- base.html: inject CSRF token into HTMX hx-headers via inline script
- htmx:configRequest event updates CSRF on every request
- HTMX loaded synchronously (no defer) so config runs before body parsed
- Notes save now works, issue creation works, all POST protected
- dashboard.py: decode session cookie and pass user to template
- notes.py: pass user to template (both GET and POST)
- CSS: .header-right flex layout, #user-info styles, min-height instead of fixed height
- Removed duplicate #user-info CSS block
- Login now properly shows admin/Deconnexion after authentication
1. Refresh button no longer doubles header
- Added ?fragment=1 param to filter/refresh HTMX requests
- Board route returns board_fragment.html (columns only) for fragment requests
- Refresh button uses window.location.reload() for full page reload
2. No more raw JSON in header
- base.html: user info rendered server-side via template variable
- board.py: decodes session cookie, passes user to template
- Dashboard/board templates show Login/Deconnexion based on auth state
3. New issue form works
- Replaced HTMX post with JS fetch (handleNewIssue)
- Adds CSRF token to form submission
- Reloads page on successful creation
- Cleaner error handling
Gitea's /api/v1/user/repos already includes all org repos the user
has access to. Fetching org repos separately added duplicates.
Removed the redundant org-repo loop from dashboard and /api/projects.
Also fixed template to use repo.owner.login instead of _org hack.
bruno