Skip to content
Merged
Show file tree
Hide file tree
Changes from all commits
Commits
File filter

Filter by extension

Filter by extension

Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
6 changes: 3 additions & 3 deletions .agents/architecture.md
Original file line number Diff line number Diff line change
Expand Up @@ -56,12 +56,12 @@ Task Wizard is a self-hosted, privacy-focused task management application. It is

| Layer | Directory | Purpose |
|-------|-----------|---------|
| HTTP Handlers | `internal/apis/` | REST + CalDAV route handlers |
| HTTP Handlers | `internal/apis/` | REST route handlers |
| Middleware | `internal/middleware/` | JWT auth, scope enforcement |
| Models | `internal/models/` | GORM data models |
| Repositories | `internal/repos/` | Database access layer |
| Services | `internal/services/` | Business logic, scheduler, notifications, housekeeping |
| Utilities | `internal/utils/` | Auth helpers, email, CalDAV parsing, DB setup |
| Utilities | `internal/utils/` | Auth helpers, email, DB setup |
| WebSocket | `internal/ws/` | Real-time push to connected clients |
| Migrations | `internal/migrations/` | Schema versioning |
| Config | `config/` | YAML-based configuration with env var overrides |
Expand All @@ -81,7 +81,7 @@ Task Wizard is a self-hosted, privacy-focused task management application. It is
- **Repository pattern** for data access abstraction
- **Service layer** for business logic separation
- **Dependency injection** (Uber FX) for wiring
- **Scope-based authorization** on API tokens (e.g. `task:read`, `label:write`, `dav:read`)
- **Scope-based authorization** on API tokens (e.g. `task:read`, `label:write`)
Copy link

Copilot AI Mar 21, 2026

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

The scope examples here use task:read / label:write, but the actual scope strings in code are Tasks.Read, Labels.Write, etc. Updating the examples to match the real scope format would prevent confusion for API token users and keep documentation consistent with apiserver/internal/models/user.go.

Suggested change
- **Scope-based authorization** on API tokens (e.g. `task:read`, `label:write`)
- **Scope-based authorization** on API tokens (e.g. `Tasks.Read`, `Labels.Write`)

Copilot uses AI. Check for mistakes.
- **Background scheduler** for notifications, token cleanup, password reset expiration
- **Smart transport** in the frontend — uses WebSocket for real-time updates, HTTP for requests
- **Feature flags** to toggle behaviors like WebSocket transport and auto-refresh
Expand Down
2 changes: 1 addition & 1 deletion .agents/features/api-tokens.md
Original file line number Diff line number Diff line change
Expand Up @@ -5,7 +5,7 @@ Fine-grained access tokens that allow external integrations to interact with Tas
## Capabilities

- Create named API tokens with an expiration date
- Scoped permissions: Tasks.Read, Tasks.Write, Labels.Read, Labels.Write, Dav.Read, Dav.Write, User.Read, User.Write, Tokens.Write
- Scoped permissions: Tasks.Read, Tasks.Write, Labels.Read, Labels.Write, User.Read, User.Write, Tokens.Write
Copy link

Copilot AI Mar 21, 2026

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

This permissions list includes Tokens.Write, but there is no corresponding scope constant or usage in the codebase (only Tasks/Labels/User scopes exist in apiserver/internal/models/user.go). Either remove Tokens.Write from the docs or add the missing scope/support so the documentation matches the implementation.

Suggested change
- Scoped permissions: Tasks.Read, Tasks.Write, Labels.Read, Labels.Write, User.Read, User.Write, Tokens.Write
- Scoped permissions: Tasks.Read, Tasks.Write, Labels.Read, Labels.Write, User.Read, User.Write

Copilot uses AI. Check for mistakes.
- Write scopes automatically include their corresponding read scope
- Tokens are validated the same way as JWT sessions but carry scope restrictions
- List and delete existing tokens from the settings UI
Expand Down
13 changes: 0 additions & 13 deletions .agents/features/caldav.md

This file was deleted.

Loading
Loading