refactor: A28 lot 2 — dashboard.py (2 735 L) → package 10 fichiers (v7.30.0)

Découpe par concern de l'ancien app/routers/dashboard.py (2 735 lignes,
63 routes) en package `app/routers/dashboard/` :

- 8 modules de routes : local_workspace 559 L (15 r.), pages_html 485 (6),
  account_settings 439 (16), workspace 321 (9), pages_api 240 (6),
  workspaces 131 (6), public 78 (1), account_api 77 (4)
- _common.py (774 L) : les 15 helpers top-level INTERCALÉS dans l'ancien
  fichier + état (logger, _VERSION, WORKSPACE_COOKIE)
- __init__.py : ordre d'enregistrement identique à l'origine, re-export
  complet (7 importateurs inchangés : main, board ×3, my_tasks,
  web_clipper, wiki, sites `_dash._render_blocks_public`, tests) + __all__

Preuve contractuelle : docs/openapi-v2.json régénéré = IDENTIQUE
byte-à-byte (509 chemins, ordre préservé).

Pièges rattrapés :
- segment décorateur sans sa fonction → assert `def in seg` + récupération
  git (corps perdus en silence à la 1ʳᵉ exécution)
- collision `settings` (section vs from app.config import settings →
  hasattr du fromlist) → renommée account_settings
- WORKSPACE_COOKIE utilisé sans import dans workspaces.py (F821)
- script __all__ mangeant la fin du fichier → __init__ réécrit

Reste A28 : collections.py 2 622 L, board.py 2 101 L (lot 3).

suite **1091/1091** · ruff OK · OpenAPI 509 identique · docs à jour

.dockerignore

@@ -14,3 +14,10 @@ build/
 node_modules/
 Dockerfile
 .dockerignore
+
+# A9 — jamais de DB ni de fichiers de test dans l'image
+*.db
+*.db-*
+test-commit.md
+upload_test.txt
+e2e/

.env.example

@@ -5,6 +5,17 @@ GITEA_OAUTH_CLIENT_ID=
 GITEA_OAUTH_CLIENT_SECRET=
 GITEA_WEBHOOK_SECRET=
 
+# ── GitHub ──
+GITHUB_OAUTH_CLIENT_ID=
+GITHUB_OAUTH_CLIENT_SECRET=
+
+# ── OAuth2 ──
+# Laisser VIDE = redirect URI dynamique (dérivée du Host/X-Forwarded-* de la requête).
+# Ne définir QUE si on veut forcer une URI exacte — elle DOIT être enregistrée
+# dans l'application OAuth2 côté Gitea/GitHub (Settings → Applications).
+# Exemple : OAUTH_REDIRECT_URI=https://flowdeck.dracodev.net/auth/callback
+OAUTH_REDIRECT_URI=
+
 # ── App ──
 APP_SECRET_KEY=change-me-to-random
 APP_HOST=0.0.0.0
@@ -13,10 +24,61 @@ LOG_LEVEL=INFO
 DEFAULT_LANG=fr
 
 # ── Database ──
-# SQLite (default): sqlite:////data/flowdeck.db
-# PostgreSQL (optional): postgresql://user:pass@host:5432/flowdeck
+# SQLite UNIQUEMENT (le code ne lit que le préfixe sqlite:///, tout autre
+# schéma retombe silencieusement sur /data/flowdeck.db).
 DATABASE_URL=sqlite:////data/flowdeck.db
 
 # ── Sync ──
 SYNC_INTERVAL=60
 GITEA_CACHE_TTL=30
+
+# ── Backups (v5.2.0) ──
+# Sauvegarde automatique quotidienne du fichier SQLite (fichiers datés).
+BACKUP_ENABLED=true
+BACKUP_DIR=/data/backups
+BACKUP_INTERVAL_HOURS=24
+BACKUP_KEEP=30
+
+# ── Forge projects sync (v5.2.0) ──
+# Rafraîchissement périodique de la table `projects` depuis les forges connectées.
+PROJECT_SYNC_ENABLED=true
+PROJECT_SYNC_INTERVAL_HOURS=1
+
+# ── Public API v2 (v6.3.0) ──
+# PUBLIC_API_INSECURE_OK=true autorise le token de dev fd-public-key (jamais en prod).
+PUBLIC_API_INSECURE_OK=false
+API_V2_RATE_LIMIT_PER_TOKEN=300
+
+# ── Email notifications (v4.9.0) ──
+# Laisser SMTP_HOST vide = pas d'envoi d'email (seulement les notifications in-app).
+SMTP_HOST=
+SMTP_PORT=587
+SMTP_USER=
+SMTP_PASSWORD=
+SMTP_FROM=FlowDeck <[email protected]>
+SMTP_USE_TLS=true
+APP_BASE_URL=http://localhost:8080
+
+# ── SSO / Enterprise (v6.7.0) ──
+# Fallback de démarrage uniquement : dès qu'un admin enregistre une configuration
+# dans Settings → Admin → SSO / Enterprise, la table `sso_config` prime sur le .env.
+# Le bouton SSO n'apparaît sur la page de connexion que si une config est active.
+# SSO_PROVIDER=saml           # saml | oidc  (vide = SSO désactivé)
+# SSO_NAME=Company SSO        # libellé du bouton
+# SSO_ONLY=false              # true = refuser le login local (les admins gardent le leur)
+# SSO_AUTO_PROVISION=true     # créer le compte au premier login SSO
+# SAML :
+# SSO_ENTITY_ID=https://idp.example.com/saml/metadata
+# SSO_SSO_URL=https://idp.example.com/saml/sso
+# SSO_SLO_URL=https://idp.example.com/saml/slo
+# SSO_X509_CERTIFICATE=-----BEGIN CERTIFICATE-----
+# SSO_SIGN_REQUESTS=false     # signer les AuthnRequests / LogoutRequest
+# OIDC :
+# SSO_ISSUER_URL=https://auth.example.com/realms/flowdeck
+# SSO_CLIENT_ID=
+# SSO_CLIENT_SECRET=
+# SSO_SCOPE=openid profile email
+# Mapping (JSON) :
+# SSO_ATTRIBUTE_MAPPING={"email":"email","full_name":"name","groups":"groups"}
+# SSO_GROUPS_MAPPING=[{"sso_group":"FlowDeck Admins","workspace_role":"admin","workspace_id":1}]
+# SSO_DEFAULT_WORKSPACE_ID=0

.gitea/workflows/ci.yml

@@ -1,28 +1,57 @@
 name: FlowDeck CI
 
 on:
+  # Run on every pushed branch so feature branches are validated before the PR.
   push:
-    branches: [main]
   pull_request:
-    branches: [main]
+    branches: [main, develop]
 
 jobs:
-  test:
+  lint:
     runs-on: ubuntu-latest
-    container: python:3.12-slim
     steps:
       - uses: actions/checkout@v4
-      - name: Install dependencies
-        run: pip install -r requirements.txt pytest pytest-cov
-      - name: Run tests with coverage
+      - uses: actions/setup-python@v5
+        with:
+          python-version: '3.12'
+      - name: Install lint tools
+        run: pip install -r requirements-dev.txt
+      - name: Ruff (Python)
+        run: ruff check app tests
+      - name: ESLint (JavaScript)
+        run: npx --yes eslint static/js
+
+  test:
+    runs-on: ubuntu-latest
+    # NOTE: no `container:` here. A `python:*-slim` image ships no Node.js, so the
+    # JavaScript `actions/checkout` action could not run and every job failed at
+    # the first step. The runner's default image already provides Node; we install
+    # the Python toolchain explicitly with actions/setup-python.
+    steps:
+      - uses: actions/checkout@v4
+      - uses: actions/setup-python@v5
+        with:
+          python-version: '3.12'
+      - name: Install system dependencies (WeasyPrint / emoji fonts)
+        run: |-
+          SUDO=""
+          if command -v sudo >/dev/null 2>&1; then SUDO="sudo"; fi
+          $SUDO apt-get update
+          $SUDO apt-get install -y --no-install-recommends \
+            libpango-1.0-0 libpangoft2-1.0-0 libharfbuzz0b libffi-dev \
+            libjpeg-dev libopenjp2-7 libcairo2 fonts-noto-color-emoji
+      - name: Install Python dependencies
+        run: pip install -r requirements-dev.txt pytest-cov
+      - name: Run tests (parallel) with coverage
         env:
           GITEA_URL: https://git.dracodev.net
           GITEA_TOKEN: ${{ secrets.GITEA_TOKEN }}
           APP_SECRET_KEY: ci-test-key
-        run: python -m pytest tests/ -v --tb=short --cov=app --cov-report=term
+        # `-n auto` needs pytest-xdist, provided by requirements-dev.txt.
+        run: python -m pytest tests/ -v --tb=short -n auto --cov=app --cov-report=term
       - name: Coverage summary
-        run: |
-          python -m pytest tests/ --cov=app --cov-report=term 2>&1 | tail -20
+        if: always()
+        run: coverage report -m || true
 
   docker:
     runs-on: ubuntu-latest

.gitignore

@@ -4,7 +4,25 @@ __pycache__/
 /data/
 .venv/
 venv/
+.venv*/
 *.egg-info/
 dist/
 .pytest_cache/
 .ruff_cache/
+
+# Understand-Anything: exclude intermediate files and local diff overlay
+.ua/intermediate/
+.ua/diff-overlay.json
+.ua/tmp/
+.ua/.trash-*/
+.ua/.understandignore
+uv.lock
+
+# A9 — jamais de DB ni de fichiers de test dans git
+*.db
+*.db-*
+test-commit.md
+upload_test.txt
+e2e/node_modules/
+e2e/shots/
+e2e/test-results/

.ua/config.json

@@ -0,0 +1 @@
+{"outputLanguage":"fr"}

.ua/meta.json

@@ -0,0 +1,6 @@
+{
+  "lastAnalyzedAt": "2026-07-10T12:53:39Z",
+  "gitCommitHash": "c86c04ca220672fb012bb69916e930102be44ef4",
+  "version": "1.0.0",
+  "analyzedFiles": 67
+}

ARCHITECTURE.md

@@ -1,7 +1,8 @@
-# Architecture FlowDeck — Document Complet v2.0
+# Architecture FlowDeck — Document Complet v4.0
 
-> **Version:** 2.0 · **Date:** 2026-07-10 · **Auteur:** Hermes-Deepin
-> **Cible:** Clone Notion intégré à Gitea avec support multi-utilisateurs
+> **Version:** 4.0 · **Date:** 2026-07-20 · **Auteur:** Hermes-Deepin
+> **Cible:** Clone Notion intégré à Gitea/GitHub — multi-comptes, multi-intégrations
+> **Version déployée:** v4.0.x (production : https://flowdeck.dracodev.net)
 
 ---
 
@@ -47,34 +48,31 @@ FlowDeck est un **clone de Notion** intégré à Gitea. Il recrée l'expérience
 │                                                                   │
 │  ┌─────────────────────────────────────────────────────────┐    │
 │  │  Templates Jinja2 (SSR)                                   │    │
-│  │  ├─ dashboard.html     — Projets + sidebar                │    │
-│  │  ├─ board.html         — Kanban (wrapper)                 │    │
-│  │  ├─ board_fragment.html— Cartes Kanban                    │    │
-│  │  ├─ table_view.html    — Vue table                        │    │
-│  │  ├─ calendar_view.html — Vue calendrier (v1.6)            │    │
-│  │  ├─ timeline_view.html — Vue Gantt (v1.6)                 │    │
-│  │  ├─ gallery_view.html  — Vue galerie (v1.6)               │    │
-│  │  ├─ list_view.html     — Vue liste (v1.6)                 │    │
-│  │  ├─ status_overview.html — Donut SVG                      │    │
-│  │  ├─ team_load.html     — Barres stacked                   │    │
-│  │  ├─ detailed_board.html— Board détaillé                   │    │
-│  │  ├─ card_detail.html   — Modale détail carte              │    │
-│  │  ├─ card.html          — Carte individuelle               │    │
-│  │  ├─ page_editor.html   — Éditeur de blocs                 │    │
-│  │  ├─ my_tasks.html      — Dashboard unifié (v1.9)          │    │
-│  │  ├─ library.html       — Bibliothèque de pages            │    │
-│  │  ├─ trash.html         — Corbeille                        │    │
-│  │  ├─ accounts.html      — Gestion comptes                  │    │
-│  │  ├─ notes.html         — Notes Markdown                   │    │
-│  │  └─ base.html          — Layout commun                    │    │
+│  │  ├─ base.html            — Layout Notion commun (sidebar)  │    │
+│  │  ├─ _header.html         — Topbar + breadcrumbs            │    │
+│  │  ├─ _workspace_tree_macro.html — Macro arbre sidebar       │    │
+│  │  ├─ landing.html         — Landing page non-auth           │    │
+│  │  ├─ workspaces.html      — Page Workspaces (locale/Gitea)  │    │
+│  │  ├─ library.html         — Bibliothèque multi-onglets      │    │
+│  │  ├─ local_workspace.html — Workspace local (explorer)      │    │
+│  │  ├─ page_editor.html     — Éditeur de blocs                │    │
+│  │  ├─ trash.html           — Corbeille (local only)          │    │
+│  │  ├─ settings.html        — Settings / My Account / Admin    │    │
+│  │  ├─ accounts.html        — Gestion comptes admin           │    │
+│  │  ├─ board.html           — Kanban (wrapper)                │    │
+│  │  ├─ board_fragment.html  — Cartes Kanban                   │    │
+│  │  ├─ table_view.html      — Vue table                       │    │
+│  │  ├─ login.html           — Login/Register (local + OAuth)   │    │
+│  │  ├─ public_page.html     — Page publiée (/p/slug)          │    │
+│  │  └─ (legacy: dashboard, detailed_board, card_detail, etc.) │    │
 │  └─────────────────────────────────────────────────────────┘    │
 │                                                                   │
 │  ┌─────────────────────────────────────────────────────────┐    │
-│  │  JavaScript (CDN, pas de build step)                      │    │
-│  │  ├─ HTMX 1.9          — AJAX sans JS                      │    │
+│  │  JavaScript (servi localement, pas de CDN externe)        │    │
 │  │  ├─ Alpine.js 3.14    — Interactivité légère              │    │
+│  │  ├─ HTMX 1.9          — AJAX sans JS (legacy)             │    │
 │  │  ├─ SortableJS 1.15   — Drag & drop                       │    │
-│  │  └─ highlight.js      — Syntax highlighting (v2.0)        │    │
+│  │  └─ Prism.js          — Syntax highlighting               │    │
 │  └─────────────────────────────────────────────────────────┘    │
 │                                                                   │
 │  ┌─────────────────────────────────────────────────────────┐    │
@@ -95,17 +93,30 @@ FlowDeck est un **clone de Notion** intégré à Gitea. Il recrée l'expérience
 │                                                                   │
 │  ┌─────────────────────────────────────────────────────────┐    │
 │  │  ROUTERS                                                  │    │
-│  │  ├─ dashboard.py      — /                    Dashboard   │    │
-│  │  ├─ board.py          — /board/{o}/{r}       Board + vues │    │
-│  │  │                    — /board/api/...       APIs board   │    │
-│  │  ├─ api.py            — /api/...             CRUD + sync  │    │
-│  │  ├─ notes.py          — /notes/{o}/{r}       Notes        │    │
-│  │  ├─ auth.py           — /auth/...            OAuth2       │    │
-│  │  ├─ webhooks.py       — /webhooks/...        Gitea hooks  │    │
-│  │  ├─ my_tasks.py       — /my-tasks            (v1.9)       │    │
-│  │  ├─ pages.py          — /pages/...           Pages CRUD   │    │
-│  │  ├─ collections.py    — /db/...              Collections  │    │
-│  │  └─ editor.py         — /api/editor/...      Block editor │    │
+│  │  ├─ main.py           — FastAPI app, lifespan, CORS, 404   │    │
+│  │  ├─ dashboard.py      — /, /workspaces, /library, /help    │    │
+│  │  │                    — /trash, /settings, /accounts        │    │
+│  │  │                    — /p/{slug} (pages publiques)         │    │
+│  │  │                    — _sidebar_data() — données sidebar   │    │
+│  │  ├─ board.py          — /board/{o}/{r}       Board + vues   │    │
+│  │  │                    — /board/api/pages     CRUD pages     │    │
+│  │  │                    — /board/api/trash     Trash          │    │
+│  │  ├─ api.py            — /api/...             CRUD + sync    │    │
+│  │  ├─ auth.py           — /auth/...            OAuth2 + local │    │
+│  │  ├─ local_workspace.py— /api/local-workspace CRUD + upload  │    │
+│  │  ├─ my_tasks.py       — /my-tasks            Dashboard      │    │
+│  │  ├─ library.py        — /api/library/*       API bibliothèque│    │
+│  │  ├─ pages.py          — /pages/...           Pages CRUD     │    │
+│  │  ├─ collections.py    — /db/...              Collections    │    │
+│  │  ├─ editor.py         — /api/editor/...      Block editor   │    │
+│  │  ├─ public_api.py     — /api/v1              Public API v1  │    │
+│  │  ├─ api_v2.py         — /api/v2              Public API v2  │    │
+│  │  │                    — Bearer + scopes, CRUD complet        │    │
+│  │  ├─ web_clipper.py    — /api/v2/web-clipper  Web Clipper     │    │
+│  │  ├─ permissions.py    — /api/v2 (ACL)        Permissions     │    │
+│  │  ├─ workspace.py      — Workspaces API + Gitea projets     │    │
+│  │  ├─ webhooks.py       — /webhooks/...        Gitea hooks    │    │
+│  │  └─ admin.py          — /api/admin/*         Admin users    │    │
 │  └─────────────────────────────────────────────────────────┘    │
 │                                                                   │
 │  ┌─────────────────────────────────────────────────────────┐    │
@@ -138,6 +149,11 @@ FlowDeck est un **clone de Notion** intégré à Gitea. Il recrée l'expérience
 │  │  │  ├─ property_values    (legacy → collection_pages)      │
 │  │  │  ├─ ai_keywords                                 │    │    │
 │  │  │  ├─ pages                                       │    │    │
+│  │  │  ├─ page_shares          (v4.0)                  │    │    │
+│  │  │  ├─ recents              (v4.0)                  │    │    │
+│  │  │  ├─ tags                 (v4.0)                  │    │    │
+│  │  │  ├─ page_tags            (v4.0)                  │    │    │
+│  │  │  ├─ gitea_private_pages  (v4.0)                  │    │    │
 │  │  │  ├─ users                                       │    │    │
 │  │  │  ├─ user_tokens                                 │    │    │
 │  │  │  ├─ workspaces            (v2.0)                │    │    │
@@ -685,42 +701,146 @@ POST   /favorites                                   → Ajouter favori
 DELETE /favorites/{id}                              → Retirer favori
 ```
 
+### 4.6 Routes Sidebar & Library (v4.0)
+
+```
+GET    /library                                     → Bibliothèque dynamique
+GET    /api/library/recents                         → Pages récentes
+GET    /api/library/favorites                       → Favoris
+GET    /api/library/shared                          → Pages partagées
+GET    /api/library/published                       → Pages publiées
+GET    /api/library/private                         → Pages privées
+GET    /api/library/workspace                       → Pages du workspace
+
+GET    /api/local-workspace/items                   → Arborescence workspace
+POST   /api/local-workspace/items                   → Créer page/dossier
+PUT    /api/local-workspace/items/{id}              → Renommer
+DELETE /api/local-workspace/items/{id}              → Soft delete
+POST   /api/local-workspace/upload                  → Upload fichier
+GET    /api/files/{ws_id}/{filename}                → Servir fichier uploadé
+
+GET    /help                                        → Page d'aide complète
+GET    /api/public/pages/{slug}                     → Page publique
+```
+
+### 4.7 Routes Share & Publish (v4.0)
+
+```
+POST   /api/pages/{id}/share                        → Partager une page
+DELETE /api/pages/{id}/share/{share_id}             → Retirer partage
+GET    /api/pages/{id}/shares                       → Liste partages
+POST   /api/pages/{id}/publish                      → Publier page
+DELETE /api/pages/{id}/publish                      → Dépublier
+```
+
 ---
 
-## 5. Frontend
+## 5. Système d'authentification (v4.0)
+
+FlowDeck supporte **3 méthodes d'authentification** et la **connexion d'intégrations multiples** à un même compte local.
+
+### 5.1 Types de comptes
+
+| Type | Auth | Workspaces | Intégrations |
+|------|------|------------|--------------|
+| **Local pur** | email + password | Locaux uniquement | Aucune |
+| **Local + intégrations** | email + password | Locaux + distants | Gitea et/ou GitHub |
+| **OAuth pur** | Gitea ou GitHub | Distants uniquement | Non-déconnectable |
+
+### 5.2 Comportement du sidebar selon le type de compte
+
+```
+LOCAL PUR:
+  ├─ 📁 [nom workspace local]
+  ├─ 📅 Meetings
+  ├─ 🕒 Recents
+  ├─ ⭐ Favorites
+  ├─ 🤖 Agents
+  ├─ 👥 Shared        ← visible si pages partagées
+  ├─ 🌐 Published     ← visible si pages publiées
+  ├─ (Private caché)
+  └─ 📚 Library / ✅ My Tasks / 🗑️ Trash / ❓ Help
+
+LOCAL + GITEA/GITHUB:
+  ├─ 🔗 [owner/repo]  ← workspace distant actif
+  ├─ 📅 Meetings
+  ├─ 🕒 Recents
+  ├─ ⭐ Favorites
+  ├─ 🤖 Agents
+  ├─ 👥 Shared
+  ├─ 🌐 Published
+  ├─ 🔒 Private        ← visible (fichiers locaux liés au projet distant)
+  └─ 📚 / ✅ / 🗑️ / ❓
+
+OAUTH PUR (GITEA/GITHUB):
+  ├─ 🔗 [owner/repo]  ← identité = compte Gitea/GitHub
+  ├─ 🕒 Recents
+  ├─ ⭐ Favorites
+  ├─ 👥 Shared
+  ├─ 🌐 Published
+  ├─ (Private caché)
+  └─ 📚 / ✅ / ❓ (Trash caché — pas de workspace local)
+```
+
+### 5.3 Règles d'affichage
+
+- **Section Private** : visible UNIQUEMENT si compte local + workspace distant actif
+- **Trash** : visible si `auth_method == 'local'` ou si des pages locales existent
+- **Boutons New File/New Folder** : cachés si `has_active_workspace == False`
+- **Message "No workspace open"** : affiché dans la section Workspace si aucun workspace actif
+- **Header sidebar** : toujours le compte local si auth_method=local, même avec intégrations
+
+### 5.4 cookie `flowdeck_workspace`
+
+- `""` → aucun workspace actif
+- `"42"` → workspace local ID 42
+- `"gitea:owner:repo"` → workspace distant Gitea
+- Nettoyage automatique si cookie invalide (workspace supprimé ou autre user)
+
+---
+
+## 6. Frontend
 
 ### 5.1 Layout
 
-```
+```ascii
 ┌──────────────────────────────────────────────────────────────┐
-│ TOPBAR (44px, sticky)                                        │
-│ ┌──────────┬──────────────────────────────────┬────────────┐ │
-│ │ Logo     │ Breadcrumbs: WS > Collection     │ Share...   │ │
-│ │ FlowDeck │ (ou WS > Collection > Page)     │ Settings   │ │
-│ └──────────┴──────────────────────────────────┴────────────┘ │
+│ TOPBAR (unified-header)                                      │
+│ ┌──────┬───────────────────────────────────────┬───────────┐ │
+│ │ «»   │ Breadcrumbs: 🏠 Workspaces           │ Share ⚙    │ │
+│ └──────┴───────────────────────────────────────┴───────────┘ │
 ├────────────┬─────────────────────────────────────────────────┤
 │ SIDEBAR    │ CONTENU PRINCIPAL                               │
 │ (240px)    │                                                 │
-│            │  ┌─────────────────────────────────────────────┐│
-│ Workspace  │  │  DATABASE VIEW                               ││
-│ header     │  │  ┌──────┬──────┬──────┬──────┬──────────┐   ││
-│            │  │  │Title │Statut│Priori│Assign│Due Date  │   ││
-│ 🔍 Search  │  │  ├──────┼──────┼──────┼──────┼──────────┤   ││
-│            │  │  │Tâche1│Todo  │ P1   │Bruno │15 juil   │   ││
-│ ▼ Recents  │  │  │Tâche2│Doing │ P2   │ —    │20 juil   │   ││
-│  · Proj A  │  │  │Tâche3│Done  │ P3   │Marie │10 juil   │   ││
-│  · Proj B  │  │  └──────┴──────┴──────┴──────┴──────────┘   ││
-│            │  │  [+ New]  [Filter]  [Sort]  [Search]  [...]  ││
-│ ▼ Private  │  └─────────────────────────────────────────────┘│
-│  · Notes   │                                                 │
-│            │  ┌─ Barre d'outils ────────────────────────────┐│
-│ ▼ Shared   │  │  [Table▼] [Kanban] [Calendar] [Gallery] ... ││
-│  · ...     │  │  [Group▼] [Filter▼] [Sort▼] [Properties▼]  ││
+│            │  ┌─ Help Page ────────────────────────────────┐│
+│ ┌────────┐ │  │ ┌──────────────┐ ┌──────────────┐          ││
+│ │ Header │ │  │ │ 🚀 Getting   │ │ 📝 Pages     │  (...)   ││
+│ │ [D]    │ │  │ │   Started    │ │   & Editor   │          ││
+│ │ Draco  │ │  │ └──────────────┘ └──────────────┘          ││
+│ └────────┘ │  └─────────────────────────────────────────────┘│
+│            │                                                 │
+│ 🏠 💬 📨 🔍│  ┌─ Library ─────────────────────────────────┐│
+│            │  │ [Recents|Favorites|Shared|Published|...]    ││
+│ 📁 Worksp. │  │ ┌──────┬──────────┬──────────┬───────────┐ ││
+│  📄 New Pg │  │ │Name  │Created by│Source    │Last edited│ ││
+│  📁 New Fl │  │ ├──────┼──────────┼──────────┼───────────┤ ││
+│  📄 page 1 │  │ │doc A │Draco     │Local     │10 min ago │ ││
+│  📄 page 2 │  │ │doc B │bruno     │Gitea     │2 hours ago│ ││
+│            │  │ └──────┴──────────┴──────────┴───────────┘ ││
+│ 📅 Meeting │  └─────────────────────────────────────────────┘│
+│ 🕒 Recents │                                                 │
+│ ⭐ Favoris │  ┌─ Workspaces ───────────────────────────────┐│
+│ 🤖 Agents  │  │ ┌──────────┐ ┌──────────┐ ┌───┐ ┌───┐     ││
+│ 👥 Shared  │  │ │Project A │ │Project B │ │ + │ │ + │     ││
+│ 🌐 Publ.   │  │ │3 pages   │ │12 pages  │ │   │ │   │     ││
+│            │  │ └──────────┘ └──────────┘ └───┘ └───┘     ││
+│ ══════════ │  └─────────────────────────────────────────────┘│
+│ 📚 Library │                                                 │
+│ ✅ My Task │  ┌─ Settings ─────────────────────────────────┐│
+│ 🗑️ Trash  │  │ My Account | Admin | Integrations            ││
+│ ❓ Help    │  │ [Upload photo] [Full Name] [Email] [...]    ││
 │            │  └─────────────────────────────────────────────┘│
-│ ────────── │                                                 │
-│ [+New page]│  ┌─ Contenu de la vue ─────────────────────────┐│
-│ (sticky    │  │  (table / board / calendar / gallery / ...)  ││
-│  footer)   │  └─────────────────────────────────────────────┘│
+│ 💬 [+📄]   │                                                 │
 └────────────┴─────────────────────────────────────────────────┘
 ```
 
@@ -800,6 +920,257 @@ User authorize ──→ GET /auth/callback?code=xxx
 
 ---
 
+## 6.5 Modèle de comptes & intégrations (v4.0)
+
+### 6.5.1 Types de comptes
+
+FlowDeck supporte 3 types de comptes, déterminés par `auth_method` dans la table `users` :
+
+```
+┌──────────────┬──────────────────┬─────────────────────────────────────┐
+│ auth_method  │ Login via        │ Identité dans le sidebar            │
+├──────────────┼──────────────────┼─────────────────────────────────────┤
+│ local        │ email + password │ Nom local (ex: "Draco")            │
+│ gitea        │ OAuth2 Gitea     │ Nom Gitea + badge 🦎 Gitea         │
+│ github       │ OAuth2 GitHub    │ Nom GitHub + badge 🐙 GitHub       │
+└──────────────┴──────────────────┴─────────────────────────────────────┘
+```
+
+**Règle fondamentale** : Un compte local avec intégration(s) reste un compte LOCAL.
+Le badge OAuth (🦎/🐙) n'apparaît QUE pour les comptes dont `auth_method` est le provider.
+
+```
+Compte LOCAL avec intégrations :
+┌──────────────────────────────────┐
+│ [D] Draco                        │  ← Nom local, PAS de badge
+│     [email protected]      │
+└──────────────────────────────────┘
+
+Compte GITEA (auth_method=gitea) :
+┌──────────────────────────────────┐
+│ [B] bruno            [🦎 Gitea]  │  ← Badge visible
+│     [email protected]           │
+└──────────────────────────────────┘
+```
+
+### 6.5.2 Matrice des intégrations
+
+```
+Compte principal    Peut ajouter      Déconnexion possible
+─────────────────────────────────────────────────────────
+local               Gitea             ✅ Oui
+local               GitHub            ✅ Oui
+local               Gitea + GitHub    ✅ Les deux
+─────────────────────────────────────────────────────────
+gitea               GitHub            ✅ GitHub      ❌ Gitea
+github              Gitea             ✅ Gitea       ❌ GitHub
+```
+
+**Settings → Integrations** : Affiche toutes les intégrations avec bouton
+Disconnect. Le provider principal (auth_method) n'a PAS de bouton Disconnect.
+
+### 6.5.3 Scénarios de workspace
+
+```
+SCÉNARIO A : Compte local pur
+─────────────────────────────
+· Login email+password
+· Workspaces locaux uniquement
+· Section Private : CACHÉE (tout est déjà local)
+· Trash : ✅ (restauration locale)
+
+SCÉNARIO B : Compte local + intégration(s)
+──────────────────────────────────────────
+· Login email+password
+· Workspaces : locaux + Gitea + GitHub
+· Section Private : VISIBLE si workspace distant actif
+· Private : stockage DB locale, associé user+repo
+· Trash : ✅ (local uniquement)
+
+SCÉNARIO C : Compte OAuth pur (gitea ou github)
+────────────────────────────────────────────────
+· Login via OAuth
+· Workspaces : distants du provider principal
+· Section Private : VISIBLE (toujours)
+· Trash : ❌ (pas de contenu local)
+· Intégration secondaire : possible
+· Déconnexion provider principal : impossible
+```
+
+### 6.5.4 Sidebar — règles d'affichage par section
+
+```
+Section        Scénario A      Scénario B              Scénario C
+─────────────  ──────────────  ──────────────────────  ──────────────
+Recents        ✅ (local)      ✅ (tout)                ✅ (tout)
+Favorites      ✅ (local)      ✅ (tout)                ✅ (tout)
+Shared         ✅ (local)      ✅ (tout)                ✅ (tout)
+Published      ✅ (local)      ✅ (tout)                ✅ (tout)
+Agents         ✅              ✅                       ✅
+Private        ❌ CACHÉ        ✅ si ws distant actif   ✅
+Workspace      ✅              ✅                       ✅
+Trash          ✅ (local)      ✅ (local)               ❌
+```
+
+Chaque section a un bouton `→ Library` qui ouvre :
+```
+/library?tab=recents|favorites|shared|published|private|workspace
+```
+
+### 6.5.5 Système Share & Publish
+
+Le bouton [Share] dans la topbar d'une page ouvre une modale à 2 tabs :
+
+```
+┌──────────────────────────────────────────────────────┐
+│  [ Share ]  [ Publish ]                              │
+├──────────────────────────────────────────────────────┤
+│ Share tab :                                          │
+│  · Invite people : [email] [Invite]                  │
+│  · General access : [🔒 Restricted] Copy link        │
+│  · Liste des personnes/groupes avec accès            │
+│  → Document listé dans sidebar "Shared"             │
+├──────────────────────────────────────────────────────┤
+│ Publish tab :                                        │
+│  · [Publish to web] → URL publique générée           │
+│  · URL : https://flowdeck.draco.dev/p/<slug>        │
+│  · [Unpublish]                                       │
+│  → Document listé dans sidebar "Published"          │
+└──────────────────────────────────────────────────────┘
+```
+
+### 6.5.6 Stockage des fichiers Private
+
+Quand un workspace distant est actif, les fichiers créés dans la section
+Private sont stockés dans la **base de données locale** (table `pages` avec
+`parent_section='Private'` et `workspace=gitea:<owner>/<repo>`).
+
+Cela permet de :
+- Prendre des notes personnelles liées à un projet sans les committer
+- Garder des brouillons avant de les pousser
+- Avoir un espace de travail privé même sur un repo partagé
+
+### 6.5.7 Trash — règles
+
+```
+Contenu                  Trash ?   Comportement
+───────────────────────  ────────  ──────────────────────────
+Workspace local          ✅        Supprimé → restaurable
+Dossier/fichier local    ✅        Supprimé → restaurable
+Fichier Gitea/GitHub     ❌        Commit "delete" → pas trash
+Page distante            ❌        Commit "delete" → pas trash
+```
+
+### 6.5.8 Édition de fichiers — UI unifiée
+
+```
+Fichier LOCAL                    Fichier DISTANT (Gitea/GitHub)
+┌─────────────────────────┐      ┌─────────────────────────────┐
+│ Même UI d'édition       │      │ Même UI d'édition           │
+│ Même rendu visuel       │      │ Même rendu visuel           │
+│ Sauvegarde auto DB      │      │ + Bouton [Commit]           │
+│ Pas de commit           │      │ + Champ message commit      │
+└─────────────────────────┘      └─────────────────────────────┘
+```
+
+### 6.5.9 Page Library — `/library?tab=<tab>`
+
+```
+┌──────────────────────────────────────────────────────────────┐
+│  Library                                                     │
+│  [Recents] [Favorites] [Shared] [Published]                   │
+│  [Private] [Workspace]                                        │
+├──────────────────────────────────────────────────────────────┤
+│  Filtres : [All] [Local] [Gitea] [GitHub]                    │
+│                                                              │
+│  ┌─────────────────────────────────────────────────────────┐ │
+│  │ 📄 Document X    Local  · modifié il y a 2h             │ │
+│  │ 📄 README.md     Gitea  · bruno/flowdeck                │ │
+│  │ 📄 Notes         Local  · Workspace Projet A            │ │
+│  └─────────────────────────────────────────────────────────┘ │
+└──────────────────────────────────────────────────────────────┘
+```
+
+### 6.5.10 Schéma DB — mises à jour pour v4.0
+
+```sql
+-- users : ajout auth_method
+ALTER TABLE users ADD COLUMN auth_method TEXT NOT NULL DEFAULT 'local';
+-- 'local' | 'gitea' | 'github'
+
+-- users : colonnes OAuth existantes
+-- gitea_id INTEGER (NULL si pas Gitea)
+-- github_id INTEGER (NULL si pas GitHub)
+-- gitea_token TEXT (token intégration, NULL si pas connecté)
+-- github_token TEXT (token intégration, NULL si pas connecté)
+
+-- pages : ajout published
+ALTER TABLE pages ADD COLUMN is_published BOOLEAN NOT NULL DEFAULT 0;
+ALTER TABLE pages ADD COLUMN publish_slug TEXT;
+ALTER TABLE pages ADD COLUMN is_shared BOOLEAN NOT NULL DEFAULT 0;
+ALTER TABLE pages ADD COLUMN share_mode TEXT DEFAULT 'restricted';
+-- 'restricted' | 'link' | 'public'
+
+-- page_shares : qui a accès à quel document
+CREATE TABLE page_shares (
+    id INTEGER PRIMARY KEY AUTOINCREMENT,
+    page_id INTEGER NOT NULL REFERENCES pages(id) ON DELETE CASCADE,
+    shared_with_user_id INTEGER REFERENCES users(id),
+    shared_with_email TEXT,
+    permission TEXT NOT NULL DEFAULT 'view',
+    -- 'view' | 'comment' | 'edit'
+    created_at TIMESTAMP DEFAULT CURRENT_TIMESTAMP,
+    created_by INTEGER REFERENCES users(id)
+);
+
+-- recents : historique de consultation
+CREATE TABLE recents (
+    id INTEGER PRIMARY KEY AUTOINCREMENT,
+    user_id INTEGER NOT NULL REFERENCES users(id),
+    page_id INTEGER NOT NULL REFERENCES pages(id),
+    workspace TEXT NOT NULL,
+    source_type TEXT NOT NULL DEFAULT 'local',
+    -- 'local' | 'gitea' | 'github'
+    accessed_at TIMESTAMP DEFAULT CURRENT_TIMESTAMP,
+    UNIQUE(user_id, page_id)
+);
+```
+
+### 6.5.11 Plan de migration
+
+```
+Phase 1 — DB & Modèles
+  1. Ajouter auth_method aux users existants (auto-détecter)
+  2. Ajouter is_published, is_shared, share_mode aux pages
+  3. Créer table page_shares
+  4. Créer table recents
+
+Phase 2 — Sidebar
+  1. Badge OAuth (🦎/🐙) basé sur auth_method
+  2. Afficher/cacher Private selon type de compte + workspace actif
+  3. Boutons Library par section
+  4. Trash filtré local-only
+
+Phase 3 — Share & Publish
+  1. Modale Share à 2 tabs fonctionnelle
+  2. Share via email/user → table page_shares
+  3. Share via lien → share_mode='link'
+  4. Publish → is_published + publish_slug
+  5. Page publique servable à /p/<slug>
+
+Phase 4 — Library
+  1. Page /library avec tabs
+  2. Filtrage par source (local/gitea/github)
+  3. Recents alimentés automatiquement
+
+Phase 5 — Intégrations
+  1. GitHub OAuth déjà fait (providers.py)
+  2. Matrice de déconnexion respectée
+  3. Compte local peut connecter/déconnecter Gitea+GitHub
+```
+
+---
+
 ## 7. Intégration Gitea
 
 ### 7.1 Flux de données
@@ -1302,7 +1673,43 @@ docker compose restart flowdeck
 - [Notion Help — Databases](https://www.notion.com/help/intro-to-databases)
 - [Notion Help — Tasks & Dependencies](https://www.notion.com/help/tasks-and-dependencies)
 - [Notion Help — Relations & Rollups](https://www.notion.com/help/relations-and-rollups)
-- [Notion Data Sources (2025)](https://www.notionapps.com/blog/notion-data-sources-update-2025/)
-- [react-notion-x](https://github.com/NotionX/react-notion-x)
 - [FlowDeck — NOTION_DATABASE_TASKS_GUIDE.md](docs/NOTION_DATABASE_TASKS_GUIDE.md)
 - [FlowDeck — ROADMAP.md](ROADMAP.md)
+
+---
+
+## 16. Versions à venir
+
+### v4.1.0 — Content Blocks enrichis (priorité standard)
+
+- **Callout boxes** — Blocs d'alerte (info, warning, tip, danger)
+- **Table of Contents** — Auto-généré depuis les headings
+- **LaTeX / KaTeX** — Formules mathématiques
+- **Toggle lists** — Listes pliables/dépliables
+- **Multi-columns** — Mise en page 2-3 colonnes
+
+### v4.2.0 — Export (priorité standard)
+
+- Export **Markdown** avec images
+- Export **PDF** (via WeasyPrint ou headless Chrome)
+- Export **HTML** standalone (page auto-suffisante)
+
+### v4.3.0 — Collaboration (priorité basse)
+
+- **Commentaires inline** sur les pages
+- **@mentions** pour notifier des utilisateurs
+- **Notifications email** (changements, mentions)
+- **Permissions par workspace** (viewer, editor, admin)
+
+### v5.0.0 — Plateforme avancée (futur)
+
+- **AI Assistants** — Génération de contenu, résumés, suggestions
+- **Embeds** — Vidéos, PDF, Figma, Google Docs
+- **Automatisations** — Règles déclenchées sur événements (Notion-style)
+- **Base de données avancée** — Relations inter-collections, rollups
+- **Kanban flexible** — Colonnes custom, WIP limits
+- **API publique REST v2** — `/api/v2` (v6.3.0) : Bearer + scopes `read/write/admin`, CRUD complet, pagination, RFC 7807, idempotence, audit, OpenAPI (`/docs`, `docs/openapi-v2.json`) ; `/api/v1` lecture seule (compat)
+- **API agent publique** — `/api/v2/agents/*` + `/api/v2/skills/*` (v6.6.0, agent phase 5) : wrappers Bearer sur `AgentEngine` (run synchrone JSON, journal + rollback, trigger externe) et marketplace de skills (export/import portable, galerie de presets) — `app/routers/api_v2_agent.py`, `app/services/skill_gallery.py`
+- **SSO / SAML + OIDC entreprise** — v6.7.0 (Enterprise Auth, dernière feature v6.0.0) : SP SAML (`python3-saml`) + OIDC PKCE (`authlib`), auto-provisioning + mapping groupes IdP → rôles workspace, mode « SSO only », onglet admin « SSO / Enterprise », migration 23 (`sso_config`, `sso_login_history`, `sso_requests`), `/help` section SSO — `app/routers/sso.py`, `app/services/sso_provisioning.py`, `app/auth/providers/{saml,oidc}_provider.py`
+- **Volume Docker persistant** — `/data` monté pour survie des données
+- **PostgreSQL** — Migration optionnelle pour scaling

BRANCHING.md

@@ -0,0 +1,108 @@
+# Stratégie de branches — FlowDeck
+
+## Structure
+
+```
+main       ──●────────────●────── production (tags vX.Y.Z)
+              \          /
+develop       ●──●──●──●────── intégration continue
+                  \  \  \
+feat/xxx          ●  ●  ●──── feature branches
+fix/xxx           ●─────────── hotfix branches
+```
+
+## Branches
+
+| Branche | Rôle | Déploiement | Protection |
+|---------|------|-------------|------------|
+| `main` | Production | Docker auto sur :8080 | Push direct interdit, PR only |
+| `develop` | Intégration | Staging (optionnel) | Push direct interdit, PR only |
+| `feat/<nom>` | Nouvelle feature | Aucun | Libre |
+| `fix/<nom>` | Correctif urgent | Aucun | Libre |
+
+## Workflow quotidien
+
+### 1. Démarrer une feature
+
+```bash
+git checkout develop
+git pull origin develop
+git checkout -b feat/ma-feature
+```
+
+### 2. Travailler
+
+```bash
+# Coder, commit souvent
+git add -A
+git commit -m "feat: description claire de ce qui est fait"
+git push origin feat/ma-feature
+```
+
+### 3. Créer une Pull Request
+
+Aller sur https://git.dracodev.net/bruno/flowdeck/pulls
+- **Base** : `develop`
+- **Head** : `feat/ma-feature`
+- Titre : descriptif
+- Assigner un reviewer si applicable
+
+### 4. Après merge
+
+```bash
+git checkout develop
+git pull origin develop
+git branch -d feat/ma-feature  # supprimer la branche locale
+```
+
+## Release (develop → main)
+
+```bash
+# 1. S'assurer que develop est prêt
+git checkout develop
+git pull origin develop
+
+# 2. Créer une PR develop → main sur Gitea
+#    (ou merger localement si admin)
+git checkout main
+git merge develop
+git tag v4.0.1
+git push origin main --tags
+```
+
+## Hotfix urgent
+
+```bash
+git checkout main
+git checkout -b fix/urgence
+# ... corriger ...
+git commit -m "fix: description"
+git push origin fix/urgence
+# PR fix/urgence → main
+# PUIS merger main → develop pour synchroniser
+git checkout develop
+git merge main
+git push origin develop
+```
+
+## Conventions de commits
+
+| Préfixe | Usage | Exemple |
+|---------|-------|---------|
+| `feat:` | Nouvelle fonctionnalité | `feat: landing page for visitors` |
+| `fix:` | Correction de bug | `fix: redirect loop on /` |
+| `refactor:` | Restructuration sans changement fonctionnel | `refactor: extract sidebar_data` |
+| `test:` | Ajout/modification de tests | `test: onboarding flow e2e` |
+| `docs:` | Documentation | `docs: update ROADMAP.md` |
+| `style:` | Formatage, CSS | `style: mobile sidebar fixes` |
+| `chore:` | Tâches de maintenance | `chore: bump version to 4.0.1` |
+
+## Règles
+
+1. **Jamais de push direct sur `main`** — toujours via PR depuis `develop` ou `fix/*`
+2. **Jamais de push direct sur `develop`** — toujours via PR depuis `feat/*` ou `fix/*`
+3. **Une branche = une feature / un fix** — éviter les branches fourre-tout
+4. **Tests passent avant merge** — CI Gitea Actions doit être verte
+5. **Commit + push après chaque modification significative**
+6. **Nom de branche en kebab-case** : `feat/landing-page`, `fix/login-redirect`
+7. **Supprimer la branche après merge** (sauf `main` et `develop`)

Dockerfile

@@ -1,19 +1,44 @@
-FROM python:3.12-slim
+# ═══════════════════════════════════════════════════════════
+# FlowDeck — multi-stage Docker build (v5.2.0)
+# Stage 1 "builder": build Python wheels once.
+# Stage 2 "runtime": minimal image with WeasyPrint system libs.
+# ═══════════════════════════════════════════════════════════
+FROM python:3.12-slim AS builder
 
 WORKDIR /app
 
-RUN apt-get update && apt-get install -y --no-install-recommends curl && rm -rf /var/lib/apt/lists/*
-
 COPY requirements.txt .
-RUN pip install --no-cache-dir -r requirements.txt
+RUN pip wheel --no-cache-dir --wheel-dir /wheels -r requirements.txt
+
+# ── runtime stage ───────────────────────────────────────────
+FROM python:3.12-slim AS runtime
+
+WORKDIR /app
+
+# WeasyPrint PDF: text layout (pango/harfbuzz), image decoding, fonts,
+# colour emoji support. curl = healthcheck.
+RUN apt-get update && apt-get install -y --no-install-recommends \
+    curl \
+    libpango-1.0-0 \
+    libpangoft2-1.0-0 \
+    libharfbuzz0b \
+    libffi-dev \
+    libgdk-pixbuf-2.0-0 \
+    shared-mime-info \
+    fonts-dejavu-core \
+    fonts-noto-color-emoji \
+    && rm -rf /var/lib/apt/lists/*
+
+COPY --from=builder /wheels /wheels
+RUN pip install --no-cache-dir /wheels/* && rm -rf /wheels
 
 COPY . .
 
-RUN mkdir -p /data
+RUN mkdir -p /data /data/backups
 
 EXPOSE 8080
 
 HEALTHCHECK --interval=30s --timeout=5s --start-period=5s --retries=3 \
   CMD curl -f http://localhost:8080/api/health || exit 1
 
-CMD ["uvicorn", "app.main:app", "--host", "0.0.0.0", "--port", "8080"]
+CMD ["uvicorn", "app.main:app", "--host", "0.0.0.0", "--port", "8080", "--proxy-headers", "--forwarded-allow-ips", "*"]

README.md

@@ -1,8 +1,8 @@
 # FlowDeck
 
-Clone de l'interface **Notion** intégré nativement à **Gitea** — Databases, Pages, Kanban, Table, multi-vues.
+Clone complet de **Notion** intégré nativement à **Gitea** — Databases, Pages, Kanban, Calendar, Gallery, Timeline, List, Multi-Users.
 
-> **v1.3.0** — Database Concept (collections, pages, vues, GiteaBoardCompat)
+> **7.3.9** — audit sécurité P0→P2 (A1–A26, A33–A36, A43 : auth 401 partout, CSRF sans exemption cookie-auth, SSRF, autoescape, logs d'exceptions) · avant : v6.7.x SSO/SAML + OIDC, v6.6.x agent API, v6.5.x synced blocks, v6.4.0 realtime, PWA offline
 
 ## Quick Start
 
@@ -15,45 +15,66 @@ docker compose up -d
 
 ## Features
 
-### Database Concept (v1.3.0)
-- **Collections**: databases indépendantes de Gitea, schéma JSON, icon, description
-- **Pages**: propriétés JSON, position, parent_id (sub-items ready), lien Gitea optionnel
-- **Vues**: configurables (type, filters, sorts, visible_properties)
+### Database & Properties (v1.3–v1.5)
+- **Collections**: databases indépendantes de Gitea, schéma JSON
+- **21 types de propriétés**: title, text, number, select, status, date, person, checkbox, url, email, phone, files, unique_id, relation, rollup, formula + auto-props
+- **Relations bidirectionnelles** + **Rollups** (12 agrégations) + **Formulas** (19 fonctions)
 - **GiteaBoardCompat**: adaptateur boards Gitea legacy → Collections
-- **API REST**: CRUD complet collections + pages (12 endpoints)
+
+### Vues Multiples (v1.6–v1.7)
+- **Table**: colonnes SSR, triables
+- **Board (Kanban)**: colonnes, groupes, drag & drop
+- **Calendar**: grid mensuel, navigation, événements
+- **Gallery**: cartes visuelles, card_size configurable
+- **List**: vue compacte avec preview
+- **Timeline**: barres Gantt horizontales
+- **Status Overview**: Donut chart SVG
+- **Team Load**: Barres empilées
+
+### Sub-items & Dépendances (v1.8)
+- **Sub-items**: parent_id auto-référence, hiérarchie illimitée
+- **Status aggregate**: parent = Done si tous enfants Done
+- **Dependencies**: Blocking/Blocked by, contrainte de transition
+
+### My Tasks (v1.9)
+- Dashboard cross-collection agrégeant toutes les tâches assignées
+- Vues: All, Today, Overdue, Next 7 days
+
+### Multi-User & Collaboratif (v2.0)
+- **Workspaces**: espaces partagés avec rôles (admin, editor, commenter, viewer)
+- **Comments**: commentaires threadés sur les pages
+- **Page History**: historique des modifications avec snapshots
+- **Favorites**: favoris par utilisateur
+- **Templates**: database + page templates
+- **CSV Import/Export**
+- **Public Sharing**: lien de partage lecture seule
+
+### API & Intégrations (v6.3–v6.6)
+- **API publique REST v2**: `/api/v2` — CRUD complet, Bearer + scopes `read/write/admin`, pagination, filtres, erreurs RFC 7807, idempotence, audit — [guide](docs/API_GUIDE_V6.md) · OpenAPI `/docs`
+- **API agent publique (v6.6)**: `/api/v2/agents/*` — agents, conversations, **run synchrone JSON**, journal d'actions + rollback, `trigger` externe
+- **Marketplace de skills (v6.6)**: export/import portable + galerie de 6 presets installables (`/api/v2/skills/*`), section « Galerie » dans la palette `/` de l'agent
+- **API publique v1**: `/api/v1` (lecture seule, compat)
+- **Webhooks sortants**: gestion + dispatcher d'événements (CRUD v2)
+- **Web Clipper**: extension navigateur Manifest V3 (article/sélection/bookmark/screenshot)
+- **PWA**: manifest.json + service worker, offline support
 
 ### UI Notion-Style (v1.1–v1.2)
-- **Sidebar gauche** avec sections hiérarchiques (Recents, Private, Library, Trash)
-- **Topbar** avec breadcrumbs (workspace > projet > page)
-- **Dark mode** Notion: `#191919` fond, `#222222` sidebar, `#333333` actif
-- **Éditeur de blocs** Notion-style: slash menu (/), navigation clavier, placeholders
-- **Drag & drop** pages dans la sidebar (SortableJS)
-
-### Vues Multiples (v0.5–v0.8)
-- **Kanban board**: colonnes avec sous-groupes, drag & drop cartes
-- **Table view**: colonnes triables, groupes rétractables
-- **Status overview**: Donut chart SVG avec segments, compteurs
-- **Team Load**: Barres empilées par membre
-- **Detailed board**: cartes avec propriétés visibles
-
-### Filtres & Tri (v0.7)
-- **Filtres cumulables** (logique AND) avec pastilles
-- **Tri multi-critères** hiérarchique
-- **Filtre par statut**: checkboxes multiples
+- Sidebar gauche avec sections hiérarchiques
+- Topbar avec breadcrumbs (workspace > projet > page)
+- Dark mode Notion: `#191919` fond, `#222222` sidebar
+- Éditeur de blocs: slash menu (/), navigation clavier, placeholders
 
 ### Intégration Gitea
-- **Issues Gitea → cartes** Notion-style
-- Sync labels, milestones, assignees, due dates
-- OAuth2 Gitea, CSRF, rate limiting
-- Webhooks pour sync temps réel
+- Issues Gitea → cartes, sync labels, milestones, assignees, due dates
+- OAuth2 Gitea, CSRF, rate limiting, webhooks
 
 ## Stack
 
 | Couche | Techno |
 |--------|--------|
-| Frontend | Jinja2 + HTMX + Alpine.js + SortableJS + CSS 31KB |
+| Frontend | Jinja2 + HTMX + Alpine.js + SortableJS + CSS |
 | Backend | Python 3.12 + FastAPI + httpx |
-| BDD | SQLite (WAL mode) — `/data/flowdeck.db` |
+| BDD | SQLite (WAL, 21 tables) — `/data/flowdeck.db` |
 | Déploiement | Docker (python:3.12-slim), docker-compose |
 
 ## Configuration
@@ -65,25 +86,16 @@ APP_PORT=8080
 DATABASE_URL=sqlite:////data/flowdeck.db
 ```
 
-## Roadmap
-
-Voir [ROADMAP.md](ROADMAP.md) — v1.4.0 Propriétés Avancées → v2.0.0 Multi-Users.
-
-## Développement
-
-```bash
-python3 -m venv venv
-source venv/bin/activate
-pip install -r requirements.txt
-uvicorn app.main:app --reload --port 8080
-```
-
 ## Tests
 
 ```bash
-python3 -m pytest tests/ -v   # 34/34 passent
+python3 -m pytest tests/ -v   # 764/764 passent (0 skip)
 ```
 
+## Roadmap
+
+Voir [ROADMAP.md](ROADMAP.md) — 7/7 blocs complétés, 52/52 features ✅
+
 ## Licence
 
 MIT

TESTING.md

@@ -0,0 +1,238 @@
+# FlowDeck — Grille de Tests Visuels
+
+> Version: 2.1.0 | Dernière mise à jour: 2026-07-10 | Dernier run: 2026-07-10 | Résultat: 55/61
+
+## Résumé du dernier run (2026-07-10)
+
+| Section | Pass | Fail | Notes |
+|---------|------|------|-------|
+| Dashboard | 8/9 | ❌ D6 Quick Find | Quick Find pas implémenté dans le dashboard |
+| Board Kanban | 9/9 | — | OK |
+| Drag & Drop | 5/5 | — | ✅ Fix CSRF + refresh appliqué |
+| Création Issue | 6/6 | — | ✅ Fix CSRF appliqué |
+| Vues | 7/7 | — | OK |
+| Filtres & Tri | 7/7 | — | OK |
+| Notes | 3/3 | — | OK |
+| Sidebar | 6/6 | — | OK |
+| Workspaces | 6/6 | — | OK |
+| Commentaires | 3/3 | — | OK |
+| Favoris | 4/4 | — | OK |
+| Webhooks | 4/5 | ⚠️ No secret | Webhook status OK, secret non configuré |
+| PWA | 0/3 | ❌ P1-P3 | manifest.json + SW non implémentés |
+| Éditeur | 3/5 | ⚠️ E4-E5 | Commandes `/` + drag blocks à vérifier |
+| **Total** | **55** | **6** | |
+
+### Bugs corrigés ce run
+- `8aaf167`: Refresh board après drag & drop
+- `[latest]`: CSRF token manquant sur fetch POST (board.html, card_detail.html)
+
+### Reste à faire
+- PWA (manifest.json + service worker)
+- Quick Find dans le dashboard
+- Config webhook secret
+- Commandes `/` dans l'éditeur
+
+Tests manuels de régression visuelle et fonctionnelle. Cocher après chaque release.
+
+## Pré-requis
+
+- FlowDeck lancé (Docker: `APP_PORT=8082 docker compose up -d`)
+- Gitea accessible (https://git.dracodev.net)
+- Au moins 1 projet avec des issues existantes
+
+---
+
+## 1. Dashboard (Accueil)
+
+| ID | Test | Action | Résultat attendu | ✅ |
+|----|------|--------|-----------------|----|
+| D1 | Chargement | Ouvrir `/` | Dashboard affiché, sidebar visible | |
+| D2 | Liste projets | Vérifier la liste | Projets Gitea listés, triés par mise à jour | |
+| D3 | Recherche projets | Taper dans la barre de recherche | Filtrage en temps réel | |
+| D4 | Lien projet | Cliquer sur un projet | Navigation vers le board du projet | |
+| D5 | Workspace menu | Cliquer sur le workspace header | Menu déroulant des workspaces | |
+| D6 | Quick Find | Cliquer 🔍 dans la sidebar | Modal de recherche rapide | |
+| D7 | Theme toggle | Basculer le thème | Dark ↔ Light, persisté localStorage | |
+| D8 | Collapse sidebar | Cliquer ⏴ | Sidebar se réduit/étend | |
+| D9 | Sidebar sections | Cliquer Meetings/Recents | Sections expand/collapse | |
+
+---
+
+## 2. Board Kanban
+
+| ID | Test | Action | Résultat attendu | ✅ |
+|----|------|--------|-----------------|----|
+| B1 | Chargement board | Ouvrir `/board/{owner}/{repo}` | Colonnes affichées avec cartes | |
+| B2 | Colonnes par défaut | Vérifier les colonnes | Backlog, À faire, En cours, Révision, Terminé | |
+| B3 | Cartes dans colonnes | Vérifier le mapping | Issues dans bonnes colonnes selon labels/état | |
+| B4 | Labels sur cartes | Vérifier l'affichage | Labels visibles avec couleur Gitea | |
+| B5 | Assignee avatar | Vérifier les cartes | Avatar + login si assigné | |
+| B6 | Milestone sur carte | Vérifier | 📅 + nom milestone si défini | |
+| B7 | Priorité | Vérifier | Badge priorité si défini dans FlowDeck | |
+| B8 | Due date | Vérifier | ⏰ + date, style "overdue" si dépassée | |
+| B9 | Compteur colonne | Vérifier chaque colonne | Nombre de cartes affiché dans le header | |
+
+---
+
+## 3. Drag & Drop
+
+| ID | Test | Action | Résultat attendu | ✅ |
+|----|------|--------|-----------------|----|
+| DD1 | Move carte | Drag carte vers autre colonne | Carte déplacée visuellement | |
+| DD2 | Persistence | Après DD1, rafraîchir la page | Carte reste dans nouvelle colonne | |
+| DD3 | Refresh auto | Après move, attendre | La vue se rafraîchit automatiquement | |
+| DD4 | Compteurs | Après move | Compteurs de colonnes mis à jour | |
+| DD5 | Move → Gitea | Vérifier sur Gitea | Label/état synchronisé si mapping existe | |
+
+---
+
+## 4. Création d'Issue
+
+| ID | Test | Action | Résultat attendu | ✅ |
+|----|------|--------|-----------------|----|
+| C1 | Bouton New | Cliquer "New ▾" dans la toolbar | Formulaire de création affiché | |
+| C2 | Création simple | Titre + "Create" | Issue créée sur Gitea, apparaît au refresh | |
+| C3 | Création + statut | Titre + sélection statut | Issue créée avec le bon statut | |
+| C4 | Annulation | Ouvrir form → ✕ | Formulaire masqué | |
+| C5 | Enter pour créer | Titre + Entrée | Issue créée (submit au Enter) | |
+| C6 | Titre vide | "Create" sans titre | Rien ne se passe (validé client) | |
+
+---
+
+## 5. Vues du Board
+
+| ID | Test | Action | Résultat attendu | ✅ |
+|----|------|--------|-----------------|----|
+| V1 | Vue Kanban | Tab "Board" | Vue kanban avec colonnes | |
+| V2 | Vue Table | Tab "Table" | Vue tableau lignes/colonnes | |
+| V3 | Vue Status | Tab "Status" | Regroupement par statut | |
+| V4 | Vue TeamLoad | Tab "Workload" | Répartition par assignee | |
+| V5 | Vue Detailed | Tab "Detailed" | Vue détaillée | |
+| V6 | Switch vue | Alterner entre vues | Contenu mis à jour sans rechargement page | |
+| V7 | URL view param | `?view=table` | Vue table chargée directement | |
+
+---
+
+## 6. Filtres & Tri
+
+| ID | Test | Action | Résultat attendu | ✅ |
+|----|------|--------|-----------------|----|
+| F1 | Filtre milestone | Sélectionner un milestone | Seules les issues du milestone affichées | |
+| F2 | Filtre label | Sélectionner un label | Seules les issues avec ce label | |
+| F3 | Combinaison filtres | Milestone + Label | Les deux filtres appliqués (AND) | |
+| F4 | Reset filtres | Sélectionner "Tous" | Toutes les issues affichées | |
+| F5 | Tri par propriété | Add sort → choisir champ | Liste triée selon critère | |
+| F6 | Tri direction | Toggle asc/desc | Direction inversée | |
+| F7 | Supprimer tri | Delete sort | Tri retiré | |
+
+---
+
+## 7. Notes
+
+| ID | Test | Action | Résultat attendu | ✅ |
+|----|------|--------|-----------------|----|
+| N1 | Accès notes | Cliquer "📝 Notes" dans le board | Page notes du projet | |
+| N2 | Édition notes | Modifier le contenu | Sauvegarde automatique | |
+| N3 | Markdown | Saisir `# Titre`, `**gras**` | Rendu Markdown | |
+
+---
+
+## 8. Sidebar & Navigation
+
+| ID | Test | Action | Résultat attendu | ✅ |
+|----|------|--------|-----------------|----|
+| S1 | Navigation page | Cliquer sur une page sidebar | Board du projet chargé | |
+| S2 | Library | Cliquer 📚 sur une page | Library view avec recents/favorites/shared | |
+| S3 | New sub-page | Cliquer + sur une page | Création sous-page | |
+| S4 | Context menu | Clic droit sur page sidebar | Menu contextuel (rename, delete, etc.) | |
+| S5 | Tree toggle | Cliquer ▶ d'un dossier | Sous-éléments affichés/masqués | |
+| S6 | Drag tree | Drag & drop élément sidebar | Réorganisation de l'arbre | |
+
+---
+
+## 9. Workspaces Multi-User
+
+| ID | Test | Action | Résultat attendu | ✅ |
+|----|------|--------|-----------------|----|
+| W1 | Lister workspaces | Voir le menu workspace | Workspaces disponibles listés | |
+| W2 | Créer workspace | Créer nouveau workspace | Workspace ajouté | |
+| W3 | Membres | Voir liste membres | Membres affichés avec rôles | |
+| W4 | Ajouter membre | Ajouter un utilisateur | Membre ajouté | |
+| W5 | Rôle membre | Changer rôle | Rôle mis à jour | |
+| W6 | Supprimer membre | Retirer un membre | Membre retiré | |
+
+---
+
+## 10. Commentaires & Historique
+
+| ID | Test | Action | Résultat attendu | ✅ |
+|----|------|--------|-----------------|----|
+| H1 | Voir commentaires | Ouvrir commentaires d'une page | Liste des commentaires | |
+| H2 | Ajouter commentaire | Écrire + envoyer | Commentaire ajouté | |
+| H3 | Historique | Voir historique d'une page | Liste des versions/modifications | |
+
+---
+
+## 11. Favoris & Partage
+
+| ID | Test | Action | Résultat attendu | ✅ |
+|----|------|--------|-----------------|----|
+| FA1 | Ajouter favori | Mettre en favori une page | Apparaît dans les favoris | |
+| FA2 | Retirer favori | Retirer des favoris | Disparaît de la liste | |
+| FA3 | Vue favorites | Tab "Favorites" dans Library | Liste des favoris | |
+| FA4 | Vue shared | Tab "Shared" dans Library | Pages partagées | |
+
+---
+
+## 12. Webhooks & API Publique
+
+| ID | Test | Action | Résultat attendu | ✅ |
+|----|------|--------|-----------------|----|
+| WH1 | Register webhook | POST /api/webhooks/register/{o}/{r} | Webhook enregistré | |
+| WH2 | Webhook status | GET /api/webhooks/status/{o}/{r} | Statut retourné | |
+| WH3 | Reception webhook | Push sur Gitea → webhook reçu | Issue synchronisée | |
+| WH4 | API health | GET /api/health | `{"status":"ok","db":true,"gitea":true}` | |
+| WH5 | API projects | GET /api/projects | Liste JSON des projets | |
+
+---
+
+## 13. PWA & Responsive
+
+| ID | Test | Action | Résultat attendu | ✅ |
+|----|------|--------|-----------------|----|
+| P1 | Mobile view | Réduire fenêtre < 768px | Layout responsive, sidebar masquable | |
+| P2 | Install PWA | "Installer" dans Chrome | Icône sur l'écran d'accueil | |
+| P3 | Offline cache | Couper réseau, recharger | Page servie depuis cache | |
+
+---
+
+## 14. Éditeur Notion-like
+
+| ID | Test | Action | Résultat attendu | ✅ |
+|----|------|--------|-----------------|----|
+| E1 | Éditeur riche | Ouvrir une page | Éditeur bloc-style Notion | |
+| E2 | Blocs texte | Taper du texte, Entrée | Nouveau bloc créé | |
+| E3 | Markdown inline | `**gras**`, `*italique*` | Formatage appliqué | |
+| E4 | `/` commandes | Taper `/` | Menu de commandes (headings, listes, etc.) | |
+| E5 | Drag blocks | Drag & drop blocs | Réorganisation | |
+
+---
+
+## Exécution
+
+```bash
+# Lancer FlowDeck
+cd ~/workspace/flowdeck && docker compose up -d
+
+# Vérifier
+curl -s http://localhost:8082/api/health
+# → {"status":"ok","version":"2.1.0","db":true,"gitea":true}
+
+# Ouvrir
+# Dashboard: http://localhost:8082/
+# Board:     http://localhost:8082/board/bruno/flowdeck
+```
+
+---
+
+**Total: 61 tests** | Dernier run: ________ | Résultat: ___/61

VERSION

@@ -0,0 +1 @@
+7.30.0

WORKLOAD.md

@@ -1,71 +1,77 @@
 # WORKLOAD — FlowDeck Notion Clone
 
-> **Début**: 2026-07-08 | **Version actuelle**: v1.3.0 | **Prochaine**: v1.4.0
+> **Début**: 2026-07-08 | **Version**: v7.30.0 (audit — A28 lot 2 : dashboard.py 2 735 L → package 10 fichiers) | **Statut**: EN COURS 🔄
+> **Cible**: parité Notion + intégration forge · **Follow-ups v7.3 livrés**: sidebar teamspaces, notif `page.updated`, charts `number` + dashboards multi-DB, unfurl forge, UI Settings → Audit — voir `ROADMAP.md § v7.3.0`
 
 ## Avancement Global
 
-| Phase | Description | Statut | Tests |
-|-------|-------------|--------|-------|
-| v0.2 – v0.9 | Base → Backend | ✅ | — |
+| Version | Description | Statut | Tests |
+|---------|-------------|--------|-------|
+| v0.2–v0.9 | Base → Backend | ✅ | — |
 | v1.0 | Production (lifespan, CI/CD) | ✅ | 28/28 |
 | v1.1 | Pages & Sidebar Notion | ✅ | — |
 | v1.2 | Éditeur Notion (slash menu, blocs) | ✅ | — |
 | v1.3 | Database Concept (collections) | ✅ | 34/34 |
-| v1.4 | Propriétés Avancées (14 types) | ⬜ | — |
-| v1.5 | Relations & Rollups | ⬜ | — |
-| v1.6 | Vues Calendrier/Timeline/Gallery/List | ⬜ | — |
-| v1.7 | Vues Améliorées (group_by, card_size) | ⬜ | — |
-| v1.8 | Sub-items & Dépendances | ⬜ | — |
-| v1.9 | My Tasks & Dashboard Unifié | ⬜ | — |
-| v2.0 | Éditeur Complet & Multi-Users | ⬜ | — |
+| v1.4 | Propriétés Avancées (21 types) | ✅ | 38/38 |
+| v1.5 | Relations, Rollups, Formulas | ✅ | 43/43 |
+| v1.6 | Vues (Calendar, Gallery, List, Timeline) | ✅ | 49/49 |
+| v1.7 | Vues Améliorées (view config, save-as) | ✅ | — |
+| v1.8 | Sub-items & Dépendances | ✅ | 56/56 |
+| v1.9 | My Tasks Dashboard | ✅ | 60/60 |
+| v2.0 | Multi-User + Editor Complete | ✅ | 67/67 |
+| v2.1 | Public API, Webhooks, PWA | ✅ | 73/73 |
+| v2.2 | Share/Publish, Favorites, Library | ✅ | 73/73 |
+| v3.0 | Auth locale, Multi-Forge, Standalone | ✅ | — |
+| v4.x–v5.x | MVP → Agent IA, palette, automations, import, calendrier, wiki-links, synced blocks | ✅ | 523+ |
+| v6.0–v6.3 | PWA offline, permissions granulaires, web clipper, API publique v2 | ✅ | 668+ |
+| **v6.4.0** | **Realtime production (merge 3-voix, broadcast non bloquant)** | ✅ | **749+** |
+| **v6.5.0–v6.5.1** | **Synced blocks production (databases/vues) + webhooks v2 complets** | ✅ | **749** |
+| **v6.6.0** | **Agent phase 5 — API publique agent & skill marketplace** | ✅ | **764+** |
+| **v6.7.0** | **SSO / SAML + OIDC entreprise (Enterprise Auth)** | ✅ | **802** |
+| v6.8.0 | Sites multi-pages + Forms publics ([doc](docs/V68_Sites_Forms.md)) | ✅ | 20 |
+| v6.9.0 | Recherche hybride + Ask AI RAG ([doc](docs/V69_Search_Ask_AI.md)) | ✅ | 24 |
+| v7.0.0 | Automations multi-étapes + Workers lite ([doc](docs/V70_Automations_Workers.md)) | ✅ | 31 |
+| v7.1.0 | Calendar sync + Meeting Notes ([doc](docs/V71_Calendar_Meetings.md)) | ✅ | 15 |
+| v7.2.0 | SCIM + 2FA + Audit UI + gouvernance agents ([doc](docs/V72_Enterprise_SCIM_2FA.md)) | ✅ | 52 |
+| v7.3.0 | Teamspaces + Verified + Polish + follow-ups ([doc](docs/V73_Wiki_Teamspaces_Polish.md)) | ✅ | 72 |
 
----
+> **Suites de régression** : `test_v72_enterprise.py` (52) + `test_v73_wiki_polish.py` (72) = **124 verts** · suite complète `-n auto` = **1016 passed**.
+> **Follow-ups v7.3 livrés** (voir § v7.3.0 du `ROADMAP.md`): sidebar par teamspace, charts `number`/multi-DB, notif `page.updated` aux followers, unfurl `gitea:`/`github:`, page Settings → Audit — + 21 casses SSO corrigées (install `python3-saml`/`authlib`).
 
-## v1.3.0 — Database Concept (complété 2026-07-10)
+## Blocs Complétés
 
-### Tables
-- [x] `collections` — base de données abstraite, schéma JSON, lien Gitea optionnel
-- [x] `collection_pages` — pages avec `parent_id`, `property_values_json`, `position`
-- [x] `collection_views` — vues configurables (`view_type`, `config_json`)
-- [x] Index: `idx_cp_collection`, `idx_cp_parent`, `idx_cp_gitea`
+| Bloc | Features | Statut |
+|------|----------|--------|
+| Bloc 1 | Database Concept | ✅ 6/6 |
+| Bloc 2 | Propriétés Avancées | ✅ 14/14 |
+| Bloc 3 | Vues Manquantes | ✅ 10/10 |
+| Bloc 4 | Sub-items & Dépendances | ✅ 7/7 |
+| Bloc 5 | My Tasks | ✅ 7/7 |
+| Bloc 6 | Éditeur Complet | ✅ 8/8 |
+| Bloc 7 | Fonctions Transversales | ✅ |
 
-### API
-- [x] `GET/POST /db/api` — lister/créer collections
-- [x] `GET/PUT/DELETE /db/api/{id}` — CRUD collection
-- [x] `GET/POST /db/{id}/pages/api` — pages dans une collection
-- [x] `GET/PUT/DELETE /db/pages/{id}/api` — CRUD page standalone
-- [x] `GET /db/{id}` — vue HTML collection
-- [x] `GET /db/boards/api` — boards Gitea comme collections
-- [x] `GET /db/board/{o}/{r}/api` — board spécifique
-- [x] `POST /db/board/{o}/{r}/sync` — sync board → collection
+**Total: 52/52 features (100%)**
 
-### Adapter
-- [x] `GiteaBoardCompat` — `from_board()`, `from_card()`, `list_boards_as_collections()`, `sync_to_collection()`
+## Architecture
 
-### Infra
-- [x] CSRF exempté pour `/db/`
-- [x] Version 1.0.0 → 1.3.0
-- [x] 34/34 tests passent
-- [x] Tag git v1.3.0
+### Tables (21)
+`users`, `user_tokens`, `boards`, `cards`, `notes`, `col_mapping`, `checklists`, `checklist_items`, `project_properties`, `property_values`, `ai_keywords`, `pages`, `collections`, `collection_pages`, `collection_views`, `collection_properties`, `workspaces`, `workspace_members`, `comments`, `page_history`, `favorites`, `database_templates`, `page_templates`, `webhook_subscriptions`
 
----
+### Routeurs (11)
+`dashboard`, `board`, `notes`, `api`, `auth`, `webhooks`, `collections`, `my_tasks`, `workspace`, `public_api` + app-level routes
 
-## Prochaines étapes (v1.4.0 — Propriétés Avancées)
+### Services (6)
+`GiteaClient`, `FormulaEngine`, `RollupEngine`, `GiteaBoardCompat`, `property_types`, `webhook_outbound`
 
-### Table `collection_properties`
-- [ ] Remplacer `project_properties` (liée à `project_owner/name`) par `collection_properties` (liée à `collections`)
-- [ ] Types: number, checkbox, url, email, phone, status (9 couleurs), files, unique_id
-- [ ] Auto-propriétés: created_time, created_by, last_edited_time, last_edited_by
-- [ ] Format number: nombre, %, €, $, £, ¥
+### Endpoints (85+)
+CRUD collections/pages, 5 vues HTML, relations/rollups/formulas, sub-items/dependencies, my-tasks, workspaces, comments, history, favorites, templates, CSV import/export, public sharing, public API v1, webhooks, PWA manifest
 
-### Intégration UI
-- [ ] Property editor inline par type (select dropdown, date picker, checkbox...)
-- [ ] Affichage des propriétés dans la modale de détail page
-- [ ] Migration project_properties → collection_properties
+## Stack
 
-## Notes
-
-- **Stack**: FastAPI + Jinja2 + HTMX + Alpine.js + SortableJS + SQLite (WAL)
-- **Docker**: python:3.12-slim, port 8080, volume /data
-- **Tests**: pytest, 34 tests, client TestClient avec SQLite temporaire
+- **Backend**: Python 3.12 + FastAPI + httpx
+- **Frontend**: Jinja2 + HTMX + Alpine.js + SortableJS + CSS 31KB
+- **BDD**: SQLite WAL mode, 21 tables, foreign keys ON
+- **Auth**: OAuth2 Gitea + sessions signed (itsdangerous) + token API
+- **Déploiement**: Docker (python:3.12-slim), docker-compose, port 8080
+- **Tests**: pytest, 764+ tests, TestClient avec SQLite temporaire
 - **CI/CD**: Gitea Actions (.gitea/workflows/ci.yml)

app/auth/__init__.py

@@ -1,3 +1,5 @@
 """FlowDeck — Auth module: session, OAuth2, dependencies."""
 from app.auth.oauth import GiteaOAuth
 from app.auth.session import SessionManager, get_current_user
+
+__all__ = ["GiteaOAuth", "SessionManager", "get_current_user"]

app/auth/oauth.py

@@ -4,9 +4,8 @@ from __future__ import annotations
 import logging
 from urllib.parse import urlencode
 
-import httpx
-
 from app.config import settings
+from app.services.http_client import shared_client
 
 logger = logging.getLogger(__name__)
 
@@ -39,7 +38,7 @@ class GiteaOAuth:
     async def exchange_code(self, code: str) -> dict | None:
         """Exchange authorization code for access token."""
         try:
-            async with httpx.AsyncClient(timeout=15) as client:
+            async with shared_client(timeout=15) as client:
                 resp = await client.post(
                     self.TOKEN_URL,
                     data={
@@ -61,7 +60,7 @@ class GiteaOAuth:
     async def get_user(self, access_token: str) -> dict | None:
         """Get user info from Gitea API."""
         try:
-            async with httpx.AsyncClient(timeout=10) as client:
+            async with shared_client(timeout=10) as client:
                 resp = await client.get(
                     self.USER_URL,
                     headers={"Authorization": f"token {access_token}"},

app/auth/providers/__init__.py

@@ -0,0 +1,262 @@
+"""Multi-forge OAuth providers — Gitea + GitHub."""
+
+from __future__ import annotations
+
+import logging
+import time
+from abc import ABC, abstractmethod
+from urllib.parse import urlencode
+
+from app.services.http_client import shared_client
+
+logger = logging.getLogger(__name__)
+
+
+class OAuthProvider(ABC):
+    """Abstract OAuth2 provider interface."""
+
+    name: str = ""
+    icon: str = "🔗"
+
+    @abstractmethod
+    def is_enabled(self) -> bool:
+        """Whether this provider is configured."""
+
+    @abstractmethod
+    def get_authorize_url(self, state: str, redirect_uri: str | None = None, force_login: bool = False) -> str:
+        """Build the authorization URL."""
+
+    @abstractmethod
+    async def exchange_code(self, code: str, redirect_uri: str | None = None) -> dict | None:
+        """Exchange authorization code for access token."""
+
+    @abstractmethod
+    async def get_user(self, access_token: str) -> dict | None:
+        """Fetch user profile from the provider."""
+
+    @abstractmethod
+    async def list_repositories(self, access_token: str) -> list[dict]:
+        """List all repositories accessible to this user."""
+
+
+class GiteaProvider(OAuthProvider):
+    """Gitea OAuth2 provider."""
+
+    name = "gitea"
+    icon = "🔗"
+
+    def __init__(self, base_url: str, client_id: str, client_secret: str, redirect_uri: str):
+        self.base = base_url.rstrip("/")
+        self.client_id = client_id
+        self.client_secret = client_secret
+        self.redirect_uri = redirect_uri
+
+    def is_enabled(self) -> bool:
+        return bool(self.client_id and self.client_secret)
+
+    def get_authorize_url(self, state: str, redirect_uri: str | None = None, force_login: bool = False) -> str:
+        params = {
+            "client_id": self.client_id,
+            "redirect_uri": redirect_uri or self.redirect_uri,
+            "response_type": "code",
+            "state": state,
+        }
+        if force_login:
+            # Gitea supports prompt=login param (undocumented but works)
+            # If not, fallback: add _force= timestamp cache-buster
+            params["_force"] = str(int(time.time()))
+        return f"{self.base}/login/oauth/authorize?" + urlencode(params)
+
+    async def exchange_code(self, code: str, redirect_uri: str | None = None) -> dict | None:
+        url = f"{self.base}/login/oauth/access_token"
+        data = {
+            "client_id": self.client_id,
+            "client_secret": self.client_secret,
+            "code": code,
+            "grant_type": "authorization_code",
+            "redirect_uri": redirect_uri or self.redirect_uri,
+        }
+        async with shared_client(timeout=15) as client:
+            r = await client.post(url, json=data, headers={"Accept": "application/json"})
+            if r.status_code != 200:
+                logger.error("Gitea token exchange failed: %s", r.text)
+                return None
+            return r.json()
+
+    async def get_user(self, access_token: str) -> dict | None:
+        url = f"{self.base}/api/v1/user"
+        async with shared_client(timeout=15) as client:
+            r = await client.get(url, headers={"Authorization": f"token {access_token}"})
+            if r.status_code != 200:
+                return None
+            data = r.json()
+            return {
+                "login": data.get("login") or data.get("username", ""),
+                "full_name": data.get("full_name", ""),
+                "email": data.get("email", ""),
+                "avatar_url": data.get("avatar_url", ""),
+                "provider_id": str(data.get("id", "")),
+            }
+
+    async def list_repositories(self, access_token: str) -> list[dict]:
+        repos = []
+        async with shared_client(timeout=30) as client:
+            for page in range(1, 6):
+                r = await client.get(
+                    f"{self.base}/api/v1/user/repos",
+                    headers={"Authorization": f"token {access_token}"},
+                    params={"page": page, "limit": 50},
+                )
+                if r.status_code != 200:
+                    break
+                data = r.json()
+                if not data:
+                    break
+                for repo in data:
+                    repos.append({
+                        "id": str(repo.get("id", "")),
+                        "name": repo.get("name", ""),
+                        "full_name": repo.get("full_name", ""),
+                        "description": repo.get("description", ""),
+                        "html_url": repo.get("html_url", ""),
+                        "clone_url": repo.get("clone_url", ""),
+                        "default_branch": repo.get("default_branch", "main"),
+                        "language": repo.get("language", ""),
+                        "updated_at": repo.get("updated_at", ""),
+                        "private": repo.get("private", False),
+                        "forge": "gitea",
+                    })
+        return repos
+
+
+class GitHubProvider(OAuthProvider):
+    """GitHub OAuth2 provider."""
+
+    name = "github"
+    icon = "🐙"
+
+    def __init__(self, client_id: str, client_secret: str, redirect_uri: str):
+        self.client_id = client_id
+        self.client_secret = client_secret
+        self.redirect_uri = redirect_uri
+        self.authorize_url = "https://github.com/login/oauth/authorize"
+        self.token_url = "https://github.com/login/oauth/access_token"
+        self.api_url = "https://api.github.com"
+
+    def is_enabled(self) -> bool:
+        return bool(self.client_id and self.client_secret)
+
+    def get_authorize_url(self, state: str, redirect_uri: str | None = None, force_login: bool = False) -> str:
+        return (
+            f"{self.authorize_url}?"
+            + urlencode({
+                "client_id": self.client_id,
+                "redirect_uri": redirect_uri or self.redirect_uri,
+                "scope": "repo,user",
+                "state": state,
+            })
+        )
+
+    async def exchange_code(self, code: str, redirect_uri: str | None = None) -> dict | None:
+        async with shared_client(timeout=15) as client:
+            r = await client.post(
+                self.token_url,
+                data={
+                    "client_id": self.client_id,
+                    "client_secret": self.client_secret,
+                    "code": code,
+                    "redirect_uri": redirect_uri or self.redirect_uri,
+                },
+                headers={"Accept": "application/json"},
+            )
+            if r.status_code != 200:
+                logger.error("GitHub token exchange failed: %s", r.text)
+                return None
+            data = r.json()
+            if "access_token" not in data:
+                return None
+            return data
+
+    async def get_user(self, access_token: str) -> dict | None:
+        url = f"{self.api_url}/user"
+        async with shared_client(timeout=15) as client:
+            r = await client.get(
+                url,
+                headers={"Authorization": f"Bearer {access_token}", "Accept": "application/vnd.github.v3+json"},
+            )
+            if r.status_code != 200:
+                return None
+            data = r.json()
+            return {
+                "login": data.get("login", ""),
+                "full_name": data.get("name", "") or data.get("login", ""),
+                "email": data.get("email", ""),
+                "avatar_url": data.get("avatar_url", ""),
+                "provider_id": str(data.get("id", "")),
+            }
+
+    async def list_repositories(self, access_token: str) -> list[dict]:
+        repos = []
+        async with shared_client(timeout=30) as client:
+            for page in range(1, 6):
+                r = await client.get(
+                    f"{self.api_url}/user/repos",
+                    headers={"Authorization": f"Bearer {access_token}", "Accept": "application/vnd.github.v3+json"},
+                    params={"page": page, "per_page": 50, "sort": "updated"},
+                )
+                if r.status_code != 200:
+                    break
+                data = r.json()
+                if not data:
+                    break
+                for repo in data:
+                    repos.append({
+                        "id": str(repo.get("id", "")),
+                        "name": repo.get("name", ""),
+                        "full_name": repo.get("full_name", ""),
+                        "description": repo.get("description", ""),
+                        "html_url": repo.get("html_url", ""),
+                        "clone_url": repo.get("clone_url", ""),
+                        "default_branch": repo.get("default_branch", "main"),
+                        "language": repo.get("language", ""),
+                        "updated_at": repo.get("updated_at", ""),
+                        "private": repo.get("private", False),
+                        "forge": "github",
+                    })
+        return repos
+
+
+# ═══════════ Provider registry ═══════════
+
+def get_providers() -> list[OAuthProvider]:
+    """Return all configured OAuth providers."""
+    from app.config import settings
+
+    providers: list[OAuthProvider] = []
+
+    gitea = GiteaProvider(
+        base_url=settings.gitea_url,
+        client_id=settings.gitea_oauth_client_id,
+        client_secret=settings.gitea_oauth_client_secret,
+        redirect_uri=settings.oauth_redirect_uri,
+    )
+    if gitea.is_enabled():
+        providers.append(gitea)
+
+    github = GitHubProvider(
+        client_id=settings.github_oauth_client_id or "",
+        client_secret=settings.github_oauth_client_secret or "",
+        redirect_uri=settings.oauth_redirect_uri or "",
+    )
+    if github.is_enabled():
+        providers.append(github)
+
+    return providers
+
+
+def get_provider(name: str) -> OAuthProvider | None:
+    """Get a specific provider by name."""
+    for p in get_providers():
+        if p.name == name:
+            return p
+    return None

app/auth/providers/oidc_provider.py

@@ -0,0 +1,217 @@
+"""OIDC provider — authorization code flow with PKCE (v6.7.0).
+
+Discovery (``.well-known/openid-configuration``) is cached for an hour, the
+ID token signature is verified against the issuer JWKS via authlib's JOSE
+implementation, and ``iss`` / ``aud`` / ``exp`` / ``nonce`` are checked here
+explicitly so the rules are visible and unit-testable.
+"""
+from __future__ import annotations
+
+import base64
+import hashlib
+import json
+import logging
+import secrets
+import time
+import warnings
+
+from app.services.http_client import shared_client
+
+logger = logging.getLogger(__name__)
+
+#: Default attribute mapping (design doc §3.2) — OIDC claim names.
+DEFAULT_OIDC_MAPPING: dict[str, str] = {
+    "login": "sub",
+    "email": "email",
+    "full_name": "name",
+    "avatar_url": "picture",
+    "groups": "groups",
+}
+
+_DISCOVERY_TTL = 3600.0
+_discovery_cache: dict[str, tuple[float, dict]] = {}
+
+
+class OIDCError(Exception):
+    """OIDC processing failure — ``message`` is user-facing."""
+
+
+def pkce_pair() -> tuple[str, str]:
+    """Return ``(code_verifier, code_challenge)`` for the S256 method."""
+    verifier = secrets.token_urlsafe(64)
+    digest = hashlib.sha256(verifier.encode("ascii")).digest()
+    challenge = base64.urlsafe_b64encode(digest).rstrip(b"=").decode("ascii")
+    return verifier, challenge
+
+
+
+
+def _b64url_decode(data: str) -> bytes:
+    return base64.urlsafe_b64decode(data + "=" * (-len(data) % 4))
+
+
+async def discover(issuer_url: str) -> dict:
+    """Fetch (and cache) the issuer's OIDC discovery document."""
+    issuer = issuer_url.rstrip("/")
+    url = f"{issuer}/.well-known/openid-configuration"
+    now = time.time()
+    hit = _discovery_cache.get(issuer)
+    if hit and now - hit[0] < _DISCOVERY_TTL:
+        return hit[1]
+    try:
+        async with shared_client(timeout=15) as client:
+            r = await client.get(url)
+            r.raise_for_status()
+            doc = r.json()
+    except Exception as err:
+        raise OIDCError(f"OIDC discovery failed ({url}): {err}") from err
+    if not doc.get("authorization_endpoint") or not doc.get("token_endpoint"):
+        raise OIDCError("OIDC discovery document is missing authorization/token endpoints")
+    _discovery_cache[issuer] = (now, doc)
+    return doc
+
+
+def build_authorize_url(
+    doc: dict,
+    *,
+    client_id: str,
+    redirect_uri: str,
+    scope: str,
+    state: str,
+    nonce: str,
+    code_challenge: str,
+) -> str:
+    from urllib.parse import urlencode
+
+    params = {
+        "client_id": client_id,
+        "redirect_uri": redirect_uri,
+        "response_type": "code",
+        "scope": scope or "openid profile email",
+        "state": state,
+        "nonce": nonce,
+        "code_challenge": code_challenge,
+        "code_challenge_method": "S256",
+    }
+    sep = "&" if "?" in doc["authorization_endpoint"] else "?"
+    return doc["authorization_endpoint"] + sep + urlencode(params)
+
+
+async def exchange_code(
+    doc: dict, *, client_id: str, client_secret: str, code: str, redirect_uri: str, code_verifier: str
+) -> dict:
+    """Exchange the authorization code for tokens (PKCE, confidential client)."""
+    data = {
+        "grant_type": "authorization_code",
+        "code": code,
+        "redirect_uri": redirect_uri,
+        "client_id": client_id,
+        "code_verifier": code_verifier,
+    }
+    auth = None
+    if client_secret:
+        auth = (client_id, client_secret)
+    try:
+        async with shared_client(timeout=15) as client:
+            r = await client.post(doc["token_endpoint"], data=data, auth=auth)
+    except Exception as err:
+        raise OIDCError(f"OIDC token request failed: {err}") from err
+    if r.status_code != 200:
+        raise OIDCError(f"OIDC token endpoint returned {r.status_code}: {r.text[:300]}")
+    try:
+        tokens = r.json()
+    except Exception as err:
+        raise OIDCError(f"OIDC token endpoint returned a non-JSON body: {err}") from err
+    if "error" in tokens:
+        raise OIDCError(f"OIDC error: {tokens.get('error')} {tokens.get('error_description', '')}".strip())
+    return tokens
+
+
+async def fetch_userinfo(doc: dict, access_token: str) -> dict:
+    """Best-effort userinfo fetch (groups often only live there)."""
+    endpoint = doc.get("userinfo_endpoint")
+    if not endpoint or not access_token:
+        return {}
+    try:
+        async with shared_client(timeout=15) as client:
+            r = await client.get(endpoint, headers={"Authorization": f"Bearer {access_token}"})
+        if r.status_code != 200:
+            return {}
+        data = r.json()
+        return data if isinstance(data, dict) else {}
+    except Exception as err:  # userinfo is optional enrichment
+        logger.debug("userinfo fetch failed: %s", err)
+        return {}
+
+
+def validate_id_token(
+    id_token: str, *, issuer: str, client_id: str, nonce: str, jwks: dict
+) -> dict:
+    """Verify the ID token signature and claims. Returns the claims dict."""
+    with warnings.catch_warnings():
+        warnings.simplefilter("ignore", DeprecationWarning)
+        from authlib.jose import JsonWebKey
+        from authlib.jose import jwt as jose_jwt
+
+    if isinstance(id_token, bytes):
+        # authlib's jose.jwt.encode() returns bytes; IdP token endpoints send
+        # str — accept both instead of crashing on ``bytes.count(".")``.
+        id_token = id_token.decode()
+    if not id_token or id_token.count(".") != 2:
+        raise OIDCError("Missing or malformed ID token")
+
+    try:
+        keyset = JsonWebKey.import_key_set(jwks)
+    except Exception as err:
+        raise OIDCError(f"Invalid issuer JWKS: {err}") from err
+
+    try:
+        # Pick the key matching the token header (kid) when several are offered.
+        header = json.loads(_b64url_decode(id_token.split(".")[0]))
+        kid = header.get("kid")
+        key = keyset.get_by_kid(kid) if kid and hasattr(keyset, "get_by_kid") else None
+        token_obj = jose_jwt.decode(id_token, key or keyset)
+    except Exception as err:
+        raise OIDCError(f"ID token signature verification failed: {err}") from err
+
+    claims = dict(token_obj)  # authlib's JWTClaims is a dict subclass
+    now = int(time.time())
+
+    if claims.get("iss") != issuer.rstrip("/") and claims.get("iss") != issuer:
+        raise OIDCError(f"ID token issuer mismatch: {claims.get('iss')!r}")
+    aud = claims.get("aud")
+    aud_list = aud if isinstance(aud, list) else [aud]
+    if client_id not in aud_list:
+        raise OIDCError("ID token audience does not include this client")
+    exp = claims.get("exp")
+    if not isinstance(exp, int) or exp < now:
+        raise OIDCError("ID token expired")
+    iat = claims.get("iat")
+    if isinstance(iat, int) and iat > now + 300:
+        raise OIDCError("ID token issued in the future")
+    if nonce and claims.get("nonce") != nonce:
+        raise OIDCError("ID token nonce mismatch")
+    if not claims.get("sub"):
+        raise OIDCError("ID token has no subject")
+    return claims
+
+
+def claims_to_identity(claims: dict, mapping: dict | None = None) -> dict:
+    """Map OIDC claims onto the shared ``{login, email, full_name, avatar_url, groups}`` shape."""
+    mapping = mapping or DEFAULT_OIDC_MAPPING
+    identity: dict = {"_raw": claims}
+    for field in ("login", "email", "full_name", "avatar_url"):
+        source = mapping.get(field) or field
+        value = claims.get(source, "")
+        if isinstance(value, list):
+            value = value[0] if value else ""
+        identity[field] = str(value or "").strip()
+    groups = claims.get(mapping.get("groups", "groups"), [])
+    if isinstance(groups, str):
+        groups = [groups]
+    identity["groups"] = [str(g) for g in groups if g]
+    if not identity["email"]:
+        identity["email"] = claims.get("email", "") or ""
+    if not identity["full_name"]:
+        identity["full_name"] = claims.get("name", "") or identity["email"]
+    return identity

app/auth/providers/saml_provider.py

@@ -0,0 +1,279 @@
+"""SAML 2.0 Service Provider — wrapper around python3-saml (OneLogin toolkit).
+
+v6.7.0. Adapts FastAPI's ``Request`` to the toolkit's flat ``request_data``
+dict and builds the SP settings from the ``sso_config`` row.
+
+What the toolkit validates in strict mode (all covered by tests):
+XML schema, signature of the assertion and/or the message against the IdP
+certificate, ``Conditions`` timestamps, ``Audience``, ``Destination``,
+``Issuer``, ``Status``, "exactly one assertion", and ``InResponseTo``
+against the AuthnRequest id we pass to ``process_response()`` — combined
+with the single-use ``sso_requests`` store that makes replay impossible.
+"""
+from __future__ import annotations
+
+import logging
+from dataclasses import dataclass, field
+
+from fastapi import Request
+
+logger = logging.getLogger(__name__)
+
+BINDING_HTTP_REDIRECT = "urn:oasis:names:tc:SAML:2.0:bindings:HTTP-Redirect"
+BINDING_HTTP_POST = "urn:oasis:names:tc:SAML:2.0:bindings:HTTP-POST"
+NAMEID_FORMAT_EMAIL = "urn:oasis:names:tc:SAML:1.1:nameid-format:emailAddress"
+
+#: Default attribute mapping (design doc §3.2). ``nameid`` = the assertion's
+#: NameID; every other value is matched against attribute Name / FriendlyName
+#: / URI local part (so ``email`` finds both ``email`` and
+#: ``http://schemas.xmlsoap.org/ws/2005/05/identity/claims/emailaddress``).
+DEFAULT_SAML_MAPPING: dict[str, str] = {
+    "login": "nameid",
+    "email": "nameid",
+    "full_name": "displayName",
+    "avatar_url": "avatar",
+    "groups": "groups",
+}
+
+
+class SAMLError(Exception):
+    """SAML processing failure — ``message`` is user-facing, ``reason`` is logged."""
+
+
+@dataclass
+class SAMLIdentity:
+    """What a validated assertion tells us about the user."""
+
+    name_id: str
+    name_id_format: str = ""
+    session_index: str = ""
+    attributes: dict[str, list[str]] = field(default_factory=dict)
+    friendly_attributes: dict[str, list[str]] = field(default_factory=dict)
+
+    def resolve(self, source: str) -> str:
+        """Resolve one mapped source (``nameid`` or an attribute name) → first value."""
+        if not source or source == "nameid":
+            return self.name_id or ""
+        if source in self.attributes and self.attributes[source]:
+            return (self.attributes[source][0] or "").strip()
+        # FriendlyName match (case-insensitive)
+        lower = {k.lower(): v for k, v in self.friendly_attributes.items()}
+        if source.lower() in lower and lower[source.lower()]:
+            return (lower[source.lower()][0] or "").strip()
+        # URI local part match: ".../claims/emailaddress" ~ "emailaddress", and
+        # a mapping of "email" must still find ".../claims/emailaddress".
+        want = source.lower().lstrip("./")
+        for name, values in self.attributes.items():
+            if not values:
+                continue
+            local = name.rsplit("/", 1)[-1].rsplit("}", 1)[-1].lower()
+            if local == want or local.endswith(want) or want.endswith(local):
+                return (values[0] or "").strip()
+        return ""
+
+
+def external_base_url(request: Request) -> str:
+    """Scheme://host the user actually used (proxy-aware, like OAuth redirects)."""
+    proto = request.headers.get("x-forwarded-proto", "")
+    scheme = proto.split(",")[0].strip() or request.url.scheme or "http"
+    fwd_host = request.headers.get("x-forwarded-host", "")
+    host = fwd_host.split(",")[0].strip() or request.headers.get("host", "localhost:8080")
+    return f"{scheme}://{host}"
+
+
+def saml_endpoints(request: Request) -> dict[str, str]:
+    """SP entity id + ACS/SLO/metadata URLs derived from the incoming request."""
+    base = external_base_url(request)
+    return {
+        "entity_id": f"{base}/auth/saml/metadata",
+        "acs": f"{base}/auth/saml/callback",
+        "slo": f"{base}/auth/saml/logout",
+        "metadata": f"{base}/auth/saml/metadata",
+    }
+
+
+def build_settings(cfg: dict, endpoints: dict[str, str]) -> dict:
+    """python3-saml settings dict built from a ``sso_config`` row."""
+    sign_requests = bool(cfg.get("sign_requests"))
+    sp: dict = {
+        "entityId": endpoints["entity_id"],
+        "assertionConsumerService": {
+            "url": endpoints["acs"],
+            "binding": BINDING_HTTP_POST,
+        },
+        "singleLogoutService": {
+            "url": endpoints["slo"],
+            "binding": BINDING_HTTP_REDIRECT,
+        },
+        "NameIDFormat": NAMEID_FORMAT_EMAIL,
+    }
+    if cfg.get("sp_private_key") and cfg.get("sp_certificate"):
+        sp["privateKey"] = cfg["sp_private_key"]
+        sp["x509cert"] = cfg["sp_certificate"]
+
+    idp: dict = {
+        "entityId": cfg.get("entity_id") or "",
+        "singleSignOnService": {
+            "url": cfg.get("sso_url") or "",
+            "binding": BINDING_HTTP_REDIRECT,
+        },
+        "x509cert": cfg.get("x509_certificate") or "",
+    }
+    if cfg.get("slo_url"):
+        idp["singleLogoutService"] = {"url": cfg["slo_url"], "binding": BINDING_HTTP_REDIRECT}
+
+    return {
+        "strict": True,
+        "debug": False,
+        "sp": sp,
+        "idp": idp,
+        "security": {
+            "authnRequestsSigned": sign_requests,
+            "logoutRequestSigned": sign_requests,
+            "logoutResponseSigned": False,
+            "wantMessagesSigned": False,
+            "wantAssertionsSigned": True,
+            "wantNameIdEncrypted": False,
+            "wantAssertionsEncrypted": False,
+            "wantXmlValidation": True,
+            "signatureAlgorithm": "http://www.w3.org/2001/04/xmldsig-more#rsa-sha256",
+            "digestAlgorithm": "http://www.w3.org/2001/04/xmlenc#sha256",
+            "rejectDeprecatedAlgorithm": True,
+            # FlowDeck is self-hosted: LAN/homelab deploys commonly reach the
+            # SP through single-label hosts (http://flowdeck/, docker service
+            # names). python3-saml rejects those URLs unless this is on.
+            "allowSingleLabelDomains": True,
+        },
+    }
+
+
+def _request_data(request: Request, script_name: str, post_data: dict | None = None) -> dict:
+    """Flat request dict expected by ``OneLogin_Saml2_Auth``."""
+    https = "on" if external_base_url(request).startswith("https") else "off"
+    return {
+        "https": https,
+        "http_host": request.headers.get("host", "localhost:8080"),
+        "script_name": script_name,
+        "request_uri": request.url.path,
+        "query_string": str(request.url.query or ""),
+        "get_data": dict(request.query_params),
+        "post_data": post_data or {},
+    }
+
+
+def _auth(request: Request, cfg: dict, script_name: str, post_data: dict | None = None):
+    from onelogin.saml2.auth import OneLogin_Saml2_Auth
+
+    settings = build_settings(cfg, saml_endpoints(request))
+    try:
+        return OneLogin_Saml2_Auth(
+            _request_data(request, script_name, post_data=post_data), old_settings=settings
+        )
+    except Exception as err:  # malformed IdP/SP config (bad cert, missing URL…)
+        raise SAMLError(f"Invalid SAML configuration: {err}") from err
+
+
+def create_login(request: Request, cfg: dict, relay_state: str) -> tuple[str, str]:
+    """Build the AuthnRequest. Returns ``(redirect_url, authn_request_id)``."""
+    auth = _auth(request, cfg, "/auth/saml/login")
+    try:
+        url = auth.login(return_to=relay_state)
+    except Exception as err:
+        raise SAMLError(f"Could not build the SAML AuthnRequest: {err}") from err
+    request_id = auth.get_last_request_id() or ""
+    if not request_id:
+        raise SAMLError("AuthnRequest was built without an id")
+    return url, request_id
+
+
+def process_response(request: Request, cfg: dict, post_data: dict, request_id: str) -> SAMLIdentity:
+    """Validate the IdP's SAMLResponse and extract the identity.
+
+    ``request_id`` is the id of the AuthnRequest we issued (from the
+    single-use ``sso_requests`` row): the toolkit rejects any response whose
+    ``InResponseTo`` does not match it.
+    """
+    auth = _auth(request, cfg, "/auth/saml/callback", post_data=post_data)
+    try:
+        auth.process_response(request_id=request_id or None)
+    except Exception as err:
+        raise SAMLError(f"SAML response could not be processed: {err}") from err
+
+    errors = auth.get_errors()
+    if errors:
+        raise SAMLError(auth.get_last_error_reason() or f"SAML errors: {', '.join(errors)}")
+    if not auth.is_authenticated():
+        raise SAMLError("SAML response did not authenticate the user")
+
+    name_id = auth.get_nameid() or ""
+    if not name_id:
+        raise SAMLError("SAML assertion carries no NameID")
+    return SAMLIdentity(
+        name_id=name_id,
+        name_id_format=auth.get_nameid_format() or "",
+        session_index=auth.get_session_index() or "",
+        attributes=auth.get_attributes() or {},
+        friendly_attributes=auth.get_friendlyname_attributes() or {},
+    )
+
+
+def metadata_xml(request: Request, cfg: dict) -> str:
+    """SP metadata XML (for the IdP configuration screen)."""
+    from onelogin.saml2.settings import OneLogin_Saml2_Settings
+
+    settings = OneLogin_Saml2_Settings(
+        build_settings(cfg, saml_endpoints(request)), custom_base_path=None
+    )
+    try:
+        xml = settings.get_sp_metadata()
+    except Exception as err:
+        raise SAMLError(f"Could not build the SP metadata: {err}") from err
+    if isinstance(xml, bytes):
+        xml = xml.decode("utf-8")
+    return xml
+
+
+def build_logout_url(request: Request, cfg: dict, return_to: str, name_id: str, session_index: str) -> str:
+    """SP-initiated Single Logout (HTTP-Redirect LogoutRequest to the IdP)."""
+    auth = _auth(request, cfg, "/auth/saml/logout")
+    if not cfg.get("slo_url"):
+        raise SAMLError("The IdP has no Single Logout URL configured")
+    try:
+        return auth.logout(
+            return_to=return_to,
+            name_id=name_id or None,
+            session_index=session_index or None,
+        )
+    except Exception as err:
+        raise SAMLError(f"Could not build the SAML LogoutRequest: {err}") from err
+
+
+def process_slo_form(request: Request, cfg: dict, form: dict, query: dict) -> tuple[str | None, list[str]]:
+    """Process a LogoutRequest / LogoutResponse received from the IdP.
+
+    ``form`` holds the POSTed fields, ``query`` the GET parameters (the
+    HTTP-Redirect binding delivers LogoutRequest/LogoutResponse there).
+    Returns ``(redirect_url, errors)``.
+    """
+    from onelogin.saml2.auth import OneLogin_Saml2_Auth
+
+    settings = build_settings(cfg, saml_endpoints(request))
+    https = "on" if external_base_url(request).startswith("https") else "off"
+    post_data = {k: v for k, v in form.items() if k in ("SAMLRequest", "SAMLResponse", "RelayState")}
+    if not post_data:
+        post_data = {"SAMLResponse": query["SAMLResponse"]} if "SAMLResponse" in query else {}
+    req_data = {
+        "https": https,
+        "http_host": request.headers.get("host", "localhost:8080"),
+        "script_name": "/auth/saml/logout",
+        "request_uri": request.url.path,
+        "query_string": str(request.url.query or ""),
+        "get_data": dict(query),
+        "post_data": post_data,
+    }
+    auth = OneLogin_Saml2_Auth(req_data, old_settings=settings)
+    try:
+        url = auth.process_slo(keep_local_session=True)
+    except Exception as err:
+        raise SAMLError(f"SAML logout could not be processed: {err}") from err
+    return url, auth.get_errors()

app/auth/session.py

@@ -1,26 +1,43 @@
 """FlowDeck — Session management with signed cookies."""
 from __future__ import annotations
 
-import json
-from datetime import datetime, timedelta
+import logging
+from datetime import UTC, datetime
+from uuid import uuid4
 
-from itsdangerous import URLSafeTimedSerializer, BadSignature, SignatureExpired
+from itsdangerous import BadSignature, SignatureExpired, URLSafeTimedSerializer
 
 from app.config import settings
 
+logger = logging.getLogger(__name__)
+
 _serializer = URLSafeTimedSerializer(settings.app_secret_key)
 
 
 class SessionManager:
-    """Manages user sessions via signed cookies."""
+    """Manages user sessions via signed cookies (v5.2.0: revocable).
+
+    Each cookie embeds a ``sid`` referencing a row in ``user_sessions``.
+    Revoking that row instantly invalidates the cookie (checked in
+    ``decode_session``). Legacy cookies without a ``sid`` stay valid.
+    """
 
     @staticmethod
-    def create_session(user_data: dict) -> str:
-        """Create a signed session cookie value."""
+    def create_session(user_data: dict, request=None) -> str:
+        """Create a signed session cookie value.
+
+        ``request`` is optional — when provided the session is recorded in the
+        ``user_sessions`` table (ip + user agent) and becomes revocable.
+        """
         payload = {
             "user": user_data,
-            "created_at": datetime.utcnow().isoformat(),
+            "created_at": datetime.now(UTC).replace(tzinfo=None).isoformat(),
         }
+        user_id = user_data.get("id")
+        if user_id:
+            sid = str(uuid4())
+            payload["sid"] = sid
+            _record_session(sid, user_id, request)
         return _serializer.dumps(payload)
 
     @staticmethod
@@ -28,10 +45,65 @@ class SessionManager:
         """Decode and validate a session cookie. Returns user data or None."""
         try:
             payload = _serializer.loads(cookie, max_age=86400 * 7)  # 7 days
-            return payload.get("user")
         except (BadSignature, SignatureExpired):
             return None
 
+        sid = payload.get("sid") or ""
+        if sid and not _session_active(sid):
+            # Revoked or deleted session → treat as logged out.
+            return None
+        if sid:
+            _touch_session(sid)
+        return payload.get("user")
+
+    @staticmethod
+    def session_id(cookie: str) -> str | None:
+        """Return the session id embedded in a cookie (or None)."""
+        try:
+            payload = _serializer.loads(cookie, max_age=86400 * 7)
+            return payload.get("sid")
+        except (BadSignature, SignatureExpired):
+            return None
+
+    @staticmethod
+    def list_sessions(user_id: int) -> list[dict]:
+        """All recorded sessions for a user (for the Settings UI)."""
+        from app.db import get_conn
+        with get_conn() as conn:
+            rows = conn.execute(
+                "SELECT id, ip_address, user_agent, created_at, last_seen_at, revoked "
+                "FROM user_sessions WHERE user_id=? ORDER BY last_seen_at DESC",
+                (user_id,),
+            ).fetchall()
+        return [dict(r) for r in rows]
+
+    @staticmethod
+    def revoke_session(sid: str) -> bool:
+        """Revoke a session row. Returns True if a row was updated."""
+        from app.db import get_conn
+        with get_conn() as conn:
+            cur = conn.execute(
+                "UPDATE user_sessions SET revoked=1 WHERE id=? AND revoked=0", (sid,)
+            )
+            conn.commit()
+            return cur.rowcount > 0
+
+    @staticmethod
+    def refresh_session(cookie: str, user_data: dict, request=None) -> str:
+        """Re-sign a cookie keeping its session id (used after profile edits)."""
+        sid = SessionManager.session_id(cookie) if cookie else None
+        payload = {
+            "user": user_data,
+            "created_at": datetime.now(UTC).replace(tzinfo=None).isoformat(),
+        }
+        user_id = user_data.get("id")
+        if user_id:
+            if sid is None:
+                sid = str(uuid4())
+                _record_session(sid, user_id, request)
+            payload["sid"] = sid
+        return _serializer.dumps(payload)
+
     @staticmethod
     def store_token(user_id: int, gitea_token: str) -> None:
         """Store a user's Gitea OAuth token in SQLite."""
@@ -58,10 +130,53 @@ class SessionManager:
         return row["gitea_token"] if row else None
 
 
+def _record_session(sid: str, user_id: int, request) -> None:
+    ip = ""
+    ua = ""
+    if request is not None:
+        ip = request.client.host if getattr(request, "client", None) else ""
+        ua = (request.headers.get("user-agent", "") or "")[:500]
+    try:
+        from app.db import get_conn
+        with get_conn() as conn:
+            conn.execute(
+                "INSERT INTO user_sessions (id, user_id, ip_address, user_agent) VALUES (?, ?, ?, ?)",
+                (sid, user_id, ip, ua),
+            )
+            conn.commit()
+    except Exception as exc:  # table may not exist in very old installs
+        logger.debug("session record skipped: %s", exc)
+
+
+def _session_active(sid: str) -> bool:
+    try:
+        from app.db import get_conn
+        with get_conn() as conn:
+            row = conn.execute(
+                "SELECT revoked FROM user_sessions WHERE id=?", (sid,)
+            ).fetchone()
+        return bool(row and not row["revoked"])
+    except Exception:
+        # No table / DB unavailable → keep the cookie valid (fail-open-safe).
+        return True
+
+
+def _touch_session(sid: str) -> None:
+    try:
+        from app.db import get_conn
+        with get_conn() as conn:
+            conn.execute(
+                "UPDATE user_sessions SET last_seen_at=CURRENT_TIMESTAMP WHERE id=? AND revoked=0",
+                (sid,),
+            )
+            conn.commit()
+    except Exception:
+        logger.exception("_touch_session")
+
+
 # FastAPI dependency
-async def get_current_user(request) -> dict | None:
+def get_current_user(request) -> dict | None:
     """FastAPI dependency: extract current user from session cookie."""
-    from fastapi import Request
     session = request.cookies.get("flowdeck_session")
     if session:
         return SessionManager.decode_session(session)

app/config.py

@@ -1,11 +1,22 @@
 """FlowDeck — Configuration via pydantic-settings."""
 from __future__ import annotations
 
+import os
 from pathlib import Path
+
 from pydantic_settings import BaseSettings, SettingsConfigDict
 
 
 class Settings(BaseSettings):
+    @property
+    def data_dir(self) -> str:
+        """Racine des fichiers (avatars, uploads…).
+
+        Pas un champ : la lecture est faite à chaque accès parce que les tests
+        monkeypatchent `FLOWDECK_DATA_DIR` en cours de vie (A42 — les 9 copies
+        de `Path(os.environ.get("FLOWDECK_DATA_DIR", "/data"))` vont ici).
+        """
+        return os.environ.get("FLOWDECK_DATA_DIR", "/data")
     model_config = SettingsConfigDict(
         env_file=".env", env_file_encoding="utf-8", extra="ignore"
     )
@@ -13,12 +24,17 @@ class Settings(BaseSettings):
     # Gitea
     gitea_url: str = "https://git.dracodev.net"
     gitea_token: str = "change-me"
-    gitea_oauth_client_id: str = ""
-    gitea_oauth_client_secret: str = ""
+    gitea_oauth_client_id: str = "test-id"
+    gitea_oauth_client_secret: str = "test-secret"
     gitea_webhook_secret: str = ""
 
-    # OAuth2
-    oauth_redirect_uri: str = "http://localhost:8080/auth/callback"
+    # GitHub
+    github_oauth_client_id: str = ""
+    github_oauth_client_secret: str = ""
+
+    # OAuth2 — empty = dynamic per-request redirect URI (Host + X-Forwarded-*),
+    # set this ONLY to pin an exact URI (must be registered in Gitea/GitHub)
+    oauth_redirect_uri: str = ""
 
     # Webhook
     webhook_base_url: str = "http://localhost:8080"
@@ -34,6 +50,10 @@ class Settings(BaseSettings):
     rate_limit_enabled: bool = True
     rate_limit_requests: int = 60  # per minute
 
+    # Public API v2 (v6.3.0)
+    public_api_insecure_ok: bool = False  # if True, fd-public-key is accepted (dev only)
+    api_v2_rate_limit_per_token: int = 300  # req/min per token for /api/v2
+
     # Database
     database_url: str = "sqlite:////data/flowdeck.db"
 
@@ -41,12 +61,84 @@ class Settings(BaseSettings):
     sync_interval: int = 60
     gitea_cache_ttl: int = 30
 
+    # Backup (v5.2.0) — scheduled daily snapshot of the SQLite file
+    backup_enabled: bool = True
+    backup_dir: str = "/data/backups"
+    backup_interval_hours: int = 24
+    backup_keep: int = 30
+
+    # Forge projects sync (v5.2.0) — periodic refresh of `projects` table
+    project_sync_enabled: bool = True
+    project_sync_interval_hours: int = 1
+
+    # Reminders (v5.8.0) — background scan for due date reminders
+    reminders_enabled: bool = True
+    reminder_scan_interval_seconds: int = 60
+
+    # Webhooks outbound (v6.4.0) — retry of failed deliveries
+    webhook_retry_enabled: bool = True
+    webhook_retry_interval_seconds: int = 60
+
+    # Email / SMTP notifications (v4.9.0) — optional. If smtp_host is empty,
+    # email notifications are skipped (only in-app notifications are delivered).
+    smtp_host: str = ""
+    smtp_port: int = 587
+    smtp_user: str = ""
+    smtp_password: str = ""
+    smtp_from: str = "FlowDeck <[email protected]>"
+    smtp_use_tls: bool = True
+    app_base_url: str = "http://localhost:8080"
+
+    # SSO / SAML + OIDC (v6.7.0) — bootstrap fallback ONLY: as soon as an admin
+    # saves a configuration in Settings → Admin → SSO / Enterprise, the
+    # `sso_config` table wins (see app/services/sso_provisioning.py).
+    sso_provider: str = ""               # 'saml' | 'oidc' | '' (disabled)
+    sso_name: str = "Company SSO"         # button label on the login page
+    sso_entity_id: str = ""               # SAML: IdP entity id
+    sso_sso_url: str = ""                 # SAML: IdP SSO URL (HTTP-Redirect)
+    sso_slo_url: str = ""                 # SAML: IdP Single Logout URL
+    sso_x509_certificate: str = ""        # SAML: IdP signing certificate (PEM)
+    sso_issuer_url: str = ""              # OIDC: issuer identifier
+    sso_client_id: str = ""               # OIDC: client id
+    sso_client_secret: str = ""           # OIDC: client secret (env only)
+    sso_scope: str = "openid profile email"
+    sso_attribute_mapping: str = ""       # JSON, defaults per provider
+    sso_groups_mapping: str = "[]"        # JSON [{sso_group, workspace_role, workspace_id}]
+    sso_auto_provision: bool = True
+    sso_only: bool = False                # refuse local login when true
+    sso_sign_requests: bool = False       # sign AuthnRequest / LogoutRequest
+    sso_default_workspace_id: int = 0
+
+    # FlowDeck Agent (v4.10.0) — multi-LLM. Empty keys → offline/mock mode
+    # (deterministic rule-based planner so the agent works without any API key).
+    agent_enabled: bool = True
+    llm_provider: str = "offline"      # any id from llm_client.PROVIDERS
+                                       # (openai, anthropic, mistral, cohere,
+                                       #  google, groq, deepseek, openrouter,
+                                       #  nvidia, together, perplexity, xai,
+                                       #  qwencloud, minimax, morph, fireworks,
+                                       #  cerebras, sambanova, chutes, xiaomi,
+                                       #  sealion, sensenova, ollama, offline)
+    llm_model: str = "gpt-4o"
+    llm_api_key: str = ""
+    llm_api_base: str = ""             # custom base URL (Ollama, OpenRouter, ...)
+    agent_max_iterations: int = 12
+    agent_max_tokens_budget: int = 500000
+    agent_run_timeout_seconds: int = 300
+
     @property
     def db_path(self) -> Path:
         if self.database_url == "sqlite:///:memory:":
             return Path(":memory:")  # Special SQLite in-memory
         if self.database_url.startswith("sqlite:///"):
-            return Path(self.database_url.replace("sqlite:///", "/"))
+            p = self.database_url.replace("sqlite:///", "", 1)
+            # On Windows, don't prepend / if path starts with a drive letter
+            import re
+            if re.match(r'^[a-zA-Z]:', p):
+                return Path(p)
+            # A26 : `sqlite:////data/flowdeck.db` donne p='/data/…' — un simple
+            # concat '/'+'/' → '//data/…' = chemin UNC sous Windows. On normalise.
+            return Path("/" + p.lstrip("/"))
         return Path("/data/flowdeck.db")
 
 

app/db.py

@@ -27,10 +27,24 @@ def init_db():
                 full_name TEXT NOT NULL DEFAULT '',
                 email TEXT NOT NULL DEFAULT '',
                 avatar_url TEXT NOT NULL DEFAULT '',
-                is_admin BOOLEAN NOT NULL DEFAULT 0,
+                avatar_color TEXT NOT NULL DEFAULT '#3A3A3A',
+                password_hash TEXT,
+                is_admin INTEGER NOT NULL DEFAULT 0,
+                is_active INTEGER NOT NULL DEFAULT 1,
+                last_login TIMESTAMP,
+                login_attempts INTEGER NOT NULL DEFAULT 0,
+                locked_until TIMESTAMP,
                 created_at TIMESTAMP DEFAULT CURRENT_TIMESTAMP
             );
 
+            CREATE TABLE IF NOT EXISTS login_history (
+                id INTEGER PRIMARY KEY AUTOINCREMENT,
+                user_id INTEGER NOT NULL REFERENCES users(id),
+                ip_address TEXT DEFAULT '',
+                user_agent TEXT DEFAULT '',
+                logged_at TIMESTAMP DEFAULT CURRENT_TIMESTAMP
+            );
+
             CREATE TABLE IF NOT EXISTS user_tokens (
                 id INTEGER PRIMARY KEY AUTOINCREMENT,
                 gitea_user_id INTEGER NOT NULL UNIQUE,
@@ -39,6 +53,19 @@ def init_db():
                 updated_at TIMESTAMP DEFAULT CURRENT_TIMESTAMP
             );
 
+            CREATE TABLE IF NOT EXISTS user_oauth_tokens (
+                id INTEGER PRIMARY KEY AUTOINCREMENT,
+                user_id INTEGER NOT NULL REFERENCES users(id),
+                provider TEXT NOT NULL,
+                access_token TEXT NOT NULL,
+                refresh_token TEXT,
+                expires_at TIMESTAMP,
+                instance_url TEXT DEFAULT '',
+                created_at TIMESTAMP DEFAULT CURRENT_TIMESTAMP,
+                updated_at TIMESTAMP DEFAULT CURRENT_TIMESTAMP,
+                UNIQUE(user_id, provider)
+            );
+
             CREATE TABLE IF NOT EXISTS boards (
                 id INTEGER PRIMARY KEY AUTOINCREMENT,
                 project_owner TEXT NOT NULL,
@@ -105,8 +132,8 @@ def init_db():
                 project_owner TEXT NOT NULL,
                 project_name TEXT NOT NULL,
                 name TEXT NOT NULL,
-                prop_type TEXT NOT NULL DEFAULT 'select',  -- select, multi_select, date, person, text
-                options_json TEXT DEFAULT '[]',             -- for select/multi_select
+                prop_type TEXT NOT NULL DEFAULT 'select',
+                options_json TEXT DEFAULT '[]',
                 position INTEGER NOT NULL DEFAULT 0,
                 created_at TIMESTAMP DEFAULT CURRENT_TIMESTAMP,
                 UNIQUE(project_owner, project_name, name)
@@ -134,10 +161,13 @@ def init_db():
             CREATE TABLE IF NOT EXISTS pages (
                 id INTEGER PRIMARY KEY AUTOINCREMENT,
                 workspace TEXT NOT NULL,
+                workspace_id INTEGER REFERENCES workspaces(id),
                 title TEXT NOT NULL DEFAULT 'New page',
                 content TEXT NOT NULL DEFAULT '',
                 parent_section TEXT DEFAULT 'Private',
                 parent_id INTEGER REFERENCES pages(id),
+                share_mode TEXT DEFAULT 'private',
+                published INTEGER DEFAULT 0,
                 created_at TIMESTAMP DEFAULT CURRENT_TIMESTAMP,
                 updated_at TIMESTAMP DEFAULT CURRENT_TIMESTAMP
             );
@@ -162,7 +192,7 @@ def init_db():
                 id INTEGER PRIMARY KEY AUTOINCREMENT,
                 collection_id INTEGER NOT NULL REFERENCES collections(id) ON DELETE CASCADE,
                 title TEXT NOT NULL DEFAULT '',
-                icon TEXT DEFAULT '📄',
+                icon TEXT DEFAULT 'file',
                 position INTEGER NOT NULL DEFAULT 0,
                 parent_id INTEGER REFERENCES collection_pages(id),
                 gitea_issue_id INTEGER,
@@ -244,14 +274,16 @@ def init_db():
                 created_at TIMESTAMP DEFAULT CURRENT_TIMESTAMP
             );
 
+            -- v2.2.0: Migrate favorites — drop old schema referencing collection_pages
+            DROP TABLE IF EXISTS favorites;
+
             CREATE TABLE IF NOT EXISTS favorites (
                 id INTEGER PRIMARY KEY AUTOINCREMENT,
                 user_id INTEGER NOT NULL REFERENCES users(id),
-                page_id INTEGER REFERENCES collection_pages(id),
-                collection_id INTEGER REFERENCES collections(id),
+                page_id INTEGER NOT NULL REFERENCES pages(id),
                 position INTEGER NOT NULL DEFAULT 0,
                 created_at TIMESTAMP DEFAULT CURRENT_TIMESTAMP,
-                UNIQUE(user_id, page_id, collection_id)
+                UNIQUE(user_id, page_id)
             );
 
             CREATE TABLE IF NOT EXISTS database_templates (
@@ -270,12 +302,36 @@ def init_db():
                 content_json TEXT DEFAULT '[]',
                 created_at TIMESTAMP DEFAULT CURRENT_TIMESTAMP
             );
+
+            -- v2.2.0: Tags system
+            CREATE TABLE IF NOT EXISTS tags (
+                id INTEGER PRIMARY KEY AUTOINCREMENT,
+                name TEXT NOT NULL,
+                color TEXT DEFAULT '#787774',
+                user_id INTEGER NOT NULL DEFAULT 0 REFERENCES users(id),
+                created_at TIMESTAMP DEFAULT CURRENT_TIMESTAMP,
+                UNIQUE(name, user_id)
+            );
+
+            CREATE TABLE IF NOT EXISTS page_tags (
+                page_id INTEGER NOT NULL REFERENCES pages(id) ON DELETE CASCADE,
+                tag_id INTEGER NOT NULL REFERENCES tags(id) ON DELETE CASCADE,
+                created_at TIMESTAMP DEFAULT CURRENT_TIMESTAMP,
+                PRIMARY KEY (page_id, tag_id)
+            );
+            CREATE INDEX IF NOT EXISTS idx_pt_page ON page_tags(page_id);
+            CREATE INDEX IF NOT EXISTS idx_pt_tag ON page_tags(tag_id);
         """)
         # Migration: add parent_id if missing (v1.0.0+)
         try:
             conn.execute("ALTER TABLE pages ADD COLUMN parent_id INTEGER REFERENCES pages(id)")
         except sqlite3.OperationalError:
             pass
+        # Migration: add avatar_color (v2.3.0+)
+        try:
+            conn.execute("ALTER TABLE users ADD COLUMN avatar_color TEXT NOT NULL DEFAULT '#3A3A3A'")
+        except sqlite3.OperationalError:
+            pass
         # Migration: add sort_order for drag & drop tree reordering (v1.1.0+)
         try:
             conn.execute("ALTER TABLE pages ADD COLUMN sort_order INTEGER NOT NULL DEFAULT 0")
@@ -292,7 +348,485 @@ def init_db():
             conn.execute("ALTER TABLE pages ADD COLUMN deleted_at TEXT")
         except sqlite3.OperationalError:
             pass
+        try:
+            conn.execute("ALTER TABLE pages ADD COLUMN share_mode TEXT DEFAULT 'private'")
+        except sqlite3.OperationalError:
+            pass
+        try:
+            conn.execute("ALTER TABLE pages ADD COLUMN published INTEGER DEFAULT 0")
+        except sqlite3.OperationalError:
+            pass
+        try:
+            conn.execute("ALTER TABLE pages ADD COLUMN workspace_id INTEGER REFERENCES workspaces(id)")
+        except sqlite3.OperationalError:
+            pass
+        # v2.2: Auth locale
+        for col in ["password_hash", "is_active", "last_login", "login_attempts", "locked_until"]:
+            try:
+                conn.execute(f"ALTER TABLE users ADD COLUMN {col} {'TEXT' if col in ('password_hash','last_login','locked_until') else 'INTEGER NOT NULL DEFAULT ' + ('1' if col=='is_active' else '0')}")
+            except sqlite3.OperationalError:
+                pass
+        # v2.5: Login history
+        try:
+            conn.execute("ALTER TABLE users ADD COLUMN is_admin INTEGER NOT NULL DEFAULT 0")
+        except sqlite3.OperationalError:
+            pass
+        try:
+            conn.execute("""CREATE TABLE IF NOT EXISTS login_history (
+                id INTEGER PRIMARY KEY AUTOINCREMENT,
+                user_id INTEGER NOT NULL REFERENCES users(id),
+                ip_address TEXT DEFAULT '',
+                user_agent TEXT DEFAULT '',
+                logged_at TIMESTAMP DEFAULT CURRENT_TIMESTAMP
+            )""")
+        except sqlite3.OperationalError:
+            pass
+        # v2.6: Tags per-user
+        try:
+            conn.execute("ALTER TABLE tags ADD COLUMN user_id INTEGER NOT NULL DEFAULT 0 REFERENCES users(id)")
+        except sqlite3.OperationalError:
+            pass
+        try:
+            # Recreate UNIQUE constraint for per-user tags
+            conn.execute("CREATE TABLE IF NOT EXISTS tags_new (id INTEGER PRIMARY KEY AUTOINCREMENT, name TEXT NOT NULL, color TEXT DEFAULT '#787774', user_id INTEGER NOT NULL DEFAULT 0 REFERENCES users(id), created_at TIMESTAMP DEFAULT CURRENT_TIMESTAMP, UNIQUE(name, user_id))")
+            conn.execute("INSERT OR IGNORE INTO tags_new (id, name, color, user_id, created_at) SELECT id, name, color, COALESCE(user_id,0), created_at FROM tags")
+            conn.execute("DROP TABLE tags")
+            conn.execute("ALTER TABLE tags_new RENAME TO tags")
+        except sqlite3.OperationalError:
+            pass
         conn.commit()
+        # v2.7: Private pages for Gitea workspaces
+        conn.execute("""
+            CREATE TABLE IF NOT EXISTS gitea_private_pages (
+                id INTEGER PRIMARY KEY AUTOINCREMENT,
+                user_id INTEGER NOT NULL REFERENCES users(id),
+                gitea_owner TEXT NOT NULL,
+                gitea_repo TEXT NOT NULL,
+                title TEXT NOT NULL DEFAULT 'Untitled',
+                content TEXT DEFAULT '',
+                created_at TIMESTAMP DEFAULT CURRENT_TIMESTAMP,
+                updated_at TIMESTAMP DEFAULT CURRENT_TIMESTAMP
+            )
+        """)
+        conn.commit()
+
+        # ── v4.0: Account & Integrations ──
+        # 1) auth_method on users
+        try:
+            conn.execute("ALTER TABLE users ADD COLUMN auth_method TEXT DEFAULT 'local'")
+        except sqlite3.OperationalError:
+            pass
+        # Detect existing auth: if user has a gitea_token in user_tokens → 'gitea'
+        conn.execute(
+            "UPDATE users SET auth_method='gitea' WHERE id IN (SELECT gitea_user_id FROM user_tokens)"
+        )
+        conn.execute(
+            "UPDATE users SET auth_method='local' WHERE auth_method IS NULL"
+        )
+        # 2) Publishing & sharing columns on pages
+        try:
+            conn.execute("ALTER TABLE pages ADD COLUMN is_published INTEGER NOT NULL DEFAULT 0")
+        except sqlite3.OperationalError:
+            pass
+        try:
+            conn.execute("ALTER TABLE pages ADD COLUMN publish_slug TEXT DEFAULT ''")
+        except sqlite3.OperationalError:
+            pass
+        try:
+            conn.execute("ALTER TABLE pages ADD COLUMN is_shared INTEGER NOT NULL DEFAULT 0")
+        except sqlite3.OperationalError:
+            pass
+        # 3) page_shares table
+        conn.execute("""
+            CREATE TABLE IF NOT EXISTS page_shares (
+                id INTEGER PRIMARY KEY AUTOINCREMENT,
+                page_id INTEGER NOT NULL REFERENCES pages(id) ON DELETE CASCADE,
+                shared_with_user_id INTEGER REFERENCES users(id),
+                shared_with_group_id INTEGER REFERENCES user_groups(id) ON DELETE CASCADE,
+                shared_with_email TEXT DEFAULT '',
+                permission TEXT NOT NULL DEFAULT 'view',
+                created_at TIMESTAMP DEFAULT CURRENT_TIMESTAMP,
+                created_by INTEGER REFERENCES users(id)
+            )
+        """)
+        # v5.x: migration — partage par groupes (colonne manquante sur DB existantes)
+        try:
+            conn.execute("ALTER TABLE page_shares ADD COLUMN shared_with_group_id INTEGER REFERENCES user_groups(id) ON DELETE CASCADE")
+        except sqlite3.OperationalError:
+            pass
+        # 4) recents table
+        conn.execute("""
+            CREATE TABLE IF NOT EXISTS recents (
+                id INTEGER PRIMARY KEY AUTOINCREMENT,
+                user_id INTEGER NOT NULL REFERENCES users(id),
+                page_id INTEGER NOT NULL REFERENCES pages(id),
+                workspace TEXT NOT NULL DEFAULT '',
+                source_type TEXT NOT NULL DEFAULT 'local',
+                accessed_at TIMESTAMP DEFAULT CURRENT_TIMESTAMP,
+                UNIQUE(user_id, page_id)
+            )
+        """)
+        conn.commit()
+
+        # v4.1.0: Data Sources & Linked Databases
+        conn.execute("""
+            CREATE TABLE IF NOT EXISTS collection_data_sources (
+                id INTEGER PRIMARY KEY AUTOINCREMENT,
+                collection_id INTEGER NOT NULL REFERENCES collections(id) ON DELETE CASCADE,
+                source_collection_id INTEGER NOT NULL REFERENCES collections(id),
+                source_name TEXT DEFAULT '',
+                is_linked BOOLEAN NOT NULL DEFAULT 0,
+                position INTEGER NOT NULL DEFAULT 0,
+                created_at TIMESTAMP DEFAULT CURRENT_TIMESTAMP,
+                UNIQUE(collection_id, source_collection_id)
+            )
+        """)
+        # Add workspace_id to collections if missing (v4.1.0 migration)
+        try:
+            conn.execute("ALTER TABLE collections ADD COLUMN workspace_id INTEGER REFERENCES workspaces(id)")
+        except sqlite3.OperationalError:
+            pass
+        # Add created_by to collections if missing
+        try:
+            conn.execute("ALTER TABLE collections ADD COLUMN created_by INTEGER REFERENCES users(id)")
+        except sqlite3.OperationalError:
+            pass
+        conn.commit()
+
+        # v4.6.0: Add collection_id to pages (page ↔ collection link for full-page DBs)
+        try:
+            conn.execute("ALTER TABLE pages ADD COLUMN collection_id INTEGER REFERENCES collections(id)")
+        except sqlite3.OperationalError:
+            pass
+
+        # v4.2.0: Collection Templates (enhanced) + Dashboards
+        # Add description, is_recurring, recurrence_rule to page_templates
+        try:
+            conn.execute("ALTER TABLE page_templates ADD COLUMN description TEXT DEFAULT ''")
+        except sqlite3.OperationalError:
+            pass
+        try:
+            conn.execute("ALTER TABLE page_templates ADD COLUMN is_recurring BOOLEAN NOT NULL DEFAULT 0")
+        except sqlite3.OperationalError:
+            pass
+        try:
+            conn.execute("ALTER TABLE page_templates ADD COLUMN recurrence_rule TEXT DEFAULT ''")
+        except sqlite3.OperationalError:
+            pass
+
+        # Dashboard: combinaison de vues/widgets sur une page
+        conn.execute("""
+            CREATE TABLE IF NOT EXISTS collection_dashboards (
+                id INTEGER PRIMARY KEY AUTOINCREMENT,
+                collection_id INTEGER NOT NULL REFERENCES collections(id) ON DELETE CASCADE,
+                name TEXT NOT NULL DEFAULT 'Dashboard',
+                layout_json TEXT NOT NULL DEFAULT '{"columns":1,"widgets":[]}',
+                created_at TIMESTAMP DEFAULT CURRENT_TIMESTAMP,
+                updated_at TIMESTAMP DEFAULT CURRENT_TIMESTAMP
+            )
+        """)
+        conn.commit()
+
+        # v4.4.0: Tasks & Dependencies
+        # Add is_task flag to collections
+        try:
+            conn.execute("ALTER TABLE collections ADD COLUMN is_task BOOLEAN NOT NULL DEFAULT 0")
+        except sqlite3.OperationalError:
+            pass
+
+        # Dependencies table: bloque/bloqué par with auto-shift config
+        conn.execute("""
+            CREATE TABLE IF NOT EXISTS page_dependencies (
+                id INTEGER PRIMARY KEY AUTOINCREMENT,
+                page_id INTEGER NOT NULL REFERENCES collection_pages(id) ON DELETE CASCADE,
+                dependency_id INTEGER NOT NULL REFERENCES collection_pages(id) ON DELETE CASCADE,
+                dependency_type TEXT NOT NULL DEFAULT 'blocks',
+                auto_shift TEXT DEFAULT 'overlap',
+                created_at TIMESTAMP DEFAULT CURRENT_TIMESTAMP,
+                UNIQUE(page_id, dependency_id, dependency_type)
+            )
+        """)
+        conn.commit()
+
+        # v4.5.0: Sprints
+        conn.execute("""
+            CREATE TABLE IF NOT EXISTS sprints (
+                id INTEGER PRIMARY KEY AUTOINCREMENT,
+                collection_id INTEGER NOT NULL REFERENCES collections(id) ON DELETE CASCADE,
+                name TEXT NOT NULL,
+                start_date TEXT NOT NULL,
+                end_date TEXT NOT NULL,
+                goal TEXT DEFAULT '',
+                status TEXT NOT NULL DEFAULT 'planning',
+                auto_complete BOOLEAN NOT NULL DEFAULT 1,
+                created_at TIMESTAMP DEFAULT CURRENT_TIMESTAMP
+            )
+        """)
+        conn.execute("""
+            CREATE TABLE IF NOT EXISTS sprint_pages (
+                id INTEGER PRIMARY KEY AUTOINCREMENT,
+                sprint_id INTEGER NOT NULL REFERENCES sprints(id) ON DELETE CASCADE,
+                page_id INTEGER NOT NULL REFERENCES collection_pages(id) ON DELETE CASCADE,
+                status_at_start TEXT DEFAULT '',
+                velocity_points INTEGER DEFAULT 1,
+                UNIQUE(sprint_id, page_id)
+            )
+        """)
+        conn.commit()
+
+        # v4.6.0: Sidebar customization config per user
+        try:
+            conn.execute("ALTER TABLE users ADD COLUMN sidebar_config TEXT DEFAULT '{}'")
+        except sqlite3.OperationalError:
+            pass
+        conn.commit()
+
+        # ═══════════ v4.9.0: Collaboration — notifications, inline comments, prefs ═══════════
+        # Notifications table (mentions, comments, page changes)
+        conn.execute("""
+            CREATE TABLE IF NOT EXISTS notifications (
+                id INTEGER PRIMARY KEY AUTOINCREMENT,
+                user_id INTEGER NOT NULL REFERENCES users(id) ON DELETE CASCADE,
+                actor_id INTEGER REFERENCES users(id),
+                ntype TEXT NOT NULL DEFAULT 'mention',   -- 'mention' | 'comment' | 'page'
+                title TEXT NOT NULL DEFAULT '',
+                message TEXT NOT NULL DEFAULT '',
+                resource_type TEXT NOT NULL DEFAULT 'page',
+                resource_id INTEGER NOT NULL DEFAULT 0,
+                url TEXT NOT NULL DEFAULT '',
+                is_read INTEGER NOT NULL DEFAULT 0,
+                created_at TIMESTAMP DEFAULT CURRENT_TIMESTAMP
+            )
+        """)
+        conn.execute(
+            "CREATE INDEX IF NOT EXISTS idx_notif_user_read ON notifications(user_id, is_read)"
+        )
+
+        # Notification email preferences (JSON: {"comments": true, "mentions": true})
+        try:
+            conn.execute("ALTER TABLE users ADD COLUMN notification_prefs TEXT DEFAULT '{}'")
+        except sqlite3.OperationalError:
+            pass
+
+        # Inline comments on pages: the v2.0.0 `comments` table had a NOT NULL FK to
+        # collection_pages, which prevents using page-editor (pages) ids. Rebuild it so
+        # it can hold page comments with optional inline anchors, while preserving data.
+        # target_type='collection_page' (legacy) or 'page' (editor); target_id = resource id.
+        # anchor_block_id = block id; anchor_start/anchor_end = text selection offsets.
+        _cols = [r[1] for r in conn.execute("PRAGMA table_info(comments)").fetchall()]
+        if "target_type" not in _cols:
+            try:
+                conn.execute("""
+                    CREATE TABLE comments_new (
+                        id INTEGER PRIMARY KEY AUTOINCREMENT,
+                        page_id INTEGER,
+                        user_id INTEGER NOT NULL REFERENCES users(id),
+                        body TEXT NOT NULL DEFAULT '',
+                        parent_id INTEGER,
+                        resolved BOOLEAN NOT NULL DEFAULT 0,
+                        created_at TIMESTAMP DEFAULT CURRENT_TIMESTAMP,
+                        updated_at TIMESTAMP DEFAULT CURRENT_TIMESTAMP,
+                        target_type TEXT NOT NULL DEFAULT 'page',
+                        target_id INTEGER NOT NULL DEFAULT 0,
+                        anchor_block_id TEXT,
+                        anchor_start INTEGER,
+                        anchor_end INTEGER
+                    )
+                """)
+                conn.execute(
+                    """INSERT INTO comments_new
+                       (id, page_id, user_id, body, parent_id, resolved, created_at, updated_at, target_type, target_id)
+                       SELECT id, page_id, user_id, body, parent_id, resolved, created_at, updated_at,
+                              'collection_page', COALESCE(page_id, 0)
+                       FROM comments"""
+                )
+                conn.execute("DROP TABLE comments")
+                conn.execute("ALTER TABLE comments_new RENAME TO comments")
+            except sqlite3.OperationalError:
+                pass
+        conn.commit()
+
+        # ═══════════ v4.10.0: FlowDeck Agent — agents, conversations, audit ═══════════
+        conn.execute("""
+            CREATE TABLE IF NOT EXISTS agents (
+                id INTEGER PRIMARY KEY AUTOINCREMENT,
+                workspace_id INTEGER REFERENCES workspaces(id),
+                name TEXT NOT NULL DEFAULT 'FlowDeck Agent',
+                icon TEXT DEFAULT '🤖',
+                agent_type TEXT NOT NULL DEFAULT 'personal',
+                description TEXT DEFAULT '',
+                system_instructions TEXT DEFAULT '',
+                model TEXT DEFAULT 'gpt-4o',
+                scope_json TEXT NOT NULL DEFAULT '{}',
+                trigger_json TEXT NOT NULL DEFAULT '{}',
+                approval_mode TEXT NOT NULL DEFAULT 'auto',
+                is_active BOOLEAN NOT NULL DEFAULT 1,
+                created_at TIMESTAMP DEFAULT CURRENT_TIMESTAMP,
+                created_by INTEGER REFERENCES users(id),
+                UNIQUE(workspace_id, name)
+            )
+        """)
+        conn.execute("""
+            CREATE TABLE IF NOT EXISTS agent_conversations (
+                id INTEGER PRIMARY KEY AUTOINCREMENT,
+                agent_id INTEGER NOT NULL REFERENCES agents(id) ON DELETE CASCADE,
+                user_id INTEGER NOT NULL REFERENCES users(id),
+                title TEXT DEFAULT 'New conversation',
+                status TEXT NOT NULL DEFAULT 'idle',
+                context_json TEXT NOT NULL DEFAULT '{}',
+                created_at TIMESTAMP DEFAULT CURRENT_TIMESTAMP,
+                updated_at TIMESTAMP DEFAULT CURRENT_TIMESTAMP
+            )
+        """)
+        conn.execute("""
+            CREATE TABLE IF NOT EXISTS agent_messages (
+                id INTEGER PRIMARY KEY AUTOINCREMENT,
+                conversation_id INTEGER NOT NULL REFERENCES agent_conversations(id) ON DELETE CASCADE,
+                role TEXT NOT NULL,
+                content TEXT NOT NULL DEFAULT '',
+                tool_calls_json TEXT DEFAULT '[]',
+                model TEXT,
+                tokens_used INTEGER DEFAULT 0,
+                created_at TIMESTAMP DEFAULT CURRENT_TIMESTAMP
+            )
+        """)
+        conn.execute("""
+            CREATE TABLE IF NOT EXISTS agent_actions (
+                id INTEGER PRIMARY KEY AUTOINCREMENT,
+                conversation_id INTEGER NOT NULL REFERENCES agent_conversations(id) ON DELETE CASCADE,
+                tool_name TEXT NOT NULL,
+                target_type TEXT,
+                target_id TEXT,
+                payload_json TEXT NOT NULL DEFAULT '{}',
+                result_json TEXT NOT NULL DEFAULT '{}',
+                status TEXT NOT NULL DEFAULT 'success',
+                undo_snapshot_json TEXT DEFAULT '{}',
+                created_at TIMESTAMP DEFAULT CURRENT_TIMESTAMP,
+                executed_by INTEGER REFERENCES users(id)
+            )
+        """)
+        conn.execute("""
+            CREATE TABLE IF NOT EXISTS agent_skills (
+                id INTEGER PRIMARY KEY AUTOINCREMENT,
+                workspace_id INTEGER REFERENCES workspaces(id),
+                name TEXT NOT NULL,
+                description TEXT DEFAULT '',
+                prompt_template TEXT NOT NULL,
+                allowed_tools_json TEXT NOT NULL DEFAULT '[]',
+                created_at TIMESTAMP DEFAULT CURRENT_TIMESTAMP,
+                created_by INTEGER REFERENCES users(id),
+                UNIQUE(workspace_id, name)
+            )
+        """)
+        conn.execute("""
+            CREATE TABLE IF NOT EXISTS agent_triggers (
+                id INTEGER PRIMARY KEY AUTOINCREMENT,
+                agent_id INTEGER NOT NULL REFERENCES agents(id) ON DELETE CASCADE,
+                trigger_type TEXT NOT NULL DEFAULT 'manual',
+                config_json TEXT NOT NULL DEFAULT '{}',
+                is_active BOOLEAN NOT NULL DEFAULT 1,
+                last_fired_at TIMESTAMP,
+                created_at TIMESTAMP DEFAULT CURRENT_TIMESTAMP
+            )
+        """)
+        # ─── v4.15.0: feedback des réponses de l'agent (👍 / 👎) ───────────────
+        conn.execute("""
+            CREATE TABLE IF NOT EXISTS agent_feedback (
+                id INTEGER PRIMARY KEY AUTOINCREMENT,
+                conversation_id INTEGER REFERENCES agent_conversations(id) ON DELETE SET NULL,
+                message_id INTEGER REFERENCES agent_messages(id) ON DELETE SET NULL,
+                user_id INTEGER REFERENCES users(id) ON DELETE SET NULL,
+                rating TEXT NOT NULL CHECK (rating IN ('up', 'down')),
+                snippet TEXT DEFAULT '',
+                comment TEXT DEFAULT '',
+                created_at TIMESTAMP DEFAULT CURRENT_TIMESTAMP
+            )
+        """)
+        conn.execute("CREATE INDEX IF NOT EXISTS idx_agent_feedback_conv ON agent_feedback(conversation_id)")
+        conn.execute("CREATE INDEX IF NOT EXISTS idx_agent_feedback_user ON agent_feedback(user_id)")
+
+        conn.execute("CREATE INDEX IF NOT EXISTS idx_agent_conv_user ON agent_conversations(user_id, updated_at)")
+        conn.execute("CREATE INDEX IF NOT EXISTS idx_agent_msg_conv ON agent_messages(conversation_id, created_at)")
+        conn.execute("CREATE INDEX IF NOT EXISTS idx_agent_action_conv ON agent_actions(conversation_id)")
+
+        # ─── v4.10.1: LLM runtime config (single row id=1) ─────────────────────
+        # Created lazily (no seed) so .env stays the default until an admin saves
+        # the LLM settings from the UI. Precedence: DB row > settings.llm_*.
+        conn.execute("""
+            CREATE TABLE IF NOT EXISTS llm_config (
+                id INTEGER PRIMARY KEY CHECK (id = 1),
+                provider TEXT NOT NULL DEFAULT 'offline',
+                model TEXT DEFAULT '',
+                api_key TEXT DEFAULT '',
+                api_base TEXT DEFAULT '',
+                verified INTEGER NOT NULL DEFAULT 0,
+                verified_model TEXT DEFAULT '',
+                verified_at TIMESTAMP,
+                last_error TEXT DEFAULT '',
+                updated_at TIMESTAMP DEFAULT CURRENT_TIMESTAMP
+            )
+        """)
+        # ─── v4.10.2: per-user provider API keys ──────────────────────────────
+        # Each user can save several providers with their own key/base + the
+        # live model list fetched from the provider (models_json cache).
+        conn.execute("""
+            CREATE TABLE IF NOT EXISTS user_llm_keys (
+                id INTEGER PRIMARY KEY AUTOINCREMENT,
+                user_id INTEGER NOT NULL REFERENCES users(id) ON DELETE CASCADE,
+                provider TEXT NOT NULL,
+                api_key TEXT NOT NULL DEFAULT '',
+                api_base TEXT NOT NULL DEFAULT '',
+                default_model TEXT DEFAULT '',
+                models_json TEXT NOT NULL DEFAULT '[]',
+                verified INTEGER NOT NULL DEFAULT 0,
+                verified_model TEXT DEFAULT '',
+                verified_at TIMESTAMP,
+                last_error TEXT DEFAULT '',
+                created_at TIMESTAMP DEFAULT CURRENT_TIMESTAMP,
+                updated_at TIMESTAMP DEFAULT CURRENT_TIMESTAMP,
+                UNIQUE(user_id, provider)
+            )
+        """)
+        conn.execute("CREATE INDEX IF NOT EXISTS idx_user_llm_keys_user ON user_llm_keys(user_id)")
+        # v4.12: provider activation/verification — a provider is only offered in
+        # the Agent UI once it is configured AND its connection test succeeded.
+        for col, ddl in (
+            ("verified", "INTEGER NOT NULL DEFAULT 0"),
+            ("verified_model", "TEXT DEFAULT ''"),
+            ("verified_at", "TIMESTAMP"),
+            ("last_error", "TEXT DEFAULT ''"),
+        ):
+            try:
+                conn.execute(f"ALTER TABLE user_llm_keys ADD COLUMN {col} {ddl}")
+            except sqlite3.OperationalError:
+                pass  # column already exists
+        for col, ddl in (
+            ("verified", "INTEGER NOT NULL DEFAULT 0"),
+            ("verified_model", "TEXT DEFAULT ''"),
+            ("verified_at", "TIMESTAMP"),
+            ("last_error", "TEXT DEFAULT ''"),
+        ):
+            try:
+                conn.execute(f"ALTER TABLE llm_config ADD COLUMN {col} {ddl}")
+            except sqlite3.OperationalError:
+                pass  # column already exists
+        # Migration: per-conversation provider/model override columns
+        for col in ("provider", "model"):
+            try:
+                conn.execute(f"ALTER TABLE agent_conversations ADD COLUMN {col} TEXT DEFAULT ''")
+            except sqlite3.OperationalError:
+                pass  # column already exists
+        conn.execute("CREATE INDEX IF NOT EXISTS idx_agent_conv_llm ON agent_conversations(provider, model)")
+        conn.commit()
+
+        # ── v5.2.0: apply any pending VERSIONED migrations (schema_version) ──
+        from app.migrations import apply_migrations
+        apply_migrations(conn)
+
+    # Webhook subscriptions (v2.1.0) — created here (idempotent) so the full
+    # schema exists without depending on the FastAPI lifespan startup.
+    from app.services.webhook_outbound import init_webhook_tables
+    init_webhook_tables()
 
 
 @contextmanager
@@ -303,6 +837,11 @@ def get_conn():
     conn.row_factory = sqlite3.Row
     conn.execute("PRAGMA journal_mode=WAL")
     conn.execute("PRAGMA foreign_keys=ON")
+    # A21 (partiel) : un seul writer par DB — sans timeout la requête concurrente
+    # échoue immédiatement avec « database is locked » (tests xdist, schedulers).
+    # ponytail: le reste d'A21 (wrapper async + 510 call sites synchrones sur
+    # l'event loop) reste à migrer module par module.
+    conn.execute("PRAGMA busy_timeout=5000")
     try:
         yield conn
     finally:

app/main.py

@@ -1,19 +1,68 @@
 """FlowDeck — Kanban léger intégré à Gitea."""
 from __future__ import annotations
 
+import asyncio
 import logging
 from contextlib import asynccontextmanager
 
-from fastapi import FastAPI
-from fastapi.staticfiles import StaticFiles
+from fastapi import FastAPI, Request
 from fastapi.middleware.cors import CORSMiddleware
+from fastapi.staticfiles import StaticFiles
+from starlette.exceptions import HTTPException as _StarHTTPException
 from starlette.middleware.sessions import SessionMiddleware
 
 from app.config import settings
 from app.db import init_db
 from app.middleware.csrf import CSRFMiddleware
-from app.routers import dashboard, board, notes, api, auth, webhooks, collections, my_tasks, workspace
-from app.services.gitea_client import gitea
+from app.middleware.security import ContentSecurityPolicyMiddleware, RateLimitMiddleware
+from app.routers import (
+    admin,
+    agent,
+    api,
+    auth,
+    board,
+    collections,
+    dashboard,
+    export,
+    library,
+    my_tasks,
+    notes,
+    onboarding,
+    projects,
+    public_api,
+    search,
+    security,
+    sharing,
+    sidebar_config,
+    sync,
+    webhooks,
+    workspace,
+)
+from app.routers.api_v2 import router as api_v2_router
+from app.routers.api_v2_agent import router as api_v2_agent_router
+from app.routers.audit import router as audit_router
+from app.routers.automations import router as automations_router
+from app.routers.collaboration import router as collaboration_router
+from app.routers.emoji import router as emoji_router
+from app.routers.gitea import router as gitea_router
+from app.routers.github_routes import router as github_router
+from app.routers.governance import router as governance_router
+from app.routers.imports import page_router as import_page_router
+from app.routers.imports import router as imports_router
+from app.routers.meetings import router as meetings_router
+from app.routers.notifications import router as notifications_router
+from app.routers.permissions import router as permissions_router
+from app.routers.realtime import router as realtime_router
+from app.routers.scim import router as scim_router
+from app.routers.search_ai import router as search_ai_router
+from app.routers.sites import router as sites_router
+from app.routers.sso import router as sso_router
+from app.routers.web_clipper import api_router as web_clipper_api_router
+from app.routers.web_clipper import router as web_clipper_router
+from app.routers.webauthn import router as webauthn_router
+from app.routers.wiki import router as wiki_router
+from app.routers.workers import router as workers_router
+from app.services.webhook_outbound import init_webhook_tables
 
 logging.basicConfig(
     level=getattr(logging, settings.log_level.upper(), logging.INFO),
@@ -22,39 +71,310 @@ logging.basicConfig(
 logger = logging.getLogger(__name__)
 
 
+def _spawn(name: str, factory):
+    """A34 : une tâche scheduler meurt en silence (aucun done_callback).
+
+    Loggue l'exception puis recrée la coroutine 10 s plus tard.
+    ponytail: pas de backoff exponentiel — un scheduler qui replante à chaque
+    tick reste visible (1 cycle / 10 s) dans les logs ; ajouter un backoff si
+    le bruit devient un problème.
+    """
+
+    async def _guard():
+        while True:
+            try:
+                await factory()
+            except asyncio.CancelledError:
+                raise
+            except Exception:
+                logger.exception("scheduler %s plante - redemarrage dans 10 s", name)
+                await asyncio.sleep(10)
+            else:
+                logger.warning("scheduler %s termine - redemarrage dans 10 s", name)
+                await asyncio.sleep(10)
+
+    return asyncio.create_task(_guard())
+
+
 @asynccontextmanager
 async def lifespan(_app: FastAPI):
     init_db()
+    init_webhook_tables()
+    import os
+    import secrets
+
     from app.db import get_conn
-    with get_conn() as conn:
-        conn.execute(
-            "INSERT OR IGNORE INTO users (login, full_name, email, is_admin) VALUES ('admin', 'Admin', '', 1)"
+    from app.password_utils import hash_password
+
+    # A26 : secret de session par défaut refusé (il signe `flowdeck_session`).
+    if settings.app_secret_key == "change-me-to-random":
+        raise RuntimeError(
+            "APP_SECRET_KEY non défini — générer une valeur : "
+            'python -c "import secrets;print(secrets.token_hex(32))" puis la mettre dans .env'
         )
-        conn.commit()
-    logger.info("FlowDeck v2.0.0 started on port %d", settings.app_port)
-    yield
+
+    # A8 : plus de mot de passe admin codé en dur — mot de passe aléatoire au
+    # premier boot (affiché une fois) ou FLOWDECK_ADMIN_PASSWORD ; re-seed si absent.
+    with get_conn() as conn:
+        if not conn.execute("SELECT 1 FROM users WHERE login='admin'").fetchone():
+            admin_pw = os.environ.get("FLOWDECK_ADMIN_PASSWORD") or secrets.token_urlsafe(12)
+            conn.execute(
+                "INSERT INTO users (login, full_name, email, password_hash, is_admin) VALUES ('admin', 'Admin', '', ?, 1)",
+                (hash_password(admin_pw),),
+            )
+            conn.commit()
+            logger.warning(
+                "Premier démarrage : compte admin créé, mot de passe = %s "
+                "(définir FLOWDECK_ADMIN_PASSWORD pour le fixer)",
+                admin_pw,
+            )
+
+    # ── FlowDeck Agent (v4.10.0): scheduled custom-agent triggers ──
+    from app.routers.agent import agent_scheduler
+    scheduler_task = _spawn("agent_scheduler", agent_scheduler)
+
+    # ── Automations (v5.1.0): cron trigger scheduler ──
+    from app.services.automations import automation_scheduler
+    automation_task = _spawn("automation_scheduler", automation_scheduler)
+
+    # ── Backups (v5.2.0): automatic daily SQLite snapshot ──
+    from app.services.backup import backup_scheduler
+    backup_task = _spawn("backup_scheduler", backup_scheduler)
+
+    # ── Forge projects sync (v5.2.0): hourly refresh of `projects` ──
+    from app.services.projects import project_sync_scheduler
+    projects_task = _spawn("project_sync_scheduler", project_sync_scheduler)
+
+    # ── Global trash purge (v5.4.0): daily cleanup of 30-day-old pages ──
+    from app.services.trash import trash_purge_scheduler
+    trash_task = _spawn("trash_purge_scheduler", trash_purge_scheduler)
+
+    # ── Reminders (v5.8.0): due-reminder scan for database rows ──
+    from app.services.reminders import reminder_scheduler
+    reminder_task = _spawn("reminder_scheduler", reminder_scheduler)
+
+    # ── Semantic search (v6.9.0): incremental vector indexing ──
+    from app.services.semantic_search import semantic_index_scheduler
+    semantic_task = _spawn("semantic_index_scheduler", semantic_index_scheduler)
+
+    # ── Calendar sync (v7.1.0): external calendars every 15 min ──
+    from app.services.calendar_sync import calendar_sync_scheduler
+    calendar_task = _spawn("calendar_sync_scheduler", calendar_sync_scheduler)
+
+    # ── Webhooks outbound (v6.4.0): retry failed deliveries ──
+    from app.services.webhook_outbound import webhook_retry_scheduler
+    webhook_task = None
+    if settings.webhook_retry_enabled:
+        webhook_task = _spawn("webhook_retry_scheduler", webhook_retry_scheduler)
+
+    logger.info("FlowDeck v%s started on port %d", dashboard._get_app_version(), settings.app_port)
+    try:
+        yield
+    finally:
+        _tasks = (scheduler_task, automation_task, backup_task, projects_task, trash_task, reminder_task, semantic_task, calendar_task)
+        if webhook_task is not None:
+            _tasks = _tasks + (webhook_task,)
+        for task in _tasks:
+            task.cancel()
+        for task in _tasks:
+            try:
+                await task
+            except asyncio.CancelledError:
+                pass
 
 
 app = FastAPI(
     title="FlowDeck",
-    version="2.0.0",
-    docs_url="/docs" if settings.log_level == "DEBUG" else None,
-    redoc_url=None,
+    version="7.30.0",
+    docs_url="/docs",
+    redoc_url="/redoc",
     lifespan=lifespan,
 )
 
 app.add_middleware(SessionMiddleware, secret_key=settings.app_secret_key, max_age=3600)
 app.add_middleware(CSRFMiddleware)
-app.add_middleware(CORSMiddleware, allow_origins=["*"], allow_methods=["*"], allow_headers=["*"])
+app.add_middleware(ContentSecurityPolicyMiddleware)
+app.add_middleware(RateLimitMiddleware)
+# A37 : origines explicites (l'auth est un cookie de session ; le front est
+# servi par le même hôte). `*` + credentials est la combinaison interdite par la
+# spec CORS — ici ni les deux ni l'un : liste fermée, méthodes/entêtes minutées.
+_CORS_ORIGINS = sorted(
+    {o.rstrip("/") for o in (settings.app_base_url or "").split() if o.startswith(("http://", "https://"))}
+)
+# Hors prod : dev local + origines d'extension (Web Clipper, Bearer uniquement —
+# pas de cookie → `allow_credentials` ne s'applique pas à ces origines).
+app.add_middleware(
+    CORSMiddleware,
+    allow_origins=_CORS_ORIGINS,
+    allow_origin_regex=r"https?://(localhost|127\.0\.0\.1)(:\d+)?|\w+-extension://.*",
+    allow_methods=["GET", "POST", "PUT", "PATCH", "DELETE"],
+    allow_headers=["Authorization", "Content-Type", "X-CSRF-Token", "Idempotency-Key"],
+    allow_credentials=True,
+)
 
 app.include_router(auth.router)
+app.include_router(sso_router)
 app.include_router(dashboard.router)
 app.include_router(board.router)
 app.include_router(notes.router)
+app.include_router(projects.router)
+app.include_router(projects.backups_router)
 app.include_router(api.router)
 app.include_router(webhooks.router)
 app.include_router(collections.router)
 app.include_router(my_tasks.router)
 app.include_router(workspace.router)
+app.include_router(library.router)
+app.include_router(admin.router)
+app.include_router(gitea_router)
+app.include_router(github_router)
+app.include_router(public_api.router)
+app.include_router(sharing.router)
+app.include_router(sidebar_config.router)
+app.include_router(export.router)
+app.include_router(notifications_router)
+app.include_router(automations_router)
+app.include_router(collaboration_router)
+app.include_router(emoji_router)
+app.include_router(realtime_router)
+app.include_router(agent.router)
+app.include_router(search.router)
+app.include_router(security.router)
+app.include_router(onboarding.router)
+app.include_router(sync.router)
+app.include_router(imports_router)
+app.include_router(import_page_router)
+app.include_router(permissions_router)
+app.include_router(web_clipper_api_router)
+app.include_router(web_clipper_router)
+app.include_router(api_v2_router)
+app.include_router(api_v2_agent_router)
+app.include_router(sites_router)
+app.include_router(search_ai_router)
+app.include_router(workers_router)
+app.include_router(meetings_router)
+# v7.2.0 — enterprise admin
+app.include_router(scim_router)
+app.include_router(webauthn_router)
+app.include_router(audit_router)
+app.include_router(governance_router)
+# v7.3.0 — teamspaces + verified wiki
+app.include_router(wiki_router)
 
 app.mount("/static", StaticFiles(directory="static"), name="static")
+
+
+@app.get("/manifest.json")
+def pwa_manifest():
+    """Serve the static web manifest from disk (same URL as before v6.0.0)."""
+    from fastapi.responses import FileResponse
+    return FileResponse("static/manifest.json", media_type="application/manifest+json")
+
+
+@app.get("/sw.js")
+def service_worker():
+    """Serve the PWA service worker at top-level scope (/)."""
+    from fastapi.responses import FileResponse
+    return FileResponse("static/sw.js", media_type="application/javascript")
+
+
+# ═══════════ API aliases (v4.0.1) ═══════════
+
+
+@app.get("/api/csrf-token")
+def csrf_token_endpoint(request: Request):
+    """Return a fresh CSRF token. Used by the frontend to auto-recover from 403."""
+    import secrets
+
+    from fastapi.responses import JSONResponse
+    token = secrets.token_hex(32)
+    response = JSONResponse({"csrf_token": token})
+    response.set_cookie(
+        "csrf_token", token,
+        httponly=False, samesite="lax", max_age=86400, path="/",
+    )
+    return response
+
+
+@app.get("/api/pages")
+def api_pages_alias(request: Request):
+    """Alias /api/pages → /board/api/pages for API path consistency."""
+    from fastapi.responses import RedirectResponse
+    qs = str(request.url.query)
+    target = f"/board/api/pages{'?' + qs if qs else ''}"
+    return RedirectResponse(url=target, status_code=307)
+
+
+@app.post("/api/pages")
+def api_pages_post_alias(request: Request):
+    """Alias POST /api/pages → /board/api/pages for API path consistency."""
+    from fastapi.responses import RedirectResponse
+    return RedirectResponse(url="/board/api/pages", status_code=307)
+
+
+# ═══════════ Styled 404 handler ═══════════
+
+
+NOT_FOUND_HTML = """<!DOCTYPE html>
+<html lang="en" data-theme="dark">
+<head>
+<meta charset="UTF-8"><meta name="viewport" content="width=device-width,initial-scale=1.0">
+<title>404 — FlowDeck</title>
+<style>
+:root{--bg:#191919;--text:#e0e0e0;--text-dim:#999;--accent:#2383E2}
+*{margin:0;padding:0;box-sizing:border-box}
+body{font-family:-apple-system,BlinkMacSystemFont,'Segoe UI',sans-serif;background:var(--bg);color:var(--text);display:flex;align-items:center;justify-content:center;min-height:100vh;text-align:center}
+.box h1{font-size:6rem;font-weight:800;opacity:.08;line-height:1}
+.box p{font-size:18px;color:var(--text-dim);margin:8px 0 24px}
+.box a{color:var(--accent);text-decoration:none;font-size:14px}
+.box a:hover{text-decoration:underline}
+</style>
+</head>
+<body>
+<div class="box">
+<h1>404</h1>
+<p>This page doesn't exist or has been moved.</p>
+<a href="/">← Back to FlowDeck</a>
+</div>
+</body>
+</html>"""
+
+
+@app.exception_handler(_StarHTTPException)
+def http_exception_handler(request: Request, exc: _StarHTTPException):
+    """Unified handler: RFC7807 for /api/v2, JSON for other /api, redirect for HTML.
+
+    Registered on Starlette's HTTPException (the base class) so it catches both
+    raised exceptions and route-miss 404s.
+    """
+    status = getattr(exc, "status_code", 500)
+    detail = getattr(exc, "detail", str(exc))
+    is_api_v2 = request.url.path.startswith("/api/v2")
+    # Programmatic API prefixes that must always answer JSON errors instead of
+    # being redirected to the HTML shell (SCIM 2.0 clients, WebAuthn fetch).
+    JSON_ERROR_PREFIXES = ("/api/v2", "/scim/v2", "/auth/webauthn")
+    is_json_api = request.url.path.startswith(JSON_ERROR_PREFIXES)
+    if status == 404:
+        if is_api_v2:
+            from app.services.api_v2_helpers import problem_response
+            return problem_response(request, exc)
+        if is_json_api and request.url.path.startswith("/scim/v2"):
+            from fastapi.responses import JSONResponse
+            return JSONResponse(
+                {"schemas": ["urn:ietf:params:scim:api:messages:2.0:Error"],
+                 "detail": detail if isinstance(detail, str) else "Not found",
+                 "status": "404"},
+                status_code=404,
+                headers={"Content-Type": "application/scim+json"},
+            )
+        if "/api" in request.url.path or is_json_api:
+            from fastapi.responses import JSONResponse
+            return JSONResponse({"detail": detail if isinstance(detail, str) else "Not found"}, status_code=404)
+        from fastapi.responses import RedirectResponse
+        return RedirectResponse("/workspaces", status_code=302)
+    # Non-404: RFC7807 for /api/v2
+    if is_api_v2:
+        from app.services.api_v2_helpers import problem_response
+        return problem_response(request, exc)
+    from fastapi.responses import JSONResponse
+    return JSONResponse({"detail": detail if isinstance(detail, str) else str(detail)}, status_code=status)

app/middleware/__init__.py

@@ -1,2 +1,4 @@
 """FlowDeck — Custom middleware."""
 from app.middleware.csrf import CSRFMiddleware
+
+__all__ = ["CSRFMiddleware"]

app/middleware/csrf.py

@@ -4,8 +4,8 @@ from __future__ import annotations
 import secrets
 
 from starlette.middleware.base import BaseHTTPMiddleware
-from starlette.responses import JSONResponse
 from starlette.requests import Request
+from starlette.responses import JSONResponse
 
 
 class CSRFMiddleware(BaseHTTPMiddleware):
@@ -16,7 +16,23 @@ class CSRFMiddleware(BaseHTTPMiddleware):
     """
 
     SAFE_METHODS = {"GET", "HEAD", "OPTIONS"}
-    EXCLUDED_PATHS = {"/api/webhook", "/auth/callback", "/board/api/pages", "/db/", "/workspace"}
+    # NOTE: ``/scim/v2`` is Bearer-token only (no cookie auth), so CSRF does not
+    # apply — IdP SCIM clients (Okta, Entra) cannot send an X-CSRF-Token.
+    # A19 — LISTE FINALE : plus aucun préfixe cookie-auth n'est exempté.
+    # Tous les appels non-GET du front envoient désormais `X-CSRF-Token`
+    # (46 sites équipés en v7.3.6 : agent_panel, settings, local_workspace,
+    # library, gitea_workspace, workspace, workspaces, welcome).
+    # Ne restent que du machine-to-machine / hors session :
+    #   - Bearer      : /api/webhook, /api/v1, /api/v2, /scim/v2
+    #   - callbacks    : /auth/* (login, register, SSO, 2FA, WebAuthn)
+    #   - publics      : /s/ (sites), /f/ (forms)
+    #   - infra/diag   : /api/csrf-token (le jeton lui-même), /api/frontend-error
+    EXCLUDED_PATHS = {
+        "/api/webhook", "/api/v1", "/api/v2", "/scim/v2",
+        "/auth/callback", "/auth/register", "/auth/local-login", "/auth/local-verify",
+        "/auth/2fa", "/auth/saml", "/auth/oidc", "/auth/webauthn",
+        "/s/", "/f/", "/api/csrf-token", "/api/frontend-error",
+    }
 
     async def dispatch(self, request: Request, call_next):
         # Webhook receiver, OAuth callback, and internal API are exempt
@@ -33,6 +49,7 @@ class CSRFMiddleware(BaseHTTPMiddleware):
                     httponly=False,  # Must be readable by JS
                     samesite="lax",
                     max_age=86400,
+                    path="/",
                 )
             return response
 

app/middleware/security.py

@@ -0,0 +1,230 @@
+"""FlowDeck — Security middleware: CSP headers + rate limiting."""
+from __future__ import annotations
+
+import ipaddress
+import re
+import secrets
+import time
+from collections import defaultdict
+
+from starlette.middleware.base import BaseHTTPMiddleware
+from starlette.requests import Request
+from starlette.responses import JSONResponse
+
+from app.templating import CSP_NONCE
+
+# ── Constants ────────────────────────────────────────────────
+
+# Allowed extensions for file uploads
+ALLOWED_EXTENSIONS: frozenset[str] = frozenset({
+    # Images
+    ".png", ".jpg", ".jpeg", ".gif", ".webp", ".svg", ".bmp", ".ico",
+    # Documents
+    ".pdf", ".md", ".markdown", ".txt", ".log", ".csv",
+    # Code
+    ".py", ".js", ".jsx", ".ts", ".tsx", ".html", ".htm", ".xml", ".css",
+    ".json", ".yaml", ".yml", ".toml", ".sql", ".sh", ".bash", ".zsh",
+    ".ps1", ".rs", ".go", ".java", ".rb", ".php", ".c", ".cpp", ".h",
+    ".swift", ".kt", ".scala", ".r",
+    # Archives
+    ".zip", ".tar", ".gz", ".rar", ".7z",
+    # Misc
+    ".env", ".cfg", ".conf", ".ini", ".dockerfile", ".makefile",
+})
+
+MAX_UPLOAD_SIZE = 10 * 1024 * 1024  # 10 MB
+
+
+def validate_upload(filename: str, size: int) -> str | None:
+    """Validate upload filename and size. Returns error message or None."""
+    if size > MAX_UPLOAD_SIZE:
+        return f"File '{filename}' exceeds maximum size of 10 MB"
+    ext = _ext(filename)
+    if ext and ext not in ALLOWED_EXTENSIONS:
+        return f"File extension '{ext}' is not allowed"
+    return None
+
+
+def _ext(filename: str) -> str:
+    """Extract lowercase extension from filename."""
+    if "." in filename:
+        return "." + filename.rsplit(".", 1)[-1].lower()
+    return ""
+
+
+# ── Content-Security-Policy Middleware ────────────────────────
+
+class ContentSecurityPolicyMiddleware(BaseHTTPMiddleware):
+    """Sets Content-Security-Policy headers on all HTML responses.
+
+    A permissive-yet-safe policy for a Notion-style app that needs:
+    - inline scripts (Alpine.js, HTMX)
+    - inline styles
+    - font loading
+    - images from various sources
+    - media (audio/video)
+    - websocket connections for HMR/SSE
+    """
+
+    CSP_HEADER = "Content-Security-Policy"
+    # A20 : `unsafe-inline` sort de script-src (remplacé par un nonce par
+    # requête — un XSS injecté dans une page ne tourne plus). Les 74 handlers
+    # inline `onclick=` restent couverts par `script-src-attr`, explicitement
+    # détaché de script-src (sinon le nonce les désactiverait aussi).
+    # `unsafe-eval` reste : Alpine (x-data en string) et htmx (hx-vars) en ont
+    # besoin → à retirer avec le build CSP d'Alpine (voir reste d'A20).
+    CSP_VALUE = (
+        "default-src 'self'; "
+        # A20 phase 2 : chart.js/leaflet vendorisés dans /static/js/vendor
+        # (test_csp_no_cdn_and_vendor), plus aucun hôte CDN tiers.
+        # `unsafe-eval` reste : Alpine (x-data) + htmx (hx-on/hx-vars) en
+        # ont besoin → retrait avec le build CSP d'Alpine (reste d'A20).
+        "script-src 'self' 'unsafe-eval' 'nonce-{nonce}'; "
+        "script-src-attr 'unsafe-inline'; "
+        # ponytail: aucun @font-face Google (grep négatif) → les deux
+        # hôtes fonts étaient morts, supprimés.
+        "style-src 'self' 'unsafe-inline'; "
+        # ponytail: `https:` reste ouvert — unfurls (YouTube/Vimeo/…) et
+        # tuiles OSM sont inénumérables ; plafond assumé, à resserrer si
+        # un proxy d'images local arrive.
+        "img-src 'self' data: blob: https:; "
+        "font-src 'self' data:; "
+        # connect-src fermé : plus de `https:` (aucun fetch cross-origin
+        # côté front — grep négatif) et websockets scopés à l'hôte de la
+        # requête ({host}) → plus de canal d'exfil vers un tiers.
+        "connect-src 'self' ws://{host} wss://{host}; "
+        "media-src 'self' blob:; "
+        "frame-src 'self'; "
+        "object-src 'none'; "
+        "base-uri 'self'; "
+        "form-action 'self'; "
+    )
+
+    async def dispatch(self, request: Request, call_next):
+        nonce = secrets.token_urlsafe(16)
+        # Posé AVANT call_next : BaseHTTPMiddleware exécute le aval dans une
+        # tâche créée maintenant → le contexte (donc le nonce) y est copié,
+        # exactement ce que les templates liront via `csp_nonce()`.
+        CSP_NONCE.set(nonce)
+        response = await call_next(request)
+        # Only set CSP on HTML responses
+        content_type = response.headers.get("content-type", "")
+        if "text/html" in content_type:
+            # Host du navigateur (uvicorn rejette les Host invalides) ;
+            # on retire quand même tout caractère hors base URL par sécurité.
+            host = re.sub(r"[^0-9A-Za-z.\-:\[\]]", "",
+                          request.headers.get("host", ""))
+            response.headers[self.CSP_HEADER] = self.CSP_VALUE.format(
+                nonce=nonce, host=host
+            )
+        return response
+
+
+# ── Rate Limiting Middleware ──────────────────────────────────
+
+class RateLimitMiddleware(BaseHTTPMiddleware):
+    """Simple in-memory sliding-window rate limiter per IP.
+
+    Default: 100 requests per minute per IP for API routes.
+    Non-API routes (HTML pages, static files) are not rate-limited.
+    """
+
+    # Paths that should be rate-limited
+    RATE_LIMITED_PREFIXES: tuple[str, ...] = (
+        "/api/", "/board/api/", "/auth/",
+        # A33 : préfixes qui manquaient — SCIM (brute force de jetons/IdP),
+        # API workspace + collections (les endpoints mutants du legacy).
+        "/scim/v2/", "/workspace/", "/db/",
+    )
+
+    # Pages publiques : seul le non-GET est plafonné (brute force de
+    # /s/<slug>/auth et spam de /f/<token>) — la lecture reste libre pour les
+    # visiteurs d'un site publié qui partagent une IP.
+    RATE_LIMITED_NON_GET_PREFIXES: tuple[str, ...] = ("/s/", "/f/")
+
+    # Paths exempt from rate limiting even under an API prefix
+    EXEMPT_PATHS: frozenset[str] = frozenset({
+        "/api/health",
+        "/api/frontend-error",
+        "/api/frontend-errors",
+    })
+
+    def __init__(self, app, max_requests: int | None = None, window_seconds: int = 60):
+        super().__init__(app)
+        # A33 : None = lire `settings.rate_limit_requests` à chaque requête (la
+        # valeur de config n'était jamais lue — 100 codé en dur contre 60 annoncé).
+        self.max_requests = max_requests
+        self.window_seconds = window_seconds
+        self._store: dict[str, tuple[float, int]] = defaultdict(lambda: (0.0, 0))
+        self._last_prune = 0.0
+        self._max_keys = 5000
+
+    async def dispatch(self, request: Request, call_next):
+        path = request.url.path
+
+        # Respect the global rate-limit toggle (disabled in tests/local).
+        from app.config import settings
+        if not settings.rate_limit_enabled:
+            return await call_next(request)
+
+        # Only rate-limit API routes (+ non-GET sur les pages publiques)
+        method = request.method.upper()
+        limited = any(path.startswith(p) for p in self.RATE_LIMITED_PREFIXES) or (
+            method not in ("GET", "HEAD", "OPTIONS")
+            and any(path.startswith(p) for p in self.RATE_LIMITED_NON_GET_PREFIXES)
+        )
+        if not limited:
+            return await call_next(request)
+
+        # Exempt health check and error capture
+        if path in self.EXEMPT_PATHS:
+            return await call_next(request)
+
+        limit = self.max_requests or settings.rate_limit_requests
+        ip = self._client_key(request)
+        now = time.time()
+
+        # A33 : le store n'était jamais épuré → croissance mémoire par IP.
+        if len(self._store) > self._max_keys and now - self._last_prune > self.window_seconds:
+            self._prune(now)
+
+        window_start, count = self._store[ip]
+        if now - window_start > self.window_seconds:
+            self._store[ip] = (now, 1)
+            return await call_next(request)
+
+        if count >= limit:
+            return JSONResponse(
+                {"error": "Rate limit exceeded", "detail": f"Max {limit} req/min per IP"},
+                status_code=429,
+            )
+
+        self._store[ip] = (window_start, count + 1)
+        return await call_next(request)
+
+    def _client_key(self, request: Request) -> str:
+        """A33 : X-Forwarded-For uniquement derrière un proxy local.
+
+        Le test porte sur `is_private` (Python ≥ 3.13 : toutes les plages non
+        globales, pas seulement RFC1918) — un pair non-global n'est pas un
+        internaute, donc le XFF du proxy fait foi.
+        ponytail: si un jour plusieurs proxies se chaînent (ou si l'app est
+        exposée directement), prendre la dernière adresse non privée de la
+        chaîne plutôt que la première.
+        """
+        host = request.client.host if request.client else "unknown"
+        fwd = request.headers.get("x-forwarded-for", "")
+        if fwd:
+            try:
+                direct = ipaddress.ip_address(host)
+                if direct.is_private or direct.is_loopback:
+                    return fwd.split(",")[0].strip() or host
+            except ValueError:
+                pass  # hôte non-IP (testserver…) → on garde la clé d'origine
+        return host
+
+    def _prune(self, now: float) -> None:
+        expired = [k for k, (start, _) in self._store.items() if now - start > self.window_seconds]
+        for k in expired:
+            del self._store[k]
+        self._last_prune = now

app/models/requests.py

@@ -0,0 +1,75 @@
+"""FlowDeck — Pydantic request models for API validation."""
+from __future__ import annotations
+
+from pydantic import BaseModel, Field, model_validator
+
+from app.middleware.security import ALLOWED_EXTENSIONS, _ext
+
+# ── File Save ────────────────────────────────────────────────
+
+class FileSaveRequest(BaseModel):
+    """Request model for saving/updating a file via Gitea."""
+    path: str = Field(..., min_length=1, description="File path in the repository")
+    content: str = Field(..., description="File content (UTF-8 encoded)")
+    message: str = Field(default="Update via FlowDeck", description="Commit message")
+    sha: str | None = Field(default=None, description="SHA of the file being updated (required for updates)")
+
+    @model_validator(mode="after")
+    def validate_path_extension(self):
+        ext = _ext(self.path)
+        if ext and ext not in ALLOWED_EXTENSIONS:
+            raise ValueError(f"File extension '{ext}' is not allowed")
+        return self
+
+
+# ── Upload ───────────────────────────────────────────────────
+
+class UploadValidationResult(BaseModel):
+    """Result of validating an upload."""
+    filename: str
+    size: int
+    extension: str
+    valid: bool
+    error: str | None = None
+
+
+
+
+class IssueCreateRequest(BaseModel):
+    """Request model for creating a Gitea issue."""
+    title: str = Field(..., min_length=1, max_length=500)
+    body: str = Field(default="")
+    labels: str = Field(default="", description="Comma-separated label IDs")
+    milestone: str = Field(default="", description="Milestone ID")
+    assignee: str = Field(default="")
+
+
+class IssueUpdateRequest(BaseModel):
+    """Request model for updating a Gitea issue (partial update)."""
+    title: str | None = Field(default=None, max_length=500)
+    body: str | None = Field(default=None)
+    state: str | None = Field(default=None, pattern=r"^(open|closed)$")
+    labels: str | None = Field(default=None, description="Comma-separated label IDs")
+    milestone: str | None = Field(default=None)
+    assignee: str | None = Field(default=None)
+
+
+# ── Card Move ────────────────────────────────────────────────
+
+class CardMoveRequest(BaseModel):
+    """Request model for moving a card between columns."""
+    owner: str = Field(..., min_length=1)
+    repo: str = Field(..., min_length=1)
+    issue_id: int = Field(..., gt=0)
+    column: str = Field(..., min_length=1)
+
+
+# ── Column Mapping ───────────────────────────────────────────
+
+class ColMappingRequest(BaseModel):
+    """Request model for column-to-label mapping."""
+    owner: str = Field(..., min_length=1)
+    repo: str = Field(..., min_length=1)
+    column: str = Field(..., min_length=1)
+    gitea_label: str = Field(..., min_length=1)
+    close_issue: bool = Field(default=False)

app/models/responses.py

@@ -0,0 +1,38 @@
+"""FlowDeck — Standardized response models."""
+from __future__ import annotations
+
+from typing import Any
+
+from pydantic import BaseModel
+
+
+class ErrorResponse(BaseModel):
+    """Standardized error response.
+
+    Example:
+        ErrorResponse(error="Rate limit exceeded", detail="Max 100 req/min per IP")
+    """
+    error: str
+    detail: str | None = None
+
+    model_config = {
+        "json_schema_extra": {
+            "example": {"error": "Not found", "detail": "Board not found"}
+        }
+    }
+
+
+class SuccessResponse(BaseModel):
+    """Standardized success response.
+
+    Example:
+        SuccessResponse(status="ok", data={"issue_id": 42})
+    """
+    status: str = "ok"
+    data: dict[str, Any] | None = None
+
+    model_config = {
+        "json_schema_extra": {
+            "example": {"status": "ok", "data": {"issue_id": 42, "column": "Done"}}
+        }
+    }

app/password_utils.py

@@ -0,0 +1,35 @@
+"""Password hashing and login security utilities."""
+
+import hashlib
+import secrets
+import time
+
+
+def hash_password(password: str) -> str:
+    """Hash a password using SHA-256 + random salt (16 bytes).
+    Format: salt_hex:hash_hex (64 + 64 = 128 chars)
+    Fallback for bcrypt — we use SHA-256 for SQLite simplicity
+    but with proper salt per password."""
+    salt = secrets.token_hex(16)
+    h = hashlib.sha256(f"{salt}:{password}".encode()).hexdigest()
+    return f"{salt}:{h}"
+
+
+def verify_password(password: str, stored: str) -> bool:
+    """Verify a password against its stored hash."""
+    try:
+        salt, h = stored.split(":", 1)
+        expected = hashlib.sha256(f"{salt}:{password}".encode()).hexdigest()
+        return h == expected
+    except (ValueError, AttributeError):
+        return False
+
+
+def is_locked(locked_until: str | None) -> bool:
+    """Check if account is temporarily locked."""
+    if not locked_until:
+        return False
+    try:
+        return float(locked_until) > time.time()
+    except (ValueError, TypeError):
+        return False

app/routers/admin.py

@@ -0,0 +1,166 @@
+"""FlowDeck — Admin API: users, roles, stats, audit."""
+from fastapi import APIRouter, Body, Depends, HTTPException, Request
+from fastapi.responses import JSONResponse
+
+router = APIRouter(tags=["admin"], prefix="/api/admin")
+
+
+# ── Dependency ──
+async def admin_required(request: Request):
+    from app.auth.session import get_current_user
+    user = get_current_user(request)
+    if not user:
+        raise HTTPException(status_code=403, detail="Admin access required")
+    # Also check DB directly (session cookie may be stale)
+    if not user.get("is_admin"):
+        from app.db import get_conn
+        with get_conn() as conn:
+            row = conn.execute("SELECT is_admin FROM users WHERE id=?", (user.get("id"),)).fetchone()
+            if not row or not row["is_admin"]:
+                raise HTTPException(status_code=403, detail="Admin access required")
+    return user
+
+
+# ── Users ──
+@router.get("/users")
+def list_users(_admin=Depends(admin_required)):
+    """List all users with workspace/file/folder counts and storage usage."""
+    from app.db import get_conn
+    with get_conn() as conn:
+        rows = conn.execute("""
+            SELECT u.id, u.login, u.full_name, u.email, u.is_admin, u.is_active,
+                   u.last_login, u.created_at,
+                   (SELECT COUNT(*) FROM workspaces WHERE owner_id=u.id) AS ws_count,
+                   (SELECT COUNT(*) FROM pages WHERE workspace_id IN (SELECT id FROM workspaces WHERE owner_id=u.id)) AS page_count
+            FROM users u
+            ORDER BY u.id
+        """).fetchall()
+        users = []
+        for r in rows:
+            d = dict(r)
+            d["file_count"] = d["page_count"]
+            d["folder_count"] = 0
+            d["total_mb"] = 0
+            users.append(d)
+    return {"users": users}
+
+
+@router.post("/users")
+def create_user(request: Request, _admin=Depends(admin_required), body: dict = Body(default={})):
+    """Create a new user (admin only)."""
+
+    from app.db import get_conn
+    from app.password_utils import hash_password
+    login = body.get("login", "").strip()
+    name = body.get("name", login)
+    email = body.get("email", login)
+    password = body.get("password", "").strip()
+    is_admin = int(body.get("is_admin", 0))
+    if not login or not password:
+        return JSONResponse({"error": "Login and password required"}, status_code=400)
+    if len(password) < 6:
+        return JSONResponse({"error": "Password must be at least 6 characters"}, status_code=400)
+    with get_conn() as conn:
+        existing = conn.execute("SELECT id FROM users WHERE login=?", (login,)).fetchone()
+        if existing:
+            return JSONResponse({"error": "User already exists"}, status_code=409)
+        conn.execute(
+            "INSERT INTO users (login, full_name, email, password_hash, is_admin) VALUES (?, ?, ?, ?, ?)",
+            (login, name, email, hash_password(password), is_admin),
+        )
+        conn.commit()
+        uid = conn.execute("SELECT last_insert_rowid()").fetchone()[0]
+    return {"status": "ok", "user": {"id": uid, "login": login}}
+
+
+@router.put("/users/{user_id:int}")
+def update_user(user_id: int, request: Request, _admin=Depends(admin_required), body: dict = Body(default={})):
+    """Update a user: name, email, password, admin status, active status."""
+
+    from app.db import get_conn
+    from app.password_utils import hash_password
+    with get_conn() as conn:
+        user = conn.execute("SELECT id FROM users WHERE id=?", (user_id,)).fetchone()
+        if not user:
+            return JSONResponse({"error": "User not found"}, status_code=404)
+        if "name" in body:
+            conn.execute("UPDATE users SET full_name=? WHERE id=?", (body["name"], user_id))
+        if "email" in body:
+            conn.execute("UPDATE users SET email=? WHERE id=?", (body["email"], user_id))
+        if "password" in body and body["password"].strip():
+            pw = body["password"].strip()
+            if len(pw) < 6:
+                return JSONResponse({"error": "Password must be at least 6 characters"}, status_code=400)
+            conn.execute("UPDATE users SET password_hash=? WHERE id=?", (hash_password(pw), user_id))
+        if "is_admin" in body:
+            conn.execute("UPDATE users SET is_admin=? WHERE id=?", (int(body["is_admin"]), user_id))
+        if "is_active" in body:
+            conn.execute("UPDATE users SET is_active=? WHERE id=?", (int(body["is_active"]), user_id))
+        conn.commit()
+    return {"status": "ok"}
+
+
+@router.delete("/users/{user_id:int}")
+def delete_user(user_id: int, _admin=Depends(admin_required)):
+    """Delete a user and cascade their data."""
+    from app.db import get_conn
+    with get_conn() as conn:
+        user = conn.execute("SELECT id FROM users WHERE id=?", (user_id,)).fetchone()
+        if not user:
+            return JSONResponse({"error": "User not found"}, status_code=404)
+        # Cascade delete: first delete child records
+        conn.execute("DELETE FROM login_history WHERE user_id=?", (user_id,))
+        conn.execute("DELETE FROM user_oauth_tokens WHERE user_id=?", (user_id,))
+        conn.execute("DELETE FROM user_tokens WHERE gitea_user_id=?", (user_id,))
+        conn.execute("DELETE FROM workspace_members WHERE user_id=?", (user_id,))
+        conn.execute("DELETE FROM comments WHERE user_id=?", (user_id,))
+        conn.execute("DELETE FROM page_history WHERE user_id=?", (user_id,))
+        conn.execute("DELETE FROM favorites WHERE user_id=?", (user_id,))
+        conn.execute("DELETE FROM gitea_private_pages WHERE user_id=?", (user_id,))
+        conn.execute("DELETE FROM tags WHERE user_id=?", (user_id,))
+        # Delete workspaces owned by this user
+        ws_rows = conn.execute("SELECT id FROM workspaces WHERE owner_id=?", (user_id,)).fetchall()
+        for ws in ws_rows:
+            conn.execute("DELETE FROM pages WHERE workspace_id=?", (ws["id"],))
+            conn.execute("DELETE FROM workspace_members WHERE workspace_id=?", (ws["id"],))
+        conn.execute("DELETE FROM workspaces WHERE owner_id=?", (user_id,))
+        conn.execute("DELETE FROM users WHERE id=?", (user_id,))
+        conn.commit()
+    return {"status": "ok"}
+
+
+# ── Stats ──
+@router.get("/stats")
+def user_stats(_admin=Depends(admin_required)):
+    """Aggregate stats: total users, workspaces, files, storage."""
+    from app.db import get_conn
+    with get_conn() as conn:
+        total_users = conn.execute("SELECT COUNT(*) FROM users").fetchone()[0]
+        total_ws = conn.execute("SELECT COUNT(*) FROM workspaces").fetchone()[0]
+        total_files = conn.execute("SELECT COUNT(*) FROM pages").fetchone()[0]
+        total_folders = 0
+        total_bytes = 0
+    return {
+        "total_users": total_users,
+        "total_workspaces": total_ws,
+        "total_files": total_files,
+        "total_folders": total_folders,
+        "total_mb": round(total_bytes / (1024 * 1024), 2),
+    }
+
+
+# ── Audit ──
+@router.get("/audit")
+def audit_log(limit: int = 100, _admin=Depends(admin_required)):
+    """Recent login history."""
+    from app.db import get_conn
+    with get_conn() as conn:
+        rows = conn.execute("""
+            SELECT lh.id, lh.user_id, u.login, u.full_name,
+                   lh.ip_address, lh.user_agent, lh.logged_at
+            FROM login_history lh
+            JOIN users u ON u.id = lh.user_id
+            ORDER BY lh.logged_at DESC
+            LIMIT ?
+        """, (min(limit, 500),)).fetchall()
+    return {"entries": [dict(r) for r in rows]}

app/routers/api.py

@@ -3,20 +3,39 @@ from __future__ import annotations
 
 import json
 import logging
-from datetime import datetime
-from typing import Optional
+from datetime import UTC, datetime
 
-from fastapi import APIRouter, HTTPException, Query, Request
+from fastapi import APIRouter, Depends, HTTPException, Query, Request
 from fastapi.responses import HTMLResponse
 
+from app.auth.session import SessionManager
 from app.config import settings
 from app.db import get_conn
-from app.routers.board import _issue_column, _map_issue_to_card, STATUS_COLORS, STATUS_LABELS
+from app.routers.board import STATUS_COLORS, STATUS_LABELS, _issue_column, _map_issue_to_card
 from app.services.gitea_client import gitea
-from app.auth.session import SessionManager
 
 logger = logging.getLogger(__name__)
-router = APIRouter(tags=["api"], prefix="/api")
+
+# A17 : ce router legacy ne sert plus un anonymous. Deux exceptions assumées —
+# le probe d'infra (Docker HEALTHCHECK / CI) et la remontée d'erreur client.
+_API_PUBLIC_PATHS = {"/api/health", "/api/frontend-error"}
+
+
+async def _require_session_or_bearer(request: Request) -> None:
+    """Session de cookie **ou** Bearer d'API valide sur toutes les routes /api."""
+    if request.url.path in _API_PUBLIC_PATHS:
+        return
+    if SessionManager.decode_session(request.cookies.get("flowdeck_session", "")):
+        return
+    auth = request.headers.get("Authorization", "")
+    if auth.startswith("Bearer "):
+        from app.routers.public_api import verify_token
+        verify_token(auth)
+        return
+    raise HTTPException(401, "Authentication required")
+
+
+router = APIRouter(tags=["api"], prefix="/api", dependencies=[Depends(_require_session_or_bearer)])
 
 # ── Simple rate limiter (in-memory, per-IP) ──
 _rate_limit_store: dict[str, tuple[float, int]] = {}
@@ -27,7 +46,7 @@ def _check_rate_limit(request: Request) -> bool:
     if not settings.rate_limit_enabled:
         return True
     ip = request.client.host if request.client else "unknown"
-    now = datetime.utcnow().timestamp()
+    now = datetime.now(UTC).replace(tzinfo=None).timestamp()
     window_start, count = _rate_limit_store.get(ip, (0, 0))
     if now - window_start > 60:
         _rate_limit_store[ip] = (now, 1)
@@ -39,7 +58,7 @@ def _check_rate_limit(request: Request) -> bool:
 
 
 @router.get("/health")
-async def health():
+async def health(request: Request):
     """Health check: DB + Gitea connectivity."""
     db_ok = False
     gitea_ok = False
@@ -48,23 +67,23 @@ async def health():
             conn.execute("SELECT 1")
         db_ok = True
     except Exception:
-        pass
+        logger.exception("health")
     try:
         await gitea.get_user_repos(page=1, limit=1)
         gitea_ok = True
     except Exception:
-        pass
+        logger.exception("health")
 
     return {
         "status": "ok" if (db_ok and gitea_ok) else "degraded",
-        "version": "2.0.0",
+        "version": request.app.version,
         "db": db_ok,
         "gitea": gitea_ok,
     }
 
 
 @router.get("/stats")
-async def stats():
+def stats():
     """Global stats for dashboard."""
     with get_conn() as conn:
         board_count = conn.execute("SELECT COUNT(*) as c FROM boards").fetchone()["c"]
@@ -80,22 +99,6 @@ async def stats():
     }
 
 
-@router.get("/projects")
-async def projects(search: str = Query(default=""), show_archived: bool = Query(default=False)):
-    """List Gitea projects (JSON)."""
-    try:
-        repos = await gitea.get_user_repos(page=1, limit=50)
-        if search:
-            q = search.lower()
-            repos = [r for r in repos if q in r.get("full_name", "").lower() or q in (r.get("description") or "").lower()]
-        if not show_archived:
-            repos = [r for r in repos if not r.get("archived", False)]
-        repos.sort(key=lambda r: r.get("updated_at", ""), reverse=True)
-    except Exception:
-        repos = []
-    return {"projects": repos}
-
-
 @router.post("/move")
 async def move_card(
     request: Request,
@@ -150,7 +153,7 @@ async def move_card(
                 issue = await gitea.get_issue(owner, repo, issue_id)
                 current_labels = [lbl["name"] for lbl in issue.get("labels", [])]
                 status_labels = await _get_status_labels(owner, repo, board_id)
-                filtered_names = [l for l in current_labels if l not in status_labels]
+                filtered_names = [name for name in current_labels if name not in status_labels]
                 filtered_names.append(mapping["gitea_label"])
 
                 # Resolve label names to IDs
@@ -176,7 +179,7 @@ async def _get_status_labels(owner: str, repo: str, board_id: int) -> list[str]:
 
 
 @router.post("/col-mapping")
-async def set_col_mapping(
+def set_col_mapping(
     owner: str = Query(...),
     repo: str = Query(...),
     column: str = Query(...),
@@ -206,7 +209,7 @@ async def set_col_mapping(
 
 
 @router.delete("/col-mapping")
-async def delete_col_mapping(
+def delete_col_mapping(
     owner: str = Query(...),
     repo: str = Query(...),
     column: str = Query(...),
@@ -231,7 +234,7 @@ async def delete_col_mapping(
 
 
 @router.get("/board-config/{owner}/{repo}")
-async def get_board_config(owner: str, repo: str):
+def get_board_config(owner: str, repo: str):
     with get_conn() as conn:
         board = conn.execute(
             "SELECT * FROM boards WHERE project_owner=? AND project_name=?",
@@ -252,7 +255,7 @@ async def get_board_config(owner: str, repo: str):
 
 
 @router.post("/board-config/{owner}/{repo}")
-async def update_board_config(
+def update_board_config(
     owner: str,
     repo: str,
     columns: str = Query(default=""),
@@ -294,7 +297,7 @@ async def create_issue(
     if not _check_rate_limit(request):
         raise HTTPException(status_code=429, detail="Rate limit exceeded")
 
-    label_ids = [int(l) for l in labels.split(",") if l.strip().isdigit()] if labels else None
+    label_ids = [int(lbl) for lbl in labels.split(",") if lbl.strip().isdigit()] if labels else None
     milestone_id = int(milestone) if milestone.strip().isdigit() else None
 
     issue = await gitea.create_issue(
@@ -346,7 +349,7 @@ async def update_issue_api(
     if state:
         kwargs["state"] = state
     if labels:
-        label_ids = [int(l) for l in labels.split(",") if l.strip().isdigit()]
+        label_ids = [int(lbl) for lbl in labels.split(",") if lbl.strip().isdigit()]
     if milestone and milestone.strip().isdigit():
         kwargs["milestone"] = int(milestone)
     if assignee:
@@ -389,7 +392,7 @@ async def get_issue_detail(owner: str, repo: str, issue_id: int, format: str = Q
         comments = await gitea.get_issue_comments(owner, repo, issue_id)
     except Exception as e:
         logger.warning("Failed to fetch issue %s/%s #%d: %s", owner, repo, issue_id, e)
-        raise HTTPException(status_code=404, detail=f"Issue #{issue_id} not found")
+        raise HTTPException(status_code=404, detail=f"Issue #{issue_id} not found") from e
 
     # Get checklists from local DB
     with get_conn() as conn:
@@ -441,8 +444,8 @@ async def get_issue_detail(owner: str, repo: str, issue_id: int, format: str = Q
             "comments": comments,
             "checklists": checklists,
         }
-        from jinja2 import Environment, FileSystemLoader
-        env = Environment(loader=FileSystemLoader("app/templates"))
+        from app.templating import ENV
+        env = ENV
         template = env.get_template("card_detail.html")
         return HTMLResponse(template.render(**ctx))
 
@@ -457,7 +460,7 @@ async def get_issue_detail(owner: str, repo: str, issue_id: int, format: str = Q
 # ── v0.5.0: Checklists ──
 
 @router.post("/checklists/{owner}/{repo}/{issue_id}")
-async def create_checklist(
+def create_checklist(
     owner: str,
     repo: str,
     issue_id: int,
@@ -481,7 +484,7 @@ async def create_checklist(
 
 
 @router.post("/checklist-items/{owner}/{repo}/{issue_id}/{checklist_id}")
-async def add_checklist_item(
+def add_checklist_item(
     owner: str,
     repo: str,
     issue_id: int,
@@ -499,7 +502,7 @@ async def add_checklist_item(
 
 
 @router.patch("/checklist-items/{item_id}")
-async def toggle_checklist_item(
+def toggle_checklist_item(
     item_id: int,
     checked: bool = Query(default=False),
     content: str = Query(default=""),
@@ -521,7 +524,7 @@ async def toggle_checklist_item(
 
 
 @router.delete("/checklist-items/{item_id}")
-async def delete_checklist_item(item_id: int):
+def delete_checklist_item(item_id: int):
     """Delete a checklist item."""
     with get_conn() as conn:
         conn.execute("DELETE FROM checklist_items WHERE id=?", (item_id,))
@@ -530,7 +533,7 @@ async def delete_checklist_item(item_id: int):
 
 
 @router.delete("/checklists/{checklist_id}")
-async def delete_checklist(checklist_id: int):
+def delete_checklist(checklist_id: int):
     """Delete a checklist and all its items."""
     with get_conn() as conn:
         conn.execute("DELETE FROM checklist_items WHERE checklist_id=?", (checklist_id,))
@@ -542,14 +545,19 @@ async def delete_checklist(checklist_id: int):
 # ── v1.0.0: User management ──
 
 @router.get("/users/me")
-async def get_my_profile(request: Request):
+def get_my_profile(request: Request):
     """Get current user profile."""
     user = SessionManager.decode_session(request.cookies.get("flowdeck_session", ""))
     if not user:
         return {"login": "guest", "full_name": "Guest", "email": ""}
     with get_conn() as conn:
+        # A29-byproduct : jamais `SELECT *` ici — la ligne contenait
+        # password_hash, login_attempts et locked_until.
         row = conn.execute(
-            "SELECT * FROM users WHERE login=?", (user.get("login", ""),)
+            "SELECT id, login, full_name, email, avatar_url, avatar_color, "
+            "is_admin, is_active, last_login, created_at "
+            "FROM users WHERE login=?",
+            (user.get("login", ""),),
         ).fetchone()
         if row:
             return dict(row)
@@ -557,7 +565,7 @@ async def get_my_profile(request: Request):
 
 
 @router.put("/users/me")
-async def update_my_profile(request: Request, full_name: str = Query(default=""),
+def update_my_profile(request: Request, full_name: str = Query(default=""),
                              email: str = Query(default="")):
     """Update current user's local profile."""
     user = SessionManager.decode_session(request.cookies.get("flowdeck_session", ""))
@@ -576,7 +584,7 @@ async def update_my_profile(request: Request, full_name: str = Query(default="")
 # ── v0.5.0: Card priority & due date ──
 
 @router.post("/card/{owner}/{repo}/{issue_id}")
-async def update_card(
+def update_card(
     owner: str,
     repo: str,
     issue_id: int,
@@ -623,3 +631,55 @@ async def get_collaborators(owner: str, repo: str):
         return {"collaborators": collaborators}
     except Exception as e:
         return {"collaborators": [], "error": str(e)}
+
+
+# ── Frontend Error Capture ───────────────────────────────────
+# Hermes diagnostique le frontend en appelant GET /api/frontend-errors
+
+_frontend_errors: list[dict] = []
+_MAX_STORED_ERRORS = 100
+
+
+@router.post("/frontend-error")
+async def capture_frontend_error(request: Request):
+    """Reçoit les erreurs JS du navigateur. Appelé automatiquement par app.js."""
+    try:
+        body = await request.json()
+    except Exception:
+        return {"status": "ignored", "reason": "invalid json"}
+
+    msg = body.get("message", "")
+    err_type = body.get("type", "error")
+    source = body.get("source", "")
+    line = body.get("line", 0)
+
+    # Dédupliquer les erreurs identiques consécutives
+    if _frontend_errors and _frontend_errors[-1].get("message") == msg:
+        _frontend_errors[-1]["count"] = _frontend_errors[-1].get("count", 1) + 1
+        _frontend_errors[-1]["time"] = body.get("time", "")
+    else:
+        body["count"] = 1
+        _frontend_errors.append(body)
+
+    while len(_frontend_errors) > _MAX_STORED_ERRORS:
+        _frontend_errors.pop(0)
+
+    if err_type == "error":
+        logger.warning("Frontend JS error: %s (%s:%s)", msg, source, line)
+    else:
+        logger.warning("Frontend unhandled rejection: %s", msg)
+
+    return {"status": "ok"}
+
+
+@router.get("/frontend-errors")
+def get_frontend_errors(request: Request, clear: bool = True):
+    """Retourne les erreurs frontend récentes. Hermes appelle cette route."""
+    errors = list(_frontend_errors)
+    if clear:
+        _frontend_errors.clear()
+    return {
+        "errors": errors,
+        "count": len(errors),
+        "cleared": clear,
+    }

app/routers/api_v2/__init__.py

@@ -0,0 +1,42 @@
+"""FlowDeck — Public API v2.
+
+Découpe A28 : l'ancien `api_v2.py` (2 110 lignes, 115 routes) est devenu
+ce package — un module par concern (`_common` = helpers), `router`
+agrégé ci-dessous avec le même prefix/tags qu'avant → 0 changement
+d'URL, 0 changement d'operation_id.
+"""
+from __future__ import annotations
+
+from fastapi import APIRouter
+
+from . import (
+    admin,
+    collections,
+    engagement,
+    identity,
+    planning,
+    projects,
+    properties,
+    sharing,
+    templates_io,
+    views,
+    webhooks,
+    workspaces,
+)
+
+router = APIRouter(prefix="/api/v2")
+for _mod in (
+    identity,
+    workspaces,
+    collections,
+    properties,
+    views,
+    engagement,
+    sharing,
+    planning,
+    templates_io,
+    projects,
+    admin,
+    webhooks,
+):
+    router.include_router(_mod.router)

app/routers/api_v2/_common.py

@@ -0,0 +1,36 @@
+"""FlowDeck — API v2 : helpers partagés des modules de routes (A28)."""
+from __future__ import annotations
+
+import hashlib
+import logging
+
+from fastapi import HTTPException, Request
+
+from app.services.api_v2_helpers import (  # noqa: F401 — require_scope est utilisé par les handlers
+    audit_log,
+    check_idempotency,
+    check_v2_rate_limit,
+    get_bearer_user,
+    has_scope,
+    paginate_headers,
+    parse_pagination,
+    require_scope,
+    row_to_dict,
+    store_idempotency,
+    to_iso8601,
+    validate_scopes_input,
+)
+
+logger = logging.getLogger(__name__)
+
+def _hash(token: str) -> str:
+    return hashlib.sha256(token.encode()).hexdigest()
+
+def _v2_rate_check(request: Request, user: dict) -> None:
+    ip = request.client.host if request.client else "unknown"
+    th = user.get("_token_hash")
+    if not check_v2_rate_limit(th, ip):
+        raise HTTPException(status_code=429, detail="Rate limit exceeded: 300 req/min per token")
+
+# ── Tokens ────────────────────────────────────────────────────────────────
+

app/routers/api_v2/admin.py

@@ -0,0 +1,91 @@
+"""FlowDeck — Public API v2 : admin.
+
+Découpe A28 de l'ancien app/routers/api_v2.py (2 110 lignes, 115 routes) — un module par concern, contrat inchangé (Bearer+scopes, pagination, RFC7807, audit + idempotency).
+"""
+from __future__ import annotations
+
+import logging
+
+from fastapi import APIRouter, Body, Header, HTTPException, Request
+
+from app.db import get_conn
+from app.services.api_v2_helpers import (  # noqa: F401 — require_scope est utilisé par les handlers
+    audit_log,
+    check_idempotency,
+    check_v2_rate_limit,
+    get_bearer_user,
+    has_scope,
+    paginate_headers,
+    parse_pagination,
+    require_scope,
+    row_to_dict,
+    store_idempotency,
+    to_iso8601,
+    validate_scopes_input,
+)
+
+from ._common import _v2_rate_check
+
+logger = logging.getLogger(__name__)
+router = APIRouter(tags=["api-v2"])
+
+
+
+@router.patch("/admin/users/{uid}")
+def admin_patch_user_v2(uid: int, request: Request, authorization: str | None = Header(default=None), body: dict = Body(default={})):
+    user = get_bearer_user(request, authorization)
+    _v2_rate_check(request, user)
+    if not user.get("is_admin") and not has_scope(user.get("_token_scopes"), "admin"):
+        raise HTTPException(403, "Admin scope required")
+    with get_conn() as conn:
+        if not conn.execute("SELECT id FROM users WHERE id=?", (uid,)).fetchone():
+            raise HTTPException(404, "User not found")
+        sets = []
+        params: list = []
+        for k in ("is_active", "is_admin", "full_name", "email"):
+            if k in body:
+                sets.append(f"{k}=?")
+                params.append(int(body[k]) if k in ("is_active", "is_admin") else body[k])
+        if not sets:
+            raise HTTPException(400, "No fields")
+        params.append(uid)
+        conn.execute(f"UPDATE users SET {', '.join(sets)} WHERE id=?", params)
+        conn.commit()
+    audit_log(user, "admin.user_update", "user", uid, "", request)
+    return {"id": uid, "status": "updated"}
+
+
+@router.delete("/admin/users/{uid}")
+def admin_delete_user_v2(uid: int, request: Request, authorization: str | None = Header(default=None)):
+    user = get_bearer_user(request, authorization)
+    _v2_rate_check(request, user)
+    if not user.get("is_admin") and not has_scope(user.get("_token_scopes"), "admin"):
+        raise HTTPException(403, "Admin scope required")
+    if uid == user["id"]:
+        raise HTTPException(400, "Cannot delete yourself")
+    with get_conn() as conn:
+        conn.execute("DELETE FROM users WHERE id=?", (uid,))
+        conn.commit()
+    audit_log(user, "admin.user_delete", "user", uid, "", request)
+    return {"id": uid, "status": "deleted"}
+
+
+@router.get("/admin/audit-logs")
+def admin_audit_logs_v2(request: Request, limit: int = 50, authorization: str | None = Header(default=None)):
+    user = get_bearer_user(request, authorization)
+    _v2_rate_check(request, user)
+    if not user.get("is_admin") and not has_scope(user.get("_token_scopes"), "admin"):
+        raise HTTPException(403, "Admin scope required")
+    limit = max(1, min(limit, 200))
+    with get_conn() as conn:
+        rows = conn.execute("SELECT * FROM api_audit_log ORDER BY created_at DESC LIMIT ?", (limit,)).fetchall()
+    return {"logs": [row_to_dict(r) for r in rows]}
+
+
+@router.get("/webhooks/events")
+def list_webhook_events_v2(request: Request, authorization: str | None = Header(default=None)):
+    """Catalogue of deliverable events (+ wildcard syntax)."""
+    user = get_bearer_user(request, authorization)
+    _v2_rate_check(request, user)
+    from app.services.webhook_outbound import EVENTS
+    return {"events": EVENTS, "wildcards": ["*", "page.*", "collection.*"]}

app/routers/api_v2/collections.py

@@ -0,0 +1,566 @@
+"""FlowDeck — Public API v2 : collections.
+
+Découpe A28 de l'ancien app/routers/api_v2.py (2 110 lignes, 115 routes) — un module par concern, contrat inchangé (Bearer+scopes, pagination, RFC7807, audit + idempotency).
+"""
+from __future__ import annotations
+
+import json
+import logging
+
+from fastapi import APIRouter, Body, Header, HTTPException, Request
+from fastapi.responses import JSONResponse
+
+from app.db import get_conn
+from app.services.api_v2_helpers import (  # noqa: F401 — require_scope est utilisé par les handlers
+    audit_log,
+    check_idempotency,
+    check_v2_rate_limit,
+    get_bearer_user,
+    has_scope,
+    paginate_headers,
+    parse_pagination,
+    require_scope,
+    row_to_dict,
+    store_idempotency,
+    to_iso8601,
+    validate_scopes_input,
+)
+from app.services.automations import fire_event as _fire_event
+from app.services.automations import run_event_sync
+
+from ._common import _v2_rate_check
+
+logger = logging.getLogger(__name__)
+router = APIRouter(tags=["api-v2"])
+
+
+
+@router.get("/collections")
+def list_collections_v2(request: Request, authorization: str | None = Header(default=None)):
+    user = get_bearer_user(request, authorization)
+    _v2_rate_check(request, user)
+    limit, offset = parse_pagination(request)
+    ws_filter = request.query_params.get("workspace_id")
+    q = (request.query_params.get("query") or "").strip()
+    with get_conn() as conn:
+        where = []
+        params: list = []
+        if ws_filter:
+            try:
+                wid = int(ws_filter)
+                where.append("c.workspace_id=?")
+                params.append(wid)
+            except ValueError:
+                pass
+        if q:
+            where.append("(c.name LIKE ? OR c.description LIKE ?)")
+            like = f"%{q}%"
+            params.extend([like, like])
+        clause = ("WHERE " + " AND ".join(where)) if where else ""
+        total = conn.execute(f"SELECT COUNT(*) FROM collections c {clause}", params).fetchone()[0]
+        rows = conn.execute(f"SELECT c.* FROM collections c {clause} ORDER BY c.name LIMIT ? OFFSET ?", (*params, limit, offset)).fetchall()
+    cols = []
+    for r in rows:
+        d = row_to_dict(r)
+        # filter by visibility: skip private not visible (best-effort)
+        cols.append(d)
+    resp = {"collections": cols, "total": total, "limit": limit, "offset": offset}
+    return JSONResponse(content=resp, headers=paginate_headers(total))
+
+
+@router.post("/collections")
+def create_collection_v2(request: Request, authorization: str | None = Header(default=None), body: dict = Body(default={})):
+    user = require_scope("write")(request, authorization)
+    _v2_rate_check(request, user)
+    idem = check_idempotency(request, user["id"])
+    if idem:
+        return JSONResponse(content=idem["data"], status_code=idem["status"])
+    name = (body.get("name") or "").strip()
+    if not name:
+        raise HTTPException(400, "name is required")
+    description = body.get("description", "")
+    icon = body.get("icon", "📋")
+    workspace_id = body.get("workspace_id")
+    schema = body.get("schema") or body.get("schema_json") or []
+    if isinstance(schema, str):
+        try:
+            schema = json.loads(schema)
+        except Exception:
+            schema = []
+    schema_json = json.dumps(schema)
+    with get_conn() as conn:
+        cur = conn.execute("INSERT INTO collections (name, description, icon, schema_json, workspace_id, created_by) VALUES (?, ?, ?, ?, ?, ?)", (name, description, icon, schema_json, workspace_id, user["id"]))
+        cid = cur.lastrowid
+        # materialize properties if schema provided — A25 : PAS de try ici,
+        # une exception doit interrompre la transaction (sinon la collection est
+        # commitée sans son schéma et l'erreur disparaît).
+        from app.services.db_templates import materialize_properties
+        materialize_properties(conn, cid, schema)
+        # default view
+        conn.execute("INSERT INTO collection_views (collection_id, name, view_type, config_json) VALUES (?,?,?,?)", (cid, "Default View", "table", json.dumps({"visible_properties": ["Title"]})))
+        conn.commit()
+        row = conn.execute("SELECT * FROM collections WHERE id=?", (cid,)).fetchone()
+    audit_log(user, "collection.create", "collection", cid, name, request)
+    data = {"id": cid, "name": name, "status": "created", "collection": row_to_dict(row)}
+    key = (request.headers.get("Idempotency-Key") or "").strip()
+    if key:
+        store_idempotency(key, user["id"], data, 201)
+    return JSONResponse(content=data, status_code=201)
+
+
+@router.get("/collections/{collection_id}")
+def get_collection_v2(collection_id: int, request: Request, authorization: str | None = Header(default=None)):
+    user = get_bearer_user(request, authorization)
+    _v2_rate_check(request, user)
+    with get_conn() as conn:
+        row = conn.execute("SELECT * FROM collections WHERE id=?", (collection_id,)).fetchone()
+        if not row:
+            raise HTTPException(404, "Collection not found")
+        pages = conn.execute("SELECT id, title, icon, position, property_values_json, created_at FROM collection_pages WHERE collection_id=? ORDER BY position LIMIT 50", (collection_id,)).fetchall()
+    d = row_to_dict(row)
+    d["pages"] = [row_to_dict(p) for p in pages]
+    return d
+
+
+@router.patch("/collections/{collection_id}")
+def patch_collection_v2(collection_id: int, request: Request, authorization: str | None = Header(default=None), body: dict = Body(default={})):
+    user = require_scope("write")(request, authorization)
+    _v2_rate_check(request, user)
+    with get_conn() as conn:
+        row = conn.execute("SELECT * FROM collections WHERE id=?", (collection_id,)).fetchone()
+        if not row:
+            raise HTTPException(404, "Collection not found")
+        name = body.get("name", row["name"])
+        description = body.get("description", row["description"])
+        icon = body.get("icon", row["icon"])
+        schema = body.get("schema") or body.get("schema_json")
+        if schema is not None:
+            sj = json.dumps(schema) if isinstance(schema, (list, dict)) else str(schema)
+        else:
+            sj = row["schema_json"]
+        conn.execute("UPDATE collections SET name=?, description=?, icon=?, schema_json=?, updated_at=CURRENT_TIMESTAMP WHERE id=?", (name, description, icon, sj, collection_id))
+        conn.commit()
+    audit_log(user, "collection.update", "collection", collection_id, "", request)
+    return {"id": collection_id, "status": "updated"}
+
+
+@router.delete("/collections/{collection_id}")
+def delete_collection_v2(collection_id: int, request: Request, authorization: str | None = Header(default=None)):
+    user = require_scope("write")(request, authorization)
+    _v2_rate_check(request, user)
+    with get_conn() as conn:
+        row = conn.execute("SELECT * FROM collections WHERE id=?", (collection_id,)).fetchone()
+        if not row:
+            raise HTTPException(404, "Collection not found")
+        conn.execute("DELETE FROM collections WHERE id=?", (collection_id,))
+        conn.commit()
+    audit_log(user, "collection.delete", "collection", collection_id, "", request)
+    return {"id": collection_id, "status": "deleted"}
+
+
+@router.post("/collections/{collection_id}/linked")
+def create_linked_db(collection_id: int, request: Request, authorization: str | None = Header(default=None), body: dict = Body(default={})):
+    user = require_scope("write")(request, authorization)
+    _v2_rate_check(request, user)
+    name = (body.get("name") or "").strip() or f"Linked DB {collection_id}"
+    with get_conn() as conn:
+        src = conn.execute("SELECT * FROM collections WHERE id=?", (collection_id,)).fetchone()
+        if not src:
+            raise HTTPException(404, "Collection not found")
+        cur = conn.execute("INSERT INTO collections (name, description, icon, schema_json, workspace_id, created_by) VALUES (?, ?, ?, ?, ?, ?)", (name, src["description"], src["icon"], src["schema_json"], src["workspace_id"] if "workspace_id" in src.keys() else None, user["id"]))
+        nid = cur.lastrowid
+        # copy data source as linked
+        try:
+            conn.execute("INSERT INTO collection_data_sources (collection_id, source_collection_id, is_linked) VALUES (?, ?, 1)", (nid, collection_id))
+        except Exception:
+            logger.exception("create_linked_db")
+        # copy views + properties (light)
+        rows = conn.execute("SELECT * FROM collection_properties WHERE collection_id=?", (collection_id,)).fetchall()
+        for p in rows:
+            try:
+                conn.execute("INSERT INTO collection_properties (collection_id, name, prop_type, options_json, position) VALUES (?, ?, ?, ?, ?)", (nid, p["name"], p["prop_type"], p["options_json"], p["position"]))
+            except Exception:
+                logger.exception("create_linked_db")
+        vrows = conn.execute("SELECT * FROM collection_views WHERE collection_id=?", (collection_id,)).fetchall()
+        for v in vrows:
+            try:
+                conn.execute("INSERT INTO collection_views (collection_id, name, view_type, config_json, position) VALUES (?, ?, ?, ?, ?)", (nid, v["name"], v["view_type"], v["config_json"], v["position"]))
+            except Exception:
+                logger.exception("create_linked_db")
+        conn.commit()
+    audit_log(user, "collection.linked", "collection", nid, f"src={collection_id}", request)
+    return {"id": nid, "name": name, "status": "created"}
+
+
+@router.post("/collections/{collection_id}/task")
+def toggle_task(collection_id: int, request: Request, authorization: str | None = Header(default=None)):
+    user = require_scope("write")(request, authorization)
+    _v2_rate_check(request, user)
+    with get_conn() as conn:
+        row = conn.execute("SELECT is_task FROM collections WHERE id=?", (collection_id,)).fetchone()
+        if not row:
+            raise HTTPException(404, "Collection not found")
+        cur_val = row["is_task"] if "is_task" in row.keys() else 0
+        new_val = 0 if cur_val else 1
+        conn.execute("UPDATE collections SET is_task=? WHERE id=?", (new_val, collection_id))
+        conn.commit()
+    audit_log(user, "collection.toggle_task", "collection", collection_id, str(new_val), request)
+    return {"id": collection_id, "is_task": bool(new_val)}
+
+
+@router.get("/collections/{collection_id}/sources")
+def list_sources(collection_id: int, request: Request, authorization: str | None = Header(default=None)):
+    user = get_bearer_user(request, authorization)
+    _v2_rate_check(request, user)
+    with get_conn() as conn:
+        if not conn.execute("SELECT id FROM collections WHERE id=?", (collection_id,)).fetchone():
+            raise HTTPException(404, "Collection not found")
+        rows = conn.execute("SELECT * FROM collection_data_sources WHERE collection_id=? ORDER BY position", (collection_id,)).fetchall()
+    return {"sources": [dict(r) for r in rows]}
+
+
+@router.post("/collections/{collection_id}/sources")
+def add_source(collection_id: int, request: Request, authorization: str | None = Header(default=None), body: dict = Body(default={})):
+    user = require_scope("write")(request, authorization)
+    _v2_rate_check(request, user)
+    src_id = body.get("source_collection_id") or body.get("source_id")
+    if not src_id:
+        raise HTTPException(400, "source_collection_id required")
+    with get_conn() as conn:
+        if not conn.execute("SELECT id FROM collections WHERE id=?", (collection_id,)).fetchone():
+            raise HTTPException(404, "Collection not found")
+        if not conn.execute("SELECT id FROM collections WHERE id=?", (src_id,)).fetchone():
+            raise HTTPException(404, "Source collection not found")
+        try:
+            conn.execute("INSERT INTO collection_data_sources (collection_id, source_collection_id) VALUES (?, ?)", (collection_id, src_id))
+            conn.commit()
+        except Exception as e:
+            raise HTTPException(409, str(e)) from None
+    audit_log(user, "collection.add_source", "collection", collection_id, str(src_id), request)
+    return {"collection_id": collection_id, "source_collection_id": src_id, "status": "added"}
+
+
+@router.delete("/collections/{collection_id}/sources/{source_id}")
+def remove_source(collection_id: int, source_id: int, request: Request, authorization: str | None = Header(default=None)):
+    user = require_scope("write")(request, authorization)
+    _v2_rate_check(request, user)
+    with get_conn() as conn:
+        conn.execute("DELETE FROM collection_data_sources WHERE collection_id=? AND (id=? OR source_collection_id=?)", (collection_id, source_id, source_id))
+        conn.commit()
+    audit_log(user, "collection.remove_source", "collection", collection_id, str(source_id), request)
+    return {"status": "removed"}
+
+
+@router.get("/collections/{collection_id}/pages")
+def list_collection_pages_v2(collection_id: int, request: Request, authorization: str | None = Header(default=None)):
+    user = get_bearer_user(request, authorization)
+    _v2_rate_check(request, user)
+    limit, offset = parse_pagination(request)
+    with get_conn() as conn:
+        if not conn.execute("SELECT id FROM collections WHERE id=?", (collection_id,)).fetchone():
+            raise HTTPException(404, "Collection not found")
+        total = conn.execute("SELECT COUNT(*) FROM collection_pages WHERE collection_id=?", (collection_id,)).fetchone()[0]
+        # filters: filter[status]=Done etc., sort, fields
+        # Simple: filter by property name via property_values_json LIKE (best-effort), sort by position or title
+        sort = request.query_params.get("sort") or ""
+        order = "position"
+        desc = False
+        if sort:
+            if sort.startswith("-"):
+                desc = True
+                sort = sort[1:]
+            # allow sorting by title/position/created_at
+            if sort in ("title", "position", "created_at", "updated_at"):
+                order = sort
+        direction = "DESC" if desc else "ASC"
+        rows = conn.execute(f"SELECT * FROM collection_pages WHERE collection_id=? ORDER BY {order} {direction} LIMIT ? OFFSET ?", (collection_id, limit, offset)).fetchall()
+    # apply filter[xxx] in-memory (small)
+    filters = {k[7:-1]: v for k, v in request.query_params.items() if k.startswith("filter[") and k.endswith("]")}
+    fields = request.query_params.get("fields")
+    fields_set = set(fields.split(",")) if fields else None
+    out = []
+    for r in rows:
+        d = row_to_dict(r)
+        # property filter (AND)
+        if filters:
+            try:
+                pv = json.loads(r["property_values_json"] or "{}") if isinstance(r["property_values_json"], str) else r["property_values_json"]
+            except Exception:
+                pv = {}
+            ok = True
+            for fk, fv in filters.items():
+                # lookup by prop id or name
+                found = False
+                for kk, vv in (pv or {}).items():
+                    if str(kk) == str(fk) or str(kk).lower() == fk.lower():
+                        if str(vv) == str(fv):
+                            found = True
+                        break
+                # also check title if filter field is title
+                if fk == "title" and d.get("title") == fv:
+                    found = True
+                if not found:
+                    ok = False
+                    break
+            if not ok:
+                continue
+        if fields_set:
+            d = {k: v for k, v in d.items() if k in fields_set or k in ("id", "collection_id")}
+        out.append(d)
+    return JSONResponse(content={"pages": out, "total": total, "limit": limit, "offset": offset}, headers=paginate_headers(total))
+
+
+@router.post("/collections/{collection_id}/pages")
+def create_collection_page_v2(collection_id: int, request: Request, authorization: str | None = Header(default=None), body: dict = Body(default={})):
+    user = require_scope("write")(request, authorization)
+    _v2_rate_check(request, user)
+    idem = check_idempotency(request, user["id"])
+    if idem:
+        return JSONResponse(content=idem["data"], status_code=idem["status"])
+    title = (body.get("title") or body.get("name") or "Untitled").strip() or "Untitled"
+    icon = body.get("icon", "file")
+    parent_id = body.get("parent_id")
+    prop_vals = body.get("property_values") or body.get("properties") or body.get("property_values_json") or {}
+    if isinstance(prop_vals, str):
+        try:
+            prop_vals = json.loads(prop_vals)
+        except Exception:
+            prop_vals = {}
+    with get_conn() as conn:
+        if not conn.execute("SELECT id FROM collections WHERE id=?", (collection_id,)).fetchone():
+            raise HTTPException(404, "Collection not found")
+        # validate properties if helper exists
+        try:
+            pass
+            # light validation: we rely on existing validators
+        except Exception:
+            logger.exception("create_collection_page_v2")
+        max_pos = conn.execute("SELECT COALESCE(MAX(position), -1)+1 FROM collection_pages WHERE collection_id=?", (collection_id,)).fetchone()[0]
+        # apply auto props
+        try:
+            props_list = [dict(r) for r in conn.execute("SELECT * FROM collection_properties WHERE collection_id=?", (collection_id,)).fetchall()]
+            from app.services.property_types import apply_auto_properties as _aap
+            _aap(props_list, prop_vals, user, is_create=True)
+        except Exception:
+            logger.exception("create_collection_page_v2")
+        cur = conn.execute("INSERT INTO collection_pages (collection_id, title, icon, position, parent_id, property_values_json) VALUES (?, ?, ?, ?, ?, ?)", (collection_id, title, icon, max_pos, parent_id, json.dumps(prop_vals)))
+        pid = cur.lastrowid
+        conn.commit()
+        row = conn.execute("SELECT * FROM collection_pages WHERE id=?", (pid,)).fetchone()
+    audit_log(user, "page.create", "collection_page", pid, title, request)
+    try:
+        run_event_sync(_fire_event("collection.page.created", {"page_id": pid, "collection_id": collection_id, "title": title}))
+    except Exception:
+        logger.exception("create_collection_page_v2")
+    data = {"id": pid, "title": title, "status": "created", "page": row_to_dict(row)}
+    key = (request.headers.get("Idempotency-Key") or "").strip()
+    if key:
+        store_idempotency(key, user["id"], data, 201)
+    return JSONResponse(content=data, status_code=201)
+
+
+@router.get("/pages/{page_id}")
+def get_page_v2(page_id: int, request: Request, authorization: str | None = Header(default=None)):
+    user = get_bearer_user(request, authorization)
+    _v2_rate_check(request, user)
+    with get_conn() as conn:
+        row = conn.execute("SELECT * FROM collection_pages WHERE id=?", (page_id,)).fetchone()
+        if not row:
+            # also try pages table (block pages)
+            row2 = conn.execute("SELECT * FROM pages WHERE id=?", (page_id,)).fetchone()
+            if not row2:
+                raise HTTPException(404, "Page not found")
+            d = row_to_dict(row2)
+            # v6.5.0: resolve synced blocks server-side (fresh content).
+            if (d.get("content_format") or "blocks") == "blocks" and d.get("content"):
+                from app.services.synced_blocks import resolve_content_json
+                d["content"] = resolve_content_json(d["content"], d["content_format"])
+            return d
+        d = row_to_dict(row)
+        # property_values_json already parsed by row_to_dict
+        # v6.5.0: expose the row's content page when it exists (no lazy
+        # creation on a read-only endpoint).
+        content_page_id = conn.execute(
+            "SELECT id FROM pages WHERE collection_row_id=?",
+            (page_id,),
+        ).fetchone()
+        d["content_page_id"] = content_page_id["id"] if content_page_id else None
+        return d
+
+
+@router.patch("/pages/{page_id}")
+def patch_page_v2(page_id: int, request: Request, authorization: str | None = Header(default=None), body: dict = Body(default={})):
+    user = require_scope("write")(request, authorization)
+    _v2_rate_check(request, user)
+    with get_conn() as conn:
+        row = conn.execute("SELECT * FROM collection_pages WHERE id=?", (page_id,)).fetchone()
+        if not row:
+            raise HTTPException(404, "Page not found")
+        title = body.get("title", row["title"])
+        icon = body.get("icon", row["icon"])
+        pos = body.get("position", row["position"])
+        parent_id = body.get("parent_id", row["parent_id"])
+        pv_raw = row["property_values_json"] or "{}"
+        try:
+            stored = json.loads(pv_raw) if isinstance(pv_raw, str) else dict(pv_raw)
+        except Exception:
+            stored = {}
+        incoming = body.get("property_values") or body.get("properties")
+        if incoming is not None:
+            if isinstance(incoming, str):
+                try:
+                    incoming = json.loads(incoming)
+                except Exception:
+                    incoming = {}
+            # merge
+            for k, v in (incoming or {}).items():
+                stored[str(k)] = v
+        # apply auto props
+        try:
+            props_list = [dict(r) for r in conn.execute("SELECT * FROM collection_properties WHERE collection_id=?", (row["collection_id"],)).fetchall()]
+            from app.services.property_types import apply_auto_properties as _aap
+            _aap(props_list, stored, user, is_create=False)
+        except Exception:
+            logger.exception("patch_page_v2")
+        conn.execute("UPDATE collection_pages SET title=?, icon=?, position=?, parent_id=?, property_values_json=?, updated_at=CURRENT_TIMESTAMP WHERE id=?", (title, icon, pos, parent_id, json.dumps(stored), page_id))
+        conn.commit()
+    audit_log(user, "page.update", "collection_page", page_id, "", request)
+    try:
+        run_event_sync(_fire_event("collection.page.updated", {"page_id": page_id, "collection_id": row["collection_id"], "title": title}))
+    except Exception:
+        logger.exception("patch_page_v2")
+    return {"id": page_id, "status": "updated"}
+
+
+@router.delete("/pages/{page_id}")
+def delete_page_v2(page_id: int, request: Request, authorization: str | None = Header(default=None)):
+    user = require_scope("write")(request, authorization)
+    _v2_rate_check(request, user)
+    with get_conn() as conn:
+        row = conn.execute("SELECT * FROM collection_pages WHERE id=?", (page_id,)).fetchone()
+        if not row:
+            raise HTTPException(404, "Page not found")
+        conn.execute("DELETE FROM collection_pages WHERE id=?", (page_id,))
+        conn.commit()
+    audit_log(user, "page.delete", "collection_page", page_id, "", request)
+    try:
+        run_event_sync(_fire_event("collection.page.deleted", {"page_id": page_id, "collection_id": row["collection_id"]}))
+    except Exception:
+        logger.exception("delete_page_v2")
+    return {"id": page_id, "status": "deleted"}
+
+
+@router.post("/pages/{page_id}/restore")
+def restore_page_v2(page_id: int, request: Request, authorization: str | None = Header(default=None)):
+    user = require_scope("write")(request, authorization)
+    _v2_rate_check(request, user)
+    # For soft-deleted pages (deleted_at) - but collection_pages has no deleted_at; handle pages table
+    with get_conn() as conn:
+        row = conn.execute("SELECT deleted_at FROM pages WHERE id=?", (page_id,)).fetchone()
+        if row and row["deleted_at"]:
+            conn.execute("UPDATE pages SET deleted_at=NULL WHERE id=?", (page_id,))
+            conn.commit()
+            try:
+                run_event_sync(_fire_event("page.restored", {"page_id": page_id}))
+            except Exception:
+                logger.exception("restore_page_v2")
+            return {"id": page_id, "status": "restored"}
+        raise HTTPException(404, "Page not found or not deleted")
+
+
+@router.post("/pages/{page_id}/move")
+def move_page_v2(page_id: int, request: Request, authorization: str | None = Header(default=None), body: dict = Body(default={})):
+    user = require_scope("write")(request, authorization)
+    _v2_rate_check(request, user)
+    with get_conn() as conn:
+        row = conn.execute("SELECT * FROM collection_pages WHERE id=?", (page_id,)).fetchone()
+        if not row:
+            raise HTTPException(404, "Page not found")
+        parent_id = body.get("parent_id", row["parent_id"])
+        position = body.get("position", row["position"])
+        conn.execute("UPDATE collection_pages SET parent_id=?, position=?, updated_at=CURRENT_TIMESTAMP WHERE id=?", (parent_id, position, page_id))
+        conn.commit()
+    audit_log(user, "page.move", "collection_page", page_id, f"parent={parent_id} pos={position}", request)
+    return {"id": page_id, "status": "moved"}
+
+
+@router.get("/pages/{page_id}/sub-items")
+def list_sub_items_v2(page_id: int, request: Request, authorization: str | None = Header(default=None)):
+    user = get_bearer_user(request, authorization)
+    _v2_rate_check(request, user)
+    with get_conn() as conn:
+        if not conn.execute("SELECT id FROM collection_pages WHERE id=?", (page_id,)).fetchone():
+            raise HTTPException(404, "Page not found")
+        rows = conn.execute("SELECT * FROM collection_pages WHERE parent_id=? ORDER BY position", (page_id,)).fetchall()
+    return {"sub_items": [row_to_dict(r) for r in rows]}
+
+
+@router.post("/pages/{page_id}/sub-items")
+def create_sub_item_v2(page_id: int, request: Request, authorization: str | None = Header(default=None), body: dict = Body(default={})):
+    user = require_scope("write")(request, authorization)
+    _v2_rate_check(request, user)
+    with get_conn() as conn:
+        parent = conn.execute("SELECT collection_id FROM collection_pages WHERE id=?", (page_id,)).fetchone()
+        if not parent:
+            raise HTTPException(404, "Page not found")
+        title = (body.get("title") or "Untitled").strip()
+        max_pos = conn.execute("SELECT COALESCE(MAX(position), -1)+1 FROM collection_pages WHERE parent_id=?", (page_id,)).fetchone()[0]
+        pv = json.dumps(body.get("property_values") or {})
+        cur = conn.execute("INSERT INTO collection_pages (collection_id, title, parent_id, position, property_values_json) VALUES (?, ?, ?, ?, ?)", (parent["collection_id"], title, page_id, max_pos, pv))
+        nid = cur.lastrowid
+        conn.commit()
+    audit_log(user, "page.create_subitem", "collection_page", nid, title, request)
+    return {"id": nid, "status": "created"}
+
+
+@router.get("/pages/{page_id}/dependencies")
+def list_dependencies_v2(page_id: int, request: Request, authorization: str | None = Header(default=None)):
+    user = get_bearer_user(request, authorization)
+    _v2_rate_check(request, user)
+    with get_conn() as conn:
+        rows = conn.execute("SELECT * FROM page_dependencies WHERE page_id=?", (page_id,)).fetchall()
+    return {"dependencies": [dict(r) for r in rows]}
+
+
+@router.post("/pages/{page_id}/dependencies")
+def add_dependency_v2(page_id: int, request: Request, authorization: str | None = Header(default=None), body: dict = Body(default={})):
+    user = require_scope("write")(request, authorization)
+    _v2_rate_check(request, user)
+    dep_id = body.get("dependency_id") or body.get("depends_on")
+    dtype = body.get("dependency_type") or "blocks"
+    if not dep_id:
+        raise HTTPException(400, "dependency_id required")
+    with get_conn() as conn:
+        if not conn.execute("SELECT id FROM collection_pages WHERE id=?", (page_id,)).fetchone():
+            raise HTTPException(404, "Page not found")
+        if not conn.execute("SELECT id FROM collection_pages WHERE id=?", (dep_id,)).fetchone():
+            raise HTTPException(404, "Dependency page not found")
+        try:
+            conn.execute("INSERT INTO page_dependencies (page_id, dependency_id, dependency_type) VALUES (?, ?, ?)", (page_id, dep_id, dtype))
+            conn.commit()
+        except Exception as e:
+            raise HTTPException(409, str(e)) from None
+    audit_log(user, "page.add_dependency", "collection_page", page_id, str(dep_id), request)
+    return {"status": "added"}
+
+
+@router.delete("/pages/{page_id}/dependencies/{dep_id}")
+def remove_dependency_v2(page_id: int, dep_id: int, request: Request, authorization: str | None = Header(default=None)):
+    user = require_scope("write")(request, authorization)
+    _v2_rate_check(request, user)
+    with get_conn() as conn:
+        conn.execute("DELETE FROM page_dependencies WHERE page_id=? AND dependency_id=?", (page_id, dep_id))
+        conn.commit()
+    audit_log(user, "page.remove_dependency", "collection_page", page_id, str(dep_id), request)
+    return {"status": "removed"}
+
+
+@router.get("/collections/{collection_id}/properties")
+def list_properties_v2(collection_id: int, request: Request, authorization: str | None = Header(default=None)):
+    user = get_bearer_user(request, authorization)
+    _v2_rate_check(request, user)
+    with get_conn() as conn:
+        if not conn.execute("SELECT id FROM collections WHERE id=?", (collection_id,)).fetchone():
+            raise HTTPException(404, "Collection not found")
+        rows = conn.execute("SELECT * FROM collection_properties WHERE collection_id=? ORDER BY position", (collection_id,)).fetchall()
+    return {"properties": [row_to_dict(r) for r in rows]}

app/routers/api_v2/engagement.py

@@ -0,0 +1,338 @@
+"""FlowDeck — Public API v2 : engagement.
+
+Découpe A28 de l'ancien app/routers/api_v2.py (2 110 lignes, 115 routes) — un module par concern, contrat inchangé (Bearer+scopes, pagination, RFC7807, audit + idempotency).
+"""
+from __future__ import annotations
+
+import json
+import logging
+
+from fastapi import APIRouter, Body, Header, HTTPException, Request
+
+from app.db import get_conn
+from app.services.api_v2_helpers import (  # noqa: F401 — require_scope est utilisé par les handlers
+    audit_log,
+    check_idempotency,
+    check_v2_rate_limit,
+    get_bearer_user,
+    has_scope,
+    paginate_headers,
+    parse_pagination,
+    require_scope,
+    row_to_dict,
+    store_idempotency,
+    to_iso8601,
+    validate_scopes_input,
+)
+from app.services.automations import fire_event as _fire_event
+from app.services.automations import run_event_sync
+
+from ._common import _v2_rate_check
+
+logger = logging.getLogger(__name__)
+router = APIRouter(tags=["api-v2"])
+
+
+
+@router.get("/pages/{page_id}/comments")
+def list_comments_v2(page_id: int, request: Request, authorization: str | None = Header(default=None)):
+    user = get_bearer_user(request, authorization)
+    _v2_rate_check(request, user)
+    limit, offset = parse_pagination(request)
+    with get_conn() as conn:
+        total = conn.execute("SELECT COUNT(*) FROM comments WHERE target_id=? OR page_id=?", (page_id, page_id)).fetchone()[0]
+        rows = conn.execute("SELECT c.*, u.login, u.full_name FROM comments c LEFT JOIN users u ON u.id=c.user_id WHERE c.target_id=? OR c.page_id=? ORDER BY c.created_at LIMIT ? OFFSET ?", (page_id, page_id, limit, offset)).fetchall()
+    return {"comments": [row_to_dict(r) for r in rows], "total": total, "limit": limit, "offset": offset}
+
+
+@router.post("/pages/{page_id}/comments")
+def create_comment_v2(page_id: int, request: Request, authorization: str | None = Header(default=None), body: dict = Body(default={})):
+    user = require_scope("write")(request, authorization)
+    _v2_rate_check(request, user)
+    text = (body.get("body") or body.get("content") or "").strip()
+    if not text:
+        raise HTTPException(400, "body is required")
+    with get_conn() as conn:
+        cur = conn.execute("INSERT INTO comments (page_id, user_id, body, target_type, target_id, anchor_block_id, anchor_start, anchor_end) VALUES (?, ?, ?, 'page', ?, ?, ?, ?)", (page_id, user["id"], text, page_id, body.get("anchor_block_id"), body.get("anchor_start"), body.get("anchor_end")))
+        nid = cur.lastrowid
+        conn.commit()
+        row = conn.execute("SELECT * FROM comments WHERE id=?", (nid,)).fetchone()
+    audit_log(user, "comment.create", "comment", nid, text[:80], request)
+    try:
+        run_event_sync(_fire_event("comment.added", {"comment_id": nid, "page_id": page_id, "user_id": user["id"]}))
+    except Exception:
+        logger.exception("create_comment_v2")
+    return {"id": nid, "status": "created", "comment": row_to_dict(row)}
+
+
+@router.patch("/comments/{comment_id}")
+def patch_comment_v2(comment_id: int, request: Request, authorization: str | None = Header(default=None), body: dict = Body(default={})):
+    user = require_scope("write")(request, authorization)
+    _v2_rate_check(request, user)
+    with get_conn() as conn:
+        row = conn.execute("SELECT * FROM comments WHERE id=?", (comment_id,)).fetchone()
+        if not row:
+            raise HTTPException(404, "Comment not found")
+        if row["user_id"] != user["id"] and not user.get("is_admin"):
+            raise HTTPException(403, "Not your comment")
+        body_text = body.get("body", row["body"])
+        resolved = body.get("resolved", row["resolved"])
+        was_resolved = int(row["resolved"] or 0)
+        conn.execute("UPDATE comments SET body=?, resolved=?, updated_at=CURRENT_TIMESTAMP WHERE id=?", (body_text, int(bool(resolved)), comment_id))
+        conn.commit()
+    if int(bool(resolved)) and not was_resolved:
+        try:
+            run_event_sync(_fire_event("comment.resolved", {"comment_id": comment_id, "page_id": row["page_id"]}))
+        except Exception:
+            logger.exception("patch_comment_v2")
+    return {"id": comment_id, "status": "updated"}
+
+
+@router.delete("/comments/{comment_id}")
+def delete_comment_v2(comment_id: int, request: Request, authorization: str | None = Header(default=None)):
+    user = require_scope("write")(request, authorization)
+    _v2_rate_check(request, user)
+    with get_conn() as conn:
+        row = conn.execute("SELECT * FROM comments WHERE id=?", (comment_id,)).fetchone()
+        if not row:
+            raise HTTPException(404, "Comment not found")
+        if row["user_id"] != user["id"] and not user.get("is_admin"):
+            raise HTTPException(403, "Not your comment")
+        conn.execute("DELETE FROM comments WHERE id=?", (comment_id,))
+        conn.commit()
+    return {"id": comment_id, "status": "deleted"}
+
+
+@router.post("/pages/{page_id}/mentions")
+def create_mention_v2(page_id: int, request: Request, authorization: str | None = Header(default=None), body: dict = Body(default={})):
+    user = require_scope("write")(request, authorization)
+    _v2_rate_check(request, user)
+    targets = body.get("user_ids") or body.get("mentions") or []
+    if isinstance(targets, int):
+        targets = [targets]
+    if not targets:
+        raise HTTPException(400, "user_ids required")
+    created = 0
+    with get_conn() as conn:
+        for uid in targets:
+            try:
+                conn.execute("INSERT INTO notifications (user_id, actor_id, ntype, title, message, resource_type, resource_id, url) VALUES (?, ?, 'mention', 'You were mentioned', ?, 'page', ?, ?)", (uid, user["id"], body.get("message") or f"Mentioned in page {page_id}", page_id, f"/pages/{page_id}"))
+                created += 1
+            except Exception:
+                logger.exception("create_mention_v2")
+        conn.commit()
+    if created:
+        try:
+            run_event_sync(_fire_event("mention.added", {"page_id": page_id, "user_ids": [u for u in targets if isinstance(u, int)], "count": created}))
+        except Exception:
+            logger.exception("create_mention_v2")
+    return {"mentions": created, "status": "created"}
+
+
+@router.get("/notifications")
+def list_notifications_v2(request: Request, authorization: str | None = Header(default=None)):
+    user = get_bearer_user(request, authorization)
+    _v2_rate_check(request, user)
+    limit, offset = parse_pagination(request)
+    unread = request.query_params.get("unread")
+    with get_conn() as conn:
+        where = "user_id=?"
+        params: list = [user["id"]]
+        if unread == "1":
+            where += " AND is_read=0"
+        total = conn.execute(f"SELECT COUNT(*) FROM notifications WHERE {where}", params).fetchone()[0]
+        rows = conn.execute(f"SELECT * FROM notifications WHERE {where} ORDER BY created_at DESC LIMIT ? OFFSET ?", (*params, limit, offset)).fetchall()
+    return {"notifications": [row_to_dict(r) for r in rows], "total": total, "limit": limit, "offset": offset}
+
+
+@router.get("/notifications/unread-count")
+def unread_count(request: Request, authorization: str | None = Header(default=None)):
+    user = get_bearer_user(request, authorization)
+    _v2_rate_check(request, user)
+    with get_conn() as conn:
+        cnt = conn.execute("SELECT COUNT(*) FROM notifications WHERE user_id=? AND is_read=0", (user["id"],)).fetchone()[0]
+    return {"unread": cnt}
+
+
+@router.post("/notifications/{notif_id}/read")
+def mark_read(notif_id: int, request: Request, authorization: str | None = Header(default=None)):
+    user = get_bearer_user(request, authorization)
+    _v2_rate_check(request, user)
+    with get_conn() as conn:
+        conn.execute("UPDATE notifications SET is_read=1 WHERE id=? AND user_id=?", (notif_id, user["id"]))
+        conn.commit()
+    return {"id": notif_id, "status": "read"}
+
+
+@router.post("/notifications/read-all")
+def mark_all_read(request: Request, authorization: str | None = Header(default=None)):
+    user = get_bearer_user(request, authorization)
+    _v2_rate_check(request, user)
+    with get_conn() as conn:
+        conn.execute("UPDATE notifications SET is_read=1 WHERE user_id=?", (user["id"],))
+        conn.commit()
+    return {"status": "all read"}
+
+
+@router.patch("/users/me/preferences")
+def patch_prefs(request: Request, authorization: str | None = Header(default=None), body: dict = Body(default={})):
+    user = get_bearer_user(request, authorization)
+    _v2_rate_check(request, user)
+    with get_conn() as conn:
+        row = conn.execute("SELECT notification_prefs FROM users WHERE id=?", (user["id"],)).fetchone()
+        try:
+            cur = json.loads(row["notification_prefs"] or "{}")
+        except Exception:
+            cur = {}
+        cur.update(body)
+        conn.execute("UPDATE users SET notification_prefs=? WHERE id=?", (json.dumps(cur), user["id"]))
+        conn.commit()
+    return {"preferences": cur}
+
+
+@router.get("/favorites")
+def list_favorites_v2(request: Request, authorization: str | None = Header(default=None)):
+    user = get_bearer_user(request, authorization)
+    _v2_rate_check(request, user)
+    with get_conn() as conn:
+        rows = conn.execute("SELECT f.*, p.title, p.workspace_id FROM favorites f JOIN pages p ON p.id=f.page_id WHERE f.user_id=? ORDER BY f.position", (user["id"],)).fetchall()
+    return {"favorites": [row_to_dict(r) for r in rows]}
+
+
+@router.post("/favorites")
+def add_favorite_v2(request: Request, authorization: str | None = Header(default=None), body: dict = Body(default={})):
+    user = require_scope("write")(request, authorization)
+    _v2_rate_check(request, user)
+    pid = body.get("page_id")
+    if not pid:
+        raise HTTPException(400, "page_id required")
+    with get_conn() as conn:
+        try:
+            conn.execute("INSERT INTO favorites (user_id, page_id) VALUES (?, ?)", (user["id"], pid))
+            conn.commit()
+        except Exception as e:
+            raise HTTPException(409, str(e)) from None
+    try:
+        run_event_sync(_fire_event("favorite.added", {"page_id": pid, "user_id": user["id"]}))
+    except Exception:
+        logger.exception("add_favorite_v2")
+    return {"page_id": pid, "status": "added"}
+
+
+@router.delete("/favorites/{page_id}")
+def remove_favorite_v2(page_id: int, request: Request, authorization: str | None = Header(default=None)):
+    user = require_scope("write")(request, authorization)
+    _v2_rate_check(request, user)
+    with get_conn() as conn:
+        conn.execute("DELETE FROM favorites WHERE user_id=? AND page_id=?", (user["id"], page_id))
+        conn.commit()
+    try:
+        run_event_sync(_fire_event("favorite.removed", {"page_id": page_id, "user_id": user["id"]}))
+    except Exception:
+        logger.exception("remove_favorite_v2")
+    return {"page_id": page_id, "status": "removed"}
+
+
+@router.get("/tags")
+def list_tags_v2(request: Request, authorization: str | None = Header(default=None)):
+    user = get_bearer_user(request, authorization)
+    _v2_rate_check(request, user)
+    q = (request.query_params.get("q") or "").strip()
+    with get_conn() as conn:
+        if q:
+            rows = conn.execute("SELECT * FROM tags WHERE user_id=? AND name LIKE ? ORDER BY name", (user["id"], f"%{q}%")).fetchall()
+        else:
+            rows = conn.execute("SELECT * FROM tags WHERE user_id=? ORDER BY name", (user["id"],)).fetchall()
+    return {"tags": [dict(r) for r in rows]}
+
+
+@router.post("/tags")
+def create_tag_v2(request: Request, authorization: str | None = Header(default=None), body: dict = Body(default={})):
+    user = require_scope("write")(request, authorization)
+    _v2_rate_check(request, user)
+    name = (body.get("name") or "").strip()
+    if not name:
+        raise HTTPException(400, "name required")
+    color = body.get("color", "#787774")
+    with get_conn() as conn:
+        try:
+            cur = conn.execute("INSERT INTO tags (name, color, user_id) VALUES (?, ?, ?)", (name, color, user["id"]))
+            tid = cur.lastrowid
+            conn.commit()
+        except Exception as e:
+            raise HTTPException(409, str(e)) from None
+    return {"id": tid, "name": name, "color": color, "status": "created"}
+
+
+@router.patch("/tags/{tag_id}")
+def patch_tag_v2(tag_id: int, request: Request, authorization: str | None = Header(default=None), body: dict = Body(default={})):
+    user = require_scope("write")(request, authorization)
+    _v2_rate_check(request, user)
+    with get_conn() as conn:
+        row = conn.execute("SELECT * FROM tags WHERE id=? AND user_id=?", (tag_id, user["id"])).fetchone()
+        if not row:
+            raise HTTPException(404, "Tag not found")
+        name = body.get("name", row["name"])
+        color = body.get("color", row["color"])
+        conn.execute("UPDATE tags SET name=?, color=? WHERE id=?", (name, color, tag_id))
+        conn.commit()
+    return {"id": tag_id, "status": "updated"}
+
+
+@router.delete("/tags/{tag_id}")
+def delete_tag_v2(tag_id: int, request: Request, authorization: str | None = Header(default=None)):
+    user = require_scope("write")(request, authorization)
+    _v2_rate_check(request, user)
+    with get_conn() as conn:
+        conn.execute("DELETE FROM tags WHERE id=? AND user_id=?", (tag_id, user["id"]))
+        conn.commit()
+    return {"id": tag_id, "status": "deleted"}
+
+
+@router.post("/pages/{page_id}/tags")
+def attach_tag_v2(page_id: int, request: Request, authorization: str | None = Header(default=None), body: dict = Body(default={})):
+    user = require_scope("write")(request, authorization)
+    _v2_rate_check(request, user)
+    tag_id = body.get("tag_id")
+    if not tag_id:
+        raise HTTPException(400, "tag_id required")
+    with get_conn() as conn:
+        try:
+            conn.execute("INSERT INTO page_tags (page_id, tag_id) VALUES (?, ?)", (page_id, tag_id))
+            conn.commit()
+        except Exception as e:
+            raise HTTPException(409, str(e)) from None
+    return {"page_id": page_id, "tag_id": tag_id, "status": "attached"}
+
+
+@router.delete("/pages/{page_id}/tags/{tag_id}")
+def detach_tag_v2(page_id: int, tag_id: int, request: Request, authorization: str | None = Header(default=None)):
+    user = require_scope("write")(request, authorization)
+    _v2_rate_check(request, user)
+    with get_conn() as conn:
+        conn.execute("DELETE FROM page_tags WHERE page_id=? AND tag_id=?", (page_id, tag_id))
+        conn.commit()
+    return {"status": "detached"}
+
+
+@router.get("/recents")
+def list_recents_v2(request: Request, authorization: str | None = Header(default=None)):
+    user = get_bearer_user(request, authorization)
+    _v2_rate_check(request, user)
+    limit = int(request.query_params.get("limit", "20"))
+    st = request.query_params.get("source_type")
+    with get_conn() as conn:
+        if st:
+            rows = conn.execute("SELECT * FROM recents WHERE user_id=? AND source_type=? ORDER BY accessed_at DESC LIMIT ?", (user["id"], st, limit)).fetchall()
+        else:
+            rows = conn.execute("SELECT * FROM recents WHERE user_id=? ORDER BY accessed_at DESC LIMIT ?", (user["id"], limit)).fetchall()
+    return {"recents": [row_to_dict(r) for r in rows]}
+
+
+@router.get("/pages/{page_id}/shares")
+def list_shares_v2(page_id: int, request: Request, authorization: str | None = Header(default=None)):
+    user = get_bearer_user(request, authorization)
+    _v2_rate_check(request, user)
+    with get_conn() as conn:
+        rows = conn.execute("SELECT * FROM page_shares WHERE page_id=?", (page_id,)).fetchall()
+    return {"shares": [dict(r) for r in rows]}

app/routers/api_v2/identity.py

@@ -0,0 +1,195 @@
+"""FlowDeck — Public API v2 : identity.
+
+Découpe A28 de l'ancien app/routers/api_v2.py (2 110 lignes, 115 routes) — un module par concern, contrat inchangé (Bearer+scopes, pagination, RFC7807, audit + idempotency).
+"""
+from __future__ import annotations
+
+import json
+import logging
+import secrets
+from datetime import datetime
+
+from fastapi import APIRouter, Body, Header, HTTPException, Request
+from fastapi.responses import JSONResponse
+
+from app.db import get_conn
+from app.services.api_v2_helpers import (  # noqa: F401 — require_scope est utilisé par les handlers
+    audit_log,
+    check_idempotency,
+    check_v2_rate_limit,
+    get_bearer_user,
+    has_scope,
+    paginate_headers,
+    parse_pagination,
+    require_scope,
+    row_to_dict,
+    store_idempotency,
+    to_iso8601,
+    validate_scopes_input,
+)
+
+from ._common import _hash, _v2_rate_check
+
+logger = logging.getLogger(__name__)
+router = APIRouter(tags=["api-v2"])
+
+
+
+@router.post("/tokens")
+def create_token(request: Request, authorization: str | None = Header(default=None), body: dict = Body(default={})):
+    user = require_scope("write")(request, authorization)
+    _v2_rate_check(request, user)
+    name = (body.get("name") or "API token").strip()[:100]
+    scopes = validate_scopes_input(body.get("scopes") or "read,write")
+    expires_at = body.get("expires_at")
+    # Idempotency
+    idem = check_idempotency(request, user["id"])
+    if idem:
+        return JSONResponse(content=idem["data"], status_code=idem["status"])
+    token = f"fd_{secrets.token_urlsafe(32)}"
+    prefix = token[:12]
+    th = _hash(token)
+    exp_val = None
+    if expires_at:
+        try:
+            # accept ISO string
+            exp_val = str(expires_at)
+            # validate parse
+            datetime.fromisoformat(exp_val.replace("Z", "+00:00"))
+        except Exception as err:
+            raise HTTPException(400, "Invalid expires_at, use ISO-8601") from err
+    with get_conn() as conn:
+        try:
+            cur = conn.execute(
+                "INSERT INTO api_tokens (user_id, name, token_hash, token_prefix, scopes, expires_at) VALUES (?, ?, ?, ?, ?, ?)",
+                (user["id"], name, th, prefix, scopes, exp_val),
+            )
+            conn.commit()
+            tid = cur.lastrowid
+        except Exception as e:
+            raise HTTPException(409, f"Token creation failed: {e}") from None
+        row = conn.execute("SELECT id, name, token_prefix, scopes, expires_at, created_at FROM api_tokens WHERE id=?", (tid,)).fetchone()
+    audit_log(user, "token.create", "api_token", tid, f"scopes={scopes}", request)
+    data = {"id": tid, "name": row["name"], "token": token, "prefix": prefix, "scopes": scopes, "expires_at": to_iso8601(row["expires_at"]) if row["expires_at"] else None, "note": "Copy token now — shown once. Use as Authorization: Bearer <token>"}
+    key = (request.headers.get("Idempotency-Key") or request.headers.get("idempotency-key") or "").strip()
+    if key:
+        store_idempotency(key, user["id"], data, 200)
+    return data
+
+
+@router.get("/tokens")
+def list_tokens(request: Request, authorization: str | None = Header(default=None)):
+    user = get_bearer_user(request, authorization)
+    _v2_rate_check(request, user)
+    with get_conn() as conn:
+        rows = conn.execute("SELECT id, name, token_prefix, scopes, expires_at, last_used_at, created_at, revoked FROM api_tokens WHERE user_id=? ORDER BY created_at DESC", (user["id"],)).fetchall()
+    out = []
+    for r in rows:
+        d = dict(r)
+        d["created_at"] = to_iso8601(d.get("created_at"))
+        d["expires_at"] = to_iso8601(d.get("expires_at")) if d.get("expires_at") else None
+        d["last_used_at"] = to_iso8601(d.get("last_used_at")) if d.get("last_used_at") else None
+        # never expose hash
+        out.append({k: v for k, v in d.items() if k != "token_hash"})
+    return {"tokens": out}
+
+
+@router.delete("/tokens/{token_id}")
+def revoke_token(token_id: int, request: Request, authorization: str | None = Header(default=None)):
+    user = require_scope("write")(request, authorization)
+    _v2_rate_check(request, user)
+    with get_conn() as conn:
+        row = conn.execute("SELECT id, user_id FROM api_tokens WHERE id=?", (token_id,)).fetchone()
+        if not row:
+            raise HTTPException(404, "Token not found")
+        if row["user_id"] != user["id"] and not user.get("is_admin"):
+            raise HTTPException(403, "Not your token")
+        conn.execute("UPDATE api_tokens SET revoked=1 WHERE id=?", (token_id,))
+        conn.commit()
+    audit_log(user, "token.revoke", "api_token", token_id, "", request)
+    return {"id": token_id, "status": "revoked"}
+
+
+@router.post("/tokens/{token_id}/rotate")
+def rotate_token(token_id: int, request: Request, authorization: str | None = Header(default=None)):
+    user = require_scope("write")(request, authorization)
+    _v2_rate_check(request, user)
+    with get_conn() as conn:
+        row = conn.execute("SELECT id, user_id, name, scopes FROM api_tokens WHERE id=?", (token_id,)).fetchone()
+        if not row:
+            raise HTTPException(404, "Token not found")
+        if row["user_id"] != user["id"] and not user.get("is_admin"):
+            raise HTTPException(403, "Not your token")
+        # revoke old
+        conn.execute("UPDATE api_tokens SET revoked=1 WHERE id=?", (token_id,))
+        new_token = f"fd_{secrets.token_urlsafe(32)}"
+        th = _hash(new_token)
+        prefix = new_token[:12]
+        cur = conn.execute("INSERT INTO api_tokens (user_id, name, token_hash, token_prefix, scopes) VALUES (?, ?, ?, ?, ?)", (row["user_id"], row["name"], th, prefix, row["scopes"] or "read,write"))
+        conn.commit()
+        nid = cur.lastrowid
+    audit_log(user, "token.rotate", "api_token", token_id, f"new_id={nid}", request)
+    return {"id": nid, "token": new_token, "prefix": prefix, "scopes": row["scopes"], "note": "Copy token now — shown once"}
+
+
+@router.get("/users/me")
+def get_me(request: Request, authorization: str | None = Header(default=None)):
+    user = get_bearer_user(request, authorization)
+    _v2_rate_check(request, user)
+    with get_conn() as conn:
+        row = conn.execute("SELECT id, login, full_name, email, avatar_url, avatar_color, is_admin, is_active, auth_method, sidebar_config, notification_prefs, timezone, created_at FROM users WHERE id=?", (user["id"],)).fetchone()
+        if not row:
+            raise HTTPException(404, "User not found")
+        d = row_to_dict(row)
+        # parse json prefs
+        for k in ("notification_prefs", "sidebar_config"):
+            if isinstance(d.get(k), str):
+                try:
+                    d[k] = json.loads(d[k] or "{}")
+                except Exception:
+                    logger.exception("get_me")
+        # never expose secrets
+        return d
+
+
+@router.patch("/users/me")
+def patch_me(request: Request, authorization: str | None = Header(default=None), body: dict = Body(default={})):
+    user = require_scope("write")(request, authorization)
+    _v2_rate_check(request, user)
+    allowed = {"full_name", "email", "avatar_color", "notification_prefs", "sidebar_config", "timezone"}
+    updates = {}
+    for k in allowed:
+        if k in body:
+            updates[k] = body[k]
+    if not updates:
+        raise HTTPException(400, "No updatable fields")
+    # validation
+    if "email" in updates and updates["email"] and "@" not in str(updates["email"]):
+        raise HTTPException(400, "Invalid email")
+    with get_conn() as conn:
+        sets = []
+        params = []
+        for k, v in updates.items():
+            if k in ("notification_prefs", "sidebar_config"):
+                v = json.dumps(v) if isinstance(v, (dict, list)) else str(v)
+            sets.append(f"{k}=?")
+            params.append(v)
+        params.append(user["id"])
+        conn.execute(f"UPDATE users SET {', '.join(sets)} WHERE id=?", params)
+        conn.commit()
+        row = conn.execute("SELECT id, login, full_name, email, avatar_url, avatar_color, is_admin, timezone, notification_prefs FROM users WHERE id=?", (user["id"],)).fetchone()
+    audit_log(user, "user.update", "user", user["id"], "", request)
+    return row_to_dict(row)
+
+
+@router.get("/users/search")
+def search_users(request: Request, q: str = "", authorization: str | None = Header(default=None)):
+    user = get_bearer_user(request, authorization)
+    _v2_rate_check(request, user)
+    q = (q or request.query_params.get("q") or "").strip()
+    if not q:
+        return {"users": []}
+    like = f"%{q}%"
+    with get_conn() as conn:
+        rows = conn.execute("SELECT id, login, full_name, email, avatar_url, avatar_color FROM users WHERE login LIKE ? OR email LIKE ? OR full_name LIKE ? LIMIT 20", (like, like, like)).fetchall()
+    return {"users": [dict(r) for r in rows]}

app/routers/api_v2/planning.py

@@ -0,0 +1,148 @@
+"""FlowDeck — Public API v2 : planning.
+
+Découpe A28 de l'ancien app/routers/api_v2.py (2 110 lignes, 115 routes) — un module par concern, contrat inchangé (Bearer+scopes, pagination, RFC7807, audit + idempotency).
+"""
+from __future__ import annotations
+
+import json
+import logging
+
+from fastapi import APIRouter, Body, Header, HTTPException, Request
+
+from app.db import get_conn
+from app.services.api_v2_helpers import (  # noqa: F401 — require_scope est utilisé par les handlers
+    audit_log,
+    check_idempotency,
+    check_v2_rate_limit,
+    get_bearer_user,
+    has_scope,
+    paginate_headers,
+    parse_pagination,
+    require_scope,
+    row_to_dict,
+    store_idempotency,
+    to_iso8601,
+    validate_scopes_input,
+)
+from app.services.automations import fire_event as _fire_event
+from app.services.automations import run_event_sync
+
+from ._common import _v2_rate_check
+
+logger = logging.getLogger(__name__)
+router = APIRouter(tags=["api-v2"])
+
+
+
+@router.post("/collections/{collection_id}/sprints")
+def create_sprint_v2(collection_id: int, request: Request, authorization: str | None = Header(default=None), body: dict = Body(default={})):
+    user = require_scope("write")(request, authorization)
+    _v2_rate_check(request, user)
+    name = (body.get("name") or "Sprint").strip()
+    start = body.get("start_date") or body.get("start") or ""
+    end = body.get("end_date") or body.get("end") or ""
+    if not start or not end:
+        raise HTTPException(400, "start_date and end_date required (YYYY-MM-DD)")
+    with get_conn() as conn:
+        cur = conn.execute("INSERT INTO sprints (collection_id, name, start_date, end_date, goal) VALUES (?, ?, ?, ?, ?)", (collection_id, name, start, end, body.get("goal") or ""))
+        sid = cur.lastrowid
+        conn.commit()
+    try:
+        run_event_sync(_fire_event("sprint.created", {"sprint_id": sid, "collection_id": collection_id, "name": name}))
+    except Exception:
+        logger.exception("create_sprint_v2")
+    return {"id": sid, "name": name, "status": "created"}
+
+
+@router.patch("/sprints/{sprint_id}")
+def patch_sprint_v2(sprint_id: int, request: Request, authorization: str | None = Header(default=None), body: dict = Body(default={})):
+    user = require_scope("write")(request, authorization)
+    _v2_rate_check(request, user)
+    with get_conn() as conn:
+        row = conn.execute("SELECT * FROM sprints WHERE id=?", (sprint_id,)).fetchone()
+        if not row:
+            raise HTTPException(404, "Sprint not found")
+        name = body.get("name", row["name"])
+        start = body.get("start_date", row["start_date"])
+        end = body.get("end_date", row["end_date"])
+        goal = body.get("goal", row["goal"])
+        status = body.get("status", row["status"])
+        conn.execute("UPDATE sprints SET name=?, start_date=?, end_date=?, goal=?, status=? WHERE id=?", (name, start, end, goal, status, sprint_id))
+        conn.commit()
+    try:
+        run_event_sync(_fire_event("sprint.updated", {"sprint_id": sprint_id, "collection_id": row["collection_id"], "name": name, "status": status}))
+    except Exception:
+        logger.exception("patch_sprint_v2")
+    return {"id": sprint_id, "status": "updated"}
+
+
+@router.delete("/sprints/{sprint_id}")
+def delete_sprint_v2(sprint_id: int, request: Request, authorization: str | None = Header(default=None)):
+    user = require_scope("write")(request, authorization)
+    _v2_rate_check(request, user)
+    with get_conn() as conn:
+        conn.execute("DELETE FROM sprints WHERE id=?", (sprint_id,))
+        conn.commit()
+    return {"id": sprint_id, "status": "deleted"}
+
+
+@router.post("/sprints/{sprint_id}/assign")
+def assign_sprint_v2(sprint_id: int, request: Request, authorization: str | None = Header(default=None), body: dict = Body(default={})):
+    user = require_scope("write")(request, authorization)
+    _v2_rate_check(request, user)
+    pid = body.get("page_id")
+    if not pid:
+        raise HTTPException(400, "page_id required")
+    with get_conn() as conn:
+        try:
+            conn.execute("INSERT INTO sprint_pages (sprint_id, page_id, velocity_points) VALUES (?, ?, ?)", (sprint_id, pid, body.get("velocity_points", 1)))
+            conn.commit()
+        except Exception as e:
+            raise HTTPException(409, str(e)) from None
+    return {"sprint_id": sprint_id, "page_id": pid, "status": "assigned"}
+
+
+@router.delete("/sprints/{sprint_id}/assign/{page_id}")
+def unassign_sprint_v2(sprint_id: int, page_id: int, request: Request, authorization: str | None = Header(default=None)):
+    user = require_scope("write")(request, authorization)
+    _v2_rate_check(request, user)
+    with get_conn() as conn:
+        conn.execute("DELETE FROM sprint_pages WHERE sprint_id=? AND page_id=?", (sprint_id, page_id))
+        conn.commit()
+    return {"status": "removed"}
+
+
+@router.get("/sprints/{sprint_id}/burndown")
+def burndown_v2(sprint_id: int, request: Request, authorization: str | None = Header(default=None)):
+    user = get_bearer_user(request, authorization)
+    _v2_rate_check(request, user)
+    with get_conn() as conn:
+        s = conn.execute("SELECT * FROM sprints WHERE id=?", (sprint_id,)).fetchone()
+        if not s:
+            raise HTTPException(404, "Sprint not found")
+        pages = conn.execute("SELECT sp.*, cp.property_values_json FROM sprint_pages sp JOIN collection_pages cp ON cp.id=sp.page_id WHERE sp.sprint_id=?", (sprint_id,)).fetchall()
+        total = len(pages)
+        # crude: completed where status property == Done (best-effort)
+        completed = 0
+        for p in pages:
+            try:
+                pv = json.loads(p["property_values_json"] or "{}")
+                for v in pv.values():
+                    if str(v).lower() in ("done", "completed", "terminé"):
+                        completed += 1
+                        break
+            except Exception:
+                logger.exception("burndown_v2")
+        remaining = total - completed
+        # ideal linear
+        ideal = [round(total * (1 - i / 10)) for i in range(11)]
+    return {"sprint_id": sprint_id, "total": total, "completed": completed, "remaining": remaining, "ideal": ideal}
+
+
+@router.get("/collections/{collection_id}/templates")
+def list_templates_v2(collection_id: int, request: Request, authorization: str | None = Header(default=None)):
+    user = get_bearer_user(request, authorization)
+    _v2_rate_check(request, user)
+    with get_conn() as conn:
+        rows = conn.execute("SELECT * FROM page_templates WHERE collection_id=? ORDER BY created_at", (collection_id,)).fetchall()
+    return {"templates": [row_to_dict(r) for r in rows]}

app/routers/api_v2/projects.py

@@ -0,0 +1,93 @@
+"""FlowDeck — Public API v2 : projects.
+
+Découpe A28 de l'ancien app/routers/api_v2.py (2 110 lignes, 115 routes) — un module par concern, contrat inchangé (Bearer+scopes, pagination, RFC7807, audit + idempotency).
+"""
+from __future__ import annotations
+
+import logging
+
+from fastapi import APIRouter, Header, HTTPException, Request
+
+from app.db import get_conn
+from app.services.api_v2_helpers import (  # noqa: F401 — require_scope est utilisé par les handlers
+    audit_log,
+    check_idempotency,
+    check_v2_rate_limit,
+    get_bearer_user,
+    has_scope,
+    paginate_headers,
+    parse_pagination,
+    require_scope,
+    row_to_dict,
+    store_idempotency,
+    to_iso8601,
+    validate_scopes_input,
+)
+
+from ._common import _v2_rate_check
+
+logger = logging.getLogger(__name__)
+router = APIRouter(tags=["api-v2"])
+
+
+
+@router.get("/projects")
+def list_projects_v2(request: Request, authorization: str | None = Header(default=None)):
+    user = get_bearer_user(request, authorization)
+    _v2_rate_check(request, user)
+    with get_conn() as conn:
+        rows = conn.execute("SELECT * FROM projects ORDER BY proj_type, owner, name").fetchall()
+    return {"projects": [row_to_dict(r) for r in rows]}
+
+
+@router.get("/projects/{owner}/{repo}/tree")
+async def project_tree_v2(owner: str, repo: str, request: Request, path: str = "", authorization: str | None = Header(default=None)):
+    get_bearer_user(request, authorization)
+    # proxy to gitea client? Return placeholder listing from projects table
+    with get_conn() as conn:
+        proj = conn.execute("SELECT * FROM projects WHERE owner=? AND name=?", (owner, repo)).fetchone()
+        if not proj:
+            raise HTTPException(404, "Project not found")
+    # delegate to gitea API if available (best-effort)
+    try:
+        from app.services.gitea_client import gitea
+        tree = await gitea.list_repo_files(owner, repo, path or "")
+        return {"owner": owner, "repo": repo, "path": path, "tree": tree}
+    except Exception:
+        return {"owner": owner, "repo": repo, "path": path, "tree": []}
+
+
+@router.get("/search")
+def search_v2(request: Request, query: str = "", workspace_id: int | None = None, type: str = "all", authorization: str | None = Header(default=None)):
+    user = get_bearer_user(request, authorization)
+    _v2_rate_check(request, user)
+    q = (query or request.query_params.get("query") or "").strip()
+    if not q:
+        return {"results": [], "query": q}
+    like = f"%{q}%"
+    with get_conn() as conn:
+        pages = []
+        # try FTS5
+        try:
+            rows = conn.execute("SELECT p.id, p.title, p.content, p.workspace_id, snippet(pages_fts, -1, '<mark>', '</mark>', '...', 32) as snippet FROM pages_fts f JOIN pages p ON p.id=f.rowid WHERE pages_fts MATCH ? LIMIT 20", (q,)).fetchall()
+            pages = [{"type": "page", "id": r["id"], "title": r["title"], "snippet": r["snippet"]} for r in rows]
+        except Exception:
+            rows = conn.execute("SELECT id, title FROM pages WHERE title LIKE ? OR content LIKE ? LIMIT 20", (like, like)).fetchall()
+            pages = [{"type": "page", "id": r["id"], "title": r["title"]} for r in rows]
+        # collections
+        colls = conn.execute("SELECT id, name FROM collections WHERE name LIKE ? LIMIT 10", (like,)).fetchall()
+        results = pages + [{"type": "collection", "id": r["id"], "title": r["name"]} for r in colls]
+    return {"query": q, "results": results}
+
+
+@router.get("/admin/users")
+def admin_list_users_v2(request: Request, limit: int = 30, offset: int = 0, authorization: str | None = Header(default=None)):
+    user = get_bearer_user(request, authorization)
+    _v2_rate_check(request, user)
+    if not user.get("is_admin") and not has_scope(user.get("_token_scopes"), "admin"):
+        raise HTTPException(403, "Admin scope required")
+    limit = max(1, min(limit, 100))
+    with get_conn() as conn:
+        total = conn.execute("SELECT COUNT(*) FROM users").fetchone()[0]
+        rows = conn.execute("SELECT id, login, full_name, email, is_admin, is_active, created_at FROM users ORDER BY id LIMIT ? OFFSET ?", (limit, offset)).fetchall()
+    return {"users": [row_to_dict(r) for r in rows], "total": total, "limit": limit, "offset": offset}

app/routers/api_v2/properties.py

@@ -0,0 +1,151 @@
+"""FlowDeck — Public API v2 : properties.
+
+Découpe A28 de l'ancien app/routers/api_v2.py (2 110 lignes, 115 routes) — un module par concern, contrat inchangé (Bearer+scopes, pagination, RFC7807, audit + idempotency).
+"""
+from __future__ import annotations
+
+import json
+import logging
+
+from fastapi import APIRouter, Body, Header, HTTPException, Request
+
+from app.db import get_conn
+from app.services.api_v2_helpers import (  # noqa: F401 — require_scope est utilisé par les handlers
+    audit_log,
+    check_idempotency,
+    check_v2_rate_limit,
+    get_bearer_user,
+    has_scope,
+    paginate_headers,
+    parse_pagination,
+    require_scope,
+    row_to_dict,
+    store_idempotency,
+    to_iso8601,
+    validate_scopes_input,
+)
+
+from ._common import _v2_rate_check
+
+logger = logging.getLogger(__name__)
+router = APIRouter(tags=["api-v2"])
+
+
+
+@router.post("/collections/{collection_id}/properties")
+def create_property_v2(collection_id: int, request: Request, authorization: str | None = Header(default=None), body: dict = Body(default={})):
+    user = require_scope("write")(request, authorization)
+    _v2_rate_check(request, user)
+    name = (body.get("name") or "").strip()
+    if not name:
+        raise HTTPException(400, "name is required")
+    ptype = body.get("prop_type") or body.get("type") or "text"
+    with get_conn() as conn:
+        if not conn.execute("SELECT id FROM collections WHERE id=?", (collection_id,)).fetchone():
+            raise HTTPException(404, "Collection not found")
+        max_pos = conn.execute("SELECT COALESCE(MAX(position), -1)+1 FROM collection_properties WHERE collection_id=?", (collection_id,)).fetchone()[0]
+        try:
+            cur = conn.execute("INSERT INTO collection_properties (collection_id, name, prop_type, options_json, number_format, position, required, visible_in_views, validation_json, group_name) VALUES (?, ?, ?, ?, ?, ?, ?, ?, ?, ?)", (collection_id, name, ptype, json.dumps(body.get("options") or []), body.get("number_format") or "number", max_pos, int(bool(body.get("required"))), int(bool(body.get("visible_in_views", True))), json.dumps(body.get("validation") or {}), (body.get("group_name") or "").strip()))
+            conn.commit()
+            pid = cur.lastrowid
+        except Exception as e:
+            raise HTTPException(409, f"Property exists: {e}") from None
+    audit_log(user, "property.create", "property", pid, name, request)
+    return {"id": pid, "name": name, "prop_type": ptype, "status": "created"}
+
+
+@router.patch("/properties/{prop_id}")
+def patch_property_v2(prop_id: int, request: Request, authorization: str | None = Header(default=None), body: dict = Body(default={})):
+    user = require_scope("write")(request, authorization)
+    _v2_rate_check(request, user)
+    with get_conn() as conn:
+        row = conn.execute("SELECT * FROM collection_properties WHERE id=?", (prop_id,)).fetchone()
+        if not row:
+            raise HTTPException(404, "Property not found")
+        name = body.get("name", row["name"])
+        opts = json.dumps(body.get("options", json.loads(row["options_json"] or "[]")))
+        nf = body.get("number_format", row["number_format"])
+        req = int(bool(body.get("required", row["required"])))
+        vis = int(bool(body.get("visible_in_views", row["visible_in_views"])))
+        vj = json.dumps(body.get("validation", json.loads(row["validation_json"] or "{}"))) if "validation" in body else (row["validation_json"] if "validation_json" in row.keys() else "{}")
+        grp = body.get("group_name", row["group_name"] if "group_name" in row.keys() else "")
+        conn.execute("UPDATE collection_properties SET name=?, options_json=?, number_format=?, required=?, visible_in_views=?, validation_json=?, group_name=? WHERE id=?", (name, opts, nf, req, vis, vj, grp, prop_id))
+        conn.commit()
+    audit_log(user, "property.update", "property", prop_id, "", request)
+    return {"id": prop_id, "status": "updated"}
+
+
+@router.delete("/properties/{prop_id}")
+def delete_property_v2(prop_id: int, request: Request, authorization: str | None = Header(default=None)):
+    user = require_scope("write")(request, authorization)
+    _v2_rate_check(request, user)
+    with get_conn() as conn:
+        if not conn.execute("SELECT id FROM collection_properties WHERE id=?", (prop_id,)).fetchone():
+            raise HTTPException(404, "Property not found")
+        conn.execute("DELETE FROM collection_properties WHERE id=?", (prop_id,))
+        conn.commit()
+    audit_log(user, "property.delete", "property", prop_id, "", request)
+    return {"id": prop_id, "status": "deleted"}
+
+
+@router.post("/properties/{prop_id}/relation")
+def create_relation_v2(prop_id: int, request: Request, authorization: str | None = Header(default=None), body: dict = Body(default={})):
+    user = require_scope("write")(request, authorization)
+    _v2_rate_check(request, user)
+    related_id = body.get("related_collection_id")
+    reverse = (body.get("reverse_name") or "").strip()
+    if not related_id:
+        raise HTTPException(400, "related_collection_id required")
+    with get_conn() as conn:
+        row = conn.execute("SELECT collection_id FROM collection_properties WHERE id=?", (prop_id,)).fetchone()
+        if not row:
+            raise HTTPException(404, "Property not found")
+        conn.execute("UPDATE collection_properties SET prop_type='relation', related_collection_id=?, reverse_name=? WHERE id=?", (related_id, reverse, prop_id))
+        if reverse:
+            max_pos = conn.execute("SELECT COALESCE(MAX(position), -1)+1 FROM collection_properties WHERE collection_id=?", (related_id,)).fetchone()[0]
+            try:
+                conn.execute("INSERT INTO collection_properties (collection_id, name, prop_type, related_collection_id, reverse_name, position) VALUES (?, ?, 'relation', ?, ?, ?)", (related_id, reverse, row["collection_id"], "", max_pos))
+            except Exception:
+                logger.exception("create_relation_v2")
+        conn.commit()
+    return {"id": prop_id, "status": "updated"}
+
+
+@router.post("/properties/evaluate-formula")
+def evaluate_formula_v2(request: Request, authorization: str | None = Header(default=None), body: dict = Body(default={})):
+    user = get_bearer_user(request, authorization)
+    _v2_rate_check(request, user)
+    expr = body.get("expression") or body.get("formula")
+    if not expr:
+        raise HTTPException(400, "expression required")
+    ctx = body.get("context") or {}
+    try:
+        from app.services.formula_engine import FormulaEngine
+        res = FormulaEngine().evaluate(expr, ctx)
+    except Exception as e:
+        raise HTTPException(400, f"Formula error: {e}") from None
+    return {"result": res, "expression": expr}
+
+
+@router.post("/properties/compute-rollup")
+def compute_rollup_v2(request: Request, authorization: str | None = Header(default=None), body: dict = Body(default={})):
+    user = get_bearer_user(request, authorization)
+    _v2_rate_check(request, user)
+    for k in ("collection_id", "relation_property_id", "target_property_id", "page_id"):
+        if k not in body:
+            raise HTTPException(400, f"{k} required")
+    try:
+        from app.services.rollup_engine import RollupEngine
+        res = RollupEngine().compute(body["collection_id"], body["relation_property_id"], body["target_property_id"], body["page_id"], body.get("function", "count"))
+    except Exception as e:
+        raise HTTPException(400, f"Rollup error: {e}") from None
+    return {"result": res}
+
+
+@router.get("/collections/{collection_id}/views")
+def list_views_v2(collection_id: int, request: Request, authorization: str | None = Header(default=None)):
+    user = get_bearer_user(request, authorization)
+    _v2_rate_check(request, user)
+    with get_conn() as conn:
+        rows = conn.execute("SELECT * FROM collection_views WHERE collection_id=? ORDER BY position", (collection_id,)).fetchall()
+    return {"views": [row_to_dict(r) for r in rows]}

app/routers/api_v2/sharing.py

@@ -0,0 +1,160 @@
+"""FlowDeck — Public API v2 : sharing.
+
+Découpe A28 de l'ancien app/routers/api_v2.py (2 110 lignes, 115 routes) — un module par concern, contrat inchangé (Bearer+scopes, pagination, RFC7807, audit + idempotency).
+"""
+from __future__ import annotations
+
+import json
+import logging
+
+from fastapi import APIRouter, Body, Header, HTTPException, Request
+
+from app.db import get_conn
+from app.services.api_v2_helpers import (  # noqa: F401 — require_scope est utilisé par les handlers
+    audit_log,
+    check_idempotency,
+    check_v2_rate_limit,
+    get_bearer_user,
+    has_scope,
+    paginate_headers,
+    parse_pagination,
+    require_scope,
+    row_to_dict,
+    store_idempotency,
+    to_iso8601,
+    validate_scopes_input,
+)
+from app.services.automations import fire_event as _fire_event
+from app.services.automations import run_event_sync
+from app.services.publish import fire_published, fire_unpublished, publish, unpublish
+
+from ._common import _v2_rate_check
+
+logger = logging.getLogger(__name__)
+router = APIRouter(tags=["api-v2"])
+
+
+
+@router.post("/pages/{page_id}/shares")
+def create_share_v2(page_id: int, request: Request, authorization: str | None = Header(default=None), body: dict = Body(default={})):
+    user = require_scope("write")(request, authorization)
+    _v2_rate_check(request, user)
+    perm = (body.get("permission") or "view").strip().lower()
+    if perm not in ("view", "comment", "edit"):
+        raise HTTPException(400, "Invalid permission. Use view, comment, or edit")
+    email = (body.get("email") or "").strip()
+    uid = body.get("user_id")
+    if not email and not uid:
+        raise HTTPException(400, "email or user_id required")
+    with get_conn() as conn:
+        cur = conn.execute("INSERT INTO page_shares (page_id, shared_with_user_id, shared_with_email, permission, created_by) VALUES (?, ?, ?, ?, ?)", (page_id, uid, email, perm, user["id"]))
+        conn.execute("UPDATE pages SET is_shared=1 WHERE id=?", (page_id,))
+        conn.commit()
+        nid = cur.lastrowid
+    audit_log(user, "share.create", "share", nid, f"page={page_id}", request)
+    try:
+        run_event_sync(_fire_event("page.shared", {"page_id": page_id, "share_id": nid, "permission": perm}))
+    except Exception:
+        logger.exception("create_share_v2")
+    return {"id": nid, "page_id": page_id, "status": "shared"}
+
+
+@router.patch("/shares/{share_id}")
+def patch_share_v2(share_id: int, request: Request, authorization: str | None = Header(default=None), body: dict = Body(default={})):
+    user = require_scope("write")(request, authorization)
+    _v2_rate_check(request, user)
+    perm = (body.get("permission") or "").strip().lower()
+    if perm not in ("view", "comment", "edit"):
+        raise HTTPException(400, "Invalid permission")
+    with get_conn() as conn:
+        if not conn.execute("SELECT id FROM page_shares WHERE id=?", (share_id,)).fetchone():
+            raise HTTPException(404, "Share not found")
+        conn.execute("UPDATE page_shares SET permission=? WHERE id=?", (perm, share_id))
+        conn.commit()
+    return {"id": share_id, "status": "updated"}
+
+
+@router.delete("/shares/{share_id}")
+def delete_share_v2(share_id: int, request: Request, authorization: str | None = Header(default=None)):
+    user = require_scope("write")(request, authorization)
+    _v2_rate_check(request, user)
+    with get_conn() as conn:
+        row = conn.execute("SELECT page_id FROM page_shares WHERE id=?", (share_id,)).fetchone()
+        if not row:
+            raise HTTPException(404, "Share not found")
+        conn.execute("DELETE FROM page_shares WHERE id=?", (share_id,))
+        # unset is_shared if no shares left
+        cnt = conn.execute("SELECT COUNT(*) FROM page_shares WHERE page_id=?", (row["page_id"],)).fetchone()[0]
+        if cnt == 0:
+            conn.execute("UPDATE pages SET is_shared=0 WHERE id=?", (row["page_id"],))
+        conn.commit()
+    return {"id": share_id, "status": "revoked"}
+
+
+@router.post("/pages/{page_id}/publish")
+def publish_page_v2(page_id: int, request: Request, authorization: str | None = Header(default=None), body: dict = Body(default={})):
+    user = require_scope("write")(request, authorization)
+    _v2_rate_check(request, user)
+    slug_in = (body.get("slug") or body.get("publish_slug") or "").strip() or None
+    slug, _title = publish(page_id, explicit_slug=slug_in)
+    audit_log(user, "page.publish", "page", page_id, slug, request)
+    run_event_sync(fire_published(page_id, slug))
+    return {"page_id": page_id, "slug": slug, "url": f"/p/{slug}", "status": "published"}
+
+
+@router.delete("/pages/{page_id}/publish")
+def unpublish_page_v2(page_id: int, request: Request, authorization: str | None = Header(default=None)):
+    user = require_scope("write")(request, authorization)
+    _v2_rate_check(request, user)
+    unpublish(page_id)
+    run_event_sync(fire_unpublished(page_id))
+    return {"page_id": page_id, "status": "unpublished"}
+
+
+@router.get("/pages/{page_id}/history")
+def list_history_v2(page_id: int, request: Request, authorization: str | None = Header(default=None)):
+    user = get_bearer_user(request, authorization)
+    _v2_rate_check(request, user)
+    with get_conn() as conn:
+        rows = conn.execute("SELECT h.*, u.login FROM page_history h LEFT JOIN users u ON u.id=h.user_id WHERE h.page_id=? ORDER BY h.created_at DESC", (page_id,)).fetchall()
+        # also page_versions for block pages
+        vrows = conn.execute("SELECT * FROM page_versions WHERE page_id=? ORDER BY created_at DESC", (page_id,)).fetchall()
+    return {"history": [row_to_dict(r) for r in rows], "versions": [row_to_dict(r) for r in vrows]}
+
+
+@router.post("/pages/{page_id}/history/restore")
+def restore_history_v2(page_id: int, request: Request, authorization: str | None = Header(default=None), body: dict = Body(default={})):
+    user = require_scope("write")(request, authorization)
+    _v2_rate_check(request, user)
+    hid = body.get("history_id") or body.get("id") or body.get("version_id")
+    if not hid:
+        raise HTTPException(400, "history_id required")
+    with get_conn() as conn:
+        h = conn.execute("SELECT * FROM page_versions WHERE id=? AND page_id=?", (hid, page_id)).fetchone()
+        if h:
+            conn.execute("UPDATE pages SET content=?, title=?, updated_at=CURRENT_TIMESTAMP WHERE id=?", (h["blocks_json"], h["title"], page_id))
+            conn.commit()
+            return {"page_id": page_id, "restored_version": hid, "status": "restored"}
+        h2 = conn.execute("SELECT * FROM page_history WHERE id=? AND page_id=?", (hid, page_id)).fetchone()
+        if h2:
+            try:
+                snap = json.loads(h2["snapshot_json"] or "{}")
+            except Exception:
+                snap = {}
+            # best-effort restore content
+            if snap.get("content"):
+                conn.execute("UPDATE pages SET content=? WHERE id=?", (snap["content"], page_id))
+                conn.commit()
+            return {"page_id": page_id, "restored_version": hid, "status": "restored"}
+        raise HTTPException(404, "History not found")
+
+
+@router.get("/collections/{collection_id}/sprints")
+def list_sprints_v2(collection_id: int, request: Request, authorization: str | None = Header(default=None)):
+    user = get_bearer_user(request, authorization)
+    _v2_rate_check(request, user)
+    limit, offset = parse_pagination(request)
+    with get_conn() as conn:
+        total = conn.execute("SELECT COUNT(*) FROM sprints WHERE collection_id=?", (collection_id,)).fetchone()[0]
+        rows = conn.execute("SELECT * FROM sprints WHERE collection_id=? ORDER BY created_at DESC LIMIT ? OFFSET ?", (collection_id, limit, offset)).fetchall()
+    return {"sprints": [row_to_dict(r) for r in rows], "total": total, "limit": limit, "offset": offset}

app/routers/api_v2/templates_io.py

@@ -0,0 +1,205 @@
+"""FlowDeck — Public API v2 : templates_io.
+
+Découpe A28 de l'ancien app/routers/api_v2.py (2 110 lignes, 115 routes) — un module par concern, contrat inchangé (Bearer+scopes, pagination, RFC7807, audit + idempotency).
+"""
+from __future__ import annotations
+
+import json
+import logging
+
+from fastapi import APIRouter, Body, Header, HTTPException, Request
+from fastapi.responses import Response
+
+from app.db import get_conn
+from app.services.api_v2_helpers import (  # noqa: F401 — require_scope est utilisé par les handlers
+    audit_log,
+    check_idempotency,
+    check_v2_rate_limit,
+    get_bearer_user,
+    has_scope,
+    paginate_headers,
+    parse_pagination,
+    require_scope,
+    row_to_dict,
+    store_idempotency,
+    to_iso8601,
+    validate_scopes_input,
+)
+
+from ._common import _v2_rate_check
+
+logger = logging.getLogger(__name__)
+router = APIRouter(tags=["api-v2"])
+
+
+
+@router.post("/collections/{collection_id}/templates")
+def create_template_v2(collection_id: int, request: Request, authorization: str | None = Header(default=None), body: dict = Body(default={})):
+    user = require_scope("write")(request, authorization)
+    _v2_rate_check(request, user)
+    name = (body.get("name") or "Template").strip()
+    pv = json.dumps(body.get("property_values") or body.get("property_values_json") or {})
+    cj = json.dumps(body.get("content") or body.get("content_json") or [])
+    with get_conn() as conn:
+        cur = conn.execute("INSERT INTO page_templates (collection_id, name, property_values_json, content_json) VALUES (?, ?, ?, ?)", (collection_id, name, pv, cj))
+        tid = cur.lastrowid
+        conn.commit()
+    return {"id": tid, "name": name, "status": "created"}
+
+
+@router.patch("/templates/{template_id}")
+def patch_template_v2(template_id: int, request: Request, authorization: str | None = Header(default=None), body: dict = Body(default={})):
+    user = require_scope("write")(request, authorization)
+    _v2_rate_check(request, user)
+    with get_conn() as conn:
+        row = conn.execute("SELECT * FROM page_templates WHERE id=?", (template_id,)).fetchone()
+        if not row:
+            raise HTTPException(404, "Template not found")
+        name = body.get("name", row["name"])
+        pv = json.dumps(body.get("property_values", json.loads(row["property_values_json"] or "{}"))) if "property_values" in body else row["property_values_json"]
+        cj = json.dumps(body.get("content", json.loads(row["content_json"] or "[]"))) if "content" in body else row["content_json"]
+        conn.execute("UPDATE page_templates SET name=?, property_values_json=?, content_json=? WHERE id=?", (name, pv, cj, template_id))
+        conn.commit()
+    return {"id": template_id, "status": "updated"}
+
+
+@router.delete("/templates/{template_id}")
+def delete_template_v2(template_id: int, request: Request, authorization: str | None = Header(default=None)):
+    user = require_scope("write")(request, authorization)
+    _v2_rate_check(request, user)
+    with get_conn() as conn:
+        conn.execute("DELETE FROM page_templates WHERE id=?", (template_id,))
+        conn.commit()
+    return {"id": template_id, "status": "deleted"}
+
+
+@router.post("/templates/{template_id}/apply")
+def apply_template_v2(template_id: int, request: Request, authorization: str | None = Header(default=None)):
+    user = require_scope("write")(request, authorization)
+    _v2_rate_check(request, user)
+    with get_conn() as conn:
+        tpl = conn.execute("SELECT * FROM page_templates WHERE id=?", (template_id,)).fetchone()
+        if not tpl:
+            raise HTTPException(404, "Template not found")
+        max_pos = conn.execute("SELECT COALESCE(MAX(position), -1)+1 FROM collection_pages WHERE collection_id=?", (tpl["collection_id"],)).fetchone()[0]
+        pv = tpl["property_values_json"] or "{}"
+        cur = conn.execute("INSERT INTO collection_pages (collection_id, title, position, property_values_json) VALUES (?, ?, ?, ?)", (tpl["collection_id"], tpl["name"], max_pos, pv))
+        pid = cur.lastrowid
+        conn.commit()
+    return {"template_id": template_id, "page_id": pid, "status": "applied"}
+
+
+@router.get("/templates/database")
+def list_db_templates_v2(request: Request, authorization: str | None = Header(default=None)):
+    user = get_bearer_user(request, authorization)
+    _v2_rate_check(request, user)
+    with get_conn() as conn:
+        rows = conn.execute("SELECT * FROM database_templates ORDER BY name").fetchall()
+    return {"templates": [row_to_dict(r) for r in rows]}
+
+
+@router.post("/templates/database/{template_id}/apply")
+def apply_db_template_v2(template_id: int, request: Request, authorization: str | None = Header(default=None), body: dict = Body(default={})):
+    user = require_scope("write")(request, authorization)
+    _v2_rate_check(request, user)
+    with get_conn() as conn:
+        tpl = conn.execute("SELECT * FROM database_templates WHERE id=?", (template_id,)).fetchone()
+        if not tpl:
+            raise HTTPException(404, "Template not found")
+        name = (body.get("name") or tpl["name"]).strip()
+        schema = json.loads(tpl["schema_json"] or "[]")
+        cur = conn.execute("INSERT INTO collections (name, description, icon, schema_json, workspace_id, created_by) VALUES (?, ?, ?, ?, ?, ?)", (name, tpl["description"], tpl["icon"] if "icon" in tpl.keys() else "📋", json.dumps(schema), body.get("workspace_id"), user["id"]))
+        cid = cur.lastrowid
+        # A25 : pas de try — un échec de matérialisation doit interrompre la
+        # transaction plutôt que de commiter une collection sans schéma.
+        from app.services.db_templates import materialize_properties
+        materialize_properties(conn, cid, schema)
+        conn.commit()
+    return {"collection_id": cid, "name": name, "status": "created"}
+
+
+@router.get("/pages/{page_id}/export")
+def export_page_v2(page_id: int, request: Request, format: str = "markdown", authorization: str | None = Header(default=None)):
+    user = get_bearer_user(request, authorization)
+    _v2_rate_check(request, user)
+    fmt = (format or request.query_params.get("format") or "markdown").lower()
+    if fmt not in ("markdown", "html", "pdf"):
+        raise HTTPException(400, "format must be markdown, html or pdf")
+    with get_conn() as conn:
+        row = conn.execute("SELECT * FROM pages WHERE id=?", (page_id,)).fetchone()
+        if not row:
+            # try collection_pages
+            row2 = conn.execute("SELECT * FROM collection_pages WHERE id=?", (page_id,)).fetchone()
+            if not row2:
+                raise HTTPException(404, "Page not found")
+            # collection pages: return JSON
+            return {"page": row_to_dict(row2), "format": fmt}
+        # block pages: delegate to export service
+        from app.services.export import export_page as _export
+        try:
+            data, mime, fname = _export(row, fmt)  # type: ignore
+            return Response(content=data, media_type=mime, headers={"Content-Disposition": f'attachment; filename="{fname}"'})
+        except Exception as e:
+            raise HTTPException(500, f"Export failed: {e}") from None
+
+
+@router.get("/collections/{collection_id}/export/csv")
+def export_csv_v2(collection_id: int, request: Request, authorization: str | None = Header(default=None)):
+    user = get_bearer_user(request, authorization)
+    _v2_rate_check(request, user)
+    import csv
+    import io
+    with get_conn() as conn:
+        if not conn.execute("SELECT id FROM collections WHERE id=?", (collection_id,)).fetchone():
+            raise HTTPException(404, "Collection not found")
+        props = [dict(r) for r in conn.execute("SELECT * FROM collection_properties WHERE collection_id=? ORDER BY position", (collection_id,)).fetchall()]
+        rows = conn.execute("SELECT * FROM collection_pages WHERE collection_id=? ORDER BY position", (collection_id,)).fetchall()
+    out = io.StringIO()
+    writer = csv.writer(out)
+    header = ["Title"] + [p["name"] for p in props]
+    writer.writerow(header)
+    for r in rows:
+        try:
+            pv = json.loads(r["property_values_json"] or "{}")
+        except Exception:
+            pv = {}
+        vals = [r["title"]]
+        for p in props:
+            vals.append(str(pv.get(str(p["id"])) or pv.get(p["name"]) or ""))
+        writer.writerow(vals)
+    return Response(content=out.getvalue().encode("utf-8"), media_type="text/csv", headers={"Content-Disposition": f'attachment; filename="collection-{collection_id}.csv"'})
+
+
+@router.post("/collections/{collection_id}/import/csv")
+async def import_csv_v2(collection_id: int, request: Request, authorization: str | None = Header(default=None)):
+    user = require_scope("write")(request, authorization)
+    _v2_rate_check(request, user)
+    try:
+        form = await request.form()
+        file = form.get("file")
+        data = await file.read() if file else b""
+        text = data.decode("utf-8", errors="ignore")
+    except Exception as err:
+        raise HTTPException(400, "file required (multipart)") from err
+    import csv
+    import io
+    reader = csv.DictReader(io.StringIO(text))
+    created = 0
+    with get_conn() as conn:
+        for row in reader:
+            title = row.get("Title") or row.get("title") or "Untitled"
+            # map remaining columns to property names
+            pv = {}
+            # resolve prop name -> id
+            props = {p["name"]: p["id"] for p in conn.execute("SELECT id, name FROM collection_properties WHERE collection_id=?", (collection_id,)).fetchall()}
+            for k, v in row.items():
+                if k in ("Title", "title"):
+                    continue
+                pid = props.get(k)
+                if pid:
+                    pv[str(pid)] = v
+            max_pos = conn.execute("SELECT COALESCE(MAX(position), -1)+1 FROM collection_pages WHERE collection_id=?", (collection_id,)).fetchone()[0]
+            conn.execute("INSERT INTO collection_pages (collection_id, title, position, property_values_json) VALUES (?, ?, ?, ?)", (collection_id, title, max_pos, json.dumps(pv)))
+            created += 1
+        conn.commit()
+    return {"imported": created, "status": "ok"}

app/routers/api_v2/views.py

@@ -0,0 +1,164 @@
+"""FlowDeck — Public API v2 : views.
+
+Découpe A28 de l'ancien app/routers/api_v2.py (2 110 lignes, 115 routes) — un module par concern, contrat inchangé (Bearer+scopes, pagination, RFC7807, audit + idempotency).
+"""
+from __future__ import annotations
+
+import json
+import logging
+
+from fastapi import APIRouter, Body, Header, HTTPException, Request
+
+from app.db import get_conn
+from app.services.api_v2_helpers import (  # noqa: F401 — require_scope est utilisé par les handlers
+    audit_log,
+    check_idempotency,
+    check_v2_rate_limit,
+    get_bearer_user,
+    has_scope,
+    paginate_headers,
+    parse_pagination,
+    require_scope,
+    row_to_dict,
+    store_idempotency,
+    to_iso8601,
+    validate_scopes_input,
+)
+from app.services.automations import fire_event as _fire_event
+from app.services.automations import run_event_sync
+
+from ._common import _v2_rate_check
+
+logger = logging.getLogger(__name__)
+router = APIRouter(tags=["api-v2"])
+
+
+
+@router.post("/collections/{collection_id}/views")
+def create_view_v2(collection_id: int, request: Request, authorization: str | None = Header(default=None), body: dict = Body(default={})):
+    user = require_scope("write")(request, authorization)
+    _v2_rate_check(request, user)
+    name = (body.get("name") or "New View").strip()
+    vtype = body.get("view_type") or body.get("type") or "table"
+    config = body.get("config") or body.get("config_json") or {}
+    with get_conn() as conn:
+        if not conn.execute("SELECT id FROM collections WHERE id=?", (collection_id,)).fetchone():
+            raise HTTPException(404, "Collection not found")
+        max_pos = conn.execute("SELECT COALESCE(MAX(position), -1)+1 FROM collection_views WHERE collection_id=?", (collection_id,)).fetchone()[0]
+        cur = conn.execute("INSERT INTO collection_views (collection_id, name, view_type, config_json, position, created_by) VALUES (?, ?, ?, ?, ?, ?)", (collection_id, name, vtype, json.dumps(config), max_pos, user["id"]))
+        vid = cur.lastrowid
+        conn.commit()
+    audit_log(user, "view.create", "view", vid, name, request)
+    try:
+        run_event_sync(_fire_event("collection.view.created", {"view_id": vid, "collection_id": collection_id, "name": name, "view_type": vtype}))
+    except Exception:
+        logger.exception("create_view_v2")
+    return {"id": vid, "name": name, "view_type": vtype, "status": "created"}
+
+
+@router.patch("/views/{view_id}")
+def patch_view_v2(view_id: int, request: Request, authorization: str | None = Header(default=None), body: dict = Body(default={})):
+    user = require_scope("write")(request, authorization)
+    _v2_rate_check(request, user)
+    with get_conn() as conn:
+        row = conn.execute("SELECT * FROM collection_views WHERE id=?", (view_id,)).fetchone()
+        if not row:
+            raise HTTPException(404, "View not found")
+        cfg = json.loads(row["config_json"] or "{}")
+        if "config" in body:
+            cfg.update(body["config"])
+        elif "config_json" in body:
+            try:
+                cfg.update(json.loads(body["config_json"]) if isinstance(body["config_json"], str) else body["config_json"])
+            except Exception:
+                logger.exception("patch_view_v2")
+        # also flat keys
+        for k in ("group_by", "sub_group_by", "wip_limits", "card_size", "cover_property", "cover_mode", "card_properties", "visible_properties", "filters", "sorts", "date_property"):
+            if k in body:
+                cfg[k] = body[k]
+        name = body.get("name", row["name"])
+        vtype = body.get("view_type") or body.get("type") or row["view_type"]
+        conn.execute("UPDATE collection_views SET name=?, view_type=?, config_json=?, updated_at=CURRENT_TIMESTAMP WHERE id=?", (name, vtype, json.dumps(cfg), view_id))
+        conn.commit()
+    audit_log(user, "view.update", "view", view_id, "", request)
+    return {"id": view_id, "status": "updated"}
+
+
+@router.delete("/views/{view_id}")
+def delete_view_v2(view_id: int, request: Request, authorization: str | None = Header(default=None)):
+    user = require_scope("write")(request, authorization)
+    _v2_rate_check(request, user)
+    with get_conn() as conn:
+        if not conn.execute("SELECT id FROM collection_views WHERE id=?", (view_id,)).fetchone():
+            raise HTTPException(404, "View not found")
+        conn.execute("DELETE FROM collection_views WHERE id=?", (view_id,))
+        conn.commit()
+    audit_log(user, "view.delete", "view", view_id, "", request)
+    return {"id": view_id, "status": "deleted"}
+
+
+@router.post("/views/{view_id}/save-as")
+def save_as_view_v2(view_id: int, request: Request, authorization: str | None = Header(default=None), body: dict = Body(default={})):
+    user = require_scope("write")(request, authorization)
+    _v2_rate_check(request, user)
+    name = (body.get("name") or "").strip() or "Copy"
+    with get_conn() as conn:
+        row = conn.execute("SELECT * FROM collection_views WHERE id=?", (view_id,)).fetchone()
+        if not row:
+            raise HTTPException(404, "View not found")
+        max_pos = conn.execute("SELECT COALESCE(MAX(position), -1)+1 FROM collection_views WHERE collection_id=?", (row["collection_id"],)).fetchone()[0]
+        cur = conn.execute("INSERT INTO collection_views (collection_id, name, view_type, config_json, position, created_by) VALUES (?, ?, ?, ?, ?, ?)", (row["collection_id"], name, row["view_type"], row["config_json"], max_pos, user["id"]))
+        nid = cur.lastrowid
+        conn.commit()
+    return {"id": nid, "name": name, "status": "created"}
+
+
+@router.get("/collections/{collection_id}/dashboards")
+def list_dashboards_v2(collection_id: int, request: Request, authorization: str | None = Header(default=None)):
+    user = get_bearer_user(request, authorization)
+    _v2_rate_check(request, user)
+    with get_conn() as conn:
+        rows = conn.execute("SELECT * FROM collection_dashboards WHERE collection_id=? ORDER BY created_at", (collection_id,)).fetchall()
+    return {"dashboards": [row_to_dict(r) for r in rows]}
+
+
+@router.post("/collections/{collection_id}/dashboards")
+def create_dashboard_v2(collection_id: int, request: Request, authorization: str | None = Header(default=None), body: dict = Body(default={})):
+    user = require_scope("write")(request, authorization)
+    _v2_rate_check(request, user)
+    name = (body.get("name") or "Dashboard").strip()
+    layout = body.get("layout") or body.get("layout_json") or {"columns": 1, "widgets": []}
+    with get_conn() as conn:
+        cur = conn.execute("INSERT INTO collection_dashboards (collection_id, name, layout_json) VALUES (?, ?, ?)", (collection_id, name, json.dumps(layout)))
+        did = cur.lastrowid
+        conn.commit()
+    return {"id": did, "name": name, "status": "created"}
+
+
+@router.patch("/dashboards/{dashboard_id}")
+def patch_dashboard_v2(dashboard_id: int, request: Request, authorization: str | None = Header(default=None), body: dict = Body(default={})):
+    user = require_scope("write")(request, authorization)
+    _v2_rate_check(request, user)
+    with get_conn() as conn:
+        row = conn.execute("SELECT * FROM collection_dashboards WHERE id=?", (dashboard_id,)).fetchone()
+        if not row:
+            raise HTTPException(404, "Dashboard not found")
+        name = body.get("name", row["name"])
+        layout = body.get("layout") or body.get("layout_json")
+        if layout is not None:
+            layout_json = json.dumps(layout)
+        else:
+            layout_json = row["layout_json"]
+        conn.execute("UPDATE collection_dashboards SET name=?, layout_json=?, updated_at=CURRENT_TIMESTAMP WHERE id=?", (name, layout_json, dashboard_id))
+        conn.commit()
+    return {"id": dashboard_id, "status": "updated"}
+
+
+@router.delete("/dashboards/{dashboard_id}")
+def delete_dashboard_v2(dashboard_id: int, request: Request, authorization: str | None = Header(default=None)):
+    user = require_scope("write")(request, authorization)
+    _v2_rate_check(request, user)
+    with get_conn() as conn:
+        conn.execute("DELETE FROM collection_dashboards WHERE id=?", (dashboard_id,))
+        conn.commit()
+    return {"id": dashboard_id, "status": "deleted"}

app/routers/api_v2/webhooks.py

@@ -0,0 +1,195 @@
+"""FlowDeck — Public API v2 : webhooks.
+
+Découpe A28 de l'ancien app/routers/api_v2.py (2 110 lignes, 115 routes) — un module par concern, contrat inchangé (Bearer+scopes, pagination, RFC7807, audit + idempotency).
+"""
+from __future__ import annotations
+
+import logging
+
+from fastapi import APIRouter, Body, Header, HTTPException, Request
+from fastapi.responses import JSONResponse
+
+from app.db import get_conn
+from app.services.api_v2_helpers import (  # noqa: F401 — require_scope est utilisé par les handlers
+    audit_log,
+    check_idempotency,
+    check_v2_rate_limit,
+    get_bearer_user,
+    has_scope,
+    paginate_headers,
+    parse_pagination,
+    require_scope,
+    row_to_dict,
+    store_idempotency,
+    to_iso8601,
+    validate_scopes_input,
+)
+
+from ._common import _v2_rate_check
+
+logger = logging.getLogger(__name__)
+router = APIRouter(tags=["api-v2"])
+
+
+
+@router.get("/webhooks")
+def list_webhooks_v2(request: Request, authorization: str | None = Header(default=None)):
+    user = get_bearer_user(request, authorization)
+    _v2_rate_check(request, user)
+    limit, offset = parse_pagination(request)
+    with get_conn() as conn:
+        total = conn.execute("SELECT COUNT(*) AS n FROM webhook_subscriptions").fetchone()["n"]
+        rows = conn.execute(
+            "SELECT * FROM webhook_subscriptions ORDER BY created_at DESC LIMIT ? OFFSET ?",
+            (limit, offset),
+        ).fetchall()
+    return JSONResponse(
+        content={"webhooks": [dict(r) for r in rows]},
+        headers=paginate_headers(total),
+    )
+
+
+@router.post("/webhooks")
+def create_webhook_v2(request: Request, authorization: str | None = Header(default=None), body: dict = Body(default={})):
+    user = require_scope("write")(request, authorization)
+    _v2_rate_check(request, user)
+    from app.services.webhook_outbound import EVENTS, _event_matches
+    url = (body.get("url") or "").strip()
+    event = (body.get("event") or "page.created").strip()
+    secret = (body.get("secret") or "").strip()
+    if not url or not url.startswith("http"):
+        raise HTTPException(400, "url must start with http")
+    if not event or (event not in EVENTS and not (event.endswith(".*") or event in ("*", "all"))):
+        raise HTTPException(400, f"Unknown event '{event}'. See GET /api/v2/webhooks/events")
+    # make sure the pattern matches at least one known event
+    if not any(_event_matches(event, e) for e in EVENTS):
+        raise HTTPException(400, f"Event pattern '{event}' matches no known event")
+    with get_conn() as conn:
+        cur = conn.execute("INSERT INTO webhook_subscriptions (url, event, secret) VALUES (?, ?, ?)", (url, event, secret))
+        wid = cur.lastrowid
+        conn.commit()
+        row = conn.execute("SELECT * FROM webhook_subscriptions WHERE id=?", (wid,)).fetchone()
+    audit_log(user, "webhook.create", "webhook", wid, url, request)
+    return {"id": wid, "status": "created", "webhook": dict(row) if row else {},
+            "signature_header": "X-FlowDeck-Signature (HMAC-SHA256, sha256=<hex>)" if secret else None}
+
+
+@router.patch("/webhooks/{webhook_id}")
+def patch_webhook_v2(webhook_id: int, request: Request, authorization: str | None = Header(default=None), body: dict = Body(default={})):
+    user = require_scope("write")(request, authorization)
+    _v2_rate_check(request, user)
+    with get_conn() as conn:
+        row = conn.execute("SELECT * FROM webhook_subscriptions WHERE id=?", (webhook_id,)).fetchone()
+        if not row:
+            raise HTTPException(404, "Webhook not found")
+        url = body.get("url", row["url"])
+        event = body.get("event", row["event"])
+        secret = body.get("secret", row["secret"])
+        active = int(bool(body.get("active", row["active"])))
+        conn.execute("UPDATE webhook_subscriptions SET url=?, event=?, secret=?, active=? WHERE id=?", (url, event, secret, active, webhook_id))
+        conn.commit()
+    audit_log(user, "webhook.update", "webhook", webhook_id, "", request)
+    return {"id": webhook_id, "status": "updated"}
+
+
+@router.delete("/webhooks/{webhook_id}")
+def delete_webhook_v2(webhook_id: int, request: Request, authorization: str | None = Header(default=None)):
+    user = require_scope("write")(request, authorization)
+    _v2_rate_check(request, user)
+    with get_conn() as conn:
+        conn.execute("DELETE FROM webhook_subscriptions WHERE id=?", (webhook_id,))
+        conn.commit()
+    audit_log(user, "webhook.delete", "webhook", webhook_id, "", request)
+    return {"id": webhook_id, "status": "deleted"}
+
+
+@router.post("/webhooks/{webhook_id}/test")
+async def test_webhook_v2(webhook_id: int, request: Request, authorization: str | None = Header(default=None)):
+    user = require_scope("write")(request, authorization)
+    _v2_rate_check(request, user)
+    with get_conn() as conn:
+        row = conn.execute("SELECT * FROM webhook_subscriptions WHERE id=?", (webhook_id,)).fetchone()
+        if not row:
+            raise HTTPException(404, "Webhook not found")
+        # live delivery via the prod dispatcher (HMAC + retry + journal),
+        # direct to this subscription only (no wildcard fan-out)
+        from app.services.webhook_outbound import deliver_to_sub
+        ok = await deliver_to_sub(webhook_id, row["url"], "ping",
+                                  {"webhook_id": webhook_id, "test": True},
+                                  row["secret"] or "")
+    audit_log(user, "webhook.test", "webhook", webhook_id, f"ok={ok}", request)
+    return {"webhook_id": webhook_id, "status": "tested", "delivered": ok}
+
+
+@router.get("/webhooks/{webhook_id}/deliveries")
+def list_deliveries_v2(webhook_id: int, request: Request,
+                              status: str | None = None,
+                              authorization: str | None = Header(default=None)):
+    user = get_bearer_user(request, authorization)
+    _v2_rate_check(request, user)
+    limit, offset = parse_pagination(request)
+    with get_conn() as conn:
+        if status:
+            total = conn.execute(
+                "SELECT COUNT(*) AS n FROM webhook_deliveries WHERE webhook_id=? AND status=?",
+                (webhook_id, status)).fetchone()["n"]
+            rows = conn.execute(
+                "SELECT * FROM webhook_deliveries WHERE webhook_id=? AND status=? "
+                "ORDER BY created_at DESC LIMIT ? OFFSET ?",
+                (webhook_id, status, limit, offset)).fetchall()
+        else:
+            total = conn.execute(
+                "SELECT COUNT(*) AS n FROM webhook_deliveries WHERE webhook_id=?",
+                (webhook_id,)).fetchone()["n"]
+            rows = conn.execute(
+                "SELECT * FROM webhook_deliveries WHERE webhook_id=? "
+                "ORDER BY created_at DESC LIMIT ? OFFSET ?",
+                (webhook_id, limit, offset)).fetchall()
+    return JSONResponse(
+        content={"deliveries": [row_to_dict(r) for r in rows]},
+        headers=paginate_headers(total),
+    )
+
+
+@router.post("/webhooks/{webhook_id}/retry")
+async def retry_webhook_deliveries(webhook_id: int, request: Request,
+                                    authorization: str | None = Header(default=None)):
+    """Manually retry failed deliveries for a webhook."""
+    user = require_scope("write")(request, authorization)
+    _v2_rate_check(request, user)
+
+    from app.services.webhook_outbound import retry_due_deliveries
+
+    with get_conn() as conn:
+        # Force retry by setting next_retry_at to the past
+        conn.execute(
+            """UPDATE webhook_deliveries
+               SET next_retry_at = strftime('%s', 'now', '-1 second')
+               WHERE webhook_id = ? AND status = 'retrying'""",
+            (webhook_id,),
+        )
+        conn.commit()
+
+    retried = await retry_due_deliveries()
+    audit_log(user, "webhook.retry", "webhook", webhook_id, f"retried={retried}", request)
+    return {"webhook_id": webhook_id, "status": "retried", "retried_count": retried}
+
+
+@router.post("/webhooks/verify-signature")
+def verify_webhook_signature(request: Request,
+                                    authorization: str | None = Header(default=None),
+                                    body: dict = Body(default={})):
+    """Verify a webhook signature (for debugging/testing)."""
+    user = get_bearer_user(request, authorization)
+    _v2_rate_check(request, user)
+
+    from app.services.webhook_outbound import verify_signature
+
+    secret = body.get("secret", "")
+    payload = body.get("payload", "{}")
+    signature = body.get("signature", "")
+
+    is_valid = verify_signature(secret, payload.encode(), signature)
+
+    audit_log(user, "webhook.signature_verify", "webhook", 0, f"valid={is_valid}", request)
+    return {"valid": is_valid, "secret": secret[:10] + "..." if len(secret) > 10 else secret}

app/routers/api_v2/workspaces.py

@@ -0,0 +1,230 @@
+"""FlowDeck — Public API v2 : workspaces.
+
+Découpe A28 de l'ancien app/routers/api_v2.py (2 110 lignes, 115 routes) — un module par concern, contrat inchangé (Bearer+scopes, pagination, RFC7807, audit + idempotency).
+"""
+from __future__ import annotations
+
+import json
+import logging
+
+from fastapi import APIRouter, Body, Header, HTTPException, Request
+from fastapi.responses import JSONResponse
+
+from app.db import get_conn
+from app.services.api_v2_helpers import (  # noqa: F401 — require_scope est utilisé par les handlers
+    audit_log,
+    check_idempotency,
+    check_v2_rate_limit,
+    get_bearer_user,
+    has_scope,
+    paginate_headers,
+    parse_pagination,
+    require_scope,
+    row_to_dict,
+    store_idempotency,
+    to_iso8601,
+    validate_scopes_input,
+)
+
+from ._common import _v2_rate_check
+
+logger = logging.getLogger(__name__)
+router = APIRouter(tags=["api-v2"])
+
+
+
+@router.get("/workspaces")
+def list_workspaces(request: Request, authorization: str | None = Header(default=None)):
+    user = get_bearer_user(request, authorization)
+    _v2_rate_check(request, user)
+    limit, offset = parse_pagination(request)
+    with get_conn() as conn:
+        total = conn.execute("SELECT COUNT(*) FROM workspaces WHERE owner_id=? OR id IN (SELECT workspace_id FROM workspace_members WHERE user_id=?)", (user["id"], user["id"])).fetchone()[0]
+        rows = conn.execute("SELECT w.*, wm.role FROM workspaces w LEFT JOIN workspace_members wm ON wm.workspace_id=w.id AND wm.user_id=? WHERE w.owner_id=? OR w.id IN (SELECT workspace_id FROM workspace_members WHERE user_id=?) ORDER BY w.created_at DESC LIMIT ? OFFSET ?", (user["id"], user["id"], user["id"], limit, offset)).fetchall()
+    out = []
+    for r in rows:
+        d = dict(r)
+        d["created_at"] = to_iso8601(d.get("created_at"))
+        try:
+            d["settings"] = json.loads(d.get("settings_json") or "{}")
+        except Exception:
+            d["settings"] = {}
+        out.append(d)
+    return {"workspaces": out, "total": total, "limit": limit, "offset": offset}
+
+
+@router.post("/workspaces")
+def create_workspace(request: Request, authorization: str | None = Header(default=None), body: dict = Body(default={})):
+    user = require_scope("write")(request, authorization)
+    _v2_rate_check(request, user)
+    idem = check_idempotency(request, user["id"])
+    if idem:
+        return JSONResponse(content=idem["data"], status_code=idem["status"])
+    name = (body.get("name") or "").strip()
+    if not name:
+        raise HTTPException(400, "name is required")
+    settings_json = json.dumps(body.get("settings") or body.get("settings_json") or {})
+    with get_conn() as conn:
+        cur = conn.execute("INSERT INTO workspaces (name, owner_id, settings_json) VALUES (?, ?, ?)", (name, user["id"], settings_json))
+        wid = cur.lastrowid
+        # owner is implicitly admin member
+        try:
+            conn.execute("INSERT OR IGNORE INTO workspace_members (workspace_id, user_id, role) VALUES (?, ?, 'owner')", (wid, user["id"]))
+        except Exception:
+            logger.exception("create_workspace")
+        conn.commit()
+        row = conn.execute("SELECT * FROM workspaces WHERE id=?", (wid,)).fetchone()
+    audit_log(user, "workspace.create", "workspace", wid, name, request)
+    data = {"id": wid, "name": name, "owner_id": user["id"], "status": "created", "workspace": row_to_dict(row)}
+    key = (request.headers.get("Idempotency-Key") or "").strip()
+    if key:
+        store_idempotency(key, user["id"], data, 200)
+    return JSONResponse(content=data, status_code=201)
+
+
+@router.get("/workspaces/{workspace_id}")
+def get_workspace(workspace_id: int, request: Request, authorization: str | None = Header(default=None)):
+    user = get_bearer_user(request, authorization)
+    _v2_rate_check(request, user)
+    with get_conn() as conn:
+        row = conn.execute("SELECT * FROM workspaces WHERE id=?", (workspace_id,)).fetchone()
+        if not row:
+            raise HTTPException(404, "Workspace not found")
+        # ACL: must be member or owner
+        member = conn.execute("SELECT role FROM workspace_members WHERE workspace_id=? AND user_id=?", (workspace_id, user["id"])).fetchone()
+        is_owner = row["owner_id"] == user["id"]
+        if not is_owner and not member and not user.get("is_admin"):
+            raise HTTPException(404, "Workspace not found")
+        members = conn.execute("SELECT u.id, u.login, u.full_name, u.avatar_url, wm.role FROM workspace_members wm JOIN users u ON u.id=wm.user_id WHERE wm.workspace_id=? ORDER BY wm.joined_at", (workspace_id,)).fetchall()
+    d = row_to_dict(row)
+    d["members"] = [dict(m) for m in members]
+    return d
+
+
+@router.patch("/workspaces/{workspace_id}")
+def patch_workspace(workspace_id: int, request: Request, authorization: str | None = Header(default=None), body: dict = Body(default={})):
+    user = require_scope("write")(request, authorization)
+    _v2_rate_check(request, user)
+    with get_conn() as conn:
+        row = conn.execute("SELECT * FROM workspaces WHERE id=?", (workspace_id,)).fetchone()
+        if not row:
+            raise HTTPException(404, "Workspace not found")
+        if row["owner_id"] != user["id"] and not user.get("is_admin"):
+            # check admin member
+            mem = conn.execute("SELECT role FROM workspace_members WHERE workspace_id=? AND user_id=?", (workspace_id, user["id"])).fetchone()
+            if not mem or mem["role"] not in ("owner", "admin"):
+                raise HTTPException(403, "Only owner/admin can edit workspace")
+        name = body.get("name", row["name"])
+        sj = body.get("settings_json") or body.get("settings")
+        if sj is not None:
+            sj = json.dumps(sj) if isinstance(sj, (dict, list)) else str(sj)
+        else:
+            sj = row["settings_json"]
+        conn.execute("UPDATE workspaces SET name=?, settings_json=? WHERE id=?", (name, sj, workspace_id))
+        conn.commit()
+    audit_log(user, "workspace.update", "workspace", workspace_id, "", request)
+    return {"id": workspace_id, "status": "updated"}
+
+
+@router.delete("/workspaces/{workspace_id}")
+def delete_workspace(workspace_id: int, request: Request, authorization: str | None = Header(default=None)):
+    user = require_scope("write")(request, authorization)
+    _v2_rate_check(request, user)
+    with get_conn() as conn:
+        row = conn.execute("SELECT * FROM workspaces WHERE id=?", (workspace_id,)).fetchone()
+        if not row:
+            raise HTTPException(404, "Workspace not found")
+        if row["owner_id"] != user["id"] and not user.get("is_admin"):
+            raise HTTPException(403, "Only owner can delete workspace")
+        conn.execute("DELETE FROM workspaces WHERE id=?", (workspace_id,))
+        conn.commit()
+    audit_log(user, "workspace.delete", "workspace", workspace_id, "", request)
+    return {"id": workspace_id, "status": "deleted"}
+
+
+@router.get("/workspaces/{workspace_id}/members")
+def list_workspace_members(workspace_id: int, request: Request, authorization: str | None = Header(default=None)):
+    user = get_bearer_user(request, authorization)
+    _v2_rate_check(request, user)
+    with get_conn() as conn:
+        ws = conn.execute("SELECT id FROM workspaces WHERE id=?", (workspace_id,)).fetchone()
+        if not ws:
+            raise HTTPException(404, "Workspace not found")
+        rows = conn.execute("SELECT u.id, u.login, u.full_name, u.avatar_url, wm.role, wm.joined_at FROM workspace_members wm JOIN users u ON u.id=wm.user_id WHERE wm.workspace_id=? ORDER BY wm.joined_at", (workspace_id,)).fetchall()
+    return {"members": [row_to_dict(r) for r in rows]}
+
+
+@router.post("/workspaces/{workspace_id}/members")
+def invite_member(workspace_id: int, request: Request, authorization: str | None = Header(default=None), body: dict = Body(default={})):
+    user = require_scope("write")(request, authorization)
+    _v2_rate_check(request, user)
+    target_id = body.get("user_id") or body.get("uid")
+    email = (body.get("email") or "").strip()
+    role = (body.get("role") or "editor").strip().lower()
+    if role not in ("owner", "admin", "editor", "viewer", "commenter"):
+        raise HTTPException(400, "Invalid role")
+    with get_conn() as conn:
+        ws = conn.execute("SELECT owner_id FROM workspaces WHERE id=?", (workspace_id,)).fetchone()
+        if not ws:
+            raise HTTPException(404, "Workspace not found")
+        # only owner/admin can invite
+        if ws["owner_id"] != user["id"] and not user.get("is_admin"):
+            mem = conn.execute("SELECT role FROM workspace_members WHERE workspace_id=? AND user_id=?", (workspace_id, user["id"])).fetchone()
+            if not mem or mem["role"] not in ("owner", "admin"):
+                raise HTTPException(403, "Only owner/admin can invite")
+        uid = target_id
+        if not uid and email:
+            u = conn.execute("SELECT id FROM users WHERE email=?", (email,)).fetchone()
+            if not u:
+                raise HTTPException(404, f"User with email {email} not found")
+            uid = u["id"]
+        if not uid:
+            raise HTTPException(400, "user_id or email required")
+        try:
+            conn.execute("INSERT INTO workspace_members (workspace_id, user_id, role) VALUES (?, ?, ?)", (workspace_id, uid, role))
+        except Exception:
+            conn.execute("UPDATE workspace_members SET role=? WHERE workspace_id=? AND user_id=?", (role, workspace_id, uid))
+        conn.commit()
+    audit_log(user, "workspace.invite", "workspace", workspace_id, f"uid={uid} role={role}", request)
+    return {"workspace_id": workspace_id, "user_id": uid, "role": role, "status": "added"}
+
+
+@router.patch("/workspaces/{workspace_id}/members/{uid}")
+def update_member_role(workspace_id: int, uid: int, request: Request, authorization: str | None = Header(default=None), body: dict = Body(default={})):
+    user = require_scope("write")(request, authorization)
+    _v2_rate_check(request, user)
+    role = (body.get("role") or "").strip().lower()
+    if role not in ("owner", "admin", "editor", "viewer", "commenter"):
+        raise HTTPException(400, "Invalid role")
+    with get_conn() as conn:
+        ws = conn.execute("SELECT owner_id FROM workspaces WHERE id=?", (workspace_id,)).fetchone()
+        if not ws:
+            raise HTTPException(404, "Workspace not found")
+        if ws["owner_id"] != user["id"] and not user.get("is_admin"):
+            mem = conn.execute("SELECT role FROM workspace_members WHERE workspace_id=? AND user_id=?", (workspace_id, user["id"])).fetchone()
+            if not mem or mem["role"] not in ("owner", "admin"):
+                raise HTTPException(403, "Only owner/admin can change roles")
+        conn.execute("UPDATE workspace_members SET role=? WHERE workspace_id=? AND user_id=?", (role, workspace_id, uid))
+        if conn.total_changes == 0:
+            raise HTTPException(404, "Member not found")
+        conn.commit()
+    audit_log(user, "workspace.role_change", "workspace", workspace_id, f"uid={uid} role={role}", request)
+    return {"workspace_id": workspace_id, "user_id": uid, "role": role, "status": "updated"}
+
+
+@router.delete("/workspaces/{workspace_id}/members/{uid}")
+def remove_member(workspace_id: int, uid: int, request: Request, authorization: str | None = Header(default=None)):
+    user = require_scope("write")(request, authorization)
+    _v2_rate_check(request, user)
+    with get_conn() as conn:
+        ws = conn.execute("SELECT owner_id FROM workspaces WHERE id=?", (workspace_id,)).fetchone()
+        if not ws:
+            raise HTTPException(404, "Workspace not found")
+        if ws["owner_id"] != user["id"] and not user.get("is_admin"):
+            mem = conn.execute("SELECT role FROM workspace_members WHERE workspace_id=? AND user_id=?", (workspace_id, user["id"])).fetchone()
+            if not mem or mem["role"] not in ("owner", "admin"):
+                raise HTTPException(403, "Only owner/admin can remove members")
+        conn.execute("DELETE FROM workspace_members WHERE workspace_id=? AND user_id=?", (workspace_id, uid))
+        conn.commit()
+    audit_log(user, "workspace.remove_member", "workspace", workspace_id, f"uid={uid}", request)
+    return {"workspace_id": workspace_id, "user_id": uid, "status": "removed"}

app/routers/api_v2_agent.py

@@ -0,0 +1,657 @@
+"""FlowDeck — Public API v2 : Agent & Skill marketplace (v6.6.0, phase 5).
+
+Thin Bearer+scopes wrappers over the existing agent logic (AgentEngine,
+`agent_skills`, the gallery service) so third-party integrations can drive
+FlowDeck Agent without a browser session:
+
+* ``/api/v2/agents`` — agents CRUD, conversations, synchronous runs (JSON,
+  the SSE stream stays an internal/UI concern), audit journal & rollback.
+* ``/api/v2/skills`` — the skill marketplace: CRUD, portable export/import and
+  the built-in gallery of installable presets.
+
+Rules honoured (see docs/API_GUIDE_V6.md): one code path (the engine and the
+gallery service are reused, never re-implemented), JSON only, no secrets or
+internal columns, rate limit + audit + idempotency on every mutation.
+"""
+from __future__ import annotations
+
+import json
+import time
+
+from fastapi import APIRouter, Header, HTTPException, Request
+from fastapi.responses import JSONResponse
+
+from app.db import get_conn
+from app.routers.agent import _default_agent
+from app.services import skill_gallery
+from app.services.agent_engine import AgentEngine, undo_action
+from app.services.api_v2_helpers import (
+    audit_log,
+    check_idempotency,
+    check_v2_rate_limit,
+    get_bearer_user,
+    has_scope,
+    paginate_headers,
+    parse_pagination,
+    row_to_dict,
+    store_idempotency,
+)
+from app.services.llm_client import LLMClient
+from app.services.llm_config import get_user_llm_key
+
+router = APIRouter(prefix="/api/v2", tags=["api-v2-agent"])
+
+
+# ── Shared guards ──────────────────────────────────────────────────────────
+
+def _guard(request: Request, authorization: str | None, *, write: bool = False) -> dict:
+    """Bearer auth + per-token rate limit (+ write scope when required)."""
+    user = get_bearer_user(request, authorization)
+    ip = request.client.host if request.client else "unknown"
+    if not check_v2_rate_limit(user.get("_token_hash"), ip):
+        raise HTTPException(429, "Rate limit exceeded: 300 req/min per token")
+    if write and not has_scope(user.get("_token_scopes"), "write"):
+        raise HTTPException(403, "Insufficient scope. Required: write")
+    return user
+
+
+async def _json_body(request: Request) -> dict:
+    try:
+        body = await request.json()
+    except Exception:  # noqa: BLE001
+        return {}
+    return body if isinstance(body, dict) else {}
+
+
+def _workspace_of(request: Request, body: dict | None = None) -> int | None:
+    """Workspace resolution mirrors the internal agent router: explicit param
+    wins, then the token's own workspace, else NULL (shared/global scope)."""
+    body = body or {}
+    raw = body.get("workspace_id") or request.query_params.get("workspace_id")
+    if raw is None:
+        return None
+    try:
+        return int(raw)
+    except (TypeError, ValueError):
+        return None
+
+
+def _owned_conversation(conn, conversation_id: int, user_id: int):
+    """Conversation visible to this token's user (ownership is enforced here,
+    unlike the session router where the browser is already authenticated)."""
+    return conn.execute(
+        "SELECT * FROM agent_conversations WHERE id=? AND user_id=?",
+        (conversation_id, user_id),
+    ).fetchone()
+
+
+def _engine_for(user_id: int, workspace_id: int | None, provider: str | None) -> AgentEngine:
+    engine = AgentEngine(user_id, workspace_id=workspace_id)
+    if provider:
+        user_key = get_user_llm_key(user_id, provider)
+        if user_key and user_key.get("api_key"):
+            engine.llm = LLMClient(
+                provider=provider,
+                api_key=user_key["api_key"],
+                api_base=user_key.get("api_base") or None,
+            )
+        else:
+            engine.llm = LLMClient(provider=provider)
+    return engine
+
+
+# ── Agents ─────────────────────────────────────────────────────────────────
+
+@router.get("/agents")
+def list_agents_v2(request: Request, authorization: str | None = Header(default=None)):
+    user = _guard(request, authorization)
+    limit, offset = parse_pagination(request)
+    ws = _workspace_of(request)
+    with get_conn() as conn:
+        _default_agent(conn, user["id"])
+        clause = "WHERE workspace_id IS ? OR workspace_id=?"
+        total = conn.execute(f"SELECT COUNT(*) FROM agents {clause}", (ws, ws)).fetchone()[0]
+        rows = conn.execute(
+            f"SELECT * FROM agents {clause} ORDER BY agent_type, name LIMIT ? OFFSET ?",
+            (ws, ws, limit, offset),
+        ).fetchall()
+    return JSONResponse(
+        content={"agents": [row_to_dict(r) for r in rows], "total": total,
+                 "limit": limit, "offset": offset},
+        headers=paginate_headers(total),
+    )
+
+
+@router.post("/agents")
+async def create_agent_v2(request: Request, authorization: str | None = Header(default=None)):
+    user = _guard(request, authorization, write=True)
+    idem = check_idempotency(request, user["id"])
+    if idem:
+        return JSONResponse(content=idem["data"], status_code=idem["status"])
+    body = await _json_body(request)
+    name = (body.get("name") or "").strip() or "Custom Agent"
+    ws = _workspace_of(request, body)
+    with get_conn() as conn:
+        try:
+            cur = conn.execute(
+                """INSERT INTO agents (workspace_id, name, icon, agent_type, description,
+                       system_instructions, model, scope_json, trigger_json, approval_mode, created_by)
+                   VALUES (?,?,?,?,?,?,?,?,?,?,?)""",
+                (ws, name, body.get("icon", "🤖"), body.get("agent_type", "custom"),
+                 body.get("description", ""), body.get("system_instructions", ""),
+                 body.get("model", "gpt-4o"),
+                 json.dumps(body.get("scope", {})), json.dumps(body.get("trigger", {})),
+                 body.get("approval_mode", "auto"), user["id"]),
+            )
+            conn.commit()
+            agent_id = cur.lastrowid
+            row = conn.execute("SELECT * FROM agents WHERE id=?", (agent_id,)).fetchone()
+        except Exception as exc:  # noqa: BLE001
+            raise HTTPException(409, f"Cannot create agent: {exc}") from exc
+    audit_log(user, "agent.create", "agent", agent_id, name, request)
+    data = {"id": agent_id, "name": name, "status": "created", "agent": row_to_dict(row)}
+    key = (request.headers.get("Idempotency-Key") or "").strip()
+    if key:
+        store_idempotency(key, user["id"], data, 201)
+    return JSONResponse(content=data, status_code=201)
+
+
+@router.get("/agents/{agent_id}")
+def get_agent_v2(agent_id: int, request: Request, authorization: str | None = Header(default=None)):
+    _guard(request, authorization)
+    with get_conn() as conn:
+        row = conn.execute("SELECT * FROM agents WHERE id=?", (agent_id,)).fetchone()
+    if not row:
+        raise HTTPException(404, "Agent not found")
+    return row_to_dict(row)
+
+
+@router.put("/agents/{agent_id}")
+async def update_agent_v2(agent_id: int, request: Request, authorization: str | None = Header(default=None)):
+    user = _guard(request, authorization, write=True)
+    body = await _json_body(request)
+    with get_conn() as conn:
+        existing = conn.execute("SELECT * FROM agents WHERE id=?", (agent_id,)).fetchone()
+        if not existing:
+            raise HTTPException(404, "Agent not found")
+        sets, params = [], []
+        for col in ("name", "icon", "description", "system_instructions", "model",
+                    "approval_mode", "is_active"):
+            if col in body:
+                sets.append(f"{col}=?")
+                params.append(body[col])
+        if "scope" in body:
+            sets.append("scope_json=?")
+            params.append(json.dumps(body["scope"]))
+        if "trigger" in body:
+            sets.append("trigger_json=?")
+            params.append(json.dumps(body["trigger"]))
+        if sets:
+            params.append(agent_id)
+            conn.execute(f"UPDATE agents SET {', '.join(sets)} WHERE id=?", params)
+            conn.commit()
+    audit_log(user, "agent.update", "agent", agent_id, "", request)
+    return {"id": agent_id, "status": "updated"}
+
+
+@router.delete("/agents/{agent_id}")
+def delete_agent_v2(agent_id: int, request: Request, authorization: str | None = Header(default=None)):
+    user = _guard(request, authorization, write=True)
+    with get_conn() as conn:
+        if not conn.execute("SELECT id FROM agents WHERE id=?", (agent_id,)).fetchone():
+            raise HTTPException(404, "Agent not found")
+        conn.execute("DELETE FROM agents WHERE id=?", (agent_id,))
+        conn.commit()
+    audit_log(user, "agent.delete", "agent", agent_id, "", request)
+    return {"id": agent_id, "status": "deleted"}
+
+
+# ── Conversations (static paths declared before /agents/{agent_id}) ────────
+
+@router.get("/agents/conversations")
+def list_conversations_v2(request: Request, authorization: str | None = Header(default=None)):
+    user = _guard(request, authorization)
+    limit, offset = parse_pagination(request)
+    with get_conn() as conn:
+        total = conn.execute(
+            "SELECT COUNT(*) FROM agent_conversations WHERE user_id=?", (user["id"],)
+        ).fetchone()[0]
+        rows = conn.execute(
+            """SELECT * FROM agent_conversations WHERE user_id=?
+               ORDER BY updated_at DESC LIMIT ? OFFSET ?""",
+            (user["id"], limit, offset),
+        ).fetchall()
+    return JSONResponse(
+        content={"conversations": [row_to_dict(r) for r in rows], "total": total,
+                 "limit": limit, "offset": offset},
+        headers=paginate_headers(total),
+    )
+
+
+@router.post("/agents/conversations")
+async def create_conversation_v2(request: Request, authorization: str | None = Header(default=None)):
+    user = _guard(request, authorization, write=True)
+    idem = check_idempotency(request, user["id"])
+    if idem:
+        return JSONResponse(content=idem["data"], status_code=idem["status"])
+    body = await _json_body(request)
+    ws = _workspace_of(request, body)
+    agent_id = body.get("agent_id")
+    with get_conn() as conn:
+        if agent_id is not None:
+            agent = conn.execute("SELECT id FROM agents WHERE id=?", (agent_id,)).fetchone()
+            if not agent:
+                raise HTTPException(404, "Agent not found")
+            agent_id = agent["id"]
+        else:
+            agent_id = _default_agent(conn, user["id"])["id"]
+        cur = conn.execute(
+            """INSERT INTO agent_conversations (agent_id, user_id, title, context_json, provider, model)
+               VALUES (?,?,?,?,?,?)""",
+            (agent_id, user["id"], body.get("title") or "New conversation",
+             json.dumps({"workspace_id": ws}),
+             body.get("provider") or "", body.get("model") or ""),
+        )
+        conv_id = cur.lastrowid
+        conn.commit()
+        row = conn.execute("SELECT * FROM agent_conversations WHERE id=?", (conv_id,)).fetchone()
+    audit_log(user, "agent.conversation.create", "agent_conversation", conv_id, "", request)
+    data = {"id": conv_id, "status": "created", "conversation": row_to_dict(row)}
+    key = (request.headers.get("Idempotency-Key") or "").strip()
+    if key:
+        store_idempotency(key, user["id"], data, 201)
+    return JSONResponse(content=data, status_code=201)
+
+
+@router.get("/agents/conversations/{conversation_id}")
+def get_conversation_v2(conversation_id: int, request: Request,
+                              authorization: str | None = Header(default=None)):
+    user = _guard(request, authorization)
+    with get_conn() as conn:
+        conv = _owned_conversation(conn, conversation_id, user["id"])
+        if not conv:
+            raise HTTPException(404, "Conversation not found")
+        messages = conn.execute(
+            "SELECT * FROM agent_messages WHERE conversation_id=? ORDER BY created_at, id",
+            (conversation_id,),
+        ).fetchall()
+    return {"conversation": row_to_dict(conv), "messages": [row_to_dict(m) for m in messages]}
+
+
+@router.delete("/agents/conversations/{conversation_id}")
+def delete_conversation_v2(conversation_id: int, request: Request,
+                                 authorization: str | None = Header(default=None)):
+    user = _guard(request, authorization, write=True)
+    with get_conn() as conn:
+        if not _owned_conversation(conn, conversation_id, user["id"]):
+            raise HTTPException(404, "Conversation not found")
+        conn.execute("DELETE FROM agent_conversations WHERE id=?", (conversation_id,))
+        conn.commit()
+    audit_log(user, "agent.conversation.delete", "agent_conversation", conversation_id, "", request)
+    return {"id": conversation_id, "status": "deleted"}
+
+
+@router.get("/agents/conversations/{conversation_id}/actions")
+def list_actions_v2(conversation_id: int, request: Request,
+                          authorization: str | None = Header(default=None)):
+    user = _guard(request, authorization)
+    with get_conn() as conn:
+        if not _owned_conversation(conn, conversation_id, user["id"]):
+            raise HTTPException(404, "Conversation not found")
+        rows = conn.execute(
+            "SELECT * FROM agent_actions WHERE conversation_id=? ORDER BY created_at, id",
+            (conversation_id,),
+        ).fetchall()
+    return {"actions": [row_to_dict(r) for r in rows]}
+
+
+@router.post("/agents/actions/{action_id}/undo")
+def undo_action_v2(action_id: int, request: Request,
+                         authorization: str | None = Header(default=None)):
+    user = _guard(request, authorization, write=True)
+    with get_conn() as conn:
+        row = conn.execute(
+            """SELECT a.id FROM agent_actions a
+               JOIN agent_conversations c ON c.id = a.conversation_id
+               WHERE a.id=? AND c.user_id=?""",
+            (action_id, user["id"]),
+        ).fetchone()
+        if not row:
+            raise HTTPException(404, "Action not found")
+    try:
+        undo_action(action_id)
+    except ValueError as exc:
+        raise HTTPException(400, str(exc)) from exc
+    except Exception as exc:  # noqa: BLE001
+        raise HTTPException(500, f"Rollback failed: {exc}") from exc
+    audit_log(user, "agent.action.undo", "agent_action", action_id, "", request)
+    return {"id": action_id, "status": "reverted"}
+
+
+# ── Runs (JSON — the SSE stream stays internal) ────────────────────────────
+
+def _collect_run_events(events: list[dict]) -> dict:
+    """Aggregate an engine event stream into a JSON run result.
+
+    Engine events are flat (``{"type": "final", "content": ...}``), the same
+    shape the SSE panel consumes.
+    """
+    final = None
+    reasoning = []
+    actions = []
+    error = None
+    for ev in events:
+        etype = ev.get("type")
+        if etype == "final":
+            final = ev.get("content") or final
+        elif etype == "reasoning":
+            reasoning.append(ev.get("content") or "")
+        elif etype == "action":
+            actions.append({k: v for k, v in ev.items() if k != "type"})
+        elif etype == "error":
+            error = ev.get("message") or "run failed"
+    return {
+        "status": "failed" if error else "completed",
+        "final": final,
+        "error": error,
+        "reasoning": reasoning,
+        "actions": actions,
+    }
+
+
+@router.post("/agents/conversations/{conversation_id}/run")
+async def run_conversation_v2(conversation_id: int, request: Request,
+                              authorization: str | None = Header(default=None)):
+    """Synchronous agent run: buffers the engine stream and returns JSON.
+
+    Third parties get one HTTP round-trip instead of an SSE subscription; the
+    same AgentEngine, permissions, journal and webhooks are used as the UI.
+    """
+    user = _guard(request, authorization, write=True)
+    idem = check_idempotency(request, user["id"])
+    if idem:
+        return JSONResponse(content=idem["data"], status_code=idem["status"])
+    body = await _json_body(request)
+    objective = (body.get("message") or body.get("objective") or "").strip()
+    if not objective:
+        raise HTTPException(400, "message is required")
+
+    with get_conn() as conn:
+        conv = _owned_conversation(conn, conversation_id, user["id"])
+        if not conv:
+            raise HTTPException(404, "Conversation not found")
+        eff_provider = body.get("provider") or conv["provider"] or None
+        eff_model = body.get("model") or conv["model"] or None
+        if body.get("provider") is not None or body.get("model") is not None:
+            conn.execute(
+                "UPDATE agent_conversations SET provider=?, model=?, updated_at=CURRENT_TIMESTAMP WHERE id=?",
+                (body.get("provider", conv["provider"] or ""),
+                 body.get("model", conv["model"] or ""), conversation_id),
+            )
+            conn.commit()
+        conv_context = {}
+        try:
+            conv_context = json.loads(conv["context_json"] or "{}") or {}
+        except (TypeError, ValueError):
+            conv_context = {}
+
+    ws = _workspace_of(request, body)
+    if ws is None:
+        ws = conv_context.get("workspace_id")
+
+    engine = _engine_for(user["id"], ws, eff_provider)
+    started = time.time()
+    events = [
+        ev async for ev in engine.run(
+            conversation_id, objective,
+            model=eff_model,
+            mentions=body.get("mentions"),
+            files=body.get("files"),
+            skill_id=body.get("skill_id"),
+            skill_ids=body.get("skill_ids"),
+            extra_context=body.get("context"),
+        )
+    ]
+    result = _collect_run_events(events)
+    with get_conn() as conn:
+        actions = conn.execute(
+            "SELECT * FROM agent_actions WHERE conversation_id=? ORDER BY created_at, id",
+            (conversation_id,),
+        ).fetchall()
+    payload = {
+        "conversation_id": conversation_id,
+        "status": result["status"],
+        "final": result["final"],
+        "error": result["error"],
+        "reasoning": result["reasoning"],
+        "actions": [row_to_dict(a) for a in actions],
+        "events": events,
+        "duration_ms": int((time.time() - started) * 1000),
+    }
+    audit_log(user, "agent.run", "agent_conversation", conversation_id, objective[:200], request)
+    status_code = 200 if result["status"] == "completed" else 500
+    data = payload
+    key = (request.headers.get("Idempotency-Key") or "").strip()
+    if key:
+        store_idempotency(key, user["id"], data, status_code)
+    return JSONResponse(content=data, status_code=status_code)
+
+
+@router.post("/agents/{agent_id}/trigger")
+async def trigger_agent_v2(agent_id: int, request: Request,
+                           authorization: str | None = Header(default=None)):
+    """Fire a custom agent from an external integration (JSON, synchronous)."""
+    user = _guard(request, authorization, write=True)
+    body = await _json_body(request)
+    ws = _workspace_of(request, body)
+    with get_conn() as conn:
+        agent = conn.execute("SELECT * FROM agents WHERE id=?", (agent_id,)).fetchone()
+        if not agent:
+            raise HTTPException(404, "Agent not found")
+        cur = conn.execute(
+            """INSERT INTO agent_conversations (agent_id, user_id, title, context_json)
+               VALUES (?,?,?,?)""",
+            (agent_id, user["id"], f"Run: {agent['name']}", json.dumps({"workspace_id": ws})),
+        )
+        conv_id = cur.lastrowid
+        conn.commit()
+
+    objective = (agent["system_instructions"] or "").strip() or f"Exécute l'agent « {agent['name']} »."
+    if body.get("message"):
+        objective = f"{objective}\n\n{body['message']}"
+    engine = _engine_for(user["id"], ws, agent["model"] or None)
+    started = time.time()
+    events = [ev async for ev in engine.run(conv_id, objective, model=agent["model"])]
+    result = _collect_run_events(events)
+    payload = {
+        "conversation_id": conv_id,
+        "agent_id": agent_id,
+        "status": result["status"],
+        "final": result["final"],
+        "error": result["error"],
+        "reasoning": result["reasoning"],
+        "actions": result["actions"],
+        "duration_ms": int((time.time() - started) * 1000),
+    }
+    audit_log(user, "agent.trigger", "agent", agent_id, objective[:200], request)
+    return JSONResponse(content=payload, status_code=200 if result["status"] == "completed" else 500)
+
+
+# ── Skill marketplace ──────────────────────────────────────────────────────
+
+@router.get("/skills")
+def list_skills_v2(request: Request, authorization: str | None = Header(default=None)):
+    _guard(request, authorization)
+    limit, offset = parse_pagination(request)
+    ws = _workspace_of(request)
+    with get_conn() as conn:
+        total = conn.execute(
+            "SELECT COUNT(*) FROM agent_skills WHERE workspace_id IS ? OR workspace_id=?",
+            (ws, ws),
+        ).fetchone()[0]
+        rows = conn.execute(
+            """SELECT * FROM agent_skills WHERE workspace_id IS ? OR workspace_id=?
+               ORDER BY name LIMIT ? OFFSET ?""",
+            (ws, ws, limit, offset),
+        ).fetchall()
+    return JSONResponse(
+        content={"skills": [row_to_dict(r) for r in rows], "total": total,
+                 "limit": limit, "offset": offset},
+        headers=paginate_headers(total),
+    )
+
+
+@router.post("/skills")
+async def create_skill_v2(request: Request, authorization: str | None = Header(default=None)):
+    user = _guard(request, authorization, write=True)
+    idem = check_idempotency(request, user["id"])
+    if idem:
+        return JSONResponse(content=idem["data"], status_code=idem["status"])
+    body = await _json_body(request)
+    ws = _workspace_of(request, body)
+    try:
+        fields = skill_gallery.parse_payload(
+            {k: body[k] for k in ("name", "description", "prompt_template", "allowed_tools")
+             if k in body} | {"format": skill_gallery.EXPORT_FORMAT}
+        )
+    except ValueError as exc:
+        raise HTTPException(400, str(exc)) from exc
+    try:
+        row, created = skill_gallery.upsert_skill(
+            fields, workspace_id=ws, created_by=user["id"],
+            overwrite=bool(body.get("overwrite")),
+        )
+    except ValueError as exc:
+        raise HTTPException(409, str(exc)) from exc
+    audit_log(user, "skill.create", "skill", row.get("id"), fields["name"], request)
+    data = {"id": row.get("id"), "name": fields["name"],
+            "status": "created" if created else "updated", "skill": row_to_dict(row) if row else {}}
+    key = (request.headers.get("Idempotency-Key") or "").strip()
+    if key:
+        store_idempotency(key, user["id"], data, 201 if created else 200)
+    return JSONResponse(content=data, status_code=201 if created else 200)
+
+
+# Gallery & import are static segments: declared before /skills/{skill_id} so
+# FastAPI never tries to coerce "gallery" into an int path parameter.
+@router.get("/skills/gallery")
+def skills_gallery_v2(request: Request, authorization: str | None = Header(default=None)):
+    _guard(request, authorization)
+    presets = skill_gallery.list_gallery()
+    return {"gallery": presets, "total": len(presets),
+            "install": "POST /api/v2/skills/gallery/{slug}/install"}
+
+
+@router.post("/skills/gallery/{slug}/install")
+async def install_gallery_skill_v2(slug: str, request: Request,
+                                   authorization: str | None = Header(default=None)):
+    user = _guard(request, authorization, write=True)
+    preset = skill_gallery.get_gallery(slug)
+    if not preset:
+        raise HTTPException(404, f"Unknown gallery skill: {slug}")
+    body = await _json_body(request)
+    ws = _workspace_of(request, body)
+    try:
+        row, created = skill_gallery.upsert_skill(
+            skill_gallery.parse_payload(preset),
+            workspace_id=ws, created_by=user["id"],
+            overwrite=bool(body.get("overwrite", True)),
+        )
+    except ValueError as exc:
+        raise HTTPException(409, str(exc)) from exc
+    audit_log(user, "skill.gallery.install", "skill", row.get("id"), slug, request)
+    data = {"slug": slug, "id": row.get("id"), "name": row.get("name"),
+            "status": "installed" if created else "updated", "skill": row_to_dict(row)}
+    return JSONResponse(content=data, status_code=201 if created else 200)
+
+
+@router.post("/skills/import")
+async def import_skill_v2(request: Request, authorization: str | None = Header(default=None)):
+    """Import a portable skill document (from another FlowDeck instance)."""
+    user = _guard(request, authorization, write=True)
+    idem = check_idempotency(request, user["id"])
+    if idem:
+        return JSONResponse(content=idem["data"], status_code=idem["status"])
+    body = await _json_body(request)
+    payload = body.get("payload") if isinstance(body.get("payload"), dict) else body
+    try:
+        fields = skill_gallery.parse_payload(payload)
+    except ValueError as exc:
+        raise HTTPException(400, str(exc)) from exc
+    ws = _workspace_of(request, body)
+    try:
+        row, created = skill_gallery.upsert_skill(
+            fields, workspace_id=ws, created_by=user["id"],
+            overwrite=bool(body.get("overwrite")),
+        )
+    except ValueError as exc:
+        raise HTTPException(409, str(exc)) from exc
+    audit_log(user, "skill.import", "skill", row.get("id"), fields["name"], request)
+    data = {"id": row.get("id"), "name": fields["name"],
+            "status": "imported" if created else "updated", "skill": row_to_dict(row)}
+    key = (request.headers.get("Idempotency-Key") or "").strip()
+    if key:
+        store_idempotency(key, user["id"], data, 201 if created else 200)
+    return JSONResponse(content=data, status_code=201 if created else 200)
+
+
+@router.get("/skills/{skill_id}")
+def get_skill_v2(skill_id: int, request: Request, authorization: str | None = Header(default=None)):
+    _guard(request, authorization)
+    with get_conn() as conn:
+        row = conn.execute("SELECT * FROM agent_skills WHERE id=?", (skill_id,)).fetchone()
+    if not row:
+        raise HTTPException(404, "Skill not found")
+    return row_to_dict(row)
+
+
+@router.get("/skills/{skill_id}/export")
+def export_skill_v2(skill_id: int, request: Request,
+                          authorization: str | None = Header(default=None)):
+    """Portable JSON document — POST it to /api/v2/skills/import elsewhere."""
+    _guard(request, authorization)
+    with get_conn() as conn:
+        row = conn.execute("SELECT * FROM agent_skills WHERE id=?", (skill_id,)).fetchone()
+    if not row:
+        raise HTTPException(404, "Skill not found")
+    return skill_gallery.export_skill(row)
+
+
+@router.delete("/skills/{skill_id}")
+def delete_skill_v2(skill_id: int, request: Request,
+                          authorization: str | None = Header(default=None)):
+    user = _guard(request, authorization, write=True)
+    with get_conn() as conn:
+        row = conn.execute("SELECT name FROM agent_skills WHERE id=?", (skill_id,)).fetchone()
+        if not row:
+            raise HTTPException(404, "Skill not found")
+        conn.execute("DELETE FROM agent_skills WHERE id=?", (skill_id,))
+        conn.commit()
+    audit_log(user, "skill.delete", "skill", skill_id, row["name"] or "", request)
+    return {"id": skill_id, "status": "deleted"}
+
+
+@router.post("/skills/{skill_id}/apply")
+async def apply_skill_v2(skill_id: int, request: Request,
+                         authorization: str | None = Header(default=None)):
+    """Open a conversation pre-loaded with the skill (ready to run)."""
+    user = _guard(request, authorization, write=True)
+    body = await _json_body(request)
+    ws = _workspace_of(request, body)
+    with get_conn() as conn:
+        skill = conn.execute("SELECT * FROM agent_skills WHERE id=?", (skill_id,)).fetchone()
+        if not skill:
+            raise HTTPException(404, "Skill not found")
+        agent_id = _default_agent(conn, user["id"])["id"]
+        cur = conn.execute(
+            """INSERT INTO agent_conversations (agent_id, user_id, title, context_json)
+               VALUES (?,?,?,?)""",
+            (agent_id, user["id"], skill["name"],
+             json.dumps({"workspace_id": ws if ws is not None else skill["workspace_id"],
+                         "skill_id": skill_id})),
+        )
+        conv_id = cur.lastrowid
+        conn.commit()
+    audit_log(user, "skill.apply", "skill", skill_id, skill["name"], request)
+    return JSONResponse(content={"conversation_id": conv_id, "skill": skill["name"],
+                                 "status": "ready"}, status_code=201)

app/routers/audit.py

@@ -0,0 +1,124 @@
+"""FlowDeck — unified audit log API (v7.2.0).
+
+Merges ``api_audit_log`` + ``permission_audit_log`` + ``sso_login_history``
+with actor/resource/date filters and CSV export (10k rows max, 365-day
+retention note). Admin only. See ``docs/V72_Enterprise_SCIM_2FA.md``.
+"""
+from __future__ import annotations
+
+from fastapi import APIRouter, HTTPException, Request
+from fastapi.responses import JSONResponse, PlainTextResponse
+
+from app.auth.session import SessionManager
+from app.db import get_conn
+from app.services.api_v2_helpers import (
+    has_scope,
+    parse_pagination,
+    resolve_bearer_token,
+)
+
+router = APIRouter(tags=["audit"])
+
+
+def _admin_user(request: Request) -> dict:
+    sess = SessionManager.decode_session(request.cookies.get("flowdeck_session", ""))
+    if sess:
+        with get_conn() as conn:
+            row = conn.execute("SELECT is_admin FROM users WHERE id=?",
+                               (sess.get("id"),)).fetchone()
+        if row and row["is_admin"]:
+            return sess
+        raise HTTPException(403, "Admin required")
+    auth = request.headers.get("authorization") or request.headers.get("Authorization") or ""
+    if auth.lower().startswith("bearer "):
+        user = resolve_bearer_token(auth[7:].strip())
+        if user and user.get("is_admin") and has_scope(
+                user.get("_token_scopes") or "read", "admin"):
+            return user
+    raise HTTPException(401, "Admin authentication required")
+
+
+def _query(source: str, actor: str, action: str, limit: int, offset: int):
+    """One source query → (rows, columns). All normalized to a common shape."""
+    with get_conn() as conn:
+        if source in ("api", "all"):
+            rows = conn.execute(
+                """SELECT created_at AS at, user_id AS actor, action,
+                          resource_type || ':' || resource_id AS resource,
+                          ip_address AS ip, detail, 'api' AS source
+                   FROM api_audit_log
+                   WHERE (?='' OR CAST(user_id AS TEXT)=?)
+                     AND (?='' OR action LIKE ?)
+                   ORDER BY id DESC LIMIT ? OFFSET ?""",
+                (actor, actor, action, f"%{action}%" if action else "%", limit, offset)
+            ).fetchall()
+            if source == "api":
+                return rows
+            api = [dict(r) for r in rows]
+        else:
+            api = []
+        if source in ("permissions", "all"):
+            rows = conn.execute(
+                """SELECT created_at AS at, performed_by AS actor, action,
+                          resource_type || ':' || resource_id AS resource,
+                          ip_address AS ip,
+                          ('target=' || COALESCE(target_user_id, target_group_id, '')
+                           || ' ' || COALESCE(old_role,'') || '→' || COALESCE(new_role,'')) AS detail,
+                          'permissions' AS source
+                   FROM permission_audit_log
+                   WHERE (?='' OR CAST(performed_by AS TEXT)=?)
+                     AND (?='' OR action LIKE ?)
+                   ORDER BY id DESC LIMIT ? OFFSET ?""",
+                (actor, actor, action, f"%{action}%" if action else "%", limit, offset)
+            ).fetchall()
+            if source == "permissions":
+                return rows
+            perm = [dict(r) for r in rows]
+        else:
+            perm = []
+        if source in ("sso", "all"):
+            rows = conn.execute(
+                """SELECT created_at AS at, user_id AS actor,
+                          ('sso_' || provider_type || '_' ||
+                            CASE success WHEN 1 THEN 'success' ELSE 'failure' END) AS action,
+                          provider_name AS resource, ip_address AS ip,
+                          COALESCE(error_message, sso_identifier, '') AS detail,
+                          'sso' AS source
+                   FROM sso_login_history
+                   WHERE (?='' OR CAST(user_id AS TEXT)=?)
+                   ORDER BY id DESC LIMIT ? OFFSET ?""",
+                (actor, actor, limit, offset)).fetchall()
+            if source == "sso":
+                return rows
+            sso = [dict(r) for r in rows]
+        else:
+            sso = []
+    merged = sorted(api + perm + sso, key=lambda d: str(d.get("at") or ""),
+                    reverse=True)
+    return merged[:limit]
+
+
+@router.get("/api/v2/audit/logs")
+def audit_logs(request: Request):
+    _admin_user(request)
+    qp = request.query_params
+    source = (qp.get("source") or "all").lower()
+    if source not in ("all", "api", "permissions", "sso"):
+        raise HTTPException(400, "source must be all|api|permissions|sso")
+    limit, offset = parse_pagination(request, default_limit=50, max_limit=500)
+    rows = _query(source, qp.get("actor") or "", qp.get("action") or "", limit, offset)
+    rows = [dict(r) if not isinstance(r, dict) else r for r in rows]
+    if qp.get("format") == "csv":
+        import csv
+        import io
+        buf = io.StringIO()
+        writer = csv.DictWriter(buf, fieldnames=["at", "source", "actor", "action",
+                                                 "resource", "ip", "detail"])
+        writer.writeheader()
+        for r in rows[:10000]:
+            writer.writerow({k: r.get(k, "") for k in writer.fieldnames})
+        return PlainTextResponse(buf.getvalue(), media_type="text/csv",
+                                 headers={"Content-Disposition":
+                                          "attachment; filename=audit.csv"})
+    return JSONResponse(content={"logs": rows, "source": source,
+                                 "limit": limit, "offset": offset})

app/routers/auth.py

@@ -4,41 +4,355 @@ from __future__ import annotations
 import logging
 import secrets
 
-from fastapi import APIRouter, Request, Query
-from fastapi.responses import RedirectResponse, HTMLResponse
+from fastapi import APIRouter, Body, Query, Request
+from fastapi.responses import HTMLResponse, RedirectResponse
 
 from app.auth.session import SessionManager
-from app.auth.oauth import gitea_oauth
 from app.config import settings
+from app.templating import CSP_NONCE
 
 logger = logging.getLogger(__name__)
 router = APIRouter(tags=["auth"], prefix="/auth")
 
 
+def get_redirect_uri(request: Request) -> str:
+    """OAuth redirect URI for this request.
+
+    Explicit `OAUTH_REDIRECT_URI` env override wins (must be registered in the
+    provider's OAuth app). Otherwise it is derived from the request so it always
+    matches the URL the user actually used: scheme from `X-Forwarded-Proto`
+    (reverse proxies) falling back to the request scheme, host from
+    `X-Forwarded-Host` falling back to the `Host` header.
+    """
+    if settings.oauth_redirect_uri:
+        return settings.oauth_redirect_uri
+    proto = request.headers.get("x-forwarded-proto", "")
+    scheme = proto.split(",")[0].strip() or request.url.scheme or "http"
+    fwd_host = request.headers.get("x-forwarded-host", "")
+    host = fwd_host.split(",")[0].strip() or request.headers.get("host", "localhost:8080")
+    return f"{scheme}://{host}/auth/callback"
+
+def _with_nonce(html: str) -> str:
+    """A20 : injecte le nonce CSP au moment du rendu.
+
+    `LOCAL_LOGIN_HTML` est une constante de module — le nonce, lui, est par
+    requête, donc il ne peut être figé qu'ici.
+    """
+    return html.replace("<script>", f'<script nonce="{CSP_NONCE.get()}">', 1)
+
+
+LOCAL_LOGIN_HTML = """<!DOCTYPE html>
+<html lang="en">
+<head>
+<meta charset="UTF-8">
+<meta name="viewport" content="width=device-width, initial-scale=1.0">
+<title>FlowDeck — Login</title>
+<style>
+*{margin:0;padding:0;box-sizing:border-box;}
+body{background:#191919;color:#fff;font-family:-apple-system,BlinkMacSystemFont,'Segoe UI',sans-serif;display:flex;align-items:center;justify-content:center;min-height:100vh;}
+.login-box{background:#222;border:1px solid rgba(255,255,255,.08);border-radius:12px;padding:40px;width:100%;max-width:400px;}
+.login-box h1{font-size:24px;margin-bottom:8px;}
+.login-box p{color:rgba(255,255,255,.5);font-size:14px;margin-bottom:24px;}
+.form-group{margin-bottom:16px;}
+.form-group label{display:block;font-size:13px;color:rgba(255,255,255,.6);margin-bottom:6px;}
+.form-group input{width:100%;padding:10px 36px 10px 12px;background:#2A2A2A;border:1px solid rgba(255,255,255,.1);border-radius:8px;color:#fff;font-size:14px;outline:none;}
+.pw-wrapper{position:relative;}
+.pw-toggle{position:absolute;right:8px;top:50%;transform:translateY(-50%);background:none;border:none;color:rgba(255,255,255,.4);cursor:pointer;font-size:16px;padding:4px;line-height:1;}
+.pw-toggle:hover{color:rgba(255,255,255,.8);}
+.form-group input:focus{border-color:#2383E2;box-shadow:0 0 0 1px #2383E2;}
+.btn{width:100%;padding:12px;border:none;border-radius:8px;font-size:14px;font-weight:500;cursor:pointer;margin-top:8px;}
+.btn-primary{background:#2383E2;color:#fff;}
+.btn-primary:hover{background:#2C8CEB;}
+.btn-secondary{background:#333;color:#fff;margin-top:12px;}
+.btn-secondary:hover{background:#444;}
+.tabs{display:flex;gap:0;margin-bottom:24px;border-bottom:1px solid rgba(255,255,255,.08);}
+.tab{flex:1;text-align:center;padding:12px;cursor:pointer;font-size:14px;color:rgba(255,255,255,.5);border-bottom:2px solid transparent;background:none;border-top:none;border-left:none;border-right:none;}
+.tab.active{color:#fff;border-bottom-color:#2383E2;}
+.error{background:rgba(255,80,80,.15);color:#ff5050;padding:10px;border-radius:8px;font-size:13px;margin-bottom:12px;display:none;}
+.success{background:rgba(80,255,80,.15);color:#50ff50;padding:10px;border-radius:8px;font-size:13px;margin-bottom:12px;display:none;}
+.oauth-section{margin-top:20px;border-top:1px solid rgba(255,255,255,.08);padding-top:20px;}
+.oauth-btn{display:flex;align-items:center;justify-content:center;gap:8px;width:100%;padding:10px;border-radius:8px;font-size:14px;cursor:pointer;border:1px solid rgba(255,255,255,.12);background:#2A2A2A;color:#fff;}
+.oauth-btn:hover{background:#333;}
+.sso-btn{border-color:rgba(35,131,226,.5);}
+</style>
+</head>
+<body>
+<div class="login-box">
+  <h1>FlowDeck</h1>
+  <p>Login or create an account to continue</p>
+  <div class="tabs">
+    <button class="tab active" onclick="switchTab('login')" id="tab-login">Login</button>
+    <button class="tab" onclick="switchTab('register')" id="tab-register">Register</button>
+  </div>
+  <div id="expired-msg" class="success" style="display:none">⚠️ Your session has expired. Please log in again.</div>
+  <div id="error-msg" class="error"></div>
+  <div id="success-msg" class="success"></div>
+  <form id="login-form" onsubmit="handleLogin(event)">
+    <div class="form-group"><label>Email or username</label><input type="text" id="email" required autocomplete="username"></div>
+    <div class="form-group">
+      <label>Password</label>
+      <div class="pw-wrapper">
+        <input type="password" id="password" required minlength="6" autocomplete="current-password">
+        <button type="button" class="pw-toggle" onclick="togglePassword()" title="Show password">👁</button>
+      </div>
+    </div>
+    <div class="form-group" id="name-group" style="display:none"><label>Name</label><input type="text" id="name"></div>
+    <button type="submit" class="btn btn-primary" id="submit-btn">Login</button>
+  </form>
+  <div class="oauth-section" id="oauth-section">
+    <p style="font-size:13px;color:rgba(255,255,255,.4);margin-bottom:8px;">Or continue with</p>
+    <button class="oauth-btn" onclick="window.location='/auth/login?provider=gitea'" style="margin-bottom:8px">🔗 <span id="gitea-btn-label">Login</span> with Gitea</button>
+    <button class="oauth-btn" onclick="window.location='/auth/login?provider=github'">🐙 <span id="github-btn-label">Login</span> with GitHub</button>
+  </div>
+  <!-- SSO / SAML + OIDC (v6.7.0) — buttons injected by loadSsoProviders() -->
+  <div class="oauth-section" id="sso-section" style="display:none">
+    <p id="sso-divider" style="font-size:13px;color:rgba(255,255,255,.4);margin-bottom:8px;">Or continue with</p>
+    <div id="sso-buttons"></div>
+    <p id="sso-only-note" style="display:none;font-size:12px;color:rgba(255,255,255,.45);margin-top:12px;line-height:1.5;">This instance only accepts your organization account — local login is disabled.</p>
+  </div>
+</div>
+<script>
+// Show session expired banner if ?expired=1 in URL
+(function(){if(location.search.includes('expired=1')){var el=document.getElementById('expired-msg');if(el)el.style.display='block';}})();
+let mode='login';
+function switchTab(t){mode=t;document.querySelectorAll('.tab').forEach(el=>el.classList.remove('active'));document.getElementById('tab-'+t).classList.add('active');document.getElementById('name-group').style.display=t==='register'?'block':'none';document.getElementById('submit-btn').textContent=t==='register'?'Register':'Login';document.getElementById('error-msg').style.display='none';document.getElementById('success-msg').style.display='none';var lbl=t==='register'?'Register':'Login';var e1=document.getElementById('gitea-btn-label');var e2=document.getElementById('github-btn-label');if(e1)e1.textContent=lbl;if(e2)e2.textContent=lbl;}
+function togglePassword(){var pw=document.getElementById('password');var btn=pw.parentElement.querySelector('.pw-toggle');if(pw.type==='password'){pw.type='text';btn.textContent='🙈';}else{pw.type='password';btn.textContent='👁';}}
+async function handleLogin(e){e.preventDefault();const email=document.getElementById('email').value;const password=document.getElementById('password').value;const name=document.getElementById('name').value;const url=mode==='register'?'/auth/register':'/auth/local-login';const body={email,password};if(mode==='register')body.name=name;try{const r=await fetch(url,{method:'POST',headers:{'Content-Type':'application/json'},body:JSON.stringify(body)});const d=await r.json();if(!r.ok){document.getElementById('error-msg').textContent=d.error||'Error';document.getElementById('error-msg').style.display='block';return;}if(d.status==='ok'){window.location='/workspaces';}}catch(err){document.getElementById('error-msg').textContent='Network error';document.getElementById('error-msg').style.display='block';}}
+// SSO buttons (v6.7.0) — rendered from /api/v2/sso/providers
+(async function loadSsoProviders(){
+  try{
+    const r = await fetch('/api/v2/sso/providers');
+    if(!r.ok) return;
+    const d = await r.json();
+    const providers = d.providers || [];
+    if(!providers.length) return;
+    const wrap = document.getElementById('sso-buttons');
+    providers.forEach(function(p){
+      const b = document.createElement('button');
+      b.className = 'oauth-btn sso-btn';
+      b.style.marginBottom = '8px';
+      b.title = 'Sign in with ' + (p.name || 'SSO');
+      b.onclick = function(){ window.location = p.login_url; };
+      const icon = document.createElement('span'); icon.textContent = p.icon || '🏢';
+      const label = document.createElement('span');
+      label.textContent = (mode === 'register' ? 'Sign up' : 'Login') + ' with ' + (p.name || 'SSO');
+      b.appendChild(icon); b.appendChild(label);
+      wrap.appendChild(b);
+    });
+    document.getElementById('sso-section').style.display = 'block';
+    if(d.sso_only){
+      // Local auth is refused server-side too — don't show a dead form.
+      const form = document.getElementById('login-form'); if(form) form.style.display = 'none';
+      const tabs = document.querySelector('.tabs'); if(tabs) tabs.style.display = 'none';
+      const oauth = document.getElementById('oauth-section'); if(oauth) oauth.style.display = 'none';
+      const note = document.getElementById('sso-only-note'); if(note) note.style.display = 'block';
+      const intro = document.querySelector('.login-box p'); if(intro) intro.textContent = 'Sign in with your organization account to continue';
+    }
+  }catch(e){}
+})();
+</script>
+</body>
+</html>"""
+
+
+@router.get("/register")
+def register_page(request: Request):
+    """Show the registration page (local login page with register tab active)."""
+    return HTMLResponse(_with_nonce(LOCAL_LOGIN_HTML.replace(
+        'class="tab active" onclick="switchTab(\'login\')"',
+        'class="tab" onclick="switchTab(\'login\')"'
+    ).replace(
+        'class="tab" onclick="switchTab(\'register\')"',
+        'class="tab active" onclick="switchTab(\'register\')"'
+    ).replace(
+        'let mode=\'login\';',
+        'let mode=\'register\';'
+    ).replace(
+        'id="name-group" style="display:none"',
+        'id="name-group" style="display:block"'
+    ).replace(
+        'id="submit-btn">Login<',
+        'id="submit-btn">Register<'
+    )), status_code=200)
+
+
 @router.get("/login")
-async def login(request: Request):
-    """Redirect to Gitea OAuth2 authorize page."""
-    if not gitea_oauth.enabled:
-        # Fallback: use global token, create a fake session
-        from app.db import get_conn
-        with get_conn() as conn:
-            user = conn.execute("SELECT * FROM users WHERE login='admin'").fetchone()
-            if not user:
-                conn.execute("INSERT INTO users (login, full_name, email, avatar_url) VALUES ('admin', 'Admin', '', '')")
-                conn.commit()
-                user = conn.execute("SELECT * FROM users WHERE login='admin'").fetchone()
-        user_data = dict(user)
-        session = SessionManager.create_session(user_data)
-        response = RedirectResponse(url="/", status_code=302)
-        response.set_cookie("flowdeck_session", session, httponly=True, max_age=86400 * 7, samesite="lax")
-        return response
+def login(request: Request, provider: str = Query("gitea")):
+    """Redirect to OAuth2 authorize page or show local login page."""
+    # Local login page (POST handled by /auth/local-login)
+    from fastapi.responses import HTMLResponse
+    if provider == "local":
+        return HTMLResponse(_with_nonce(LOCAL_LOGIN_HTML), status_code=200)
+
+    # OAuth flow — check if provider is configured
+    from app.auth.providers import get_provider
+    oauth_provider = get_provider(provider)
+    if not oauth_provider:
+        # OAuth provider not configured — show error instead of auto-creating admin
+        return HTMLResponse(
+            f"""<!DOCTYPE html><html><head><title>FlowDeck</title><style>
+            body{{background:#191919;color:#fff;font-family:sans-serif;display:flex;align-items:center;justify-content:center;min-height:100vh;text-align:center;}}
+            .box{{background:#222;border:1px solid rgba(255,255,255,.08);border-radius:12px;padding:40px;max-width:420px;}}
+            h1{{font-size:20px;margin-bottom:12px;}}p{{color:rgba(255,255,255,.5);font-size:14px;margin-bottom:16px;}}
+            a{{color:#2383E2;}}
+            </style></head><body><div class="box">
+            <h1>⚠️ {provider.title()} OAuth not configured</h1>
+            <p>The {provider} integration has not been set up by the server administrator.</p>
+            <p><a href="/auth/login?provider=local">↩ Use local login</a></p>
+            </div></body></html>""",
+            status_code=200,
+        )
 
     state = secrets.token_hex(32)
     request.session["oauth_state"] = state
-    auth_url = gitea_oauth.get_authorize_url(state)
+    request.session["oauth_provider"] = provider
+    # Link mode: connect OAuth to current local account instead of creating new user
+    mode = request.query_params.get("mode", "")
+    # Encode auth mode in state to survive session loss during OAuth redirect
+    signed_state = f"{state}:{mode}" if mode else state
+    request.session["oauth_mode"] = mode
+    # Redirect URI derived from the incoming request (scheme-aware); stored in
+    # session so the callback reuses the EXACT same URI for token exchange
+    redirect_uri = get_redirect_uri(request)
+    request.session["oauth_redirect_uri"] = redirect_uri
+    auth_url = oauth_provider.get_authorize_url(signed_state, redirect_uri=redirect_uri, force_login=(mode == "link"))
     return RedirectResponse(url=auth_url, status_code=302)
 
 
+@router.post("/register")
+def register(request: Request, body: dict = Body(default={})):
+    """Register a new local account."""
+
+    from app.db import get_conn
+    from app.password_utils import hash_password
+    email = body.get("email", "").strip()
+    password = body.get("password", "").strip()
+    name = body.get("name", email.split("@")[0] if "@" in email else email)
+
+    if not email or not password:
+        from fastapi.responses import JSONResponse
+        return JSONResponse({"error": "Email and password required"}, status_code=400)
+    if len(password) < 6:
+        from fastapi.responses import JSONResponse
+        return JSONResponse({"error": "Password must be at least 6 characters"}, status_code=400)
+
+    # SSO-only instance (v6.7.0): local registration is refused — accounts are
+    # auto-provisioned by the IdP instead (admins still come from Settings).
+    from app.services.sso_provisioning import is_sso_only
+    if is_sso_only():
+        from fastapi.responses import JSONResponse
+        return JSONResponse(
+            {"error": "Registration is disabled — sign in with your organization SSO"},
+            status_code=403,
+        )
+
+    with get_conn() as conn:
+        existing = conn.execute("SELECT id FROM users WHERE login=?", (email,)).fetchone()
+        if existing:
+            from fastapi.responses import JSONResponse
+            return JSONResponse({"error": "Account already exists"}, status_code=409)
+        # First real user (excluding default admin with no password) is admin
+        real_user_count = conn.execute(
+            "SELECT COUNT(*) FROM users WHERE password_hash IS NOT NULL AND password_hash != ''"
+        ).fetchone()[0]
+        is_admin = 1 if real_user_count == 0 else 0
+        conn.execute(
+            "INSERT INTO users (login, full_name, email, password_hash, is_admin) VALUES (?, ?, ?, ?, ?)",
+            (email, name, email, hash_password(password), is_admin),
+        )
+        conn.commit()
+        user = conn.execute("SELECT * FROM users WHERE login=?", (email,)).fetchone()
+    user_data = dict(user)
+    # Log login
+    _log_login(user_data["id"], request)
+    session = SessionManager.create_session(user_data, request)
+    from fastapi.responses import JSONResponse
+    response = JSONResponse({"status": "ok", "user": {"login": email, "name": name}})
+    response.set_cookie("flowdeck_session", session, httponly=True, max_age=86400 * 7, samesite="lax", path="/")
+    return response
+
+
+@router.post("/local-login")
+def local_login(request: Request, body: dict = Body(default={})):
+    """Login with email + password."""
+    import time
+
+    from fastapi.responses import JSONResponse
+
+    from app.db import get_conn
+    from app.password_utils import is_locked, verify_password
+    email = body.get("email", "").strip()
+    password = body.get("password", "").strip()
+
+    if not email or not password:
+        return JSONResponse({"error": "Email and password required"}, status_code=400)
+
+    with get_conn() as conn:
+        user = conn.execute("SELECT * FROM users WHERE login=?", (email,)).fetchone()
+    if not user:
+        return JSONResponse({"error": "Invalid credentials"}, status_code=401)
+
+    ud = dict(user)
+    if not ud.get("is_active"):
+        return JSONResponse({"error": "Account disabled"}, status_code=403)
+    if is_locked(ud.get("locked_until")):
+        return JSONResponse({"error": "Account temporarily locked. Try again later."}, status_code=423)
+
+    if not verify_password(password, ud.get("password_hash", "")):
+        with get_conn() as conn:
+            attempts = (ud.get("login_attempts", 0) or 0) + 1
+            lock = None
+            if attempts >= 5:
+                lock = str(time.time() + 900)  # 15 min lock
+            conn.execute(
+                "UPDATE users SET login_attempts=?, locked_until=? WHERE id=?",
+                (attempts, lock, ud["id"]),
+            )
+            conn.commit()
+        return JSONResponse({"error": "Invalid credentials"}, status_code=401)
+
+    # Successful local login — SSO-only instances keep a way in for admins
+    # only (every other account must use the IdP, design §7.1).
+    from app.services.sso_provisioning import is_sso_only
+    if is_sso_only() and not ud.get("is_admin"):
+        return JSONResponse(
+            {"error": "Local login is disabled on this instance — sign in with SSO"},
+            status_code=403,
+        )
+
+    # v7.2.0: verified domain with SSO enforcement (admins keep local access).
+    if not ud.get("is_admin"):
+        with get_conn() as conn:
+            dom = (ud.get("email") or "").split("@")[-1].lower() if "@" in (ud.get("email") or "") else ""
+            if dom:
+                enforced = conn.execute(
+                    "SELECT id FROM domain_claims WHERE domain=? AND verified=1"
+                    " AND enforce_sso=1", (dom,)).fetchone()
+                if enforced:
+                    return JSONResponse(
+                        {"error": "Local login is disabled for your domain — sign in with SSO"},
+                        status_code=403)
+
+    with get_conn() as conn:
+        conn.execute(
+            "UPDATE users SET login_attempts=0, locked_until=NULL, last_login=? WHERE id=?",
+            (str(time.time()), ud["id"]),
+        )
+        conn.commit()
+
+    # v7.2.0: TOTP 2FA — password OK, but hold the session until code check.
+    from app.services import two_factor as _2fa
+    if _2fa.is_enabled(ud["id"]):
+        return JSONResponse({"status": "2fa_required",
+                             "pending": _2fa.mint_pending(ud["id"])})
+
+    session = SessionManager.create_session(ud, request)
+    _log_login(ud["id"], request)
+    response = JSONResponse({"status": "ok", "user": {"login": ud["login"], "name": ud["full_name"]}})
+    response.set_cookie("flowdeck_session", session, httponly=True, max_age=86400 * 7, samesite="lax", path="/")
+    return response
+
+
 @router.get("/callback")
 async def callback(
     request: Request,
@@ -46,13 +360,32 @@ async def callback(
     state: str = Query(...),
 ):
     """Handle OAuth2 callback from Gitea."""
-    # Validate state
+    # Recover mode from state suffix (state:mode format), then validate
     expected_state = request.session.get("oauth_state", "")
-    if not expected_state or state != expected_state:
-        return HTMLResponse("<h1>Invalid state</h1>", status_code=400)
+    provider_name = request.session.get("oauth_provider", "gitea")
 
-    # Exchange code for token
-    token_data = await gitea_oauth.exchange_code(code)
+    auth_mode = ""
+    raw_state = state
+    if ":" in state:
+        raw_state, auth_mode = state.rsplit(":", 1)
+        if auth_mode:
+            request.session["oauth_mode"] = auth_mode
+
+    # Validate: state token must match session, unless session lost and mode present
+    if expected_state and raw_state != expected_state:
+        return HTMLResponse("<h1>Invalid state</h1>", status_code=400)
+    if not expected_state and not auth_mode:
+        return HTMLResponse("<h1>Session expired — please try connecting again</h1>", status_code=400)
+
+    from app.auth.providers import get_provider
+    oauth_provider = get_provider(provider_name)
+    if not oauth_provider:
+        return HTMLResponse(f"<h1>Unknown provider: {provider_name}</h1>", status_code=400)
+
+    # Exchange code for token — reuse the redirect URI from the authorize step
+    # (stored in session), falling back to deriving it from this request
+    redirect_uri = request.session.get("oauth_redirect_uri") or get_redirect_uri(request)
+    token_data = await oauth_provider.exchange_code(code, redirect_uri=redirect_uri)
     if not token_data:
         return HTMLResponse("<h1>Token exchange failed</h1>", status_code=400)
 
@@ -61,50 +394,177 @@ async def callback(
         return HTMLResponse("<h1>No access token</h1>", status_code=400)
 
     # Get user info
-    user = await gitea_oauth.get_user(access_token)
-    if not user:
+    oauth_user = await oauth_provider.get_user(access_token)
+    if not oauth_user:
         return HTMLResponse("<h1>Failed to get user</h1>", status_code=400)
 
+    # Link mode: connect OAuth to current session user (for Settings → Integrations)
+    oauth_mode = request.session.pop("oauth_mode", "")
+    if oauth_mode == "link":
+        from app.auth.session import get_current_user as gcu
+        current = gcu(request)
+        if not current:
+            return HTMLResponse("<h1>Not logged in — please log in first</h1>", status_code=400)
+        from app.db import get_conn as _gc
+        with _gc() as conn:
+            conn.execute(
+                """INSERT OR REPLACE INTO user_oauth_tokens
+                   (user_id, provider, access_token, refresh_token, expires_at, updated_at)
+                   VALUES (?, ?, ?, ?, ?, CURRENT_TIMESTAMP)""",
+                (current["id"], provider_name, access_token, token_data.get("refresh_token"), token_data.get("expires_at")),
+            )
+            conn.commit()
+        return RedirectResponse(url="/settings#integrations", status_code=302)
+
     # Store user in DB
     from app.db import get_conn
+    login_id = f"{provider_name}_{oauth_user['login']}"
     with get_conn() as conn:
         conn.execute(
-            """INSERT INTO users (login, full_name, email, avatar_url)
-               VALUES (?, ?, ?, ?)
+            """INSERT INTO users (login, full_name, email, avatar_url, auth_method)
+               VALUES (?, ?, ?, ?, ?)
                ON CONFLICT(login)
-               DO UPDATE SET full_name=excluded.full_name, email=excluded.email, avatar_url=excluded.avatar_url""",
-            (user["login"], user.get("full_name", ""), user.get("email", ""), user.get("avatar_url", "")),
+               DO UPDATE SET full_name=excluded.full_name, email=excluded.email, avatar_url=excluded.avatar_url, auth_method=excluded.auth_method""",
+            (login_id, oauth_user.get("full_name", ""), oauth_user.get("email", ""), oauth_user.get("avatar_url", ""), provider_name),
         )
         conn.commit()
-
-    # Store token
-    SessionManager.store_token(user["id"], access_token)
-
-    # Also store user in local DB
-    with get_conn() as conn:
-        db_user = conn.execute("SELECT * FROM users WHERE login=?", (user["login"],)).fetchone()
-    user_data = dict(db_user) if db_user else user
+        # Store OAuth token
+        uid = conn.execute("SELECT id FROM users WHERE login=?", (login_id,)).fetchone()
+        if uid:
+            conn.execute(
+                """INSERT OR REPLACE INTO user_oauth_tokens
+                   (user_id, provider, access_token, refresh_token, expires_at, updated_at)
+                   VALUES (?, ?, ?, ?, ?, CURRENT_TIMESTAMP)""",
+                (uid["id"], provider_name, access_token, token_data.get("refresh_token"), token_data.get("expires_at")),
+            )
+            conn.commit()
+            user = conn.execute("SELECT * FROM users WHERE id=?", (uid["id"],)).fetchone()
+        else:
+            user = conn.execute("SELECT * FROM users WHERE login=?", (login_id,)).fetchone()
+    user_data = dict(user) if user else oauth_user
 
     # Create session
-    session = SessionManager.create_session(user_data)
-    response = RedirectResponse(url="/", status_code=302)
-    response.set_cookie("flowdeck_session", session, httponly=True, max_age=86400 * 7, samesite="lax")
+    session = SessionManager.create_session(user_data, request)
+    _log_login(user_data["id"], request)
+    response = RedirectResponse(url="/workspaces", status_code=302)
+    response.set_cookie("flowdeck_session", session, httponly=True, max_age=86400 * 7, samesite="lax", path="/")
     return response
 
 
 @router.get("/logout")
-async def logout():
-    """Clear session and redirect to dashboard."""
-    response = RedirectResponse(url="/", status_code=302)
+def logout(request: Request):
+    """Clear session and redirect to login page.
+
+    SAML sessions additionally hand over to the IdP's Single Logout when one
+    is configured (the actual cookie clearing happens on the SLO route).
+    """
+    cookie = request.cookies.get("flowdeck_session", "")
+    user = SessionManager.decode_session(cookie) if cookie else None
+    local_target = "/auth/login?provider=local"
+
+    if user and user.get("_sso_name_id"):
+        # SSO session → let /auth/saml/logout revoke locally + notify the IdP.
+        return RedirectResponse(url=f"/auth/saml/logout?next={local_target}", status_code=302)
+
+    response = RedirectResponse(url=local_target, status_code=302)
     response.delete_cookie("flowdeck_session")
     return response
 
 
 @router.get("/user")
-async def current_user(request: Request):
+def current_user(request: Request):
     """Return current user info as JSON."""
     from app.auth.session import get_current_user as gcu
-    user = await gcu(request)
+    user = gcu(request)
     if not user:
         return {"authenticated": False}
     return {"authenticated": True, "user": user}
+
+
+# ── v7.2.0 — TOTP 2FA ─────────────────────────────────────────────────────
+
+@router.post("/local-verify")
+def local_verify(request: Request, body: dict = Body(default={})):
+    """Exchange a 2FA ``pending`` token + TOTP/backup code for a session."""
+    from fastapi.responses import JSONResponse
+
+    from app.db import get_conn
+    from app.services import two_factor as _2fa
+    user_id = _2fa.redeem_pending(body.get("pending", ""))
+    if not user_id:
+        return JSONResponse({"error": "Challenge expired — log in again"}, status_code=401)
+    if not _2fa.verify_code(user_id, body.get("code", "")):
+        return JSONResponse({"error": "Invalid code"}, status_code=401)
+    with get_conn() as conn:
+        row = conn.execute("SELECT * FROM users WHERE id=?", (user_id,)).fetchone()
+        if not row or not row["is_active"]:
+            return JSONResponse({"error": "Account disabled"}, status_code=403)
+        ud = dict(row)
+    session = SessionManager.create_session(ud, request)
+    _log_login(ud["id"], request)
+    response = JSONResponse({"status": "ok", "user": {"login": ud["login"]}})
+    response.set_cookie("flowdeck_session", session, httponly=True,
+                        max_age=86400 * 7, samesite="lax", path="/")
+    return response
+
+
+def _session_user_or_401(request: Request) -> dict:
+    from fastapi import HTTPException
+    user = SessionManager.decode_session(request.cookies.get("flowdeck_session", ""))
+    if not user or not user.get("id"):
+        raise HTTPException(401, "Authentication required")
+    return user
+
+
+@router.get("/2fa/status")
+def twofa_status(request: Request):
+    from app.services import two_factor as _2fa
+    user = _session_user_or_401(request)
+    return {"enabled": _2fa.is_enabled(user["id"]),
+            "backup_remaining": _2fa.remaining_backup_codes(user["id"])}
+
+
+@router.post("/2fa/setup")
+def twofa_setup(request: Request):
+    from app.services import two_factor as _2fa
+    user = _session_user_or_401(request)
+    return _2fa.setup_secret(user["id"])
+
+
+@router.post("/2fa/activate")
+def twofa_activate(request: Request, body: dict = Body(default={})):
+    from fastapi.responses import JSONResponse
+
+    from app.services import two_factor as _2fa
+    user = _session_user_or_401(request)
+    try:
+        codes = _2fa.activate_secret(user["id"], body.get("secret", ""),
+                                     body.get("code", ""))
+    except ValueError:
+        return JSONResponse({"error": "Invalid code — secret not activated"},
+                            status_code=400)
+    return {"status": "enabled", "backup_codes": codes}
+
+
+@router.post("/2fa/disable")
+def twofa_disable(request: Request):
+    from app.services import two_factor as _2fa
+    user = _session_user_or_401(request)
+    _2fa.disable(user["id"])
+    return {"status": "disabled"}
+
+# ── Helpers ──
+def _log_login(user_id: int, request: Request):
+    """Record login in history."""
+    try:
+        from app.db import get_conn
+        ip = request.client.host if request.client else ''
+        ua = request.headers.get('user-agent', '')[:500]
+        with get_conn() as conn:
+            conn.execute(
+                "INSERT INTO login_history (user_id, ip_address, user_agent) VALUES (?, ?, ?)",
+                (user_id, ip, ua),
+            )
+            conn.commit()
+    except Exception:
+        logger.exception("_log_login")

app/routers/automations.py

@@ -0,0 +1,318 @@
+"""FlowDeck — Automations API (v5.1.0): rules CRUD, manual/button run, history."""
+from __future__ import annotations
+
+import json
+import logging
+
+from fastapi import APIRouter, Body, Depends, HTTPException, Request
+
+from app.auth.session import SessionManager
+from app.db import get_conn
+from app.services.automations import (
+    get_page_context,
+    get_steps,
+    press_button,
+    run_automation,
+    validate_step,
+)
+
+logger = logging.getLogger(__name__)
+
+
+def _require_session(request: Request) -> None:
+    """A13 : toute la route (CRUD, run, press-button) exige une session."""
+    if not SessionManager.decode_session(request.cookies.get("flowdeck_session", "")):
+        raise HTTPException(status_code=401, detail="Authentication required")
+
+
+router = APIRouter(tags=["automations"], dependencies=[Depends(_require_session)])
+
+TRIGGER_TYPES = ("event", "cron", "button")
+
+
+def _json_or_dumps(val, default="[]"):
+    """Store JSON string columns without double-encoding."""
+    if val is None:
+        return default
+    if isinstance(val, str):
+        try:
+            json.loads(val)
+            return val
+        except (TypeError, json.JSONDecodeError):
+            return json.dumps(val)
+    return json.dumps(val)
+
+
+def _current_user(request: Request) -> dict:
+    user = SessionManager.decode_session(request.cookies.get("flowdeck_session", ""))
+    return user if user and user.get("id") else {}
+
+
+def _validate_payload(body: dict) -> None:
+    name = (body.get("name") or "").strip()
+    if not name:
+        raise HTTPException(status_code=400, detail="name required")
+    trigger_type = body.get("trigger_type", "event")
+    if trigger_type not in TRIGGER_TYPES:
+        raise HTTPException(status_code=400, detail="invalid trigger_type")
+    if trigger_type == "event" and not body.get("event"):
+        raise HTTPException(status_code=400, detail="event required for event trigger")
+    if trigger_type == "cron" and not (body.get("cron_expression") or "").strip():
+        raise HTTPException(status_code=400, detail="cron_expression required for cron trigger")
+    for key in ("condition_json", "actions_json"):
+        val = body.get(key, "[]")
+        try:
+            if isinstance(val, str):
+                json.loads(val)
+            else:
+                json.dumps(val)
+        except (TypeError, json.JSONDecodeError):
+            raise HTTPException(status_code=400, detail=f"{key} must be valid JSON") from None
+
+
+@router.get("/workspace/automations")
+def list_automations(request: Request):
+    with get_conn() as conn:
+        rows = conn.execute("SELECT * FROM automations ORDER BY created_at DESC").fetchall()
+    items = [dict(r) for r in rows]
+    return {"automations": items}
+
+
+@router.post("/workspace/automations")
+def create_automation(request: Request, body: dict = Body(default={})):
+    _validate_payload(body)
+    user = _current_user(request)
+    by = user["id"]
+    with get_conn() as conn:
+        cur = conn.execute(
+            """INSERT INTO automations
+               (workspace, name, trigger_type, event, cron_expression, collection_id,
+                condition_json, actions_json, enabled, created_by)
+               VALUES (?,?,?,?,?,?,?,?,?,?)""",
+            (
+                body.get("workspace", "") or "",
+                (body.get("name") or "").strip(),
+                body.get("trigger_type", "event"),
+                body.get("event", "page.created"),
+                body.get("cron_expression", "") or "",
+                body.get("collection_id") or None,
+                _json_or_dumps(body.get("condition", body.get("condition_json", []))),
+                _json_or_dumps(body.get("actions", body.get("actions_json", []))),
+                int(body.get("enabled", True)),
+                by,
+            ),
+        )
+        conn.commit()
+        new_id = cur.lastrowid
+    return {"id": new_id, "status": "created"}
+
+
+@router.get("/workspace/automations/{auto_id}")
+def get_automation(request: Request, auto_id: int):
+    with get_conn() as conn:
+        row = conn.execute("SELECT * FROM automations WHERE id=?", (auto_id,)).fetchone()
+    if not row:
+        raise HTTPException(status_code=404, detail="Automation not found")
+    return dict(row)
+
+
+@router.put("/workspace/automations/{auto_id}")
+def update_automation(request: Request, auto_id: int, body: dict = Body(default={})):
+    _validate_payload(body)
+    with get_conn() as conn:
+        row = conn.execute("SELECT id FROM automations WHERE id=?", (auto_id,)).fetchone()
+        if not row:
+            raise HTTPException(status_code=404, detail="Automation not found")
+        conn.execute(
+            """UPDATE automations SET
+                 name=?, trigger_type=?, event=?, cron_expression=?, collection_id=?,
+                 condition_json=?, actions_json=?, enabled=?, updated_at=CURRENT_TIMESTAMP
+               WHERE id=?""",
+            (
+                (body.get("name") or "").strip(),
+                body.get("trigger_type", "event"),
+                body.get("event", "page.created"),
+                body.get("cron_expression", "") or "",
+                body.get("collection_id") or None,
+                _json_or_dumps(body.get("condition", body.get("condition_json", []))),
+                _json_or_dumps(body.get("actions", body.get("actions_json", []))),
+                int(body.get("enabled", True)),
+                auto_id,
+            ),
+        )
+        conn.commit()
+    return {"id": auto_id, "status": "updated"}
+
+
+@router.delete("/workspace/automations/{auto_id}")
+def delete_automation(request: Request, auto_id: int):
+    with get_conn() as conn:
+        conn.execute("DELETE FROM automations WHERE id=?", (auto_id,))
+        conn.commit()
+    return {"id": auto_id, "status": "deleted"}
+
+
+async def _execute(automation_id: int, trigger_source: str, body: dict) -> dict:
+    page_id = body.get("page_id") if isinstance(body, dict) else None
+    collection_id = body.get("collection_id") if isinstance(body, dict) else None
+    context = {"collection_id": collection_id, "page_id": page_id}
+    if page_id:
+        context.update(get_page_context(int(page_id), collection_id or 0))
+    result = await run_automation(automation_id, trigger_source, context)
+    result["automation_id"] = automation_id
+    return result
+
+
+@router.post("/workspace/automations/{auto_id}/run")
+async def run_automation_endpoint(request: Request, auto_id: int):
+    body = await request.json() if request.headers.get("content-type") else {}
+    return await _execute(auto_id, "manual", body)
+
+
+@router.post("/api/automations/{auto_id}/run")
+async def run_automation_button(request: Request, auto_id: int):
+    body = await request.json() if request.headers.get("content-type") else {}
+    return await _execute(auto_id, "button", body)
+
+
+@router.get("/workspace/automations/{auto_id}/runs")
+def automation_runs_history(request: Request, auto_id: int, limit: int = 50):
+    with get_conn() as conn:
+        rows = conn.execute(
+            """SELECT * FROM automation_runs WHERE automation_id=?
+               ORDER BY created_at DESC, id DESC LIMIT ?""",
+            (auto_id, limit),
+        ).fetchall()
+    return {"runs": [dict(r) for r in rows]}
+
+
+# ── v7.0.0 — chained steps (trigger/condition/delay/action) ───────────────
+
+STEP_SECRET_FIELDS = {"webhook_url"}
+
+
+def _require_session(request: Request) -> dict:
+    user = SessionManager.decode_session(request.cookies.get("flowdeck_session", ""))
+    if not user or not user.get("id"):
+        raise HTTPException(status_code=401, detail="Authentication required")
+    return user
+
+
+def _get_auto(auto_id: int) -> dict | None:
+    with get_conn() as conn:
+        row = conn.execute("SELECT * FROM automations WHERE id=?", (auto_id,)).fetchone()
+    return dict(row) if row else None
+
+
+def _auto_404():
+    # NOTE: return (not raise) — the global 404 handler redirects non-/api
+    # paths to /workspaces, which TestClient follows into a 200.
+    from fastapi.responses import JSONResponse
+    return JSONResponse({"detail": "Automation not found"}, status_code=404)
+
+
+def _encrypt_step_config(config: dict) -> dict:
+    """Encrypt secret fields at rest (empty = keep existing, like sso_config)."""
+    from app.services.sso_provisioning import encrypt_secret
+    cfg = dict(config or {})
+    for field in STEP_SECRET_FIELDS:
+        if field in cfg and cfg[field]:
+            val = str(cfg[field])
+            if not val.startswith("gAAAAA"):
+                cfg[field] = encrypt_secret(val)
+    return cfg
+
+
+@router.get("/workspace/automations/{auto_id}/steps")
+def list_steps(request: Request, auto_id: int):
+    if _get_auto(auto_id) is None:
+        return _auto_404()
+    return {"automation_id": auto_id, "steps": get_steps(auto_id)}
+
+
+@router.post("/workspace/automations/{auto_id}/steps")
+def create_step(request: Request, auto_id: int, body: dict = Body(default={})):
+    _require_session(request)
+    if _get_auto(auto_id) is None:
+        return _auto_404()
+    kind = body.get("kind", "")
+    config = body.get("config", {}) or {}
+    validate_step(kind, config)
+    with get_conn() as conn:
+        pos = conn.execute(
+            "SELECT COALESCE(MAX(position), -1)+1 FROM automation_steps WHERE automation_id=?",
+            (auto_id,)).fetchone()[0]
+        cur = conn.execute(
+            "INSERT INTO automation_steps (automation_id, kind, position, config_json)"
+            " VALUES (?,?,?,?)",
+            (auto_id, kind, int(body.get("position", pos)),
+             json.dumps(_encrypt_step_config(config))))
+        conn.commit()
+        step_id = cur.lastrowid
+    return {"id": step_id, "status": "created"}
+
+
+@router.put("/workspace/automations/steps/{step_id}")
+def update_step(request: Request, step_id: int, body: dict = Body(default={})):
+    _require_session(request)
+    with get_conn() as conn:
+        row = conn.execute("SELECT * FROM automation_steps WHERE id=?", (step_id,)).fetchone()
+        if not row:
+            from fastapi.responses import JSONResponse
+            return JSONResponse({"detail": "Step not found"}, status_code=404)
+        kind = body.get("kind", row["kind"])
+        try:
+            config = body.get("config", json.loads(row["config_json"] or "{}"))
+        except (TypeError, json.JSONDecodeError):
+            config = {}
+        validate_step(kind, config if isinstance(config, dict) else {})
+        conn.execute(
+            "UPDATE automation_steps SET kind=?, position=?, config_json=? WHERE id=?",
+            (kind, int(body.get("position", row["position"])),
+             json.dumps(_encrypt_step_config(config)), step_id))
+        conn.commit()
+    return {"id": step_id, "status": "updated"}
+
+
+@router.delete("/workspace/automations/steps/{step_id}")
+def delete_step(request: Request, step_id: int):
+    _require_session(request)
+    with get_conn() as conn:
+        conn.execute("DELETE FROM automation_steps WHERE id=?", (step_id,))
+        conn.commit()
+    return {"id": step_id, "status": "deleted"}
+
+
+@router.put("/workspace/automations/{auto_id}/mode")
+def set_trigger_mode(request: Request, auto_id: int, body: dict = Body(default={})):
+    """Set multi-trigger mode: any (default) or all (5-minute window)."""
+    _require_session(request)
+    if _get_auto(auto_id) is None:
+        return _auto_404()
+    mode = (body.get("mode") or "any").lower()
+    if mode not in ("any", "all"):
+        raise HTTPException(status_code=400, detail="mode must be any or all")
+    with get_conn() as conn:
+        conn.execute("UPDATE automations SET trigger_mode=? WHERE id=?", (mode, auto_id))
+        conn.commit()
+    return {"id": auto_id, "trigger_mode": mode}
+
+
+@router.post("/api/automations/press-button")
+async def press_button_endpoint(request: Request):
+    """Run the automation linked to a native DB button cell (CSRF-exempt)."""
+    body = await request.json() if request.headers.get("content-type") else {}
+    try:
+        collection_id = int(body.get("collection_id", 0))
+        row_id = int(body.get("row_id", 0))
+    except (TypeError, ValueError):
+        raise HTTPException(status_code=400, detail="collection_id + row_id required") from None
+    prop_ref = body.get("property", body.get("property_id", ""))
+    if not prop_ref:
+        raise HTTPException(status_code=400, detail="property required")
+    user = _current_user(request)
+    try:
+        result = await press_button(collection_id, row_id, prop_ref, user.get("id") or 1)
+    except ValueError as exc:
+        raise HTTPException(status_code=400, detail=str(exc)) from None
+    return result

app/routers/collaboration.py

@@ -0,0 +1,208 @@
+"""FlowDeck — Collaboration API (v4.9.0): inline comments on pages + mentions.
+
+Comments live in the existing `comments` table, extended with a target_type /
+target_id pair and inline anchors (anchor_block_id + text offsets). Mentions
+written in a comment body automatically notify the mentioned users.
+"""
+from __future__ import annotations
+
+import logging
+
+from fastapi import APIRouter, Body, HTTPException, Request
+
+from app.auth.session import SessionManager
+from app.db import get_conn
+from app.services import notifications as notif
+from app.services.automations import fire_event as _fire_event
+from app.services.automations import run_event_sync
+
+logger = logging.getLogger(__name__)
+router = APIRouter(tags=["collaboration"], prefix="/api")
+
+
+def _current_user(request: Request) -> dict:
+    user = SessionManager.decode_session(request.cookies.get("flowdeck_session", ""))
+    if not user or not user.get("id"):
+        raise HTTPException(status_code=401, detail="Authentication required")
+    return user
+
+
+def _page_url(page_id: int) -> str:
+    from app.config import settings
+    return f"{settings.app_base_url}/pages/{page_id}"
+
+
+def _serialize(rows):
+    out = []
+    for r in rows:
+        d = dict(r)
+        d["author"] = {
+            "id": r["author_id"],
+            "login": r["author_login"],
+            "full_name": r["author_name"],
+            "avatar_url": r["author_avatar"],
+            "avatar_color": r["author_color"],
+        }
+        for k in ("author_id", "author_login", "author_name", "author_avatar", "author_color"):
+            d.pop(k, None)
+        out.append(d)
+    return out
+
+
+@router.get("/pages/{page_id}/comments")
+def list_comments(request: Request, page_id: int):
+    """List page-level and inline comments for a FlowDeck page."""
+    _current_user(request)
+    with get_conn() as conn:
+        page = conn.execute("SELECT id, title FROM pages WHERE id=?", (page_id,)).fetchone()
+        if not page:
+            raise HTTPException(404, "Page not found")
+        rows = conn.execute(
+            """SELECT c.*, c.user_id AS author_id, u.login AS author_login,
+                      u.full_name AS author_name, u.avatar_url AS author_avatar,
+                      u.avatar_color AS author_color
+               FROM comments c
+               JOIN users u ON c.user_id = u.id
+               WHERE c.target_type='page' AND c.target_id=?
+               ORDER BY c.created_at ASC, c.id ASC""",
+            (page_id,),
+        ).fetchall()
+    return {"page_id": page_id, "comments": _serialize(rows)}
+
+
+@router.post("/pages/{page_id}/comments")
+def add_comment(request: Request, page_id: int, body: dict = Body(default={})):
+    """Create a page or inline comment. Mentions (@login) notify users."""
+    user = _current_user(request)
+    text = (body.get("body") or "").strip()
+    if not text:
+        raise HTTPException(400, "body required")
+
+    anchor_block = body.get("anchor_block_id")
+    anchor_start = body.get("anchor_start")
+    anchor_end = body.get("anchor_end")
+    # normalize empty anchor → page-level comment
+    if not anchor_block or anchor_start is None or anchor_end is None:
+        anchor_block, anchor_start, anchor_end = None, None, None
+    elif int(anchor_start) == int(anchor_end):
+        anchor_block, anchor_start, anchor_end = None, None, None
+
+    parent_id = body.get("parent_id")
+    uid = user["id"]
+    with get_conn() as conn:
+        page = conn.execute("SELECT id, title FROM pages WHERE id=?", (page_id,)).fetchone()
+        if not page:
+            raise HTTPException(404, "Page not found")
+        conn.execute(
+            "INSERT OR IGNORE INTO users (id, login, full_name, is_admin) VALUES (?,?,?,1)",
+            (uid, user.get("login", "admin"), user.get("full_name", "Admin")),
+        )
+        cur = conn.execute(
+            """INSERT INTO comments
+               (page_id, user_id, body, parent_id, target_type, target_id,
+                anchor_block_id, anchor_start, anchor_end)
+               VALUES (?,?,?,?, 'page', ?, ?, ?, ?)""",
+            (page_id, uid, text, parent_id, page_id, anchor_block, anchor_start, anchor_end),
+        )
+        comment_id = cur.lastrowid
+        conn.commit()
+
+        # v7.3.0: commenting implies following — the author gets the
+        # (throttled) page.updated notifications like any other follower.
+        from app.services import wiki as wiki_svc
+        wiki_svc.ensure_follow(page_id, uid, conn=conn)
+        conn.commit()
+
+        # Notify users @-mentioned in the comment (skip the author).
+        url = _page_url(page_id)
+        title = f"New comment on “{page['title']}”"
+        message = f"{user.get('full_name') or user.get('login')} commented: {text[:300]}"
+        notif.process_mentions(
+            text, uid, "mention", title, message,
+            "page", page_id, url, conn=conn,
+        )
+        conn.commit()
+
+    try:
+        run_event_sync(_fire_event("comment.added", {"comment_id": comment_id, "page_id": page_id, "user_id": uid}))
+        mentioned_ids = notif.extract_mentions(text)
+        if mentioned_ids:
+            run_event_sync(_fire_event("mention.added", {"page_id": page_id, "comment_id": comment_id, "count": len(mentioned_ids)}))
+    except Exception:
+        logger.exception("add_comment")
+
+    return {"id": comment_id, "status": "created"}
+
+
+@router.post("/pages/{page_id}/mentions")
+def notify_page_mentions(request: Request, page_id: int, body: dict = Body(default={})):
+    """Notify users @-mentioned in a page's content (called on save).
+
+    Accepts {"text": "..."} containing @login handles. Deduplicated server-side
+    against a per-page cache so repeated auto-saves don't spam notifications.
+    """
+    user = _current_user(request)
+    text = body.get("text") or ""
+    with get_conn() as conn:
+        page = conn.execute("SELECT id, title FROM pages WHERE id=?", (page_id,)).fetchone()
+        if not page:
+            raise HTTPException(404, "Page not found")
+        url = _page_url(page_id)
+        mentioned = notif.process_mentions(
+            text, user["id"], "mention", f"You were mentioned in “{page['title']}”",
+            f"{user.get('full_name') or user.get('login')} mentioned you on a page.",
+            "page", page_id, url, conn=conn,
+        )
+        conn.commit()
+    if mentioned:
+        try:
+            run_event_sync(_fire_event("mention.added", {"page_id": page_id, "user_ids": mentioned, "count": len(mentioned)}))
+        except Exception:
+            logger.exception("notify_page_mentions")
+    return {"mentioned": mentioned}
+
+
+@router.put("/comments/{comment_id}")
+def update_comment(request: Request, comment_id: int, body: dict = Body(default={})):
+    """Update a comment body or resolve/unresolve it."""
+    user = _current_user(request)
+    with get_conn() as conn:
+        row = conn.execute(
+            "SELECT * FROM comments WHERE id=?", (comment_id,)
+        ).fetchone()
+        if not row:
+            raise HTTPException(404, "Comment not found")
+        if row["user_id"] != user["id"]:
+            raise HTTPException(403, "Not allowed to edit this comment")
+        if "body" in body and body.get("body") is not None:
+            conn.execute(
+                "UPDATE comments SET body=?, updated_at=CURRENT_TIMESTAMP WHERE id=?",
+                (body["body"].strip(), comment_id),
+            )
+        was_resolved = int(row["resolved"] or 0)
+        if "resolved" in body and body.get("resolved") is not None:
+            conn.execute("UPDATE comments SET resolved=? WHERE id=?",
+                         (1 if body["resolved"] else 0, comment_id))
+        conn.commit()
+    if body.get("resolved") and not was_resolved:
+        try:
+            run_event_sync(_fire_event("comment.resolved", {"comment_id": comment_id, "page_id": row["page_id"]}))
+        except Exception:
+            logger.exception("update_comment")
+    return {"id": comment_id, "status": "updated"}
+
+
+@router.delete("/comments/{comment_id}")
+def delete_comment(request: Request, comment_id: int):
+    """Delete a comment and its replies."""
+    user = _current_user(request)
+    with get_conn() as conn:
+        row = conn.execute("SELECT * FROM comments WHERE id=?", (comment_id,)).fetchone()
+        if not row:
+            raise HTTPException(404, "Comment not found")
+        if row["user_id"] != user["id"]:
+            # allow page "owners" — fall back to a simple ownership rule for now
+            raise HTTPException(403, "Not allowed to delete this comment")
+        conn.execute("DELETE FROM comments WHERE id=? OR parent_id=?", (comment_id, comment_id))
+        conn.commit()
+    return {"id": comment_id, "status": "deleted"}

app/routers/dashboard.py

@@ -1,135 +0,0 @@
-"""FlowDeck — Dashboard: liste des projets Gitea + sidebar data."""
-from __future__ import annotations
-
-import logging
-
-from fastapi import APIRouter, Request, Query
-from fastapi.responses import HTMLResponse
-
-from app.services.gitea_client import gitea
-from app.auth.session import SessionManager
-from app.db import get_conn
-
-logger = logging.getLogger(__name__)
-router = APIRouter(tags=["dashboard"])
-
-
-def _sidebar_data(request: Request, repos: list[dict]) -> dict:
-    user = SessionManager.decode_session(request.cookies.get("flowdeck_session", ""))
-    ws = user.get("login", "Bruno") if user else "Bruno"
-    initial = ws[0].upper() if ws else "B"
-
-    recent_pages = []
-    for repo in repos[:10]:
-        full_name = repo.get("full_name", "")
-        recent_pages.append({
-            "id": full_name,
-            "name": repo.get("name", full_name),
-            "icon": "📁",
-            "url": f"/board/{full_name}",
-            "active": False,
-            "indent": 0,
-            "depth": 0,
-            "has_children": False,
-            "children": [],
-        })
-
-    return {
-        "workspace_name": ws, "workspace_initial": initial,
-        "current_page": "Dashboard", "last_edited": "now",
-        "recent_pages": recent_pages,
-        "private_pages": [],
-        "favorite_pages": [],
-        "user": user,
-        "workspace_key": "",
-    }
-
-
-@router.get("/trash", response_class=HTMLResponse)
-async def trash_page(request: Request):
-    """Trash page."""
-    from jinja2 import Environment, FileSystemLoader
-    env = Environment(loader=FileSystemLoader("app/templates"))
-    sidebar = _sidebar_data(request, [])
-    template = env.get_template("trash.html")
-    return template.render(**sidebar)
-
-
-@router.get("/library", response_class=HTMLResponse)
-async def library_page(request: Request):
-    from jinja2 import Environment, FileSystemLoader
-    env = Environment(loader=FileSystemLoader("app/templates"))
-    sidebar = _sidebar_data(request, [])
-    for p in sidebar["recent_pages"]:
-        p["last_edited"] = "now"
-    for p in sidebar["private_pages"]:
-        p["last_edited"] = "now"
-    template = env.get_template("library.html")
-    return template.render(**sidebar)
-
-
-@router.get("/pages/{page_id}", response_class=HTMLResponse)
-async def view_page_root(request: Request, page_id: int):
-    """Render a Markdown page at root level with workspace context."""
-    from jinja2 import Environment, FileSystemLoader
-    from app.routers.board import _sidebar_data as board_sidebar
-    env = Environment(loader=FileSystemLoader("app/templates"))
-    with get_conn() as conn:
-        row = conn.execute("SELECT * FROM pages WHERE id=?", (page_id,)).fetchone()
-        if not row:
-            return HTMLResponse("<h2>Page not found</h2>", status_code=404)
-    page = dict(row)
-    ws = page.get("workspace", "")
-    parts = ws.split("/") if "/" in ws else ["", ""]
-    owner, repo = parts[0], parts[1] if len(parts) > 1 else ""
-    sidebar = board_sidebar(request, owner, repo)
-    # Load sub-pages
-    with get_conn() as conn:
-        subs = conn.execute(
-            "SELECT id, title FROM pages WHERE parent_id=? ORDER BY updated_at DESC",
-            (page_id,),
-        ).fetchall()
-    ctx = {**sidebar, "page": page, "sub_pages": [dict(s) for s in subs]}
-    template = env.get_template("page_editor.html")
-    return template.render(**ctx)
-
-
-@router.get("/accounts", response_class=HTMLResponse)
-async def accounts_page(request: Request):
-    """Account management panel."""
-    from jinja2 import Environment, FileSystemLoader
-    env = Environment(loader=FileSystemLoader("app/templates"))
-    sidebar = _sidebar_data(request, [])
-    user = SessionManager.decode_session(request.cookies.get("flowdeck_session", ""))
-    with get_conn() as conn:
-        users = conn.execute("SELECT * FROM users ORDER BY created_at DESC").fetchall()
-    ctx = {**sidebar, "user": user, "users": [dict(u) for u in users]}
-    template = env.get_template("accounts.html")
-    return template.render(**ctx)
-
-
-@router.get("/", response_class=HTMLResponse)
-async def dashboard(
-    request: Request,
-    search: str = Query(default=""),
-    show_archived: bool = Query(default=False),
-):
-    try:
-        repos = await gitea.get_user_repos(page=1, limit=50)
-        if search:
-            q = search.lower()
-            repos = [r for r in repos if q in r.get("full_name", "").lower()
-                     or q in (r.get("description") or "").lower()]
-        if not show_archived:
-            repos = [r for r in repos if not r.get("archived", False)]
-        repos.sort(key=lambda r: r.get("updated_at", ""), reverse=True)
-    except Exception as e:
-        logger.error("Dashboard error: %s", e)
-        repos = []
-
-    from jinja2 import Environment, FileSystemLoader
-    env = Environment(loader=FileSystemLoader("app/templates"))
-    sidebar = _sidebar_data(request, repos)
-    template = env.get_template("dashboard.html")
-    return template.render(request=request, repos=repos, search=search,
-                           show_archived=show_archived, **sidebar)

app/routers/dashboard/__init__.py

@@ -0,0 +1,77 @@
+"""FlowDeck — Dashboard (pages HTML + API de l'app).
+
+Découpe A28 : l'ancien `dashboard.py` (2 735 lignes, 63 routes) est
+devenu ce package — un module par concern, helpers dans `_common`,
+re-export de tout ce que les 7 importateurs existants utilisent
+(main, board, my_tasks, web_clipper, wiki, sites, tests).
+"""
+from __future__ import annotations
+
+import logging
+
+from fastapi import APIRouter
+
+from . import (  # ordre = ordre d'enregistrement d'origine (openapi identique)
+    account_api,
+    account_settings,
+    local_workspace,
+    pages_api,
+    pages_html,
+    public,
+    workspace,
+    workspaces,
+)
+from ._common import (  # noqa: F401 — re-export des helpers
+    _VERSION,
+    WORKSPACE_COOKIE,
+    _build_breadcrumb,
+    _build_tree_children,
+    _file_page_disk_path,
+    _format_size,
+    _get_active_workspace,
+    _get_app_version,
+    _get_user_id,
+    _get_user_or_redirect,
+    _local_workspaces_for_user,
+    _nav_breadcrumb,
+    _render_blocks_public,
+    _require_page_view,
+    _require_user_id,
+    _sanitize_id,
+    _sidebar_data,
+)
+
+logger = logging.getLogger(__name__)
+router = APIRouter()
+for _mod in (
+    pages_html,
+    account_api,
+    workspace,
+    local_workspace,
+    workspaces,
+    account_settings,
+    public,
+    pages_api,
+):
+    router.include_router(_mod.router)
+
+__all__ = [
+    "router",
+    "WORKSPACE_COOKIE",
+    "_VERSION",
+    "_build_breadcrumb",
+    "_build_tree_children",
+    "_file_page_disk_path",
+    "_format_size",
+    "_get_active_workspace",
+    "_get_app_version",
+    "_get_user_id",
+    "_get_user_or_redirect",
+    "_local_workspaces_for_user",
+    "_nav_breadcrumb",
+    "_render_blocks_public",
+    "_require_page_view",
+    "_require_user_id",
+    "_sanitize_id",
+    "_sidebar_data",
+]

app/routers/dashboard/_common.py

@@ -0,0 +1,774 @@
+"""FlowDeck — Dashboard : helpers partagés des modules de routes (A28).
+
+Les 15 helpers top-level de l'ancien dashboard.py vivent ici (état :
+_VERSION, WORKSPACE_COOKIE) — ré-exportés par le package.
+"""
+from __future__ import annotations
+
+import logging
+
+from fastapi import HTTPException, Request
+from fastapi.responses import RedirectResponse
+
+from app.auth.session import SessionManager
+from app.config import settings
+from app.db import get_conn
+
+logger = logging.getLogger(__name__)
+
+_VERSION = None
+
+WORKSPACE_COOKIE = "flowdeck_workspace"
+
+
+
+def _get_app_version() -> str:
+    """Read version from VERSION file with caching."""
+    global _VERSION
+    if _VERSION is not None:
+        return _VERSION
+    try:
+        import os
+        version_path = os.path.join(os.path.dirname(__file__), "..", "..", "VERSION")
+        if os.path.exists(version_path):
+            with open(version_path) as f:
+                _VERSION = f.read().strip()
+        else:
+            # Docker fallback
+            version_path = "/app/VERSION"
+            if os.path.exists(version_path):
+                with open(version_path) as f:
+                    _VERSION = f.read().strip()
+            else:
+                _VERSION = "0.0.0"
+    except Exception:
+        _VERSION = "0.0.0"
+    return _VERSION
+
+
+
+
+
+
+def _get_user_or_redirect(request: Request):
+    """Return decoded user or a RedirectResponse to login page.
+    Skips redirect when DB has no users (fresh install / test env)."""
+    user = SessionManager.decode_session(request.cookies.get("flowdeck_session", ""))
+    if not user:
+        # Allow through if no users exist yet (fresh install / tests)
+        try:
+            with get_conn() as conn:
+                count = conn.execute("SELECT COUNT(*) FROM users").fetchone()[0]
+                if count == 0:
+                    return {"id": 1, "login": "admin", "full_name": "Admin", "is_admin": True}
+        except Exception:
+            logger.exception("_get_user_or_redirect")
+        return RedirectResponse("/auth/login?provider=local&expired=1", status_code=302)
+    return user
+
+
+
+
+
+
+def _local_workspaces_for_user(user: dict | None, workspace_id: int = 0) -> list[dict]:
+    """Return list of local workspaces for a user."""
+    if not user:
+        return []
+    try:
+        with get_conn() as conn:
+            rows = conn.execute(
+                "SELECT id, name FROM workspaces WHERE owner_id = ? ORDER BY name",
+                (user["id"],)
+            ).fetchall()
+            return [{"id": r["id"], "name": r["name"]} for r in rows]
+    except Exception:
+        return []
+
+
+
+
+
+
+def _sidebar_data(request: Request, repos: list[dict], include_workspace: bool = True) -> dict:
+    user = SessionManager.decode_session(request.cookies.get("flowdeck_session", ""))
+    ws = user.get("login", "Bruno") if user else "Bruno"
+    initial = ws[0].upper() if ws else "B"
+
+    # Get avatar info from DB
+    avatar_url = ""
+    avatar_color = "#3A3A3A"
+    if user:
+        try:
+            with get_conn() as conn:
+                row = conn.execute("SELECT avatar_url, avatar_color FROM users WHERE id = ?", (user["id"],)).fetchone()
+                if row:
+                    avatar_url = row["avatar_url"] or ""
+                    avatar_color = row["avatar_color"] or "#3A3A3A"
+        except Exception:
+            logger.exception("_sidebar_data")
+
+    recent_pages = []
+    for repo in repos[:10]:
+        full_name = repo.get("full_name", "")
+        recent_pages.append({
+            "id": full_name,
+            "name": repo.get("name", full_name),
+            "icon": "folder",
+            "url": f"/board/{full_name}",
+            "active": False,
+            "indent": 0,
+            "depth": 0,
+            "has_children": False,
+            "children": [],
+        })
+
+    # Active workspace from cookie (skip on pages like /workspaces where no
+    # workspace context should be shown)
+    from app.routers.board import _load_workspace_pages
+    ws_cookie = request.cookies.get("flowdeck_workspace", "")
+    active_ws_name = "Workspace"
+    workspace_pages = []
+    gitea_workspace = False
+    gitea_owner = ""
+    gitea_repo = ""
+    has_active_workspace = False
+    local_ws_id = 0
+
+    if ws_cookie and ws_cookie.startswith("gitea:"):
+        # Gitea workspace: set owner/repo for client-side tree loading
+        # AND open the local workspace mirror of the same name in the
+        # sidebar's top "My Workspaces" section, in parallel with the
+        # Gitea repository tree.
+        parts = ws_cookie.split(":", 2)
+        if len(parts) >= 3:
+            gitea_owner = parts[1]
+            gitea_repo = parts[2]
+            active_ws_name = f"{gitea_owner}/{gitea_repo}"
+            gitea_workspace = True
+            has_active_workspace = True
+            # Load the local mirror workspace tree so it appears in "My
+            # Workspaces" alongside the Gitea repository section.
+            if user:
+                try:
+                    with get_conn() as conn:
+                        row = conn.execute(
+                            "SELECT id FROM workspaces WHERE owner_id=? AND name=? AND settings_json LIKE ?",
+                            (user["id"], f"{gitea_owner}/{gitea_repo}", "%gitea_repo%")
+                        ).fetchone()
+                        if row:
+                            local_ws_id = row["id"]
+                            workspace_pages = _load_workspace_pages(str(local_ws_id))
+                except (ValueError, Exception):
+                    pass
+    elif include_workspace and ws_cookie and user:
+        try:
+            wsi = int(ws_cookie)
+            with get_conn() as conn:
+                # Verify this workspace belongs to the current user
+                row = conn.execute(
+                    "SELECT id, name, owner_id FROM workspaces WHERE id=? AND owner_id=?",
+                    (wsi, user["id"])
+                ).fetchone()
+                if row:
+                    active_ws_name = row["name"]
+                    workspace_pages = _load_workspace_pages(ws_cookie)
+                    has_active_workspace = True
+                # else: stale cookie from another user — ignore
+        except (ValueError, Exception):
+            pass
+
+    # Auth method & OAuth badge data
+    auth_method = "local"
+    gitea_linked = False
+    github_linked = False
+    if user and user.get("id"):
+        try:
+            with get_conn() as conn:
+                am_row = conn.execute("SELECT auth_method FROM users WHERE id=?", (user["id"],)).fetchone()
+                if am_row and am_row["auth_method"]:
+                    auth_method = am_row["auth_method"]
+                tokens = conn.execute(
+                    "SELECT provider FROM user_oauth_tokens WHERE user_id=?", (user["id"],)
+                ).fetchall()
+                for t in tokens:
+                    if t["provider"] == "gitea":
+                        gitea_linked = True
+                    elif t["provider"] == "github":
+                        github_linked = True
+        except Exception:
+            logger.exception("_sidebar_data")
+
+    # Get local workspace ID for Gitea workspace mirror
+    local_ws_id = 0
+    if gitea_workspace and gitea_owner and gitea_repo:
+        try:
+            with get_conn() as conn:
+                row = conn.execute(
+                    "SELECT id FROM workspaces WHERE owner_id=? AND name=? AND settings_json LIKE ?",
+                    (user["id"], f"{gitea_owner}/{gitea_repo}", "%gitea_repo%")
+                ).fetchone()
+                if row:
+                    local_ws_id = row["id"]
+        except Exception:
+            logger.exception("_sidebar_data")
+
+    # Private pages for mirror workspace (when Gitea remote active)
+    private_pages = []
+    if gitea_workspace and local_ws_id:
+        try:
+            with get_conn() as conn:
+                pp_rows = conn.execute(
+                    "SELECT id, title FROM pages WHERE parent_section='Private' AND workspace_id=? AND deleted_at IS NULL ORDER BY updated_at DESC LIMIT 20",
+                    (local_ws_id,)
+                ).fetchall()
+                private_pages = [{"id": r[0], "title": r[1] or "Untitled"} for r in pp_rows]
+        except Exception:
+            logger.exception("_sidebar_data")
+
+    # Shared / received / published pages for the sidebar (Par moi / Avec moi)
+    shared_made_pages = []
+    shared_received_pages = []
+    published_pages = []
+    shared_pages = []
+    if user and user.get("id"):
+        from app.routers.board import _load_shared_sidebar_pages
+        shared_made_pages, shared_received_pages, published_pages, shared_pages = _load_shared_sidebar_pages(user["id"])
+
+    sidebar = {
+        "workspace_name": ws, "workspace_initial": initial,
+        "active_ws_name": active_ws_name,
+        "workspace_key": f"{gitea_owner}/{gitea_repo}" if gitea_workspace else "",
+        "gitea_workspace": gitea_workspace,
+        "gitea_owner": gitea_owner,
+        "gitea_repo": gitea_repo,
+        "local_ws_id": local_ws_id,
+        "workspace_pages": workspace_pages,
+        "current_page": "Dashboard", "last_edited": "now",
+        "recent_pages": recent_pages,
+        "private_pages": private_pages,
+        "favorite_pages": [],
+        "shared_pages": shared_pages,
+        "shared_made_pages": shared_made_pages,
+        "shared_received_pages": shared_received_pages,
+        "published_pages": published_pages,
+        "user": user,
+        "avatar_url": avatar_url,
+        "avatar_color": avatar_color,
+        "auth_method": auth_method,
+        "gitea_linked": gitea_linked,
+        "github_linked": github_linked,
+        "has_active_workspace": has_active_workspace,
+        "app_version": _get_app_version(),
+    }
+
+    sidebar["local_workspaces"] = _local_workspaces_for_user(user)
+
+    return sidebar
+
+
+
+
+
+
+# ═══════════ User API endpoints ═══════════
+
+def _get_user_id(request: Request) -> int:
+    user = SessionManager.decode_session(request.cookies.get("flowdeck_session", ""))
+    return user["id"] if user and user.get("id") else 1
+
+
+
+
+
+
+def _require_user_id(request: Request) -> int:
+    """A3/A4 — 401 sans session (les routes qui mutent un compte ne tolèrent
+    plus le fallback « legacy single-user » → id 1 = l'admin seedé)."""
+    user = SessionManager.decode_session(request.cookies.get("flowdeck_session", ""))
+    if not user or not user.get("id"):
+        raise HTTPException(401, "Authentication required")
+    return user["id"]
+
+
+
+
+
+
+def _file_page_disk_path(page: dict):
+    """Resolve the on-disk file behind a ``content_format == 'file'`` page.
+
+    Returns ``(abs_path: Path, filename: str, mime: str, size: int)`` or None
+    when the row is not a file page, references a non-textual/missing file, or
+    the path escapes the data root (path-traversal guard).
+    """
+    if (page.get("content_format") or "") != "file":
+        return None
+    import json as _json
+    try:
+        meta = _json.loads(page.get("content", "{}"))
+    except (_json.JSONDecodeError, TypeError):
+        meta = {}
+    if not isinstance(meta, dict):
+        return None
+    rel = (meta.get("file_path") or "").replace("\\", "/").strip()
+    if not rel or not rel.startswith("uploads/"):
+        return None
+    parts = rel.split("/")
+    if ".." in parts or "." in parts:
+        return None
+    from pathlib import Path
+    root = Path(settings.data_dir).resolve()
+    full = (root / rel).resolve()
+    try:
+        full.relative_to(root)
+    except ValueError:
+        return None
+    if not full.exists() or not full.is_file():
+        return None
+    filename = parts[-1] or page.get("title", "file")
+    mime = meta.get("mime_type") or "application/octet-stream"
+    size = meta.get("size") or 0
+    return (full, filename, mime, size)
+
+
+
+
+
+
+def _require_page_view(request: Request, page_id: int) -> None:
+    """A16 : lecture d'une pièce jointe = session + `can_view_page` (404 sinon)."""
+    user = SessionManager.decode_session(request.cookies.get("flowdeck_session", ""))
+    if not user or not user.get("id"):
+        raise HTTPException(401, "Authentication required")
+    from app.services.permission_manager import PermissionManager
+
+    if not PermissionManager(user["id"], bool(user.get("is_admin"))).can_view_page(page_id):
+        raise HTTPException(404, "Page not found")
+
+
+
+
+
+
+def _build_tree_children(conn, parent_id: int | None, ws_id: int, uid: int | None = None) -> list:
+    """Recursively build the tree of children for a node."""
+    if parent_id is None:
+        rows = conn.execute(
+            "SELECT id, title, parent_section, content_format, content, page_icon, "
+            "(is_shared OR share_mode != 'private' OR COALESCE(published,0)) as is_shared, "
+            "created_at, updated_at FROM pages "
+            "WHERE parent_id IS NULL AND workspace_id=? AND deleted_at IS NULL AND collection_row_id IS NULL "
+            "ORDER BY created_at DESC",
+            (ws_id,),
+        ).fetchall()
+    else:
+        rows = conn.execute(
+            "SELECT id, title, parent_section, content_format, content, page_icon, "
+            "(is_shared OR share_mode != 'private' OR COALESCE(published,0)) as is_shared, "
+            "created_at, updated_at FROM pages "
+            "WHERE parent_id=? AND workspace_id=? AND deleted_at IS NULL "
+            "ORDER BY created_at DESC",
+            (parent_id, ws_id),
+        ).fetchall()
+
+    # Get workspace owner name for author display
+    ws_owner = conn.execute(
+        "SELECT u.full_name, u.login FROM workspaces w JOIN users u ON u.id=w.owner_id WHERE w.id=?",
+        (ws_id,),
+    ).fetchone()
+    author = ws_owner["full_name"] or ws_owner["login"] if ws_owner else "—"
+
+    # Collect all page IDs to fetch tags in one query
+    all_ids = [r["id"] for r in rows]
+    tags_map = {}
+    favorited_ids = set()
+    if all_ids:
+        placeholders = ",".join("?" for _ in all_ids)
+        tag_rows = conn.execute(
+            f"SELECT pt.page_id, t.id, t.name, t.color FROM page_tags pt "
+            f"JOIN tags t ON t.id=pt.tag_id WHERE pt.page_id IN ({placeholders})",
+            all_ids,
+        ).fetchall()
+        for tr in tag_rows:
+            tags_map.setdefault(tr["page_id"], []).append({
+                "id": tr["id"], "name": tr["name"], "color": tr["color"],
+            })
+        if uid is not None:
+            fav_rows = conn.execute(
+                f"SELECT page_id FROM favorites WHERE user_id=? AND page_id IN ({placeholders})",
+                [uid, *all_ids],
+            ).fetchall()
+            favorited_ids = {fr["page_id"] for fr in fav_rows}
+
+    tree = []
+    for r in rows:
+        is_folder = r["parent_section"] == "Workspace"
+        children = _build_tree_children(conn, r["id"], ws_id, uid)
+
+        # Compute size
+        size = 0
+        if r["content_format"] == "file":
+            import json as _json
+            try:
+                meta = _json.loads(r["content"])
+                size = meta.get("size", 0)
+            except Exception:
+                size = len(r["content"] or "")
+        else:
+            size = len(r["content"] or "")
+
+        tree.append({
+            "id": r["id"],
+            "name": r["title"] or "Untitled",
+            "type": "folder" if is_folder else "page",
+            "is_folder": is_folder,
+            "content_format": r["content_format"] if not is_folder else None,
+            "page_icon": r["page_icon"] or "",
+            "children": children,
+            "has_children": len(children) > 0,
+            "child_count": len(children),
+            "size": size,
+            "size_display": _format_size(size),
+            "created_at": r["created_at"],
+            "updated_at": r["updated_at"],
+            "author": author,
+            "tags": tags_map.get(r["id"], []),
+            "is_shared": bool(r["is_shared"]),
+            "favorited": r["id"] in favorited_ids,
+        })
+    return tree
+
+
+
+
+
+
+def _format_size(size_bytes: int) -> str:
+    """Human-readable file size."""
+    if size_bytes < 1024:
+        return f"{size_bytes} B"
+    elif size_bytes < 1024 * 1024:
+        return f"{size_bytes / 1024:.1f} KB"
+    elif size_bytes < 1024 * 1024 * 1024:
+        return f"{size_bytes / (1024 * 1024):.1f} MB"
+    return f"{size_bytes / (1024 * 1024 * 1024):.2f} GB"
+
+
+
+
+
+
+def _build_breadcrumb(conn, folder_id: int) -> list:
+    """Build breadcrumb trail from root to folder_id."""
+    breadcrumb = []
+    current = folder_id
+    seen = set()
+    while current and current not in seen:
+        seen.add(current)
+        row = conn.execute(
+            "SELECT id, title, parent_id, parent_section FROM pages WHERE id=?",
+            (current,),
+        ).fetchone()
+        if row:
+            breadcrumb.insert(0, {
+                "id": row["id"],
+                "name": row["title"] or "Untitled",
+                "is_folder": row["parent_section"] == "Workspace",
+            })
+            current = row["parent_id"]
+        else:
+            break
+    return breadcrumb
+
+
+
+
+
+
+def _nav_breadcrumb(conn, page_id: int) -> list:
+    """Build a Notion-style breadcrumb chain (root -> page) for the header.
+
+    Returns a list of dicts: {id, label, url, icon, menu}. The last item is the
+    current page (url = None). Every item has ``menu: True`` so the header can
+    open a sibling-navigation dropdown for it.
+    """
+    from app.routers.board import _file_icon
+    chain = []
+    current = page_id
+    seen = set()
+    while current and current not in seen:
+        seen.add(current)
+        row = conn.execute(
+            "SELECT id, title, parent_id, parent_section, content_format "
+            "FROM pages WHERE id=? AND deleted_at IS NULL",
+            (current,),
+        ).fetchone()
+        if not row:
+            break
+        is_folder = row["parent_section"] == "Workspace"
+        title = row["title"] or "Untitled"
+        chain.insert(0, {
+            "id": row["id"],
+            "label": title,
+            "url": None,
+            "icon": "folder" if is_folder else _file_icon(title, row["content_format"]),
+            "menu": True,
+        })
+        current = row["parent_id"]
+    # All items except the current page are navigable links.
+    for i, item in enumerate(chain):
+        if i < len(chain) - 1:
+            item["url"] = f"/pages/{item['id']}"
+    return chain
+
+
+
+
+
+
+def _get_active_workspace(request: Request, user_id: int = None) -> dict | None:
+    """Get the active workspace ID from the cookie (verified for current user), or first user workspace, or None."""
+    ws_id = request.cookies.get(WORKSPACE_COOKIE)
+    if ws_id:
+        try:
+            with get_conn() as conn:
+                ws = conn.execute("SELECT * FROM workspaces WHERE id=?",
+                                  (int(ws_id),)).fetchone()
+                if ws:
+                    ws_dict = dict(ws)
+                    # Verify ownership — only return if it belongs to the current user
+                    if user_id is None or ws_dict.get("owner_id") == user_id:
+                        return ws_dict
+        except (ValueError, Exception):
+            pass
+    # Fallback: first workspace owned by this user
+    if user_id:
+        with get_conn() as conn:
+            ws = conn.execute(
+                "SELECT * FROM workspaces WHERE owner_id=? ORDER BY id LIMIT 1",
+                (user_id,)
+            ).fetchone()
+            if ws:
+                return dict(ws)
+    return None
+
+
+
+
+
+
+def _sanitize_id(block_id: str) -> str:
+    """Sanitize a block id for use as an HTML anchor (only alnum kept)."""
+    if not block_id:
+        return ""
+    return "".join(ch for ch in str(block_id) if ch.isalnum())
+
+
+
+
+
+
+def _render_blocks_public(blocks: list, titles: dict | None = None) -> str:
+    """Render FlowDeck blocks as plain HTML for public pages.
+
+    v5.11.0: ``titles`` (token → label, see app.services.wiki_links) turns
+    ``[[fdpage:ID]]`` / ``[[fddate:...]]`` tokens into chips/links.
+    """
+    html_parts = []
+
+    def _wiki(c: str) -> str:
+        if titles and ("[[fdpage:" in c or "[[fddate:" in c):
+            from app.services.wiki_links import resolve_tokens_html
+            return resolve_tokens_html(c, titles)
+        return c
+
+    for b in blocks:
+        t = b.get("type", "paragraph")
+        c = _wiki(b.get("content", "") or "")
+        if t == "heading_1":
+            html_parts.append(f'<h1 id="h-{_sanitize_id(b.get("id",""))}" style="font-size:2.5rem;font-weight:700;margin:32px 0 8px;">{c}</h1>')
+        elif t == "heading_2":
+            html_parts.append(f'<h2 id="h-{_sanitize_id(b.get("id",""))}" style="font-size:1.75rem;font-weight:600;margin:28px 0 6px;">{c}</h2>')
+        elif t == "heading_3":
+            html_parts.append(f'<h3 id="h-{_sanitize_id(b.get("id",""))}" style="font-size:1.35rem;font-weight:600;margin:24px 0 4px;">{c}</h3>')
+        elif t == "heading_4":
+            html_parts.append(f'<h4 id="h-{_sanitize_id(b.get("id",""))}" style="font-size:1.15rem;font-weight:600;margin:20px 0 4px;">{c}</h4>')
+        elif t == "bulleted_list":
+            html_parts.append(f'<li style="margin-left:24px;">{c}</li>')
+        elif t == "numbered_list":
+            html_parts.append(f'<li style="margin-left:24px;list-style:decimal;">{c}</li>')
+        elif t == "to_do":
+            checked = "checked" if b.get("checked") else ""
+            todo_style = "text-decoration:line-through;opacity:.5" if b.get("checked") else ""
+            html_parts.append(
+                f'<div style="display:flex;align-items:center;gap:8px;margin:4px 0;">'
+                f'<input type="checkbox" {checked} disabled>'
+                f'<span style="{todo_style}">{c}</span>'
+                f'</div>'
+            )
+        elif t == "toggle":
+            children_html = ""
+            if b.get("children"):
+                children_html = '<div style="margin-left:22px;padding-left:12px;border-left:1px solid rgba(255,255,255,.1);margin-top:4px;">'
+                children_html += _render_blocks_public(b["children"], titles)
+                children_html += "</div>"
+            html_parts.append(
+                f'<details style="margin:8px 0;" open><summary style="cursor:pointer;font-weight:500;">{c}</summary>{children_html}</details>'
+            )
+        elif t == "quote":
+            html_parts.append(
+                f'<blockquote style="border-left:3px solid var(--accent,#4c9aff);margin:12px 0;padding:4px 16px;opacity:.85;">{c}</blockquote>'
+            )
+        elif t == "table_of_contents":
+            toc = [
+                x for x in blocks
+                if x.get("type", "").startswith("heading_") and (x.get("content") or "").strip()
+            ]
+            if toc:
+                items = []
+                for h in toc:
+                    lvl = int(h["type"].split("_")[-1])
+                    items.append(
+                        f'<div style="margin-left:{max(0, lvl - 1) * 14}px;padding:5px 8px;font-size:14px;">'
+                        f'<a href="#h-{_sanitize_id(h.get("id",""))}" style="color:inherit;text-decoration:none;display:block;">{h.get("content","")}</a></div>'
+                    )
+                html_parts.append(
+                    '<div style="border:1px solid rgba(255,255,255,.1);border-radius:8px;padding:16px 20px;margin:4px 0;">'
+                    '<div style="font-size:12px;font-weight:600;text-transform:uppercase;letter-spacing:.5px;opacity:.5;margin-bottom:10px;">On this page</div>'
+                    + "".join(items) + "</div>"
+                )
+        elif t == "math":
+            tex = c.replace("&", "&amp;").replace("<", "&lt;").replace(">", "&gt;")
+            html_parts.append(
+                f'<div data-katex="{tex}" style="margin:12px 0;padding:12px 16px;background:rgba(255,255,255,.04);border-radius:8px;overflow-x:auto;"></div>'
+            )
+        elif t == "columns":
+            cols_html = ""
+            for child in b.get("children") or []:
+                cols_html += (
+                    '<div style="flex:1;min-width:0;padding:10px 12px;background:rgba(255,255,255,.05);'
+                    'border-radius:8px;box-sizing:border-box;">'
+                    + _render_blocks_public([child], titles) + "</div>"
+                )
+            html_parts.append(
+                f'<div style="display:flex;gap:12px;margin:8px 0 16px;align-items:stretch;">{cols_html}</div>'
+            )
+        elif t == "callout":
+            icon = b.get("icon", "💡")
+            bg = (b.get("style") or {}).get("bgColor", "rgba(76,154,255,.1)")
+            html_parts.append(
+                f'<div style="display:flex;gap:10px;padding:14px 18px;margin:12px 0;border-radius:8px;'
+                f'background:{bg};align-items:flex-start;">'
+                f'<span style="font-size:20px;flex-shrink:0;">{icon}</span>'
+                f'<span>{c}</span></div>'
+            )
+        elif t == "code":
+            lang = b.get("language", "")
+            lang_label = f"<div style='font-size:11px;opacity:.4;margin-bottom:8px;'>{lang}</div>" if lang else ""
+            html_parts.append(
+                f'<pre style="background:rgba(255,255,255,.05);padding:16px 20px;border-radius:8px;'
+                f'overflow-x:auto;font-size:14px;line-height:1.5;margin:12px 0;">'
+                f'{lang_label}'
+                f'<code>{c}</code></pre>'
+            )
+        elif t == "divider":
+            html_parts.append('<hr style="border:none;border-top:1px solid rgba(255,255,255,.1);margin:16px 0;">')
+        elif t == "image":
+            src = b.get("src", "")
+            alt = b.get("alt", "")
+            html_parts.append(
+                f'<figure style="margin:16px 0;text-align:center;">'
+                f'<img src="{src}" alt="{alt}" data-full="{src}" style="max-width:100%;border-radius:8px;cursor:zoom-in;">'
+                f'</figure>'
+            )
+        elif t == "video":
+            src = b.get("src", "")
+            if src:
+                html_parts.append(
+                    f'<video controls preload="metadata" style="max-width:100%;border-radius:8px;display:block;margin:12px auto;">'
+                    f'<source src="{src}"></video>'
+                )
+        elif t == "audio":
+            src = b.get("src", "")
+            if src:
+                html_parts.append(
+                    f'<audio controls preload="metadata" style="width:100%;margin:8px 0;"><source src="{src}"></audio>'
+                )
+        elif t == "bookmark":
+            url = b.get("url") or b.get("src") or ""
+            title = b.get("title") or url
+            desc = b.get("description") or ""
+            img = b.get("image") or ""
+            site = b.get("site_name") or ""
+            img_html = (
+                f'<img src="{img}" alt="" style="width:120px;height:90px;object-fit:cover;border-radius:8px;flex-shrink:0;">' if img else ""
+            )
+            desc_html = f'<div style="font-size:13px;opacity:.75;margin-top:4px;">{desc}</div>' if desc else ""
+            site_html = f'<div style="font-size:11px;opacity:.5;text-transform:uppercase;letter-spacing:.5px;margin-top:6px;">{site}</div>' if site else ""
+            html_parts.append(
+                f'<a href="{url}" target="_blank" rel="noopener noreferrer" style="text-decoration:none;color:inherit;">'
+                f'<div style="display:flex;gap:14px;align-items:center;border:1px solid rgba(255,255,255,.12);border-radius:10px;'
+                f'padding:14px 16px;margin:14px 0;background:rgba(255,255,255,.03);">'
+                f'<div style="flex:1;min-width:0;"><div style="font-weight:600;font-size:15px;">{title}</div>'
+                f'{desc_html}{site_html}</div>{img_html}</div></a>'
+            )
+        elif t == "embed":
+            url = b.get("src", "")
+            emb = b.get("embed_type") or ""
+            if emb in ("inline_dbs", "collection"):
+                html_parts.append('<div>[Embedded content]</div>')
+            elif emb == "download":
+                html_parts.append(
+                    f'<a href="{url}" download style="display:inline-block;margin:12px 0;color:var(--accent,#4c9aff);">⬇ {b.get("file_name") or "Download"}</a>'
+                )
+            elif emb == "pdf" and url:
+                html_parts.append(
+                    f'<iframe src="{url}" style="width:100%;height:70vh;border:none;border-radius:8px;margin:12px 0;"></iframe>'
+                )
+            elif url:
+                from app.services.embeds import embed_src
+                src = b.get("embed_src") or embed_src(url) or url
+                height = b.get("height") or 520
+                try:
+                    height = int(height)
+                except (ValueError, TypeError):
+                    height = 520
+                html_parts.append(
+                    f'<div style="position:relative;width:100%;height:{height}px;border-radius:8px;overflow:hidden;'
+                    f'background:#0a0a0a;"><iframe src="{src}" loading="lazy" frameborder="0" '
+                    f'style="position:absolute;inset:0;width:100%;height:100%;" allowfullscreen allow="autoplay; encrypted-media; picture-in-picture"></iframe></div>'
+                )
+        elif t == "synced":
+            # v6.5.0: render synced block instances (resolved server-side).
+            if b.get("_synced_deleted"):
+                html_parts.append(
+                    '<div style="margin:8px 0;padding:8px 12px;border-left:3px solid #e05e5e;'
+                    'background:rgba(224,94,94,.08);border-radius:4px;font-size:13px;opacity:.8;">'
+                    'Deleted synced block</div>'
+                )
+            else:
+                inner = b.get("_synced_content")
+                if not isinstance(inner, list) or not inner:
+                    try:
+                        import json as _sj
+                        parsed = _sj.loads(b.get("content") or "[]")
+                        inner = parsed if isinstance(parsed, list) else []
+                    except (ValueError, TypeError):
+                        inner = []
+                inner = [{"type": "paragraph", "content": str(x)} if not isinstance(x, dict) else x
+                         for x in inner]
+                if inner:
+                    html_parts.append(
+                        '<div style="margin:8px 0;padding-left:12px;'
+                        'border-left:3px solid var(--accent,#4c9aff);">'
+                        + _render_blocks_public(inner, titles) + '</div>'
+                    )
+        else:
+            html_parts.append(f'<p style="margin:4px 0;line-height:1.7;">{c}</p>')
+    return "\n".join(html_parts)
+
+
+# ═══════════ Library page actions API ═══════════
+
+

app/routers/dashboard/account_api.py

@@ -0,0 +1,77 @@
+"""FlowDeck — Dashboard : account_api.
+
+Découpe A28 de l'ancien app/routers/dashboard.py (2 735 lignes, 63 routes) — un module par concern, contrat inchangé.
+"""
+from __future__ import annotations
+
+import logging
+
+from fastapi import APIRouter, Body, HTTPException, Request
+
+from app.db import get_conn
+
+from ._common import _require_user_id
+
+logger = logging.getLogger(__name__)
+router = APIRouter(tags=["dashboard"])
+
+
+
+
+@router.put("/api/user/profile")
+def update_profile(request: Request, body: dict = Body(default={})):
+    full_name = body.get("full_name", "").strip()
+    uid = _require_user_id(request)
+    with get_conn() as conn:
+        conn.execute("UPDATE users SET full_name=? WHERE id=?", (full_name, uid))
+        conn.commit()
+    return {"status": "ok"}
+
+
+
+
+@router.put("/api/user/password")
+def update_password(request: Request, body: dict = Body(default={})):
+    from app.password_utils import hash_password, verify_password
+    password = body.get("password", "").strip()
+    if len(password) < 6:
+        return {"error": "Password must be at least 6 characters"}
+    uid = _require_user_id(request)
+    # A3 : le mot de passe actuel est exigé (session volée ≠ droit de changer le mdp).
+    current = body.get("current_password", "")
+    with get_conn() as conn:
+        row = conn.execute("SELECT password_hash FROM users WHERE id=?", (uid,)).fetchone()
+        if not row or not verify_password(current, row["password_hash"]):
+            raise HTTPException(403, "Current password is incorrect")
+        conn.execute("UPDATE users SET password_hash=? WHERE id=?", (hash_password(password), uid))
+        conn.commit()
+    return {"status": "ok"}
+
+
+
+
+@router.post("/api/user/token")
+def generate_token(request: Request):
+    import secrets
+    uid = _require_user_id(request)
+    token = secrets.token_hex(32)
+    with get_conn() as conn:
+        conn.execute(
+            "INSERT OR REPLACE INTO user_tokens (gitea_user_id, gitea_token, updated_at) VALUES (?, ?, CURRENT_TIMESTAMP)",
+            (uid, token),
+        )
+        conn.commit()
+    return {"token": f"fd_{token}"}
+
+
+
+
+@router.delete("/api/user/forge/{provider}")
+def disconnect_forge(request: Request, provider: str):
+    uid = _require_user_id(request)
+    with get_conn() as conn:
+        conn.execute(
+            "DELETE FROM user_oauth_tokens WHERE user_id=? AND provider=?", (uid, provider)
+        )
+        conn.commit()
+    return {"status": "ok"}

app/routers/dashboard/account_settings.py

@@ -0,0 +1,439 @@
+"""FlowDeck — Dashboard : settings.
+
+Découpe A28 de l'ancien app/routers/dashboard.py (2 735 lignes, 63 routes) — un module par concern, contrat inchangé.
+"""
+from __future__ import annotations
+
+import logging
+
+from fastapi import APIRouter, Body, Request
+from fastapi.responses import HTMLResponse, JSONResponse, RedirectResponse
+
+from app.auth.session import SessionManager
+from app.db import get_conn
+
+from ._common import _format_size, _get_active_workspace, _get_user_id, _sidebar_data
+
+logger = logging.getLogger(__name__)
+router = APIRouter(tags=["dashboard"])
+
+
+
+
+# ═══════════ Settings Page ═══════════
+
+@router.get("/settings", response_class=HTMLResponse)
+def app_settings_page(request: Request):
+    """Settings & configuration page."""
+    from app.templating import ENV
+    env = ENV
+    sidebar = _sidebar_data(request, [])
+    user = SessionManager.decode_session(request.cookies.get("flowdeck_session", ""))
+    if not user:
+        return RedirectResponse("/auth/login?provider=local", status_code=302)
+    ctx = {**sidebar, "user": user}
+    # Pass active workspace for breadcrumb nav menu
+    ws = _get_active_workspace(request, user_id=_get_user_id(request))
+    ctx["nav_workspace_id"] = ws["id"] if ws else 0
+    template = env.get_template("settings.html")
+    return template.render(**ctx)
+
+
+
+
+@router.post("/api/settings/avatar")
+async def upload_avatar(request: Request):
+    """Upload a user avatar image."""
+    import os
+    import uuid
+    from pathlib import Path
+    form = await request.form()
+    file = form.get("file")
+    if not file:
+        return {"error": "No file"}, 400
+    user = SessionManager.decode_session(request.cookies.get("flowdeck_session", ""))
+    if not user:
+        return {"error": "Not authenticated"}, 401
+    # Save to data/avatars
+    avatars_dir = Path("/data/avatars")
+    avatars_dir.mkdir(parents=True, exist_ok=True)
+    ext = os.path.splitext(file.filename)[1] or ".png"
+    filename = f"{user['id']}_{uuid.uuid4().hex[:8]}{ext}"
+    filepath = avatars_dir / filename
+    content = await file.read()
+    filepath.write_bytes(content)
+    # Update user avatar_url
+    avatar_url = f"/api/settings/avatar/{filename}"
+    with get_conn() as conn:
+        conn.execute("UPDATE users SET avatar_url = ? WHERE id = ?", (avatar_url, user["id"]))
+        conn.commit()
+    return {"avatar_url": avatar_url}
+
+
+
+
+@router.get("/api/settings/avatar/{filename:path}")
+def serve_avatar_file(filename: str):
+    """Serve an uploaded avatar image file."""
+    from pathlib import Path
+
+    from fastapi.responses import FileResponse
+    # A11 : garde path traversal (motif de serve_uploaded_file) — `:path` Starlette
+    # accepte les `/`, donc `..%2f` ressortirait du dossier avatars.
+    base_dir = Path("/data/avatars").resolve()
+    filepath = (base_dir / filename).resolve()
+    try:
+        filepath.relative_to(base_dir)
+    except ValueError:
+        return JSONResponse({"error": "Path traversal denied"}, status_code=403)
+    if not filepath.is_file():
+        return JSONResponse({"error": "Not found"}, status_code=404)
+    return FileResponse(filepath)
+
+
+
+
+@router.get("/api/avatar/{user_id:int}")
+def get_avatar(user_id: int):
+    """Redirect to the user's avatar."""
+    with get_conn() as conn:
+        row = conn.execute("SELECT avatar_url FROM users WHERE id = ?", (user_id,)).fetchone()
+    if row and row["avatar_url"]:
+        return RedirectResponse(row["avatar_url"], status_code=302)
+    return JSONResponse({"error": "No avatar"}, status_code=404)
+
+
+
+
+@router.post("/api/settings/avatar-color")
+def set_avatar_color(request: Request, body: dict = Body(default={})):
+    """Set the user's avatar background color."""
+    color = body.get("color", "#3A3A3A")
+    user = SessionManager.decode_session(request.cookies.get("flowdeck_session", ""))
+    if not user:
+        return {"error": "Not authenticated"}, 401
+    with get_conn() as conn:
+        conn.execute("UPDATE users SET avatar_url = '', avatar_color = ? WHERE id = ?", (color, user["id"]))
+        conn.commit()
+    return {"status": "ok", "color": color}
+
+
+# ═══════════ Tag Management API (per-user) ═══════════
+
+
+
+
+# ═══════════ Tag Management API (per-user) ═══════════
+
+@router.post("/api/settings/tags")
+def create_tag_global(request: Request, body: dict = Body(default={})):
+    """Create a tag for the current user."""
+    tag_name = body.get("name", "").strip().lower()
+    color = body.get("color", "#787774")
+    uid = _get_user_id(request)
+    if not tag_name or not uid:
+        return {"error": "Tag name required"}, 400
+    with get_conn() as conn:
+        tag = conn.execute("SELECT id FROM tags WHERE name = ? AND user_id = ?", (tag_name, uid)).fetchone()
+        if tag:
+            conn.execute("UPDATE tags SET color = ? WHERE id = ?", (color, tag["id"]))
+            conn.commit()
+            return {"tag": {"id": tag["id"], "name": tag_name, "color": color}}
+        cursor = conn.execute("INSERT INTO tags (name, color, user_id) VALUES (?, ?, ?)", (tag_name, color, uid))
+        conn.commit()
+        return {"tag": {"id": cursor.lastrowid, "name": tag_name, "color": color}}
+
+
+
+
+@router.put("/api/settings/tags/{tag_id:int}")
+def update_tag_global(tag_id: int, request: Request, body: dict = Body(default={})):
+    """Update a tag (name or color) — only if owned by user."""
+    uid = _get_user_id(request)
+    with get_conn() as conn:
+        if "name" in body:
+            conn.execute("UPDATE tags SET name = ? WHERE id = ? AND user_id = ?", (body["name"].strip().lower(), tag_id, uid))
+        if "color" in body:
+            conn.execute("UPDATE tags SET color = ? WHERE id = ? AND user_id = ?", (body["color"], tag_id, uid))
+        conn.commit()
+    return {"status": "ok"}
+
+
+
+
+@router.delete("/api/settings/tags/{tag_id:int}")
+def delete_tag_global(tag_id: int, request: Request):
+    """Delete a tag — only if owned by user."""
+    uid = _get_user_id(request)
+    with get_conn() as conn:
+        conn.execute("DELETE FROM page_tags WHERE tag_id = ?", (tag_id,))
+        conn.execute("DELETE FROM tags WHERE id = ? AND user_id = ?", (tag_id, uid))
+        conn.commit()
+    return {"status": "ok"}
+
+
+
+
+@router.get("/api/settings/tags/all")
+def list_all_tags_global(request: Request):
+    """List current user's tags with counts."""
+    uid = _get_user_id(request)
+    with get_conn() as conn:
+        rows = conn.execute(
+            "SELECT t.id, t.name, t.color, COUNT(pt.page_id) as count "
+            "FROM tags t LEFT JOIN page_tags pt ON pt.tag_id = t.id "
+            "WHERE t.user_id = ? GROUP BY t.id ORDER BY t.name",
+            (uid,),
+        ).fetchall()
+    return JSONResponse(
+        {"tags": [dict(r) for r in rows]},
+        headers={"Cache-Control": "no-store"},
+    )
+
+
+# ═══════════ Workspace Tags API ═══════════
+
+
+
+
+# ═══════════ Workspace Tags API ═══════════
+
+@router.get("/api/local-workspace/tags")
+def list_tags(request: Request):
+    """List ALL user tags with counts scoped to the active workspace."""
+    ws = _get_active_workspace(request, user_id=_get_user_id(request))
+    ws_id = ws["id"] if ws else None
+    uid = _get_user_id(request)
+    if not ws_id:
+        return {"tags": []}
+    with get_conn() as conn:
+        rows = conn.execute(
+            "SELECT t.id, t.name, t.color, "
+            "(SELECT COUNT(*) FROM page_tags pt "
+            " JOIN pages p ON p.id = pt.page_id AND p.workspace_id = ? "
+            " WHERE pt.tag_id = t.id) as count "
+            "FROM tags t WHERE t.user_id = ? ORDER BY t.name",
+            (ws_id, uid),
+        ).fetchall()
+    return JSONResponse(
+        {"tags": [dict(r) for r in rows]},
+        headers={"Cache-Control": "no-store"},
+    )
+
+
+
+
+@router.get("/api/local-workspace/items/{item_id:int}/tags")
+def get_item_tags(item_id: int):
+    """Get tags for a specific item."""
+    with get_conn() as conn:
+        rows = conn.execute(
+            "SELECT t.id, t.name, t.color FROM tags t "
+            "JOIN page_tags pt ON pt.tag_id = t.id "
+            "WHERE pt.page_id = ? ORDER BY t.name",
+            (item_id,),
+        ).fetchall()
+    return {"tags": [dict(r) for r in rows]}
+
+
+
+
+@router.post("/api/local-workspace/items/{item_id:int}/tags")
+def add_item_tag(request: Request, item_id: int, body: dict = Body(default={})):
+    """Add a tag to an item (creates tag if new, scoped to user)."""
+    tag_name = body.get("name", "").strip().lower()
+    tag_color = body.get("color", "#787774")
+    uid = _get_user_id(request)
+    if not tag_name:
+        return {"error": "Tag name required"}, 400
+
+    with get_conn() as conn:
+        # Get or create tag (per user)
+        tag = conn.execute("SELECT id, name, color FROM tags WHERE name = ? AND user_id = ?", (tag_name, uid)).fetchone()
+        if not tag:
+            cursor = conn.execute(
+                "INSERT INTO tags (name, color, user_id) VALUES (?, ?, ?)", (tag_name, tag_color, uid)
+            )
+            conn.commit()
+            tag_id = cursor.lastrowid
+            tag = {"id": tag_id, "name": tag_name, "color": tag_color}
+        else:
+            tag_id = tag["id"]
+
+        # Link tag to page (ignore duplicate)
+        try:
+            conn.execute(
+                "INSERT OR IGNORE INTO page_tags (page_id, tag_id) VALUES (?, ?)",
+                (item_id, tag_id),
+            )
+            conn.commit()
+        except Exception:
+            logger.exception("add_item_tag")
+
+    return {"tag": {"id": tag["id"], "name": tag["name"], "color": tag["color"]}}
+
+
+
+
+@router.delete("/api/local-workspace/items/{item_id:int}/tags/{tag_id:int}")
+def remove_item_tag(item_id: int, tag_id: int):
+    """Remove a tag from an item."""
+    with get_conn() as conn:
+        conn.execute(
+            "DELETE FROM page_tags WHERE page_id = ? AND tag_id = ?",
+            (item_id, tag_id),
+        )
+        conn.commit()
+    return {"status": "ok"}
+
+
+
+
+@router.get("/api/local-workspace/tags/search")
+def search_by_tags(request: Request, tags: str = ""):
+    """Search items by tags (comma-separated)."""
+    ws = _get_active_workspace(request, user_id=_get_user_id(request))
+    ws_id = ws["id"] if ws else None
+    if not ws_id:
+        return {"items": []}
+    tag_names = [t.strip().lower() for t in tags.split(",") if t.strip()]
+    if not tag_names:
+        return {"items": []}
+    with get_conn() as conn:
+        placeholders = ",".join("?" for _ in tag_names)
+        rows = conn.execute(
+            f"SELECT DISTINCT p.id, p.title, p.content_format, p.parent_section, "
+            f"p.content, p.created_at, p.updated_at "
+            f"FROM pages p "
+            f"JOIN page_tags pt ON pt.page_id = p.id "
+            f"JOIN tags t ON t.id = pt.tag_id "
+            f"WHERE t.name IN ({placeholders}) AND p.workspace_id = ? AND p.deleted_at IS NULL "
+            f"ORDER BY p.updated_at DESC",
+            tag_names + [ws_id],
+        ).fetchall()
+    items = []
+    for r in rows:
+        is_folder = r["parent_section"] == "Workspace"
+        size = len(r["content"] or "")
+        items.append({
+            "id": r["id"],
+            "name": r["title"] or "Untitled",
+            "is_folder": is_folder,
+            "content_format": r["content_format"],
+            "created_at": r["created_at"],
+            "updated_at": r["updated_at"],
+            "size": size,
+            "size_display": _format_size(size),
+        })
+    return {"items": items}
+
+
+# ── Account update ──
+
+
+
+
+# ── Account update ──
+@router.put("/api/settings/account")
+def update_account(request: Request, body: dict = Body(default={})):
+    """Update current user's profile: full_name, login, email, password."""
+    from app.password_utils import hash_password
+    user = SessionManager.decode_session(request.cookies.get("flowdeck_session", ""))
+    if not user:
+        return JSONResponse({"error": "Not authenticated"}, status_code=401)
+    with get_conn() as conn:
+        uid = user["id"]
+        if "full_name" in body:
+            conn.execute("UPDATE users SET full_name=? WHERE id=?", (body["full_name"].strip(), uid))
+        if "login" in body:
+            new_login = body["login"].strip()
+            if new_login and new_login != user.get("login"):
+                existing = conn.execute("SELECT id FROM users WHERE login=? AND id!=?", (new_login, uid)).fetchone()
+                if existing:
+                    return JSONResponse({"error": "Username already taken"}, status_code=409)
+                conn.execute("UPDATE users SET login=? WHERE id=?", (new_login, uid))
+        if "email" in body:
+            conn.execute("UPDATE users SET email=? WHERE id=?", (body["email"].strip(), uid))
+        if "password" in body and body["password"].strip():
+            pw = body["password"].strip()
+            if len(pw) < 6:
+                return JSONResponse({"error": "Password must be at least 6 characters"}, status_code=400)
+            conn.execute("UPDATE users SET password_hash=? WHERE id=?", (hash_password(pw), uid))
+        conn.commit()
+        row = conn.execute("SELECT * FROM users WHERE id=?", (uid,)).fetchone()
+        user_data = dict(row)
+    # Refresh session cookie with updated data (keeps the same session id)
+    cookie = request.cookies.get("flowdeck_session", "")
+    new_session = SessionManager.refresh_session(cookie, user_data, request)
+    response = JSONResponse({"status": "ok", "user": {k: user_data[k] for k in ("id","login","full_name","email","is_admin")}})
+    response.set_cookie("flowdeck_session", new_session, httponly=True, max_age=86400 * 7, samesite="lax", path="/")
+    return response
+
+
+# ═══════════ Sidebar Refresh API ═══════════
+
+
+
+
+# ═══════════ Sidebar Refresh API ═══════════
+
+@router.get("/api/sidebar/workspace-tree")
+def sidebar_workspace_tree(request: Request):
+    """Return the sidebar workspace tree as HTML fragment.
+
+    Called by appState().refreshSidebarTree() after CRUD operations
+    in the main content area to keep the sidebar in sync.
+    """
+    from app.routers.board import _load_workspace_pages
+    from app.templating import ENV
+
+    user = SessionManager.decode_session(request.cookies.get("flowdeck_session", ""))
+    if not user:
+        return HTMLResponse("")
+
+    ws_cookie = request.cookies.get("flowdeck_workspace", "")
+    if not ws_cookie:
+        return HTMLResponse('<li class="sidebar-item empty-hint"><span class="page-icon">📄</span><span class="page-name text-dim">No pages yet</span></li>')
+
+    # Gitea workspace — no server-side tree, loaded client-side
+    if ws_cookie.startswith("gitea:"):
+        return HTMLResponse('<li class="sidebar-item empty-hint"><span class="page-icon">🔗</span><span class="page-name text-dim">Remote workspace</span></li>')
+
+    try:
+        ws_id = int(ws_cookie)
+        with get_conn() as conn:
+            # Verify workspace belongs to user
+            row = conn.execute(
+                "SELECT id FROM workspaces WHERE id=? AND owner_id=?",
+                (ws_id, user["id"])
+            ).fetchone()
+            if not row:
+                return HTMLResponse(
+                    '<li class="sidebar-item empty-hint"><span class="page-icon">📄</span>'
+                    '<span class="page-name text-dim">No pages yet</span></li>'
+                )
+
+        pages = _load_workspace_pages(ws_cookie)
+        if not pages:
+            return HTMLResponse(
+                '<li class="sidebar-item empty-hint"><span class="page-icon">📄</span>'
+                '<span class="page-name text-dim">No pages yet</span></li>'
+            )
+
+        # Render the tree using the extracted macro
+        env = ENV
+        template = env.from_string(
+            "{% from '_workspace_tree_macro.html' import render_workspace_tree %}"
+            "{{ render_workspace_tree(pages) }}"
+        )
+        html = template.render(pages=pages)
+        return HTMLResponse(html)
+    except (ValueError, Exception) as e:
+        logger.error(f"sidebar_workspace_tree failed: {e}", exc_info=True)
+        return HTMLResponse(
+            '<li class="sidebar-item empty-hint"><span class="page-icon">📄</span>'
+            '<span class="page-name text-dim">No pages yet</span></li>'
+        )
+
+
+# ═══════════ Public Published Page ═══════════

app/routers/dashboard/local_workspace.py

@@ -0,0 +1,559 @@
+"""FlowDeck — Dashboard : local_workspace.
+
+Découpe A28 de l'ancien app/routers/dashboard.py (2 735 lignes, 63 routes) — un module par concern, contrat inchangé.
+"""
+from __future__ import annotations
+
+import logging
+from datetime import UTC
+
+from fastapi import APIRouter, Body, Request
+from fastapi.responses import HTMLResponse, JSONResponse, RedirectResponse
+
+from app.auth.session import SessionManager
+from app.config import settings
+from app.db import get_conn
+
+from ._common import (
+    _build_breadcrumb,
+    _build_tree_children,
+    _file_page_disk_path,
+    _get_active_workspace,
+    _get_user_id,
+    _require_page_view,
+    _require_user_id,
+    _sidebar_data,
+)
+
+logger = logging.getLogger(__name__)
+router = APIRouter(tags=["dashboard"])
+
+
+
+
+# ═══════════ Local Workspace (file/folder CRUD) ═══════════
+
+@router.get("/local-workspace", response_class=HTMLResponse)
+def local_workspace_page(request: Request, folder: int = None):
+    """Local workspace page with file/folder tree.
+
+    If ?folder=ID is provided, shows that folder's contents with breadcrumb.
+    """
+    from app.templating import ENV
+    env = ENV
+    sidebar = _sidebar_data(request, [])
+    user = SessionManager.decode_session(request.cookies.get("flowdeck_session", ""))
+    if not user:
+        return RedirectResponse("/auth/login?provider=local", status_code=302)
+
+    ws = _get_active_workspace(request, user_id=user["id"])
+    ws_id = ws["id"] if ws else None
+
+    # If no workspace exists for this user, redirect to workspaces page
+    if not ws_id:
+        return RedirectResponse("/workspaces", status_code=302)
+
+    # Build breadcrumb if navigating into a folder
+    breadcrumb = []
+    current_folder_id = folder
+    if folder and ws_id:
+        with get_conn() as conn:
+            breadcrumb = _build_breadcrumb(conn, folder)
+
+    ctx = {
+        **sidebar,
+        "user": user,
+        "workspace_name": sidebar.get("active_ws_name", "My Workspace"),
+        "current_folder_id": current_folder_id or 0,
+        "workspace_id": ws_id or 0,
+        "nav_workspace_id": ws_id or 0,
+        "breadcrumb": breadcrumb,
+        "breadcrumbs": breadcrumb,
+    }
+    template = env.get_template("local_workspace.html")
+    return HTMLResponse(
+        content=template.render(**ctx),
+        headers={
+            "Cache-Control": "no-cache, no-store, must-revalidate",
+            "Pragma": "no-cache",
+            "Expires": "0",
+        }
+    )
+
+
+
+
+@router.get("/api/local-workspace/tree")
+def local_workspace_tree(request: Request, folder: int = None):
+    """Return the file/folder tree filtered by active workspace.
+
+    If ?folder=ID is provided, returns only that folder's children.
+    Otherwise returns the full recursive tree from root.
+    """
+    ws = _get_active_workspace(request, user_id=_get_user_id(request))
+    ws_id = ws["id"] if ws else None
+    if not ws_id:
+        return {"tree": [], "breadcrumb": []}
+    uid = _get_user_id(request)
+
+    with get_conn() as conn:
+        if folder:
+            # Show only this folder's children + build breadcrumb
+            children = _build_tree_children(conn, folder, ws_id, uid)
+            breadcrumb = _build_breadcrumb(conn, folder)
+            return {"tree": children, "breadcrumb": breadcrumb, "current_folder": folder}
+        else:
+            # Full tree from root
+            roots = _build_tree_children(conn, None, ws_id, uid)
+            return {"tree": roots, "breadcrumb": [], "current_folder": None}
+
+
+
+
+@router.get("/api/local-workspace/page-content/{page_id:int}")
+def get_page_content(page_id: int):
+    """Return the raw content of a page (for preview)."""
+    with get_conn() as conn:
+        row = conn.execute(
+            "SELECT content, content_format FROM pages WHERE id=?", (page_id,)
+        ).fetchone()
+    if not row:
+        return JSONResponse({"error": "Not found"}, status_code=404)
+    fmt = row["content_format"]
+    if fmt == "file":
+        return JSONResponse({"content": "(uploaded file)", "format": fmt})
+    # v6.5.0: resolve synced blocks server-side (fresh content on read).
+    from app.services.synced_blocks import resolve_content_json
+    return {"content": resolve_content_json(row["content"] or "", fmt), "format": fmt}
+
+
+
+
+@router.get("/api/pages/{page_id}/download")
+def download_page_file(request: Request, page_id: int):
+    """Download the original uploaded file of a ``file`` page (attachment)."""
+    _require_page_view(request, page_id)
+    with get_conn() as conn:
+        row = conn.execute(
+            "SELECT id, title, content, content_format FROM pages "
+            "WHERE id=? AND deleted_at IS NULL",
+            (page_id,),
+        ).fetchone()
+    if not row:
+        return JSONResponse({"error": "Not found"}, status_code=404)
+    resolved = _file_page_disk_path(dict(row))
+    if not resolved:
+        return JSONResponse({"error": "No downloadable file"}, status_code=404)
+    full, filename, mime, _size = resolved
+    from fastapi.responses import FileResponse
+    return FileResponse(
+        str(full), media_type=mime or "application/octet-stream",
+        filename=filename, content_disposition_type="attachment",
+    )
+
+
+
+
+@router.get("/api/pages/{page_id}/file-content")
+def page_file_content(request: Request, page_id: int):
+    """Return the textual content of a ``file`` page (for copy to clipboard).
+
+    Binary files (PDF, images…) answer ``{ok: false}`` — the clipboard copy is
+    only meaningful for plain-text / code / markdown files.
+    """
+    from app.services.export import _file_text
+
+    _require_page_view(request, page_id)
+    with get_conn() as conn:
+        row = conn.execute(
+            "SELECT id, title, content, content_format FROM pages "
+            "WHERE id=? AND deleted_at IS NULL",
+            (page_id,),
+        ).fetchone()
+    if not row:
+        return JSONResponse({"error": "Not found"}, status_code=404)
+    page = dict(row)
+    text = _file_text(page)
+    if text is None:
+        return JSONResponse(
+            {"ok": False, "error": "Not a textual file", "name": page.get("title", "")},
+            status_code=415,
+        )
+    return {"ok": True, "name": page.get("title") or "File", "content": text}
+
+
+
+
+@router.get("/api/local-workspace/breadcrumb")
+def local_workspace_breadcrumb(request: Request, folder: int):
+    """Return breadcrumb trail for a folder."""
+    with get_conn() as conn:
+        breadcrumb = _build_breadcrumb(conn, folder)
+    return {"breadcrumb": breadcrumb}
+
+
+
+
+@router.get("/api/nav/menu")
+def nav_menu(request: Request, workspace_id: int = None, parent_id: int = None):
+    """Return the pages at one level for the header breadcrumb navigation menu.
+
+    If ``parent_id`` is given, returns that page's children; otherwise the
+    workspace's root pages. Each item includes ``has_children`` so the frontend
+    can render an expandable sub-menu.
+    """
+    from app.routers.board import _file_icon
+    ws_id = workspace_id
+    if not ws_id:
+        ws = _get_active_workspace(request, user_id=_get_user_id(request))
+        ws_id = ws["id"] if ws else None
+    if not ws_id:
+        return {"items": []}
+    with get_conn() as conn:
+        if parent_id:
+            rows = conn.execute(
+                "SELECT id, title, parent_section, content_format FROM pages "
+                "WHERE parent_id=? AND workspace_id=? AND deleted_at IS NULL "
+                "ORDER BY sort_order ASC, created_at DESC",
+                (parent_id, ws_id),
+            ).fetchall()
+        else:
+            rows = conn.execute(
+                "SELECT id, title, parent_section, content_format FROM pages "
+                "WHERE parent_id IS NULL AND workspace_id=? AND deleted_at IS NULL AND collection_row_id IS NULL "
+                "ORDER BY sort_order ASC, created_at DESC",
+                (ws_id,),
+            ).fetchall()
+        ids = [r["id"] for r in rows]
+        child_counts = {}
+        if ids:
+            placeholders = ",".join("?" for _ in ids)
+            cc_rows = conn.execute(
+                f"SELECT parent_id, COUNT(*) AS c FROM pages "
+                f"WHERE parent_id IN ({placeholders}) AND deleted_at IS NULL "
+                f"GROUP BY parent_id",
+                ids,
+            ).fetchall()
+            for cr in cc_rows:
+                child_counts[cr["parent_id"]] = cr["c"]
+        items = []
+        for r in rows:
+            is_folder = r["parent_section"] == "Workspace"
+            title = r["title"] or "Untitled"
+            items.append({
+                "id": r["id"],
+                "name": title,
+                "icon": "folder" if is_folder else _file_icon(title, r["content_format"]),
+                "has_children": child_counts.get(r["id"], 0) > 0,
+                "url": f"/pages/{r['id']}",
+            })
+    return {"items": items}
+
+
+
+
+@router.post("/api/local-workspace/items")
+def create_local_workspace_item(request: Request, body: dict = Body(default={})):
+    """Create a new file in the active workspace."""
+    name = (body.get("name") or "").strip() or "Untitled"
+    item_type = body.get("type", "page")
+    parent_id = body.get("parent_id")
+    explicit_ws_id = body.get("workspace_id")
+    ws = _get_active_workspace(request, user_id=_get_user_id(request))
+    ws_id = explicit_ws_id or (ws["id"] if ws else None)
+    ws_key = (ws["name"] if ws else "Workspace") if not explicit_ws_id else ""
+    section = 'Workspace' if item_type == 'folder' else 'Private'
+    with get_conn() as conn:
+        cursor = conn.execute(
+            "INSERT INTO pages (workspace, workspace_id, title, content, content_format, parent_section, parent_id) "
+            "VALUES (?, ?, ?, '', 'blocks', ?, ?)",
+            (ws_key, ws_id, name, section, parent_id)
+        )
+        conn.commit()
+        pid = cursor.lastrowid
+    return {"id": pid, "name": name, "type": item_type}
+
+
+
+
+@router.put("/api/local-workspace/items/{item_id:int}")
+def rename_local_workspace_item(request: Request, item_id: int, body: dict = Body(default={})):
+    """Rename a file."""
+    name = body.get("name", "Untitled").strip()
+    with get_conn() as conn:
+        conn.execute("UPDATE pages SET title=? WHERE id=?", (name, item_id))
+        conn.commit()
+    return {"status": "ok"}
+
+
+
+
+@router.delete("/api/local-workspace/items/{item_id:int}")
+def delete_local_workspace_item(request: Request, item_id: int):
+    """Soft-delete a file/folder (sets deleted_at)."""
+    from datetime import datetime
+    with get_conn() as conn:
+        conn.execute(
+            "UPDATE pages SET deleted_at=? WHERE id=? AND deleted_at IS NULL",
+            (datetime.now(UTC).replace(tzinfo=None).isoformat(), item_id),
+        )
+        conn.commit()
+    return {"status": "ok"}
+
+
+
+
+@router.post("/api/local-workspace/items/{item_id:int}/restore")
+def restore_local_workspace_item(request: Request, item_id: int):
+    """Restore a soft-deleted file/folder."""
+    with get_conn() as conn:
+        conn.execute(
+            "UPDATE pages SET deleted_at=NULL WHERE id=?",
+            (item_id,),
+        )
+        conn.commit()
+    return {"status": "ok"}
+
+
+
+
+@router.get("/api/files/{ws_id:int}/{filename:path}")
+def serve_uploaded_file(ws_id: int, filename: str):
+    """Serve an uploaded file from disk."""
+    import mimetypes
+    from pathlib import Path
+    root = Path(settings.data_dir)
+    base_dir = (root / f"uploads/workspace_{ws_id}").resolve()
+    fp = (base_dir / filename).resolve()
+    try:
+        fp.relative_to(base_dir)
+    except ValueError:
+        return JSONResponse({"error": "Path traversal denied"}, status_code=403)
+    if not fp.exists():
+        return JSONResponse({"error": "File not found"}, status_code=404)
+    mime, _ = mimetypes.guess_type(str(fp))
+    content = fp.read_bytes()
+    from fastapi.responses import Response
+    return Response(content=content, media_type=mime or "application/octet-stream")
+
+
+
+
+@router.put("/api/local-workspace/items/{item_id:int}/move")
+def move_local_workspace_item(request: Request, item_id: int, body: dict = Body(default={})):
+    """Move an item to a new parent (drag & drop)."""
+    new_parent_id = body.get("parent_id")  # None = move to root
+    with get_conn() as conn:
+        conn.execute(
+            "UPDATE pages SET parent_id=? WHERE id=?",
+            (new_parent_id, item_id),
+        )
+        conn.commit()
+    return {"status": "ok"}
+
+
+
+
+@router.post("/api/local-workspace/upload")
+async def upload_local_workspace_file(request: Request):
+    """Upload one or more files via drag-and-drop.
+
+    Accepts multipart form with 'files' field (one or multiple files).
+    Optional: 'parent_id' to place files in a specific folder.
+    Stores files on disk at /data/uploads/workspace_{id}/ and creates DB records.
+    """
+    import json
+    from pathlib import Path
+
+    uid = _require_user_id(request)  # A22 : pas d'upload anonyme
+    ws = _get_active_workspace(request, user_id=uid)
+    ws_id = ws["id"] if ws else None
+    if not ws_id:
+        return JSONResponse({"error": "No active workspace"}, status_code=400)
+
+    try:
+        form = await request.form()
+    except Exception:
+        return JSONResponse({"error": "Invalid form data"}, status_code=400)
+
+    parent_id_raw = form.get("parent_id")
+    parent_id = int(parent_id_raw) if parent_id_raw else None
+    files = form.getlist("files")
+
+    if not files:
+        return JSONResponse({"error": "No files provided"}, status_code=400)
+
+
+    from app.middleware.security import validate_upload
+
+    data_root = Path(settings.data_dir)
+    upload_dir = data_root / f"uploads/workspace_{ws_id}"
+    upload_dir.mkdir(parents=True, exist_ok=True)
+
+    results = []
+    with get_conn() as conn:
+        for f in files:
+            filename = f.filename or "untitled"
+            # Sanitize filename: only keep basename, prevent path traversal
+            safe_name = Path(filename).name
+            if not safe_name:
+                safe_name = "untitled"
+
+            # Unique filename on disk
+            file_path = upload_dir / safe_name
+            stem, suffix = file_path.stem, file_path.suffix
+            counter = 1
+            while file_path.exists():
+                file_path = upload_dir / f"{stem} ({counter}){suffix}"
+                counter += 1
+
+            content = await f.read()
+            err = validate_upload(safe_name, len(content))  # A22 : taille + extension
+            if err:
+                results.append({"name": safe_name, "error": err})
+                continue
+            file_path.write_bytes(content)
+
+            # Determine if this is a folder marker or actual file
+            rel_path = str(file_path.relative_to(data_root))
+            size = len(content)
+            mime = f.content_type or "application/octet-stream"
+
+            cursor = conn.execute(
+                """INSERT INTO pages (workspace, workspace_id, title, content, content_format, parent_section, parent_id)
+                   VALUES ('', ?, ?, ?, 'file', 'Private', ?)""",
+                (ws_id, file_path.name,
+                 json.dumps({"file_path": rel_path, "size": size, "mime_type": mime}),
+                 parent_id),
+            )
+            results.append({"id": cursor.lastrowid, "name": file_path.name, "type": "page", "size": size})
+
+        conn.commit()
+
+    return {"status": "ok", "items": results}
+
+
+
+
+@router.post("/api/local-workspace/upload-folder")
+async def upload_local_workspace_folder(request: Request):
+    """Handle recursive folder upload.
+
+    Frontend walks the directory tree with webkitGetAsEntry and sends:
+    - 'structure': JSON array of {path: str, type: 'folder'|'file'}
+    - 'files': multipart files (one per file in the structure)
+    - 'parent_id': target folder (optional)
+
+    Creates folders first, then uploads files into their respective folders.
+    """
+    import json
+    from pathlib import Path
+
+    uid = _require_user_id(request)  # A22 : pas d'upload anonyme
+    ws = _get_active_workspace(request, user_id=uid)
+    ws_id = ws["id"] if ws else None
+    if not ws_id:
+        return JSONResponse({"error": "No active workspace"}, status_code=400)
+
+    try:
+        form = await request.form()
+    except Exception:
+        return JSONResponse({"error": "Invalid form data"}, status_code=400)
+
+    parent_id_raw = form.get("parent_id")
+    root_parent_id = int(parent_id_raw) if parent_id_raw else None
+    structure_raw = form.get("structure")
+
+    if not structure_raw:
+        return JSONResponse({"error": "No structure provided"}, status_code=400)
+
+    try:
+        structure = json.loads(structure_raw)
+    except json.JSONDecodeError:
+        return JSONResponse({"error": "Invalid structure JSON"}, status_code=400)
+
+
+    from app.middleware.security import validate_upload
+
+    data_root = Path(settings.data_dir)
+    upload_dir = data_root / f"uploads/workspace_{ws_id}"
+    upload_dir.mkdir(parents=True, exist_ok=True)
+
+    results = []
+    created_folders = {}  # relative_path -> db_id
+
+    with get_conn() as conn:
+        # Phase 1: Create all folders
+        for item in structure:
+            if item.get("type") != "folder":
+                continue
+            path_parts = item["path"].strip("/").split("/")
+            folder_name = path_parts[-1]
+            # Determine parent: parent of this folder in the tree
+            if len(path_parts) == 1:
+                actual_parent = root_parent_id
+            else:
+                parent_path = "/".join(path_parts[:-1])
+                actual_parent = created_folders.get(parent_path)
+
+            cursor = conn.execute(
+                """INSERT INTO pages (workspace, workspace_id, title, content, content_format, parent_section, parent_id)
+                   VALUES ('', ?, ?, '', 'blocks', 'Workspace', ?)""",
+                (ws_id, folder_name, actual_parent),
+            )
+            fid = cursor.lastrowid
+            created_folders[item["path"].strip("/")] = fid
+            results.append({"id": fid, "name": folder_name, "type": "folder"})
+
+        # Phase 2: Upload files into their respective folders
+        for item in structure:
+            if item.get("type") != "file":
+                continue
+            path_parts = item["path"].strip("/").split("/")
+            file_name = path_parts[-1]
+            if len(path_parts) == 1:
+                file_parent = root_parent_id
+            else:
+                parent_path = "/".join(path_parts[:-1])
+                file_parent = created_folders.get(parent_path)
+
+            # Find the matching file in multipart data
+            matched = None
+            for f in form.getlist("files"):
+                if f.filename and (f.filename == item["path"] or f.filename.endswith("/" + file_name)):
+                    matched = f
+                    break
+            if not matched:
+                continue
+
+            safe_name = Path(file_name).name
+            file_path = upload_dir / safe_name
+            stem, suffix = file_path.stem, file_path.suffix
+            counter = 1
+            while file_path.exists():
+                file_path = upload_dir / f"{stem} ({counter}){suffix}"
+                counter += 1
+
+            content = await matched.read()
+            err = validate_upload(safe_name, len(content))  # A22 : taille + extension
+            if err:
+                results.append({"name": safe_name, "error": err})
+                continue
+            file_path.write_bytes(content)
+
+            rel_path = str(file_path.relative_to(data_root))
+            cursor = conn.execute(
+                """INSERT INTO pages (workspace, workspace_id, title, content, content_format, parent_section, parent_id)
+                   VALUES ('', ?, ?, ?, 'file', 'Private', ?)""",
+                (ws_id, file_path.name,
+                 json.dumps({"file_path": rel_path, "size": len(content), "mime_type": matched.content_type or "application/octet-stream"}),
+                 file_parent),
+            )
+            results.append({"id": cursor.lastrowid, "name": file_path.name, "type": "page", "size": len(content)})
+
+        conn.commit()
+
+    return {"status": "ok", "items": results}
+
+
+# ═══════════ Workspaces CRUD ═══════════

app/routers/dashboard/pages_api.py

@@ -0,0 +1,240 @@
+"""FlowDeck — Dashboard : pages_api.
+
+Découpe A28 de l'ancien app/routers/dashboard.py (2 735 lignes, 63 routes) — un module par concern, contrat inchangé.
+"""
+from __future__ import annotations
+
+import logging
+
+from fastapi import APIRouter, Body, Request
+from fastapi.responses import JSONResponse
+
+from app.auth.session import SessionManager
+from app.db import get_conn
+
+logger = logging.getLogger(__name__)
+router = APIRouter(tags=["dashboard"])
+
+
+
+
+# ═══════════ Library page actions API ═══════════
+
+@router.get("/api/pages/{page_id:int}/content")
+def api_page_content(page_id: int):
+    """Get page content for side peek preview."""
+    with get_conn() as conn:
+        row = conn.execute(
+            "SELECT title, content, content_format FROM pages WHERE id=? AND deleted_at IS NULL",
+            (page_id,),
+        ).fetchone()
+        if not row:
+            return JSONResponse({"error": "Not found"}, status_code=404)
+    # v6.5.0: resolve synced blocks server-side (fresh content on read).
+    from app.services.synced_blocks import resolve_content_json
+    return {
+        "title": row["title"],
+        "content": resolve_content_json(row["content"], row["content_format"]),
+        "format": row["content_format"] or "blocks",
+    }
+
+
+
+
+@router.put("/api/pages/{page_id:int}/rename")
+def api_rename_page(page_id: int, request: Request, body: dict = Body(default={})):
+    """Inline rename a page title."""
+    title = (body.get("title") or "").strip()
+    if not title:
+        return JSONResponse({"error": "Title required"}, status_code=400)
+    with get_conn() as conn:
+        conn.execute(
+            "UPDATE pages SET title=?, updated_at=CURRENT_TIMESTAMP WHERE id=? AND deleted_at IS NULL",
+            (title, page_id),
+        )
+        # v6.5.0: renaming a database row's content page updates the row.
+        from app.services.row_pages import sync_page_title_to_row
+        sync_page_title_to_row(conn, page_id)
+        conn.commit()
+    return {"status": "ok", "title": title}
+
+
+
+
+@router.post("/api/pages/{page_id:int}/trash")
+def api_trash_page(page_id: int):
+    """Soft-delete a page (move to trash)."""
+    with get_conn() as conn:
+        conn.execute(
+            "UPDATE pages SET parent_section='Trash', deleted_at=CURRENT_TIMESTAMP WHERE id=?",
+            (page_id,),
+        )
+        conn.commit()
+    return {"status": "ok"}
+
+
+
+
+@router.post("/api/pages/{page_id:int}/convert-to-database")
+def api_convert_to_database(page_id: int, request: Request, body: dict = Body(default={})):
+    """Convert a page into a full-page database (Notion-style).
+
+    Creates a collection linked to this page, adds the default 'Name' property,
+    and sets the page's content_format to 'collection'.
+    """
+    import json as _json
+    db_name = (body.get("name") or "").strip()
+
+    with get_conn() as conn:
+        page = conn.execute(
+            "SELECT id, title, workspace_id FROM pages WHERE id=? AND deleted_at IS NULL",
+            (page_id,),
+        ).fetchone()
+        if not page:
+            return JSONResponse({"error": "Page not found"}, status_code=404)
+
+        if not db_name:
+            db_name = page["title"] or "New Database"
+
+        # Create the collection
+        cur = conn.execute(
+            """INSERT INTO collections
+               (name, description, icon, schema_json, is_inline, parent_page_id, workspace_id)
+               VALUES (?, '', '📋', '[]', 0, ?, ?)""",
+            (db_name, page_id, page["workspace_id"]),
+        )
+        collection_id = cur.lastrowid
+
+        # Create default "Name" property (text, position 0)
+        conn.execute(
+            """INSERT INTO collection_properties
+               (collection_id, name, prop_type, position, required, visible_in_views)
+               VALUES (?, 'Name', 'title', 0, 1, 1)""",
+            (collection_id,),
+        )
+
+        # Create default "Table" view
+        conn.execute(
+            """INSERT INTO collection_views
+               (collection_id, name, view_type, config_json, position)
+               VALUES (?, 'Table', 'table', ?, 0)""",
+            (collection_id, _json.dumps({"visible_properties": ["Name"]})),
+        )
+
+        # Update the page to be a database page
+        conn.execute(
+            "UPDATE pages SET content_format='collection', collection_id=?, updated_at=CURRENT_TIMESTAMP WHERE id=?",
+            (collection_id, page_id),
+        )
+
+        conn.commit()
+
+    return {
+        "status": "converted",
+        "collection_id": collection_id,
+        "name": db_name,
+        "view_url": f"/pages/{page_id}",
+    }
+
+
+
+
+@router.get("/api/collections/{collection_id:int}/table-data")
+def api_collection_table_data(collection_id: int):
+    """Get collection properties + pages for rendering the table view."""
+    with get_conn() as conn:
+        coll = conn.execute(
+            "SELECT * FROM collections WHERE id=?", (collection_id,)
+        ).fetchone()
+        if not coll:
+            return JSONResponse({"error": "Collection not found"}, status_code=404)
+
+        properties = [
+            dict(r) for r in conn.execute(
+                "SELECT * FROM collection_properties WHERE collection_id=? ORDER BY position",
+                (collection_id,),
+            ).fetchall()
+        ]
+
+        pages = [
+            dict(r) for r in conn.execute(
+                "SELECT * FROM collection_pages WHERE collection_id=? ORDER BY position",
+                (collection_id,),
+            ).fetchall()
+        ]
+
+        views = [
+            dict(r) for r in conn.execute(
+                "SELECT * FROM collection_views WHERE collection_id=? ORDER BY position",
+                (collection_id,),
+            ).fetchall()
+        ]
+
+    return {
+        "collection": dict(coll),
+        "properties": properties,
+        "pages": pages,
+        "views": views,
+    }
+
+
+
+
+@router.post("/api/collections/{collection_id:int}/pages")
+def api_create_collection_page(collection_id: int, request: Request, body: dict = Body(default={})):
+    """Create a new page (row) in a collection."""
+    import json as _json
+    title = body.get("title", "New page").strip() or "New page"
+    icon = body.get("icon", "file")
+
+    with get_conn() as conn:
+        coll = conn.execute(
+            "SELECT id FROM collections WHERE id=?", (collection_id,)
+        ).fetchone()
+        if not coll:
+            return JSONResponse({"error": "Collection not found"}, status_code=404)
+
+        # Get next position
+        max_pos = conn.execute(
+            "SELECT COALESCE(MAX(position), -1) + 1 FROM collection_pages WHERE collection_id=?",
+            (collection_id,),
+        ).fetchone()[0]
+
+        # Load default property values from collection properties
+        props = [
+            dict(r) for r in conn.execute(
+                "SELECT id, name, prop_type FROM collection_properties WHERE collection_id=? ORDER BY position",
+                (collection_id,),
+            ).fetchall()
+        ]
+        default_values = {}
+        for p in props:
+            if p["prop_type"] == "title":
+                default_values[str(p["id"])] = title
+        # Caller-provided values (e.g. board "add card in column X") win.
+        incoming = body.get("properties") or {}
+        if isinstance(incoming, dict):
+            default_values.update(incoming)
+
+        from app.services.property_types import apply_auto_properties
+        user = SessionManager.decode_session(request.cookies.get("flowdeck_session", "")) or {"login": "admin", "id": 1}
+        apply_auto_properties(props, default_values, user, is_create=True)
+
+        cur = conn.execute(
+            """INSERT INTO collection_pages
+               (collection_id, title, icon, cover_url, position, property_values_json)
+               VALUES (?, ?, ?, ?, ?, ?)""",
+            (collection_id, title, icon, body.get("cover_url", ""), max_pos,
+             _json.dumps(default_values)),
+        )
+        page_id = cur.lastrowid
+        conn.commit()
+
+    return {
+        "id": page_id,
+        "title": title,
+        "icon": icon,
+        "position": max_pos,
+        "property_values_json": default_values,
+        "status": "created",
+    }

app/routers/dashboard/pages_html.py

@@ -0,0 +1,485 @@
+"""FlowDeck — Dashboard : pages_html.
+
+Découpe A28 de l'ancien app/routers/dashboard.py (2 735 lignes, 63 routes) — un module par concern, contrat inchangé.
+"""
+from __future__ import annotations
+
+import logging
+
+from fastapi import APIRouter, Query, Request
+from fastapi.responses import HTMLResponse, RedirectResponse
+
+from app.auth.session import SessionManager
+from app.db import get_conn
+
+from ._common import _get_active_workspace, _get_user_id, _nav_breadcrumb, _sidebar_data
+
+logger = logging.getLogger(__name__)
+router = APIRouter(tags=["dashboard"])
+
+
+
+
+@router.get("/trash", response_class=HTMLResponse)
+def trash_page(request: Request, owner: str = Query(default=""), repo: str = Query(default="")):
+    """Trash page — scoped to workspace if owner/repo provided."""
+    from app.routers.board import _sidebar_data as board_sidebar
+    from app.templating import ENV
+    env = ENV
+    sidebar = board_sidebar(request, owner, repo)
+    with get_conn() as conn:
+        ws_key = f"{owner}/{repo}" if owner and repo else ""
+        # Pages are soft-deleted via parent_section='Trash'
+        if ws_key:
+            rows = conn.execute(
+                "SELECT id, title, workspace FROM pages WHERE parent_section='Trash' AND workspace=? ORDER BY updated_at DESC",
+                (ws_key,),
+            ).fetchall()
+        else:
+            rows = conn.execute(
+                "SELECT id, title, workspace FROM pages WHERE parent_section='Trash' ORDER BY updated_at DESC",
+            ).fetchall()
+    sidebar["trash_items"] = [{"id": r["id"], "name": r["title"] or "Untitled", "workspace": r["workspace"]} for r in rows]
+    # Pass active workspace for breadcrumb nav menu
+    ws = _get_active_workspace(request, user_id=_get_user_id(request))
+    sidebar["nav_workspace_id"] = ws["id"] if ws else 0
+    template = env.get_template("trash.html")
+    return template.render(**sidebar)
+
+
+
+
+@router.get("/library", response_class=HTMLResponse)
+def library_page(request: Request, owner: str = Query(default=""), repo: str = Query(default="")):
+    """Library page — tabbed view (recents, favorites, shared, published, private, workspace).
+
+    Sidebar data is kept intact. Tab content is loaded client-side via /api/library/* endpoints.
+    """
+    from app.routers.board import _sidebar_data as board_sidebar
+    from app.templating import ENV
+    env = ENV
+    sidebar = board_sidebar(request, owner, repo)
+    # Pass active workspace for breadcrumb nav menu
+    ws_key_ws = f"{owner}/{repo}" if owner and repo else ""
+    if ws_key_ws:
+        with get_conn() as conn:
+            ws_row = conn.execute("SELECT id FROM workspaces WHERE name=? AND owner_id=?", (ws_key_ws, _get_user_id(request))).fetchone()
+            sidebar["nav_workspace_id"] = ws_row["id"] if ws_row else 0
+    else:
+        ws = _get_active_workspace(request, user_id=_get_user_id(request))
+        sidebar["nav_workspace_id"] = ws["id"] if ws else 0
+
+    template = env.get_template("library.html")
+    sidebar["active_workspace_id"] = sidebar.get("nav_workspace_id", 0)
+    # Gitea workspace context for Repository tab
+    sidebar["is_gitea_workspace"] = bool(owner and repo)
+    sidebar["gitea_workspace_owner"] = owner
+    sidebar["gitea_workspace_repo"] = repo
+    return template.render(**sidebar)
+
+
+
+
+@router.get("/pages/{page_id}", response_class=HTMLResponse)
+def view_page_root(request: Request, page_id: int):
+    """Render a Markdown page at root level with workspace context — or file viewer.
+    ?embed=1 — minimal mode for side peek (editor only, no header)."""
+    embed = request.query_params.get("embed") == "1"
+    from app.routers.board import _sidebar_data as board_sidebar
+    from app.templating import ENV
+    env = ENV
+    with get_conn() as conn:
+        row = conn.execute("SELECT * FROM pages WHERE id=?", (page_id,)).fetchone()
+        if not row:
+            return RedirectResponse("/workspaces", status_code=302)
+    page = dict(row)
+    # v6.5.0: synced blocks resolve server-side at read time.
+    from app.services.synced_blocks import resolve_content_json
+    page["content"] = resolve_content_json(page.get("content", ""), page.get("content_format"))
+
+    ws = page.get("workspace", "")
+    parts = ws.split("/") if "/" in ws else ["", ""]
+    owner, repo = parts[0], parts[1] if len(parts) > 1 else ""
+    sidebar = board_sidebar(request, owner, repo)
+    # Load sub-pages
+    with get_conn() as conn:
+        subs = conn.execute(
+            "SELECT id, title FROM pages WHERE parent_id=? ORDER BY updated_at DESC",
+            (page_id,),
+        ).fetchall()
+        fav = conn.execute(
+            "SELECT id FROM favorites WHERE user_id=? AND page_id=?",
+            (1, page_id),
+        ).fetchone()
+
+    # Build page_data, including file metadata for uploaded files
+    _locked = bool(page.get("is_locked", 0))
+    _locked_by = page.get("locked_by") if "locked_by" in page else None
+    _sess_user = SessionManager.decode_session(request.cookies.get("flowdeck_session", ""))
+    _uid = _sess_user.get("id") if _sess_user and _sess_user.get("id") else None
+    _can_edit = (not _locked) or bool(_sess_user and _sess_user.get("is_admin")) or (_locked_by and _uid and _locked_by == _uid)
+    page_data = {"id": page_id, "title": page.get("title"), "content_format": page.get("content_format", "blocks"), "content": page.get("content", ""), "favorited": fav is not None, "share_mode": page.get("share_mode", "private"), "published": bool(page.get("published", 0)),
+                 "is_locked": _locked,
+                 "locked_by": _locked_by,
+                 "can_edit": _can_edit,
+                 "full_width": bool(page.get("full_width", 0)) if "full_width" in page else False,
+                 "font_small": bool(page.get("font_small", 0)) if "font_small" in page else False}
+
+    # For file pages, extract file metadata and add to page_data
+    if page.get("content_format") == "file":
+        import json as _json
+        try:
+            meta = _json.loads(page.get("content", "{}"))
+        except _json.JSONDecodeError:
+            meta = {}
+        file_path = meta.get("file_path", "").replace("\\", "/")
+        mime_type = meta.get("mime_type", "application/octet-stream")
+        file_size = meta.get("size", 0)
+        fp_parts = file_path.split("/")
+        ws_id = ""
+        for p in fp_parts:
+            if p.startswith("workspace_"):
+                ws_id = p.replace("workspace_", "")
+                break
+        filename = fp_parts[-1] if fp_parts else page.get("title", "File")
+        from urllib.parse import quote
+        safe_name = quote(filename, safe='')
+        file_url = f"/api/files/{ws_id}/{safe_name}" if ws_id else ""
+        page_data["file_url"] = file_url
+        page_data["file_mime"] = mime_type
+        page_data["file_size"] = file_size
+        page_data["file_name"] = filename
+
+    # For collection (database) pages, load collection + properties + pages
+    collection_data = None
+    if page.get("content_format") == "collection" and page.get("collection_id"):
+        with get_conn() as conn:
+            col = conn.execute(
+                "SELECT * FROM collections WHERE id=?", (page["collection_id"],)
+            ).fetchone()
+            if col:
+                props = [
+                    dict(r) for r in conn.execute(
+                        "SELECT * FROM collection_properties WHERE collection_id=? ORDER BY position",
+                        (page["collection_id"],),
+                    ).fetchall()
+                ]
+                cpages = [
+                    dict(r) for r in conn.execute(
+                        "SELECT * FROM collection_pages WHERE collection_id=? ORDER BY position",
+                        (page["collection_id"],),
+                    ).fetchall()
+                ]
+                cviews = [
+                    dict(r) for r in conn.execute(
+                        "SELECT * FROM collection_views WHERE collection_id=? ORDER BY position",
+                        (page["collection_id"],),
+                    ).fetchall()
+                ]
+                collection_data = {
+                    "collection": dict(col),
+                    "properties": props,
+                    "pages": cpages,
+                    "views": cviews,
+                }
+        page_data["collection_id"] = page["collection_id"]
+
+    with get_conn() as conn:
+        nav_crumbs = _nav_breadcrumb(conn, page_id)
+    # dérivé calculé UNE fois : ctx ET page_data (JSON) l'utilisent (A27)
+    page_is_shared = (
+        bool(page.get("is_shared", 0))
+        or page.get("share_mode", "private") != "private"
+        or bool(page.get("published", 0))
+    )
+    ctx = {**sidebar, "page": page, "sub_pages": [dict(s) for s in subs],
+           "page_favorited": fav is not None,
+           "page_share_mode": page.get("share_mode", "private"),
+           "page_published": bool(page.get("published", 0)),
+           "page_is_shared": page_is_shared,
+           "page_data": page_data,
+           "collection_data": collection_data,
+           "breadcrumb_items": nav_crumbs,
+           "nav_workspace_id": page.get("workspace_id") or 0,
+           "nav_page_id": page_id,
+           "embed_mode": embed}
+    # A27 phase 2 : le JS de l'éditeur lit ces valeurs dans page-data (JSON)
+    # au lieu des interpolations Jinja — une seule source, même calculs que le
+    # ctx ci-dessus.
+    from app.templating import ENV as _ENV27
+    page_data.update(
+        updated_at=page.get("updated_at", ""),
+        created_at=page.get("created_at", ""),
+        user_id=_uid or 0,
+        is_shared=page_is_shared,
+        clip_icon=_ENV27.from_string(
+            "{% from '_icons.html' import fd_icon %}{{ fd_icon('paperclip', 14) }}"
+        ).render(),
+    )
+    # Select template: collection pages use database table view
+    if page.get("content_format") == "collection" and not embed:
+        template = env.get_template("page_editor_collection.html")
+    else:
+        template = env.get_template("page_editor_embed.html" if embed else "page_editor.html")
+    response = template.render(**ctx)
+    return HTMLResponse(content=response, headers={"Cache-Control": "no-store, max-age=0"})
+
+
+
+
+@router.get("/accounts", response_class=HTMLResponse)
+def accounts_page(request: Request):
+    """Account management panel."""
+    from app.templating import ENV
+    env = ENV
+    sidebar = _sidebar_data(request, [])
+    user = SessionManager.decode_session(request.cookies.get("flowdeck_session", ""))
+    with get_conn() as conn:
+        users = conn.execute(
+            "SELECT id, login, full_name, email, avatar_url, avatar_color, "
+            "is_admin, is_active, created_at FROM users ORDER BY created_at DESC"
+        ).fetchall()
+    ctx = {**sidebar, "user": user, "users": [dict(u) for u in users]}
+    template = env.get_template("accounts.html")
+    return template.render(**ctx)
+
+
+
+
+@router.get("/help", response_class=HTMLResponse)
+def help_page(request: Request):
+    """Comprehensive help & documentation page."""
+    from app.templating import ENV
+    env = ENV
+    sidebar = _sidebar_data(request, [])
+    # Render via a block-based template so content_html lands in {% block content %}
+    block_tpl = env.from_string(
+        '{% extends "base.html" %}{% block content %}{{ content_html|safe }}{% endblock %}'
+    )
+    return HTMLResponse(block_tpl.render(
+        **sidebar,
+        request=request,
+        page_title="Help",
+        title_prefix="Help",
+        page_icon="❓",
+        content_html="""<style>
+.help-page{max-width:900px;margin:0 auto;padding:40px 24px 80px;}
+.help-hero{text-align:center;margin-bottom:48px;}
+.help-hero h1{font-size:32px;font-weight:800;margin:0 0 8px;}
+.help-hero p{font-size:16px;color:var(--text-dim);max-width:500px;margin:0 auto;}
+.help-grid{display:grid;grid-template-columns:repeat(auto-fit,minmax(280px,1fr));gap:16px;margin-bottom:48px;}
+.help-card{background:var(--bg-card);border:1px solid var(--border);border-radius:12px;padding:24px;transition:border-color .15s;}
+.help-card:hover{border-color:rgba(255,255,255,.12);}
+.help-card h3{font-size:15px;font-weight:600;margin:0 0 4px;display:flex;align-items:center;gap:8px;}
+.help-card .icon{font-size:20px;}
+.help-card p{font-size:13px;color:var(--text-dim);line-height:1.5;margin:8px 0 0;}
+.help-card ul{list-style:none;padding:0;margin:12px 0 0;}
+.help-card li{font-size:13px;padding:3px 0;color:var(--text-dim);}
+.help-card li::before{content:'• ';color:var(--accent);}
+.help-section{margin-bottom:48px;}
+.help-section h2{font-size:20px;font-weight:700;margin:0 0 16px;padding-bottom:8px;border-bottom:1px solid var(--border);}
+.help-kbd{display:inline-block;padding:2px 8px;background:var(--bg-tertiary);border:1px solid var(--border);border-radius:4px;font-family:monospace;font-size:12px;color:var(--text);min-width:16px;text-align:center;}
+.help-shortcut-row{display:flex;align-items:center;gap:12px;padding:8px 12px;border-radius:6px;margin-bottom:2px;}
+.help-shortcut-row:hover{background:var(--bg-hover);}
+.help-shortcut-row .keys{display:flex;gap:4px;min-width:140px;}
+.help-shortcut-row .desc{font-size:13px;color:var(--text-dim);}
+.help-badge{display:inline-block;padding:2px 10px;border-radius:20px;font-size:11px;font-weight:600;}
+.help-badge.local{background:rgba(35,131,226,.15);color:#2C8CEB;}
+.help-badge.gitea{background:rgba(0,200,100,.15);color:#00CC66;}
+.help-badge.github{background:rgba(130,80,220,.15);color:#A060F0;}
+.help-badge.sso{background:rgba(217,115,13,.18);color:#E0952B;}
+</style>
+<div class="help-page">
+<div class="help-hero">
+<h1>❓ FlowDeck Help</h1>
+<p>Everything you need to know about your Notion-style workspace with Gitea & GitHub integration.</p>
+</div>
+
+<div class="help-grid">
+<div class="help-card">
+<h3><span class="icon">🚀</span>Getting Started</h3>
+<p>FlowDeck is your private, self-hosted workspace. Create pages, organize projects, and integrate with your Git forge.</p>
+<ul>
+<li>Create a workspace from the <b>Workspaces</b> page</li>
+<li>Click <b>📄 New Page</b> in the sidebar to start writing</li>
+<li>Use <span class="help-kbd">Ctrl+N</span> anywhere to create a page</li>
+</ul>
+</div>
+
+<div class="help-card">
+<h3><span class="icon">📝</span>Pages & Editor</h3>
+<p>Notion-style block editor with slash commands, markdown shortcuts, and rich formatting.</p>
+<ul>
+<li>Type <span class="help-kbd">/</span> for the slash command menu</li>
+<li>Drag & drop pages in the sidebar to reorganize</li>
+<li>Right-click for context menu (duplicate, rename, delete)</li>
+</ul>
+</div>
+
+<div class="help-card">
+<h3><span class="icon">{{ fd_icon("folder",16) }}</span>Workspaces</h3>
+<p>Organize your work into separate workspaces. Each has its own pages and files.</p>
+<ul>
+<li><span class="help-badge local">Local</span> Files stored on your server</li>
+<li><span class="help-badge gitea">Gitea</span> Connect to browse & edit repos</li>
+<li><span class="help-badge github">GitHub</span> Connect via Settings → Integrations</li>
+</ul>
+</div>
+
+<div class="help-card">
+<h3><span class="icon">🦎</span>Gitea Integration</h3>
+<p>Connect your Gitea account to access repositories directly from FlowDeck.</p>
+<ul>
+<li>Go to <b>Settings → Integrations</b> to connect</li>
+<li>Browse repo file trees in the sidebar</li>
+<li>Create & edit files with commit messages</li>
+<li>Sync labels as tags</li>
+</ul>
+</div>
+
+<div class="help-card">
+<h3><span class="icon">🌐</span>Sharing & Publishing</h3>
+<p>Share pages with collaborators or publish them to the web.</p>
+<ul>
+<li>Click <b>Share</b> in the page editor top-right</li>
+<li>Share with specific users or get a public link</li>
+<li>Publish to make a page visible at <code>/p/your-slug</code></li>
+</ul>
+</div>
+
+<div class="help-card">
+<h3><span class="icon">📚</span>Library, Trash & Tasks</h3>
+<p>Find all your content in one place with powerful filtering.</p>
+<ul>
+<li><b>Library</b> — Tabs for Recents, Favorites, Shared, Published</li>
+<li><b>Trash</b> — Soft-deleted pages (30-day retention)</li>
+<li><b>My Tasks</b> — Aggregated tasks from all collections</li>
+</ul>
+</div>
+
+<div class="help-card">
+<h3><span class="icon">📶</span>Offline & PWA</h3>
+<p>Install FlowDeck as an app and keep working without a connection.</p>
+<ul>
+<li><b>Install</b> — browser menu → <i>Install app</i> / <i>Add to Home Screen</i></li>
+<li>Edits made offline are queued locally and synced automatically</li>
+<li>A <b>⟳</b> marker shows pages with pending changes</li>
+</ul>
+</div>
+</div>
+
+<div class="help-section">
+<h2>⌨️ Keyboard Shortcuts</h2>
+<div class="help-shortcut-row"><div class="keys"><span class="help-kbd">Ctrl</span>+<span class="help-kbd">N</span></div><div class="desc">Create new page</div></div>
+<div class="help-shortcut-row"><div class="keys"><span class="help-kbd">Ctrl</span>+<span class="help-kbd">K</span></div><div class="desc">Quick find / command palette</div></div>
+<div class="help-shortcut-row"><div class="keys"><span class="help-kbd">Ctrl</span>+<span class="help-kbd">S</span></div><div class="desc">Save current page</div></div>
+<div class="help-shortcut-row"><div class="keys"><span class="help-kbd">F2</span></div><div class="desc">Rename selected item</div></div>
+<div class="help-shortcut-row"><div class="keys"><span class="help-kbd">Delete</span></div><div class="desc">Move selected item to trash</div></div>
+<div class="help-shortcut-row"><div class="keys"><span class="help-kbd">Escape</span></div><div class="desc">Close modal / cancel editing</div></div>
+<div class="help-shortcut-row"><div class="keys"><span class="help-kbd">Enter</span></div><div class="desc">Open selected page</div></div>
+<div class="help-shortcut-row"><div class="keys"><span class="help-kbd">Ctrl</span>+<span class="help-kbd">O</span></div><div class="desc">New AI chat (in footer)</div></div>
+</div>
+
+<div class="help-section">
+<h2>🔐 Authentication</h2>
+<p style="color:var(--text-dim);font-size:14px;line-height:1.6;">
+FlowDeck supports three authentication methods:<br>
+<span class="help-badge local">Local</span> Email + password — create an account on the login page.<br>
+<span class="help-badge gitea">Gitea OAuth</span> Login with your Gitea account. Your repos appear as workspaces.<br>
+<span class="help-badge github">GitHub OAuth</span> Login or link your GitHub account in Settings → Integrations.<br><br>
+<b>Tip:</b> You can connect Gitea/GitHub to an existing local account — your identity stays as your local user.
+</p>
+<p style="color:var(--text-dim);font-size:14px;line-height:1.6;">
+<span class="help-badge sso">SSO</span> <b>Enterprise SSO</b> (v6.7.0) — sign in with your organization account.<br>
+<i>For administrators:</i> open <b>Settings → Admin → SSO / Enterprise</b> and pick a provider:<br>
+• <b>SAML 2.0</b> — paste the IdP <i>Entity ID</i>, <i>SSO URL</i> and signing certificate, then give the IdP this
+<code>/auth/saml/metadata</code> link (it contains the SP Entity ID, ACS URL and certificate).<br>
+• <b>OpenID Connect</b> — paste the <i>Issuer URL</i>, <i>Client ID</i> and <i>Client Secret</i> (PKCE is used, scopes default to <code>openid profile email</code>).<br>
+• <b>Provisioning</b> — accounts are created automatically on first login, groups from the IdP map to workspace roles,
+and <i>SSO only</i> disables local login (admins keep their local door). Every attempt is audited in
+<b>Settings → Admin → SSO / Enterprise</b> (login history).
+</p>
+</div>
+
+<div class="help-section">
+<h2>📶 Offline mode (PWA)</h2>
+<p style="color:var(--text-dim);font-size:14px;line-height:1.6;">
+FlowDeck is a Progressive Web App: pages you visited stay available offline and your
+edits are saved locally, then synchronised when the connection returns.<br><br>
+<b>Install:</b> open your browser menu and choose <i>Install app</i> (Chrome/Edge) or
+<i>Add to Home Screen</i> (Safari/iOS). FlowDeck then opens in its own window.<br>
+<b>Offline editing:</b> while offline, the editor stores changes in the browser
+(IndexedDB) and shows an offline banner with the number of pending changes. A
+<b>⟳</b> icon appears next to pages that have unsynced edits.<br>
+<b>Reconnection:</b> the queue is replayed automatically (and via Background Sync).
+A spinner badge appears while syncing, followed by a confirmation toast.<br>
+<b>Conflicts:</b> if a page changed on the server, the latest edit wins and a notice is
+shown. If a page was deleted server-side, your offline copy is recreated as an orphan
+page. If a page with the same title already exists, the offline copy is renamed
+<i>“Title (copie offline)”</i>.
+</p>
+</div>
+
+<div class="help-section">
+<h2>🔌 API publique v2</h2>
+<p style="color:var(--text-dim);font-size:14px;line-height:1.6;">
+FlowDeck exposes a full REST API under <b>/api/v2</b> for third-party integrations.<br>
+<b>Auth:</b> create a token in Settings → API tokens, then send it as
+<code>Authorization: Bearer &lt;token&gt;</code>. Tokens carry scopes
+<code>read</code>, <code>write</code> or <code>admin</code> (a higher scope implies the lower ones).<br>
+<b>Features:</b> CRUD on collections, pages, properties, views, comments, notifications,
+favorites, tags, sharing, sprints and templates; pagination (<code>?limit=&amp;offset=</code> +
+<code>X-Total-Count</code>), filters (<code>filter[prop]=value</code>), sorting, full-text search
+(<code>/api/v2/search</code>), idempotency (<code>Idempotency-Key</code>) and RFC 7807 error bodies.<br>
+<b>Reference:</b> interactive OpenAPI docs at <a href="/docs" target="_blank" rel="noopener">/docs</a>
+(also <code>/redoc</code>, <code>docs/openapi-v2.json</code>).
+</p>
+</div>
+
+<div class="help-section">
+<h2>💡 Tips</h2>
+<p style="color:var(--text-dim);font-size:14px;line-height:1.6;">
+• Toggle the sidebar with the <b>«</b> button in the top-left corner.<br>
+• Switch between workspaces using the dropdown menu in the sidebar header.<br>
+• The <b>Private</b> section appears when a remote workspace is active — files here stay local.<br>
+• Hover over any sidebar item to see action buttons (favorite, share, delete).<br>
+• Use <b>Ctrl+Click</b> or <b>Shift+Click</b> to multi-select items in the sidebar.
+</p>
+</div>
+
+</div>"""
+    ))
+
+
+
+
+@router.get("/accounts/settings", response_class=HTMLResponse)
+def settings_page(request: Request):
+    """User settings page — profile, forges, tokens."""
+    from app.templating import ENV
+    env = ENV
+    sidebar = _sidebar_data(request, [])
+    user = SessionManager.decode_session(request.cookies.get("flowdeck_session", ""))
+    if not user:
+        from fastapi.responses import RedirectResponse
+        return RedirectResponse("/auth/login?provider=local", status_code=302)
+    # Check forge connections
+    gitea_connected = False
+    github_connected = False
+    if user.get("id"):
+        with get_conn() as conn:
+            tokens = conn.execute(
+                "SELECT provider FROM user_oauth_tokens WHERE user_id=?", (user["id"],)
+            ).fetchall()
+            for t in tokens:
+                if t["provider"] == "gitea":
+                    gitea_connected = True
+                elif t["provider"] == "github":
+                    github_connected = True
+    ctx = {**sidebar, "user": user, "gitea_connected": gitea_connected, "github_connected": github_connected}
+    template = env.get_template("settings.html")
+    response = template.render(**ctx)
+    return HTMLResponse(content=response)
+
+
+# ═══════════ User API endpoints ═══════════

app/routers/dashboard/public.py

@@ -0,0 +1,78 @@
+"""FlowDeck — Dashboard : public.
+
+Découpe A28 de l'ancien app/routers/dashboard.py (2 735 lignes, 63 routes) — un module par concern, contrat inchangé.
+"""
+from __future__ import annotations
+
+import logging
+
+from fastapi import APIRouter, Request
+from fastapi.responses import HTMLResponse
+
+from app.db import get_conn
+
+from ._common import _render_blocks_public
+
+logger = logging.getLogger(__name__)
+router = APIRouter(tags=["dashboard"])
+
+
+
+
+# ═══════════ Public Published Page ═══════════
+
+
+@router.get("/p/{slug}", response_class=HTMLResponse)
+def public_published_page(request: Request, slug: str):
+    """Serve a published page at /p/<slug> — no auth required."""
+    from app.templating import ENV
+
+    with get_conn() as conn:
+        row = conn.execute(
+            "SELECT id, title, content, content_format, updated_at, created_at, cover_url, page_icon "
+            "FROM pages WHERE publish_slug=? AND is_published=1",
+            (slug,),
+        ).fetchone()
+
+    if not row:
+        return HTMLResponse(
+            """<!DOCTYPE html><html lang="en"><head><meta charset="UTF-8">
+<title>Not Found — FlowDeck</title>
+<style>body{font-family:system-ui,sans-serif;display:flex;align-items:center;
+justify-content:center;height:100vh;margin:0;background:#191919;color:#ccc;}
+h1{font-size:3rem;opacity:.3}</style></head><body><h1>404</h1></body></html>""",
+            status_code=404,
+        )
+
+    page = dict(row)
+    env = ENV
+
+    # Convert blocks to HTML for rendering
+    content_html = ""
+    if page.get("content_format") == "blocks" and page.get("content"):
+        import json as _json
+        try:
+            blocks = _json.loads(page["content"])
+            from app.services.synced_blocks import resolve_synced_block
+            blocks = resolve_synced_block(blocks)
+            from app.db import get_conn as _gc
+            from app.services.wiki_links import token_labels
+            with _gc() as conn:
+                wiki_titles_map = token_labels(conn, page["content"])
+            content_html = _render_blocks_public(blocks, wiki_titles_map)
+        except (_json.JSONDecodeError, Exception):
+            content_html = f"<p>{page.get('content', '')}</p>"
+    elif page.get("content"):
+        # Plain text / markdown
+        text = page["content"]
+        content_html = f"<pre style='white-space:pre-wrap;font-family:system-ui;font-size:16px;line-height:1.6;'>{text}</pre>"
+
+    template = env.get_template("public_page.html")
+    return template.render(
+        title=page["title"] or "Untitled",
+        content_html=content_html,
+        updated_at=page.get("updated_at", ""),
+        created_at=page.get("created_at", ""),
+        cover_url=page.get("cover_url", ""),
+        page_icon=page.get("page_icon", ""),
+    )

app/routers/dashboard/workspace.py

@@ -0,0 +1,321 @@
+"""FlowDeck — Dashboard : workspace.
+
+Découpe A28 de l'ancien app/routers/dashboard.py (2 735 lignes, 63 routes) — un module par concern, contrat inchangé.
+"""
+from __future__ import annotations
+
+import logging
+
+from fastapi import APIRouter, Body, Query, Request
+from fastapi.responses import HTMLResponse, RedirectResponse
+
+from app.auth.session import SessionManager
+from app.db import get_conn
+from app.services.gitea_client import get_user_gitea_client, gitea
+
+from ._common import _get_active_workspace, _get_user_id, _sidebar_data
+
+logger = logging.getLogger(__name__)
+router = APIRouter(tags=["dashboard"])
+
+
+
+
+@router.get("/", response_class=HTMLResponse)
+async def dashboard(
+    request: Request,
+    search: str = Query(default=""),
+    show_archived: bool = Query(default=False),
+):
+    """Smart root route: landing for visitors, local workspace for new users, dashboard for Gitea users."""
+    user = SessionManager.decode_session(request.cookies.get("flowdeck_session", ""))
+
+    # ── Not authenticated → show landing page ──
+    if not user:
+        # Allow through if DB is empty (fresh install)
+        try:
+            with get_conn() as conn:
+                count = conn.execute("SELECT COUNT(*) FROM users").fetchone()[0]
+                if count == 0:
+                    from app.templating import ENV
+                    env = ENV
+                    template = env.get_template("landing.html")
+                    return template.render()
+        except Exception:
+            logger.exception("dashboard")
+        from app.templating import ENV
+        env = ENV
+        template = env.get_template("landing.html")
+        return template.render()
+
+    # ── Authenticated ──
+    user_id = user.get("id", 1)
+    has_gitea = False
+    try:
+        with get_conn() as conn:
+            tok = conn.execute(
+                "SELECT access_token FROM user_oauth_tokens WHERE user_id=? AND provider='gitea'",
+                (user_id,),
+            ).fetchone()
+            has_gitea = bool(tok)
+    except Exception:
+        logger.exception("dashboard")
+
+    if not has_gitea:
+        # Check if user has any workspace
+        try:
+            with get_conn() as conn:
+                ws_count = conn.execute(
+                    "SELECT COUNT(*) FROM workspaces WHERE owner_id=?", (user_id,)
+                ).fetchone()[0]
+                if ws_count == 0:
+                    # v5.2.0: first-launch → onboarding wizard
+                    return RedirectResponse("/welcome", status_code=302)
+        except Exception:
+            logger.exception("dashboard")
+        return RedirectResponse("/local-workspace", status_code=302)
+
+    # ── Gitea user → full dashboard ──
+    try:
+        repos = await gitea.get_user_repos(page=1, limit=50)
+        if search:
+            q = search.lower()
+            repos = [r for r in repos if q in r.get("full_name", "").lower()
+                     or q in (r.get("description") or "").lower()]
+        if not show_archived:
+            repos = [r for r in repos if not r.get("archived", False)]
+        repos.sort(key=lambda r: r.get("updated_at", ""), reverse=True)
+    except Exception as e:
+        logger.error("Dashboard error: %s", e)
+        repos = []
+
+    from app.templating import ENV
+    env = ENV
+    sidebar = _sidebar_data(request, repos)
+    template = env.get_template("dashboard.html")
+    return template.render(request=request, repos=repos, search=search,
+                           show_archived=show_archived, **sidebar)
+
+
+# ═══════════ Workspace ═══════════
+
+
+
+
+# ═══════════ Workspace ═══════════
+
+@router.get("/workspace", response_class=HTMLResponse)
+def workspace_page(request: Request):
+    """Unified workspace showing all projects."""
+    from app.templating import ENV
+    env = ENV
+    sidebar = _sidebar_data(request, [])
+    user = SessionManager.decode_session(request.cookies.get("flowdeck_session", ""))
+    if not user:
+        return RedirectResponse("/auth/login?provider=local", status_code=302)
+    ctx = {**sidebar, "user": user}
+    # Pass active workspace for breadcrumb nav menu
+    ws = _get_active_workspace(request, user_id=_get_user_id(request))
+    ctx["nav_workspace_id"] = ws["id"] if ws else 0
+    template = env.get_template("workspace.html")
+    return template.render(**ctx)
+
+
+
+
+@router.get("/gitea-workspace", response_class=HTMLResponse)
+def gitea_workspace_page(request: Request):
+    """Gitea workspace — browse repo files."""
+    import json
+
+    from app.templating import ENV
+    env = ENV
+    sidebar = _sidebar_data(request, [])
+    user = SessionManager.decode_session(request.cookies.get("flowdeck_session", ""))
+    if not user:
+        return RedirectResponse("/auth/login?provider=local", status_code=302)
+    owner = request.query_params.get("owner", "")
+    repo = request.query_params.get("repo", "")
+    ws_key = f"{owner}/{repo}" if owner and repo else ""
+    ws_name = ws_key or "Gitea Workspace"
+    # Auto-create local workspace mirror for storing local files
+    local_ws_id = None
+    if ws_key:
+        with get_conn() as conn:
+            existing = conn.execute(
+                "SELECT id, owner_id FROM workspaces WHERE owner_id=? AND name=? AND settings_json LIKE ?",
+                (user["id"], ws_key, "%gitea_repo%")
+            ).fetchone()
+            if existing:
+                local_ws_id = existing["id"]
+            else:
+                c = conn.execute(
+                    "INSERT INTO workspaces (name, owner_id, settings_json) VALUES (?, ?, ?)",
+                    (ws_key, user["id"], json.dumps({"gitea_repo": ws_key, "gitea_owner": owner}))
+                )
+                local_ws_id = c.lastrowid
+                conn.execute(
+                    "INSERT INTO workspace_members (workspace_id, user_id, role) VALUES (?, ?, ?)",
+                    (local_ws_id, user["id"], "admin")
+                )
+                conn.commit()
+    ctx = {
+        **sidebar,
+        "user": user,
+        "active_ws_name": ws_name,
+        "workspace_key": ws_key,
+        "gitea_workspace": True,  # always true on this page
+        "gitea_owner": owner,
+        "gitea_repo": repo,
+        "workspace_name": ws_name,
+        "workspace_initial": repo[0].upper() if repo else "G",
+        "owner": owner,
+        "repo": repo,
+        "nav_workspace_id": local_ws_id or 0,  # for breadcrumb nav menu
+    }
+    template = env.get_template("gitea_workspace.html")
+    resp = HTMLResponse(content=template.render(**ctx))
+    resp.set_cookie("flowdeck_workspace", f"gitea:{owner}:{repo}", path="/", samesite="lax")
+    return resp
+
+
+
+
+@router.get("/api/workspace/projects")
+async def list_workspace_projects(request: Request):
+    """List all projects: built-in + Gitea + GitHub.
+    Uses the user's own Gitea token if connected, not the global admin token."""
+    user = SessionManager.decode_session(request.cookies.get("flowdeck_session", ""))
+
+    builtin = []
+    with get_conn() as conn:
+        rows = conn.execute(
+            "SELECT id, title FROM pages WHERE parent_id IS NULL AND collection_row_id IS NULL ORDER BY updated_at DESC LIMIT 20"
+        ).fetchall()
+        # A23 : une seule agrégation GROUP BY au lieu d'un COUNT par ligne.
+        counts = {}
+        if rows:
+            for c in conn.execute(
+                "SELECT parent_id, COUNT(*) AS c FROM pages WHERE parent_id IN ({}) GROUP BY parent_id".format(
+                    ",".join("?" * len(rows))
+                ),
+                [r["id"] for r in rows],
+            ).fetchall():
+                counts[c["parent_id"]] = c["c"]
+        for r in rows:
+            builtin.append({"id": str(r["id"]), "name": r["title"] or "Untitled", "pageCount": counts.get(r["id"], 0), "forge": "builtin"})
+
+    gitea_repos = []
+    # Use per-user token if available, otherwise return empty
+    user_gitea = get_user_gitea_client(request) if user else None
+    if user_gitea:
+        try:
+            repos = await user_gitea.get_user_repos(page=1, limit=50)
+            for repo in repos:
+                gitea_repos.append({
+                    "id": str(repo.get("id", "")),
+                    "name": repo.get("name", ""),
+                    "full_name": repo.get("full_name", ""),
+                    "description": repo.get("description", ""),
+                    "html_url": repo.get("html_url", ""),
+                    "language": repo.get("language", ""),
+                    "forge": "gitea",
+                })
+        except Exception:
+            logger.exception("list_workspace_projects")
+
+    return {"builtin": builtin, "gitea": gitea_repos, "github": []}
+
+
+
+
+@router.post("/api/workspace/projects")
+def create_workspace_project(request: Request, body: dict = Body(default={})):
+    name = body.get("name", "").strip()
+    if not name:
+        return {"error": "Name required"}
+    with get_conn() as conn:
+        cursor = conn.execute(
+            "INSERT INTO pages (workspace, title, content, content_format, parent_section) VALUES ('', ?, '', 'blocks', 'Private')",
+            (name,),
+        )
+        conn.commit()
+        pid = cursor.lastrowid
+    return {"id": pid, "name": name, "forge": "builtin"}
+
+
+# ═══════════ Workspace Members API ═══════════
+
+
+
+
+# ═══════════ Workspace Members API ═══════════
+
+@router.get("/api/workspace/{ws_id:int}/members")
+def list_members(request: Request, ws_id: int):
+    """List all members of a workspace."""
+    with get_conn() as conn:
+        rows = conn.execute(
+            """SELECT u.id, u.login, u.full_name, u.avatar_url, wm.role, wm.joined_at
+               FROM workspace_members wm JOIN users u ON u.id = wm.user_id
+               WHERE wm.workspace_id=? ORDER BY wm.joined_at""", (ws_id,)
+        ).fetchall()
+    return {"members": [dict(r) for r in rows]}
+
+
+
+
+@router.post("/api/workspace/{ws_id:int}/members")
+def invite_member(request: Request, ws_id: int, body: dict = Body(default={})):
+    """Invite a user to a workspace by email."""
+    email = body.get("email", "").strip()
+    role = body.get("role", "editor")
+    if role not in ("owner", "admin", "editor", "viewer"):
+        return {"error": "Invalid role"}, 400
+    with get_conn() as conn:
+        user = conn.execute("SELECT id FROM users WHERE login=? OR email=?", (email, email)).fetchone()
+        if not user:
+            return {"error": "User not found"}, 404
+        try:
+            conn.execute(
+                "INSERT INTO workspace_members (workspace_id, user_id, role) VALUES (?, ?, ?)",
+                (ws_id, user["id"], role),
+            )
+            conn.commit()
+        except Exception:
+            return {"error": "Already a member"}, 409
+    return {"status": "ok", "user_id": user["id"], "role": role}
+
+
+
+
+@router.put("/api/workspace/{ws_id:int}/members/{user_id:int}")
+def update_member_role(request: Request, ws_id: int, user_id: int, body: dict = Body(default={})):
+    """Change a member's role."""
+    role = body.get("role", "editor")
+    if role not in ("owner", "admin", "editor", "viewer"):
+        return {"error": "Invalid role"}
+    with get_conn() as conn:
+        conn.execute(
+            "UPDATE workspace_members SET role=? WHERE workspace_id=? AND user_id=?",
+            (role, ws_id, user_id),
+        )
+        conn.commit()
+    return {"status": "ok"}
+
+
+
+
+@router.delete("/api/workspace/{ws_id:int}/members/{user_id:int}")
+def remove_member(request: Request, ws_id: int, user_id: int):
+    """Remove a member from a workspace."""
+    with get_conn() as conn:
+        conn.execute(
+            "DELETE FROM workspace_members WHERE workspace_id=? AND user_id=?",
+            (ws_id, user_id),
+        )
+        conn.commit()
+    return {"status": "ok"}
+
+
+# ═══════════ Local Workspace (file/folder CRUD) ═══════════

app/routers/dashboard/workspaces.py

@@ -0,0 +1,131 @@
+"""FlowDeck — Dashboard : workspaces.
+
+Découpe A28 de l'ancien app/routers/dashboard.py (2 735 lignes, 63 routes) — un module par concern, contrat inchangé.
+"""
+from __future__ import annotations
+
+import logging
+
+from fastapi import APIRouter, Body, Request
+from fastapi.responses import HTMLResponse, JSONResponse, RedirectResponse
+
+from app.auth.session import SessionManager
+from app.db import get_conn
+
+from ._common import WORKSPACE_COOKIE, _get_active_workspace, _get_user_id, _sidebar_data
+
+logger = logging.getLogger(__name__)
+router = APIRouter(tags=["dashboard"])
+
+
+
+
+@router.get("/workspaces", response_class=HTMLResponse)
+def workspaces_page(request: Request):
+    """Workspaces list page."""
+    from app.templating import ENV
+    env = ENV
+    sidebar = _sidebar_data(request, [], include_workspace=False)
+    user = SessionManager.decode_session(request.cookies.get("flowdeck_session", ""))
+    if not user:
+        return RedirectResponse("/auth/login?provider=local&expired=1", status_code=302)
+    ctx = {**sidebar, "user": user}
+    # Pass active workspace for breadcrumb nav menu (null on workspaces home)
+    ws = _get_active_workspace(request, user_id=_get_user_id(request))
+    ctx["nav_workspace_id"] = ws["id"] if ws else 0
+    template = env.get_template("workspaces.html")
+    return template.render(**ctx)
+
+
+
+
+@router.get("/api/workspaces")
+def list_workspaces(request: Request):
+    """List all workspaces for the current user."""
+    user = SessionManager.decode_session(request.cookies.get("flowdeck_session", ""))
+    uid = user["id"] if user and user.get("id") else 1
+    with get_conn() as conn:
+        rows = conn.execute(
+            "SELECT w.*, (SELECT COUNT(*) FROM pages WHERE workspace_id=w.id AND collection_row_id IS NULL) as page_count "
+            "FROM workspaces w WHERE w.owner_id=? ORDER BY w.created_at DESC",
+            (uid,),
+        ).fetchall()
+    workspaces = []
+    for r in rows:
+        d = dict(r)
+        workspaces.append(d)
+    active = _get_active_workspace(request, user_id=_get_user_id(request))
+    return {"workspaces": workspaces, "active_id": active["id"] if active else None}
+
+
+
+
+@router.post("/api/workspaces")
+def create_workspace(request: Request, body: dict = Body(default={})):
+    """Create a new workspace."""
+    name = body.get("name", "New Workspace").strip()
+    if not name:
+        return {"error": "Name required"}
+    user = SessionManager.decode_session(request.cookies.get("flowdeck_session", ""))
+    uid = user["id"] if user and user.get("id") else 1
+    with get_conn() as conn:
+        # Ensure user exists (FK constraint)
+        uid_ok = conn.execute("SELECT id FROM users WHERE id=?", (uid,)).fetchone()
+        if not uid_ok:
+            conn.execute(
+                "INSERT OR IGNORE INTO users (id, login, full_name, is_admin) VALUES (?, ?, ?, 1)",
+                (uid, user.get("login", "admin") if user else "admin",
+                 user.get("full_name", "Admin") if user else "Admin"),
+            )
+        cursor = conn.execute(
+            "INSERT INTO workspaces (name, owner_id) VALUES (?, ?)",
+            (name, uid),
+        )
+        ws_id = cursor.lastrowid
+        # Add owner as member
+        conn.execute(
+            "INSERT OR IGNORE INTO workspace_members (workspace_id, user_id, role) VALUES (?, ?, 'owner')",
+            (ws_id, uid),
+        )
+        conn.commit()
+    return {"id": ws_id, "name": name}
+
+
+
+
+@router.put("/api/workspaces/{ws_id:int}")
+def rename_workspace(request: Request, ws_id: int, body: dict = Body(default={})):
+    """Rename a workspace."""
+    name = body.get("name", "").strip()
+    if not name:
+        return {"error": "Name required"}
+    with get_conn() as conn:
+        conn.execute("UPDATE workspaces SET name=? WHERE id=?", (name, ws_id))
+        conn.commit()
+    return {"status": "ok"}
+
+
+
+
+@router.delete("/api/workspaces/{ws_id:int}")
+def delete_workspace(request: Request, ws_id: int):
+    """Delete a workspace and all its pages."""
+    with get_conn() as conn:
+        conn.execute("DELETE FROM pages WHERE workspace_id=?", (ws_id,))
+        conn.execute("DELETE FROM workspace_members WHERE workspace_id=?", (ws_id,))
+        conn.execute("DELETE FROM workspaces WHERE id=?", (ws_id,))
+        conn.commit()
+    return {"status": "ok"}
+
+
+
+
+@router.post("/api/workspaces/{ws_id:int}/select")
+def select_workspace(request: Request, ws_id: int):
+    """Set the active workspace via cookie."""
+    response = JSONResponse({"status": "ok", "workspace_id": ws_id})
+    response.set_cookie(WORKSPACE_COOKIE, str(ws_id), max_age=86400 * 30, httponly=True, path="/")
+    return response
+
+
+# ═══════════ Settings Page ═══════════

app/routers/emoji.py

@@ -0,0 +1,100 @@
+"""FlowDeck — custom workspace emojis (v5.6.0).
+
+Uploaded emoji images stored per-workspace and usable as page icons. Kept on a
+prefix-less router so the paths stay ``/api/custom-emojis`` (the board router's
+``/{owner}/{repo}`` HTML catch-all would otherwise shadow them).
+"""
+from __future__ import annotations
+
+import datetime
+import re
+from pathlib import Path
+
+from fastapi import APIRouter, HTTPException, Request
+
+from app.config import settings
+from app.db import get_conn
+
+router = APIRouter(tags=["emojis"])
+
+_IMAGE_EXTS = {"png", "jpg", "jpeg", "gif", "webp", "svg", "bmp", "ico", "avif"}
+
+
+def _upload_root() -> Path:
+
+    return Path(settings.data_dir)
+
+
+def _active_ws(request: Request) -> int:
+    """Workspace id from the active-workspace cookie, fallback 1."""
+    try:
+        ws_id = int(request.cookies.get("flowdeck_workspace", "") or 0)
+        if ws_id > 0:
+            return ws_id
+    except (ValueError, TypeError):
+        pass
+    return 1
+
+
+@router.get("/api/custom-emojis")
+def list_custom_emojis(request: Request):
+    """List the current workspace's custom emojis."""
+    ws_id = _active_ws(request)
+    with get_conn() as conn:
+        rows = conn.execute(
+            "SELECT id, name, url FROM custom_emojis WHERE workspace_id=? ORDER BY created_at DESC",
+            (ws_id,),
+        ).fetchall()
+    return {"status": "ok", "emojis": [dict(r) for r in rows]}
+
+
+@router.post("/api/custom-emojis")
+async def create_custom_emoji(request: Request):
+    """Upload a custom emoji image (multipart: ``name`` + ``file``)."""
+    form = await request.form()
+    name = (form.get("name") or "").strip()[:40] or "emoji"
+    upload = form.get("file")
+    if upload is None or not hasattr(upload, "filename"):
+        raise HTTPException(400, "file field required")
+    original = (upload.filename or "emoji.png").replace("\\", "/").rsplit("/", 1)[-1]
+    safe = re.sub(r"[^A-Za-z0-9._-]", "_", original)[:80]
+    ext = safe.rsplit(".", 1)[-1].lower() if "." in safe else "png"
+    if ext not in _IMAGE_EXTS:
+        raise HTTPException(400, "Unsupported image format")
+    ws_id = _active_ws(request)
+    stamp = datetime.datetime.now(datetime.UTC).replace(tzinfo=None).strftime("%Y%m%d%H%M%S%f")
+    folder = _upload_root() / f"uploads/workspace_{ws_id}"
+    folder.mkdir(parents=True, exist_ok=True)
+    final = f"emoji_{stamp}_{safe}"
+    (folder / final).write_bytes(await upload.read())
+    url = f"/api/files/{ws_id}/{final}"
+    with get_conn() as conn:
+        cur = conn.execute(
+            "INSERT INTO custom_emojis (workspace_id, name, url) VALUES (?, ?, ?)",
+            (ws_id, name, url),
+        )
+        conn.commit()
+        emoji_id = cur.lastrowid
+    return {"status": "ok", "emoji": {"id": emoji_id, "name": name, "url": url}}
+
+
+@router.delete("/api/custom-emojis/{emoji_id}")
+def delete_custom_emoji(request: Request, emoji_id: int):
+    """Delete a custom emoji (and its stored file)."""
+    ws_id = _active_ws(request)
+    with get_conn() as conn:
+        row = conn.execute(
+            "SELECT url FROM custom_emojis WHERE id=? AND workspace_id=?",
+            (emoji_id, ws_id),
+        ).fetchone()
+        if not row:
+            raise HTTPException(404, "emoji not found")
+        conn.execute("DELETE FROM custom_emojis WHERE id=?", (emoji_id,))
+        conn.commit()
+    try:
+        fname = (row["url"] or "").rsplit("/", 1)[-1]
+        if fname:
+            (_upload_root() / f"uploads/workspace_{ws_id}" / fname).unlink(missing_ok=True)
+    except OSError:
+        pass
+    return {"status": "ok", "id": emoji_id}

app/routers/export.py

@@ -0,0 +1,103 @@
+"""FlowDeck — Export endpoints (v4.7.0).
+
+Routes /api/export/* — generate Markdown, HTML, PDF and static-site (zip)
+exports server-side for a given page.
+"""
+from __future__ import annotations
+
+import logging
+import re
+
+from fastapi import APIRouter, HTTPException, Request
+from fastapi.responses import Response
+
+from app.db import get_conn
+from app.services.export import (
+    build_static_site_bytes,
+    page_to_markdown,
+    page_to_pdf_bytes,
+    page_to_standalone_html,
+)
+
+logger = logging.getLogger(__name__)
+router = APIRouter(tags=["export"], prefix="/api/export")
+
+
+def _load_page_or_404(request: Request, page_id: int) -> dict:
+    """A16 : session obligatoire + `PermissionManager.can_view_page` — l'export ne
+    doit pas délivrer le contenu d'une page énumérable par id."""
+    from app.auth.session import SessionManager
+    from app.services.permission_manager import PermissionManager
+
+    user = SessionManager.decode_session(request.cookies.get("flowdeck_session", ""))
+    if not user or not user.get("id"):
+        raise HTTPException(status_code=401, detail="Authentication required")
+    with get_conn() as conn:
+        row = conn.execute(
+            "SELECT * FROM pages WHERE id=? AND deleted_at IS NULL",
+            (page_id,),
+        ).fetchone()
+    if not row:
+        raise HTTPException(status_code=404, detail="Page not found")
+    if not PermissionManager(user["id"], bool(user.get("is_admin"))).can_view_page(page_id):
+        raise HTTPException(status_code=404, detail="Page not found")
+    return dict(row)
+
+
+def _download_header(filename: str, media_type: str) -> dict:
+    ascii_name = re.sub(r"[^\x00-\x7F]", "_", filename)
+    quoted = filename.replace('"', '')
+    return {
+        "Content-Disposition": f'attachment; filename="{ascii_name}"; filename*=UTF-8\'\'{quoted}',
+        "Cache-Control": "no-store",
+        "Content-Type": media_type,
+    }
+
+
+def _safe_filename(page: dict, ext: str) -> str:
+    title = (page.get("title") or "Untitled").strip() or "Untitled"
+    title = re.sub(r'[\\/:*?"<>|]+', "_", title)
+    return f"{title}.{ext}"
+
+
+@router.get("/markdown/{page_id}")
+def export_markdown(page_id: int, request: Request):
+    page = _load_page_or_404(request, page_id)
+    md = page_to_markdown(page)
+    filename = _safe_filename(page, "md")
+    headers = _download_header(filename, "text/markdown")
+    return Response(content=md.encode("utf-8"), status_code=200, headers=headers)
+
+
+@router.get("/html/{page_id}")
+def export_html(page_id: int, request: Request):
+    page = _load_page_or_404(request, page_id)
+    html = page_to_standalone_html(page)
+    filename = _safe_filename(page, "html")
+    headers = _download_header(filename, "text/html")
+    return Response(content=html.encode("utf-8"), status_code=200, headers=headers)
+
+
+@router.get("/pdf/{page_id}")
+def export_pdf(page_id: int, request: Request):
+    page = _load_page_or_404(request, page_id)
+    try:
+        pdf_bytes = page_to_pdf_bytes(page)
+    except ImportError:
+        raise HTTPException(status_code=501, detail="PDF export requires 'weasyprint' or 'xhtml2pdf'") from None
+    except Exception as exc:  # noqa: BLE001
+        logger.error("PDF export failed for page %s: %s", page_id, exc)
+        raise HTTPException(status_code=500, detail="PDF generation failed") from exc
+    filename = _safe_filename(page, "pdf")
+    headers = _download_header(filename, "application/pdf")
+    return Response(content=pdf_bytes, status_code=200, headers=headers)
+
+
+@router.get("/site/{page_id}")
+def export_site(page_id: int, request: Request):
+    page = _load_page_or_404(request, page_id)
+    site_bytes = build_static_site_bytes(page)
+    title = _safe_filename(page, "site").replace(".site", "") or "flowdeck-site"
+    filename = f"{title}_site.zip"
+    headers = _download_header(filename, "application/zip")
+    return Response(content=site_bytes, status_code=200, headers=headers)

app/routers/gitea.py

@@ -0,0 +1,326 @@
+"""FlowDeck — Gitea integration API routes."""
+from fastapi import APIRouter, Body, HTTPException, Request
+from fastapi.responses import JSONResponse
+
+router = APIRouter(tags=["gitea"], prefix="/api/gitea")
+
+
+def _require_gitea(request: Request):
+    """Return a per-user GiteaClient or raise 401.
+
+    Only returns a client if the user has personally connected their Gitea
+    account (OAuth token). No fallback to admin token — each user must link
+    their own Gitea account to see Gitea projects.
+    """
+    from app.services.gitea_client import get_user_gitea_client
+    client = get_user_gitea_client(request)
+    if not client:
+        raise HTTPException(status_code=401, detail="Gitea account not linked. Go to Settings → Integrations to connect.")
+    return client
+
+
+
+
+@router.get("/orgs")
+async def list_orgs(request: Request):
+    """List organizations the user belongs to."""
+    gitea = _require_gitea(request)
+    try:
+        orgs = await gitea.get_user_orgs()
+        return {"orgs": orgs}
+    except Exception as e:
+        return JSONResponse({"error": str(e)}, status_code=502)
+
+
+# ── Projects (repos) ──
+@router.get("/projects")
+async def list_projects(request: Request, org: str = ""):
+    """List Gitea repos: user repos (org='') or org repos."""
+    gitea = _require_gitea(request)
+    try:
+        if org:
+            repos = await gitea.get_org_repos(org)
+        else:
+            repos = await gitea.get_user_repos(limit=100)
+        return {"projects": repos}
+    except Exception as e:
+        return JSONResponse({"error": str(e)}, status_code=502)
+
+
+# ── Repo tree ──
+@router.get("/projects/{owner}/{repo}/tree")
+async def repo_tree(request: Request, owner: str, repo: str, path: str = ""):
+    """Get contents of a repo directory (one level)."""
+    gitea = _require_gitea(request)
+    try:
+        items = await gitea.get_repo_contents(owner, repo, path)
+        tree = []
+        for item in items:
+            tree.append({
+                "name": item.get("name"),
+                "path": item.get("path"),
+                "type": "folder" if item.get("type") == "dir" else "file",
+                "size": item.get("size", 0),
+                "sha": item.get("sha"),
+            })
+        return {"tree": tree}
+    except Exception as e:
+        return JSONResponse({"error": str(e)}, status_code=502)
+
+
+# ── File content ──
+@router.get("/projects/{owner}/{repo}/file")
+async def get_file(request: Request, owner: str, repo: str, path: str):
+    """Get file content (decoded)."""
+    gitea = _require_gitea(request)
+    try:
+        content = await gitea.get_file_content(owner, repo, path)
+        return {"content": content, "path": path}
+    except Exception as e:
+        return JSONResponse({"error": str(e)}, status_code=502)
+
+
+# ── Save file (create or update) ──
+@router.put("/projects/{owner}/{repo}/file")
+async def save_file(request: Request, owner: str, repo: str):
+    """Create or update a file in the repo."""
+    gitea = _require_gitea(request)  # admin token can write too
+    try:
+        body = await request.json()
+    except Exception:
+        body = {}
+    path = body.get("path", "").strip("/")
+    content = body.get("content", "")
+    message = body.get("message", "Update via FlowDeck")
+    sha = body.get("sha")
+    if not path:
+        return JSONResponse({"error": "Path required"}, status_code=400)
+    try:
+        result = await gitea.create_or_update_file(owner, repo, path, content, message, sha)
+        return {"status": "ok", "commit": result.get("commit", {})}
+    except Exception as e:
+        return JSONResponse({"error": str(e)}, status_code=502)
+
+
+# ── Upload file (binary) ──
+@router.post("/projects/{owner}/{repo}/upload")
+async def upload_file(request: Request, owner: str, repo: str):
+    """Upload a binary file to the repo."""
+    import base64
+    gitea = _require_gitea(request)
+    try:
+        form = await request.form()
+    except Exception:
+        return JSONResponse({"error": "Invalid form data"}, status_code=400)
+    file = form.get("file")
+    folder = form.get("folder", "")
+    message = form.get("message", "Upload via FlowDeck")
+    if not file:
+        return JSONResponse({"error": "No file provided"}, status_code=400)
+    try:
+        content = await file.read()
+        encoded = base64.b64encode(content).decode("utf-8")
+        path = f"{folder.strip('/')}/{file.filename}".strip("/") if folder.strip("/") else file.filename
+        result = await gitea.create_or_update_file(owner, repo, path, encoded, message, sha=None)
+        return {"status": "ok", "path": path, "commit": result.get("commit", {})}
+    except Exception as e:
+        return JSONResponse({"error": str(e)}, status_code=502)
+
+
+# ── Delete file ──
+@router.delete("/projects/{owner}/{repo}/file")
+async def delete_file(request: Request, owner: str, repo: str):
+    """Delete a file from the repo."""
+    gitea = _require_gitea(request)  # admin token can write too
+    path = request.query_params.get("path", "")
+    sha = request.query_params.get("sha", "")
+    message = request.query_params.get("message", "Delete via FlowDeck")
+    if not path or not sha:
+        return JSONResponse({"error": "Path and SHA required"}, status_code=400)
+    try:
+        await gitea.delete_file(owner, repo, path, sha, message)
+        return {"status": "ok"}
+    except Exception as e:
+        return JSONResponse({"error": str(e)}, status_code=502)
+
+
+# ── Labels ──
+@router.get("/projects/{owner}/{repo}/labels")
+async def get_labels(request: Request, owner: str, repo: str):
+    """Get labels for a repo (mapped to tags)."""
+    gitea = _require_gitea(request)
+    try:
+        labels = await gitea.get_labels(owner, repo)
+        return {"labels": [
+            {"id": lbl["id"], "name": lbl["name"], "color": lbl.get("color", "#787774")}
+            for lbl in labels
+        ]}
+    except Exception as e:
+        return JSONResponse({"error": str(e)}, status_code=502)
+
+
+# ── Account linking ──
+
+@router.get("/status")
+def gitea_status(request: Request):
+    """Check if the current user has Gitea linked."""
+    from app.services.gitea_client import get_user_gitea_client
+    client = get_user_gitea_client(request)
+    return {"linked": client is not None}
+
+
+@router.delete("/disconnect")
+def disconnect_gitea(request: Request):
+    """Remove all Gitea OAuth tokens for the current user."""
+    from app.auth.session import SessionManager
+    from app.db import get_conn
+    user = SessionManager.decode_session(request.cookies.get("flowdeck_session", ""))
+    if not user:
+        return JSONResponse({"error": "Not authenticated"}, status_code=401)
+    with get_conn() as conn:
+        conn.execute("DELETE FROM user_oauth_tokens WHERE user_id=? AND provider='gitea'", (user["id"],))
+        conn.commit()
+    return {"status": "ok"}
+
+
+# ── Private Pages (local FlowDeck pages linked to Gitea project) ──
+
+@router.get("/projects/{owner}/{repo}/private-pages")
+def list_private_pages(owner: str, repo: str, request: Request):
+    """List private pages for this Gitea project."""
+    from app.auth.session import SessionManager
+    from app.db import get_conn
+    user = SessionManager.decode_session(request.cookies.get("flowdeck_session", ""))
+    if not user:
+        return JSONResponse({"pages": []})
+    with get_conn() as conn:
+        rows = conn.execute(
+            "SELECT id, title, updated_at FROM gitea_private_pages WHERE user_id=? AND gitea_owner=? AND gitea_repo=? ORDER BY updated_at DESC",
+            (user["id"], owner, repo),
+        ).fetchall()
+    return {"pages": [{"id": r["id"], "title": r["title"], "updated_at": r["updated_at"]} for r in rows]}
+
+
+@router.post("/projects/{owner}/{repo}/private-pages")
+def create_private_page(owner: str, repo: str, request: Request, body: dict = Body(default={})):
+    """Create a new private page for this Gitea project."""
+
+    from app.auth.session import SessionManager
+    from app.db import get_conn
+    user = SessionManager.decode_session(request.cookies.get("flowdeck_session", ""))
+    if not user:
+        return JSONResponse({"error": "Not authenticated"}, status_code=401)
+    title = body.get("title", "Untitled").strip() or "Untitled"
+    with get_conn() as conn:
+        cursor = conn.execute(
+            "INSERT INTO gitea_private_pages (user_id, gitea_owner, gitea_repo, title) VALUES (?,?,?,?)",
+            (user["id"], owner, repo, title),
+        )
+        conn.commit()
+    return {"status": "ok", "page": {"id": cursor.lastrowid, "title": title}}
+
+
+@router.get("/projects/{owner}/{repo}/private-pages/{page_id}")
+def get_private_page(owner: str, repo: str, page_id: int, request: Request):
+    """Get a single private page."""
+    from app.auth.session import SessionManager
+    from app.db import get_conn
+    user = SessionManager.decode_session(request.cookies.get("flowdeck_session", ""))
+    if not user:
+        return JSONResponse({"error": "Not authenticated"}, status_code=401)
+    with get_conn() as conn:
+        row = conn.execute(
+            "SELECT * FROM gitea_private_pages WHERE id=? AND user_id=? AND gitea_owner=? AND gitea_repo=?",
+            (page_id, user["id"], owner, repo),
+        ).fetchone()
+    if not row:
+        return JSONResponse({"error": "Not found"}, status_code=404)
+    return {"page": {"id": row["id"], "title": row["title"], "content": row["content"], "updated_at": row["updated_at"]}}
+
+
+@router.put("/projects/{owner}/{repo}/private-pages/{page_id}")
+def update_private_page(owner: str, repo: str, page_id: int, request: Request, body: dict = Body(default={})):
+    """Update a private page."""
+
+    from app.auth.session import SessionManager
+    from app.db import get_conn
+    user = SessionManager.decode_session(request.cookies.get("flowdeck_session", ""))
+    if not user:
+        return JSONResponse({"error": "Not authenticated"}, status_code=401)
+    title = body.get("title", "").strip()
+    content = body.get("content", "")
+    with get_conn() as conn:
+        if title:
+            conn.execute(
+                "UPDATE gitea_private_pages SET title=?, updated_at=CURRENT_TIMESTAMP WHERE id=? AND user_id=? AND gitea_owner=? AND gitea_repo=?",
+                (title, page_id, user["id"], owner, repo),
+            )
+        conn.execute(
+            "UPDATE gitea_private_pages SET content=?, updated_at=CURRENT_TIMESTAMP WHERE id=? AND user_id=? AND gitea_owner=? AND gitea_repo=?",
+            (content, page_id, user["id"], owner, repo),
+        )
+        conn.commit()
+    return {"status": "ok"}
+
+
+@router.delete("/projects/{owner}/{repo}/private-pages/{page_id}")
+def delete_private_page(owner: str, repo: str, page_id: int, request: Request):
+    """Delete a private page."""
+    from app.auth.session import SessionManager
+    from app.db import get_conn
+    user = SessionManager.decode_session(request.cookies.get("flowdeck_session", ""))
+    if not user:
+        return JSONResponse({"error": "Not authenticated"}, status_code=401)
+    with get_conn() as conn:
+        conn.execute(
+            "DELETE FROM gitea_private_pages WHERE id=? AND user_id=? AND gitea_owner=? AND gitea_repo=?",
+            (page_id, user["id"], owner, repo),
+        )
+        conn.commit()
+    return {"status": "ok"}
+
+
+# ── Commit history for a file ──
+@router.get("/projects/{owner}/{repo}/commits")
+async def file_commits(request: Request, owner: str, repo: str, path: str = ""):
+    """Get recent commits for a specific file."""
+    gitea = _require_gitea(request)
+    try:
+        commits = await gitea.get_file_commits(owner, repo, path)
+        return {"commits": commits}
+    except Exception as e:
+        return JSONResponse({"error": str(e)}, status_code=502)
+
+
+# ── Sync labels to tags ──
+@router.post("/projects/{owner}/{repo}/sync-labels")
+async def sync_labels(request: Request, owner: str, repo: str):
+    """Sync Gitea labels to FlowDeck tags for the current user."""
+    from app.auth.session import get_current_user as gcu
+    from app.db import get_conn
+    user = gcu(request)
+    if not user:
+        return JSONResponse({"error": "Not authenticated"}, status_code=401)
+    gitea = _require_gitea(request)
+    try:
+        labels = await gitea.get_labels(owner, repo)
+    except Exception:
+        labels = []
+    imported = 0
+    with get_conn() as conn:
+        for label in labels:
+            name = label.get("name", "")
+            color = label.get("color", "#787774")
+            if not name:
+                continue
+            existing = conn.execute(
+                "SELECT id FROM tags WHERE name=? AND user_id=?", (name, user["id"])
+            ).fetchone()
+            if not existing:
+                conn.execute(
+                    "INSERT INTO tags (name, color, user_id) VALUES (?, ?, ?)",
+                    (name, f"#{color}", user["id"]),
+                )
+                imported += 1
+        conn.commit()
+    return {"status": "ok", "imported": imported, "total": len(labels)}

app/routers/github_routes.py

@@ -0,0 +1,35 @@
+"""GitHub OAuth — status and disconnect routes."""
+from fastapi import APIRouter, Request
+from fastapi.responses import JSONResponse
+
+router = APIRouter(tags=["github"], prefix="/api/github")
+
+
+@router.get("/status")
+def github_status(request: Request):
+    """Check if the current user has GitHub linked."""
+    from app.auth.session import SessionManager
+    from app.db import get_conn
+    user = SessionManager.decode_session(request.cookies.get("flowdeck_session", ""))
+    if not user:
+        return {"linked": False}
+    with get_conn() as conn:
+        row = conn.execute(
+            "SELECT access_token FROM user_oauth_tokens WHERE user_id=? AND provider='github' AND access_token IS NOT NULL AND access_token != ''",
+            (user["id"],)
+        ).fetchone()
+    return {"linked": row is not None}
+
+
+@router.delete("/disconnect")
+def disconnect_github(request: Request):
+    """Remove all GitHub OAuth tokens for the current user."""
+    from app.auth.session import SessionManager
+    from app.db import get_conn
+    user = SessionManager.decode_session(request.cookies.get("flowdeck_session", ""))
+    if not user:
+        return JSONResponse({"error": "Not authenticated"}, status_code=401)
+    with get_conn() as conn:
+        conn.execute("DELETE FROM user_oauth_tokens WHERE user_id=? AND provider='github'", (user["id"],))
+        conn.commit()
+    return {"status": "ok"}

app/routers/governance.py

@@ -0,0 +1,90 @@
+"""FlowDeck — agent governance API (v7.2.0): policies + approval queue."""
+from __future__ import annotations
+
+import json
+
+from fastapi import APIRouter, Body, HTTPException, Request
+from fastapi.responses import JSONResponse
+
+from app.auth.session import SessionManager
+from app.db import get_conn
+from app.services import agent_policies as policies
+from app.services.api_v2_helpers import audit_log
+
+router = APIRouter(tags=["governance"])
+
+
+def _owner_or_admin(request: Request) -> dict:
+    user = SessionManager.decode_session(request.cookies.get("flowdeck_session", ""))
+    if not user or not user.get("id"):
+        raise HTTPException(401, "Authentication required")
+    with get_conn() as conn:
+        row = conn.execute("SELECT is_admin FROM users WHERE id=?", (user["id"],)).fetchone()
+        is_admin = bool(row and row["is_admin"])
+        if not is_admin and request.query_params.get("workspace_id"):
+            member = conn.execute(
+                "SELECT role FROM workspace_members WHERE workspace_id=? AND user_id=?",
+                (request.query_params.get("workspace_id"), user["id"])).fetchone()
+            owner = conn.execute("SELECT id FROM workspaces WHERE id=? AND owner_id=?",
+                                 (request.query_params.get("workspace_id"),
+                                  user["id"])).fetchone()
+            if not member and not owner:
+                raise HTTPException(403, "Workspace access required")
+            if member and member["role"] not in ("admin", "editor", "owner"):
+                raise HTTPException(403, "Editor role required")
+    user["is_admin"] = is_admin
+    return user
+
+
+@router.get("/api/v2/agent-policies")
+def list_policies(request: Request):
+    _owner_or_admin(request)
+    with get_conn() as conn:
+        rows = conn.execute("SELECT * FROM agent_policies ORDER BY workspace_id").fetchall()
+    return {"policies": [dict(r) for r in rows]}
+
+
+@router.post("/api/v2/agent-policies")
+def upsert_policy(request: Request, body: dict = Body(default={})):
+    user = _owner_or_admin(request)
+    wid = body.get("workspace_id")
+    tools = body.get("allowed_tools")
+    if tools is not None and not isinstance(tools, list):
+        raise HTTPException(400, "allowed_tools must be a list or null")
+    with get_conn() as conn:
+        conn.execute(
+            """INSERT INTO agent_policies (workspace_id, allowed_tools_json, max_steps,
+                                           require_approval)
+               VALUES (?,?,?,?)
+               ON CONFLICT(workspace_id) DO UPDATE SET
+                 allowed_tools_json=excluded.allowed_tools_json,
+                 max_steps=excluded.max_steps, require_approval=excluded.require_approval""",
+            (wid, json.dumps(tools) if tools is not None else None,
+             max(1, min(int(body.get("max_steps") or 12), 50)),
+             1 if body.get("require_approval") else 0))
+        conn.commit()
+        row = conn.execute("SELECT * FROM agent_policies WHERE workspace_id IS ?",
+                           (wid,)).fetchone()
+    audit_log(user, "agent.policy.upsert", "workspace", wid or 0, "", request)
+    return JSONResponse(status_code=201, content=dict(row))
+
+
+@router.get("/api/v2/agent-approvals")
+def list_approvals(request: Request):
+    _owner_or_admin(request)
+    status = request.query_params.get("status", "pending")
+    with get_conn() as conn:
+        rows = conn.execute("SELECT * FROM agent_approvals WHERE status=? ORDER BY id DESC"
+                            " LIMIT 100", (status,)).fetchall()
+    return {"approvals": [dict(r) for r in rows]}
+
+
+@router.post("/api/v2/agent-approvals/{approval_id}/decide")
+def decide_approval(approval_id: int, request: Request, body: dict = Body(default={})):
+    user = _owner_or_admin(request)
+    out = policies.decide_approval(approval_id, user["id"], bool(body.get("approve")))
+    if out is None:
+        raise HTTPException(404, "Pending approval not found")
+    audit_log(user, "agent.approval.decide", "agent_approval", approval_id,
+              out["status"], request)
+    return out

app/routers/imports.py

@@ -0,0 +1,378 @@
+"""FlowDeck — unified import API (v5.6.0, Phase 0/1/2).
+
+Exposes the importer registry, a dry-run preview, a synchronous run and an
+optional background job with polling. Works with the existing workspace cookie
+(``flowdeck_workspace``) and session.
+"""
+from __future__ import annotations
+
+import json
+import logging
+
+from fastapi import APIRouter, HTTPException, Request
+from fastapi.responses import HTMLResponse, RedirectResponse, Response
+
+from app.auth.session import SessionManager
+from app.db import get_conn
+from app.services.automations import fire_event
+from app.services.importers import (
+    get_job,
+    list_jobs,
+    list_sources,
+    parse_upload,
+    preview_result,
+    resolve_relations,
+    run_import,
+    start_import_job,
+)
+
+logger = logging.getLogger(__name__)
+
+router = APIRouter(prefix="/api/import", tags=["import"])
+page_router = APIRouter(tags=["import"])
+
+MAX_UPLOAD_BYTES = 200 * 1024 * 1024
+
+
+def _current_user(request: Request) -> dict:
+    return SessionManager.decode_session(request.cookies.get("flowdeck_session", "")) or {}
+
+
+@page_router.get("/import", response_class=HTMLResponse)
+def import_page(request: Request):
+    """Standalone import wizard (source picker, dry-run, mapping, progress)."""
+    user = _current_user(request)
+    if not user:
+        return RedirectResponse("/auth/login?provider=local", status_code=302)
+    from app.templating import ENV
+
+    env = ENV
+    return HTMLResponse(content=env.get_template("import.html").render(user=user))
+
+
+def _workspace(request: Request) -> tuple[int | None, str]:
+    """Resolve (workspace_id, login) from the workspace cookie + session."""
+    ws_id: int | None = None
+    cookie = request.cookies.get("flowdeck_workspace", "")
+    try:
+        value = int(cookie)
+        if value > 0:
+            ws_id = value
+    except (ValueError, TypeError):
+        pass
+    user = _current_user(request)
+    login = user.get("login", "") if user else ""
+    return ws_id, login
+
+
+async def _read_upload(request: Request) -> tuple[str, bytes, str | None]:
+    form = await request.form()
+    upload = form.get("file")
+    if upload is None or not hasattr(upload, "filename"):
+        raise HTTPException(400, "file field required")
+    filename = (upload.filename or "import").replace("\\", "/").rsplit("/", 1)[-1]
+    data = await upload.read()
+    if len(data) > MAX_UPLOAD_BYTES:
+        raise HTTPException(413, "File too large (max 200 MB)")
+    source_id = form.get("source") or None
+    return filename, data, source_id
+
+
+@router.get("/sources")
+def import_sources(request: Request):
+    """List every available importer for the UI source picker."""
+    return {"sources": list_sources()}
+
+
+@router.post("/preview")
+async def import_preview(request: Request):
+    """Dry-run: parse the upload and describe what would be created."""
+    filename, data, source_id = await _read_upload(request)
+    imp, result = parse_upload(filename, data, source_id)
+    if imp is None:
+        raise HTTPException(400, "Format non reconnu — choisissez une source")
+    out = preview_result(result)
+    out["detected_source"] = imp.source_id
+    out["source_label"] = imp.label
+    return out
+
+
+@router.post("/run")
+async def import_run(request: Request):
+    """Import an upload (synchronously, or as a background job when async=true)."""
+    form = await request.form()
+    upload = form.get("file")
+    if upload is None or not hasattr(upload, "filename"):
+        raise HTTPException(400, "file field required")
+    filename = (upload.filename or "import").replace("\\", "/").rsplit("/", 1)[-1]
+    data = await upload.read()
+    if len(data) > MAX_UPLOAD_BYTES:
+        raise HTTPException(413, "File too large (max 200 MB)")
+
+    source_id = form.get("source") or None
+    parent_id = _int_or_none(form.get("parent_id"))
+    target = _int_or_none(form.get("target_collection_id"))
+    dedup = str(form.get("dedup", "true")).lower() not in ("false", "0", "no")
+    async_mode = str(form.get("async", "false")).lower() in ("true", "1", "yes")
+    mapping = _parse_mapping(form.get("mapping"))
+    mode = _parse_mode(form.get("mode"))
+    ws_id, login = _workspace(request)
+
+    if async_mode:
+        job = start_import_job(
+            filename=filename, data=data, source_id=source_id,
+            workspace_id=ws_id, workspace_name=login, user_login=login,
+            parent_page_id=parent_id, target_collection_id=target, dedup=dedup,
+            mapping=mapping, mode=mode,
+        )
+        return {"status": "queued", "job_id": job["id"]}
+
+    imp, result = parse_upload(filename, data, source_id)
+    if imp is None:
+        raise HTTPException(400, "Format non reconnu — choisissez une source")
+    report = run_import(
+        result, workspace_id=ws_id, workspace_name=login, user_login=login,
+        parent_page_id=parent_id, target_collection_id=target, dedup=dedup,
+        mapping=mapping, mode=mode,
+    )
+    report["detected_source"] = imp.source_id
+    if imp.source_id == "notion":
+        with get_conn() as conn:
+            report["relations"] = resolve_relations(conn, ws_id)
+    for page_id in report.get("page_ids", [])[:100]:
+        try:
+            await fire_event("page.created", {"page_id": page_id, "title": "", "workspace": login})
+        except Exception:  # noqa: BLE001 - events are best-effort
+            pass
+    return report
+
+
+@router.post("/forge")
+async def import_forge(request: Request):
+    """Import a forge repo's issues (+ labels/milestones) into collections."""
+    try:
+        body = await request.json()
+    except Exception:
+        raise HTTPException(400, "Invalid JSON body") from None
+    provider = str(body.get("provider") or "gitea").lower()
+    owner = str(body.get("owner") or "").strip()
+    repo = str(body.get("repo") or "").strip()
+    if not owner or not repo:
+        raise HTTPException(400, "owner and repo are required")
+    state = str(body.get("state") or "all")
+    include_labels = bool(body.get("include_labels", True))
+    include_milestones = bool(body.get("include_milestones", True))
+    ws_id, login = _workspace(request)
+
+    if provider == "gitea":
+        from app.services.gitea_client import get_user_gitea_client
+        from app.services.importers.forge import GiteaForgeAdapter
+        client = get_user_gitea_client(request)
+        if client is None:
+            raise HTTPException(400, "Gitea non connecté")
+        adapter = GiteaForgeAdapter(client)
+    elif provider == "github":
+        from app.services.github_adapter import GitHubAdapter
+        token = _user_oauth_token(request, "github")
+        if not token:
+            raise HTTPException(400, "GitHub non connecté")
+        adapter = GitHubAdapter(token)
+    else:
+        raise HTTPException(400, "provider must be 'gitea' or 'github'")
+
+    from app.services.importers.forge import fetch_forge_issues
+    result = await fetch_forge_issues(
+        adapter, owner, repo, provider=provider, state=state,
+        include_labels=include_labels, include_milestones=include_milestones,
+    )
+    report = run_import(
+        result, workspace_id=ws_id, workspace_name=login, user_login=login,
+    )
+    report["detected_source"] = f"forge:{provider}"
+    return report
+
+
+@router.post("/forge-repo")
+async def import_forge_repo(request: Request):
+    """Import a forge repo's text files as pages (folder hierarchy preserved)."""
+    try:
+        body = await request.json()
+    except Exception:
+        raise HTTPException(400, "Invalid JSON body") from None
+    provider = str(body.get("provider") or "gitea").lower()
+    owner = str(body.get("owner") or "").strip()
+    repo = str(body.get("repo") or "").strip()
+    if not owner or not repo:
+        raise HTTPException(400, "owner and repo are required")
+    path = str(body.get("path") or "")
+    max_files = min(int(body.get("max_files") or 200), 1000)
+    ws_id, login = _workspace(request)
+
+    adapter = _forge_adapter(request, provider)
+
+    from app.services.importers.forge_repo import fetch_forge_repo
+    result = await fetch_forge_repo(
+        adapter, owner, repo, provider=provider, path=path, max_files=max_files,
+    )
+    report = run_import(result, workspace_id=ws_id, workspace_name=login, user_login=login)
+    report["detected_source"] = f"forge-repo:{provider}"
+    return report
+
+
+@router.post("/url")
+async def import_url(request: Request):
+    """Web clipper: fetch a URL and create a page (bookmark card + content)."""
+    try:
+        body = await request.json()
+    except Exception:
+        raise HTTPException(400, "Invalid JSON body") from None
+    url = str(body.get("url") or "").strip()
+    if not url:
+        raise HTTPException(400, "url is required")
+    ws_id, login = _workspace(request)
+
+    from app.services.importers.url_fetch import fetch_url_result
+    try:
+        result = await fetch_url_result(url)
+    except ValueError as exc:
+        raise HTTPException(400, str(exc)) from None
+    if not result.pages:
+        raise HTTPException(422, "; ".join(result.warnings) or "Page introuvable")
+    report = run_import(result, workspace_id=ws_id, workspace_name=login, user_login=login)
+    report["detected_source"] = "url"
+    return report
+
+
+@router.post("/run-batch")
+async def import_run_batch(request: Request):
+    """Import several uploaded files sequentially, returning one report each."""
+    form = await request.form()
+    uploads = form.getlist("file")
+    if not uploads:
+        raise HTTPException(400, "file field required")
+    source_id = form.get("source") or None
+    parent_id = _int_or_none(form.get("parent_id"))
+    target = _int_or_none(form.get("target_collection_id"))
+    dedup = str(form.get("dedup", "true")).lower() not in ("false", "0", "no")
+    mode = _parse_mode(form.get("mode"))
+    mapping = _parse_mapping(form.get("mapping"))
+    ws_id, login = _workspace(request)
+
+    results: list[dict] = []
+    summary = {"files": 0, "pages_created": 0, "rows_created": 0, "errors": 0}
+    for upload in uploads:
+        filename = (getattr(upload, "filename", "") or "import").replace("\\", "/").rsplit("/", 1)[-1]
+        data = await upload.read()
+        if len(data) > MAX_UPLOAD_BYTES:
+            results.append({"filename": filename, "report": {"status": "error",
+                            "errors": [{"title": filename, "error": "File too large"}]}})
+            summary["errors"] += 1
+            continue
+        imp, result = parse_upload(filename, data, source_id)
+        if imp is None:
+            results.append({"filename": filename, "report": {"status": "error",
+                            "errors": [{"title": filename, "error": "Format non reconnu"}]}})
+            summary["errors"] += 1
+            continue
+        report = run_import(
+            result, workspace_id=ws_id, workspace_name=login, user_login=login,
+            parent_page_id=parent_id, target_collection_id=target, dedup=dedup,
+            mapping=mapping, mode=mode,
+        )
+        report["detected_source"] = imp.source_id
+        results.append({"filename": filename, "report": report})
+        summary["files"] += 1
+        summary["pages_created"] += report.get("pages_created", 0)
+        summary["rows_created"] += report.get("rows_created", 0)
+        summary["errors"] += len(report.get("errors", []))
+    return {"status": "ok", "summary": summary, "results": results}
+
+
+@router.post("/relations/resolve")
+def import_resolve_relations(request: Request):
+    """Convert text columns referencing another collection into relation props."""
+    ws_id, _ = _workspace(request)
+    with get_conn() as conn:
+        return resolve_relations(conn, ws_id)
+
+
+@router.get("/jobs")
+def import_jobs(request: Request):
+    return {"jobs": list_jobs()}
+
+
+@router.get("/jobs/{job_id}")
+def import_job(job_id: str):
+    job = get_job(job_id)
+    if not job:
+        raise HTTPException(404, "Job not found")
+    return job
+
+
+@router.get("/jobs/{job_id}/report")
+def import_job_report(job_id: str):
+    """Download a job's import report as JSON."""
+    job = get_job(job_id)
+    if not job:
+        raise HTTPException(404, "Job not found")
+    payload = json.dumps(job.get("report") or {}, ensure_ascii=False, indent=2)
+    return Response(
+        content=payload,
+        media_type="application/json",
+        headers={"Content-Disposition": f'attachment; filename="import-{job_id}.json"'},
+    )
+
+
+def _forge_adapter(request: Request, provider: str):
+    if provider == "gitea":
+        from app.services.gitea_client import get_user_gitea_client
+        from app.services.importers.forge import GiteaForgeAdapter
+        client = get_user_gitea_client(request)
+        if client is None:
+            raise HTTPException(400, "Gitea non connecté")
+        return GiteaForgeAdapter(client)
+    if provider == "github":
+        from app.services.github_adapter import GitHubAdapter
+        token = _user_oauth_token(request, "github")
+        if not token:
+            raise HTTPException(400, "GitHub non connecté")
+        return GitHubAdapter(token)
+    raise HTTPException(400, "provider must be 'gitea' or 'github'")
+
+
+def _int_or_none(value) -> int | None:
+    try:
+        ivalue = int(value)
+        return ivalue if ivalue > 0 else None
+    except (ValueError, TypeError):
+        return None
+
+
+def _parse_mapping(value) -> dict[str, str] | None:
+    if not value:
+        return None
+    try:
+        parsed = json.loads(value)
+    except (ValueError, TypeError):
+        return None
+    if isinstance(parsed, dict):
+        return {str(k): str(v) for k, v in parsed.items() if v}
+    return None
+
+
+def _parse_mode(value) -> str | None:
+    mode = str(value or "").strip().lower()
+    return mode if mode in ("skip", "update", "duplicate") else None
+
+
+def _user_oauth_token(request: Request, provider: str) -> str:
+    user = _current_user(request)
+    if not user or not user.get("id"):
+        return ""
+    with get_conn() as conn:
+        row = conn.execute(
+            "SELECT access_token FROM user_oauth_tokens WHERE user_id=? AND provider=? "
+            "ORDER BY updated_at DESC LIMIT 1",
+            (user["id"], provider),
+        ).fetchone()
+    return row["access_token"] if row else ""

app/routers/library.py

@@ -0,0 +1,413 @@
+"""FlowDeck — Library API: recents, favorites, shared, published, private, workspace."""
+from __future__ import annotations
+
+import logging
+
+from fastapi import APIRouter, Query, Request
+
+from app.auth.session import SessionManager
+from app.db import get_conn
+
+logger = logging.getLogger(__name__)
+router = APIRouter(tags=["library"], prefix="/api/library")
+
+SOURCE_TYPES = {"all", "local", "gitea", "github"}
+
+
+def _get_user_id(request: Request) -> int:
+    user = SessionManager.decode_session(request.cookies.get("flowdeck_session", ""))
+    return user["id"] if user and user.get("id") else 1
+
+
+def _detect_source_type(workspace: str) -> str:
+    ws = (workspace or "").strip()
+    if not ws:
+        return "local"
+    if ws.startswith("github:"):
+        return "github"
+    if "/" in ws:
+        return "gitea"
+    return "local"
+
+
+def _source_label(source_type: str, workspace: str) -> str:
+    if source_type == "gitea":
+        return workspace
+    elif source_type == "github":
+        return workspace.replace("github:", "", 1)
+    return workspace or "Private"
+
+
+def _build_item(db_row: dict, uid: int = 1) -> dict:
+    workspace = db_row.get("workspace", "") or ""
+    source_type = _detect_source_type(workspace)
+    page_id = db_row["id"]
+    title = db_row.get("title") or "Untitled"
+
+    # URL
+    if source_type in ("gitea", "github"):
+        ws = workspace.replace("github:", "", 1) if source_type == "github" else workspace
+        parts = ws.split("/", 1)
+        url = f"/gitea-workspace?owner={parts[0]}&repo={parts[1] if len(parts) > 1 else ''}"
+    else:
+        url = f"/pages/{page_id}"
+
+    # Icon
+    content_format = db_row.get("content_format", "blocks")
+    if db_row.get("is_folder"):
+        icon = "📁"
+    elif content_format == "file":
+        icon = "📄"
+        fn = title.lower()
+        if fn.endswith(".pdf"):
+            icon = "📕"
+        elif any(fn.endswith(e) for e in [".png", ".jpg", ".jpeg", ".gif", ".webp", ".svg"]):
+            icon = "🖼️"
+        elif any(fn.endswith(e) for e in [".py", ".js", ".ts", ".go", ".rs"]):
+            icon = "📜"
+    else:
+        icon = "📝"
+
+    return {
+        "id": page_id,
+        "title": title,
+        "icon": icon,
+        "page_icon": db_row.get("page_icon") or "",
+        "is_folder": bool(db_row.get("is_folder", 0)),
+        "source_type": source_type,
+        "source_label": _source_label(source_type, workspace),
+        "workspace": workspace,
+        "workspace_name": _source_label(source_type, workspace),
+        "author": db_row.get("author") or "",
+        "author_initial": (db_row.get("author") or "?")[0].upper(),
+        "updated_at": db_row.get("updated_at", ""),
+        "visited_at": db_row.get("visited_at") or "",
+        "has_children": False,
+        "children": [],
+        "url": url,
+        "content_format": content_format,
+        "favorited": bool(db_row.get("favorited", 0)),
+        "share_mode": db_row.get("share_mode", "private"),
+        "tags": [],
+    }
+
+
+def _apply_source_filter(query: str, params: list, source_type: str) -> tuple[str, list]:
+    if source_type == "local":
+        query += " AND (p.workspace = '' OR (p.workspace NOT LIKE '%/%' AND p.workspace NOT LIKE 'github:%'))"
+    elif source_type == "gitea":
+        query += " AND p.workspace LIKE '%/%' AND p.workspace NOT LIKE 'github:%'"
+    elif source_type == "github":
+        query += " AND p.workspace LIKE 'github:%'"
+    return query, params
+
+
+def _rows_to_items(rows, uid: int = 1) -> list:
+    items = [_build_item(dict(r), uid) for r in rows]
+    return _attach_tags(items)
+
+
+def _attach_tags(items: list) -> list:
+    """Batch-load page tags for library items."""
+    if not items:
+        return items
+    ids = [it["id"] for it in items]
+    placeholders = ",".join("?" for _ in ids)
+    with get_conn() as conn:
+        rows = conn.execute(
+            f"SELECT pt.page_id, t.id, t.name, t.color FROM page_tags pt "
+            f"JOIN tags t ON t.id = pt.tag_id WHERE pt.page_id IN ({placeholders})",
+            ids,
+        ).fetchall()
+    tag_map: dict = {}
+    for r in rows:
+        tag_map.setdefault(r["page_id"], []).append({
+            "id": r["id"], "name": r["name"], "color": r["color"],
+        })
+    for it in items:
+        it["tags"] = tag_map.get(it["id"], [])
+    return items
+
+
+def _enrich_children(items: list) -> list:
+    """Add has_children info to items in a single batch query."""
+    if not items:
+        return items
+    ids = [it["id"] for it in items]
+    placeholders = ",".join(["?" for _ in ids])
+    with get_conn() as conn:
+        child_rows = conn.execute(
+            f"SELECT parent_id, COUNT(*) as cnt FROM pages "
+            f"WHERE parent_id IN ({placeholders}) AND deleted_at IS NULL "
+            f"GROUP BY parent_id",
+            ids,
+        ).fetchall()
+    child_counts = {r["parent_id"]: r["cnt"] for r in child_rows}
+    for it in items:
+        it["has_children"] = bool(child_counts.get(it["id"], 0))
+    return items
+
+
+# ═══════════ Tab endpoints ═══════════
+
+BASE_SELECT = (
+    "SELECT p.id, p.title, p.workspace, p.updated_at, p.content_format, "
+    "p.parent_id, p.share_mode, p.parent_section, p.page_icon"
+)
+
+
+@router.get("/recents")
+def library_recents(
+    request: Request,
+    source_type: str = Query(default="all"),
+    tree: int = Query(default=0),
+    workspace_id: int = Query(default=0),
+):
+    if source_type not in SOURCE_TYPES:
+        source_type = "all"
+
+    uid = _get_user_id(request)
+    query = f"{BASE_SELECT} FROM pages p WHERE p.parent_section != 'Trash' AND p.deleted_at IS NULL"
+    params: list = []
+
+    # Hierarchical view: show only root-level pages at the top
+    if tree:
+        query += " AND p.parent_id IS NULL"
+
+    # Filter by active workspace
+    if workspace_id:
+        query += " AND p.workspace_id = ?"
+        params.append(workspace_id)
+
+    query, params = _apply_source_filter(query, params, source_type)
+    query += " ORDER BY p.updated_at DESC LIMIT 50"
+
+    with get_conn() as conn:
+        rows = conn.execute(query, params).fetchall()
+
+    items = _rows_to_items(rows, uid)
+    _enrich_children(items)
+    return {"items": items}
+
+
+@router.get("/favorites")
+def library_favorites(
+    request: Request,
+    source_type: str = Query(default="all"),
+    tree: int = Query(default=0),
+):
+    if source_type not in SOURCE_TYPES:
+        source_type = "all"
+
+    uid = _get_user_id(request)
+    query = (
+        "SELECT p.id, p.title, p.workspace, p.updated_at, p.content_format, "
+        "p.parent_id, p.share_mode, p.parent_section, 1 as favorited "
+        "FROM favorites f JOIN pages p ON p.id = f.page_id "
+        "WHERE f.user_id = ? AND p.parent_section != 'Trash' AND p.deleted_at IS NULL"
+    )
+    params: list = [uid]
+    if tree:
+        query += " AND p.parent_id IS NULL"
+    query, params = _apply_source_filter(query, params, source_type)
+    query += " ORDER BY f.position"
+
+    with get_conn() as conn:
+        rows = conn.execute(query, params).fetchall()
+
+    items = _rows_to_items(rows, uid)
+    _enrich_children(items)
+    return {"items": items}
+
+
+@router.get("/shared")
+def library_shared(
+    request: Request,
+    source_type: str = Query(default="all"),
+    tree: int = Query(default=0),
+    dir: str = Query(default="all"),
+):
+    if source_type not in SOURCE_TYPES:
+        source_type = "all"
+    if dir not in ("made", "received", "all"):
+        dir = "all"
+
+    uid = _get_user_id(request)
+
+    # Page ids the user shares toward others (nominal page_shares) or receives
+    # (direct shares + group shares via group_members)
+    with get_conn() as conn:
+        made_rows = conn.execute(
+            "SELECT DISTINCT s.page_id FROM page_shares s WHERE s.created_by=?",
+            (uid,),
+        ).fetchall()
+        try:
+            recv_rows = conn.execute(
+                """SELECT DISTINCT s.page_id FROM page_shares s
+                   LEFT JOIN group_members gm ON gm.group_id = s.shared_with_group_id AND gm.user_id=?
+                   WHERE s.shared_with_user_id=? OR gm.user_id=?""",
+                (uid, uid, uid),
+            ).fetchall()
+        except Exception:
+            recv_rows = conn.execute(
+                "SELECT DISTINCT s.page_id FROM page_shares s WHERE s.shared_with_user_id=?",
+                (uid,),
+            ).fetchall()
+    made_ids = {r[0] for r in made_rows}
+    recv_ids = {r[0] for r in recv_rows}
+
+    conds: list[str] = []
+    params: list = []
+    if dir in ("all", "made"):
+        conds.append("p.share_mode != 'private'")
+    if dir in ("all", "made") and made_ids:
+        conds.append(f"p.id IN ({','.join('?' for _ in made_ids)})")
+        params.extend(made_ids)
+    if dir in ("all", "received") and recv_ids:
+        conds.append(f"p.id IN ({','.join('?' for _ in recv_ids)})")
+        params.extend(recv_ids)
+    if dir == "received" and not recv_ids:
+        return {"items": []}
+
+    query = (
+        f"{BASE_SELECT} FROM pages p "
+        f"WHERE ({' OR '.join(conds)}) AND p.parent_section != 'Trash' AND p.deleted_at IS NULL"
+    )
+    if tree:
+        query += " AND p.parent_id IS NULL"
+    query, params = _apply_source_filter(query, params, source_type)
+    query += " ORDER BY p.updated_at DESC LIMIT 50"
+
+    with get_conn() as conn:
+        rows = conn.execute(query, params).fetchall()
+
+    items = _rows_to_items(rows, uid)
+    for it in items:
+        sid = it["id"]
+        is_made = sid in made_ids or it.get("share_mode", "private") != "private"
+        is_recv = sid in recv_ids
+        it["share_dir"] = "both" if (is_made and is_recv) else ("made" if is_made else ("received" if is_recv else ""))
+    _enrich_children(items)
+    return {"items": items}
+
+
+@router.get("/published")
+def library_published(
+    request: Request,
+    source_type: str = Query(default="all"),
+    tree: int = Query(default=0),
+):
+    if source_type not in SOURCE_TYPES:
+        source_type = "all"
+
+    uid = _get_user_id(request)
+    query = f"{BASE_SELECT} FROM pages p WHERE p.published = 1 AND p.parent_section != 'Trash' AND p.deleted_at IS NULL"
+    params: list = []
+    if tree:
+        query += " AND p.parent_id IS NULL"
+    query, params = _apply_source_filter(query, params, source_type)
+    query += " ORDER BY p.updated_at DESC LIMIT 50"
+
+    with get_conn() as conn:
+        rows = conn.execute(query, params).fetchall()
+
+    items = _rows_to_items(rows, uid)
+    _enrich_children(items)
+    return {"items": items}
+
+
+@router.get("/private")
+def library_private(
+    request: Request,
+    source_type: str = Query(default="all"),
+    tree: int = Query(default=0),
+):
+    if source_type not in SOURCE_TYPES:
+        source_type = "all"
+
+    uid = _get_user_id(request)
+    query = f"{BASE_SELECT} FROM pages p WHERE p.parent_section = 'Private' AND p.deleted_at IS NULL"
+    params: list = []
+    if tree:
+        query += " AND p.parent_id IS NULL"
+    query, params = _apply_source_filter(query, params, source_type)
+    query += " ORDER BY p.updated_at DESC LIMIT 50"
+
+    with get_conn() as conn:
+        rows = conn.execute(query, params).fetchall()
+
+    items = _rows_to_items(rows, uid)
+    _enrich_children(items)
+    return {"items": items}
+
+
+@router.get("/children/{page_id:int}")
+def library_children(page_id: int, request: Request):
+    """Return child pages for a given parent page (for tree expansion in Library)."""
+    uid = _get_user_id(request)
+    with get_conn() as conn:
+        rows = conn.execute(
+            f"{BASE_SELECT}, (SELECT COUNT(*) FROM pages c WHERE c.parent_id = p.id AND c.deleted_at IS NULL) as child_count "
+            f"FROM pages p WHERE p.parent_id = ? AND p.deleted_at IS NULL "
+            f"ORDER BY p.title COLLATE NOCASE",
+            [page_id],
+        ).fetchall()
+    items = _rows_to_items(rows, uid)
+    _enrich_children(items)
+    return {"items": items}
+
+
+@router.get("/repository")
+def library_repository(
+    request: Request,
+    gitea_owner: str = Query(default=""),
+    gitea_repo: str = Query(default=""),
+):
+    """Return Gitea repository pages/files for the Library Repository tab."""
+    if not gitea_owner or not gitea_repo:
+        return {"items": []}
+
+    uid = _get_user_id(request)
+    ws_key = f"{gitea_owner}/{gitea_repo}"
+    query = f"{BASE_SELECT} FROM pages p WHERE p.workspace = ? AND p.deleted_at IS NULL"
+    params = [ws_key]
+    query += " ORDER BY p.updated_at DESC LIMIT 100"
+
+    with get_conn() as conn:
+        rows = conn.execute(query, params).fetchall()
+
+    items = _rows_to_items(rows, uid)
+    _enrich_children(items)
+    return {"items": items}
+
+
+@router.get("/workspace")
+def library_workspace(
+    request: Request,
+    source_type: str = Query(default="all"),
+    tree: int = Query(default=0),
+    workspace_id: int = Query(default=0),
+):
+    if source_type not in SOURCE_TYPES:
+        source_type = "all"
+
+    uid = _get_user_id(request)
+    query = f"{BASE_SELECT} FROM pages p WHERE (p.workspace != '' OR p.workspace_id IS NOT NULL) AND p.parent_section != 'Trash' AND p.deleted_at IS NULL"
+    params: list = []
+
+    if tree:
+        query += " AND p.parent_id IS NULL"
+
+    if workspace_id:
+        query += " AND p.workspace_id = ?"
+        params.append(workspace_id)
+
+    query, params = _apply_source_filter(query, params, source_type)
+    query += " ORDER BY p.updated_at DESC LIMIT 50"
+
+    with get_conn() as conn:
+        rows = conn.execute(query, params).fetchall()
+
+    items = _rows_to_items(rows, uid)
+    _enrich_children(items)
+    return {"items": items}

app/routers/meetings.py

@@ -0,0 +1,198 @@
+"""FlowDeck — Calendar links + Meetings API (v7.1.0).
+
+``/api/v2/calendar-links*`` — Google/CalDAV link CRUD (session or Bearer
+``write``), manual sync trigger. ``GET /db/{id}/calendar/freebusy`` —
+weekday availability. ``/api/v2/meetings/*`` — audio upload, manual
+transcript, AI summary (fires ``meeting.summarized``).
+
+See ``docs/V71_Calendar_Meetings.md``.
+"""
+from __future__ import annotations
+
+import secrets
+
+from fastapi import APIRouter, Body, HTTPException, Request
+from fastapi.responses import JSONResponse
+
+from app.auth.session import SessionManager
+from app.db import get_conn
+from app.services import calendar_sync as cal
+from app.services import meetings as meet
+from app.services.api_v2_helpers import (
+    audit_log,
+    has_scope,
+    resolve_bearer_token,
+    row_to_dict,
+)
+
+router = APIRouter(tags=["calendar-meetings"])
+
+
+def _auth_user(request: Request, *, require_write: bool = False) -> dict:
+    sess = SessionManager.decode_session(request.cookies.get("flowdeck_session", ""))
+    if sess:
+        return sess
+    auth = request.headers.get("authorization") or request.headers.get("Authorization") or ""
+    if auth.lower().startswith("bearer "):
+        user = resolve_bearer_token(auth[7:].strip())
+        if not user:
+            raise HTTPException(401, "Invalid or expired API token")
+        if require_write and not has_scope(user.get("_token_scopes") or "read", "write"):
+            raise HTTPException(403, "Insufficient scope. Required: write")
+        return user
+    raise HTTPException(401, "Authentication required")
+
+
+# ── calendar links ─────────────────────────────────────────────────────────
+
+@router.post("/api/v2/calendar-links")
+def create_link(request: Request, body: dict = Body(default={})):
+    user = _auth_user(request, require_write=True)
+    provider = (body.get("provider") or "").lower()
+    if provider not in cal.PROVIDERS:
+        raise HTTPException(400, "provider must be google|caldav")
+    try:
+        collection_id = int(body.get("collection_id", 0))
+    except (TypeError, ValueError):
+        raise HTTPException(400, "collection_id required") from None
+    creds = body.get("credentials") or {}
+    if provider == "google" and not creds.get("access_token"):
+        raise HTTPException(400, "google needs credentials.access_token")
+    if provider == "caldav" and not creds.get("url"):
+        raise HTTPException(400, "caldav needs credentials.url")
+    try:
+        out = cal.save_link(user["id"], provider, collection_id, creds,
+                            body.get("calendar_id") or "primary",
+                            body.get("date_property") or "")
+    except ValueError as exc:
+        raise HTTPException(400, str(exc)) from None
+    audit_log(user, "calendar.link", "collection", collection_id, provider, request)
+    return JSONResponse(status_code=201, content=out)
+
+
+@router.get("/api/v2/calendar-links")
+def get_links(request: Request):
+    user = _auth_user(request)
+    return {"links": cal.list_links(user["id"])}
+
+
+@router.delete("/api/v2/calendar-links/{link_id}")
+def remove_link(link_id: int, request: Request):
+    user = _auth_user(request, require_write=True)
+    if not cal.delete_link(user["id"], link_id):
+        raise HTTPException(404, "Link not found")
+    audit_log(user, "calendar.unlink", "calendar_link", link_id, "", request)
+    return {"status": "deleted", "id": link_id}
+
+
+@router.post("/api/v2/calendar-links/{link_id}/sync")
+async def sync_now(link_id: int, request: Request):
+    user = _auth_user(request, require_write=True)
+    with get_conn() as conn:
+        row = conn.execute("SELECT * FROM calendar_links WHERE id=?", (link_id,)).fetchone()
+    if not row or (row["user_id"] != user["id"] and not user.get("is_admin")):
+        raise HTTPException(404, "Link not found")
+    try:
+        stats = await cal.sync_link(link_id)
+    except (cal.SyncError, ValueError) as exc:
+        raise HTTPException(502 if isinstance(exc, cal.SyncError) else 400,
+                            str(exc)) from None
+    audit_log(user, "calendar.sync", "calendar_link", link_id, str(stats), request)
+    return {"link_id": link_id, **stats}
+
+
+# ── free/busy ──────────────────────────────────────────────────────────────
+
+@router.get("/db/{collection_id}/calendar/freebusy")
+def freebusy(collection_id: int, request: Request):
+    _auth_user(request)
+    qp = request.query_params
+    try:
+        out = cal.freebusy(collection_id, qp.get("from", ""), qp.get("to", ""),
+                           qp.get("date_property", ""))
+    except ValueError as exc:
+        raise HTTPException(400, str(exc)) from None
+    return out
+
+
+# ── meetings ───────────────────────────────────────────────────────────────
+
+@router.post("/api/v2/meetings/transcribe")
+async def upload_and_transcribe(request: Request):
+    user = _auth_user(request, require_write=True)
+    try:
+        form = await request.form()
+    except Exception:
+        raise HTTPException(400, "multipart upload required") from None
+    upload = form.get("audio")
+    try:
+        page_id = int(form.get("page_id", 0))
+    except (TypeError, ValueError):
+        raise HTTPException(400, "page_id required") from None
+    language = (form.get("language") or "fr")[:10]
+    manual = (form.get("transcript") or "").strip()
+    if upload is None and not manual:
+        raise HTTPException(400, "audio file or transcript required")
+    audio_path = ""
+    if upload is not None:
+        filename = (upload.filename or "").lower()
+        ext = filename.rsplit(".", 1)[-1] if "." in filename else ""
+        if ext not in meet.AUDIO_EXTENSIONS:
+            raise HTTPException(400, f"audio must be one of {sorted(meet.AUDIO_EXTENSIONS)}")
+        data = await upload.read()
+        if len(data) > meet.MAX_AUDIO_BYTES:
+            raise HTTPException(413, "audio exceeds 100 MB")
+        if not data:
+            raise HTTPException(400, "empty audio file")
+        audio_path = str(meet.meetings_dir()
+                         / f"{page_id}_{secrets.token_hex(8)}.{ext}")
+        with open(audio_path, "wb") as fh:
+            fh.write(data)
+    transcript = manual
+    if not transcript and audio_path:
+        try:
+            transcript = meet.transcribe_audio(audio_path, language)
+        except meet.TranscriptionUnavailable as exc:
+            transcript = ""  # stored; client transcribes or posts manual text later
+            _ = exc
+    try:
+        tid = meet.save_transcript(page_id, transcript, language, audio_path)
+    except ValueError as exc:
+        raise HTTPException(404, str(exc)) from None
+    with get_conn() as conn:
+        row = conn.execute("SELECT * FROM meeting_transcripts WHERE id=?", (tid,)).fetchone()
+    audit_log(user, "meeting.transcribe", "page", page_id, f"transcript={tid}", request)
+    return JSONResponse(status_code=201, content={
+        **row_to_dict(row), "transcribed": bool(transcript)})
+
+
+@router.post("/api/v2/meetings/transcripts/{transcript_id}/text")
+def set_transcript_text(transcript_id: int, request: Request, body: dict = Body(default={})):
+    """Store a client-side (manual) transcript on an existing row."""
+    _auth_user(request, require_write=True)
+    text = (body.get("transcript") or "").strip()
+    if not text:
+        raise HTTPException(400, "transcript required")
+    with get_conn() as conn:
+        if not conn.execute("SELECT id FROM meeting_transcripts WHERE id=?",
+                            (transcript_id,)).fetchone():
+            raise HTTPException(404, "Transcript not found")
+        conn.execute("UPDATE meeting_transcripts SET transcript=? WHERE id=?",
+                     (text, transcript_id))
+        conn.commit()
+        row = conn.execute("SELECT * FROM meeting_transcripts WHERE id=?",
+                           (transcript_id,)).fetchone()
+    return row_to_dict(row)
+
+
+@router.post("/api/v2/meetings/transcripts/{transcript_id}/summarize")
+async def summarize(transcript_id: int, request: Request):
+    user = _auth_user(request, require_write=True)
+    try:
+        out = await meet.summarize_transcript(transcript_id, user.get("id"))
+    except ValueError as exc:
+        raise HTTPException(400, str(exc)) from None
+    except RuntimeError as exc:
+        raise HTTPException(502, str(exc)) from None
+    audit_log(user, "meeting.summarize", "transcript", transcript_id, "", request)
+    return out

app/routers/my_tasks.py

@@ -4,11 +4,12 @@ from __future__ import annotations
 import json
 import logging
 
-from fastapi import APIRouter, Request, HTTPException, Query
+from fastapi import APIRouter, Request
 from fastapi.responses import HTMLResponse
 
-from app.db import get_conn
 from app.auth.session import SessionManager
+from app.db import get_conn
+from app.templating import ENV
 
 logger = logging.getLogger(__name__)
 router = APIRouter(tags=["my-tasks"], prefix="/my-tasks")
@@ -20,7 +21,7 @@ def _get_current_user(request: Request) -> dict | None:
 
 
 @router.get("", response_class=HTMLResponse)
-async def my_tasks_dashboard(request: Request, view: str = "all", days: int = 7):
+def my_tasks_dashboard(request: Request, view: str = "all", days: int = 7):
     """My Tasks — aggregates all pages assigned to the current user across all collections."""
     user = _get_current_user(request)
     user_login = user.get("login", "admin") if user else "admin"
@@ -38,121 +39,89 @@ async def my_tasks_dashboard(request: Request, view: str = "all", days: int = 7)
 
             collection_tasks = []
             for p in pages:
-                props = json.loads(p["property_values_json"])
-                # Check if assigned to current user
-                assigned = False
-                for v in props.values():
-                    if isinstance(v, list):
-                        for item in v:
-                            if isinstance(item, dict) and item.get("login") == user_login:
-                                assigned = True
-                                break
-                    elif isinstance(v, str) and user_login.lower() in v.lower():
-                        assigned = True
-                    if assigned:
-                        break
-
-                if not assigned and user_login == "admin":
-                    assigned = True  # admin sees all
-
-                if not assigned:
+                props = {}
+                try:
+                    props = json.loads(p["property_values_json"] or "{}")
+                except (json.JSONDecodeError, TypeError):
+                    pass
+                due_date = props.get("due_date", "")
+                status = props.get("status", "—")
+                assignee = props.get("assignee", "")
+                if view != "all" and assignee and assignee != user_login:
                     continue
-
-                # Extract status and due date
-                status = None
-                due_date = None
-                for v in props.values():
-                    if isinstance(v, str) and v in ("Todo", "In Progress", "Done", "Complete"):
-                        status = v
-                    elif isinstance(v, str) and v.startswith("20"):
-                        due_date = v[:10]
-
-                # Filter by view
-                if view == "today":
-                    from datetime import date
-                    if not due_date or due_date != date.today().isoformat():
-                        continue
-                elif view == "overdue":
-                    from datetime import date
-                    if not due_date or due_date >= date.today().isoformat():
-                        continue
-                elif view == "upcoming":
-                    from datetime import date, timedelta
-                    if not due_date:
-                        continue
-                    today = date.today()
-                    limit = today + timedelta(days=days)
-                    d = date.fromisoformat(due_date)
-                    if d < today or d > limit:
-                        continue
-
                 collection_tasks.append({
-                    "id": p["id"], "title": p["title"], "icon": p.get("icon", "📄"),
-                    "status": status, "due_date": due_date, "props": props,
+                    "id": p["id"],
+                    "title": p["title"] or "Untitled",
+                    "icon": p["icon"] or "📋",
+                    "status": status,
+                    "due_date": due_date,
                 })
-
             if collection_tasks:
                 grouped[col["name"]] = collection_tasks
 
     total = sum(len(t) for t in grouped.values())
 
-    # Render
+    # Build content HTML
     sections = ""
     for col_name, tasks in grouped.items():
         items = ""
         for t in tasks:
             due_badge = f"<span class='mt-due'>{t['due_date']}</span>" if t.get("due_date") else ""
-            status_badge = f"<span class='mt-status mt-{t['status'].lower().replace(' ','-') if t.get('status') else 'none'}'>{t.get('status','—')}</span>"
-            items += f"""<div class='mt-item'>
-<span class='mt-icon'>{t['icon']}</span>
-<span class='mt-title'>{t['title']}</span>
-{status_badge}{due_badge}
-</div>"""
+            status_cls = t['status'].lower().replace(' ', '-') if t.get('status') else 'none'
+            status_badge = f"<span class='mt-status mt-{status_cls}'>{t.get('status', '—')}</span>"
+            items += f"<div class='mt-item'><span class='mt-icon'>{t['icon']}</span><span class='mt-title'>{t['title']}</span>{status_badge}{due_badge}</div>"
 
-        sections += f"""<div class='mt-section'>
-<div class='mt-section-header'>{col_name} <span class='mt-count'>{len(tasks)}</span></div>
-{items}
-</div>"""
+        sections += f"<div class='mt-section'><div class='mt-section-header'>{col_name} <span class='mt-count'>{len(tasks)}</span></div>{items}</div>"
 
-    return HTMLResponse(f"""<!DOCTYPE html>
-<html><head><meta charset="utf-8"><title>My Tasks — FlowDeck</title>
-<style>
-body{{font-family:system-ui,sans-serif;background:#191919;color:#fff;margin:0;padding:20px}}
-h1{{font-size:24px;margin:0 0 16px}}
-.view-tabs{{display:flex;gap:4px;margin-bottom:20px;border-bottom:1px solid #333;padding-bottom:8px}}
-.tab{{padding:6px 14px;border-radius:6px;cursor:pointer;color:#A0A0A0;font-size:13px;background:none;border:none;text-decoration:none}}
-.tab:hover,.tab.active{{background:#333;color:#fff}}
-.mt-section{{margin-bottom:24px}}
-.mt-section-header{{font-size:14px;font-weight:600;color:#A0A0A0;margin-bottom:8px;text-transform:uppercase;letter-spacing:.5px}}
-.mt-count{{color:#6B6B6B;font-weight:400}}
-.mt-item{{display:flex;align-items:center;gap:10px;padding:8px 12px;background:#1a1a1a;border-radius:6px;margin-bottom:3px;border:1px solid #222}}
-.mt-item:hover{{border-color:#444}}
-.mt-icon{{font-size:16px}}
-.mt-title{{flex:1;font-size:14px}}
-.mt-status{{font-size:11px;padding:2px 8px;border-radius:4px}}
-.mt-due{{font-size:11px;color:#A0A0A0}}
-.mt-todo{{background:#333;color:#A0A0A0}}
-.mt-in-progress{{background:#1a2744;color:#3366CC}}
-.mt-done,.mt-complete{{background:#1a332a;color:#00CC66}}
-.p_desc{{color:#A0A0A0;margin-top:8px}}
-</style></head><body>
-<h1>📋 My Tasks</h1>
-<div class="view-tabs">
-<a class="tab{' active' if view=='all' else ''}" href="?view=all">All</a>
-<a class="tab{' active' if view=='today' else ''}" href="?view=today">Today</a>
-<a class="tab{' active' if view=='overdue' else ''}" href="?view=overdue">Overdue</a>
-<a class="tab{' active' if view=='upcoming' else ''}" href="?view=upcoming&days=7">Next 7 days</a>
+    content_html = f"""<div style="max-width:800px;margin:0 auto;padding:40px 24px;">
+<h1 style="font-size:24px;margin:0 0 8px;">📋 My Tasks</h1>
+<p style="color:var(--text-dim);font-size:14px;margin-bottom:24px;">{total} tasks across {len(grouped)} collections</p>
+<div class="view-tabs" style="display:flex;gap:4px;margin-bottom:24px;border-bottom:1px solid var(--border);padding-bottom:12px;">
+<a class="tab{' active' if view=='all' else ''}" href="/my-tasks?view=all" style="padding:6px 14px;border-radius:6px;cursor:pointer;color:var(--text-dim);font-size:13px;text-decoration:none;">All</a>
+<a class="tab{' active' if view=='today' else ''}" href="/my-tasks?view=today" style="padding:6px 14px;border-radius:6px;cursor:pointer;color:var(--text-dim);font-size:13px;text-decoration:none;">Today</a>
+<a class="tab{' active' if view=='overdue' else ''}" href="/my-tasks?view=overdue" style="padding:6px 14px;border-radius:6px;cursor:pointer;color:var(--text-dim);font-size:13px;text-decoration:none;">Overdue</a>
+<a class="tab{' active' if view=='upcoming' else ''}" href="/my-tasks?view=upcoming&days=7" style="padding:6px 14px;border-radius:6px;cursor:pointer;color:var(--text-dim);font-size:13px;text-decoration:none;">Next 7 days</a>
 </div>
+<style>
+.tab.active{{background:var(--accent);color:#fff!important;}}
+.tab:hover{{background:var(--bg-hover);color:var(--text);}}
+.mt-section{{margin-bottom:24px;}}
+.mt-section-header{{font-size:13px;font-weight:600;color:var(--text-dim);margin-bottom:8px;text-transform:uppercase;letter-spacing:.5px;}}
+.mt-count{{color:var(--text-dim);font-weight:400;opacity:.5;}}
+.mt-item{{display:flex;align-items:center;gap:10px;padding:10px 12px;background:var(--bg-card);border-radius:8px;margin-bottom:3px;border:1px solid var(--border);}}
+.mt-item:hover{{border-color:var(--accent);}}
+.mt-icon{{font-size:16px;}}
+.mt-title{{flex:1;font-size:14px;}}
+.mt-status{{font-size:11px;padding:2px 8px;border-radius:4px;}}
+.mt-due{{font-size:11px;color:var(--text-dim);}}
+.mt-todo,.mt-none{{background:rgba(255,255,255,.05);color:var(--text-dim);}}
+.mt-in-progress{{background:rgba(35,131,226,.15);color:#2C8CEB;}}
+.mt-done,.mt-completed,.mt-complete{{background:rgba(0,200,100,.15);color:#00CC66;}}
+</style>
 {sections}
-<p class="p_desc">{total} tasks across {len(grouped)} collections</p>
-</body></html>""")
+</div>"""
+
+    from app.routers.dashboard import _sidebar_data
+    env = ENV
+    sidebar = _sidebar_data(request, [])
+    block_tpl = env.from_string(
+        '{% extends "base.html" %}{% block content %}{{ content_html|safe }}{% endblock %}'
+    )
+    return block_tpl.render(
+        **sidebar,
+        request=request,
+        content_html=content_html,
+        page_title="My Tasks",
+        title_prefix="My Tasks",
+        page_icon="📋",
+    )
 
 
 @router.get("/api")
-async def my_tasks_api(request: Request, view: str = "all", days: int = 7):
+def my_tasks_api(request: Request, view: str = "all", days: int = 7):
     """API: return my tasks as JSON."""
     user = _get_current_user(request)
-    user_login = user.get("login", "admin") if user else "admin"
+    user.get("login", "admin") if user else "admin"
 
     with get_conn() as conn:
         collections = conn.execute("SELECT * FROM collections ORDER BY name").fetchall()

app/routers/notes.py

@@ -13,7 +13,7 @@ router = APIRouter(tags=["notes"], prefix="/notes")
 
 
 @router.get("/{owner}/{repo}", response_class=HTMLResponse)
-async def get_notes(request: Request, owner: str, repo: str):
+def get_notes(request: Request, owner: str, repo: str):
     with get_conn() as conn:
         row = conn.execute(
             "SELECT content FROM notes WHERE project_owner=? AND project_name=? AND title='Notes'",
@@ -21,9 +21,9 @@ async def get_notes(request: Request, owner: str, repo: str):
         ).fetchone()
     content = row["content"] if row else ""
 
-    from jinja2 import Environment, FileSystemLoader
     from app.auth.session import SessionManager
-    env = Environment(loader=FileSystemLoader("app/templates"))
+    from app.templating import ENV
+    env = ENV
     user = SessionManager.decode_session(request.cookies.get("flowdeck_session", ""))
     template = env.get_template("notes.html")
     return template.render(request=request, owner=owner, repo=repo, content=content, user=user)
@@ -44,9 +44,9 @@ async def save_notes(request: Request, owner: str, repo: str):
         )
         conn.commit()
 
-    from jinja2 import Environment, FileSystemLoader
     from app.auth.session import SessionManager
-    env = Environment(loader=FileSystemLoader("app/templates"))
+    from app.templating import ENV
+    env = ENV
     user = SessionManager.decode_session(request.cookies.get("flowdeck_session", ""))
     template = env.get_template("notes.html")
     return template.render(request=request, owner=owner, repo=repo, content=content, user=user)

app/routers/notifications.py

@@ -0,0 +1,149 @@
+"""FlowDeck — Notifications API (v4.9.0 collaboration)."""
+from __future__ import annotations
+
+import logging
+
+from fastapi import APIRouter, Body, HTTPException, Request
+
+from app.auth.session import SessionManager
+from app.db import get_conn
+
+logger = logging.getLogger(__name__)
+router = APIRouter(tags=["notifications"], prefix="/api/notifications")
+
+
+def _current_user(request: Request) -> dict:
+    user = SessionManager.decode_session(request.cookies.get("flowdeck_session", ""))
+    if not user or not user.get("id"):
+        raise HTTPException(status_code=401, detail="Authentication required")
+    return user
+
+
+@router.get("")
+def list_notifications(request: Request, limit: int = 50):
+    """List the current user's notifications, newest first."""
+    user = _current_user(request)
+    with get_conn() as conn:
+        rows = conn.execute(
+            """SELECT n.*, a.login AS actor_login, a.full_name AS actor_name,
+                      a.avatar_url AS actor_avatar, a.avatar_color AS actor_color
+               FROM notifications n
+               LEFT JOIN users a ON n.actor_id = a.id
+               WHERE n.user_id=?
+               ORDER BY n.created_at DESC, n.id DESC LIMIT ?""",
+            (user["id"], limit),
+        ).fetchall()
+        unread = conn.execute(
+            "SELECT COUNT(*) AS c FROM notifications WHERE user_id=? AND is_read=0",
+            (user["id"],),
+        ).fetchone()["c"]
+    return {
+        "notifications": [dict(r) for r in rows],
+        "unread": unread,
+    }
+
+
+@router.get("/unread-count")
+def unread_count(request: Request):
+    """Unread count for the topbar badge."""
+    user = _current_user(request)
+    with get_conn() as conn:
+        c = conn.execute(
+            "SELECT COUNT(*) AS c FROM notifications WHERE user_id=? AND is_read=0",
+            (user["id"],),
+        ).fetchone()["c"]
+    return {"unread": c}
+
+
+@router.post("/read")
+def mark_read(request: Request, body: dict = Body(default={})):
+    """Mark one notification as read (id) or all (id omitted)."""
+    user = _current_user(request)
+    nid = body.get("id")
+    with get_conn() as conn:
+        if nid:
+            conn.execute(
+                "UPDATE notifications SET is_read=1 WHERE id=? AND user_id=?",
+                (nid, user["id"]),
+            )
+        else:
+            conn.execute(
+                "UPDATE notifications SET is_read=1 WHERE user_id=?",
+                (user["id"],),
+            )
+        conn.commit()
+    return {"status": "ok"}
+
+
+@router.post("/read-all")
+async def mark_all_read(request: Request):
+    """Mark all notifications as read."""
+    return await mark_read(request)
+
+
+@router.get("/prefs")
+def get_prefs(request: Request):
+    """Return the current user's notification email preferences."""
+    user = _current_user(request)
+    from app.services import notifications as notif
+    return {"prefs": notif.get_user_prefs(user["id"])}
+
+
+@router.post("/prefs")
+def set_prefs(request: Request, body: dict = Body(default={})):
+    """Update the current user's notification email preferences."""
+    user = _current_user(request)
+    from app.services import notifications as notif
+    prefs = notif.get_user_prefs(user["id"])
+    for key in ("comments", "mentions", "reminders", "assignments"):
+        if key in body:
+            prefs[key] = bool(body[key])
+    notif.set_user_prefs(user["id"], prefs)
+    return {"status": "ok", "prefs": prefs}
+
+
+@router.get("/timezone")
+def get_timezone(request: Request):
+    """Return the current user's IANA timezone ('' = UTC)."""
+    user = _current_user(request)
+    with get_conn() as conn:
+        row = conn.execute("SELECT timezone FROM users WHERE id=?", (user["id"],)).fetchone()
+    tz = (row["timezone"] if row and "timezone" in row.keys() else "") or ""
+    from app.services.recurrence import common_timezones
+    return {"timezone": tz, "zones": common_timezones()}
+
+
+@router.post("/timezone")
+def set_timezone(request: Request, body: dict = Body(default={})):
+    """Update the current user's IANA timezone (empty string = UTC)."""
+    user = _current_user(request)
+    tz = (body.get("timezone") or "").strip()
+    from app.services.recurrence import is_valid_timezone
+    if tz and not is_valid_timezone(tz):
+        raise HTTPException(status_code=400, detail=f"Unknown timezone '{tz}'")
+    with get_conn() as conn:
+        conn.execute("UPDATE users SET timezone=? WHERE id=?", (tz, user["id"]))
+        conn.commit()
+    return {"status": "ok", "timezone": tz}
+
+
+@router.get("/users/search")
+def search_users(request: Request, q: str = ""):
+    """User autocomplete for @mentions."""
+    _current_user(request)
+    q = (q or "").strip()
+    with get_conn() as conn:
+        if q:
+            like = f"%{q}%"
+            rows = conn.execute(
+                """SELECT id, login, full_name, avatar_url, avatar_color
+                   FROM users WHERE login LIKE ? OR full_name LIKE ?
+                   ORDER BY (login=? OR full_name=?) DESC, login LIMIT 20""",
+                (like, like, q, q),
+            ).fetchall()
+        else:
+            rows = conn.execute(
+                """SELECT id, login, full_name, avatar_url, avatar_color
+                   FROM users ORDER BY login LIMIT 20"""
+            ).fetchall()
+    return {"users": [dict(r) for r in rows]}

app/routers/onboarding.py

@@ -0,0 +1,127 @@
+"""FlowDeck — v5.2.0 Onboarding: /welcome wizard + its API.
+
+First-launch experience: create workspace → connect a forge (optional) →
+create the first project (welcome page), then land in the app.
+"""
+from __future__ import annotations
+
+import json
+import logging
+
+from fastapi import APIRouter, Body, HTTPException, Request
+from fastapi.responses import HTMLResponse, JSONResponse, RedirectResponse
+
+from app.auth.session import SessionManager
+from app.db import get_conn
+
+logger = logging.getLogger(__name__)
+router = APIRouter(tags=["onboarding"])
+
+WORKSPACE_COOKIE = "flowdeck_workspace"
+
+
+def _require_user(request: Request) -> dict:
+    user = SessionManager.decode_session(request.cookies.get("flowdeck_session", ""))
+    if not user or not user.get("id"):
+        raise HTTPException(status_code=401, detail="Not authenticated")
+    return user
+
+
+@router.get("/welcome", response_class=HTMLResponse)
+def onboarding_page(request: Request):
+    """Onboarding wizard. Redirects logged-out users to login and users who
+    already have a workspace straight to the app."""
+    user = SessionManager.decode_session(request.cookies.get("flowdeck_session", ""))
+    if not user:
+        return RedirectResponse("/auth/login?provider=local", status_code=302)
+    with get_conn() as conn:
+        ws_count = conn.execute(
+            "SELECT COUNT(*) FROM workspaces WHERE owner_id=?", (user["id"],)
+        ).fetchone()[0]
+    if ws_count > 0:
+        return RedirectResponse("/workspaces", status_code=302)
+
+    from app.templating import ENV
+    env = ENV
+    template = env.get_template("welcome.html")
+    return HTMLResponse(content=template.render(
+        user=user,
+        gitea_url_configured=_forge_configured("gitea"),
+        github_url_configured=_forge_configured("github"),
+    ))
+
+
+def _forge_configured(provider: str) -> bool:
+    try:
+        from app.auth.providers import get_provider
+        return get_provider(provider) is not None
+    except Exception:
+        return False
+
+
+# ═══════════ Onboarding API ═══════════
+
+
+@router.post("/api/onboarding/workspace")
+def onboarding_create_workspace(request: Request, body: dict = Body(default={})):
+    """Step 1 — create the first local workspace."""
+    user = _require_user(request)
+    name = (body.get("name") or "").strip() or "My Workspace"
+
+    with get_conn() as conn:
+        cur = conn.execute(
+            "INSERT INTO workspaces (name, owner_id, settings_json) VALUES (?, ?, '{}')",
+            (name, user["id"]),
+        )
+        conn.execute(
+            "INSERT INTO workspace_members (workspace_id, user_id, role) VALUES (?, ?, 'owner')",
+            (cur.lastrowid, user["id"]),
+        )
+        conn.commit()
+        ws_id = cur.lastrowid
+
+    response = JSONResponse({"status": "ok", "id": ws_id, "name": name})
+    response.set_cookie(WORKSPACE_COOKIE, str(ws_id), max_age=86400 * 30, httponly=True, path="/")
+    return response
+
+
+@router.post("/api/onboarding/project")
+def onboarding_create_project(request: Request, body: dict = Body(default={})):
+    """Step 3 — create the first project: a welcome page in the workspace."""
+    user = _require_user(request)
+    title = (body.get("title") or "").strip() or "Welcome to FlowDeck"
+    workspace_id = body.get("workspace_id")
+
+    with get_conn() as conn:
+        ws = None
+        if workspace_id:
+            ws = conn.execute(
+                "SELECT id FROM workspaces WHERE id=? AND owner_id=?",
+                (workspace_id, user["id"]),
+            ).fetchone()
+        if not ws:
+            ws = conn.execute(
+                "SELECT id FROM workspaces WHERE owner_id=? ORDER BY id LIMIT 1",
+                (user["id"],),
+            ).fetchone()
+        if not ws:
+            raise HTTPException(status_code=400, detail="Create a workspace first")
+
+        blocks = [
+            {"id": "1", "type": "heading_1", "content": title},
+            {"id": "2", "type": "paragraph",
+             "content": "Welcome to FlowDeck 🎉 — your workspace is ready."},
+            {"id": "3", "type": "paragraph",
+             "content": "Use the slash command « / » in any page to add blocks, databases, to-dos and more."},
+            {"id": "4", "type": "paragraph",
+             "content": "Connect Gitea or GitHub in Settings → Integrations to sync your repositories."},
+        ]
+        cur = conn.execute(
+            "INSERT INTO pages (workspace, workspace_id, title, content, content_format, parent_section) "
+            "VALUES (?, ?, ?, ?, 'blocks', 'Private')",
+            (user.get("login", "local"), ws["id"], title, json.dumps(blocks)),
+        )
+        conn.commit()
+        page_id = cur.lastrowid
+
+    return {"status": "ok", "id": page_id, "title": title, "workspace_id": ws["id"]}

app/routers/permissions.py

@@ -0,0 +1,518 @@
+"""FlowDeck — v6.0.0 Granular permissions API (page/collection/property ACL).
+
+Backend for the page-editor "Permissions" panel, database property visibility
+and user-group management. Grants are stored in ``page_permissions`` /
+``collection_permissions`` / ``property_permissions``; every mutation is logged
+into ``permission_audit_log`` for the admin audit view.
+"""
+from __future__ import annotations
+
+import logging
+
+from fastapi import APIRouter, Body, HTTPException, Request
+
+from app.auth.session import SessionManager
+from app.db import get_conn
+from app.services.permission_manager import PermissionManager
+
+logger = logging.getLogger(__name__)
+router = APIRouter(tags=["permissions"], prefix="/api/v2")
+
+
+PAGE_ROLES = ("viewer", "commenter", "editor", "owner")
+COLLECTION_ROLES = ("viewer", "commenter", "editor", "owner")
+PROPERTY_ROLES = ("viewer", "editor")
+PERMISSION_TYPES = ("inherit", "restricted", "private")
+
+
+def _require_user(request: Request) -> dict:
+    user = SessionManager.decode_session(request.cookies.get("flowdeck_session", ""))
+    if not user or not user.get("id"):
+        raise HTTPException(status_code=401, detail="Not authenticated")
+    return user
+
+
+def _pm(request: Request) -> PermissionManager:
+    return PermissionManager(_require_user(request)["id"])
+
+
+def _client_ip(request: Request) -> str:
+    try:
+        return request.client.host if request.client else ""
+    except Exception:
+        return ""
+
+
+def _perm_list(conn, table: str, fk: str, resource_id: int) -> list[dict]:
+    rows = conn.execute(
+        f"""SELECT p.*,
+                   u.login AS user_login, u.full_name AS user_name,
+                   g.name AS group_name
+              FROM {table} p
+              LEFT JOIN users u ON u.id = p.user_id
+              LEFT JOIN user_groups g ON g.id = p.group_id
+             WHERE p.{fk}=? ORDER BY p.id""",
+        (resource_id,),
+    ).fetchall()
+    out = []
+    for r in rows:
+        d = dict(r)
+        if d.get("user_id"):
+            d["name"] = d["user_name"] or d["user_login"] or f"User #{d['user_id']}"
+            d["kind"] = "user"
+        else:
+            d["name"] = d["group_name"] or f"Group #{d['group_id']}"
+            d["kind"] = "group"
+        out.append(d)
+    return out
+
+
+def _grant_common(request: Request, pm: PermissionManager, resource_type: str,
+                  resource_id: int, body: dict, table: str, fk: str,
+                  allowed_roles: tuple[str, ...],
+                  extra_cols: dict | None = None) -> dict:
+    user_id = body.get("user_id")
+    group_id = body.get("group_id")
+    role = (body.get("role") or "").strip()
+    if role not in allowed_roles:
+        raise HTTPException(400, f"role must be one of {', '.join(allowed_roles)}")
+    if not user_id and not group_id:
+        raise HTTPException(400, "Provide either user_id or group_id")
+    if user_id and not isinstance(user_id, int):
+        raise HTTPException(400, "user_id must be an integer")
+    if group_id and not isinstance(group_id, int):
+        raise HTTPException(400, "group_id must be an integer")
+    actor = _require_user(request)["id"]
+    with get_conn() as conn:
+        if user_id:
+            exists = conn.execute("SELECT id FROM users WHERE id=?", (user_id,)).fetchone()
+            if not exists:
+                raise HTTPException(404, "User not found")
+        if group_id:
+            exists = conn.execute("SELECT id FROM user_groups WHERE id=?", (group_id,)).fetchone()
+            if not exists:
+                raise HTTPException(404, "Group not found")
+        existing = conn.execute(
+            f"SELECT id, role FROM {table} WHERE {fk}=? AND user_id IS ? AND group_id IS ?",
+            (resource_id, user_id, group_id),
+        ).fetchone()
+        if existing:
+            conn.execute(f"UPDATE {table} SET role=? WHERE id=?",
+                         (role, existing["id"]))
+            old_role = existing["role"]
+            perm_id = existing["id"]
+        else:
+            cols = [fk, "user_id", "group_id", "role", "granted_by"]
+            vals: list = [resource_id, user_id, group_id, role, actor]
+            for col, val in (extra_cols or {}).items():
+                cols.append(col)
+                vals.append(val)
+            placeholders = ", ".join("?" for _ in cols)
+            cur = conn.execute(
+                f"INSERT INTO {table} ({', '.join(cols)}) VALUES ({placeholders})",
+                tuple(vals),
+            )
+            perm_id = cur.lastrowid
+            old_role = None
+        conn.commit()
+    pm.invalidate()
+    pm.log_permission_change(resource_type, resource_id, "grant",
+                             target_user_id=user_id, target_group_id=group_id,
+                             old_role=old_role, new_role=role, ip_address=_client_ip(request))
+    return {"status": "ok", "id": perm_id, "role": role, "user_id": user_id, "group_id": group_id}
+
+
+def _revoke_common(request: Request, pm: PermissionManager, resource_type: str,
+                   resource_id: int, table: str, fk: str, perm_id: int) -> dict:
+    with get_conn() as conn:
+        row = conn.execute(
+            f"SELECT user_id, group_id, role FROM {table} WHERE id=? AND {fk}=?",
+            (perm_id, resource_id),
+        ).fetchone()
+        if not row:
+            raise HTTPException(404, "Permission not found")
+        conn.execute(f"DELETE FROM {table} WHERE id=?", (perm_id,))
+        conn.commit()
+    pm.invalidate()
+    pm.log_permission_change(resource_type, resource_id, "revoke",
+                             target_user_id=row["user_id"], target_group_id=row["group_id"],
+                             old_role=row["role"], new_role=None, ip_address=_client_ip(request))
+    return {"status": "revoked"}
+
+
+def _set_permission_type(request: Request, pm: PermissionManager, resource_type: str,
+                         resource_id: int, table: str, body: dict) -> dict:
+    ptype = (body.get("permission_type") or "").strip()
+    if ptype not in PERMISSION_TYPES:
+        raise HTTPException(400, f"permission_type must be one of {', '.join(PERMISSION_TYPES)}")
+    with get_conn() as conn:
+        conn.execute(f"UPDATE {table} SET permission_type=? WHERE id=?", (ptype, resource_id))
+        conn.commit()
+    pm.invalidate()
+    pm.log_permission_change(resource_type, resource_id, "type_change",
+                             new_role=ptype, ip_address=_client_ip(request))
+    return {"status": "ok", "permission_type": ptype}
+
+
+# ═══════════════ Page permissions ═══════════════
+
+
+@router.get("/pages/{page_id}/permissions")
+def list_page_permissions(page_id: int, request: Request):
+    """List explicit page grants + the caller's effective role."""
+    pm = _pm(request)
+    if not pm.can_view_page(page_id):
+        raise HTTPException(404, "Page not found")
+    with get_conn() as conn:
+        grants = _perm_list(conn, "page_permissions", "page_id", page_id)
+    return {
+        "permissions": grants,
+        "mine": pm.get_page_permission(page_id),
+        "permission_type": _page_type(page_id),
+        "can_manage": pm.can_manage_page_permissions(page_id),
+    }
+
+
+@router.get("/pages/{page_id}/permissions/mine")
+def my_page_permission(page_id: int, request: Request):
+    """Effective role of the current user on a page (UI gating)."""
+    pm = _pm(request)
+    if not pm.can_view_page(page_id):
+        raise HTTPException(404, "Page not found")
+    return {
+        "role": pm.get_page_permission(page_id),
+        "can_edit": pm.can_edit_page(page_id),
+        "can_comment": pm.can_comment_page(page_id),
+        "can_manage": pm.can_manage_page_permissions(page_id),
+        "permission_type": _page_type(page_id),
+    }
+
+
+def _page_type(page_id: int) -> str:
+    with get_conn() as conn:
+        row = conn.execute(
+            "SELECT permission_type FROM pages WHERE id=?", (page_id,)
+        ).fetchone()
+    return (row["permission_type"] if row else "inherit") or "inherit"
+
+
+@router.post("/pages/{page_id}/permissions")
+def grant_page_permission(page_id: int, request: Request, body: dict = Body(default={})):
+    pm = _pm(request)
+    if not pm.can_manage_page_permissions(page_id):
+        raise HTTPException(403, "Only a page owner can manage its permissions")
+    return _grant_common(request, pm, "page", page_id, body,
+                         "page_permissions", "page_id", PAGE_ROLES)
+
+
+@router.post("/pages/{page_id}/permissions/batch")
+def batch_page_permissions(page_id: int, request: Request, body: dict = Body(default={})):
+    """Grant several permissions in one call: {grants: [{user_id|group_id, role}, ...]}."""
+    pm = _pm(request)
+    if not pm.can_manage_page_permissions(page_id):
+        raise HTTPException(403, "Only a page owner can manage its permissions")
+    grants = body.get("grants") or []
+    if not isinstance(grants, list) or not grants:
+        raise HTTPException(400, "grants must be a non-empty list")
+    results = []
+    for g in grants:
+        results.append(_grant_common(request, pm, "page", page_id, g,
+                                     "page_permissions", "page_id", PAGE_ROLES))
+    return {"status": "ok", "granted": results}
+
+
+@router.delete("/pages/{page_id}/permissions/{perm_id}")
+def revoke_page_permission(page_id: int, perm_id: int, request: Request):
+    pm = _pm(request)
+    if not pm.can_manage_page_permissions(page_id):
+        raise HTTPException(403, "Only a page owner can manage its permissions")
+    return _revoke_common(request, pm, "page", page_id, "page_permissions", "page_id", perm_id)
+
+
+@router.post("/pages/{page_id}/permission-type")
+async def set_page_permission_type(page_id: int, request: Request):
+    pm = _pm(request)
+    if not pm.can_manage_page_permissions(page_id):
+        raise HTTPException(403, "Only a page owner can manage its permissions")
+    return _set_permission_type(request, pm, "page", page_id, "pages", await request.json())
+
+
+# ═══════════════ Collection permissions ═══════════════
+
+
+@router.get("/collections/{collection_id}/permissions")
+def list_collection_permissions(collection_id: int, request: Request):
+    pm = _pm(request)
+    if not pm.can_view_collection(collection_id):
+        raise HTTPException(404, "Collection not found")
+    with get_conn() as conn:
+        grants = _perm_list(conn, "collection_permissions", "collection_id", collection_id)
+    return {
+        "permissions": grants,
+        "mine": pm.get_collection_permission(collection_id),
+        "permission_type": _collection_type(collection_id),
+        "can_manage": pm.can_manage_collection_permissions(collection_id),
+    }
+
+
+def _collection_type(collection_id: int) -> str:
+    with get_conn() as conn:
+        row = conn.execute(
+            "SELECT permission_type FROM collections WHERE id=?", (collection_id,)
+        ).fetchone()
+    return (row["permission_type"] if row else "inherit") or "inherit"
+
+
+@router.post("/collections/{collection_id}/permissions")
+def grant_collection_permission(collection_id: int, request: Request, body: dict = Body(default={})):
+    pm = _pm(request)
+    if not pm.can_manage_collection_permissions(collection_id):
+        raise HTTPException(403, "Only a collection owner can manage its permissions")
+    return _grant_common(request, pm, "collection", collection_id, body,
+                         "collection_permissions", "collection_id", COLLECTION_ROLES)
+
+
+@router.delete("/collections/{collection_id}/permissions/{perm_id}")
+def revoke_collection_permission(collection_id: int, perm_id: int, request: Request):
+    pm = _pm(request)
+    if not pm.can_manage_collection_permissions(collection_id):
+        raise HTTPException(403, "Only a collection owner can manage its permissions")
+    return _revoke_common(request, pm, "collection", collection_id,
+                          "collection_permissions", "collection_id", perm_id)
+
+
+@router.post("/collections/{collection_id}/permission-type")
+async def set_collection_permission_type(collection_id: int, request: Request):
+    pm = _pm(request)
+    if not pm.can_manage_collection_permissions(collection_id):
+        raise HTTPException(403, "Only a collection owner can manage its permissions")
+    return _set_permission_type(request, pm, "collection", collection_id,
+                                "collections", await request.json())
+
+
+@router.get("/collections/{collection_id}/properties/visible")
+def visible_properties(collection_id: int, request: Request):
+    """Split property ids into visible / hidden for the current user."""
+    pm = _pm(request)
+    if not pm.can_view_collection(collection_id):
+        raise HTTPException(404, "Collection not found")
+    visible = pm.get_visible_properties(collection_id)
+    with get_conn() as conn:
+        all_ids = [r["id"] for r in conn.execute(
+            "SELECT id FROM collection_properties WHERE collection_id=?",
+            (collection_id,),
+        ).fetchall()]
+    return {
+        "visible": visible,
+        "hidden": [pid for pid in all_ids if pid not in visible],
+        "can_edit": pm.can_edit_collection(collection_id),
+    }
+
+
+# ═══════════════ Property permissions ═══════════════
+
+
+@router.get("/collections/{collection_id}/properties/{property_id}/permissions")
+def list_property_permissions(collection_id: int, property_id: int, request: Request):
+    pm = _pm(request)
+    if not pm.can_view_collection(collection_id):
+        raise HTTPException(404, "Collection not found")
+    with get_conn() as conn:
+        grants = _perm_list(conn, "property_permissions", "property_id", property_id)
+    return {
+        "permissions": grants,
+        "mine_view": pm.can_view_property(collection_id, property_id),
+        "mine_edit": pm.can_edit_property(collection_id, property_id),
+        "can_manage": pm.can_manage_collection_permissions(collection_id),
+    }
+
+
+@router.post("/collections/{collection_id}/properties/{property_id}/permissions")
+def grant_property_permission(collection_id: int, property_id: int, request: Request, body: dict = Body(default={})):
+    pm = _pm(request)
+    if not pm.can_manage_collection_permissions(collection_id):
+        raise HTTPException(403, "Only a collection owner can manage property permissions")
+    with get_conn() as conn:
+        prop = conn.execute(
+            "SELECT id FROM collection_properties WHERE id=? AND collection_id=?",
+            (property_id, collection_id),
+        ).fetchone()
+        if not prop:
+            raise HTTPException(404, "Property not found")
+    return _grant_common(request, pm, "property", property_id, body,
+                         "property_permissions", "property_id", PROPERTY_ROLES,
+                         extra_cols={"collection_id": collection_id})
+
+
+@router.delete("/collections/{collection_id}/properties/{property_id}/permissions/{perm_id}")
+def revoke_property_permission(collection_id: int, property_id: int,
+                                     perm_id: int, request: Request):
+    pm = _pm(request)
+    if not pm.can_manage_collection_permissions(collection_id):
+        raise HTTPException(403, "Only a collection owner can manage property permissions")
+    return _revoke_common(request, pm, "property", property_id,
+                          "property_permissions", "property_id", perm_id)
+
+
+# ═══════════════ Groups ═══════════════
+
+
+@router.get("/groups")
+def list_groups(request: Request, workspace_id: int | None = None):
+    user = _require_user(request)
+    pm = PermissionManager(user["id"])
+    return {"groups": pm.get_groups_for_workspace(workspace_id)}
+
+
+@router.post("/groups")
+def create_group(request: Request, body: dict = Body(default={})):
+    pm = _pm(request)
+    ws_id = body.get("workspace_id")
+    gid = pm.create_group(ws_id, body.get("name") or "", body.get("description") or "",
+                          created_by=pm.user_id)
+    pm.log_permission_change("group", gid, "group_create",
+                             target_group_id=gid, new_role="",
+                             ip_address=_client_ip(request))
+    return {"status": "ok", "id": gid}
+
+
+@router.put("/groups/{group_id}")
+def update_group(group_id: int, request: Request, body: dict = Body(default={})):
+    pm = _pm(request)
+    name = (body.get("name") or "").strip()
+    if not name:
+        raise HTTPException(400, "name is required")
+    with get_conn() as conn:
+        row = conn.execute(
+            "SELECT workspace_id FROM user_groups WHERE id=?", (group_id,)
+        ).fetchone()
+        if not row:
+            raise HTTPException(404, "Group not found")
+        if not pm.is_workspace_admin(row["workspace_id"]):
+            raise HTTPException(403, "Only a workspace owner or admin can edit groups")
+        conn.execute(
+            "UPDATE user_groups SET name=?, description=? WHERE id=?",
+            (name, body.get("description") or "", group_id),
+        )
+        conn.commit()
+    return {"status": "ok"}
+
+
+@router.delete("/groups/{group_id}")
+def delete_group(group_id: int, request: Request):
+    pm = _pm(request)
+    with get_conn() as conn:
+        row = conn.execute(
+            "SELECT workspace_id FROM user_groups WHERE id=?", (group_id,)
+        ).fetchone()
+        if not row:
+            raise HTTPException(404, "Group not found")
+        if not pm.is_workspace_admin(row["workspace_id"]):
+            raise HTTPException(403, "Only a workspace owner or admin can delete groups")
+    pm.delete_group(group_id)
+    pm.log_permission_change("group", group_id, "group_delete",
+                             target_group_id=group_id, ip_address=_client_ip(request))
+    return {"status": "deleted"}
+
+
+@router.get("/groups/{group_id}/members")
+def list_group_members(group_id: int, request: Request):
+    user = _require_user(request)
+    return {"members": PermissionManager(user["id"]).get_group_members(group_id)}
+
+
+@router.post("/groups/{group_id}/members")
+def add_group_member(group_id: int, request: Request, body: dict = Body(default={})):
+    pm = _pm(request)
+    user_id = body.get("user_id")
+    if not user_id or not isinstance(user_id, int):
+        raise HTTPException(400, "user_id is required")
+    with get_conn() as conn:
+        row = conn.execute(
+            "SELECT workspace_id FROM user_groups WHERE id=?", (group_id,)
+        ).fetchone()
+        if not row:
+            raise HTTPException(404, "Group not found")
+        if not pm.is_workspace_admin(row["workspace_id"]):
+            raise HTTPException(403, "Only a workspace owner or admin can manage groups")
+    pm.add_user_to_group(group_id, user_id)
+    pm.invalidate()
+    pm.log_permission_change("group", group_id, "member_add",
+                             target_user_id=user_id, target_group_id=group_id,
+                             ip_address=_client_ip(request))
+    return {"status": "ok"}
+
+
+@router.delete("/groups/{group_id}/members/{user_id}")
+def remove_group_member(group_id: int, user_id: int, request: Request):
+    pm = _pm(request)
+    with get_conn() as conn:
+        row = conn.execute(
+            "SELECT workspace_id FROM user_groups WHERE id=?", (group_id,)
+        ).fetchone()
+        if not row:
+            raise HTTPException(404, "Group not found")
+        if not pm.is_workspace_admin(row["workspace_id"]):
+            raise HTTPException(403, "Only a workspace owner or admin can manage groups")
+    pm.remove_user_from_group(group_id, user_id)
+    pm.invalidate()
+    pm.log_permission_change("group", group_id, "member_remove",
+                             target_user_id=user_id, target_group_id=group_id,
+                             ip_address=_client_ip(request))
+    return {"status": "ok"}
+
+
+# ═══════════════ Users (access pickers) + audit ═══════════════
+
+
+@router.get("/users")
+def list_users(request: Request, workspace_id: int | None = None, q: str = ""):
+    """Workspace members (+ admins) for the grant pickers."""
+    _require_user(request)
+    q = (q or "").strip().lower()
+    with get_conn() as conn:
+        if workspace_id:
+            rows = conn.execute(
+                """SELECT DISTINCT u.id, u.login, u.full_name, u.email, u.avatar_color
+                   FROM users u
+                   LEFT JOIN workspace_members wm ON wm.user_id=u.id AND wm.workspace_id=?
+                   WHERE u.is_admin=1 OR wm.id IS NOT NULL
+                   ORDER BY u.login""",
+                (workspace_id,),
+            ).fetchall()
+        else:
+            rows = conn.execute(
+                "SELECT id, login, full_name, email, avatar_color FROM users ORDER BY login"
+            ).fetchall()
+    users = []
+    for r in rows:
+        d = dict(r)
+        if q and q not in (d["login"].lower(), d["full_name"].lower(),
+                           d["email"].lower()):
+            continue
+        users.append({"id": d["id"], "login": d["login"], "name": d["full_name"] or d["login"],
+                      "email": d["email"], "avatar_color": d["avatar_color"]})
+    return {"users": users}
+
+
+@router.get("/audit/permissions")
+def permission_audit(request: Request, limit: int = 100):
+    """Full permission change history — workspace owner/admin only."""
+    user = _require_user(request)
+    uid = user["id"]
+    is_admin = bool(user.get("is_admin"))
+    limit = max(1, min(int(limit), 500))
+    with get_conn() as conn:
+        if not is_admin:
+            owned = conn.execute(
+                "SELECT id FROM workspaces WHERE owner_id=?", (uid,)
+            ).fetchall()
+            if not owned:
+                raise HTTPException(403, "Only a workspace owner or admin can view the audit log")
+        rows = conn.execute(
+            """SELECT a.*, u.login AS actor_login
+               FROM permission_audit_log a LEFT JOIN users u ON u.id=a.performed_by
+               ORDER BY a.created_at DESC, a.id DESC LIMIT ?""",
+            (limit,),
+        ).fetchall()
+    return {"events": [dict(r) for r in rows]}

app/routers/projects.py

@@ -0,0 +1,66 @@
+"""FlowDeck — v5.2.0 Projects API: list, register, manual sync + backups admin."""
+from __future__ import annotations
+
+import logging
+
+from fastapi import APIRouter, Body, HTTPException, Request
+
+from app.auth.session import SessionManager
+from app.services import projects as projects_svc
+from app.services.backup import backup_db, list_backups
+
+logger = logging.getLogger(__name__)
+router = APIRouter(tags=["projects"], prefix="/api/projects")
+backups_router = APIRouter(tags=["backups"])
+
+
+def _require_admin(request: Request) -> dict:
+    user = SessionManager.decode_session(request.cookies.get("flowdeck_session", ""))
+    if not user or not user.get("is_admin"):
+        raise HTTPException(status_code=403, detail="Admin only")
+    return user
+
+
+@router.get("")
+def list_projects(request: Request):
+    """List all synced projects (optionally filtered by type)."""
+    proj_type = request.query_params.get("type") or None
+    return {"projects": projects_svc.list_projects(proj_type)}
+
+
+@router.post("")
+def create_project(request: Request, body: dict = Body(default={})):
+    """Register a standalone (builtin) project."""
+    name = (body.get("name") or "").strip()
+    if not name:
+        raise HTTPException(status_code=400, detail="name required")
+    project = projects_svc.create_builtin_project(name, body.get("owner", ""), body.get("description", ""))
+    return {"status": "ok", "project": project}
+
+
+@router.post("/sync")
+async def sync_projects(request: Request):
+    """Trigger an immediate forge sync for every connected account."""
+    _require_admin(request)
+    stats = await projects_svc.sync_all_projects()
+    return {"status": "ok", "stats": stats}
+
+
+# ═══════════ Backups (admin) ═══════════
+
+
+@backups_router.post("/api/settings/backups/run")
+def run_backup_now(request: Request):
+    """Admin: create a database backup immediately."""
+    _require_admin(request)
+    filename = backup_db()
+    if not filename:
+        raise HTTPException(status_code=400, detail="Backups disabled or no database file")
+    return {"status": "ok", "filename": filename}
+
+
+@backups_router.get("/api/settings/backups")
+def admin_list_backups(request: Request):
+    """Admin: list stored backups."""
+    _require_admin(request)
+    return {"backups": list_backups()}

app/routers/public_api.py

@@ -0,0 +1,120 @@
+"""FlowDeck — Public API router (v2.1.0, v5.2.0 per-user tokens)."""
+from __future__ import annotations
+
+import hashlib
+import logging
+from secrets import token_urlsafe
+
+from fastapi import APIRouter, Depends, Header, HTTPException, Request
+
+from app.auth.session import SessionManager
+from app.db import get_conn
+
+logger = logging.getLogger(__name__)
+router = APIRouter(tags=["public-api"], prefix="/api/v1")
+DEFAULT_TOKEN = "fd-public-key"
+
+
+def _hash_token(token: str) -> str:
+    return hashlib.sha256(token.encode("utf-8")).hexdigest()
+
+
+def _token_owner(token: str) -> dict | None:
+    """Resolve an api_tokens row by its sha256 hash (revoked → None)."""
+    with get_conn() as conn:
+        row = conn.execute(
+            "SELECT id, user_id, name FROM api_tokens WHERE token_hash=? AND revoked=0",
+            (_hash_token(token),),
+        ).fetchone()
+        if not row:
+            return None
+        conn.execute(
+            "UPDATE api_tokens SET last_used_at=CURRENT_TIMESTAMP WHERE id=?", (row["id"],)
+        )
+        conn.commit()
+        return dict(row)
+
+
+def verify_token(authorization: str | None = Header(None)):
+    if not authorization or not authorization.startswith("Bearer "):
+        raise HTTPException(401, "API token required. Generate one via Settings → API tokens.")
+    token = authorization[7:]  # strip "Bearer "
+    if token == DEFAULT_TOKEN:
+        from app.config import settings as _s
+        if not _s.public_api_insecure_ok:
+            raise HTTPException(401, "Default token disabled. Set PUBLIC_API_INSECURE_OK=true in dev or use a real Bearer token.")
+        return token
+    with get_conn() as conn:
+        row = conn.execute("SELECT 1 FROM user_tokens WHERE gitea_token=?", (token,)).fetchone()
+    if row:
+        return token
+    owner = _token_owner(token)
+    if not owner:
+        raise HTTPException(403, "Invalid API token")
+    return token
+
+
+@router.post("/token")
+def generate_token(request: Request):
+    """Generate a public API access token (A4 : session obligatoire — plus de
+    « legacy shared token » `user_id=0` créable par un anonymous)."""
+    user = SessionManager.decode_session(request.cookies.get("flowdeck_session", ""))
+    if not user or not user.get("id"):
+        raise HTTPException(401, "Authentication required")
+    token = f"fd_{token_urlsafe(24)}"
+    with get_conn() as conn:
+        conn.execute(
+            "INSERT INTO api_tokens (user_id, name, token_hash, token_prefix) VALUES (?, ?, ?, ?)",
+            (user["id"], "API token", _hash_token(token), token[:12]),
+        )
+        conn.commit()
+    return {"token": token, "note": "Use as: Authorization: Bearer <token>"}
+
+
+@router.get("/collections", dependencies=[Depends(verify_token)])
+def public_list_collections(request: Request):
+    with get_conn() as conn:
+        rows = conn.execute("SELECT id, name, description, icon, created_at FROM collections ORDER BY name").fetchall()
+    return {"collections": [dict(r) for r in rows]}
+
+
+@router.get("/collections/{collection_id}", dependencies=[Depends(verify_token)])
+def public_get_collection(request: Request, collection_id: int):
+    with get_conn() as conn:
+        coll = conn.execute("SELECT * FROM collections WHERE id=?", (collection_id,)).fetchone()
+        if not coll:
+            raise HTTPException(404, "Not found")
+        pages = conn.execute(
+            "SELECT id, title, icon, position, property_values_json, created_at, updated_at FROM collection_pages WHERE collection_id=? ORDER BY position",
+            (collection_id,),
+        ).fetchall()
+    return {"collection": dict(coll), "pages": [dict(p) for p in pages]}
+
+
+@router.get("/collections/{collection_id}/pages", dependencies=[Depends(verify_token)])
+def public_list_pages(request: Request, collection_id: int):
+    with get_conn() as conn:
+        pages = conn.execute(
+            "SELECT id, title, icon, position, property_values_json, created_at FROM collection_pages WHERE collection_id=? AND parent_id IS NULL ORDER BY position",
+            (collection_id,),
+        ).fetchall()
+    return {"pages": [dict(p) for p in pages]}
+
+
+@router.get("/pages/{page_id}", dependencies=[Depends(verify_token)])
+def public_get_page(request: Request, page_id: int):
+    with get_conn() as conn:
+        p = conn.execute("SELECT * FROM collection_pages WHERE id=?", (page_id,)).fetchone()
+        if not p:
+            raise HTTPException(404, "Not found")
+    return dict(p)
+
+
+@router.get("/my-tasks", dependencies=[Depends(verify_token)])
+def public_my_tasks(request: Request):
+    """Public API: list tasks (requires valid token)."""
+    with get_conn() as conn:
+        pages = conn.execute(
+            "SELECT id, title, icon, property_values_json FROM collection_pages WHERE parent_id IS NULL ORDER BY created_at DESC LIMIT 50"
+        ).fetchall()
+    return {"tasks": [dict(p) for p in pages]}

app/routers/realtime.py

@@ -0,0 +1,63 @@
+"""FlowDeck — v5.13.0 Realtime: WebSocket gateway /ws/pages/{page_id}.
+
+Auth via cookie session (flowdeck_session). Rooms in-memory par page.
+"""
+from __future__ import annotations
+
+import json
+import logging
+
+from fastapi import APIRouter, Request, WebSocket
+from starlette.websockets import WebSocketDisconnect
+
+from app.auth.session import SessionManager
+from app.services.realtime_server import manager
+
+logger = logging.getLogger(__name__)
+router = APIRouter(tags=["realtime"])
+
+
+@router.get("/api/realtime/stats")
+def realtime_stats(request: Request):
+    """Observabilité realtime v6.4.0 : rooms, connexions, ops, merges, conflits.
+
+    Réservé aux utilisateurs authentifiés (données d'activité internes).
+    """
+    user = SessionManager.decode_session(
+        request.cookies.get("flowdeck_session", "")
+    )
+    if not user or not user.get("id"):
+        return {"error": "unauthorized"}
+    return manager.stats()
+
+
+@router.websocket("/ws/pages/{page_id}")
+async def ws_page(websocket: WebSocket, page_id: int):
+    await websocket.accept()
+    user = SessionManager.decode_session(
+        websocket.cookies.get("flowdeck_session", "")
+    )
+    if not user or not user.get("id"):
+        try:
+            await websocket.close(code=4401)
+        except Exception:
+            logger.exception("ws_page")
+        return
+
+    conn = await manager.connect(websocket, page_id, user)
+    if not conn:
+        return
+    try:
+        while True:
+            raw = await websocket.receive_text()
+            try:
+                msg = json.loads(raw)
+            except (TypeError, ValueError):
+                continue
+            await manager.handle(conn, msg)
+    except WebSocketDisconnect:
+        pass
+    except Exception as e:  # noqa: BLE001
+        logger.debug("ws closed: %s", e)
+    finally:
+        await manager.disconnect(conn)

app/routers/scim.py

@@ -0,0 +1,277 @@
+"""FlowDeck — SCIM 2.0 provisioning + domain claims (v7.2.0).
+
+``/scim/v2/Users`` (Bearer ``scim_tokens``, admin) : IT systems provision and
+deprovision accounts. Suspend (``active=false``) flips ``users.is_active`` and
+revokes ``user_sessions``. Domain claims: ``/.well-known`` HTTP verification +
+optional local-login enforcement per email domain.
+
+See ``docs/V72_Enterprise_SCIM_2FA.md``.
+"""
+from __future__ import annotations
+
+import hashlib
+import secrets
+
+from fastapi import APIRouter, Body, HTTPException, Request
+from fastapi.responses import JSONResponse
+
+from app.auth.session import SessionManager
+from app.db import get_conn
+from app.services.api_v2_helpers import audit_log
+from app.services.http_client import shared_client
+
+router = APIRouter(tags=["scim"])
+SCIM_SCHEMAS = ["urn:ietf:params:scim:schemas:core:2.0:User"]
+
+
+# ── auth ───────────────────────────────────────────────────────────────────
+
+def _scim_guard(request: Request) -> dict:
+    auth = request.headers.get("authorization") or request.headers.get("Authorization") or ""
+    if auth.lower().startswith("bearer "):
+        digest = hashlib.sha256(auth[7:].strip().encode()).hexdigest()
+        with get_conn() as conn:
+            row = conn.execute("SELECT * FROM scim_tokens WHERE token_hash=? AND revoked=0",
+                               (digest,)).fetchone()
+        if row:
+            return {"scim_token_id": row["id"], "name": row["name"]}
+    raise HTTPException(401, "SCIM token required")
+
+
+def _admin_session(request: Request) -> dict:
+    user = SessionManager.decode_session(request.cookies.get("flowdeck_session", ""))
+    if not user or not user.get("id"):
+        raise HTTPException(401, "Authentication required")
+    with get_conn() as conn:
+        row = conn.execute("SELECT is_admin FROM users WHERE id=?", (user["id"],)).fetchone()
+    if not row or not row["is_admin"]:
+        raise HTTPException(403, "Admin required")
+    return user
+
+
+def _scim_user(row) -> dict:
+    d = dict(row)
+    return {"schemas": SCIM_SCHEMAS, "id": str(d["id"]), "userName": d["login"],
+            "name": {"formatted": d.get("full_name") or d["login"]},
+            "emails": [{"value": d.get("email") or "", "primary": True}],
+            "active": bool(d.get("is_active", 1)),
+            "meta": {"resourceType": "User"}}
+
+
+# ── SCIM resources ─────────────────────────────────────────────────────────
+
+@router.get("/scim/v2/Users")
+def scim_list(request: Request):
+    _scim_guard(request)
+    with get_conn() as conn:
+        rows = conn.execute("SELECT * FROM users ORDER BY id LIMIT 100").fetchall()
+    items = [_scim_user(r) for r in rows]
+    return {"schemas": ["urn:ietf:params:scim:api:messages:2.0:ListResponse"],
+            "totalResults": len(items), "Resources": items}
+
+
+@router.post("/scim/v2/Users")
+def scim_create(request: Request, body: dict = Body(default={})):
+    _scim_guard(request)
+    username = (body.get("userName") or "").strip()
+    if not username:
+        raise HTTPException(400, "userName required")
+    email = ""
+    for em in body.get("emails") or []:
+        if isinstance(em, dict) and em.get("value"):
+            email = em["value"]
+            break
+    name = ((body.get("name") or {}).get("formatted") or username)[:200]
+    active = body.get("active", True)
+    with get_conn() as conn:
+        if conn.execute("SELECT id FROM users WHERE login=?", (username,)).fetchone():
+            raise HTTPException(409, "User already exists")
+        cur = conn.execute(
+            "INSERT INTO users (login, full_name, email, is_active, auth_method)"
+            " VALUES (?,?,?,?,'saml')",
+            (username, name, email, 1 if active else 0))
+        conn.commit()
+        row = conn.execute("SELECT * FROM users WHERE id=?", (cur.lastrowid,)).fetchone()
+    return JSONResponse(status_code=201, content=_scim_user(row))
+
+
+@router.get("/scim/v2/Users/{user_id}")
+def scim_get(user_id: str, request: Request):
+    _scim_guard(request)
+    with get_conn() as conn:
+        row = conn.execute("SELECT * FROM users WHERE id=?", (user_id,)).fetchone()
+    if not row:
+        raise HTTPException(404, "User not found")
+    return _scim_user(row)
+
+
+def _apply_scim_update(conn, user_id: str, body: dict) -> None:
+    row = conn.execute("SELECT * FROM users WHERE id=?", (user_id,)).fetchone()
+    if not row:
+        raise HTTPException(404, "User not found")
+    updates: dict = {}
+    if "userName" in body and body["userName"]:
+        updates["login"] = body["userName"].strip()
+    if isinstance(body.get("name"), dict) and body["name"].get("formatted"):
+        updates["full_name"] = body["name"]["formatted"][:200]
+    if isinstance(body.get("emails"), list):
+        for em in body["emails"]:
+            if isinstance(em, dict) and em.get("value"):
+                updates["email"] = em["value"][:200]
+                break
+    if "active" in body:
+        updates["is_active"] = 1 if body["active"] else 0
+    if updates:
+        sets = ", ".join(f"{k}=?" for k in updates)
+        conn.execute(f"UPDATE users SET {sets} WHERE id=?", (*updates.values(), user_id))
+    if body.get("active") is False:
+        conn.execute("UPDATE user_sessions SET revoked=1 WHERE user_id=?", (user_id,))
+    conn.commit()
+
+
+@router.put("/scim/v2/Users/{user_id}")
+def scim_replace(user_id: str, request: Request, body: dict = Body(default={})):
+    _scim_guard(request)
+    with get_conn() as conn:
+        _apply_scim_update(conn, user_id, body)
+        row = conn.execute("SELECT * FROM users WHERE id=?", (user_id,)).fetchone()
+    return _scim_user(row)
+
+
+@router.patch("/scim/v2/Users/{user_id}")
+def scim_patch(user_id: str, request: Request, body: dict = Body(default={})):
+    _scim_guard(request)
+    flat: dict = {}
+    for op in body.get("Operations") or []:
+        path = (op.get("path") or "").lower()
+        if path in ("username", "active"):
+            flat["userName" if path == "username" else "active"] = op.get("value")
+    with get_conn() as conn:
+        _apply_scim_update(conn, user_id, {**body, **flat})
+        row = conn.execute("SELECT * FROM users WHERE id=?", (user_id,)).fetchone()
+    return _scim_user(row)
+
+
+@router.delete("/scim/v2/Users/{user_id}")
+def scim_delete(user_id: str, request: Request):
+    _scim_guard(request)
+    with get_conn() as conn:
+        row = conn.execute("SELECT id FROM users WHERE id=?", (user_id,)).fetchone()
+        if not row:
+            raise HTTPException(404, "User not found")
+        # Deprovision = suspend (keeps content + audit trail).
+        conn.execute("UPDATE users SET is_active=0 WHERE id=?", (user_id,))
+        conn.execute("UPDATE user_sessions SET revoked=1 WHERE user_id=?", (user_id,))
+        conn.commit()
+    return JSONResponse(status_code=204, content=None)
+
+
+# ── SCIM token management (admin, session) ─────────────────────────────────
+
+@router.post("/api/v2/scim/tokens")
+def create_scim_token(request: Request, body: dict = Body(default={})):
+    admin = _admin_session(request)
+    raw = f"scim_{secrets.token_urlsafe(32)}"
+    digest = hashlib.sha256(raw.encode()).hexdigest()
+    with get_conn() as conn:
+        cur = conn.execute("INSERT INTO scim_tokens (token_hash, name, created_by)"
+                           " VALUES (?,?,?)",
+                           (digest, str(body.get("name") or "SCIM")[:120], admin["id"]))
+        conn.commit()
+    audit_log(admin, "scim.token.create", "scim_token", cur.lastrowid, "", request)
+    return JSONResponse(status_code=201,
+                        content={"id": cur.lastrowid, "token": raw,
+                                 "warning": "shown once"})
+
+
+@router.get("/api/v2/scim/tokens")
+def list_scim_tokens(request: Request):
+    _admin_session(request)
+    with get_conn() as conn:
+        rows = conn.execute("SELECT id, name, created_by, revoked, created_at"
+                            " FROM scim_tokens ORDER BY id DESC").fetchall()
+    return {"tokens": [dict(r) for r in rows]}
+
+
+@router.delete("/api/v2/scim/tokens/{token_id}")
+def revoke_scim_token(token_id: int, request: Request):
+    admin = _admin_session(request)
+    with get_conn() as conn:
+        conn.execute("UPDATE scim_tokens SET revoked=1 WHERE id=?", (token_id,))
+        conn.commit()
+    audit_log(admin, "scim.token.revoke", "scim_token", token_id, "", request)
+    return {"status": "revoked", "id": token_id}
+
+
+# ── domain claims ──────────────────────────────────────────────────────────
+
+@router.get("/api/v2/domain-claims")
+def list_domains(request: Request):
+    _admin_session(request)
+    with get_conn() as conn:
+        rows = conn.execute("SELECT * FROM domain_claims ORDER BY domain").fetchall()
+    out = []
+    for r in rows:
+        d = dict(r)
+        d.pop("txt_token", None)
+        out.append(d)
+    return {"domains": out}
+
+
+@router.post("/api/v2/domain-claims")
+def create_domain(request: Request, body: dict = Body(default={})):
+    admin = _admin_session(request)
+    domain = (body.get("domain") or "").strip().lower()
+    if not domain or "." not in domain or "/" in domain:
+        raise HTTPException(400, "valid domain required")
+    token = f"flowdeck-verify={secrets.token_hex(16)}"
+    with get_conn() as conn:
+        try:
+            cur = conn.execute(
+                """INSERT INTO domain_claims
+                   (domain, txt_token, auto_join_role, enforce_sso, workspace_id)
+                   VALUES (?,?,?,?,?)""",
+                (domain, token, body.get("auto_join_role") or "viewer",
+                 1 if body.get("enforce_sso") else 0, body.get("workspace_id")))
+            conn.commit()
+        except Exception:
+            raise HTTPException(409, "Domain already claimed") from None
+        did = cur.lastrowid
+    audit_log(admin, "domain.claim", "domain", did, domain, request)
+    return JSONResponse(status_code=201, content={
+        "id": did, "domain": domain,
+        "verify_url": f"https://{domain}/.well-known/flowdeck-verify.txt",
+        "expected_content": token})
+
+
+@router.post("/api/v2/domain-claims/{domain_id}/verify")
+async def verify_domain(domain_id: int, request: Request):
+    admin = _admin_session(request)
+    with get_conn() as conn:
+        row = conn.execute("SELECT * FROM domain_claims WHERE id=?", (domain_id,)).fetchone()
+        if not row:
+            raise HTTPException(404, "Domain not found")
+        claim = dict(row)
+    url = f"https://{claim['domain']}/.well-known/flowdeck-verify.txt"
+    try:
+        async with shared_client(timeout=10, follow_redirects=True) as client:
+            resp = await client.get(url)
+        ok = resp.status_code == 200 and claim["txt_token"] in (resp.text or "")
+    except Exception:  # noqa: BLE001 — unreachable domain = not verified
+        ok = False
+    if ok:
+        with get_conn() as conn:
+            conn.execute("UPDATE domain_claims SET verified=1 WHERE id=?", (domain_id,))
+            conn.commit()
+    audit_log(admin, "domain.verify", "domain", domain_id, str(ok), request)
+    return {"id": domain_id, "verified": ok}
+
+
+@router.delete("/api/v2/domain-claims/{domain_id}")
+def delete_domain(domain_id: int, request: Request):
+    admin = _admin_session(request)
+    with get_conn() as conn:
+        conn.execute("DELETE FROM domain_claims WHERE id=?", (domain_id,))
+        conn.commit()
+    audit_log(admin, "domain.delete", "domain", domain_id, "", request)
+    return {"status": "deleted", "id": domain_id}

app/routers/search.py

@@ -0,0 +1,27 @@
+"""FlowDeck — unified search router (v5.0.0).
+
+``GET /api/search?q=`` backs the Ctrl+K command palette. Returns matching
+editor pages and databases scoped to the current user's accessible workspaces.
+"""
+from __future__ import annotations
+
+from fastapi import APIRouter, Query, Request
+
+from app.auth.session import SessionManager
+from app.services.search import search as search_service
+
+router = APIRouter(tags=["search"])
+
+
+@router.get("/api/search")
+def search(request: Request, q: str = Query(default="")):
+    user = SessionManager.decode_session(request.cookies.get("flowdeck_session", ""))
+    user_id = user.get("id") if user and user.get("id") else None
+
+    data = search_service(q, user_id=user_id)
+    return {
+        "query": q,
+        "pages": data["pages"],
+        "collections": data["collections"],
+        "total": len(data["pages"]) + len(data["collections"]),
+    }

app/routers/search_ai.py

@@ -0,0 +1,95 @@
+"""FlowDeck — hybrid search + Ask AI API (v6.9.0).
+
+``GET /api/v2/search/hybrid`` — lexical (FTS5/LIKE) fused with vector cosine
+(RRF), workspace-scoped, ACL-filtered, paginated with ``X-Total-Count``.
+``POST /api/v2/search/ask`` — RAG answer with ``[[fdpage:ID]]`` citations
+(LLM when configured, extractive offline fallback), cached 10 min.
+
+Auth: session cookie first, Bearer fallback (``read`` scope suffices).
+See ``docs/V69_Search_Ask_AI.md``.
+"""
+from __future__ import annotations
+
+from fastapi import APIRouter, HTTPException, Request
+from fastapi.responses import JSONResponse
+
+from app.auth.session import SessionManager
+from app.db import get_conn
+from app.services import semantic_search as sem
+from app.services.api_v2_helpers import (
+    audit_log,
+    has_scope,
+    paginate_headers,
+    parse_pagination,
+    resolve_bearer_token,
+)
+
+router = APIRouter(tags=["search-ai"])
+
+
+def _auth_user(request: Request) -> dict:
+    sess = SessionManager.decode_session(request.cookies.get("flowdeck_session", ""))
+    if sess:
+        return sess
+    auth = request.headers.get("authorization") or request.headers.get("Authorization") or ""
+    if auth.lower().startswith("bearer "):
+        user = resolve_bearer_token(auth[7:].strip())
+        if not user:
+            raise HTTPException(401, "Invalid or expired API token")
+        if not has_scope(user.get("_token_scopes") or "read", "read"):
+            raise HTTPException(403, "Insufficient scope. Required: read")
+        return user
+    raise HTTPException(401, "Authentication required")
+
+
+@router.get("/api/v2/search/hybrid")
+def hybrid(request: Request):
+    user = _auth_user(request)
+    q = (request.query_params.get("q") or request.query_params.get("query") or "").strip()
+    if not q:
+        raise HTTPException(400, "q is required")
+    limit, offset = parse_pagination(request)
+    ws_raw = request.query_params.get("workspace_id")
+    workspace_id = int(ws_raw) if ws_raw and str(ws_raw).isdigit() else None
+    results, _total = sem.hybrid_search(q, user, limit=limit + offset,
+                                        workspace_id=workspace_id)
+    page = results[offset:offset + limit]
+    # Index-on-read: a fresh page may not be indexed yet (scheduler runs every
+    # 5 min). Best-effort is handled by tests calling index_resource directly.
+    resp = JSONResponse({"query": q, "results": page,
+                         "total": len(results), "limit": limit, "offset": offset})
+    for k, v in paginate_headers(len(results)).items():
+        resp.headers[k] = v
+    return resp
+
+
+@router.post("/api/v2/search/ask")
+async def ask_ai(request: Request):
+    user = _auth_user(request)
+    try:
+        body = await request.json()
+    except Exception:
+        body = {}
+    question = (body.get("question") or body.get("q") or "").strip()
+    if not question:
+        raise HTTPException(400, "question is required")
+    ws = body.get("workspace_id")
+    workspace_id = int(ws) if isinstance(ws, int) or (isinstance(ws, str) and ws.isdigit()) else None
+    out = await sem.ask(question, user, workspace_id)
+    audit_log(user, "search.ask", "search", "", question[:200], request)
+    return {"question": question, "workspace_id": workspace_id, **out}
+
+
+@router.get("/api/v2/search/index-status")
+def index_status(request: Request):
+    """How many resources are indexed vs pending (owner/admin visibility)."""
+    user = _auth_user(request)
+    with get_conn() as conn:
+        indexed = conn.execute("SELECT COUNT(*) FROM semantic_index_state").fetchone()[0]
+        vectors = conn.execute("SELECT COUNT(*) FROM semantic_embeddings").fetchone()[0]
+        pages_total = conn.execute(
+            "SELECT COUNT(*) FROM pages WHERE (deleted_at IS NULL OR deleted_at='') "
+            "AND COALESCE(search_excluded, 0)=0").fetchone()[0]
+    return {"indexed_resources": indexed, "vectors": vectors,
+            "indexable_pages": pages_total, "model": sem.MODEL, "dim": sem.DIM,
+            "user_id": user.get("id")}

app/routers/security.py

@@ -0,0 +1,120 @@
+"""FlowDeck — v5.2.0 Security: per-user API tokens & active sessions.
+
+Backend for the Settings → API tokens / Sessions UI.
+"""
+from __future__ import annotations
+
+import hashlib
+import logging
+from secrets import token_urlsafe
+
+from fastapi import APIRouter, Body, HTTPException, Request
+
+from app.auth.session import SessionManager
+from app.db import get_conn
+
+logger = logging.getLogger(__name__)
+router = APIRouter(tags=["security"], prefix="/api/settings")
+
+
+def _hash_token(token: str) -> str:
+    return hashlib.sha256(token.encode("utf-8")).hexdigest()
+
+
+def _current_user_id(request: Request) -> int:
+    user = SessionManager.decode_session(request.cookies.get("flowdeck_session", ""))
+    if not user or not user.get("id"):
+        raise HTTPException(status_code=401, detail="Not authenticated")
+    return user["id"]
+
+
+# ═══════════ API tokens ═══════════
+
+
+@router.get("/tokens")
+def list_tokens(request: Request):
+    """List the current user's API tokens (prefix only, no secrets)."""
+    uid = _current_user_id(request)
+    with get_conn() as conn:
+        rows = conn.execute(
+            "SELECT id, name, token_prefix, last_used_at, revoked, created_at "
+            "FROM api_tokens WHERE user_id=? ORDER BY created_at DESC",
+            (uid,),
+        ).fetchall()
+    return {"tokens": [dict(r) for r in rows]}
+
+
+@router.post("/tokens")
+def create_token(request: Request, body: dict = Body(default={})):
+    """Create an API token for the current user. The secret is returned once."""
+    uid = _current_user_id(request)
+    name = (body.get("name") or "").strip() or "API token"
+    token = f"fd_{token_urlsafe(24)}"
+    with get_conn() as conn:
+        cur = conn.execute(
+            "INSERT INTO api_tokens (user_id, name, token_hash, token_prefix) VALUES (?, ?, ?, ?)",
+            (uid, name[:80], _hash_token(token), token[:12]),
+        )
+        conn.commit()
+        tid = cur.lastrowid
+    return {"id": tid, "name": name, "token": token,
+            "note": "Copy this token now — it won't be shown again."}
+
+
+@router.delete("/tokens/{token_id:int}")
+def revoke_token(token_id: int, request: Request):
+    """Revoke an API token (soft delete)."""
+    uid = _current_user_id(request)
+    with get_conn() as conn:
+        row = conn.execute(
+            "SELECT id FROM api_tokens WHERE id=? AND user_id=?", (token_id, uid)
+        ).fetchone()
+        if not row:
+            raise HTTPException(status_code=404, detail="Token not found")
+        conn.execute("UPDATE api_tokens SET revoked=1 WHERE id=?", (token_id,))
+        conn.commit()
+    return {"status": "revoked"}
+
+
+# ═══════════ Active sessions ═══════════
+
+
+@router.get("/sessions")
+def list_sessions(request: Request):
+    """List the current user's active sessions with their devices."""
+    uid = _current_user_id(request)
+    current_sid = SessionManager.session_id(request.cookies.get("flowdeck_session", ""))
+    sessions = SessionManager.list_sessions(uid)
+    now = __import__("datetime").datetime.now()
+    for s in sessions:
+        s["is_current"] = (s["id"] == current_sid)
+        # A session older than 7 days is implicitly expired (cookie max-age).
+        created = s.get("created_at") or ""
+        try:
+            from datetime import datetime
+            created_dt = datetime.fromisoformat(str(created).replace("Z", ""))
+            s["expired"] = (now - created_dt).days >= 7
+        except Exception:
+            s["expired"] = False
+    return {"sessions": sessions}
+
+
+@router.post("/sessions/{sid}/revoke")
+def revoke_session(sid: str, request: Request):
+    """Revoke an active session. If it's the current one, the user is logged out."""
+    uid = _current_user_id(request)
+    with get_conn() as conn:
+        row = conn.execute(
+            "SELECT id FROM user_sessions WHERE id=? AND user_id=?", (sid, uid)
+        ).fetchone()
+    if not row:
+        raise HTTPException(status_code=404, detail="Session not found")
+    SessionManager.revoke_session(sid)
+    # Also wipe the OAuth state cookie if the current session was revoked.
+    current_sid = SessionManager.session_id(request.cookies.get("flowdeck_session", ""))
+    if current_sid == sid:
+        try:
+            request.session.clear()
+        except Exception:
+            logger.exception("revoke_session")
+    return {"status": "revoked"}

app/routers/sharing.py

@@ -0,0 +1,356 @@
+"""FlowDeck — Sharing, Publishing & Recents API (v4.0)."""
+from __future__ import annotations
+
+import logging
+from datetime import UTC, datetime
+
+from fastapi import APIRouter, Body, HTTPException, Request
+
+from app.auth.session import SessionManager
+from app.db import get_conn
+from app.services.automations import fire_event as _fire_event
+from app.services.automations import run_event_sync
+from app.services.publish import fire_published, fire_unpublished, publish, unpublish
+
+logger = logging.getLogger(__name__)
+router = APIRouter(tags=["sharing"], prefix="/api")
+
+
+def _require_auth(request: Request) -> dict:
+    """Require an authenticated session. Returns user dict or raises 401."""
+    user = SessionManager.decode_session(request.cookies.get("flowdeck_session", ""))
+    if not user:
+        raise HTTPException(status_code=401, detail="Authentication required")
+    return user
+
+
+# ── Page Sharing ──
+
+
+@router.post("/pages/{page_id}/share")
+def share_page(page_id: int, request: Request, body: dict = Body(default={})):
+    """Invite a user, an email, or a group to a page."""
+    user = _require_auth(request)
+    target_user_id = body.get("user_id")
+    target_group_id = body.get("group_id")
+    email = body.get("email", "")
+    permission = body.get("permission", "view")
+
+    if permission not in ("view", "comment", "edit"):
+        raise HTTPException(400, "Invalid permission. Use view, comment, or edit.")
+
+    if not target_user_id and not target_group_id and not email:
+        raise HTTPException(400, "Provide user_id, group_id or email to share with.")
+
+    # Bridge share permission (view/comment/edit) → granular role
+    # (viewer/commenter/editor) so page_permissions grants stay in sync.
+    _SHARE_TO_ROLE = {"view": "viewer", "comment": "commenter", "edit": "editor"}
+
+    with get_conn() as conn:
+        # Verify page exists
+        page = conn.execute("SELECT id, title FROM pages WHERE id=?", (page_id,)).fetchone()
+        if not page:
+            raise HTTPException(404, "Page not found")
+
+        # Verify target user exists if user_id given
+        if target_user_id:
+            target = conn.execute("SELECT id FROM users WHERE id=?", (target_user_id,)).fetchone()
+            if not target:
+                raise HTTPException(404, "Target user not found")
+
+        # Verify target group exists if group_id given
+        if target_group_id:
+            gtarget = conn.execute("SELECT id FROM user_groups WHERE id=?", (target_group_id,)).fetchone()
+            if not gtarget:
+                raise HTTPException(404, "Target group not found")
+
+        # Upsert to avoid duplicates: update the existing permission if the same
+        # target (user, group or email) is already shared on this page.
+        target_row = None
+        if target_user_id:
+            target_row = conn.execute(
+                "SELECT id FROM page_shares WHERE page_id=? AND shared_with_user_id=?",
+                (page_id, target_user_id),
+            ).fetchone()
+        elif target_group_id:
+            target_row = conn.execute(
+                "SELECT id FROM page_shares WHERE page_id=? AND shared_with_group_id=?",
+                (page_id, target_group_id),
+            ).fetchone()
+        elif email:
+            target_row = conn.execute(
+                """SELECT id FROM page_shares
+                   WHERE page_id=? AND shared_with_email=? AND shared_with_user_id IS NULL AND shared_with_group_id IS NULL""",
+                (page_id, email.strip()),
+            ).fetchone()
+
+        if target_row:
+            conn.execute(
+                "UPDATE page_shares SET permission=?, created_by=? WHERE id=?",
+                (permission, user["id"], target_row["id"]),
+            )
+            share_id = target_row["id"]
+        else:
+            if not email:
+                email = ""
+            try:
+                cur = conn.execute(
+                    """INSERT INTO page_shares (page_id, shared_with_user_id, shared_with_group_id, shared_with_email, permission, created_by)
+                       VALUES (?, ?, ?, ?, ?, ?)""",
+                    (page_id, target_user_id, target_group_id, email.strip(), permission, user["id"]),
+                )
+            except Exception:
+                # Fallback for DBs where the migration has not run yet
+                cur = conn.execute(
+                    """INSERT INTO page_shares (page_id, shared_with_user_id, shared_with_email, permission, created_by)
+                       VALUES (?, ?, ?, ?, ?)""",
+                    (page_id, target_user_id, email.strip(), permission, user["id"]),
+                )
+            share_id = cur.lastrowid
+        conn.execute("UPDATE pages SET is_shared=1 WHERE id=?", (page_id,))
+        # ── Mirror group shares into page_permissions so the ACL used by
+        # PermissionManager (can_view/edit/comment) grants real access to
+        # every group member. Best-effort: never break legacy page_shares.
+        if target_group_id:
+            try:
+                _mirror_share_grant(conn, page_id, target_group_id, _SHARE_TO_ROLE[permission], user["id"])
+            except Exception:
+                logger.warning("share→page_permissions mirror failed (page=%s group=%s)", page_id, target_group_id)
+        conn.commit()
+
+    try:
+        run_event_sync(_fire_event("page.shared", {"page_id": page_id, "share_id": share_id, "permission": permission}))
+    except Exception:
+        logger.exception("share_page")
+
+    return {
+        "id": share_id,
+        "page_id": page_id,
+        "shared_with_user_id": target_user_id,
+        "shared_with_group_id": target_group_id,
+        "shared_with_email": email,
+        "permission": permission,
+        "status": "shared",
+    }
+
+
+def _mirror_share_grant(conn, page_id: int, group_id: int, role: str, granted_by: int) -> None:
+    """Upsert a ``page_permissions`` grant mirroring a group ``page_shares`` row.
+
+    Keeps the granular ACL (used by ``PermissionManager``) in sync with what
+    the share dialog shows, so invited groups get effective view/edit rights.
+    """
+    existing = conn.execute(
+        "SELECT id FROM page_permissions WHERE page_id=? AND user_id IS NULL AND group_id=?",
+        (page_id, group_id),
+    ).fetchone()
+    if existing:
+        conn.execute("UPDATE page_permissions SET role=?, granted_by=? WHERE id=?",
+                     (role, granted_by, existing["id"]))
+    else:
+        conn.execute(
+            "INSERT INTO page_permissions (page_id, user_id, group_id, role, granted_by) "
+            "VALUES (?, NULL, ?, ?, ?)",
+            (page_id, group_id, role, granted_by),
+        )
+
+
+def _mirror_share_revoke(conn, page_id: int, group_id: int) -> None:
+    """Remove the mirrored grant when a group share is updated away or deleted."""
+    conn.execute(
+        "DELETE FROM page_permissions WHERE page_id=? AND user_id IS NULL AND group_id=?",
+        (page_id, group_id),
+    )
+
+
+@router.put("/pages/{page_id}/share/{share_id}", description="Update a share's permission.")
+def update_share_permission(page_id: int, share_id: int, request: Request, body: dict = Body(default={})):
+    """Change the permission level of an existing share entry."""
+    user = _require_auth(request)
+
+    permission = body.get("permission", "")
+
+    if permission not in ("view", "comment", "edit"):
+        raise HTTPException(400, "Invalid permission. Use view, comment, or edit.")
+
+    with get_conn() as conn:
+        row = conn.execute(
+            "SELECT id, shared_with_group_id FROM page_shares WHERE id=? AND page_id=?",
+            (share_id, page_id),
+        ).fetchone()
+        if not row:
+            raise HTTPException(404, "Share entry not found")
+
+        conn.execute(
+            "UPDATE page_shares SET permission=? WHERE id=?",
+            (permission, share_id),
+        )
+        # Keep the mirrored ACL grant in sync for group shares.
+        try:
+            gid = row["shared_with_group_id"] if "shared_with_group_id" in row.keys() else None
+        except Exception:
+            gid = None
+        if gid:
+            try:
+                _mirror_share_grant(conn, page_id, gid,
+                                    {"view": "viewer", "comment": "commenter", "edit": "editor"}[permission],
+                                    user["id"])
+            except Exception:
+                logger.warning("share→page_permissions mirror failed (share=%s)", share_id)
+        conn.commit()
+
+    return {"status": "updated", "share_id": share_id, "permission": permission}
+
+
+@router.delete("/pages/{page_id}/share/{share_id}")
+def remove_share(page_id: int, share_id: int, request: Request):
+    """Remove a share invitation."""
+    _require_auth(request)
+
+    with get_conn() as conn:
+        row = conn.execute(
+            "SELECT id, shared_with_group_id FROM page_shares WHERE id=? AND page_id=?",
+            (share_id, page_id),
+        ).fetchone()
+        if not row:
+            raise HTTPException(404, "Share entry not found")
+
+        conn.execute("DELETE FROM page_shares WHERE id=?", (share_id,))
+        try:
+            gid = row["shared_with_group_id"] if "shared_with_group_id" in row.keys() else None
+        except Exception:
+            gid = None
+        if gid:
+            try:
+                _mirror_share_revoke(conn, page_id, gid)
+            except Exception:
+                logger.warning("share→page_permissions revoke failed (share=%s)", share_id)
+        # If no more shares, unset is_shared
+        remaining = conn.execute(
+            "SELECT COUNT(*) AS c FROM page_shares WHERE page_id=?", (page_id,)
+        ).fetchone()["c"]
+        if remaining == 0:
+            conn.execute("UPDATE pages SET is_shared=0 WHERE id=?", (page_id,))
+        conn.commit()
+
+    return {"status": "removed", "share_id": share_id}
+
+
+@router.get("/pages/{page_id}/shares")
+def list_shares(page_id: int, request: Request):
+    """Get all shares for a page."""
+    _require_auth(request)
+
+    with get_conn() as conn:
+        page = conn.execute("SELECT id FROM pages WHERE id=?", (page_id,)).fetchone()
+        if not page:
+            raise HTTPException(404, "Page not found")
+
+        try:
+            rows = conn.execute(
+                """SELECT s.*, u.login, u.full_name, u.avatar_url, g.name AS group_name
+                   FROM page_shares s
+                   LEFT JOIN users u ON s.shared_with_user_id = u.id
+                   LEFT JOIN user_groups g ON s.shared_with_group_id = g.id
+                   WHERE s.page_id=?
+                   ORDER BY s.created_at DESC""",
+                (page_id,),
+            ).fetchall()
+        except Exception:
+            rows = conn.execute(
+                """SELECT s.*, u.login, u.full_name, u.avatar_url
+                   FROM page_shares s
+                   LEFT JOIN users u ON s.shared_with_user_id = u.id
+                   WHERE s.page_id=?
+                   ORDER BY s.created_at DESC""",
+                (page_id,),
+            ).fetchall()
+
+    return {
+        "page_id": page_id,
+        "shares": [
+            {
+                "id": r["id"],
+                "shared_with_user_id": r["shared_with_user_id"],
+                "shared_with_group_id": r["shared_with_group_id"] if "shared_with_group_id" in r.keys() else None,
+                "shared_with_email": r["shared_with_email"],
+                "permission": r["permission"],
+                "created_at": r["created_at"],
+                "created_by": r["created_by"],
+                "user_login": r["login"],
+                "user_full_name": r["full_name"],
+                "user_avatar_url": r["avatar_url"],
+                "group_name": r["group_name"] if "group_name" in r.keys() else None,
+                "kind": "group" if (("shared_with_group_id" in r.keys() and r["shared_with_group_id"]) or ("group_name" in r.keys() and r["group_name"])) else "user",
+            }
+            for r in rows
+        ],
+    }
+
+
+# ── Page Publishing ──
+
+
+@router.post("/pages/{page_id}/publish")
+def publish_page(page_id: int, request: Request):
+    """Publish a page (is_published=1) with a URL slug."""
+    _require_auth(request)
+    slug, _title = publish(page_id)
+    run_event_sync(fire_published(page_id, slug))
+    return {
+        "page_id": page_id,
+        "is_published": True,
+        "publish_slug": slug,
+        "status": "published",
+    }
+
+
+@router.delete("/pages/{page_id}/publish")
+def unpublish_page(page_id: int, request: Request):
+    """Unpublish a page."""
+    _require_auth(request)
+    unpublish(page_id)
+    run_event_sync(fire_unpublished(page_id))
+    return {
+        "page_id": page_id,
+        "is_published": False,
+        "status": "unpublished",
+    }
+
+
+# ── Recents ──
+
+
+@router.post("/recents/track")
+def track_recent(request: Request, body: dict = Body(default={})):
+    """Record a page access in recents."""
+    user = _require_auth(request)
+    page_id = body.get("page_id")
+    workspace = body.get("workspace", "")
+    source_type = body.get("source_type", "local")
+
+    if not page_id:
+        raise HTTPException(400, "page_id is required")
+
+    with get_conn() as conn:
+        page = conn.execute("SELECT id FROM pages WHERE id=?", (page_id,)).fetchone()
+        if not page:
+            raise HTTPException(404, "Page not found")
+
+        conn.execute(
+            """INSERT INTO recents (user_id, page_id, workspace, source_type, accessed_at)
+               VALUES (?, ?, ?, ?, ?)
+               ON CONFLICT(user_id, page_id)
+               DO UPDATE SET workspace=excluded.workspace,
+                             source_type=excluded.source_type,
+                             accessed_at=excluded.accessed_at""",
+            (user["id"], page_id, workspace, source_type, datetime.now(UTC).replace(tzinfo=None).isoformat()),
+        )
+        conn.commit()
+
+    return {
+        "status": "tracked",
+        "user_id": user["id"],
+        "page_id": page_id,
+        "accessed_at": datetime.now(UTC).replace(tzinfo=None).isoformat(),
+    }

app/routers/sidebar_config.py

@@ -0,0 +1,112 @@
+"""FlowDeck — Sidebar customization API (v4.6.0)."""
+from __future__ import annotations
+
+import json
+import logging
+
+from fastapi import APIRouter, Body, HTTPException, Request
+
+from app.auth.session import SessionManager
+from app.db import get_conn
+
+logger = logging.getLogger(__name__)
+router = APIRouter(tags=["sidebar"], prefix="/api/sidebar")
+
+
+def _get_user(request: Request) -> dict:
+    user = SessionManager.decode_session(request.cookies.get("flowdeck_session", ""))
+    if not user:
+        raise HTTPException(status_code=401, detail="Not authenticated")
+    return user
+
+
+DEFAULT_CONFIG = {
+    "workspace": {"visible": True, "order": 0, "show_count": None},
+    "gitea": {"visible": True, "order": 1, "show_count": None},
+    "meetings": {"visible": True, "order": 2, "show_count": 5},
+    "recents": {"visible": True, "order": 3, "show_count": 10},
+    "favorites": {"visible": True, "order": 4, "show_count": 10},
+    "agents": {"visible": True, "order": 5, "show_count": None},
+    "teamspaces": {"visible": True, "order": 6, "show_count": None},
+    "shared": {"visible": True, "order": 7, "show_count": 10},
+    "published": {"visible": True, "order": 8, "show_count": 10},
+    "private": {"visible": True, "order": 9, "show_count": None},
+}
+
+
+@router.get("/config")
+def get_sidebar_config(request: Request):
+    """Get the current user's sidebar customization config."""
+    user = _get_user(request)
+    with get_conn() as conn:
+        row = conn.execute(
+            "SELECT sidebar_config FROM users WHERE id=?", (user["id"],)
+        ).fetchone()
+    if not row:
+        return {"config": DEFAULT_CONFIG}
+
+    raw = row["sidebar_config"]
+    if not raw:
+        return {"config": DEFAULT_CONFIG}
+
+    try:
+        stored = json.loads(raw)
+    except (json.JSONDecodeError, TypeError):
+        return {"config": DEFAULT_CONFIG}
+
+    # Merge with defaults to ensure all keys exist
+    merged = dict(DEFAULT_CONFIG)
+    merged.update(stored)
+    return {"config": merged}
+
+
+def get_sidebar_config_sync(user_id: int) -> dict:
+    """Synchronous helper to get sidebar config (used during template rendering)."""
+    with get_conn() as conn:
+        row = conn.execute(
+            "SELECT sidebar_config FROM users WHERE id=?", (user_id,)
+        ).fetchone()
+    if not row:
+        return dict(DEFAULT_CONFIG)
+    raw = row["sidebar_config"]
+    if not raw:
+        return dict(DEFAULT_CONFIG)
+    try:
+        stored = json.loads(raw)
+    except (json.JSONDecodeError, TypeError):
+        return dict(DEFAULT_CONFIG)
+    merged = dict(DEFAULT_CONFIG)
+    merged.update(stored)
+    return merged
+
+
+@router.put("/config")
+def save_sidebar_config(request: Request, body: dict = Body(...)):
+    """Save the current user's sidebar customization config."""
+    user = _get_user(request)
+
+    config = body.get("config")
+    if not config or not isinstance(config, dict):
+        raise HTTPException(status_code=400, detail="config object is required")
+
+    # Merge with defaults to ensure validity
+    merged = dict(DEFAULT_CONFIG)
+    for key, val in config.items():
+        if key in DEFAULT_CONFIG and isinstance(val, dict):
+            merged[key] = {
+                "visible": val.get("visible", DEFAULT_CONFIG[key]["visible"]),
+                "order": val.get("order", DEFAULT_CONFIG[key]["order"]),
+                "show_count": val.get("show_count", DEFAULT_CONFIG[key]["show_count"]),
+            }
+        elif key not in DEFAULT_CONFIG:
+            # Allow new custom sections
+            merged[key] = val
+
+    with get_conn() as conn:
+        conn.execute(
+            "UPDATE users SET sidebar_config=? WHERE id=?",
+            (json.dumps(merged), user["id"]),
+        )
+        conn.commit()
+
+    return {"status": "ok", "config": merged}

app/routers/sites.py

@@ -0,0 +1,822 @@
+"""FlowDeck — Sites & public Forms (v6.8.0).
+
+Notion Sites + Forms parity: multi-page public sites (/s/<slug>) with nav,
+password/expiry gating, SEO + view stats, and anonymous collection forms
+(/f/<token>) with rate limiting, validation and notifications.
+
+Auth: session cookie first, Bearer token fallback (api_tokens,
+extension_devices, legacy user_tokens) via api_v2_helpers.
+"""
+from __future__ import annotations
+
+import hashlib
+import html
+import json
+import logging
+import re
+import secrets
+import time
+import unicodedata
+from datetime import UTC, datetime
+
+from fastapi import APIRouter, Body, HTTPException, Request
+from fastapi.responses import HTMLResponse, JSONResponse, PlainTextResponse
+
+from app.auth.session import SessionManager
+from app.config import settings
+from app.db import get_conn
+from app.password_utils import hash_password, verify_password
+from app.services.api_v2_helpers import (
+    audit_log,
+    get_bearer_user,
+    has_scope,
+    paginate_headers,
+    parse_pagination,
+    resolve_bearer_token,
+    row_to_dict,
+)
+
+logger = logging.getLogger(__name__)
+
+router = APIRouter(tags=["sites"])
+
+_SLUG_RE = re.compile(r"^[a-z0-9-]{3,50}$")
+_FORM_TOKEN_RE = re.compile(r"^f_[A-Za-z0-9_-]{6,64}$")
+
+# In-memory rate limiting for anonymous form posts: ip -> (window_start, count).
+_form_rate: dict[str, tuple[float, int]] = {}
+_FORM_RATE_MAX = 20
+_FORM_RATE_WINDOW = 3600.0
+
+
+# ── helpers ────────────────────────────────────────────────────────────────
+
+def _slugify(title: str) -> str:
+    slug = unicodedata.normalize("NFKD", title or "").encode("ascii", "ignore").decode("ascii")
+    slug = re.sub(r"[^\w\s-]", "", slug.lower())
+    slug = re.sub(r"[-\s]+", "-", slug).strip("-")
+    return slug or "untitled"
+
+
+def _check_slug(slug: str) -> None:
+    if not _SLUG_RE.match(slug or ""):
+        raise HTTPException(400, "Invalid slug: 3-50 chars, lowercase letters, digits, dashes.")
+
+
+def _auth_user(request: Request, *, require_write: bool = False) -> dict:
+    """Session-first auth, Bearer fallback. Enforces scope for Bearer tokens."""
+    sess = SessionManager.decode_session(request.cookies.get("flowdeck_session", ""))
+    if sess:
+        return sess
+    auth = request.headers.get("authorization") or request.headers.get("Authorization") or ""
+    if auth.lower().startswith("bearer "):
+        user = resolve_bearer_token(auth[7:].strip())
+        if not user:
+            raise HTTPException(401, "Invalid or expired API token")
+        if require_write and not has_scope(user.get("_token_scopes") or "read", "write"):
+            raise HTTPException(403, "Insufficient scope. Required: write")
+        return user
+    raise HTTPException(401, "Authentication required")
+
+
+def _site_auth_cookie(site_id: int) -> str:
+    return f"site_auth_{site_id}"
+
+
+def _site_unlocked(request: Request, site: dict) -> bool:
+    if not site.get("password_hash"):
+        return True
+    from itsdangerous import BadSignature, URLSafeTimedSerializer
+    ser = URLSafeTimedSerializer(settings.app_secret_key, salt="site-auth")
+    try:
+        val = ser.loads(request.cookies.get(_site_auth_cookie(site["id"]), ""), max_age=86400)
+        return val == site["id"]
+    except BadSignature:
+        return False
+    except Exception:
+        return False
+
+
+def _site_expired(site: dict) -> bool:
+    exp = site.get("expires_at")
+    if not exp:
+        return False
+    try:
+        dt = datetime.fromisoformat(str(exp).replace("Z", "+00:00"))
+        if dt.tzinfo is None:
+            dt = dt.replace(tzinfo=UTC)
+        return dt.timestamp() < time.time()
+    except Exception:
+        return False
+
+
+def _resolve_site(conn, *, slug: str = "", host: str = "") -> dict | None:
+    row = None
+    if slug:
+        row = conn.execute("SELECT * FROM sites WHERE slug=?", (slug,)).fetchone()
+    elif host:
+        row = conn.execute("SELECT * FROM sites WHERE custom_domain=?", (host.split(":")[0],)).fetchone()
+    return dict(row) if row else None
+
+
+def _site_pages(conn, site_id: int) -> list[dict]:
+    rows = conn.execute(
+        """SELECT p.id, p.title, p.page_icon, p.cover_url, p.updated_at, sp.position
+           FROM site_pages sp JOIN pages p ON p.id = sp.page_id
+           WHERE sp.site_id=? AND (p.deleted_at IS NULL OR p.deleted_at='')
+           ORDER BY sp.position, p.id""",
+        (site_id,),
+    ).fetchall()
+    out = []
+    for r in rows:
+        d = dict(r)
+        d["slug"] = _slugify(d.get("title") or "untitled") or f"page-{d['id']}"
+        out.append(d)
+    return out
+
+
+def _find_site_page(pages: list[dict], ref: str) -> dict | None:
+    ref = (ref or "").strip()
+    if ref.isdigit():
+        for p in pages:
+            if p["id"] == int(ref):
+                return p
+    for p in pages:
+        if p["slug"] == ref:
+            return p
+    # slug with -<id> suffix fallback
+    m = re.search(r"-(\d+)$", ref)
+    if m:
+        for p in pages:
+            if p["id"] == int(m.group(1)):
+                return p
+    return None
+
+
+def _render_page_html(page: dict) -> str:
+    """Render a pages row to HTML (blocks → public renderer, else <pre>)."""
+    if page.get("content_format") == "blocks" and page.get("content"):
+        try:
+            from app.routers import dashboard as _dash
+            blocks = json.loads(page["content"])
+            try:
+                from app.services.synced_blocks import resolve_synced_block
+                blocks = resolve_synced_block(blocks)
+            except Exception:
+                logger.exception("_render_page_html")
+            titles: dict = {}
+            try:
+                from app.db import get_conn as _gc
+                from app.services.wiki_links import token_labels
+                with _gc() as _c:
+                    titles = token_labels(_c, page["content"])
+            except Exception:
+                titles = {}
+            return _dash._render_blocks_public(blocks, titles)
+        except Exception:
+            return f"<p>{html.escape(str(page.get('content', '')))}</p>"
+    if page.get("content"):
+        return (
+            "<pre style='white-space:pre-wrap;font-family:system-ui;"
+            f"font-size:16px;line-height:1.6;'>{html.escape(page['content'])}</pre>"
+        )
+    return "<p style='color:#999'>Empty page.</p>"
+
+
+def _site_shell(*, site: dict, pages: list[dict], current_id: int, title: str,
+                body_html: str, noindex: bool = False) -> str:
+    nav = "".join(
+        f"<a href='/s/{site['slug']}/{p['slug']}'"
+        f" style='display:block;padding:6px 10px;border-radius:6px;text-decoration:none;"
+        f"color:{'#fff' if p['id'] == current_id else '#bbb'};"
+        f"background:{'#333' if p['id'] == current_id else 'transparent'}'>"
+        f"{html.escape((p.get('page_icon') or '') + ' ' + (p.get('title') or 'Untitled'))}</a>"
+        for p in pages
+    )
+    robots = "noindex,nofollow" if (noindex or site.get("noindex")) else "index,follow"
+    desc = html.escape((site.get("title") or title)[:160])
+    theme_bg = "#191919" if site.get("theme", "dark") == "dark" else "#ffffff"
+    theme_fg = "#e0e0e0" if site.get("theme", "dark") == "dark" else "#222222"
+    return f"""<!DOCTYPE html><html lang="en"><head><meta charset="UTF-8">
+<meta name="viewport" content="width=device-width,initial-scale=1.0">
+<meta name="robots" content="{robots}">
+<meta name="description" content="{desc}">
+<meta property="og:title" content="{html.escape(title)}">
+<meta property="og:description" content="{desc}">
+<meta name="twitter:card" content="summary">
+<title>{html.escape(title)} — {html.escape(site.get('title') or 'FlowDeck Site')}</title>
+<style>body{{font-family:system-ui,sans-serif;background:{theme_bg};color:{theme_fg};margin:0}}
+.layout{{display:flex;min-height:100vh}}.nav{{width:240px;padding:16px;border-right:1px solid #333}}
+.main{{flex:1;padding:32px;max-width:860px}}a{{color:#4c9aff}}
+@media(max-width:700px){{.nav{{display:none}}.main{{padding:16px}}}}</style></head>
+<body><div class="layout"><nav class="nav">
+<a href="/s/{site['slug']}" style="font-weight:700;color:{theme_fg};text-decoration:none">
+{html.escape(site.get('title') or 'Site')}</a><div style="height:12px"></div>{nav}</nav>
+<main class="main">{body_html}</main></div></body></html>"""
+
+
+def _track_view(site_id: int) -> None:
+    day = datetime.now(UTC).strftime("%Y-%m-%d")
+    try:
+        with get_conn() as conn:
+            conn.execute(
+                """INSERT INTO site_views (site_id, day, views) VALUES (?, ?, 1)
+                   ON CONFLICT(site_id, day) DO UPDATE SET views=views+1""",
+                (site_id, day),
+            )
+            conn.commit()
+    except Exception:
+        logger.exception("_track_view")
+
+
+def _form_config(conn, collection_id: int) -> dict:
+    row = conn.execute(
+        "SELECT id, name, form_config_json FROM collections WHERE id=?", (collection_id,)
+    ).fetchone()
+    if not row:
+        raise HTTPException(404, "Collection not found")
+    try:
+        cfg = json.loads(row["form_config_json"] or "{}")
+    except Exception:
+        cfg = {}
+    return {"id": row["id"], "name": row["name"], "config": cfg}
+
+
+def _check_form_rate(ip: str) -> None:
+    now = time.time()
+    start, count = _form_rate.get(ip, (now, 0))
+    if now - start > _FORM_RATE_WINDOW:
+        _form_rate[ip] = (now, 1)
+        return
+    if count >= _FORM_RATE_MAX:
+        raise HTTPException(429, "Too many submissions. Try again later.")
+    _form_rate[ip] = (start, count + 1)
+
+
+# ── Sites CRUD (session or Bearer) ─────────────────────────────────────────
+
+@router.post("/api/v2/sites")
+def create_site(request: Request, body: dict = Body(default={})):
+    user = _auth_user(request, require_write=True)
+    root_page_id = body.get("root_page_id")
+    if not root_page_id:
+        raise HTTPException(400, "root_page_id is required")
+    slug = (body.get("slug") or "").strip().lower() or None
+    with get_conn() as conn:
+        page = conn.execute("SELECT id, title FROM pages WHERE id=?", (root_page_id,)).fetchone()
+        if not page:
+            raise HTTPException(404, "Root page not found")
+        if not slug:
+            slug = _slugify(page["title"])
+            base, i = slug, 1
+            while conn.execute("SELECT id FROM sites WHERE slug=?", (slug,)).fetchone():
+                slug = f"{base}-{i}"
+                i += 1
+        else:
+            _check_slug(slug)
+            if conn.execute("SELECT id FROM sites WHERE slug=?", (slug,)).fetchone():
+                raise HTTPException(409, "Slug already taken")
+        theme = body.get("theme", "dark")
+        if theme not in ("light", "dark"):
+            raise HTTPException(400, "theme must be light or dark")
+        custom_domain = (body.get("custom_domain") or "").strip() or None
+        if custom_domain and conn.execute(
+            "SELECT id FROM sites WHERE custom_domain=?", (custom_domain,)
+        ).fetchone():
+            raise HTTPException(409, "Domain already linked to another site")
+        expires_at = body.get("expires_at")
+        if expires_at:
+            try:
+                datetime.fromisoformat(str(expires_at).replace("Z", "+00:00"))
+            except Exception:
+                raise HTTPException(400, "Invalid expires_at (use ISO-8601)") from None
+        cur = conn.execute(
+            """INSERT INTO sites (slug, root_page_id, title, theme, custom_domain,
+                                  expires_at, noindex, analytics_id, created_by)
+               VALUES (?, ?, ?, ?, ?, ?, ?, ?, ?)""",
+            (slug, root_page_id, body.get("title") or page["title"],
+             theme, custom_domain, expires_at,
+             1 if body.get("noindex") else 0,
+             (body.get("analytics_id") or "")[:120], user["id"]),
+        )
+        site_id = cur.lastrowid
+        conn.execute(
+            "INSERT OR IGNORE INTO site_pages (site_id, page_id, position) VALUES (?, ?, 0)",
+            (site_id, root_page_id),
+        )
+        conn.commit()
+        site = conn.execute("SELECT * FROM sites WHERE id=?", (site_id,)).fetchone()
+    audit_log(user, "site.create", "site", site_id, f"slug={slug}", request)
+    return JSONResponse(status_code=201, content=row_to_dict(site))
+
+
+@router.get("/api/v2/sites")
+def list_sites(request: Request):
+    user = _auth_user(request)
+    limit, offset = parse_pagination(request)
+    with get_conn() as conn:
+        total = conn.execute(
+            "SELECT COUNT(*) FROM sites WHERE created_by=?", (user["id"],)
+        ).fetchone()[0]
+        rows = conn.execute(
+            "SELECT * FROM sites WHERE created_by=? ORDER BY id DESC LIMIT ? OFFSET ?",
+            (user["id"], limit, offset),
+        ).fetchall()
+    resp = JSONResponse([row_to_dict(r) for r in rows])
+    for k, v in paginate_headers(total).items():
+        resp.headers[k] = v
+    return resp
+
+
+@router.get("/api/v2/sites/{site_id}")
+def get_site(site_id: int, request: Request):
+    user = _auth_user(request)
+    with get_conn() as conn:
+        row = conn.execute("SELECT * FROM sites WHERE id=?", (site_id,)).fetchone()
+        if not row:
+            raise HTTPException(404, "Site not found")
+        site = dict(row)
+        if site.get("created_by") != user["id"] and not user.get("is_admin"):
+            raise HTTPException(404, "Site not found")
+        pages = _site_pages(conn, site_id)
+    out = row_to_dict(row)
+    out["pages"] = pages
+    return out
+
+
+@router.patch("/api/v2/sites/{site_id}")
+def update_site(site_id: int, request: Request, body: dict = Body(default={})):
+    user = _auth_user(request, require_write=True)
+    with get_conn() as conn:
+        row = conn.execute("SELECT * FROM sites WHERE id=?", (site_id,)).fetchone()
+        if not row:
+            raise HTTPException(404, "Site not found")
+        site = dict(row)
+        if site.get("created_by") != user["id"] and not user.get("is_admin"):
+            raise HTTPException(404, "Site not found")
+        updates: dict = {}
+        if "title" in body:
+            updates["title"] = str(body["title"] or "")[:200]
+        if "theme" in body:
+            if body["theme"] not in ("light", "dark"):
+                raise HTTPException(400, "theme must be light or dark")
+            updates["theme"] = body["theme"]
+        if "slug" in body and body["slug"] != site["slug"]:
+            _check_slug(str(body["slug"]).lower())
+            if conn.execute(
+                "SELECT id FROM sites WHERE slug=? AND id!=?", (body["slug"].lower(), site_id)
+            ).fetchone():
+                raise HTTPException(409, "Slug already taken")
+            updates["slug"] = str(body["slug"]).lower()
+        if "custom_domain" in body:
+            dom = (body["custom_domain"] or "").strip() or None
+            if dom and conn.execute(
+                "SELECT id FROM sites WHERE custom_domain=? AND id!=?", (dom, site_id)
+            ).fetchone():
+                raise HTTPException(409, "Domain already linked to another site")
+            updates["custom_domain"] = dom
+        if "expires_at" in body:
+            if body["expires_at"]:
+                try:
+                    datetime.fromisoformat(str(body["expires_at"]).replace("Z", "+00:00"))
+                except Exception:
+                    raise HTTPException(400, "Invalid expires_at (use ISO-8601)") from None
+            updates["expires_at"] = body["expires_at"]
+        if "noindex" in body:
+            updates["noindex"] = 1 if body["noindex"] else 0
+        if "analytics_id" in body:
+            updates["analytics_id"] = str(body["analytics_id"] or "")[:120]
+        if "password" in body:
+            updates["password_hash"] = hash_password(str(body["password"])) if body["password"] else ""
+        if updates:
+            updates["updated_at"] = datetime.now(UTC).strftime("%Y-%m-%d %H:%M:%S")
+            sets = ", ".join(f"{k}=?" for k in updates)
+            conn.execute(f"UPDATE sites SET {sets} WHERE id=?", (*updates.values(), site_id))
+            conn.commit()
+        site = conn.execute("SELECT * FROM sites WHERE id=?", (site_id,)).fetchone()
+    audit_log(user, "site.update", "site", site_id, ",".join(updates), request)
+    return row_to_dict(site)
+
+
+@router.delete("/api/v2/sites/{site_id}")
+def delete_site(site_id: int, request: Request):
+    user = _auth_user(request, require_write=True)
+    with get_conn() as conn:
+        row = conn.execute("SELECT * FROM sites WHERE id=?", (site_id,)).fetchone()
+        if not row:
+            raise HTTPException(404, "Site not found")
+        if row["created_by"] != user["id"] and not user.get("is_admin"):
+            raise HTTPException(404, "Site not found")
+        conn.execute("DELETE FROM sites WHERE id=?", (site_id,))
+        conn.commit()
+    audit_log(user, "site.delete", "site", site_id, "", request)
+    return {"status": "deleted", "id": site_id}
+
+
+@router.get("/api/v2/sites/{site_id}/pages")
+def list_site_pages(site_id: int, request: Request):
+    user = _auth_user(request)
+    with get_conn() as conn:
+        row = conn.execute("SELECT * FROM sites WHERE id=?", (site_id,)).fetchone()
+        if not row or (row["created_by"] != user["id"] and not user.get("is_admin")):
+            raise HTTPException(404, "Site not found")
+        return {"site_id": site_id, "pages": _site_pages(conn, site_id)}
+
+
+@router.post("/api/v2/sites/{site_id}/pages")
+def add_site_page(site_id: int, request: Request, body: dict = Body(default={})):
+    user = _auth_user(request, require_write=True)
+    page_id = body.get("page_id")
+    if not page_id:
+        raise HTTPException(400, "page_id is required")
+    with get_conn() as conn:
+        row = conn.execute("SELECT * FROM sites WHERE id=?", (site_id,)).fetchone()
+        if not row or (row["created_by"] != user["id"] and not user.get("is_admin")):
+            raise HTTPException(404, "Site not found")
+        if not conn.execute("SELECT id FROM pages WHERE id=?", (page_id,)).fetchone():
+            raise HTTPException(404, "Page not found")
+        pos = conn.execute(
+            "SELECT COALESCE(MAX(position), -1)+1 FROM site_pages WHERE site_id=?", (site_id,)
+        ).fetchone()[0]
+        conn.execute(
+            "INSERT OR IGNORE INTO site_pages (site_id, page_id, position) VALUES (?, ?, ?)",
+            (site_id, page_id, pos),
+        )
+        conn.commit()
+        pages = _site_pages(conn, site_id)
+    audit_log(user, "site.page.add", "site", site_id, f"page={page_id}", request)
+    return {"site_id": site_id, "pages": pages}
+
+
+@router.delete("/api/v2/sites/{site_id}/pages/{page_id}")
+def remove_site_page(site_id: int, page_id: int, request: Request):
+    user = _auth_user(request, require_write=True)
+    with get_conn() as conn:
+        row = conn.execute("SELECT * FROM sites WHERE id=?", (site_id,)).fetchone()
+        if not row or (row["created_by"] != user["id"] and not user.get("is_admin")):
+            raise HTTPException(404, "Site not found")
+        if page_id == row["root_page_id"]:
+            raise HTTPException(400, "Cannot remove the root page")
+        conn.execute(
+            "DELETE FROM site_pages WHERE site_id=? AND page_id=?", (site_id, page_id)
+        )
+        conn.commit()
+    audit_log(user, "site.page.remove", "site", site_id, f"page={page_id}", request)
+    return {"status": "removed", "site_id": site_id, "page_id": page_id}
+
+
+@router.get("/api/v2/sites/{site_id}/stats")
+def site_stats(site_id: int, request: Request, days: int = 30):
+    user = _auth_user(request)
+    days = max(1, min(int(days or 30), 365))
+    with get_conn() as conn:
+        row = conn.execute("SELECT * FROM sites WHERE id=?", (site_id,)).fetchone()
+        if not row or (row["created_by"] != user["id"] and not user.get("is_admin")):
+            raise HTTPException(404, "Site not found")
+        rows = conn.execute(
+            "SELECT day, views FROM site_views WHERE site_id=? ORDER BY day DESC LIMIT ?",
+            (site_id, days),
+        ).fetchall()
+        total = conn.execute(
+            "SELECT COALESCE(SUM(views), 0) FROM site_views WHERE site_id=?", (site_id,)
+        ).fetchone()[0]
+    return {"site_id": site_id, "total_views": total,
+            "days": [{"day": r["day"], "views": r["views"]} for r in rows]}
+
+
+# ── Public site rendering ──────────────────────────────────────────────────
+
+def _public_guard(site: dict, request: Request):
+    if _site_expired(site):
+        return HTMLResponse("<h1>410 — Site expired.</h1>", status_code=410)
+    if site.get("password_hash") and not _site_unlocked(request, site):
+        return HTMLResponse(
+            f"""<!DOCTYPE html><html><body style="font-family:system-ui;background:#191919;color:#eee;
+            display:flex;align-items:center;justify-content:center;height:100vh">
+            <form method="post" action="/s/{site['slug']}/auth">
+            <h2>🔒 {html.escape(site.get('title') or 'Protected site')}</h2>
+            <input type="password" name="password" placeholder="Password"
+             style="padding:8px;border-radius:6px;border:1px solid #444;background:#222;color:#fff">
+            <button style="padding:8px 14px;border-radius:6px">Unlock</button></form></body></html>""",
+            status_code=401,
+        )
+    return None
+
+
+@router.get("/s/{slug}", response_class=HTMLResponse)
+def public_site_home(request: Request, slug: str):
+    with get_conn() as conn:
+        site = _resolve_site(conn, slug=slug,
+                             host=request.headers.get("host", ""))
+        if not site:
+            return HTMLResponse("<h1>404 — Site not found.</h1>", status_code=404)
+        guard = _public_guard(site, request)
+        if guard:
+            return guard
+        pages = _site_pages(conn, site["id"])
+        page = conn.execute("SELECT * FROM pages WHERE id=?", (site["root_page_id"],)).fetchone()
+        if not page:
+            return HTMLResponse("<h1>404 — Root page removed.</h1>", status_code=404)
+        page = dict(page)
+    _track_view(site["id"])
+    body = f"<h1>{html.escape(page.get('title') or 'Untitled')}</h1>" + _render_page_html(page)
+    return _site_shell(site=site, pages=pages, current_id=page["id"],
+                       title=page.get("title") or "Untitled", body_html=body)
+
+
+@router.get("/s/{slug}/sitemap.xml", response_class=PlainTextResponse)
+def site_sitemap(request: Request, slug: str):
+    with get_conn() as conn:
+        site = _resolve_site(conn, slug=slug)
+        if not site or _site_expired(site) or site.get("password_hash"):
+            return PlainTextResponse("Not found", status_code=404)
+        pages = _site_pages(conn, site["id"])
+    base = str(request.base_url).rstrip("/")
+    urls = [f"<url><loc>{base}/s/{slug}</loc></url>"] + [
+        f"<url><loc>{base}/s/{slug}/{p['slug']}</loc></url>" for p in pages
+    ]
+    return PlainTextResponse(
+        "<?xml version='1.0' encoding='UTF-8'?>"
+        "<urlset xmlns='http://www.sitemaps.org/schemas/sitemap/0.9'>"
+        f"{''.join(urls)}</urlset>",
+        media_type="application/xml",
+    )
+
+
+@router.get("/s/{slug}/{page_ref}", response_class=HTMLResponse)
+def public_site_page(request: Request, slug: str, page_ref: str):
+    with get_conn() as conn:
+        site = _resolve_site(conn, slug=slug, host=request.headers.get("host", ""))
+        if not site:
+            return HTMLResponse("<h1>404 — Site not found.</h1>", status_code=404)
+        guard = _public_guard(site, request)
+        if guard:
+            return guard
+        pages = _site_pages(conn, site["id"])
+        target = _find_site_page(pages, page_ref)
+        if not target:
+            return HTMLResponse("<h1>404 — Page not in this site.</h1>", status_code=404)
+        page = conn.execute("SELECT * FROM pages WHERE id=?", (target["id"],)).fetchone()
+        if not page:
+            return HTMLResponse("<h1>404 — Page removed.</h1>", status_code=404)
+        page = dict(page)
+    _track_view(site["id"])
+    body = f"<h1>{html.escape(page.get('title') or 'Untitled')}</h1>" + _render_page_html(page)
+    return _site_shell(site=site, pages=pages, current_id=page["id"],
+                       title=page.get("title") or "Untitled", body_html=body)
+
+
+@router.post("/s/{slug}/auth")
+async def public_site_auth(request: Request, slug: str):
+    with get_conn() as conn:
+        site = _resolve_site(conn, slug=slug)
+        if not site:
+            return JSONResponse({"detail": "Site not found"}, status_code=404)
+    if not site.get("password_hash"):
+        return {"status": "public"}
+    ctype = request.headers.get("content-type", "")
+    password = ""
+    if "application/json" in ctype:
+        try:
+            password = (await request.json()).get("password", "")
+        except Exception:
+            logger.exception("public_site_auth")
+            password = ""
+    else:
+        try:
+            form = await request.form()
+            password = form.get("password", "")
+        except Exception:
+            logger.exception("public_site_auth")
+            password = ""
+    if not verify_password(password or "", site["password_hash"] or ""):
+        raise HTTPException(401, "Wrong password")
+    from itsdangerous import URLSafeTimedSerializer
+    ser = URLSafeTimedSerializer(settings.app_secret_key, salt="site-auth")
+    resp = JSONResponse({"status": "unlocked"})
+    resp.set_cookie(_site_auth_cookie(site["id"]), ser.dumps(site["id"]),
+                    httponly=True, samesite="lax", max_age=86400, path="/")
+    return resp
+
+
+# ── Public Forms ───────────────────────────────────────────────────────────
+
+@router.get("/api/v2/collections/{collection_id}/form")
+def get_form_config(collection_id: int, request: Request):
+    _auth_user(request)
+    with get_conn() as conn:
+        info = _form_config(conn, collection_id)
+    return {"collection_id": collection_id, "name": info["name"], "form": info["config"]}
+
+
+@router.put("/api/v2/collections/{collection_id}/form")
+def put_form_config(collection_id: int, request: Request, body: dict = Body(default={})):
+    user = _auth_user(request, require_write=True)
+    with get_conn() as conn:
+        info = _form_config(conn, collection_id)
+        cfg = info["config"] if isinstance(info["config"], dict) else {}
+        if "enabled" in body:
+            cfg["enabled"] = bool(body["enabled"])
+        for key in ("title", "success_message"):
+            if key in body:
+                cfg[key] = str(body[key] or "")[:300]
+        for key in ("fields", "required", "notify_user_ids"):
+            if key in body and isinstance(body[key], list):
+                cfg[key] = body[key][:50]
+        if "public_token" in body and body["public_token"]:
+            tok = str(body["public_token"])
+            if not _FORM_TOKEN_RE.match(tok):
+                raise HTTPException(400, "Invalid public_token (f_ + 6-64 chars)")
+            cfg["public_token"] = tok
+        if cfg.get("enabled") and not cfg.get("public_token"):
+            cfg["public_token"] = "f_" + secrets.token_urlsafe(9)
+        conn.execute(
+            "UPDATE collections SET form_config_json=? WHERE id=?",
+            (json.dumps(cfg), collection_id),
+        )
+        conn.commit()
+    audit_log(user, "form.config", "collection", collection_id, "", request)
+    return {"collection_id": collection_id, "form": cfg}
+
+
+def _collection_props(conn, collection_id: int) -> list[dict]:
+    return [dict(r) for r in conn.execute(
+        "SELECT * FROM collection_properties WHERE collection_id=? ORDER BY position",
+        (collection_id,)).fetchall()]
+
+
+@router.get("/f/{token}", response_class=HTMLResponse)
+def public_form(request: Request, token: str):
+    embed = request.query_params.get("embed") == "1"
+    with get_conn() as conn:
+        row = conn.execute("SELECT * FROM collections").fetchone()
+        target = None
+        if _FORM_TOKEN_RE.match(token or ""):
+            for c in conn.execute("SELECT id, name, form_config_json FROM collections").fetchall():
+                try:
+                    cfg = json.loads(c["form_config_json"] or "{}")
+                except Exception:
+                    continue
+                if cfg.get("enabled") and cfg.get("public_token") == token:
+                    target = (c, cfg)
+                    break
+        _ = row
+        if not target:
+            return HTMLResponse("<h1>404 — Form not found.</h1>", status_code=404)
+        coll, cfg = target
+        props = _collection_props(conn, coll["id"])
+    fields = cfg.get("fields") or [p["name"] for p in props if p["prop_type"] != "formula"][:10]
+    required = set(cfg.get("required") or [])
+    inputs = ""
+    for name in fields:
+        prop = next((p for p in props if p["name"] == name), None)
+        ptype = (prop or {}).get("prop_type", "text")
+        itype = {"number": "number", "email": "email", "url": "url",
+                 "date": "date", "phone": "tel"}.get(ptype, "text")
+        req = "required" if name in required else ""
+        if ptype in ("select", "status") and prop:
+            try:
+                opts = json.loads(prop.get("options_json") or "[]")
+            except Exception:
+                opts = []
+            opts_html = "".join(
+                f"<option>{html.escape(o.get('name', ''))}</option>" for o in opts)
+            inputs += (f"<label>{html.escape(name)}{'*' if req else ''}</label>"
+                       f"<select name='{html.escape(name)}' {req}>{opts_html}</select>")
+        elif ptype == "checkbox":
+            inputs += (f"<label><input type='checkbox' name='{html.escape(name)}'> "
+                       f"{html.escape(name)}</label>")
+        else:
+            inputs += (f"<label>{html.escape(name)}{'*' if req else ''}</label>"
+                       f"<input type='{itype}' name='{html.escape(name)}' {req}>")
+    chrome = "" if embed else f"<h1>{html.escape(cfg.get('title') or coll['name'])}</h1>"
+    return HTMLResponse(
+        f"""<!DOCTYPE html><html><head><meta charset="UTF-8">
+<meta name="viewport" content="width=device-width,initial-scale=1.0">
+<title>{html.escape(cfg.get('title') or coll['name'])}</title>
+<style>body{{font-family:system-ui;background:#191919;color:#eee;margin:0;padding:24px}}
+form{{max-width:520px;margin:auto}}label{{display:block;margin:12px 0 4px}}
+input,select,textarea{{width:100%;padding:8px;border-radius:6px;border:1px solid #444;background:#222;color:#fff}}
+button{{margin-top:16px;padding:10px 18px;border-radius:6px;border:0;background:#2383E2;color:#fff}}</style>
+</head><body>{chrome}
+<form method="post" action="/f/{token}">
+<input type="text" name="__hp" style="display:none" tabindex="-1" autocomplete="off">
+{inputs}<button>Submit</button></form></body></html>"""
+    )
+
+
+@router.post("/f/{token}")
+async def submit_form(request: Request, token: str):
+    ip = request.client.host if request.client else "unknown"
+    _check_form_rate(ip or "unknown")
+    ctype = request.headers.get("content-type", "")
+    data: dict = {}
+    if "application/json" in ctype:
+        try:
+            data = await request.json()
+        except Exception:
+            data = {}
+    else:
+        try:
+            form = await request.form()
+            data = dict(form)
+        except Exception:
+            data = {}
+    if data.get("__hp"):
+        raise HTTPException(400, "Spam detected")
+    with get_conn() as conn:
+        target = None
+        if _FORM_TOKEN_RE.match(token or ""):
+            for c in conn.execute("SELECT id, name, form_config_json FROM collections").fetchall():
+                try:
+                    cfg = json.loads(c["form_config_json"] or "{}")
+                except Exception:
+                    continue
+                if cfg.get("enabled") and cfg.get("public_token") == token:
+                    target = (c, cfg)
+                    break
+        if not target:
+            # NOTE: return (not raise) — the global 404 handler redirects
+            # non-/api paths to /workspaces, which would turn this into a 200.
+            return JSONResponse({"detail": "Form not found"}, status_code=404)
+        coll, cfg = target
+        props = _collection_props(conn, coll["id"])
+        by_name = {p["name"]: p for p in props}
+        fields = cfg.get("fields") or list(by_name)[:10]
+        required = set(cfg.get("required") or [])
+        values: dict = {}
+        for name in fields:
+            prop = by_name.get(name)
+            if not prop:
+                continue
+            raw = data.get(name, "")
+            if prop["prop_type"] == "checkbox":
+                raw = True if raw in (True, "on", "true", "1", "checked") else False
+            if name in required and (raw is None or raw == "" or raw is False):
+                raise HTTPException(400, f"Field required: {name}")
+            values[str(prop["id"])] = raw
+        # Validate via property_types.validate_property_rule
+        try:
+            from app.services.property_types import validate_property_rule
+            for name in fields:
+                prop = by_name.get(name)
+                if not prop:
+                    continue
+                ok, _msg = validate_property_rule(
+                    prop.get("prop_type", "text"), values.get(str(prop["id"])),
+                    prop.get("validation_json") or prop.get("options_json") or "")
+                if not ok:
+                    raise HTTPException(400, f"Invalid value for {name}: {_msg}")
+        except HTTPException:
+            raise
+        except Exception:
+            logger.exception("submit_form")
+        title = str(data.get(by_name[fields[0]]["name"], "Form response") if fields else "Form response")[:200]
+        cur = conn.execute(
+            """INSERT INTO collection_pages (collection_id, title, property_values_json)
+               VALUES (?, ?, ?)""",
+            (coll["id"], title or "Form response", json.dumps(values)),
+        )
+        row_id = cur.lastrowid
+        ip_hash = hashlib.sha256(f"{ip}|{datetime.now(UTC).strftime('%Y-%m-%d')}".encode()).hexdigest()
+        conn.execute(
+            "INSERT INTO form_responses (collection_id, row_id, ip_hash) VALUES (?, ?, ?)",
+            (coll["id"], row_id, ip_hash),
+        )
+        conn.commit()
+        notify_ids = cfg.get("notify_user_ids") or []
+    # Notify (never throws the submission)
+    try:
+        from app.services.notifications import create_notification
+        for uid in notify_ids[:20]:
+            try:
+                create_notification(int(uid), None, "form_response",
+                                    f"New response: {coll['name']}",
+                                    f"{title}", "collection", coll["id"],
+                                    f"/db/{coll['id']}")
+            except Exception:
+                continue
+    except Exception:
+        logger.exception("submit_form")
+    try:
+        from app.services.automations import fire_event as _fire
+        await _fire("form.submitted", {"collection_id": coll["id"], "row_id": row_id})
+    except Exception:
+        logger.exception("submit_form")
+    if "application/json" in ctype:
+        return {"status": "ok", "row_id": row_id,
+                "message": cfg.get("success_message") or "Merci !"}
+    return HTMLResponse(
+        f"""<!DOCTYPE html><html><body style="font-family:system-ui;background:#191919;color:#eee;
+        display:flex;align-items:center;justify-content:center;height:100vh">
+        <p>{html.escape(cfg.get('success_message') or 'Merci !')}</p></body></html>"""
+    )
+
+
+# used by tests to reset the anonymous rate limiter
+def _reset_form_rate() -> None:
+    _form_rate.clear()
+
+
+# Backwards-compat alias for tests importing ``get_bearer_user`` from here.
+__all__ = ["router", "get_bearer_user"]

app/routers/sso.py

@@ -0,0 +1,652 @@
+"""FlowDeck — v6.7.0 SSO: SAML 2.0 + OIDC endpoints and admin config API.
+
+Two families of routes:
+
+* ``/auth/saml/*`` and ``/auth/oidc/*`` — the browser flows (login redirect,
+  ACS callback, SP metadata, Single Logout). The callback endpoints are
+  CSRF-exempt (cross-site POST from the IdP) and instead protected by the
+  single-use ``sso_requests`` relay token + full assertion validation.
+* ``/api/v2/sso/*`` — admin configuration API (session admin or Bearer token
+  with write scope), consumed by Settings → Admin → SSO / Enterprise.
+
+Every attempt — success or rejection — lands in ``sso_login_history``.
+"""
+from __future__ import annotations
+
+import logging
+import secrets
+import time
+
+from fastapi import APIRouter, Body, HTTPException, Request
+from fastapi.responses import HTMLResponse, RedirectResponse
+
+from app.auth.providers import oidc_provider, saml_provider
+from app.auth.session import SessionManager
+from app.services import sso_provisioning as sso
+from app.services.api_v2_helpers import has_scope, resolve_bearer_token
+from app.services.http_client import shared_client
+
+logger = logging.getLogger(__name__)
+router = APIRouter(tags=["sso"])
+
+DEFAULT_NEXT = "/workspaces"
+
+# ── Rate limiting (design §5.2: 5 SSO attempts / minute / IP) ──────────────
+_RATE_WINDOW = 60.0
+_RATE_MAX = 5
+_rate_store: dict[str, tuple[float, int]] = {}
+
+
+def _rate_ok(request: Request, bucket: str = "sso") -> bool:
+    from app.config import settings
+
+    if not settings.rate_limit_enabled:
+        return True
+    ip = request.client.host if request.client else "unknown"
+    key = f"{bucket}:{ip}"
+    now = time.time()
+    window, count = _rate_store.get(key, (0.0, 0))
+    if now - window > _RATE_WINDOW:
+        _rate_store[key] = (now, 1)
+        return True
+    if count >= _RATE_MAX:
+        return False
+    _rate_store[key] = (window, count + 1)
+    return True
+
+
+def _page(title: str, body: str, status: int = 200) -> HTMLResponse:
+    """Small standalone error/info page (same styling as the login page)."""
+    return HTMLResponse(
+        f"""<!DOCTYPE html><html lang="en"><head><meta charset="UTF-8">
+<title>FlowDeck — {title}</title><style>
+*{{margin:0;padding:0;box-sizing:border-box}}
+body{{background:#191919;color:#fff;font-family:-apple-system,BlinkMacSystemFont,'Segoe UI',sans-serif;
+display:flex;align-items:center;justify-content:center;min-height:100vh;}}
+.box{{background:#222;border:1px solid rgba(255,255,255,.08);border-radius:12px;padding:40px;max-width:460px;text-align:center;}}
+h1{{font-size:20px;margin-bottom:12px}}p{{color:rgba(255,255,255,.55);font-size:14px;margin-bottom:10px;line-height:1.5;word-break:break-word}}
+a{{color:#2383E2;font-size:14px;text-decoration:none}}a:hover{{text-decoration:underline}}
+</style></head><body><div class="box"><h1>{title}</h1>{body}</div></body></html>""",
+        status_code=status,
+    )
+
+
+def _sso_config_or_error() -> dict | None:
+    cfg = sso.get_sso_config()
+    return sso.normalize_config(cfg) if cfg else None
+
+
+def _session_cookie(user_data: dict, request: Request):
+    """Signed, revocable session cookie (same shape as local/OAuth logins)."""
+    return SessionManager.create_session(user_data, request)
+
+
+def _login_error(message: str, *, cfg: dict | None, identifier: str = "", request=None) -> HTMLResponse:
+    provider_type = (cfg or {}).get("provider_type", "saml")
+    sso.log_sso_login(
+        user_id=None,
+        provider_type=provider_type,
+        provider_name=(cfg or {}).get("name") or "SSO",
+        identifier=identifier,
+        request=request,
+        success=False,
+        error=message,
+    )
+    logger.warning("SSO login rejected: %s", message)
+    safe = (
+        message.replace("&", "&amp;").replace("<", "&lt;").replace(">", "&gt;")[:400]
+    )
+    return _page(
+        "SSO sign-in failed",
+        f"<p>{safe}</p><p><a href=\"/auth/login?provider=local\">↩ Back to login</a></p>",
+        status=403,
+    )
+
+
+# ═══════════════════════════════ SAML 2.0 ════════════════════════════════
+
+
+@router.get("/auth/saml/login")
+def saml_login(request: Request, next: str = DEFAULT_NEXT):
+    """SP-initiated SSO: issue an AuthnRequest and redirect to the IdP."""
+    if not _rate_ok(request, "saml"):
+        return _page("Too many attempts", "<p>Please wait a minute and try again.</p>", status=429)
+    cfg = _sso_config_or_error()
+    if not cfg or cfg["provider_type"] != "saml":
+        return _page(
+            "SAML not configured",
+            "<p>Single Sign-On has not been set up by the server administrator.</p>"
+            "<p><a href=\"/auth/login?provider=local\">↩ Use local login</a></p>",
+            status=404,
+        )
+
+    cfg = sso.ensure_sp_keypair(cfg)
+    # RelayState = "<AuthnRequest id>.<CSRF token>" — both checked at the ACS.
+    csrf_token = secrets.token_hex(16)
+    # The id is only known after building the request, so build it first with a
+    # placeholder relay state, then re-issue with the real one? python3-saml
+    # builds the AuthnRequest inside login(); we instead create the row right
+    # after login() returns the URL — but the RelayState is already embedded.
+    # So: generate the request id ourselves is not possible → build the URL,
+    # then patch the RelayState by rebuilding with the known id.
+    from urllib.parse import parse_qs, urlencode, urlparse
+
+    provisional = saml_provider.create_login(request, cfg, relay_state="_pending_")
+    authn_id = provisional[1]
+    relay = f"{authn_id}.{csrf_token}"
+    sso.create_request(
+        "saml_authn",
+        request_id=authn_id,
+        relay_state=csrf_token,
+        next_path=sso.safe_next_path(next),
+    )
+    # Replace the placeholder RelayState with the real token (same SAMLRequest).
+    parsed = urlparse(provisional[0])
+    params = parse_qs(parsed.query)
+    params["RelayState"] = [relay]
+    flat = [(k, v) for k, values in params.items() for v in values]
+    url = f"{parsed.scheme}://{parsed.netloc}{parsed.path}?{urlencode(flat)}"
+    return RedirectResponse(url, status_code=302)
+
+
+@router.post("/auth/saml/callback")
+async def saml_callback(request: Request):
+    """Assertion Consumer Service — validate the SAMLResponse and open a session."""
+    if not _rate_ok(request, "saml-cb"):
+        return _page("Too many attempts", "<p>Please wait a minute and try again.</p>", status=429)
+
+    form = await request.form()
+    saml_response = str(form.get("SAMLResponse") or "")
+    relay_state = str(form.get("RelayState") or "")
+    if not saml_response:
+        return _login_error("Missing SAMLResponse", cfg=None, request=request)
+
+    cfg = _sso_config_or_error()
+    if not cfg or cfg["provider_type"] != "saml":
+        return _login_error("SAML is not configured", cfg=None, request=request)
+
+    authn_id, _, csrf_token = relay_state.partition(".")
+    pending = sso.peek_request("saml_authn", authn_id)
+    if not pending and sso.was_consumed("saml_authn", authn_id):
+        # Same assertion twice: the single-use row is already spent.
+        return _login_error(
+            "Replayed SAML response rejected", cfg=cfg, identifier=authn_id, request=request
+        )
+    if not pending or not csrf_token or not secrets.compare_digest(
+        pending.get("relay_state", ""), csrf_token
+    ):
+        return _login_error(
+            "Unknown or expired login request (start again from the login page)",
+            cfg=cfg, request=request,
+        )
+
+    try:
+        identity = saml_provider.process_response(
+            request, cfg, {"SAMLResponse": saml_response, "RelayState": relay_state}, authn_id
+        )
+    except saml_provider.SAMLError as err:
+        return _login_error(str(err), cfg=cfg, identifier=authn_id, request=request)
+
+    # Single-use: the same AuthnRequest id can never authenticate twice.
+    consumed = sso.consume_request("saml_authn", authn_id, csrf_token)
+    if not consumed:
+        return _login_error(
+            "Replayed SAML response rejected", cfg=cfg, identifier=authn_id, request=request
+        )
+
+    claims = sso.identity_from_saml(identity, cfg)
+    identifier = sso.sso_identifier_field(claims)
+    try:
+        user = sso.handle_sso_login(claims, provider_type="saml", cfg=cfg, request=request)
+    except sso.SSOProvisioningError as err:
+        # _login_error() below records the failed attempt itself.
+        return _login_error(str(err), cfg=cfg, identifier=identifier, request=request)
+
+    sso.log_sso_login(
+        user_id=user["id"], provider_type="saml",
+        provider_name=cfg.get("name") or "SSO", identifier=identifier,
+        request=request, success=True,
+    )
+    user_data = dict(user)
+    user_data["_sso_name_id"] = identity.name_id
+    user_data["_sso_session_index"] = identity.session_index
+    response = RedirectResponse(consumed.get("next_path") or DEFAULT_NEXT, status_code=302)
+    response.set_cookie(
+        "flowdeck_session", _session_cookie(user_data, request),
+        httponly=True, max_age=86400 * 7, samesite="lax", path="/",
+    )
+    return response
+
+
+@router.get("/auth/saml/metadata")
+def saml_metadata(request: Request):
+    """SP metadata XML — paste into the IdP (Azure AD / Okta / Keycloak…)."""
+    cfg = _sso_config_or_error()
+    if not cfg or cfg["provider_type"] != "saml":
+        return _page("SAML not configured", "<p>No SAML configuration found.</p>", status=404)
+    cfg = sso.ensure_sp_keypair(cfg)
+    try:
+        xml = saml_provider.metadata_xml(request, cfg)
+    except saml_provider.SAMLError as err:
+        return _page("Metadata error", f"<p>{err}</p>", status=500)
+    return HTMLResponse(xml, media_type="application/samlmetadata+xml")
+
+
+async def _saml_logout(request: Request, next: str = "/auth/login?provider=local"):
+    """Single Logout: SP-initiated (our logout button) or IdP-initiated.
+
+    * no SAML payload → build a LogoutRequest to the IdP (after revoking the
+      local session);
+    * ``SAMLRequest`` / ``SAMLResponse`` present → process it (LogoutResponse
+      of our own SLO, or a LogoutRequest issued by the IdP).
+    """
+    form = dict(await request.form()) if request.method == "POST" else {}
+    query = dict(request.query_params)
+    cfg = _sso_config_or_error()
+    if not cfg or cfg["provider_type"] != "saml":
+        response = RedirectResponse(next, status_code=302)
+        response.delete_cookie("flowdeck_session")
+        return response
+
+    payload = form.get("SAMLRequest") or form.get("SAMLResponse") or query.get("SAMLResponse")
+    if payload:
+        try:
+            url, errors = saml_provider.process_slo_form(request, cfg, form, query)
+        except saml_provider.SAMLError as err:
+            logger.warning("SLO processing failed: %s", err)
+            return _login_error(str(err), cfg=cfg, request=request)
+        if errors:
+            return _login_error(
+                "; ".join(errors)[:300], cfg=cfg, request=request
+            )
+        response = RedirectResponse(url or next, status_code=302)
+        response.delete_cookie("flowdeck_session")
+        return response
+
+    # SP-initiated
+    cookie = request.cookies.get("flowdeck_session", "")
+    user = SessionManager.decode_session(cookie) if cookie else None
+    response = RedirectResponse(next, status_code=302)
+    if cookie:
+        sid = SessionManager.session_id(cookie)
+        if sid:
+            SessionManager.revoke_session(sid)
+        response.delete_cookie("flowdeck_session")
+    if user and cfg.get("slo_url") and user.get("_sso_name_id"):
+        try:
+            logout_url = saml_provider.build_logout_url(
+                request, cfg,
+                return_to=sso.safe_next_path(next),
+                name_id=user.get("_sso_name_id", ""),
+                session_index=user.get("_sso_session_index", ""),
+            )
+            # Keep the cookie-clearing headers built above: hand the browser
+            # to the IdP with our local session already dead.
+            response = RedirectResponse(logout_url, status_code=302)
+            response.delete_cookie("flowdeck_session")
+            return response
+        except saml_provider.SAMLError as err:
+            logger.warning("SP-initiated SLO failed: %s", err)
+    return response
+
+
+
+@router.get("/auth/saml/logout")
+async def saml_logout(request: Request, next: str = "/auth/login?provider=local"):
+    """SP-initiated Single Logout (GET) — hands the browser to the IdP."""
+    return await _saml_logout(request, next)
+
+
+@router.post("/auth/saml/logout")
+async def saml_logout_post(request: Request, next: str = "/auth/login?provider=local"):
+    """IdP-initiated Single Logout (POST with SAMLRequest/SAMLResponse)."""
+    return await _saml_logout(request, next)
+
+
+# ═════════════════════════════════ OIDC ═══════════════════════════════════
+
+
+@router.get("/auth/oidc/login")
+async def oidc_login(request: Request, next: str = DEFAULT_NEXT):
+    """Redirect to the OIDC provider (authorization code + PKCE)."""
+    if not _rate_ok(request, "oidc"):
+        return _page("Too many attempts", "<p>Please wait a minute and try again.</p>", status=429)
+    cfg = _sso_config_or_error()
+    if not cfg or cfg["provider_type"] != "oidc":
+        return _page(
+            "OIDC not configured",
+            "<p>Single Sign-On has not been set up by the server administrator.</p>"
+            "<p><a href=\"/auth/login?provider=local\">↩ Use local login</a></p>",
+            status=404,
+        )
+    try:
+        doc = await oidc_provider.discover(cfg["issuer_url"])
+    except oidc_provider.OIDCError as err:
+        return _login_error(str(err), cfg=cfg, request=request)
+
+    from app.auth.providers.saml_provider import external_base_url
+
+    state = secrets.token_hex(32)
+    nonce = secrets.token_hex(16)
+    verifier, challenge = oidc_provider.pkce_pair()
+    sso.create_request(
+        "oidc",
+        request_id=state,
+        relay_state=nonce,
+        code_verifier=verifier,
+        next_path=sso.safe_next_path(next),
+    )
+    url = oidc_provider.build_authorize_url(
+        doc,
+        client_id=cfg["client_id"],
+        redirect_uri=f"{external_base_url(request)}/auth/oidc/callback",
+        scope=cfg.get("scope") or "openid profile email",
+        state=state,
+        nonce=nonce,
+        code_challenge=challenge,
+    )
+    return RedirectResponse(url, status_code=302)
+
+
+async def _oidc_callback(request: Request):
+    """OIDC callback: exchange the code, validate the ID token, open a session."""
+    if not _rate_ok(request, "oidc-cb"):
+        return _page("Too many attempts", "<p>Please wait a minute and try again.</p>", status=429)
+
+    params = dict(request.query_params)
+    if request.method == "POST":
+        params.update({k: str(v) for k, v in (await request.form()).items()})
+
+    cfg = _sso_config_or_error()
+    if not cfg or cfg["provider_type"] != "oidc":
+        return _login_error("OIDC is not configured", cfg=None, request=request)
+
+    if params.get("error"):
+        return _login_error(
+            f"Provider error: {params.get('error')} {params.get('error_description', '')}".strip(),
+            cfg=cfg, request=request,
+        )
+    code, state = params.get("code", ""), params.get("state", "")
+    pending = sso.consume_request("oidc", state)
+    if not code or not pending:
+        return _login_error(
+            "Unknown or expired OIDC state (start again from the login page)",
+            cfg=cfg, request=request,
+        )
+
+    from app.auth.providers.saml_provider import external_base_url
+
+    try:
+        doc = await oidc_provider.discover(cfg["issuer_url"])
+        tokens = await oidc_provider.exchange_code(
+            doc,
+            client_id=cfg["client_id"],
+            client_secret=sso.client_secret_value(cfg),
+            code=code,
+            redirect_uri=f"{external_base_url(request)}/auth/oidc/callback",
+            code_verifier=pending.get("code_verifier", ""),
+        )
+        jwks = await _fetch_jwks(doc)
+        claims = oidc_provider.validate_id_token(
+            tokens.get("id_token", ""),
+            issuer=cfg["issuer_url"],
+            client_id=cfg["client_id"],
+            nonce=pending.get("relay_state", ""),
+            jwks=jwks,
+        )
+        userinfo = await oidc_provider.fetch_userinfo(doc, tokens.get("access_token", ""))
+    except oidc_provider.OIDCError as err:
+        return _login_error(str(err), cfg=cfg, identifier=state, request=request)
+
+    merged = {**claims, **userinfo}
+    identity = oidc_provider.claims_to_identity(merged, cfg.get("attribute_mapping") or None)
+    identifier = sso.sso_identifier_field(identity)
+    try:
+        user = sso.handle_sso_login(identity, provider_type="oidc", cfg=cfg, request=request)
+    except sso.SSOProvisioningError as err:
+        # _login_error() below records the failed attempt itself.
+        return _login_error(str(err), cfg=cfg, identifier=identifier, request=request)
+
+    sso.log_sso_login(
+        user_id=user["id"], provider_type="oidc",
+        provider_name=cfg.get("name") or "SSO", identifier=identifier,
+        request=request, success=True,
+    )
+    response = RedirectResponse(pending.get("next_path") or DEFAULT_NEXT, status_code=302)
+    response.set_cookie(
+        "flowdeck_session", _session_cookie(dict(user), request),
+        httponly=True, max_age=86400 * 7, samesite="lax", path="/",
+    )
+    return response
+
+
+
+@router.get("/auth/oidc/callback")
+async def oidc_callback(request: Request):
+    """OIDC callback (GET, authorization code in the query string)."""
+    return await _oidc_callback(request)
+
+
+@router.post("/auth/oidc/callback")
+async def oidc_callback_post(request: Request):
+    """OIDC callback (POST, form_post response mode)."""
+    return await _oidc_callback(request)
+
+
+async def _fetch_jwks(doc: dict) -> dict:
+    url = doc.get("jwks_uri")
+    if not url:
+        raise oidc_provider.OIDCError("Discovery document has no jwks_uri")
+
+    try:
+        async with shared_client(timeout=15) as client:
+            r = await client.get(url)
+            r.raise_for_status()
+            data = r.json()
+    except Exception as err:
+        raise oidc_provider.OIDCError(f"Could not fetch the issuer JWKS: {err}") from err
+    if not isinstance(data, dict) or not data.get("keys"):
+        raise oidc_provider.OIDCError("Issuer JWKS contains no keys")
+    return data
+
+
+async def _oidc_logout(request: Request, next: str = "/auth/login?provider=local"):
+    """Local logout + RP-initiated logout at the provider when supported."""
+    cfg = _sso_config_or_error()
+    response = RedirectResponse(next, status_code=302)
+    cookie = request.cookies.get("flowdeck_session", "")
+    if cookie:
+        sid = SessionManager.session_id(cookie)
+        if sid:
+            SessionManager.revoke_session(sid)
+        response.delete_cookie("flowdeck_session")
+    if cfg and cfg["provider_type"] == "oidc":
+        try:
+            doc = await oidc_provider.discover(cfg["issuer_url"])
+            end_session = doc.get("end_session_endpoint")
+            if end_session:
+                from urllib.parse import urlencode
+
+                from app.auth.providers.saml_provider import external_base_url
+
+                qs = urlencode({
+                    "client_id": cfg["client_id"],
+                    "post_logout_redirect_uri": external_base_url(request) + next,
+                })
+                sep = "&" if "?" in end_session else "?"
+                return RedirectResponse(f"{end_session}{sep}{qs}", status_code=302)
+        except oidc_provider.OIDCError as err:
+            logger.debug("RP-initiated logout skipped: %s", err)
+    return response
+
+
+
+@router.get("/auth/oidc/logout")
+async def oidc_logout(request: Request, next: str = "/auth/login?provider=local"):
+    """OIDC logout (GET) — local session first, then the IdP end-session URL."""
+    return await _oidc_logout(request, next)
+
+
+@router.post("/auth/oidc/logout")
+async def oidc_logout_post(request: Request, next: str = "/auth/login?provider=local"):
+    """OIDC logout (POST)."""
+    return await _oidc_logout(request, next)
+
+
+# ═══════════════════════ Admin configuration API ══════════════════════════
+
+
+def _require_admin(request: Request, *, write: bool) -> dict:
+    """Admin identity: Bearer token (scope read/write) or an admin session.
+
+    Session-authenticated writes also need the CSRF header — ``/api/v2`` is
+    exempted in the middleware, so the check lives here for this router.
+    """
+    auth_header = request.headers.get("authorization") or ""
+    if auth_header.lower().startswith("bearer "):
+        user = resolve_bearer_token(auth_header[7:].strip())
+        if not user:
+            raise HTTPException(status_code=401, detail="Invalid or expired token")
+        scopes = user.get("_token_scopes") or ""
+        need = "write" if write else "read"
+        if not (has_scope(scopes, need) or has_scope(scopes, "admin")):
+            raise HTTPException(status_code=403, detail=f"Insufficient scope. Required: {need}")
+        if not user.get("is_admin"):
+            raise HTTPException(status_code=403, detail="Admin access required")
+        return user
+
+    from app.db import get_conn
+
+    user = SessionManager.decode_session(request.cookies.get("flowdeck_session", ""))
+    if not user or not user.get("id"):
+        raise HTTPException(status_code=401, detail="Not authenticated")
+    with get_conn() as conn:
+        row = conn.execute(
+            "SELECT id, login, full_name, email, is_admin FROM users WHERE id=?",
+            (user["id"],),
+        ).fetchone()
+    if not row or not row["is_admin"]:
+        raise HTTPException(status_code=403, detail="Admin access required")
+    if write and request.method in ("POST", "PUT", "PATCH", "DELETE"):
+        cookie = request.cookies.get("csrf_token", "")
+        header = request.headers.get("X-CSRF-Token", "")
+        if not cookie or not header or not secrets.compare_digest(cookie, header):
+            raise HTTPException(status_code=403, detail="CSRF validation failed")
+    return dict(row)
+
+
+@router.get("/api/v2/sso/providers")
+def sso_providers(request: Request):
+    """Public: what the login page should show (button list + sso_only flag)."""
+    cfg = _sso_config_or_error()
+    if not cfg:
+        return {"providers": [], "sso_only": False}
+    from app.auth.providers.saml_provider import external_base_url
+
+    base = external_base_url(request)
+    login_path = "/auth/saml/login" if cfg["provider_type"] == "saml" else "/auth/oidc/login"
+    return {
+        "providers": [{
+            "type": cfg["provider_type"],
+            "name": cfg.get("name") or "Company SSO",
+            "icon": "🏢",
+            "login_url": f"{login_path}?next={DEFAULT_NEXT}",
+        }],
+        "sso_only": bool(cfg.get("sso_only")),
+        "base_url": base,
+    }
+
+
+@router.get("/api/v2/sso/config")
+def get_sso_config_api(request: Request):
+    """Read the current SSO configuration (secrets never returned)."""
+    _require_admin(request, write=False)
+    cfg = _sso_config_or_error()
+    return sso.public_config_view(cfg)
+
+
+@router.post("/api/v2/sso/config")
+@router.put("/api/v2/sso/config")
+def save_sso_config_api(request: Request, payload: dict = Body(...)):
+    """Create/replace the SSO configuration (admin, scope write)."""
+    admin = _require_admin(request, write=True)
+    try:
+        saved = sso.save_sso_config(payload, created_by=admin.get("id"))
+    except sso.SSOConfigError as err:
+        raise HTTPException(status_code=400, detail=str(err)) from err
+    from app.services.api_v2_helpers import audit_log
+
+    audit_log(admin, "sso.config.save", "sso_config", saved.get("id", 0),
+              f"provider={saved.get('provider_type')}", request)
+    return sso.public_config_view(saved)
+
+
+@router.delete("/api/v2/sso/config")
+def delete_sso_config_api(request: Request):
+    """Disable SSO — local logins keep working (design §8 « SSO disable »)."""
+    admin = _require_admin(request, write=True)
+    removed = sso.delete_sso_config()
+    from app.services.api_v2_helpers import audit_log
+
+    audit_log(admin, "sso.config.disable", "sso_config", 0, "", request)
+    return {"status": "ok", "disabled": removed}
+
+
+@router.get("/api/v2/sso/workspaces")
+def sso_workspaces(request: Request):
+    """Workspaces available for default assignment / group mapping."""
+    _require_admin(request, write=False)
+    from app.db import get_conn
+
+    with get_conn() as conn:
+        rows = conn.execute(
+            "SELECT id, name, owner_id FROM workspaces ORDER BY name"
+        ).fetchall()
+    cfg = _sso_config_or_error()
+    return {
+        "workspaces": [dict(r) for r in rows],
+        "default_workspace_id": (cfg or {}).get("default_workspace_id"),
+        "sso_only": bool((cfg or {}).get("sso_only")),
+        "provisioned_users": sso.provisioned_count(),
+    }
+
+
+@router.post("/api/v2/sso/sync")
+def sso_sync(request: Request):
+    """Re-apply group → workspace role mapping for every SSO user."""
+    admin = _require_admin(request, write=True)
+    try:
+        result = sso.force_sync_all_groups()
+    except sso.SSOProvisioningError as err:
+        raise HTTPException(status_code=400, detail=str(err)) from err
+    from app.services.api_v2_helpers import audit_log
+
+    audit_log(admin, "sso.sync", "sso_config", 0, str(result), request)
+    return {"status": "ok", **result}
+
+
+@router.get("/api/v2/sso/history")
+def sso_history(request: Request, limit: int = 50):
+    """Audit trail of SSO login attempts (successes and rejections)."""
+    _require_admin(request, write=False)
+    from app.db import get_conn
+
+    limit = max(1, min(int(limit or 50), 200))
+    with get_conn() as conn:
+        rows = conn.execute(
+            """SELECT h.id, h.user_id, u.login, h.provider_type, h.provider_name,
+                      h.sso_identifier, h.ip_address, h.success, h.error_message,
+                      h.created_at
+               FROM sso_login_history h LEFT JOIN users u ON u.id = h.user_id
+               ORDER BY h.id DESC LIMIT ?""",
+            (limit,),
+        ).fetchall()
+    out = []
+    for r in rows:
+        d = dict(r)
+        ident = d.get("sso_identifier") or ""
+        if "|" in ident:  # drop the stored group list from the UI payload
+            d["sso_identifier"] = ident.split("|", 1)[0]
+        d["success"] = bool(d["success"])
+        out.append(d)
+    return {"history": out}

app/routers/sync.py

@@ -0,0 +1,108 @@
+"""FlowDeck — /api/v2/sync endpoints (v6.0.0 PWA offline sync, Bearer v6.4.0).
+
+Auth: ``Authorization: Bearer <token>`` (scopes ``read`` for delta/status,
+``write`` for batch). The legacy ``flowdeck_session`` cookie is still accepted
+as a fallback so the installed PWA/service worker keeps syncing.
+"""
+from __future__ import annotations
+
+import logging
+
+from fastapi import APIRouter, Header, HTTPException, Query, Request
+from fastapi.responses import JSONResponse
+
+from app.auth.session import SessionManager
+from app.services.api_v2_helpers import get_bearer_user, has_scope
+from app.services.sync_engine import SyncEngine
+
+logger = logging.getLogger(__name__)
+
+router = APIRouter(prefix="/api/v2/sync", tags=["sync"])
+
+_engine = SyncEngine()
+
+
+def _user(request: Request, authorization: str | None = None,
+          *, required_scope: str = "read") -> dict:
+    """Bearer-first auth with session-cookie fallback (offline.js compat)."""
+    auth = authorization or request.headers.get("authorization") or ""
+    if auth and auth.lower().startswith("bearer "):
+        try:
+            user = get_bearer_user(request, authorization)
+        except HTTPException:
+            raise HTTPException(
+                status_code=401, detail="Invalid or expired API token"
+            ) from None
+        if not has_scope(user.get("_token_scopes"), required_scope):
+            raise HTTPException(
+                status_code=403,
+                detail=f"Insufficient scope. Required: {required_scope}",
+            )
+        return user
+    user = SessionManager.decode_session(request.cookies.get("flowdeck_session", ""))
+    if not user:
+        raise HTTPException(status_code=401, detail="Authentication required")
+    return user
+
+
+@router.get("/delta")
+async def sync_delta(
+    request: Request,
+    since: float = Query(default=0, description="Epoch seconds (ou ms) du dernier sync"),
+    workspace_id: int = Query(default=None),
+    authorization: str | None = Header(default=None),
+):
+    """Pull server-side changes since `since` (for the given workspace)."""
+    user = _user(request, authorization, required_scope="read")
+    if workspace_id is None:
+        raise HTTPException(status_code=400, detail="workspace_id is required")
+    result = await _engine.get_delta(user["id"], since, workspace_id)
+    if result.get("error") == "forbidden":
+        return JSONResponse({"detail": "Forbidden"}, status_code=403)
+    return result
+
+
+@router.post("/batch")
+async def sync_batch(request: Request, authorization: str | None = Header(default=None)):
+    """Apply a batch of offline mutations and return per-mutation results."""
+    user = _user(request, authorization, required_scope="write")
+    try:
+        body = await request.json()
+    except Exception:
+        raise HTTPException(status_code=400, detail="Invalid JSON body") from None
+
+    mutations = body.get("mutations") or []
+    device_id = body.get("device_id") or "unknown"
+    if not isinstance(mutations, list) or not mutations:
+        return {"results": [], "conflicts": [], "server_time": SyncEngine._now_epoch()}
+
+    result = await _engine.apply_batch(user["id"], mutations, device_id)
+    result["server_time"] = SyncEngine._now_epoch()
+    return result
+
+
+@router.get("/status")
+def sync_status(request: Request, workspace_id: int = Query(default=None),
+                      authorization: str | None = Header(default=None)):
+    """Synchronization status for the workspace (pending server queue, last sync)."""
+    user = _user(request, authorization, required_scope="read")
+    from app.db import get_conn
+    with get_conn() as conn:
+        if not SyncEngine._can_access(conn, user["id"], workspace_id):
+            return JSONResponse({"detail": "Forbidden"}, status_code=403)
+        pending = conn.execute(
+            "SELECT COUNT(*) AS n FROM offline_sync_queue WHERE user_id=? AND status='pending'",
+            (user["id"],),
+        ).fetchone()["n"]
+        last = conn.execute(
+            "SELECT MAX(created_at) AS last FROM offline_sync_queue "
+            "WHERE user_id=? AND status='synced'",
+            (user["id"],),
+        ).fetchone()["last"]
+        return {
+            "pending_count": pending,
+            "last_sync": last,
+            "is_syncing": False,
+            "server_time": SyncEngine._now_epoch(),
+            "workspace_id": workspace_id,
+        }

app/routers/web_clipper.py

@@ -0,0 +1,307 @@
+"""FlowDeck — Web Clipper router (v6.0.0).
+
+Endpoints:
+  GET  /api/v2/web-clipper/status
+  POST /api/v2/web-clipper/auth/verify
+  POST /api/v2/web-clipper/clip
+  GET  /api/v2/web-clipper/devices
+  DELETE /api/v2/web-clipper/devices/{id}
+  GET  /extensions  (HTML download page)
+
+Auth: session cookie OR Bearer api_token OR Bearer extension device token.
+"""
+from __future__ import annotations
+
+import hashlib
+import logging
+
+from fastapi import APIRouter, Body, HTTPException, Request
+from fastapi.responses import HTMLResponse
+
+from app.auth.session import SessionManager
+from app.db import get_conn
+from app.services.web_clipper import (
+    MAX_CLIP_BYTES,
+    _check_rate_limit,
+    create_page_from_clip,
+    list_devices,
+    log_clip,
+    register_device,
+    revoke_device,
+    sanitize_html,
+)
+
+logger = logging.getLogger(__name__)
+router = APIRouter(tags=["web-clipper"])
+api_router = APIRouter(prefix="/api/v2/web-clipper", tags=["web-clipper"])
+
+
+def _hash(token: str) -> str:
+    return hashlib.sha256(token.encode()).hexdigest()
+
+
+def _user_from_request(request: Request) -> dict | None:
+    # 1) session cookie
+    user = SessionManager.decode_session(request.cookies.get("flowdeck_session", ""))
+    if user:
+        return user
+    # 2) Authorization Bearer
+    auth = request.headers.get("authorization") or request.headers.get("Authorization") or ""
+    if auth.lower().startswith("bearer "):
+        token = auth[7:].strip()
+        if not token:
+            return None
+        th = _hash(token)
+        with get_conn() as conn:
+            # api_tokens (Settings → API tokens)
+            row = conn.execute(
+                "SELECT user_id FROM api_tokens WHERE token_hash=? AND revoked=0", (th,)
+            ).fetchone()
+            if row:
+                u = conn.execute("SELECT id, login, full_name, email, is_admin FROM users WHERE id=?", (row["user_id"],)).fetchone()
+                if u:
+                    return dict(u)
+            # extension_devices
+            row = conn.execute(
+                "SELECT user_id FROM extension_devices WHERE token_hash=? AND revoked=0", (th,)
+            ).fetchone()
+            if row:
+                u = conn.execute("SELECT id, login, full_name, email, is_admin FROM users WHERE id=?", (row["user_id"],)).fetchone()
+                if u:
+                    return dict(u)
+            # legacy user_tokens
+            row = conn.execute("SELECT gitea_user_id FROM user_tokens WHERE gitea_token=?", (token,)).fetchone()
+            if row:
+                u = conn.execute("SELECT id, login, full_name, email, is_admin FROM users WHERE id=?", (row["gitea_user_id"],)).fetchone()
+                if u:
+                    return dict(u)
+    return None
+
+
+def _require_user(request: Request) -> dict:
+    user = _user_from_request(request)
+    if not user:
+        raise HTTPException(status_code=401, detail="Authentication required")
+    return user
+
+
+# ── API: status ──
+
+@api_router.get("/status")
+def clipper_status(request: Request):
+    user = _user_from_request(request)
+    if not user:
+        return {"authenticated": False}
+    with get_conn() as conn:
+        dev_cnt = conn.execute("SELECT COUNT(*) FROM extension_devices WHERE user_id=? AND revoked=0", (user["id"],)).fetchone()[0]
+        clip_cnt = conn.execute("SELECT COUNT(*) FROM extension_clips WHERE user_id=?", (user["id"],)).fetchone()[0]
+    return {"authenticated": True, "user": {"id": user["id"], "login": user.get("login")}, "devices": dev_cnt, "clips": clip_cnt}
+
+
+# ── API: auth verify / device registration ──
+
+@api_router.post("/auth/verify")
+def auth_verify(request: Request, body: dict = Body(default={})):
+    user = _require_user(request)
+    device_id = (body.get("device_id") or request.headers.get("x-device-id") or "").strip()
+    device_name = (body.get("device_name") or body.get("deviceName") or "").strip()[:200]
+    extension_name = (body.get("extension_name") or body.get("extensionName") or "chrome").strip()[:20].lower()
+    if not device_id:
+        raise HTTPException(status_code=400, detail="device_id required")
+    if len(device_id) > 128:
+        raise HTTPException(status_code=400, detail="device_id too long")
+    try:
+        res = register_device(user["id"], device_id, device_name, extension_name)
+    except ValueError as e:
+        raise HTTPException(status_code=400, detail=str(e)) from None
+    if res["existing"]:
+        return {"status": "ok", "device_id": device_id, "existing": True, "message": "Device already registered"}
+    return {"status": "ok", "device_id": device_id, "token": res["token"], "note": "Copy token now — shown once. Use as Authorization: Bearer <token>"}
+
+
+@api_router.post("/clip")
+def clip_page(request: Request, body: dict = Body(...)):
+    user = _require_user(request)
+    # Enforce max body size early (10 MB)
+    clen = request.headers.get("content-length")
+    if clen:
+        try:
+            if int(clen) > MAX_CLIP_BYTES + 1024:
+                raise HTTPException(status_code=413, detail="Clip too large (max 10 MB)")
+        except ValueError:
+            pass
+
+    # Device identification for rate limiting and logging
+    device_id = (body.get("device_id") or request.headers.get("x-device-id") or "web").strip()[:128] or "web"
+    # Rate limit 50/hour per device
+    if not _check_rate_limit(f"{user['id']}:{device_id}"):
+        raise HTTPException(status_code=429, detail="Rate limit: max 50 clips/hour per device")
+
+    url = (body.get("url") or body.get("source_url") or "").strip()
+    title = (body.get("title") or "").strip()
+    content = body.get("content") or body.get("html") or ""
+    clip_type = (body.get("content_type") or body.get("clip_type") or "article").strip().lower()
+    if clip_type not in ("article", "selection", "bookmark", "screenshot"):
+        clip_type = "article"
+
+    if not url and not title and not content:
+        raise HTTPException(status_code=400, detail="url, title or content required")
+
+    # Validate url if present
+    if url:
+        if not (url.startswith("http://") or url.startswith("https://")):
+            # allow bare domain? reject javascript:
+            if url.lower().startswith("javascript:") or url.lower().startswith("data:"):
+                raise HTTPException(status_code=400, detail="Invalid URL")
+
+    # Cap content bytes
+    if content and len(content.encode("utf-8")) > MAX_CLIP_BYTES:
+        raise HTTPException(status_code=413, detail="Content too large (max 10 MB)")
+
+    # Sanitize HTML content if present
+    if content and "<" in content:
+        # sanitize but keep structure for blocks converter
+        content = sanitize_html(content)[: MAX_CLIP_BYTES]
+
+    # Prepare payload for service
+    _img_b64 = body.get("image_base64") or body.get("screenshot") or ""
+    if not _img_b64 and body.get("images"):
+        try:
+            _imgs = body.get("images")
+            if isinstance(_imgs, list) and _imgs:
+                _img_b64 = _imgs[0].get("base64") or _imgs[0].get("src") or ""
+        except Exception:
+            logger.exception("clip_page")
+    clip_data = {
+        "url": url,
+        "title": title[:200],
+        "content": content,
+        "content_type": clip_type,
+        "selection_html": body.get("selection_html") or body.get("selection") or "",
+        "image_base64": _img_b64,
+        "tags": body.get("tags") or [],
+        "target_workspace_id": body.get("target_workspace_id") or body.get("workspace_id"),
+        "target_page_id": body.get("target_page_id") or body.get("parent_page_id"),
+        "metadata": body.get("metadata") or {},
+    }
+
+    try:
+        result = create_page_from_clip(clip_data, user["id"])
+    except Exception as e:
+        logger.exception("clip creation failed: %s", e)
+        raise HTTPException(status_code=500, detail="Failed to create page") from None
+
+    # Log clip
+    try:
+        log_clip(user["id"], device_id, clip_type, url, result["page_id"], result["workspace_id"], result["title"])
+    except Exception:
+        logger.exception("clip_page")
+
+    return {"status": "ok", "page_id": result["page_id"], "title": result["title"], "workspace_id": result["workspace_id"], "url": f"/pages/{result['page_id']}"}
+
+
+@api_router.get("/devices")
+def list_extension_devices(request: Request):
+    user = _require_user(request)
+    devices = list_devices(user["id"])
+    return {"devices": devices}
+
+
+@api_router.delete("/devices/{device_id}")
+def revoke_extension_device(device_id: int, request: Request):
+    user = _require_user(request)
+    ok = revoke_device(user["id"], device_id)
+    if not ok:
+        raise HTTPException(status_code=404, detail="Device not found")
+    return {"status": "revoked"}
+
+
+# ── HTML: /extensions download page ──
+
+@router.get("/extensions", response_class=HTMLResponse)
+def extensions_page(request: Request):
+    from app.routers.dashboard import _sidebar_data
+    from app.templating import ENV
+
+    env = ENV
+    try:
+        sidebar = _sidebar_data(request, [])
+    except Exception:
+        sidebar = {}
+    # Simple standalone page reusing base.html
+    block_tpl = env.from_string(
+        '{% extends "base.html" %}{% block content %}{{ content_html|safe }}{% endblock %}'
+    )
+    user = _user_from_request(request)
+    # Count for auth user
+    devices = []
+    clips = 0
+    if user:
+        try:
+            devices = list_devices(user["id"])
+            clips = sum(d.get("clips_count", 0) for d in devices)
+        except Exception:
+            logger.exception("extensions_page")
+    content_html = f"""
+<style>
+.ext-page{{max-width:900px;margin:0 auto;padding:32px 24px 80px;}}
+.ext-hero{{text-align:center;padding:28px 0 8px;}}
+.ext-hero h1{{font-size:30px;font-weight:800;margin:0 0 6px;}}
+.ext-hero p{{color:var(--text-dim);font-size:14px;max-width:560px;margin:0 auto;line-height:1.6;}}
+.ext-grid{{display:grid;grid-template-columns:repeat(auto-fit,minmax(240px,1fr));gap:14px;margin:28px 0;}}
+.ext-card{{border:1px solid var(--border);border-radius:12px;padding:18px;background:var(--bg-card);}}
+.ext-card h3{{font-size:15px;margin:0 0 6px;display:flex;align-items:center;gap:8px;}}
+.ext-card p{{font-size:12.5px;color:var(--text-dim);line-height:1.5;margin:0 0 10px;}}
+.ext-card a{{font-size:13px;color:var(--accent);text-decoration:none;}}
+.ext-card a:hover{{text-decoration:underline;}}
+.ext-section{{margin:28px 0;}}
+.ext-section h2{{font-size:18px;font-weight:700;margin:0 0 10px;}}
+.ext-steps{{counter-reset:step;list-style:none;padding:0;margin:0;}}
+.ext-steps li{{display:flex;gap:12px;padding:10px 0;border-bottom:1px solid var(--border);font-size:13px;color:var(--text-dim);}}
+.ext-steps li::before{{counter-increment:step;content:counter(step);flex:0 0 26px;height:26px;display:flex;align-items:center;justify-content:center;background:var(--accent);color:#fff;border-radius:50%;font-size:12px;font-weight:600;}}
+.ext-dev-list{{margin-top:12px;}}
+.ext-dev-item{{display:flex;align-items:center;justify-content:space-between;padding:10px 12px;border:1px solid var(--border);border-radius:8px;margin-bottom:6px;background:var(--bg-tertiary);}}
+.ext-badge{{font-size:10px;padding:2px 8px;border-radius:99px;background:rgba(46,160,67,.14);color:#2ea043;font-weight:600;}}
+</style>
+<div class="ext-page">
+  <div class="ext-hero">
+    <h1>🧩 FlowDeck Web Clipper</h1>
+    <p>Capture any web page — article, selection, bookmark or screenshot — directly into FlowDeck. Install the browser extension, connect it once, then clip in one click.</p>
+  </div>
+  <div class="ext-grid">
+    <div class="ext-card">
+      <h3>🟢 Chrome / Edge</h3>
+      <p>Manifest V3 — Chrome 88+, Edge 88+.</p>
+      <a href="/static/extension/flowdeck-clipper.zip" download>Download .zip</a> · <span style="font-size:11px;color:var(--text-dim);">load unpacked in chrome://extensions</span>
+    </div>
+    <div class="ext-card">
+      <h3>🟠 Firefox</h3>
+      <p>Firefox 109+ (Manifest V2 compat).</p>
+      <a href="/static/extension/flowdeck-clipper.zip" download>Download .zip</a> · <span style="font-size:11px;color:var(--text-dim);">load temporary add-on</span>
+    </div>
+    <div class="ext-card">
+      <h3>⌨️ Sans extension</h3>
+      <p>API directe — <code>POST /api/v2/web-clipper/clip</code> avec Bearer token.</p>
+      <a href="/help">Docs /help</a>
+    </div>
+  </div>
+  <div class="ext-section">
+    <h2>How it works</h2>
+    <ol class="ext-steps">
+      <li>Install the extension (.zip) → enable in your browser.</li>
+      <li>Open FlowDeck, go to <b>Settings → Extensions</b> and copy a Bearer token (or the clipper verifies via your session cookie).</li>
+      <li>On any web page, click <b>📌 Clip to FlowDeck</b> (floating button, right-click selection, or extension popup).</li>
+      <li>Choose type: Article (full), Selection, Bookmark or Screenshot — the page is created instantly in your workspace.</li>
+    </ol>
+  </div>
+  <div class="ext-section">
+    <h2>Captures on this account</h2>
+    <p style="font-size:12px;color:var(--text-dim);">{len(devices)} device(s) · {clips} clip(s) total</p>
+    <div class="ext-dev-list">
+      {"".join(f'<div class="ext-dev-item"><span><b>{d.get("device_name") or d.get("extension_name")}</b> <code style="font-size:11px;color:var(--text-dim);">{d.get("device_id")[:24]}</code></span><span><span class="ext-badge">{d.get("clips_count",0)} clips</span> <span style="font-size:11px;color:var(--text-dim);">{d.get("last_clip_at") or ""}</span></span></div>' for d in devices[:10]) or '<p style="font-size:13px;color:var(--text-dim);">No devices yet — clip your first page from the extension to appear here.</p>'}
+    </div>
+    <p style="margin-top:10px;"><a href="/accounts/settings" style="font-size:13px;color:var(--accent);">Manage in Settings → Extensions</a></p>
+  </div>
+</div>
+"""
+    return HTMLResponse(block_tpl.render(**sidebar, request=request, page_title="Extensions", title_prefix="Extensions", page_icon="🧩", content_html=content_html))

app/routers/webauthn.py

@@ -0,0 +1,214 @@
+"""FlowDeck — Passkeys / WebAuthn (v7.2.0).
+
+Registration + passwordless login via the ``webauthn`` package (pinned in
+requirements). Challenges live in a short-lived in-memory store (5 min,
+single-process — same tradeoff as the SSE rooms). RP ID is derived from the
+request host. See ``docs/V72_Enterprise_SCIM_2FA.md``.
+"""
+from __future__ import annotations
+
+import secrets
+import time
+
+from fastapi import APIRouter, Body, HTTPException, Request
+from fastapi.responses import JSONResponse
+
+from app.auth.session import SessionManager
+from app.db import get_conn
+
+router = APIRouter(tags=["webauthn"], prefix="/auth/webauthn")
+
+# key -> (challenge bytes, expires_at). key = f"reg:{user_id}" | f"login:{login}".
+_challenges: dict[str, tuple[bytes, float]] = {}
+_CHALLENGE_TTL = 300.0
+
+
+def _require_lib():
+    try:
+        import webauthn  # noqa: F401
+        return True
+    except ImportError:
+        return False
+
+
+def _store_challenge(key: str, challenge: bytes) -> None:
+    _challenges[key] = (challenge, time.time() + _CHALLENGE_TTL)
+
+
+def _take_challenge(key: str) -> bytes | None:
+    item = _challenges.pop(key, None)
+    if not item:
+        return None
+    challenge, exp = item
+    return challenge if exp > time.time() else None
+
+
+def _rp(request: Request) -> tuple[str, str]:
+    host = (request.url.hostname or "localhost").split(":")[0]
+    return host, f"{request.url.scheme}://{request.headers.get('host', host)}"
+
+
+def _session_user(request: Request) -> dict:
+    user = SessionManager.decode_session(request.cookies.get("flowdeck_session", ""))
+    if not user or not user.get("id"):
+        raise HTTPException(401, "Authentication required")
+    return user
+
+
+@router.post("/register/begin")
+def register_begin(request: Request):
+    if not _require_lib():
+        raise HTTPException(501, "WebAuthn library not installed")
+    from webauthn import generate_registration_options, options_to_json
+    user = _session_user(request)
+    rp_id, _origin = _rp(request)
+    with get_conn() as conn:
+        existing = conn.execute("SELECT credential_id FROM webauthn_credentials WHERE user_id=?",
+                                (user["id"],)).fetchall()
+    from webauthn.helpers.structs import PublicKeyCredentialDescriptor
+    exclude = [PublicKeyCredentialDescriptor(id=_b64url_to_bytes(r["credential_id"]))
+               for r in existing]
+    options = generate_registration_options(
+        rp_id=rp_id, rp_name="FlowDeck", user_name=user.get("login", f"user{user['id']}"),
+        user_id=str(user["id"]).encode(), exclude_credentials=exclude or None)
+    _store_challenge(f"reg:{user['id']}", options.challenge)
+    return JSONResponse(content=__import__("json").loads(options_to_json(options)))
+
+
+@router.post("/register/finish")
+def register_finish(request: Request, body: dict = Body(default={})):
+    if not _require_lib():
+        raise HTTPException(501, "WebAuthn library not installed")
+    from webauthn import verify_registration_response
+    user = _session_user(request)
+    challenge = _take_challenge(f"reg:{user['id']}")
+    if not challenge:
+        raise HTTPException(400, "Challenge expired — begin again")
+    rp_id, origin = _rp(request)
+    try:
+        verified = verify_registration_response(
+            credential=body.get("credential") or {},
+            expected_challenge=challenge, expected_rp_id=rp_id, expected_origin=origin,
+            require_user_verification=False)
+    except Exception as exc:  # noqa: BLE001 — invalid attestation → 400, never 500
+        raise HTTPException(400, f"Registration rejected: {exc}") from None
+    import base64
+    cred_id = base64.urlsafe_b64encode(verified.credential_id).decode().rstrip("=")
+    pubkey = base64.b64encode(bytes(verified.credential_public_key)).decode()
+    with get_conn() as conn:
+        try:
+            cur = conn.execute(
+                """INSERT INTO webauthn_credentials
+                   (user_id, credential_id, public_key, sign_count, name)
+                   VALUES (?,?,?,?,?)""",
+                (user["id"], cred_id, pubkey, verified.sign_count,
+                 str(body.get("name") or "Passkey")[:80]))
+            conn.commit()
+        except Exception:
+            raise HTTPException(409, "Credential already registered") from None
+        kid = cur.lastrowid
+    return {"id": kid, "status": "registered"}
+
+
+@router.post("/login/begin")
+def login_begin(request: Request, body: dict = Body(default={})):
+    if not _require_lib():
+        raise HTTPException(501, "WebAuthn library not installed")
+    from webauthn import generate_authentication_options, options_to_json
+    login = (body.get("login") or "").strip()
+    if not login:
+        raise HTTPException(400, "login required")
+    with get_conn() as conn:
+        user = conn.execute("SELECT * FROM users WHERE login=?", (login,)).fetchone()
+        if not user or not user["is_active"]:
+            raise HTTPException(401, "Invalid credentials")
+        creds = conn.execute("SELECT credential_id FROM webauthn_credentials WHERE user_id=?",
+                             (user["id"],)).fetchall()
+    if not creds:
+        raise HTTPException(400, "No passkeys for this account")
+    rp_id, _origin = _rp(request)
+    from webauthn.helpers.structs import PublicKeyCredentialDescriptor
+    allow = [PublicKeyCredentialDescriptor(id=_b64url_to_bytes(r["credential_id"]))
+             for r in creds]
+    options = generate_authentication_options(rp_id=rp_id, allow_credentials=allow)
+    _store_challenge(f"login:{login}", options.challenge)
+    return JSONResponse(content=__import__("json").loads(options_to_json(options)))
+
+
+@router.post("/login/finish")
+def login_finish(request: Request, body: dict = Body(default={})):
+    if not _require_lib():
+        raise HTTPException(501, "WebAuthn library not installed")
+    from webauthn import verify_authentication_response
+    login = (body.get("login") or "").strip()
+    challenge = _take_challenge(f"login:{login}")
+    if not login or not challenge:
+        raise HTTPException(400, "Challenge expired — begin again")
+    with get_conn() as conn:
+        user = conn.execute("SELECT * FROM users WHERE login=?", (login,)).fetchone()
+        if not user or not user["is_active"]:
+            raise HTTPException(401, "Invalid credentials")
+        stored = conn.execute("SELECT * FROM webauthn_credentials WHERE user_id=?",
+                              (user["id"],)).fetchall()
+    rp_id, origin = _rp(request)
+    credential = body.get("credential") or {}
+    cred_id = (credential.get("id") or "").rstrip("=")
+    match = next((dict(r) for r in stored if r["credential_id"].rstrip("=") == cred_id), None)
+    if not match:
+        raise HTTPException(401, "Unknown credential")
+    import base64
+    try:
+        verified = verify_authentication_response(
+            credential=credential, expected_challenge=challenge,
+            expected_origin=origin, expected_rp_id=rp_id,
+            credential_public_key=base64.b64decode(match["public_key"]),
+            credential_current_sign_count=match["sign_count"],
+            require_user_verification=False)
+    except Exception as exc:  # noqa: BLE001
+        raise HTTPException(401, f"Authentication rejected: {exc}") from None
+    with get_conn() as conn:
+        conn.execute("UPDATE webauthn_credentials SET sign_count=? WHERE id=?",
+                     (verified.new_sign_count, match["id"]))
+        conn.execute("UPDATE users SET last_login=? WHERE id=?",
+                     (str(time.time()), user["id"]))
+        conn.commit()
+        ud = dict(conn.execute("SELECT * FROM users WHERE id=?", (user["id"],)).fetchone())
+    session = SessionManager.create_session(ud, request)
+    response = JSONResponse({"status": "ok", "user": {"login": ud["login"]}})
+    response.set_cookie("flowdeck_session", session, httponly=True,
+                        max_age=86400 * 7, samesite="lax", path="/")
+    return response
+
+
+@router.get("/keys")
+def list_keys(request: Request):
+    user = _session_user(request)
+    with get_conn() as conn:
+        rows = conn.execute("SELECT id, name, sign_count, created_at FROM webauthn_credentials"
+                            " WHERE user_id=? ORDER BY id", (user["id"],)).fetchall()
+    return {"keys": [dict(r) for r in rows]}
+
+
+@router.delete("/keys/{key_id}")
+def delete_key(key_id: int, request: Request):
+    user = _session_user(request)
+    with get_conn() as conn:
+        cur = conn.execute("DELETE FROM webauthn_credentials WHERE id=? AND user_id=?",
+                           (key_id, user["id"]))
+        conn.commit()
+        if not cur.rowcount:
+            raise HTTPException(404, "Key not found")
+    return {"status": "deleted", "id": key_id}
+
+
+def _b64url_to_bytes(data: str) -> bytes:
+    import base64
+    padded = data + "=" * (-len(data) % 4)
+    return base64.urlsafe_b64decode(padded)
+
+
+def reset_challenges() -> None:
+    _challenges.clear()
+
+
+__all__ = ["router", "reset_challenges", "secrets"]

app/routers/webhooks.py

@@ -1,12 +1,12 @@
 """FlowDeck — Webhook receiver for real-time Gitea sync."""
 from __future__ import annotations
 
-import json
-import hmac
 import hashlib
+import hmac
+import json
 import logging
 
-from fastapi import APIRouter, Request, HTTPException
+from fastapi import APIRouter, HTTPException, Request
 
 from app.config import settings
 from app.db import get_conn
@@ -162,7 +162,7 @@ async def register_webhook(owner: str, repo: str, request: Request):
         return {"status": "ok", "webhook": result}
     except Exception as e:
         logger.error("Failed to register webhook: %s", e)
-        raise HTTPException(status_code=500, detail=str(e))
+        raise HTTPException(status_code=500, detail=str(e)) from e
 
 
 @router.get("/status/{owner}/{repo}")

app/routers/wiki.py

@@ -0,0 +1,513 @@
+"""FlowDeck — teamspaces, verified pages, wiki home, collab polish (v7.3.0).
+
+Routes under ``/api/v2/wiki`` plus the guest entry point ``/g/{token}``.
+Design : ``docs/V73_Wiki_Teamspaces_Polish.md``.
+"""
+from __future__ import annotations
+
+import html
+
+from fastapi import APIRouter, Body, HTTPException, Request
+from fastapi.responses import HTMLResponse, JSONResponse
+
+from app.auth.session import SessionManager
+from app.db import get_conn
+from app.services import wiki
+from app.services.api_v2_helpers import audit_log
+from app.services.notifications import create_notification
+from app.templating import ENV
+
+router = APIRouter(tags=["wiki"])
+
+
+def _esc(value) -> str:
+    return html.escape(str(value))
+
+
+def _user(request: Request) -> dict:
+    sess = SessionManager.decode_session(request.cookies.get("flowdeck_session", ""))
+    if not sess or not sess.get("id"):
+        raise HTTPException(401, "Authentication required")
+    with get_conn() as conn:
+        row = conn.execute("SELECT is_admin, is_active FROM users WHERE id=?",
+                           (sess["id"],)).fetchone()
+    if not row or not row["is_active"]:
+        raise HTTPException(403, "Account disabled")
+    return sess
+
+
+def _workspace_id(request: Request) -> int:
+    wid = request.query_params.get("workspace_id")
+    if not wid:
+        raise HTTPException(400, "workspace_id required")
+    try:
+        wid = int(wid)
+    except (TypeError, ValueError):
+        raise HTTPException(400, "invalid workspace_id") from None
+    with get_conn() as conn:
+        if not conn.execute("SELECT 1 FROM workspaces WHERE id=?", (wid,)).fetchone():
+            raise HTTPException(404, "Workspace not found")
+    return wid
+
+
+def _teamspace_or_404(teamspace_id: int, user_id: int) -> dict:
+    with get_conn() as conn:
+        row = conn.execute("SELECT * FROM teamspaces WHERE id=?", (teamspace_id,)).fetchone()
+    if not row:
+        raise HTTPException(404, "Teamspace not found")
+    if not wiki.can_read_teamspace(user_id, teamspace_id):
+        # private teamspace → 404 (not 403), same as restricted collections
+        raise HTTPException(404, "Teamspace not found")
+    return dict(row)
+
+
+def _page_or_404(page_id: int) -> dict:
+    with get_conn() as conn:
+        row = conn.execute(
+            "SELECT id, title, workspace_id, teamspace_id, deleted_at FROM pages WHERE id=?",
+            (page_id,)).fetchone()
+    if not row or row["deleted_at"]:
+        raise HTTPException(404, "Page not found")
+    return dict(row)
+
+
+def _is_admin(user: dict) -> bool:
+    with get_conn() as conn:
+        row = conn.execute("SELECT is_admin FROM users WHERE id=?", (user["id"],)).fetchone()
+    return bool(row and row["is_admin"])
+
+
+def _can_verify(user: dict, page: dict) -> bool:
+    """Admin, or an editor/owner of the teamspace / workspace holding the page."""
+    if _is_admin(user):
+        return True
+    if page.get("teamspace_id"):
+        return wiki.can_write_teamspace(user["id"], page["teamspace_id"])
+    wid = page.get("workspace_id")
+    if not wid:
+        return False
+    with get_conn() as conn:
+        owner = conn.execute("SELECT owner_id FROM workspaces WHERE id=?", (wid,)).fetchone()
+        if owner and owner["owner_id"] == user["id"]:
+            return True
+        member = conn.execute("SELECT role FROM workspace_members WHERE workspace_id=? AND user_id=?",
+                              (wid, user["id"])).fetchone()
+    return bool(member and member["role"] in ("owner", "admin", "editor"))
+
+
+# ── teamspaces ─────────────────────────────────────────────────────────────
+
+@router.get("/api/v2/wiki/teamspaces")
+def list_teamspaces(request: Request):
+    user = _user(request)
+    wid = request.query_params.get("workspace_id")
+    if wid:
+        try:
+            wid = int(wid)
+        except (TypeError, ValueError):
+            raise HTTPException(400, "invalid workspace_id") from None
+    else:
+        wid = None
+    return {"teamspaces": wiki.list_teamspaces(user["id"], wid)}
+
+
+@router.get("/wiki/teamspaces/{teamspace_id}", response_class=HTMLResponse)
+def teamspace_page(teamspace_id: int, request: Request):
+    """Teamspace detail HTML page — sidebar entry point."""
+    user = _user(request)
+    ts = _teamspace_or_404(teamspace_id, user["id"])
+    ts["role"] = wiki.get_teamspace_role(user["id"], teamspace_id)
+    with get_conn() as conn:
+        ws = conn.execute("SELECT name FROM workspaces WHERE id=?",
+                          (ts["workspace_id"],)).fetchone()
+    pages = wiki.teamspace_pages(teamspace_id)
+    collections = wiki.teamspace_collections(teamspace_id)
+    page_rows = "\n".join(
+        f'<a class="ts-row" href="/pages/{p["id"]}" style="display:flex;align-items:center;gap:8px;'
+        f'padding:8px 10px;border-radius:6px;color:inherit;text-decoration:none;">'
+        f'<span>📄</span><span>{_esc(p["title"] or "Untitled")}</span></a>'
+        for p in pages)
+    coll_rows = "\n".join(
+        f'<a class="ts-row" href="/db/{c["id"]}" style="display:flex;align-items:center;gap:8px;'
+        f'padding:8px 10px;border-radius:6px;color:inherit;text-decoration:none;">'
+        f'<span>{_esc(c["icon"] or "🗄️")}</span><span>{_esc(c["name"] or "Untitled")}</span></a>'
+        for c in collections)
+    content_html = f"""
+<div style="max-width:860px;margin:0 auto;padding:40px 24px;">
+  <h1 style="font-size:26px;display:flex;align-items:center;gap:10px;">
+    {_esc(ts['name'])}{' <span style="font-size:13px;padding:2px 8px;border-radius:10px;background:rgba(76,154,255,.15);color:#4c9aff;">🔒 private</span>' if ts['private'] else ''}
+  </h1>
+  <p style="color:var(--text-dim);">{_esc(ts.get('description') or '')}</p>
+  <div style="display:flex;gap:10px;font-size:12px;color:var(--text-dim);margin-bottom:24px;flex-wrap:wrap;">
+    <span>Workspace: {_esc((ws["name"]) if ws else '')}</span>
+    <span>·</span><span>Role: {_esc(ts['role'])}</span>
+    <span>·</span><span>{len(pages) + len(collections)} items</span>
+  </div>
+  <h2 style="font-size:16px;margin:20px 0 8px;">Pages</h2>
+  <div style="display:flex;flex-direction:column;gap:4px;">
+    {page_rows or '<p style="color:var(--text-dim);font-size:13px;">No pages yet.</p>'}
+  </div>
+  <h2 style="font-size:16px;margin:24px 0 8px;">Databases</h2>
+  <div style="display:flex;flex-direction:column;gap:4px;">
+    {coll_rows or '<p style="color:var(--text-dim);font-size:13px;">No databases yet.</p>'}
+  </div>
+</div>
+<style>
+.ts-row:hover{{background:var(--bg-hover);}}
+</style>"""
+    from app.routers.dashboard import _sidebar_data
+    env = ENV
+    sidebar = _sidebar_data(request, [])
+    block_tpl = env.from_string(
+        '{% extends "base.html" %}{% block content %}{{ content_html|safe }}{% endblock %}'
+    )
+    return block_tpl.render(
+        **sidebar,
+        request=request,
+        content_html=content_html,
+        page_title=ts["name"],
+        title_prefix="Teamspace",
+        page_icon="🏛️",
+    )
+
+
+@router.post("/api/v2/wiki/teamspaces")
+def create_teamspace(request: Request, body: dict = Body(default={})):
+    user = _user(request)
+    name = (body.get("name") or "").strip()
+    if not name or len(name) > 120:
+        raise HTTPException(400, "name required (max 120 chars)")
+    wid = int(body.get("workspace_id") or 0)
+    with get_conn() as conn:
+        ws = conn.execute("SELECT owner_id FROM workspaces WHERE id=?", (wid,)).fetchone()
+        if not ws:
+            raise HTTPException(404, "Workspace not found")
+        admin = conn.execute("SELECT is_admin FROM users WHERE id=?", (user["id"],)).fetchone()
+        member = conn.execute("SELECT role FROM workspace_members WHERE workspace_id=? AND user_id=?",
+                              (wid, user["id"])).fetchone()
+        allowed = (ws["owner_id"] == user["id"] or (admin and admin["is_admin"])
+                   or (member and member["role"] in ("admin", "editor", "owner")))
+    if not allowed:
+        raise HTTPException(403, "Editor role required in the workspace")
+    try:
+        tsid = wiki.create_teamspace(wid, name, user["id"],
+                                     description=body.get("description") or "",
+                                     private=bool(body.get("private")))
+    except ValueError as exc:
+        raise HTTPException(409, str(exc)) from None
+    audit_log(user, "teamspace.create", "teamspace", tsid, name, request)
+    return JSONResponse(status_code=201, content={"id": tsid, "name": name})
+
+
+@router.get("/api/v2/wiki/teamspaces/{teamspace_id}")
+def get_teamspace(teamspace_id: int, request: Request):
+    user = _user(request)
+    ts = _teamspace_or_404(teamspace_id, user["id"])
+    ts["role"] = wiki.get_teamspace_role(user["id"], teamspace_id)
+    ts["member_count"] = len(wiki.teamspace_member_ids(teamspace_id))
+    return ts
+
+
+@router.get("/api/v2/wiki/teamspaces/{teamspace_id}/members")
+def list_members(teamspace_id: int, request: Request):
+    user = _user(request)
+    _teamspace_or_404(teamspace_id, user["id"])
+    with get_conn() as conn:
+        rows = conn.execute(
+            """SELECT m.user_id, m.role, u.login, u.full_name FROM teamspace_members m
+               JOIN users u ON u.id = m.user_id WHERE m.teamspace_id=? ORDER BY u.login""",
+            (teamspace_id,)).fetchall()
+    return {"members": [dict(r) for r in rows]}
+
+
+@router.put("/api/v2/wiki/teamspaces/{teamspace_id}/members/{member_id}")
+def set_member(teamspace_id: int, member_id: int, request: Request, body: dict = Body(default={})):
+    user = _user(request)
+    _teamspace_or_404(teamspace_id, user["id"])
+    if not wiki.can_write_teamspace(user["id"], teamspace_id):
+        raise HTTPException(403, "Editor role required")
+    role = body.get("role")
+    if role not in wiki.TEAMSPACE_ROLES:
+        raise HTTPException(400, f"role must be one of {', '.join(wiki.TEAMSPACE_ROLES)}")
+    with get_conn() as conn:
+        if not conn.execute("SELECT 1 FROM users WHERE id=?", (member_id,)).fetchone():
+            raise HTTPException(404, "User not found")
+        conn.execute(
+            """INSERT INTO teamspace_members (teamspace_id, user_id, role) VALUES (?,?,?)
+               ON CONFLICT(teamspace_id, user_id) DO UPDATE SET role=excluded.role""",
+            (teamspace_id, member_id, role))
+        conn.commit()
+    audit_log(user, "teamspace.member.set", "teamspace", teamspace_id,
+              f"u{member_id}={role}", request)
+    return {"status": "ok", "user_id": member_id, "role": role}
+
+
+@router.delete("/api/v2/wiki/teamspaces/{teamspace_id}/members/{member_id}")
+def remove_member(teamspace_id: int, member_id: int, request: Request):
+    user = _user(request)
+    _teamspace_or_404(teamspace_id, user["id"])
+    if not wiki.can_write_teamspace(user["id"], teamspace_id):
+        raise HTTPException(403, "Editor role required")
+    with get_conn() as conn:
+        cur = conn.execute("DELETE FROM teamspace_members WHERE teamspace_id=? AND user_id=?",
+                           (teamspace_id, member_id))
+        conn.commit()
+        if not cur.rowcount:
+            raise HTTPException(404, "Not a member")
+    return {"status": "removed", "user_id": member_id}
+
+
+# ── verified pages ─────────────────────────────────────────────────────────
+
+@router.get("/api/v2/wiki/pages/{page_id}/verification")
+def get_verification(page_id: int, request: Request):
+    _user(request)
+    _page_or_404(page_id)
+    return {"verification": wiki.verification(page_id)}
+
+
+@router.post("/api/v2/wiki/pages/{page_id}/verify")
+def verify_page(page_id: int, request: Request, body: dict = Body(default={})):
+    user = _user(request)
+    page = _page_or_404(page_id)
+    if not _can_verify(user, page):
+        raise HTTPException(403, "Editor role required to verify a page")
+    out = wiki.verify_page(page_id, user["id"],
+                           days=body.get("days") or wiki.VERIFICATION_DAYS_DEFAULT,
+                           note=body.get("note") or "")
+    audit_log(user, "page.verify", "page", page_id, out.get("expires_at") or "", request)
+    return {"verification": out}
+
+
+@router.delete("/api/v2/wiki/pages/{page_id}/verify")
+def unverify_page(page_id: int, request: Request):
+    user = _user(request)
+    _page_or_404(page_id)
+    if not wiki.unverify_page(page_id):
+        raise HTTPException(404, "Page is not verified")
+    audit_log(user, "page.unverify", "page", page_id, "", request)
+    return {"status": "unverified", "page_id": page_id}
+
+
+@router.get("/api/v2/wiki/verified")
+def list_verified(request: Request):
+    """Verified (non-expired) pages of a workspace — the ✅ wiki index."""
+    user = _user(request)
+    wid = _workspace_id(request)
+    with get_conn() as conn:
+        rows = conn.execute(
+            """SELECT p.id, p.title, p.page_icon, p.teamspace_id,
+                      v.verified_at, v.expires_at, v.note, u.login
+               FROM page_verifications v
+               JOIN pages p ON p.id = v.page_id
+               LEFT JOIN users u ON u.id = v.verified_by
+               WHERE p.workspace_id=? AND p.deleted_at IS NULL""",
+            (wid,)).fetchall()
+    out = []
+    for r in rows:
+        item = dict(r)
+        if wiki.is_expired(r):
+            continue  # badge lapsed → not listed
+        if item["teamspace_id"] and not wiki.can_read_teamspace(user["id"],
+                                                                item["teamspace_id"]):
+            continue  # private teamspace → hidden
+        item["active"] = True
+        out.append(item)
+    return {"pages": out}
+
+
+# ── follows ────────────────────────────────────────────────────────────────
+
+@router.post("/api/v2/wiki/pages/{page_id}/follow")
+def follow_page(page_id: int, request: Request):
+    user = _user(request)
+    _page_or_404(page_id)
+    now = wiki.toggle_follow(page_id, user["id"])
+    return {"page_id": page_id, "following": now}
+
+
+@router.get("/api/v2/wiki/pages/{page_id}/followers")
+def list_followers(page_id: int, request: Request):
+    _user(request)
+    _page_or_404(page_id)
+    ids = wiki.followers(page_id)
+    if not ids:
+        return {"followers": []}
+    with get_conn() as conn:
+        rows = conn.execute(
+            f"SELECT id, login, full_name FROM users WHERE id IN ({','.join('?' * len(ids))})",
+            ids).fetchall()
+    return {"followers": [dict(r) for r in rows]}
+
+
+# ── comment reactions ──────────────────────────────────────────────────────
+
+@router.post("/api/v2/wiki/comments/{comment_id}/reactions")
+def react(comment_id: int, request: Request, body: dict = Body(default={})):
+    user = _user(request)
+    emoji = (body.get("emoji") or "").strip()
+    if not emoji:
+        raise HTTPException(400, "emoji required")
+    try:
+        counts = wiki.toggle_reaction(comment_id, user["id"], emoji)
+    except LookupError:
+        raise HTTPException(404, "Comment not found") from None
+    return {"comment_id": comment_id, "reactions": counts}
+
+
+@router.get("/api/v2/wiki/comments/{comment_id}/reactions")
+def list_reactions(comment_id: int, request: Request):
+    _user(request)
+    return {"comment_id": comment_id, "reactions": wiki.reactions(comment_id)}
+
+
+# ── guest shares ───────────────────────────────────────────────────────────
+
+@router.post("/api/v2/wiki/pages/{page_id}/guests")
+def create_guest(page_id: int, request: Request, body: dict = Body(default={})):
+    user = _user(request)
+    page = _page_or_404(page_id)
+    if page.get("teamspace_id") and not wiki.can_write_teamspace(user["id"], page["teamspace_id"]):
+        raise HTTPException(403, "Editor role required to share")
+    try:
+        share = wiki.create_guest_share(page_id, body.get("email") or "",
+                                        body.get("role") or "viewer",
+                                        user["id"], days=body.get("days", 30))
+    except ValueError as exc:
+        raise HTTPException(400, str(exc)) from None
+    audit_log(user, "page.guest_share", "page", page_id, share["email"], request)
+    return JSONResponse(status_code=201, content={
+        "id": share["id"], "token": share["token"], "role": share["role"],
+        "expires_at": share["expires_at"], "url": f"/g/{share['token']}"})
+
+
+@router.get("/api/v2/wiki/pages/{page_id}/guests")
+def list_guests(page_id: int, request: Request):
+    _user(request)
+    _page_or_404(page_id)
+    with get_conn() as conn:
+        rows = conn.execute(
+            "SELECT id, email, role, expires_at, revoked, created_at FROM guest_shares"
+            " WHERE page_id=? ORDER BY id DESC", (page_id,)).fetchall()
+    return {"guests": [dict(r) for r in rows]}
+
+
+@router.delete("/api/v2/wiki/guests/{share_id}")
+def revoke_guest(share_id: int, request: Request):
+    user = _user(request)
+    with get_conn() as conn:
+        if not conn.execute("SELECT 1 FROM guest_shares WHERE id=?", (share_id,)).fetchone():
+            raise HTTPException(404, "Guest share not found")
+        conn.execute("UPDATE guest_shares SET revoked=1 WHERE id=?", (share_id,))
+        conn.commit()
+    audit_log(user, "page.guest_revoke", "guest_share", share_id, "", request)
+    return {"status": "revoked", "id": share_id}
+
+
+_GUEST_404 = """<!DOCTYPE html><html lang="en"><head><meta charset="utf-8">
+<meta name="viewport" content="width=device-width,initial-scale=1">
+<title>Link unavailable — FlowDeck</title>
+<style>body{font-family:-apple-system,Segoe UI,Roboto,sans-serif;max-width:520px;
+margin:80px auto;padding:0 20px;color:#1f2328;text-align:center}
+h1{font-size:20px} p{color:#656d76;line-height:1.6}</style></head><body>
+<h1>This link is unavailable</h1>
+<p>It may have expired, been revoked, or never existed.<br>
+Ask the person who shared it with you for a new link.</p></body></html>"""
+
+
+@router.get("/g/{token}", response_class=HTMLResponse)
+def guest_page(token: str, request: Request):
+    """Account-less page access (read-only or commenter). 404 if inactive."""
+    share = wiki.resolve_guest_share(token)
+    if not share:
+        return HTMLResponse(_GUEST_404, status_code=404)
+    with get_conn() as conn:
+        page = conn.execute("SELECT id, title, content, created_at, updated_at, deleted_at"
+                            " FROM pages WHERE id=?", (share["page_id"],)).fetchone()
+    if not page or page["deleted_at"]:
+        return HTMLResponse(_GUEST_404, status_code=404)
+    wiki.record_view(share["page_id"])
+    return f"""<!DOCTYPE html><html lang="en"><head><meta charset="utf-8">
+<meta name="viewport" content="width=device-width,initial-scale=1">
+<title>{page['title']} — FlowDeck guest</title>
+<style>body{{font-family:-apple-system,Segoe UI,Roboto,sans-serif;max-width:760px;
+margin:40px auto;padding:0 20px;line-height:1.6;color:#1f2328}}
+.guest-banner{{background:#fff4e5;border:1px solid #ffd8a8;padding:10px 14px;
+border-radius:8px;margin-bottom:24px;font-size:14px}}
+pre{{background:#f6f8fa;padding:14px;border-radius:8px;overflow:auto;
+white-space:pre-wrap;word-break:break-word}}</style></head><body>
+<div class="guest-banner">You are viewing this page as a guest
+({share['role']}{' — expires ' + str(share['expires_at']) if share['expires_at'] else ''}).
+Editing is disabled.</div>
+<h1>{page['title']}</h1><pre>{page['content'] or ''}</pre></body></html>"""
+
+
+# ── page views ─────────────────────────────────────────────────────────────
+
+@router.get("/api/v2/wiki/pages/{page_id}/views")
+def page_views(page_id: int, request: Request):
+    user = _user(request)
+    page = _page_or_404(page_id)
+    if page.get("teamspace_id") and not wiki.can_write_teamspace(user["id"], page["teamspace_id"]):
+        raise HTTPException(403, "Editor role required to read analytics")
+    return wiki.view_stats(page_id, days=request.query_params.get("days", 30))
+
+
+# ── wiki home ──────────────────────────────────────────────────────────────
+
+@router.get("/api/v2/wiki/home")
+def wiki_home(request: Request):
+    """Aggregated knowledge home: verified pages + recents + teamspaces."""
+    user = _user(request)
+    wid = _workspace_id(request)
+    with get_conn() as conn:
+        recents = conn.execute(
+            """SELECT id, title, page_icon, updated_at FROM pages
+               WHERE workspace_id=? AND deleted_at IS NULL
+               ORDER BY updated_at DESC LIMIT 20""", (wid,)).fetchall()
+        verified = conn.execute(
+            """SELECT v.page_id, v.verified_at, v.expires_at FROM page_verifications v
+               JOIN pages p ON p.id = v.page_id
+               WHERE p.workspace_id=? AND p.deleted_at IS NULL
+                 AND (v.expires_at IS NULL OR v.expires_at > ?)""",
+            (wid, __import__("datetime").datetime.now(
+                __import__("datetime").timezone.utc).replace(microsecond=0).isoformat()),
+        ).fetchall()
+    return {"workspace_id": wid,
+            "teamspaces": wiki.list_teamspaces(user["id"], wid),
+            "verified": [dict(r) for r in verified],
+            "recents": [dict(r) for r in recents]}
+
+
+@router.post("/api/v2/wiki/verify-expiry-sweep")
+def sweep_expiry(request: Request):
+    """Notify verifiers whose ✅ expires within 7 days (idempotent-ish job)."""
+    user = _user(request)
+    with get_conn() as conn:
+        if not conn.execute("SELECT is_admin FROM users WHERE id=?", (user["id"],)).fetchone()[0]:
+            raise HTTPException(403, "Admin required")
+    sent = 0
+    for row in wiki.expiring_verifications(days=7):
+        create_notification(row["owner_id"], None, "page.verification_expiring",
+                            "Verification expiring soon",
+                            f"“{row['title']}” loses its verified badge on {row['expires_at']}.",
+                            resource_type="page", resource_id=row["page_id"])
+        sent += 1
+    return {"notified": sent}
+
+
+# ── blocks (mermaid / equation_inline / progress) ───────────────────────────
+
+@router.post("/api/v2/wiki/blocks/preview")
+def preview_blocks(request: Request, body: dict = Body(default={})):
+    """Render v7.3 blocks to HTML (same renderer used by the export pipeline)."""
+    _user(request)
+    blocks = body.get("blocks")
+    if not isinstance(blocks, list):
+        raise HTTPException(400, "blocks must be a list")
+    if len(blocks) > 200:
+        raise HTTPException(400, "max 200 blocks per preview")
+    from app.services.wiki_blocks import mmdc_available, render_block
+    out = [{"type": b.get("type"), "html": render_block(b)} for b in blocks
+           if isinstance(b, dict) and b.get("type") in ("mermaid", "equation_inline", "progress")]
+    return {"rendered": out, "mmdc_available": mmdc_available()}

app/routers/workers.py

@@ -0,0 +1,208 @@
+"""FlowDeck — Workers API (v7.0.0): CRUD, manual run, history, fork, usage."""
+from __future__ import annotations
+
+from fastapi import APIRouter, Body, HTTPException, Request
+from fastapi.responses import JSONResponse
+
+from app.auth.session import SessionManager
+from app.db import get_conn
+from app.services import workers as worker_service
+from app.services.api_v2_helpers import (
+    audit_log,
+    has_scope,
+    paginate_headers,
+    parse_pagination,
+    resolve_bearer_token,
+    row_to_dict,
+)
+
+router = APIRouter(tags=["workers"])
+
+
+def _auth_user(request: Request, *, require_write: bool = False) -> dict:
+    sess = SessionManager.decode_session(request.cookies.get("flowdeck_session", ""))
+    if sess:
+        return sess
+    auth = request.headers.get("authorization") or request.headers.get("Authorization") or ""
+    if auth.lower().startswith("bearer "):
+        user = resolve_bearer_token(auth[7:].strip())
+        if not user:
+            raise HTTPException(401, "Invalid or expired API token")
+        if require_write and not has_scope(user.get("_token_scopes") or "read", "write"):
+            raise HTTPException(403, "Insufficient scope. Required: write")
+        return user
+    raise HTTPException(401, "Authentication required")
+
+
+def _row_to_api(row) -> dict:
+    d = row_to_dict(row)
+    d.pop("code_py", None)  # code only via ?include_code=1 or owner fetch
+    return d
+
+
+@router.post("/api/v2/workers")
+def create_worker(request: Request, body: dict = Body(default={})):
+    user = _auth_user(request, require_write=True)
+    name = (body.get("name") or "Untitled worker").strip()[:200]
+    code = body.get("code_py") or ""
+    try:
+        worker_service.validate_code(code)
+    except worker_service.WorkerRejected as exc:
+        raise HTTPException(400, f"code rejected: {exc}") from None
+    slug = worker_service.unique_slug(body.get("slug") or name)
+    with get_conn() as conn:
+        cur = conn.execute(
+            """INSERT INTO workers (slug, workspace_id, name, code_py, schedule_cron,
+                                    shared, daily_budget_s, created_by)
+               VALUES (?,?,?,?,?,?,?,?)""",
+            (slug, body.get("workspace_id"), name, code,
+             (body.get("schedule_cron") or "")[:60],
+             1 if body.get("shared") else 0,
+             max(1, min(int(body.get("daily_budget_s") or 60), 3600)),
+             user["id"]))
+        conn.commit()
+        wid = cur.lastrowid
+        row = conn.execute("SELECT * FROM workers WHERE id=?", (wid,)).fetchone()
+    audit_log(user, "worker.create", "worker", wid, slug, request)
+    return JSONResponse(status_code=201, content={**_row_to_api(row), "code_py": code})
+
+
+@router.get("/api/v2/workers")
+def list_workers(request: Request):
+    _auth_user(request)
+    limit, offset = parse_pagination(request)
+    with get_conn() as conn:
+        total = conn.execute("SELECT COUNT(*) FROM workers").fetchone()[0]
+        rows = conn.execute(
+            "SELECT * FROM workers ORDER BY id DESC LIMIT ? OFFSET ?",
+            (limit, offset)).fetchall()
+    resp = JSONResponse([_row_to_api(r) for r in rows])
+    for k, v in paginate_headers(total).items():
+        resp.headers[k] = v
+    return resp
+
+
+@router.get("/api/v2/workers/{worker_id}")
+def get_worker(worker_id: int, request: Request):
+    user = _auth_user(request)
+    with get_conn() as conn:
+        row = conn.execute("SELECT * FROM workers WHERE id=?", (worker_id,)).fetchone()
+    if not row:
+        raise HTTPException(404, "Worker not found")
+    out = _row_to_api(row)
+    if (request.query_params.get("include_code") == "1" or row["created_by"] == user["id"]
+            or user.get("is_admin")):
+        out["code_py"] = row["code_py"]
+    return out
+
+
+@router.patch("/api/v2/workers/{worker_id}")
+def update_worker(worker_id: int, request: Request, body: dict = Body(default={})):
+    user = _auth_user(request, require_write=True)
+    with get_conn() as conn:
+        row = conn.execute("SELECT * FROM workers WHERE id=?", (worker_id,)).fetchone()
+        if not row:
+            raise HTTPException(404, "Worker not found")
+        if row["created_by"] != user["id"] and not user.get("is_admin"):
+            raise HTTPException(403, "Only the owner can update this worker")
+        updates: dict = {}
+        if "name" in body:
+            updates["name"] = str(body["name"] or "")[:200]
+        if "code_py" in body:
+            try:
+                worker_service.validate_code(body["code_py"] or "")
+            except worker_service.WorkerRejected as exc:
+                raise HTTPException(400, f"code rejected: {exc}") from None
+            updates["code_py"] = body["code_py"] or ""
+        if "schedule_cron" in body:
+            updates["schedule_cron"] = str(body["schedule_cron"] or "")[:60]
+        if "shared" in body:
+            updates["shared"] = 1 if body["shared"] else 0
+        if "daily_budget_s" in body:
+            updates["daily_budget_s"] = max(1, min(int(body["daily_budget_s"] or 60), 3600))
+        if "slug" in body and body["slug"] != row["slug"]:
+            if not worker_service._SLUG_RE.match(str(body["slug"] or "")):
+                raise HTTPException(400, "Invalid slug")
+            if conn.execute("SELECT id FROM workers WHERE slug=? AND id!=?",
+                            (body["slug"], worker_id)).fetchone():
+                raise HTTPException(409, "Slug already taken")
+            updates["slug"] = body["slug"]
+        if updates:
+            sets = ", ".join(f"{k}=?" for k in updates)
+            conn.execute(f"UPDATE workers SET {sets}, updated_at=CURRENT_TIMESTAMP WHERE id=?",
+                         (*updates.values(), worker_id))
+            conn.commit()
+        row = conn.execute("SELECT * FROM workers WHERE id=?", (worker_id,)).fetchone()
+    audit_log(user, "worker.update", "worker", worker_id, ",".join(updates), request)
+    return _row_to_api(row)
+
+
+@router.delete("/api/v2/workers/{worker_id}")
+def delete_worker(worker_id: int, request: Request):
+    user = _auth_user(request, require_write=True)
+    with get_conn() as conn:
+        row = conn.execute("SELECT * FROM workers WHERE id=?", (worker_id,)).fetchone()
+        if not row:
+            raise HTTPException(404, "Worker not found")
+        if row["created_by"] != user["id"] and not user.get("is_admin"):
+            raise HTTPException(403, "Only the owner can delete this worker")
+        conn.execute("DELETE FROM workers WHERE id=?", (worker_id,))
+        conn.commit()
+    audit_log(user, "worker.delete", "worker", worker_id, "", request)
+    return {"status": "deleted", "id": worker_id}
+
+
+@router.post("/api/v2/workers/{worker_id}/run")
+async def run_worker_endpoint(worker_id: int, request: Request):
+    user = _auth_user(request, require_write=True)
+    try:
+        body = await request.json() if request.headers.get("content-type") else {}
+    except Exception:
+        body = {}
+    with get_conn() as conn:
+        row = conn.execute("SELECT * FROM workers WHERE id=?", (worker_id,)).fetchone()
+        if not row:
+            raise HTTPException(404, "Worker not found")
+        if (row["created_by"] != user["id"] and not row["shared"]
+                and not user.get("is_admin")):
+            raise HTTPException(403, "Worker is private")
+    import asyncio
+    loop = asyncio.get_running_loop()
+    try:
+        out = await loop.run_in_executor(
+            None, worker_service.run_worker, worker_id, body.get("ctx") or {})
+    except HTTPException:
+        raise
+    audit_log(user, "worker.run", "worker", worker_id, out.get("status", ""), request)
+    return out
+
+
+@router.get("/api/v2/workers/{worker_id}/runs")
+def worker_runs(worker_id: int, request: Request):
+    _auth_user(request)
+    limit, _offset = parse_pagination(request, default_limit=20)
+    with get_conn() as conn:
+        if not conn.execute("SELECT id FROM workers WHERE id=?", (worker_id,)).fetchone():
+            raise HTTPException(404, "Worker not found")
+        rows = conn.execute(
+            "SELECT * FROM worker_runs WHERE worker_id=? ORDER BY id DESC LIMIT ?",
+            (worker_id, limit)).fetchall()
+    return {"worker_id": worker_id, "runs": [row_to_dict(r) for r in rows]}
+
+
+@router.post("/api/v2/workers/{worker_id}/fork")
+def fork_worker_endpoint(worker_id: int, request: Request):
+    user = _auth_user(request, require_write=True)
+    out = worker_service.fork_worker(worker_id, user["id"])
+    audit_log(user, "worker.fork", "worker", worker_id, "", request)
+    return JSONResponse(status_code=201, content=out)
+
+
+@router.get("/api/v2/workers-usage")
+def workers_usage(request: Request):
+    user = _auth_user(request)
+    ws_raw = request.query_params.get("workspace_id")
+    wid = int(ws_raw) if ws_raw and str(ws_raw).isdigit() else None
+    return {"workspace_id": wid,
+            "used_seconds_today": round(worker_service.daily_usage_s(wid), 2),
+            "user_id": user.get("id")}

app/routers/workspace.py

@@ -2,15 +2,18 @@
 from __future__ import annotations
 
 import csv
+import html
 import io
 import json
 import logging
+import sqlite3
 
-from fastapi import APIRouter, Request, HTTPException
+from fastapi import APIRouter, Body, HTTPException, Request
 from fastapi.responses import HTMLResponse, StreamingResponse
 
-from app.db import get_conn
 from app.auth.session import SessionManager
+from app.db import get_conn
+from app.services.automations import fire_event, run_event_sync
 
 logger = logging.getLogger(__name__)
 router = APIRouter(tags=["workspace"], prefix="/workspace")
@@ -23,18 +26,38 @@ def _current_user(request: Request) -> dict:
     return SessionManager.decode_session(s) or {"login": "admin", "id": 1}
 
 
+def _require_admin(request: Request) -> dict:
+    """A15 : webhooks sortants = admin — le serveur POSTe le contenu des pages."""
+    user = SessionManager.decode_session(request.cookies.get("flowdeck_session", ""))
+    if not user or not user.get("id"):
+        raise HTTPException(401, "Authentication required")
+    if not user.get("is_admin"):
+        raise HTTPException(403, "Admin only")
+    return user
+
+
+def _require_ws_admin(request: Request, ws_id: int) -> None:
+    """A5 — CRUD des membres : session obligatoire + rôle admin de l'espace
+    (ou admin global). Un anonymous ne peut plus s'ajouter lui-même ni se
+    promouvoir admin."""
+    user = SessionManager.decode_session(request.cookies.get("flowdeck_session", ""))
+    if not user or not user.get("id"):
+        raise HTTPException(401, "Authentication required")
+    with get_conn() as conn:
+        if conn.execute("SELECT 1 FROM users WHERE id=? AND is_admin=1", (user["id"],)).fetchone():
+            return
+        row = conn.execute(
+            "SELECT role FROM workspace_members WHERE workspace_id=? AND user_id=?",
+            (ws_id, user["id"]),
+        ).fetchone()
+    if not row or row["role"] != "admin":
+        raise HTTPException(403, "Workspace admin role required")
+
+
 # ── Workspaces ──
 
-@router.get("")
-async def list_workspaces(request: Request):
-    with get_conn() as conn:
-        rows = conn.execute("SELECT * FROM workspaces ORDER BY name").fetchall()
-    return {"workspaces": [dict(r) for r in rows]}
-
-
 @router.post("")
-async def create_workspace(request: Request):
-    body = await request.json() if request.headers.get("content-type") else {}
+def create_workspace(request: Request, body: dict = Body(default={})):
     name = body.get("name", "Default Workspace")
     user = _current_user(request)
     uid = user.get("id", 1)
@@ -55,7 +78,9 @@ async def create_workspace(request: Request):
 # ── Members ──
 
 @router.get("/{ws_id}/members")
-async def list_members(request: Request, ws_id: int):
+def list_members(request: Request, ws_id: int):
+    if not SessionManager.decode_session(request.cookies.get("flowdeck_session", "")):
+        raise HTTPException(401, "Authentication required")
     with get_conn() as conn:
         rows = conn.execute(
             "SELECT wm.*, u.login, u.full_name, u.avatar_url FROM workspace_members wm JOIN users u ON wm.user_id=u.id WHERE wm.workspace_id=?",
@@ -65,14 +90,14 @@ async def list_members(request: Request, ws_id: int):
 
 
 @router.post("/{ws_id}/members")
-async def add_member(request: Request, ws_id: int):
-    body = await request.json() if request.headers.get("content-type") else {}
+def add_member(request: Request, ws_id: int, body: dict = Body(default={})):
+    _require_ws_admin(request, ws_id)
     user_id = body.get("user_id")
     role = body.get("role", "editor")
     if role not in ROLES:
         raise HTTPException(400, f"Invalid role: {role}")
     with get_conn() as conn:
-        conn.execute("INSERT OR IGNORE INTO users (id, login, full_name, is_admin) VALUES (?,?,?,1)",
+        conn.execute("INSERT OR IGNORE INTO users (id, login, full_name, is_admin) VALUES (?,?,?,0)",
                      (user_id, f"user_{user_id}", f"User {user_id}"))
         conn.execute("INSERT INTO workspace_members (workspace_id, user_id, role) VALUES (?,?,?)",
                      (ws_id, user_id, role))
@@ -81,8 +106,8 @@ async def add_member(request: Request, ws_id: int):
 
 
 @router.put("/{ws_id}/members/{user_id}")
-async def update_member_role(request: Request, ws_id: int, user_id: int):
-    body = await request.json() if request.headers.get("content-type") else {}
+def update_member_role(request: Request, ws_id: int, user_id: int, body: dict = Body(default={})):
+    _require_ws_admin(request, ws_id)
     role = body.get("role", "editor")
     if role not in ROLES:
         raise HTTPException(400, f"Invalid role: {role}")
@@ -94,7 +119,8 @@ async def update_member_role(request: Request, ws_id: int, user_id: int):
 
 
 @router.delete("/{ws_id}/members/{user_id}")
-async def remove_member(request: Request, ws_id: int, user_id: int):
+def remove_member(request: Request, ws_id: int, user_id: int):
+    _require_ws_admin(request, ws_id)
     with get_conn() as conn:
         conn.execute("DELETE FROM workspace_members WHERE workspace_id=? AND user_id=?", (ws_id, user_id))
         conn.commit()
@@ -104,7 +130,7 @@ async def remove_member(request: Request, ws_id: int, user_id: int):
 # ── Comments ──
 
 @router.get("/pages/{page_id}/comments")
-async def list_comments(request: Request, page_id: int):
+def list_comments(request: Request, page_id: int):
     with get_conn() as conn:
         rows = conn.execute(
             "SELECT c.*, u.login, u.avatar_url FROM comments c JOIN users u ON c.user_id=u.id WHERE c.page_id=? ORDER BY c.created_at",
@@ -114,8 +140,7 @@ async def list_comments(request: Request, page_id: int):
 
 
 @router.post("/pages/{page_id}/comments")
-async def add_comment(request: Request, page_id: int):
-    body = await request.json() if request.headers.get("content-type") else {}
+def add_comment(request: Request, page_id: int, body: dict = Body(default={})):
     b = body.get("body", "").strip()
     if not b:
         raise HTTPException(400, "body required")
@@ -128,27 +153,36 @@ async def add_comment(request: Request, page_id: int):
         cur = conn.execute("INSERT INTO comments (page_id, user_id, body, parent_id) VALUES (?,?,?,?)",
                            (page_id, uid, b, parent_id))
         conn.commit()
+    try:
+        run_event_sync(fire_event("comment.added", {"comment_id": cur.lastrowid, "page_id": page_id, "user_id": uid}))
+    except Exception:
+        logger.exception("add_comment")
     return {"id": cur.lastrowid, "status": "created"}
 
 
 @router.put("/comments/{comment_id}")
-async def update_comment(request: Request, comment_id: int):
-    body = await request.json() if request.headers.get("content-type") else {}
+def update_comment(request: Request, comment_id: int, body: dict = Body(default={})):
     b = body.get("body")
     resolved = body.get("resolved")
     with get_conn() as conn:
+        row = conn.execute("SELECT page_id, resolved FROM comments WHERE id=?", (comment_id,)).fetchone()
         if b is not None:
             conn.execute("UPDATE comments SET body=?, updated_at=CURRENT_TIMESTAMP WHERE id=?", (b, comment_id))
         if resolved is not None:
             conn.execute("UPDATE comments SET resolved=? WHERE id=?", (int(resolved), comment_id))
         conn.commit()
+    if resolved and row and not int(row["resolved"] or 0):
+        try:
+            run_event_sync(fire_event("comment.resolved", {"comment_id": comment_id, "page_id": row["page_id"]}))
+        except Exception:
+            logger.exception("update_comment")
     return {"status": "updated"}
 
 
 # ── Page History ──
 
 @router.get("/pages/{page_id}/history")
-async def page_history(request: Request, page_id: int):
+def page_history(request: Request, page_id: int):
     with get_conn() as conn:
         rows = conn.execute(
             "SELECT * FROM page_history WHERE page_id=? ORDER BY created_at DESC LIMIT 50",
@@ -158,8 +192,7 @@ async def page_history(request: Request, page_id: int):
 
 
 @router.post("/pages/{page_id}/history")
-async def record_history(request: Request, page_id: int):
-    body = await request.json() if request.headers.get("content-type") else {}
+def record_history(request: Request, page_id: int, body: dict = Body(default={})):
     user = _current_user(request)
     uid = user.get("id", 1)
     with get_conn() as conn:
@@ -175,7 +208,7 @@ async def record_history(request: Request, page_id: int):
 # ── Favorites ──
 
 @router.get("/favorites")
-async def list_favorites(request: Request):
+def list_favorites(request: Request):
     user = _current_user(request)
     uid = user.get("id", 1)
     with get_conn() as conn:
@@ -191,8 +224,7 @@ async def list_favorites(request: Request):
 
 
 @router.post("/favorites")
-async def add_favorite(request: Request):
-    body = await request.json() if request.headers.get("content-type") else {}
+def add_favorite(request: Request, body: dict = Body(default={})):
     user = _current_user(request)
     uid = user.get("id", 1)
     page_id = body.get("page_id")
@@ -204,11 +236,15 @@ async def add_favorite(request: Request):
             (uid, page_id, collection_id),
         )
         conn.commit()
+    try:
+        run_event_sync(fire_event("favorite.added", {"page_id": page_id, "collection_id": collection_id, "user_id": uid}))
+    except Exception:
+        logger.exception("add_favorite")
     return {"status": "favorited"}
 
 
 @router.delete("/favorites/{fav_id}")
-async def remove_favorite(request: Request, fav_id: int):
+def remove_favorite(request: Request, fav_id: int):
     with get_conn() as conn:
         conn.execute("DELETE FROM favorites WHERE id=?", (fav_id,))
         conn.commit()
@@ -218,47 +254,40 @@ async def remove_favorite(request: Request, fav_id: int):
 # ── Templates ──
 
 @router.get("/templates/database")
-async def list_db_templates(request: Request):
+def list_db_templates(request: Request):
     with get_conn() as conn:
         rows = conn.execute("SELECT * FROM database_templates ORDER BY name").fetchall()
     return {"templates": [dict(r) for r in rows]}
 
 
 @router.post("/templates/database")
-async def create_db_template(request: Request):
-    body = await request.json() if request.headers.get("content-type") else {}
+def create_db_template(request: Request, body: dict = Body(default={})):
     cur = None
     with get_conn() as conn:
         cur = conn.execute(
-            "INSERT INTO database_templates (name, description, schema_json) VALUES (?,?,?)",
-            (body.get("name", "Template"), body.get("description", ""), json.dumps(body.get("schema", []))),
+            "INSERT INTO database_templates (name, description, icon, schema_json) VALUES (?,?,?,?)",
+            (body.get("name", "Template"), body.get("description", ""),
+             body.get("icon", "📋"), json.dumps(body.get("schema", []))),
         )
         conn.commit()
     return {"id": cur.lastrowid, "status": "created"}
 
 
 @router.post("/templates/database/{tid}/apply")
-async def apply_db_template(request: Request, tid: int):
-    body = await request.json() if request.headers.get("content-type") else {}
+def apply_db_template(request: Request, tid: int, body: dict = Body(default={})):
+    from app.services.db_templates import create_from_template
     name = body.get("name", "New Database")
     with get_conn() as conn:
         tmpl = conn.execute("SELECT * FROM database_templates WHERE id=?", (tid,)).fetchone()
         if not tmpl:
             raise HTTPException(404, "Template not found")
-        cur = conn.execute(
-            "INSERT INTO collections (name, description, icon, schema_json) VALUES (?,?,?,?)",
-            (name, tmpl["description"], "📋", tmpl["schema_json"]),
-        )
-        conn.execute(
-            "INSERT INTO collection_views (collection_id, name, view_type, config_json) VALUES (?,?,?,?)",
-            (cur.lastrowid, "Default View", "table", "{}"),
-        )
+        collection_id = create_from_template(conn, name, dict(tmpl))
         conn.commit()
-    return {"collection_id": cur.lastrowid, "name": name, "status": "created"}
+    return {"collection_id": collection_id, "name": name, "status": "created"}
 
 
 @router.get("/collections/{collection_id}/templates/page")
-async def list_page_templates(request: Request, collection_id: int):
+def list_page_templates(request: Request, collection_id: int):
     with get_conn() as conn:
         rows = conn.execute(
             "SELECT * FROM page_templates WHERE collection_id=? ORDER BY name", (collection_id,)
@@ -267,8 +296,7 @@ async def list_page_templates(request: Request, collection_id: int):
 
 
 @router.post("/collections/{collection_id}/templates/page")
-async def create_page_template(request: Request, collection_id: int):
-    body = await request.json() if request.headers.get("content-type") else {}
+def create_page_template(request: Request, collection_id: int, body: dict = Body(default={})):
     with get_conn() as conn:
         cur = conn.execute(
             "INSERT INTO page_templates (collection_id, name, property_values_json) VALUES (?,?,?)",
@@ -279,8 +307,7 @@ async def create_page_template(request: Request, collection_id: int):
 
 
 @router.post("/collections/{collection_id}/templates/page/{tid}/apply")
-async def apply_page_template(request: Request, collection_id: int, tid: int):
-    body = await request.json() if request.headers.get("content-type") else {}
+def apply_page_template(request: Request, collection_id: int, tid: int, body: dict = Body(default={})):
     with get_conn() as conn:
         tmpl = conn.execute("SELECT * FROM page_templates WHERE id=? AND collection_id=?", (tid, collection_id)).fetchone()
         if not tmpl:
@@ -293,14 +320,304 @@ async def apply_page_template(request: Request, collection_id: int, tid: int):
             (collection_id, body.get("title", "New Page"), max_pos, tmpl["property_values_json"]),
         )
         conn.commit()
+    run_event_sync(fire_event("page.created", {
+        "page_id": cur.lastrowid,
+        "collection_id": collection_id,
+        "title": body.get("title", "New Page"),
+        "properties": json.loads(tmpl["property_values_json"]) if tmpl["property_values_json"] else {},
+    }))
     return {"id": cur.lastrowid, "status": "created"}
 
 
+@router.put("/collections/{collection_id}/templates/page/{tid}")
+def update_page_template(request: Request, collection_id: int, tid: int, body: dict = Body(default={})):
+    """Update a page template — name, properties, content, recurrence."""
+    with get_conn() as conn:
+        tmpl = conn.execute(
+            "SELECT * FROM page_templates WHERE id=? AND collection_id=?", (tid, collection_id)
+        ).fetchone()
+        if not tmpl:
+            raise HTTPException(404, "Template not found")
+
+        name = body.get("name", tmpl["name"])
+        tmpl_dict = dict(tmpl)
+        description = body.get("description", tmpl_dict.get("description", ""))
+        property_values_json = json.dumps(body.get("properties", json.loads(tmpl["property_values_json"])))
+        content_json = json.dumps(body.get("content", json.loads(tmpl_dict.get("content_json", "[]"))))
+        is_recurring = int(body.get("is_recurring", tmpl_dict.get("is_recurring", 0)))
+        recurrence_rule = body.get("recurrence_rule", tmpl_dict.get("recurrence_rule", ""))
+
+        conn.execute(
+            """UPDATE page_templates SET name=?, description=?, property_values_json=?,
+               content_json=?, is_recurring=?, recurrence_rule=? WHERE id=?""",
+            (name, description, property_values_json, content_json, is_recurring, recurrence_rule, tid),
+        )
+        conn.commit()
+    return {"id": tid, "status": "updated"}
+
+
+@router.delete("/collections/{collection_id}/templates/page/{tid}")
+def delete_page_template(request: Request, collection_id: int, tid: int):
+    """Delete a page template."""
+    with get_conn() as conn:
+        tmpl = conn.execute(
+            "SELECT * FROM page_templates WHERE id=? AND collection_id=?", (tid, collection_id)
+        ).fetchone()
+        if not tmpl:
+            raise HTTPException(404, "Template not found")
+        conn.execute("DELETE FROM page_templates WHERE id=?", (tid,))
+        conn.commit()
+    return {"id": tid, "status": "deleted"}
+
+
+# ── v4.2.0: Dashboards ──
+
+@router.get("/collections/{collection_id}/dashboards")
+def list_dashboards(request: Request, collection_id: int):
+    """List all dashboards for a collection."""
+    with get_conn() as conn:
+        rows = conn.execute(
+            "SELECT * FROM collection_dashboards WHERE collection_id=? ORDER BY name", (collection_id,)
+        ).fetchall()
+    return {"dashboards": [dict(r) for r in rows]}
+
+
+@router.post("/collections/{collection_id}/dashboards")
+def create_dashboard(request: Request, collection_id: int, body: dict = Body(default={})):
+    """Create a new dashboard for a collection."""
+    name = body.get("name", "Dashboard").strip()
+    layout = json.dumps(body.get("layout", {"columns": 1, "widgets": []}))
+
+    with get_conn() as conn:
+        coll = conn.execute("SELECT id FROM collections WHERE id=?", (collection_id,)).fetchone()
+        if not coll:
+            raise HTTPException(404, "Collection not found")
+        cur = conn.execute(
+            "INSERT INTO collection_dashboards (collection_id, name, layout_json) VALUES (?,?,?)",
+            (collection_id, name, layout),
+        )
+        conn.commit()
+    return {"id": cur.lastrowid, "name": name, "status": "created"}
+
+
+@router.put("/collections/{collection_id}/dashboards/{did}")
+def update_dashboard(request: Request, collection_id: int, did: int, body: dict = Body(default={})):
+    """Update a dashboard — name or layout (widgets grid)."""
+    with get_conn() as conn:
+        dash = conn.execute(
+            "SELECT * FROM collection_dashboards WHERE id=? AND collection_id=?", (did, collection_id)
+        ).fetchone()
+        if not dash:
+            raise HTTPException(404, "Dashboard not found")
+
+        name = body.get("name", dash["name"])
+        layout = json.dumps(body.get("layout", json.loads(dash["layout_json"])))
+
+        conn.execute(
+            "UPDATE collection_dashboards SET name=?, layout_json=?, updated_at=CURRENT_TIMESTAMP WHERE id=?",
+            (name, layout, did),
+        )
+        conn.commit()
+    return {"id": did, "status": "updated"}
+
+
+@router.delete("/collections/{collection_id}/dashboards/{did}")
+def delete_dashboard(request: Request, collection_id: int, did: int):
+    """Delete a dashboard."""
+    with get_conn() as conn:
+        dash = conn.execute(
+            "SELECT * FROM collection_dashboards WHERE id=? AND collection_id=?", (did, collection_id)
+        ).fetchone()
+        if not dash:
+            raise HTTPException(404, "Dashboard not found")
+        conn.execute("DELETE FROM collection_dashboards WHERE id=?", (did,))
+        conn.commit()
+    return {"id": did, "status": "deleted"}
+
+
+# ── v4.5.0: Sprints ──
+
+@router.get("/collections/{collection_id}/sprints")
+def list_sprints(request: Request, collection_id: int):
+    """List all sprints for a collection."""
+    with get_conn() as conn:
+        rows = conn.execute(
+            "SELECT * FROM sprints WHERE collection_id=? ORDER BY start_date DESC", (collection_id,)
+        ).fetchall()
+        sprints = []
+        for r in rows:
+            s = dict(r)
+            # Count pages in sprint
+            count = conn.execute(
+                "SELECT COUNT(*) as cnt FROM sprint_pages WHERE sprint_id=?", (r["id"],)
+            ).fetchone()["cnt"]
+            s["page_count"] = count
+            sprints.append(s)
+    return {"sprints": sprints}
+
+
+@router.post("/collections/{collection_id}/sprints")
+def create_sprint(request: Request, collection_id: int, body: dict = Body(default={})):
+    """Create a new sprint."""
+    name = body.get("name", "").strip()
+    start_date = body.get("start_date", "")
+    end_date = body.get("end_date", "")
+    if not name or not start_date or not end_date:
+        raise HTTPException(400, "name, start_date, end_date are required")
+
+    goal = body.get("goal", "")
+    status = body.get("status", "planning")
+    auto_complete = int(body.get("auto_complete", 1))
+
+    with get_conn() as conn:
+        cur = conn.execute(
+            "INSERT INTO sprints (collection_id, name, start_date, end_date, goal, status, auto_complete) VALUES (?,?,?,?,?,?,?)",
+            (collection_id, name, start_date, end_date, goal, status, auto_complete),
+        )
+        conn.commit()
+    try:
+        run_event_sync(fire_event("sprint.created", {"sprint_id": cur.lastrowid, "collection_id": collection_id, "name": name}))
+    except Exception:
+        logger.exception("create_sprint")
+    return {"id": cur.lastrowid, "name": name, "status": "created"}
+
+
+@router.put("/collections/{collection_id}/sprints/{sid}")
+def update_sprint(request: Request, collection_id: int, sid: int, body: dict = Body(default={})):
+    """Update a sprint."""
+    with get_conn() as conn:
+        sprint = conn.execute(
+            "SELECT * FROM sprints WHERE id=? AND collection_id=?", (sid, collection_id)
+        ).fetchone()
+        if not sprint:
+            raise HTTPException(404, "Sprint not found")
+
+        name = body.get("name", sprint["name"])
+        start_date = body.get("start_date", sprint["start_date"])
+        end_date = body.get("end_date", sprint["end_date"])
+        goal = body.get("goal", sprint["goal"])
+        status = body.get("status", sprint["status"])
+        auto_complete = int(body.get("auto_complete", sprint["auto_complete"]))
+
+        conn.execute(
+            "UPDATE sprints SET name=?, start_date=?, end_date=?, goal=?, status=?, auto_complete=? WHERE id=?",
+            (name, start_date, end_date, goal, status, auto_complete, sid),
+        )
+        conn.commit()
+    try:
+        run_event_sync(fire_event("sprint.updated", {"sprint_id": sid, "collection_id": collection_id, "name": name, "status": status}))
+    except Exception:
+        logger.exception("update_sprint")
+    return {"id": sid, "status": "updated"}
+
+
+@router.delete("/collections/{collection_id}/sprints/{sid}")
+def delete_sprint(request: Request, collection_id: int, sid: int):
+    """Delete a sprint."""
+    with get_conn() as conn:
+        sprint = conn.execute(
+            "SELECT * FROM sprints WHERE id=? AND collection_id=?", (sid, collection_id)
+        ).fetchone()
+        if not sprint:
+            raise HTTPException(404, "Sprint not found")
+        conn.execute("DELETE FROM sprints WHERE id=?", (sid,))
+        conn.commit()
+    return {"id": sid, "status": "deleted"}
+
+
+@router.post("/collections/{collection_id}/sprints/{sid}/assign")
+def assign_page_to_sprint(request: Request, collection_id: int, sid: int, body: dict = Body(default={})):
+    """Assign a page to a sprint."""
+    page_id = body.get("page_id")
+    if not page_id:
+        raise HTTPException(400, "page_id is required")
+
+    velocity_points = body.get("velocity_points", 1)
+    status_at_start = body.get("status_at_start", "")
+
+    with get_conn() as conn:
+        sprint = conn.execute("SELECT id FROM sprints WHERE id=?", (sid,)).fetchone()
+        if not sprint:
+            raise HTTPException(404, "Sprint not found")
+        page = conn.execute("SELECT id FROM collection_pages WHERE id=?", (page_id,)).fetchone()
+        if not page:
+            raise HTTPException(404, "Page not found")
+
+        try:
+            conn.execute(
+                "INSERT INTO sprint_pages (sprint_id, page_id, status_at_start, velocity_points) VALUES (?,?,?,?)",
+                (sid, page_id, status_at_start, velocity_points),
+            )
+            conn.commit()
+        except sqlite3.IntegrityError:
+            raise HTTPException(409, "Page already assigned to this sprint") from None
+    return {"sprint_id": sid, "page_id": page_id, "status": "assigned"}
+
+
+@router.delete("/collections/{collection_id}/sprints/{sid}/assign/{page_id}")
+def remove_page_from_sprint(request: Request, collection_id: int, sid: int, page_id: int):
+    """Remove a page from a sprint."""
+    with get_conn() as conn:
+        existing = conn.execute(
+            "SELECT * FROM sprint_pages WHERE sprint_id=? AND page_id=?", (sid, page_id)
+        ).fetchone()
+        if not existing:
+            raise HTTPException(404, "Assignment not found")
+        conn.execute("DELETE FROM sprint_pages WHERE sprint_id=? AND page_id=?", (sid, page_id))
+        conn.commit()
+    return {"sprint_id": sid, "page_id": page_id, "status": "removed"}
+
+
+@router.get("/collections/{collection_id}/sprints/burndown/{sid}")
+def sprint_burndown(request: Request, collection_id: int, sid: int):
+    """Calculate burndown data for a sprint."""
+    with get_conn() as conn:
+        sprint = conn.execute(
+            "SELECT * FROM sprints WHERE id=? AND collection_id=?", (sid, collection_id)
+        ).fetchone()
+        if not sprint:
+            raise HTTPException(404, "Sprint not found")
+
+        pages = conn.execute(
+            """SELECT sp.velocity_points, cp.property_values_json
+               FROM sprint_pages sp JOIN collection_pages cp ON sp.page_id=cp.id
+               WHERE sp.sprint_id=?""", (sid,)
+        ).fetchall()
+
+    total_points = sum(p["velocity_points"] for p in pages)
+    completed = 0
+    for p in pages:
+        props = json.loads(p["property_values_json"])
+        for v in props.values():
+            if isinstance(v, str) and v.lower() in ("done", "complete", "completed", "terminé"):
+                completed += p["velocity_points"]
+                break
+
+    from datetime import date
+    today = date.today()
+    start = date.fromisoformat(sprint["start_date"]) if sprint["start_date"] else today
+    end = date.fromisoformat(sprint["end_date"]) if sprint["end_date"] else today
+    total_days = max((end - start).days, 1)
+    elapsed = max((today - start).days, 0)
+    ideal_burn = total_points - (total_points * elapsed / total_days)
+
+    return {
+        "sprint": sprint["name"],
+        "total_points": total_points,
+        "completed_points": completed,
+        "remaining_points": total_points - completed,
+        "ideal_remaining": round(ideal_burn, 1),
+        "start_date": sprint["start_date"],
+        "end_date": sprint["end_date"],
+        "days_elapsed": elapsed,
+        "days_total": total_days,
+    }
+
+
 # ── CSV Import/Export ──
 
 @router.post("/collections/{collection_id}/import/csv")
-async def import_csv(request: Request, collection_id: int):
-    body = await request.json() if request.headers.get("content-type") else {}
+def import_csv(request: Request, collection_id: int, body: dict = Body(default={})):
     csv_data = body.get("csv", "")
     if not csv_data:
         raise HTTPException(400, "csv field required")
@@ -325,7 +642,7 @@ async def import_csv(request: Request, collection_id: int):
 
 
 @router.get("/collections/{collection_id}/export/csv")
-async def export_csv(request: Request, collection_id: int):
+def export_csv(request: Request, collection_id: int):
     with get_conn() as conn:
         pages = conn.execute(
             "SELECT * FROM collection_pages WHERE collection_id=? ORDER BY position", (collection_id,)
@@ -352,26 +669,86 @@ async def export_csv(request: Request, collection_id: int):
     )
 
 
+# ── Webhooks Outbound Management ──
+
+@router.get("/webhooks")
+def list_webhooks(request: Request):
+    _require_admin(request)
+    with get_conn() as conn:
+        rows = conn.execute("SELECT * FROM webhook_subscriptions ORDER BY created_at DESC").fetchall()
+    return {"webhooks": [dict(r) for r in rows]}
+
+
+@router.post("/webhooks")
+def create_webhook(request: Request, body: dict = Body(default={})):
+    _require_admin(request)
+    url = body.get("url", "").strip()
+    event = body.get("event", "page.created")
+    secret = body.get("secret", "")
+    if not url:
+        raise HTTPException(400, "url required")
+    # A15 : SSRF — le scheduler POSTe le contenu des pages vers cette URL.
+    from urllib.parse import urlparse
+
+    from app.services.importers.url_fetch import _is_public_host
+    parsed = urlparse(url)
+    if parsed.scheme not in ("http", "https") or not parsed.hostname or not _is_public_host(parsed.hostname):
+        raise HTTPException(400, f"url non autorisée: {parsed.hostname}")
+    with get_conn() as conn:
+        cur = conn.execute(
+            "INSERT INTO webhook_subscriptions (url, event, secret) VALUES (?,?,?)",
+            (url, event, secret),
+        )
+        conn.commit()
+    return {"id": cur.lastrowid, "url": url, "event": event, "status": "registered"}
+
+
+@router.delete("/webhooks/{wh_id}")
+def delete_webhook(request: Request, wh_id: int):
+    _require_admin(request)
+    with get_conn() as conn:
+        conn.execute("DELETE FROM webhook_subscriptions WHERE id=?", (wh_id,))
+        conn.commit()
+    return {"status": "deleted"}
+
+
 # ── Public Sharing ──
 
 @router.get("/public/{collection_id}")
-async def public_view(request: Request, collection_id: int):
-    """Simple public read-only view — no auth required."""
+def public_view(request: Request, collection_id: int):
+    """Simple public read-only view — no auth required.
+
+    A18 : les bases ``restricted``/``private`` (``permission_type``) restent
+    masquées (404) et toute interpolation part dans ``html.escape`` (XSS stocké
+    sur le titre de la base ou d'une ligne).
+    """
     with get_conn() as conn:
         coll = conn.execute("SELECT * FROM collections WHERE id=?", (collection_id,)).fetchone()
         if not coll:
             raise HTTPException(404, "Collection not found")
+        ptype = coll["permission_type"] if "permission_type" in coll.keys() else "inherit"
+        if ptype in ("restricted", "private"):
+            # 404 explicite : le handler global transformerait un HTTPException(404)
+            # en redirection 302 → login pour un chemin HTML.
+            return HTMLResponse(
+                "<!DOCTYPE html><html><head><meta charset=\"utf-8\"><title>404</title></head>"
+                "<body><h1>404 — Not found</h1></body></html>",
+                status_code=404,
+            )
         pages = conn.execute(
             "SELECT id, title, icon, property_values_json FROM collection_pages WHERE collection_id=? ORDER BY position",
             (collection_id,),
         ).fetchall()
 
+    esc = html.escape
+    name = esc(str(coll["name"] or ""))
+    icon = esc(str(coll["icon"] or ""))
     items = "".join(
-        f"<li>{p['icon']} <b>{p['title']}</b></li>"
+        f"<li>{esc(str(p['icon'] or ''))} <b>{esc(str(p['title'] or ''))}</b></li>"
         for p in pages
     )
     return HTMLResponse(f"""<!DOCTYPE html>
-<html><head><meta charset="utf-8"><title>{coll['name']} — FlowDeck Public</title>
+<html><head><meta charset="utf-8"><title>{name} — FlowDeck Public</title>
 <style>body{{font-family:system-ui;background:#191919;color:#fff;padding:20px}}
 h1{{font-size:24px}} li{{padding:8px;border-bottom:1px solid #333}}</style></head>
-<body><h1>{coll['icon']} {coll['name']}</h1><ul>{items}</ul><p>{len(pages)} items</p></body></html>""")
+<body><h1>{icon} {name}</h1><ul>{items}</ul><p>{len(pages)} items</p></body></html>""")

app/services/agent_engine.py

@@ -0,0 +1,513 @@
+"""FlowDeck — AgentEngine: ReAct orchestrator (v4.14.0).
+
+`objective → comprehension → context → reasoning ↔ action → result`.
+
+The engine drives the LLM (which only emits tool intentions), gates each call
+through PermissionManager, executes it via ToolRegistry, journals every action
+to `agent_actions` with an undo snapshot, and yields a stream of SSE events so
+the UI can render reasoning + actions live. Since v4.14.0 a freshly created
+conversation is automatically renamed with a descriptive title derived from its
+content so the history stays easy to browse.
+"""
+from __future__ import annotations
+
+import asyncio
+import json
+import logging
+import re
+
+from app.config import settings
+from app.db import get_conn
+from app.services.agent_policies import check_tool, get_policy
+from app.services.context_builder import ContextBuilder
+from app.services.llm_client import LLMClient
+from app.services.permission_manager import WRITE_TOOLS, PermissionManager
+from app.services.tool_registry import ToolRegistry
+
+logger = logging.getLogger(__name__)
+
+MAX_ITERATIONS = 12
+
+
+async def _fire_agent_webhook(event: str, payload: dict) -> None:
+    """Dispatch an outbound agent lifecycle event (never raises).
+
+    Lifecycle: ``agent.run.started`` → ``agent.run.finished`` | ``agent.run.failed``.
+    All three are in the webhook_outbound catalogue, so integrations can subscribe
+    to `agent.*` and drive FlowDeck Agent from outside (Agent phase 5).
+    """
+    try:
+        from app.services.webhook_outbound import fire_event as _fire_wh
+        await _fire_wh(event, payload)
+    except Exception:  # noqa: BLE001
+        logger.debug("%s webhook dispatch failed", event)
+
+# Compact in-app guide so the LLM can answer « comment faire… ? » questions even
+# when no document is attached to the conversation (generic help / onboarding).
+APP_GUIDE = """## Guide de l'utilisateur FlowDeck (sert à répondre aux questions « comment … ? »)
+- **Pages** : le contenu est organisé en blocs (paragraphes, titres, listes, to-do, tableaux, images, formules, bases embarquées). La barre latérale liste les pages récentes, favoris, agents, partagées et publiées.
+- **Documents & espaces de travail** : un « document » est une page éditeur (type Notion) qui vit dans un espace de travail. Pour créer un document dans un espace : appelle `read_workspaces` (reprends le `workspace_name` ou l'id exact), puis `create_document`. Pour modifier un document existant : `read_document` puis `write_blocks` (blocs et/ou titre). Pour supprimer : `delete_document` (corbeille). `search_workspace` retrouve aussi les documents et les espaces par titre.
+- **Format des blocs** (pour `write_blocks`) : chaque bloc est un objet `{"type": "...", "content": "texte"}`. Le champ du texte s'appelle **`content`** (jamais `text`). Un script / code s'écrit dans un bloc `{"type": "code", "content": "...", "language": "powershell"}`. Les titres sont `heading_1`, `heading_2`, `heading_3`, `heading_4`. Autres types : paragraph, bulleted_list, numbered_list, to_do, quote, divider, toggle, callout.
+- **Collections (bases de données)** : des ensembles de pages structurées avec des propriétés (texte, nombre, sélection, dates…). Chaque collection peut avoir plusieurs vues : tableau, board (kanban), calendrier, galerie, liste, timeline, graphique, formulaire, carte, flux, gantt. Ajouter une propriété ou une vue = outils add_property / create_view.
+- **Créer du contenu** : « crée une collection X », « crée une page », « ajoute une propriété Statut à la collection Y » sont des actions que l'agent peut exécuter directement avec ses outils.
+- **Espaces de travail** : FlowDeck gère des espaces locaux et des dépôts Gitea/GitHub (pages privées dans un dépôt, issues reliées via read_gitea_issues). On change d'espace depuis le menu en bas à gauche (« Switch workspace »).
+- **Recherche** : la commande Ctrl+K / la barre de recherche du haut permet de retrouver pages et collections.
+- **Corbeille & Bibliothèque** : les pages supprimées vont dans la Corbeille ; Favoris / Récents / Partagés / Publiés se consultent dans la Bibliothèque.
+- **Réglages** : Paramètres (en bas à gauche → Settings) pour le compte, les notifications, les tags, les intégrations et la section « Agent & IA » (clés API, fournisseurs, modèle global).
+- **Agent IA** : ouvrable via le bouton 🤖 en bas à droite ou la section « Agents » du sidebar. On peut lui parler de la page ouverte, ou lui poser des questions générales sur l'utilisation de l'application.
+Quand la question est générale (« comment créer un kanban ? », « où sont mes favoris ? »), réponds de façon concise et guidée à partir de ces informations, sans inventer de fonctionnalités absentes."""
+
+# Deterministic auto-title heuristics (used when no real LLM is configured, and
+# as a fallback when the generated title is unusable). Ordered by priority: the
+# first matching intent wins.
+_TITLE_INTENTS = (
+    ("Création", ("créer", "crée", "crées", "création", "nouveau", "nouvelle",
+                  "create", "creation")),
+    ("Ajout", ("ajouter", "ajoute", "ajout d", "ajoutons", "add")),
+    ("Renommage", ("renommer", "renomme", "renommage", "rename")),
+    ("Suppression", ("supprimer", "supprime", "suppression", "delete")),
+    ("Déplacement", ("déplacer", "déplace", "déplacement", "move")),
+    ("Mise à jour", ("modifier", "modifie", "modification", "mets à jour",
+                     "met à jour", "mettre à jour", "update", "éditer")),
+    ("Analyse", ("analyser", "analyse")),
+    ("Résumé", ("résumer", "résume", "résumé", "resume")),
+    ("Traduction", ("traduire", "traduis", "traduit", "traduction", "translate")),
+    ("Planification", ("planifier", "planifie", "préparer", "prépare", "organiser",
+                       "organise", "sprint", "agenda")),
+    ("Recherche", ("chercher", "cherche", "rechercher", "recherche", "trouver",
+                   "trouve", "liste", "lister", "search", "find")),
+)
+
+_TITLE_TYPES = (
+    ("collection", "collection", ("collection", "base de données", "database", "db")),
+    ("propriété", "propriété", ("propriété", "property")),
+    ("vue", "vue", (" vue", "view")),
+    ("board", "board", ("board", "kanban")),
+    ("sprint", "sprint", ("sprint",)),
+    ("document", "document", ("document", "note de réunion", "compte-rendu", "compte rendu")),
+    ("tâche", "tâche", ("tâche", "task", "tache")),
+    ("issue", "issue", ("issue",)),
+)
+
+
+class AgentEngine:
+    def __init__(self, user_id: int, workspace_id: int | None = None,
+                 llm: LLMClient | None = None):
+        self.user_id = user_id
+        self.workspace_id = workspace_id
+        self.llm = llm or LLMClient()
+        self.tools = ToolRegistry()
+        self.ctx = ContextBuilder(user_id, workspace_id)
+        self.perms = PermissionManager(user_id)
+        self._tokens = 0
+
+    # ── Helpers ──
+
+    def _load_agent(self, conversation_id: int) -> dict:
+        with get_conn() as conn:
+            row = conn.execute(
+                "SELECT a.* FROM agents a JOIN agent_conversations c ON c.agent_id=a.id WHERE c.id=?",
+                (conversation_id,),
+            ).fetchone()
+        if not row:
+            row = {"id": None, "name": "FlowDeck Agent", "icon": "🤖", "agent_type": "personal",
+                   "system_instructions": "", "model": settings.llm_model,
+                   "scope_json": "{}", "approval_mode": "auto"}
+        return dict(row)
+
+    def _build_system_prompt(self, agent: dict, skills=None) -> str:
+        if skills is None:
+            skills = []
+        if isinstance(skills, dict):
+            skills = [skills]
+        lines = [
+            "Tu es FlowDeck Agent, un agent IA qui réalise des tâches dans le workspace FlowDeck.",
+            "Tu réfléchis (reasoning) puis agis en appelant les outils disponibles.",
+            "Appelle UN ou PLUSIEURS outils pour atteindre l'objectif, puis conclus avec une réponse finale.",
+            "N'invente jamais d'IDs : utilise ceux fournis dans le contexte.",
+            f"Workspace courant : {self.workspace_id}.",
+        ]
+        if agent.get("system_instructions"):
+            lines.append(f"\nInstructions de l'agent {agent.get('name','')}:\n{agent['system_instructions']}")
+        # Plusieurs skills peuvent être appliqués au même post : chacun injecte
+        # son prompt dans les instructions système.
+        for skill in skills:
+            if skill:
+                lines.append(f"\nSkill appliquée « {skill.get('name','')} »:\n{skill.get('prompt_template','')}")
+        # L'utilisateur peut poser des questions d'aide sans contexte de document ;
+        # le guide intégré permet d'y répondre (aucun outil requis).
+        lines.append("\n" + APP_GUIDE)
+        return "\n".join(lines)
+
+    # ── Main run (async generator of SSE events) ──
+
+    async def run(self, conversation_id: int, objective: str, *, model: str | None = None,
+                  mentions: list[str] | None = None, files: list[dict] | None = None,
+                  skill_id: int | None = None, skill_ids: list[int] | None = None,
+                  extra_context: str | None = None):
+        agent = self._load_agent(conversation_id)
+        scope = json.loads(agent.get("scope_json") or "{}")
+        approval_mode = agent.get("approval_mode") or "auto"
+        model = model or agent.get("model") or settings.llm_model
+
+        ids = list(skill_ids or [])
+        if skill_id and skill_id not in ids:
+            ids.append(skill_id)
+        skills = [s for s in (self._load_skill(i, scope) for i in ids) if s]
+        system = self._build_system_prompt(agent, skills)
+        context = self.ctx.build(mentions=mentions, files=files)
+        if extra_context and extra_context.strip():
+            context += "\n\n## Document / contexte fourni par l'utilisateur\n" + extra_context.strip()
+
+        messages = [
+            {"role": "system", "content": system},
+            {"role": "user", "content": f"{objective}\n\n# Contexte\n{context}"},
+        ]
+
+        self._persist_message(conversation_id, "user", objective)
+        self._update_conversation(conversation_id, status="running")
+        await _fire_agent_webhook("agent.run.started", {
+            "conversation_id": conversation_id,
+            "objective": objective[:500],
+            "model": model or "",
+        })
+
+        # Update the history title right away (before the run finishes) and
+        # refine it once we have the final answer (_autotitle below).
+        try:
+            suggested = self._suggest_title(objective, None)
+            if suggested:
+                self._update_conversation(conversation_id, title=suggested[:80])
+        except Exception:  # noqa: BLE001 — never break a run because of the title
+            logger.exception("Auto-title failed for conversation #%s", conversation_id)
+
+        tool_schema = self.tools.schema(scope)
+        final_text = None
+        used_model = model or ""  # peut être ajusté par un repli de modèle (404/410)
+
+        try:
+            # v7.2.0 — the workspace policy may cap iterations below the global max.
+            policy_max = get_policy(self.workspace_id).get("max_steps") or MAX_ITERATIONS
+            iterations = min(settings.agent_max_iterations or MAX_ITERATIONS, policy_max)
+            for _step in range(iterations):
+                if self._tokens >= settings.agent_max_tokens_budget:
+                    yield self._event("error", {"message": "Budget de tokens dépassé"})
+                    break
+
+                response = await asyncio.wait_for(
+                    self.llm.complete(messages, model=model, tools=tool_schema, stream=True),
+                    timeout=settings.agent_run_timeout_seconds,
+                )
+                self._tokens += response.usage.get("total_tokens", 0) or 0
+
+                if getattr(response, "notice", ""):
+                    yield self._event("notice", {"message": response.notice})
+
+                used_model = getattr(response, "model", "") or used_model
+
+                if response.text and response.text.strip():
+                    yield self._event("reasoning", {"content": response.text})
+
+                if not response.tool_calls:
+                    messages.append({"role": "assistant", "content": response.text or ""})
+                    final_text = response.text or self._no_tool_message(response)
+                    yield self._event("final", {"content": final_text})
+                    break
+
+                # L'API de chat exige que le message assistant qui *annonce* les appels
+                # d'outils porte les `tool_calls` (avec id), puis que chaque résultat
+                # d'outil soit fourni avec le `tool_call_id` correspondant. Sans cela
+                # la passe suivante est refusée par le fournisseur (et l'agent retombait
+                # silencieusement sur le mock hors-ligne).
+                tool_specs = []
+                for idx, call in enumerate(response.tool_calls):
+                    call_id = call.get("id") or f"call_{conversation_id}_{idx}_{self._tokens}"
+                    tool_specs.append({
+                        "id": call_id,
+                        "type": "function",
+                        "function": {
+                            "name": call["name"],
+                            "arguments": call.get("arguments_raw")
+                                or json.dumps(call.get("arguments") or {}, ensure_ascii=False),
+                        },
+                    })
+                assistant_msg = {"role": "assistant", "content": response.text or ""}
+                assistant_msg["tool_calls"] = tool_specs
+                messages.append(assistant_msg)
+
+                for idx, call in enumerate(response.tool_calls):
+                    tool, args = call["name"], call.get("arguments") or {}
+                    call_id = tool_specs[idx]["id"]
+                    denied = False
+                    # v7.2.0 — workspace tool scope + human approval gate, checked
+                    # *before* permissions so a scoped-out tool never reaches ACLs.
+                    gov = check_tool(self.user_id, self.workspace_id, tool,
+                                     is_write=tool in WRITE_TOOLS,
+                                     conversation_id=conversation_id)
+                    if not gov.get("allowed"):
+                        detail = gov.get("reason") or "Refusé par la politique agent"
+                        if gov.get("approval_id"):
+                            detail = (f"Approbation requise (demande #{gov['approval_id']}) "
+                                      f"— action suspendue")
+                        yield self._event("action", {
+                            "tool": tool, "status": "approval_required" if gov.get("approval_id")
+                            else "error", "detail": detail,
+                            "approval_id": gov.get("approval_id")})
+                        self._log_action(conversation_id, tool, args, {}, "error", detail=detail)
+                        messages.append({
+                            "role": "tool", "tool_call_id": call_id,
+                            "content": json.dumps({"status": "error", "message": detail},
+                                                   ensure_ascii=False),
+                        })
+                        denied = True
+                    try:
+                        if not denied:
+                            self.perms.assert_can(tool, args, self.workspace_id, approval_mode)
+                    except Exception as exc:  # permission / approval guard
+                        detail = self._exc_detail(exc)
+                        yield self._event("action", {"tool": tool, "status": "error", "detail": detail})
+                        self._log_action(conversation_id, tool, args, {}, "error", detail=detail)
+                        messages.append({
+                            "role": "tool", "tool_call_id": call_id,
+                            "content": json.dumps({"status": "error", "message": f"Permission refusée: {detail}"}, ensure_ascii=False),
+                        })
+                        denied = True
+
+                    if not denied:
+                        result = await self.tools.execute(tool, args, user_id=self.user_id)
+
+                        if result.status == "success":
+                            yield self._event("action", {
+                                "tool": tool, "status": result.status,
+                                "target_type": result.target_type, "target_id": result.target_id,
+                                "message": result.message,
+                            })
+                            self._log_action(conversation_id, tool, args, result.data, "success",
+                                             target_type=result.target_type, target_id=result.target_id,
+                                             undo=result.undo)
+                            messages.append({
+                                "role": "tool", "tool_call_id": call_id,
+                                "content": json.dumps({"status": "ok", "result": result.data, "target_id": result.target_id}, ensure_ascii=False),
+                            })
+                        else:
+                            yield self._event("action", {"tool": tool, "status": "error", "detail": result.message})
+                            self._log_action(conversation_id, tool, args, {}, "error", detail=result.message)
+                            messages.append({
+                                "role": "tool", "tool_call_id": call_id,
+                                "content": json.dumps({"status": "error", "message": result.message}, ensure_ascii=False),
+                            })
+
+            if final_text is None:
+                final_text = "Objectif traité. Consultez le journal des actions pour le détail."
+                yield self._event("final", {"content": final_text})
+
+            self._persist_message(conversation_id, "assistant", final_text,
+                                  model=used_model, tokens=self._tokens)
+            await self._autotitle(conversation_id, objective, final_text)
+            # v6.4.0: emit agent.run.finished (outbound webhooks only).
+            await _fire_agent_webhook("agent.run.finished", {
+                "conversation_id": conversation_id,
+                "objective": objective[:500],
+                "model": used_model,
+                "tokens": self._tokens,
+            })
+
+        except Exception as exc:  # noqa: BLE001
+            logger.exception("AgentEngine run failed")
+            await _fire_agent_webhook("agent.run.failed", {
+                "conversation_id": conversation_id,
+                "objective": objective[:500],
+                "error": str(exc)[:500],
+            })
+            yield self._event("error", {"message": f"Erreur interne: {exc}"})
+        finally:
+            self._update_conversation(conversation_id, status="idle")
+
+    # ── Skills ──
+
+    def _load_skill(self, skill_id: int, scope: dict | None) -> dict | None:
+        with get_conn() as conn:
+            row = conn.execute("SELECT * FROM agent_skills WHERE id=?", (skill_id,)).fetchone()
+        if not row:
+            return None
+        skill = dict(row)
+        allowed = json.loads(skill.get("allowed_tools_json") or "[]")
+        if allowed:
+            skill["prompt_template"] = (skill.get("prompt_template") or "") + \
+                "\nOutils autorisés: " + ", ".join(allowed)
+        return skill
+
+    # ── Audit & persistence ──
+
+    def _log_action(self, conversation_id, tool, args, result, status,
+                    *, target_type="", target_id=None, undo=None, detail=""):
+        with get_conn() as conn:
+            conn.execute(
+                """INSERT INTO agent_actions
+                   (conversation_id, tool_name, target_type, target_id, payload_json,
+                    result_json, status, undo_snapshot_json, executed_by)
+                   VALUES (?,?,?,?,?,?,?,?,?)""",
+                (conversation_id, tool, target_type,
+                 str(target_id) if target_id is not None else None,
+                 json.dumps(args, ensure_ascii=False),
+                 json.dumps(result, ensure_ascii=False, default=str),
+                 status,
+                 json.dumps(undo or {}, ensure_ascii=False),
+                 self.user_id),
+            )
+            conn.commit()
+
+    def _persist_message(self, conversation_id, role, content, *, model="", tokens=0):
+        with get_conn() as conn:
+            conn.execute(
+                "INSERT INTO agent_messages (conversation_id, role, content, model, tokens_used) VALUES (?,?,?,?,?)",
+                (conversation_id, role, content, model, tokens),
+            )
+            conn.commit()
+
+    def _update_conversation(self, conversation_id, *, status=None, title=None):
+        with get_conn() as conn:
+            sets, params = ["updated_at=CURRENT_TIMESTAMP"], []
+            if status:
+                sets.append("status=?")
+                params.append(status)
+            if title:
+                sets.append("title=?")
+                params.append(title)
+            params.append(conversation_id)
+            conn.execute(f"UPDATE agent_conversations SET {', '.join(sets)} WHERE id=?", params)
+            conn.commit()
+
+    # ── Misc ──
+
+    @staticmethod
+    def _event(etype: str, data: dict) -> dict:
+        return {"type": etype, **data}
+
+    @staticmethod
+    def _no_tool_message(response) -> str:
+        return "Je n'ai pas d'action à proposer pour cet objectif. Posez-moi une question plus précise ou demandez-moi de créer un élément."
+
+    @staticmethod
+    def _exc_detail(exc: Exception) -> str:
+        detail = getattr(exc, "detail", None)
+        return detail if isinstance(detail, str) else str(exc)
+
+    # ── Auto-title (v4.14.0) ──
+
+    async def _autotitle(self, conversation_id: int, objective: str, final_text: str | None):
+        """Rename the conversation with a descriptive title derived from the
+        *latest* user request. Runs after every AI call so the history list
+        always reflects the current topic and stays easy to browse."""
+        try:
+            suggested = self._suggest_title(objective, final_text)
+            if suggested:
+                self._update_conversation(conversation_id, title=suggested[:80])
+        except Exception:  # noqa: BLE001 — never break a run because of the title
+            logger.exception("Auto-title failed for conversation #%s", conversation_id)
+
+    @classmethod
+    def _suggest_title(cls, objective: str | None, final_text: str | None) -> str:
+        """Produce a short descriptive title from the user objective (offline-safe)."""
+        text = (objective or "").split("\n# Contexte", 1)[0].strip() or (final_text or "").strip()
+        if not text:
+            return "Conversation"
+        # Strip the composer prefixes ("Contexte « X »", "Skill « Y »") that the
+        # frontend prepends before the real user text.
+        text = re.sub(
+            r"(?:Contexte\s*«[^»]*»|Skill\s*«[^»]*»|Skill\s+«[^»]*»)(?:\s*[,;\n.])+\s*",
+            "", text,
+        ).strip()
+        if not text:
+            return "Conversation"
+        low = text.lower()
+
+        intent = None
+        for label, words in _TITLE_INTENTS:
+            if any(w in low for w in words):
+                intent = label
+                break
+
+        type_label = next(
+            (t for t, _noun, words in _TITLE_TYPES if any(w in low for w in words)), None
+        )
+        has_workspace = any(w in low for w in ("workspace", "espace de travail"))
+        quotes = [q.strip() for q in re.findall(r'[«"]([^«»"]{1,80})[»"]', text) if q.strip()]
+        subject = quotes[0] if quotes else None
+        ws = quotes[-1] if (has_workspace and len(quotes) > 1) else None
+
+        def _clean(s: str) -> str:
+            return re.sub(r"\s+", " ", s).strip(" .;:-")
+
+        if not subject and type_label:
+            noun = next((n for t, n, _w in _TITLE_TYPES if t == type_label), type_label)
+            m = re.search(
+                rf"\b{noun}\b\s*(?:nomm[ée]e?\s+|appel[ée]e?\s+|intitul[ée]e?\s+)?"
+                r'[«"]?\s*([A-Za-zÀ-ÿ0-9][A-Za-zÀ-ÿ0-9_ \-]{1,60}?)\s*[»"]?',
+                text, re.IGNORECASE,
+            )
+            if m:
+                subject = m.group(1).strip()
+
+        if intent and subject:
+            core = f"{intent} {type_label or 'élément'} « {subject} »" \
+                if type_label else f"{intent} « {subject} »"
+            if ws:
+                core += f" (dans {ws})"
+            return _clean(core)
+
+        generic = _clean(text)
+        return generic[:70] if generic else "Conversation"
+
+
+def undo_action(action_id: int) -> bool:
+    """Reverse a single agent action using its stored undo snapshot.
+
+    Returns True on success. Marks the action row `reverted`.
+    """
+    with get_conn() as conn:
+        action = conn.execute("SELECT * FROM agent_actions WHERE id=?", (action_id,)).fetchone()
+        if not action:
+            raise ValueError(f"Action #{action_id} introuvable")
+        undo = json.loads(action["undo_snapshot_json"] or "{}")
+        op, table, rid = undo.get("action"), undo.get("table"), undo.get("id")
+        if not op or not table or rid is None:
+            raise ValueError(f"Action #{action_id} n'a pas de snapshot annulable")
+
+        if op == "delete":
+            conn.execute(f"DELETE FROM {table} WHERE id=?", (rid,))
+        elif op == "softdelete":
+            conn.execute(f"UPDATE {table} SET deleted_at=NULL WHERE id=?", (rid,))
+        elif op == "insert":
+            snapshot = undo.get("snapshot")
+            if not snapshot:
+                raise ValueError("Snapshot manquant pour insert")
+            cols = ", ".join(snapshot.keys())
+            ph = ", ".join("?" for _ in snapshot)
+            conn.execute(f"INSERT INTO {table} ({cols}) VALUES ({ph})", list(snapshot.values()))
+        elif op == "update":
+            snapshot = undo.get("snapshot")
+            if table == "collection_pages":
+                conn.execute(
+                    "UPDATE collection_pages SET property_values_json=?, title=?, updated_at=CURRENT_TIMESTAMP WHERE id=?",
+                    (json.dumps(snapshot, ensure_ascii=False), undo.get("title", ""), rid),
+                )
+            elif table == "pages":
+                if isinstance(snapshot, dict):
+                    conn.execute(
+                        "UPDATE pages SET content=?, content_format=?, title=?, updated_at=CURRENT_TIMESTAMP WHERE id=?",
+                        (snapshot.get("content", ""),
+                         snapshot.get("content_format", "markdown"),
+                         snapshot.get("title", ""), rid),
+                    )
+                else:
+                    conn.execute("UPDATE pages SET content=?, updated_at=CURRENT_TIMESTAMP WHERE id=?",
+                                 (snapshot, rid))
+            else:
+                raise ValueError(f"Table non gérée pour rollback: {table}")
+        else:
+            raise ValueError(f"Opération de rollback inconnue: {op}")
+
+        conn.execute("UPDATE agent_actions SET status='reverted' WHERE id=?", (action_id,))
+        conn.commit()
+    return True