7 Commits

Include renames

Author	SHA1	Message	Date
bruno	c718fe06de	fix: A20 (partiel) — CSP nonce par requête, unsafe-inline sort de script-src (v7.7.0) ... - ContentSecurityPolicyMiddleware : nonce aléatoire par requête dans la ContextVar `CSP_NONCE` (posée avant `call_next` → visible des templates), `script-src 'self' 'unsafe-eval' 'nonce-…'` — plus aucun script inline sans nonce ne tourne (fin des XSS injectés en JS) - 38 tags `<script>` des templates : `nonce="{{ csp_nonce() }}"` (passage scripté, vérifié : 0 restant) ; `LOCAL_LOGIN_HTML` (constante de module) : helper `_with_nonce()` au rendu ; collections.py : 3 scripts Python (chart/form/map) noncés - `<meta name="htmx-config" content='{"inlineScriptNonce": …}'>` dans base.html : htmx ré-injecte les <script> des réponses boostées avec le bon nonce - `script-src-attr 'unsafe-inline'` : les 74 handlers `onclick=` inline restent couverts (le nonce les aurait désactivés aussi) - chart.js (cdn.jsdelivr.net) et leaflet (unpkg) ajoutés à script-src/style-src : vues chart/map déjà BLOQUÉES par la CSP depuis toujours (commentaire ponytail: upgrade = vendoriser puis retirer les hôtes) - reste d'A20 : unsafe-eval (Alpine x-data → @alpinejs/csp), externalisation JS (A27), resserrer img-src/connect-src test : test_csp_nonce_per_request (page base.html + page hors template, nonce unique par requête) suite **1037/1037** · `ruff check app tests` OK · docs à jour	2026-10-01 10:41:39 -04:00
bruno	9ab47d8113	fix(workspace): menu contextuel après navigation partielle + sync sidebar/header au rename	2026-09-14 18:20:43 -04:00
bruno	da3e09c215	feat(icon): Notion-style icon picker + custom workspace emojis; fix side peek file content & ctx menu overflow	2026-09-12 20:05:53 -04:00
bruno	7a6c66a609	feat: add download + copy file content to context menus and editor ... - Add /api/pages/{id}/download and /api/pages/{id}/file-content endpoints - Add Download + Copy content to shared context menu (_ctx_menu.html) - Wire handlers in local-workspace and library context menus - Add Download + Copy content to editor '...' menu for file pages - Multi-block selection copy/cut/paste with Ctrl+C/X/V shortcuts - Align page title with blocks start (CSS pseudo-element offset)	2026-09-12 12:53:17 -04:00
bruno	881c3e3e0a	feat(library): tags + tag filtering, monochrome icons; fix live tag updates ... - library: expose page tags (batch), render tag chips per row and add a tag filter bar; register tag create/associate/remove in the shared context menu exactly like local-workspace - library: restore monochrome SVG icons (folder/edit/image/file) matching local-workspace, with optional custom page_icon - workspace: refresh tag chips/filter live on tag add/remove (reassign arrays + tagsVersion) instead of requiring a page reload - ctxmenu: measure the rendered menu and clamp it to the viewport on open	2026-09-11 22:33:37 -04:00
bruno	c36082be6a	fix(ctxmenu): repair library rendering and complete unified row menu ... - library.html: remove leftover syntax error + orphan </template></div> that broke libraryPage() (page showed 'undefined' and no files), call the correct fdCtx.openMenu and use self instead of a throwaway libraryPage() instance - _ctx_menu.html: full conventional menu with shortcuts, tags + colour picker, edit-icon picker; closes on outside click and Escape - local_workspace.html: migrate onContextMenu to the shared fdCtx store with complete handlers; drop legacy window._ctxMenuData DOM hacks - dashboard.py: expose page_icon + favorited in the workspace tree	2026-09-11 22:00:54 -04:00
bruno	fbc8d657e7	feat(ctxmenu): unify row context menu via shared partial (_ctx_menu.html) for library+workspace; keep data-cfasync=false on page_editor_scripts	2026-09-11 21:24:01 -04:00