v2.97

- Add new background colors: moderatepink, strongcyan, limegreen.
- Add new background colors with themes: dark, relax.
- Note: due date etc on cards is visible on all themes. Hiding is not implemented yet.

Thanks to xet7 !

.babelrc

@@ -1,12 +0,0 @@
-{ 
-  "presets": [ 
-    "@babel/preset-stage-3" 
-  ],
-  "env": {
-    "COVERAGE": {
-      "plugins": [
-        "istanbul"
-      ]
-    }
-  }
-}

.codex/config.toml

@@ -1,5 +0,0 @@
-# Project-scoped Codex configuration.
-#
-# Claude has no non-default tool permissions or MCP servers configured for this
-# repository, so there are no settings to translate here. Project instructions
-# live in AGENTS.md and the nested AGENTS.md files.

.devcontainer/Dockerfile

@@ -1,293 +0,0 @@
-FROM ubuntu:24.04
-LABEL maintainer="wekan"
-LABEL org.opencontainers.image.ref.name="ubuntu"
-LABEL org.opencontainers.image.version="24.04"
-LABEL org.opencontainers.image.source="https://github.com/wekan/wekan"
-
-# 2022-04-25:
-# - gyp does not yet work with Ubuntu 22.04 ubuntu:rolling,
-#   so changing to 21.10. https://github.com/wekan/wekan/issues/4488
-
-ENV BUILD_DEPS="apt-utils gnupg gosu wget bzip2 g++ iproute2 apt-transport-https libarchive-tools"
-ENV DEV_DEPS="curl python3 ca-certificates build-essential git"
-ARG DEBIAN_FRONTEND=noninteractive
-
-ENV \
-    DEBUG=false \
-    NODE_VERSION=v14.21.4 \
-    METEOR_RELEASE=METEOR@2.14 \
-    USE_EDGE=false \
-    METEOR_EDGE=1.5-beta.17 \
-    NPM_VERSION=6.14.17 \
-    FIBERS_VERSION=4.0.1 \
-    ARCHITECTURE=linux-x64 \
-    SRC_PATH=./ \
-    WITH_API=true \
-    RESULTS_PER_PAGE="" \
-    DEFAULT_BOARD_ID="" \
-    ACCOUNTS_LOCKOUT_KNOWN_USERS_FAILURES_BEFORE=3 \
-    ACCOUNTS_LOCKOUT_KNOWN_USERS_PERIOD=60 \
-    ACCOUNTS_LOCKOUT_KNOWN_USERS_FAILURE_WINDOW=15 \
-    ACCOUNTS_LOCKOUT_UNKNOWN_USERS_FAILURES_BERORE=3 \
-    ACCOUNTS_LOCKOUT_UNKNOWN_USERS_LOCKOUT_PERIOD=60 \
-    ACCOUNTS_LOCKOUT_UNKNOWN_USERS_FAILURE_WINDOW=15 \
-    ACCOUNTS_COMMON_LOGIN_EXPIRATION_IN_DAYS=90 \
-    ATTACHMENTS_UPLOAD_EXTERNAL_PROGRAM="" \
-    ATTACHMENTS_UPLOAD_MIME_TYPES="" \
-    ATTACHMENTS_UPLOAD_MAX_SIZE=0 \
-    AVATARS_UPLOAD_EXTERNAL_PROGRAM="" \
-    AVATARS_UPLOAD_MIME_TYPES="" \
-    AVATARS_UPLOAD_MAX_SIZE=0 \
-    RICHER_CARD_COMMENT_EDITOR=false \
-    CARD_OPENED_WEBHOOK_ENABLED=false \
-    MAX_IMAGE_PIXEL="" \
-    IMAGE_COMPRESS_RATIO="" \
-    NOTIFICATION_TRAY_AFTER_READ_DAYS_BEFORE_REMOVE="" \
-    BIGEVENTS_PATTERN=NONE \
-    NOTIFY_DUE_DAYS_BEFORE_AND_AFTER="" \
-    NOTIFY_DUE_AT_HOUR_OF_DAY="" \
-    EMAIL_NOTIFICATION_TIMEOUT=30000 \
-    MATOMO_ADDRESS="" \
-    MATOMO_SITE_ID="" \
-    MATOMO_DO_NOT_TRACK=true \
-    MATOMO_WITH_USERNAME=false \
-    METRICS_ALLOWED_IP_ADDRESSES="" \
-    BROWSER_POLICY_ENABLED=true \
-    TRUSTED_URL="" \
-    WEBHOOKS_ATTRIBUTES="" \
-    OAUTH2_ENABLED=false \
-    OIDC_REDIRECTION_ENABLED=false \
-    OAUTH2_CA_CERT="" \
-    OAUTH2_ADFS_ENABLED=false \
-    OAUTH2_B2C_ENABLED=false \
-    OAUTH2_LOGIN_STYLE=redirect \
-    OAUTH2_CLIENT_ID="" \
-    OAUTH2_SECRET="" \
-    OAUTH2_SERVER_URL="" \
-    OAUTH2_AUTH_ENDPOINT="" \
-    OAUTH2_USERINFO_ENDPOINT="" \
-    OAUTH2_TOKEN_ENDPOINT="" \
-    OAUTH2_ID_MAP="" \
-    OAUTH2_USERNAME_MAP="" \
-    OAUTH2_FULLNAME_MAP="" \
-    OAUTH2_ID_TOKEN_WHITELIST_FIELDS="" \
-    OAUTH2_REQUEST_PERMISSIONS='openid profile email' \
-    OAUTH2_EMAIL_MAP="" \
-    LDAP_ENABLE=false \
-    LDAP_PORT=389 \
-    LDAP_HOST="" \
-    LDAP_AD_SIMPLE_AUTH="" \
-    LDAP_USER_AUTHENTICATION=false \
-    LDAP_USER_AUTHENTICATION_FIELD=uid \
-    LDAP_BASEDN="" \
-    LDAP_LOGIN_FALLBACK=false \
-    LDAP_RECONNECT=true \
-    LDAP_TIMEOUT=10000 \
-    LDAP_IDLE_TIMEOUT=10000 \
-    LDAP_CONNECT_TIMEOUT=10000 \
-    LDAP_AUTHENTIFICATION=false \
-    LDAP_AUTHENTIFICATION_USERDN="" \
-    LDAP_AUTHENTIFICATION_PASSWORD="" \
-    LDAP_LOG_ENABLED=false \
-    LDAP_BACKGROUND_SYNC=false \
-    LDAP_BACKGROUND_SYNC_INTERVAL="" \
-    LDAP_BACKGROUND_SYNC_KEEP_EXISTANT_USERS_UPDATED=false \
-    LDAP_BACKGROUND_SYNC_IMPORT_NEW_USERS=false \
-    LDAP_ENCRYPTION=false \
-    LDAP_CA_CERT="" \
-    LDAP_REJECT_UNAUTHORIZED=false \
-    LDAP_USER_SEARCH_FILTER="" \
-    LDAP_USER_SEARCH_SCOPE="" \
-    LDAP_USER_SEARCH_FIELD="" \
-    LDAP_SEARCH_PAGE_SIZE=0 \
-    LDAP_SEARCH_SIZE_LIMIT=0 \
-    LDAP_GROUP_FILTER_ENABLE=false \
-    LDAP_GROUP_FILTER_OBJECTCLASS="" \
-    LDAP_GROUP_FILTER_GROUP_ID_ATTRIBUTE="" \
-    LDAP_GROUP_FILTER_GROUP_MEMBER_ATTRIBUTE="" \
-    LDAP_GROUP_FILTER_GROUP_MEMBER_FORMAT="" \
-    LDAP_GROUP_FILTER_GROUP_NAME="" \
-    LDAP_UNIQUE_IDENTIFIER_FIELD="" \
-    LDAP_UTF8_NAMES_SLUGIFY=true \
-    LDAP_USERNAME_FIELD="" \
-    LDAP_FULLNAME_FIELD="" \
-    LDAP_MERGE_EXISTING_USERS=false \
-    LDAP_EMAIL_FIELD="" \
-    LDAP_EMAIL_MATCH_ENABLE=false \
-    LDAP_EMAIL_MATCH_REQUIRE=false \
-    LDAP_EMAIL_MATCH_VERIFIED=false \
-    LDAP_SYNC_USER_DATA=false \
-    LDAP_SYNC_USER_DATA_FIELDMAP="" \
-    LDAP_SYNC_GROUP_ROLES="" \
-    LDAP_DEFAULT_DOMAIN="" \
-    LDAP_SYNC_ADMIN_STATUS="" \
-    LDAP_SYNC_ADMIN_GROUPS="" \
-    HEADER_LOGIN_ID="" \
-    HEADER_LOGIN_FIRSTNAME="" \
-    HEADER_LOGIN_LASTNAME="" \
-    HEADER_LOGIN_EMAIL="" \
-    HEADER_LOGIN_TRUSTED_IPS="" \
-    HEADER_LOGIN_TRUSTED_PROXIES="" \
-    LOGOUT_WITH_TIMER=false \
-    LOGOUT_IN="" \
-    LOGOUT_ON_HOURS="" \
-    LOGOUT_ON_MINUTES="" \
-    CORS="" \
-    CORS_ALLOW_HEADERS="" \
-    CORS_EXPOSE_HEADERS="" \
-    DEFAULT_AUTHENTICATION_METHOD="" \
-    PASSWORD_LOGIN_ENABLED=true \
-    CAS_ENABLED=false \
-    CAS_BASE_URL="" \
-    CAS_LOGIN_URL="" \
-    CAS_VALIDATE_URL="" \
-    SAML_ENABLED=false \
-    SAML_PROVIDER="" \
-    SAML_ENTRYPOINT="" \
-    SAML_ISSUER="" \
-    SAML_CERT="" \
-    SAML_IDPSLO_REDIRECTURL="" \
-    SAML_PRIVATE_KEYFILE="" \
-    SAML_PUBLIC_CERTFILE="" \
-    SAML_IDENTIFIER_FORMAT="" \
-    SAML_LOCAL_PROFILE_MATCH_ATTRIBUTE="" \
-    SAML_ATTRIBUTES="" \
-    ORACLE_OIM_ENABLED=false \
-    WAIT_SPINNER="" \
-    WRITABLE_PATH=/data \
-    S3=""
-
-#   NODE_OPTIONS="--max_old_space_size=4096"
-
-#---------------------------------------------
-# == at docker-compose.yml: AUTOLOGIN WITH OIDC/OAUTH2 ====
-# https://github.com/wekan/wekan/wiki/autologin
-#- OIDC_REDIRECTION_ENABLED=true
-#---------------------------------------------------------------------
-
-ENV PATH=$PATH:/home/wekan/.meteor/
-
-RUN <<EOR
-echo "export PATH=$PATH" >> /etc/environment
-EOR
-
-# Copy source dir
-RUN <<EOR
-set -o xtrace
-
-mkdir -p /home/wekan/app/.meteor
-mkdir -p /home/wekan/app/packages
-EOR
-
-COPY \
-    .meteor/.finished-upgraders \
-    .meteor/.id \
-    .meteor/cordova-plugins \
-    .meteor/packages \
-    .meteor/platforms \
-    .meteor/release \
-    .meteor/versions \
-    /home/wekan/app/.meteor/
-
-COPY \
-    package.json \
-    settings.json \
-    /home/wekan/app/
-
-COPY \
-    tests \
-    /home/wekan/app/tests/
-
-COPY \
-    packages \
-    /home/wekan/app/packages/
-
-# Install OS
-RUN <<EOR
-set -o xtrace
-
-# Add non-root user wekan
-useradd --user-group --system --home-dir /home/wekan wekan
-# OS dependencies
-apt-get update --assume-yes
-apt-get install --assume-yes --no-install-recommends ${BUILD_DEPS} ${DEV_DEPS}
-
-# Meteor installer doesn't work with the default tar binary, so using bsdtar while installing.
-# https://github.com/coreos/bugs/issues/1095#issuecomment-350574389
-cp $(which tar) $(which tar)~
-ln -sf $(which bsdtar) $(which tar)
-
-# Install NodeJS
-cd /tmp
-
-# Download nodejs
-wget "https://github.com/wekan/node-v14-esm/releases/download/${NODE_VERSION}/node-${NODE_VERSION}-${ARCHITECTURE}.tar.gz"
-wget "https://github.com/wekan/node-v14-esm/releases/download/${NODE_VERSION}/SHASUMS256.txt"
-
-# Verify nodejs authenticity
-grep "node-${NODE_VERSION}-${ARCHITECTURE}.tar.gz" "SHASUMS256.txt" | shasum -a 256 -c -
-rm -f "SHASUMS256.txt"
-
-# Install Node
-tar xzf "node-$NODE_VERSION-$ARCHITECTURE.tar.gz" -C /usr/local --strip-components=1 --no-same-owner
-rm "node-$NODE_VERSION-$ARCHITECTURE.tar.gz" "SHASUMS256.txt"
-ln -s "/usr/local/bin/node" "/usr/local/bin/nodejs"
-mkdir -p "/opt/nodejs/lib/node_modules/fibers/.node-gyp" "/root/.node-gyp/${NODE_VERSION} /home/wekan/.config"
-
-# Install node dependencies
-npm install -g npm@${NPM_VERSION}
-chown --recursive wekan:wekan /home/wekan/.config
-
-# Install Meteor
-cd /home/wekan
-chown --recursive wekan:wekan /home/wekan
-echo "Starting meteor ${METEOR_RELEASE} installation...   \n"
-gosu wekan:wekan curl https://install.meteor.com/ | /bin/sh
-mv /root/.meteor /home/wekan/
-chown --recursive wekan:wekan /home/wekan/.meteor
-
-# sed -i 's/api\.versionsFrom/\/\/api.versionsFrom/' /home/wekan/app/packages/meteor-useraccounts-core/package.js
-cd /home/wekan/.meteor
-gosu wekan:wekan /home/wekan/.meteor/meteor -- help
-
-# Build app (Development)
-cd /home/wekan/app
-gosu wekan:wekan /home/wekan/.meteor/meteor add standard-minifier-js
-gosu wekan:wekan /home/wekan/.meteor/meteor npm install --no-audit
-
-# Put back the original tar
-mv $(which tar)~ $(which tar)
-
-# Cleanup
-apt-get remove --purge --assume-yes ${BUILD_DEPS}
-apt-get install --assume-yes --no-install-recommends build-essential
-apt-get autoremove --assume-yes
-apt-get clean --assume-yes
-rm -Rf /tmp/*
-rm -Rf /var/lib/apt/lists/*
-rm -Rf /var/cache/apt
-rm -Rf /var/lib/apt/lists
-rm -Rf /home/wekan/app_build
-
-mkdir /data
-chown wekan --recursive /data
-EOR
-
-USER wekan
-
-ENV PORT=3000
-EXPOSE $PORT
-
-STOPSIGNAL SIGKILL
-WORKDIR /home/wekan/app
-
-#---------------------------------------------------------------------
-# https://github.com/wekan/wekan/issues/3585#issuecomment-1021522132
-# Add more Node heap:
-#   NODE_OPTIONS="--max_old_space_size=4096"
-# Add more stack:
-#   bash -c "ulimit -s 65500; exec node --stack-size=65500 main.js"
-#---------------------------------------------------------------------
-#
-
-CMD ["/home/wekan/.meteor/meteor", "run", "--verbose", "--settings", "settings.json"]

.devcontainer/build.sh

@@ -1,14 +0,0 @@
-#!/bin/bash
-
-cd /home/wekan/app
-rm -rf node_modules
-/home/wekan/.meteor/meteor npm install
-rm -rf .build
-/home/wekan/.meteor/meteor build .build --directory
-cp -f fix-download-unicode/cfs_access-point.txt .build/bundle/programs/server/packages/cfs_access-point.js
-cd .build/bundle/programs/server
-rm -rf node_modules
-/home/wekan/.meteor/meteor npm install
-cd node_modules/fibers
-node build.js
-cd /home/wekan/app

.devcontainer/devcontainer.json

@@ -1,17 +0,0 @@
-// See https://aka.ms/vscode-remote/devcontainer.json for format details.
-{
-  "dockerComposeFile": ["docker-compose.yml", "docker-compose.extend.yml"],
-  "service": "wekan-dev",
-  "workspaceFolder": "/home/wekan/app",
-  "extensions": [
-    "mutantdino.resourcemonitor",
-    "editorconfig.editorconfig",
-    "dbaeumer.vscode-eslint",
-    "codezombiech.gitignore",
-    "eamodio.gitlens",
-    "gruntfuggly.todo-tree",
-    "dotjoshjohnson.xml",
-    "redhat.vscode-yaml",
-    "vuhrmeister.vscode-meteor"
-  ]
-}

.devcontainer/docker-compose.yml

@@ -1,49 +0,0 @@
-services:
-
-  wekandb-dev:
-    image: mongo:6
-    container_name: wekan-dev-db
-    restart: unless-stopped
-    command: mongod --oplogSize 128
-    networks:
-      - wekan-dev-tier
-    expose:
-      - 27017
-    volumes:
-      - /etc/localtime:/etc/localtime:ro
-      - ./volumes/wekan-db:/data/db
-      - ./volumes/wekan-db-dump:/dump
-
-  wekan-dev:
-    container_name: wekan-dev-app
-    restart: always
-    networks:
-      - wekan-dev-tier
-    build:
-      context: ..
-      dockerfile: .devcontainer/Dockerfile
-    ports:
-      - 3000:3000
-      - 9229:9229
-    environment:
-      - MONGO_URL=mongodb://wekandb-dev:27017/wekan
-      - ROOT_URL=http://localhost:3000
-      - WITH_API=true
-      - RICHER_CARD_COMMENT_EDITOR=true
-      - BROWSER_POLICY_ENABLED=true
-      - WRITABLE_PATH=/data
-    depends_on:
-      - wekandb-dev
-    volumes:
-      - /etc/localtime:/etc/localtime:ro
-      - ./volumes/data:/data
-      - ../client:/home/wekan/app/client
-      - ../models:/home/wekan/app/models
-      - ../config:/home/wekan/app/config
-      - ../imports:/home/wekan/app/imports
-      - ../server:/home/wekan/app/server
-      - ../public:/home/wekan/app/public
-
-networks:
-  wekan-dev-tier:
-    driver: bridge

.dockerignore

@@ -1,36 +0,0 @@
-*~
-*.swp
-.meteor-spk
-*.sublime-workspace
-tmp/
-node_modules/
-npm-debug.log
-.gitmodules
-.vscode/
-.idea/
-.build/*
-**/parts/
-**/stage
-**/prime
-**/*.snap
-snap/.snapcraft/
-.idea
-.DS_Store
-.DS_Store?
-.build*
-*.browserify.js.cached
-*.browserify.js.map
-.build*
-versions.json
-.versions
-.npm
-.build*
-._*
-.Trashes
-Thumbs.db
-ehthumbs.db
-.eslintcache
-.meteor/local
-.devcontainer/docker-compose.extend.yml
-.devcontainer/volumes*/
-.git

.editorconfig

@@ -8,20 +8,3 @@ end_of_line = lf
 insert_final_newline = true
 indent_style = space
 indent_size = 2
-
-[*.{js,html}]
-
-charset = utf-8
-end_of_line = lf
-indent_brace_style = 1TBS
-indent_size = 2
-indent_style = space
-insert_final_newline = true
-max_line_length = 80
-quote_type = auto
-spaces_around_operators = true
-trim_trailing_whitespace = true
-
-[*.md]
-
-trim_trailing_whitespace = false

.eslintignore

@@ -1,2 +0,0 @@
-packages/*
-.snap-meteor-1.8/*

.eslintrc.json

@@ -1,59 +1,38 @@
 {
-  "extends": [
-    "eslint:recommended",
-    "plugin:meteor/recommended",
-    "prettier",
-    "prettier/standard"
-  ],
+  "extends": "eslint:recommended",
   "env": {
     "es6": true,
     "node": true,
-    "browser": true,
-    "meteor": true
+    "browser": true
   },
-  "parser": "babel-eslint",
   "parserOptions": {
-    "ecmaVersion": 2018,
-    "sourceType": "module"
+    "ecmaVersion": 2017,
+    "sourceType": "module",
+    "ecmaFeatures": {
+      "experimentalObjectRestSpread": true
+    }
   },
   "rules": {
     "strict": 0,
     "no-undef": 0,
     "accessor-pairs": 2,
-    "comma-dangle": [
-      2,
-      "always-multiline"
-    ],
+    "comma-dangle": [2, "always-multiline"],
     "consistent-return": 2,
     "dot-notation": 2,
     "eqeqeq": 2,
-    "indent": 0,
+    "indent": [2, 2],
     "no-cond-assign": 2,
     "no-constant-condition": 2,
     "no-eval": 2,
-    "no-inner-declarations": [
-      0
-    ],
+    "no-inner-declarations": [0],
     "no-unneeded-ternary": 2,
     "radix": 2,
-    "semi": [
-      2,
-      "always"
-    ],
-    "camelcase": [
-      2,
-      {
-        "properties": "never"
-      }
-    ],
+    "semi": [2, "always"],
+    "camelcase": [2, {"properties": "never"}],
     "comma-spacing": 2,
     "comma-style": 2,
     "eol-last": 2,
-    "linebreak-style": [
-      2,
-      "unix"
-    ],
-    "meteor/audit-argument-checks": 0,
+    "linebreak-style": [2, "unix"],
     "new-parens": 2,
     "no-lonely-if": 2,
     "no-multiple-empty-lines": 2,
@@ -61,15 +40,10 @@
     "no-spaced-func": 2,
     "no-trailing-spaces": 2,
     "operator-linebreak": 2,
-    "quotes": [
-      2,
-      "single",
-      {
-        "avoidEscape": true
-      }
-    ],
+    "quotes": [2, "single"],
     "semi-spacing": 2,
     "space-unary-ops": 2,
+    "arrow-parens": 2,
     "arrow-spacing": 2,
     "no-class-assign": 2,
     "no-dupe-class-members": 2,
@@ -78,35 +52,8 @@
     "prefer-const": 2,
     "prefer-spread": 2,
     "prefer-template": 2,
-    "no-unused-vars": "warn",
-    "@typescript-eslint/no-floating-promises": "error",
-    "prettier/prettier": [
-      "error",
-      {
-        "printWidth": 80,
-        "tabWidth": 2,
-        "useTabs": false,
-        "singleQuote": true,
-        "trailingComma": "all"
-      }
-    ],
-    "meteor/no-session": 0
+    "no-unused-vars" : "warn"
   },
-  "settings": {
-    "import/resolver": {
-      "meteor": {
-        "extensions": [
-          ".js",
-          ".jsx"
-        ]
-      }
-    }
-  },
-  "plugins": [
-    "prettier",
-    "meteor",
-    "@typescript-eslint"
-  ],
   "globals": {
     "Meteor": false,
     "Session": false,
@@ -123,31 +70,37 @@
     "Template": false,
     "$": false,
     "_": false,
+    "autosize": false,
     "Avatar": true,
     "Avatars": true,
+    "BlazeComponent": false,
+    "BlazeLayout": false,
     "CollectionHooks": false,
+    "DocHead": false,
     "ESSearchResults": false,
     "FastRender": false,
     "FlowRouter": false,
     "FS": false,
     "getSlug": false,
     "Migrations": false,
+    "moment": false,
     "Mousetrap": false,
     "Picker": false,
     "Presence": true,
     "presences": true,
     "Ps": true,
+    "ReactiveTabs": false,
     "Restivus": false,
     "SimpleSchema": false,
+    "SubsManager": false,
     "T9n": false,
     "TAPi18n": false,
     "AccountsTemplates": true,
     "Activities": true,
     "Attachments": true,
     "Boards": true,
-    "CardCommentReactions": true,
     "CardComments": true,
-    "DatePicker": true,
+    "DatePicker" : true,
     "Cards": true,
     "CustomFields": true,
     "Lists": true,
@@ -156,11 +109,13 @@
     "CSSEvents": true,
     "EscapeActions": true,
     "Filter": true,
+    "Mixins": true,
     "Modal": true,
     "MultiSelection": true,
     "Popup": true,
     "Sidebar": true,
     "Utils": true,
+    "InlinedForm": true,
     "UnsavedEdits": true,
     "Notifications": true,
     "allowIsBoardAdmin": true,
@@ -168,16 +123,15 @@
     "allowIsBoardMemberByCard": true,
     "allowIsBoardMemberCommentOnly": true,
     "allowIsBoardMemberNoComments": true,
-    "allowIsBoardMemberWorker": true,
     "Emoji": true,
     "Checklists": true,
     "Settings": true,
     "InvitationCodes": true,
+    "JsonRoutes": true,
     "Authentication": true,
     "Integrations": true,
     "HTTP": true,
     "AccountSettings": true,
-    "TableVisibilityModeSettings": true,
     "Announcements": true,
     "Swimlanes": true,
     "ChecklistItems": true,

.gitattributes

@@ -1,3 +0,0 @@
-* text=auto eol=lf
-*.{cmd,[cC][mM][dD]} text eol=crlf
-*.{bat,[bB][aA][tT]} text eol=crlf

.github/FUNDING.yml

@@ -1,4 +0,0 @@
-# These are supported funding model platforms
-
-github: wekan
-custom: ['https://wekan.fi/commercial-support/']

.github/ISSUE_TEMPLATE.md

@@ -0,0 +1,27 @@
+## Issue
+
+Add these issues to elsewhere:
+- Snap: https://github.com/wekan/wekan-snap/issues
+
+Other Wekan issues can be added here.
+
+**Server Setup Information**:
+
+* Did you test in newest Wekan?:
+* For new Wekan install, did you configure root-url correctly https://github.com/wekan/wekan/wiki/Settings ?
+* Wekan version:
+* If this is about old version of Wekan, what upgrade problem you have?:
+* Operating System:
+* Deployment Method(snap/docker/sandstorm/mongodb bundle/source):
+* Http frontend if any (Caddy, Nginx, Apache, see config examples from Wekan GitHub wiki first):
+* Node Version:
+* MongoDB Version:
+* ROOT_URL environment variable http(s)://(subdomain).example.com(/suburl):
+
+**Problem description**:
+- *REQUIRED: Add recorded animated gif about how it works currently, and screenshot mockups how it should work. Use peek to record animgif in Linux https://github.com/phw/peek*
+- *Explain steps how to reproduce*
+- *In webbrowser, what does show Right Click / Inspect / Console ? Chrome shows more detailed info than Firefox.*
+- *If using Snap, what does show command `sudo snap logs wekan.wekan` ?*
+- *If using Docker, what does show command `sudo docker logs wekan-app` ?*
+- *If logs are very long, attach them in .zip file*

.github/ISSUE_TEMPLATE/bug_report.yml

@@ -1,42 +0,0 @@
-name: 🐛 Bug Report
-description: Report a bug to help improve WeKan
-labels: ["bug"]
-body:
-  - type: markdown
-    attributes:
-      value: |
-        Thanks for reporting a bug! Please ensure you are using the [latest version of WeKan](https://wekan.fi/install) and [Upgrade](https://wekan.fi/upgrade) before submitting.
-  - type: textarea
-    id: description
-    attributes:
-      label: Bug Description
-      description: A clear and concise description of what the bug is. Mention versions of WeKan, Node.js, database name and version, frontend webserver version like Caddy etc.
-    validations:
-      required: true
-  - type: textarea
-    id: reproduction
-    attributes:
-      label: Steps to Reproduce
-      description: How can we recreate this issue?
-      placeholder: |
-        1. Go to '...'
-        2. Click on '....'
-        3. Scroll down to '....'
-        4. See error
-    validations:
-      required: true
-  - type: textarea
-    id: logs
-    attributes:
-      label: Relevant Logs
-      description: | 
-        - Please paste any relevant anonymized server logs or browser console errors here.
-        - Snap: sudo snap logs wekan.wekan
-        - Docker: sudo docker logs wekan-app
-        - If logs are very long, attach them in .zip file
-      render: shell
-  - type: textarea
-    id: context
-    attributes: 
-      label: Additional Context
-      description: Add any other context, anonymized screenshots or GIF video about the bug, and screenshot mockups about how it should work.

.github/ISSUE_TEMPLATE/feature_request.yml

@@ -1,31 +0,0 @@
-name: ✨ Feature Request
-description: Suggest a new feature for WeKan
-labels: ["Feature:Request"]
-body:
-  - type: textarea
-    id: feature-description
-    attributes:
-      label: Problem Statement
-      description: Is your feature request related to a problem? Please describe.
-      placeholder: I'm always frustrated when [...]
-    validations:
-      required: true
-  - type: textarea
-    id: solution
-    attributes:
-      label: Proposed Solution
-      description: A clear and concise description of what you want to happen.
-    validations:
-      required: true
-  - type: textarea
-    id: alternatives
-    attributes:
-      label: Alternatives Considered
-      description: Any alternative solutions or features you've considered.
-  - type: textarea
-    id: context
-    attributes:
-      label: Additional Context
-      description: Add any other context, like anonymized screenshot mockups about how it should work.
-    
-    

.github/ISSUE_TEMPLATE/security-report.yml

@@ -1,14 +0,0 @@
-name: 🛡️ Security Issue
-description: Report a security vulnerability
-labels: ["security", "critical"]
-body:
-  - type: markdown
-    attributes:
-      value: |
-        ## ⚠️ IMPORTANT: Please do not report security vulnerabilities via public issues.
-        
-        To protect the WeKan community, we ask that you report security bugs privately. This allows us to fix the issue before it can be exploited by malicious actors.
-        
-        ### How to report:
-        Please read our **[Security Policy (SECURITY.md)](https://github.com/wekan/wekan/blob/main/SECURITY.md)** for the official reporting process and contact information.
-

.github/ISSUE_TEMPLATE/ucs-issue.yml

@@ -1,23 +0,0 @@
-name: 🗳️ Univention (UCS) Issue
-description: Problems specifically related to the WeKan app on Univention Corporate Server
-labels: ["UCS"]
-body:
-  - type: markdown
-    attributes:
-      value: |
-        ## 🛑 Is this a UCS-specific issue?
-        
-        If your issue is related to the **Univention Corporate Server (UCS) integration**, packaging, or installation via the Univention App Center, it should be reported in the dedicated Univention repository.
-        
-        ### ➡️ [Report UCS Issues Here](https://github.com/wekan/univention/issues)
-        
-        ---
-        **Why?**
-        Reporting there ensures that the maintainers specifically focused on the UCS environment see your request. 
-        
-        If you are certain this is a **core WeKan bug** that affects all platforms (Docker, Snap, etc.), please go back and use the standard [Bug Report](https://github.com/wekan/wekan/issues/new?template=bug-report.yml) template.
-  - type: textarea
-    id: ucs-details
-    attributes:
-      label: Brief Description (Optional)
-      description: If you still wish to post here, please provide a brief summary of why this is a core Wekan issue and not a UCS-specific integration bug.

.github/dependabot.yml

@@ -1,43 +0,0 @@
-version: 2
-updates:
-- package-ecosystem: "github-actions"
-  directory: "/"
-  schedule:
-      interval: "weekly"
-- package-ecosystem: "npm"
-  directory: "/"
-  schedule:
-      interval: "weekly"
-  ignore:
-      # Build-time-only (devDependency) Rspack toolchain. These packages compile
-      # the bundle on the developer / CI machine and are NOT shipped in the
-      # deployed WeKan server or client bundle, so their advisories do not affect
-      # a running WeKan instance. (For example webpack-dev-server / @rspack/dev-
-      # server, pulled via @rspack/cli, and the socket.io/ws chain pulled via
-      # @rsdoctor/rspack-plugin, never run in WeKan — it builds with `meteor run`,
-      # not the Rspack CLI or dev-server.)
-      #
-      # They also cannot simply be removed or bumped:
-      #   * @meteorjs/rspack re-pins and re-installs @rspack/cli and
-      #     @rsdoctor/rspack-plugin into package.json on every build, so deleting
-      #     them does not stick.
-      #   * The only upgrades Dependabot/npm offer are build-breaking: a
-      #     @meteorjs/rspack downgrade, or @rspack/cli 2.0 / Rspack 2.0, which
-      #     needs Meteor 3.6 (see https://github.com/meteor/meteor/pull/14360).
-      #     WeKan currently runs METEOR@3.5-rc.2.
-      #
-      # So pin them here until Meteor 3.6 + Rspack 2.0 land, then revisit.
-    - dependency-name: "@meteorjs/rspack"
-    - dependency-name: "@rspack/core"
-    - dependency-name: "@rspack/cli"
-    - dependency-name: "@rsdoctor/rspack-plugin"
-    - dependency-name: "css-loader"
-    - dependency-name: "style-loader"
-# Playwright end-to-end test harness — pure test-only tooling that never ships in
-# WeKan. It now depends only on @playwright/test and the official `mongodb` driver
-# (the heavy, CVE-prone `mongosh` CLI was replaced by helpers/mongo-runner.js).
-# Watch this directory so those two stay patched.
-- package-ecosystem: "npm"
-  directory: "/tests/playwright"
-  schedule:
-      interval: "weekly"

.github/workflows/AppImage.yml

@@ -1,417 +0,0 @@
-name: AppImage
-
-# Build WeKan as an AppImage for every CPU an AppImage runtime exists for, and
-# attach them to the newest WeKan release.
-#
-# WHAT IS INSIDE IS WHAT WEKAN ALREADY SHIPS. release-all.yml already produces a
-# bundle that runs offline with nothing installed: the Meteor server (main.js),
-# the bundled Node.js the release was built against, the wekan/FerretDB v1 fork
-# with its embedded pure-Go SQLite backend, the wekan/mongo-tools-patches binaries, the
-# cpu-exec/qemu-user shim from #6458, and start-wekan.sh to bring them up. That
-# bundle is already relocatable and already self-contained - it is the offline
-# zip people download today - so this workflow does NOT rebuild WeKan. It takes
-# the wekan-<version>-<arch>.zip off the release and wraps it, which means the
-# AppImage is byte-for-byte the same server, Node and FerretDB as the zip beside
-# it rather than a second build that might differ.
-#
-# So there is no MongoDB to install, no Node to install, and no database server
-# to run: FerretDB v1 keeps everything in SQLite files under the AppImage's data
-# directory. One download, one file, double-click.
-#
-# WHICH CPUs. An AppImage needs a runtime binary for its architecture, and those
-# exist for x86_64, aarch64, armhf and i686. WeKan publishes Linux bundles for
-# amd64 and arm64, so those are the two that can be wrapped: x86_64 from amd64,
-# aarch64 from arm64. Each is built on a runner of its own CPU, because
-# appimagetool has to run on the architecture it is packing for. If a bundle for
-# another architecture appears on a release, add it to the matrix and it will be
-# wrapped the same way.
-#
-# WHERE THE DATA GOES. A .deb or a container has somewhere obvious to put its
-# data; an AppImage is one file that may live on a USB stick, and the one place
-# it can always write is the user's home. WRITABLE_PATH defaults to
-# ~/.local/share/wekan here, so running the AppImage twice keeps the same boards,
-# and setting WRITABLE_PATH yourself still overrides it - the launcher's own
-# variables all still work.
-
-on:
-  # Callable, so release-all-missing.yml can ask for just the architectures
-  # a release is short of. The build itself stays here - a second copy of the
-  # appimages build would drift from this one.
-  workflow_call:
-    inputs:
-      tag:
-        required: false
-        type: string
-      publish:
-        required: false
-        default: true
-        type: boolean
-      only:
-        description: 'Only build these architectures, as a JSON array (e.g. ["aarch64"]); empty = all'
-        required: false
-        default: ''
-        type: string
-
-  workflow_dispatch:
-    inputs:
-      tag:
-        description: 'Release tag to wrap and attach to (empty = newest release)'
-        required: false
-        type: string
-      publish:
-        description: 'Attach the AppImages to the release'
-        required: false
-        default: true
-        type: boolean
-      only:
-        description: 'Only build these architectures, as a JSON array (e.g. ["aarch64"]); empty = all'
-        required: false
-        default: ''
-        type: string
-
-permissions:
-  contents: write
-
-concurrency:
-  group: wekan-appimage-${{ inputs.tag || github.ref }}
-  cancel-in-progress: false
-
-jobs:
-  release:
-    name: find the release
-    runs-on: ubuntu-24.04
-    outputs:
-      tag: ${{ steps.find.outputs.tag }}
-      version: ${{ steps.find.outputs.version }}
-    steps:
-      - uses: actions/checkout@v7
-
-      - id: find
-        env:
-          GH_TOKEN: ${{ github.token }}
-        run: |
-          set -euo pipefail
-          tag='${{ inputs.tag }}'
-          # --repo on every gh call, whether or not the job happens to have
-          # checked out: a call that relies on an inferred remote breaks the day
-          # somebody removes the checkout, and the error it gives - "fatal: not
-          # a git repository" - names neither gh nor the workflow.
-          [ -n "$tag" ] || tag="$(gh release list --repo "${{ github.repository }}" \
-            --limit 1 --json tagName --jq '.[0].tagName')"
-          if [ -z "$tag" ]; then
-            echo "::error::No release to wrap, and no tag was given."
-            exit 1
-          fi
-          # The bundles are named wekan-10.57-amd64.zip against tag v10.57.
-          version="${tag#v}"
-          echo "tag=$tag" >> "$GITHUB_OUTPUT"
-          echo "version=$version" >> "$GITHUB_OUTPUT"
-          echo "Wrapping the bundles from $tag (version $version)"
-
-  build:
-    name: AppImage ${{ matrix.appimage_arch }}
-    needs: release
-    runs-on: ${{ matrix.runs_on }}
-    # A 32-bit job that cannot run on the runner it was given must not fail the
-    # release for the architectures that built fine.
-    continue-on-error: ${{ matrix.tolerate_failure || false }}
-    timeout-minutes: 60
-    strategy:
-      fail-fast: false
-      matrix:
-        include:
-          - appimage_arch: x86_64
-            bundle_arch: amd64
-            runs_on: ubuntu-24.04
-          - appimage_arch: aarch64
-            bundle_arch: arm64
-            runs_on: ubuntu-24.04-arm
-          # The other two architectures an AppImage runtime EXISTS for. There
-          # are four in total - x86_64, aarch64, i686, armhf - and that is the
-          # whole limit: the runtime is the ELF the kernel executes, so an
-          # architecture with no runtime cannot have an AppImage at all. That is
-          # why ppc64le, s390x, riscv64 and loong64 are not here and never will
-          # be; they are served by the bundle zip and the .deb.
-          #
-          # i686 builds on the x86_64 runner, which runs 32-bit x86 natively -
-          # no emulation, no multiarch, and appimagetool-i686 runs as-is.
-          - appimage_arch: i686
-            bundle_arch: i386
-            runs_on: ubuntu-24.04
-          # armhf builds on the aarch64 runner, which runs 32-bit ARM only if
-          # the kernel was built with CONFIG_COMPAT and the 32-bit loader is
-          # installed. GitHub does not promise either, so this one is allowed to
-          # fail without taking the release with it - the same treatment TSC
-          # gives its emulated armhf job. If it turns out to work reliably,
-          # drop the flag; if it never does, drop the entry.
-          - appimage_arch: armhf
-            bundle_arch: armhf
-            runs_on: ubuntu-24.04-arm
-            tolerate_failure: true
-    # WHICH entries this run wants, decided here because it cannot be decided
-    # where it belongs. A job-level `if:` cannot see `matrix` - GitHub exposes
-    # that context to runs-on, env, name, steps and a few others, but not to a
-    # job's own condition - and a workflow that tries answers
-    #   Unrecognized named-value: 'matrix'
-    # and refuses to load at all, taking every workflow that CALLS it with it.
-    # A job-level env CAN see matrix, so the answer is computed once here and
-    # every step below asks for it.
-    env:
-      BUILD_THIS: ${{ inputs.only == '' || contains(fromJSON(inputs.only), matrix.appimage_arch) }}
-
-    steps:
-      - uses: actions/checkout@v7
-        if: ${{ env.BUILD_THIS == 'true' }}
-
-      # An AppImage only WRAPS an existing release bundle
-      # (wekan-<version>-<arch>.zip); it cannot build one. When this workflow is
-      # asked to fill a gap for a release whose base bundle is not published yet
-      # (release in progress, or it failed), `gh release download` finds "no
-      # assets to download" and the job failed hard. Turn that into a graceful
-      # skip: if the bundle this arch needs is not on the release, flip BUILD_THIS
-      # off so every step below (all gated on it) is skipped with a notice. The
-      # AppImage is built normally once the base bundle exists.
-      - name: Skip this arch if its release bundle is not published yet
-        if: ${{ env.BUILD_THIS == 'true' }}
-        env:
-          GH_TOKEN: ${{ github.token }}
-        run: |
-          set -euo pipefail
-          zip="wekan-${{ needs.release.outputs.version }}-${{ matrix.bundle_arch }}.zip"
-          if gh release view '${{ needs.release.outputs.tag }}' --repo "${{ github.repository }}" \
-               --json assets --jq '.assets[].name' 2>/dev/null | grep -qx "$zip"; then
-            echo "OK: $zip is on ${{ needs.release.outputs.tag }}; building its AppImage."
-          else
-            echo "::notice::$zip is not on ${{ needs.release.outputs.tag }} yet - skipping this AppImage (it can only wrap a bundle that exists)."
-            echo "BUILD_THIS=false" >> "$GITHUB_ENV"
-          fi
-
-      - name: Fetch the release bundle for this architecture
-        if: ${{ env.BUILD_THIS == 'true' }}
-        env:
-          GH_TOKEN: ${{ github.token }}
-        run: |
-          set -euo pipefail
-          zip="wekan-${{ needs.release.outputs.version }}-${{ matrix.bundle_arch }}.zip"
-          gh release download '${{ needs.release.outputs.tag }}' \
-            --repo "${{ github.repository }}" --pattern "$zip" --clobber
-          unzip -q "$zip"
-          # A zip that exists is not a bundle that runs; these are the two files
-          # the AppImage is built around.
-          for f in bundle/main.js bundle/node bundle/ferretdb bundle/start-wekan.sh; do
-            if [ ! -e "$f" ]; then
-              echo "::error::$zip has no $f - it is not a runnable WeKan bundle."
-              exit 1
-            fi
-          done
-          chmod +x bundle/node bundle/ferretdb bundle/start-wekan.sh
-          du -sh bundle
-
-      - name: Build the AppDir
-        if: ${{ env.BUILD_THIS == 'true' }}
-        run: |
-          set -euo pipefail
-          version='${{ needs.release.outputs.version }}'
-          rm -rf AppDir
-          mkdir -p AppDir/usr/lib/wekan AppDir/usr/share/applications \
-                   AppDir/usr/share/icons/hicolor/512x512/apps
-          cp -a bundle AppDir/usr/lib/wekan/bundle
-
-          # WeKan's own icon, from public/. 512x512 is what appimagetool wants
-          # for the thumbnail a desktop shows.
-          cp public/android-chrome-512x512.png \
-             AppDir/usr/share/icons/hicolor/512x512/apps/wekan.png
-          cp AppDir/usr/share/icons/hicolor/512x512/apps/wekan.png AppDir/wekan.png
-
-          cat > AppDir/usr/share/applications/wekan.desktop <<'DESKTOP'
-          [Desktop Entry]
-          Type=Application
-          Name=WeKan
-          GenericName=Kanban board
-          Comment=Open Source kanban board with FerretDB and Node.js included
-          Exec=wekan
-          Icon=wekan
-          Terminal=true
-          Categories=Office;ProjectManagement;
-          Keywords=kanban;board;tasks;project;
-          DESKTOP
-          cp AppDir/usr/share/applications/wekan.desktop AppDir/wekan.desktop
-
-          # AppRun is what the AppImage runs. It does three things the launcher
-          # cannot do for itself: pick a writable place for the data (an AppImage
-          # is read-only and may sit on a USB stick), say where WeKan is once it
-          # has started, and then hand over to start-wekan.sh, which is the same
-          # launcher the offline zip uses - so every variable it documents
-          # (WRITABLE_PATH, PORT, ROOT_URL, MONGO_URL, WEKAN_DB, ...) still works.
-          cat > AppDir/AppRun <<'APPRUN'
-          #!/bin/sh
-          set -eu
-          HERE="$(dirname "$(readlink -f "$0")")"
-          BUNDLE="$HERE/usr/lib/wekan/bundle"
-
-          # An AppImage is read-only, so the data cannot live beside it.
-          : "${WRITABLE_PATH:=${XDG_DATA_HOME:-$HOME/.local/share}/wekan}"
-          export WRITABLE_PATH
-          : "${PORT:=8080}"
-          export PORT
-          : "${ROOT_URL:=http://localhost:$PORT}"
-          export ROOT_URL
-
-          mkdir -p "$WRITABLE_PATH"
-
-          echo "WeKan is starting."
-          echo "  Open:  $ROOT_URL"
-          echo "  Data:  $WRITABLE_PATH"
-          echo "  Stop:  Ctrl-C"
-          echo
-          echo "Set WRITABLE_PATH, PORT, ROOT_URL or MONGO_URL to change any of"
-          echo "this; WEKAN_DB=mongodb uses your own database instead of the"
-          echo "bundled FerretDB."
-          echo
-
-          exec "$BUNDLE/start-wekan.sh" "$@"
-          APPRUN
-          chmod +x AppDir/AppRun
-
-      - name: Pack the AppImage
-        if: ${{ env.BUILD_THIS == 'true' }}
-        run: |
-          set -euo pipefail
-          version='${{ needs.release.outputs.version }}'
-          arch='${{ matrix.appimage_arch }}'
-          name="WeKan-${version}-${arch}"
-
-          curl -fSL --retry 5 --retry-delay 10 -o appimagetool \
-            "https://github.com/AppImage/appimagetool/releases/download/continuous/appimagetool-${arch}.AppImage"
-          chmod +x appimagetool
-
-          mkdir -p dist
-          # A runner has no FUSE, so the tool cannot mount itself; this unpacks
-          # it to a temporary directory and runs it from there instead.
-          APPIMAGE_EXTRACT_AND_RUN=1 ARCH="$arch" \
-            ./appimagetool AppDir "dist/${name}.AppImage"
-
-          chmod +x "dist/${name}.AppImage"
-          # Checksum keeps the .AppImage extension in its name, matching the zip
-          # convention (wekan-<v>-<arch>.zip.sha256sum) and what
-          # releases/expected-assets.sh looks for. Naming it ${name}.sha256sum
-          # (extension dropped) meant "what is missing" never found the checksum,
-          # so every run rebuilt the AppImage even when it was already published.
-          ( cd dist
-            md5sum    "${name}.AppImage" > "${name}.AppImage.md5sum"
-            sha256sum "${name}.AppImage" > "${name}.AppImage.sha256sum" )
-          ls -lh dist
-
-      - name: Check that it starts
-        if: ${{ env.BUILD_THIS == 'true' }}
-        run: |
-          set -euo pipefail
-          version='${{ needs.release.outputs.version }}'
-          app="dist/WeKan-${version}-${{ matrix.appimage_arch }}.AppImage"
-          # An AppImage that packs is not an AppImage that runs. Start it, wait
-          # for WeKan to answer on its port, then stop it - so a broken bundle
-          # is caught here rather than by whoever downloads it.
-          export WRITABLE_PATH="$PWD/smoke-data" PORT=8080
-
-          # A CHECK THAT CANNOT RUN IS NOT A FAILED CHECK. The 32-bit builds are
-          # packed on a 64-bit runner, which executes them only if the kernel and
-          # loader for that word size are present - GitHub promises neither. If
-          # the binary cannot be executed AT ALL, the AppImage is as good as
-          # anything here knows and the release must not be withheld for it; say
-          # so and move on. Anything else - it starts and does not answer - is
-          # the bug this step exists for and still fails.
-          if ! APPIMAGE_EXTRACT_AND_RUN=1 "$app" --appimage-help >/dev/null 2>&1 \
-             && ! APPIMAGE_EXTRACT_AND_RUN=1 "$app" --help >/dev/null 2>&1; then
-            if ! file "$app" | grep -q "$(uname -m)"; then
-              echo "::warning::this runner cannot execute a ${{ matrix.appimage_arch }} binary, so the AppImage was packed but not started. It is uploaded unchecked."
-              exit 0
-            fi
-          fi
-
-          APPIMAGE_EXTRACT_AND_RUN=1 "$app" > smoke.log 2>&1 &
-          pid=$!
-          ok=false
-          for _ in $(seq 1 90); do
-            if curl -fsS -o /dev/null "http://localhost:8080/sign-in"; then ok=true; break; fi
-            kill -0 "$pid" 2>/dev/null || break
-            sleep 2
-          done
-          kill "$pid" 2>/dev/null || true
-          wait "$pid" 2>/dev/null || true
-          if [ "$ok" != true ]; then
-            echo "::error::the AppImage did not answer on port 8080; its log follows"
-            tail -n 100 smoke.log
-            exit 1
-          fi
-          echo "WeKan answered on port 8080."
-
-      - uses: actions/upload-artifact@v7
-        if: ${{ env.BUILD_THIS == 'true' }}
-        with:
-          name: appimage-${{ matrix.appimage_arch }}
-          path: dist/
-          if-no-files-found: error
-
-  publish:
-    name: attach to the release
-    needs: [release, build]
-    if: ${{ always() && inputs.publish != false }}
-    runs-on: ubuntu-24.04
-    steps:
-      - uses: actions/download-artifact@v8
-        with:
-          pattern: appimage-*
-          path: assets
-          merge-multiple: true
-
-      - name: Say what was built, and what was not
-        env:
-          GH_TOKEN: ${{ github.token }}
-        run: |
-          set -euo pipefail
-          ls -lh assets 2>/dev/null || true
-          if ls assets/*.AppImage >/dev/null 2>&1; then
-            # Every architecture the matrix builds. A missing one WARNS rather
-          # than fails: the 32-bit pair is allowed not to build, and an
-          # architecture whose base bundle was never published has nothing to
-          # wrap. What must not happen silently is one going missing unnoticed.
-          for want in x86_64 aarch64 i686 armhf; do
-              ls assets/*"-$want.AppImage" >/dev/null 2>&1 || \
-                echo "::warning::no AppImage for $want - see that build job's log"
-            done
-          else
-            # No AppImage was produced. That is only a FAILURE if there was a base
-            # bundle to wrap: an AppImage cannot be built without one, and the
-            # build jobs skip (not fail) when the base bundle is not published yet.
-            published="$(gh release view '${{ needs.release.outputs.tag }}' --repo "${{ github.repository }}" --json assets --jq '.assets[].name' 2>/dev/null || true)"
-            base_present=false
-            for arch in amd64 arm64 i386 armhf; do
-              printf '%s\n' "$published" | grep -qx "wekan-${{ needs.release.outputs.version }}-${arch}.zip" && base_present=true
-            done
-            if [ "$base_present" = false ]; then
-              echo "::notice::No base bundle (wekan-${{ needs.release.outputs.version }}-{amd64,arm64}.zip) is on ${{ needs.release.outputs.tag }} yet, so there is nothing to wrap - skipping. release-all.yml builds the AppImages once the base bundles are published."
-              exit 0
-            fi
-            echo "::error::A base bundle is published but no architecture produced an AppImage - every build job failed. Their logs say why; nothing is uploaded."
-            exit 1
-          fi
-
-      - name: Upload them
-        env:
-          GH_TOKEN: ${{ github.token }}
-        run: |
-          set -euo pipefail
-          if ! ls assets/*.AppImage >/dev/null 2>&1; then
-            echo "Nothing to upload (no base bundle was published to wrap)."
-            exit 0
-          fi
-          # --repo, because this job does NOT check the repository out - it only
-          # downloads artifacts - so `gh` has no git remote to infer the repo
-          # from and fails with "fatal: not a git repository". Every other gh
-          # call in this workflow already passes it; these two did not, so the
-          # AppImages were built, smoke-tested and uploaded as artifacts, and
-          # then nothing was attached to the release.
-          gh release upload '${{ needs.release.outputs.tag }}' assets/* \
-            --repo "${{ github.repository }}" --clobber
-          echo "Uploaded to $(gh release view '${{ needs.release.outputs.tag }}' \
-            --repo "${{ github.repository }}" --json url --jq .url)"

.github/workflows/Flatpak.yml

@@ -1,430 +0,0 @@
-name: Flatpak
-
-# Build WeKan as a Flatpak for every CPU the runtime exists for, attach the
-# single-file bundles to the newest WeKan release, and publish a Flatpak
-# REPOSITORY that can be added with `flatpak remote-add`.
-#
-# Like AppImage.yml, this does NOT rebuild WeKan. release-all.yml already
-# produces a bundle that runs offline with nothing installed - the Meteor server
-# (main.js), the bundled Node.js the release was built against, the
-# wekan/FerretDB v1 fork with its embedded pure-Go SQLite backend, the
-# wekan/mongo-tools-patches binaries and start-wekan.sh - so this takes the
-# wekan-<version>-<arch>.zip off the release and packages it. The Flatpak is
-# therefore the same server, Node and FerretDB as the zip and the AppImage
-# beside it, not a third build that might differ.
-#
-# A BUNDLE AND A REPOSITORY are two different things and both come out of one
-# build here. A .flatpak bundle is one file you install by hand and update by
-# downloading the next one; a repository is what makes `flatpak update` work,
-# and one repository serves every architecture at once. The bundles go on the
-# GitHub release; the repository is uploaded as an artifact of static files, so
-# it can be copied to a website with no server to run.
-#
-# WHICH CPUs. org.freedesktop.Platform//24.08 is built for x86_64 and aarch64,
-# and WeKan publishes Linux bundles for amd64 and arm64, so those are the two.
-# Each builds on a runner of its own CPU rather than under emulation.
-#
-# AND THAT IS THE WHOLE LIST - there is no third to add. A flatpak runs against
-# a RUNTIME, not against the host's libraries, so an architecture exists here
-# only if freedesktop.org publishes org.freedesktop.Platform for it. It does so
-# for x86_64 and aarch64; the i386 and arm runtimes were discontinued. That is
-# the difference from AppImage.yml, which was able to grow from two
-# architectures to four: an AppImage carries its own runtime binary, and
-# runtimes exist for i686 and armhf as well. WeKan's ppc64le, s390x, riscv64,
-# loong64 and 32-bit bundles are served by the zip and the .deb.
-#
-# THE SANDBOX. WeKan is a server you reach in a browser, so it needs the network
-# and a place to keep its data, and nothing else - no X11, no audio, no access
-# to your files. --share=network and --persist=.wekan are the whole permission
-# list, and FerretDB keeps everything in SQLite inside that one directory.
-#
-# THE REPOSITORY IS UNSIGNED. Signing needs a GPG key, which is a secret rather
-# than something a workflow can invent. The README written into the repository
-# says exactly how to sign it when a key exists.
-
-on:
-  # Callable, so release-all-missing.yml can ask for just the architectures
-  # a release is short of. The build itself stays here - a second copy of the
-  # flatpaks build would drift from this one.
-  workflow_call:
-    inputs:
-      tag:
-        required: false
-        type: string
-      publish:
-        required: false
-        default: true
-        type: boolean
-      only:
-        description: 'Only build these architectures, as a JSON array (e.g. ["x86_64"]); empty = all'
-        required: false
-        default: ''
-        type: string
-
-  workflow_dispatch:
-    inputs:
-      tag:
-        description: 'Release tag to wrap and attach to (empty = newest release)'
-        required: false
-        type: string
-      publish:
-        description: 'Attach the bundles to the release'
-        required: false
-        default: true
-        type: boolean
-      publish_repo:
-        description: 'Build the Flatpak repository for the website'
-        required: false
-        default: true
-        type: boolean
-      only:
-        description: 'Only build these architectures, as a JSON array (e.g. ["x86_64"]); empty = all'
-        required: false
-        default: ''
-        type: string
-
-permissions:
-  contents: write
-
-concurrency:
-  group: wekan-flatpak-${{ inputs.tag || github.ref }}
-  cancel-in-progress: false
-
-jobs:
-  release:
-    name: find the release
-    runs-on: ubuntu-24.04
-    outputs:
-      tag: ${{ steps.find.outputs.tag }}
-      version: ${{ steps.find.outputs.version }}
-    steps:
-      - uses: actions/checkout@v7
-      - id: find
-        env:
-          GH_TOKEN: ${{ github.token }}
-        run: |
-          set -euo pipefail
-          tag='${{ inputs.tag }}'
-          # --repo on every gh call, whether or not the job happens to have
-          # checked out: one that relies on an inferred remote breaks the day
-          # somebody removes the checkout.
-          [ -n "$tag" ] || tag="$(gh release list --repo "${{ github.repository }}" \
-            --limit 1 --json tagName --jq '.[0].tagName')"
-          if [ -z "$tag" ]; then
-            echo "::error::No release to wrap, and no tag was given."
-            exit 1
-          fi
-          version="${tag#v}"
-          echo "tag=$tag" >> "$GITHUB_OUTPUT"
-          echo "version=$version" >> "$GITHUB_OUTPUT"
-          echo "Wrapping the bundles from $tag (version $version)"
-
-  build:
-    name: flatpak ${{ matrix.flatpak_arch }}
-    needs: release
-    runs-on: ${{ matrix.runs_on }}
-    timeout-minutes: 90
-    strategy:
-      fail-fast: false
-      matrix:
-        include:
-          - flatpak_arch: x86_64
-            bundle_arch: amd64
-            runs_on: ubuntu-24.04
-          - flatpak_arch: aarch64
-            bundle_arch: arm64
-            runs_on: ubuntu-24.04-arm
-    # WHICH entries this run wants, decided here because it cannot be decided
-    # where it belongs. A job-level `if:` cannot see `matrix` - GitHub exposes
-    # that context to runs-on, env, name, steps and a few others, but not to a
-    # job's own condition - and a workflow that tries answers
-    #   Unrecognized named-value: 'matrix'
-    # and refuses to load at all, taking every workflow that CALLS it with it.
-    # A job-level env CAN see matrix, so the answer is computed once here and
-    # every step below asks for it.
-    env:
-      BUILD_THIS: ${{ inputs.only == '' || contains(fromJSON(inputs.only), matrix.flatpak_arch) }}
-
-    steps:
-      - uses: actions/checkout@v7
-        if: ${{ env.BUILD_THIS == 'true' }}
-
-      - name: Install flatpak
-        if: ${{ env.BUILD_THIS == 'true' }}
-        run: |
-          set -euo pipefail
-          sudo apt-get update
-          sudo apt-get install -y --no-install-recommends flatpak ostree zip
-          flatpak remote-add --if-not-exists --user flathub \
-            https://flathub.org/repo/flathub.flatpakrepo
-          flatpak install --user -y --noninteractive flathub \
-            org.freedesktop.Platform//24.08 org.freedesktop.Sdk//24.08
-
-      - name: Fetch the release bundle for this architecture
-        if: ${{ env.BUILD_THIS == 'true' }}
-        env:
-          GH_TOKEN: ${{ github.token }}
-        run: |
-          set -euo pipefail
-          zip="wekan-${{ needs.release.outputs.version }}-${{ matrix.bundle_arch }}.zip"
-          gh release download '${{ needs.release.outputs.tag }}' \
-            --repo "${{ github.repository }}" --pattern "$zip" --clobber
-          unzip -q "$zip"
-          for f in bundle/main.js bundle/node bundle/ferretdb bundle/start-wekan.sh; do
-            if [ ! -e "$f" ]; then
-              echo "::error::$zip has no $f - it is not a runnable WeKan bundle."
-              exit 1
-            fi
-          done
-          chmod +x bundle/node bundle/ferretdb bundle/start-wekan.sh
-          du -sh bundle
-
-      # flatpak-builder is for building from source. The bundle IS the build, so
-      # this uses `flatpak build` directly: make a build directory from the
-      # runtime, copy the bundle into it, finish it with its permissions, and
-      # export it into a repository.
-      - name: Build the Flatpak
-        if: ${{ env.BUILD_THIS == 'true' }}
-        run: |
-          set -euo pipefail
-          version='${{ needs.release.outputs.version }}'
-          arch='${{ matrix.flatpak_arch }}'
-
-          rm -rf build-dir repo
-          flatpak build-init --arch="$arch" build-dir \
-            io.github.wekan.WeKan org.freedesktop.Sdk org.freedesktop.Platform 24.08
-
-          mkdir -p build-dir/files/lib/wekan build-dir/files/bin \
-                   build-dir/files/share/applications \
-                   build-dir/files/share/icons/hicolor/512x512/apps \
-                   build-dir/files/share/metainfo
-          cp -a bundle build-dir/files/lib/wekan/bundle
-          cp public/android-chrome-512x512.png \
-             build-dir/files/share/icons/hicolor/512x512/apps/io.github.wekan.WeKan.png
-
-          # The command the Flatpak runs. --persist=.wekan gives the sandbox one
-          # writable directory that survives restarts, and that is where
-          # WRITABLE_PATH points, so FerretDB's SQLite files and the attachments
-          # live there. Everything start-wekan.sh documents still overrides.
-          cat > build-dir/files/bin/wekan <<'SH'
-          #!/bin/sh
-          set -eu
-          BUNDLE=/app/lib/wekan/bundle
-          : "${WRITABLE_PATH:=$HOME/.wekan}"
-          export WRITABLE_PATH
-          : "${PORT:=8080}"
-          export PORT
-          : "${ROOT_URL:=http://localhost:$PORT}"
-          export ROOT_URL
-          mkdir -p "$WRITABLE_PATH"
-          echo "WeKan is starting."
-          echo "  Open:  $ROOT_URL"
-          echo "  Data:  $WRITABLE_PATH  (inside the Flatpak sandbox)"
-          echo "  Stop:  Ctrl-C"
-          echo
-          exec "$BUNDLE/start-wekan.sh" "$@"
-          SH
-          chmod +x build-dir/files/bin/wekan
-
-          cat > build-dir/files/share/applications/io.github.wekan.WeKan.desktop <<'DESKTOP'
-          [Desktop Entry]
-          Type=Application
-          Name=WeKan
-          GenericName=Kanban board
-          Comment=Open Source kanban board with FerretDB and Node.js included
-          Exec=wekan
-          Icon=io.github.wekan.WeKan
-          Terminal=true
-          Categories=Office;ProjectManagement;
-          Keywords=kanban;board;tasks;project;
-          DESKTOP
-
-          cat > build-dir/files/share/metainfo/io.github.wekan.WeKan.metainfo.xml <<XML
-          <?xml version="1.0" encoding="UTF-8"?>
-          <component type="desktop-application">
-            <id>io.github.wekan.WeKan</id>
-            <name>WeKan</name>
-            <summary>Open Source kanban board</summary>
-            <metadata_license>CC0-1.0</metadata_license>
-            <project_license>MIT</project_license>
-            <description>
-              <p>
-                WeKan is an Open Source kanban board. This build carries everything
-                it needs to run: the WeKan server, Node.js, and FerretDB v1 with an
-                embedded SQLite backend, so no separate database is required.
-              </p>
-            </description>
-            <launchable type="desktop-id">io.github.wekan.WeKan.desktop</launchable>
-            <url type="homepage">https://wekan.fi</url>
-            <releases><release version="${version}"/></releases>
-          </component>
-          XML
-
-          # A server reached in a browser needs the network and its own data
-          # directory, and nothing else.
-          flatpak build-finish build-dir \
-            --share=network \
-            --persist=.wekan \
-            --command=wekan
-
-          flatpak build-export --arch="$arch" repo build-dir stable
-
-      - name: Make the single-file bundle
-        if: ${{ env.BUILD_THIS == 'true' }}
-        run: |
-          set -euo pipefail
-          version='${{ needs.release.outputs.version }}'
-          name="WeKan-${version}-${{ matrix.flatpak_arch }}"
-          mkdir -p dist
-          flatpak build-bundle repo "dist/${name}.flatpak" \
-            --arch='${{ matrix.flatpak_arch }}' io.github.wekan.WeKan stable
-          # Checksum keeps the .flatpak extension in its name, matching the zip
-          # convention and what releases/expected-assets.sh looks for; dropping it
-          # meant "what is missing" never found the checksum and rebuilt the
-          # Flatpak every run even when already published.
-          ( cd dist
-            md5sum    "${name}.flatpak" > "${name}.flatpak.md5sum"
-            sha256sum "${name}.flatpak" > "${name}.flatpak.sha256sum" )
-          ls -lh dist
-
-      - uses: actions/upload-artifact@v7
-        if: ${{ env.BUILD_THIS == 'true' }}
-        with:
-          name: flatpak-${{ matrix.flatpak_arch }}
-          path: dist/
-          if-no-files-found: error
-
-      - uses: actions/upload-artifact@v7
-        if: ${{ env.BUILD_THIS == 'true' }}
-        with:
-          name: flatpak-repo-${{ matrix.flatpak_arch }}
-          path: repo/
-          if-no-files-found: warn
-
-  publish:
-    name: attach to the release, and build the repository
-    needs: [release, build]
-    if: ${{ always() }}
-    runs-on: ubuntu-24.04
-    steps:
-      - uses: actions/download-artifact@v8
-        with:
-          pattern: flatpak-[0-9a-z]*
-          path: assets
-          merge-multiple: true
-
-      - name: Say what was built, and what was not
-        run: |
-          set -euo pipefail
-          ls -lh assets 2>/dev/null || true
-          if ! ls assets/*.flatpak >/dev/null 2>&1; then
-            echo "::error::No architecture produced a Flatpak bundle; nothing is uploaded."
-            exit 1
-          fi
-          for want in x86_64 aarch64; do
-            ls assets/*"-$want.flatpak" >/dev/null 2>&1 || \
-              echo "::warning::no Flatpak for $want - see that build job's log"
-          done
-
-      - name: Upload the bundles
-        if: ${{ inputs.publish != false }}
-        env:
-          GH_TOKEN: ${{ github.token }}
-        run: |
-          set -euo pipefail
-          # --repo, because this job does NOT check the repository out - it
-          # only downloads artifacts - so `gh` has no git remote to infer the
-          # repo from and fails with "fatal: not a git repository". The same
-          # line was wrong in AppImage.yml for the same reason.
-          #
-          # And the bundles BY NAME, not assets/*: the artifacts also carry the
-          # ostree repository the flatpak was exported through - config,
-          # objects/, refs/, summaries/, summary, summary.idx - which is build
-          # scaffolding, not something to attach to a release. TSC hit this
-          # exact thing ("upload only the bundle files, not the ostree repo").
-          gh release upload '${{ needs.release.outputs.tag }}' \
-            assets/*.flatpak assets/*.flatpak.md5sum assets/*.flatpak.sha256sum \
-            --repo "${{ github.repository }}" --clobber
-          echo "Uploaded to $(gh release view '${{ needs.release.outputs.tag }}' \
-            --repo "${{ github.repository }}" --json url --jq .url)"
-
-      # ---- the repository -------------------------------------------------
-      - uses: actions/download-artifact@v8
-        if: ${{ inputs.publish_repo != false }}
-        with:
-          pattern: flatpak-repo-*
-          path: repos
-
-      - name: Build the multi-architecture repository
-        if: ${{ inputs.publish_repo != false }}
-        run: |
-          set -euo pipefail
-          sudo apt-get update
-          sudo apt-get install -y --no-install-recommends flatpak ostree
-          shopt -s nullglob
-          parts=(repos/flatpak-repo-*)
-          if [ ${#parts[@]} -eq 0 ]; then
-            echo "::warning::no repository halves were produced; skipping"
-            exit 0
-          fi
-          ostree init --repo=flatpak-repo --mode=archive-z2
-          for part in "${parts[@]}"; do
-            name="$(basename "$part")"
-            echo "Pulling $name"
-            ostree --repo=flatpak-repo remote add --no-gpg-verify --if-not-exists \
-              "$name" "file://$PWD/$part"
-            ostree --repo=flatpak-repo pull --mirror "$name" || true
-          done
-          flatpak build-update-repo --prune flatpak-repo
-
-          cat > flatpak-repo/wekan.flatpakrepo <<'REPO'
-          [Flatpak Repo]
-          Title=WeKan
-          Url=https://wekan.fi/flatpak/
-          Homepage=https://wekan.fi
-          Comment=WeKan releases, built by the Flatpak workflow in wekan/wekan
-          Description=Flatpak repository for WeKan, the Open Source kanban board
-          REPO
-
-          cat > flatpak-repo/README.txt <<'TXT'
-          Flatpak repository for WeKan.
-
-          Copy this whole directory to the website under /flatpak/, then:
-
-            flatpak remote-add --if-not-exists wekan \
-              https://wekan.fi/flatpak/wekan.flatpakrepo
-            flatpak install wekan io.github.wekan.WeKan
-            flatpak run io.github.wekan.WeKan
-
-          Then open http://localhost:8080 . Everything is inside: the WeKan
-          server, Node.js, and FerretDB v1 with an embedded SQLite backend, so
-          there is no database to install. The data lives in the sandbox's
-          persistent .wekan directory.
-
-          THIS REPOSITORY IS NOT SIGNED. Signing needs a GPG key, which is a
-          secret rather than something a workflow can invent. To sign it:
-
-            1. Make a key, once, on a machine you trust:
-                 gpg --quick-generate-key "WeKan <security@wekan.fi>" default default never
-                 gpg --export KEYID > wekan-flatpak.gpg          # the public half
-                 gpg --export-secret-keys --armor KEYID          # the private half
-            2. Put the private half in the repository's Actions secrets as
-               GPG_PRIVATE_KEY.
-            3. In Flatpak.yml, import it before the export and add the two flags:
-                 flatpak build-export --gpg-sign=KEYID ...
-                 flatpak build-update-repo --gpg-sign=KEYID ...
-            4. Put wekan-flatpak.gpg beside this file on the website and add
-                 GPGKey=<base64 of wekan-flatpak.gpg>
-               to wekan.flatpakrepo.
-
-          Until then flatpak will say the remote is unsigned, and installing
-          from it trusts whoever serves the files.
-          TXT
-          du -sh flatpak-repo
-
-      - uses: actions/upload-artifact@v7
-        if: ${{ inputs.publish_repo != false }}
-        with:
-          name: flatpak-repository
-          path: flatpak-repo/
-          if-no-files-found: warn

.github/workflows/depsreview.yaml

@@ -1,14 +0,0 @@
-name: 'Dependency Review'
-on: [pull_request]
-
-permissions:
-  contents: read
-
-jobs:
-  dependency-review:
-    runs-on: ubuntu-latest
-    steps:
-      - name: 'Checkout Repository'
-        uses: actions/checkout@v7
-      - name: 'Dependency Review'
-        uses: actions/dependency-review-action@v5

.github/workflows/docker-publish.yml

@@ -1,93 +0,0 @@
-name: Docker
-
-# This workflow uses actions that are not certified by GitHub.
-# They are provided by a third-party and are governed by
-# separate terms of service, privacy policy, and support
-# documentation.
-
-on:
-  schedule:
-    - cron: '28 23 * * *'
-  push:
-    branches: [ main ]
-    # Publish semver tags as releases.
-    tags: [ 'v*.*.*' ]
-  pull_request:
-    branches: [ main ]
-
-env:
-  # Use docker.io for Docker Hub if empty
-  REGISTRY: ghcr.io
-  # github.repository as <account>/<repo>
-  IMAGE_NAME: ${{ github.repository }}
-
-
-jobs:
-  build:
-
-    runs-on: ubuntu-latest
-    permissions:
-      contents: read
-      packages: write
-
-    steps:
-      - name: Checkout repository
-        uses: actions/checkout@v7
-
-      # The Dockerfile DOWNLOADS the prebuilt release zip that release-all.yml
-      # publishes (and `exit 8`s if it is missing), so this image can only be
-      # built once the release for the version pinned in the Dockerfile is up. On
-      # a tag push (the tag is created early in the release, ~30 min before the
-      # zips are attached), during the release window, or if the release failed,
-      # the asset 404s and this job failed hard. Check first and SKIP the build
-      # (a notice, green run) when the release is not published yet; the release
-      # image itself is built + pushed by release-all.yml's docker job.
-      - name: Is the release this Dockerfile needs published yet?
-        id: rel
-        env:
-          GH_TOKEN: ${{ github.token }}
-        run: |
-          set -euo pipefail
-          VERSION="$(sed -n 's/^ARG VERSION=//p' Dockerfile | head -1)"
-          asset="wekan-${VERSION}-amd64.zip"
-          if gh release view "v${VERSION}" --repo "${{ github.repository }}" \
-               --json assets --jq '.assets[].name' 2>/dev/null | grep -qx "$asset"; then
-            echo "build=yes" >> "$GITHUB_OUTPUT"
-            echo "OK: $asset is on the v${VERSION} release; building the image."
-          else
-            echo "build=no" >> "$GITHUB_OUTPUT"
-            echo "::notice::$asset is not on the v${VERSION} release yet - skipping. release-all.yml builds and pushes the image once the release is published."
-          fi
-
-      # Login against a Docker registry except on PR
-      # https://github.com/docker/login-action
-      - name: Log into registry ${{ env.REGISTRY }}
-        if: github.event_name != 'pull_request'
-        uses: docker/login-action@dbcb813823bdd20940b903addbd779551569679f
-        with:
-          registry: ${{ env.REGISTRY }}
-          username: ${{ github.actor }}
-          password: ${{ secrets.GITHUB_TOKEN }}
-
-      # Extract metadata (tags, labels) for Docker
-      # https://github.com/docker/metadata-action
-      - name: Extract Docker metadata
-        id: meta
-        uses: docker/metadata-action@dc802804100637a589fabce1cb79ff13a1411302
-        with:
-          images: ${{ env.REGISTRY }}/${{ env.IMAGE_NAME }}
-
-      # Build and push Docker image with Buildx (don't push on PR)
-      # https://github.com/docker/build-push-action
-      - name: Build and push Docker image
-        if: steps.rel.outputs.build == 'yes'
-        uses: docker/build-push-action@53b7df96c91f9c12dcc8a07bcb9ccacbed38856a
-        with:
-          context: .
-          push: ${{ github.event_name != 'pull_request' }}
-          tags: ${{ steps.meta.outputs.tags }}
-          labels: ${{ steps.meta.outputs.labels }}
-          # Full build provenance (SLSA), not the minimal default that BuildKit
-          # attaches on its own. See release-all.yml for what it is and why the
-          # manifest list gains an `unknown/unknown` entry per platform.
-          provenance: mode=max

.github/workflows/docker-variant.yml

@@ -1,154 +0,0 @@
-# ─────────────────────────────────────────────────────────────────────────────
-# Publish a variant Docker image — MANUALLY, never as part of a release.
-#
-# wekanteam/wekan-gantt-gpl (and wekanteam/wekan-ondra) are the same WeKan as
-# wekanteam/wekan: the variant repositories are byte-identical to wekan/wekan
-# apart from the snap name in snapcraft.yaml, so the image content is the same
-# image. This workflow therefore does not rebuild anything - it points a variant
-# tag at the multi-arch manifest the release already built and verified, with
-# `docker buildx imagetools create`. Same digests, all five architectures, no
-# half-hour emulated build, and no way for the variant image to drift from the
-# release it claims to be.
-#
-# `workflow_dispatch` ONLY, on purpose. release-all.yml publishes wekanteam/wekan
-# to Docker Hub, Quay and GHCR on every release; the variant images are published
-# when the maintainer decides to, which is what this file exists for. Nothing
-# here runs on a push, a tag or a schedule.
-#
-# If a variant repository ever stops being identical to wekan/wekan, this
-# retag becomes wrong: build that repository's own Dockerfile instead.
-#
-# Local equivalent, same behaviour: releases/docker-publish-variant.sh
-# ─────────────────────────────────────────────────────────────────────────────
-name: Publish variant Docker image (manual)
-
-on:
-  workflow_dispatch:
-    inputs:
-      image:
-        description: 'Docker Hub repository under wekanteam/ to publish'
-        required: true
-        default: 'wekan-gantt-gpl'
-        type: choice
-        options:
-          - wekan-gantt-gpl
-          - wekan-ondra
-      version:
-        description: 'WeKan version to publish, without the v (e.g. 10.49). Empty = newest GitHub release.'
-        required: false
-        default: ''
-        type: string
-      also_latest:
-        description: 'Also move the :latest tag of the variant image'
-        required: false
-        default: true
-        type: boolean
-
-permissions:
-  contents: read
-
-jobs:
-  retag:
-    runs-on: ubuntu-latest
-    steps:
-      # First step on purpose: a missing or wrong credential is then ONE named
-      # line at the top of the log, not a failure deep inside a push.
-      - name: Check DOCKERHUB_AUTH is configured and works
-        env:
-          DOCKERHUB_AUTH: ${{ secrets.DOCKERHUB_AUTH }}
-        run: |
-          set -uo pipefail
-          if [ -z "${DOCKERHUB_AUTH:-}" ]; then
-            echo "::error::docker-variant: DOCKERHUB_AUTH is not set - the image cannot be pushed. It is base64 of 'username:token' for docker.io."
-            exit 1
-          fi
-          if ! creds="$(printf '%s' "$DOCKERHUB_AUTH" | base64 -d 2>/dev/null)"; then
-            echo "::error::docker-variant: DOCKERHUB_AUTH is not valid base64. Set it with: printf '%s' 'user:token' | base64 -w0"
-            exit 1
-          fi
-          case "$creds" in
-            *:*) ;;
-            *) echo "::error::docker-variant: DOCKERHUB_AUTH decodes to something without a ':' - it must be base64 of 'username:token'."; exit 1 ;;
-          esac
-          user="${creds%%:*}"
-          token="${creds#*:}"
-          if ! printf '%s' "$token" | docker login docker.io -u "$user" --password-stdin; then
-            echo "::error::docker-variant: DOCKERHUB_AUTH was REJECTED by docker.io (login failed as user '$user'). The token is wrong, expired, or lacks push rights for wekanteam/${{ inputs.image }}."
-            exit 1
-          fi
-          echo "docker-variant: DOCKERHUB_AUTH works for docker.io (user '$user')."
-
-      - name: Work out which version to publish
-        id: v
-        run: |
-          set -euo pipefail
-          version="${{ inputs.version }}"
-          if [ -z "$version" ]; then
-            # The newest release of wekan/wekan, asked of GitHub rather than guessed.
-            version="$(curl -sSL -H 'Accept: application/vnd.github+json' \
-              https://api.github.com/repos/wekan/wekan/releases/latest \
-              | sed -n 's/.*"tag_name": *"v\{0,1\}\([^"]*\)".*/\1/p' | head -1)"
-          fi
-          version="${version#v}"
-          if [ -z "$version" ]; then
-            echo "::error::docker-variant: no version given and the newest release could not be read from the GitHub API."
-            exit 1
-          fi
-          echo "version=$version" >> "$GITHUB_OUTPUT"
-          echo "Publishing wekanteam/${{ inputs.image }} from wekanteam/wekan:v$version"
-
-      - name: Set up Docker Buildx
-        uses: docker/setup-buildx-action@v4
-
-      - name: Retag wekanteam/wekan as wekanteam/${{ inputs.image }}
-        run: |
-          set -euo pipefail
-          src="wekanteam/wekan:v${{ steps.v.outputs.version }}"
-          dst="wekanteam/${{ inputs.image }}:v${{ steps.v.outputs.version }}"
-
-          # The source must exist and be the full multi-arch manifest, or the
-          # variant tag would quietly cover fewer architectures than wekan does.
-          if ! platforms="$(docker buildx imagetools inspect "$src" \
-                --format '{{range .Manifest.Manifests}}{{.Platform.OS}}/{{.Platform.Architecture}} {{end}}' 2>&1)"; then
-            echo "::error::docker-variant: $src cannot be inspected - is that version released and pushed? ($platforms)"
-            exit 1
-          fi
-          echo "$src covers: $platforms"
-          for want in linux/amd64 linux/arm64 linux/ppc64le linux/s390x linux/riscv64; do
-            case " $platforms " in
-              *" $want "*) ;;
-              *) echo "::error::docker-variant: $src has no $want, so the variant image would be missing it too."; exit 1 ;;
-            esac
-          done
-
-          tags=(-t "$dst")
-          if [ "${{ inputs.also_latest }}" = "true" ]; then
-            tags+=(-t "wekanteam/${{ inputs.image }}:latest")
-          fi
-          # imagetools create copies the MANIFEST, so the variant tag points at the
-          # very digests the release built and verified. Nothing is rebuilt.
-          docker buildx imagetools create "${tags[@]}" "$src"
-
-          # Pushed is not the same as pushed correctly: ask Docker Hub what it has.
-          got="$(docker buildx imagetools inspect "$dst" \
-            --format '{{range .Manifest.Manifests}}{{.Platform.OS}}/{{.Platform.Architecture}} {{end}}')"
-          echo "$dst covers: $got"
-          for want in linux/amd64 linux/arm64 linux/ppc64le linux/s390x linux/riscv64; do
-            case " $got " in
-              *" $want "*) ;;
-              *) echo "::error::docker-variant: $dst is missing $want after the push."; exit 1 ;;
-            esac
-          done
-          echo "OK: $dst published (same digests as $src)."
-
-      - name: Job result
-        if: always()
-        run: |
-          case "${{ job.status }}" in
-            success)   mark='OK       ' ;;
-            failure)   mark='FAILED   ' ;;
-            cancelled) mark='CANCELLED' ;;
-            *)         mark='${{ job.status }}' ;;
-          esac
-          echo "$mark docker-variant wekanteam/${{ inputs.image }}"
-          echo "$mark docker-variant wekanteam/${{ inputs.image }}" >> "$GITHUB_STEP_SUMMARY"

.github/workflows/dockerimage.yml

@@ -1,48 +0,0 @@
-name: Docker Image CI
-
-on:
-  push:
-    branches:
-      - main
-
-permissions:
-  contents: read
-
-jobs:
-
-  build:
-
-    runs-on: ubuntu-latest
-
-    steps:
-    - uses: actions/checkout@v7
-
-    # The Dockerfile does not build WeKan from source — it DOWNLOADS the prebuilt
-    # release zip (wekan-<VERSION>-amd64.zip) that release-all.yml publishes, and
-    # `exit 8`s if it is missing. So this image can only be built once the release
-    # for the version pinned in the Dockerfile is up. On a push during the release
-    # window (the version was just bumped but the release job has not attached the
-    # zip yet), or if the release failed, the asset 404s and this job failed hard
-    # even though nothing here is wrong. Check first and SKIP (a notice, green run)
-    # when the release is not published yet; the real image is built by
-    # release-all.yml's docker job once the release is up.
-    - name: Is the release this Dockerfile needs published yet?
-      id: rel
-      env:
-        GH_TOKEN: ${{ github.token }}
-      run: |
-        set -euo pipefail
-        VERSION="$(sed -n 's/^ARG VERSION=//p' Dockerfile | head -1)"
-        asset="wekan-${VERSION}-amd64.zip"
-        if gh release view "v${VERSION}" --repo "${{ github.repository }}" \
-             --json assets --jq '.assets[].name' 2>/dev/null | grep -qx "$asset"; then
-          echo "build=yes" >> "$GITHUB_OUTPUT"
-          echo "OK: $asset is on the v${VERSION} release; building the image."
-        else
-          echo "build=no" >> "$GITHUB_OUTPUT"
-          echo "::notice::$asset is not on the v${VERSION} release yet - skipping. release-all.yml builds the image once the release is published."
-        fi
-
-    - name: Build the Docker image
-      if: steps.rel.outputs.build == 'yes'
-      run: docker build . --file Dockerfile --tag wekan:$(date +%s)

.github/workflows/meteor-spk.yml

@@ -1,107 +0,0 @@
-name: Build meteor-spk bundle
-
-# Manually triggered. Assembles WeKan's modernized meteor-spk (the Sandstorm packaging
-# tool + its meteor-spk.deps: Node 24, FerretDB, the Mongo 3.x CLIs and the modern
-# sandstorm-http-bridge) and zips it as meteor-spk-YYYY-MM-DD_HH_MM_SS.zip — the same kind
-# of self-contained meteor-spk bundle that https://github.com/sandstorm-io/meteor-spk
-# releases, but with WeKan's Node 24 / FerretDB deps baked in. Download it to `meteor-spk
-# pack` WeKan (or any Meteor 3.x app) without re-running build-deps.sh each time.
-#
-#   gh workflow run meteor-spk.yml
-#
-# This only assembles + zips the tool; it does NOT pack or sign a WeKan .spk, so it needs
-# no SANDSTORM_KEYRING. The .spk itself is built by sandstorm.yml; the Sandstorm App
-# Market publish is done by sandstorm-store.yml.
-
-on:
-  workflow_dispatch:
-    inputs:
-      ref:
-        description: 'Branch, tag or SHA to build the meteor-spk deps from (default: main)'
-        required: false
-        default: 'main'
-
-permissions:
-  contents: write
-
-env:
-  NODE_VERSION: '24'
-
-jobs:
-  meteor-spk:
-    runs-on: ubuntu-24.04
-    timeout-minutes: 120
-    steps:
-      - uses: actions/checkout@v7
-        with:
-          ref: ${{ github.event.inputs.ref || 'main' }}
-
-      - uses: actions/setup-node@v7
-        with:
-          node-version: ${{ env.NODE_VERSION }}
-
-      - name: Enable unprivileged user namespaces (Ubuntu 24.04 restricts them)
-        # Same as sandstorm.yml: Ubuntu 24.04's AppArmor blocks the unprivileged user
-        # namespaces the Sandstorm install relies on; relax it so the install (whose
-        # sandstorm-http-bridge build-deps.sh copies in) can run on the runner.
-        run: |
-          sudo sysctl -w kernel.apparmor_restrict_unprivileged_userns=0 || true
-          sudo sysctl -w kernel.unprivileged_userns_clone=1 2>/dev/null || true
-
-      - name: Install system dependencies
-        run: |
-          sudo apt-get update
-          sudo apt-get install -y p7zip-full wget curl build-essential g++ make python3 unzip xz-utils git zip
-
-      - name: Install Sandstorm (dev, unattended)
-        # build-deps.sh's [bridge] step copies the modern
-        # /opt/sandstorm/latest/bin/sandstorm-http-bridge into the deps, so Sandstorm
-        # must be installed first — same ordering as sandstorm.yml.
-        run: curl https://install.sandstorm.io | sudo bash -s -- -d
-
-      - name: Assemble modern meteor-spk.deps (Node 24 + FerretDB + Mongo 3.x CLIs)
-        # Base = upstream meteor-spk 0.6.0 from dl.sandstorm.io; build-deps.sh swaps in
-        # Node 24, FerretDB, the Mongo 3.x CLIs, the migration launcher/importer, keeps
-        # niscud, and swaps in the modern sandstorm-http-bridge. Produces
-        # $HOME/projects/meteor-spk/meteor-spk-0.6.0 (the meteor-spk tool + deps).
-        run: bash sandstorm-src/build-deps.sh
-
-      - name: Zip the meteor-spk bundle
-        id: zip
-        run: |
-          set -euo pipefail
-          STAMP="$(date +'%Y-%m-%d_%H_%M_%S')"
-          ZIP="meteor-spk-${STAMP}.zip"
-          BUNDLE_DIR="$HOME/projects/meteor-spk"
-          if [ ! -d "$BUNDLE_DIR/meteor-spk-0.6.0" ]; then
-            echo "::error::Expected meteor-spk bundle at $BUNDLE_DIR/meteor-spk-0.6.0 was not produced by build-deps.sh."
-            exit 1
-          fi
-          # Zip so it extracts to a top-level meteor-spk-0.6.0/ directory, like the
-          # upstream meteor-spk release archives. Exclude the base tarball build-deps.sh
-          # downloaded next to it.
-          ( cd "$BUNDLE_DIR" && zip -r -y -q "$GITHUB_WORKSPACE/$ZIP" meteor-spk-0.6.0 -x '*.tar.xz' )
-          ZIP_BYTES=$(stat -c%s "$GITHUB_WORKSPACE/$ZIP")
-          echo "Packed $ZIP: $((ZIP_BYTES/1024/1024)) MiB ($ZIP_BYTES bytes)"
-          ls -la "$GITHUB_WORKSPACE/$ZIP"
-          echo "zip=$ZIP" >> "$GITHUB_OUTPUT"
-
-      - uses: actions/upload-artifact@v7
-        with:
-          name: ${{ steps.zip.outputs.zip }}
-          path: ${{ steps.zip.outputs.zip }}
-          retention-days: 7
-
-      - name: Upload the meteor-spk bundle to the newest WeKan release
-        env:
-          GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
-          GH_REPO: ${{ github.repository }}
-        run: |
-          set -euo pipefail
-          TAG="$(gh release list --limit 1 --json tagName --jq '.[0].tagName' 2>/dev/null || true)"
-          if [ -z "${TAG:-}" ] || [ "$TAG" = "null" ]; then
-            echo "::warning::No existing GitHub Release found; the meteor-spk bundle is available only as a workflow artifact."
-            exit 0
-          fi
-          echo "Uploading ${{ steps.zip.outputs.zip }} to the newest release: $TAG"
-          gh release upload "$TAG" "${{ steps.zip.outputs.zip }}" --clobber

.github/workflows/playwright.yml.disabled

@@ -1,298 +0,0 @@
-name: Playwright E2E Tests
-
-on:
-  push:
-    branches: [main]
-  pull_request:
-    branches: [main]
-
-concurrency:
-  group: playwright-${{ github.ref }}
-  cancel-in-progress: true
-
-permissions:
-  contents: read
-
-jobs:
-  unit-tests:
-    name: Meteor unit tests
-    runs-on: ubuntu-24.04
-    steps:
-      - uses: actions/checkout@v7
-
-      - name: Setup Node 24
-        uses: actions/setup-node@v6
-        with:
-          node-version: '24'
-          cache: 'npm'
-
-      - name: Cache Meteor installation
-        uses: actions/cache@v6
-        with:
-          path: ~/.meteor
-          key: meteor-${{ hashFiles('.meteor/release') }}-${{ hashFiles('.meteor/packages') }}
-          restore-keys: meteor-
-
-      - name: Cache Meteor build (.meteor/local)
-        uses: actions/cache@v6
-        with:
-          path: .meteor/local
-          key: meteor-local-unit-${{ hashFiles('.meteor/versions') }}
-          restore-keys: meteor-local-unit-
-
-      - name: Install Meteor
-        run: |
-          if [ ! -x ~/.meteor/meteor ]; then
-            curl https://install.meteor.com/ | sh
-          fi
-          echo "$HOME/.meteor" >> "$GITHUB_PATH"
-
-      - name: Install npm dependencies
-        run: npm ci
-
-      - name: Run Meteor unit tests
-        # First Meteor build is slow; allow time before the test driver starts.
-        timeout-minutes: 45
-        # NOTE: do not set TEST_WATCH here. meteortesting:mocha computes
-        # `testWatch: TEST_WATCH || …`, and the string '0' is truthy in JS, so
-        # TEST_WATCH=0 turns ON watch mode and the process never exits — that is
-        # what made this job hang until the 45-minute timeout. With TEST_WATCH
-        # unset, `meteor test --once` runs the server tests and exits with the
-        # correct status (matching the local build.sh run).
-        run: meteor test --once --driver-package meteortesting:mocha
-
-  e2e-tests:
-    name: Playwright E2E (${{ matrix.project }} ${{ matrix.shard }}/2)
-    runs-on: ubuntu-24.04
-    needs: unit-tests
-    strategy:
-      fail-fast: false
-      matrix:
-        # Playwright bundles Chromium, Firefox and WebKit builds that all run
-        # headless on the Linux runner (installed per-job below with --with-deps).
-        project: [chromium, firefox, webkit]
-        # Split each browser's ~245 specs across 2 parallel shards (6 jobs total)
-        # to cut wall-clock time. Each shard job starts its own WeKan + Mongo, so
-        # there is no shared-server contention between shards. Raise the shard
-        # count (here and in the --shard flag below) once the baseline is green
-        # and/or once E2E runs against a prebuilt bundle (cheaper per-job startup).
-        shard: [1, 2]
-
-    services:
-      mongodb:
-        image: mongo:7
-        ports: ['27017:27017']
-        options: >-
-          --health-cmd "mongosh --eval 'db.adminCommand(\"ping\")'"
-          --health-interval 10s
-          --health-timeout 5s
-          --health-retries 5
-
-    steps:
-      - uses: actions/checkout@v7
-
-      - name: Setup Node 24
-        uses: actions/setup-node@v6
-        with:
-          node-version: '24'
-          cache: 'npm'
-
-      - name: Cache Meteor installation
-        uses: actions/cache@v6
-        with:
-          path: ~/.meteor
-          key: meteor-${{ hashFiles('.meteor/release') }}-${{ hashFiles('.meteor/packages') }}
-          restore-keys: meteor-
-
-      - name: Cache Meteor build (.meteor/local)
-        uses: actions/cache@v6
-        with:
-          path: .meteor/local
-          key: meteor-local-e2e-${{ hashFiles('.meteor/versions') }}
-          restore-keys: meteor-local-e2e-
-
-      - name: Install Meteor
-        run: |
-          if [ ! -x ~/.meteor/meteor ]; then
-            curl https://install.meteor.com/ | sh
-          fi
-          echo "$HOME/.meteor" >> "$GITHUB_PATH"
-
-      - name: Install app npm dependencies
-        run: npm ci
-
-      - name: Install Playwright test dependencies
-        run: npm ci
-        working-directory: tests/playwright
-
-      - name: Install Playwright browsers
-        run: npx playwright install --with-deps ${{ matrix.project }}
-        working-directory: tests/playwright
-
-      - name: Build and start WeKan (production bundle)
-        run: |
-          # Run E2E against a PRODUCTION build instead of `meteor run` (dev mode).
-          # In dev the client JS is served by the rspack dev server, which did not
-          # serve the bundle reliably in headless CI: the browser received HTML for
-          # the bundle ("Unexpected token '<'"), Meteor never initialised, and every
-          # spec timed out. A production build bakes the client JS into the bundle,
-          # served statically by the Meteor server at :3000.
-          meteor build ./output --directory
-          ( cd output/bundle/programs/server && npm install )
-          # WeKan's server/00checkStartup.js refuses to start unless WRITABLE_PATH
-          # (used for attachment/file storage) is set and writable.
-          mkdir -p "$PWD/wekan-writable"
-          # Match the env the dev runner (build.sh) and the specs expect:
-          # WITH_API enables the REST API (specs 17/23/24/28), comment-editor
-          # flag matches dev.
-          MONGO_URL=mongodb://localhost:27017/wekan_test \
-          ROOT_URL=http://localhost:3000 \
-          PORT=3000 \
-          WRITABLE_PATH="$PWD/wekan-writable" \
-          WITH_API=true \
-          RICHER_CARD_COMMENT_EDITOR=false \
-          node output/bundle/main.js > wekan-run.log 2>&1 &
-          # The production server serves the client JS statically, so once :3000
-          # responds the bundle is being served. Wait up to 10 minutes.
-          for i in $(seq 1 60); do
-            if curl -sf http://localhost:3000 > /dev/null; then
-              echo "WeKan is up after $((i * 10))s"
-              break
-            fi
-            echo "Waiting for WeKan... attempt $i/60"
-            sleep 10
-          done
-          if ! curl -sf http://localhost:3000 > /dev/null; then
-            echo "WeKan failed to start. Last 250 log lines:"
-            tail -n 250 wekan-run.log
-            exit 1
-          fi
-        env:
-          TOOL_NODE_FLAGS: --max-old-space-size=8192
-          NODE_OPTIONS: --max-old-space-size=8192
-          DISABLE_CAPTCHA: 'true' 
-
-      - name: Run Playwright tests (${{ matrix.project }} shard ${{ matrix.shard }}/2)
-        run: |
-          npx playwright test \
-            --project=${{ matrix.project }} \
-            --shard=${{ matrix.shard }}/2 \
-            --reporter=github
-        working-directory: tests/playwright
-        env:
-          WEKAN_BASE_URL: http://localhost:3000
-          WEKAN_MONGO_URL: mongodb://localhost:27017/wekan_test
-          # Make the firefox and webkit projects available to --project
-          # (playwright.config.js only defines them when this is set).
-          WEKAN_PLAYWRIGHT_ALL: '1'
-
-      - name: Upload Playwright report
-        if: always()
-        uses: actions/upload-artifact@v7
-        with:
-          name: playwright-report-${{ matrix.project }}-shard${{ matrix.shard }}
-          path: tests/playwright/playwright-report/
-          retention-days: 14
-
-      - name: Upload test results (screenshots / videos)
-        if: failure()
-        uses: actions/upload-artifact@v7
-        with:
-          name: test-results-${{ matrix.project }}-shard${{ matrix.shard }}
-          path: tests/playwright/test-results/
-          retention-days: 7
-
-  e2e-regression:
-    name: Puppeteer regression suite
-    runs-on: ubuntu-24.04
-    needs: unit-tests
-
-    services:
-      mongodb:
-        image: mongo:7
-        ports: ['27017:27017']
-        options: >-
-          --health-cmd "mongosh --eval 'db.adminCommand(\"ping\")'"
-          --health-interval 10s
-          --health-timeout 5s
-          --health-retries 5
-
-    steps:
-      - uses: actions/checkout@v7
-
-      - name: Setup Node 24
-        uses: actions/setup-node@v6
-        with:
-          node-version: '24'
-          cache: 'npm'
-
-      - name: Cache Meteor installation
-        uses: actions/cache@v6
-        with:
-          path: ~/.meteor
-          key: meteor-${{ hashFiles('.meteor/release') }}-${{ hashFiles('.meteor/packages') }}
-          restore-keys: meteor-
-
-      - name: Cache Meteor build (.meteor/local)
-        uses: actions/cache@v6
-        with:
-          path: .meteor/local
-          key: meteor-local-regression-${{ hashFiles('.meteor/versions') }}
-          restore-keys: meteor-local-regression-
-
-      - name: Install Meteor
-        run: |
-          if [ ! -x ~/.meteor/meteor ]; then
-            curl https://install.meteor.com/ | sh
-          fi
-          echo "$HOME/.meteor" >> "$GITHUB_PATH"
-
-      - name: Install npm dependencies
-        run: npm ci
-
-      - name: Install Chromium
-        run: sudo apt-get install -y chromium-browser
-
-      - name: Build and start WeKan (production bundle)
-        run: |
-          # Run a PRODUCTION build, not `meteor run` (dev): exactly like the
-          # Playwright e2e job, because the rspack dev server does not serve the
-          # client JS bundle in headless CI, so Meteor never initialises and the
-          # puppeteer regression test times out in waitForMeteorGlobals(). The
-          # production bundle serves the client statically. WRITABLE_PATH is
-          # required by server/00checkStartup.js; WITH_API mirrors the dev runner.
-          meteor build ./output --directory
-          ( cd output/bundle/programs/server && npm install )
-          mkdir -p "$PWD/wekan-writable"
-          MONGO_URL=mongodb://localhost:27017/wekan_regression \
-          ROOT_URL=http://localhost:3000 \
-          PORT=3000 \
-          WRITABLE_PATH="$PWD/wekan-writable" \
-          WITH_API=true \
-          RICHER_CARD_COMMENT_EDITOR=false \
-          node output/bundle/main.js > wekan-run.log 2>&1 &
-          for i in $(seq 1 60); do
-            if curl -sf http://localhost:3000 > /dev/null; then
-              echo "WeKan is up after $((i * 10))s"
-              break
-            fi
-            echo "Waiting for WeKan... attempt $i/60"
-            sleep 10
-          done
-          if ! curl -sf http://localhost:3000 > /dev/null; then
-            echo "WeKan failed to start. Last 250 log lines:"
-            tail -n 250 wekan-run.log
-            exit 1
-          fi
-        env:
-          TOOL_NODE_FLAGS: --max-old-space-size=8192
-          NODE_OPTIONS: --max-old-space-size=8192
-          DISABLE_CAPTCHA: 'true'
-
-      - name: Run list-regressions e2e
-        run: node tests/e2e/list-regressions.js
-        env:
-          WEKAN_BASE_URL: http://localhost:3000
-          WEKAN_MONGO_URL: mongodb://localhost:27017/wekan_regression
-          CHROMIUM_PATH: /usr/bin/chromium-browser
-          HEADLESS: 'true'

.github/workflows/release-all-missing.yml

@@ -1,318 +0,0 @@
-name: Release all missing
-
-# Build only the bundles a release does not already carry.
-#
-# WHY: release-all.yml is one run that bumps versions, tags, builds every
-# platform, publishes Docker images, snaps, the website and the charts. It is
-# the right thing for MAKING a release and the wrong thing for FINISHING one.
-# When the v10.57 run ended with the six extra architectures missing - four of
-# them on a shell-quoting bug and two on a base image - there was no way to get
-# those six without running the whole thing again, version bump and all.
-#
-# This finishes a release that already exists. It never bumps a version, never
-# tags, never touches Docker, snap, the website or the charts.
-#
-# WHAT IT CAN BUILD, and why that is not everything. Only build-amd64 runs
-# Meteor; every other bundle WeKan ships is that same bundle repacked. This job
-# downloads the PUBLISHED wekan-<v>-amd64.zip and repacks it, so it can rebuild:
-#
-#   the six extra architectures  s390x ppc64le riscv64 i386 armhf loong64
-#   the AppImages and Flatpaks   by calling their own workflows
-#
-# It cannot rebuild amd64 itself (that is the Meteor build), nor arm64, win64
-# and mac-arm64 (each needs its own kind of runner and its own steps), nor the
-# Sandstorm .spk. When one of those is missing it says so and names
-# release-all.yml, rather than pretending.
-#
-# The repack is releases/repack-bundle-for-arch.sh - the SAME script
-# release-all.yml's build-extra-arches runs, so a bundle added to a release
-# months later is built exactly like the ones already on it.
-#
-# What a complete release looks like is releases/expected-assets.sh, in one
-# place. An asset counts as present only when its .sha256sum is there too; the
-# Sandstorm .spk is signed rather than checksummed and is marked nosums.
-#
-# Usage:
-#   gh workflow run release-all-missing.yml -f version=10.58
-
-on:
-  workflow_dispatch:
-    inputs:
-      version:
-        description: 'Release to complete, without the v (e.g. 10.58). Empty = the newest release.'
-        required: false
-        type: string
-
-permissions:
-  contents: write
-
-env:
-  # Must match release-all.yml: the Node.js major the bundles carry.
-  NODE_VERSION: '24'
-
-# Never at the same time as a full release run, which would be uploading to the
-# same assets.
-concurrency:
-  group: wekan-release-${{ inputs.version || github.ref }}
-  cancel-in-progress: false
-
-jobs:
-  plan:
-    name: what the release is missing
-    runs-on: ubuntu-latest
-    outputs:
-      version: ${{ steps.plan.outputs.version }}
-      extra: ${{ steps.plan.outputs.extra }}
-      appimage: ${{ steps.plan.outputs.appimage }}
-      flatpak: ${{ steps.plan.outputs.flatpak }}
-      manual: ${{ steps.plan.outputs.manual }}
-      total: ${{ steps.plan.outputs.total }}
-    steps:
-      - uses: actions/checkout@v7
-
-      - id: plan
-        env:
-          GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
-        run: |
-          set -euo pipefail
-
-          V='${{ inputs.version }}'
-          V="${V#v}"
-          if [ -z "$V" ]; then
-            V="$(gh release view --json tagName --jq .tagName)"
-            V="${V#v}"
-            echo "No version given; the newest release is v$V."
-          fi
-          echo "version=$V" >> "$GITHUB_OUTPUT"
-
-          if gh release view "v$V" >/dev/null 2>&1; then
-            gh release view "v$V" --json assets --jq '.assets[].name' | sort > existing.txt
-          else
-            echo "::error::There is no release v$V to complete. This workflow FINISHES a release; release-all.yml makes one."
-            exit 1
-          fi
-          echo "v$V carries $(wc -l < existing.txt | tr -d ' ') asset(s)."
-
-          bash releases/expected-assets.sh "$V" > expected.txt
-
-          : > missing.txt
-          present=0
-          while read -r kind selector asset sums; do
-            need="$asset"
-            [ "$sums" = "sums" ] && need="$need ${asset}.sha256sum"
-            have=yes
-            for n in $need; do grep -qxF "$n" existing.txt || have=no; done
-            if [ "$have" = yes ]; then present=$((present + 1)); else echo "$kind $selector" >> missing.txt; fi
-          done < expected.txt
-
-          total="$(wc -l < missing.txt | tr -d ' ')"
-          echo "total=$total" >> "$GITHUB_OUTPUT"
-
-          for kind in extra appimage flatpak; do
-            sels="$(awk -v k="$kind" '$1 == k { print $2 }' missing.txt)"
-            json="$(printf '%s\n' $sels | sed '/^$/d' | jq -R . | jq -sc .)"
-            [ -n "$json" ] || json='[]'
-            echo "$kind=$json" >> "$GITHUB_OUTPUT"
-            echo "  $kind: $json"
-          done
-
-          # The ones this workflow cannot make. Named, not silently skipped.
-          manual="$(awk '$1 == "meteor" || $1 == "repack" || $1 == "sandstorm" { printf "%s/%s ", $1, $2 }' missing.txt)"
-          echo "manual=${manual% }" >> "$GITHUB_OUTPUT"
-
-          {
-            echo "### v$V"
-            echo ""
-            echo "$present of $((present + total)) assets already published."
-            echo ""
-            if [ "$total" -eq 0 ]; then
-              echo "Nothing is missing - the release is complete."
-            else
-              echo "Missing:"
-              echo ""
-              echo '```'
-              cat missing.txt
-              echo '```'
-              if [ -n "$manual" ]; then
-                echo ""
-                echo "Not buildable here (run release-all.yml): \`$manual\`"
-              fi
-            fi
-          } >> "$GITHUB_STEP_SUMMARY"
-          echo "Missing $total. Needs release-all.yml: ${manual:-none}"
-
-      - name: Say plainly what this run will not do
-        if: ${{ steps.plan.outputs.manual != '' }}
-        run: |
-          echo "::warning::v${{ steps.plan.outputs.version }} is missing ${{ steps.plan.outputs.manual }}, which this workflow cannot build: amd64 is the Meteor build, arm64/win64/mac-arm64 each need their own runner, and the Sandstorm .spk is signed. Run release-all.yml for those."
-
-  # The six architectures nobody else builds for, repacked from the PUBLISHED
-  # amd64 bundle - which is what makes this possible without a Meteor build.
-  extra-arches:
-    name: ${{ matrix.arch }}
-    needs: plan
-    if: ${{ needs.plan.outputs.extra != '[]' }}
-    runs-on: ubuntu-24.04
-    timeout-minutes: 300
-    strategy:
-      fail-fast: false
-      matrix:
-        include:
-          # The same table as release-all.yml's build-extra-arches, and it has
-          # to stay the same: `node_arch` is what the Node.js download is
-          # called (Node says x86 where we say i386, armv7l where we say
-          # armhf), `ferretdb_arch` is the asset name in the wekan/FerretDB
-          # release, and `image` must be a base image that PUBLISHES this
-          # platform - ubuntu:26.04 does not build 386, debian:trixie does.
-          - { arch: s390x,   platform: linux/s390x,   image: debian:trixie, node_arch: s390x,   ferretdb_arch: s390x }
-          - { arch: ppc64le, platform: linux/ppc64le, image: debian:trixie, node_arch: ppc64le, ferretdb_arch: ppc64le }
-          - { arch: riscv64, platform: linux/riscv64, image: debian:trixie, node_arch: riscv64, ferretdb_arch: riscv64 }
-          - { arch: i386,    platform: linux/386,     image: debian:trixie, node_arch: x86,     ferretdb_arch: i386 }
-          - { arch: armhf,   platform: linux/arm/v7,  image: debian:trixie, node_arch: armv7l,  ferretdb_arch: armhf }
-          # loong64 has NO base image on Docker Hub at any tag, so there is no
-          # loong64 userland to rebuild the native modules in. Its Node.js and
-          # its FerretDB both exist; the container does not. The preflight
-          # inside the script stops it saying exactly that, and it stays in the
-          # matrix so it is visible rather than quietly absent.
-          - { arch: loong64, platform: linux/loong64, image: debian:trixie, node_arch: loong64, ferretdb_arch: loong64 }
-    env:
-      VERSION: ${{ needs.plan.outputs.version }}
-    steps:
-      - name: Skip the architectures this release already has
-        id: want
-        run: |
-          if printf '%s' '${{ needs.plan.outputs.extra }}' | jq -e --arg a '${{ matrix.arch }}' 'index($a)' >/dev/null; then
-            echo "build=yes" >> "$GITHUB_OUTPUT"
-          else
-            echo "build=no" >> "$GITHUB_OUTPUT"
-            echo "v${VERSION} already has ${{ matrix.arch }}; nothing to do."
-          fi
-
-      - name: Install dependencies
-        if: ${{ steps.want.outputs.build == 'yes' }}
-        run: |
-          sudo apt-get update
-          sudo apt-get install -y curl unzip zip
-
-      - name: Set up QEMU for ${{ matrix.arch }} emulation
-        if: ${{ steps.want.outputs.build == 'yes' }}
-        uses: docker/setup-qemu-action@v4
-
-      # Before the download, because actions/checkout cleans the workspace.
-      - uses: actions/checkout@v7
-        if: ${{ steps.want.outputs.build == 'yes' }}
-
-      # THE DIFFERENCE from release-all.yml, and the whole point of this
-      # workflow: the amd64 bundle comes from the RELEASE, not from an artifact
-      # of a build that is not running. Its checksum is verified when the
-      # release has one - a bundle every other architecture is cut from is worth
-      # checking before it is cut.
-      - name: Download the published amd64 bundle
-        if: ${{ steps.want.outputs.build == 'yes' }}
-        env:
-          GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
-        run: |
-          set -euo pipefail
-          zip="wekan-${VERSION}-amd64.zip"
-          gh release download "v${VERSION}" --pattern "$zip" --clobber
-          if gh release download "v${VERSION}" --pattern "${zip}.sha256sum" --clobber 2>/dev/null; then
-            sha256sum -c "${zip}.sha256sum"
-            echo "amd64 bundle checksum verified."
-          else
-            echo "::warning::v${VERSION} publishes no ${zip}.sha256sum, so the bundle every other architecture is cut from could not be verified."
-          fi
-          unzip -q "$zip"
-          [ -d bundle ] || { echo "::error::$zip did not contain a bundle/ directory."; exit 1; }
-          rm -f "$zip" "${zip}.sha256sum"
-
-      - name: Repack it for ${{ matrix.arch }}
-        if: ${{ steps.want.outputs.build == 'yes' }}
-        env:
-          ARCH: ${{ matrix.arch }}
-          NODE_ARCH: ${{ matrix.node_arch }}
-          FERRETDB_ARCH: ${{ matrix.ferretdb_arch }}
-          IMAGE: ${{ matrix.image }}
-          PLATFORM: ${{ matrix.platform }}
-        run: bash releases/repack-bundle-for-arch.sh
-
-      - name: Attach ${{ matrix.arch }} to the release
-        if: ${{ steps.want.outputs.build == 'yes' }}
-        env:
-          GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
-        run: |
-          set -euo pipefail
-          asset="wekan-${VERSION}-${{ matrix.arch }}.zip"
-          # No --clobber: this architecture was absent, so an upload that would
-          # overwrite something means the release changed under this run.
-          gh release upload "v${VERSION}" "$asset" "${asset}.sha256sum"
-          # Confirm from the other side. An upload that reports success and
-          # leaves no asset behind is the failure nobody notices until a
-          # download 404s.
-          gh release view "v${VERSION}" --json assets --jq '.assets[].name' > release-assets.txt
-          grep -qxF "$asset" release-assets.txt || {
-            echo "::error::$asset is not on release v${VERSION} although the upload reported success."
-            exit 1
-          }
-          echo "OK: $asset attached ($(($(wc -c < "$asset")/1024/1024)) MiB)."
-
-  appimage:
-    name: AppImages
-    needs: plan
-    if: ${{ needs.plan.outputs.appimage != '[]' }}
-    uses: ./.github/workflows/AppImage.yml
-    permissions:
-      contents: write
-    with:
-      tag: v${{ needs.plan.outputs.version }}
-      publish: true
-      only: ${{ needs.plan.outputs.appimage }}
-
-  flatpak:
-    name: Flatpaks
-    needs: plan
-    if: ${{ needs.plan.outputs.flatpak != '[]' }}
-    uses: ./.github/workflows/Flatpak.yml
-    permissions:
-      contents: write
-    with:
-      tag: v${{ needs.plan.outputs.version }}
-      publish: true
-      only: ${{ needs.plan.outputs.flatpak }}
-
-  done:
-    name: what is still missing
-    needs: [plan, extra-arches, appimage, flatpak]
-    if: ${{ always() }}
-    runs-on: ubuntu-latest
-    steps:
-      - uses: actions/checkout@v7
-      - env:
-          GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
-          V: ${{ needs.plan.outputs.version }}
-          BEFORE: ${{ needs.plan.outputs.total }}
-        run: |
-          set -euo pipefail
-          if [ "$BEFORE" = "0" ]; then
-            echo "::notice::v$V was already complete - nothing was built."
-            exit 0
-          fi
-          gh release view "v$V" --json assets --jq '.assets[].name' | sort > now.txt
-          bash releases/expected-assets.sh "$V" > expected.txt
-          still=""
-          while read -r kind selector asset sums; do
-            need="$asset"
-            [ "$sums" = "sums" ] && need="$need ${asset}.sha256sum"
-            for n in $need; do
-              grep -qxF "$n" now.txt || { still="$still $kind/$selector"; break; }
-            done
-          done < expected.txt
-          echo "" >> "$GITHUB_STEP_SUMMARY"
-          if [ -z "$still" ]; then
-            echo "v$V is complete."
-            echo "**v$V is complete.**" >> "$GITHUB_STEP_SUMMARY"
-          else
-            # A warning, not a failure: what is left may be the parts this
-            # workflow never claimed to build.
-            echo "::warning::v$V is still missing:${still}"
-            echo "Still missing:\`${still# }\`" >> "$GITHUB_STEP_SUMMARY"
-          fi

.github/workflows/release.yml

@@ -1,30 +0,0 @@
-name: Release Charts
-
-on:
-  push:
-    branches:
-      - main
-
-permissions:
-  contents: read
-
-jobs:
-  release:
-    permissions:
-      contents: write  # for helm/chart-releaser-action to push chart release and create a release
-    runs-on: ubuntu-latest
-    steps:
-      - name: Checkout
-        uses: actions/checkout@v7
-        with:
-          fetch-depth: 0
-
-      - name: Configure Git
-        run: |
-          git config user.name "$GITHUB_ACTOR"
-          git config user.email "$GITHUB_ACTOR@users.noreply.github.com"
-
-      - name: Run chart-releaser
-        uses: helm/chart-releaser-action@v1.7.0
-        env:
-          CR_TOKEN: "${{ secrets.GITHUB_TOKEN }}"

.github/workflows/sandstorm-store.yml

@@ -1,145 +0,0 @@
-name: Publish .spk to Sandstorm App Market
-
-# Manually triggered. Takes the Sandstorm .spk that sandstorm.yml already built and
-# attached to a WeKan GitHub Release, renames it to wekan-<VERSION>.spk (VERSION is the
-# WeKan release version, e.g. 9.88), and publishes it to the Sandstorm App Market with
-#   spk publish wekan-<VERSION>.spk
-# exactly like releases/release-sandstorm.sh does locally.
-#
-#   gh workflow run sandstorm-store.yml
-#   gh workflow run sandstorm-store.yml -f version=9.88
-#   gh workflow run sandstorm-store.yml -f version=9.88 -f tag=v9.88
-#
-# Needs SANDSTORM_KEYRING (base64 of ~/.sandstorm-keyring) — `spk publish` proves app
-# ownership with the WeKan Sandstorm app's private key from that keyring — and installs
-# Sandstorm + assembles meteor-spk the same way sandstorm.yml does, so `spk` is present.
-# It does NOT rebuild the .spk; it publishes the one already on the release.
-
-on:
-  workflow_dispatch:
-    inputs:
-      version:
-        description: 'WeKan version for the store filename wekan-<VERSION>.spk (e.g. 9.88). Default: derived from the release tag.'
-        required: false
-        default: ''
-      tag:
-        description: 'Release tag whose .spk to publish (default: newest release).'
-        required: false
-        default: ''
-
-permissions:
-  contents: read
-
-env:
-  NODE_VERSION: '24'
-
-jobs:
-  sandstorm-store:
-    runs-on: ubuntu-24.04
-    timeout-minutes: 120
-    steps:
-      - uses: actions/checkout@v7
-
-      - uses: actions/setup-node@v7
-        with:
-          node-version: ${{ env.NODE_VERSION }}
-
-      - name: Enable unprivileged user namespaces (Ubuntu 24.04 restricts them)
-        run: |
-          sudo sysctl -w kernel.apparmor_restrict_unprivileged_userns=0 || true
-          sudo sysctl -w kernel.unprivileged_userns_clone=1 2>/dev/null || true
-
-      - name: Install system dependencies
-        run: |
-          sudo apt-get update
-          sudo apt-get install -y p7zip-full wget curl build-essential g++ make python3 unzip xz-utils git
-
-      - name: Install Sandstorm (dev, unattended)
-        # Provides the `spk` command used to publish, and the sandstorm-http-bridge that
-        # build-deps.sh copies into the meteor-spk deps.
-        run: curl https://install.sandstorm.io | sudo bash -s -- -d
-
-      - name: Assemble modern meteor-spk.deps (same as sandstorm.yml)
-        run: |
-          bash sandstorm-src/build-deps.sh
-          echo "$HOME/projects/meteor-spk/meteor-spk-0.6.0" >> "$GITHUB_PATH"
-
-      - name: Restore the Sandstorm signing keyring
-        env:
-          SANDSTORM_KEYRING: ${{ secrets.SANDSTORM_KEYRING }}
-        run: |
-          if [ -n "${SANDSTORM_KEYRING:-}" ]; then
-            # spk publish reads the app signing key from ~/.sandstorm-keyring (a FILE in
-            # $HOME), same location meteor-spk pack uses.
-            printf '%s' "$SANDSTORM_KEYRING" | base64 -d > "$HOME/.sandstorm-keyring"
-            chmod 600 "$HOME/.sandstorm-keyring"
-            echo "Restored ~/.sandstorm-keyring ($(wc -c < "$HOME/.sandstorm-keyring") bytes)."
-          else
-            echo "::error::SANDSTORM_KEYRING secret is not set. 'spk publish' proves ownership of the WeKan Sandstorm app with the private key from this keyring, so publishing cannot proceed without it. Add the base64 of your ~/.sandstorm-keyring file as the SANDSTORM_KEYRING repository secret (e.g. 'base64 -w0 ~/.sandstorm-keyring')."
-            exit 1
-          fi
-
-      - name: Download the newest .spk from the WeKan release and name it wekan-<VERSION>.spk
-        id: fetch
-        env:
-          GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
-          GH_REPO: ${{ github.repository }}
-          IN_TAG: ${{ github.event.inputs.tag }}
-          IN_VERSION: ${{ github.event.inputs.version }}
-        run: |
-          set -euo pipefail
-
-          # 1) Which release to publish from.
-          TAG="${IN_TAG:-}"
-          if [ -z "$TAG" ]; then
-            TAG="$(gh release list --limit 1 --json tagName --jq '.[0].tagName' 2>/dev/null || true)"
-          fi
-          if [ -z "${TAG:-}" ] || [ "$TAG" = "null" ]; then
-            echo "::error::No release found to publish the .spk from."
-            exit 1
-          fi
-
-          # 2) VERSION for the store filename wekan-<VERSION>.spk. Use the input, else
-          #    derive it from the tag (strip a leading 'v', e.g. v9.88 -> 9.88).
-          VERSION="${IN_VERSION:-}"
-          if [ -z "$VERSION" ]; then
-            VERSION="${TAG#v}"
-          fi
-          echo "Release: $TAG  ->  store filename: wekan-${VERSION}.spk"
-
-          # 3) Download the newest .spk asset on that release. sandstorm.yml attaches it
-          #    as wekan-sandstorm-YYYY_MM_DD-HH_MM_SS.spk; if several exist, take the
-          #    lexicographically-newest (the timestamp sorts chronologically).
-          ASSET="$(gh release view "$TAG" --json assets \
-            --jq '[.assets[].name | select(endswith(".spk"))] | sort | last' 2>/dev/null || true)"
-          if [ -z "${ASSET:-}" ] || [ "$ASSET" = "null" ]; then
-            echo "::error::Release $TAG has no .spk asset. Run sandstorm.yml first to build and attach one."
-            exit 1
-          fi
-          echo "Downloading .spk asset: $ASSET"
-          gh release download "$TAG" --pattern "$ASSET" --dir . --clobber
-
-          SPK="wekan-${VERSION}.spk"
-          mv -f "$ASSET" "$SPK"
-          ls -la "$SPK"
-          echo "spk=$SPK" >> "$GITHUB_OUTPUT"
-
-      - name: Publish to the Sandstorm App Market
-        env:
-          SPK: ${{ steps.fetch.outputs.spk }}
-        run: |
-          set -euo pipefail
-          # Resolve the spk binary: prefer PATH, then the Sandstorm install location.
-          SPK_BIN="$(command -v spk || true)"
-          if [ -z "$SPK_BIN" ]; then
-            for c in /opt/sandstorm/latest/bin/spk /opt/sandstorm/spk /usr/local/bin/spk; do
-              [ -x "$c" ] && SPK_BIN="$c" && break
-            done
-          fi
-          if [ -z "$SPK_BIN" ]; then
-            echo "::error::Could not find the 'spk' command from the Sandstorm install."
-            exit 1
-          fi
-          echo "Publishing $SPK with $SPK_BIN ..."
-          # Same command as releases/release-sandstorm.sh: spk publish wekan-<VERSION>.spk
-          "$SPK_BIN" publish "$SPK"

.github/workflows/sandstorm.yml

@@ -1,144 +0,0 @@
-name: Build Sandstorm .spk
-
-# Manually triggered. Builds ONLY the Sandstorm .spk package (nothing else) and
-# uploads it as wekan-sandstorm-YYYY_MM_DD-HH_MM_SS.spk to the NEWEST WeKan GitHub
-# Release as an attachment, so you can download it, test whether the Sandstorm
-# build works, and see any errors — without running a full release.
-#
-#   gh workflow run sandstorm.yml
-#
-# EXPERIMENTAL in CI (same caveats as the build-sandstorm job in release-all.yml):
-#   * Sandstorm needs unprivileged user namespaces; GitHub's Ubuntu runners are VMs
-#     that allow them, but this is the fragile part.
-#   * meteor-spk SIGNS the .spk with the app private key from the Sandstorm keyring;
-#     provide it as the SANDSTORM_KEYRING secret (base64 of ~/.sandstorm keyring).
-
-on:
-  workflow_dispatch:
-    inputs:
-      ref:
-        description: 'Branch, tag or SHA to build the .spk from (default: main)'
-        required: false
-        default: 'main'
-
-permissions:
-  contents: write
-
-env:
-  NODE_VERSION: '24'
-
-jobs:
-  sandstorm:
-    runs-on: ubuntu-24.04
-    timeout-minutes: 120
-    steps:
-      - uses: actions/checkout@v7
-        with:
-          # Build the dispatched ref so a fix branch can be tested before it is
-          # merged to main; defaults to main for a plain `gh workflow run`.
-          ref: ${{ github.event.inputs.ref || 'main' }}
-
-      - uses: actions/setup-node@v7
-        with:
-          node-version: ${{ env.NODE_VERSION }}
-
-      - name: Enable unprivileged user namespaces (Ubuntu 24.04 restricts them)
-        # Ubuntu 24.04's AppArmor defaults kernel.apparmor_restrict_unprivileged_userns=1,
-        # which blocks the unprivileged user namespaces that the Sandstorm install and
-        # the spk supervisor rely on (the "fragile part" noted above). Relax it so
-        # `install.sandstorm.io` and meteor-spk can create sandboxes on the runner.
-        # `|| true`: on kernels/runners without these knobs, setting them is a no-op.
-        run: |
-          sudo sysctl -w kernel.apparmor_restrict_unprivileged_userns=0 || true
-          sudo sysctl -w kernel.unprivileged_userns_clone=1 2>/dev/null || true
-
-      - name: Install system dependencies and Meteor
-        run: |
-          sudo apt-get update
-          sudo apt-get install -y p7zip-full wget curl build-essential g++ make python3 unzip xz-utils git qemu-user-static
-          if [ ! -f "$HOME/.meteor/meteor" ]; then curl https://install.meteor.com/ | sh; fi
-          echo "$HOME/.meteor" >> "$GITHUB_PATH"
-
-      - name: Install Sandstorm (dev, unattended)
-        # Installed BEFORE assembling the deps: build-deps.sh's [bridge] step copies
-        # the modern /opt/sandstorm/latest/bin/sandstorm-http-bridge over the ancient
-        # bundled one, so the Sandstorm install must be in place first.
-        run: curl https://install.sandstorm.io | sudo bash -s -- -d
-
-      - name: Assemble modern meteor-spk.deps (Node 24 + FerretDB + Mongo 3.x CLIs)
-        # Base = upstream meteor-spk 0.6.0 from dl.sandstorm.io (has mongod 3.0 +
-        # niscud). build-deps.sh swaps in Node 24, adds FerretDB + the Mongo 3.x
-        # CLIs + the migration launcher/importer, keeps niscud, and swaps in the
-        # modern sandstorm-http-bridge from the Sandstorm install above. No dependency
-        # on the retired releases.wekan.team or the old projects.7z.
-        run: |
-          bash sandstorm-src/build-deps.sh
-          echo "$HOME/projects/meteor-spk/meteor-spk-0.6.0" >> "$GITHUB_PATH"
-
-      - name: Restore the Sandstorm signing keyring
-        env:
-          SANDSTORM_KEYRING: ${{ secrets.SANDSTORM_KEYRING }}
-        run: |
-          if [ -n "${SANDSTORM_KEYRING:-}" ]; then
-            # meteor-spk / spk read the app signing key from ~/.sandstorm-keyring —
-            # a FILE directly in $HOME (see the pack crash path
-            # "/home/runner/.sandstorm-keyring"). Write it exactly there, NOT to
-            # ~/.sandstorm/sandstorm-keyring, or `meteor-spk pack` aborts with
-            # "open(~/.sandstorm-keyring): No such file or directory".
-            printf '%s' "$SANDSTORM_KEYRING" | base64 -d > "$HOME/.sandstorm-keyring"
-            chmod 600 "$HOME/.sandstorm-keyring"
-            echo "Restored ~/.sandstorm-keyring ($(wc -c < "$HOME/.sandstorm-keyring") bytes)."
-          else
-            echo "::error::SANDSTORM_KEYRING secret is not set. meteor-spk pack signs the .spk with the WeKan Sandstorm app's private key, which lives in this keyring, so packing cannot proceed without it. Add the base64 of your ~/.sandstorm-keyring file as the SANDSTORM_KEYRING repository secret (e.g. 'base64 -w0 ~/.sandstorm-keyring')."
-            exit 1
-          fi
-
-      - name: Install Meteor npm dependencies
-        # PUPPETEER_SKIP_DOWNLOAD: puppeteer is a devDependency used only by tests,
-        # not by the server, so it never belongs in the packed .spk. Skipping its
-        # Chromium download (~150 MB) avoids any risk of it bloating the build and
-        # speeds up CI.
-        env:
-          PUPPETEER_SKIP_DOWNLOAD: '1'
-        run: |
-          (meteor update --npm 2>/dev/null || true) && meteor npm install
-
-      - name: Build the Sandstorm .spk
-        id: build
-        env:
-          PUPPETEER_SKIP_DOWNLOAD: '1'
-        run: |
-          set -euo pipefail
-          STAMP="$(date +'%Y_%m_%d-%H_%M_%S')"
-          SPK="wekan-sandstorm-${STAMP}.spk"
-          meteor-spk pack "$SPK"
-          # Report the packed size and warn if it exceeds Cloudflare's 100 MB upload
-          # cap (a proxied browser upload to a Cloudflare-fronted Sandstorm 413s above
-          # this; install via a DNS-only host / SSH tunnel, or trim further).
-          SPK_BYTES=$(stat -c%s "$SPK")
-          echo "Packed $SPK: $((SPK_BYTES/1024/1024)) MiB ($SPK_BYTES bytes)"
-          if [ "$SPK_BYTES" -gt $((100*1024*1024)) ]; then
-            echo "::warning::$SPK is $((SPK_BYTES/1024/1024)) MiB — over Cloudflare's 100 MB upload limit. Upload via a DNS-only host / SSH tunnel to Sandstorm, or trim the bundle further."
-          fi
-          ls -la "$SPK"
-          echo "spk=$SPK" >> "$GITHUB_OUTPUT"
-
-      - uses: actions/upload-artifact@v7
-        with:
-          name: ${{ steps.build.outputs.spk }}
-          path: ${{ steps.build.outputs.spk }}
-          retention-days: 7
-
-      - name: Upload the .spk to the newest WeKan release
-        env:
-          GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
-          GH_REPO: ${{ github.repository }}
-        run: |
-          set -euo pipefail
-          TAG="$(gh release list --limit 1 --json tagName --jq '.[0].tagName' 2>/dev/null || true)"
-          if [ -z "${TAG:-}" ] || [ "$TAG" = "null" ]; then
-            echo "::error::No existing GitHub Release found to attach the .spk to."
-            exit 1
-          fi
-          echo "Uploading ${{ steps.build.outputs.spk }} to the newest release: $TAG"
-          gh release upload "$TAG" "${{ steps.build.outputs.spk }}" --clobber

.gitignore

@@ -1,19 +1,14 @@
 *~
-/*.log
-# vim swap files (.swp, .swo, .swn) - but NOT .swcrc, which is the SWC transpiler
-# configuration and has to be committed. Without this exception `git add .swcrc`
-# is silently a no-op and the fix for #6557 never leaves the working tree.
-*.sw*
-!.swcrc
+*.swp
 .meteor-spk
 *.sublime-workspace
 tmp/
 node_modules/
 npm-debug.log
-.gitmodules
 .vscode/
 .idea/
 .build/*
+package-lock.json
 **/parts/
 **/stage
 **/prime
@@ -34,84 +29,3 @@ versions.json
 .Trashes
 Thumbs.db
 ehthumbs.db
-.eslintcache
-.meteor/local
-.meteor/local-test
-.devcontainer/docker-compose.extend.yml
-.devcontainer/volumes*/
-.coverage
-
-# Rspack build artifacts
-_build/
-public/build-assets/
-public/build-chunks/
-private/build-assets/
-private/build-chunks/
-public/client-rspack.js.map
-
-# Helm chart
-# Chart dependencies
-/helm/wekan/**/*.tgz
-/helm/wekan/charts
-
-# Meteor Modern-Tools build context directories
-_build
-*/build-assets
-*/build-chunks
-.rsdoctor
-
-# Tests
-playwright-report/
-test-results/
-
-# Claude AI
-.claude/
-
-# Companion repositories and tools, cloned INSIDE this checkout so they work in a
-# Flatpak sandbox that shares only this directory. One ignored directory for all
-# of them - it replaced an entry per clone (/FerretDB/, /node/, /mongo-tools/,
-# /mongosh/, /sandstorm/, /projects/, and the WeKan variants), which had to be
-# extended by hand for every new one. build.sh's ensure_tool_repo clones what a
-# test run needs into here: .tools/FerretDB, .tools/node-patches,
-# .tools/mongo-tools-patches. Nothing in here is WeKan's source, and Meteor is
-# told the same by /.tools/ in .meteorignore.
-.tools/
-
-# Meteor custom local directory (METEOR_LOCAL_DIR)
-_build-local-test
-*/build-assets-local-test
-*/build-chunks-local-test
-
-# Test and build logs, when they land INSIDE the repo. build.sh writes to
-# ../log/<datetime>/ by preference - one level up, so a test run does not show
-# up in git status - but the parent of the repo is not writable in a Flatpak
-# sandbox, which shares only the repository. There it falls back to ./log/,
-# which must not be committed.
-/log/
-
-# V8 heap snapshots from WEKAN_BUILD_HEAP_SNAPSHOT=1. Named
-# Heap.<date>.<pid>.<n>.heapsnapshot by Node, written into the repo root
-# because that is the build's working directory, and as large as the heap that
-# produced them - gigabytes.
-Heap.*.heapsnapshot
-
-# Linux core dumps (core.<pid>), e.g. from a crashing Playwright/WebKit browser
-# process. Written into the crashing process CWD (tests/playwright/) by
-# kernel.core_pattern; never source files.
-core.[0-9]*
-
-# The two variant repositories (wekan/wekan-ondra, wekan/wekan-gantt-gpl) when
-# they are cloned INSIDE this working copy to be synced by hand. They are whole
-# git repositories of their own; git would not commit them into this one, but
-# they should not show up as untracked noise either.
-/wekan-ondra/
-/wekan-gantt-gpl/
-
-# node-patches: a SEPARATE repo (github.com/wekan/node-patches) checked out here.
-node-patches/
-
-# mongo-tools-patches: a SEPARATE repo (github.com/wekan/mongo-tools-patches)
-# checked out here. Same story as node-patches: the PATCHES to the upstream
-# MongoDB Database Tools that WeKan's bundled bsondump/mongodump/... are built
-# from, replacing the wekan/mongo-tools source fork.
-mongo-tools-patches/

.gitpod.Dockerfile

@@ -1,10 +0,0 @@
-FROM gitpod/workspace-mongodb
-                    
-USER gitpod
-
-# Install custom tools, runtime, etc. using apt-get
-# For example, the command below would install "bastet" - a command line tetris clone:
-#
-# RUN sudo apt-get -q update && #     sudo apt-get install -yq bastet && #     sudo rm -rf /var/lib/apt/lists/*
-#
-# More information: https://www.gitpod.io/docs/config-docker/

.gitpod.yml

@@ -1,4 +0,0 @@
-tasks:
-  - init: npm install
-image:
-  file: .gitpod.Dockerfile

.meteor/.finished-upgraders

@@ -16,5 +16,3 @@ notices-for-facebook-graph-api-2
 1.4.1-add-shell-server-package
 1.4.3-split-account-service-packages
 1.5-add-dynamic-import-package
-1.7-split-underscore-from-meteor-base
-1.8.3-split-jquery-from-blaze

.meteor/packages

@@ -3,63 +3,92 @@
 # 'meteor add' and 'meteor remove' will edit this file for you,
 # but you can also edit it by hand.
 
-meteor-base@1.5.2
+meteor-base@1.2.0
 
 # Build system
-ecmascript@0.19.0
-standard-minifier-js@3.2.0
-rspack@1.2.0
-# Declared explicitly because server/modernBrowsers.js imports it, to say that
-# Yandex Browser is modern and must not be served the legacy bundle (#6557).
-modern-browsers@0.2.3
+ecmascript
+stylus@2.513.13
+standard-minifier-css@1.3.5
+standard-minifier-js@2.2.0
+mquandalle:jade
 
-blaze@3.0.2
+# Polyfills
+es5-shim@4.6.15
 
 # Collections
 aldeed:collection2
-aldeed:schema-index@4.0.0-beta.5
-reywood:publish-composite
-mongo@2.5.0
+cfs:standard-packages
+cottz:publish-relations
+dburles:collection-helpers
+idmontie:migrations
+matb33:collection-hooks
+matteodem:easy-search
+mongo@1.3.1
+mquandalle:collection-mutations
 
 # Account system
-accounts-password@3.3.1
-accounts-express@1.0.0
-communitypackages:core
-communitypackages:unstyled
-communitypackages:flow-routing
-# Routing
-ostrio:flow-router-extra
+kenton:accounts-sandstorm
+service-configuration@1.0.11
+useraccounts:unstyled
+useraccounts:flow-routing
 wekan-ldap
 wekan-accounts-cas
-wekan-accounts-sandstorm
-wekan-accounts-lockout
-wekan-oidc
 wekan-accounts-oidc
 
 # Utilities
-check@1.5.0
-random@1.2.2
-reactive-dict@1.3.2
-session@1.2.3
-tracker@1.3.4
-audit-argument-checks@1.0.8
+check@1.2.5
+jquery@1.11.10
+random@1.0.10
+reactive-dict@1.2.0
+session@1.1.7
+tracker@1.1.3
+underscore@1.0.10
+3stack:presence
+alethes:pages
+arillo:flow-router-helpers
+audit-argument-checks@1.0.7
+kadira:blaze-layout
+kadira:dochead
+meteorhacks:picker
+meteorhacks:subs-manager
+mquandalle:autofocus
+ongoworks:speakingurl
+raix:handlebar-helpers
+tap:i18n
+http@1.3.0
 
 # UI components
-ostrio:i18n
-reactive-var@1.0.13
-shell-server@0.7.0
-email@3.2.0
-dynamic-import@0.7.4
+blaze
+reactive-var@1.0.11
+fortawesome:fontawesome
+mousetrap:mousetrap
+mquandalle:jquery-textcomplete
+mquandalle:jquery-ui-drag-drop-sort
+mquandalle:mousetrap-bindglobal
+peerlibrary:blaze-components@=0.15.1
+templates:tabs
+verron:autosize
+simple:json-routes
+rajit:bootstrap3-datepicker
+shell-server@0.3.0
+simple:rest-accounts-password
+useraccounts:core
+email@1.2.3
+horka:swipebox
+dynamic-import@0.2.0
+staringatlights:fast-render
+
+mixmax:smart-disconnect
+accounts-password@1.5.0
+cfs:gridfs
+rzymek:fullcalendar
+momentjs:moment@2.22.2
+browser-policy-framing
+mquandalle:moment
+msavin:usercache
+wekan-scrollbar
+mquandalle:perfect-scrollbar
+mdg:meteor-apm-agent
+meteorhacks:unblock
+lucasantoniassi:accounts-lockout
 wekan-markdown
-quave:synced-cron
-ostrio:cookies
-ostrio:files
-# lmieulet:meteor-coverage
-meteortesting:mocha@3.0.0
-matb33:collection-hooks
-service-configuration@1.3.5
-minifier-css@2.0.2
-ejson@1.2.0
-logging@1.3.6
-wekan-fullcalendar
-wekan-fontawesome

.meteor/release

@@ -1 +1 @@
-METEOR@3.5.1
+METEOR@1.6.0.1

.meteor/versions

@@ -1,118 +1,188 @@
-accounts-base@3.3.0
-accounts-express@1.0.0
-accounts-oauth@1.4.7
-accounts-password@3.3.1
-aldeed:collection2@4.2.1
-aldeed:schema-index@4.0.0
-aldeed:simple-schema@1.13.1
-allow-deny@2.1.0
-audit-argument-checks@1.0.8
-autoupdate@2.0.1
-babel-compiler@7.15.0
-babel-runtime@1.5.2
-base64@1.0.14
-binary-heap@1.0.13
-blaze@3.0.3
-blaze-tools@2.0.1
-boilerplate-generator@2.1.0
-caching-compiler@2.0.1
-caching-html-compiler@2.0.1
-callback-hook@1.8.0
-check@1.5.0
-communitypackages:core@2.0.3
-communitypackages:flow-routing@2.1.0
-communitypackages:unstyled@2.0.1
-core-runtime@1.0.0
-ddp@1.4.2
-ddp-client@3.4.0
-ddp-common@1.4.5
-ddp-rate-limiter@1.3.0
-ddp-server@3.4.0
-diff-sequence@1.1.3
-dynamic-import@0.7.4
-ecmascript@0.19.0
-ecmascript-runtime@0.8.3
-ecmascript-runtime-client@0.13.0
-ecmascript-runtime-server@0.11.1
-ejson@1.2.0
-email@3.2.0
-es5-shim@4.8.1
-facts-base@1.0.2
-fetch@0.2.0
-geojson-utils@1.0.12
-hot-code-push@1.0.5
-html-tools@2.0.1
-htmljs@2.0.2
-id-map@1.2.0
-inter-process-messaging@0.1.3
-jquery@3.0.2
-lai:collection-extensions@1.0.0
-localstorage@1.2.1
-logging@1.3.6
-matb33:collection-hooks@2.1.0
-meteor@2.3.1
-meteor-base@1.5.2
-meteortesting:browser-tests@1.8.0
-meteortesting:mocha@3.3.0
-meteortesting:mocha-core@8.2.0
-minifier-css@2.0.2
-minifier-js@3.3.0
-minimongo@2.2.0
-modern-browsers@0.2.3
-modules@0.20.3
-modules-runtime@0.13.2
-mongo@2.5.0
-mongo-decimal@0.2.0
-mongo-dev-server@1.1.1
-mongo-id@1.0.9
-npm-mongo@6.16.2
-oauth@3.0.4
-oauth2@1.3.3
-observe-sequence@2.0.1
-ordered-dict@1.2.0
-ostrio:cookies@2.9.2
-ostrio:cstorage@4.0.1
-ostrio:files@3.0.1
-ostrio:flow-router-extra@3.15.3
-ostrio:i18n@3.2.1
-promise@1.0.0
-quave:synced-cron@2.4.0
-raix:eventemitter@1.0.0
-random@1.2.2
-rate-limit@1.2.0
-react-fast-refresh@0.3.0
-reactive-dict@1.3.2
-reactive-var@1.0.13
-reload@1.3.2
-retry@1.1.1
-reywood:publish-composite@1.9.0
-routepolicy@1.1.2
-rspack@1.2.0
-service-configuration@1.3.5
-session@1.2.3
-sha@1.0.10
-shell-server@0.7.0
-socket-stream-client@0.7.1
-spacebars@2.0.1
-spacebars-compiler@2.0.1
-standard-minifier-js@3.2.0
-templating@1.4.5
-templating-compiler@2.0.1
-templating-runtime@2.0.2
-templating-tools@2.0.1
-tools-core@1.2.0
-tracker@1.3.4
-typescript@5.11.0
-url@1.3.6
-webapp@2.3.0
-webapp-hashing@1.1.2
-wekan-accounts-cas@0.2.0
-wekan-accounts-lockout@1.1.0
+3stack:presence@1.1.2
+accounts-base@1.4.0
+accounts-oauth@1.1.15
+accounts-password@1.5.0
+aldeed:collection2@2.10.0
+aldeed:collection2-core@1.2.0
+aldeed:schema-deny@1.1.0
+aldeed:schema-index@1.1.1
+aldeed:simple-schema@1.5.3
+alethes:pages@1.8.6
+allow-deny@1.1.0
+arillo:flow-router-helpers@0.5.2
+audit-argument-checks@1.0.7
+autoupdate@1.3.12
+babel-compiler@6.24.7
+babel-runtime@1.1.1
+base64@1.0.10
+binary-heap@1.0.10
+blaze@2.3.2
+blaze-tools@1.0.10
+boilerplate-generator@1.3.1
+browser-policy-common@1.0.11
+browser-policy-framing@1.1.0
+caching-compiler@1.1.9
+caching-html-compiler@1.1.2
+callback-hook@1.0.10
+cfs:access-point@0.1.49
+cfs:base-package@0.0.30
+cfs:collection@0.5.5
+cfs:collection-filters@0.2.4
+cfs:data-man@0.0.6
+cfs:file@0.1.17
+cfs:gridfs@0.0.34
+cfs:http-methods@0.0.32
+cfs:http-publish@0.0.13
+cfs:power-queue@0.9.11
+cfs:reactive-list@0.0.9
+cfs:reactive-property@0.0.4
+cfs:standard-packages@0.5.9
+cfs:storage-adapter@0.2.3
+cfs:tempstore@0.1.5
+cfs:upload-http@0.0.20
+cfs:worker@0.1.4
+check@1.2.5
+chuangbo:cookie@1.1.0
+coffeescript@1.12.7_3
+coffeescript-compiler@1.12.7_3
+cottz:publish-relations@2.0.8
+dburles:collection-helpers@1.1.0
+ddp@1.4.0
+ddp-client@2.2.0
+ddp-common@1.3.0
+ddp-rate-limiter@1.0.7
+ddp-server@2.1.1
+deps@1.0.12
+diff-sequence@1.0.7
+dynamic-import@0.2.1
+ecmascript@0.9.0
+ecmascript-runtime@0.5.0
+ecmascript-runtime-client@0.5.0
+ecmascript-runtime-server@0.5.0
+ejson@1.1.0
+email@1.2.3
+es5-shim@4.6.15
+fastclick@1.0.13
+fortawesome:fontawesome@4.7.0
+geojson-utils@1.0.10
+horka:swipebox@1.0.2
+hot-code-push@1.0.4
+html-tools@1.0.11
+htmljs@1.0.11
+http@1.3.0
+id-map@1.0.9
+idmontie:migrations@1.0.3
+jquery@1.11.10
+kadira:blaze-layout@2.3.0
+kadira:dochead@1.5.0
+kadira:flow-router@2.12.1
+kenton:accounts-sandstorm@0.7.0
+launch-screen@1.1.1
+livedata@1.0.18
+localstorage@1.2.0
+logging@1.1.19
+lucasantoniassi:accounts-lockout@1.0.0
+matb33:collection-hooks@0.8.4
+matteodem:easy-search@1.6.4
+mdg:meteor-apm-agent@3.1.2
+mdg:validation-error@0.5.1
+meteor@1.8.2
+meteor-base@1.2.0
+meteor-platform@1.2.6
+meteorhacks:aggregate@1.3.0
+meteorhacks:collection-utils@1.2.0
+meteorhacks:meteorx@1.4.1
+meteorhacks:picker@1.0.3
+meteorhacks:subs-manager@1.6.4
+meteorhacks:unblock@1.1.0
+meteorspark:util@0.2.0
+minifier-css@1.2.16
+minifier-js@2.2.2
+minifiers@1.1.8-faster-rebuild.0
+minimongo@1.4.3
+mixmax:smart-disconnect@0.0.4
+mobile-status-bar@1.0.14
+modules@0.11.0
+modules-runtime@0.9.1
+momentjs:moment@2.22.2
+mongo@1.3.1
+mongo-dev-server@1.1.0
+mongo-id@1.0.6
+mongo-livedata@1.0.12
+mousetrap:mousetrap@1.4.6_1
+mquandalle:autofocus@1.0.0
+mquandalle:collection-mutations@0.1.0
+mquandalle:jade@0.4.9
+mquandalle:jade-compiler@0.4.5
+mquandalle:jquery-textcomplete@0.8.0_1
+mquandalle:jquery-ui-drag-drop-sort@0.2.0
+mquandalle:moment@1.0.1
+mquandalle:mousetrap-bindglobal@0.0.1
+mquandalle:perfect-scrollbar@0.6.5_2
+msavin:usercache@1.0.0
+npm-bcrypt@0.9.3
+npm-mongo@2.2.33
+oauth@1.2.1
+oauth2@1.2.0
+observe-sequence@1.0.16
+ongoworks:speakingurl@1.1.0
+ordered-dict@1.0.9
+peerlibrary:assert@0.2.5
+peerlibrary:base-component@0.16.0
+peerlibrary:blaze-components@0.15.1
+peerlibrary:computed-field@0.7.0
+peerlibrary:reactive-field@0.3.0
+promise@0.10.0
+raix:eventemitter@0.1.3
+raix:handlebar-helpers@0.2.5
+rajit:bootstrap3-datepicker@1.7.1
+random@1.0.10
+rate-limit@1.0.8
+reactive-dict@1.2.0
+reactive-var@1.0.11
+reload@1.1.11
+retry@1.0.9
+routepolicy@1.0.12
+rzymek:fullcalendar@3.8.0
+service-configuration@1.0.11
+session@1.1.7
+sha@1.0.9
+shell-server@0.3.1
+simple:authenticate-user-by-token@1.0.1
+simple:json-routes@2.1.0
+simple:rest-accounts-password@1.1.2
+simple:rest-bearer-token-parser@1.0.1
+simple:rest-json-error-handler@1.0.1
+softwarerero:accounts-t9n@1.3.11
+spacebars@1.0.15
+spacebars-compiler@1.1.3
+srp@1.0.10
+standard-minifier-css@1.3.5
+standard-minifier-js@2.2.3
+staringatlights:fast-render@2.16.5
+staringatlights:inject-data@2.0.5
+stylus@2.513.13
+tap:i18n@1.8.2
+templates:tabs@2.3.0
+templating@1.3.2
+templating-compiler@1.3.3
+templating-runtime@1.3.2
+templating-tools@1.1.2
+tracker@1.1.3
+ui@1.0.13
+underscore@1.0.10
+url@1.1.0
+useraccounts:core@1.14.2
+useraccounts:flow-routing@1.14.2
+useraccounts:unstyled@1.14.2
+verron:autosize@3.0.8
+webapp@1.4.0
+webapp-hashing@1.0.9
 wekan-accounts-oidc@1.0.10
-wekan-accounts-sandstorm@0.9.0
-wekan-fontawesome@6.4.2
-wekan-fullcalendar@5.11.5
-wekan-ldap@0.1.0
-wekan-markdown@1.0.9
-wekan-oidc@1.1.0
-zodern:types@1.0.13
+wekan-markdown@1.0.7
+wekan-oidc@1.0.12
+wekan-scrollbar@3.1.3
+wekan-accounts-cas@0.1.0
+wekan-ldap@0.0.2
+yasaricli:slugify@0.0.7
+zimme:active-route@2.3.2

.meteorignore

@@ -1,42 +0,0 @@
-npm-packages/
-# Root tests/ holds Playwright specs, Node E2E and node-based unit tests - none
-# of it is Meteor code, and Meteor's file watcher otherwise churns on the
-# tests/playwright/test-results/ tree (inotify errors). The leading slash anchors
-# this to the repo root only, so it does NOT match server/lib/tests/ or
-# client/lib/tests/ (the Mocha suites, loaded via meteor.testModule in
-# package.json). A naked "tests/" would match a dir named tests at any depth and
-# would hide those suites, making `meteor test` report "0 passing".
-/tests/
-
-# Build/tool scratch space: a full Node 24 install (headers for EVERY openssl arch),
-# a Go toolchain with its module/build caches, build logs and repro dirs. 20,535
-# DIRECTORIES, none of it app code. Meteor's watcher takes one inotify watch per
-# directory, and the per-user limit (fs.inotify.max_user_watches, 65536 here) is
-# shared with every other watcher the user runs - editors included. Watching this
-# tree is what made `meteor` fail with
-#   inotify_add_watch on '.tools/node-.../openssl/archs/BSD-x86_64/asm_avx2'
-#   failed: No space left on device
-# ENOSPC from inotify_add_watch means "watch limit reached", NOT a full disk.
-/.tools/
-
-# DO NOT ADD /_build/ OR /_build-local-test/ HERE. They look like build output
-# that should be ignored - they are gitignored, and they are the first two
-# entries of the 296 KB pattern list above - and excluding them breaks the
-# build outright:
-#
-#   error: Could not find mainModule for 'os' architecture:
-#   _build/main-prod/server-meteor.js
-#   Check the "meteor" section of your package.json file?
-#
-# They are not leftovers, they are the HANDOFF. rspack compiles the app into
-# _build/main-prod/ (and _build/test/ for a test run), and Meteor then reads
-# _build/main-prod/server-meteor.js and client-meteor.js as the application's
-# main modules - package.json names client/main.js and server/main.js, and the
-# rspack integration repoints mainModule at its own output. Ignoring them hides
-# the files Meteor is about to be handed. They cost 3 directories each, so there
-# was nothing to win here anyway.
-
-# Local build and test logs. WEKAN_LOG_ROOT prefers ../log/<datetime>/, but
-# falls back to ./log when the parent is not writable - which is exactly the
-# case inside the Flatpak sandbox, so this directory does appear here.
-/log/

.pkgr.yml

@@ -1,13 +0,0 @@
-dependencies:
-  - libreadline-dev
-  - libssl-dev
-  - bsdtar
-targets:
-  ubuntu-18.04:
-  ubuntu-16.04:
-  ubuntu-14.04:
-  centos-6:
-  centos-7:
-  debian-10:
-  sles-12:
-  sles-11:

.prettierignore

@@ -1,8 +0,0 @@
-packages/
-node_modules/
-.build/
-.meteor/
-.vscode/
-.tx/
-.github/
-.snap-meteor-1.8/

.prettierrc

@@ -1,8 +0,0 @@
-{
-  "printWidth": 80,
-  "tabWidth": 2,
-  "useTabs": false,
-  "semi": true,
-  "singleQuote": true,
-  "trailingComma": "all"
-}

.swcrc

@@ -1,5 +0,0 @@
-{
-  "jsc": {
-    "externalHelpers": false
-  }
-}

.travis.yml

@@ -1,10 +1,10 @@
-dist: focal
+dist: trusty
 sudo: required
 
 env:
-  TRAVIS_DOCKER_COMPOSE_VERSION: 1.24.0
-  TRAVIS_NODE_VERSION: 14.21.3
-  TRAVIS_NPM_VERSION: latest
+  TRAVIS_DOCKER_COMPOSE_VERSION: 1.17.0
+  TRAVIS_NODE_VERSION: 8.9.3
+  TRAVIS_NPM_VERSION: 5.5.1
 
 before_install:
   - sudo apt-get update -y

.tx/config

@@ -1,9 +1,55 @@
-[main]
-host     = https://www.transifex.com
-lang_map = te_IN: te-IN, es_AR: es-AR, es_419: es-LA, es_TX: es-TX, he_IL: he-IL, zh_CN: zh-CN, ar_EG: ar-EG, cs_CZ: cs-CZ, fa_IR: fa-IR, ms_MY: ms-MY, nl_NL: nl-NL, de_CH: de-CH, en_IT: en-IT, uz_UZ: uz-UZ, fr_CH: fr-CH, hi_IN: hi-IN, et_EE: et-EE, es_PE: es-PE, es_MX: es-MX, gl_ES: gl-ES, mn_MN: mn, zh_TW: zh-TW, ast_ES: ast-ES, es_CL: es-CL, ja_JP: ja-JP, lv_LV: lv, ro_RO: ro-RO, az_AZ: az-AZ, cy_GB: cy-GB, gu_IN: gu-IN, pl_PL: pl-PL, vep: ve-PP, en_BR: en-BR, en@ysv: en-YS, hu_HU: hu, ko_KR: ko-KR, pt_BR: pt-BR, zh_HK: zh-HK, zu_ZA: zu-ZA, en_MY: en-MY, ja-Hira: ja-HI, fi_FI: fi, vec: ve-CC, vi_VN: vi-VN, fr_FR: fr-FR, id_ID: id, zh_Hans: zh-Hans, en_DE: en-DE, en_GB: en-GB, el_GR: el-GR, uk_UA: uk-UA, az@latin: az-LA, de_AT: de-AT, uz@Latn: uz-LA, vls: vl-SS, ar_DZ: ar-DZ, bg_BG: bg, es_PY: es-PY, fy_NL: fy-NL, uz@Arab: uz-AR, ru_UA: ru-UA, war: wa-RR, zh_CN.GB2312: zh-GB
+# This is the configuration of the Transifex tool that we use to manage the
+# translations on Wekan. Documentation at: http://docs.transifex.com/client.
+#
+# Push
+# ====
+#
+# It is recommended that contributors use the Transifex web UI to create and
+# edit translated strings. However in case a contributor has directly jumped
+# into the code and made its translations in the corresponding i18n.json file
+# we can push it using
+#
+# > tx push -t -l ar
+#
+# Where `ar` is the language identifier. In addition, the project maintainer
+# should push the English source file to Transifex at least before each release
+# candidate using:
+#
+# > tx push -s
+#
+# Pull
+# ====
+#
+# The set of accepted language is directly managed in Transifex, the only
+# restriction we define to bundle a new language in the application, is that its
+# completion is at least at 75%.
+#
+# We use:
+#
+# > tx pull
+#
+# to download new versions of existing translations, and
+#
+# > tx pull -a --minimum-perc=75
+#
+# to download new sufficiently advanced translations.
 
-[o:wekan:p:wekan:r:application]
-file_filter = imports/i18n/data/<lang>.i18n.json
-source_file = imports/i18n/data/en.i18n.json
+[main]
+host = https://www.transifex.com
+# tap:i18n requires us to use `-` separator in the language identifiers whereas
+# Transifex uses a `_` separator, without an option to customize it on one side
+# or the other, so we need to do a Manual mapping.
+lang_map = bg_BG:bg, en_GB:en-GB, es_AR:es-AR, el_GR:el, fi_FI:fi, hu_HU:hu, id_ID:id, mn_MN:mn, no:nb, lv_LV:lv, pt_BR:pt-BR, ro_RO:ro, zh_CN:zh-CN, zh_TW:zh-TW, zh_HK:zh-HK
+
+[wekan.application]
+file_filter = i18n/<lang>.i18n.json
 source_lang = en
-type        = KEYVALUEJSON
+type = KEYVALUEJSON
+
+# We might have a dedicated second resource later to translate the “Welcome
+# Board” data.
+#
+# [wekan.welcomeBoard]
+# file_filter = private/welcomeBoard/<lang>.json
+# source_lang = en
+# type = KEYVALUEJSON

.vscode/launch.json

@@ -1,57 +0,0 @@
-{
-  "version": "0.2.0",
-  "configurations": [
-    {
-      "type": "node",
-      "request": "launch",
-      "name": "Meteor: Node",
-      "runtimeExecutable": "meteor",
-      "runtimeArgs": [
-        "--port=4000",
-        "--exclude-archs=web.browser.legacy,web.cordova",
-        "--raw-logs"
-      ],
-      "env": {
-        "WRITABLE_PATH": "/tmp/uploads",
-      },
-      "outputCapture": "std",
-      "restart": true,
-      "timeout": 60000
-    },
-    {
-      "type": "chrome",
-      "request": "launch",
-      "name": "Meteor: Chrome",
-      "url": "http://localhost:4000",
-      "sourceMapPathOverrides": {
-        "meteor://💻app/*": "${workspaceFolder}/*"
-      },
-      "userDataDir": "${env:HOME}/.vscode/chrome"
-    },
-    {
-      "type": "node",
-      "request": "launch",
-      "name": "Test: Node",
-      "runtimeExecutable": "meteor",
-      "runtimeArgs": [
-        "test",
-        "--port=4040",
-        "--exclude-archs=web.browser.legacy,web.cordova",
-        "--driver-package=meteortesting:mocha",
-        "--settings=settings.json",
-        "--raw-logs"
-      ],
-      "env": {
-        "TEST_WATCH": "1"
-      },
-      "outputCapture": "std",
-      "timeout": 60000
-    }
-  ],
-  "compounds": [
-    {
-      "name": "Meteor: All",
-      "configurations": ["Meteor: Node", "Meteor: Chrome"]
-    }
-  ]
-}

.vscode/settings.json

@@ -1,16 +1,12 @@
 {
-  "terminal.integrated.env.linux": {
-    "TERM": "xterm-256color"
-  },
-  "terminal.integrated.env.osx": {
-    "TERM": "xterm-256color"
-  },
-  "terminal.integrated.env.windows": {
-    "TERM": "xterm-256color"
-  },
-  "terminal.integrated.shell.linux": "/bin/bash",
-  "terminal.integrated.shellArgs.linux": [
-    "-l"
-  ],
-  "files.simpleDialog.enable": true
-}
+  "editor.tabSize": 2,
+  "editor.rulers": [80],
+  "files.trimTrailingWhitespace": true,
+  "files.insertFinalNewline": true,
+  "files.exclude": {
+    "**/.git": true,
+    "**/.DS_Store": true,
+    "node_modules": true,
+    ".meteor/local": true
+  }
+}

AGENTS.md

@@ -1,453 +0,0 @@
-# AGENTS.md — instructions Codex reads first
-
-Codex reads this file at the repo root before doing work here. Follow it.
-
-## First: are you the maintainer or a contributor?
-
-Check the current git identity before committing or releasing:
-
-```
-git config user.name && git config user.email
-```
-
-- **Maintainer mode** — ONLY when the identity is exactly
-  `Lauri Ojansivu <x@xet7.org>` (name `Lauri Ojansivu`, email `x@xet7.org`). Then, and
-  only then: commit **directly to the current branch** as `Lauri Ojansivu <x@xet7.org>`
-  with no AI trailer and no pull request, and the **publishing / release steps** below
-  are available.
-- **Contributor mode** — any other git identity. Then: do **not** commit directly to
-  the branch and do **not** run any release/publishing step. Make changes on a branch
-  and open a **pull request** for the maintainer to review. The "commit as Lauri
-  Ojansivu", "commit directly", and all release instructions below are **maintainer-only
-  and do not apply to you**.
-
-Everything below marked as maintainer-specific (committing directly, the exact commit
-author, and the entire "Making a release" / publishing flow) applies only in maintainer
-mode. The rest (translation policy, CHANGELOG structure, tests, validating from code) is
-good practice for everyone.
-
-## Process: "Fix open issues"
-
-When asked to fix an open issue (one issue at a time):
-
-1. **Read the whole issue** — the description AND all comments (e.g.
-   `gh issue view <n> --comments`, or the GitHub API `.../issues/<n>/comments`).
-2. **If it is a bug, first check whether it is already fixed** in the current WeKan
-   AND FerretDB source code (read the actual code, not just changelogs). It may have
-   been fixed already.
-3. **If it is NOT fixed yet, fix it**, using the newest documentation and issues of
-   the dependencies involved, checking where the newest MAINTAINED dependency lives and
-   reading its source and issues:
-   - Meteor 3 docs — https://docs.meteor.com/
-   - Meteor 3 source + issues — https://github.com/meteor/meteor/issues
-   - other Meteor software docs/code (e.g. Rocket.Chat) for how they solved it
-   - Meteor forums — https://forums.meteor.com
-   - AtmosphereJS — https://atmospherejs.com/ ; Packosphere — https://packosphere.com/
-   - Meteor Community Packages — https://github.com/meteor-community-packages
-   - Meteor-Files — https://github.com/veliovgroup/Meteor-Files
-   - npm — https://www.npmjs.com
-4. **After fixing, add tests** — unit tests, negative tests, and UI tests where
-   appropriate — and **run the new tests to verify they pass** (see Tests / the sandbox
-   build+test instructions in `docs/Security/Sandboxes/vscode/README.md`).
-5. **Commit** (maintainer only — when the current git user is `Lauri Ojansivu
-   <x@xet7.org>`), with no "Co-Authored" / AI trailer, a message body ending:
-
-   ```
-   Thanks to (GitHub nickname of the issue creator) and xet7 !
-
-   Fixes #1234,
-   ```
-6. **If the bug is already fixed**, still add a commit that CLOSES the issue (a commit
-   whose message ends `Fixes #1234,`), noting where/when it was fixed.
-
-Fix from source and test — do not guess. If the environment cannot run the relevant
-test (e.g. Docker is unavailable in this sandbox), reproduce as closely as possible
-from source and say clearly what was and was not verified.
-
-## Translations (Transifex ↔ direct LLM fill, no external service)
-
-WeKan translations live in `imports/i18n/data/<lang>.i18n.json` (flat
-`key -> string`, 2-space indent, key order matches `en.i18n.json`). Transifex holds
-the human translations. **The policy is: never overwrite a human translation with a
-filled (or English) one, but always take the newest translations from Transifex.**
-
-- Pull with `releases/translations/pull-translations.sh`. It runs `tx pull -a -f`
-  (which fills every string that is UNtranslated on Transifex with the English source)
-  and then a **per-key merge** (`releases/translations/merge-translations.mjs`) that,
-  for every language file and every key:
-  - Transifex has a real translation (pulled value differs from English) → **keep it**
-    (the newest human translation always wins);
-  - the pull reverted it to English but a human translation is committed in git →
-    **restore the committed translation** (a pull never reverts a human translation,
-    even in files that also received real new Transifex translations);
-  - **no translation anywhere** (untranslated on Transifex AND never committed) → leave
-    the English source as a placeholder. **This is the only case a non-human value is
-    used.** A separate fill step may fill *only* these English placeholders, so a filled
-    string can never overwrite a human translation.
-- Restored languages are pushed back to Transifex so they stop reverting.
-
-### Filling the remaining untranslated strings — directly, no translation service
-
-The strings still equal to the English source after the merge are the ones untranslated
-**everywhere** (Transifex + git). Translate these **directly** — the maintainer or the
-assistant (an LLM) writes the translation itself, using that language's **existing
-translations** and general **kanban terminology** for the language as the reference.
-**Do NOT wire up any external translation service, API, endpoint, key or password** — an
-earlier `machine-translate.mjs` that called LibreTranslate/DeepL is removed on purpose
-(it did not work and needed a password). There is **no `WEKAN_MT*` env var** anymore.
-
-- `node releases/translations/fill-translations.mjs --missing` — per-language count of
-  strings still needing translation (English + `en-*` variants are skipped: English by
-  design). Also printed at the end of `pull-translations.sh`.
-- `node releases/translations/fill-translations.mjs --list <lang> [--limit N]` — dump the
-  untranslated keys of a language as `{ key: englishSource }` for the translator to fill.
-- `node releases/translations/fill-translations.mjs --apply <lang> <translated.json>` —
-  merge the translations back. It writes **only** into placeholder keys, so it can
-  **never** overwrite a human translation, and a value still equal to English/empty is
-  ignored. Key order and 2-space indent are preserved.
-
-**Both directions are safe, and it is verified:**
-`node releases/translations/verify-human-preference.mjs` proves (pure-logic, no network)
-that the pull-merge keeps/restores human translations and that a fill only touches
-placeholders. Filled strings stay **local** — they are **NOT** pushed to Transifex (only
-the merge-restored human languages are pushed), so a filled string can never masquerade
-as human there. So: **only missing strings are ever filled, only when missing
-everywhere, human strings are always preferred and merged**, and nothing you fill is
-pushed to Transifex as if it were human.
-
-## General practices (from ../log/v10/Claude.txt)
-
-- **[maintainer only]** Commit as `Lauri Ojansivu <x@xet7.org>`, with **no**
-  "Co-Authored-By" or any other AI trailer, directly to the `main` branch of WeKan and
-  the `main-v1` branch of the FerretDB fork. **Do not make pull requests.** (Contributors
-  do the opposite: work on a branch and open a pull request — see the top section.)
-- Lauri Ojansivu (xet7) maintains WeKan (https://wekan.fi) and the FerretDB v1 fork.
-- Directory structure:
-  - `wekan` — this repo (https://github.com/wekan/wekan); see
-    `docs/DeveloperDocs/Directory-Structure.md`; `CHANGELOG.md` at root.
-  - `../w/wekan.fi` — the WeKan website.
-  - `FerretDB` subdirectory (when present) — https://github.com/wekan/FerretDB, its own
-    `CHANGELOG.md`. FerretDB `.go` files must contain **no** application-specific names
-    (say "the client" / "a Meteor 3 driver" / a bare `#NNNN`); its `CHANGELOG.md` may
-    use `wekan/wekan#NNNN`.
-  - `sandstorm` subdirectory (when present) — https://github.com/sandstorm-io/sandstorm.
-
-### CHANGELOG
-
-- During development, add entries under a new `# Upcoming WeKan ® release` section above
-  the newest release (FerretDB uses `## Upcoming FerretDB release`). Do **not** hand-edit
-  `package.json` or any other version reference — the release workflow bumps those.
-- **The file's shape, top to bottom** — keep it exactly as it is now:
-  1. `# Platforms` — the line `Newest WeKan at these platforms:` and the Install /
-     Upgrade / Docs / Mac ChangeLog bullets, then a `<details>` whose `<summary>` is
-     `Version` holding "which WeKan version uses what". There is no `# Version`
-     heading of its own.
-  2. `# TODO Later` — a `<details>` whose `<summary>` is `Carried to a future
-     release.` explaining the list, then one `<details>` per category (below).
-  3. The releases, newest first, each `# v<MAJOR>.<MINOR> YYYY-MM-DD WeKan ® release`.
-
-  Nothing else is an `#` heading. A `##`/`###` inside a release would break the
-  version list, and a wrapped line that BEGINS with `#` (e.g. an issue number such
-  as `#6514`) becomes a heading too — escape it `\#6514` or keep it off the line
-  start.
-- **A release's order of subsections** — CRITICAL SECURITY ISSUES first, then new
-  features, then the Admin Panel / UI reorganisation if there is one, then dependency
-  updates (`Thanks to dependabot.`), then bug fixes, then developer-facing changes,
-  documentation and translations. The section ends with the line `Thanks to above
-  GitHub users for their contributions and translators for their translations.`
-- **Every entry is a `<details>` block, and they are what a release is made of.**
-  The `<summary>` is the SHORT description of what was done and IS the link to the
-  commit — the hash lives in the `href` and is never on the page — followed by the
-  `Thanks to …` sentence. Clicking it reveals the long description:
-
-  ```
-  <details>
-  <summary><a href="https://github.com/wekan/wekan/commit/<hash>">Short description of
-  what was done</a>. Thanks to (issue creator's GitHub nickname) and xet7.</summary>
-
-  The long description: what was wrong, why, what it does now, what the test pins.
-  Word-wrapped at 80 characters, ordinary markdown - links, `code`, emphasis.
-
-  </details>
-  ```
-
-  Exactly as above: `<details>` and `</details>` each on their own line, the whole
-  `<summary>…</summary>` on ONE line, a blank line under it, the body, a blank line,
-  the close — and a blank line between two blocks.
-- **The summary is one line at a glance** — aim for ≤ 110 characters — and PLAIN text:
-  no `[text](url)`, no `**bold**`, no backticks inside `<summary>`, because a link
-  cannot nest inside the `<a>` and the rest renders literally. It ends with a full
-  stop, then `Thanks to …`. Every summary in a release links its own commit.
-- **A change with nothing more to say stays a plain bullet** —
-  `- [Short description](https://github.com/wekan/wekan/commit/<hash>). Thanks to xet7.`
-  — and a dependency batch keeps its `- **package 1.2.3 → 1.2.4** — one line on what
-  it is` bullets, closing with `Thanks to dependabot.` A `<details>` whose body only
-  repeats its summary is noise; use one when there IS a longer story to reveal, which
-  is most fixes.
-- **`# TODO Later` blocks are the same shape with two differences:** the `<summary>` is
-  the short category text (no `<a>`, because nothing was committed), and there is **no
-  `Thanks to`** — nothing is done yet, so there is nobody to thank. The body lists the
-  issues as `[#NNNN](https://github.com/wekan/wekan/issues/NNNN) (one-line reason)`.
-- **The hash is never the link text.** `[f1c89548e](…)` shows a hash to a reader who
-  cannot do anything with it; the link text says what changed. Same for `[merge
-  commit](…)` and for a bare URL — see the next rule.
-- **Never show a long URL as visible text.** A link is always
-  `[short text](url)` — an issue is `[#6524](…/issues/6524)`, an advisory is
-  `[GHSA-xxxx](…)`, a security page is `[ZipBleed](https://wekan.fi/hall-of-fame/zipbleed/)`.
-- **Subsection headers read as ONE flowing sentence.** The FIRST subsection of a release
-  starts with `This release ` (e.g. `This release fixes the following bugs:`); every LATER
-  subsection in the SAME release starts with a lowercase `and ` instead of repeating
-  `This release ` — e.g.
-  `This release fixes the following bugs:` … `and updates the following dependencies:` …
-  `and has the following developer-tooling fix:` … `and improves the translation workflow:`
-  … then the closing `Thanks to above GitHub users …` line. A release with only one
-  subsection just keeps its single `This release …:` header. Use `and adds the following
-  new features:`, `and fixes the following bugs:`, `and updates the following
-  dependencies:`, etc., matching the verb to the subsection.
-- **The Upcoming section opens with an `**In short:**` paragraph.** One paragraph,
-  right under the `# Upcoming WeKan ® release` line and above the first
-  `This release …:` header, saying what the whole release amounts to — the areas
-  that changed and what changed about them, with the notable names in `**bold**`
-  so it can be skimmed. It is a SUMMARY, not a list: it does not link commits, it
-  does not repeat an entry's wording, and it ends by accounting for the rest in a
-  clause (`Below that: dependency updates, nine bug fixes … and the usual
-  documentation and translation work.`). Keep it current as entries are added —
-  it is the first thing a reader sees, so a stale one misdescribes the release.
-  A finished release keeps the paragraph it was written with.
-- **Under the summary comes the BINARIES TABLE: what each platform ships.** So the
-  top of a release section is, in order, (1) the `**In short:**` paragraph and
-  (2) this table, and only then the `This release …:` subsections. A WeKan bundle
-  is not only WeKan — it carries a Node.js, a FerretDB and the MongoDB Database
-  Tools that other projects publish, and WHICH source has a given CPU changes
-  from release to release: nodejs.org builds some architectures,
-  unofficial-builds others, and [wekan/node-patches](https://github.com/wekan/node-patches)
-  the ones neither of them does. "Which Node.js is in the arm64 bundle of 10.69,
-  and was it checked" must be answerable from the CHANGELOG, not from a build log
-  that expires.
-
-  ```
-  | Platform | Binary | From | Version | SHA256 |
-  | --- | --- | --- | --- | --- |
-  | amd64 | Node.js | [nodejs.org](https://nodejs.org/dist/v24.19.0/node-v24.19.0-linux-x64.tar.xz) | v24.19.0 | `a1b2…` |
-  | amd64 | FerretDB | [wekan/FerretDB](https://github.com/wekan/FerretDB/releases/download/v1.24.0/ferretdb-amd64) | v1.24.0 | `c3d4…` |
-  | arm64 | Node.js | [nodejs.org](https://nodejs.org/dist/v24.19.0/node-v24.19.0-linux-arm64.tar.xz) | v24.19.0 | `e5f6…` |
-  ```
-
-  **GROUPED BY PLATFORM**: rows are sorted by platform and then by binary, so one
-  platform's binaries stay together and the table is read a platform at a time.
-  The URL is the LINK ON THE "From" CELL — never a bare URL as visible text, the
-  same rule as everywhere else — and it is the exact file that was downloaded, not
-  the project's front page. The SHA256 is the checksum the source published and the
-  build verified, in backticks; a source that publishes none says *no checksum
-  published*, which is not a failed check but a source worth fixing. Table rows
-  carry links, so the 80-character wrap does not apply to them.
-
-  It is the same table `releases/provenance-table.sh` puts at the top of the GitHub
-  release notes, from the `provenance.tsv` rows each build job records — so the two
-  are filled from the same data and cannot disagree. **A platform that was NOT built
-  has no rows**, which is how the table also answers "why is there no i386 bundle
-  this time": no source published a Node.js for it (see
-  `releases/resolve-node-source.sh`).
-- **Inside a subsection, entries are GROUPED BY AREA.** A release touches a handful
-  of areas and repeating the area's name in every summary is the noise this
-  removes — twelve entries that each begin "All Boards:" say "All Boards" twelve
-  times and the part that differs starts halfway through the line. Instead the area
-  is named ONCE, as a bold line with a short description of what the group covers,
-  and every entry under it drops the prefix:
-
-  ```
-  and fixes the following bugs:
-
-  **The first header bar** - how it lays itself out, and what sits under it.
-
-  <details>
-  <summary><a href="…">It fills each row before starting the next one</a>. Thanks to xet7.</summary>
-  …
-  </details>
-
-  <details>
-  <summary><a href="…">It wraps to a second row instead of hiding the buttons that do not fit</a>. Thanks to xet7.</summary>
-  …
-  </details>
-
-  **All Boards** - the overview and its search.
-
-  <details>
-  …
-  ```
-
-  The group line is `**Area** - short description.` on ONE line, wrapped at 80 like
-  everything else, with a blank line under it. It is NOT a heading: a `##` inside a
-  release breaks the version list (see above). Group labels are the areas of the
-  app — `All Boards`, `The first header bar`, `The left menus`, `The Admin Panel`,
-  `Board views`, `Public Boards`, `Member Settings`, `Board roles` — and the same
-  label is reused across subsections when an area has both a feature and a fix.
-  EVERY entry of a grouped subsection belongs to a group, including a group with
-  one entry: a section that is half grouped and half loose reads as a mistake. A
-  subsection with only one entry, and the dependency bullets, stay flat.
-- **CRITICAL security header — match the previous releases' wording.** A security release
-  leads with `This release fixes the following CRITICAL SECURITY ISSUE of
-  [Name](https://wekan.fi/hall-of-fame/namebleed/):` for a single named *Bleed, or
-  `This release fixes the following CRITICAL SECURITY ISSUES:` for several — NOT
-  `CRITICAL VULNERABILITIES`. Each security bullet still links its own
-  `https://wekan.fi/hall-of-fame/...bleed/`. CodeQL-only releases use the established
-  `This release fixes the following SECURITY ISSUES found by GitHub CodeQL code scanning:`.
-  Because CRITICAL comes first, it keeps the `This release ` prefix; a following non-security
-  subsection becomes `and …` per the rule above.
-- **`# TODO Later` section** — a triage backlog near the TOP of `CHANGELOG.md` (above the
-  version sections), for open issues that were **investigated but not fixed here**, each
-  recorded with a concrete REASON so whoever picks it up next knows why. Use it when working
-  through open issues (the "Fix open issues" process): for each issue, either **fix it** (commit
-  ending `Fixes #NNNN,`), **close it** if already fixed in current code (commit `Close #NNNN` /
-  `Fixes #NNNN,`), or — when it can't be fixed/verified in this environment — **add it to `TODO
-  Later` under the matching category with the reason**. Group issues by category bullet, e.g.:
-  *Need specific infrastructure / a running server stack* (LDAP/WebHooks/Sandstorm/proxy —
-  environment owners), *Need the running app to reproduce/verify* (runtime UI / publication /
-  mergebox / router state, not unit-testable), *Already correct in the current code* (verified by
-  reading; could not reproduce), *Feature requests / behaviour-by-design rather than bugs*, and
-  *Needs a maintainer decision on the intended contract*. Each category is a `<details>`
-  whose `<summary>` is the SHORT category text and whose body lists the issues with their
-  reasons — and with **no `Thanks to` line**, because nothing is done yet, so there is
-  nobody to thank. Each entry is a normal issue link
-  `[#NNNN](https://github.com/wekan/wekan/issues/NNNN) (one-line reason)` — issue links here, NOT
-  commit links (nothing was committed). **Keep it current:** when an issue in `TODO Later` gets
-  fixed, REMOVE it from the list (its fix commit's `Fixes #NNNN` closes it); do not leave fixed
-  issues in the backlog. This is the only CHANGELOG place that uses issue links and lives above
-  the releases; everything else uses the per-release commit-link bullets above.
-- FerretDB Upcoming structure — `### New Features 🎉`, `### Fixed 🐛`, `### Other Changes
-  🤖`; entries end `... by @xet7. Thanks to xet7.`
-- Word-wrap both CHANGELOGs at 80 chars, but never break a long link across lines (a
-  `<summary>` line, or any other line carrying a link, may be longer). Continuation
-  lines of a plain bullet are indented by two spaces.
-
-### Commit message structure
-
-```
-Do something.
-
-Thanks to (original creator of issue) and xet7 !
-
-Fixes #1234,
-Fixes #1235.
-```
-
-### Making a release — no version number needed  **[maintainer only]**
-
-All publishing / release steps below are maintainer-only. Contributors never run them.
-
-- WeKan: run `./releases/release-all.sh` (no arguments). It renames
-  `# Upcoming WeKan ® release` to the next version (same increment as the last release;
-  9.99 → 10.00) dated today, commits + pushes, and triggers
-  `.github/workflows/release-all.yml` (its `bump` job bumps `package.json` and every
-  version reference, then the release jobs tag `v<new>` and publish the GitHub Release).
-  An explicit `oldversion newversion` pair still overrides. Adding entries under Upcoming
-  is the only hand step.
-- FerretDB: run `./build.sh release-ferretdb` from the `FerretDB` subdirectory (no
-  version). It renames `## Upcoming FerretDB release` to the next version with the
-  correct git-tag link, commits + tags + pushes, then triggers `release-all.yml` (which
-  in turn triggers `docker.yml` for the multi-arch image). It refuses to re-release an
-  already-tagged version.
-
-### Security issues
-
-- Fix the vulnerability, add a CRITICAL section to the WeKan CHANGELOG like previous
-  entries, and update `../w/wekan.fi/hall-of-fame/index.html` and the vuln-name
-  subdirectory `index.html` like previous security issues.
-- **A Hall of Fame row has EIGHT cells**, in this order: CVE, Icon, Vulnerability
-  name, Date, Responsible Security Disclosure by, Stars, Process, Vulnerabilities.
-  One thing per cell — the name without its icons, the Font Awesome icons alone in
-  Icon (still wrapped in `<h2>`), the reporter alone in "by", the `GoldStar.png`
-  images alone in Stars, and the sentence about how the report arrived (coordinated
-  disclosure, GitHub advisory, code scanning, found while reviewing …) in Process.
-  In "by", the reporter's NICKNAME is the link —
-  `<b><a href="https://github.com/nick">nick</a></b>`, never the name followed by a
-  separate "(GitHub)" link. **Check the account exists before linking it** (a 404 or,
-  worse, somebody else's profile is the failure here); a real name, a company or a
-  tool such as GitHub CodeQL is not a GitHub user and stays plain text. Do not write
-  a role note after a name — no `(fix)`, `(found)` or `(found and fix)`: this column
-  is the credit, and the Process cell beside it already says how the report arrived.
-  Stars is a column so it can be compared down the page; do not put a star, an icon
-  or the process sentence back into another cell. A page-local `<style>` in
-  `index.html` keeps a row's stars on ONE line from 900px up (they are a count) and
-  sizes them at 24px, and keeps the icon and its red drop on one line at every width
-  (they are one icon) — the table itself stays percentage-sized with no fixed or
-  minimum width, so it fills the page at every browser width.
-- **On the Hall of Fame index page, the Process and Vulnerabilities cells are
-  collapsed.** Those two columns carry the prose — how the report arrived, and the
-  whole story of the vulnerability — so the page would be one wall of text and the
-  columns that identify a row (CVE, name, date, reporter, stars) would be far apart.
-  In `hall-of-fame/index.html`, and ONLY in those two `<td>`s, the cell's content
-  sits inside a `<details>` whose summary is the column's own name — `Process` for
-  the Process cell, `Details` for the Vulnerabilities cell:
-
-  ```
-  <td valign="top">
-    <details>
-    <summary>Details</summary>
-
-    <ul>
-      <li>… the same list as before …</li>
-    </ul>
-    </details>
-  </td>
-  ```
-
-  The summary is that plain word, there is a blank line under it, and the cell's
-  contents are otherwise unchanged. The other six cells of the row stay as they are
-  — they are what a reader scans — and so does the header row.
-- **The vuln-name subdirectory page is NOT collapsed.** `hall-of-fame/<name>bleed/index.html`
-  is the page a reader opened on purpose, for one vulnerability: its table cell stays
-  open and its `<h2 class="hof">Details</h2>` prose section below the table stays as
-  it is. Only the index, which lists them all, hides them behind the summary.
-
-### Tests
-
-- `build.sh` / `build.bat` have a menu to install dependencies, build
-  WeKan and run tests.
-- Add tests, negative tests and UI tests for all new features and fixes that do not yet
-  have tests. When adding a test, run or validate it and fix it until it works.
-- **"Check newest test logs":** test logs go into a `log/<datetime>/` directory,
-  one per run (e.g. `2026-07-21_20-58-09/`). That is **`../log/`**, one level up
-  from the repo, so a run does not show up in `git status` - **unless the parent
-  is not writable**, as in a Flatpak sandbox that shares only the repository;
-  there it is **`./log/`** inside the repo (gitignored). `build.sh` prints which
-  one when a run starts. The
-  newest datetime directory is the latest run. Each holds the Playwright per-browser
-  logs (`wekan-alltests-chromium.log`, `-firefox.log`, `-webkit.log`), the mocha/unit
-  log (`wekan-alltests-mocha.log`), the e2e/import logs, and `wekan-test-server.log`
-  (the WeKan test server + database output). A whole-run directory also holds the
-  database-conformance logs (`db-conformance-*.log`, `-report.md`, `-summary.txt`)
-  and FerretDB's own (`ferretdb-unit.log`, `-vet.log`, `-integration.log`). "Check
-  the newest test logs" means: open the most recent `log/<datetime>/` - look in
-  `../log/` first, then `./log/` - and read those.
-- **Check and fix WHILE the tests are still running.** A full run takes a long time
-  (three browsers, then every database with an image for this CPU, then FerretDB's
-  own suites), and its stages finish one at a time. Do not wait for the end: read
-  the logs that are already written, fix what they show, and then look again for the
-  stages that have finished since — repeat until every stage has run and everything
-  found is fixed. Two things make this work:
-  - A stage's log file is complete when its `===== ... finished` line is there; a
-    file whose mtime is still moving is a stage in progress, and its failures so far
-    are already real and worth fixing.
-  - The node suites are run by `tests/run-node-suites.cjs`, which runs ALL of them
-    and lists every failure at the end (`===== node suites: N run, M failed`). They
-    are the fastest signal - about 15 seconds for 260 suites - so they are usually
-    what to fix first while the browsers are still going.
-- **A failing guard is not automatically a broken app.** Most of these suites read
-  the source and pin a behaviour. When one fails, decide which side is wrong: fix
-  the CODE when the guard still describes what WeKan should do, and fix the GUARD
-  when the behaviour deliberately changed - and then say in the test WHY, so the
-  next reader knows it was a decision and not a slip. Every fixed test keeps the
-  assertion that made it valuable; do not delete a test to make a run green.
-
-## Environment
-
-- The editor (VSCode) runs inside a **Flatpak sandbox**, launched by
-  `docs/Security/Sandboxes/vscode/vscode-sandbox.sh`. What the sandbox allows/blocks and
-  how it is set up is documented in `docs/Security/Sandboxes/vscode/README.md` in that
-  same directory — read it when something behaves differently than a normal host (file
-  access, network, running services).
-
-### Always validate from the actual code
-
-- When doing anything, check how it actually works in the code first.

CLAUDE.md

@@ -1,458 +0,0 @@
-# CLAUDE.md — instructions Claude reads first
-
-Claude Code reads this file at the repo root before doing work here. Follow it.
-
-## First: are you the maintainer or a contributor?
-
-Check the current git identity before committing or releasing:
-
-```
-git config user.name && git config user.email
-```
-
-- **Maintainer mode** — ONLY when the identity is exactly
-  `Lauri Ojansivu <x@xet7.org>` (name `Lauri Ojansivu`, email `x@xet7.org`). Then, and
-  only then: commit **directly to the current branch** as `Lauri Ojansivu <x@xet7.org>`
-  with no AI trailer and no pull request, and the **publishing / release steps** below
-  are available.
-- **Contributor mode** — any other git identity. Then: do **not** commit directly to
-  the branch and do **not** run any release/publishing step. Make changes on a branch
-  and open a **pull request** for the maintainer to review. The "commit as Lauri
-  Ojansivu", "commit directly", and all release instructions below are **maintainer-only
-  and do not apply to you**.
-
-Everything below marked as maintainer-specific (committing directly, the exact commit
-author, and the entire "Making a release" / publishing flow) applies only in maintainer
-mode. The rest (translation policy, CHANGELOG structure, tests, validating from code) is
-good practice for everyone.
-
-## Process: "Fix open issues"
-
-When asked to fix an open issue (one issue at a time):
-
-1. **Read the whole issue** — the description AND all comments (e.g.
-   `gh issue view <n> --comments`, or the GitHub API `.../issues/<n>/comments`).
-2. **If it is a bug, first check whether it is already fixed** in the current WeKan
-   AND FerretDB source code (read the actual code, not just changelogs). It may have
-   been fixed already.
-3. **If it is NOT fixed yet, fix it**, using the newest documentation and issues of
-   the dependencies involved, checking where the newest MAINTAINED dependency lives and
-   reading its source and issues:
-   - Meteor 3 docs — https://docs.meteor.com/
-   - Meteor 3 source + issues — https://github.com/meteor/meteor/issues
-   - other Meteor software docs/code (e.g. Rocket.Chat) for how they solved it
-   - Meteor forums — https://forums.meteor.com
-   - AtmosphereJS — https://atmospherejs.com/ ; Packosphere — https://packosphere.com/
-   - Meteor Community Packages — https://github.com/meteor-community-packages
-   - Meteor-Files — https://github.com/veliovgroup/Meteor-Files
-   - npm — https://www.npmjs.com
-4. **After fixing, add tests** — unit tests, negative tests, and UI tests where
-   appropriate — and **run the new tests to verify they pass** (see Tests / the sandbox
-   build+test instructions in `docs/Security/Sandboxes/vscode/README.md`).
-5. **Commit** (maintainer only — when the current git user is `Lauri Ojansivu
-   <x@xet7.org>`), with no "Co-Authored" / AI trailer, a message body ending:
-
-   ```
-   Thanks to (GitHub nickname of the issue creator) and xet7 !
-
-   Fixes #1234,
-   ```
-6. **If the bug is already fixed**, still add a commit that CLOSES the issue (a commit
-   whose message ends `Fixes #1234,`), noting where/when it was fixed.
-
-Fix from source and test — do not guess. If the environment cannot run the relevant
-test (e.g. Docker is unavailable in this sandbox), reproduce as closely as possible
-from source and say clearly what was and was not verified.
-
-## Translations (Transifex ↔ direct LLM fill, no external service)
-
-WeKan translations live in `imports/i18n/data/<lang>.i18n.json` (flat
-`key -> string`, 2-space indent, key order matches `en.i18n.json`). Transifex holds
-the human translations. **The policy is: never overwrite a human translation with a
-filled (or English) one, but always take the newest translations from Transifex.**
-
-- Pull with `releases/translations/pull-translations.sh`. It runs `tx pull -a -f`
-  (which fills every string that is UNtranslated on Transifex with the English source)
-  and then a **per-key merge** (`releases/translations/merge-translations.mjs`) that,
-  for every language file and every key:
-  - Transifex has a real translation (pulled value differs from English) → **keep it**
-    (the newest human translation always wins);
-  - the pull reverted it to English but a human translation is committed in git →
-    **restore the committed translation** (a pull never reverts a human translation,
-    even in files that also received real new Transifex translations);
-  - **no translation anywhere** (untranslated on Transifex AND never committed) → leave
-    the English source as a placeholder. **This is the only case a non-human value is
-    used.** A separate fill step may fill *only* these English placeholders, so a filled
-    string can never overwrite a human translation.
-- Restored languages are pushed back to Transifex so they stop reverting.
-
-### Filling the remaining untranslated strings — directly, no translation service
-
-The strings still equal to the English source after the merge are the ones untranslated
-**everywhere** (Transifex + git). Translate these **directly** — the maintainer or the
-assistant (an LLM) writes the translation itself, using that language's **existing
-translations** and general **kanban terminology** for the language as the reference.
-**Do NOT wire up any external translation service, API, endpoint, key or password** — an
-earlier `machine-translate.mjs` that called LibreTranslate/DeepL is removed on purpose
-(it did not work and needed a password). There is **no `WEKAN_MT*` env var** anymore.
-
-- `node releases/translations/fill-translations.mjs --missing` — per-language count of
-  strings still needing translation (English + `en-*` variants are skipped: English by
-  design). Also printed at the end of `pull-translations.sh`.
-- `node releases/translations/fill-translations.mjs --list <lang> [--limit N]` — dump the
-  untranslated keys of a language as `{ key: englishSource }` for the translator to fill.
-- `node releases/translations/fill-translations.mjs --apply <lang> <translated.json>` —
-  merge the translations back. It writes **only** into placeholder keys, so it can
-  **never** overwrite a human translation, and a value still equal to English/empty is
-  ignored. Key order and 2-space indent are preserved.
-
-**Both directions are safe, and it is verified:**
-`node releases/translations/verify-human-preference.mjs` proves (pure-logic, no network)
-that the pull-merge keeps/restores human translations and that a fill only touches
-placeholders. Filled strings stay **local** — they are **NOT** pushed to Transifex (only
-the merge-restored human languages are pushed), so a filled string can never masquerade
-as human there. So: **only missing strings are ever filled, only when missing
-everywhere, human strings are always preferred and merged**, and nothing you fill is
-pushed to Transifex as if it were human.
-
-## General practices (from ../log/v10/Claude.txt)
-
-- **[maintainer only]** Commit as `Lauri Ojansivu <x@xet7.org>`, with **no**
-  "Co-Authored-By" or any other AI trailer, directly to the `main` branch of WeKan and
-  the `main-v1` branch of the FerretDB fork. **Do not make pull requests.** (Contributors
-  do the opposite: work on a branch and open a pull request — see the top section.)
-- Lauri Ojansivu (xet7) maintains WeKan (https://wekan.fi) and the FerretDB v1 fork.
-- Directory structure:
-  - `wekan` — this repo (https://github.com/wekan/wekan); see
-    `docs/DeveloperDocs/Directory-Structure.md`; `CHANGELOG.md` at root.
-  - `../w/wekan.fi` — the WeKan website.
-  - `.tools/` — companion repos cloned INSIDE this checkout, in one directory
-    that `.gitignore` and `.meteorignore` already exclude (they used to be one
-    ignored subdirectory each at the repo root). `build.sh`'s `ensure_tool_repo`
-    clones one on demand, so a fresh checkout needs no manual setup:
-    `.tools/FerretDB`, `.tools/node-patches`, `.tools/mongo-tools-patches`.
-  - `.tools/FerretDB` (cloned on demand) — https://github.com/wekan/FerretDB, its own
-    `CHANGELOG.md`. FerretDB `.go` files must contain **no** application-specific names
-    (say "the client" / "a Meteor 3 driver" / a bare `#NNNN`); its `CHANGELOG.md` may
-    use `wekan/wekan#NNNN`.
-  - `.tools/sandstorm` (when present) — https://github.com/sandstorm-io/sandstorm.
-
-### CHANGELOG
-
-- During development, add entries under a new `# Upcoming WeKan ® release` section above
-  the newest release (FerretDB uses `## Upcoming FerretDB release`). Do **not** hand-edit
-  `package.json` or any other version reference — the release workflow bumps those.
-- **The file's shape, top to bottom** — keep it exactly as it is now:
-  1. `# Platforms` — the line `Newest WeKan at these platforms:` and the Install /
-     Upgrade / Docs / Mac ChangeLog bullets, then a `<details>` whose `<summary>` is
-     `Version` holding "which WeKan version uses what". There is no `# Version`
-     heading of its own.
-  2. `# TODO Later` — a `<details>` whose `<summary>` is `Carried to a future
-     release.` explaining the list, then one `<details>` per category (below).
-  3. The releases, newest first, each `# v<MAJOR>.<MINOR> YYYY-MM-DD WeKan ® release`.
-
-  Nothing else is an `#` heading. A `##`/`###` inside a release would break the
-  version list, and a wrapped line that BEGINS with `#` (e.g. an issue number such
-  as `#6514`) becomes a heading too — escape it `\#6514` or keep it off the line
-  start.
-- **A release's order of subsections** — CRITICAL SECURITY ISSUES first, then new
-  features, then the Admin Panel / UI reorganisation if there is one, then dependency
-  updates (`Thanks to dependabot.`), then bug fixes, then developer-facing changes,
-  documentation and translations. The section ends with the line `Thanks to above
-  GitHub users for their contributions and translators for their translations.`
-- **Every entry is a `<details>` block, and they are what a release is made of.**
-  The `<summary>` is the SHORT description of what was done and IS the link to the
-  commit — the hash lives in the `href` and is never on the page — followed by the
-  `Thanks to …` sentence. Clicking it reveals the long description:
-
-  ```
-  <details>
-  <summary><a href="https://github.com/wekan/wekan/commit/<hash>">Short description of
-  what was done</a>. Thanks to (issue creator's GitHub nickname) and xet7.</summary>
-
-  The long description: what was wrong, why, what it does now, what the test pins.
-  Word-wrapped at 80 characters, ordinary markdown - links, `code`, emphasis.
-
-  </details>
-  ```
-
-  Exactly as above: `<details>` and `</details>` each on their own line, the whole
-  `<summary>…</summary>` on ONE line, a blank line under it, the body, a blank line,
-  the close — and a blank line between two blocks.
-- **The summary is one line at a glance** — aim for ≤ 110 characters — and PLAIN text:
-  no `[text](url)`, no `**bold**`, no backticks inside `<summary>`, because a link
-  cannot nest inside the `<a>` and the rest renders literally. It ends with a full
-  stop, then `Thanks to …`. Every summary in a release links its own commit.
-- **A change with nothing more to say stays a plain bullet** —
-  `- [Short description](https://github.com/wekan/wekan/commit/<hash>). Thanks to xet7.`
-  — and a dependency batch keeps its `- **package 1.2.3 → 1.2.4** — one line on what
-  it is` bullets, closing with `Thanks to dependabot.` A `<details>` whose body only
-  repeats its summary is noise; use one when there IS a longer story to reveal, which
-  is most fixes.
-- **`# TODO Later` blocks are the same shape with two differences:** the `<summary>` is
-  the short category text (no `<a>`, because nothing was committed), and there is **no
-  `Thanks to`** — nothing is done yet, so there is nobody to thank. The body lists the
-  issues as `[#NNNN](https://github.com/wekan/wekan/issues/NNNN) (one-line reason)`.
-- **The hash is never the link text.** `[f1c89548e](…)` shows a hash to a reader who
-  cannot do anything with it; the link text says what changed. Same for `[merge
-  commit](…)` and for a bare URL — see the next rule.
-- **Never show a long URL as visible text.** A link is always
-  `[short text](url)` — an issue is `[#6524](…/issues/6524)`, an advisory is
-  `[GHSA-xxxx](…)`, a security page is `[ZipBleed](https://wekan.fi/hall-of-fame/zipbleed/)`.
-- **Subsection headers read as ONE flowing sentence.** The FIRST subsection of a release
-  starts with `This release ` (e.g. `This release fixes the following bugs:`); every LATER
-  subsection in the SAME release starts with a lowercase `and ` instead of repeating
-  `This release ` — e.g.
-  `This release fixes the following bugs:` … `and updates the following dependencies:` …
-  `and has the following developer-tooling fix:` … `and improves the translation workflow:`
-  … then the closing `Thanks to above GitHub users …` line. A release with only one
-  subsection just keeps its single `This release …:` header. Use `and adds the following
-  new features:`, `and fixes the following bugs:`, `and updates the following
-  dependencies:`, etc., matching the verb to the subsection.
-- **The Upcoming section opens with an `**In short:**` paragraph.** One paragraph,
-  right under the `# Upcoming WeKan ® release` line and above the first
-  `This release …:` header, saying what the whole release amounts to — the areas
-  that changed and what changed about them, with the notable names in `**bold**`
-  so it can be skimmed. It is a SUMMARY, not a list: it does not link commits, it
-  does not repeat an entry's wording, and it ends by accounting for the rest in a
-  clause (`Below that: dependency updates, nine bug fixes … and the usual
-  documentation and translation work.`). Keep it current as entries are added —
-  it is the first thing a reader sees, so a stale one misdescribes the release.
-  A finished release keeps the paragraph it was written with.
-- **Under the summary comes the BINARIES TABLE: what each platform ships.** So the
-  top of a release section is, in order, (1) the `**In short:**` paragraph and
-  (2) this table, and only then the `This release …:` subsections. A WeKan bundle
-  is not only WeKan — it carries a Node.js, a FerretDB and the MongoDB Database
-  Tools that other projects publish, and WHICH source has a given CPU changes
-  from release to release: nodejs.org builds some architectures,
-  unofficial-builds others, and [wekan/node-patches](https://github.com/wekan/node-patches)
-  the ones neither of them does. "Which Node.js is in the arm64 bundle of 10.69,
-  and was it checked" must be answerable from the CHANGELOG, not from a build log
-  that expires.
-
-  ```
-  | Platform | Binary | From | Version | SHA256 |
-  | --- | --- | --- | --- | --- |
-  | amd64 | Node.js | [nodejs.org](https://nodejs.org/dist/v24.19.0/node-v24.19.0-linux-x64.tar.xz) | v24.19.0 | `a1b2…` |
-  | amd64 | FerretDB | [wekan/FerretDB](https://github.com/wekan/FerretDB/releases/download/v1.24.0/ferretdb-amd64) | v1.24.0 | `c3d4…` |
-  | arm64 | Node.js | [nodejs.org](https://nodejs.org/dist/v24.19.0/node-v24.19.0-linux-arm64.tar.xz) | v24.19.0 | `e5f6…` |
-  ```
-
-  **GROUPED BY PLATFORM**: rows are sorted by platform and then by binary, so one
-  platform's binaries stay together and the table is read a platform at a time.
-  The URL is the LINK ON THE "From" CELL — never a bare URL as visible text, the
-  same rule as everywhere else — and it is the exact file that was downloaded, not
-  the project's front page. The SHA256 is the checksum the source published and the
-  build verified, in backticks; a source that publishes none says *no checksum
-  published*, which is not a failed check but a source worth fixing. Table rows
-  carry links, so the 80-character wrap does not apply to them.
-
-  It is the same table `releases/provenance-table.sh` puts at the top of the GitHub
-  release notes, from the `provenance.tsv` rows each build job records — so the two
-  are filled from the same data and cannot disagree. **A platform that was NOT built
-  has no rows**, which is how the table also answers "why is there no i386 bundle
-  this time": no source published a Node.js for it (see
-  `releases/resolve-node-source.sh`).
-- **Inside a subsection, entries are GROUPED BY AREA.** A release touches a handful
-  of areas and repeating the area's name in every summary is the noise this
-  removes — twelve entries that each begin "All Boards:" say "All Boards" twelve
-  times and the part that differs starts halfway through the line. Instead the area
-  is named ONCE, as a bold line with a short description of what the group covers,
-  and every entry under it drops the prefix:
-
-  ```
-  and fixes the following bugs:
-
-  **The first header bar** - how it lays itself out, and what sits under it.
-
-  <details>
-  <summary><a href="…">It fills each row before starting the next one</a>. Thanks to xet7.</summary>
-  …
-  </details>
-
-  <details>
-  <summary><a href="…">It wraps to a second row instead of hiding the buttons that do not fit</a>. Thanks to xet7.</summary>
-  …
-  </details>
-
-  **All Boards** - the overview and its search.
-
-  <details>
-  …
-  ```
-
-  The group line is `**Area** - short description.` on ONE line, wrapped at 80 like
-  everything else, with a blank line under it. It is NOT a heading: a `##` inside a
-  release breaks the version list (see above). Group labels are the areas of the
-  app — `All Boards`, `The first header bar`, `The left menus`, `The Admin Panel`,
-  `Board views`, `Public Boards`, `Member Settings`, `Board roles` — and the same
-  label is reused across subsections when an area has both a feature and a fix.
-  EVERY entry of a grouped subsection belongs to a group, including a group with
-  one entry: a section that is half grouped and half loose reads as a mistake. A
-  subsection with only one entry, and the dependency bullets, stay flat.
-- **CRITICAL security header — match the previous releases' wording.** A security release
-  leads with `This release fixes the following CRITICAL SECURITY ISSUE of
-  [Name](https://wekan.fi/hall-of-fame/namebleed/):` for a single named *Bleed, or
-  `This release fixes the following CRITICAL SECURITY ISSUES:` for several — NOT
-  `CRITICAL VULNERABILITIES`. Each security bullet still links its own
-  `https://wekan.fi/hall-of-fame/...bleed/`. CodeQL-only releases use the established
-  `This release fixes the following SECURITY ISSUES found by GitHub CodeQL code scanning:`.
-  Because CRITICAL comes first, it keeps the `This release ` prefix; a following non-security
-  subsection becomes `and …` per the rule above.
-- **`# TODO Later` section** — a triage backlog near the TOP of `CHANGELOG.md` (above the
-  version sections), for open issues that were **investigated but not fixed here**, each
-  recorded with a concrete REASON so whoever picks it up next knows why. Use it when working
-  through open issues (the "Fix open issues" process): for each issue, either **fix it** (commit
-  ending `Fixes #NNNN,`), **close it** if already fixed in current code (commit `Close #NNNN` /
-  `Fixes #NNNN,`), or — when it can't be fixed/verified in this environment — **add it to `TODO
-  Later` under the matching category with the reason**. Group issues by category bullet, e.g.:
-  *Need specific infrastructure / a running server stack* (LDAP/WebHooks/Sandstorm/proxy —
-  environment owners), *Need the running app to reproduce/verify* (runtime UI / publication /
-  mergebox / router state, not unit-testable), *Already correct in the current code* (verified by
-  reading; could not reproduce), *Feature requests / behaviour-by-design rather than bugs*, and
-  *Needs a maintainer decision on the intended contract*. Each category is a `<details>`
-  whose `<summary>` is the SHORT category text and whose body lists the issues with their
-  reasons — and with **no `Thanks to` line**, because nothing is done yet, so there is
-  nobody to thank. Each entry is a normal issue link
-  `[#NNNN](https://github.com/wekan/wekan/issues/NNNN) (one-line reason)` — issue links here, NOT
-  commit links (nothing was committed). **Keep it current:** when an issue in `TODO Later` gets
-  fixed, REMOVE it from the list (its fix commit's `Fixes #NNNN` closes it); do not leave fixed
-  issues in the backlog. This is the only CHANGELOG place that uses issue links and lives above
-  the releases; everything else uses the per-release commit-link bullets above.
-- FerretDB Upcoming structure — `### New Features 🎉`, `### Fixed 🐛`, `### Other Changes
-  🤖`; entries end `... by @xet7. Thanks to xet7.`
-- Word-wrap both CHANGELOGs at 80 chars, but never break a long link across lines (a
-  `<summary>` line, or any other line carrying a link, may be longer). Continuation
-  lines of a plain bullet are indented by two spaces.
-
-### Commit message structure
-
-```
-Do something.
-
-Thanks to (original creator of issue) and xet7 !
-
-Fixes #1234,
-Fixes #1235.
-```
-
-### Making a release — no version number needed  **[maintainer only]**
-
-All publishing / release steps below are maintainer-only. Contributors never run them.
-
-- WeKan: run `./releases/release-all.sh` (no arguments). It renames
-  `# Upcoming WeKan ® release` to the next version (same increment as the last release;
-  9.99 → 10.00) dated today, commits + pushes, and triggers
-  `.github/workflows/release-all.yml` (its `bump` job bumps `package.json` and every
-  version reference, then the release jobs tag `v<new>` and publish the GitHub Release).
-  An explicit `oldversion newversion` pair still overrides. Adding entries under Upcoming
-  is the only hand step.
-- FerretDB: run `./build.sh release-ferretdb` from `.tools/FerretDB` (no
-  version). It renames `## Upcoming FerretDB release` to the next version with the
-  correct git-tag link, commits + tags + pushes, then triggers `release-all.yml` (which
-  in turn triggers `docker.yml` for the multi-arch image). It refuses to re-release an
-  already-tagged version.
-
-### Security issues
-
-- Fix the vulnerability, add a CRITICAL section to the WeKan CHANGELOG like previous
-  entries, and update `../w/wekan.fi/hall-of-fame/index.html` and the vuln-name
-  subdirectory `index.html` like previous security issues.
-- **A Hall of Fame row has EIGHT cells**, in this order: CVE, Icon, Vulnerability
-  name, Date, Responsible Security Disclosure by, Stars, Process, Vulnerabilities.
-  One thing per cell — the name without its icons, the Font Awesome icons alone in
-  Icon (still wrapped in `<h2>`), the reporter alone in "by", the `GoldStar.png`
-  images alone in Stars, and the sentence about how the report arrived (coordinated
-  disclosure, GitHub advisory, code scanning, found while reviewing …) in Process.
-  In "by", the reporter's NICKNAME is the link —
-  `<b><a href="https://github.com/nick">nick</a></b>`, never the name followed by a
-  separate "(GitHub)" link. **Check the account exists before linking it** (a 404 or,
-  worse, somebody else's profile is the failure here); a real name, a company or a
-  tool such as GitHub CodeQL is not a GitHub user and stays plain text. Do not write
-  a role note after a name — no `(fix)`, `(found)` or `(found and fix)`: this column
-  is the credit, and the Process cell beside it already says how the report arrived.
-  Stars is a column so it can be compared down the page; do not put a star, an icon
-  or the process sentence back into another cell. A page-local `<style>` in
-  `index.html` keeps a row's stars on ONE line from 900px up (they are a count) and
-  sizes them at 24px, and keeps the icon and its red drop on one line at every width
-  (they are one icon) — the table itself stays percentage-sized with no fixed or
-  minimum width, so it fills the page at every browser width.
-- **On the Hall of Fame index page, the Process and Vulnerabilities cells are
-  collapsed.** Those two columns carry the prose — how the report arrived, and the
-  whole story of the vulnerability — so the page would be one wall of text and the
-  columns that identify a row (CVE, name, date, reporter, stars) would be far apart.
-  In `hall-of-fame/index.html`, and ONLY in those two `<td>`s, the cell's content
-  sits inside a `<details>` whose summary is the column's own name — `Process` for
-  the Process cell, `Details` for the Vulnerabilities cell:
-
-  ```
-  <td valign="top">
-    <details>
-    <summary>Details</summary>
-
-    <ul>
-      <li>… the same list as before …</li>
-    </ul>
-    </details>
-  </td>
-  ```
-
-  The summary is that plain word, there is a blank line under it, and the cell's
-  contents are otherwise unchanged. The other six cells of the row stay as they are
-  — they are what a reader scans — and so does the header row.
-- **The vuln-name subdirectory page is NOT collapsed.** `hall-of-fame/<name>bleed/index.html`
-  is the page a reader opened on purpose, for one vulnerability: its table cell stays
-  open and its `<h2 class="hof">Details</h2>` prose section below the table stays as
-  it is. Only the index, which lists them all, hides them behind the summary.
-
-### Tests
-
-- `build.sh` / `build.bat` have a menu to install dependencies, build
-  WeKan and run tests.
-- Add tests, negative tests and UI tests for all new features and fixes that do not yet
-  have tests. When adding a test, run or validate it and fix it until it works.
-- **"Check newest test logs":** test logs go into a `log/<datetime>/` directory,
-  one per run (e.g. `2026-07-21_20-58-09/`). That is **`../log/`**, one level up
-  from the repo, so a run does not show up in `git status` - **unless the parent
-  is not writable**, as in a Flatpak sandbox that shares only the repository;
-  there it is **`./log/`** inside the repo (gitignored). `build.sh` prints which
-  one when a run starts. The
-  newest datetime directory is the latest run. Each holds the Playwright per-browser
-  logs (`wekan-alltests-chromium.log`, `-firefox.log`, `-webkit.log`), the mocha/unit
-  log (`wekan-alltests-mocha.log`), the e2e/import logs, and `wekan-test-server.log`
-  (the WeKan test server + database output). A whole-run directory also holds the
-  database-conformance logs (`db-conformance-*.log`, `-report.md`, `-summary.txt`)
-  and FerretDB's own (`ferretdb-unit.log`, `-vet.log`, `-integration.log`). "Check
-  the newest test logs" means: open the most recent `log/<datetime>/` - look in
-  `../log/` first, then `./log/` - and read those.
-- **Check and fix WHILE the tests are still running.** A full run takes a long time
-  (three browsers, then every database with an image for this CPU, then FerretDB's
-  own suites), and its stages finish one at a time. Do not wait for the end: read
-  the logs that are already written, fix what they show, and then look again for the
-  stages that have finished since — repeat until every stage has run and everything
-  found is fixed. Two things make this work:
-  - A stage's log file is complete when its `===== ... finished` line is there; a
-    file whose mtime is still moving is a stage in progress, and its failures so far
-    are already real and worth fixing.
-  - The node suites are run by `tests/run-node-suites.cjs`, which runs ALL of them
-    and lists every failure at the end (`===== node suites: N run, M failed`). They
-    are the fastest signal - about 15 seconds for 260 suites - so they are usually
-    what to fix first while the browsers are still going.
-- **A failing guard is not automatically a broken app.** Most of these suites read
-  the source and pin a behaviour. When one fails, decide which side is wrong: fix
-  the CODE when the guard still describes what WeKan should do, and fix the GUARD
-  when the behaviour deliberately changed - and then say in the test WHY, so the
-  next reader knows it was a decision and not a slip. Every fixed test keeps the
-  assertion that made it valuable; do not delete a test to make a run green.
-
-## Environment
-
-- The editor (VSCode) runs inside a **Flatpak sandbox**, launched by
-  `docs/Security/Sandboxes/vscode/vscode-sandbox.sh`. What the sandbox allows/blocks and
-  how it is set up is documented in `docs/Security/Sandboxes/vscode/README.md` in that
-  same directory — read it when something behaves differently than a normal host (file
-  access, network, running services).
-
-### Always validate from the actual code
-
-- When doing anything, check how it actually works in the code first.

CODE_OF_CONDUCT.md

@@ -1,27 +0,0 @@
-# Code of Conduct
-
-For all code at WeKan GitHub Organization https://github.com/wekan
-
-- For pull requests, mention only those participants that are **human**.
-- All code in pull requests need to have permission already to add it to WeKan with MIT license, and will become MIT license.
-- For any dependencies, permissive licenses like https://copyfree.org are preferred
-- For anything currently that is non-permissive (like GPL, AGPL, SSPL), those will be replaced with permissive-licensed alternatives
-- All code is checked and validated by xet7 and many different security AI. If code is real working fix or feature, it usually will be merged.
-- All known vulnerabilities have been fixed at newest WeKan, please upgrade https://wekan.fi/upgrade/
-- There is no known backdoors. If WeKan is installed by someone else, first registered user is Admin and has Admin Panel access.
-- Maintainer of WeKan has no access to someone elses installed WeKan.
-- For someone elses installed WeKan, see [Forgot Password](https://github.com/wekan/wekan/blob/main/docs/Login/Forgot-Password.md)
-
-# Reporting about violations or something else
-
-## Private reports
-
-- Email support@wekan.fi
-- Security issues: [SECURITY.md](SECURITY.md)
-- License violations
-- Anything private, sensitive or negative
-
-## Public
-
-- Feature Requests and Bug Reports https://github.com/wekan/wekan/issues
-- Anything happy, positive, encouraging, helping, at friendly WeKan Global FOSS Community

CONTRIBUTING.md

@@ -1,94 +1,4 @@
-## About money
+To get started, [please sign the Contributor License Agreement](https://www.clahub.com/agreements/wekan/wekan).
 
-Not paid:
+[Then, please read documentation at wiki](https://github.com/wekan/wekan/wiki).
 
-- Money is not paid for these, everyone uses their own time at their own cost:
-  - Security reports, see [SECURITY.md](SECURITY.md)
-  - Pull requests
-  - xet7 checking pull requests
-  - This is because full-featured WeKan FLOSS kanban with MIT license is free to use
-    also for Commercial Use without any payment, with full source code at
-    https://github.com/wekan/wekan for all platforms at https://wekan.fi/install/ .
-    There is nothing proprietary. WeKan is NOT Big Tech.
-    WeKan is maintained by https://github.com/xet7 at Finland https://wekan.fi .     
-- Public FLOSS Developer Community Support:
-  - https://github.com/wekan/wekan/issues
-
-Paid by customers of WeKan to WeKan:
-
-- Optional Private Paid Commercial Support at https://wekan.fi/commercial-support/
-  - Optional Paid Support/Features/Fixes/PrivateChat . All Paid Features and Fixes are added directly to FLOSS WeKan https://github.com/wekan/wekan
-  - Optional Paid Official SaaS Hosting https://wekan.fi/saas/ , if you need full-featured hosting, that is more than free app https://wekan.fi/app/
-
-## Contributing Security related
-
-For responsible security disclosure, please follow this process: [SECURITY.md](SECURITY.md)
-
-CVE Hall of Fame is at https://wekan.fi/hall-of-fame/
-
-## Contributing to Documentation Wiki
-
-Fork WeKan repo https://github.com/wekan/wekan ,
-edit `docs` directory content at GitHub web interface,
-and click send PR.
-
-## Contributing code
-
-Use build.sh to run all tests to verify you don't break any features, before sending PR.
-
-Only send one feature or fix at one PR. Do not add many unrelated changes.
-
-Only send those changed code lines, that are related to your one feature or fix.
-
-Do not format unrelated code. Do not use code formatting or linting like eslist or prettier.
-
-Send your code ASAP, because there are daily releases of WeKan with major features and fixes added.
-
-[Building WeKan and sending PR](https://github.com/wekan/wekan/blob/main/docs/DeveloperDocs/Build-and-Create-Pull-Request.md).
-
-WeKan code contributors Hall of Fame is at ChangeLog, where
-GitHub usernames are mentioned with changes added:
-
-https://github.com/wekan/wekan/blob/main/CHANGELOG.md
-
-Changes can be like typo fixes, bugfixes, features, or anything else
-like for example at open GitHub issues https://github.com/wekan/wekan/issues .
-Closed issues are already fixed or implemented.
-
-Also see other docs:
-
-https://github.com/wekan/wekan/tree/main/docs/DeveloperDocs
-
-WeKan code has MIT license.
-
-About 300 persons have contributed to WeKan, stats at:
-
-https://www.openhub.net/p/wekan
-
-WeKan maintainer xet7 reviews PR for typos etc before accepting to WeKan,
-so that WeKan code will still work OK.
-
-## Contributing translations
-
-Non-English translations are contributed only at
-https://app.transifex.com/wekan/wekan
-
-When adding new features, in your PR to
-https://github.com/wekan/wekan/pulls
-only add new English source language strings
-to https://github.com/wekan/wekan/blob/main/imports/i18n/data/en.i18n.json
-
-Maintainer of WeKan xet7 downloads all newest
-translations from Transifex and adds
-them to WeKan repo before making
-new release.
-
-## About WeKan Organization https://github.com/wekan
-
-Only xet7 has write access to WeKan Organization.
-
-xet7 reviews all PRs before merging.
-
-There has been over 300 contributors to WeKan, newest stats at:
-
-https://www.openhub.net/p/wekan

Dockerfile

@@ -1,82 +1,44 @@
-# debian:trixie (Debian 13), not ubuntu:26.04: Ubuntu publishes no linux/386
-# image, which stopped the image from ever building for i386. Debian ships every
-# arch this image targets - amd64, arm64, 386, arm/v7, ppc64le, riscv64, s390x -
-# so ONE base covers them all, and it is the same base WeKan's per-arch .zip
-# bundles are already built in (releases/... build-extra-arches).
-FROM debian:trixie
+FROM ubuntu:disco
 LABEL maintainer="wekan"
-LABEL org.opencontainers.image.ref.name="debian"
-LABEL org.opencontainers.image.version="trixie"
-LABEL org.opencontainers.image.source="https://github.com/wekan/wekan"
 
-# TARGETARCH and TARGETVARIANT are automatically provided by Docker Buildx
-ARG TARGETARCH
-ARG TARGETVARIANT
-ARG VERSION=10.78
-ARG DEBIAN_FRONTEND=noninteractive
-
-ENV BUILD_DEPS="apt-utils gnupg wget bzip2 g++ curl libarchive-tools build-essential git ca-certificates python3 unzip"
-
-ENV \
+# Set the environment variables (defaults where required)
+# DOES NOT WORK: paxctl fix for alpine linux: https://github.com/wekan/wekan/issues/1303
+# ENV BUILD_DEPS="paxctl"
+ENV BUILD_DEPS="apt-utils bsdtar gnupg gosu wget curl bzip2 build-essential python3 python3-pip git ca-certificates gcc-8" \
     DEBUG=false \
-    NODE_VERSION=v24.19.0 \
-    METEOR_RELEASE=METEOR@3.5-rc.2 \
+    NODE_VERSION=v8.16.0 \
+    METEOR_RELEASE=1.6.0.1 \
     USE_EDGE=false \
-    NPM_VERSION=11.12.1 \
+    METEOR_EDGE=1.5-beta.17 \
+    NPM_VERSION=latest \
+    FIBERS_VERSION=2.0.0 \
+    ARCHITECTURE=linux-x64 \
     SRC_PATH=./ \
     WITH_API=true \
-    MONGO_OPLOG_URL="" \
-    RESULTS_PER_PAGE="" \
-    DEFAULT_BOARD_ID="" \
     ACCOUNTS_LOCKOUT_KNOWN_USERS_FAILURES_BEFORE=3 \
     ACCOUNTS_LOCKOUT_KNOWN_USERS_PERIOD=60 \
     ACCOUNTS_LOCKOUT_KNOWN_USERS_FAILURE_WINDOW=15 \
     ACCOUNTS_LOCKOUT_UNKNOWN_USERS_FAILURES_BERORE=3 \
     ACCOUNTS_LOCKOUT_UNKNOWN_USERS_LOCKOUT_PERIOD=60 \
     ACCOUNTS_LOCKOUT_UNKNOWN_USERS_FAILURE_WINDOW=15 \
-    ACCOUNTS_COMMON_LOGIN_EXPIRATION_IN_DAYS=90 \
-    ATTACHMENTS_UPLOAD_EXTERNAL_PROGRAM="" \
-    ATTACHMENTS_UPLOAD_MIME_TYPES="" \
-    ATTACHMENTS_UPLOAD_MAX_SIZE=0 \
-    AVATARS_UPLOAD_EXTERNAL_PROGRAM="" \
-    AVATARS_UPLOAD_MIME_TYPES="" \
-    AVATARS_UPLOAD_MAX_SIZE=72000 \
-    RICHER_CARD_COMMENT_EDITOR=false \
-    CARD_OPENED_WEBHOOK_ENABLED=false \
-    MAX_IMAGE_PIXEL="" \
-    IMAGE_COMPRESS_RATIO="" \
-    NOTIFICATION_TRAY_AFTER_READ_DAYS_BEFORE_REMOVE="" \
-    BIGEVENTS_PATTERN=NONE \
-    NOTIFY_ON_ASSIGN="true" \
-    NOTIFY_DUE_DAYS_BEFORE_AND_AFTER="" \
-    NOTIFY_DUE_AT_HOUR_OF_DAY="" \
     EMAIL_NOTIFICATION_TIMEOUT=30000 \
     MATOMO_ADDRESS="" \
     MATOMO_SITE_ID="" \
     MATOMO_DO_NOT_TRACK=true \
     MATOMO_WITH_USERNAME=false \
-    METRICS_ALLOWED_IP_ADDRESSES="" \
     BROWSER_POLICY_ENABLED=true \
     TRUSTED_URL="" \
     WEBHOOKS_ATTRIBUTES="" \
     OAUTH2_ENABLED=false \
-    OIDC_REDIRECTION_ENABLED=false \
-    OAUTH2_CA_CERT="" \
-    OAUTH2_ADFS_ENABLED=false \
-    OAUTH2_B2C_ENABLED=false \
     OAUTH2_LOGIN_STYLE=redirect \
     OAUTH2_CLIENT_ID="" \
     OAUTH2_SECRET="" \
-    OAUTH2_SECRET_FILE="" \
     OAUTH2_SERVER_URL="" \
     OAUTH2_AUTH_ENDPOINT="" \
     OAUTH2_USERINFO_ENDPOINT="" \
     OAUTH2_TOKEN_ENDPOINT="" \
-    OAUTH2_LOGOUT_ENDPOINT="" \
     OAUTH2_ID_MAP="" \
     OAUTH2_USERNAME_MAP="" \
-    OAUTH2_AUTO_REGISTRATION="true" \
-    OAUTH2_ADMIN_GROUPS="" \
     OAUTH2_FULLNAME_MAP="" \
     OAUTH2_ID_TOKEN_WHITELIST_FIELDS="" \
     OAUTH2_REQUEST_PERMISSIONS='openid profile email' \
@@ -84,9 +46,6 @@ ENV \
     LDAP_ENABLE=false \
     LDAP_PORT=389 \
     LDAP_HOST="" \
-    LDAP_AD_SIMPLE_AUTH="" \
-    LDAP_USER_AUTHENTICATION=false \
-    LDAP_USER_AUTHENTICATION_FIELD=uid \
     LDAP_BASEDN="" \
     LDAP_LOGIN_FALLBACK=false \
     LDAP_RECONNECT=true \
@@ -96,16 +55,15 @@ ENV \
     LDAP_AUTHENTIFICATION=false \
     LDAP_AUTHENTIFICATION_USERDN="" \
     LDAP_AUTHENTIFICATION_PASSWORD="" \
-    LDAP_AUTHENTIFICATION_PASSWORD_FILE="" \
     LDAP_LOG_ENABLED=false \
     LDAP_BACKGROUND_SYNC=false \
-    LDAP_BACKGROUND_SYNC_INTERVAL="" \
+    LDAP_BACKGROUND_SYNC_INTERVAL=100 \
     LDAP_BACKGROUND_SYNC_KEEP_EXISTANT_USERS_UPDATED=false \
     LDAP_BACKGROUND_SYNC_IMPORT_NEW_USERS=false \
-    LDAP_BACKGROUND_SYNC_DISABLE_NONEXISTANT_USERS=false \
     LDAP_ENCRYPTION=false \
     LDAP_CA_CERT="" \
     LDAP_REJECT_UNAUTHORIZED=false \
+    LDAP_USER_AUTHENTICATION=false \
     LDAP_USER_SEARCH_FILTER="" \
     LDAP_USER_SEARCH_SCOPE="" \
     LDAP_USER_SEARCH_FIELD="" \
@@ -132,16 +90,10 @@ ENV \
     LDAP_DEFAULT_DOMAIN="" \
     LDAP_SYNC_ADMIN_STATUS="" \
     LDAP_SYNC_ADMIN_GROUPS="" \
-    LDAP_SYNC_ORGANIZATIONS=false \
-    LDAP_SYNC_ORGANIZATIONS_GROUPS="" \
-    LDAP_SYNC_TEAMS=false \
-    LDAP_SYNC_TEAMS_GROUPS="" \
     HEADER_LOGIN_ID="" \
     HEADER_LOGIN_FIRSTNAME="" \
     HEADER_LOGIN_LASTNAME="" \
     HEADER_LOGIN_EMAIL="" \
-    HEADER_LOGIN_TRUSTED_IPS="" \
-    HEADER_LOGIN_TRUSTED_PROXIES="" \
     LOGOUT_WITH_TIMER=false \
     LOGOUT_IN="" \
     LOGOUT_ON_HOURS="" \
@@ -149,187 +101,168 @@ ENV \
     CORS="" \
     CORS_ALLOW_HEADERS="" \
     CORS_EXPOSE_HEADERS="" \
-    DEFAULT_AUTHENTICATION_METHOD="" \
-    PASSWORD_LOGIN_ENABLED=true \
-    CAS_ENABLED=false \
-    CAS_BASE_URL="" \
-    CAS_LOGIN_URL="" \
-    CAS_VALIDATE_URL="" \
-    SAML_ENABLED=false \
-    SAML_PROVIDER="" \
-    SAML_ENTRYPOINT="" \
-    SAML_ISSUER="" \
-    SAML_CERT="" \
-    SAML_IDPSLO_REDIRECTURL="" \
-    SAML_PRIVATE_KEYFILE="" \
-    SAML_PUBLIC_CERTFILE="" \
-    SAML_IDENTIFIER_FORMAT="" \
-    SAML_LOCAL_PROFILE_MATCH_ATTRIBUTE="" \
-    SAML_ATTRIBUTES="" \
-    ORACLE_OIM_ENABLED=false \
-    WAIT_SPINNER="" \
-    WRITABLE_PATH=/data \
-    S3="" \
-    MAIL_SERVICE_PASSWORD_FILE="" \
-    MONGO_PASSWORD_FILE="" \
-    S3_SECRET_FILE=""
+    DEFAULT_AUTHENTICATION_METHOD=""
 
-# Where this image's Node.js comes from is decided by the SAME script the .zip
-# bundles and the snap use - official nodejs.org, then unofficial-builds, then
-# wekan/node-patches - so the image and the bundle of the same architecture can
-# never end up on Node.js from different places. It is copied in rather than
-# reimplemented here; a second copy of that order would drift from the first.
-COPY --chmod=755 releases/resolve-node-source.sh /tmp/resolve-node-source.sh
+# Copy the app to the image
+COPY ${SRC_PATH} /home/wekan/app
 
-RUN <<EOR
-set -o xtrace
-# Fail hard on any error so a missing release zip / failed download can never
-# produce a "successful" image with an empty /build (Cannot find /build/main.js).
-set -eo pipefail
+RUN \
+    set -o xtrace && \
+    # Add non-root user wekan
+    useradd --user-group --system --home-dir /home/wekan wekan && \
+    \
+    # OS dependencies
+    apt-get update -y && apt-get install -y --no-install-recommends ${BUILD_DEPS} && \
+    pip3 install -U pip setuptools wheel && \
+    \
+    # Meteor installer doesn't work with the default tar binary, so using bsdtar while installing.
+    # https://github.com/coreos/bugs/issues/1095#issuecomment-350574389
+    cp $(which tar) $(which tar)~ && \
+    ln -sf $(which bsdtar) $(which tar) && \
+    \
+    # Download nodejs
+    wget https://nodejs.org/dist/${NODE_VERSION}/node-${NODE_VERSION}-${ARCHITECTURE}.tar.gz && \
+    wget https://nodejs.org/dist/${NODE_VERSION}/SHASUMS256.txt.asc && \
+    #---------------------------------------------------------------------------------------------
+    # Node Fibers 100% CPU usage issue:
+    # https://github.com/wekan/wekan-mongodb/issues/2#issuecomment-381453161
+    # https://github.com/meteor/meteor/issues/9796#issuecomment-381676326
+    # https://github.com/sandstorm-io/sandstorm/blob/0f1fec013fe7208ed0fd97eb88b31b77e3c61f42/shell/server/00-startup.js#L99-L129
+    # Also see beginning of wekan/server/authentication.js
+    #   import Fiber from "fibers";
+    #   Fiber.poolSize = 1e9;
+    # OLD: Download node version 8.12.0 prerelease that has fix included, => Official 8.12.0 has been released
+    # Description at https://releases.wekan.team/node.txt
+    #wget https://releases.wekan.team/node-${NODE_VERSION}-${ARCHITECTURE}.tar.gz && \
+    #echo "1ed54adb8497ad8967075a0b5d03dd5d0a502be43d4a4d84e5af489c613d7795  node-v8.12.0-linux-x64.tar.gz" >> SHASUMS256.txt.asc && \
+    \
+    # Verify nodejs authenticity
+    grep ${NODE_VERSION}-${ARCHITECTURE}.tar.gz SHASUMS256.txt.asc | shasum -a 256 -c - && \
+    #export GNUPGHOME="$(mktemp -d)" && \
+    #\
+    # Try other key servers if ha.pool.sks-keyservers.net is unreachable
+    # Code from https://github.com/chorrell/docker-node/commit/2b673e17547c34f17f24553db02beefbac98d23c
+    # gpg keys listed at https://github.com/nodejs/node#release-team
+    # and keys listed here from previous version of this Dockerfile
+    #for key in \
+    #9554F04D7259F04124DE6B476D5A82AC7E37093B \
+    #94AE36675C464D64BAFA68DD7434390BDBE9B9C5 \
+    #FD3A5288F042B6850C66B31F09FE44734EB7990E \
+    #71DCFD284A79C3B38668286BC97EC7A07EDE3FC1 \
+    #DD8F2338BAE7501E3DD5AC78C273792F7D83545D \
+    #C4F0DFFF4E8C1A8236409D08E73BC641CC11F4C8 \
+    #B9AE9905FFD7803F25714661B63B535A4C206CA9 \
+    #; do \
+    #gpg --keyserver ha.pool.sks-keyservers.net --recv-keys "$key" || \
+    #gpg --keyserver pgp.mit.edu --recv-keys "$key" || \
+    #gpg --keyserver keyserver.pgp.com --recv-keys "$key" ; \
+    #done && \
+    #gpg --verify SHASUMS256.txt.asc && \
+    # Ignore socket files then delete files then delete directories
+    #find "$GNUPGHOME" -type f | xargs rm -f && \
+    #find "$GNUPGHOME" -type d | xargs rm -fR && \
+    rm -f SHASUMS256.txt.asc && \
+    \
+    # Install Node
+    tar xvzf node-${NODE_VERSION}-${ARCHITECTURE}.tar.gz && \
+    rm node-${NODE_VERSION}-${ARCHITECTURE}.tar.gz && \
+    mv node-${NODE_VERSION}-${ARCHITECTURE} /opt/nodejs && \
+    ln -s /opt/nodejs/bin/node /usr/bin/node && \
+    ln -s /opt/nodejs/bin/npm /usr/bin/npm && \
+    \
+    #DOES NOT WORK: paxctl fix for alpine linux: https://github.com/wekan/wekan/issues/1303
+    #paxctl -mC `which node` && \
+    \
+    # Install Node dependencies
+    npm install -g npm@${NPM_VERSION} && \
+    npm install -g node-gyp && \
+    npm install -g fibers@${FIBERS_VERSION} && \
+    \
+    # Change user to wekan and install meteor
+    cd /home/wekan/ && \
+    chown wekan:wekan --recursive /home/wekan && \
+    curl "https://install.meteor.com" -o /home/wekan/install_meteor.sh && \
+    #curl "https://install.meteor.com/?release=${METEOR_RELEASE}" -o /home/wekan/install_meteor.sh && \
+    # OLD: sed -i "s|RELEASE=.*|RELEASE=${METEOR_RELEASE}\"\"|g" ./install_meteor.sh && \
+    # Install Meteor forcing its progress
+    sed -i 's/VERBOSITY="--silent"/VERBOSITY="--progress-bar"/' ./install_meteor.sh && \
+    echo "Starting meteor ${METEOR_RELEASE} installation...   \n" && \
+    chown wekan:wekan /home/wekan/install_meteor.sh && \
+    \
+    # Check if opting for a release candidate instead of major release
+    if [ "$USE_EDGE" = false ]; then \
+      gosu wekan:wekan sh /home/wekan/install_meteor.sh; \
+    else \
+      gosu wekan:wekan git clone --recursive --depth 1 -b release/METEOR@${METEOR_EDGE} git://github.com/meteor/meteor.git /home/wekan/.meteor; \
+    fi; \
+    \
+    # Get additional packages
+    #mkdir -p /home/wekan/app/packages && \
+    #chown wekan:wekan --recursive /home/wekan && \
+    # REPOS BELOW ARE INCLUDED TO WEKAN REPO
+    #cd /home/wekan/app/packages && \
+    #gosu wekan:wekan git clone --depth 1 -b master https://github.com/wekan/flow-router.git kadira-flow-router && \
+    #gosu wekan:wekan git clone --depth 1 -b master https://github.com/meteor-useraccounts/core.git meteor-useraccounts-core && \
+    #gosu wekan:wekan git clone --depth 1 -b master https://github.com/wekan/meteor-accounts-cas.git && \
+    #gosu wekan:wekan git clone --depth 1 -b master https://github.com/wekan/wekan-ldap.git && \
+    #gosu wekan:wekan git clone --depth 1 -b master https://github.com/wekan/wekan-scrollbar.git && \
+    #gosu wekan:wekan git clone --depth 1 -b master https://github.com/wekan/meteor-accounts-oidc.git && \
+    #gosu wekan:wekan git clone --depth 1 -b master --recurse-submodules https://github.com/wekan/markdown.git && \
+    #gosu wekan:wekan mv meteor-accounts-oidc/packages/switch_accounts-oidc wekan-accounts-oidc && \
+    #gosu wekan:wekan mv meteor-accounts-oidc/packages/switch_oidc wekan-oidc && \
+    #gosu wekan:wekan rm -rf meteor-accounts-oidc && \
+    sed -i 's/api\.versionsFrom/\/\/api.versionsFrom/' /home/wekan/app/packages/meteor-useraccounts-core/package.js && \
+    cd /home/wekan/.meteor && \
+    gosu wekan:wekan /home/wekan/.meteor/meteor -- help; \
+    \
+    # extract the OpenAPI specification
+    npm install -g api2html@0.3.3 && \
+    mkdir -p /home/wekan/python && \
+    chown wekan:wekan --recursive /home/wekan/python && \
+    cd /home/wekan/python && \
+    gosu wekan:wekan git clone --depth 1 -b master https://github.com/Kronuz/esprima-python && \
+    cd /home/wekan/python/esprima-python && \
+    python3 setup.py install --record files.txt && \
+    cd /home/wekan/app &&\
+    gosu wekan:wekan mkdir -p ./public/api && \
+    gosu wekan:wekan python3 ./openapi/generate_openapi.py --release $(git describe --tags --abbrev=0) > ./public/api/wekan.yml && \
+    gosu wekan:wekan /opt/nodejs/bin/api2html -c ./public/logo-header.png -o ./public/api/wekan.html ./public/api/wekan.yml; \
+    # Build app
+    cd /home/wekan/app && \
+    gosu wekan:wekan /home/wekan/.meteor/meteor add standard-minifier-js && \
+    gosu wekan:wekan /home/wekan/.meteor/meteor npm install && \
+    gosu wekan:wekan /home/wekan/.meteor/meteor build --directory /home/wekan/app_build && \
+    cp /home/wekan/app/fix-download-unicode/cfs_access-point.txt /home/wekan/app_build/bundle/programs/server/packages/cfs_access-point.js && \
+    rm /home/wekan/app_build/bundle/programs/server/npm/node_modules/meteor/rajit_bootstrap3-datepicker/lib/bootstrap-datepicker/node_modules/phantomjs-prebuilt/lib/phantom/bin/phantomjs && \
+    chown wekan:wekan /home/wekan/app_build/bundle/programs/server/packages/cfs_access-point.js && \
+    #Removed binary version of bcrypt because of security vulnerability that is not fixed yet.
+    #https://github.com/wekan/wekan/commit/4b2010213907c61b0e0482ab55abb06f6a668eac
+    #https://github.com/wekan/wekan/commit/7eeabf14be3c63fae2226e561ef8a0c1390c8d3c
+    #cd /home/wekan/app_build/bundle/programs/server/npm/node_modules/meteor/npm-bcrypt && \
+    #gosu wekan:wekan rm -rf node_modules/bcrypt && \
+    #gosu wekan:wekan npm install bcrypt && \
+    cd /home/wekan/app_build/bundle/programs/server/ && \
+    gosu wekan:wekan npm install && \
+    #gosu wekan:wekan npm install bcrypt && \
+    mv /home/wekan/app_build/bundle /build && \
+    \
+    # Put back the original tar
+    mv $(which tar)~ $(which tar) && \
+    \
+    # Cleanup
+    apt-get remove --purge -y ${BUILD_DEPS} && \
+    apt-get autoremove -y && \
+    npm uninstall -g api2html &&\
+    rm -R /var/lib/apt/lists/* && \
+    rm -R /home/wekan/.meteor && \
+    rm -R /home/wekan/app && \
+    rm -R /home/wekan/app_build && \
+    cat /home/wekan/python/esprima-python/files.txt | xargs rm -R && \
+    rm -R /home/wekan/python && \
+    rm /home/wekan/install_meteor.sh
 
-# Create Wekan user. --create-home is required because --system users do not
-# get a home directory by default; without it /home/wekan never exists and the
-# later `chown ... /home/wekan/` aborts the build (now that set -e is active).
-useradd --user-group --system --create-home --home-dir /home/wekan wekan
-
-# OS Updates
-apt-get update --assume-yes
-apt-get upgrade --assume-yes
-apt-get install --assume-yes --no-install-recommends ${BUILD_DEPS}
-
-# Multi-arch mapping: Docker TARGETARCH -> WeKan's own platform name, which is
-# both the bundle .zip's name and what resolve-node-source.sh is asked about.
-# amd64/arm64 have MongoDB Community; ppc64le/s390x/riscv64 have no MongoDB
-# server and ship FerretDB v1 instead (the ferretdb binary is baked into their
-# .zip and started by wekan-entrypoint.sh). Debian's 32-bit ARM port is armhf
-# (ARMv7, VFPv3-D16), which is what linux/arm/v7 runs.
-case "${TARGETARCH}" in
-    "amd64")   WEKAN_ARCH="amd64"   ;;
-    "arm64")   WEKAN_ARCH="arm64"   ;;
-    "ppc64le") WEKAN_ARCH="ppc64le" ;;
-    "s390x")   WEKAN_ARCH="s390x"   ;;
-    "riscv64") WEKAN_ARCH="riscv64" ;;
-    "386")     WEKAN_ARCH="i386"    ;;
-    "arm")     WEKAN_ARCH="armhf"   ;;
-    *) echo "Unsupported architecture: ${TARGETARCH}${TARGETVARIANT:+/${TARGETVARIANT}}"; exit 1 ;;
-esac
-
-# Node.js installation - official nodejs.org, then unofficial-builds.nodejs.org,
-# then wekan/node-patches, in that order, for EVERY architecture.
-#
-# The choice is made by releases/resolve-node-source.sh, copied in above and used
-# by the .zip bundles and the snap as well, so the image and the bundle of one
-# architecture always carry the same Node.js from the same place. It is asked
-# about the MAJOR, so a CPU whose newest build lags a release still gets its
-# newest: it answers with the exact file, what shape that file is, and the
-# SHA256 the source published for it.
-#
-# npm is arch-independent JavaScript, so it is grafted from the official amd64
-# tarball of the version that was resolved - a build-time tool, not the shipped
-# node. (node-patches publishes a bare node binary and no npm at all, which is
-# why npm is fetched separately rather than taken from the archive above.)
-cd /tmp
-NODE_MAJOR="${NODE_VERSION#v}"; NODE_MAJOR="${NODE_MAJOR%%.*}"
-if ! NODE_META="$(bash /tmp/resolve-node-source.sh "${WEKAN_ARCH}" "${NODE_MAJOR}")"; then
-    echo "No Node.js ${NODE_MAJOR}.x for ${WEKAN_ARCH} at nodejs.org, unofficial-builds.nodejs.org or wekan/node-patches, so this image cannot be built for it. Build node-${WEKAN_ARCH} in wekan/node-patches, or drop ${TARGETARCH} from the image's platform list." >&2
-    exit 1
-fi
-eval "${NODE_META}"
-echo "Node.js ${node_full} for ${WEKAN_ARCH}: ${node_from} (${node_url})"
-wget --tries=20 --waitretry=20 --retry-on-http-error=403,500,502,503 -O node-download "${node_url}"
-echo "${node_sha256}  node-download" | sha256sum -c -
-case "${node_kind}" in
-    binary)
-        cp node-download /usr/local/bin/node
-        ;;
-    tar.xz|tar.gz|tar)
-        # bsdtar (libarchive-tools) is installed below for the bundle; plain tar
-        # here, letting it detect the compression rather than naming it.
-        tar -xf node-download --no-same-owner "${node_member}"
-        cp "${node_member}" /usr/local/bin/node
-        ;;
-    *)
-        echo "resolve-node-source.sh returned an unknown kind '${node_kind}'." >&2
-        exit 1
-        ;;
-esac
-chmod +x /usr/local/bin/node
-# npm + npx from the official amd64 tarball of the SAME version; extract only
-# those paths, not the amd64 node binary.
-wget "https://nodejs.org/dist/${node_full}/node-${node_full}-linux-x64.tar.gz"
-wget "https://nodejs.org/dist/${node_full}/SHASUMS256.txt"
-grep " node-${node_full}-linux-x64.tar.gz\$" SHASUMS256.txt | sha256sum -c -
-tar xzf "node-${node_full}-linux-x64.tar.gz" -C /usr/local --strip-components=1 --no-same-owner \
-    "node-${node_full}-linux-x64/lib/node_modules/npm" \
-    "node-${node_full}-linux-x64/bin/npm" \
-    "node-${node_full}-linux-x64/bin/npx"
-rm -rf node-download "node-${node_full}-linux-x64.tar.gz" "node-${node_full}-linux-x64" SHASUMS256.txt
-ln -s "/usr/local/bin/node" "/usr/local/bin/nodejs"
-
-# NPM configuration
-npm install -g npm@${NPM_VERSION}
-chown --recursive wekan:wekan /home/wekan/
-
-# Temporary Tar swap for Meteor bundle
-cp $(which tar) $(which tar)~
-ln -sf $(which bsdtar) $(which tar)
-
-# WeKan Bundle Installation
-mkdir -p /home/wekan/app
-cd /home/wekan/app
-# Retry the release-asset download: even though the CI `docker` job needs the
-# `release` job (so the asset is already uploaded), GitHub's
-# releases/download/<tag>/<asset> URL can briefly return 404 right after upload
-# (CDN/propagation lag). A plain wget treats 404 as fatal, which failed the
-# build; retry on transient HTTP errors so propagation lag no longer breaks it.
-WEKAN_ZIP_URL="https://github.com/wekan/wekan/releases/download/v${VERSION}/wekan-${VERSION}-${WEKAN_ARCH}.zip"
-wget --tries=20 --waitretry=20 --retry-on-http-error=404,403,500,502,503 "${WEKAN_ZIP_URL}" \
-  || { echo "Failed to download ${WEKAN_ZIP_URL} after retries"; exit 8; }
-unzip "wekan-${VERSION}-${WEKAN_ARCH}.zip"
-rm "wekan-${VERSION}-${WEKAN_ARCH}.zip"
-npm install --prefix ./bundle/programs/server
-mv /home/wekan/app/bundle /build
-
-# The .zip bundle now ships a self-contained launcher + its own Node.js for the
-# offline downloads; the Docker image installs its own Node and uses
-# wekan-entrypoint.sh, so drop the redundant bundled node + launchers. Keeps
-# /build/ferretdb (used by the entrypoint) and the per-arch MongoDB Database Tools
-# (bsondump, mongodump, mongorestore, … from wekan/mongo-tools-patches, embedded in the
-# bundle) for backup/restore inside the container. Saves ~80 MB per arch.
-rm -f /build/node /build/start-wekan.sh /build/start-wekan.bat
-
-# Restore original tar
-mv $(which tar)~ $(which tar)
-
-# Cleanup
-# Remove unused Go-based pebble binary shipped by base image to reduce CVE surface.
-apt-get remove --purge --assume-yes pebble || true
-rm -f /usr/bin/pebble
-apt-get remove --purge --assume-yes ${BUILD_DEPS}
-apt-get autoremove --assume-yes
-apt-get clean --assume-yes
-rm -Rf /tmp/*
-rm -Rf /var/lib/apt/lists/*
-rm -Rf /home/wekan/app
-
-mkdir -p /data
-chown wekan:wekan --recursive /data
-EOR
-
-# Database-backend selector entrypoint. Every arch's bundle now ships a FerretDB
-# binary (baked into the .zip and moved to /build/ferretdb above); this script
-# starts FerretDB v1 (SQLite) or leaves the DB external based on WEKAN_DB and the
-# /build/.ferretdb-default marker (present only on MongoDB-less arches). See
-# releases/ferretdb/wekan-entrypoint.sh.
-COPY --chmod=755 releases/ferretdb/wekan-entrypoint.sh /build/wekan-entrypoint.sh
-# #6492: standalone "recovering data" page the entrypoint serves as a brief bridge on
-# the web port while a just-restored FerretDB comes back up during a data recovery.
-COPY --chmod=644 releases/ferretdb/recovery-bridge.mjs /build/recovery-bridge.mjs
-
-USER wekan
 ENV PORT=8080
 EXPOSE $PORT
-STOPSIGNAL SIGKILL
-WORKDIR /build
+USER wekan
 
-CMD ["bash", "/build/wekan-entrypoint.sh"]
+CMD ["node", "/build/main.js"]

FUTURE.md

@@ -1,40 +0,0 @@
-# Future
-
-## Moved Import/Export/Sync issues to Big Picture Roadmap wiki page
-
-This change is limited to only Import/Export/Sync issues, while those are In Progress of being fixed.
-
-2023-11-21 xet7 closed 261 issues that are linked at https://github.com/wekan/wekan/wiki/Sync ,
-that is Roadmap of Import/Export/Sync in WeKan. It means, that those issues progress will be
-updated at that wiki page, when xet7 and other WeKan contributors fix those.
-Many of those issues are In Progress of being fixed and added.
-
-## Platform Updates
-
-Issues related to platforms are being closed, because only list of working platforms is mentioned now
-at WeKan website https://wekan.github.io Install section and at [ChangeLog](https://github.com/wekan/wekan/blob/main/CHANGELOG.md)
-where is this new text:
-
-> Newest WeKan at amd64 platforms: Linux bundle, Snap Candidate, Docker, Kubernetes. Fixing other platforms In Progress. 
-
-Platform support changes often, because:
-
-- There are many dependencies, that update or break or change often
-- Node.js segfaults at some CPU/OS
-- Some platforms have build errors
-
-Roadmap is to update all existing platforms, and add more platforms.
-
-Upcoming platform upgrades:
-
-- Fix migrations, so that newest WeKan can be released to Snap Stable. (Currently newest is at Snap Candidate).
-
-## WeKan features
-
-Most Meteor WeKan features are listed here:
-
-https://github.com/wekan/wekan/wiki/Deep-Dive-Into-WeKan
-
-Remaining features and all changes are listed here:
-
-https://github.com/wekan/wekan/blob/main/CHANGELOG.md

GOVERNANCE.md

@@ -1,10 +0,0 @@
-# Governance
-
-Anyone can send pull request to https://github.com/wekan/wekan/wiki/pulls ,
-if there is permission to add code to WeKan with MIT license.
-
-As maintainer, xet7 checks all pull requests and merges them.
-
-Only xet7 has write access to repo https://github.com/wekan/wekan
-
-

LICENSE

@@ -1,6 +1,6 @@
 The MIT License (MIT)
 
-Copyright (c) Lauri Ojansivu
+Copyright (c) 2014-2019 The Wekan Team
 
 Permission is hereby granted, free of charge, to any person obtaining a copy
 of this software and associated documentation files (the "Software"), to deal

README.md

@@ -1,59 +1,42 @@
-# WeKan ® - Open Source kanban
+# Wekan - Open Source kanban
 
-## Downloads
+[![Contributors](https://img.shields.io/github/contributors/wekan/wekan.svg "Contributors")](https://github.com/wekan/wekan/graphs/contributors)
+[![Docker Repository on Quay](https://quay.io/repository/wekan/wekan/status "Docker Repository on Quay")](https://quay.io/repository/wekan/wekan)
+[![Docker Hub container status](https://img.shields.io/docker/build/wekanteam/wekan.svg "Docker Hub container status")](https://hub.docker.com/r/wekanteam/wekan)
+[![Docker Hub pulls](https://img.shields.io/docker/pulls/wekanteam/wekan.svg "Docker Hub Pulls")](https://hub.docker.com/r/wekanteam/wekan)
+[![Wekan Build Status][travis_badge]][travis_status]
+[![Codacy Badge](https://api.codacy.com/project/badge/Grade/02137ecec4e34c5aa303f57637196a93 "Codacy Badge")](https://www.codacy.com/app/xet7/wekan?utm_source=github.com&utm_medium=referral&utm_content=wekan/wekan&utm_campaign=Badge_Grade)
+[![Code Climate](https://codeclimate.com/github/wekan/wekan/badges/gpa.svg "Code Climate")](https://codeclimate.com/github/wekan/wekan)
+[![Project Dependencies](https://david-dm.org/wekan/wekan.svg "Project Dependencies")](https://david-dm.org/wekan/wekan)
+[![Code analysis at Open Hub](https://img.shields.io/badge/code%20analysis-at%20Open%20Hub-brightgreen.svg "Code analysis at Open Hub")](https://www.openhub.net/p/wekan)
+[![FOSSA Status](https://app.fossa.io/api/projects/git%2Bgithub.com%2Fwekan%2Fwekan.svg?type=shield)](https://app.fossa.io/projects/git%2Bgithub.com%2Fwekan%2Fwekan?ref=badge_shield)
 
-https://wekan.fi/install/
+## [Translate Wekan at Transifex](https://transifex.com/wekan/wekan)
 
-## Docker Containers
+Translations to non-English languages are accepted only at [Transifex](https://transifex.com/wekan/wekan) using webbrowser.
+New English strings of new features can be added as PRs to edge branch file wekan/i18n/en.i18n.json .
 
-- [GitHub](https://github.com/wekan/wekan/pkgs/container/wekan)
-- [Quay](https://quay.io/repository/wekan/wekan)
-- [Docker Hub](https://hub.docker.com/r/wekanteam/wekan)
+## [Wekan feature requests and bugs](https://github.com/wekan/wekan/issues)
 
-docker-compose.yml at https://github.com/wekan/wekan/blob/main/docker-compose.yml
-
-## Standards
-
-- [WeKan and Standard for Public Code](https://wekan.fi/standard-for-public-code/) assessment was made at 2023-11.
-  Currently Wekan meets 8 out of 16 criteria out of the box.
-  Some others could be met with small changes.
-
-## Code stats
-
-- [CII Best Practices](https://bestpractices.coreinfrastructure.org/projects/4619)
-- [Code Climate](https://codeclimate.com/github/wekan/wekan)
-- [Open Hub](https://www.openhub.net/p/wekan)
-- [OSS Insight](https://ossinsight.io/analyze/wekan/wekan)
-
-## Translate WeKan ® at Transifex
-
-Translations to non-English languages are accepted only at [Transifex](https://app.transifex.com/wekan/wekan) using webbrowser.
-New English strings of new features can be added as PRs to master branch file wekan/imports/i18n/data/en.i18n.json .
-
-## WeKan ® feature requests and bugs
-
-Please add most of your questions as GitHub issue: [WeKan ® Feature Requests and Bugs](https://github.com/wekan/wekan/issues).
+Please add most of your questions as GitHub issue: [Wekan feature requests and bugs](https://github.com/wekan/wekan/issues).
 It's better than at chat where details get lost when chat scrolls up.
 
-## Discussions
+## Chat
 
-[IRC](https://github.com/wekan/wekan/blob/main/docs/FAQ/IRC-FAQ.md)
+[![Wekan Chat][vanila_badge]][wekan_chat] - Most Wekan community and developers are here. Works on webbrowser
+and PWA app that can be added as icon on Android and bookmark on iOS, used like native app.
 
-## Docker: Latest tag has newest release
-
-You can use latest tag to get newest release tag.
-See bottom of https://github.com/wekan/wekan/issues/3874
+[Wekan IRC FAQ](https://github.com/wekan/wekan/wiki/IRC-FAQ)
 
 ## FAQ
 
-**NOTE**:
+**NOTE**: 
+- Please read the [FAQ](https://github.com/wekan/wekan/wiki/FAQ) first
+- Please don't feed the trolls and spammers that are mentioned in the FAQ :)
 
-- Please read the [FAQ](https://github.com/wekan/wekan/blob/main/docs/FAQ/FAQ.md) first
-- Please don't feed the [trolls](https://github.com/wekan/wekan/blob/main/docs/FAQ/FAQ.md#why-am-i-called-a-troll) and [spammers](https://github.com/wekan/wekan/blob/main/docs/FAQ/FAQ.md#why-am-i-called-a-spammer) that are mentioned in the FAQ :)
+## About Wekan
 
-## About WeKan ®
-
-WeKan ® is a completely [Open Source][open_source] and [Free software][free_software]
+Wekan is an completely [Open Source][open_source] and [Free software][free_software]
 collaborative kanban board application with MIT license.
 
 Whether you’re maintaining a personal todo list, planning your holidays with some friends,
@@ -61,142 +44,96 @@ or working in a team on your next revolutionary idea, Kanban boards are an unbea
 to keep your things organized. They give you a visual overview of the current state of your project,
 and make you productive by allowing you to focus on the few items that matter the most.
 
-Since WeKan ® is a free software, you don’t have to trust us with your data and can
+Since Wekan is a free software, you don’t have to trust us with your data and can
 install Wekan on your own computer or server. In fact we encourage you to do
 that by providing one-click installation on various platforms.
 
-- WeKan ® is used in [most countries of the world](https://snapcraft.io/wekan).
-- WeKan ® largest user has 30k users using WeKan ® in their company.
-- WeKan ® has been [translated](https://app.transifex.com/wekan/) to 154 languages.
-- [Features][features]: WeKan ® has real-time user interface.
-- [Platforms](https://wekan.fi/install/): WeKan ® supports many platforms.
-  WeKan ® is critical part of new platforms Wekan is currently being integrated to.
+- Wekan is used in [most countries of the world](https://snapcraft.io/wekan).
+- Wekan largest user has 13k users using Wekan in their company.
+- Wekan has been [translated](https://transifex.com/wekan/wekan) to about 50 languages.
+- [Features][features]: Wekan has real-time user interface.
+- [Platforms][platforms]: Wekan supports many platforms.
+  Wekan is critical part of new platforms Wekan is currently being integrated to.
+- [Integrations][integrations]: Current possible integrations and future plans.
 
 ## Requirements
 
-- 1 GB RAM minimum free for WeKan ®. Production server should have minimum total 4 GB RAM.
-  For thousands of users, for example with [Docker](https://github.com/wekan/wekan/blob/main/docker-compose.yml): 3 frontend servers,
-  each having 2 CPU and 2 wekan-app containers. One backend wekan-db server with many CPUs.
-- Enough disk space and alerts about low disk space. If you run out of disk space, MongoDB database gets corrupted.
-- SECURITY: Updating to newest WeKan ® version very often. Please check you do not have automatic updates of Sandstorm or Snap turned off.
-  Old versions have security issues because of old versions Node.js etc. Only newest WeKan ® is supported.
-  WeKan ® on Sandstorm is not usually affected by any Standalone WeKan ® (Snap/Docker/Source) security issues.
+- 64bit: Linux [Snap](https://github.com/wekan/wekan-snap/wiki/Install) or [Sandstorm](https://sandstorm.io) /
+  [Mac](https://github.com/wekan/wekan/wiki/Mac) / [Windows](https://github.com/wekan/wekan/wiki/Install-Wekan-from-source-on-Windows).
+  [More Platforms](https://github.com/wekan/wekan/wiki/Platforms). [ARM progress](https://github.com/wekan/wekan/issues/1053#issuecomment-410919264).
+- 1 GB RAM minimum free for Wekan. Production server should have minimum total 4 GB RAM.
+  For thousands of users, for example with [Docker](https://github.com/wekan/wekan/blob/devel/docker-compose.yml): 3 frontend servers,
+  each having 2 CPU and 2 wekan-app containers. One backend wekan-db server with many CPUs.  
+- Enough disk space and alerts about low disk space. If you run out disk space, MongoDB database gets corrupted.
+- SECURITY: Updating to newest Wekan version very often. Please check you do not have automatic updates of Sandstorm or Snap turned off.
+  Old versions have security issues because of old versions Node.js etc. Only newest Wekan is supported.
+  Wekan on Sandstorm is not usually affected by any Standalone Wekan (Snap/Docker/Source) security issues.
 - [Reporting all new bugs immediately](https://github.com/wekan/wekan/issues).
-  New features and fixes are added to WeKan ® [many times a day](https://github.com/wekan/wekan/blob/main/CHANGELOG.md).
-- [Backups](https://github.com/wekan/wekan/blob/main/docs/Backup/Backup.md) of WeKan ® database once a day minimum.
+  New features and fixes are added to Wekan [many times a day](https://github.com/wekan/wekan/blob/devel/CHANGELOG.md).
+- [Backups](https://github.com/wekan/wekan/wiki/Backup) of Wekan database once a day miminum.
   Bugs, updates, users deleting list or card, harddrive full, harddrive crash etc can eat your data. There is no undo yet.
-  Some bugs can cause WeKan ® board to not load at all, requiring manual fixing of database content.
+  Some bug can cause Wekan board to not load at all, requiring manual fixing of database content.
 
-## Roadmap and Demo
+## Roadmap
 
-[Roadmap][roadmap_wekan] - Public read-only board at WeKan ® demo.
+[Roadmap Milestones](https://github.com/wekan/wekan/milestones)
 
 [Developer Documentation][dev_docs]
 
-- There are many companies and individuals contributing code to WeKan ®, to add features and bugfixes
-  [many times a day](https://github.com/wekan/wekan/blob/main/CHANGELOG.md).
+- There is many companies and individuals contributing code to Wekan, to add features and bugfixes
+  [many times a day](https://github.com/wekan/wekan/blob/devel/CHANGELOG.md).
 - [Please add Add new Feature Requests and Bug Reports immediately](https://github.com/wekan/wekan/issues).
-- [Commercial Support](https://wekan.fi/commercial-support/).
+- [Commercial Support](https://wekan.team).
+- [Bounties](https://wekan.team/bounties/index.html).
 
 We also welcome sponsors for features and bugfixes.
-By working directly with WeKan ® you get the benefit of active maintenance and new features added by growing WeKan ® developer community.
+By working directly with Wekan you get the benefit of active maintenance and new features added by growing Wekan developer community.
 
-## Getting Started with Development
+## Demo
 
-The main branch uses Meteor 3.5 with Node.js 24.x.
-See [CHANGELOG.md](https://github.com/wekan/wekan/blob/main/CHANGELOG.md) for the latest runtime updates.
-
-To contribute, [create a fork](https://github.com/wekan/wekan/blob/main/docs/DeveloperDocs/Build-and-Create-Pull-Request.md#2-create-fork-of-httpsgithubcomwekanwekan-at-github-web-page) and run `./build.sh` (or `./build.bat` on Windows) as detailed [here](https://github.com/wekan/wekan/blob/main/docs/DeveloperDocs/Build-and-Create-Pull-Request.md#3-install-dependencies-build-wekan-and-run-the-dev-server). Once you're ready, please test your code and [submit a pull request (PR)](https://github.com/wekan/wekan/blob/main/docs/DeveloperDocs/Build-and-Create-Pull-Request.md#7-test).
-
-Please refer to the [developer documentation](https://github.com/wekan/wekan/blob/main/docs/DeveloperDocs/Developer-Documentation.md) for more information.
-
-## First-Time Setup for Development
-
-### Prerequisites
-
-Before building WeKan from source, ensure you have:
-
-- **Git** - for cloning the repository
-- **Node.js 24.x** - WeKan requires Node.js 24.x
-- **Meteor** - the JavaScript framework WeKan is built with
-
-### Installing Node.js 24.x
-
-```bash
-# Using nvm (recommended)
-curl -o- https://raw.githubusercontent.com/nvm-sh/nvm/v0.39.0/install.sh | bash
-source ~/.zshrc  # or ~/.bashrc
-nvm install 24
-nvm use 24
-```
-
-### Installing Meteor
-
-```bash
-curl https://install.meteor.com/ | sh
-```
-
-### Building WeKan
-
-The `build.sh` script shows a two-level menu. The top level groups options into categories:
-
-```
-1) Setup   2) Dev server   3) Tests   4) Docker   5) Tools   6) Quit
-```
-
-You pick a category number, then the item number inside it (each submenu also has a `Back` entry). Building from source is a three-stage process:
-
-1. **Setup -> Install dependencies** - Downloads all required Meteor packages and npm modules
-2. **Setup -> Build WeKan** - Compiles the application
-3. **Dev server -> localhost:3000** - Starts the development server at http://localhost:3000
-
-```bash
-# Clone your fork
-git clone git@github.com:YOUR_USERNAME/wekan.git
-cd wekan
-
-# Make the script executable
-chmod +x build.sh
-
-# Step 1: Install dependencies (Setup -> Install dependencies)
-./build.sh
-# Press 1 (Setup) and Enter, then 1 (Install dependencies) and Enter
-
-# Step 2: Build WeKan (Setup -> Build WeKan, after dependencies complete)
-./build.sh
-# Press 1 (Setup) and Enter, then 2 (Build WeKan) and Enter
-
-# Step 3: Run WeKan in development mode (Dev server -> localhost:3000)
-./build.sh
-# Press 2 (Dev server) and Enter, then 1 (localhost:3000) and Enter
-```
-
-If a dev server is already running on that port, the **Dev server** options stop it automatically and start a fresh server on the same port.
- 
-
-### WSL Users
-
-WSL users can use Snap Candidate. See [install docs](https://wekan.fi/install/).
-
-The development server will start at http://localhost:3000. Any changes you make to the source code will automatically trigger a rebuild and refresh your browser.
+[Wekan demo][roadmap_wefork]
 
 ## Screenshot
 
-[More screenshots at Features page](https://github.com/wekan/wekan/tree/main/docs/Features)
+[More screenshots at Features page](https://github.com/wekan/wekan/wiki/Features)
 
-[![Screenshot of WeKan ®][screenshot_wekan]][roadmap_wekan]
+[![Screenshot of Wekan][screenshot_wefork]][roadmap_wefork]
+
+## Stable
+
+- master+devel branch. At release, devel is merged to master.
+- Receives fixes and features that have been tested at edge that they work.
+- If you want automatic updates, [use Snap](https://github.com/wekan/wekan-snap/wiki/Install).
+- If you want to test before update, [use Docker quay.io release tags](https://github.com/wekan/wekan/wiki/Docker).
+
+## Edge
+
+- edge branch. All new fixes and features are added to here first. [Testing Edge](https://github.com/wekan/wekan-snap/wiki/Snap-Developer-Docs).
 
 ## License
 
-WeKan ® is released under the very permissive [MIT license](LICENSE), and made
+Wekan is released under the very permissive [MIT license](LICENSE), and made
 with [Meteor](https://www.meteor.com).
 
-[dev_docs]: https://github.com/wekan/wekan/blob/main/docs/DeveloperDocs/Developer-Documentation.md
-[screenshot_wekan]: https://wekan.fi/wekan-dark-mode.png
+[platforms]: https://github.com/wekan/wekan/wiki/Platforms
+[dev_docs]: https://github.com/wekan/wekan/wiki/Developer-Documentation
+[screenshot_wekan]: http://i.imgur.com/cI4jW2h.png
+[screenshot_wefork]: https://wekan.github.io/wekan-markdown.png
 [features]: https://github.com/wekan/wekan/wiki/Features
-[roadmap_wekan]: https://boards.wekan.team/b/D2SzJKZDS4Z48yeQH/wekan-open-source-kanban-board-with-mit-license
+[integrations]: https://github.com/wekan/wekan/wiki/Integrations
+[roadmap_wekan]: http://try.wekan.io/b/MeSsFJaSqeuo9M6bs/wekan-roadmap
+[roadmap_wefork]: https://wekan.indie.host/b/t2YaGmyXgNkppcFBq/wekan-fork-roadmap
 [wekan_issues]: https://github.com/wekan/wekan/issues
+[wefork_issues]: https://github.com/wefork/wekan/issues
 [docker_image]: https://hub.docker.com/r/wekanteam/wekan/
-[translate_wekan]: https://app.transifex.com/wekan/wekan/
+[travis_badge]: https://travis-ci.org/wekan/wekan.svg?branch=devel
+[travis_status]: https://travis-ci.org/wekan/wekan
+[wekan_wiki]: https://github.com/wekan/wekan/wiki
+[translate_wekan]: https://www.transifex.com/wekan/wekan/
 [open_source]: https://en.wikipedia.org/wiki/Open-source_software
 [free_software]: https://en.wikipedia.org/wiki/Free_software
+[vanila_badge]: https://vanila.io/img/join-chat-button2.png
+[wekan_chat]: https://community.vanila.io/wekan
+
+
+[![FOSSA Status](https://app.fossa.io/api/projects/git%2Bgithub.com%2Fwekan%2Fwekan.svg?type=large)](https://app.fossa.io/projects/git%2Bgithub.com%2Fwekan%2Fwekan?ref=badge_large)

READMELoginSignUp.md

@@ -1,113 +0,0 @@
-# 🔐 WeKan — Login System Overview
-
-This document provides a detailed overview of WeKan’s **login and authentication system**, covering client-side UI, server-side logic, external authentication methods, and potential upgrade paths.
-
----
-
-## 🖥️ Login Web UI
-
-WeKan's login interface is implemented using a combination of:
-
-- `layouts.jade` – Login HTML structure
-- `layouts.js` – Login logic and interactivity
-- `layouts.css` – Styling and layout
-
-📁 Source: [`client/components/main`](https://github.com/wekan/wekan/tree/main/client/components/main)
-
----
-
-## ⚙️ Server-Side Authentication
-
-Server-side login functionality is handled in:
-
-- [`server/authentication.js`](https://github.com/wekan/wekan/blob/main/server/authentication.js)
-
-Other related configurations:
-
-- 🔧 Account config: [`config/accounts.js`](https://github.com/wekan/wekan/blob/main/config/accounts.js)
-- 📨 Sign-up invitations: [`models/settings.js#L275`](https://github.com/wekan/wekan/blob/main/models/settings.js#L275)
-- 👤 User creation logic: [`models/users.js#L1339`](https://github.com/wekan/wekan/blob/main/models/users.js#L1339)
-
----
-
-## 👥 Meteor User Accounts
-
-WeKan utilizes Meteor’s `accounts` system. Relevant resources:
-
-- 📚 Meteor 2.x Accounts Docs: [v2-docs.meteor.com/api/accounts](https://v2-docs.meteor.com/api/accounts)
-- 🔍 Meteor Packages:
-  - [`packages`](https://github.com/wekan/wekan/blob/main/.meteor/packages)
-  - [`versions`](https://github.com/wekan/wekan/blob/main/.meteor/versions)
-- 📦 Meteor 2.14 core packages: [Meteor 2.14 packages](https://github.com/meteor/meteor/tree/release/METEOR%402.14/packages)
-
----
-
-## 🔐 External Authentication (OIDC, LDAP, etc.)
-
-WeKan supports external authentication methods via internal packages.
-
-📁 See [`packages/`](https://github.com/wekan/wekan/tree/main/packages) for:
-- OpenID Connect (OIDC)
-- LDAP
-- OAuth and other integrations
-
----
-
-## 📦 NPM & AtmosphereJS Dependencies
-
-- 🔗 `package.json`: [Dependencies list](https://github.com/wekan/wekan/blob/main/package.json)
-- 🧩 WekanTeam scoped NPM packages: [@wekanteam on npm](https://www.npmjs.com/search?q=%40wekanteam)
-- ☁️ AtmosphereJS Meteor packages: [atmospherejs.com](https://atmospherejs.com)
-
----
-
-## 🚧 Meteor Version & Upgrade Notes
-
-- 📌 Current Version: **Meteor 2.14**
-  - [`.meteor/release`](https://github.com/wekan/wekan/blob/main/.meteor/release)
-- 🔧 Maintained with only **critical fixes** until ~Summer 2025
-- 🚀 Migration to **Meteor 3** or a new framework is under consideration
-
-📘 Meteor 3 API: [docs.meteor.com/api/accounts](https://docs.meteor.com/api/accounts)
-
----
-
-## 🧪 Prototypes & Examples
-
-### 🐘 PHP Prototype Sign-Up
-
-Used in experimental versions:
-
-- Step 1: [`sign-up1.php`](https://github.com/wekan/php/blob/main/page/sign-up1.php)
-- Step 2: [`sign-up2.php`](https://github.com/wekan/php/blob/main/page/sign-up2.php)
-- Main entry: [`index.php#L72-L83`](https://github.com/wekan/php/blob/main/public/index.php#L72-L83)
-
----
-
-### 🎨 WeKan Studio Prototype
-
-Sign-up logic in the **WeKan Studio** version:
-
-- [`signUp.fmt`](https://github.com/wekan/wekanstudio/blob/main/srv/templates/login/signUp.fmt)
-
----
-
-## 📎 Future Considerations
-
-- Upgrading to **Meteor 3.x**
-- Refactoring frontend logic to fix translation rendering order
-- Exploring **simplified authentication systems** in future prototypes
-
----
-
-## 🔗 Project Links
-
-- 🔧 Main Repo: [github.com/wekan/wekan](https://github.com/wekan/wekan)
-- 🌐 Website: [wekan.github.io](https://wekan.github.io)
-- 📚 Documentation: [Wekan Wiki](https://github.com/wekan/wekan/wiki)
-
----
-
-
-
----

SECURITY.md

@@ -1,279 +1,95 @@
-## About Money: No bounty
+Security is very important to us. If you discover any issue regarding security, please disclose
+the information responsibly by sending an email to security (at) wekan.team and not by
+creating a GitHub issue. We will respond swiftly to fix verifiable security issues.
 
-There is no bounty, like described at [CONTRIBUTING.md](CONTRIBUTING.md),
-because WeKan is NOT Big Tech. WeKan is FLOSS.
+We thank you with a place at our hall of fame page, that is
+at https://wekan.github.io/hall-of-fame . Others have just posted public GitHub issue,
+so they are not at that hall-of-fame page.
 
-## Steps for Coordinated Vulnerability Disclosure
+## How should reports be formatted?
 
-### 1. Security Researcher:
-
-- **Report**: Click "New draft security advisory" at [WeKan Security Advisories](https://github.com/wekan/wekan/security/advisories).
-  More info at [GitHub Docs about reporting privately](https://docs.github.com/en/code-security/how-tos/report-and-fix-vulnerabilities/report-privately).
-- **Proof of Concept (PoC)**: If possible, include a fix or a reproduction script/code.
-- DO NOT EMAIL [security@wekan.fi](security-at-wekan.fi.asc), because:
-  - Email is NOT secure or private.
-  - Using GitHub directly verifies that:
-    - You are:
-      - Saving my time by filling all details at GitHub, so that I can easily click request CVE at GitHub
-      - A correct GitHub user
-      - Really reading this SECURITY.md
-      - Knowing what you are doing
-    - You are not:
-      - Someone that tries to waste my time
-      - Trying to impersonate as some other GitHub user
-      - Spammer
-      - Bot
-
-### 2. WeKan Security Team:
-
-- **Remediation**: Please wait for a new WeKan release that addresses the issue.
-  Fixes are announced at the top of the [ChangeLog](https://github.com/wekan/wekan/blob/main/CHANGELOG.md).
-- **Recognition**: We will acknowledge your contribution by adding you to our
-  [Hall of Fame](https://wekan.fi/hall-of-fame/).
-- **CVE Policy**: WeKan Security requests CVE at GitHub when releasing Security Advisory.
-
-### 3. Post-Release and Public Disclosure:
-
-- Advisories reported at GitHub are listed at [WeKan Security Advisories](https://github.com/wekan/wekan/security/advisories).
-- DO NOT EMAIL [security@wekan.fi](security-at-wekan.fi.asc), because:
-  - Email is NOT secure or private.
-  - Using GitHub directly verifies that:
-    - You are:
-      - Saving my time by filling all details at GitHub, so that I can easily click request CVE at GitHub
-      - A correct GitHub user
-      - Really reading this SECURITY.md
-      - Knowing what you are doing
-    - You are not:
-      - Someone that tries to waste my time
-      - Trying to impersonate as some other GitHub user
-      - Spammer
-      - Bot
+```
+Name: %name
+Twitter: %twitter
+Bug type: %bugtype
+Domain: %domain
+Severity: %severity
+URL: %url
+PoC: %poc
+CVSS (optional): %cvss
+CWSS (optional): %cwss
+```
 
 ## Who can participate in the program
 
 Anyone who reports a unique security issue in scope and does not disclose it to
-a third party before we have patched, and is able to add
-"New draft security advisory" at [WeKan Security Advisories](https://github.com/wekan/wekan/security/advisories).
+a third party before we have patched and updated may be upon their approval
+added to the Wekan Hall of Fame.
 
 ## Which domains are in scope?
 
-No public domains, because all those are donated to WeKan Open Source project,
-and we don't have any permissions to do security scans on those donated servers.
+No public domains, because all those are donated to Wekan Open Source project,
+and we don't have any permissions to do security scans on those donated servers
 
-Please don't perform research that could impact other users. Second, please keep
-the reports short and succinct. If we fail to understand the logic of your bug, we will tell you.
+Please don't perform research that could impact other users. Secondly, please keep
+the reports short and succinct. If we fail to understand the logics of your bug, we will tell you.
 
-You can [Install WeKan](https://wekan.fi/install/) on your own computer
+You can [Install Wekan](https://github.com/wekan/wekan/releases) to your own computer
 and scan it's vulnerabilities there.
 
-## About WeKan Versions
+## About Wekan versions
 
-There are 2 versions of WeKan: Standalone WeKan, and Sandstorm WeKan.
+There are only 2 versions of Wekan: Standalone Wekan, and Sandstorm Wekan.
 
-## Meteor Security
+### Standalone Wekan Security
 
-https://guide.meteor.com/security
-
-### Standalone WeKan Security
-
-Standalone WeKan includes all non-Sandstorm platforms. Some Standalone WeKan platforms
+Standalone Wekan includes all non-Sandstorm platforms. Some Standalone Wekan platforms
 like Snap and Docker have their own specific sandboxing etc features.
 
-Standalone WeKan by default does not load any files from Internet, like fonts, CSS, etc.
-This also means all Standalone WeKan functionality works in offline local networks.
-WeKan is used in most countries of the world https://snapcraft.io/wekan
-and by companies that have 30k users.
+Standalone Wekan by default does not load any files from Internet, like fonts, CSS, etc.
+This also means all Standalone Wekan functionality works in offline local networks.
+Wekan is used by companies that have [thousands of users](https://github.com/wekan/wekan/wiki/AWS) and at healthcare.
 
-- WeKan private board attachments are not accessible without logging in.
-- There is feature to set board public, so that board is visible without logging
-  in readonly mode, with realtime updates.
-- Admin Panel has feature to disable all public boards, so all boards are private.
+Wekan uses xss package for input fields like cards, as you can see from
+[package.json](https://github.com/wekan/wekan/blob/devel/package.json). Other used versions can be seen from
+[Meteor versions file](https://github.com/wekan/wekan/blob/devel/.meteor/versions).
+Forms can include markdown links, html, image tags etc like you see at https://wekan.github.io .
+It's possible to add attachments to cards, and markdown/html links to files.
 
-## SSL/TLS
+Wekan attachments are not accessible without logging in. Import from Trello works by copying
+Trello export JSON to Wekan Trello import page, and in Trello JSON file there is direct links to all publicly
+accessible Trello attachment files, that Standalone Wekan downloads directly to Wekan MongoDB database in
+[CollectionFS](https://github.com/wekan/wekan/pull/875) format. When Wekan board is exported in
+Wekan JSON format, all board attachments are included in Wekan JSON file as base64 encoded text.
+That Wekan JSON format file can be imported to Sandstorm Wekan with all the attachments, when we get
+latest Wekan version working on Sandstorm, only couple of bugs are left before that. In Sandstorm it's not
+possible yet to import from Trello with attachments, because Wekan does not implement Sandstorm-compatible
+access to outside of Wekan grain.
 
-- SSL/TLS encrypts traffic between webbrowser and webserver.
-- If you are thinking about TLS MITM, look at https://github.com/caddyserver/caddy/issues/2530
-- Let's Encrypt TLS requires publicly accessible webserver, that Let's Encrypt TLS validation servers check.
-- If firewall limits to only allowed IP addresses, you may need non-Let's Encrypt TLS cert.
+Standalone Wekan only has password auth currently, there is work in progress to add
+[oauth2](https://github.com/wekan/wekan/pull/1578), [Openid](https://github.com/wekan/wekan/issues/538),
+[LDAP](https://github.com/wekan/wekan/issues/119) etc. If you need more login security for Standalone Wekan now,
+it's possible add additional [Google Auth proxybouncer](https://github.com/wekan/wekan/wiki/Let's-Encrypt-and-Google-Auth) in front of password auth, and then use Google Authenticator for Google Auth. Standalone Wekan does have [brute force protection with eluck:accounts-lockout and browser-policy clickjacking protection](https://github.com/wekan/wekan/blob/devel/CHANGELOG.md#v080-2018-04-04-wekan-release). You can also optionally use some [WAF](https://en.wikipedia.org/wiki/Web_application_firewall)
+like for example [AWS WAF](https://aws.amazon.com/waf/).
 
-## XSS
+[All Wekan Platforms](https://github.com/wekan/wekan/wiki/Platforms)
 
-- DOMPurify https://www.npmjs.com/package/dompurify
-  - WeKan uses DOMPurify npm package to filter for XSS at fields like cards, as you can see from
-    [package.json](https://github.com/wekan/wekan/blob/main/package.json). Other used versions can be seen from
-    [Meteor versions file](https://github.com/wekan/wekan/blob/main/.meteor/versions).
-  - Forms can include markdown links, html, image tags etc like you see at https://wekan.fi .
-  - It's possible to add attachments to cards, and markdown/html links to files.
-  - DOMPurify cleans up viewed code, so JavaScript in input fields does not execute
-    - https://wekan.fi/hall-of-fame/fieldbleed/
-- Reaction in comment is now checked, that it does not have extra added code
-  - https://wekan.fi/hall-of-fame/reactionbleed/
-- https://github.com/wekan/wekan/blob/main/packages/markdown/src/template-integration.js#L76
+### Sandstorm Wekan Security
 
-## QA About PubSub
+On Sandstorm platform using environment variable Standalone Wekan features like Admin Panel etc are
+turned off, because Sandstorm platform provides SSO for all apps running on Sandstorm. 
 
-Q:
-
-Hello,
-I have just seen the Meteor DevTools Evolved extension and was wondering if anyone
-had asked themselves the question of security.
-Insofar as all data is shown in the minimongo tab in plain text.
-How can data be hidden from this extension?
-
-A:
-
-## PubSub
-
-- It is not a security issue to show text or images that the user has permission to see.
-  It is a security issue, if browserside is some text or image that user should not see.
-- Meteor has browserside minimongo database, made with JavaScript, updated with Publish/Subscribe, PubSub.
-- Publish/Subscribe means, that realtime web framework reads database changes stream,
-  and then immediately updates webpage, like dashboards, chat, kanban.
-  That is the point of any realtime web framework in any programming language.
-- Yes, you should check with Meteor DevTools Evolved Chromium/Firefox extension that
-  at minimongo is only text that user has permission to see.
-- Check as a logged-in user and as a logged-out user.
-- Check permissions and sanitize before allowing some change, because someone could modify content of input field,
-  PubSub/websocket data (for example with Burp Suite Community Edition), etc.
-- If you have a REST API, also check that only those who have a login token and permission can view or edit text.
-- You should not include any data user is not allowed to see. Not to webpage text, not to websockets/PubSub, etc.
-- Minimongo should not have password hashes PubSub https://wekan.fi/hall-of-fame/userbleed/
-- PubSub uses WebSockets, so you need those to be enabled on the webserver like Caddy/Nginx/Apache etc, examples of settings
-  at right menu of https://github.com/wekan/wekan/wiki
-- Clientside https://github.com/wekan/wekan/tree/main/client/components subscribes to
-  PubSub https://github.com/wekan/wekan/tree/main/server/publications or calls meteor methods
-  at https://github.com/wekan/wekan/tree/main/models
-- For Admin:
-  - You can have input field for password https://github.com/wekan/wekan/blob/main/client/components/cards/attachments.js#L303-L312
-  - You can save password to database https://github.com/wekan/wekan/blob/main/client/components/cards/attachments.js#L303-L312
-  - Check that only current user or Admin can change password https://github.com/wekan/wekan/blob/main/client/components/cards/attachments.js#L303-L312
-    - Note that currentUser uses code like Meteor.user() in .js file
-  - Do not include password hashes in PubSub https://github.com/wekan/wekan/blob/main/server/publications/users.js
-  - Only show Admin Panel to Admin https://github.com/wekan/wekan/blob/main/client/components/settings/settingBody.jade#L3
-- If there is a large amount of data, use pagination https://github.com/wekan/wekan/blob/main/client/components/settings/peopleBody.js
-- Only publish a limited amount of data in PubSub. Limit in MongoDB query in publications how much is published. Too much could make browser too slow.
-- Environment variables for email and other passwords.
-- But what if you would like to remove Minimongo and only use Meteor methods for saving? In that case, you don't have realtime updates,
-  and you need to write much more code to load and save data yourself, handle any multi user data saving conflicts yourself,
-  and many Meteor Atmospherejs.com PubSub using packages would not work anymore https://github.com/wekan/we
-
-## PubSub: Fix that user can not change to Admin
-
-- With PubSub, there is checking, that someone modifying Websockets content, like permission isAdmin, can not change to Admin.
-- https://github.com/wekan/wekan/commit/cbad4cf5943d47b916f64b4582f8ca76a9dfd743
-- https://wekan.fi/hall-of-fame/adminbleed/
-
-## Permissions and Roles
-
-- For any user permissions, it's best to use Meteor package https://github.com/Meteor-Community-Packages/meteor-roles .
-- Currently, WeKan has custom hardcoded permissions and does not yet use the meteor-roles package.
-  - Using permissions at WeKan sidebar https://github.com/wekan/wekan/blob/main/client/components/sidebar/sidebar.js#L1854-L1875
-  - List of roles: https://github.com/wekan/wekan/wiki/REST-API-Role . Change at board or Admin Panel. Also Organizations/Teams.
-  - Worker role: https://github.com/wekan/wekan/issues/2788
-  - Not implemented yet: Granular Roles https://github.com/wekan/wekan/issues/3022
-- Check is user logged in, with `if (Meteor.user()) {`
-- Check is code running at server `if (Meteor.isServer()) {` or client `if Meteor.isClient()) {` .
-- Here is some authentication code https://github.com/wekan/wekan/blob/main/server/authentication.js
-
-## Environment variables
-
-- For any passwords, use environment variables; those are serverside
-- Do not copy environment variables to public variables that are visible on the browserside https://github.com/wekan/wekan/blob/main/server/max-size.js
-
-```
-Meteor.startup(() => {
-  if (process.env.HEADER_LOGIN_ID) {
-    Meteor.settings.public.attachmentsUploadMaxSize   = process.env.ATTACHMENTS_UPLOAD_MAX_SIZE;
-    Meteor.settings.public.attachmentsUploadMimeTypes = process.env.ATTACHMENTS_UPLOAD_MIME_TYPES;
-    Meteor.settings.public.avatarsUploadMaxSize       = process.env.AVATARS_UPLOAD_MAX_SIZE;
-```
-
-- For serverside, you can set Meteor.settings.variablename, without text public
-- For WeKan kanban, there is a feature for setting a board to public; it can be viewed by anyone, with realtime updates. But
-- Some of those permissions are checked at users.js models at https://github.com/wekan/wekan/tree/main/models
-- Environment variables are used for email server passwords, etc, at all platforms https://github.com/wekan/wekan/commit/a781c0e7dcfdbe34c1483ee83cec12455b7026f7
-
-## Escape HTML comment tags so that HTML comments are visible
-
-- Someone reported that it was a problem that the content of HTML comments in edit mode was not visible in view mode, so this change makes HTML comments visible.
-- https://github.com/wekan/wekan/commit/167863d95711249e69bb3511175d73b34acbbdb3
-- https://wekan.fi/hall-of-fame/invisiblebleed/
-
-## Attachments: XSS in filename is sanitized
-
-- https://github.com/wekan/wekan/blob/main/client/components/cards/attachments.js#L303-L312
-- https://wekan.fi/hall-of-fame/filebleed/
-
-### Attachments: Forced download to prevent stored XSS
-
-- To prevent browser-side execution of uploaded content under the app origin, all attachment downloads are served with safe headers:
-  - `Content-Type: application/octet-stream`
-  - `Content-Disposition: attachment`
-  - `X-Content-Type-Options: nosniff`
-  - A restrictive `Content-Security-Policy` with `sandbox`
-- This means attachments are downloaded instead of rendered inline by default. This mitigates HTML/JS/SVG based stored XSS vectors.
-- Avatars and inline images remain supported but SVG uploads are blocked and never rendered inline.
-
-## Users: Client update restrictions
-
-- Client-side updates to user documents are limited to safe fields only:
-  - `username`
-  - `profile.*`
-- Sensitive fields are blocked from any client updates and can only be modified by server methods with authorization:
-  - `orgs`, `teams`, `roles`, `isAdmin`, `createdThroughApi`, `loginDisabled`, `authenticationMethod`, `services.*`, `emails.*`, `sessionData.*`
-- Attempts to update forbidden fields from the client are denied.
-- Admin operations like managing org/team membership or toggling flags must use server methods that check permissions.
-
-## Voting: integrity and authorization
-
-- Client updates to card `vote` fields are blocked to prevent forged votes and inconsistent policy enforcement.
-- Voting is performed via a server method that enforces:
-  - Authentication and board membership, or an explicit per-card flag allowing non-members to vote.
-  - Only the caller's own userId is added/removed from `vote.positive`/`vote.negative`.
-- This prevents members from fabricating other users' votes and ensures non-members cannot vote unless explicitly allowed.
-
-## Planning Poker: integrity and authorization
-
-- Client updates to card `poker` fields are blocked. All poker actions go through server methods that enforce:
-  - Authentication and board membership for configuration and results.
-  - For casting a poker vote, either board membership or an explicit per-card flag allowing non-members to participate.
-  - Only the caller's own userId is added/removed from the selected estimation bucket (e.g., one, two, five, etc.).
-- Methods cover setting/unsetting poker question/end, casting votes, replaying, and setting final estimation.
-
-## Attachment API: authentication and DoS prevention
-
-- The attachment API (`/api/attachment/*`) requires proper authentication using `X-User-Id` and `X-Auth-Token` headers.
-- Authentication validates tokens by hashing with `Accounts._hashLoginToken` and matching against stored login tokens, preventing identity spoofing.
-- Request handlers implement:
-  - 30-second timeout to prevent hanging connections.
-  - Request body size limits (50MB for uploads, 10MB for metadata operations).
-  - Proper error handling and guaranteed response completion.
-  - Request error event handlers to clean up failed connections.
-- This prevents:
-  - DoS attacks via concurrent unauthenticated or malformed requests.
-  - Identity spoofing by using arbitrary bearer tokens or user IDs.
-  - Resource exhaustion from hanging connections or excessive payloads.
-- Access control: all attachment operations verify board membership before allowing access.
-
-## Brute force login protection
-
-- https://github.com/wekan/wekan/commit/23e5e1e3bd081699ce39ce5887db7e612616014d
-- https://github.com/wekan/wekan/tree/main/packages/wekan-accounts-lockout
-
-### Sandstorm WeKan Security
-
-On the Sandstorm platform, Standalone WeKan features like the Admin Panel are turned off using environment variables, because Sandstorm platform provides SSO for all apps running on Sandstorm.
-
-[Sandstorm](https://sandstorm.io) is a separate Open Source platform that has been
+[Sandstorm](https://sandstorm.io) is separate Open Source platform that has been
 [security audited](https://sandstorm.io/news/2017-03-02-security-review) and found bugs fixed.
-Sandstorm also has passwordless login, LDAP, SAML, Google, and other auth options already.
-On Sandstorm, code is read-only and signed by app maintainers; only grain content can be modified.
-WeKan on Sandstorm runs in a sandboxed grain; it does not have access elsewhere without a user-visible PowerBox request or opening a randomly-generated API key URL.
+Sandstorm also has passwordless login, LDAP, SAML, Google etc auth options already.
+At Sandstorm code is read-only and signed by app maintainers, only grain content can be modified.
+Wekan at Sandstorm runs in sandboxed grain, it does not have access elsewhere without user-visible
+PowerBox request or opening randomly-generated API key URL.
 Also read [Sandstorm Security Practices](https://docs.sandstorm.io/en/latest/using/security-practices/) and
 [Sandstorm Security non-events](https://docs.sandstorm.io/en/latest/using/security-non-events/).
-For Sandstorm specific security issues you can contact [kentonv](https://github.com/kentonv) by email.
+For Sandstorm specific security issues you can contact [kentonv](https://github.com/kentonv) by email. 
 
-## What WeKan bugs are eligible?
+## What Wekan bugs are eligible?
 
 Any typical web security bugs. If any of the previously mentioned is somehow problematic and
 a security issue, we'd like to know about it, and also how to fix it:
@@ -285,12 +101,29 @@ a security issue, we'd like to know about it, and also how to fix it:
 - Authentication bypass
 - Server-side code execution
 
-## What WeKan bugs are NOT eligible?
+## What Wekan bugs are NOT eligible?
 
-Typical already-known or 'no impact' bugs such as:
+Typical already known or "no impact" bugs such as:
 
+- Brute force password guessign. Currently there is
+  [brute force protection with eluck:accounts-lockout](https://github.com/wekan/wekan/blob/devel/CHANGELOG.md#v080-2018-04-04-wekan-release).
+- Security issues related to that Wekan uses Meteor 1.6.0.1 related packages, and upgrading to newer
+  Meteor 1.6.1 is complicated process that requires lots of changes to many dependency packages.
+  Upgrading [has been tried many times, spending a lot of time](https://github.com/meteor/meteor/issues/9609)
+  but there still is issues. Helping with package upgrades is very welcome.
+- [Wekan API old tokens not replaced correctly](https://github.com/wekan/wekan/issues/1437)
+- Missing Cookie flags on non-session cookies or 3rd party cookies
+- Logout CSRF
 - Social engineering
 - Denial of service
-- SSL BEAST/CRIME/etc. WeKan does not have SSL built-in; it uses Caddy/Nginx/Apache on the front end.
+- SSL BEAST/CRIME/etc. Wekan does not have SSL built-in, it uses Caddy/Nginx/Apache etc at front.
+  Integrated Caddy support is updated often.
+- Email spoofing, SPF, DMARC & DKIM. Wekan does not include email server.
 
-WeKan is Open Source with MIT license, and free to use also for commercial use.
+Wekan is Open Source with MIT license, and free to use also for commercial use.
+We welcome all fixes to improve security by email to security (at) wekan.team .
+
+## Bonus Points
+
+If your Responsible Security Disclosure includes code for fixing security issue,
+you get bonus points, as seen on [Hall of Fame](https://wekan.github.io/hall-of-fame).

Stackerfile.yml

@@ -1,5 +1,5 @@
 appId: wekan-public/apps/77b94f60-dec9-0136-304e-16ff53095928
-appVersion: "v10.78.0"
+appVersion: "v2.97.0"
 files:
   userUploads:
     - README.md

client/00-startup.js

@@ -1,183 +0,0 @@
-// Fix dynamic-import chunk loading when Wekan runs under a sub-path (ROOT_URL includes a pathname,
-// e.g. https://example.com/wekan). Rspack's runtime builds every chunk URL as
-// __webpack_public_path__ + chunkName, and the chunk name ALREADY includes the "build-chunks/"
-// prefix (its runtime does `u = e => "build-chunks/" + e + "." + hash + ".js"`). The default
-// public path is "/", so at the site root chunks correctly resolve to "/build-chunks/<chunk>".
-// Under a sub-path we must prefix that sub-path — but must NOT re-add "build-chunks/" ourselves,
-// or the URL becomes "/wekan/build-chunks/build-chunks/<chunk>" and 404s (issue #6445, which broke
-// the lazy-loaded language chunks). So set the public path to "<sub-path>/" and let rspack append
-// "build-chunks/" itself. Done here at module evaluation time, before any import() expression runs
-// (those are deferred to Meteor.startup callbacks).
-/* global __webpack_public_path__:writable */
-try {
-  const _cfg = typeof window !== 'undefined' && window.__meteor_runtime_config__;
-  const _rootUrl = _cfg && _cfg.ROOT_URL;
-  if (_rootUrl) {
-    const _rootPath = new URL(_rootUrl).pathname.replace(/\/+$/, '');
-    if (_rootPath && _rootPath !== '/') {
-      __webpack_public_path__ = _rootPath + '/';
-    }
-  }
-} catch (_) {}
-
-// Expose Meteor on window. Under the Meteor 3.5 + rspack build, bare `Meteor`
-// references in app code are rewritten by rspack's ProvidePlugin into per-module
-// imports, so `Meteor` is NOT placed on the browser `window` the way the classic
-// Meteor linker did. Re-expose it so the browser console and the Playwright e2e
-// tests (which call Meteor.loginWithToken / Meteor.userId / Meteor.subscribe etc.
-// via page.evaluate in window scope) can reach it. This matches the long-standing
-// classic-Meteor behaviour where `Meteor` is a global.
-if (typeof window !== 'undefined') {
-  window.Meteor = Meteor;
-}
-
-// Fix bug in jam:offline 0.4.1: s?.message.includes() crashes when s.message is
-// undefined (e.g. during WebSocket reconnect errors that don't carry a .message).
-// Wrap _debug so the optional chain is complete: s?.message?.includes().
-(function patchJamOfflineDebug() {
-  const patched = Meteor._debug;
-  Meteor._debug = function (m, s) {
-    try {
-      return patched.call(this, m, s);
-    } catch (e) {
-      // jam:offline's override threw — fall back to the bare console log.
-      if (typeof console !== 'undefined') {
-        console.log(m, s);
-      }
-    }
-  };
-})();
-
-// PWA — use Meteor.absoluteUrl so the path is correct under sub-URL deployments
-if ('serviceWorker' in navigator) {
-  window.addEventListener('load', function() {
-    const swPath = new URL('pwa-service-worker.js', Meteor.absoluteUrl()).pathname;
-    navigator.serviceWorker.register(swPath);
-  });
-}
-
-// Import Blaze helpers (replaces removed raix:handlebar-helpers package)
-import '/client/config/blazeHelpers';
-
-// Import board converter for on-demand conversion
-import '/client/lib/boardConverter';
-import '/client/features/boardConversion';
-import { Utils } from '/client/lib/utils';
-
-// Import migration manager and progress UI - COMMENTED OUT
-// import '/client/lib/attachmentMigrationManager';
-// import '/client/components/settings/migrationProgress';
-
-// Custom head tags
-
-// Mirror Meteor login token into a cookie for server-side file route auth
-// This enables cookie-based auth for /cdn/storage/* without leaking ROOT_URL
-// Token already lives in localStorage; cookie adds same-origin send-on-request semantics
-Meteor.startup(() => {
-  const COOKIE_NAME = 'meteor_login_token';
-  const USER_ID_COOKIE = 'meteor_user_id';
-  const TOKEN_EXPIRES_COOKIE = 'meteor_login_token_expires';
-
-  const getCookie = (name) => {
-    try {
-      const parts = document.cookie ? document.cookie.split(';') : [];
-      for (const part of parts) {
-        const [k, ...rest] = part.trim().split('=');
-        if (decodeURIComponent(k) === name) {
-          return decodeURIComponent(rest.join('='));
-        }
-      }
-    } catch (_) {}
-    return '';
-  };
-
-  const cookieAttrs = () => {
-    const attrs = ['Path=/', 'SameSite=Lax'];
-    try {
-      if (window.location && window.location.protocol === 'https:') {
-        attrs.push('Secure');
-      }
-    } catch (_) {}
-    return attrs.join('; ');
-  };
-
-  const setCookie = (name, value) => {
-    if (!value) return;
-    document.cookie = `${encodeURIComponent(name)}=${encodeURIComponent(value)}; ${cookieAttrs()}`;
-  };
-  const clearCookie = (name) => {
-    document.cookie = `${encodeURIComponent(name)}=; Expires=Thu, 01 Jan 1970 00:00:00 GMT; ${cookieAttrs()}`;
-  };
-
-  const syncCookie = () => {
-    try {
-      const token = Accounts && typeof Accounts._storedLoginToken === 'function' ? Accounts._storedLoginToken() : null;
-      if (token) setCookie(COOKIE_NAME, token); else clearCookie(COOKIE_NAME);
-    } catch (e) {
-      // ignore
-    }
-  };
-
-  const bootstrapTokenFromCookie = () => {
-    try {
-      const currentToken = Accounts && typeof Accounts._storedLoginToken === 'function'
-        ? Accounts._storedLoginToken()
-        : null;
-      if (currentToken) {
-        return;
-      }
-
-      const token = getCookie(COOKIE_NAME);
-      const userId = getCookie(USER_ID_COOKIE);
-      const tokenExpiresRaw = getCookie(TOKEN_EXPIRES_COOKIE);
-      const tokenExpires = tokenExpiresRaw ? new Date(tokenExpiresRaw) : null;
-
-      if (!token || !userId || !tokenExpires || Number.isNaN(tokenExpires.getTime())) {
-        return;
-      }
-
-      if (Accounts && typeof Accounts._storeLoginToken === 'function') {
-        Accounts._storeLoginToken(userId, token, tokenExpires);
-        if (Meteor.status && !Meteor.status().connected && typeof Meteor.reconnect === 'function') {
-          Meteor.reconnect();
-        }
-      }
-    } catch (_) {
-      // ignore
-    }
-  };
-
-  bootstrapTokenFromCookie();
-
-  // Initial sync on startup
-  syncCookie();
-
-  // Keep cookie in sync on login/logout
-  if (Accounts && typeof Accounts.onLogin === 'function') Accounts.onLogin(syncCookie);
-  if (Accounts && typeof Accounts.onLogout === 'function') Accounts.onLogout(syncCookie);
-
-  // Sync across tabs/windows when localStorage changes
-  window.addEventListener('storage', (ev) => {
-    if (ev && typeof ev.key === 'string' && ev.key.indexOf('Meteor.loginToken') !== -1) {
-      syncCookie();
-    }
-  });
-
-});
-
-// Subscribe to per-user small publications
-Meteor.startup(() => {
-  Tracker.autorun(() => {
-    if (Meteor.userId()) {
-      Meteor.subscribe('userDesktopDragHandles');
-    }
-  });
-
-  // Initialize mobile mode on startup for iOS devices
-  // This ensures mobile mode is applied correctly on page load
-  Tracker.afterFlush(() => {
-    if (typeof Utils !== 'undefined' && Utils.initializeUserSettings) {
-      Utils.initializeUserSettings();
-    }
-  });
-});

client/components/activities/activities.css

@@ -1,78 +0,0 @@
-.activity-title {
-  margin: 0 10px 9px;
-  display: flex;
-  justify-content: space-between;
-}
-.reactions-popup .add-comment-reaction {
-  display: inline-block;
-  cursor: pointer;
-  border-radius: 10px;
-  font-size: 18px;
-  text-align: center;
-  line-height: 1.3;
-  width: 70px;
-}
-.reactions-popup .add-comment-reaction:hover {
-  background-color: #b0c4de;
-}
-/* Eye / eye-slash icon toggle for showing/hiding activities. Open eye
-   (.eye-icon) = activities shown; crossed eye (.eye-slash-icon) = hidden.
-   Matches the password-visibility toggle used on the login/register pages. */
-.activities-eye-toggle {
-  cursor: pointer;
-  display: inline-flex;
-  align-items: center;
-  gap: 0.4em;
-  text-decoration: none;
-}
-.activities-eye-toggle .eye-icon,
-.activities-eye-toggle .eye-slash-icon {
-  line-height: 1;
-}
-.activities {
-  clear: both;
-}
-.activities .activity {
-  margin: 1px 0;
-  padding: 7px 0;
-  display: flex;
-}
-.activities .activity .member {
-  width: 56px;
-  height: 56px;
-}
-.activities .activity .activity-member {
-  font-weight: 700;
-}
-.activities .activity .activity-desc {
-  word-wrap: break-word;
-  overflow: hidden;
-  flex: 1;
-  align-self: center;
-  margin: 0;
-  margin-inline-start: 6px;
-  overflow: hidden;
-  word-break: break-word;
-}
-.activities .activity .activity-desc .activity-comment {
-  display: block;
-  border-radius: 6px;
-  background: #fff;
-  text-decoration: none;
-  box-shadow: 0 2px 3px rgba(0,0,0,0.2);
-  margin-top: 6px;
-  padding: 6px 10px;
-}
-.activities .activity .activity-desc .activity-checklist {
-  display: block;
-  border-radius: 3px;
-  background: #fff;
-  text-decoration: none;
-  box-shadow: 0 1px 2px rgba(0,0,0,0.2);
-  margin-top: 5px;
-  padding: 5px;
-}
-.activities .activity .activity-desc .activity-meta {
-  font-size: 0.8em;
-  color: #999;
-}

client/components/activities/activities.jade

@@ -1,209 +1,223 @@
 template(name="activities")
-  if showActivities
-    .activities.js-sidebar-activities
-      //- We should use Template.dynamic here but there is a bug with
-      //- blaze-components: https://github.com/peerlibrary/meteor-blaze-components/issues/30
-      if $eq mode "board"
-        +boardActivities
-      else
-        +cardActivities
+  .activities.js-sidebar-activities
+    //- We should use Template.dynamic here but there is a bug with
+    //- blaze-components: https://github.com/peerlibrary/meteor-blaze-components/issues/30
+    if $eq mode "board"
+      +boardActivities
+    else
+      +cardActivities
 
 template(name="boardActivities")
-  each activityData in boardActivitiesList
-    +activity(activity=activityData card=card mode=mode)
+  each currentBoard.activities
+    .activity
+      +userAvatar(userId=user._id)
+      p.activity-desc
+        +memberName(user=user)
+
+        if($eq activityType 'deleteAttachment')
+          | {{{_ 'activity-delete-attach' cardLink}}}.
+
+        if($eq activityType 'addAttachment')
+          | {{{_ 'activity-attached' attachmentLink cardLink}}}.
+
+        if($eq activityType 'addBoardMember')
+          | {{{_ 'activity-added' memberLink boardLabel}}}.
+
+        if($eq activityType 'addComment')
+          | {{{_ 'activity-on' cardLink}}}
+          a.activity-comment(href="{{ card.absoluteUrl }}")
+            +viewer
+              = comment.text
+
+        if($eq activityType 'addChecklist')
+          | {{{_ 'activity-checklist-added' cardLink}}}.
+          .activity-checklist(href="{{ card.absoluteUrl }}")
+            +viewer
+              = checklist.title
+        if($eq activityType 'removeChecklist')
+          | {{{_ 'activity-checklist-removed' cardLink}}}.
+
+        if($eq activityType 'checkedItem')
+          | {{{_ 'activity-checked-item' checkItem checklist.title cardLink}}}.
+
+        if($eq activityType 'uncheckedItem')
+          | {{{_ 'activity-unchecked-item' checkItem checklist.title cardLink}}}.
+
+        if($eq activityType 'checklistCompleted')
+          | {{{_ 'activity-checklist-completed' checklist.title cardLink}}}.
+
+        if($eq activityType 'checklistUncompleted')
+          | {{{_ 'activity-checklist-uncompleted' checklist.title cardLink}}}.
+
+        if($eq activityType 'addChecklistItem')
+          | {{{_ 'activity-checklist-item-added' checklist.title cardLink}}}.
+          .activity-checklist(href="{{ card.absoluteUrl }}")
+            +viewer
+              = checklistItem.title
+        if($eq activityType 'removedChecklistItem')
+          | {{{_ 'activity-checklist-item-removed' checklist.title cardLink}}}.
+
+        if($eq activityType 'archivedCard')
+          | {{{_ 'activity-archived' cardLink}}}.
+
+        if($eq activityType 'archivedList')
+          | {{_ 'activity-archived' list.title}}.
+
+        if($eq activityType 'archivedSwimlane')
+          | {{_ 'activity-archived' swimlane.title}}.
+
+        if($eq activityType 'createBoard')
+          | {{_ 'activity-created' boardLabel}}.
+
+        if($eq activityType 'createCard')
+          | {{{_ 'activity-added' cardLink boardLabel}}}.
+
+        if($eq activityType 'createCustomField')
+          | {{_ 'activity-customfield-created' customField}}.
+
+        if($eq activityType 'createList')
+          | {{_ 'activity-added' list.title boardLabel}}.
+
+        if($eq activityType 'createSwimlane')
+          | {{_ 'activity-added' swimlane.title boardLabel}}.
+
+        if($eq activityType 'removeList')
+          | {{_ 'activity-removed' title boardLabel}}.
+
+        if($eq activityType 'importBoard')
+          | {{{_ 'activity-imported-board' boardLabel sourceLink}}}.
+
+        if($eq activityType 'importCard')
+          | {{{_ 'activity-imported' cardLink boardLabel sourceLink}}}.
+
+        if($eq activityType 'importList')
+          | {{{_ 'activity-imported' listLabel boardLabel sourceLink}}}.
+
+        if($eq activityType 'joinMember')
+          if($eq user._id member._id)
+            | {{{_ 'activity-joined' cardLink}}}.
+          else
+            | {{{_ 'activity-added' memberLink cardLink}}}.
+
+        if($eq activityType 'moveCardBoard')
+          | {{{_ 'activity-moved' cardLink oldBoardName boardName}}}.
+
+        if($eq activityType 'moveCard')
+          | {{{_ 'activity-moved' cardLink oldList.title list.title}}}.
+
+        if($eq activityType 'removeBoardMember')
+          | {{{_ 'activity-excluded' memberLink boardLabel}}}.
+
+        if($eq activityType 'restoredCard')
+          | {{{_ 'activity-sent' cardLink boardLabel}}}.
+
+        if($eq activityType 'addedLabel')
+          | {{{_ 'activity-added-label' lastLabel cardLink}}}.
+
+        if($eq activityType 'removedLabel')
+          | {{{_ 'activity-removed-label' lastLabel cardLink}}}.
+
+        if($eq activityType 'setCustomField')
+          | {{{_ 'activity-set-customfield' lastCustomField lastCustomFieldValue cardLink}}}.
+
+        if($eq activityType 'unsetCustomField')
+          | {{{_ 'activity-unset-customfield' lastCustomField cardLink}}}.
+
+        if($eq activityType 'unjoinMember')
+          if($eq user._id member._id)
+            | {{{_ 'activity-unjoined' cardLink}}}.
+          else
+            | {{{_ 'activity-removed' memberLink cardLink}}}.
+
+        span(title=createdAt).activity-meta {{ moment createdAt }}
 
 template(name="cardActivities")
-  each activityData in cardActivitiesList
-    +activity(activity=activityData card=card mode=mode)
+  each currentCard.activities
+    .activity
+      +userAvatar(userId=user._id)
+      p.activity-desc
+        +memberName(user=user)
+        if($eq activityType 'createCard')
+          | {{_ 'activity-added' cardLabel listName}}.
+        if($eq activityType 'importCard')
+          | {{{_ 'activity-imported' cardLabel list.title sourceLink}}}.
+        if($eq activityType 'joinMember')
+          if($eq user._id member._id)
+            | {{_ 'activity-joined' cardLabel}}.
+          else
+            | {{{_ 'activity-added' memberLink cardLabel}}}.
+        if($eq activityType 'unjoinMember')
+          if($eq user._id member._id)
+            | {{_ 'activity-unjoined' cardLabel}}.
+          else
+            | {{{_ 'activity-removed' cardLabel memberLink}}}.
+        if($eq activityType 'archivedCard')
+          | {{_ 'activity-archived' cardLabel}}.
 
-template(name="activity")
-  .activity(data-id=activity._id)
-    +userAvatar(userId=activity.user._id)
-    p.activity-desc
-      span.activity-member
-        +memberName(user=activity.user)
+        if($eq activityType 'addedLabel')
+          | {{{_ 'activity-added-label-card' lastLabel }}}.
 
-      //- attachment activity -------------------------------------------------
-      if($eq activity.activityType 'deleteAttachment')
-        | {{{_ 'activity-delete-attach' cardLink}}}.
+        if($eq activityType 'removedLabel')
+          | {{{_ 'activity-removed-label-card' lastLabel }}}.
 
-      if($eq activity.activityType 'addAttachment')
-        | {{{_ 'activity-attached' attachmentLink cardLink}}}.
-        if($neq mode 'board')
-          if activity.attachment.isImage
-            img.attachment-image-preview(src=activity.attachment.url)
+        if($eq activityType 'removeChecklist')
+          | {{{_ 'activity-checklist-removed' cardLabel}}}.
 
-      //- board activity ------------------------------------------------------
-      if($eq activity.activityType 'createBoard')
-        | {{{_ 'activity-created' boardLabelLink}}}.
+        if($eq activityType 'checkedItem')
+          | {{{_ 'activity-checked-item-card' checkItem checklist.title }}}.
 
-      if($eq activity.activityType 'importBoard')
-        | {{{_ 'activity-imported-board' boardLabelLink sourceLink}}}.
+        if($eq activityType 'uncheckedItem')
+          | {{{_ 'activity-unchecked-item-card' checkItem checklist.title }}}.
 
-      if($eq activity.activityType 'addBoardMember')
-        | {{{_ 'activity-added' memberLink boardLabelLink}}}.
+        if($eq activityType 'checklistCompleted')
+          | {{{_ 'activity-checklist-completed-card' checklist.title }}}.
 
-      if($eq activity.activityType 'removeBoardMember')
-        | {{{_ 'activity-excluded' memberLink boardLabelLink}}}.
+        if($eq activityType 'checklistUncompleted')
+          | {{{_ 'activity-checklist-uncompleted-card' checklist.title }}}.
 
-      //- card activity -------------------------------------------------------
-      if($eq activity.activityType 'createCard')
-        if($eq mode 'card')
-          | {{{_ 'activity-added' cardLabelLink (sanitize activity.listName)}}}.
-        else
-          | {{{_ 'activity-added' cardLabelLink boardLabelLink}}}.
+        if($eq activityType 'restoredCard')
+          | {{_ 'activity-sent' cardLabel boardLabel}}.
+        if($eq activityType 'moveCard')
+          | {{_ 'activity-moved' cardLabel oldList.title list.title}}.
 
-      if($eq activity.activityType 'importCard')
-        | {{{_ 'activity-imported' cardLink boardLabelLink sourceLink}}}.
+        if($eq activityType 'moveCardBoard')
+          | {{{_ 'activity-moved' cardLink oldBoardName boardName}}}.
 
-      if($eq activity.activityType 'moveCard')
-        | {{{_ 'activity-moved' cardLabelLink (sanitize activity.oldList.title) (sanitize activity.list.title)}}}.
-
-      if($eq activity.activityType 'moveCardBoard')
-        | {{{_ 'activity-moved' cardLink (sanitize activity.oldBoardName) (sanitize activity.boardName)}}}.
-
-      if($eq activity.activityType 'archivedCard')
-        | {{{_ 'activity-archived' cardLink}}}.
-
-      if($eq activity.activityType 'restoredCard')
-        | {{{_ 'activity-sent' cardLink boardLabelLink}}}.
-
-      //- checklist activity --------------------------------------------------
-      if($eq activity.activityType 'addChecklist')
-        | {{{_ 'activity-checklist-added' cardLink}}}.
-        if($eq mode 'card')
+        if($eq activityType 'addAttachment')
+          | {{{_ 'activity-attached' attachmentLink cardLabel}}}.
+          if attachment.isImage
+            img.attachment-image-preview(src=attachment.url)
+        if($eq activityType 'deleteAttachment')
+          | {{{_ 'activity-delete-attach'  cardLabel}}}.
+        if($eq activityType 'removedChecklist')
+          | {{{_ 'activity-checklist-removed' cardLabel}}}.
+        if($eq activityType 'addChecklist')
+          | {{{_ 'activity-checklist-added' cardLabel}}}.
           .activity-checklist
             +viewer
-              = activity.checklist.title
-        else
-          a.activity-checklist(href="{{ activity.card.originRelativeUrl }}")
+              = checklist.title
+        if($eq activityType 'addChecklistItem')
+          | {{{_ 'activity-checklist-item-added' checklist.title cardLink}}}.
+          .activity-checklist(href="{{ card.absoluteUrl }}")
             +viewer
-              = activity.checklist.title
+              = checklistItem.title
 
-      if($eq activity.activityType 'removedChecklist')
-        | {{{_ 'activity-checklist-removed' cardLink}}}.
+        if($eq activityType 'addComment')
+          +inlinedForm(classNames='js-edit-comment')
+            +editor(autofocus=true)
+              = comment.text
+            .edit-controls
+              button.primary(type="submit") {{_ 'edit'}}
+          else
+            .activity-comment
+              +viewer
+                = comment.text
+            span(title=createdAt).activity-meta {{ moment createdAt }}
+              if ($eq currentUser._id comment.userId)
+                = ' - '
+                a.js-open-inlined-form {{_ "edit"}}
+                = ' - '
+                a.js-delete-comment {{_ "delete"}}
 
-      if($eq activity.activityType 'completeChecklist')
-        | {{{_ 'activity-checklist-completed' (sanitize activity.checklist.title) cardLink}}}.
-
-      if($eq activity.activityType 'uncompleteChecklist')
-        | {{{_ 'activity-checklist-uncompleted' (sanitize activity.checklist.title) cardLink}}}.
-
-      if($eq activity.activityType 'checkedItem')
-        | {{{_ 'activity-checked-item' (sanitize checkItem) (sanitize activity.checklist.title) cardLink}}}.
-
-      if($eq activity.activityType 'uncheckedItem')
-        | {{{_ 'activity-unchecked-item' (sanitize checkItem) (sanitize activity.checklist.title) cardLink}}}.
-
-      if($eq activity.activityType 'addChecklistItem')
-        | {{{_ 'activity-checklist-item-added' (sanitize activity.checklist.title) cardLink}}}.
-        .activity-checklist(href="{{ activity.card.originRelativeUrl }}")
-          +viewer
-            = activity.checklistItem.title
-
-      if($eq activity.activityType 'removedChecklistItem')
-        | {{{_ 'activity-checklist-item-removed' (sanitize activity.checklist.title) cardLink}}}.
-
-      //- comment activity ----------------------------------------------------
-      if($eq activity.activityType 'deleteComment')
-        | {{{_ 'activity-deleteComment' (sanitize activity.commentDisplayText)}}}.
-
-      if($eq activity.activityType 'editComment')
-        | {{{_ 'activity-editComment' (sanitize activity.commentDisplayText)}}}.
-
-      if($eq activity.activityType 'addComment')
-        | {{{_ 'activity-on' cardLink}}}
-        a.activity-comment(href="{{ activity.card.originRelativeUrl }}")
-          +viewer
-            = activity.comment.text
-
-      //- date activity ------------------------------------------------
-      if($eq activity.activityType 'a-receivedAt')
-        | {{{_ 'activity-receivedDate' (sanitize receivedDate) cardLink}}}.
-
-      if($eq activity.activityType 'a-startAt')
-        | {{{_ 'activity-startDate' (sanitize startDate) cardLink}}}.
-
-      if($eq activity.activityType 'a-dueAt')
-        | {{{_ 'activity-dueDate' (sanitize dueDate) cardLink}}}.
-
-      if($eq activity.activityType 'a-endAt')
-        | {{{_ 'activity-endDate' (sanitize endDate) cardLink}}}.
-
-      if($eq activity.activityType 'a-changedTitle')
-        | {{{_ 'activity-changedTitle' (sanitize activity.value) cardLink}}}.
-
-      if($eq activity.activityType 'a-changedDescription')
-        | {{{_ 'activity-changedDescription' cardLink}}}.
-
-      //- customField activity ------------------------------------------------
-      if($eq activity.activityType 'createCustomField')
-        | {{_ 'activity-customfield-created' customField}}.
-
-      if($eq activity.activityType 'setCustomField')
-        | {{{_ 'activity-set-customfield' (sanitize lastCustomField) (sanitize lastCustomFieldValue) cardLink}}}.
-
-      if($eq activity.activityType 'unsetCustomField')
-        | {{{_ 'activity-unset-customfield' (sanitize lastCustomField) cardLink}}}.
-
-      //- label activity ------------------------------------------------------
-      if($eq activity.activityType 'addedLabel')
-        | {{{_ 'activity-added-label' (sanitize lastLabel) cardLink}}}.
-
-      if($eq activity.activityType 'removedLabel')
-        | {{{_ 'activity-removed-label' (sanitize lastLabel) cardLink}}}.
-
-      //- list activity -------------------------------------------------------
-      if($neq mode 'card')
-        if($eq activity.activityType 'createList')
-          | {{{_ 'activity-added' (sanitize listLabel) boardLabelLink}}}.
-
-        if($eq activity.activityType 'importList')
-          | {{{_ 'activity-imported' (sanitize listLabel) boardLabelLink sourceLink}}}.
-
-        if($eq activity.activityType 'removeList')
-          | {{{_ 'activity-removed' (sanitize activity.title) boardLabelLink}}}.
-
-        if($eq activity.activityType 'archivedList')
-          | {{_ 'activity-archived' (sanitize listLabel)}}.
-
-        if($eq activity.activityType 'changedListTitle')
-          | {{_ 'activity-changedListTitle' (sanitize listLabel) boardLabelLink}}
-
-      //- member activity ----------------------------------------------------
-      if($eq activity.activityType 'joinMember')
-        if($eq user._id activity.member._id)
-          | {{{_ 'activity-joined' cardLink}}}.
         else
-          | {{{_ 'activity-added' memberLink cardLink}}}.
-
-      if($eq activity.activityType 'unjoinMember')
-        if($eq user._id activity.member._id)
-          | {{{_ 'activity-unjoined' cardLink}}}.
-        else
-          | {{{_ 'activity-removed' memberLink cardLink}}}.
-
-      //- swimlane activity --------------------------------------------------
-      if($eq activity.activityType 'createSwimlane')
-        | {{{_ 'activity-added' (sanitize activity.swimlane.title) boardLabelLink}}}.
-
-      if($eq activity.activityType 'archivedSwimlane')
-        | {{{_ 'activity-archived' (sanitize activity.swimlane.title)}}}.
-
-
-      //- I don't understand this part ----------------------------------------
-      if(currentData.timeKey)
-        | {{_ activity.activityType }}
-        = ' '
-        i(title=currentData.timeValue).activity-meta {{ displayDate currentData.timeValue 'LLL' }}
-        if (currentData.timeOldValue)
-          = ' '
-            | {{{_ "previous_as" }}}
-            = ' '
-            i(title=currentData.timeOldValue).activity-meta {{ displayDate currentData.timeOldValue 'LLL' }}
-        = ' @'
-      else if(currentData.timeValue)
-        | {{_ activity.activityType currentData.timeValue}}
-
-      if($neq mode 'none')
-        div(title=activity.createdAt).activity-meta {{ displayDate activity.createdAt }}
+          span(title=createdAt).activity-meta {{ moment createdAt }}

client/components/activities/activities.js

@@ -1,401 +1,170 @@
-import { ReactiveCache } from '/imports/reactiveCache';
-import { ReactiveVar } from 'meteor/reactive-var';
-import { Template } from 'meteor/templating';
-import DOMPurify from 'dompurify';
-import { sanitizeHTML, sanitizeText } from '/imports/lib/secureDOMPurify';
-import { TAPi18n } from '/imports/i18n';
-import { Utils } from '/client/lib/utils';
-import { getSidebarInstance } from '/client/features/sidebar/service';
+const activitiesPerPage = 20;
 
-// #6480/#6481: 500 was far more than the sidebar/card activity feed ever shows
-// at once, and with FerretDB (no oplog) every live cursor is re-run on a timer —
-// so a 500-row activities cursor was re-fetched and re-diffed on every poll for
-// each open board/card. 50 covers the visible feed; infinite scroll still pulls
-// the next page on demand (the server cursor is index-bounded either way).
-const activitiesPerPage = 50;
+BlazeComponent.extendComponent({
+  onCreated() {
+    // XXX Should we use ReactiveNumber?
+    this.page = new ReactiveVar(1);
+    this.loadNextPageLocked = false;
+    const sidebar = this.parentComponent(); // XXX for some reason not working
+    sidebar.callFirstWith(null, 'resetNextPeak');
+    this.autorun(() => {
+      let mode = this.data().mode;
+      const capitalizedMode = Utils.capitalize(mode);
+      let thisId, searchId;
+      if (mode === 'linkedcard' || mode === 'linkedboard') {
+        thisId = Session.get('currentCard');
+        searchId = Cards.findOne({_id: thisId}).linkedId;
+        mode = mode.replace('linked', '');
+      } else {
+        thisId = Session.get(`current${capitalizedMode}`);
+        searchId = thisId;
+      }
+      const limit = this.page.get() * activitiesPerPage;
+      const user = Meteor.user();
+      const hideSystem = user ? user.hasHiddenSystemMessages() : false;
+      if (searchId === null)
+        return;
 
-Template.activities.onCreated(function () {
-  // Register with sidebar so it can call loadNextPage on us
-  const Sidebar = getSidebarInstance();
-  if (Sidebar) {
-    Sidebar.activitiesInstance = this;
-  }
+      this.subscribe('activities', mode, searchId, limit, hideSystem, () => {
+        this.loadNextPageLocked = false;
 
-  // XXX Should we use ReactiveNumber?
-  this.page = new ReactiveVar(1);
-  this.loadNextPageLocked = false;
-  this.loadNextPage = () => {
+        // If the sibear peak hasn't increased, that mean that there are no more
+        // activities, and we can stop calling new subscriptions.
+        // XXX This is hacky! We need to know excatly and reactively how many
+        // activities there are, we probably want to denormalize this number
+        // dirrectly into card and board documents.
+        const nextPeakBefore = sidebar.callFirstWith(null, 'getNextPeak');
+        sidebar.calculateNextPeak();
+        const nextPeakAfter = sidebar.callFirstWith(null, 'getNextPeak');
+        if (nextPeakBefore === nextPeakAfter) {
+          sidebar.callFirstWith(null, 'resetNextPeak');
+        }
+      });
+    });
+  },
+
+  loadNextPage() {
     if (this.loadNextPageLocked === false) {
       this.page.set(this.page.get() + 1);
       this.loadNextPageLocked = true;
     }
-  };
-
-  // TODO is sidebar always available? E.g. on small screens/mobile devices
-  const sidebar = getSidebarInstance();
-  if (sidebar && sidebar.infiniteScrolling) {
-    sidebar.infiniteScrolling.resetNextPeak();
-  }
-  this.autorun(() => {
-    const data = Template.currentData();
-    let mode = data?.mode;
-    if (mode) {
-      const capitalizedMode = Utils.capitalize(mode);
-      let searchId;
-      const showActivities = _showActivities(data);
-      if (mode === 'linkedcard' || mode === 'linkedboard') {
-        const currentCard = Utils.getCurrentCard();
-        searchId = currentCard.linkedId;
-        mode = mode.replace('linked', '');
-      } else if (mode === 'card') {
-        searchId = Utils.getCurrentCardId();
-      } else {
-        searchId = Session.get(`current${capitalizedMode}`);
-      }
-      const limit = this.page.get() * activitiesPerPage;
-      if (searchId === null) return;
-
-      this.subscribe('activities', mode, searchId, limit, showActivities, () => {
-        this.loadNextPageLocked = false;
-
-        // TODO the guard can be removed as soon as the TODO above is resolved
-        if (!sidebar || !sidebar.infiniteScrolling) return;
-        // If the sidebar peak hasn't increased, that means that there are no more
-        // activities, and we can stop calling new subscriptions.
-        const nextPeakBefore = sidebar.infiniteScrolling.getNextPeak();
-        sidebar.calculateNextPeak();
-        const nextPeakAfter = sidebar.infiniteScrolling.getNextPeak();
-        if (nextPeakBefore === nextPeakAfter) {
-          sidebar.infiniteScrolling.resetNextPeak();
-        }
-      });
-    }
-  });
-});
-
-function _showActivities(data) {
-  // Instance-wide switch (Admin Panel / Settings / Hide board activities on all
-  // boards). Read ONCE from the global settings; when it is on, no board shows
-  // its activities and the per-board value is not consulted at all.
-  if (ReactiveCache.getCurrentSetting()?.hideBoardActivitiesOnAllBoards) {
-    return false;
-  }
-  let ret = false;
-  let mode = data?.mode;
-  if (mode) {
-    if (mode === 'linkedcard' || mode === 'linkedboard') {
-      const currentCard = Utils.getCurrentCard();
-      ret = currentCard.showActivities ?? false;
-    } else if (mode === 'card') {
-      // For card mode, get showActivities from data context or fallback to current card
-      const card = data?.card || Utils.getCurrentCard();
-      ret = card?.showActivities ?? false;
-    } else {
-      ret = Utils.getCurrentBoard().showActivities ?? false;
-    }
-  }
-  return ret;
-}
-
-Template.activities.helpers({
-  showActivities() {
-    const data = Template.currentData();
-    return _showActivities(data);
   },
 
-  activities() {
-    const activities = this.card?.activities?.();
-    return activities || [];
-  },
-});
-
-Template.boardActivities.helpers({
-  boardActivitiesList() {
-    const board = Utils.getCurrentBoard();
-    const activities = board?.activities?.();
-    return activities || [];
-  },
-});
-
-Template.cardActivities.helpers({
-  cardActivitiesList() {
-    const data = Template.currentData();
-    const card = data?.card;
-    const activities = card?.activities?.();
-    return activities || [];
-  },
-});
-
-Template.activity.helpers({
-  checkItem() {
-    const checkItemId = this.activity.checklistItemId;
-    const checkItem = ReactiveCache.getChecklistItem(checkItemId);
-    return checkItem && checkItem.title;
+  checkItem(){
+    const checkItemId = this.currentData().checklistItemId;
+    const checkItem = ChecklistItems.findOne({_id:checkItemId});
+    return checkItem.title;
   },
 
-  boardLabelLink() {
-    const currentBoardId = Session.get('currentBoard');
-    if (this.mode !== 'board') {
-      return createBoardLink(this.activity.board(), this.activity.listName ? this.activity.listName : null);
-    }
-    else if (currentBoardId != this.activity.boardId) {
-      return createBoardLink(this.activity.board(), this.activity.listName ? this.activity.listName : null);
-    }
+  boardLabel() {
     return TAPi18n.__('this-board');
   },
 
-  cardLabelLink() {
-    const currentBoardId = Session.get('currentBoard');
-    if (this.mode == 'card') {
-      return TAPi18n.__('this-card');
-    }
-    else if (this.mode !== 'board') {
-      return createCardLink(this.activity.card(), null);
-    }
-    else if (currentBoardId != this.activity.boardId) {
-      return createCardLink(this.activity.card(), this.activity.board().title);
-    }
-    return createCardLink(this.activity.card(), null);
+  cardLabel() {
+    return TAPi18n.__('this-card');
   },
 
   cardLink() {
-    const currentBoardId = Session.get('currentBoard');
-    if (this.mode !== 'board') {
-      return createCardLink(this.activity.card(), null);
-    }
-    else if (currentBoardId != this.activity.boardId) {
-      return createCardLink(this.activity.card(), this.activity.board().title);
-    }
-    return createCardLink(this.activity.card(), null);
+    const card = this.currentData().card();
+    return card && Blaze.toHTML(HTML.A({
+      href: card.absoluteUrl(),
+      'class': 'action-card',
+    }, card.title));
   },
 
-  receivedDate() {
-    const card = this.activity.card();
-    if (!card) return null;
-    return card.receivedAt;
-  },
-
-  startDate() {
-    const card = this.activity.card();
-    if (!card) return null;
-    return card.startAt;
-  },
-
-  dueDate() {
-    const card = this.activity.card();
-    if (!card) return null;
-    return card.dueAt;
-  },
-
-  endDate() {
-    const card = this.activity.card();
-    if (!card) return null;
-    return card.endAt;
-  },
-
-  lastLabel() {
-    const lastLabelId = this.activity.labelId;
-    if (!lastLabelId) return null;
-    const lastLabel = ReactiveCache.getBoard(
-      this.activity.boardId,
-    ).getLabelById(lastLabelId);
-    if (lastLabel && (lastLabel.name === undefined || lastLabel.name === '')) {
-      return lastLabel.color;
-    } else if (lastLabel.name !== undefined && lastLabel.name !== '') {
-      return lastLabel.name;
-    } else {
+  lastLabel(){
+    const lastLabelId = this.currentData().labelId;
+    if (!lastLabelId)
       return null;
+    const lastLabel = Boards.findOne(Session.get('currentBoard')).getLabelById(lastLabelId);
+    if(lastLabel.name === undefined || lastLabel.name === ''){
+      return lastLabel.color;
+    }else{
+      return lastLabel.name;
     }
   },
 
-  lastCustomField() {
-    const lastCustomField = ReactiveCache.getCustomField(
-      this.activity.customFieldId,
-    );
-    if (!lastCustomField) return null;
+  lastCustomField(){
+    const lastCustomField = CustomFields.findOne(this.currentData().customFieldId);
+    if (!lastCustomField)
+      return null;
     return lastCustomField.name;
   },
 
-  lastCustomFieldValue() {
-    const lastCustomField = ReactiveCache.getCustomField(
-      this.activity.customFieldId,
-    );
-    if (!lastCustomField) return null;
-    const value = this.activity.value;
-    if (
-      lastCustomField.settings.dropdownItems &&
-      lastCustomField.settings.dropdownItems.length > 0
-    ) {
-      const dropDownValue = lastCustomField.settings.dropdownItems.find(
-        item => {
-          return item._id === value;
-        },
-      );
-      if (dropDownValue) return dropDownValue.name;
+  lastCustomFieldValue(){
+    const lastCustomField = CustomFields.findOne(this.currentData().customFieldId);
+    if (!lastCustomField)
+      return null;
+    const value = this.currentData().value;
+    if (lastCustomField.settings.dropdownItems && lastCustomField.settings.dropdownItems.length > 0) {
+      const dropDownValue = _.find(lastCustomField.settings.dropdownItems, (item) => {
+        return item._id === value;
+      });
+      if (dropDownValue)
+        return dropDownValue.name;
     }
     return value;
   },
 
   listLabel() {
-    const activity = this.activity;
-    const list = activity.list();
-    return (list && list.title) || activity.title;
+    return this.currentData().list().title;
   },
 
   sourceLink() {
-    const source = this.activity.source;
-    if (source) {
-      // XSS fix (reported by meifukun): source.url is imported from an external
-      // board (e.g. a Trello board's `url`) and was rendered as an <a href> with
-      // no scheme check, so a `javascript:` (or data:/vbscript:) URL executed in
-      // the board admin's session on click and could exfiltrate Meteor.loginToken.
-      // Only render a link for an http(s) URL; otherwise show the plain (sanitized)
-      // source name with no href.
-      if (source.url && /^https?:\/\//i.test(String(source.url))) {
-        return Blaze.toHTML(
-          HTML.A(
-            {
-              href: source.url,
-            },
-            sanitizeHTML(source.system),
-          ),
-        );
+    const source = this.currentData().source;
+    if(source) {
+      if(source.url) {
+        return Blaze.toHTML(HTML.A({
+          href: source.url,
+        }, source.system));
+      } else {
+        return source.system;
       }
-      return sanitizeHTML(source.system);
     }
     return null;
   },
 
   memberLink() {
     return Blaze.toHTMLWithData(Template.memberName, {
-      user: this.activity.member(),
+      user: this.currentData().member(),
     });
   },
 
   attachmentLink() {
-    const attachment = this.activity.attachment();
-    const attachmentUrl = attachment && typeof attachment.link === 'function'
-      ? attachment.link()
-      : '';
+    const attachment = this.currentData().attachment();
     // trying to display url before file is stored generates js errors
-    return (
-      (attachment &&
-        attachment.path &&
-        attachmentUrl &&
-        Blaze.toHTML(
-          HTML.A(
-            {
-              href: `${attachmentUrl}?download=true`,
-              target: '_blank',
-            },
-            sanitizeText(attachment.name),
-          ),
-        )) ||
-      sanitizeText(this.activity.attachmentName)
-    );
+    return attachment && attachment.url({ download: true }) && Blaze.toHTML(HTML.A({
+      href: attachment.url({ download: true }),
+      target: '_blank',
+    }, attachment.name()));
   },
 
   customField() {
-    const customField = this.activity.customField();
-    if (!customField) return null;
+    const customField = this.currentData().customField();
+    if (!customField)
+      return null;
     return customField.name;
   },
-});
 
-Template.activity.helpers({
-  sanitize(value) {
-    return sanitizeHTML(value);
+  events() {
+    return [{
+      // XXX We should use Popup.afterConfirmation here
+      'click .js-delete-comment'() {
+        const commentId = this.currentData().commentId;
+        CardComments.remove(commentId);
+      },
+      'submit .js-edit-comment'(evt) {
+        evt.preventDefault();
+        const commentText = this.currentComponent().getValue().trim();
+        const commentId = Template.parentData().commentId;
+        if (commentText) {
+          CardComments.update(commentId, {
+            $set: {
+              text: commentText,
+            },
+          });
+        }
+      },
+    }];
   },
-});
-
-Template.commentReactions.events({
-  'click .reaction'(event) {
-    const user = ReactiveCache.getCurrentUser();
-    if (user && user.isBoardMember()) {
-      const codepoint = event.currentTarget.dataset['codepoint'];
-      const commentId = Template.instance().data.commentId;
-      const cardComment = ReactiveCache.getCardComment(commentId);
-      cardComment.toggleReaction(codepoint);
-    }
-  },
-  'click .open-comment-reaction-popup': Popup.open('addReaction'),
-})
-
-Template.addReactionPopup.events({
-  'click .add-comment-reaction'(event) {
-    const user = ReactiveCache.getCurrentUser();
-    if (user && user.isBoardMember()) {
-      const codepoint = event.currentTarget.dataset['codepoint'];
-      const commentId = Template.instance().data.commentId;
-      const cardComment = ReactiveCache.getCardComment(commentId);
-      cardComment.toggleReaction(codepoint);
-    }
-    Popup.back();
-  },
-})
-
-Template.addReactionPopup.helpers({
-  codepoints() {
-    // Starting set of unicode codepoints as comment reactions
-    return [
-      '&#128077;',
-      '&#128078;',
-      '&#128064;',
-      '&#9989;',
-      '&#10060;',
-      '&#128591;',
-      '&#128079;',
-      '&#127881;',
-      '&#128640;',
-      '&#128522;',
-      '&#129300;',
-      '&#128532;'];
-  }
-})
-
-Template.commentReactions.helpers({
-  isSelected(userIds) {
-    return Meteor.userId() && userIds.includes(Meteor.userId());
-  },
-  userNames(userIds) {
-    const ret = ReactiveCache.getUsers({_id: {$in: userIds}})
-      .map(user => user.profile.fullname)
-      .join(', ');
-    return ret;
-  }
-})
-
-function createCardLink(card, board) {
-  if (!card) return '';
-  let text = card.title;
-  if (board) text = `${board} > ` + text;
-  return (
-    card &&
-    Blaze.toHTML(
-      HTML.A(
-        {
-          href: card.originRelativeUrl(),
-          class: 'action-card',
-        },
-        sanitizeHTML(text),
-      ),
-    )
-  );
-}
-
-function createBoardLink(board, list) {
-  let text = board.title;
-  if (list) text += `: ${list}`;
-  return (
-    board &&
-    Blaze.toHTML(
-      HTML.A(
-        {
-          href: board.originRelativeUrl(),
-          class: 'action-board',
-        },
-        sanitizeHTML(text),
-      ),
-    )
-  );
-}
+}).register('activities');

client/components/activities/activities.styl

@@ -0,0 +1,48 @@
+@import 'nib'
+
+.activity-title
+  margin: 0 0.5em 0.8em
+  display: flex
+  justify-content:space-between
+
+.activities
+  clear: both
+
+  .activity
+    margin: 10px 0
+    display: flex
+
+    .member
+      width: 24px
+      height: @width
+
+    .activity-desc
+      word-wrap: break-word
+      overflow: hidden
+      flex: 1
+      align-self: center
+      margin: 0
+      margin-left: 3px
+      overflow: hidden;
+      word-break: break-word;
+
+      .activity-comment
+        display: block
+        border-radius: 3px
+        background: white
+        text-decoration: none
+        box-shadow: 0 1px 2px rgba(0,0,0,.2)
+        margin-top: 5px
+        padding: 5px
+
+      .activity-checklist
+        display: block
+        border-radius: 3px
+        background: white
+        text-decoration: none
+        box-shadow: 0 1px 2px rgba(0,0,0,.2)
+        margin-top: 5px
+        padding: 5px
+      .activity-meta
+        font-size: 0.8em
+        color: darken(white, 40%)

client/components/activities/comments.css

@@ -1,183 +0,0 @@
-.new-comment {
-  position: relative;
-  margin: 0 0 20px 38px;
-}
-.new-comment .member {
-  opacity: 0.7;
-  position: absolute;
-  top: 1px;
-  inset-inline-start: -38px;
-}
-.new-comment.is-open .member {
-  opacity: 1;
-}
-.new-comment.is-open .helper {
-  display: inline-block;
-}
-.new-comment.is-open textarea {
-  min-height: 100px;
-  color: #4d4d4d;
-  cursor: auto;
-  overflow: hidden;
-  word-wrap: break-word;
-}
-.new-comment .too-long {
-  margin-top: 8px;
-}
-.new-comment textarea {
-  background-color: #fff;
-  border: 0;
-  box-shadow: 0 1px 2px rgba(0,0,0,0.23);
-  height: 36px;
-  margin: 4px 4px 6px 0;
-  padding: 9px 11px;
-  width: 100%;
-}
-.new-comment textarea:hover,
-.new-comment textarea:is-open {
-  background-color: #fff;
-  box-shadow: 0 1px 3px rgba(0,0,0,0.33);
-  border: 0;
-  cursor: pointer;
-}
-.new-comment textarea:is-open {
-  cursor: auto;
-}
-.comment-item {
-  background-color: #fff;
-  border: 0;
-  box-shadow: 0 1px 2px rgba(0,0,0,0.23);
-  color: #8c8c8c;
-  height: 36px;
-  margin: 4px 4px 6px 0;
-  width: 92%;
-}
-.comment-item:hover {
-  background: #e0e0e0;
-}
-.comment-item.add-comment {
-  display: flex;
-  margin: 5px;
-}
-.comment-item.add-comment a {
-  display: block;
-  margin: auto;
-}
-.comments {
-  clear: both;
-}
-.comments .comment {
-  margin: 0.5px 0;
-  padding: 6px 0;
-  display: flex;
-}
-.comments .comment .member {
-  width: 32px;
-  height: 32px;
-}
-.comments .comment .comment-member {
-  font-weight: 700;
-}
-.comments .comment .comment-desc {
-  word-wrap: break-word;
-  overflow: hidden;
-  flex: 1;
-  align-self: center;
-  margin: 0;
-  margin-inline-start: 3px;
-  overflow: hidden;
-  word-break: break-word;
-}
-.comments .comment .comment-desc .comment-text {
-  display: block;
-  border-radius: 3px;
-  background: #fff;
-  text-decoration: none;
-  box-shadow: 0 1px 2px rgba(0,0,0,0.2);
-  margin-top: 5px;
-  padding: 5px;
-}
-.comments .comment .comment-desc .reactions {
-  display: flex;
-  margin-top: 5px;
-  gap: 5px;
-}
-.comments .comment .comment-desc .reactions .open-comment-reaction-popup {
-  display: flex;
-  align-items: center;
-  text-decoration: none;
-  height: 24px;
-}
-.comments .comment .comment-desc .reactions .open-comment-reaction-popup span {
-  display: inline-block;
-  font-size: 14px;
-  font-weight: 500;
-  line-height: 1;
-  margin-inline-start: 4px;
-}
-.comments .comment .comment-desc .reactions .reaction {
-  cursor: pointer;
-  border: 1px solid #808080;
-  border-radius: 15px;
-  display: flex;
-  padding: 2px 5px;
-}
-.comments .comment .comment-desc .reactions .reaction.selected {
-  background-color: #b0c4de;
-}
-.comments .comment .comment-desc .reactions .reaction:hover {
-  background-color: #b0c4de;
-}
-.comments .comment .comment-desc .reactions .reaction .reaction-count {
-  font-size: 12px;
-}
-.comments .comment .comment-desc .comment-meta {
-  font-size: 0.8em;
-  color: #999;
-}
-/* Threaded replies (issue #5907): indent replies under their parent. */
-.comments .comment.is-reply {
-  margin-inline-start: 24px;
-  border-inline-start: 2px solid #e0e0e0;
-  padding-inline-start: 8px;
-}
-.comments .comment .comment-desc .comment-in-reply-to {
-  font-size: 0.8em;
-  color: #999;
-  border-inline-start: 2px solid #ccc;
-  padding-inline-start: 6px;
-  margin: 3px 0;
-  display: block;
-}
-.comments .comment .comment-desc .comment-in-reply-to .comment-in-reply-to-label {
-  font-weight: 700;
-  margin-inline-end: 4px;
-}
-.comments .comment .comment-desc .comment-in-reply-to .comment-in-reply-to-text {
-  font-style: italic;
-}
-/* "In reply to" banner above the new-comment form. */
-.new-comment .comment-reply-banner {
-  background: #f4f4f4;
-  border-inline-start: 2px solid #ccc;
-  padding: 4px 6px;
-  margin: 0 4px 6px 0;
-  font-size: 0.85em;
-  color: #666;
-  display: flex;
-  align-items: center;
-  gap: 6px;
-}
-.new-comment .comment-reply-banner .comment-reply-banner-label {
-  font-weight: 700;
-}
-.new-comment .comment-reply-banner .comment-reply-banner-text {
-  flex: 1;
-  font-style: italic;
-  overflow: hidden;
-  white-space: nowrap;
-  text-overflow: ellipsis;
-}
-.new-comment .comment-reply-banner a {
-  cursor: pointer;
-}

client/components/activities/comments.jade

@@ -1,84 +1,9 @@
 template(name="commentForm")
   .new-comment.js-new-comment(
     class="{{#if commentFormIsOpen}}is-open{{/if}}")
-    +userAvatar(userId=currentUser._id noRemove=true)
-    if replyToComment
-      .comment-reply-banner.js-reply-banner
-        span.comment-reply-banner-label {{_ 'comment-in-reply-to'}}:
-        span.comment-reply-banner-text
-          +viewer
-            = replyToComment.text
-        a.js-cancel-reply(title="{{_ 'close' }}")
-          i.fa.fa-times-thin
+    +userAvatar(userId=currentUser._id)
     form.js-new-comment-form
       +editor(class="js-new-comment-input")
         | {{getUnsavedValue 'cardComment' currentCard._id}}
       .add-controls
         button.primary.confirm.clear.js-add-comment(type="submit") {{_ 'comment'}}
-
-template(name="comments")
-  .comments
-    each commentData in getComments
-      +comment(commentData)
-
-template(name="comment")
-  .comment(class="{{#if parentId}}is-reply{{/if}}")
-    +userAvatar(userId=userId)
-    p.comment-desc
-      span.comment-member
-        +memberName(user=user)
-
-      if parentComment
-        .comment-in-reply-to
-          span.comment-in-reply-to-label {{_ 'comment-in-reply-to'}}:
-          span.comment-in-reply-to-text
-            +viewer
-              = parentComment.text
-
-      +inlinedForm(classNames='js-edit-comment')
-        +editor(autofocus=true)
-          = text
-        .edit-controls
-          button.primary(type="submit") {{_ 'edit'}}
-          a.js-close-inlined-form(title="{{_ 'close' }}")
-            i.fa.fa-times-thin
-      else
-        .comment-text
-          +viewer
-            = text
-        +commentReactions(reactions=reactions commentId=_id)
-        span(title=createdAt).comment-meta {{ displayDate createdAt }}
-          if currentUser.isBoardMember
-            = ' - '
-            a.js-reply-comment {{_ "comment-reply"}}
-          if canEditThisComment
-            +editOrDeleteComment
-
-template(name="editOrDeleteComment")
-  = ' - '
-  a.js-open-inlined-form {{_ "edit"}}
-  = ' - '
-  a.js-delete-comment {{_ "delete"}}
-
-template(name="deleteCommentPopup")
-  p {{_ "comment-delete"}}
-  button.js-confirm.negate.full(type="submit") {{_ 'delete'}}
-
-template(name="commentReactions")
-  .reactions
-    each reaction in reactions
-      span.reaction(class="{{#if isSelected reaction.userIds}}selected{{/if}}" data-codepoint="#{reaction.reactionCodepoint}" title="{{userNames reaction.userIds}}")
-        span.reaction-codepoint !{reaction.reactionCodepoint}
-        span.reaction-count #{reaction.userIds.length}
-    if (currentUser.isBoardMember)
-      unless currentUser.isReadOnly
-        unless currentUser.isReadAssignedOnly
-          a.open-comment-reaction-popup(title="{{_ 'addReactionPopup-title'}}")
-            i.fa.fa-smile-o(title="{{_ 'reaction' }}")
-            i.fa.fa-plus(title="{{_ 'add' }}")
-
-template(name="addReactionPopup")
-  .reactions-popup
-    each codepoint in codepoints
-      span.add-comment-reaction(data-codepoint="#{codepoint}") !{codepoint}
-

client/components/activities/comments.js

@@ -1,210 +1,58 @@
-import { ReactiveCache } from '/imports/reactiveCache';
-import CardComments, { canEditComment } from '/models/cardComments';
-import { UnsavedEdits } from '/client/lib/unsavedEdits';
-import { EscapeActions } from '/client/lib/escapeActions';
-import { Utils } from '/client/lib/utils';
-import autosize from 'autosize';
-
 const commentFormIsOpen = new ReactiveVar(false);
-// _id of the comment currently being replied to (threaded replies, issue #5907).
-// Empty string means a new top-level comment.
-const replyToCommentId = new ReactiveVar('');
 
-// #5547: persist the comment draft (debounced) into UnsavedEdits while the user
-// types, so a comment in progress survives closing the card, clicking outside
-// it, or navigating away — the form prefills from {{getUnsavedValue
-// 'cardComment' ...}} on the next open. Historical note: the click-open flag
-// that armed the old escape-time draft save was removed in 2019 (3b3950369)
-// because the escape handler CLEARED the visible text; since then nothing saved
-// the draft at all, so any close of the card discarded the comment.
-let commentDraftTimer = null;
-let commentDraftPending = null; // { cardId, value }
+BlazeComponent.extendComponent({
+  onDestroyed() {
+    commentFormIsOpen.set(false);
+  },
 
-function commentDraftWrite({ cardId, value }) {
-  if (!cardId) return;
-  const draftKey = { fieldName: 'cardComment', docId: cardId };
-  if ((value || '').trim()) {
-    UnsavedEdits.set(draftKey, value);
-  } else {
-    UnsavedEdits.reset(draftKey);
-  }
-}
-
-function scheduleCommentDraftSave(cardId, value) {
-  commentDraftPending = { cardId, value };
-  if (commentDraftTimer) clearTimeout(commentDraftTimer);
-  commentDraftTimer = setTimeout(() => {
-    commentDraftTimer = null;
-    const pending = commentDraftPending;
-    commentDraftPending = null;
-    if (pending) commentDraftWrite(pending);
-  }, 300);
-}
-
-// Run a pending (debounced) save immediately — e.g. the card is closing.
-function flushCommentDraftSave() {
-  if (commentDraftTimer) {
-    clearTimeout(commentDraftTimer);
-    commentDraftTimer = null;
-  }
-  const pending = commentDraftPending;
-  commentDraftPending = null;
-  if (pending) commentDraftWrite(pending);
-}
-
-// Drop any pending save — the comment was submitted, so there is no draft.
-function cancelCommentDraftSave() {
-  if (commentDraftTimer) {
-    clearTimeout(commentDraftTimer);
-    commentDraftTimer = null;
-  }
-  commentDraftPending = null;
-}
-
-Template.commentForm.onDestroyed(function () {
-  // #5547: the card can close without the escape handler ever running (the X
-  // button, a route change); make sure the last keystrokes reach the draft.
-  flushCommentDraftSave();
-  commentFormIsOpen.set(false);
-  $('.note-popover').hide();
-});
-
-Template.commentForm.helpers({
   commentFormIsOpen() {
     return commentFormIsOpen.get();
   },
-  // The comment being replied to, if any, so the form can show an
-  // "In reply to ..." banner with a way to cancel.
-  replyToComment() {
-    const id = replyToCommentId.get();
-    return id ? ReactiveCache.getCardComment(id) : undefined;
-  },
-});
 
-Template.commentForm.events({
-  // #5547: arm the escape handler below (it saves the draft and closes the
-  // form); this flag had no setter since 2019, so the handler never ran.
-  'focus .js-new-comment-input'() {
-    commentFormIsOpen.set(true);
+  getInput() {
+    return this.$('.js-new-comment-input');
   },
-  // #5547: keep the draft continuously saved (debounced) while typing.
-  'input .js-new-comment-input'(evt) {
-    scheduleCommentDraftSave(Utils.getCurrentCardId(), evt.currentTarget.value);
-  },
-  'submit .js-new-comment-form'(evt, tpl) {
-    const input = tpl.$('.js-new-comment-input');
-    const text = input.val().trim();
-    const card = Template.currentData();
-    let boardId = card.boardId;
-    let cardId = card._id;
-    if (card.isLinkedCard()) {
-      boardId = ReactiveCache.getCard(card.linkedId).boardId;
-      cardId = card.linkedId;
-    } else if (card.isLinkedBoard()) {
-      boardId = card.linkedId;
-    }
-    if (text) {
-      const parentId = replyToCommentId.get();
-      CardComments.insert({
-        text,
-        boardId,
-        cardId,
-        parentId: parentId || '',
-      });
-      // #5547: the comment is saved — cancel any debounced draft save still in
-      // flight and remove the stored draft so it does not resurface next open.
-      cancelCommentDraftSave();
-      UnsavedEdits.reset({
-        fieldName: 'cardComment',
-        docId: Utils.getCurrentCardId(),
-      });
-      replyToCommentId.set('');
-      resetCommentInput(input);
-      Tracker.flush();
-      autosize.update(input);
-      input.trigger('submitted');
-    }
-    evt.preventDefault();
-  },
-  'click .js-cancel-reply'(evt) {
-    evt.preventDefault();
-    replyToCommentId.set('');
-  },
-  // Pressing Ctrl+Enter should submit the form
-  'keydown form textarea'(evt, tpl) {
-    if (evt.keyCode === 13 && (evt.metaKey || evt.ctrlKey)) {
-      tpl.find('button[type=submit]').click();
-    }
-  },
-});
 
-Template.comments.helpers({
-  getComments() {
-    const data = Template.currentData();
-    if (!data || typeof data.comments !== 'function') return [];
-    return data.comments();
+  events() {
+    return [{
+      'click .js-new-comment:not(.focus)'() {
+        commentFormIsOpen.set(true);
+      },
+      'submit .js-new-comment-form'(evt) {
+        const input = this.getInput();
+        const text = input.val().trim();
+        const card = this.currentData();
+        let boardId = card.boardId;
+        let cardId = card._id;
+        if (card.isLinkedCard()) {
+          boardId = Cards.findOne(card.linkedId).boardId;
+          cardId = card.linkedId;
+        }
+        if (text) {
+          CardComments.insert({
+            text,
+            boardId,
+            cardId,
+          });
+          resetCommentInput(input);
+          Tracker.flush();
+          autosize.update(input);
+        }
+        evt.preventDefault();
+      },
+      // Pressing Ctrl+Enter should submit the form
+      'keydown form textarea'(evt) {
+        if (evt.keyCode === 13 && (evt.metaKey || evt.ctrlKey)) {
+          this.find('button[type=submit]').click();
+        }
+      },
+    }];
   },
-});
-
-Template.comment.helpers({
-  // Whether the current user may edit/delete this comment, honouring the
-  // board's restrictCommentEditing setting (issue #5906). Mirrors the
-  // server-side enforcement so the UI hides buttons the server would reject.
-  canEditThisComment() {
-    const user = ReactiveCache.getCurrentUser();
-    if (!user) return false;
-    const isAuthor = user._id === this.userId;
-    const board = ReactiveCache.getBoard(this.boardId);
-    const isBoardAdmin = !!board && board.hasAdmin(user._id);
-    const restrictCommentEditing = !!board && !!board.restrictCommentEditing;
-    return canEditComment({ isAuthor, isBoardAdmin, restrictCommentEditing });
-  },
-  // The parent comment this one replies to, or undefined.
-  parentComment() {
-    return this.parentId ? ReactiveCache.getCardComment(this.parentId) : undefined;
-  },
-});
-
-Template.comment.events({
-  'click .js-reply-comment'(evt) {
-    evt.preventDefault();
-    replyToCommentId.set(this._id);
-    // Open and focus the new-comment form.
-    const input = $('.js-new-comment-input');
-    input.click();
-    Tracker.afterFlush(() => {
-      $('.js-new-comment-input').focus();
-    });
-  },
-  'click .js-delete-comment': Popup.afterConfirm('deleteComment', function () {
-    const commentId = this._id;
-    // #3252: only remove if the doc is still in the local cache. Under heavy
-    // archive/delete churn the comment can already be evicted from Minimongo,
-    // and CardComments.remove() of a missing _id throws "Removed nonexistent
-    // document" on the client.
-    if (commentId && CardComments.findOne(commentId)) {
-      CardComments.remove(commentId);
-    }
-    Popup.back();
-  }),
-  'submit .js-edit-comment'(evt, tpl) {
-    evt.preventDefault();
-    const textarea = tpl.find('.js-edit-comment textarea,input[type=text]');
-    const commentText = textarea && textarea.value ? textarea.value.trim() : '';
-    const commentId = tpl.data._id;
-    if (commentText) {
-      CardComments.update(commentId, {
-        $set: {
-          text: commentText,
-        },
-      });
-    }
-  },
-});
+}).register('commentForm');
 
 // XXX This should be a static method of the `commentForm` component
 function resetCommentInput(input) {
-  input.val(''); // without manually trigger, input event won't be fired
+  input.val('');
   input.blur();
   commentFormIsOpen.set(false);
 }
@@ -215,39 +63,28 @@ function resetCommentInput(input) {
 // Tracker.autorun to register the component dependencies, and re-run when these
 // dependencies are invalidated. A better component API would remove this hack.
 Tracker.autorun(() => {
-  Utils.getCurrentCardId();
+  Session.get('currentCard');
   Tracker.afterFlush(() => {
     autosize.update($('.js-new-comment-input'));
   });
 });
 
-EscapeActions.register(
-  'inlinedForm',
+EscapeActions.register('inlinedForm',
   () => {
     const draftKey = {
       fieldName: 'cardComment',
-      docId: Utils.getCurrentCardId(),
+      docId: Session.get('currentCard'),
     };
     const commentInput = $('.js-new-comment-input');
-    const draft = (commentInput.val() || '').trim();
-    cancelCommentDraftSave();
+    const draft = commentInput.val().trim();
     if (draft) {
       UnsavedEdits.set(draftKey, draft);
     } else {
       UnsavedEdits.reset(draftKey);
     }
-    // #5547: do NOT clear the input — clearing it on every click outside the
-    // comment box is exactly the "comment text disappearing" bug that got this
-    // handler disarmed in 2019 (3b3950369). The draft is saved above; if the
-    // card stays open, the text stays visible; if the card closes, the next
-    // open prefills the form from the draft.
-    commentInput.blur();
-    commentFormIsOpen.set(false);
+    resetCommentInput(commentInput);
   },
-  () => {
-    return commentFormIsOpen.get();
-  },
-  {
+  () => { return commentFormIsOpen.get(); }, {
     noClickEscapeOn: '.js-new-comment',
-  },
+  }
 );

client/components/activities/comments.styl

@@ -0,0 +1,48 @@
+@import 'nib'
+
+.new-comment
+  position: relative
+  margin: 0 0 20px 38px
+
+  .member
+    opacity: .7
+    position: absolute
+    top: 1px
+    left: -38px
+
+  &.is-open
+    .member
+      opacity: 1
+
+    .helper
+      display: inline-block
+
+    textarea
+      min-height: 100px
+      color: #4d4d4d
+      cursor: auto
+      overflow: hidden
+      word-wrap: break-word
+
+  .too-long
+    margin-top: 8px
+
+  textarea
+    background-color: #fff
+    border: 0
+    box-shadow: 0 1px 2px rgba(0, 0, 0, .23)
+    color: #8c8c8c
+    height: 36px
+    margin: 4px 4px 6px 0
+    padding: 9px 11px
+    width: 100%
+
+    &:hover,
+    &:is-open
+      background-color: #fff
+      box-shadow: 0 1px 3px rgba(0, 0, 0, .33)
+      border: 0
+      cursor: pointer
+
+    &:is-open
+      cursor: auto

client/components/boardConversionProgress.css

@@ -1,184 +0,0 @@
-/* Board Conversion Progress Styles */
-.board-conversion-overlay {
-  position: fixed;
-  top: 0;
-  inset-inline-start: 0;
-  width: 100%;
-  height: 100%;
-  background-color: rgba(0, 0, 0, 0.7);
-  z-index: 9999;
-  display: none;
-  align-items: center;
-  justify-content: center;
-}
-
-.board-conversion-overlay.active {
-  display: flex;
-}
-
-.board-conversion-modal {
-  background: white;
-  border-radius: 8px;
-  box-shadow: 0 10px 30px rgba(0, 0, 0, 0.3);
-  max-width: 500px;
-  width: 90%;
-  max-height: 80vh;
-  overflow: hidden;
-  animation: slideIn 0.3s ease-out;
-}
-
-@keyframes slideIn {
-  from {
-    opacity: 0;
-    transform: translateY(-20px);
-  }
-  to {
-    opacity: 1;
-    transform: translateY(0);
-  }
-}
-
-.board-conversion-header {
-  padding: 20px 24px 16px;
-  border-bottom: 1px solid #e0e0e0;
-  text-align: center;
-}
-
-.board-conversion-header h3 {
-  margin: 0 0 8px 0;
-  color: #333;
-  font-size: 20px;
-  font-weight: 500;
-}
-
-.board-conversion-header h3 i {
-  margin-inline-end: 8px;
-  color: #2196F3;
-}
-
-.board-conversion-header p {
-  margin: 0;
-  color: #666;
-  font-size: 14px;
-}
-
-.board-conversion-content {
-  padding: 24px;
-}
-
-.conversion-progress {
-  margin-bottom: 20px;
-}
-
-.progress-bar {
-  width: 100%;
-  height: 8px;
-  background-color: #e0e0e0;
-  border-radius: 4px;
-  overflow: hidden;
-  margin-bottom: 8px;
-}
-
-.progress-fill {
-  height: 100%;
-  background: linear-gradient(90deg, #2196F3, #21CBF3);
-  border-radius: 4px;
-  transition: width 0.3s ease;
-  position: relative;
-}
-
-.progress-fill::after {
-  content: '';
-  position: absolute;
-  top: 0;
-  inset-inline-start: 0;
-  inset-inline-end: 0;
-  bottom: 0;
-  background: linear-gradient(
-    90deg,
-    transparent,
-    rgba(255, 255, 255, 0.3),
-    transparent
-  );
-  animation: shimmer 2s infinite;
-}
-
-@keyframes shimmer {
-  0% {
-    transform: translateX(-100%);
-  }
-  100% {
-    transform: translateX(100%);
-  }
-}
-
-.progress-text {
-  text-align: center;
-  font-weight: 600;
-  color: #2196F3;
-  font-size: 16px;
-}
-
-.conversion-status {
-  text-align: center;
-  margin-bottom: 16px;
-  color: #333;
-  font-size: 16px;
-}
-
-.conversion-status i {
-  margin-inline-end: 8px;
-  color: #2196F3;
-}
-
-.conversion-time {
-  text-align: center;
-  color: #666;
-  font-size: 14px;
-  background-color: #f5f5f5;
-  padding: 8px 12px;
-  border-radius: 4px;
-  margin-bottom: 16px;
-}
-
-.conversion-time i {
-  margin-inline-end: 6px;
-  color: #FF9800;
-}
-
-.board-conversion-footer {
-  padding: 16px 24px 20px;
-  border-top: 1px solid #e0e0e0;
-  background-color: #f9f9f9;
-}
-
-.conversion-info {
-  text-align: center;
-  color: #666;
-  font-size: 13px;
-  line-height: 1.4;
-}
-
-.conversion-info i {
-  margin-inline-end: 6px;
-  color: #2196F3;
-}
-
-/* Responsive design */
-@media (max-width: 600px) {
-  .board-conversion-modal {
-    width: 95%;
-    margin: 20px;
-  }
-
-  .board-conversion-header,
-  .board-conversion-content,
-  .board-conversion-footer {
-    padding-inline-start: 16px;
-    padding-inline-end: 16px;
-  }
-
-  .board-conversion-header h3 {
-    font-size: 18px;
-  }
-}

client/components/boardConversionProgress.jade

@@ -1,27 +0,0 @@
-template(name="boardConversionProgress")
-  .board-conversion-overlay(class="{{#if isConverting}}active{{/if}}")
-    .board-conversion-modal
-      .board-conversion-header
-        h3
-          i.fa.fa-cog
-          | {{_ 'converting-board'}}
-        p {{_ 'converting-board-description'}}
-
-      .board-conversion-content
-        .conversion-progress
-          .progress-bar
-            .progress-fill(style="width: {{conversionProgress}}%")
-          .progress-text {{conversionProgress}}%
-
-        .conversion-status
-          i.fa.fa-cog
-          | {{conversionStatus}}
-
-        .conversion-time(style="{{#unless conversionEstimatedTime}}display: none;{{/unless}}")
-          i.fa.fa-clock-o
-          | {{_ 'estimated-time-remaining'}}: {{conversionEstimatedTime}}
-
-      .board-conversion-footer
-        .conversion-info
-          i.fa.fa-info-circle
-          | {{_ 'conversion-info-text'}}

client/components/boardConversionProgress.js

@@ -1,37 +0,0 @@
-import { Template } from 'meteor/templating';
-import { ReactiveVar } from 'meteor/reactive-var';
-import {
-  boardConverter,
-  isConverting,
-  conversionProgress,
-  conversionStatus,
-  conversionEstimatedTime
-} from '/client/lib/boardConverter';
-
-Template.boardConversionProgress.helpers({
-  isConverting() {
-    return isConverting.get();
-  },
-
-  conversionProgress() {
-    return conversionProgress.get();
-  },
-
-  conversionStatus() {
-    return conversionStatus.get();
-  },
-
-  conversionEstimatedTime() {
-    return conversionEstimatedTime.get();
-  }
-});
-
-Template.boardConversionProgress.onCreated(function() {
-  // Subscribe to conversion state changes
-  this.autorun(() => {
-    isConverting.get();
-    conversionProgress.get();
-    conversionStatus.get();
-    conversionEstimatedTime.get();
-  });
-});

client/components/boards/allBoardsSidebar.jade

@@ -1,105 +0,0 @@
-//- The All Boards right sidebar.
-//-
-//- The board sidebar (client/components/sidebar/) is built around a board - its
-//- members, labels, activities and settings - and All Boards has no board, so
-//- this is its own. What it borrows is the SHELL: the same
-//- `.board-sidebar.sidebar` classes, the same `.sidebar-actions` row with the ✕,
-//- the same `.sidebar-content` with a title and a back arrow above the view. So
-//- it looks and behaves like the one on a board without pretending to be it.
-//-
-//- docs/Design/Page/Search.md, docs/Design/Page/Multi-Selection.md
-
-template(name="allBoardsSidebar")
-  //- The theme class goes on an ANCESTOR of `.sidebar`, never on it: every
-    themed sidebar rule is a DESCENDANT selector -
-    `.board-color-belize .sidebar .sidebar-content .sidebar-btn` - so a class on
-    the sidebar element itself matches nothing at all, which is how the first
-    attempt at this left the buttons white on light grey anyway. On a board the
-    class sits on a container around the sidebar; this is that container.
-
-    It wraps ONLY the sidebar, so the theme cannot bleed into the board icons
-    behind it. It is out of flow (the sidebar inside is fixed), so it costs no
-    layout.
-  .all-boards-sidebar-theme(class="{{themeClass}}")
-    .board-sidebar.sidebar.all-boards-sidebar(class="{{#if isSidebarOpen}}is-open{{/if}}")
-      .sidebar-actions
-        a.sidebar-xmark.js-close-all-boards-sidebar(aria-label="{{_ 'close'}}") ✕
-      .sidebar-content.js-all-boards-sidebar-content
-        //- A title and a back arrow on every view EXCEPT home, which is where
-          back would go - exactly as the board sidebar does it.
-        if sidebarViewTitle
-          h2
-            a.fa.fa-arrow-left.js-all-boards-sidebar-home(aria-label="{{_ 'go-back'}}")
-            = sidebarViewTitle
-        if isSidebarOpen
-          +Template.dynamic(template=sidebarViewTemplate)
-
-//- What the hamburger opens: the page's own menu, the counterpart of
-//- `homeSidebar` on a board.
-template(name="allBoardsHomeSidebar")
-  //- Sort, which was a button in this page's second header bar. The VIEW menu
-    was too, and it is in the first top header bar instead - a view menu says
-    what you are looking at, which belongs beside the page's name rather than
-    behind a panel you have to open. Search and Multi-Selection were in that bar
-    as well and are NOT repeated here: this view has offered both as rows since
-    it was written. docs/Design/Page/All-Boards.md
-  a.sidebar-btn.js-open-boards-sort(class="{{#unless isBoardsSort 'custom'}}emphasis{{/unless}}")
-    i.fa.fa-sort
-    span {{_ 'sort-boards'}}
-  hr
-  ul.sidebar-list
-    li
-      a.js-all-boards-sidebar-search
-        i.fa.fa-search
-        span.sidebar-list-item-description {{_ 'search-boards'}}
-    if canModifyBoards
-      li
-        a.js-all-boards-sidebar-multiselection
-          i.fa.fa-check-square-o
-          span.sidebar-list-item-description {{_ 'multi-selection'}}
-  hr
-  //- Archived boards had a handler in the header bar and no button to reach it.
-  a.sidebar-btn.js-open-archived-board
-    i.fa.fa-archive
-    span {{_ 'archived-boards'}}
-
-template(name="allBoardsSearchSidebar")
-  //- The SAME term the page filters by, so the board list behind the sidebar
-    narrows as you type - which is what the search field in the header bar did
-    before this became a sidebar view.
-  input.js-board-search-input(
-    type="text"
-    aria-label="{{_ 'search-boards'}}"
-    value="{{boardSearch}}"
-    autofocus
-    autocomplete="off"
-    dir="auto")
-  if boardSearch
-    a.sidebar-btn.js-board-search-clear
-      i.fa.fa-times
-      span {{_ 'filter-clear'}}
-
-//- The actions on a selection, as sidebar rows - the same place a board puts
-//- them. They were four icons crowded into the header bar; here each one has
-//- its name beside it.
-template(name="allBoardsMultiSelectionSidebar")
-  if hasBoardsSelected
-    a.sidebar-btn.js-star-selected
-      i.fa.fa-star
-      span {{selectedStarTitle}}
-    a.sidebar-btn.js-home-selected
-      i.fa.fa-home
-      span {{_ 'set-selected-home'}}
-    hr
-    a.sidebar-btn.js-archive-selected-boards
-      i.fa.fa-archive
-      span {{_ 'archive-board'}}
-    a.sidebar-btn.js-duplicate-selected-boards
-      i.fa.fa-clipboard
-      span {{_ 'duplicate-board'}}
-    hr
-    a.sidebar-btn.js-multiselection-reset
-      i.fa.fa-times-thin
-      span {{_ 'multi-selection-off'}}
-  else
-    p.sidebar-multiselection-hint {{_ 'multi-selection-active'}}

client/components/boards/allBoardsSidebar.js

@@ -1,211 +0,0 @@
-import { ReactiveCache } from '/imports/reactiveCache';
-import { FlowRouter } from 'meteor/ostrio:flow-router-extra';
-const { allBoardsPath, SECTION_ARCHIVE } = require('/models/lib/allBoardsUrls');
-import { TAPi18n } from '/imports/i18n';
-import { BoardMultiSelection } from '/client/lib/boardMultiSelection';
-import { allBoardsSearchVar } from '/client/lib/allBoardsView';
-import {
-  allBoardsSidebarView,
-  isAllBoardsSidebarOpen,
-  openAllBoardsSidebar,
-  closeAllBoardsSidebar,
-} from '/client/lib/allBoardsSidebar';
-import {
-  SIDEBAR_HOME,
-  SIDEBAR_SEARCH,
-  SIDEBAR_MULTISELECTION,
-  sidebarViewTitleKey,
-  sidebarViewTemplate,
-} from '/models/lib/allBoardsSidebar';
-import { selectedStarTitleKey, selectedStarAction } from '/models/lib/selectedStars';
-
-// The All Boards right sidebar. Its shell mirrors the board sidebar's; what it
-// shows is this page's own. docs/Design/Page/Search.md,
-// docs/Design/Page/Multi-Selection.md
-
-Template.allBoardsSidebar.helpers({
-  isSidebarOpen() {
-    return isAllBoardsSidebarOpen();
-  },
-  // The theme the panel is painted with.
-  //
-  // `.sidebar .sidebar-content .sidebar-btn` is a light grey box whose text is
-  // WHITE; what makes that readable on a board is a `.board-color-*` ancestor
-  // replacing the grey with a themed colour. This page has no board, so without
-  // a class here every button was white on light grey - unreadable, which is
-  // exactly what it looked like.
-  //
-  // `board-color-belize` is the established default for a themed thing outside
-  // a board: client/components/main/globalSearch.js falls back to the same one.
-  themeClass() {
-    return 'board-color-belize';
-  },
-  sidebarViewTemplate() {
-    return sidebarViewTemplate(allBoardsSidebarView());
-  },
-  // Home has no title and no back arrow: there is nothing behind it.
-  sidebarViewTitle() {
-    const key = sidebarViewTitleKey(allBoardsSidebarView());
-    return key ? TAPi18n.__(key) : null;
-  },
-});
-
-Template.allBoardsSidebar.events({
-  'click .js-close-all-boards-sidebar'(evt) {
-    evt.preventDefault();
-    closeAllBoardsSidebar();
-  },
-  'click .js-all-boards-sidebar-home'(evt) {
-    evt.preventDefault();
-    openAllBoardsSidebar(SIDEBAR_HOME);
-  },
-});
-
-Template.allBoardsHomeSidebar.helpers({
-  canModifyBoards() {
-    const currentUser = ReactiveCache.getCurrentUser();
-    return currentUser && !currentUser.isCommentOnly();
-  },
-});
-
-Template.allBoardsHomeSidebar.events({
-  'click .js-all-boards-sidebar-search'(evt) {
-    evt.preventDefault();
-    openAllBoardsSidebar(SIDEBAR_SEARCH);
-  },
-  'click .js-all-boards-sidebar-multiselection'(evt) {
-    evt.preventDefault();
-    BoardMultiSelection.activate();
-    openAllBoardsSidebar(SIDEBAR_MULTISELECTION);
-  },
-  // Boards in Archive is a page. This row had no handler at all: the one it
-  // relied on lived in the header bar's events map and went when that map was
-  // rewritten, so the button did nothing.
-  'click .js-open-archived-board'(evt) {
-    evt.preventDefault();
-    closeAllBoardsSidebar();
-    // The SECTION of this page, not the full-width page it replaced.
-    // docs/Design/Page/Archive.md
-    FlowRouter.go(allBoardsPath(SECTION_ARCHIVE, []));
-  },
-});
-
-Template.allBoardsSearchSidebar.helpers({
-  boardSearch() {
-    return allBoardsSearchVar.get();
-  },
-});
-
-// The search term is the page's, not this template's: the board list behind the
-// sidebar filters as you type, which is what the header bar's search field did
-// before it became a sidebar view.
-Template.allBoardsSearchSidebar.events({
-  'input .js-board-search-input'(evt) {
-    allBoardsSearchVar.set(evt.currentTarget.value);
-  },
-  'keydown .js-board-search-input'(evt) {
-    if (evt.key === 'Escape') {
-      // Clear first, close second: Escape on a search box that has text in it
-      // means "undo the search", and only an already-empty box falls through to
-      // the sidebar's own Escape.
-      if (allBoardsSearchVar.get()) {
-        evt.preventDefault();
-        evt.stopPropagation();
-        allBoardsSearchVar.set('');
-        evt.currentTarget.value = '';
-      }
-    }
-  },
-  'click .js-board-search-clear'(evt, tpl) {
-    evt.preventDefault();
-    allBoardsSearchVar.set('');
-    const input = tpl.find('.js-board-search-input');
-    if (input) {
-      input.value = '';
-      input.focus();
-    }
-  },
-});
-
-// What the "Selected: ★" row would do if clicked right now, and to which
-// boards. The same function the header bar used - see models/lib/selectedStars.
-function currentSelectedStarAction() {
-  const user = ReactiveCache.getCurrentUser();
-  return selectedStarAction(BoardMultiSelection.getSelectedBoardIds(), id =>
-    Boolean(user && user.hasStarred(id)),
-  );
-}
-
-Template.allBoardsMultiSelectionSidebar.helpers({
-  hasBoardsSelected() {
-    return BoardMultiSelection.count() > 0;
-  },
-  selectedStarTitle() {
-    return TAPi18n.__(selectedStarTitleKey(currentSelectedStarAction().action));
-  },
-});
-
-Template.allBoardsMultiSelectionSidebar.events({
-  // Only the boards that must CHANGE are toggled: toggleBoardStar flips one
-  // board, so calling it for an already-starred one in the mixed case would
-  // un-star it.
-  'click .js-star-selected'(evt) {
-    evt.preventDefault();
-    currentSelectedStarAction().boardIds.forEach((id) => {
-      Meteor.call('toggleBoardStar', id);
-    });
-  },
-  'click .js-home-selected'(evt) {
-    evt.preventDefault();
-    const ids = BoardMultiSelection.getSelectedBoardIds();
-    if (ids.length) {
-      Meteor.call('toggleDefaultBoard', ids[0]);
-    }
-  },
-  'click .js-archive-selected-boards'(evt) {
-    evt.preventDefault();
-    const selectedBoards = BoardMultiSelection.getSelectedBoardIds();
-    if (
-      selectedBoards.length > 0 &&
-      confirm(TAPi18n.__('archive-board-confirm'))
-    ) {
-      selectedBoards.forEach((boardId) => {
-        Meteor.call('archiveBoard', boardId, (err) => {
-          if (err) alert(err?.reason || err?.message || 'Failed to archive board');
-        });
-      });
-      BoardMultiSelection.reset();
-    }
-  },
-  'click .js-duplicate-selected-boards'(evt) {
-    evt.preventDefault();
-    const selectedBoards = BoardMultiSelection.getSelectedBoardIds();
-    if (
-      selectedBoards.length > 0 &&
-      confirm(TAPi18n.__('duplicate-board-confirm'))
-    ) {
-      selectedBoards.forEach((boardId) => {
-        const board = ReactiveCache.getBoard(boardId);
-        if (board) {
-          Meteor.call(
-            'copyBoard',
-            boardId,
-            {
-              sort: ReactiveCache.getBoards({ archived: false }).length,
-              type: 'board',
-              title: board.title,
-            },
-            (err) => {
-              if (err) console.error(err);
-            },
-          );
-        }
-      });
-      BoardMultiSelection.reset();
-    }
-  },
-  'click .js-multiselection-reset'(evt) {
-    evt.preventDefault();
-    BoardMultiSelection.disable();
-  },
-});

client/components/boards/boardArchive.jade

@@ -1,24 +1,19 @@
 template(name="archivedBoards")
-  .table-page-controls
-    input.js-archived-boards-search(type="search" placeholder="{{_ 'search'}}")
-    .table-page-pagination
-      button.js-archived-boards-prev-page(class="{{#if hasPrevPage}}{{else}}disabled{{/if}}")
-        | <
-      span.table-page-page-info {{currentPage}} / {{totalPages}}
-      button.js-archived-boards-next-page(class="{{#if hasNextPage}}{{else}}disabled{{/if}}")
-        | >
+  h2
+    i.fa.fa-archive
+    | {{_ 'archived-boards'}}
+
   ul.archived-lists
     each archivedBoards
       li.archived-lists-item
         div.board-header-btns
-          button.primary.board-header-btn.js-delete-board(type="submit")
-            i.fa.fa-trash
+          button.board-header-btn.js-delete-board
+            i.fa.fa-trash-o
             | {{_ 'delete-board'}}
-          button.primary.board-header-btn.js-restore-board(type="submit")
+          button.board-header-btn.js-restore-board
             i.fa.fa-undo
             | {{_ 'restore-board'}}
           = title
-        span {{ displayDate archivedAt 'LLL' }}
     else
       li.no-items-message {{_ 'no-archived-boards'}}
 

client/components/boards/boardArchive.js

@@ -1,96 +1,39 @@
-import { ReactiveCache } from '/imports/reactiveCache';
-import { FlowRouter } from 'meteor/ostrio:flow-router-extra';
-import Boards from '/models/boards';
-import { Utils } from '/client/lib/utils';
-import { TABLE_PAGE_ROWS_PER_PAGE } from '/models/lib/tablePage';
-
-// The app's one rows-per-page (docs/Design/Page/Table.md): the archive pages
-// like every other paginated page, whatever pager it draws.
-const ARCHIVED_BOARDS_PER_PAGE = TABLE_PAGE_ROWS_PER_PAGE;
-
-Template.archivedBoards.onCreated(function () {
-  // Server-side pagination: only the current page of archived boards is ever
-  // published/loaded, so a long-lived instance's archive stays fast.
-  this.page = new ReactiveVar(1);
-  this.total = new ReactiveVar(0);
-  this.searchQuery = new ReactiveVar('');
-  this.autorun(() => {
-    const searchTerm = this.searchQuery.get();
-    const skip = (this.page.get() - 1) * ARCHIVED_BOARDS_PER_PAGE;
-    this.subscribe('archivedBoards', searchTerm, ARCHIVED_BOARDS_PER_PAGE, skip);
-    Meteor.call('getArchivedBoardsCount', searchTerm, (err, count) => {
-      if (!err) this.total.set(count || 0);
-    });
-  });
-});
-
-Template.archivedBoards.helpers({
-  isBoardAdmin() {
-    return ReactiveCache.getCurrentUser()?.isBoardAdmin();
+BlazeComponent.extendComponent({
+  onCreated() {
+    this.subscribe('archivedBoards');
   },
 
   archivedBoards() {
-    // Only the current page is in minimongo (the publication is limited).
-    return ReactiveCache.getBoards(
-      { archived: true },
-      { sort: { archivedAt: -1, modifiedAt: -1 } },
-    );
+    return Boards.find({ archived: true }, {
+      sort: ['title'],
+    });
   },
 
-  currentPage() { return Template.instance().page.get(); },
-  totalPages() { return Math.max(1, Math.ceil((Template.instance().total.get() || 0) / ARCHIVED_BOARDS_PER_PAGE)); },
-  hasPrevPage() { return Template.instance().page.get() > 1; },
-  hasNextPage() {
-    const tpl = Template.instance();
-    return tpl.page.get() < Math.max(1, Math.ceil((tpl.total.get() || 0) / ARCHIVED_BOARDS_PER_PAGE));
+  events() {
+    return [{
+      'click .js-restore-board'() {
+        // TODO : Make isSandstorm variable global
+        const isSandstorm = Meteor.settings && Meteor.settings.public &&
+          Meteor.settings.public.sandstorm;
+        if (isSandstorm && Session.get('currentBoard')) {
+          const currentBoard = Boards.findOne(Session.get('currentBoard'));
+          currentBoard.archive();
+        }
+        const board = this.currentData();
+        board.restore();
+        Utils.goBoardId(board._id);
+      },
+      'click .js-delete-board': Popup.afterConfirm('boardDelete', function() {
+        Popup.close();
+        const isSandstorm = Meteor.settings && Meteor.settings.public &&
+          Meteor.settings.public.sandstorm;
+        if (isSandstorm && Session.get('currentBoard')) {
+          const currentBoard = Boards.findOne(Session.get('currentBoard'));
+          Boards.remove(currentBoard._id);
+        }
+        Boards.remove(this._id);
+        FlowRouter.go('home');
+      }),
+    }];
   },
-});
-
-Template.archivedBoards.events({
-  'keydown .js-archived-boards-search'(event, tpl) {
-    if (event.keyCode === 13) {
-      event.preventDefault();
-      tpl.searchQuery.set(tpl.$('.js-archived-boards-search').val() || '');
-      tpl.page.set(1);
-    }
-  },
-  'click .js-archived-boards-prev-page'(event, tpl) {
-    event.preventDefault();
-    const current = tpl.page.get();
-    if (current > 1) tpl.page.set(current - 1);
-  },
-  'click .js-archived-boards-next-page'(event, tpl) {
-    event.preventDefault();
-    const total = tpl.total.get() || 0;
-    const totalPages = Math.max(1, Math.ceil(total / ARCHIVED_BOARDS_PER_PAGE));
-    const current = tpl.page.get();
-    if (current < totalPages) tpl.page.set(current + 1);
-  },
-  async 'click .js-restore-board'() {
-    // TODO : Make isSandstorm variable global
-    const isSandstorm =
-      Meteor.settings &&
-      Meteor.settings.public &&
-      Meteor.settings.public.sandstorm;
-    if (isSandstorm && Utils.getCurrentBoardId()) {
-      const currentBoard = Utils.getCurrentBoard();
-      await currentBoard.archive();
-    }
-    const board = this;
-    await board.restore();
-    Utils.goBoardId(board._id);
-  },
-  'click .js-delete-board': Popup.afterConfirm('boardDelete', async function() {
-    Popup.back();
-    const isSandstorm =
-      Meteor.settings &&
-      Meteor.settings.public &&
-      Meteor.settings.public.sandstorm;
-    if (isSandstorm && Utils.getCurrentBoardId()) {
-      const currentBoard = Utils.getCurrentBoard();
-      await Boards.removeAsync(currentBoard._id);
-    }
-    await Boards.removeAsync(this._id);
-    FlowRouter.go('home');
-  }),
-});
+}).register('archivedBoards');

client/components/boards/boardBody.css

@@ -1,606 +0,0 @@
-.board-wrapper {
-  position: absolute;
-  inset-inline-start: 0;
-  inset-inline-end: 0;
-  top: 0;
-  bottom: 0;
-  overflow-x: hidden;
-  overflow-y: hidden;
-  width: 100%;
-  min-width: 100%;
-}
-
-/* When zoom is 50% or lower, ensure full width like content */
-.board-wrapper[style*="transform: scale(0.5)"] {
-  width: 100% !important;
-  max-width: 100% !important;
-  margin: 0 !important;
-}
-
-.board-wrapper[style*="transform: scale(0.4)"] {
-  width: 100% !important;
-  max-width: 100% !important;
-  margin: 0 !important;
-}
-
-.board-wrapper[style*="transform: scale(0.3)"] {
-  width: 100% !important;
-  max-width: 100% !important;
-  margin: 0 !important;
-}
-.board-wrapper .board-canvas {
-  position: absolute;
-  inset-inline-start: 0;
-  inset-inline-end: 0;
-  top: 0;
-  bottom: 0;
-  transition: margin 0.1s;
-  overflow-y: auto;
-  width: 100%;
-  min-width: 100%;
-}
-
-/* Ensure horizontal scrollbar is visible for high zoom levels */
-.board-wrapper .board-canvas[style*="overflow-x: auto"] {
-  overflow-x: auto !important;
-  overflow-y: auto !important;
-}
-
-/* Style the scrollbar for better visibility */
-.board-wrapper .board-canvas::-webkit-scrollbar {
-  height: 12px;
-  width: 12px;
-}
-
-.board-wrapper .board-canvas::-webkit-scrollbar-track {
-  background: #f1f1f1;
-  border-radius: 6px;
-}
-
-.board-wrapper .board-canvas::-webkit-scrollbar-thumb {
-  background: #888;
-  border-radius: 6px;
-}
-
-.board-wrapper .board-canvas::-webkit-scrollbar-thumb:hover {
-  background: #555;
-}
-
-/* Ensure content area can scroll horizontally for high zoom levels */
-#content[style*="overflow-x: auto"] {
-  overflow-x: auto !important;
-  overflow-y: auto !important;
-}
-
-/* Style content area scrollbar */
-#content::-webkit-scrollbar {
-  height: 12px;
-  width: 12px;
-}
-
-#content::-webkit-scrollbar-track {
-  background: #f1f1f1;
-  border-radius: 6px;
-}
-
-#content::-webkit-scrollbar-thumb {
-  background: #888;
-  border-radius: 6px;
-}
-
-#content::-webkit-scrollbar-thumb:hover {
-  background: #555;
-}
-
-/* Ensure scrollbars are always visible for high zoom levels */
-#content[style*="overflow-x: auto"] {
-  position: relative;
-}
-
-#content[style*="overflow-x: auto"]::-webkit-scrollbar {
-  height: 12px;
-  width: 12px;
-}
-
-    /* Force vertical scrollbar to always be visible */
-    #content[style*="overflow-y: auto"] {
-      overflow-y: scroll !important;
-    }
-
-    /* Mobile - keep #content text at normal size (reverted #6426 oversizing) */
-    @media screen and (max-width: 800px),
-           screen and (max-device-width: 800px),
-           screen and (-webkit-min-device-pixel-ratio: 2) and (max-width: 800px),
-           screen and (max-width: 800px) and (orientation: portrait),
-           screen and (max-width: 800px) and (orientation: landscape) {
-      #content {
-        font-size: 1em !important; /* Normal size (reverted #6426 oversizing) */
-      }
-
-      /* Keep all text elements at normal size */
-      #content h1, #content h2, #content h3, #content h4, #content h5, #content h6,
-      #content p, #content span, #content div, #content a, #content button,
-      #content .minicard, #content .list-header-name, #content .board-header-btn,
-      #content .card-title, #content .card-details, #content .card-description,
-      #content .swimlane-header, #content .list-title, #content .card-text,
-      #content .member, #content .member-name, #content .member-initials,
-      #content .checklist-item, #content .checklist-title, #content .comment,
-      #content .activity, #content .activity-text, #content .activity-time,
-      #content .board-title, #content .board-description, #content .list-name,
-      #content .card-text, #content .card-title, #content .card-description,
-      #content .swimlane-title, #content .swimlane-description,
-      #content .board-header-title, #content .board-header-description,
-      #content .card-detail-title, #content .card-detail-description,
-      #content .list-header-title, #content .list-header-description,
-      #content .swimlane-header-title, #content .swimlane-header-description,
-      #content .minicard-title, #content .minicard-description,
-      #content .card-comment, #content .card-comment-text,
-      #content .checklist-item-text, #content .checklist-item-title,
-      #content .activity-item, #content .activity-item-text,
-      #content .board-member, #content .board-member-name,
-      #content .team-member, #content .team-member-name,
-      #content .org-member, #content .org-member-name,
-      #content .template-member, #content .template-member-name,
-      #content .user-name, #content .user-email, #content .user-role,
-      #content .setting-title, #content .setting-description,
-      #content .popup-title, #content .popup-description,
-      #content .modal-title, #content .modal-description,
-      #content .notification-title, #content .notification-text,
-      #content .announcement-title, #content .announcement-text,
-      #content .offline-warning-title, #content .offline-warning-text,
-      #content .error-title, #content .error-text,
-      #content .success-title, #content .success-text,
-      #content .info-title, #content .info-text,
-      #content .warning-title, #content .warning-text {
-        font-size: 1em !important; /* Use inherited 2x scaling */
-      }
-
-      /* Keep icons the same size (don't scale them) */
-      #content .fa, #content .icon, #content i {
-        font-size: 1em !important; /* Keep original icon size */
-      }
-
-      /* Reset specific icon sizes to prevent double scaling */
-      #content .fa-home, #content .fa-bars, #content .fa-search,
-      #content .fa-bell, #content .fa-user, #content .fa-cog,
-      #content .fa-plus, #content .fa-minus, #content .fa-edit,
-      #content .fa-trash, #content .fa-save, #content .fa-cancel,
-      #content .fa-arrow-left, #content .fa-arrow-right,
-      #content .fa-arrow-up, #content .fa-arrow-down,
-      #content .fa-check, #content .fa-times, #content .fa-close,
-      #content .fa-star, #content .fa-heart, #content .fa-thumbs-up,
-      #content .fa-thumbs-down, #content .fa-comment, #content .fa-reply,
-      #content .fa-share, #content .fa-download, #content .fa-upload,
-      #content .fa-copy, #content .fa-paste, #content .fa-cut,
-      #content .fa-undo, #content .fa-redo, #content .fa-refresh,
-      #content .fa-sync, #content .fa-spinner, #content .fa-loading,
-      #content .fa-info, #content .fa-question, #content .fa-exclamation,
-      #content .fa-warning, #content .fa-error, #content .fa-success,
-      #content .fa-check-circle, #content .fa-times-circle,
-      #content .fa-exclamation-circle, #content .fa-question-circle,
-      #content .fa-info-circle, #content .fa-warning-circle,
-      #content .fa-error-circle, #content .fa-success-circle {
-        font-size: 1em !important; /* Keep original icon size */
-      }
-    }
-
-    /* Fallback for iPhone devices using JavaScript detection */
-    .iphone-device #content {
-      font-size: 1em !important; /* Normal size (reverted #6426 oversizing) */
-    }
-
-    .iphone-device #content h1, .iphone-device #content h2, .iphone-device #content h3, .iphone-device #content h4, .iphone-device #content h5, .iphone-device #content h6,
-    .iphone-device #content p, .iphone-device #content span, .iphone-device #content div, .iphone-device #content a, .iphone-device #content button,
-    .iphone-device #content .minicard, .iphone-device #content .list-header-name, .iphone-device #content .board-header-btn,
-    .iphone-device #content .card-title, .iphone-device #content .card-details, .iphone-device #content .card-description,
-    .iphone-device #content .swimlane-header, .iphone-device #content .list-title, .iphone-device #content .card-text,
-    .iphone-device #content .member, .iphone-device #content .member-name, .iphone-device #content .member-initials,
-    .iphone-device #content .checklist-item, .iphone-device #content .checklist-title, .iphone-device #content .comment,
-    .iphone-device #content .activity, .iphone-device #content .activity-text, .iphone-device #content .activity-time,
-    .iphone-device #content .board-title, .iphone-device #content .board-description, .iphone-device #content .list-name,
-    .iphone-device #content .card-text, .iphone-device #content .card-title, .iphone-device #content .card-description,
-    .iphone-device #content .swimlane-title, .iphone-device #content .swimlane-description,
-    .iphone-device #content .board-header-title, .iphone-device #content .board-header-description,
-    .iphone-device #content .card-detail-title, .iphone-device #content .card-detail-description,
-    .iphone-device #content .list-header-title, .iphone-device #content .list-header-description,
-    .iphone-device #content .swimlane-header-title, .iphone-device #content .swimlane-header-description,
-    .iphone-device #content .minicard-title, .iphone-device #content .minicard-description,
-    .iphone-device #content .card-comment, .iphone-device #content .card-comment-text,
-    .iphone-device #content .checklist-item-text, .iphone-device #content .checklist-item-title,
-    .iphone-device #content .activity-item, .iphone-device #content .activity-item-text,
-    .iphone-device #content .board-member, .iphone-device #content .board-member-name,
-    .iphone-device #content .team-member, .iphone-device #content .team-member-name,
-    .iphone-device #content .org-member, .iphone-device #content .org-member-name,
-    .iphone-device #content .template-member, .iphone-device #content .template-member-name,
-    .iphone-device #content .user-name, .iphone-device #content .user-email, .iphone-device #content .user-role,
-    .iphone-device #content .setting-title, .iphone-device #content .setting-description,
-    .iphone-device #content .popup-title, .iphone-device #content .popup-description,
-    .iphone-device #content .modal-title, .iphone-device #content .modal-description,
-    .iphone-device #content .notification-title, .iphone-device #content .notification-text,
-    .iphone-device #content .announcement-title, .iphone-device #content .announcement-text,
-    .iphone-device #content .offline-warning-title, .iphone-device #content .offline-warning-text,
-    .iphone-device #content .error-title, .iphone-device #content .error-text,
-    .iphone-device #content .success-title, .iphone-device #content .success-text,
-    .iphone-device #content .info-title, .iphone-device #content .info-text,
-    .iphone-device #content .warning-title, .iphone-device #content .warning-text {
-      font-size: 1em !important; /* Use inherited 2x scaling */
-    }
-
-    /* Keep icons the same size for iPhone devices */
-    .iphone-device #content .fa, .iphone-device #content .icon, .iphone-device #content i {
-      font-size: 1em !important; /* Keep original icon size */
-    }
-
-/* Mobile iPhone: keep card details text/icons at normal size (reverted #6426 oversizing) */
-body.mobile-mode.iphone-device .card-details {
-  font-size: 1em !important;
-}
-body.mobile-mode.iphone-device .card-details .fa,
-body.mobile-mode.iphone-device .card-details .icon,
-body.mobile-mode.iphone-device .card-details i,
-body.mobile-mode.iphone-device .card-details .emoji-icon,
-body.mobile-mode.iphone-device .card-details a,
-body.mobile-mode.iphone-device .card-details p,
-body.mobile-mode.iphone-device .card-details span,
-body.mobile-mode.iphone-device .card-details div,
-body.mobile-mode.iphone-device .card-details button,
-body.mobile-mode.iphone-device .card-details input,
-body.mobile-mode.iphone-device .card-details select,
-body.mobile-mode.iphone-device .card-details textarea {
-  font-size: inherit !important;
-}
-/* Section titles slightly larger than content but not as big as card title */
-body.mobile-mode.iphone-device .card-details .card-details-item-title {
-  font-size: 1.1em !important;
-  font-weight: bold;
-}
-
-/* Ensure scrollbars are positioned correctly */
-#content[style*="overflow-x: auto"]::-webkit-scrollbar:vertical {
-  width: 12px;
-}
-
-#content[style*="overflow-x: auto"]::-webkit-scrollbar:horizontal {
-  height: 12px;
-}
-
-/* Force both scrollbars to always be visible for high zoom levels */
-#content[style*="overflow-x: auto"][style*="overflow-y: auto"] {
-  overflow-x: scroll !important;
-  overflow-y: scroll !important;
-}
-
-/* Ensure the right scrollbar is always visible on the inner right edge */
-#content[style*="overflow-y: auto"] {
-  scrollbar-gutter: stable;
-}
-.board-wrapper .board-canvas .board-overlay {
-  position: fixed;
-  inset-inline-start: 0;
-  inset-inline-end: 0;
-  top: 0;
-  bottom: 0;
-  top: -100px;
-  inset-inline-end: -400px;
-  background: #000;
-  opacity: 0.33;
-  animation: fadeIn 0.2s;
-  z-index: 16;
-}
-
-/* Fix for mobile Safari: ensure overlay stays behind card details */
-@media screen and (max-width: 800px) {
-  .board-wrapper .board-canvas .board-overlay {
-    z-index: 17 !important;
-  }
-
-  /* In desktop mode on small screens, still keep overlay behind card */
-  body.desktop-mode .board-wrapper .board-canvas .board-overlay {
-    z-index: 17 !important;
-  }
-}
-
-/* In mobile mode, lower the overlay z-index to stay behind card details */
-body.mobile-mode .board-wrapper .board-canvas .board-overlay {
-  z-index: 17 !important;
-}
-
-/* iPhone in desktop mode: remove overlay to avoid blocking card */
-body.desktop-mode.iphone-device .board-wrapper .board-canvas .board-overlay {
-  display: none !important;
-  pointer-events: none !important;
-}
-
-/* Desktop mode: hide overlay to allow multiple cards and board interaction */
-body.desktop-mode .board-wrapper .board-canvas .board-overlay {
-  display: none !important;
-  pointer-events: none !important;
-}
-/* #2877 "Wekan swimlane jumps when moving card": while a card is dragged the
-   "+ Add Card" composer link is hidden, but hiding it with `display: none`
-   collapsed the bottom row of EVERY list at drag start (and restored it on
-   drop). With auto-height swimlanes the whole swimlane shrank/grew by the
-   composer's height, so all swimlanes below visibly jumped up and back down.
-   `visibility: hidden` hides the link just the same but keeps its box in the
-   layout, so nothing moves when a drag starts or ends. */
-.board-wrapper .board-canvas.is-dragging-active .open-minicard-composer {
-  visibility: hidden;
-}
-/* Checked cards of a multi-selection ARE the payload being dragged, so
-   removing them from the flow (showing the list as it will look after the
-   drop) is intentional — keep display: none here. */
-.board-wrapper .board-canvas.is-dragging-active .minicard-wrapper.is-checked {
-  display: none;
-}
-/* Mobile view styles - applied when isMiniScreen is true (iPhone, etc.) */
-.board-wrapper.mobile-view {
-  width: 100% !important;
-  max-width: 100% !important;
-  min-width: 100% !important;
-  inset-inline-start: 0 !important;
-  inset-inline-end: 0 !important;
-  overflow-x: hidden !important;
-  overflow-y: auto !important;
-}
-
-.board-wrapper.mobile-view .board-canvas {
-  width: 100% !important;
-  max-width: 100% !important;
-  min-width: 100% !important;
-  inset-inline-start: 0 !important;
-  inset-inline-end: 0 !important;
-  overflow-x: hidden !important;
-  overflow-y: auto !important;
-}
-
-.board-wrapper.mobile-view .board-canvas.mobile-view .swimlane {
-  border-bottom: 1px solid #ccc;
-  display: block !important;
-  flex-direction: column;
-  margin: 0;
-  padding: 0;
-  overflow-x: hidden !important;
-  overflow-y: auto;
-  width: 100% !important;
-  max-width: 100% !important;
-  min-width: 100% !important;
-}
-
-/* MOBILE MODE, not a narrow window. A swimlane laid out as a BLOCK with
-   `overflow-x: hidden` is the phone board: every list becomes a full-width row,
-   one under the other, and the "add list" form lands under the last list rather
-   than beside it. A phone whose user chose DESKTOP mode asked for the desktop
-   board - lists side by side, scrolled sideways - and was getting the phone one.
-   `.board-wrapper.mobile-view` above says the same thing for the mini-screen
-   class; this says it for the mode the user picked. */
-@media screen and (max-width: 800px),
-       screen and (max-device-width: 932px) and (-webkit-min-device-pixel-ratio: 3) {
-  body.mobile-mode .board-wrapper {
-    width: 100% !important;
-    max-width: 100% !important;
-    min-width: 100% !important;
-    inset-inline-start: 0 !important;
-    inset-inline-end: 0 !important;
-    overflow-x: hidden !important;
-    overflow-y: auto !important;
-  }
-
-  body.mobile-mode .board-wrapper .board-canvas {
-    width: 100% !important;
-    max-width: 100% !important;
-    min-width: 100% !important;
-    inset-inline-start: 0 !important;
-    inset-inline-end: 0 !important;
-    overflow-x: hidden !important;
-    overflow-y: auto !important;
-  }
-
-  body.mobile-mode .board-wrapper .board-canvas .swimlane {
-    border-bottom: 1px solid #ccc;
-    display: block !important;
-    flex-direction: column;
-    margin: 0;
-    padding: 0;
-    overflow-x: hidden !important;
-    overflow-y: auto;
-    width: 100% !important;
-    max-width: 100% !important;
-    min-width: 100% !important;
-  }
-
-  /* Desktop mode on a narrow window: the board scrolls SIDEWAYS, like a desktop
-     board. Without this the canvas would keep the `overflow-x: hidden` it has
-     from elsewhere and the lists past the right edge would be unreachable. */
-  body:not(.mobile-mode) .board-wrapper,
-  body:not(.mobile-mode) .board-wrapper .board-canvas {
-    overflow-x: auto !important;
-  }
-
-  body:not(.mobile-mode) .board-wrapper .board-canvas .swimlane {
-    display: flex !important;
-    flex-direction: row !important;
-    overflow-x: auto !important;
-  }
-}
-.calendar-event-green {
-  background: #3cb500 !important;
-  border-color: #2a8000;
-  color: #fff !important;
-}
-.calendar-event-yellow {
-  background: #fad900 !important;
-  border-color: #c7ac00;
-  color: #000 !important;
-}
-.calendar-event-orange {
-  background: #ff9f19 !important;
-  border-color: #cc7c14;
-  color: #000 !important;
-}
-.calendar-event-red {
-  background: #eb4646 !important;
-  border-color: #b83737;
-  color: #fff !important;
-}
-.calendar-event-purple {
-  background: #a632db !important;
-  border-color: #7d26a6;
-  color: #fff !important;
-}
-.calendar-event-blue {
-  background: #0079bf !important;
-  border-color: #005a8a;
-  color: #fff !important;
-}
-.calendar-event-pink {
-  background: #ff78cb !important;
-  border-color: #cc62a3;
-  color: #000 !important;
-}
-.calendar-event-sky {
-  background: #00c2e0 !important;
-  border-color: #0094ab;
-  color: #fff !important;
-}
-.calendar-event-black {
-  background: #4d4d4d !important;
-  border-color: #1a1a1a;
-  color: #fff !important;
-}
-.calendar-event-lime {
-  background: #51e898 !important;
-  border-color: #3eb375;
-  color: #000 !important;
-}
-.calendar-event-silver {
-  background: #c0c0c0 !important;
-  border-color: #8c8c8c;
-  color: #000 !important;
-}
-.calendar-event-peachpuff {
-  background: #ffdab9 !important;
-  border-color: #ccaf95;
-  color: #000 !important;
-}
-.calendar-event-crimson {
-  background: #dc143c !important;
-  border-color: #a8112f;
-  color: #fff !important;
-}
-.calendar-event-plum {
-  background: #dda0dd !important;
-  border-color: #a87ba8;
-  color: #000 !important;
-}
-.calendar-event-darkgreen {
-  background: #006400 !important;
-  border-color: #003000;
-  color: #fff !important;
-}
-.calendar-event-slateblue {
-  background: #6a5acd !important;
-  border-color: #4f4399;
-  color: #fff !important;
-}
-.calendar-event-magenta {
-  background: #f0f !important;
-  border-color: #c0c;
-  color: #fff !important;
-}
-.calendar-event-gold {
-  background: #ffd700 !important;
-  border-color: #ca0;
-  color: #000 !important;
-}
-.calendar-event-navy {
-  background: #000080 !important;
-  border-color: #003;
-  color: #fff !important;
-}
-.calendar-event-gray {
-  background: #808080 !important;
-  border-color: #333;
-  color: #fff !important;
-}
-.calendar-event-saddlebrown {
-  background: #8b4513 !important;
-  border-color: #572b0c;
-  color: #fff !important;
-}
-.calendar-event-paleturquoise {
-  background: #afeeee !important;
-  border-color: #8ababa;
-  color: #000 !important;
-}
-.calendar-event-mistyrose {
-  background: #ffe4e1 !important;
-  border-color: #ccb8b6;
-  color: #000 !important;
-}
-.calendar-event-indigo {
-  background: #4b0082 !important;
-  border-color: #2b004d;
-  color: #fff !important;
-}
-/* Modal Styles */
-.modal {
-  display: none;
-  position: fixed;
-  top: 50%;
-  left: 50%;
-  transform: translate(-50%, -50%);
-  z-index: 9999;
-  background-color: rgba(0, 0, 0, 0.5);
-  width: 100%;
-  height: 100%;
-}
-.modal-dialog {
-  display: flex;
-  justify-content: center;
-  align-items: center;
-  height: 25%; /* Adjust the height to make it smaller */
-  position: relative;
-  margin: 10% auto; /* This margin will help center the modal vertically */
-  max-width: 400px; /* Adjust the max-width to make it smaller */
-  background-color: #fff;
-  border-radius: 5px;
-  box-shadow: 0 0 10px rgba(0, 0, 0, 0.3);
-}
-.modal-header {
-  display: flex;
-  justify-content: center;
-  align-items: center;
-  padding-bottom: 1px;
-  border-bottom: 1px solid #ccc;
-}
-.modal-title {
-  display: flex;
-  justify-content: center;
-  align-items: center;
-  margin: 0;
-  font-size: 18px;
-}
-.modal-footer {
-  display: flex;
-  justify-content: center;
-  align-items: center;
-  padding-top: 4px;
-  border-top: 1px solid #ccc;
-}
-.close {
-  display: flex;
-  justify-content: center;
-  align-items: center;
-  position: absolute;
-  top: 5px;
-  inset-inline-end: 5px;
-  font-size: 25px;
-  cursor: pointer;
-}
-
-/* Global file drag over state for board canvas */
-.board-canvas.file-drag-over {
-  background-color: rgba(0, 123, 255, 0.05) !important;
-  border: 2px dashed #007bff !important;
-  transition: all 0.2s ease;
-}

client/components/boards/boardBody.jade

@@ -1,75 +1,42 @@
 template(name="board")
-
-  if isConverting
-    +boardConversionProgress
-  else if isBoardReady
+  if isBoardReady.get
     if currentBoard
       if onlyShowCurrentCard
         +cardDetails(currentCard)
       else
         +boardBody
     else
-      //-- XXX We need a better error message in case the board has been archived
-      +message(label="board-not-found")
-      //-- | {{goHome}}
+      //- XXX We need a better error message in case the board has been archived
+      //+message(label="board-not-found")
+      {{goHome}}
   else
     +spinner
 
 template(name="boardBody")
-  if notDisplayThisBoard
-   | {{_ 'tableVisibilityMode-allowPrivateOnly'}}
-  else
-    // Debug information (remove in production)
-    if debugBoardState
-      .debug-info(style="position: fixed; top: 0; inset-inline-start: 0; background: rgba(0,0,0,0.8); color: white; padding: 10px; z-index: 9999; font-size: 12px;")
-        | {{_ 'board'}}: {{currentBoard.title}} | {{_ 'view'}}: {{boardView}} | {{_ 'has-swimlanes'}}: {{hasSwimlanes}} | {{_ 'swimlanes'}}: {{currentBoard.swimlanes.length}}
-    .board-wrapper(class="{{themeColorClass}}" class="{{#if isMiniScreen}}mobile-view{{/if}}")
-      .board-canvas.js-swimlanes.dragscroll(
-        class="{{#if Sidebar.isOpen}}is-sibling-sidebar-open{{/if}}"
-        class="{{#if MultiSelection.isActive}}is-multiselection-active{{/if}}"
-        class="{{#if draggingActive}}is-dragging-active{{/if}}"
-        class="{{#unless isVerticalScrollbars}}no-scrollbars{{/unless}}"
-        class="{{#if isMiniScreen}}mobile-view{{/if}}")
-        if currentBoard.showDependencies
-          +dependencyOverlay
-        if showOverlay
-          .board-overlay
-        if currentBoard.isTemplatesBoard
-          each currentBoard.swimlanes
-            +swimlane(this)
-        else if isViewSwimlanes
-          if hasSwimlanes
-            each currentBoard.swimlanes
-              +swimlane(this)
-          else
-            // Fallback: If no swimlanes exist, show lists instead of empty message
-            +listsGroup(currentBoard)
-        else if isViewLists
-          +listsGroup(currentBoard)
-        else if isViewCalendar
-          +calendarView
-        else if isViewGantt
-          +ganttView
-        else if isViewTable
-          +tableView
-        else if isViewStats
-          +statsView
-        else
-          // Default view - show swimlanes if they exist, otherwise show lists
-          if hasSwimlanes
-            each currentBoard.swimlanes
-              +swimlane(this)
-          else
-            +listsGroup(currentBoard)
-      //- Render multiple open cards in desktop mode
-      unless isMiniScreen
-        each openCards
-          +cardDetails(this cardIndex=@index)
-      +sidebar
+  .board-wrapper(class=currentBoard.colorClass)
+    +sidebar
+    .board-canvas.js-swimlanes.js-perfect-scrollbar(
+      class="{{#if Sidebar.isOpen}}is-sibling-sidebar-open{{/if}}"
+      class="{{#if MultiSelection.isActive}}is-multiselection-active{{/if}}"
+      class="{{#if draggingActive.get}}is-dragging-active{{/if}}")
+      if showOverlay.get
+        .board-overlay
+      if currentBoard.isTemplatesBoard
+        each currentBoard.swimlanes
+          +swimlane(this)
+      else if isViewSwimlanes
+        each currentBoard.swimlanes
+          +swimlane(this)
+      else if isViewLists
+        +listsGroup(currentBoard)
+      else if isViewCalendar
+        +calendarView
+      else
+        +listsGroup(currentBoard)
 
 template(name="calendarView")
   if isViewCalendar
-    .calendar-view.swimlane.dragscroll
+    .calendar-view.swimlane
       if currentCard
         +cardDetails(currentCard)
-      +fullcalendar(calendarOptions)
+      +fullcalendar(calendarOptions)

client/components/boards/boardBody.styl

@@ -0,0 +1,55 @@
+@import 'nib'
+
+position()
+  if arguments[0] == cover || arguments[0] == fixed-cover
+    if arguments[0] == cover
+      position: absolute
+    else
+      position: fixed
+    left: 0
+    right: 0
+    top: 0
+    bottom: 0
+  else
+    position: arguments
+
+.board-wrapper
+  position: cover
+  overflow-x: hidden
+  overflow-y: hidden
+
+  .board-canvas
+    position: cover
+    transition: margin .1s
+    overflow-y: auto
+
+    &.is-sibling-sidebar-open
+      margin-right: 248px
+
+    .board-overlay
+      position: fixed-cover
+      top: -100px
+      right: -400px
+      background: black
+      opacity: 0.33
+      animation: fadeIn 0.2s
+      z-index: 16
+
+    &.is-dragging-active
+      .open-minicard-composer,
+      .minicard-wrapper.is-checked
+        display: none
+
+@media screen and (max-width: 800px)
+  .board-wrapper
+
+    .board-canvas
+
+      .swimlane
+        border-bottom: 1px solid #CCC
+        display: flex
+        flex-direction: column
+        margin: 0
+        padding: 0 0px 0px 0
+        overflow-x: hidden
+        overflow-y: auto

client/components/boards/boardColors.styl

@@ -0,0 +1,231 @@
+// We define a set of six board colors that we took from the FlatUI palette.
+// http://flatuicolors.com
+//
+// XXX Centralizing all these properties in a single file just because their
+// value is derived from the same color, doesn't make any sense. We should
+// create a mixin/macro that would generate 6 versions of a given property and
+// dispatch this list in the other stylus files.
+setBoardColor(color)
+  &#header,
+  &.sk-spinner div,
+  .board-backgrounds-list &.background-box,
+  .board-list & a
+    background-color: color
+
+  .is-selected .minicard
+    border-left: 3px solid color
+
+  button[type=submit].primary, input[type=submit].primary
+    background-color: darken(color, 20%)
+
+  &.pop-over .pop-over-list li a:not(.disabled):hover,
+  .sidebar .sidebar-content .sidebar-btn:hover,
+  .sidebar-list li a:hover
+    background-color: lighten(color, 10%)
+
+  &#header ul li.current, &#header-quick-access ul li.current
+    border-bottom: 2px solid lighten(color, 10%)
+
+  &#header-quick-access
+    background: darken(color, 10%)
+    color: white
+
+  &#header #header-main-bar .board-header-btn.emphasis
+    background: complement(color)
+
+    &:hover,
+    .board-header-btn-close
+      background: darken(complement(color), 10%)
+
+    &:hover .board-header-btn-close
+      background: darken(complement(color), 20%)
+
+  .materialCheckBox.is-checked
+    border-bottom: 2px solid color
+    border-right: 2px solid color
+
+  .is-multiselection-active .multi-selection-checkbox
+    &.is-checked + .minicard
+      background: lighten(color, 90%)
+
+    &:not(.is-checked) + .minicard:hover:not(.minicard-composer)
+      background: lighten(color, 97%)
+
+  .toggle-label
+
+    &:after
+      background-color: darken(color, 20%)
+
+  .toggle-switch:checked ~ .toggle-label
+    background-color: lighten(color, 20%)
+
+    &:after
+      background-color: darken(color, 20%)
+
+  @media screen and (max-width: 800px)
+    &.pop-over .header
+      background: color
+      color: white
+
+   &#header ul li.current, &#header-quick-access ul li.current
+      border-bottom: 4px solid lighten(color, 20%)
+
+.board-color-nephritis
+  setBoardColor(#27AE60)
+
+.board-color-pomegranate
+  setBoardColor(#C0392B)
+
+.board-color-belize
+  setBoardColor(#2980B9)
+
+.board-color-wisteria
+  setBoardColor(#8E44AD)
+
+.board-color-midnight
+  setBoardColor(#2C3E50)
+
+.board-color-pumpkin
+  setBoardColor(#E67E22)
+
+.board-color-moderatepink
+  setBoardColor(#CD5A91)
+
+.board-color-strongcyan
+  setBoardColor(#00AECC)
+
+.board-color-limegreen
+  setBoardColor(#4BBF6B)
+
+.board-color-dark
+  setBoardColor(#2C3E51)
+
+  /* Not hidden in dark mode.
+    card fields: received, start, due, end, members, requested, assigned
+  .card-details-item.card-details-item-received,
+  .card-details-item.card-details-item-start,
+  .card-details-item.card-details-item-due,
+  .card-details-item.card-details-item-end,
+  .card-details-item.card-details-item-members,
+  .card-details-item.card-details-item-name { display:none; }
+  .card-details-items:empty { display:none; }
+  */
+
+  // DARK MODE, when dark background mode selected.
+  // Modified version from https://github.com/wekan/wekan/wiki/Custom-CSS-themes#dark-theme
+  // In progress, please send pull requests to fix remaining visibility issues.
+  .ui-sortable,
+  .swimlane,
+  .swimlane >.swimlane-header-wrap,
+  .swimlane >.list.js-list,
+  .swimlane >.list-composer.js-list-composer,
+  .list-body,
+  .list,
+  .list-composer,
+  .sidebar-content,
+  .card-details
+    background-color:#2C3E50
+
+  .card-details h3,
+  .card-details-items,
+  .card-checklist-items .ui-sortable,
+  .card-subtasks-items,
+  .activities,
+  .material-toggle-switch
+    color:#bbbbbb
+
+  .list-header
+    background-color: #888888
+
+  .board-widget,
+  .board-widget-labels,
+  .board-widget-members
+    color: #aaaaaa
+
+  /* popup menu titles (boards, swimlanes, lists, cards, labels) */
+  .pop-over >.header
+    display:none;
+
+  /* HIDE UNTIL HOVER -------------------------------------------------- */
+
+  /* header "+" button */
+  #header-quick-access .fa-plus
+    display:none
+  #header-quick-access:hover .fa-plus
+    display:inherit
+
+  /* "add card" links (use visibility rather than display so items don't jump) */
+  .open-minicard-composer
+    visibility:hidden
+
+  .list.js-list:hover .open-minicard-composer
+    visibility:visible
+
+  .list-header-menu
+    visibility:hidden
+
+  .list.js-list:hover .list-header-menu
+    visibility:visible
+
+  /* "add list/swimlane" links (use visibility rather than display so items don't jump) */
+  .list.js-list-composer       >.list-header
+    visibility:hidden
+
+  .list.js-list-composer:hover >.list-header
+    visibility:visible
+
+  /* headers */
+  #header-quick-access, #header
+    background-color:rgba(0,0,0,.75) !important
+
+  #header .board-header-btn:hover
+    background-color:rgba(255,255,255,0.3) !important
+
+  /* foregrounds: swimlanes, lists */
+  .list >.list-header, .swimlane-header
+    color:rgba(255,255,255,.7)
+
+  /* minicards */
+  .minicard
+    background-color:rgba(255,255,255,.4)
+
+  .minicard-wrapper.is-selected .minicard,
+  .minicard:hover,
+  .minicard-composer.js-composer,
+  .open-minicard-composer:hover
+    background-color:rgba(255,255,255,.8) !important
+    color:#000
+
+  .minicard, .minicard .badge
+    color:#fff
+
+  .minicard:hover .badge, .minicard-wrapper.is-selected .badge
+    color:#000
+
+  /* cards */
+  .card-details .card-details-header
+    background-color:#ccc
+
+  /* sidebar */
+  .sidebar-tongue, .sidebar-shadow
+    background-color:#666 !important
+
+  .sidebar-content h3, .sidebar-content h2, .sidebar-content
+    color:rgba(255,255,255,.7) !important
+
+.board-color-relax
+  setBoardColor(#27AE61)
+
+  // RELAX MODE: light green backgroud, when green background color selected.
+  .ui-sortable
+    background-color:#a7e366
+
+  .list-header
+    background-color:#a7e366
+    border-bottom: 6px solid #a7e366
+
+  .list-body
+    background-color:#a7e366
+
+  .list
+    border-left: 1px dotted #000000

client/components/boards/boardHeader.jade

@@ -1,126 +1,152 @@
-//- The pencil that renames the board, beside the board's name in the FIRST
-//- header bar. The name is there, so the thing that edits it belongs next to it
-//- rather than in a bar of its own. Board admins only; everybody else sees the
-//- name without a pencil. docs/Design/Page/Header.md
-template(name="boardEditTitleButton")
-  if currentUser.isBoardAdmin
+template(name="boardHeaderBar")
+  h1.header-board-menu
     with currentBoard
-      a.board-header-btn.js-edit-board-title(title="{{_ 'edit'}}" value=title)
-        i.fa.fa-pencil-square-o
+      a(class="{{#if currentUser.isBoardAdmin}}js-edit-board-title{{else}}is-disabled{{/if}}")
+        +viewer
+          = title
+
+  .board-header-btns.left
+    unless isMiniScreen
+      if currentBoard
+        if currentUser
+          a.board-header-btn.js-star-board(class="{{#if isStarred}}is-active{{/if}}"
+            title="{{#if isStarred}}{{_ 'click-to-unstar'}}{{else}}{{_ 'click-to-star'}}{{/if}} {{_ 'starred-boards-description'}}")
+            i.fa(class="fa-star{{#unless isStarred}}-o{{/unless}}")
+            if showStarCounter
+              span
+                = currentBoard.stars
 
-//- Everything else the board's second header bar held, as icons in the FIRST
-//- bar, to the left of the notification bell.
-//-
-//- ICON ONLY, each named by a tooltip. The bar is a single row shared with the
-//- logo, the starred boards, the view menu, the bell and the user menu, and
-//- these are ten more controls - labelled, they would not fit at any width.
-//-
-//- There is no desktop/mobile split any more either. The second bar wrote the
-//- whole set out TWICE, once for each, because a labelled row does not fit on a
-//- phone; icons do, so one set serves both. docs/Design/Page/Header.md
-template(name="boardHeaderButtons")
-  if currentBoard
-    if currentUser
-      .board-header-btns.board-header-controls
-        with currentBoard
           a.board-header-btn(
             class="{{#if currentUser.isBoardAdmin}}js-change-visibility{{else}}is-disabled{{/if}}"
             title="{{_ currentBoard.permission}}")
             i.fa(class="{{#if currentBoard.isPublic}}fa-globe{{else}}fa-lock{{/if}}")
-            //- The SAME expression the tooltip uses, so the two cannot say
-              different things - and both follow the board from Private to
-              Public without a second list of words to keep in step.
-            span.board-header-btn-label {{_ currentBoard.permission}}
+            span {{_ currentBoard.permission}}
 
-          unless watchDisabled
-            a.board-header-btn.js-watch-board(title="{{_ watchLevel }}")
-              if $eq watchLevel "watching"
-                i.fa.fa-eye
-              if $eq watchLevel "tracking"
-                i.fa.fa-bell
-              if $eq watchLevel "muted"
-                i.fa.fa-bell-slash
-              span.board-header-btn-label {{_ watchLevel }}
+          a.board-header-btn.js-watch-board(
+            title="{{_ watchLevel }}")
+            if $eq watchLevel "watching"
+              i.fa.fa-eye
+            if $eq watchLevel "tracking"
+              i.fa.fa-bell
+            if $eq watchLevel "muted"
+              i.fa.fa-bell-slash
+            span {{_ watchLevel}}
 
-          //- The name beside the icon where the bar has room for it, dropped
-            when it does not - one rule in header.css hides every label of this
-            bar below the width they stop fitting at.
-            docs/Design/Page/Header.md
-          a.board-header-btn(title="{{#if isSortActive}}{{_ 'sort-is-on'}}{{else}}{{_ 'sort-cards'}}{{/if}}" class="js-sort-cards {{#if isSortActive }}emphasis{{/if}}")
-            i.fa.fa-sort
-            span.board-header-btn-label {{#if isSortActive}}{{_ 'sort-is-on'}}{{else}}{{_ 'sort-cards'}}{{/if}}
-          if isSortActive
-            a.board-header-btn-close.js-sort-reset(title="{{_ 'remove-sort'}}")
-              i.fa.fa-times-thin
+        else
+          a.board-header-btn.js-log-in(
+            title="{{_ 'log-in'}}")
+            i.fa.fa-sign-in
+            span {{_ 'log-in'}}
 
-        +boardButtons
+  .board-header-btns.right
+    if currentBoard
+      if isMiniScreen
+        if currentUser
+          a.board-header-btn.js-star-board(class="{{#if isStarred}}is-active{{/if}}"
+            title="{{#if isStarred}}{{_ 'click-to-unstar'}}{{else}}{{_ 'click-to-star'}}{{/if}} {{_ 'starred-boards-description'}}")
+            i.fa(class="fa-star{{#unless isStarred}}-o{{/unless}}")
+            if showStarCounter
+              span
+                = currentBoard.stars
 
-        a.board-header-btn.js-open-filter-view(
-            title="{{#if Filter.isActive}}{{_ 'filter-on-desc'}}{{else}}{{_ 'filter'}}{{/if}}"
-            class="{{#if Filter.isActive}}js-filter-active{{/if}}")
-          i.fa.fa-filter
-          span.board-header-btn-label {{#if Filter.isActive}}{{_ 'filter-on-desc'}}{{else}}{{_ 'filter'}}{{/if}}
+          a.board-header-btn(
+            class="{{#if currentUser.isBoardAdmin}}js-change-visibility{{else}}is-disabled{{/if}}"
+            title="{{_ currentBoard.permission}}")
+            i.fa(class="{{#if currentBoard.isPublic}}fa-globe{{else}}fa-lock{{/if}}")
+            span {{_ currentBoard.permission}}
+
+          a.board-header-btn.js-watch-board(
+            title="{{_ watchLevel }}")
+            if $eq watchLevel "watching"
+              i.fa.fa-eye
+            if $eq watchLevel "tracking"
+              i.fa.fa-bell
+            if $eq watchLevel "muted"
+              i.fa.fa-bell-slash
+            span {{_ watchLevel}}
+
+        else
+          a.board-header-btn.js-log-in(
+            title="{{_ 'log-in'}}")
+            i.fa.fa-sign-in
+            span {{_ 'log-in'}}
+
+      if isSandstorm
+        if currentUser
+          a.board-header-btn.js-open-archived-board
+            i.fa.fa-archive
+            span {{_ 'archives'}}
+
+      a.board-header-btn.js-open-filter-view(
+          title="{{#if Filter.isActive}}{{_ 'filter-on-desc'}}{{else}}{{_ 'filter'}}{{/if}}"
+          class="{{#if Filter.isActive}}emphasis{{/if}}")
+        i.fa.fa-filter
+        span {{#if Filter.isActive}}{{_ 'filter-on'}}{{else}}{{_ 'filter'}}{{/if}}
         if Filter.isActive
           a.board-header-btn-close.js-filter-reset(title="{{_ 'filter-clear'}}")
             i.fa.fa-times-thin
+            
+      if currentUser.isAdmin
+        a.board-header-btn.js-open-rules-view(title="{{_ 'rules'}}")
+          i.fa.fa-magic
+          span {{_ 'rules'}}
+      else if currentUser.isBoardAdmin
+        a.board-header-btn.js-open-rules-view(title="{{_ 'rules'}}")
+          i.fa.fa-magic
+          span {{_ 'rules'}}
 
-        a.board-header-btn.js-open-search-view(title="{{_ 'search'}}")
-          i.fa.fa-search
-          span.board-header-btn-label {{_ 'search'}}
+      a.board-header-btn.js-open-search-view(title="{{_ 'search'}}")
+        i.fa.fa-search
+        span {{_ 'search'}}
 
-        a.board-header-btn.js-toggle-dependencies(
-            title="{{#if currentBoard.showDependencies}}{{_ 'hide-dependencies'}}{{else}}{{_ 'show-dependencies'}}{{/if}}"
-            class="{{#if currentBoard.showDependencies}}emphasis{{/if}}")
-          i.fa.fa-link
-          span.board-header-btn-label {{#if currentBoard.showDependencies}}{{_ 'hide-dependencies'}}{{else}}{{_ 'show-dependencies'}}{{/if}}
+      unless currentBoard.isTemplatesBoard
+        a.board-header-btn.js-toggle-board-view(
+          title="{{_ 'board-view'}}")
+          i.fa.fa-th-large
+          span {{#if currentUser.profile.boardView}}{{_ currentUser.profile.boardView}}{{else}}{{_ 'board-view-lists'}}{{/if}}
 
-        if canModifyBoard
-          a.board-header-btn.js-multiselection-activate(
-              title="{{#if MultiSelection.isActive}}{{_ 'multi-selection-on'}}{{else}}{{_ 'multi-selection'}}{{/if}}"
-              class="{{#if MultiSelection.isActive}}emphasis{{/if}}")
-            i.fa.fa-check-square-o
-            //- Named, like the board's Multi-Selection on All Boards: a
-              check-box outline says nothing about what the button does.
-            span.board-header-btn-label {{_ 'multi-selection'}}
+      if canModifyBoard
+        a.board-header-btn.js-multiselection-activate(
+            title="{{#if MultiSelection.isActive}}{{_ 'multi-selection-on'}}{{else}}{{_ 'multi-selection'}}{{/if}}"
+            class="{{#if MultiSelection.isActive}}emphasis{{/if}}")
+          i.fa.fa-check-square-o
+          span {{#if MultiSelection.isActive}}{{_ 'multi-selection-on'}}{{else}}{{_ 'multi-selection'}}{{/if}}
           if MultiSelection.isActive
-            a.board-header-btn-close.js-multiselection-reset(title="{{_ 'multi-selection-off'}}")
+            a.board-header-btn-close.js-multiselection-reset(title="{{_ 'filter-clear'}}")
               i.fa.fa-times-thin
-    else
-      a.board-header-btn.js-log-in(title="{{_ 'log-in'}}")
-        i.fa.fa-sign-in
 
-//- `described-list`: every row is icon + name + description, and the three are laid
-//- out as three left-aligned columns (popup.css), so the descriptions of all the
-//- rows start at the same x whether or not a row carries the check mark.
+      .separator
+      a.board-header-btn.js-toggle-sidebar
+        i.fa.fa-navicon
+
 template(name="boardVisibilityList")
-  ul.pop-over-list.described-list
+  ul.pop-over-list
     li
       with "private"
         a.js-select-visibility
-          i.fa.fa-lock
+          i.fa.fa-lock.colorful
           | {{_ 'private'}}
           if visibilityCheck
             i.fa.fa-check
           span.sub-name {{_ 'private-desc'}}
-    if notAllowPrivateVisibilityOnly
-      li
-        with "public"
-          a.js-select-visibility
-            i.fa.fa-globe
-            | {{_ 'public'}}
-            if visibilityCheck
-              i.fa.fa-check
-            span.sub-name {{_ 'public-desc'}}
+    li
+      with "public"
+        a.js-select-visibility
+          i.fa.fa-globe.colorful
+          | {{_ 'public'}}
+          if visibilityCheck
+            i.fa.fa-check
+          span.sub-name {{_ 'public-desc'}}
 
 template(name="boardChangeVisibilityPopup")
   +boardVisibilityList
 
 template(name="boardChangeWatchPopup")
-  ul.pop-over-list.described-list
+  ul.pop-over-list
     li
       with "watching"
         a.js-select-watch
-          i.fa.fa-eye
+          i.fa.fa-eye.colorful
           | {{_ 'watching'}}
           if watchCheck
             i.fa.fa-check
@@ -128,7 +154,7 @@ template(name="boardChangeWatchPopup")
     li
       with "tracking"
         a.js-select-watch
-          i.fa.fa-bell
+          i.fa.fa-bell.colorful
           | {{_ 'tracking'}}
           if watchCheck
             i.fa.fa-check
@@ -136,67 +162,22 @@ template(name="boardChangeWatchPopup")
     li
       with "muted"
         a.js-select-watch
-          i.fa.fa-bell-slash
+          i.fa.fa-bell-slash.colorful
           | {{_ 'muted'}}
           if watchCheck
             i.fa.fa-check
           span.sub-name {{_ 'muted-info'}}
 
-template(name="boardChangeViewPopup")
-  ul.pop-over-list
-    li
-      with "board-view-swimlanes"
-        a.js-open-swimlanes-view
-          i.fa.fa-th-large
-          | {{_ 'swimlanes'}}
-          if $eq Utils.boardView "board-view-swimlanes"
-            i.fa.fa-check
-    li
-      with "board-view-lists"
-        a.js-open-lists-view
-          i.fa.fa-trello
-          | {{_ 'board-view-lists'}}
-          if $eq Utils.boardView "board-view-lists"
-            i.fa.fa-check
-    li
-      with "board-view-cal"
-        a.js-open-cal-view
-          i.fa.fa-calendar
-          | {{_ 'board-view-cal'}}
-          if $eq Utils.boardView "board-view-cal"
-            i.fa.fa-check
-    li
-      with "board-view-gantt"
-        a.js-open-gantt-view
-          i.fa.fa-bar-chart
-          | {{_ 'board-view-gantt'}}
-          if $eq Utils.boardView "board-view-gantt"
-            i.fa.fa-check
-    li
-      with "board-view-table"
-        a.js-open-table-view
-          i.fa.fa-table
-          | {{_ 'board-view-table'}}
-          if $eq Utils.boardView "board-view-table"
-            i.fa.fa-check
-    li
-      with "board-view-stats"
-        a.js-open-stats-view
-          i.fa.fa-pie-chart
-          | {{_ 'board-view-stats'}}
-          if $eq Utils.boardView "board-view-stats"
-            i.fa.fa-check
-
 template(name="createBoard")
   form
     label
       | {{_ 'title'}}
       input.js-new-board-title(type="text" placeholder="{{_ 'bucket-example'}}" autofocus required)
-    if visibilityMenuIsOpen
+    if visibilityMenuIsOpen.get
       +boardVisibilityList
     else
       p.quiet
-        if $eq visibility 'public'
+        if $eq visibility.get 'public'
           span.fa.fa-globe.colorful
           = " "
           | {{{_ 'board-public-info'}}}
@@ -206,121 +187,13 @@ template(name="createBoard")
           | {{{_ 'board-private-info'}}}
         a.js-change-visibility {{_ 'change'}}.
     input.primary.wide(type="submit" value="{{_ 'create'}}")
-    unless importDisabled
-      span.quiet
-        | {{_ 'or'}}
-        a.js-import-board {{_ 'import'}}
+    span.quiet
+      | {{_ 'or'}}
+      a.js-import-board {{_ 'import'}}
     span.quiet
       | /
       a.js-board-template {{_ 'template'}}
 
-template(name="createBoardPopup")
-  form
-    label
-      | {{_ 'title'}}
-      input.js-new-board-title(type="text" placeholder="{{_ 'bucket-example'}}" autofocus required)
-    if visibilityMenuIsOpen
-      +boardVisibilityList
-    else
-      p.quiet
-        if $eq visibility 'public'
-          span.fa.fa-globe.colorful
-          = " "
-          | {{{_ 'board-public-info'}}}
-        else
-          span.fa.fa-lock.colorful
-          = " "
-          | {{{_ 'board-private-info'}}}
-        a.js-change-visibility {{_ 'change'}}.
-    input.primary.wide(type="submit" value="{{_ 'create'}}")
-    unless importDisabled
-      span.quiet
-        | {{_ 'or'}}
-        a.js-import-board {{_ 'import'}}
-    span.quiet
-      | /
-      a.js-board-template {{_ 'template'}}
-
-template(name="headerBarCreateBoardPopup")
-  form
-    label
-      | {{_ 'title'}}
-      input.js-new-board-title(type="text" placeholder="{{_ 'bucket-example'}}" autofocus required)
-    if visibilityMenuIsOpen
-      +boardVisibilityList
-    else
-      p.quiet
-        if $eq visibility 'public'
-          span.fa.fa-globe.colorful
-          = " "
-          | {{{_ 'board-public-info'}}}
-        else
-          span.fa.fa-lock.colorful
-          = " "
-          | {{{_ 'board-private-info'}}}
-        a.js-change-visibility {{_ 'change'}}.
-    input.primary.wide(type="submit" value="{{_ 'create'}}")
-    unless importDisabled
-      span.quiet
-        | {{_ 'or'}}
-        a.js-import-board {{_ 'import'}}
-    span.quiet
-      | /
-      a.js-board-template {{_ 'template'}}
-
-// New popup for Template Container creation; shares the same form content
-template(name="createTemplateContainerPopup")
-  form
-    label
-      | {{_ 'title'}}
-      input.js-new-board-title(type="text" placeholder="{{_ 'bucket-example'}}" autofocus required)
-    if visibilityMenuIsOpen
-      +boardVisibilityList
-    else
-      p.quiet
-        if $eq visibility 'public'
-          span.fa.fa-globe.colorful
-          = " "
-          | {{{_ 'board-public-info'}}}
-        else
-          span.fa.fa-lock.colorful
-          = " "
-          | {{{_ 'board-private-info'}}}
-        a.js-change-visibility {{_ 'change'}}.
-    input.primary.wide(type="submit" value="{{_ 'create'}}")
-    unless importDisabled
-      span.quiet
-        | {{_ 'or'}}
-        a.js-import-board {{_ 'import'}}
-    span.quiet
-      | /
-      a.js-board-template {{_ 'template'}}
-
-//template(name="listsortPopup")
-//
-  h2
-//
-   | {{_ 'list-sort-by'}}
-//
-  hr
-//
-  ul.pop-over-list
-//
-    each value in allowedSortValues
-//
-     li
-//
-      a.js-sort-by(name="{{value.name}}")
-//
-        if $eq sortby value.name
-//
-           i.fa(class="{{#if $eq Direction 'fa-arrow-up'}}fa-arrow-up{{else}}fa-arrow-down{{/if}}")
-//
-        | {{_ value.label }}{{_ value.shortLabel}}
-//
-        if $eq sortby value.name
-//
-           i.fa.fa-check
 template(name="boardChangeTitlePopup")
   form
     label
@@ -334,74 +207,3 @@ template(name="boardChangeTitlePopup")
 template(name="boardCreateRulePopup")
   p {{_ 'close-board-pop'}}
   button.js-confirm.negate.full(type="submit") {{_ 'archive'}}
-
-
-template(name="cardsSortPopup")
-  ul.pop-over-list
-    li
-      a.js-sort-due
-        i.fa.fa-calendar
-        | {{_ 'due-date'}}
-      hr
-    li
-      a.js-sort-title
-        i.fa.fa-sort-alpha-asc
-        | {{_ 'title-alphabetically'}}
-      hr
-    li
-      a.js-sort-created-desc
-        i.fa.fa-arrow-down
-        | {{_ 'created-at-newest-first'}}
-      hr
-    li
-      a.js-sort-created-asc
-        i.fa.fa-arrow-up
-        | {{_ 'created-at-oldest-first'}}
-
-
-//- The board's view menu, in the FIRST top header bar.
-//-
-//- It was a button in the board's second header bar. A view menu says what you
-//- are looking AT, so it belongs beside the page's name in the one bar that is
-//- always on screen - the same place the All Boards Lists/Table menu is.
-//-
-//- `unless currentBoard.isTemplatesBoard`: there is nothing to look at six
-//- ways on a templates board. docs/Design/Page/Header.md
-//- Whether THIS board is starred, and the button that changes it. Its own
-//- template because the first header bar places it beside the starred-boards
-//- dropdown rather than among the board's other controls: the two are one pair -
-//- how many boards you have starred, and whether this is one of them.
-//-
-//- The outline star means not starred and the solid one means starred, so the
-//- button shows its state rather than the action - the tooltip says the action.
-//- docs/Design/Page/Header.md
-template(name="boardStarButton")
-  if currentBoard
-    a.board-header-btn.js-star-board(class="{{#if isStarred}}is-active{{/if}}"
-      title="{{#if isStarred}}{{_ 'click-to-unstar'}}{{else}}{{_ 'click-to-star'}}{{/if}}")
-      i.fa(class="fa-star{{#unless isStarred}}-o{{/unless}}")
-      if showStarCounter
-        span.board-star-counter {{currentBoard.stars}}
-
-template(name="boardViewMenu")
-  unless currentBoard.isTemplatesBoard
-    //- The name is VISIBLE beside the icon, not only in the tooltip. Six view
-      icons are six glyphs to learn, and a tooltip is the one place a name
-      cannot be read without hovering - so the button says which view is on.
-      The bar wraps to a second row when it runs out of width, which is what
-      makes a word beside the icon affordable. docs/Design/Page/Header.md
-    a.board-header-btn.js-toggle-board-view(title="{{boardViewName}}")
-      i.fa.fa-caret-down
-      if $eq boardView 'board-view-swimlanes'
-        i.fa.fa-th-large
-      if $eq boardView 'board-view-lists'
-        i.fa.fa-trello
-      if $eq boardView 'board-view-cal'
-        i.fa.fa-calendar
-      if $eq boardView 'board-view-gantt'
-        i.fa.fa-bar-chart
-      if $eq boardView 'board-view-table'
-        i.fa.fa-table
-      if $eq boardView 'board-view-stats'
-        i.fa.fa-pie-chart
-      span.board-header-btn-label= boardViewName

client/components/boards/boardHeader.js

@@ -1,641 +1,247 @@
-import { ReactiveCache } from '/imports/reactiveCache';
-import { TAPi18n } from '/imports/i18n';
-import { FlowRouter } from 'meteor/ostrio:flow-router-extra';
-const { allBoardsPath, SECTION_ARCHIVE } = require('/models/lib/allBoardsUrls');
-import dragscroll from '@wekanteam/dragscroll';
-import getSlug from 'limax';
-import Boards from '/models/boards';
-import Swimlanes from '/models/swimlanes';
-import TableVisibilityModeSettings from '/models/tableVisibilityModeSettings';
-import { Filter } from '/client/lib/filter';
-// Which way a button that opens a sidebar view goes on a click - one answer,
-// in one place, for both Filter and Search.
-import {
-  SIDEBAR_VIEW_CLOSE,
-  sidebarViewButtonAction,
-} from '/models/lib/sidebarViewButton';
-import { MultiSelection } from '/client/lib/multiSelection';
-import { getSidebarInstance } from '/client/features/sidebar/service';
-import { Utils } from '/client/lib/utils';
+Template.boardMenuPopup.events({
+  'click .js-rename-board': Popup.open('boardChangeTitle'),
+  'click .js-custom-fields'() {
+    Sidebar.setView('customFields');
+    Popup.close();
+  },
+  'click .js-open-archives'() {
+    Sidebar.setView('archives');
+    Popup.close();
+  },
+  'click .js-change-board-color': Popup.open('boardChangeColor'),
+  'click .js-change-language': Popup.open('changeLanguage'),
+  'click .js-archive-board ': Popup.afterConfirm('archiveBoard', function() {
+    const currentBoard = Boards.findOne(Session.get('currentBoard'));
+    currentBoard.archive();
+    // XXX We should have some kind of notification on top of the page to
+    // confirm that the board was successfully archived.
+    FlowRouter.go('home');
+  }),
+  'click .js-delete-board': Popup.afterConfirm('deleteBoard', function() {
+    const currentBoard = Boards.findOne(Session.get('currentBoard'));
+    Popup.close();
+    Boards.remove(currentBoard._id);
+    FlowRouter.go('home');
+  }),
+  'click .js-outgoing-webhooks': Popup.open('outgoingWebhooks'),
+  'click .js-import-board': Popup.open('chooseBoardSource'),
+  'click .js-subtask-settings': Popup.open('boardSubtaskSettings'),
+});
 
-/*
-const DOWNCLS = 'fa-sort-down';
-const UPCLS = 'fa-sort-up';
-*/
-const sortCardsBy = new ReactiveVar('');
-
-// Persist the card sort so it survives a page reload. Session is in-memory and
-// is reset on reload, which is why "sort by due date" kept reverting to the
-// default. See https://github.com/wekan/wekan/issues/5886
-const CARDS_SORT_BY_STORAGE_KEY = 'wekan-cards-sortBy';
-function setCardsSortBy(sortBy) {
-  Session.set('sortBy', sortBy);
-  try {
-    if (sortBy) {
-      window.localStorage.setItem(CARDS_SORT_BY_STORAGE_KEY, JSON.stringify(sortBy));
-    } else {
-      window.localStorage.removeItem(CARDS_SORT_BY_STORAGE_KEY);
-    }
-  } catch (e) {}
-}
+Template.boardMenuPopup.helpers({
+  exportUrl() {
+    const params = {
+      boardId: Session.get('currentBoard'),
+    };
+    const queryParams = {
+      authToken: Accounts._storedLoginToken(),
+    };
+    return FlowRouter.path('/api/boards/:boardId/export', params, queryParams);
+  },
+  exportFilename() {
+    const boardId = Session.get('currentBoard');
+    return `wekan-export-board-${boardId}.json`;
+  },
+});
 
 Template.boardChangeTitlePopup.events({
-  async submit(event, templateInstance) {
-    event.preventDefault();
-    const newTitle = templateInstance
-      .$('.js-board-name')
-      .val()
-      .trim();
-    const newDesc = templateInstance
-      .$('.js-board-desc')
-      .val()
-      .trim();
+  submit(evt, tpl) {
+    const newTitle = tpl.$('.js-board-name').val().trim();
+    const newDesc = tpl.$('.js-board-desc').val().trim();
     if (newTitle) {
-      // The board this popup was opened FOR, when it was opened for one: the
-      // All Boards Table view opens this same popup from a row whose data
-      // context is that row's board (docs/Design/Page/All-Boards.md), and on
-      // that page there is no "current board" at all. The board header opens it
-      // with the current board as its context, so that side is unchanged.
-      const context = Template.currentData();
-      const board =
-        context && context._id && typeof context.rename === 'function'
-          ? context
-          : Utils.getCurrentBoard();
-      if (board) {
-        await board.rename(newTitle);
-        await board.setDescription(newDesc);
-      }
-      Popup.back();
+      this.rename(newTitle);
+      this.setDescription(newDesc);
+      Popup.close();
     }
+    evt.preventDefault();
   },
 });
 
-Template.boardHeaderButtons.onCreated(function () {
-  Meteor.subscribe('tableVisibilityModeSettings');
-  // Restore the persisted card sort after a reload (Session is in-memory), so
-  // both the sorting and the sort icon are remembered. See #5886.
-  if (!Session.get('sortBy')) {
-    try {
-      const stored = window.localStorage.getItem(CARDS_SORT_BY_STORAGE_KEY);
-      if (stored) {
-        Session.set('sortBy', JSON.parse(stored));
-      }
-    } catch (e) {}
-  }
-});
-
-Template.boardHeaderButtons.helpers({
-  notDisplayThisBoard() {
-    const allowPrivateVisibilityOnly = TableVisibilityModeSettings.findOne('tableVisibilityMode-allowPrivateOnly');
-    const currentBoard = Utils.getCurrentBoard();
-    return (
-      allowPrivateVisibilityOnly !== undefined &&
-      allowPrivateVisibilityOnly.booleanValue &&
-      currentBoard &&
-      currentBoard.permission === 'public'
-    );
-  },
-
+BlazeComponent.extendComponent({
   watchLevel() {
-    const currentBoard = Utils.getCurrentBoard();
+    const currentBoard = Boards.findOne(Session.get('currentBoard'));
     return currentBoard && currentBoard.getWatchLevel(Meteor.userId());
   },
 
-  boardView() {
-    return Utils.boardView();
-  },
-  isSortActive() {
-    return Session.get('sortBy') ? true : false;
-  },
-  // A Font Awesome class name for the active sort, not an emoji.
-  sortCardsIcon() {
-    const sortBy = Session.get('sortBy');
-    if (!sortBy) {
-      return 'fa-sort'; // nothing chosen
-    }
-    if (sortBy.dueAt) {
-      return 'fa-clock-o'; // due date
-    } else if (sortBy.title) {
-      return 'fa-font'; // alphabetical
-    } else if (sortBy.createdAt) {
-      return sortBy.createdAt === 1 ? 'fa-arrow-up' : 'fa-arrow-down';
-    }
-    return 'fa-sort';
-  },
-});
-
-// The board star, in its own template because the first header bar places it
-// beside the starred-boards dropdown. A Blaze event map only sees events inside
-// its own template, so its helpers and its click come with its markup.
-Template.boardStarButton.helpers({
   isStarred() {
     const boardId = Session.get('currentBoard');
-    const user = ReactiveCache.getCurrentUser();
+    const user = Meteor.user();
     return user && user.hasStarred(boardId);
   },
 
-  // Only show the star counter if the number of stars is greater than 2.
+  // Only show the star counter if the number of star is greater than 2
   showStarCounter() {
-    const currentBoard = Utils.getCurrentBoard();
+    const currentBoard = Boards.findOne(Session.get('currentBoard'));
     return currentBoard && currentBoard.stars >= 2;
   },
 
-  currentBoard() {
-    return Utils.getCurrentBoard();
+  events() {
+    return [{
+      'click .js-edit-board-title': Popup.open('boardChangeTitle'),
+      'click .js-star-board'() {
+        Meteor.user().toggleBoardStar(Session.get('currentBoard'));
+      },
+      'click .js-open-board-menu': Popup.open('boardMenu'),
+      'click .js-change-visibility': Popup.open('boardChangeVisibility'),
+      'click .js-watch-board': Popup.open('boardChangeWatch'),
+      'click .js-open-archived-board'() {
+        Modal.open('archivedBoards');
+      },
+      'click .js-toggle-board-view'() {
+        const currentUser = Meteor.user();
+        if ((currentUser.profile || {}).boardView === 'board-view-swimlanes') {
+          currentUser.setBoardView('board-view-cal');
+        } else if ((currentUser.profile || {}).boardView === 'board-view-lists') {
+          currentUser.setBoardView('board-view-swimlanes');
+        } else if ((currentUser.profile || {}).boardView === 'board-view-cal') {
+          currentUser.setBoardView('board-view-lists');
+        } else {
+          currentUser.setBoardView('board-view-swimlanes');
+        }
+      },
+      'click .js-toggle-sidebar'() {
+        Sidebar.toggle();
+      },
+      'click .js-open-filter-view'() {
+        Sidebar.setView('filter');
+      },
+      'click .js-filter-reset'(evt) {
+        evt.stopPropagation();
+        Sidebar.setView();
+        Filter.reset();
+      },
+      'click .js-open-search-view'() {
+        Sidebar.setView('search');
+      },
+      'click .js-open-rules-view'() {
+        Modal.openWide('rulesMain');
+      },
+      'click .js-multiselection-activate'() {
+        const currentCard = Session.get('currentCard');
+        MultiSelection.activate();
+        if (currentCard) {
+          MultiSelection.add(currentCard);
+        }
+      },
+      'click .js-multiselection-reset'(evt) {
+        evt.stopPropagation();
+        MultiSelection.disable();
+      },
+      'click .js-log-in'() {
+        FlowRouter.go('atSignIn');
+      },
+    }];
+  },
+}).register('boardHeaderBar');
+
+Template.boardHeaderBar.helpers({
+  canModifyBoard() {
+    return Meteor.user() && Meteor.user().isBoardMember() && !Meteor.user().isCommentOnly();
   },
 });
 
-Template.boardStarButton.events({
-  'click .js-star-board'() {
-    const boardId = Session.get('currentBoard');
-    if (boardId) {
-      Meteor.call('toggleBoardStar', boardId);
-    }
+const CreateBoard = BlazeComponent.extendComponent({
+  template() {
+    return 'createBoard';
   },
-});
 
-// Open the sidebar on `view`, or shut it when it is already showing that view.
-// `mustStayOpen` is Filter's exception: see models/lib/sidebarViewButton.js.
-function toggleSidebarView(view, mustStayOpen) {
-  const sidebar = getSidebarInstance();
-  if (!sidebar) {
-    console.warn('Sidebar not available for setView');
-    return;
-  }
-  // Open AND on this view: a sidebar open on Activities is showing neither, and
-  // clicking either button there has to switch to it rather than close.
-  const isShowingView = sidebar.isOpen() && sidebar.getView() === view;
-  if (sidebarViewButtonAction(isShowingView, mustStayOpen) === SIDEBAR_VIEW_CLOSE) {
-    sidebar.hide();
-    return;
-  }
-  sidebar.setView(view);
-}
-
-Template.boardHeaderButtons.events({
-  'click .js-edit-board-title': Popup.open('boardChangeTitle'),
-  'click .js-change-visibility': Popup.open('boardChangeVisibility'),
-  'click .js-watch-board': Popup.open('boardChangeWatch'),
-  // Boards in Archive is a SECTION of All Boards, not a page of its own: the
-  // row in its left menu. `/archive` is the full-width page that section
-  // replaced. docs/Design/Page/Archive.md
-  'click .js-open-archived-board'() {
-    FlowRouter.go(allBoardsPath(SECTION_ARCHIVE, []));
+  onCreated() {
+    this.visibilityMenuIsOpen = new ReactiveVar(false);
+    this.visibility = new ReactiveVar('private');
+    this.boardId = new ReactiveVar('');
   },
-  // The button that opens the filter sidebar also shuts it. It only ever
-  // opened, so a second click did nothing visible and the only way back was the
-  // sidebar's own X - somewhere else on screen from the thing you just clicked.
-  //
-  // Not while a filter is ON, though: the sidebar is then the one place that
-  // says what is being hidden from the board, and closing it would leave a
-  // board showing a subset of its cards with nothing on screen to say so. The X
-  // beside this button is what clears the filter.
-  // models/lib/sidebarViewButton.js
-  'click .js-open-filter-view'() {
-    toggleSidebarView('filter', Filter.isActive());
-  },
-  'click .js-sort-cards': Popup.open('cardsSort'),
-  /*
-  'click .js-open-sort-view'(evt) {
-    const target = evt.target;
-    if (target.tagName === 'I') {
-      // click on the text, popup choices
-      this.changeDirection();
-    } else {
-      // change the sort order
-      Popup.open('listsort')(evt);
-    }
-  },
-  */
-  'click .js-filter-reset'(event) {
-    event.stopPropagation();
-    const sidebar = getSidebarInstance();
-    if (sidebar) {
-      sidebar.setView();
-    } else {
-      console.warn('Sidebar not available for setView');
-    }
-    Filter.reset();
-  },
-  'click .js-sort-reset'() {
-    setCardsSortBy('');
-  },
-  // Search shuts what it opened too, with no exception: its results are inside
-  // the panel, so closing it hides nothing from the board the way closing an
-  // active filter's panel would. models/lib/sidebarViewButton.js
-  'click .js-open-search-view'() {
-    toggleSidebarView('search', false);
-  },
-  'click .js-toggle-dependencies'() {
-    const currentBoard = Utils.getCurrentBoard();
-    if (currentBoard) {
-      currentBoard.setShowDependencies(!currentBoard.showDependencies);
-    }
-  },
-  'click .js-multiselection-activate'() {
-    const currentCard = Utils.getCurrentCardId();
-    MultiSelection.activate();
-    if (currentCard) {
-      MultiSelection.add(currentCard);
-    }
-  },
-  'click .js-multiselection-reset'(event) {
-    event.stopPropagation();
-    MultiSelection.disable();
-  },
-  'click .js-log-in'() {
-    FlowRouter.go('atSignIn');
-  },
-});
 
-Template.boardChangeViewPopup.events({
-  'click .js-open-lists-view'() {
-    Utils.setBoardView('board-view-lists');
-    Popup.back();
-  },
-  'click .js-open-swimlanes-view'() {
-    Utils.setBoardView('board-view-swimlanes');
-    Popup.back();
-  },
-  'click .js-open-cal-view'() {
-    Utils.setBoardView('board-view-cal');
-    Popup.back();
-  },
-  'click .js-open-gantt-view'() {
-    Utils.setBoardView('board-view-gantt');
-    Popup.back();
-  },
-  'click .js-open-table-view'() {
-    Utils.setBoardView('board-view-table');
-    Popup.back();
-  },
-  'click .js-open-stats-view'() {
-    Utils.setBoardView('board-view-stats');
-    Popup.back();
-  },
-});
-
-// Shared setup for all create board popups
-function setupCreateBoardState(tpl) {
-  tpl.visibilityMenuIsOpen = new ReactiveVar(false);
-  tpl.visibility = new ReactiveVar('private');
-  tpl.boardId = new ReactiveVar('');
-  // #5850: default to creating a regular board; the dedicated
-  // createTemplateContainerPopup sets this true in its onRendered.
-  Session.set('createBoardAsTemplate', false);
-  Meteor.subscribe('tableVisibilityModeSettings');
-}
-
-function createBoardHelpers() {
-  return {
-    visibilityMenuIsOpen() {
-      return Template.instance().visibilityMenuIsOpen.get();
-    },
-    visibility() {
-      return Template.instance().visibility.get();
-    },
-    notAllowPrivateVisibilityOnly() {
-      return !TableVisibilityModeSettings.findOne('tableVisibilityMode-allowPrivateOnly')?.booleanValue;
-    },
-    visibilityCheck() {
-      return Template.currentData() === Template.instance().visibility.get();
-    },
-  };
-}
-
-async function createBoardSubmit(tpl, event) {
-  event.preventDefault();
-  const title = tpl.find('.js-new-board-title').value;
-  const slug = getSlug(title) || 'board';
-
-  // #5850: template boards are created via the dedicated "Add Template Board"
-  // flow (createTemplateContainerPopup), signalled by this Session flag, rather
-  // than a checkbox on the generic Create Board popup. Consume it immediately.
-  const addTemplateContainer = Session.get('createBoardAsTemplate') === true;
-  Session.set('createBoardAsTemplate', false);
-  if (addTemplateContainer) {
-    tpl.boardId.set(
-      await Meteor.callAsync('createBoardWithInitialSwimlanes', {
-        title,
-        slug,
-        permission: 'private',
-        type: 'template-container',
-        migrationVersion: 1,
-        swimlanes: [
-          { title: 'Card Templates', sort: 1, type: 'template-container', role: 'card' },
-          { title: 'List Templates', sort: 2, type: 'template-container', role: 'list' },
-          { title: 'Board Templates', sort: 3, type: 'template-container', role: 'board' },
-        ],
-      }),
-    );
-
-    // Assign to space if one was selected
-    const spaceId = Session.get('createBoardInWorkspace');
-    if (spaceId) {
-      Meteor.call('assignBoardToWorkspace', tpl.boardId.get(), spaceId, (err) => {
-        if (err) console.error('Error assigning board to space:', err);
-      });
-      Session.set('createBoardInWorkspace', null); // Clear after use
-    }
-
-    FlowRouter.go('board', { id: tpl.boardId.get(), slug });
-
-  } else {
-    const visibility = tpl.visibility.get();
-
-    tpl.boardId.set(
-      await Meteor.callAsync('createBoardWithInitialSwimlanes', {
-        title,
-        slug,
-        permission: visibility,
-        migrationVersion: 1,
-        swimlanes: [{ title: 'Default' }],
-      }),
-    );
-
-    // Assign to space if one was selected
-    const spaceId = Session.get('createBoardInWorkspace');
-    if (spaceId) {
-      Meteor.call('assignBoardToWorkspace', tpl.boardId.get(), spaceId, (err) => {
-        if (err) console.error('Error assigning board to space:', err);
-      });
-      Session.set('createBoardInWorkspace', null); // Clear after use
-    }
-
-    FlowRouter.go('board', { id: tpl.boardId.get(), slug });
-  }
-}
-
-function createBoardEvents() {
-  return {
-    'click .js-select-visibility'(event, tpl) {
-      tpl.visibility.set(this);
-      tpl.visibilityMenuIsOpen.set(false);
-    },
-    'click .js-change-visibility'(event, tpl) {
-      tpl.visibilityMenuIsOpen.set(!tpl.visibilityMenuIsOpen.get());
-    },
-    async 'submit'(event, tpl) {
-      await createBoardSubmit(tpl, event);
-    },
-    'click .js-import-board': Popup.open('chooseBoardSource'),
-    'click .js-board-template': Popup.open('searchElement'),
-  };
-}
-
-// createBoard (non-popup version)
-Template.createBoard.onCreated(function () {
-  setupCreateBoardState(this);
-});
-
-Template.createBoard.helpers(createBoardHelpers());
-
-Template.createBoard.events(createBoardEvents());
-
-// createBoardPopup
-Template.createBoardPopup.onCreated(function () {
-  setupCreateBoardState(this);
-});
-
-Template.createBoardPopup.helpers(createBoardHelpers());
-
-Template.createBoardPopup.events(createBoardEvents());
-
-// createTemplateContainerPopup
-Template.createTemplateContainerPopup.onCreated(function () {
-  setupCreateBoardState(this);
-});
-
-Template.createTemplateContainerPopup.onRendered(function () {
-  // #5850: this dedicated popup always creates a template board.
-  Session.set('createBoardAsTemplate', true);
-});
-
-Template.createTemplateContainerPopup.helpers(createBoardHelpers());
-
-Template.createTemplateContainerPopup.events(createBoardEvents());
-
-// headerBarCreateBoardPopup
-Template.headerBarCreateBoardPopup.onCreated(function () {
-  setupCreateBoardState(this);
-});
-
-Template.headerBarCreateBoardPopup.helpers(createBoardHelpers());
-
-Template.headerBarCreateBoardPopup.events({
-  'click .js-select-visibility'(event, tpl) {
-    tpl.visibility.set(this);
-    tpl.visibilityMenuIsOpen.set(false);
-  },
-  'click .js-change-visibility'(event, tpl) {
-    tpl.visibilityMenuIsOpen.set(!tpl.visibilityMenuIsOpen.get());
-  },
-  async submit(event, tpl) {
-    await createBoardSubmit(tpl, event);
-    // Immediately star boards created with the headerbar popup.
-    await ReactiveCache.getCurrentUser().toggleBoardStar(tpl.boardId.get());
-  },
-  'click .js-import-board': Popup.open('chooseBoardSource'),
-  'click .js-board-template': Popup.open('searchElement'),
-});
-
-Template.boardVisibilityList.helpers({
-  notAllowPrivateVisibilityOnly() {
-    return !TableVisibilityModeSettings.findOne('tableVisibilityMode-allowPrivateOnly')?.booleanValue;
-  },
-});
-
-Template.boardChangeVisibilityPopup.onCreated(function () {
-  Meteor.subscribe('tableVisibilityModeSettings');
-});
-
-Template.boardChangeVisibilityPopup.helpers({
-  notAllowPrivateVisibilityOnly(){
-    return !TableVisibilityModeSettings.findOne('tableVisibilityMode-allowPrivateOnly')?.booleanValue;
-  },
   visibilityCheck() {
-    const currentBoard = Utils.getCurrentBoard();
-    return this === currentBoard.permission;
+    return this.currentData() === this.visibility.get();
   },
-});
 
-Template.boardChangeVisibilityPopup.events({
-  'click .js-select-visibility'() {
-    const currentBoard = Utils.getCurrentBoard();
-    const visibility = this;
-    if (typeof visibility === 'string') {
-      currentBoard.setVisibility(visibility);
-      Popup.back();
-    }
+  setVisibility(visibility) {
+    this.visibility.set(visibility);
+    this.visibilityMenuIsOpen.set(false);
   },
-});
 
-Template.boardChangeWatchPopup.helpers({
+  toggleVisibilityMenu() {
+    this.visibilityMenuIsOpen.set(!this.visibilityMenuIsOpen.get());
+  },
+
+  onSubmit(evt) {
+    evt.preventDefault();
+    const title = this.find('.js-new-board-title').value;
+    const visibility = this.visibility.get();
+
+    this.boardId.set(Boards.insert({
+      title,
+      permission: visibility,
+    }));
+
+    Swimlanes.insert({
+      title: 'Default',
+      boardId: this.boardId.get(),
+    });
+
+    Utils.goBoardId(this.boardId.get());
+  },
+
+  events() {
+    return [{
+      'click .js-select-visibility'() {
+        this.setVisibility(this.currentData());
+      },
+      'click .js-change-visibility': this.toggleVisibilityMenu,
+      'click .js-import': Popup.open('boardImportBoard'),
+      submit: this.onSubmit,
+      'click .js-import-board': Popup.open('chooseBoardSource'),
+      'click .js-board-template': Popup.open('searchElement'),
+    }];
+  },
+}).register('createBoardPopup');
+
+(class HeaderBarCreateBoard extends CreateBoard {
+  onSubmit(evt) {
+    super.onSubmit(evt);
+    // Immediately star boards crated with the headerbar popup.
+    Meteor.user().toggleBoardStar(this.boardId.get());
+  }
+}).register('headerBarCreateBoardPopup');
+
+BlazeComponent.extendComponent({
+  visibilityCheck() {
+    const currentBoard = Boards.findOne(Session.get('currentBoard'));
+    return this.currentData() === currentBoard.permission;
+  },
+
+  selectBoardVisibility() {
+    const currentBoard = Boards.findOne(Session.get('currentBoard'));
+    const visibility = this.currentData();
+    currentBoard.setVisibility(visibility);
+    Popup.close();
+  },
+
+  events() {
+    return [{
+      'click .js-select-visibility': this.selectBoardVisibility,
+    }];
+  },
+}).register('boardChangeVisibilityPopup');
+
+BlazeComponent.extendComponent({
   watchLevel() {
-    const currentBoard = Utils.getCurrentBoard();
+    const currentBoard = Boards.findOne(Session.get('currentBoard'));
     return currentBoard.getWatchLevel(Meteor.userId());
   },
 
   watchCheck() {
-    const currentBoard = Utils.getCurrentBoard();
-    return this === currentBoard.getWatchLevel(Meteor.userId());
-  },
-});
-
-Template.boardChangeWatchPopup.events({
-  'click .js-select-watch'() {
-    const level = this;
-    if (typeof level === 'string') {
-      Meteor.call(
-        'watch',
-        'board',
-        Session.get('currentBoard'),
-        level,
-        (err, ret) => {
-          if (!err && ret) Popup.back();
-        },
-      );
-    }
-  },
-});
-
-/*
-// BlazeComponent.extendComponent was removed - this code is unused.
-// Original listsortPopup component:
-// {
-  onCreated() {
-    //this.sortBy = new ReactiveVar();
-    ////this.sortDirection = new ReactiveVar();
-    //this.setSortBy();
-    this.downClass = DOWNCLS;
-    this.upClass = UPCLS;
-  },
-  allowedSortValues() {
-    const types = [];
-    const pushed = {};
-    ReactiveCache.getCurrentUser()
-      .getListSortTypes()
-      .forEach(type => {
-        const key = type.replace(/^-/, '');
-        if (pushed[key] === undefined) {
-          types.push({
-            name: key,
-            label: `list-label-${key}`,
-            shortLabel: `list-label-short-${key}`,
-          });
-          pushed[key] = 1;
-        }
-      });
-    return types;
-  },
-  Direction() {
-    return ReactiveCache.getCurrentUser().getListSortByDirection() === -1
-      ? this.downClass
-      : this.upClass;
-  },
-  sortby() {
-    return ReactiveCache.getCurrentUser().getListSortBy();
-  },
-
-  setSortBy(type = null) {
-    const user = ReactiveCache.getCurrentUser();
-    if (type === null) {
-      type = user._getListSortBy();
-    } else {
-      let value = '';
-      if (type.map) {
-        // is an array
-        value = (type[1] === -1 ? '-' : '') + type[0];
-      }
-      Meteor.call('setListSortBy', value);
-    }
-    //this.sortBy.set(type[0]);
-    //this.sortDirection.set(type[1]);
+    return this.currentData() === this.watchLevel();
   },
 
   events() {
-    return [
-      {
-        'click .js-sort-by'(evt) {
-          evt.preventDefault();
-          const target = evt.target;
-          const sortby = target.getAttribute('name');
-          const down = !!target.querySelector(`.${this.upClass}`);
-          const direction = down ? -1 : 1;
-          this.setSortBy([sortby, direction]);
-          if (Utils.isMiniScreen) {
-            Popup.back();
-          }
-        },
+    return [{
+      'click .js-select-watch'() {
+        const level = this.currentData();
+        Meteor.call('watch', 'board', Session.get('currentBoard'), level, (err, ret) => {
+          if (!err && ret) Popup.close();
+        });
       },
-    ];
+    }];
   },
-// }.register('listsortPopup');
-*/
-
-Template.cardsSortPopup.events({
-  'click .js-sort-due'() {
-    const sortBy = {
-      dueAt: 1,
-    };
-    setCardsSortBy(sortBy);
-    sortCardsBy.set(TAPi18n.__('due-date'));
-    Popup.back();
-  },
-  'click .js-sort-title'() {
-    const sortBy = {
-      title: 1,
-    };
-    setCardsSortBy(sortBy);
-    sortCardsBy.set(TAPi18n.__('title'));
-    Popup.back();
-  },
-  'click .js-sort-created-asc'() {
-    const sortBy = {
-      createdAt: 1,
-    };
-    setCardsSortBy(sortBy);
-    sortCardsBy.set(TAPi18n.__('date-created-newest-first'));
-    Popup.back();
-  },
-  'click .js-sort-created-desc'() {
-    const sortBy = {
-      createdAt: -1,
-    };
-    setCardsSortBy(sortBy);
-    sortCardsBy.set(TAPi18n.__('date-created-oldest-first'));
-    Popup.back();
-  },
-});
-
-// The board's view menu is its own template in the FIRST header bar now, so its
-// handler is here rather than on the second bar that used to draw it.
-// docs/Design/Page/Header.md
-Template.boardViewMenu.events({
-  'click .js-toggle-board-view': Popup.open('boardChangeView'),
-});
-
-Template.boardViewMenu.helpers({
-  boardView() {
-    return Utils.boardView();
-  },
-  // The tooltip: the name of the view that is ON. The button is icon only, so
-  // this is the only place the name appears. docs/Design/Page/Header.md
-  boardViewName() {
-    const names = {
-      'board-view-swimlanes': 'swimlanes',
-      'board-view-lists': 'lists',
-      'board-view-cal': 'calendar',
-      'board-view-gantt': 'gantt',
-      'board-view-table': 'board-view-table',
-      'board-view-stats': 'board-view-stats',
-    };
-    return TAPi18n.__(names[Utils.boardView()] || 'board-view');
-  },
-});
-
-// The pencil is its own template in the first header bar, beside the board's
-// name, so its click is handled here. docs/Design/Page/Header.md
-Template.boardEditTitleButton.events({
-  'click .js-edit-board-title': Popup.open('boardChangeTitle'),
-});
+}).register('boardChangeWatchPopup');

client/components/boards/boardHeader.styl

@@ -0,0 +1,22 @@
+.integration-form
+  padding: 5px
+  border-bottom: 1px solid #ccc
+
+.flex
+  display: -webkit-box
+  display: -moz-box
+  display: -webkit-flex
+  display: -moz-flex
+  display: -ms-flexbox
+  display: flex
+
+.option
+  @extends .flex
+  -webkit-border-radius: 3px;
+  border-radius: 3px;
+  background: #fff;
+  text-decoration: none;
+  -webkit-box-shadow: 0 1px 2px rgba(0,0,0,0.2);
+  box-shadow: 0 1px 2px rgba(0,0,0,0.2);
+  margin-top: 5px;
+  padding: 5px;

client/components/boards/boardLabelHelpers.js

@@ -1,42 +0,0 @@
-/**
- * Pure helpers for building the option labels shown in board / list /
- * swimlane selectors (e.g. the move-card and copy-card popups).
- *
- * Regression #6135 ("numbering boards, list, swim caused some issues"):
- * a previous change prepended a sequential number to every option label
- * (e.g. "3. My Board"). That broke two things:
- *
- *   1. Boards whose name itself starts with a digit became hard to read.
- *   2. First-letter keyboard navigation in the native <select> dropdown
- *      stopped working, because every option started with a number instead
- *      of the board name.
- *
- * The fix: numbering is OPTIONAL and OFF by default. By default the label is
- * exactly the entity name, so its first character is the name's first
- * character and first-letter navigation works again. When numbering is
- * explicitly enabled, the number is appended as a trailing visual suffix so
- * the label still STARTS with the name.
- */
-
-/**
- * Build the label for a selectable board/list/swimlane option.
- *
- * @param {string} name   The entity (board/list/swimlane) name/title.
- * @param {number} index  Zero-based position in the list.
- * @param {Object} [opts]
- * @param {boolean} [opts.numbered=false] When true, append the 1-based
- *        number as a trailing suffix. When false (default), return the bare
- *        name so first-letter keyboard navigation keeps working.
- * @returns {string} The option label.
- */
-export function boardOptionLabel(name, index, { numbered = false } = {}) {
-  const label = name == null ? '' : String(name);
-  if (!numbered) {
-    return label;
-  }
-  const position = Number(index);
-  const number = Number.isFinite(position) ? position + 1 : index;
-  return `${label} (${number})`;
-}
-
-export default boardOptionLabel;

client/components/boards/boardsList.jade

@@ -1,554 +1,49 @@
 template(name="boardList")
-  //- `sidebar-open` moves the boards LEFT while the right sidebar is open, so
-    every board icon stays visible between the left menu and the panel instead
-    of hiding under it. Desktop only - on a phone the sidebar is full width and
-    there is nothing to move aside. boardsList.css
-  .wrapper.all-boards-wrapper(class="{{#if isSidebarOpen}}sidebar-open{{/if}}")
-    +allBoardsSidebar
-    //- The folded state is marked on the GRID, not on the menu inside it: a
-      hidden grid ITEM still leaves its track behind, so the boards would keep
-      a 260px-wide nothing beside them. The grid drops to one column and hides
-      the menu in the same rule. The Admin Panel marks its menu instead, because
-      a flex row with a hidden item simply closes up.
-      docs/Design/Page/Left-Menu.md
-    .boards-layout(class="{{#if isLeftMenuCollapsed}}collapsed{{/if}}")
-      // Left menu
-      .boards-left-menu
-        //- The caret that folds it away - the Admin Panel's own, so the two
-          menus cannot end up with two different carets, and the same control a
-          list has on a board. Folded, the menu is not drawn at all and the
-          caret that brings it back rides on the pane title below.
-          docs/Design/Page/Left-Menu.md
-        +leftMenuCollapse
-        ul.menu
-          //- ONE row, rendered four times, rather than four copies of the same
-            eight lines. Their ORDER depends on the user - Starred first if
-            anything is starred, Remaining first if not - and four copies could
-            not be reordered without moving markup about.
-            menuSections() asks models/lib/allBoardsUrls.js for the order.
+  .wrapper
+    ul.board-list.clearfix
+      li.js-add-board
+        a.board-list-item.label {{_ 'add-board'}}
+      each boards
+        li(class="{{#if isStarred}}starred{{/if}}" class=colorClass)
+          if isInvited
+            .board-list-item
+              span.details
+                span.board-list-item-name= title
+                i.fa.js-star-board(
+                  class="fa-star{{#if isStarred}} is-star-active{{else}}-o{{/if}}"
+                  title="{{_ 'star-board-title'}}")
+                p.board-list-item-desc {{_ 'just-invited'}}
+                button.js-accept-invite.primary {{_ 'accept'}}
+                button.js-decline-invite {{_ 'decline'}}
+          else
+            a.js-open-board.board-list-item(href="{{pathFor 'board' id=_id slug=slug}}")
+              span.details
+                span.board-list-item-name
+                  +viewer
+                    = title
+                i.fa.js-star-board(
+                  class="fa-star{{#if isStarred}} is-star-active{{else}}-o{{/if}}"
+                  title="{{_ 'star-board-title'}}")
+                p.board-list-item-desc
+                  +viewer
+                    = description
+                if hasSpentTimeCards
+                  i.fa.js-has-spenttime-cards(
+                    class="fa-circle{{#if hasOvertimeCards}} has-overtime-card-active{{else}} no-overtime-card-active{{/if}}"
+                    title="{{#if hasOvertimeCards}}{{_ 'has-overtime-cards'}}{{else}}{{_ 'has-spenttime-cards'}}{{/if}}")
+                i.fa.js-clone-board(
+                    class="fa-clone"
+                    title="{{_ 'duplicate-board'}}")
+                i.fa.js-archive-board(
+                    class="fa-archive"
+                    title="{{_ 'archive-board'}}")
 
-            "Archive", not "Boards in Archive": one word, like its neighbours,
-            and the menu already says what it lists. `archives` is an existing
-            key, translated in the same 135 languages, and the one already used
-            for the archive as a PLACE.
-          each menuSections
-            li(class="menu-item {{#if isSelectedMenu type}}active{{/if}}")
-              a.js-select-menu(class="{{extraClass}}" data-type="{{type}}")
-                span.menu-label
-                  span.emoji-icon
-                    i.fa(class="{{icon}}")
-                  |  {{_ labelKey}}
-                span.menu-count {{sectionCount type}}
-            //- The share targets belong to the TEMPLATES row, so they are drawn
-              inside the loop directly under it - not after the whole list,
-              where they would follow the Archive and read as its sub-list.
-            if $eq type 'templates'
-              if isSelectedMenu 'templates'
-                if shareTargets.length
-                  li.menu-section-title {{_ 'share-template-with'}}
-                  each shareTargets
-                    li.menu-item.js-share-target(data-share-type="{{type}}", data-share-id="{{id}}", data-share-name="{{name}}", title="{{_ 'drag-template-here-to-share'}}")
-                      span.menu-label
-                        span.emoji-icon
-                          i.fa.fa-share-alt
-                        |  {{name}}
-        //- Rules above and below the Workspaces section. The menu is three
-          kinds of thing in one column - the three board lists, the workspaces
-          tree, and the archive - and without them the tree ran into its
-          neighbours as if it were more of the same list.
-        hr.boards-menu-divider
-        .workspaces-header
-          span
-            span.emoji-icon
-              i.fa.fa-folder-open
-            |  {{_ 'allboards.workspaces'}}
-          a.js-add-workspace(title="{{_ 'allboards.add-workspace'}}") +
-        // Workspaces tree
-        +workspaceTree(nodes=workspacesTree selectedWorkspaceId=selectedWorkspaceId)
-        hr.boards-menu-divider
-
-        // Existing filter by orgs/teams (kept)
-        ul.AllBoardTeamsOrgs
-          li.AllBoardTeams
-            if userHasTeams
-              select.js-AllBoardTeams#jsAllBoardTeams("multiple")
-                option(value="-1") {{_ 'teams'}} :
-                each teamsDatas
-                  option(value="{{teamId}}") {{_ teamDisplayName}}
-
-          li.AllBoardOrgs
-            if userHasOrgs
-              select.js-AllBoardOrgs#jsAllBoardOrgs("multiple")
-                option(value="-1") {{_ 'organizations'}} :
-                each orgsDatas
-                  option(value="{{orgId}}") {{orgDisplayName}}
-
-          li.AllBoardBtns
-            div.AllBoardButtonsContainer
-              if userHasOrgsOrTeams
-                span.emoji-icon
-                  i.fa.fa-search
-                input#filterBtn(type="button" value="{{_ 'filter'}}")
-                button#resetBtn.filter-reset-btn
-                  span.reset-icon
-                    span.emoji-icon
-                      i.fa.fa-times-thin
-                  span {{_ 'filter-clear'}}
-
-      //- The grip that changes the menu's width, the Admin Panel's own. It is a
-        child of the GRID and not of the menu: it is positioned absolutely, so it
-        is no grid item and adds no track, and it does not scroll away with a
-        long list of workspaces the way a handle inside the menu would.
-        docs/Design/Page/Left-Menu.md
-      +leftMenuResize
-
-      // Right boards grid
-      //- There is NO bar above the boards, and no second header bar either.
-        Every control of this page - Sort, Search, Multi-Selection, the view
-        menu and the actions on a selection - is in the right sidebar, and the
-        page is named by the FIRST header bar. docs/Design/Page/All-Boards.md
-      .boards-right-grid
-        //- The heading of the pane: which list of boards this is. It sits above
-          the view branch, so it is drawn ONCE whichever view is on - the board
-          icons and the Table are two ways of showing the same section, not two
-          sections.
-          The Admin Panel's own `paneTitle`, so the two pages have one heading
-          at one size and colour. docs/Design/Page/All-Boards.md
-        +paneTitle(allBoardsPaneTitle)
-        //- The Archive is a SECTION of this page, drawn here beside the left
-          menu, not a page of its own that replaces it - and drawn with the same
-          board ICONS every other section uses. It had a table of its own, which
-          meant the one place you go to bring a board back was the one place
-          multi-selection, dragging and the tile layout did not work.
-          docs/Design/Page/Archive.md
-        if isAllBoardsView 'table'
-          +tablePage(tablePageData)
-        else
-          if boardsPaginationActive
-            .boards-pagination
-              button.js-boards-prev-page(class="{{#if hasBoardsPrevPage}}{{else}}disabled{{/if}}")
-                | <
-              span.boards-page-info {{boardsCurrentPage}} / {{boardsTotalPages}}
-              button.js-boards-next-page(class="{{#if hasBoardsNextPage}}{{else}}disabled{{/if}}")
-                | >
-          ul.board-list.clearfix.js-boards.dragscroll(class="{{#if isMiniScreen}}mobile-view{{/if}} {{#if BoardMultiSelection.isActive}}is-multiselection-active{{/if}}")
-            //- The Remove bar, drawn only while a board from Home is actually
-              being dragged - the launcher's, which appears at the top of the
-              screen when an icon is picked up and is not there the rest of the
-              time. Dropping a board here takes it off Home; the board itself
-              stays where it lives, the way an app stays in the drawer.
-              docs/Features/Board/Home.md
-            if showsHomeRemoveTarget
-              li.home-remove-target.js-home-remove
-                i.fa.fa-trash
-                span {{_ 'home-board-remove'}}
-            //- Home is a mark on ONE board rather than a place boards are
-              kept, so an empty Home says what to drag instead of showing a
-              blank pane.
-            if isSelectedMenu 'home'
-              unless boards.length
-                li.board-list-item-empty {{_ 'home-board-empty'}}
-            //- No "Add Board" in the Archive - a board cannot be created
-              already archived - nor in Home, where a new board would not be
-              the board that opens after login: the tile would promise
-              something it cannot do. ONE helper rather than two nested
-              conditions, because nesting one moved the tile's own children out
-              from under it.
-            if showsAddBoardTile
-              li.js-add-board
-                if isSelectedMenu 'templates'
-                  a.board-list-item.label.is-template-container(title="{{_ 'add-template-container'}}")
-                    span.emoji-icon
-                      i.fa.fa-plus
-                    |  {{_ 'add-template-container'}}
-                else
-                  a.board-list-item.label(title="{{_ 'add-board'}}")
-                    span.emoji-icon
-                      i.fa.fa-plus
-                    |  {{_ 'add-board'}}
-            //- The BOOKMARKS, in the Starred section beside the starred
-              boards - because Starred is the list of places you keep, and a
-              bookmark is one of them. A tile rather than a row, so it sits in
-              the same grid as the boards; a white border, so it is legible as
-              a different KIND of thing without being a different shape; and
-              the theme's own colour behind it, so it belongs to this WeKan.
-              It carries the title AND the URL: the title says where it goes
-              and the URL says what it is, which is what a bookmark bar shows.
-              Dragging one past another reorders them, and that order is the
-              order of the header dropdown - the two are views of one array.
-              docs/Features/Board/Starred.md
-            if isSelectedMenu 'starred'
-              each starredPages
-                li.js-bookmark.nodragscroll.board-list-item-bookmark(data-url="{{url}}", draggable="true")
-                  a.board-list-item(href="{{url}}", title="{{title}}")
-                    span.bookmark-title
-                      i.fa.fa-star
-                      |  {{title}}
-                    span.bookmark-url {{url}}
-                  //- A SIBLING of the link, not a child of it: an `a` inside an
-                    `a` is invalid HTML, and browsers repair it by closing the
-                    outer one early - which would leave the URL line outside the
-                    link that is supposed to carry it.
-                  a.js-unstar-bookmark.bookmark-unstar(href="#", title="{{_ 'click-to-unstar-page'}}")
-                    i.fa.fa-times
-            each boards
-              li.js-board.nodragscroll(class="{{_id}} {{#if isStarred}}starred{{/if}} {{colorClass}} {{#if BoardMultiSelection.isSelected _id}}is-checked{{/if}}", draggable="true")
-                if isInvited
-                  .board-list-item
-                    if BoardMultiSelection.isActive
-                      .materialCheckBox.multi-selection-checkbox.js-toggle-board-multi-selection(
-                        class="{{#if BoardMultiSelection.isSelected _id}}is-checked{{/if}}")
-                    span.details
-                      span.board-list-item-name= title
-                      span.js-star-board(
-                        class="{{#if isStarred}}is-star-active{{else}}is-not-star-active{{/if}}"
-                        title="{{_ 'star-board-title'}}")
-                        span.emoji-icon
-                          i.fa(class="{{#if isStarred}}fa-star{{else}}fa-star-o{{/if}}")
-                      p.board-list-item-desc {{_ 'just-invited'}}
-                      button.js-accept-invite.primary {{_ 'accept'}}
-                      button.js-decline-invite {{_ 'decline'}}
-                else
-                  if $eq type "template-container"
-                    .template-container.board-list-item
-                      if BoardMultiSelection.isActive
-                        .materialCheckBox.multi-selection-checkbox.js-toggle-board-multi-selection(
-                          class="{{#if BoardMultiSelection.isSelected _id}}is-checked{{/if}}")
-                      //- The drag handle obeys the same "Show desktop drag handles"
-                        setting as swimlanes, lists and cards. With handles ON it is
-                        the only place a board drag may start, so the rest of the
-                        tile is free to dragscroll; with handles OFF there is no
-                        handle and the whole tile is the drag source.
-                      if isTouchScreenOrShowDesktopDragHandles
-                        span.board-handle.nodragscroll(title="{{boardWorkspaceDragHint}}")
-                          span.emoji-icon
-                            i.fa.fa-arrows
-
-                      a.js-open-board(href="{{pathFor 'board' id=_id slug=slug}}" draggable="false")
-                        span.details
-                          span.board-list-item-name(title="{{_ 'template-container'}}")
-                            +viewer
-                              = title
-                          p.board-list-item-desc
-                            +viewer
-                              = description
-                          //- When you are looking at the Archive, when it was
-                            archived - that is what you sort an archive by, and
-                            what tells one old board from another.
-                            client/components/boards/boardsList.js
-                          if isSelectedMenu 'archive'
-                            p.board-list-item-archived-at
-                              span.emoji-icon
-                                i.fa.fa-archive
-                              |  {{_ 'archived-at'}}
-                              = ' '
-                              = archivedAtText
-                          if hasSpentTimeCards
-                            span.js-has-spenttime-cards(
-                              class="{{#if hasOvertimeCards}}has-overtime-card-active{{else}}no-overtime-card-active{{/if}}"
-                              title="{{#if hasOvertimeCards}}{{_ 'has-overtime-cards'}}{{else}}{{_ 'has-spenttime-cards'}}{{/if}}")
-                              span.emoji-icon
-                                i.fa.fa-clock-o
-                      span.js-star-board(
-                        class="{{#if isStarred}}is-star-active{{else}}is-not-star-active{{/if}}"
-                        title="{{_ 'star-board-title'}}")
-                        span.emoji-icon
-                          i.fa(class="fa-star{{#unless isStarred}}-o{{/unless}}")
-                  else
-                    //- #5157: reuse the board's existing backgroundImageURL as the
-                    //- tile background on the board list page.
-                    .board-list-item(class="{{#if backgroundImageURL}}has-background-image{{/if}}" style="{{#if backgroundImageURL}}background-image:url('{{backgroundImageURL}}');{{/if}}")
-                      if BoardMultiSelection.isActive
-                        .materialCheckBox.multi-selection-checkbox.js-toggle-board-multi-selection(
-                          class="{{#if BoardMultiSelection.isSelected _id}}is-checked{{/if}}")
-                      //- #2220: the Home board (opened after login) is badged with a
-                        home icon at the top centre of its tile.
-                      if isDefaultBoard
-                        span.board-home-badge(title="{{_ 'home-board-badge'}}")
-                          i.fa.fa-home
-                      //- The drag handle obeys the same "Show desktop drag handles"
-                        setting as swimlanes, lists and cards. With handles ON it is
-                        the only place a board drag may start, so the rest of the
-                        tile is free to dragscroll; with handles OFF there is no
-                        handle and the whole tile is the drag source.
-                      if isTouchScreenOrShowDesktopDragHandles
-                        span.board-handle.nodragscroll(title="{{boardWorkspaceDragHint}}")
-                          span.emoji-icon
-                            i.fa.fa-arrows
-
-                      a.js-open-board(href="{{pathFor 'board' id=_id slug=slug}}" draggable="false")
-                        span.details
-                          span.board-list-item-name(title="{{boardOpenAndMoveHint}}")
-                            +viewer
-                              = title
-                          //- #5174 / #4825: the per-board allows* flags are
-                          //- resolved server-side into the one-shot tile data
-                          //- (the raw fields are not even published to this
-                          //- page), so the show* helpers below gate the whole
-                          //- block consistently for every board.
-                          unless currentSetting.hideBoardMemberList
-                            if showBoardMemberList _id
-                              .minicard-members
-                                each member in boardMembers _id
-                                  a.name
-                                    +userAvatar(userId=member noRemove=true)
-                          unless currentSetting.hideCardCounterList
-                            if showCardCounterList _id
-                              .minicard-lists.flex.flex-wrap
-                                each list in boardLists _id
-                                  .item
-                                    | {{ list }}
-                          p.board-list-item-desc
-                            +viewer
-                              = description
-                          //- When you are looking at the Archive, when it was
-                            archived - that is what you sort an archive by, and
-                            what tells one old board from another.
-                            client/components/boards/boardsList.js
-                          if isSelectedMenu 'archive'
-                            p.board-list-item-archived-at
-                              span.emoji-icon
-                                i.fa.fa-archive
-                              |  {{_ 'archived-at'}}
-                              = ' '
-                              = archivedAtText
-                          if hasSpentTimeCards
-                            span.js-has-spenttime-cards(
-                              class="{{#if hasOvertimeCards}}has-overtime-card-active{{else}}no-overtime-card-active{{/if}}"
-                              title="{{#if hasOvertimeCards}}{{_ 'has-overtime-cards'}}{{else}}{{_ 'has-spenttime-cards'}}{{/if}}")
-                              span.emoji-icon
-                                i.fa.fa-clock-o
-                      a.js-star-board(
-                        class="{{#if isStarred}}is-star-active{{else}}is-not-star-active{{/if}}"
-                        title="{{_ 'star-board-title'}}")
-                        span.emoji-icon
-                          i.fa(class="fa-star{{#unless isStarred}}-o{{/unless}}")
-                      //- #2220 Home-board toggle is disabled: the icon and the
-                      //- set-default-board action are intentionally not rendered.
-
-template(name="boardsSortPopup")
-  ul.pop-over-list
-    li
-      a.js-boards-sort(data-sort="custom" class="{{#if isBoardsSort 'custom'}}active{{/if}}")
-        span.emoji-icon
-          i.fa.fa-arrows
-        |  {{_ 'sort-boards-custom'}}
-    li
-      a.js-boards-sort(data-sort="title-asc" class="{{#if isBoardsSort 'title-asc'}}active{{/if}}")
-        span.emoji-icon
-          i.fa.fa-sort-alpha-asc
-        |  {{_ 'sort-boards-title-asc'}}
-    li
-      a.js-boards-sort(data-sort="title-desc" class="{{#if isBoardsSort 'title-desc'}}active{{/if}}")
-        span.emoji-icon
-          i.fa.fa-sort-alpha-desc
-        |  {{_ 'sort-boards-title-desc'}}
-
-//- One row of the All Boards Table view. A rowTemplate, because the Edit cell is
-//- a control and the row carries its board's colours - neither of which a
-//- text-cell column spec can express. Cells must match the header, in order:
-//- Edit, Board title, Board description.
-template(name="allBoardsRow")
-  tr.all-boards-row(class="{{colorClass}}" data-board-id="{{_id}}")
-    td.all-boards-edit
-      a.js-edit-board-title-row(title="{{_ 'edit'}}")
-        i.fa.fa-pencil
-    td.all-boards-title
-      a.js-open-board-row(href="{{pathFor 'board' id=_id slug=slug}}")
-        +viewer
-          = title
-    td.all-boards-desc
-      +viewer
-        = description
-
-template(name="allBoardsViewPopup")
-  ul.pop-over-list
-    li
-      a.js-all-boards-view-lists
-        i.fa.fa-trello
-        | {{_ 'lists'}}
-        if isAllBoardsView 'lists'
-          i.fa.fa-check
-    li
-      a.js-all-boards-view-table
-        i.fa.fa-table
-        | {{_ 'board-view-table'}}
-        if isAllBoardsView 'table'
-          i.fa.fa-check
-  //.board-header-btns.right
-  //
+template(name="boardListHeaderBar")
+  h1 {{_ 'my-boards'}}
+  .board-header-btns.right
     a.board-header-btn.js-open-archived-board
-  //
       i.fa.fa-archive
-  //
       span {{_ 'archives'}}
-  //
     a.board-header-btn(href="{{pathFor 'board' id=templatesBoardId slug=templatesBoardSlug}}")
-  //
       i.fa.fa-clone
-  //
       span {{_ 'templates'}}
-
-// Recursive template for workspaces tree
-template(name="workspaceTree")
-  if nodes
-    ul.workspace-tree.js-workspace-tree
-      //- `../selectedWorkspaceId`, not the bare name. Inside `each` the data
-        context is the NODE, and this is a template argument rather than a
-        helper - so a bare lookup found nothing on the node, `$eq` compared an
-        id with undefined, and no workspace ever got the `active` class. The
-        theme highlight was styled for a class that was never applied.
-      each nodes
-        //- Which part of the row starts a reorder follows the "Show desktop drag
-          handles" toggle in the first header bar - the same setting swimlanes,
-          lists, cards and the board tiles obey:
-            handles ON  - the ✥ handle, and only the handle;
-            handles OFF - the workspace's icon AND its name, which is the whole
-                          `a.js-select-space`.
-          The anchor rather than the icon alone: a 16px glyph is a target that
-          has to be aimed at, and the name beside it is the part of the row a
-          reader is actually pointing at. Clicking it still opens the workspace -
-          a click and a drag are different gestures on the same element, exactly
-          as they are on a board tile with handles off.
-          NOT the whole row either: the row also holds the ⋯ menu and the board
-          count, and a drag started on those is a drag of something else.
-          `dragstart` bubbles, so the handler stays on the row in both cases.
-          docs/Design/Page/All-Boards.md
-        li.workspace-node(class="{{#if $eq id ../selectedWorkspaceId}}active{{/if}}" data-workspace-id="{{id}}")
-          .workspace-node-content
-            //- The caret that folds this workspace's own workspaces away, at
-              the START of the row - before the drag handle, so the carets of a
-              tree line up in one column whatever the handles toggle says. It is
-              the control a list has on a board and the one the left menu itself
-              has, down to the two words in its tooltip.
-              A workspace with no workspaces under it has nothing to fold, so it
-              gets a spacer of the same width instead: a row that shifted
-              sideways when it gained a child would be a moving target.
-              docs/Design/Page/Workspaces.md
-            if workspaceHasChildren
-              a.workspace-collapse-indicator.js-collapse-workspace(
-                title="{{workspaceCollapseLabel}}"
-                aria-label="{{workspaceCollapseLabel}}"
-                aria-expanded="{{#if isWorkspaceCollapsed}}false{{else}}true{{/if}}"
-                role="button"
-                tabindex="0")
-                if isWorkspaceCollapsed
-                  i.fa.fa-caret-right
-                else
-                  i.fa.fa-caret-down
-            else
-              span.workspace-collapse-spacer
-            if isTouchScreenOrShowDesktopDragHandles
-              span.workspace-drag-handle.nodragscroll(draggable="true")
-                span.emoji-icon
-                  i.fa.fa-arrows
-
-            //- `nodragscroll` for the same reason the handle carries it: the
-              page-level dragscroll owns a mousedown it is not opted out of, and
-              a drag that never begins is what "reordering does not work" looks
-              like.
-            a.js-select-workspace.js-select-space.nodragscroll(
-              data-id="{{id}}"
-              draggable="{{#if isTouchScreenOrShowDesktopDragHandles}}false{{else}}true{{/if}}")
-              span.workspace-icon
-                if icon
-                  span.workspace-icon-value(style="{{#if iconColor}}color: {{iconColor}};{{/if}}")
-                    +viewer
-                      = icon
-                else
-                  span.emoji-icon(style="{{#if iconColor}}color: {{iconColor}};{{/if}}")
-                    i.fa.fa-folder
-              span.workspace-name= name
-            a.js-open-workspace-menu(data-id="{{id}}" title="{{_ 'allboards.workspace-menu'}}")
-              span.emoji-icon
-                i.fa.fa-bars
-            span.workspace-count {{workspaceCount id}}
-          //- ONE condition, not `if children` wrapped in an `unless collapsed`:
-            `..` counts block levels, and a second block between the `each` and
-            this inclusion is another level for `../selectedWorkspaceId` to
-            climb - which is how the highlight was lost once already.
-            docs/Design/Page/Workspaces.md
-          if workspaceShowsChildren
-            +workspaceTree(nodes=children selectedWorkspaceId=../selectedWorkspaceId)
-
-//- #6524: creating a workspace used window.prompt(), which a browser may refuse
-  to show at all - iOS Safari lets the user suppress further prompts for a page,
-  and then the "+" beside Workspaces did nothing visible. This is a normal popup
-  with a real input, like every other create flow in WeKan.
-template(name="addWorkspacePopup")
-  form.js-add-workspace-form
-    label
-      | {{_ 'allboards.add-workspace-prompt'}}
-      input.js-new-workspace-name(type="text" autocomplete="off" autofocus required)
-    input.primary.wide(type="submit" value="{{_ 'allboards.add-workspace'}}")
-
-template(name="workspaceActionsPopup")
-  form.workspace-actions-form.js-workspace-actions-form(data-id="{{id}}")
-    label
-      | {{_ 'allboards.edit-workspace-name'}}
-      input.js-workspace-name(type="text" value="{{workspaceName}}" required)
-    label
-      | {{_ 'allboards.edit-workspace-icon'}}
-      input.js-workspace-icon(type="text" value="{{workspaceIcon}}")
-    input.primary.wide(type="submit" value="{{_ 'save'}}")
-  hr
-  form.workspace-subspace-form.js-workspace-subspace-form(data-id="{{id}}")
-    label
-      | {{_ 'allboards.add-subworkspace-prompt'}}
-      input.js-subworkspace-name(type="text")
-    button.primary.wide(type="submit") {{_ 'allboards.add-subworkspace'}}
-  hr
-  .workspace-delete-block
-    span.js-workspace-delete-error(style="color: #c00; display: block; margin: 4px 0;")
-    button.js-delete-workspace.negate.wide(type="button" data-id="{{id}}") {{_ 'delete'}}
-
-//- The All Boards view menu, in the FIRST top header bar, beside the board
-//- view menu's place - a view menu says what you are looking AT, so both of
-//- them sit next to the page's name rather than in a bar or a panel.
-//-
-//- It names the CURRENT view, not itself: the board header says "Swimlanes" or
-//- "Lists" rather than "Board View", and this matches it.
-//- docs/Design/Page/Header.md
-//- The page's controls, as icons, in the first top header bar - left of the
-//- bell, exactly where a board's own controls are. They were rows inside the
-//- right sidebar's home view, which meant two clicks and a panel covering the
-//- boards to reach the thing you came for; and the sidebar's home view was the
-//- ONLY reason All Boards offered a hamburger, so it does not any more. Search
-//- and Multi-Selection still open the sidebar, straight into their own view.
-//-
-//- Each names itself beside its icon where the bar has room, and the one rule
-//- in header.css drops every label below 1100px, leaving the tooltips.
-//- docs/Design/Page/All-Boards.md
-template(name="allBoardsHeaderButtons")
-  a.board-header-btn.js-open-boards-sort(title="{{_ 'sort-boards'}}" class="{{#unless isBoardsSort 'custom'}}emphasis{{/unless}}")
-    i.fa.fa-sort
-    span.board-header-btn-label {{_ 'sort-boards'}}
-  a.board-header-btn.js-all-boards-sidebar-search(title="{{_ 'search-boards'}}")
-    i.fa.fa-search
-    span.board-header-btn-label {{_ 'search-boards'}}
-  if canModifyBoards
-    //- Says whether it is ON, and offers the way OFF - the same pair the
-      board's own Multi-Selection has. It looked identical whether or not a
-      selection was running, so the one control that changes what a click on a
-      board does gave no sign it had changed it, and the only way out was to
-      find the row inside the sidebar. docs/Design/Page/Multi-Selection.md
-    a.board-header-btn.js-all-boards-sidebar-multiselection(
-        title="{{#if BoardMultiSelection.isActive}}{{_ 'multi-selection-on'}}{{else}}{{_ 'multi-selection'}}{{/if}}"
-        class="{{#if BoardMultiSelection.isActive}}emphasis{{/if}}")
-      i.fa.fa-check-square-o
-      span.board-header-btn-label {{#if BoardMultiSelection.isActive}}{{_ 'multi-selection-on'}}{{else}}{{_ 'multi-selection'}}{{/if}}
-    if BoardMultiSelection.isActive
-      a.board-header-btn-close.js-multiselection-reset(title="{{_ 'multi-selection-off'}}")
-        i.fa.fa-times-thin
-
-template(name="allBoardsViewMenu")
-  //- The name is visible beside the icon, the same as the board's view menu:
-    a tooltip is the one place a name cannot be read without hovering.
-  a.board-header-btn.js-open-all-boards-view(title="{{#if isAllBoardsView 'table'}}{{_ 'board-view-table'}}{{else}}{{_ 'lists'}}{{/if}}")
-    i.fa.fa-caret-down
-    if isAllBoardsView 'table'
-      i.fa.fa-table
-      span.board-header-btn-label {{_ 'board-view-table'}}
-    else
-      i.fa.fa-trello
-      span.board-header-btn-label {{_ 'lists'}}

client/components/boards/boardsList.styl

@@ -0,0 +1,198 @@
+@import 'nib'
+
+$spaceBetweenTiles = 16px
+
+.board-list
+  margin: 0 ($spaceBetweenTiles/2)
+
+  li
+    float: left
+    width: 25%
+    box-sizing: border-box
+    position: relative
+
+    &.starred
+      .fa-star,
+      .fa-star-o
+        opacity: 1
+
+  .board-list-item
+    overflow: hidden;
+    background-color: #999
+    color: #f6f6f6
+    height: 90px
+    font-size: 16px
+    line-height: 22px
+    border-radius: 3px
+    display: block
+    font-weight: 700
+    min-height: 18px
+    padding: 8px
+    margin: ($spaceBetweenTiles/2)
+    position: relative
+    text-decoration: none
+
+    &.tile
+      background-size: auto
+      background-repeat: repeat
+
+  .board-list-item-sub-name
+    color: rgba(255, 255, 255, .5)
+    display: block
+    font-size: 14px
+    font-weight: 400
+    line-height: 22px
+
+  .board-list-item-desc
+    color: #fff
+    display: block
+    font-size: 14px
+    font-weight: 400
+    line-height: 18px
+
+  .js-add-board
+    text-align:center
+
+    .label
+      font-weight: normal
+      line-height:90px
+
+    :hover
+      background-color:#939393
+
+  .fa-star,
+  .fa-star-o
+    bottom: 0
+    font-size: 14px
+    height: 18px
+    line-height: 18px
+    opacity: 0
+    padding: 9px 9px
+    position: absolute
+    right: 0
+    top: 0
+    transition-duration: .15s
+    transition-property: color, font-size, background
+
+  .fa-circle
+    bottom: 0;
+    font-size: 10px;
+    height: 10px;
+    line-height: 10px;
+    padding: 9px 9px;
+    position: absolute;
+    right: 0;
+    transition-duration: .15s
+    transition-property: color, font-size, background
+
+  .has-overtime-card-active
+    color: #eb4646 !important
+
+  .no-overtime-card-active
+    color: #3cb500 !important
+
+  .is-star-active
+    color: white
+
+  .fa-clone
+    position: absolute;
+    bottom: 0
+    font-size: 14px
+    height: 18px
+    line-height: 18px
+    opacity: 0
+    right: 0
+    padding: 9px 9px
+    transition-duration: .15s
+    transition-property: color, font-size, background
+
+  .fa-archive
+    position: absolute;
+    bottom: 0
+    font-size: 14px
+    height: 18px
+    line-height: 18px
+    opacity: 0
+    left: 0
+    padding: 9px 9px
+    transition-duration: .15s
+    transition-property: color, font-size, background
+
+  li:hover a
+    &:hover
+      .fa-star,
+      .fa-clone,
+      .fa-archive,
+      .fa-star-o
+        color: white
+
+    .fa-star,
+    .fa-clone,
+    .fa-archive,
+    .fa-star-o
+      color: white
+      opacity: .75
+
+      &:hover
+        font-size: 18px
+        opacity: 1
+
+      &.is-star-active
+        opacity: 1
+
+.board-backgrounds-list
+
+  .board-background-select
+    box-sizing: border-box
+    display: block
+    float: left
+    width: 50%
+    padding-top: 12px
+    position: relative
+    z-index: 1
+
+    &:nth-child(-n + 2)
+      padding-top: 0
+
+    &:nth-child(2n)
+      padding-left: 6px
+
+    &:nth-child(2n+1)
+      padding-right: 6px
+
+    .background-box
+      color: white
+      border-radius: 3px
+      background-size: cover
+      display: block
+      height: 74px
+      position: relative
+      width: 100%
+      cursor: pointer
+      display: flex
+      align-items: center
+      justify-content: center
+
+      i.fa-check
+        font-size: 25px
+        color: white
+
+@media screen and (max-width: 800px)
+  .board-list
+    height: 100%
+    overflow: scroll
+
+    li
+      width: 33.3%
+
+    .board-list-item
+      overflow: hidden
+
+    .board-list-item-sub-name
+      position: relative
+      top: -100px
+      left: -100px
+
+@media screen and (max-width: 360px)
+    li
+      width: 50%

client/components/boards/calendarView.css

@@ -1,43 +0,0 @@
-.calendar-view .fc {
-  --fc-button-text-color: #333;
-  --fc-button-bg-color: #f5f5f5;
-  --fc-button-border-color: rgba(0, 0, 0, 0.2);
-  --fc-button-hover-bg-color: #e6e6e6;
-  --fc-button-hover-border-color: rgba(0, 0, 0, 0.25);
-  --fc-button-active-bg-color: #d9d9d9;
-  --fc-button-active-border-color: rgba(0, 0, 0, 0.3);
-}
-
-.calendar-view .fc .fc-button-primary {
-  text-shadow: 0 1px 1px rgba(255, 255, 255, 0.75);
-  box-shadow: inset 0 1px 0 rgba(255, 255, 255, 0.2),
-    0 1px 2px rgba(0, 0, 0, 0.05);
-  background-image: linear-gradient(to bottom, #fff 0%, #e6e6e6 100%);
-}
-
-.calendar-view .fc .fc-button-primary:focus,
-.calendar-view .fc .fc-button-primary:not(:disabled).fc-button-active,
-.calendar-view .fc .fc-button-primary:not(:disabled):active {
-  box-shadow: inset 0 2px 4px rgba(0, 0, 0, 0.15),
-    0 1px 2px rgba(0, 0, 0, 0.05);
-}
-
-.calendar-create-close {
-  min-height: auto !important;
-  min-width: auto !important;
-  width: 32px;
-  height: 32px;
-  padding: 0 !important;
-  border: 0 !important;
-  background: transparent !important;
-  box-shadow: none !important;
-  color: #666 !important;
-  opacity: 0.8;
-}
-
-.calendar-create-close:hover,
-.calendar-create-close:focus {
-  background: transparent !important;
-  color: #111 !important;
-  opacity: 1;
-}

client/components/boards/dependencyOverlay.css

@@ -1,127 +0,0 @@
-.dependency-overlay {
-  position: absolute;
-  top: 0;
-  inset-inline-start: 0;
-  width: 100%;
-  height: 100%;
-  pointer-events: none;
-  z-index: 100;
-  overflow: visible;
-}
-
-/* #3392: the overlay SVG stays click-through, but each line is clickable (to
-   open the edit/delete popup) even though its container is pointer-events:none. */
-.dependency-line {
-  pointer-events: stroke;
-  cursor: pointer;
-}
-
-.dependency-temp-line {
-  pointer-events: none;
-}
-
-/* #3392: drag-to-connect handle on the minicard (no mode — cards stay
-   clickable). Shown on hover; drag it onto another card to create a link. */
-.minicard .dependency-connect-handle {
-  position: absolute;
-  top: 50%;
-  inset-inline-end: -7px;
-  transform: translateY(-50%);
-  width: 18px;
-  height: 18px;
-  display: flex;
-  align-items: center;
-  justify-content: center;
-  color: #eb144c;
-  background: #fff;
-  border-radius: 50%;
-  box-shadow: 0 0 2px rgba(0, 0, 0, 0.4);
-  cursor: crosshair;
-  opacity: 0;
-  z-index: 101;
-}
-
-.minicard:hover .dependency-connect-handle {
-  opacity: 1;
-}
-
-.dependency-line-popup .dependency-field {
-  display: flex;
-  align-items: center;
-  justify-content: space-between;
-  gap: 8px;
-  margin-bottom: 6px;
-}
-
-.dependency-line-popup .card-dependency-icons li a.is-selected {
-  border-color: #eb144c;
-  border-width: 2px;
-}
-
-.dependency-line-delete {
-  display: inline-flex;
-  align-items: center;
-  gap: 6px;
-  color: #eb144c;
-}
-
-/* #3392: card detail "Dependencies" rows */
-.card-details-dependencies-list .card-dependency {
-  display: flex;
-  align-items: center;
-  gap: 6px;
-  margin-bottom: 4px;
-}
-
-.card-details-dependencies-list .card-dependency-link {
-  flex: 1 1 auto;
-  overflow: hidden;
-  text-overflow: ellipsis;
-  white-space: nowrap;
-}
-
-.card-details-dependencies-list .js-dependency-type {
-  flex: 0 0 auto;
-  max-width: 130px;
-}
-
-.card-details-dependencies-list .js-dependency-color {
-  flex: 0 0 auto;
-  width: 28px;
-  height: 24px;
-  padding: 0;
-  border: none;
-  background: none;
-  cursor: pointer;
-}
-
-.card-dependencies-popup .dependency-field {
-  display: flex;
-  align-items: center;
-  justify-content: space-between;
-  gap: 8px;
-  margin-bottom: 6px;
-}
-
-.card-dependency-icons {
-  display: flex;
-  flex-wrap: wrap;
-  gap: 8px;
-  list-style: none;
-  margin: 0;
-  padding: 4px;
-}
-
-.card-dependency-icons li a {
-  display: inline-flex;
-  align-items: center;
-  justify-content: center;
-  width: 32px;
-  height: 32px;
-  border: 1px solid #ddd;
-  border-radius: 4px;
-}
-
-.minicard .badge.minicard-dependencies .badge-icon {
-  font-weight: bold;
-}

client/components/boards/dependencyOverlay.jade

@@ -1,35 +0,0 @@
-template(name="dependencyOverlay")
-  svg.dependency-overlay.js-dependency-overlay(xmlns="http://www.w3.org/2000/svg")
-    defs
-      each dependencyMarkers
-        marker(id="{{markerId}}" markerWidth="8" markerHeight="8" refX="7" refY="3" orient="auto" markerUnits="userSpaceOnUse")
-          path(d="M0,0 L7,3 L0,6 Z" fill="{{color}}")
-    each dependencyLines
-      path.dependency-line(d="{{path}}" fill="none" stroke="{{color}}" stroke-width="2" marker-end="{{markerUrl}}")
-    if tempLine
-      path.dependency-temp-line(d="{{tempLine}}" fill="none" stroke="#eb144c" stroke-width="2" stroke-dasharray="6,4")
-
-template(name="dependencyLinePopup")
-  .dependency-line-popup
-    label.dependency-field
-      span {{_ 'dependency-type'}}
-      select.js-line-type
-        each typeOption
-          if selected
-            option(value="{{id}}" selected="selected") {{_ label}}
-          else
-            option(value="{{id}}") {{_ label}}
-    label.dependency-field
-      span {{_ 'dependency-color'}}
-      input.js-line-color(type="color" value="{{color}}")
-    .dependency-field
-      span {{_ 'dependency-icon'}}
-    ul.card-dependency-icons
-      each dependencyIcons
-        li
-          a.js-line-icon(data-icon="{{name}}" title="{{name}}" class="{{#if selected}}is-selected{{/if}}")
-            i.fa(class="fa-{{name}}")
-    hr
-    a.js-line-delete.dependency-line-delete
-      i.fa.fa-times
-      | {{_ 'remove-dependency'}}

client/components/boards/dependencyOverlay.js

@@ -1,300 +0,0 @@
-import { ReactiveCache } from '/imports/reactiveCache';
-import { ReactiveVar } from 'meteor/reactive-var';
-import { Utils } from '/client/lib/utils';
-import {
-  DEPENDENCY_ICON_CHOICES,
-  DEPENDENCY_TYPES,
-  dependencyTypeMeta,
-  normalizeDependencies,
-} from '/models/metadata/dependencies';
-
-// #3392: PI Program Board "Red Strings".
-// Draw colored, typed connection lines (SVG paths) between cards that declare
-// cardDependencies. The board stays fully usable (cards clickable) — drawing a
-// new link is initiated from a small connect handle on each minicard (drag it
-// onto another card, piplanning.io / Kendis / Miro style), and a link can be
-// edited/deleted by clicking its line. The overlay SVG itself stays
-// pointer-events:none; only the lines (and the minicard handles) capture events.
-//
-// Coordinates are computed from the live DOM (getBoundingClientRect of
-// [data-card-id] minicards) translated into the overlay SVG's own coordinate
-// space, so scrolling/resizing is handled by recomputing relative to the SVG's
-// current bounding rect.
-
-// Stable, css-safe marker id for an arrowhead of a given color.
-function markerIdForColor(color) {
-  return `dependency-arrowhead-${String(color).replace(/[^a-zA-Z0-9]/g, '')}`;
-}
-
-Template.dependencyOverlay.onCreated(function () {
-  this.lines = new ReactiveVar([]);
-  this.markers = new ReactiveVar([]);
-  this.tempLine = new ReactiveVar(null); // line being drawn while dragging
-  // Guard against deferred (rAF / setTimeout) callbacks touching the DOM after
-  // the overlay is destroyed ("Can't select in removed DomRange").
-  this._overlayDestroyed = false;
-
-  // Rect of a card relative to the overlay SVG, or null if not rendered.
-  this.rectOf = (cardId, svgRect) => {
-    const el = document.querySelector(`[data-card-id="${cardId}"]`);
-    if (!el) return null;
-    const r = el.getBoundingClientRect();
-    if (r.width === 0 && r.height === 0) return null;
-    return { x: r.left - svgRect.left, y: r.top - svgRect.top, w: r.width, h: r.height };
-  };
-
-  this.recompute = () => {
-    if (this._overlayDestroyed || !this.view || this.view.isDestroyed) {
-      return;
-    }
-    const svg = this.find('.js-dependency-overlay');
-    if (!svg) {
-      return;
-    }
-    const board = Utils.getCurrentBoard();
-    if (!board) {
-      this.lines.set([]);
-      return;
-    }
-
-    const svgRect = svg.getBoundingClientRect();
-    const centerOf = cardId => this.rectOf(cardId, svgRect);
-
-    const cards = ReactiveCache.getCards({
-      boardId: board._id,
-      archived: false,
-    });
-
-    const lines = [];
-    const markerColors = new Set();
-    cards.forEach(card => {
-      const deps = normalizeDependencies(card.cardDependencies);
-      if (deps.length === 0) {
-        return;
-      }
-      const sourceRect = centerOf(card._id);
-      if (!sourceRect) {
-        return;
-      }
-      deps.forEach(dep => {
-        const targetRect = centerOf(dep.cardId);
-        if (!targetRect) {
-          return;
-        }
-        const meta = dependencyTypeMeta(dep.type);
-        // Draw the arrow from the prerequisite card's right edge to the
-        // dependent card's left edge. For forward relations (blocks/fixes/
-        // related-to) the source card is the prerequisite; for the reverse
-        // relations (is-blocked-by/is-fixed-by) the target is.
-        const prereq = meta.forward ? sourceRect : targetRect;
-        const dependent = meta.forward ? targetRect : sourceRect;
-        const x1 = prereq.x + prereq.w;
-        const y1 = prereq.y + prereq.h / 2;
-        const x2 = dependent.x;
-        const y2 = dependent.y + dependent.h / 2;
-        const dx = Math.max(40, Math.abs(x2 - x1) / 2);
-        const path = `M ${x1} ${y1} C ${x1 + dx} ${y1}, ${x2 - dx} ${y2}, ${x2} ${y2}`;
-        const markerId = markerIdForColor(dep.color);
-        if (meta.directed) {
-          markerColors.add(dep.color);
-        }
-        lines.push({
-          path,
-          color: dep.color,
-          type: dep.type,
-          icon: dep.icon,
-          directed: meta.directed,
-          markerId: meta.directed ? markerId : '',
-          // Source card (owns the dependency) and target card.
-          fromId: card._id,
-          toId: dep.cardId,
-        });
-      });
-    });
-    this.lines.set(lines);
-    this.markers.set(
-      [...markerColors].map(color => ({
-        color,
-        markerId: markerIdForColor(color),
-      })),
-    );
-  };
-
-  this.scheduleRecompute = () => {
-    if (this._overlayDestroyed) return;
-    if (this._raf) {
-      window.cancelAnimationFrame(this._raf);
-    }
-    this._raf = window.requestAnimationFrame(() => {
-      this._raf = null;
-      this.recompute();
-    });
-  };
-});
-
-Template.dependencyOverlay.onRendered(function () {
-  const instance = this;
-  const svg = this.find('.js-dependency-overlay');
-  this.scrollEl = svg ? this.firstNode.closest('.board-canvas') : null;
-
-  this.autorun(() => {
-    const board = Utils.getCurrentBoard();
-    if (board) {
-      ReactiveCache.getCards({ boardId: board._id, archived: false });
-    }
-    instance.scheduleRecompute();
-  });
-
-  this.onScroll = () => instance.scheduleRecompute();
-  this.onResize = () => instance.scheduleRecompute();
-
-  if (this.scrollEl) {
-    this.scrollEl.addEventListener('scroll', this.onScroll, { passive: true });
-  }
-  window.addEventListener('scroll', this.onScroll, { passive: true });
-  window.addEventListener('resize', this.onResize);
-
-  // --- drag-to-connect (from a minicard's connect handle) -----------------
-  // Find the card under a viewport point. The overlay is pointer-events:none,
-  // so elementsFromPoint returns the minicards directly.
-  const cardIdAtPoint = (clientX, clientY) => {
-    const els = document.elementsFromPoint(clientX, clientY);
-    for (const el of els) {
-      if (svg && svg.contains(el)) continue;
-      const card = el.closest && el.closest('[data-card-id]');
-      if (card) return card.getAttribute('data-card-id');
-    }
-    return null;
-  };
-
-  this.onMouseDown = e => {
-    if (e.button !== 0) return;
-    const handle =
-      e.target.closest && e.target.closest('.js-dependency-connect-handle');
-    if (!handle) return;
-    const cardEl = handle.closest('[data-card-id]');
-    if (!cardEl) return;
-    // Beat the card drag-sort: capture-phase + stop propagation.
-    e.preventDefault();
-    e.stopPropagation();
-    instance.dragSourceId = cardEl.getAttribute('data-card-id');
-  };
-
-  this.onMouseMove = e => {
-    if (!instance.dragSourceId || !svg) return;
-    const svgRect = svg.getBoundingClientRect();
-    const from = instance.rectOf(instance.dragSourceId, svgRect);
-    if (!from) return;
-    const x1 = from.x + from.w;
-    const y1 = from.y + from.h / 2;
-    const x2 = e.clientX - svgRect.left;
-    const y2 = e.clientY - svgRect.top;
-    const dx = Math.max(40, Math.abs(x2 - x1) / 2);
-    instance.tempLine.set(
-      `M ${x1} ${y1} C ${x1 + dx} ${y1}, ${x2 - dx} ${y2}, ${x2} ${y2}`,
-    );
-  };
-
-  this.onMouseUp = e => {
-    if (!instance.dragSourceId) return;
-    const sourceId = instance.dragSourceId;
-    instance.dragSourceId = null;
-    instance.tempLine.set(null);
-    const targetId = cardIdAtPoint(e.clientX, e.clientY);
-    if (targetId && targetId !== sourceId) {
-      const card = ReactiveCache.getCard(sourceId);
-      if (card && typeof card.addDependency === 'function') {
-        card.addDependency(targetId);
-      }
-    }
-  };
-
-  // Capture phase so the connect drag starts before the sortable grabs the card.
-  document.addEventListener('mousedown', this.onMouseDown, true);
-  document.addEventListener('mousemove', this.onMouseMove);
-  document.addEventListener('mouseup', this.onMouseUp);
-
-  this._initTimeout = Meteor.setTimeout(() => instance.scheduleRecompute(), 300);
-});
-
-Template.dependencyOverlay.onDestroyed(function () {
-  this._overlayDestroyed = true;
-  if (this.scrollEl) {
-    this.scrollEl.removeEventListener('scroll', this.onScroll);
-  }
-  window.removeEventListener('scroll', this.onScroll);
-  window.removeEventListener('resize', this.onResize);
-  if (this.onMouseDown) document.removeEventListener('mousedown', this.onMouseDown, true);
-  if (this.onMouseMove) document.removeEventListener('mousemove', this.onMouseMove);
-  if (this.onMouseUp) document.removeEventListener('mouseup', this.onMouseUp);
-  if (this._raf) {
-    window.cancelAnimationFrame(this._raf);
-  }
-  if (this._initTimeout) {
-    Meteor.clearTimeout(this._initTimeout);
-  }
-});
-
-Template.dependencyOverlay.helpers({
-  dependencyLines() {
-    return Template.instance().lines.get();
-  },
-  dependencyMarkers() {
-    return Template.instance().markers.get();
-  },
-  tempLine() {
-    return Template.instance().tempLine.get();
-  },
-  markerUrl() {
-    return this.markerId ? `url(#${this.markerId})` : '';
-  },
-});
-
-Template.dependencyOverlay.events({
-  'click .dependency-line'(event) {
-    event.preventDefault();
-    event.stopPropagation();
-    // `this` is the line data object (fromId/toId/type/color/icon).
-    Popup.open('dependencyLine').call(this, event);
-  },
-});
-
-// #3392: popup to edit or delete an on-board dependency line. Data context is the
-// line object { fromId, toId, type, color, icon }.
-Template.dependencyLinePopup.helpers({
-  typeOption() {
-    const current = this.type;
-    return DEPENDENCY_TYPES.map(t => ({
-      id: t.id,
-      label: `dependency-type-${t.id}`,
-      selected: t.id === current,
-    }));
-  },
-  color() {
-    return this.color;
-  },
-  dependencyIcons() {
-    const current = this.icon;
-    return DEPENDENCY_ICON_CHOICES.map(name => ({ name, selected: name === current }));
-  },
-});
-
-Template.dependencyLinePopup.events({
-  'change .js-line-type'(event) {
-    const card = ReactiveCache.getCard(this.fromId);
-    if (card) card.setDependencyProps(this.toId, { type: event.currentTarget.value });
-  },
-  'change .js-line-color'(event) {
-    const card = ReactiveCache.getCard(this.fromId);
-    if (card) card.setDependencyProps(this.toId, { color: event.currentTarget.value });
-  },
-  'click .js-line-icon'(event) {
-    const card = ReactiveCache.getCard(this.fromId);
-    if (card) card.setDependencyProps(this.toId, { icon: event.currentTarget.dataset.icon });
-  },
-  'click .js-line-delete'() {
-    const card = ReactiveCache.getCard(this.fromId);
-    if (card) card.removeDependency(this.toId);
-    Popup.back();
-  },
-});

client/components/boards/miniboard.jade

@@ -3,7 +3,6 @@ template(name="miniboard")
     class="minicard-{{colorClass}}")
     .minicard-title
       .handle
-        span.drag-handle(title="{{_ 'dragBoard'}}")
-          i.fa.fa-arrows
+        .fa.fa-arrows
       +viewer
         = title

client/components/boards/originalPositionsView.css

@@ -1,263 +0,0 @@
-/* Original Positions View Styles */
-.original-positions-view {
-  margin: 10px 0;
-  padding: 15px;
-  background-color: #f8f9fa;
-  border: 1px solid #e9ecef;
-  border-radius: 6px;
-}
-
-.original-positions-header {
-  display: flex;
-  align-items: center;
-  gap: 10px;
-  margin-bottom: 15px;
-}
-
-.original-positions-header .btn {
-  display: flex;
-  align-items: center;
-  gap: 5px;
-}
-
-.original-positions-content {
-  background-color: white;
-  border: 1px solid #dee2e6;
-  border-radius: 4px;
-  padding: 15px;
-}
-
-.original-positions-loading {
-  text-align: center;
-  padding: 20px;
-  color: #6c757d;
-  font-style: italic;
-}
-
-.original-positions-loading i {
-  margin-inline-end: 8px;
-}
-
-.original-positions-filters {
-  margin-bottom: 20px;
-  padding-bottom: 15px;
-  border-bottom: 1px solid #dee2e6;
-}
-
-.original-positions-filters .btn-group {
-  display: flex;
-  flex-wrap: wrap;
-  gap: 5px;
-}
-
-.original-positions-filters .btn {
-  display: flex;
-  align-items: center;
-  gap: 5px;
-  white-space: nowrap;
-}
-
-.original-positions-list {
-  max-height: 400px;
-  overflow-y: auto;
-}
-
-.original-position-item {
-  background-color: #f8f9fa;
-  border: 1px solid #e9ecef;
-  border-radius: 4px;
-  margin-bottom: 10px;
-  padding: 12px;
-  transition: all 0.2s ease;
-}
-
-.original-position-item:hover {
-  background-color: #e9ecef;
-  border-color: #ced4da;
-}
-
-.original-position-item:last-child {
-  margin-bottom: 0;
-}
-
-.original-position-item-header {
-  display: flex;
-  align-items: center;
-  gap: 8px;
-  margin-bottom: 8px;
-  font-weight: 600;
-  color: #495057;
-}
-
-.original-position-item-header i {
-  color: #6c757d;
-  width: 16px;
-  text-align: center;
-}
-
-.entity-type {
-  background-color: #007bff;
-  color: white;
-  padding: 2px 6px;
-  border-radius: 3px;
-  font-size: 11px;
-  font-weight: 500;
-  text-transform: uppercase;
-}
-
-.entity-name {
-  color: #212529;
-  font-weight: 600;
-}
-
-.entity-id {
-  color: #6c757d;
-  font-size: 11px;
-  font-family: monospace;
-}
-
-.original-position-item-details {
-  margin-inline-start: 24px;
-}
-
-.original-position-description {
-  color: #495057;
-  margin-bottom: 6px;
-  font-size: 13px;
-}
-
-.original-title {
-  color: #6c757d;
-  font-size: 12px;
-  margin-bottom: 6px;
-  padding: 4px 6px;
-  background-color: #e9ecef;
-  border-radius: 3px;
-}
-
-.original-title strong {
-  color: #495057;
-}
-
-.original-position-date {
-  color: #6c757d;
-  font-size: 11px;
-}
-
-.no-original-positions {
-  text-align: center;
-  padding: 40px 20px;
-  color: #6c757d;
-  font-style: italic;
-}
-
-.no-original-positions i {
-  font-size: 24px;
-  margin-bottom: 10px;
-  display: block;
-  color: #adb5bd;
-}
-
-/* Responsive adjustments */
-@media (max-width: 768px) {
-  .original-positions-view {
-    margin: 5px 0;
-    padding: 10px;
-  }
-
-  .original-positions-header {
-    flex-direction: column;
-    align-items: stretch;
-    gap: 8px;
-  }
-
-  .original-positions-header .btn {
-    justify-content: center;
-  }
-
-  .original-positions-filters .btn-group {
-    justify-content: center;
-  }
-
-  .original-position-item-header {
-    flex-wrap: wrap;
-    gap: 6px;
-  }
-
-  .entity-name {
-    flex: 1;
-    min-width: 0;
-    word-break: break-word;
-  }
-
-  .original-position-item-details {
-    margin-inline-start: 0;
-    margin-top: 8px;
-  }
-}
-
-/* Dark theme support */
-@media (prefers-color-scheme: dark) {
-  .original-positions-view {
-    background-color: #2d3748;
-    border-color: #4a5568;
-    color: #e2e8f0;
-  }
-
-  .original-positions-content {
-    background-color: #1a202c;
-    border-color: #4a5568;
-  }
-
-  .original-position-item {
-    background-color: #2d3748;
-    border-color: #4a5568;
-    color: #e2e8f0;
-  }
-
-  .original-position-item:hover {
-    background-color: #4a5568;
-    border-color: #718096;
-  }
-
-  .original-position-item-header {
-    color: #e2e8f0;
-  }
-
-  .original-position-item-header i {
-    color: #a0aec0;
-  }
-
-  .entity-name {
-    color: #e2e8f0;
-  }
-
-  .entity-id {
-    color: #a0aec0;
-  }
-
-  .original-position-description {
-    color: #e2e8f0;
-  }
-
-  .original-title {
-    background-color: #4a5568;
-    color: #a0aec0;
-  }
-
-  .original-title strong {
-    color: #e2e8f0;
-  }
-
-  .original-position-date {
-    color: #a0aec0;
-  }
-
-  .no-original-positions {
-    color: #a0aec0;
-  }
-
-  .no-original-positions i {
-    color: #718096;
-  }
-}