* feat(api): expand REST coverage for full dashboard automation
Closes#6435.
Boards could only be created empty through the API. The single endpoint for
adding a widget took no geometry, so the size came from the widget default and
the position was always the next free cell. Everything else a setup needs was
reachable from the interface only.
Board composition
- POST /api/boards/items accepts an optional placement: width, height, xOffset,
yOffset and sectionId, or a layouts array for per breakpoint control. Without
it the previous automatic placement is unchanged.
- Adds read, update and delete for items, CRUD for sections, read and replace
for layouts, and GET /api/boards/{id} for the whole board.
- GET /api/boards/{id}/export and POST /api/boards/import make a board
reproducible from version control. onConflict decides what happens when the
name is taken, so a pipeline can be re-run.
- Board access is manageable through GET/PUT /api/boards/{id}/permissions.
Remaining services
- Search engines, integrations, groups, api keys and server settings are
exposed over OpenAPI and registered as MCP tools.
- GET /api/config/export and POST /api/config/import cover the configuration of
a whole instance. Ids are kept so references inside opaque widget options stay
intact, and entities are matched by natural key when the id is unknown, which
is what makes a document from another instance applicable.
- The backup endpoints accept an ApiKey header, so a recovery job no longer
needs a browser session.
Headless bootstrap
- homarr api-keys create prints a key without opening the web interface, which
together with the existing recreate-admin removes the last manual step.
Notes
- No database migration, the schema already stores position and size.
- Grid coordinates and sizes in a document are bounded, and the placement scan
no longer walks every column, so a large grid cannot occupy the server.
- Imports collect their statements first and apply them in one transaction, so a
rejected document never leaves a board half written.
Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
* fix: harden dashboard automation APIs
* fix: validate global home board settings
* fix: validate merged import settings
* docs(api): describe the bounded placement scan accurately
The comment still described the earlier version that walked every row up to the
last occupied one. Both axes now iterate the edges of the occupied areas, so the
cost follows the amount of content rather than the dimensions of the grid.
Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
* fix(api): keep the search engine type narrow and record the new MCP tools
The `.output()` added to `searchEngine.getPaginated` widened `type` back to a
string through the plain select schema, which broke the management page that
switches on it. It now reuses the narrowed union the detail endpoint already has.
`mcp.spec` pins the reviewed tool inventory; the 33 tools this branch exposes are
added to it. The configuration round trip asserted the first layout of an item,
which is the mobile one half of the time and holds the same item clamped, so it
addresses the base layout by id instead.
Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
* feat(api): complete Homarr automation endpoints
* refactor(api): consolidate preferences and task docs
* refactor(api): narrow REST to dashboard automation
* refactor(api): expose existing dashboard controls only
* fix(docs): drop removed API key CLI path
---------
Co-authored-by: rfdrew <20803599+rfdrew@users.noreply.github.com>
Co-authored-by: Claude Opus 5 <noreply@anthropic.com>
Co-authored-by: Thomas Camlong <thomas@ajnart.fr>
Co-authored-by: ajnart <thomas@ajnart.dev>
* fix(boards): add permissions to board summary schema to fix manage page crash
The getAllBoards query fetches userPermissions and groupPermissions
from the DB, but boardSummarySchema (the output validator) did not
include them. tRPC stripped the fields, causing a TypeError when
getBoardPermissionsAsync called .some() on undefined.
* fix(backup): cast Buffer to Uint8Array for NextResponse body
Node 24 narrowed the BodyInit type, making Buffer incompatible.
Wrapping in Uint8Array satisfies the type constraint.
* fix(lint): remove forbidden non-null assertions across backup and board code
Replace non-null assertions with safe guards, optional chaining, and
for-of iteration so oxlint passes in CI. Also remove unused Collapse import.
* fix(deps): update dependency drizzle-zod to ^0.8.2
* chore: update zod to v4 import
* fix: path is no longer available in transform context
* fix: AnyZodObject does no longer exist
* fix: auth env.ts using wrong createEnv and remove unused file env-validation.ts
* fix: required_error no longer exists on z.string
* fix: zod error map is deprecated and replaced with config
* fix: default requires callback now
* fix: migrate zod resolver for mantine
* fix: remove unused form translation file
* fix: wrong enum type
* fix: record now requires two arguments
* fix: add-confirm-password-refinement type issues
* fix: add missing first record argument for entityStateSchema
* fix: migrate superrefine to check
* fix(deps): upgrade zod-form-data to v3
* fix: migrate superRefine to check for mediaUploadSchema
* fix: authProvidersSchema default is array
* fix: use stringbool instead of custom implementation
* fix: record requires first argument
* fix: migrate superRefine to check for certificate router
* fix: confirm pasword refinement is overwriting types
* fix: email optional not working
* fix: migrate intersection to object converter
* fix: safe parse return value rename
* fix: easier access for min and max number value
* fix: migrate superRefine to check for oldmarr import file
* fix: inference of enum shape for old-import board-size wrong
* fix: errors renamed to issues
* chore: address pull request feedback
* fix: zod form requires object
* fix: inference for use-zod-form not working
* fix: remove unnecessary convertion
* fix(deps): upgrade trpc-to-openapi to v3
* fix: build error
* fix: migrate missing zod imports to v4
* fix: migrate zod records to v4
* fix: missing core package dependency in api module
* fix: unable to convert custom zod schema to openapi schema
* fix(deps): upgrade zod to v4
* chore(renovate): enable zod dependency updates
* test: add simple unit test for convertIntersectionToZodObject
---------
Co-authored-by: homarr-renovate[bot] <158783068+homarr-renovate[bot]@users.noreply.github.com>
* feat: add integration access settings
* fix: typecheck and test issues
* fix: test timeout
* chore: address pull request feedback
* chore: add throw if action forbidden for integration permissions
* fix: unable to create new migrations because of duplicate prevId in sqlite snapshots
* chore: add sqlite migration for integration permissions
* test: add unit tests for integration access
* test: add permission checks to integration router tests
* test: add unit test for integration permissions
* chore: add mysql migration
* fix: format issues
* fix: cache is not exportet from react
* fix: format issue
* wip: add usage of group permissions
* feat: show inherited groups and add manage group
* refactor: improve board access management
* chore: address pull request feedback
* fix: type issues
* fix: migrations
* test: add unit tests for board permissions, permissions and board router
* test: add unit tests for board router and get current user permissions method
* fix: format issues
* fix: deepsource issue
* refactor: improve user feedback for general board settings section
* wip: add board settings for background and colors, move danger zone to own file, refactor code
* feat: add shade selector
* feat: add slider for opacity
* fix: issue with invalid hex values for color preview
* refactor: add shared mutation hook for saving partial board settings with invalidate query
* fix: add cleanup for not applied changes to logo and page title
* feat: add layout settings
* feat: add empty custom css section to board settings
* refactor: improve layout of board logo on mobile
* feat: add theme provider for board colors
* refactor: add auto contrast for better contrast of buttons with low primary shade
* feat: add background for boards
* feat: add opacity for boards
* feat: add rename board
* feat: add visibility and delete of board settings
* fix: issue that wrong data is updated with update board method
* refactor: improve danger zone button placement for mobile
* fix: board not revalidated when already in boards layout
* refactor: improve board color preview
* refactor: change save button color to teal, add placeholders for general board settings
* chore: update initial migration
* refactor: remove unnecessary div
* chore: address pull request feedback
* fix: ci issues
* fix: deepsource issues
* chore: address pull request feedback
* fix: formatting issue
* chore: address pull request feedback
Meier Lukas
Manuel
Andre SilvaandAndre Silva
