This commit introduces a comprehensive Kanban board customization system and
improves CSRF token configuration for Docker deployments.
## Major Features
### 1. Customizable Kanban Board Columns
Add complete kanban column customization system allowing users to define
custom workflow states beyond the default columns.
**New Components:**
- Add KanbanColumn model with full CRUD operations (app/models/kanban_column.py)
- Add kanban routes blueprint with admin endpoints (app/routes/kanban.py)
- Add kanban column management templates (app/templates/kanban/)
- Add migration 019 for kanban_columns table (migrations/)
**Features:**
- Create unlimited custom columns with unique keys, labels, icons, and colors
- Drag-and-drop column reordering with position persistence
- Toggle column visibility without deletion
- Protected system columns (todo, in_progress, done) prevent accidental deletion
- Complete state marking for columns that should mark tasks as done
- Real-time updates via SocketIO broadcasts when columns change
- Font Awesome icon support (5000+ icons)
- Bootstrap color scheme integration
- Comprehensive validation and error handling
**Integration:**
- Update Task model to work with dynamic column statuses (app/models/task.py)
- Update task routes to use kanban column API (app/routes/tasks.py)
- Update project routes to fetch active columns (app/routes/projects.py)
- Add kanban column management links to base template (app/templates/base.html)
- Update kanban board templates to render dynamic columns (app/templates/tasks/)
- Add cache prevention headers to force fresh column data
**API Endpoints:**
- GET /api/kanban/columns - Fetch all active columns
- POST /api/kanban/columns/reorder - Reorder columns
- GET /kanban/columns - Column management interface (admin only)
- POST /kanban/columns/create - Create new column (admin only)
- POST /kanban/columns/<id>/edit - Edit column (admin only)
- POST /kanban/columns/<id>/delete - Delete column (admin only)
- POST /kanban/columns/<id>/toggle - Toggle column visibility (admin only)
### 2. Enhanced CSRF Configuration
Improve CSRF token configuration and documentation for Docker deployments.
**Configuration Updates:**
- Add WTF_CSRF_ENABLED environment variable to all docker-compose files
- Add WTF_CSRF_TIME_LIMIT environment variable with 1-hour default
- Update app/config.py to read CSRF settings from environment
- Add SECRET_KEY validation in app/__init__.py to prevent production deployment
with default keys
**Docker Compose Updates:**
- docker-compose.yml: CSRF enabled by default for security testing
- docker-compose.remote.yml: CSRF always enabled in production
- docker-compose.remote-dev.yml: CSRF enabled with production-like settings
- docker-compose.local-test.yml: CSRF can be disabled for local testing
- Add helpful comments explaining each CSRF-related environment variable
- Update env.example with CSRF configuration examples
**Verification Scripts:**
- Add scripts/verify_csrf_config.sh for Unix systems
- Add scripts/verify_csrf_config.bat for Windows systems
- Scripts check SECRET_KEY, CSRF_ENABLED, and CSRF_TIME_LIMIT settings
### 3. Database Initialization Improvements
- Update app/__init__.py to run pending migrations on startup
- Add automatic kanban column initialization after migrations
- Improve error handling and logging during database setup
### 4. Configuration Management
- Update app/config.py with new CSRF and kanban-related settings
- Add environment variable parsing with sensible defaults
- Improve configuration validation and error messages
## Documentation
### New Documentation Files
- CUSTOM_KANBAN_README.md: Quick start guide for kanban customization
- KANBAN_CUSTOMIZATION.md: Detailed technical documentation
- IMPLEMENTATION_SUMMARY.md: Implementation details and architecture
- KANBAN_AUTO_REFRESH_COMPLETE.md: Real-time update system documentation
- KANBAN_REFRESH_FINAL_FIX.md: Cache and refresh troubleshooting
- KANBAN_REFRESH_SOLUTION.md: Technical solution for data freshness
- docs/CSRF_CONFIGURATION.md: Comprehensive CSRF setup guide
- CSRF_DOCKER_CONFIGURATION_SUMMARY.md: Docker-specific CSRF setup
- CSRF_TROUBLESHOOTING.md: Common CSRF issues and solutions
- APPLY_KANBAN_MIGRATION.md: Migration application guide
- APPLY_FIXES_NOW.md: Quick fix reference
- DEBUG_KANBAN_COLUMNS.md: Debugging guide
- DIAGNOSIS_STEPS.md: System diagnosis procedures
- BROWSER_CACHE_FIX.md: Browser cache troubleshooting
- FORCE_NO_CACHE_FIX.md: Cache prevention solutions
- SESSION_CLOSE_ERROR_FIX.md: Session handling fixes
- QUICK_FIX.md: Quick reference for common fixes
### Updated Documentation
- README.md: Add kanban customization feature description
- Update project documentation with new features
## Testing
### New Test Files
- test_kanban_refresh.py: Test kanban column refresh functionality
## Technical Details
**Database Changes:**
- New table: kanban_columns with 11 columns
- Indexes on: key, position
- Default data: 4 system columns (todo, in_progress, review, done)
- Support for both SQLite (development) and PostgreSQL (production)
**Real-Time Updates:**
- SocketIO events: 'kanban_columns_updated' with action type
- Automatic page refresh when columns are created/updated/deleted/reordered
- Prevents stale data by expiring SQLAlchemy caches after changes
**Security:**
- Admin-only access to column management
- CSRF protection on all column mutation endpoints
- API endpoints exempt from CSRF (use JSON and other auth mechanisms)
- System column protection prevents data integrity issues
- Validation prevents deletion of columns with active tasks
**Performance:**
- Efficient querying with position-based ordering
- Cached column data with cache invalidation on changes
- No-cache headers on API responses to prevent stale data
- Optimized database indexes for fast lookups
## Breaking Changes
None. This is a fully backward-compatible addition.
Existing workflows continue to work with the default columns.
Custom columns are opt-in via the admin interface.
## Migration Notes
1. Run migration 019 to create kanban_columns table
2. Default columns are initialized automatically on first run
3. No data migration needed for existing tasks
4. Existing task statuses map to new column keys
## Environment Variables
New environment variables (all optional with defaults):
- WTF_CSRF_ENABLED: Enable/disable CSRF protection (default: true)
- WTF_CSRF_TIME_LIMIT: CSRF token expiration in seconds (default: 3600)
- SECRET_KEY: Required in production, must be cryptographically secure
See env.example for complete configuration reference.
## Deployment Notes
Affected modules: Projects, Clients, Tasks, Invoices, Comments, Admin, Search
- All HTML forms now include csrf_token hidden input
- JavaScript forms retrieve token from meta tag in base.html
- API endpoints properly exempted for JSON operations
- 58 POST forms + 4 dynamic JS forms now protected
Security impact: HIGH - Closes critical CSRF vulnerability
Files modified: 20 templates
- Remove global jQuery/DataTables/Chart.js from base; load per-page where used
- Add “Skip to content” link and set main content id for accessibility
- Add reusable confirm modal with Promise API; refactor clients/invoices to use it
- Add mobile “Log Time” floating action button (FAB)
- Extract inline styles into app/static/ui.css (invoices, project view); tidy project list CSS
- Invoices list: add status filter chips, mobile-friendly data-labels; move scripts to extra_js
- Add per-page Chart.js includes for reports and project view
- Improve performance (less global JS) and consistency without altering behavior
Note: Theme/density navbar buttons intentionally excluded per request.
Add Pomodoro focus mode with session summaries
Model: FocusSession; API: /api/focus-sessions/; UI: Focus modal on timer page
Add estimates vs actuals with burndown and budget alerts
Project fields: estimated_hours, budget_amount, budget_threshold_percent
API: /api/projects/<id>/burndown; Charts in project view and project report
Implement recurring time blocks/templates
Model: RecurringBlock; API CRUD: /api/recurring-blocks; CLI: flask generate_recurring
Add tagging and saved filters across views
Model: SavedFilter; /api/entries supports tag and saved_filter_id
Support billable rate overrides per project/member
Model: RateOverride; invoicing uses effective rate resolution
Also:
Migration: 016_add_focus_recurring_rates_filters_and_project_budget.py
Integrations and UI updates in projects view, timer page, and reports
Docs updated (startup, invoice, task mgmt) and README feature list
Added basic tests for new features
- Reduce global .btn:hover lift (no translate) and lighten shadow (0 2px 6px @ 0.08); trim overlay to 0.35
- Tone down .btn-primary/.btn-success/.btn-danger hover lift and shadows
- Align inline .btn:hover in templates (tasks view/edit/create, my_tasks, projects create)
- Preserve focus states and dark mode; no functional changes
Files:
- app/static/base.css
- app/templates/tasks/view.html
- app/templates/tasks/edit.html
- app/templates/tasks/create.html
- app/templates/tasks/my_tasks.html
- templates/projects/create.html
- Fix header alignment issues with comments counter and action button
- Remove nested card styling conflicts in comments list
- Improve comment header flex layout with proper spacing
- Fix timestamp text overflow with ellipsis for long content
- Make comment actions always visible instead of hover-only
- Remove conflicting CSS resets that broke flex layouts
- Remove decorative guideline to prevent double left borders
- Optimize comment metadata flex behavior for better responsiveness
Resolves vertical alignment issues in comment headers and improves
overall visual consistency of the comment system.
• Enhanced CSS variable system with comprehensive color palettes (50-900 scales)
• Implemented modern glass morphism effects with backdrop-blur throughout
• Added smooth animations and micro-interactions for better user feedback
• Created reusable component system with modern styling patterns
• Improved mobile experience with better touch interactions and responsive design
• Enhanced dark theme with better contrast ratios and visual hierarchy
• Updated navbar to use square corners and fixed dark mode styling issues
• Applied consistent styling patterns from clients page across all templates
• Added comprehensive theme template for future customizations
• Maintained existing blue color scheme while modernizing visual appearance
• Optimized CSS architecture with global styling patterns and reduced duplication
• Enhanced accessibility with proper focus states and WCAG compliance
• Improved button system with gradients, animations, and consistent interactions
Files modified:
- app/static/base.css: Enhanced with modern styling system
- app/static/mobile.css: Improved mobile experience and touch interactions
- app/static/theme-template.css: Comprehensive theme export template
- app/templates/_components.html: Modernized reusable components
- Multiple template files: Applied consistent styling patterns
- Documentation: Added comprehensive guides and summaries
Breaking changes: None - all existing functionality preserved
- Add Comment model with threaded replies and user attribution
- Create Alembic migration (013_add_comments_table.py) for database schema
- Implement complete CRUD operations via comments routes
- Add responsive UI with inline editing and real-time interactions
- Include permission system (users edit own, admins manage all)
- Support soft delete for comments with replies to preserve structure
- Add comprehensive CSS styling with dark theme support
- Integrate comments sections into project and task detail views
- Fix modal z-index and context issues for delete confirmations
- Update README with detailed feature documentation
Technical details:
- Threaded comment structure with parent-child relationships
- API endpoints for comment operations and retrieval
- Mobile-responsive design with touch-friendly interactions
- Internationalization support via Flask-Babel
- Bootstrap 5 modal integration with proper event handling
- Add DataTables library integration for enhanced table functionality
- Improve navigation bar styling with rounded corners and white background
- Fix mobile button widths for better responsive design
- Enhance badge styling with proper text wrapping and ellipsis handling
- Add table sorting styles for projects and tasks lists
- Improve mobile responsiveness across various screen sizes
- Update filter button styling for better visual consistency
- Update Kanban board: remove alert system, clean up styling and JavaScript
- Enhance task management: add collapsible filters, improve button layouts
- Improve mobile responsiveness: standardize colors, spacing, and component styling
- Modernize CSS: implement CSS custom properties for consistent theming
- Update templates: standardize button styling and layout across all pages
- Refactor invoice interface: improve form layouts and visual consistency
- Enhance admin pages: better spacing and mobile-friendly designs
This update provides a more cohesive and modern user experience across
desktop and mobile devices with improved accessibility and visual consistency.
- Integrate Flask-Babel and i18n utilities; initialize in app factory
- Add `preferred_language` to `User` with Alembic migration (011_add_user_preferred_language)
- Add `babel.cfg` and `scripts/extract_translations.py`
- Add `translations/` for en, de, fr, it, nl, fi
- Update templates to use `_()` and add language picker in navbar/profile
- Respect locale in routes and context processors; persist user preference
- Update requirements and Docker/Docker entrypoint for Babel/gettext support
- Minor copy and style adjustments across pages
Migration: run `alembic upgrade head`
- Add Kanban board partial and integrate into tasks list
- app/templates/tasks/_kanban.html
- app/templates/tasks/list.html
- Update API to support task status moves and ordering
- app/routes/api.py
- Expose Kanban in layout/navigation and polish UI
- app/templates/base.html
- app/static/base.css
- Link/entry points from related pages
- templates/projects/view.html
- templates/reports/index.html
- Minor profile page adjustments
- app/templates/auth/profile.html
- Add reusable Kanban partial (app/templates/tasks/_kanban.html) with HTML5
drag-and-drop and optimistic status updates via PUT /api/tasks/<id>/status
- Tasks overview (app/templates/tasks/list.html): replace grid with Kanban and
remove the List/Kanban toggle so Kanban is the sole view
- Project page (templates/projects/view.html): replace task cards grid with the
same Kanban board
Features:
- Added shimmer effects and micro-interactions across all components
- Implemented gradient backgrounds and enhanced visual hierarchy
- Created smooth hover animations with cubic-bezier transitions
- Enhanced markdown editor with professional styling and dark mode support
- Improved task cards with animated progress bars and status badges
- Added responsive design optimizations for mobile devices
Technical improvements:
- Consolidated and optimized CSS across 6 template files
- Implemented consistent design system with unified color palette
- Added hardware-accelerated animations for 60fps performance
- Enhanced accessibility with proper focus states and contrast ratios
- Created modular CSS architecture with clear organization
Dark mode enhancements:
- Complete dark theme support across all modified components
- Smooth theme switching with no visual glitches
- Enhanced contrast and readability in dark mode
- Consistent color palette and gradient adaptations
Responsive design:
- Mobile-optimized touch interactions and spacing
- Unified breakpoint behavior across all pages
- Enhanced button sizes and hover states for mobile
Files modified:
- templates/clients/list.html - Enhanced client list with animated badges and cards
- templates/clients/view.html - Improved client details with shimmer effects
- app/templates/tasks/edit.html - Professional markdown editor styling
- app/templates/tasks/create.html - Enhanced task creation form
- app/templates/tasks/list.html - Modern task cards with animations
- templates/projects/view.html - Consistent project task styling
This commit transforms the TimeTracker into a modern, professional application with exceptional user experience in both light and dark modes.
- Create and use shared page_header macro for consistent info headers
- Apply new header styling to:
- Dashboard, Projects, Clients, Invoices (removed filter dropdown), Reports, Timer (manual)
- System Info, Admin Users (list + form)
- Profile, Edit Profile
- Tasks (list, my tasks, overdue)
- Analytics (desktop + mobile)
- About, Help
- Add shared header/badge utilities in base.css for consistent spacing and badges
- Align summary cards and table/button styles with admin dashboard
- Footer: add “Buy me a coffee” link (https://buymeacoffee.com/DryTrix)
models/user: add nullable full_name and display_name property (fallback to username)
migrations: add 002_add_user_full_name to introduce users.full_name
auth/profile: show and allow editing full_name; persist on POST
templates:
use display_name across navbar, dashboard greeting, tasks (list/view/edit/my/overdue), projects view, reports (user/project), invoices (creator and generate-from-time), and admin (dashboard/users)
keep username where appropriate (e.g., read-only admin form field)
reports:
aggregate/group by display_name in summaries
CSV export writes display_name instead of username
projects: get_user_totals returns display names when available
main/dashboard: replace inline Jinja in script with data attribute flag to satisfy linter
tasks/view: remove Jinja desc() usage; iterate over pre-ordered time_entries from route and slice to 5
fixes jinja2 UndefinedError: 'desc' is undefined
Use GET route `timer.start_timer_for_project` instead of POST-only `timer.start_timer`
in task and project templates. This fixes “405 Method Not Allowed” when starting a
timer from /tasks and /tasks/<id>, and from the project view.
- Add Task model with full CRUD operations, status tracking, and priority management
- Integrate tasks with existing projects and time entries via foreign key relationships
- Create new Flask routes (/tasks) with admin and user role-based access control
- Implement task status transitions (pending → in_progress → completed → cancelled)
- Add task filtering by status, priority, assignee, and project
- Create responsive Jinja2 templates for task listing, creation, editing, and viewing
- Integrate task selection in timer and manual time entry forms
- Add task management to project dashboards and navigation menus
- Implement automatic database migration system for seamless deployment
- Create migration scripts to add missing tables and columns
- Update startup script to detect and run migrations automatically
- Add comprehensive error handling and validation
- Include full documentation (TASK_MANAGEMENT_README.md)
- Update project structure and main README with new feature details
Database Changes:
- New 'tasks' table with indexes for performance
- Add 'task_id' column to 'time_entries' table
- Automatic migration detection and execution
Technical Implementation:
- SQLAlchemy relationships with proper backrefs and cascading
- Flask-Login integration for role-based access
- Bootstrap 5 responsive UI components
- Font Awesome icons for visual enhancement
- Comprehensive test coverage and error handling
This feature enables users to break down projects into manageable tasks,
track progress, assign work, and maintain better project organization.
- Add mobile-first CSS with responsive breakpoints and touch targets
- Create dedicated mobile.css and mobile.js files for enhanced mobile experience
- Implement card-based table layouts for small screens with data-label attributes
- Add mobile-specific utility classes (mobile-card, touch-target, mobile-stack)
- Enhance navigation with collapsible mobile menu and swipe gestures
- Optimize forms, buttons, and modals for mobile devices
- Add touch feedback and mobile-specific interactions
- Implement responsive grid layouts and mobile typography
- Add mobile meta tags for PWA-like functionality
- Ensure all templates use mobile-friendly classes and responsive design
Dries Peeters