Settings
Theme
Choose how the admin portal looks for your account. The setting is per-user, not global.
Sidebar Footer Logo
Replaces the logo shown at the bottom of the sidebar and the link it opens.
Login Screen
Choose the animated background effect, speed, and accent color shown on the login page.
Open Graph / Link Previews
Controls the title, description, and image other sites show when someone pastes a link to this portal into Slack, iMessage, Facebook, Twitter/X, or similar. Image is served publicly so crawlers can fetch it.
Home Screen Icon (iOS / iPadOS)
Icon and label used when this admin portal (/tspro) is pinned to an iPhone or iPad home screen via Safari's "Add to Home Screen." Independent from the public site's home-screen icon.
Signed in as admin
Two-Factor Authentication
Off
Add a one-time code from an authenticator app (2FAS, Google Authenticator, Aegis, 1Password…) on top of your password for this account.
Two-factor authentication has been turned on for your account.
Set it up below, or turn it off if you'd rather not use it.
1 Scan this QR code in your authenticator app — in 2FAS, tap ＋ → Scan QR code.
Can't scan? Enter this key manually (Time-based, SHA-1, 6 digits):
2 Enter the 6-digit code the app shows to confirm:
Two-factor authentication is protecting this account. You'll be asked for a code from your authenticator each time you sign in.
Save your recovery codes
Each code works once if you lose access to your authenticator. Store them somewhere safe — they won't be shown again.
Permission matrix
Each role's capabilities at a glance. Your row is highlighted.
| Capability | Admin | Editor | Intergroup Member | Viewer |
|---|---|---|---|---|
| View meetings, libraries, files, calendar | ✓ | ✓ | ✓ | ✓ |
| Customize dashboard widgets and order | ✓ | ✓ | ✓ | ✓ |
| Edit existing meetings, locations, schedules, Zoom accounts | ✓ | ✓ | ✓ | — |
| Create new meetings or delete meetings | ✓ | — | ✓ | — |
| Create new libraries / edit library settings (name, description, alert) | ✓ | — | ✓ | — |
| Upload files to existing libraries | ✓ | ✓ | ✓ | — |
| Upload, edit, delete files attached to meetings (any uploader) | ✓ | ✓ | ✓ | — |
| Edit / rename library files (any uploader) | ✓ | ✓* | ✓ | — |
| Delete library files (any uploader) | ✓ | ✓* | ✓ | — |
| Bulk-edit categories / bulk-delete files | ✓ | ✓* | ✓ | — |
| Rename files in the File Browser | ✓ | ✓* | ✓ | — |
| Edit Intergroup-flagged libraries | ✓ | — | ✓ | — |
| Create new Intergroup libraries | ✓ | — | — | — |
| View the Intergroup Email Accounts page | ✓ | — | ✓ | — |
| Edit the Intergroup Email Accounts list | ✓ | — | — | — |
| Edit the Web Frontend (theme, header, nav, footer) | ✓ | — | — | — |
| Manage users, modules, email, security, data | ✓ | — | — | — |
* Editors can rename, edit, delete, or bulk-edit a library file or a File Browser entry only when its uploader was another Editor. Admin-, Intergroup-Member-, and legacy items are protected — an admin or Intergroup Member must change them. Files attached to meetings are unaffected and editable by every editor-tier role regardless of uploader.
Need a different role?
Role assignments are managed by an admin. If your access needs to change, contact an admin via the Need Help? popup.
-
Intergroup module
Show or hide the Intergroup sidebar subsection. When on, the section surfaces the Intergroup Email page (toggled separately below) plus shortcuts to the Intergroup Minutes and Intergroup Documents libraries (when those libraries exist). Editing Documents & Minutes is gated to admins and the new Intergroup Member role; Email Accounts stays admin-only.
-
Intergroup Email Accounts Admin & Intergroup Member only
Show or hide the Email Accounts entry inside the Intergroup subsection. Turn this off to keep Minutes & Documents visible while hiding the Email page. The Email Accounts page itself is hard-gated to admins and Intergroup Members regardless of the role setting below; editing the account list stays admin-only.
-
-
Zoom & Tech Hub
Show or hide the Zoom Tech Training page from the sidebar.
-
Announcements & Events
Show or hide the Announcements & Events module. When off, the sidebar entry disappears and the routes return 404; existing posts are kept and reappear when re-enabled.
-
Stories
Recovery stories — long-form first-person posts at
/storiesand/stories/<slug>. Each story has an author byline, an optional sobriety / story date, a featured image, and a Markdown body. When off, the sidebar entry disappears and the public + admin routes return 404; existing stories are kept and reappear when re-enabled. -
Trusted Servants Email List
Admin-managed contact roster + blast email surface. When on, a sign-up widget appears on every signed-in user's dashboard inviting them to add their name, phone, and email; admins manage the roster and send updates from
/email-list. The role gate below decides who can see the roster and send blasts — every signed-in user can self-subscribe via the dashboard widget regardless. -
Recovery Contacts
Public directory at
/contactlistwhere visitors submit their name, phone, and email. Submissions stay hidden until an admin approves them from the Recovery Contacts sidebar section, where each entry has per-field toggles to show the phone, the email, or both. Bot submissions are blocked by a hidden honeypot plus Cloudflare Turnstile (when configured). The role gate below decides who can review and approve entries. -
Blog
Long-form editorial blog at
/blogand/blog/<slug>, with categories, tags, featured images, author bylines, and Markdown body. Page block can scope a list to a single category or tag — host multiple committee / group blogs from a single Posts table. When off, the sidebar entry disappears and the public + admin routes return 404; existing posts are kept and reappear when re-enabled. -
Web Frontend module
Turn the entire Web Frontend module on or off. When off, the Web Frontend entry disappears from the sidebar, the editor routes are blocked, and the public homepage won't serve. The role gate here only hides/shows the sidebar entry — the underlying editor routes always require admin authority.
Public Domain
Canonical URL used in outbound emails and any other absolute link this portal sends out. Without this set, links fall back to whatever Host header the request carried — which is usually a Docker bridge IP for portals behind a reverse proxy. Save this once and every welcome email / access-request notification picks up the right hostname.
SMTP Server
Used for sending notification emails, including access requests from the login screen.
Send test email
Verifies the SMTP credentials above by sending a test message.
Server Timezone
Determines what the portal calls "today" and "now" — used by the public meetings block and any other time-dependent display. Set this to your fellowship's local timezone, regardless of where the server is hosted.
Zoom One-Time-Passcodes (OTP)
Shared inbox where Zoom sends one-time-password codes. These credentials are shown to users on Online/Hybrid meeting pages so they can retrieve OTP codes when logging into Zoom.
Login Bot Protection
Require a Cloudflare Turnstile challenge on the login screen. Create a site at Cloudflare → Turnstile (widget mode: Managed), add your portal hostname to its domain list, then paste the keys below.
All data
The complete portal — SQLite database, every uploaded file, and the
Fernet key (zoom.key) used to decrypt stored Zoom
credentials. Use this to migrate the whole install or roll back to
a known-good archive.
Import
Replaces this portal's database and uploads with the contents of an
export archive. The current database and uploads are moved to a
timestamped backup-YYYYMMDD-HHMMSS/ folder inside the
data directory before the import is applied. You will be signed out
when the import completes. Type REPLACE to confirm.
Large bundles are sliced into ~90 MB chunks in the browser, so this works behind proxies that cap request bodies at 100 MB (e.g. Cloudflare Free).
Preparing upload…
Reading the selected bundle.
Export
Download a complete archive of this portal — database, uploads, and the Fernet key. Use the Import side on a fresh instance to restore.
Optional: encrypt the bundle with a passphrase (AES-256-GCM,
PBKDF2-derived key). The downloaded file becomes
.zip.enc. The destination needs the same passphrase
to import it. Recommended when transmitting through Cloudflare or
any other TLS-terminating proxy — the edge only sees ciphertext.
Frontend bundle
Just the public frontend — content, navigation (nav items, mega-menu columns and blocks), template choices, colors, alerts, and referenced logos / assets. Use this to drop your frontend into a fresh install without touching users, meetings, libraries, or meeting uploads.
Import frontend
Overwrites all frontend settings, nav items, and referenced assets
with the bundle's contents. Other data (users, meetings, libraries)
is left alone. Type REPLACE to confirm.
Export frontend
Download a scoped .zip containing
frontend.json (settings + nav tree) and an
assets/ folder with every file the frontend references.
Frontend staging sync
Build your public website on a separate Staging copy, then move it to your Live site over the network — no bundle to download and re-upload. This wizard pairs the two installs. Only the frontend travels (presentation, navigation, page-builder Pages, and the assets they use); recovery Stories, users, meetings, and libraries are never touched, and the receiving side auto-saves a rollback snapshot first.
Which install is this?
Staging sync links two installs. Set up your Live site first — it mints the shared token you'll paste into Staging.
Set up your Live site first. Run this wizard on your Live install, choose “This is my Live site”, and copy the token it generates. Once you have that token, continue here.
Create the shared token
This secret lets your Staging copy sync with this Live site. Generate it here, then paste it into Staging.
This Live site is set to receive syncs automatically — nothing else to configure here.
Live site ready ✓
This site will now serve and accept syncs from your Staging copy. To finish, open this wizard on your Staging install, choose “This is my Staging copy”, and give it:
Shared token
This site's address
https://demo.meridianrecovery.example
Paste the token from your Live site
On your Live site you generated a shared token. Paste it here so the two installs match.
Your Live site's address
The address of your Live site — what you'd type in a browser to reach it.
An https:// address is strongly recommended.
Check the connection
Confirm this Staging copy can reach your Live site with the shared token before moving anything.
A failure usually means the Live URL is wrong, the Live site is offline, or the tokens don't match — or the Live site wasn't set up with “This is my Live site”.
Sync the frontend
Each direction overwrites one side and saves a rollback snapshot on the
receiving side first. Type REPLACE to confirm.
Pull Live → here
Overwrites this Staging copy with your Live site's frontend.
Push here → Live
Overwrites your Live site with this Staging copy's frontend.
Off-site backups
Push the full app (database + uploads + Fernet key) to a remote destination on a schedule you control. Local snapshots below protect against accidents — off-site backups protect against disasters that take the whole machine with them.
No off-site targets configured yet.
Database snapshots
One snapshot of tsp.db is taken automatically each day at
app start. The most recent 14 are kept; older ones are pruned. Use
these to roll back from an accidental delete or a broken migration.
No snapshots yet — one will be created on the next app start.
WordPress importer
Pull recovery stories, announcements, or events out of an existing WordPress site. Connect over the WP REST API or upload a posts CSV. The wizard previews exactly what will be created — including slug clashes and image downloads — before anything is saved.
Maps each post (or every post in a category) onto Stories, Announcements, Events, or skip. Featured images are deduplicated by content hash on import.
Trusted Servants Pro
Version 2.14.3
An open-source web app designed to help addiction recovery fellowships maintain shared documents and accounts
Built by
Hyprlab
Hyprlab
Released under the
GNU Affero General Public License v3.0.
Release notes
What's new in each version, in plain English.
-
2.14.3 (latest)Jun 14, 2026 — Fix: non-admins can turn their own two-factor off
- Turning two-factor off now works for every role. Previously, only admins could turn their own two-factor on or off — for other roles the "Turn off two-factor" button silently did nothing, so the setup wizard kept reappearing at each login. Now any user can fully manage two-factor for their own account under Settings → Your Access.
- Small spacing fix on the two-factor setup screen.
-
2.14.2Jun 13, 2026 — Two-factor on/off polish
- Turning two-factor off now clearly shows it's off. The yellow notice and the red "Turn off two-factor" button disappear the moment you switch it off under Settings → Your Access.
- Admins see the change right away. If you turn your own two-factor on or off, the Settings → Users list updates that account's Two-factor toggle to match.
- Clearer wording on the setup screen — two-factor is described as "available for your account" rather than "required," since it's optional and you can skip it.
-
2.14.1Jun 13, 2026 — Turn two-factor on for any account, with a setup wizard
- Admins can switch two-factor on or off for any account from Settings → Users — there's a new Two-factor toggle on each user row (and in the Edit-user dialog). New admin accounts now have it on by default.
- Two-factor works for every role now, not just admins.
- A friendly setup wizard greets people at login. When an account is set to use two-factor but hasn't set it up yet, the next sign-in walks the user through scanning the QR code and confirming a code — then shows their recovery codes. They can Skip for now and set it up later if they prefer.
- Anyone can manage their own two-factor under Settings → Your Access — turn it on, see whether setup is still required, or turn it off (confirming their password first).
-
2.14.0Jun 13, 2026 — Two-factor authentication for admins
- You can now turn on two-factor authentication (2FA) for your admin account. Open Settings → Security → Set up two-factor authentication, scan the QR code with an authenticator app, and enter the 6-digit code to confirm. It works with any standard app — 2FAS, Google Authenticator, Aegis, 1Password, and the rest.
- It's optional and admin-only. Each admin chooses whether to switch it on; other roles never see this step. Once enabled, you'll be asked for a code from your app after entering your password each time you sign in.
- Recovery codes mean you can't get locked out. When you enable 2FA you get ten one-time recovery codes — save them somewhere safe. If you ever lose your phone, any one of them gets you in. You can regenerate a fresh set anytime (you'll confirm your password first).
- Turning it off is protected too. Disabling 2FA or generating new recovery codes asks for your account password first, so nobody can quietly remove the extra protection from a logged-in screen.
-
2.13.2Jun 13, 2026 — Toasts no longer cover the topbar
- Pop-up "Saved" and error messages now appear just below the top bar instead of on top of it, so they no longer hide the buttons in the header while you're working.
-
2.13.1Jun 12, 2026 — A full search results page and a smarter search palette
- There's now a full search results page. When a search turns up more than the quick palette can show, click "See all results" to open a dedicated page listing everything — meetings, libraries and files, announcements and events, stories, blog posts, locations, users, pages, and more. Filter to a single type with one click and sort by Relevance, Name (A–Z / Z–A), or Recently updated.
- Filtering and sorting are instant. Clicking a type or changing the sort updates the results in place — no full page reload, your scroll position stays put, and the browser's Back/Forward buttons work as expected.
- The search palette remembers your last search. Open a result and come back, and the palette still shows what you searched for, so you can jump between results without retyping. A Clear button wipes it (and it clears on its own when you close the window). A new "See all results" button is pinned to the bottom of the palette.
- Cleaner result previews. Search snippets no longer show stray formatting tags from descriptions — just clean, readable text.
-
2.13.0Jun 12, 2026 — A cleaner post editor and a sticky, full-width header
- The announcement / event editor is reorganized and de-cluttered. Fields now flow in a logical order — what the post is (type, title, URL, and when it publishes) → its content → event details → links → images — with Links moved above Images. The old separate "Publishing" card was folded into the top card, the cramped monospaced fields now use the regular Inter font, and the spacing between sections is tighter.
- Pick a featured image and see it right away. Choosing an image now shows the thumbnail instantly, before you save. And clicking "Remove current image" hides the thumbnail on the spot so you can see the change before saving — the removal still only takes effect when you save.
- The "Auto-archive this announcement" control looks like one tidy setting — a single panel with the switch and the date picker together — matching the "Online event" toggle. "Remove current image" is now a clear red pill instead of a stray checkbox.
- The page header bar now stays pinned to the top as you scroll on every admin page, uses the same background as the sidebar, and looks right in dark mode. It also now stretches the full width of the screen to the right edge.
- On phones, the header's buttons are swipeable. Instead of wrapping onto several lines, the action buttons sit in a single row you can swipe left/right.
-
2.12.6Jun 11, 2026 — Shared-account sign-ups & a cleaner Libraries widget
- The Trusted Servants sign-up widget now works for shared accounts. If several people share one portal login, each can add themselves to the email list: the dashboard form always starts blank, never pre-fills or "remembers" the last person, and never offers to remove anyone. Every submission creates its own new entry. Editing and removing entries stays admin-only on the Email List page.
- The Libraries dashboard widget no longer lists Intergroup libraries. It now shows only the regular Libraries-module entries — matching the Libraries page itself. Intergroup-flagged libraries remain in their dedicated Intergroup sidebar section.
-
2.12.5Jun 10, 2026 — Schedule posts, a smarter search, and Users/editor polish
- Schedule announcements & events for the future. In the post editor, set the "Posted on / schedule for" field to a future date & time and Publish — the post stays hidden from the public site until then, then appears automatically. The admin list flags it with a teal "Scheduled ·
" badge, and there's a one-click "Today" button on the date fields. - Exhaustive backend search. Search now finds every post type and state (announcements, events — including drafts, archived, and pending), plus Stories, Blog posts, and page-builder Pages. It also jumps to sections: type "data" or "security" to open that Settings tab, or "branding"/"navigation" to open the matching Web Frontend page — all role-gated so people only see what they're allowed to.
- Users tab: filter, sort, and multi-delete. Type to filter the user list by name/username/email/phone/role, click any column header to sort, and use the new checkboxes to delete several users at once (you can never select yourself).
- Set a custom URL while a post is still a draft. A hand-picked URL now sticks through editing and publishing, so a draft goes live at the right address with no after-the-fact rename or redirect.
- Download a rollback snapshot from Settings too. The "Rollback snapshots" button now also lives on the Settings → Data staging-sync card (with the matching card icon), not just the Web Frontend overview.
- Dashboard is now a button. The sidebar Dashboard link moved into the fixed button cluster at the top, styled like the Notifications and Watchtower buttons.
- No more sideways scrolling on the post editor on phones. Long links and fields no longer overflow the screen.
- Schedule announcements & events for the future. In the post editor, set the "Posted on / schedule for" field to a future date & time and Publish — the post stays hidden from the public site until then, then appears automatically. The admin list flags it with a teal "Scheduled ·
-
2.12.4Jun 9, 2026 — Download a rollback snapshot to undo a sync
- The Staging Sync card now has a "Rollback snapshots" button. Every sync automatically saves a complete rollback bundle of your frontend (including recovery Stories) before it overwrites anything — this opens a popup listing those bundles, newest first, with the date, size, and a one-click Download for each.
- Built-in restore instructions. The popup explains exactly how to put a snapshot back: download the
.zip, then go to Settings → Data → Frontend bundle → Import frontend and import it. The 10 most recent snapshots are kept automatically.
-
2.12.3Jun 9, 2026 — Pull/Push your Live site right from the Web Frontend overview
- On your Staging copy, the Web Frontend overview now has Pull and Push buttons built into its Status card. Once staging sync is set up, you can bring your Live site's frontend down to keep working on it, or send your changes up to Live, in one click — with a live "Connected / Unreachable" check and a last-pulled/pushed timestamp — without ever opening Settings. Each direction asks for a quick second-click confirmation before it overwrites anything.
- It only appears on the Staging copy, never on the Live site — the Live install is the receiver, so there's nothing for it to push or pull.
-
2.12.2Jun 9, 2026 — Staging sync asks which site is Live vs Staging
- The wizard now starts by asking which install this is — your Live site or your Staging copy — and shows only the fields that side needs. Pick “This is my Live site” and it just creates the shared token for you to copy; pick “This is my Staging copy” and it asks for the token, your Live site's address, then a connection test and the Pull/Push controls. No more guessing which boxes to fill on which install.
- You're guided to set up the Live site first. Choosing Staging reminds you to run the wizard on your Live site first and copy the token it generates — so the two installs always end up paired correctly, in the right order.
- The whole setup now happens without the Settings window ever closing. Generating the token, saving, testing, and syncing all complete in place — no page reloads, no being bounced out of Settings mid-step.
- Where to find it: Settings → Data → Frontend staging sync.
-
2.12.1Jun 9, 2026 — A guided setup wizard for frontend staging sync
- Setting up staging sync is now a step-by-step wizard. The old single panel left it unclear which install you were on and which way your website would move. The new wizard walks you through it: an Overview that draws both sites with Push/Pull arrows, Pair token, Peer address, Test, and Sync — one step at a time, with a progress bar across the top you can click to jump around.
- The shared token is easier to copy between the two sites. Step 2 now shows the actual token in a box with a Copy button, so you can paste it into the other install at any time — not just in the one-time message when you first generate it. It also makes clear that both sites must end up with the same token, and that you can start the wizard on either one.
- The Settings window no longer closes on you mid-setup. Generating a token, saving, testing, or running a sync used to bounce you out of Settings and back to the page behind it. It now stays open on Settings → Data, right where you left off — so after you generate a token you're looking straight at it, Copy button ready.
- Where to find it: Settings → Data → Frontend staging sync.
-
2.12.0Jun 8, 2026 — Sync your website's frontend from a dev copy to your live site
- You can now build your public website on a separate copy and push it to your live site over the network. Run a second "staging" install to redesign the site — theme, colors, navigation and mega-menus, layouts, fonts, icons, and your page-builder Pages — then send the finished result to production with one click, instead of downloading a bundle and re-uploading it. It works both ways: Pull brings your live site's current frontend down to the staging copy to start from, and Push sends your changes back up when they're ready.
- Only the frontend moves — nothing else. The look-and-feel, navigation, and Pages (plus every image and file they reference) transfer. Your recovery Stories, users, meetings, libraries, and meeting uploads on the receiving site are left exactly as they were. (Stories are usually submitted or edited on the live site, so a push never touches them.)
- Safe by default. Before either site is overwritten, it automatically saves a complete rollback snapshot of its current frontend — if a sync isn't what you wanted, you can put it back from Settings → Data → Frontend bundle. Each install also has to opt in to being synced ("Allow inbound"), every request is protected by a shared secret token you set on both installs, and repeated bad attempts are rate-limited. Use an
https://address between the two sites. - Where to find it: Settings → Data → Frontend staging sync. Enter the other install's address, paste the same token on both, tick Allow inbound on whichever side should receive, then use Test connection, Pull, or Push.
-
2.11.1Jun 8, 2026 — Hour-of-day charts follow your portal's timezone
- The "when do people visit" and failed-login charts now read in your timezone, not UTC. The Web Frontend visitor metrics' Hour of day chart and Watchtower's Failed logins · last 24 hours chart used to bucket activity by UTC hour, so the busy-hour bars could sit hours off from your fellowship's actual clock. They now follow the timezone set in Settings → Server Timezone, and the charts are labelled with the active zone (e.g.
EDT).
- The "when do people visit" and failed-login charts now read in your timezone, not UTC. The Web Frontend visitor metrics' Hour of day chart and Watchtower's Failed logins · last 24 hours chart used to bucket activity by UTC hour, so the busy-hour bars could sit hours off from your fellowship's actual clock. They now follow the timezone set in Settings → Server Timezone, and the charts are labelled with the active zone (e.g.
-
2.11.0Jun 7, 2026 — Recover a corrupted or locked-out portal from your backup server
- You can now restore from your off-site backup server even when you can't get into the portal. Until now, restoring a backup meant logging into the portal and importing it from the inside — no help at all on the day the portal's data is corrupted, or you're locked out and can't sign in. There's now an out-of-band path: from the TS Pro Backup server's own console (a separate machine you can still reach), pick a stored full backup, paste the site's private key, and it pushes the backup straight back into your portal, which restores itself — no portal login required. Your old data is set aside with a timestamp first, and login lockouts are cleared so you can sign back in right after.
- It's off until you turn it on, per backup target. Because this is a powerful recovery path, it stays disabled until you opt in. On the backup target for your TS Pro Backup server (Settings → Off-site backups → your target → Edit), tick "Allow remote restore" and fill in your portal's public URL. Save or test the connection and it pairs with the backup server automatically — after that, the backup server's console offers a Remote restore button on your full backups. Requires TS Pro Backup 1.3.0 or later.
- Locked down by design. A restore can only be applied if it arrives with both a secret token your portal shared with the backup server and the correct private key — the same key that already encrypts your backups. One without the other is rejected before anything is touched, so a leaked token alone can't be used to overwrite your portal. The backup server never sees your unencrypted data or your private key.
-
2.10.9Jun 5, 2026 — Live notification chips, and a more accurate "who's online"
- The little number badges update on their own now. The attention chips on the left sidebar (Watchtower, Notifications, and the per-section counts) and on your dashboard (Access Requests, Locked Accounts, Off-site Backups, Forms) used to only refresh when you reloaded the page. Now they update themselves every few seconds — when a new access request or form submission comes in, the count just appears and ticks up, and when you clear it, the badge disappears on its own. No more reloading to see what's waiting.
- "Currently Online" is more accurate. The dashboard's online count (and the live "who's online" view in the User Log) was sometimes counting people who'd actually left — a browser quietly refetching an icon in the background could keep someone showing as online, parked on a non-page address like
/site-branding/apple-touch-icon. Now only real page views count, so the online list reflects who's actually using the portal.
-
2.10.8Jun 2, 2026 — Encrypted backups to Dropbox/FTP/SFTP now work on large portals
- Fixed: encrypted off-site backups failing with a "server offline" error. If you turned on archive encryption for an FTP, SFTP, or Dropbox backup, a larger portal could grind for a while and then show a "server offline" error — the encryption step was loading the whole backup into memory at once and running the server out of RAM. Encryption (and decryption on restore) now processes the backup in small pieces, so memory stays low no matter how big your portal is — a multi-gigabyte backup uses the same memory as a tiny one. Backups encrypted before this update still restore normally.
- Fixed: a confusing "connection failed" message in the Dropbox setup wizard. After clicking Test connection (which showed a green OK) and then Continue to schedule, you'd get a red "connection failed" error on the first click and have to click again. That's resolved — the wizard no longer re-uses the single-use Dropbox authorization code, so Continue works the first time.
-
2.10.7Jun 2, 2026 — See your disk space right on the dashboard
- Disk space is now on your dashboard. The Server panel on the dashboard (which already shows CPU, memory, uptime, and who's online) now includes a Disk tile — how full your server's disk is, with the space used and total (e.g. "92 GB / 196 GB"). It tracks the disk that holds your data, uploads, and backups. The tile turns amber when it crosses 85% full — the same point at which the low-space warning kicks in — so you can keep an eye on it at a glance without leaving the dashboard. Shown to admins only.
-
2.10.6Jun 2, 2026 — A real guarantee against a full disk, plus a heads-up before it happens
- Your server now actively keeps its own disk tidy. A small daily housekeeper automatically clears out old, unused Docker images and build leftovers — the stuff that quietly piled up and filled disks before. Unlike the previous auto-cleanup (which only tidied up after automatic updates), this one cleans up everything unused, no matter how it got left behind, so the disk stays under control on its own.
- You'll get a warning before the disk is ever full. When the server's disk passes 85% full, admins now see a clear "Low disk space" banner at the top of every admin page and a matching alert in the Notification Center — with how much space is left and what to do about it. That gives you plenty of runway to act before backups, uploads, or updates could fail. The warning is shown to admins only, and disappears on its own once space is freed.
- Already running an older install? Re-run the installer to adopt the new housekeeper (your data and settings are preserved) — see the README's "Keeping disk usage in check" section.
-
2.10.5Jun 2, 2026 — Keep your server from filling its own disk
- Your server won't quietly fill its own disk anymore. Over many months, an unattended portal could slowly use up all its disk space in two ways — automatic updates kept piling up old, unused copies of the app, and the behind-the-scenes activity logs grew without limit. Once the disk filled, things like off-site backups (and even installing updates) would start failing with "disk full" errors. New installs now automatically clean up old images after each update and keep logs trimmed, so this won't happen.
- Already running an older install? If your disk is filling up, you can clean it up and adopt the new safeguards without reinstalling — the README's new "Keeping disk usage in check" section walks you through it (a couple of
dockercleanup commands, then re-running the installer to refresh your setup). Your data and settings are preserved. - This release changes only the deployment setup and documentation — the app itself is unchanged from 2.10.4.
-
2.10.4Jun 2, 2026 — Fix: off-site backups failing with "disk is full"
- Fixed: off-site backups failing with a "database or disk is full" error. On some servers, clicking Run Now (or a scheduled run) on any off-site backup — TS Pro Backup, Dropbox, FTP, or SFTP — could fail with an internal server error mentioning "database or disk is full," even though the server had plenty of room. The cause was that the app built each backup in the system's small scratch area (
/tmp) rather than next to your actual data; once a site's backup grew past what that scratch area could hold, the backup couldn't be assembled. Backups are now built on the same disk that holds your data — which always has the space — so this no longer happens. Advanced operators can point the scratch space at a dedicated disk with the newTSP_TMP_DIRsetting.
- Fixed: off-site backups failing with a "database or disk is full" error. On some servers, clicking Run Now (or a scheduled run) on any off-site backup — TS Pro Backup, Dropbox, FTP, or SFTP — could fail with an internal server error mentioning "database or disk is full," even though the server had plenty of room. The cause was that the app built each backup in the system's small scratch area (
-
2.10.3Jun 2, 2026 — Configurable page backgrounds + clearer, friendlier backups
- Pick the background for your Contact and Recovery Contacts pages. These two pages used to have a fixed animated background baked in. Now they use the same Dynamic Background picker as the rest of your site — open Settings → Web Frontend → Templates, find the Contact or Recovery Contacts page, and choose any pattern, colours, or texture in its Customize panel. They look exactly as before until you change them, so nothing moves unless you want it to. (The Join the Chat page was already adjustable this way.)
- See at a glance what each backup is. On Off-site Backups → Manage, every configured destination now wears a clear, colour-coded label — TS Pro Backup, SFTP, FTP/FTPS, or Dropbox — right next to its status, instead of a tiny grey code.
- A cleaner, friendlier backup-connection editor. Editing a backup destination now opens with a bold banner showing exactly what kind of connection it is, and the fields are larger and fill the width so long addresses and keys are easy to read and edit.
- Fixed: backups that were stuck saying "Running" forever. If the app restarted while a backup was mid-upload — for example during an update, or partway through an overnight scheduled run — that backup could keep showing "Running" even though nothing was actually happening. The app now tidies these up automatically on startup, marking the interrupted backup as failed so your status is always accurate.
- Tidy-up: the WordPress importer moved to the bottom of Settings → Data, below the everyday backup and export tools, since it's a one-time setup helper.
-
2.10.2Jun 1, 2026 — End-to-end-encrypted off-site backups + clearer Watchtower
- A new, private off-site backup option: TS Pro Backup. Alongside FTP/FTPS, SFTP, and Dropbox, you can now send your backups to a dedicated TS Pro Backup server — and they're end-to-end encrypted. Each backup is scrambled on your portal, using a key the backup server hands out, before it ever leaves; the backup server only ever holds a locked copy it can't open. You keep the matching private key (shown once when your site is created in the backup server's console), and it's the only thing that can unlock a backup — so even the backup host can't read your data. The setup wizard walks you through it: paste the server address and your site's API key, click Test connection, and it shows a short "fingerprint" of your encryption key so you can confirm it matches what the backup server displays.
- Restoring is just as private. On a TS Pro Backup target's Restore page you paste your private key to unlock and restore an archive — the key is used right there and never uploaded. And if you ever need to recover the hard way, you can download the encrypted file from the backup server and import it directly under Settings → Import by pasting the same private key. Your existing passphrase-based encrypted backups keep working exactly as before.
- Fixed: "Run now" (and the wizard's first backup) no longer shows an error after a successful run. A timing issue could make a backup that actually succeeded report a server error instead of its real result. It now reports the true outcome every time.
-
2.10.2Watchtower also tells you which tab needs attention
- The Watchtower attention count now points you to the right place. The shield button in the sidebar has long shown a little number when something needs a look — flagged Recovery Contacts requests, pending access requests, or locked-out accounts — but once you opened Watchtower it didn't say which section that number was about. Now each of Watchtower's tabs carries its own coloured chip (red on Overview for flagged Recovery Contacts, amber on Requests for pending access requests, blue on Access for locked accounts), so you can see at a glance where to go.
- A new "Needs attention" panel at the top of the Watchtower Overview. It lists each thing that needs you — with a short description and a count — and every row is a link that takes you straight to the section that handles it. When there's nothing outstanding it simply says "All clear."
-
2.10.1May 31, 2026 — Know at a glance whether your email relay is connected
- A connection check for the API relay, right where you set it up. Under Settings → Domain / Email, the API-relay option now shows a status pill — Connected, Not connected, or Not tested — next to a Test connection button. Click it after pasting in your relay's address and API key and the portal checks, without sending an email, that the relay is reachable and that the key is accepted — so you can confirm everything's right before you save. If something's off, it tells you why (a rejected key, an unreachable address, and so on). Each time you open the tab it re-checks, so the pill always reflects the live connection.
- For the full check, update the companion relay to v0.1.1 or newer (pull
hyprlab/tspro-relay:latest). On an older relay the portal still validates your API key — it just notes that the relay should be updated to report its own status.
-
2.10.0May 30, 2026 — Send email even where outbound SMTP is blocked
- A new "API relay" sending option, alongside the existing direct-SMTP path. Some hosts — DigitalOcean droplets are the classic example — block the outbound ports email normally uses, so the portal simply couldn't send mail there. Now it can: under Settings → Domain / Email, switch Sending method to API relay (HTTPS), paste in your relay's address and API key, and the portal hands each message to a small companion service over the web, which does the actual sending. Your mail-server password lives only on the relay, never copied into the app. Prefer the old way? Direct SMTP is still right there and unchanged — the SMTP fields even tuck away when you're in relay mode so the screen only shows what you need. A Send Test button confirms whichever method you picked.
- The companion relay is its own one-click install. It's published separately as
hyprlab/tspro-relayand comes with its own simple sign-in dashboard where you set the mail-server details, copy the API key, watch a log of everything sent, and optionally turn on a bot challenge for its login. - Seamless upgrade. Existing sites that send over SMTP keep working exactly as before — the new settings are added automatically on first start, and you only see the relay option if you go looking for it.
-
2.9.5May 30, 2026 — Guided Zoom launcher + automatic OTP-code retrieval
- A step-by-step "Launch Zoom Meeting (Guided)" wizard on the meeting detail page. New to hosting? Online and hybrid meetings now have a guided launcher (a focused, blur-the-background popup) that walks a trusted servant through opening Zoom: (1) Sign in — reminds you to host from a Mac/Windows/Linux computer (not a phone, tablet, or Chromebook) and shows the assigned Zoom account's login with one-click copy; (2) Get the code — reminds you to choose "Verify via one-time passcode" (not "Allow on other devices") and fetches the latest sign-in code for you (see below); (3) Start — a big Launch button plus the Meeting ID and passcode to copy, and a reminder to sign out of any other Zoom account in your browser first. Each step has a screenshot you can click to enlarge, and you can jump between steps with the numbered circles at the top.
- The app can now retrieve the Zoom one-time passcode for you, automatically. Add your OTP inbox's IMAP details once under Settings → Security → Zoom One-Time-Passcodes (OTP), and a Retrieve latest code button appears in the wizard, on the meeting's passcode section, and on the Zoom Accounts page. Click it and the system keeps checking the inbox for up to 3 minutes (with a spinner) until the code arrives — it may take up to a minute for Zoom to send it. The newest code is shown with a timestamp and a live countdown to expiry (Zoom codes last 10 minutes from when they're sent), so you can see at a glance how long you have to enter it. Only codes from the last 10 minutes count, and if several arrive you always get the newest. (Your webmail login is still shown as a fallback.)
- Meeting detail page tidied up. The Zoom details now live in their own card on the right, the Schedule and Location each sit in a clean card, and the Location shows the full address with an Open in Maps button (it even matches a saved location through a small typo).
- Fixed: the live-meeting badge's background poller no longer skews your visitor metrics. The
/api/live-meetingcheck the public site makes every 30 seconds was being counted as page views, padding your totals and showing up in Top Paths. It's now excluded from visitor metrics entirely — both new hits and any already-recorded ones — so your numbers reflect real visits.
-
2.9.4May 29, 2026 — Dynamic-background picker overhaul + mobile polish
- The Dynamic Background picker is reorganised into Background + Options tabs with a live preview that repaints as you change presets, overlays, colours, and pastel strength — so you can see exactly what you'll get before saving. Each preset only shows the knobs that apply to it.
- More control over backgrounds: per-preset sliders (dot size/spacing/rotation, line angle/thickness, etc.), a Scale + Intensity slider on every texture overlay, and real foreground/background colours for the dotted-grid and diagonal-lines patterns.
- Retired the Starfield, Noise paper, and Spotlight glow base backgrounds (the six texture overlays are unaffected; any surface using a retired preset falls back to its solid colour / image).
- Mobile polish (Recovery Blue): the header now stays fully sticky on phones, the hamburger menu slides open with a smooth animation, the swipe utility bar no longer peeks the next item at rest, and the signed-in footer auth buttons left-align and wrap cleanly.
-
2.9.3May 28, 2026 — Card body preview controls + "Read more" links on list templates
- New setting on the announcements and events list templates: pick how much of each post's body shows on the card. Web Frontend → Templates → Customize panel on either list template now has a Card body preview control with two modes: Full body (renders the entire body on each card) or Truncated body capped at a character count you set (50–2000, default 200). The character input is greyed out unless truncated is selected. Announcements default to full (no change for existing sites); events default to truncated 200 chars (events now show their body alongside the existing summary line, capped so cards stay compact).
- "Read more ›" link added to every announcement and event card. Every card in the announcements list and every card-shaped event card (Cards layout, Magazine "More events" tiles, Timeline cards) now ships with a Read more link pointing at the post's detail page. The link is shown regardless of body length or truncation setting — the title is still the primary affordance, this is the explicit secondary call-to-action. Magazine hero events keep their existing "View event" primary button; Calendar view has no cards (chips + list) so it's unchanged.
-
2.9.2May 28, 2026 — Pastel strength slider, themed image elevation, detail-page polish
- Dynamic background pastel intensity is now a slider, not a toggle. Pull the slider in the Dynamic Background picker between 0 and 100 to dial how soft your light-mode palette gets — at 0 the colours stay fully saturated, at 100 they land in true cream / blush / mint pastels. Old saves that had the checkbox on still load with full strength. The strength-100 endpoint was also rebalanced to be visibly paler than the previous all-or-nothing setting, so even a maxed slider reads as a soft wash rather than a punchy tinted block.
- Featured images on announcement, event, and archive detail pages now elevate with a themed shadow. A clearly visible
lgshadow sits behind the image at rest and expands to anxlshadow on hover, with the shadow colour automatically following whatever you set under Design → Card shadow colour — change the theme tint and the image shadow retints to match. The border that used to outline the image is gone, the hover lift is dropped (the shadow alone does the work, no jumping), and the transition runs a flat 200 ms. - Detail-page layout reshaped for better balance. The featured-image column on announcement / event / archive detail pages (Classic layout) is now 33 % of the page width and the body column is 66 %, with the image height following the column width instead of being pinned to a fixed pixel value. Reads cleaner on wide screens where the previous fixed-width cover used to feel cramped next to a long body.
- Meeting detail logo bumped to 240 px on desktop (was 180 px) across all four meeting-detail layouts (classic, card stack, magazine, minimal). Mobile keeps the existing narrower size so it still fits below 600 px wide.
-
2.9.1May 28, 2026 — Dynamic-background picker layering + phantom "online" users fix
- Fixed: the Dynamic Background picker opened behind the modal that launched it on the frontend templates page. The picker is a shared body-level dialog and was getting stacked under the template-edit modal (which is appended at runtime). The picker (along with the global media + icon pickers) now layers cleanly on top of any content modal that triggered it.
- Fixed: users appeared "persistently online" on
/api/live-meeting. The utility bar polls that endpoint every 30 seconds when the live-meeting badge is enabled, and the online-users tracker was treating each poll as a real page view — pinning the user's last-seen location to/api/live-meetingforever. Background polls on any/api/*endpoint are now skipped, so the Currently Online widget reflects actual navigation again. After deploying, lingering phantom-online users should drop off within your usual idle cutoff.
-
2.9.0May 28, 2026 — Page drafts, edit history, and a live-updating preview
- Save pages as drafts without publishing. Already-published pages can now stash in-progress edits in a draft slot without touching the live page. The yellow save bar in the page editor now has two buttons — Save Draft and Publish — so it's always clear what's about to happen, and an amber banner appears at the top whenever you're editing draft content. When a draft is loaded, a top-of-screen Publish draft button lets you push it live without having to make a fake edit first to expose the save bar. The pages list shows an "Unpublished changes" chip on any row that has a stashed draft.
- Full edit history with one-click rollback. Every Save Draft and Publish is recorded — up to the last 50 entries per page. A new History button on the page editor opens a chronological list (newest first) with Draft / Published chips, timestamps, and the author of each save. Clicking Restore loads any past revision back into a draft for review; your live page stays unchanged until you click Publish, so rollbacks are always safe to preview before committing.
- Live preview that actually updates as you type. The Preview window on the page editor now updates itself silently as you keep editing — no new popup, no focus stealing, no flicker. Open Preview once and keep editing; the preview tab quietly re-renders in place every ~700ms (with scroll position preserved across each update) so you can watch your changes flow through in near real time.
- Fixed: two-column containers used to scramble blocks across columns on save. A common report — putting two blocks in the left column and three in the right of a two-column container, hitting Save, and watching the last right-column block jump to the left — is gone. Columns now save exactly the way you arranged them in the editor, even when the two sides have different numbers of blocks.
- Unplaced blocks bin is readable again. Block pills parked in the Unplaced bin on the page builder now have proper cards with their own background, icon, and a clear gap between them, so the bin reads as a stack of distinct items instead of a wall of text.
- Polish. Status chips on the Pages list no longer collide when a row has both a visibility chip and an "Unpublished changes" chip — they wrap with breathing room. The Save Draft button in the yellow save bar now uses the same brown as the Publish button for its text and outline, so the two read as a matched pair.
-
2.8.3May 28, 2026 — Live-update content-page preview + markdown lists + SVG image scaling
- Content-page Preview now updates live. Open the preview tab once and keep editing — the preview reloads automatically (debounced) every time you change a block, no need to keep clicking Preview. The preview window remembers your scroll position across reloads so you stay in the spot you were inspecting. Nothing gets saved to the live page until you hit Save — the preview is purely a render of your current, in-progress edits.
- Markdown lists in announcement and meeting bodies render properly. Typing
intro line⏎- itemdirectly under a paragraph now renders as a real bulleted list on the public site (announcement detail pages, event detail pages, and all four meeting-detail templates). Previously you had to remember to leave a blank line before the-for the list to render; the field now handles that for you. - SVG image blocks now respect the width setting. An SVG dropped into an image block was sometimes capping at its source file's intrinsic size instead of scaling up to the chosen width — particularly inside flex containers with centered alignment. SVGs now scale up to fill the percentage you picked (50%, 80%, 100%, etc.) regardless of the source file's pixel dimensions, while raster images keep their existing "don't upscale past natural size" behaviour.
- Unplaced blocks bin reads more cleanly. Pills in the Unplaced bin on the page builder now stack vertically with the same tint and spacing as placed blocks, instead of wrapping into a horizontal row with a different background — easier to scan and to drag back into the active layout.
-
2.8.2May 26, 2026 — Visitor metrics export + timezone fix for events
- Export visitor metrics to CSV. A new Export CSV button on Watchtower → Visitors downloads everything in the current window — daily traffic, top paths, top referrers, devices/browsers/OS breakdowns — in one spreadsheet-friendly file. The export respects whichever Unique visitors / Hits mode you have selected so the numbers match what's on the page.
- Tooltips and chart polish on Watchtower → Visitors. Hovering any bar in the daily-traffic chart now shows the exact count and date in a small tooltip. The legend on the chart is back to the right side, the Devices/Browsers/Operating systems donut grid lines up cleanly on every screen width, and hover states on the donut slices show the full breakdown.
- Fixed: events were sometimes auto-archiving on the wrong day. The "cut off past events" sweep was using server-clock UTC instead of your fellowship's configured timezone, so an event ending at, say, 9 pm Pacific would either disappear early (UTC was already on the next day) or hang around in the live list past midnight local. The sweep now compares against site-local time, so events drop off at midnight in your timezone — same as you'd expect.
-
2.8.1May 26, 2026 — See who's hitting 404s and block them in one click
- The 404s tab now shows who's actually hitting each dead URL. Every row in Top missing URLs has a small "route" icon that opens an inline panel listing the IP addresses hitting that URL, how many times each, and when they last tried. The Recent 404s table got a Source IP column too.
- One-click block. Beside each IP — both in the inline panel and in the Recent 404s table — there's a Block button that adds the IP to your Watchtower blocklist permanently. The ban reason auto-fills with the 404 path so it's obvious in the log later why you blocked them. Already-blocked IPs show a red "Blocked" chip instead of the button.
- New 404s capture the IP automatically — older entries (from before this update) show "—" in the IP column.
-
2.8.0May 26, 2026 — Cookie Compliance + unified Watchtower visitor metrics
- New: Cookie Compliance module under Web Frontend → Setup. Turn it on with a single toggle and the public site shows a privacy banner until visitors make a choice — their answer is remembered in their browser for a year by default.
- Three quick-start presets you can apply with one click: GDPR / UK GDPR, CCPA / CPRA (California), or Generic notice — each one sets best-practice defaults for the prompt mode, wording, and position.
- Three prompt modes to choose: Notice (just a heads-up), Consent (Accept / Reject buttons), or Strict opt-in (the GDPR-compliant version).
- Auto-adapt to visitor region. When on, EU/UK visitors automatically see the strict GDPR flow and California visitors see the CCPA flow — your chosen mode is the minimum; auto only escalates.
- Generate a starter privacy policy in one click. Pick GDPR, CCPA, or Generic and a fresh policy page is created and linked as your privacy policy — you just need to fill in a few placeholders (organisation name, contact email, retention periods) before publishing.
- Banner copy is fully editable: title, body, button labels, position (bottom bar, corner, or modal).
- New: Privacy & cookies footer block — drag it into your footer from the builder palette. It adds a "Privacy policy" link plus a "Cookie settings" button visitors can click any time to revisit their cookie choice.
- Visitor metrics moved to Watchtower. The Web Frontend "Visitor Metrics" page has been folded into the Watchtower → Visitors tab — same charts, same data, one place. The old URL still works (it just redirects), and every link that used to point there now goes to Watchtower.
- Unique visitors is now the default headline number on the visitor metrics tab, with a clear pill toggle to flip to "Hits" (every page load). The choice sticks in your browser. The dashboard widgets that show traffic also lead with unique visitors now — more useful for "how many real people".
- Fixed: the Web / View / Watchtower pills at the top of the sidebar no longer get an underline when you hover them.
-
2.7.5May 26, 2026 — Turn 404s into redirects without leaving the page
- The 404s tab can now create redirects in one click. Beside every row in Top missing URLs and Recent 404s, a Redirect button opens a small dialog already filled in with the missing URL — just type the destination and save. The row instantly shows a green "redirected" chip so you know which ones you've handled, and you can keep working through the list without ever leaving the page.
- Wildcard redirects. Source paths ending in
/*(e.g./swag/*) now match every URL under that prefix and land them all on the same target. Exact-match rules always win, and the matcher is boundary-safe (so/swag/*doesn't accidentally catch/swagger). The dialog has a Use/*helper that turns the clicked 404 into a parent-prefix wildcard for you. - Show more 404s at once. The Top missing URLs and Top referrers cards (on both the 404s and Visitors tabs) now show 30 rows by default and have a Show 30 more button to keep expanding — handy when you've got a long tail of broken links to triage.
- Fixed: the Hour of day chart on Watchtower → Visitors was rendering as 24 flat lines even when there was real traffic — it now shows the actual bar heights again. Hour labels now appear under every column, not just every fourth.
-
2.7.4May 26, 2026 — Recovery Contacts page styling + save-bar tidy-up
- Style the Recovery Contacts page from the Templates screen. The public
/contactlistpage now shows up in Web Frontend → Templates like every other page, with its own appearance controls: heading, subheading, intro, container width, and the background/fonts/sizes Customize panel. These moved out of the Forms settings, which now focus on the form's plumbing — on/off, email alerts, button label, confirmation message, and bot protection. - One save bar, not two. Editing a template in its pop-up no longer shows a duplicate "Unsaved changes" bar inside the dialog — you'll just see the usual yellow save bar at the bottom of the screen, and the dialog stays open after you save.
- Fixed: the "Contact us" button on the Recovery Contacts page no longer gets underlined when you hover over it.
- Tidied: a little more space between paragraphs in the announcement cards on the Announcements page.
- Style the Recovery Contacts page from the Templates screen. The public
-
2.7.3May 25, 2026 — Phone formatting + a contact call-to-action
- Phone numbers look tidy automatically. On the Recovery Contacts directory (and its PDF), numbers are formatted as you'd expect —
202-555-0100for US/Canada (or1-202-555-0100), and the correct international style for numbers from other countries. People can still type however they like; only the display is cleaned up. - A "Contact us" prompt on the Recovery Contacts page — a short line (pulled from your Contact page settings) and a button that takes visitors to your contact form. On phones it appears neatly at the bottom of the page, below the sign-up form.
- Fixed: on phones, the utility-bar buttons (like "Print List" and "Contact List") no longer wrap onto two lines.
- Phone numbers look tidy automatically. On the Recovery Contacts directory (and its PDF), numbers are formatted as you'd expect —
-
2.7.2May 25, 2026 — Small refinements
- The signed-in admin button in your menus and footer now reads "Return to dashboard" (instead of "Back to TS Pro dashboard").
- Tidier spacing between the two email-alert switches on the Recovery Contacts form settings, and clearer wording confirming the admin is emailed about a removal only after the person clicks their confirmation link — so a bad actor can never get someone taken off the list.
-
2.7.1May 25, 2026 — Recovery Contacts: abuse protection + polish
Builds on the new Recovery Contacts directory with protection against malicious "update" and "remove" requests, plus a round of refinements.
- No more spammed listing owners. Someone can only request an update to a listing once every 24 hours — a second attempt is turned away and never applied. The form now tells people about this limit.
- "I didn't submit this." Every update/removal confirmation email now has a second link for the listing's owner to click if they didn't make the request. One click throws the request away and locks that listing against any changes for 7 days.
- A new Watchtower view. Flagged requests show up on the Watchtower Overview with the requestor's IP address and one-click Block IP + Resolve buttons, a red alert badge on the Watchtower button so you notice right away, and Flagged / Locked markers on the affected listings in the Recovery Contacts page.
- Form refinements: the "let people contact me by email through the site" option is now on by default (and stays on automatically if someone hides both their phone and email), a "Need help?" link sits at the bottom of the form, and the layout/copy got small clarity tweaks.
- PDF: listings reachable only through the site now print a tidy, clickable link to your contact page (the printed text drops the
https://but the link still works). - Fixed: the directory's live search now properly hides the entries that don't match what you've typed.
-
2.7.0May 25, 2026 — Recovery Contacts: a self-service member directory
A new Recovery Contacts module lets members add themselves to a shared directory and reach each other directly — turn it on under Web Frontend → Forms → Recovery Contacts. Once enabled, your public page lives at
/contactlistand you manage entries under Recovery Contacts in the dashboard.- Members add themselves. A simple form takes their name, phone, and email, and they choose exactly what shows publicly — phone, email, both, or neither. You approve each entry before it appears, and can adjust anyone's visibility later.
- "Available to sponsor" puts a red-heart badge on a listing so people looking for a sponsor can find them at a glance.
- Stay reachable without exposing your details. Members can switch on a Contact me button — visitors send them a message through the site and the email is relayed privately (the member's address is never shown, and they can just hit reply). It's on by default, and it's kept on automatically for anyone who hides both their phone and email, so there's always a way to reach them.
- Self-service updates and removals. When a member updates their listing or asks to be removed, we email them a confirmation link; one click applies the change automatically — no admin action needed. (You can still action requests yourself from the dashboard if someone never clicks.)
- Find anyone fast. Live search filters the list as you type — by name, phone, or email — and you can type "sponsor" to show only members available to sponsor.
- Print or share a PDF. One click downloads a clean, branded PDF of the directory (it respects whatever you've searched for). Members who are reachable only through the site show a note pointing to your
/contactlistpage instead of a blank phone/email. - A full activity log. The dashboard keeps an audit trail of everything — new entries, confirmed updates and removals, relayed "Contact me" messages, and every admin action — each with who did it and when.
- Plus: a pending-count badge in the sidebar, an entry in your dashboard Forms widget, optional email alerts when someone joins or asks to be removed, and built-in bot protection (Turnstile).
-
2.6.1May 24, 2026 — Neobrutal theme
A bold new Neobrutal theme joins the lineup under Web Frontend → Design → Theme.
- Neobrutalism, done properly: colourful flat blocks (yellow, pink, cyan, lime), thick black borders, chunky hard drop-shadows, big Archivo Black headings, and buttons that visibly press in when you click them.
- It styles your whole site — header, menus, homepage, footer, every page — in both light and dark. In dark mode the page goes near-black while the bright cards keep popping.
- The hero gets a geometric backdrop — a faint grid with bold outlined shapes — and those shapes re-scatter to new spots on every page refresh, so the homepage feels alive without ever covering your headline.
Also fixed: the Neobrutal footer's location cards no longer turn black on hover.
-
2.6.0May 24, 2026 — New site themes + a deeper dark-mode toolkit
Your public site gains four new ready-made themes plus much finer control over dark mode and the mega menu.
- Four new themes under Web Frontend → Design → Theme, alongside Classic and Recovery Blue — each styles your whole site (header, menus, homepage, footer, every page) in both light and dark:
- Modern Dark — a sleek deep-indigo "mission control" look with a soft aurora glow and teal/cyan buttons.
- Cyberpunk — a neon-grid, near-black look in cyan/magenta with sharp edges and a techno typeface.
- Sanctuary — a warm, calm sand-and-sage palette with a friendly serif.
- Terminal — a green-on-black, all-monospace "command line" look with a blinking cursor.
- Themes remember their settings. When you switch themes, the one you're leaving is saved automatically and the one you return to comes back exactly how you left it. The theme switcher now lets you choose Return to last saved state or Reset to default before applying — and those buttons stay visible no matter how far you scroll the theme list.
- The mega menu, leveled up (Web Frontend → Navigation → Mega menu appearance):
- Give it a dynamic background — the same animated backdrops you can already use on the hero and pages.
- Set separate background and text colours for light and dark mode.
- A blend slider mixes between your background colour and the dynamic background.
- A “Render dark in light mode” switch keeps a dark panel behind light text.
- Its headings, links, and buttons now all follow your chosen text colour.
- New “Text — Darkmode” colour on the Design page sets your site's dark-mode text everywhere at once.
- Recovery Blue now has a frosted-glass header and frosted footer cards.
- Plus a long list of dark-mode polish so colours stay consistent across cards, menus, buttons, and the homepage in every theme.
-
2.5.0May 22, 2026 — Popups you build like a page
You can now create popups — modal windows that appear over your public site — using the same drag-and-drop builder you already use for pages.
- Find them under Web Frontend → Popups. Click New popup, give it a name, and you land in the familiar builder: the same draggable blocks and the blue “Add block” button as the page editor. Drop in text, headings, images, buttons, columns, and more.
- Style each popup: width and max width, auto or fixed height, padding, background colour (with a separate dark-mode colour), corner radius, and shadow. Dim the page behind it with an adjustable backdrop, and place it in the centre, at the top, or at the bottom.
- Control where it shows: turn it on or off for desktop and mobile independently, and let it fill the screen width on phones.
- Open it from anywhere: point any link or button at
#yourpopupname— a navigation link, a button on a page, or even a shared URL ending in#yourpopupname. You can also have a popup open automatically a few seconds after the page loads. - Preview before going live: each popup has a Preview button that opens it for you even while it's disabled, so you can get it right before anyone else sees it. Visitors can close it with the × button, by clicking the dimmed background, or by pressing Escape.
Also fixed: the public home page no longer shows an error in the rare case where no homepage has been chosen yet — it now shows a friendly placeholder (and a shortcut to pick a homepage if you're signed in).
-
2.4.0May 21, 2026 — Live meeting bar updates on its own
The LIVE meeting badge at the top of your public site now appears and disappears automatically, without anyone needing to refresh the page.
- When an online or hybrid meeting reaches its start (or Zoom-opens) time, the yellow LIVE:
badge — with its Join Zoom Meeting button — slides in for everyone currently on the site, and clears itself when the meeting ends. Previously a visitor only saw it if they happened to load the page during the meeting. - It checks for changes every 30 seconds (and the moment someone switches back to your tab), so the bar always reflects what's live right now.
- On desktop, any "Helpline"-style grouped item still tucks into its compact icon while a meeting is live to give the live message room — now correctly, whether the meeting was already live when the page loaded or went live while the visitor was reading.
No setup needed beyond the existing utility-bar settings: keep the bar enabled and the live-meeting badge turned on.
- When an online or hybrid meeting reaches its start (or Zoom-opens) time, the yellow LIVE:
-
2.3.0May 21, 2026 — Image & asset caching for a faster public site
Your public site now lets returning visitors keep images and styling in their browser cache instead of re-downloading everything on every visit — so pages load noticeably faster the second time around — without ever showing stale content.
- New Caching panel under Web Frontend → Caching. Turn image caching on/off, choose how long browsers may keep images (default 7 days), and manage everything from one place.
- Edits still appear instantly. Every image has a hidden version stamp; when you upload or replace an image, the stamp changes and visitors get the new image right away — no waiting for the cache to expire.
- Your CSS/JavaScript are cached too, and refresh automatically on every update you deploy, so visitors are never stuck on old styling.
- One-click controls: Clear image cache now forces every visitor to refetch images on their next visit (handy after a bulk change), and Rebuild thumbnails clears the generated thumbnail files. The panel also shows the current cache version, when it was last cleared, and how much thumbnail data is on disk.
- Nothing dynamic is affected — pages, the live-meeting bar, forms, search, and the admin area always render fresh. Only images and static styling are cached.
- Caching is on by default, so you get the speed-up immediately; flip the toggle off any time if you'd rather not cache.
-
2.2.2May 21, 2026 — Frontend backups capture more, dashboard polish
Two improvements:
- Frontend backups are now complete. A frontend bundle now includes each page's social-share settings (the Open Graph title, description, and image you set per page) and each story's publication date. Previously these were quietly left out, so importing a bundle on another install lost the social cards and reset story dates to the import day. Importing an older bundle still works — the new fields just fall back to defaults. (The full-site backup already captured everything.)
- Dashboard & sidebar polish. The drag handles on the Your role, Currently online, and Access requests widgets now match the size, spacing, and position of every other widget's handle. In the sidebar, the Watchtower icon is slightly larger, the Notifications/Search spacing is tidied, and the Web button now shows the same green pulsing dot as the Currently online panel when your public site is live.
-
2.2.1May 20, 2026 — Footer builder now matches the page builder
The Footer admin has been rebuilt to work exactly like the content-page / homepage builder, instead of its own separate interface:
- A Footer structure card lets you arrange footer blocks into rows and columns with drag-and-drop, click any block to edit its content, add blocks from a palette, and add rows (1–4 columns) — the same flow you already use for pages.
- The bespoke "Save Footer" button is replaced by the familiar sticky save bar that appears when you have unsaved changes.
- Everything you could put in the footer before is still here (brand, link columns, social icons, secondary nav, copyright, meeting locations, contact section, dividers, etc.) — just edited consistently with the rest of the site.
-
2.2.0May 20, 2026 — Preview frontend pages before publishing
You can now preview content pages and the homepage before they go live:
- In the page editor, a new Preview ↗ button opens a new tab showing your current, unsaved changes exactly as the public site would render them — so you can check your work before hitting Save. The live page doesn't change until you Save.
- In Frontend → Pages, every page now has a Preview link. This works for draft pages too, which previously couldn't be viewed at all until published.
- Previews are visible only to signed-in admins/editors (never the public) and carry a clear banner so you always know you're looking at a preview, not the live page.
-
2.1.35May 20, 2026 — WordPress importer: custom-field mapping + large-site chunked import
Two big upgrades to the WordPress importer, plus a small polish:
- Map your custom fields to any post type. A new Map fields step in the import wizard discovers the custom fields actually present on the WordPress site you connect to, then lets you map each one onto the matching field for every post type you're importing into — events/announcements (start & end times, location, contact, Zoom, website), stories (author, bio, story date, clean/sobriety date), and blog. Smart defaults are pre-filled from field-name detection, and your mapping is saved per site so re-imports remember it. Custom-field mapping now works for every post type, not just events.
- Import sites with more than 500 posts. The old 500-post cap is gone. Large sites now import in chunks automatically — a progress bar advances through the batches so the import can't time out, and posts already imported are safe even if you close the tab. The initial fetch tops out at 3,000 posts; for more, narrow by date on the WordPress side and run again.
- The dry-run "Ready to import" bar is now a sticky footer pinned to the bottom of the window, so the Run-import button stays in reach while you scroll the preview.
-
2.1.34May 20, 2026 — Notifications Center
A new Notifications button in the sidebar (just above Search) gathers everything that needs your attention into one place, with a live count chip:
- Click it to open a popup listing your notifications — pending access requests, locked accounts, unread contact messages, and submissions awaiting review (announcements/events and stories). Each one links straight to the section that needs attention.
- Clear items one at a time with the × button, or Clear all at once. The count chip updates instantly as you clear them.
- You only ever see notifications for sections you can act on — admins see everything; editors see submissions awaiting review.
-
2.1.33May 20, 2026 — Watchtower 404s, GSR Summary popup, smarter utility-bar collapse
Three improvements landed together:
- Watchtower → 404s. A new tab tracks the dead URLs visitors hit on the public site — broken inbound links, mistyped addresses, and pages that moved without a redirect. It shows totals over a time window, a trend chart, a ranked "Top missing URLs" list (with where each came from), and a recent-hits table. There's a Clear log button when you want to reset it. Admin pages and signed-in staff are never counted — these are real visitor misses.
- GSR Summary popup. The GSR button in the utility bar now opens the GSR Summary in a popup instead of jumping to the announcements page. It shows the exact same summary, styled to match. On phones it opens full-screen; on desktop it's a centred popup. A Go to Announcements button at the bottom takes you to the full page when you want it.
- Utility-bar containers stay open on mobile. When a live meeting is showing, a utility-bar group set to collapse to an icon (e.g. the helpline) still collapses on desktop to make room for the LIVE banner — but on mobile it now stays fully expanded, since the swipe strip has plenty of room and there's no need to hide its links behind an icon.
-
2.1.32May 20, 2026 — "What's New" release-notes dashboard widget
A new What's New widget on the main dashboard surfaces the latest release at a glance:
- The dashboard now leads with the newest version — its number, a Latest badge, the date, the headline, and the release note itself (rendered from the same notes you're reading right now).
- Below that, an Earlier releases list shows the previous few versions so you can catch up on recent changes without leaving the dashboard.
- A View all release notes button (bottom-right of the card) jumps straight to Settings → About, where the full version history lives.
- Like every other dashboard card you can drag it to reorder or hide it under Customize. It's on by default for everyone.
-
2.1.31May 20, 2026 — Templates page index polish
More refinement to the Frontend → Templates page now that each template configurator opens as a modal:
- The standalone Reusable templates intro card is removed — its explanation moved into the
?tooltip next to the page title. - Each row's URL (e.g.
/blog/<slug>) shows as a tidy outline chip beside the template name; the "currently active" template shows in a soft brand-tinted pill. - The A→Z / Z→A sort toggle sits at the far right of the toolbar.
- Rows now use the same flat card styling as the rest of the admin (no frontend-style hover lift).
- Fixed a brief flash of the old stacked-card layout on page load, and removed a stray collapse carrot that the global card-collapse feature was adding to this page.
- The standalone Reusable templates intro card is removed — its explanation moved into the
-
2.1.30May 20, 2026 — Templates page modal layout fixes
Per-template modals on the Frontend → Templates page now reflow cleanly. Customize-panel cards (Background, Fonts, Sidebar widgets, Sizes) used to squeeze into one row inside the modal width and the content overflowed into adjacent neighbours; the grid is now capped at two columns inside modals (single column under 720px) so every card has full breathing room.
-
2.1.29May 20, 2026 — Post galleries, multi-select file picker, refactored Templates page
Announcement / event posts get an image gallery (up to 6)
Edit any post to attach up to 6 images via upload or the File Browser. On the public detail page the gallery renders as a 3-column grid alongside the featured image with a click-to-zoom lightbox (keyboard navigation, swipe on mobile, ESC to close). Thumbnails are lazily generated so the page stays light.
File Browser opens in multi-select mode when picking gallery images
When the gallery picker opens the File Browser, the modal switches into multi-select mode — checkboxes-style selection on every card / row, a sticky bottom action bar that counts your selection and adds them all in one click. The list-view Select button used to silently do nothing; that bug is also fixed.
Frontend → Templates page is now a sortable list of modals
The Templates page used to render every template configurator (Meetings list, Story detail, Blog detail, etc.) as a long stack of cards. It's now a sortable list — A→Z / Z→A toggle persists per browser — with an Edit button per row that opens a centred modal. Forms inside each modal use the yellow save bar; the modal stays open after Save so you can keep iterating, and only the X (or Esc / backdrop click) dismisses.
-
2.1.28May 19, 2026 — Trailing-slash tolerance + form builder UX polish
URLs with or without a trailing slash both work now
Visiting
/contact/or/storyform/no longer 404s — every route resolves with or without the trailing slash. Fixes a class of "I copied the URL wrong" bug.Form-builder field cards expand on whole-card click
The Edit button on each field card in the form builder is gone. Click anywhere on a card (heading, type pill, chevron, dead space) to expand its editor; click any control inside an open card to interact with it normally. The card animates open/close over 200ms with a chevron indicator that rotates.
Posts admin defaults to Posted newest-first; remembers your sort
The Announcements & Events list now defaults to Posted descending. Click any column header to override; your choice persists across visits via a cookie. The Pending tab keeps its own freshest-first default.
Smaller polish
- Custom Forms sidebar entry renamed to Custom Form Submissions with a Manage forms button up top.
- Dashboard Forms widget rows now show just the pending count (e.g. "3 pending review") instead of the lifetime total — quieter and more actionable.
- Stories / Announcements & Events / Contact Form list pages gain a Manage form button up top linking to the matching form's settings page.
-
2.1.27May 19, 2026 — File-type restrictions on form uploads
Every file-type field in the form builder gains an Accepted file types input — comma-separated extensions or MIME types (
.pdf,.docxorimage/*). The picker on the public form filters accordingly; the server enforces the same rule on submit so a tampered POST can't sneak a disallowed file through. -
2.1.26May 19, 2026 — Module form URLs & active-URL switch
The Preview button on each form's settings page (Announcements/Events, Story, Contact) now reflects the form's current public URL — the custom slug when one is configured, the canonical path otherwise. When you set a custom slug, the canonical path (
/submissionform,/storyform,/contact) auto-redirects to the new URL so only one URL serves the form at a time. -
2.1.25May 19, 2026 — Story submission pipeline + module-form builder
Story submissions now have their own holding tank
Recovery story submissions used to land in the generic Form Submissions inbox. They now go to a dedicated Pending review tab on the Stories admin page — same flow announcement / event submissions already use. Each pending row shows the submitter's contact info, a download link for any attached file, and an Approve to drafts button that lands you on the story edit page. A new public
/storyformpage renders the form through the shared Submission Form chrome (Classic / Minimal / Split layouts).Form builder is now embedded in every module form's settings page
The same drag-and-drop field builder you use for custom forms is now layered onto all three module forms — Announcements/Events, Story, Contact. Each one ships with a default block set matching its built-in layout, so you can drag/edit/add/remove fields without losing the existing fields. Per-field labels, placeholders, help text, and options are editable inline inside the builder.
Configurable public URL per module form
Each module form now has a customizable public URL slug. Type your preferred URL into the Public URL card on the form's settings page and visitors reach the form at
/<your-slug>instead of the canonical path. The settings page pre-populates the input with the current URL so it's always visible.Other polish
- Custom forms get a Visibility toggle matching the module-form pattern.
- "Submission Form" is renamed Announcements/Events Form throughout the admin.
- The "Submission Form" template card on the Templates page is renamed Forms Template since it now drives the chrome of every public form.
-
2.1.24May 19, 2026 — Post edit page polish
The top Save post / Save draft primary buttons are replaced by a yellow save bar at the bottom of the page that only appears when you've made changes — same pattern the meeting modal uses. Lifecycle actions (Publish, Move to Drafts) stay in the top action area as explicit choices.
Other smaller tweaks:
- Summary field renamed to GSR Summary.
- The Event details card hides entirely when the Event checkbox is off — toggles live without a save.
- Links card now sits above Event details in the layout order.
- Headline card has 1rem of breathing room between each grouping. -
2.1.23May 19, 2026 — Multi-row Links on posts
The single Event website field on posts grows into a Links section that applies to announcements and events alike. Each row carries a URL, a label, a button-style picker (Primary solid or Secondary outline), and an "open in new tab" checkbox. Add as many call-to-action buttons as you need — the public detail page renders each one in your chosen style.
-
2.1.22May 19, 2026 — Announcement auto-archive + other polish
Auto-archive announcements on a schedule
The post edit page grows an Auto-archive after date/time toggle — visible only when the Announcement checkbox is checked (events already auto-archive via their event end date). Once the deadline passes, the announcement quietly moves to the archive without an admin visit.
Posted on field now populates from any source
The Posted on field used to render blank for legacy posts even though the list table showed a date. It now falls back to the same value the list uses, so it's always populated.
Event website + Event contact folded into Event details
Two cards on the post edit page collapsed into the main Event details card as subheaded sections.
Meeting "Queue schedule change" submit is now inline
Clicking Queue schedule change inside the meeting edit modal no longer closes the modal — the yellow save bar flips to Saved and animates out instead, the same way the main meeting save works.
-
2.1.21May 19, 2026 — Public alert expiry + future schedule swaps
Auto-hide public alerts on a schedule
The meeting edit modal's Public Alert Message gets a toggle + datetime picker. Flip it on, pick a moment, and the alert hides from the public site at that time and clears itself from the field — so admins don't have to remember to remove a one-off announcement.
Queue a future schedule swap for a meeting
Directly under Day & Times, a new Scheduled changes fieldset lets you build the meeting's next schedule (full week's worth of days + times) and pick the date it goes live. Until then the meeting keeps its current schedule; on the effective date the queued set replaces it automatically.
Better-looking public meeting alerts
The public meeting alert had a transparent amber wash that washed out on busy backgrounds. It's now a solid amber tile (light + dark themes), and the alert also surfaces on the meetings list cards above the description so visitors see it earlier in their journey.
-
2.1.20May 19, 2026 — Featured-image File Browser picker
The announcements / events edit page gains a Choose from File Browser button next to the featured-image upload input. Click it to pick from existing uploads instead of re-uploading; the preview swaps live and the existing upload + "Remove current image" affordances keep working unchanged.
-
2.1.19May 18, 2026 — Pending-submission chip + unified Forms dashboard widget
Sidebar shows submissions awaiting review
The Announcements & Events sidebar entry carries a number chip when there are visitor-submitted posts in the holding tank — same shape the Watchtower / Contact Form chips already use.
Dashboard Forms widget
The old Contact Form dashboard widget is replaced by a single Forms widget that lists every form on the system (Submission Form, Contact Form, plus every custom form you've built) with submission counts, last-activity dates, and warn-tinted attention badges. New custom forms appear automatically as they're created.
-
2.1.18May 18, 2026 — Form Submissions redesign, 12-hour Zoom calendar, small UX polish
A grab-bag release focused on making admin pages scan faster.
Form Submissions page is now a card layout with submitter previews
The Form Submissions inbox used to render each row as a thin "Form name · timestamp · IP" strip — fine for one row, hard to scan for thirty. Replaced with a card layout that surfaces, per row:
- Avatar circle with the submitter's first initial (muted grey when nobody can be identified).
- Submitter name in bold, pulled from name-type fields in the form (or the email's local-part / "Anonymous" as fallbacks).
- Form pill showing which form they used, plus a local-time timestamp.
- 2-line headline taken from the first subject or message field — see what they actually wrote without opening the detail.
- Meta chips: email, phone, field count, file-attachment count (when any), submitter IP.
Hover any card and it lifts toward brand-blue with a soft shadow + chevron slide. Mobile drops the chevron and stacks the timestamp.
Zoom Accounts calendar shows 12-hour times
The grid used to render
18:45–20:00. Now6:45 PM–8:00 PM— matches every other time display in the app.Sidebar Intergroup section: "+ Add Library" → "+ Add IG Library"
Disambiguates it from the + New Library button on the main libraries page, which creates a regular non-Intergroup library.
Currently Online widget no longer shows you
The widget used to surface the viewing admin's own row, which inflated the count and added noise — you already know you're signed in. Filtered out everywhere: the widget's list, the widget's header count, the dashboard tile's "X users · last 5 min" number, and the tile's tooltip names. Now they all show other people on the portal.
-
2.1.17May 18, 2026 — Custom forms now support Cloudflare Turnstile
If you have Cloudflare Turnstile turned on in Settings → Security, custom forms now show the Turnstile widget right above the Submit button — same as the events-submission form and the contact form already do. Visitors complete the challenge as part of filling out the form; the server verifies the token before storing the submission. If the challenge fails, the page re-renders with a red banner above the form explaining what happened, with everything the visitor typed still in place so they don't have to start over.
No action needed beyond keeping Turnstile enabled — every existing custom form picks up the protection automatically.
-
2.1.16May 18, 2026 — Local-time backups, idle Currently-Online rows, instant post-login appearance
Three admin-experience polishes around dates, the dashboard widget, and login UX.
Off-site backup times now show in your local timezone
Every backup timestamp in the admin — last successful run on the dashboard widget, next scheduled run, the per-row last/next on the Off-site Backups list, the recent-activity rows, the run-history page — now renders in the timezone you set on Settings → Timezone, with the proper tz abbreviation on the end (e.g.
May 18, 03:00 PDTinstead ofMay 18, 10:00 UTC).The cron expression itself is also interpreted in your local timezone now. If you type
0 3 * * *, you get 3 AM local every day — matching what the rest of the admin shows on the wall clock — not 3 AM UTC. The schedule fieldset hints on the wizard and the edit page were updated to say so.Currently Online widget keeps idle users visible
The Currently Online widget used to drop a user the moment they hadn't navigated in 5 minutes. Now it keeps them in the list for up to an hour, but renders them greyed-out with "no activity in X mins" instead of an "Xs ago" timestamp. After an hour of silence the row drops off.
The header count ("X users") still reflects only the currently-active users (within the 5-minute window), so the number matches what the dashboard tile's "X users · last 5 min" shows. Empty-state copy changed from "Nobody is currently signed in" to "No users active" — fires only when nobody has been seen at all in the past hour.
Newly-logged-in user shows up in the widget right away
A small reliability fix: a user who just logged in now appears in the widget on the very next 5-second poll regardless of what page their post-login redirect lands on. (Previously the widget waited for the first non-asset GET to fire its tracker, which was 99% of the time the next page they loaded but had occasional misses.)
-
2.1.15May 18, 2026 — Form Submissions now lives in the main app sidebar
The Form Submissions inbox moved out of the Web Frontend admin and into the main app sidebar's Admin section, right next to Contact Form. Visible only to admins. One click from anywhere in the portal opens the submissions list. The submissions list and detail pages also picked up a small cleanup: they render as standalone admin pages now, without the Web Frontend admin's two-column subnav chrome.
-
2.1.14May 18, 2026 — Fix: custom form submit 500'd while sending recipient email
After the CSRF fix shipped in 2.1.13, posting a valid submission to a custom form returned an Internal Server Error. The handler tried to read a column on SiteSetting that doesn't exist (
frontend_site_nameinstead offrontend_title) while building the email subject. Fixed; submissions now go through cleanly. If you saw this error in 2.1.13, update to 2.1.14 and retry — nothing on your forms or stored submissions changes. -
2.1.13May 18, 2026 — Fix: custom form submissions blocked with "CSRF token is missing"
Submitting a custom form on the public site returned Bad Request — The CSRF token is missing. The form's hidden CSRF input was omitted from the template — fixed. If you saw this error in 2.1.12, update to 2.1.13 and retry; nothing on your forms or their submissions changes.
-
2.1.12May 18, 2026 — Build your own forms, link them from the stories page
Two big additions that finally close the loop on letting visitors submit things to your site without writing code.
Build any form you want, drag-and-drop
There's a new Custom forms section under Web Frontend → Forms. Click + Add form to create one. The edit page is split in two:
- Settings — title, the URL slug (visitors reach the form at
/<slug>), an optional description rendered above the form (Markdown supported —**bold**,*italic*,[links](https://example.com),-lists), comma-separated recipient emails, and what happens after submit (redirect to a URL or show a thank-you message inline). - Fields — drag-and-drop builder. Pick a type from the dropdown, click + Add field, fill in the label. Eight field types: text, email, phone, textarea, select, radio, checkboxes, file. Each field has a label, optional placeholder + help text, required toggle, and (for select / radio / checkboxes) a one-per-line list of options. Drag the ⋮⋮ handle to reorder; click Edit to open a card's body; click the red trash button to delete with confirm.
The public form uses the same template chrome (Classic / Minimal / Split) as the Submission Form — pick once in Web Frontend → Structure → Templates, every custom form picks up the same look. On submit, each visitor's answers land in a new admin page, and each address you listed in recipients gets an email with the full field values. File uploads work and arrive as proper links in the admin detail view.
Checkboxes get a special treatment: their help text is a multi-line box that supports Markdown so you can write longer instructions, embed links, use
-lists, etc.Form Submissions inbox
New Form Submissions entry in the Web Frontend admin's sidebar (under Structure). Lists every submission across every custom form, newest first, filterable by which form it came in on. Click any row for the detail view — field labels + values + file attachments. Delete button on the detail page (with confirm) if you want to clear something out.
"Share your story" button on the stories page
The Stories list template on Web Frontend → Structure → Templates has two new fields under a "Submit a story" button section:
- Form to link to — a single dropdown with two groups: Built-in forms (Submission Form, Contact Form) and Custom forms (every custom form you've built; disabled ones show (disabled)). Pick one to surface a button on
/storiesthat visitors can click to submit their own stories. Leave it set to — None — to hide the button entirely. - Button label — optional. If blank, the button uses the linked form's own title (e.g. Share Your Story).
The button sits right under the page heading + subheading on whichever stories-list variant you've picked (paper-stack, ledger, manuscript, broadsheet, minimal-serif, magazine) — so it's where visitors expect to find a call to action.
A few small touches
- A grumpy 500 error when opening a custom form's edit page is gone (a stray Jinja-syntax token sat inside a JavaScript comment).
- Drag-highlighting text inside a field card's textareas works again — previously the parent's
draggable="true"hijacked the cursor; now the card only goes draggable while you're holding the ⋮⋮ handle. - The + Add form button on the forms index sits at its natural width (was stretching across the card on the first cut).
- Settings — title, the URL slug (visitors reach the form at
-
2.1.11May 18, 2026 — Dropbox backups stop expiring every 4 hours
If you were using Dropbox as an off-site backup destination, the access token Dropbox's "Generate access token" button gives you is only valid for 4 hours — so the scheduler worked once the day you set it up, then failed every subsequent morning with
expired_access_tokenand you had to keep generating new tokens. (Dev mode wasn't the cause — the token lifetime is the same on dev and published apps.)Switched to Dropbox's proper OAuth refresh-token flow so the connection stays live indefinitely. Here's what changes for you:
- The Dropbox backup wizard now asks for App key, App secret, and a one-time authorization code instead of an access token. The App key and App secret come from your Dropbox app's Settings tab; the authorization code comes from clicking the new Open Dropbox authorization page button on the form — Dropbox shows you a code, you paste it back in, and we exchange it for a long-lived refresh token at save time.
- The Dropbox SDK then auto-mints a fresh short-lived access token on every backup call. No more daily expiry. The refresh token doesn't expire until you manually revoke the app's access from your Dropbox account settings.
- Migrating an existing Dropbox target: open Off-site Backups in Settings — your existing target will show a yellow banner reading "Legacy short-lived token" with a link straight into the Edit page. Fill in the three fields (App key, App secret, fresh authorization code from the auth page) and Save. Same Dropbox app, same remote path, same schedule — just upgraded auth.
The legacy raw-token path is still supported in code (so a pre-2.1.11 target keeps working until you upgrade it), but it'll continue to expire every 4 hours and the banner will keep nagging you to upgrade.
-
2.1.10May 18, 2026 — Bundle encryption, Frontend overview, edit-in-place backups, card shadow colour
A grab-bag release focused on making the admin surface easier to live in and locking down the things that travel off-machine.
Encrypt your full-portal export with a passphrase
The Settings → Data → Export card now offers an optional encryption passphrase. Leave it blank for a plain
.ziplike before; type one and the download becomestsp-export-…-zip.enc— AES-256-GCM ciphertext that only your passphrase can decrypt. The Import side has a matching field and auto-detects encrypted bundles, so a destination install just needs the same passphrase to restore.Don't want to invent a passphrase? Click Generate strong passphrase — the browser produces a 24-character one in the format
Xk9p-Mw2N-jVqL-3Hbt-uR5z-PnAc, drawn from an alphabet that excludes the visually-ambiguousI l O 0 1so it can be transcribed from a printed page without second-guessing. A yellow banner reminds you to save it (no recovery exists), and inline Show / Copy buttons keep the field usable.Why bother? When the bundle travels through Cloudflare or any other reverse proxy, the edge sees plaintext during the upload. Encrypting client-side hands the edge ciphertext instead.
Web Frontend Overview tab is now a customisable widget grid
The Overview tab at /tspro/frontend/ used to be two toggles + a "Pick a section on the left" placeholder. It's now a draggable grid of widgets that mirrors the home dashboard:
- Status — the existing public on/off and sidebar auto-hide toggles, kept as a widget so they can be hidden or reordered.
- Visitor metrics — the full five-tile traffic overview (Views / Unique visitors / Today / Yesterday / Last 7 days) lifted from the Visitor Metrics page so you don't have to click into a second page to see the numbers.
- Pages, Redirects, Navigation, Forms, Branding & theme, Header & Footer — section-specific cards with counts and one-click access.
Drag any widget to reorder it; preferences are saved per-user. Click Customize in the top actions to hide widgets you don't care about. Same recipe as the home dashboard — same drag-handle, same Customize modal, same persistence.
Edit an off-site backup target without removing + recreating
Off-site backup targets used to be create-only — once a target was through the setup wizard, the only way to change credentials, schedule, or encryption was to remove it (which loses the run history) and add a new one from scratch. Each row on Settings → Off-site Backups now has an Edit button that opens a single page with connection / schedule / encryption all in one form. One Save button, one round-trip, and the next scheduler tick picks up your new cron immediately. The backend kind (FTP / SFTP / Dropbox) stays read-only — switching backends mid-life would orphan the existing remote archives.
Custom shadow colour for primary and secondary cards (light + dark mode)
Two new colour pickers per card style on Web Frontend → Design: a shadow colour for light mode and one for dark mode. Pick a brand-tinted glow for hero cards, warm amber on feature cards, or a cool cyan that only shows in dark mode. The size (shadow scale) still drives the offset and blur; the colour just supplies the tint, with alpha preserved from the scale so a saturated brand colour still reads as a soft glow rather than an opaque block. Defaults match the historic charcoal in every theme — existing installs render byte-identical until you opt in.
-
2.1.9May 18, 2026 — Restore bundles work behind Cloudflare's 100 MB upload cap
Restoring a full-portal bundle now works even when your app sits behind Cloudflare (Free plan caps proxied uploads at 100 MB) or another tight-upload proxy. No config change, no operator workaround — pick the file, type REPLACE, watch the progress bar.
What you'll see
The Settings → Data → Import form now opens with a one-line note explaining the chunking behaviour. After you click Import & Replace All Data:
- A progress overlay appears immediately with a brand-coloured bar.
- The sub-line counts chunks as they upload: "Uploading bundle… — Chunk 3 of 12 — 270 MB of 1.2 GB".
- Once the final chunk lands, the overlay flips to "Reassembling and restoring…" with the spinner while the server stitches the pieces back together and runs the restore.
- On success you're signed out (same as before) and land on the login page with your restored data.
How it works (you don't need to do anything)
The browser slices the bundle into ~90 MB pieces (under Cloudflare's 100 MB cap with envelope room) and uploads them as separate POSTs to a new chunk endpoint. A finalize call then assembles them on disk and runs the existing import flow. If your browser somehow can't slice files (very old versions), the form falls back to a single direct POST — same behaviour as before.
If you close the tab mid-upload, the partial chunks auto-clean themselves up on the server after 24 hours so nothing accumulates.
-
2.1.8May 18, 2026 — Restore reliability: images load correctly right after a restore
Fixed an intermittent "some images load on this reload, others don't" problem that could appear right after restoring a bundle on a multi-worker deployment. The server now gracefully recycles its workers after the import so every worker reads from the restored database — no more flaky-images / occasional 404s while you're verifying the import.
You shouldn't notice anything other than the restored portal "just working" immediately after sign-in.
-
2.1.7May 18, 2026 — Restore safety: Turnstile auto-disables when the host changes
Cloudflare Turnstile sitekeys are bound to the domain you registered them under. Restoring a prod bundle (with Turnstile enabled) onto a different host — a local dev VM, a staging machine, anything — would otherwise lock you out at login: the widget can't issue a valid token for the new domain, so every sign-in attempt fails the security check before the password is even checked.
The Import now detects this and:
- Auto-disables Turnstile on the destination when the source's host doesn't match where you imported (and flashes a clear warning naming both hosts so you know why).
- Keeps your sitekey and secret on the row — once you've verified the sitekey is valid for the new domain, one toggle in Settings → Security turns Turnstile back on.
- Clears any login lockouts the importer admin may have racked up bouncing off Turnstile, so you can sign back in cleanly.
If you're restoring back to the same host (disaster-recovery scenario), Turnstile stays on.
-
2.1.6May 17, 2026 — Bundle restore upload reliability + meeting-modal post-save refresh
A trio of polish fixes around the Data tab and the meeting edit modal.
Full-portal Import: bigger upload ceiling + a friendly error when you hit it
The Import form was silently failing on prod bundles bigger than 256 MB — the server returned a tiny error response that the browser rendered as a blank page, and back-button left you with no data imported and no flash explaining what happened. Two fixes:
- The default upload cap is now 4 GiB (configurable via
TSP_MAX_UPLOAD_MBif you need it tighter). Whole-portal bundles with non-trivial uploads dirs go through cleanly without surprises. - If you ever do exceed the cap, the page no longer goes blank — a clear red flash names the limit and points at the env var, and the form is right there waiting when you back-button.
A spinner during the upload so you know it's working
Multi-hundred-MB bundles can take tens of seconds to upload before the server even starts the restore. The Import button now flips to "Restoring…" and a full-viewport overlay with a spinner appears immediately on click, so you don't sit staring at a hung page wondering if you double-clicked.
Meeting edit modal: page behind refreshes after a save
Saving an edit from the meeting modal updates the database but didn't refresh the page behind it — the title, description, schedule etc. underneath kept showing the old values until you reloaded. Now, when you close the modal after a successful save (Cancel, X, Esc, or backdrop click), the page automatically reloads to show your edits. Saving twice before closing still results in one reload, not two.
- The default upload cap is now 4 GiB (configurable via
-
2.1.5May 17, 2026 — Email-list audience controls + Web Frontend sidebar auto-hide
A few focused additions to the Trusted Servants module and the Web Frontend admin.
Audience controls when sending an email-list update
The Send-an-update page now leads with an Audience card. Two modes:
- Full list (the new default) — sends to every subscriber + every intergroup member + every app user (editor / viewer accounts). A summary line under the radio shows the count in each group so you know the spread before sending. Duplicate emails across groups only get one copy.
- Granular — pick exactly which groups, and inside the subscribers group, pick exactly which subscribers via a scrollable checkbox list with Select all / Clear shortcuts. A live count under the Granular radio updates as you tick / untick, including the per-group breakdown and the total.
Either way, the message is sent one SMTP send per recipient with
{name}personalization, and duplicates across groups are merged so nobody gets two copies.Web Frontend admin: auto-hide the app sidebar
When you're inside the Web Frontend admin pages, the main left-edge app sidebar now collapses to a hamburger button so the content area can use the full viewport width. Tap the menu icon (top-left) to slide the sidebar in when needed; tap outside or pick a link and it slides back out. The Web Frontend has its own sub-nav so two sidebars side-by-side ate into editing canvas space on laptops. A toggle on the Web Frontend → Overview card lets you flip the auto-hide off if you'd rather keep both visible.
Smarter sidebar behaviour: when you click a sidebar link that leaves the Web Frontend (e.g., Meetings, Settings), the sidebar stays visible through the navigation instead of sliding away and then re-appearing on the next page — that flash was distracting.
Name field on user accounts
Every user account now has an optional Name field (e.g. "Jane D."), separate from the login username. It's editable from Settings → Users in both the Create form and the per-row Edit modal, and it shows up in the users table. The email-list blast uses it for
{name}personalization when the recipient comes from the intergroup-members or app-users group, so the friendly name lands in their inbox even if they've never added themselves to the Trusted Servants list.Minor polish
- The email-list cards (the roster + the send-update pages) lost their right border and brand-blue left accent — the shadow + top/bottom hairlines define the cards without the redundant verticals against the page gutter on these wide-table pages. Other Settings cards keep the brand-blue accent.
- Page heading on /email-list reads "Trusted Servants Email List" (the full module name) instead of just "Email List"; sidebar link stays as the shorter "Email List".
-
2.1.4May 17, 2026 — Trusted Servants widget stays put
Small follow-up to 2.1.3. The Join the Trusted Servants list widget on the dashboard no longer disappears once you've joined — it stays visible whenever the module is on and the dashboard toggle is checked. Once you're on the list, the widget switches to Your Trusted Servants info: name / email / phone are pre-filled with the values admins actually see on the roster, the button reads Save changes instead of Join, and a discreet Remove me from the list action appears below a thin divider for when you want to come off entirely.
Why: a few users mentioned they wanted to see and tweak their listed contact info from the dashboard without digging through any admin surface. The previous self-retiring widget hid this option behind "you can't get back to it." Now the widget is the canonical edit point for your own row.
-
2.1.3May 17, 2026 — Trusted Servants Email List, Watchtower quicknav, dashboard widget refresh
Three substantial changes in one release.
New: Trusted Servants Email List module
A complete contact roster + mass-email surface for fellowship-business updates, available at the new public URL /email-list once an admin turns it on in Settings → Modules → Trusted Servants Email List.
- Dashboard widget: every signed-in user (admin or not) sees a "Join the Trusted Servants list" widget on their dashboard until they've submitted their info. Name pre-fills from username, email + phone pre-fill from the user's account. Click join — the widget self-retires until they want to update their entry.
- Admin manage page at /email-list: full subscriber table with per-row edit / delete, Add manually modal for adding external contacts who don't have portal accounts, Import CSV wizard (see below), Send an update button.
- Send-an-update flow: type a subject, write a Markdown body. Use
{name}in either to personalize per recipient. Submit fires one SMTP message per recipient (no BCC pile-ups), records what was sent, surfaces sent / failed counts in the history card at the bottom of the manage page. Spinner overlay while it runs. - CSV import wizard (multi-step modal): upload a spreadsheet, the importer auto-detects which columns are name / email / phone, you review the mapping + a dry-run preview of what will be added (and why anything is being skipped — duplicates, missing fields, blank rows), then commit. Columns you don't care about are ignored automatically. Encoding + delimiter are auto-detected; the same CSV from Excel, Google Sheets, or Numbers all work without futzing.
Watchtower button on the sidebar, with notification chips
The Watchtower link moved out of the Admin section into its own pinned button above the sidebar search bar (under the Web Frontend pair). The button uses a shield icon and carries up to two attention chips so you can see what needs eyes without opening the page:
- An amber chip for pending access requests
- A brand-blue chip for currently-locked accounts
When neither count is above zero, the button is clean with no decoration. The Web Frontend pair also got a label-fit fix: previously the labels truncated to "We..." in the narrow grid cells — now they read Web (admin panel) and View (public site, new tab).
Dashboard widgets visual refresh
Every dashboard widget now uses the icon-led card style introduced for the Settings panes — same drop shadow, same soft border, but with a leading icon next to each widget's title so they're easier to scan at a glance. The drag handle moved into the title row as an inline chip (it's still in the top-left, just no longer floating absolutely on top of the title — so widget titles never have to be padded to avoid it).
Specifically: Recent Meetings has a calendar icon, Libraries has a book, Recent Files has a document icon, Visitor Metrics has a bar chart, Off-site Backups has a cloud, Recent Deletions has a trash icon, Contact Form has a mail icon, the Trusted Servants sign-up has a user-plus icon, Currently Online has a users icon, Access Requests has a user-plus icon, and the Server / Your Role widget keeps its existing layout.
The brand-blue left accent that other data-cards have was deliberately left off in the dashboard context — it read as visual noise next to the masonry layout. Everywhere else (Settings panes, the backup admin modal, the email-list import wizard) the accent stays.
-
2.1.2May 17, 2026 — Templated submission form + primary-card alignment
The public
/submissionformpage (the one visitors use to submit an event or announcement for admin review) is now templated like the rest of the public site — pick from three different layouts and tune background, fonts, and sizing per layout.Three layouts to choose from
Open Web Frontend → Templates → Submission form (/submissionform) and you'll see three picker cards:
- Classic (default — matches what the page looked like before this release). Centered single-column page with a heading, subheading, and a soft-shadowed card containing the form.
- Minimal. Borderless, no card. Serif heading on a thin rule, intro flows into the body, fields sit directly on the page. Maximum focus on the writing.
- Split. Two-column desktop layout: heading + subheading + intro stay sticky on the left as you scroll; the form card sits on the right. Collapses to one column on mobile.
Each layout shows a thumbnail of its silhouette in the picker so you can compare at a glance before saving.
The same per-template controls every other page gets
Each layout has its own customize panel — background colour with optional dark-mode pairing, dynamic background (gradient / overlay / palette), heading font, body font, heading-size override, body-size override. Boxed vs. full width, max-width, and side-padding controls match every other templated page.
Form card now follows your Primary-card design
The form's card now uses the Primary card design tokens from Site → Design → Card styles. Whatever background, border colour, border width, shadow, and hover treatment you've set for primary cards site-wide (meetings list, events, fellowships, library items, etc.) the submission form's card now matches automatically — light mode and dark mode. Pre-2.1.2 the card was hard-coded to white with a brand-blue border; that's gone.
-
2.1.1May 17, 2026 — Settings tabs unified, Locations + Sidebar buttons in card heads
A polish release focused entirely on Settings. Seven tabs (Appearance, Users, Global, Domain / Email, Timezone, Security, Sidebar) now share the same card chrome the Data tab introduced: a brand-blue accent on the left edge, a soft drop shadow, an icon next to each section title, and a clean single-column stack instead of the previous mix of two-column grids and horizontal-rule dividers. The Settings modal now reads as one consistent visual language.
Tab-by-tab changes
- Email renamed to Domain / Email. The Public Domain section moved here from Appearance, and the Access Request Notifications recipient field tucked into the SMTP card as one combined save — one fewer button to remember to click.
- Global (Locations / Officers / Fellowships): the "+ New Location" button moved into the Locations card's title bar so it's always visible at the top, no longer a separate floating action above the card.
- Sidebar: the "Save sidebar order" button now sits in the card's title bar too — you don't have to scroll past the long manual-reorder list to find it.
- Users: Create User and Roles & permissions stay side-by-side inside a single "Add a user" card so the permissions reference reads as guidance for picking the right role on the form. The full users table and the Public Information Chair section each get their own card below.
- Timezone, Security: each section is now a self-contained card. The two-column "OTP Email / Bot Protection" grid on Security is gone — the cards stack vertically with their own visual separation instead.
Release notes display in About tab
When you open Settings → About → Release notes, each subsection heading now has 2 rem of breathing room above it (so headings don't crash into the prose of the previous section), and the paragraphs under each heading render as brand-color bulleted list items. Intro paragraphs at the top of each entry (like this one) stay as flowing prose — only the body paragraphs inside subsections get bulleted. Easier to scan when skimming "what changed" between versions.
Other polish
- Locations "+" button is now full size and the "+" inside it shows up in white instead of being painted brand-blue (the same blue as the button background, which made it disappear).
-
2.1.0May 17, 2026 — Automated off-site backups + Appearance tab refactor
Big release. Three things landed together: a complete off-site backup system, a new dashboard widget to keep an eye on it, and a visual refresh for the Appearance tab in Settings.
Automated off-site backups (FTP, SFTP, Dropbox)
The daily SQLite snapshot we've always taken locally is good for accidents — accidental deletes, broken migrations — but it lives on the same disk as the app. A real disaster (drive dies, VM is wiped) takes the snapshots with it. Off-site backups solve that.
Open Settings → Data → Off-site backups → Set up off-site backup → to walk through the 5-step setup wizard:
- Destination — pick FTP, FTPS, SFTP (SSH), or Dropbox.
- Connect — enter credentials. A "Test connection" button round-trips a tiny sentinel file so you find out the credentials work before leaving the wizard.
- Schedule — pick a preset (Daily at 03:00 UTC, Weekly Sunday, Hourly, Monthly) or write a custom cron expression. Also pick how many old archives to keep on the remote.
- Encryption (optional) — turn on archive encryption to wrap every backup in a passphrase before it's uploaded. Even if your Dropbox token leaks or your FTP host is compromised, the archives stay sealed. There's no recovery for a lost passphrase — the wizard makes you tick a box confirming you've saved it before proceeding.
- Review — last chance to look it over, then optionally run a first backup right now so you can confirm it works end-to-end.
Each backup archive is a complete app snapshot — the SQLite database, every uploaded file, and the encryption key for stored credentials — exactly the same
.zipthe existing Settings → Data → Export data button produces. Restore is symmetric: download an archive from the remote, then import it via the existing Settings → Data → Import data flow.You can configure multiple targets — e.g. an FTP daily and a Dropbox weekly — and each runs independently with its own schedule, retention, and encryption setting. A built-in scheduler thread checks once a minute for due jobs, runs them, and emails admins via your configured SMTP host if a backup that was previously working starts to fail. The "Manage backups" modal shows status, run history, and a "Run now" button for any target, and the new dashboard widget surfaces health at a glance.
New "Off-site Backups" dashboard widget
Admins get a new draggable widget on the main dashboard. Four stat tiles up top show Healthy / Failing / Paused / Total target counts; the Failing tile turns red whenever something's broken and a warn badge appears in the widget title. Below that: when the last successful backup ran (and which target wrote it), when the next scheduled run is due, and the four most-recent backup attempts with their pass/fail pills. The entire widget is clickable — opens the "Manage backups" modal directly. Toggle it on/off from the dashboard's Customize button.
Appearance tab in Settings — visual refresh
The Appearance tab in Settings has been redesigned to match the card style we use in the Data tab — every section (Theme, Sidebar Footer Logo, Login Screen, Open Graph link previews, Home Screen Icon, Public Domain) is now its own card with a brand-blue accent on the left, an icon next to the title, and a clean drop shadow. The two-column layout is gone; cards stack vertically so each one has room to breathe on every screen size. Nothing changed about what the settings do, only how they're laid out.
Smaller polish
- No more cloud-icon flash when opening the backups modal or any iframe-based settings panel — inline SVG icons now carry intrinsic dimensions, so they render at the right size from the very first frame instead of briefly stretching to fill the container.
- Busy spinner while a backup is being taken — the "Run now" button on the Manage modal and the "Enable target" button at the end of the wizard now show a clear "Backing up…" overlay until the upload finishes, so you can't accidentally double-click.
- Modals stack instead of replace — opening the Manage backups modal no longer closes the Settings modal underneath it; same for the wizard. You can dismiss whichever you're done with and the one below is still where you left it.
-
2.0.4May 17, 2026 — Dashboard widgets: every widget has a visible grab handle, no more awkward gaps
Two paired fixes for the admin dashboard.
Every widget now shows a visible grab handle
Three widgets — Recent Deletions, Frontend Visitor Metrics, and Contact Form — were silently missing their drag handle and the underlying
draggable="true"attribute, so you couldn't reorder them at all. They share a common macro with the rest of the dashboard widgets; a Jinja scoping quirk was causing the macro to skip both pieces of markup. Fixed at the source: every dashboard widget now consistently carries the grab handle and is draggable.The handle itself was also redesigned. It moved from the top-right (where it disappeared behind every widget's "View all" link and right-aligned metadata) to a clearly visible chip in the top-left of each widget, always at full opacity, with a subtle background + border so it reads as a deliberate UI control rather than a faint hover-only icon. Hover and active states still tighten the visual cue.
Widgets now pack tightly with no awkward vertical gaps
The dashboard grid was a straight two-column layout, which meant whenever one column held a tall widget (e.g. Recent Meetings with many rows) and the other column held a short widget (e.g. Currently Online with one user), the short column would leave a large empty gap waiting for the tall column to finish before the next widget could appear.
The grid is now a masonry layout: shorter widgets slide up to fill those gaps automatically. DOM order is still the preferred order — the masonry only back-fills empty space; reorder via the grab handle still does exactly what you expect. Below 720 px the dashboard collapses to a single stacked column with normal spacing.
The layout recomputes itself whenever something changes — window resize, drag-reorder, the Currently Online widget's user count changing, the Frontend Visitor Metrics sparkline animating in — so the packing stays tight as widget heights flex.
-
2.0.3May 16, 2026 — Real client IPs in Watchtower, public library thumbnails
Two fixes that were each producing wrong-looking results in production:
Watchtower now logs real client IPs
If you've been running behind the bundled Caddy reverse proxy (the default
install.shsetup), every IP shown in Watchtower — Access, Visitors, Requests, the IP-blocklist — was the Caddy container's docker-bridge address (typically172.x.x.x), not the real visitor's IP. The Flask app wasn't reading theX-Forwarded-Forheader Caddy was already setting.This release wires in the standard
ProxyFixmiddleware sorequest.remote_addrreflects the real client across the whole app: probe-block log lines, login records, contact-form submissions, Turnstile verification, and the IP-block gate that powers the blocklist.One cleanup step: any rows you previously added to the Watchtower → IP blocklist that captured docker-bridge addresses (e.g.
172.17.0.1) won't match real client traffic anymore. Open the blocklist panel and clear those out.If you run the app without a reverse proxy in front (bound directly to a public interface), set
TSP_TRUSTED_PROXIES=0in your.envto keep the app from trusting forwarded-IP headers that nothing legitimate is setting.Library item thumbnails now load for the public
Library item thumbnails on the public Literature Library page (and any homepage / page block that surfaces a library item) were silently 404'ing to anonymous visitors — the route was login-gated. Logged-in admins saw the thumbnails fine; the public saw broken images.
Thumbnails now render publicly whenever the parent library and the item are both flagged as public-visible (the same gate the Literature Library page itself already uses). Private libraries and admin-hidden items continue to 404 to anonymous traffic.
-
2.0.2May 16, 2026 — Frontend admin tools: blog edit chip, auth-aware menu/footer, library item summaries
A round of frontend polish focused on giving signed-in admins fast tools on the public site, and making library authoring more flexible.
Edit any blog post from the public page
Signed-in editors now see a floating Edit post chip in the bottom-right corner of every
/blog/<slug>page. One click lands you in the admin editor. Hidden on mobile labels (icon-only below 640 px) so it doesn't crowd the reading column. Anonymous visitors see nothing. The existing draft / archived preview banner still carries its own edit link, so drafts don't show two stacked affordances.Auth-aware Login / Dashboard / Logout in the mega menu and footer
A new Admin login block type joins the mega-menu builder under Web Frontend → Navigation. Drag it into any column and it renders as a styled button (pill or rounded, your pick) that auto-swaps based on visitor state:
- Anonymous: a single Login button → the sign-in page.
- Signed in: a button row — Back to TS Pro dashboard on the left, a yellow Logout button on the far right.
The footer's existing Login pill got the same treatment automatically — flips to a Dashboard + Logout pair when an admin is viewing the site. Both surfaces share one visual language (icons, padding, hover) and respect the per-link size slider. Logout on the public site now returns visitors to the homepage, not the admin sign-in screen.
Library Add modal: pick how the item gets its content
The Add Item modal (renamed from Add File) replaces the old two-mode Upload / Paste toggle with a three-way picker:
- Upload file / file browser — same as before; pick a file or grab one from the File Browser.
- Paste / type content — Markdown-supported body that opens as its own document.
- External link — a URL field for items that live elsewhere.
Each option owns its own content slot: switching tabs hides the others, and saving in a given mode clears the slots it doesn't use. An optional Summary field (multi-line, up to 500 chars) sits above the picker for a short blurb that shows alongside the title in lists. The Edit modal got the same treatment — opens in whichever mode matches the existing data.
Mobile-only mega-menu animation + fade controls
The Web Frontend → Navigation → Mega menu appearance page grew a Mobile (≤ 720 px) subsection with three new knobs that only kick in on small viewports:
- Staggered link entrance · mobile — turn the staggered reveal off on phones where it can read as flicker.
- Stagger speed · mobile — independent ms slider.
- Fade speed · mobile — independent ms slider for the panel fade-in.
Desktop tuning is untouched. The desktop Show on hover fade toggle still gates whether the panel fades at all on every viewport.
Polish
- Meeting card titles on the homepage now render at weight 600 instead of inheriting the heavier 700 from their wrapping heading.
- Hidden fieldsets actually hide — a CSS rule was overriding the user-agent's
[hidden] { display: none }for.fieldsetelements, so any toggled fieldset (like the library content-mode panels) kept rendering. One-line fix.
Under the hood
- New
LibraryItem.summarycolumn (additive migration; existing data untouched). auth.logoutnow accepts a validated?next=redirect target. Strict path-only validation — open-redirect smuggles get bounced.- The library save handler enforces single-channel content per item — a row can never carry both a file and a URL the way some legacy rows could. Existing data is preserved until you next edit + save.
-
2.0.1May 16, 2026 — Meetings-list + Pro Tips cards now ride the Primary-card design tokens
Two small but visible polish fixes for the public meetings page in dark mode:
- Meetings-list cards are solid again. A stale CSS rule was painting them at 3% white — close to invisible — over the page background. They now read on a solid Primary-card-dark surface and pick up your Site → Design → Card styles → Primary card → Background (dark) token. Light mode is unchanged.
- Pro Tips cards match the meeting cards. Each tip in the Pro Tips accordion (both the standalone block at the bottom of the directory + weekboard layouts and the inline block on the sidebar layout) now adopts the canonical Primary-card recipe — background, border, border-radius, hover lift, hover shadow, dark-mode swap — instead of its own hardcoded colours. Editing the Primary card design tokens once now re-tints the meeting cards and the Pro Tips cards together.
No data changes, no admin action needed.
-
2.0.0May 16, 2026 — Watchtower: one place to watch the door
This is a major release. Watchtower is a new top-level admin module that replaces three older admin pages (User Log, Delete Log, Access Requests) with a single, security-focused dashboard — and adds real teeth: anomaly detection, an IP blocklist that actually blocks at the door, force-end on sessions, and a failed-login leaderboard with one-click bans. It's the new home for everything you'd want to know about who's signed in, who tried to sign in, what they did, what got deleted, and who's asking for an account.
Where to find it
Sidebar → Admin → Watchtower (admin-only). The old Access Requests, User Log, and Delete Log items are gone — their data lives inside Watchtower now. Anyone deep-linking the old URLs (
/user-log,/delete-log,/access-requests) will see a 404 — please update bookmarks to/watchtower.What's in it
-
Overview tab. Seven KPI tiles at a glance — views today, unique visitors, who's online right now, failed login attempts in the last 24 hours, blocked IPs, pending access requests, and files in the recycle bin. A system-health card with live CPU, memory, load average, and uptime. A 30-day visitor traffic chart, a 24-hour failed-login bar chart that colours hot hours red, a banner that fires when something looks off ("brute-force attempt in progress", "concentrated attack from 1.2.3.4"), a top suspicious-IPs table with one-click Block, a recent admin-activity feed, an active-sessions list with End session, and the live IP blocklist.
-
Visitors tab. Everything from the old Visitor Metrics page — KPI strip, traffic chart, top paths, top referrers, device breakdown, hour-of-day distribution — now inside the Watchtower shell.
-
Access tab. The new security operations centre. A failed-login leaderboard for the last 7 days with Block, Unblock, and Clear on every row; a manual ban form (permanent, or 1 hour / 24 hours / 7 days / 30 days); the active blocklist with hit counters so you can see whether each ban is actually being hit. Below that, Login sessions at the top of the audit-log area (the answer to "who's signed in?" is the first thing you see), followed by the activity feed — now showing the most recent 20 entries with an inline Show N more button to expand the rest without leaving the page.
-
Deletes tab. The recycle bin with Restore / Purge now on each row. Files are restorable for 30 days; the auto-purge runs on every page load.
-
Requests tab. Active and archived access requests with Create User, Mark Handled, Archive, Delete. Pending password resets and the 30-day reset history sit alongside.
Block an IP at the door
Watchtower ships a real IP blocklist. When you click Block anywhere — on the Overview, on the suspicious-IPs table, or via the manual form — the IP is added to a database table. From that moment on, every request from that address gets a 403 before the page renders, before assets are served, before anything else runs. A hit counter on each row tells you whether the ban is actually catching traffic. Temporary bans expire automatically; permanent bans stay until you click Unblock.
Every ban, unban, session-end, and failure-clear is written to the activity log, so you can always answer "who did this and when".
Polish
- Page background colour in Web Frontend → Templates → Customize now supports a dark-mode variant — pick Same as light, Auto (uses the Surface — Darkmode design token, so it tracks your site palette), or Manual (set your own hex). Every existing frontend template picks up the swap automatically.
- Classic blog detail no longer shows a subtle border-colour flash when you hover over the article body or its sidebar cards.
Migration notes
- The new
ip_blocktable is created automatically on first boot. - Three legacy URLs were removed (
/user-log,/delete-log,/access-requests). All POST action endpoints that used to live under those paths now live under/watchtower/...— internal links were updated. - No data migration; everything historic (activity log entries, login sessions, deleted files, access requests, visitor events) shows up in Watchtower untouched.
-
-
1.10.5May 15, 2026 — Blog overhaul: visual block editor, redesigned editor sidebar, classic detail polish
A sweeping refresh of the blog module — the markdown textarea is gone, replaced by a delightful visual editor; the edit page got a metadata sidebar; the classic public template adopts the design-token primary card look; and a few admin-set knobs that quietly weren't responding (template background, mesh randomize, comments) are fixed or retired.
Section block: group blocks with controllable spacing
The body editor's palette gained a new Section block — a container that wraps other blocks with adjustable top and bottom margin (rem, default 3 / 3). Drag it from the palette like any other block; once it's on the canvas, drag more blocks straight into its inner drop zone, or drag existing blocks from the top level into the section (or back out). Each section gets its own zone with the same insert-marker affordance. Sections can hold any block type except another section.
Container width control on the blog detail page
Web Frontend → Templates → Blog detail now has a Container width fieldset that matches the Blog list one: pick Boxed (capped max-width, default 1160 px, range 640–2400) or Full width (spans the viewport with side padding as a viewport-% gutter, default 5%). Applies to all four detail templates — classic, modern, cover, and longform. Longform's narrow-essay default still kicks in by default, but the admin's chosen width wins when set.
Preview unpublished posts on the public URL
Signed-in editors can now visit
/blog/<slug>for any draft or archived post and see it rendered exactly as it would publish — with an amber Draft preview / Archived preview banner at the top reminding them why a regular visitor wouldn't see this page. The banner carries a one-click Edit post → link back to the admin form. Anonymous visitors still get a clean 404 on unpublished URLs.The action-bar View on Frontend ↗ button on the blog edit page also shows for drafts and archives now — its label flips to Preview draft ↗ / Preview archived ↗ so you know what you're opening.
Hyperlist is now permanently dark + starts the week on Sunday
The accessibility-first Hyperlist (
/hyperlist) used to follow the OS preference for light vs dark — that meant the page looked different depending on the visitor's system. It now ships a permanent near-black palette, decoupled from both the site theme and the OS preference. The brutalist white-on-black look is part of the template's identity.The day sections also reorder to Sunday → Saturday to match the calendars folks read in everyday life. The "Filter is optional — without JavaScript every meeting stays visible." sentence in the search hint was removed.
Writing a post
- Visual drag-and-drop body editor. The body is now a stack of block cards — paragraph, heading (H2 / H3 / H4), image, button, list (bulleted or numbered), quote, callout (info / success / warn / danger), divider, video (YouTube / Vimeo URL → auto-embed, or self-hosted MP4), and code. Click the floating + Add block pill in the bottom-right (same chrome as the page builder) to drop a fresh block, or drag any tile from the palette right into the canvas at the exact insert point — an animated marker shows where the block will land.
- Each block edits inline. No modals. Drag handle on the left of every block to reorder; toolbar on top to duplicate, move up / down, or delete. Lists handle
Enter(add row) andBackspace(remove the empty row + jump to the previous). - Image blocks have a file-library picker. Click Browse to pick from images you've already uploaded — same modal as the page builder, with search by filename and inline drag-to-upload. Or just paste a URL.
- Markdown still works inline. Paragraph, list, quote, and callout bodies all support
**bold**,*italic*,[link](https://…)so prose-style writers don't lose anything. - Older posts keep their Markdown body until you re-save with blocks. Nothing migrates automatically.
Edit page layout
- Two-column layout. The main column (Post + Body) fills the available width; a new ~320px metadata column on the right holds everything else — publication, author, categories & tags, and featured image — merged into one card with section headings.
- Categories as a checkmark list (not pills any more) with an Add new category field below it. Type a name, click Add (or press Enter), and the new category appears pre-checked. Same UX for tags now — checkmark list of every tag plus inline
Add new tag. Pressing Enter in either field used to accidentally publish the post; that's fixed (a form-level guard now intercepts Enter on every text input except the title, where it still submits for muscle memory). - Author picker is now an Intergroup roster dropdown. Lists every member from Settings → Global, labelled
Name — Roleso two members with the same first name stay distinguishable. Existing posts whoseauthor_namedoesn't match a current roster entry surface a "(legacy)" option so a Save doesn't silently drop the previously-saved byline. The free-form bio textarea is gone (the column stays so existing public templates that show a bio still work). - Featured image gets a Browse Library button next to Upload — same library modal as the body image blocks. Picking a tile sets the post's featured image to the chosen file (no duplicate on disk) and shows a "Will use:
" indicator until save. - Live title → slug — typing the title rewrites the URL field as you type, with a brand-tinted highlight (same as the announcement / event editor).
- View on Frontend ↗ button in the top action bar — opens the public
/blog/<slug>URL in a new tab whenever the Web Frontend module is on and the post isn't a draft or archived.
Comments feature removed
The Allow comments checkbox in the publication section is gone, along with the comments feature entirely — no UI, no public render path, no downstream consumer. The underlying database column is preserved (SQLite can't drop a column in-place without rebuilding the table, which the safety rule rightly blocks) but nothing reads it.
Classic blog detail template polish
- Primary card surface, hover lift, and accent border now apply to the main post card, the Related / Categories sidebar widgets, and the author bio aside. Adjust the look site-wide from Web Frontend → Design → Card styles → Primary card.
- Featured image now leads the post card — sits above the category chips, title, and byline, and bleeds edge-to-edge across the card's top with rounded corners that match the card. Same look as the list-view cards.
- Sidebar widgets are toggleable per-template — Web Frontend → Templates → Blog detail → Classic → Customize now exposes Show Related widget / Show Categories widget. Turn one off and only the other shows; turn both off and the right rail disappears entirely, letting the post expand to the full container width.
Fixed
- Template background settings now apply on the classic blog detail. The article was painting its own surface from a variable that never read the admin-chosen background — the static colour / gradient / image picker now flows through. For dynamic animated backgrounds (mesh / aurora / etc.) the article renders transparent so the animated canvas shows behind the post card.
- Mesh-gradient randomize toggles actually randomize on the classic blog detail. Selecting random colors + random positions on a mesh background now repaints the palette + mesh anchor / angle on every page load (the host element was missing the CSS variables the mesh CSS consumes). Other surfaces that already worked are unchanged.
Blog list cards
- All card-shaped list layouts (Cards / Sidebar / Magazine / Mosaic) now inherit the Primary card design-token surface — same bg / border / border-radius / shadow / hover lift / hover accent border as the rest of the project. Gazette and Minimal are text-row layouts so they're untouched.
-
1.10.4May 15, 2026 — Visitor metrics: no more phantom traffic when the public site is off
A small follow-up to 1.10.3. When the web frontend was disabled, the Visitor Metrics widget was still counting scanner / crawler hits to public-site URLs (
/,/meetings,/events, etc.) — those requests get redirected to the login screen as designed, but the recorder was already writing the row before the redirect kicked in.- The visitor recorder now respects the frontend gate. When
Web Frontend → Enable public siteis off, page hits stop registering as visits. Login-page traffic was never affected. - Historical rows are left alone — going forward the counts will only include traffic that actually saw a public page.
- The visitor recorder now respects the frontend gate. When
-
1.10.3May 15, 2026 — Security hardening sweep
A defensive security pass triggered by production probe traffic for
.envand friends. The portal was already safe (Caddy doesn't serve files from disk;.envisn't in the Docker image) but this release tightens a handful of best-practice gaps that a careful audit surfaced.- Attacker probe paths return a bare 404 — requests for
/.env,/.env.backup,/.git/config,/wp-admin/,/phpmyadmin/,/xmlrpc.php,/.aws/credentials,/credentials.json,/backup.zip, and dozens more well-known recon targets now short-circuit before the 404 template renders. Zero body, no branding reflected back to scanners, one log line per probe so you can see attack patterns. - Open-redirect class fixed — every "bounce the user back where they came from" handler now validates
Refereris same-origin before honouring it. Previously an attacker could host a page that linked into a protected route and bounce the victim off to an external site on the permission-denied flash. - SVG uploads sanitized in every code path —
<script>tags,on*=handlers, andjavascript:URLs are now stripped on the way in for every SVG upload (was only the Custom Icons admin path). SVG remains admin-only. - Default
admin/admineliminated — the bundled installer now generates a strong random admin password automatically and prints it once at the end of the install. Production refuses to start withoutTSP_ADMIN_PASSWORDset. Local dev (TSP_DEBUG=1) still falls back toadmin/adminfor convenience. - Encrypted-credential failures now logged — rotating
TSP_SECRET_KEYor replacing the Fernet key used to make stored Zoom / OTP passwords silently disappear from the UI. The decrypt path now logs a warning per affected column so the breakage surfaces in container logs. - Two more cross-origin hardening headers —
Cross-Origin-Opener-Policy: same-origin(blockswindow.openerattacks) andCross-Origin-Resource-Policy: same-origin(blocks external sites from hot-linking our responses) are emitted on every response.
- Attacker probe paths return a bare 404 — requests for
-
1.10.2May 14, 2026 — Per-page link previews, Home Screen icons, detail-card style + announcements/events polish
Layered on top of 1.10.1 — every public detail page now ships its own Open Graph preview (so a meeting / event / story / blog link pasted into Slack or iMessage shows that entity's logo + title + summary instead of the site-wide fallback), separate iOS Home Screen icon + name for the admin portal and the public site, detail cards swapped to the meeting-card visual family, View on Frontend on the post editor, cleaner announcement cards + linkable GSR titles, mobile padding restored on homepage Meetings + Events blocks, and a redesigned More events grid.
- Per-page Open Graph link previews — meeting / event / announcement / story / blog detail pages now emit their own
og:title,og:description, andog:image. Meetings use the meeting logo; events / announcements / stories / blog posts use their featured image. Anything missing falls back to the site-wide values under Web Frontend → Branding & SEO. (Make sure the Enable link previews toggle there is on.) - Content pages get a new Open Graph / Link Previews section on the page-edit screen — set a custom title, description, and preview image per page; any field left blank falls back to the site-wide defaults.
- iOS Home Screen icon + display name — separate controls for the admin portal (Settings → Appearance) and the public site (Web Frontend → Branding & SEO). Visitors who "Add to Home Screen" on iPhone / iPad now see the icon and label you upload here instead of the bundled defaults. 180×180 PNG with an opaque background works best — iOS rounds the corners.
- Event / announcement / archive detail cards (Schedule / Location / Online / Contact panels) now use the Primary card design tokens, matching the elevated meeting-detail card look. Adjust them site-wide from Site → Design → Card styles → Primary card.
- View on Frontend ↗ button on the announcement / event admin edit page — opens the matching public URL (event / announcement / archive) in a new tab.
- Announcements list cards dropped the redundant View details ↗ CTA. The card title is the link now (with a hover underline).
- GSR Summary titles are now navigable — each title links to the announcement detail page, styled to read as plain text with a hover underline so the printed-digest aesthetic stays intact.
- Homepage Meetings + Events blocks regained their mobile gutter. Desktop is unchanged — the parent page-builder container still controls width and padding there.
- Events Magazine "More events" grid: featured images now show above each tile's title; grid caps at 3 cards per row (drops to 2 on tablets, 1 on phones) so each tile stays wide enough to host a thumbnail.
- Per-page Open Graph link previews — meeting / event / announcement / story / blog detail pages now emit their own
-
1.10.1May 14, 2026 — Polish pass: meetings list, About tab, post / event editor flow, container gutter
Quick refinements layered on top of 1.10.0 — a release-notes pane in the About tab, the missing desktop gutter restored, several meeting-page touches, and a stack of editorial-flow fixes for the announcements / events module.
- Settings → About now leads with a friendly Release notes pane (open by default) and tucks the dense Changelog underneath in a collapsed toggle.
- Container padding — desktop default flipped to
5vw(was0) so every block that uses.fe-containercarries a visible left/right gutter at all desktop widths. - Meetings list (Sidebar template): in-person and hybrid meetings show the location name + address at the top of the actions column.
- Meetings list (Sidebar template): admin-curated custom links in the rail under the day filters — chevron-right for internal, external-link icon (with new-tab toggle) for external.
- Backend meeting detail: View on Frontend ↗ button now appears whenever the Web Frontend module is enabled (was gated on public visibility), positioned right next to Edit.
- Frontend meeting detail: Files & Readings panel drops the file-description text under each link — just the title + arrow.
- Homepage Meetings + Events blocks dropped the inner
.fe-containerwrapper so their width / gutter is now controlled solely by the surrounding page-builder container — fixes the cards grid getting crushed when site-wide container padding adds on top of the parent's own gutter. - Announcements & Events admin: every row + the post-edit page now have a Duplicate button — clones the post into a fresh Draft (title gets a "(copy)" suffix) so you can spin up next month's announcement / event using last month's fields as the seed.
- Post slug auto-derives from the title when the title changes on save (with
-2/-3/… suffixes on collision). The slug input still wins when the title is unchanged, so you can rename the URL without touching the title. - Live title → slug preview: typing in the Title field on the post-edit page now rewrites the URL field as you type, with a brief brand-tinted highlight so you can see the URL changing alongside the title.
- Draft → publish stamps "Posted on" with the current time: the first time a draft actually goes live, "Published on …" resets to "now" — no more relying on whatever back-date the admin keyed in earlier.
- Publish + Move-to-Drafts on the post-edit page now save your in-progress edits. Previously they only flipped the draft state and lost any unsaved changes — you'd have to click Save first, then Publish.
- Drafts no longer pollute the URL-redirect history: renaming a draft (or a pending submission) doesn't add a row to
EntitySlugHistory. Only published posts log a redirect when their URL changes. - Auto-stamped post / story published-on times now honour the site timezone. Previously the auto-stamp wrote UTC and the display rendered it as if local, so a draft published at 5 PM in California would show as 12 AM the next day. Re-save any affected posts (or click Publish again) to refresh the stored value.
- Frontend export bundle no longer carries Posts (announcements + events) — those are per-deployment editorial content, not look-and-feel. Pages, stories, navigation, layouts, fonts, icons, design tokens, and media still ride along as before.
- Homepage side padding survives a frontend export round-trip. The import path was silently rewriting any page integer column set to
0(e.g.full_padding_pct: 0on a full-bleed page) back to the model's default — so the homepage's gutter reset to 4 % every time. All integer columns on Page now round-trip verbatim. - Meeting detail page: description prose caps at 75 % column width above 1024 px for comfortable line length on wide monitors; tablets / landscape phones / split-screen (≤1024 px) still get the full width. Applied across all four detail templates (Classic, Minimal, Card Stack, Magazine).
- Event website URL field accepts relative paths (e.g.
/about-us) so admins can point an event at a page on the same site without needing the full domain. Full URLs still work; the mobile URL keyboard still comes up. - Announcements + Events list pages sort by post date — newest published at the top, descending. Applies to the Cards view, the GSR Summary view, and the events list. The homepage Upcoming Events block keeps its chronological "next event first" ordering.
- GSR Summary subheading trimmed to "Fellowship news, in brief."
-
1.10.0May 14, 2026 — Design tokens overhaul + hero button picker chrome
The deepest pass on the design tokens system to date — buttons and cards each split into two-column admin views with live previews above each column, and the hero block's button editor finally gets the same icon picker + colour cluster the rest of the admin uses.
- New Surface — Darkmode token controls the dark-mode page background site-wide.
- New per-button border / hover-border / hover-background tokens (8 colours + widths) for both Primary and Secondary styles, with live previews that repaint as you edit.
- New per-card hover-border tokens (Primary + Secondary) — the feature-card accent on hover is now admin-tunable.
- New Container padding tokens (desktop + mobile) — restored the lost 5% mobile gutter site-wide.
- Frontend Features block: each card now gets an inline button (Primary or Secondary, with editable label) instead of the whole card being a link, plus an optional section-level CTA.
- Hero modal button rows: icon picker for the before/after icons, full design-token colour clusters for every colour field.
- Custom links in the meetings sidebar: add internal or external links below the day filters with chevron / external-link icons + open-in-new-tab toggle.
-
1.9.1May 2026 — Frontend bundle is now a verbatim copy
Fixes two gaps in the frontend export/import where pages were silently reverting to model defaults on restore. Per-page spacing settings and the homepage designation now ride along correctly.
-
1.9.0May 2026 — Homepage is a Page now
The legacy homepage admin is retired. The public
/root is now driven by whichever Page row you designate as the homepage, with the same page-builder editor you use for every other content page.- Pick any Page as the homepage from the Pages list — one click flips the designation and publishes.
- Hero block edit modal gains dark-mode controls for the heading gradient and subheading colour.
- Container blocks: per-side border widths, hover border width, variable-driven hover effects.
- New per-page Features and FAQ blocks (verbatim copies of the homepage editors).
- New per-page Meetings list and Upcoming Events blocks.
-
1.8.6 – 1.8.8May 2026 — Library import wizard, frontend export coverage, public submission form
Frontend export bundle expanded to cover the full content surface (custom layouts, fonts, icons, hero buttons, media, every frontend SiteSetting). Library import wizard streamlines bringing existing material into a new install. Visitors can submit events and announcements at
/submissionformfor admin review. -
1.8.5May 2026 — Cross-instance cookie isolation
Two TSP instances on the same hostname no longer step on each other's CSRF cookies, fixing a logout-loop scenario when running multiple deployments behind one domain.
-
1.8.4April 2026 — Literature Library, Printlist, Hyperlist, frontend search
Three new public surfaces and a global search modal land in one cycle.
- /library — public-facing Literature Library with per-item visibility toggles and admin Templates integration.
- /printlist + /printlist.pdf — branded, print-optimised meeting schedule.
- /hyperlist — accessibility-first plain-HTML index of every active meeting (no chrome, no JS, single small payload).
- Frontend-wide search modal — Cmd/Ctrl+K from anywhere, draggable trigger in the utility bar, extensible source registry covering meetings + events out of the box.
- Past-events archive at /events/archive with sidebar filter rail.
-
1.8.3April 2026 — Footer locations, Pro Tips, Inclusion block
Long polish cycle covering the meetings list, footer location cards, design-token expansion, and several dark-mode fixes.
- "Pro Tips" accordion at the bottom of /meetings with a GUI editor (icon picker on every row).
- Statement of Inclusion block for the homepage.
- Meeting Locations: split address fields, location notes, website URL, opened to frontend editors.
- Footer meeting-locations block: frosted-glass cards with first-class location features.
- Default appearance control (light / dark / follow system).
- Recovery Blue primary buttons adopt the meeting-page Zoom-button recipe by default.
-
1.8.0 – 1.8.2March 2026 — Meetings list, Live Meetings Bar, Utility Bar admin
The /meetings page becomes a three-template picker (Sidebar with day-filter rail, Directory with sticky toolbar, Week board with seven Mon→Sun columns). The Live Meetings Bar replaces the legacy Top Alert Bar, with admin grouping and mobile-aware swipe rails.
- Per-meeting Extended Content section — admin-tunable Markdown blocks below the schedule.
- Public meeting + event detail pages get an Edit shortcut for logged-in editors.
- Click-to-copy chips with a green "Copied!" tooltip.
- Settings → Timezone tab for explicit site-wide timezone control.
- Footer "Powered by Trusted Servants Pro" pill block.
-
1.7.0 – 1.7.17February 2026 — Announcements & Events, Design tokens, custom fonts/icons
The Announcements & Events module ships alongside a site-wide Design tokens system, custom font and icon libraries, daily SQLite snapshots, and reusable detail-page Templates.
- New Upcoming Events block on the homepage and a dedicated /events listing.
- Site-wide Design tokens — Brand, Accent, Surface, Text, Card, Buttons, Links — flow into every region of the public site.
- Recovery Blue theme rename + per-template appearance overrides.
- Custom fonts and custom icons libraries — upload your own and pick them from the same dropdowns as built-ins.
- Customizable public 404 + playful admin 404 page.
- Two-panel split block for side-by-side homepage sections with per-side padding.
- Per-module role permissions and the new Frontend editor role.
- Frontend favicon, OG fields, and meta-tag split (separate from the admin chrome).
- Daily SQLite snapshots saved to
/data/snapshotswith retention.
-
1.6.0 – 1.6.2January 2026 — Web Frontend module
The Web Frontend module lands — a swappable public marketing site driven by registry-defined templates, with mega menus, alert bars, full nav editor, and a module gate that splits enabled-vs-publicly-visible.
- Swappable templates per region (header, footer, homepage, meeting detail, etc.).
- Full navigation editor with mega menus, search, and admin-only preview banner.
- Frontend bundle import/export for portable site copies.
- Public-asset blueprint and pasted-font pipeline.
- Settings modal "Web Frontend" pane with refresh-on-save hook.
- Update-available banner notices same-version redeploys (image content hash).
-
1.4.0December 2025 — File Browser picker rebuild
The File Browser picker is rebuilt with sort + direction controls, preview-before-select, and URL-state preservation so deep-linked picker views survive a refresh.
-
1.3.7 – 1.3.13November 2025 — Security hardening + library authoring + lockouts
A long stretch of security hardening (CSRF, secure cookies, XSS, brute-force protection) lands alongside library reading authoring, per-username login lockouts, and an Access Requests redesign.
- CSRF protection, secure cookies, security headers, login brute-force protection.
- Library reading authoring — paste content as an alternative to file upload, with a Markdown editor + paper-styled lightbox.
- On-the-fly PDF download for any pasted reading.
- Per-username login lockout with a DB-backed state and admin-visible chips.
- Access Requests widget redesign + Customize Dashboard toggle.
- Mobile sidebar footer always visible; create user from an access request in one click.
-
1.3.0 – 1.3.6October 2025 — AGPLv3, drag-and-drop dashboard, OG previews
The project goes open source under AGPLv3. The dashboard becomes drag-and-drop with per-user widget customisation. Open Graph link previews ship for every share-worthy URL. Server Stats and Server Metrics widgets land for editors and admins.
- Open-source under AGPLv3 with attribution credit on the About page.
- Drag-and-drop dashboard with per-user customisation.
- Universal SVG icons + light mode default on fresh installs.
- Server Stats card with Online Now tile + per-role visibility.
- First-run setup wizard for fresh installs.
- Guided tour for viewers and editors.
- File Browser lightbox for previewing images and PDFs in place.
- Legacy WordPress redirects honoured automatically.
-
1.2September 2025 — Rebrand to Trusted Servants Pro
Project renamed from the early working title to Trusted Servants Pro. Third-party branding unbundled; sidebar logo now appears on the login screen.
-
1.1September 2025 — Login bot protection + unattended installer
Cloudflare Turnstile gates the login and access-request forms. The installer ships an unattended mode for one-line VPS deploys. HTTP cache headers tightened on auth-sensitive routes.
-
1.0August 2025 — First public release
The first public release — a complete portal for fellowship trusted servants covering meetings, libraries, file storage, accounts, Zoom credentials, intergroup info, and tech training.
- Meetings, Libraries & Readings, File Browser, Copy Link buttons.
- Roles & Access (admin / editor / viewer), Request Access flow.
- Zoom Accounts (encrypted credential storage) + Zoom Tech Training playbook.
- Themes (light, dark, neobrutal, cyberpunk, solarpunk) with a 3D login transition.
- Email / SMTP, data export / import, configurable session length.
- Responsive design from day one — every view ships dedicated mobile layouts.
Changelog
The full implementation log — every change in technical detail.
-
2.14.3Jun 14, 2026
Fixed
- Non-admin users can now manage their own 2FA. The self-service endpoints
(/settings/mfa/begin|enable|disable|regenerate-recovery) were still gated
@admin_requiredfrom when 2FA was admin-only — so after the card moved to
Settings → Your Access (any role), a non-admin's "Turn off two-factor" (or
setup) silently failed, leavingmfa_requiredset and re-prompting the setup
wizard at every login. Changed them to@login_required; they only ever act
oncurrent_user, so each user manages their own 2FA and no one else's.
Changed
- 1rem gap between the authentication-code field and the Verify button on the
login 2FA setup wizard.
- Non-admin users can now manage their own 2FA. The self-service endpoints
-
2.14.2Jun 13, 2026
Fixed
- Turning 2FA off in Settings → Your Access now fully reflects the off state.
The yellow "2FA has been turned on for your account" notice and the red
"Turn off two-factor" button now disappear when you turn it off (a scoped
.mfa-card [hidden]CSS rule — the elements'display: flex/inline-flex
was beating the[hidden]attribute, so toggling them had no visible effect). - The Users-tab Two-factor toggle stays in sync. When a user enables or
disables their own 2FA from Your Access, the admin Users tab iframe (if open
in the same Settings modal) reloads so its per-row toggle reflects the new
state instead of going stale until the modal is reopened.
Changed
- Reworded the login setup wizard from "Two-factor authentication is required
for your account" to "available for your account" — it's optional and
skippable, so "available" reads truer.
- Turning 2FA off in Settings → Your Access now fully reflects the off state.
-
2.14.1Jun 13, 2026
Added
- Per-account 2FA control in Settings → Users. Each user row has a
Two-factor toggle (also in the Edit-user modal). Turning it on flags the
account as requiring 2FA; turning it off fully clears any requirement,
enrolment, secret, and recovery codes. New admin accounts default to
requiring 2FA at creation time (other roles default off). - 2FA is available to any role, not just admins. The login challenge gate
dropped itsis_admin()restriction;mfa_requiredis now the master "2FA
on for this account" switch (distinct frommfa_enabled, which means
enrolment is complete). - One-time login setup wizard. When an account is flagged to require 2FA
but hasn't enrolled, the next sign-in (after the correct password) routes to
/tspro/auth/mfa-setup: scan the QR / enter the key, confirm a code, and save
the recovery codes. The user may Skip for now to sign in without enrolling
— the wizard reappears at each login until they enrol or turn 2FA off.
Changed
- Personal 2FA self-management moved to Settings → Your Access (visible to
every role) from the admin-only Security tab, since 2FA now applies to any
role. The card shows three states — Off, Setup required (with an admin
notice and a one-click turn-off), and Enabled. Disabling or regenerating
recovery codes remains password-gated. The Security tab keeps the
portal-wide settings (Turnstile, Zoom OTP). - New
user.mfa_requiredcolumn (added by_migrate_sqlite). On the boot that
adds it, any account already enrolled is backfilled tomfa_required = 1so
live 2FA keeps challenging under the new master-gate model.
- Per-account 2FA control in Settings → Users. Each user row has a
-
2.14.0Jun 13, 2026
Added
- Optional two-factor authentication (2FA) for admin accounts. Admins can
enable a time-based one-time-password (TOTP) second factor from
Settings → Security. Enrolment shows a QR code plus a manually-typeable
key; the codes are standard RFC 6238 (HMAC-SHA1, 6 digits, 30 s), so any
authenticator works — 2FAS, Google Authenticator, Aegis, 1Password, etc. The
TOTP engine is stdlib-only (hmac/hashlib) and validated against the
RFC 6238 test vectors; the shared secret is stored Fernet-encrypted, never in
clear. 2FA is strictly admin-only and per-account — other roles never see the
step, and an admin who is later demoted is silently exempt rather than locked
out (User.mfa_active()re-checksis_admin()). - Single-use recovery codes. Ten one-time codes are generated at enrolment
and shown exactly once; only their SHA-256 hashes are stored. Either a TOTP
code or a recovery code completes the sign-in, so a lost authenticator doesn't
lock an admin out of the only admin account. Codes can be regenerated from the
Security card (password-gated). - Two-step sign-in challenge. After a correct password, an MFA-enabled admin
is routed to a dedicated/tspro/auth/mfapage to enter their code before the
session starts. The challenge is IP rate-limited (reusing the login limiter)
and the half-authenticated state expires after 10 minutes.
Changed
- New dependency:
qrcode==7.4.2(enrolment QR rendering; uses the already-
vendored Pillow backend). The verification path itself pulls in nothing new. - New
usercolumnsmfa_enabled,mfa_secret_enc,mfa_recovery_codes_json
(added by_migrate_sqlite; fresh installs viacreate_all).
Security
- Disabling 2FA and regenerating recovery codes both require re-entering the
account password, so a walked-up-to, already-unlocked session can't silently
strip the second factor. Login failure buckets are cleared only after the
second factor verifies — a stolen password alone can't reset the lockout
budget on the MFA step.
- Optional two-factor authentication (2FA) for admin accounts. Admins can
-
2.13.2Jun 13, 2026
Changed
- Backend flash/toast messages now appear below the topbar instead of
floating over it, so transient "Saved" / error toasts no longer cover the
topbar's action buttons. The offset tracks the live topbar height (which can
wrap taller on narrow viewports) via a small--topbar-hmeasurement.
- Backend flash/toast messages now appear below the topbar instead of
-
2.13.1Jun 12, 2026
Added
- Full-page search results at
/tspro/search. Surfaces everything the live
search palette (⌘K) finds, uncapped, with type-filter chips (per-type counts)
and sorting — Relevance (default), Name A–Z / Z–A, and Recently updated.
Covers every searchable type: meetings, libraries + library files, meeting
attachments, announcements/events, stories, blog posts, files, locations,
users, pages, and Settings / Web-Frontend jump targets. The palette and the
page share one backend helper (_search_sections) so matching and
role-gating stay identical; a lightweight relevance score (label-prefix >
label > snippet hits, DB order as the stable tiebreak) drives the default
sort. - AJAX filtering & sorting on the results page. Clicking a type chip or
changing the sort fetches only the swappable results region (a new
_search_results_region.htmlpartial, returned when the request carries
X-Requested-With: fetch) and replaces it in place — no full-page reload.
The URL stays in sync viahistory.pushState, back/forward re-fetch via
popstate, and the swap preserves the current scroll position. Falls back to
a real navigation if the fetch fails; chips remain plain links for no-JS.
Changed
- Search palette is now stateful. A full-width "See all results" button is
pinned as a sticky footer linking to the full page. The last query + results
are preserved insessionStorage, so opening a result and coming back
restores where you left off; a Clear button (and closing the window) wipes
that state. - Result snippets are flattened to plain text. Inline HTML carried in some
descriptions/bodies (e.g.<b><i>…) is stripped — and any tag clipped by the
char-budget slice is dropped — so neither the palette nor the page shows
literal markup.
- Full-page search results at
-
2.13.0Jun 12, 2026
Changed
- Announcement / event post editor relaid out.
post_edit.htmlis split
into a logical top-to-bottom card flow — Type & title (now also holding
"Posted on / schedule for" and the announcement auto-archive control, merged
in from the former standalone Publishing card) → Content → Event
details → Links → Images. Links moved above Images. All monospace
faces on the page (body/summary textareas, slug input + prefix, slug-history
chips, inlinecode) now inherit Inter via.post-formoverrides. Inter-card
spacing tightened (.form.post-formgap 1.25rem; cards lose their own
bottom margin) and datetime inputs capped at 320px so the "Today" button
hugs the field. - Auto-archive control restyled as a cohesive panel. The "Auto-archive this
announcement" switch + datetime now share one bordered, panel-tinted block
matching the "Online event" toggle row (shared.post-toggle-row/
.post-toggle-infoclasses), with the date field revealing below a divider
inside the same panel. - "Remove current image" restyled as a pill toggle. The featured-image
clear checkbox renders as a chip (.post-featured-clear) — neutral outline
at rest, red fill + × icon when armed — instead of a bare checkbox. - Topbar header is now sticky and full-width.
.topbaris pinned
(position: sticky; top: 0) across every backend page with the sidebar's
var(--panel)background, avar(--border)bottom border, and a soft
shadow — fully theme-aware (dark/night-mode compatible). The readable-width
cap moved off.contentonto the inner.pagebody
(max-width: calc(1400px - 2 * var(--content-px))), so the bar bleeds the
full grid column out to the right edge of the viewport while page content
keeps its prior width and left alignment. Frontend-admin / 404 full-bleed
opt-outs moved to.page:has(…). The bar's bottom margin uses
var(--content-px)so the gap below it matches the container's
left/right gutters at every breakpoint.
Added
- Instant featured-image preview. Choosing a file in "Upload new image"
swaps the thumbnail immediately viaURL.createObjectURL(no save needed),
hiding the empty placeholder and clearing any stale File-Browser pick. - Live "Remove current image". Arming the clear pill hides the thumbnail
on the spot (.is-cleared); unchecking — or picking a new upload — restores
it. The actual delete still happens server-side on save. - Swipeable mobile topbar actions. On phones the top-actions row is a
single non-wrapping, horizontally swipeable strip (overflow-x: auto,
flex-wrap: nowrap, hidden scrollbar,touch-action: pan-x) instead of
wrapping to multiple rows; list-page view controls ride in the same strip.
Fixed
- Gallery "Choose from File Browser" alignment. The button bottom-aligns
with the file input instead of floating to the upload-label column's center. - Zoom OTP retrieve copy reworded on the Meeting and Zoom Accounts pages:
"After Zoom prompts for the code, click this retrieve button and the system
will fetch it — it may take up to a minute to retrieve."
- Announcement / event post editor relaid out.
-
2.12.6Jun 11, 2026
Changed
- Trusted Servants sign-up widget reworked for shared accounts. The
dashboard widget (index.html) now always renders a single blank "Join the
list" form — no per-user subscription state, no pre-filled account details
(fields default to empty withautocomplete="off"), no "Save changes" /
"Remove me" variant.main.trusted_servants_subscribeno longer upserts on
user_id; it inserts a freshTrustedServantSubscriberwithuser_id = NULL
on every submit, so multiple people sharing one login each get their own
admin-managed entry.index()stops looking up the per-user subscription.
Editing/removing entries remains admin-only on/email-list. - Libraries dashboard widget excludes Intergroup libraries.
index()now
filtersLibrary.is_intergroup == False, mirroring the/librariespage, so
the widget only lists general Libraries-module entries.
Removed
main.trusted_servants_unsubscriberoute (/email-list/unsubscribe) and
its widget form — end users no longer self-remove from the list.
- Trusted Servants sign-up widget reworked for shared accounts. The
-
2.12.5Jun 10, 2026
Added
- Scheduled / future posts. A published announcement/event with a future
published_atis now hidden from every public surface until that moment, then
appears automatically. Centralized infrontend._post_live_clause()(NULL =
legacy/always visible; site-local-naive comparison) and chained onto all nine
publicPostqueries (lists, past/archive, canonical resolver, the three
detail routes, both sitemap feeds).post_savekeeps a future date on publish
instead of stamping "now"; the admin list shows a teal "Scheduled" badge
(posts.html,posts()passesnow_local); the editor relabels the field
and adds a "Today" button. - Exhaustive backend search (
api_search). All post states (drafts,
archived, pending) with type/state labels, plus Stories, Blog posts, and
page-builder Pages. New role-gated navigation results jump to a Settings tab
(opens the modal) or a Web Frontend section. Non-admins never receive
admin-only destinations. - Users tab: filter, sort, multi-delete (
users.html). Client-side filter
box, sortable columns (username/name/email/phone/role), and checkbox
multi-select backed by a new admin-onlyauth.users_bulk_deleteroute (skips
self + invalid ids). - Rollback snapshots button in Settings → Data. The snapshots modal is now
shared chrome inbase.html(de-duped fromfrontend_dashboard.html) and
opened from both the staging-sync card and the Web Frontend overview; the
staging-sync card's header icon now matches the Frontend bundle card. - "Today" button on the event start/end datetime fields, which also keeps
the end ≥ start automatically.
Changed
- Dashboard moved to a pinned sidebar button styled like the Notifications /
Watchtower buttons (_is_visible('dashboard')→ False, button inbase.html). - Custom post URL is honored on drafts.
post_savehonors an explicit slug
whenever the post isn't publicly addressable yet, and the editor stops
auto-deriving the slug once the admin customizes it — so a draft publishes at
the chosen URL with no redirect.
Fixed
- Mobile horizontal overflow on the post editor.
.post-formpins
min-width: 0on grid rows/fields, keeps inputs fluid, and clips horizontal
overflow so long URLs/fields no longer cause a horizontal scrollbar.
- Scheduled / future posts. A published announcement/event with a future
-
2.12.4Jun 9, 2026
Added
- Rollback snapshots modal on the Staging Sync card (
app/routes.py,
app/templates/frontend_dashboard.html,app/static/css/app.css,
app/static/js/app.js). A "Rollback snapshots" button opens a popup listing
the auto-saved pre-sync bundles (newest first) with date, size, and a download
link each, plus step-by-step restore instructions (download → Settings → Data
→ Frontend bundle → Import frontend). Two new admin-only routes back it:
GET /settings/frontend-sync/snapshots(JSON list) and
…/snapshots/<name>(download, filename-pattern validated like the DB-snapshot
route). The snapshot directory is now a shared_frontend_sync_snapshot_dir()
helper. The list is fetched on each open so it stays fresh after a Pull/Push.
Staging-install only, matching the sync controls.
- Rollback snapshots modal on the Staging Sync card (
-
2.12.3Jun 9, 2026
Added
- Staging-sync Pull/Push controls on the Web Frontend overview
(app/templates/frontend_dashboard.html,app/static/css/app.css,
app/static/js/app.js). Nested inside the existing Status widget on a
Staging install: a live connection pill (an async ping to the peer via the
frontend-synctestroute), the paired Live site's label + URL, and
arm-then-confirm Pull from Live / Push to Live buttons that reuse the
AJAXfrontend_sync_pull/frontend_sync_pushroutes — so the frontend can
be moved without opening Settings. Results and last-pulled/pushed timestamps
update in place. Gated onself_role == 'staging'+ a configured token and
Live URL, so it never renders on the Live (receiver) install.
- Staging-sync Pull/Push controls on the Web Frontend overview
-
2.12.2Jun 9, 2026
Reshapes the frontend staging-sync wizard (2.12.1) around an explicit role
choice and moves every wizard action to AJAX so the settings modal never reloads.Added
FrontendSyncPeer.self_role(app/models.py) —'live'or'staging'
(''until chosen). The wizard's first step asks which install this is and
then shows only that role's fields.allow_inboundis derived from the role
(live ⇒ on, staging ⇒ off) instead of a separate checkbox, so the two stay
consistent. Back-filled on existing 2.12.0/2.12.1 installs by a new
_migrate_sqliteentry (app/__init__.py); fresh installs get it from
db.create_all().
Changed
- Role-scoped wizard (
app/templates/base.html,app/static/js/app.js,
app/static/css/app.css). A Live install only mints the shared token and
is set to receive (its "Finish" step hands off the token + this site's address
to paste into Staging). A Staging install pastes the token, enters the Live
URL, tests, then Pulls/Pushes. The stepper is built client-side from the chosen
role's step list. Choosing Staging is gated behind a "set up your Live site
first" confirmation, enforcing the pairing order. - All wizard actions submit over AJAX (save / generate / test / pull / push).
The outbound routes (app/routes.py) return JSON when called with
X-Requested-With: fetchand keep the flash + redirect path as a no-JS
fallback. Field updates (the new token, paired state, last-synced timestamps)
apply in place, so the settings modal stays open throughout.
Fixed
- The settings modal no longer closes/reopens on every wizard action. 2.12.1
worked around the full-page reload by reopening the modal afterward, which
flickered on each "Save & continue"; the AJAX submit path removes the reload
entirely.
-
2.12.1Jun 9, 2026
Reworks the frontend staging sync setup UI (shipped in 2.12.0) from a single
flat card into a guided five-step wizard, and fixes the settings modal closing
out from under the admin on every sync action. No model, route, or wire-format
changes — purely the admin-facing setup experience in Settings → Data.Changed
- Frontend staging sync is now a step-by-step wizard (
app/templates/base.html)
— Overview → Pair token → Peer address → Test → Sync, driven by a clickable
stepper. The overview draws the two installs with explicit Push/Pull arrows so
"which side am I on, and which way does the frontend move" is no longer
ambiguous. The token step now renders the actual shared token in a copy-to-
clipboard box (the model already exposes a decrypttokenproperty) instead of
only flashing it once at generation, and the inbound checkbox spells out which
install should tick it. Styles live under.fe-sync-*inapp/static/css/app.css,
mirroring the existing.wp-wizard-stepperpattern; with JS disabled every step
stays visible so the card still works.
Fixed
- The settings modal no longer closes when you run a sync action. The wizard's
forms do full-page POSTs (data-no-ajax), which dropped the admin back to the
page behind the modal after Generate / Save / Test / Pull / Push. A new
feSyncWizardhandler inapp/static/js/app.jsrecords a reopen flag plus the
target step before each submit and, on the resulting reload, reopens the modal to
the Data tab and restores the wizard step — so generating a token leaves you
looking at the freshly minted token with its Copy button.
- Frontend staging sync is now a step-by-step wizard (
-
2.12.0Jun 8, 2026
Adds frontend staging sync: an authenticated, bidirectional HTTP sync that
moves the scoped frontend bundle between two paired installs, so a developer can
iterate on a dev/staging copy and push the result to production (or pull prod's
live frontend down to work on). Only the public frontend moves — presentation
(theme / nav / mega-menus / layouts / fonts / icons /frontend_*settings),
page-builder Pages, and referenced assets — never users, meetings, libraries,
Zoom accounts, backups, or recovery Stories. Built on the existing scoped
frontend bundle (_frontend_export_payload/ frontend import), wrapped in a
network API that mirrors the remote-restore security shape.Added
FrontendSyncPeermodel (app/models.py) — one paired sibling install:
base_url+ a Fernet-encrypted sharedtoken(the same secret lives on both
installs and authenticates traffic in both directions, constant-time compared)allow_inbound(off by default; gates whether this install will serve a
pull or accept a push) +last_pulled_at/last_pushed_at/last_inbound_at
audit columns. Kept in its own table rather than onSiteSettingso a
frontend_*column can't sweep the token into the synced bundle. New table is
auto-created bydb.create_all()at boot — no_migrate_sqliteentry needed.- Inbound API on a new CSRF-exempt
frontend_sync_bpblueprint
(app/routes.py, registered + exempted inapp/__init__.py), token in the
X-Frontend-Sync-Tokenheader, rate-limited per IP via
LoginFailure(kind="frontend_sync"):GET /api/v1/frontend-sync/ping
(reachability + version probe),GET /api/v1/frontend-sync/pull(streams a
scoped bundle),POST /api/v1/frontend-sync/push(snapshots the current
frontend, then applies the pushed bundle, returning a JSON summary). - Outbound client (
app/frontend_sync.py) —ping/pull_from_peer/
push_to_peerusingrequests, with friendly error mapping (unreachable,
bad token, rate-limited, version mismatch) and audit-timestamp updates. - Admin UI — a "Frontend staging sync" card in Settings → Data
(app/templates/base.html) with peer label / base URL / shared-token fields,
a Generate token action, an Allow inbound toggle, and
Test connection / Pull from peer / Push to peer actions (typed
REPLACEconfirm). Backed by four@admin_requiredroutes
(/settings/frontend-sync/{save,test,pull,push}). The configured peer is
injected into templates viainject_globals. - Pre-apply snapshot (
_frontend_sync_snapshot) — the receiving side writes
a FULL frontend bundle (including Stories) to
<data>/frontend-sync-snapshots/frontend-pre-sync-<stamp>.zipbefore applying
(pruned to the 10 most recent), so any sync is reversible via the existing
Frontend bundle import.
Changed
- Refactored the existing frontend export/import into reusable helpers shared by
the manual admin forms and the new sync (app/routes.py):
_frontend_export_payload(include_stories=…)(omits thestorieskey for the
presentation+pages sync scope — import already no-ops when it's absent),
_write_frontend_bundle_zip(dest, include_stories)(manifest now records a
sync_scope), and_import_frontend_bundle_zip(zip) -> (ok, summary). The
/settings/frontend-importform route is now a thin wrapper over the helper;
its REPLACE-confirm + flash behavior is unchanged.
-
2.11.1Jun 8, 2026
Makes the hour-of-day charts read in the portal's configured timezone
instead of UTC. Both the Watchtower "Failed logins · last 24 hours" chart and
the frontend visitor-metrics "Hour of day" chart now bucket by the IANA zone
set in Settings → Server Timezone (SiteSetting.timezone), so the busy-hour
bars line up with the fellowship's wall clock rather than the host's UTC.Changed
- Visitor "Hour of day" distribution (
visitor_metrics.hourly_distribution)
shifts each UTC timestamp by the site's current offset inside the SQLite
strftimerollup, keeping the aggregation server-side. The chart caption and
CSV export section now show the active zone label (e.g.EDT) in place of the
old hard-codedUTC. (app/visitor_metrics.py,app/templates/watchtower/visitors.html,app/routes.py.) - Watchtower failed-login hourly chart (
watchtower.hourly_failed_logins)
builds its rolling 24-hour window and buckets per row in site-local time
(DST-correct), and the card now labels the active zone. (app/watchtower.py,
app/templates/watchtower/overview.html,app/routes.py.) - New
site_offset_seconds()andsite_tz_label()helpers inapp/timezone.py.
Note: SQLite has no IANA-tz support, so the visitor chart applies the zone's
current offset — a window straddling a DST change is approximate by one hour
at the boundary. The Watchtower chart converts per row and is fully DST-correct. - Visitor "Hour of day" distribution (
-
2.11.0Jun 7, 2026
Adds remote restore: the off-site TS Pro Backup server can push a stored
backup back into this portal on operator request — out-of-band recovery for a
corrupted database, a locked-out admin, or an accidental login/IP lockout, when
you can't drive a restore from inside the portal. Off by default; the admin
opts in per backup target. Pairs with TS Pro Backup 1.3.0+.Added
- Inbound remote-restore API (
POST /api/v1/restore,/restore/chunk,
/restore/finalize), served on a dedicated root-level blueprint
(restore_bp) and CSRF-exempt — it's machine-to-machine, like the upload
side. It is deliberately not behind the admin session (that's the access
that's unavailable in a lockout). It reassembles the pushed archive, decrypts
it, and applies it through the existing_perform_data_import()(which swaps
the DB + uploads +zoom.key, runs migrations, clears login lockouts,
scrubs domain-bound Turnstile, and recycles workers). (app/routes.py.) - Auto-pairing. When remote restore is enabled on a TS Pro Backup target,
TSProBackupBackend.open()(and "Test connection") publish this portal's
public URL + a shared restore token to the backup server via its
POST /api/v1/registerendpoint — best-effort, so a registration hiccup
never blocks a backup. (app/backup_backends.py,app/routes.py.) - Admin opt-in on the backup-target edit form: an "Allow remote restore"
toggle plus a public URL field (off by default). Enabling mints the token;
the next save / test publishes it. (app/templates/backups_edit.html.) pubkey.public_from_private()— derives thetsppk_…public key from a
tspsk_…private key, used to verify a supplied restore key matches the key
on file before any destructive action. (app/pubkey.py.)
Security
- Two independent secrets gate every inbound restore. The push must carry
the per-target restore token (X-Restore-Token, constant-time compared,
Fernet-encrypted at rest) and a private key that both decrypts the
archive and derives to the target's storede2ee_public_key— checked
before any DB swap. A stolen token alone cannot push an attacker-crafted
archive. Failed attempts are rate-limited per IP (a distinctLoginFailure
kind, so it never interferes with the console login limiter) and audit-logged.
The supplied private key is used in-memory only — never stored or logged.
Schema
BackupTargetgainsallow_remote_restore,restore_token_enc,
public_url, andlast_remote_restore_at(additive boot migration).
- Inbound remote-restore API (
-
2.10.10Jun 7, 2026
Fixed
- Visitor IPs behind Cloudflare are now recorded correctly instead of the Cloudflare edge IP. With the app fronted by Cloudflare (→ Caddy → gunicorn), the login log, Watchtower 404 tracker, IP-block gate, activity log, and form submissions were all recording a Cloudflare address (e.g.
172.71.x.x) rather than the real visitor — becauseProxyFix(x_for=1)peels back only oneX-Forwarded-Forhop, but Cloudflare adds a second. A new_CloudflareRemoteAddrWSGI shim (installed inside ProxyFix) rewritesREMOTE_ADDRfrom Cloudflare'sCF-Connecting-IPheader — a single, Cloudflare-set value holding the true client IP, immune to the XFF hop-count guesswork and to client-supplied XFF spoofing. Because every IP consumer readsrequest.remote_addr, all of them are corrected at once. Falls back cleanly to the previous XFF behaviour when the header is absent, is only active when a proxy is trusted (TSP_TRUSTED_PROXIES> 0, the default), and can be disabled withTSP_TRUST_CF_HEADER=0for non-Cloudflare proxies. Already-logged rows are not rewritten. (app/__init__.py.)
Changed
-
The Watchtower 404s tab won't let you block an IP a real user signed in from. To avoid accidentally 403-ing a legitimate visitor out of the portal, every IP shown on the 404s tab (the Top-missing-URLs expandable IP list and the Recent-404s table) is now cross-referenced against successful logins from the last 30 days. If a user signed in from that IP, the 404 row still shows but its "Block" button is greyed out and disabled, with a tooltip explaining why and naming the user (e.g. "Can't block — jason signed in from this IP in the last 30 days…"). The
/watchtower/ban-iproute enforces the same guard server-side for the 404 flow (the Access / Overview block forms are unaffected, so an admin can still deliberately block such an IP there). Two batched helpers (recent_login_user_ips/recent_login_user_for_ip) resolve the IP→username map without N+1 queries. (app/watchtower.py,app/routes.py,app/templates/watchtower/not_found.html,app/templates/watchtower/_not_found_ips.html.) -
Blocking an IP from the Watchtower 404s tab no longer reloads the page. Under Watchtower → 404s → Top missing URLs, expanding a missing URL lists the IPs hitting it, each with a "Block IP" button. Clicking Block used to POST the form and reload the whole tab, throwing you back to the top of the list. It now blocks via
fetch(the/watchtower/ban-iproute returns JSON when called withAccept: application/json) and swaps that row in place for a "Blocked" chip with a small confirmation toast — so the expanded list stays open and you can keep working down it, blocking more IPs without losing your place. The no-JS form path still posts-and-redirects as before. (app/routes.py,app/templates/watchtower/not_found.html,app/templates/watchtower/_not_found_ips.html.)
Added
- A public "Copy URL" button on the event and meeting detail pages. The event/announcement/archive detail head (
classicevent template) and the meeting detail head (classicmeeting template) now show a "Copy URL" pill to the right of the category chips, above the title. It carries a link icon and copies the canonical page URL (request.base_url) to the clipboard, flashing green to confirm. The button reuses the existing.fe-copy-btnclipboard handler (navigator.clipboardwith thedocument.execCommandfallback for plain-HTTP LAN access), so it works in non-secure contexts. Styled as a.fe-copy-url-pill— a pill matching the.fe-meeting-typechip height with a slight 1-px border like the "Edit" shortcut. Visible to everyone (not role-gated). On the meeting head the chip + button are wrapped in a new.fe-meeting-detail-chipsflex row. (app/templates/frontend/events/classic.html,app/templates/frontend/meetings/classic.html,app/static/css/frontend.css.)
- Visitor IPs behind Cloudflare are now recorded correctly instead of the Cloudflare edge IP. With the app fronted by Cloudflare (→ Caddy → gunicorn), the login log, Watchtower 404 tracker, IP-block gate, activity log, and form submissions were all recording a Cloudflare address (e.g.
-
2.10.9Jun 5, 2026
Changed
- The dashboard's "Currently Online" count and the User Log live widget now track only real page views — not asset fetches. Presence was recorded by a
before_requestblocklist that tried to enumerate every asset route by endpoint-name suffix (_image,_logo,_favicon, …) and URL file extension. Routes that didn't fit the naming convention slipped through — notably the home-screen icon endpoints (site_apple_touch_icon/site_frontend_apple_touch_icon, whose names end in_iconand whose URLs carry no extension), so a browser quietly refetching/site-branding/apple-touch-iconkept its user pinned as "online" and parked their live location on a non-page URL. Tracking moved to anafter_requesthook gated on the response itself: presence is recorded only for a200 text/htmlresponse. That definitively excludes icons, images, PDFs, file downloads, JSON API/metrics polls, redirects, and error pages — regardless of how the serving route or its URL is named — and it's self-maintaining, so any future asset endpoint is excluded for free. The throttle/change-detection behaviour is unchanged. (app/routes.py, comment sync inapp/auth.py.)
Added
- Sidebar and dashboard attention chips now update live, without a page reload. The number chips on the backend sidebar (per-section nav badges, the Watchtower quick-nav chips, the Notifications bell) and the dashboard widget badges (Access Requests, Locked Accounts, Off-site Backups, Forms) used to reflect new submissions/requests only on the next full page load. They now poll a new
GET /tspro/_live/countsendpoint every 20 s (and immediately when a backgrounded tab regains focus) and reconcile each chip in place — so a chip appears, increments, and disappears on its own as work arrives and is cleared. The counts come from one shared helper (_attention_counts()) that also seeds the initial render, so a polled value can never drift from what the page first showed; every count stays role-gated exactly as the rendered chip is. Chips now always exist in the DOM (hidden at 0) and carry adata-live-chipkey; the poller only flips the number + thehiddenflag, never replacing elements, so bound handlers (dashboard drag-reorder, the Notifications modal trigger) are untouched. Dashboard-only counts (failed backups, forms attention) are requested via?dash=1only while the dashboard is on screen, keeping every other page's poll cheap. Also fixed a latent CSS issue where.nav-badge'sdisplayoutranked the UA[hidden]rule, so an always-rendered chip wouldn't hide at 0 (.nav-badge[hidden] { display: none }).
- The dashboard's "Currently Online" count and the User Log live widget now track only real page views — not asset fetches. Presence was recorded by a
-
2.10.8Jun 2, 2026
Fixed
- Encrypted off-site backups no longer crash the worker ("server offline") on large archives.
encrypt_archive_file()read the entire archive into memory and calledFernet.encrypt()on the whole blob — peak memory ran to ~1 GB+ for a ~294 MB archive (input + ciphertext + a ~33%-larger base64 token + copies), which OOM-killed the gunicorn worker (SIGKILL / exit 137) mid-request and surfaced in the browser as a "server offline" error after a long pause. Encryption (and the matching decrypt on restore) is now streamed in 4 MiB chunks — each chunk is one length-prefixed Fernet token — so peak memory stays flat (~200 MB total process, independent of archive size; a 4 GB backup encrypts in the same footprint as a 4 MB one). Measured: the 294 MB archive now encrypts in ~2 s instead of being killed. The on-disk format is bumped to v0x02; the legacy v0x01 single-token format is still readable bydecrypt_archive_file, so encrypted backups taken before this change still restore. Affects every passphrase-encrypted target (FTP/SFTP/Dropbox); TS Pro Backup was already streamed (app/pubkey.py) and was unaffected. - Dropbox backup wizard no longer shows a spurious "connection failed" error on the first "Continue to schedule" click. The wizard's "Test connection" button submits the form first — which exchanges the Dropbox one-time authorization code for a refresh token and stores it — then tests. Because the auth-code field still held the now-spent code, clicking "Continue to schedule" re-submitted it, and
backups_wizard_step2_posttried to exchange the single-use code a second time, which Dropbox rejects; the second click then worked only because the redirect had cleared the field.step2_postis now idempotent: if an auth-code exchange fails but a working refresh token is already stored, the spent code is treated as a harmless stale value and the wizard proceeds, instead of blocking with a misleading error. (A genuine first-time failure — no stored token and a bad code — still blocks and surfaces the error.) The wizard also now clears the consumed auth-code field after a successful test, avoiding the redundant exchange entirely.
- Encrypted off-site backups no longer crash the worker ("server offline") on large archives.
-
2.10.7Jun 2, 2026
Added
- Disk-space tile on the dashboard Server widget. The admin-only Server widget (Dashboard → "Your Role and Server Stats") gains a Disk tile alongside CPU and Memory, showing percent used plus
used / total(e.g. "92 GB / 196 GB") and a sparkline. Measured on the data volume (DATA_DIR— the disk that actually fills, since the DB, uploads, and backups all live there), falling back to the host root. The tile turns amber at ≥85% — the same threshold as the low-disk banner and Notification Center entry — so the dashboard reads as a live monitor at a glance.metrics.snapshot()now takes an optionaldisk_pathand returnsdisk_total/disk_used/disk_percent;/api/server-metricspasses the configured data dir. The admin metrics grid widens from 5 to 6 tiles (server-metrics-grid-6), with the responsive breakpoints updated to match. Admin-only by construction (the whole Server column is gated onis_admin()).
- Disk-space tile on the dashboard Server widget. The admin-only Server widget (Dashboard → "Your Role and Server Stats") gains a Disk tile alongside CPU and Memory, showing percent used plus
-
2.10.6Jun 2, 2026
Added
- Daily image-prune janitor (
docker-prunecompose service). A new sidecar in both production compose definitions (install.sh's generateddocker-compose.ymlanddocker-compose.deploy.yml) runsdocker image prune -af --filter until=72handdocker builder prune -af --filter until=72honce a day. This is the actual guarantee against the disk-fill class of failure:WATCHTOWER_CLEANUP=trueonly reclaims images from updates Watchtower itself performs, so images orphaned by manualdocker compose pull, re-tagged:latestchurn, or partial pulls accumulate unbounded (a long-lived box was observed with 170 images / ~20 GB reclaimable on a full 24 GB disk). The janitor sweeps everything unused for >72h regardless of how it was orphaned. It mountsdocker.sock(same privilege Watchtower already holds); the prune is host-wide, so it's intended for a dedicated TSP host. Left out of the devdocker-compose.yml, where a host-wide prune would disrupt other local projects. - Low-disk-space warning for admins. New
app/diskcheck.pyruns a cached (5-min TTL), log-throttled (hourly)shutil.disk_usage()check on the data volume and host root, de-duplicated by device id. When either crosses 85%, admins see a banner on every admin page (base.html, gated in both theinject_globalscontext processor and the template) and adisk_space:lowentry in the Notification Center (app/notifications.py, inside the admin-only source block). The notification uses a stable key so a dismissal sticks until the condition clears (then re-surfaces if it crosses again via the existing prune-on-resolve logic), while its body re-derives each render so the figures stay live. AWARNINGis logged when the threshold is first crossed. Both surfaces are strictly admin-only — verified for admin (shown), viewer (hidden), and anonymous (hidden).
Changed
- README's "Keeping disk usage in check" section documents the new prune janitor and the admin low-disk warning, and notes that re-running
install.shadopts the janitor on existing installs.
- Daily image-prune janitor (
-
2.10.5Jun 2, 2026
Changed
- Deployment hardening so an unattended host can't fill its own disk. Two compounding gaps could fill a server's disk over months of unattended operation, after which every disk-backed operation failed — including off-site backups (
database or disk is full) and evendocker compose pull(no space left on device): - Container log rotation. All three compose definitions (
install.sh's generateddocker-compose.yml,docker-compose.deploy.yml, and the devdocker-compose.yml) now setlogging: { driver: json-file, options: { max-size: 10m, max-file: 3 } }on every service. Docker's defaultjson-filedriver is unbounded; on a long-running box the container writable layers had grown to multiple GB of unrotated logs. - Watchtower image cleanup (documented + reinforced).
install.shalready setWATCHTOWER_CLEANUP=true, but installs predating that flag accumulate one stale image per 24-hour auto-update — a long-lived box was observed with 170 images (167 unused, ~20 GB reclaimable) filling a 24 GB disk. Added an explanatory comment in the generated compose and a new "Keeping disk usage in check" section in the README documenting the settings and the manual remediation (docker image prune -af/docker builder prune -af, then re-runinstall.shto adopt the hardened compose) for boxes that predate them. - No application code changed in this release; it is compose/installer/documentation only. (Existing deployments must refresh their
docker-compose.yml— re-runinstall.sh— to pick up the new settings, sincedocker compose pullonly updates images, not the compose file.)
- Deployment hardening so an unattended host can't fill its own disk. Two compounding gaps could fill a server's disk over months of unattended operation, after which every disk-backed operation failed — including off-site backups (
-
2.10.4Jun 2, 2026
Fixed
- Off-site backups no longer fail with
database or disk is fullwhen the system temp dir is small.build_export_archive()staged its scratch files — theVACUUM INTOcopy of the database and the in-progress zip — in the system temp dir (/tmp) viatempfile.NamedTemporaryFile()with nodir=. On many production hosts/tmpis a small tmpfs or a space-constrained container overlay, whileVACUUM INTOneeds roughly the full database size in free space at the destination; once a portal's archive grew large enough the export aborted with(sqlite3.OperationalError) database or disk is full [SQL: VACUUM INTO '/tmp/tsp-export-…db'], taking down every off-site target (TS Pro Backup, Dropbox, FTP/SFTP) since they all build the same archive first. Scratch files now stage on the data volume (UPLOAD_FOLDER's parent — the same mount that holdstsp.dbanduploads/, so headroom is guaranteed), with the encrypted-restore decrypt (decrypt_archive_file) and the TS Pro Backup e2eeput()ciphertext staging alongside their source files for the same reason. A new optionalTSP_TMP_DIRenv var overrides the scratch location for installs that mount a dedicated scratch volume; if the chosen directory isn't writable the code falls back to the system temp dir.
- Off-site backups no longer fail with
-
2.10.3Jun 2, 2026
Added
- Contact and Recovery Contacts pages now honour the Dynamic Background picker (Settings → Web Frontend → Templates). Both pages previously hard-coded the
aurora-blobsbackdrop directly in their templates, so the backdrop couldn't be changed from the admin. They now resolve their dynamic background from the same per-template settings every other list/detail surface uses —template_settings(site, 'contact', 'split')andtemplate_settings(site, 'recovery_contacts', 'default')— and apply it throughfrontend/_dynbg_apply.html(recipe + custom colours + overlay + per-preset knobs). The admin picker and its save path (frontend_template_settings_save) already existed for both surfaces; only the public templates (frontend/contact.html,frontend/recovery_contacts.html) were ignoring the saved value. Each page defaults toaurora-blobswhen nothing is saved, so existing sites render identically until an admin picks something. (The/chatpage is a regularPageand was already dynbg-configurable via the page editor, so it was left as-is.) - Colour-coded backend chips on the Manage Backups screen. Each configured off-site target now shows a prominent, colour-coded chip with an icon and friendly name — TS Pro Backup (shield/indigo), SFTP (server/green), FTP/FTPS (server/slate), Dropbox (box/sky) — beside its status pill, replacing the tiny muted
· FTPbackend code so the backend each target uses reads at a glance (backups_list.html+ a new.backup-kind-chiprule set inapp.css, dark-mode aware; FTP rows showFTPSwhen TLS is on).
Changed
- Redesigned the off-site backup connection edit screen. The edit form now leads with a prominent connection-type banner — a large kind icon, the friendly backend name, a one-line description, and a status badge ("End-to-end encrypted", "FTPS · TLS encrypted", "SSH file transfer", "Cloud storage") — instead of a tiny muted backend code. Fields fill the panel width and are sized up (the setup wizard's 720px card cap is dropped on this screen), with endpoints, hosts, and remote paths rendered in a monospace face so long strings read clearly. All new styling is scoped under
.backup-edit, so the setup wizard is untouched. - Moved the WordPress importer card to the bottom of Settings → Data. It now sits below the everyday data tools (full archive, frontend bundle, off-site backups, database snapshots) since it's a one-off migration aid rather than routine maintenance.
Fixed
- Off-site backup targets no longer get stuck showing "Running" forever.
run_target()runs synchronously: it flips the target's status mirror (and theBackupRunrow) torunning, uploads, then flips took/failed. If the process was interrupted mid-run by a restart — a deploy, OOM, or a long upload that overran a worker timeout (a scheduled 3 AM run is a prime candidate) — the final flip never happened and the pill read "Running…" indefinitely with no recovery path. The scheduler now reconciles orphanedrunningrows on boot (only the lock-winning worker does this, so workers don't race): each interruptedBackupRunis markedfailedwith an "Interrupted — the server restarted while this backup was in progress." message and afinished_at, and every affected target's status mirror is resynced to its most recent resolved (ok/failed) run, ornever_runif none.
- Contact and Recovery Contacts pages now honour the Dynamic Background picker (Settings → Web Frontend → Templates). Both pages previously hard-coded the
-
2.10.2Jun 1, 2026
Added
- TS Pro Backup — an off-site, end-to-end-encrypted backup destination. A fourth backup
kind(tspro_backup) joins FTP/SFTP/Dropbox, targeting a dedicatedtspro-backupserver over its/api/v1HTTP API. Newapp/pubkey.pyimplements the client half of a hybrid ECIES scheme (TSPEPK01envelope): ephemeral X25519 → HKDF-SHA256 → AES-256-GCM, streamed in 1 MiB blocks so multi-GB archives cost O(1) memory. The backup server issues each site an X25519 keypair and advertises the public key via/api/v1/ping;TSProBackupBackend(inbackup_backends.py) encrypts every archive to that key before upload, so the server only ever stores ciphertext it cannot read. The matching private key is held by the operator out-of-band and is only ever supplied at restore — it is never stored in the portal. NewBackupTargetcolumnsapi_base_url,api_key_enc(Fernet), ande2ee_public_key(additively migrated); the backend learns chunked-upload capability + chunk size from/pingand splits large ciphertext so a body-size-limited proxy (e.g. Cloudflare's 100 MiB cap) can't reject it. - Wizard + edit integration. The backup wizard gained a TS Pro Backup option on step 1; step 2 collects the API endpoint + per-site key; Test connection pings the server, pins its current public key on the target, and shows the key's fingerprint (
tspro_fpJinja filter) so the admin can confirm it against the backup server's console. A server-side key rotation is surfaced as an error rather than silently re-pointing backups at an undecryptable key. The encryption-at-rest step is replaced by an "end-to-end encrypted automatically" notice (the passphrase layer is never double-wrapped on top ofTSPEPK01). - Restore + recovery. The target's Restore page accepts the site's
tspsk_…private key and decrypts by content (magic bytes), not file extension. The data-import flow (_decrypt_if_encrypted) also learned theTSPEPK01envelope, so an operator can recover directly from a downloaded.encby pasting the private key into Settings → Import even when the Restore page isn't reachable. Legacy passphrase bundles (TSPENC01) continue to work unchanged. - Watchtower notification chips are now pinned to the tab that owns them, plus a "Needs attention" widget on the Overview. The sidebar Watchtower quicknav button already showed a combined attention count, but once an admin clicked through there was nothing indicating which of the six tabs the number lived in. Each attention source now renders a colour-coded chip on its owning tab in
templates/watchtower/_tabs.html—recovery_contacts_abuse_count(danger/red) on Overview (where the flagged-requests panel lives),locked_accounts_count(blue) on Access, andpending_access_count(warn/amber) on Requests — using the same three counts already provided byinject_globals(), so no new queries were added. The Overview also gained a Needs attention card (templates/watchtower/overview.html) that lists every active item with an icon, count badge, one-line description, and a clickable row linking straight to the area needing attention (#wt-rc-abuse,/watchtower/requests,/watchtower/access); it collapses to a green "All clear" line when nothing is pending.
Fixed
- Synchronous backup runs no longer 500 with
DetachedInstanceError. The "run now" button and the wizard's first run readrun.statusafter the app context (and its session) tore down, raising on a detached instance whose attributes had been expired by commit — masking the real outcome.run_target()nowrefresh()es andexpunge()es the row before returning so the status stays readable after detach. .nav-badge-warnnow renders amber instead of brand-blue. The warn modifier was defined before the base.nav-badgerule inapp.css, so the base brand-blue background overrode it by source order (the same trap.nav-badge-dangeralready sidestepped by being defined after the base). Moved the warn rule below the base so the amber colour wins everywhere it's used — including the new Watchtower Requests-tab chip and the existing pending-access quicknav chip.
- TS Pro Backup — an off-site, end-to-end-encrypted backup destination. A fourth backup
-
2.10.1May 31, 2026
Added
- API-relay connection test + live status pill (Settings → Domain / Email). The API-relay transport gained a Test connection button and a colour-coded status pill (Connected / Not connected / Not tested) that surfaces the relay's reachability and API-key validity without sending a message. The Test button validates the URL + key typed into the form before they're saved; opening the Email tab re-probes the saved relay so the pill reflects the live connection, and a failure shows the underlying reason (a rejected key, an unreachable host, etc.). Backed by a new
POST /settings/relay-testroute andapp/mail.py'srelay_health(), which calls the relay's Bearer-authenticatedGET /api/health(added inhyprlab/tspro-relayv0.1.1) and falls back to an auth-onlyPOST /api/sendprobe for older relays — so the key is still validated without delivering mail. NewSiteSettingcolumnsrelay_status,relay_status_detail, andrelay_checked_at(additively migrated) persist the last outcome for the pill's initial render.
Changed
- Saving changed relay credentials clears the cached connection-test result, so the pill never claims "Connected" against a URL or key that no longer applies — the Email tab re-probes on its next open to refill it.
- API-relay connection test + live status pill (Settings → Domain / Email). The API-relay transport gained a Test connection button and a colour-coded status pill (Connected / Not connected / Not tested) that surfaces the relay's reachability and API-key validity without sending a message. The Test button validates the URL + key typed into the form before they're saved; opening the Email tab re-probes the saved relay so the pill reflects the live connection, and a failure shows the underlying reason (a rejected key, an unreachable host, etc.). Backed by a new
-
2.10.0May 30, 2026
Added
- Email relay transport — an alternative to direct SMTP for hosts that block outbound SMTP ports (e.g. DigitalOcean). Under Settings → Domain / Email, a new Sending method selector toggles between Direct SMTP and API relay (HTTPS). In relay mode the portal POSTs each message as JSON over HTTPS to a companion relay container (
hyprlab/tspro-relay) that performs the actual SMTP delivery, so SMTP credentials never need to live on the app host. NewSiteSettingcolumnsmail_transport,relay_url, andrelay_api_key_enc(Fernet-encrypted, additively migrated); the API key field follows the same "leave blank to keep / clear" pattern as the SMTP password. SiteSetting.mail_ready()— a transport-aware helper that reports whether outgoing mail is configured for the active transport (relay needs a URL + From address; SMTP needs a host + From address).app/mail.py'ssend_mail()now branches onmail_transport, with_send_via_relay()handling the HTTPS POST (base64 attachments, Reply-To, JSON error surfacing).
Changed
- All notification call-sites now gate on
mail_ready()instead ofsmtp_host, so access-request emails, contact-form sends, recovery-contact alerts, and backup-failure alerts all work under either transport. The frontend Reply-To sender delegates to the relay in relay mode. - The Email settings UI hides the SMTP server fields when API relay is selected (and shows the relay URL / key fields instead), driven by the sending-method toggle, so only the relevant fields are visible. The test-send reports which transport it exercised.
- Email relay transport — an alternative to direct SMTP for hosts that block outbound SMTP ports (e.g. DigitalOcean). Under Settings → Domain / Email, a new Sending method selector toggles between Direct SMTP and API relay (HTTPS). In relay mode the portal POSTs each message as JSON over HTTPS to a companion relay container (
-
2.9.5May 30, 2026
Added
- Guided Zoom Meeting launcher — a stepped, blur-backdrop wizard on the backend meeting detail page. Online/hybrid meetings gain a Launch Zoom Meeting (Guided) button above the Zoom ID/passcode block that opens a modal walking a host through three steps: Sign in (warns hosting needs a Mac/Windows/Linux desktop — not iOS/Android/Chromebook — and shows the assigned account login + click-to-copy password with reveal), Get code (reminds the user to click "Or alternatively, Verify via one-time passcode" rather than "Allow on other devices", then retrieves the OTP — see below), and Start the meeting (a Launch button on the start URL plus Meeting ID/passcode to copy, and a caveat to sign out of any other Zoom account in the browser first). Each step carries an annotated screenshot that opens in a lightbox; the stepper circles at the top are clickable (and keyboard-accessible) to jump between steps.
- Automatic OTP-code retrieval over IMAP (
app/otp_fetch.py). A new fetcher logs into the shared OTP inbox read-only (IMAPEXAMINE— never marks mail read), finds the freshest Zoom sign-in code, parses the 6-digit passcode, and returns it with the email's own timestamp. Stripping<head>/<style>/<script>first keeps embedded CSS/font-URL digits from polluting the search, and a hint-scored extractor (anchored on "expire", "passcode", "verification"…) isolates the real code over stray numbers (map coordinates, dates, phone numbers, zips). Backs the wizard's Step 2, an inline Retrieve latest code button on the meeting detail OTP Email section, and the OTP Email widget on the Zoom Accounts page — all sharing oneinitOtpFetch()handler via a[data-otp-widget]container, so seasoned hosts can pull a code in place without opening the wizard. - IMAP mailbox settings in Settings → Security → Zoom OTP Email. The existing OTP-email credentials gained IMAP server / port / SSL / optional username / mailbox / optional app-password fields (encrypted via Fernet, additively migrated). Username/password fall back to the email + password above when left blank.
- Location now resolves to its full address with an Open-in-Maps link. The meeting detail Location card shows the saved Location's complete address (not just the name) plus an Open in Maps button (the record's
maps_url, else a Google Maps search). Resolution moved to the route with tolerant matching (exact normalized match, then a difflib similarity ≥ 0.86 fallback) so a one-character typo in the meeting's free-text location still resolves.
Changed
- The "Retrieve latest code" button now polls the inbox for up to 3 minutes. Zoom is slow to send the passcode email, so a single check usually came up empty. Clicking Retrieve now keeps checking every ~6 seconds (showing a spinner and "Checking for code…") until a code lands or 3 minutes elapse; it stops early on a configuration/login error. Backed by a new
retryableflag on the fetch response (the "no email/code yet" and transient-network cases are retryable; config/login errors are terminal). Copy updated to "it may take up to a minute to retrieve a code". - A live expiry countdown is shown next to a retrieved code. Zoom codes die 10 minutes after the email is sent, so the fetch response carries
expires_in_seconds(600 − age) and the client renders a tickingm:sscountdown beside the code — green normally, amber under a minute, and a red "Code expired — request a new code from Zoom." at zero. Wired into all three retrieve spots (wizard, meeting detail, Zoom Accounts) via the sharedinitOtpFetch()handler. - OTP section renamed to "Zoom One-Time-Passcodes (OTP)" everywhere it appears (meeting detail, Zoom Accounts page, Settings → Security), and on the meeting detail page it's wrapped in a
zg-cardpanel matching the Schedule/Location cards. - Meeting detail page restyled into a balanced two-column card layout. The Zoom section is wrapped in its own
data-card(brand-accent panel) in the right column, the full-height vertical divider is gone, the logo moved into the left column so the Zoom card rises to the top, and the Schedule and Location sections sit in their own card-style containers. The 50/50 grid is preserved even for in-person meetings (the right column simply renders blank). - OTP code freshness window tightened to 10 minutes, and the newest code always wins when several arrive in the window (ranked by Zoom-origin, then code confidence, then recency — so a genuine code can't be hijacked by a stray number in a newer non-code notice).
- Click-to-copy chips render in Inter with normal letter spacing, and the "Click to copy" tooltip now has a green background.
Fixed
- OTP search no longer misses codes near the UTC midnight boundary. IMAP
SINCEcompares against each message'sINTERNALDATEin the mail server's timezone (DreamHost is US-Pacific), so a code arriving just after UTC midnight was dated the previous day server-side and excluded. TheSINCEwindow is widened by a day to absorb any server offset; the precise per-message UTC timestamp check still enforces the real freshness window. /api/live-meeting(and any/api/*background poll) no longer skews visitor metrics. The utility bar polls/api/live-meetingevery 30s on every public visitor; those machine requests were being recorded asVisitorEventrows and inflating totals and the top-paths list._should_skipnow drops all/api/*requests at record time, and a shared_NO_APIclause excludes any historical/api/*rows from every aggregation (totals, daily series, uniques, top paths/referrers, device/browser/OS donuts, hourly distribution) — non-destructively, without deleting the rows.
-
2.9.4May 29, 2026
Added
- Dynamic-background picker reorganised into Background + Options tabs with a live preview. The modal now leads with a fixed preview band (
.dynbg-modal-preview, a sibling between.modal-headand the scroll body so it sits flush under the title bar and nothing scrolls above it) that re-renders on every settings change — preset, overlay, colours, pastel strength, randomize toggles, and per-preset knobs all repaint the sample in place. The Options tab merges the former Overlay + Colours panels and only shows the controls that apply to the active preset (driven by a newPRESET_CAPScapability spec stamped onto the panel asdata-dynbg-preset-capsJSON), so admins never see a knob that does nothing for the chosen background. - Per-preset tuning knobs. A generic
knobsJSON dimension (validated/scoped bydynbg.normalize_knobsagainstPRESET_CAPS, stamped as CSS custom properties byknobs_to_css_vars) carries each preset's sliders without per-field plumbing. Dotted grid exposes Dot size / Spacing / Rotation / Opacity; diagonal lines exposes Angle / Spacing / Opacity / Thickness. Round-tripped end-to-end throughroutes.py,frontend.pytemplate settings, the block editor, and the page-hero modal. - Size + Intensity on every texture overlay. Previously only Noise grain was tunable; Scanlines, Linen, Vignette, Crosshatch, and Dot weave now each expose a Scale (
--fe-dynbg-ov-scale) and Intensity (--fe-dynbg-ov-opacity) slider via the newOVERLAY_KNOBSspec, with per-overlay slider bounds set in the modal. Defaults of ×1 reproduce the original look so existing saves render unchanged. - Foreground/background colours for the pattern presets. Dotted grid and diagonal lines are now two-colour presets labelled Dots/Lines + Background — Colour 1 (
--fe-dynbg-c1) drives the dot/stroke colour and Colour 2 (--fe-dynbg-c2) the surface fill (light + dark). Custom colours now actually affect these patterns; leaving a slot blank falls through to the brand token. - Server-randomised picker thumbnails.
dynbg.thumb_style()seeds each catalog tile with a fresh random palette + random positions per page load, so the picker reads as a lively sample set rather than identical brand-default renders. - Animated mobile menu reveal (Recovery Blue). Tapping the hamburger now slides the primary nav dropdown down with an eased fade (
@keyframes feMobileMenuDrop, 280 mscubic-bezier(0.2, 0.8, 0.2, 1)), and the mega-menu panel uses the SAME entrance on mobile (≤ 880 px) regardless of the desktop panel-fade toggle, so opening either reads as one consistent motion instead of a hard cut. Both replay on each open via their.fe-nav-open/.openclass; gated byprefers-reduced-motion.
Changed
- Dynamic-background recipes extracted into a shared
app/static/css/dynbg.css, now linked by both the admin shell (base.html) and the public frontend templates so the picker's live preview and thumbnails render the real recipes. These rules are no longer duplicated infrontend.css— single source of truth. - Unset custom-colour slots display a ∅ null glyph in the picker chips instead of the brand-default blue swatch, so an admin can tell at a glance which slots are overridden vs. falling through to the theme token.
- Default randomize-on for the presets that have movable parts. Aurora blobs / mesh / bands default the randomize-colours (and positions, where applicable) toggles on when first picked; the deliberate fg/bg pattern presets default them off.
- Footer signed-in auth buttons are left-aligned and wrap. The "Return to dashboard" + "Logout" pair in the
admin_loginfooter block now sits left-aligned with a 1 rem gap (was pushed to opposite column edges viajustify-content: space-between+margin-left: auto) and wraps to a second line when the block is too narrow. - More breathing room under the mobile hamburger dropdown. The Recovery Blue mobile nav panel gained an extra 1 rem of bottom padding (
8px 20px calc(16px + 1rem)) below its last button.
Removed
- Retired the Starfield, Noise paper, and Spotlight glow base backgrounds. All of their catalog entries, CSS recipes, and supporting code were removed. The six texture overlays (Noise grain, Scanlines, Linen, Vignette, Crosshatch, Dot weave) are unaffected. Any surface previously set to one of the three retired presets falls back to "no dynamic background" (its solid colour / uploaded image still renders).
Fixed
- Dotted-grid rotation now tiles across the whole surface instead of a narrow band. The dots layer was only oversized
inset: -30%(≈1.6×), so on a wide/short (or tall/narrow) surface a near-90° rotation shrank the dotted region to a band the width of the short side — a per-axis-percentage limitation (inset/width %can't size off the longer dimension)..fe-dynbg-dotted-gridis now a CSS size query container and the dots layer is a centred square sized200cqmax(2× the host's longest side); a centred square of side 2·max always exceeds the host's diagonal, so the lattice fully covers at any angle and aspect ratio. - The pastel-strength slider now live-updates the picker preview. Dragging it re-pastelises the in-modal sample immediately (the admin shell is light mode, so the preview applies the pastel directly to
--fe-dynbg-cN) instead of only taking effect after save. - Recovery Blue header is now fully sticky on mobile. The shared headroom script still slides the header up on scroll-down at desktop widths, but the transform is neutralised at ≤ 880 px (
.fe-header-recovery.fe-header-hidden { transform: none }) so the helpline bar + hamburger stay pinned and reachable while scrolling instead of hiding. - Mobile utility bar no longer reveals a neighbouring item's pill at rest. The horizontal swipe strip's snap "pages" were sizing to their content width — a percentage
flex-basiscollapses to content inside a horizontal scroll container — and the strip retained the header's inline side gutter, so each page was inset and the gutter exposed the adjacent item. Pages now pin to the full viewport viamin-width: 100%(which resolves against the container's definite width), the strip is forced full-bleed withpadding: 0 !important(beating the inline gutter, mirroring the existingmax-width: none !important), andoverflow: hiddenclips any container wider than the viewport so nothing bleeds past a page edge.
- Dynamic-background picker reorganised into Background + Options tabs with a live preview. The modal now leads with a fixed preview band (
-
2.9.3May 28, 2026
Added
- Per-template "Card body preview" setting on the announcements_list and events_list customize panels. New radio + character-count input on
tpl_customize_panel(gated onkind in ('announcements_list', 'events_list')) storescard_body_mode('full' | 'truncated') andcard_body_max_chars(clamped 50..2000, default 200) into the per-template settings leaf viafrontend_template_settings_save. The character input isdisableduntil the truncated radio is selected; an inline IIFE re-gates it on the fly.frontend.py::template_settingswas extended to include the two new keys in its passthrough allowlist — without this the loader silently dropped the keys and persisted saves wouldn't apply on the public render. (Fixed in same commit.) _announcement_card.htmlreads the mode + char cap from_announcements_list_tpl(the dispatcher template's scoped variable). Truncated mode slicesann.bodyvia Jinja'struncate(N, True, '…')BEFORE piping throughmarkdown_block, so the trailing ellipsis lands inside the rendered paragraph. Default mode =full— preserves the legacy render for sites that haven't touched the setting._event_card.htmladds a new.fe-events-card-body-previewblock renderingev.bodyunder the existingev.summaryline, controlled by the same mode + cap pair read from_events_list_tpl. Default mode =truncatedat 200 chars — events historically rendered onlysummary, so an unbounded body would balloon every card; the opinionated default keeps cards compact while letting admins flip to full for long-form previews. The Magazine "More events" tiles force-compact via the include'scompact=trueand bypass the new block entirely.- "Read more ›" link on every list card. Renders unconditionally at the bottom of
.fe-announcements-card-bodyand.fe-events-card-body(and on the Timeline layout's.fe-events-tl-card), independent of body length or truncation setting. Targets the post's detail URL viapost_url(...). New.fe-card-read-moreCSS class — accent-coloured weight 600 text with a›chevron that slides 3px on:hover/:focus-visible(motion gated byprefers-reduced-motion). Timeline variant carriesposition: relative; z-index: 2so the visible link's pointer events win over the card's absolute.fe-events-tl-card-linkoverlay.
- Per-template "Card body preview" setting on the announcements_list and events_list customize panels. New radio + character-count input on
-
2.9.2May 28, 2026
Added
- Pastel-strength slider on the dynamic-background picker. Replaces the previous binary "Use pastels in light mode only" checkbox with an integer 0-100 slider + live numeric readout.
dynbg.normalize_pastel_strength()accepts and coerces legacy booleans (True→ 100,False→ 0), ints, and numeric strings;pastelize(hex_str, strength=100)lerps between the source HSL values and the full pastel target so intermediate slider positions produce intermediate paleness.encode_config()persists the int (omits when 0);decode_config()returns the int (legacy boolean records resolve to 100).colors_to_css_vars()and the per-template settings JSON leaf (bg_dynbg_pastel_light) carry the strength end-to-end. Form-parse paths inroutes.pynow pass the raw form value through and letencode_configclamp. - Themed featured-image elevation on detail pages. New CSS rule on
.fe-event-detail-cover(Classic) and.fe-event-time-cover(Timeline) emits anlgshadow at rest, expanding toxlon:hover/:focus-visible/:focus-within, with the colour driven by new--fe-color-card-primary-shadow+--fe-color-card-primary-shadow-darkCSS variables emitted fromdesign.py::card_chrome_css_vars. Light/dark variants composed viacolor-mix(in oklab, var(--…) <alpha>%, transparent). Transition is a flatbox-shadow 200ms ease(no theme-token indirection so the timing stays predictable across themes). Border on the Classic cover stripped (border: 0) and the legacytranslateY(-3px)hover lift overridden withtransform: none— elevation now reads as pure shadow expansion, no jumping.
Changed
- Detail-page hero is now a 33 % / 66 % split between the featured-image column and the body column (previously a fixed 427 px / 1fr). The fixed
height: 320pxon.fe-event-detail-coverwas also dropped so the cover scales with the column width via itsaspect-ratio: 4/3instead. - Pastel target at strength 100 is now ~50 % paler than the previous all-or-nothing pastel band. The legacy full-pastel target (
min(sat, 0.339), lightness 0.69–0.75) is now halved on saturation and pushed halfway toward pure white on lightness, landing in cream / blush / mint territory.#ff0000at strength 100 now resolves to#ded0d0(was#ca9595). - Meeting detail logo bumped to 240 px on desktop across all four meeting-detail layouts. Both the classic-specific
.fe-meeting-detail-head-logo .fe-meeting-logorule and the shared base.fe-meeting-logorule updated; themax-width: 600pxmobile override (140 px) is preserved.
- Pastel-strength slider on the dynamic-background picker. Replaces the previous binary "Use pastels in light mode only" checkbox with an integer 0-100 slider + live numeric readout.
-
2.9.1May 28, 2026
Fixed
- Dynamic Background picker rendered BEHIND the template-edit modal that triggered it. Both modals had
z-index: 100; same-z-index siblings stack by DOM order. The#dynbg-picker-modallives inbase.html(early DOM), but the per-template settings modal onfrontend_templates.htmlis built dynamically via JS anddocument.body.appendChild'd at runtime — landing AFTER the picker in the DOM, so the picker painted under it. Bumped#dynbg-picker-modal,#media-picker-modal, and#icon-picker-modaltoz-index: 105(above content modals at 100, below the sticky save bar at 110). Future global pickers should join the same selector. - Authenticated users with a public tab open showed as "persistently online on
/api/live-meeting". The utility bar's poller fetches/api/live-meetingevery 30 s (and on every visibility change) when the LIVE-badge toggle is on, and_track_last_seeninroutes.pyonly skippedmain.api_*endpoints — but the live-meeting endpoint lives on the frontend blueprint asfrontend.api_live_meeting, so each poll rewrotelast_pathto/api/live-meetingand refreshedlast_seen_at, keeping the user warm forever. Added a path-based skip (request.path.startswith("/api/")) so background polls on any blueprint's/api/*route are excluded from location tracking. Match by path (not endpoint name) so future API routes on any blueprint inherit the skip automatically.
- Dynamic Background picker rendered BEHIND the template-edit modal that triggered it. Both modals had
-
2.9.0May 28, 2026
Added
- Page draft slot for already-published pages. New
Page.draft_json(TEXT) +Page.draft_saved_at(DATETIME) columns capture an in-flight snapshot of every editable field (title, slug, blocks_json, layout, background, padding, SEO, colors, fonts) without touching the live row.frontend_page_savereads asave_actionform field (publish|draft); thedraftbranch writes a typed snapshot dict todraft_jsonand clears it on the next publish, while thepublishbranch keeps the existing column writes and now also nulls out the draft slot atomically. Uploaded draft assets (bg / og images) still land on disk so a Publish later can reference them; un-published draft uploads are picked up by the daily orphan-cleanup pass.frontend_page_editdetects a stashed draft, deserialises it, expunges the Page from the session, and overlays the draft values onto the in-memory object so autoflushes during the rest of the view can't accidentally persist draft values to the live row. Newfrontend_page_discard_draftendpoint clears the slot. - Edit history for pages with one-click restore. New
PageRevisionmodel —page_idFK with cascade delete,action('draft' | 'publish'),snapshot_json(same shape asdraft_json),created_at,created_by_id(FK to User)._record_page_revision()is called from both save branches;_PAGE_REVISION_LIMIT = 50per page, older rows trimmed in the same transaction. Newfrontend_page_revisionsendpoint returns a JSON list for the editor modal;frontend_page_revision_restorewrites the chosen snapshot intodraft_json(non-destructive — the live row is untouched until the admin Publishes) and logs the restore as its own draft revision for audit. NewHistorybutton +#page-history-modalin the editor renders the list with Draft/Published chips, local-time timestamps, author, and a Restore form per row. - Live-update preview window via opener polling.
frontend/page.htmlinjects a poller (inpreview_modeonly) that readswindow.opener.document.getElementById('page-blocks-json').value, debounces to 500ms ticks, and silently re-POSTs to/_preview/page/<id>when the JSON changes. The fetched HTML replacesdocument.body.innerHTMLin place — inline scripts are cloned+replaced so lottie / dynbg / copy-script init code re-runs. Poller state lives onwindow.__tspPreviewStateso it survives the body swap; an immediate post-fetch re-poll catches keystrokes that landed during the in-flight fetch. Scroll position snapshotted across each swap. Editor side just opens the named preview window once and never re-submits — the preview pulls instead of the editor pushing. - Throttled BlockEditor → hidden-input sync.
editModalinput/change listeners noweditor.serialize()and write to#page-blocks-jsonon a leading-edge + trailing-edge 150 ms throttle so continuous typing in a heading / paragraph keeps the hidden field fresh (and therefore the preview poller's reads accurate). Pure debounce previously only flushed on a typing pause; a long sentence typed without breaks left the preview stuck at the pre-typing value. - Yellow save bar reskinned for the page editor. The page-edit IIFE relabels
#fe-save-bar-btnto "Publish", injects a sibling "Save Draft" button (ghost-style, text + border tinted with the Publish button's fill#422006for a matched-pair look), and wires both to flip#page-save-actionbefore triggering the sharedfeSaveBarsave loop. A__tspViaDraftflag short-circuits the capture-phase reset so the draft proxy click doesn't get overwritten back to publish. - Top-level "Publish draft" shortcut. Conditionally rendered in
top_actionswhendraft_activeis true — same submission path as the yellow bar's Publish button, but visible without needing a dirty edit to expose the save bar. Lets admins publish a stashed draft exactly as-is.
Fixed
- Two-column container scrambled child blocks on save when the cells had different lengths. The save path round-robin-flattened cells into
data.blocksand the load path round-robin-redistributed them, soleft=[A,B]+right=[C,D,E]round-tripped toleft=[A,B,E]+right=[C,D]. CSS grid'sauto-flow: rowcan't express unequal columns; the fix persists cell membership explicitly asdata.cell_lengths: [2, 3](concat-by-cell flat list + per-cell counts). All four touchpoints updated:page_structure.js::rebuildContainerFromRowwritescell_lengths,makeRowSplitslices by it on initial draw,routes.py::_page_active_treeuses it for the structure card render, and the publictemplates/frontend/page.html+templates/_blocks.htmlcontainer blocks emit a.fe-pp-grid-cellflex-column sub-wrapper per cell carryinggrid-column: Nso the actual page renders the layout as built. Legacy data withoutcell_lengthsfalls through to the previous round-robin distribution on every path, so existing pages are unaffected until their first save. - Unplaced blocks bin pills had no background / chrome and blended into the bin. Base
.fe-page-structure .fe-page-structure-blockstyles are scoped to the structure card, but the orphan bin renders inside a separate.fe-page-orphanssection (siblings, not nested), so orphan pills inherited none of the base flex / padding / border / brand-soft bg styling — only my earlier padding override. Added dedicated.fe-page-orphans-list .fe-page-structure-blockrules mirroring the structure card's pill chrome withvar(--panel)background so pills read as discrete cards against the bin'svar(--panel-2)bg, plus an explicitgap: 8pxon the list container. - Status chips on the Pages list collided when a row had both a visibility chip and an "Unpublished changes" chip. Wrapped them in
.fe-page-status-pills(display: flex; gap: 6px; flex-wrap: wrap).
- Page draft slot for already-published pages. New
-
2.8.3May 28, 2026
Added
- Content-page Preview live-updates. The Preview button on the page editor (
frontend_page_edit.html) now opens the preview into a fixed, named window (tsp-page-preview-<page_id>) and the editor re-POSTs the currentblocks_jsonto that window on every change to the edit form, debounced 700 ms. The structure card already dispatchesinputevents from the hidden#page-blocks-jsonfield whenever pills are dragged / removed / edited, so the live-update wiring just listens for those at the form level. Live-update only fires when the preview window is still open (win.closedcheck) so editing without an open preview costs nothing. Scroll position is preserved across reloads by a small companion script injected intofrontend/page.html(preview-mode only) that stasheswindow.scrollYinsessionStorageonbeforeunloadand restores it on next load.
Fixed
- Markdown lists in admin-authored post / meeting bodies didn't render unless the author left a blank line before the dash. The detail templates piped these fields through the
markdownJinja filter, which is bare Python-Markdown with no preprocessing — Python-Markdown requires a blank line before a list / heading / blockquote when it follows a paragraph, sointro⏎- itemrendered inline. Switched to the existingmarkdown_blockfilter, which inserts the required blank line for the user before any list / heading / blockquote that directly follows non-blank content. Affects all four meeting-detail templates (frontend/meetings/classic.html,card_stack.html,magazine.html,minimal.html) formeeting.descriptionand all four event-detail templates (frontend/events/classic.html,minimal.html,poster.html,timeline.html) forevent.body. Event templates are reused by/announcement/<slug>(seefrontend.announcement_detail), so this covers announcement bodies too. - SVG image blocks rendered at the SVG's intrinsic width instead of the admin-chosen
max_width_pctwhen the block sat inside a flex container withalign-items: center. Block-level<figure>children of a centered flex parent only stretch when given an explicit width —max-widthalone has nothing to clamp because the figure shrink-wraps to the SVG's intrinsic dimensions (e.g.<svg width="452">). The image-block renderer in bothtemplates/frontend/page.htmlandtemplates/_blocks.htmlnow appendswidth: <pct>%to the figure's inline styles when the src ends in.svg(case-insensitive, query/fragment stripped), andwidth: 100%; height: autoto the img, so SVGs scale to fill the chosen percentage regardless of their source dimensions. Raster images keep the existingmax-width: 100%semantics so a small image in a wide figure doesn't get upscaled. - Unplaced blocks bin on the page builder wrapped pills horizontally with a different background, making mixed-length labels jumble. The
.fe-page-orphans-listzone now stacks pills vertically (flex-direction: column; gap: 6px) matching the structure tree, thebackground: var(--panel)per-pill override was dropped so orphan pills inherit the samevar(--brand-soft)tint as placed pills, pill padding bumped to10px 12pxwith radius10px, and the bin container's radius bumped to12px.
- Content-page Preview live-updates. The Preview button on the page editor (
-
2.8.2May 26, 2026
Added
- CSV export on Watchtower → Visitors. New Export CSV button in the tab's top actions downloads the current window's metrics — daily traffic, top paths, top referrers, devices/browsers/OS — as a single CSV. Server-side aggregation reuses the same
visitor_metricshelpers the page renders from, and the export honours the active Unique visitors / Hits mode so the export numbers match what was on screen.
Fixed
- Events auto-archive sweep was running on the server's UTC clock instead of the site-configured timezone.
event_ends_atis stored as naive site-local (parsed straight from the admin's HTML5datetime-localinput), but_auto_archive_eventswas building its cutoff fromdatetime.utcnow().date()— so an event ending at 9 pm Pacific would be flagged "past" any time after 1 am UTC the same day, and conversely a 2 am Eastern end-time wouldn't sweep until UTC midnight rolled past it. Cutoff is nownow_local_naive(site).date(). Same fix applied to the four other places that gate on "is this event past?":frontend._post_in_archive, theevents_listroute, thearchiveroute,blocks.filtered_events, andsearch._events_source+search._archive_source. Watchtower / visitor-metrics callers also usedatetime.utcnow().date()but compare against UTC-stamped system rows so they're correct as-is and not touched. - Watchtower → Visitors daily-traffic chart polish: legend back on the right, donut grid lines up at all viewport widths, and hover tooltips now show the exact count + date on the daily chart and the full slice breakdown on the donuts.
Internal
- Video Streamer module parked under
archive/video_streamer/— full implementation (Flask routes,flask-sockWebSocket ingest, ffmpegStreamManager, admin UI, public HLS viewer withhls.js, sidebar entry, file-upload source, browser-camera source) preserved as a self-contained archive plus anintegration.patchcapturing the seven touchpoints. Not on the active code path; the archive's README documents the restore recipe (git apply+ fourmvs) for a future release. SiteSetting columns and thevideo_streamtable left in_migrate_sqlitehistory so an upgraded DB stays compatible if the module is reinstated.
- CSV export on Watchtower → Visitors. New Export CSV button in the tab's top actions downloads the current window's metrics — daily traffic, top paths, top referrers, devices/browsers/OS — as a single CSV. Server-side aggregation reuses the same
-
2.8.1May 26, 2026
Added
- Source IPs visible on Watchtower → 404s with one-click blocking. Every row in Top missing URLs now has an IPs chevron button (route icon) that lazily fetches and inlines a panel listing the distinct IPs hitting that URL in the current window — IP, hit count, last-seen timestamp, and a per-IP Block IP button. Already-blocked IPs render as a red "Blocked" chip instead. The Recent 404s table gained a Source IP column plus a per-row Block button. Blocking from either surface reuses the existing
/watchtower/ban-ipendpoint and returns the admin to the 404s tab; the ban reason is auto-populated with the 404 path. Powered by a newnot_found_ips_for_path()aggregator +GET /watchtower/not-found/path-ipsHTML-fragment endpoint; one batchedIPBlocklookup populates the "Blocked vs Block" state per page load so there are no N+1 queries. NewNotFoundEvent.ipcolumn (VARCHAR(45), indexed) captures source IP on every public 404 going forward — existing rows display "—" since they predate the column.
- Source IPs visible on Watchtower → 404s with one-click blocking. Every row in Top missing URLs now has an IPs chevron button (route icon) that lazily fetches and inlines a panel listing the distinct IPs hitting that URL in the current window — IP, hit count, last-seen timestamp, and a per-IP Block IP button. Already-blocked IPs render as a red "Blocked" chip instead. The Recent 404s table gained a Source IP column plus a per-row Block button. Blocking from either surface reuses the existing
-
2.8.0May 26, 2026
Added
- Cookie Compliance module — new "Cookie Compliance" entry under Web Frontend → Setup that runs a privacy/cookie banner on the public site. Module-level on/off toggle. Three prompt modes: Notice (informational, single dismiss), Consent (Accept / Reject equally prominent), and Strict opt-in (GDPR-compliant — non-essential cookies blocked until accept). Three regional quick-start presets (GDPR/UK GDPR, CCPA/CPRA, Generic) apply best-practice defaults — mode, copy, position — in one click. Auto-region inference (Cloudflare/Fastly/Vercel country headers +
Accept-Languagefallback) escalates EU/UK visitors to strict and California visitors to consent regardless of the configured mode (auto can only escalate, never relax). Banner copy is fully customizable (title, body, accept/reject/more labels, position: bottom-bar / bottom-left / bottom-right / modal). Visitor choice persists in a first-partytsp_cookie_consentcookie for a configurable lifetime (default 365 days, max 730,SameSite=Lax,Secureon HTTPS). Three starter privacy policy generators (GDPR / CCPA / Generic) create a fully-seeded Page and link it as the policy with one click — admin just fills in placeholder fields (organisation name, contact email, retention periods). 13 newcookie_compliance_*columns onSiteSettingwith matching_migrate_sqliteentries; new moduleapp/cookie_compliance.pyowns region inference + presets + templates. - Privacy & cookies footer block — draggable from the footer builder palette. Renders a "Privacy policy" pill linking to whatever's configured under Cookie Compliance plus a "Cookie settings" pill that clears the consent cookie and re-prompts the banner so visitors can change their mind later. Both pills only render when the corresponding piece is configured — the block gracefully no-ops if dragged in before Cookie Compliance is set up.
- Unique visitors / Hits toggle on the Watchtower Visitors tab and (then-renamed) Web Frontend Metrics page. Default emphasis switched from hits to unique visitors — the more meaningful number for "how many real people". Segmented pill toggle with a
?tooltip explaining each mode; preference persists inlocalStorageand is restored before paint so the page never flashes the wrong side. Both sets pre-render server-side so the toggle flips instantly. KPI tiles, daily traffic chart, top paths, top referrers, devices, browsers, OS, and hour-of-day all swap their counts (and re-rank where applicable) when toggled. - "Manage redirects" button on the Watchtower 404s tab top actions, links straight to
/tspro/frontend/redirectsso the admin can hop from spotting a 404 to managing redirects without navigating.
Changed
- Web Frontend Visitor Metrics page is now the Watchtower Visitors tab. All panels (rich daily-traffic chart with hover tooltips, hour-of-day strip, Devices/Browsers/Operating systems donuts, expandable Top paths / Top referrers lists, summary KPI tiles) live in one place.
/tspro/frontend/metrics301-redirects to/tspro/watchtower/visitorswith the query string preserved. The Web Frontend admin subnav's "Visitor Metrics" entry, the main/tsprodashboard widget's "Open metrics" button, and the Web Frontend dashboard widget's "Full metrics" button all link to the new home. Both dashboard widgets now show unique visitors as the headline (sub-line still surfaces hits + hits/visitor ratio); the sparkline in the Web Frontend widget switched from hits to uniques to match.
Fixed
- Sidebar quicknav pills (Web / View / Watchtower) no longer get an underline on hover. They inherited an underline from the global
a:hover { text-decoration: underline }rule because.sidebar-quicknav-btn:hoverwas setting bg/color/border but nottext-decoration. Added the explicit override.
- Cookie Compliance module — new "Cookie Compliance" entry under Web Frontend → Setup that runs a privacy/cookie banner on the public site. Module-level on/off toggle. Three prompt modes: Notice (informational, single dismiss), Consent (Accept / Reject equally prominent), and Strict opt-in (GDPR-compliant — non-essential cookies blocked until accept). Three regional quick-start presets (GDPR/UK GDPR, CCPA/CPRA, Generic) apply best-practice defaults — mode, copy, position — in one click. Auto-region inference (Cloudflare/Fastly/Vercel country headers +
-
2.7.5May 26, 2026
Added
- Create a redirect from any 404 in one click — every row in the Top missing URLs and Recent 404s sections of Watchtower → 404s now has a Redirect button. Clicking it opens a modal pre-filled with the source path; type the target, save, and a 301 is added to the
UrlRedirecttable without taking you off the page. The row in-place swaps to a "redirected" chip so you can immediately spot which URLs you've handled and keep going through the list. New JSON endpointPOST /watchtower/not-found/redirect(CSRF-protected via the globalX-CSRFTokenfetch wrapper); validation mirrors the full Redirects admin page. - Wildcard redirects — source paths ending in
/*(e.g./swag/*) now match every URL under that prefix and land them all on the literal target. Exact-match rules always win over wildcards; among wildcards the longest prefix wins, and the/boundary keeps/swag/*from accidentally catching/swagger. The Watchtower modal grew a Use/*helper button that converts the clicked 404 path into a parent-prefix wildcard, and the Redirects admin page (/tspro/frontend/redirects) explains the syntax. Validation rejects*anywhere other than a trailing/*, a bare/*,*in the target, and self-loops where the target falls under the wildcard prefix. - Expandable Top missing URLs / Top paths / Top referrers cards on both the Watchtower 404s and Visitors tabs. Each card shows 30 rows initially and a Show 30 more button below the list reveals the next batch with a quick fade/slide-down keyframe (220 ms cubic-bezier, ~8 ms per-row stagger; respects
prefers-reduced-motion). The card-head meta updates live to "showing X of Y" and the button hides itself when the pool is exhausted. Server now fetches up to 300 rows for these lists so most expand sessions don't need another round-trip. The expander lives inapp/static/js/app.jsand matches any[data-wt-expand]/[data-wt-expand-btn]pair.
Fixed
- Watchtower → Visitors "Hour of day" chart was rendering as 24 flat 1-px ticks even with thousands of views in the window. Root cause:
.wt-hourlywas usingalign-items: flex-end, which sized each column to its tiny tick label instead of stretching to the 140 px container; the innerflex: 1track then collapsed to ~1 px, leaving the bars' percentage heights with no reference. Changed toalign-items: stretch(withmin-height: 0on the column + track for safe flex shrinking); tracks keep their own internalalign-items: flex-endso bars still bottom-align. Hour labels now show under every column (was every 4th).
- Create a redirect from any 404 in one click — every row in the Top missing URLs and Recent 404s sections of Watchtower → 404s now has a Redirect button. Clicking it opens a modal pre-filled with the source path; type the target, save, and a 301 is added to the
-
2.7.4May 26, 2026
Added
- Recovery Contacts page template on Web Frontend → Templates — the public
/contactlistpage now has its own card in the Templates list, modelled on the Contact page template and uniform with every other template: a "Directory + form" style card, the shared Customize panel (background / fonts / sizes), and page-level controls for the heading / subheading / Markdown intro plus container width. These appearance settings moved here out of the Forms admin (newfrontend_recovery_contacts_template_saveroute;recovery_contactsregistered as a template kind). The Forms page keeps the form mechanics (visibility, admin alerts + recipient, submit-button label, success message, bot protection) and links up to the new section — and no longer writes the moved fields, so saving it can't clobber them. No schema changes: reuses the existingrecovery_contacts_*columns +frontend_template_settings_json.
Changed
- Template Edit modals show a single save bar. Editing inside a template modal previously surfaced two "Unsaved changes" bars — the global yellow bar pinned to the page and a second one in the modal footer. The redundant in-modal bar is gone; modal edits now commit through the one global save bar (
#fe-save-bar), which already stacks above the modal, batches every dirty section, and keeps the modal open after saving. Inline per-section Save buttons stay hidden inside the modal and a stray Enter routes through the global Save instead of a full-page reload. - More breathing room between paragraphs in the body text of announcement cards on the
/announcementslist (cards view) —1.1emparagraph margins, with the first/last paragraph still flush to the card edges.
Fixed
- "Contact us" button on the Recovery Contacts page no longer shows an underline on hover. Being an
<a>styled as a button, it was inheriting the generic frontend link-hover underline (.fe-page a:hover); a higher-specificity rule now suppresses it. (The Contact page's submit is a<button>, so it was never affected.)
- Recovery Contacts page template on Web Frontend → Templates — the public
-
2.7.3May 25, 2026
Added
- Phone numbers are formatted for display on the public Recovery Contacts directory + PDF (stored values are untouched). North American numbers are hyphenated —
202-555-0100, or1-202-555-0100with a leading 1 — and numbers carrying any other country code are rendered in that country's standard international style via libphonenumber (e.g.+44 20 7946 0958), even when the+was omitted. Unparseable/partial numbers show exactly as entered. New dependency:phonenumbers(app/phone.py, registered as thephone_fmtJinja filter). - "Contact us" call-to-action on the Recovery Contacts page — a divider-topped section showing the Contact page's subheading and a button through to the public contact form. On desktop it sits under the directory cards; on mobile it moves to the bottom of the page, below the form. Only shown when the contact form is enabled.
Fixed
- Utility-bar button labels no longer wrap on mobile — items like "Print List" / "Contact List" stay on one line (the bar is already a horizontal swipe strip), via
white-space: nowrapon the utility-bar leaf items.
- Phone numbers are formatted for display on the public Recovery Contacts directory + PDF (stored values are untouched). North American numbers are hyphenated —
-
2.7.2May 25, 2026
Changed
- Signed-in admin button renamed to "Return to dashboard" (was "Back to TS Pro dashboard") across all three mega-menu variants (
classic,recovery-blue,themed) and the footer admin block. The admin nav-link editor help text was updated to match. - Recovery Contacts form settings — added a 1 rem gap between the two toggle rows in the "Admin email alerts" section, and clarified the removal-alerts toggle copy to make explicit that the admin is emailed only after the person clicks the confirmation link (so you're never asked to remove someone who hasn't confirmed they want off the list — no behaviour change from 2.7.1).
- Signed-in admin button renamed to "Return to dashboard" (was "Back to TS Pro dashboard") across all three mega-menu variants (
-
2.7.1May 25, 2026
Added — Recovery Contacts: anti-abuse on self-service update/removal
Hardens the public update/removal flow against malicious requests aimed at a listing's owner, and surfaces what it catches in Watchtower.
- 24-hour update rate-limit — a second update request against the same listing within 24 h is rejected with a "wait 24 hours" message; the second submission's data is never ingested, and the attempt is flagged. Tracked via
RecoveryContact.last_update_request_at. The "I'm updating my existing entry" block now states the once-per-24h limit. - "I didn't submit this" link — every update/removal confirmation email now carries a second link beside the confirm link. Clicking it discards the pending request and locks the listing against any update/removal request for 7 days (
RecoveryContact.requests_locked_until); the confirmation page reports the request was discarded. While locked, both update and removal requests are refused. - Watchtower panel + attention chip — a "Recovery Contacts · flagged requests" panel on the Watchtower Overview tab lists each flagged request (rate-limited 2nd update or owner-disavowed) with the requestor's IP, a one-click Block IP (reusing the IP blocklist), and Resolve. Unresolved flags drive a red attention chip on the Watchtower sidebar quicknav and an anomaly callout. Listings with flags/locks also show Flagged / Locked until … badges in the Recovery Contacts admin table.
- Data model — new
RecoveryContactAbusetable (kind, targeted listing snapshot, requestor IP, attempt count, lock deadline, resolved state) + arecord_recovery_contact_abuse()helper that bumps an existing unresolved row instead of duplicating. Newrecovery_contactcolumns patched in via_migrate_sqlite(); the abuse table is created bydb.create_all(). New audit-log events:update_rate_limited,disavowed,request_blocked.
Added — Recovery Contacts form & directory refinements
- "Contact me by email through the site" is on by default, and is force-checked + locked whenever a member hides both their phone and email — so there's always a way to reach them.
- "Need help?" link at the foot of the form, pointing to the public
/contactpage. - The "available to sponsor" checkbox now sits below the "contact me by email" option.
Changed — Recovery Contacts polish
- Directory cards adopt the Primary card design tokens (
--fe-color-card-primary-bg/border, plus the-darkvariants) and join the shared.fe-card-primaryshadow/hover aggregator, so they match meeting/submission cards in every theme and dark mode. - Pale-green tint on the "I'm updating my existing entry" block (mirrors the pale-pink removal block); checking "Remove me from the list" now greys out and disables every other field except Name + Email.
- PDF: contact-only listings (phone + email both hidden) now print "Contact through the site —
/contactlist" as a clickable link — the visible text drops thehttps://while the link still targets the fullhttps://URL. - Removal-block copy now ends "Use the email from your listing."
Fixed — Recovery Contacts live search
- Typing in the directory search now actually hides non-matching cards until the box is cleared — the card's
display: flexhad been overriding the[hidden]attribute, so excluded entries stayed visible.
- 24-hour update rate-limit — a second update request against the same listing within 24 h is rejected with a "wait 24 hours" message; the second submission's data is never ingested, and the attempt is flagged. Tracked via
-
2.7.0May 25, 2026
Added — Recovery Contacts module
A new self-service member directory: visitors add themselves (name + phone + email), pick exactly what shows publicly, and reach each other directly. Public page served at
/contactlist; admin management lives at TS Pro → Recovery Contacts; settings live under Web Frontend → Forms → Recovery Contacts. Off by default and 404s when disabled, like every other module surface.- Public directory + submission form (
app/frontend.py,templates/frontend/recovery_contacts.html). Two-column layout inside the shared dynbg section so themes + dark mode flow through automatically: the member list (with header chip/title/subheading) on the left, the submission form on the right. Email is required; phone is optional. Entries appear only after an admin approves them. - Per-entry display control — each member chooses to show their phone, email, both, or neither (
show_phone/show_email, surfaced via thepublic_phone/public_emailmodel properties). An admin can adjust visibility per row afterward. - "Available to sponsor" opt-in adds a red-heart badge to the listing so members seeking a sponsor can spot them.
- Private "Contact me" relay — opting into Let people contact me by email through the site adds a Contact me button that opens a modal; the message is emailed to the member with Reply-To set to the sender so their address is never exposed (
_send_with_reply_to). Honeypot + Turnstile protected. The backend shows a contact-count chip per member. This box is checked by default, and is forced on + locked whenever the member hides both phone and email — so there's always a way to reach them. - Double opt-in update & removal — checking I'm updating my existing entry or Remove me from the list matches the member by email and sends a confirmation link. Clicking the link applies the change automatically (update overwrites the matched entry; removal deletes it) with no admin approval (
/contactlist/confirm/<token>). Unconfirmed requests still surface to the admin to action manually. The removal block greys out and disables every other field except Name + Email; the update block is tinted pale green, the removal block pale pink. - Live search filters the directory as you type (name / phone / email, plus the keyword "sponsor") and hides non-matching cards until cleared.
- Branded PDF of the directory via WeasyPrint at
/contactlist.pdf— honours the active?q=filter, stacks the logo over the public URL, centres the title, and downloads as<Site-Name>-Recovery-Contacts_<yyyymmdd>.pdf. Listings reachable only through the site (phone + email both hidden) note "Contact through the site — https:///contactlist" in place of empty phone/email cells. - Admin backend (
app/routes.py,templates/recovery_contacts.html): pending-review table with per-request match panels (Apply update / Approve as new / Remove / Dismiss), a published table with inline visibility toggles + per-row edit, a manual add modal, and an Activity log (audit trail) of submissions, email confirmations, relayed contacts, and every admin action — each row carrying the actor (visitor vs named admin), timestamp, and IP. - Integrations — sidebar entry with a pending-count badge, inclusion in the dashboard Forms widget, an entry in Web Frontend → Forms (
app/forms_registry.py), and admin email alerts (toggleable for new entries and for removals). - Data model (
app/models.py) — newRecoveryContacttable (display flags, sponsor/contact opt-ins, contact count, shared confirmation token for update+removal, self-referentialmatched_entry_id) andRecoveryContactLogtable for the audit log, plus alog_recovery_contact()helper. Newrecovery_contacts_*columns onSiteSetting. Tables are created bydb.create_all(); all additive columns are patched in via_migrate_sqlite()(race-tolerant for the 2-worker gunicorn setup). Legacy/phonelist302-redirects to/contactlist.
Changed — Directory cards adopt the Primary card design tokens
The Recovery Contacts list cards now read surface + border from the Primary card tokens (
--fe-color-card-primary-bg/--fe-color-card-primary-border, with the-darkvariants) and join the shared.fe-card-primaryshadow/hover/transition aggregator, so they match meeting/submission cards in every theme and dark mode. - Public directory + submission form (
-
2.6.1May 24, 2026
Added — Neobrutal theme
A seventh frontend theme: neobrutalism — colourful flat surfaces (yellow / pink / cyan / lime), thick black borders, hard offset drop-shadows (no blur), chunky Archivo Black headings, and controls that "press" on click (translate + shadow shrink). Styles every region — header, mega menu, homepage, footer, list/detail pages — in both light and dark; in dark mode the canvas goes near-black while the bright blocks stay colourful with their text pinned to ink for legibility (
app/static/css/themes/neobrutal.css).- Geometric hero backdrop — a faint graph grid plus bold black-outlined shapes (circles + a tilted square) scattered to the corners, drawn entirely in CSS on the hero's
::before/::after. - Randomised on each load —
neobrutal_hero_css_vars(site)(app/design.py, registered as a Jinja global and injected onto<body>infrontend/base.html) emits fresh random positions per request, so the primitives re-scatter on every refresh. Each shape roams a generous region within its own corner so the centred headline always stays clear; the square's rotation randomises too. No JavaScript — server-rendered, so no flash. - Newly vendored font: Archivo Black (
app/static/fonts/archivo-black/). Registered in the font catalog + theme registries (fonts.py,frontend.py) with full design tokens (design.py, default light mode).
Fixed
- Neobrutal footer location cards no longer darken to near-black on hover (the shared force-dark hover rule was burying the black card text) — the hover now re-asserts the bright surface; its feedback is the lift + larger hard shadow.
- Geometric hero backdrop — a faint graph grid plus bold black-outlined shapes (circles + a tilted square) scattered to the corners, drawn entirely in CSS on the hero's
-
2.6.0May 24, 2026
Added — Four new frontend themes (Modern Dark, Cyberpunk, Sanctuary, Terminal)
Beyond Classic and Recovery Blue, the Web Frontend now ships four complete themes, each styling every public region — header, mega menu, homepage, footer, and all list/detail pages — in both light and dark mode:
- Modern Dark — deep-indigo "mission control" canvas with a diffuse aurora, film grain, teal→cyan gradient buttons, Fraunces display over Inter.
- Cyberpunk — near-black neon-grid HUD with scanlines, cyan/magenta, sharp zero-radius edges, and Orbitron/Chakra Petch type.
- Sanctuary — warm sand/cream canvas, sage-green + clay accents, Lora humanist serif, soft rounded cards.
- Terminal — utilitarian command line: phosphor-green on near-black, all-monospace, flat boxy panels, prompt-prefixed headings + a blinking cursor.
Themes apply non-destructively via theme-scoped CSS (
app/static/css/themes/<key>.css) loaded only for the active theme — switching never rewrites page/block content. Sharedfrontend/headers/themed.html+frontend/megamenus/themed.htmlpartials drive every alternate theme. Newly vendored fonts: Orbitron, Chakra Petch, Lora.Added — Per-theme saved state
Switching themes auto-saves the outgoing theme's appearance fields (design tokens, fonts, default mode, per-template settings, mega-menu colours) into the new
SiteSetting.frontend_theme_states_jsonand restores the incoming theme's last state, so returning to a theme brings it back exactly as left. The theme switcher modal gained a When applying chooser — Return to last saved state / Reset to default — pinned as a fixed band so it and the Apply button stay visible as the theme grid scrolls.Added — Mega-menu dynamic backgrounds, dark-mode colours, and blend
- Dynamic background picker for the mega-menu panel (the same
dynbgsystem the hero/pages use), rendered behind the links via anfe-dynbg-hostpanel and clipped to its rounded corners. - Render dark in light mode toggle — forces the dynbg's dark variant in light mode so a dark panel sits behind light text.
- Independent light/dark colour pickers — separate background + text colours per mode.
- Background ↔ dynamic blend slider — the dynbg layer's opacity over the solid colour (0 = colour only, 100 = dynbg only).
- Mega-menu headings, links, and buttons (including the admin "Back to TS Pro dashboard" button) now obey the configured Text colour; the Logout pill keeps its distinct amber. Dark mode auto-lightens the text colour for legibility.
New additive
SiteSettingcolumns (all via_migrate_sqlite):frontend_mega_bg_dynamic_key,frontend_mega_bg_dynbg_config_json,frontend_mega_bg_dynbg_dark,frontend_mega_bg_color_dark,frontend_mega_text_color_dark,frontend_mega_bg_dynbg_blend.Added — "Text — Darkmode" design token
A new Colors token controls dark-mode text site-wide: anywhere the Text token is used, this value takes over in dark mode (body, headings, card/event titles, page-builder content). Hardcoded neutral dark-text colours (
#e2e8f0/#f1f5f9/#cbd5e1) are routed through a--fe-text-dark-activechannel defined only in dark mode, so light mode is untouched.Changed — Recovery Blue: frosted-glass header + footer cards
The Recovery Blue header is now a translucent frosted-glass bar (
backdrop-filter: blur + saturate), and the footer location cards use a light frosted-glass surface — both light and dark. The desktop nav no longer draws a dark navy box behind its links (scoped to the mobile dropdown).Fixed — Dark-mode token connections + Modern Dark polish
- Hardcoded recovery-blue dark values now resolve through the active theme's dark tokens: card hover borders →
--fe-dm-border-hover, the Files & Readings panel + events/announcements active tab + section dividers + meeting-type badges. - The derived dark primary-button colour is re-resolved on
<body>so it tracks the theme instead of falling back to blue. - Themed-header nav links default to the dark-mode text colour (no more dark-on-dark).
- Modern Dark: fresh teal/violet hero scene (dropping leftover recovery-blue particles), rebuilt footer, and removed the white box around the "What is CMA" / "Additional Resources" sections in light mode.
- The Design page's per-token Reset now dispatches input/change events so the unsaved-changes save bar appears.
Backup
Every new frontend setting scopes into the frontend export/import automatically (the field list is prefix-derived from
SiteSettingcolumns); thecolor_text_darktoken rides inside the exportedfrontend_design_json. -
2.5.1May 23, 2026
Changed — "Powered by" footer block links to gettspro.com
The footer builder's Powered by attribution block now links to
https://gettspro.cominstead of the project's GitHub repo (templates/frontend/footers/blocks/_powered_by.html). The block's description in the footer builder palette was updated to match (app/frontend.py). -
2.5.0May 22, 2026
Added — Popups: site-wide modal popups built with the page builder
A new Popups section under Web Frontend → Content lets admins author modal popups using the same drag-and-drop block builder as content pages, fired from
#nameanchor selectors anywhere on the public site.- New
Popupmodel (app/models.py) —name(the trigger handle /#selector, unique + slugified),title,blocks_json(same section/block schema asPage), anis_enabledtoggle, plus the popup's own chrome:width+max_width_pct,height_mode(auto/fixed) +height,padding,bg_color(+ optionalbg_color_dark),border_radius,shadow, overlay (overlay_enabled/overlay_color/overlay_opacity),position(centre/top/bottom), per-device visibility (show_desktop/show_mobile/mobile_full_width), and behaviour (close_on_overlay,show_close_button,auto_open+auto_open_delay). The new table is created bydb.create_all()on upgrade — no migration needed. - Admin CRUD (
app/routes.py): list / create / edit / save / enable-disable / delete under/tspro/frontend/popups, plus a Popups entry in the Web Frontend subnav (_frontend_subnav.html). - Builder reuses the page builder verbatim — the editor renders the shared structure card with draggable block pills, the blue "Add block" floating palette, and the BlockEditor modal, driven by the same
page_structure.jsand_frontend_structure_card.htmlmacros content pages use.block_editor.jsgained an optionalallowedTypesmount option so the popup palette is scoped to content blocks (the homepage-section blocks — hero / meetings / events / features / faq — and the wiki TOC are excluded). - Triggers (
templates/frontend/_popups.html, included site-wide infrontend/base.html): any link to#name, any element withdata-popup="name", and a matching URL hash on load /hashchangeopen the popup; it closes via the × button, a backdrop click (when enabled), or Escape. Popups are surfaced to every public template by afrontendblueprint context processor; content renders through the sharedrender_sectionsmacro so popups inherit every block style the site already ships. - Editor-only preview route (
/_preview/popup/<id>) force-opens a popup on a neutral page so admins can preview drafts before enabling them.
Fixed — Public homepage no longer 500s when no homepage is configured
frontend/page.htmlbuilt its page-shell inline style frompage.*even inindex()'s no-homepage fallback (which renders withpage=None), so the public/returned a 500 ('None' has no attribute 'pad_top') during the brief pre-seed window on a fresh install or if the designated homepage page was deleted. The template now guards everypage.*access and renders a friendly "no homepage configured yet" placeholder (with a Set a homepage in Pages shortcut for signed-in editors) instead of crashing. - New
-
2.4.0May 21, 2026
Added — Live meeting bar updates without a page refresh
The utility-bar "LIVE:
" badge now appears, updates, and clears on its own as online/hybrid meetings open and close — visitors no longer have to reload to see it. - New endpoint
GET /api/live-meeting(app/frontend.py) returns the current live-meeting state as JSON ({"live": …, "name": …, "join_url": …}), reusing the exactcurrent_live_meeting()logic the server render uses so a poll always matches a refresh. Public, gated on the admin's live-badge toggle, uncached. - Poller in the utility bar (
_utility_bar.html) fetches that endpoint every 30s (and on tab refocus) and updates the bar in place: inserts/updates/clears the LIVE badge + Join CTA and toggles the bar'sis-livestyling (clearing the idle inline colours so the yellow shows). The server-rendered state still paints the correct bar on first load; the poller just keeps it fresh. When a site uses the badge but has no other bar items, the bar is renderedhiddenso the poller has a target and reveals it only when a meeting is live. - Container collapse is now CSS-driven. Containers with a
collapsed_icon(e.g. a Helpline pill) always emit both the collapsed icon and the full container; which one shows is decided by the bar's.is-liveclass + viewport. This fixes the collapse so it works whether the bar was rendered live OR flipped live by the poller (previously the collapse was gated on the server-render live state and didn't trigger on the dynamic path).
- New endpoint
-
2.3.3May 21, 2026
Changed — Web Frontend quick-nav visible to non-admins (read-only)
The sidebar Web/View quick-nav previously rendered only for admins. Signed-in non-admins (viewer / editor / intergroup_member) now see it too when the Web Frontend module is enabled:
- Web renders as a non-clickable status indicator (a
<span aria-disabled="true">, not a link) that still shows the live dot — so non-admins can see at a glance whether the public site is live, but can't open the admin panel they aren't authorized for. The icon/label are muted to read as a status chip; the live dot keeps full strength. - View opens the public site in a new tab — shown to non-admins when the site is live (admins keep it always, since they get the editor preview even while the public toggle is off, and a non-admin would otherwise be bounced straight back).
- Admins are unaffected: clickable Web link + View + Watchtower as before. A lone Web button (non-admin, site off) spans the full quick-nav width.
- Web renders as a non-clickable status indicator (a
-
2.3.2May 21, 2026
Fixed — Redirects match with or without a trailing slash
The redirect handler (
_url_redirect_handler) matched the incoming path againstUrlRedirect.source_pathexactly, so a rule stored as/donate404'd for visitors hitting/donate/(and vice versa). The lookup now checks both slash variants in a single indexed query (source_path IN ('/donate', '/donate/')), preferring an exact match when both a slashed and unslashed rule exist. Root/is matched as-is. Still one query per request, so no added per-request cost. -
2.3.1May 21, 2026
Fixed — Dark-mode form & contact-page text contrast
Several frontend form surfaces rendered text in near-black against a dark background in dark mode.
- Submission / story form labels + legends (
.fe-submission-form label/fieldset legend): these carry an explicit light-mode colour (var(--fe-color-text)) that overrode the card's inherited dark-mode text colour, so on the dark submission card (/submissionform,/storyform, submission modals) every field label and the fieldset legend were nearly invisible. Flipped to the dark-mode text tokens (--fe-dm-text/--fe-dm-text-strong). - Contact card stayed white in dark mode: its dark override referenced
var(--fe-color-surface, #111827), but the design token is defined (light) and never flipped, so the fallback never applied — leaving a white card (with dark inputs) on the dark page. Now uses the real dark surface tokens (--fe-dm-surface/--fe-dm-border) plus a light base text colour, mirroring.fe-submission-card. The contact form's own labels now follow the same dark-mode rule (the earlier:not(.fe-contact-form)carve-out was removed once the card itself went dark). - Contact aside text (
.fe-contact-title"Get in touch",.fe-contact-intro, the public-information-chair name and other channel values, and channel labels) sits on the dark page rather than the card and had no dark override, so it rendered near-black. Lifted the heading to--fe-dm-text-strong, intro/values to--fe-dm-text, and labels to--fe-dm-text-muted.
Verified with a headless browser in dark mode:
/submissionformand/contactnow render all labels, headings, and contact values at readable contrast against their dark surfaces. - Submission / story form labels + legends (
-
2.3.0May 21, 2026
Added — Frontend image & asset caching control panel
A new Web Frontend → Setup → Caching admin page that makes returning visitors stop re-downloading images on every page view, while keeping changes instant.
- Root cause fixed: the
_security_headersafter-request hook forcedCache-Control: no-storeon every path except/static/and/pub/, overwriting themax-agethat image routes (/story-image,/blog-image,/post-gallery-image,/site-branding/*, …) set themselves. So most frontend images were re-fetched on every visit. Caching is now centralized inapp/imgcache.py::apply_cache_headers, wired into the same hook (it owns image/static responses; everything else still getsno-store). - Cache-busting without template surgery: a
?v=<token>is auto-appended to all ~121 image URLs and every/staticURL via Flask'surl_defaultshook (imgcache.inject_bust) — no per-call-site edits. Images use a monotonicSiteSetting.media_cache_versiontoken (read live, request-cached ing);/staticusesversion.__build_id__(a content hash of theapp/tree), so each deploy busts CSS/JS/fonts automatically. - Instant freshness on change:
imgcache.note_image_change()advances the version token whenever an image is uploaded/replaced. Wired into the central_save_upload(image extensions only) plus the three direct-.save()image routes (custom icon, page background, brand logo). A change → new URL → immediate refetch; unchanged images stay cached for the full lifetime with zero requests. - The panel (
frontend_caching.html): master image-caching toggle, cache lifetime (1h–1yr presets, default 7 days), auto-refresh-on-change toggle,immutabletoggle; a separate static-assets toggle + lifetime (default 30 days); and a Maintenance card showing cache version, last-cleared time, and on-disk thumbnail count/size, with Clear image cache now (bumps the token for all visitors) and Rebuild thumbnails (deletes generated_thumb_files, regenerated lazily) actions. - Admin-uploaded fonts (the
site_custom_font_assetroute) are cached aggressively too, but treated as self-busting (their URLs embed a UUID filename) so they don't churn on the image token. - Schema: 8 additive
media_cache_*columns onSiteSetting(enabled, max-age, immutable, static toggle + max-age, autobump, version, cleared-at), with matching_migrate_sqliteentries. Defaults: image + static caching on. - Untouched: HTML pages, API/JSON, admin pages, and document downloads stay
no-store/ Flask defaults, so dynamic surfaces like the live-meeting utility bar remain per-request fresh. Verified end-to-end with a headless browser against sandboxed copies of the DB (migration on real data; staticpublic, max-age=2592000, immutable+ build-id token; imagepublic, max-age=604800, immutable+ version token; toggle-off →no-store; upload/clear bump the token immediately).
- Root cause fixed: the
-
2.2.2May 21, 2026
Fixed — Frontend export now carries per-page OG overrides + story dates
The scoped frontend bundle serialises
Page/Storyrows with explicit field lists that had drifted from the models, silently dropping two admin-editable, public-facing fields on export/import:Page.og_title/og_description/og_image_filename— per-page Open Graph (social-share) overrides set in the page editor. The OG image is now also collected so it ships in the bundle'sassets/.Story.published_at— the public "posted on" timestamp; without it, imported stories reset their date to the import time.
Both are now exported and restored. Bundle
format_versionbumped 4 → 5; older bundles still import (the new fields fall back to model defaults). Also corrected the asset-collection comment to match actual behaviour (every ref is kept; the zip step skips names with no file on disk, so regex false-positives never ship and real refs never drop) and simplified the now-redundantfinal_assetsloop. Verified with an isolated export → fresh-install import round-trip: pages (incl. OG), stories (incl.published_at), settings, and referenced assets reproduce verbatim. The whole-site export was already drift-proof (full DB viaVACUUM INTO).Changed — Dashboard + sidebar polish
- Dashboard drag handles: the three macro opt-out widgets (Your role / server metrics, Currently online, Access requests) rendered their handle as an absolute top-left chip, a different size/offset/position from every other widget. They now render the handle inline at the start of their own title row (
.dash-drag-handle--in-head), reproducing the macro handle exactly (in-flow, 22px brand grip). Removed the dead "inset for absolute chip" padding rules. - Sidebar: Watchtower quicknav icon bumped to 16px (Web/View stay 14px); Notifications & Search button gap tightened 10px → 8px; the Web button's live-status dot now reuses the Currently-online widget's emerald pulsing ping to signal "frontend module enabled and public".
-
2.2.1May 20, 2026
Changed — Footer builder converged onto the page block builder
The Footer admin now uses the same inline structure-builder flow as content pages, replacing its bespoke form + separate layout-builder modal.
- Inline structure card (
frontend_footer.html): footer blocks arrange into drag-drop rows/columns (Sortable), click-to-edit pills opening the existing per-type content modals, an "Add block" palette + "Add row" (1–4 col) controls, and a sticky save bar in place of the "Save Footer" button. All block editors render unconditionally now (any block addable from the palette). - Self-contained
footer_builder.jsowns the drag/palette/remove/save-bar and serialises the arrangement into a hiddenfooter_layout_json(rows/columns of block types) — no changes to the shared page-builder JS or macros, so the page editor is untouched. - Save (
frontend_footer_save): the posted arrangement upserts the active footerCustomLayout(promoting a prebuilt to an editable custom layout when needed); block content still saves via the unchangedparse_footer. Public render is unchanged —_custom.html+ the 11 footer block partials already consumeCustomLayoutrows + the content dict, so live footers are byte-identical until edited. - Converters (
blocks.py): added losslessfooter_blocks_from_content/footer_content_from_blocks/footer_layout_to_blocks/footer_blocks_to_layout_rows(round-trip tested) bridging the content dict, the block-list, and layout rows.
- Inline structure card (
-
2.2.0May 20, 2026
Added — Preview frontend pages (and homepage) before publishing
An editor-only preview surface for content pages and the homepage, so changes can be checked before they go live.
- Preview route:
frontend.page_preview(/_preview/page/<id>, GET + POST) renders a Page through the same pipeline as the public site, gated to signed-in frontend editors (can_edit_frontend) — never the public. GET renders the saved content (so DRAFT/unpublished pages, whichpage_detailhides even from editors, can finally be previewed); POST renders theblocks_jsonposted from the structure editor — the current unsaved edits — with page-level settings (background, layout, SEO) taken from the saved row. - Shared render path: extracted
frontend._render_page(page, site, sections=…, preview=…, unsaved=…)from the duplicated tails ofindexandpage_detail(TOC, lottie detection, meetings/events hydration, OG tags, context); all three now render through it, so the preview is byte-for-byte the public render. - Editor button: a Preview ↗ action in the page editor builds the live block JSON via
new FormData(form)(firing the editor's existing serialize hook) and POSTs it to the preview route in a new tab — no save required. - Pages list: a Preview link per row (works for drafts).
- Banner:
frontend/page.htmlshows a fixed preview banner (only whenpreview_mode) with accurate wording for unsaved-changes / draft / plain-preview. - No schema change and no change to save/publish semantics — purely additive (the live page already only changes on Save).
- Preview route:
-
2.1.35May 20, 2026
Added — WordPress importer: universal custom-field mapping
A new Map fields wizard step (step 3 of 5) discovers the custom fields present on the connected site and maps them, per post type, onto destination columns.
- Discovery:
wp_importer.discover_fieldsaggregates every scalar custom field across the fetched posts (from the already-captured flattenedacfpayload) with sample values + post counts. - Registry:
TARGET_FIELDSis the single extension point — per-target destination fields (key, label, type, aliases). Adding a future post type is one entry here plus a row-construction branch. - Suggestion:
suggest_mappingpre-fills smart defaults from field-name detection (reusing the legacy alias table + date-field aliases); the admin overrides any of them. - Apply:
_extract_target_fieldsresolves each target's mapping with type coercion (text/url/datetime/date/bool — incl. anYYYYMMDDdate→datetime fix), applied to all post types (events/announcements, stories, blog) — previously only events/announcements got custom-field mapping. Falls back to the legacy alias auto-detect when no mapping exists. - Saved per site: new
WpFieldMappingtable (keyed by host, sentinelcsvfor uploads) remembers the last mapping so re-imports auto-load it. New routewp_import_fields+wp_import_fields.html.
Added — Chunked import for large WordPress sites
The 500-post fetch cap is removed and the commit runs in batches so large sites can't hit the request timeout.
MAX_FETCH_POSTS(3,000) ceilings the single connect fetch; the connect step warns when the ceiling is hit.COMMIT_CHUNK_SIZE(200) bounds each commit request. The dry-run commit now processes one chunk per request, accumulating counts/warnings in the stash and rendering an auto-advancingwp_import_progress.html(progress bar, running counts, pause/stop) until done. Slug uniqueness stays correct across chunks (each batch re-reads existing rows). Small sites (≤ chunk size) commit in one pass as before.apply_plangainscount_inline; the dry-run preview skips per-post inline-image counting on large sets (> 400 posts) to stay responsive.
Changed — dry-run "Ready to import" is a sticky footer
The confirm block is no longer a
.card/.data-card— it's a full-bleed sticky footer bar (.wp-confirm-bar) anchored to the bottom of the wizard modal, so the IMPORT field + Run-import button stay reachable while scrolling the preview. Shows the batch count for chunked imports. - Discovery:
-
2.1.34May 20, 2026
Added — Notifications Center
A sidebar Notifications button (with a live uncleared-count chip) that opens a popup modal of everything needing the user's attention; each item deep-links to its section and can be cleared individually or all at once.
- Derived, not event-sourced.
app/notifications.pywalks the same attention sources the sidebar badges use (pending access requests, locked accounts, unread contact messages, posts/stories awaiting review) and turns each into a notification keyed by a stable string (access_request:42,locked_account:jdoe…). The only thing persisted is each user's dismissals — newNotificationDismissaltable (auto-created bydb.create_all). "Uncleared" = current attention items minus dismissals; a dismissal whose item resolves is pruned so a recurring key resurfaces. No event plumbing to maintain, nothing to go stale. - Role-scoped. Admins see access/security/contact items; editors and up see submissions awaiting review (gated by the relevant module being on). Viewers get no button.
- Endpoints.
GET /tspro/notifications(HTML fragment),POST /tspro/notifications/clear(one key),POST /tspro/notifications/clear-all— the clear endpoints return the new count so the chip updates live.notifications_countis injected via the existing context processor. - UI. Sidebar button mirrors the Search button chrome with a
nav-badgechip;_notifications_modal.html(self-contained markup + JS, fetches the list on open) and_notifications_list.htmlfragment;.notif-*styles inapp.css. The modal is included beforeapp.jsso itsdata-close/data-open-modalhandlers bind at init (guarded withis_authenticatedsince that spot also renders on the login page).
Fixed — sidebar quicknav spacing
The sidebar is a flex column (margins don't collapse), so
.sidebar-quicknav's bottom margin stacked with the Notifications button's top margin into a 14px gap. Dropped the quicknav bottom margin so quicknav → Notifications → Search share a uniform 8px rhythm. - Derived, not event-sourced.
-
2.1.33May 20, 2026
Added — Watchtower 404s tab
A new
/tspro/watchtower/not-foundtab surfacing the public-site 404s visitors hit.- Model: new
NotFoundEventtable (created viadb.create_all— no_migrate_sqliteentry needed for a new table). Storescreated_at/day,path, the fullreferrer(kept in full — for internal broken links the referrer is our own site, whichVisitorEventdeliberately discards) plusreferrer_host, parsed device/browser/os, and a daily-rotatingvisitor_hash. - Recording:
visitor_metrics.record_404reuses the existing bot/asset/UA/hash helpers; called from the global 404 errorhandler inapp/__init__.pyonly on the public-frontend branch (admin/tspropaths and signed-in users are excluded). Fully defensive — a logging failure can never turn a 404 into a 500. - Aggregation:
watchtower.pygainsnot_found_summary/not_found_daily/top_missing_paths/top_404_referrers/recent_404s/clear_404s. - UI:
watchtower/not_found.htmlmirrors the Visitors tab (KPI tiles, amber trend chart, two ranked lists, recent-hits table) with a window selector and a Clear-log action. Tab added towatchtower/_tabs.html;_ENDPOINT_LABELSentry added.
Added — GSR Summary modal
The utility-bar GSR button now opens the GSR Summary in a modal instead of linking to
/announcements#gsr.- Shared partial: the GSR "paper" markup was extracted from
announcements_list/omni.htmlintofrontend/_gsr_summary.html, included by both the announcements page and the modal so they never drift. - Fragment endpoint:
GET /announcements/gsr-summaryrenders just that partial. The announcements query was refactored intofrontend._active_announcementsand is shared by the list route and the fragment. The GSR button is global but the data only lives here, so the modal fetches the fragment on first open. - Modal: self-contained
frontend/_gsr_modal.html(markup + style + JS, like_lightbox.html), included once infrontend/base.html. Centred popup on desktop; full-screen sheet covering the header on mobile (≤540px, z-index 1300 > header). Footer "Go to Announcements" button; close via X / backdrop / Esc; body scroll-lock. The GSR button keeps its/announcements#gsrhref as a no-JS fallback (data-fe-gsr-trigger). - Surface: the modal is one uniform card surface (
--fe-panel/--fe-dm-surface); inside the modal the paper drops its sheet background + shadow (override scoped to.fe-gsr-modaland theme-qualified so it beats the shared dark paper rule), keeping only the typography.
Changed — Utility-bar live collapse is desktop-only
When the live-meeting bar is active, a container with a
collapsed_iconcollapsed to its icon on every viewport. It now collapses only on desktop (to free centre room for the LIVE banner); at ≤720px — where the bar is a horizontal swipe strip — the full container is shown instead._utility_bar.htmlemits both variants andfrontend.cssshows the right one per width (.fe-utility-container--live-expanded). - Model: new
-
2.1.32May 20, 2026
Added — "What's New" release-notes dashboard widget
A new dashboard widget (key
release-notes) renders the latest release note plus a compact history of the previous three versions, with a CTA into Settings → About.- Data source: reuses
app/about_docs.py::load_release_notes(exposed as theapp_release_notes()Jinja global) — the same parsedRELEASE_NOTES.mdthe About tab reads, so the widget adds no new data plumbing. - Template: rendered in
templates/index.htmlvia the existingdash_widgetmacro (sparkleshead icon, title "What's New"). Leads with a brand-tinted hero panel for the latest entry (version +Latestpill + date + headline + rendered Markdown body, clamped with a softmask-imagefade), followed by an "Earlier releases" list and a right-aligned View all release notes CTA. - Deep link: the CTA is an
<a data-open-modal="settings-modal" data-settings-tab="about">— it reuses the existingapp.jshandler that opens the Settings modal and activates a named tab, so it lands on Settings → About with the release-notes list expanded. - Per-user toggle + ordering: new
User.dash_show_release_notescolumn (defaultTrue, all roles) with a matching_migrate_sqliteentry;release-notesregistered inDASHBOARD_WIDGET_KEYS(aftertrusted-servants) so it joins drag-reorder and the Customize modal. Persisted in/dashboard/customize. - Styling: new
.dash-relnotes-*rules inapp.css— theme-aware viacolor-mixagainst--brand; the CTA sitsalign-self: flex-end(content-width, right-aligned).
- Data source: reuses
-
2.1.31May 20, 2026
Changed — Frontend → Templates page index polish
Follow-up refinements to the 2.1.29 list-of-modals refactor:
- Active-template pill now renders the brand colour at 18% opacity (
color-mix(in srgb, var(--brand) 18%, transparent)) with brand-coloured text, instead of the neutral panel fill. - (/url) suffix in each row title is split into its own pill chip styled like a secondary (outline) button — transparent fill, neutral border, monospace URL text.
- Sort A→Z / Z→A toggle moved to the far right of the toolbar (
justify-content: flex-end). - 1rem gap between the stacked elements inside each index card and between cards in the list.
- Index rows now match the standard backend
.cardchrome (same border,var(--radius),var(--shadow)) — the frontend-style hover lift / brand-border treatment is dropped.
Fixed — Templates page card flash + stray collapse carrot
- The first-paint hide rule that keeps template cards invisible until the JS lifts them into modals lived in a
<style>at the bottom of the content block, so the cards (and one stray modal section) briefly flashed before the rule was parsed. Moved the criticalvisibility: hiddenrule to the top of the content block so it applies from the first paint. - The global
feCollapsibleCards()helper (which adds a chevron toggle to every.cardin.fe-admin-mainacross FE-admin pages) was decorating cards on the Templates page too. Added adata-no-collapseopt-out — the helper early-returns for those cards and the index JS strips any chevron / collapsed state from cards as they're lifted into modals.
Removed — "Reusable templates" intro card
The standalone intro card is gone; its explanatory copy now lives in the Templates page title's
?tooltip (heading_help) so the legend is available without consuming a card slot. - Active-template pill now renders the brand colour at 18% opacity (
-
2.1.30May 20, 2026
Fixed — Frontend → Templates per-template modal layout
Per-template modals on the Frontend → Templates page now reflow cleanly. The customize-panel fieldset grid (Background / Fonts / Sidebar widgets / Sizes) used to inherit
grid-template-columns: repeat(auto-fit, minmax(240px, 1fr))from the standalone page; inside the narrower modal width that squeezed all four fieldsets into a single row, and their heavy.fieldset { padding: 2rem; gap: 2rem }chrome overflowed into neighbours. Inside.modal.tpl-modalthe grid is now capped at two columns (single column under 720px), fieldset padding is trimmed to1rem 1.25remwithgap: .75rem, and the picker thumbnail grid is tightened tominmax(180px, 1fr)so wide thumbs don't push the modal body past its parent panel.Section content inside each modal also reflows as a vertical flex stack with a 1.25rem gap so the picker form, the customize
<details>, and any follow-up settings form don't sit flush or appear to overlap. -
2.1.29May 20, 2026
Added — Announcement / event post galleries
Posts grow an image gallery (up to 6 images) that renders in a 3-column grid alongside the featured image on the public detail page with a click-to-zoom lightbox.
- Model: new
Post.gallery_json(JSON list of stored filenames);Post.gallery_filenamesproperty decodes, validates, and tail-truncates to 6._cleanup_retired_assetreference-counts the new column via a JSON-content scan so an image referenced by another post's gallery survives a delete. - Admin (
post_edit.html): new Gallery card after the Featured image card with a thumbnail grid (auto-fill 120px min,object-fit: cover), per-tile remove, multi-select upload, and File Browser picker. The picker opens in a new multi-select mode (?multi=1) — sticky bottom bar tallies selected items and posts them in one batch. Server save handler rebuilds the gallery list from three parallel streams (kept-existing, new uploads, picked media-ids) and routes removed files through_cleanup_retired_asset. - Public route:
GET /post-gallery-image/<pid>/<idx>(public blueprint) with?thumb=<size>(120/240/400/720/1080) via the existingthumbnails.ensure_thumbhelper. Cached thumbs ship withCache-Control: public, max-age=86400and clean up automatically when the source retires. - Frontend: shared
frontend/events/_gallery.htmlpartial included by all four event detail templates (classic, minimal, poster, timeline). 3-column grid with responsivesrcset(240w / 400w / 720w). Width matches the featured image per template — inside.fe-event-detail-cover-coland.fe-event-time-mainfor the templates with an inline featured image; capped atmax-width: 480pxcentred for poster + minimal. Uses the existing_lightbox.htmlpartial via thedata-lightbox-scopeconvention.
Added — File Browser multi-select picker mode
The File Browser modal grows a
?multi=1opt-in for batch selection — used by the post gallery picker, available to any future caller that wants to grab several files in one trip.- New
picker_multiflag on the route + adata-media-multi-barsticky bottom action bar insidemedia.htmlwith running count, Clear, and Add N items. - Per-item Select clicks toggle into a running
selectedSet instead of immediately posting; the host card / row flips into a brand-tintedis-selectedstate with the button label flipping to "Selected ✓". Add N itemsbutton posts a singlemedia-selected-batchpostMessageback with the full items array.
Fixed — File Browser list-view Select did nothing
The picker iframe's
.media-selectclick handler walked up the DOM viaclosest('.media-card')to fetch the data attributes — that selector only matched grid cards. List-view rows are<tr>with the samedata-media-id/data-stored/data-originalattributes but no.media-cardancestor, soclosestreturned null and the click no-op'd. Switched toclosest('[data-media-id]')so both views hit the same code path.Changed — Frontend → Templates page is now a sortable index of modals
The Templates page used to render every template-type configurator (Meetings list, Events list, Story detail, etc.) as a long stack of cards. Refactored into a sortable index of rows with per-template modals:
- All 16+
<section class="card fe-tplgrid-section">blocks are auto-discovered by JS and lifted into modal shells; an Edit button per row opens the matching modal. - An A→Z / Z→A sort toggle above the list (default A→Z) persists per browser via localStorage.
- Forms inside each modal use the yellow save-bar pattern: dirty triggers the bar, the bar's Save button POSTs every dirty form via fetch, animates "Saved" with the existing
fe-save-leavekeyframe, then resets — the modal stays open until the operator clicks the X. - Inline primary Save buttons inside each section are hidden in the modal so the save bar is the canonical commit affordance.
- Model: new
-
2.1.28May 19, 2026
Added — Trailing-slash tolerance app-wide
Flipped
app.url_map.strict_slashes = Falseincreate_appso any route resolves with or without a trailing slash. External links / typos like/contact/now reach the same handler as/contact; previously Werkzeug 404'd on the mismatched form depending on how the route was declared.Changed — Form-builder field cards expand on whole-card click + 200ms animation
The custom-form (and per-module form) field builder used to require clicking a dedicated Edit button to expand a field card. Replaced with a whole-card click target:
data-field-editbutton removed; clicking anywhere on a card (except the drag handle, delete button, or a raw input/select/textarea/button/link) toggles the body. Each card gets a chevron indicator on the right that rotates 180° on open. The body now animates open/close over 200ms viamax-height+opacity+padding+border-top-widthtransitions on theis-openclass.Changed — Module form list pages get a Manage form button
Stories, Announcements & Events, and Contact Form admin list pages now carry a Manage form button (settings icon) in the top action area linking to the matching form's settings page.
Changed — Templates page section cards remember collapsed state
Every
<section class="card">on/tspro/frontend/templatesstarts collapsed by default and persists per-card expansion state in localStorage. Heading is the clickable toggle; chevron indicator rotates on open. (Superseded by the 2.1.29 index-of-modals refactor.)Changed — Posts admin defaults to Posted newest-first; sort persisted
/tspro/announcementseventsdefault sort is nowposted_desc(newest at top by Posted date) for the active / drafts / archived tabs (pending keeps itssubmitted_descdefault). The chosen sort persists per browser via theview-posts-sortcookie.Changed — Forms widget pending counts replace lifetime totals
Dashboard Forms widget rows used to show
{subtitle} · {total} submissions · last {date}. The total is redundant with the attention badge on the right; subhead now reads just the unreviewed count ("3 pending review") and falls back to "all caught up" when nothing's waiting on the admin.Changed — "Form Submissions" sidebar → "Custom Form Submissions"
Sidebar entry renamed to match the page heading; the page itself gains a Manage forms button up top linking back to
/tspro/frontend/forms. -
2.1.27May 19, 2026
Added — File-type restrictions on form file uploads
File-type form fields in the form builder grow an Accepted file types input — comma-separated extensions or MIME types (
.pdf,.docxorimage/*). The HTML5acceptattribute drives the picker; a new server-side_accept_matcheshelper enforces the same rule on submit so a tampered POST can't smuggle a disallowed type through. The accept input auto-hides on non-file cards and toggles when the type changes. -
2.1.26May 19, 2026
Changed — Module form URLs
- Each module form's Preview button on the settings page now points to the form's current public URL — the admin-set custom slug when one is configured, the canonical path otherwise.
- The canonical paths (
/submissionform,/storyform,/contact) 302-redirect to the custom slug when set so only one URL serves the form at a time.
-
2.1.25May 19, 2026
Added — Story submission pipeline
Story submissions land in the Stories admin pending-review tab instead of Form Submissions. New public
/storyformroute (renders through the shared Submission Form template chrome — Classic / Minimal / Split) with optional file attachment + an Accept Terms checkbox. Admins approve to drafts, reject, or download the attached file for offline review. A one-shot importer on the Form Submission detail page migrates legacy custom-form story submissions into the new flow.Added — Form builder integrated into all three module forms
The custom-form field builder is now embedded in all three module-form settings pages (Announcements/Events, Story, Contact). Admins drag/edit/add/remove fields with the same UI custom forms use; each form ships with a default block set matching its built-in layout. Per-field labels, placeholders, help text, and options are editable inline inside the builder.
Added — Configurable public URL per module form
Each module form gains a configurable public URL slug — the built-in path keeps working and the catch-all dispatcher serves the form at the admin-picked slug as well. Settings page shows the canonical URL pre-populated so it's always visible.
Changed — Forms admin polish
Custom forms get a Visibility card with an on/off toggle matching the module-form pattern. "Submission Form" is renamed to "Announcements/Events Form" throughout the UI. Submission Form template card is renamed "Forms Template" since it now drives the chrome of every public form.
-
2.1.24May 19, 2026
Changed — Post edit page polish
- Top Save post / Save draft primary buttons replaced by the yellow save bar pattern. State transitions (Publish, Move to Drafts) stay in the top action area as explicit lifecycle actions.
- Summary field renamed to GSR Summary with an updated subhead.
- Headline card gets 1rem of breathing room between groupings.
- Event checkbox subhead changed to "Shows up in event feeds."
- Event details card hides entirely when the Event checkbox is off and toggles live without a save.
- Links card sits above Event details in the layout order.
-
2.1.23May 19, 2026
Added — Multi-row Links section on posts
The Event website field becomes a top-level Links section that applies to announcements and events alike. Each row carries a URL, a label, a Primary (solid) / Secondary (outline) button style dropdown, and an "open in new tab" checkbox. + Add another link stacks as many call-to-action buttons as needed; rows with a blank URL are silently dropped at save time. Frontend event detail templates (classic, poster) honour the per-link button style; minimal + timeline keep their inline text-link rendering.
-
2.1.22May 19, 2026
Added — Announcement auto-archive
Post edit gains an announcement-only "auto-archive after date/time" toggle (hidden when Event is checked — events already auto-archive via
event_ends_at). The auto-archive sweep handles announcements past their deadline and runs on the public list + detail routes so the public side stays in sync without an admin visit.Fixed — Posted on field
Edit form now populates from
display_postedso legacy rows show their stored timestamp.Changed — Event details consolidated
Event website + Event contact fold into the main Event details card as subheaded sections.
Changed — Meeting modal Queue-schedule-change submit is inline
Fetch-driven save with the existing yellow save bar flipping to Saved and animating out instead of closing the modal.
-
2.1.21May 19, 2026
Added — Public alert expiry + future schedule swaps
The meeting edit modal grows two scheduling helpers:
- Public Alert Message gets a toggle + datetime-local picker that auto-hides the alert after the chosen moment and wipes it from the field on the next page load.
- New Scheduled changes fieldset under Day & Times — queue a full future schedule swap with an effective date; the next page load past that date replaces the current days + times with the queued set and deletes the queued row.
Changed — Public meeting alert presentation
The public meeting alert background is solid amber (no more transparent wash) and the alert now also renders on the meetings list cards above the description across all three layouts.
-
2.1.20May 19, 2026
Added — Featured-image File Browser picker on post edit
Announcements & Events edit page gains a Choose from File Browser button next to the featured-image upload input. Opens the existing media picker modal; selecting an item swaps the inline preview, stashes the MediaItem id in a hidden input, and clears any pending file upload so the browser pick is what saves. Upload, picker, and the existing "Remove current image" checkbox are processed in priority order on the server.
-
2.1.19May 18, 2026
Added — Pending-submissions chip + unified Forms dashboard widget
- Sidebar chip on the Announcements & Events entry shows the number of visitor-submitted posts awaiting review.
- Dashboard Forms widget replaces the old standalone Contact Form widget, rolling up every form on the system (Submission Form, Contact Form, plus every CustomForm row) with submission counts, last activity, and warn-tinted attention badges. New custom forms surface automatically.
-
2.1.18May 18, 2026
Changed — Form Submissions list: card layout with per-row submitter preview
The Form Submissions index used to render each row as a thin "Form name · timestamp · IP · View details →" strip. Replaced with a card-per-row layout that surfaces who submitted, how to reach them, and what they wrote, so an operator can triage at a glance without opening every row.
- New
_summarise_form_submission(sub)helper inroutes.pywalks the parent CustomForm'sblocks_jsonto identify fields by type + name heuristics (since the operator types free-form labels): NAME_HINTS =full_name/your_name/submitter_name/name/contact_name; phone hints =phone/tel/mobile; subject hints =subject/title/topic; body hints =message/comments/body/details/description/notes. Returnsdisplay_name(with email-localpart and "Anonymous" fallbacks),email,phone,headline(140-char trimmed),field_count(non-empty answers),file_count. frontend_form_submissionsroute precomputes a{sub.id: preview}dict and threads it into the template so the Jinja loop stays declarative (no payload JSON parsing in the template).frontend_form_submissions.htmlrenders each submission as a card with:- a brand-blue avatar circle with the submitter's first initial (muted grey when "Anonymous")
- bold submitter name + form pill + site-local timestamp on the head row
- 2-line clamped headline below
- chips for email, phone, field count, file count (when present), and IP (muted, mono)
- right-side chevron with a hover slide on the card
- CSS replaced the old
.fe-submission-rowflat strip with the new.fe-submission-cardsystem — hover lifts the border to brand-blue with a soft shadow, mobile breakpoint at 640px drops the chevron and stacks the timestamp.
Changed — Zoom Accounts calendar shows 12-hour times
The grid's
cal-timecells used to render18:45–20:00. Now6:45 PM–8:00 PMvia the existing|fmt12hfilter — matches the rest of the app's time displays.Changed — Sidebar Intergroup section: "+ Add Library" → "+ Add IG Library"
The admin-only action pinned to the bottom of the Intergroup subsection used to read "+ Add Library" — easy to confuse with the standalone "+ New Library" button on the main libraries page (which creates a regular non-Intergroup library). Renamed to "+ Add IG Library" so the operator sees at a glance that this entry creates a library scoped to the Intergroup module.
Changed — Currently Online widget no longer shows the viewing admin
A small UX nit: the widget surfaced the admin who was viewing it, which added noise (the admin already knows they're signed in) and inflated the header count.
/api/online-usersnow drops the viewing admin fromusersand recomputes the activecountfrom the filtered list. The dashboard's server-metrics tile and its tooltip-names list got the same treatment so the count + names stay in sync between the two surfaces. - New
-
2.1.17May 18, 2026
Added — Custom forms support Cloudflare Turnstile
The events-submission form, the contact form, and the admin login all already gate POST through Cloudflare Turnstile when
SiteSetting.turnstile_enabledis on. Custom forms were the only public POST surface left without the same protection — bots could (theoretically) target an admin-authored form's URL directly.frontend/_custom_form_body.htmlrenders the standard<div class="cf-turnstile">widget (same chrome the contact + submission forms use) whensite.turnstile_enabled && site.turnstile_site_key. Picks up the Turnstile script for free — the wrappingfrontend/submission.htmldispatcher already loads it conditionally; no extra JS hop on the custom-form path.frontend.py::custom_form_submitruns_verify_turnstileagainstcf-turnstile-responsebefore any storage / email work whenturnstile_enabled. Failed verification builds a replay dict from the incoming form (proper checkbox multi-value handling so multi-select state survives) and re-renders the form with a new__turnstile__form-level error + HTTP 400. The visitor doesn't lose their typing.- Form-level error banner in
_custom_form_body.html— keyed oncform_errors['__turnstile__']so the rejection copy sits above the fields rather than associating with any single input. New.fe-custom-form-banner/.fe-custom-form-banner--errorCSS (light + dark mode variants).
Verified end-to-end with Cloudflare's always-passes test sitekey + a no-token POST against a custom form: widget renders, JS loaded, server rejects untokened POST with HTTP 400 + banner shown + typed values preserved.
-
2.1.16May 18, 2026
Changed — Off-site backup datetimes now render in the site's configured timezone
Every backup datetime display path was hard-coded to UTC even though admins set their tz on Settings → Timezone. Promoted everything to render in the site's local zone with a tz abbreviation suffix (e.g.
May 18, 03:00 PDT) instead ofMay 18, 03:00 UTC:- New
|fmt_site_localJinja filter (app/__init__.py) that attaches UTC to a naive datetime, converts tosite_timezone(SiteSetting), and formats with%Zso the abbreviation lands on the end. Already-aware datetimes are converted directly rather than double-stamped. backups_list.html(per-row last/next run + recent-activity rows),backups_runs.html(run history detail),index.htmlBackups dashboard widget (Last successful / Next scheduled run + Recent activity rows), and the wizard step-5 finalize flash all now run through the new filter.- Cron expression itself is interpreted in the site's timezone, not UTC.
compute_next_runinapp/backup_scheduler.pyattaches the site's zone to the base datetime before handing it to croniter, computes the next firing in local time, then converts back to naive-UTC for storage. So0 3 * * *now means 3 AM local (matching what the admin sees on the wall clock) — not 3 AM UTC. Falls back to UTC when no app context is available so the scheduler boot path stays robust. Both the wizard's step-3 schedule hint and the edit page's hint now read "interpreted in the site's timezone — set on Settings → Timezone".
Changed — Currently Online widget keeps idle users visible for an hour
The widget used to drop a user the moment their
last_seen_ataged past 5 minutes — handy for "who's working in the portal RIGHT NOW", but lost track of admins who'd been around recently and hadn't yet been seen by another. Lift the list cap from 5 min to 1 hour while keeping the 5-minute window as the "active" threshold:- New
IDLE_WINDOW = timedelta(hours=1)inapp/routes.py._online_users()now returns(active_count, users)whereusersis everyone within the 1-hour idle window (newest-first) andactive_countis the within-5-min subset — what the dashboard's server-metrics tile + the widget header still reports as "currently online". /api/online-usersadds anis_idleboolean per user (last_seen_atpast 5 min but within 1 hour)._online_widget.htmladdsfmtIdle(iso)returning "no activity in X mins" with pluralisation, renders idle rows with anis-idleclass +data-idle="1"attribute, and the per-second tick-updater picksfmtIdlevsfmtAgobased on the row's idle flag.- CSS for
.online-row.is-idledrops opacity to 0.55, mutes the avatar and location-link colors, and skips the just-moved flash so idle rows don't pulse. - Empty-state copy changed from "Nobody is currently signed in." to "No users active." — fires only when nobody's been seen at all in the past hour.
- The dashboard's server-metrics tile tooltip continues to list only the active subset, so the count and the names match.
Fixed — Newly-logged-in user shows up in the Currently Online widget immediately
User.last_seen_atwas only ever set by the request-tracker's before_request hook on a non-skipped GET. If a fresh login's post-redirect GET happened to be skip-listed (an asset request, an API ping) or the visitor closed the tab before the redirect resolved, the user wouldn't appear in the widget on the next 5-second poll.auth.loginnow stampsuser.last_seen_at = utcnow()at the momentlogin_user()returns, so the row enters the widget regardless of what the redirect lands on. - New
-
2.1.15May 18, 2026
Changed — Form Submissions moved out of the Web Frontend admin into the main app sidebar
The Form Submissions admin used to live as a Web Frontend subnav entry under Structure, alongside the form builder. Reaching the inbox from anywhere outside the Web Frontend admin meant clicking into the FE area first — an awkward extra step for a destination admins consult independently of the FE editing surface. Promoted it to a first-class sidebar entry in the Admin section of the main app sidebar.
Sidebar (
app/sidebar.py):- New
form_submissionsentry in_ADMIN_CATALOGwithendpoint="main.frontend_form_submissions"and anactive_kind="prefix:main.frontend_form_submission"so the link lights up both on the list and on the per-submission detail page. _is_visiblereturnsTrueonly for admins (user.is_admin()) — the link never enters the rendered HTML for non-admin sessions.- Picks up the existing
admin_reorder_catalogwalk automatically, so the item appears in Settings → Sidebar drag-reorder UI without further code changes.
Removed from Web Frontend admin (
_frontend_subnav.html):- Subnav link under Structure is gone (both the desktop nav
<a>and the mobile picker<option>).
Submissions admin pages now render standalone:
frontend_form_submissions.html+frontend_form_submission_detail.htmldropped their.fe-admin-layoutwrapper and_frontend_subnav.htmlinclude. They now render as plain admin pages (extendingbase.htmldirectly), matching the layout pattern ofcontact_form.html.- Submissions-list page's old "← Back to forms" top_actions link removed (the sidebar is now the canonical entry point).
- Detail page keeps its "← Back to submissions" top_actions link — that's natural list↔detail navigation, not Web-Frontend-specific chrome.
- New
-
2.1.14May 18, 2026
Fixed — Custom form submit 500'd when building the recipient-email subject
After the CSRF fix in 2.1.13, posting a valid CustomForm submission hit
AttributeError: 'SiteSetting' object has no attribute 'frontend_site_name'while building the recipient-email subject line. The brand-name column isfrontend_title, notfrontend_site_name— I'd guessed at the column name from memory rather than grepping the model. Fixed infrontend.py::custom_form_submit; also added the standardif site else Noneguard so a never-configured install doesn't trip on the attribute access either. -
2.1.13May 18, 2026
Fixed — Custom form submit returned "CSRF token is missing"
Every public CustomForm POST was rejected with HTTP 400
The CSRF token is missing.because the form body partial omitted the hidden CSRF input. Flask-WTF's app-wideCSRFProtectrequires a token on every POST; the legacy events-submission and contact public forms both include one. Added<input type="hidden" name="csrf_token" value="{{ csrf_token() }}">tofrontend/_custom_form_body.html, matching the shape the other two public forms use. -
2.1.12May 18, 2026
Added — Custom forms with a drag-and-drop field builder
A whole new admin-authored forms system: build any form from the Web Frontend admin, give it its own URL, collect submissions in a unified admin inbox. Lives alongside the existing events/announcements Submission Form and the dedicated Contact Form — those keep their specialised business logic untouched.
Models (new tables, auto-created via
db.create_all()on boot, no_migrate_sqliteneeded):CustomForm—slug(unique-indexed, drives the public URL),title,description(markdown-supported intro),blocks_json(the ordered field set),recipients_csv,redirect_url/thank_you_message(one wins on submit),enabled,created_at/updated_at.FormSubmission—form_idFK (cascade delete),payload_json({"fields": {…}, "files": {name → {stored, original}}}),ip,created_at.
Admin index (
Web Frontend → Forms) — same page as the registry-form list, with a new Custom forms section. Single + Add form button creates a disabled-by-default stub (Untitled form/untitled-form[-N]) and drops the operator onto the edit page with the title input autofocused + selected.Edit page (
/tspro/frontend/forms/custom/<id>/edit) — settings card on top (title, slug with reserved-route + Page-slug + CustomForm collision guards, description, recipients CSV, redirect URL / thank-you message, enabled toggle), field builder below. Eight field types:text,email,phone,textarea,select,radio,checkboxes,file. Per-field config: label, name (auto-snake-case from label, unique-suffixed on collision), required toggle, placeholder, help text, options (one-per-line for select/radio/checkboxes). HTML5 drag & drop reorder via the⋮⋮handle on each card; cards startdraggable="false"so cursor placement + drag-highlight in the field's textareas work normally — the handle'smousedownflips the card draggable for the duration of the gesture,dragend/ window-mouseupresets.Public render routes through the shared "Forms" template — the same
frontend/submission.htmldispatcher the events/announcements submission form uses, with the operator's currently-selected template variant (Classic / Minimal / Split), dynamic background, width mode, and padding. CustomForm-specific overrides (heading_override= title,intro_override= description piped through|markdown_block) sit in place of the SiteSetting defaults; a newform_body_partialparameter on each variant swaps the events form body forfrontend/_custom_form_body.html. Contact form unchanged — kept on its own template per product spec. The- listmarkdown shape works without the operator needing a blank line above (markdown_blockauto-inserts it).Submit handler validates fields against the form's blocks (
required, basic email format), stores aFormSubmissionrow, optionally emails recipients (one address per submission with Reply-To set to the submitter's email field when one exists), then either redirects toredirect_urlor renders the thank-you message inline. File uploads land underUPLOAD_FOLDERwith UUID-prefixed filenames; payload JSON stores the filename + the operator-uploaded original. Validation failures re-render with field-level errors AND previously-typed values so the visitor doesn't lose their typing.Form Submissions admin — new sidebar entry under Structure in the Web Frontend subnav. List page at
/tspro/frontend/forms/submissionsshows the 200 most recent submissions across all custom forms, filterable by form via a dropdown. Per-submission detail at/forms/submissions/<id>pairs each value with its field label (from the form's blocks_json), surfaces file attachments as download links, handles deleted-form edge case by falling back to a raw JSON payload view. Delete action with confirm.Checkboxes help — multi-line + markdown. The help-text input under a
checkboxesfield is a 4-row<textarea>with a 2000-char ceiling and a "Markdown supported" hint. Renders publicly through|markdown_blockinside a block-level<div>so multi-paragraph help, lists, links, emphasis all work. Other field types keep their existing single-line<input>+ plain-text render.Markdown description. The form's
descriptionfield on the edit page now advertises "Markdown supported" and renders through|markdown_blockon the public page, sitting in place of the variant's intro slot.Added — Stories list "Submit a story" call-to-action
The public
/storiespage can now carry an opt-in CTA button under its title + subheading that links to any form on the site. Two new SiteSetting columns (frontend_stories_list_submit_form,frontend_stories_list_submit_label) drive it. Admin Templates page picks the target form from a single grouped dropdown — Built-in forms optgroup for the registry entries, Custom forms optgroup for every CustomForm row (disabled forms show(disabled)next to their name). Identifier is stored as a registry-key (submission/contact) orcustom:<id>, resolved to a URL at render time so a CustomForm slug rename or deletion doesn't leave a dangling link. Empty / invalid / deleted-form identifiers cleanly hide the button. New shared partialfrontend/_stories_submit_cta.htmlincluded from each of the six variants (paper-stack, ledger, manuscript, broadsheet, minimal-serif, magazine) right after their heading area so the CTA sits at the top of the page where visitors look first. -
2.1.11May 18, 2026
Fixed — Dropbox backup target no longer expires every 4 hours
The Dropbox backup wizard collected a raw access token from the Dropbox developer console's "Generate access token" button. Since Dropbox's Sept-2021 auth change those tokens are short-lived (4-hour lifetime), so the scheduler's daily 3 AM run worked once and then failed every subsequent morning with
AuthError('expired_access_token', None). Dev mode is unrelated — the token lifetime is the same on dev and published apps.Switched the Dropbox path to the OAuth-with-refresh-token flow:
- Three new
BackupTargetcolumns (app_key,app_secret_enc,refresh_token_enc) + matching_migrate_sqliteentries. The legacyoauth_token_enccolumn stays so pre-2.1.11 targets keep working until they're migrated; the backend falls back to it when the refresh trio is empty. DropboxBackend.open()prefersdropbox.Dropbox(oauth2_refresh_token=…, app_key=…, app_secret=…)when those three are present — the SDK auto-mints a fresh short-lived access token on every call. Falls back to the legacy raw-token constructor when onlyoauth_token_encis set; raises a clear error message when neither is set.- New shared template partial
_backups_dropbox_fields.html— App key + App secret + Authorization code fields, plus a JS-driven "Open Dropbox authorization page" link that fills in the OAuth URL (https://www.dropbox.com/oauth2/authorize?client_id=<key>&response_type=code&token_access_type=offline) so the operator gets back a refresh token rather than another short-lived access token. Reused by both the wizard step 2 and the edit page so future changes land in one place. - New helper
_exchange_dropbox_auth_code()— POSTs tohttps://api.dropboxapi.com/oauth2/tokento swap the operator's one-time authorization code for a refresh token at save time. Mapsinvalid_grant/invalid_client/ missing-refresh-token / network errors to actionable flash messages. - Both POST handlers (
backups_wizard_step2_post+backups_edit_post) run the exchange whenauth_codeis present, persist the encrypted refresh token, and clearoauth_token_encso the backend stops falling back to the (now-expired) legacy token. - Yellow banner on
backups_list.htmlfor any Dropbox target that still has only the legacyoauth_token_enc, with a direct link to Edit so the operator can finish the OAuth dance in one click.
- Three new
-
2.1.10May 18, 2026
Added — Edit an off-site backup target after it's been added
Off-site backup targets were create-only — once a target was through the 5-step wizard, the only ways to change anything were Remove + recreate (loses run history) or hand-edit the row. New per-row Edit action on the backups list opens a single consolidated page with connection, schedule, and encryption sections stacked on one form. One Save button writes all three groups in one POST and redirects back to the list.
- New routes:
GET /settings/backups/<id>/edit(renders the edit page) andPOST /settings/backups/<id>/edit(consolidated save). Field-write logic mirrors the wizard's step 2 / 3 / 4 POST handlers exactly so a future refactor can lift them into one helper. - Schedule re-seeds
next_run_atwhen the target is currently enabled so a cron change takes effect on the next scheduler tick, not the next restart. - Encryption gating preserves leave-blank-to-keep-current for the passphrase and only requires the "I've saved it" acknowledgment on first turn-on or rotation — toggling an already-stored passphrase off doesn't re-prompt.
- Test connection posts connection-only fields to the wizard's step-2 endpoint (which skips encryption validation) so a half-typed passphrase doesn't block the network test.
- Read-only:
kind(FTP / SFTP / Dropbox). Switching backends mid-life would orphan the existing remote archives — make a new target instead.
Added — Admin-tunable shadow colour for primary + secondary card styles (light + dark mode)
Four new
Card stylesdesign fields on the Web Frontend Design page — Primary card — shadow color, Primary card — shadow color (dark mode), Secondary card — shadow color, Secondary card — shadow color (dark mode) — let admins recolour the box-shadow under their primary and secondary card surfaces from the historic neutral charcoal to anything (brand-tinted glow on hero cards, warm amber on feature cards, a cool cyan glow that only shows in dark mode, etc.).How it works
A new
SHADOW_SCALE_COMPONENTStable inapp/design.pymirrorsSHADOW_SCALEbut splits each preset into(offset+blur, alpha). The new helpershadow_with_color(scale_key, hex_color)composes a freshbox-shadowvalue by combining the chosen size scale's offset+blur with rgba derived from the operator's hex (alpha preserved from the scale).design_css_varsnow uses the helper to emit two pairs of vars per card style — light (--fe-card-primary-shadow/--fe-card-primary-hover-shadow) and dark (-shadow-dark/-hover-shadow-dark). Each card style's resting and hover shadow share the same tint within a mode so the surface stays visually coherent. Invalid hex inputs gracefully fall back to the canonicalSHADOW_SCALEstring so a bad override never silently drops the shadow.Dark-mode handoff is done in
frontend.cssviahtml[data-theme="dark"]selector rules that redirect every primary / secondary card consumer (.fe-card-primary,.fe-meeting-card,.fe-feature-card, …) to the-darkvariant, withvar(…, var(…))fallback to the light value so an install that hasn't customised the dark colour renders identically across modes.Defaults
All four fields default to
#0f172a(rgba 15, 23, 42) in every theme — the exact charcoal the old hardcodedSHADOW_SCALEbaked in — so existing installs render byte-identical until an admin opts in.Admin UX
Picks up the existing
kind="color"rendering automatically — color picker + hex chip + override toggle + reset button — and slots into the existing "Card styles" two-column layout (Primary card column on the left, Secondary card column on the right) right after the resting and hover shadow scale dropdowns.Changed — Web Frontend Overview tab refactored to a draggable widget grid
The Web Frontend Overview tab (
/tspro/frontend/) was just two toggles + a "Pick a section on the left to edit" placeholder list. Replaced with a customisable widget grid that mirrors the home dashboard's recipe end-to-end — same.dash-grid+[data-dashboard-reorder]chrome, same_dash_widget.htmlmacro, same drag-to-reorder JS, same Customize-modal pattern. Operators can hide widgets they don't care about and reorder the rest; preferences persist per-user.New widgets (default order):
- fe-status — public-frontend on/off toggle + the per-user sidebar auto-hide pref (the two existing toggles, kept as a widget so they can be reordered / hidden).
- fe-visitor-metrics — wide widget that lifts the five-tile overview bar straight out of
visitor_metrics.html(Views · 30d / Unique visitors / Today / Yesterday / Last 7 days), backed by the samevisitor_metrics.summary+daily_seriesaggregators the full metrics page uses. Header links through to/tspro/frontend/metrics. - fe-pages — last 6 updated content pages with a badge showing total page count.
- fe-redirects — total redirect count + the 5 most recent
source → targetpairs. - fe-navigation — header nav-item count + one-click into the navigation editor.
- fe-forms — every entry in
forms_registry.all_forms()(Submission, Contact) with its live/off state. - fe-branding — active theme name + logo-present indicator + shortcut to branding settings.
- fe-header-footer — pair of quick links to the Header and Footer editors.
Persistence: new
User.fe_dash_show_*boolean columns (one per widget, defaults True) +User.fe_dash_order_jsontext column for the per-user order. Matching_migrate_sqliteentries so existing installs pick them up additively.Routes: new
POST /tspro/frontend/customize(toggles) andPOST /tspro/frontend/order(JSON drag-reorder) mirrordashboard_customize/dashboard_order_saveexactly — same shape, same auth, same payload contract — so the existing dashboard-reorder JS inapp.jsworks on either grid unchanged (selector matches[data-dashboard-reorder]on whichever page is rendered).Removed: the "Pick a section on the left to edit" copy + the bulleted Header / Footer / Homepage / Pages list. Those links now live in the Header & Footer widget, the Pages widget, and the subnav.
Added — Optional passphrase encryption for full-portal bundles (AES-256-GCM)
Bundles contain the entire SQLite DB + every upload +
zoom.key(the Fernet seed that decrypts stored Zoom / OTP / Turnstile credentials). When transmitted through a TLS-terminating proxy like Cloudflare, the edge sees the bundle in plaintext during the upload — same exposure as any other HTTPS upload through CF, but it's worth options. Operators can now encrypt the bundle with a passphrase so only ciphertext ever leaves the source host.New module
app/bundle_crypto.py: streaming AES-256-GCM with a 32-byte key derived from the passphrase via PBKDF2-HMAC-SHA256 (600 000 iterations) and a fresh 16-byte random salt per export. Binary format is[magic 'TSPENC01' 8B][salt 16B][nonce 12B][ciphertext …][tag 16B]. Encrypt and decrypt both walk the input in 1 MiB blocks viacryptography's low-levelCipher.update / finalizeAPI so multi-GB bundles cost O(1) memory. GCM auth tag covers the entire ciphertext — wrong passphrase or any byte tampering raisesBundleDecryptErrorat finalize time.Export (
data_export→ POST): the form on Settings → Data → Export is now a POST form with an optional Encryption passphrase field. Empty → plain.zip(legacy GET path still works for scripted callers); non-empty → server stream-encrypts after building the bundle and servestsp-export-…-zip.encwithapplication/octet-stream. Passphrase rides in the POST body, never the URL, so it can't leak via Referer / server logs / browser history.Import (
data_importdirect +data_import_finalize): both routes now accept an optionalpassphraseform field. New helper_decrypt_if_encrypted(zip_path, passphrase)runs after the file is assembled on disk: detects theTSPENC01magic, decrypts to a fresh tempfile under the supplied passphrase, hands the decrypted path to the shared_perform_data_importhelper. Bundles without the magic skip decryption (passphrase is ignored with a "warning" flash so the operator catches a mismatched bundle before it overwrites the destination). Wrong passphrase / corrupted ciphertext → red flash with a clear explanation; no partial import. Cleanup unlinks the decrypted tempfile in the finally even when the import errors.Browser (
base.html): the Import form has a new password field — placeholder "Required only for encrypted bundles", autofill suppressed viaautocomplete="off". The chunked-upload JS reads the field and includes it in the synthetic finalize POST so the existing 90 MiB chunk flow works for.zip.encbundles unchanged — chunks are just ciphertext bytes on the wire, Cloudflare's edge sees nothing recognizable. File picker now accepts.encalongside.zip.Passphrase generator on the export form. Operators don't have to invent a strong passphrase: a Generate strong passphrase button (visible by default) produces a 24-character passphrase formatted as 6 groups of 4 (e.g.
Xk9p-Mw2N-jVqL-3Hbt-uR5z-PnAc) drawn from a 54-character alphabet that excludes the visually-ambiguousI l O 0 1so it can be transcribed from a printed page without second-guessing. ~138 bits of entropy. Inline Show/Hide toggle + Copy to clipboard button appear once the field has a value (clipboard falls back to a "Press Ctrl+C" selection state on older browsers / non-secure contexts wherenavigator.clipboardisn't available). Generated client-side viacrypto.getRandomValues()so the server never sees the passphrase until the encrypted bundle download is requested.Save-this-passphrase warning. A yellow
.flash.flash-warningbanner appears the moment the passphrase field has any value (typed or generated): "Save this passphrase before exporting. Store it somewhere safe — a password manager, encrypted notes app, or a printed page in a vault. Without it the encrypted bundle cannot be decrypted." No recovery channel exists; if the operator loses the passphrase the bundle is permanently undecryptable.Settings save-bar opt-out. The export form carries
data-no-ajax="1"so the Settings modal's save-bar tracker doesn't hide the primary submit button (the tracker normally hides.btn-primaryso the floating yellow Save bar owns the commit path — the right behaviour for "save these settings" forms, wrong for "trigger this download" forms). - New routes:
-
2.1.9May 18, 2026
Added — Chunked bundle restore so imports work behind a 100 MiB proxy cap (Cloudflare Free)
Cloudflare's Free plan caps proxied request bodies at 100 MiB, so any non-trivial restore bundle (DB + uploads dir in one zip) hit a 413 at the edge before the request even reached the app — no spinner, no flash, the user just got a Cloudflare error page. The Import form now slices the chosen archive into ~90 MiB pieces in the browser and uploads them as separate requests, then triggers the restore once every chunk has landed. No proxy config change, no operator paperwork — pick the file, type REPLACE, click Import, watch the progress bar.
Server (
app/routes.py):- New
POST /settings/import/chunk— accepts one chunk keyed by a per-upload UUID (upload_id),chunk_index, andtotal_chunks. Saves the chunk to<data_dir>/import-chunks/<upload_id>/<chunk_index:08d>.bin. Admin-only, validates the upload_id against a strict UUID regex (no path traversal), runs an idempotent sweep that removes abandoned chunk dirs older than 24 h on every chunk POST. - New
POST /settings/import/finalize— concatenates the chunks in order into a singletsp-import-chunked-*.zipin the data dir, then hands the assembled path to the shared_perform_data_importhelper that the direct-upload route already uses. Re-checks the REPLACE confirmation, verifies the chunk count matches the browser'sexpected_chunks(bails with a clear flash on mismatch + cleans the staging dir), cleans up after itself on both success and failure paths. - Extracted the existing
/settings/importbody into_perform_data_import(zip_path) -> (ok, redirect_url)so both the direct-upload (no-JS fallback) and the chunked-upload finalize call the exact same import logic. The direct route stays in place for clients that don't run JS or scripted callers that want a single-shot upload.
Browser (
base.html+app.css):- Form's submit handler intercepts on browsers with
fetch+File.prototype.slice+crypto.randomUUID(with a v4 polyfill fallback for older Safari). Slices the selected file at the 90 MiB boundary (under the 100 MiB cap with envelope room), POSTs each chunk viafetch, then synthesises a hidden form POST to/finalizeso the browser follows the server's redirect-to-logout natively (preserving the flashed status). On feature-test miss, the native form POST stays in place — the no-JS path still works for bundles small enough to pass the proxy. - New progress overlay (reuses the existing
.backup-busychrome) shows a brand-coloured progress bar with "Uploading bundle… — Chunk N of M — 270 MB of 1.2 GB", flips to "Reassembling and restoring…" once the final chunk lands, and surfaces an inline error message on a failed chunk so the operator knows to retry rather than being left staring at a hung spinner. - Card now carries a one-liner above the form explaining the 90 MB chunking behaviour, so operators behind a proxy understand why it works without them having to read the changelog.
- New
-
2.1.8May 18, 2026
Fixed — Bundle restore: recycle gunicorn workers so sibling workers see the new DB
After a full-portal import, only the worker that ran the restore disposes its SQLAlchemy engine — sibling sync workers continue serving from connection-pool handles to the pre-restore SQLite file. Linux keeps the moved file readable through the open fd even after
shutil.move, so the symptom is intermittent: subsequent requests pick a worker round-robin, and the ones that land on the stale pool render the pre-restore DB (missing rows, 404s on uploaded media that the new DB does reference, occasional CSRF mismatches). Misdiagnosed as a cookie-collision issue on same-host dev/test pairs — the per-secret SESSION_COOKIE_NAME suffix already handles that cleanly.data_importnow signalsSIGHUPto the gunicorn master after the file swap. Gunicorn's HUP handler spawns fresh workers, waits until they're ready, then gracefully shuts down the old ones — the current worker finishes serving its redirect-to-logout before honouring the shutdown, so the user's response still ships. Guarded by a parent-cmdline check so it's a no-op underpython run.py(debug, single process) — sending SIGHUP to bash would close the terminal. -
2.1.7May 18, 2026
Fixed — Bundle restore: auto-disable Turnstile on host change + clear login lockouts
Restoring a prod bundle with Turnstile enabled into an install on a different host (e.g. local dev / test VM) was a silent lockout: the Cloudflare sitekey is domain-bound, the widget either fails to render or fails to issue a token at the new host, and
_verify_turnstile(which runs before the password check inapp/auth.py) rejects every attempt with "Security check failed" — easy to misread as bad credentials, and each attempt counts toward the per-IP / per-username rate-limit lockout.Two-sided fix so both the source and destination cooperate:
- Export (
app/backup.py) bumps manifestformat_versionto2and adds two context fields:source_host(the request host the export was triggered from, best-effort — scheduled background snapshots can't see one and writenull) andturnstile_enabled_at_export(so the importer doesn't need to peek at the restored DB to know whether to bother). The note in the manifest now also calls out the auto-disable behaviour. - Import (
data_importinapp/routes.py) readssource_hostfrom the bundle's manifest, compares to the current request host, and if they differ — or either is missing (pre-v2 bundles default to scrub) — flipssite_setting.turnstile_enabledoff and flashes a clear warning that names both hosts and points the admin at Settings → Security to re-enable once the sitekey matches the new host. Sitekey + encrypted secret are preserved on the row so a same-host re-import only costs one toggle flip. The importer also wipeslogin_failureso any lockout the admin accumulated bouncing off Turnstile mid-restore doesn't wedge them out on the new install.
- Export (
-
2.1.6May 17, 2026
Added — Restore bundle: busy spinner while the upload is in flight
The Settings → Data → Import form now mounts a full-viewport
.backup-busyoverlay (re-using the spinner already styled for the backup wizard) on submit, with "Restoring bundle…" / "Uploading the archive and replacing data. Don't close this tab." copy. The submit button flips toRestoring…and is disabled so the operator can't double-post. Resolves the silent-click confusion on multi-hundred-MB bundles where the browser shows no progress for tens of seconds while the upload streams.Fixed — Full-portal Import: lift 256 MiB upload cap + friendly 413 page
The Settings → Data → Import form was silently failing on any prod restore bundle bigger than 256 MiB. Flask's
MAX_CONTENT_LENGTH(hard-coded at256 * 1024 * 1024) short-circuits the request with HTTP 413 beforedata_importeven runs, so the browser navigated to a bare error body that rendered as a blank page — no flash, no clue. After back-button the app still worked, but no data had imported. Triggered as soon as the source install accumulated a couple hundred MB of media — the uploads dir alone is part of the bundle.Two changes in
app/__init__.py:- Default cap raised to 4 GiB and made env-configurable via new
TSP_MAX_UPLOAD_MB(megabytes; default4096, falls back to4096on a bad value). Headroom for whole-portal restore archives without committing to "unlimited" — installs that need a tighter ceiling can dial it down. - 413 errorhandler flashes
"Upload too large — exceeds the N MB limit. Raise TSP_MAX_UPLOAD_MB on the server and restart, then retry."and redirects to the Referer (same-host validated againstrequest.hostto avoid open-redirect; falls back tomain.index). The user lands back on the form they submitted instead of staring at a blank page.
CLAUDE.md updated to document the new default + env var.
Fixed — Meeting edit modal: page behind reloads after a successful save
The meeting edit modal intercepts submit via
fetch()to keep the modal open after a save (so the operator can keep editing), but the host page behind the modal was still rendering pre-save data once the modal was dismissed. The save handler in_meeting_modal.htmlnow setsmodal.dataset.reloadOnClose = '1'on a successful save, and aMutationObserveron the modal'saria-hiddenattribute fireswindow.location.reload()the moment the modal closes by any path (Cancel button, X, Esc, or backdrop click). The keep-open-after-save UX is preserved — the reload only fires when the operator actually dismisses the modal, and saving twice before closing still results in exactly one reload. - Default cap raised to 4 GiB and made env-configurable via new
-
2.1.5May 17, 2026
Added — Audience controls on the email-list blast (Full list / Granular)
The Send-an-update page now opens with a full Audience card above Compose. Two radio modes, same shape MeetingLibrary uses for its all/granular reading selection:
- Full list (default) — fans out to every subscriber + every user with the
intergroup_memberrole + every editor / viewer account. A static summary line under the radio readsX subscribers + Y intergroup + Z app users · TOTAL total (before email-dedupe)so the admin can see the spread before sending. Group toggles collapse via.ts-aud-groups[hidden] { display: none }(the bare HTMLhiddenattribute was being outranked by the block'sdisplay: flex). - Granular — reveals three group checkboxes (Subscribers / Intergroup members / App users). Inside Subscribers, a further "All subscribers" / "Pick which subscribers" radio reveals a scrollable checkbox list of every subscriber with Select all / Clear controls. A live summary line under the Granular radio updates on every audience-input change — group toggles, subs sub-mode flip, per-subscriber checkboxes, the bulk Select all / Clear — showing the same group + total counts the Full-list summary shows, recomputed from the current selection.
The send handler now validates
audience_modetoall/granular, inallforces every group + the subs sub-mode on so a stale form posts cleanly, and ingranularreads the per-group toggles + thesubscriber_idscheckbox whitelist (coerced to ints, only known rows allowed). Combined recipient list is deduped by lowercased email so a person in two groups gets one copy; the personalization{name}token uses the row's own name (subscriber.name oruser.name or user.username) so each recipient still sees their own. Therecipient_counton the resulting BlastRun row reflects the deduped count, not the raw group sum.Added — Auto-hide app sidebar inside the Web Frontend admin
New
User.fe_admin_autohide_sidebarboolean column (default True,ALTER TABLE ADD COLUMNmigration). When on, the main app sidebar collapses to a hamburger button while the user is on a/frontend/…route — the Web Frontend has its own sub-nav (.fe-admin-subnav) so the outer sidebar competes with editing canvas width on laptops.body.fe-admin-autohideis set frombase.htmlonly when both conditions match; a new CSS ruleset under the existing@media (max-width: 900px)block mirrors its selectors at every viewport width so.sidebarbecomesposition: fixed; transform: translateX(-100%)and.menu-btn { display: grid }. The existing menu-toggle handler drives.sidebar.openunchanged.A new toggle row on the Web Frontend overview page lets the admin flip the pref off; the form carries
data-fe-auto-submitso the FE save-bar tracker'strackable()check skips it (same opt-out the existing public-frontend toggle uses), avoiding a spurious "Unsaved changes" flash.Added — Name field on User accounts
User.name— new optionalString(120)column with a matching_migrate_sqlite ALTER TABLEentry. Distinct fromusername(the login handle):nameis the friendly display form ("Jane D."). Surfaced everywhere User contact info shows up:- Create User card has a Name input between Username and Email.
- All-users table has a Name column.
- Edit user modal has a Name input alongside Username / Email / Phone.
users_createreads + persistsname;users_updatehonours anif "name" in request.formclause so submit-blank clears, omit-key leaves the row alone.
The email-list blast falls back to
user.name or user.usernamewhen building the{name}personalization token from the IG-members or app-users groups, so blast recipients see their friendly name even if they never set up a TrustedServantSubscriber row.Changed — Sidebar links that leave the Web Frontend keep the sidebar open
Click handler in
app.jsnow checksbody.fe-admin-autohide: when the click target'shrefdoesn't include/frontend/, the sidebar stays open through the navigation. The destination page doesn't carry the auto-hide body class so its sidebar renders statically visible — the previous unconditionalclassList.remove('open')produced a distracting slide-out + reflow + slide-in. In-Web-Frontend links still close the slide-in sidebar as before, and the mobile-breakpoint behaviour on non-FE pages is unchanged.Changed — Email-list cards drop the right border + the brand-blue left accent
Scoped CSS rule
.ts-page-wrap .card.data-card { border-right: 0; border-left: 1px solid var(--border) }runs only inside the email-list admin pages (/email-list+/email-list/blast). The cards now sit with shadow + top + bottom + faint 1 px left/no right hairlines — the brand-blue accent reads as redundant chrome against.content's gutter on these wide-table pages. Every other consumer of.data-card(Settings panes, backups admin modal, email-list import wizard) keeps the full four-sided border + brand-blue accent.Changed — Email-list page title
The
/email-listpage heading was set to "Trusted Servants Email List" (the full module name) while the sidebar link stays as the shorter "Email List". The.ts-page-wrapouter wrap dropped its narrowingmax-width: 1080px; margin: 0 autoconstraint so the page sits flush inmain.contentlike every other admin page; the wrap keeps just the flex-column + 1 rem gap shape. - Full list (default) — fans out to every subscriber + every user with the
-
2.1.4May 17, 2026
Changed — Trusted Servants dashboard widget always shows when enabled
The widget no longer auto-hides itself after a user subscribes. The visibility gate in
index.htmldropped theand not trusted_servants_subscriptioncondition; the widget now renders whenevertrusted_servants_enabledis True and the user hasdash_show_trusted_servantschecked. Two render modes inside the widget body:- Not yet subscribed — title "Join the Trusted Servants list", fields pre-fill from the
Useraccount (username / email / phone), primary action Join the list. - Already subscribed — title "Your Trusted Servants info", fields pre-fill from the existing
TrustedServantSubscriberrow so the values shown match what admins see in the roster, primary action Save changes, plus a secondary Remove me from the list action below a thin divider. The secondary action POSTs to the existing/email-list/unsubscribeendpoint and is danger-tinted but transparent (text + hover background only — gentler thanbtn-dangersince the user is removing themselves, not destroying data).
The
/email-list/subscribeendpoint was already upsert-shaped (creates a new row when the user has no subscription, updates the existing one otherwise) so the form action stays the same for both modes — no route change needed. - Not yet subscribed — title "Join the Trusted Servants list", fields pre-fill from the
-
2.1.3May 17, 2026
Added — Trusted Servants Email List module
A self-contained admin-managed contact roster + mass-email surface, scoped to the public-facing URL
/email-list. Two new tables back it —TrustedServantSubscriber(one row per entry;user_idFK is nullable + unique so portal-user self-subscriptions and admin-added external contacts share the same table without duplicate constraints) andTrustedServantBlast(per-send history with subject + markdown body + recipient / sent / failed counts + started/finished timestamps + sender FK). Two newSiteSettingcolumns —trusted_servants_enabled/trusted_servants_required_role— drive the Modules-tab toggle and the role gate; a newdash_show_trusted_servantscolumn onUsercontrols the dashboard widget. All four schema additions ship with matching_migrate_sqliteALTER entries.Three entry points:
- Dashboard sign-up widget (
index.htmlwidget block keyedtrusted-servants) — visible to every signed-in user until they've added themselves. Form pre-fills name from the user's username, email fromUser.email, phone fromUser.phone; submits to/email-list/subscribewhich upserts the subscription. The widget auto-retires once the user is on the list. Dashboard's Customize modal carries a matching toggle row. - Admin manage page at
/email-list— table of subscribers with per-row Edit / Delete actions, an "Add manually" modal for external contacts (creates rows withuser_id = NULL), an "Import CSV" wizard (see below), a "Send an update" CTA, and a send-history card showing the last 25 blasts. - Mass-email compose at
/email-list/blast— subject + Markdown body. Submit fires one SMTP send per recipient (via the existingmail.send_mail) so the body can be personalized with a{name}token; failures don't abort the loop — each recipient is tried independently and theBlastRunrow records sent vs failed counts. A full-screen busy overlay blocks the page while the synchronous loop runs.
Added — CSV import wizard (multi-step iframe modal) for the email list
/email-list/importis now a three-step wizard that lives inside an iframe modal (same pattern as the off-site backup wizard). Step 1 takes the upload; step 2 renders the auto-detected column mapping + a live dry-run summary + the first 20 sample rows; step 3 commits and auto-closes. The whole flow stays inside the same modal until completion — no full-page redirects.Column auto-detection normalizes each header to lowercase-no-punct and matches against alias sets:
- Name —
Name,Full Name,Display Name,Contact Name,Subscriber Name, or aFirst Name+Last Namepair concatenated at write time. - Email (required) —
Email,Email Address,Mail,Mail Address,Contact Email,Email ID. - Phone (optional) —
Phone,Phone Number,Mobile,Cell,Tel,Telephone,Contact Phone.
Any column whose header doesn't match (Status, Role, Notes, internal IDs, etc.) is dropped — extra columns can't break the import. Encoding auto-detect: UTF-8 with BOM stripping → UTF-8 with replacement → latin-1 fallback. Delimiter detection:
csv.Snifferprobes for comma / semicolon / tab / pipe with comma as the default. The parsed CSV is stashed on disk as JSON under<DATA_DIR>/ts_import/<token>.jsonso the file uploads once and the mapping form can re-preview without re-uploading; a 24h sweep runs on every upload to purge abandoned imports.Each mapping
<select>lists every header in the CSV plus an explicit "— none —" option. Changing any dropdown auto-re-renders the preview via a GET that preserves the token + embed flag + every other select's value, so the dry-run tally + sample table stay in sync without an explicit "re-run" click. Sticky footer pinned to the iframe viewport bottom keeps Cancel / ← Back / Import N rows reachable while the admin scrolls through a long mapping or sample.Row filtering: blank rows skipped, rows missing name or email skipped, rows with malformed email (no
@or no dot in the domain) skipped, duplicate emails (case-insensitive, against existing rows + earlier rows in the same CSV) skipped. 5000-row cap per upload so a misclicked huge file can't hang the request.Added — Watchtower quicknav button + Web Frontend "Web" / "View" relabel
A new pinned button cluster sits above the sidebar search bar and below the brand block. Row 1 carries Web (admin panel, with the live/off status dot) and View (public site, opens in a new tab) — both labels were shortened from "Web Frontend" / "View site" so they fit the half-width quicknav grid cells without ellipsis truncation. Row 2 (every admin) is a full-width Watchtower button with a
shieldicon and up to two right-aligned attention chips: an ambernav-badge-warnfor pending access requests (pending_access_count, already in the context processor), and a brand-blue chip for currently-locked accounts (locked_accounts_count, added toinject_globals— one query againstLoginFailureonly for admin viewers). When neither count is > 0 the chip slot collapses so the button reads as a clean "Watchtower" with no decoration.Both
watchtowerandweb_frontendentries are now hidden from the Admin-section catalog inapp/sidebar.py(_is_visiblereturns False) — exactly one entry point per surface.contact_formstays in the catalog since it isn't part of Watchtower.Changed — Dashboard widgets adopt data-card chrome (without the brand left accent)
Every dashboard widget — both the seven macro-driven ones (Recent Meetings, Libraries, Recent Files, Visitor Metrics, Off-site Backups, Recent Deletions, Contact Form, Trusted Servants sign-up) and the three structurally-unique ones (Server Metrics, Currently Online, Access Requests) — now renders inside a
.card.data-cardsection. The macro head row is now a.data-card-headflex line: [≡ drag handle (inline)] [icon] [Title] [optional badge] [View all →]. Each call site passes ahead_iconLucide key (calendarfor Meetings,book-openfor Libraries,file-textfor Files,bar-chartfor Visitor Metrics,cloud-uploadfor Backups,trash-2for Deletions,mailfor Contact Form,user-plusfor Trusted Servants / Access Requests,usersfor Currently Online).Two specific behaviors:
- Drag handle inlined in the head row. Previously absolutely positioned at
top: 10px; left: 10pxwith a.dash-widget .card-head { padding-left: 38px }rule clearing space for it. The new macro structure embeds the handle inside.data-card-headdirectly, so it lives in the flex flow and the.data-card-head { gap: .6rem }spacing handles separation..dash-widget-head .dash-drag-handle { position: static }overrides the global absolute placement; the chip's hover styling continues to come from.dash-drag-handle:hover. - Brand-blue left accent suppressed in the dashboard context. The standard
.data-card { border-left: 4px solid var(--brand) }reads as visual noise next to the dashboard's tight masonry, so a scoped.dash-grid .card.data-card { border-left: 1px solid var(--border) }rule restores a uniform 1 px edge inside.dash-grid. Settings panes, embed-mode admin iframes (backups admin, email-list import wizard), and every other consumer of.data-cardkeep the accent.
The macro's
iconparameter was renamed tohead_iconso it doesn't shadow the globalicon()Jinja helper used to render the SVG inside the macro body.Changed — Public URL renamed from
/trusted-servantsto/email-listAll 13 public paths under the module moved from
/trusted-servants…to/email-list…. Endpoint function names (trusted_servants_list,trusted_servants_import_confirm, etc.) and the SQLAlchemy table names (trusted_servant_subscriber,trusted_servant_blast) stayed put so everyurl_for("main.trusted_servants_*")reference + the sidebar'sactive_kind="prefix:main.trusted_servants"keep matching. The admin toggle at/settings/trusted-servants-toggleis a different path prefix and was deliberately left alone. The page heading was set to "Trusted Servants Email List" (the full module name) while the sidebar link stays as the shorter "Email List". The page wrap dropped itsmax-width: 1080px; margin: 0 autosince the outermain.contentalready caps width at 1400 px — the old wrap centered the page inside a narrower band and produced a visibly oversized left margin compared to every other admin page. - Dashboard sign-up widget (
-
2.1.2May 17, 2026
Added — Submission form template system (Classic / Minimal / Split)
The public
/submissionformpage is now templated. Three layouts ship at launch in a newSUBMISSION_FORM_TEMPLATESregistry inapp/frontend.py: Classic (centered single-column card on a tinted surface — bit-for-bit identical to what previously rendered), Minimal (borderless, serif heading on a thin rule, intro flows into the body, no card chrome), and Split (sticky rail on the left with heading + subheading + intro markdown, form card on the right; collapses to one column below 880 px). The route picks the active variant viaSiteSetting.frontend_submission_form_templateand dispatches to a partial underapp/templates/frontend/submission/<key>.html; adding a future layout is one partial + one entry in the registry.The new admin surface lives under Web Frontend → Templates → Submission form (/submissionform). Each variant gets a picker card with a rendered thumbnail silhouette (classic = card-with-rows, minimal = serif-title + rule + flat lines, split = two-column side/main grid) plus the full
tpl_customize_panelmacro the rest of the templated sections use — per-template background colour with dark-mode pairing, dynbg key + overlay + palette config, heading font, body font, heading-size override, body-size override, all routed through the sharedfrontend_template_settings_jsonJSON bucket keyed undersubmission_form. A Boxed / Full width radio drivesfrontend_submission_form_width_modewith companion max-width (480–2400 px) and side-padding (0–20 %) knobs.New
SiteSettingcolumns:frontend_submission_form_template(default"classic"),frontend_submission_form_width_mode,frontend_submission_form_max_width(default 720),frontend_submission_form_padding_pct(default 5),frontend_submission_form_bg_dynamic_key,frontend_submission_form_bg_dynbg_config_json. All six get matching_migrate_sqliteentries so existing installs pick up the columns additively. A newfrontend_submission_form_template_saveroute persists the picker + layout knobs;submission_formwas appended to_TEMPLATE_KINDSand the catalog-dispatch map infrontend_template_settings_saveso the shared customize-panel POST endpoint also accepts the kind. Heading / subheading / intro copy and form behaviour (allowed types, submit label, success message) continue to live on the existing Forms admin surface — this release only adds the appearance dimension.Changed — Submission form card opts into the Primary-card design tokens
.fe-submission-cardno longer carries its own hard-coded#ffffffbackground,var(--fe-accent)border colour, custom 16 px shadow recipe, or 160 ms transition. It now pullsbackground: var(--fe-color-card-primary-bg),border: var(--fe-card-primary-border-width) solid var(--fe-color-card-primary-border), and inherits shadow / transition / hover lift / hover border colour from the shared Primary-card aggregator block at the bottom offrontend.css(.fe-submission-cardwas added to both the shape-class list and the hover-class list). Dark-mode override added alongside.fe-mlist-card's rule so the card flips to--fe-color-card-primary-bg-dark/--fe-color-card-primary-border-darkin dark mode. Net effect: Site → Design → Card styles → Primary card now re-tints the submission form's card uniformly with every other primary card on the public site (meetings list, events list, fellowships, library items, etc.). Border radius stays at 16 px and padding stays at the 2 rem / 2.25 rem inset — those weren't tokenised at the site level so they remain on the card's own rule. -
2.1.1May 17, 2026
Changed — Settings modal tabs unified on a single data-card chrome
Six settings tabs (Appearance, Users, Global, Domain / Email, Timezone, Security, Sidebar) now share the same
<section class="card data-card">chrome the Data tab introduced — brand-blue left accent, soft shadow, icon-led head with adata-card-headLucide icon + title, optionaldata-card-leaddescription, optional right-aligneddata-card-head-actionsslot for primary buttons. Every tab is now a single-column vertical stack of these cards. Tab-specific pane CSS converged onpadding: 20px 24px; gap: 8px; flex-direction: columnwith a.data-card > .form { margin: 0; padding: 0; gap: 14px }rule per tab so forms inside cards adopt the card's spacing instead of the global.form { gap: 2rem }. Dead chrome —.appearance-pane,.appearance-grid,.appearance-theme,.security-grid,.security-col,.users-top-grid > .card,.sidebar-order-head,.sidebar-order-title, every<hr class="settings-sep">separator inside refactored panes — is gone.The Users tab is the one exception to "one card per section" — Create User and Roles & permissions stay side-by-side inside a single "Add a user" data-card. The permissions list reads as guidance for picking the right role on the form, not a disconnected reference, so collapsing them into one card with two
<h3 class="users-subhead">sub-headings matches the user's expectation. All other refactored tabs render one stacked card per logical section.Changed — Locations card hosts the "+ New Location" button in its head
The Global tab's Locations section moved its primary action from a standalone bar at the top of the iframe (
embed-actionsdiv +top_actionsblock) into a new right-aligned slot inside thedata-card-head. The slot is exposed as.data-card-head-actions { margin-left: auto; display: flex; align-items: center; gap: 8px; font-weight: 400 }so any future card can use the same pattern. Companion rule.data-card-head .btn .icon { color: currentColor }overrides the brand-blue tint the head applies to its leading title icon so the "+" inside a.btn-primarydoesn't render invisible against the brand-blue button background.Changed — Email tab renamed to "Domain / Email"; Public Domain moved there
The tab label
data-tab="email"is now "Domain / Email" and the Public Domain section migrated from the Appearance tab into a new top card on this tab. Form action (main.site_url_save) is unchanged. The Access Request Notifications recipient field collapsed into the SMTP Server card as a single labeled input below the From-email row, eliminating the in-form<hr class="settings-sep">divider and the redundant inner.u-namesub-heading; one Save button now commits SMTP credentials + access-request recipient together. Test-email form moved to its own third data-card.Changed — Embed-mode data-cards keep their brand accent + shadow
body.embed .card.data-card { ... }restoresborder-left: 4px solid var(--brand),border-radius: var(--radius),box-shadow: var(--shadow),padding: 2rem,margin: 0 0 16pxinside iframe-embedded pages (Global tab, Backups admin modal, etc.). The genericbody.embed .cardrule from before this release stripped all of those for plain list cards to keep them flush inside iframes; data-cards rely on those declarations for their visual identity, so they needed an explicit override.Changed — Release-notes formatting: 2 rem above headings, paragraphs as bullets
In the About tab's "Release notes"
<details>, every<h3>/<h4>subsection heading inside.release-notes > linow getsmargin-top: 2rem(with a smaller.75remfor the very first heading in the entry so the date line + first section don't push off the top). Paragraphs that follow a heading — selected via theh3 ~ psibling combinator — render as brand-bulleted list items via a::beforecontent"•"onpadding-left: 1.15rem. Intro paragraphs before the first heading stay as flowing prose; only body paragraphs within a subsection bullet.Changed — Backups dashboard widget Open Graph icon reuse
When the user opens the Manage Backups iframe modal, the existing iframe lazy-load path correctly restores
data-src→srcon next open even after the close handler blanks it out. Addedbackups-frameto the close-time blank list alongsidewp-import-frame,story-edit-frame,backup-wizard-frame. (Item from 2.1.0 development log retroactively documented — the line was already in code but missing from CHANGELOG.)Added — Sidebar tab "Save sidebar order" button in card head
The Save button moved from inside the form body (where it sat above the description paragraph in a
sidebar-order-headflex row) into thedata-card-head-actionsslot — clicking save no longer requires scrolling past the manual-reorder list to find it. Same right-aligned slot pattern used by the Locations card. -
2.1.0May 17, 2026
Added — Automated off-site backups (FTP / FTPS / SFTP / Dropbox)
Two new tables —
BackupTarget(per-destination config) andBackupRun(per-attempt history) — back a complete off-site backup subsystem. The archive payload reuses the existingtsp-export-<stamp>.zipbuilder (DB viaVACUUM INTO+uploads/+zoom.key+manifest.json), now extracted fromroutes.data_exportinto a sharedapp.backup.build_export_archive(app)so the manual export route and the scheduled runs produce byte-identical archives. Three backends sit behind a uniformopen/put/list/delete/fetch/closesurface inapp/backup_backends.py:FTPBackend(stdlibftplib, FTPS by default with a plain-FTP opt-out),SFTPBackend(paramiko, password and/or private-key auth, supports Ed25519/ECDSA/RSA/DSA key formats), andDropboxBackend(Dropbox SDK with chunked-upload session for >150 MB archives). All credentials are Fernet-encrypted via the existingapp/crypto.pyhelpers; every delete/list path refuses non-export filenames so a misconfiguredremote_pathcannot sweep unrelated files.app/backup_scheduler.pyadds a single daemon thread started fromcreate_app(). The thread is gated by a non-blockingflockon<DATA_DIR>/.backup-scheduler.lockso only one of the two gunicorn workers drives the loop; the loser sleeps harmlessly.croniterparsesBackupTarget.schedule_cronandcompute_next_run()writes the next firing intoBackupTarget.next_run_atafter every run.run_target(app, target_id)is synchronous and used by both the scheduler and the "Run now" route — it builds the archive, optionally encrypts it (PBKDF2-HMAC-SHA256 → Fernet over a passphrase, with a 21-byteTSPB-tagged header so the format is self-identifying), uploads, prunes remote retention only after a successful put so a botched upload cannot remove the prior good copy, writes theBackupRunrow, updates the target'slast_statusmirror, and emails the admin via the existing SMTP path on ok→failed transitions only (no storm on consecutive failures).The Dropbox backend wraps every API call in a
_prefer_ipv4()context manager that temporarily overridesurllib3.util.connection.allowed_gai_familyto returnAF_INET. Docker's default bridge network is IPv4-only; without the override,getaddrinforeturns AAAA records (e.g.2620:100:601c:19::a27d:613forapi.dropboxapi.com) that urllib3 tries first and the kernel can't route, producingENETUNREACH(errno 101). The patch is scoped to Dropbox calls so the WordPress importer or any otherrequestsconsumer keeps its IPv6 capability if it needs it.Added — 5-step backup setup wizard as an iframe modal
Wizard pages (
backups_wizard_step1.htmlthrough_step5.html+_done.html) match the existing WordPress importer'swp-wizard-stepperchrome and embed-mode pattern. Steps: Destination (radio cards for FTP / SFTP / Dropbox) → Connect (kind-specific credentials with an AJAX "Test connection" probe that round-trips a 1-byte sentinel file) → Schedule (preset chips + custom cron + retention count) → Encryption (opt-in passphrase with a "I've saved this" acknowledgement gate) → Review (summary + optional run-now). New#backup-wizard-modallives inbase.htmlwith a lazy-loaded iframe pointing at/settings/backups/new?embed=1; the close handler blanks the iframesrcso reopening starts a fresh wizard. In embed mode, every step's form carries a hiddenembed=1input, the "Cancel" / "Back" links postMessage the parent (backups-modal-close) to dismiss the modal, and the final step rendersbackups_wizard_done.htmlwhich auto-closes after 1.2 s on success or waits for the Done click on failure.Added — Backups admin iframe modal (stacks above settings)
New
#backups-modalhostsbackups_list.html,backups_runs.html, andbackups_restore.htmlin embed mode so the user can manage targets without leaving the settings overlay. Thebackups_list/_runs/_restoreroutes all accept?embed=1and propagate it through every redirect target (backups_delete,backups_restore_post, etc.) via a new_backup_embed_kwargs()helper. Inside the embedded admin, "Add backup target" postMessages the parent (backups-open-wizard) so the wizard modal stacks on top instead of replacing the iframe. The wizard'sbackups-modal-closehandler now checks whether the admin modal is open: if so it reloads just thebackups-frameiframe; otherwise it reloads the whole page so the Data-tab chip refreshes. Thebackups-frameiframe is added to the close-time blank list alongsidewp-import-frame,story-edit-frame, andbackup-wizard-frameso reopening any of them starts a clean session.Added — Off-site Backups dashboard widget
A new admin-only widget keyed
backupsjoinsDASHBOARD_WIDGET_KEYSand the_dashboard_orderrotation, gated byUser.dash_show_backups(defaulting True, with a matching_migrate_sqlitecolumn add). The widget renders four stat tiles — Healthy / Failing / Paused (or Never run, if nothing's paused) / Total — plus the last successful backup's timestamp + target name, the soonest next scheduled run, and the four most recentBackupRunrows with status pills. The Failing tile flips red whenever count > 0 and the widget's title row picks up a warn-tinted nav-badge with the same count so "needs attention" reads from the dashboard at a glance. The whole interior is a single button — clicking anywhere opens thebackups-modal. Empty state shows a "Set up your first backup" CTA that opens the wizard modal directly. The customize modal inindex.htmlgained a matching "Off-site Backups" toggle row anddashboard_customizesaves it under the existing admin-only branch.Added — Settings → Data tab "Off-site backups" card
New
<section class="card data-card">block between the "WordPress importer" and "Database snapshots" sections, mirroring the existing data-card chrome (brand-blue left accent + icon-led head + lead paragraph). Renders zero or more configured targets with status pills + last-run timestamp + per-row "Manage" button; a footer row carries a primary "Set up off-site backup →" (or "Add another backup" when targets already exist) that opens#backup-wizard-modal, plus a secondary "Manage backups" that opens#backups-modal. Neither button closes the parent settings modal so the user can stack admin surfaces above the Settings overlay. A newbackup_targets()Jinja global mirrors the existingdb_snapshots()pattern.Added — Busy spinner while a backup runs
.backup-busyoverlay (fixed inset, CSS-only ring spinner, brief explanatory copy, blocks pointer events while shown) is mounted inside the embedded backups list and on the wizard's step 5 page. It appears when any[data-backup-runnow-form]submits or when the wizard's "Enable target" form posts. Synchronous server-side backup can run for seconds to minutes depending on archive size and remote speed; the overlay both reassures the user the request hasn't hung and prevents double-submit.Changed — Inline SVG icons carry intrinsic
width/heightto eliminate FOUC_SVG_ATTRSinapp/icons.pygainedwidth="24" height="24". Before this, an inline<svg class="icon">with no dimension attributes stretched to fill its parent container during the brief window beforeapp.cssloaded the.icon { width: 1em; height: 1em }rule — visible inside any iframe (most prominent: thecloud-uploadicon in the backups list rendering at full modal width before settling to 1em). CSS specificity still wins once the stylesheet parses, so existing sizing is preserved; the attributes only matter during the FOUC window. Affects every Lucide icon site-wide.Changed — Appearance settings tab refactored to single-column data-card stack
Six sections — Theme, Sidebar Footer Logo, Login Screen, Open Graph / Link Previews, Home Screen Icon, Public Domain — are each wrapped in
<section class="card data-card">with adata-card-head(Lucide icon + title) anddata-card-leaddescription, matching the chrome the Data tab already used. The two-column.appearance-gridand<hr class="settings-sep">separators are gone; the cards stack vertically with each card's brand-blue left accent + shadow providing the visual separator. All form actions, file inputs, IDs, and JS hooks (theme picker, login FX preview, OG image preview, Apple-touch icon preview, login transition toggle) are preserved — behavior is unchanged. Dead CSS (.appearance-pane,.appearance-theme,.appearance-gridtwo-col rules, and their media-query overrides) was removed; a small ruleset normalizes forms inside the new data-cards to a 10 px gap so the card head + lead paragraph carry the visual spacing instead of the form's default 2 remgap.Changed — Backups modal uses 2 rem inset chrome with full-width children on desktop
.backups-wrapnow wraps all three embedded pages (list / runs / restore). In embed mode the.embed-contentshell's default 20 px padding is zeroed (via:has(> .backups-wrap)) and.backups-wrapowns the full 2 rem padding on desktop, scaling back to 1 rem below 720 px. The previousmax-width: 960pxconstraint is dropped in embed mode so target rows / activity rows fill the panel width — read directly inside the modal without an awkward narrow inset.Fixed — Dropbox backend ENETUNREACH on Docker bridge networks
Symptom: "Dropbox connect failed: HTTPSConnectionPool(host='api.dropboxapi.com', port=443): … Network is unreachable" on a Docker container with the default bridge network. Cause:
getaddrinforeturned both A and AAAA records; urllib3's connection pool tried the AAAA address first and the kernel had no route. Fixed by scoping a_prefer_ipv4()context manager around everyDropboxBackendSDK call. See the Added section above for full details on why the patch is scoped (other parts of the app that legitimately use IPv6 are untouched). -
2.0.4May 17, 2026
Fixed — Macro-rendered dashboard widgets were missing drag handles + draggable attribute
Three dashboard widgets (Recent Deletions, Frontend Visitor Metrics, Contact Form) rendered without
draggable="true"and without thedash-drag-handlespan. The macro intemplates/_dash_widget.htmlgated both on{% if can_reorder %}, butcan_reorderwas being set with{% set can_reorder = true %}inside{% block content %}intemplates/index.html— Jinja'swith contextimport does not reliably surface block-scoped{% set %}variables into the imported macro, so the gate evaluated as falsy and silently dropped both pieces of markup. The inline widgets (server-metrics, currently-online, access-requests) worked fine because they referencecan_reorderfrom inside the block where it was set. The macro is dashboard-only and every dashboard widget is meant to be reorderable, so the gate is gone —draggable="true"and the handle span now render unconditionally inside the macro.Changed — Dashboard widget grid is now a CSS-Grid pseudo-masonry layout
.dash-gridswitched fromgrid-template-columns: 1fr 1fr; align-items: start(which left awkward vertical gaps whenever the two columns' widgets had divergent heights) to a fine 8 pxgrid-auto-rowstrack withgrid-auto-flow: row denseand a companion JS layout pass (initDashboardMasonryinapp/static/js/app.js). The JS measures each widget's renderedgetBoundingClientRect().height, computesspan = ceil((height + 16) / 8)(the 16 px visual gap between widgets is folded into the span — actualrow-gapis 0 because a real row-gap would multiply across every fine row track and explode the layout), and writes the result towidget.style.gridRowEnd.denseflow then back-fills earlier vacant tracks with later, shorter widgets so the dashboard packs tight. Recompute triggers: deferred initial run viarequestAnimationFrame,window.load(covers late-loading fonts / icons), debouncedwindow.resize,ResizeObserverper widget (covers live polling widgets whose content height changes), and after every drag-reorder commit (the reorder handler now callswindow.__tspDashLayout()). Below the 720 px breakpoint the grid collapses to a single column with normalrow-gap: 16pxand the JS skips span assignment..dash-widgetcarries agrid-row-end: span 40placeholder for first paint (uses the longhand so the JS-setgridRowEndcleanly overrides — the shorthandgrid-row: span 40expands togrid-row-start: span 40; grid-row-end: autoand would conflict).Changed — Dashboard widget drag handle: always visible chip, top-left of widget
.dash-drag-handlemoved from absolutetop: 10px; right: 12pxatopacity: 0.55(revealed to 1 only on widget hover) totop: 10px; left: 10pxat full opacity at rest, with avar(--panel-2)background,var(--border)border, and 6 px radius. Old placement disappeared behind right-aligned "View all" links and right-alignedcard-headmetadata text on most widgets, so even when the icon was rendered it was effectively invisible. Hover/active states still tighten the visual cue (brand-tinted bg, brand-tinted border) but the resting state is now a first-class affordance instead of a near-invisible ghost icon. To avoid the chip overlapping titles:.dash-widget .card-head { padding-left: 38px; }insets everycard-headtitle; two widgets without acard-headget targeted padding (.access-requests-card .ar-titlegetspadding-left: 38px;.server-metrics .role-panelgetspadding-top: 18pxto clear the chip on the left column only — the right server-stats column stays at its natural top). -
2.0.3May 16, 2026
Fixed — Watchtower logged docker-bridge IPs instead of real client IPs
Production deploys (install.sh) front gunicorn with Caddy, which sets
X-Forwarded-For, but the Flask app wasn't wrapped inProxyFix— sorequest.remote_addrreturned the Caddy container's bridge address (typically172.x.x.x) on every request. Every downstream consumer (__init__._ip_block_gate,__init__._block_known_probes,activity._client_ip,auth.loginip captures,frontendturnstile + contact form ip captures) inherited the wrong value, so Watchtower's Access / Visitors / Requests panels and the IP-blocklist all keyed off the proxy IP.create_appnow wrapsapp.wsgi_appinwerkzeug.middleware.proxy_fix.ProxyFixwithx_for=x_proto=x_hostset from a newTSP_TRUSTED_PROXIESenv var (default 1 hop, matching the Caddy → gunicorn topology; set to 0 to disable for direct-bind deploys that don't want to trust spoofable forwarding headers).visitor_metrics._client_iplost its hand-rolled XFF parser sincerequest.remote_addris now correct everywhere. Operator note: any pre-existingIPBlockrows that captured docker-bridge addresses are now dead — they no longer match real client traffic and should be cleared from the Watchtower IP-block panel.Fixed — Library item thumbnails 404'd for logged-out visitors
reading_thumbnail(/readings/<rid>/thumbnail) carried a blanket@login_requireddecorator, so the public Literature Library page (frontend/literature_library.html) and any page-block referencing a library item thumbnail (_blocks.html) rendered broken images to anonymous visitors. The route now serves the file when the user is authenticated or when bothLibraryItem.public_visibleand the parentLibrary.public_visibleare True — matching the visibility gate the Literature Library page itself already enforces. Private libraries and admin-hidden items continue to 404 to anonymous traffic. -
2.0.2May 16, 2026
Added — Dynbg "Use pastels in light mode only" toggle
A new boolean field
pastel_lightjoins the dynbg config dict (encoded/decoded bydynbg.encode_config/dynbg.decode_config, persisted into the existingbg_dynbg_config_jsoncolumn with opt-in semantics — onlyTruesurvives the encode so the column stays minimal). The dynbg-picker modal's Colours panel grew a new checkbox Use pastels in light mode only; the trigger button partial (_dynbg_picker.html) carries the hidden input +data-dynbg-pastel-light/-inputattrs so the modal's get/set/open/save/clear flows all round-trip the value. The per-template Customize panel's pseudo-cfg (frontend_templates.html) and every per-page picker include the new field. The page-hero modal's client-side JSON builder, the block-editor'sdynbgTriggerhelper, and the page hero's trigger-populate path were all updated to threadpastelLightthrough.New
pastelize(hex)helper indynbg.pyproduces a soft variant via HLS — preserves hue, caps saturation, and lifts lightness into a tunable band.colors_to_css_vars(colors, cfg)now emits a companion--fe-dynbg-cN-lightfor every colour whencfg.pastel_lightis True. Special case: whenpastel_lightis on but the admin hasn't picked custom colours, three hardcoded pale tints (cool / warm / mint) are emitted as the light-mode fallback so the surface still softens instead of falling through to the preset's vivid brand-derived defaults. Three CSS rules underhtml:not([data-theme="dark"]) [style*="--fe-dynbg-cN-light"]re-bind--fe-dynbg-cNto the companion in light mode —!importantis required because the canonical--fe-dynbg-cNis set inline on the same element and inline custom-property declarations otherwise outrank stylesheet rules.15 frontend detail / list templates (meetings, events, stories, blog detail + list, archive, fellowships, literature library, printlist, announcements, site index variants) were converted from a hand-rolled inline
{% for _c in _resolved %}--fe-dynbg-cN: …{% endfor %}loop to the canonicaldynbg_colors_css(dynbg_resolve_colors(cfg), cfg)helper call so they emit the pastel companion vars uniformly with the list-page templates already using the helper. 9 list-template runtime cfg dicts (meetings_list,events_list,blog_list,fellowships_list,archive,literature_library,printlist,stories_list,announcements_list) gained a'pastel_light': X.get('bg_dynbg_pastel_light', False)entry. The template-level pastel band currently sits at saturation cap 0.339 and lightness 0.69–0.75 — produces confident dusty tints (cornflower, blush, sage, terracotta, ochre) rather than near-white washes.Added — Library item summary field + Add modal redesign + lightbox + external-link marker
A new optional plain-text
summarycolumn onLibraryItem(Text, additive migration) shown as a 3-row textarea in both the Add and Edit modals plus the standalonereading_form.html. The label notes the 500-character cap and a live<N>/500 remainingcounter beneath the textarea ticks down on input — counter goes red + bold when remaining hits 0. Counter is wired generically: any textarea with[data-summary-input]paired with a sibling[data-summary-counter](containing[data-summary-count]) gets the live readout.The Add modal swaps the old two-mode Upload / Paste toggle for a three-way segmented control (
.content-mode-seg) — Upload file / file browser, Paste / type content, External link — with each option owning exactly one content slot. Switching modes hides the others (hiddenattribute +disabledinputs so the browser doesn't submit them); saving in a given mode clears the slots it doesn't use. The modal trigger button, header, and submit button all rename from Add File / Upload to Add Item / Add item. The Edit modal got the same treatment — header renamed to Edit Item, default mode derived from existing data (file → upload, body → paste, url → link, empty → upload). Updated_apply_reading_formenforces single-channel content per item; empty/legacy submissions still fall back to the old permissive shape so historical posts keep working.Frontend library list (
templates/frontend/literature_library.html) now renders the summary directly under the filename / external link URL via a new.fe-library-item-summaryparagraph (0.875rem,white-space: pre-wrapso multi-line summaries preserve line breaks). External-link cards (no in-house file takes precedence) carry a smallexternal-linkLucide icon in the top-right corner via a new.fe-library-item--externalmodifier — visually telegraphs the click leaves the site. The entire card became clickable via a stretched-link::afteroverlay on the title anchor; the thumbnail wrapper lifts above the overlay (z-index: 2) and opts into the existingfrontend/_lightbox.htmlpartial viadata-lightbox-scopeso clicking the thumbnail opens the image viewer instead of navigating with the title link.Changed —
_apply_reading_formenforces single-channel content per itemThe library-item save handler in
routes.pywas reworked so each mode owns exactly one content slot —uploadclears body + url,pasteclears file + url,linkclears file + body. Empty/legacy submissions without acontent_modeflag still fall back to the old permissive shape so historical posts keep working. New items can never accidentally carry both a file and a URL the way some legacy rows could.Changed — Sinewave background reads more organic
renderSineGradientinlogin_fx.jsgained a third sine component (f3Mul/amp3/phase3) plus a slow y-axis modulation (yMod/yAmp) that shifts each scan-line slightly from the one above. Pure left-right symmetry breaks; the bands bend more like a real fluid surface.randomWaveParams()widened the per-component range and adds the new keys so randomised waves get noticeably varied shapes between renders. Existing stored waves missing the new keys fall through to the new defaults — same generator, richer canonical look. Applies anywhere the sinewave style is used (page hero, footer background).Changed — Footer chip hover keeps inherited text colour
.fe-footer-location-directions:hover,.fe-footer-admin-login:hover, and.fe-footer-block-powered-by a:hovernow usecolor: inheritinstead of swapping to the brand link colour — only the surface tint deepens on hover, text stays white (or whatever the footer chrome's resting text colour is). The--logoutmodifier (yellow background, black text) sets its own colour further down and is unaffected.Changed — Meeting card title weight on the homepage
.fe-meeting-card-link(the<a>inside the<h3>for each meeting tile in the homepage Meetings block) now explicitly setsfont-weight: 600. Previously the weight was inherited from the wrapping<h3>(typically 700) which read heavier than other card titles on the same page.Fixed —
<fieldset class="fieldset" hidden>was still renderingThe base
.fieldsetrule inapp.csssetdisplay: flex; flex-direction: column; …, which beat the user-agent stylesheet's[hidden] { display: none }and kept hidden fieldsets visible. Added.fieldset[hidden] { display: none; }so any panel toggled via thehiddenattribute (library content-mode picker, future toggled fieldsets) actually disappears.Added — Mobile-specific mega-menu animation + fade controls
Three new
SiteSettingcolumns + admin UI under Web Frontend → Navigation → Mega menu appearance → Mobile (≤ 720 px):frontend_megamenu_animate_mobile(bool, default True; toggles the staggered link entrance under the mobile breakpoint independently of the desktop toggle),frontend_megamenu_animate_mobile_ms(int, default 320; mobile-only stagger speed slider, 100–1500 ms), andfrontend_megamenu_panel_fade_mobile_ms(int, default 180; mobile-only panel-fade speed slider, 0–1500 ms). All three are clamped to the same ranges as their desktop counterparts in the save handler, and additive_migrate_sqliteentries land them on existing installs. Renderers (frontend/megamenus/classic.html+frontend/megamenus/recovery-blue.html) stamp--fe-mm-fade-ms-mobileand (recovery-blue only)--fe-mm-reveal-ms-mobilein the panel's inline style and add afe-megamenu-animate-mobile-offclass when the toggle is off. One new@media (max-width: 720px)block infrontend.cssre-binds--fe-mm-fade-ms/--fe-mm-reveal-msto the mobile variants so every existing consumer (panel fade transition, recovery-blue reveal keyframes) swaps automatically, and the off-class zeroes the stagger keyframes under the same breakpoint. Admin form'swireSpeedhelper now tolerates null toggle/row selectors so a standalone slider (the mobile fade speed has no companion toggle — the desktop Show on hover fade toggle still gates whether the fade runs at all) wires only the live readout.Added — Floating "Edit post" affordance on every blog detail template
A new
templates/frontend/_blog_edit_button.htmlpartial stamps a fixed-position chip in the bottom-right of/blog/<slug>for signed-in editors. Gated oncurrent_user.is_authenticated and current_user.can_edit() and not is_preview— suppressed when the existing draft / archived preview banner already carries an edit link, so signed-in editors visiting a draft don't see two stacked edit affordances. Includes a pencil icon + "Edit post" label that collapses to icon-only below 640 px so the chip doesn't crowd the reading column on mobile. Dark-mode flip swaps the dark-on-light pill for a light-on-dark variant. Included in all four detail templates (classic / modern / cover / longform) right after the preview-banner include.Added —
admin_loginmega-menu link kind with auth-aware Login / Dashboard + Logout button rowA new
kind="admin_login"value joinslink | title | button | section | searchinFrontendNavLink._NAV_BLOCK_KINDS, with a default label of"Login"baked into_NAV_DEFAULT_LABEL. The per-column add-row in_nav_megacol.htmlnow includes a+ Admin loginbutton so admins can drop one into any mega-menu column. In the editor (_nav_megalink.html), the kind suppresses the editable label + URL inputs (both are managed by the renderer) and replaces them with an explanatory note; it keeps every other styling field a regularlinkkind exposes (icon before / after, per-link size slider vialink_size_pct, color override, open-in-new-tab) AND adopts thebuttonkind's Style picker (Pill / Rounded). Form-trigger is hidden because the auto-managed href would always win.Both megamenu renderers (
frontend/megamenus/classic.html+frontend/megamenus/recovery-blue.html) grew a dedicatedelif _k == 'admin_login'branch so the kind renders as a button (not a link). Anonymous visitors see a single Login chip →url_for('auth.login'). Authenticated users see a flex row with two chips: Back to TS Pro dashboard →url_for('main.index')on the left and Logout pushed to the far right viajustify-content: space-between. The row wrapper (.fe-megamenu-classic-block-authrow/.fe-megamenu-block-authrow) bundles--i(existing animation index) and--fe-mm-link-scale(per-link size override) into one inlinestyle=""so the entire pair scales together when the admin moves the size slider. Default icons (log-inon Login,layout-gridon Dashboard,log-outon Logout) auto-render when the admin hasn't picked an icon, matching the footer admin_login block's hardcoded icons.Added — Footer admin_login block flips to a Dashboard + Logout pair on sign-in
templates/frontend/footers/blocks/_admin_login.htmlnow branches oncurrent_user.is_authenticated. Signed-out visitors see the existing single Login pill. Signed-in users see a new.fe-footer-admin-login-rowflex container with two pills — Back to TS Pro dashboard (layout-gridicon) on the left and Logout (log-outicon,--logoutmodifier) on the far right viamargin-left: auto. Both pills reuse the existing.fe-footer-admin-loginrecipe so surface / border / hover stay consistent with the meeting-locations block.Added —
auth.logouthonours a validated?next=redirect targetauth.logoutnow reads?next=from the query string and redirects there when the value is path-only (/...) and not protocol-relative (//...). Invalid or missingnextfalls back to the historicalauth.loginredirect, so admin-side logout links keep their old behaviour. All three frontend logout links (mega-menu classic + recovery-blue, footer block) now passnext=url_for('frontend.index')so signing out from a public page returns the visitor to the homepage instead of the admin sign-in screen. The path validation closes any open-redirect smuggle —?next=//evil.example.com/xfalls through to the login screen.Changed — Mega-menu button-styled kinds (admin_login, kind=button) honour the per-link size slider
.fe-megamenu-classic-block-btnand.fe-megamenu-block-btnnow computefont-size: calc(0.875rem * var(--fe-mm-link-scale, 1))(or0.9375remfor the recovery-blue variant). Previously the size slider in the admin editor only affectedlink-kind anchors; button-styled kinds ignored it entirely. The default scale of 1 keeps existing button rendering byte-identical when the admin hasn't toggled the override.Changed — admin_login mega-menu chips inherit the base button look + carry a Logout yellow modifier
.fe-megamenu-classic-block-btn--admin-auth/.fe-megamenu-block-btn--admin-authis a layout-only marker class — 7 px top/bottom padding andwidth: auto; align-self: flex-start(with.fe-megamenu-recovery-blueprefix so it beats the existingwidth: 100%rule for recovery-blue buttons). Background, border, text-color, and hover are all left to the underlying.fe-megamenu-*-block-btnbase recipe so the chips match the existingkind="button"rendering — solid accent surface in classic, translucent-white in recovery-blue. Pill / rounded shape still comes from the admin-picked-pill/-roundedmodifier so the editor's Style dropdown isn't a no-op. The.fe-megamenu-classic-block-btn--logout/.fe-megamenu-block-btn--logoutmodifier paints the Logout chip in opaque amber-yellow (#facc15) with black text in both themes; hover deepens to#eab308. A parallel.fe-footer-admin-login--logoutmodifier carries the same amber palette in the footer.Changed — Sidebar admin section keeps Contact Form alongside Watchtower
_ADMIN_CATALOGinsidebar.pylost the legacyaccess_requests,user_log, anddelete_logrows when Watchtower absorbed them in 2.0.0; this release also drops their visibility checks from_is_visiblesince the catalog entries no longer exist. (Their POST action endpoints had already moved under/watchtower/...namespaced endpoints.) -
2.0.1May 16, 2026
Fixed — Meetings-list cards no longer render translucent in dark mode
Cards on the public meetings list (
.fe-mlist-card) had two stacked dark-mode rules infrontend.css. The earlier one painted them atrgba(5, 8, 15, 0.85), the later one atrgba(255, 255, 255, 0.03)— and the later rule won, producing a 3% white wash that read as transparent over the page surface. Both rules are now consolidated and point at the Primary-card design tokens:background: var(--fe-color-card-primary-bg-dark, #131a33)andborder-color: var(--fe-color-card-primary-border-dark, #1f2a44). Cards are now solid and re-tint when the admin edits Site → Design → Card styles → Primary card → Background (dark). Light mode is unchanged.Changed — Pro Tips cards adopt the Primary-card design-token recipe
Each
.fe-faq-iteminside the standalone Pro Tips section (_protips.html) and the inline Pro Tips block on the sidebar meetings-list layout (meetings_list/sidebar.html) now carries anfe-card-primaryopt-in class. The class is the canonical Primary-card surface (background / border / border-radius in light + dark, plus the shared.fe-card-primary:hoveraggregator's lift + shadow + hover-border transition), so a single tunable point — Site → Design → Card styles → Primary card — drives meetings-list cards AND Pro Tips cards together. Three CSS rule blocks that were duplicating or fighting the recipe were removed: the hardcoded.fe-mlist-protips-inline .fe-faq-itemlight-mode bg + border, its:hoverblock, and the dark-mode override that pinned the Pro Tips bg to a translucent white. Kept the.fe-mlist-protips-inline .fe-faq-item.is-openaccent-border rule since the hover aggregator doesn't address the open state. -
2.0.0May 16, 2026
Added — Watchtower: unified admin security + observability console
A new top-level admin module at
/tspro/watchtowerthat consolidates four pre-existing surfaces (User Log, Delete Log, Access Requests, Visitor Metrics) into a single five-tab dashboard and layers new security primitives on top. Overview tab carries seven KPI tiles (views today / uniques today / online now / failed logins 24h / blocked IPs / pending requests / files in trash), a system-health card (CPU / memory / load / uptime, each with progress bars), a 30-day visitor SVG line+area chart, a 24-hour failed-login bar chart with red/amber/grey heat colouring, a rule-based anomaly banner (brute-force attempt in progress/elevated failed-login volume/concentrated attack from <IP>), a top suspicious-IPs leaderboard with one-click Block/Unblock, a recent-activity feed, an active-sessions table with force-end actions, and the live IP blocklist. Visitors mirrors the old visitor-metrics page inside the new shell. Access ships a failed-login leaderboard (Block / Unblock / Clear per IP), a manual IP-ban form (permanent or 1h / 24h / 7d / 30d), the active blocklist with hit counters, account-scoped activity feed (truncated to 20 rows with an inline expand button; the infinite-scroll sentinel only un-hides after expansion so collapsed feeds don't trigger API pages), and the login-sessions table with force-end. Deletes carries the same recycle-bin restore/purge workflow as before. Requests carries pending password resets, 30-day reset history, and the active/archived access-request inbox with Create User / Mark Handled / Archive / Delete actions.The data layer lives in a new
app/watchtower.py(helpers for KPI counts, daily/hourly time series, anomaly rules, top failed-login IPs joined against the IPBlock table, active-session listing, recent admin activity, IP ban/unban, login-failure clearing, session force-end, system snapshot passthrough). Templates live underapp/templates/watchtower/with a shared tab strip partial. The five view routes plus four state-mutating action endpoints (watchtower_ban_ip,watchtower_unban_ip,watchtower_end_session,watchtower_clear_failures) and the six relocated action endpoints (watchtower_delete_restore/…_purge,watchtower_request_handled/…_archive/…_unarchive/…_delete) are all@admin_requiredand write toActivityLogso every ban / unban / end-session / clear / restore / purge / request-mutation is auditable. Sidebar_ADMIN_CATALOGwas condensed — User Log, Delete Log, and Access Requests entries are removed in favour of a single Watchtower row that carries the pending-access-request badge.Added — IP blocklist with admin-managed request gate
New
IPBlockmodel (ip,reason,blocked_by→ User FK,blocked_at,expires_at,hit_count,last_hit_at) plus a new app-levelbefore_requesthook that resolves the request'sREMOTE_ADDRagainst the table on every inbound request, returns a flat 403 withCache-Control: no-storefor an unexpired match, and stampshit_count+last_hit_aton the matching row so the dashboard can see whether a ban is actually being exercised. Expired rows get lazily deleted on the request that would have matched them so the blocklist self-cleans without a separate cron. The hook is the firstbefore_requestin the chain (ahead of the probe-blocker) so a banned IP gets cut off even on asset requests.db.create_all()handles the new table on fresh installs; no migration entry needed.Changed — Watchtower replaces the three legacy admin surfaces (User Log, Delete Log, Access Requests)
The standalone
GET /tspro/user-log,GET /tspro/delete-log, andGET /tspro/access-requestsroutes are removed (now 404). Their templates (user_log.html,delete_log.html,access_requests.html) are removed too. The six action POST endpoints were renamed in place under the Watchtower namespace:delete_log_restore→watchtower_delete_restore(/watchtower/deletes/<rid>/restore),delete_log_purge→watchtower_delete_purge,access_request_handled→watchtower_request_handled,access_request_archive→watchtower_request_archive,access_request_unarchive→watchtower_request_unarchive,access_request_delete→watchtower_request_delete. Every internalurl_for(...)reference was migrated —_ENDPOINT_LABELS(the global label dict used by the omnibar / breadcrumb resolver), the dashboard's Recent Deletions + Access Requests + Online Users tiles, the_ulog_event.htmlpartial's user-deep-link, and the global-search Users section. TheGET /tspro/api/user-log-eventsendpoint is preserved unchanged — it backs the activity-feed infinite scroll on the Access tab. Legacy sidebar visibility keys (access_requests,user_log,delete_log) were dropped from_is_visiblesince their catalog entries no longer exist.Added — Light/dark page background override on per-template customize panel
The Web Frontend → Templates customize panel's Override page background color control now carries a Dark mode dropdown next to the light-mode swatch with three options: Same as light (no override; default), Auto (Surface — Darkmode token) (emits
var(--fe-color-surface-dark)so the dark variant tracks the site's Design palette), and Manual (reveals a dark-mode colour swatch that ships an arbitrary hex).template_css_vars(app/frontend.py) emits--tpl-bg-darkalongside--tpl-bg; a single new rule infrontend.css—html[data-theme="dark"] [style*="--tpl-bg-dark"] { --tpl-bg: var(--tpl-bg-dark) !important; }— swaps the live variable so every existingvar(--tpl-bg, …)consumer (blog detail, hyperlist, stories, list pages, etc.) flips automatically with no per-template CSS. Data rides the existingSiteSetting.frontend_template_settings_json(no schema migration);template_settingsloader pass-through was extended to whitelist the newbg_dark_mode/bg_darkkeys so they survive the round-trip from JSON back into the renderer.frontend_template_settings_savedrops the implicit'same'mode from JSON to keep the leaf lean.Fixed — Hover border-color flicker on classic blog detail's reading surface
.fe-blog-cls-main/.fe-blog-cls-widget/.fe-blog-cls-biocarry.fe-card-primary, so they inherited the global card hover token (--fe-color-card-primary-hover-border) — visible as a border colour shift on hover even though the existing suppression rule tried to neutralise it. Two fixes:border-coloris dropped from the transition list on these three elements (no animation runs even if a hover token leaks through), and a parallel[data-theme="dark"]suppression rule resets to--fe-color-card-primary-border-darkinstead of the light-mode token (the old rule restored the light border value in dark mode, producing a perceptible flicker on hover). -
1.10.5May 15, 2026
Added — Section block (nested container) inside the blog body editor
A new
sectionblock type ships in the body editor's palette — the first block that holds other blocks. State storage gains a recursive child list (data.blocks) plus two numeric margin controls (data.margin_top/data.margin_bottom, in rem; default 3 / 3, range 0–20, step 0.25). The renderer in_blog_blocks.htmlemits<section class="bb-section" style="margin-top: Nrem; margin-bottom: Nrem;">and recursively renders children through the samerender_blog_blockmacro so a Section with nested paragraphs / headings / callouts / etc. produces the same markup it would at the top level. The newbb-sectionCSS infrontend.csszeroes first / last child margins so the inline section margin wins without margin-collapse weirdness.Editor JS got a substantial drag-and-drop refactor to support nesting. Mutation helpers (
moveBlock,duplicateBlock,deleteBlock,insertBlockAt) now thread ahostarray reference so they operate on the right list — top-levelblocksOR a section'sdata.blocks. Each section's inner canvas is a[data-pbe-zone]element tracked in aWeakMapkeyed to its host array; the outer canvas's drag handlers delegate to whichever zone the cursor is in, so adding a section instantly spawns a working drop zone without extra listener wiring. A_dragSourceclosure variable captures the source host at dragstart, letting cross-zone moves splice the block out of the right array regardless of where the user drops it. Reading-time estimation recurses into section children so prose inside sections still counts toward the auto-computed minutes.Server-side
_sanitize_blog_body_blockswas split into a list-walking helper (_sanitize_blog_block_list) so the section's recursive children get the same field coercion + length caps. Nesting is hard-capped at depth 1 — a Section can't contain another Section. The 200-block-per-list ceiling applies at every level. A newmargin_rem(value, default)helper coerces the rem inputs to floats, clamps to 0–20, and rounds to 2 dp so the JSON column doesn't accumulate input-rounding noise.Added — Container width control on the blog detail page (
/blog/<slug>)Three new columns on
SiteSettingmirror the existing blog-list shape:frontend_blog_post_width_mode(boxed/full, defaultboxed),frontend_blog_post_max_width(px, 640–2400, default 1160),frontend_blog_post_padding_pct(vw, 0–20, default 5). Additive_migrate_sqliteentries land them on existing installs. A new "Container width" fieldset in Web Frontend → Templates → Blog detail — same two-radio + max-width + padding-pct shape as the Blog list controls — posts to the existingfrontend_blog_post_template_saveroute, which now reads and clamps all three values. All four detail templates (classic, modern, cover, longform) apply the chosen width through the shell wrapper: boxed mode swaps in the.fe-containerclass withstyle="max-width: Npx;"; full mode uses a per-template*-shell--fullmodifier andpadding-left/right: Nvw;viewport gutters. Longform's hardcoded narrow-essay 680px shell is overridden via inlinemax-width: nonein full mode so the admin's setting actually lands.Added — Draft / archived blog posts are previewable on the public URL when signed in
blog_post_detailwas filtering candidates through_blog_visible_query(), so signed-in editors hitting/blog/<draft-slug>got a 404 — they had to publish first to verify how a post would actually render. The view now bypasses the visibility filter whencurrent_user.can_edit()is True, walking the full query in those cases (still ordered by pinned + published-at desc). Anonymous visitors still get the 404 path — nothing about the public surface changed for them. A newtemplates/frontend/_blog_preview_banner.htmlpartial is included at the top of all four blog detail templates (classic / cover / modern / longform) and stamps an amber banner with a "Draft preview" or "Archived preview" tag, a short explanation of why a regular visitor wouldn't see this page, and a one-click "Edit post →" link straight to/tspro/blog/<id>. Visible only whenis_previewis True (the view sets it for any unpublished state whencan_previewresolved to True), so published posts get zero extra chrome.The View on Frontend admin button in
blog_edit.htmlused to be hidden whenever_p.is_draftor_p.is_archivedwas True (the link would have 404'd). Now it always shows when the Web Frontend module is on, and the label flips to Preview draft ↗ / Preview archived ↗ / View on Frontend ↗ based on state so the editor knows what they're about to open.Changed — Hyperlist permanently dark + week starts Sunday
templates/frontend/hyperlist.htmlwas a light-by-default template with a@media (prefers-color-scheme: dark)block flipping it to a near-black palette under the OS preference. The whole@mediablock was removed and every light-mode declaration in the base stylesheet was rewritten to the dark palette (body bg#0a0a0a, ink#f5f5f5, cards#131313, links#8ab4ff, focus rings#ffd700, live region#2a2400 / #ffd700). The template is now decoupled from the site's light/dark toggle AND from the visitor's OS preference — it's deliberately, permanently black. The header doc comment was updated to match.The week ordering was rotated so Sunday renders first. The underlying
MeetingSchedule.day_of_weekenum stays the project-wide 0=Mon..6=Sun convention; only the rendered section order changes. After per-day buckets are populated and sorted,day_buckets = [day_buckets[6]] + day_buckets[:6]shifts Sunday to the front so the template renders Sunday → Saturday — same ordering pattern themeetings_listview already uses.Also: the search-hint text "Filter is optional — without JavaScript every meeting stays visible." was removed from the search row. The
/-key and Escape-key shortcuts are still documented inline.Added — Visual drag-and-drop blog post body editor
The blog admin's body field flipped from a single Markdown textarea to a visual block editor mounted in
app/templates/blog_edit.htmland powered by a newapp/static/js/post_body_editor.js(~700 lines). State lives in ablocksarray of{id, type, data}dicts; every mutation re-renders the canvas and writes the JSON-serialised tree (sans ephemeral ids) to a hiddenbody_blocks_jsoninput via thecommit()helper, so a normal form submit round-trips the latest state without any "did the editor flush?" race. Ten block types ship out of the gate — paragraph, heading (H2/H3/H4), image, button, list (bulleted / numbered with Enter-to-add + Backspace-to-remove), quote, callout (info / success / warn / danger), separator, video (YouTube / Vimeo URL → auto-detected iframe embed, or self-hosted MP4 →<video>), and code. Each block carries a left drag handle (HTML5 native DnD), a top toolbar (type chip + move-up/down/duplicate/delete), and a per-type editor body. The floating "Add block" pill reuses the existing.fe-page-palette-floatingchrome from the page builder — same FAB → expanding panel animation, click-to-append OR drag-to-position semantics, animated insert-marker that shows the exact drop slot. The legacy Markdownbodycolumn stays onBlogPostas a fallback so unconverted posts keep rendering identically until the writer re-saves with blocks; the public render path in the four blog detail templates (classic / cover / modern / longform) now branches onpost.body_blocksand falls back to(post.body or '')|markdown. Storage is a newbody_blocks_json TEXTcolumn onblog_post(additive migration in_migrate_sqlite), sanitised on save through_sanitize_blog_body_blocksinapp/routes.py— unknown block types are dropped, string fields are length-capped, and the list is hard-capped at 200 blocks so a forged form post can't smuggle arbitrary HTML or oversized payloads into storage. Output renders through a newapp/templates/_blog_blocks.htmlpartial that emits.bb-*-scoped markup with frontend CSS styles appended tofrontend.css. The image block carries an inline file-library picker — the same/tspro/files/images.jsonmodal as the page-builder image block — so writers can drop an existing upload into a block without re-uploading; the picker callback now hands the entireMediaItemdict back to consumers so both the body image block AND the new featured-image picker (see below) can pull the id when they need it.Added — Refactored blog edit page — two-column layout with merged settings sidebar
The edit page split into a flex grid: a main column (Post + Body cards) that expands to fill every pixel between the app sidebar and the metadata column, and a metadata column (~280–340px) that holds publish state + author + taxonomy + featured image in one merged "Post settings" card. The metadata column collects four sub-sections separated by hairline dividers + section headings so the four groups feel discrete without fragmenting into separate cards. Categories ditched the pill UI for a vertical checklist (one row per category, color swatch on the left, scrollable when the list gets long, brand-tinted highlight when checked); tags got the same treatment so the two taxonomy widgets read as siblings. Both ship with an inline "Add" affordance — a text input + button row that POSTs to new
blog_category_quick_add/blog_tag_quick_addJSON endpoints, which mint (or dedupe by case-insensitive name) the row and return the new id/name; the JS appends a pre-checked row to the list and clears the input so the writer can stack several new categories / tags in a row without leaving the editor. Author input flipped from a free-form text field to a<select>whose options come from the IntergroupOfficer roster (Settings → Global) — each option renders "Name — Role" so two members with the same first name stay distinguishable. The stored value remains the resolved name string (compatible withBlogPost.author_name), so legacy posts and the public templates need zero changes; posts whoseauthor_namedoesn't match a current officer surface a "(legacy)" option in the dropdown so a Save round-trip doesn't silently drop the previously-saved byline. The author bio textarea was removed (column stays so legacy posts keep their bios). Featured-image control gained a "Browse library" button next to "Upload" — opens the samepbeOpenImageBrowsermodal the body image block uses, stamps the chosenMediaItem.idinto a hiddenfeatured_image_media_idfield, and shows a "Will use:" indicator until save; the server reads the id only when no fresh file upload is present and reuses the existing stored_filename(no disk duplication). A new "View on Frontend ↗" button in the top action bar mirrors the announcement / event editor — opens the public/blog/<slug>URL in a new tab whenever the Web Frontend module is enabled and the post isn't a draft or archived. Live title → slug sync was ported from the post editor: typing the title rewrites the slug field in real time with the same_normalize_slugrules the server uses, with a brand-tinted highlight on each keystroke. A defensive form-level Enter guard intercepts Enter on every single-line text input except the title so pressing Enter inside the tag / category / new-tag fields no longer accidentally publishes (the title still submits on Enter for muscle memory).Removed — Blog post comments feature
The
allow_commentscheckbox is gone from the post editor, theBlogPost.allow_commentsform-read inblog_saveand theallow_comments=src.allow_commentscarry inblog_duplicateare gone, and no UI, public renderer, or downstream consumer references the value anywhere. The underlying SQLite column is preserved as a vestigial NOT-NULL-defaulted attribute on the model (a comment inapp/models.pyflags it as inert) because SQLite can't drop a column in-place without rebuilding the table — a destructive op that the safety rule rightly blocks. A future schema migration that rebuildsblog_postcan delete the model attribute in the same change.Changed — Classic blog detail template — Primary card chrome + featured-image hero + configurable rail
The main post card, the two sidebar widgets (Related / Categories), and the author-bio aside now carry the
fe-card-primarydesign-token class, so their bg / border / border-radius / shadow / transition timing / hover lift + accent border swap all come from the central token aggregator infrontend.cssinstead of per-instance overrides; the template's inline CSS keeps only the layout-specific bits (padding, flex, etc.). The featured image now leads the post card (above the category chips, title, and byline) and bleeds to the card's left / right / top edges via negative margins matching the card'sclamp(1.5rem, 4vw, 3rem)responsive padding — same edge-to-edge look the blog-list cards have. The card's ownoverflow: hiddenclips the image to the rounded top corners;box-shadowpaints outside the box and isn't affected, so the hover lift still reads cleanly. Two new toggles in the customize panel (gated toblog_post→classic) — Show Related widget / Show Categories widget — let admins turn off either or both. When both are off the entire<aside>is omitted and the grid switches to a single full-width track so the post body expands to the container width. Saved as explicitFalsevalues infrontend_template_settings_json; missing keys mean "shown" so the JSON stays lean and legacy installs default to the original look.Fixed — Template background settings now apply on the classic blog detail
The
.fe-blog-post-classicarticle was painting its own background from--blog-bg, which never read--tpl-bg(the variable that carries the admin-chosen template background throughtpl_style). Chained--blog-bgthrough--tpl-bgfirst in both light and dark mode so the admin's solid colour / gradient / image setting flows in; the existing surface-token fallback kicks in only when nothing's set. For dynamic animated backgrounds the article now renders transparent so the canvas shows through — the inner card still has its own solid surface so the prose stays readable.Fixed — Mesh-gradient randomize toggles now actually randomize on the classic blog detail
tpl_dynbg_configwas being passed tofrontend/_dynbg_apply.html(which emits the dynbg children) but the host element'sstyleattribute never received the CSS variables that--fe-dynbg-mesh-*-x/-y/-angleconsume. Resolveddynbg_resolve_colors+dynbg_resolve_positionsinto the inline CSS var string at the top ofclassic.htmland stamped it onto the host alongsidetpl_style— same patternmeetings_list.htmluses. The "randomize colors" + "randomize positions" toggles now repaint the palette / mesh anchor + angle on every page load.Changed — Blog list cards (cards / sidebar / magazine / mosaic layouts) inherit
.fe-card-primarytokensAdded
fe-card-primaryto the card root inapp/templates/frontend/blog_list/{cards,sidebar,magazine,mosaic}.htmland stripped each layout's hardcodedbackground/border/border-radius/transition+ per-card:hoverdeclarations so the design-token surface + the shared token-aggregator hover (lift + accent border swap) take over. Only structural rules survive per-layout —overflow: hiddenfor the bleeding featured image,break-inside: avoidfor mosaic's masonry columns, and theis-pinned/is-featuredaccent overrides. Gazette + minimal layouts are text-row layouts with no card chrome, intentionally left alone. -
1.10.4May 15, 2026
Fixed — Visitor recorder now respects the frontend gate (no more phantom traffic when the public site is disabled)
_record_visitor_eventinapp/frontend.pyis mounted as abefore_requeston thefrontendblueprint. Flask runs blueprintbefore_requesthooks BEFORE the route handler itself runs — which means a request to/,/meetings,/events, etc. would write aVisitorEventrow before the route's_frontend_gate(site)call had a chance to return a 302 to login. Withfrontend_enabledoff, scanner / crawler hits at common frontend paths were getting redirected to login as designed but still appearing in the dashboard's Visitor Metrics widget as "real" page views. The recorder already filtered authenticated users (admin/editor previews) and obvious bot UAs, but anything with a plausible browser UA that didn't match the_BOT_TOKENSlist slipped through.visitor_metrics.record_visit()now reads theSiteSettingrow up front and short-circuits whenfrontend_module_enabledis False ORfrontend_enabledis False — same precondition the route handlers'_frontend_gateenforces. Verified end-to-end via aunittest.mock.patchagainst the SiteSetting query: gate-off → recorder writes zero rows; gate-on → recorder writes one row per legitimate visit. Login-page traffic was never affected (login lives on theauthblueprint, which the recorder hook isn't wired into).Historical rows from before this fix are left intact — there's no audit log of when
frontend_enabledwas toggled, and any retroactive scrub would have to guess at which rows were legitimate. -
1.10.3May 15, 2026
Added — Defensive 404 short-circuit for known attacker probe paths
Production was seeing the usual scanner traffic (
.env,.env.backup,.git/config,wp-admin/,phpmyadmin/,xmlrpc.php,.aws/credentials,credentials.json,backup.zip, etc.) hitting the heavy 404 template — a ~25 KB render that reflects site branding back at the scanner. New_block_known_probesbefore_requesthandler inapp/__init__.pymatches paths against a suffix tuple (filenames) and prefix tuple (directories) of well-known recon targets, returns("", 404, {"Cache-Control": "no-store"})— zero body, no template render — and emits a singleapp.logger.info("probe-block %s from %s", path, ip)line so operators see attack patterns without filling logs with full request dumps. Fast structural pre-filter (/.//wp-/phpmyadmin/ etc. substring check) keeps the per-request cost of the more expensive tuple scan off the legitimate-traffic hot path. Confirmed:/.env,/.env.backup,/.git/config,/wp-admin/setup-config.php,/phpmyadmin/,/xmlrpc.php,/server-status,/.aws/credentials,/.ssh/authorized_keys,/credentials.json,/backup.zipall returnHTTP 404 size=0after the patch.Changed —
request.referrerfallbacks now route through a same-origin validatorEvery flash-and-bounce handler in
app/routes.pyused to fall back torequest.referrerwhen no explicit target was set (redirect(request.referrer or url_for("main.index"))— 85 occurrences across the file).Refereris browser-set and steerable by an attacker hosting a page that links into a protected route: a victim clicking that link would get permission-denied and then redirected off tohttps://attacker.example/, opening a phishing pivot. Added a small helper_safe_referrer()near the top ofapp/routes.pythat returnsrequest.referreronly when its parsed netloc matchesrequest.host_url's netloc (so cross-origin Referer values fall through toNone, and callers land on whatever expliciturl_for(...)they intended). Bulk replaced all 85 call sites — three multi-line ones patched individually. No other Python files userequest.referrer, so the audit is complete.Added — SVG
<script>/on*=/javascript:sanitization on every upload, not just custom icons_save_upload()inapp/routes.pyalready ran SVG dimension normalisation but never the existing_sanitize_svg()regex stripper — that was wired only into the Custom Icons admin path. SVG uploads are admin-only (ADMIN_ONLY_UPLOAD_EXTENSIONS = {".svg"}) so the practical risk is low, but defence-in-depth is cheap: an admin uploading a vector logo handed off by a designer shouldn't become a vector for stored XSS against other admins / visitors who later navigate to the file directly (browsers execute inline<script>in standalone SVGs)._save_uploadnow calls_sanitize_svg(data)before_normalize_svg_dimensions(data)for.svguploads. Test confirms<script>...</script>andonclick=...are stripped from the persisted bytes.Changed — Fernet decrypt failures now log a warning instead of silently returning
""app/crypto.py::decrypt()used to swallow all exceptions and return an empty string. The intent was graceful degradation — a stored encrypted column that fails to decrypt (key rotation, corrupted bytes) wouldn't crash the request — but the failure mode is hostile to operators: rotatingTSP_SECRET_KEYor replacingzoom.keymakes every Zoom / OTP password disappear from the UI with no clue in the logs. Replaced the bareexcept Exception: return ""with a logged warning ("Fernet decrypt failed — encrypted column unreadable. Most likely cause: TSP_SECRET_KEY or zoom.key was rotated after this value was stored. Re-enter the affected credential to re-encrypt under the current key.") behind a nested try so a missing app context can't bubble out ofdecrypt(). Still returns""to callers (preserves the no-crash contract); the difference is the operator now sees one warning per affected column in container logs.Changed — Refuse to seed
admin/adminin production_seed_admin()inapp/__init__.pydefaultedTSP_ADMIN_PASSWORDto literal"admin"when the env var was unset. The bundled installer always supplied a value, but anyone bringing the image up manually (hand-written compose, ad-hocdocker run) silently gotadmin/adminon a public-internet/tspro/auth/login— a takeover in one request. Now: ifTSP_ADMIN_PASSWORDis empty ANDTSP_DEBUGis unset,_seed_adminraisesRuntimeError("TSP_ADMIN_PASSWORD is required on first boot. …")and the container fails to start.TSP_DEBUG=1falls through to a warning + the legacyadmin/adminfor local dev. Same pattern_seed_adminalready used forTSP_SECRET_KEY.docker-compose.deploy.ymland the installer's embedded compose template both flip${TSP_ADMIN_PASSWORD:-admin}→${TSP_ADMIN_PASSWORD:?TSP_ADMIN_PASSWORD must be set in .env (used only on first boot to seed the admin account)}so the compose layer also short-circuits.Changed — Installer generates a random admin password instead of defaulting to
admininstall.shpreviously defaultedADMIN_PASSWORD="${TSP_ADMIN_PASSWORD:-admin}". Same logic as the newTSP_SECRET_KEYgeneration: when the operator doesn't supply a value,openssl rand -base64 24 | tr -d '\n/+=' | cut -c1-24produces a strong random password, persists it to${INSTALL_DIR}/.env(chmod 600), and the end-of-install banner prints it once. Reruns read the existing password back from.envso the banner still surfaces the correct credential after a re-install. Combined with the previous change, this closes the path where a fresh install ships with publicly-guessable credentials.Added — Cross-Origin-Opener-Policy + Cross-Origin-Resource-Policy headers
@app.after_request_security_headersnow setsCross-Origin-Opener-Policy: same-originandCross-Origin-Resource-Policy: same-originon every response. COOP keeps any window we open (or that opens us) in a separate browsing-context group sowindow.openerattacks can't reach across origins; CORP blocks other origins from embedding our responses as resources (image hot-linking, external<link rel="stylesheet">, etc.). Both scoped to our own origin — Caddy, Cloudflare, and our/pub/asset URLs all live on the same host so nothing legitimate breaks. Pairs with the existing CSPframe-ancestors 'self'. -
1.10.2May 14, 2026
Added — Per-page Open Graph on every public detail page + a Page-level OG section
The public site now emits per-entity Open Graph / Twitter Card metadata on every detail surface:
/meetings/<slug>usesMeeting.name+Meeting.description+Meeting.logo_filename(served via the existingpublic.public_meeting_logoroute);/event/<slug>,/announcement/<slug>, and/archive/<slug>usePost.title+Post.summary or Post.body+Post.featured_image_filename(public.post_featured_image);/stories/<slug>uses the corresponding Story columns (public.story_featured_image);/blog/<slug>uses BlogPost (public.blog_post_featured_image). NewPagecolumnsog_title/og_description/og_image_filename(with_migrate_sqliteentries) — set them from a new Open Graph / Link Previews section on the page-edit form, sitting under Background image. Aog_presenthidden marker gates the assignment so partial sub-form submits can't wipe values. Page OG image is served on/pub/page-og-image/<page_id>with a 1-day public cache header. Anything left blank — per-entity AND per-page — falls back to the site-widefrontend_og_*defaults set under Web Frontend → Branding & SEO; the site-widefrontend_og_enabledmaster toggle still gates the entire block.Implementation: a new
frontend.py::_page_og(site, title, description, image_url)helper produces thepage_og_title/page_og_description/page_og_image_urltriplet thatfrontend/base.htmlconsumes. Descriptions are HTML-stripped, whitespace-collapsed, and clipped to 280 characters with a Unicode ellipsis — comfortably under Facebook's 300-char hard ceiling and a hair above Twitter's classic 200-char sweet spot. Image URLs are emitted as absolute (_external=True) because crawlers (Slack / iMessage / Facebook) skip relative-path previews. Every detail route was updated to splat_page_og(...)intorender_template(...)alongside the existing context, including the homepageindex()(which already renders a Page).Added — Apple Home Screen icon + display name for admin (/tspro) and public site
Two new SiteSetting column pairs:
apple_touch_icon_filename/apple_touch_icon_name(backend) andfrontend_apple_touch_icon_filename/frontend_apple_touch_icon_name(frontend), all additively migrated. Two new public serve routes —/site-branding/apple-touch-iconand/site-branding/frontend-apple-touch-icon— so iOS can fetch the icon anonymously when a visitor taps "Add to Home Screen."base.htmlandfrontend/base.htmlswap their hardcoded staticapple-touch-icon_tspro.png/apple-touch-icon_dccma.pnglinks for the uploaded version when one is set (falling back to the bundled static asset otherwise), and emit<meta name="apple-mobile-web-app-title">when a display name is configured. The backend control sits in Settings → Appearance, paired in the right column of the same grid row as Open Graph; the frontend control lives under Web Frontend → Branding & SEO as its own card. Both panels carry a live icon + label preview that updates as the admin edits, with the same?v={{ app_build_id }}cache-busting suffix the favicon already uses so iOS picks up new artwork on the next home-screen add.Changed — Event / announcement / archive detail cards switched to Primary card tokens
.fe-event-detail-card(Schedule / Location / Online / Contact panels on the public event, announcement, and archive detail pages) used to read from the Secondary card design tokens — the soft panel surface used by feature cards and FAQ items. Switched to Primary card tokens (the elevated meeting-card style) so the detail panels read as a coherent card family with the meeting-detail cards. Standalone rule'sbackground/border/border-widthdeclarations swapped to--fe-color-card-primary-*; the per-card:hoverblock was removed in favour of the shared primary aggregator selector at the bottom of the file (which now includes.fe-event-detail-card); the Secondary aggregator no longer references it. (Dark-mode overrides athtml[data-theme="dark"] .fe-event-detail-cardstill read from the Secondary dark tokens — pending a follow-up.)Added — View on Frontend ↗ button on the post-edit page
The announcements / events admin edit page (
/tspro/announcementsevents/<id>) gains aView on Frontend ↗button in the top-action row. Uses the existingpost_urlJinja global so the link routes to the right public URL (/event/<slug>,/announcement/<slug>, or/archive/<slug>) based on the post's state. Gated onfrontend_module_enabled; hidden on pending-review submissions, drafts, and brand-new unsaved posts.Changed — Announcements list cards drop the "View details ↗" CTA; GSR titles become links
The announcement card partial used to render a separate
View details ↗link at the bottom. Removed — the card title was already a link to the same URL. The card title's:hovernow underlines (was no underline at any state) so the click affordance is still clear. On the GSR Summary view, each title is now wrapped in an<a href="{{ post_url(ann) }}">so the printed-digest layout is also navigable; styled to inherit the surrounding text colour (no link blue, no underline at rest) with a subtle hover underline so the printed-digest aesthetic stays intact.Changed — Meetings + Events blocks: mobile self-padding restored
Earlier removing the inner
.fe-containerwrapper fromfrontend/blocks/meetings.htmlandfrontend/blocks/events.html(so they wouldn't double-pad inside page-builder containers on desktop) accidentally left those blocks flush on mobile when their parent container carried explicit0 0 0 0mobile padding. Added a@media (max-width: 768px)self-padding rule reading--fe-container-pad-mobile(default5vw) — same.fe-faq--barepattern. Desktop is untouched (parent container still controls), so the admin's homepage layout doesn't gain a double gutter.Changed — Events Magazine "More events" grid: cover image at the top, max 3 per row
The secondary tiles inside the More events grid (rendered on the events Magazine layout + Omni layout's Magazine panel) now show their featured image above the title (was previously hidden via
display: none). Tile layout reshaped viagrid-template-areasso the cover bleeds to the card edges with a 16/9 aspect ratio + rounded top corners, the date drops to a small inline chip, and the body sits below. Grid switched fromrepeat(auto-fill, minmax(280px, 1fr))to a fixedrepeat(3, minmax(0, 1fr))cap (drops to 2 columns at ≤1024 px and 1 column at ≤640 px) so each tile stays wide enough to host a thumbnail at a sensible size. -
1.10.1May 14, 2026
Changed — Announcements + Events list templates now sort by post date (newest first)
Both
/announcementsand/eventslist pages used to order byPost.created_at(announcements) orPost.event_starts_atascending (events, via the sharedfiltered_eventshelper). Switched both tocoalesce(published_at, created_at) descso the cards land newest-published first regardless of when each event runs. Back-dated posts surface in the right slot; rows with NULLpublished_at(legacy imports) still sort sensibly via creation time. The events list keeps its "upcoming only" filter (past events go to /archive); the homepage Upcoming Events block still usesfiltered_eventswith chronological ordering — that helper is unchanged. The GSR Summary panel inside the announcements omni layout is a sub-render of the sameall_announcementslist, so it picks up the new sort automatically. GSR Summary subheading trimmed to "Fellowship news, in brief."Changed — Event website URL field accepts relative paths
The post-edit page's Event website URL input was
<input type="url">, which the browser validated against the URL spec — rejecting relative paths like/about-us. Switched to<input type="text" inputmode="url">(mobile URL keyboard preserved) so admins can point at internal pages on the same domain as well as full external URLs. Placeholder + label updated to hint both shapes (https://example.org/event or /page-slug). No server-side / render-side changes needed: the save endpoint already only length-bounds the value, and browsers resolve relativehrefs against the current domain.Changed — Frontend meeting detail: description column caps at 75% above 1024 px
The description prose on the public meeting-detail page used to stretch the full container width on every viewport, producing uncomfortable line lengths on widescreen monitors. New
max-width: 75%cap above 1024 px (andmax-width: 100%at 1024 px and under, so tablets / landscape phones / split-screen still get the full width). Applied across all four detail templates (Classic, Minimal, Card Stack, Magazine) via their respective description-container classes (.fe-meeting-detail-desc,.fe-meeting-min-desc,.fe-meeting-stack-prose,.fe-meeting-mag-prose) so the column reads consistently regardless of which template is selected.Changed — Frontend export bundle: posts excluded, verbatim coverage tightened
The frontend bundle is now strictly look-and-feel (settings, navigation, layouts, fonts, icons, design tokens, pages, stories, intergroup officers, media). Three coordinated changes:
- Posts dropped from export. The
postscollection (everyPostrow) and theslug_historycollection (which only carriedpostentries) no longer appear in the payload. Per-post asset scan removed. The import side keeps its backwards-compat path so old bundles that DO contain posts still restore them; new bundles produced by this function omit them. Posts are per-deployment editorial content — shipping them silently overwrote the destination's editorial state. - Homepage padding bug fixed on import. Found the cause of "frontend export keeps resetting the side padding on the homepage": the page-import path used
int(p.get("pad_x") or 16)which silently rewrote any explicit0to the default (because0 or 16 == 16in Python). Switched every integer column on Page (pad_x,pad_top,pad_bottom,section_gap,block_margin_y,max_width,full_padding_pct,bg_tile_scale) to the existing_opt_inthelper, which only falls back to the default when the key is missing or non-numeric. Full-bleed pages withfull_padding_pct: 0now round-trip verbatim. - Setting scope widened for module gates. Added
posts_,stories_,blog_to the prefix list in_frontend_setting_keys, capturing the 6 module-gate columns (*_enabled+*_required_role) that control whether the public Events / Announcements / Stories / Blog surfaces serve at all. They're frontend behaviour even though they don't carry afrontend_prefix in the schema.
Fixed — Auto-stamped Post / Story
published_athonours the site timezonePost.published_at(andStory.published_at) is stored as a naive datetime that the form parser (_parse_post_dt) reads as the admin's local wall-clock time, and that the display layer renders straight through.strftime()— so the storage convention is "naive = site-local". But the auto-stamp paths useddatetime.utcnow(), writing UTC into the same column. Display then rendered UTC as if it were local, producing wrong wall-clock times offset by the admin's tz from UTC (e.g. 5 PM PDT showing as 12 AM next day).New helper
app/timezone.py::now_local_naive(site)returns the current site-local datetime withtzinfostripped. Wired into:
-post_saveroute — the draft → publish stamp + the defaultpublished_atfor newly created posts.
-post_publishroute — the inline draft → publish flip from the list page.
-story_saveroute — same pattern, fixed prophylactically so the same bug doesn't surface on stories.Form-entered values were already correct (naive site-local). Existing rows with UTC-stamped
published_atwill keep showing at the wrong time until republished — re-saving the post writes a fresh local-naive value into the column.Fixed — Publish / Move-to-Drafts buttons on the post-edit page now save in-progress edits
The
Publishbutton on a draft (and theMove to Draftsbutton on a published post) used to POST to the dedicatedpost_publish/post_unpublishstate-flip routes, which never saw the post-edit form's fields — so clicking either without first clickingSave draft/Save postthrew away every edit the admin had made. Both buttons now submit the post-edit form withaction=publish/action=draft.post_savealready handled both values to flipis_draftAND save the form fields AND (with the recent draft → publish change) stamppublished_at = now, so the buttons now do exactly what the labels suggest. The standalonepost_publishroute stays in place for the per-row inlinePublishbutton on the list page where there's no form to save.Changed — Drafts and pending submissions don't log URL redirects on slug changes
Renaming a draft used to insert a row in
EntitySlugHistoryfor every slug change, polluting the redirect table with mappings from URLs the public never saw. Captured_was_public = (not creating) and (not is_draft) and (not is_pending_review)before mutating the post and gated theEntitySlugHistoryinsert on it.- Editing a draft and renaming it → no redirect (URL was never public).
- Publishing a draft (with or without a slug change during the same save) → no redirect from the old draft slug; the post starts its public life cleanly at the new URL.
- Renaming a published post → redirect logged as before.
- Moving a published post back to drafts → no new redirect; subsequent slug changes don't log either until the post is republished.
Added — Live title → slug sync on the post-edit page with highlight pulse
Every keystroke in the Title field now rewrites the URL field client-side using the same
_normalize_slugrules the server runs on save (lowercase, non-alphanumeric runs collapse to-, leading/trailing hyphens stripped, 200-char cap). The URL row picks up an accent-tinted background + brand-coloured border + a soft brand-coloured ring; the slug text shifts to the brand colour. Highlight fades out ~1.4 s after the last edit (animation restarts on each keystroke so it stays visible while typing).Changed — Draft → publish transition stamps
published_atwith the current timeBoth publish paths (the dedicated
post_publishroute ANDpost_savewhen the form'saction=publishbutton is clicked) now overwritepublished_atwithdatetime.utcnow()whenever the post was actually a draft on the way in. Matches the principle that "Posted on …" should reset to "now" the first time a piece of content actually goes live, regardless of whatever date the admin had keyed into the form for back-dating earlier. No-op when the post is already published or when the save doesn't flip draft status.Changed — Post slug auto-derives from title when the title changes
post_savepreviously trusted the slug input regardless of whether the editor touched it — and the slug input is pre-populated from the database, so renaming a post left the public URL pinned to the old title. Reworked the slug-resolution branch:- Title changed (or creating a new post) → re-derive the slug from the new title and ignore the slug input. The existing
_unique_post_slugsweep appends-2/-3/ … on collision; flash message surfaces the suffix when it had to disambiguate ("URL auto-derived to "test-event-2" to avoid collision with another post"). - Title unchanged → respect the editor's explicit slug input (existing behavior preserved). Editors can still rename the URL without touching the title.
Slug-history redirect logging continues to fire on any
public_slugchange, so the previous URL keeps working via the existing 301 fallback even when the title-driven auto-derive flips the slug.Added — Announcements & Events admin: Duplicate button surfaced
The
post_duplicateroute already existed (clones a post into a fresh Draft with a(copy)title suffix, redirects to the Drafts tab) but the UI didn't expose it — the Drafts empty-state message even read "Duplicate an active post to start one" without offering anywhere to do so. Surfaced the action in two places:- List page (
/tspro/announcementsevents) — every row gets aDuplicatebutton betweenEditandPublish/Drafts. Hidden on pending-review submissions. - Edit page (
/tspro/announcementsevents/<pid>) — top-action row gets aDuplicatebutton between Archive/Restore and Delete. Hidden on brand-new posts and pending-review submissions.
Featured-image filename is shared on the duplicate (uploads are content-addressed, so two rows pointing at the same stored file is fine — the cleanup helper sees the reference).
Changed — Homepage Meetings + Events blocks: dropped inner
.fe-containerwrapperThe
frontend/blocks/meetings.htmlandfrontend/blocks/events.htmlpartials wrapped their content in<div class="fe-container">. After flipping--fe-container-pad-desktopto5vw, that token padding was being added on top of whatever the page-builder container providing the block also set — squeezing the meeting cards grid into too-narrow columns at intermediate desktop viewports and crushing the events list. Both partials now skip the.fe-containerwrapper entirely so the surrounding page-builder container is the sole source of width + horizontal padding.- Both blocks are page-builder-only (only included from
frontend/page.htmlafter the 1.9.0 homepage retirement), so dropping the wrapper has no other consumers to worry about. - Width clamping moves to the parent container (admins set
max-widthper container as part of the page-builder); blocks render at 100 % of the surrounding container's content width.
Changed — Container padding desktop default flipped to 5vw
container_pad_desktopshipped at0in 1.10.0 on the assumption that the boxedmax-width: 1160pxcap would always provide a desktop gutter — but at intermediate viewport widths (~768–1160 px) the cap doesn't engage and content runs to the viewport edge. Theme defaults flipped to5vw(matches mobile), so every block that wraps in.fe-container(meeting detail, event detail, meetings list in boxed mode, hero/CTA/inclusion blocks) now carries a visible left/right gutter at all desktop widths. Admin can still override per-deployment under Site → Design → Layout.Added — Meetings list (Sidebar template) — location name + address in column 3 for in-person / hybrid
The 3-column expanded meeting card on the Sidebar layout now renders a location pane at the top of column 3 — above the Zoom credentials, Get Directions, and Add to Calendar buttons. Bold location name + muted address lines (street, then city/state/zip) when the meeting's free-text location resolves against a saved Location row; falls back to the bare free-text string for custom locations that don't match.
- Server-side resolver batches the
Location.query.all()lookup once per page request, builds ameeting_locationsdict keyed by meeting id, and passes it to the template — no N+1 follow-ups. - Online-only meetings skip the pane entirely.
- The Directory and Week-board layouts already render location info in column 2; this change only affects the Sidebar 3-column render.
Added — Meetings list (Sidebar template) — admin-curated custom links rail
A new "Sidebar custom links" fieldset under Frontend → Templates → Meetings list lets admins add internal or external links that render below the day filters under a divider line in the Sidebar layout's rail. Internal links get a chevron-right at the far right; external links get an external-link icon and an optional "Open in new tab" toggle.
- Per row: Label, URL, Internal/External chip-style toggle, Open-in-new-tab checkbox.
- Storage: new
SiteSetting.frontend_meetings_list_sidebar_links_jsoncolumn (TEXT, nullable, additive migration). - Resolver
meetings_list_sidebar_links_resolved(site)clamps unknown link types tointernaland drops rows missing label OR URL. - Public links inherit the rail's text colour at every state (no link-blue, no underline) and only the background tints on hover.
Changed — Backend meeting detail: View on Frontend button gate + placement
The "View on Frontend ↗" button on
/tspro/meetings/<slug>was gated onfrontend_enabled(public visibility) so it disappeared whenever public access was off — even though signed-in editors can preview the page either way. Switched to thefrontend_module_enabledgate (module on/off). Also reordered so Edit comes first and View on Frontend sits immediately to its right at the top of the action row, ahead of Archive/Restore + Delete.Changed — Frontend meeting detail Files & Readings: drop file description text
_resources.htmlno longer renders the muted<span>carryingf.descriptionbeneath each link. Each row is now just the title + the trailing↗arrow, applied across all four meeting templates (Classic, Magazine, Card Stack, Minimal) since they share the same partial.Added — Settings → About: Release notes section above the Changelog
A new release-notes data source ships alongside the changelog, displayed first in the About tab inside an open
<details>(changelog moves into a closed<details>underneath). New fileapp/templates/_release_notes.html(HTML partial) +RELEASE_NOTES.md(markdown mirror) at the repo root. Friendly per-version summaries cover every version bump from 1.0 → 1.10.0 — patch versions grouped under their parent (e.g. "1.7.0 – 1.7.17") to keep the section scannable.- Both
<details>blocks get a tinted card chrome with a custom rotating chevron caret. - About-pane outer
padding: 24pxremoved (padding: 0) so the new chrome sits flush against the modal panel edges.
- Posts dropped from export. The
-
1.10.0May 14, 2026
Added — Hero block buttons: icon picker + design-token colour pickers
The hero block edit modal's per-button "Advanced — icons + custom colours" panel rewired to use the same shared chrome the rest of the admin uses. The two icon fields (
icon_before,icon_after) are now icon-picker triggers — click the dashed tile to open the global Lucide / custom-uploads picker (search, size slider, the lot); the trigger fills with a live SVG preview and a small×clear button. Wired through[data-open-icon-picker]+data-icon-targetagainst per-row hidden inputs minted with random unique IDs so multiple button rows in the same modal don't collide.The four colour fields (
icon_before_color,icon_after_color,custom_bg_color,custom_text_color) gained the full colour-cluster UI — editable hex text input + native<input type="color">swatch + auto-attached 🎨 design-token-palette button + read-only hex caption + matched-token chip (◈ Brand). The 🎨 button comes for free from the global_design_token_picker.htmlMutationObserver — every dynamically-injected<input type="color">picks up the chrome on insert. Two-way binding everywhere: editing hex syncs the swatch, picking a swatch updates the hex, picking a token writes both.Changed — Dynamic background modal "Save" → "Done"
The footer button on
#dynbg-picker-modal(Choose a dynamic background) said Save, but the modal doesn't actually save — it commits the chosen preset back to the parent form's hidden inputs and the parent form is what eventually saves on its own submit. Renamed the button text to Done so the verb matches what the click actually does.Added — Hover-background tokens for primary + secondary buttons
Two more colour tokens —
color_btn_primary_hover_bgandcolor_btn_secondary_hover_bg— drive the background colour applied on:hover. Rendered in their respective Buttons admin column right between bg and text, so admins can tune the hover wash from one place. Defaults approximate the previouscolor-mix(in srgb, <bg> 88/92%, black)auto-darken (#0a51e0/#e4e6e8for Classic;#0a51e0/#e0e3e7for Recovery Blue), so existing button hover visuals stay essentially the same. The CSS keeps thecolor-mixrecipe as a fallback inside the newvar(...)so unstyled environments still get auto-darken behaviour. Live preview button repaints hover bg in real time.Added — Surface — Darkmode token + per-style button border tokens (8 new)
A new colour token Surface — Darkmode (default
#0b1026) under Site → Design → Colors becomes the source of truth for the dark-mode page background. Wired by replacing the hard-coded value in--fe-dm-page-bgwithvar(--fe-color-surface-dark, #0b1026)so every consumer that reads--fe-dm-page-bg(body bg, force-dark footer, etc.) tracks the token.The Buttons section gains eight per-style border tokens — for each of Primary and Secondary: border colour, border width, hover border colour, hover border width. Border widths flow through the existing
BORDER_WIDTH_SCALE(0/1/2/3/4 px); colour fields use the standard hex picker. Defaults preserve current visuals: primary borders match the bg colour (visually invisible until the admin picks a contrasting value), secondary usescolor_borderat rest andcolor_btn_secondary_texton hover (the legacy.fe-btn-ghostrecipe)..fe-btn-primary/.fe-btn-ghostswitched from shorthandborder:declarations to longhandborder-width+border-style+border-colorso each can read its own token without fighting cascade order. Hover rules read the hover token with the resting token as fallback (so half-configured borders don't flicker between widths).- The four new fields per kind render in their respective Buttons column (Primary on the left, Secondary on the right) right after
bg+text, and the live preview button stamps--fe-btn-<kind>-border-width+--fe-color-btn-<kind>-border(resting + hover) so the preview repaints in real time as the admin edits any field. - Existing dark-mode hardcoded
.fe-btn-ghostborder overrides (e.g.border-color: #334155) remain at higher specificity — these light-mode tokens drive light mode only.
Added — Buttons section: two-column layout with per-style live preview
Mirrors the Card styles layout. Buttons now lays out as Primary on the left, Secondary on the right, each column carrying its own preview button at the top followed by the settings stack underneath. Drops to single column under 900 px. Shared structural settings (radius, padding-x, padding-y, weight, text-transform, decoration) live in a dedicated Shared button settings block below both columns with a one-liner clarifying they apply to every button regardless of style.
- Each preview button is a self-contained
.fe-btn-style-preview-buttonthat re-implements just enough of the public.fe-btnrecipe to render on the admin page (admin chrome doesn't loadfrontend.css). Reads the same--fe-btn-*+--fe-color-btn-*custom properties so the live JS can stamp tokens directly on the element. - New live preview JS block listens on form
input/changeand resolves every Buttons token (radius scale, padding text values, on/off effect toggles forbtn_shadow/btn_hover_transform/btn_hover_glow) through the same recipes the Python emitter uses, so the preview matches the public render exactly. - Three primary-only effect tokens (
btn_shadow,btn_hover_transform,btn_hover_glow) render only inside the Primary column.
Added — Card styles: two-column layout + per-card hover-border tokens
The Card styles tab restructured into two side-by-side columns matching the new Buttons layout: Primary on the left, Secondary on the right, each with its preview card directly above its full settings stack so the visual + the controls that drive it stay grouped. Drops to single column under 900 px. The shared
data-card-previewattribute moved to the wrapper so the existing live-preview JS still finds both target cards in one query.Two new colour tokens —
color_card_primary_hover_borderandcolor_card_secondary_hover_border— control the border colour applied on:hover. Defaults preserve current visuals: secondary cards (feature, FAQ, quick-link, inclusion, etc.) keep accent-on-hover, primary cards default to their resting border colour (no visual shift unless the admin overrides). Wired into the shared.fe-card-primary:hover/.fe-card-secondary:hoverrules so every primary or secondary card surface picks them up. The legacy hardcoded.fe-feature-card:hoveraccent border now also reads the secondary token. Mirrored in each column with the existing colour-token mirror system; the live preview repaints hover-border in real time.Changed — Button padding tokens wired through to
.fe-btnbtn_padding_xandbtn_padding_yexisted in the schema and emitted CSS variables but no rule consumed them —.fe-btnhad a hardcodedpadding: 14px 28px. Rewrote the.fe-btnrule to readvar(--fe-btn-padding-y, 14px) var(--fe-btn-padding-x, 28px), switched the field type from a fixed scale (xs/sm/md/lg/xl) to a free-form text input so admins get pixel-precise control, and updated theme defaults to"14px"/"28px"so existing button visuals are preserved bit-for-bit. Labels reworded to "Vertical padding (top/bottom)" / "Horizontal padding (left/right)" so the role of each axis is unambiguous; placeholder hints suggest legal CSS lengths (14px,0.875rem,1vw).Added — Container padding design tokens (
container_pad_desktop/container_pad_mobile)A 1.8.4-era CSS rule —
@media (max-width: 560px) { .frontend-body .fe-container { padding: 0 5vw; } }— was lost in a later refactor, leaving every block that wraps in.fe-containersitting flush against the viewport on phones. Restored as two free-form text design tokens under Site → Design → Layout: Container padding — desktop (default0) and Container padding — mobile (default5vw, applied at ≤768 px). Accept any CSS length:0,24px,2rem,5%,5vw. Wired into.fe-container(used by hero/cta/inclusion/etc. blocks) and the page-builder shell.fe-pp-shell, with the per-pagepad_xsetting still winning on desktop and the mobile token acting as a single global lever at ≤768 px.Page-builder full-bleed pages emit their
full_padding_pctas a--fe-pp-pad-x-fullcustom property instead of inlinepadding-left/right, so the mobile media query can override without an inline-style war. The bare FAQ block (.fe-faq--bare, used inside page-builder containers that drop the.fe-section+.fe-containerchrome) gets a surgical mobile-only horizontal padding rule that reads the same token, so FAQ accordions inside zero-padding containers still get a phone-friendly gutter without forcing a margin around the whole page.Changed — Frontend Features block: per-card buttons + section CTA + cleaner hover
The features block stopped wrapping each card in an
<a>. Cards are always<article>now; when a card has a link, it renders an inline.fe-btn(Primary or Secondary, admin-selectable) inside the card with an editable label (defaults to "Learn more" if blank). Removes the global.fe-page a:hoverunderline that was being applied to the card title + body whenever the whole card was the link target.- Two new per-card fields in the Features modal (
button_label,button_style); modal layout adds a "Button label / Style" row beneath the existing link URL row. JS extends the default item shape so missing inputs still serialise cleanly._normalize_featurescarries the new keys and clampsbutton_styleto the allowlist (primary/ghost). - A section-level bottom CTA (
cta_label/cta_url/cta_style/cta_new_tab) renders as a single centred.fe-btnunder the cards when both label + URL are filled — matches the.fe-events-foot/.fe-meetings-footpattern.4remof space above the button at desktop widths (@media (min-width: 768px)); mobile keeps the tighter28pxshared rule. - Card now uses flex column +
margin-top: autoon the actions row so per-card CTAs align across rows even when bodies differ in length. Dead.fe-feature-card--linkedselector +cursor: pointerrule removed (no longer needed).
Added — Container padding: per-side fields with unit selector
The container block's Padding control used to be a single free-form text input accepting CSS shorthand (
1rem,24px 16px, etc.) — readable only if you already think in CSS. Replaced with a box-style diagram: four numeric inputs positioned around a centre "Padding" tag, labelled Top / Right / Bottom / Left on the outer ring so the role of each input is unambiguous. Each input is a chip combining a<input type="number">with a<select>dropdown for the unit — admins can pick px / rem / em / vh / vw / % per side independently. Same layout repeats for the mobile-override row (centre tag reads "Mobile"; any side left blank inherits the matching desktop value at ≤720 px).- Storage shifts from a bare integer to a full CSS-value string (
"16px","2rem","5%"). The first time a saved container with the legacypaddingshorthand is opened, a one-shot parser seeds the four per-side fields with the equivalent values preserving the original unit — so a savedpadding: "1.5rem"becomes four1.5remfields, not a px equivalent. - Renderers (
_blocks.html,frontend/page.html) read the new fields through a_pad_side(v)helper: empty/null →0, integer →<n>px(legacy compat), string → unchanged. The four sides assemble into--block-cont-padding: T R B L. When all four are empty, the legacyd.paddingCSS shorthand still applies, so containers saved before the per-side editor split keep their look. - CSS for the box: 3×5 grid with axis labels on the outer ring + four input chips on the inner cross + a dashed-border "Padding" tag in the centre. Native number-input spinner suppressed; unit
<select>borderless and muted so it reads as secondary chrome.
Added — Card styles design-token group + per-container card option
A new Card styles tab under Frontend → Design houses every knob that drives the look of card surfaces site-wide. The eight existing colour tokens for primary + secondary cards (bg/border light + dark) are mirrored into this tab; the canonical inputs still live on the Colors tab, with bidirectional JS sync (dashed border + "Synced" badge on the mirror so admins know editing either copy updates both). On top of the colour tokens, ten new structural tokens — five per card kind — control border width, shadow, hover shadow, transition, and hover transform. Three new scales back the new fields:
BORDER_WIDTH_SCALE(0 / 1 / 2 / 3 / 4 px),TRANSITION_SCALE(none / fast 120 ms / normal 200 ms / slow 320 ms),TRANSFORM_SCALE(none / lift-sm -1 px / lift-md -2 px / lift-lg -4 px), all on a custom cubic-bezier easing.- Live preview pane at the top of the tab — two sample cards (primary, secondary) styled by the current form values. Inline CSS custom properties are stamped onto each preview card on every form input / change, so the swatch + border-width + shadow + lift + timing update instantly without a save round-trip. Hover the cards to see the configured
hover_shadow+hover_transform. - Aggregator CSS appended to
frontend.csswires every existing card class (.fe-meeting-card,.fe-meeting-detail-card,.fe-meeting-extended-card,.fe-recovery-threeup-card— primary;.fe-feature-card,.fe-quick-card,.fe-faq-item,.fe-inclusion-card,.fe-meeting-mag-side-card,.fe-event-detail-card— secondary) to the new tokens for shadow / transition / hover behaviour. Border-width is patched on each card's ownborder:declaration (so the shorthand still wins over inline overrides), border-colour comes from the existing colour tokens. - Opt-in classes —
.fe-card-primary/.fe-card-secondaryturn any block into a card surface using the same tokens (bg + border + shadow + hover lift, in both light and dark modes). - Container builder option — every container block gains a new "Card style" panel in its settings modal with a select (
None / Primary card · meeting-card look / Secondary card · feature-card look). The selection writesd.card_styleonto the block; the public renderer (_blocks.html) emits the matchingfe-card-primary/fe-card-secondaryclass on the rendered<div>. Per-block inline styles (bg / border / shadow) still layer on top, so admins can fine-tune one container without unlinking it from the global card style. - Editable hex chip — the colour-token rows (both Colors and Card styles tabs) replace the read-only
<code>hex caption with an<input type="text">. Type or paste a hex value and the swatch updates, the Override checkbox ticks itself, the field gets the overridden styling, and the save bar lights up — same effect as opening the native colour dialog. Invalid input shows a red border (via:invalid:not(:placeholder-shown)) and rolls back to the picker's current colour on blur.
Added — Secondary card colour tokens (feature-block style propagated site-wide)
Four new colour design tokens —
color_card_secondary_bg,color_card_secondary_bg_dark,color_card_secondary_border,color_card_secondary_border_dark— with defaults derived from the homepage features-block visual (Classic:#f4f7fbpanel-soft /#e2e8f0border /#131a33dark bg; Recovery-blue:#f1f5f9/#cbd5e1/#131a33). Every card matching that style —.fe-feature-card(the source),.fe-quick-card,.fe-faq-item,.fe-inclusion-card,.fe-meeting-mag-side-card,.fe-event-detail-card— now resolves its bg + border through the new tokens in both light and dark mode, with the previous hard-coded value retained as the fallback so existing installs render identically until the admin overrides anything. Tweak a secondary-card colour once and the homepage features block, quick-access cards, FAQ items, inclusion block, meeting-magazine sidebar, and event-detail panels all update uniformly.Added — Primary card colour tokens (meeting-card style propagated site-wide)
Four new colour design tokens —
color_card_primary_bg,color_card_primary_bg_dark,color_card_primary_border,color_card_primary_border_dark— with defaults derived from the existing meeting card visual (#ffffffbg in light /#131a33dark; theme-accent border in light /#1f2a44dark). Applied to every card that shares the meeting-card style:.fe-meeting-card(the source),.fe-meeting-detail-card,.fe-recovery-threeup-card,.fe-meeting-extended-card. The previously-namedcolor_card_darktoken (which only fed the fellowships card dark surface + sort<select>background +<option>background) was removed and its three sites converted to--fe-color-card-primary-bg-dark— one token for "dark elevated card surface" instead of two redundant ones. Saved overrides for the removed key are silently ignored on load byresolve_design's unknown-key guard, so no migration is needed.Fixed — Block payloads no longer reset when moved between containers
Dragging a heading (or any block) out of a nested container in the page builder was silently losing its text and other in-modal edits. Each structure-card pill stored its block data in a
data-block-payloadattribute set once at server render. When the user opened the modal block editor and edited a heading's text, that change lived only in the BlockEditor's internalstate.sections— the pill's DOM attribute stayed stale. Then when the user dragged the block out of its container,syncStateFromDomrebuilt the hiddenblocks_jsonfield by reading those stale pill payloads, quietly clobbering the modal edits.Fix: keep pill payloads in sync with editor edits in real time. Two new helpers exposed from
page_structure.js:window.tspSyncStructurePayloadsFromState(stateSections)— walks an entire BlockEditor state, refreshing every matching pill'sdata-block-payload+data-previewand merging container settings into the livecontainerPayloadByIdmap (preserving each container's.data.blockssince the structure card stays canonical for composition). Called from the editor modal'sinputlistener on every keystroke.window.tspSyncStructurePayloadOne(id, payload)— single-block variant for the dedicated modals (hero / meetings / events / features / FAQ). Called from each modal'spersistModalToBlockafter writing toblocks_json, so the in-session view also reflects edits without waiting for a save round-trip.
Drag a heading out of a container after editing it in the modal — the text + every other setting now travel with the pill.
Added — Block + container duplication in the page builder
Every block pill gains a
⧉icon button next to the existing×, and every container row gains a "Duplicate" action alongside Settings + Remove. Clicking duplicate deep-clones the payload (re-uid'd top to bottom — nested container children get fresh ids too) and inserts the copy immediately after the original.- Top-level leaf pills are wrapped in a
.fe-page-structure-row--single; duplicating them produces a fresh row at the same level rather than a sibling pill that would collide inside the original's single-block zone. Nested + orphan pills duplicate as straight sibling pills in the same drop zone. - Container duplication uses
makeRowFromPayload(clone)so a duplicated container renders as a full row (with its own column cells, drop zones, and recursive children). - Wired through
bindRemoveButton+ the existing MutationObserver + delegated click handler so duplicate buttons on freshly-minted pills (palette drops, row-factory output, the duplicate itself) pick up the same behaviour automatically. The "open editor modal" pill-click guards now skip clicks on the duplicate buttons too, so duplicate doesn't double-fire as an edit.
Changed — Flex containers render as single-zone flow in builder
Flex containers in the page builder used to split into N column cells (one per child) whenever
direction: row— which misrepresented how flexbox actually works: children are siblings inside one container, not isolated tracks. Now every flex container renders as a single drop zone in the structure card, regardless ofdirection. The zone gets a flex-flow class (fe-page-structure-block-list--flex-{row|column|row-reverse|column-reverse}) that matches the configured direction, so pills inside lay out exactly how they will on the public site. Grid containers keep the N-cell visualisation (the public CSS Grid layout actually does map children to discrete tracks).- Wording — flex containers now label themselves "Flex row container" / "Flex column container" (matching the configured
direction) in both the inline-edit placeholder and the chip below. Grid containers keep the existing "N-column container" wording. - Column flow pills stretch full-width —
align-items: stretchon.fe-page-structure-block-list--flex-column+width: 100%on each pill, so vertical-flow containers read as a stack of equal-width pills (the way they'll render on the public site). - Row flow pills size to content —
width: auto; flex: 0 0 auto, so several pills can sit side-by-side in a horizontal row. - Auto-provisioning — the showcase pattern (one inner-container shell per cell) only applies to multi-column GRID containers now. Flex containers hold their direct children flat.
Fixed — Nested container layout adapts on narrow viewports
When containers were nested inside other containers, the inner row's 130-px label gutter (which holds the row-num chip + Settings + Remove + Duplicate buttons) at ≥720 px was eating the drop zone — three deep the zone collapsed to nothing at typical admin viewports. Nested rows (any
.fe-page-structure-rowinside a parent's.fe-page-structure-col) now always stack the label + action buttons above their columns grid, with the label laid out as a horizontal strip (input + chip + Settings + Duplicate + Remove) so the gutter stays compact above the full-width drop zone. Top-level rows are unaffected.Changed — Block pills hover-expand so edit/delete stay reachable
In narrow nested cells, the "Edit" hint chip + × remove button at the right edge of clickable pills used to clip against the cell border, making them unreachable. On hover (or keyboard focus-within), the pill now grows to
min-width: max-contentand lifts above neighbouring content withposition: relative; z-index: 5+ a soft drop shadow — so every control is visible and clickable no matter how tight the column. Cells aren'toverflow: hidden, so the pill simply paints beyond its column without disturbing the surrounding layout.Added — Collapsible sidebar sections
The labelled sections in the main admin sidebar (Intergroup / External / Admin) collapse + expand independently. Each section's divider is now a
<button>with an aria-expanded toggle + a chevron that rotates -90° when collapsed; the items wrapper hides via[hidden]. Per-section state persists inlocalStorageunder thetsp-sidebar-collapsedkey, and is re-applied after the AJAX nav refresh triggered by Settings saves so collapse state survives module-toggle round-trips. The unlabelled "main" section (top items) stays always-visible.Changed — File browser: thumbnails, grid view, pagination, lightbox prev/next
The File Browser (
/tspro/files) is now a usable visual library instead of an opaque table:- List view — every row leads with a 48×48 thumbnail. Images render the actual file (lazy-loaded,
object-fit: cover); PDFs / docs / video / audio render a typed icon + extension badge fallback. Clicking the thumbnail (or filename link, as before) opens the lightbox for previewable types. - Grid view — toggle in the top actions switches to a responsive
auto-fill, minmax(180px, …)card grid with square thumbnail surfaces and filename + size below. Each card has hover-lift + brand-coloured border. The toggle's "List" / "Grid" preference persists in the existingview-mediacookie alongside sort + direction. - Lightbox — collects every previewable item on the page and lets you step prev/next via on-screen chevron buttons or ← / → arrow keys, with a "3 / 17" counter in the header. Works for both views and the picker preview button. Image and PDF previews unchanged from before; other types fall back to opening in a new tab.
- Server-side pagination —
/tspro/filesnow paginates at 100 records per page. The route builds a single SQL query that pushes the hidden-filename + pending-uploads + search filters and the chosen sort (with a SQLCASEfor thetypebucket so it groups by extension globally) before.offset().limit(), returning exactly one page's worth of rows regardless of catalog size. A pagination footer below the list/grid shows "Showing X–Y of N" + First / Prev / Page / Next / Last buttons (disabled at the ends).
Fixed — Frontend FAQ block fills its container in the page builder
The shared FAQ partial (
frontend/blocks/faq.html) always wrapped itself in<section class="fe-section"><div class="fe-container">— which on the page-builder render path was capping the accordion to the partial's own 1160-px.fe-containerregardless of the surrounding builder container's width. Newfaq_no_chromeflag, passed fromfrontend/page.html's FAQ branch, drops both wrappers in builder context and forces the inner.fe-faq-listto its full-width mode. The accordion now fills whatever container width the admin set on the parent. New.fe-faq--bareclass zeroes section padding and the auto-centring margin (only horizontal — vertical rhythm on the list + section head is preserved); only kicks in on the builder path, so the homepage's full-section FAQ is unchanged.Changed — Removed hidden 28 px / 5 vw padding on
.fe-containerThe
.frontend-body .fe-containerselector had a baked-inpadding: 0 28px(andpadding: 0 5vwat ≤560 px) that admins couldn't see or override from the page-builder. The container now enforces onlymax-width: var(--fe-container-max)+ horizontal centring; every gutter / horizontal padding decision lives in the per-section / per-container builder settings.Added — Stories admin bulk actions
The
/tspro/storiesadmin page gains the same multi-select / bulk-action UI the Posts admin has had since 1.8: a row of checkboxes (per row + select-all in the header), a hidden pill-shaped action bar that slides in once you've selected at least one story, and one POST handler that processes the whole batch in a single transaction.- New
story_bulkroute (POST /tspro/stories/bulk) acceptsaction∈{archive | unarchive | draft | publish | delete}and a repeatedidsfield. Mirrorspost_bulk's shape exactly — id-parse with silent skip on stale ids, singleStory.id.in_(...)lookup, action-specific commit. Delete path snapshots featured-image filenames + inline/pub/body image paths before row removal so_cleanup_retired_assetcan run after commit with the row no longer pointing at the files (otherwise the residual-reference check would keep the asset alive forever). - Activity log writes a single
story.bulk_<action>row per batch with the count and label, so the User Log shows "Bulk archived 12 stories" rather than 12 separate events. - Bulk-action bar adapts to the current tab — no
Archivebutton while viewing Archived (would be a no-op), noMove to draftson Drafts, noPublishon Published.DeleteandClearare always present. - Per-row action buttons (Edit / Publish / Drafts / Archive / Delete) now reference sibling
<form id="single-story-...">stubs viaform="..."so a row's individual archive/delete button can sit inside the bulk form without nested-form warnings. - Selected rows pick up a subtle brand-tinted background via
tr[data-story-row]:has(input:checked)so it's obvious at a glance which rows are about to be bulk-actioned. - Inline JS (same shape as
posts.html): row-check listeners refresh the counter and reveal the bar, select-all toggles every visible checkbox with proper indeterminate state when partially selected, each[data-bulk]button writes its action name into the hidden field and submits with an optional confirm prompt (count interpolated into the message — "Delete 7 selected stories permanently?"). - Toolbar + bulk-bar styles (
.posts-toolbar,.posts-bulkbar,.posts-bulkbar-count,.posts-th-check,.posts-check-wrap) were previously defined inline inposts.htmlandblog_list.html. Lifted intostories.htmlso the bulk pill chrome renders correctly on this page.margin-bottom: 1remon the stories toolbar gives the "Showing N stories" line breathing room above the table — Posts and Blog keep their existing 0.85rem.
Added — FAQ block: 1/2-column layout, boxed/full-width, side-padding control
The per-page FAQ block (page-builder modal
#page-faq-edit-modal) gains three layout knobs above the items list. All three default to the historic single-column / boxed / no-extra-padding render, so unedited FAQ blocks are byte-for-byte identical post-upgrade.- Columns —
1(default) or2. The 2-column variant splits items into two independent flex stacks at template render time (ceil(N/2)on the left, the remainder on the right) so each column is its own stacking context. Critical: a single CSS Grid would share row heights between columns, so a taller card on one side would push the other side's items down by inflating the shared row — separate stacks mean the right column's heights can never reach across and affect the left's. Both columns sit flush to the top of the FAQ list; items pack to the top of each column via the flex column's natural flow. - Width —
boxed(default, 760px column on 1-col / 1080px on 2-col) orfull(lifts the cap so the accordion bleeds to the parent container's edge — useful when paired with a wide page or the 2-column layout). - Side padding — integer-pixel slider (0..200px) that adds inner horizontal padding on the FAQ block's
.fe-container. Lets the admin tuck the accordion inside a gutter without nesting it in a wrapper container block. - Storage — three new optional keys on the FAQ block's
data:columns,width_mode,pad_x. Modal inputs carrydata-faq-field="<key>"so the existing two-way binding inpage_faq_modal.jspicks them up alongside heading/subheading — generalisedreadModal()/populateModalFromBlock()so the JS walks every[data-faq-field]element rather than hardcoding each key. - Pill preview — the block-list pill's subtext now shows
N items · 2 col · full-width(or· 1 colfor the default) so you can see the layout at a glance without opening the modal.
Public render lives in
frontend/blocks/faq.html: applies.fe-faq-cols-{1|2}+.fe-faq-w-{boxed|full}classes; injects inlinepadding-left/righton.fe-containerwhenpad_x > 0. The 2-column markup is two.fe-faq-coldivs wrapping the item lists; CSS lays them out as a flex row withalign-items: flex-startso each column sizes to its own content (grid's defaultalign-items: normalwas resolving tostretchin some browsers and stretching the shorter column, leaving its cards visually centered in the column). On phones (≤720px) the row wraps to a single-column stack.Fixed — Nested page-builder containers were inheriting the parent container's shadow / bg / border / hover
CSS custom properties inherit by default. When the outer container's inline style set
--block-cont-shadow: <value>, that variable cascaded to every descendant — and any nested.block-containerread it throughbox-shadow: var(--block-cont-shadow, none), with the inherited value winning over thenonefallback (which only applies when the variable is truly unset, not when inherited). Same latent leak affected--block-cont-bg,--block-cont-border-color,--block-cont-border-width, every--block-cont-hover-*, and the grid/flex layout vars.Fix: reset every container-scoped variable to its default at the top of the
.block-containerrule. Inline styles on the same element still win (specificity 1,0,0,0 > 0,0,1,0), so a container that DOES declare its own values keeps them intact — but inherited values from ancestors no longer leak through. Each container now starts from a clean slate, so a nested container with no shadow configured stays shadow-free even if its parent has one.Added — Frontend visitor metrics (anonymous page-view analytics for the public site)
A new admin-only analytics surface that tracks real human traffic to the public web frontend. Signed-in users (admins, editors, intergroup members, viewers) are excluded from every count — the metrics page reflects actual visitors only.
Schema:
- New
VisitorEventmodel (app/models.py) — one row per anonymous page view. Columns:created_at,day(UTCYYYY-MM-DDfor cheap date-bucketed aggregations),path,endpoint,referrer_host(origin only — full referer URLs never persisted),device(mobile/tablet/desktop/other),browser,os,visitor_hash. Indexed on(day, path)and(day, visitor_hash)so the metrics-page rollups scan a small slice rather than the whole table. - Privacy: no IP, no User-Agent string, no full Referer URL is ever stored.
visitor_hashis a daily-rotating BLAKE2b of(SECRET_KEY, UTC date, IP, UA)— the salt rotates at midnight UTC, so a hash is a stable identifier within a single day but a different hash the next day. Uniques are estimated fromCOUNT(DISTINCT visitor_hash)per day. - New
User.dash_show_visitor_metricsboolean column (default true, migration entry added to_migrate_sqlite) — drives the per-user dashboard customize toggle.
Recording pipeline (
app/visitor_metrics.py):- Mounted as a
before_requesthook on thefrontendblueprint so admin-portal traffic is never recorded. - Drops requests that are: authenticated (
current_user.is_authenticated), non-GET, asset fetches (any of/static/,/pub/,/site-branding/,/faviconor extension.png|jpg|jpeg|gif|webp|avif|svg|ico|css|js|woff|woff2|ttf|otf|eot|mp4|webm|mp3|ogg|m4a|pdf|zip|json|xml|txt|map), browser prefetches (Sec-Purpose: prefetch,Purpose: prefetch), empty UA, or bot UA (~30-token allowlist covering Googlebot, Bingbot, Facebook/Twitter/LinkedIn link previews, Discord/Telegram/WhatsApp previews, Yandex/Baidu/DuckDuck, SEO crawlers Ahrefs/Semrush/MJ12/Petal, monitoring bots Pingdom/UptimeRobot, headless Chrome / Lighthouse / PageSpeed, and common HTTP libraries curl/wget/requests/axios/okhttp/go-http-client). - Cross-blueprint guard: even if a future change accidentally registers the hook elsewhere, the recorder bails when
request.endpointdoesn't start withfrontend.— admin-portal traffic can never leak into the table. - User-Agent parsing is a small dependency-free lookup (
_BROWSER_PATTERNS/_OS_PATTERNS). Edge/Brave/Vivaldi/Opera are matched before Chrome (they all carry "chrome" in the UA); iPads masquerading as Macs are routed totabletvia the touch-event tiebreaker. - Defensive at every step — any exception in the recorder is swallowed (with a session rollback) so a flaky write can't break the public page render.
Admin metrics page (
/tspro/frontend/metrics, admin-only, inside the Web Frontend subnav under Overview):- Five top-line summary tiles — Views in window (with inline 14-day sparkline), Unique visitors in window (+ derived views-per-visitor), Today (with
↑/↓delta vs yesterday), Yesterday, Last 7 days. - Full-width inline-SVG time-series chart — filled area for total views (brand gradient) overlaid with a dashed purple→cyan stroke for unique visitors. Horizontal grid lines + tick labels on the Y axis; adaptive X-axis label density (every 1/3/7 days depending on window length). One
circleper day wires up a hover tooltip that shows the day + both counts. - Hour-of-day distribution — 24 vertical bars showing average traffic per hour (UTC, last 30 days).
- Three donut charts — Devices, Browsers, Operating systems. Each donut renders as concentric
circlearcs withstroke-dasharrayslices (no external chart library), centered with the total view count, alongside a legend list with swatch / label / count. - Two top-N tables — Top pages (links to the public URL, opens in new tab) and Top referrers (
Direct / bookmarkfor null referrers, external link icon otherwise). Each row carries an inline bar gauge showing its share of the top result. - Window selector top-right (
7 / 14 / 30 / 90 days); the route's_resolve_metrics_windowonly accepts those four values so hand-crafted query strings can't widen the scan. - Page renders inside
fe-admin-layoutwith_frontend_subnav.htmlso the Visitor Metrics entry highlights as active and the page reads as part of the Web Frontend module.
Dashboard widget (admin-only, draggable, "Frontend Visitor Metrics"):
- Three stat tiles — Today, Last 7 days, Unique · 30d — with the Today tile in brand-tinted accent style.
- Inline-SVG 14-day sparkline (filled area + stroke). When there's no traffic yet, shows a friendly "No visits yet — once the public site sees real traffic, the chart will populate." message instead of a flat line.
- "Open metrics →" link in the card header navigates to the full metrics page.
- Widget participates in the existing dashboard drag-drop reorder; per-user toggle in the Customize Dashboard modal (admin-only section, default on).
- New JSON endpoint
/tspro/frontend/api/visitor-metrics/summaryreturns the summary numbers + sparkline series — wired for future polling refresh, currently used as the canonical shape definition.
Sidebar wiring:
- The Web Frontend subnav (
_frontend_subnav.html) gains a "Visitor Metrics" entry right under "Overview" (Lucidebar-charticon). Active-state highlight matches whenrequest.endpoint == 'main.visitor_metrics_page'. - No entry in the top-level admin sidebar — the page is conceptually part of the Web Frontend module and lives entirely within its URL space (
/tspro/frontend/metrics) and its admin layout.
CSS — ~200 lines added under
/* ===== Visitor metrics admin page ===== */. Tile grid responsive 5→3→2→1 columns; chart hover dots animate radius on:hover; donut slices animatestroke-widthon container hover; tooltip uses absolute-positionedposition: absoluteinside the chart wrapper so SVG↔HTML coordinates line up; dark-mode-aware trend arrows (#16a34alight /#4ade80dark for up;#dc2626/#f87171for down).Verified end-to-end on the live install: hit the public site as Chrome/macOS, Safari/iOS, Firefox/Windows, Chrome/Android — all four recorded with correct device/browser/OS parsing; Googlebot UA and
/static/*asset hits correctly skipped; admin metrics page and dashboard widget both render with live data including the chart, donuts, and top-pages tables. -
1.9.1May 13, 2026
Fixed — Frontend export/import now produces a verbatim 1-to-1 copy (bundle v3 → v4)
Two gaps in the frontend bundle were silently dropping per-page customisation on every restore. Both fixed; bundle format version bumped 3 → 4 (v3 bundles still import — the new fields fall back to defaults).
- Per-page spacing columns —
pad_top,pad_bottom,pad_x,section_gap,block_margin_y(added during the page-builder cycle, ~80/96/16/32/12 defaults). Previously NOT exported and NOT imported — every restored page reverted to the model's defaults. Both sides now carry them. The import side falls back to the same defaults via a local_opt_inthelper when a v3 bundle predates the change, so older bundles continue to import without surprises. - Homepage designation —
SiteSetting.homepage_page_idis a Page FK, and page IDs aren't portable across installs. Export now resolves the FK → page slug assettings.homepage_page_slugin the payload. Import side runs after pages are restored, looks up the page by slug, and writes the new id back toSiteSetting.homepage_page_id. When the slug is missing (v3 bundle) or doesn't match any imported page, the destination keeps whatever its own_seed_homepage_pagewrote —/stays 200 either way.
Manifest scope note rewritten to call out the v4 additions and the v3 backwards-compat path. Format version bumped in both
manifest.json(the zip header) and the innerfrontend.jsonpayload'sformat_versionconstant.No code changes needed for the rest of the v1.9.0 surface area that lives inside
blocks_json— Container per-side borders, hover border-width, mobile direction / padding, height / min-height, dark-mode colours; Hero dark-mode gradient + sub colour; Features / FAQ heading + subheading + items list; Meetings / Events filter + display toggles. These all ride along byte-for-byte inside the TEXTblocks_jsoncolumn. The whole-site bundle (verbatim SQLite copy) likewise needs no changes — the newhomepage_page_idcolumn rides along with the raw.dbfile.Verified by round-trip test on the live install: tweaked a page's spacing to
42/137/7, exported, cleared the destination state, re-imported withconfirm=REPLACE, confirmed the page's spacing was restored verbatim andSiteSetting.homepage_page_idwas correctly re-pointed at the new page row (id changed from 11 → 23 due to the wholesale delete/replace; the FK followed via slug). - Per-page spacing columns —
-
1.9.0May 13, 2026
Changed — Homepage is now a Page (the legacy homepage admin + public renderer are retired)
The public
/root is now driven by whicheverPagerow the admin designates as the homepage. The legacy homepage admin editor (/tspro/frontend/homepage) and its custom render pipeline are gone — the homepage uses the same page-builder editor as every other content page, with the same modals, the same per-block data shape, and the samefrontend/page.htmlpublic render.Schema:
SiteSetting.homepage_page_id— new nullableIntegerFK toPage.id(ON DELETE SET NULLso deleting the page doesn't break the column). Migration added to_migrate_sqlite.- New
_seed_homepage_page(app)runs in the boot sequence after_seed_page_layouts. Idempotent — ifhomepage_page_idis already set to a valid Page, no-op. Otherwise: adopts an existingslug='home'Page if one exists, or creates a fresh "Home" page (slug='home', single hero block with welcoming default copy —"You are not alone."/"Find meetings, connect with your community…"—published=True,layout_key='page-blank') and writes the ID. Every install — fresh or existing — has a homepage Page after first boot following this release.
Public render:
frontend.py::index()loads the homepage Page and renders it through the same pipeline aspage_detail: parsesblocks_json, collects heading TOC, hydrates per-instance meetings groups + events lists, and rendersfrontend/page.html. The legacy hero / blocks / homepage-template chain is gone. Whenhomepage_page_idis null (shouldn't happen post-migration),/renders an empty placeholder page rather than 500.
Admin UI:
- Sidebar (
_frontend_subnav.html) — "Homepage" link now routes to/tspro/frontend/pages/<homepage_page_id>/edit(falls back to the Pages list if the column is unset). Active-state highlight tracks whether the admin is on the homepage's edit screen specifically vs any other page. - Pages list (
frontend_pages.html) — the current homepage row picks up anis-homepageclass (subtle brand-tinted row background), achip-homepagebadge next to the title ({{ icon('home') }} Homepage), its slug column shows/rather than/<slug>, the View link points at the public/, and both Delete and Make-Homepage actions are hidden for that row (can't delete the active homepage; can't make a page its own homepage). Every other row picks up a Make-homepage button. - Page-edit screen (
frontend_page_edit.html) — banner reads"Editing homepage"instead of"Editing page", slug shows as/, and gets thechip-homepagebadge. The Make-homepage button sits inline with the status pills for non-homepage pages. - New route
POST /tspro/frontend/pages/<id>/set-homepage(frontend_page_set_homepage) — flipsSiteSetting.homepage_page_idand, in the same transaction, publishes the page if it wasn't already published (admins shouldn't have to flip status separately just to designate a homepage). - CSS — new
.chip-homepagerule +.tbl tr.is-homepage tdrow tint (both brand-tinted viacolor-mixagainst--brand).
Legacy retirement (473 lines deleted from
routes.py):frontend_save(legacy homepage content POST)frontend_hero_save(legacy hero settings POST)frontend_hero_button_new/_edit/_delete/_buttons_reorder(legacy hero CTA CRUD)frontend_homepage(the admin editor view itself)frontend_homepage_template_save(legacy homepage layout picker POST)site_hero_bg_image/site_hero_bg_video(legacy public asset routes)
Templates deleted:
frontend_homepage.html(1,400+ line legacy editor),frontend/index.html(legacy public render),frontend/_hero.html,frontend/homepages/classic.html,frontend/homepages/recovery-blue.html,frontend/homepages/_custom.html, and the now-emptyfrontend/homepages/directory.Updated
url_forcallers infrontend_dashboard.html(Web Frontend dashboard's Homepage card now points atfrontend_page_editwith the currenthomepage_page_id) andfrontend_templates.html(the explanatory note about "layouts vs templates" no longer references the legacy Homepage URL).Data left in place for forward / backward compatibility:
SiteSetting.frontend_hero_*columns (~25),frontend_blocks_json,frontend_homepage_template, and theFrontendHeroButtontable stay on disk. No code reads them now, so they're inert — but keeping them lets the export bundle continue to serialise pre-retirement values and lets a future tooling pass migrate any custom legacy homepage content into the new Page model.CustomLayout(kind='homepage')rows (the homepage's drag-drop layout presets) stay in the DB. Inert in the new world; the page builder useskind='page'layouts. Same export-bundle reasoning.
Verified by test client on fresh boot:
/→ 200 rendering the seeded Home page,/tspro/frontend/homepage→ 404,SiteSetting.homepage_page_idpopulated with the seeded page's ID, Pages admin shows the badge + Make-homepage forms on non-homepage rows, edit screen shows "Editing homepage" banner, sidebar Homepage link targets the right page.Added — Hero edit modal — dark-mode controls for the heading gradient + subheading text
Three new colour inputs in the modal's Typography column: Gradient start (dark) + Gradient end (dark) under the Heading group, and Text colour (dark) under the Subheading group. The existing inputs were relabelled "(light)" so the pairs read clearly. Defaults match the existing hardcoded dark hero CSS (
#ffffff → #94a3b8gradient,#94a3b8sub colour), so unedited blocks render identically in dark mode to before the controls existed._hero_block_modal_proxycarries the three keys (frontend_hero_heading_grad_start_dark/_end_dark/frontend_hero_subheading_color_dark);hero_block.htmlemits matching inline CSS vars--fe-hero-h-grad-s-dark/--fe-hero-h-grad-e-dark/--fe-hero-sub-color-dark. The existinghtml[data-theme="dark"] .fe-hero-headingand.fe-hero-subrules now read those vars (with the historic hex colours as fallbacks).page_hero_modal.js::syncPreviewstamps the same dark vars on the preview heading + sub, so the live preview reflects the admin's dark-mode choice when the admin theme is set to dark.Two subsequent fixes for the same feature:
- Dark-mode wins over dynamic-text — when "Dynamic text colors" was enabled on the block, the
.fe-hero-text-light/dark .fe-hero-heading { … !important }rule hardcoded light-mode colours regardless of theme, so the dark vars set inline never resolved. Added!importantto the new dark-mode rule (with higher specificity fromhtml[attr] .class) so dark-mode wins over dynamic-text under dark theme. Light theme keeps the dynamic-text behaviour unchanged. - Glyph clipping preserved — first cut of the dark-mode override used
background:shorthand with!important, which resetbackground-cliptoborder-box(also!important) and made the heading paint as a solid gradient rectangle instead of clipping to glyph shapes. Switched tobackground-image:(the same trick the dynamic-text rule uses) so the base rule'sbackground-clip: textstays in effect.
Fixed — Inclusion-style list pills (
.fe-pp-list-pills) didn't obey dark modeThe dark-mode rule for the page-builder
listblock's pill style only matchedhtml[data-theme="dark"]and missedbody.fe-frontend-force-dark; and worse, it computed its background viacolor-mix(var(--fe-color-surface, …) 70%, …)—--fe-color-surfaceis a light-mode design token (usually near-white), so the resulting fill landed on a light grey even in dark mode. Refactored to read--fe-dm-surface/--fe-dm-border/--fe-dm-textdirectly (the same tokens every other dark surface uses — FAQ, meeting cards, contact cards), and paired the selector withbody.fe-frontend-force-darkso both system-driven and admin-locked dark modes engage. Pills now sit on the same dark-navy + dark-slate family as the rest of the page.Changed — Page-builder pages drop the auto-divider between adjacent
.fe-sectionblocksThe site-wide rule
.fe-section + .fe-section { border-top: 1px solid var(--fe-border); }added a hairline between consecutive section blocks — fine on the homepage (Features → divider → CTA → divider → FAQ), but a surprise on admin-composed page-builder pages where every block (FAQ, Features, Meetings, Events) emits its own<section class="fe-section">. Two adjacent blocks inside the same.fe-pp-sectiongot an uncontrollable hairline that admins couldn't see in the editor and couldn't remove from the container settings. Suppressed inside.fe-ppvia.fe-pp .fe-section + .fe-section { border-top: 0 }; the homepage (no.fe-ppwrapper) keeps the original behaviour. Container borders are now the only border driver on page-builder pages — wrap blocks in a container if you want a visible divider.Fixed — Mobile
.fe-pppadding + section-gap now honour admin's per-page settingsTwo hardcoded mobile overrides defeated the per-page spacing controls (
pad_top/pad_bottom/section_gapfrom the page-edit form):@media (max-width: 640px) .fe-pp { padding: 56px 0 72px }discarded the inline--fe-pp-pad-top/--fe-pp-pad-bottomvariables — an admin who setpad_top: 0from the page-settings panel still saw 56 px on phones. Rule now reads from the same custom properties as desktop with tighter fallback values (56 / 72) so unset pages keep the historic look but explicit0actually flushes to the header.@media (max-width: 640px) .fe-pp-section { margin-top: 24px }pinned every section after the first to 24 px regardless of the admin'ssection_gap. Removed — desktop'svar(--fe-pp-section-gap, 32px)carries through, sosection_gap: 0produces zero margin on mobile too.
Fixed — Icon picker modal opens behind the hero / features / FAQ edit modals
Both modals lived at the default
.modalz-index 100; whichever opened later won the DOM-order tiebreaker. Per-page edit modals are included AFTER the icon picker infrontend_page_edit.html, so the picker was getting layered behind. Bumped.icon-picker-modaltoz-index: 200so it always stacks above the standard.modalchain — same approach the.fe-save-baralready uses for "stays above any open modal". Sits below the dynbg picker (max-int z-index) so the more-modal-than-modal hierarchy stays intact. Affects every consumer of[data-open-icon-picker]: hero CTA editor, features card editor, FAQ item editor, nav-megamenu link editor.Added — Hero / Meetings / Events blocks available in the page builder
Three homepage section types are now first-class blocks the admin can drop onto any content page from the floating "Add blocks" palette. Each one shows up alongside the existing primitives (heading, paragraph, image, container, …) with its own Lucide icon and a server-side preview popover.
- Hero — per-instance content + background block. Mirrors the homepage hero's full surface area (heading, subheading, eyebrow + tagline toggle, heading typography with font / size / gradient, subheading typography with font / size / colour, dynamic-text contrast, desktop + mobile height sliders, all 7 background styles — Frosty / Solid / Gradient / Image / Sinewave / Video / Dynamic — particle overlay with effect + speed + size, and a rich CTA-button list with per-button icons + custom colours). Every field is independent of
SiteSetting.frontend_hero_*— each page's hero is fully customisable on its own. - Meetings list — live filtered card grid. Carries its own filter (today / next 24h / next 7 days / this week / all) + max-count + display toggles (group by day, type chip, schedule lines) + animation + stagger + heading + intro. Hydrated server-side per block instance via
blocks.filtered_meetings(d)and rendered through the existingfrontend/blocks/meetings.htmlpartial. - Upcoming events — same shape as the meetings block, hydrated via
blocks.filtered_events(d, site=…), rendered throughfrontend/blocks/events.html. Per-row toggles for featured image / summary / location.
Wiring:
-app/routes.py—_PAGE_LAYOUT_BLOCK_TYPESgainshero/meetings/events;_PAGE_BLOCK_CATALOGgains catalog entries (icon + description, surfaced in the palette);_block_previewhandlers emit meaningful hover-popover text per block ("Today's Meetings · upcoming_today · max 6 · grouped by day", etc.); new_hero_block_modal_proxy(data)helper builds aSimpleNamespacemirroringSiteSetting.frontend_hero_*so the page-hero modal partial can reuse the homepage's markup verbatim.
-app/static/js/block_editor.js— three newBLOCK_TYPESentries;blankBlockdefaults for each (Hero defaults match the homepage shape, Meetings + Events copyblocks.MEETINGS_DEFAULTS/EVENTS_DEFAULTS);renderHeroBody/renderMeetingsBody/renderEventsBodyeditor builders; dispatch inrenderBlockBody.
-app/static/js/page_structure.js—BLANK_DATAfactories for the three types (mirrorsblock_editor.js's defaults so palette drops produce identical payloads regardless of entry point);tspBlockLabelsentries;makePillElroutes hero pills to the dedicated#page-hero-edit-modalinstead of the generic BlockEditor modal.
-app/templates/_frontend_structure_card.html—page_pillmacro routespill.t == 'hero'topage-hero-edit-modalwhile every other block type keeps using the generic modal.
-app/templates/frontend_page_edit.html— adds_PAGE_BLOCK_LABELS+_editableentries for the three new types; includes the new_page_hero_modal.htmlpartial; loadslogin_fx.js(powers the hero's particle / sinewave engines) + the newpage_hero_modal.js.
-app/frontend.py::page_detail— recursively scanssectionsformeetings/eventsblocks (incl. nested under containers), pre-fetches each instance's data viafiltered_meetings/filtered_eventskeyed by block id, passes both maps to the template.
-app/templates/frontend/page.html::pp_block— three new branches: hero includesfrontend/blocks/hero_block.html(a per-block-data sibling of_hero.html); meetings + events use Jinja{% with %}to scopeblock_content+meetings_groups/events_listper block instance before including the homepage section partials.
-app/templates/frontend/blocks/hero_block.html— new partial. Drives the same.fe-heroCSS recipe the homepage hero uses but reads every value from block data (heading, subheading, eyebrow, fonts, sizes, gradient + solid + image + sinewave + video + dynamic backgrounds, particle overlay, per-button icons + custom colours) so the public render matches the homepage's visual fidelity.Added — Hero block edit modal — verbatim copy of the homepage modal, wired to per-page data
The Hero block opens a dedicated
#page-hero-edit-modal(defined inapp/templates/_page_hero_modal.html) whose markup is copy-paste of the homepage's hero edit modal — live preview pane at the top, three-column layout (Text / Background / Buttons), every original control. The only adaptations:- reads from a Python
SimpleNamespaceproxy (_hero_block_modal_proxy) instead ofsitedirectly, so the same Jinja can drive either context; - no
<form action>(values save with the parent page-edit form viablocks_json); - the FrontendHeroButton table is replaced with a JS-driven button-list editor (per-block buttons live inside
data.buttons, not a separate DB table); - the bg-image / bg-video CRUD hits
/files/upload(the standard media endpoint) instead of the hero-specific save endpoint.
Two-way data binding lives in the new
app/static/js/page_hero_modal.js(deferred toDOMContentLoadedbecause the partial includes after the script tag), with these behaviours:- Pill click → captures the active block id, reads
data-block-payload, populates every[data-hero-field]input from the block's data, renders the buttons list, syncs image / video previews, paints the live-preview pane. - Document-level capture-phase
input+changelisteners → write back toblocks_jsonAND directly mark the save bar dirty (#fe-save-bar.hidden = false+ dispatchedinputevent on#page-edit-form), so the save-bar reveal is decoupled from the persistence path. - Live-preview pane re-renders on every edit (
syncPreviewported from the homepage'sheroFullPreviewIIFE — heading / subhead / eyebrow text, font class swap, size + colour CSS vars, bg-style class + per-style paint, frosty blob hue vars, dynamic-text contrast class, particle FX lifecycle viainitLoginFX). - Synthetic
name="be-hero-<field>"stamped on every radio at init time — the verbatim copy dropped the homepage'sname="frontend_hero_…"in favour ofdata-hero-field, but radios still need anameto form a group (otherwise clicking Sinewave doesn't uncheck Frosty and:checkedqueries return stale state). - Submit-restore listener — the BlockEditor in
#page-layout-edit-modalauto-mounts on every pill click (viapage_structure.js), and its inline submit handler infrontend_page_edit.htmloverwriteshidden.valuewitheditor.serialize()right before submit. That serializer only knows about server-loaded data, so hero edits would be wiped without intervention. Tracked in aheroEditsMap; a late-firesubmit+formdatalistener on the page-edit form walks the just-overwritten JSON and patches every hero block's data back in.
Added — Per-page Meetings list edit modal (
#page-meetings-edit-modal)The meetings-list page-builder block now opens a dedicated modal that's a verbatim copy of the homepage's
editor_meetings()macro markup (lines 903-989 offrontend_homepage.html). Same 11 fields the homepage exposes — Section heading, Intro line, Filter (6 options: today / upcoming-today / next 24h / next 7 days / this week / all), Max meetings (1-30 slider), Schedule lines per card (1-7 slider), Animation (fade / slide / none), Stagger (0-200ms slider), Group by day toggle, Show meeting type chip toggle, Show schedule lines toggle, Empty-state message — bound throughdata-meetings-field="<key>"instead ofname="meetings_<key>"so values flow intoblock.dataand save with the parent page-edit form viablocks_json. New_meetings_block_modal_proxy(data)inroutes.pyreturns{**MEETINGS_DEFAULTS, **block_data}as a dict shim so the homepage macro's_ms.<key>access pattern works character-for-character. Pill routing in_frontend_structure_card.html::page_pill+page_structure.js::makePillElopenspage-meetings-edit-modalformeetingspills, sticky Done footer at the bottom of the scrolling panel.page_meetings_modal.jshandles two-way binding: pill click →populateModalFromBlockreadsblock.datainto the inputs (slider readouts refresh live); document-level capture-phase input/change listener walks[data-meetings-field], rebuilds the data shape, replaces the active block insideblocks_json, and flags the save bar dirty. Late-fire submit + formdata listener patchesmeetings_modal_editsback overeditor.serialize()output so the BlockEditor's stale-state serialize can't wipe modal edits.Added — Per-page Upcoming Events edit modal (
#page-events-edit-modal)Identical pattern to the meetings modal for the upcoming-events block. Same dedicated modal verbatim-copied from the homepage's
editor_events()macro (lines 992-1058 offrontend_homepage.html). 9 fields — Section heading, Intro line, Max events (1-24 slider), Animation (fade / slide / none), Stagger (0-200ms slider), Show featured image toggle, Show summary text toggle, Show location / online tag toggle, Empty-state message — bound throughdata-events-field="<key>". New_events_block_modal_proxy(data)returns{**EVENTS_DEFAULTS, **block_data}. Pill routing updated to sendeventspills topage-events-edit-modal.page_events_modal.jsmirrorspage_meetings_modal.jsbut with one extra wrinkle: the three visibility toggles (show_image/show_summary/show_location) default totruewhen undefined to mirror the homepage'sis not defined orJinja guard —populateModalFromBlocktreatsnullastruefor those keys specifically so a fresh events block doesn't appear to have everything off until the admin ticks the boxes.Added — Per-page Features cards block (
#page-features-edit-modal)Verbatim copy of the homepage Features section's editor surface AND public render. Modal markup mirrors
editor_features()+_feature_card_row()macros (lines 629-735 offrontend_homepage.html) — heading + subheading at the top, drag-to-reorder list of up to 6 cards, each card carrying icon (via shared[data-open-icon-picker]trigger), title, Markdown body with side-by-side live-preview MD editor, optional URL + new-tab toggle. Each top-level field bound throughdata-features-field; each per-card field throughdata-features-card-field.page_features_modal.jsclones the empty<template data-features-card-template>once per saved item on pill click (template's__IDX__placeholder gets a unique counter so the icon picker's#feat-card-<idx>-iconID selectors stay collision-free);tspInitMdEditors(node)wires up the freshly-cloned card's markdown preview tabs. Add / remove / pointer-driven drag-reorder; on every changereadModal()walks the DOM cards in order and rebuildsblock.data.items[]. Public render infrontend/page.html::pp_blockre-shapes the per-page block's data as{'features': d}and{% include "frontend/blocks/features.html" %}— the same partial the homepage uses — so the page-builder render is byte-for-byte identical (same.fe-features-grid, same on-brand icon colour, same markdown body rendering).Icon-preview helper exposed:
window.tspRenderIconHtml(ref)inapp.jslets the features (and FAQ) modal repaint the icon preview from saved data — the picker only paints when it changes the input, so without this helper a card cloned from saved data would show a blank icon spot while the hidden input still carried the saved ref.Added — Per-page FAQ accordion block (
#page-faq-edit-modal)Verbatim copy of the homepage FAQ section's editor + public render. Modal mirrors
editor_faq()+_faq_item_row()macros (lines 1075-1156 offrontend_homepage.html) — drag-to-reorder list of up to 20 accordion items, each carrying icon (with optional size override), question text, side-by-side Markdown answer editor. Per-item fields bound throughdata-faq-card-field(question / answer / icon / icon_size); the homepage version had no top-level heading or subheading override (its public partial carried a hardcoded section title "Frequently asked questions" + intro), so the page-builder version adds heading + subheading inputs at the top of the modal — empty values fall back to the homepage's hardcoded strings, so unedited blocks still produce a valid section-head.frontend/blocks/faq.htmlnow reads from optionalblock_content.faq_heading/block_content.faq_subheadingkeys with the original strings as fallbacks; homepage doesn't pass those keys so its render is byte-identical.page_faq_modal.jsmirrors the features modal — clone-template pattern, MD editor init, drag-reorder, late-fire submit/formdata patch — adapted for the simpler 4-key item schema. The accordion toggle handler infrontend/base.htmlis document-level ([data-faq-toggle]), so the per-page FAQ block's accordion animates exactly like the homepage's without any extra wiring.Added — Container — per-side border-width controls + hover border width
The container editor's Visual panel now exposes four "emptyable" number inputs —
border_w_top/border_w_right/border_w_bottom/border_w_left(each 0-16, blank = inherit the uniformborder_widthset above). The existing "Border width" control was relabelled "Border width (all sides)" with a hint explaining the overrides below. Empty / 0 / explicit-number all carry distinct meanings: blank = inherit; 0 = explicit "no border on this side"; any positive int = explicit width. A newemptyableNumInput()helper insiderenderContainerBodykeeps the empty-vs-0 distinction (the existingnumInput()coerced NaN to 0). When the four resolved widths are all equal, the renderer keeps the legacyborder: <w>px <style> <color>shorthand (zero diff for containers that haven't customised the new fields). When they differ, it switches toborder-style: <style>+border-width: <T>px <R>px <B>px <L>pxfour-value shorthand +--block-cont-border-color: <colour>variable (the colour is moved into a CSS variable so the existing:hoverrules can swap it).Hover border width added as a fifth control under the Hover panel —
hover_border_width(0-16, blank = no hover change). Pairs withborder_width: 0at rest + non-zero hover to make a border appear only on hover. Renderer emitsborder-style: solid+border-width: 0px 0px 0px 0pxrest declarations even with zero rest-state widths (so the hover swap has aborder-styleto paint with — defaultborder-style: nonewould keep the hover-width invisible).border-widthitself joins the transition list (180 ms ease) so the rest→hover swap animates instead of jump-cutting. New.block-container--hover-border-width:hover { border-width: var(--block-cont-hover-border-width); }CSS rule.Changed — Container hover effects — variable-driven, win over inline rest state
The container's hover-bg / hover-border-colour / hover-shadow rules weren't applying because the rest state was emitted as direct inline properties (
background-color: #fff; border: 4px solid #000; box-shadow: var(--block-cont-shadow); …), specificity 1,0,0,0, defeating the.block-container--hover-*:hoverrules at 0,0,2,0. Refactored the renderer (both_blocks.htmlfor the admin/editor preview andfrontend/page.html::pp_container_stylesfor the public render) to emit those three properties as inline CSS variables only —--block-cont-bg,--block-cont-border-color,--block-cont-shadow,--block-cont-border-width— with a global.block-containerrule consuming them for the rest state viavar(--block-cont-bg, transparent)etc. The existing:hoverrules now win on the cascade since inline no longer declares the property directly; admin's hover overrides (background / border colour / border width / shadow / lift) all visibly apply now. Existing dark-mode rules ([style*="--tsp-bg-dm"]+!important) keep working unchanged.Changed — Hero block edit modal — polish pass (sticky Done footer, symmetric padding, true-token preview, debug outline gone)
Four small refinements to the per-page hero edit modal added earlier in this release:
- Sticky Done footer — the unified action row now pins to the bottom of the scrolling panel with a frosted-glass background, top border, and soft drop-shadow so the Done button is reachable at any scroll depth, especially when the buttons list grows tall. Negative horizontal margins pull the footer through the card's 2 rem padding to span panel edge-to-edge; the negative bottom margin eats
padding-bottomso the footer pins to the panel's true bottom edge (no empty strip below). Dark-mode variant tunes the panel mix + shadow for low-light surfaces. - Symmetric horizontal padding —
.fe-page-edit-modal-panel > .cardwas carrying apadding-right: 56pxoverride left over from when the close button wasposition: absolute(it reserved room so the visibility toggle in.card-headwouldn't sit under the button). The close button has since switched toposition: stickywith its own clearance, and.card-headcarries its ownpadding-right: 64px, so the card-level override was creating an asymmetric body (32 px left / 56 px right) that made every input row look off-centre. Override removed; body content is now centred inside symmetric 2 rem horizontal padding, and the sticky-footer margins were retuned (-2remon both sides) to match. - Live preview now resolves design tokens —
.fe-btn-primaryreads throughvar(--fe-color-btn-primary-bg, var(--fe-ink)); those tokens are inlined as CSS custom properties on the public<body>style viadesign_css_vars(site), but the admin context has none of them, so the preview button was falling through to the fallback (var(--fe-ink), which is itself undefined in admin) and rendering a generic dark fill instead of the admin's chosen brand colour. Stamped the samedesign_css_vars(site)string onto the preview's.frontend-bodywrapper in_page_hero_modal.htmlso the preview button, ghost button, and yellow button now resolve to the same colours, shadows, hover lifts, and radii the public render uses. - Debug outline removed — the dashed
1px outlineI had stamped on.hero-full-preview .fe-hero-innerto visualise the 820 px max-width bound during development was still shipping; it read as a stray dotted rectangle inside the preview. Outline + dark-mode variant removed.
Added —
/homepage-v2— homepage cloned as a regular PagePer-page hero / meetings / events blocks make it possible to recreate the homepage as a content Page that lives under the standard page editor. A one-shot script seeded
/homepage-v2as a draft Page (id=11) by readingSiteSetting.frontend_blocks_jsonand translating each homepage section into Page-builder primitives:features(3 items) → section container → heading + subhead → 3-col grid of card-containers (icon + title + body + optional CTA each).cta→ section container → heading + body + row-container holding primary + secondary buttons.stats(4 items) → 4-col grid of card-containers (big-number heading + label paragraph).quick_links(4 items) → 4-col grid of card-containers (glyph + title + body + Open button)._meetings/_events→ placeholder containers documenting the carried-over config (filter, max_count, animation, etc.). Now that the live data-driven blocks exist, the admin can swap each placeholder for a realmeetings/eventsblock via the palette.testimonials(3) → 3-col grid of card-containers (quote + bold attribution,space-betweenjustify so attribution pins to the bottom — uses the new container Height field).faq(4) → single column of Q+A pair-containers.inclusion→ section container → icon + heading + body + pill-style list of 7 tag chips.
Every container that visually wants a "card" surface gets
height: 100%,shadow: sm,border_radius: 16, andbg_color_dark: var(--fe-color-card-dark)so dark-mode just works. Each container also carries a friendly Label so the editor's structure tree reads as "Section · Features", "Quick links grid", etc. instead of a wall of unlabeled rows. Live homepage at/is untouched —SiteSetting.frontend_blocks_jsonis byte-for-byte identical.Deferred to a follow-up: a
SiteSetting.homepage_page_idcolumn + route flip at/so the admin can promote a Page row to be the homepage once they're done iterating on it.Added — Container — Height + Min-height fields for stretching to fill grid cells
Two new free-form CSS length fields in the container's Spacing & width panel: Height and Min height. Both blank by default (auto-size to content, today's behaviour). The Height field unblocks the common pattern where a 3-column grid of cards uses
justify-content: space-betweenon each card's flex column to pin a button to the bottom edge — the grid stretches every cell to the tallest sibling's height by default, but a nested container inside the cell still sizes to its own content unless it explicitly opts in. Setting Height to100%makes the inner container fill the cell, which givesspace-betweensomewhere to distribute children.app/static/js/block_editor.js—containerblank-block gainsheight: ''+min_height: ''.renderContainerBodyappends two new rows under Max width: Height (placeholderauto — e.g. 100%, 400px) and Min height (placeholdernone — e.g. 320px, 50vh). Both accept any CSS length somin(50vh, 600px)/calc(...)round-trip cleanly.app/templates/_blocks.html+app/templates/frontend/page.html— both container renderers appendheight: <value>/min-height: <value>to the inline style only when the field is non-empty, so unset fields don't paint a redundantheight: autorule.
Existing containers are unaffected (both fields default to blank).
Added — Container — Mobile direction + mobile padding overrides (with visual divider in the editor)
Two new optional fields on every container that target the ≤720 px breakpoint:
- Mobile direction (Layout panel, flex-only) — overrides the historic "all flex containers collapse to column on mobile" default. Options:
Auto(today's behaviour),Column,Column reverse · bottom child first,Row · keep side-by-side,Row reverse · keep side-by-side, swap order. Lets admins keep a row layout on phones, or surface the right/bottom child first when a row collapses. - Padding (mobile) (Spacing panel) — free-form CSS-shorthand override applied at ≤720 px. Blank inherits the desktop padding so existing containers don't shift.
Mobile rows sit under a subtle dashed divider in the editor so the "desktop value / mobile override" pairs read as related controls rather than blending into the rest of the panel.
app/static/js/block_editor.js—containerblank-block gainsmobile_direction: ''+padding_mobile: ''. New select + text rows added to the Layout (inside flexBox) and Spacing panels respectively; both rows pick up a newbe-container-row--mobile-sectionmodifier class.app/templates/_blocks.html+app/templates/frontend/page.html— padding now emits as a CSS custom property (--block-cont-padding) instead of a directpadding:rule so the mobile media query can override it without an inline-style specificity war.--block-cont-padding-mobileand--block-cont-flex-dir-mobileonly emit when the admin set them; unset values fall back to today's behaviour.app/static/css/frontend.css— desktop readspadding: var(--block-cont-padding, 1rem); the existing@media (max-width: 720px)block now readspadding: var(--block-cont-padding-mobile, var(--block-cont-padding, 1rem))andflex-direction: var(--block-cont-flex-dir-mobile, column). Grid containers continue to collapse to a single column on mobile (unchanged).app/static/css/app.css— new.be-container-row--mobile-sectionrule (dashedborder-top+ extra top spacing) applied to both mobile-override rows for visual grouping.
Existing containers are unaffected — both new fields default to blank.
Fixed — Uploaded SVGs with
width="100%" height="100%"collapsed to 0×0 inside flex / grid itemsAffinity Designer, Serif, and several other SVG editors export with
width="100%" height="100%"on the root<svg>(only theviewBoxcarries the pixel size). When loaded through an<img>, such files have no intrinsic dimensions — only an aspect ratio — so placing them inside a flex item without a definite parent width collapses them to 0. 29 of 30 uploaded SVGs on the live deployment had this defect; the heart graphic in/for-family-and-friends's right-hand container was the visible symptom.app/routes.py::_normalize_svg_dimensions— new helper next to_sanitize_svg. Conservative regex rewrite that only fires when the root<svg>has BOTHwidth="100%"ANDheight="100%"AND a parseableviewBox. Replaces the percentages with the viewBox's width + height values so the SVG carries real intrinsic pixels. Inner<svg>elements, partial-percent values, and pixel-valued files are left untouched. Whole-number values format without trailing.0to keep diffs minimal.- Upload paths wired in —
_save_upload(library + media via_apply_file_upload),media_upload(the/files/uploadendpoint the page builder's image picker hits), andfrontend_custom_icon_upload(which already runs_sanitize_svg). Normalization runs before the SHA-256 dedup hash so re-uploading the same broken SVG dedupes against the already-fixed copy rather than the pre-fix bytes. - One-shot backfill — walked every
*.svginUPLOAD_FOLDERthrough the same helper; 29 files rewritten in place, 1 left alone (already had pixel dims).
Fixed — Page-builder Save bar reloaded the page out from under any open modal
The yellow save bar's "stay open after save" branch only kicked in when every dirty form lived inside a modal — but the page-builder's BlockEditor lives inside
#page-layout-edit-modalwhile the outer#page-edit-formis rendered in the main page chrome. Editing blocks inside the modal re-dispatchesinputevents to the outer form (so the bar lights up), but hitting Save then reloaded the whole page, dismissing the modal mid-edit.app/static/js/app.js::feSaveBar—stayOpennow ALSO returns true when any.modal.openis currently visible, not just when the dirty form itself lives inside a modal. Matches the intent of the existing in-code comment ("the visitor opened the modal to edit one block and would be jarred by it disappearing on save"). On save, the bar animates out, the modal stays in front, and the BlockEditor keeps its in-memory state for the next round of edits.
Added —
/for-family-and-friendsPage seeded via the content-page builderNew public Page at
/for-family-and-friendscarrying the verbatim copy from the matching page on dccma.com. Built entirely from existing block types (no new ones) and grouped viacontainerblocks per the page-builder convention.- Page row — title "For Family and Friends",
is_published=True,is_private=False,template=standard,layout_key=custom. One section (nosec.title— content is grouped via containers per the project's "containers only, never section titles" rule). - Structure — three top-level containers: an intro container (H2 "Is someone you care about suffering from addiction?" + 4 verbatim paragraphs), a mid container (H3 pull-quote heading + 2 verbatim paragraphs), and a Resources container (H2 + 3 paragraphs with bold leads via markdown for CM-Anon / Alanon / Nar-Anon).
- No images — text only, matching the request to skip image import.
Verified:
GET /for-family-and-friendsreturns 200; all three headings render with the expected hierarchy (H2 / H3 / H2) and slug-anchor ids.Added —
/newcomerPage seeded via the content-page builderNew public Page at
/newcomermatching the structure of the original DC CMA newcomer landing page. Built entirely from the existing block library (no new block types) so the admin can refine every section through the standard page editor.- Page row — title "New to CMA?",
is_published=True,is_private=False,bg_image_filenameset to the cloud-splash hero so the page sits over the same atmospheric backdrop as the source. 10 sections: New to CMA? (hero with parachute graphic + Find a Meeting + Helpline CTAs), What is CMA?, Anonymity · Love · Connection (cards-styled list), Am I an addict?, There is a solution, One day at a time, Ninety meetings in ninety days, People places and things, Together we can, and Newcomer Resources (3-column container with the PDF thumbnails). Each section uses some combination ofheading,image,paragraph,list,button, andcontainerblocks. - Assets — 20 SVG / JPG image assets pulled from the source site into
/data/uploadswith UUID-prefixed stored filenames and registered asMediaItemrows (sha256, size, mime). Blocks reference them via the anonymous-readable/pub/<original_filename>route. - Body copy — section headings, button labels, and links match the source page; body paragraphs are seeded with brief original framing copy the admin can replace through the rich-text editor with their preferred wording.
Verified:
GET /newcomerreturns 200 with all 10 sections rendered and every image asset resolving via/pub/<filename>(200 each).Added — Fellowships Index — admin-curated list of sister recovery fellowships, public
/fellowshipspage, searchableNew top-to-bottom feature for surfacing peer recovery fellowships (Crystal Meth Anonymous, AA, NA, In The Rooms, etc.) on the public site. Edited from Settings → Global as a repeatable row table; rendered publicly at
/fellowshipsthrough one of two admin-selectable layouts; auto-included on/siteindexand in the globalCmd/Ctrl+Ksearch.Data model. New
Fellowshiptable —name,is_virtual,country,state_region,url,sort_order, timestamps. Virtual rows are online-only fellowships (no geography); regional rows carry a country + state/province/region.db.create_all()covers fresh installs; existing installs pick the table up on next boot too.app/models.py— newFellowshipmodel alongsideIntergroupOfficer. Ten newSiteSetting.frontend_fellowships_*columns control the public surface: enable toggle, template key, container width / max-width / padding-%, heading + subheading, default sort mode (name-asc/name-desc/country-asc/newest/oldest), and dynbg key + config JSON.app/__init__.py::_migrate_sqlite— ALTER TABLE entries for every newsite_settingcolumn so existing deployments upgrade cleanly. The newfellowshiptable itself rides on the existingdb.create_all()boot step (idempotent CREATE TABLE IF NOT EXISTS).
Admin section (Settings → Global). Repeatable row table mirroring the Intergroup Officers pattern (
app/templates/locations.html). Each row: name (required), a Virtual/Regionalmode-toggleswitch, country, state/province/region, website URL, and a remove button. Toggling Virtual hides the country/region cells via JS and keeps a hiddenfellowship_is_virtualinput in lockstep with the visual checkbox — exactly one value per row, so the server-side parallel-array reconciliation never shifts when virtual/regional rows are mixed.app/templates/locations.html— new section card under Intergroup Officers, with+ Add fellowship/ remove-row JS and the Virtual toggle's visibility sync. Hidden template row stays in the DOM for cloning; server-side blank-name drop guards against the stray empty row.app/routes.py::fellowships_save— POST handler at/tspro/fellowships/save. Reconciles parallel form arrays (fellowship_id/_name/_is_virtual/_country/_state_region/_url), drops blank-name rows, deletes existing ids that aren't in the submission, and wipes country/region on virtual rows so a toggle back to regional starts clean. Gated by the existing_can_edit_locations()permission.app/routes.py::locations— now also loadsFellowshiprows ordered bysort_orderand passes them through to the template.
Frontend templates page. New "Fellowships list (/fellowships)" card on
/tspro/frontend/templates— same chrome as every other list template (Stories, Blog, Archive, Site Index).app/frontend.py— newFELLOWSHIPS_LIST_TEMPLATEScatalog with two entries:sidebar(sticky rail with search + Virtual/Regional toggle + per-country pills + sort selector, default) andcompact(top filter strip over a dense single-column list).app/routes.py—frontend_templatesroute imports the new catalog, passes it + the active key + the per-template settings (template_settings(s, "fellowships_list", key)) into the template;_TEMPLATE_KINDS+catalog_mapinfrontend_template_settings_saveextended so the shared Customize panel (background, fonts, sizes, dynbg) works for fellowships too. New/tspro/frontend/fellowships-list-templatePOST handler persists layout / publish toggle / width mode + max-width + padding-% / heading + subheading / default sort mode / dynbg key + config.app/templates/frontend_templates.html— new card before the templates-page footer with a layout picker (thumb mocks for both variants), the standardtpl_customize_panel, a Page heading fieldset, the standard Container width fieldset, a Default sort fieldset (5 options), a Publish toggle (/fellowships404s when off), and a Preview link that shows up only when published.
Public
/fellowshipspage.@bp.route("/fellowships")inapp/frontend.py, decorated with@public_section("Fellowships", gate=…)so it auto-appears on/siteindexand is searchable, with the samefrontend_fellowships_enabledgate the route enforces.app/frontend.py::fellowships_list— pulls Fellowship rows ordered bysort_order, applies the configured initial sort, buckets by country (Virtual gets its own bucket), builds per-row punctuation-stripped search blobs, resolves the chosen layout partial + dynbg, and renders the dispatcher.app/templates/frontend/fellowships_list.html— dispatcher template. Ships the shared filter + sort engine (search input, country pills, type-toggle checkboxes, sort<select>) as a single inline<script>keyed offdata-fellowships-*attributes, so any new layout that drops the same hooks gets the same UX for free. Keyboard/focuses the search input (matches/archive).app/templates/frontend/fellowships/sidebar.html— default layout. Sidebar rail (header, search, Show: Virtual/Regional checkboxes with counts, Sort dropdown, country-pill list) on the left; main column groups cards under country headings with a chip per row (Virtualchip is green-tinted,Regionalis accent-tinted). Each card carries name, region line, and a "Visit website ↗" link when set.app/templates/frontend/fellowships/compact.html— second layout. Top filter strip (search + chips + sort) over a dense single-column list — one row per fellowship with the region line inline and the website link at the right edge.app/static/css/frontend.css— appended.fe-fellowships-*styles: card recipe with the sametranslateY(-2px)+0 8px 28pxhover lift the rest of the meeting-shaped cards use, chip colours (regional = accent-tint, virtual = green-tint),.fe-mlist-sortstyles for the sort selector, and the compact-list grid. Admin.fellowships-tblrow styles included.
Search index +
/siteindex. Fellowships join every other public content type as a first-class search source.app/search.py— new_fellowships_sourceself-registers at module import; only emits items whenfrontend_fellowships_enabledis on. Each result anchors to/fellowships#fellowship-<id>so opening a result scrolls to the matching card.app/templates/frontend/base.html—KIND_LABELS/KIND_ICON/KIND_ORDERextended with thefellowshipkind (Lucide-style two-figure icon, ordered between Pages and Sections). Modal hint copy updated to mention fellowships./siteindex— already auto-picks the new public page up via the@public_sectionregistry built in the prior/siteindexwork; no template changes needed.
Verified end-to-end on the live container:
/fellowshipsreturns 200 with 7 cards across 5 country buckets (incl. Virtual) after the save-handler test seeded + re-saved data;/api/search-indexnow reports 7fellowship-kind items;/siteindexrenders a "Fellowships" entry in the Sections group when the publish toggle is on; the admin save handler correctly handles mixed virtual/regional rows, drops, renames, and inserts via the parallel-array reconciliation.Added — Auto-discovered top-level sections on
/siteindex(Hyperlist, Archive, Blog filled in)/siteindex's Sections group is now driven by a@public_sectiondecorator on each top-level template route, registered into a_PUBLIC_SECTIONSlist. The previous hardcoded list was missing/hyperlist,/archive, and/blog; with the decorator on every top-level public surface (Home, Meetings, Hyperlist, Events, Archive, Announcements, Stories, Blog, Library, Print list, Submit, Contact) the index now lists all 12 and stays in sync automatically whenever a new top-level page is added.app/frontend.py— newpublic_section(title, gate=...)decorator +_PUBLIC_SECTIONSregistry near the top of the file. Each top-level route carries the decorator under@bp.route, paired with the same feature-flag predicate the route uses for its own 404 (so the index never advertises a page that would 404)._site_index_groups()iterates over the registry instead of two hardcoded lists;url_forfailures are caught quietly so a misregistered endpoint can't 500 the whole page.
Added — Frontend-wide search now covers every public content type
The
Cmd/Ctrl+Ksearch modal previously only indexed meetings + upcoming events. It now indexes the entire public surface — live announcements, archived posts (past events + archived announcements together, the same union /archive renders), recovery stories, blog posts (incl. category + tag names), public libraries + their items, custom Pages (body content walked out ofblocks_json), and every top-level section page from the@public_sectionregistry above. Each result row routes to the correct detail URL (e.g._post_urlflips between/event/<slug>and/archive/<slug>based on archive state).app/search.py— seven new sources self-register at module import:_announcements_source(live announcements),_archive_source(past events + archived announcements),_stories_source,_blog_source,_library_source,_pages_source,_sections_source(reads_PUBLIC_SECTIONS). Each source mirrors the route's own feature-flag gate (posts_enabled/stories_enabled/blog_enabled) so the search results match the visible site. New helpers_text_blob,_strip_html, and_blocks_textbuild punctuation-stripped search blobs from titles / summaries / bodies / blocks JSON consistently across sources.app/templates/frontend/base.html—KIND_LABELSandKIND_ICONextended with friendly labels + Lucide-style SVGs forannouncement,archive,story,blog,library,page, andsection. NewKIND_ORDERmap controls group stacking order in the result list (meetings → events → announcements → archive → stories → blog → library → pages → sections); unknown kinds fall to the end via a fallback rank so a future source without a label entry still renders. Hint copy updated to reflect the broader scope.
Added —
/api/search-indexgzip-compressed when the client accepts itFollow-on to the search-index expansion above: indexing every public surface grew the response from ~22 items to ~400+, pushing the raw payload to ~377 KB. The endpoint now ships gzip when the client's
Accept-Encodingadvertises it. Browsers always do, so the typical wire payload lands at ~88 KB (a 76% reduction). The handler short-circuits to plain JSON when gzip isn't accepted so curl / older clients still work.app/frontend.py::api_search_index— uses stdlibgzip.compresson the JSON body; setsContent-Encoding: gzip,Content-Length, andVary: Accept-Encoding. No new runtime dependency. Compression level 6 (the gzip default — best speed/ratio trade).
Added — Per-item hover tooltips on the utility bar
Every leaf row (link / button / text / icon) in the utility-bar admin editor now carries a new Tooltip input (optional, capped at 200 chars). When set the public renderer stamps it as the rendered element's
title=attribute so visitors see the admin-defined text on hover. For icon-only items the tooltip also takes precedence onaria-label, so screen readers get the richer hover text instead of just the icon name.app/utility_bar.py—_coerce_leafaccepts / strips / length-caps atooltipfield;parse_form_itemslegacy parser pullstooltip[]for symmetry. Round-trips throughparse_items/serialise_itemsbecause both call into_coerce_item.app/templates/_utility_bar_item_row.html— new<label>withdata-utility-field="tooltip"placed under the URL row, gated to the samedata-utility-show-forset so the field hides automatically when the admin flips an item to a singleton kind that doesn't need it.app/templates/_frontend_utility_bar_admin.html—readLeafin the JSON-payload builder reads thetooltipfield via the existingget()helper so the saved JSON carries it through.app/templates/frontend/_utility_bar.html—render_leafmacro emitstitle="<tooltip>"on every leaf kind when set; icon-only items additionally use it as thearia-label(with the existing label/icon-name as fallback).- Singletons (
theme_toggle,search_trigger,gsr_summary) keep their built-intitle=attributes and are intentionally not admin-editable.
Changed — Meeting-card hover signature unified across the public site
Every meeting-shaped card on the public site now lifts the same way on hover so the homepage, the
/meetingslist, the meeting detail grid, the Files & Readings panel, and the extended Files & Readings card all share one motion language. Single recipe applied:transform: translateY(-2px); box-shadow: 0 8px 28px rgba(15, 23, 42, 0.10); transition: 200ms ease (transform + box-shadow + border-color);.fe-meeting-card(homepage Upcoming Meetings tiles) — reference recipe; the rest of the selectors below were tuned to match it..fe-mlist-card(every meeting card on the/meetingsdirectory across sidebar / directory / weekboard / dense layouts) — hover lift bumped fromtranslateY(-1px)+0 6px 18px rgba(15, 23, 42, 0.08)to the shared-2px+0 8px 28px rgba(15, 23, 42, 0.10); transition lengthened from 160 ms → 200 ms. Border-color intentionally stays put on hover so the card doesn't visibly recolour under the cursor..fe-meeting-detail-card(Schedule / Location / Zoom blocks on the Classic meeting detail template) — also flipped to a pure-white light-mode surface (var(--fe-color-surface, #ffffff), wasvar(--fe-panel-soft)) with an accent border at rest (1px solid var(--fe-accent), wasvar(--fe-border)). Redundant hover border-colour swap removed since rest is already accent..fe-meeting-detail-grid > .fe-meeting-resources— the Files & Readings panel that drops into the Classic grid alongside the detail cards now matches their rest + hover recipe so the row reads as true siblings instead of one stylistic outlier..fe-meeting-extended-card— the standalone Files & Readings card every non-Classic meeting template uses. Hover bumped fromtranslateY(-1px)+0 6px 18px rgba(15, 23, 42, 0.08)to the unified-2px+0 8px 28px rgba(15, 23, 42, 0.10); transition lengthened from 160 ms → 200 ms so the lift animates in lock-step with the cards above it.
Dark-mode rules underneath each selector (deep-navy surface, indigo hover border-tint) keep their existing behaviour — only the light-mode appearance and the shared hover transform/shadow were touched.
Added — Container-width admin panel on the Contact Us template
/tspro/frontend/templatesnow ships a "Container width" fieldset inside the Contact (/contact) card with the same boxed/full + max-width + side-padding shape every other list/detail admin surface uses (Events list, Announcements list, Stories list, Blog list, Archive). Boxed caps the contact section at the configured max-width and centers; full-bleed spans the viewport with the configured padding-% asvwgutters.- New
SiteSettingcolumns —contact_form_width_mode(VARCHAR(16) NOT NULL DEFAULT 'boxed'),contact_form_max_width(INTEGER NOT NULL DEFAULT 1160),contact_form_padding_pct(INTEGER NOT NULL DEFAULT 5), with matching_migrate_sqliteentries so existing installs upgrade additively. - Save handler clamps inputs — mode validated against
boxed/full; max-width clamped to 640–2400 px; padding clamped to 0–20 vw. Out-of-range values fall through to the model default rather than blanking the column. frontend/contact.htmlhonors the settings — the outer<section>now carriesfe-mlist--w-<mode>; inner wrapper switches between.fe-container(boxed, inlinemax-width: Npx) and.fe-mlist-fullwrap(full, inlinepadding-left/right: Nvw). Default values (boxed/1160/5) match the legacy layout exactly so existing sites render identically until an admin opens the panel.
Added — 80 / 100 vh floor on every public-detail surface
Every event / announcement / archive detail, meeting detail, story detail, blog detail, and the literature library list now floors at a generous fraction of the viewport less the header stack so short posts don't leave a strip of footer floating mid-page. Shared CSS rule near the top of
frontend.css:/* events: classic / timeline / minimal / poster */ .fe-event-detail, .fe-event-time, .fe-event-min, .fe-event-poster, /* meetings: classic / minimal / card-stack / magazine */ .fe-meeting-detail, .fe-meeting-min, .fe-meeting-stack, .fe-meeting-mag, /* stories: paper / anthology / letter / journal / magazine */ .fe-story-paper, .fe-story-anth, .fe-story-letter, .fe-story-journal, .fe-story-mag, /* blog: all four detail templates share .fe-blog-post as the root */ .fe-blog-post { min-height: calc(80vh - var(--fe-header-full-h, 108px)); }The literature library list (
.fe-mlist.fe-library) floors at the full viewport less the header — it's the canonical public-literature landing surface, so a one-section result still fills the browser. Compound selector beats the generic.fe-mlist { min-height: 50vh }floor lower in the file on specificity (0,2,0 vs 0,1,0) without relying on source order. Header math reads--fe-header-full-h(the full header stack including utility bar + alert band, already maintained by the header chrome) so the calc subtracts the actual visible header — not just the brand row.Added — Web Frontend quick-jump buttons above the sidebar search bar
The admin sidebar now carries two pinned buttons directly above the Search bar so admins can hop into the Web Frontend without scrolling through the nav: Web Frontend (opens the admin panel at
main.frontend_dashboard) and View site (opens the publicfrontend.indexin a new tab). The canonical "Web Frontend" entry under the Admin section of the nav stays put — the quick-jump cluster is in addition to it, not a replacement.- Role-gated with the same condition as the existing Web Frontend nav entry —
site.frontend_module_enabledANDcurrent_user.can_edit_frontend(). Viewers and non-frontend editors don't see the cluster at all. - Live status indicator — a small dot on the Web Frontend button reflects
site.frontend_enabled: green with a gentle 2.4s pulse when the public site is live to anonymous visitors, muted grey when it's in editor-only preview mode. Hover tooltip spells out which state ("Public site is LIVE — visible to everyone" vs. "Public site is OFF — visible only to signed-in admins and frontend editors"). Pulse animation respectsprefers-reduced-motion. - Active-route highlighting — the Web Frontend button picks up a brand-tinted background when the current route is anywhere under
main.frontend_*(same prefix the canonical nav entry's active rule uses). - Two-column grid layout (
grid-template-columns: 1fr 1fr) so the cluster fits the sidebar's width without forcing a wider rail; long labels truncate with ellipsis on narrow viewports.
Fixed —
/tspro/meetings500'd withTypeError: 'function' object is not iterableThe shared
_meeting_modal.htmlpartial (used by both the meetings list and the meeting-edit page) loops{% for lib in all_libraries %}.all_librariesis registered inapp/__init__.pyas a Jinja global pointing at the underlying_all_librariesfunction (not its return value), and the meeting-edit route happens to shadow that global with a real list via render context. The meetings list route never did — so when an admin opened/tspro/meetingsthe loop tried to iterate the bare function and raised a TypeError. Now passesall_libraries=Library.query.order_by(Library.name).all()alongside the existingmeetings/zoom_accounts/locationscontext, matching the pattern the edit route uses.Fixed — Page-builder two-column block now stacks on phones
The page-builder's container block was rendering
style="grid-template-columns: 1fr 1fr; …"(or whatevergrid_columnsthe admin chose) as inline CSS, which beat every class-rule attempt to override it at smaller viewports. The/chatpage in particular surfaced this — two side-by-side blocks squeezed into half-width strips on phones instead of stacking. Both renderers (app/templates/_blocks.html::render_container_blockandapp/templates/frontend/page.html::pp_container_styles— turns out there are two duplicate container renderers, one for admin previews / wiki pages and one for public pages) now emit--block-cont-grid-cols: <value>and--block-cont-flex-dir: <value>custom properties instead of writing the layout properties directly; new CSS rules infrontend.cssconsume the variables withrepeat(2, 1fr)/columnfallbacks and collapse to1fr/columnat the≤720pxmobile breakpoint. Row-direction flex containers stack the same way; column-direction containers andflex-wrap: wrapopt-ins are unaffected.Fixed — Design tokens page color rows overflowing
Each color tile on
/tspro/frontend/designwas packing six elements into a tight flex row ([Override checkbox] [color picker] [🎨 button] [hex caption] [matches-token chip] [↺ reset]) because the site-wide design-token picker (_design_token_picker.html, included once viabase.html) auto-injects three of those elements (🎨 / hex / chip) next to every<input type="color">on every page. On the design tokens page itself the chip was also tautological (matching a "Brand" token to itself) and the elements collectively overflowed the 260px tile minimum.- Suppress shared auto-picker on this page only —
data-no-token-pickerstamped on each color input opts out of the site-wide attachment pass without touching any other page that benefits from it. - Native hex caption added inline after the swatch — reads the picker's current value live via the existing color-input listener, so admins still see the hex string at a glance without opening the colour-picker dialog.
- "Override" label wraps the gating checkbox so the toggle reads as a deliberate control instead of stray decoration.
- Wider tiles + flex-wrap — grid minmax bumped from 260px → 300px; field padding from 12×14 to 14×16; control row carries
flex-wrap: wrapso on a narrow column the reset button drops to the next line gracefully instead of squeezing out. Swatch grew to 48×32 (was 36×28); reset button auto-anchors right viamargin-left: autoso wide rows align consistently regardless of how many controls landed inline.
Fixed — Story detail pages 500'd with
NameError: name 'tpl_dynbg_config' is not definedEvery
/stories/<slug>request was raising aNameErrorbecauseapp/frontend.py:story_detailwas passingtpl_dynbg_config=tpl_dynbg_configintorender_templatewithout ever assigning the variable. The route only builttpl_dynbg_overlay/tpl_dynbg_colorsfrom the decoded_story_cfg; the richer config dict the story templates iterate (paper.html,journal.html,anthology.html,letter.html,magazine.html— every one of them readstpl_dynbg_configin the section's inline style + threads it throughfrontend/_dynbg_apply.html) was never materialised. Now built with the same shapearchive_detailuses: flatSiteSetting.frontend_story_bg_dynbg_config_jsonwins per-dimension (overlay, scope, size, intensity, randomize-colors / randomize-positions, animate), falling through to per-template-settings leaf keys (bg_dynbg_overlay_scope, etc.) for anything not set on the flat picker. So the noise + motion knobs the admin saved actually take effect on the public story render.Added — WordPress importer auto-maps ACF custom fields onto event / announcement columns
The importer now pulls ACF (Advanced Custom Fields) data from every WP REST post and auto-maps recognised field names onto the matching Post columns (event start/end times, location, Google Maps link, event website, Zoom credentials, contact info, summary override). Announcement-targeted and event-targeted imports share the same column set — both lifecycle states live in one
Postmodel and the public/archivemixes them in the same year sections, so a post should pick up every populated ACF field regardless of which side of the toggle it lands on.- ACF capture —
_normalize_rest_postreads theacfkey off the standard/wp/v2/postsREST response (modern ACF ≥5.11 withshow_in_rest=trueon each field group exposes it by default). When the bulk endpoint returns no ACF on any post,_acf_fallback_fetchprobes the legacy/wp-json/acf/v3/posts/<id>namespace once per post (so sites still running the standalone ACF-to-REST plugin work without admin intervention). CSV imports acceptacf_<name>,acf:<name>,meta:<name>columns plus any bare column whose name matches the alias set. - Field aliasing —
ACF_FIELD_ALIASESlists 70+ candidate names per target column sovenue/event_location_name/place_nameall resolve tolocation_name;event_website_url/register_url/rsvp_urlall resolve towebsite_url;zoom_meeting_passcode/zoom_password/meeting_passwordall resolve tozoom_passcode; etc. - Prefix-stripping index —
_build_acf_indexalso stamps every ACF key under its prefix-stripped form (event_,announcement_,evt_,ann_,story_,post_,wp_,field_). So a future site that namespaces every ACF field underevent_*automatically resolves against the plain alias list without code changes —event_contact_namematches thecontact_namealias,event_addressmatchesaddress, etc. - Date + time composition —
_resolve_event_datetimebuilds a realdatetimefrom whatever the site provides: full-datetime alias wins outright when present; otherwise composes adatetimefrom separate date alias + time alias viadatetime.combine. HandlesYYYY-MM-DD HH:MM:SS,YYYYMMDD(legacy ACF save format), Unix timestamps, ISO,M/D/YYYY,B D, Yfor dates;HH:MM:SS,I:M %p,6pmshorthand for times. Date-only with no companion time defaults to midnight so the row still gets a realevent_starts_at. - Boolean coercion —
is_onlineaccepts1/true/yes/online/virtualtruthy strings and0/false/no/in-person/physicalfalsy strings. - Summary override —
announcement_summary/event_summary/summaryACF fields beat the WP-rendered excerpt when present, so the rich admin-authored field is what surfaces on the public site instead of the auto-generated post-content snippet. - Length-capped string columns — each Post column has a max length matching its schema column (
location_name255,zoom_passcode128,contact_name120, etc.) so an oversized ACF value can never blow up the insert. - Dry-run value preview — each event/announcement row on the dry-run page renders an ACF · N fields disclosure under the title; clicking it expands a
column → valuetable showing exactly what will land (event_starts_at: Jan 27, 2026 8:30 PM,zoom_url: https://us02web.zoom.us/j/…, etc.). Datetimes render in friendly format, long strings truncate at 80 chars. The Plan-summary counts card adds a purple "ACF fields" tile ({N} across {M} posts) so the global total is visible at a glance. - Stale-stash banner — wizards opened against a pre-ACF token (post stash where every post has no
acfpayload) now surface a yellow alert on both the Map and Dry-run pages: "Stale wizard — ACF data not captured" with a one-click Reconnect button. Prevents reopening an old wizard URL from silently producing ACF-less imports, which was the original symptom that prompted the auto-mapping work.
Added — Pagination on the public
/archivepage (infinite scroll or numbered pages)The unified archive page now paginates its card list — default is infinite scroll, 20 cards per batch, loading the next batch when the visitor reaches the end. Admins can switch to numbered pagination (with ‹Prev / 1 / 2 / 3 / … / N / Next› controls) or adjust the page size (1–200) from the Templates admin page.
- New
SiteSettingcolumns —frontend_archive_pagination_mode(VARCHAR(16) NOT NULL DEFAULT 'infinite'),frontend_archive_page_size(INTEGER NOT NULL DEFAULT 20), with matching_migrate_sqliteentries. - Client-side pagination — every card renders into the DOM on first load (so the existing search / year / type filters keep working without a round-trip). The shared JS in
archive.htmlslices the filtered set by current page (numbered) or current shown-count (infinite) and toggleshiddenon every card. Year-section headings auto-collapse when no cards from that year remain on the current slice. - Infinite-scroll loader uses
IntersectionObserverwith a 200px-rootMargin so the next batch starts loading just before the visitor scrolls into the sentinel. Newly revealed cards stagger-animate in via the existingis-enteringclass without restaging the already-visible ones. - Numbered paginator renders a compact 1 / current±1 / last window with
…ellipses, hides itself when the filtered set fits on one page, and scrolls the top of the results column into view on each page click. - Filter changes reset paging — pill click, kind-toggle change, and search input all reset to page 1 / 20 shown so a filter never strands the visitor mid-list.
Added — Archive page template picker (Year Sidebar / Timeline / Compact List / Magazine)
/archivenow ships four selectable layouts, picked from a new card in the admin Templates page. The default (Year Sidebar) preserves the existing chrome — sticky left rail with search + type checkboxes + year pills, year-grouped card stack on the right. Three new layouts surface the same data through different visual languages:- Timeline — vertical centerline spine with year markers stamped along it; cards alternate left/right of the spine; compact filter strip at the top instead of a sidebar. Collapses to a single left-aligned column on phones.
- Compact List — dense single-column rows (date block · kind chip · title · summary · arrow). No thumbnails. Top filter strip. Best for fellowships with many archived items.
- Magazine — 3-up grid of editorial tiles with the very first tile spanning two columns as a feature card; cover image + kind chip + date + title + summary per tile; hover lift + cover image scale on hover.
Architecturally
archive.htmlis now a thin dispatcher: it resolves dynbg config, includes the chosen layout partial (frontend/archive/<key>.html), and owns the shared filter + pagination JS at the bottom. Every layout drops the same data-attribute hooks (data-archive-rail,data-archive-results,data-archive-year-section,data-archive-search,data-archive-kind-toggle,data-archive-filter,data-archive-load-sentinel,data-archive-pagination) so the same JS drives every variant. NewARCHIVE_TEMPLATEScatalog inapp/frontend.py; newfrontend_archive_templatecolumn onSiteSetting; per-template appearance overrides ride through the existingfrontend_template_settings_jsonJSON column under thearchivekind (registered in_TEMPLATE_KINDS+catalog_map); per-page dynbg viafrontend_archive_bg_dynamic_key/frontend_archive_bg_dynbg_config_json. Admin picker cards ship pure-CSS layout thumbnails inapp.css(fe-tplgrid-thumb-archive-*).Fixed — Archive page year buckets / sort use
published_at, notcreated_atImported announcements were piling up under the current month because the route was bucketing them by
Post.created_at(the row-insert timestamp). The WP importer correctly stores the original WP publish date inPost.published_at, so the route now prefers that (p.published_at or p.created_at) for both thesort_atand theyearof each announcement entry. Events were already correct (they useevent_starts_at, which the importer sets from the original date). The announcement card's "Posted …" line also now usesPost.display_postedso the per-card date matches the year bucket it lives under.Added — Inline body image cleanup on post / story / blog delete
Deleting a post / story / blog row now retires the inline
<img src="/pub/…">images embedded in the row's body, not just the featured image. WP-imported posts often carry several inline screenshots / photos; previously those copies stayed on disk + in theMediaItemcatalog as orphans after the parent row was deleted._extract_body_pub_originals(html)regex helper pulls every/pub/<filename>token out of a body HTML chunk (covers<img src>,srcset,<a href>, plain-text URLs)._collect_body_inline_stored(html)resolves those original filenames to currentMediaItem.stored_filenamevalues (de-duped) so callers pipe each through the existing_cleanup_retired_assethelper._cleanup_retired_assetreference-count extended — the helper now also LIKE-scansPost.body,Story.body, andBlogPost.bodyfor the file's/pub/<original_filename>token. So if you delete post A but post B's body still embeds the same inline image, the helper sees B's reference and keeps the file. Symmetric with the existing column-reference checks (featured_image_filename, MeetingFile, LibraryItem, etc.).- Wired into every delete path —
post_delete(single announcement/event),post_bulkdelete branch,story_delete,blog_delete,blog_bulkdelete branch. Order in each path: snapshot the body's inline stored filenames BEFORE the row is deleted (need the body text intact to scan), commit the delete, then run cleanup on each captured filename after commit (so the helper's body scan no longer sees the dying row's own body).
Changed — Admin Templates section heading renamed to "Announcements / Events / Archive detail"
The detail-template card on
/tspro/frontend/templatesnow reads Announcements / Events / Archive detail with the blurb mentioning/archive/<slug>so admins know the same template drives archived-post detail pages too — not just the live/event/<slug>and/announcement/<slug>URLs.Added — Site-wide design-palette colour picker with hex caption + token chip on every colour input
Every
<input type="color">across the admin now sits next to a one-click 🎨 button that opens the same design-palette popover the content-page editor uses. The popover is rendered once inbase.html(via the new_design_token_picker.htmlpartial) and auto-attaches a picker, a live hex caption, and a token-match chip to every colour input on the page.- Shared partial at
app/templates/_design_token_picker.htmlrenders the popover DOM, populateswindow.tspDesignColorTokens(key → hex) plus a newwindow.tspDesignColorTokenLabels(key → display name), and ships its own self-contained<script>/<style>so it's drop-in safe. - Auto-attach scan wires every
<input type="color">on the page with three siblings: the 🎨 button, a monospace hex caption (e.g.#1f4e79) that updates live oninput/change, and a "Token:" chip that lights up the moment the input's value matches a palette colour. Selecting a token from the popover writes the resolved hex into the input and dispatches input/changeso any live-preview JS picks up the change. - Skip rules prevent double-wiring where richer token-aware controls already exist: inputs marked
data-no-token-picker, wrappers carryingdata-token-pair(content-page editor), and block-editor.be-color-clusterelements all keep their existing pickers. - Token-aware text fields that store
token:<key>get a stronger ◈ Bound:chip with a separate tooltip explaining that palette edits propagate live. The passive ◈ chip on plain hex inputs uses a clear tooltip so admins know the value is a frozen snapshot of the palette, not a live binding. - MutationObserver rescans dynamically-injected colour inputs (modal content, lazy form sections) so the homepage hero modal, footer modal, and other on-demand surfaces pick up the picker without per-screen wiring.
Added — Homepage hero subheading typography (font, size, colour) with mobile-aware scaling
The hero edit modal split the typography section into two side-by-side groups, Heading and Subheading, each with its own font (Fraunces serif / Inter sans), size (50–200% slider with live readout), and colour (gradient pair for the heading, single colour for the subheading). The subheading colour and font are independent of the heading so admins can mix-and-match without one overriding the other.
- New
SiteSettingcolumns —frontend_hero_subheading_font(VARCHAR(32) NOT NULL DEFAULT 'inter'),frontend_hero_subheading_size(INTEGER NOT NULL DEFAULT 100),frontend_hero_subheading_color(VARCHAR(16)), with matching_migrate_sqliteentries so existing installs upgrade additively. Defaults preserve the legacy look exactly. - Modal layout uses CSS grid with
repeat(auto-fit, minmax(min(100%, 320px), 1fr))so the two groups sit side-by-side on desktop and stack to a single column on phones without any per-element media queries. Font-family pillgroups wrap to one pill per line at ≤540px viewport. - Mobile scaling — both
.fe-hero-headingand.fe-hero-subnow multiply aclamp(min, fluid, max)baseline by the admin's unitless--fe-hero-h-size/--fe-hero-sub-sizefactor. The same 150% setting reads as a smaller absolute size on phones and a larger one on desktops, so admins get sensible scaling on every device. - Live preview at the top of the modal reflects font / size / colour edits in real time — font class swap, CSS variable updates, and reset-checkbox handling all wired through
input/changelisteners. - Save endpoint clamps size to 50–200%, sanitises the colour via the existing
_sanitize_icon_color, and honours a "Reset subheading colour to default" checkbox.
Added — Lightbox-compatible images in blog detail templates
Every
<img>in the four blog detail templates (Modern / Longform / Classic / Cover) is now zoomable — clicking opens a self-contained, dependency-free lightbox modal. Featured images and inline body images both work.- New shared partial at
app/templates/frontend/_lightbox.htmlships the modal markup, CSS, and JS in one drop-in{% include %}. Auto-discovers every<img>inside adata-lightbox-scopecontainer. - Click to open with fade-in transition; multiple images get prev/next arrows; arrow-key + Escape navigation; click backdrop or × to close. Body scroll locked while open. Honours
prefers-reduced-motion. - Caption auto-fills from
alttext when present. data-lightbox-srclets a thumbnail show small but expand to a full-resolution original — used on featured images so the hero shows a?thumb=thumb but the lightbox renders the unscaledblog_post_featured_image.- Smart skip — images wrapped in
<a>are intentionally excluded so card thumbnails still navigate. Per-imagedata-lightbox-skipopts out individually. - Wired into all four blog detail templates: Modern, Longform, Classic on hero + body images; Cover on body images only (the hero is a CSS background with the title overlaid, which would conflict with the title link area). Inline body images use whatever
srcthey were imported with, which after the WP importer's image rewriter is the local/pub/<filename>path.
Removed — Summary rendering from blog detail templates
The post summary is no longer rendered as a deck/lede on the Blog Modern / Longform / Classic / Cover detail templates. The summary still appears in list cards and link previews — only the detail page no longer shows it. Existing CSS rules for the now-unused
.fe-blog-*-deckclasses are retained as dead code; trivial to clean up later.Added — WordPress importer rewrites inline body images to local copies
The importer now walks every
<img>in the post body's HTML and downloads each uniquesrc/srcsetURL via the same image-download path the featured image uses, then rewrites the attribute values to point at/pub/<filename>so imported posts no longer depend on the source WordPress site staying online.- Sha256 content-hash dedupe — re-importing the same image across many posts only stores one copy on disk (mirrors the featured-image behaviour).
srcsetresponsive variants get rewritten in place with size descriptors (300w,2x, etc.) preserved.- Skip for
data:,blob:,javascript:,#, and already-local/pub/…URLs. - Per-batch URL cache so two posts referencing the same image only hit the network once.
- Failures are non-fatal — original URL stays put (broken image vs. lost reference) and a per-row warning is surfaced so admins can chase 404s.
- Wizard counts — new "Inline images" tile (cyan) on the dry-run preview and Done page, plus an "Inline failed" tile if any downloads errored. The dry-run heuristic walks
src+srcsetthe same way the commit phase does so the totals match. - Applies to all four import targets — Stories, Announcements, Events, and Blog.
image_cbcontract refactor —_download_image_full(url)now returns(stored_filename, original_filename)so the inline rewriter can build public URLs while the featured-image path keeps using the stored filename.download_image_to_uploadsis preserved as a single-string shim for the legacy callsite.
Added — Bulk action toolbar in the Blog admin list
Per-row checkboxes + select-all on
/tspro/blogwith a sticky bulk action bar that surfaces only when something's checked. Status flips (Archive / Restore / Move to drafts / Publish / Feature / Unfeature / Pin / Unpin), per-category and per-tag bulk operations, and a delete action all routed through a single/tspro/blog/bulkendpoint.- Category ops — pick a category from a dropdown, then
+ Cat(add to existing),− Cat(remove that one), or↦ Cat(replace all categories with the picked one, with a destructive-action confirm). - Tag ops — same pattern:
+ Tag/− Tagafter picking from a tag dropdown. - Bulk form layered correctly — the bulk form lives standalone with the checkboxes wired via
form="blog-bulk-form"so per-row action<form>s can stay inline without HTML's nesting prohibition. - Stale ids silently skipped — if someone deletes a post in another tab, the rest of the batch still applies.
- ActivityLog entry per batch (
blog.bulk_<action>).
Added — Per-post archive override on WordPress import dry-run + bulk select-all
The WP importer no longer auto-archives by status — admins now flag each post for archiving directly on the dry-run preview screen via a checkbox in a new rightmost "Archive" column. Three bulk buttons in the section header:
- All — flip every visible row's checkbox on.
- None — clear all.
- From WP status — only flag rows whose original WP status was
trashor containedarchive(preserves the auto-detection behaviour as an opt-in shortcut).
A live counter under the IMPORT prompt shows "N posts will land in the Archived tab" so the admin knows what's about to happen before typing IMPORT. Selections survive a failed POST (e.g. forgot to type IMPORT) because they're persisted to the stash on submit and re-applied on re-render.
- Auto-classifier simplified —
_classify_wp_statusnow only returnsis_draft(fordraft/private/pending); archived state is purely admin-driven via the dry-run checkboxes. apply_planacceptsarchive_keys— a set of post keys to flag as archived. Threaded through all three target types (Story / BlogPost / Post).- Bug fix — preview rows now carry the post
key, so the form submission can correctly map archive checkboxes back to their source posts. Previously the missing key meant every archive checkbox submitted asname="archive:"(empty key) and the route couldn't match anything, causing an entire 300-post import to land active. - Dark-mode fix — the WP import wizard templates (
wp_import_map.html,wp_import_dry_run.html,wp_import_done.html) were usingvar(--surface, …)/var(--surface-alt, …)/var(--text-soft, …)token names that don't exist in this app's theme system, so the light fallback hex/rgba values leaked through in dark mode. Mapped to the real tokens (--panel,--panel-2,--muted) so post rows, category cards, filter bar, target pillgroup, post thumbnail, slug code, summary text, skipped-list, and the dry-run / done count cards all flip with the theme.
Added — WordPress importer Blog target + category + tag preservation
The WP importer now supports the new Blog module as an import target alongside Stories / Announcements / Events. WordPress categories and tags carry over: matching ones (by slug first, case-insensitive name fallback) are reused; net-new rows are created on commit.
- REST fetcher harvests
/wp/v2/categorieswith{name, slug, description}and a parallel/wp/v2/tagscall (non-fatal if the site has tags disabled). Authenticated status list now includestrashwith a fallback retry without it for older / hardened installs that reject the value. - CSV parser separately recognises a
Tagscolumn when present; legacy "Tags as Categories" fallback preserved for old CSVs that store everything in one column. apply_planroutes WP categories →BlogCategoryand WP tags →BlogTagvia slug-first / case-insensitive-name fallback matching. Net-new rows added with auto-disambiguated slugs.- Counts include
blog,blog_categories_created,blog_tags_created,blog_categories_matched,blog_tags_matched. - Wizard UI — Blog target pill (rose palette) on the map page hidden when the module is off (with an in-page hint pointing to Settings → Modules). Tag chips alongside category chips on each post row. Dry-run preview gets a "Categories & tags" column and a summary block (matched vs would-create). Done page gets a Blog count card linking to
/tspro/blog, post-import created summary with deeplinks to the manage pages, and Edit → links for blog rows. - WP date preservation — REST grabs the full ISO datetime (
date/date_gmt). CSV preserves time when the Date column carries it. The full timestamp parses intopublished_aton every imported row (Story, BlogPost, Post), so a 2018 WP post lands showing "Mar 15, 2018, 2:30 PM" in the admin list instead of being stamped with today's date.
Added — Blog module: long-form editorial posts with categories + tags + multiple frontend layouts
Full new module sitting alongside Stories and Announcements & Events. The same data table serves many distinct frontend "blogs" by filtering each page-block embed on a category or tag, so a fellowship can host one blog per committee or group without parallel tables.
- Models —
BlogPost(title, slug, summary, body, featured_image, author byline,published_at,is_featured/is_pinned/is_draft/is_archived,allow_comments,reading_minutes),BlogCategory(name, slug, colour, position, description),BlogTag(name, slug), plus M2Mblog_post_categories/blog_post_tags. - Migration — all new
SiteSettingcolumns (blog_enabled,blog_required_role, list/post template keys, width/padding, dynbg config) added to_migrate_sqliteso existing DBs upgrade cleanly. - Module gating —
blog_enabledtoggle +blog_required_roledropdown in Settings → Modules (mirrors Stories). Sidebar entry shows when enabled and role passes;_require_blog_enabled()gates every admin route. - Backend — CRUD for posts (filter by category/tag/status/search, sort by published/title/updated/author), categories, tags, plus duplicate / publish / unpublish / archive / unarchive / delete. Auto-create new tags inline from the post editor.
/blog-image/<id>public endpoint with thumb support. - Admin templates —
blog_list.htmlwith filter rail,blog_edit.htmlwith category pill checkboxes + tag multi-select + free-text auto-create + featured image + author + publish date + reading time + pin/feature/comments toggles,blog_categories.htmlwith inline edit form + colour picker,blog_tags.htmlwith tag cloud + inline edit. - Frontend —
/blogand/blog/<slug>plus pretty-URL aliases/blog/category/<slug>and/blog/tag/<slug>. Slug history honoured for redirects. - Six list layouts — Magazine (default, hero + grid), Cards (uniform 3-up), Gazette (newspaper broadsheet), Minimal (image-light single column), Mosaic (masonry CSS columns), Sidebar (main column + sticky filter rail).
- Four detail layouts — Modern (default), Longform (Medium-style with drop-cap), Classic (sidebar + related), Cover (full-bleed parallax hero).
- Page block
blog_list— scopes by category OR tag, three styles (cards / list / headlines), per-block knobs for columns, sort, max items, only-featured/pinned, and which metadata to surface. - Templates admin — new Blog list and Blog detail picker sections appear when the module is enabled, with width/heading controls and the same per-template Customize panel as the other modules.
Added — Posted-on timestamp field across Posts / Blog / Stories with sort + WP date preservation
Every admin list page that surfaces posts now shows a "Posted" column with the editable timestamp, and clicking the column header sorts by it. WordPress imports preserve the original publish date.
- Models —
PostandStorygainedpublished_atDateTime columns (BlogPost already had one). All three carry adisplay_postedproperty that falls back tocreated_atfor legacy rows so nothing renders blank. - Edit forms —
post_edit.htmlandstory_edit.htmlgot a "Posted on"datetime-localfield. Empty input keeps the existing value; new posts default tonow()if blank.blog_edit.htmlalready had its "Publish date" field. - Admin lists — Announcements/Events, Stories, and Blog all now show date + time in a sortable "Posted" column. Sort options include
posted_asc/posted_descand (for Stories) Title / Author / Story date / Posted. - WP importer — REST grabs the full ISO datetime from
date/date_gmt; CSV preserves time when the Date column carries it. The full timestamp parses intopublished_aton every imported row.
Added — Bulk action toolbar + sorting + pagination on Announcements & Events admin
Per-row checkboxes + select-all on
/tspro/announcementseventswith a sticky bulk action bar (Archive / Restore / Move to drafts / Publish / Delete — buttons hide when they wouldn't make sense for the current tab). Selected rows pick up a brand-tinted background. Single POST to/announcementsevents/bulkdoes the work; stale ids skipped silently.- Sortable column headers — Title, Type, When (or Submitted on the pending tab), Posted, Edited. First click sets the default direction; second click flips it. Active column shows an arrow. Sort survives across pagination and tab changes.
- Hard cap at 100 per page with Prev / Next bookends, "Page N of M · 100 per page" footer, and "Showing 1–100 of N · sorted by …" toolbar caption.
Added — Blog module page block for embedding filtered post lists
New
blog_listblock type for custom Pages. Scopes by category OR tag, picks a display style (cards / list / headlines), and surfaces presentation knobs (columns 1–4, gap, max items, sort, only-featured/pinned, per-item display: image / summary / categories / date).- Block editor JS registers
blog_listin the type catalog with sensible defaults. - Block renderer at
app/templates/_blocks.htmlwalks the block data, queries viablog_block_dataJinja global, and renders the chosen style. - Server-side data helper (
blog_block_data(category_id, tag_id, sort, max_items, only_featured, only_pinned)) handles filtering / sorting / capping; mirroredall_blog_categories/all_blog_tagshelpers expose the taxonomy lists to the block-editor picker dropdowns. - "View all → " link auto-appends to each block, pointing at the matching category / tag landing page when scoped, or the main
/blogindex otherwise.
Added — Hero block vertical-height (vh) controls for desktop + mobile, header-aware
The hero block on the homepage gained two new sliders in its edit modal — Desktop height and Mobile height, both 0–200 vh in steps of 5 — alongside a live readout that displays "Auto" at 0 and
<n>vhotherwise. The sticky header is automatically subtracted from the calc so a100 vhsetting fills exactly the visible viewport below the header instead of overshooting by a header's worth and forcing visitors to scroll to clear the hero.- New
SiteSettingcolumns —frontend_hero_height_vh_desktopandfrontend_hero_height_vh_mobile(INTEGER NOT NULL DEFAULT 0) with matching_migrate_sqliteentries so existing installs upgrade additively.0= "auto" (the existing padding-derived height), keeping every untouched install rendering byte-for-byte the same. - Save route —
frontend_hero_saveclamps both values to0–200 vhvia_clamp_int. - CSS —
.fe-heronow readsmin-height: var(--fe-hero-min-h, auto), plusdisplay: flex; flex-direction: column; justify-content: centerso content sits in the middle when the section stretches. The mobile breakpoint reads--fe-hero-min-h-mobile, falling back to the desktop var, then to auto. - Header-subtraction calc — the hero template emits
min-height: max(0px, calc(<N>vh - var(--fe-header-full-h, <configured-header-h>px))).--fe-header-full-his already measured live infrontend/base.html(resize + scroll observer) and reflects the full sticky stack (utility bar + alert bar + header). The fallback uses the server-rendered header-height SiteSetting so the hero doesn't render too tall on first paint before JS measures the live value.max(0px, …)floors small admin values on tall-headered installs so the calc never goes negative. - Inline emission only when non-zero — the template only writes the CSS custom properties when the admin has dialled a non-zero value, so installs that never visit the field stay on the original padding-based layout with zero diff.
Added — Sticky title bar + close button inside every page-edit modal
Every block editor on the homepage admin (Hero + the eleven block-editor modals) now keeps its title strip and the X close button visibly anchored to the top of the modal panel as the form scrolls.
.fe-page-edit-modal-panelis nowdisplay: flex; flex-direction: columnso the close button canalign-selfto the right edge as a sticky child without restructuring existing markup..fe-page-edit-modal-panel > .card > .card-headbecomesposition: sticky; top: 0with full-width bleed (margin: 0 -2rem) so the title strip stays anchored to the panel's visible top..fe-page-edit-modal-closeswitched fromposition: absolute→position: sticky; top: 12px, withmargin-bottom: -44pxso the button doesn't reserve a 44px empty strip above the title.z-index: 6keeps it layered above the sticky head (z-index: 4).
Changed — Save bar opts-in to modal forms + layers above modal backdrop + keeps modal open on save
The yellow save bar at the bottom-left of the Web Frontend admin now works for the homepage hero modal (and any other modal that opts in), surfaces above any open modal's backdrop blur instead of behind it, and no longer reloads the page when the dirty form lives inside a modal so the visitor isn't kicked back to the page each time they save.
- Modal-form opt-in —
feSaveBar'strackable()previously rejected any form inside a.modaloutright. New rule: modal forms are opt-in viadata-fe-savebar. The hero form (<form id="hero-save-form">) carries the attribute so the bar tracks its dirty state. Other modals across the admin (footer editors, user edit, settings, etc.) keep their existing skip behaviour because they don't carry the attribute. - Save bar moved out of
.fe-subnav—.fe-subnavisposition: stickywhich (per CSS spec) creates its own stacking context, trapping the save bar'sz-index: 110inside the parent's local stack. Since.modalhas explicitz-index: 100at root level, it always painted above the auto-z-indexed subnav's children. The save bar is now a sibling of the subnav (still inside.fe-admin-layout) so itsz-index: 110competes directly with the modal's100at the root stacking context, lifting the bar above the backdrop'sbackdrop-filter: blur(6px)so it stays sharp AND clickable while a modal is on focus. - Save bar z-index bumped 50 → 110 — high enough to clear modals (
z-index: 100). - No reload on modal save — the save handler branches on whether every dirty form lives inside a
.modal. If yes, the bar animates out, resets its label/button, and clears the dirty set without reloading; the modal stays in front and the visitor can keep editing. Subsequent field changes immediately re-arm the bar. Non-modal forms still reload (server-normalised values like clamps / sanitisation flow back into rendered fields, which the modal-stay path skips because the user can see their typed value already).
Changed — Header utility bar item + container icon picker uses the shared icon-modal chooser
The leaf-row "Icon"
<select>and the container "Collapsed icon"<select>on the Web Frontend → Header → Utility bar admin both became chooser buttons that open the same icon-picker modal the nav mega-menu and homepage feature-card editors already use. The legacy 24-icon whitelist (utility_bar_icon_choices) is no longer referenced — admins now have the full Lucide catalog plus their own Custom uploads available.- Saver contract preserved — the hidden inputs still carry
data-utility-field="icon"anddata-utility-field="collapsed_icon"so the existing JSON payload shape is unchanged. No saver, validator, or public-renderer changes were needed; the public renderer'sicon()helper already handles both Lucide names andcustom:NNrefs. - Picker generalised for unstable IDs — utility-bar rows are cloned at runtime from a
<template>so each row can't carry stable global IDs.openPickernow falls back to[data-icon-input]inside the[data-icon-field]wrapper whendata-icon-targetis absent. The clear handler uses the same fallback. This unblocks any future call site that wants the picker without minting per-instance IDs. - Icon-picker modal include — added to
frontend_header.html(it wasn't loaded on this page before), wiring the same Lucide catalog / custom-icon list / upload / delete URLs as the homepage and templates pages. - CSS — new
.utility-bar-icon-fieldrules wrap the trigger button + clear chip into the row's grid column, withhas-icontoggling preview / placeholder / clear visibility consistently with the existing.nav-megalink-icon-fieldpattern.
Added — 50vh floor + sidebar-style filter animation on every list page
The literature-library, meetings, events, announcements, and unified archive pages all now floor at
min-height: 50vhso a sparsely-populated list still gives visitors a page-shaped surface instead of collapsing to a thin strip beneath the header. Beyond that, the smooth slide-in entrance animation that fires when the meetings-list rail filter changes is now consistent across every list page so filter clicks read as transitions, not jumps.- Min-height — single CSS rule covering
.fe-mlist(meetings + library + archive),.fe-events-list-omni/cards/calendar/timeline/magazine, and.fe-announcements-list. - Animation extended — the existing
.fe-mlist-card.is-enteringkeyframe / cubic-bezier was generalised to also cover.fe-library-item,.fe-events-archive-card-wrap,.fe-events-card, and.fe-announcements-card, with a matching reduced-motion override. - Library (
literature_library.html) —applyFiltergained ananimatearg; pill clicks fire the animation, pure search keystrokes skip it (typing doesn't restage the list every character). - Archive (
archive.html) — sameanimatearg pattern; year-pill clicks AND Events/Announcements checkbox toggles fire the animation. - Events omni (
events_list/omni.html) — tab switches between Overview / Cards / Calendar / Timeline animate the cards in the new panel. Initial localStorage restore is silent. - Announcements omni (
announcements_list/omni.html) — same treatment for Cards ↔ GSR Summary tab switches; initial hash + localStorage restore is silent.
Changed — Frontend export bundle covers pages, officers, stories, posts, slug history (format v3)
/tspro/settings/frontend-exportis now content-complete for everything 1.8.x has added to the public-frontend authoring surface. Bundles bumped toformat_version: 3and round-trip cleanly through the matching/tspro/settings/frontend-importingest path.- Settings prefix selector broadened —
submission_form_*andcontact_form_*columns now ride with the bundle (Forms admin copy / toggles / success messages). Recipient*_tocolumns are explicitly excluded as deployment routing — shipping them would silently re-route mail to the source's recipients on the destination. - Pages — every
Pagerow exports withblocks_json,layout_key, full background config (colour with light/dark/auto modes, image + tile / cover + scale, dynbg key + config JSON), width formatting (width_mode/max_width/full_padding_pct), and per-page hero typography overrides (heading_color/heading_align/heading_font/subheading_*). Import replaces by slug so an existing page on the destination is overwritten rather than duplicated. - IntergroupOfficer roster — replaces wholesale on import with source ids preserved, so the
intergroup_memberandofficer_rosterpage blocks (which storeofficer_idverbatim) keep working after the round-trip. - Stories —
Storyrows including drafts and archives ride along. Author byline, sobriety / story dates, summary, body, featured image, and theis_featuredflag are all carried. - Posts — events + announcements, drafts + archives included. Pending submissions (
is_pending_review=True) are skipped — the holding tank is per-deployment workflow state, not content. Source ids are preserved so the matching slug-history rows still resolve to the right entity. - Slug history —
EntitySlugHistoryrows forentity_type='post'ride along so renamed posts keep their 301-redirects on the destination. Meeting slug history stays out of the frontend bundle (meetings live in the broader content scope this export deliberately avoids). - Asset collection extended — page
bg_image_filename+ dynbg config JSON, story / post featured images, and embedded references inside pageblocks_jsonand story / post markdown bodies are all scanned and bundled intoassets/.
The whole-site export (
/tspro/settings/export, the SQLiteVACUUM INTO+uploads/+zoom.keyarchive) was already complete by definition — every new table since 1.8.6 is captured automatically — so no code change there, just verified the export still produces a healthy archive against the live data.Added — Library import wizard for bulk multi-file uploads
The library detail page gained an Import Multiple button (next to + Add File in both the page header and the Files card foot) that opens a staging modal accepting any number of files at once. Drop them onto the dashed drop-zone or pick them via the inline label-wrapped picker; each file lands in a row with an editable title input pre-filled by the wizard's filename-to-title heuristic, the filetype badge, the original filename, and a per-row remove button. The footer shows a live "N files ready to import" count and keeps the Import button disabled until at least one file is staged. New backend route
POST /libraries/<slug>/readings/import(main.library_import) consumes parallelfiles/titlesarrays plus optionalcategory_ids, creates oneLibraryItemper file via_save_upload(so sha256 dedup applies — re-uploading identical bytes reuses the existingMediaItemrow), and re-checks the Intergroupcategories_requiredgate so a tampered POST can't bypass it.- Title derivation —
_derive_title_from_filename(Python) and the matching JS helper both strip the extension, replace_-.with spaces, split camelCase boundaries, collapse whitespace, and Title Case. Examples:meeting_minutes_2024.pdf→ "Meeting Minutes 2024",BigBook_PersonalStories.pdf→ "Big Book Personal Stories",step-12-essay.pdf→ "Step 12 Essay". Empty filenames fall back to "Untitled". Server-side derivation is the fallback for any row whose title input was left blank. - Title row is nameless in the DOM — only the live file input is
name="files"; per-row title<input type="text">carries no name. On submit, the JS strips any priordata-import-title-hiddencarriers and appends fresh hidden<input name="titles">elements in the same order aspicker.files, so Flask'srequest.files.getlist("files")andrequest.form.getlist("titles")line up index-for-index. - DataTransfer-based file list —
picker.filesis the live source of truth for what gets submitted; the wizard mirrors itsstaged[]JS state onto the input via a freshDataTransferon every add/remove so users can drop a batch, remove a wrong pick, drop more, and submit cleanly. - Soft de-dup — same filename + size in the same wizard session is silently skipped client-side (defensive against double-clicking the picker); content-level dedup happens server-side via the existing sha256 check in
_save_upload. - Modal-close reset — closing the modal (× button, backdrop click, Cancel) clears the staged list so the next open starts fresh; without this the next session would replay stale
Filehandles whose underlying disk content might have changed.
Added — Library page block: max items + Load More + sort
The Library block gained two new controls in its settings panel: a Sort items by dropdown (Custom order · Name A→Z · Name Z→A · Date added newest · Date added oldest) and a Max items number input. When
max_items > 0and the rendered count exceeds it, the renderer marks excess items withblock-library-hiddenand emits a centered pill-shaped Load more (N more) button below the items. Clicking it reveals the next batch (data-lib-block-stepitems, defaulting tomax_items), updates the inline "(N more)" count, and removes itself once nothing's left to show. A single delegated click handler binds once per page (window-flag guard, IIFE) so multiple library blocks on the same page coexist without double-binding.- Sort plumbed through
library_block_data— accepts a fourthsortargument applied AFTER the granular hand-pick filter so curated subsets honour the chosen order. Recognised values:manual(default — library position then id),name-asc,name-desc,date-desc(newest first),date-asc. Unknown values fall back to manual. - Renderer integration — all three styles (bulleted / list / cards) use Jinja's
loop.index0 >= _max_itemsto mark hidden items. The wrapper carriesdata-lib-block-maxanddata-lib-block-stepso the Load More handler knows the page step. CSS rule.block-library .block-library-hidden { display: none !important }beats the inline grid/flex declarations the wrapper rules emit. - Editor defaults preserved —
sort: 'manual'andmax_items: 0are set as defaults, so existing library blocks keep their original look until an admin opts into a different sort or sets a non-zero max. - Mobile-aware Load More — the button styling uses
color-mix(in srgb, var(--brand) 10%, var(--panel-2))for the hover tint and rides design-token brand colours so it inherits the active theme. The:activestate translates 1px down for tactile feedback.
Added — Add to Calendar (.ics) downloads on meetings + events
Visitors can now save any meeting or event to their personal calendar with one click. New endpoints
GET /meetings/<slug>/calendar.icsandGET /event/<slug>/calendar.icsemit RFC-5545 VCALENDAR payloads with proper line-folding (75-octet wrap), text escaping (\,,\;,\\,\n), andContent-Disposition: attachment; filename="<slug>.ics"so the file saves rather than opens in the browser.- Meetings — one weekly-recurring
VEVENTperMeetingSchedulerow, joined byRRULE:FREQ=WEEKLY;BYDAY=<MO|TU|WE|TH|FR|SA|SU>.DTSTART/DTENDare computed from the next occurrence of the schedule's day + start time in the site's configured timezone, then converted to UTC for the serialised value. UID is stable per(meeting_id, schedule_id)so each weekly slot is its own calendar entry.SUMMARY/DESCRIPTION/LOCATIONcarry the meeting name, full body + Zoom join link / ID / passcode + canonical "Details:" URL, and a resolved address (matched through theLocationtable when available, falling back to raw text orZoom · <link>for online-only). - Events — single
VEVENT(noRRULE) sourced fromevent_starts_at/event_ends_at. Stored datetimes are tz-naive but represent the site's local wall clock; the helper anchors them to the site timezone before UTC conversion so the wall-clock the admin typed survives DST shifts. Defaults to a 1-hour duration whenevent_ends_atis blank. - Buttons live under the schedule / When block in every detail layout: meetings use
classic.html/magazine.html/card_stack.html/minimal.html; events useclassic.html/minimal.html/poster.html/timeline.html. The meetings list card (_meeting_card.html) gained a third pill alongside Join Zoom / Get Directions in both the 3-column day-grouped mode and the default directory/weekboard mode. Each link uses Lucide'scalendar-checkicon and the HTML5downloadattribute so the file lands as<slug>.icsinstead of opening in-browser. - New module
app/calendar_export.pyexposesmeeting_to_ics(meeting, site, base_url)andevent_to_ics(event, site, base_url). Both go through helpers_escape,_fold,_fmt_utc,_next_occurrenceso future calendar exports (announcement series, classes, etc.) can reuse the same primitives. Cache-Control: no-storeon both endpoints so an admin schedule edit propagates to the next download immediately.
Added — Library page block
New Library block in the floating palette renders any Library's items in three configurable styles: Bulleted (UL with markers, title-only), Plain list (bordered card with hairline-separated rows; title + description excerpt + category chips), Cards (CSS Grid with rounded-corner cards, hover lift, optional 16:9 thumbnail strip, title + body excerpt + category chips). Cards mode adds column-count toggle (1/2/3) and gap input.
The block stores
library_id,mode('all'|'granular'),item_ids[],style,columns,gap, plus three field toggles (show_description,show_thumbnails,show_categories) and an optionaltitleheading. Newlibrary_block_data(library_id, mode, item_ids)Jinja global resolves to(library, filtered_items)at request time so admin edits to the library propagate to every page using it without re-saving. Granular mode exposes a checklist of every item in the chosen library with Select all / Clear quick actions; switching libraries invalidates the previous picks. Items withstored_filenamelink viapublic.public_file, items withurllink externally, body-only items render as plain text.window.tspLibrariesinjected on the page-edit screen drives the editor's picker without an AJAX round-trip.Mobile breakpoint at 720 px collapses the cards grid to a single column regardless of admin's chosen count.
Added — Intergroup Officer roster + page blocks
New Settings → Global → Intergroup Officers section (the "Meeting Locations" tab was renamed Global since it's now the catch-all for site-wide rosters and singletons) hosts a repeatable contact table with position / name / phone / email columns. Add/remove rows inline, save persists; blank rows are silently dropped. Storage lives on a new
IntergroupOfficermodel (separate from the legacyIntergroupAccountwhich holds IMAP credentials, so officer roster edits don't churn email-server config).Two new page blocks consume the roster:
- Intergroup Member — references one officer row by id and renders their contact card (position chip + name + phone link + email link) with four
show_*toggles to gate which fields display. Editor dropdown lists every officer by their position name first, with the personal name in parens for context. Live preview card mirrors the public render. Renderer looks the row up at request time so officer edits propagate without re-saving consuming pages. - Officer Roster — loops every officer into a configurable card grid. 2 or 3 column toggle, configurable gap, same four field toggles applied uniformly. Each card has shadow + rounded corners + hover lift. Mobile collapses to single column.
intergroup_officers()andintergroup_officer(id)Jinja globals expose the roster to templates;window.tspIntergroupOfficerscarries the same data into the page editor for instant dropdown / live-preview without AJAX.Added — Lottie animation page block with hover playback
New Lottie block in the floating palette embeds Bodymovin / Lottie JSON animations. Vendored
[email protected]lives atapp/static/vendor/lottie/lottie.min.js(300 KB, self-hosted, no CDN dependency). The block storessrc(URL or/pub/<filename>path),loop,autoplay,speed(0.25–3×),max_width_pct,align,bg_color,renderer(svg|canvas), andplayback(auto|hover).- Editor settings panel — file upload (accepts
.json/.lottie) reuses the existing/tspro/files/uploadendpoint. Live animated preview inside the modal uses lottie-web on-demand-loaded so admins see the actual animation playing while tweaking settings. Width slider, alignment toggle, playback dropdown (Autoplay / Play on hover), Loop checkbox, Autoplay checkbox (auto-hides in hover mode since it's implicit), speed slider, renderer dropdown (SVG sharp / Canvas faster), background-colour input. - Hover playback mode — animation parks at frame 0; on
mouseenterit plays forward, onmouseleaveit reverses back to frame 0 with anenterFramewatcher that pauses on reaching frame 0 so it doesn't loop in reverse forever. Aclickhandler toggles play/reverse for touch devices. CSS addscursor: pointerand a subtle scale on hover to telegraph interactivity. - Aspect-ratio detection — the public init script and editor preview both listen for lottie-web's
DOMLoadedevent, readanim.animationData.w/.h, and stamp--lottie-ratio: <w>/<h>onto the wrapper. The stage's CSS reads this var viaaspect-ratio: var(--lottie-ratio, 1 / 1)so non-square animations get the right shape instead of being letterboxed inside a forced square. - Conditional script include —
frontend/page.htmlonly loadslottie.min.jsand the init script when at least one Lottie block exists on the page (detected server-side via the new_sections_have_block_typewalker). Pages without Lottie content skip the 300 KB asset entirely.
Added — Three-panel row primitive in the block palette
Companion to the existing Two-panel row: Three-panel row mints a 3-column grid container (
grid_columns: "1fr 1fr 1fr",gap: 2rem) with three inner containers ready to host child pills. The drop handler inpage_structure.jswas generalised tosplitCols = type === 'split' ? 2 : (type === 'split3' ? 3 : 0)so adding asplit4later is one ternary branch. Catalog tile uses thelayout-gridLucide icon to differentiate visually from the 2-panelcolumnsicon.Added — Container labels (admin-only) editable from the structure tree
Containers gained a new
data.labelfield surfaced exclusively in the page-edit structure card — public renders ignore it. The Settings panel's first group is now a Label input ("Optional admin-only name (e.g. 'Officers')"); typing in it shows up immediately in the structure tree row's title.The structure card now renders the row's label as a normal-cased title (instead of the all-caps "CONTAINER" tag) and a small "container · single column" / "N-column container" subtitle for context. Inline editing — the row label area is a transparent
<input type="text">that admins can click and edit directly without opening the modal; on input,findContainerPayload(blockId).data.labelupdates andsyncStateFromDom()writes the new value to the hidden form input. Sortable's drag-handle filter excludes the label input so clicking it doesn't kick off a row reorder. The popover/modal flow round-trips: editing the label in the structure card updates the editor modal on next open (viaremountPageBlockEditor), and editing it in the modal persists back through the standard form save.Added — Floating, collapsible block palette
The Add blocks palette is no longer a static card pinned at the bottom of the page tree. It floats in the lower-right corner of the page-edit screen as a collapsible FAB → panel:
- Collapsed state shows a pill-shaped + Add block button with brand-colour fill, drop shadow, and a hover-lift. Clicking it scales the FAB out and slides the panel up from the same bottom-right anchor with a
cubic-bezier(0.2, 0.8, 0.2, 1)ease (280 ms scale+translate, 220 ms opacity). - Expanded state hosts the full tile grid in a rounded card with header + close × + drag-instruction copy. Click outside, hit
Escape, or click × to collapse. Click-outside is suppressed while a tile is mid-drag (with a 100 ms grace window afterdragendfor the synthetic click some browsers fire after a drop) so the panel stays open across drops — admins can drag several blocks before manually collapsing. - Drag-drop wiring is unchanged: tiles still carry
data-be-block-{type,name}and the grid still hasdata-be-paletteso the existing handlers attach without modification. The panel wrapper haspointer-events: noneso its empty area doesn't block underlying clicks; children re-enable.
Added — Page background colour with Light / Dark / Auto modes + design-token palette
Pages gained a Background colour section in the Page Settings card sitting between the Dynamic background and Background image sections. Three new columns on the
Pagemodel (bg_color,bg_color_dark,bg_color_dark_mode) — additive_migrate_sqliteentry so existing deployments survive the upgrade. The light value goes onbackground-color; the dark value rides--tsp-bg-dmwhich the existinghtml[data-theme="dark"] [style*="--tsp-bg-dm"]rule swaps in (same pattern containers use).The dark-mode mode field gates how the dark variant resolves:
- Same as light — no
--tsp-bg-dmemitted (light value applies in both modes). - Auto-derive dark variant — the existing
derive_dark_color()HLS helper produces a dark-mode-friendly variant from the light hex. - Manual — admin sets
bg_color_darkexplicitly (with auto-derivation as a fallback when the field is left blank).
Token-aware values —
bg_color/bg_color_darkaccept either a hex literal (#fef3c7) OR a design-token reference (token:color_brand). Tokens stay live: the renderer emitsvar(--fe-color-<key>)so updating the token under Settings → Design retints every page using it without re-saving. Both inputs have a 🎨 Tokens button next to the existing swatch + hex pair; clicking opens a popover (position: fixed, anchored under the trigger, viewport-edge-clamped) listing every color token with its label + current resolved hex as a clickable swatch. Selecting a token writestoken:<key>to the text input and updates the swatch to the resolved hex so the visual preview stays accurate. The<input type="color">always shows the resolved hex, even when the stored value is a token reference. Save endpoint validatestoken:<key>againstDESIGN_FIELDS_BY_KEYso only real color tokens land in storage.Added — Token picker on every block-editor color input
The 🎨 token picker is now woven into every color UI in the block editor. New
attachTokenButton(textInput, swatchInput)helper inblock_editor.jsadds the button to a color cluster and shares a single lazily-built popover (_ensureTokenPopover/_openTokenPopover) that any picker can trigger. Click-outside / Escape / × all dismiss; toggling the same anchor closes it.colorPair(used by container bg, border, button bg/hover/text/border, and several misc inputs) — gained the 🎨 button between text and Clear; text input now acceptstoken:<key>without flagging as invalid; swatch always shows the resolved hex (looked up fromwindow.tspDesignColorTokens).colorPickerWithDarkMode(typography color, list card colors, icon block) — same upgrades on both Light and Manual-dark rows.
New
css_colorJinja filter translates stored color values into CSS-emitable strings:'#fef3c7'→#fef3c7,'token:color_brand'→var(--fe-color-brand), blank → empty string. Applied at every inline-style color emission point in_blocks.htmlandfrontend/page.html(container bg/dark, container border + dark, container hover-bg / hover-border, list card bg / border / number bg + color, image bg, image caption color, icon color + dark, button bg / hover-bg / text / hover-text / border / hover-border / shadow, typography color + dark, page heading_color + subheading_color)._norm_color(page-edit save validator for heading/subheading) also acceptstoken:<key>for any registered color token.Added — Card Dark design token
New Card Dark color token (
color_card_dark, default#1f2937) under Settings → Design → Colors. Emits as--fe-color-card-darkon<body>so any block or stylesheet can reference it viavar(--fe-color-card-dark). Theme defaults updated on bothclassicandrecovery-bluethemes;design_css_vars()includes the new key in its emission tuple.Added — Container removal: two-choice safety modal
When deleting a container that holds blocks, the structure tree now opens a custom modal instead of the bare
confirm()that auto-parked everything to the orphan bin. Two card-style buttons: Move blocks to "Unplaced blocks" (neutral styling, current behavior — children survive in the bin) and Remove everything (red title + red hover, recursively flags every descendant id intointentionallyRemovedIdsso the safety net doesn't sweep them back). Cancel / × / backdrop / Escape all dismiss. Empty-container removals stay a one-lineconfirm()(nothing to ferry).Added — GUI-friendly grid-column editor
When a container's Display flips to Grid, the Layout panel now exposes a column-count stepper (
[−] N columns [+], clamped 1–12), quick-preset chips (2 equal,3 equal,4 equal,Sidebar + main,Main + sidebar,1:2,2:1— active preset highlights in brand colour), per-column track selectors with common values (1fr / 2fr / 3fr / auto / min-content / max-content / 80px–320px / 25–75% / Custom value…), and a live preview bar where each segment scales to the track's relative weight (1fr → 1, 200px → 2, auto → 1, % → fraction).An Edit raw CSS instead escape hatch flips the panel into a single text field for
calc(),minmax(),fit-content(), named lines, etc. Round-tripping:repeat(N, X)↔ N tracks of X;1fr 2fr 1fr↔ three explicit tracks; anything containing(auto-flips to advanced mode so we never silently mangle a value. The serializer collapses N identical tracks back torepeat(N, X)for cleanliness on save.Changed — Settings tab "Meeting Locations" renamed to "Global"
The Settings modal tab now reads Global to reflect that it hosts every site-wide roster + singleton (Meeting Locations + the new Intergroup Officers section). The
data-tab="locations"slug stayed the same so all existing wiring (the iframe loader, the footer admin's "Edit in Settings" deeplinks) keeps working.Changed — Page Settings card: Visibility fieldset removed
The Visibility radio fieldset (Draft / Published / Private) was redundant with the status pills at the top of the page-edit screen, which post directly to
/frontend/pages/<id>/status. The fieldset is gone; a hiddenstatusfield reflecting the current state preserves visibility on a normal Save round-trip so the form doesn't accidentally drop a published page back to Draft.Changed — Container blocks: round-robin distribution + auto-fit / auto-fill detection
The structure-tree builder for grid containers had two issues that the Officer grid on
/intergroupexposed: (1) overflow children (more items than columns) all dumped into the last cell because of thecells[i % n_cols] if i < n_cols else cells[-1]clause; (2)repeat(auto-fit, minmax(260px, 1fr))parsed as 3 columns by token-count even though the rendered count varies with viewport.Fix:
_grid_col_count()now treats anyauto-fit/auto-fillgrid as 1 column so the structure tree shows the children as a flat stack (the public render still flows them as a wrapping grid). The distribution loop simplified tocells[i % n_cols]for every child, mirroring CSS grid's defaultgrid-auto-flow: row— a 3-column grid with 6 items now distributes 2/2/2 across columns instead of 0/0/6. Same auto-fit detection mirrored inpage_structure.js'sgridColCountso client-side re-renders match.Changed — Edit modal opens at the top + drops the focused block's own head
focusBlockin the page-edit script now resetsmodal-body.scrollTop = 0instead of callingtarget.scrollIntoView({ block: 'center' })— with focus-mode hiding every sibling, centering the lone visible target only nudged the scroll a few pixels for no benefit. In.is-focus-mode, the focused block's own.be-block-head(drag handle, type label, × remove button) is nowdisplay: noneand its outline / border / padding / background are zeroed out. The settings panels (Label, Layout, Spacing, etc.) start right at the top of the modal body — the modal reads as a clean settings sheet for the clicked block, not a floating draggable card.Changed — Grid controls row gap
Added
display: flex; flex-direction: column; gap: 0.5rem;to.be-container-grid-controlsso each row inside the grid editor (column count, quick presets, per-track selectors, preview, advanced toggle) sits with 0.5 rem of breathing room.Changed —
/intergrouppage: standard containers + admin labelsThe seeded
/intergrouppage replicating dccma.com's content was rebuilt to use only standard Container blocks instead of section-titled wrappers (the latter weren't editable from the structure card). The whole page lives in one untitled section containing 9 labeled top-level Container blocks — each former section title became:- the container's admin-only
label(e.g. Officers, Meeting Resources) so the structure tree reads at a glance. - a fully-editable
<h2>heading block as the container's first child so the public-facing section title is still there.
Inner containers (the meeting card, meeting actions row, officer grid, individual officer cards) all carry their own labels too: "Meeting card", "Meeting actions", "Officer grid", "Officer · Chair", and so on.
Fixed — Mass-delete container loses nested empty containers to orphan bin
When the user picked Remove everything on a container with nested containers + leaf blocks, the leaf ids were flagged but nested-container ids were not — the safety net then "rescued" the empty wrappers into the Unplaced bin. The walk now hits three sources: leaf-pill payloads (
data-block-payload), every nested[data-be-row-block-id]row inside the container being removed, and the parent container's full payload tree fromfindContainerPayload. All descendant ids get flagged before the row is removed so the safety net leaves them alone.Fixed — Container Flex → Grid swap blanked the modal
Flipping a container's Display from Flex to Grid in the settings panel called the editor's top-level
render(), which wipedsectionsEl.innerHTMLand rebuilt the editor — but the focus-mode CSS hides every.be-blockthat doesn't have.be-block-focused(or an ancestor.be-block-focused-path). Class assignments live on DOM nodes, not data, so the rebuild dropped focus and the modal went blank.render()now captures the currently focused block'sdata-idbefore clearing the DOM, then re-applies.be-block-focusedto the new node and walks up its ancestors to re-stamp.be-block-focused-path. The logic mirrorsfocusBlockinfrontend_page_edit.html. Same fix benefits any other in-place re-render (list item add/remove, section delete, etc.).Fixed — Update toast covered by the floating block palette
Bumped
.version-update-banner'sz-indexfrom400to2147483647(the CSS z-index ceiling — max signed 32-bit int) so it sits above the floating palette (1000), modals (100), the wp-fetch overlay (9999), and anything future code might add. Both elements still anchor to bottom-right; the toast now sits visually on top of the FAB instead of behind it.Fixed — Token popover not appearing (off-screen positioning)
The page-bg token popover was opening but landing off-screen because it was
position: absolutewith top/left computed in form-relative coords, while its nearest positioned ancestor was the section (since the section hadposition: relativeset). Switched toposition: fixedwith viewport coords fromgetBoundingClientRect(), no offset math. Also added a right-edge clamp so the panel can't slip past the viewport on narrow windows.z-index: 1100so it sits above the floating block palette but stays below the update toast.Changed — Mega menu builder: "Override size" label clarified
The per-link size-override checkbox in the mega menu builder (
_nav_megalink.html) was labelled simply Override size, which sat ambiguously next to the other size controls (icon size, image size, etc.). Renamed to Override font size so it's unmistakably the link-text scale, not anything geometric.Changed — Mega menu: external links swap chevron for an external-link glyph
The trailing icon next to each mega menu link now reflects whether the link leaves the site:
- Internal links (relative paths like
/meetings, anchors like#section, etc.) keep the existingchevron-rightglyph. - External links (URL starts with
http://,https://,mailto:, ortel:) render Lucide'sexternal-linkicon — the box-with-arrow-exiting-top-right shape — so visitors can tell at a glance which links open something off-site.
Detection is purely template-side via
link.url.startswith(...)on the four prefixes above; no schema or model change. Same 20px sizing, samecurrentColorstroke, same hover slide. Both megamenu themes (Recovery Blue + Classic) get the swap, and a--externalmodifier class is stamped on the wrapper so future styling can differentiate further if needed.Changed — Mega menu chevrons: always visible, real chevron, sized + tinted to match label
Three small changes to the trailing arrow on each mega menu link, applied to both
recovery-blue.htmlandclassic.html:- Always visible. The chevron used to be
opacity: 0until hover, with a 6px slide-in animation — a "gotcha" affordance that hid the link's clickable nature on first view. Now the chevron sits at fullopacity: 1at rest, with the slide compressed to a subtle 3px nudge on hover for a touch of motion. - Real chevron, not an arrow / glyph. Recovery Blue was using
icon('arrow-right')(a straight arrow), Classic was rendering a literal→text glyph. Both now useicon('chevron-right')— Lucide's actual chevron — so the visual matches the rest of the UI's chevrons (the dynbg-trigger caret, calendar nav, etc.) and renders cleanly at any DPI. - 20px square + matches text colour. Both chevron containers now declare
color: inheritandopacity: 1so the SVG'scurrentColorstroke paints in exactly the link label's colour (white-on-blue on Recovery Blue, dark-on-light on Classic, or any per-link override). The icon itself was bumped from 16×16 to 20×20.
Added — Image block: corner roundness + drop-shadow with mobile-aware scaling
The image block grew two style controls in the BlockEditor and a matching pair of inline-style outputs in every public renderer:
BlockEditor controls
- Corner roundness — a 0–50px slider live-updates the in-modal preview's
border-radius. Default of 0 (sharp). The slider's px value is written into the block'sdata.border_radiusand surfaced as a CSS custom property (see render-side details below). - Drop shadow — a
<select>with five presets: None / Subtle / Soft / Pronounced / Dramatic. Each preset maps to a pre-bakedbox-shadowrecipe (e.g.Soft→0 4px 6px rgba(0,0,0,0.08), 0 2px 4px rgba(0,0,0,0.06)). The preview img inside the modal applies the recipe live so admins see the saved render before clicking Save. - Both controls slot into the existing image-block form between Alignment and Caption colour, alongside the existing Width / Alignment / Caption fields.
Public render
- Two renderers updated so the new fields take effect everywhere the image block is used:
_blocks.html(admin / Zoom Tech surfaces, generic block macro) ANDfrontend/page.html(the page-detail-specific image renderer). The latter is what/<slug>pages use; without updating it, settings appeared to save but didn't render — caught when corner roundness on/marcmahad no visible effect. - Inline shadow recipes are stamped directly on the
<img>(box-shadow: ...) so the shadow tracks the actual visual bounds of the image rather than the surrounding<figure>. Recipes match the JS preview'sSHADOW_RECIPESmap exactly so the modal preview equals the live render.
Mobile-aware corner-radius scaling
A 32px corner radius reads cleanly on a desktop hero image but looks comically rounded on a 320px-wide phone screen. To get proportional softening without a second admin field, the renderer emits
--img-radius: <n>pxas a CSS custom property (instead of a hardcodedborder-radiusdeclaration), andfrontend.cssconsumes it:css .fe-pp-figure img, .block-image img { border-radius: var(--img-radius, 0); } @media (max-width: 560px) { .fe-pp-figure img, .block-image img { border-radius: calc(var(--img-radius, 0) / 2); } }So 32px on desktop → 16px on phones, 24px → 12px, 8px → 4px, etc. The 560px breakpoint matches the convention used elsewhere in
frontend.css.The existing
.block-image imgrule inapp.css(admin / Zoom Tech surfaces) was migrated toborder-radius: var(--img-radius, 6px)so legacy unedited blocks keep their 6px default while admin-set values override via the inline custom property.Fixed — Page editor: orphan × button now actually deletes
Two bugs were stacked on top of each other so that clicking × on an Unplaced-blocks pill did nothing useful — it either popped a blank Edit-layout modal or appeared to delete the block only for it to re-spawn on the next sync.
- Modal-open click was beating the × handler. Orphan pills carry
data-open-modal="page-layout-edit-modal"for the click-to-edit flow.app.jsbinds a per-element bubble-phase click listener on every[data-open-modal]element that callsopenModal(...)unconditionally — without checking for clicks on inner buttons. Clicking × bubbled through that listener BEFOREpage_structure.js's document-level remove handler ran, so the editor popped open empty and the confirm dialog appeared on top of it. - Fix: bind a click listener directly on every
[data-be-remove-block]/[data-be-remove-row]element. Listeners on the target element fire BEFORE bubble-phase listeners on ancestors, so the parent pill's modal-open listener never sees the click. The handler doesstopImmediatePropagation+ runs the remove logic. A capture-phase document delegate stays as a fallback for dynamically-minted × buttons; aMutationObserverpicks up new × buttons (palette drops, BlockEditor mutations) so they get the per-button binding too. - Safety net was rescuing deliberate deletes.
syncStateFromDomsnapshots every block id before reconstructing from the DOM and re-stamps any "lost" ids into the Unplaced bin — meant to catch drag-drop reconstruction bugs. It couldn't tell a deliberate × delete apart from a dragged block that fell off the rails, so every orphan delete was undone in the same call: pill removed → safety net sees the id missing → safety net stamps a fresh pill back. - Fix: introduced an
intentionallyRemovedIdsset.handleRemoveBlockandhandleRemoveRowregister the deleted block's id (plus all descendant ids — a container delete cascades) before callingsyncStateFromDom. The diff skips any id in the set, then the set is consumed at the end of each sync so future drag-drop bugs still trigger normal rescue behaviour.
Changed — BlockEditor: deleting a container preserves its children + closes empty focus modal
Two related fixes to the modal-based block editor when removing a block that's the focus of the modal:
- Container delete dumps children to Unplaced blocks (no refresh required). The modal's × on a block did
parentBlocks.splice(bi, 1)and re-rendered. For container blocks holding children indata.blocks, those children disappeared with the container — no rescue, no orphan rescue, just gone on save. Now the × handler detects a non-empty container, confirms with the count ("Its X blocks will move to 'Unplaced blocks' so nothing is lost"), splices the container out, and dispatches ablockremoveCustomEvent carrying the children's payloads ondetail.liftedChildren.page_structure.jslistens for the event on#page-editor-root, stamps each child as a pill via the existingmakeNodeFromPayloadhelper, appends to the orphans zone, removes theis-emptyclass, and re-syncs the hidden field — all without leaving the modal or reloading the page. - Empty modal after focused-block delete. When the admin opened the modal focused on a block then clicked × inside, the block was deleted but the modal stayed open in focus mode showing a blank panel. Added a
blockremovelistener on the modal that checks for the absence of.be-block-focusedand clicks the modal's[data-close]to dismiss it. Non-focused deletes (× on a sibling block while the modal is open in full-editor mode) leave the modal as-is.
Changed — Pages list: 3-status visibility, sortable columns, multi-row bulk actions
Pages got a real Draft / Published / Private state machine and a backend list that lets admins flip multiple at once. The single-checkbox
is_publishedtoggle is gone; in its place a three-way visibility model:- Draft —
is_published=False. Hidden from public — anonymous visitors get 404, signed-in editors / admins can preview by visiting the URL. - Published —
is_published=True,is_private=False. Visible to everyone, listed on the Site Index. - Private —
is_published=True,is_private=True. Only signed-in editors / admins can open the URL — anonymous visitors get the same 404 they'd see for a draft. Hidden from the Site Index and any future public navigation.
Schema
- New
Page.is_privateboolean column (defaultFalse) with a_migrate_sqliteentry so existing deploys add the column without touchingis_published. Combined with the existingis_publishedcolumn to encode the three states above.
Public gating
frontend.page_detail— gate widened: published-and-not-private for anonymous, published-and-anything for signed-in editors. The 404 path is identical for both Draft and Private viewed by anon, so a Private page's existence isn't leaked.frontend.site_index— Pages section now filtersis_published=True, is_private=False(Site Index never advertises Private pages).
Admin: page edit screen
- Visibility fieldset replaces the single Published checkbox in
frontend_page_edit.html. Three-way radio with a one-liner description for each state. - Status pill row sits under the title banner — Draft / Publish / Make Private. Clicking a pill selects the matching radio in the page-settings form and dispatches a
changeso the shared save bar lights up "Unsaved changes". No auto-submit, no separate quick-action endpoint round-trip — same form lifecycle as editing any other field. Pills mirror the radio's state live; flipping the radio directly inside the fieldset keeps the pills in sync. - Status chip in the title banner — Draft / Published / Private with the matching
.post-chip-*colour.
Admin: pages list
- Sortable columns — Title, URL, Layout, Status, Updated. Click a header to sort; click again to reverse. Default sort is Title ascending. Sort is purely client-side: each
<tr>carriesdata-sort-*keys the click handler reads, and the tbody re-orders in place. The Updated column carries an epoch-timestamp data attribute for proper numeric ordering. - Checkboxes per row + select-all in the header. Selecting at least one row reveals a bulk-action toolbar above the table.
- Bulk-action toolbar — Draft / Publish / Private buttons posting to the new
frontend_pages_bulkendpoint. Single commit applies the same status flip to every selected row.
Endpoints
POST /tspro/frontend/pages/<id>/status— single-page quick-action endpoint (kept for direct callers, no longer used by the edit-screen pills since those go through the normal save flow now).POST /tspro/frontend/pages/bulk— multi-row bulk action. Acceptspage_ids[]+status. Unknown ids are silently dropped; unknown statuses flash an error.frontend_page_save— accepts the newstatusfield (draft / published / private) with a fallback to the legacy single-checkboxis_published+is_privateform for older callers.frontend_page_create— accepts an initialstatusfrom the New-page modal (still defaults todraftif omitted, matching the existing modal flow).
CSS
.post-chip-private— purple variant alongside the existing online / draft / announcement / event / warning chips, with a dark-mode parity rule..fe-pages-list-card .tbl thead th.sortable— cursor + hover background + bidirectional arrow indicators (filled when active, faded when inactive)..fe-pages-bulk-bar— brand-tinted toolbar that animates in via the[hidden]attribute toggle, hosting the count + action buttons..fe-page-status-fieldset+.fe-page-edit-status-actions— the edit-screen visibility fieldset and its companion pill row.
Added — Site Index frontend template (
/siteindex)A new auto-populated table of contents page that lists every public surface on the site — pages, meetings, events, announcements, stories, library items — picked up automatically as content is added. Two layouts plus the same Customize machinery (Background / Fonts / Sizes / dynbg + overlays + custom colours + randomize) every other template gets.
Public render
/siteindex(route lives inapp/frontend.py) — gated by thefrontend_site_index_enabledtoggle so the URL 404s until an admin publishes it. Originally shipped at/site-index; renamed to/siteindexto match the existing flat-slug convention (/submissionform,/printlist, etc.).- Two layouts under
app/templates/frontend/site_index/: - Grouped — sections by content type with an eyebrow heading + count chip per group. Items inside each group sort alphabetically.
- Alphabet — single A–Z list flattened across all kinds, each row tagged with a brand-tinted kind chip so admins still see what they're looking at without needing the group structure.
_site_index_groups(site)helper — pulls fromPage(published, non-private),Meeting(active),Post(published, non-archived events / announcements),Story(non-draft, non-archived),Library+LibraryItem(public-visible). Each item carries{title, url, kind, subtitle, date}so layouts can render flexibly.- Sections group at the top — the Grouped layout's first section lists the top-level template pages: Home, Meetings, Events, Announcements, Stories, Library, Print list. Each entry is gated by its respective feature flag (events / announcements respect
posts_enabled; stories respectsstories_enabled) so the index never points at a 404.
Schema
- 13 new
SiteSettingcolumns with_migrate_sqliteentries:frontend_site_index_enabled,_template,_heading,_subheading,_sort_mode, six_show_*per-section toggles (pages / meetings / events / announcements / stories / library),_bg_dynamic_key,_bg_dynbg_config_json. Per-template style overrides reuse the existingfrontend_template_settings_jsonJSON column keyed by(kind, key)— same shape every other template uses, no per-section column explosion. siteindexreserved slug — added tofrontend_page_createandfrontend_page_saveslug-uniqueness sets so admins can't claim it as a Page slug and shadow the index route.
Admin
- New section on
/tspro/frontend/templates— card grid for the two variants, the standardtpl_customize_panel(Background / Fonts / Sizes), heading / subheading inputs, sort-order radio (Grouped / A–Z), six per-section visibility toggles, and the Publish toggle that gates the public route. Posts to a newfrontend_site_index_template_saveendpoint. Bonus cleanup: removed a stray duplicateif/deadfrom .frontend import _post_in_archiveline in_site_index_groups(). site_indexadded to_TEMPLATE_KINDS+ thecatalog_mapinfrontend_template_settings_saveso per-template settings round-trip through the same dispatch table as every other kind.
CSS
.fe-site-index*classes infrontend.css— page heading + blurb, group eyebrow + count chip, row pill recipe (brand-tinted hover background, arrow that translates on hover,:focus-visibleoutline), kind chip on the alphabet variant matching the meeting-card schedule pill recipe, dark-mode parity tweaks..fe-tplgrid-thumb-site-index-*classes inapp.css— picker thumbs for the two layouts (eyebrow bars + row stripes for grouped, centered title + flat row stack for alphabet).
Changed — Templates admin: uniform Customize panel on every template card
Every template card on
/tspro/frontend/templatesnow exposes the same Background / Fonts / Sizes 3-column Customize dropdown — no matter the section. Previously only Meeting / Event detail (which used thetpl_sectionmacro) had this panel; every other section had its own bespoke controls and admins had to hunt for settings that were present on one card but missing on another.Reusable customize-panel macro
- Extracted
tpl_customize_panel(kind, active_key, settings, name, scope_label)from the existingtpl_sectionmacro. Drops in below any section's style cards. Background fieldset always carries both an override-page-background-colour toggle AND the dynamic-background trigger; Fonts has heading + body font selects; Sizes has heading + body size sliders with override toggles. - Open by default —
<details>element now ships with theopenattribute unconditionally, replacing the conditional{% if settings.bg or … %}open{% endif %}that previously expanded only when the section already had saved overrides. Admins land on the page with all panels visible so they don't have to discover the toggle. Customize ""empty-quotes bug fixed —_active_name = ''from{% set %}inside{% for %}(Jinja loop scope doesn't leak) replaced withtemplates | selectattr('key', 'equalto', active_key) | list | firstwhich actually returns a value the surrounding template can read. Summary heading now renders e.g.Customize Sidebarinstead ofCustomize "".- Sections alphabetical — both the cards within each section AND the section blocks themselves now sort alphabetically. The
frontend_templatesroute wraps every catalog in a_by_name()sort before rendering;tpl_customize_panelis rendered the same way on every card so the on-page experience reads as a single shape.
List-section form split
Each list section's single form (cards + per-section settings + one Save button) is split into:
- Form 1 — cards-only with a
Save layoutbutton. - Customize panel — own form posting to
frontend_template_settings_save. - Form 2 — page-heading copy + container width + pro-tips + dynbg / per-section settings +
Save Section settingsbutton.
Both forms post to the same per-section URL. Each save handler was refactored to use field-presence checks (
if "<field>" in request.form:) so a layout-only POST doesn't clobber the heading / subheading / max_width / padding / dynbg fields and vice versa. Refactor applied to: announcements list, events list, stories list, meetings list, story detail, literature library. Printlist (no card variants) gets the customize panel directly under the section heading; Contact us gets it between its single "Split — intro + form" card and the existing PIC-toggle form.Schema + dispatch additions
_TEMPLATE_KINDSextended to all ten kinds (meeting / event / story / meetings_list / events_list / announcements_list / stories_list / literature_library / printlist / contact). Single dispatch table infrontend_template_settings_savemaps each kind to its catalog (or one-key sentineldefault/splitfor the single-rendering sections).- No new columns — every section reuses the existing
frontend_template_settings_jsonJSON column, keyed by(kind, key). template_settings()pass-through — earlier the function silently dropped every dynbg-related leaf key (bg_dynamic_key,bg_dynbg_overlay,bg_dynbg_colors,bg_dynbg_overlay_scope/size/intensity,bg_dynbg_randomize_colors/positions,bg_dynbg_animate), copying onlybg / heading_font / body_font / heading_size / body_sizeout of the leaf — so saves succeeded but the customize panel re-opened withChoose…as if nothing was persisted. Fixed by passing every dynbg key through alongside the existing five.
Standalone dynbg fieldsets removed
Each list section's redundant standalone "Dynamic background" fieldset was stripped — the customize panel's Background column owns the dynbg picker now. Each list shell template was updated to read dynbg from the per-template settings JSON first (
template_settings(site, kind, key).get('bg_dynamic_key')) and fall back to the flat-field columns for back-compat with installs that already saved through the old standalone control.Render-side wiring for entity-detail templates
tpl_dynbg_configplumbed through every entity-detail render call inapp/frontend.py— meeting, event, story, archive event, archive announcement. Each route now builds a complete dict (overlay,colors,overlay_scope,overlay_size,overlay_intensity,randomize_colors,randomize_positions,animate) from the per-template settings leaf and passes it to the partial.- 13 entity-detail partials updated (4 meeting + 4 event + 5 story) — switched from a hand-built
{overlay, colors}dict totpl_dynbg_config, and the inline-CSS-vars stamp now goes throughdynbg_resolve_colors(...)+dynbg_resolve_positions(...)so the randomize flags actually take effect per-render. Two consecutive reloads of the same meeting / event / story page now produce different--fe-dynbg-c1and--fe-dynbg-blob-a-topvalues when randomize is on.
_dynbg_picker.htmlpseudo-cfg fixThe customize-panel call site previously built
_tpl_pseudo_cfg = {'overlay': …, 'colors': …}and passed it to the dynbg trigger. Every other dimension (randomize_colors, randomize_positions, scope, noise_size, noise_intensity, animate) was missing from the pseudo-cfg, so opening the modal showed those controls in their default state even when persisted in JSON, and Save would clobber them with the empty defaults. Fixed by carrying every dimensiontemplate_settings()exposes.Changed — Meetings-list cards: dark-mode dimmed background + uniform description colour
.fe-mlist-cardhad no dark-mode override — kept its defaultbackground: #ffffffdeclaration and the cards rendered as either glaring white tiles or, when overridden upstream, fully transparent rectangles against the dark page. Added an explicit dark-mode rule withbackground: rgba(5, 8, 15, 0.85)(a few stops below the page bg so each card reads as a sunken/dimmed tile rather than a raised lighter one) plus matchingborder-color: #1f2a44. The 85% alpha lets any page-level dynamic background paint subtly through the cards instead of them reading as fully opaque blocks.- Description text matches title — the meeting-card description renders with
<p class="fe-mlist-card-desc muted">, and the global.mutedutility paints text invar(--muted)(a dim grey). Result: title was bright, description faded out — a visual mismatch within the same card. Forced.fe-mlist-card-desc(incl..mutedvariant) tocolor: inheritin dark mode so description copy reads at the same weight as the title.
Added — Dynbg modal: overlays, custom colours, per-render randomize, noise tunables
A second pass on the dynamic-backgrounds primitive that promoted the inline picker to a popup modal and grew three new dimensions: a separate texture overlay layer, custom-colour overrides per surface, and per-render randomization for both colours and positions.
Modal-popup picker (replaces the inline grid)
- One global modal in
templates/base.html(#dynbg-picker-modal) lives at body root on every admin page. The trigger macro emits a hidden<input>+ a button; clicking the button opens the modal pre-populated with the trigger's saved state. Save writes the selection back viachangeevents on the hidden inputs; Clear all wipes every dimension at once. - Tabs inside the modal —
Background/Overlay/Colours. Each tab is its own selection state; Save commits all three at once. dynbg_trigger(...)macro intemplates/_dynbg_picker.html— drop-in form control for any admin form. Renders a hidden input + a button with the current preset's name + a small live thumbnail preview. The button'sdata-dynbg-*attributes carry every dimension's current value so the modal reads + writes them on open / save.- Lazy DOM lookup in the JS handler — modal markup lives near the bottom of
<body>, AFTER the<script src="app.js">tag, so caching DOM references at script-load time would resolve to null. Every reference is re-fetched inside the handlers so the IIFE is order-independent and survives templates moving the markup around. - Delegated trigger handler so triggers added later in the page lifecycle (e.g. by the block editor when an admin opens a container's edit panel) pair up automatically.
Overlay layer
- New
OVERLAYScatalog inapp/dynbg.py— six presets at launch:noise-grain(the Hyprlab sandpaper recipe — SVG fractal-noise data-URL at 3% opacity, tiled),scanlines(2px horizontal stripes at 1.5% alpha),linen(two-direction stripe weave),vignette(radial darken from corners),crosshatch(diagonal stripe pair),dot-weave(tiny halftone lattice). Each has dark-mode parity and respectsprefers-reduced-motion. - Render partial
templates/frontend/_dynbg_overlay.html— sister to the base_dynbg.html. Emits a<div class="fe-dynbg-overlay fe-dynbg-overlay-<key>">whose CSS rules paint the texture above the base dynbg AND above page content (pointer-events: none,z-index: 10). Compose with any base background or stand on their own. - Apply helper
templates/frontend/_dynbg_apply.html— single include any host can drop in to render base dynbg + overlay together. Reads the saved JSON config and threads overlay key / scope / noise size / intensity through the partials. - Stamping at the host — every dynbg-using surface decodes the stored config, calls
dynbg_resolve_colors(cfg)+dynbg_resolve_positions(cfg, key)to get the per-render CSS-vars string, and concatenates into the host element's inlinestyle="..."so colours + positions ride alongside the existing base styles.
Scope toggle (per overlay)
overlay_scopeconfig field with two values:all(default — texture rides over backgrounds AND content, the Hyprlab feel) andbg(texture sits beneath cards / typography). The latter applies the.fe-dynbg-overlay--bg-onlymodifier which drops the overlay'sz-indexfrom 10 to 0 so the host's content (forced toz-index: 1by the host's:whererule) paints on top.- Modal UI — radio pair under the Overlay tab → Scope fieldset.
Noise-grain knobs
- Two admin-tunable parameters for the noise-grain overlay:
overlay_size(drivesfeTurbulence baseFrequency, range0.1–2.0, default0.9; lower = coarser film grain, higher = ultra-fine sand) andoverlay_intensity(drives the SVG rect'sopacity, range0.005–0.5, default0.03). - Server-side data-URL generation —
dynbg.noise_grain_data_url(size, intensity)bakes the chosen values directly into the SVG'sfeTurbulence baseFrequencyand rectopacityattributes (the SVG can't read CSS variables — those parameters must be literal at parse time). The partial stamps the URL inline asstyle="background-image: url('...')"only when the values differ from the defaults; otherwise the static CSS class default takes over. - URL-encoded apostrophes (
%27) inside the SVG so they don't conflict with the surroundingurl('...')wrapper after HTML decoding. Without this, the inner'from e.g.viewBox='0 0 256 256'would close theurl()string early and the browser would discard the rest as invalid CSS — a previous regression where any custom-baked URL silently rendered as broken CSS (no noise visible). - Modal UI — two range sliders + a "Reset to default" button, visible only when the noise-grain card is the active overlay.
Custom colours (3 slots per surface)
- Up to three custom hexes per surface override the brand-token colours each base preset uses. Each preset's CSS now defines
--_db-c1 / c2 / c3shadow vars that resolve through--fe-dynbg-c1 / c2 / c3first (set by the host's inline-stamped style) and fall back to the brand accent / hand-tuned secondary mixes. - Modal UI — Colours tab with three colour-picker rows (paired
<input type=color>+ hex text input + per-slot Clear button). Empty slots fall through to the brand default; filled slots take over instantly via the CSS-vars stamp on the host. - Server-side gating via
dynbg.normalize_color()(3/4/6/8-digit hex regex) so a tampered POST can't inject arbitrary CSS through the inline-style channel.
Two independent randomize toggles
randomize_colors— when on, the saved colour slots are ignored anddynbg.random_colors(3)generates a fresh brand-friendly palette per render (HSL with random hue + capped medium saturation / lightness so the palette stays brand-friendly: no muddy browns, no eye-searing neons). Same surface re-tints on every visit.randomize_positions— when on,dynbg.random_positions(key)returns a dict of CSS-variable → value pairs that randomise the position-shaped properties of the active preset, stamped onto the host's inline style. Per-preset randomisation:aurora-blobs: each blob's top / left / bottom / right corner anchor + size (220–460px)mesh-gradient: each layer's conic origin (x / y) + starting angleaurora-bands: each band's sweep angle (40–160°)spotlight: each spot's corner anchor + width / height (50–100%)- Other presets (dotted-grid, diagonal-lines, noise-paper, starfield) ignore this flag — they have nothing positional to move.
- CSS retrofit for the four randomization-supporting presets — every position-shaped value reads through a
var(--fe-dynbg-...)chain with the original hand-tuned value as the fallback, so when randomize-positions is off the surfaces look exactly as before. - Backwards-compat — the legacy single
randomizefield maps to both flags during decode;encode_config(... randomize=True)still works for any older callers. - Modal UI — Colours tab → Randomize on every page load fieldset, two checkboxes (Colours / Positions) that work independently.
Wired into every existing dynbg surface
The picker macro now carries nine hidden inputs (base key + overlay + 3 colours + scope + noise size + noise intensity + randomize_colors + randomize_positions). Every save handler routes them through the new
_dynbg_config_from_form(form, config_field)helper which encodes them as a single JSON blob into the matching<surface>_bg_dynbg_config_jsoncolumn.- Schema additions — Page + 8 SiteSetting columns (
bg_dynbg_config_json+frontend_<surface>_bg_dynbg_config_json× 8). All auto-migrate via_migrate_sqlite. - Per-template settings JSON (Meeting / Event detail) absorbs the same dimensions as additional keys (
bg_dynbg_overlay,bg_dynbg_colors,bg_dynbg_overlay_scope,bg_dynbg_overlay_size,bg_dynbg_overlay_intensity,bg_dynbg_randomize_colors,bg_dynbg_randomize_positions). - Container blocks (block editor) — JS
dynbgTrigger({key, overlay, colors, scope, noiseSize, noiseIntensity, randomizeColors, randomizePositions, onChange})builds nine hidden inputs dynamically, consolidates theirchangeevents into a single onChange callback (microtask drain — the editor only re-serialises once per modal save, not nine times), and round-trips every dimension into the block's data dict. Public-side_blocks.htmlandfrontend/page.html'spp_blockmacro stamp the colour + position vars onto the container's inlinestyleand include the apply partial. - Layout-template normalizer (
_normalize_blocks) preserves all the new container fields through saves so a layout-template ship can carry pre-textured containers without losing the picks.
Bug fixes uncovered along the way
- Modal not opening — fixed
if (!modal) returnearly-bail by switching to lazy DOM lookups; the script-load-timegetElementByIdwas returning null because the modal markup is in<body>after the script tag. - Overlay not saving — call sites of
dynbg_trigger(...)weren't passingconfig_field, so the hidden inputs were namedbg_dynbg_config_json__overlay(the macro default) but each save handler was readingfrontend_<surface>_bg_dynbg_config_json__overlay. Picker-macro call sites updated to thread the matching field name through. - Trigger button reverts to "Choose…" after save —
{% set _entry = ... %}inside a{% for %}loop doesn't leak outside the loop scope. Switched todynbg_catalog() | selectattr('key', 'equalto', current) | list | firstwhich returns a value the surrounding template can read. - Internal-server-error on dashboard load — modal's overlay-card thumbnails included
_dynbg_overlay.htmlwithout the new size / intensity / scope kwargs, andis not nonetripped Jinja's StrictUndefined. Defaulted all three optional kwargs at the top of the partial via|default(none, true). - Page-level dynbg invisible behind opaque section bgs —
.fe-mlist { background: var(--fe-panel-soft); }was painting on top of the dynbg. Added a CSS rule that forces the immediate child sections of.fe-page-dynbg-host.fe-dynbg-hosttobackground: transparentso the dynbg shows through.
Changed — Templates admin: alphabetical card + section ordering
- Cards inside each section sort alphabetically by display name —
frontend_templatesroute wraps every catalog (Meeting / Event / Stories list / Stories detail / Events list / Meetings list / etc.) insorted(catalog, key=lambda t: (t.get("name") or "").lower())before passing them into the template. The sort is admin-page-local; the underlying*_TEMPLATESlists keep their declared order so other call sites (lookups by key, "first available template" fallbacks) stay deterministic. - Section blocks themselves sort alphabetically by heading — physically reordered the
<section>blocks intemplates/frontend_templates.htmlso admins now see Announcements / Events detail → Announcements list → Contact us → Events list → Literature Library → Meeting detail → Meetings list → Printlist → Stories list → Story detail. Previously Stories list / Story detail interrupted the alphabetical run between Announcements list and Events list.
Added — Dynamic backgrounds library
A new visual primitive: a catalog of CSS-driven, optionally-animated backdrops that any frontend surface can opt into alongside its existing solid-colour / gradient / image options. Eight presets ship today; adding a ninth is one Python dict entry plus one CSS rule and every picker on the site lights it up automatically.
Catalog + render primitive
app/dynbg.py— single source of truth for the catalog. Each entry is{key, name, description}. Helpers:by_key(key)for lookup,normalize(key)to coerce a possibly-tampered POST value to a known key orNone(every server-side save path routes user input through this gate). Eight presets at launch:aurora-blobs(the original contact-page backdrop),mesh-gradient,aurora-bands,starfield,dotted-grid,diagonal-lines,noise-paper,spotlight.templates/frontend/_dynbg.html— render partial. Caller passesdynbg_key(viawithblock or render-context) and the partial emits a<div class="fe-dynbg fe-dynbg-<key>" aria-hidden="true">with the right inner spans / SVG nodes for that recipe. Unknown / blank keys produce no output, so consumers can include the partial unguarded.- CSS recipes in
static/css/frontend.css— every preset uses brand-design tokens (--fe-accent,--fe-color-bg,--fe-color-surface) so the same key produces a brand-coloured backdrop on every install. Animations honourprefers-reduced-motion: reduceglobally. Each preset has explicit dark-mode rules (html[data-theme="dark"]+body.fe-frontend-force-darkselector pair) so the backdrop stays legible when the visitor flips the theme toggle. fe-dynbg-hosthost class — small CSS helper that gives a host elementposition: relative; isolation: isolate;plus promotes its non-dynbg children toz-index: 1so the dynbg paints under content. Consumers add this class alongside an.fe-dynbgchild to host a dynamic backdrop without rewriting their existing stacking context.- Catalog as Jinja global —
dynbg_catalog()registered inapp/__init__.py::create_appso any template can enumerate the available presets without importing Python.
Modal-popup admin picker (shared across every surface)
- One global modal in
templates/base.html—#dynbg-picker-modallives at body root on every admin page. It carries the full preset grid (rendered via the same_dynbg.htmlpartial as the public site, so the thumbnails are live previews of what the visitor will see) plus Save / Clear / Cancel buttons. dynbg_trigger(field_name, current, button_id)macro intemplates/_dynbg_picker.html— drop-in form control that any admin form uses to add a "Pick a dynamic background" affordance. Renders a hidden<input>(so a normal form POST submits the key) plus a button that opens the global modal pre-selected to the trigger's current value. Save writes back viachangeevent on the hidden input + bubbles to listeners.- Delegated trigger handler in
static/js/app.js— clicks on[data-dynbg-trigger]are caught at the document level so triggers added later in the page lifecycle (e.g. by the block editor when an admin opens a container's edit panel) pair up automatically. One trigger is "active" at a time; the modal stashes a reference on open and consumes it on Save / Clear / Cancel. - Trigger button styling in
static/css/app.css— small thumbnail tile + display name + chevron, matches the rest of the admin's row-style controls. Hover lift + focus-visible outline.
Surfaces wired up
Every surface where a frontend background is definable now exposes the picker. Plumbing pattern is consistent across surfaces: column / JSON field on the model,
dynbg_trigger(...)macro in the admin form,fe-dynbg-host+_dynbg.htmlinclude in the public render.- Pages (
/<slug>) —Page.bg_dynamic_keycolumn added (auto-migrates via_migrate_sqlite). Saved byfrontend_page_save(validated throughdynbg.normalize). Picker rendered in the page-edit form's Background section.frontend/page.htmladdsfe-dynbg-hostto the article wrapper and includes the partial when a key is set. - Hero (Homepage admin) —
SiteSetting.frontend_hero_bg_dynamic_keycolumn. Newdynamicmode added tofrontend_hero_bg_style(joins the existingfrosty / solid / gradient / image / sinewave / videoset). Picker in a new "Dynamic" panel under Background → Style. Rendered infrontend/_hero.htmlwhen the active style isdynamic. - Container blocks (block editor) — JS helper
dynbgTrigger(currentKey, onChange)added tostatic/js/block_editor.jsthat builds a trigger button + hidden input dynamically inside the container's "Background & border" panel.bg_dynamic_keyround-trips throughblocks_json(Page block storage preserves arbitrary keys, no whitelist needed). Rendered by both_blocks.html'srender_blockmacro (for zoom-tech / shared block contexts) andfrontend/page.html'spp_blockmacro (for content pages) so the dynbg appears wherever containers paint. - Per-template customize panels (Templates admin) —
bg_dynamic_keystored alongside the existing per-templatebgcolour override insideSiteSetting.frontend_template_settings_json. Picker added to the customize panel's Background fieldset for every template kind (meeting / event / story).tpl_dynbg_keyplumbed through everyrender_template(...)call site inapp/frontend.py; each entity-detail partial addsfe-dynbg-hostto its root<section>and includes the partial: 4 meeting templates (classic,card_stack,magazine,minimal), 4 event templates (classic,poster,timeline,minimal), 5 story templates (anthology,journal,letter,magazine,paper). - Contact page — refactored to consume the same primitive from the start. Replaced ~50 lines of bespoke
.fe-contact-bg/.fe-contact-blobCSS withfe-dynbg-host+aurora-blobsinclude. Proves the abstraction by deleting all the duplicated blob CSS.
Added — Contact Us page (frontend) + Contact Form admin
A complete public
/contactflow: visitor-facing page with a Cloudflare-Turnstile-protected form, server-side validation + email notification, and an admin inbox for the persisted submissions.Public surface
/contactroute inapp/frontend.py— gated onSiteSetting.contact_form_enabled(404s when off). Reuses the existing site-wide Turnstile config; no separate keys needed./contact/submitroute — validates required fields, runs the Turnstile check, persists aContactSubmissionrow, and sends the message to the configured recipient. Recipient resolution falls throughcontact_form_to→pic_email→access_request_toso an install with only the dashboard PIC email set still routes mail somewhere sensible.Reply-Toheader set to the visitor's email — admins reply to the notification from their inbox and the reply goes straight to the form submitter without copy-pasting addresses. Implemented via_send_with_reply_to()(lightweight twin ofmail.send_mailthat supports custom Reply-To); falls back tosend_mail()on transport error so a customised mail layer doesn't lose the email path.- Honeypot field — hidden
name="website"input. Non-empty submission silently redirects with the success flash (so bots can't tell their submission was rejected) and skips both the DB write and the email. templates/frontend/contact.html— two-column hero on desktop (eyebrow + heading + Markdown intro + auto-populated PIC contact channels on the left, glassy form card on the right). Single column on mobile. Reuses the.fe-submission-formfield chrome so inputs stay visually consistent with/submissionform. Per-channel PIC visibility toggles let admins surface email-only / phone-only combinations without clearing the dashboard PIC fields they still want elsewhere in the portal.
Schema + migrations
ContactSubmissionmodel —name,email,phone,subject,message,ip_address,is_read,is_archived,archived_at,email_sent,email_error,created_at. MirrorsAccessRequest's read/archive pattern so the admin UX feels familiar.- New
SiteSettingcolumns —contact_form_enabled,contact_form_to,contact_form_heading,contact_form_subheading,contact_form_intro,contact_form_success_message,contact_form_submit_label,contact_form_subject_required,contact_form_show_phone, plus three granular PIC visibility toggles (contact_form_show_pic_name/_email/_phone). All auto-migrate via_migrate_sqlite. /contactadded to the page-creation reserved-slug set so an admin-authored Page can't shadow the public route.
Admin
- Sidebar entry —
Contact Formunder the Admin section (admin-only). Live unread count badge that mirrors the dashboard widget. /tspro/contact-form— Active / Archived tabs (matches Access Requests UX). Each row shows the message inline with mailto/tel links, email-delivery status badge, and Mark read/unread / Archive / Restore / Delete actions. Unread rows highlight with a brand-blue left edge.- Forms admin integration — Contact Form registered in
app/forms_registry.py. Settings page at/tspro/frontend/forms/contact(lives under Web Frontend → Forms alongside the existing Submission Form). Page heading / subheading / Markdown intro and granular PIC toggles moved to the Templates admin's Contact-us section so form mechanics (recipient, fields, success message, bot protection) and look-and-feel (page copy, PIC panel) live on their respective surfaces.
Added — Sidebar unread badge + Contact Form dashboard widget
- Live unread count in the global context-processor —
unread_contact_countcomputed once per request alongsidepending_access_count. Sidebar badge in_sidebar_nav.htmlmirrors the Access Requests pattern (warn-tinted bubble with the count). - Dashboard widget
contact-form— list of up to 6 unread submissions with thedash_show_contact_formper-user toggle (default on). Quiet "No unread messages — inbox is clear" empty state when the inbox is empty; warn-tinted count badge in the heading when there's something to read. User.dash_show_contact_formcolumn added (auto-migrates).DASHBOARD_WIDGET_KEYSextended to include the new key so drag-reorder honours it.
Changed — Standardised dashboard widget chrome
- New
templates/_dash_widget.htmlmacro — single source of truth for the draggable card /card-head/ "View all →" recipe used by every list-style dashboard widget. Caller does{% call dash_widget(key='foo', title='Foo', view_all_url=…, badge_count=count) %} <ul class="list">…</ul> {% endcall %}and the wrapper chrome is identical to every other widget. Optional kwargs:view_all_label,badge_count(warn-tinted nav-badge in the heading),badge_title(tooltip),wide(full-row variant). - Five widgets retrofitted to use the macro:
meetings,libraries,files,deletions, and the newcontact-form. Three structurally-bespoke widgets (server-metrics2-column panel,currently-onlineexternal partial,access-requests2-block grid) deliberately stay on their own layouts; the macro doc-comment notes when to opt out. - Visual standardisation prevents future drift — adding a new list-style widget now picks up the canonical chrome by construction. The contact-form widget originally invented its own bespoke
.contact-form-card/.contact-form-card-alertclasses; that CSS was deleted in favour of the macro so every widget reads as part of the same family at rest.
Changed — Stories detail polish
- Summary stripped from every detail template —
paper,letter,journal,anthology, andmagazineno longer renderstory.summary. The summary stays scoped to list templates as the at-a-glance excerpt; detail pages now read title → byline → body without a redundant deck paragraph repeating what the body's first line already says.
Magazine detail — full restructure
- Smooth hero gradient — the previous bottom-anchored overlay panel left a visible seam where the gradient met the untouched image. Replaced it with a separate
<span class="fe-story-mag-hero-shade">covering the entire hero with a multi-stop ramp (rgba(0,0,0,0)at 0–35% →.15at 55% →.55at 80% →.85at 100%). The upper image area is now genuinely transparent and the fade into dark is continuous rather than stepped. - Sidebar removed — dropped
.fe-story-mag-asideentirely. Body is a single 720px column for an editorial-magazine reading flow rather than a marketing-card layout. The author bio (when set) renders as an inline brand-blue-bordered<aside>near the bottom of the article. - "All stories" link moved into the body — out of the hero overlay (where it sat on top of the photo) and into the top of
.fe-story-mag-roomstyled in page text color. Reads as part of the article chrome, not overlaid signage. - Byline + published date moved into the hero — under the title in
.fe-story-mag-hero-meta(e.g. "By Joe S. · March 1, 2025"), with a subtletext-shadowso it stays legible over any featured image. The body's old meta-bar now only carries "Clean since" when present. - Hero image upgraded to thumb=1080 — uses the new thumbnail pipeline at the highest allowed size, so even the hero-bleed image is content-cached rather than the multi-MB original.
Stories list magazine
- "Stories of recovery" eyebrow removed from the page header — title stands on its own.
- Hero card eyebrow —
Now reading→Latestfor non-featured top stories.Featured storyis still used when the row'sis_featuredis set.
Added — Server-side thumbnail pipeline for story featured images
Pages that show story featured images in lists (admin stories table, public
paper-stack/manuscript/broadsheet/magazinelayouts) used to load the multi-MB hero original on every reload. Wired up a lazy-generation thumbnail pipeline so list views fetch fitted-into-<size>x<size>JPEGs / PNGs / WebPs instead.app/thumbnails.pyensure_thumb(filename, size)— lazy-generates a thumbnail next to the source file inUPLOAD_FOLDER(filename convention:<base>_thumb_<size>.<ext>) and returns its path. Subsequent calls hit the cached file. Allowlisted sizes:(120, 240, 400, 720, 1080)so abusive query strings can't fill the disk with arbitrary sizes.- Pillow integration — honors EXIF rotation via
ImageOps.exif_transposeso portrait photos don't render sideways. Flattens RGBA / LA / palette-indexed sources onto white when re-encoding to JPEG. JPEG quality 82 progressive; WebP quality 82; PNGcompress_level=6. SVG / GIF sources are skipped (caller falls back to the source). cleanup_for(filename)— deletes every cached thumb across all allowlisted sizes when a source image is retired. Wired into_cleanup_retired_assetinroutes.pyso replacing or deleting a featured image takes its thumbnails with it.- Threading — a module-level
_LOCKserialises generation across concurrent gunicorn workers so two requests for the same(filename, size)don't write the same file twice. Half-written thumb files are unlinked on exception so a poisoned cache doesn't defeat the file-existence check on the next request. Pillow==11.0.0added torequirements.txt(was previously available transitively via WeasyPrint, but pinning it explicit prevents a silent regression if a future dependency drops it).
Image route + template wiring
/story-image/<sid>?thumb=<size>— the existingpublic.story_featured_imageroute now lazy-generates and serves a thumbnail when the query param matches the allowlist; falls back to the source for unknown sizes. SetsCache-Control: public, max-age=86400since the (uuid-prefixed) source filename is content-addressed — any change to the featured image rolls the URL anyway.- Reference-counting —
_cleanup_retired_assetextended to countStory.featured_image_filenamereferences too (was missing — would have eagerly deleted images still referenced by stories). - List templates switched to thumb URLs:
- admin
stories.htmlrow thumbs →?thumb=120 - public
paper-stack.htmlcard images →?thumb=400 - public
manuscript.htmlfloated thumbs →?thumb=240 - public
magazine.htmlhero →?thumb=720, grid cards →?thumb=400 - public
broadsheet.htmlhero →?thumb=720, column thumbs →?thumb=400 - All also got
loading="lazy"so off-screen images defer fetching. - Detail templates keep using full-size sources — single hero per page, so the bandwidth cost is one image per visit, not N.
Changed — Story edit also opens in the modal
- Modal renamed
story-new-modal→story-edit-modal. One modal handles both creating and editing. openModalextended inapp.jswith optionalsrcOverride+titleOverrideargs (consumed from the trigger element'sdata-modal-src/data-modal-titleattributes). The same[data-open-modal]handler now repoints a shared modal at per-trigger URLs, which means + New story and per-row Edit buttons all open the same iframe modal pointed at different URLs.- Iframe selector loosened —
openModal/closeModalpreviously matchediframe[data-src]for lazy-load, but the story modal repoints its iframe per-trigger viadata-modal-src(no staticdata-srcon the element). The selector is nowiframewith a guard that only setssrcwhen a target can be resolved (srcOverride || data-src); closeModal resets by id. - Stories list triggers —
+ New story/ per-rowEditbuttons / the title cell (now aposts-title-btn<button>styled as a hyperlink) all usedata-open-modal="story-edit-modal"plus a per-rowdata-modal-srcanddata-modal-title. - Per-row state-change forms — Publish / Unpublish / Archive / Restore / Delete forms inside the new-story modal pass through hidden
embed=1inputs so the post-action redirect lands back inside the embed iframe rather than navigating the modal to the full admin chrome. - Routes —
_story_embed()/_story_embed_kwargs()helpers threadembed=1through every story state-change route. Delete from inside the modal renders a tinytemplates/story_modal_close.htmlstub that auto-postMessages the parent so the modal closes cleanly even when there's no row left to redirect to. - postMessage type renamed from
story-new-closetostory-modal-close(the parent listener still accepts the legacy type for in-flight iframes so the rename doesn't break already-loaded modals).
Added — New-story popup modal
- Modal in
stories.html— added<div id="story-new-modal" class="modal modal-lg">(later renamed tostory-edit-modalonce the same modal handled editing too) with an<iframe class="settings-frame">whosedata-srcpoints at/tspro/stories/new?embed=1. The iframe lazy-loads on first open and resets toabout:blankon close so reopening always starts at a clean form. - Launch button —
+ New storyswitched from<a href="/tspro/stories/new">to<button data-open-modal="story-new-modal">. Modal panel usesheight: calc(100vh - 10vh); max-width: 1080px;and the iframe takesflex: 1 1 autoso the form has room to render without the wrapper collapsing. story_edit.htmlis embed-aware — the entiretop_actionsblock was moved into a content-resident<div class="story-edit-header">so the action buttons render in both standalone and embed modes. The header usesposition: sticky; top: 0;so Save / Publish / Archive / Delete stay reachable while the form scrolls. In embed mode the← All storieslink becomes aCancelbutton withdata-story-closethat postMessages the parent.- Embed propagation in routes —
story_new/story_edit/story_save/story_publish/story_unpublish/story_archive/story_unarchive/story_deleteall check the request'sembed=1(URL or form body) and preserve it on every redirect. After save → redirect to the edit page in embed mode so the admin can keep iterating; after delete → render thestory_modal_close.htmlstub that auto-postMessages the parent. - Parent-side handler in
app.js— newmessagelistener catches the close type, closes the story modal, and reloads the underlying stories page so any saved/deleted row reflects in the list. - base.html embed detection widened — was
request.args.get('embed') == '1', now also acceptsrequest.form.get('embed') == '1'on POSTs since the dry-run commit (and now the story-save flow when it renders the next page directly) carriesembed=1in the form body rather than the URL. Without this, post-save renders would have leaked the full admin chrome back into the iframe.
Changed — WordPress importer is now a modal
A second pass on the importer that took it from a separate full-page wizard to a modal dialog launched from the Settings → Data tab, with a much more polished sticky-header / sticky-footer flow and a loading spinner on every long-running step. Backend logic is unchanged; this is a UX rework on top of the existing wizard.
Modal launch + embed mode
- Modal in
base.html— added<div id="wp-import-modal" class="modal modal-lg">containing an<iframe class="settings-frame" id="wp-import-frame">whosedata-srcpoints at/tspro/settings/wp-import?embed=1. The iframe lazy-loads on first open and resets back toabout:blankon close, so reopening always starts at step 1. - Launch button — converted from
<a href="...">to<button data-open-modal="wp-import-modal" data-close-modal="settings-modal">. Also added a genericdata-close-modal="<id>"companion attribute to the existing[data-open-modal]click handler inapp.jsso any modal trigger can close a sibling modal first; used here to dismiss the Settings modal cleanly as the importer opens (otherwise they'd stack). - Modal sizing —
#wp-import-modal .modal-panel { height: calc(100vh - 10vh); max-width: 1180px; }and#wp-import-frame { flex: 1 1 auto; ... }so the iframe gets a tall canvas to render the wizard without the wrapper collapsing to its content height (the symptom that originally made the modal appear as a thin sliver). openModal/closeModalextensions inapp.js— set iframesrcfromdata-srcon first open, blankwp-import-frameon close. Plus a newpostMessagelistener that catches{type: 'wp-import-close'}from inside the iframe and closes the modal — wired up by the Done page's primary button (data-wp-close) so finishing an import dismisses the modal cleanly.- Embed-mode propagation —
_wp_embed_kwargs()helper threadsembed=1through every wizard redirect (Connect → Map → Dry-run → Done) so the chromeless render persists across the POST/302/GET dance. Each form also carries a hidden<input type="hidden" name="embed" value="1">and internal nav links appendembed=1viaurl_for(..., embed=1 if embed else None). - Embed detection in
base.html— widened fromrequest.args.get('embed') == '1'to also acceptrequest.form.get('embed') == '1'on POST requests, since the dry-run commit POSTsembed=1in the form body and renderswp_import_done.htmldirectly (no redirect to a?embed=1URL). Without this, the Import-complete page would leak the full admin chrome (sidebar + header) back into the modal.
Sticky header
.wp-wizard-headerwraps the action bar (back / cancel / continue buttons) and the step indicator on every wizard step. Usesposition: sticky; top: 0; z-index: 20with a panel background, hairline bottom border, and a soft shadow so it pins to the top of the iframe / page while the post list or preview table scrolls underneath.- Embed-mode bleed —
body.embed .wp-wizard-header { margin: -20px -20px 1.25rem; padding-left: 20px; padding-right: 20px; padding-top: 20px; }pulls the sticky header out to the iframe edges so its background covers the full top strip rather than leaving 20px gaps fromembed-content's padding. - Action bar relocation — every wizard template's action bar moved out of the (chrome-only)
top_actionsblock into a content-resident.wp-actionbarsitting inside the new sticky header, so the same buttons render in both standalone and embed modes.
Sticky footer (dry-run commit row)
.wp-confirm-cardis nowposition: sticky; bottom: 0; z-index: 15on the dry-run page, so the IMPORT confirmation field + Run-import button stay glued to the bottom of the iframe while the admin scrolls the preview table.- Embed-mode bleed —
body.embed .wp-confirm-card { margin: 0 -20px; ... border-top: 4px solid var(--brand); }pulls the sticky footer to the iframe edges, drops the side / bottom borders, and re-adds the brand accent as a top border (since the data-card's left-border accent isn't visible once the side borders go). - Inline confirm row — the
<label>Type IMPORT to confirm</label>now usesdisplay: flex; flex-direction: row; align-items: center; gap: .75rem;so the prompt text sits flush left of the input on a single line. The form is a 2-column grid (input on the left, Run-import button on the right). Collapses to stacked at ≤640px. - Padding —
.wp-confirm-card { padding-top: 2rem; padding-bottom: 1.1rem; }and.wp-confirm-card .data-card-head { margin-top: 2rem; }give the sticky footer enough breathing room above the orange "Ready to import" header that it doesn't read as cramped.
Loading spinner on every long-running step
- Shared partial — overlay markup + JS extracted into
app/templates/_wp_fetch_overlay.html. CSS lives inapp.css(.wp-fetch-overlay,.wp-fetch-overlay-card,.wp-fetch-spinnerwith awp-fetch-spinkeyframe). Each wizard step that has a slow form includes the partial. - Per-mode messages — forms opt in via
data-wp-fetch-formand an optionaldata-wp-fetch-modeattribute; the JS picks a tailored title + message: mode="rest"→ "Connecting to WordPress…" with the parsed host inlinemode="csv"→ "Parsing CSV…" with the chosen filenamemode="map"→ "Compiling the import plan…" (Continue to dry run)mode="import"→ "Running the import…" with a "please don't close this window" hint- Submit-button locking — disables both the submitting form's button and any external buttons that target it via
form="<id>"(e.g. the sticky-header "Continue to dry run" button submitswp-map-formfrom outside the form), so a double-click doesn't fire two requests.
Skip pill colour
- Active Skip pill is now sky-blue (
#e0f2fe/#075985light,#0c2a45/#bae6fddark) instead of muted grey. Reads as a deliberate selection that matches the colour-coded target system instead of a disabled / muted state — distinct from the deep-blue Announcements pill.
Other polish
- Plan summary tile font —
.wp-count-numswitched fromFraunces(serif) toInter(sans-serif) atfont-weight: 700,letter-spacing: -.02em, withfont-variant-numeric: tabular-numsso digits align across tiles. Applied on both the dry-run preview and the Done page. - Image status label — chip text changed from "Would download" to "Will download" — after the IMPORT confirmation it really will, and the new wording removes the conditional ambiguity.
.data-cardchrome generalised — un-scoped from.settings-pane[data-pane="data"]so the same brand-blue-left-border / icon-header / lead-paragraph / actions-row pattern is reusable; the dry-run "Ready to import" card now uses it (with an orangedata-card-headoverride since it's a destructive confirmation, not a routine action).- Activity log entry — every commit logs
wp_import.commitwith a one-line summary of the counts (e.g. "Imported 14 stories, 3 announcement(s), 0 event(s) from rest").
Removed — Legacy WP-CSV-to-Library importer
- Deleted the inline "WordPress posts → Library" form from the Settings → Data tab in
base.htmland its backingdata_wp_import_postsroute fromroutes.py(~130 lines of CSV parsing + attachment downloading + LibraryItem creation). The new wizard's CSV path covers the same use case via the broader Stories / Announcements / Events targets, so the dedicated Library-only path was orphaned. The/tspro/settings/wp-import-postsendpoint now returns 404.
Changed — Settings → Data tab refactored into uniform cards
Every section of the Data tab now wraps in a
.data-card(a.cardplus a 4px brand-blue left border, Lucide icon header, lead paragraph, optional inner two-column grid, and a trailing actions row):- All data (
{{ icon('database') }}) — full-archive Import (file + REPLACE confirm + danger button) and Export (download button) side-by-side inside the card. - Frontend bundle (
{{ icon('layout-grid') }}) — frontend-scoped Import / Export side-by-side. - WordPress importer (
{{ icon('globe') }}) — copy + Launch importer button, opens the modal. - Database snapshots (
{{ icon('save') }}) — daily-snapshot list + Snapshot now button.
The two-column inner grid (
.data-card-grid/.data-card-col) inherits the legacy.data-grid/.data-colshape but lives inside the card padding instead of fighting it. Removed all the old<hr class="settings-rule">separators since each card now stands on its own withmargin-bottom: 16px. CSS for.data-card*lives inapp.css(later un-scoped from.settings-pane[data-pane="data"]so the wizard could reuse it).Added — WordPress importer wizard
A guided multi-step importer that pulls posts out of an existing WordPress site or a CSV export and lands them in the right place — Stories, Announcements, or Events — with a dry-run preview before anything is created.
Backend (
app/wp_importer.py)- REST fetcher (
fetch_wp(site_url, user, app_password)) — paginates/wp-json/wp/v2/categoriesand/wp-json/wp/v2/posts?_embed=1with a 500-post cap. HTTP Basic auth with WordPress Application Passwords is the recommended path; anonymous fetches return only public posts. Resolves featured images via_embedded.wp:featuredmediaand authors via_embedded.author. Surfaces concrete error strings (auth failure, 404, network) so the wizard can show them without a stack trace. - CSV parser (
parse_csv(file_obj)) — accepts WP All Export's column names (Title,Categories,Content,Date,Featured Image,Author, …) or raw WordPress columns (post_title,post_content,post_category, …). Splits multi-value categories on|/;/,, parses several date formats, decodes UTF-8 with BOM and Latin-1 fallback. Caps at 2000 rows. - Stable post shape — both fetchers normalize to one dict:
{key, wp_id, title, slug, summary, body_html, categories, author_name, date, featured_image_url, is_draft, url}. Body stays as the WP-rendered HTML — Stories / Announcements / Events all already pass body through themarkdownJinja filter, which routes HTML through bleach, so WP markup round-trips to the public site without a separate HTML-to-Markdown pass. - Stash store — wizard state lives in
$TSP_DATA_DIR/wp_import/<token>.json, wheretokenis a uuid hex (validated with a strict regex on every read).stash_purge_old()drops files older than 24h on every wizard entry so abandoned sessions don't accumulate. - Plan compile + apply —
compile_plan(posts, mapping)walks each post, resolves the target table via the per-post mapping (with category-default fallback handled in the route), and reports per-target slug clashes.apply_plan(actions, dry_run)is the single code path for both the preview and the commit;dry_run=Truereturns the same{counts, rows, warnings}summary without touching the DB. Slug clashes auto-suffix-2,-3, … via an in-processused_slugsset so a single import batch can't write two rows with the same slug either. - Featured-image download (
download_image_to_uploads) — grabs the binary, sha256-hashes, and reuses the existingMediaItemrow when the hash matches. Falls back to Content-Type when the URL has no usable extension. Failures are caught per post and reported in the result'swarningslist rather than aborting the whole import.
Routes (
app/routes.py)GET /tspro/settings/wp-import— step 1, source picker. Callsstash_purge_old()opportunistically.POST /tspro/settings/wp-import/connect— step 2a, REST fetch. On success persists the stash and redirects to the map page; on failure flashes the error and stays on step 1.POST /tspro/settings/wp-import/upload-csv— step 2b, CSV parse. Same redirect shape asconnect.GET/POST /tspro/settings/wp-import/<token>/map— step 3. GET renders the map page (with a precomputedcat_countsdict so the template doesn't need Jinja list comprehensions). POST resolves the effective per-post mapping by combining the per-post overrides with the per-category defaults — explicit per-post value wins, otherwise the first non-skip category match wins, otherwiseskip.GET/POST /tspro/settings/wp-import/<token>/dry-run— step 4. GET runsapply_plan(dry_run=True). POST requires the literalIMPORTconfirmation, runsapply_plan(dry_run=False)with the image download callback, logs to the activity feed, deletes the stash, and renders the done page.POST /tspro/settings/wp-import/<token>/cancel— wipes the stash and bounces back to step 1.
All five routes are admin-only. Breadcrumb labels added for
wp_import_start/_map/_dry_runso the global breadcrumb resolver names them properly.Wizard chrome
- Stepper — four-card horizontal progress indicator at the top of every wizard page: Source → Review & map → Dry run → Import. Active step gets the primary-color treatment; completed steps get a green checkmark.
- Source picker (
wp_import_start.html) — two side-by-side cards (Connect to WordPress/Upload a CSV) plus a four-step "How this works" explainer. Forms wired straight to the connect / upload-csv endpoints. - Map page (
wp_import_map.html) — three sections:
1. Map by category — every WP category gets a row with post count + a target pillgroup (Story / Announcement / Event / Skip) styled with target-coded colors (gold / blue / green / grey).
2. Posts list — one card per post: thumbnail, title with Draft chip, byline / date / "View on WP" link, summary excerpt, category chips, and a vertical pillgroup withFrom category(default, shows the resolved target as italic muted text that updates live) plus the four explicit targets.
3. Filter bar — title/summary/category text search + category dropdown + count readout, plus four bulk-apply buttons (Map all visible to Story / Announcement / Event / Skip) that respect the active filter. - Dry run (
wp_import_dry_run.html) — large count cards for each target plus skipped / renamed / image-failed warning cards. Per-row table calls out renamed slugs with a chip and shows the image status (Would download/—). A collapsibledetailselement groups all skipped posts. The commit form requires typingIMPORT(HTML5pattern="IMPORT"on the input). - Done page (
wp_import_done.html) — same count chrome with the cards now linking into the destination admin pages (Stories / Posts). Per-row table with Edit links into each created row's edit screen so the admin can immediately tune anything that came across awkwardly.
Settings → Data
- New WordPress importer launcher card replaces the inline "WordPress posts → Library" form on the Data tab. Card chrome: blue-to-purple left accent bar, globe icon, two short paragraphs explaining the wizard, and a primary
Launch importer →button. The original CSV-to-Library importer was renamed to "Quick CSV → Library" and kept below the launcher for the legacy use case (Intergroup Minutes archive). - CSS (
app/static/css/app.css) —.data-wp-launchrules add the accent bar, single-row layout (collapses to stacked at 720px), and primary CTA alignment.
Added — Stories module
A full long-form recovery-story CMS, off by default, with its own admin section, public list + detail pages, and a catalog of paper / editorial layouts.
Model + module gating
Storymodel (app/models.py) —title,slug,summary,body(Markdown),featured_image_filename,author_name,author_bio,sobriety_date,story_date,is_featured,is_draft,is_archived, plus timestamps andcreated_by. Has its ownpublic_slug(explicit slug if set, else slugify(title)) and adisplay_datehelper that prefersstory_dateand falls back tocreated_at.SiteSettingcolumns —stories_enabled(default off),stories_required_role(defaultadmin),frontend_stories_list_template(defaultpaper-stack),frontend_stories_list_width_mode/_max_width/_padding_pct/_heading/_subheading, andfrontend_story_template(defaultpaper). Both the newstorytable (viadb.create_all()) and the SiteSetting columns (via_migrate_sqlite) are picked up on existing installs without a manual migration.- Settings → Modules toggle + role picker — new row alongside Announcements & Events. The same
module_role_pickermacro and_DYNAMIC_SECTION_ITEMSmap are extended so the sidebar entry's section (Main vs Admin) follows the configured required role. _require_stories_enabled()— the same shape as_require_posts_enabled: 404 when the toggle is off OR the user's role doesn't satisfy the configured requirement. Wraps every admin route.
Admin (
/tspro/stories)- CRUD routes —
stories(list with active / drafts / archived tabs),story_new,story_edit,story_save,story_publish,story_unpublish,story_archive,story_unarchive,story_delete. Slug edits gated to admins + frontend editors and uniqueness-resolved via a new_unique_story_slughelper that mirrors_unique_post_slug. Slug renames append rows toEntitySlugHistoryso the public detail route can 301 old URLs forward. stories.html— table view with thumbnail, title + summary, author, story date, and chip column for Draft / Archived / Featured states. Per-row actions: Edit, Publish/Move-to-Drafts, Archive/Restore, Delete.story_edit.html— blog-style form: Title, Public URL slug (admin-only), Summary, Markdown body (18 rows), Author byline + bio, Story date + Sobriety date (HTML5 date inputs), Featured-this-story checkbox, Featured image upload with the same clear / replace semantics as Posts. Top-of-page action bar carries Save-as-draft / Publish / Save / Move-to-Drafts / Archive / Restore / Delete depending on current state.public.story_featured_imageroute serves uploaded hero images so the public list + detail templates can render them without auth.- Sidebar entry — added to
_MAIN_CATALOGwithprefix:main.storyactive-kind matching; visibility wired into_is_visibleso it follows the same toggle + role gate as the routes.
Public site (
/stories,/stories/<slug>)/stories— lists every published story (drafts + archives filtered out), featured stories first, then bystory_datedesc. Layout picked fromSTORIES_LIST_TEMPLATES; container width / heading / subheading configurable via the admin Templates page. Admin's chosen layout's built-in copy is used when the heading + subheading fields are empty./stories/<slug>— single-story detail. Old slugs 301-redirect viaEntitySlugHistory. Layout picked fromSTORY_TEMPLATES. Per-template appearance overrides flow through the existingtemplate_settings/template_css_varspipeline so the global Design tokens still cascade.
Six list-page layouts (all
frontend/stories_list/<key>.html)Serif-forward typography throughout; each layout ships its own scoped CSS with light + dark variants.
paper-stack(default) — creased index-cards on a warm paper backdrop. Featured-image thumb on the left (or an ornament tile when no image is set), serif title + italic byline + summary on the right. Subtle per-card rotation, soft drop shadow, edge-fray, and a sepia-tinted image filter for an archive-of-letters feel. Featured stories get a vermilion "Featured" pin and a warmer card gradient.ledger— hand-bound ledger book aesthetic: cream paper sheet ruled with hairline blue lines, brown-banded spine on the left, marginalia-style date block (DD / MON / YYYY stack) per entry, roman-style entry numbers (№ 1, № 2, …), and double-rule masthead.manuscript— single column on textured cream stock inside a double-bordered sheet, drop-cap initial on each story preview (the first letter of the title, vermilion italic), italic byline, ❦ ornaments on the rules, and a small thumbnail floated right.broadsheet— two-column newspaper layout on aged newsprint with a halftone-style dot overlay. Big condensed serif headlines, double-rule masthead with vol / edition / date, a featured story spanning the top in a 1.5fr / 1fr grid, then a 3-column body (column-count: 3) with hairline column-rules. Featured images are grayscaled for that newsprint feel.minimal-serif— centered, generous whitespace, italic serif title, fine-print bylines, no images, no cards. Stories flow down the page like a literary index. Reads through--tpl-bg/--tpl-heading-font/--tpl-body-fontso it inherits the global design tokens cleanly.magazine— modern editorial: featured story as a 1.2fr / 1fr hero card with a 16:11 cover image, then a 3-up grid of illustrated cards. Sans-serif chrome, serif headlines.
Five detail-page layouts (all
frontend/stories/<key>.html)paper(default) — creased-paper sheet on a warm backdrop. Tipped-in featured-image plate (slightly rotated, with a caption),— A Recovery Story —eyebrow, italic serif title, italic deck, byline + display date + clean-since meta row, drop-cap on the first body paragraph, ❦ rule between the body and an "About the author" block.letter— typewriter / serif hand-typed letter on lined stock. Date in the upper-right, centered title inSpecial Elite/Courier Prime, "Dear reader," opener, indented body paragraphs, "Yours in fellowship," sign-off, the author's signature inCaveat(rotated −2deg in vermilion), and a dashed "Clean since DD MON YYYY" stamp rotated −3deg. No featured image — the focus is the writing.journal— ruled-paper journal page. Brown leather backdrop, two-column ruled margin (red verticals), 32px ruled body lines, big serif title, sobriety date as a hand-stamped triple-bordered seal in the upper-right (rotated 7deg), and a small Polaroid-style photo (rotated −1deg) when a featured image is set.anthology— literary anthology layout. Eyebrow line ("A Recovery Story · 2025"), centered italic serif title, thin rule, italic byline + meta row, single column of body copy with a drop-cap. Centered blockquotes; no featured image.magazine— full-bleed featured-image hero with the title overlaid in a dark gradient, then a meta-bar and a1fr / 280pxtwo-column reading layout: body copy on the left, stickyAuthorcard on the right with byline, Clean since / Story published facts, bio, and a "More stories →" link. Falls back to a no-hero header when there's no featured image.
Admin Templates page
- Stories list picker — same chrome as the Events / Announcements pickers. Six layout cards with thumbnails, page-heading copy override, and a container-width fieldset (boxed / full + max-width / side-padding). Saves via a new
frontend_stories_list_template_saveendpoint. Hidden when the Stories module is off so the page doesn't surface dead UI. - Story detail picker — five layout cards (paper / letter / journal / anthology / magazine) with their own thumbnails, saves via
frontend_story_template_save. - The route still emits
STORIES_LIST_TEMPLATES/STORY_TEMPLATESand the active keys to the template even when the module is off (just the markup hides), so flipping the toggle on resurfaces the picker without a refresh of the templates context.
Added — Icon block
- New block type
iconin the page builder — drag from the "Add blocks" palette like any other block. Registered in_PAGE_LAYOUT_BLOCK_TYPES,_PAGE_BLOCK_CATALOG,_blank_page_block,_block_preview, plus the JS counterparts inblock_editor.js,page_structure.jsBLANK_DATA, and the structure card's_PAGE_BLOCK_LABELSso it round-trips through layout presets, drag-drop, the orphan bin, and the structure tree like every other content block. - Edit modal fields — Icon picker (opens the shared
icon-picker-modalalready used by nav-link / footer / homepage icons; full Lucide catalog + custom uploads + search), Size slider (8–256 px), Alignment toggle (Left / Center / Right), Colour picker with the standard Same / Auto / Manual dark-mode triplet, optional click-through Link URL + "Open in new tab" checkbox. - Live visual preview in the edit modal — renders the actual SVG (or
<img>forcustom:Nicons) at the chosen size + colour. Lazy-loads the Lucide catalog fromvendor/lucide/icons.json(cached at module scope so multiple icon blocks share one fetch) and re-renders on every relevant change: picker save, size slider drag, picker modal's own size slider, colour picker save / clear / mode switch. Shows a checkered transparency backdrop so soft-coloured icons stay visible. Below the visual, a monospace meta line shows the exact stored values (<icon-name> · <size>px · <color>). Stale refs surface as "Unknown icon: …" so deleted custom icons don't render as a silent blank. - Public render — both
_blocks.htmlandfrontend/page.htmlemit<div class="block-icon block-icon--<align>">withfont-size+color+--tsp-color-dminline styles. The icon's SVG inherits size from1emon.icon, so size scales correctly and the existing global dark-mode rule swaps in the dark variant underhtml[data-theme="dark"]. - Icon-picker modal embedded in the page-edit template — the modal lives at the bottom of
frontend_page_edit.html(was missing entirely) so the BlockEditor's "Pick an icon…" trigger has a target to open. Samedata-catalog-url/data-custom-list-url/data-custom-upload-url/data-custom-delete-urlwiring as the other 4 templates that already host their own copy.
Added — Lucide catalog more than doubled (125 → 256 icons)
Eight new categories appended to
vendor/lucide/icons.json, all using the sameviewBox="0 0 24 24"+currentColorstroke convention as the existing set so they layer in seamlessly via_load_catalog()+ the picker modal grid:- Technology (26) — laptop, smartphone, tablet, monitor, server, cloud, cloud-upload, cloud-download, database, cpu, hard-drive, wifi, wifi-off, bluetooth, battery, battery-charging, power, plug, terminal, package, box, mouse, keyboard, printer, scan, qr-code.
- Weather & Nature (17) — cloud-rain, cloud-snow, cloud-lightning, cloud-sun, snowflake, umbrella, droplet, droplets, wind, thermometer, sunrise, sunset, leaf, flame, sparkles, tree-pine, mountain.
- Travel & Transport (14) — plane, plane-takeoff, plane-landing, train-front, car, bike, bus, ship, rocket, anchor, fuel, navigation, route, tent.
- Food & Drink (10) — coffee-cup, utensils, pizza, wine, beer, ice-cream, apple, cake, cookie, salad.
- Editing & Format (17) — bold, italic, underline, strikethrough, align-{left,center,right,justify}, list-ordered, indent, outdent, quote, scissors, rotate-cw, rotate-ccw, undo, redo.
- Shapes & Symbols (15) — triangle, hexagon, octagon, diamond, pentagon, asterisk, slash, percent, equal, divide, plus-circle, minus-circle, x-circle, hash, infinity.
- Health & Activity (11) — heart-pulse, pill, syringe, stethoscope, dna, activity, dumbbell, trophy, medal, footprints, running.
- More UI (21) — expand, shrink, maximize-2, minimize-2, trash-2, history, bookmark-plus, bookmark-check, lightbulb, sticker, ticket, puzzle, coins, wallet, hand-coins, calculator, calendar-clock, calendar-check, graduation-cap, school, newspaper.
The 6 "Content blocks" icons added in the prior pass (
heading,type,list,code,mouse-pointer-click,panel-left) are also new — they were referenced by block-catalog entries but missing from the catalog, so the corresponding block tiles previously rendered blank.Added — New-page modal flow
- "New page" button on
/frontend/pagesopens a modal in place instead of navigating to a blank edit screen. Modal asks for the page title (required) + a starting layout (Custom by default, or any seeded preset / saved custom layout — same card grid the edit-screen layout picker uses). Submitting POSTs to a newfrontend_page_createroute which mints the row, stamps the chosen layout's blocks (or starts blank for Custom), generates a slug with the same RESERVED-set + uniqueness loop the save route uses, and redirects into/frontend/pages/<id>/edit. The active layout structure card is fully populated by the time the admin lands on the edit screen — no more "save first, then choose a layout" two-step flow. - Legacy
/frontend/pages/newURL bounces back to/frontend/pagesso any old bookmark hits the modal flow. frontend_pagesroute now passespage_layoutsto the template so the modal can render the layout-card grid.
Fixed — New-page save 500 (
NOT NULL constraint failed: page.slug)frontend_page_savewas assigningpage.titleandpage.slugAFTER its slug-uniqueness query, butPage.query.filter(...)triggers an SQLAlchemy autoflush BEFORE running. With a brand-newPage()already added to the session (viadb.session.add(page)), the autoflush attempted to insert a row with NULLslug+ NULLtitleand crashed on the NOT NULL constraint. Fix: assignpage.title/page.template/page.is_published/page.blocks_jsonup front, then run the slug-uniqueness probe insidedb.session.no_autoflush:(defense-in-depth so a future field addition can't re-introduce the race), assignpage.slug, THEN add to the session. New pages now save cleanly on first submit.
Added — Active layout structure card on new pages
- Removed the
{% if page %}gate around the active-layout structure card, orphans card, and block palette infrontend_page_edit.htmlso they render on/frontend/pages/newtoo. Was originally moot because the New-page flow now uses a modal (above), but the change still benefits any admin reaching the legacy edit screen with an unsaved page.
Added — Content Pages
A full content-page CMS, accessible via Web Frontend → Pages in the admin and served at
/<slug>on the public frontend.Page admin
Pagemodel (app/models.py) —slug,title,blocks_json,template(standard / wiki),is_published, plus the per-page settings listed below. Boot-time additive migrations cover existing installs.- CRUD admin — list view, new-page form, edit form, delete with confirm. Slug auto-derives from title and is guarded against collisions with reserved frontend routes (
/meetings,/events,/library, etc.). - Public render route — catch-all
frontend.page_detail(slug)resolves a published page and emits the showcase layout (or wiki layout with a TOC sidebar) via the shared_blocks.htmlmacros.
Showcase rendering on
/<slug>- Two-column hero (image + title left, lead-paragraph card right) when the first section starts with an image; centered single-column hero otherwise.
- A new
regex_searchJinja filter detects single-link paragraphs ([text](url)) and auto-promotes them to tokenized.fe-btn-primaryCTA buttons — admins author CTAs as plain markdown. - Unordered lists render as numbered step cards (
.fe-pp-steps) with hover lift + accent-tinted border. - Hero card is a flex column with a uniform
1remgap so lead → CTA → supporting copy reads at a consistent rhythm.
Per-page background
- Upload (PNG, JPG, WEBP, GIF, SVG) → served via
/pub/page-bg/<page_id>(cache-busted byupdated_at). - Cover mode (full-bleed) and Tile mode with a 25-400 % scale slider — same 120 px base used in the live render and the admin live-preview pane so they read 1:1.
- Live preview with a checkered backdrop for transparent SVGs.
- Dark-mode dim —
.fe-pp-has-bg::afterpaints argba(0,0,0,0.55)veil over cover backgrounds (0.45for tile) so admin-uploaded photos / patterns don't blow out the dark theme.
Per-page hero typography
- Main heading + sub-headings each take a color (color picker with editable hex text input, two-way bound, blank = inherit theme), alignment (Auto / Left / Center / Right), and font (any vendored or admin-uploaded
CustomFont). - Hex inputs accept
#rgb,#rrggbb, or unprefixed forms — three-digit shorthand auto-expands; invalid input flags red without clobbering the saved value; blur snaps back so the field never lies.
Layout picker (homepage / footer pattern)
- Five seeded
kind='page'layout presets — Blank, Article, Marketing landing, FAQ, Two-column showcase. Selecting a preset copies fresh blank content blocks of the preset's types intopage.blocks_json. - "Custom layout" tile opens the same drag-and-drop builder the homepage and footer use; reuses
frontend_custom_layout_save / update / delete. - Active layout structure card — pills for every block in the page's content, each opening the Edit layout modal scrolled to the matching block (block IDs propagated through
data-page-block-id; clicked block flashes with a soft yellow halo via.be-block-flash). - Page settings, Background, and Hero typography sit in their own cards below the structure card.
Added — Block Editor
- Button block (
type: 'button') — first-class CTA with label, URL, "Open in new tab", alignment toggle, and a Style toggle (Primary / Secondary / Custom). Custom mode reveals a panel with bg / hover bg / text / hover text / border / hover border / shadow color pickers; partial configurations fall back to the theme's.fe-btntoken recipe. - Container block (
type: 'container') — recursive layout primitive holding nested children. Settings (collapsible<details>panels): - Layout — Display (Flex / Grid), Direction, Wrap, Grid columns (
grid-template-columnssyntax), Justify, Align, Gap. - Spacing & width — Padding (CSS shorthand), Width (Boxed / Full), Max width.
- Background & border — Background color, Border width / style / color, Rounded corners, Box shadow preset (None / Subtle / Medium / Large / Dramatic).
- Hover — Background, Border color, Shadow override, Hover lift. Each is opt-in via per-property classes (
block-container--hover-bg,--hover-border,--hover-shadow,--hover-lift) so untouched hover values don't revert resting styles. - Recursive editor — refactored
renderBlocksList(blocks, parentId)shared between sections and containers; cross-parent drags resolved viadata-blocks-parentIDs and afindBlocksByIdwalker. Sortable groups blocks across the whole tree.
Changed
- Block-editor toggles (button-block style/align, container width-mode, page heading-align, page bg-mode) now carry the existing
view-toggleclass so the active pill picks up the accent-filled visual feedback. - Style / align / color-clear actions dispatch a bubbling synthetic
inputevent from a relevant element so the sticky#fe-save-bardirty-tracker (which listens for nativeinput/changeon the form) flips to "Unsaved changes" on click-only state mutations. - Sticky save bar's
new FormData(form)path now picks up the editor's serialized JSON via aformdataevent listener — companion to the existingsubmitlistener that handled the in-form Save button.
Fixed
- Color pickers were unclickable on initial load — split into a hidden
name=input (form payload) and a separate visual swatch + editable hex text input that stay clickable always; the visible inputs are never disabled. - Saving with the bg upload wiped page content — the route only updates
blocks_jsonwhen the form carries a non-empty, valid value; mount/serialize failures leave the existing column untouched and surface aconsole.warnso the path stays diagnosable. - Style / align toggles in button blocks weren't pressing — class-toggling worked, but
.btn.activeonly had visual styling inside.view-toggle. Toggle divs now carry that class and use event delegation for resilience after re-renders. - Hex var() fallbacks were invalid — container hover styling now gates on per-property classes instead of empty
var(…, )fallbacks, so unset hover values don't revert the resting style toinitial.
Internal
- New Jinja globals —
font_stack(key)(resolves a font key to its full CSS family stack),regex_searchfilter (used by the showcase rendering's link-only-paragraph detection). - Public
/pub/page-bg/<page_id>route serves page backgrounds;Page.is_publishedgates access. - Admin block-editor styles (
.be-button-*,.be-container-*,.page-bg-*,.page-typo-*) live inapp.css; public-facing showcase + container styles infrontend.css.
Changed — Page admin polish
- Pages list view (
/tspro/frontend/pages) — switched the<table>from the unstyleddata-tableclass to the project's standard.tbl(setswidth: 100%, gives every cell12px 8pxpadding with bottom borders, styles headers as small uppercase muted labels). Status pills now usepost-chip post-chip-online(Published, teal) andpost-chip post-chip-draft(Draft, slate) — the previouspill/pill-successclasses had no CSS anywhere in the project, so everything was crammed flush-left as plain text. Layout column wrapped in<span class="chip">; URL slug + Updated cells getnowrap; date picks upmuted. Removed the redundant inlinestyle="display:inline"on the delete form (.row-actions formalready handles it). - Page edit screen — title banner above the first card so the admin always sees which page they're editing (eyebrow "Editing page" + title + slug code chip + Draft chip when unpublished). Eight backend tokens (
--panel,--text,--border,--muted,--panel-2) so it adapts to dark mode automatically. - Hero typography card removed — per-block typography lives on the heading / paragraph / container blocks themselves now; the redundant page-level color / alignment / font controls are gone, along with their JS handlers and CSS. The save route was also tightened to only touch
heading_color/subheading_color/heading_font/subheading_font/heading_aligncolumns when those fields are explicitly posted, so legacy values on existing pages survive a save round-trip from the slimmed-down form. - Active-layout structure card — graphical tree (
structure_page_treemacro in_frontend_structure_card.html) replaces the flat row of pills. A 2-column container inpage.blocks_jsonrenders as a real 2-column row with the per-column pills inside the right cell; a single-column container renders as a labeled "Container · single column" row with its child pills stacked; section titles render as soft uppercase dividers. Driven by_page_active_tree(page)inroutes.py, which walksblocks_jsonand builds a[{type:'columns'|'block'|'section_label', …}]shape;_container_columnsparsesgrid-template-columns: repeat(N, …)/ whitespace-separated tracks and inlines one level of nested-container children so a 2-col outer container with two inner containers shows the inner blocks per column instead of opaque "Container" pills. - "Edit layout" button at top-right of the structure card now opens the layout PICKER (the prebuilt grid + Custom-layout tile) instead of the drag-drop builder. The structure-card macro grew an optional
picker_modal_idarg; when supplied, the button usesdata-open-modal(the standard modal handler) instead of thedata-edit-layoutshortcut. Also added a dataset fallback in the layout-builder JS handler (feLayoutBuilderinapp.js) so the standalone-button path works when no.template-cardancestor is present — matches the fallback the footer's handler already had. - Per-block focus modal — clicking any pill in the structure card opens the BlockEditor modal in focus mode: only the clicked block (and its container ancestry) is visible, with a "← View all blocks" button in the modal head to escape back to the full layout editor. The bottom redundant "Edit layout" button is gone — pills cover the per-block path, the top-right button covers the layout-switching path. CSS-driven via
.fe-page-edit-modal.is-focus-modewhich hides every.be-blocknot on the focused-path; path containers drop their head + settings panels so the focused descendant is the only thing the admin sees.
Changed — Layout system
- Layout-apply is non-destructive AND idempotent.
frontend_page_layout_savenow stamps each top-level layout entry as its OWN untitled section in the page (so a layout[split, container]produces two sections — a 2-column hero + a single-column block area). Existing UNTITLED (structural) sections at the top of the page are stripped and replaced with the fresh shell — re-clicking "Use this layout" yields the same shape, no more duplicating 2-column rows. TITLED sections (admin's content like "Chat Conduct Policy") are always preserved, ordered after the shell. Convention: untitled = layout/structural, titled = user content. splitblock is a universal layout primitive — added to_PAGE_BLOCK_CATALOGso the same Two-panel-row block the homepage offers is now in the page admin's layout-builder palette. When applied to a page,splitexpands into a real 2-columncontainer(display: grid,grid_columns: "1fr 1fr") holding two child containers, one per panel. New_instantiate_preset_entry(entry)helper inroutes.pyhandles the expansion + recurses intocontainerchildren so a layout authored with a Container holding e.g. a Heading + Paragraph stamps that exact tree onto the page.- Container is a real drop-zone in the layout builder — drag any other block into it; the chrome shape mirrors split (head + drop-zone), one full-width drop area instead of two side-by-side panels. Serializer + hydrator round-trip the nested
blocksarray._normalize_blocks(allowed_types)recurses intocontainer.blockswith the same whitelist as the parent. Splits are blocked from being placed inside a container's drop-zone (keeps the tree shallow); container-inside-container is allowed. - Two-column showcase preset rebuilt — was a flat
[image, paragraph, button, paragraph]that relied on the (now-deleted)pp_hero_splitrenderer auto-magic to look like 2 columns. Now[split{left:[image], right:[heading, paragraph, button]}, container{blocks:[heading, paragraph, list]}]so it stamps a real 2-column hero + a single-column area underneath ready for a guidelines / cards / policy block. - Custom layout save accepts
kind=page.frontend_custom_layout_saveand_updatewere rejecting page-kind layouts with "Unknown layout kind: page" because they only knewhomepage/footer. Added apagebranch +_PAGE_LAYOUT_BLOCK_TYPESwhitelist; parameterised_normalize_blocks(allowed_types=...)so the same shape-recursing function serves all three.
Changed — Public page renderer (
frontend/page.html)- No more auto-injected page title. Removed every site that auto-rendered
page.titleinto the public page: thepp_hero_splitmacro (deleted), the wiki-mode header<h1>(deleted), the empty-page fallback<h1>(deleted). Page now renders ONLY the blocks the admin placed in the layout — every visible element traces back to a block inblocks_json. The page title remains in the<title>browser tab and the admin's edit screen. - No more auto-split-into-hero magic. The
pp_hero_splitmacro used to detect an image in the first untitled section and rewrite the section into a fake 2-column hero with auto-promoted lead paragraph + auto-injected<h1>. With the new layout system using explicitcontainerblocks for columns, that auto-magic is redundant and confusing — the structure card couldn't see through it. Stripped along with the_link_only_reCTA-detection regex (paragraphs whose entire content was a single markdown link no longer auto-promote to primary buttons; admins use a Button block). - No more auto-numbered-step-card promotion. Unordered list blocks used to render as a numbered
<ol class="fe-pp-steps">with hover lift + accent-tinted border. Now they fall through to the standard_blocks.htmlrenderer which honoursd.ordered—<ul>for unordered,<ol>for ordered. pp_sectionis now a straightforward "render section title (if set) + blocks in order"; thepp_block(b, is_lead=False)parameter is gone.
Fixed — Dark mode
- 15 sites in
app.cssreferenced undefined CSS variables (var(--surface, #fff),var(--surface-alt, #f8fafc),var(--surface-2, #f8fafc),var(--ink, #0f172a),var(--ink-muted, #64748b)) with hardcoded light-mode hex fallbacks —--surface*and--ink*are not defined in any theme, so the fallbacks always rendered, leaving the BlockEditor / focus modal / page-bg preview / button colour pickers / container colour pickers / meeting-list filters / location lines / etc. with light backgrounds + dark text under the dark theme. Replaced every instance with the real theme tokens (--panel,--panel-2,--text,--muted). - BlockEditor visual hierarchy reworked so blocks read as elevated cards in both light + dark mode:
.be-sectionuses--panel-2(slightly tinted from modal panel),.be-blockuses--panel(clean elevated card),.be-block-headuses--panel-2(sub-zone tint). Inputs / textareas / selects in.be-bodynow explicitly set--panelbackground +--textcolor +--borderborder + 6px radius + 6/10px padding so they stop rendering with browser-default white-on-white in dark mode..be-section-titlebecomes a proper inset input with the same chrome. is-invalidcolour states (container colour text, button colour val) usevar(--danger)withcolor-mix(in srgb, var(--danger) 12%, transparent)for the tint, instead of hardcoded#ef4444/rgba(239, 68, 68, 0.08)/#b91c1c.
Added — Tooling
scripts/restore_chat_page.py— one-shot recovery for the seeded/chatpage if a destructive layout-apply (or any other event) wiped its content. Rebuildspage.blocks_jsonto match the showcase layout's stamped shape with the original WhatsApp content filled in: section 1 (untitled, 2-column hero) gets the WhatsApp logos image + intro paragraph + "Join us on WhatsApp" CTA + community-chats follow-up; section 2 (untitled, single-column container) gets the Chat Conduct Policy heading + intro + bulleted guidelines + closing paragraph with the privacy link. Mirrors_blank_page_block("container")["data"]so re-applying the showcase layout in the admin is a no-op for the structural shape. Idempotent. Run from the host:python3 scripts/restore_chat_page.py.
Added — Page width formatting
- Boxed / Full-width toggle on every page, with a slider for max-width when boxed (640–1600 px) and a side-padding % when full-width (0–20% viewport gutter). Three new
Pagecolumns (width_mode,max_width,full_padding_pct) with matching_migrate_sqliteentries. The form lives in a new "Page width" card directly beneath Page settings; sliders show their live value via<output>; the inactive control's label hides when toggling so the panel stays focused. Public renderer applies the selected mode as inline style on.fe-pp-shell(max-width or padding-left/right vw). The hardcodedmax-width: 760pxon.fe-pp-shellwas also removed — it was overriding the new inline style.
Changed — Wiki mode is now a layout, not a page setting
- Standard / Wiki layout-style toggle removed from the page edit form. Every page is
template = 'standard'— the column is kept for back-compat but the save route always writes that value. Public renderer's wiki branch deleted;frontend/page.htmlhas a single render path now. toc_sidebarblock — new universal block type that renders a sticky on-page table of contents, built at request time from every Heading block on the page (_collect_page_headingswalks containers too). Settings on the block: title (default "On this page"), max heading level to include (h2..h6), sticky toggle, sticky top-offset px. Heading blocks now stampid="<slug>"so the TOC links work; duplicate heading text gets-2/-3suffixes. Hides on viewports under 880 px to avoid sticky-on-mobile UX.- Wiki layout preset (
page-wiki) — seeded prebuilt: asplitwith two heading+paragraph pairs on the left and atoc_sidebaron the right. The legacy wiki-template path renders identically by selecting this preset.
Added — Per-block typography
- Shared typography panel in the BlockEditor exposing Font family, Font size, Weight (Theme default / 400 / 500 / 600 / 700 / 800), Colour (swatch + hex + clear), Alignment (Auto / Left / Center / Right / Justify), Line height. Wired into Heading, Paragraph, and List blocks. Each setting saves to the block's
dataand renders as inlinestyleon the public element — empty values short-circuit so unedited blocks stay clean HTML. - Heading levels expanded to H2..H6 (was H2..H5).
- List block — Marker style dropdown (Theme default / Disc / Circle / Square / Numbered 1. / Lower-alpha a. / Upper-roman I.) — applied as
list-style-type. Plus the shared typography panel. - Image block — Width slider (20%–100%), Alignment toggle (Left / Center / Right), Caption colour, Caption size. Caption styling applies as inline style on the
<figcaption>. - Font dropdown options are populated from
window.tspFonts, injected by the page-edit template at boot fromfrontend_fonts()+font_stack(key)— new admin-uploadedCustomFontrows show up automatically.
Added — Drag-drop composition in the main view
- Block palette (
structure_block_palettemacro) sits below the active layout structure card. Each tile (Two-panel, Container, Heading, Text, Image, Button, List, Callout, Video, Code, Divider, Wiki sidebar) is HTML5-draggable. Drop into any structure-card zone → mints a fresh block from the catalog's blank defaults with a newidand inserts it. The Two-panel tile expands into a 2-column grid container with two empty inner containers (matches the showcase preset's stamping logic). - Sortable.js zones throughout the structure card — every column cell, single-block row, and the orphan bin is a drop target (single shared group
be-zone). Drag any pill within a zone to reorder, between zones to move (column → orphan, orphan → column, column-A → column-B, etc.). On every drop, JS walks the DOM and reconstructssections[]from each pill'sdata-block-payload, respecting which zone it landed in (round-tripping inner-containerdata.blocksper column for the showcase pattern). The new JSON writes to#page-blocks-jsonand dispatches aninputevent so the sticky save bar lights up. - Top-level drag-drop — the rows container (
.fe-page-structure-rows) is itself a drop target (data-be-zone="root"). Dropping a Container or Two-panel palette tile at the top level mints a new row at the cursor position; dropping a leaf-type tile creates arow-singlesection. Drop position is computed fromevent.clientYagainst existing rows so the new row lands above whichever row's midpoint is below the cursor (or appended if past the last row). An empty-state placeholder ("Drop a Container or Two-panel here…") appears when the active layout has no rows. - Row reorder — separate Sortable instance on the root zone (group
be-rows,pull: false,put: false) so pill drags never trigger row drags and vice versa. Drag handles:.fe-page-structure-row-label(multi-column rows) and a new.fe-page-row-handlegrip (row-single rows). On drop,syncStateFromDomrebuildssections[]in the new row order. - Hover preview popover on every pill (active layout + orphan bin). Server-side
_block_preview(b)produces a typed payload ({kind: 'text'|'image'|'list'|'code', label, text, src, subtext}) stamped onto each pill asdata-preview. Floating fixed-position card renders text excerpts, image thumbnails, item counts, button label/URL — auto-positioned, viewport-clamped, auto-hides on mouseout/focusout. - Always-expanded settings panels in BlockEditor — every
<details>(Layout / Spacing & width / Background & border / Hover / Typography) opens by default so settings are visible without an extra click. - Container/2-col Settings buttons in each row's label gutter — opens BlockEditor focused on that container so flex/grid/spacing/visual/hover panels are reachable in one click.
Added — Orphan bin
- Layout switch is now non-destructive of edited content. When applying a new layout, blocks displaced from the previous layout's untitled (structural) sections aren't wiped — they're swept into a special
_orphans=truesection and surfaced in the editor as a separate "Unplaced blocks" card. The admin drags them back into the new layout's columns or rows when ready._block_has_contentfilters out empty placeholders so the bin doesn't collect noise. Existing orphan-bin contents survive across multiple layout switches (orphans of orphans). Orphan sections never render publicly.
Added — Remove buttons (with auto-orphan)
- × delete on every pill (subtle by default, fades in on pill hover/focus, turns red on its own hover). Click →
confirm("Remove this block?")→ DOM removal →syncStateFromDom. The pill markup changed from<button>to<div>so the × can be a real nested<button>(avoids invalid HTML), and a delegated click handler keeps the click-to-edit/modal-open path working for both server-rendered and dynamically-added pills. - Remove on container / 2-col rows — sits in the row-label gutter alongside Settings. If the row holds child blocks, the confirmation message shows the count and the children move to the orphan bin (preserving full payloads, no data loss); if empty, simple confirm + remove. Row-single rows get a square × icon-button on the right.
- Click forwarding — page-edit IIFE exposes
window.focusPageBlock+window.remountPageBlockEditor;page_structure.jscalls them after every structural mutation so the modal-based BlockEditor always mounts against the latest tree on next open. Server-rendered pills stampdata-pill-bound="1"once their per-element handler is attached so the delegated fallback inpage_structure.jsdoesn't double-fire.
Internal — Structure tree wiring
structure_page_treemacro consumes_page_active_tree(page)which now returns{tree, orphans}.treeentries:{type:'block'|'columns'|'section_label', …}.orphansentries: flat{t, block_id}pills._container_columnsparsesgrid-template-columns: repeat(N, …)/ whitespace-separated tracks AND inlines one level of nested-container children so the visualisation matches the public render.structure_orphans_cardmacro renders the orphan bin (hidden when empty via.is-empty); JS toggles it as orphans come and go.structure_block_palettemacro renders the always-on draggable source.- Each pill carries
data-block-payload(full JSON of the block) —syncStateFromDomwalks the DOM and reconstructssections[]purely from the pill payloads + zone context attributes (data-be-zone,data-be-parent-block-id,data-be-col-index,data-be-row-block-id).
Changed — Layout picker polish
- "Edit layout" button → "Change layout" on the structure card — matches what it actually does (open the layout picker to switch layouts).
- Custom layout is now a regular radio option in the picker grid (top of the layout list), not a separate tile that opens the drag-drop builder modal. Selecting it submits with
layout_key=custom→ existing route records the choice without stamping → user is back on the edit page where the structure card's drag-drop + block palette let them build the layout in place. The drag-drop builder is still reachable via a smaller secondary "Build a reusable layout template…" button below the picker grid; helper text clarifies it's for designing saved templates that any page can pick from this list. (Customized)badge on the structure card heading — when the page's structural shape has been edited away from what the active prebuilt layout would stamp (added / removed / rearranged blocks, or anything in the orphan bin), the heading reads "Active layout — Two-column showcase (Customized)"._page_is_customized(page, active_layout)builds a structural-shape signature from both the page and a fresh stamp of the layout (ignoring user-content fields like text / md / src / items / IDs) and compares. Customized = structural-only changes; pure content edits don't trigger the badge.- Prebuilt layout templates can ship styling overrides —
_instantiate_preset_entryextended to merge adatadict from each entry on top of the type's blank defaults (containers, splits, leaves all supported). Splits also acceptdata_left/data_rightfor per-panel styling so a layout can independently style each column. Updated showcase + wiki seeds to ship structural choices (gap, grid_columns) as overrides; the user inherits these at apply time and can edit them via the block's settings panel.
Added — Image block media browser
- Browse library / Upload new buttons next to the Image source URL input. Browse opens a dedicated picker modal showing a thumbnail grid of every image in the MediaItem catalog (PNG / JPG / WEBP / GIF / SVG / AVIF / BMP). Auto-loads from new
/tspro/files/images.jsonendpoint (paginated 200 max, optional?q=substring filter against original filename). Click a tile → sets the block'sdata.srcto/pub/<filename>, closes modal, live preview updates. Search field in the modal head filters client-side as the admin types. - Drop-zone uploader at the top of the picker modal — accepts file-picker click OR drag-and-drop (multiple files supported). Streams to existing
/tspro/files/uploadendpoint with the page's CSRF token; on success the grid auto-refreshes. If the picker was opened with a pending pick callback (admin clicked Browse to choose), the FIRST uploaded file gets auto-selected and modal closes — zero extra clicks for the "I'm uploading something fresh" path. - Upload new on the block bypasses the grid: pops the OS file picker, uploads, immediately sets
data.srcto the new file's URL. - Modal lazy-creates on first open. Lives at
<body>level so it stacks above the per-block focus modal.
Fixed — Save bar reliability + edit-modal rendering
- Newly-dragged blocks vanished on save. The form's submit + formdata handlers were unconditionally writing to the hidden
blocks_jsoninput from BlockEditor's serialised state. When the modal-based BlockEditor was never mounted (admin only edited via the structure card's drag-drop),serialise()returned null and the handlers wiped the hidden input — silently discarding everythingsyncStateFromDomhad written there. Made both handlers no-op when the editor isn't mounted, since the structure card already keeps the hidden input authoritative on every drop. - Edit modal had no controls for newly-dragged blocks. The delegated click handler in
page_structure.jsopened the modal and calledfocusPageBlockbut never calledensureEditor()to mount the BlockEditor — so the modal body was an empty div. Exposedwindow.ensurePageBlockEditor = ensureEditorfrom the page-edit IIFE; the delegated handler now calls it before focusing. TworequestAnimationFrameticks (matching the per-element handler): first to mount, second to scroll-and-focus. - Save bar didn't appear for drag-drop changes.
syncStateFromDomnow dispatchesinputTHREE ways for reliability: on the hidden input (canonical bubbling path), on the form directly (guarantees the form's listener fires even when bubbling is interrupted), and as a defensive last resort directly toggles#fe-save-bar.hidden = falseif it's still hidden a tick after the events fire. - Save bar didn't appear for changes inside a block's edit modal. BlockEditor's
notifyChange()firesinputon#page-editor-root, but that root sits inside the focused-edit modal which is rendered OUTSIDE the page-edit form — so the bubble never reached the form-level listener. Added a capture-phaseinputlistener on the modal element that re-dispatches aninputevent onto the page-edit form (which the save-bar IIFE picks up + adds the form to itsdirtyset). - "Settings" button on container rows opened a blank modal. The Settings button carries
data-page-block-id(it's the entry point for editing the container), but the click handler's overly-broad guardif (e.target.closest('button')) return;matched the button itself and bailed before mounting the editor. Tightened the guard to skip ONLY when the click landed on an inner remove button ([data-be-remove-block]/[data-be-remove-row]). Settings buttons now fall through toensureEditor()+focusBlock(id). - Heading block had no visible text input. Recent dark-mode CSS added
width: 100%to all inputs/selects inside.be-body. Inside the heading's.be-rowflex container, the level select also gotwidth: 100%, squeezing the text input. Restructured the heading editor to two separate labeled rows ("Level" + "Heading text") instead of cramming both into one.be-row. Also patched the underlying CSS so any future side-by-side layouts behave:.be-body .be-row > select { width: auto; flex: 0 0 auto; }and.be-body .be-row > input[type=text] { flex: 1 1 0; min-width: 0; }.
Changed — No invisible chrome (page styling traces to block data)
- Container + image defaults are now fully unstyled.
_blank_page_block("container")ships withpadding: "0", gap: "0", width_mode: "full", max_width: 0(was1rem/1rem/boxed/1160). A freshly-dropped Container behaves like a plain<div>until the admin styles it. Same in JS BlockEditor +page_structure.jsBLANK_DATA. Image defaults:align: ""(was'center') — figure inherits its container's text-align rather than auto-centering. - Stripped CSS-imposed chrome on the public page renderer:
.fe-pp-figure img { border-radius: 18px; box-shadow: var(--fe-shadow-lg, ...); }— every image got 18 px rounded corners + drop shadow regardless of block settings..fe-pp-figure { margin: 36px 0 32px; text-align: center; }— every figure got vertical margin + center alignment baked in..fe-pp-section { margin-top: 64px; padding-top: 56px; border-top: 1px solid var(--fe-border); }— top hairline + padding chrome between sections..fe-pp-section .fe-pp-prose { max-width: 640px; margin-inline: auto; } p { text-align: center; }— every paragraph in a section auto-centered + clamped to 640 px..fe-pp-section-title { text-align: center; }— section titles auto-centered..fe-pp-figure figcaption { color: var(--fe-ink-soft); font-size: 0.9375rem; }— caption auto-styled with muted colour + smaller font..fe-pp-has-bg .fe-pp-section { background: var(--fe-color-surface); border: 1px solid var(--fe-border); border-radius: 22px; padding: 40px 44px; }(light + dark variants + mobile media queries) — pages with a bg image auto-wrapped every section in a white card with border, radius, padding, and a 50px box-shadow on dark.- All matching dark-mode + media-query overrides removed too.
pp_container_stylesmax-width: 0pxguard — added_mw > 0check so a freshly-flipped container in boxed mode withoutmax_widthset doesn't render withmax-width: 0pxand collapse.- Mirrored to
_blocks.htmlso the shared block renderer applies the same minimal defaults. - Memory rule saved:
feedback_no_invisible_chrome.mdindexed inMEMORY.md— every visible style on a frontend page must trace back to either a Page setting or an explicit block setting; CSS infrontend.csscannot auto-apply backgrounds, borders, shadows, border-radius, text-align, auto-margins, or padding chrome the admin can't see in any edit modal. Reading-comfort defaults (font-size, line-height, theme colour) are explicitly carved out as typography rather than visual chrome.
Added — Recursive nested-container rendering
- For two-column blocks: containers can be nested inside each column. Refactored the structure tree to be fully recursive — every container at any depth becomes a
'columns'node with its ownblock_id, drop zones, and Settings + Remove buttons. Cells contain other tree nodes recursively. A 2-col container holding two inner containers (each with their own children) renders ascolumns(outer)→ 2 cells → each cell holdscolumns(inner)→ that cell's content. Goes as deep as the data nests. - Macro recursion —
structure_page_treesplit into a self-referencingrender_tree_nodemacro called from cell contents, so server-rendered output mirrors the block tree exactly. - Client-side recursion —
reconstructBlocksFromZone(zone)walks a cell's direct children: pills become block payloads, nested.fe-page-structure-row--splitrows become container payloads (rebuilt viarebuildContainerFromRow). NewmakeNodeFromPayload(payload)returns either a pill (leaf) or a row (container) so cell hydration recurses too.bindZones()runs after every drop so newly-added nested zones become Sortable + drop targets immediately. - Drop handler nesting — when a Container or Two-panel is dropped INTO a column cell (
data-be-zone="container-col"), the new element is a row (not a flat pill) inserted at the cursor's vertical position, matching what the server would render on next page load. Visual state stays consistent without re-render. makeRowSplittwo-pattern hydration: showcase pattern (all direct children are containers, count matchesnCols) maps each cell to one inner container; flat pattern distributes children round-robin. Single-column containers no longer auto-provision an inner-container wrapper — they hold direct children flat, matching what "I just dropped a Container here, it's empty" expects.- Self-reference bug fix — original
rebuildContainerFromRowshowcase branch wroteinnerContainer.data.blocks = [innerContainer](the cell zone now contains the inner-container's row, which reconstructs to the inner container itself). Created circular reference →JSON.stringifythrew → save bar never fired → next drag attempt infinite-looped throughfindContainerPayload. Rewrote so each cell's reconstructed contents ARE the parent's direct child slot (showcase detection: every cell holds exactly one container payload).
Added — Auto / manual dark-mode toggle on color settings
- Reusable
colorPickerWithDarkMode({value, valueDark, mode, onChange})helper in BlockEditor — renders three rows: light swatch + hex + Clear (existing pattern); mode toggle[Same | Auto | Manual]; manual dark swatch + hex + Clear (visible only in Manual mode); auto-derived preview chip with swatch dot (visible only in Auto mode).onChange(light, dark, mode)fires on every state change;darkis''for Same, the auto-derived hex for Auto, or the picked hex for Manual — renderer doesn't have to know about modes, just emitsdarkas a CSS variable when non-empty. deriveDarkMode(hex)algorithm — parses hex → HSL, inverts the lightness component (1 - L), keeps hue + saturation intact, converts back.#1a1a1a→#e5e5e5,#4a90e2→ similar mid-luminance blue. Returns''for invalid input.- Wired into Typography Color (heading / paragraph / list) —
d.color,d.color_dark,d.color_dark_mode. - Wired into Container Background + Border colour —
d.bg_color/d.bg_color_dark/d.bg_color_dark_modeandd.border_color/d.border_color_dark/d.border_color_dark_mode. - Server defaults extended —
_blank_page_blockadds_dark('') and_dark_mode('same') for these three fields. Existing pages without them fall through cleanly viadict.get(). - Renderer emits CSS variables —
typo_style+pp_typo_styleemit--tsp-color-dm: <hex>whencolor_darkis non-empty. Container styles emit--tsp-bg-dmand--tsp-border-dmsimilarly. - Three global dark-mode rules —
html[data-theme="dark"] [style*="--tsp-<prop>-dm"] { <prop>: var(--tsp-<prop>-dm) !important; }for color, background-color, and border-color. The[style*="--tsp-…"]attribute selector keeps each rule narrow;!importantis needed because inline styles otherwise win over any cascade rule on the same property.
Changed — Dark-mode
.fe-btn-primarydefaults- Background:
#e2e8f0→#052566(deep navy). - Text:
#0b1026→#e2e8f0(off-white). - Hover bg: previously flashed to
#fff→ nowcolor-mix(in srgb, #052566 80%, #fff 20%)so the hover stays in the same colour family. - Hover text: kept at
#e2e8f0so contrast doesn't flip mid-hover. - The two scoped overrides (
.fe-meeting-card-actions .fe-btn-primaryuses#1e3a8a;.fe-hero-cta .fe-btn-primaryderives from the admin's per-button colour pickers viacolor-mix) are explicit per-context choices and were left intact.
Added — List block: display styles + per-card style settings
display_stylefield on the list block with five options: Plain (default<ul>/<ol>with the existing Marker style dropdown), Numbered cards (the original.fe-pp-stepslook — circular numeral + soft card per item), Checklist (✓mark in a brand-tinted pill), Arrow list (→mark in a neutral pill), Inline pills (rounded chips that flow horizontally + wrap). UI dropdown auto-hides the Marker style row when a non-plain display style is selected. Existing list blocks (nodisplay_stylefield) render through the plain branch unchanged.- Card style settings panel appears in the list editor when Numbered cards is selected. Exposes: card background (with auto / manual dark-mode toggle), border colour (with dark-mode toggle), border radius (px), padding (CSS shorthand), gap between cards (CSS gap value), shadow preset (None / Subtle / Medium / Large / Dramatic), Hover lift checkbox (toggles the lift + shadow on hover), number circle background colour (with dark-mode toggle), number circle text colour (with dark-mode toggle). Renderer emits inline styles + CSS custom properties on
.fe-pp-steps(gap),.fe-pp-step(bg / border / radius / padding / shadow + hover-lift vars), and.fe-pp-step-num(bg / colour). Dark-mode counterparts ride along as--tsp-bg-dm/--tsp-border-dm/--tsp-color-dmso the existing global rules swap them underhtml[data-theme="dark"]. - List card border style now mirrors
.fe-meeting-card—border: 1px solid var(--fe-accent)+border-radius: 16px(was1px solid var(--fe-border)+ 14 px) and the same hover lift recipe (translateY(-2px)+0 8px 28px rgba(15,23,42,0.10)shadow). Dark mode pairs both card families on#131a33/#1f2a44. - List cards flush against neighbours — stripped the 28 px top margin baked into
.fe-pp-stepsand the auto-spacing rules between cards lists and adjacent prose blocks (.fe-pp-steps + .fe-pp-prose { margin-top + muted color + smaller font + center }and.fe-pp-section .fe-pp-prose:has(+ .fe-pp-steps) { margin-bottom: 28px }). Containergapis now the only source of inter-block spacing. - Hover lift toggle wired through CSS variables —
.fe-pp-step:hovernow readsvar(--fe-pp-step-hover-lift, 1)andvar(--fe-pp-step-hover-shadow, 0 8px 28px rgba(15,23,42,0.10)). The card-style settings panel sets these to0andnonerespectively when the admin unchecks "Hover lift", so the lift + shadow are suppressed without touching the default rule.
Added — Markdown enabled in list items + Text blocks
- List items support markdown links — added a
markdown_inlineJinja filter that runs the same markdown + bleach pipeline asmarkdownbut strips the single outer<p>wrapper for single-paragraph inputs. Multi-paragraph inputs keep all their tags. Switched all 10item|markdownusages in_blocks.html+frontend/page.htmltoitem|markdown_inlineso list items can carry inline markdown (links, bold, italic, code spans) without the wrapping paragraph fighting parent inline elements (.fe-pp-list-textis a<span>— invalid to nest a<p>there). Editor placeholder updated: "List item (supports markdown — e.g.[link](https://example.com))". - Paragraph (Text) blocks support full multi-line markdown — switched paragraph rendering from
|markdown(which required users to insert blank lines before lists/headings to be parsed) to|markdown_block(auto-inserts those blank lines via_markdown_block_breaks). Authors can now write**bold**,*italic*,[link](url),# heading,> quote,- list,```code```, tables, etc. — Python-Markdown parses them all without the admin having to think about blank-line spacing rules. Editor placeholder rewritten with concrete examples; textarea bumped 5 → 6 rows.
Fixed — Drag-drop reconstruction edge cases
- Newly-dragged Container into a cell vanished on save (regression after recursive nesting).
findContainerPayload(blockId)only walkedsections(the pre-drag state), so a brand-new container minted by a palette drop wasn't findable — the reconstruction's row branch didif (!containerPayload) return;and bailed without recursing into the new container's cell or pushing the container itself. The container was lost; blocks dragged INTO it were rescued to the orphan bin by the safety net but the container chrome was gone. Fix: maintain acontainerPayloadByIdMap seeded fromsectionsat boot AND populated by every code path that mints a fresh container payload (makeRowFromPayload,makeNodeFromPayload, the drop handler).findContainerPayloadchecks the map first (O(1) lookup), falls back to walking sections. Map gets re-seeded after eachsyncStateFromDomso deleted containers fall out and don't accumulate. - Self-reference circular bug fix in
rebuildContainerFromRow. The showcase-pattern branch was double-recursing —innerContainers[idx].data.blocks = reconstructBlocksFromZone(zone)produced[innerContainer1Payload]from a cell that contained the inner container's own row, so we were assigninginnerContainer.data.blocks = [innerContainer].JSON.stringifythrew on the cycle, the hidden input never updated, save bar never fired, andfindContainerPayloadinfinite-looped on subsequent drags. Rewrote: each cell's reconstructed contents ARE the parent's direct child slot (showcase detection: every cell holds exactly one container payload). - Lost-block safety net in
syncStateFromDom. Snapshots every block id present BEFORE the reconstruction; after, walks the new sections and any missing id gets pushed to the orphan bin (with the original payload) instead of being silently lost. Empty containers don't get rescued; leaf blocks and non-empty containers do. Container nesting is flattened on the way to the bin (a lost container becomes an empty wrapper) since its lost children would already have been rescued individually. Console-warns when it fires so the regression is visible. The orphan card auto-reveals + count badge updates so the admin sees the rescued blocks immediately. - Orphan bin always reachable. Was
display: nonewhen empty (so admins couldn't drag blocks INTO an empty bin to park them). Nowopacity: 0.6+ a "Drop blocks here…" placeholder message that hides as soon as a pill lands. Bin is a stable drop target; the safety net's rescued blocks have a clear destination.
Added — Recursive nested-container rendering
- Containers can be nested inside cells —
_block_node(replaces_container_columns) recursively walks blocks: every container becomes a'columns'tree node (single- or multi-cell) with its ownblock_id, drop zones, Settings + Remove buttons. Cells contain other tree nodes recursively. A 2-col container holding two inner containers (each with their own children) renders ascolumns(outer)→ 2 cells → each cell holdscolumns(inner)→ that cell's content. Goes as deep as the data nests. - Macro recursion —
structure_page_treesplit into a self-referencingrender_tree_nodemacro called from cell contents. - Client-side recursion —
reconstructBlocksFromZone(zone)walks a cell's direct children (pills become block payloads, nested.fe-page-structure-row--splitrows become container payloads viarebuildContainerFromRow). NewmakeNodeFromPayload(payload)returns either a pill (leaf) or a row (container) so cell hydration recurses too.bindZones()runs after every drop so newly-added nested zones become Sortable + drop targets immediately. makeRowSplittwo-pattern hydration — showcase pattern (all direct children are containers, count matchesnCols) maps each cell to one inner container; flat pattern distributes children round-robin across cells, with both pills and nested rows rendered viamakeNodeFromPayload. Single-column containers no longer auto-provision an inner-container wrapper — they hold direct children flat.- Drop handler nesting — when a Container or Two-panel is dropped INTO a column cell (
data-be-zone="container-col"), the new element is a row (not a flat pill) inserted at the cursor's vertical position, matching what the server would render on next page load. Visual state stays consistent without re-render.
Added — Auto / manual dark-mode toggle on color settings
- Reusable
colorPickerWithDarkMode({value, valueDark, mode, onChange})helper in BlockEditor — renders three rows: light swatch + hex + Clear; mode toggle[Same | Auto | Manual]; manual dark swatch + hex + Clear (visible only in Manual mode); auto-derived preview chip with swatch dot (visible only in Auto mode).onChange(light, dark, mode)fires on every state change;darkis''for Same, the auto-derived hex for Auto, or the picked hex for Manual — renderer doesn't have to know about modes, just emitsdarkas a CSS variable when non-empty. deriveDarkMode(hex)algorithm — parses hex → HSL, inverts the lightness component (1 - L), keeps hue + saturation intact, converts back.#1a1a1a→#e5e5e5,#4a90e2→ similar mid-luminance blue.- Wired into Typography Color (heading / paragraph / list), Container Background + Border colour, and the new list card style fields (card bg, card border, number bg, number text).
- Server defaults extended —
_blank_page_blockadds_dark('') and_dark_mode('same') for these fields. Existing pages without them fall through cleanly viadict.get(). - Renderer emits CSS variables —
typo_style+pp_typo_styleemit--tsp-color-dm: <hex>whencolor_darkis non-empty. Container styles emit--tsp-bg-dmand--tsp-border-dmsimilarly. List cards emit--tsp-bg-dm/--tsp-border-dmon.fe-pp-stepand--tsp-bg-dm/--tsp-color-dmon.fe-pp-step-num. - Three global dark-mode rules in
frontend.css:
css html[data-theme="dark"] [style*="--tsp-color-dm"] { color: var(--tsp-color-dm) !important; } html[data-theme="dark"] [style*="--tsp-bg-dm"] { background-color: var(--tsp-bg-dm) !important; } html[data-theme="dark"] [style*="--tsp-border-dm"] { border-color: var(--tsp-border-dm) !important; }
The[style*="--tsp-…"]attribute selector keeps each rule narrow;!importantis needed because inline styles otherwise win over any cascade rule on the same property.
Changed — Edit modal polish
- Removed "← View all blocks" button from the focused-edit modal head. The associated JS (focus-clear button reference, click listener, hidden-toggle calls inside
clearFocus/focusBlock) is gone.clearFocus()now also runs whenever any close affordance fires (×icon, Done button, backdrop) so the next pill click lands in a fresh focus regardless. - 1 rem gap between modal title and × close button —
.fe-page-edit-modal .modal-head { gap: 1rem; }plus.fe-page-edit-modal .modal-head > .icon-btn[data-close] { margin-left: 1rem; }for the belt-and-braces case where browser flexgapdoesn't honour cleanly.
Changed — Page edit form: three cards merged into one
- Page settings + Page width + Background → single
.fe-page-settings-card. Three subsections separated by 1 px hairline + an inline<h3>sub-heading paired with the muted helper text. First subsection's border is suppressed via:first-of-type. Sub-heading usesflexso the muted helper sits inline on wide viewports and wraps below on narrow. All form input names (title,slug,is_published,width_mode,max_width,full_padding_pct,bg_image,clear_bg,bg_mode,bg_tile_scale) unchanged — the save route's form parsing keeps working without changes.