plugins/kanban
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

Kanban — the todo board, extracted, over as many projects as you like

Browse Source 
was `/todos` in the platform: a board, an API and a tree reader pointed at
`resolve(process.cwd(), 'todo')`. that is not a setting — it is the belief that
there is one project and it is the one the server happens to have been started in.

THE READER CAME ACROSS UNCHANGED except for that one line. the frontmatter parser
that never rewrites a body, the ordering, the index writer — all of it as it was,
and its 8 tests came too and still pass. everything that changed is that the
directory is now a parameter.

`writeIndex` no longer writes to `process.cwd()` either. that was the same
assumption wearing a different hat, and with two projects it would have had every
board overwriting one file. the map goes beside the folder it describes.

A PROJECT IS A NAME AND A PATH, and paths are confined to the owner's home by the
same three checks av-club uses — absolute, realpath BEFORE the containment test,
and `root` or `root + sep` rather than a bare startsWith. spelled out again rather
than cross-referenced, because the next person to add a path-taking route reads the
file they are in.

it stores NO ITEMS. one table, a list of folders. uninstalling with "delete its
data" ticked loses the list and never a line of anybody's work — which is the
property the markdown format was chosen for.

`/projects` is owner-only: pointing this at a directory is a statement about the
filesystem. moving a card is not, so a member granted `kanban` can work any board
they can see.

removing a project removes the ROW. the route says so in its response and the
button says so in its tooltip, because "delete" beside a folder full of somebody's
work should not be ambiguous.

README records the seam honestly: the platform keeps its own todo/ and its CLI, so
there are two copies of the reader and they will drift. the alternative was making
the platform's own backlog depend on a plugin being installed.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
This commit is contained in:
pastilhas
2026-08-29 03:27:56 +01:00
co-authored by Claude Opus 5
commit 6e54f223e6
12 changed files with 1179 additions and 0 deletions
Download Patch File Download Diff File Expand all files Collapse all files
api/projects.ts
+88
View File
@@ -0,0 +1,88 @@
import { realpath, stat } from 'node:fs/promises';
import { isAbsolute, resolve, sep } from 'node:path';
import { db } from 'officerdb/db';
import { and, eq } from 'drizzle-orm';
import { getOwnerHomeDir } from '@@/data-path';
import { kanbanProjects, type KanbanProject } from '../db/schema';
/**
* The list of folders this board can show, and the rule about which folders those may be.
*
* ── Every path is confined to the owner's home ──
*
* A project path is caller-supplied and is then read from and WRITTEN to — `patchFrontmatter` edits
* files under it, and `writeIndex` creates one beside it. So it goes through the same three checks
* av-club's `paths.ts` applies, for the same reasons, and they are worth repeating rather than
* cross-referencing because the next person to add a path-taking route will read whichever file they
* are in:
*
* ABSOLUTE — a relative path resolves against a working directory the caller cannot see. That is
* precisely the bug this extraction exists to fix, so accepting one here would be reintroducing it
* through the front door.
* REALPATH FIRST — a symlink inside home pointing at `/etc` is resolved and then rejected. Checking
* the path as written and opening the resolved one is the classic way this fails.
* `root` OR `root + sep` — never a bare `startsWith`, which accepts `/home/user-backup` for a root
* of `/home/user`.
*/
const inside = (root: string, target: string) => target === root || target.startsWith(root + sep);
export class ProjectPathError extends Error {}
/**
* Validate a directory a caller wants to add.
*
* It must EXIST and be a directory. A project pointing at nothing is a row that produces an empty board
* with no explanation, and the moment to say so is while somebody is looking at the form.
*/
export async function safeProjectPath(raw: unknown, email: string): Promise<string> {
if (typeof raw !== 'string' || !raw.trim()) throw new ProjectPathError('A path is required.');
const home = getOwnerHomeDir(email);
const trimmed = raw.trim();
const expanded = trimmed === '~' ? home : trimmed.startsWith('~/') ? resolve(home, trimmed.slice(2)) : trimmed;
if (!isAbsolute(expanded)) throw new ProjectPathError('The path must be absolute.');
const real = await realpath(resolve(expanded)).catch(() => null);
// One message for "outside" and "missing" together: distinguishing them turns this into an oracle for
// what exists elsewhere on the disk.
if (!real || !inside(home, real)) throw new ProjectPathError('That is not a folder this board can read.');
const info = await stat(real).catch(() => null);
if (!info?.isDirectory()) throw new ProjectPathError('That path is not a directory.');
return real;
}
export const listProjects = (userId: number): Promise<KanbanProject[]> =>
db.select().from(kanbanProjects).where(eq(kanbanProjects.userId, userId)).orderBy(kanbanProjects.name);
/**
* One project, scoped to its owner.
*
* The `userId` is in the WHERE clause rather than checked after the read. A query that fetches by id
* and then compares is one `if` away from returning somebody else's row, and that `if` is exactly what
* gets dropped in a refactor.
*/
export async function getProject(userId: number, id: number): Promise<KanbanProject | null> {
const [row] = await db
.select()
.from(kanbanProjects)
.where(and(eq(kanbanProjects.userId, userId), eq(kanbanProjects.id, id)))
.limit(1);
return row ?? null;
}
export async function addProject(userId: number, name: string, path: string): Promise<KanbanProject> {
const [row] = await db.insert(kanbanProjects).values({ userId, name, path }).returning();
return row!;
}
/** Removes the ROW. Never the folder — this plugin does not delete anybody's todo files, ever. */
export async function removeProject(userId: number, id: number): Promise<boolean> {
const rows = await db
.delete(kanbanProjects)
.where(and(eq(kanbanProjects.userId, userId), eq(kanbanProjects.id, id)))
.returning({ id: kanbanProjects.id });
return rows.length > 0;
}
api/router.ts
+142
View File
@@ -0,0 +1,142 @@
import { existsSync, readFileSync, writeFileSync } from 'node:fs';
import { join, resolve } from 'node:path';
import type { Context } from 'hono';
import { createRouter, type HonoVariables } from '@@/create-router';
import * as errors from '@@/custom-errors';
import { TODO_STATUSES, bodyOf, frontmatter, patchFrontmatter, readTree, writeIndex } from './tree';
import { ProjectPathError, addProject, getProject, listProjects, removeProject, safeProjectPath } from './projects';
/**
* Mounted at `/api/kanban`.
*
* ── Every item route takes a project ──
*
* That is the extraction, expressed in the URL. The platform's version had no such parameter because it
* had no such question: there was one folder and it was found from `process.cwd()`.
*
* The project is resolved to a row FIRST, scoped by the caller's own user id, and the path used for the
* filesystem work comes from that row — never from the request. So a caller cannot name a directory,
* only choose among ones already vetted by `safeProjectPath` when they were added.
*
* ── Who may do what ──
*
* The manifest makes `/projects` owner-only: pointing this plugin at a folder is a statement about the
* filesystem. Moving a card is not, so a member granted `kanban` can work the board of any project they
* can see. Nothing in this file checks again — two places deciding the same thing is how they come to
* disagree.
*/
export const router = createRouter();
// ── Projects ──
router.get('/projects', async (ctx) => {
const user = ctx.get('user');
return ctx.json({ projects: await listProjects(user.id as number) });
});
router.post('/projects', async (ctx) => {
const user = ctx.get('user');
const { name, path } = (ctx.get('body') ?? {}) as { name?: string; path?: string };
if (!name?.trim()) throw errors.BAD_REQUEST('name is required');
try {
const resolved = await safeProjectPath(path, user.email as string);
return ctx.json(await addProject(user.id as number, name.trim(), resolved), 201);
} catch (error) {
// A bad path is the caller's words being unusable, not a fault. Anything else is a real failure and
// is left to the platform's error handler rather than flattened into a 400.
if (error instanceof ProjectPathError) throw errors.BAD_REQUEST(error.message);
throw error;
}
});
router.delete('/projects/:id', async (ctx) => {
const user = ctx.get('user');
const removed = await removeProject(user.id as number, Number(ctx.req.param('id')));
if (!removed) throw errors.NOT_FOUND('no such project');
// Said plainly, because "delete" next to a folder full of somebody's work deserves to be unambiguous.
return ctx.json({ ok: true, note: 'The folder and its files were not touched.' });
});
// ── The board ──
/**
* Resolve `?project=<id>` to a directory this caller owns.
*
* Every item route starts here, so there is one place where a request turns into a path on disk.
*/
async function rootFor(ctx: Context<{ Variables: HonoVariables }>): Promise<string> {
const user = ctx.get('user');
const id = Number(ctx.req.query('project'));
if (!Number.isInteger(id)) throw errors.BAD_REQUEST('project is required');
const project = await getProject(user.id as number, id);
if (!project) throw errors.NOT_FOUND('no such project');
return project.path;
}
/** `<theme>/<slug>`, both kebab-case — also the traversal guard, since it admits no dot or slash pair. */
const ID_SHAPE = /^[a-z0-9][a-z0-9-]*\/[a-z0-9][a-z0-9-]*$/;
const fileForId = (root: string, id: string): string => {
if (!ID_SHAPE.test(id)) throw errors.BAD_REQUEST(`not a todo id: ${id}`);
const [theme, slug] = id.split('/');
// Joined onto the ROW's path, which was vetted when the project was added — never onto anything from
// this request beyond the id, which the shape above has already constrained.
const path = resolve(root, join(theme!, `${slug}.md`));
if (!existsSync(path)) throw errors.NOT_FOUND(`no todo at ${id}`);
return path;
};
/** GET /api/kanban?project=<id> — the whole tree, no bodies. What the board renders. */
router.get('/', async (ctx) => ctx.json(readTree(await rootFor(ctx))));
/** GET /api/kanban/item?project=<id>&id=<theme>/<slug> — one item, body included. */
router.get('/item', async (ctx) => {
const text = readFileSync(fileForId(await rootFor(ctx), ctx.req.query('id') ?? ''), 'utf8');
return ctx.json({ meta: frontmatter(text), body: bodyOf(text) });
});
/**
* PATCH /api/kanban/item — update an item's frontmatter: `{ id, status?, priority?, due?, order? }`.
*
* **The body is untouchable through this API, on purpose.** The prose is the owner's; only the machine's
* half of the file is writable here, and `patchFrontmatter` splices keys without touching a byte past
* the closing fence.
*/
router.patch('/item', async (ctx) => {
const root = await rootFor(ctx);
const { id, status, priority, due, order } = (ctx.get('body') ?? {}) as {
id: string;
status?: string;
priority?: string;
due?: string;
order?: number;
};
const path = fileForId(root, id);
const updates: Record<string, string> = {};
if (status !== undefined) {
if (!(TODO_STATUSES as readonly string[]).includes(status)) throw errors.BAD_REQUEST(`not a status: ${status}`);
updates.status = status;
}
// `urgent` or nothing — the format deliberately has no scale.
if (priority !== undefined) {
if (priority !== '' && priority !== 'urgent') throw errors.BAD_REQUEST(`not a priority: ${priority}`);
updates.priority = priority;
}
if (due !== undefined) {
if (due !== '' && !/^20\d\d-\d\d-\d\d$/.test(due)) throw errors.BAD_REQUEST(`not a date: ${due}`);
updates.due = due;
}
if (order !== undefined) {
if (!Number.isInteger(order) || order < 0) throw errors.BAD_REQUEST(`not an order: ${order}`);
updates.order = String(order);
}
if (Object.keys(updates).length === 0) throw errors.BAD_REQUEST('nothing to update');
writeFileSync(path, patchFrontmatter(readFileSync(path, 'utf8'), updates));
// The generated map, regenerated on every write so it cannot drift from the tree it describes.
writeIndex(root);
return ctx.json({ ok: true });
});
api/tree.test.ts
+62
View File
@@ -0,0 +1,62 @@
import { describe, expect, test } from 'bun:test';
import { bodyOf, frontmatter, patchFrontmatter } from './tree';
const FILE = `---
id: fleet/an-item
title: "An item, with: punctuation"
theme: fleet
status: open
created: 2026-08-21
order: 2
---
**The body.** Hand-written prose with --- inside it.
- a list
`;
describe('frontmatter', () => {
test('reads plain and JSON-quoted values', () => {
const fm = frontmatter(FILE);
expect(fm.id).toBe('fleet/an-item');
expect(fm.title).toBe('An item, with: punctuation');
expect(fm.order).toBe('2');
});
test('accepts prettier-style single quotes', () => {
expect(frontmatter(`---\ntitle: 'A quoted title'\n---\n`).title).toBe('A quoted title');
});
test('no frontmatter → empty', () => {
expect(frontmatter('just prose')).toEqual({});
});
});
describe('bodyOf', () => {
test('returns everything after the fence, trimmed of leading blank lines', () => {
expect(bodyOf(FILE).startsWith('**The body.**')).toBe(true);
});
});
describe('patchFrontmatter', () => {
test('replaces an existing key in place', () => {
const out = patchFrontmatter(FILE, { status: 'done' });
expect(frontmatter(out).status).toBe('done');
expect(out.match(/^status:/gm)).toHaveLength(1);
});
test('appends a key that was absent', () => {
const out = patchFrontmatter(FILE, { priority: 'urgent' });
expect(frontmatter(out).priority).toBe('urgent');
});
test('never touches the body — byte for byte', () => {
const out = patchFrontmatter(FILE, { status: 'doing', order: '9' });
expect(bodyOf(out)).toBe(bodyOf(FILE));
});
test('a --- inside the body is not mistaken for the fence', () => {
const out = patchFrontmatter(FILE, { status: 'done' });
expect(out).toContain('with --- inside it');
});
});
api/tree.ts
+190
View File
@@ -0,0 +1,190 @@
import { readFileSync, readdirSync, writeFileSync, statSync } from 'node:fs';
import { join, resolve } from 'node:path';
// The todo tree: `todo/<theme>/<item>.md`, one item per file, frontmatter + hand-written prose.
// `todo/README.md` is the format's contract; the parts that matter here:
//
// - `id` (`<theme>/<slug>`) is the identity and the filename. Everything keys on it.
// - Frontmatter is the machine's half. The BODY IS THE OWNER'S and is never rewritten by code —
// `patchFrontmatter` below splices keys into the frontmatter block and must not touch a byte past
// the closing fence.
// - `TODO.md` at the repo root is GENERATED output (`writeIndex`), never a write target.
//
// This module is the one reader and one writer. `scripts/todo-index.ts` (the CLI) and the `/api/todos`
// router both import it, so the board and the generated index cannot disagree about what the tree holds.
/*
THE ONE THING THAT CHANGED IN THIS FILE.
It read `resolve(process.cwd(), 'todo')` — the platform's own todo folder, found by assuming the
server's working directory. That is not a setting; it is the belief that there is exactly one project
and it is the one the process happens to have been started in.
Every function below now takes the directory. Everything else here — the frontmatter reader that
never touches the body, the index writer, the ordering — is unchanged and was already right.
*/
export const TODO_STATUSES = ['open', 'doing', 'blocked', 'backburner', 'done'] as const;
export type TodoStatus = (typeof TODO_STATUSES)[number];
export type TodoItem = {
id: string;
title: string;
theme: string;
status: string;
created: string;
/** `urgent` or empty — deliberately no scale, see todo/README.md. */
priority: string;
due: string;
order: number;
file: string;
};
export type TodoTheme = { theme: string; heading: string; note: string; items: TodoItem[] };
/** Minimal frontmatter reader — `key: value`, values optionally JSON-quoted. No YAML dependency. */
export function frontmatter(text: string): Record<string, string> {
const end = text.indexOf('\n---', 4);
if (!text.startsWith('---') || end === -1) return {};
const out: Record<string, string> = {};
for (const line of text.slice(4, end).split('\n')) {
const m = line.match(/^([a-z_]+):\s*(.*)$/);
if (!m || !m[1]) continue;
const raw = (m[2] ?? '').trim();
out[m[1]] = raw.startsWith('"') || raw.startsWith("'") ? (JSON.parse(normalizeQuotes(raw)) as string) : raw;
}
return out;
}
// Prettier rewrites the frontmatter's double quotes to single, which JSON.parse refuses. Both mean the
// same string; accept both rather than fighting the formatter.
const normalizeQuotes = (raw: string) =>
raw.startsWith("'") ? JSON.stringify(raw.slice(1, -1).replace(/\\'/g, "'")) : raw;
/** The body: everything after the frontmatter block's closing fence and its trailing blank lines. */
export function bodyOf(text: string): string {
const end = text.indexOf('\n---', 4);
if (!text.startsWith('---') || end === -1) return text;
return text.slice(end + 4).replace(/^\n+/, '');
}
/**
* Splice `updates` into the frontmatter block, touching nothing else — the body is hand-written prose
* and a rewrite would produce a diff nobody can read. An existing key is replaced in place; a new one
* is appended just before the closing fence. Returns the text unchanged if there is no frontmatter.
*/
export function patchFrontmatter(text: string, updates: Record<string, string>): string {
const end = text.indexOf('\n---', 4);
if (!text.startsWith('---') || end === -1) return text;
let block = text.slice(4, end);
for (const [key, value] of Object.entries(updates)) {
const line = `${key}: ${value}`;
const re = new RegExp(`^${key}:.*$`, 'm');
block = re.test(block) ? block.replace(re, line) : `${block}\n${line}`;
}
return `---\n${block}${text.slice(end)}`;
}
export function readTree(root: string): { themes: TodoTheme[] } {
const themes = readdirSync(root)
.filter((d) => statSync(join(root, d)).isDirectory())
.sort()
.map((theme) => {
const files = readdirSync(join(root, theme)).filter((f) => f.endsWith('.md'));
const indexText = readFileSync(join(root, theme, '_index.md'), 'utf8');
const meta = frontmatter(indexText);
const items = files
.filter((f) => f !== '_index.md')
.map((f) => {
const fm = frontmatter(readFileSync(join(root, theme, f), 'utf8'));
return {
id: fm.id ?? `${theme}/${f.replace(/\.md$/, '')}`,
title: fm.title ?? f,
theme,
status: fm.status ?? 'open',
created: fm.created ?? '',
priority: fm.priority ?? '',
due: fm.due ?? '',
order: Number(fm.order ?? 0),
file: `todo/${theme}/${f}`,
};
})
.sort((a, b) => a.order - b.order);
return { theme, heading: meta.heading ?? theme, note: bodyOf(indexText).trim(), items };
});
return { themes };
}
const HEADER = `# TODO — the index
Deferred work. **The items live in \`todo/\`, one file each**, grouped by theme; this file is the map
over them and is GENERATED — run \`bun run todo:index\` after any change rather than editing it here.
Format and the two-way-sync contract: \`todo/README.md\`. Browse and edit it at \`/todos\` in the app.
**Context, corrected 2026-08-07.** This list used to open by saying Officer was "collapsing from
multi-tenant / open-source-ready to a **single-user platform**", and told you to treat multi-tenant
indirection as accidental complexity. **That direction was reversed.** The permission model shipped on
2026-08-07 to serve a real goal — deploy to the company server, onboard people, give each one their own
Gitea account through the platform. Per-user scoping is now a requirement, and the items that proposed
deleting it have been removed rather than left to mislead the next reader.
What did NOT reverse: \`execution\` permissions (terminal, chat, tasks, files, desktop, browser) run as
the owner's OS user and can never be granted. Indirection there really is accidental complexity.
`;
export function renderIndex(root: string): string {
const { themes } = readTree(root);
const all = themes.flatMap((t) => t.items);
const open = all.filter((i) => i.status !== 'done').length;
const done = all.length - open;
const urgent = all
.filter((i) => i.status !== 'done' && i.priority === 'urgent')
.sort((a, b) => (a.due || '9999').localeCompare(b.due || '9999'))
.map((i) => `- ${i.due ? `**due ${i.due}** — ` : ''}**${i.title}** — [${i.id}](${i.file})`);
const rows = themes
.filter((t) => t.items.length)
.map((t) => {
const o = t.items.filter((i) => i.status !== 'done').length;
return `| [${t.heading}](todo/${t.theme}/) | ${o} | ${t.items.length - o} |`;
});
// A theme holding only prose has no row above, and an entry nobody can see is the failure mode the
// whole split risks. List them explicitly rather than letting them age out of view.
const notes = themes.filter((t) => !t.items.length).map((t) => `- [${t.heading}](todo/${t.theme}/_index.md)`);
const recent = all
.filter((i) => i.status !== 'done')
.sort((a, b) => b.created.localeCompare(a.created))
.slice(0, 10)
.map((i) => `- \`${i.created}\` **${i.title}** — [${i.id}](${i.file})`);
return [
HEADER,
...(urgent.length ? [`## Urgent\n`, ...urgent, ``] : []),
`## Themes\n`,
`**${open} open, ${done} closed**, across ${rows.length} themes.\n`,
`| Theme | Open | Closed |`,
`| --- | --- | --- |`,
...rows,
``,
`## Records — no items, kept for the reasoning\n`,
...notes,
``,
`## Newest ten\n`,
...recent,
``,
].join('\n');
}
/**
* The generated map, written beside the tree rather than at `process.cwd()`.
*
* It used to go to the platform's own repo root, which was the same assumption as `todoDir` and wrong
* the same way: with two projects it would have had every board overwriting one file. `<root>/../TODO.md`
* keeps the map next to the folder it describes, which is where somebody reading that repository looks.
*/
export function writeIndex(root: string): void {
writeFileSync(resolve(root, '..', 'TODO.md'), renderIndex(root));
}