3 Commits

Include renames

Author	SHA1	Message	Date
Melvin StroblandClaude Fable 5	8d82d6c4ec	Let agents drive the flow API over MCP ... The engine now speaks MCP at /mcp, with a built-in OAuth 2.1 authorization server in front of it: an agent registers itself, sends a human to the browser to approve it, and exchanges the resulting code for a token. PKCE is required, codes are single-use and stored only as hashes, the browser is redirected to the URI that was registered rather than the one asked for, and refresh tokens rotate so that replaying a spent one revokes the whole line. Twenty tools cover reading, building, publishing and running flows, and each one calls the same REST endpoint the dashboard calls, in-process, carrying the caller's own token. That keeps one description of what a flow is and what may be done to it — validation, the draft/publish split, the version check — and means an agent can do nothing a person could not do in the browser. Agent tokens are RS256 with a keypair of their own rather than the secret that signs browser sessions, so deleting the key withdraws every agent without logging anyone out, and deps.decode_token grew the branch that trusting a second issuer will need when the hosted login arrives. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>	2026-08-16 00:22:41 +02:00
Melvin StroblandClaude Opus 5	82356810ce	Give the tests their own database and drop the template specs ... pytest was deleting every user on teardown against the development database. The engine is built at import time, so tests/__init__.py pins POSTGRES_DB before app.core.config loads; the fixture creates the schema and drops the database again, guarded against a name that is not _test. Playwright now defaults at the integrated stack, which is the origin the API allows, so a bare `bunx playwright test` works without a dev server. The four template specs that asserted copy we no longer ship are gone, along with the helpers they were the last callers of. The admin edit assertion was page-wide and only ever passed on a fresh database. Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01KkmeRiyeYmVZqJVwuyHq9o	2026-08-15 21:19:12 +02:00
Melvin StroblandClaude Opus 5	1916f7f778	Vendor backend and frontend into the monorepo ... The submodule collapse was only half applied: .gitmodules was deleted but backend/ and frontend/ were still recorded as gitlinks, so none of their files were tracked. Replace the gitlinks with the real trees. Also untrack .env (it carried placeholder secrets) in favour of a tracked .env.example, drop the committed __pycache__, and narrow the blanket *.png ignore that would have swallowed design assets. Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>	2026-08-09 15:14:54 +02:00