feat(collab): v4.9.0 Collaboration - commentaires inline, mentions @, notifications in-app + email

app/routers/collaboration.py

@@ -0,0 +1,184 @@
+"""FlowDeck — Collaboration API (v4.9.0): inline comments on pages + mentions.
+
+Comments live in the existing `comments` table, extended with a target_type /
+target_id pair and inline anchors (anchor_block_id + text offsets). Mentions
+written in a comment body automatically notify the mentioned users.
+"""
+from __future__ import annotations
+
+import logging
+
+from fastapi import APIRouter, Request, HTTPException
+
+from app.db import get_conn
+from app.auth.session import SessionManager
+from app.services import notifications as notif
+
+logger = logging.getLogger(__name__)
+router = APIRouter(tags=["collaboration"], prefix="/api")
+
+
+def _current_user(request: Request) -> dict:
+    user = SessionManager.decode_session(request.cookies.get("flowdeck_session", ""))
+    if not user or not user.get("id"):
+        raise HTTPException(status_code=401, detail="Authentication required")
+    return user
+
+
+def _page_url(page_id: int) -> str:
+    from app.config import settings
+    return f"{settings.app_base_url}/pages/{page_id}"
+
+
+def _serialize(rows):
+    out = []
+    for r in rows:
+        d = dict(r)
+        d["author"] = {
+            "id": r["author_id"],
+            "login": r["author_login"],
+            "full_name": r["author_name"],
+            "avatar_url": r["author_avatar"],
+            "avatar_color": r["author_color"],
+        }
+        for k in ("author_id", "author_login", "author_name", "author_avatar", "author_color"):
+            d.pop(k, None)
+        out.append(d)
+    return out
+
+
+@router.get("/pages/{page_id}/comments")
+async def list_comments(request: Request, page_id: int):
+    """List page-level and inline comments for a FlowDeck page."""
+    user = _current_user(request)
+    with get_conn() as conn:
+        page = conn.execute("SELECT id, title FROM pages WHERE id=?", (page_id,)).fetchone()
+        if not page:
+            raise HTTPException(404, "Page not found")
+        rows = conn.execute(
+            """SELECT c.*, c.user_id AS author_id, u.login AS author_login,
+                      u.full_name AS author_name, u.avatar_url AS author_avatar,
+                      u.avatar_color AS author_color
+               FROM comments c
+               JOIN users u ON c.user_id = u.id
+               WHERE c.target_type='page' AND c.target_id=?
+               ORDER BY c.created_at ASC, c.id ASC""",
+            (page_id,),
+        ).fetchall()
+    return {"page_id": page_id, "comments": _serialize(rows)}
+
+
+@router.post("/pages/{page_id}/comments")
+async def add_comment(request: Request, page_id: int):
+    """Create a page or inline comment. Mentions (@login) notify users."""
+    user = _current_user(request)
+    body = await request.json() if request.headers.get("content-type") else {}
+    text = (body.get("body") or "").strip()
+    if not text:
+        raise HTTPException(400, "body required")
+
+    anchor_block = body.get("anchor_block_id")
+    anchor_start = body.get("anchor_start")
+    anchor_end = body.get("anchor_end")
+    # normalize empty anchor → page-level comment
+    if not anchor_block or anchor_start is None or anchor_end is None:
+        anchor_block, anchor_start, anchor_end = None, None, None
+    elif int(anchor_start) == int(anchor_end):
+        anchor_block, anchor_start, anchor_end = None, None, None
+
+    parent_id = body.get("parent_id")
+    uid = user["id"]
+    with get_conn() as conn:
+        page = conn.execute("SELECT id, title FROM pages WHERE id=?", (page_id,)).fetchone()
+        if not page:
+            raise HTTPException(404, "Page not found")
+        conn.execute(
+            "INSERT OR IGNORE INTO users (id, login, full_name, is_admin) VALUES (?,?,?,1)",
+            (uid, user.get("login", "admin"), user.get("full_name", "Admin")),
+        )
+        cur = conn.execute(
+            """INSERT INTO comments
+               (page_id, user_id, body, parent_id, target_type, target_id,
+                anchor_block_id, anchor_start, anchor_end)
+               VALUES (?,?,?,?, 'page', ?, ?, ?, ?)""",
+            (page_id, uid, text, parent_id, page_id, anchor_block, anchor_start, anchor_end),
+        )
+        comment_id = cur.lastrowid
+        conn.commit()
+
+        # Notify users @-mentioned in the comment (skip the author).
+        url = _page_url(page_id)
+        title = f"New comment on “{page['title']}”"
+        message = f"{user.get('full_name') or user.get('login')} commented: {text[:300]}"
+        notif.process_mentions(
+            text, uid, "mention", title, message,
+            "page", page_id, url, conn=conn,
+        )
+        conn.commit()
+
+    return {"id": comment_id, "status": "created"}
+
+
+@router.post("/pages/{page_id}/mentions")
+async def notify_page_mentions(request: Request, page_id: int):
+    """Notify users @-mentioned in a page's content (called on save).
+
+    Accepts {"text": "..."} containing @login handles. Deduplicated server-side
+    against a per-page cache so repeated auto-saves don't spam notifications.
+    """
+    user = _current_user(request)
+    body = await request.json() if request.headers.get("content-type") else {}
+    text = body.get("text") or ""
+    with get_conn() as conn:
+        page = conn.execute("SELECT id, title FROM pages WHERE id=?", (page_id,)).fetchone()
+        if not page:
+            raise HTTPException(404, "Page not found")
+        url = _page_url(page_id)
+        mentioned = notif.process_mentions(
+            text, user["id"], "mention", f"You were mentioned in “{page['title']}”",
+            f"{user.get('full_name') or user.get('login')} mentioned you on a page.",
+            "page", page_id, url, conn=conn,
+        )
+        conn.commit()
+    return {"mentioned": mentioned}
+
+
+@router.put("/comments/{comment_id}")
+async def update_comment(request: Request, comment_id: int):
+    """Update a comment body or resolve/unresolve it."""
+    user = _current_user(request)
+    body = await request.json() if request.headers.get("content-type") else {}
+    with get_conn() as conn:
+        row = conn.execute(
+            "SELECT * FROM comments WHERE id=?", (comment_id,)
+        ).fetchone()
+        if not row:
+            raise HTTPException(404, "Comment not found")
+        if row["user_id"] != user["id"]:
+            raise HTTPException(403, "Not allowed to edit this comment")
+        if "body" in body and body.get("body") is not None:
+            conn.execute(
+                "UPDATE comments SET body=?, updated_at=CURRENT_TIMESTAMP WHERE id=?",
+                (body["body"].strip(), comment_id),
+            )
+        if "resolved" in body and body.get("resolved") is not None:
+            conn.execute("UPDATE comments SET resolved=? WHERE id=?",
+                         (1 if body["resolved"] else 0, comment_id))
+        conn.commit()
+    return {"id": comment_id, "status": "updated"}
+
+
+@router.delete("/comments/{comment_id}")
+async def delete_comment(request: Request, comment_id: int):
+    """Delete a comment and its replies."""
+    user = _current_user(request)
+    with get_conn() as conn:
+        row = conn.execute("SELECT * FROM comments WHERE id=?", (comment_id,)).fetchone()
+        if not row:
+            raise HTTPException(404, "Comment not found")
+        if row["user_id"] != user["id"]:
+            # allow page "owners" — fall back to a simple ownership rule for now
+            raise HTTPException(403, "Not allowed to delete this comment")
+        conn.execute("DELETE FROM comments WHERE id=? OR parent_id=?", (comment_id, comment_id))
+        conn.commit()
+    return {"id": comment_id, "status": "deleted"}

app/routers/notifications.py

@@ -0,0 +1,126 @@
+"""FlowDeck — Notifications API (v4.9.0 collaboration)."""
+from __future__ import annotations
+
+import logging
+
+from fastapi import APIRouter, Request, HTTPException
+
+from app.db import get_conn
+from app.auth.session import SessionManager
+
+logger = logging.getLogger(__name__)
+router = APIRouter(tags=["notifications"], prefix="/api/notifications")
+
+
+def _current_user(request: Request) -> dict:
+    user = SessionManager.decode_session(request.cookies.get("flowdeck_session", ""))
+    if not user or not user.get("id"):
+        raise HTTPException(status_code=401, detail="Authentication required")
+    return user
+
+
+@router.get("")
+async def list_notifications(request: Request, limit: int = 50):
+    """List the current user's notifications, newest first."""
+    user = _current_user(request)
+    with get_conn() as conn:
+        rows = conn.execute(
+            """SELECT n.*, a.login AS actor_login, a.full_name AS actor_name,
+                      a.avatar_url AS actor_avatar, a.avatar_color AS actor_color
+               FROM notifications n
+               LEFT JOIN users a ON n.actor_id = a.id
+               WHERE n.user_id=?
+               ORDER BY n.created_at DESC, n.id DESC LIMIT ?""",
+            (user["id"], limit),
+        ).fetchall()
+        unread = conn.execute(
+            "SELECT COUNT(*) AS c FROM notifications WHERE user_id=? AND is_read=0",
+            (user["id"],),
+        ).fetchone()["c"]
+    return {
+        "notifications": [dict(r) for r in rows],
+        "unread": unread,
+    }
+
+
+@router.get("/unread-count")
+async def unread_count(request: Request):
+    """Unread count for the topbar badge."""
+    user = _current_user(request)
+    with get_conn() as conn:
+        c = conn.execute(
+            "SELECT COUNT(*) AS c FROM notifications WHERE user_id=? AND is_read=0",
+            (user["id"],),
+        ).fetchone()["c"]
+    return {"unread": c}
+
+
+@router.post("/read")
+async def mark_read(request: Request):
+    """Mark one notification as read (id) or all (id omitted)."""
+    user = _current_user(request)
+    body = await request.json() if request.headers.get("content-type") else {}
+    nid = body.get("id")
+    with get_conn() as conn:
+        if nid:
+            conn.execute(
+                "UPDATE notifications SET is_read=1 WHERE id=? AND user_id=?",
+                (nid, user["id"]),
+            )
+        else:
+            conn.execute(
+                "UPDATE notifications SET is_read=1 WHERE user_id=?",
+                (user["id"],),
+            )
+        conn.commit()
+    return {"status": "ok"}
+
+
+@router.post("/read-all")
+async def mark_all_read(request: Request):
+    """Mark all notifications as read."""
+    return await mark_read(request)
+
+
+@router.get("/prefs")
+async def get_prefs(request: Request):
+    """Return the current user's notification email preferences."""
+    user = _current_user(request)
+    from app.services import notifications as notif
+    return {"prefs": notif.get_user_prefs(user["id"])}
+
+
+@router.post("/prefs")
+async def set_prefs(request: Request):
+    """Update the current user's notification email preferences."""
+    user = _current_user(request)
+    from app.services import notifications as notif
+    body = await request.json() if request.headers.get("content-type") else {}
+    prefs = notif.get_user_prefs(user["id"])
+    for key in ("comments", "mentions"):
+        if key in body:
+            prefs[key] = bool(body[key])
+    notif.set_user_prefs(user["id"], prefs)
+    return {"status": "ok", "prefs": prefs}
+
+
+@router.get("/users/search")
+async def search_users(request: Request, q: str = ""):
+    """User autocomplete for @mentions."""
+    user = _current_user(request)
+    q = (q or "").strip()
+    with get_conn() as conn:
+        if q:
+            like = f"%{q}%"
+            rows = conn.execute(
+                """SELECT id, login, full_name, avatar_url, avatar_color
+                   FROM users WHERE login LIKE ? OR full_name LIKE ?
+                   ORDER BY (login=? OR full_name=?) DESC, login LIMIT 20""",
+                (like, like, q, q),
+            ).fetchall()
+        else:
+            rows = conn.execute(
+                """SELECT id, login, full_name, avatar_url, avatar_color
+                   FROM users ORDER BY login LIMIT 20"""
+            ).fetchall()
+    return {"users": [dict(r) for r in rows]}