ework-web 0.10.37 → 0.10.38

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "ework-web",
-  "version": "0.10.37",
+  "version": "0.10.38",
   "type": "module",
   "description": "ework-web — standalone multi-project issue tracker. Local SQLite-backed, no external API dependency. Bun + TypeScript + SSR HTML.",
   "license": "MIT",

package/src/config.ts

@@ -64,8 +64,8 @@ export const configSchema = z.object({
   collapseLines: z.coerce.number().int().positive().default(16),
   fileRoots: z
     .string()
-    .transform((s) => s.split(",").map((x) => x.trim()).filter(Boolean))
-    .default("/tmp"),
+    .default("/tmp")
+    .transform((s) => s.split(",").map((x) => x.trim()).filter(Boolean)),
   fileMaxLines: z.coerce.number().int().positive().default(2000),
   fileMaxBytes: z.coerce.number().int().positive().default(512 * 1024),
   translateUrl: z.string().default(""),

package/src/remote-file.ts

@@ -50,7 +50,8 @@ async function fetchDaemon(
   apiPath: string,
   params: Record<string, string>
 ): Promise<Response> {
-  const url = new URL(`${endpoint}${apiPath}`);
+  const base = /^https?:\/\//.test(endpoint) ? endpoint : `http://${endpoint}`;
+  const url = new URL(`${base}${apiPath}`);
   for (const [k, v] of Object.entries(params)) url.searchParams.set(k, v);
   const resp = await fetch(url.toString(), { signal: AbortSignal.timeout(10_000) });
   return resp;

package/src/store.ts

@@ -5,6 +5,22 @@
 import { getDB } from "./db";
 import { createHash } from "node:crypto";
 
+let _visibilityChecked = false;
+let _hasVisibilityColumn = true;
+
+async function visibilitySupported(): Promise<boolean> {
+  if (_visibilityChecked) return _hasVisibilityColumn;
+  _visibilityChecked = true;
+  try {
+    await getDB().get("SELECT visibility FROM {{projects}} LIMIT 0");
+    _hasVisibilityColumn = true;
+  } catch {
+    _hasVisibilityColumn = false;
+    console.warn("[store] projects.visibility column missing — treating all projects as public");
+  }
+  return _hasVisibilityColumn;
+}
+
 export type UserKind = "human" | "bot" | "system";
 
 export interface UserRow {
@@ -181,12 +197,15 @@ export async function listProjectsWithCounts(
 ): Promise<ProjectWithCounts[]> {
   const isAdmin = viewer?.is_admin === 1;
   const login = viewer?.login;
-  const visibilityFilter = isAdmin
+  const hasVis = isAdmin ? true : await visibilitySupported();
+  const visibilityFilter = !hasVis
     ? ""
-    : login
-      ? ` AND (p.visibility != 'private' OR EXISTS (SELECT 1 FROM {{project_members}} pm WHERE pm.project_id = p.id AND pm.user_login = ?))`
-      : ` AND p.visibility != 'private'`;
-  const args = !isAdmin && login ? [login] : [];
+    : isAdmin
+      ? ""
+      : login
+        ? ` AND (p.visibility != 'private' OR EXISTS (SELECT 1 FROM {{project_members}} pm WHERE pm.project_id = p.id AND pm.user_login = ?))`
+        : ` AND p.visibility != 'private'`;
+  const args = hasVis && !isAdmin && login ? [login] : [];
   return await getDB().all<ProjectWithCounts>(
     `SELECT p.*,
        COALESCE(SUM(CASE WHEN i.state = 'open' THEN 1 ELSE 0 END), 0) AS open_count,
@@ -404,7 +423,7 @@ export async function listAllIssues(opts: ListIssuesOpts = {}): Promise<IssueWit
     sql += " AND EXISTS (SELECT 1 FROM {{issue_labels}} il JOIN {{labels}} l ON l.id = il.label_id WHERE il.issue_id = i.id AND l.name = ?)";
     args.push(label);
   }
-  if (!opts.viewerIsAdmin) {
+  if (!opts.viewerIsAdmin && await visibilitySupported()) {
     sql += " AND (p.visibility != 'private'";
     if (opts.viewerLogin) {
       sql += " OR EXISTS (SELECT 1 FROM {{project_members}} pm WHERE pm.project_id = p.id AND pm.user_login = ?)";