pygitweb 0.2.1__tar.gz → 0.2.2__tar.gz

{pygitweb-0.2.1/pygitweb.egg-info → pygitweb-0.2.2}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: pygitweb
-Version: 0.2.1
+Version: 0.2.2
 Summary: Gitweb reimplementation with FastAPI and Pygit2
 License-Expression: MIT
 Requires-Python: >=3.11

{pygitweb-0.2.1 → pygitweb-0.2.2}/actions.py

@@ -20,6 +20,7 @@ from fastapi.responses import HTMLResponse, JSONResponse, PlainTextResponse, Res
 from python_ripgrep import PySortMode, PySortModeKind
 from python_ripgrep import search as rg_search
 
+from pygitweb.auth import can_read_branch
 from pygitweb.config import BLOB_LANG, settings
 from pygitweb.formatting import age_string, sanitize, to_utf8
 from pygitweb.git_helpers import (
@@ -972,13 +973,17 @@ def git_history(
 	)
 
 
-def git_heads(project: str) -> HTMLResponse:
+def git_heads(project: str, token: str | None) -> HTMLResponse:
 	"""Heads (branches) list page. Port of git_heads."""
 	heads_list = git_get_heads_list(project)
-	if not heads_list:
+	if settings.AUTH:
+		visible_heads = [(name, ref, oid) for name, ref, oid in heads_list if can_read_branch(project, ref, token)]
+	else:
+		visible_heads = heads_list
+	if not visible_heads:
 		raise HTTPException(status_code=404, detail="No heads found")
 	rows = []
-	for name, _ref, oid in heads_list:
+	for name, _ref, oid in visible_heads:
 		oid_short = oid[:7] if oid else ""
 		commit_link = f"/project/{project}?a=commit&h={quote(oid, safe='')}"
 		tree_link = f"/project/{project}?a=tree&h={quote(oid, safe='')}"

{pygitweb-0.2.1 → pygitweb-0.2.2}/auth.py

@@ -32,7 +32,7 @@ from pygitweb.auth_oauth import OAUTH_STATE_COOKIE_NAME, oauth_router
 from pygitweb.config import settings
 from pygitweb.gravatar import gravatar_url
 from pygitweb.password_hash import verify_password
-from pygitweb.permissions import Permission, PermissionPrincipal
+from pygitweb.permissions import Permission, PermissionPrincipal, has_branch_read_permission
 from pygitweb.projects import git_get_project_owner
 from pygitweb.sessions import create_session, get_session, revoke_session
 from pygitweb.templates_env import POSTAMBLE, PREAMBLE, env
@@ -65,6 +65,23 @@ def principal_from_session(token: str | None) -> PermissionPrincipal | None:
 	return PermissionPrincipal(username=rec.username, email=rec.email)
 
 
+def _anonymous_principal_for_permissions() -> PermissionPrincipal | None:
+	for entry in auth_config.local_users:
+		if getattr(entry, "assume_anonymous", False):
+			return PermissionPrincipal(username=entry.user, email=entry.email)
+	return None
+
+
+def _principal_identity_for_permissions(token: str | None) -> str | None:
+	principal = principal_from_session(token)
+	if principal is not None:
+		return principal.identity
+	anonymous = _anonymous_principal_for_permissions()
+	if anonymous is not None:
+		return anonymous.identity
+	return None
+
+
 def has_permission(
 	permission: Permission,
 	project: str | None = None,
@@ -73,10 +90,10 @@ def has_permission(
 ) -> bool:
 	if not settings.AUTH:
 		return True
-	principal = principal_from_session(token)
-	if principal is None:
+	identity = _principal_identity_for_permissions(token)
+	if identity is None:
 		return False
-	return auth_config.oauth_permissions.has_permission(principal.identity, permission, project)
+	return auth_config.oauth_permissions.has_permission(identity, permission, project)
 
 
 def _owner_matches(project: str, token: str | None) -> bool:
@@ -111,6 +128,17 @@ def can_write_project(project: str, token: str | None) -> bool:
 	return has_permission(Permission.WRITE, project, token=token)
 
 
+def can_read_branch(project: str, ref_name: str, token: str | None) -> bool:
+	if not settings.AUTH:
+		return True
+	if _owner_matches(project, token):
+		return True
+	identity = _principal_identity_for_permissions(token)
+	if identity is None:
+		return False
+	return has_branch_read_permission(auth_config.oauth_permissions, identity, project, ref_name)
+
+
 def ensure_read_project(project: str, token: str | None) -> None:
 	if can_read_project(project, token):
 		return

{pygitweb-0.2.1 → pygitweb-0.2.2}/auth.schema.json

@@ -60,7 +60,7 @@
         "additionalProperties": {
           "type": "array",
           "items": { "type": "string" },
-          "description": "Scoped keys: pgw.read.{scope}, pgw.write.{scope}, pgw.boards.{scope}, pgw.tasks.{scope}, pgw.comments.{scope}, pgw.hooks.{scope}, pgw.mr.create.{scope}, pgw.mr.merge.{scope} (fnmatch on project path). Principal * matches any authenticated user."
+          "description": "Scoped keys: pgw.read.{scope}, pgw.write.{scope}, pgw.read_branch.{scope}, pgw.write_branch.{scope}, pgw.boards.{scope}, pgw.tasks.{scope}, pgw.comments.{scope}, pgw.hooks.{scope}, pgw.mr.create.{scope}, pgw.mr.merge.{scope} (fnmatch on project or project/branch path). Principal * matches any authenticated user."
         }
       },
       "local_users": {
@@ -94,6 +94,10 @@
               "type": "string",
               "format": "email",
               "description": "Optional e-mail for Gravatar and permission grants by principal e-mail."
+            },
+            "assume_anonymous": {
+              "type": "boolean",
+              "description": "If true, unauthenticated requests assume this user for read permissions (e.g. public viewer role)."
             }
           }
         }

{pygitweb-0.2.1 → pygitweb-0.2.2}/auth_config.py

@@ -12,14 +12,16 @@ import secrets
 import stat
 import sys
 from pathlib import Path
-from typing import Literal
+from typing import TYPE_CHECKING, Literal
 
 from pydantic import BaseModel, ConfigDict, Field, field_serializer, field_validator
 
-from pygitweb.config import Settings
 from pygitweb.password_hash import hash_password
 from pygitweb.permissions import PermissionsMap
 
+if TYPE_CHECKING:
+	from pygitweb.config import Settings
+
 DEFAULT_AUTH_CONFIG_PATH = Path.home() / ".pygitweb" / "auth.json"
 _AUTH_CONFIG_MODE = 0o600
 
@@ -70,6 +72,7 @@ class LocalUser(BaseModel):
 	password: str | None = Field(default=None, alias="pass", serialization_alias="pass")
 	pass_hash: str = ""
 	email: str | None = None
+	assume_anonymous: bool = False
 
 	@field_validator("email", mode="before")
 	@classmethod
@@ -91,7 +94,7 @@ class AuthConfig(BaseModel):
 	oauth_client_id: str = ""
 	oauth_client_secret: str = ""
 	oauth_redirect_uri: str = ""
-	oauth_username_from: OAuthUsernameFrom = "email"
+	oauth_username_from: OAuthUsernameFrom = "preffered_username"
 	oauth_allowed_emails: list[str] = Field(default_factory=list)
 	oauth_permissions: PermissionsMap = Field(default_factory=PermissionsMap.empty)
 	local_users: list[LocalUser] = Field(default_factory=list)
@@ -132,7 +135,7 @@ def default_auth_config(*, admin_password: str, salt: str) -> AuthConfig:
 		oauth_client_id="",
 		oauth_client_secret="",
 		oauth_redirect_uri="",
-		oauth_username_from="email",
+		oauth_username_from="preffered_username",
 		oauth_allowed_emails=[],
 		oauth_permissions=PermissionsMap.default_access(),
 		local_users=[LocalUser(user="admin", pass_hash=hash_password(admin_password, config_salt=salt))],

{pygitweb-0.2.1 → pygitweb-0.2.2}/auth_oauth.py

@@ -323,10 +323,9 @@ async def oauth_callback(
 	if not is_oauth_email_allowed(auth_config, email):
 		raise HTTPException(status_code=status.HTTP_403_FORBIDDEN, detail="Email is not allowed to sign in")
 	username = oauth_username_from_profile(auth_config, profile)
-	subject = _profile_subject(profile)
 	sid = create_session(
 		username,
-		subject=subject,
+		subject=username,
 		email=email,
 		auth_method="oauth",
 	)

{pygitweb-0.2.1 → pygitweb-0.2.2}/auth_test.py

@@ -5,10 +5,13 @@ import sys
 from collections.abc import Generator
 from pathlib import Path
 from unittest.mock import AsyncMock, patch
+from urllib.parse import parse_qs, urlparse
 
+import httpx
 import pytest
-from fastapi import HTTPException
+from fastapi import FastAPI, HTTPException, Request
 from fastapi.testclient import TestClient
+from httpx import ASGITransport
 
 from pygitweb.auth import ACCESS_TOKEN_COOKIE_NAME
 from pygitweb.auth_config import AuthConfig, LocalUser, init_auth_config, write_auth_config
@@ -29,6 +32,8 @@ from pygitweb.password_hash import hash_password, verify_password
 from pygitweb.permissions import PERMISSION_ADD_PROJECTS, PermissionsMap
 from pygitweb.sessions import get_session
 
+_REAL_ASYNC_CLIENT = httpx.AsyncClient
+
 
 class _DummyResponse:
 	def __init__(self, payload: object, is_success: bool = True) -> None:
@@ -48,6 +53,47 @@ _LOCAL_ADMIN = AuthConfig(
 )
 
 
+def _build_test_idp_app(
+	email: str = "user@example.com",
+	preferred_username: str = "oauthuser",
+) -> FastAPI:
+	idp = FastAPI()
+
+	@idp.post("/token")
+	async def google_token(request: Request) -> dict[str, str]:
+		form = await request.form()
+		grant_type = str(form.get("grant_type") or "")
+		code = str(form.get("code") or "")
+		if grant_type != "authorization_code" or code != "auth-code":
+			return {"error": "invalid_grant"}
+		return {"access_token": "idp-access-token"}
+
+	@idp.post("/login/oauth/access_token")
+	async def github_token(request: Request) -> dict[str, str]:
+		form = await request.form()
+		code = str(form.get("code") or "")
+		if code != "auth-code":
+			return {"error": "bad_code"}
+		return {"access_token": "idp-access-token"}
+
+	@idp.get("/v1/userinfo")
+	async def google_userinfo() -> dict[str, str]:
+		return {"sub": "oauth-sub-1", "email": email, "preferred_username": preferred_username}
+
+	@idp.get("/user")
+	async def github_user() -> dict[str, object]:
+		return {"id": "123", "login": preferred_username, "email": None}
+
+	@idp.get("/user/emails")
+	async def github_emails() -> list[dict[str, object]]:
+		return [
+			{"email": email, "primary": True, "verified": True},
+			{"email": "other@example.com", "primary": False, "verified": True},
+		]
+
+	return idp
+
+
 @pytest.fixture
 def client() -> Generator[TestClient, None, None]:
 	with TestClient(app) as c:
@@ -294,6 +340,32 @@ def test_oauth_allowed_emails_exact_match() -> None:
 	assert not is_oauth_email_allowed(cfg, "other@example.com")
 
 
+def test_anonymous_user_assumes_local_public_role_for_read_permissions() -> None:
+	from pygitweb.auth import can_read_project
+
+	cfg = AuthConfig(
+		auth_mode="local",
+		local_users=[
+			LocalUser(
+				user="public",
+				password="secret",
+				email="public@example.com",
+				assume_anonymous=True,
+			),
+		],
+		oauth_permissions=PermissionsMap.model_validate({
+			"*": [],
+			"pgw.read.secret": ["public@example.com"],
+		}),
+	)
+	with (
+		patch.object(settings, "AUTH", True),
+		patch("pygitweb.auth.auth_config", cfg),
+	):
+		assert can_read_project("secret", None)
+		assert not can_read_project("other", None)
+
+
 _OAUTH_CFG = AuthConfig(
 	auth_mode="oauth",
 	oauth_provider="google",
@@ -345,15 +417,50 @@ def test_oauth_callback_creates_session(client: TestClient, oauth_auth_config: A
 		assert r.status_code == 303
 		rec = get_session(r.cookies["pygitweb_access_token"])
 		assert rec is not None
-		assert rec.username == "user@example.com"
-		assert rec.subject == "oauth-sub-1"
+		assert rec.username == "oauthuser"
+		assert rec.subject == "oauthuser"
 		assert rec.email == "user@example.com"
 		assert rec.auth_method == "oauth"
-		assert client.get("/users/me").json()["username"] == "user@example.com"
+		assert client.get("/users/me").json()["username"] == "oauthuser"
 		status = client.get("/auth/status").json()
-		assert status["username"] == "user@example.com"
+		assert status["username"] == "oauthuser"
 		assert status["gravatar_url"] == gravatar_url("user@example.com")
-	clear_client_cookies(client)
+		clear_client_cookies(client)
+
+
+def test_oauth_flow_with_asgi_idp(client: TestClient, oauth_auth_config: AuthConfig) -> None:
+	idp_app = _build_test_idp_app()
+
+	async def runner() -> None:
+		transport = ASGITransport(app=idp_app)
+
+		def _idp_client_factory(*_: object, **__: object) -> httpx.AsyncClient:
+			return _REAL_ASYNC_CLIENT(transport=transport, base_url="https://idp.test")
+
+		with (
+			patch.object(settings, "AUTH", True),
+			patch("pygitweb.auth_oauth.httpx.AsyncClient", side_effect=_idp_client_factory),
+		):
+			start = client.get("/auth/oauth/start", params={"next": "/boards"}, follow_redirects=False)
+			assert start.status_code == 303
+			location = start.headers["location"]
+			state_values = parse_qs(urlparse(location).query).get("state", [])
+			assert state_values
+			state = state_values[0]
+			callback = client.get(
+				"/auth/oauth/callback",
+				params={"code": "auth-code", "state": state},
+				follow_redirects=False,
+			)
+			assert callback.status_code == 303
+			rec = get_session(callback.cookies[ACCESS_TOKEN_COOKIE_NAME])
+			assert rec is not None
+			assert rec.username == "oauthuser"
+			assert rec.subject == "oauthuser"
+			assert rec.email == "user@example.com"
+			assert rec.auth_method == "oauth"
+
+	asyncio.run(runner())
 
 
 def test_auth_status_no_gravatar_for_local_login(client: TestClient, local_auth_config: AuthConfig) -> None:

{pygitweb-0.2.1 → pygitweb-0.2.2}/hooks_install.py

@@ -34,6 +34,7 @@ _SAMPLE_LABELS: dict[str, str] = {
 	"pre-commit.ruff": "Ruff Pre-commit",
 	"commit-msg.pattern": "Commit Message Pattern",
 	"pre-receive.protected-pattern": "Protected Branch Commit Messages",
+	"pre-receive.branch-permissions": "Branch Write Permissions",
 	"post-commit.push-remotes": "Post-commit Push Remotes",
 }
 

{pygitweb-0.2.1 → pygitweb-0.2.2}/main.py

@@ -751,6 +751,7 @@ async def internal_notify(
 async def dispatch(
 	request: Request,
 	project: ValidatedReadableProject,
+	token: Annotated[str | None, Depends(access_token_from_request)],
 	a: Annotated[str | None, Query(alias="a")] = None,
 	h: Annotated[str | None, Query(alias="h")] = None,
 	hb: Annotated[str | None, Query(alias="hb")] = None,
@@ -845,7 +846,7 @@ async def dispatch(
 		p, pc = parse_pagination(page, pagecount)
 		return git_history(project, hash_param, file_name, request, p, pc)
 	if action == "heads":
-		return git_heads(project)
+		return git_heads(project, token)
 	if action == "tags":
 		p, pc = parse_pagination(page, pagecount)
 		return git_tags(project, request, p, pc)

{pygitweb-0.2.1 → pygitweb-0.2.2}/permissions.py

@@ -27,7 +27,11 @@ WILDCARD_PRINCIPAL = "*"
 PERMISSION_ADD_PROJECTS = "pgw.addprojects"
 PERMISSION_SETTINGS = "pgw.settings"
 
-_SCOPED_PREFIX = re.compile(r"^pgw\.(boards|tasks|comments|hooks|mr\.create|mr\.merge|read|write)\.(.+)$")
+_SCOPED_PREFIX = re.compile(
+	r"^pgw\.(boards|tasks|comments|hooks|mr\.create|mr\.merge|read|write|read_branch|write_branch)\.(.+)$",
+)
+
+_BRANCH_REF_PREFIX = "refs/heads/"
 
 
 class Permission(StrEnum):
@@ -35,6 +39,8 @@ class Permission(StrEnum):
 
 	READ = "read"
 	WRITE = "write"
+	READ_BRANCH = "read_branch"
+	WRITE_BRANCH = "write_branch"
 	BOARDS = "boards"
 	TASKS = "tasks"
 	COMMENTS = "comments"
@@ -57,6 +63,8 @@ class Permission(StrEnum):
 		if self in (
 			Permission.READ,
 			Permission.WRITE,
+			Permission.READ_BRANCH,
+			Permission.WRITE_BRANCH,
 			Permission.BOARDS,
 			Permission.TASKS,
 			Permission.COMMENTS,
@@ -116,6 +124,49 @@ def project_matches_scope(project: str, scope: str) -> bool:
 	return fnmatch.fnmatchcase(project, scope)
 
 
+def short_branch_name_from_ref(ref_name: str) -> str | None:
+	if not ref_name.startswith(_BRANCH_REF_PREFIX):
+		return None
+	return ref_name.removeprefix(_BRANCH_REF_PREFIX)
+
+
+def branch_permission_subject(project: str, ref_name: str) -> str | None:
+	short_name = short_branch_name_from_ref(ref_name)
+	if short_name is None:
+		return None
+	return f"{project}/{short_name}"
+
+
+def has_branch_read_permission(
+	permissions: PermissionsMap,
+	principal: str | None,
+	project: str,
+	ref_name: str,
+) -> bool:
+	subject = branch_permission_subject(project, ref_name)
+	if subject is None:
+		return True
+	branch_specific = permissions.matching_scoped_principals(Permission.READ_BRANCH, subject)
+	if branch_specific:
+		return permissions.has_permission(principal, Permission.READ_BRANCH, subject)
+	return permissions.has_permission(principal, Permission.READ, project)
+
+
+def has_branch_write_permission(
+	permissions: PermissionsMap,
+	principal: str | None,
+	project: str,
+	ref_name: str,
+) -> bool:
+	subject = branch_permission_subject(project, ref_name)
+	if subject is None:
+		return True
+	branch_specific = permissions.matching_scoped_principals(Permission.WRITE_BRANCH, subject)
+	if branch_specific:
+		return permissions.has_permission(principal, Permission.WRITE_BRANCH, subject)
+	return permissions.has_permission(principal, Permission.WRITE, project)
+
+
 class PermissionsMap(RootModel[dict[str, list[str]]]):
 	"""Validated ``oauth_permissions`` object from auth.json."""
 

{pygitweb-0.2.1 → pygitweb-0.2.2}/permissions_test.py

@@ -5,9 +5,13 @@ from pygitweb.permissions import (
 	PERMISSION_SETTINGS,
 	Permission,
 	PermissionsMap,
+	branch_permission_subject,
+	has_branch_read_permission,
+	has_branch_write_permission,
 	parse_permission_key,
 	permission_key,
 	project_matches_scope,
+	short_branch_name_from_ref,
 )
 
 
@@ -54,12 +58,31 @@ def test_parse_mr_scoped_keys() -> None:
 	assert merge.permission is Permission.MR_MERGE
 
 
+def test_parse_branch_scoped_keys() -> None:
+	read = parse_permission_key("pgw.read_branch.team/app-main")
+	assert read is not None
+	assert read.permission is Permission.READ_BRANCH
+	assert read.project_scope == "team/app-main"
+	write = parse_permission_key("pgw.write_branch.dev/alice.*")
+	assert write is not None
+	assert write.permission is Permission.WRITE_BRANCH
+	assert write.project_scope == "dev/alice.*"
+
+
 def test_project_glob() -> None:
 	assert project_matches_scope("team/app", "team/*")
 	assert not project_matches_scope("other/app", "team/*")
 	assert project_matches_scope("anything", "*")
 
 
+def test_branch_permission_subject() -> None:
+	assert short_branch_name_from_ref("refs/heads/main") == "main"
+	assert short_branch_name_from_ref("refs/heads/dev/alice.feature") == "dev/alice.feature"
+	assert short_branch_name_from_ref("refs/tags/v1.0.0") is None
+	assert branch_permission_subject("demo", "refs/heads/main") == "demo/main"
+	assert branch_permission_subject("demo", "refs/tags/v1.0.0") is None
+
+
 def test_superuser_grants_all() -> None:
 	m = PermissionsMap.model_validate({
 		"*": ["admin@example.com"],
@@ -138,3 +161,41 @@ def test_owner_grants_read_and_write() -> None:
 		assert can_read_project("secret", token)
 		assert can_write_project("secret", token)
 		assert not can_read_project("secret", None)
+
+
+def test_has_branch_write_permission_falls_back_to_project_scope() -> None:
+	m = PermissionsMap.model_validate({
+		"*": [],
+		"pgw.write.demo": ["writer@example.com"],
+	})
+	assert has_branch_write_permission(m, "writer@example.com", "demo", "refs/heads/main")
+	assert not has_branch_write_permission(m, "other@example.com", "demo", "refs/heads/main")
+
+
+def test_has_branch_write_permission_enforces_branch_specific_rules() -> None:
+	m = PermissionsMap.model_validate({
+		"*": [],
+		"pgw.write.demo": ["writer@example.com"],
+		"pgw.write_branch.demo/main": ["branch-writer@example.com"],
+	})
+	assert has_branch_write_permission(m, "branch-writer@example.com", "demo", "refs/heads/main")
+	assert not has_branch_write_permission(m, "writer@example.com", "demo", "refs/heads/main")
+
+
+def test_has_branch_read_permission_falls_back_to_project_scope() -> None:
+	m = PermissionsMap.model_validate({
+		"*": [],
+		"pgw.read.demo": ["reader@example.com"],
+	})
+	assert has_branch_read_permission(m, "reader@example.com", "demo", "refs/heads/main")
+	assert not has_branch_read_permission(m, "other@example.com", "demo", "refs/heads/main")
+
+
+def test_has_branch_read_permission_enforces_branch_specific_rules() -> None:
+	m = PermissionsMap.model_validate({
+		"*": [],
+		"pgw.read.demo": ["reader@example.com"],
+		"pgw.read_branch.demo/main": ["branch-reader@example.com"],
+	})
+	assert has_branch_read_permission(m, "branch-reader@example.com", "demo", "refs/heads/main")
+	assert not has_branch_read_permission(m, "reader@example.com", "demo", "refs/heads/main")

{pygitweb-0.2.1 → pygitweb-0.2.2/pygitweb.egg-info}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: pygitweb
-Version: 0.2.1
+Version: 0.2.2
 Summary: Gitweb reimplementation with FastAPI and Pygit2
 License-Expression: MIT
 Requires-Python: >=3.11

{pygitweb-0.2.1 → pygitweb-0.2.2}/pyproject.toml

@@ -4,7 +4,7 @@ build-backend = "setuptools.build_meta"
 
 [project]
 name = "pygitweb"
-version = "0.2.1"
+version = "0.2.2"
 description = "Gitweb reimplementation with FastAPI and Pygit2"
 readme = "README.md"
 license = "MIT"

{pygitweb-0.2.1 → pygitweb-0.2.2}/static/board.js

@@ -225,11 +225,13 @@
       var statusEl = details.querySelector('.board-card-status');
       var priorityEl = details.querySelector('.board-card-priority');
       var assigneeEl = details.querySelector('.board-card-assignee');
+      var tagsEl = details.querySelector('.board-card-tags');
       if (dueDate) dueDate.textContent = task.due_date || 'None';
       if (updatedAt) updatedAt.textContent = task.updated_at || 'None';
       if (statusEl) statusEl.textContent = status;
       if (priorityEl) priorityEl.textContent = task.priority || 'LOW';
       if (assigneeEl) assigneeEl.textContent = task.assignee || 'None';
+      if (tagsEl) tagsEl.textContent = task.tags || '';
       updateCardCommentCount(card, task.comments_count || 0);
     }
     return clone;
@@ -617,6 +619,7 @@
     var dueEl = popoutCard.querySelector('.board-card-due-date');
     var statusEl = popoutCard.querySelector('.board-card-status');
     var priorityEl = popoutCard.querySelector('.board-card-priority');
+    var tagsEl = popoutCard.querySelector('.board-card-tags');
 
     function pushTaskUpdate() {
       var taskRef = popoutCard.dataset.taskRef;
@@ -629,16 +632,19 @@
       var sEl = popoutCard.querySelector('.board-card-status');
       var pEl = popoutCard.querySelector('.board-card-priority');
       var aEl = popoutCard.querySelector('.board-card-assignee');
+      var tagsEl_ = popoutCard.querySelector('.board-card-tags');
       var dueVal = (dueEl_ && dueEl_.textContent) ? dueEl_.textContent.trim() : '';
       var statusDisplay = (sEl && sEl.textContent) ? sEl.textContent.trim() : 'TODO';
       var priorityDisplay = (pEl && pEl.textContent) ? pEl.textContent.trim() : 'LOW';
+      var tagsVal = (tagsEl_ && tagsEl_.textContent) ? tagsEl_.textContent.trim() : '';
       var body = {
         title: (tEl && tEl.textContent) ? tEl.textContent.trim() || 'Untitled' : 'Untitled',
         description: getMarkdownFromElement(dEl),
         status: statusDisplay ? statusDisplay.replace(/\s+/g, '_').toUpperCase() : 'TODO',
         priority: priorityDisplay ? priorityDisplay.replace(/\s+/g, '_').toUpperCase() : 'LOW',
         assignee: (aEl && aEl.textContent && aEl.textContent.trim() !== 'None') ? aEl.textContent.trim() : null,
-        due_date: (dueVal && dueVal !== 'None') ? dueVal : null
+        due_date: (dueVal && dueVal !== 'None') ? dueVal : null,
+        tags: tagsVal || ''
       };
       fetch('/tasks/update?' + new URLSearchParams({ project: ctx.project, board: ctx.board, task: taskRef }).toString(), {
         method: 'POST',
@@ -783,6 +789,12 @@
         sel.addEventListener('change', commitPriority);
       });
     }
+
+    if (tagsEl) {
+      tagsEl.addEventListener('blur', function () {
+        pushTaskUpdate();
+      });
+    }
   }
 
   function showCardPopout(card) {

{pygitweb-0.2.1 → pygitweb-0.2.2}/static/main.css

@@ -1126,6 +1126,12 @@ pre {
 		text-transform: uppercase;
 	}
 
+	.board-card-tags[contenteditable="true"]:empty::before {
+		content: "(click to add tags)";
+		color: var(--pgw-text-muted);
+		opacity: 0.8;
+	}
+
 	.board-card-comment-body {
 		min-width: 0;
 		flex: 1;

{pygitweb-0.2.1 → pygitweb-0.2.2}/tasks.py

@@ -220,6 +220,7 @@ def _task_to_json(t: Task) -> dict[str, Any]:
 		"priority": t.priority.value if t.priority else None,
 		"assignee": t.assignee,
 		"due_date": t.due_date.isoformat() if t.due_date else None,
+		"tags": getattr(t, "tags", "") or "",
 		"created_at": t.created_at.isoformat() if t.created_at else None,
 		"updated_at": t.updated_at.isoformat() if t.updated_at else None,
 		"comments_count": len(getattr(t, "comments", [])),
@@ -305,6 +306,7 @@ def task_create(
 	priority: str = Query("LOW", description="Task priority"),
 	assignee: str = Query("", description="Assignee"),
 	due_date: str = Query("", description="Due date ISO"),
+	tags: str = Query("", description="Task tags (KEY=VALUE list)"),
 ) -> JSONResponse:
 	"""Create a new task on a board."""
 	repo = pygit2.Repository(os.path.join(settings.PROJECTROOT, project))
@@ -335,6 +337,7 @@ def task_create(
 		priority=priority_enum,
 		assignee=assignee or None,
 		due_date=due,
+		tags=tags or "",
 	)
 	oid = task.write(repo)
 	b.tasks = getattr(b, "tasks", []) or []
@@ -355,7 +358,7 @@ async def task_update(
 	board: str = Query(..., description="Board name"),
 	task_ref: str = Query(..., alias="task", description="Task ref (e.g. refs/tags/tasks/task_123)"),
 ) -> JSONResponse:
-	"""Update a task (body: optional title, description, status, priority, assignee, due_date)."""
+	"""Update a task (body: optional title, description, status, priority, assignee, due_date, tags)."""
 	try:
 		body = await request.json() if request.headers.get("content-type", "").startswith("application/json") else {}
 	except Exception:
@@ -385,6 +388,8 @@ async def task_update(
 			)
 		except ValueError:
 			pass
+	if "tags" in body:
+		t.tags = str(body.get("tags") or "")
 	old_oid = str(repo.references[ref].resolve().target)
 	t.update_message()
 	new_oid = t.write(repo)

{pygitweb-0.2.1 → pygitweb-0.2.2}/templates/board_card.html

@@ -24,13 +24,46 @@
       {% endif %}
     </div>
     <div class="board-card-details d-none mt-2 pt-2 border-top small">
-      <div class="mb-2"><strong class="text-muted">Ref</strong><div class="board-card-task-ref font-monospace text-muted mt-1 text-break">{% if task and task.ref %}{{ task.ref }}{% else %}{% endif %}</div></div>
-      <div class="mb-2"><strong class="text-muted">Description</strong><div class="board-card-description-full board-card-editable board-card-markdown mt-1">{% if task and task.description %}{{ task.description }}{% else %}{% endif %}</div></div>
-      <div class="mb-2"><strong class="text-muted">Due date</strong><div class="board-card-due-date board-card-editable text-muted mt-1">{% if task and task.due_date %}{{ task.due_date }}{% else %}None{% endif %}</div></div>
-      <div class="mb-2"><strong class="text-muted">Last modified</strong><div class="board-card-updated-at text-muted mt-1">{% if task and task.updated_at %}{{ task.updated_at }}{% else %}None{% endif %}</div></div>
-      <div class="mb-2"><strong class="text-muted">Status</strong><div class="board-card-status board-card-editable text-muted mt-1">{% if task %}{{ task.status or 'TODO' }}{% else %}TODO{% endif %}</div></div>
-      <div class="mb-2"><strong class="text-muted">Priority</strong><div class="board-card-priority board-card-editable text-muted mt-1">{% if task and task.priority %}{{ task.priority }}{% else %}LOW{% endif %}</div></div>
-      <div class="mb-2"><strong class="text-muted">Assignee</strong><div class="board-card-assignee text-muted mt-1">{% if task and task.assignee %}{{ task.assignee }}{% else %}None{% endif %}</div></div>
+      <div class="mb-2">
+        <strong class="text-muted">Ref</strong>
+        <div class="board-card-task-ref font-monospace text-muted mt-1 text-break">{% if task and task.ref %}{{ task.ref }}{% else %}{% endif %}</div>
+      </div>
+      <div class="mb-2">
+        <strong class="text-muted">Description</strong>
+        <div class="board-card-description-full board-card-editable board-card-markdown mt-1">{% if task and task.description %}{{ task.description }}{% else %}{% endif %}</div>
+      </div>
+      <div class="mb-2">
+        <strong class="text-muted">Due date</strong>
+        <div class="board-card-due-date board-card-editable text-muted mt-1">{% if task and task.due_date %}{{ task.due_date }}{% else %}None{% endif %}</div>
+      </div>
+      <div class="mb-2">
+        <strong class="text-muted">Last modified</strong>
+        <div class="board-card-updated-at text-muted mt-1">{% if task and task.updated_at %}{{ task.updated_at }}{% else %}None{% endif %}</div>
+      </div>
+      <div class="mb-2">
+        <strong class="text-muted">Status</strong>
+        <div class="board-card-status board-card-editable text-muted mt-1">{% if task %}{{ task.status or 'TODO' }}{% else %}TODO{% endif %}</div>
+      </div>
+      <div class="mb-2">
+        <strong class="text-muted">Priority</strong>
+        <div class="board-card-priority board-card-editable text-muted mt-1">{% if task and task.priority %}{{ task.priority }}{% else %}LOW{% endif %}</div>
+      </div>
+      <div class="mb-2">
+        <strong class="text-muted">Assignee</strong>
+        <div class="board-card-assignee text-muted mt-1">{% if task and task.assignee %}{{ task.assignee }}{% else %}None{% endif %}</div>
+      </div>
+      <div class="mb-2">
+        <details class="board-card-tags-details" open>
+          <summary class="text-muted">Tags</summary>
+          <div
+            class="board-card-tags font-monospace text-muted mt-1 small"
+            contenteditable="true"
+            spellcheck="false"
+          >
+            {% if task and task.tags %}{{ task.tags }}{% endif %}
+          </div>
+        </details>
+      </div>
       <div class="mb-0 board-card-comments-section">
         <strong class="text-muted">Comments</strong>
         <div class="board-card-comments-list mt-2"></div>