Both sidebar and workspace page DnD handlers now use @drop.prevent
to stop browser's default text insertion behavior. Without .prevent,
the browser tries to navigate to the dragged text as a URL, breaking
the drop event.
Added x-cloak directive and [x-cloak] CSS so button never flashes
before Alpine loads. Button is in base.html so appears on all pages
that extend the base template.
When sidebarCollapsed=true, a hamburger button appears at top-left
corner to restore the sidebar. CSS fixed positioning outside sidebar
so it's always visible even when sidebar is collapsed.
Same bug as tree API — sqlite3.Row doesn't implement .get(),
only __getitem__ (bracket notation). Fixed icon detection for
folders vs files in sidebar workspace section.
Server-side rendered sidebar doesn't auto-update after AJAX creation.
Changed create modal to reload page after success so sidebar picks up
new pages from workspace_pages template variable.
sqlite3.Row objects only support __getitem__ (r['key']), not the .get()
method. Changed r.get('parent_section') to r['parent_section'] in
folder type detection logic.
The roots query only had id, title columns but the tree builder
accessed r['parent_section'] which didn't exist in the result row.
Added parent_section to the SELECT to fix folder type detection.
- Topbar: removed New File/New Folder buttons + 'Files' label
- Breadcrumb: Workspace / work1 instead of work1 / Files
- Modals: single shared create modal with focus auto, @keydown.enter
- parent_id param: recursive folder/file creation inside folders
- Sidebar buttons use same POST /api/local-workspace/items
- newPageInWorkspace/newFolderInWorkspace now both use unified API
- Login redirect (all modes) now goes to /workspaces
- Workspace tree API filters by active workspace_id (no leak)
- Workspace name in sidebar from cookie (active_ws_name)
- Sidebar workspace section: 📄 new page + 📁 new folder buttons
- deleteWorkspacePage() in sidebar with confirmation
- _load_workspace_pages() helper with workspace_id filter
- CSS for sidebar-item-delete button (× on hover)
- Home button now links to /workspaces (universal workspace page)
- Sidebar workspace section shows active workspace name from cookie
- _sidebar_data reads flowdeck_workspace cookie for active_ws_name
- local-workspace APIs filter by workspace_id (not global)
- newPageInWorkspace() JS function added to sidebar
- CSRF exemption for /api/local-workspace routes
- DB: pages.workspace_id column linking pages to workspaces table
- /workspaces: list, create, rename, delete workspaces page
- API: GET/POST/PUT/DELETE /api/workspaces + POST select
- Session: flowdeck_workspace cookie for active workspace tracking
- Sidebar: Workspace section shows active workspace name + page tree
- Local workspace APIs filter by active workspace_id
- Home redirects non-Gitea users to /workspaces
- Dashboard '/' checks user_oauth_tokens for Gitea connection
- Local accounts (no Gitea token) redirect to /local-workspace
- Sidebar: Workspace section above Meetings with 'My Workspace' link
- Local users no longer see Gitea projects on Home page
- /local-workspace: page with file tree for local accounts (no forge)
- API: GET/POST/PUT/DELETE /api/local-workspace/items
- Workspace is empty when no pages exist, shows create buttons
- File tree shows nested items with rename/delete actions
- Local accounts are NOT linked to Gitea (separate workspace space)
CSRF middleware now excludes /auth/register, /auth/local-login,
/api/user, and /api/workspace paths. Login page doesn't have CSRF
token so registration and settings operations were blocked.
- CSS media queries: <=1024px (tablet) and <=768px (mobile)
- Sidebar hidden on mobile, togglable via .mobile-open
- Topbar, page editor, workspace, settings adapt padding
- Share dialog shrinks to 90vw on mobile
- Get Started toolbar wraps and centers pills
- No JS changes needed — pure CSS responsive
- GET /api/workspace/{id}/members — list all members with roles
- POST /api/workspace/{id}/members — invite user by email
- PUT /api/workspace/{id}/members/{user_id} — change role
- DELETE /api/workspace/{id}/members/{user_id} — remove member
- Roles: owner, admin, editor, viewer
- Uses existing workspace_members DB table (v2.0 schema)
When users table is empty (fresh install/test), auth check returns
a default admin user instead of redirecting. This allows the application
to bootstrap and tests to run without mocking sessions.
- conftest.py: fixture that creates a test user + valid session cookie
- test_dashboard + test_dashboard_notion_ui use authenticated_client
- No more redirect to login in tests — proper auth simulation
Dashboard now calls _get_user_or_redirect() before rendering.
Unauthenticated users get redirected to /auth/login?provider=local.
All sensitive routes now protected: /, /workspace, /accounts/settings
- Logout now redirects to /auth/login?provider=local instead of /
- Dashboard / and /workspace check auth and redirect to login if no session
- _get_user_or_redirect() helper added for reusable auth checks
- No more fallback admin user on dashboard — explicit login required
- Routes without session redirect to login page
- config.py: FLOWDECK_STANDALONE flag (default false)
- dashboard: graceful fallback when Gitea API unavailable
Works without GITEA_TOKEN or with FLOWDECK_STANDALONE=true
- Login page already supports local-only mode
- Workspace page: forge sections hidden when no projects
- Application fully functional with zero external dependencies
- GET /workspace — unified workspace page
- GET /api/workspace/projects — JSON API for built-in + Gitea projects
- POST /api/workspace/projects — create built-in project
- Added RedirectResponse to imports
- GET /workspace — HTML page showing all projects
- GET /api/workspace/projects — JSON API returning builtin + gitea + github
- POST /api/workspace/projects — create new built-in project
- Workspace template with project cards, forge badges, create modal
- Built-in projects: pages without workspace/parent
- Gitea repos: via existing GiteaClient
- GitHub repos: via OAuth token from user_oauth_tokens
- Callback now supports any provider (Gitea/GitHub) via providers.get_provider()
- OAuth tokens stored in user_oauth_tokens table per user + provider
- Login page shows both Gitea and GitHub OAuth buttons
- config.py: github_client_id + github_client_secret
- Auth flow no longer depends on gitea_oauth import — fully abstracted
- Fallback admin user now sets is_active=1 and admin@localhost email
- GET /accounts/settings — settings page with profile, forges, tokens, sessions
- PUT /api/user/profile — update display name
- PUT /api/user/password — change password
- POST /api/user/token — generate API token
- DELETE /api/user/forge/{provider} — disconnect forge
- Redirects to /auth/login?provider=local if not logged in
Pages with share_mode='anyone' or published=1 are now listed in the
left sidebar Shared section. Icon shows 🌐 for published pages,
🔗 for anyone-with-link pages. Updated _sidebar_data() to query
the pages table for shared/published pages.
The toggleFavorite() function body was missing its closing },
causing togglePublish(){...} to be parsed inside toggleFavorite()
body. The { at togglePublish() column was the 'Unexpected token {'
SyntaxError that prevented ALL JavaScript from executing.
Root cause of ALL Alpine 'is not defined' errors since the refactor.
Same pattern as f7d9d91: dashboard.router is registered before board.router
in main.py, so its /pages/{id} takes priority. Added page_data dict to match
the new JSON script tag approach.
Root cause: x-data HTML attribute with tojson creates quote conflicts
that survive even Cache-Control: no-store (likely nginx proxy cache).
Solution: page data is now in a <script type=application/json> tag,
completely decoupled from Alpine x-data HTML attribute. Zero quoting
issues regardless of page content.
- x-data="editorState()" + x-init="loadPage()" replaces editor(...)
- Server passes page_data dict, template renders as JSON script tag
- Same approach used for page_share_mode and page_published
- All 73 tests pass
The @input handler on the title called autoSave() which wasn't in
scope. Changed to save() which is available on the Alpine x-data object.
The debounce is already handled internally.
Both board.py and dashboard.py page endpoints now return
Cache-Control: no-store, max-age=0 headers to prevent the browser
from caching the page HTML with broken x-data attributes.
tojson outputs JSON with double quotes, which clash with x-data="..."
HTML attribute delimiter. Changed x-data delimiters to single quotes
so JSON double quotes are contained properly within the attribute.
x-data editor() arguments used manual |e escaping with single quotes.
Page content containing newlines, quotes or backslashes broke the
JavaScript string literal. Now uses |tojson filter for all fields
(proper JSON escaping).
dashboard.router is registered before board.router in main.py, so its
/pages/{page_id} takes priority. It was missing page_share_mode and
page_published template variables, causing Jinja2 TypeError.
- DB: pages.share_mode (private/invited/anyone) + published (bool)
- API: POST /board/api/share/{id} saves share settings to DB
- view_page: passes page_share_mode + page_published to template
- page_editor: inits share state from server, auto-saves on change
- Clipboard: fallback to textarea for HTTP (navigator.clipboard blocked)
- Toast: showToast() with proper timeout clearing
- pages table: added share_mode (private/invited/anyone) and published (bool)
- board.py: view_page now loads share_mode + published from DB
- page_editor.html: initializes shareTab, generalAccess, pagePublished from server
- Clipboard: fallback to textarea copy for HTTP (no HTTPS required)
- Toast: guaranteed visible with fixed positioning and Alpine x-show
- Sidebar Shared section: renders shared_pages (pages with share_mode != private)
- Dialog right edge aligns with Share button area (right: 72px)
- z-index raised to 999 to prevent being hidden by other layers
- Max-height reduced to 65vh to fit viewport
- Access menu: !important dark background, proper option styling
- Sidebar Shared section now renders shared_pages dynamically
- board.py: shared_pages added to _sidebar_data() return
Jinja2 tried to evaluate {{ a.email[0].toUpperCase() }} inside Alpine.js
x-for template, causing UndefinedError. Wrapped in {% raw %} block.
Also changed avatars to use x-text binding instead of {{ }} interpolation.
Share panel restructured to match Notion:
- General Access: dropdown with 'Only people invited' / 'Anyone with the link'
- Invite: email + permission selector
- Publish to web: toggle + URL input + Copy link button
- Copy page link at bottom
CSS: .share-access-btn and .share-access-menu for the access dropdown
- Share dropdown and More menu CSS were accidentally removed — restored
- Share dropdown: position absolute under button (top: calc(100% + 4px))
- Get Started toolbar: bottom: 28px to clear the editor statusbar
- Removed gradient background that was cut off by statusbar
- base.html topbar wrapped in {% block topbar %} for override
- page_editor.html overrides topbar block with empty content (uses its own)
- Get Started toolbar: fixed to bottom center with gradient fade
- No more double Share/Link/Star buttons
Replicates Notion's page layout from reference images:
- Top bar: Private badge, Share button, Link copy, Star/favorite toggle, ⋮ menu
- Share modal: Publish toggle, Copy link, Invite people with permission select
- Empty page toolbar: Get started with H1/H2/H3/bullet/todo/callout/quote
- Star toggle integrated with favorites API (POST/DELETE /board/api/favorites)
- board.py view_page now passes workspace context + page_favorited
- dashboard.py view_page_root also passes page_favorited
- CSS: .page-topbar, .share-modal, .empty-page-toolbar, toggle switch, more menu
Bug: lib_private filtered on p.source == '🔒 Private' which only matched pages
without a workspace. All pages have parent_section='Private' by default, so
filtering by source excluded them all.
Fix: add 'section' field to page dict from parent_section DB column,
filter lib_private by p.section == 'Private'
Bug: two separate x-data='{ tab }' scopes (one on tabs, one on table)
→ clicking tabs changed tab in first scope, x-show looked at second scope
Fix: single x-data wrapper around both tabs and table divs
6 files changed:
- db.py: migrate favorites table FK from collection_pages(id) to pages(id)
- board.py: add favorites API (POST/DELETE /board/api/favorites/{id}, GET list)
- board.py: _sidebar_data() now loads favorite_pages from DB via JOIN
- dashboard.py: library_page loads lib_favorites from DB (not parent_section)
- csrf.py: exclude /board/api/favorites from CSRF checks
- base.html: context menu toggles Add/Remove Favorites based on state
- base.html: favoriteIds Alpine set initialized from server-rendered favorites
- test_app.py: test_favorites_crud rewritten for new page-based favorites API
Favorites now work end-to-end:
- Right-click → Add to Favorites (or Remove if already favorited)
- Sidebar Favorites section shows favorited pages
- Library Favorites tab shows the same pages
- API: POST/DELETE /board/api/favorites/{page_id}, GET /board/api/favorites
- Sidebar data (board._sidebar_data()) no longer overwritten by library content
- New variables: lib_recent, lib_favorites, lib_shared, lib_private
- Pages categorized by parent_section column: Private/Favorites/Shared
- Recents tab shows all non-trashed pages ordered by updated_at
- library.html updated to use lib_* variables instead of sidebar data
- Favorites/Shared tabs hidden when empty (lib_has_favorites/lib_has_shared)
3 bugs fixed:
1. dashboard.py /library was registered before board.router and had no workspace context → removed old endpoint, re-added with owner/repo params using board._sidebar_data()
2. base.html navigateTo('/library') lost workspace → now auto-appends ?owner=X&repo=Y from workspaceKey
3. openLibrary(id) used bare window.location.href → now uses this.navigateTo()
Now the Library page:
- Shows pages filtered by workspace when coming from a project
- Preserves the sidebar context (no more Admin Dashboard fallback)
- Tabs (Recents, Favorites, Shared, Private) display project pages from DB
- board.html: ajout X-CSRF-Token header sur fetch /api/move et /api/issues
- card_detail.html: ajout helper getCsrf() + header sur tous les fetch POST/PATCH
- Sans ce fix, drag & drop, création issue, checklists échouent en production
- Nouveau router my_tasks.py: GET /my-tasks (HTML), GET /my-tasks/api (JSON)
- Agrège toutes les pages assignées à l'utilisateur sur toutes les collections
- Vues: All, Today, Overdue, Next 7 days
- Groupement par collection, filter admin auto
- 60/60 tests passent (+4 tests v1.9)
- Version 1.8.0 → 1.9.0
v1.7.0 — View Management:
- PUT /db/views/{id}/config (group_by, card_size, cover, visible_properties)
- POST /db/{id}/views/save-as (save current state as new view)
- GET /db/{id}/views/api (list views)
v1.8.0 — Sub-items & Dependencies:
- parent_id auto-référence: GET/POST /db/{id}/pages/{pid}/sub-items
- Status aggregation: GET .../status-aggregate
- Dependencies: POST .../dependencies, POST .../check-deps (blocking constraint)
- 56/56 tests passent (+7 tests)
- Version 1.6.0 → 1.8.0
- ROADMAP: v1.3.0 déplacé dans Completed, item checkboxes [x]
- WORKLOAD: réécrit pour refléter v1.3.0 + plan v1.4.0
- README: version 1.3.0, features à jour, tests 34/34
Database foundation:
- New tables: collections, collection_pages, collection_views
- Router /db with full CRUD API
- GiteaBoardCompat adapter for legacy board compatibility
- CSRF exemption for /db/ routes
- 34/34 tests pass
- Version bump 1.0.0 → 1.3.0
- Deployed and verified on Docker port 8080
- Nouveau router app/routers/collections.py
- GET/POST/PUT/DELETE /db pour les collections
- POST/GET/PUT/DELETE pour les pages dans une collection
- Vue HTML basique par collection + vue par défaut auto-créée
- CSRF exempté pour /db/
- 5 nouveaux tests (collections list, CRUD, pages CRUD, validation, HTML render)
- 33/33 tests passent
- Ajout des 3 nouvelles tables pour le Database Concept
- collections: base de données abstraite, indépendante de Gitea
- collection_pages: pages génériques avec parent_id et property_values_json
- collection_views: vues configurables par collection
- Mise à jour test_db_tables_exist pour inclure les nouvelles tables
- 28/28 tests passent
- Anatomie des Databases Notion (Collection/CollectionView/Pages)
- 21 types de propriétés, 6 types de vues, Relations & Rollups
- Architecture des Tasks (sub-items auto-référencés, dépendances)
- Plan d'implémentation en 6 phases avec SQL, Python et HTML
- Rétrocompatibilité avec les boards Gitea existants
- Sidebar: 7 collapsible sections (Meetings, Recents, Favorites, Agents, Shared, Private, Notion apps)
- Nav icon row: Home with text + icon, Chat/Inbox/Search icon-only, collapse on right
- Notion apps: Library, My Tasks, Trash, Help
- Footer: New chat Ctrl+O + New page buttons
- Auto-update: sidebar items reflect title changes immediately on save
- CSS: nav-icon-btn, home-btn, collapse-btn, empty-hint, outline none
- Add sort_order column to pages table for drag & drop reordering
- Rewrite _sidebar_data with recursive _build_page_tree for nested hierarchy
- Add tree toggle buttons (▶ collapsed / ▼ expanded) on parent items
- Alpine.js expandedNodes state with toggleTreeNode() for expand/collapse
- Jinja2 recursive macro render_tree_item for proper nesting + indentation
- SortableJS integration on .sidebar-items for drag & drop repositioning
- New PUT /board/api/pages/{id}/move API for persisting moves
- Auto-set sort_order on page creation (max+1 for same parent)
- CSS: .tree-toggle, .tree-toggle-placeholder, grab cursor on page-icon
- 28/28 tests pass, all endpoints healthy
- Page /accounts: profil utilisateur éditable, comptes connectés, workspace members
- API GET/PUT /api/users/me: lecture/écriture profil local (full_name, email)
- Users list from local DB, auth via Gitea OAuth2
- Imports SessionManager clean dans api.py
- sidebar items: attribut data-page-id ajouté pour ciblage DOM
- save(): après PUT réussi, met à jour .page-name dans le sidebar
- saveTitle(): reload la page (changement de titre = reload ok)
- CSRF middleware: excluded_paths utilise maintenant startswith (pas exact match)
- /board/api/pages/* exempté — les PUT depuis page_editor passent
- saveTitle() reload la page après sauvegarde → sidebar mis à jour
- pages.workspace = owner/repo (ex: bruno/flowdeck) au lieu du nom user
- Sidebar: Kanban board + 4 sous-vues avec URLs distinctes (?view=kanban|table|...)
- Cliquer sur 'Table view' dans sidebar → change la vue à droite
- Dashboard (/): sidebar montre uniquement les projets Gitea
- Board (/board/{o}/{r}): sidebar montre les pages de ce projet
- Changement de projet = changement de contexte (pages isolées)
- newPage/newSubPage passent workspace_key à l'API
- Auto-switch view depuis paramètre URL dans board.html
bruno