feat: free Magic Mark rebuilt on the Strapi Design System

.agents/skills/strapi-plugin-maintenance/SKILL.md

@@ -1,12 +1,16 @@
 ---
 name: strapi-plugin-maintenance
-description: Maintain Magicmark Strapi 5 bookmarks, sharing, license UI and conditional access with reproducible checks.
+description: Maintain Magic Mark (Magicmark), the free Strapi 5 bookmarks and advanced filters plugin, with reproducible checks.
 ---
 
-# Magicmark maintenance
+# Magic Mark maintenance
 
-Use Node 22. Read local rules, query current Strapi 5 plugin/route/permission and Design System docs through Context7, and compare newest compatible 5.x with the workbench pin. Do not store credentials or license keys in skills, traces or Git; never push without an explicit request.
+Use Node 22 or 24. Read local rules and the workbench skills (docs-first, lint-required, strapi-plugin-api, strapi-plugin-security, strapi-admin-ui-ux, strapi-design-system). Never store credentials in skills, traces or Git; never push without an explicit request.
 
-Trace both `server/src/routes/admin.ts` and `server/routes/admin.js`, the controller/services and `admin/src/permissions.ts`. Routes and menu links currently use empty `policies`/`permissions`; do not assume this means unauthenticated access, but prove the admin auth scope and role/permission boundary at runtime. Make a matrix for anonymous, admin lacking permission, allowed admin, bookmark owner and another admin. Check create/reorder/pin/share/delete ownership, role visibility, license key writes and limits server-side. Preserve the intentional share semantics while denying cross-user modification.
+The plugin is free: there is no license system and there must never be outbound requests, timers or tracking. `tests/source-contract.test.cjs` enforces this.
 
-Use Strapi 5 Design System, permission-backed menu and accessible bookmark actions, empty/error/loading states and responsive query-builder layout. Run `npm run build`, `npm run verify`, `npm run test:ts:front`, `npm run test:ts:back`, plus focused owner/deny tests; then shared app build/boot and Playwright CLI navigation. Do not present successful typechecks as proof of authorization.
+Server: `server/src/routes/admin.ts` (every route has `admin::isAuthenticatedAdmin` plus `admin::hasPermissions`), `controllers/bookmarks.ts`, `services/bookmarks.ts` (access rules, sharing rows, per-user pins), `services/maintenance.ts` (3.x migrations, deletion cleanup), `validation.ts` (zod). Keep the route permission matrix in `tests/server-routes.test.cjs` and the README in sync. A bookmark the caller cannot see answers 404; a visible one owned by someone else answers 403 on writes.
+
+Admin: Design System components and `@strapi/strapi/admin` APIs only, no custom styled components or colour literals. One injection in `listView.actions` (Advanced filters + Bookmarks), the bookmarks page, and the homepage widget. Every string uses `msg()` and exists in en, de, fr, es and pt (`tests/admin-i18n.test.cjs`); German copy does not address the reader.
+
+Gates before a commit: `npm run lint`, `npm run format:check`, `npm test`, `npm run test:ts:front`, `npm run test:ts:back`, `npm run build`, `npm run verify`, `npm run verify:runtime`, `npm pack --dry-run`. For UI or permission changes also run the isolated host acceptance (own port, SQLite, synthetic data, egress blocked) with an RBAC matrix (anonymous, admin without permission, owner, other admin, manager) and the Playwright viewport matrix in light and dark mode.

.github/ISSUE_TEMPLATE/bug-report.yml

@@ -7,29 +7,29 @@ body:
     attributes:
       value: |
         ## Thanks for taking the time to report a bug!
-        
+
   - type: textarea
     id: bug-description
     attributes:
       label: 🐛 Bug Description
       description: A clear and concise description of what the bug is
     validations:
       required: true
-      
+
   - type: textarea
     id: expected-behavior
     attributes:
       label: ✅ Expected Behavior
     validations:
       required: true
-      
+
   - type: textarea
     id: actual-behavior
     attributes:
       label: ❌ Actual Behavior
     validations:
       required: true
-      
+
   - type: textarea
     id: reproduction-steps
     attributes:
@@ -41,7 +41,7 @@ body:
         4. See error...
     validations:
       required: true
-      
+
   - type: dropdown
     id: feature-area
     attributes:
@@ -58,7 +58,7 @@ body:
         - Other
     validations:
       required: true
-      
+
   - type: dropdown
     id: content-type
     attributes:
@@ -72,31 +72,31 @@ body:
         - Other
     validations:
       required: false
-      
+
   - type: input
     id: plugin-version
     attributes:
       label: 📦 Plugin Version
       placeholder: e.g. 3.0.2
     validations:
       required: true
-      
+
   - type: input
     id: strapi-version
     attributes:
       label: 🚀 Strapi Version
       placeholder: e.g. 5.29.0
     validations:
       required: true
-      
+
   - type: input
     id: node-version
     attributes:
       label: 🟢 Node Version
       placeholder: e.g. 20.19.4
     validations:
       required: true
-      
+
   - type: dropdown
     id: database
     attributes:
@@ -109,15 +109,15 @@ body:
         - Other
     validations:
       required: false
-      
+
   - type: textarea
     id: error-logs
     attributes:
       label: 📋 Error Logs
       render: shell
     validations:
       required: false
-      
+
   - type: textarea
     id: filter-query
     attributes:
@@ -126,7 +126,7 @@ body:
       render: json
     validations:
       required: false
-      
+
   - type: checkboxes
     id: terms
     attributes:

.github/ISSUE_TEMPLATE/feature-request.yml

@@ -7,7 +7,7 @@ body:
     attributes:
       value: |
         ## Thanks for suggesting a feature!
-        
+
   - type: dropdown
     id: feature-area
     attributes:
@@ -27,29 +27,29 @@ body:
         - Other
     validations:
       required: true
-      
+
   - type: textarea
     id: problem
     attributes:
       label: 🤔 Problem / Use Case
     validations:
       required: true
-      
+
   - type: textarea
     id: solution
     attributes:
       label: 💡 Proposed Solution
     validations:
       required: true
-      
+
   - type: textarea
     id: example
     attributes:
       label: 📝 Example
       description: Show example queries or UI mockups
     validations:
       required: false
-      
+
   - type: checkboxes
     id: terms
     attributes:

.github/PULL_REQUEST_TEMPLATE.md

@@ -1,20 +1,21 @@
-<!-- 
+<!--
 Thank you for contributing to MagicMark! 🎉
 Please fill out this template to help us review your PR.
 -->
 
 ## 📝 Description
-<!-- Provide a clear and concise description of your changes -->
-
 
+<!-- Provide a clear and concise description of your changes -->
 
 ## 🔗 Related Issue(s)
+
 <!-- Link to related issues. Use "Closes #123" or "Fixes #123" to auto-close issues -->
 
 - Closes #
 - Related to #
 
 ## 🎯 Type of Change
+
 <!-- Put an `x` in all boxes that apply -->
 
 - [ ] 🐛 Bug fix (non-breaking change that fixes an issue)
@@ -27,6 +28,7 @@ Please fill out this template to help us review your PR.
 - [ ] ⚡ Performance improvement
 
 ## 🔍 Feature Area
+
 <!-- Which part of the plugin does this affect? -->
 
 - [ ] Query Builder UI
@@ -43,6 +45,7 @@ Please fill out this template to help us review your PR.
 - [ ] Documentation
 
 ## 🧪 Testing
+
 <!-- Describe the tests you ran to verify your changes -->
 
 - [ ] I have tested these changes locally
@@ -53,13 +56,14 @@ Please fill out this template to help us review your PR.
 
 ### Test Environment
 
-- **Plugin Version**: 
-- **Strapi Version**: 
-- **Node Version**: 
-- **Database**: 
-- **OS**: 
+- **Plugin Version**:
+- **Strapi Version**:
+- **Node Version**:
+- **Database**:
+- **OS**:
 
 ### Filter Testing
+
 <!-- If applicable, describe filter scenarios you tested -->
 
 - [ ] Tested with simple filters
@@ -69,11 +73,11 @@ Please fill out this template to help us review your PR.
 - [ ] Tested bookmark sharing
 
 ## 📸 Screenshots/Videos
-<!-- If applicable, add screenshots of query builder or filter results -->
-
 
+<!-- If applicable, add screenshots of query builder or filter results -->
 
 ## 📋 Checklist
+
 <!-- Put an `x` in all boxes that apply -->
 
 - [ ] My code follows the project's code style
@@ -85,17 +89,17 @@ Please fill out this template to help us review your PR.
 - [ ] I have tested query generation and execution
 
 ## 🔄 Breaking Changes
-<!-- If this introduces breaking changes, describe the impact and migration path -->
-
 
+<!-- If this introduces breaking changes, describe the impact and migration path -->
 
 ## 📚 Additional Context
-<!-- Add any other context about the PR here -->
-
 
+<!-- Add any other context about the PR here -->
 
 ---
+
 **PR Title Format**: Please use conventional commits format:
+
 - `feat: add date range filter operator`
 - `fix: resolve relation filter query generation`
 - `docs: update advanced filter examples`

.github/dependabot.yml

@@ -0,0 +1,56 @@
+# Automatic dependency updates. Patch and minor updates are grouped into one weekly PR
+# and merged automatically by .github/workflows/dependency-auto-merge.yml when lint, tests,
+# type checks, build and verify all pass. Major updates get their own PR and wait for review.
+version: 2
+updates:
+  - package-ecosystem: npm
+    directory: /
+    schedule:
+      interval: weekly
+      day: monday
+      time: '06:00'
+      timezone: Europe/Berlin
+    open-pull-requests-limit: 5
+    versioning-strategy: increase-if-necessary
+    commit-message:
+      prefix: 'chore(deps)'
+      prefix-development: 'chore(deps-dev)'
+    labels: [dependencies]
+    groups:
+      minor-and-patch:
+        update-types: [minor, patch]
+    ignore:
+      # These versions are set by the Strapi 5 admin that hosts the plugin.
+      # A major bump here would break the plugin inside Strapi, so it is never proposed.
+      - dependency-name: 'react'
+        update-types: ['version-update:semver-major']
+      - dependency-name: 'react-dom'
+        update-types: ['version-update:semver-major']
+      - dependency-name: '@types/react'
+        update-types: ['version-update:semver-major']
+      - dependency-name: '@types/react-dom'
+        update-types: ['version-update:semver-major']
+      - dependency-name: 'react-intl'
+        update-types: ['version-update:semver-major']
+      - dependency-name: 'react-router-dom'
+        update-types: ['version-update:semver-major']
+      - dependency-name: 'styled-components'
+        update-types: ['version-update:semver-major']
+      - dependency-name: '@strapi/*'
+        update-types: ['version-update:semver-major']
+      # @strapi/sdk-plugin 6.1.1 and typescript-eslint 8 require TypeScript 5.x (< 6.1).
+      - dependency-name: 'typescript'
+        update-types: ['version-update:semver-major']
+  - package-ecosystem: github-actions
+    directory: /
+    schedule:
+      interval: weekly
+      day: monday
+      time: '06:00'
+      timezone: Europe/Berlin
+    commit-message:
+      prefix: 'ci'
+    labels: [dependencies]
+    groups:
+      actions:
+        update-types: [minor, patch]