test: A32 TERMINÉ — 6 routes Gitea stubbées + bug prod fd_icon (v7.20.0)

Les 6 dernières routes d'A32 (api.py, gitea) avec stub de transport — zéro réseau réel : - _stub_gitea() : stubs manuels sur gitea_client.gitea (create_issue, update_issue, update_issue_labels, get_issue, get_issue_comments) avec ÉTAT MUTABLE PARTAGÉ — le handler PATCH re-fetch l'issue via get_issue, un canevas figé aurait masqué la mise à jour. - POST /issues : carte INSÉRÉE sur le board (board seedé par endpoint) ; PATCH : colonne recalculée sans perdre la carte. - GET /issues JSON + HTML : ?format=html requis (le segment /html ne fixe pas le paramètre, le handler le lit dans la query) ; stub qui lève → 404. - POST /checklists + POST /checklist-items : lignes vérifiées en base, 404 sans board ; cleanup (items → checklists). BUG PROD corrigé (trouvé par le smoke HTML) : card_detail.html utilisait la macro fd_icon SANS l'importer → UndefinedError → 500 systématique sur GET /api/issues/...?format=html (seul rendu du template dans le code). Fix : {% from '_icons.html' import fd_icon %}. A32 COMPLET : plus aucun router « 0 test » (webhooks, notes, sidebar_config, github_routes, library, api, dashboard, api_v2 tous couverts). test_smoke_uncovered.py : 52 tests. suite **1089/1089** · ruff OK · docs à jour
test: A32 phase 2h — dashboard bloqué : 44/44 routes à 0 ref (v7.19.0)
2026-10-01 15:39:21 -04:00 · 2026-10-01 15:24:38 -04:00 · 2026-10-01 15:11:45 -04:00 · 2026-10-01 14:40:06 -04:00 · 2026-10-01 13:59:00 -04:00 · 2026-10-01 13:36:56 -04:00
11 changed files with 2001 additions and 500 deletions
@@ -1,5 +1,267 @@
 # Changelog - FlowDeck

+## v7.20.0 (2026-10-01) — Audit : A32 TERMINÉ (routes Gitea + bug fd_icon)
+
+### Fixed
+
+- **Bug prod trouvé par les smokes** : `card_detail.html` appelait la macro
+  `fd_icon` **sans l'importer** → `UndefinedError` → **500 systématique** sur
+  `GET /api/issues/{o}/{r}/{id}?format=html` (seul rendu du template dans le
+  code) → `{% from '_icons.html' import fd_icon %}` ajouté
+
+### Tests
+
+- Les **6 dernières routes d'A32** (Gitea, stub de transport, zéro réseau) :
+  · stubs manuels sur `gitea_client.gitea` avec **état mutable partagé**
+    (le handler PATCH re-fetch l'issue via `get_issue` — un canevas figé
+    aurait masqué la mise à jour)
+  · `POST /issues` : carte **insérée sur le board** ; `PATCH` : colonne
+    recalculée **sans perdre la carte**
+  · `GET /issues` JSON + **HTML** (`?format=html` — le segment `/html` ne fixe
+    pas le paramètre `format`, il est lu dans la query) ; stub qui lève → 404
+  · `POST /checklists` + `POST /checklist-items` : lignes **vérifiées en
+    base**, 404 sans board
+- `test_smoke_uncovered.py` : **52 tests** ; suite complète **1089/1089**
+- **A32 complet** : plus aucun router « 0 test » (webhooks, notes,
+  sidebar_config, github_routes, library, api, dashboard, api_v2)
+
+## v7.19.0 (2026-10-01) — Audit : A32 : dashboard bloqué (44/44)
+
+### Tests
+
+- +5 routes `dashboard.py` — `test_smoke_uncovered.py` : 49 tests :
+  · **Members** (POST/PUT/DELETE) : invitation de soi-même dans un workspace
+    dédié, rôle relu en base, membre supprimé (`COUNT=0`) ; **quirk documenté**
+    : les retours `(..., 400)` de ces routes sont sérialisés FastAPI en
+    tableau + 200 (`[{"error": "Invalid role"}, 400]`)
+  · `upload-folder` : **validations seules** (structure absente → 400,
+    JSON cassé → 400) — zéro fichier écrit sur disque, workspace dédié nettoyé
+  · `convert-to-database` : collection + propriété `title` + vue `table` +
+    page en `content_format='collection'` **vérifiés en base**, 404 page
+    inconnue, cleanup **dans l'ordre FK** (page avant collection)
+- **Recoupement final** : scan des 44 routes strictement à 0 ref de
+  `dashboard.py` → **toutes exercées** (19 faux positifs résiduels =
+  paths en f-string dans les tests, rapprochés manuellement)
+- Suite complète : **1086/1086**
+
+## v7.18.0 (2026-10-01) — Audit : A32 phase 2g (dashboard +13)
+
+### Tests
+
+- +13 routes `dashboard.py` (cumul **43→56 sur 63**) —
+  `test_smoke_uncovered.py` : 46 tests :
+  · `/gitea-workspace` : page HTML (200 ou redirection propre)
+  · `workspace/projects` GET+POST : shape `{builtin, gitea, github}` avec
+    `github == []`, projet créé **retrouvé dans builtin**, quirk `error` sans
+    nom, nettoyage
+  · **Cycle items local-workspace** (5 routes) : création → renommage **relu en
+    base** → move → soft-delete (`deleted_at` **relu**) → restore
+    (`deleted_at IS NULL` **relu**), nettoyage
+  · **Cycle tags d'item** (5 routes) : POST (nom lowercasé), tags de l'item,
+    liste workspace, search (shape), suppression vérifiée. Utilisateur +
+    workspace **créés dans le test** : `/api/local-workspace/tags` a besoin
+    d'un workspace actif (fallback « premier workspace du user ») — on ne le
+    fait pas dépendre de l'utilisateur fixture partagé, tout est nettoyé
+- Suite complète : **1083/1083**
+
+## v7.17.0 (2026-10-01) — Audit : A32 phase 2f (dashboard +7, garde-fous A16)
+
+### Tests
+
+- +7 routes `dashboard.py` (cumul **36→43 sur 63**), centrées sur les
+  garde-fous A16 — `test_smoke_uncovered.py` : 42 tests :
+  · `GET /api/files/{ws}/{path}` : traversal encodé `%2e%2e%2f` →
+    **403 « Path traversal denied »** ; inexistant → 404 ; vrai fichier écrit
+    dans le data_dir de test → **200 + octets exacts** (nettoyé)
+  · `GET /api/pages/{id}/download` : page markdown → 404 « downloadable »
+    (pas de 500) ; page « file » avec chemin `../` qui sort de la racine →
+    **jamais 200** (404), et `file-content` → 404/415
+  · `GET /api/local-workspace/page-content/{id}` : contenu + format relus,
+    404 sur id inconnu
+  · `GET /api/avatar/{id}` : **302 + Location** avec `follow_redirects=False`
+    (AUCUNE requête réelle vers l'URL externe — règle « 0 réseau »), 404 sans
+    avatar
+  · `GET/POST /api/collections/{id}/table-data|pages` : 404 inconnu, shape,
+    ligne créée **retrouvée dans table-data**, nettoyage finally
+- Suite complète : **1079/1079**
+
+## v7.16.0 (2026-10-01) — Audit : A32 phase 2e (dashboard +9, comptes)
+
+### Tests
+
+- +9 routes `dashboard.py` (cumul **27→36 sur 63**) :
+  · `/accounts` + `/accounts/settings` : 200 HTML, **`password_hash` absent**
+    du rendu (whitelist A2 vérifiée côté page)
+  · `PUT /api/user/profile` : persistance **relue en base**, valeur d'origine
+    restaurée en `finally`
+  · `PUT /api/user/password` : **403 « current password is incorrect »** (A3 —
+    la session seule ne change pas le mdp) + quirk assumé et documenté :
+    longueur validée AVANT auth → 200 + message d'erreur
+  · `POST /api/user/token` : format `fd_` + 64 hex, ligne `user_tokens`
+    nettoyée en `finally`
+  · `DELETE /api/user/forge/{provider}` : `{"status": "ok"}`
+  · `PUT /api/settings/account` : full_name/email persistés + **400 sur mdp
+    court** (validateur), restauration en `finally`
+  · `POST /api/workspaces/{id}/select` : `Set-Cookie flowdeck_workspace`
+    vérifié ; `GET /api/local-workspace/breadcrumb` : shape liste
+- `test_smoke_uncovered.py` : 38 tests ; suite complète **1075/1075**
+
+## v7.15.0 (2026-10-01) — Audit : A32 phase 2d (dashboard +10 routes)
+
+### Tests
+
+- Scan strict `dashboard.py` : **44 routes à 0 référence** (sur 63) — 10
+  couvertes cette passe dans `test_smoke_uncovered.py` (32 tests au fichier) :
+  · **Tags CRUD** : création (`SmokeTag` → `smoketag` lowercasé), présence
+    dans la liste, changement de couleur relu, suppression puis absence
+  · **Vie d'une page** : GET `content` (contenu seedé relu) → PUT `rename`
+    (ok + **400 sur titre vide** + titre relu en base) → POST `trash`
+    (`parent_section='Trash'` + `deleted_at` **relus en base**)
+  · `sidebar/workspace-tree` : 200 HTML, fragment « No pages yet » sans cookie
+  · `settings/avatar-color` : couleur relue **sur l'utilisateur de la
+    session** (pas `LIMIT 1`), valeurs d'origine restaurées en `finally`
+  · `workspace/{id}/members` : shape `{"members": [...]}`
+- Helper `_seed_page` : surcharge des colonnes par défaut (`content=`, …)
+- Suite complète : **1069/1069**
+
+## v7.14.0 (2026-10-01) — Audit : A32 phase 2c (api_v2 +5 routes)
+
+### Tests
+
+- Scan strict des 115 routes `api_v2.py` contre tous les tests (chaîne de
+  chemin littérale) → **5 routes à 0 référence**, toutes couvertes :
+  · `POST /properties/evaluate-formula` : 200 + shape, 400 sans `expression`
+    (le moteur renvoie `1 + 2` tel quel aujourd'hui — le smoke valide le câble
+    route/auth/parse, pas le moteur)
+  · `POST /properties/compute-rollup` : 400 `collection_id required`,
+    401 sans bearer
+  · `GET /admin/audit-logs` : portail admin vérifié — attendu **calculé depuis
+    `/users/me`** (le tout premier utilisateur d'un worker est admin, état non
+    contrôlable depuis le test), + token scope `admin` → 200 + `logs` liste
+  · `GET /webhooks/events` : catalogue non vide + wildcards `*`/`page.*`
+  · `POST /webhooks/verify-signature` : **valid=True** avec
+    `sign_payload(secret, payload)` (même helper que le serveur), False avec
+    une signature bidon
+- `test_smoke_uncovered.py` : 27 tests au total
+- Suite complète : **1064/1064**
+
+## v7.13.0 (2026-10-01) — Audit : A32 phase 2b (api.py 16/22)
+
+### Tests
+
+- `api.py` passe de **3 à 16 routes couvertes** (22 `@router` au total) :
+  · `board-config` GET/POST : défauts à 5 colonnes sans board, création puis
+    relecture du roundtrip
+  · `col-mapping` POST/DELETE : 404 sans board, upsert `label` vérifié,
+    suppression vérifiée
+  · `card` POST : 404 sans board, `{"status": "ok"}` avec
+  · `collaborators` GET : **`gitea.get_collaborators` stubbé** (zéro réseau réel)
+  · `frontend-error(s)` : capture, JSON invalide → `ignored`, **dédup** d'une
+    erreur répétée (`count=2`), lecture qui purge (`cleared=true` puis 0)
+  · checklist mutations : PATCH item (checked/content relus EN BASE),
+    DELETE item, DELETE checklist (réapparition `COUNT=0`) — seed + cleanup
+- Reste `api.py` : 6 routes Gitea (issues ×4 + créations checklists) →
+  stub de transport httpx. Reste global : `dashboard.py` 17/63,
+  `api_v2.py` 50/115
+
+### Tests
+
+- Suite complète : **1059/1059** (236 s) ; `test_smoke_uncovered.py` : 22 tests
+
+## v7.12.0 (2026-10-01) — Audit : A32 phase 2a (library 10/10)
+
+### Tests
+
+- `library.py` passe de **1/10 à 8 routes couvertes** : les 5 listes
+  (recents/favorites/published/private/workspace) en un test de boucle,
+  `/private` avec une page seedée et retrouvée, `/children/{id}` avec un
+  parent/enfant seedés (titre retrouvé), `/repository` vide et clé
+  (aucun appel réseau — la clé n'est qu'une string de workspace)
+- Test de non-régression 404 sur les 2 routes supprimées
+
+### Removed
+
+- **2 routes cassées supprimées** (découverte des smokes) :
+  `/api/library/local-workspace-children/{id}` renvoyait un 500 systématique
+  et `/api/library/local-workspace` un 500 dès qu'un workspace existait —
+  les deux lisaient `local_workspace_items`, **une table qui n'est créée nulle
+  part** dans le codebase (grep : 0 `CREATE TABLE`), avec **0 référence front**.
+  `library._format_size` devenu mort : supprimé aussi (une version vit dans
+  `dashboard.py`, inchangée)
+- `local_workspace_items` : plus aucune occurrence dans `app/`
+
+### Tests
+
+- Suite complète : **1053/1053** (229 s) ; `test_smoke_uncovered.py` : 16 tests
+
+## v7.11.0 (2026-10-01) — Audit : A32 phase 1 (routers à 0 test)
+
+### Tests
+
+- `tests/test_smoke_uncovered.py` — **10 smoke tests**, un par route des 4
+  routers qui n'avaient AUCUN test :
+  · `webhooks.py` (3/3) : réception sans secret → `{"status":"ok"}` ;
+  HMAC faux → 401 (secret piloté par monkeypatch) ; register sans secret →
+  400 **avant** tout appel réseau ; status avec `gitea.list_webhooks` stubbé
+  (zéro accès réseau réel)
+  · `notes.py` (2/2) : GET HTML + roundtrip POST→GET (upsert persisté,
+  échappement HTML vérifié `&lt;b&gt;`)
+  · `sidebar_config.py` (2/2) : GET défauts, PUT persisté relu depuis
+  `users.sidebar_config`, 400 sans `config`, remise en état en fin de test
+  · `github_routes.py` (2/2) : status `{"linked": False}`, disconnect ok
+- Reste (phase 2) : quasi nuls — `library.py` 1/10, `api.py` 3/23,
+  `dashboard.py` 17/63, `api_v2.py` 50/115
+- Suite complète : **1047/1047**
+
+## v7.10.0 (2026-10-01) — Audit : A21 phase 2b (api_v2 bouclé)
+
+### Changed
+
+- **Helper** `run_event_sync(coro)` (`app/services/automations.py`) : exécute
+  une coroutine d'événement depuis un handler synchrone — `asyncio.run` sur une
+  boucle dédiée dans le **worker threadpool** : bloqué = le worker, jamais la
+  boucle d'event, et la réponse n'est envoyée qu'une fois l'événement terminé
+  (déterministe, équivalent sémantique de l'`await` d'avant). Note
+  `ponytail:` : clients httpx créés à chaque appel partout → aucun lien de
+  boucle ; sinon `run_coroutine_threadsafe` + boucle du lifespan
+- **A21 (phase 2b)** — 15 routes `api_v2` dont les seuls awaits étaient
+  `request.json` / `_fire_event` / `fire_published` / `fire_unpublished` →
+  paramètre `Body(default={})` + `run_event_sync(...)` + conversion en `def`
+- **`api_v2` : 111/115 routes hors event loop** — il ne reste que 4 routes
+  async, toutes avec de vrais awaits réseau : `import_csv_v2` (multipart),
+  `project_tree_v2` (gitea), `test_webhook_v2`, `retry_webhook_deliveries`
+- Repo-wide : **403 routes synchrones (hors loop) / 260 async** (phase 2c)
+
+### Tests
+
+- Ciblé (public_api_v2 + v65 + webhooks_v2 + audit) : 90/90 — les webhooks
+  prouvent la détermination de `run_event_sync` ; suite complète **1037/1037**
+  en 228 s
+
+## v7.9.0 (2026-10-01) — Audit : A21 phase 2a (api_v2 hors loop)
+
+### Changed
+
+- **A21 (phase 2a)** — dans `api_v2`, les 36 routes dont le **seul** `await`
+  était `body = await request.json()` passent à un paramètre FastAPI
+  `body: dict = Body(default={})` (parsing async fait par FastAPI avant
+  l'appel) puis sont converties en `def` → threadpool. Équivalences vérifiées
+  avant-engagement : corps absent → `{}` (identique au `try/except` d'avant),
+  JSON invalide → **422** (avant : traité silencieusement comme `{}`),
+  zéro `body[...] = ` dans le fichier (le défaut partagé n'est jamais muté)
+- `api_v2` : **96/115 routes hors event loop** (60 en phase 1 + 36 ici) ;
+  il ne reste que **19 routes async** dans ce router (`fire_event`,
+  `request.form`, appels gitea/webhooks — phase 2b)
+- Bug de transformation évité en cours de route : première version du script
+  supprimait 5 lignes au lieu de 4 (`slice` fermant d'un cran trop loin) —
+  fichier restauré depuis git puis script corrigé, 0 ligne perdue (diff
+  logique : +39/-183 = 36 signatures + import, 4 lignes de try/except × 35)
+
+### Tests
+
+- Suite complète **1037/1037** (242 s) ; ciblée sur `test_public_api_v2` +
+  `test_v65` + audit : 62/62 verts avant la passe complète
+
 ## v7.8.0 (2026-10-01) — Audit : A21 phase 1 (SQLite hors event loop)

 ### Changed
@@ -1 +1 @@
-7.8.0
+7.20.0
@@ -1,6 +1,6 @@
 # WORKLOAD — FlowDeck Notion Clone

-> **Début**: 2026-07-08 | **Version**: v7.8.0 (audit — A21 phase 1 : 352 routes hors loop) | **Statut**: EN COURS 🔄
+> **Début**: 2026-07-08 | **Version**: v7.20.0 (audit — A32 TERMINÉ : routes Gitea stubbées + bug fd_icon) | **Statut**: EN COURS 🔄
 > **Cible**: parité Notion + intégration forge · **Follow-ups v7.3 livrés**: sidebar teamspaces, notif `page.updated`, charts `number` + dashboards multi-DB, unfurl forge, UI Settings → Audit — voir `ROADMAP.md § v7.3.0`

 ## Avancement Global
@@ -185,7 +185,7 @@ async def lifespan(_app: FastAPI):

 app = FastAPI(
    title="FlowDeck",
-    version="7.8.0",
+    version="7.20.0",
    docs_url="/docs",
    redoc_url="/redoc",
    lifespan=lifespan,
@@ -12,7 +12,7 @@ import logging
 import secrets
 from datetime import datetime

-from fastapi import APIRouter, Header, HTTPException, Request
+from fastapi import APIRouter, Body, Header, HTTPException, Request
 from fastapi.responses import JSONResponse, Response

 from app.db import get_conn
@@ -31,6 +31,7 @@ from app.services.api_v2_helpers import (  # noqa: F401 — require_scope est ut
    validate_scopes_input,
 )
 from app.services.automations import fire_event as _fire_event
+from app.services.automations import run_event_sync
 from app.services.publish import fire_published, fire_unpublished, publish, unpublish

 logger = logging.getLogger(__name__)
@@ -48,13 +49,9 @@ def _v2_rate_check(request: Request, user: dict) -> None:
 # ── Tokens ────────────────────────────────────────────────────────────────

@router.post("/tokens")
-async def create_token(request: Request, authorization: str | None = Header(default=None)):
+def create_token(request: Request, authorization: str | None = Header(default=None), body: dict = Body(default={})):
    user = require_scope("write")(request, authorization)
    _v2_rate_check(request, user)
-    try:
-        body = await request.json()
-    except Exception:
-        body = {}
    name = (body.get("name") or "API token").strip()[:100]
    scopes = validate_scopes_input(body.get("scopes") or "read,write")
    expires_at = body.get("expires_at")
@@ -166,13 +163,9 @@ def get_me(request: Request, authorization: str | None = Header(default=None)):
        return d

@router.patch("/users/me")
-async def patch_me(request: Request, authorization: str | None = Header(default=None)):
+def patch_me(request: Request, authorization: str | None = Header(default=None), body: dict = Body(default={})):
    user = require_scope("write")(request, authorization)
    _v2_rate_check(request, user)
-    try:
-        body = await request.json()
-    except Exception:
-        body = {}
    allowed = {"full_name", "email", "avatar_color", "notification_prefs", "sidebar_config", "timezone"}
    updates = {}
    for k in allowed:
@@ -232,16 +225,12 @@ def list_workspaces(request: Request, authorization: str | None = Header(default
    return {"workspaces": out, "total": total, "limit": limit, "offset": offset}

@router.post("/workspaces")
-async def create_workspace(request: Request, authorization: str | None = Header(default=None)):
+def create_workspace(request: Request, authorization: str | None = Header(default=None), body: dict = Body(default={})):
    user = require_scope("write")(request, authorization)
    _v2_rate_check(request, user)
    idem = check_idempotency(request, user["id"])
    if idem:
        return JSONResponse(content=idem["data"], status_code=idem["status"])
-    try:
-        body = await request.json()
-    except Exception:
-        body = {}
    name = (body.get("name") or "").strip()
    if not name:
        raise HTTPException(400, "name is required")
@@ -282,13 +271,9 @@ def get_workspace(workspace_id: int, request: Request, authorization: str | None
    return d

@router.patch("/workspaces/{workspace_id}")
-async def patch_workspace(workspace_id: int, request: Request, authorization: str | None = Header(default=None)):
+def patch_workspace(workspace_id: int, request: Request, authorization: str | None = Header(default=None), body: dict = Body(default={})):
    user = require_scope("write")(request, authorization)
    _v2_rate_check(request, user)
-    try:
-        body = await request.json()
-    except Exception:
-        body = {}
    with get_conn() as conn:
        row = conn.execute("SELECT * FROM workspaces WHERE id=?", (workspace_id,)).fetchone()
        if not row:
@@ -336,13 +321,9 @@ def list_workspace_members(workspace_id: int, request: Request, authorization: s
    return {"members": [row_to_dict(r) for r in rows]}

@router.post("/workspaces/{workspace_id}/members")
-async def invite_member(workspace_id: int, request: Request, authorization: str | None = Header(default=None)):
+def invite_member(workspace_id: int, request: Request, authorization: str | None = Header(default=None), body: dict = Body(default={})):
    user = require_scope("write")(request, authorization)
    _v2_rate_check(request, user)
-    try:
-        body = await request.json()
-    except Exception:
-        body = {}
    target_id = body.get("user_id") or body.get("uid")
    email = (body.get("email") or "").strip()
    role = (body.get("role") or "editor").strip().lower()
@@ -374,13 +355,9 @@ async def invite_member(workspace_id: int, request: Request, authorization: str
    return {"workspace_id": workspace_id, "user_id": uid, "role": role, "status": "added"}

@router.patch("/workspaces/{workspace_id}/members/{uid}")
-async def update_member_role(workspace_id: int, uid: int, request: Request, authorization: str | None = Header(default=None)):
+def update_member_role(workspace_id: int, uid: int, request: Request, authorization: str | None = Header(default=None), body: dict = Body(default={})):
    user = require_scope("write")(request, authorization)
    _v2_rate_check(request, user)
-    try:
-        body = await request.json()
-    except Exception:
-        body = {}
    role = (body.get("role") or "").strip().lower()
    if role not in ("owner", "admin", "editor", "viewer", "commenter"):
        raise HTTPException(400, "Invalid role")
@@ -451,16 +428,12 @@ def list_collections_v2(request: Request, authorization: str | None = Header(def
    return JSONResponse(content=resp, headers=paginate_headers(total))

@router.post("/collections")
-async def create_collection_v2(request: Request, authorization: str | None = Header(default=None)):
+def create_collection_v2(request: Request, authorization: str | None = Header(default=None), body: dict = Body(default={})):
    user = require_scope("write")(request, authorization)
    _v2_rate_check(request, user)
    idem = check_idempotency(request, user["id"])
    if idem:
        return JSONResponse(content=idem["data"], status_code=idem["status"])
-    try:
-        body = await request.json()
-    except Exception:
-        body = {}
    name = (body.get("name") or "").strip()
    if not name:
        raise HTTPException(400, "name is required")
@@ -507,13 +480,9 @@ def get_collection_v2(collection_id: int, request: Request, authorization: str |
    return d

@router.patch("/collections/{collection_id}")
-async def patch_collection_v2(collection_id: int, request: Request, authorization: str | None = Header(default=None)):
+def patch_collection_v2(collection_id: int, request: Request, authorization: str | None = Header(default=None), body: dict = Body(default={})):
    user = require_scope("write")(request, authorization)
    _v2_rate_check(request, user)
-    try:
-        body = await request.json()
-    except Exception:
-        body = {}
    with get_conn() as conn:
        row = conn.execute("SELECT * FROM collections WHERE id=?", (collection_id,)).fetchone()
        if not row:
@@ -545,13 +514,9 @@ def delete_collection_v2(collection_id: int, request: Request, authorization: st
    return {"id": collection_id, "status": "deleted"}

@router.post("/collections/{collection_id}/linked")
-async def create_linked_db(collection_id: int, request: Request, authorization: str | None = Header(default=None)):
+def create_linked_db(collection_id: int, request: Request, authorization: str | None = Header(default=None), body: dict = Body(default={})):
    user = require_scope("write")(request, authorization)
    _v2_rate_check(request, user)
-    try:
-        body = await request.json()
-    except Exception:
-        body = {}
    name = (body.get("name") or "").strip() or f"Linked DB {collection_id}"
    with get_conn() as conn:
        src = conn.execute("SELECT * FROM collections WHERE id=?", (collection_id,)).fetchone()
@@ -607,13 +572,9 @@ def list_sources(collection_id: int, request: Request, authorization: str | None
    return {"sources": [dict(r) for r in rows]}

@router.post("/collections/{collection_id}/sources")
-async def add_source(collection_id: int, request: Request, authorization: str | None = Header(default=None)):
+def add_source(collection_id: int, request: Request, authorization: str | None = Header(default=None), body: dict = Body(default={})):
    user = require_scope("write")(request, authorization)
    _v2_rate_check(request, user)
-    try:
-        body = await request.json()
-    except Exception:
-        body = {}
    src_id = body.get("source_collection_id") or body.get("source_id")
    if not src_id:
        raise HTTPException(400, "source_collection_id required")
@@ -701,16 +662,12 @@ def list_collection_pages_v2(collection_id: int, request: Request, authorization
    return JSONResponse(content={"pages": out, "total": total, "limit": limit, "offset": offset}, headers=paginate_headers(total))

@router.post("/collections/{collection_id}/pages")
-async def create_collection_page_v2(collection_id: int, request: Request, authorization: str | None = Header(default=None)):
+def create_collection_page_v2(collection_id: int, request: Request, authorization: str | None = Header(default=None), body: dict = Body(default={})):
    user = require_scope("write")(request, authorization)
    _v2_rate_check(request, user)
    idem = check_idempotency(request, user["id"])
    if idem:
        return JSONResponse(content=idem["data"], status_code=idem["status"])
-    try:
-        body = await request.json()
-    except Exception:
-        body = {}
    title = (body.get("title") or body.get("name") or "Untitled").strip() or "Untitled"
    icon = body.get("icon", "file")
    parent_id = body.get("parent_id")
@@ -743,7 +700,7 @@ async def create_collection_page_v2(collection_id: int, request: Request, author
        row = conn.execute("SELECT * FROM collection_pages WHERE id=?", (pid,)).fetchone()
    audit_log(user, "page.create", "collection_page", pid, title, request)
    try:
-        await _fire_event("collection.page.created", {"page_id": pid, "collection_id": collection_id, "title": title})
+        run_event_sync(_fire_event("collection.page.created", {"page_id": pid, "collection_id": collection_id, "title": title}))
    except Exception:
        logger.exception("create_collection_page_v2")
    data = {"id": pid, "title": title, "status": "created", "page": row_to_dict(row)}
@@ -781,13 +738,9 @@ def get_page_v2(page_id: int, request: Request, authorization: str | None = Head
        return d

@router.patch("/pages/{page_id}")
-async def patch_page_v2(page_id: int, request: Request, authorization: str | None = Header(default=None)):
+def patch_page_v2(page_id: int, request: Request, authorization: str | None = Header(default=None), body: dict = Body(default={})):
    user = require_scope("write")(request, authorization)
    _v2_rate_check(request, user)
-    try:
-        body = await request.json()
-    except Exception:
-        body = {}
    with get_conn() as conn:
        row = conn.execute("SELECT * FROM collection_pages WHERE id=?", (page_id,)).fetchone()
        if not row:
@@ -822,13 +775,13 @@ async def patch_page_v2(page_id: int, request: Request, authorization: str | Non
        conn.commit()
    audit_log(user, "page.update", "collection_page", page_id, "", request)
    try:
-        await _fire_event("collection.page.updated", {"page_id": page_id, "collection_id": row["collection_id"], "title": title})
+        run_event_sync(_fire_event("collection.page.updated", {"page_id": page_id, "collection_id": row["collection_id"], "title": title}))
    except Exception:
        logger.exception("patch_page_v2")
    return {"id": page_id, "status": "updated"}

@router.delete("/pages/{page_id}")
-async def delete_page_v2(page_id: int, request: Request, authorization: str | None = Header(default=None)):
+def delete_page_v2(page_id: int, request: Request, authorization: str | None = Header(default=None)):
    user = require_scope("write")(request, authorization)
    _v2_rate_check(request, user)
    with get_conn() as conn:
@@ -839,13 +792,13 @@ async def delete_page_v2(page_id: int, request: Request, authorization: str | No
        conn.commit()
    audit_log(user, "page.delete", "collection_page", page_id, "", request)
    try:
-        await _fire_event("collection.page.deleted", {"page_id": page_id, "collection_id": row["collection_id"]})
+        run_event_sync(_fire_event("collection.page.deleted", {"page_id": page_id, "collection_id": row["collection_id"]}))
    except Exception:
        logger.exception("delete_page_v2")
    return {"id": page_id, "status": "deleted"}

@router.post("/pages/{page_id}/restore")
-async def restore_page_v2(page_id: int, request: Request, authorization: str | None = Header(default=None)):
+def restore_page_v2(page_id: int, request: Request, authorization: str | None = Header(default=None)):
    user = require_scope("write")(request, authorization)
    _v2_rate_check(request, user)
    # For soft-deleted pages (deleted_at) - but collection_pages has no deleted_at; handle pages table
@@ -855,20 +808,16 @@ async def restore_page_v2(page_id: int, request: Request, authorization: str | N
            conn.execute("UPDATE pages SET deleted_at=NULL WHERE id=?", (page_id,))
            conn.commit()
            try:
-                await _fire_event("page.restored", {"page_id": page_id})
+                run_event_sync(_fire_event("page.restored", {"page_id": page_id}))
            except Exception:
                logger.exception("restore_page_v2")
            return {"id": page_id, "status": "restored"}
        raise HTTPException(404, "Page not found or not deleted")

@router.post("/pages/{page_id}/move")
-async def move_page_v2(page_id: int, request: Request, authorization: str | None = Header(default=None)):
+def move_page_v2(page_id: int, request: Request, authorization: str | None = Header(default=None), body: dict = Body(default={})):
    user = require_scope("write")(request, authorization)
    _v2_rate_check(request, user)
-    try:
-        body = await request.json()
-    except Exception:
-        body = {}
    with get_conn() as conn:
        row = conn.execute("SELECT * FROM collection_pages WHERE id=?", (page_id,)).fetchone()
        if not row:
@@ -891,13 +840,9 @@ def list_sub_items_v2(page_id: int, request: Request, authorization: str | None
    return {"sub_items": [row_to_dict(r) for r in rows]}

@router.post("/pages/{page_id}/sub-items")
-async def create_sub_item_v2(page_id: int, request: Request, authorization: str | None = Header(default=None)):
+def create_sub_item_v2(page_id: int, request: Request, authorization: str | None = Header(default=None), body: dict = Body(default={})):
    user = require_scope("write")(request, authorization)
    _v2_rate_check(request, user)
-    try:
-        body = await request.json()
-    except Exception:
-        body = {}
    with get_conn() as conn:
        parent = conn.execute("SELECT collection_id FROM collection_pages WHERE id=?", (page_id,)).fetchone()
        if not parent:
@@ -920,13 +865,9 @@ def list_dependencies_v2(page_id: int, request: Request, authorization: str | No
    return {"dependencies": [dict(r) for r in rows]}

@router.post("/pages/{page_id}/dependencies")
-async def add_dependency_v2(page_id: int, request: Request, authorization: str | None = Header(default=None)):
+def add_dependency_v2(page_id: int, request: Request, authorization: str | None = Header(default=None), body: dict = Body(default={})):
    user = require_scope("write")(request, authorization)
    _v2_rate_check(request, user)
-    try:
-        body = await request.json()
-    except Exception:
-        body = {}
    dep_id = body.get("dependency_id") or body.get("depends_on")
    dtype = body.get("dependency_type") or "blocks"
    if not dep_id:
@@ -967,13 +908,9 @@ def list_properties_v2(collection_id: int, request: Request, authorization: str
    return {"properties": [row_to_dict(r) for r in rows]}

@router.post("/collections/{collection_id}/properties")
-async def create_property_v2(collection_id: int, request: Request, authorization: str | None = Header(default=None)):
+def create_property_v2(collection_id: int, request: Request, authorization: str | None = Header(default=None), body: dict = Body(default={})):
    user = require_scope("write")(request, authorization)
    _v2_rate_check(request, user)
-    try:
-        body = await request.json()
-    except Exception:
-        body = {}
    name = (body.get("name") or "").strip()
    if not name:
        raise HTTPException(400, "name is required")
@@ -992,13 +929,9 @@ async def create_property_v2(collection_id: int, request: Request, authorization
    return {"id": pid, "name": name, "prop_type": ptype, "status": "created"}

@router.patch("/properties/{prop_id}")
-async def patch_property_v2(prop_id: int, request: Request, authorization: str | None = Header(default=None)):
+def patch_property_v2(prop_id: int, request: Request, authorization: str | None = Header(default=None), body: dict = Body(default={})):
    user = require_scope("write")(request, authorization)
    _v2_rate_check(request, user)
-    try:
-        body = await request.json()
-    except Exception:
-        body = {}
    with get_conn() as conn:
        row = conn.execute("SELECT * FROM collection_properties WHERE id=?", (prop_id,)).fetchone()
        if not row:
@@ -1028,13 +961,9 @@ def delete_property_v2(prop_id: int, request: Request, authorization: str | None
    return {"id": prop_id, "status": "deleted"}

@router.post("/properties/{prop_id}/relation")
-async def create_relation_v2(prop_id: int, request: Request, authorization: str | None = Header(default=None)):
+def create_relation_v2(prop_id: int, request: Request, authorization: str | None = Header(default=None), body: dict = Body(default={})):
    user = require_scope("write")(request, authorization)
    _v2_rate_check(request, user)
-    try:
-        body = await request.json()
-    except Exception:
-        body = {}
    related_id = body.get("related_collection_id")
    reverse = (body.get("reverse_name") or "").strip()
    if not related_id:
@@ -1054,13 +983,9 @@ async def create_relation_v2(prop_id: int, request: Request, authorization: str
    return {"id": prop_id, "status": "updated"}

@router.post("/properties/evaluate-formula")
-async def evaluate_formula_v2(request: Request, authorization: str | None = Header(default=None)):
+def evaluate_formula_v2(request: Request, authorization: str | None = Header(default=None), body: dict = Body(default={})):
    user = get_bearer_user(request, authorization)
    _v2_rate_check(request, user)
-    try:
-        body = await request.json()
-    except Exception:
-        body = {}
    expr = body.get("expression") or body.get("formula")
    if not expr:
        raise HTTPException(400, "expression required")
@@ -1073,13 +998,9 @@ async def evaluate_formula_v2(request: Request, authorization: str | None = Head
    return {"result": res, "expression": expr}

@router.post("/properties/compute-rollup")
-async def compute_rollup_v2(request: Request, authorization: str | None = Header(default=None)):
+def compute_rollup_v2(request: Request, authorization: str | None = Header(default=None), body: dict = Body(default={})):
    user = get_bearer_user(request, authorization)
    _v2_rate_check(request, user)
-    try:
-        body = await request.json()
-    except Exception:
-        body = {}
    for k in ("collection_id", "relation_property_id", "target_property_id", "page_id"):
        if k not in body:
            raise HTTPException(400, f"{k} required")
@@ -1101,13 +1022,9 @@ def list_views_v2(collection_id: int, request: Request, authorization: str | Non
    return {"views": [row_to_dict(r) for r in rows]}

@router.post("/collections/{collection_id}/views")
-async def create_view_v2(collection_id: int, request: Request, authorization: str | None = Header(default=None)):
+def create_view_v2(collection_id: int, request: Request, authorization: str | None = Header(default=None), body: dict = Body(default={})):
    user = require_scope("write")(request, authorization)
    _v2_rate_check(request, user)
-    try:
-        body = await request.json()
-    except Exception:
-        body = {}
    name = (body.get("name") or "New View").strip()
    vtype = body.get("view_type") or body.get("type") or "table"
    config = body.get("config") or body.get("config_json") or {}
@@ -1120,19 +1037,15 @@ async def create_view_v2(collection_id: int, request: Request, authorization: st
        conn.commit()
    audit_log(user, "view.create", "view", vid, name, request)
    try:
-        await _fire_event("collection.view.created", {"view_id": vid, "collection_id": collection_id, "name": name, "view_type": vtype})
+        run_event_sync(_fire_event("collection.view.created", {"view_id": vid, "collection_id": collection_id, "name": name, "view_type": vtype}))
    except Exception:
        logger.exception("create_view_v2")
    return {"id": vid, "name": name, "view_type": vtype, "status": "created"}

@router.patch("/views/{view_id}")
-async def patch_view_v2(view_id: int, request: Request, authorization: str | None = Header(default=None)):
+def patch_view_v2(view_id: int, request: Request, authorization: str | None = Header(default=None), body: dict = Body(default={})):
    user = require_scope("write")(request, authorization)
    _v2_rate_check(request, user)
-    try:
-        body = await request.json()
-    except Exception:
-        body = {}
    with get_conn() as conn:
        row = conn.execute("SELECT * FROM collection_views WHERE id=?", (view_id,)).fetchone()
        if not row:
@@ -1169,13 +1082,9 @@ def delete_view_v2(view_id: int, request: Request, authorization: str | None = H
    return {"id": view_id, "status": "deleted"}

@router.post("/views/{view_id}/save-as")
-async def save_as_view_v2(view_id: int, request: Request, authorization: str | None = Header(default=None)):
+def save_as_view_v2(view_id: int, request: Request, authorization: str | None = Header(default=None), body: dict = Body(default={})):
    user = require_scope("write")(request, authorization)
    _v2_rate_check(request, user)
-    try:
-        body = await request.json()
-    except Exception:
-        body = {}
    name = (body.get("name") or "").strip() or "Copy"
    with get_conn() as conn:
        row = conn.execute("SELECT * FROM collection_views WHERE id=?", (view_id,)).fetchone()
@@ -1196,13 +1105,9 @@ def list_dashboards_v2(collection_id: int, request: Request, authorization: str
    return {"dashboards": [row_to_dict(r) for r in rows]}

@router.post("/collections/{collection_id}/dashboards")
-async def create_dashboard_v2(collection_id: int, request: Request, authorization: str | None = Header(default=None)):
+def create_dashboard_v2(collection_id: int, request: Request, authorization: str | None = Header(default=None), body: dict = Body(default={})):
    user = require_scope("write")(request, authorization)
    _v2_rate_check(request, user)
-    try:
-        body = await request.json()
-    except Exception:
-        body = {}
    name = (body.get("name") or "Dashboard").strip()
    layout = body.get("layout") or body.get("layout_json") or {"columns": 1, "widgets": []}
    with get_conn() as conn:
@@ -1212,13 +1117,9 @@ async def create_dashboard_v2(collection_id: int, request: Request, authorizatio
    return {"id": did, "name": name, "status": "created"}

@router.patch("/dashboards/{dashboard_id}")
-async def patch_dashboard_v2(dashboard_id: int, request: Request, authorization: str | None = Header(default=None)):
+def patch_dashboard_v2(dashboard_id: int, request: Request, authorization: str | None = Header(default=None), body: dict = Body(default={})):
    user = require_scope("write")(request, authorization)
    _v2_rate_check(request, user)
-    try:
-        body = await request.json()
-    except Exception:
-        body = {}
    with get_conn() as conn:
        row = conn.execute("SELECT * FROM collection_dashboards WHERE id=?", (dashboard_id,)).fetchone()
        if not row:
@@ -1255,13 +1156,9 @@ def list_comments_v2(page_id: int, request: Request, authorization: str | None =
    return {"comments": [row_to_dict(r) for r in rows], "total": total, "limit": limit, "offset": offset}

@router.post("/pages/{page_id}/comments")
-async def create_comment_v2(page_id: int, request: Request, authorization: str | None = Header(default=None)):
+def create_comment_v2(page_id: int, request: Request, authorization: str | None = Header(default=None), body: dict = Body(default={})):
    user = require_scope("write")(request, authorization)
    _v2_rate_check(request, user)
-    try:
-        body = await request.json()
-    except Exception:
-        body = {}
    text = (body.get("body") or body.get("content") or "").strip()
    if not text:
        raise HTTPException(400, "body is required")
@@ -1272,19 +1169,15 @@ async def create_comment_v2(page_id: int, request: Request, authorization: str |
        row = conn.execute("SELECT * FROM comments WHERE id=?", (nid,)).fetchone()
    audit_log(user, "comment.create", "comment", nid, text[:80], request)
    try:
-        await _fire_event("comment.added", {"comment_id": nid, "page_id": page_id, "user_id": user["id"]})
+        run_event_sync(_fire_event("comment.added", {"comment_id": nid, "page_id": page_id, "user_id": user["id"]}))
    except Exception:
        logger.exception("create_comment_v2")
    return {"id": nid, "status": "created", "comment": row_to_dict(row)}

@router.patch("/comments/{comment_id}")
-async def patch_comment_v2(comment_id: int, request: Request, authorization: str | None = Header(default=None)):
+def patch_comment_v2(comment_id: int, request: Request, authorization: str | None = Header(default=None), body: dict = Body(default={})):
    user = require_scope("write")(request, authorization)
    _v2_rate_check(request, user)
-    try:
-        body = await request.json()
-    except Exception:
-        body = {}
    with get_conn() as conn:
        row = conn.execute("SELECT * FROM comments WHERE id=?", (comment_id,)).fetchone()
        if not row:
@@ -1298,7 +1191,7 @@ async def patch_comment_v2(comment_id: int, request: Request, authorization: str
        conn.commit()
    if int(bool(resolved)) and not was_resolved:
        try:
-            await _fire_event("comment.resolved", {"comment_id": comment_id, "page_id": row["page_id"]})
+            run_event_sync(_fire_event("comment.resolved", {"comment_id": comment_id, "page_id": row["page_id"]}))
        except Exception:
            logger.exception("patch_comment_v2")
    return {"id": comment_id, "status": "updated"}
@@ -1318,13 +1211,9 @@ def delete_comment_v2(comment_id: int, request: Request, authorization: str | No
    return {"id": comment_id, "status": "deleted"}

@router.post("/pages/{page_id}/mentions")
-async def create_mention_v2(page_id: int, request: Request, authorization: str | None = Header(default=None)):
+def create_mention_v2(page_id: int, request: Request, authorization: str | None = Header(default=None), body: dict = Body(default={})):
    user = require_scope("write")(request, authorization)
    _v2_rate_check(request, user)
-    try:
-        body = await request.json()
-    except Exception:
-        body = {}
    targets = body.get("user_ids") or body.get("mentions") or []
    if isinstance(targets, int):
        targets = [targets]
@@ -1341,7 +1230,7 @@ async def create_mention_v2(page_id: int, request: Request, authorization: str |
        conn.commit()
    if created:
        try:
-            await _fire_event("mention.added", {"page_id": page_id, "user_ids": [u for u in targets if isinstance(u, int)], "count": created})
+            run_event_sync(_fire_event("mention.added", {"page_id": page_id, "user_ids": [u for u in targets if isinstance(u, int)], "count": created}))
        except Exception:
            logger.exception("create_mention_v2")
    return {"mentions": created, "status": "created"}
@@ -1390,13 +1279,9 @@ def mark_all_read(request: Request, authorization: str | None = Header(default=N
    return {"status": "all read"}

@router.patch("/users/me/preferences")
-async def patch_prefs(request: Request, authorization: str | None = Header(default=None)):
+def patch_prefs(request: Request, authorization: str | None = Header(default=None), body: dict = Body(default={})):
    user = get_bearer_user(request, authorization)
    _v2_rate_check(request, user)
-    try:
-        body = await request.json()
-    except Exception:
-        body = {}
    with get_conn() as conn:
        row = conn.execute("SELECT notification_prefs FROM users WHERE id=?", (user["id"],)).fetchone()
        try:
@@ -1419,13 +1304,9 @@ def list_favorites_v2(request: Request, authorization: str | None = Header(defau
    return {"favorites": [row_to_dict(r) for r in rows]}

@router.post("/favorites")
-async def add_favorite_v2(request: Request, authorization: str | None = Header(default=None)):
+def add_favorite_v2(request: Request, authorization: str | None = Header(default=None), body: dict = Body(default={})):
    user = require_scope("write")(request, authorization)
    _v2_rate_check(request, user)
-    try:
-        body = await request.json()
-    except Exception:
-        body = {}
    pid = body.get("page_id")
    if not pid:
        raise HTTPException(400, "page_id required")
@@ -1436,20 +1317,20 @@ async def add_favorite_v2(request: Request, authorization: str | None = Header(d
        except Exception as e:
            raise HTTPException(409, str(e)) from None
    try:
-        await _fire_event("favorite.added", {"page_id": pid, "user_id": user["id"]})
+        run_event_sync(_fire_event("favorite.added", {"page_id": pid, "user_id": user["id"]}))
    except Exception:
        logger.exception("add_favorite_v2")
    return {"page_id": pid, "status": "added"}

@router.delete("/favorites/{page_id}")
-async def remove_favorite_v2(page_id: int, request: Request, authorization: str | None = Header(default=None)):
+def remove_favorite_v2(page_id: int, request: Request, authorization: str | None = Header(default=None)):
    user = require_scope("write")(request, authorization)
    _v2_rate_check(request, user)
    with get_conn() as conn:
        conn.execute("DELETE FROM favorites WHERE user_id=? AND page_id=?", (user["id"], page_id))
        conn.commit()
    try:
-        await _fire_event("favorite.removed", {"page_id": page_id, "user_id": user["id"]})
+        run_event_sync(_fire_event("favorite.removed", {"page_id": page_id, "user_id": user["id"]}))
    except Exception:
        logger.exception("remove_favorite_v2")
    return {"page_id": page_id, "status": "removed"}
@@ -1467,13 +1348,9 @@ def list_tags_v2(request: Request, authorization: str | None = Header(default=No
    return {"tags": [dict(r) for r in rows]}

@router.post("/tags")
-async def create_tag_v2(request: Request, authorization: str | None = Header(default=None)):
+def create_tag_v2(request: Request, authorization: str | None = Header(default=None), body: dict = Body(default={})):
    user = require_scope("write")(request, authorization)
    _v2_rate_check(request, user)
-    try:
-        body = await request.json()
-    except Exception:
-        body = {}
    name = (body.get("name") or "").strip()
    if not name:
        raise HTTPException(400, "name required")
@@ -1488,13 +1365,9 @@ async def create_tag_v2(request: Request, authorization: str | None = Header(def
    return {"id": tid, "name": name, "color": color, "status": "created"}

@router.patch("/tags/{tag_id}")
-async def patch_tag_v2(tag_id: int, request: Request, authorization: str | None = Header(default=None)):
+def patch_tag_v2(tag_id: int, request: Request, authorization: str | None = Header(default=None), body: dict = Body(default={})):
    user = require_scope("write")(request, authorization)
    _v2_rate_check(request, user)
-    try:
-        body = await request.json()
-    except Exception:
-        body = {}
    with get_conn() as conn:
        row = conn.execute("SELECT * FROM tags WHERE id=? AND user_id=?", (tag_id, user["id"])).fetchone()
        if not row:
@@ -1515,13 +1388,9 @@ def delete_tag_v2(tag_id: int, request: Request, authorization: str | None = Hea
    return {"id": tag_id, "status": "deleted"}

@router.post("/pages/{page_id}/tags")
-async def attach_tag_v2(page_id: int, request: Request, authorization: str | None = Header(default=None)):
+def attach_tag_v2(page_id: int, request: Request, authorization: str | None = Header(default=None), body: dict = Body(default={})):
    user = require_scope("write")(request, authorization)
    _v2_rate_check(request, user)
-    try:
-        body = await request.json()
-    except Exception:
-        body = {}
    tag_id = body.get("tag_id")
    if not tag_id:
        raise HTTPException(400, "tag_id required")
@@ -1566,13 +1435,9 @@ def list_shares_v2(page_id: int, request: Request, authorization: str | None = H
    return {"shares": [dict(r) for r in rows]}

@router.post("/pages/{page_id}/shares")
-async def create_share_v2(page_id: int, request: Request, authorization: str | None = Header(default=None)):
+def create_share_v2(page_id: int, request: Request, authorization: str | None = Header(default=None), body: dict = Body(default={})):
    user = require_scope("write")(request, authorization)
    _v2_rate_check(request, user)
-    try:
-        body = await request.json()
-    except Exception:
-        body = {}
    perm = (body.get("permission") or "view").strip().lower()
    if perm not in ("view", "comment", "edit"):
        raise HTTPException(400, "Invalid permission. Use view, comment, or edit")
@@ -1587,19 +1452,15 @@ async def create_share_v2(page_id: int, request: Request, authorization: str | N
        nid = cur.lastrowid
    audit_log(user, "share.create", "share", nid, f"page={page_id}", request)
    try:
-        await _fire_event("page.shared", {"page_id": page_id, "share_id": nid, "permission": perm})
+        run_event_sync(_fire_event("page.shared", {"page_id": page_id, "share_id": nid, "permission": perm}))
    except Exception:
        logger.exception("create_share_v2")
    return {"id": nid, "page_id": page_id, "status": "shared"}

@router.patch("/shares/{share_id}")
-async def patch_share_v2(share_id: int, request: Request, authorization: str | None = Header(default=None)):
+def patch_share_v2(share_id: int, request: Request, authorization: str | None = Header(default=None), body: dict = Body(default={})):
    user = require_scope("write")(request, authorization)
    _v2_rate_check(request, user)
-    try:
-        body = await request.json()
-    except Exception:
-        body = {}
    perm = (body.get("permission") or "").strip().lower()
    if perm not in ("view", "comment", "edit"):
        raise HTTPException(400, "Invalid permission")
@@ -1627,25 +1488,21 @@ def delete_share_v2(share_id: int, request: Request, authorization: str | None =
    return {"id": share_id, "status": "revoked"}

@router.post("/pages/{page_id}/publish")
-async def publish_page_v2(page_id: int, request: Request, authorization: str | None = Header(default=None)):
+def publish_page_v2(page_id: int, request: Request, authorization: str | None = Header(default=None), body: dict = Body(default={})):
    user = require_scope("write")(request, authorization)
    _v2_rate_check(request, user)
-    try:
-        body = await request.json()
-    except Exception:
-        body = {}
    slug_in = (body.get("slug") or body.get("publish_slug") or "").strip() or None
    slug, _title = publish(page_id, explicit_slug=slug_in)
    audit_log(user, "page.publish", "page", page_id, slug, request)
-    await fire_published(page_id, slug)
+    run_event_sync(fire_published(page_id, slug))
    return {"page_id": page_id, "slug": slug, "url": f"/p/{slug}", "status": "published"}

@router.delete("/pages/{page_id}/publish")
-async def unpublish_page_v2(page_id: int, request: Request, authorization: str | None = Header(default=None)):
+def unpublish_page_v2(page_id: int, request: Request, authorization: str | None = Header(default=None)):
    user = require_scope("write")(request, authorization)
    _v2_rate_check(request, user)
    unpublish(page_id)
-    await fire_unpublished(page_id)
+    run_event_sync(fire_unpublished(page_id))
    return {"page_id": page_id, "status": "unpublished"}

 # ── History ───────────────────────────────────────────────────────────────
@@ -1661,13 +1518,9 @@ def list_history_v2(page_id: int, request: Request, authorization: str | None =
    return {"history": [row_to_dict(r) for r in rows], "versions": [row_to_dict(r) for r in vrows]}

@router.post("/pages/{page_id}/history/restore")
-async def restore_history_v2(page_id: int, request: Request, authorization: str | None = Header(default=None)):
+def restore_history_v2(page_id: int, request: Request, authorization: str | None = Header(default=None), body: dict = Body(default={})):
    user = require_scope("write")(request, authorization)
    _v2_rate_check(request, user)
-    try:
-        body = await request.json()
-    except Exception:
-        body = {}
    hid = body.get("history_id") or body.get("id") or body.get("version_id")
    if not hid:
        raise HTTPException(400, "history_id required")
@@ -1703,13 +1556,9 @@ def list_sprints_v2(collection_id: int, request: Request, authorization: str | N
    return {"sprints": [row_to_dict(r) for r in rows], "total": total, "limit": limit, "offset": offset}

@router.post("/collections/{collection_id}/sprints")
-async def create_sprint_v2(collection_id: int, request: Request, authorization: str | None = Header(default=None)):
+def create_sprint_v2(collection_id: int, request: Request, authorization: str | None = Header(default=None), body: dict = Body(default={})):
    user = require_scope("write")(request, authorization)
    _v2_rate_check(request, user)
-    try:
-        body = await request.json()
-    except Exception:
-        body = {}
    name = (body.get("name") or "Sprint").strip()
    start = body.get("start_date") or body.get("start") or ""
    end = body.get("end_date") or body.get("end") or ""
@@ -1720,19 +1569,15 @@ async def create_sprint_v2(collection_id: int, request: Request, authorization:
        sid = cur.lastrowid
        conn.commit()
    try:
-        await _fire_event("sprint.created", {"sprint_id": sid, "collection_id": collection_id, "name": name})
+        run_event_sync(_fire_event("sprint.created", {"sprint_id": sid, "collection_id": collection_id, "name": name}))
    except Exception:
        logger.exception("create_sprint_v2")
    return {"id": sid, "name": name, "status": "created"}

@router.patch("/sprints/{sprint_id}")
-async def patch_sprint_v2(sprint_id: int, request: Request, authorization: str | None = Header(default=None)):
+def patch_sprint_v2(sprint_id: int, request: Request, authorization: str | None = Header(default=None), body: dict = Body(default={})):
    user = require_scope("write")(request, authorization)
    _v2_rate_check(request, user)
-    try:
-        body = await request.json()
-    except Exception:
-        body = {}
    with get_conn() as conn:
        row = conn.execute("SELECT * FROM sprints WHERE id=?", (sprint_id,)).fetchone()
        if not row:
@@ -1745,7 +1590,7 @@ async def patch_sprint_v2(sprint_id: int, request: Request, authorization: str |
        conn.execute("UPDATE sprints SET name=?, start_date=?, end_date=?, goal=?, status=? WHERE id=?", (name, start, end, goal, status, sprint_id))
        conn.commit()
    try:
-        await _fire_event("sprint.updated", {"sprint_id": sprint_id, "collection_id": row["collection_id"], "name": name, "status": status})
+        run_event_sync(_fire_event("sprint.updated", {"sprint_id": sprint_id, "collection_id": row["collection_id"], "name": name, "status": status}))
    except Exception:
        logger.exception("patch_sprint_v2")
    return {"id": sprint_id, "status": "updated"}
@@ -1760,13 +1605,9 @@ def delete_sprint_v2(sprint_id: int, request: Request, authorization: str | None
    return {"id": sprint_id, "status": "deleted"}

@router.post("/sprints/{sprint_id}/assign")
-async def assign_sprint_v2(sprint_id: int, request: Request, authorization: str | None = Header(default=None)):
+def assign_sprint_v2(sprint_id: int, request: Request, authorization: str | None = Header(default=None), body: dict = Body(default={})):
    user = require_scope("write")(request, authorization)
    _v2_rate_check(request, user)
-    try:
-        body = await request.json()
-    except Exception:
-        body = {}
    pid = body.get("page_id")
    if not pid:
        raise HTTPException(400, "page_id required")
@@ -1824,13 +1665,9 @@ def list_templates_v2(collection_id: int, request: Request, authorization: str |
    return {"templates": [row_to_dict(r) for r in rows]}

@router.post("/collections/{collection_id}/templates")
-async def create_template_v2(collection_id: int, request: Request, authorization: str | None = Header(default=None)):
+def create_template_v2(collection_id: int, request: Request, authorization: str | None = Header(default=None), body: dict = Body(default={})):
    user = require_scope("write")(request, authorization)
    _v2_rate_check(request, user)
-    try:
-        body = await request.json()
-    except Exception:
-        body = {}
    name = (body.get("name") or "Template").strip()
    pv = json.dumps(body.get("property_values") or body.get("property_values_json") or {})
    cj = json.dumps(body.get("content") or body.get("content_json") or [])
@@ -1841,13 +1678,9 @@ async def create_template_v2(collection_id: int, request: Request, authorization
    return {"id": tid, "name": name, "status": "created"}

@router.patch("/templates/{template_id}")
-async def patch_template_v2(template_id: int, request: Request, authorization: str | None = Header(default=None)):
+def patch_template_v2(template_id: int, request: Request, authorization: str | None = Header(default=None), body: dict = Body(default={})):
    user = require_scope("write")(request, authorization)
    _v2_rate_check(request, user)
-    try:
-        body = await request.json()
-    except Exception:
-        body = {}
    with get_conn() as conn:
        row = conn.execute("SELECT * FROM page_templates WHERE id=?", (template_id,)).fetchone()
        if not row:
@@ -1892,13 +1725,9 @@ def list_db_templates_v2(request: Request, authorization: str | None = Header(de
    return {"templates": [row_to_dict(r) for r in rows]}

@router.post("/templates/database/{template_id}/apply")
-async def apply_db_template_v2(template_id: int, request: Request, authorization: str | None = Header(default=None)):
+def apply_db_template_v2(template_id: int, request: Request, authorization: str | None = Header(default=None), body: dict = Body(default={})):
    user = require_scope("write")(request, authorization)
    _v2_rate_check(request, user)
-    try:
-        body = await request.json()
-    except Exception:
-        body = {}
    with get_conn() as conn:
        tpl = conn.execute("SELECT * FROM database_templates WHERE id=?", (template_id,)).fetchone()
        if not tpl:
@@ -2065,15 +1894,11 @@ def admin_list_users_v2(request: Request, limit: int = 30, offset: int = 0, auth
    return {"users": [row_to_dict(r) for r in rows], "total": total, "limit": limit, "offset": offset}

@router.patch("/admin/users/{uid}")
-async def admin_patch_user_v2(uid: int, request: Request, authorization: str | None = Header(default=None)):
+def admin_patch_user_v2(uid: int, request: Request, authorization: str | None = Header(default=None), body: dict = Body(default={})):
    user = get_bearer_user(request, authorization)
    _v2_rate_check(request, user)
    if not user.get("is_admin") and not has_scope(user.get("_token_scopes"), "admin"):
        raise HTTPException(403, "Admin scope required")
-    try:
-        body = await request.json()
-    except Exception:
-        body = {}
    with get_conn() as conn:
        if not conn.execute("SELECT id FROM users WHERE id=?", (uid,)).fetchone():
            raise HTTPException(404, "User not found")
@@ -2144,13 +1969,9 @@ def list_webhooks_v2(request: Request, authorization: str | None = Header(defaul
    )

@router.post("/webhooks")
-async def create_webhook_v2(request: Request, authorization: str | None = Header(default=None)):
+def create_webhook_v2(request: Request, authorization: str | None = Header(default=None), body: dict = Body(default={})):
    user = require_scope("write")(request, authorization)
    _v2_rate_check(request, user)
-    try:
-        body = await request.json()
-    except Exception:
-        body = {}
    from app.services.webhook_outbound import EVENTS, _event_matches
    url = (body.get("url") or "").strip()
    event = (body.get("event") or "page.created").strip()
@@ -2172,13 +1993,9 @@ async def create_webhook_v2(request: Request, authorization: str | None = Header
            "signature_header": "X-FlowDeck-Signature (HMAC-SHA256, sha256=<hex>)" if secret else None}

@router.patch("/webhooks/{webhook_id}")
-async def patch_webhook_v2(webhook_id: int, request: Request, authorization: str | None = Header(default=None)):
+def patch_webhook_v2(webhook_id: int, request: Request, authorization: str | None = Header(default=None), body: dict = Body(default={})):
    user = require_scope("write")(request, authorization)
    _v2_rate_check(request, user)
-    try:
-        body = await request.json()
-    except Exception:
-        body = {}
    with get_conn() as conn:
        row = conn.execute("SELECT * FROM webhook_subscriptions WHERE id=?", (webhook_id,)).fetchone()
        if not row:
@@ -2274,19 +2091,15 @@ async def retry_webhook_deliveries(webhook_id: int, request: Request,


@router.post("/webhooks/verify-signature")
-async def verify_webhook_signature(request: Request,
-                                    authorization: str | None = Header(default=None)):
+def verify_webhook_signature(request: Request,
+                                    authorization: str | None = Header(default=None),
+                                    body: dict = Body(default={})):
    """Verify a webhook signature (for debugging/testing)."""
    user = get_bearer_user(request, authorization)
    _v2_rate_check(request, user)

    from app.services.webhook_outbound import verify_signature

-    try:
-        body = await request.json()
-    except Exception:
-        body = {}
-
    secret = body.get("secret", "")
    payload = body.get("payload", "{}")
    signature = body.get("signature", "")
@@ -341,74 +341,6 @@ def library_private(
    return {"items": items}


-@router.get("/local-workspace-children/{item_id:int}")
-def library_local_workspace_children(item_id: int, request: Request):
-    """Return children of a local workspace item for tree expansion."""
-    _get_user_id(request)
-    with get_conn() as conn:
-        # Get the item to find its workspace
-        item = conn.execute(
-            "SELECT workspace_id FROM local_workspace_items WHERE id=? AND deleted_at IS NULL",
-            [item_id],
-        ).fetchone()
-        if not item:
-            return {"items": []}
-
-        rows = conn.execute(
-            "SELECT id, name, is_folder, parent_id, content_format, size, "
-            "COALESCE(updated_at, created_at) as updated_at "
-            "FROM local_workspace_items "
-            "WHERE parent_id = ? AND deleted_at IS NULL "
-            "ORDER BY is_folder DESC, name COLLATE NOCASE",
-            [item_id],
-        ).fetchall()
-
-    items = []
-    for r in rows:
-        name = r["name"] or "Untitled"
-        is_folder = bool(r["is_folder"])
-        icon = "📁" if is_folder else "📄"
-        fn = name.lower()
-        if not is_folder:
-            if fn.endswith(".pdf"):
-                icon = "📕"
-            elif any(fn.endswith(e) for e in [".png", ".jpg", ".jpeg", ".gif", ".webp", ".svg"]):
-                icon = "🖼️"
-            elif any(fn.endswith(e) for e in [".py", ".js", ".ts", ".go", ".rs"]):
-                icon = "📜"
-
-        with get_conn() as conn:
-            child_count = conn.execute(
-                "SELECT COUNT(*) FROM local_workspace_items WHERE parent_id=? AND deleted_at IS NULL",
-                [r["id"]],
-            ).fetchone()[0]
-
-        items.append({
-            "id": r["id"],
-            "title": name,
-            "icon": icon,
-            "is_folder": is_folder,
-            "source_type": "local-ws",
-            "source_label": "",
-            "workspace": "",
-            "workspace_name": "",
-            "author": "",
-            "author_initial": "?",
-            "updated_at": r["updated_at"] or "",
-            "visited_at": "",
-            "has_children": child_count > 0,
-            "children": [],
-            "url": f"/local-workspace?folder={r['id']}" if is_folder else f"/pages/{r['id']}",
-            "content_format": r["content_format"] or "file",
-            "favorited": False,
-            "page_icon": "",
-            "tags": [],
-            "size_display": _format_size(r["size"]) if r["size"] else "",
-        })
-
-    return {"items": items}
-
-
@router.get("/children/{page_id:int}")
 def library_children(page_id: int, request: Request):
    """Return child pages for a given parent page (for tree expansion in Library)."""
@@ -449,91 +381,6 @@ def library_repository(
    return {"items": items}


-@router.get("/local-workspace")
-def library_local_workspace(
-    request: Request,
-    workspace_id: int = Query(default=0),
-):
-    """Return local workspace items (files/folders) formatted for Library display."""
-    from app.routers.dashboard import _get_active_workspace
-    uid = _get_user_id(request)
-
-    # Get the active workspace
-    ws = _get_active_workspace(request, user_id=uid)
-    if not ws:
-        return {"items": []}
-
-    ws_id = workspace_id or ws["id"]
-
-    # Query local workspace tree
-    with get_conn() as conn:
-        rows = conn.execute(
-            "SELECT id, name, is_folder, parent_id, content_format, size, "
-            "COALESCE(updated_at, created_at) as updated_at "
-            "FROM local_workspace_items "
-            "WHERE workspace_id = ? AND deleted_at IS NULL "
-            "ORDER BY is_folder DESC, name COLLATE NOCASE",
-            [ws_id],
-        ).fetchall()
-
-    items = []
-    for r in rows:
-        name = r["name"] or "Untitled"
-        is_folder = bool(r["is_folder"])
-        icon = "📁" if is_folder else "📄"
-        fn = name.lower()
-        if not is_folder:
-            if fn.endswith(".pdf"):
-                icon = "📕"
-            elif any(fn.endswith(e) for e in [".png", ".jpg", ".jpeg", ".gif", ".webp", ".svg"]):
-                icon = "🖼️"
-            elif any(fn.endswith(e) for e in [".py", ".js", ".ts", ".go", ".rs"]):
-                icon = "📜"
-
-        # Check for children
-        child_count = conn.execute(
-            "SELECT COUNT(*) FROM local_workspace_items WHERE parent_id=? AND deleted_at IS NULL",
-            [r["id"]],
-        ).fetchone()[0]
-
-        items.append({
-            "id": r["id"],
-            "title": name,
-            "icon": icon,
-            "is_folder": is_folder,
-            "source_type": "local-ws",
-            "source_label": ws.get("name", "Workspace"),
-            "workspace": ws.get("name", ""),
-            "workspace_name": ws.get("name", ""),
-            "author": "",
-            "author_initial": "?",
-            "updated_at": r["updated_at"] or "",
-            "visited_at": "",
-            "has_children": child_count > 0,
-            "children": [],
-            "url": f"/local-workspace?folder={r['id']}" if is_folder else f"/pages/{r['id']}",
-            "content_format": r["content_format"] or "file",
-            "favorited": False,
-            "page_icon": "",
-            "tags": [],
-            "size_display": _format_size(r["size"]) if r["size"] else "",
-        })
-
-    return {"items": items}
-
-
-def _format_size(size_bytes):
-    if not size_bytes:
-        return ""
-    if size_bytes < 1024:
-        return f"{size_bytes} B"
-    if size_bytes < 1048576:
-        return f"{size_bytes/1024:.1f} KB"
-    if size_bytes < 1073741824:
-        return f"{size_bytes/1048576:.1f} MB"
-    return f"{size_bytes/1073741824:.1f} GB"
-
-
@router.get("/workspace")
 def library_workspace(
    request: Request,
@@ -355,6 +355,19 @@ async def run_automation(automation_id: int, trigger_source: str, context: dict)
        return {"status": "error", "detail": str(exc)}


+def run_event_sync(coro, timeout: float = 60.0):
+    """A21 phase 2b : exécute une coroutine d'événement depuis un handler synchrone.
+
+    Bloque le worker threadpool (jamais la boucle d'event) et attend la fin —
+    déterministe, exactement ce que faisait l'await avant la conversion des
+    routes en `def`.
+    ponytail: les clients httpx des services sont créés à chaque appel (aucun
+    lien de boucle) ; si un jour un client/queue est lié à la boucle de l'app,
+    passer à `asyncio.run_coroutine_threadsafe` + boucle capturée au lifespan.
+    """
+    return asyncio.run(asyncio.wait_for(coro, timeout))
+
+
 async def fire_event(event: str, payload: dict):
    """Dispatch an event to outbound webhooks and matching automations."""
    # v7.3.0: page.updated → in-app notification to followers (throttled).
@@ -1,4 +1,5 @@
 {# Card detail modal content — full issue info + comments #}
+{% from '_icons.html' import fd_icon %}
 <div class="card-detail" x-data="cardDetail()">
  <!-- Title -->
  <div style="display:flex; align-items:flex-start; gap:12px; margin-bottom:16px;">
@@ -2,7 +2,7 @@
  "openapi": "3.1.0",
  "info": {
    "title": "FlowDeck",
-    "version": "7.8.0"
+    "version": "7.20.0"
  },
  "paths": {
    "/auth/register": {
@@ -10765,47 +10765,6 @@
        }
      }
    },
-    "/api/library/local-workspace-children/{item_id}": {
-      "get": {
-        "tags": [
-          "library"
-        ],
-        "summary": "Library Local Workspace Children",
-        "description": "Return children of a local workspace item for tree expansion.",
-        "operationId": "library_local_workspace_children_api_library_local_workspace_children__item_id__get",
-        "parameters": [
-          {
-            "name": "item_id",
-            "in": "path",
-            "required": true,
-            "schema": {
-              "type": "integer",
-              "title": "Item Id"
-            }
-          }
-        ],
-        "responses": {
-          "200": {
-            "description": "Successful Response",
-            "content": {
-              "application/json": {
-                "schema": {}
-              }
-            }
-          },
-          "422": {
-            "description": "Validation Error",
-            "content": {
-              "application/json": {
-                "schema": {
-                  "$ref": "#/components/schemas/HTTPValidationError"
-                }
-              }
-            }
-          }
-        }
-      }
-    },
    "/api/library/children/{page_id}": {
      "get": {
        "tags": [
@@ -10899,48 +10858,6 @@
        }
      }
    },
-    "/api/library/local-workspace": {
-      "get": {
-        "tags": [
-          "library"
-        ],
-        "summary": "Library Local Workspace",
-        "description": "Return local workspace items (files/folders) formatted for Library display.",
-        "operationId": "library_local_workspace_api_library_local_workspace_get",
-        "parameters": [
-          {
-            "name": "workspace_id",
-            "in": "query",
-            "required": false,
-            "schema": {
-              "type": "integer",
-              "default": 0,
-              "title": "Workspace Id"
-            }
-          }
-        ],
-        "responses": {
-          "200": {
-            "description": "Successful Response",
-            "content": {
-              "application/json": {
-                "schema": {}
-              }
-            }
-          },
-          "422": {
-            "description": "Validation Error",
-            "content": {
-              "application/json": {
-                "schema": {
-                  "$ref": "#/components/schemas/HTTPValidationError"
-                }
-              }
-            }
-          }
-        }
-      }
-    },
    "/api/library/workspace": {
      "get": {
        "tags": [
@@ -16725,6 +16642,17 @@
            }
          }
        ],
+        "requestBody": {
+          "content": {
+            "application/json": {
+              "schema": {
+                "type": "object",
+                "default": {},
+                "title": "Body"
+              }
+            }
+          }
+        },
        "responses": {
          "200": {
            "description": "Successful Response",
@@ -16974,6 +16902,17 @@
            }
          }
        ],
+        "requestBody": {
+          "content": {
+            "application/json": {
+              "schema": {
+                "type": "object",
+                "default": {},
+                "title": "Body"
+              }
+            }
+          }
+        },
        "responses": {
          "200": {
            "description": "Successful Response",
@@ -17123,6 +17062,17 @@
            }
          }
        ],
+        "requestBody": {
+          "content": {
+            "application/json": {
+              "schema": {
+                "type": "object",
+                "default": {},
+                "title": "Body"
+              }
+            }
+          }
+        },
        "responses": {
          "200": {
            "description": "Successful Response",
@@ -17233,6 +17183,17 @@
            }
          }
        ],
+        "requestBody": {
+          "content": {
+            "application/json": {
+              "schema": {
+                "type": "object",
+                "default": {},
+                "title": "Body"
+              }
+            }
+          }
+        },
        "responses": {
          "200": {
            "description": "Successful Response",
@@ -17397,6 +17358,17 @@
            }
          }
        ],
+        "requestBody": {
+          "content": {
+            "application/json": {
+              "schema": {
+                "type": "object",
+                "default": {},
+                "title": "Body"
+              }
+            }
+          }
+        },
        "responses": {
          "200": {
            "description": "Successful Response",
@@ -17462,6 +17434,17 @@
            }
          }
        ],
+        "requestBody": {
+          "content": {
+            "application/json": {
+              "schema": {
+                "type": "object",
+                "default": {},
+                "title": "Body"
+              }
+            }
+          }
+        },
        "responses": {
          "200": {
            "description": "Successful Response",
@@ -17617,6 +17600,17 @@
            }
          }
        ],
+        "requestBody": {
+          "content": {
+            "application/json": {
+              "schema": {
+                "type": "object",
+                "default": {},
+                "title": "Body"
+              }
+            }
+          }
+        },
        "responses": {
          "200": {
            "description": "Successful Response",
@@ -17727,6 +17721,17 @@
            }
          }
        ],
+        "requestBody": {
+          "content": {
+            "application/json": {
+              "schema": {
+                "type": "object",
+                "default": {},
+                "title": "Body"
+              }
+            }
+          }
+        },
        "responses": {
          "200": {
            "description": "Successful Response",
@@ -17837,6 +17842,17 @@
            }
          }
        ],
+        "requestBody": {
+          "content": {
+            "application/json": {
+              "schema": {
+                "type": "object",
+                "default": {},
+                "title": "Body"
+              }
+            }
+          }
+        },
        "responses": {
          "200": {
            "description": "Successful Response",
@@ -18003,6 +18019,17 @@
            }
          }
        ],
+        "requestBody": {
+          "content": {
+            "application/json": {
+              "schema": {
+                "type": "object",
+                "default": {},
+                "title": "Body"
+              }
+            }
+          }
+        },
        "responses": {
          "200": {
            "description": "Successful Response",
@@ -18178,6 +18205,17 @@
            }
          }
        ],
+        "requestBody": {
+          "content": {
+            "application/json": {
+              "schema": {
+                "type": "object",
+                "default": {},
+                "title": "Body"
+              }
+            }
+          }
+        },
        "responses": {
          "200": {
            "description": "Successful Response",
@@ -18288,6 +18326,17 @@
            }
          }
        ],
+        "requestBody": {
+          "content": {
+            "application/json": {
+              "schema": {
+                "type": "object",
+                "default": {},
+                "title": "Body"
+              }
+            }
+          }
+        },
        "responses": {
          "200": {
            "description": "Successful Response",
@@ -18454,6 +18503,17 @@
            }
          }
        ],
+        "requestBody": {
+          "content": {
+            "application/json": {
+              "schema": {
+                "type": "object",
+                "default": {},
+                "title": "Body"
+              }
+            }
+          }
+        },
        "responses": {
          "200": {
            "description": "Successful Response",
@@ -18564,6 +18624,17 @@
            }
          }
        ],
+        "requestBody": {
+          "content": {
+            "application/json": {
+              "schema": {
+                "type": "object",
+                "default": {},
+                "title": "Body"
+              }
+            }
+          }
+        },
        "responses": {
          "200": {
            "description": "Successful Response",
@@ -18674,6 +18745,17 @@
            }
          }
        ],
+        "requestBody": {
+          "content": {
+            "application/json": {
+              "schema": {
+                "type": "object",
+                "default": {},
+                "title": "Body"
+              }
+            }
+          }
+        },
        "responses": {
          "200": {
            "description": "Successful Response",
@@ -18849,6 +18931,17 @@
            }
          }
        ],
+        "requestBody": {
+          "content": {
+            "application/json": {
+              "schema": {
+                "type": "object",
+                "default": {},
+                "title": "Body"
+              }
+            }
+          }
+        },
        "responses": {
          "200": {
            "description": "Successful Response",
@@ -18905,6 +18998,17 @@
            }
          }
        ],
+        "requestBody": {
+          "content": {
+            "application/json": {
+              "schema": {
+                "type": "object",
+                "default": {},
+                "title": "Body"
+              }
+            }
+          }
+        },
        "responses": {
          "200": {
            "description": "Successful Response",
@@ -19015,6 +19119,17 @@
            }
          }
        ],
+        "requestBody": {
+          "content": {
+            "application/json": {
+              "schema": {
+                "type": "object",
+                "default": {},
+                "title": "Body"
+              }
+            }
+          }
+        },
        "responses": {
          "200": {
            "description": "Successful Response",
@@ -19062,6 +19177,17 @@
            }
          }
        ],
+        "requestBody": {
+          "content": {
+            "application/json": {
+              "schema": {
+                "type": "object",
+                "default": {},
+                "title": "Body"
+              }
+            }
+          }
+        },
        "responses": {
          "200": {
            "description": "Successful Response",
@@ -19109,6 +19235,17 @@
            }
          }
        ],
+        "requestBody": {
+          "content": {
+            "application/json": {
+              "schema": {
+                "type": "object",
+                "default": {},
+                "title": "Body"
+              }
+            }
+          }
+        },
        "responses": {
          "200": {
            "description": "Successful Response",
@@ -19219,6 +19356,17 @@
            }
          }
        ],
+        "requestBody": {
+          "content": {
+            "application/json": {
+              "schema": {
+                "type": "object",
+                "default": {},
+                "title": "Body"
+              }
+            }
+          }
+        },
        "responses": {
          "200": {
            "description": "Successful Response",
@@ -19275,6 +19423,17 @@
            }
          }
        ],
+        "requestBody": {
+          "content": {
+            "application/json": {
+              "schema": {
+                "type": "object",
+                "default": {},
+                "title": "Body"
+              }
+            }
+          }
+        },
        "responses": {
          "200": {
            "description": "Successful Response",
@@ -19385,6 +19544,17 @@
            }
          }
        ],
+        "requestBody": {
+          "content": {
+            "application/json": {
+              "schema": {
+                "type": "object",
+                "default": {},
+                "title": "Body"
+              }
+            }
+          }
+        },
        "responses": {
          "200": {
            "description": "Successful Response",
@@ -19495,6 +19665,17 @@
            }
          }
        ],
+        "requestBody": {
+          "content": {
+            "application/json": {
+              "schema": {
+                "type": "object",
+                "default": {},
+                "title": "Body"
+              }
+            }
+          }
+        },
        "responses": {
          "200": {
            "description": "Successful Response",
@@ -19551,6 +19732,17 @@
            }
          }
        ],
+        "requestBody": {
+          "content": {
+            "application/json": {
+              "schema": {
+                "type": "object",
+                "default": {},
+                "title": "Body"
+              }
+            }
+          }
+        },
        "responses": {
          "200": {
            "description": "Successful Response",
@@ -19715,6 +19907,17 @@
            }
          }
        ],
+        "requestBody": {
+          "content": {
+            "application/json": {
+              "schema": {
+                "type": "object",
+                "default": {},
+                "title": "Body"
+              }
+            }
+          }
+        },
        "responses": {
          "200": {
            "description": "Successful Response",
@@ -19771,6 +19974,17 @@
            }
          }
        ],
+        "requestBody": {
+          "content": {
+            "application/json": {
+              "schema": {
+                "type": "object",
+                "default": {},
+                "title": "Body"
+              }
+            }
+          }
+        },
        "responses": {
          "200": {
            "description": "Successful Response",
@@ -19881,6 +20095,17 @@
            }
          }
        ],
+        "requestBody": {
+          "content": {
+            "application/json": {
+              "schema": {
+                "type": "object",
+                "default": {},
+                "title": "Body"
+              }
+            }
+          }
+        },
        "responses": {
          "200": {
            "description": "Successful Response",
@@ -20125,6 +20350,17 @@
            }
          }
        ],
+        "requestBody": {
+          "content": {
+            "application/json": {
+              "schema": {
+                "type": "object",
+                "default": {},
+                "title": "Body"
+              }
+            }
+          }
+        },
        "responses": {
          "200": {
            "description": "Successful Response",
@@ -20217,6 +20453,17 @@
            }
          }
        ],
+        "requestBody": {
+          "content": {
+            "application/json": {
+              "schema": {
+                "type": "object",
+                "default": {},
+                "title": "Body"
+              }
+            }
+          }
+        },
        "responses": {
          "200": {
            "description": "Successful Response",
@@ -20365,6 +20612,17 @@
            }
          }
        ],
+        "requestBody": {
+          "content": {
+            "application/json": {
+              "schema": {
+                "type": "object",
+                "default": {},
+                "title": "Body"
+              }
+            }
+          }
+        },
        "responses": {
          "200": {
            "description": "Successful Response",
@@ -20421,6 +20679,17 @@
            }
          }
        ],
+        "requestBody": {
+          "content": {
+            "application/json": {
+              "schema": {
+                "type": "object",
+                "default": {},
+                "title": "Body"
+              }
+            }
+          }
+        },
        "responses": {
          "200": {
            "description": "Successful Response",
@@ -20531,6 +20800,17 @@
            }
          }
        ],
+        "requestBody": {
+          "content": {
+            "application/json": {
+              "schema": {
+                "type": "object",
+                "default": {},
+                "title": "Body"
+              }
+            }
+          }
+        },
        "responses": {
          "200": {
            "description": "Successful Response",
@@ -20753,6 +21033,17 @@
            }
          }
        ],
+        "requestBody": {
+          "content": {
+            "application/json": {
+              "schema": {
+                "type": "object",
+                "default": {},
+                "title": "Body"
+              }
+            }
+          }
+        },
        "responses": {
          "200": {
            "description": "Successful Response",
@@ -20809,6 +21100,17 @@
            }
          }
        ],
+        "requestBody": {
+          "content": {
+            "application/json": {
+              "schema": {
+                "type": "object",
+                "default": {},
+                "title": "Body"
+              }
+            }
+          }
+        },
        "responses": {
          "200": {
            "description": "Successful Response",
@@ -20919,6 +21221,17 @@
            }
          }
        ],
+        "requestBody": {
+          "content": {
+            "application/json": {
+              "schema": {
+                "type": "object",
+                "default": {},
+                "title": "Body"
+              }
+            }
+          }
+        },
        "responses": {
          "200": {
            "description": "Successful Response",
@@ -21085,6 +21398,17 @@
            }
          }
        ],
+        "requestBody": {
+          "content": {
+            "application/json": {
+              "schema": {
+                "type": "object",
+                "default": {},
+                "title": "Body"
+              }
+            }
+          }
+        },
        "responses": {
          "200": {
            "description": "Successful Response",
@@ -21195,6 +21519,17 @@
            }
          }
        ],
+        "requestBody": {
+          "content": {
+            "application/json": {
+              "schema": {
+                "type": "object",
+                "default": {},
+                "title": "Body"
+              }
+            }
+          }
+        },
        "responses": {
          "200": {
            "description": "Successful Response",
@@ -21251,6 +21586,17 @@
            }
          }
        ],
+        "requestBody": {
+          "content": {
+            "application/json": {
+              "schema": {
+                "type": "object",
+                "default": {},
+                "title": "Body"
+              }
+            }
+          }
+        },
        "responses": {
          "200": {
            "description": "Successful Response",
@@ -21361,6 +21707,17 @@
            }
          }
        ],
+        "requestBody": {
+          "content": {
+            "application/json": {
+              "schema": {
+                "type": "object",
+                "default": {},
+                "title": "Body"
+              }
+            }
+          }
+        },
        "responses": {
          "200": {
            "description": "Successful Response",
@@ -21592,6 +21949,17 @@
            }
          }
        ],
+        "requestBody": {
+          "content": {
+            "application/json": {
+              "schema": {
+                "type": "object",
+                "default": {},
+                "title": "Body"
+              }
+            }
+          }
+        },
        "responses": {
          "200": {
            "description": "Successful Response",
@@ -21648,6 +22016,17 @@
            }
          }
        ],
+        "requestBody": {
+          "content": {
+            "application/json": {
+              "schema": {
+                "type": "object",
+                "default": {},
+                "title": "Body"
+              }
+            }
+          }
+        },
        "responses": {
          "200": {
            "description": "Successful Response",
@@ -21861,6 +22240,17 @@
            }
          }
        ],
+        "requestBody": {
+          "content": {
+            "application/json": {
+              "schema": {
+                "type": "object",
+                "default": {},
+                "title": "Body"
+              }
+            }
+          }
+        },
        "responses": {
          "200": {
            "description": "Successful Response",
@@ -22367,6 +22757,17 @@
            }
          }
        ],
+        "requestBody": {
+          "content": {
+            "application/json": {
+              "schema": {
+                "type": "object",
+                "default": {},
+                "title": "Body"
+              }
+            }
+          }
+        },
        "responses": {
          "200": {
            "description": "Successful Response",
@@ -22618,6 +23019,17 @@
            }
          }
        ],
+        "requestBody": {
+          "content": {
+            "application/json": {
+              "schema": {
+                "type": "object",
+                "default": {},
+                "title": "Body"
+              }
+            }
+          }
+        },
        "responses": {
          "200": {
            "description": "Successful Response",
@@ -22674,6 +23086,17 @@
            }
          }
        ],
+        "requestBody": {
+          "content": {
+            "application/json": {
+              "schema": {
+                "type": "object",
+                "default": {},
+                "title": "Body"
+              }
+            }
+          }
+        },
        "responses": {
          "200": {
            "description": "Successful Response",
@@ -22961,6 +23384,17 @@
            }
          }
        ],
+        "requestBody": {
+          "content": {
+            "application/json": {
+              "schema": {
+                "type": "object",
+                "default": {},
+                "title": "Body"
+              }
+            }
+          }
+        },
        "responses": {
          "200": {
            "description": "Successful Response",
Author	SHA1	Message	Date
bruno	7a38ddd0f6	test: A32 TERMINÉ — 6 routes Gitea stubbées + bug prod fd_icon (v7.20.0) FlowDeck CI / lint (push) Canceled after 0s Details FlowDeck CI / test (push) Canceled after 0s Details FlowDeck CI / docker (push) Canceled after 0s Details Les 6 dernières routes d'A32 (api.py, gitea) avec stub de transport — zéro réseau réel : - _stub_gitea() : stubs manuels sur gitea_client.gitea (create_issue, update_issue, update_issue_labels, get_issue, get_issue_comments) avec ÉTAT MUTABLE PARTAGÉ — le handler PATCH re-fetch l'issue via get_issue, un canevas figé aurait masqué la mise à jour. - POST /issues : carte INSÉRÉE sur le board (board seedé par endpoint) ; PATCH : colonne recalculée sans perdre la carte. - GET /issues JSON + HTML : ?format=html requis (le segment /html ne fixe pas le paramètre, le handler le lit dans la query) ; stub qui lève → 404. - POST /checklists + POST /checklist-items : lignes vérifiées en base, 404 sans board ; cleanup (items → checklists). BUG PROD corrigé (trouvé par le smoke HTML) : card_detail.html utilisait la macro fd_icon SANS l'importer → UndefinedError → 500 systématique sur GET /api/issues/...?format=html (seul rendu du template dans le code). Fix : {% from '_icons.html' import fd_icon %}. A32 COMPLET : plus aucun router « 0 test » (webhooks, notes, sidebar_config, github_routes, library, api, dashboard, api_v2 tous couverts). test_smoke_uncovered.py : 52 tests. suite 1089/1089 · ruff OK · docs à jour	2026-10-01 15:39:21 -04:00
bruno	113374e499	test: A32 phase 2h — dashboard bloqué : 44/44 routes à 0 ref (v7.19.0) FlowDeck CI / test (push) Failing after 3h12m50s Details FlowDeck CI / lint (push) Successful in 1m54s Details FlowDeck CI / docker (push) Skipped Details +5 routes dashboard (fichier test_smoke_uncovered.py à 49 tests) : - Members POST/PUT/DELETE : invitation de soi-même dans un workspace dédié (_own_workspace), rôle admin relu en base, membre supprimé (COUNT=0). Quirk documenté : les retours tuple des routes (`{"error": ...}, 400`) sont sérialisés FastAPI en tableau + 200 → assert sur `[0]["error"]`. - upload-folder : validations SEULES (structure absente → 400 « No structure provided », JSON cassé → 400 « Invalid structure JSON ») — zéro fichier écrit, workspace dédié nettoyé. - convert-to-database : collection + propriété title + vue table + page en content_format='collection' VÉRIFIÉS en base, 404 page inconnue, cleanup dans l'ordre FK (pages avant collections — IntegrityError corrigée). Recoupement final : scan des 44 routes strictement à 0 ref de dashboard.py → TOUTES exercées. Les 19 résidus du scan sont des faux positifs (paths en f-string dans les tests : /api/workspace/1/…, f"/api/pages/{id}/…", …) rapprochés manuellement un par un. Reste A32 : les 6 routes Gitea d'api.py (issues ×4, créations checklists) → stub de transport httpx (effort S). suite 1086/1086 · `ruff check app tests` OK · docs à jour	2026-10-01 15:24:38 -04:00
bruno	0cb476e336	test: A32 phase 2g — dashboard +13 routes, cycles items/tags (v7.18.0) FlowDeck CI / lint (push) Successful in 1m58s Details FlowDeck CI / test (push) Successful in 14m55s Details FlowDeck CI / docker (push) Canceled after 0s Details Cumul dashboard : 43 → 56 des 63 routes. 4 nouveaux tests (fichier à 46) : - GET /gitea-workspace : page HTML (200 ou redirection propre) - workspace/projects GET+POST : shape {builtin, gitea, github} avec github == [] ; projet créé RETROUVÉ dans builtin ; quirk « error » sans nom ; nettoyage (DELETE page) - Cycle items local-workspace (5 routes) : POST création (titre relu), PUT rename (relu en base), PUT move, DELETE soft-delete (deleted_at relu), POST restore (deleted_at NULL relu) — nettoyage finally - Cycle tags d'item (5 routes) : POST (urgenta32 lowercasé), tags de l'item, liste workspace, search (shape), suppression vérifiée. Utilisateur DÉDIÉ + workspace créé dans le test (le endpoint /api/local-workspace/tags exige un workspace actif : fallback « premier workspace du user » — on n'attache pas ce workspace à l'utilisateur fixture partagé), tout est nettoyé. Reste A32 : dashboard 7 routes (members invite/role/unsubscribe, upload-folder, convert-to-database) + 6 routes Gitea d'api.py (stub httpx). suite 1083/1083 · `ruff check app tests` OK · docs à jour	2026-10-01 15:11:45 -04:00
bruno	2339fa2586	test: A32 phase 2f — dashboard +7 routes, garde-fous A16 (v7.17.0) FlowDeck CI / lint (push) Successful in 1m52s Details FlowDeck CI / docker (push) Canceled after 0s Details FlowDeck CI / test (push) Canceled after 5m54s Details Cumul dashboard : 36 → 43 des 63 routes. 4 nouveaux tests (fichier à 42), centrés sur les garde-fous A16 : - GET /api/files/{ws}/{path} : traversal encodé %2e%2e%2f → 403 « Path traversal denied » (décodé par Starlette puis bloqué par resolve) ; inexistant → 404 ; vrai fichier écrit dans le data_dir de test → 200 + octets exacts, nettoyé en finally - GET /api/pages/{id}/download : page markdown → 404 « No downloadable file » (pas de 500) ; page « file » avec chemin ../ sortant de la racine → jamais 200 ; file-content → 404/415 sans fuite - GET /api/local-workspace/page-content/{id} : contenu + format relus, 404 sur id inconnu - GET /api/avatar/{id} : 302 + Location avec follow_redirects=False (AUCUNE requête réelle vers l'URL externe), 404 sans avatar - GET/POST /api/collections/{id}/table-data\|pages : 404 inconnu, shape, ligne créée retrouvée dans table-data, nettoyage finally Reste A32 : dashboard 20 routes (upload/local-workspace items/members/ projects/HTML gitea) + 6 routes Gitea d'api.py (stub transport httpx). suite 1079/1079 · `ruff check app tests` OK · docs à jour	2026-10-01 14:40:06 -04:00
bruno	8b48dbdd4b	test: A32 phase 2e — dashboard +9 routes, comptes A2/A3 (v7.16.0) FlowDeck CI / lint (push) Canceled after 0s Details FlowDeck CI / test (push) Canceled after 0s Details FlowDeck CI / docker (push) Canceled after 0s Details Cumul dashboard : 27 → 36 des 63 routes. 6 nouveaux tests (fichier à 38) : - /accounts + /accounts/settings : 200 HTML et « password_hash » ABSENT du rendu (whitelist A2 vérifiée côté page) - PUT /api/user/profile : persistance relue en base, restauration finally - PUT /api/user/password : 403 « current password is incorrect » (A3 — la session seule ne change pas le mdp) + quirk assumé documenté : la longueur est validée AVANT l'auth et répond 200 + message - POST /api/user/token : format fd_ + 64 hex ; ligne user_tokens nettoyée - DELETE /api/user/forge/{provider} : {"status": "ok"} - PUT /api/settings/account : full_name/email persistés + 400 sur mdp court, restauration finally - POST /api/workspaces/1/select : Set-Cookie flowdeck_workspace vérifié ; GET /api/local-workspace/breadcrumb : shape liste Reste A32 : dashboard 27 routes (fichiers/avatars/local-workspace/collections) + 6 routes Gitea d'api.py (stub transport httpx). suite 1075/1075 · `ruff check app tests` OK · docs à jour	2026-10-01 13:59:00 -04:00
bruno	360c705fd4	test: A32 phase 2d — dashboard +10 routes couvertes (v7.15.0) FlowDeck CI / lint (push) Canceled after 0s Details FlowDeck CI / test (push) Canceled after 0s Details FlowDeck CI / docker (push) Canceled after 0s Details Scan strict dashboard.py : 44 routes à 0 référence stricte sur 63. 10 couvertes cette passe (test_smoke_uncovered.py → 32 tests) : - Tags CRUD complet : POST (nom lowercasé `SmokeTag` → `smoketag`), GET all (présent), PUT couleur (relue), DELETE (absente de la liste ensuite) - Vie d'une page : GET /api/pages/{id}/content (contenu seedé relu) → PUT rename (ok + 400 titre vide + titre relu en base) → POST trash (parent_section='Trash' + deleted_at RELUS en base) ; nettoyage en finally - GET /api/sidebar/workspace-tree : 200 HTML, fragment « No pages yet » (pas de cookie workspace) - POST /api/settings/avatar-color : couleur relue SUR L'UTILISATEUR DE LA SESSION (pas LIMIT 1), avatar_color/avatar_url d'origine restaurés - GET /api/workspace/1/members : shape {"members": [...]} Helper _seed_page : les colonnes par défaut sont surchargeables (content=) pour les seeds à contenu. Reste A32 : dashboard 34 routes à 0 ref (fichiers/avatars/imports…) + 6 routes Gitea d'api.py (stub transport httpx). suite 1069/1069 · `ruff check app tests` OK · docs à jour	2026-10-01 13:36:56 -04:00
bruno	0698645dbd	test: A32 phase 2c — api_v2 : les 5 routes à 0 ref couvertes (v7.14.0) FlowDeck CI / lint (push) Successful in 1m52s Details FlowDeck CI / docker (push) Canceled after 0s Details FlowDeck CI / test (push) Canceled after 34m59s Details Scan strict des 115 routes api_v2.py contre tous les tests (chaîne de chemin littérale) → 5 routes sans AUCUNE référence, toutes couvertes maintenant : - POST /properties/evaluate-formula : 200 + shape, 400 sans expression. Le moteur renvoie « 1 + 2 » tel quel aujourd'hui → le smoke valide le câble (bearer, Body param, parse), pas le moteur (réalm de ses propres tests). - POST /properties/compute-rollup : 400 « collection_id required », 401 sans bearer. - GET /admin/audit-logs : portail admin VÉRIFIÉ — l'attendu est calculé depuis /users/me (le tout premier utilisateur d'un worker est admin : état non contrôlable depuis un test isolé), + token scope admin → 200 + logs. - GET /webhooks/events : catalogue non vide + wildcards * / page.. - POST /webhooks/verify-signature : valid=True avec sign_payload() (le même helper que le serveur), False avec signature bidon. test_smoke_uncovered.py : 27 tests. Reste A32 : dashboard 17/63 + 6 routes gitea d'api.py (stub transport). suite 1064/1064* · `ruff check app tests` OK · docs à jour	2026-10-01 13:09:32 -04:00
bruno	b2e38aece7	test: A32 phase 2b — api.py 3 → 16/22 routes couvertes (v7.13.0) FlowDeck CI / lint (push) Canceled after 0s Details FlowDeck CI / test (push) Canceled after 0s Details FlowDeck CI / docker (push) Canceled after 0s Details +6 smokes dans test_smoke_uncovered.py (22 tests au total dans le fichier) : - board-config GET/POST : défauts 5 colonnes sans board, création puis relecture du roundtrip (seed via l'endpoint lui-même, pas de SQL brut) - col-mapping POST/DELETE : 404 sans board, upsert label vérifié, suppression - card POST : 404 sans board, ok avec - collaborators GET : gitea.get_collaborators STUBBÉ (zéro accès réseau réel) - frontend-error(s) : capture, JSON invalide → ignored, DÉDUP d'une erreur répétée (count=2), lecture qui purge (cleared=true puis 0) - checklist mutations : PATCH item (checked/content relus EN BASE), DELETE item, DELETE checklist (COUNT=0) — seed + cleanup en finally Reste api.py : 6 routes Gitea (issues ×4 + créations checklists owner/repo) → stub de transport httpx (phase suivante). Reste global : dashboard 17/63, api_v2 50/115. suite 1059/1059 (236 s) · `ruff check app tests` OK · docs à jour	2026-10-01 12:35:22 -04:00
bruno	df9a269d76	test: A32 phase 2a — library 10/10 + 2 routes fantômes supprimées (v7.12.0) FlowDeck CI / lint (push) Successful in 1m53s Details FlowDeck CI / docker (push) Canceled after 0s Details FlowDeck CI / test (push) Canceled after 8m41s Details - tests/test_smoke_uncovered.py : +6 tests pour library.py (1/10 → 8 routes couvertes) : les 5 listes en boucle (recents/favorites/published/private/ workspace → 200 + items), /private avec page seedée retrouvée, /children/{id} avec parent/enfant seedés, /repository vide ET clé (string, aucun réseau), non-régression 404 sur les routes supprimées. - DÉCOUVERTE (les smokes l'ont prouvé) : `/api/library/local-workspace-children` renvoyait un 500 systématique (test vert → ASGI double response.start) et `/api/library/local-workspace` 500 dès qu'un workspace existe — les deux lisaient `local_workspace_items`, table AUCUNEMENT créée dans le codebase (0 CREATE TABLE) et sans 1 seule référence front. Supprimés avec `library._format_size` devenu mort (la copie de dashboard.py est inchangée). `local_workspace_items` : 0 occurrence restante dans app/. - helper `_seed_page` minimal (workspace NOT NULL inclus) + nettoyage en finally (pas de pollution des autres tests). suite 1053/1053 (229 s) · `ruff check app tests` OK · docs à jour restent phase 2b : api.py 3/23, dashboard.py 17/63, api_v2.py 50/115	2026-10-01 12:11:12 -04:00
bruno	da7326ffde	test: A32 phase 1 — 4 routers à 0 test couverts (10 smokes) (v7.11.0) FlowDeck CI / lint (push) Successful in 1m50s Details FlowDeck CI / test (push) Successful in 13m55s Details FlowDeck CI / docker (push) Canceled after 0s Details tests/test_smoke_uncovered.py — un smoke par route des 4 routers qui n'avaient AUCUN test : - webhooks.py 3/3 : réception sans secret → {"status":"ok"} ; HMAC faux → 401 (secret piloté par monkeypatch, déterministe quel que soit le .env) ; register sans secret → 400 AVANT tout appel réseau ; status avec gitea.list_webhooks stubbé → {"registered": False} (zéro réseau réel) - notes.py 2/2 : GET HTML + roundtrip POST→GET (upsert persisté en base, échappement HTML vérifié : <b> et non <b>) - sidebar_config.py 2/2 : GET défauts ; PUT persisté puis RELU depuis users.sidebar_config ; 400 sans config ; remise en état en fin de test - github_routes.py 2/2 : status {"linked": False} ; disconnect {"status": "ok"} Reste (A32 phase 2) : quasi nuls — library 1/10, api 3/23, dashboard 17/63, api_v2 50/115 → même recette, fixture client existante. suite 1047/1047 · `ruff check app tests` OK · docs à jour	2026-10-01 11:54:43 -04:00
bruno	3a1276596c	fix: A21 phase 2b — run_event_sync + 15 routes api_v2 en def (v7.10.0) FlowDeck CI / lint (push) Canceled after 0s Details FlowDeck CI / test (push) Canceled after 0s Details FlowDeck CI / docker (push) Canceled after 0s Details - `run_event_sync(coro)` (app/services/automations.py) : exécute une coroutine d'événement depuis un handler synchrone — `asyncio.run` sur une boucle dédiée dans le worker threadpool : le worker est bloqué, JAMAIS la boucle d'event, et la réponse n'est produite qu'une fois l'événement terminé (déterministe, équivalent sémantique de l'await). ponytail: les clients httpx sont créés à chaque appel partout → aucun lien de boucle ; sinon run_coroutine_threadsafe + boucle du lifespan. - 15 routes api_v2 dont les SEULS awaits étaient `request.json`, `_fire_event`, `fire_published`, `fire_unpublished` → `Body(default={})` + `run_event_sync(...)` + conversion en `def` (script : wrapping par appariement de parenthèses chaîne-aware, assert de flip « plus aucun await »). - api_v2 : 111/115 routes hors loop. Les 4 restantes ont de vrais awaits réseau et restent async volontairement : import_csv_v2 (multipart), project_tree_v2 (gitea), test_webhook_v2 (delivery), retry_webhook_deliveries. - Repo-wide : 403 routes sync (hors loop) / 260 async (phase 2c). tests : ciblé public_api_v2 + v65 + webhooks_v2 + audit = 90/90 (les webhooks prouvent la détermination de run_event_sync) ; suite complète 1037/1037 (228 s) · `ruff check app tests` OK · docs à jour	2026-10-01 11:35:43 -04:00
bruno	07904f05e5	fix: A21 phase 2a — api_v2 : body JSON en paramètre, 36 routes hors loop (v7.9.0) FlowDeck CI / lint (push) Canceled after 0s Details FlowDeck CI / test (push) Canceled after 0s Details FlowDeck CI / docker (push) Canceled after 0s Details - Les 36 routes d'api_v2 dont le SEUL `await` était `body = await request.json()` (bloc try/except uniforme) → paramètre FastAPI `body: dict = Body(default={})` + conversion en `def` → threadpool : toute leur séquence SQLite quitte l'event loop. - Équivalences vérifiées avant engament (probe FastAPI) : · corps absent → `{}` (identique à l'ancien try/except) · JSON invalide → 422 (avant : avalé comme `{}` — 422 est plus juste) · zéro `body[...]=` / setdefault / update dans api_v2 → défaut partagé jamais muté - verify_webhook_signature (signature multi-ligne) traitée à la main. - Piège courant évité : première version du script supprimait 5 lignes au lieu de 4 (slice m-1:m+4) → fichier restauré depuis git, slice corrigée, 0 ligne perdue (diff logique +39/-183). api_v2 : 96/115 routes hors loop (60 phase 1 + 36 ici) ; 19 async restantes (fire_event, request.form, gitea/webhooks) = phase 2b. suite 1037/1037 (242 s) · `ruff check app tests` OK · docs à jour	2026-10-01 11:19:58 -04:00
@@ -1 +1 @@
 .8.0
 .20.0