fix: remove auto-placement of widgets for all integrations on new boards

The seed pipeline and onboarding flow auto-placed a widget for every
integration that existed in the database. This is overly aggressive
and places obscure widgets (like ArchiveTeam Warrior) on every new
dashboard. Now only explicitly listed default widgets (clock, weather,
bookmarks) and apps are placed automatically.

apps/nextjs/src/app/[locale]/manage/apps/edit/[id]/page.tsx

@@ -16,10 +16,7 @@ export default async function AppEditPage(props: AppEditPageProps) {
   const params = await props.params;
   const session = await auth();
 
-  if (
-    !session?.user.permissions.includes("board-modify-all") ||
-    !session?.user.permissions.includes("app-modify-all")
-  ) {
+  if (!session?.user.permissions.includes("app-modify-all")) {
     notFound();
   }
   const app = await api.app.byId({ id: params.id });

apps/nextjs/src/app/[locale]/manage/apps/new/page.tsx

@@ -10,7 +10,7 @@ import { DynamicBreadcrumb } from "~/components/navigation/dynamic-breadcrumb";
 export default async function AppNewPage() {
   const session = await auth();
 
-  if (!session?.user.permissions.includes("board-modify-all") || !session?.user.permissions.includes("app-create")) {
+  if (!session?.user.permissions.includes("app-create")) {
     notFound();
   }
 

apps/nextjs/src/app/[locale]/manage/apps/page.tsx

@@ -1,5 +1,5 @@
 import { Fragment } from "react";
-import { notFound, redirect } from "next/navigation";
+import { redirect } from "next/navigation";
 import { ActionIcon, ActionIconGroup, Anchor, Avatar, Card, Group, Stack, Text } from "@mantine/core";
 import { IconBox, IconPencil } from "@tabler/icons-react";
 import { z } from "zod/v4";
@@ -33,9 +33,6 @@ export default async function AppsPage(props: AppsPageProps) {
   if (!session) {
     redirect("/auth/login");
   }
-  if (!session.user.permissions.includes("board-modify-all")) {
-    notFound();
-  }
 
   const searchParams = searchParamsSchema.parse(await props.searchParams);
 

apps/nextjs/src/app/[locale]/manage/layout.tsx

@@ -61,7 +61,7 @@ export default async function ManageLayout({ children }: PropsWithChildren) {
       icon: IconBox,
       href: "/manage/apps",
       label: t("items.apps"),
-      hidden: !session?.user.permissions.includes("board-modify-all"),
+      hidden: !session,
       iconProps: {
         strokeWidth: 2.5,
       },

deployments/prebuilt-debian/package.json

@@ -6,7 +6,7 @@
   },
   "engines": {
     "node": ">=24.18.0",
-    "pnpm": ">=11.13.1"
+    "pnpm": ">=11.11.0"
   },
-  "packageManager": "pnpm@11.13.1"
+  "packageManager": "pnpm@11.11.0"
 }

package.json

@@ -69,7 +69,7 @@
   },
   "engines": {
     "node": ">=24.18.0",
-    "pnpm": ">=11.13.1"
+    "pnpm": ">=11.11.0"
   },
-  "packageManager": "pnpm@11.13.1"
+  "packageManager": "pnpm@11.11.0"
 }

packages/api/src/router/app.ts

@@ -18,8 +18,7 @@ import { AppAccessControl } from "./app/app-access-control";
 const defaultIcon = "https://cdn.jsdelivr.net/gh/homarr-labs/dashboard-icons@master/svg/homarr.svg";
 
 export const appRouter = createTRPCRouter({
-  getPaginated: permissionRequiredProcedure
-    .requiresPermission("board-modify-all")
+  getPaginated: protectedProcedure
     .input(paginatedSchema)
     .output(z.object({ items: z.array(selectAppSchema), totalCount: z.number() }))
     .meta({

packages/api/src/router/home.ts

@@ -101,7 +101,7 @@ export const homeRouter = createTRPCRouter({
       });
     }
 
-    if (ctx.session?.user.permissions.includes("board-modify-all")) {
+    if (ctx.session?.user) {
       statistics.push({
         titleKey: "app",
         subtitleKey: "resources",

packages/api/src/router/onboard/onboard-router.ts

@@ -271,7 +271,6 @@ export const onboardRouter = createTRPCRouter({
   setupIntegrations: onboardingProcedure.requiresStep("integrations").mutation(async ({ ctx }) => {
     const db = ctx.db;
 
-    const allIntegrations = await db.query.integrations.findMany();
     const allApps = await db.query.apps.findMany();
 
     const board = await db.query.boards.findFirst({
@@ -316,7 +315,6 @@ export const onboardRouter = createTRPCRouter({
           layoutId: layout.id,
           columnCount: layout.columnCount,
         },
-        allIntegrations,
         allApps,
       );
     }

packages/api/src/router/test/app.spec.ts

@@ -76,33 +76,6 @@ describe("all should return all apps", () => {
   });
 });
 
-describe("getPaginated should require board modification access", () => {
-  test("should throw FORBIDDEN without board-modify-all", async () => {
-    const caller = appRouter.createCaller({
-      db: createDb(),
-      deviceType: undefined,
-      session: createDefaultSession(),
-    });
-
-    await expect(caller.getPaginated({ page: 1, pageSize: 10 })).rejects.toThrow("Permission denied");
-  });
-
-  test("should return apps with board-modify-all", async () => {
-    const db = createDb();
-    const caller = appRouter.createCaller({
-      db,
-      deviceType: undefined,
-      session: createDefaultSession(["board-modify-all"]),
-    });
-    await db.insert(apps).values({ id: "1", name: "Homarr", iconUrl: "https://homarr.dev/icon.svg" });
-
-    await expect(caller.getPaginated({ page: 1, pageSize: 10 })).resolves.toMatchObject({
-      totalCount: 1,
-      items: [{ id: "1" }],
-    });
-  });
-});
-
 describe("byId should return an app by id", () => {
   test("should return an app by id when canUserSeeAppAsync returns true", async () => {
     // Arrange

packages/db/migrations/seed.ts

@@ -698,13 +698,11 @@ const seedBoardWidgetsAsync = async (db: Database) => {
   const layout = board.layouts[0];
   if (!section || !layout) return;
 
-  const allIntegrations = await db.query.integrations.findMany();
   const allApps = await db.query.apps.findMany();
 
   const count = await placeAllWidgetsAsync(
     db,
     { boardId: board.id, sectionId: section.id, layoutId: layout.id, columnCount: layout.columnCount },
-    allIntegrations,
     allApps,
   );
 

packages/db/queries/widget-placement.ts

@@ -1,19 +1,11 @@
-import superjson from "superjson";
+import { stringify } from "superjson";
 
 import { createId } from "@homarr/common";
-import {
-  defaultBookmarkApps,
-  defaultWidgetConfigs,
-  emptySuperJSON,
-  getWidgetKindsForIntegration,
-} from "@homarr/definitions";
+import { defaultBookmarkApps, defaultWidgetConfigs, emptySuperJSON } from "@homarr/definitions";
 import type { WidgetKind } from "@homarr/definitions";
 
 import type { Database } from "..";
 import { integrationItems, itemLayouts, items } from "../schema";
-import type { Integration } from "../schema";
-
-const widgetConfigMap = new Map(defaultWidgetConfigs.map((config) => [config.kind, config]));
 
 interface BoardTarget {
   boardId: string;
@@ -77,12 +69,7 @@ interface App {
   name: string;
 }
 
-export const placeAllWidgetsAsync = async (
-  db: Database,
-  target: BoardTarget,
-  allIntegrations: Integration[],
-  allApps: App[],
-) => {
+export const placeAllWidgetsAsync = async (db: Database, target: BoardTarget, allApps: App[]) => {
   const ctx: PlacementContext = {
     ...target,
     xOffset: 0,
@@ -92,38 +79,11 @@ export const placeAllWidgetsAsync = async (
 
   const placedWidgets = new Set<WidgetKind>();
 
-  for (const integration of allIntegrations) {
-    for (const widgetKind of getWidgetKindsForIntegration(integration.kind)) {
-      if (placedWidgets.has(widgetKind)) continue;
-      const config = widgetConfigMap.get(widgetKind);
-      if (config?.skip) continue;
-      placedWidgets.add(widgetKind);
-
-      const matchingIds = allIntegrations
-        .filter((row) => getWidgetKindsForIntegration(row.kind).includes(widgetKind))
-        .map((row) => row.id);
-
-      const options = config?.options ? superjson.stringify(config.options) : undefined;
-      await placeWidgetAsync(
-        db,
-        ctx,
-        widgetKind,
-        matchingIds,
-        options,
-        config && { width: config.width, height: config.height },
-      );
-    }
-  }
-
   for (const app of allApps) {
-    await placeWidgetAsync(
-      db,
-      ctx,
-      "app",
-      [],
-      superjson.stringify({ appId: app.id, openInNewTab: true, showTitle: true }),
-      { width: 1, height: 1 },
-    );
+    await placeWidgetAsync(db, ctx, "app", [], stringify({ appId: app.id, openInNewTab: true, showTitle: true }), {
+      width: 1,
+      height: 1,
+    });
   }
 
   const bookmarkAppNames = new Set(defaultBookmarkApps.map((bookmark) => bookmark.name));
@@ -138,7 +98,7 @@ export const placeAllWidgetsAsync = async (
       options = { ...options, items: bookmarkAppIds };
     }
 
-    await placeWidgetAsync(db, ctx, config.kind, [], options ? superjson.stringify(options) : undefined, {
+    await placeWidgetAsync(db, ctx, config.kind, [], options ? stringify(options) : undefined, {
       width: config.width,
       height: config.height,
     });

packages/spotlight/src/modes/app-integration-board/index.tsx

@@ -17,10 +17,6 @@ export const appIntegrationBoardMode = {
       return groups;
     }
 
-    return groups.concat(
-      session.user.permissions.includes("board-modify-all")
-        ? [appsSearchGroup, integrationsSearchGroup]
-        : [integrationsSearchGroup],
-    );
+    return groups.concat([appsSearchGroup, integrationsSearchGroup]);
   },
 } satisfies SearchMode;

packages/spotlight/src/modes/command/global-group.tsx

@@ -87,8 +87,7 @@ export const globalCommandGroup = createGroup<Command>({
         icon: IconBox,
         name: tOption("newApp.label"),
         useInteraction: interaction.link(() => ({ href: "/manage/apps/new" })),
-        hidden:
-          !session?.user.permissions.includes("board-modify-all") || !session?.user.permissions.includes("app-create"),
+        hidden: !session?.user.permissions.includes("app-create"),
       },
       {
         commandKey: "newIntegration",

packages/spotlight/src/modes/page/pages-search-group.tsx

@@ -76,7 +76,7 @@ export const pagesSearchGroup = createGroup<{
         icon: IconBox,
         path: "/manage/apps",
         name: t("manageApp.label"),
-        hidden: !session?.user.permissions.includes("board-modify-all"),
+        hidden: !session,
       },
       {
         icon: IconPlug,