Thomas Camlong
e49e53a32f
Codex review: app-modify-all implies only app-create - app-use-all is implied by app-full-all alone. Putting use beneath modify in the ordered ladder therefore fabricated a grant: a legacy group holding just app-modify-all displayed as Modify, and touching the row or applying a preset silently granted use of every app. Ladders may now only contain keys that genuinely imply each other. Everything else is a capability with its own checkbox, so the app row is No access | Modify | Full plus "Use all apps" and "Create apps". A test asserts every ladder is a real chain, so this class of mismatch fails CI rather than shipping. Also documents in the API docs why app list endpoints can now return FORBIDDEN and why integration lists may return fewer records, as AGENTS.md requires.
Homarr web application
This workspace contains Homarr's Next.js application. It consumes the shared API, authentication, database, board, widget, translation, and UI packages from this monorepo.
Run commands from the repository root:
pnpm install --frozen-lockfile
cp .env.example .env
Keep infrastructure running in the first terminal:
pnpm docker:dev
Apply migrations and start the application in a second terminal:
pnpm db:migration:sqlite:run
pnpm dev
The app listens on http://127.0.0.1:3000. Configure an absolute writable DB_URL, AUTH_SECRET, and
SECRET_ENCRYPTION_KEY in .env before first startup.
To test Custom Widgets against a local Community Workshop, start PocketBase and the docs in separate terminals:
pnpm docker:workshop
WORKSHOP_API_URL=http://127.0.0.1:8090 pnpm dev:docs
Then set:
HOMARR_WEBSITE_URL=http://127.0.0.1:3003
WORKSHOP_API_URL=http://127.0.0.1:8090
WORKSHOP_WEB_URL=http://127.0.0.1:3003/workshop
Server-rendered runtime configuration exposes those URLs to the browser, so changing a production container's environment does not require rebuilding the Next.js bundle.
See apps/docs/docs/advanced/development/getting-started.mdx
for the full contributor setup.