feat(advisories): configurable check interval and a weekly digest

[rubenvdlinde]

Completes the advisory work behind #160/#166. Stacked on #169 — merge that first and this retargets cleanly.

Implements two maintainer decisions: 6-hour default, 1–24 configurable, and urgent immediately + a weekly digest for everything else.

Interval

AdvisorySettingsStore holds it, AdvisoryRefreshJob reads it at construction (TimedJob fixes its interval there), and GET/PUT /api/advisory/settings expose it alongside the supported bounds — a client that hardcodes the range drifts from the server the first time it changes.

The store clamps; the endpoint rejects. Deliberate, not inconsistent:

• A UI that asks for 48 hours and is answered 200 OK while the server stored 24 has been lied to → the API returns 400.
• A value arriving another way — occ config:app:set, or a future release narrowing the range — must still produce a working schedule. Refusing to run because a stored number is out of bounds would silently stop security checks, which is worse than checking at a neighbouring frequency.

Digest

AdvisoryDigestNotifier summarises the informational advisories — apps with a security history whose installed version is already safe — once a week. Urgent advisories keep their own immediate path and are excluded here, so nobody is told twice.

Three behaviours worth naming, each a way this could have gone quietly wrong:

• a week with nothing informational sends nothing and does not advance the clock, so the first week with something to report sends immediately rather than waiting out a window consumed by silence;
• a dispatch that reached nobody does not advance the clock either — one transient failure must not suppress a second week as well;
• it rate-limits itself, so the job can call it on every sweep (up to 24×/day) and it still sends once a week.

Defaults on: the urgent path fires regardless, and the digest carries everything else. Defaulting it off would hide that material behind a setting nobody knows exists.

UI

A control in the Settings panel, with the bounds read from the server. It sends '1'/'0' rather than a JSON boolean, because PHP casts a JSON false to '' and the server would read that as unspecified — the same trap already documented on the auto-update kill switch.

Verification

• 564 unit tests, 1125 assertions; no failure outside tests/unit/Command (19 errors there are a missing symfony/console in my local vendor copy)
• psalm clean on every file this PR adds or touches; gate-16 count=0
• openapi.json regenerated — 22 routes, both new operations present
• frontend builds, and the new strings were confirmed present in the built bundle rather than assumed

Not touched: three psalm errors in AdvisoryNotifier.php. They appear locally and not in CI, which resolves OCP types against a real Nextcloud tree rather than the app's stubs. "Fixing" them from local output would risk turning a green job red.

🤖 Generated with Claude Code

[github-actions]

Quality Report — ConductionNL/app-versions @ a4cdcaa

Check	PHP	Vue	Security	License	Tests
lint	✅
phpcs	✅
phpmd	✅
psalm	❌
phpstan	✅
phpmetrics	✅
eslint		✅
stylelint		✅
build		✅
composer			✅	✅ 29/29
npm			✅	✅ 282/282
app:check-code	⏭️
info.xml	✅
REUSE	❌
PHPUnit					✅
Newman					⏭️
Playwright					✅
Hydra gates					✅

---

Quality workflow — 2026-08-21 08:19 UTC

Download the full PDF report from the workflow artifacts.

[github-actions]

Quality Report — ConductionNL/app-versions @ 0fe3aae

Check	PHP	Vue	Security	License	Tests
lint	✅
phpcs	✅
phpmd	✅
psalm	✅
phpstan	✅
phpmetrics	✅
eslint		✅
stylelint		✅
build		✅
composer			✅	✅ 29/29
npm			✅	✅ 282/282
app:check-code	⏭️
info.xml	✅
REUSE	❌
PHPUnit					✅
Newman					⏭️
Playwright					✅
Hydra gates					✅

---

Quality workflow — 2026-08-21 08:34 UTC

Download the full PDF report from the workflow artifacts.