checkflow/.cline-context.md

Project Current Status & Rules

• Objective: Maintain, review, and enhance the CheckFlow self-hosted TickTick-style task management web application according to specifications in AGENTS.md, ensuring full feature integrity, security compliance, clean code quality, and responsive UX across all devices.

• Core Architecture & Source Structure:

  • src/app/: Next.js App Router root layouts, providers, auth/demo/admin views, and REST/CalDAV API endpoints (/api/tasks, /api/lists, /api/import, /api/dav/[...path]).
  • src/components/layout/: AppShell.tsx (3-panel main layout, resizer coordination, mobile drawer overlay), Sidebar.tsx (draggable resizer, lists tree, tag & trash navigation, profile & import popover).
  • src/components/tasks/:
    • TaskList.tsx: Recursive n-depth hierarchical checklist, inline title editing, context menu, smart quick-add toolbar.
    • TaskDetail.tsx: Right-side detail panel, modular block swap (Subtasks ⇄ Markdown Note), mouse drag split resizer, mobile bottom-sheet with swipe-down dismissal.
    • MarkdownNoteEditor.tsx: Distraction-free text/markdown note canvas with DOMPurify sanitization & preview rendering.
    • KanbanView.tsx: CheckFlow Labs 3-column Kanban board view (To Do / In Progress / Done).
  • src/components/settings/: SettingsModal.tsx (Profile, Preferences, Labs, Integrations/DAVx⁵, Admin tabs).
  • src/lib/: userPrefs.ts (global user customization state store), useUserPrefs.ts (reactive preferences hook & CSS variable injector), i18n/ (EN/KO/JA localization dictionary), mockData.ts (LocalStorage demo store), auth.ts, prisma.ts.
  • src/middleware.ts: Route-level auth and admin role verification guard.

• Completed So Far:

  • Rewrote entire Git commit history with active local Git identity across all branches and tags, and force-pushed to self-hosted Gitea remote origin.
  • Conducted full audit of codebase against all specification items in AGENTS.md.
  • Verified 100% implementation of core features: n-depth recursive checklist, real-time subtask synchronization, modular blocks & split resizer, 3-way theme (VSCode dark / pastel light / system), global UserPrefs customization, Labs Kanban view, and mobile bottom sheet.
  • Enhanced CalDAV / DAVx⁵ synchronization endpoint (src/app/api/dav/[...path]/route.ts) with full RFC 4791 support: OPTIONS, PROPFIND (principal & calendar collection discovery), REPORT (calendar-query/multiget), PUT (task upsert from VTODO), and DELETE.
  • Upgraded Settings Modal "Integrations (CalDAV)" tab with multi-platform interactive guides (Android/DAVx⁵, Apple Reminders, Thunderbird), one-click URL copy feedback, ICS feed direct download, and live endpoint test ping.
  • Standardized all synchronization terminology from brand-specific references to open standards and Android/Apple cross-platform guidelines.
  • Implemented full-fidelity standard Task Export pair (/api/export) supporting RFC 4180 / TickTick-compatible CSV with UTF-8 BOM, and RFC 5545 iCalendar (.ics VTODO) format.
  • Added Export modal in Sidebar user popover menu supporting format selection, target list filtering, completed tasks inclusion toggle, and seamless Demo mode client-side Blob generation.
  • Added localized i18n strings for Export across English, Korean, and Japanese.
  • Configured production multi-stage Dockerfile with standalone Next.js runner, Prisma CLI migrations support, and automated docker-entrypoint.sh startup script.
  • Added .dockerignore for minimal context transfer and fast build times.
  • Refined docker-compose.yml and .env.example to support standalone 2-file deployment (docker-compose.yml + .env) without cloning source code, prebuilt registry images (CHECKFLOW_IMAGE), Watchtower auto-updating labels, and automated database migrations.
  • Automated Gitea Actions CI workflow (.gitea/workflows/docker-build.yaml) for building & pushing container images to Gitea Container Registry with lowercase repository name normalization (env.REPO) and OCI source labels (org.opencontainers.image.source) for automatic repository package linkage.
  • Completely revamped README.md to reflect standalone 2-file Docker deployment (with curl/wget commands), Watchtower auto-update, architecture, and open-standard CalDAV sync guidelines.
  • Validated that npm run lint and npm run build execute with 0 errors and 0 warnings.

• Next Steps (Todo):

  • Enhance keyboard accessibility & global shortcuts (shortcuts for switching list/kanban view, quick task navigation, Command Palette bindings).
  • Add optional automatic synchronization background polling / webhook integration if requested.
  • Plan next feature iterations or custom integrations as requested by user.

• Caveats & Absolute Rules:

  • Security & Multi-user Privacy: All API endpoints must strictly verify session ownership (userId === session.user.id) and list ownership before creating/updating/deleting tasks or lists.
  • Sanitization: Never render raw HTML without DOMPurify; always sanitize CSV/ICS user inputs against formula injection (sanitizeFormula).
  • Admin Gatekeeping: Admin routes must strictly require role === "ADMIN" both on server/middleware and client.
  • User Customization Priority: Any new UI preferences (sizes, positions, order) must be persisted through userPrefs.ts and respect the "Reset to Defaults" Labs option.
  • i18n Consistency: Any newly added UI string must be translated across all 3 language dictionaries (en, ko, ja) in src/lib/i18n/translations.ts and src/lib/i18n/index.tsx.
  • Mobile Bottom-Sheet Convention: Maintain touch gestures (mobile-open class, Y-axis swipe threshold > 120px) for the detail panel on mobile screens.