fix: side peek des bases repasse en vanilla JS + largeur 1100px standard (v7.49.0)

- Panneau peek: les bindings Alpine (x-data absent du conteneur) rendaient
  loovverture et le redimensionnement inoperants -> cblage direct sur le document.
- Helper unique window.fdWirePeekResize (app.js): pointer capture, 300px-90vw,
  clic=fermer, largeur persiste fd_peek_width partagee entre les 4 peeks.
- database-table-container margin:0 (tableau colle a gauche, marge Library).
- .lib-container remonte dans app.css (trash etait pleine largeur), .db-index 1100px.
- ObsiGate verifie sans code: creation .xlsx OK (openpyxl, #186).

app/routers/board/_common.py

@@ -485,6 +485,10 @@ def _sidebar_data(request: Request, owner: str = "", repo: str = "") -> dict:
                     active_ws_name = row["name"]
                     workspace_pages = _load_workspace_pages(ws_cookie)
                     has_active_workspace = True
+                    # v7.46.0 : comme pour le sidebar dashboard, exposer l'ID de
+                    # l'espace ACTIF (le bouton Home de base.html pointait sinon
+                    # sur ``local_workspaces[0]``, premier espace trie par nom).
+                    local_ws_id = wsi
         except (ValueError, Exception):
             pass
     recent = []

app/routers/board/sharing.py

@@ -12,6 +12,11 @@ from fastapi.responses import HTMLResponse
 from app.auth.session import SessionManager
 from app.db import get_conn
 from app.services.automations import fire_event, run_event_sync
+from app.services.collection_lifecycle import (
+    collections_hosted_by_page,
+    collections_hosted_by_pages,
+    delete_collections,
+)
 from app.services.publish import fire_published, fire_unpublished, publish, unpublish
 
 from ._common import _sidebar_data
@@ -176,10 +181,15 @@ def restore_page(request: Request, page_id: int):
 def permanent_delete(request: Request, page_id: int):
     _trash_session(request)
     with get_conn() as conn:
+        # La page hôte d'une base disparaît définitivement → sa base et ses
+        # lignes aussi, sinon My Tasks (et /db) continuaient de lister des
+        # tâches sans document.
+        collections = collections_hosted_by_page(conn, page_id)
         conn.execute("UPDATE pages SET parent_id=NULL WHERE parent_id=?", (page_id,))
         conn.execute("DELETE FROM pages WHERE id=? AND deleted_at IS NOT NULL", (page_id,))
+        delete_collections(conn, collections)
         conn.commit()
-    return {"status": "ok", "deleted": page_id}
+    return {"status": "ok", "deleted": page_id, "collections": len(collections)}
 
 
 
@@ -193,13 +203,23 @@ def empty_trash(request: Request):
         n = conn.execute(
             "SELECT COUNT(*) FROM pages WHERE deleted_at IS NOT NULL"
         ).fetchone()[0]
+        # Bases portées par les pages purgées (les pages contenu de ligne
+        # n'hébergent aucune base et ne remontent rien).
+        trashed = [
+            r["id"]
+            for r in conn.execute(
+                "SELECT id FROM pages WHERE deleted_at IS NOT NULL"
+            ).fetchall()
+        ]
+        collections = collections_hosted_by_pages(conn, trashed)
         conn.execute(
             "UPDATE pages SET parent_id=NULL WHERE parent_id IN "
             "(SELECT id FROM pages WHERE deleted_at IS NOT NULL)"
         )
         conn.execute("DELETE FROM pages WHERE deleted_at IS NOT NULL")
+        delete_collections(conn, collections)
         conn.commit()
-    return {"status": "ok", "deleted": n}
+    return {"status": "ok", "deleted": n, "collections": len(collections)}
 
 
 

app/routers/board/synced.py

@@ -16,23 +16,41 @@ router = APIRouter(tags=["board"], prefix="/board")
 
 
 
-# ═══════════════ v5.14.0: Synced Blocks ─═══════════════════
-# These routes MUST be registered before the catch-all /{owner}/{repo} below.
+# ═══════════════ v5.14.0: Synced Blocks ─═══════════════════# These routes MUST be registered before the catch-all /{owner}/{repo} below.
+
+def _session_user(request: Request) -> dict:
+    """Session obligatoire — sans garde, un appel anonyme levait
+    ``AttributeError: 'NoneType' object has no attribute 'get'`` (HTTP 500)
+    au lieu d'un 401."""
+    user = SessionManager.decode_session(request.cookies.get("flowdeck_session", ""))
+    if not user or not user.get("id"):
+        raise HTTPException(401, "Authentication required")
+    return user
+
+
+def _assert_can_edit_block(request: Request, sb: dict) -> None:
+    """Seul l'auteur du bloc (ou un admin global) peut le modifier/supprimer."""
+    user = _session_user(request)
+    if sb.get("created_by") in (None, user.get("id")):
+        return
+    if user.get("is_admin"):
+        return
+    raise HTTPException(403, "Not the author of this synced block")
+
 
 @router.get("/api/synced-blocks")
 def list_synced_blocks_api(request: Request, workspace: str = Query(default="")):
     """List synced blocks for a workspace."""
-    user = SessionManager.decode_session(request.cookies.get("flowdeck_session", ""))
+    user = _session_user(request)
     from app.services.synced_blocks import list_synced_blocks
     return {"synced_blocks": list_synced_blocks(workspace or user.get("login", ""))}
 
 
 
-
 @router.post("/api/synced-blocks")
 def create_synced_block_api(request: Request, body: dict = Body(...)):
     """Create a new synced block."""
-    user = SessionManager.decode_session(request.cookies.get("flowdeck_session", ""))
+    user = _session_user(request)
     from app.services.synced_blocks import create_synced_block
     sid = create_synced_block(
         workspace=body.get("workspace", ""),
@@ -61,6 +79,7 @@ async def update_synced_block_api(request: Request, sid: int):
     sb = get_synced_block(sid)
     if not sb:
         raise HTTPException(404, "Synced block not found")
+    _assert_can_edit_block(request, sb)
     update_synced_block(sid, body.get("title", sb["title"]), body.get("content", []))
     # v6.5.0: rewrite every referencing page's stored content first (DB row
     # content pages included), THEN push the realtime update so open rooms
@@ -86,6 +105,7 @@ async def delete_synced_block_api(request: Request, sid: int):
     sb = get_synced_block(sid)
     if not sb:
         raise HTTPException(404, "Synced block not found")
+    _assert_can_edit_block(request, sb)
     # v6.5.0: collect referencing pages BEFORE the FK cascade wipes the
     # refs, rewrite their stored content (deleted state), then broadcast.
     pids = page_ids_for_synced(sid)
@@ -99,8 +119,9 @@ async def delete_synced_block_api(request: Request, sid: int):
 
 
 @router.get("/api/synced-blocks/{sid}")
-def get_synced_block_api(sid: int):
+def get_synced_block_api(request: Request, sid: int):
     """Get a synced block by id."""
+    _session_user(request)
     from app.services.synced_blocks import get_synced_block
     sb = get_synced_block(sid)
     if not sb: