From ae0b96485916e9d16c62aad24ba6b3d43cb13cb5 Mon Sep 17 00:00:00 2001 From: bruno Date: Fri, 10 Jul 2026 16:51:00 -0400 Subject: [PATCH] =?UTF-8?q?fix:=20Home=20=E2=86=92=20/workspaces,=20worksp?= =?UTF-8?q?ace=20name=20from=20cookie,=20CRUD=20+=20CSRF?= MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit - Home button now links to /workspaces (universal workspace page) - Sidebar workspace section shows active workspace name from cookie - _sidebar_data reads flowdeck_workspace cookie for active_ws_name - local-workspace APIs filter by workspace_id (not global) - newPageInWorkspace() JS function added to sidebar - CSRF exemption for /api/local-workspace routes --- app/middleware/csrf.py | 2 +- app/routers/board.py | 14 ++++++++++++++ app/routers/dashboard.py | 11 +++++++---- app/templates/base.html | 16 ++++++++++++++-- 4 files changed, 36 insertions(+), 7 deletions(-) diff --git a/app/middleware/csrf.py b/app/middleware/csrf.py index 1ee6fe8..0e43b28 100644 --- a/app/middleware/csrf.py +++ b/app/middleware/csrf.py @@ -16,7 +16,7 @@ class CSRFMiddleware(BaseHTTPMiddleware): """ SAFE_METHODS = {"GET", "HEAD", "OPTIONS"} - EXCLUDED_PATHS = {"/api/webhook", "/api/v1", "/auth/callback", "/auth/register", "/auth/local-login", "/api/user", "/board/api/pages", "/board/api/favorites", "/api/workspace", "/db/", "/workspace"} + EXCLUDED_PATHS = {"/api/webhook", "/api/v1", "/auth/callback", "/auth/register", "/auth/local-login", "/api/user", "/board/api/pages", "/board/api/favorites", "/api/workspace", "/api/local-workspace", "/db/", "/workspace"} async def dispatch(self, request: Request, call_next): # Webhook receiver, OAuth callback, and internal API are exempt diff --git a/app/routers/board.py b/app/routers/board.py index c1e5f3c..c135645 100644 --- a/app/routers/board.py +++ b/app/routers/board.py @@ -144,6 +144,19 @@ def _sidebar_data(request: Request, owner: str = "", repo: str = "") -> dict: user = SessionManager.decode_session(request.cookies.get("flowdeck_session", "")) ws_name = user.get("login", "Bruno") if user else "Bruno" ws_key = f"{owner}/{repo}" if owner and repo else ws_name # workspace = project context + + # Active workspace name from cookie (for local workspace display) + from app.routers.dashboard import WORKSPACE_COOKIE + ws_cookie = request.cookies.get(WORKSPACE_COOKIE, "") + active_ws_name = "Workspace" + if ws_cookie: + try: + with get_conn() as conn: + ws = conn.execute("SELECT name FROM workspaces WHERE id=?", (int(ws_cookie),)).fetchone() + if ws: + active_ws_name = ws["name"] + except (ValueError, Exception): + pass recent = [] if owner and repo: view_map = { @@ -215,6 +228,7 @@ def _sidebar_data(request: Request, owner: str = "", repo: str = "") -> dict: }) return {"workspace_name": ws_name, "workspace_initial": ws_name[0].upper() if ws_name else "B", + "active_ws_name": active_ws_name, "current_page": repo or "Dashboard", "last_edited": "now", "recent_pages": recent, "private_pages": private_items, "favorite_pages": favorites, "shared_pages": shared_pages, diff --git a/app/routers/dashboard.py b/app/routers/dashboard.py index 7e203a3..3674244 100644 --- a/app/routers/dashboard.py +++ b/app/routers/dashboard.py @@ -488,7 +488,7 @@ async def local_workspace_page(request: Request): ).fetchall() items = [{"id": r["id"], "name": r["title"] or "Untitled", "type": "page"} for r in rows] - ctx = {**sidebar, "user": user, "workspace_name": "My Workspace", "items": items} + ctx = {**sidebar, "user": user, "workspace_name": sidebar.get("active_ws_name", "My Workspace"), "items": items} template = env.get_template("local_workspace.html") return template.render(**ctx) @@ -514,14 +514,17 @@ async def local_workspace_tree(request: Request): @router.post("/api/local-workspace/items") async def create_local_workspace_item(request: Request): - """Create a new file.""" + """Create a new file in the active workspace.""" import json body = await request.json() name = body.get("name", "Untitled").strip() + ws = _get_active_workspace(request) + ws_id = ws["id"] if ws else None with get_conn() as conn: cursor = conn.execute( - "INSERT INTO pages (workspace, title, content, content_format, parent_section) VALUES ('', ?, '', 'blocks', 'Private')", - (name,), + "INSERT INTO pages (workspace, workspace_id, title, content, content_format, parent_section) " + "VALUES ('', ?, ?, '', 'blocks', 'Private')", + (ws_id, name), ) conn.commit() pid = cursor.lastrowid diff --git a/app/templates/base.html b/app/templates/base.html index 3e2d3dd..1ec04da 100644 --- a/app/templates/base.html +++ b/app/templates/base.html @@ -62,7 +62,7 @@
- + Home @@ -85,7 +85,7 @@
- 📁 {{ workspace_name or 'Workspace' }} + 📁 {{ active_ws_name or 'Workspace' }}
@@ -625,6 +625,18 @@ .then(data => { window.location.href = `/pages/${data.id}`; }) .catch(err => { alert('Failed to create sub-page: ' + err.message); }); }, + newPageInWorkspace() { + const name = prompt('Page name:'); + if (!name || !name.trim()) return; + fetch('/api/local-workspace/items', { + method: 'POST', + headers: { 'Content-Type': 'application/json', 'X-CSRF-Token': this.getCsrfToken() }, + body: JSON.stringify({ name: name.trim(), type: 'page' }) + }) + .then(r => { if (!r.ok) throw new Error('Failed'); return r.json(); }) + .then(data => { window.location.href = `/pages/${data.id}`; }) + .catch(err => { alert('Failed: ' + err.message); }); + }, createEmptyPage() { this.showNewPageMenu = false;