test: A32 phase 2h — dashboard bloqué : 44/44 routes à 0 ref (v7.19.0)

+5 routes dashboard (fichier test_smoke_uncovered.py à 49 tests) :

- Members POST/PUT/DELETE : invitation de soi-même dans un workspace dédié
  (_own_workspace), rôle admin relu en base, membre supprimé (COUNT=0).
  Quirk documenté : les retours tuple des routes (`{"error": ...}, 400`)
  sont sérialisés FastAPI en tableau + 200 → assert sur `[0]["error"]`.
- upload-folder : validations SEULES (structure absente → 400 « No
  structure provided », JSON cassé → 400 « Invalid structure JSON ») —
  zéro fichier écrit, workspace dédié nettoyé.
- convert-to-database : collection + propriété title + vue table + page en
  content_format='collection' VÉRIFIÉS en base, 404 page inconnue,
  cleanup dans l'ordre FK (pages avant collections — IntegrityError corrigée).

Recoupement final : scan des 44 routes strictement à 0 ref de dashboard.py →
TOUTES exercées. Les 19 résidus du scan sont des faux positifs (paths en
f-string dans les tests : /api/workspace/1/…, f"/api/pages/{id}/…", …)
rapprochés manuellement un par un.

Reste A32 : les 6 routes Gitea d'api.py (issues ×4, créations checklists)
→ stub de transport httpx (effort S).

suite **1086/1086** · `ruff check app tests` OK · docs à jour

CHANGELOG.md

@@ -1,5 +1,65 @@
 # Changelog - FlowDeck
 
+## v7.19.0 (2026-10-01) — Audit : A32 : dashboard bloqué (44/44)
+
+### Tests
+
+- +5 routes `dashboard.py` — `test_smoke_uncovered.py` : 49 tests :
+  · **Members** (POST/PUT/DELETE) : invitation de soi-même dans un workspace
+    dédié, rôle relu en base, membre supprimé (`COUNT=0`) ; **quirk documenté**
+    : les retours `(..., 400)` de ces routes sont sérialisés FastAPI en
+    tableau + 200 (`[{"error": "Invalid role"}, 400]`)
+  · `upload-folder` : **validations seules** (structure absente → 400,
+    JSON cassé → 400) — zéro fichier écrit sur disque, workspace dédié nettoyé
+  · `convert-to-database` : collection + propriété `title` + vue `table` +
+    page en `content_format='collection'` **vérifiés en base**, 404 page
+    inconnue, cleanup **dans l'ordre FK** (page avant collection)
+- **Recoupement final** : scan des 44 routes strictement à 0 ref de
+  `dashboard.py` → **toutes exercées** (19 faux positifs résiduels =
+  paths en f-string dans les tests, rapprochés manuellement)
+- Suite complète : **1086/1086**
+
+## v7.18.0 (2026-10-01) — Audit : A32 phase 2g (dashboard +13)
+
+### Tests
+
+- +13 routes `dashboard.py` (cumul **43→56 sur 63**) —
+  `test_smoke_uncovered.py` : 46 tests :
+  · `/gitea-workspace` : page HTML (200 ou redirection propre)
+  · `workspace/projects` GET+POST : shape `{builtin, gitea, github}` avec
+    `github == []`, projet créé **retrouvé dans builtin**, quirk `error` sans
+    nom, nettoyage
+  · **Cycle items local-workspace** (5 routes) : création → renommage **relu en
+    base** → move → soft-delete (`deleted_at` **relu**) → restore
+    (`deleted_at IS NULL` **relu**), nettoyage
+  · **Cycle tags d'item** (5 routes) : POST (nom lowercasé), tags de l'item,
+    liste workspace, search (shape), suppression vérifiée. Utilisateur +
+    workspace **créés dans le test** : `/api/local-workspace/tags` a besoin
+    d'un workspace actif (fallback « premier workspace du user ») — on ne le
+    fait pas dépendre de l'utilisateur fixture partagé, tout est nettoyé
+- Suite complète : **1083/1083**
+
+## v7.17.0 (2026-10-01) — Audit : A32 phase 2f (dashboard +7, garde-fous A16)
+
+### Tests
+
+- +7 routes `dashboard.py` (cumul **36→43 sur 63**), centrées sur les
+  garde-fous A16 — `test_smoke_uncovered.py` : 42 tests :
+  · `GET /api/files/{ws}/{path}` : traversal encodé `%2e%2e%2f` →
+    **403 « Path traversal denied »** ; inexistant → 404 ; vrai fichier écrit
+    dans le data_dir de test → **200 + octets exacts** (nettoyé)
+  · `GET /api/pages/{id}/download` : page markdown → 404 « downloadable »
+    (pas de 500) ; page « file » avec chemin `../` qui sort de la racine →
+    **jamais 200** (404), et `file-content` → 404/415
+  · `GET /api/local-workspace/page-content/{id}` : contenu + format relus,
+    404 sur id inconnu
+  · `GET /api/avatar/{id}` : **302 + Location** avec `follow_redirects=False`
+    (AUCUNE requête réelle vers l'URL externe — règle « 0 réseau »), 404 sans
+    avatar
+  · `GET/POST /api/collections/{id}/table-data|pages` : 404 inconnu, shape,
+    ligne créée **retrouvée dans table-data**, nettoyage finally
+- Suite complète : **1079/1079**
+
 ## v7.16.0 (2026-10-01) — Audit : A32 phase 2e (dashboard +9, comptes)
 
 ### Tests

VERSION

@@ -1 +1 @@
-7.16.0
+7.19.0

WORKLOAD.md

@@ -1,6 +1,6 @@
 # WORKLOAD — FlowDeck Notion Clone
 
-> **Début**: 2026-07-08 | **Version**: v7.16.0 (audit — A32 phase 2e : dashboard +9 routes, comptes A2/A3) | **Statut**: EN COURS 🔄
+> **Début**: 2026-07-08 | **Version**: v7.19.0 (audit — A32 : dashboard 44/44 routes à 0 ref couvertes) | **Statut**: EN COURS 🔄
 > **Cible**: parité Notion + intégration forge · **Follow-ups v7.3 livrés**: sidebar teamspaces, notif `page.updated`, charts `number` + dashboards multi-DB, unfurl forge, UI Settings → Audit — voir `ROADMAP.md § v7.3.0`
 
 ## Avancement Global

app/main.py

@@ -185,7 +185,7 @@ async def lifespan(_app: FastAPI):
 
 app = FastAPI(
     title="FlowDeck",
-    version="7.16.0",
+    version="7.19.0",
     docs_url="/docs",
     redoc_url="/redoc",
     lifespan=lifespan,

docs/openapi-v2.json

@@ -2,7 +2,7 @@
   "openapi": "3.1.0",
   "info": {
     "title": "FlowDeck",
-    "version": "7.16.0"
+    "version": "7.19.0"
   },
   "paths": {
     "/auth/register": {

tests/test_smoke_uncovered.py

@@ -596,6 +596,375 @@ def test_dashboard_settings_account_update(client):
             conn.commit()
 
 
+def _own_workspace(client) -> int:
+    """Workspace appartenant à l'utilisateur de la SESSION (fallback actif)."""
+    from app.db import get_conn
+
+    uid = client.get("/api/users/me").json()["id"]
+    with get_conn() as conn:
+        cur = conn.execute(
+            "INSERT INTO workspaces (name, owner_id) VALUES ('Ws propre A32', ?)", (uid,)
+        )
+        ws_id = cur.lastrowid
+        conn.commit()
+    return ws_id
+
+
+def test_dashboard_members_invite_role_remove(client):
+    """POST invite → PUT role → DELETE : cycle complet vérifié en base."""
+    from app.db import get_conn
+
+    ws_id = _own_workspace(client)
+    me = client.get("/api/users/me").json()
+    try:
+        r = client.post(
+            f"/api/workspace/{ws_id}/members",
+            json={"email": me["login"], "role": "editor"},
+        )
+        assert r.status_code == 200 and r.json()["status"] == "ok"
+        assert r.json()["role"] == "editor"
+
+        # rôle invalide → quirk assumé (retour tuple FastAPI : tableau + 200)
+        inval = client.post(
+            f"/api/workspace/{ws_id}/members", json={"email": me["login"], "role": "hacker"}
+        )
+        assert inval.status_code == 200
+        assert inval.json()[0]["error"] == "Invalid role"
+
+        up = client.put(
+            f"/api/workspace/{ws_id}/members/{me['id']}", json={"role": "admin"}
+        )
+        assert up.status_code == 200 and up.json() == {"status": "ok"}
+        with get_conn() as conn:
+            row = conn.execute(
+                "SELECT role FROM workspace_members WHERE workspace_id=? AND user_id=?",
+                (ws_id, me["id"]),
+            ).fetchone()
+        assert row["role"] == "admin"
+
+        rm = client.delete(f"/api/workspace/{ws_id}/members/{me['id']}")
+        assert rm.json() == {"status": "ok"}
+        with get_conn() as conn:
+            left = conn.execute(
+                "SELECT COUNT(*) AS n FROM workspace_members WHERE workspace_id=? AND user_id=?",
+                (ws_id, me["id"]),
+            ).fetchone()["n"]
+        assert left == 0
+    finally:
+        with get_conn() as conn:
+            conn.execute("DELETE FROM workspace_members WHERE workspace_id=?", (ws_id,))
+            conn.execute("DELETE FROM workspaces WHERE id=?", (ws_id,))
+            conn.commit()
+
+
+def test_dashboard_upload_folder_validation(client):
+    """A22 : validations du dépôt de dossier SANS écrire de fichier."""
+    ws_id = _own_workspace(client)
+    try:
+        # structure absente → 400
+        r = client.post(
+            "/api/local-workspace/upload-folder", data={"parent_id": ""}
+        )
+        assert r.status_code == 400
+        assert r.json()["error"] == "No structure provided"
+        # structure JSON cassée → 400
+        bad = client.post(
+            "/api/local-workspace/upload-folder", data={"structure": "{pas du json"}
+        )
+        assert bad.status_code == 400
+        assert bad.json()["error"] == "Invalid structure JSON"
+    finally:
+        from app.db import get_conn
+
+        with get_conn() as conn:
+            conn.execute("DELETE FROM workspaces WHERE id=?", (ws_id,))
+            conn.commit()
+
+
+def test_dashboard_convert_to_database(client):
+    """Convertit une page en base : collection + propriété Name + vue Table."""
+    from app.db import get_conn
+
+    pid = _seed_page("À convertir A32")
+    collection_id = None
+    try:
+        r = client.post(f"/api/pages/{pid}/convert-to-database", json={})
+        assert r.status_code == 200, r.text
+        d = r.json()
+        assert d["status"] == "converted" and d["view_url"] == f"/pages/{pid}"
+        collection_id = d["collection_id"]
+
+        with get_conn() as conn:
+            page = conn.execute(
+                "SELECT content_format, collection_id FROM pages WHERE id=?", (pid,)
+            ).fetchone()
+            assert page["content_format"] == "collection"
+            assert page["collection_id"] == collection_id
+            coll = conn.execute(
+                "SELECT name FROM collections WHERE id=?", (collection_id,)
+            ).fetchone()
+            assert coll["name"] == d["name"]
+            prop = conn.execute(
+                "SELECT prop_type FROM collection_properties WHERE collection_id=? AND prop_type='title'",
+                (collection_id,),
+            ).fetchone()
+            assert prop is not None
+            view = conn.execute(
+                "SELECT view_type FROM collection_views WHERE collection_id=?",
+                (collection_id,),
+            ).fetchone()
+            assert view["view_type"] == "table"
+
+        # page inconnue → 404
+        assert client.post("/api/pages/999999/convert-to-database", json={}).status_code == 404
+    finally:
+        with get_conn() as conn:
+            # ordre FK : la page référence la collection (pages.collection_id)
+            conn.execute("DELETE FROM pages WHERE id=?", (pid,))
+            if collection_id is not None:
+                conn.execute("DELETE FROM collection_views WHERE collection_id=?", (collection_id,))
+                conn.execute("DELETE FROM collection_properties WHERE collection_id=?", (collection_id,))
+                conn.execute("DELETE FROM collections WHERE id=?", (collection_id,))
+            conn.commit()
+
+
+def test_dashboard_gitea_workspace_page(client):
+    r = client.get("/gitea-workspace")
+    assert r.status_code in (200, 302), r.status_code
+    if r.status_code == 200:
+        assert "text/html" in r.headers["content-type"]
+
+
+def test_dashboard_workspace_projects_crud(client):
+    from app.db import get_conn
+
+    listing = client.get("/api/workspace/projects")
+    assert listing.status_code == 200
+    d = listing.json()
+    assert isinstance(d["builtin"], list) and isinstance(d["gitea"], list)
+    assert d["github"] == []
+    created = client.post("/api/workspace/projects", json={"name": "Projet A32"})
+    assert created.status_code == 200
+    body = created.json()
+    assert body["name"] == "Projet A32" and body["forge"] == "builtin"
+    try:
+        # la page créée est un projet racine → elle apparaît dans builtin
+        names = [p["name"] for p in client.get("/api/workspace/projects").json()["builtin"]]
+        assert "Projet A32" in names
+        vide = client.post("/api/workspace/projects", json={"name": "  "})
+        assert "error" in vide.json()  # quirk : 200 + message
+    finally:
+        with get_conn() as conn:
+            conn.execute("DELETE FROM pages WHERE id=?", (body["id"],))
+            conn.commit()
+
+
+def test_dashboard_local_workspace_item_lifecycle(client):
+    """POST → rename → move → soft-delete → restore (5 routes, vérifié en base)."""
+    from app.db import get_conn
+
+    created = client.post("/api/local-workspace/items", json={"name": "Fichier A32"})
+    assert created.status_code == 200
+    item = created.json()
+    iid = item["id"]
+    try:
+        assert item["name"] == "Fichier A32" and item["type"] == "page"
+        with get_conn() as conn:
+            row = conn.execute("SELECT title FROM pages WHERE id=?", (iid,)).fetchone()
+        assert row["title"] == "Fichier A32"
+
+        assert client.put(
+            f"/api/local-workspace/items/{iid}", json={"name": "Renommé A32"}
+        ).json() == {"status": "ok"}
+        with get_conn() as conn:
+            row = conn.execute("SELECT title FROM pages WHERE id=?", (iid,)).fetchone()
+        assert row["title"] == "Renommé A32"
+
+        assert client.put(
+            f"/api/local-workspace/items/{iid}/move", json={"parent_id": None}
+        ).json() == {"status": "ok"}
+
+        assert client.delete(f"/api/local-workspace/items/{iid}").json() == {"status": "ok"}
+        with get_conn() as conn:
+            row = conn.execute("SELECT deleted_at FROM pages WHERE id=?", (iid,)).fetchone()
+        assert row["deleted_at"] is not None
+
+        assert client.post(f"/api/local-workspace/items/{iid}/restore").json() == {
+            "status": "ok"
+        }
+        with get_conn() as conn:
+            row = conn.execute("SELECT deleted_at FROM pages WHERE id=?", (iid,)).fetchone()
+        assert row["deleted_at"] is None
+    finally:
+        with get_conn() as conn:
+            conn.execute("DELETE FROM pages WHERE id=?", (iid,))
+            conn.commit()
+
+
+def test_dashboard_item_tags_lifecycle(client):
+    """POST tag item → lecture → liste workspace → search → suppression.
+
+    L'utilisateur et son workspace sont créés DANS le test : /tags a besoin
+    d'un workspace actif (fallback « premier workspace du user ») et on ne
+    veut pas que ce workspace appartienne à l'utilisateur fixture partagé.
+    """
+    from app.db import get_conn
+
+    reg = client.post(
+        "/auth/register",
+        json={"email": "[email protected]", "password": "secret123", "name": "taguser"},
+    )
+    assert reg.status_code == 200, reg.text
+    uid = client.get("/api/users/me").json()["id"]
+    with get_conn() as conn:
+        cur = conn.execute(
+            "INSERT INTO workspaces (name, owner_id) VALUES ('Ws A32', ?)", (uid,)
+        )
+        ws_id = cur.lastrowid
+        conn.commit()
+    iid = _seed_page("Item taggé A32")
+    tag_id = None
+    try:
+        created = client.post(
+            f"/api/local-workspace/items/{iid}/tags", json={"name": "UrgentA32"}
+        )
+        assert created.status_code == 200
+        tag_id = created.json()["tag"]["id"]
+        assert created.json()["tag"]["name"] == "urgenta32"  # lowercasé
+
+        item_tags = client.get(f"/api/local-workspace/items/{iid}/tags").json()["tags"]
+        assert any(t["id"] == tag_id for t in item_tags)
+
+        all_tags = client.get("/api/local-workspace/tags")
+        assert all_tags.status_code == 200
+        assert any(t["id"] == tag_id for t in all_tags.json()["tags"])
+
+        search = client.get("/api/local-workspace/tags/search", params={"tags": "urgentA32"})
+        assert search.status_code == 200 and isinstance(search.json()["items"], list)
+
+        assert client.delete(
+            f"/api/local-workspace/items/{iid}/tags/{tag_id}"
+        ).json() == {"status": "ok"}
+        after = client.get(f"/api/local-workspace/items/{iid}/tags").json()["tags"]
+        assert all(t["id"] != tag_id for t in after)
+    finally:
+        with get_conn() as conn:
+            if tag_id is not None:
+                conn.execute("DELETE FROM tags WHERE id=?", (tag_id,))
+            conn.execute("DELETE FROM pages WHERE id=?", (iid,))
+            conn.execute("DELETE FROM workspaces WHERE id=?", (ws_id,))
+            conn.commit()
+
+
+def test_dashboard_files_traversal_denied_and_serve(client):
+    """A16 : /api/files refuse le traversal et sert les vrais fichiers."""
+    import pathlib as _pathlib
+
+    from app.config import settings as _settings
+
+    # traversal encodé (%2e%2e%2f) → décodé par Starlette, bloqué par resolve()
+    r = client.get("/api/files/1/%2e%2e%2f%2e%2e%2fetc/passwd")
+    assert r.status_code == 403
+    assert r.json()["error"] == "Path traversal denied"
+    # inexistant → 404
+    assert client.get("/api/files/1/rien-du-tout.txt").status_code == 404
+    # vrai fichier écrit dans le data_dir de test → 200 + contenu
+    base = _pathlib.Path(_settings.data_dir) / "uploads" / "workspace_1"
+    base.mkdir(parents=True, exist_ok=True)
+    fp = base / "smoke-a32.txt"
+    fp.write_text("bonjour depuis le disque", encoding="utf-8")
+    try:
+        ok = client.get("/api/files/1/smoke-a32.txt")
+        assert ok.status_code == 200
+        assert ok.content == b"bonjour depuis le disque"
+    finally:
+        fp.unlink(missing_ok=True)
+
+
+def test_dashboard_download_and_file_content_guards(client):
+    """A16 : download/file-content sur page fichier avec chemin qui s'échappe."""
+    from app.db import get_conn
+
+    md = _seed_page("Doc A32", content="du markdown")
+    fpage = _seed_page(
+        "Fichier A32", content="../outside.txt", content_format="file"
+    )
+    try:
+        # page markdown → pas de fichier téléchargeable (404 propre, pas de 500)
+        dl = client.get(f"/api/pages/{md}/download")
+        assert dl.status_code == 404 and "downloadable" in dl.json()["error"]
+        # page « file » dont le chemin sort de la racine → ni 200 ni fuite
+        fc = client.get(f"/api/pages/{fpage}/file-content")
+        assert fc.status_code in (404, 415), fc.status_code
+        dl2 = client.get(f"/api/pages/{fpage}/download")
+        assert dl2.status_code == 404
+    finally:
+        with get_conn() as conn:
+            conn.execute("DELETE FROM pages WHERE id IN (?, ?)", (md, fpage))
+            conn.commit()
+
+
+def test_dashboard_page_content_and_avatar_redirect(client):
+    from app.db import get_conn
+
+    pid = _seed_page("Preview A32", content="aperçu a32", content_format="markdown")
+    uid = client.get("/api/users/me").json()["id"]
+    with get_conn() as conn:
+        prev = conn.execute(
+            "SELECT avatar_url FROM users WHERE id=?", (uid,)
+        ).fetchone()["avatar_url"]
+    try:
+        r = client.get(f"/api/local-workspace/page-content/{pid}")
+        assert r.status_code == 200
+        assert r.json() == {"content": "aperçu a32", "format": "markdown"}
+        assert client.get("/api/local-workspace/page-content/999999").status_code == 404
+
+        with get_conn() as conn:
+            conn.execute(
+                "UPDATE users SET avatar_url=? WHERE id=?",
+                ("https://exemple.dev/a.png", uid),
+            )
+            conn.commit()
+        # follow_redirects=False : surtout pas de requête RÉELLE vers l'URL
+        # externe pointée par l'avatar (règle « 0 réseau » de l'audit)
+        red = client.get(f"/api/avatar/{uid}", follow_redirects=False)
+        assert red.status_code == 302
+        assert red.headers["location"] == "https://exemple.dev/a.png"
+        assert client.get("/api/avatar/999999").status_code == 404
+    finally:
+        with get_conn() as conn:
+            conn.execute(
+                "DELETE FROM pages WHERE id=?", (pid,)
+            )
+            conn.execute("UPDATE users SET avatar_url=? WHERE id=?", (prev, uid))
+            conn.commit()
+
+
+def test_dashboard_collection_table_data_and_row_create(client):
+    from app.db import get_conn
+
+    cid = client.post("/db/api", json={"name": "Coll A32"}).json()["id"]
+    try:
+        r = client.get(f"/api/collections/{cid}/table-data")
+        assert r.status_code == 200
+        d = r.json()
+        assert d["collection"]["name"] == "Coll A32"
+        assert d["pages"] == [] and isinstance(d["properties"], list)
+        assert client.get("/api/collections/999999/table-data").status_code == 404
+
+        created = client.post(
+            f"/api/collections/{cid}/pages", json={"title": "Ligne A32"}
+        )
+        assert created.status_code in (200, 201), created.text
+        back = client.get(f"/api/collections/{cid}/table-data").json()["pages"]
+        assert any(p.get("title") == "Ligne A32" for p in back)
+    finally:
+        with get_conn() as conn:
+            conn.execute("DELETE FROM collection_pages WHERE collection_id=?", (cid,))
+            conn.execute("DELETE FROM collections WHERE id=?", (cid,))
+            conn.commit()
+
+
 def test_dashboard_workspace_select_and_breadcrumb(client):
     # select : cookie positionné + shape
     r = client.post("/api/workspaces/1/select")