feat: finalisation éditeur Forge + mode hors-ligne PWA + consolidation roadmap

- Forge: Tab indent, Ctrl+K, auto-focus, AI status, messages erreur FR
- Forge: slash commands clean, cache-bust iframe, preview serveur
- Forge: iframe 82vh, hauteur auto, table inline, sélecteur langage
- PWA hors-ligne: IndexedDB (offline-db.js + offline.js)
- Mermaid: thème dark complet, highlight.js preview
- Backend: màj CSP, rename chain, bookmarks/history/shares
- Roadmap: consolidation dans docs/ROADMAP.md (75 items)
- Infra: docker-compose.podman.yml, suppression test-vault
- .gitignore: exclusion odysseus/

backend/ai.py

@@ -5,7 +5,9 @@ Configured via environment variables.
 """
 
 import os
+import json
 import logging
+from pathlib import Path
 import httpx
 from typing import Optional, Literal
 
@@ -13,27 +15,48 @@ logger = logging.getLogger("obsigate.ai")
 
 ProviderName = Literal["deepseek", "openrouter", "gemini"]
 
-# Provider configurations
-PROVIDERS = {
-    "deepseek": {
-        "api_key": os.getenv("DEEPSEEK_API_KEY", "").strip(),
-        "base_url": "https://api.deepseek.com/v1",
-        "model": os.getenv("DEEPSEEK_MODEL", "deepseek-chat"),
-        "auth_header": "Bearer {api_key}",
-    },
-    "openrouter": {
-        "api_key": os.getenv("OPENROUTER_API_KEY", "").strip(),
-        "base_url": "https://openrouter.ai/api/v1",
-        "model": os.getenv("OPENROUTER_MODEL", "openai/gpt-4o-mini"),
-        "auth_header": "Bearer {api_key}",
-    },
-    "gemini": {
-        "api_key": os.getenv("GEMINI_API_KEY", "").strip(),
-        "base_url": "https://generativelanguage.googleapis.com/v1beta",
-        "model": os.getenv("GEMINI_MODEL", "gemini-2.0-flash"),
-        "auth_header": None,  # Uses query param ?key=
-    },
-}
+# Provider configurations — keys loaded from file or .env
+AI_KEYS_FILE = Path("data/api_keys.json")
+
+def _read_ai_keys() -> dict:
+    if not AI_KEYS_FILE.exists():
+        return {}
+    try:
+        return json.loads(AI_KEYS_FILE.read_text(encoding="utf-8"))
+    except Exception:
+        return {}
+
+def get_ai_key(env_name: str) -> str:
+    """Get AI key: stored file first, then .env fallback."""
+    keys = _read_ai_keys()
+    if env_name in keys and keys[env_name]:
+        return keys[env_name]
+    return os.getenv(env_name, "").strip()
+
+def _load_provider_keys():
+    """Load AI keys from stored file, falling back to .env."""
+    return {
+        "deepseek": {
+            "api_key": get_ai_key("DEEPSEEK_API_KEY"),
+            "base_url": "https://api.deepseek.com/v1",
+            "model": os.getenv("DEEPSEEK_MODEL", "deepseek-chat"),
+            "auth_header": "Bearer {api_key}",
+        },
+        "openrouter": {
+            "api_key": get_ai_key("OPENROUTER_API_KEY"),
+            "base_url": "https://openrouter.ai/api/v1",
+            "model": os.getenv("OPENROUTER_MODEL", "openai/gpt-4o-mini"),
+            "auth_header": "Bearer {api_key}",
+        },
+        "gemini": {
+            "api_key": get_ai_key("GEMINI_API_KEY"),
+            "base_url": "https://generativelanguage.googleapis.com/v1beta",
+            "model": os.getenv("GEMINI_MODEL", "gemini-2.0-flash"),
+            "auth_header": None,
+        },
+    }
+
+PROVIDERS = _load_provider_keys()
 
 DEFAULT_PROVIDER: ProviderName = os.getenv("AI_DEFAULT_PROVIDER", "deepseek")  # type: ignore
 

backend/ai_routes.py

@@ -24,7 +24,7 @@ async def api_status():
     Reads environment variables at runtime so that changes to
     .env or Docker environment are reflected immediately.
     """
-    import os as _os
+    from backend.ai import get_ai_key
     provider_keys = {
         "deepseek": "DEEPSEEK_API_KEY",
         "openrouter": "OPENROUTER_API_KEY",
@@ -32,7 +32,7 @@ async def api_status():
     }
     providers = {}
     for name, env_var in provider_keys.items():
-        has_key = bool(_os.getenv(env_var, "").strip())
+        has_key = bool(get_ai_key(env_var))
         providers[name] = {
             "available": has_key,
             "model": PROVIDERS[name]["model"] if has_key else None,

backend/history.py

@@ -123,3 +123,46 @@ def is_bookmarked(username: str, vault: str, path: str) -> bool:
         return False
     bookmarks = _read_data(_get_bookmarks_file(username))
     return any(b["vault"] == vault and b["path"] == path for b in bookmarks)
+
+
+def update_bookmarks_after_rename(vault: str, old_path: str, new_path: str):
+    """Update all users' bookmarks when a file is renamed."""
+    if not HISTORY_DIR.exists():
+        return
+    for bfile in HISTORY_DIR.glob("*_bookmarks.json"):
+        try:
+            bookmarks = _read_data(bfile)
+            updated = False
+            for b in bookmarks:
+                if b.get("vault") == vault and b.get("path") == old_path:
+                    b["path"] = new_path
+                    # Update title from new path
+                    new_title = new_path.split("/")[-1].replace(".md", "").replace("-", " ").replace("_", " ")
+                    b["title"] = new_title
+                    updated = True
+            if updated:
+                _write_data(bfile, bookmarks)
+                logger.info(f"Updated bookmarks in {bfile.name}: {vault}/{old_path} -> {new_path}")
+        except Exception as e:
+            logger.error(f"Failed to update bookmarks in {bfile.name}: {e}")
+
+
+def update_history_after_rename(vault: str, old_path: str, new_path: str):
+    """Update all users' history entries when a file is renamed."""
+    if not HISTORY_DIR.exists():
+        return
+    for hfile in HISTORY_DIR.glob("*.json"):
+        if "_bookmarks" in hfile.name:
+            continue
+        try:
+            history = _read_data(hfile)
+            updated = False
+            for h in history:
+                if h.get("vault") == vault and h.get("path") == old_path:
+                    h["path"] = new_path
+                    updated = True
+            if updated:
+                _write_data(hfile, history)
+                logger.info(f"Updated history in {hfile.name}: {vault}/{old_path} -> {new_path}")
+        except Exception as e:
+            logger.error(f"Failed to update history in {hfile.name}: {e}")

backend/main.py

@@ -9,6 +9,7 @@ import secrets
 import shutil
 import string
 import time
+import urllib.request
 from concurrent.futures import ThreadPoolExecutor
 from contextlib import asynccontextmanager
 from datetime import datetime, timezone
@@ -50,7 +51,7 @@ from backend.vault_settings import (
     get_vault_setting,
     update_vault_setting,
 )
-from backend.history import record_open, get_recent_opened, remove_recent, toggle_bookmark, get_bookmarks, is_bookmarked
+from backend.history import record_open, get_recent_opened, remove_recent, toggle_bookmark, get_bookmarks, is_bookmarked, update_bookmarks_after_rename, update_history_after_rename
 
 logging.basicConfig(
     level=logging.INFO,
@@ -545,9 +546,9 @@ class SecurityHeadersMiddleware(BaseHTTPMiddleware):
         response.headers["Content-Security-Policy"] = (
             "default-src 'self'; "
             "script-src 'self' 'unsafe-inline' https://cdnjs.cloudflare.com https://unpkg.com https://esm.sh https://cdn.jsdelivr.net; "
-            "style-src 'self' 'unsafe-inline' https://cdnjs.cloudflare.com https://fonts.googleapis.com; "
+            "style-src 'self' 'unsafe-inline' https://cdnjs.cloudflare.com https://fonts.googleapis.com https://cdn.jsdelivr.net; "
             "img-src 'self' data: blob:; "
-            "connect-src 'self' https://esm.sh https://unpkg.com https://cdnjs.cloudflare.com https://fonts.googleapis.com https://fonts.gstatic.com; "
+            "connect-src 'self' https://esm.sh https://unpkg.com https://cdnjs.cloudflare.com https://fonts.googleapis.com https://fonts.gstatic.com https://cdn.jsdelivr.net; "
             "font-src 'self' https://fonts.gstatic.com;"
         )
         # Cache static assets aggressively (fingerprinted by PWA manifest hash)
@@ -654,7 +655,7 @@ except OSError:
     build_pdf_html = None  # type: ignore[assignment]
     import logging
     logging.getLogger("obsigate").warning("PDF export unavailable (WeasyPrint/GTK not found)")
-from backend.share import create_share, get_share_by_token, record_access, revoke_share, list_shares  # noqa: E402
+from backend.share import create_share, get_share_by_token, record_access, revoke_share, list_shares, update_shares_after_rename  # noqa: E402
 from backend.webhooks import get_webhooks, create_webhook, update_webhook, delete_webhook, dispatch_webhooks  # noqa: E402
 from backend.saved_searches import get_saved, save_search, delete_saved  # noqa: E402
 from backend.ai_routes import router as ai_router  # noqa: E402
@@ -1814,6 +1815,11 @@ async def api_file_rename(
         # Update index
         await handle_file_move(vault_name, old_path_str, new_path_str)
         
+        # Update bookmarks, history, and shares
+        update_bookmarks_after_rename(vault_name, old_path_str, new_path_str)
+        update_history_after_rename(vault_name, old_path_str, new_path_str)
+        update_shares_after_rename(vault_name, old_path_str, new_path_str)
+        
         # Broadcast SSE event
         await sse_manager.broadcast("file_renamed", {
             "vault": vault_name,
@@ -3602,6 +3608,114 @@ async def api_set_config(body: dict = Body(...), current_user=Depends(require_ad
     return current
 
 
+# ---------------------------------------------------------------------------
+# AI API Keys — stored in data/api_keys.json, fallback to .env
+# ---------------------------------------------------------------------------
+
+from backend.ai import get_ai_key, _read_ai_keys  # noqa: E402
+
+AI_KEYS_FILE = Path("data/api_keys.json")
+
+def _write_ai_keys(data: dict):
+    AI_KEYS_FILE.parent.mkdir(parents=True, exist_ok=True)
+    tmp = AI_KEYS_FILE.with_suffix(".tmp")
+    tmp.write_text(_json.dumps(data, indent=2), encoding="utf-8")
+    tmp.replace(AI_KEYS_FILE)
+
+@app.get("/api/config/ai-keys")
+async def api_get_ai_keys(current_user=Depends(require_admin)):
+    """Return stored AI keys (values masked)."""
+    keys = _read_ai_keys()
+    masked = {}
+    for k in ["DEEPSEEK_API_KEY", "OPENROUTER_API_KEY", "GEMINI_API_KEY"]:
+        val = keys.get(k, "") or os.environ.get(k, "")
+        if val:
+            masked[k] = val[:4] + "..." + val[-4:] if len(val) > 8 else "***"
+        else:
+            masked[k] = ""
+    return masked
+
+@app.post("/api/config/ai-keys")
+async def api_set_ai_keys(body: dict = Body(...), current_user=Depends(require_admin)):
+    """Save AI keys. Pass {"DEEPSEEK_API_KEY":"sk-...","OPENROUTER_API_KEY":"...","GEMINI_API_KEY":"..."}"""
+    keys = _read_ai_keys()
+    for k in ["DEEPSEEK_API_KEY", "OPENROUTER_API_KEY", "GEMINI_API_KEY"]:
+        if k in body and body[k]:
+            keys[k] = body[k]
+    _write_ai_keys(keys)
+    logger.info("AI keys updated")
+    return {"status": "ok"}
+
+@app.post("/api/config/ai-keys/test")
+async def api_test_ai_keys(current_user=Depends(require_admin)):
+    """Test which AI providers are configured."""
+    results = {}
+    for key_name, label, test_url, test_header in [
+        ("DEEPSEEK_API_KEY", "deepseek", "https://api.deepseek.com/v1/models", "Authorization"),
+        ("OPENROUTER_API_KEY", "openrouter", "https://openrouter.ai/api/v1/models", "Authorization"),
+        ("GEMINI_API_KEY", "gemini", "https://generativelanguage.googleapis.com/v1beta/models?key={key}", None),
+    ]:
+        key = get_ai_key(key_name)
+        if not key:
+            results[label] = "non configuré"
+            continue
+        try:
+            import urllib.request
+            if test_header:
+                req = urllib.request.Request(test_url, headers={test_header: "Bearer " + key})
+            else:
+                req = urllib.request.Request(test_url.replace("{key}", key))
+            urllib.request.urlopen(req, timeout=5)
+            results[label] = "ok"
+        except Exception as e:
+            results[label] = "erreur: " + str(e)[:80]
+    return results
+
+
+# ---------------------------------------------------------------------------
+# AI Models — list available models per provider
+# ---------------------------------------------------------------------------
+
+@app.get("/api/config/ai-models")
+async def api_list_ai_models(provider: str = Query(...), current_user=Depends(require_admin)):
+    """List available models for a given AI provider."""
+    provider = provider.lower()
+
+    if provider not in ("deepseek", "openrouter", "gemini"):
+        return {"models": [], "error": f"Unknown provider: {provider}"}
+
+    key_name = f"{provider.upper()}_API_KEY"
+    key = get_ai_key(key_name)
+    if not key:
+        return {"models": [], "error": "API key not configured"}
+
+    # Build URL and request
+    if provider == "gemini":
+        url = f"https://generativelanguage.googleapis.com/v1beta/models?key={key}"
+    elif provider == "deepseek":
+        url = "https://api.deepseek.com/v1/models"
+    else:  # openrouter
+        url = "https://openrouter.ai/api/v1/models"
+
+    try:
+        if provider == "gemini":
+            req = urllib.request.Request(url)
+        else:
+            req = urllib.request.Request(url, headers={"Authorization": "Bearer " + key})
+
+        with urllib.request.urlopen(req, timeout=10) as resp:
+            data = _json.loads(resp.read().decode())
+
+        if provider == "gemini":
+            models = [m.get("name", "") for m in data.get("models", [])]
+        else:
+            models = [m.get("id", "") for m in data.get("data", [])]
+
+        return {"models": models}
+    except Exception as e:
+        return {"models": [], "error": str(e)}
+
+
 # ---------------------------------------------------------------------------
 # Diagnostics API
 # ---------------------------------------------------------------------------

backend/share.py

@@ -109,3 +109,16 @@ def list_shares(vault_filter: Optional[str] = None) -> list:
     # Most recent first
     shares.sort(key=lambda s: s.get("created_at", ""), reverse=True)
     return shares
+
+
+def update_shares_after_rename(vault: str, old_path: str, new_path: str):
+    """Update all shares when a file is renamed."""
+    data = _read()
+    updated = False
+    for sid, s in data["shares"].items():
+        if s.get("vault") == vault and s.get("path") == old_path:
+            s["path"] = new_path
+            updated = True
+            logger.info(f"Updated share {sid}: {vault}/{old_path} -> {new_path}")
+    if updated:
+        _write(data)