Публічная дарожная карта
Што мы будуем
Дарожная карта Community Edition у прамым эфіры з GitHub. Прадметы перамяшчаюцца як працоўныя караблі - тут няма нічога абяцання з датай.
зараз
У стадыі выдання Community Edition.
- Платформа#18
Redis cache adapter
Multi-instance deployments need a shared cache rather than process memory or a local filesystem.
- Платформа#54
Federated admin login, MFA, and session revocation controls
Production administration needs modern identity options and visible session control beyond password-only login.
- Платформа#94
Safe custom JavaScript and third-party snippet injection
#73 shipped custom CSS in the page builder. Authors also need to add JavaScript — analytics snippets, chat widgets, structured-data blocks, small interactions — per page or…
- Платформа#105
WebAuthn passkey sign-in for administrators and users
#70 shipped TOTP and #54 covers federated login and session revocation. Passkeys (WebAuthn) are now the strongest widely-supported option: phishing-resistant, no shared secret,…
- Змест#143
Federated API parity for comment spam policy management
#109 shipped local heuristic spam scoring, admin-curated block/allow rules, and admin-curated spam-signal terms for public comments — but only through the cookie-authenticated…
- Платформа#146
Umbrella: Elsa Workflows connector and managed cloud
Use Justflows as the customer/workspace, configuration, billing, quota, and support layer for an Elsa Workflows cloud offering. This umbrella covers both: 1. Elsa Connector…
- Платформа#198
Security program: harden core and extension trust, build a Security Center, and verify recovery
Make Justflows CE secure by default and give operators a built-in Security Center with actionable checks, security events, integrity status, and recovery guidance. Essential…
- Пашырэнні#231
Umbrella: Shop Stripe payment suite
Make Stripe a complete, first-class payment provider for the Shop plugin (plugin-registry-service/plugins/ecommerce), covering online checkout, wallets, local methods, saved…
- Пашырэнні#241
Stripe: fees, balance transactions, and payout reconciliation
- [ ] Store the Stripe fee and net amount per payment from balance transactions. - [ ] Payouts listed with the orders/refunds/disputes they contain; payout. webhooks update…
- Пашырэнні#242
Stripe: optional Stripe Tax calculation and tax transactions
Merchants can use Stripe Tax instead of Shop's own tax rates. - [ ] Setting to use Stripe Tax per site; Shop tax remains the default. - [ ] Tax calculated at checkout via Tax…
- Пашырэнні#243
Stripe: Stripe Invoicing and Quotes for B2B orders
- [ ] Admin can send an order as a Stripe Invoice (hosted invoice page, due date, payment terms). - [ ] Optional Stripe Quotes for draft orders; accepted quotes become orders.…
- Пашырэнні#244
Stripe Connect for multisite: per-site connected accounts and platform fees
On a multisite/multi-tenant installation (see #23), every site currently needs its own Stripe secret keys. Operators running a hosted network (like Justflows Cloud) need sites…
- Пашырэнні#245
Stripe: admin setup, test mode, diagnostics, and agent tools
- [ ] Guided setup in Payments settings: keys or Connect onboarding, webhook registration, payment methods, wallet domains. - [ ] Separate test and live credentials with a…
- Пашырэнні#246
Stripe: test suite and merchant documentation
- [ ] Unit tests using recorded fixtures for every API call and webhook type. - [ ] Optional integration suite against stripe-mock and Stripe CLI webhook forwarding, kept out…
- Аперацыі#257
Network backup and restore for root site and all subsites
The current backup and restore workflow is scoped to the site selected in Admin. A multisite operator must back up and restore every subsite separately, and a root-site archive…
- Платформа#269
Run a scoped independent security review
Part of #198. Someone outside the development of the new security surface reviews it before broad availability. - Scope the review to the Security Center, extension trust, and…
Далей
Ставіцца ў чаргу, як толькі бягучы зрэз трапляе.
- Змест#106
Editorial workflow with draft, review, approval, and publish states
Teams larger than one person need review before publishing. Today content is either a draft or published, and any user who can edit can also publish. Newsrooms and marketing…
- Пашырэнні#183
Shop: support lifetime subscription discounts for limited signup offers
Shop discounts currently apply to the initial checkout only. Subscription renewal pricing explicitly excludes discounts, so a 100% coupon shows €0.00 today followed by the…
- Пашырэнні#184
First-party Helpdesk plugin: multisite + Shop customer service, tickets, visibility, handover, secure uploads, support popup, subscription limits
Sites that sell something, run a community, or host customers need a place where people can ask for help and staff can answer in an orderly way. Today that means a contact form…
- Пашырэнні#193
Analytics network tag: decide consent on sites without a consent plugin
The Analytics network tag (set on the main site) fires on every site's public pages, whether or not that site has Analytics active. Cookie Consent works per site. So on a…
- Платформа#195
Load only the JavaScript and CSS each page needs (code splitting, per-page assets, hashed caching)
Frameworks like Next.js split code per route and ship only what a page needs. Justflows already has most of the tooling for this. The admin UI is built with Vite and Rolldown,…
- Платформа#201
Workspace Subscription page: current plan, upgrades, usage, and root-site limit visibility
Add a Subscription page to the user workspace so customers can see their current subscription, understand their usage, and upgrade when an upgrade is available. Operators…
- Платформа#212
Elsa: agree supported API, authentication, tenancy, and hosting contract
Establish the supported Elsa 3 integration contract before implementation. - Approve the minimum Elsa version and API compatibility matrix. - Select machine authentication and…
- Пашырэнні#218
Elsa connector: health sync, usage sync, diagnostics, and observability
Keep connector state current and supportable without exposing customer data. - Add per-site health and usage jobs with jitter, timeouts, retry, and backoff. - Persist bounded…
- Платформа#219
Elsa connector: signed callbacks and webhook replay protection
Receive Elsa events securely when supported by the agreed hosting contract. - Define allowed event types and schemas. - Implement raw-body signature, timestamp, tenant…
- Платформа#220
Elsa cloud: build private provisioning API and environment state machine
Manage Elsa infrastructure without placing provider privileges in tenant plugins. - Implement authenticated environment and operation APIs. - Model provisioning, ready,…
- Платформа#221
Elsa cloud: provision shared multi-tenant pools for small plans
Place smaller customers as isolated Elsa tenants in shared containers. - Provision pinned, versioned shared Elsa pools. - Automate tenant creation, scoped service identity,…
- Платформа#222
Elsa cloud: provision dedicated instances for larger plans
Offer dedicated Elsa deployments on demand for larger customers. - Provision the approved pinned Elsa topology and dedicated database. - Configure HTTPS, endpoints,…
- Платформа#223
Elsa cloud: migrate customers from shared pools to dedicated instances
Move a customer from shared to dedicated placement without changing its Justflows workspace. - Define eligibility, maintenance, export/import, credential rotation, endpoint…
- Платформа#224
Elsa cloud: connect subscriptions, quotas, suspension, retention, and deletion
Map plans and subscription lifecycle to Elsa placement safely. - Define plan rules for shared/dedicated placement, capacity, environments, and usage. - Register and enforce…
- Платформа#225
Elsa integration: security, isolation, disaster recovery, and production readiness
Validate the connector and managed cloud for production. - Test SSRF, redirects, CSRF, authorization, limits, replay, and redaction. - Test shared-pool isolation and noisy…
- Пашырэнні#226
Elsa integration: define Justflows hook catalog and versioned event envelopes
Define which Justflows and plugin events may trigger Elsa workflows and exactly what data each event carries. - Catalog stable core hooks for content, accounts, forms,…
- Платформа#227
Elsa integration: build hook-to-workflow mappings and durable delivery
Let workspace administrators map approved Justflows hooks to Elsa workflows with reliable delivery. - Add mapping UI for hook, Elsa definition/version policy, field projection,…
- Платформа#228
Elsa integration: provision workspace-scoped service identities and capability consent
Authenticate Elsa-to-Justflows calls with a dedicated least-privilege identity. - Create one service identity per Justflows workspace/site and Elsa tenant/environment. - Use…
- Пашырэнні#229
Elsa integration: publish official Justflows Elsa activity package
Provide versioned Elsa activities that call approved Justflows APIs without importing internal runtime code. - Create the official .NET activity package, provisionally…
- Платформа#230
Elsa integration: end-to-end internal, external, and isolation test suite
Prove internal Justflows orchestration and external-purpose Elsa workflows work safely together. - Test Justflows hook to durable event to Elsa workflow. - Test Elsa activity…
- Пашырэнні#270
Sandbox unverified plugins and let only verified releases run outside it
Extension trust records that untrusted extensions are not supported, and that running them needs a separate project with enforceable operating system or process boundaries.…
- Пашырэнні#271
Open the marketplace to third-party publishers safely
The Marketplace only serves Justflows plugins today. Plugins run as trusted server code (extension trust), so a listing from an outside publisher carries the same risk as…
- Пашырэнні#272
Add publisher accounts, namespaces, and plugin ownership
Part of #271. Every Marketplace plugin belongs to a known publisher account, and only that publisher can submit releases for it. - Add publisher accounts with verified email,…
- Пашырэнні#273
Add a review queue with reviewer roles and an audit trail
Part of #271. Depends on #272. Follows the requirements in #263. Every submission moves through a tracked review, and the system can grow from one reviewer to a team without…
- Пашырэнні#274
Sign marketplace releases only after approval, in a separate signing service
Part of #271. Depends on #273. Approval is the only route to a valid signature, and the signing key stays away from services that handle publisher input. - Move signing to a…
- Пашырэнні#275
Accept plugin source through a GitHub App and a CLI
Part of #271. Depends on #272. Publishers submit source code, not built packages, and every submission points to an exact, permanent snapshot. - Build a GitHub App with…
- Пашырэнні#276
Build submissions in isolated throwaway environments
Part of #271. Depends on #275. Justflows produces each .jfpkg from recorded source, without publisher code ever running on trusted infrastructure. - Run each build in a new…
- Пашырэнні#277
Run automated security checks on every submission
Part of #271. Depends on #276. Uses the rules from #97. Every submission gets the same automated checks, and a failure blocks it before a reviewer spends time on it. - Run the…
- Пашырэнні#278
Roll out marketplace updates in stages
Part of #271. Depends on #274. A bad release can be stopped before it reaches every site. - Release third-party updates to automatic-update sites in stages over 24 to 72 hours.…
- Пашырэнні#279
Let Justflows remotely disable confirmed malicious plugins
Part of #271. Builds on the signed advisory feed in #262. Related to #270. When a plugin release is confirmed malicious, Justflows can stop it on connected sites, including…
- Пашырэнні#280
Monitor listed plugins and respond to publisher compromise
Part of #271. Depends on #277 and #279. Published plugins stay under watch after approval, and maintainers have a clear plan when a publisher is compromised. - Rescan…
- Пашырэнні#282
Pilot third-party publishing with invited publishers, then open it up
Part of #271. Depends on #272, #273, #274, #275, #276, #277, #278, #279, and #280. Third-party publishing is proven with a small group before anyone can apply. - Invite a small…
Пазней
На гарызонце, не запланавана.
- Змест#59
Multiple language selector designs and customization
The existing core.language-switcher correctly resolves localized routes, but presentation is limited to inline language codes or names. Different headers, footers, mobile…
- Платформа#64
Optional separate mobile and desktop cache variants
Responsive sites should normally serve the same HTML and use CSS for different viewport sizes. Some themes, plugins, menus, or integrations may intentionally render different…
- Платформа#66
Configurable GDPR and PSD2/PSD3 readiness and compliance controls
Organizations need privacy and payment-security controls that match their role, jurisdiction, risk, enabled features, and professional advice. Justflows should provide strong…
- Змест#95
Default privacy policy page generator and setting
Most sites need a privacy policy page. Today operators create one by hand with no starting point and no link between "the privacy policy" and the features that reference it…
- Вопыт распрацоўніка#97
Plugin and theme quality checker for authors
#10 documents plugin/theme authoring and #21 covers install trust and signing, but authors have no tool that checks a package for quality, compatibility, and security issues…
- Змест#99
Shareable draft preview links
Editors need to show unpublished or scheduled content to reviewers and stakeholders who do not have admin accounts. Today previewing requires logging in, so review happens over…
- Аперацыі#107
Maintenance mode and coming-soon page
Operators need a supported way to take the public site offline for maintenance, or to run a pre-launch "coming soon" page, without stopping the process or hand-editing a proxy.
- Пашырэнні#111
First-party Related Content plugin
Keeping readers on the site after an article is a core publishing need. There is a first-party Forms, Analytics, and Gallery plugin (#14, #15, #75) but nothing for on-page…
- Пашырэнні#112
First-party Newsletter and subscriber management plugin
Publishers want an owned audience. Today there is no first-party way to collect subscribers, confirm opt-in, and send a broadcast or a post digest. This pairs with the Forms…
- Пашырэнні#114
First-party Announcements and site-wide banners plugin
Operators frequently need a temporary site-wide message: a sale, an incident notice, a policy update, an event countdown. Today this means editing the theme. A small…
- Пашырэнні#115
First-party Paid memberships and subscriptions plugin
Many independent publishers monetise through paid memberships and gated content. There is a hosted marketplace (#13) and a public user system (#56), but no first-party way to…
- Пашырэнні#116
First-party Documentation and knowledge-base theme
A large share of Justflows installs will be product docs, knowledge bases, and internal handbooks. There is a Theme Customizer (#72) and page builder (#73) but no first-party…
- Пашырэнні#117
First-party Portfolio and agency theme
Freelancers, studios, and agencies are a natural audience for a self-hosted site builder. A first-party portfolio/agency theme gives them a polished starting point that shows…
- Пашырэнні#118
First-party Magazine and news theme
News sites, blogs with volume, and multi-author publications need dense, hierarchy-rich layouts that the default theme does not target. A first-party magazine theme exercises…
- Аперацыі#119
OpenLiteSpeed / LiteSpeed hosting and LSCache integration
Justflows already ships a production Nginx config (docker/nginx.conf) and targets Node hosting on Plesk / cPanel, but LiteSpeed and OpenLiteSpeed are a large share of that…
- Пашырэнні#121
First-party Content access control and gating plugin
Publishers frequently need to restrict who can see a page, post, custom-type entry, media file, or download — not only paying subscribers. The roadmap has recurring memberships…
- Пашырэнні#122
First-party Ticketing and event tickets plugin
Operators want to sell tickets — for events, tours, workshops, timed entry, donations-with-admission, or any priced pass — directly from their own site instead of a third-party…
- Пашырэнні#123
First-party Interactive maps plugin
Sites need embeddable, interactive maps — store and office locators, event venues, travel and real-estate listings, coverage areas, hiking routes, data overlays — without…
- #126
Create new patterns
Create new patterns available via the load directory in the pattern panel Create new patterns available via the load directory in the pattern panel
- #147
Create a Cpanel plugin
users should be able to have justflows default in their Cpanel environment. Create a plugin on the Cpanel market place so users can have the oneclick install on Cpanel
- Пашырэнні#247
Stripe: Terminal for in-person payments
Accept in-person card payments for Shop orders using Stripe Terminal readers. - [ ] Register locations and readers per site. - [ ] Admin/POS screen to collect payment for an…
- Пашырэнні#248
Stripe: Identity verification for customers
Optional identity verification (Stripe Identity) for age-restricted products, high-risk orders, or B2B accounts. - [ ] Rules for when verification is required (product, order…
- Пашырэнні#249
Stripe: evaluate remaining Stripe products (Issuing, Treasury, Capital, Financial Connections, Climate)
Decide which remaining Stripe products make sense for Shop and multisite operators, and open implementation issues for the ones accepted. - Issuing (cards for…
- Платформа#250
First-party Moneybird integration: full API suite and official-plugin compatibility
Build and ship a first-party Moneybird integration that exposes the full supported Moneybird API suite inside Justflows and interoperates with every official plugin through…
- Пашырэнні#281
Allow closed-source paid plugins under a commercial agreement
Part of #271. Depends on #273 and #276. Paid plugins can be listed without publishing their source, under a contract, while reviewers still see all of it. - Update…
Адпраўлены
Ужо ў Community Edition.
- Змест#7
Persist custom content types and fields
Admin → Content Types currently edits types in the browser only. They are not stored in the database or exposed on the API, so custom types cannot survive a reload or drive the…
- Платформа#8
Public content REST API and OpenAPI for headless use
The website promises a typed headless CMS. Plugin authors have @justflows/sdk; frontend consumers still need a stable, documented public content API.
- Змест#9
Built-in SEO: titles, canonicals, sitemap, and robots.txt
A complete website out of the box needs discoverability without a plugin.
- Вопыт распрацоўніка#10
Plugin and theme author documentation
The runtime and SDK exist; authors still need a single path from hello-world to a signed-off .jfpkg.
- Вопыт распрацоўніка#11
CI quality gate for core packages
Public CE needs a predictable merge bar: lint, typecheck, and tests on every PR into developers.
- Платформа#12
Admin accessibility pass
The admin is the product for authors. Keyboard paths, names, and contrast should meet a WCAG 2.2 AA bar on the primary flows.
- Пашырэнні#13
Hosted marketplace catalog for community packages
Site owners need a reviewed catalog of plugins and themes that installs directly from Admin → Marketplace.
- Пашырэнні#14
First-party Forms plugin
Contact forms are core functionality for a complete website platform.
- Пашырэнні#15
First-party privacy-friendly Analytics plugin
First-party, on-site analytics provides useful traffic insight without requiring a paid or third-party service.
- Платформа#16
Content webhooks
Headless and integration users need push delivery, not only polling.
- Змест#17
Locale-aware content routing
Multilingual sites need content locales, translation relationships, localized routes, and language-aware discovery.
- Аперацыі#19
Backup and restore from admin Tools
Self-hosters need a supported, portable snapshot of content, configuration, and media without operating directly on SQL.
- Вопыт распрацоўніка#20
Stable SDK compatibility policy
A stable release requires plugin and theme authors to know which public contracts can change and how deprecation works.
- Пашырэнні#21
Plugin signing and install trust
Package installation is a supply-chain boundary and must verify provenance before activation.
- Платформа#22
Role and capability editor in admin
Administrators need more control than selecting one of the five built-in roles.
- Платформа#23
First-class multi-site and multi-tenant SaaS hosting
Justflows needs first-class multi-site and multi-tenant support for two use cases: 1. Users and organizations running multiple websites in their own Justflows installation. 2.…
- Платформа#24
Static / edge export
Static output lets high-traffic public pages be served from object storage or an edge CDN without hitting the Node origin.
- Аперацыі#25
Browser install wizard
Shipped in v0.1.0. Finish setup in the browser after Docker or shared hosting. See README Option A/B.
- Платформа#26
Unified Express server (API + admin + public site)
Shipped in v0.1.0. PostgreSQL, MySQL, and MariaDB. One Node process.
- Змест#27
Visual block editor and page builder
Shipped in v0.1.0. Eleven core blocks and a drag-and-drop page builder.
- Пашырэнні#28
Plugin and theme runtime (.jfpkg + typed SDK)
Shipped in v0.1.0. Upload packages in admin. Authors use @justflows/sdk.
- Змест#29
Media library (local + S3-compatible)
Shipped in v0.1.0. Uploads, derivatives, local and S3 adapters.
- Платформа#30
Auth, CSRF, and security admin
Shipped in v0.1.0. Capabilities, signed sessions, PBKDF2, security header pages.
- Аперацыі#31
Caching, health checks, and in-admin updates
Shipped in v0.1.0. Memory/filesystem cache, Tools performance controls, health, updates.
- Змест#32
WordPress WXR importer (posts and pages)
Shipped in v0.1.0. Admin → Tools accepts a WordPress export .xml.
- Пашырэнні#49
Add configurable CAPTCHA protection to Forms
The shipped Forms implementation has per-IP rate limiting and a honeypot, but automated abuse still needs a challenge option for higher-risk public forms.
- Змест#50
Complete public user comments and moderation workflow
Comment storage, moderation routes, and an admin moderation page are partially present, but visitors cannot submit or view comments through the public site, so the feature is…
- Платформа#51
Allow administrators to change the admin URL safely
Operators may want the administration entry path to be non-default for policy, branding, or reduction of opportunistic login noise. This is defense-in-depth and must not be…
- Платформа#52
Add a Justflows marketing and discovery section to Admin Home
Admin Home should help operators discover useful Justflows resources, releases, marketplace packages, documentation, and community channels without overwhelming core…
- Платформа#53
Add advanced per-user scope and capability selection
Default roles are convenient but cannot express narrower access such as editing only selected content types, locales, sites, or owned content. This issue complements #22, which…
- Аперацыі#55
Fix migration bookkeeping and PostgreSQL pending-migration reruns
The migration runner calls every name in MIGRATIONORDER on each installed-server startup and never reads migrations. Only 0001initial writes a tracker row; migrations 0002…
- Платформа#56
Replace mock Users admin with real user management API
Administrators need to manage real accounts from Admin → Users. This is distinct from #22: this bug restores the expected fixed-role user-management behavior; #22 adds custom…
- Аперацыі#57
Developer debug mode and Admin diagnostics center
Developers and self-hosters need enough visibility to diagnose plugin, hook, API, job, cache, database, rendering, and update failures without enabling unsafe raw error output…
- Змест#58
Site favicon management in Admin and public frontend
Site owners need to select a recognizable browser/app icon without editing theme files or server assets manually.
- Змест#60
Multiple light and dark mode selector designs
The existing core.color-scheme widget supports light, dark, and optional system behavior, but only basic button and icon presentation. Themes need several polished selector…
- Змест#61
Dedicated menu designer with horizontal, dropdown, and mega-menu layouts
Admin → Menus can create menus from pages, posts, custom links, and nested child items, but authors cannot visually design navigation behavior or build responsive dropdown and…
- Платформа#63
Customizable system email designs and template editor
Justflows can send system notifications through sendmail or SMTP, but subjects and text bodies are currently assembled in individual routes/services. Site owners need…
- Змест#65
Working revisions for every content type without overwriting the live version
Authors must be able to edit and save a draft of already-published content without changing what visitors currently see. The draft should become live only through an explicit…
- Платформа#69
Admin server-side rendering for every admin route
Administrators should get a fully rendered admin document on first load. Site owners must never need a frontend build toolchain, and admin screens must not be indexed.
- Платформа#70
TOTP two-factor authentication and password rotation
A compromised password could not be rotated from inside the product, and there was no second factor on admin sign-in.
- Платформа#71
Administrative audit log and subject-access/erasure APIs
Security and privacy operations need a reconstructable record of administrative actions, plus a way to export or erase personal data held about an account.
- Змест#72
Theme Customizer: homepage, blog index, footer, design tokens, and dark mode
A site owner should choose the home and blog pages, edit the footer, and control typography, spacing, and light/dark palettes without editing theme files.
- Змест#73
Page builder: saved headers, grid, reusable blocks, animations, and custom CSS
Authors need layout, header, and styling controls in the visual builder without dropping into theme source.
- Змест#74
Post List and Link List blocks
A complete site needs a blog index and reusable link columns without a plugin.
- Пашырэнні#75
First-party Gallery plugin with extra layouts
Image galleries are core website functionality and should install as a first-party package alongside Forms and Analytics.
- Змест#78
Keep selected language in public nav and fall back when a translation is missing
On a multilingual public site, choosing NL (or any non-default locale) must stick for the rest of the visit. Menu links currently drop back to the default language, and…
- Аперацыі#87
Automatic core updates and release discovery in Admin → Updates
Self-hosters currently have to watch for releases and upload justflows.zip by hand from Admin -> Updates. The screen should discover new releases on its own and, when an…
- Змест#92
Customizable 404 and error pages
When a URL does not resolve, or a request fails with 403, 410, 500, or a maintenance error, visitors currently see a generic system page. Operators want these pages to match…
- Платформа#93
Self-service password reset for administrators and users
Administrators and registered users who forget a password currently have no supported self-service recovery. #70 delivered scheduled password rotation, not a reset flow.…
- Змест#96
WordPress-style permalink structure settings
Operators migrating from WordPress and other CMSs expect to control URL structure: date-based, /%postname%/, category-prefixed, custom base paths per content type, and a…
- Змест#98
Scheduled publishing and future-dated content
Authors expect to set a future publish date and have content go live automatically, and to schedule unpublish/expiry for time-limited content. Without it, publishing depends on…
- Змест#100
Redirect manager with 404 logging, import, and export
Site migrations, restructures, and permalink changes create broken inbound links. Operators need to manage redirects in admin instead of editing proxy configuration, and to see…
- Змест#101
Built-in site search for the public frontend and admin
A content platform needs search. Visitors expect a working site search box, and editors expect fast content search in admin. Today there is no first-party search surface for…
- Змест#102
RSS, Atom, and JSON feeds for content
#9 shipped titles, canonicals, sitemap, and robots.txt, but there are no syndication feeds. Readers, aggregators, podcast clients, and newsletter tools expect RSS 2.0, Atom,…
- Платформа#103
Automatic responsive images and modern formats
#29 shipped the media library (local + S3). It stores originals but does not generate responsive sizes or modern formats, so pages ship oversized images and themes hand-build…
- Аперацыі#104
SMTP transport configuration and email delivery log
#63 covers email template design, but there is no admin surface for the transport that actually sends mail, and no visibility into whether messages were delivered. Operators…
- Змест#108
Trash and recycle bin with retention for all content types
Deletion today is effectively permanent, which makes accidental loss unrecoverable without a backup restore (#19). Users expect a trash with a grace period, like every mature CMS.
- Змест#109
Comment spam filtering and submission throttling
#50 shipped public comments and a moderation workflow, and #49 added CAPTCHA to Forms. Comments still need dedicated spam defense or moderation queues fill with junk and…
- Змест#110
Block pattern library and pattern directory
#73 shipped reusable blocks and saved headers. Authors still build common section layouts (hero, feature grid, pricing, testimonial, CTA, FAQ) from scratch each time. A pattern…
- Пашырэнні#113
First-party Cookie consent and script-gating plugin
Sites that use analytics, embeds, or marketing snippets in the EU and similar jurisdictions need a consent banner and a way to gate scripts until consent is given. This…
- Платформа#120
Detect modified Justflows core and extension files
Justflows already verifies .jfpkg archive digests and Marketplace signatures before installing plugins, themes, and CSS providers (#21). That establishes authenticity at…
- #127
Add configurable public-site PWA support
Allow a site owner to turn their public Justflows website into an installable Progressive Web App (PWA), configured entirely from the admin interface. Visitors should be able…
- #132
BUG Webhook DB entry incorrect
On admin/webhooks when creating a new webhook. We get this errot Incorrect datetime value: '2026-09-05T08:42:02.512Z' for column justflows.webhookendpoints.createdat at row 1…
- #135
Headless federated API
Justflows exposes two HTTP surfaces today: the session-cookie management API under /api/ that only the administration SPA drives, and a read-only public content API under…
- #159
Bring your own AI: MCP server and BYOK provider keys for Claude, ChatGPT and Cursor
People already pay for AI tools: Claude (Pro/Max, Claude Code, Claude Desktop), ChatGPT (Plus/Pro/Team), Cursor, or a direct Anthropic / OpenAI API account. Right now none of…
- #165
Uploaded themes lose their Customizer controls
A theme package can add its own Customizer section with a customize block, and name per-block inspector fields with blockControls. Bundled themes do this in…
- Пашырэнні#185
Keep core plugin-agnostic: move remaining first-party plugin code out of core
Core must stay plugin-agnostic. It provides hooks, the SDK, and APIs; it must not know about any specific plugin (plugin ids, settings, routes, admin screens, or catalog…
- Пашырэнні#186
Cookie Consent: ship its admin screen in the plugin, not in core
Cookie Consent's admin screen is a core page, not part of the plugin. Core can't stay plugin-agnostic while it ships a screen for one plugin, and a third-party consent plugin…
- Пашырэнні#187
Cookie Consent: keep the config snapshot per site on multisite
Cookie Consent keeps one in-memory config snapshot for the whole process (plugins/consent/src/state.ts in plugin-registry-service). On a multisite install, one process serves…
- Пашырэнні#188
Forms: serve its endpoints as plugin routes and drop the core /justflows-forms code
Forms has code in core: endpoints, static-export rules, and reserved paths. Core can't stay plugin-agnostic while it does, and a third-party form plugin couldn't get the same…
- Пашырэнні#189
Helpdesk: move the support popup, settings schema, and nav rule out of core
Helpdesk has code in core: the support popup, a settings schema, a CAPTCHA case, and a nav rule. Core can't stay plugin-agnostic while it does. Core code today: -…
- Пашырэнні#190
Gallery: render the block from the plugin and drop the core runtime skip
The Gallery block is rendered by core, and core never starts the Gallery plugin's own code. Core code today: - apps/server/src/lib/media/gallery-public.ts - The Gallery case in…
- Пашырэнні#191
SEO: move head output and editor fields into the plugin and drop hostCooperative
Core still renders SEO output and treats the SEO plugin as a special case. Core code today: - apps/server/src/lib/rendering/seo-public.ts - The justflows.seo runtime skip…
- Вопыт распрацоўніка#192
SDK: let plugins translate their admin menu labels without core catalog keys
A plugin's admin menu label is translated only through labelKey, which looks the key up in core's admin catalogs. That's why core ships nav.forms and nav.consent. Analytics…
- Вопыт распрацоўніка#194
Fix plugin-api test typecheck: operatorKey.ensure test has untyped handler params
The root pnpm typecheck fails in @justflows/plugin-api#typecheck:tests: tests/unit/plugin-hooks.test.ts(273,20): error TS18046: 'context' is of type 'unknown'.…
- Змест#205
Enforce tenant and object authorization across previews, content, media, translations, and API keys
Make tenant, content, media, translation, merge-tag, preview, and API-key authorization consistently enforce the request site and the actor's effective permissions. Parent:…
- Платформа#206
Make MFA, recovery, reset, device sessions, and bootstrap authorization fail closed and atomic
Make MFA, recovery codes, password resets, device sessions, and installation bootstrap authorization fail closed and remain one-time across concurrent workers. Parent: #198. -…
- Платформа#207
Protect and preserve private storage across web servers, object storage, updates, and rollback
Protect private/runtime files and preserve them through delivery, storage migration, core updates, rollback, and failure on every supported hosting stack. Parent: #198. - Keep…
- Пашырэнні#208
Contain and bound TAR and ZIP processing for packages and core updates
Make package and core-update archive processing contained, bounded, non-blocking, and trust-verified on every supported release environment. Parent: #198. - Parse TAR numeric…
- Платформа#209
Public responses repeat identical RateLimit headers from stacked limiters
Public site responses send one RateLimit / RateLimit-Policy pair per policy, instead of the same pair repeated for every limiter the request passes through. A public page…
- Пашырэнні#213
Elsa connector: scaffold first-party multisite plugin and capabilities
Create the first-party Elsa Workflows connector plugin foundation. - Add plugins/elsa-workflows using the established plugin structure. - Declare admin, outbound network, jobs,…
- Платформа#214
Elsa connector: secure connection profiles and credential lifecycle
Connect each workspace securely to a shared tenant-enabled or dedicated Elsa instance. - Store site-scoped mode, placement, URLs, authentication type, Elsa tenant ID, version,…
- Пашырэнні#215
Elsa connector: implement versioned Elsa API client and compatibility detection
Provide one validated server-side adapter for supported Elsa APIs. - Implement probe, definition listing, instance listing/detail, and workflow start. - Add the agreed…
- Пашырэнні#216
Elsa connector: build overview, workflows, and executions admin screens
Expose a useful Elsa dashboard without recreating Elsa Studio. - Build Overview with connection, version, placement, Studio link, counts, sync time, and incidents. - Build…
- Платформа#217
Elsa connector: add safe workflow execution actions and auditing
Let authorized operators start supported workflows safely. - Add confirmed workflow start with bounded JSON input and optional correlation ID. - Enforce execute separately from…
- Пашырэнні#232
Stripe: API client foundation and end-to-end payment create/read
The Shop Stripe gateway (src/payments/stripe/) can verify a key, capture/void/refund an existing PaymentIntent, and verify webhook signatures, but nothing creates or reads a…
- Пашырэнні#233
Stripe: card checkout with Payment Element, PaymentIntents, and SCA/3DS
Customers pay on the storefront checkout with Stripe's Payment Element; card data never touches the Justflows server. - [ ] Load Stripe.js from js.stripe.com with the CSP/HTTP…
- Пашырэнні#234
Stripe: hosted and embedded Stripe Checkout, and Payment Links
Merchants can choose Stripe Checkout (hosted redirect or embedded) instead of the on-page Payment Element, and create Payment Links for orders or products. - [ ] Checkout mode…
- Пашырэнні#235
Stripe: Express Checkout Element with Apple Pay, Google Pay, and Link
One-click wallet buttons on cart, product, and checkout pages. - [ ] Express Checkout Element on checkout; optional on cart and product pages. - [ ] Apple Pay domain…
- Пашырэнні#236
Stripe: local and delayed payment methods (iDEAL, Bancontact, SEPA Debit, Klarna, and more)
Support Stripe's regional and buy-now-pay-later methods, including ones that settle asynchronously. - [ ] iDEAL, Bancontact, EPS, Przelewy24, SEPA Debit, Sofort/successors,…
- Пашырэнні#237
Stripe: Customer sync, SetupIntents, and saved payment methods
Returning customers can save and reuse payment methods; Shop customers map to Stripe Customers. - [ ] Shop customer ↔ Stripe Customer mapping per site, created lazily;…
- Пашырэнні#238
Stripe: subscriptions with Stripe Billing and Shop recurring support
Recurring payments are implemented only for Mollie (src/payments/mollie/mollie-recurring.ts). Stripe does not advertise recurring. Shop subscriptions renew on Stripe, either…
- Пашырэнні#239
Stripe: full webhook coverage, endpoint registration, and replay
parseStripeEvent classifies only payment/charge/dispute events and the merchant must create the endpoint and paste the signing secret manually. - [ ] Create/update the webhook…
- Пашырэнні#240
Stripe: refunds, disputes with evidence submission, and Radar fraud signals
- [ ] Refunds created from Shop refunds with reason and metadata; refund status updates via webhooks, including failed refunds. - [ ] Disputes listed per order with due date,…
- Платформа#251
Security Center: add a filtered security event view
Part of #198. Give administrators a focused, site-scoped security event view without mixing in unrelated content activity. - Security Center links directly to the security…
- Платформа#252
Security Center: add opt-in email notifications for high-value events
Part of #198. Let each site opt in to email notifications for high-value security events while keeping the in-app audit trail available without external mail. -…
- Платформа#254
Document secure self-hosting and deployment boundaries
Part of #198. Publish practical security guidance for operators deploying Justflows CE across supported self-hosting paths. - TLS termination and HTTPS application URLs. -…
- Платформа#255
Document edge WAF, bot, and DDoS integration
Part of #198. Provide a provider-neutral integration approach for putting a CDN, WAF, bot-control layer, or DDoS service in front of Justflows without making it mandatory for…
- Аперацыі#256
Backup foundation: portable local archive and safe restore
First implementation slice of #19 and the recovery phase in #198. Create a portable, bounded local backup archive and a fail-safe restore foundation before adding remote…
- Платформа#258
Publish a versioned threat model and maintain a private control matrix
Part of #198. Maintainers can see who the platform defends against, which assets and trust boundaries matter, and which controls are verified for a named revision. - Publish a…
- Платформа#259
Re-verify authentication, tenancy, and input boundaries against current code
Part of #198. The security baseline reflects the current revision, not historical reports. - Review authentication, MFA/recovery, session revocation, capability and delegation…
- Платформа#260
Verify resource limits and client IP handling across multiple workers
Part of #198. Limits hold when an installation runs more than one worker, and behavior stays bounded when a shared store fails. - Throttling, expensive routes, uploads, image…
- Платформа#261
Require approval when a plugin update changes its permissions
Part of #198. An administrator sees and approves any new permissions before an updated plugin replaces the installed version. - Compare the declared permissions of the…
- Платформа#262
Show core and extension vulnerability status from signed advisories
Part of #198. The Security Center reports whether installed core and extension versions are affected by a published advisory, based on metadata the installation can…
- Платформа#263
Define extension review requirements and connect them to the quality checker
Part of #198. Related to #97. Publishers and reviewers know what an extension must meet before listing, and what a passing check does and does not mean. - Document the…
- Платформа#264
Harden Security Center scope, scans, and states
Part of #198. Security Center visibility and actions are enforced by the server and stay within their resource budgets. - Verify and test site versus network visibility and…
- Аперацыі#265
Report backup readiness and define restore drills and recovery objectives
Part of #198. Builds on #19. Operators can see real backup evidence in the Security Center, and know how to prove that a restore works. - Use backup schedule and destination…
- Аперацыі#266
Establish vulnerability triage and a security release runbook
Part of #198. A private report has a defined path from intake to a coordinated advisory. - Private vulnerability reporting, triage ownership, and supported-version policy. - A…
- Аперацыі#267
Add secret scanning and SBOM verification to CI and releases
Part of #198. A committed credential fails CI, and a release cannot be published with a missing or malformed SBOM. - Run the existing tracked-file secret scan in the CI…
- Платформа#268
Extend security regression suites to upgrade paths and real databases
Part of #198. Security regressions are caught on fresh installs and upgrades, not only in unit tests. - Maintain suites for auth/tenant isolation, package integrity,…
- Змест#283
Add core content visibility rules and a plugin extension hook
Part of #121. Related to #22, #53, and #115. Justflows has one consistent content-visibility contract for every content type. Operators can restrict content by role or…
Гэтая старонка чытае публічны праект Justflows GitHub. Слупкі могуць змяняцца без даты выпуску.
Ваш бясплатны сайт — праз хвіліну
Выберыце назву, і сайт ужо працуе і гатовы да рэдагавання. Без карткі, без сервера, нічога не трэба ўсталёўваць.