Merge branch 'dev' into beszel-system-grid-layout-regression

Co-authored-by: Tim Moore <tim.moore@ingenuity.com.au>

.env.example

@@ -66,6 +66,4 @@ UNSAFE_ENABLE_MOCK_INTEGRATION=true
 
 # Whether demo mode is read-only. Defaults to true (the public demo blocks all mutations).
 # Set to false for writable preview deployments so the demo user can modify the dashboard.
-# DEMO_READ_ONLY=false
-# Central Homarr Workshop API. Override only when developing the Workshop locally.
-# NEXT_PUBLIC_WORKSHOP_API_URL=http://localhost:8090
+# DEMO_READ_ONLY=false

.github/ISSUE_TEMPLATE/bug_report.yml

@@ -33,6 +33,8 @@ body:
       options:
         # The below comment is used to insert a new version with on-release.yml
         #NEXT_VERSION#
+        - 1.72.0
+        - 1.71.0
         - 1.70.0
         - 1.69.2
         - 1.69.0

.github/workflows/autofix.yml

@@ -23,7 +23,6 @@ jobs:
         with:
           fetch-depth: 0
           ref: ${{ github.head_ref }}
-          persist-credentials: false
 
       - name: Setup
         uses: ./tooling/github/setup

.github/workflows/ci.yml

@@ -60,7 +60,7 @@ jobs:
       TURBO_PLATFORM: linux/amd64
     steps:
       - uses: actions/checkout@v7
-        if: '!env.ACT'
+        if: "!env.ACT"
         with:
           fetch-depth: 0
           persist-credentials: false
@@ -81,9 +81,6 @@ jobs:
       - name: Copy environment defaults
         run: cp .env.example .env
 
-      - name: Check formatting in affected workspaces
-        run: pnpm turbo run format --affected --continue -- --check
-
       - name: Lint, typecheck, and build affected workspaces
         run: pnpm turbo run lint typecheck build --affected --continue=dependencies-successful
 
@@ -93,12 +90,8 @@ jobs:
       - name: Run unit tests
         run: pnpm test
 
-      - name: Report coverage
-        if: always() && !env.ACT
-        uses: davelosert/vitest-coverage-report-action@v2
-
   container:
-    name: Container, E2E, and memory
+    name: Container and E2E
     needs: fast-gate
     if: |
       github.event_name == 'merge_group' ||
@@ -111,7 +104,7 @@ jobs:
       packages: write
     steps:
       - uses: actions/checkout@v7
-        if: '!env.ACT'
+        if: "!env.ACT"
         with:
           persist-credentials: false
           ref: ${{ github.event_name == 'workflow_dispatch' && inputs.ref || '' }}
@@ -120,11 +113,11 @@ jobs:
         uses: ./tooling/github/setup
 
       - name: Set up Docker Buildx
-        if: '!env.ACT'
+        if: "!env.ACT"
         uses: docker/setup-buildx-action@v4
 
       - name: Build container once
-        if: '!env.ACT'
+        if: "!env.ACT"
         uses: docker/build-push-action@v7
         with:
           context: .
@@ -165,9 +158,9 @@ jobs:
             --tag homarr-ci --tag homarr-e2e "${secret_args[@]}" .
 
       - name: Cache Playwright browsers
-        if: '!env.ACT'
+        if: "!env.ACT"
         id: playwright-cache
-        uses: actions/cache@v4
+        uses: actions/cache@v6
         with:
           path: ~/.cache/ms-playwright
           key: playwright-${{ runner.os }}-${{ hashFiles('pnpm-lock.yaml') }}
@@ -185,88 +178,12 @@ jobs:
 
       - name: Upload E2E artifacts
         if: failure() && !env.ACT
-        uses: actions/upload-artifact@v4
+        uses: actions/upload-artifact@v7
         with:
           name: playwright-report
           path: e2e/test-results/
           retention-days: 7
 
-      - name: Run memory regression test
-        env:
-          CONTAINER_NAME: homarr-mem-${{ github.run_id }}-${{ github.run_attempt }}
-          SECRET_ENCRYPTION_KEY: 0000000000000000000000000000000000000000000000000000000000000000
-        run: |
-          docker run -d --name "$CONTAINER_NAME" -p 127.0.0.1::7575 \
-            -e NO_EXTERNAL_CONNECTION=true \
-            -e SECRET_ENCRYPTION_KEY="$SECRET_ENCRYPTION_KEY" \
-            homarr-ci
-          PORT=$(docker port "$CONTAINER_NAME" 7575/tcp | sed 's/.*://')
-          [[ "$PORT" =~ ^[0-9]+$ ]] || { echo "ERROR: invalid port mapping: '$PORT'"; exit 1; }
-          URL="http://127.0.0.1:${PORT}"
-
-          healthy=false
-          for i in $(seq 1 30); do
-            if curl -sf "$URL/api/health/ready" >/dev/null 2>&1; then
-              echo "Container healthy after $((i * 2))s"
-              healthy=true
-              break
-            fi
-            sleep 2
-          done
-
-          if [ "$healthy" != "true" ]; then
-            echo "ERROR: Container never became healthy"
-            docker logs "$CONTAINER_NAME" --tail 100
-            exit 1
-          fi
-
-          warmup_ok=0
-          for _ in $(seq 1 5); do
-            curl -sf "$URL/" >/dev/null 2>&1 && warmup_ok=$((warmup_ok + 1))
-            sleep 2
-          done
-          if [ "$warmup_ok" -eq 0 ]; then
-            echo "ERROR: All warmup requests failed"
-            docker logs "$CONTAINER_NAME" --tail 50
-            exit 1
-          fi
-
-          docker inspect -f '{{.State.Running}}' "$CONTAINER_NAME" | grep -qx true || {
-            echo "ERROR: Container died before memory measurement"
-            docker logs "$CONTAINER_NAME" --tail 100
-            exit 1
-          }
-
-          RAW_MEMORY=$(docker stats --no-stream --format '{{.MemUsage}}' "$CONTAINER_NAME" | sed 's| /.*||')
-          MEMORY_MB=$(echo "$RAW_MEMORY" | awk '
-            /GiB/ { gsub(/GiB/, ""); print $1 * 1024; next }
-            /MiB/ { gsub(/MiB/, ""); print $1; next }
-            /KiB/ { gsub(/KiB/, ""); print $1 / 1024; next }
-            { print $1 / 1048576 }
-          ')
-
-          echo "Memory usage: ${MEMORY_MB} MB (${RAW_MEMORY})"
-          [[ "$MEMORY_MB" =~ ^[0-9]+(\.[0-9]+)?$ ]] || {
-            echo "ERROR: non-numeric memory value: '$MEMORY_MB' (raw: '$RAW_MEMORY')"
-            docker logs "$CONTAINER_NAME" --tail 100
-            exit 1
-          }
-          if awk "BEGIN { exit !($MEMORY_MB < 50) }"; then
-            echo "ERROR: Memory suspiciously low (${MEMORY_MB} MB) — container may have crashed"
-            docker logs "$CONTAINER_NAME" --tail 100
-            exit 1
-          elif awk "BEGIN { exit !($MEMORY_MB > 700) }"; then
-            echo "ERROR: Memory usage ${MEMORY_MB} MB exceeds 700 MB"
-            docker logs "$CONTAINER_NAME" --tail 100
-            exit 1
-          fi
-
-      - name: Clean up memory test container
-        if: always()
-        env:
-          CONTAINER_NAME: homarr-mem-${{ github.run_id }}-${{ github.run_attempt }}
-        run: docker rm -f "$CONTAINER_NAME" >/dev/null 2>&1 || true
-
       - name: Determine preview tag
         id: preview
         if: |
@@ -316,7 +233,7 @@ jobs:
         run: test -n "$PR_NUMBER" || { echo "pr_number is required for cleanup"; exit 1; }
 
       - name: Delete GHCR package version
-        if: '!env.ACT'
+        if: "!env.ACT"
         uses: actions/github-script@v8
         with:
           script: |

CHANGELOG.md

@@ -1,3 +1,7 @@
+## [1.72.0](https://github.com/homarr-labs/homarr/compare/v1.71.0...v1.72.0) (2026-07-24)
+
+## [1.71.0](https://github.com/homarr-labs/homarr/compare/v1.70.0...v1.71.0) (2026-07-17)
+
 ## [1.70.0](https://github.com/homarr-labs/homarr/compare/v1.69.2...v1.70.0) (2026-07-10)
 
 ## [1.69.2](https://github.com/homarr-labs/homarr/compare/v1.69.1...v1.69.2) (2026-07-06)

Dockerfile

@@ -1,4 +1,4 @@
-# syntax=docker/dockerfile:1.10
+# syntax=docker/dockerfile:1.25
 
 FROM node:24.18.0-alpine AS base
 
@@ -9,12 +9,24 @@ RUN apk add --no-cache libc6-compat curl bash && apk update
 RUN corepack enable pnpm
 COPY pnpm-lock.yaml pnpm-workspace.yaml package.json ./
 COPY patches ./patches
+# Workaround for pnpm/pnpm#5268: pnpm fetch crashes when patchedDependencies
+# are configured with nodeLinker: hoisted. The applyPatchToDir function tries
+# to chdir into node_modules/<pkg> which doesn't exist during fetch (only the
+# content-addressable store is populated). By temporarily switching to the
+# isolated linker, patches apply inside the virtual store (node_modules/.pnpm/...)
+# which IS created by pnpm fetch. The original hoisted linker is restored
+# before the install step so the final node_modules layout stays flat.
 RUN --mount=type=cache,id=pnpm-store,target=/pnpm/store \
-    pnpm config set store-dir /pnpm/store && pnpm fetch
+    pnpm config set store-dir /pnpm/store && \
+    sed -i 's/nodeLinker: hoisted/nodeLinker: isolated/' pnpm-workspace.yaml && \
+    pnpm fetch && \
+    sed -i 's/nodeLinker: isolated/nodeLinker: hoisted/' pnpm-workspace.yaml
 
 COPY . .
+# Follow the pnpm fetch pattern from https://pnpm.io/cli/fetch
+# --frozen-lockfile is omitted as recommended by the pnpm fetch docs
 RUN --mount=type=cache,id=pnpm-store,target=/pnpm/store \
-    pnpm install --recursive --offline --frozen-lockfile
+    pnpm install --recursive
 
 ARG SKIP_ENV_VALIDATION='true'
 ARG CI='true'

apps/docs/.oxlintrc.json

@@ -23,9 +23,6 @@
     "react-hooks/exhaustive-deps": "warn",
     "eslint/no-unused-expressions": "warn"
   },
-  "options": {
-    "reportUnusedDisableDirectives": "off"
-  },
   "ignorePatterns": ["**/*.config.js", "**/*.config.mjs", "**/*.cjs", ".docusaurus/**", "build/**"],
   "settings": {
     "react": { "version": "19" }

apps/docs/docs/advanced/single-sign-on/index.mdx

@@ -127,6 +127,8 @@ Homarr supports multiple authentication options, from internal userbase (credent
 
     If you'd rather manage group memberships for OIDC users locally (instead of via the IdP), set `AUTH_OIDC_GROUPS_LOCAL_MANAGEMENT=true`. While enabled, Homarr stops syncing OIDC users' group memberships from the groups claim, and admins can add/remove OIDC users on a group's members page. If you turn this back to `false`, the next login of each user resumes the regular sync and reconciles their groups with the IdP's claim again, which may remove memberships that were added manually while local management was enabled.
 
+    To let an existing credentials user also sign in with OIDC, set `AUTH_OIDC_ENABLE_DANGEROUS_CREDENTIALS_LINKING=true`. On the first OIDC sign-in, Homarr links a credentials user with the same email address instead of creating a second user. The user keeps their password login, local username and profile, groups, permissions, boards, settings, and API keys. OIDC profile and group claims do not overwrite the credentials-owned data. Homarr requires the OIDC profile to contain `email_verified: true` while this option is enabled. Only enable this when your OIDC provider verifies email addresses, because a matching email could otherwise be used to take over an existing account.
+
     <details>
       <summary>
         Example Setup
@@ -204,6 +206,7 @@ Homarr supports multiple authentication options, from internal userbase (credent
     | ``AUTH_OIDC_NAME_ATTRIBUTE_OVERWRITE`` | Overwrite name attribute. By default it will use preferred_username if it does not contain a `@` and otherwise name. | ---          |
     | ``AUTH_OIDC_FORCE_USERINFO`` | Force userinfo endpoint to be used for user information.    | false         |
     | ``AUTH_OIDC_ENABLE_DANGEROUS_ACCOUNT_LINKING`` | Enable account linking for OIDC provider. This will link the OIDC accounts by email. Be sure that you have verified emails to prevent stealing accounts. | false |
+    | ``AUTH_OIDC_ENABLE_DANGEROUS_CREDENTIALS_LINKING`` | Link an OIDC identity to an existing credentials user with the same email. The credentials login and existing user data are preserved. Requires the OIDC profile to contain `email_verified: true`. | false |
     | ``AUTH_OIDC_TOKEN_ENDPOINT_AUTH_METHOD`` | Override method for the token endpoint authentication. Supported values are `client_secret_basic`, `client_secret_post`, `client_secret_jwt` and `none`. | client_secret_basic |
 
     ### Permission System

apps/docs/docs/getting-started/installation/helm.md

@@ -2,9 +2,9 @@
 
 <img src="https://raw.githubusercontent.com/homarr-labs/charts/refs/heads/main/charts/homarr/icon.svg" align="right" width="92" alt="homarr logo">
 
-![Version: 8.22.0](https://img.shields.io/badge/Version-8.22.0-informational?style=flat)
+![Version: 8.23.0](https://img.shields.io/badge/Version-8.23.0-informational?style=flat)
 ![Type: application](https://img.shields.io/badge/Type-application-informational?style=flat)
-![AppVersion: v1.70.0](https://img.shields.io/badge/AppVersion-v1.70.0-informational?style=flat)
+![AppVersion: v1.71.0](https://img.shields.io/badge/AppVersion-v1.71.0-informational?style=flat)
 
 A Helm chart to deploy homarr for Kubernetes
 
@@ -259,7 +259,7 @@ httproute:
             value: /
       backendRefs:
         - name: homarr
-          port: 8080
+          port: 7575
 ````
 </details>
 
@@ -419,17 +419,17 @@ All available values are listed on the [artifacthub](https://artifacthub.io/pack
 | envSecrets.dbEncryption.key | string | `"db-encryption-key"` | Secret key for SECRET_ENCRYPTION_KEY can be generated with `openssl rand -hex 32` |
 | fullnameOverride | string | `""` | Overrides chart's fullname |
 | hostAliases | list | `[]` | Add static entries to /etc/hosts in the Pod. This is useful in the following cases: - You are running in a dual-stack cluster (IPv4 + IPv6) and want to force usage of IPv4 for specific hostnames - Your application is having DNS resolution issues or IPv6 preference issues - You need to override or simulate DNS entries without changing global DNS - You are running in an air-gapped or isolated environment without external DNS Example: hostAliases:   - ip: "192.168.1.10"     hostnames:       - "example.com"       - "example.internal" |
-| httproute | object | `{"enabled":false,"hostnames":["chart-example.local"],"parentRefs":[{"name":"my-gateway","namespace":"default"}],"rules":[{"backendRefs":[{"name":"homarr","port":8080}],"filters":[],"matches":[{"path":{"type":"PathPrefix","value":"/"}}]}]}` | Gateway API HTTPRoute configuration |
+| httproute | object | `{"enabled":false,"hostnames":["chart-example.local"],"parentRefs":[{"name":"my-gateway","namespace":"default"}],"rules":[{"backendRefs":[{"name":"homarr","port":7575}],"filters":[],"matches":[{"path":{"type":"PathPrefix","value":"/"}}]}]}` | Gateway API HTTPRoute configuration |
 | httproute.enabled | bool | `false` | Enable HTTPRoute |
 | httproute.hostnames | list | `["chart-example.local"]` | Hostnames this route matches (similar to ingress.hosts.host) |
 | httproute.parentRefs | list | `[{"name":"my-gateway","namespace":"default"}]` | References to the parent Gateway(s) this route attaches to. Each item must include at least a `name`, and optionally a `namespace`. |
-| httproute.rules | list | `[{"backendRefs":[{"name":"homarr","port":8080}],"filters":[],"matches":[{"path":{"type":"PathPrefix","value":"/"}}]}]` | List of routing rules. Each rule can include: - matches: path/header/query matching - filters: optional transformations (redirects, header modifications, etc.) - backendRefs: one or more Kubernetes Services to forward traffic to |
+| httproute.rules | list | `[{"backendRefs":[{"name":"homarr","port":7575}],"filters":[],"matches":[{"path":{"type":"PathPrefix","value":"/"}}]}]` | List of routing rules. Each rule can include: - matches: path/header/query matching - filters: optional transformations (redirects, header modifications, etc.) - backendRefs: one or more Kubernetes Services to forward traffic to |
 | httproute.rules[0].filters | list | `[]` | Optional filters for this rule (default: empty) |
 | httproute.rules[0].matches[0].path.type | string | `"PathPrefix"` | Path match type. One of: Exact, PathPrefix, RegularExpression |
 | httproute.rules[0].matches[0].path.value | string | `"/"` | Path value to match |
 | image.pullPolicy | string | `"IfNotPresent"` | Image pull policy |
 | image.repository | string | `"ghcr.io/homarr-labs/homarr"` | Image repository |
-| image.tag | string | `"v1.70.0"` | Overrides the image tag whose default is the chart appVersion |
+| image.tag | string | `"v1.71.0"` | Overrides the image tag whose default is the chart appVersion |
 | imagePullSecrets | list | `[]` | Secrets for Docker registry |
 | ingress.annotations | object | `{}` | Ingress annotations |
 | ingress.enabled | bool | `false` | Enable ingress |

apps/docs/docs/integrations/immich/index.mdx

@@ -50,12 +50,11 @@ import { immichServerStatsWidget } from '../../widgets/immich-server-stats';
     <code>user.read</code>,{" "}
     <code>user.update</code>,{" "}
     <code>asset.read</code>,{" "}
+    <code>asset.view</code>,{" "}
     <code>asset.download</code>,{" "}
     <code>asset.statistics</code>,{" "}
     <code>server.statistics</code>,{" "}
     <code>server.about</code>.
-    <br />
-    Additional permissions may be required depending on your Immich version. If you encounter authorization errors, grant any missing permissions requested by the server.
   </span>
 
 ),

apps/docs/docs/management/custom-widgets/index.mdx

@@ -82,10 +82,6 @@ Custom widgets can be exported and imported as JSON files. To export, select the
 
 The import format uses `"$schema": "homarr-custom-widget-v2"` to identify the widget version.
 
-## Community Workshop
-
-Use **Install widget** on **Management → Workshop** to inspect and import community widgets. Use **Share in Workshop** from a widget's action menu to publish its canonical export without manually copying JSON. Secrets are never included in exports and must be configured on each Homarr instance.
-
 ## Available Mantine Components for Custom JSX
 
 When using the `customJsx` display type, your template has access to a whitelist of [Mantine v9](https://mantine.dev) components. Unrecognized components, event handlers, and dangerous tags are stripped for security.

apps/docs/docs/management/workshop/index.mdx

@@ -1,40 +0,0 @@
----
-tags:
-  - Workshop
-  - Custom Widgets
-  - Custom CSS
----
-
-# Community Workshop
-
-The [Workshop](pathname:///workshop) is Homarr's community catalog for custom widgets and CSS themes. You can inspect every creation before downloading it or using it in Homarr.
-
-:::warning Community content
-
-Workshop entries are created by community members. Review widget endpoints, templates, and CSS before using them. Keep a current Homarr backup and never add secrets to an exported widget.
-
-:::
-
-## Discover and install
-
-In Homarr, open **Management → Workshop** to browse, search, filter, inspect, download, and install creations. The custom-widget management page and a board's custom CSS settings also provide contextual Workshop actions.
-
-- Widgets are validated against `homarr-custom-widget-v2` before installation. API keys and other secrets are not included and must be configured locally.
-- CSS is loaded into the board editor for review. It is not saved until you choose **Save changes**.
-- The public website never executes submitted widget templates or CSS.
-
-## Share a creation
-
-Use **Share in Workshop** beside a custom widget or in a board's custom CSS settings. Sign in with GitHub, provide a public title and description, inspect the exported source, and publish it. You can also publish from the Workshop website by pasting an exported widget or CSS source.
-
-Submissions are public immediately. Authors can update or delete their own submissions. Updating content increases its revision and shows the supplied changelog.
-
-## Votes and reports
-
-Signed-in members can vote to help useful creations rank higher. Report malicious content, spam, copyright problems, or inappropriate material from a submission's detail page. Reports are visible only to Workshop staff.
-
-## Accounts and moderation
-
-Workshop accounts use GitHub OAuth and are separate from users in a self-hosted Homarr instance. Workshop moderators can remove submissions, prevent an account from publishing, disable an account, and resolve reports. These actions require a reason and are recorded.
-
-The Workshop is a central service operated by Homarr at `store.homarr.dev`. Running the backend locally is supported for contributors developing or testing this feature, not as a private production marketplace.

apps/docs/docs/widgets/beszel-system-stats/index.mdx

@@ -15,7 +15,7 @@ import beszelSystemStats from "./img/beszel-system-stats.png";
 
 <WidgetHeader widget={beszelSystemStatsWidget} categories={["System Monitoring", "Charts"]} />
 
-This widget displays time-series charts for a selected Beszel system, including CPU, memory, disk, network, and Docker container metrics. The Disk Usage chart combines the root disk and every extra filesystem reported by Beszel. You can use the realtime Live view or select a historical period ranging from 1 hour to 30 days. If the live stream drops, the widget now shows the connection failure state immediately and can switch back to historical data.
+This widget displays time-series charts for a selected Beszel system, including CPU, memory, disk, network, and Docker container metrics. The Disk Usage chart combines the root disk and every extra filesystem reported by Beszel. You can use the realtime Live view or select a historical period ranging from 1 hour to 30 days. Live view keeps a one-minute window and pauses while the browser tab is hidden. If the live stream drops, the widget now shows the connection failure state immediately and can switch back to historical data.
 
 ### Screenshots
 

apps/docs/docs/widgets/immich-album-carousel/index.mdx

@@ -1,6 +1,6 @@
 ---
 title: 'Immich Album Carousel'
-description: 'Shows a slideshow of your album pictures from Immich'
+description: 'Shows a slideshow of pictures from an Immich album or your full library'
 hide_title: true
 ---
 
@@ -37,4 +37,3 @@ import screen from './img/screen.png';
 
 ### Configuration
 <WidgetConfig configuration={immichAlbumCarouselWidget.configuration} />
-

apps/docs/docs/widgets/immich-album-carousel/index.ts

@@ -4,15 +4,16 @@ import { IconPhoto } from "@tabler/icons-react";
 export const immichAlbumCarouselWidget: WidgetDefinition = {
   icon: IconPhoto,
   name: "Immich Album",
-  description: "Shows a slideshow of your album pictures from Immich",
+  description: "Shows a slideshow of pictures from an Immich album or your full library",
   path: "../../widgets/immich-album-carousel",
   configuration: {
     items: [
       {
         name: "Album",
-        description: "Select the Immich album to show in the slideshow.",
+        description:
+          "Select an Immich album or All photos. An empty selection also shows random photos from your full library.",
         values: { type: "string" },
-        defaultValue: "",
+        defaultValue: "All photos",
       },
       {
         name: "Interval in seconds",

apps/docs/docs/widgets/media-request-list/index.mdx

@@ -1,41 +1,44 @@
 ---
-title: 'Media Request List'
-description: 'See a list of all media requests from your integration'
+title: "Media Request List"
+description: "See a list of all media requests from your integration"
 hide_title: true
 ---
 
-import { WidgetHeader } from '@site/src/components/widgets/header';
-import { AddingWidget } from '@site/src/components/widgets/adding';
-import { WidgetConfig } from '@site/src/components/widgets/configuration';
-import { WidgetIntegrations } from '@site/src/components/widgets/integrations';
+import { WidgetHeader } from "@site/src/components/widgets/header";
+import { AddingWidget } from "@site/src/components/widgets/adding";
+import { WidgetConfig } from "@site/src/components/widgets/configuration";
+import { WidgetIntegrations } from "@site/src/components/widgets/integrations";
 import { IconAd } from "@tabler/icons-react";
-import Tabs from '@theme/Tabs';
-import TabItem from '@theme/TabItem';
-import { mediaRequestListWidget } from '.';
-import { jellyseerrIntegration } from '@site/docs/integrations/jellyseerr';
-import { overseerrIntegration } from '@site/docs/integrations/overseerr';
+import Tabs from "@theme/Tabs";
+import TabItem from "@theme/TabItem";
+import { mediaRequestListWidget } from ".";
+import { jellyseerrIntegration } from "@site/docs/integrations/jellyseerr";
+import { overseerrIntegration } from "@site/docs/integrations/overseerr";
 
-
-<WidgetHeader
-  widget={mediaRequestListWidget}
-  categories={['Media requests']}
-/>
+<WidgetHeader widget={mediaRequestListWidget} categories={["Media requests"]} />
 
 Provides a list of all open and recently closed requests. It also provides the functionality to approve or reject requests.
 
+You can limit the list to specific request statuses (for example, only show `pending`) and restrict it to requests created within the last N days.
+
 ### Screenshots
 
-import mediaRequestList from './img/list.png';
+import mediaRequestList from "./img/list.png";
 
 <img src={mediaRequestList} alt="media-request-list" width={256} height={256} />
 
 ### Supported Integrations
 
-<WidgetIntegrations items={[{
-  integration: jellyseerrIntegration,
-}, {
-  integration: overseerrIntegration,
-}]} />
+<WidgetIntegrations
+  items={[
+    {
+      integration: jellyseerrIntegration,
+    },
+    {
+      integration: overseerrIntegration,
+    },
+  ]}
+/>
 
 ### Interactions
 
@@ -47,4 +50,5 @@ import mediaRequestList from './img/list.png';
 <AddingWidget />
 
 ### Configuration
+
 <WidgetConfig configuration={mediaRequestListWidget.configuration} />

apps/docs/docs/widgets/media-request-list/index.ts

@@ -14,6 +14,18 @@ export const mediaRequestListWidget: WidgetDefinition = {
         values: { type: "boolean" },
         defaultValue: "yes",
       },
+      {
+        name: "Statuses to show",
+        description: "Only requests with these statuses will be shown. Defaults to all statuses.",
+        values: "List of: 'pending', 'approved', 'declined', 'failed', 'completed'",
+        defaultValue: "All statuses",
+      },
+      {
+        name: "Show only recent requests",
+        description: "Limit to requests created within this many days. Set to 0 to disable the time filter.",
+        values: "0-365",
+        defaultValue: "0",
+      },
     ],
   },
 };

apps/docs/docusaurus.config.ts

@@ -16,9 +16,6 @@ const config: Config = {
     defaultLocale: "en",
     locales: ["en"],
   },
-  customFields: {
-    workshopApiUrl: process.env.NEXT_PUBLIC_WORKSHOP_API_URL ?? "https://store.homarr.dev",
-  },
   onBrokenLinks: "throw",
   onBrokenAnchors: "throw",
   onDuplicateRoutes: "throw",
@@ -127,11 +124,6 @@ const config: Config = {
           position: "left",
           to: "/blog",
         },
-        {
-          label: "Workshop",
-          position: "left",
-          to: "/workshop",
-        },
         {
           label: "About us",
           position: "left",
@@ -317,18 +309,6 @@ const config: Config = {
         },
       };
     },
-    function workshopRoutesPlugin() {
-      return {
-        name: "workshop-routes",
-        async contentLoaded({ actions }) {
-          actions.addRoute({
-            path: "/workshop/:id",
-            component: "@site/src/components/workshop/WorkshopDetailRoutePage",
-            exact: true,
-          });
-        },
-      };
-    },
     "@signalwire/docusaurus-plugin-llms-txt",
     async function tailwindCssPlugin() {
       return {

apps/docs/package.json

@@ -27,7 +27,6 @@
     "@docusaurus/plugin-sitemap": "^3.10.1",
     "@docusaurus/preset-classic": "^3.10.1",
     "@homarr/definitions": "workspace:^",
-    "@homarr/workshop": "workspace:^0.1.0",
     "@mdx-js/react": "^3.1.1",
     "@nivo/line": "^0.99.0",
     "@scalar/api-reference-react": "catalog:",
@@ -44,7 +43,7 @@
     "random-word-slugs": "^0.1.7",
     "react": "catalog:",
     "react-dom": "catalog:",
-    "swiper": "^14.0.2",
+    "swiper": "^14.0.5",
     "tailwindcss": "^4.3.2"
   },
   "devDependencies": {

apps/docs/src/components/workshop/WorkshopAdmin.tsx

@@ -1,300 +0,0 @@
-import React, { useCallback, useEffect, useMemo, useState } from "react";
-import useDocusaurusContext from "@docusaurus/useDocusaurusContext";
-
-import {
-  WORKSHOP_API_URL,
-  WorkshopClient,
-  type WorkshopAccountState,
-  type WorkshopModerationAction,
-  type WorkshopReport,
-  type WorkshopRole,
-  type WorkshopUser,
-} from "@homarr/workshop";
-
-import styles from "./workshop.module.css";
-
-type PendingAction =
-  | { kind: "report"; id: string; status: "resolved" | "dismissed" }
-  | { kind: "state"; id: string; state: WorkshopAccountState }
-  | { kind: "role"; id: string; role: WorkshopRole };
-
-export function WorkshopAdmin() {
-  const { siteConfig } = useDocusaurusContext();
-  const client = useMemo(
-    () => new WorkshopClient((siteConfig.customFields?.workshopApiUrl as string | undefined) ?? WORKSHOP_API_URL),
-    [siteConfig],
-  );
-  const [user, setUser] = useState<WorkshopUser | null>(null);
-  const [reports, setReports] = useState<WorkshopReport[]>([]);
-  const [users, setUsers] = useState<WorkshopUser[]>([]);
-  const [actions, setActions] = useState<WorkshopModerationAction[]>([]);
-  const [pending, setPending] = useState<PendingAction | null>(null);
-  const [error, setError] = useState("");
-
-  const load = useCallback(async () => {
-    const current = await client.refreshAuth();
-    setUser(current);
-    if (!current || (current.role !== "moderator" && current.role !== "admin")) return;
-    try {
-      const [nextReports, nextUsers, nextActions] = await Promise.all([
-        client.listReports(),
-        client.listUsers(),
-        client.listModerationActions(),
-      ]);
-      setReports(nextReports);
-      setUsers(nextUsers);
-      setActions(nextActions);
-    } catch (caught) {
-      setError(caught instanceof Error ? caught.message : "Could not load moderation data");
-    }
-  }, [client]);
-  useEffect(() => client.subscribeToAuth(setUser), [client]);
-  useEffect(() => {
-    void load();
-  }, [load]);
-
-  if (!user)
-    return (
-      <main className={styles.page}>
-        <h1>Workshop moderation</h1>
-        <p>Sign in with a promoted GitHub account to continue.</p>
-        <button
-          className="button button--primary"
-          onClick={async () => {
-            await client.signInWithGitHub();
-            await load();
-          }}
-        >
-          Sign in with GitHub
-        </button>
-      </main>
-    );
-  if (user.role === "member")
-    return (
-      <main className={styles.page}>
-        <h1>Workshop moderation</h1>
-        <div className={styles.error} role="alert">
-          Your account does not have moderation access.
-        </div>
-      </main>
-    );
-
-  return (
-    <main className={styles.page}>
-      <header className={styles.hero}>
-        <div>
-          <h1>Workshop moderation</h1>
-          <p>Review reports and apply the smallest action needed. Every action requires a reason and is recorded.</p>
-        </div>
-      </header>
-      {error && (
-        <div className={styles.error} role="alert">
-          {error}
-        </div>
-      )}
-      <section className={styles.adminSection}>
-        <h2>Open reports</h2>
-        {reports.length === 0 ? (
-          <p>No open reports.</p>
-        ) : (
-          <div className={styles.tableWrap}>
-            <table>
-              <thead>
-                <tr>
-                  <th>Category</th>
-                  <th>Submission</th>
-                  <th>Details</th>
-                  <th>Created</th>
-                  <th>Action</th>
-                </tr>
-              </thead>
-              <tbody>
-                {reports.map((report) => (
-                  <tr key={report.id}>
-                    <td>{report.category}</td>
-                    <td>{report.submission}</td>
-                    <td>{report.explanation}</td>
-                    <td>{new Date(report.created).toLocaleString()}</td>
-                    <td aria-label="Report actions">
-                      <div className={styles.rowActions}>
-                        <button onClick={() => setPending({ kind: "report", id: report.id, status: "resolved" })}>
-                          Resolve
-                        </button>
-                        <button onClick={() => setPending({ kind: "report", id: report.id, status: "dismissed" })}>
-                          Dismiss
-                        </button>
-                      </div>
-                    </td>
-                  </tr>
-                ))}
-              </tbody>
-            </table>
-          </div>
-        )}
-      </section>
-      <section className={styles.adminSection}>
-        <h2>Community accounts</h2>
-        <div className={styles.tableWrap}>
-          <table>
-            <thead>
-              <tr>
-                <th>User</th>
-                <th>Role</th>
-                <th>State</th>
-                <th>Moderate</th>
-              </tr>
-            </thead>
-            <tbody>
-              {users.map((account) => (
-                <tr key={account.id}>
-                  <td>{account.displayName}</td>
-                  <td>{account.role}</td>
-                  <td>{account.state}</td>
-                  <td>
-                    {account.id === user.id ? (
-                      "Current account"
-                    ) : (
-                      <div className={styles.rowActions}>
-                        <button
-                          onClick={() =>
-                            setPending({
-                              kind: "state",
-                              id: account.id,
-                              state: account.state === "posting_banned" ? "active" : "posting_banned",
-                            })
-                          }
-                        >
-                          {account.state === "posting_banned" ? "Lift posting ban" : "Posting ban"}
-                        </button>
-                        <button
-                          onClick={() =>
-                            setPending({
-                              kind: "state",
-                              id: account.id,
-                              state: account.state === "disabled" ? "active" : "disabled",
-                            })
-                          }
-                        >
-                          {account.state === "disabled" ? "Restore" : "Disable"}
-                        </button>
-                        {user.role === "admin" && (
-                          <button
-                            onClick={() =>
-                              setPending({
-                                kind: "role",
-                                id: account.id,
-                                role: account.role === "member" ? "moderator" : "member",
-                              })
-                            }
-                          >
-                            {account.role === "member" ? "Promote" : "Set member"}
-                          </button>
-                        )}
-                      </div>
-                    )}
-                  </td>
-                </tr>
-              ))}
-            </tbody>
-          </table>
-        </div>
-      </section>
-      <section className={styles.adminSection}>
-        <h2>Recent actions</h2>
-        <div className={styles.tableWrap}>
-          <table>
-            <thead>
-              <tr>
-                <th>Action</th>
-                <th>Target</th>
-                <th>Reason</th>
-                <th>Created</th>
-              </tr>
-            </thead>
-            <tbody>
-              {actions.map((action) => (
-                <tr key={action.id}>
-                  <td>{action.action}</td>
-                  <td>
-                    {action.targetType}:{action.targetId}
-                  </td>
-                  <td>{action.reason}</td>
-                  <td>{new Date(action.created).toLocaleString()}</td>
-                </tr>
-              ))}
-            </tbody>
-          </table>
-        </div>
-      </section>
-      {pending && (
-        <ReasonDialog
-          action={pending}
-          onClose={() => setPending(null)}
-          onConfirm={async (reason) => {
-            if (pending.kind === "report") await client.resolveReport(pending.id, pending.status, reason);
-            else if (pending.kind === "state") await client.updateAccountState(pending.id, pending.state, reason);
-            else await client.updateRole(pending.id, pending.role, reason);
-            setPending(null);
-            await load();
-          }}
-        />
-      )}
-    </main>
-  );
-}
-
-function ReasonDialog({
-  action,
-  onClose,
-  onConfirm,
-}: {
-  action: PendingAction;
-  onClose: () => void;
-  onConfirm: (reason: string) => Promise<void>;
-}) {
-  const [reason, setReason] = useState("");
-  const [error, setError] = useState("");
-  const [saving, setSaving] = useState(false);
-  return (
-    <div className={styles.overlay}>
-      <dialog className={styles.dialog} open aria-labelledby="moderation-reason-title">
-        <h2 id="moderation-reason-title">Confirm moderation action</h2>
-        <p>
-          This will apply <strong>{action.kind}</strong> to the selected record.
-        </p>
-        <form
-          onSubmit={async (event) => {
-            event.preventDefault();
-            setSaving(true);
-            try {
-              await onConfirm(reason);
-            } catch (caught) {
-              setError(caught instanceof Error ? caught.message : "Action failed");
-              setSaving(false);
-            }
-          }}
-        >
-          <label>
-            Reason
-            <textarea
-              required
-              minLength={3}
-              maxLength={1000}
-              value={reason}
-              onChange={(event) => setReason(event.target.value)}
-            />
-          </label>
-          {error && <p className={styles.error}>{error}</p>}
-          <div className={styles.formActions}>
-            <button type="button" className="button button--secondary" onClick={onClose}>
-              Cancel
-            </button>
-            <button disabled={saving} className="button button--danger">
-              {saving ? "Applying…" : "Apply action"}
-            </button>
-          </div>
-        </form>
-      </dialog>
-    </div>
-  );
-}

apps/docs/src/components/workshop/WorkshopDetailRoutePage.tsx

@@ -1,16 +0,0 @@
-import React from "react";
-import BrowserOnly from "@docusaurus/BrowserOnly";
-import Layout from "@theme/Layout";
-
-export default function WorkshopDetailRoutePage() {
-  return (
-    <Layout title="Workshop submission">
-      <BrowserOnly fallback={<main style={{ minHeight: "70vh" }} />}>
-        {() => {
-          const { WorkshopDetailRoute } = require("./WorkshopPage");
-          return <WorkshopDetailRoute />;
-        }}
-      </BrowserOnly>
-    </Layout>
-  );
-}

apps/docs/src/components/workshop/WorkshopPage.tsx

@@ -1,668 +0,0 @@
-import React, { useCallback, useEffect, useMemo, useState } from "react";
-import Link from "@docusaurus/Link";
-import { useHistory, useLocation } from "@docusaurus/router";
-import useDocusaurusContext from "@docusaurus/useDocusaurusContext";
-import {
-  IconAlertTriangle,
-  IconBrandGithub,
-  IconCopy,
-  IconDownload,
-  IconFlag,
-  IconSearch,
-  IconUpload,
-} from "@tabler/icons-react";
-
-import {
-  WORKSHOP_API_URL,
-  WorkshopClient,
-  type WorkshopSubmissionDetail,
-  type WorkshopSubmissionInput,
-  type WorkshopSubmissionSummary,
-  type WorkshopSubmissionType,
-  type WorkshopUser,
-  workshopExportFilename,
-} from "@homarr/workshop";
-
-import styles from "./workshop.module.css";
-
-const useWorkshop = () => {
-  const { siteConfig } = useDocusaurusContext();
-  const apiUrl = (siteConfig.customFields?.workshopApiUrl as string | undefined) ?? WORKSHOP_API_URL;
-  return useMemo(() => new WorkshopClient(apiUrl), [apiUrl]);
-};
-
-const saveContent = (submission: WorkshopSubmissionDetail) => {
-  const url = URL.createObjectURL(
-    new Blob([submission.content], { type: submission.type === "css" ? "text/css" : "application/json" }),
-  );
-  const link = document.createElement("a");
-  link.href = url;
-  link.download = workshopExportFilename(submission.title, submission.type);
-  link.click();
-  URL.revokeObjectURL(url);
-};
-
-export function WorkshopApp() {
-  const client = useWorkshop();
-  const [user, setUser] = useState<WorkshopUser | null>(null);
-  const [items, setItems] = useState<WorkshopSubmissionSummary[]>([]);
-  const [page, setPage] = useState(1);
-  const [totalPages, setTotalPages] = useState(1);
-  const [type, setType] = useState<WorkshopSubmissionType | "all">("all");
-  const [sort, setSort] = useState<"top" | "newest">("top");
-  const [search, setSearch] = useState("");
-  const [mine, setMine] = useState(false);
-  const [loading, setLoading] = useState(true);
-  const [error, setError] = useState("");
-  const [showForm, setShowForm] = useState(false);
-
-  useEffect(() => client.subscribeToAuth(setUser), [client]);
-
-  const load = useCallback(async () => {
-    setLoading(true);
-    setError("");
-    try {
-      await client.refreshAuth();
-      const result = await client.list({ page, type, sort, search, author: mine ? client.currentUser?.id : undefined });
-      setItems(result.items);
-      setTotalPages(result.totalPages);
-    } catch (caught) {
-      setError(caught instanceof Error ? caught.message : "Workshop is unavailable");
-    } finally {
-      setLoading(false);
-    }
-  }, [client, mine, page, search, sort, type]);
-
-  useEffect(() => {
-    const timeout = window.setTimeout(() => void load(), 250);
-    return () => window.clearTimeout(timeout);
-  }, [load]);
-
-  const signIn = async () => {
-    try {
-      await client.signInWithGitHub();
-      await load();
-    } catch (caught) {
-      setError(caught instanceof Error ? caught.message : "Sign-in failed");
-    }
-  };
-
-  return (
-    <main className={styles.page}>
-      <header className={styles.hero}>
-        <div>
-          <h1>Workshop</h1>
-          <p>Community widgets and CSS themes, ready to inspect and use in Homarr.</p>
-        </div>
-        <div className={styles.accountActions}>
-          {user ? (
-            <>
-              {(user.role === "moderator" || user.role === "admin") && (
-                <Link className="button button--secondary" to="/workshop/admin">
-                  Moderate
-                </Link>
-              )}
-              <button className="button button--primary" onClick={() => setShowForm(true)}>
-                <IconUpload size={17} /> Share creation
-              </button>
-              <button className="button button--secondary" onClick={() => client.signOut()}>
-                Sign out
-              </button>
-            </>
-          ) : (
-            <button className="button button--primary" onClick={() => void signIn()}>
-              <IconBrandGithub size={18} /> Sign in with GitHub
-            </button>
-          )}
-        </div>
-      </header>
-
-      <section className={styles.safety} aria-label="Community content warning">
-        <IconAlertTriangle aria-hidden size={20} />
-        <p>
-          Workshop content is community-provided. Inspect source before installing it and keep a current Homarr backup.
-        </p>
-      </section>
-
-      <div className={styles.toolbar}>
-        <label className={styles.search}>
-          <span className="sr-only">Search Workshop</span>
-          <IconSearch aria-hidden size={18} />
-          <input
-            value={search}
-            onChange={(event) => {
-              setSearch(event.target.value);
-              setPage(1);
-            }}
-            placeholder="Search creations"
-          />
-        </label>
-        <label>
-          Type
-          <select
-            value={type}
-            onChange={(event) => {
-              setType(event.target.value as typeof type);
-              setPage(1);
-            }}
-          >
-            <option value="all">All</option>
-            <option value="widget">Widgets</option>
-            <option value="css">CSS themes</option>
-          </select>
-        </label>
-        <label>
-          Sort
-          <select
-            value={sort}
-            onChange={(event) => {
-              setSort(event.target.value as typeof sort);
-              setPage(1);
-            }}
-          >
-            <option value="top">Top rated</option>
-            <option value="newest">Newest</option>
-          </select>
-        </label>
-        {user && (
-          <label className={styles.checkbox}>
-            <input
-              type="checkbox"
-              checked={mine}
-              onChange={(event) => {
-                setMine(event.target.checked);
-                setPage(1);
-              }}
-            />{" "}
-            My submissions
-          </label>
-        )}
-      </div>
-
-      {error && (
-        <div className={styles.error} role="alert">
-          {error} <button onClick={() => void load()}>Try again</button>
-        </div>
-      )}
-      {loading ? (
-        <WorkshopSkeleton />
-      ) : items.length ? (
-        <div className={styles.grid}>
-          {items.map((item) => (
-            <WorkshopCard client={client} item={item} key={item.id} />
-          ))}
-        </div>
-      ) : (
-        <section className={styles.empty}>
-          <h2>No creations found</h2>
-          <p>Adjust the filters, or share the first creation in this category.</p>
-        </section>
-      )}
-
-      {totalPages > 1 && (
-        <nav className={styles.pagination} aria-label="Workshop pages">
-          <button disabled={page === 1} onClick={() => setPage((value) => value - 1)}>
-            Previous
-          </button>
-          <span>
-            Page {page} of {totalPages}
-          </span>
-          <button disabled={page === totalPages} onClick={() => setPage((value) => value + 1)}>
-            Next
-          </button>
-        </nav>
-      )}
-      {showForm && (
-        <SubmissionForm
-          client={client}
-          onClose={() => setShowForm(false)}
-          onSaved={async () => {
-            setShowForm(false);
-            await load();
-          }}
-        />
-      )}
-    </main>
-  );
-}
-
-function WorkshopCard({ client, item }: { client: WorkshopClient; item: WorkshopSubmissionSummary }) {
-  const image = item.screenshots[0];
-  return (
-    <article className={styles.card}>
-      {image ? (
-        <img src={client.fileUrl(item.id, image, "480x320")} alt="" loading="lazy" />
-      ) : (
-        <div className={styles.cardPlaceholder} aria-hidden>
-          {item.type === "widget" ? "{}" : "CSS"}
-        </div>
-      )}
-      <div className={styles.cardBody}>
-        <div className={styles.cardMeta}>
-          <span>{item.type === "widget" ? "Widget" : "CSS theme"}</span>
-          <span>
-            {item.score >= 0 ? "+" : ""}
-            {item.score}
-          </span>
-        </div>
-        <h2>
-          <Link to={`/workshop/${item.id}`}>{item.title}</Link>
-        </h2>
-        <p>{item.description || "No description provided."}</p>
-        <small>
-          By {item.authorName} · revision {item.revision}
-        </small>
-      </div>
-    </article>
-  );
-}
-
-export function WorkshopDetailRoute() {
-  const client = useWorkshop();
-  const location = useLocation();
-  const id = location.pathname.split("/").filter(Boolean).at(-1) ?? "";
-  const history = useHistory();
-  const [user, setUser] = useState<WorkshopUser | null>(null);
-  const [submission, setSubmission] = useState<WorkshopSubmissionDetail | null>(null);
-  const [error, setError] = useState("");
-  const [reporting, setReporting] = useState(false);
-  const [editing, setEditing] = useState(false);
-  const [moderating, setModerating] = useState(false);
-
-  const load = useCallback(async () => {
-    try {
-      setSubmission(await client.get(id));
-    } catch (caught) {
-      setError(caught instanceof Error ? caught.message : "Submission not found");
-    }
-  }, [client, id]);
-  useEffect(() => client.subscribeToAuth(setUser), [client]);
-  useEffect(() => {
-    void client.refreshAuth();
-    void load();
-  }, [client, load]);
-
-  if (error)
-    return (
-      <main className={styles.page}>
-        <div className={styles.error} role="alert">
-          {error}
-        </div>
-        <Link to="/workshop">Back to Workshop</Link>
-      </main>
-    );
-  if (!submission) return <WorkshopSkeleton />;
-
-  const requireAuth = async () => client.currentUser ?? client.signInWithGitHub();
-  return (
-    <main className={styles.page}>
-      <Link to="/workshop">← Back to Workshop</Link>
-      <article className={styles.detail}>
-        <header>
-          <span className={styles.type}>{submission.type === "widget" ? "Widget" : "CSS theme"}</span>
-          <h1>{submission.title}</h1>
-          <p>{submission.description}</p>
-          <small>
-            By {submission.authorName} · revision {submission.revision}
-          </small>
-        </header>
-        {submission.screenshots.length > 0 && (
-          <div className={styles.gallery}>
-            {submission.screenshots.map((image, index) => (
-              <img
-                key={image}
-                src={client.fileUrl(submission.id, image, "960x640")}
-                alt={`${submission.title} screenshot ${index + 1}`}
-              />
-            ))}
-          </div>
-        )}
-        <div className={styles.detailActions}>
-          <button className="button button--primary" onClick={() => saveContent(submission)}>
-            <IconDownload size={17} /> Download {submission.type === "widget" ? "JSON" : "CSS"}
-          </button>
-          <button
-            className="button button--secondary"
-            onClick={() => void navigator.clipboard.writeText(submission.content)}
-          >
-            <IconCopy size={17} /> Copy source
-          </button>
-          <button
-            className="button button--secondary"
-            onClick={async () => {
-              await requireAuth();
-              await client.vote(submission.id, 1);
-              await load();
-            }}
-          >
-            Upvote ({submission.upvotes})
-          </button>
-          <button className="button button--secondary" onClick={() => setReporting(true)}>
-            <IconFlag size={16} /> Report
-          </button>
-          {user?.id === submission.author && (
-            <>
-              <button className="button button--secondary" onClick={() => setEditing(true)}>
-                Edit
-              </button>
-              <button
-                className="button button--danger"
-                onClick={async () => {
-                  if (window.confirm("Delete this submission permanently?")) {
-                    await client.delete(submission.id);
-                    history.push("/workshop");
-                  }
-                }}
-              >
-                Delete
-              </button>
-            </>
-          )}
-          {(user?.role === "moderator" || user?.role === "admin") && user.id !== submission.author && (
-            <button className="button button--danger" onClick={() => setModerating(true)}>
-              Remove submission
-            </button>
-          )}
-        </div>
-        <section>
-          <h2>Source</h2>
-          <p className={styles.sourceHint}>
-            Review this content before using it. Workshop content is never executed on homarr.dev.
-          </p>
-          <pre className={styles.source}>
-            <code>{submission.content}</code>
-          </pre>
-        </section>
-        {submission.changelog && (
-          <section>
-            <h2>Latest changes</h2>
-            <p>{submission.changelog}</p>
-          </section>
-        )}
-      </article>
-      {reporting && <ReportForm client={client} submissionId={submission.id} onClose={() => setReporting(false)} />}
-      {editing && (
-        <SubmissionForm
-          client={client}
-          existing={submission}
-          onClose={() => setEditing(false)}
-          onSaved={async () => {
-            setEditing(false);
-            await load();
-          }}
-        />
-      )}
-      {moderating && (
-        <ModerationRemovalForm
-          client={client}
-          submission={submission}
-          onClose={() => setModerating(false)}
-          onRemoved={() => history.push("/workshop/admin")}
-        />
-      )}
-    </main>
-  );
-}
-
-function ModerationRemovalForm({
-  client,
-  submission,
-  onClose,
-  onRemoved,
-}: {
-  client: WorkshopClient;
-  submission: WorkshopSubmissionDetail;
-  onClose: () => void;
-  onRemoved: () => void;
-}) {
-  const [reason, setReason] = useState("");
-  const [error, setError] = useState("");
-  const [pending, setPending] = useState(false);
-  return (
-    <div className={styles.overlay}>
-      <dialog className={styles.dialog} open aria-labelledby="remove-submission-title">
-        <h2 id="remove-submission-title">Remove {submission.title}</h2>
-        <p>
-          This permanently deletes the submission, files, votes, and reports. A metadata snapshot is retained in
-          moderation history.
-        </p>
-        <form
-          onSubmit={async (event) => {
-            event.preventDefault();
-            setPending(true);
-            try {
-              await client.removeSubmission(submission.id, reason);
-              onRemoved();
-            } catch (caught) {
-              setError(caught instanceof Error ? caught.message : "Removal failed");
-              setPending(false);
-            }
-          }}
-        >
-          <label>
-            Reason
-            <textarea
-              required
-              minLength={3}
-              maxLength={1000}
-              value={reason}
-              onChange={(event) => setReason(event.target.value)}
-            />
-          </label>
-          {error && <p className={styles.error}>{error}</p>}
-          <div className={styles.formActions}>
-            <button type="button" className="button button--secondary" onClick={onClose}>
-              Cancel
-            </button>
-            <button disabled={pending} className="button button--danger">
-              {pending ? "Removing…" : "Remove permanently"}
-            </button>
-          </div>
-        </form>
-      </dialog>
-    </div>
-  );
-}
-
-function SubmissionForm({
-  client,
-  existing,
-  onClose,
-  onSaved,
-}: {
-  client: WorkshopClient;
-  existing?: WorkshopSubmissionDetail;
-  onClose: () => void;
-  onSaved: () => void;
-}) {
-  const [type, setType] = useState<WorkshopSubmissionType>(existing?.type ?? "widget");
-  const [title, setTitle] = useState(existing?.title ?? "");
-  const [description, setDescription] = useState(existing?.description ?? "");
-  const [content, setContent] = useState(existing?.content ?? "");
-  const [changelog, setChangelog] = useState(existing?.changelog ?? "");
-  const [screenshots, setScreenshots] = useState<File[]>([]);
-  const [removedScreenshots, setRemovedScreenshots] = useState<string[]>([]);
-  const [error, setError] = useState("");
-  const [pending, setPending] = useState(false);
-  const submit = async (event: React.FormEvent) => {
-    event.preventDefault();
-    setPending(true);
-    setError("");
-    const input: WorkshopSubmissionInput = { type, title, description, content, changelog };
-    try {
-      if (!client.currentUser) await client.signInWithGitHub();
-      if (existing) {
-        await client.update(existing.id, input, screenshots, removedScreenshots);
-      } else {
-        await client.create(input, screenshots);
-      }
-      await onSaved();
-    } catch (caught) {
-      setError(caught instanceof Error ? caught.message : "Could not save submission");
-    } finally {
-      setPending(false);
-    }
-  };
-  return (
-    <div
-      className={styles.overlay}
-      role="presentation"
-      onMouseDown={(event) => {
-        if (event.target === event.currentTarget) onClose();
-      }}
-    >
-      <dialog className={styles.dialog} open aria-labelledby="submission-form-title">
-        <h2 id="submission-form-title">{existing ? "Update creation" : "Share with the community"}</h2>
-        <form onSubmit={(event) => void submit(event)}>
-          <label>
-            Type
-            <select
-              disabled={Boolean(existing)}
-              value={type}
-              onChange={(event) => setType(event.target.value as WorkshopSubmissionType)}
-            >
-              <option value="widget">Custom widget</option>
-              <option value="css">CSS theme</option>
-            </select>
-          </label>
-          <label>
-            Title
-            <input
-              required
-              minLength={3}
-              maxLength={100}
-              value={title}
-              onChange={(event) => setTitle(event.target.value)}
-            />
-          </label>
-          <label>
-            Description
-            <textarea maxLength={2000} value={description} onChange={(event) => setDescription(event.target.value)} />
-          </label>
-          <label>
-            {type === "widget" ? "Widget JSON" : "CSS source"}
-            <textarea
-              className={styles.editor}
-              required
-              value={content}
-              onChange={(event) => setContent(event.target.value)}
-            />
-          </label>
-          <label>
-            Changelog
-            <textarea maxLength={2000} value={changelog} onChange={(event) => setChangelog(event.target.value)} />
-          </label>
-          <label>
-            Screenshots (PNG, JPG, or WebP, up to 5)
-            <input
-              type="file"
-              accept="image/png,image/jpeg,image/webp"
-              multiple
-              onChange={(event) => setScreenshots(Array.from(event.target.files ?? []).slice(0, 5))}
-            />
-          </label>
-          {existing?.screenshots.map((screenshot) => (
-            <label className={styles.checkbox} key={screenshot}>
-              <input
-                type="checkbox"
-                checked={removedScreenshots.includes(screenshot)}
-                onChange={(event) =>
-                  setRemovedScreenshots((current) =>
-                    event.target.checked
-                      ? [...current, screenshot]
-                      : current.filter((filename) => filename !== screenshot),
-                  )
-                }
-              />
-              Remove existing screenshot {screenshot}
-            </label>
-          ))}
-          {error && (
-            <p className={styles.error} role="alert">
-              {error}
-            </p>
-          )}
-          <div className={styles.formActions}>
-            <button type="button" className="button button--secondary" onClick={onClose}>
-              Cancel
-            </button>
-            <button disabled={pending} className="button button--primary">
-              {pending ? "Saving…" : existing ? "Save update" : "Publish creation"}
-            </button>
-          </div>
-        </form>
-      </dialog>
-    </div>
-  );
-}
-
-function ReportForm({
-  client,
-  submissionId,
-  onClose,
-}: {
-  client: WorkshopClient;
-  submissionId: string;
-  onClose: () => void;
-}) {
-  const [category, setCategory] = useState<"malicious" | "spam" | "copyright" | "inappropriate" | "other">("malicious");
-  const [explanation, setExplanation] = useState("");
-  const [error, setError] = useState("");
-  return (
-    <div className={styles.overlay}>
-      <dialog className={styles.dialog} open aria-labelledby="report-title">
-        <h2 id="report-title">Report submission</h2>
-        <form
-          onSubmit={async (event) => {
-            event.preventDefault();
-            try {
-              if (!client.currentUser) await client.signInWithGitHub();
-              await client.report(submissionId, category, explanation);
-              onClose();
-            } catch (caught) {
-              setError(caught instanceof Error ? caught.message : "Could not send report");
-            }
-          }}
-        >
-          <label>
-            Reason
-            <select value={category} onChange={(event) => setCategory(event.target.value as typeof category)}>
-              <option value="malicious">Malicious</option>
-              <option value="spam">Spam</option>
-              <option value="copyright">Copyright</option>
-              <option value="inappropriate">Inappropriate</option>
-              <option value="other">Other</option>
-            </select>
-          </label>
-          <label>
-            Details
-            <textarea
-              required
-              minLength={3}
-              maxLength={1000}
-              value={explanation}
-              onChange={(event) => setExplanation(event.target.value)}
-            />
-          </label>
-          {error && <p className={styles.error}>{error}</p>}
-          <div className={styles.formActions}>
-            <button type="button" className="button button--secondary" onClick={onClose}>
-              Cancel
-            </button>
-            <button className="button button--primary">Submit report</button>
-          </div>
-        </form>
-      </dialog>
-    </div>
-  );
-}
-
-function WorkshopSkeleton() {
-  return (
-    <div className={styles.grid} aria-label="Loading Workshop">
-      {Array.from({ length: 6 }, (_, index) => (
-        <div className={styles.skeleton} key={index} />
-      ))}
-    </div>
-  );
-}

apps/docs/src/components/workshop/workshop.module.css

@@ -1,299 +0,0 @@
-.page {
-  max-width: 1240px;
-  min-height: 70vh;
-  margin: 0 auto;
-  padding: 2.5rem 1.25rem 5rem;
-}
-.hero {
-  display: flex;
-  align-items: flex-end;
-  justify-content: space-between;
-  gap: 2rem;
-  margin-bottom: 1.5rem;
-}
-.hero h1,
-.detail h1 {
-  margin: 0;
-  font-size: 2.25rem;
-  letter-spacing: -0.025em;
-}
-.hero p {
-  max-width: 65ch;
-  margin: 0.5rem 0 0;
-  color: var(--ifm-color-emphasis-700);
-}
-.accountActions,
-.detailActions,
-.formActions {
-  display: flex;
-  align-items: center;
-  flex-wrap: wrap;
-  gap: 0.75rem;
-}
-.accountActions :global(.button),
-.detailActions :global(.button) {
-  display: inline-flex;
-  align-items: center;
-  gap: 0.4rem;
-}
-.safety {
-  display: flex;
-  align-items: flex-start;
-  gap: 0.75rem;
-  padding: 0.85rem 1rem;
-  margin-bottom: 1.5rem;
-  border: 1px solid var(--ifm-color-warning-dark);
-  border-radius: 10px;
-  background: color-mix(in srgb, var(--ifm-color-warning) 10%, transparent);
-}
-.safety p {
-  margin: 0;
-}
-.toolbar {
-  display: flex;
-  align-items: end;
-  flex-wrap: wrap;
-  gap: 0.75rem;
-  padding: 0.75rem;
-  margin-bottom: 1.5rem;
-  border: 1px solid var(--ifm-color-emphasis-300);
-  border-radius: 10px;
-}
-.toolbar label,
-.dialog label {
-  display: grid;
-  gap: 0.3rem;
-  font-size: 0.8rem;
-  font-weight: 600;
-}
-.toolbar input,
-.toolbar select,
-.dialog input,
-.dialog select,
-.dialog textarea {
-  min-height: 44px;
-  padding: 0.55rem 0.7rem;
-  border: 1px solid var(--ifm-color-emphasis-400);
-  border-radius: 7px;
-  color: var(--ifm-font-color-base);
-  background: var(--ifm-background-surface-color);
-  font: inherit;
-}
-.search {
-  position: relative;
-  flex: 1 1 280px;
-}
-.search svg {
-  position: absolute;
-  left: 0.75rem;
-  bottom: 0.8rem;
-  color: var(--ifm-color-emphasis-600);
-}
-.search input {
-  width: 100%;
-  padding-left: 2.25rem;
-}
-.checkbox {
-  display: flex !important;
-  grid-auto-flow: column;
-  align-items: center;
-  min-height: 44px;
-}
-.checkbox input {
-  min-height: auto;
-}
-.grid {
-  display: grid;
-  grid-template-columns: repeat(auto-fit, minmax(270px, 1fr));
-  gap: 1rem;
-}
-.card {
-  overflow: hidden;
-  border: 1px solid var(--ifm-color-emphasis-300);
-  border-radius: 12px;
-  background: var(--ifm-background-surface-color);
-}
-.card img,
-.cardPlaceholder {
-  width: 100%;
-  aspect-ratio: 3 / 2;
-  object-fit: cover;
-}
-.cardPlaceholder {
-  display: grid;
-  place-items: center;
-  background: var(--ifm-color-emphasis-100);
-  color: var(--ifm-color-emphasis-600);
-  font: 700 1.5rem var(--ifm-font-family-monospace);
-}
-.cardBody {
-  padding: 1rem;
-}
-.cardBody h2 {
-  margin: 0.4rem 0;
-  font-size: 1.08rem;
-}
-.cardBody p {
-  min-height: 2.7em;
-  margin: 0 0 0.65rem;
-  color: var(--ifm-color-emphasis-700);
-  font-size: 0.9rem;
-}
-.cardMeta {
-  display: flex;
-  justify-content: space-between;
-  color: var(--ifm-color-emphasis-700);
-  font-size: 0.75rem;
-  font-weight: 700;
-}
-.error {
-  padding: 0.85rem 1rem;
-  margin: 1rem 0;
-  border-radius: 8px;
-  color: var(--ifm-color-danger-contrast-foreground);
-  background: var(--ifm-color-danger-contrast-background);
-}
-.empty {
-  padding: 4rem 1rem;
-  text-align: center;
-  border: 1px dashed var(--ifm-color-emphasis-400);
-  border-radius: 12px;
-}
-.pagination {
-  display: flex;
-  justify-content: center;
-  align-items: center;
-  gap: 1rem;
-  margin-top: 2rem;
-}
-.pagination button {
-  min-height: 44px;
-  padding: 0.5rem 0.8rem;
-}
-.skeleton {
-  min-height: 310px;
-  border-radius: 12px;
-  background: var(--ifm-color-emphasis-200);
-  animation: pulse 1.5s ease-in-out infinite;
-}
-.detail {
-  margin-top: 1.5rem;
-}
-.detail header {
-  max-width: 75ch;
-}
-.type {
-  display: inline-block;
-  margin-bottom: 0.5rem;
-  color: var(--ifm-color-primary);
-  font-weight: 700;
-}
-.gallery {
-  display: flex;
-  gap: 1rem;
-  overflow-x: auto;
-  margin: 1.5rem 0;
-  scroll-snap-type: x mandatory;
-}
-.gallery img {
-  width: min(720px, 85vw);
-  max-height: 480px;
-  object-fit: contain;
-  border-radius: 10px;
-  background: var(--ifm-color-emphasis-100);
-  scroll-snap-align: start;
-}
-.detailActions {
-  margin: 1.5rem 0 2rem;
-}
-.sourceHint {
-  color: var(--ifm-color-emphasis-700);
-}
-.source {
-  max-height: 560px;
-  overflow: auto;
-  padding: 1rem;
-  border-radius: 8px;
-  font-size: 0.78rem;
-}
-.overlay {
-  position: fixed;
-  z-index: 500;
-  inset: 0;
-  display: grid;
-  place-items: center;
-  padding: 1rem;
-  background: rgb(0 0 0 / 0.7);
-}
-.dialog {
-  width: min(680px, 100%);
-  max-height: 90vh;
-  overflow-y: auto;
-  padding: 1.25rem;
-  border-radius: 12px;
-  background: var(--ifm-background-color);
-}
-.dialog form {
-  display: grid;
-  gap: 1rem;
-}
-.dialog textarea {
-  min-height: 88px;
-  resize: vertical;
-}
-.dialog .editor {
-  min-height: 240px;
-  font-family: var(--ifm-font-family-monospace);
-  font-size: 0.78rem;
-}
-.formActions {
-  justify-content: flex-end;
-}
-@keyframes pulse {
-  50% {
-    opacity: 0.55;
-  }
-}
-@media (max-width: 700px) {
-  .hero {
-    align-items: stretch;
-    flex-direction: column;
-  }
-  .accountActions > * {
-    flex: 1;
-    justify-content: center;
-  }
-  .toolbar > label {
-    flex: 1 1 100%;
-  }
-}
-@media (prefers-reduced-motion: reduce) {
-  .skeleton {
-    animation: none;
-  }
-}
-.adminSection {
-  margin: 2rem 0;
-}
-.tableWrap {
-  overflow-x: auto;
-}
-.tableWrap table {
-  width: 100%;
-  border-collapse: collapse;
-}
-.tableWrap th,
-.tableWrap td {
-  padding: 0.7rem;
-  border-bottom: 1px solid var(--ifm-color-emphasis-300);
-  text-align: left;
-  vertical-align: top;
-}
-.rowActions {
-  display: flex;
-  flex-wrap: wrap;
-  gap: 0.4rem;
-}
-.rowActions button {
-  min-height: 36px;
-}

apps/docs/src/pages/workshop/admin/index.tsx

@@ -1,16 +0,0 @@
-import React from "react";
-import BrowserOnly from "@docusaurus/BrowserOnly";
-import Layout from "@theme/Layout";
-
-export default function WorkshopAdminPage() {
-  return (
-    <Layout title="Workshop moderation" noFooter>
-      <BrowserOnly fallback={<main style={{ minHeight: "70vh" }} />}>
-        {() => {
-          const { WorkshopAdmin } = require("@site/src/components/workshop/WorkshopAdmin");
-          return <WorkshopAdmin />;
-        }}
-      </BrowserOnly>
-    </Layout>
-  );
-}

apps/docs/src/pages/workshop/index.tsx

@@ -1,16 +0,0 @@
-import React from "react";
-import BrowserOnly from "@docusaurus/BrowserOnly";
-import Layout from "@theme/Layout";
-
-export default function WorkshopPage() {
-  return (
-    <Layout title="Workshop" description="Community widgets and CSS themes for Homarr">
-      <BrowserOnly fallback={<main style={{ minHeight: "70vh" }} />}>
-        {() => {
-          const { WorkshopApp } = require("@site/src/components/workshop/WorkshopPage");
-          return <WorkshopApp />;
-        }}
-      </BrowserOnly>
-    </Layout>
-  );
-}

apps/nextjs/package.json

@@ -50,7 +50,6 @@
     "@homarr/validation": "workspace:^0.1.0",
     "@homarr/websocket": "workspace:^0.1.0",
     "@homarr/widgets": "workspace:^0.1.0",
-    "@homarr/workshop": "workspace:^0.1.0",
     "@mantine/colors-generator": "catalog:",
     "@mantine/core": "catalog:",
     "@mantine/dropzone": "catalog:",

apps/nextjs/src/app/[locale]/_client-providers/trpc.tsx

@@ -2,6 +2,7 @@
 
 import type { PropsWithChildren } from "react";
 import { useState } from "react";
+import type { QueryKey } from "@tanstack/react-query";
 import { QueryClient } from "@tanstack/react-query";
 import { ReactQueryDevtools } from "@tanstack/react-query-devtools";
 import { ReactQueryStreamedHydration } from "@tanstack/react-query-next-experimental";
@@ -33,6 +34,7 @@ import {
 import { createHeadersCallbackForSource, getTrpcUrl } from "@homarr/api/shared";
 import { env } from "@homarr/common/env";
 import { showWarningNotification } from "@homarr/notifications";
+import { widgetImports } from "@homarr/widgets";
 
 import { createWidgetQueryPersister } from "./query-cache-persister";
 
@@ -90,6 +92,13 @@ export function TRPCReactProvider(props: PropsWithChildren) {
       },
     });
     client.setQueryDefaults([["widget"]], { refetchInterval: queryCacheDefaultRefetchIntervalMs });
+    for (const { definition } of Object.values(widgetImports)) {
+      const def = definition as { refetchInterval?: number | null; queryKey?: QueryKey; kind: string };
+      if (def.refetchInterval === undefined) continue;
+      const key = def.queryKey ?? [["widget", def.kind]];
+      const interval = def.refetchInterval === null ? false : def.refetchInterval * 1000;
+      client.setQueryDefaults(key, { refetchInterval: interval });
+    }
     return client;
   });
 

apps/nextjs/src/app/[locale]/boards/[name]/settings/_customCss.tsx

@@ -11,9 +11,6 @@ import { IconInfoCircle } from "@tabler/icons-react";
 import { useForm } from "@homarr/form";
 import { useI18n, useScopedI18n } from "@homarr/translation/client";
 
-import { PublishToWorkshopButton } from "~/components/workshop/workshop-browser";
-import { UseCssFromWorkshopButton } from "~/components/workshop/workshop-actions";
-
 import type { Board } from "../../_types";
 import { useSavePartialSettingsMutation } from "./_shared";
 import classes from "./customcss.module.css";
@@ -48,11 +45,7 @@ export const CustomCssSettingsContent = ({ board }: Props) => {
           {customCssT("customClassesAlert.description")}
         </Alert>
 
-        <Group justify="space-between">
-          <Group>
-            <UseCssFromWorkshopButton onUse={(css) => form.setFieldValue("customCss", css)} />
-            <PublishToWorkshopButton type="css" defaultTitle={board.name} getContent={() => form.values.customCss} />
-          </Group>
+        <Group justify="end">
           <Button type="submit" loading={isPending}>
             {t("common.action.saveChanges")}
           </Button>

apps/nextjs/src/app/[locale]/manage/apps/edit/[id]/page.tsx

@@ -16,7 +16,10 @@ export default async function AppEditPage(props: AppEditPageProps) {
   const params = await props.params;
   const session = await auth();
 
-  if (!session?.user.permissions.includes("app-modify-all")) {
+  if (
+    !session?.user.permissions.includes("board-modify-all") ||
+    !session?.user.permissions.includes("app-modify-all")
+  ) {
     notFound();
   }
   const app = await api.app.byId({ id: params.id });

apps/nextjs/src/app/[locale]/manage/apps/new/page.tsx

@@ -10,7 +10,7 @@ import { DynamicBreadcrumb } from "~/components/navigation/dynamic-breadcrumb";
 export default async function AppNewPage() {
   const session = await auth();
 
-  if (!session?.user.permissions.includes("app-create")) {
+  if (!session?.user.permissions.includes("board-modify-all") || !session?.user.permissions.includes("app-create")) {
     notFound();
   }
 

apps/nextjs/src/app/[locale]/manage/apps/page.tsx

@@ -1,5 +1,5 @@
 import { Fragment } from "react";
-import { redirect } from "next/navigation";
+import { notFound, redirect } from "next/navigation";
 import { ActionIcon, ActionIconGroup, Anchor, Avatar, Card, Group, Stack, Text } from "@mantine/core";
 import { IconBox, IconPencil } from "@tabler/icons-react";
 import { z } from "zod/v4";
@@ -33,6 +33,9 @@ export default async function AppsPage(props: AppsPageProps) {
   if (!session) {
     redirect("/auth/login");
   }
+  if (!session.user.permissions.includes("board-modify-all")) {
+    notFound();
+  }
 
   const searchParams = searchParamsSchema.parse(await props.searchParams);
 

apps/nextjs/src/app/[locale]/manage/custom-widgets/_custom-widget-actions.tsx

@@ -6,7 +6,6 @@ import {
   IconCopy,
   IconDots,
   IconDownload,
-  IconShare3,
   IconToggleLeft,
   IconToggleRight,
   IconTrash,
@@ -20,7 +19,6 @@ import { showErrorNotification, showSuccessNotification } from "@homarr/notifica
 import { useScopedI18n } from "@homarr/translation/client";
 
 import { MobileAffixButton } from "~/components/manage/mobile-affix-button";
-import { PublishToWorkshopButton } from "~/components/workshop/workshop-browser";
 
 const iconProps = { size: 16, stroke: 1.5 };
 
@@ -32,7 +30,6 @@ interface WidgetRef {
 
 export const CustomWidgetRowActions = ({ widget }: { widget: WidgetRef }) => {
   const t = useScopedI18n("customWidget");
-  const workshopT = useScopedI18n("workshop");
   const { openConfirmModal } = useConfirmModal();
   const deleteMutation = clientApi.customWidget.delete.useMutation();
   const duplicateMutation = clientApi.customWidget.duplicate.useMutation();
@@ -144,16 +141,6 @@ export const CustomWidgetRowActions = ({ widget }: { widget: WidgetRef }) => {
         <Menu.Item onClick={() => void handleExport()} leftSection={<IconDownload {...iconProps} />}>
           {t("action.export")}
         </Menu.Item>
-        <PublishToWorkshopButton
-          type="widget"
-          defaultTitle={widget.name}
-          getContent={async () => JSON.stringify(await utils.customWidget.export.fetch({ id: widget.id }), null, 2)}
-          renderTrigger={(open) => (
-            <Menu.Item onClick={open} leftSection={<IconShare3 {...iconProps} />}>
-              {workshopT("action.share")}
-            </Menu.Item>
-          )}
-        />
         <Menu.Divider />
         <Menu.Item
           color="red"

apps/nextjs/src/app/[locale]/manage/custom-widgets/page.tsx

@@ -9,7 +9,6 @@ import { Link } from "@homarr/ui";
 
 import { ManagePageLayout } from "~/components/manage/manage-page-layout";
 import { MobileAffixButton } from "~/components/manage/mobile-affix-button";
-import { InstallWidgetFromWorkshopButton } from "~/components/workshop/workshop-actions";
 import { CustomWidgetBetaBanner } from "./_beta-banner";
 import { ImportCustomWidgetButton } from "./_custom-widget-actions";
 import { CustomWidgetList } from "./_custom-widget-list";
@@ -29,7 +28,6 @@ export default async function CustomWidgetsPage() {
       title={t("page.list.title")}
       primaryAction={
         <Group gap="xs">
-          <InstallWidgetFromWorkshopButton />
           <ImportCustomWidgetButton />
           <MobileAffixButton component={Link} href="/manage/custom-widgets/new" leftSection={<IconPlus size={16} />}>
             {t("action.create")}

apps/nextjs/src/app/[locale]/manage/layout.tsx

@@ -18,7 +18,6 @@ import {
   IconHomeFilled,
   IconLayoutDashboardFilled,
   IconMailForward,
-  IconBuildingStore,
   IconPhotoFilled,
   IconPointerFilled,
   IconSearch,
@@ -62,7 +61,7 @@ export default async function ManageLayout({ children }: PropsWithChildren) {
       icon: IconBox,
       href: "/manage/apps",
       label: t("items.apps"),
-      hidden: !session,
+      hidden: !session?.user.permissions.includes("app-create"),
       iconProps: {
         strokeWidth: 2.5,
       },
@@ -72,26 +71,20 @@ export default async function ManageLayout({ children }: PropsWithChildren) {
       icon: IconAffiliateFilled,
       href: "/manage/integrations",
       label: t("items.integrations"),
-      hidden: !session,
+      hidden: !session?.user.permissions.includes("integration-create"),
       "data-onboarding-tour-id": "manage-integrations",
     },
     {
       icon: IconApi,
       href: "/manage/custom-widgets",
       label: t("items.customWidgets"),
-      hidden: !session,
-    },
-    {
-      icon: IconBuildingStore,
-      href: "/manage/workshop",
-      label: t("items.workshop"),
       hidden: !session?.user.permissions.includes("admin"),
     },
     {
       icon: IconSearch,
       href: "/manage/search-engines",
       label: t("items.searchEngies"),
-      hidden: !session,
+      hidden: !session?.user.permissions.includes("search-engine-create"),
       iconProps: {
         strokeWidth: 2.5,
       },
@@ -101,7 +94,7 @@ export default async function ManageLayout({ children }: PropsWithChildren) {
       icon: IconPhotoFilled,
       href: "/manage/medias",
       label: t("items.medias"),
-      hidden: !session,
+      hidden: !session?.user.permissions.includes("media-upload"),
       "data-onboarding-tour-id": "manage-medias",
     },
     {

apps/nextjs/src/app/[locale]/manage/tools/docker/docker-table.tsx

@@ -193,6 +193,10 @@ export function DockerTable({ initialData }: DockerTableProps) {
     positionToolbarAlertBanner: "top",
     enableTableFooter: false,
     enableBottomToolbar: false,
+    // MRT's built-in full-screen mode does not stretch the table to fill the
+    // viewport, so with few containers it renders as a thin strip (#6230). Disable
+    // it, matching the other management tables (users, invites).
+    enableFullScreenToggle: false,
     positionGlobalFilter: "right",
     mantineSearchTextInputProps: {
       placeholder: tDocker("table.search", { count: String(containers.length) }),

apps/nextjs/src/app/[locale]/manage/users/[userId]/general/_components/_general-settings-form.tsx

@@ -31,6 +31,7 @@ import {
   userChangeHomeBoardsSchema,
   userChangeSearchPreferencesSchema,
   userEditProfileSchema,
+  userEnableRightClickOnWidgetsSchema,
   userFirstDayOfWeekSchema,
   userPingIconsEnabledSchema,
 } from "@homarr/validation/user";
@@ -51,6 +52,7 @@ const userGeneralSettingsSchema = z.object({
   ddgBangsEnabled: userChangeSearchPreferencesSchema.shape.ddgBangsEnabled,
   firstDayOfWeek: userFirstDayOfWeekSchema.shape.firstDayOfWeek,
   pingIconsEnabled: userPingIconsEnabledSchema.shape.pingIconsEnabled,
+  enableRightClickOnWidgets: userEnableRightClickOnWidgetsSchema.shape.enableRightClickOnWidgets,
 });
 
 type FormValues = z.infer<typeof userGeneralSettingsSchema>;
@@ -78,6 +80,7 @@ const buildInitialValues = (user: RouterOutputs["user"]["getById"]): FormValues
   ddgBangsEnabled: user.ddgBangs,
   firstDayOfWeek: user.firstDayOfWeek as DayOfWeek,
   pingIconsEnabled: user.pingIconsEnabled,
+  enableRightClickOnWidgets: user.enableRightClickOnWidgets,
 });
 
 export const UserGeneralSettingsForm = ({
@@ -95,6 +98,7 @@ export const UserGeneralSettingsForm = ({
   const changeSearchPreferencesMutation = clientApi.user.changeSearchPreferences.useMutation();
   const changeFirstDayOfWeekMutation = clientApi.user.changeFirstDayOfWeek.useMutation();
   const changePingIconsEnabledMutation = clientApi.user.changePingIconsEnabled.useMutation();
+  const changeEnableRightClickOnWidgetsMutation = clientApi.user.changeEnableRightClickOnWidgets.useMutation();
 
   const initialValues = buildInitialValues(user);
   const initialValuesRef = useRef(initialValues);
@@ -114,6 +118,7 @@ export const UserGeneralSettingsForm = ({
     changeSearchPreferencesMutation,
     changeFirstDayOfWeekMutation,
     changePingIconsEnabledMutation,
+    changeEnableRightClickOnWidgetsMutation,
   ];
   const isPending = mutations.some((m) => m.isPending);
 
@@ -169,6 +174,14 @@ export const UserGeneralSettingsForm = ({
         action: () =>
           changePingIconsEnabledMutation.mutateAsync({ id: user.id, pingIconsEnabled: parsed.data.pingIconsEnabled }),
       },
+      {
+        when: changed("enableRightClickOnWidgets"),
+        action: () =>
+          changeEnableRightClickOnWidgetsMutation.mutateAsync({
+            id: user.id,
+            enableRightClickOnWidgets: parsed.data.enableRightClickOnWidgets,
+          }),
+      },
     ];
 
     const promises = saveActions.filter((s) => s.when).map((s) => s.action());
@@ -305,6 +318,11 @@ export const UserGeneralSettingsForm = ({
                 label={t("user.field.pingIconsEnabled.label")}
                 {...form.getInputProps("pingIconsEnabled", { type: "checkbox" })}
               />
+              <Switch
+                label={t("user.field.enableRightClickOnWidgets.label")}
+                description={t("user.field.enableRightClickOnWidgets.description")}
+                {...form.getInputProps("enableRightClickOnWidgets", { type: "checkbox" })}
+              />
             </Stack>
           </Card>
         </SimpleGrid>

apps/nextjs/src/app/[locale]/manage/workshop/page.tsx

@@ -1,18 +0,0 @@
-import { redirect } from "next/navigation";
-
-import { auth } from "@homarr/auth/next";
-import { getScopedI18n } from "@homarr/translation/server";
-
-import { ManagePageLayout } from "~/components/manage/manage-page-layout";
-import { WorkshopBrowser } from "~/components/workshop/workshop-browser";
-
-export default async function WorkshopPage() {
-  const session = await auth();
-  if (!session?.user.permissions.includes("admin")) redirect(session ? "/" : "/auth/login");
-  const t = await getScopedI18n("workshop");
-  return (
-    <ManagePageLayout title={t("title")} size="xl">
-      <WorkshopBrowser />
-    </ManagePageLayout>
-  );
-}

apps/nextjs/src/app/api/image-proxy/[id]/route.ts

@@ -1,19 +1,25 @@
-import { notFound } from "next/navigation";
-
 import { ImageProxy } from "@homarr/image-proxy";
 
 export const GET = async (_request: Request, props: { params: Promise<{ id: string }> }) => {
   const { id } = await props.params;
 
   const imageProxy = new ImageProxy();
-  const image = await imageProxy.forwardImageAsync(id);
-  if (!image) {
-    notFound();
+  const result = await imageProxy.forwardImageAsync(id);
+
+  if ("error" in result) {
+    const status = result.error === "upstream-error" ? result.statusCode : result.error === "fetch-error" ? 502 : 404;
+    return new Response(null, {
+      status,
+      headers: {
+        "X-Homarr-Image-Proxy-Error": result.error,
+      },
+    });
   }
 
-  return new Response(image, {
+  return new Response(result.image, {
     headers: {
       "Cache-Control": "public, max-age=3600, immutable", // Cache for 1 hour
+      ...(result.contentType ? { "Content-Type": result.contentType } : {}),
     },
   });
 };

apps/nextjs/src/components/board/items/widget-context-menu.tsx

@@ -1,9 +1,17 @@
 "use client";
 
 import type { MutableRefObject, ReactNode } from "react";
-import { useCallback, useEffect, useMemo, useState } from "react";
-import { Group, Loader, Menu, Switch, Text } from "@mantine/core";
-import { IconCopy, IconLayoutKanban, IconRefresh, IconSettings, IconTrash } from "@tabler/icons-react";
+import { useCallback, useMemo } from "react";
+import { Group, Loader, Menu, Switch, Text, Tooltip } from "@mantine/core";
+import {
+  IconAlertTriangle,
+  IconCircleCheck,
+  IconCopy,
+  IconLayoutKanban,
+  IconRefresh,
+  IconSettings,
+  IconTrash,
+} from "@tabler/icons-react";
 import type { QueryClient, QueryKey } from "@tanstack/react-query";
 import { useIsFetching, useQueryClient } from "@tanstack/react-query";
 
@@ -11,10 +19,12 @@ import { clientApi } from "@homarr/api/client";
 import { useSession } from "@homarr/auth/client";
 import { useRequiredBoard } from "@homarr/boards/context";
 import { useEditMode } from "@homarr/boards/edit-mode";
+import { useTimeAgo } from "@homarr/common";
 import { useConfirmModal, useModalAction } from "@homarr/modals";
 import { useSettings } from "@homarr/settings";
 import { translateIfNecessary } from "@homarr/translation";
 import { useI18n, useScopedI18n } from "@homarr/translation/client";
+import type { TranslationFunction } from "@homarr/translation";
 import type { WidgetContextMenuAction } from "@homarr/widgets";
 import { reduceWidgetOptionsWithDefaultValues, widgetImports } from "@homarr/widgets";
 import { WidgetEditModal } from "@homarr/widgets/modals";
@@ -38,6 +48,7 @@ export const WidgetContextMenu = ({ item, widgetStateRef, children }: WidgetCont
   const tMenu = useScopedI18n("item.menu.label");
   const t = useI18n();
   const settings = useSettings();
+  const isRightClickEnabled = settings.enableRightClickOnWidgets;
   const { openModal } = useModalAction(WidgetEditModal);
   const { openModal: openMoveModal } = useModalAction(ItemMoveModal);
   const { openConfirmModal } = useConfirmModal();
@@ -158,6 +169,7 @@ export const WidgetContextMenu = ({ item, widgetStateRef, children }: WidgetCont
   );
 
   if (!session) return <>{children}</>;
+  if (!isRightClickEnabled) return <>{children}</>;
 
   const visibleWidgetActions = widgetContextActions.filter((a) => !a.hidden);
 
@@ -232,11 +244,14 @@ export const WidgetContextMenu = ({ item, widgetStateRef, children }: WidgetCont
             onClick={handleRefetch}
             disabled={isWidgetFetching}
           >
-            <Group justify="space-between" wrap="nowrap">
+            <Group justify="space-between" wrap="nowrap" gap="sm">
               {tMenu("refresh")}
-              <Text size="xs" c="dimmed">
-                <WidgetCacheAge queryClient={queryClient} queryKey={widgetQueryKey} isFetching={isWidgetFetching} />
-              </Text>
+              <WidgetQueryStatus
+                queryClient={queryClient}
+                queryKey={widgetQueryKey}
+                isFetching={isWidgetFetching}
+                t={t}
+              />
             </Group>
           </Menu.Item>
           <Menu.Item
@@ -273,34 +288,65 @@ export const WidgetContextMenu = ({ item, widgetStateRef, children }: WidgetCont
   );
 };
 
-const WidgetCacheAge = ({
-  queryClient,
-  queryKey,
-  isFetching,
-}: {
+interface WidgetQueryStatusProps {
   queryClient: QueryClient;
   queryKey: QueryKey;
   isFetching: boolean;
-}) => {
-  // 1s tick for "just now" → "1s ago" label transition; isFetching prop handles refetch reactivity
-  const [, setTick] = useState(0);
-  useEffect(() => {
-    const id = setInterval(() => setTick((n) => n + 1), 1000);
-    return () => clearInterval(id);
-  }, []);
+  t: TranslationFunction;
+}
 
-  if (isFetching) return <Loader size={12} />;
+const WidgetQueryStatus = ({ queryClient, queryKey, isFetching, t }: WidgetQueryStatusProps) => {
+  const queries = queryClient.getQueryCache().findAll({ queryKey });
+  const timestamps = queries.map((query) => query.state.dataUpdatedAt).filter(Boolean);
+  const latest = timestamps.length > 0 ? Math.max(...timestamps) : 0;
+  const ageLabel = useTimeAgo(new Date(latest));
 
-  const timestamps = queryClient
-    .getQueryCache()
-    .findAll({ queryKey })
-    .map((q) => q.state.dataUpdatedAt)
-    .filter(Boolean);
-  if (timestamps.length === 0) return null;
+  if (isFetching) {
+    return (
+      <Group gap={4} wrap="nowrap">
+        <Loader size={12} />
+        <Text size="xs" c="dimmed">
+          {t("item.menu.status.loading")}
+        </Text>
+      </Group>
+    );
+  }
 
-  const latest = Math.max(...timestamps);
-  const seconds = Math.floor((Date.now() - latest) / 1000);
-  if (seconds < 5) return "just now";
-  if (seconds < 60) return `${seconds}s ago`;
-  return `${Math.floor(seconds / 60)}m ago`;
+  if (queries.length === 0) {
+    return (
+      <Text size="xs" c="dimmed">
+        {t("item.menu.status.idle")}
+      </Text>
+    );
+  }
+
+  const hasError = queries.some((q) => q.state.status === "error");
+
+  if (hasError) {
+    const errorQuery = queries.find((q) => q.state.status === "error");
+    const errorMessage =
+      errorQuery?.state.error instanceof Error
+        ? errorQuery.state.error.message
+        : String(errorQuery?.state.error ?? "Unknown error");
+
+    return (
+      <Tooltip label={errorMessage} multiline position="left" w={250}>
+        <Group gap={4} wrap="nowrap">
+          <IconAlertTriangle size={12} color="var(--mantine-color-red-6)" />
+          <Text size="xs" c="red.6">
+            {t("item.menu.status.error")} · {ageLabel}
+          </Text>
+        </Group>
+      </Tooltip>
+    );
+  }
+
+  return (
+    <Group gap={4} wrap="nowrap">
+      <IconCircleCheck size={12} color="var(--mantine-color-green-6)" />
+      <Text size="xs" c="dimmed">
+        {t("item.menu.status.success")} · {ageLabel}
+      </Text>
+    </Group>
+  );
 };

apps/nextjs/src/components/workshop/workshop-actions.tsx

@@ -1,72 +0,0 @@
-"use client";
-
-import { Button, Modal } from "@mantine/core";
-import { useDisclosure } from "@mantine/hooks";
-import { IconBuildingStore } from "@tabler/icons-react";
-
-import { clientApi } from "@homarr/api/client";
-import { revalidatePathActionAsync } from "@homarr/common/client";
-import { showErrorNotification, showSuccessNotification } from "@homarr/notifications";
-import { useScopedI18n } from "@homarr/translation/client";
-import { customWidgetImportSchema } from "@homarr/validation/custom-widget";
-import { validateWorkshopContent } from "@homarr/workshop";
-
-import { WorkshopBrowser } from "./workshop-browser";
-
-export function InstallWidgetFromWorkshopButton() {
-  const t = useScopedI18n("workshop");
-  const [opened, { open, close }] = useDisclosure(false);
-  const utils = clientApi.useUtils();
-  const mutation = clientApi.customWidget.import.useMutation({
-    onSuccess: () => {
-      showSuccessNotification({ title: t("title"), message: t("action.install") });
-      void utils.customWidget.all.invalidate();
-      void revalidatePathActionAsync("/manage/custom-widgets");
-      close();
-    },
-    onError: (error) => showErrorNotification({ title: t("title"), message: error.message }),
-  });
-  return (
-    <>
-      <Button variant="default" leftSection={<IconBuildingStore size={16} />} onClick={open}>
-        {t("action.install")}
-      </Button>
-      <Modal opened={opened} onClose={close} title={t("title")} size="90%" fullScreen={false}>
-        <WorkshopBrowser
-          initialType="widget"
-          lockedType="widget"
-          useLabel={t("action.install")}
-          onUse={async (submission) => {
-            const parsed = customWidgetImportSchema.parse(JSON.parse(submission.content));
-            await mutation.mutateAsync(parsed);
-          }}
-        />
-      </Modal>
-    </>
-  );
-}
-
-export function UseCssFromWorkshopButton({ onUse }: { onUse: (css: string) => void }) {
-  const t = useScopedI18n("workshop");
-  const [opened, { open, close }] = useDisclosure(false);
-  return (
-    <>
-      <Button variant="default" leftSection={<IconBuildingStore size={16} />} onClick={open}>
-        {t("action.useCss")}
-      </Button>
-      <Modal opened={opened} onClose={close} title={t("title")} size="90%">
-        <WorkshopBrowser
-          initialType="css"
-          lockedType="css"
-          useLabel={t("action.useCss")}
-          onUse={(submission) => {
-            const validation = validateWorkshopContent("css", submission.content);
-            if (!validation.success) throw new Error(validation.error);
-            onUse(submission.content);
-            close();
-          }}
-        />
-      </Modal>
-    </>
-  );
-}

apps/nextjs/src/components/workshop/workshop-browser.tsx

@@ -1,339 +0,0 @@
-"use client";
-
-import type { ReactNode } from "react";
-import { useEffect, useMemo, useState } from "react";
-import {
-  Alert,
-  Badge,
-  Box,
-  Button,
-  Card,
-  Code,
-  Group,
-  Image,
-  Modal,
-  Pagination,
-  Select,
-  SimpleGrid,
-  Skeleton,
-  Stack,
-  Text,
-  TextInput,
-  Textarea,
-} from "@mantine/core";
-import { useDebouncedValue, useDisclosure } from "@mantine/hooks";
-import { IconAlertTriangle, IconBrandGithub, IconDownload, IconExternalLink, IconSearch } from "@tabler/icons-react";
-import { useQuery } from "@tanstack/react-query";
-
-import type { WorkshopSubmissionDetail, WorkshopSubmissionType } from "@homarr/workshop";
-
-import { WORKSHOP_API_URL, WORKSHOP_WEB_URL, WorkshopClient, workshopExportFilename } from "@homarr/workshop";
-import { useScopedI18n } from "@homarr/translation/client";
-
-const apiUrl = process.env.NEXT_PUBLIC_WORKSHOP_API_URL ?? WORKSHOP_API_URL;
-
-export interface WorkshopBrowserProps {
-  initialType?: WorkshopSubmissionType | "all";
-  lockedType?: WorkshopSubmissionType;
-  onUse?: (submission: WorkshopSubmissionDetail) => Promise<void> | void;
-  useLabel?: string;
-}
-
-export function WorkshopBrowser({ initialType = "all", lockedType, onUse, useLabel }: WorkshopBrowserProps) {
-  const t = useScopedI18n("workshop");
-  const client = useMemo(() => new WorkshopClient(apiUrl), []);
-  const [page, setPage] = useState(1);
-  const [type, setType] = useState<WorkshopSubmissionType | "all">(initialType);
-  const [sort, setSort] = useState<"top" | "newest">("top");
-  const [search, setSearch] = useState("");
-  const [debouncedSearch] = useDebouncedValue(search, 250);
-  const [selected, setSelected] = useState<WorkshopSubmissionDetail | null>(null);
-  const [detailLoading, setDetailLoading] = useState(false);
-  const [usePending, setUsePending] = useState(false);
-  const [useError, setUseError] = useState("");
-
-  const query = useQuery({
-    queryKey: ["workshop", "list", page, type, sort, debouncedSearch],
-    queryFn: () => client.list({ page, type, sort, search: debouncedSearch, perPage: 12 }),
-  });
-
-  const openDetail = async (id: string) => {
-    setDetailLoading(true);
-    try {
-      setSelected(await client.get(id));
-    } finally {
-      setDetailLoading(false);
-    }
-  };
-
-  const download = (submission: WorkshopSubmissionDetail) => {
-    const url = URL.createObjectURL(
-      new Blob([submission.content], { type: submission.type === "css" ? "text/css" : "application/json" }),
-    );
-    const anchor = document.createElement("a");
-    anchor.href = url;
-    anchor.download = workshopExportFilename(submission.title, submission.type);
-    anchor.click();
-    URL.revokeObjectURL(url);
-  };
-
-  return (
-    <Stack gap="lg">
-      <Alert icon={<IconAlertTriangle size={18} />} color="yellow" title={t("safety.title")}>
-        {t("safety.description")}
-      </Alert>
-      <Group align="end">
-        <TextInput
-          label={t("search.label")}
-          placeholder={t("search.placeholder")}
-          leftSection={<IconSearch size={16} />}
-          value={search}
-          onChange={(event) => {
-            setSearch(event.currentTarget.value);
-            setPage(1);
-          }}
-          style={{ flex: 1 }}
-        />
-        <Select
-          label={t("filter.type")}
-          value={type}
-          disabled={Boolean(lockedType)}
-          onChange={(value) => {
-            setType((value ?? "all") as typeof type);
-            setPage(1);
-          }}
-          data={[
-            { value: "all", label: t("filter.all") },
-            { value: "widget", label: t("filter.widgets") },
-            { value: "css", label: t("filter.css") },
-          ]}
-        />
-        <Select
-          label={t("filter.sort")}
-          value={sort}
-          onChange={(value) => {
-            setSort((value ?? "top") as typeof sort);
-            setPage(1);
-          }}
-          data={[
-            { value: "top", label: t("filter.top") },
-            { value: "newest", label: t("filter.newest") },
-          ]}
-        />
-      </Group>
-      {query.error && (
-        <Alert color="red" title={t("error.loadTitle")}>
-          {query.error.message}
-          <Button variant="subtle" onClick={() => void query.refetch()}>
-            {t("action.retry")}
-          </Button>
-        </Alert>
-      )}
-      {query.isLoading ? (
-        <SimpleGrid cols={{ base: 1, sm: 2, lg: 3 }}>
-          <Skeleton h={280} />
-          <Skeleton h={280} />
-          <Skeleton h={280} />
-        </SimpleGrid>
-      ) : query.data?.items.length ? (
-        <SimpleGrid cols={{ base: 1, sm: 2, lg: 3 }}>
-          {query.data.items.map((item) => (
-            <Card key={item.id} withBorder padding="md">
-              {item.screenshots[0] ? (
-                <Card.Section>
-                  <Image src={client.fileUrl(item.id, item.screenshots[0], "480x320")} h={170} alt="" />
-                </Card.Section>
-              ) : (
-                <Card.Section>
-                  <Box
-                    h={170}
-                    bg="var(--mantine-color-default-hover)"
-                    style={{ display: "grid", placeItems: "center" }}
-                  >
-                    <Text ff="monospace" fw={700}>
-                      {item.type === "widget" ? "{}" : "CSS"}
-                    </Text>
-                  </Box>
-                </Card.Section>
-              )}
-              <Stack gap="xs" mt="md">
-                <Group justify="space-between">
-                  <Badge variant="light">{item.type === "widget" ? t("type.widget") : t("type.css")}</Badge>
-                  <Text size="sm" c="dimmed">
-                    {item.score >= 0 ? "+" : ""}
-                    {item.score}
-                  </Text>
-                </Group>
-                <Text fw={600} lineClamp={1}>
-                  {item.title}
-                </Text>
-                <Text size="sm" c="dimmed" lineClamp={2}>
-                  {item.description || t("empty.description")}
-                </Text>
-                <Text size="xs" c="dimmed">
-                  {t("by", { name: item.authorName, revision: item.revision })}
-                </Text>
-                <Button variant="light" onClick={() => void openDetail(item.id)}>
-                  {t("action.inspect")}
-                </Button>
-              </Stack>
-            </Card>
-          ))}
-        </SimpleGrid>
-      ) : (
-        <Stack align="center" py="xl">
-          <Text fw={600}>{t("empty.title")}</Text>
-          <Text c="dimmed">{t("empty.description")}</Text>
-        </Stack>
-      )}
-      {(query.data?.totalPages ?? 0) > 1 && (
-        <Pagination total={query.data?.totalPages ?? 1} value={page} onChange={setPage} mx="auto" />
-      )}
-      <Modal
-        opened={Boolean(selected) || detailLoading}
-        onClose={() => setSelected(null)}
-        title={selected?.title ?? t("loading")}
-        size="xl"
-      >
-        {detailLoading || !selected ? (
-          <Skeleton h={400} />
-        ) : (
-          <Stack>
-            <Group>
-              <Badge>{selected.type === "widget" ? t("type.widget") : t("type.css")}</Badge>
-              <Text size="sm" c="dimmed">
-                {t("by", { name: selected.authorName, revision: selected.revision })}
-              </Text>
-            </Group>
-            <Text>{selected.description}</Text>
-            <Alert icon={<IconAlertTriangle size={18} />} color="yellow">
-              {t("safety.inspect")}
-            </Alert>
-            <Code block mah={360} style={{ overflow: "auto", whiteSpace: "pre" }}>
-              {selected.content}
-            </Code>
-            <Group justify="space-between">
-              <Group>
-                <Button variant="default" leftSection={<IconDownload size={16} />} onClick={() => download(selected)}>
-                  {t("action.download")}
-                </Button>
-                <Button
-                  component="a"
-                  href={`${WORKSHOP_WEB_URL}/${selected.id}`}
-                  target="_blank"
-                  variant="subtle"
-                  leftSection={<IconExternalLink size={16} />}
-                >
-                  {t("action.website")}
-                </Button>
-              </Group>
-              {onUse && (
-                <Button
-                  loading={usePending}
-                  onClick={async () => {
-                    setUsePending(true);
-                    setUseError("");
-                    try {
-                      if (lockedType && selected.type !== lockedType) throw new Error(t("error.wrongType"));
-                      await onUse(selected);
-                      setSelected(null);
-                    } catch (caught) {
-                      setUseError(caught instanceof Error ? caught.message : t("error.install"));
-                    } finally {
-                      setUsePending(false);
-                    }
-                  }}
-                >
-                  {useLabel ?? t("action.use")}
-                </Button>
-              )}
-            </Group>
-            {useError && <Alert color="red">{useError}</Alert>}
-          </Stack>
-        )}
-      </Modal>
-    </Stack>
-  );
-}
-
-export function PublishToWorkshopButton({
-  type,
-  getContent,
-  defaultTitle,
-  compact = false,
-  renderTrigger,
-}: {
-  type: WorkshopSubmissionType;
-  getContent: () => Promise<string> | string;
-  defaultTitle: string;
-  compact?: boolean;
-  renderTrigger?: (open: () => void) => ReactNode;
-}) {
-  const t = useScopedI18n("workshop");
-  const client = useMemo(() => new WorkshopClient(apiUrl), []);
-  const [opened, { open, close }] = useDisclosure(false);
-  const [title, setTitle] = useState(defaultTitle);
-  const [description, setDescription] = useState("");
-  const [changelog, setChangelog] = useState("");
-  const [error, setError] = useState("");
-  const [pending, setPending] = useState(false);
-  useEffect(() => setTitle(defaultTitle), [defaultTitle]);
-  const publish = async () => {
-    setPending(true);
-    setError("");
-    try {
-      if (!client.currentUser) await client.signInWithGitHub();
-      await client.create({ type, title, description, changelog, content: await getContent() });
-      close();
-    } catch (caught) {
-      setError(caught instanceof Error ? caught.message : t("error.publish"));
-    } finally {
-      setPending(false);
-    }
-  };
-  return (
-    <>
-      {renderTrigger ? (
-        renderTrigger(open)
-      ) : (
-        <Button
-          size={compact ? "xs" : undefined}
-          variant="default"
-          leftSection={<IconBrandGithub size={16} />}
-          onClick={open}
-        >
-          {t("action.share")}
-        </Button>
-      )}
-      <Modal opened={opened} onClose={close} title={t("publish.title")}>
-        <Stack>
-          <TextInput
-            required
-            label={t("publish.name")}
-            value={title}
-            onChange={(event) => setTitle(event.currentTarget.value)}
-          />
-          <Textarea
-            label={t("publish.description")}
-            value={description}
-            onChange={(event) => setDescription(event.currentTarget.value)}
-          />
-          <Textarea
-            label={t("publish.changelog")}
-            value={changelog}
-            onChange={(event) => setChangelog(event.currentTarget.value)}
-          />
-          {error && <Alert color="red">{error}</Alert>}
-          <Group justify="end">
-            <Button variant="default" onClick={close}>
-              {t("action.cancel")}
-            </Button>
-            <Button loading={pending} disabled={title.trim().length < 3} onClick={() => void publish()}>
-              {t("action.publish")}
-            </Button>
-          </Group>
-        </Stack>
-      </Modal>
-    </>
-  );
-}

apps/store/.env.example

@@ -1,5 +0,0 @@
-GITHUB_CLIENT_ID=
-GITHUB_CLIENT_SECRET=
-PB_SUPERUSER_EMAIL=
-PB_SUPERUSER_PASSWORD=
-PB_EXPOSE_PORT=8090

apps/store/.gitignore

@@ -1,4 +0,0 @@
-.env
-.env.*
-!.env.example
-pb_data/

apps/store/Dockerfile

@@ -1,31 +0,0 @@
-FROM alpine:3.22 AS download
-
-ARG TARGETARCH
-ARG POCKETBASE_VERSION=0.39.6
-
-RUN apk add --no-cache ca-certificates curl unzip
-RUN case "${TARGETARCH}" in \
-      amd64) PB_ARCH=amd64 ;; \
-      arm64) PB_ARCH=arm64 ;; \
-      arm) PB_ARCH=armv7 ;; \
-      *) echo "Unsupported architecture: ${TARGETARCH}" >&2; exit 1 ;; \
-    esac && \
-    BASE_URL="https://github.com/pocketbase/pocketbase/releases/download/v${POCKETBASE_VERSION}" && \
-    ARCHIVE="pocketbase_${POCKETBASE_VERSION}_linux_${PB_ARCH}.zip" && \
-    curl --fail --location --silent --show-error "${BASE_URL}/${ARCHIVE}" --output "/tmp/${ARCHIVE}" && \
-    curl --fail --location --silent --show-error "${BASE_URL}/checksums.txt" --output /tmp/checksums.txt && \
-    cd /tmp && grep " ${ARCHIVE}$" checksums.txt | sha256sum -c - && \
-    unzip "/tmp/${ARCHIVE}" pocketbase -d /out
-
-FROM alpine:3.22
-
-RUN apk add --no-cache ca-certificates su-exec tzdata && addgroup -S pocketbase && adduser -S -G pocketbase pocketbase
-COPY --from=download /out/pocketbase /usr/local/bin/pocketbase
-COPY entrypoint.sh /usr/local/bin/workshop-entrypoint
-
-RUN chmod +x /usr/local/bin/workshop-entrypoint && mkdir -p /pb_data /pb_hooks /pb_migrations && chown -R pocketbase:pocketbase /pb_data /pb_hooks /pb_migrations
-
-USER root
-EXPOSE 8090
-HEALTHCHECK --interval=30s --timeout=5s --start-period=10s --retries=3 CMD wget -q --spider http://127.0.0.1:8090/api/health || exit 1
-ENTRYPOINT ["workshop-entrypoint"]

apps/store/README.md

@@ -1,45 +0,0 @@
-# Homarr Workshop backend
-
-PocketBase provides the central Workshop API at `store.homarr.dev`. It is not a per-instance Homarr service. Local deployment is for development and integration testing.
-
-## Local startup
-
-1. Copy `.env.example` to `.env` and create a GitHub OAuth app.
-2. Set its callback URL to `http://localhost:8090/api/oauth2-redirect`.
-3. Set `GITHUB_CLIENT_ID`, `GITHUB_CLIENT_SECRET`, `PB_SUPERUSER_EMAIL`, and `PB_SUPERUSER_PASSWORD`.
-4. Run `docker compose up --build` from this directory.
-
-The API is at `http://localhost:8090`; the emergency PocketBase dashboard is at `http://localhost:8090/_/`. Day-to-day moderation belongs in `/workshop/admin`, not the PocketBase dashboard.
-
-The image downloads the official PocketBase `0.39.6` release and verifies it against that release's `checksums.txt`. Migrations and hooks are mounted read-only.
-
-## Roles and account states
-
-- `member`: publish, update/delete owned submissions, vote, and report.
-- `moderator`: report queue, submission removal, posting bans, and account disable/restore.
-- `admin`: moderator actions plus role changes.
-- `posting_banned`: cannot create or update submissions; can browse, vote, and report.
-- `disabled`: cannot authenticate or write.
-
-Bootstrap the first admin through the PocketBase dashboard by changing a GitHub-authenticated user's role. All later staff actions use the restricted Workshop back office and are recorded in `moderation_actions`.
-
-## Backup and restore
-
-PocketBase stores records and uploads in `/pb_data`. Stop writes or stop the container, then archive the named volume:
-
-```sh
-docker compose stop workshop
-docker run --rm -v store_workshop_data:/data -v "$PWD":/backup alpine tar czf /backup/workshop-backup.tgz -C /data .
-docker compose start workshop
-```
-
-Restore only into the same PocketBase version after preserving the current volume. Extract the archive into an empty `workshop_data` volume, start the service, and verify `/api/health`, collection migrations, a listing request, and an authenticated write.
-
-## Production checklist
-
-- Terminate TLS at the reverse proxy and forward the real client IP.
-- Keep superuser credentials outside Compose and rotate them after bootstrap.
-- Restrict the dashboard path to operators; GitHub users never need it.
-- Review the versioned default rate limits for OAuth, submissions, votes, reports, moderation, and general API traffic against production load before launch.
-- Back up `/pb_data` before every PocketBase or migration upgrade and test restore regularly.
-- Monitor health, authentication failures, 429/5xx responses, moderation actions, disk use, and backup age.

apps/store/docker-compose.yml

@@ -1,24 +0,0 @@
-services:
-  workshop:
-    build:
-      context: .
-      args:
-        POCKETBASE_VERSION: 0.39.6
-    image: homarr/workshop-pocketbase:0.39.6
-    restart: unless-stopped
-    environment:
-      GITHUB_CLIENT_ID: ${GITHUB_CLIENT_ID:-}
-      GITHUB_CLIENT_SECRET: ${GITHUB_CLIENT_SECRET:-}
-      PB_SUPERUSER_EMAIL: ${PB_SUPERUSER_EMAIL:-}
-      PB_SUPERUSER_PASSWORD: ${PB_SUPERUSER_PASSWORD:-}
-    ports:
-      - "${PB_EXPOSE_PORT:-8090}:8090"
-    volumes:
-      - workshop_data:/pb_data
-      - ./pb_hooks:/pb_hooks:ro
-      - ./pb_migrations:/pb_migrations:ro
-    security_opt:
-      - no-new-privileges:true
-
-volumes:
-  workshop_data:

apps/store/entrypoint.sh

@@ -1,14 +0,0 @@
-#!/bin/sh
-set -eu
-
-chown -R pocketbase:pocketbase /pb_data
-
-if [ -n "${PB_SUPERUSER_EMAIL:-}" ] && [ -n "${PB_SUPERUSER_PASSWORD:-}" ]; then
-  su-exec pocketbase pocketbase superuser upsert "${PB_SUPERUSER_EMAIL}" "${PB_SUPERUSER_PASSWORD}" --dir=/pb_data
-fi
-
-exec su-exec pocketbase pocketbase serve \
-  --http=0.0.0.0:8090 \
-  --dir=/pb_data \
-  --hooksDir=/pb_hooks \
-  --migrationsDir=/pb_migrations

apps/store/pb_hooks/workshop-utils.js

@@ -1,102 +0,0 @@
-const WIDGET_SCHEMA = "homarr-custom-widget-v2";
-const CSS_SCHEMA = "homarr-custom-css-v1";
-const CSS_LIMIT = 16384;
-const WIDGET_AUTH_TYPES = ["none", "bearer", "basic", "apiKeyHeader", "apiKeyQuery"];
-const WIDGET_METHODS = ["GET", "POST", "PUT", "DELETE", "PATCH"];
-const WIDGET_DISPLAY_TYPES = [
-  "singleValue",
-  "keyValue",
-  "table",
-  "statGrid",
-  "progressBars",
-  "statusIndicator",
-  "countGrid",
-  "raw",
-  "actionButton",
-  "customJsx",
-];
-
-function fail(ErrorType, _code, message) {
-  throw new ErrorType(message);
-}
-
-function requireWritableAccount(app, auth, posting) {
-  if (!auth) fail(UnauthorizedError, "authentication_required", "Authentication is required");
-  const account = app.findRecordById("users", auth.id);
-  if (account.getString("state") === "disabled") fail(ForbiddenError, "account_disabled", "Account is disabled");
-  if (posting && account.getString("state") === "posting_banned")
-    fail(ForbiddenError, "posting_banned", "Account cannot publish submissions");
-  return account;
-}
-
-function validateSubmission(record) {
-  const type = record.getString("type");
-  const content = record.getString("content");
-  if (type === "css") {
-    if (!content.trim()) fail(BadRequestError, "invalid_submission", "CSS cannot be empty");
-    if (content.length > CSS_LIMIT) fail(BadRequestError, "invalid_submission", "CSS is too large");
-    record.set("schemaVersion", CSS_SCHEMA);
-    return;
-  }
-  if (type !== "widget") fail(BadRequestError, "invalid_submission", "Unsupported submission type");
-  let widget;
-  try {
-    widget = JSON.parse(content);
-  } catch {
-    fail(BadRequestError, "invalid_submission", "Widget content is not valid JSON");
-  }
-  if (
-    !widget ||
-    widget.$schema !== WIDGET_SCHEMA ||
-    typeof widget.name !== "string" ||
-    widget.name.length < 1 ||
-    widget.name.length > 128 ||
-    typeof widget.url !== "string" ||
-    widget.url.length < 1 ||
-    !WIDGET_AUTH_TYPES.includes(widget.authType) ||
-    !WIDGET_METHODS.includes(widget.method) ||
-    !WIDGET_DISPLAY_TYPES.includes(widget.displayType) ||
-    typeof widget.displayConfig !== "object" ||
-    Array.isArray(widget.displayConfig) ||
-    Object.prototype.hasOwnProperty.call(widget, "secrets")
-  ) {
-    fail(BadRequestError, "invalid_submission", "Widget does not match homarr-custom-widget-v2");
-  }
-  if (!widget.displayConfig || widget.displayConfig.type !== widget.displayType) {
-    fail(BadRequestError, "invalid_submission", "Widget displayConfig.type must match displayType");
-  }
-  record.set("schemaVersion", WIDGET_SCHEMA);
-}
-
-function snapshot(record) {
-  return JSON.stringify(record.publicExport());
-}
-
-function requireStaff(app, auth) {
-  const account = requireWritableAccount(app, auth, false);
-  const role = account.getString("role");
-  if (role !== "moderator" && role !== "admin") fail(ForbiddenError, "forbidden", "Staff access is required");
-  return role;
-}
-
-function body(e) {
-  const data = new DynamicModel({ reason: "", state: "", role: "", status: "" });
-  e.bindBody(data);
-  if (!data.reason || data.reason.trim().length < 3)
-    fail(BadRequestError, "invalid_submission", "A reason is required");
-  return data;
-}
-
-function audit(app, actor, action, targetType, targetId, reason, targetSnapshot) {
-  const collection = app.findCollectionByNameOrId("moderation_actions");
-  const record = new Record(collection);
-  record.set("actor", actor.id);
-  record.set("action", action);
-  record.set("targetType", targetType);
-  record.set("targetId", targetId);
-  record.set("reason", reason.trim());
-  record.set("snapshot", targetSnapshot || "");
-  app.save(record);
-}
-
-module.exports = { audit, body, fail, requireStaff, requireWritableAccount, snapshot, validateSubmission };

apps/store/pb_hooks/workshop.pb.js

@@ -1,168 +0,0 @@
-/// <reference path="../pb_data/types.d.ts" />
-
-onRecordAuthWithOAuth2Request((e) => {
-  const utils = require(`${__hooks}/workshop-utils.js`);
-  if (e.record && e.record.getString("state") === "disabled")
-    utils.fail(ForbiddenError, "account_disabled", "Account is disabled");
-  if (e.isNewRecord) {
-    e.createData.displayName = e.oAuth2User.name || e.oAuth2User.username || "Community member";
-    e.createData.avatarUrl = e.oAuth2User.avatarUrl || "";
-    e.createData.role = "member";
-    e.createData.state = "active";
-  }
-  e.next();
-}, "users");
-
-onRecordAuthRequest((e) => {
-  const utils = require(`${__hooks}/workshop-utils.js`);
-  if (e.record.getString("state") === "disabled") utils.fail(ForbiddenError, "account_disabled", "Account is disabled");
-  e.next();
-}, "users");
-
-onRecordUpdateRequest((e) => {
-  const original = e.app.findRecordById("users", e.record.id);
-  e.record.set("role", original.get("role"));
-  e.record.set("state", original.get("state"));
-  e.record.set("moderationReason", original.get("moderationReason"));
-  e.next();
-}, "users");
-
-onRecordCreateRequest((e) => {
-  const utils = require(`${__hooks}/workshop-utils.js`);
-  const account = utils.requireWritableAccount(e.app, e.auth, true);
-  utils.validateSubmission(e.record);
-  e.record.set("author", e.auth.id);
-  e.record.set("authorName", account.getString("displayName"));
-  e.record.set("revision", 1);
-  e.next();
-}, "submissions");
-
-onRecordUpdateRequest((e) => {
-  const utils = require(`${__hooks}/workshop-utils.js`);
-  utils.requireWritableAccount(e.app, e.auth, true);
-  const original = e.app.findRecordById("submissions", e.record.id);
-  e.record.set("author", original.get("author"));
-  e.record.set("authorName", original.get("authorName"));
-  e.record.set("type", original.get("type"));
-  e.record.set("schemaVersion", original.get("schemaVersion"));
-  e.record.set(
-    "revision",
-    original.getInt("revision") + (e.record.getString("content") !== original.getString("content") ? 1 : 0),
-  );
-  utils.validateSubmission(e.record);
-  e.next();
-}, "submissions");
-
-onRecordCreateRequest((e) => {
-  const utils = require(`${__hooks}/workshop-utils.js`);
-  utils.requireWritableAccount(e.app, e.auth, false);
-  const value = e.record.getInt("value");
-  if (value !== 1 && value !== -1) throw new BadRequestError("Vote must be 1 or -1");
-  e.record.set("user", e.auth.id);
-  e.next();
-}, "votes");
-
-onRecordUpdateRequest((e) => {
-  const utils = require(`${__hooks}/workshop-utils.js`);
-  utils.requireWritableAccount(e.app, e.auth, false);
-  const original = e.app.findRecordById("votes", e.record.id);
-  const value = e.record.getInt("value");
-  if (value !== 1 && value !== -1) throw new BadRequestError("Vote must be 1 or -1");
-  e.record.set("user", original.get("user"));
-  e.record.set("submission", original.get("submission"));
-  e.next();
-}, "votes");
-
-onRecordCreateRequest((e) => {
-  const utils = require(`${__hooks}/workshop-utils.js`);
-  utils.requireWritableAccount(e.app, e.auth, false);
-  e.record.set("reporter", e.auth.id);
-  e.record.set("status", "open");
-  e.next();
-}, "reports");
-
-routerAdd(
-  "POST",
-  "/api/workshop/moderation/submissions/{id}/remove",
-  (e) => {
-    const utils = require(`${__hooks}/workshop-utils.js`);
-    utils.requireStaff(e.app, e.auth);
-    const data = utils.body(e);
-    const id = e.request.pathValue("id");
-    e.app.runInTransaction((tx) => {
-      const target = tx.findRecordById("submissions", id);
-      utils.audit(tx, e.auth, "remove_submission", "submission", id, data.reason, utils.snapshot(target));
-      tx.delete(target);
-    });
-    return e.json(200, { success: true });
-  },
-  $apis.requireAuth("users"),
-);
-
-routerAdd(
-  "POST",
-  "/api/workshop/moderation/users/{id}/state",
-  (e) => {
-    const utils = require(`${__hooks}/workshop-utils.js`);
-    const actorRole = utils.requireStaff(e.app, e.auth);
-    const data = utils.body(e);
-    if (!["active", "posting_banned", "disabled"].includes(data.state))
-      throw new BadRequestError("Invalid account state");
-    const id = e.request.pathValue("id");
-    if (id === e.auth.id) throw new BadRequestError("You cannot moderate your own account");
-    e.app.runInTransaction((tx) => {
-      const target = tx.findRecordById("users", id);
-      if (target.getString("role") === "admin" && actorRole !== "admin") throw new ForbiddenError("forbidden");
-      const previous = utils.snapshot(target);
-      target.set("state", data.state);
-      target.set("moderationReason", data.reason);
-      tx.save(target);
-      utils.audit(tx, e.auth, "set_account_state", "user", id, data.reason, previous);
-    });
-    return e.json(200, { success: true });
-  },
-  $apis.requireAuth("users"),
-);
-
-routerAdd(
-  "POST",
-  "/api/workshop/moderation/users/{id}/role",
-  (e) => {
-    const utils = require(`${__hooks}/workshop-utils.js`);
-    if (utils.requireStaff(e.app, e.auth) !== "admin") throw new ForbiddenError("forbidden");
-    const data = utils.body(e);
-    if (!["member", "moderator", "admin"].includes(data.role)) throw new BadRequestError("Invalid role");
-    const id = e.request.pathValue("id");
-    if (id === e.auth.id) throw new BadRequestError("You cannot change your own role");
-    e.app.runInTransaction((tx) => {
-      const target = tx.findRecordById("users", id);
-      const previous = utils.snapshot(target);
-      target.set("role", data.role);
-      tx.save(target);
-      utils.audit(tx, e.auth, "set_role", "user", id, data.reason, previous);
-    });
-    return e.json(200, { success: true });
-  },
-  $apis.requireAuth("users"),
-);
-
-routerAdd(
-  "POST",
-  "/api/workshop/moderation/reports/{id}/resolve",
-  (e) => {
-    const utils = require(`${__hooks}/workshop-utils.js`);
-    utils.requireStaff(e.app, e.auth);
-    const data = utils.body(e);
-    if (!["resolved", "dismissed"].includes(data.status)) throw new BadRequestError("Invalid report status");
-    const id = e.request.pathValue("id");
-    e.app.runInTransaction((tx) => {
-      const target = tx.findRecordById("reports", id);
-      const previous = utils.snapshot(target);
-      target.set("status", data.status);
-      tx.save(target);
-      utils.audit(tx, e.auth, "resolve_report", "report", id, data.reason, previous);
-    });
-    return e.json(200, { success: true });
-  },
-  $apis.requireAuth("users"),
-);

apps/store/pb_migrations/1783900000_workshop_v2.js

@@ -1,248 +0,0 @@
-/// <reference path="../pb_data/types.d.ts" />
-
-migrate(
-  (app) => {
-    let users;
-    try {
-      users = app.findCollectionByNameOrId("users");
-    } catch {
-      users = new Collection({
-        type: "auth",
-        name: "users",
-        listRule: "@request.auth.role = 'moderator' || @request.auth.role = 'admin'",
-        viewRule: "id = @request.auth.id || @request.auth.role = 'moderator' || @request.auth.role = 'admin'",
-        updateRule: "id = @request.auth.id && @request.auth.state != 'disabled'",
-        deleteRule: null,
-        passwordAuth: { enabled: false },
-      });
-    }
-    // PocketBase creates a default users auth collection on first boot, so
-    // Workshop fields must be added to the existing collection explicitly.
-    users.fields.add(
-      new TextField({ name: "displayName", required: true, min: 1, max: 100 }),
-      new URLField({ name: "avatarUrl" }),
-      new SelectField({ name: "role", required: true, maxSelect: 1, values: ["member", "moderator", "admin"] }),
-      new SelectField({
-        name: "state",
-        required: true,
-        maxSelect: 1,
-        values: ["active", "posting_banned", "disabled"],
-      }),
-      new TextField({ name: "moderationReason", max: 1000 }),
-    );
-    const githubClientId = $os.getenv("GITHUB_CLIENT_ID");
-    const githubClientSecret = $os.getenv("GITHUB_CLIENT_SECRET");
-    users.oauth2.enabled = Boolean(githubClientId && githubClientSecret);
-    users.oauth2.providers =
-      githubClientId && githubClientSecret
-        ? [{ name: "github", clientId: githubClientId, clientSecret: githubClientSecret }]
-        : [];
-    app.save(users);
-
-    const staffRule = "@request.auth.role = 'moderator' || @request.auth.role = 'admin'";
-    const writableRule = "@request.auth.id != '' && @request.auth.state != 'disabled'";
-    const authorRule = "author = @request.auth.id && @request.auth.state = 'active'";
-
-    const submissions = new Collection({
-      type: "base",
-      name: "submissions",
-      // Full source is intentionally available only through getOne; discovery
-      // must use workshop_listings so list payloads never contain content.
-      listRule: null,
-      viewRule: "",
-      createRule: null,
-      updateRule: null,
-      deleteRule: null,
-      fields: [
-        { type: "select", name: "type", required: true, maxSelect: 1, values: ["widget", "css"] },
-        { type: "text", name: "title", required: true, min: 3, max: 100 },
-        { type: "text", name: "description", max: 2000 },
-        { type: "text", name: "schemaVersion", required: true, max: 100 },
-        { type: "text", name: "content", required: true, max: 1000000 },
-        {
-          type: "file",
-          name: "screenshots",
-          maxSelect: 5,
-          maxSize: 5242880,
-          mimeTypes: ["image/png", "image/jpeg", "image/webp"],
-          thumbs: ["480x320", "960x640"],
-        },
-        {
-          type: "relation",
-          name: "author",
-          required: true,
-          maxSelect: 1,
-          collectionId: users.id,
-          cascadeDelete: true,
-        },
-        { type: "text", name: "authorName", required: true, max: 100 },
-        { type: "number", name: "revision", required: true, onlyInt: true, min: 1 },
-        { type: "text", name: "changelog", max: 2000 },
-        { type: "autodate", name: "created", onCreate: true },
-        { type: "autodate", name: "updated", onCreate: true, onUpdate: true },
-      ],
-    });
-    app.save(submissions);
-    submissions.createRule = "@request.auth.id != ''";
-    submissions.updateRule = authorRule;
-    submissions.deleteRule = authorRule;
-    submissions.addIndex("idx_submissions_author", false, "author", "");
-    submissions.addIndex("idx_submissions_type_created", false, "type, created", "");
-    app.save(submissions);
-
-    const votes = new Collection({
-      type: "base",
-      name: "votes",
-      listRule: null,
-      viewRule: null,
-      createRule: null,
-      updateRule: null,
-      deleteRule: null,
-      fields: [
-        {
-          type: "relation",
-          name: "submission",
-          required: true,
-          maxSelect: 1,
-          collectionId: submissions.id,
-          cascadeDelete: true,
-        },
-        { type: "relation", name: "user", required: true, maxSelect: 1, collectionId: users.id, cascadeDelete: true },
-        { type: "number", name: "value", required: true, onlyInt: true, min: -1, max: 1 },
-        { type: "autodate", name: "created", onCreate: true },
-        { type: "autodate", name: "updated", onCreate: true, onUpdate: true },
-      ],
-    });
-    app.save(votes);
-    votes.listRule = "user = @request.auth.id";
-    votes.viewRule = "user = @request.auth.id";
-    votes.createRule = writableRule;
-    votes.updateRule = "user = @request.auth.id && @request.auth.state != 'disabled'";
-    votes.deleteRule = "user = @request.auth.id && @request.auth.state != 'disabled'";
-    votes.addIndex("idx_votes_user_submission", true, "user, submission", "");
-    votes.addIndex("idx_votes_submission", false, "submission", "");
-    app.save(votes);
-
-    const reports = new Collection({
-      type: "base",
-      name: "reports",
-      listRule: null,
-      viewRule: null,
-      createRule: null,
-      updateRule: null,
-      deleteRule: null,
-      fields: [
-        {
-          type: "relation",
-          name: "submission",
-          required: true,
-          maxSelect: 1,
-          collectionId: submissions.id,
-          cascadeDelete: true,
-        },
-        {
-          type: "relation",
-          name: "reporter",
-          required: true,
-          maxSelect: 1,
-          collectionId: users.id,
-          cascadeDelete: true,
-        },
-        {
-          type: "select",
-          name: "category",
-          required: true,
-          maxSelect: 1,
-          values: ["malicious", "spam", "copyright", "inappropriate", "other"],
-        },
-        { type: "text", name: "explanation", required: true, min: 3, max: 1000 },
-        { type: "select", name: "status", required: true, maxSelect: 1, values: ["open", "resolved", "dismissed"] },
-        { type: "autodate", name: "created", onCreate: true },
-        { type: "autodate", name: "updated", onCreate: true, onUpdate: true },
-      ],
-    });
-    app.save(reports);
-    reports.listRule = staffRule;
-    reports.viewRule = staffRule;
-    reports.createRule = writableRule;
-    reports.addIndex("idx_reports_reporter_submission", true, "reporter, submission", "");
-    reports.addIndex("idx_reports_status_created", false, "status, created", "");
-    app.save(reports);
-
-    const moderationActions = new Collection({
-      type: "base",
-      name: "moderation_actions",
-      listRule: staffRule,
-      viewRule: staffRule,
-      createRule: null,
-      updateRule: null,
-      deleteRule: null,
-      fields: [
-        { type: "relation", name: "actor", required: true, maxSelect: 1, collectionId: users.id },
-        {
-          type: "select",
-          name: "action",
-          required: true,
-          maxSelect: 1,
-          values: ["remove_submission", "set_account_state", "set_role", "resolve_report"],
-        },
-        { type: "text", name: "targetType", required: true, max: 30 },
-        { type: "text", name: "targetId", required: true, max: 30 },
-        { type: "text", name: "reason", required: true, min: 3, max: 1000 },
-        { type: "text", name: "snapshot", max: 100000 },
-        { type: "autodate", name: "created", onCreate: true },
-      ],
-    });
-    app.save(moderationActions);
-    moderationActions.addIndex("idx_moderation_actions_created", false, "created", "");
-    app.save(moderationActions);
-
-    const listings = new Collection({
-      type: "view",
-      name: "workshop_listings",
-      listRule: "",
-      viewRule: "",
-      viewQuery: `
-        SELECT s.id, s.type, s.title, s.description, s.schemaVersion, s.screenshots,
-          s.revision, s.changelog, s.author, s.authorName, s.created, s.updated,
-          COALESCE(SUM(CASE WHEN v.value = 1 THEN 1 ELSE 0 END), 0) AS upvotes,
-          COALESCE(SUM(CASE WHEN v.value = -1 THEN 1 ELSE 0 END), 0) AS downvotes,
-          COALESCE(SUM(v.value), 0) AS score
-        FROM submissions s
-        LEFT JOIN votes v ON v.submission = s.id
-        GROUP BY s.id
-      `,
-    });
-    app.save(listings);
-
-    const settings = app.settings();
-    settings.rateLimits.enabled = true;
-    settings.rateLimits.rules = [
-      { label: "*:auth", audience: "", duration: 60, maxRequests: 10 },
-      { label: "submissions:create", audience: "@auth", duration: 60, maxRequests: 10 },
-      { label: "votes:create", audience: "@auth", duration: 10, maxRequests: 20 },
-      { label: "reports:create", audience: "@auth", duration: 60, maxRequests: 5 },
-      { label: "/api/workshop/moderation/", audience: "@auth", duration: 60, maxRequests: 30 },
-      { label: "/api/", audience: "", duration: 10, maxRequests: 300 },
-    ];
-    settings.logs.maxDays = 30;
-    settings.logs.logAuthId = true;
-    settings.logs.logIP = true;
-    app.save(settings);
-  },
-  (app) => {
-    // PocketBase creates the users auth collection before this migration. Keep
-    // it intact on rollback so reverting Workshop can never delete accounts.
-    for (const name of ["workshop_listings", "moderation_actions", "reports", "votes", "submissions"]) {
-      try {
-        app.delete(app.findCollectionByNameOrId(name));
-      } catch {
-        // Collection was not created or was already removed.
-      }
-    }
-    const settings = app.settings();
-    settings.rateLimits.enabled = false;
-    settings.rateLimits.rules = [];
-    app.save(settings);
-  },
-);

apps/store/tests/run-integration.sh

@@ -1,26 +0,0 @@
-#!/bin/sh
-set -eu
-
-project="homarr-workshop-integration"
-port="${WORKSHOP_TEST_PORT:-18091}"
-email="integration@homarr.test"
-password="WorkshopIntegrationPassword123!"
-
-cleanup() {
-  PB_EXPOSE_PORT="$port" docker compose --file apps/store/docker-compose.yml --project-name "$project" down --volumes >/dev/null 2>&1 || true
-}
-trap cleanup EXIT INT TERM
-cleanup
-
-PB_EXPOSE_PORT="$port" \
-PB_SUPERUSER_EMAIL="$email" \
-PB_SUPERUSER_PASSWORD="$password" \
-docker compose --file apps/store/docker-compose.yml --project-name "$project" up --detach --build --wait
-
-if ! WORKSHOP_TEST_URL="http://127.0.0.1:$port" \
-  WORKSHOP_TEST_SUPERUSER_EMAIL="$email" \
-  WORKSHOP_TEST_SUPERUSER_PASSWORD="$password" \
-  node apps/store/tests/workshop.integration.mjs; then
-  docker compose --file apps/store/docker-compose.yml --project-name "$project" logs --no-color workshop
-  exit 1
-fi

apps/store/tests/workshop.integration.mjs

@@ -1,165 +0,0 @@
-import assert from "node:assert/strict";
-
-import PocketBase, { ClientResponseError } from "pocketbase";
-
-const baseUrl = process.env.WORKSHOP_TEST_URL;
-const superuserEmail = process.env.WORKSHOP_TEST_SUPERUSER_EMAIL;
-const superuserPassword = process.env.WORKSHOP_TEST_SUPERUSER_PASSWORD;
-assert(baseUrl && superuserEmail && superuserPassword, "Workshop integration test environment is incomplete");
-
-const root = new PocketBase(baseUrl);
-await root.collection("_superusers").authWithPassword(superuserEmail, superuserPassword);
-
-const createUser = async (name, role = "member", state = "active") => {
-  const password = `Workshop${name}Password123!`;
-  return root.collection("users").create({
-    email: `${name.toLowerCase()}@homarr.test`,
-    password,
-    passwordConfirm: password,
-    verified: true,
-    displayName: name,
-    role,
-    state,
-  });
-};
-
-const expectStatus = async (operation, status) => {
-  const statuses = Array.isArray(status) ? status : [status];
-  await assert.rejects(operation, (error) => error instanceof ClientResponseError && statuses.includes(error.status));
-};
-
-const memberRecord = await createUser("Member");
-const secondMemberRecord = await createUser("SecondMember");
-const bannedRecord = await createUser("Banned", "member", "posting_banned");
-const disabledRecord = await createUser("Disabled");
-const moderatorRecord = await createUser("Moderator", "moderator");
-const adminRecord = await createUser("Admin", "admin");
-
-const member = await root.collection("users").impersonate(memberRecord.id, 3600);
-const secondMember = await root.collection("users").impersonate(secondMemberRecord.id, 3600);
-const banned = await root.collection("users").impersonate(bannedRecord.id, 3600);
-const disabled = await root.collection("users").impersonate(disabledRecord.id, 3600);
-const moderator = await root.collection("users").impersonate(moderatorRecord.id, 3600);
-const admin = await root.collection("users").impersonate(adminRecord.id, 3600);
-
-const forgedMember = await member.collection("users").update(memberRecord.id, {
-  role: "admin",
-  state: "posting_banned",
-  moderationReason: "self escalation",
-});
-assert.equal(forgedMember.role, "member", "members must not change their own role");
-assert.equal(forgedMember.state, "active", "members must not change their own account state");
-assert.equal(forgedMember.moderationReason, "", "members must not change protected moderation fields");
-
-await admin.send(`/api/workshop/moderation/users/${disabledRecord.id}/state`, {
-  method: "POST",
-  body: { state: "disabled", reason: "Integration disable" },
-});
-
-const submission = await member.collection("submissions").create({
-  type: "css",
-  title: "Integration theme",
-  description: "A backend integration fixture",
-  schemaVersion: "forged-version",
-  content: ":root { --homarr-test: #fff; }",
-  author: secondMemberRecord.id,
-  authorName: "Forged",
-  revision: 99,
-});
-assert.equal(submission.author, memberRecord.id, "server must enforce ownership");
-assert.equal(submission.authorName, "Member", "server must snapshot the authenticated author name");
-assert.equal(submission.revision, 1, "server must own the initial revision");
-assert.equal(submission.schemaVersion, "homarr-custom-css-v1", "server must own schemaVersion");
-
-await expectStatus(
-  () => banned.collection("submissions").create({ type: "css", title: "Blocked theme", content: "body {}" }),
-  403,
-);
-await expectStatus(() => disabled.collection("votes").create({ submission: submission.id, value: 1 }), [400, 403]);
-await expectStatus(
-  () =>
-    member.collection("submissions").create({
-      type: "widget",
-      title: "Invalid widget",
-      content: JSON.stringify({ $schema: "homarr-custom-widget-v2", name: "Missing contract" }),
-    }),
-  400,
-);
-
-const vote = await member.collection("votes").create({ submission: submission.id, value: 1 });
-await expectStatus(() => member.collection("votes").create({ submission: submission.id, value: -1 }), 400);
-assert.equal(
-  (await member.collection("votes").update(vote.id, { submission: "forged", user: "forged", value: -1 })).submission,
-  submission.id,
-);
-
-const report = await secondMember.collection("reports").create({
-  submission: submission.id,
-  reporter: memberRecord.id,
-  category: "spam",
-  explanation: "Integration report",
-  status: "dismissed",
-});
-assert.equal(report.reporter, secondMemberRecord.id);
-assert.equal(report.status, "open");
-assert.equal((await member.collection("reports").getList()).totalItems, 0, "reports must remain private from members");
-assert.equal((await moderator.collection("reports").getList()).items.length, 1);
-
-await expectStatus(
-  () =>
-    member.send(`/api/workshop/moderation/users/${secondMemberRecord.id}/state`, {
-      method: "POST",
-      body: { state: "posting_banned", reason: "No permission" },
-    }),
-  403,
-);
-await expectStatus(
-  () =>
-    moderator.send(`/api/workshop/moderation/users/${adminRecord.id}/state`, {
-      method: "POST",
-      body: { state: "disabled", reason: "Cannot alter admin" },
-    }),
-  403,
-);
-await expectStatus(
-  () =>
-    moderator.send(`/api/workshop/moderation/users/${secondMemberRecord.id}/role`, {
-      method: "POST",
-      body: { role: "moderator", reason: "Cannot promote" },
-    }),
-  403,
-);
-
-await admin.send(`/api/workshop/moderation/users/${secondMemberRecord.id}/role`, {
-  method: "POST",
-  body: { role: "moderator", reason: "Integration promotion" },
-});
-assert.equal((await root.collection("users").getOne(secondMemberRecord.id)).role, "moderator");
-
-await moderator.send(`/api/workshop/moderation/reports/${report.id}/resolve`, {
-  method: "POST",
-  body: { status: "resolved", reason: "Integration resolution" },
-});
-assert.equal((await root.collection("reports").getOne(report.id)).status, "resolved");
-
-await moderator.send(`/api/workshop/moderation/submissions/${submission.id}/remove`, {
-  method: "POST",
-  body: { reason: "Integration removal" },
-});
-await expectStatus(() => root.collection("submissions").getOne(submission.id), 404);
-await expectStatus(() => root.collection("votes").getOne(vote.id), 404);
-await expectStatus(() => root.collection("reports").getOne(report.id), 404);
-
-const actions = await root.collection("moderation_actions").getFullList({ sort: "created" });
-assert.deepEqual(
-  actions.map((action) => action.action),
-  ["set_account_state", "set_role", "resolve_report", "remove_submission"],
-);
-assert(actions.at(-1)?.snapshot.includes("Integration theme"), "removal audit must retain a target snapshot");
-
-const anonymous = new PocketBase(baseUrl);
-const listings = await anonymous.collection("workshop_listings").getList();
-assert.equal(listings.totalItems, 0);
-await expectStatus(() => anonymous.collection("submissions").getList(), 403);
-
-console.log("Workshop backend integration matrix passed");

audit.md

@@ -1,78 +0,0 @@
-# Workshop V2 audit
-
-## Purpose
-
-The Workshop is Homarr's central community catalog for custom widgets and CSS themes. It must let people discover, inspect, export, publish, update, report, and install creations from homarr.dev and from Homarr itself without requiring raw copy-and-paste as the default workflow.
-
-### Feature North Star
-
-A Homarr user can move from a useful local creation to a safe community submission, or from a community listing to an installed local creation, in one understandable flow with source visibility and an explicit confirmation boundary.
-
-### Developer-experience North Star
-
-Workshop behavior is defined once: one typed contract, one client, versioned PocketBase migrations, deterministic local startup, shared validation fixtures, typed failures, and UI components that contain presentation rather than PocketBase queries or authorization rules.
-
-## Baseline audit
-
-The abandoned prototype is preserved at `origin/feat/widget-store-prototype-backup` (`89260b875`). This rewrite starts at `dev` commit `ba7718bde`.
-
-| Area          | Severity | Baseline finding                                                                                                                    | V2 resolution                                                                                                      |
-| ------------- | -------- | ----------------------------------------------------------------------------------------------------------------------------------- | ------------------------------------------------------------------------------------------------------------------ |
-| Branch health | P0       | PR #5984 was based on an obsolete `dev` commit and conflicted with the current branch.                                              | Rebuild from current `dev`; keep the old head on a backup ref.                                                     |
-| Security      | P0       | Submission validation ran in browsers and could be bypassed with direct PocketBase writes.                                          | Enforce validation, ownership, account state, immutable fields, and upload limits in PocketBase hooks and rules.   |
-| Moderation    | P0       | There were no moderator roles, posting bans, disabled accounts, least-privilege actions, or durable moderation history.             | Add roles, account states, explicit moderation routes, a staff UI, and append-only actions.                        |
-| Architecture  | P1       | Docs and Next.js defined separate record types, queries, mutations, sorting, voting, and error behavior.                            | Add `@homarr/workshop` as the only public contract and API client.                                                 |
-| Performance   | P1       | The browser downloaded every submission and full content, then searched, sorted, and filtered locally.                              | Server-side pagination/filtering/sorting; summary views exclude content.                                           |
-| Product       | P1       | Website and app flows were disconnected and sharing still depended on manual content transfer.                                      | Add contextual install and direct share actions backed by canonical exports.                                       |
-| UX/UI         | P1       | A large bespoke Docusaurus component set and a separate Mantine modal produced inconsistent interaction and state behavior.         | Use each host's native components with shared flows, copy rules, contracts, and states.                            |
-| Accessibility | P1       | Several custom interactive elements bypassed semantic controls and touch targets; focus and reduced-motion behavior was incomplete. | Require semantic controls, visible focus, keyboard operation, 44px touch targets, AA contrast, and reduced motion. |
-| Operations    | P1       | A third-party PocketBase image and incomplete bootstrap docs made builds and recovery non-deterministic.                            | Build a pinned official binary with checksum verification; document health, backup, restore, OAuth, and upgrades.  |
-| Testing       | P1       | Tests covered a narrow client schema and did not exercise API rules, roles, auth states, moderation, or cross-surface flows.        | Add contract, backend permission-matrix, UI, and end-to-end coverage.                                              |
-| Documentation | P2       | Documentation advertised a supported self-hosted Workshop even though V2 is a central Homarr service.                               | Document the central service and local-development overrides only.                                                 |
-
-## Decisions
-
-- Public name: **Workshop**.
-- Launch content: custom widgets (`homarr-custom-widget-v2`) and CSS (`homarr-custom-css-v1`).
-- Identity: GitHub OAuth only.
-- Community features: votes and reports; comments are removed.
-- Hosting: one Homarr-operated service at `store.homarr.dev`; overrides are development-only.
-- Publishing: immediate, with source inspection, reporting, and staff removal.
-- Staff: GitHub-authenticated moderators/admins use `/workshop/admin`; PocketBase superusers are bootstrap/emergency access.
-
-## Launch acceptance
-
-- [x] Anonymous users can browse, search, filter, inspect, copy, and download without receiving full content in listing responses.
-- [x] Members can publish, update, delete, vote, and report; ownership and schemas are enforced server-side.
-- [x] Posting-banned users cannot create or update submissions but can browse, vote, and report.
-- [x] Disabled accounts cannot authenticate or write, including with an existing token.
-- [x] Moderators can resolve reports, remove submissions, posting-ban users, and disable/restore non-admin users.
-- [x] Only admins can change roles; staff actions are append-only and attributable.
-- [x] Homarr can export/share local widgets and CSS and validate/confirm Workshop installs.
-- [x] Website and app implement loading, empty, offline, validation, permission, and destructive-action states.
-- [x] Keyboard semantics, mobile layout, dark mode, reduced motion, and horizontal overflow received a browser smoke test.
-- [x] Clean PocketBase startup, migration, health, backup, and restore procedures are reproducible and documented.
-- [ ] Add automated authenticated cross-surface E2E coverage before changing the PR from draft to ready.
-
-## Deferred after V2
-
-Comments, private Workshop deployments, automated approval queues, follows, collections, notifications, arbitrary package types, historical version installation, and personalized recommendations.
-
-## Exit scorecard
-
-The baseline has three P0, seven P1, and one P2 findings. The rewrite closes every product, security, architecture, moderation, performance, operations, documentation, UX, and DX finding. One P1 release-verification item remains: automated authenticated E2E across both public and in-app surfaces. Keep PR #5984 in draft until it lands.
-
-| Gate                        | Result  | Evidence                                                                                                                                                                                          |
-| --------------------------- | ------- | ------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
-| Branch ancestry             | Pass    | Rebuilt from `dev` at `ba7718bde`; prototype preserved at `origin/feat/widget-store-prototype-backup`.                                                                                            |
-| Contract                    | Pass    | Five Vitest cases cover widget/CSS fixtures, filenames, limits, screenshot validation, and round trips.                                                                                           |
-| Backend                     | Pass    | Disposable PocketBase integration matrix covers roles, account states, ownership forgery, schema rejection, duplicate votes, private reports, escalation, deletion cascades, and audit snapshots. |
-| Backend operations          | Pass    | PocketBase 0.39.6 image builds with checksum verification; clean migration, health, and listing/detail access boundaries pass.                                                                    |
-| Type safety                 | Pass    | Scoped Turbo typecheck passes for Workshop, Docs, and Next.js.                                                                                                                                    |
-| Lint                        | Pass    | Scoped lint exits clean; remaining warnings predate the rewrite. Workshop has zero warnings.                                                                                                      |
-| Format                      | Pass    | Every changed supported file passes `oxfmt --check`; repository-wide Docs formatting still reports pre-existing drift.                                                                            |
-| Production builds           | Pass    | Docusaurus and Next.js production builds pass under Node 24.18.0.                                                                                                                                 |
-| Browser smoke               | Pass    | Desktop and 390px mobile discovery render without console errors or horizontal overflow; semantic labels, skip link, dark mode, and reduced motion are active.                                    |
-| Automated cross-surface E2E | Open P1 | Authenticated website-to-Homarr publish/install and moderator flows still need browser automation.                                                                                                |
-
-Final implementation scores (10 is best): security 9, architecture/DX 9, moderation 9, performance 9, responsive UI 9, theming 9, accessibility 8, automated testing 7. Accessibility remains below 9 until authenticated dialogs and destructive flows receive a full keyboard/screen-reader pass.

deployments/prebuilt-debian/package.json

@@ -6,7 +6,7 @@
   },
   "engines": {
     "node": ">=24.18.0",
-    "pnpm": ">=11.10.0"
+    "pnpm": ">=11.15.1"
   },
-  "packageManager": "pnpm@11.10.0"
+  "packageManager": "pnpm@11.15.1"
 }

package.json

@@ -1,6 +1,6 @@
 {
   "name": "homarr",
-  "version": "1.70.0",
+  "version": "1.72.0",
   "private": true,
   "scripts": {
     "build": "cross-env CI=true turbo build",
@@ -21,7 +21,6 @@
     "db:studio": "pnpm -F db studio",
     "dev": "pnpm -F nextjs dev",
     "dev:docs": "pnpm -F @homarr/docs dev",
-    "dev:workshop": "docker compose -f apps/store/docker-compose.yml up --build",
     "docker:dev": "docker compose -f ./development/development.docker-compose.yml up",
     "format": "turbo format --continue -- --check",
     "format:fix": "turbo format --continue",
@@ -34,7 +33,6 @@
     "start": "concurrently \"pnpm with-env node apps/tasks/tasks.cjs\" \"pnpm with-env node apps/websocket/wssServer.cjs\" \"pnpm -F nextjs start\"",
     "test": "cross-env NODE_ENV=development CI=true vitest run --exclude e2e --coverage.enabled ",
     "test:e2e": "cross-env NODE_ENV=development CI=true vitest e2e",
-    "test:workshop-backend": "bash apps/store/tests/run-integration.sh",
     "test:ui": "cross-env NODE_ENV=development CI=true vitest --exclude e2e --ui --coverage.enabled",
     "typecheck": "turbo typecheck",
     "with-env": "dotenv -e .env --"
@@ -71,7 +69,7 @@
   },
   "engines": {
     "node": ">=24.18.0",
-    "pnpm": ">=11.10.0"
+    "pnpm": ">=11.15.1"
   },
-  "packageManager": "pnpm@11.10.0"
+  "packageManager": "pnpm@11.15.1"
 }

packages/api/src/router/app.ts

@@ -18,7 +18,8 @@ import { AppAccessControl } from "./app/app-access-control";
 const defaultIcon = "https://cdn.jsdelivr.net/gh/homarr-labs/dashboard-icons@master/svg/homarr.svg";
 
 export const appRouter = createTRPCRouter({
-  getPaginated: protectedProcedure
+  getPaginated: permissionRequiredProcedure
+    .requiresPermission("board-modify-all")
     .input(paginatedSchema)
     .output(z.object({ items: z.array(selectAppSchema), totalCount: z.number() }))
     .meta({

packages/api/src/router/home.ts

@@ -101,7 +101,7 @@ export const homeRouter = createTRPCRouter({
       });
     }
 
-    if (ctx.session?.user) {
+    if (ctx.session?.user.permissions.includes("board-modify-all")) {
       statistics.push({
         titleKey: "app",
         subtitleKey: "resources",

packages/api/src/router/search-engine/search-engine-router.ts

@@ -3,7 +3,7 @@ import { z } from "zod/v4";
 
 import { createId } from "@homarr/common";
 import { createLogger } from "@homarr/core/infrastructure/logs";
-import { asc, eq, like } from "@homarr/db";
+import { and, asc, eq, like } from "@homarr/db";
 import { getServerSettingByKeyAsync, updateServerSettingByKeyAsync } from "@homarr/db/queries";
 import { searchEngines, users } from "@homarr/db/schema";
 import { byIdSchema, paginatedSchema, searchSchema } from "@homarr/validation/common";
@@ -130,9 +130,15 @@ export const searchEngineRouter = createTRPCRouter({
 
     return null;
   }),
-  search: protectedProcedure.input(searchSchema).query(async ({ ctx, input }) => {
+  search: publicProcedure.input(searchSchema).query(async ({ ctx, input }) => {
     return await ctx.db.query.searchEngines.findMany({
-      where: like(searchEngines.short, `${input.query.toLowerCase().trim()}%`),
+      // Public dashboards have no session: restrict anonymous users to generic
+      // (non-integration) engines so custom search engines work there too (#4132),
+      // while integration-backed engines stay available only when signed in.
+      where: and(
+        like(searchEngines.short, `${input.query.toLowerCase().trim()}%`),
+        ctx.session?.user ? undefined : eq(searchEngines.type, "generic"),
+      ),
       with: {
         integration: {
           columns: {

packages/api/src/router/test/app.spec.ts

@@ -76,6 +76,33 @@ describe("all should return all apps", () => {
   });
 });
 
+describe("getPaginated should require board modification access", () => {
+  test("should throw FORBIDDEN without board-modify-all", async () => {
+    const caller = appRouter.createCaller({
+      db: createDb(),
+      deviceType: undefined,
+      session: createDefaultSession(),
+    });
+
+    await expect(caller.getPaginated({ page: 1, pageSize: 10 })).rejects.toThrow("Permission denied");
+  });
+
+  test("should return apps with board-modify-all", async () => {
+    const db = createDb();
+    const caller = appRouter.createCaller({
+      db,
+      deviceType: undefined,
+      session: createDefaultSession(["board-modify-all"]),
+    });
+    await db.insert(apps).values({ id: "1", name: "Homarr", iconUrl: "https://homarr.dev/icon.svg" });
+
+    await expect(caller.getPaginated({ page: 1, pageSize: 10 })).resolves.toMatchObject({
+      totalCount: 1,
+      items: [{ id: "1" }],
+    });
+  });
+});
+
 describe("byId should return an app by id", () => {
   test("should return an app by id when canUserSeeAppAsync returns true", async () => {
     // Arrange

packages/api/src/router/test/user.spec.ts

@@ -357,6 +357,83 @@ describe("delete should delete user", () => {
   });
 });
 
+describe("changeEnableRightClickOnWidgets should toggle the right-click preference", () => {
+  test("non-admin can toggle their own preference", async () => {
+    const db = createDb();
+    const caller = userRouter.createCaller({
+      db,
+      deviceType: undefined,
+      session: defaultSession,
+    });
+
+    await db.insert(users).values({
+      id: defaultOwnerId,
+      name: "owner",
+    });
+
+    await caller.changeEnableRightClickOnWidgets({ id: defaultOwnerId, enableRightClickOnWidgets: false });
+
+    const updated = await db.query.users.findFirst({
+      where: eq(users.id, defaultOwnerId),
+      columns: { enableRightClickOnWidgets: true },
+    });
+    expect(updated?.enableRightClickOnWidgets).toBe(false);
+
+    await caller.changeEnableRightClickOnWidgets({ id: defaultOwnerId, enableRightClickOnWidgets: true });
+
+    const restored = await db.query.users.findFirst({
+      where: eq(users.id, defaultOwnerId),
+      columns: { enableRightClickOnWidgets: true },
+    });
+    expect(restored?.enableRightClickOnWidgets).toBe(true);
+  });
+
+  test("non-admin cannot toggle another user's preference", async () => {
+    const db = createDb();
+    const caller = userRouter.createCaller({
+      db,
+      deviceType: undefined,
+      session: defaultSession,
+    });
+
+    const otherUserId = createId();
+    await db.insert(users).values({ id: defaultOwnerId });
+    await db.insert(users).values({ id: otherUserId, name: "other" });
+
+    await expect(
+      caller.changeEnableRightClickOnWidgets({ id: otherUserId, enableRightClickOnWidgets: false }),
+    ).rejects.toThrow("User not found");
+
+    const other = await db.query.users.findFirst({
+      where: eq(users.id, otherUserId),
+      columns: { enableRightClickOnWidgets: true },
+    });
+    expect(other?.enableRightClickOnWidgets).toBe(true);
+  });
+
+  test("admin can toggle another user's preference", async () => {
+    const db = createDb();
+    const adminSession = createSession(["admin"]);
+    const caller = userRouter.createCaller({
+      db,
+      deviceType: undefined,
+      session: adminSession,
+    });
+
+    const targetUserId = createId();
+    await db.insert(users).values({ id: defaultOwnerId });
+    await db.insert(users).values({ id: targetUserId, name: "target" });
+
+    await caller.changeEnableRightClickOnWidgets({ id: targetUserId, enableRightClickOnWidgets: false });
+
+    const target = await db.query.users.findFirst({
+      where: eq(users.id, targetUserId),
+      columns: { enableRightClickOnWidgets: true },
+    });
+    expect(target?.enableRightClickOnWidgets).toBe(false);
+  });
+});
+
 const createOnboardingStepAsync = async (db: Database, step: OnboardingStep) => {
   await db.insert(onboarding).values({
     id: createId(),

packages/api/src/router/user.ts

@@ -23,6 +23,7 @@ import {
   userCreateSchema,
   userDdgBangsSchema,
   userEditProfileSchema,
+  userEnableRightClickOnWidgetsSchema,
   userFirstDayOfWeekSchema,
   userInitSchema,
   userPingIconsEnabledSchema,
@@ -345,6 +346,7 @@ export const userRouter = createTRPCRouter({
         mobileHomeBoardId: true,
         firstDayOfWeek: true,
         pingIconsEnabled: true,
+        enableRightClickOnWidgets: true,
         defaultSearchEngineId: true,
         openSearchInNewTab: true,
         ddgBangs: true,
@@ -381,6 +383,7 @@ export const userRouter = createTRPCRouter({
           mobileHomeBoardId: true,
           firstDayOfWeek: true,
           pingIconsEnabled: true,
+          enableRightClickOnWidgets: true,
           defaultSearchEngineId: true,
           openSearchInNewTab: true,
           ddgBangs: true,
@@ -651,6 +654,32 @@ export const userRouter = createTRPCRouter({
         })
         .where(eq(users.id, ctx.session.user.id));
     }),
+  changeEnableRightClickOnWidgets: protectedProcedure
+    .meta({
+      openapi: {
+        method: "PATCH",
+        path: "/api/users/right-click-widgets",
+        tags: ["users"],
+        protect: true,
+      },
+    })
+    .input(convertIntersectionToZodObject(userEnableRightClickOnWidgetsSchema.and(byIdSchema)))
+    .output(z.void())
+    .mutation(async ({ input, ctx }) => {
+      if (!ctx.session.user.permissions.includes("admin") && ctx.session.user.id !== input.id) {
+        throw new TRPCError({
+          code: "NOT_FOUND",
+          message: "User not found",
+        });
+      }
+
+      await ctx.db
+        .update(users)
+        .set({
+          enableRightClickOnWidgets: input.enableRightClickOnWidgets,
+        })
+        .where(eq(users.id, input.id));
+    }),
   changePingIconsEnabled: protectedProcedure
     .input(userPingIconsEnabledSchema.and(byIdSchema))
     .mutation(async ({ input, ctx }) => {

packages/api/src/router/widgets/__tests__/bounded-async-queue.spec.ts

@@ -0,0 +1,45 @@
+import { describe, expect, test } from "vitest";
+
+import { BoundedAsyncQueue } from "../bounded-async-queue";
+
+describe("BoundedAsyncQueue", () => {
+  test("keeps only the newest values when the queue is full", async () => {
+    const queue = new BoundedAsyncQueue<number>(2);
+    queue.push(1);
+    queue.push(2);
+    queue.push(3);
+    queue.close();
+
+    await expect(queue.next()).resolves.toEqual({ value: 2, done: false });
+    await expect(queue.next()).resolves.toEqual({ value: 3, done: false });
+    await expect(queue.next()).resolves.toEqual({ value: undefined, done: true });
+  });
+
+  test("resolves a pending read as soon as a value arrives", async () => {
+    const queue = new BoundedAsyncQueue<string>(1);
+    const next = queue.next();
+
+    queue.push("latest");
+
+    await expect(next).resolves.toEqual({ value: "latest", done: false });
+  });
+
+  test("resolves a pending read when the producer closes", async () => {
+    const queue = new BoundedAsyncQueue<number>(1);
+    const next = queue.next();
+
+    queue.close();
+
+    await expect(next).resolves.toEqual({ value: undefined, done: true });
+  });
+
+  test("rejects a pending read when the producer fails", async () => {
+    const queue = new BoundedAsyncQueue<number>(1);
+    const next = queue.next();
+    const error = new Error("upstream failed");
+
+    queue.fail(error);
+
+    await expect(next).rejects.toBe(error);
+  });
+});

packages/api/src/router/widgets/beszel.ts

@@ -1,5 +1,4 @@
 import { TRPCError } from "@trpc/server";
-import { observable } from "@trpc/server/observable";
 import { z } from "zod/v4";
 
 import { createLogger } from "@homarr/core/infrastructure/logs";
@@ -14,8 +13,10 @@ import {
 import { settleIntegrationQueries } from "../../settle-integrations";
 import { createManyIntegrationMiddleware } from "../../middlewares/integration";
 import { createTRPCRouter, publicProcedure } from "../../trpc";
+import { BoundedAsyncQueue } from "./bounded-async-queue";
 
 const logger = createLogger({ module: "beszelRouter" });
+const MAX_PENDING_LIVE_EVENTS = 4;
 
 const errorMessage = (error: unknown) => (error instanceof Error ? error.message : String(error));
 
@@ -203,98 +204,94 @@ export const beszelRouter = createTRPCRouter({
         systemId: z.string(),
       }),
     )
-    .subscription(({ ctx, input }) => {
-      return observable<LiveStatsEvent>((emit) => {
-        const controller = new AbortController();
-        let isActive = true;
-        let emittedEventCount = 0;
+    .subscription(async function* ({ ctx, input, signal }) {
+      const integration = ctx.integrations[0];
+      if (!integration) {
+        throw new TRPCError({ code: "BAD_REQUEST", message: "At least one Beszel integrationId is required" });
+      }
 
-        logger.debug("Beszel realtime subscription started", {
-          userId: ctx.session?.user?.id,
-          integrationIds: ctx.integrations.map((integration) => integration.id),
-          systemId: input.systemId,
-        });
+      const queue = new BoundedAsyncQueue<LiveStatsEvent>(MAX_PENDING_LIVE_EVENTS);
+      const controller = new AbortController();
+      let emittedEventCount = 0;
 
+      const stop = () => {
+        controller.abort();
+        void queue.return();
+      };
+      if (signal?.aborted) return;
+      signal?.addEventListener("abort", stop, { once: true });
+
+      logger.debug("Beszel realtime subscription started", {
+        userId: ctx.session?.user?.id,
+        integrationIds: ctx.integrations.map((candidate) => candidate.id),
+        systemId: input.systemId,
+      });
+
+      try {
+        const instance = await createIntegrationAsync(integration);
+        if (controller.signal.aborted) return;
         void (async () => {
-          const integration = ctx.integrations[0];
-          if (!integration) {
-            emit.error(
-              new TRPCError({ code: "BAD_REQUEST", message: "At least one Beszel integrationId is required" }),
-            );
-            return;
-          }
-
           try {
-            const instance = await createIntegrationAsync(integration);
-            if (typeof instance.subscribeRealtimeMetrics === "function") {
-              await instance.subscribeRealtimeMetrics(
-                input.systemId,
-                (event) => {
-                  if (!isActive) return;
-                  emittedEventCount += 1;
-                  if (emittedEventCount <= 2 || emittedEventCount % 60 === 0) {
-                    logger.debug("Forwarding Beszel realtime events", {
-                      userId: ctx.session?.user?.id,
-                      integrationId: integration.id,
-                      systemId: input.systemId,
-                      eventType: event.type,
-                      emittedEventCount,
-                      statsCount: Array.isArray(event.record.stats) ? event.record.stats.length : undefined,
-                    });
-                  }
-                  emit.next(event);
-                },
-                controller.signal,
-              );
-            } else {
-              emit.error(
-                new TRPCError({
-                  code: "METHOD_NOT_SUPPORTED",
-                  message: `Integration ${integration.kind} does not support realtime metrics`,
-                }),
-              );
-            }
-          } catch (error) {
-            if (isActive) {
-              logger.warn("Beszel realtime subscription failed", {
-                userId: ctx.session?.user?.id,
-                integrationId: integration.id,
-                systemId: input.systemId,
-                emittedEventCount,
-                error: errorMessage(error),
+            if (typeof instance.subscribeRealtimeMetrics !== "function") {
+              throw new TRPCError({
+                code: "METHOD_NOT_SUPPORTED",
+                message: `Integration ${integration.kind} does not support realtime metrics`,
               });
-              emit.error(
-                error instanceof TRPCError
-                  ? error
-                  : new TRPCError({
-                      code: "INTERNAL_SERVER_ERROR",
-                      message: error instanceof Error ? error.message : String(error),
-                    }),
-              );
             }
-          }
 
-          if (isActive) {
-            logger.debug("Beszel realtime subscription completed", {
+            await instance.subscribeRealtimeMetrics(
+              input.systemId,
+              (event) => {
+                emittedEventCount += 1;
+                if (emittedEventCount <= 2 || emittedEventCount % 60 === 0) {
+                  logger.debug("Forwarding Beszel realtime events", {
+                    userId: ctx.session?.user?.id,
+                    integrationId: integration.id,
+                    systemId: input.systemId,
+                    eventType: event.type,
+                    emittedEventCount,
+                    statsCount: Array.isArray(event.record.stats) ? event.record.stats.length : undefined,
+                  });
+                }
+                queue.push(event);
+              },
+              controller.signal,
+            );
+            queue.close();
+          } catch (error) {
+            if (controller.signal.aborted) {
+              queue.close();
+              return;
+            }
+
+            logger.warn("Beszel realtime subscription failed", {
               userId: ctx.session?.user?.id,
               integrationId: integration.id,
               systemId: input.systemId,
               emittedEventCount,
+              error: errorMessage(error),
             });
-            emit.complete();
+            queue.fail(
+              error instanceof TRPCError
+                ? error
+                : new TRPCError({
+                    code: "INTERNAL_SERVER_ERROR",
+                    message: error instanceof Error ? error.message : String(error),
+                  }),
+            );
           }
         })();
 
-        return () => {
-          isActive = false;
-          logger.debug("Beszel realtime subscription cancelled", {
-            userId: ctx.session?.user?.id,
-            integrationIds: ctx.integrations.map((integration) => integration.id),
-            systemId: input.systemId,
-            emittedEventCount,
-          });
-          controller.abort();
-        };
-      });
+        for await (const event of queue) yield event;
+      } finally {
+        stop();
+        signal?.removeEventListener("abort", stop);
+        logger.debug("Beszel realtime subscription stopped", {
+          userId: ctx.session?.user?.id,
+          integrationId: integration.id,
+          systemId: input.systemId,
+          emittedEventCount,
+        });
+      }
     }),
 });

packages/api/src/router/widgets/bounded-async-queue.ts

@@ -0,0 +1,88 @@
+type QueueResult<T> = IteratorResult<T, undefined>;
+
+type PendingRead<T> = {
+  resolve: (result: QueueResult<T>) => void;
+  reject: (reason?: unknown) => void;
+};
+
+/**
+ * A small async queue for live streams.
+ *
+ * Live metrics are snapshots, so retaining every snapshot while a client is
+ * slow is both unnecessary and dangerous. When the queue is full, discard
+ * the oldest pending snapshot and keep the newest one.
+ */
+export class BoundedAsyncQueue<T> implements AsyncIterableIterator<T> {
+  private readonly values: T[] = [];
+  private pendingRead: PendingRead<T> | undefined;
+  private closed = false;
+  private failed = false;
+  private failure: unknown;
+
+  public constructor(private readonly maxSize: number) {
+    if (!Number.isInteger(maxSize) || maxSize < 1) {
+      throw new Error("A bounded async queue requires a positive integer max size");
+    }
+  }
+
+  public push(value: T): void {
+    if (this.closed) return;
+
+    if (this.pendingRead) {
+      const pendingRead = this.pendingRead;
+      this.pendingRead = undefined;
+      pendingRead.resolve({ value, done: false });
+      return;
+    }
+
+    if (this.values.length >= this.maxSize) this.values.shift();
+    this.values.push(value);
+  }
+
+  public close(): void {
+    if (this.closed) return;
+    this.closed = true;
+
+    if (this.pendingRead) {
+      const pendingRead = this.pendingRead;
+      this.pendingRead = undefined;
+      pendingRead.resolve({ value: undefined, done: true });
+    }
+  }
+
+  public fail(error: unknown): void {
+    if (this.closed) return;
+    this.closed = true;
+    this.failed = true;
+    this.failure = error;
+    this.values.length = 0;
+
+    if (this.pendingRead) {
+      const pendingRead = this.pendingRead;
+      this.pendingRead = undefined;
+      pendingRead.reject(error);
+    }
+  }
+
+  public next(): Promise<QueueResult<T>> {
+    if (this.values.length > 0) {
+      return Promise.resolve({ value: this.values.shift() as T, done: false });
+    }
+    if (this.failed) return Promise.reject(this.failure);
+    if (this.closed) return Promise.resolve({ value: undefined, done: true });
+
+    return new Promise<QueueResult<T>>((resolve, reject) => {
+      this.pendingRead = { resolve, reject };
+    });
+  }
+
+  public return(): Promise<QueueResult<T>> {
+    this.values.length = 0;
+    this.close();
+    return Promise.resolve({ value: undefined, done: true });
+  }
+
+  public [Symbol.asyncIterator](): AsyncIterableIterator<T> {
+    return this;
+  }
+}

packages/api/src/router/widgets/immich.ts

@@ -25,7 +25,7 @@ export const immichRouter = createTRPCRouter({
     .concat(createImmichIntegrationMiddleware("query"))
     .input(
       z.object({
-        albumId: z.string(),
+        albumId: z.string().optional(),
       }),
     )
     .query(async ({ ctx, input }) => {

packages/api/src/router/widgets/media-requests.ts

@@ -3,7 +3,10 @@ import { z } from "zod/v4";
 import { getIntegrationKindsByCategory } from "@homarr/definitions";
 import { createIntegrationAsync } from "@homarr/integrations";
 import { mediaRequestStatusConfiguration } from "@homarr/integrations/types";
-import { mediaRequestListRequestHandler } from "@homarr/request-handler/media-request-list";
+import {
+  mediaRequestListInputSchema,
+  mediaRequestListRequestHandler,
+} from "@homarr/request-handler/media-request-list";
 import { mediaRequestStatsRequestHandler } from "@homarr/request-handler/media-request-stats";
 
 import { createManyIntegrationMiddleware, createOneIntegrationMiddleware } from "../../middlewares/integration";
@@ -16,13 +19,14 @@ export const mediaRequestsRouter = createTRPCRouter({
       mcp: {
         enabled: true,
         description:
-          "Get latest media requests from Overseerr/Jellyseerr with their status (pending, approved, declined, available). REQUIRED: integrationIds (array of Overseerr/Jellyseerr integration IDs from integration_all)",
+          "Get latest media requests from Overseerr/Jellyseerr with their status (pending, approved, declined, failed, completed). REQUIRED: integrationIds (array of Overseerr/Jellyseerr integration IDs from integration_all). OPTIONAL: statuses (array of statuses to include, must be non-empty) and recentDays (number 0-365; 0 disables the time filter).",
       },
     })
     .concat(createManyIntegrationMiddleware("query", ...getIntegrationKindsByCategory("mediaRequest")))
-    .query(async ({ ctx }) => {
+    .input(mediaRequestListInputSchema)
+    .query(async ({ ctx, input }) => {
       const results = await settleIntegrationQueries(ctx.integrations, async (integration) => {
-        const { data } = await mediaRequestListRequestHandler.handler(integration, {}).getDataAsync();
+        const { data } = await mediaRequestListRequestHandler.handler(integration, input).getDataAsync();
         return { integration: { id: integration.id, name: integration.name, kind: integration.kind }, data };
       });
       return results

packages/api/src/router/widgets/releases.ts

@@ -3,6 +3,7 @@ import { escapeForRegEx } from "@tiptap/react";
 import { z } from "zod/v4";
 
 import { decryptSecret } from "@homarr/common/server";
+import { createLogger } from "@homarr/core/infrastructure/logs";
 import { eq } from "@homarr/db";
 import { boards, items, widgetSecrets } from "@homarr/db/schema";
 import { releaseProviderKinds } from "@homarr/definitions";
@@ -11,6 +12,8 @@ import { releasesRequestHandler } from "@homarr/request-handler/releases";
 import { createTRPCRouter, publicProcedure } from "../../trpc";
 import { throwIfActionForbiddenAsync } from "../board/board-access";
 
+const logger = createLogger({ module: "releasesRouter" });
+
 const formatVersionFilterRegex = (versionFilter: z.infer<typeof releaseVersionFilterSchema> | undefined) => {
   if (!versionFilter) return undefined;
 
@@ -71,13 +74,13 @@ export const releasesRouter = createTRPCRouter({
             for (const secret of secrets) {
               try {
                 tokensByProvider.set(secret.kind, decryptSecret(secret.value));
-              } catch {
-                // Skip corrupt secrets
+              } catch (error) {
+                logger.warn("Failed to decrypt widget secret", { itemId: input.itemId, kind: secret.kind, error });
               }
             }
           }
-        } catch {
-          // Access denied or table not yet migrated -- proceed without tokens
+        } catch (error) {
+          logger.warn("Failed to load release widget tokens", { itemId: input.itemId, error });
         }
       }
 

packages/auth/adapter.ts

@@ -6,20 +6,24 @@ import { and, eq } from "@homarr/db";
 import { accounts, sessions, users } from "@homarr/db/schema";
 import type { SupportedAuthProvider } from "@homarr/definitions";
 
-export const createAdapter = (db: Database, provider: SupportedAuthProvider | "unknown"): Adapter => {
+export const createAdapter = (
+  db: Database,
+  provider: SupportedAuthProvider | "unknown",
+  enableDangerousCredentialsLinking = false,
+): Adapter => {
   const drizzleAdapter = DrizzleAdapter(db, { usersTable: users, sessionsTable: sessions, accountsTable: accounts });
 
   return {
     ...drizzleAdapter,
-    // We override the default implementation as we want to have a provider
-    // flag in the user instead of the account to not intermingle users from different providers
+    // Keep users isolated by their primary provider. The explicit credentials-linking
+    // opt-in is the only exception and keeps credentials as the primary provider.
     // eslint-disable-next-line no-restricted-syntax
     getUserByEmail: async (email) => {
       if (provider === "unknown") {
         throw new Error("Unable to get user by email for unknown provider");
       }
 
-      const user = await db.query.users.findFirst({
+      let user = await db.query.users.findFirst({
         where: and(eq(users.email, email), eq(users.provider, provider)),
         columns: {
           id: true,
@@ -30,6 +34,22 @@ export const createAdapter = (db: Database, provider: SupportedAuthProvider | "u
         },
       });
 
+      if (!user && provider === "oidc" && enableDangerousCredentialsLinking) {
+        // Credentials accounts do not have an email-verification flow, so their
+        // Auth.js emailVerified field is always null. The OIDC profile's strict
+        // email_verified check is the security boundary for this opt-in.
+        user = await db.query.users.findFirst({
+          where: and(eq(users.email, email), eq(users.provider, "credentials")),
+          columns: {
+            id: true,
+            name: true,
+            email: true,
+            emailVerified: true,
+            image: true,
+          },
+        });
+      }
+
       if (!user) {
         return null;
       }

packages/auth/configuration.ts

@@ -44,7 +44,7 @@ export const createConfiguration = (
   headers: ReadonlyHeaders | null,
   useSecureCookies: boolean,
 ) => {
-  const adapter = createAdapter(db, provider);
+  const adapter = createAdapter(db, provider, env.AUTH_OIDC_ENABLE_DANGEROUS_CREDENTIALS_LINKING);
   return NextAuth({
     logger: {
       error: (error) => {

packages/auth/env.ts

@@ -46,6 +46,7 @@ export const env = createEnv({
           AUTH_OIDC_NAME_ATTRIBUTE_OVERWRITE: z.string().optional(),
           AUTH_OIDC_FORCE_USERINFO: createBooleanSchema(false),
           AUTH_OIDC_ENABLE_DANGEROUS_ACCOUNT_LINKING: createBooleanSchema(false),
+          AUTH_OIDC_ENABLE_DANGEROUS_CREDENTIALS_LINKING: createBooleanSchema(false),
           AUTH_OIDC_TOKEN_ENDPOINT_AUTH_METHOD: z
             .enum(["client_secret_basic", "client_secret_post", "client_secret_jwt", "none"])
             .default("client_secret_basic"),

packages/auth/events.ts

@@ -24,6 +24,7 @@ export const createSignInEventHandler = (db: Database): Exclude<NextAuthConfig["
         name: true,
         image: true,
         colorScheme: true,
+        provider: true,
       },
     });
 
@@ -33,6 +34,7 @@ export const createSignInEventHandler = (db: Database): Exclude<NextAuthConfig["
     // Groups from oidc provider are provided from the profile, it's not typed.
     if (
       !env.AUTH_OIDC_GROUPS_LOCAL_MANAGEMENT &&
+      dbUser.provider === "oidc" &&
       profile &&
       groupsKey in profile &&
       Array.isArray(profile[groupsKey])
@@ -57,7 +59,7 @@ export const createSignInEventHandler = (db: Database): Exclude<NextAuthConfig["
       });
     }
 
-    if (profile) {
+    if (profile && dbUser.provider === "oidc") {
       const profileUsername = extractProfileName(profile);
       if (!profileUsername) {
         throw new Error(`OIDC provider did not return a name properties='${Object.keys(profile).join(",")}'`);

packages/auth/providers/oidc/oidc-provider.ts

@@ -7,6 +7,7 @@ import { fetchWithTrustedCertificatesAsync } from "@homarr/core/infrastructure/h
 
 import { env } from "../../env";
 import { createRedirectUri } from "../../redirect";
+import { assertVerifiedEmailForCredentialsLinking } from "./verified-email";
 
 export const OidcProvider = (headers: ReadonlyHeaders | null): OIDCConfig<Profile> => ({
   id: "oidc",
@@ -18,7 +19,8 @@ export const OidcProvider = (headers: ReadonlyHeaders | null): OIDCConfig<Profil
     token_endpoint_auth_method: env.AUTH_OIDC_TOKEN_ENDPOINT_AUTH_METHOD,
   },
   issuer: env.AUTH_OIDC_ISSUER,
-  allowDangerousEmailAccountLinking: env.AUTH_OIDC_ENABLE_DANGEROUS_ACCOUNT_LINKING,
+  allowDangerousEmailAccountLinking:
+    env.AUTH_OIDC_ENABLE_DANGEROUS_ACCOUNT_LINKING || env.AUTH_OIDC_ENABLE_DANGEROUS_CREDENTIALS_LINKING,
   authorization: {
     params: {
       scope: env.AUTH_OIDC_SCOPE_OVERWRITE,
@@ -55,6 +57,7 @@ export const OidcProvider = (headers: ReadonlyHeaders | null): OIDCConfig<Profil
     if (!profile.sub) {
       throw new Error(`OIDC provider did not return a sub property='${Object.keys(profile).join(",")}'`);
     }
+    assertVerifiedEmailForCredentialsLinking(profile, env.AUTH_OIDC_ENABLE_DANGEROUS_CREDENTIALS_LINKING);
     const name = extractProfileName(profile);
     if (!name) {
       throw new Error(`OIDC provider did not return a name properties='${Object.keys(profile).join(",")}'`);

packages/auth/providers/oidc/verified-email.ts

@@ -0,0 +1,11 @@
+export const assertVerifiedEmailForCredentialsLinking = (
+  profile: { email?: unknown; email_verified?: unknown },
+  isCredentialsLinkingEnabled: boolean,
+) => {
+  if (
+    isCredentialsLinkingEnabled &&
+    (profile.email_verified !== true || typeof profile.email !== "string" || profile.email.trim().length === 0)
+  ) {
+    throw new Error("OIDC provider did not return a verified email while credentials linking is enabled");
+  }
+};

packages/auth/providers/test/oidc-provider.spec.ts

@@ -0,0 +1,87 @@
+import { afterEach, describe, expect, test, vi } from "vitest";
+
+import { OidcProvider } from "../oidc/oidc-provider";
+import { assertVerifiedEmailForCredentialsLinking } from "../oidc/verified-email";
+
+const mockEnv = vi.hoisted(() => ({
+  AUTH_OIDC_CLIENT_ID: "client-id",
+  AUTH_OIDC_CLIENT_NAME: "OIDC",
+  AUTH_OIDC_CLIENT_SECRET: "client-secret",
+  AUTH_OIDC_ENABLE_DANGEROUS_ACCOUNT_LINKING: false,
+  AUTH_OIDC_ENABLE_DANGEROUS_CREDENTIALS_LINKING: false,
+  AUTH_OIDC_FORCE_USERINFO: false,
+  AUTH_OIDC_ISSUER: "https://example.com",
+  AUTH_OIDC_NAME_ATTRIBUTE_OVERWRITE: undefined,
+  AUTH_OIDC_SCOPE_OVERWRITE: "openid email profile",
+  AUTH_OIDC_TOKEN_ENDPOINT_AUTH_METHOD: "client_secret_basic" as const,
+}));
+
+vi.mock("../../env", () => ({ env: mockEnv }));
+vi.mock("next-auth", () => ({ customFetch: Symbol("customFetch") }));
+
+afterEach(() => {
+  mockEnv.AUTH_OIDC_ENABLE_DANGEROUS_CREDENTIALS_LINKING = false;
+});
+
+describe("assertVerifiedEmailForCredentialsLinking", () => {
+  test("allows a strictly verified OIDC email when credentials linking is enabled", () => {
+    expect(() =>
+      assertVerifiedEmailForCredentialsLinking({ email: "test@example.com", email_verified: true }, true),
+    ).not.toThrow();
+  });
+
+  test.each([
+    { email: "test@example.com", email_verified: false },
+    { email: "test@example.com", email_verified: "true" },
+    { email_verified: true },
+    { email: null, email_verified: true },
+    { email: " ", email_verified: true },
+    {},
+  ])("rejects an OIDC profile without a strictly verified email when credentials linking is enabled", (profile) => {
+    expect(() => assertVerifiedEmailForCredentialsLinking(profile, true)).toThrow(
+      "OIDC provider did not return a verified email while credentials linking is enabled",
+    );
+  });
+
+  test("does not require the claim when credentials linking is disabled", () => {
+    expect(() => assertVerifiedEmailForCredentialsLinking({}, false)).not.toThrow();
+  });
+
+  test("OIDC provider rejects an unverified profile when credentials linking is enabled", () => {
+    mockEnv.AUTH_OIDC_ENABLE_DANGEROUS_CREDENTIALS_LINKING = true;
+    const provider = OidcProvider(null);
+    expect(provider.allowDangerousEmailAccountLinking).toBe(true);
+    const mapProfile = provider.profile;
+    if (!mapProfile) throw new Error("Expected OIDC profile mapper to be defined");
+
+    expect(() =>
+      mapProfile(
+        {
+          sub: "subject",
+          preferred_username: "test",
+          email: "test@example.com",
+          email_verified: false,
+        },
+        {},
+      ),
+    ).toThrow("OIDC provider did not return a verified email while credentials linking is enabled");
+  });
+
+  test("OIDC provider accepts an unverified profile when credentials linking is disabled", () => {
+    const provider = OidcProvider(null);
+    const mapProfile = provider.profile;
+    if (!mapProfile) throw new Error("Expected OIDC profile mapper to be defined");
+
+    expect(() =>
+      mapProfile(
+        {
+          sub: "subject",
+          preferred_username: "test",
+          email: "test@example.com",
+          email_verified: false,
+        },
+        {},
+      ),
+    ).not.toThrow();
+  });
+});

packages/auth/test/adapter.spec.ts

@@ -1,6 +1,7 @@
 import { describe, expect, test } from "vitest";
 
-import { users } from "@homarr/db/schema";
+import { eq } from "@homarr/db";
+import { accounts, apiKeys, groupMembers, groups, users } from "@homarr/db/schema";
 import { createDb } from "@homarr/db/test";
 
 import { createAdapter } from "../adapter";
@@ -64,4 +65,91 @@ describe("createAdapter should create drizzle adapter", () => {
     // Assert
     await expect(actAsync()).rejects.toThrow("Unable to get user by email for unknown provider");
   });
+
+  test("getUserByEmail should return a credentials user for oidc when credentials linking is enabled", async () => {
+    const db = createDb();
+    const adapter = createAdapter(db, "oidc", true);
+    const email = "test@example.com";
+    await db.insert(users).values({ id: "credentials-user", name: "test", email, provider: "credentials" });
+
+    const user = await adapter.getUserByEmail?.(email);
+
+    expect(user?.id).toBe("credentials-user");
+  });
+
+  test("getUserByEmail should not return credentials users for non-oidc providers", async () => {
+    const db = createDb();
+    const adapter = createAdapter(db, "ldap", true);
+    const email = "test@example.com";
+    await db.insert(users).values({ id: "credentials-user", name: "test", email, provider: "credentials" });
+
+    const user = await adapter.getUserByEmail?.(email);
+
+    expect(user).toBeNull();
+  });
+
+  test("getUserByEmail should prefer an existing oidc user over a credentials user", async () => {
+    const db = createDb();
+    const adapter = createAdapter(db, "oidc", true);
+    const email = "test@example.com";
+    await db.insert(users).values([
+      { id: "credentials-user", name: "credentials", email, provider: "credentials" },
+      { id: "oidc-user", name: "oidc", email, provider: "oidc" },
+    ]);
+
+    const user = await adapter.getUserByEmail?.(email);
+
+    expect(user?.id).toBe("oidc-user");
+  });
+
+  test("linkAccount should preserve the credentials user and their data", async () => {
+    const db = createDb();
+    const adapter = createAdapter(db, "oidc", true);
+    const email = "test@example.com";
+    await db.insert(users).values({
+      id: "credentials-user",
+      name: "test",
+      email,
+      password: "hashed-password",
+      provider: "credentials",
+      colorScheme: "light",
+      completedBoardTour: true,
+    });
+    await db.insert(groups).values({ id: "group", name: "Test group", position: 1 });
+    await db.insert(groupMembers).values({ groupId: "group", userId: "credentials-user" });
+    await db.insert(apiKeys).values({ id: "api-key", apiKey: "secret", userId: "credentials-user" });
+
+    const user = await adapter.getUserByEmail?.(email);
+    if (!user) throw new Error("Expected credentials user to be found for OIDC linking");
+    await adapter.linkAccount?.({
+      userId: user.id,
+      type: "oidc",
+      provider: "oidc",
+      providerAccountId: "oidc-subject",
+    });
+
+    const linkedUser = await db.query.users.findFirst({ where: eq(users.id, "credentials-user") });
+    const account = await db.query.accounts.findFirst({ where: eq(accounts.providerAccountId, "oidc-subject") });
+    const membership = await db.query.groupMembers.findFirst({
+      where: eq(groupMembers.userId, "credentials-user"),
+    });
+    const apiKey = await db.query.apiKeys.findFirst({ where: eq(apiKeys.userId, "credentials-user") });
+    const userByAccount = await adapter.getUserByAccount?.({
+      provider: "oidc",
+      providerAccountId: "oidc-subject",
+    });
+    const allUsers = await db.query.users.findMany();
+    expect(linkedUser).toMatchObject({
+      id: "credentials-user",
+      password: "hashed-password",
+      provider: "credentials",
+      colorScheme: "light",
+      completedBoardTour: true,
+    });
+    expect(account?.userId).toBe("credentials-user");
+    expect(membership?.groupId).toBe("group");
+    expect(apiKey?.id).toBe("api-key");
+    expect(userByAccount?.id).toBe("credentials-user");
+    expect(allUsers).toHaveLength(1);
+  });
 });

packages/auth/test/events.spec.ts

@@ -135,7 +135,7 @@ describe("createSignInEventHandler should create signInEventHandler", () => {
     test("should add missing group membership", async () => {
       // Arrange
       const db = createDb();
-      await createUserAsync(db);
+      await createUserAsync(db, "oidc");
       await createGroupAsync(db);
       const eventHandler = createSignInEventHandler(db);
 
@@ -155,7 +155,7 @@ describe("createSignInEventHandler should create signInEventHandler", () => {
     test("should remove group membership", async () => {
       // Arrange
       const db = createDb();
-      await createUserAsync(db);
+      await createUserAsync(db, "oidc");
       await createGroupAsync(db);
       await db.insert(groupMembers).values({
         userId: "1",
@@ -179,7 +179,7 @@ describe("createSignInEventHandler should create signInEventHandler", () => {
     test("should not remove group membership for everyone group", async () => {
       // Arrange
       const db = createDb();
-      await createUserAsync(db);
+      await createUserAsync(db, "oidc");
       await createGroupAsync(db, everyoneGroup);
       await db.insert(groupMembers).values({
         userId: "1",
@@ -204,7 +204,7 @@ describe("createSignInEventHandler should create signInEventHandler", () => {
       // Arrange
       mockEnv.AUTH_OIDC_GROUPS_LOCAL_MANAGEMENT = true;
       const db = createDb();
-      await createUserAsync(db);
+      await createUserAsync(db, "oidc");
       await createGroupAsync(db);
       const eventHandler = createSignInEventHandler(db);
 
@@ -229,10 +229,10 @@ describe("createSignInEventHandler should create signInEventHandler", () => {
     ["ldap" as const, { name: "test-new" }, undefined],
     ["oidc" as const, { name: "test" }, { preferred_username: "test-new" }],
     ["oidc" as const, { name: "test" }, { preferred_username: "test@example.com", name: "test-new" }],
-  ])("signInEventHandler should update username for %s provider", async (_provider, user, profile) => {
+  ])("signInEventHandler should update username for %s provider", async (provider, user, profile) => {
     // Arrange
     const db = createDb();
-    await createUserAsync(db);
+    await createUserAsync(db, provider);
     const eventHandler = createSignInEventHandler(db);
 
     // Act
@@ -251,6 +251,32 @@ describe("createSignInEventHandler should create signInEventHandler", () => {
     });
     expect(dbUser?.name).toBe("test-new");
   });
+  test("signInEventHandler should preserve credentials-owned data when the user signs in with linked oidc", async () => {
+    const db = createDb();
+    await createUserAsync(db, "credentials", "local-avatar");
+    await createGroupAsync(db);
+    await db.insert(groupMembers).values({ userId: "1", groupId: "1" });
+    const eventHandler = createSignInEventHandler(db);
+
+    await eventHandler?.({
+      user: { id: "1", name: "test" },
+      profile: {
+        preferred_username: "oidc-name",
+        picture: "oidc-avatar",
+        someRandomGroupsKey: [],
+      },
+      account: null,
+    });
+
+    const dbUser = await db.query.users.findFirst({ where: eq(users.id, "1") });
+    const membership = await db.query.groupMembers.findFirst({ where: eq(groupMembers.userId, "1") });
+    expect(dbUser).toMatchObject({
+      name: "test",
+      image: "local-avatar",
+      provider: "credentials",
+    });
+    expect(membership?.groupId).toBe("1");
+  });
   test("signInEventHandler should set color-scheme cookie", async () => {
     // Arrange
     const db = createDb();
@@ -275,11 +301,17 @@ describe("createSignInEventHandler should create signInEventHandler", () => {
   });
 });
 
-const createUserAsync = async (db: Database) =>
+const createUserAsync = async (
+  db: Database,
+  provider: "credentials" | "ldap" | "oidc" = "credentials",
+  image?: string,
+) =>
   await db.insert(users).values({
     id: "1",
     name: "test",
     colorScheme: "dark",
+    image,
+    provider,
   });
 
 const createGroupAsync = async (db: Database, name = "test") =>

packages/core/src/infrastructure/http/request.ts

@@ -67,12 +67,14 @@ export const fetchWithTrustedCertificatesAsync = async (
   url: RequestInfo,
   options?: RequestInit & { timeout?: number; bodyTimeout?: number },
 ): Promise<Response> => {
-  const agent = await createCertificateAgentAsync(
-    undefined,
-    options?.bodyTimeout !== undefined ? { bodyTimeout: options.bodyTimeout } : undefined,
-  );
+  const agent =
+    options?.dispatcher ??
+    (await createCertificateAgentAsync(
+      undefined,
+      options?.bodyTimeout !== undefined ? { bodyTimeout: options.bodyTimeout } : undefined,
+    ));
   if (options?.timeout) {
-    const { bodyTimeout: _bodyTimeout, ...fetchOptions } = options;
+    const { bodyTimeout: _bodyTimeout, dispatcher: _dispatcher, ...fetchOptions } = options;
     return await withTimeoutAsync(
       async (signal) =>
         fetch(url, {
@@ -84,7 +86,7 @@ export const fetchWithTrustedCertificatesAsync = async (
     );
   }
 
-  const { bodyTimeout: _bodyTimeout, ...fetchOptions } = options ?? {};
+  const { bodyTimeout: _bodyTimeout, dispatcher: _dispatcher, ...fetchOptions } = options ?? {};
   return fetch(url, {
     ...fetchOptions,
     dispatcher: agent,

packages/db/migrations/mysql/0043_add_right_click_preference.sql

@@ -0,0 +1 @@
+ALTER TABLE `user` ADD `enable_right_click_on_widgets` boolean DEFAULT true NOT NULL;

packages/db/migrations/mysql/meta/_journal.json

@@ -302,6 +302,13 @@
       "when": 1783176100870,
       "tag": "0042_add_widget_secret",
       "breakpoints": true
+    },
+    {
+      "idx": 43,
+      "version": "5",
+      "when": 1783852800000,
+      "tag": "0043_add_right_click_preference",
+      "breakpoints": true
     }
   ]
-}
+}

packages/db/migrations/postgresql/0009_add_right_click_preference.sql

@@ -0,0 +1 @@
+ALTER TABLE "user" ADD COLUMN "enable_right_click_on_widgets" boolean DEFAULT true NOT NULL;

packages/db/migrations/postgresql/meta/_journal.json

@@ -64,6 +64,13 @@
       "when": 1783176100870,
       "tag": "0008_add_widget_secret",
       "breakpoints": true
+    },
+    {
+      "idx": 9,
+      "version": "7",
+      "when": 1783786677702,
+      "tag": "0009_add_right_click_preference",
+      "breakpoints": true
     }
   ]
-}
+}

packages/db/migrations/sqlite/0041_add_right_click_preference.sql

@@ -0,0 +1 @@
+ALTER TABLE `user` ADD `enable_right_click_on_widgets` integer DEFAULT true NOT NULL;

packages/db/migrations/sqlite/meta/_journal.json

@@ -288,6 +288,13 @@
       "when": 1783176100870,
       "tag": "0040_add_widget_secret",
       "breakpoints": true
+    },
+    {
+      "idx": 41,
+      "version": "6",
+      "when": 1783786658943,
+      "tag": "0041_add_right_click_preference",
+      "breakpoints": true
     }
   ]
-}
+}

packages/db/schema/mysql.ts

@@ -86,6 +86,7 @@ export const users = mysqlTable("user", {
   colorScheme: varchar({ length: 5 }).$type<ColorScheme>().default("dark").notNull(),
   firstDayOfWeek: tinyint().$type<DayOfWeek>().default(1).notNull(), // Defaults to Monday
   pingIconsEnabled: boolean().default(false).notNull(),
+  enableRightClickOnWidgets: boolean().default(true).notNull(),
   completedManageTour: boolean().default(false).notNull(),
   completedBoardTour: boolean().default(false).notNull(),
 });

packages/db/schema/postgresql.ts

@@ -85,6 +85,7 @@ export const users = pgTable("user", {
   colorScheme: varchar({ length: 5 }).$type<ColorScheme>().default("dark").notNull(),
   firstDayOfWeek: smallint().$type<DayOfWeek>().default(1).notNull(), // Defaults to Monday
   pingIconsEnabled: boolean().default(false).notNull(),
+  enableRightClickOnWidgets: boolean().default(true).notNull(),
   completedManageTour: boolean().default(false).notNull(),
   completedBoardTour: boolean().default(false).notNull(),
 });

packages/db/schema/sqlite.ts

@@ -68,6 +68,7 @@ export const users = sqliteTable("user", {
   colorScheme: text().$type<ColorScheme>().default("dark").notNull(),
   firstDayOfWeek: int().$type<DayOfWeek>().default(1).notNull(), // Defaults to Monday
   pingIconsEnabled: int({ mode: "boolean" }).default(false).notNull(),
+  enableRightClickOnWidgets: int({ mode: "boolean" }).default(true).notNull(),
   completedManageTour: int({ mode: "boolean" }).default(false).notNull(),
   completedBoardTour: int({ mode: "boolean" }).default(false).notNull(),
 });

packages/db/test/mysql-migration.spec.ts

@@ -37,5 +37,5 @@ describe("Mysql Migration", () => {
 
     connection.end();
     await mysqlContainer.stop();
-  }, 40_000);
+  }, 120_000);
 });

packages/definitions/src/integration.ts

@@ -467,7 +467,6 @@ export const integrationDefs = {
     iconUrl: "https://cdn.jsdelivr.net/gh/selfhst/icons/png/archiveteam-warrior.png",
     category: ["archiving"],
     documentationUrl: null,
-    defaultUrl: "http://localhost:8001",
   },
   // This integration only returns mock data, it is used during development (but can also be used in production by directly going to the create page)
   mock: {

packages/image-proxy/src/index.ts

@@ -19,6 +19,12 @@ const createUrlByIdChannel = (id: string) =>
     headers: `${string}.${string}`;
   }>(`image-proxy:url:${id}`);
 
+export type ForwardImageResult =
+  | { image: ArrayBuffer; contentType: string | null }
+  | { error: "not-found" }
+  | { error: "upstream-error"; statusCode: number }
+  | { error: "fetch-error" };
+
 export class ImageProxy {
   private static hmacKey: Buffer<ArrayBuffer> | null = null;
 
@@ -47,17 +53,34 @@ export class ImageProxy {
     return this.createImageUrl(id);
   }
 
-  public async forwardImageAsync(id: string): Promise<ArrayBuffer | null> {
+  public async forwardImageAsync(id: string): Promise<ForwardImageResult> {
     const urlAndHeaders = await this.getImageUrlAndHeadersAsync(id);
     if (!urlAndHeaders) {
-      return null;
+      return { error: "not-found" };
     }
 
-    const response = await fetchWithTrustedCertificatesAsync(urlAndHeaders.url, {
-      headers: urlAndHeaders.headers ?? {},
-    });
-
     const proxyUrl = this.createImageUrl(id);
+    let response: Awaited<ReturnType<typeof fetchWithTrustedCertificatesAsync>>;
+    try {
+      response = await fetchWithTrustedCertificatesAsync(urlAndHeaders.url, {
+        headers: urlAndHeaders.headers ?? {},
+      });
+    } catch (error) {
+      logger.error(
+        new ErrorWithMetadata(
+          "Failed to connect to image source",
+          {
+            id,
+            url: this.redactUrl(urlAndHeaders.url),
+            headers: this.redactHeaders(urlAndHeaders.headers),
+            proxyUrl,
+          },
+          { cause: error },
+        ),
+      );
+      return { error: "fetch-error" };
+    }
+
     if (!response.ok) {
       logger.error(
         new ErrorWithMetadata("Failed to fetch image", {
@@ -68,7 +91,7 @@ export class ImageProxy {
           statusCode: response.status,
         }),
       );
-      return null;
+      return { error: "upstream-error", statusCode: response.status };
     }
 
     const arrayBuffer = await response.arrayBuffer();
@@ -80,7 +103,7 @@ export class ImageProxy {
       size: `${(arrayBuffer.byteLength / 1024).toFixed(1)}KB`,
     });
 
-    return arrayBuffer;
+    return { image: arrayBuffer, contentType: response.headers.get("content-type") };
   }
 
   private createImageUrl(id: string): string {

packages/integrations/src/base/session-store.ts

@@ -23,10 +23,15 @@ export const createSessionStore = <TValue>(integration: { id: string }) => {
         return null;
       }
     },
-    async setAsync(value: TValue) {
-      logger.debug("Updating session in store", { store: channelName });
+    /**
+     * @param value session to store
+     * @param options pass `ttlSeconds` when the credential has a known lifetime, so a stored
+     * session can never outlive the token it holds
+     */
+    async setAsync(value: TValue, options?: { ttlSeconds?: number }) {
+      logger.debug("Updating session in store", { store: channelName, ttlSeconds: options?.ttlSeconds });
       try {
-        await channel.setAsync(encryptSecret(superjson.stringify(value)));
+        await channel.setAsync(encryptSecret(superjson.stringify(value)), options);
       } catch (error) {
         logger.error(new ErrorWithMetadata("Failed to save session", { store: channelName }, { cause: error }));
       }

packages/integrations/src/beszel/beszel-integration.ts

@@ -1,6 +1,8 @@
 import { ResponseError } from "@homarr/common/server";
 import { createLogger } from "@homarr/core/infrastructure/logs";
-import { fetchWithTrustedCertificatesAsync } from "@homarr/core/infrastructure/http";
+import { ErrorWithMetadata } from "@homarr/core/infrastructure/logs/error";
+import { createCertificateAgentAsync, fetchWithTrustedCertificatesAsync } from "@homarr/core/infrastructure/http";
+import type { Response as UndiciResponse } from "undici";
 
 import type { IntegrationInput, IntegrationTestingInput } from "../base/integration";
 import { Integration } from "../base/integration";
@@ -80,11 +82,47 @@ export const normalizeRealtimeSnapshot = (
   return events;
 };
 
-interface BeszelSession {
+export interface BeszelSession {
   token: string;
   userId: string;
+  /** Epoch milliseconds, taken from the token's `exp` claim. Undefined when it could not be read. */
+  expiresAt?: number;
 }
 
+/**
+ * Re-authenticate this long before the token actually lapses, so a request can never be sent
+ * with a token that expires while it is in flight.
+ */
+const sessionExpiryLeewayMs = 60_000;
+
+/**
+ * Reads the expiration out of a PocketBase auth token.
+ *
+ * @returns expiry as epoch milliseconds, or null when the token is malformed or carries no
+ * numeric `exp` claim — in which case we fall back to the existing 401 retry path.
+ */
+export const parseTokenExpiration = (token: string): number | null => {
+  const payload = token.split(".")[1];
+  if (!payload) return null;
+
+  try {
+    const decoded = Buffer.from(payload.replace(/-/g, "+").replace(/_/g, "/"), "base64").toString("utf8");
+    const { exp } = JSON.parse(decoded) as { exp?: unknown };
+    return typeof exp === "number" && Number.isFinite(exp) ? exp * 1000 : null;
+  } catch {
+    return null;
+  }
+};
+
+/**
+ * Beszel answers requests carrying an expired token with `200` and an empty list rather than `401`,
+ * because its collection rules filter on `@request.auth.id` instead of rejecting. The 401 retry in
+ * `fetchWithAuthAsync` therefore never fires, so a stored session would otherwise be trusted
+ * forever. Sessions have to expire themselves.
+ */
+export const isSessionExpired = (session: BeszelSession, now = Date.now()) =>
+  session.expiresAt !== undefined && session.expiresAt - sessionExpiryLeewayMs <= now;
+
 export class BeszelIntegration extends Integration {
   private readonly sessionStore: SessionStore<BeszelSession>;
 
@@ -95,11 +133,19 @@ export class BeszelIntegration extends Integration {
 
   private async authenticateAsync(): Promise<BeszelSession> {
     const existingSession = await this.sessionStore.getAsync();
-    if (existingSession) {
+    if (existingSession && !isSessionExpired(existingSession)) {
       logger.debug("Using stored Beszel session", { integrationId: this.integration.id });
       return existingSession;
     }
 
+    if (existingSession) {
+      logger.info("Stored Beszel session expired, re-authenticating", {
+        integrationId: this.integration.id,
+        expiresAt: existingSession.expiresAt,
+      });
+      await this.sessionStore.clearAsync();
+    }
+
     const authUrl = this.url("/api/collections/users/auth-with-password");
     logger.debug("Authenticating with Beszel", { integrationId: this.integration.id, url: authUrl.pathname });
     const response = await fetchWithTrustedCertificatesAsync(authUrl, {
@@ -118,9 +164,30 @@ export class BeszelIntegration extends Integration {
     }
 
     const data = (await response.json()) as BeszelAuthResponse;
-    const session: BeszelSession = { token: data.token, userId: data.record.id };
-    await this.sessionStore.setAsync(session);
-    logger.debug("Saved Beszel session", { integrationId: this.integration.id, userId: session.userId });
+    const expiresAt = parseTokenExpiration(data.token) ?? undefined;
+
+    // A token that has already lapsed by the time it reaches us means our clock and Beszel's
+    // disagree by more than the token lifetime. Re-authenticating would only mint another dead
+    // token, and using this one would silently produce the empty responses this check exists to
+    // prevent — so fail loudly instead.
+    if (expiresAt !== undefined && expiresAt <= Date.now()) {
+      logger.warn("Beszel issued an already-expired token", { integrationId: this.integration.id, expiresAt });
+      throw new ErrorWithMetadata("Beszel issued an already-expired authentication token, check for clock skew", {
+        integrationId: this.integration.id,
+        expiresAt,
+      });
+    }
+
+    const session: BeszelSession = { token: data.token, userId: data.record.id, expiresAt };
+    // Give the stored entry the token's own lifetime, so the cache cannot outlive the credential
+    // even if the session is never read again before it lapses.
+    const ttlSeconds = expiresAt === undefined ? undefined : Math.max(1, Math.ceil((expiresAt - Date.now()) / 1000));
+    await this.sessionStore.setAsync(session, ttlSeconds === undefined ? undefined : { ttlSeconds });
+    logger.debug("Saved Beszel session", {
+      integrationId: this.integration.id,
+      userId: session.userId,
+      expiresAt,
+    });
     return session;
   }
 
@@ -357,19 +424,41 @@ export class BeszelIntegration extends Integration {
     let emittedSnapshotCount = 0;
 
     while (!signal.aborted) {
+      let streamResponse: UndiciResponse | undefined;
+      let streamAgent: Awaited<ReturnType<typeof createCertificateAgentAsync>> | undefined;
+      const closeStreamAsync = async () => {
+        const response = streamResponse;
+        streamResponse = undefined;
+        const agent = streamAgent;
+        streamAgent = undefined;
+
+        if (response?.body) await response.body.cancel().catch(() => {});
+        if (agent) await agent.close().catch(() => {});
+      };
+
       try {
         let session = await this.authenticateAsync();
-        const openStream = async () =>
-          await fetchWithTrustedCertificatesAsync(realtimeUrl, {
-            headers: {
-              Accept: "text/event-stream",
-              Authorization: session.token,
-              "Cache-Control": "no-cache",
-              Pragma: "no-cache",
-            },
-            signal,
-            bodyTimeout: 0,
-          });
+        const openStream = async () => {
+          streamAgent = await createCertificateAgentAsync(undefined, { bodyTimeout: 0 });
+          try {
+            const response = await fetchWithTrustedCertificatesAsync(realtimeUrl, {
+              headers: {
+                Accept: "text/event-stream",
+                Authorization: session.token,
+                "Cache-Control": "no-cache",
+                Pragma: "no-cache",
+              },
+              signal,
+              bodyTimeout: 0,
+              dispatcher: streamAgent,
+            });
+            streamResponse = response;
+            return response;
+          } catch (error) {
+            await closeStreamAsync();
+            throw error;
+          }
+        };
 
         logger.debug("Opening Beszel rt_metrics SSE connection", {
           integrationId: this.integration.id,
@@ -378,6 +467,7 @@ export class BeszelIntegration extends Integration {
         });
         let response = await openStream();
         if (response.status === 401) {
+          await closeStreamAsync();
           await this.sessionStore.clearAsync();
           session = await this.authenticateAsync();
           response = await openStream();
@@ -402,14 +492,21 @@ export class BeszelIntegration extends Integration {
             clientId = frame.id || fallbackClientId;
             if (!clientId) throw new Error("PocketBase PB_CONNECT event did not include a client ID");
 
+            if (!streamAgent) throw new Error("Beszel realtime stream agent is not available");
             const subscribeResponse = await fetchWithTrustedCertificatesAsync(realtimeUrl, {
               method: "POST",
               headers: { Authorization: session.token, "Content-Type": "application/json" },
               body: JSON.stringify({ clientId, subscriptions: [topic] }),
               signal,
+              dispatcher: streamAgent,
             });
-            if (subscribeResponse.status === 401) await this.sessionStore.clearAsync();
-            if (!subscribeResponse.ok) throw new ResponseError(subscribeResponse);
+            try {
+              if (subscribeResponse.status === 401) await this.sessionStore.clearAsync();
+              if (!subscribeResponse.ok) throw new ResponseError(subscribeResponse);
+              await subscribeResponse.arrayBuffer();
+            } finally {
+              if (subscribeResponse.body) await subscribeResponse.body.cancel().catch(() => {});
+            }
             logger.debug("Subscribed to Beszel rt_metrics topic", {
               integrationId: this.integration.id,
               systemId,
@@ -461,10 +558,12 @@ export class BeszelIntegration extends Integration {
         } finally {
           await reader.cancel().catch(() => {});
           reader.releaseLock();
+          await closeStreamAsync();
         }
 
         if (!signal.aborted) throw new Error("Beszel rt_metrics SSE stream ended unexpectedly");
       } catch (error) {
+        await closeStreamAsync();
         if (signal.aborted) break;
         if (error instanceof ResponseError && error.statusCode === 401 && retryAttempt === 0) {
           retryAttempt += 1;

packages/integrations/src/beszel/test/beszel-integration.spec.ts

@@ -10,6 +10,7 @@ vi.hoisted(() => {
 const BESZEL_URL = process.env.BESZEL_TEST_URL ?? "http://localhost:8090";
 const BESZEL_EMAIL = process.env.BESZEL_TEST_EMAIL ?? "";
 const BESZEL_PASSWORD = process.env.BESZEL_TEST_PASSWORD ?? "";
+const closeAgent = vi.hoisted(() => vi.fn().mockResolvedValue(undefined));
 
 vi.mock("@homarr/redis", () => ({
   createGetSetChannel: () => ({
@@ -32,7 +33,7 @@ vi.mock("@homarr/core/infrastructure/logs", () => ({
 vi.mock("@homarr/core/infrastructure/http", () => ({
   fetchWithTrustedCertificatesAsync: (url: URL | string, init?: RequestInit) => fetch(url, init),
   createAxiosCertificateInstanceAsync: vi.fn().mockResolvedValue({}),
-  createCertificateAgentAsync: vi.fn().mockResolvedValue(undefined),
+  createCertificateAgentAsync: vi.fn().mockResolvedValue({ close: closeAgent }),
 }));
 
 vi.mock("@homarr/core/infrastructure/certificates", () => ({
@@ -153,6 +154,7 @@ describe("subscribeRealtimeMetrics", () => {
 
       expect(subscriptionBodies).toEqual([{ clientId: "client-1", subscriptions: [topic] }]);
       expect(events.map((event) => event.type)).toEqual(["system_stats", "container_stats"]);
+      expect(closeAgent).toHaveBeenCalled();
     } finally {
       globalThis.fetch = originalFetch;
     }

packages/integrations/src/beszel/test/beszel-session.spec.ts

@@ -0,0 +1,213 @@
+// @vitest-environment node
+import { afterEach, beforeEach, describe, expect, test, vi } from "vitest";
+
+vi.hoisted(() => {
+  process.env.SKIP_ENV_VALIDATION = "true";
+  process.env.SECRET_ENCRYPTION_KEY = "ff3f4f7ce30e870c9630de9e5d244ffa81101a24ed0dfe5f064beb53a7e684f1";
+  process.env.ENABLE_DNS_CACHING = "false";
+});
+
+// A stateful stand-in for redis, so a session actually survives between calls and the
+// expiry logic can be exercised end to end.
+const store = vi.hoisted(() => new Map<string, { value: string; ttlSeconds?: number }>());
+
+vi.mock("@homarr/redis", () => ({
+  createGetSetChannel: (name: string) => ({
+    getAsync: () => Promise.resolve(store.get(name)?.value ?? null),
+    setAsync: (value: string, options?: { ttlSeconds?: number }) => {
+      store.set(name, { value, ttlSeconds: options?.ttlSeconds });
+      return Promise.resolve();
+    },
+    removeAsync: () => {
+      store.delete(name);
+      return Promise.resolve();
+    },
+  }),
+}));
+
+vi.mock("@homarr/core/infrastructure/logs", () => ({
+  createLogger: () => ({ debug: vi.fn(), info: vi.fn(), warn: vi.fn(), error: vi.fn() }),
+  ErrorWithMetadata: class extends Error {},
+}));
+
+vi.mock("@homarr/core/infrastructure/http", () => ({
+  fetchWithTrustedCertificatesAsync: (url: URL | string, init?: RequestInit) => fetch(url, init),
+  createAxiosCertificateInstanceAsync: vi.fn().mockResolvedValue({}),
+  createCertificateAgentAsync: vi.fn().mockResolvedValue({ close: vi.fn() }),
+}));
+
+vi.mock("@homarr/core/infrastructure/certificates", () => ({
+  getTrustedCertificateHostnamesAsync: vi.fn().mockResolvedValue([]),
+  getAllTrustedCertificatesAsync: vi.fn().mockResolvedValue([]),
+}));
+
+import { BeszelIntegration, isSessionExpired, parseTokenExpiration } from "../beszel-integration";
+
+const base64Url = (value: object) => Buffer.from(JSON.stringify(value)).toString("base64url");
+const createToken = (expiresAtSeconds: number) => `header.${base64Url({ exp: expiresAtSeconds })}.signature`;
+
+describe("parseTokenExpiration", () => {
+  test("reads the exp claim as epoch milliseconds", () => {
+    expect(parseTokenExpiration(createToken(1_800_000_000))).toBe(1_800_000_000_000);
+  });
+
+  test("decodes base64url payloads containing - and _", () => {
+    // A payload that base64-encodes with both + and /, which must be url-decoded first.
+    const token = `header.${Buffer.from(JSON.stringify({ sub: "a>b?c>>", exp: 1_700_000_000 })).toString("base64url")}.sig`;
+    expect(parseTokenExpiration(token)).toBe(1_700_000_000_000);
+  });
+
+  test.each([
+    ["not-a-jwt", "no segments"],
+    ["header.%%%not-base64%%%.signature", "undecodable payload"],
+    [`header.${base64Url({ id: "user-1" })}.signature`, "no exp claim"],
+    [`header.${base64Url({ exp: "soon" })}.signature`, "non-numeric exp"],
+  ])("returns null for %s (%s)", (token) => {
+    expect(parseTokenExpiration(token)).toBeNull();
+  });
+});
+
+const session = (expiresAt?: number) => ({ token: "t", userId: "u", expiresAt });
+
+describe("isSessionExpired", () => {
+  const now = Date.UTC(2026, 6, 26, 12, 0, 0);
+
+  test("treats a session with an unknown expiry as valid, falling back to the 401 retry", () => {
+    expect(isSessionExpired(session(undefined), now)).toBe(false);
+  });
+
+  test("keeps a session that is comfortably in the future", () => {
+    expect(isSessionExpired(session(now + 60 * 60 * 1000), now)).toBe(false);
+  });
+
+  test("expires a session that lapses within the leeway window", () => {
+    expect(isSessionExpired(session(now + 30_000), now)).toBe(true);
+  });
+
+  test("expires a session that has already lapsed", () => {
+    expect(isSessionExpired(session(now - 1), now)).toBe(true);
+  });
+});
+
+const createIntegration = () =>
+  new BeszelIntegration({
+    id: "test-beszel-session",
+    name: "Test Beszel",
+    url: "http://localhost:8090",
+    externalUrl: null,
+    decryptedSecrets: [
+      { kind: "username", value: "user@example.com" },
+      { kind: "password", value: "password" },
+    ],
+  });
+
+describe("BeszelIntegration session lifecycle", () => {
+  const originalFetch = globalThis.fetch;
+  let authCount = 0;
+  let issuedToken = "";
+
+  beforeEach(() => {
+    store.clear();
+    authCount = 0;
+    globalThis.fetch = vi.fn((input: RequestInfo | URL) => {
+      const url = String(input);
+      if (url.endsWith("/api/collections/users/auth-with-password")) {
+        authCount++;
+        return Promise.resolve(Response.json({ token: issuedToken, record: { id: "user-1" } }));
+      }
+      if (url.includes("/api/collections/systems/records")) {
+        return Promise.resolve(Response.json({ page: 1, perPage: 500, totalItems: 0, totalPages: 0, items: [] }));
+      }
+      throw new Error(`Unexpected request: ${url}`);
+    }) as typeof fetch;
+  });
+
+  afterEach(() => {
+    globalThis.fetch = originalFetch;
+  });
+
+  test("reuses a stored session while its token is still valid", async () => {
+    issuedToken = createToken(Math.floor(Date.now() / 1000) + 7 * 24 * 60 * 60);
+    const integration = createIntegration();
+
+    await integration.getSystemsAsync();
+    await integration.getSystemsAsync();
+
+    expect(authCount).toBe(1);
+  });
+
+  test("persists the session with a ttl matching the token lifetime", async () => {
+    const lifetimeSeconds = 7 * 24 * 60 * 60;
+    issuedToken = createToken(Math.floor(Date.now() / 1000) + lifetimeSeconds);
+
+    await createIntegration().getSystemsAsync();
+
+    const stored = store.get("session-store:test-beszel-session");
+    expect(stored?.ttlSeconds).toBeGreaterThan(lifetimeSeconds - 60);
+    expect(stored?.ttlSeconds).toBeLessThanOrEqual(lifetimeSeconds);
+  });
+
+  test("re-authenticates once the stored token has expired", async () => {
+    // Beszel replies 200 + empty list to an expired token instead of 401, so without an expiry
+    // check the stale session would be reused forever. See homarr-labs/homarr#6470.
+    vi.useFakeTimers();
+
+    try {
+      const lifetimeSeconds = 7 * 24 * 60 * 60;
+      const issuedAt = new Date("2026-07-26T00:00:00.000Z");
+      vi.setSystemTime(issuedAt);
+      issuedToken = createToken(Math.floor(issuedAt.getTime() / 1000) + lifetimeSeconds);
+      const integration = createIntegration();
+
+      await integration.getSystemsAsync();
+      expect(authCount).toBe(1);
+
+      // Step past the token's lifetime, exactly as an idle Homarr instance would.
+      vi.setSystemTime(new Date(issuedAt.getTime() + (lifetimeSeconds + 1) * 1000));
+      issuedToken = createToken(Math.floor(Date.now() / 1000) + lifetimeSeconds);
+      await integration.getSystemsAsync();
+
+      expect(authCount).toBe(2);
+    } finally {
+      vi.useRealTimers();
+    }
+  });
+
+  test("uses a short-lived token that is valid now but lapses inside the leeway window", async () => {
+    // The leeway exists to stop a token expiring mid-request; it must not reject a token that is
+    // still valid, or an instance with a short authToken.duration could never authenticate.
+    issuedToken = createToken(Math.floor(Date.now() / 1000) + 30);
+
+    await expect(createIntegration().getSystemsAsync()).resolves.toEqual([]);
+    expect(authCount).toBe(1);
+    expect(store.get("session-store:test-beszel-session")?.ttlSeconds).toBeGreaterThan(0);
+  });
+
+  test("fails loudly when Beszel issues an already-expired token instead of returning empty data", async () => {
+    issuedToken = createToken(Math.floor(Date.now() / 1000) - 600);
+
+    const caught = await createIntegration()
+      .getSystemsAsync()
+      .then(
+        () => null,
+        (error: unknown) => error,
+      );
+
+    // The integration base class wraps thrown errors, so assert against the cause chain.
+    const messages: string[] = [];
+    for (let error: unknown = caught; error instanceof Error; error = error.cause) messages.push(error.message);
+    expect(messages.join(" | ")).toMatch(/clock skew/i);
+
+    // The dead token must not be persisted, or it would be served to the next caller.
+    expect(store.has("session-store:test-beszel-session")).toBe(false);
+    expect(authCount).toBe(1);
+  });
+
+  test("does not store a ttl when the token carries no readable expiry", async () => {
+    issuedToken = "opaque-token-without-claims";
+
+    await createIntegration().getSystemsAsync();
+
+    expect(store.get("session-store:test-beszel-session")?.ttlSeconds).toBeUndefined();
+  });
+});

packages/integrations/src/emby/emby-integration.ts

@@ -117,6 +117,12 @@ export class EmbyIntegration extends Integration implements IMediaServerIntegrat
             episodeName: sessionInfo.NowPlayingItem.EpisodeTitle,
             albumName: sessionInfo.NowPlayingItem.Album ?? "",
             episodeCount: sessionInfo.NowPlayingItem.EpisodeCount,
+            playback: {
+              state: null,
+              positionMs: null,
+              durationMs: null,
+            },
+            location: null,
             metadata: null,
           };
         }

packages/integrations/src/immich/immich-integration.ts

@@ -1,10 +1,14 @@
 import {
+  AssetMediaSize,
+  AssetTypeEnum,
+  AssetVisibility,
   getAlbumInfo,
   getAllAlbums,
   getMyUser,
   getServerStatistics,
   init,
   searchAssets,
+  searchRandom,
   searchUsers,
 } from "@immich/sdk";
 import type { AssetResponseDto, MetadataSearchDto } from "@immich/sdk";
@@ -42,6 +46,7 @@ export interface ImmichAsset {
 }
 
 const logger = createLogger({ module: "immich-integration" });
+const randomPhotoCount = 50;
 
 export class ImmichIntegration extends Integration {
   constructor(integration: IntegrationInput) {
@@ -62,36 +67,36 @@ export class ImmichIntegration extends Integration {
     };
   }
 
-  public async getAlbumAsync(albumId: string): Promise<ImmichAlbum> {
+  public async getAlbumAsync(albumId?: string): Promise<ImmichAlbum> {
     this.initClient();
     const requestOptions = this.getRequestOptions();
+
+    if (!albumId) {
+      const assets = await searchRandom(
+        {
+          randomSearchDto: {
+            size: randomPhotoCount,
+            type: AssetTypeEnum.Image,
+            visibility: AssetVisibility.Timeline,
+          },
+        },
+        requestOptions,
+      );
+
+      return {
+        id: "",
+        albumName: "",
+        assets: await this.createAssetsAsync(assets),
+      };
+    }
+
     const [album, albumAssets] = await Promise.all([
       getAlbumInfo({ id: albumId }, requestOptions),
       this.searchAlbumAssetsAsync(albumId),
     ]);
-    const imageProxy = new ImageProxy();
     return {
       albumName: album.albumName,
-      assets: await Promise.all(
-        albumAssets.map(async (asset) => {
-          const publicLink = await imageProxy.createImageAsync(
-            this.url(`/api/assets/${asset.id}/original`).toString(),
-            {
-              "x-api-key": this.getSecretValue("apiKey"),
-            },
-          );
-          return {
-            id: asset.id,
-            type: asset.type,
-            thumbhash: asset.thumbhash,
-            fileCreatedAt: asset.fileCreatedAt,
-            fileModifiedAt: asset.fileModifiedAt,
-            originalPath: asset.originalPath,
-            updatedAt: asset.updatedAt,
-            publicLink,
-          };
-        }),
-      ),
+      assets: await this.createAssetsAsync(albumAssets),
       id: album.id,
     };
   }
@@ -133,6 +138,32 @@ export class ImmichIntegration extends Integration {
     return assets;
   }
 
+  private async createAssetsAsync(assets: AssetResponseDto[]): Promise<ImmichAsset[]> {
+    const imageProxy = new ImageProxy();
+    return await Promise.all(
+      assets.map(async (asset) => {
+        const publicLink = await imageProxy.createImageAsync(
+          // This is the URL generated by the SDK's viewAsset call. Preview images are
+          // browser-compatible while avoiding the large original asset download.
+          this.url(`/api/assets/${asset.id}/thumbnail`, { size: AssetMediaSize.Preview }).toString(),
+          {
+            "x-api-key": this.getSecretValue("apiKey"),
+          },
+        );
+        return {
+          id: asset.id,
+          type: asset.type,
+          thumbhash: asset.thumbhash,
+          fileCreatedAt: asset.fileCreatedAt,
+          fileModifiedAt: asset.fileModifiedAt,
+          originalPath: asset.originalPath,
+          updatedAt: asset.updatedAt,
+          publicLink,
+        };
+      }),
+    );
+  }
+
   private getRequestOptions(fetchAsync = fetchWithTrustedCertificatesAsync) {
     return {
       // Undici and node types are not the same

packages/integrations/src/interfaces/media-server/media-server-types.ts

@@ -13,6 +13,12 @@ export interface StreamSession {
     episodeName?: string | null;
     albumName?: string | null;
     episodeCount?: number | null;
+    playback: {
+      state: "playing" | "paused" | "buffering" | null;
+      positionMs: number | null;
+      durationMs: number | null;
+    };
+    location: "lan" | "wan" | null;
     metadata: {
       video: {
         resolution: {

packages/integrations/src/jellyfin/jellyfin-integration.ts

@@ -17,6 +17,10 @@ import type { IMediaServerIntegration } from "../interfaces/media-server/media-s
 import type { CurrentSessionsInput, StreamSession } from "../interfaces/media-server/media-server-types";
 import type { IMediaReleasesIntegration, MediaRelease, MediaType } from "../types";
 
+function ticksToMs(ticks: number | null | undefined): number | null {
+  return ticks ? Math.round(ticks / 10_000) : null;
+}
+
 @HandleIntegrationErrors([integrationAxiosHttpErrorHandler])
 export class JellyfinIntegration extends Integration implements IMediaServerIntegration, IMediaReleasesIntegration {
   private readonly jellyfin: Jellyfin = new Jellyfin({
@@ -50,6 +54,9 @@ export class JellyfinIntegration extends Integration implements IMediaServerInte
         let currentlyPlaying: StreamSession["currentlyPlaying"] | null = null;
 
         if (sessionInfo.NowPlayingItem) {
+          const positionMs = ticksToMs(sessionInfo.PlayState?.PositionTicks);
+          const durationMs = ticksToMs(sessionInfo.NowPlayingItem.RunTimeTicks);
+
           currentlyPlaying = {
             type: convertJellyfinType(sessionInfo.NowPlayingItem.Type),
             name: sessionInfo.NowPlayingItem.SeriesName ?? sessionInfo.NowPlayingItem.Name ?? "",
@@ -57,6 +64,12 @@ export class JellyfinIntegration extends Integration implements IMediaServerInte
             episodeName: sessionInfo.NowPlayingItem.EpisodeTitle,
             albumName: sessionInfo.NowPlayingItem.Album ?? "",
             episodeCount: sessionInfo.NowPlayingItem.EpisodeCount,
+            playback: {
+              state: sessionInfo.PlayState?.IsPaused ? "paused" : "playing",
+              positionMs,
+              durationMs,
+            },
+            location: null,
             metadata: {
               video: {
                 resolution: