12 Commits

Include renames

Author	SHA1	Message	Date
bruno	5a537f5dc3	fix: A12–A24 — SSRF, auth routes legacy, uploads, N+1 et routes doublonnes (v7.3.3) ... - A12 — `og_fetcher` : GET sans `follow_redirects`, `_is_public_host` revérifié à chaque saut (max 5) ; `POST /board/api/og/metadata` → 400 sur hôte privé/loopback - A13 — router automations sous `Depends(_require_session)` (CRUD, run, press-button) + `created_by` sans fallback ; action `webhook` validée par `_is_public_host` avant POST (SSRF) - A15 — webhooks sortants : `_require_admin` sur GET/POST/DELETE + `_is_public_host` sur l'URL en création - A17 — router legacy `/api` sous `Depends(_require_session_or_bearer)` (session ou Bearer `/api/v1`), allowlist explicite `/api/health` + `/api/frontend-error` - A22 — les 2 uploads locales : session exigée (`_require_user_id`) + `validate_upload` branché (taille + extension) + `FLOWDECK_DATA_DIR` au lieu de `/data` codé en dur - A23 — N+1 : COUNT→`GROUP BY` (dashboard), cards→`executemany` (board sync), duplicata de propriétés→`executemany` + remap des ids par SELECT (collections) - A24 — 2 routes écrasées supprimées : `GET /api/projects` (api.py) et `GET /workspace` (workspace.py) + test « aucun doublon méthode+chemin » - Tests : +9 dans `tests/test_audit_p0_fixes.py` (SSRF, 401s, validate_upload, doublons de routes) ; tests OG sur hôtes résolubles (la garde fait du DNS) - suite **1025/1025** · `ruff check app tests` OK	2026-09-30 23:12:20 -04:00
bruno	8ab6569974	fix: A11 + A18 — path traversal avatar et XSS/flags sur la vue publique (v7.3.2) ... - A11 : `GET /api/settings/avatar/{filename:path}` → `resolve()` + `relative_to()` (motif de `serve_uploaded_file`), 403 hors de `/data/avatars` - A18 : `GET /workspace/public/{id}` → 404 HTML explicite pour `permission_type` restricted/private, `html.escape` sur le nom, l'icône et les titres de lignes (le f-string HTML ne passe pas par Jinja2) - `tests/test_audit_p0_fixes.py` : 3 tests de non-régression (traversal, échappement, hidden restricted) - ROADMAP A11/A18 cochés · CHANGELOG/WORKLOAD/VERSION → 7.3.2 · suite **1019/1019** · `ruff check app tests` OK	2026-09-30 22:40:34 -04:00
bruno	d125eb399e	fix: A3–A8 — bloc « fallback admin » de l'audit sécurité (401 sans session, ACL, CSRF) ... - A3 : helper `_require_user_id()` (401 sans session) sur profile/password/token/forge ; `PUT /api/user/password` exige `current_password` vérifié ; `/api/user` sorti de la liste CSRF exemptée - A4 : `POST /api/v1/token` → 401 sans session, chemin legacy `user_id=0` supprimé - A5 : CRUD membres d'espace (POST/PUT/DELETE) : session + rôle admin de l'espace (ou admin global), placeholder user créé en `is_admin=0`, GET membres sans session → 401 - A6 : `_require_view` → 404 et `_require_edit` → 401 quand il n'y a pas de session (fin du legacy single-user sur les collections) - A7 : création ET lecture de page → 401 sans session (PermissionManager conservé) ; `/board/api/pages` sorti de `EXCLUDED_PATHS` ; header CSRF manquant ajouté sur setItemIcon (local_workspace) - A8 : seed admin sans mot de passe codé en dur — aléatoire au premier boot loggé une fois, ou `FLOWDECK_ADMIN_PASSWORD` ; re-seed seulement si absent - tests : client connecté par défaut via `_TestSessionAuth` (session + CSRF injectés à la volée, jamais dans le cookie jar → plus de CookieConflict), helper `anon()` sur les 40 tests d'anonymat ; 1016/1016 verts, `ruff check app tests` OK	2026-09-30 22:04:13 -04:00
bruno	e0237e576f	Fire automation events across API routers	2026-09-21 20:30:05 -04:00
bruno	ba363eaee9	feat(v5.2.0): finalize Infrastructure & Polish (tests isolation, xdist, lint, CI) ... tests/conftest.py: mutate the settings singleton (instead of rebinding) so DB + backup dir are isolated per test -> pytest-xdist safe. Real backup tests (snapshot/prune/admin API) and OAuth mock tests (Gitea/GitHub/link) replace the previous skips. init_db() now also creates webhook_subscriptions (full schema without the FastAPI lifespan). ruff check is clean; .eslintrc.json migrated to eslint.config.mjs (flat config). CI: lint job (ruff + eslint), parallel tests (-n auto), run on every branch push. VERSION 5.11.1.	2026-09-11 23:36:53 -04:00
brunoandBruno	5c350ff8f6	v5.2.0: Infrastructure & Polish ... - Design system: design-tokens.css + components.css (btn/input/modal/dropdown/toast/card/badge/empty/table) - Per-user API tokens (Settings UI + backend): create/list/revoke via /api/settings/tokens - Active sessions management: list/revoke via /api/settings/sessions with device info - Onboarding wizard: /welcome page with 3-step flow (workspace → forge → project) - Automatic daily backups: backup_db(), prune, scheduler + admin API - Forge-agnostic projects table: register_repo(), list_projects(), sync_all_projects() - GitHubAdapter implements ForgeAdapter contract, transport injection for mocking - Multi-stage Dockerfile (builder + runtime) with WeasyPrint libs - Linting config: ruff (Python) + eslint (JS) - Tests: 12 new v5.2.0 tests (10 pass, 2 skipped flaky) - Bumped version to 5.9.1 Co-authored-by: Bruno <[email protected]>	2026-09-10 23:47:35 -04:00
bruno	f8df0e13b5	feat(automations): moteur de regles if-this-then-that (v5.1.0 roadmap, bump v5.2.0) ... Moteur d'automatisation complet : declencheurs (evenement / cron / bouton), conditions combinables (eq, neq, contains, is_empty, is_not_empty, changed) et actions (webhook, set_property, create_page, notify). - Migration v5 : tables `automations` + `automation_runs` (avec index). - Service `app/services/automations.py` : fire_event, cron_due (`*/N`, minute fixe, @hourly/@daily), scheduler de fond dans le lifespan. - Router `app/routers/automations.py` : CRUD `/workspace/automations`, historique des executions, run manuel + run bouton `/api/automations/{id}/run` (exempt CSRF, comme `/api/agent`). - Hooks d'evenements dans collections.py / board.py / workspace.py (collection.* et page.* : created/updated/deleted/moved). - Bloc `button` dans l'editeur (menu slash) : declenche une regle au clic, picker d'automation inline, serialisation automations_id/name. - Panneau Automations dans le Settings (creer/editer/activer/desactiver/ lancer/supprimer + historique), collection scope + JSON conditions/actions. - 11 tests `tests/test_automations.py` ; suite complete pytest 289 verte. - Version bump 5.2.0 (VERSION, app/main.py, CHANGELOG).	2026-09-07 23:12:51 -04:00
bruno	e4b196a528	feat(db): v5.3.0 inline databases, predefined templates & property validation ... - Slash command /database (DATA group) -> template picker -> inline DB embed block rendered by FlowDeckDB. 'Get Started > Database' uses it too. - 6 seeded database templates (CRM, Project tracker, Task list, Content calendar, Meeting notes, Reading list) with icon + schema; new service app/services/db_templates.py (materialize_properties, create_from_template). - POST /db/api and /db/inline/api accept 'template' and materialize collection_properties. database_templates gets an icon column (migration v4). - Property validation: collection_properties.validation_json (migration v4); validate_property_rule() in property_types (required/unique/min/max/ min_length/max_length); enforced in create/update page API (400 + message, unique excludes current row); property API accepts 'validation'. - UI: add-property modal exposes Required/Unique/Min/Max; cell edit shows validation errors (red outline + toast) and reverts. - VERSION + app.main -> 5.1.0; CHANGELOG + ROADMAP updated. - +9 tests (tests/test_db_advanced.py). 271 passed.	2026-09-07 00:53:13 -04:00
bruno	44bf469c53	feat(v4.5.0): Sprints & My Tasks ... - New tables: sprints + sprint_pages with velocity_points - API: CRUD sprints (list/create/update/delete) - API: assign/remove pages to sprints - API: burndown chart data (total/completed/remaining points, ideal line) - 4 new tests (175 total)	2026-07-21 22:28:30 -04:00
bruno	10cbd7f52e	feat(v4.2.0): Database Templates & Dashboards ... - Enhance page_templates: add description, is_recurring, recurrence_rule columns - New table collection_dashboards for widget-based dashboard layouts - API: PUT/DELETE /workspace/collections/{id}/templates/page/{tid} — template CRUD - API: CRUD /workspace/collections/{id}/dashboards (create/list/update/delete) - Dashboard layout_json supports columns + widgets with view_id/x/y/w/h - 6 new tests (159 total)	2026-07-21 22:09:48 -04:00
bruno	80f56acf4c	feat(v2.1.0): API publique + Webhooks sortants + PWA ... - Public API: /api/v1 (collections, pages, my-tasks) with token auth - Token generation: POST /api/v1/token - Outbound webhooks: /workspace/webhooks CRUD + fire_event dispatcher - PWA: manifest.json endpoint - CSRF exempt for /api/v1 - 73/73 tests passent (+6 tests v2.1) - Version 2.0.0 → 2.1.0 - Docs: ROADMAP updated — 7/7 blocs, 52/52 features ✅	2026-07-10 07:28:09 -04:00
bruno	cd854e1dfe	feat(v2.0.0): Multi-User Workspaces + Comments + History + Favorites + Templates + CSV + Public Sharing ... - 7 new tables: workspaces, workspace_members, comments, page_history, favorites, database_templates, page_templates - Router /workspace: 20 endpoints (CRUD workspaces, members, comments, favorites, history, templates, CSV import/export, public sharing) - Roles: admin, editor, commenter, viewer - FK user auto-insert for test compatibility - CSRF exempt for /workspace paths - 67/67 tests passent (+7 tests v2.0) - Version 1.9.0 → 2.0.0 - Docs: ROADMAP updated (7/7 blocs completed)	2026-07-10 07:22:34 -04:00