fix: A43 TERMINÉ + A38 phase 1 — CSRF rendu côté serveur, helper unique (v7.33.0)

A43 (les 4 items sont clos) : - `__CSRF_PLACEHOLDER__` supprimé : ContextVar CSRF_TOKEN posée par CSRFMiddleware avant call_next (même mécanique que le nonce CSP), global `{{ csrf_token() }}` dans templating, base.html rend `{"X-CSRF-Token":{{ csrf_token()|tojson }}}` — vide si cookie absent, `htmx:configRequest` re-lit le cookie à chaque appel → plus jamais de jeton factice servi. - Palette : `fetch('/api/search…')` SANS header (GET ∈ SAFE_METHODS → CSRF inapplicable) — le JSON.parse du body-attr par frappe disparaît. - utcnow déprécié = 0 dans app/**.py ; health loggé (A25) + booléens db/ gitea = raison ; probe réseau = voulu (test de connectivité). A38 phase 1 (CSRF unifié) : - `window.getCsrf()` unique dans le <head> de base.html. - 76 lectures brutes du cookie → getCsrf() dans 13 fichiers (47 formes `(…||[])[1]||''`, 25 déclarations `const X = match(…)` avec conversion de leurs usages `X?X[1]:''` → `X` (noms collectés PAR FICHIER, jamais de règle globale), 4 formes espacées). - Définitions dupliquées supprimées : card_detail.html (multi-lignes), database_table.js (1 ligne dans IIFE → chute sur le global). - Les 3 variantes de base.html (IIFE getCsrf + 2 getCsrfToken) → `return getCsrf()`. - welcome.html garde sa lecture locale (page autonome sans base) ; reste exactement 1 raw dans base.html (la déf head) + 2 dans welcome. Test : test_csrf_server_rendered_no_placeholder (pas de placeholder + token du hx-headers == cookie csrf_token). suite **1092/1092** · ruff OK · node --check vert · docs à jour
2026-10-02 08:45:27 -04:00
parent 0bc74ad728
commit 770fdc2b68
25 changed files with 190 additions and 119 deletions
@@ -188,7 +188,7 @@
          var fd = new FormData();
          fd.append('name', this.customName || 'emoji');
          fd.append('file', this.customFile);
-          var csrf = (document.cookie.match(/csrf_token=([^;]+)/) || [])[1] || '';
+          var csrf = getCsrf();
          var r = await fetch('/api/custom-emojis', { method: 'POST', headers: { 'X-CSRF-Token': csrf }, body: fd, credentials: 'same-origin' });
          var d = await r.json();
          if (d && d.emoji) {
@@ -203,7 +203,7 @@
      },
      async deleteCustom(id) {
        try {
-          var csrf = (document.cookie.match(/csrf_token=([^;]+)/) || [])[1] || '';
+          var csrf = getCsrf();
          await fetch('/api/custom-emojis/' + id, { method: 'DELETE', headers: { 'X-CSRF-Token': csrf }, credentials: 'same-origin' });
          this.custom = this.custom.filter(function (e) { return e.id !== id; });
        } catch { /* volontaire */ }
@@ -97,7 +97,7 @@
          var payload = {prompt: message};
          if(context && context.trim()) payload.context = String(context).slice(0, 20000);
          return fetch('/api/agent/generate', {
-            method:'POST', headers:{'X-CSRF-Token': (document.cookie.match(/csrf_token=([^;]+)/)||[])[1]||'', 'Content-Type':'application/json'},
+            method:'POST', headers:{'X-CSRF-Token': getCsrf(), 'Content-Type':'application/json'},
            body: JSON.stringify(payload)
          }).then(function(resp){
            return resp.json();
@@ -243,7 +243,7 @@
          if(self.llmModel) payload.model = self.llmModel;

          fetch('/api/agent/generate', {
-            method:'POST', headers:{'X-CSRF-Token': (document.cookie.match(/csrf_token=([^;]+)/)||[])[1]||'', 'Content-Type':'application/json'}, body: JSON.stringify(payload)
+            method:'POST', headers:{'X-CSRF-Token': getCsrf(), 'Content-Type':'application/json'}, body: JSON.stringify(payload)
          }).then(function(r){ return r.json(); }).then(function(d){
            self.messages = self.messages.filter(function(m){ return m.id !== thinkId; });
            if(d && d.ok && d.text){
@@ -366,7 +366,7 @@
      installGallerySkill(slug, icon, name){
        var self = this;
        fetch('/api/agent/skills/gallery/' + encodeURIComponent(slug) + '/install', {
-          method: 'POST', headers: {'X-CSRF-Token': (document.cookie.match(/csrf_token=([^;]+)/)||[])[1]||'', 'Content-Type': 'application/json'}, body: '{}'
+          method: 'POST', headers: {'X-CSRF-Token': getCsrf(), 'Content-Type': 'application/json'}, body: '{}'
        }).then(function(r){
          return r.json().then(function(d){ return {ok: r.ok, d: d}; });
        }).then(function(res){
@@ -530,7 +530,7 @@
        var body = {title:'Nouvelle conversation'};
        if(self.llmProvider) body.provider = self.llmProvider;
        if(self.llmModel) body.model = self.llmModel;
-        fetch('/api/agent/conversations', {method:'POST', headers:{'X-CSRF-Token': (document.cookie.match(/csrf_token=([^;]+)/)||[])[1]||'', 'Content-Type':'application/json'}, body: JSON.stringify(body)})
+        fetch('/api/agent/conversations', {method:'POST', headers:{'X-CSRF-Token': getCsrf(), 'Content-Type':'application/json'}, body: JSON.stringify(body)})
          .then(function(r){return r.json()}).then(function(d){
            var conv = {id:d.id, title:d.title, updated_at:new Date().toISOString()};
            self.conversations.unshift(conv); self.currentConv = conv;
@@ -547,7 +547,7 @@
        if(self.llmProvider) body.provider = self.llmProvider;
        if(self.llmModel) body.model = self.llmModel;
        self._ensuring = fetch('/api/agent/conversations', {
-          method:'POST', headers:{'X-CSRF-Token': (document.cookie.match(/csrf_token=([^;]+)/)||[])[1]||'', 'Content-Type':'application/json'}, body: JSON.stringify(body)
+          method:'POST', headers:{'X-CSRF-Token': getCsrf(), 'Content-Type':'application/json'}, body: JSON.stringify(body)
        }).then(function(r){return r.json()}).then(function(d){
          var conv = {id:d.id, title:d.title, updated_at:new Date().toISOString()};
          self.conversations.unshift(conv); self.currentConv = conv;
@@ -569,7 +569,7 @@
        if(self.llmProvider) body.provider = self.llmProvider;
        if(self.llmModel) body.model = self.llmModel;
        fetch('/api/agent/conversations/'+self.currentConv.id, {
-          method:'PATCH', headers:{'X-CSRF-Token': (document.cookie.match(/csrf_token=([^;]+)/)||[])[1]||'', 'Content-Type':'application/json'}, body: JSON.stringify(body)
+          method:'PATCH', headers:{'X-CSRF-Token': getCsrf(), 'Content-Type':'application/json'}, body: JSON.stringify(body)
        }).catch(function(){});
      },

@@ -1370,7 +1370,7 @@
        if(m.id && /^\d+$/.test(String(m.id))) payload.message_id = Number(m.id);
        fetch('/api/agent/feedback', {
          method: 'POST',
-          headers: {'X-CSRF-Token': (document.cookie.match(/csrf_token=([^;]+)/)||[])[1]||'', 'Content-Type': 'application/json'},
+          headers: {'X-CSRF-Token': getCsrf(), 'Content-Type': 'application/json'},
          body: JSON.stringify(payload)
        }).then(function(r){ return r.json(); }).then(function(d){
          if(d && d.status === 'recorded'){ m.fb = rating; }
@@ -1468,7 +1468,7 @@

        return fetch('/api/agent/conversations/'+self.currentConv.id+'/run', {
          method:'POST',
-          headers:{'X-CSRF-Token': (document.cookie.match(/csrf_token=([^;]+)/)||[])[1]||'', 'Content-Type':'application/json'},
+          headers:{'X-CSRF-Token': getCsrf(), 'Content-Type':'application/json'},
          body: JSON.stringify(payload)
        }).then(function(resp){
          if(!resp.ok){ return resp.json().then(function(j){ throw new Error(j.detail || ('HTTP '+resp.status)); }); }
@@ -94,10 +94,10 @@ const BD=(()=>{try{const el=document.getElementById('bd-config');return el?JSON.
      title: '', status: 'todo',
      create() {
        if (!this.title.trim()) return;
-        const csrf = document.cookie.match(/csrf_token=([^;]+)/);
+        const csrf = getCsrf();;
        fetch(`/api/issues/${owner}/${repo}?title=${encodeURIComponent(this.title)}&labels=${this.status}`, {
          method: 'POST',
-          headers: { 'X-CSRF-Token': csrf ? csrf[1] : '' }
+          headers: { 'X-CSRF-Token': csrf }
        })
          .then(r => r.json())
          .then(data => {
@@ -131,10 +131,10 @@ const BD=(()=>{try{const el=document.getElementById('bd-config');return el?JSON.
          onEnd: function(evt) {
            const cardId = evt.item.dataset.cardId;
            const toStatus = evt.to.dataset.status;
-            const csrf = document.cookie.match(/csrf_token=([^;]+)/);
+            const csrf = getCsrf();;
            fetch(`/api/move?owner=${owner}&repo=${repo}&issue_id=${cardId}&column=${toStatus}`, {
              method: 'POST',
-              headers: { 'X-CSRF-Token': csrf ? csrf[1] : '' }
+              headers: { 'X-CSRF-Token': csrf }
            })
              .then(() => {
                // ponytail: refresh current view after move
@@ -57,7 +57,6 @@ const DB_CONFIG=(()=>{try{const el=document.getElementById('db-config');const v=
        var found = parseOpts(prop).filter(function(o){ return o.name === name; })[0];
        return (found && PALETTE[found.color]) || '#8b8b8b';
    }
-    function getCsrf() { var m = document.cookie.match(/csrf_token=([^;]+)/); return m ? m[1] : ''; }
    function toast(msg, kind) {
        if (typeof window.showToast === 'function') window.showToast(msg, kind);
        else if (kind === 'error') console.warn(msg);
@@ -98,7 +98,7 @@ document.addEventListener('alpine:init', () => {
      var newPath = oldPath.replace(/[^/]+$/, newName.trim());
      fetch('/api/gitea/projects/' + this.owner + '/' + this.repo + '/file', {
        method: 'PUT',
-        headers: {'X-CSRF-Token': (document.cookie.match(/csrf_token=([^;]+)/)||[])[1]||'',  'Content-Type': 'application/json' },
+        headers: {'X-CSRF-Token': getCsrf(),  'Content-Type': 'application/json' },
        body: JSON.stringify({ path: oldPath, new_path: newPath, message: 'Rename ' + oldPath + ' to ' + newPath })
      }).then(function(r){ return r.json(); })
        .then(function(d){
@@ -113,7 +113,7 @@ document.addEventListener('alpine:init', () => {
      if (!item) return;
      if (!confirm('Delete ' + item.name + '?')) return;
      var self = this;
-      fetch('/api/gitea/projects/' + this.owner + '/' + this.repo + '/file?path=' + encodeURIComponent(item.path) + '&sha=' + (item.sha || '') + '&message=Delete ' + item.path, {headers: {'X-CSRF-Token': (document.cookie.match(/csrf_token=([^;]+)/)||[])[1]||''}, 
+      fetch('/api/gitea/projects/' + this.owner + '/' + this.repo + '/file?path=' + encodeURIComponent(item.path) + '&sha=' + (item.sha || '') + '&message=Delete ' + item.path, {headers: {'X-CSRF-Token': getCsrf()}, 
        method: 'DELETE'
      }).then(function(r){
        if (r.ok) { self.refreshTree(); }
@@ -208,7 +208,7 @@ document.addEventListener('alpine:init', () => {
        if (!path) return;
        if (!confirm('Delete ' + path + ' from ' + self.owner + '/' + self.repo + '?')) return;
        var sha = el.getAttribute('data-gitea-sha') || '';
-        fetch('/api/gitea/projects/' + self.owner + '/' + self.repo + '/file?path=' + encodeURIComponent(path) + '&sha=' + encodeURIComponent(sha) + '&message=' + encodeURIComponent('Delete via FlowDeck'), {headers: {'X-CSRF-Token': (document.cookie.match(/csrf_token=([^;]+)/)||[])[1]||''}, 
+        fetch('/api/gitea/projects/' + self.owner + '/' + self.repo + '/file?path=' + encodeURIComponent(path) + '&sha=' + encodeURIComponent(sha) + '&message=' + encodeURIComponent('Delete via FlowDeck'), {headers: {'X-CSRF-Token': getCsrf()}, 
          method: 'DELETE',
        }).then(function(r) {
          if (r.ok) self.refreshTree();
@@ -350,7 +350,7 @@ document.addEventListener('alpine:init', () => {
      if (!this.filePath) return;
      if (!confirm('Delete ' + this.filePath + ' from ' + this.owner + '/' + this.repo + '?')) return;
      try {
-        var r = await fetch('/api/gitea/projects/' + this.owner + '/' + this.repo + '/file?path=' + encodeURIComponent(this.filePath) + '&sha=' + encodeURIComponent(this.fileSha) + '&message=' + encodeURIComponent('Delete via FlowDeck'), {headers: {'X-CSRF-Token': (document.cookie.match(/csrf_token=([^;]+)/)||[])[1]||''}, 
+        var r = await fetch('/api/gitea/projects/' + this.owner + '/' + this.repo + '/file?path=' + encodeURIComponent(this.filePath) + '&sha=' + encodeURIComponent(this.fileSha) + '&message=' + encodeURIComponent('Delete via FlowDeck'), {headers: {'X-CSRF-Token': getCsrf()}, 
          method: 'DELETE',
        });
        if (r.ok) {
@@ -363,8 +363,8 @@ function libraryPage() {
    },

    _getCsrf() {
-      var m = document.cookie.match(/csrf_token=([^;]+)/);
-      return m ? m[1] : '';
+      var m = getCsrf();;
+      return m;
    },

    _syncSidebar() {
@@ -740,7 +740,7 @@ function libraryPage() {
      var item = store && store.node;
      if (!item) return;
      var self = this;
-      fetch('/api/local-workspace/items/' + item.id + '/tags/' + tagId, {headers: {'X-CSRF-Token': (document.cookie.match(/csrf_token=([^;]+)/)||[])[1]||''},  method: 'DELETE' })
+      fetch('/api/local-workspace/items/' + item.id + '/tags/' + tagId, {headers: {'X-CSRF-Token': getCsrf()},  method: 'DELETE' })
        .then(function(r) {
          if (!r.ok) return;
          item.tags = (item.tags || []).filter(function(t) { return t.id !== tagId; });
@@ -760,7 +760,7 @@ function libraryPage() {
      try {
        var r = await fetch('/api/local-workspace/items/' + item.id + '/tags', {
          method: 'POST',
-          headers: {'Content-Type': 'application/json', 'X-CSRF-Token': (document.cookie.match(/csrf_token=([^;]+)/)||[])[1]||''},
+          headers: {'Content-Type': 'application/json', 'X-CSRF-Token': getCsrf()},
          body: JSON.stringify({name: tagName, color: color})
        });
        if (r.ok) {
@@ -300,7 +300,7 @@ window._wsInitData = (function() {
      var self = this;
      // Soft-delete all selected items
      for (var i=0; i<ids.length; i++) {
-        await fetch('/api/local-workspace/items/' + ids[i], {headers: {'X-CSRF-Token': (document.cookie.match(/csrf_token=([^;]+)/)||[])[1]||''},  method: 'DELETE' });
+        await fetch('/api/local-workspace/items/' + ids[i], {headers: {'X-CSRF-Token': getCsrf()},  method: 'DELETE' });
      }
      this.clearSelection();
      this._reloadAfterAction();
@@ -643,7 +643,7 @@ window._wsInitData = (function() {
        var r = await fetch('/board/api/pages/' + node.id + '/icon', {
          method: 'POST',
          headers: {'Content-Type': 'application/json',
-                    'X-CSRF-Token': (document.cookie.match(/csrf_token=([^;]+)/) || [])[1] || ''},
+                    'X-CSRF-Token': getCsrf()},
          body: JSON.stringify({icon: icon})
        });
        if (!r.ok) throw new Error('icon update failed');
@@ -725,7 +725,7 @@ window._wsInitData = (function() {
      color = color || (store && store.newTagColor) || '#787774';
      try {
        var r = await fetch('/api/local-workspace/items/' + node.id + '/tags', {
-          method: 'POST', headers: {'X-CSRF-Token': (document.cookie.match(/csrf_token=([^;]+)/)||[])[1]||'', 'Content-Type':'application/json'},
+          method: 'POST', headers: {'X-CSRF-Token': getCsrf(), 'Content-Type':'application/json'},
          body: JSON.stringify({name: tagName, color: color})
        });
        if (r.ok) {
@@ -862,7 +862,7 @@ window._wsInitData = (function() {
      if (!newName) return;
      try {
        var r = await fetch('/api/local-workspace/items/' + id, {
-          method: 'PUT', headers: {'X-CSRF-Token': (document.cookie.match(/csrf_token=([^;]+)/)||[])[1]||'', 'Content-Type':'application/json'},
+          method: 'PUT', headers: {'X-CSRF-Token': getCsrf(), 'Content-Type':'application/json'},
          body: JSON.stringify({name: newName})
        });
        if (r.ok) {
@@ -1042,7 +1042,7 @@ window._wsInitData = (function() {
      this.renamingId = null;
      if (!n || n === node.name) return;
      var r = await fetch('/api/local-workspace/items/' + node.id, {
-        method: 'PUT', headers: {'X-CSRF-Token': (document.cookie.match(/csrf_token=([^;]+)/)||[])[1]||'', 'Content-Type':'application/json'},
+        method: 'PUT', headers: {'X-CSRF-Token': getCsrf(), 'Content-Type':'application/json'},
        body: JSON.stringify({name: n})
      });
      if (r.ok) {
@@ -1096,7 +1096,7 @@ window._wsInitData = (function() {
        var targetId = this.currentFolder > 0 ? this.currentFolder : null;
        this.clipboard.forEach(function(id) {
          fetch('/api/local-workspace/items/' + id + '/move', {
-            method: 'PUT', headers: {'X-CSRF-Token': (document.cookie.match(/csrf_token=([^;]+)/)||[])[1]||'', 'Content-Type':'application/json'},
+            method: 'PUT', headers: {'X-CSRF-Token': getCsrf(), 'Content-Type':'application/json'},
            body: JSON.stringify({parent_id: targetId})
          }).then(function(r) { if (r.ok) self._reloadAfterAction(); });
        });
@@ -1107,7 +1107,7 @@ window._wsInitData = (function() {
    // ── Duplicate ──
    async duplicateItem(node) {
      var r = await fetch('/api/local-workspace/items', {
-        method: 'POST', headers: {'X-CSRF-Token': (document.cookie.match(/csrf_token=([^;]+)/)||[])[1]||'', 'Content-Type':'application/json'},
+        method: 'POST', headers: {'X-CSRF-Token': getCsrf(), 'Content-Type':'application/json'},
        body: JSON.stringify({name: node.name + ' (copy)', type: node.type || 'page',
          parent_id: this.currentFolder > 0 ? this.currentFolder : null})
      });
@@ -1135,7 +1135,7 @@ window._wsInitData = (function() {
      this.undoMessage = 'Deleted "' + (node.name || 'item') + '"';
      this.undoVisible = true;
      // Delete via API
-      var r = await fetch('/api/local-workspace/items/' + this.undoItemId, {headers: {'X-CSRF-Token': (document.cookie.match(/csrf_token=([^;]+)/)||[])[1]||''},  method:'DELETE' });
+      var r = await fetch('/api/local-workspace/items/' + this.undoItemId, {headers: {'X-CSRF-Token': getCsrf()},  method:'DELETE' });
      if (!r.ok) { this.undoVisible = false; return; }
      // Reload from API for reliability (sidebar refresh handled by _reloadAfterAction)
      this._reloadAfterAction();
@@ -1159,7 +1159,7 @@ window._wsInitData = (function() {
          self._reloadAfterAction();
          return;
        }
-        fetch('/api/local-workspace/items/' + ids[i] + '/restore', {headers: {'X-CSRF-Token': (document.cookie.match(/csrf_token=([^;]+)/)||[])[1]||''},  method: 'POST' })
+        fetch('/api/local-workspace/items/' + ids[i] + '/restore', {headers: {'X-CSRF-Token': getCsrf()},  method: 'POST' })
          .finally(function() { restoreOne(i + 1); });
      }
      restoreOne(0);
@@ -1455,7 +1455,7 @@ window._wsInitData = (function() {
      if (this.parentFolder) body.parent_id = this.parentFolder.db_id;
      var r = await fetch('/api/local-workspace/items', {
        method:'POST',
-        headers:{'X-CSRF-Token': (document.cookie.match(/csrf_token=([^;]+)/)||[])[1]||'', 'Content-Type':'application/json'},
+        headers:{'X-CSRF-Token': getCsrf(), 'Content-Type':'application/json'},
        body:JSON.stringify(body)
      });
      if (r.ok) {
@@ -1539,7 +1539,7 @@ window._wsInitData = (function() {
      if (!n||!this.target) return;
      var r = await fetch('/api/local-workspace/items/'+this.target.db_id, {
        method:'PUT',
-        headers:{'X-CSRF-Token': (document.cookie.match(/csrf_token=([^;]+)/)||[])[1]||'', 'Content-Type':'application/json'},
+        headers:{'X-CSRF-Token': getCsrf(), 'Content-Type':'application/json'},
        body:JSON.stringify({name:n})
      });
      if (r.ok) { this._reloadAfterAction(); }
@@ -1552,7 +1552,7 @@ window._wsInitData = (function() {

    async doDelete() {
      if (!this.target) return;
-      var r = await fetch('/api/local-workspace/items/'+this.target.db_id, {headers: {'X-CSRF-Token': (document.cookie.match(/csrf_token=([^;]+)/)||[])[1]||''},  method:'DELETE' });
+      var r = await fetch('/api/local-workspace/items/'+this.target.db_id, {headers: {'X-CSRF-Token': getCsrf()},  method:'DELETE' });
      if (r.ok) { this._reloadAfterAction(); }
    },

@@ -1739,7 +1739,7 @@ window._wsInitData = (function() {
      try {
        var r = await fetch('/api/local-workspace/items/' + itemId + '/move', {
          method: 'PUT',
-          headers: {'X-CSRF-Token': (document.cookie.match(/csrf_token=([^;]+)/)||[])[1]||'',  'Content-Type': 'application/json' },
+          headers: {'X-CSRF-Token': getCsrf(),  'Content-Type': 'application/json' },
          body: JSON.stringify(body)
        });
        if (r.ok) {
@@ -1834,7 +1834,7 @@ window._wsInitData = (function() {
      try {
        var r = await fetch('/api/local-workspace/items/' + itemId + '/tags', {
          method: 'POST',
-          headers: {'X-CSRF-Token': (document.cookie.match(/csrf_token=([^;]+)/)||[])[1]||'', 'Content-Type': 'application/json'},
+          headers: {'X-CSRF-Token': getCsrf(), 'Content-Type': 'application/json'},
          body: JSON.stringify({name: tagName})
        });
        if (r.ok) {
@@ -1853,7 +1853,7 @@ window._wsInitData = (function() {

    async removeTag(itemId, tagId) {
      try {
-        var r = await fetch('/api/local-workspace/items/' + itemId + '/tags/' + tagId, {headers: {'X-CSRF-Token': (document.cookie.match(/csrf_token=([^;]+)/)||[])[1]||''}, 
+        var r = await fetch('/api/local-workspace/items/' + itemId + '/tags/' + tagId, {headers: {'X-CSRF-Token': getCsrf()}, 
          method: 'DELETE'
        });
        if (r.ok) {
@@ -1999,7 +1999,7 @@ window._wsInitData = (function() {
        try {
          await fetch('/api/local-workspace/items/' + ids[i] + '/move', {
            method: 'PUT',
-            headers: {'X-CSRF-Token': (document.cookie.match(/csrf_token=([^;]+)/)||[])[1]||'', 'Content-Type':'application/json'},
+            headers: {'X-CSRF-Token': getCsrf(), 'Content-Type':'application/json'},
            body: JSON.stringify({ parent_id: parentId || null })
          });
        } catch { /* volontaire */ }
@@ -1499,7 +1499,7 @@ replaceBlock(idx,type){const b=this.blocks[idx];if(!b)return;this.sync();this.pu
        cutSelectedBlocks(){const indices=_selIndicesSorted();if(!indices.length)return;this.sync();this.pushHistory();const selected=indices.map(i=>this.blocks[i]).filter(Boolean);if(!selected.length)return;const md=this._blocksToMarkdown(selected);if(navigator.clipboard&&navigator.clipboard.writeText){navigator.clipboard.writeText(md).then(()=>{});}this.blocks=this.blocks.filter((b,i)=>indices.indexOf(i)<0);if(!this.blocks.length)this.blocks=[this.mkB('paragraph','')];this.dirty=true;this.autoSave();this.render();_rtSync();_selClear();this.showToast('Blocs coupés');},
        async pasteBlocks(){const idx=this._focusedIdx();if(idx<0)return;try{const text=await navigator.clipboard.readText();if(!text||!text.trim())return;const parsed=this.md2b(text);if(!parsed.length)return;this.sync();this.pushHistory();this.blocks.splice(idx+1,0,...parsed);this.dirty=true;this.autoSave();this.render();_rtSync();this._focusBid(parsed[parsed.length-1].id);_selClear();}catch(e){if(e.name==='NotAllowedError'){this.showToast('Permission presse-papier refusée');}else{this.showToast('Coller impossible','error');}}},
        _focusedIdx(){const a=this.getActiveBlock();return a?a.idx:-1;},
-        async moveBlockToPage(idx,pageId){if(idx<0||idx>=this.blocks.length||pageId===this.pid)return;this.sync();this.pushHistory();const block=this.blocks[idx];const self=this;const csrf=document.cookie.match(/csrf_token=([^;]+)/);this.showToast('Déplacement du bloc…');try{const r=await fetch(`/board/api/pages/${pageId}`,{credentials:'same-origin'});const d=await r.json();let tblocks=[];if(d.content_format==='blocks'&&d.content){try{tblocks=JSON.parse(d.content);}catch(e){tblocks=[];}}tblocks.push(block);await fetch(`/board/api/pages/${pageId}/blocks`,{method:'POST',headers:{'Content-Type':'application/json','X-CSRF-Token':csrf?csrf[1]:''},body:JSON.stringify({title:d.title||'',blocks:tblocks})});
+        async moveBlockToPage(idx,pageId){if(idx<0||idx>=this.blocks.length||pageId===this.pid)return;this.sync();this.pushHistory();const block=this.blocks[idx];const self=this;const csrf = getCsrf();;this.showToast('Déplacement du bloc…');try{const r=await fetch(`/board/api/pages/${pageId}`,{credentials:'same-origin'});const d=await r.json();let tblocks=[];if(d.content_format==='blocks'&&d.content){try{tblocks=JSON.parse(d.content);}catch(e){tblocks=[];}}tblocks.push(block);await fetch(`/board/api/pages/${pageId}/blocks`,{method:'POST',headers:{'Content-Type':'application/json','X-CSRF-Token':csrf},body:JSON.stringify({title:d.title||'',blocks:tblocks})});
          if(this.blocks.length<=1){this.blocks[0]=this.mkB('paragraph','');}else{this.blocks.splice(idx,1);}this.dirty=true;this.autoSave();this.render();_rtSync();_selClear();this.showToast('Bloc déplacé');
        }catch(e){this.showToast('Échec du déplacement','error');}},

@@ -1585,9 +1585,9 @@ applyAIBlocks(text){
        },

        toggleFavorite(){
-          const csrf=document.cookie.match(/csrf_token=([^;]+)/);
+          const csrf = getCsrf();;
          const m=this.favorited?'DELETE':'POST';
-          fetch(`/board/api/favorites/${this.pid}`,{method:m,headers:{'X-CSRF-Token':csrf?csrf[1]:''}})
+          fetch(`/board/api/favorites/${this.pid}`,{method:m,headers:{'X-CSRF-Token':csrf}})
            .then(r=>r.json()).then(()=>{this.favorited=!this.favorited;this.showToast(this.favorited?'Added to favorites':'Removed from favorites');
              if(window.appState&&window.appState.refreshFavorites)window.appState.refreshFavorites();
            }).catch(()=>{this.showToast('Failed to toggle favorite');});
@@ -1608,8 +1608,8 @@ applyAIBlocks(text){
        _syncIsShared(){this.pageIsShared=!!(this.pagePublished||this.generalAccess==='anyone'||(this.accessList||[]).length>0);},
        togglePublish(){this.pagePublished=!this.pagePublished;this._syncIsShared();this.saveShare();},
        saveShare(){
-          const csrf=document.cookie.match(/csrf_token=([^;]+)/);
-          fetch(`/board/api/share/${this.pid}`,{method:'POST',headers:{'Content-Type':'application/json','X-CSRF-Token':csrf?csrf[1]:''},body:JSON.stringify({mode:this.generalAccess,published:this.pagePublished})}).then(()=>this._syncIsShared()).catch(()=>{});
+          const csrf = getCsrf();;
+          fetch(`/board/api/share/${this.pid}`,{method:'POST',headers:{'Content-Type':'application/json','X-CSRF-Token':csrf},body:JSON.stringify({mode:this.generalAccess,published:this.pagePublished})}).then(()=>this._syncIsShared()).catch(()=>{});
        },
        async copyPageLink(){
          console.log('copyPageLink invoked');
@@ -1632,10 +1632,10 @@ applyAIBlocks(text){
        },
        publishPage() {
          var self = this;
-          var csrf = document.cookie.match(/csrf_token=([^;]+)/);
+          var csrf = getCsrf();;
          fetch('/api/pages/' + this.pid + '/publish', {
            method: 'POST',
-            headers: { 'Content-Type': 'application/json', 'X-CSRF-Token': csrf ? csrf[1] : '' }
+            headers: { 'Content-Type': 'application/json', 'X-CSRF-Token': csrf }
          }).then(function(r){ return r.json(); }).then(function(d){
            if (d.is_published) {
              self.pagePublished = true;
@@ -1648,10 +1648,10 @@ applyAIBlocks(text){
        },
        unpublishPage() {
          var self = this;
-          var csrf = document.cookie.match(/csrf_token=([^;]+)/);
+          var csrf = getCsrf();;
          fetch('/api/pages/' + this.pid + '/publish', {
            method: 'DELETE',
-            headers: { 'X-CSRF-Token': csrf ? csrf[1] : '' }
+            headers: { 'X-CSRF-Token': csrf }
          }).then(function(r){ return r.json(); }).then(function(d){
            if (!d.is_published) {
              self.pagePublished = false;
@@ -1665,10 +1665,10 @@ applyAIBlocks(text){
        shareInvite() {
          var self = this;
          if (this.inviteGroupId) {
-            var csrf = document.cookie.match(/csrf_token=([^;]+)/);
+            var csrf = getCsrf();;
            fetch('/api/pages/' + this.pid + '/share', {
              method: 'POST',
-              headers: { 'Content-Type': 'application/json', 'X-CSRF-Token': csrf ? csrf[1] : '' },
+              headers: { 'Content-Type': 'application/json', 'X-CSRF-Token': csrf },
              body: JSON.stringify({ group_id: this.inviteGroupId, permission: this.invitePermission })
            }).then(function(r){ return r.json(); }).then(function(d){
              if (d.status === 'shared') {
@@ -1680,10 +1680,10 @@ applyAIBlocks(text){
            return;
          }
          if (!this.inviteEmail.trim()) return;
-          var csrf2 = document.cookie.match(/csrf_token=([^;]+)/);
+          var csrf2 = getCsrf();;
          fetch('/api/pages/' + this.pid + '/share', {
            method: 'POST',
-            headers: { 'Content-Type': 'application/json', 'X-CSRF-Token': csrf2 ? csrf2[1] : '' },
+            headers: { 'Content-Type': 'application/json', 'X-CSRF-Token': csrf2 },
            body: JSON.stringify({ user_id: this.inviteUserId, email: this.inviteEmail.trim(), permission: this.invitePermission })
          }).then(function(r){ return r.json(); }).then(function(d){
            if (d.status === 'shared') {
@@ -1760,10 +1760,10 @@ applyAIBlocks(text){
        },
        updateShare(sid, perm) {
          var self = this;
-          var csrf = document.cookie.match(/csrf_token=([^;]+)/);
+          var csrf = getCsrf();;
          fetch('/api/pages/' + this.pid + '/share/' + sid, {
            method: 'PUT',
-            headers: { 'Content-Type': 'application/json', 'X-CSRF-Token': csrf ? csrf[1] : '' },
+            headers: { 'Content-Type': 'application/json', 'X-CSRF-Token': csrf },
            body: JSON.stringify({ permission: perm })
          }).then(function(r){ return r.json(); }).then(function(d){
            self.showToast(d.status === 'updated' ? 'Permission updated' : (d.detail || 'Update failed'));
@@ -1779,10 +1779,10 @@ applyAIBlocks(text){
        },
        removeShare(sid) {
          var self = this;
-          var csrf = document.cookie.match(/csrf_token=([^;]+)/);
+          var csrf = getCsrf();;
          fetch('/api/pages/' + this.pid + '/share/' + sid, {
            method: 'DELETE',
-            headers: { 'X-CSRF-Token': csrf ? csrf[1] : '' }
+            headers: { 'X-CSRF-Token': csrf }
          }).then(function(r){ return r.json(); }).then(function(d){
            if (d.status === 'removed') { self.showToast('Share removed'); self.loadShares(); }
            else { self.showToast(d.detail || 'Remove failed'); }
@@ -1794,7 +1794,7 @@ applyAIBlocks(text){
          this.moreOpen=false;
          this.exportOpen=false;
          // Ensure latest blocks are persisted before exporting any format
-          var csrf = document.cookie.match(/csrf_token=([^;]+)/);
+          var csrf = getCsrf();;
          var self = this;
          var doDownload = function(){
            var title = encodeURIComponent((self.pageTitle || 'Untitled').trim() || 'Untitled');
@@ -1813,7 +1813,7 @@ applyAIBlocks(text){
            doDownload();
          }
        },
-        duplicatePage(){this.moreOpen=false;const csrf=document.cookie.match(/csrf_token=([^;]+)/);const t=(this.pageTitle||'').trim()||'New Page';fetch(`/board/api/pages?title=${encodeURIComponent(t+' copy')}&section=Private&project=${encodeURIComponent(PD.workspace_key||'')}`,{method:'POST',headers:{'X-CSRF-Token':csrf?csrf[1]:''}}).then(r=>r.json()).then(d=>{window.location.href=`/pages/${d.id}`;}).catch(()=>{window.showToast('Duplicate failed','error');});},
+        duplicatePage(){this.moreOpen=false;const csrf = getCsrf();;const t=(this.pageTitle||'').trim()||'New Page';fetch(`/board/api/pages?title=${encodeURIComponent(t+' copy')}&section=Private&project=${encodeURIComponent(PD.workspace_key||'')}`,{method:'POST',headers:{'X-CSRF-Token':csrf}}).then(r=>r.json()).then(d=>{window.location.href=`/pages/${d.id}`;}).catch(()=>{window.showToast('Duplicate failed','error');});},
        movePage(){
          this.moreOpen=false;
          this.moveOpen = true;
@@ -1829,11 +1829,11 @@ applyAIBlocks(text){
        },
        doMove(wsId) {
          this.moveOpen = false;
-          var csrf = document.cookie.match(/csrf_token=([^;]+)/);
+          var csrf = getCsrf();;
          var self = this;
          fetch('/board/api/pages/' + this.pid + '/move', {
            method: 'PUT',
-            headers: { 'Content-Type': 'application/json', 'X-CSRF-Token': csrf ? csrf[1] : '' },
+            headers: { 'Content-Type': 'application/json', 'X-CSRF-Token': csrf },
            body: JSON.stringify({ workspace_id: wsId })
          }).then(function(r){ return r.json(); })
            .then(function(d){
@@ -1846,7 +1846,7 @@ applyAIBlocks(text){
            })
            .catch(function(){ self.showToast('Move failed'); });
        },
-        deletePage(){this.moreOpen=false;if(!confirm('Move to Trash?'))return;const csrf=document.cookie.match(/csrf_token=([^;]+)/);fetch(`/board/api/pages/${this.pid}/trash`,{method:'POST',headers:{'X-CSRF-Token':csrf?csrf[1]:''}}).then(()=>{window.location.href='/';}).catch(()=>{window.showToast('Failed','error');});},
+        deletePage(){this.moreOpen=false;if(!confirm('Move to Trash?'))return;const csrf = getCsrf();;fetch(`/board/api/pages/${this.pid}/trash`,{method:'POST',headers:{'X-CSRF-Token':csrf}}).then(()=>{window.location.href='/';}).catch(()=>{window.showToast('Failed','error');});},
        downloadFile(){this.moreOpen=false;if(!this.fileUrl)return;var a=document.createElement('a');a.href=this.fileUrl;a.download='';document.body.appendChild(a);a.click();document.body.removeChild(a);this.showToast('Download started','success');},
        async copyFileContent(){this.moreOpen=false;if(!this.fileUrl)return;try{var r=await fetch('/api/pages/'+this.pid+'/file-content');var d=await r.json();if(d.ok&&d.content!==undefined){await navigator.clipboard.writeText(d.content);this.showToast('Content copied to clipboard','success');}else{this.showToast('Not a text file','error');}}catch(e){this.showToast('Copy failed','error');}},

@@ -1871,12 +1871,12 @@ applyAIBlocks(text){
        async createDbFromTemplate(tplName){
          const self=this;
          var name = tplName ? (tplName+' — '+new Date().toLocaleDateString('fr-FR')) : 'Database';
-          const csrf=document.cookie.match(/csrf_token=([^;]+)/);
+          const csrf = getCsrf();;
          try{
            const body={name:name, parent_page_id:this.pid};
            if(tplName) body.template=tplName;
            const r=await fetch('/db/inline/api',{
-              method:'POST',headers:{'Content-Type':'application/json','X-CSRF-Token':csrf?csrf[1]:''},
+              method:'POST',headers:{'Content-Type':'application/json','X-CSRF-Token':csrf},
              body:JSON.stringify(body)
            });
            const d=await r.json();
@@ -1896,10 +1896,10 @@ applyAIBlocks(text){
        async createForm(){
          const name=prompt('Form name:','New Form');
          if(!name||!name.trim())return;
-          const csrf=document.cookie.match(/csrf_token=([^;]+)/);
+          const csrf = getCsrf();;
          try{
            const r=await fetch('/db/inline/api',{
-              method:'POST',headers:{'Content-Type':'application/json','X-CSRF-Token':csrf?csrf[1]:''},
+              method:'POST',headers:{'Content-Type':'application/json','X-CSRF-Token':csrf},
              body:JSON.stringify({name:name.trim(),parent_page_id:this.pid})
            });
            const d=await r.json();
@@ -2106,7 +2106,7 @@ applyAIBlocks(text){
        toggleComments(){this.commentsOpen=!this.commentsOpen;if(this.commentsOpen)this.loadComments();},
        async loadComments(){try{const r=await fetch('/api/pages/'+this.pid+'/comments',{credentials:'same-origin'});const d=await r.json();this.comments=d.comments||[];this.commentCount=this.comments.length;}catch(e){this.comments=[];}},
        fmtTime(s){if(!s)return '';const t=new Date((String(s).includes('T')||String(s).includes('Z'))?s:(s+'Z'));if(isNaN(t.getTime()))t=new Date(s);const diff=Math.floor((Date.now()-t.getTime())/1000);if(diff<60)return 'just now';if(diff<3600)return Math.floor(diff/60)+'m ago';if(diff<86400)return Math.floor(diff/3600)+'h ago';return Math.floor(diff/86400)+'d ago';},
-        csrfTok(){return (document.cookie.match(/csrf_token=([^;]+)/)||[])[1]||'';},
+        csrfTok(){return getCsrf();},
        async addPageComment(){
          const text=(this.commentDraft||'').trim();if(!text)return;
          const self=this;const sel=this._commentSel;
@@ -2378,8 +2378,8 @@ applyAIBlocks(text){
              this._fileTitleT=null;
              const title=(this.pageTitle||'').trim();
              if(!title)return;
-              const csrf=document.cookie.match(/csrf_token=([^;]+)/);
-              fetch(`/board/api/pages/${this.pid}?title=${encodeURIComponent(title)}`,{method:'PUT',headers:{'X-CSRF-Token':csrf?csrf[1]:''}})
+              const csrf = getCsrf();;
+              fetch(`/board/api/pages/${this.pid}?title=${encodeURIComponent(title)}`,{method:'PUT',headers:{'X-CSRF-Token':csrf}})
                .then(()=>{this.dirty=false;})
                .catch(()=>{});
            },600);
@@ -2400,8 +2400,8 @@ applyAIBlocks(text){
              .catch(()=>{this.saving=false;});
          };
          if(!navigator.onLine){queueOffline();return;}
-          const csrf=document.cookie.match(/csrf_token=([^;]+)/);
-          fetch(`/board/api/pages/${this.pid}/blocks`,{method:'POST',headers:{'Content-Type':'application/json','X-CSRF-Token':csrf?csrf[1]:''},body:JSON.stringify({title:this.pageTitle,blocks:blocksArr})})
+          const csrf = getCsrf();;
+          fetch(`/board/api/pages/${this.pid}/blocks`,{method:'POST',headers:{'Content-Type':'application/json','X-CSRF-Token':csrf},body:JSON.stringify({title:this.pageTitle,blocks:blocksArr})})
          .then(r=>r.json()).then(()=>{this.saving=false;this.dirty=false;this.lastSaved=new Date().toLocaleTimeString();
            this._syncTitleUI();
            if(cb)cb();
@@ -2411,11 +2411,11 @@ applyAIBlocks(text){
          const idx=this.getIdx(bid);if(idx<0)return;
          const b=this.blocks[idx];
          if(!b.automation_id){this.pickAutomation(bid);return;}
-          const csrf=document.cookie.match(/csrf_token=([^;]+)/);
+          const csrf = getCsrf();;
          const self=this;
          this.showToast('⚡ '+ (b.automation_name||'Automation') + '…');
          fetch('/api/automations/'+b.automation_id+'/run',{method:'POST',
-            headers:{'Content-Type':'application/json','X-CSRF-Token':csrf?csrf[1]:''},
+            headers:{'Content-Type':'application/json','X-CSRF-Token':csrf},
            body:JSON.stringify({page_id:this.pid})})
            .then(r=>r.json())
            .then(d=>{
@@ -146,7 +146,7 @@ function settingsInit() {
        var n = this.newTagName.trim();
        if (!n) return;
        var r = await fetch('/api/settings/tags', {
-          method: 'POST', headers: {'X-CSRF-Token': (document.cookie.match(/csrf_token=([^;]+)/)||[])[1]||'', 'Content-Type':'application/json'},
+          method: 'POST', headers: {'X-CSRF-Token': getCsrf(), 'Content-Type':'application/json'},
          body: JSON.stringify({name: n, color: this.newTagColor})
        });
        if (r.ok) { this.newTagName = ''; this.newTagColor = '#787774'; await this.loadTags(); }
@@ -154,7 +154,7 @@ function settingsInit() {

      async updateTagColor(id, color) {
        await fetch('/api/settings/tags/' + id, {
-          method: 'PUT', headers: {'X-CSRF-Token': (document.cookie.match(/csrf_token=([^;]+)/)||[])[1]||'', 'Content-Type':'application/json'},
+          method: 'PUT', headers: {'X-CSRF-Token': getCsrf(), 'Content-Type':'application/json'},
          body: JSON.stringify({color: color})
        });
        await this.loadTags();
@@ -162,7 +162,7 @@ function settingsInit() {

      async deleteTag(id) {
        if (!confirm('Delete this tag?')) return;
-        await fetch('/api/settings/tags/' + id, {headers: {'X-CSRF-Token': (document.cookie.match(/csrf_token=([^;]+)/)||[])[1]||''},  method: 'DELETE' });
+        await fetch('/api/settings/tags/' + id, {headers: {'X-CSRF-Token': getCsrf()},  method: 'DELETE' });
        await this.loadTags();
      },

@@ -183,7 +183,7 @@ function settingsInit() {
          this.renamingTag = null; return;
        }
        await fetch('/api/settings/tags/' + tag.id, {
-          method: 'PUT', headers: {'Content-Type':'application/json', 'X-CSRF-Token': (document.cookie.match(/csrf_token=([^;]+)/)||[])[1]||''},
+          method: 'PUT', headers: {'Content-Type':'application/json', 'X-CSRF-Token': getCsrf()},
          body: JSON.stringify({name: newName})
        });
        this.renamingTag = null;
@@ -456,7 +456,7 @@ function settingsInit() {
        try {
          var r = await fetch('/api/agent/keys/' + id + '/models', {
            method: 'POST',
-            headers: {'X-CSRF-Token': (document.cookie.match(/csrf_token=([^;]+)/)||[])[1]||'', 'Content-Type':'application/json'},
+            headers: {'X-CSRF-Token': getCsrf(), 'Content-Type':'application/json'},
            body: JSON.stringify({api_key: f.api_key, api_base: f.api_base})
          });
          var d = await r.json();
@@ -485,7 +485,7 @@ function settingsInit() {
          if (f.models && f.models.length) body.models = f.models;
          var r = await fetch('/api/agent/keys/' + id, {
            method: 'PUT',
-            headers: {'X-CSRF-Token': (document.cookie.match(/csrf_token=([^;]+)/)||[])[1]||'', 'Content-Type':'application/json'},
+            headers: {'X-CSRF-Token': getCsrf(), 'Content-Type':'application/json'},
            body: JSON.stringify(body)
          });
          var d = await r.json();
@@ -521,7 +521,7 @@ function settingsInit() {
          if (f.api_key) body.api_key = f.api_key;
          var r = await fetch('/api/agent/keys/' + id + '/test', {
            method: 'POST',
-            headers: {'X-CSRF-Token': (document.cookie.match(/csrf_token=([^;]+)/)||[])[1]||'', 'Content-Type':'application/json'},
+            headers: {'X-CSRF-Token': getCsrf(), 'Content-Type':'application/json'},
            body: JSON.stringify(body)
          });
          var d = await r.json();
@@ -547,7 +547,7 @@ function settingsInit() {
        var f = this.keyForm(id);
        f.deleting = true; f.msg = ''; f.ok = false;
        try {
-          var r = await fetch('/api/agent/keys/' + id, {headers: {'X-CSRF-Token': (document.cookie.match(/csrf_token=([^;]+)/)||[])[1]||''},  method: 'DELETE' });
+          var r = await fetch('/api/agent/keys/' + id, {headers: {'X-CSRF-Token': getCsrf()},  method: 'DELETE' });
          var d = await r.json();
          if (r.ok) {
            f.has_key = false; f.api_key = ''; f.models = []; f.model = ''; f.last_error = '';
@@ -707,7 +707,7 @@ function settingsInit() {
        if (!file) return;
        var form = new FormData();
        form.append('file', file);
-        var r = await fetch('/api/settings/avatar', {headers: {'X-CSRF-Token': (document.cookie.match(/csrf_token=([^;]+)/)||[])[1]||''},  method: 'POST', body: form });
+        var r = await fetch('/api/settings/avatar', {headers: {'X-CSRF-Token': getCsrf()},  method: 'POST', body: form });
        if (r.ok) {
          var d = await r.json();
          this.avatarUrl = d.avatar_url + '?t=' + Date.now();
@@ -718,7 +718,7 @@ function settingsInit() {
      async selectAvatarColor(color) {
        this.avatarColor = color;
        var r = await fetch('/api/settings/avatar-color', {
-          method: 'POST', headers: {'X-CSRF-Token': (document.cookie.match(/csrf_token=([^;]+)/)||[])[1]||'', 'Content-Type':'application/json'},
+          method: 'POST', headers: {'X-CSRF-Token': getCsrf(), 'Content-Type':'application/json'},
          body: JSON.stringify({color: color})
        });
        if (r.ok) { this.avatarUrl = ''; }
@@ -863,7 +863,7 @@ function settingsInit() {
      // ── v5.2.0 API tokens ──
      async loadApiTokens() {
        try {
-          var r = await fetch('/api/settings/tokens', {headers: {'X-CSRF-Token': (document.cookie.match(/csrf_token=([^;]+)/)||[])[1]||''}, credentials:'same-origin'});
+          var r = await fetch('/api/settings/tokens', {headers: {'X-CSRF-Token': getCsrf()}, credentials:'same-origin'});
          var d = await r.json();
          this.apiTokens = d.tokens || [];
        } catch { this.apiTokens = []; }
@@ -873,7 +873,7 @@ function settingsInit() {
        if (!name) return;
        try {
          var r = await fetch('/api/settings/tokens', {method:'POST', credentials:'same-origin',
-            headers: {'X-CSRF-Token': (document.cookie.match(/csrf_token=([^;]+)/)||[])[1]||'', 'Content-Type':'application/json'}, body: JSON.stringify({name: name})});
+            headers: {'X-CSRF-Token': getCsrf(), 'Content-Type':'application/json'}, body: JSON.stringify({name: name})});
          var d = await r.json();
          if (!r.ok) { window.showToast && window.showToast(d.detail || 'Erreur', 'error'); return; }
          this.newToken = d;
@@ -41,7 +41,7 @@ function workspacesPage() {
    },

    async selectLocal(ws) {
-      await fetch(`/api/workspaces/${ws.id}/select`, {headers: {'X-CSRF-Token': (document.cookie.match(/csrf_token=([^;]+)/)||[])[1]||''}, method:'POST'});
+      await fetch(`/api/workspaces/${ws.id}/select`, {headers: {'X-CSRF-Token': getCsrf()}, method:'POST'});
      window.location = '/local-workspace';
    },

@@ -49,7 +49,7 @@ function workspacesPage() {
      if (!this.wsName.trim()) return;
      await fetch('/api/workspaces', {
        method:'POST',
-        headers:{'X-CSRF-Token': (document.cookie.match(/csrf_token=([^;]+)/)||[])[1]||'', 'Content-Type':'application/json'},
+        headers:{'X-CSRF-Token': getCsrf(), 'Content-Type':'application/json'},
        body:JSON.stringify({name:this.wsName.trim()})
      });
      this.wsName = '';
@@ -67,7 +67,7 @@ function workspacesPage() {
      if (!this.wsName.trim()||!this.renameTarget) return;
      await fetch(`/api/workspaces/${this.renameTarget.id}`, {
        method:'PUT',
-        headers:{'X-CSRF-Token': (document.cookie.match(/csrf_token=([^;]+)/)||[])[1]||'', 'Content-Type':'application/json'},
+        headers:{'X-CSRF-Token': getCsrf(), 'Content-Type':'application/json'},
        body:JSON.stringify({name:this.wsName.trim()})
      });
      this.wsName = '';
@@ -78,7 +78,7 @@ function workspacesPage() {

    async deleteWs(ws) {
      if (!confirm(`Delete workspace "${ws.name}" and all its pages?`)) return;
-      await fetch(`/api/workspaces/${ws.id}`, {headers: {'X-CSRF-Token': (document.cookie.match(/csrf_token=([^;]+)/)||[])[1]||''}, method:'DELETE'});
+      await fetch(`/api/workspaces/${ws.id}`, {headers: {'X-CSRF-Token': getCsrf()}, method:'DELETE'});
      await this.load();
    },