Общественная дорожная карта
Что мы строим
Дорожная карта Community Edition доступна на GitHub. Предметы перемещаются как рабочие корабли — здесь нет ничего обещанного с датой.
Сейчас
В разработке Community Edition.
- Операции#57
Developer debug mode and Admin diagnostics center
Developers and self-hosters need enough visibility to diagnose plugin, hook, API, job, cache, database, rendering, and update failures without enabling unsafe raw error output…
- Платформа#103
Automatic responsive images and modern formats
#29 shipped the media library (local + S3). It stores originals but does not generate responsive sizes or modern formats, so pages ship oversized images and themes hand-build…
- #135
Headless federated API
Justflows exposes two HTTP surfaces today: the session-cookie management API under /api/ that only the administration SPA drives, and a read-only public content API under…
Далее
Ставится в очередь после прибытия текущего фрагмента.
- Платформа#18
Redis cache adapter
Multi-instance deployments need a shared cache rather than process memory or a local filesystem.
- Операции#19
Backup and restore from admin Tools
Self-hosters need a supported, portable snapshot of content, configuration, and media without operating directly on SQL.
- Платформа#64
Optional separate mobile and desktop cache variants
Responsive sites should normally serve the same HTML and use CSS for different viewport sizes. Some themes, plugins, menus, or integrations may intentionally render different…
- Содержание#92
Customizable 404 and error pages
When a URL does not resolve, or a request fails with 403, 410, 500, or a maintenance error, visitors currently see a generic system page. Operators want these pages to match…
- Содержание#95
Default privacy policy page generator and setting
Most sites need a privacy policy page. Today operators create one by hand with no starting point and no link between "the privacy policy" and the features that reference it…
- Содержание#98
Scheduled publishing and future-dated content
Authors expect to set a future publish date and have content go live automatically, and to schedule unpublish/expiry for time-limited content. Without it, publishing depends on…
- Содержание#101
Built-in site search for the public frontend and admin
A content platform needs search. Visitors expect a working site search box, and editors expect fast content search in admin. Today there is no first-party search surface for…
- Содержание#109
Comment spam filtering and submission throttling
#50 shipped public comments and a moderation workflow, and #49 added CAPTCHA to Forms. Comments still need dedicated spam defense or moderation queues fill with junk and…
Позже
На горизонте, не запланировано.
- Платформа#23
First-class multi-site
The database already scopes records by site, but operators need a supported administration and routing model for multiple properties.
- Платформа#54
Federated admin login, MFA, and session revocation controls
Production administration needs modern identity options and visible session control beyond password-only login.
- Содержание#59
Multiple language selector designs and customization
The existing core.language-switcher correctly resolves localized routes, but presentation is limited to inline language codes or names. Different headers, footers, mobile…
- Платформа#66
Configurable GDPR and PSD2/PSD3 readiness and compliance controls
Organizations need privacy and payment-security controls that match their role, jurisdiction, risk, enabled features, and professional advice. Justflows should provide strong…
- Платформа#94
Safe custom JavaScript and third-party snippet injection
#73 shipped custom CSS in the page builder. Authors also need to add JavaScript — analytics snippets, chat widgets, structured-data blocks, small interactions — per page or…
- Опыт разработчика#97
Plugin and theme quality checker for authors
#10 documents plugin/theme authoring and #21 covers install trust and signing, but authors have no tool that checks a package for quality, compatibility, and security issues…
- Содержание#99
Shareable draft preview links
Editors need to show unpublished or scheduled content to reviewers and stakeholders who do not have admin accounts. Today previewing requires logging in, so review happens over…
- Платформа#105
WebAuthn passkey sign-in for administrators and users
#70 shipped TOTP and #54 covers federated login and session revocation. Passkeys (WebAuthn) are now the strongest widely-supported option: phishing-resistant, no shared secret,…
- Содержание#106
Editorial workflow with draft, review, approval, and publish states
Teams larger than one person need review before publishing. Today content is either a draft or published, and any user who can edit can also publish. Newsrooms and marketing…
- Операции#107
Maintenance mode and coming-soon page
Operators need a supported way to take the public site offline for maintenance, or to run a pre-launch "coming soon" page, without stopping the process or hand-editing a proxy.
- Расширения#111
First-party Related Content plugin
Keeping readers on the site after an article is a core publishing need. There is a first-party Forms, Analytics, and Gallery plugin (#14, #15, #75) but nothing for on-page…
- Расширения#112
First-party Newsletter and subscriber management plugin
Publishers want an owned audience. Today there is no first-party way to collect subscribers, confirm opt-in, and send a broadcast or a post digest. This pairs with the Forms…
- Расширения#114
First-party Announcements and site-wide banners plugin
Operators frequently need a temporary site-wide message: a sale, an incident notice, a policy update, an event countdown. Today this means editing the theme. A small…
- Расширения#115
First-party Paid memberships and subscriptions plugin
Many independent publishers monetise through paid memberships and gated content. There is a hosted marketplace (#13) and a public user system (#56), but no first-party way to…
- Расширения#116
First-party Documentation and knowledge-base theme
A large share of Justflows installs will be product docs, knowledge bases, and internal handbooks. There is a Theme Customizer (#72) and page builder (#73) but no first-party…
- Расширения#117
First-party Portfolio and agency theme
Freelancers, studios, and agencies are a natural audience for a self-hosted site builder. A first-party portfolio/agency theme gives them a polished starting point that shows…
- Расширения#118
First-party Magazine and news theme
News sites, blogs with volume, and multi-author publications need dense, hierarchy-rich layouts that the default theme does not target. A first-party magazine theme exercises…
- Операции#119
OpenLiteSpeed / LiteSpeed hosting and LSCache integration
Justflows already ships a production Nginx config (docker/nginx.conf) and targets Node hosting on Plesk / cPanel, but LiteSpeed and OpenLiteSpeed are a large share of that…
- Платформа#120
Detect modified Justflows core and extension files
Justflows already verifies .jfpkg archive digests and Marketplace signatures before installing plugins, themes, and CSS providers (#21). That establishes authenticity at…
- Расширения#121
First-party Content access control and gating plugin
Publishers frequently need to restrict who can see a page, post, custom-type entry, media file, or download — not only paying subscribers. The roadmap has recurring memberships…
- Расширения#122
First-party Ticketing and event tickets plugin
Operators want to sell tickets — for events, tours, workshops, timed entry, donations-with-admission, or any priced pass — directly from their own site instead of a third-party…
- Расширения#123
First-party Interactive maps plugin
Sites need embeddable, interactive maps — store and office locators, event venues, travel and real-estate listings, coverage areas, hiking routes, data overlays — without…
- #126
Create new patterns
Create new patterns available via the load directory in the pattern panel Create new patterns available via the load directory in the pattern panel
- #127
Add PWA
Add a full working PWA feature Add a full working PWA feature should be able to be fully configurable
Отправлено
Уже в Community Edition.
- Содержание#7
Persist custom content types and fields
Admin → Content Types currently edits types in the browser only. They are not stored in the database or exposed on the API, so custom types cannot survive a reload or drive the…
- Платформа#8
Public content REST API and OpenAPI for headless use
The website promises a typed headless CMS. Plugin authors have @justflows/sdk; frontend consumers still need a stable, documented public content API.
- Содержание#9
Built-in SEO: titles, canonicals, sitemap, and robots.txt
A complete website out of the box needs discoverability without a plugin.
- Опыт разработчика#10
Plugin and theme author documentation
The runtime and SDK exist; authors still need a single path from hello-world to a signed-off .jfpkg.
- Опыт разработчика#11
CI quality gate for core packages
Public CE needs a predictable merge bar: lint, typecheck, and tests on every PR into developers.
- Платформа#12
Admin accessibility pass
The admin is the product for authors. Keyboard paths, names, and contrast should meet a WCAG 2.2 AA bar on the primary flows.
- Расширения#13
Hosted marketplace catalog for community packages
Site owners need a reviewed catalog of plugins and themes that installs directly from Admin → Marketplace.
- Расширения#14
First-party Forms plugin
Contact forms are core functionality for a complete website platform.
- Расширения#15
First-party privacy-friendly Analytics plugin
First-party, on-site analytics provides useful traffic insight without requiring a paid or third-party service.
- Платформа#16
Content webhooks
Headless and integration users need push delivery, not only polling.
- Содержание#17
Locale-aware content routing
Multilingual sites need content locales, translation relationships, localized routes, and language-aware discovery.
- Опыт разработчика#20
Stable SDK compatibility policy
A stable release requires plugin and theme authors to know which public contracts can change and how deprecation works.
- Расширения#21
Plugin signing and install trust
Package installation is a supply-chain boundary and must verify provenance before activation.
- Платформа#22
Role and capability editor in admin
Administrators need more control than selecting one of the five built-in roles.
- Платформа#24
Static / edge export
Static output lets high-traffic public pages be served from object storage or an edge CDN without hitting the Node origin.
- Операции#25
Browser install wizard
Shipped in v0.1.0. Finish setup in the browser after Docker or shared hosting. See README Option A/B.
- Платформа#26
Unified Express server (API + admin + public site)
Shipped in v0.1.0. PostgreSQL, MySQL, and MariaDB. One Node process.
- Содержание#27
Visual block editor and page builder
Shipped in v0.1.0. Eleven core blocks and a drag-and-drop page builder.
- Расширения#28
Plugin and theme runtime (.jfpkg + typed SDK)
Shipped in v0.1.0. Upload packages in admin. Authors use @justflows/sdk.
- Содержание#29
Media library (local + S3-compatible)
Shipped in v0.1.0. Uploads, derivatives, local and S3 adapters.
- Платформа#30
Auth, CSRF, and security admin
Shipped in v0.1.0. Capabilities, signed sessions, PBKDF2, security header pages.
- Операции#31
Caching, health checks, and in-admin updates
Shipped in v0.1.0. Memory/filesystem cache, Tools performance controls, health, updates.
- Содержание#32
WordPress WXR importer (posts and pages)
Shipped in v0.1.0. Admin → Tools accepts a WordPress export .xml.
- Расширения#49
Add configurable CAPTCHA protection to Forms
The shipped Forms implementation has per-IP rate limiting and a honeypot, but automated abuse still needs a challenge option for higher-risk public forms.
- Содержание#50
Complete public user comments and moderation workflow
Comment storage, moderation routes, and an admin moderation page are partially present, but visitors cannot submit or view comments through the public site, so the feature is…
- Платформа#51
Allow administrators to change the admin URL safely
Operators may want the administration entry path to be non-default for policy, branding, or reduction of opportunistic login noise. This is defense-in-depth and must not be…
- Платформа#52
Add a Justflows marketing and discovery section to Admin Home
Admin Home should help operators discover useful Justflows resources, releases, marketplace packages, documentation, and community channels without overwhelming core…
- Платформа#53
Add advanced per-user scope and capability selection
Default roles are convenient but cannot express narrower access such as editing only selected content types, locales, sites, or owned content. This issue complements #22, which…
- Операции#55
Fix migration bookkeeping and PostgreSQL pending-migration reruns
The migration runner calls every name in MIGRATIONORDER on each installed-server startup and never reads migrations. Only 0001initial writes a tracker row; migrations 0002…
- Платформа#56
Replace mock Users admin with real user management API
Administrators need to manage real accounts from Admin → Users. This is distinct from #22: this bug restores the expected fixed-role user-management behavior; #22 adds custom…
- Содержание#58
Site favicon management in Admin and public frontend
Site owners need to select a recognizable browser/app icon without editing theme files or server assets manually.
- Содержание#60
Multiple light and dark mode selector designs
The existing core.color-scheme widget supports light, dark, and optional system behavior, but only basic button and icon presentation. Themes need several polished selector…
- Содержание#61
Dedicated menu designer with horizontal, dropdown, and mega-menu layouts
Admin → Menus can create menus from pages, posts, custom links, and nested child items, but authors cannot visually design navigation behavior or build responsive dropdown and…
- Платформа#63
Customizable system email designs and template editor
Justflows can send system notifications through sendmail or SMTP, but subjects and text bodies are currently assembled in individual routes/services. Site owners need…
- Содержание#65
Working revisions for every content type without overwriting the live version
Authors must be able to edit and save a draft of already-published content without changing what visitors currently see. The draft should become live only through an explicit…
- Платформа#69
Admin server-side rendering for every admin route
Administrators should get a fully rendered admin document on first load. Site owners must never need a frontend build toolchain, and admin screens must not be indexed.
- Платформа#70
TOTP two-factor authentication and password rotation
A compromised password could not be rotated from inside the product, and there was no second factor on admin sign-in.
- Платформа#71
Administrative audit log and subject-access/erasure APIs
Security and privacy operations need a reconstructable record of administrative actions, plus a way to export or erase personal data held about an account.
- Содержание#72
Theme Customizer: homepage, blog index, footer, design tokens, and dark mode
A site owner should choose the home and blog pages, edit the footer, and control typography, spacing, and light/dark palettes without editing theme files.
- Содержание#73
Page builder: saved headers, grid, reusable blocks, animations, and custom CSS
Authors need layout, header, and styling controls in the visual builder without dropping into theme source.
- Содержание#74
Post List and Link List blocks
A complete site needs a blog index and reusable link columns without a plugin.
- Расширения#75
First-party Gallery plugin with extra layouts
Image galleries are core website functionality and should install as a first-party package alongside Forms and Analytics.
- Содержание#78
Keep selected language in public nav and fall back when a translation is missing
On a multilingual public site, choosing NL (or any non-default locale) must stick for the rest of the visit. Menu links currently drop back to the default language, and…
- Операции#87
Automatic core updates and release discovery in Admin → Updates
Self-hosters currently have to watch for releases and upload justflows.zip by hand from Admin -> Updates. The screen should discover new releases on its own and, when an…
- Платформа#93
Self-service password reset for administrators and users
Administrators and registered users who forget a password currently have no supported self-service recovery. #70 delivered scheduled password rotation, not a reset flow.…
- Содержание#96
WordPress-style permalink structure settings
Operators migrating from WordPress and other CMSs expect to control URL structure: date-based, /%postname%/, category-prefixed, custom base paths per content type, and a…
- Содержание#100
Redirect manager with 404 logging, import, and export
Site migrations, restructures, and permalink changes create broken inbound links. Operators need to manage redirects in admin instead of editing proxy configuration, and to see…
- Содержание#102
RSS, Atom, and JSON feeds for content
#9 shipped titles, canonicals, sitemap, and robots.txt, but there are no syndication feeds. Readers, aggregators, podcast clients, and newsletter tools expect RSS 2.0, Atom,…
- Операции#104
SMTP transport configuration and email delivery log
#63 covers email template design, but there is no admin surface for the transport that actually sends mail, and no visibility into whether messages were delivered. Operators…
- Содержание#108
Trash and recycle bin with retention for all content types
Deletion today is effectively permanent, which makes accidental loss unrecoverable without a backup restore (#19). Users expect a trash with a grace period, like every mature CMS.
- Содержание#110
Block pattern library and pattern directory
#73 shipped reusable blocks and saved headers. Authors still build common section layouts (hero, feature grid, pricing, testimonial, CTA, FAQ) from scratch each time. A pattern…
- Расширения#113
First-party Cookie consent and script-gating plugin
Sites that use analytics, embeds, or marketing snippets in the EU and similar jurisdictions need a consent banner and a way to gate scripts until consent is given. This…
- #132
BUG Webhook DB entry incorrect
On admin/webhooks when creating a new webhook. We get this errot Incorrect datetime value: '2026-09-05T08:42:02.512Z' for column justflows.webhookendpoints.createdat at row 1…
На этой странице читается общедоступный проект Justflows GitHub. Столбцы могут меняться без указания даты выпуска.
Готовы к потоку?
Присоединяйтесь к сообществу открытого исходного кода, строящему будущее контентных платформ.