTotalTabs = 1;
  int _lastTabIndex = 0;
  bool _userOnLastTab = false;
+  DateTime? _lastTelemetryAt;

  static const Duration _chatListActiveInterval = Duration(seconds: 15);
  static const Duration _chatListIdleInterval = Duration(seconds: 60);
+  static const Duration _telemetryInterval = Duration(minutes: 15);

  void _onTabControllerChanged() {
    final newIndex = Main.bottomNavigator.index;
@@ -60,7 +63,7 @@ class _AppState extends State<App> with WidgetsBindingObserver {
    _syncChatListPolling();
  }

-  void _syncChatListPolling() {
+  void _syncChatListPolling({bool refresh = true}) {
    if (!mounted) return;
    final modules = AppModule.getBottomBarModules(context);
    final talkSlot = modules.indexWhere((m) => m.module == Modules.talk);
@@ -70,19 +73,45 @@ class _AppState extends State<App> with WidgetsBindingObserver {
    bloc.setAutoRefreshInterval(
      talkIsActive ? _chatListActiveInterval : _chatListIdleInterval,
    );
-    if (talkIsActive) bloc.refresh();
+    if (talkIsActive && refresh) bloc.refresh();
+  }
+
+  // Wall-clock throttle rather than Debouncer.throttle: a Timer does not tick
+  // reliably while the app is suspended, so the window would still be open on
+  // the resume it is supposed to let through.
+  void _reportTelemetry() {
+    if (!mounted) return;
+    final now = DateTime.now();
+    final last = _lastTelemetryAt;
+    if (last != null && now.difference(last) < _telemetryInterval) return;
+    _lastTelemetryAt = now;
+    TelemetryHeartbeat.report(
+      notificationsEnabled: context
+          .read<SettingsCubit>()
+          .val()
+          .notificationSettings
+          .enabled,
+    );
  }

  @override
  void didChangeAppLifecycleState(AppLifecycleState state) {
    log('AppLifecycle: $state');
    if (state == AppLifecycleState.resumed) {
+      _reportTelemetry();
      Debouncer.throttle('appLifecycleState', const Duration(seconds: 10), () {
        if (!mounted) return;
        log('Refreshing due to LifecycleChange');
        NotificationTasks.updateProviders(context);
      });
+      // updateProviders already refreshes the chat list; only re-arm the poll.
+      _syncChatListPolling(refresh: false);
      _handlePendingWidgetNavigation();
+    } else if (mounted) {
+      // Stop polling while backgrounded: a silent refresh failing in the
+      // background would otherwise leave an error that flashes on the next
+      // resume before the foreground refetch replaces it.
+      context.read<ChatListBloc>().setAutoRefreshInterval(null);
    }
  }

@@ -145,6 +174,7 @@ class _AppState extends State<App> with WidgetsBindingObserver {
      // Mirror BLoC updates into the home-screen widget without waiting
      // for the periodic background refresh.
      final settingsCubit = context.read<SettingsCubit>();
+      final capabilitiesCubit = context.read<CapabilitiesCubit>();
      _timetableWidgetSync?.cancel();
      _timetableWidgetSync = timetable.stream.listen((state) {
        final data = state.data;
@@ -153,6 +183,7 @@ class _AppState extends State<App> with WidgetsBindingObserver {
            WidgetPublisher.publishFromBlocState(
              data,
              settings: settingsCubit.val(),
+              isTeacher: capabilitiesCubit.isTeacher,
            ),
          );
        }
@@ -164,6 +195,7 @@ class _AppState extends State<App> with WidgetsBindingObserver {
          WidgetPublisher.publishFromBlocState(
            initialData,
            settings: settingsCubit.val(),
+            isTeacher: capabilitiesCubit.isTeacher,
          ),
        );
      }
@@ -178,10 +210,7 @@ class _AppState extends State<App> with WidgetsBindingObserver {
      if (mounted) setState(() {});
    });

-    TelemetryHeartbeat.report(
-      notificationsEnabled:
-          context.read<SettingsCubit>().val().notificationSettings.enabled,
-    );
+    _reportTelemetry();

    // A refreshed FCM token invalidates the existing push subscription — the
    // NC device identifier stays stable, so we simply re-register (NC first,
@@ -256,9 +285,7 @@ class _AppState extends State<App> with WidgetsBindingObserver {

      if (totalTabs != _knownTotalTabs) {
        var targetIndex = currentIndex;
-        if (_userOnLastTab) {
-          targetIndex = totalTabs - 1;
-        } else if (currentIndex >= totalTabs) {
+        if (_userOnLastTab || currentIndex >= totalTabs) {
          targetIndex = totalTabs - 1;
        }
        // Replace the controller atomically: a stale index past the new
@@ -1,5 +1,6 @@
 import 'dart:async';
 import 'dart:developer';
+import 'dart:io';

 import 'package:flutter/widgets.dart';
 import 'package:workmanager/workmanager.dart';
@@ -32,12 +33,20 @@ class WidgetBackgroundTask {

  static const Duration periodicFrequency = Duration(minutes: 30);

+  /// A snapshot younger than this is considered fresh enough — a second
+  /// trigger within the window (push + periodic slot coinciding) is skipped.
+  static const Duration refreshDebounce = Duration(minutes: 10);
+
  static Future<void> initialize() async {
    await Workmanager().initialize(_callbackDispatcher);
    await Workmanager().registerPeriodicTask(
      periodicTaskName,
      periodicTaskName,
      frequency: periodicFrequency,
+      // iOS ignores `frequency:` and instead uses initialDelay as the
+      // BGAppRefresh earliestBeginDate on every (auto-)resubmission —
+      // without it each completed run is immediately eligible again.
+      initialDelay: Platform.isIOS ? periodicFrequency : Duration.zero,
      constraints: Constraints(networkType: NetworkType.connected),
      existingWorkPolicy: ExistingPeriodicWorkPolicy.keep,
      backoffPolicy: BackoffPolicy.linear,
@@ -45,7 +54,21 @@ class WidgetBackgroundTask {
    );
  }

-  static Future<void> requestImmediateRefresh() async {
+  /// Single owner of the platform strategy for "refresh soon": Android
+  /// enqueues a WorkManager one-off (retry + network constraint included),
+  /// iOS runs inline — one-off Workmanager tasks there only execute
+  /// in-process anyway, so the direct call is equivalent and skips the extra
+  /// background engine. [inlineTimeout] bounds the inline path for callers
+  /// with a hard budget (FCM handler).
+  static Future<void> requestImmediateRefresh({
+    bool force = true,
+    Duration? inlineTimeout,
+  }) async {
+    if (Platform.isIOS) {
+      final refresh = runRefreshNow(force: force);
+      await (inlineTimeout == null ? refresh : refresh.timeout(inlineTimeout));
+      return;
+    }
    await Workmanager().registerOneOffTask(
      '$oneOffTaskName-${DateTime.now().millisecondsSinceEpoch}',
      oneOffTaskName,
@@ -54,24 +77,61 @@ class WidgetBackgroundTask {
    );
  }

+  /// Shared refresh entry for the periodic worker, push triggers, and login.
+  /// Throws on fetch failure so the worker path can signal a retry.
+  static Future<void> runRefreshNow({bool force = false}) async {
+    await WidgetSync.ensureInitialized();
+    bool populated;
+    try {
+      // Bounded: a hanging keystore read must not stall the caller's budget
+      // (FCM handler ~25s on iOS) forever.
+      populated = await AccountData().waitForPopulation().timeout(
+        const Duration(seconds: 10),
+      );
+    } on TimeoutException {
+      populated = false;
+    }
+    if (!populated) {
+      // Deliberately does NOT flip the widget to logged-out: a failed or slow
+      // keychain read (locked iOS device during the 06:00 silent push) is
+      // indistinguishable from "never logged in" here, and blanking the
+      // widget on a transient failure is worse than keeping the snapshot.
+      // Logout/login manage the flag explicitly (WidgetSync.clear / login).
+      log('[widget-refresh] credentials unavailable, skipping refresh');
+      return;
+    }
+    final fetchedAt = await WidgetSync.getFetchedAt();
+    if (shouldSkipRefresh(fetchedAt: fetchedAt, now: DateTime.now(), force: force)) {
+      log('[widget-refresh] snapshot is fresh, skipping refresh');
+      return;
+    }
+    await _refresh();
+  }
+
  static Future<void> cancelAll() async {
    await Workmanager().cancelAll();
  }
 }

+/// Pure debounce decision so it stays unit-testable. A `fetchedAt` in the
+/// future (clock change, debug time shift) never skips — refreshing is the
+/// safe direction.
+bool shouldSkipRefresh({
+  required DateTime? fetchedAt,
+  required DateTime now,
+  required bool force,
+}) {
+  if (force || fetchedAt == null) return false;
+  final age = now.difference(fetchedAt);
+  return !age.isNegative && age < WidgetBackgroundTask.refreshDebounce;
+}
+
@pragma('vm:entry-point')
 void _callbackDispatcher() {
  Workmanager().executeTask((task, inputData) async {
    try {
      WidgetsFlutterBinding.ensureInitialized();
-      await AccountData().waitForPopulation();
-      if (!AccountData().isPopulated()) {
-        log('[widget-bg] not logged in, skipping refresh');
-        await WidgetSync.setLoggedIn(false);
-        await WidgetSync.triggerUpdate();
-        return true;
-      }
-      await _refresh();
+      await WidgetBackgroundTask.runRefreshNow();
      return true;
    } on Exception catch (e, s) {
      log('[widget-bg] refresh failed: $e', stackTrace: s);
@@ -94,39 +154,51 @@ Future<void> _refresh() async {
  }

  final now = WidgetPublisher.widgetNow();
-  // 14-day window so the week-widget rolls forward into next Monday's
-  // lessons on Friday evening.
-  final weekStart = _startOfWeek(now);
-  final weekEndExclusive = weekStart.add(const Duration(days: 14));
+  // Fetch window matches the week payload's window so the widget can roll
+  // forward into next week's lessons without fresh data.
+  final weekStart = WidgetDataMapper.startOfCalendarWeek(now);
+  final weekEndExclusive = weekStart.add(
+    const Duration(days: WidgetDataMapper.weekWindowDays),
+  );

-  final timetable = await TimetableGetWeek().run(
+  // All six requests are independent — run them concurrently so the total
+  // latency is the slowest request, not the sum (matters for the push path's
+  // hard time budget). Reference-data failures fall through to null in the
+  // mapper rather than aborting the whole refresh.
+  final timetableFuture = TimetableGetWeek().run(
    from: weekStart,
    until: weekEndExclusive.subtract(const Duration(days: 1)),
  );
-
-  // Reference data — failures fall through to null in the mapper rather
-  // than aborting the whole refresh.
-  final subjects = await _runOrNull<TimetableGetSubjectsResponse>(
+  final subjectsFuture = _runOrNull<TimetableGetSubjectsResponse>(
    () => TimetableGetSubjects().run(),
  );
-  final rooms = await _runOrNull<TimetableGetRoomsResponse>(
+  final roomsFuture = _runOrNull<TimetableGetRoomsResponse>(
    () => TimetableGetRooms().run(),
  );
-  final holidays = await _runOrNull<TimetableGetHolidaysResponse>(
+  final holidaysFuture = _runOrNull<TimetableGetHolidaysResponse>(
    () => TimetableGetHolidays().run(),
  );
-  final timegrid = await _runOrNull<TimetableGetTimegridResponse>(
+  final timegridFuture = _runOrNull<TimetableGetTimegridResponse>(
    () => TimetableGetTimegrid().run(),
  );
-  final customEvents = await _runOrNull<GetCustomTimetableEventResponse>(
+  final customEventsFuture = _runOrNull<GetCustomTimetableEventResponse>(
    () => GetCustomTimetableEvent(
      GetCustomTimetableEventParams(AccountData().getUserSecret()),
    ).run(),
  );
+  final timetable = await timetableFuture;
+  final subjects = await subjectsFuture;
+  final rooms = await roomsFuture;
+  final holidays = await holidaysFuture;
+  final timegrid = await timegridFuture;
+  final customEvents = await customEventsFuture;

  final lessons = timetable.entries;

-  final connectDouble = await WidgetSync.getConnectDoubleLessons();
+  final [connectDouble, isTeacher] = await Future.wait([
+    WidgetSync.getConnectDoubleLessons(),
+    WidgetSync.getIsTeacher(),
+  ]);
  final dayData = WidgetDataMapper.buildDayData(
    now: now,
    lessons: lessons,
@@ -136,6 +208,7 @@ Future<void> _refresh() async {
    timegrid: timegrid,
    customEvents: customEvents,
    connectDoubleLessons: connectDouble,
+    showClassInsteadOfTeacher: isTeacher,
  );
  final weekData = WidgetDataMapper.buildWeekData(
    now: now,
@@ -146,6 +219,7 @@ Future<void> _refresh() async {
    timegrid: timegrid,
    customEvents: customEvents,
    connectDoubleLessons: connectDouble,
+    showClassInsteadOfTeacher: isTeacher,
  );

  await WidgetSync.writeDayData(dayData);
@@ -158,11 +232,6 @@ Future<void> _refresh() async {
  );
 }

-DateTime _startOfWeek(DateTime reference) {
-  final monday = reference.subtract(Duration(days: reference.weekday - 1));
-  return DateTime(monday.year, monday.month, monday.day);
-}
-
 Future<T?> _runOrNull<T>(Future<T> Function() task) async {
  try {
    return await task();
@@ -13,12 +13,8 @@ extension IsSameDay on DateTime {

  TimeOfDay toTimeOfDay() => TimeOfDay(hour: hour, minute: minute);

-  bool isSameDateTime(DateTime other) {
-    var isSameDay = this.isSameDay(other);
-    var isSameTimeOfDay = (toTimeOfDay() == other.toTimeOfDay());
-
-    return isSameDay && isSameTimeOfDay;
-  }
+  bool isSameDateTime(DateTime other) =>
+      isSameDay(other) && toTimeOfDay() == other.toTimeOfDay();

  bool isSameOrAfter(DateTime other) => isSameDateTime(other) || isAfter(other);
 }
@@ -55,6 +55,7 @@ import 'widget/avatar_disk_cache.dart';
 import 'widget/breaker/breaker.dart';
 import 'widget/debug/cache_view.dart';
 import 'widget/downloads/download_tray.dart';
+import 'widget/emergency/emergency_notice_gate.dart';
 import 'widget_data/widget_sync.dart';

 Future<void> main() async {
@@ -360,9 +361,10 @@ class _MainState extends State<Main> {
            // would otherwise cover it).
            child: DownloadTrayHost(child: child ?? const SizedBox.shrink()),
          ),
-          home: LoaderOverlay(
-            child: Breaker(
-              breaker: BreakerArea.global,
+          home: EmergencyNoticeGate(
+            child: LoaderOverlay(
+              child: Breaker(
+                breaker: BreakerArea.global,
              child: BlocConsumer<AccountBloc, AccountState>(
                listenWhen: (previous, current) =>
                    previous.status != current.status,
@@ -468,6 +470,7 @@ class _MainState extends State<Main> {
                      );
                  }
                },
+                ),
              ),
            ),
          ),
@@ -17,6 +17,10 @@ class AccountData {
  // token, so two registrations need two app passwords.
  static const _appPasswordField = 'nextcloud_app_password';
  static const _appPasswordTalkField = 'nextcloud_app_password_talk';
+  // Marks accounts whose Nextcloud credentials came from Login Flow v2 (2FA):
+  // the real password is not valid against Nextcloud, only the flow-issued
+  // app password is — and no further app passwords can be minted silently.
+  static const _loginFlowField = 'nextcloud_login_flow';
  // Persists the demo session across cold starts (see DemoMode).
  static const _demoField = 'is_demo';
  // Keeps isPopulated()/getPassword() valid; demo mode never uses a real one.
@@ -38,10 +42,17 @@ class AccountData {
  String? _appPassword;
  String? _appPasswordTalk;
  bool _isDemo = false;
+  bool _usesLoginFlow = false;

  /// True while the active session is a local demo session (see DemoMode).
  bool get isDemo => _isDemo;

+  /// True when the Nextcloud credentials were obtained via Login Flow v2
+  /// (browser login, e.g. because the account has two-factor authentication).
+  /// In that mode the stored real password only authenticates MarianumConnect;
+  /// every Nextcloud call must use the flow-issued app password.
+  bool get usesLoginFlow => _usesLoginFlow;
+
  String getUsername() {
    if (_username == null) throw Exception('Username not initialized');
    return _username!;
@@ -86,9 +97,11 @@ class AccountData {
    _appPassword = null;
    _appPasswordTalk = null;
    _isDemo = false;
+    _usesLoginFlow = false;
    await _secureStorage.delete(key: _usernameField);
    await _secureStorage.delete(key: _passwordField);
    await _secureStorage.delete(key: _demoField);
+    await _secureStorage.delete(key: _loginFlowField);
    await _clearAppPasswordStorage();
    await _clearAppPasswordTalkStorage();
  }
@@ -111,6 +124,17 @@ class AccountData {
    await _clearAppPasswordStorage();
  }

+  /// Adopts an app password obtained via Login Flow v2 and switches the
+  /// account into flow mode (see [usesLoginFlow]). Any previously stored Talk
+  /// app password belonged to the old session era and is dropped — the second
+  /// (optional) flow pass stores a fresh one via [setAppPasswordTalk].
+  Future<void> setLoginFlow(String appPassword) async {
+    await setAppPassword(appPassword);
+    await clearAppPasswordTalk();
+    _usesLoginFlow = true;
+    await _secureStorage.write(key: _loginFlowField, value: 'true');
+  }
+
  bool hasAppPassword() => _appPassword != null && _appPassword!.isNotEmpty;

  /// Persists the app password backing the Talk push registration.
@@ -156,6 +180,7 @@ class AccountData {
    _username = await _secureStorage.read(key: _usernameField);
    _password = await _secureStorage.read(key: _passwordField);
    _isDemo = (await _secureStorage.read(key: _demoField)) == 'true';
+    _usesLoginFlow = (await _secureStorage.read(key: _loginFlowField)) == 'true';
    try {
      _appPassword = await pushSecureStorage.read(key: _appPasswordField);
      _appPasswordTalk = await pushSecureStorage.read(
@@ -196,15 +221,10 @@ class AccountData {
  /// Prefer this over embedding credentials in URLs — error logs and crash
  /// reports often capture the URL but not headers.
  String getBasicAuthHeader() {
-    if (!isPopulated()) {
-      throw Exception(
-        'AccountData (e.g. username or password) is not initialized!',
-      );
-    }
+    _requirePopulated();
    // Prefer the scoped app password once available; it survives real-password
    // rotation and is what the push-v2 registration is bound to.
-    final secret = _appPassword ?? _password;
-    return 'Basic ${base64Encode(utf8.encode('$_username:$secret'))}';
+    return _basicAuth(_appPassword ?? _password!);
  }

  /// Basic-auth header using the Talk app password — authenticates the
@@ -212,29 +232,45 @@ class AccountData {
  /// talk password has not been minted yet; callers treat that as a failed
  /// talk registration and retry on the next start.
  String getTalkBasicAuthHeader() {
-    if (!isPopulated()) {
-      throw Exception(
-        'AccountData (e.g. username or password) is not initialized!',
-      );
-    }
+    _requirePopulated();
    if (!hasAppPasswordTalk()) {
+      // Login-flow account whose second (talk) flow pass was skipped: no
+      // silent minting possible, the talk registration shares the single
+      // flow-issued credential.
+      if (_usesLoginFlow && hasAppPassword()) return _basicAuth(_appPassword!);
      throw StateError('Talk app password not available yet');
    }
-    return 'Basic ${base64Encode(utf8.encode('$_username:$_appPasswordTalk'))}';
+    return _basicAuth(_appPasswordTalk!);
  }

  /// Basic-auth header that always uses the real password. Needed exactly once,
  /// to mint the app password via `core/getapppassword` (an app password cannot
  /// mint another).
  String getRealPasswordBasicAuthHeader() {
+    _requirePopulated();
+    return _basicAuth(_password!);
+  }
+
+  /// Secret authenticating against Nextcloud: the app password once available
+  /// (minted or flow-issued), otherwise the real password. Mirrors the
+  /// preference of [getBasicAuthHeader] for clients that need the raw secret
+  /// (WebDAV client construction).
+  String getNextcloudSecret() {
+    _requirePopulated();
+    return _appPassword ?? _password!;
+  }
+
+  void _requirePopulated() {
    if (!isPopulated()) {
      throw Exception(
        'AccountData (e.g. username or password) is not initialized!',
      );
    }
-    return 'Basic ${base64Encode(utf8.encode('$_username:$_password'))}';
  }

+  String _basicAuth(String secret) =>
+      'Basic ${base64Encode(utf8.encode('$_username:$secret'))}';
+
  /// Convenience wrapper around [getBasicAuthHeader] returning a single-entry
  /// header map ready to merge into HTTP request headers.
  Map<String, String> authHeaders() => {'Authorization': getBasicAuthHeader()};
@@ -1,18 +1,3 @@
-import 'account_data.dart';
-
-enum EndpointMode { live, stage }
-
-class EndpointOptions {
-  Endpoint live;
-  Endpoint? staged;
-  EndpointOptions({required this.live, required this.staged});
-
-  Endpoint get(EndpointMode mode) {
-    if (staged == null || mode == EndpointMode.live) return live;
-    return staged!;
-  }
-}
-
 class Endpoint {
  String domain;
  String path;
@@ -29,16 +14,5 @@ class EndpointData {

  EndpointData._construct();

-  EndpointMode getEndpointMode() {
-    late String existingName;
-    existingName = AccountData().getUsername();
-    return existingName.startsWith('google')
-        ? EndpointMode.stage
-        : EndpointMode.live;
-  }
-
-  Endpoint nextcloud() => EndpointOptions(
-    live: Endpoint(domain: 'cloud.marianum-fulda.de'),
-    staged: Endpoint(domain: 'mhsl.eu', path: '/marianum/marianummobile/cloud'),
-  ).get(getEndpointMode());
+  Endpoint nextcloud() => Endpoint(domain: 'cloud.marianum-fulda.de');
 }
@@ -3,6 +3,7 @@ import 'dart:developer';
 import 'package:crypton/crypton.dart';
 import 'package:firebase_messaging/firebase_messaging.dart';

+import '../background/widget_background_task.dart';
 import '../notification/notification_service.dart';
 import 'chat_thread_store.dart';
 import 'nid_store.dart';
@@ -12,6 +13,10 @@ import 'push_registration_store.dart';
 import 'push_renderer.dart';
 import 'push_subject.dart';

+/// Wire value of the FCM `type` field for silent widget-refresh pushes.
+/// Mirrors PUSH_TYPE_WIDGET_REFRESH in MarianumConnect's MarMobileApiService.
+const String widgetRefreshPushType = 'widget-refresh';
+
 /// How an incoming FCM payload should be interpreted.
 enum PushKind {
  /// Encrypted Nextcloud push-v2 notification (`subject` + `signature`).
@@ -20,6 +25,11 @@ enum PushKind {
  /// Plaintext MarianumConnect direct push (`source == "connect"`).
  connect,

+  /// Silent MarianumConnect push requesting a home-widget data refresh
+  /// (`source == "connect"` + `type == "widget-refresh"`). Never rendered,
+  /// processed even with notifications off.
+  widgetRefresh,
+
  /// Neither — ignored.
  unknown,
 }
@@ -31,7 +41,10 @@ PushKind classifyPush(Map<String, dynamic> data) {
  final hasSubject = (data['subject'] as String?)?.isNotEmpty ?? false;
  final hasSignature = (data['signature'] as String?)?.isNotEmpty ?? false;
  if (hasSubject && hasSignature) return PushKind.nextcloud;
-  if (data['source'] == 'connect') return PushKind.connect;
+  if (data['source'] == 'connect') {
+    if (data['type'] == widgetRefreshPushType) return PushKind.widgetRefresh;
+    return PushKind.connect;
+  }
  return PushKind.unknown;
 }

@@ -97,11 +110,30 @@ class PushMessageHandler {
          notificationsEnabled: notificationsEnabled,
        );
        break;
+      case PushKind.widgetRefresh:
+        // Deliberately before any notificationsEnabled gate: silent sync
+        // pushes must work with notifications off.
+        await _handleWidgetRefresh();
+        break;
      case PushKind.unknown:
        break;
    }
  }

+  Future<void> _handleWidgetRefresh() async {
+    try {
+      // The iOS FCM handler runs in the main isolate with a ~25s APNs
+      // budget — bound the inline refresh below that so the completion
+      // handler always fires in time.
+      await WidgetBackgroundTask.requestImmediateRefresh(
+        force: false,
+        inlineTimeout: const Duration(seconds: 20),
+      );
+    } on Exception catch (e) {
+      log('[push] widget refresh failed: $e');
+    }
+  }
+
  Future<void> _handleConnect(
    RemoteMessage message, {
    required bool foreground,
@@ -67,6 +67,13 @@ class PushRegistration {
  /// registration binds to it, so it must be obtained before registering.
  Future<void> ensureAppPassword() async {
    if (AccountData().hasAppPassword()) return;
+    if (AccountData().usesLoginFlow) {
+      // Flow-Konten (2FA): Basic Auth mit dem echten Passwort wird abgelehnt,
+      // stilles Minting ist unmöglich. Reparatur nur interaktiv über
+      // Einstellungen → „Nextcloud neu verbinden".
+      log('Push: login-flow account without app password, cannot mint silently');
+      return;
+    }
    try {
      final appPassword = await GetAppPassword().run();
      await AccountData().setAppPassword(appPassword);
@@ -79,6 +86,11 @@ class PushRegistration {
  /// (each `getapppassword` call with the real password mints a fresh one).
  Future<void> ensureTalkAppPassword() async {
    if (AccountData().hasAppPasswordTalk()) return;
+    // Flow-Konten können still kein zweites App-Passwort münzen — das
+    // Talk-Passwort kommt nur aus dem zweiten Login-Flow-Durchlauf; bis dahin
+    // teilt sich die Talk-Registrierung das eine App-Passwort (siehe
+    // AccountData.getTalkBasicAuthHeader).
+    if (AccountData().usesLoginFlow) return;
    try {
      final appPassword = await GetAppPassword().run();
      await AccountData().setAppPasswordTalk(appPassword);
@@ -129,8 +141,19 @@ class PushRegistration {
      appVersion = null;
    }

+    final types = registrationTypesFor(
+      usesLoginFlow: AccountData().usesLoginFlow,
+      hasTalkAppPassword: AccountData().hasAppPasswordTalk(),
+    );
+    if (!types.contains(PushRegistrationType.general)) {
+      await _recordAttempt(
+        PushRegistrationType.general,
+        'Ohne zweite Nextcloud-Freigabe nicht verfügbar (nur Talk-Push)',
+      );
+    }
+
    var allOk = true;
-    for (final type in PushRegistrationType.values) {
+    for (final type in types) {
      final ok = await _registerType(
        type: type,
        fcmToken: fcmToken,
@@ -260,6 +283,19 @@ class PushRegistration {
    await _store.clear();
  }

+  /// Pure decision which Nextcloud registrations this session can maintain.
+  /// Flow-Konten (2FA), die nur den ersten Login-Flow-Durchlauf abgeschlossen
+  /// haben, besitzen eine einzige NC-Session — Nextcloud bindet pro Session
+  /// genau eine Subscription, also bleibt nur die (wichtigere)
+  /// Talk-Registrierung. Mit dem zweiten (Talk-)App-Passwort aus dem
+  /// optionalen zweiten Durchlauf laufen wieder beide.
+  static List<PushRegistrationType> registrationTypesFor({
+    required bool usesLoginFlow,
+    required bool hasTalkAppPassword,
+  }) => usesLoginFlow && !hasTalkAppPassword
+      ? const [PushRegistrationType.talk]
+      : PushRegistrationType.values;
+
  /// Pure decision for whether a persisted registration endpoint no longer
  /// matches the currently active one. A missing/empty stored value never
  /// forces a re-registration — old installs (pre endpoint-tracking) heal via
@@ -371,13 +371,7 @@ class PushRenderer {
      jsonEncode({'chatToken': ?chatToken, 'nid': nid});

  /// Deterministic non-negative 31-bit id from a string, used when the push
-  /// carries no `nid`.
-  int _fallbackId(String? seed) {
-    if (seed == null || seed.isEmpty) return 0;
-    var hash = 0;
-    for (final unit in seed.codeUnits) {
-      hash = (hash * 31 + unit) & 0x7fffffff;
-    }
-    return hash;
-  }
+  /// carries no `nid`. Shares the hash with [stableChatNotificationId] (an
+  /// empty/null seed hashes to 0).
+  int _fallbackId(String? seed) => stableChatNotificationId(seed ?? '');
 }
@@ -5,11 +5,15 @@ import 'package:flutter_secure_storage/flutter_secure_storage.dart';
 /// the server public key and the Nextcloud app password to decrypt pushes
 /// while the app is not running.
 ///
-/// The value reuses the existing app-group id already present in the iOS
-/// project (`ios/Runner/Runner.entitlements`). Phase 3 must additionally list
-/// it under `keychain-access-groups` for both the Runner and the NSE target.
+/// A team-prefixed keychain access group (`$(AppIdentifierPrefix)eu.mhsl…push`)
+/// listed under `keychain-access-groups` in both the Runner and the NSE
+/// entitlements. The literal `MY55VF3KPG.` prefix is the team's stable
+/// AppIdentifierPrefix; Runner and NSE share the group because they sign with
+/// the same team. (App-group ids like `group.*` can't be used here because the
+/// Xcode-managed profiles only grant `<TeamID>.*` keychain groups.)
 /// On Android `groupId` is ignored, so this is a no-op there.
-const String kPushKeychainGroup = 'group.eu.mhsl.marianum.mobile.client.widget';
+const String kPushKeychainGroup =
+    'MY55VF3KPG.eu.mhsl.marianum.mobile.client.push';

 /// [IOSOptions] used for every push-related secure-storage entry. Uses
 /// `first_unlock` accessibility so the NSE can read the key material after the
@@ -87,6 +87,13 @@ class PushStatusReport {
      (general.registeredProxyServer?.isNotEmpty ?? false) &&
      !proxyEndpointMismatch(general) &&
      general.lastRegistrationError == null;
+
+  /// True when no link in the chain is currently broken. Unknown links stay
+  /// permissive (mirroring [readyForTestNotification]) so a not-yet-loaded
+  /// capability or an undetermined OS permission does not flip the at-a-glance
+  /// health icon to red. Drives the compact status indicator in the settings.
+  bool get chainHealthy =>
+      buildPushStatusRows(this).every((row) => row.state != PushCheck.fail);
 }

 /// Collects the current push chain state. Settings/capability flags come from
@@ -18,6 +18,7 @@ import '../state/app/modules/app_modules.dart';
 import '../state/app/modules/chat/bloc/chat_bloc.dart';
 import '../state/app/modules/chat_list/bloc/chat_list_bloc.dart';
 import '../state/app/modules/marianum_message/bloc/marianum_message_state.dart';
+import '../view/login/nextcloud_login_flow_page.dart';
 import '../view/pages/files/files.dart';
 import '../view/pages/files/sharing/sharee_picker_page.dart';
 import '../view/pages/foreign_timetable/element_picker_page.dart';
@@ -114,6 +115,20 @@ class AppRoutes {
    );
  }

+  /// Runs the Nextcloud Login Flow v2 (browser login, e.g. for accounts with
+  /// two-factor authentication) and resolves to `true` once an app password
+  /// was adopted. Used from the login flow and the settings "reconnect"
+  /// action.
+  static Future<bool> openNextcloudLoginFlow(BuildContext context) async {
+    final result = await Navigator.of(context).push<bool>(
+      MaterialPageRoute(
+        fullscreenDialog: true,
+        builder: (_) => const NextcloudLoginFlowPage(),
+      ),
+    );
+    return result ?? false;
+  }
+
  /// Opens the tappable, zoomable profile-picture viewer for [id].
  static void openLargeProfilePicture(BuildContext context, String id) {
    Navigator.of(context).push(
@@ -440,7 +455,7 @@ class AppRoutes {
  static bool goToTab(BuildContext context, Modules module) {
    final index = AppModule.getBottomBarModules(
      context,
-    ).map((e) => e.module).toList().indexOf(module);
+    ).indexWhere((e) => e.module == module);
    if (index == -1) return false;
    Main.bottomNavigator.jumpToTab(index);
    return true;
@@ -1,3 +1,5 @@
+import 'package:flutter/foundation.dart';
+
 class PendingShare {
  final List<String> filePaths;
  final String? text;
@@ -17,12 +19,6 @@ class PendingShare {
  /// fires two `open(url)` requests per share (see ShareViewController), so
  /// the same share can arrive twice on the media stream — receivedAt is
  /// deliberately ignored here so such duplicates compare equal.
-  bool contentEquals(PendingShare other) {
-    if (text != other.text) return false;
-    if (filePaths.length != other.filePaths.length) return false;
-    for (var i = 0; i < filePaths.length; i++) {
-      if (filePaths[i] != other.filePaths[i]) return false;
-    }
-    return true;
-  }
+  bool contentEquals(PendingShare other) =>
+      text == other.text && listEquals(filePaths, other.filePaths);
 }
--- a/Show More
+++ b/Show More
Author	SHA1	Message	Date
MineTec	ccb22a497d	added support for 2fa login with browser flow	2026-08-10 20:00:38 +02:00
MineTec	889d8f67c5	show classname instead of teacher name in teacher timetable view	2026-08-09 12:19:57 +02:00
MineTec	39c16bd4ea	enhanced route transition gate because of a syncfusion viewer bug	2026-08-08 22:13:19 +02:00
MineTec	b9cb1df473	added cache folder sweep check before file actions, preventing errors	2026-08-07 21:36:09 +02:00
MineTec	62fa337188	added integration_test to deps	2026-08-07 21:25:08 +02:00
MineTec	c0dadf8b6e	bumped minor version to 1.5.1+61	2026-08-06 20:30:20 +02:00
MineTec	ab23422a86	widget refresh enhancements	2026-08-06 20:22:32 +02:00
MineTec	646e2c0451	removed timetable limits, fully dependent on marianumConnect now	2026-08-05 20:03:02 +02:00
MineTec	246cb0f527	simplified loadable state logic by removing connectivity debouncing and inlining indicator helpers; updated error bar visibility and chat list polling behavior	2026-08-02 08:21:25 +02:00
MineTec	4c2e9b47e7	Merge remote-tracking branch 'origin/develop' into develop	2026-08-01 18:19:56 +02:00
MineTec	2d690736e3	implemented connectivity debouncing and refetch throttling for loadable state UI components	2026-08-01 18:16:22 +02:00
MineTec	778c473631	added telemetry call on app resume with 15 minute cooldown	2026-07-28 12:52:07 +02:00
MineTec	7e9cbcf1e9	fixed widget mounting errors	2026-07-28 12:51:39 +02:00
MineTec	32be67426c	Merge remote-tracking branch 'origin/develop' into develop	2026-07-26 13:49:05 +02:00
MineTec	b957189fd3	implemented absence report module with form validation, prefill support, and API integration	2026-07-26 11:45:48 +02:00
MineTec	624c5512a6	fixed failing test	2026-07-23 14:22:32 +02:00
MineTec	3493cf8617	fixed error on pdf viewer transition	2026-07-23 14:16:33 +02:00
MineTec	75080a2c49	implemented shared items view for Talk chats with tabbed categories and on-scroll pagination	2026-07-19 10:58:02 +02:00
MineTec	f3cd7896d9	implemented backward pagination for chat history with on-scroll prefetching	2026-07-17 20:14:47 +02:00
Marianum	101e7c909c	bump version to 1.4.0+59	2026-07-17 15:19:26 +02:00
Marianum	429f1e6f96	fix build against updated dependencies: re-add DioExceptionType.transformTimeout case (restored in dio 5.10.0) and rename SwiftReceiveSharingIntentPlugin to ReceiveSharingIntentPlugin (renamed in receive_sharing_intent 1.9.0); refresh Podfile.lock and SPM Package.resolved	2026-07-17 15:19:10 +02:00
Marianum	a0c55a811c	completed iOS push notification setup: created the NotificationServiceExtension Xcode target programmatically (via xcodeproj), embedded it in Runner, and added its xcconfig base configs; fixed Automatic Signing by switching the NSE↔Runner shared keychain from an app-group to a team-prefixed access group across entitlements, Dart and Swift; fixed the analyzer break from dio 5.9.2 dropping DioExceptionType.transformTimeout	2026-07-17 15:05:34 +02:00
MineTec	e625216a90	improved push notification settings with health indicators and optimized notification dismissal	2026-07-16 22:40:33 +02:00
MineTec	8128cede21	refactored teacher display in lesson details to better handle substitutions and duplicates	2026-07-16 21:44:08 +02:00
MineTec	e5f7cf0176	updated the ProseMirror table view to conditionally hide the mode toggle toolbar when content fits within the available width, ensuring the toggle is only visible for overflowing tables.	2026-07-16 21:43:52 +02:00
MineTec	e349d667d4	implemented a 1-minute in-memory cache for the EmergencyNoticeClient to prevent redundant network requests on app resume	2026-07-16 10:47:51 +02:00
MineTec	7c1f5c06df	implemented a backend-independent emergency notice system	2026-07-15 20:30:20 +02:00
MineTec	e8c6ac1c65	further improved accessibility across the application and add tooltips to action buttons	2026-07-15 19:29:40 +02:00
MineTec	478f0ff20b	implemented comprehensive accessibility (A11y) support across the app	2026-07-13 23:41:47 +02:00
MineTec	8274dd46cd	refactored HTTP error handling and streamlined UI components by centralizing shared logic and removing redundant parameters	2026-07-13 22:58:02 +02:00
MineTec	d7536ea5d0	remove dead endpoint staging mode (obsoleted by demo mode)	2026-07-13 22:32:38 +02:00
MineTec	398b147c76	simplify: dedupe boilerplate and remove dead code across all layers	2026-07-13 22:22:39 +02:00