fix: side peek des bases repasse en vanilla JS + largeur 1100px standard (v7.49.0)

- Panneau peek: les bindings Alpine (x-data absent du conteneur) rendaient
  loovverture et le redimensionnement inoperants -> cblage direct sur le document.
- Helper unique window.fdWirePeekResize (app.js): pointer capture, 300px-90vw,
  clic=fermer, largeur persiste fd_peek_width partagee entre les 4 peeks.
- database-table-container margin:0 (tableau colle a gauche, marge Library).
- .lib-container remonte dans app.css (trash etait pleine largeur), .db-index 1100px.
- ObsiGate verifie sans code: creation .xlsx OK (openpyxl, #186).

app/routers/dashboard/_common.py

@@ -174,6 +174,11 @@ def _sidebar_data(request: Request, repos: list[dict], include_workspace: bool =
                     active_ws_name = row["name"]
                     workspace_pages = _load_workspace_pages(ws_cookie)
                     has_active_workspace = True
+                    # v7.46.0 : exposer l'ID de l'espace ACTIF. Avant, le sidebar
+                    # ne fournissait que son nom et le bouton Home de la sidebar
+                    # retombait sur ``local_workspaces[0]`` (premier espace TRIE
+                    # PAR NOM) → clic sur Home = changement d'espace surprise.
+                    local_ws_id = wsi
                 # else: stale cookie from another user — ignore
         except (ValueError, Exception):
             pass
@@ -199,8 +204,9 @@ def _sidebar_data(request: Request, repos: list[dict], include_workspace: bool =
         except Exception:
             logger.exception("_sidebar_data")
 
-    # Get local workspace ID for Gitea workspace mirror
-    local_ws_id = 0
+    # Get local workspace ID for Gitea workspace mirror (le miroir Gitea est un
+    # espace DISTINCT : on ne doit pas écraser ``local_ws_id`` (espace actif).
+    gitea_mirror_ws_id = 0
     if gitea_workspace and gitea_owner and gitea_repo:
         try:
             with get_conn() as conn:
@@ -209,18 +215,18 @@ def _sidebar_data(request: Request, repos: list[dict], include_workspace: bool =
                     (user["id"], f"{gitea_owner}/{gitea_repo}", "%gitea_repo%")
                 ).fetchone()
                 if row:
-                    local_ws_id = row["id"]
+                    gitea_mirror_ws_id = row["id"]
         except Exception:
             logger.exception("_sidebar_data")
 
     # Private pages for mirror workspace (when Gitea remote active)
     private_pages = []
-    if gitea_workspace and local_ws_id:
+    if gitea_workspace and gitea_mirror_ws_id:
         try:
             with get_conn() as conn:
                 pp_rows = conn.execute(
                     "SELECT id, title FROM pages WHERE parent_section='Private' AND workspace_id=? AND deleted_at IS NULL ORDER BY updated_at DESC LIMIT 20",
-                    (local_ws_id,)
+                    (gitea_mirror_ws_id,)
                 ).fetchall()
                 private_pages = [{"id": r[0], "title": r[1] or "Untitled"} for r in pp_rows]
         except Exception:

app/routers/dashboard/local_workspace.py

@@ -15,6 +15,7 @@ from app.config import settings
 from app.db import get_conn
 
 from ._common import (
+    WORKSPACE_COOKIE,
     _build_breadcrumb,
     _build_tree_children,
     _file_page_disk_path,
@@ -34,10 +35,16 @@ router = APIRouter(tags=["dashboard"])
 # ═══════════ Local Workspace (file/folder CRUD) ═══════════
 
 @router.get("/local-workspace", response_class=HTMLResponse)
-def local_workspace_page(request: Request, folder: int = None):
+def local_workspace_page(request: Request, folder: int = None, ws: int = None):
     """Local workspace page with file/folder tree.
 
     If ?folder=ID is provided, shows that folder's contents with breadcrumb.
+    If ?ws=ID is provided, shows that workspace — c'est ce que fait le bouton
+    « Home » de la sidebar (``/local-workspace?ws=<id>``). Le paramètre était
+    produit par le sidebar mais **ignoré** par la route : le contenu affiché
+    restait celui du workspace *actif* (cookie), donc Home pouvait montrer un
+    autre workspace que celui annoncé dans l'URL. Un ``ws`` qui n'appartient
+    pas à l'utilisateur est ignoré (et le workspace actif conservé).
     """
     from app.templating import ENV
     env = ENV
@@ -46,13 +53,46 @@ def local_workspace_page(request: Request, folder: int = None):
     if not user:
         return RedirectResponse("/auth/login?provider=local", status_code=302)
 
-    ws = _get_active_workspace(request, user_id=user["id"])
-    ws_id = ws["id"] if ws else None
+    ws_row = _get_active_workspace(request, user_id=user["id"])
+    if ws is not None:
+        # Workspace demandé par l'URL : on ne l'accepte que s'il appartient à
+        # l'utilisateur (même règle de propriété que _get_active_workspace).
+        with get_conn() as conn:
+            requested = conn.execute(
+                "SELECT id, name FROM workspaces WHERE id=? AND owner_id=?",
+                (ws, user["id"]),
+            ).fetchone()
+        if requested is not None:
+            ws_row = dict(requested)
+            # L'URL fait foi : on aligne le cookie pour que le reste de
+            # l'application (sidebar, API tree, breadcrumbs) suive le même
+            # workspace que celui affiché.
+            response = _render_local_workspace(env, sidebar, user, ws_row, folder)
+            response.set_cookie(WORKSPACE_COOKIE, str(ws_row["id"]),
+                                max_age=86400 * 30, httponly=True, path="/")
+            return response
+
+    ws_id = ws_row["id"] if ws_row else None
 
     # If no workspace exists for this user, redirect to workspaces page
     if not ws_id:
         return RedirectResponse("/workspaces", status_code=302)
 
+    return _render_local_workspace(env, sidebar, user, ws_row, folder)
+
+
+def _render_local_workspace(env, sidebar: dict, user: dict, ws_row: dict,
+                             folder: int | None) -> HTMLResponse:
+    """Render the local-workspace page for ``ws_row`` (shared by both paths).
+
+    ``sidebar`` a été calculé **avant** le éventuel changement de workspace
+    (``?ws=``) : on force donc le nom affiché et la sidebar sur ``ws_row``,
+    sinon la page afficherait le contenu d'un workspace sous le titre d'un
+    autre.
+    """
+    ws_id = ws_row["id"]
+    ws_name = (ws_row.get("name") or sidebar.get("active_ws_name") or "My Workspace")
+
     # Build breadcrumb if navigating into a folder
     breadcrumb = []
     current_folder_id = folder
@@ -63,7 +103,9 @@ def local_workspace_page(request: Request, folder: int = None):
     ctx = {
         **sidebar,
         "user": user,
-        "workspace_name": sidebar.get("active_ws_name", "My Workspace"),
+        "workspace_name": ws_name,
+        "active_ws_name": ws_name,
+        "active_workspace_id": ws_id,
         "current_folder_id": current_folder_id or 0,
         "workspace_id": ws_id or 0,
         "nav_workspace_id": ws_id or 0,
@@ -255,6 +297,7 @@ def nav_menu(request: Request, workspace_id: int = None, parent_id: int = None):
 @router.post("/api/local-workspace/items")
 def create_local_workspace_item(request: Request, body: dict = Body(default={})):
     """Create a new file in the active workspace."""
+    _require_user_id(request)  # A3/A4 : pas de creation de page anonyme
     name = (body.get("name") or "").strip() or "Untitled"
     item_type = body.get("type", "page")
     parent_id = body.get("parent_id")
@@ -279,6 +322,7 @@ def create_local_workspace_item(request: Request, body: dict = Body(default={}))
 @router.put("/api/local-workspace/items/{item_id:int}")
 def rename_local_workspace_item(request: Request, item_id: int, body: dict = Body(default={})):
     """Rename a file."""
+    _require_user_id(request)
     name = body.get("name", "Untitled").strip()
     with get_conn() as conn:
         conn.execute("UPDATE pages SET title=? WHERE id=?", (name, item_id))
@@ -291,6 +335,7 @@ def rename_local_workspace_item(request: Request, item_id: int, body: dict = Bod
 @router.delete("/api/local-workspace/items/{item_id:int}")
 def delete_local_workspace_item(request: Request, item_id: int):
     """Soft-delete a file/folder (sets deleted_at)."""
+    _require_user_id(request)
     from datetime import datetime
     with get_conn() as conn:
         conn.execute(
@@ -306,6 +351,7 @@ def delete_local_workspace_item(request: Request, item_id: int):
 @router.post("/api/local-workspace/items/{item_id:int}/restore")
 def restore_local_workspace_item(request: Request, item_id: int):
     """Restore a soft-deleted file/folder."""
+    _require_user_id(request)
     with get_conn() as conn:
         conn.execute(
             "UPDATE pages SET deleted_at=NULL WHERE id=?",
@@ -342,6 +388,7 @@ def serve_uploaded_file(ws_id: int, filename: str):
 @router.put("/api/local-workspace/items/{item_id:int}/move")
 def move_local_workspace_item(request: Request, item_id: int, body: dict = Body(default={})):
     """Move an item to a new parent (drag & drop)."""
+    _require_user_id(request)
     new_parent_id = body.get("parent_id")  # None = move to root
     with get_conn() as conn:
         conn.execute(

app/routers/dashboard/workspaces.py

@@ -6,18 +6,47 @@ from __future__ import annotations
 
 import logging
 
-from fastapi import APIRouter, Body, Request
+from fastapi import APIRouter, Body, HTTPException, Request
 from fastapi.responses import HTMLResponse, JSONResponse, RedirectResponse
 
 from app.auth.session import SessionManager
 from app.db import get_conn
+from app.services.collection_lifecycle import (
+    delete_collections,
+    workspace_collection_ids,
+)
 
-from ._common import WORKSPACE_COOKIE, _get_active_workspace, _get_user_id, _sidebar_data
+from ._common import (
+    WORKSPACE_COOKIE,
+    _get_active_workspace,
+    _get_user_id,
+    _require_user_id,
+    _sidebar_data,
+)
 
 logger = logging.getLogger(__name__)
 router = APIRouter(tags=["dashboard"])
 
 
+def _require_ws_owner(request: Request, ws_id: int) -> int:
+    """A3/A4 — session obligatoire + l'appelant doit posseder l'espace
+    (ou être admin global). Sans ce garde, un POST/DELETE anonyme créait ou
+    supprimait des espaces au nom de l'utilisateur 1."""
+    uid = _require_user_id(request)
+    with get_conn() as conn:
+        row = conn.execute(
+            "SELECT owner_id FROM workspaces WHERE id=?", (ws_id,)
+        ).fetchone()
+        if not row:
+            raise HTTPException(404, "Workspace not found")
+        is_admin = conn.execute(
+            "SELECT is_admin FROM users WHERE id=?", (uid,)
+        ).fetchone()
+    if row["owner_id"] != uid and not (is_admin and is_admin["is_admin"]):
+        raise HTTPException(403, "Not your workspace")
+    return uid
+
+
 
 
 @router.get("/workspaces", response_class=HTMLResponse)
@@ -42,8 +71,7 @@ def workspaces_page(request: Request):
 @router.get("/api/workspaces")
 def list_workspaces(request: Request):
     """List all workspaces for the current user."""
-    user = SessionManager.decode_session(request.cookies.get("flowdeck_session", ""))
-    uid = user["id"] if user and user.get("id") else 1
+    uid = _require_user_id(request)
     with get_conn() as conn:
         rows = conn.execute(
             "SELECT w.*, (SELECT COUNT(*) FROM pages WHERE workspace_id=w.id AND collection_row_id IS NULL) as page_count "
@@ -67,7 +95,7 @@ def create_workspace(request: Request, body: dict = Body(default={})):
     if not name:
         return {"error": "Name required"}
     user = SessionManager.decode_session(request.cookies.get("flowdeck_session", ""))
-    uid = user["id"] if user and user.get("id") else 1
+    uid = _require_user_id(request)
     with get_conn() as conn:
         # Ensure user exists (FK constraint)
         uid_ok = conn.execute("SELECT id FROM users WHERE id=?", (uid,)).fetchone()
@@ -99,6 +127,7 @@ def rename_workspace(request: Request, ws_id: int, body: dict = Body(default={})
     name = body.get("name", "").strip()
     if not name:
         return {"error": "Name required"}
+    _require_ws_owner(request, ws_id)
     with get_conn() as conn:
         conn.execute("UPDATE workspaces SET name=? WHERE id=?", (name, ws_id))
         conn.commit()
@@ -109,13 +138,19 @@ def rename_workspace(request: Request, ws_id: int, body: dict = Body(default={})
 
 @router.delete("/api/workspaces/{ws_id:int}")
 def delete_workspace(request: Request, ws_id: int):
-    """Delete a workspace and all its pages."""
+    """Delete a workspace, its pages and its databases."""
+    _require_ws_owner(request, ws_id)
     with get_conn() as conn:
+        # Les bases du workspace partaient avec ses pages : les laisser créait
+        # des collections orphelines (workspace_id pointant sur rien) que
+        # /db et My Tasks continuaient de lister.
+        collections = workspace_collection_ids(conn, ws_id)
+        delete_collections(conn, collections)
         conn.execute("DELETE FROM pages WHERE workspace_id=?", (ws_id,))
         conn.execute("DELETE FROM workspace_members WHERE workspace_id=?", (ws_id,))
         conn.execute("DELETE FROM workspaces WHERE id=?", (ws_id,))
         conn.commit()
-    return {"status": "ok"}
+    return {"status": "ok", "collections": len(collections)}
 
 
 
@@ -123,6 +158,7 @@ def delete_workspace(request: Request, ws_id: int):
 @router.post("/api/workspaces/{ws_id:int}/select")
 def select_workspace(request: Request, ws_id: int):
     """Set the active workspace via cookie."""
+    _require_ws_owner(request, ws_id)
     response = JSONResponse({"status": "ok", "workspace_id": ws_id})
     response.set_cookie(WORKSPACE_COOKIE, str(ws_id), max_age=86400 * 30, httponly=True, path="/")
     return response