Adding more calendars and sync to demo and mock weather data.

Author: jherforth

client/src/app.jsx

@@ -354,10 +354,12 @@ const App = () => {
             chores: { enabled: true },
             calendar: { enabled: true },
             photos: { enabled: false },
-            weather: { enabled: false },
+            // Weather renders from the server's static demo snapshot
+            // (/api/demo/weather) — no OpenWeatherMap key needed.
+            weather: { enabled: true },
           },
         });
-        for (const widgetName of ['chores', 'calendar']) {
+        for (const widgetName of ['chores', 'calendar', 'weather']) {
           await axios.post(`${API_DEVICE_URL}/widget-assignments`, {
             widget_name: widgetName,
             tabNumber: 1,
@@ -782,6 +784,7 @@ const App = () => {
               activeTab={activeTab}
               activeTabConfigJson={tabs.find((tab) => tab.number === activeTab)?.config_json || null}
               allTabConfigs={tabs}
+              demoMode={demoStatus.demo}
             />
           </Suspense>
         ),
@@ -847,7 +850,7 @@ const App = () => {
     });
 
     return result;
-  }, [widgetSettings, pluginSettings, activeTab, apiKeys, widgetAssignments, installedPlugins, theme]);
+  }, [widgetSettings, pluginSettings, activeTab, apiKeys, widgetAssignments, installedPlugins, theme, demoStatus.demo]);
 
   const activeTabId = useMemo(() => {
     const active = tabs.find(tab => tab.number === activeTab);

client/src/components/WeatherWidget.jsx

@@ -52,6 +52,7 @@ const WeatherWidget = ({
   prefetchOnly = false,
   refreshNonce = 0,
   isActive = true,
+  demoMode = false,
 }) => {
   const API_DEVICE_URL = getDeviceApiBase(API_BASE_URL);
   const [weatherData, setWeatherData] = useState(null);
@@ -537,6 +538,29 @@ const WeatherWidget = ({
     applyResolvedTabSettings(tabSettings);
   }, [activeTab, activeTabConfigJson, refreshNonce]);
 
+  // Demo mode: no OpenWeatherMap key exists, so instead of the normal fetch
+  // pipeline the server hands us a static snapshot (Chili, NY). Writing it into
+  // the payload cache means every later settings re-apply finds it there.
+  useEffect(() => {
+    if (!demoMode || !settingsLoaded) return undefined;
+
+    let cancelled = false;
+    (async () => {
+      try {
+        const units = tempUnit === 'C' ? 'metric' : 'imperial';
+        const response = await axios.get(`${API_BASE_URL}/api/demo/weather?units=${units}`);
+        if (cancelled || !response.data?.weatherData) return;
+        writeCachedPayloadFor(locationQuery, tempUnit, response.data);
+        applyWeatherPayloadToState(response.data);
+        setError(null);
+      } catch {
+        // Demo snapshot unavailable; leave the widget in its default state.
+      }
+    })();
+
+    return () => { cancelled = true; };
+  }, [demoMode, settingsLoaded, locationQuery, tempUnit]);
+
   useEffect(() => {
     if (!settingsLoaded || !shouldFetchNow) {
       return;

docs/guides/demo-mode.md

@@ -43,7 +43,9 @@ DEMO MODE enabled: in-memory database, PIN disabled, sample data resets every 6h
 | --- | --- | --- |
 | **Database** | SQLite file at `server/data/tasks.db` (persistent) | **In-memory** — wiped when the container stops; `DB_PATH` is ignored |
 | **Admin PIN** | Optional PIN gate on the Admin Panel | **Disabled** — panel opens freely; PIN set/verify/delete return `403` so no visitor can lock others out |
-| **Sample data** | Empty first-run welcome screen | A demo household is **seeded at boot and re-seeded every 6 hours**; new visitor devices auto-enable the chore + calendar widgets |
+| **Sample data** | Empty first-run welcome screen | A demo household is **seeded at boot and re-seeded every 6 hours**; new visitor devices auto-enable the chore, calendar, and weather widgets |
+| **Calendar sync** | Syncs whatever sources you configure | Runs **only for the curated demo feeds** seeded at boot; source add/edit/delete routes are blocked so visitor URLs are never fetched |
+| **Weather** | Live OpenWeatherMap data (your API key) | A **static snapshot of Chili, NY** served from `GET /api/demo/weather` — no API key involved |
 | **Abuse-prone routes** | Available | Return `403` (see below) |
 | **Client banner** | — | A **"Demo Mode — sample data resets every N hours"** banner is shown |
 
@@ -58,9 +60,10 @@ mode." }`:
 - **The `/api/proxy` CORS proxy** — so it can't be used as an open relay.
 - **Google & Apple connection setup** — OAuth config, authorize/callback, account
   delete, CalDAV calendar listing.
-- **Calendar test & sync triggers** — visitor-supplied calendar URLs are **never
-  fetched**; the calendar sync service stays off entirely and the seeded events
-  are shown from cache.
+- **Calendar source management and manual sync triggers** — adding, editing, or
+  deleting calendar sources is blocked, as are the test/sync endpoints. The sync
+  service *does* run in demo mode, but only ever fetches the curated feeds
+  seeded below — a visitor-supplied URL can never reach it (SSRF guard).
 
 Everyday interactive routes **still work**, so the demo feels live: completing and
 un-completing chores, moving and resizing widgets, switching tabs, and adjusting
@@ -86,13 +89,25 @@ and is designed to make an empty dashboard feel like a real family command cente
   chores post clams, routine chores post zero.
 - **Prizes** to spend clams on — Movie night pick (50), Ice cream trip (30),
   30 min extra screen time (15).
-- **A week of calendar events** — soccer practice, pizza night, a dentist
+- **A week of family calendar events** — soccer practice, pizza night, a dentist
   appointment, an overnight trip to Grandma's, a piano recital, and a
-  library-books-due reminder. Calendar sync never runs; these come from the event
-  cache under a placeholder "Family Calendar" source that is never fetched.
+  library-books-due reminder. These are baked into the event cache under a
+  placeholder "Family Calendar" source (a reserved `.invalid` URL the sync
+  service knows to skip), so they're on screen the instant the demo boots.
+- **Four live public calendar feeds**, synced for real by the calendar sync
+  service so the demo shows genuine multi-calendar behavior:
+  - **US Federal Holidays** (OPM)
+  - **Arizona Diamondbacks** (MLB schedule)
+  - **Town of Chili — Calendar** and **Town of Chili — Community Events** — two
+    overlapping town feeds, which double as a live demonstration of
+    cross-calendar event deduplication.
+- **A weather snapshot for Chili, NY** — the demo has no OpenWeatherMap key, so
+  the weather widget renders a static real-conditions snapshot (current temp,
+  3-day outlook, hourly chart, air quality) served by `GET /api/demo/weather`.
 
 Because the whole set is re-seeded on a timer (every 6 hours by default) and the
-database is in-memory, the demo always returns to this known-good state.
+database is in-memory, the demo always returns to this known-good state; each
+reset also restarts the feed sync jobs and refetches the live calendars.
 
 ## How the reset works
 

docs/guides/deployment.md

@@ -73,12 +73,14 @@ What it changes:
 - **Admin PIN disabled** — the Admin Panel opens without a prompt, and the
   PIN set/verify/delete routes return 403 so a visitor can't lock others out.
 - **Sample data** — a demo household (users, chores, schedules, clam history,
-  prizes, a week of calendar events) is seeded at boot and re-seeded every
-  6 hours; new visitor devices auto-enable the chore + calendar widgets.
+  prizes, family calendar events, live public calendar feeds, and a static
+  weather snapshot) is seeded at boot and re-seeded every 6 hours; new visitor
+  devices auto-enable the chore, calendar, and weather widgets.
 - **Abuse-prone routes return 403** — all uploads (widgets/sounds/avatars/
   photos), widget install/delete, the `/api/proxy` CORS proxy, Google/Apple
-  connection setup, and calendar test/sync triggers (visitor-supplied URLs
-  are never fetched — the calendar sync service stays off).
+  connection setup, and all calendar source add/edit/delete/test/sync routes.
+  Calendar sync runs, but only for the seeded demo feeds — visitor-supplied
+  URLs are never fetched.
 - A "Demo Mode" banner is shown in the client.
 
 Normal installs are unaffected: `DEMO_MODE` defaults to `false` everywhere.

docs/reference/configuration.md

@@ -16,7 +16,7 @@ database). This page covers both.
 | `NODE_ENV` | — | `production` / `development`. |
 | `HOMEGLOW_DISABLE_BACKGROUND_JOBS` | `0` | Set to `1` to disable the nightly chore-pruning cron (useful in tests). |
 | `HOMEGLOW_DISABLE_CALENDAR_SYNC` | `0` | Set to `1` to disable the calendar sync service. |
-| `DEMO_MODE` | `false` | Set to `true` to run a **public demo instance**: in-memory DB (wiped on stop), admin PIN disabled, sample data seeded and reset every 6h, and abuse-prone routes (uploads, CORS proxy, OAuth, outbound calendar fetches) return 403. See the [Demo Mode](../guides/demo-mode.md) guide. |
+| `DEMO_MODE` | `false` | Set to `true` to run a **public demo instance**: in-memory DB (wiped on stop), admin PIN disabled, sample data seeded and reset every 6h (incl. live demo calendar feeds and a static weather snapshot), and abuse-prone routes (uploads, CORS proxy, OAuth, calendar source management) return 403 — calendar sync only ever fetches the seeded demo feeds. See the [Demo Mode](../guides/demo-mode.md) guide. |
 | `BACKEND_VERSION` / `BACKEND_GIT_COMMIT` / `BACKEND_GITHUB_REPOSITORY` | build metadata | Surfaced by `GET /api/stats`; set by CI. |
 
 If `ENCRYPTION_KEY` is missing or invalid, the server logs a warning at startup and

server/index.js

@@ -2501,6 +2501,16 @@ fastify.get('/api/demo', async () => {
   return { demo: DEMO_MODE, resetHours: DEMO_MODE ? DEMO_RESET_HOURS : null };
 });
 
+// Static weather snapshot for the demo weather widget (no OpenWeatherMap key
+// in demo mode). ?units=metric converts the imperial snapshot.
+fastify.get('/api/demo/weather', async (request, reply) => {
+  if (!DEMO_MODE) {
+    return reply.status(404).send({ error: 'Not available outside demo mode.' });
+  }
+  const { buildDemoWeatherPayload } = require('./utils/demoWeather');
+  return buildDemoWeatherPayload(request.query.units === 'metric' ? 'metric' : 'imperial');
+});
+
 function deserializeSettingValue(value) {
   if (typeof value !== 'string') {
     return value;
@@ -3570,6 +3580,9 @@ fastify.get('/api/calendar-sources', async (request, reply) => {
 });
 
 fastify.post('/api/calendar-sources', async (request, reply) => {
+  // Demo-blocked: with the sync service running in demo mode, a visitor-added
+  // source would be fetched server-side (SSRF). Only the seeded feeds sync.
+  if (demoBlocked(reply)) return;
   const { name, type, url, username, password, color } = request.body;
   if (!name || !type || !url) {
     return reply.status(400).send({ error: 'Name, type, and URL are required.' });
@@ -3606,6 +3619,9 @@ fastify.post('/api/calendar-sources', async (request, reply) => {
 });
 
 fastify.patch('/api/calendar-sources/:id', async (request, reply) => {
+  // Demo-blocked: editing a source's URL would make the sync service fetch a
+  // visitor-supplied address (SSRF).
+  if (demoBlocked(reply)) return;
   const { id } = request.params;
   const { name, type, url, username, password, color, enabled } = request.body;
 
@@ -3664,6 +3680,8 @@ fastify.patch('/api/calendar-sources/:id', async (request, reply) => {
 });
 
 fastify.delete('/api/calendar-sources/:id', async (request, reply) => {
+  // Demo-blocked so one visitor can't remove the curated demo feeds for the next.
+  if (demoBlocked(reply)) return;
   const { id } = request.params;
   try {
     if (calendarSyncService) {
@@ -4612,6 +4630,13 @@ const start = async () => {
       setInterval(() => {
         try {
           resetDemoData(db);
+          // Reseeding assigns new source ids, so the running sync jobs point
+          // at rows that no longer exist. Restart them (this also kicks off an
+          // immediate syncAllSources to refill the wiped event cache).
+          if (calendarSyncService && process.env.HOMEGLOW_DISABLE_CALENDAR_SYNC !== '1') {
+            calendarSyncService.stopAllSyncJobs();
+            calendarSyncService.startAllSyncJobs();
+          }
         } catch (err) {
           console.error('Demo reset failed:', err);
         }
@@ -4633,13 +4658,19 @@ const start = async () => {
     // Seed bundled default chore notification sounds into the persisted uploads volume
     await seedDefaultSounds();
 
-    // Initialize calendar sync service. Demo mode constructs it (so cached
-    // demo events are readable) but never initializes the sync jobs, and the
-    // manual-sync routes are demo-blocked — visitor-entered calendar URLs are
-    // never fetched (SSRF guard).
+    // Initialize calendar sync service. Demo mode runs sync too, but ONLY for
+    // the curated feeds in demoSeed.js: every route that could add or edit a
+    // source URL is demo-blocked, so visitor-entered addresses are never
+    // fetched (SSRF guard). The seeded "Family Calendar" placeholder
+    // (.invalid host) is skipped by the service itself.
     if (DEMO_MODE) {
       calendarSyncService = new CalendarSyncService(db, decryptPassword);
-      console.log('Calendar sync jobs disabled in demo mode (cached events only)');
+      if (process.env.HOMEGLOW_DISABLE_CALENDAR_SYNC !== '1') {
+        calendarSyncService.initialize();
+        console.log('Calendar sync enabled in demo mode (seeded demo feeds only; source management is demo-blocked)');
+      } else {
+        console.log('Calendar sync jobs disabled in demo mode by HOMEGLOW_DISABLE_CALENDAR_SYNC=1 (cached events only)');
+      }
     } else if (process.env.HOMEGLOW_DISABLE_CALENDAR_SYNC !== '1') {
       calendarSyncService = new CalendarSyncService(db, decryptPassword);
       calendarSyncService.initialize();

server/services/calendarSync.js

@@ -57,6 +57,14 @@ class CalendarSyncService {
         return { success: false, error: 'Source not found or disabled' };
       }
 
+      // Placeholder sources on the RFC 2606 reserved ".invalid" TLD can never
+      // resolve (the demo's baked "Family Calendar" uses one to carry its
+      // pre-cached events). Skip them silently instead of recording a
+      // misleading error status.
+      if (this.isPlaceholderUrl(source.url)) {
+        return { skipped: true };
+      }
+
       console.log(`Starting sync for calendar source: ${source.name} (${source.type})`);
       const startTime = Date.now();
 
@@ -249,6 +257,14 @@ class CalendarSyncService {
     return out;
   }
 
+  isPlaceholderUrl(url) {
+    try {
+      return new URL(url).hostname.toLowerCase().endsWith('.invalid');
+    } catch {
+      return false;
+    }
+  }
+
   async syncAllSources() {
     const sources = this.db.prepare('SELECT id FROM calendar_sources WHERE enabled = 1').all();
     const results = [];

server/tests/demoMode.test.js

@@ -70,6 +70,8 @@ test.before(async () => {
             DEMO_MODE: 'true',
             TZ: 'UTC',
             HOMEGLOW_DISABLE_BACKGROUND_JOBS: '1',
+            // Demo mode syncs its curated calendar feeds; keep tests offline.
+            HOMEGLOW_DISABLE_CALENDAR_SYNC: '1',
             ENCRYPTION_KEY: Buffer.alloc(32, 7).toString('base64'),
         },
         stdio: ['ignore', 'pipe', 'pipe'],
@@ -142,6 +144,29 @@ test('sample data is seeded (users, chores, prizes, calendar events)', async ()
     const events = await api('/api/calendar-events');
     assert.equal(events.status, 200);
     assert.ok(events.body.length >= 4);
+
+    // Family Calendar placeholder + the 4 curated live ICS feeds.
+    const sources = await api('/api/calendar-sources');
+    assert.equal(sources.status, 200);
+    assert.ok(sources.body.length >= 5);
+    const sourceNames = sources.body.map((s) => s.name);
+    assert.ok(sourceNames.includes('US Federal Holidays'));
+    assert.ok(sourceNames.includes('Arizona Diamondbacks'));
+});
+
+test('demo weather snapshot is served in both unit systems', async () => {
+    const imperial = await api('/api/demo/weather');
+    assert.equal(imperial.status, 200);
+    assert.equal(imperial.body.weatherData.name, 'Chili');
+    assert.equal(typeof imperial.body.weatherData.main.temp, 'number');
+    assert.ok(Array.isArray(imperial.body.forecastData) && imperial.body.forecastData.length === 3);
+    assert.ok(Array.isArray(imperial.body.chartData) && imperial.body.chartData.length === 8);
+    assert.ok(imperial.body.airQualityData.list[0].main.aqi >= 1);
+
+    const metric = await api('/api/demo/weather?units=metric');
+    assert.equal(metric.status, 200);
+    assert.ok(metric.body.weatherData.main.temp < imperial.body.weatherData.main.temp,
+        'metric temperature should be the Celsius conversion of the imperial snapshot');
 });
 
 test('abuse-prone routes are blocked with 403', async () => {
@@ -158,6 +183,9 @@ test('abuse-prone routes are blocked with 403', async () => {
         ['GET', '/api/connections/google/callback'],
         ['DELETE', '/api/connections/google/account'],
         ['POST', '/api/connections/apple/calendars'],
+        ['POST', '/api/calendar-sources'],
+        ['PATCH', '/api/calendar-sources/1'],
+        ['DELETE', '/api/calendar-sources/1'],
         ['POST', '/api/calendar-sources/1/test'],
         ['POST', '/api/photo-sources/1/uploaded'],
         ['POST', '/api/calendar-sync/1'],

server/utils/demoSeed.js

@@ -126,13 +126,32 @@ function seedUsersAndChores(db) {
   insertPrize.run('30 min extra screen time', 15);
 }
 
+// Real public ICS feeds synced live in demo mode (calendar sync runs for these;
+// visitors can't add/edit sources — those routes are demo-blocked, so only this
+// curated list is ever fetched). Several overlap on purpose: the two Town of
+// Chili feeds share events, which shows off cross-calendar deduplication.
+const DEMO_CALENDAR_FEEDS = [
+  { name: 'US Federal Holidays', url: 'https://www.opm.gov/policy-data-oversight/pay-leave/federal-holidays/holidays.ics', color: '#2a9d8f' },
+  { name: 'Arizona Diamondbacks', url: 'https://ics.calendarlabs.com/99/df8470ee/Arizona_Diamondbacks_-_MLB.ics', color: '#a4133c' },
+  { name: 'Town of Chili — Calendar', url: 'https://www.chiliny.gov/common/modules/iCalendar/iCalendar.aspx?catID=14&feed=calendar', color: '#457b9d' },
+  { name: 'Town of Chili — Community Events', url: 'https://www.chiliny.gov/common/modules/iCalendar/iCalendar.aspx?catID=30&feed=calendar', color: '#8338ec' },
+];
+
 function seedCalendar(db) {
-  // Calendar sync never runs in demo mode, so this ICS source is only a label
-  // for the cached events below (the URL is never fetched).
+  // The Family Calendar's .invalid URL is a placeholder that is never fetched
+  // (the sync service skips reserved-TLD hosts); its events are the baked
+  // cache entries below, so the demo has content the instant it boots.
   const sourceId = db.prepare(
     "INSERT INTO calendar_sources (name, type, url, color, enabled, sort_order) VALUES ('Family Calendar', 'ICS', 'https://demo.invalid/family.ics', '#6e44ff', 1, 0)"
   ).run().lastInsertRowid;
 
+  const insertSource = db.prepare(
+    'INSERT INTO calendar_sources (name, type, url, color, enabled, sort_order) VALUES (?, ?, ?, ?, 1, ?)'
+  );
+  DEMO_CALENDAR_FEEDS.forEach((feed, index) => {
+    insertSource.run(feed.name, 'ICS', feed.url, feed.color, index + 1);
+  });
+
   const insertEvent = db.prepare(
     'INSERT INTO calendar_events_cache (source_id, event_uid, title, start_time, end_time, description, location, all_day) VALUES (?, ?, ?, ?, ?, ?, ?, ?)'
   );