Public Access

0 Fork 0

Files

T

Thomas Camlong 6728d0a63d fix(permissions): keep create permissions grantable and stop silent escalation

The matrix could not represent board-create, app-create, integration-create,
search-engine-create or media-upload, and savePermissions force-bundled every
create key with its modify/full parent. Together that meant a group with
board-create was silently upgraded to board-full-all on the next save, and the
common "members may create their own boards" setup became unreachable.

- permissionMatrix models create/upload as an orthogonal capability next to the
  ordered access levels, so all 20 permission keys round-trip losslessly
- savePermissions stores exactly what was selected
- the matrix UI gets a per-category create checkbox, auto-checked and disabled
  when the chosen level already implies it
- a management section is reachable when the user can do at least one thing in
  it; nav, pages and stat cards now share one access helper

2026-08-18 15:40:28 +02:00

public

feat: consolidate onboarding

2026-08-14 11:32:12 +02:00

src

fix(permissions): keep create permissions grantable and stop silent escalation

2026-08-18 15:40:28 +02:00

next.config.ts

fix: refine dashboard interactions and widget options (#6597 )

2026-08-15 10:44:37 +02:00

package.json

feat: port release-v2 experience improvements from #6582 (audited subset) (#6609 )

2026-08-18 09:40:02 +02:00

postcss.config.cjs

feat: add credentials authentication (#1 )

2023-12-10 17:12:20 +01:00

README.md

fix: harden v2 custom widgets and Workshop (#6480 )

2026-08-13 19:50:46 +02:00

tsconfig.json

fix(manage/about): bypass self-fetch + add manage error boundary (LLM exploration) (#6009 )

2026-06-26 20:12:39 +02:00

README.md

Homarr web application

This workspace contains Homarr's Next.js application. It consumes the shared API, authentication, database, board, widget, translation, and UI packages from this monorepo.

Run commands from the repository root:

pnpm install --frozen-lockfile
cp .env.example .env

Keep infrastructure running in the first terminal:

pnpm docker:dev

Apply migrations and start the application in a second terminal:

pnpm db:migration:sqlite:run
pnpm dev

The app listens on http://127.0.0.1:3000. Configure an absolute writable DB_URL, AUTH_SECRET, and SECRET_ENCRYPTION_KEY in .env before first startup.

To test Custom Widgets against a local Community Workshop, start PocketBase and the docs in separate terminals:

pnpm docker:workshop
WORKSHOP_API_URL=http://127.0.0.1:8090 pnpm dev:docs

Then set:

HOMARR_WEBSITE_URL=http://127.0.0.1:3003
WORKSHOP_API_URL=http://127.0.0.1:8090
WORKSHOP_WEB_URL=http://127.0.0.1:3003/workshop

Server-rendered runtime configuration exposes those URLs to the browser, so changing a production container's environment does not require rebuilding the Next.js bundle.

See apps/docs/docs/advanced/development/getting-started.mdx for the full contributor setup.