ConductionNL · github-actions · May 1, 2026 · May 2, 2026 · May 2, 2026 · May 2, 2026
diff --git a/.github/CODEOWNERS b/.github/CODEOWNERS
@@ -0,0 +1,36 @@
+# CODEOWNERS — auto-request reviewers based on path domain.
+# Last-match-wins; broad rules first, specific overrides below.
+# Created 2026-05-03 from the OR-abstraction audit follow-up.
+
+# Default: every named codeowner reviews unmatched paths.
+*                       @rubenvdlinde @rjzondervan @Rem-Dam @remko48 @WilcoLouwerse @bbrands02 @SudoThijn
+
+# Backend (PHP) — services, controllers, mappers, db, migration, etc.
+lib/                    @bbrands02 @rjzondervan @WilcoLouwerse
+appinfo/                @bbrands02 @rjzondervan @WilcoLouwerse
+**/*.php                @bbrands02 @rjzondervan @WilcoLouwerse
+phpcs.xml               @bbrands02 @rjzondervan @WilcoLouwerse
+phpmd.xml               @bbrands02 @rjzondervan @WilcoLouwerse
+phpstan.neon            @bbrands02 @rjzondervan @WilcoLouwerse
+phpstan-baseline.neon   @bbrands02 @rjzondervan @WilcoLouwerse
+phpmd.baseline.xml      @bbrands02 @rjzondervan @WilcoLouwerse
+composer.json           @bbrands02 @rjzondervan @WilcoLouwerse
+composer.lock           @bbrands02 @rjzondervan @WilcoLouwerse
+
+# Frontend (Vue / TS / JS) — components, stores, pages, build config.
+src/                    @SudoThijn @remko48
+**/*.vue                @SudoThijn @remko48
+**/*.ts                 @SudoThijn @remko48
+**/*.js                 @SudoThijn @remko48
+package.json            @SudoThijn @remko48
+package-lock.json       @SudoThijn @remko48
+jest.config.js          @SudoThijn @remko48
+playwright.config.ts    @SudoThijn @remko48
+webpack.config.js       @SudoThijn @remko48
+babel.config.js         @SudoThijn @remko48
+
+# Specs / docs / ADRs / openspec.
+openspec/               @rubenvdlinde @Rem-Dam
+docs/                   @rubenvdlinde @Rem-Dam
+**/*.md                 @rubenvdlinde @Rem-Dam
+README.md               @rubenvdlinde @Rem-Dam
diff --git a/.github/workflows/code-quality.yml b/.github/workflows/code-quality.yml
@@ -18,3 +18,21 @@ jobs:
       enable-phpmetrics: true
       enable-frontend: true
       enable-eslint: true
+      # Hard gates:
+      #   - PHPUnit — wired in wave3.10. 4-way matrix (PHP 8.3/8.4 ×
+      #     NC stable31/stable32) all green.
+      #   - Newman — wired alongside the postman collection drift
+      #     sweep (PR #123 follow-up): six real backend bugs fixed
+      #     (Templates SQL, Feeds 2× constraint, addWidget TypeError,
+      #     Lock-on-nonexistent, share TypeError, addRule TypeError),
+      #     postman fixture-id wiring repaired and assertion drift
+      #     resolved. 196 assertions / 0 failures locally.
+      #
+      # Playwright remains disabled — the shared workflow's
+      # PHP-built-in-server lifetime is the blocker (cross-repo PR
+      # `ConductionNL/.github#37`). The `tests/e2e/global-setup.ts`
+      # `ensureBundleBuilt()` helper is in place so once the shared
+      # workflow lands, flipping the gate Just Works.
+      enable-phpunit: true
+      enable-newman: true
+      newman-environment-path: "tests/integration/local.env.json"
diff --git a/.github/workflows/documentation.yml b/.github/workflows/documentation.yml
@@ -10,4 +10,4 @@ jobs:
   deploy:
     uses: ConductionNL/.github/.github/workflows/documentation.yml@main
     with:
-      cname: mydash.app
+      cname: mydash.conduction.nl
diff --git a/.gitignore b/.gitignore
@@ -45,6 +45,12 @@ Thumbs.db
 /phpqa/
 /quality-reports/
 
+# Playwright e2e
+/tests/e2e/.auth/
+/test-results/
+/playwright-report/
+/playwright/.cache/
+
 # PHP
 /composer.phar
 
@@ -60,3 +66,8 @@ Thumbs.db
 sbom.cdx.json
 bom-php.cdx.json
 bom-npm.cdx.json
+
+# Research notes (local-only)
+/docs/sendent-analysis.md
+/sendent-workspace-main/
+/2026.*_sendent-workspace-main.zip
diff --git a/CHANGELOG.md b/CHANGELOG.md
@@ -6,17 +6,69 @@ All notable changes to this project will be documented in this file.
 
 ### Added
 
-- **Initial-state contract** (REQ-INIT-001..REQ-INIT-005). Workspace and admin
-  pages now route every initial-state key through the typed PHP service
-  `OCA\MyDash\Service\InitialStateBuilder` (with a `Page` enum and required-key
-  enforcement via `MissingInitialStateException`). The mirrored typed JS reader
-  `src/utils/loadInitialState.js` returns a default-filled object and warns when
-  `INITIAL_STATE_SCHEMA_VERSION` (currently `1`) drifts between server and
-  client. To add a key: update the spec Data Model (REQ-INIT-002), bump
-  `INITIAL_STATE_SCHEMA_VERSION` in both PHP and JS, and add the setter +
-  reader entry in the same commit. Direct calls to
-  `IInitialState::provideInitialState` from controllers / settings, and direct
-  `loadState('mydash', ...)` calls from `src/`, are forbidden by lint.
+- **Per-user RSS / Atom dashboard feeds** (REQ-FEED-001..009): users can
+  now opt-in to a personal feed of their accessible dashboards via
+  `GET /api/feed/token`. New routes `POST /api/feed/token/regenerate`
+  (atomic rotate), `DELETE /api/feed/token` (idempotent soft-revoke),
+  and the public `GET /feed/{token}.xml` (no Nextcloud auth — gated
+  only by the opaque token). Tokens are 32 random bytes encoded
+  URL-safe base64 (~43 chars, 256-bit entropy, non-enumerable). Feed
+  output is RSS 2.0 by default; `Accept: application/atom+xml` (or the
+  `?format=atom` query fallback) switches to Atom 1.0. Visibility
+  reuses `DashboardService::getVisibleToUser()` so private dashboards
+  never leak to public feed consumers; item count is capped at the
+  admin-tunable `mydash.feed_item_cap` (default 50). New
+  `oc_mydash_feed_tokens` table with `UNIQUE(user_id)` enforces the
+  one-token-per-user rotation invariant.
+
+### Changed
+
+- **GridStack bumped from `^10.3.1` to `^12.2.1`** (resolved 12.6.0). Major
+  version bump bundled with the responsive-grid-breakpoints change. The
+  `GridStack.init` signature, the `change` event payload, the
+  `engine.nodes` accessor, the `removeWidget(el, removeDOM)` call, and the
+  `enable()`/`disable()` lifecycle methods used by `DashboardGrid.vue` are
+  unchanged across the v10 -> v12 jump, so no caller-side breakage was
+  observed during the bump. Downstream forks pinning a narrower
+  `gridstack` range will need to widen their dependency.
+
+### Added
+
+- **Responsive grid breakpoints** (REQ-GRID-007 / REQ-GRID-012 /
+  REQ-GRID-013): the GridStack instance now reflows proportionally at four
+  viewport widths instead of staying fixed-12-column on narrow screens.
+  Breakpoints `[{w:1400,c:12},{w:1100,c:8},{w:768,c:4},{w:480,c:1}]` with
+  the `moveScale` layout algorithm. Geometry constants (`CELL_HEIGHT = 60`,
+  `GRID_MARGIN = 8`, `BREAKPOINTS`) live in
+  `src/composables/useGridManager.js` as the single source of truth and
+  are mirrored to the CSS custom property `--mydash-cell-height` at
+  init time so `calc()` expressions stay in sync. Cell height moved from
+  the previously documented 80 px to 60 px to better support multi-row
+  info widgets; flip the `CELL_HEIGHT` constant in the composable (single
+  edit) if a denser/looser default is preferred.
+
+- **Initial-state contract** (REQ-INIT-001..006): `lib/Service/InitialStateBuilder.php`
+  centralises the per-page initial-state payload pushed via Nextcloud's
+  `IInitialState` service. The matching JS reader at
+  `src/utils/loadInitialState.js` returns a typed default-filled object for
+  the workspace and admin pages. Both sides stamp / validate a
+  `_schemaVersion` constant; deploy skew between PHP and JS surfaces as a
+  console warning at runtime.
+
+  Adding, removing, or renaming a key requires four coordinated edits in
+  the same commit:
+  1. update the spec Data Model in
+     `openspec/specs/initial-state-contract/spec.md`,
+  2. bump `INITIAL_STATE_SCHEMA_VERSION` in
+     `lib/Service/InitialStateBuilder.php` AND
+     `src/utils/loadInitialState.js`,
+  3. add (or remove) the typed setter in the PHP builder and the matching
+     entry in the JS reader's `PAGE_KEYS` table,
+  4. update the controller(s) that call the builder.
+
+  CI guards (`composer lint:initial-state`, `npm run lint:initial-state`)
+  forbid direct `IInitialState::provideInitialState()` calls outside the
+  builder and direct `loadState('mydash', ...)` calls outside the reader.
 
 ## 0.1.0 - Initial Release
 

diff --git a/DEVELOPMENT.md b/DEVELOPMENT.md
@@ -55,16 +55,26 @@ npm start            # Dev server at http://localhost:3000 with hot reload
 
 Simply add or edit Markdown files in the `docs/` folder. The sidebar is auto-generated from the folder structure. Changes will appear on the product page after pushing to `development`.
 
-## Security review checkboxes
+## Adding a widget type
 
-### Extending the SVG whitelist
+The widget registry (`src/constants/widgetRegistry.js`) is the single source of truth for "addable" custom widget types (REQ-WDG-014). Because many widget capabilities ship in parallel branches that all touch the same object, the file is a heavy merge-conflict site -- a regression that silently drops a type would silently disappear from the Add Custom Widget picker without any test signal. To add a new widget type:
 
-`lib/Service/SvgSanitiser.php` ships a deliberately conservative whitelist of 24 element types and 50 attribute types — see `ALLOWED_ELEMENTS` and `ALLOWED_ATTRIBUTES` (REQ-RES-010 / REQ-RES-011 in the `resource-uploads` capability).
+- Update `src/constants/widgetRegistry.js` with the new entry (`renderer`, `form`, `defaultContent`, `displayName`, `icon`).
+- Update `EXPECTED_TYPES` in `src/constants/__tests__/widgetRegistry.completeness.spec.js` (REQ-WDG-023) so the completeness guard stays in sync. The test will fail with a precise diff if you forget.
+- Implement the renderer + form Vue components following the pattern of an existing widget (e.g. `LabelWidget.vue` + `LabelForm.vue`).
+- Add i18n keys for the type's `displayName` and any user-facing form labels to all four `l10n/` files (`en.js`, `en.json`, `nl.js`, `nl.json`).
+- Add the canonical capability spec under `openspec/specs/<widget-name>/spec.md` so the type's REQ-* identifiers, defaults, and acceptance scenarios are documented.
 
-Adding any element or attribute to either constant is a **security review checkbox**, not an editorial change. Before merging an addition, confirm:
+## Security review checklist
 
-- the element / attribute carries no executable surface (no script, no event handler, no foreign content, no URL fetch outside the existing `href` filter);
-- the addition is justified by a real upload that is currently being rejected, not a speculative future need;
-- a corresponding unit test covers the new whitelist entry.
+### Extending the SVG sanitiser whitelist
 
-The sanitiser runs server-side BEFORE the size cap (REQ-RES-009), so an over-permissive whitelist becomes stored XSS the moment a sanitised-looking SVG is rendered back into a logged-in user's browser.
+`lib/Service/SvgSanitiser.php` enforces a deliberately conservative whitelist of allowed SVG element and attribute names (REQ-RES-010 / REQ-RES-011 in `openspec/specs/resource-uploads/spec.md`). Every uploaded SVG is parsed via `DOMDocument` with `LIBXML_NONET | LIBXML_NOENT` and the resulting tree is filtered against `ALLOWED_ELEMENTS` and `ALLOWED_ATTRIBUTES`. Anything not on those lists is removed before persistence, and the persisted bytes (NOT the original) are what subsequently get served back to other users' browsers.
+
+If you propose adding a new element name to `ALLOWED_ELEMENTS` or a new attribute to `ALLOWED_ATTRIBUTES`:
+
+- A security review is required before merge (XSS surface change).
+- Verify the new element / attribute cannot carry executable payloads in any browser SVG renderer (e.g. `<animate>` `attributeName` injection, `<set>` event triggering, etc.).
+- Add a PHPUnit scenario covering the new surface, plus a negative scenario showing that a known-bad construct involving the new name is still rejected.
+- Update REQ-RES-010 / REQ-RES-011 in the canonical spec to reflect the new whitelist size and add the element / attribute name explicitly.
+- The sanitiser runs server-side BEFORE the size cap (REQ-RES-009), so an over-permissive whitelist becomes stored XSS the moment a sanitised-looking SVG is rendered back into a logged-in user's browser.
diff --git a/README.md b/README.md
@@ -12,13 +12,15 @@
   <a href="https://github.com/ConductionNL/mydash/releases"><img src="https://img.shields.io/github/v/release/ConductionNL/mydash" alt="Latest release"></a>
   <a href="https://github.com/ConductionNL/mydash/blob/main/LICENSE"><img src="https://img.shields.io/badge/license-AGPL--3.0-blue" alt="License"></a>
   <a href="https://github.com/ConductionNL/mydash/actions"><img src="https://img.shields.io/github/actions/workflow/status/ConductionNL/mydash/code-quality.yml?label=quality" alt="Code quality"></a>
-  <a href="https://mydash.app"><img src="https://img.shields.io/badge/docs-mydash.app-green" alt="Documentation"></a>
+  <a href="https://mydash.conduction.nl"><img src="https://img.shields.io/badge/docs-mydash.conduction.nl-green" alt="Documentation"></a>
 </p>
 
 ---
 
 MyDash supercharges the Nextcloud dashboard. Create multiple personalized workspaces with drag-and-drop widgets, custom shortcut tiles, and smart visibility rules — then let admins roll out templates to entire teams. It works with every existing Nextcloud dashboard widget out of the box, supporting both the v1 and v2 Dashboard APIs.
 
+📚 **[Step-by-step tutorials](https://mydash.conduction.nl/docs/category/tutorials)** — user + admin walkthroughs with screenshots, kept in sync with the live UI via the [journeydoc](https://github.com/ConductionNL/hydra/blob/development/openspec/architecture/adr-030-journeydoc-pattern.md) capture spec.
+
 ## Screenshots
 
 <table>

diff --git a/appinfo/info.xml b/appinfo/info.xml
@@ -46,7 +46,7 @@ Ideaal voor organisaties die consistente, samengestelde dashboards willen voor h
 
 Vrij en open source onder de EUPL-1.2-licentie.
     ]]></description>
-	<version>1.0.3-unstable.4</version>
+	<version>1.0.4-unstable.0</version>
 	<licence>EUPL-1.2</licence>
 	<author mail="info@conduction.nl" homepage="https://www.conduction.nl/">Conduction</author>
 	<namespace>MyDash</namespace>
@@ -71,11 +71,45 @@ Vrij en open source onder de EUPL-1.2-licentie.
 		<nextcloud min-version="28" max-version="34"/>
 	</dependencies>
 
+	<!-- Surface dashboards, widget content, and metadata in NC unified search. REQ-SRCH-001. -->
+	<types>
+		<search/>
+	</types>
+
+	<background-jobs>
+		<job>OCA\MyDash\BackgroundJob\OrphanedDataCleanupJob</job>
+	</background-jobs>
+
 	<settings>
 		<admin>OCA\MyDash\Settings\MyDashAdmin</admin>
 		<admin-section>OCA\MyDash\Settings\MyDashAdminSection</admin-section>
 	</settings>
 
+	<commands>
+		<!-- REQ-EXIM-010: dashboard export / import via `php occ`. -->
+		<command>OCA\MyDash\Command\ExportCommand</command>
+		<command>OCA\MyDash\Command\ImportCommand</command>
+		<!-- REQ-CFLI-011: Confluence HTML export importer via `php occ`. -->
+		<command>OCA\MyDash\Command\ImportConfluenceCommand</command>
+		<!-- REQ-CLI-001..011: shared `mydash:` CLI suite (cli-commands). -->
+		<command>OCA\MyDash\Command\DashboardListCommand</command>
+		<command>OCA\MyDash\Command\DashboardShowCommand</command>
+		<command>OCA\MyDash\Command\DashboardDeleteCommand</command>
+		<command>OCA\MyDash\Command\DashboardDebugShareCommand</command>
+		<command>OCA\MyDash\Command\UserRevokeFeedTokenCommand</command>
+		<command>OCA\MyDash\Command\I18nExportStringsCommand</command>
+		<command>OCA\MyDash\Command\I18nMigrateLanguageStructureCommand</command>
+		<command>OCA\MyDash\Command\I18nCopyNavigationCommand</command>
+		<!-- REQ-OCLN-001..009: orphaned-data cleanup CLI. -->
+		<command>OCA\MyDash\Command\CleanupScanCommand</command>
+		<command>OCA\MyDash\Command\CleanupPurgeCommand</command>
+		<!-- REQ-DEMO-009: bundled demo showcase install / list. -->
+		<command>OCA\MyDash\Command\DemoShowcasesInstallCommand</command>
+		<command>OCA\MyDash\Command\DemoShowcasesListCommand</command>
+		<!-- REQ-WIZ-010: setup wizard via `php occ mydash:setup`. -->
+		<command>OCA\MyDash\Command\SetupCommand</command>
+	</commands>
+
 	<navigations>
 		<navigation>
 			<name>MyDash</name>
@@ -84,4 +118,11 @@ Vrij en open source onder de EUPL-1.2-licentie.
 			<order>-5</order>
 		</navigation>
 	</navigations>
+
+	<activity>
+		<!-- REQ-ACT-001: register the MyDash Activity provider that
+		     surfaces the 13-event catalogue defined in
+		     OCA\MyDash\Activity\Extension. -->
+		<provider>OCA\MyDash\Activity\Extension</provider>
+	</activity>
 </info>