feat: v7.3.0 — cycle v6.8.0→v7.3.0 (Sites, Search, Automations, Calendar, SCIM, Wiki) + audit A9

- v6.8.0 Sites & Forms publics (migrations 24) - v6.9.0 Recherche sémantique hybride + Ask AI (migration 25) - v7.0.0 Automations v2 multi-étapes + Workers sandboxés (migration 26) - v7.1.0 Calendar sync Google/CalDAV + Meeting Notes (migration 27) - v7.2.0 Enterprise : SCIM 2.0, 2FA TOTP/passkeys, audit UI, agent approvals (migration 28) - v7.3.0 Wiki/Teamspaces, verified pages, collab polish, charts, unfurl (migration 29) - docs V68→V73, ROADMAP/CHANGELOG/WORKLOAD à jour, VERSION 7.3.0 - A9 : flowdeck.db, flowdeck_dev.db, test-commit.md, upload_test.txt et e2e/{node_modules,shots,test-results} désindexés + ignorés (.gitignore/.dockerignore)
2026-09-30 20:02:57 -04:00
parent d074689b18
commit 1706ad1ee9
260 changed files with 10667 additions and 353788 deletions
@@ -8,7 +8,13 @@ from fastapi import APIRouter, HTTPException, Request

 from app.auth.session import SessionManager
 from app.db import get_conn
-from app.services.automations import get_page_context, run_automation
+from app.services.automations import (
+    get_page_context,
+    get_steps,
+    press_button,
+    run_automation,
+    validate_step,
+)

 logger = logging.getLogger(__name__)
 router = APIRouter(tags=["automations"])
@@ -172,3 +178,138 @@ async def automation_runs_history(request: Request, auto_id: int, limit: int = 5
            (auto_id, limit),
        ).fetchall()
    return {"runs": [dict(r) for r in rows]}
+
+
+# ── v7.0.0 — chained steps (trigger/condition/delay/action) ───────────────
+
+STEP_SECRET_FIELDS = {"webhook_url"}
+
+
+def _require_session(request: Request) -> dict:
+    user = SessionManager.decode_session(request.cookies.get("flowdeck_session", ""))
+    if not user or not user.get("id"):
+        raise HTTPException(status_code=401, detail="Authentication required")
+    return user
+
+
+def _get_auto(auto_id: int) -> dict | None:
+    with get_conn() as conn:
+        row = conn.execute("SELECT * FROM automations WHERE id=?", (auto_id,)).fetchone()
+    return dict(row) if row else None
+
+
+def _auto_404():
+    # NOTE: return (not raise) — the global 404 handler redirects non-/api
+    # paths to /workspaces, which TestClient follows into a 200.
+    from fastapi.responses import JSONResponse
+    return JSONResponse({"detail": "Automation not found"}, status_code=404)
+
+
+def _encrypt_step_config(config: dict) -> dict:
+    """Encrypt secret fields at rest (empty = keep existing, like sso_config)."""
+    from app.services.sso_provisioning import encrypt_secret
+    cfg = dict(config or {})
+    for field in STEP_SECRET_FIELDS:
+        if field in cfg and cfg[field]:
+            val = str(cfg[field])
+            if not val.startswith("gAAAAA"):
+                cfg[field] = encrypt_secret(val)
+    return cfg
+
+
+@router.get("/workspace/automations/{auto_id}/steps")
+async def list_steps(request: Request, auto_id: int):
+    if _get_auto(auto_id) is None:
+        return _auto_404()
+    return {"automation_id": auto_id, "steps": get_steps(auto_id)}
+
+
+@router.post("/workspace/automations/{auto_id}/steps")
+async def create_step(request: Request, auto_id: int):
+    _require_session(request)
+    if _get_auto(auto_id) is None:
+        return _auto_404()
+    body = await request.json() if request.headers.get("content-type") else {}
+    kind = body.get("kind", "")
+    config = body.get("config", {}) or {}
+    validate_step(kind, config)
+    with get_conn() as conn:
+        pos = conn.execute(
+            "SELECT COALESCE(MAX(position), -1)+1 FROM automation_steps WHERE automation_id=?",
+            (auto_id,)).fetchone()[0]
+        cur = conn.execute(
+            "INSERT INTO automation_steps (automation_id, kind, position, config_json)"
+            " VALUES (?,?,?,?)",
+            (auto_id, kind, int(body.get("position", pos)),
+             json.dumps(_encrypt_step_config(config))))
+        conn.commit()
+        step_id = cur.lastrowid
+    return {"id": step_id, "status": "created"}
+
+
+@router.put("/workspace/automations/steps/{step_id}")
+async def update_step(request: Request, step_id: int):
+    _require_session(request)
+    body = await request.json() if request.headers.get("content-type") else {}
+    with get_conn() as conn:
+        row = conn.execute("SELECT * FROM automation_steps WHERE id=?", (step_id,)).fetchone()
+        if not row:
+            from fastapi.responses import JSONResponse
+            return JSONResponse({"detail": "Step not found"}, status_code=404)
+        kind = body.get("kind", row["kind"])
+        try:
+            config = body.get("config", json.loads(row["config_json"] or "{}"))
+        except (TypeError, json.JSONDecodeError):
+            config = {}
+        validate_step(kind, config if isinstance(config, dict) else {})
+        conn.execute(
+            "UPDATE automation_steps SET kind=?, position=?, config_json=? WHERE id=?",
+            (kind, int(body.get("position", row["position"])),
+             json.dumps(_encrypt_step_config(config)), step_id))
+        conn.commit()
+    return {"id": step_id, "status": "updated"}
+
+
+@router.delete("/workspace/automations/steps/{step_id}")
+async def delete_step(request: Request, step_id: int):
+    _require_session(request)
+    with get_conn() as conn:
+        conn.execute("DELETE FROM automation_steps WHERE id=?", (step_id,))
+        conn.commit()
+    return {"id": step_id, "status": "deleted"}
+
+
+@router.put("/workspace/automations/{auto_id}/mode")
+async def set_trigger_mode(request: Request, auto_id: int):
+    """Set multi-trigger mode: any (default) or all (5-minute window)."""
+    _require_session(request)
+    if _get_auto(auto_id) is None:
+        return _auto_404()
+    body = await request.json() if request.headers.get("content-type") else {}
+    mode = (body.get("mode") or "any").lower()
+    if mode not in ("any", "all"):
+        raise HTTPException(status_code=400, detail="mode must be any or all")
+    with get_conn() as conn:
+        conn.execute("UPDATE automations SET trigger_mode=? WHERE id=?", (mode, auto_id))
+        conn.commit()
+    return {"id": auto_id, "trigger_mode": mode}
+
+
+@router.post("/api/automations/press-button")
+async def press_button_endpoint(request: Request):
+    """Run the automation linked to a native DB button cell (CSRF-exempt)."""
+    body = await request.json() if request.headers.get("content-type") else {}
+    try:
+        collection_id = int(body.get("collection_id", 0))
+        row_id = int(body.get("row_id", 0))
+    except (TypeError, ValueError):
+        raise HTTPException(status_code=400, detail="collection_id + row_id required") from None
+    prop_ref = body.get("property", body.get("property_id", ""))
+    if not prop_ref:
+        raise HTTPException(status_code=400, detail="property required")
+    user = _current_user(request)
+    try:
+        result = await press_button(collection_id, row_id, prop_ref, user.get("id") or 1)
+    except ValueError as exc:
+        raise HTTPException(status_code=400, detail=str(exc)) from None
+    return result