Knowledge Cards - Releases

Added

• Administrators can now hand out editing rights. Until now writing was hard-wired to Nextcloud administrators: there was no way to let a colleague add a page without making them an administrator of the whole server. A new page under Administration → Knowledge Cards lets an administrator pick accounts and groups as editors. An editor has the same rights inside the app as an administrator — creating, editing and deleting collections and pages, uploading media, managing members and the trash bin — and no extra rights at all outside it.
• Editors are chosen once for the whole app, not per collection. Group membership counts, so adding a group is enough; people who join that group later become editors automatically.

Changed

• Only real Nextcloud administrators can change the editor list. Editors match administrators everywhere else in the app, but deliberately cannot appoint or remove editors — otherwise an editor could make themselves permanent and take the decision away from the administrator.
• Wording that promised administrator-only writing was corrected: the visibility hints in the member dialog, the message shown when a write is refused, and the App Store description.
• Accounts and groups that no longer exist are dropped when the editor list is saved, so a mistyped name cannot sit in the list looking as though it grants something.

Note on upgrading

Nothing changes for existing instances until an administrator appoints someone: with an empty editor list the app behaves exactly as it did in 1.6.0.

Fixed

• Sections were counted as cards waiting to be read. A section holds no text and cannot be marked as read, so counting it made progress impossible to finish — a collection with one page and one section sat at "2 pages · 1/2 read (50%)" forever. Reading progress — the collection cover, the sidebar badge and bar, the home cards and the section header — now counts pages only.

Fixed

• An icon chosen while creating a collection came out as an empty frame. The picture is uploaded before the collection exists, so it lands in the shared icon folder, but it was then requested under the new collection's own folder and answered with a 404 — the file was always there, just looked for in the wrong place. Serving now falls back to the shared folder, which also repairs icons uploaded before this release.

Fixed

• A white or light logo uploaded with a transparent background looked like an empty frame, because it sat on a light surface. Icons now carry a hairline shadow — invisible on dark logos, an outline on pale ones. (The upload itself was always fine: a 4000×4000 square PNG scales down and stores correctly.)

• Downscaling only limited the width, so a narrow, very tall picture was uploaded almost full size. Height is now limited too.

• Delete buttons looked washed out on some themes. They took their colour from Nextcloud's --color-error, which a theme may define as a pale warning tint; they now use a fixed red, so a permanent action always looks like one.

Changed

• The ＋ button in the tree asks what to add — a page or a section — instead of silently creating an empty page. Nothing is created until you pick. The same two choices already existed in card menus; now every entry point offers both.
• Reading stays inside the folder you are in. "Next"/"Previous" walk the current folder's cards only — they used to run through the whole instance in one flat order and could jump into a different folder, or another collection entirely — and the cards under a page are its folder's cards, not loosely related pages from everywhere. Word-scored "related pages" is gone with them.
• The trash bin's buttons read "Delete" and "Delete selected" instead of the longer "Delete for good"; the permanence is in the tooltip and the confirmation.

Added

• Cards inside cards, as deep as you like. A card is no longer only a page: it can hold other cards, which can hold their own, without a depth limit. Opening a card shows its own grid of cards, the same way opening a collection does — the "go into a folder" feeling now works at every level.
• The sidebar tree expands and collapses per card; the path to the card you are reading stays open, and search reveals the ancestors of every match instead of showing orphaned children.
• Breadcrumbs show the full path (collection › card › card › …), and every step is clickable.
• A card's context menu and its page footer both offer "Add a card inside".
• The new-collection dialog builds the whole tree up front: every row has a ＋ that adds an indented row beneath it.
• Collection cards show how many cards live inside them.

Changed

• Deleting a card takes everything inside it to the trash bin, and restoring brings the whole branch back. The confirmation says how many cards will go. If a card is restored while its parent is still in the trash, it returns to the top level of its collection rather than becoming unreachable.
• The editor ↔ visitor preview button is hidden for accounts that cannot write; it only ever made sense for editors, and a read-only account is already in visitor mode.

Database

• nextlibrary_pages gains a parent_id column (0 = top level of the collection). Existing pages keep parent_id = 0, so nothing moves and every collection looks exactly as it did before the update.

Fixed

• Adding a page appeared to do nothing. The page was created on the server, but the reading canvas (#viewer) had gone missing from the page, so drawing the new page threw and nothing appeared — and because the error landed in the request's catch, it was reported as "could not save to the server" even though the save had succeeded. The canvas is now recreated if it is missing, and drawing errors are no longer reported as save failures: a failed save and a failed redraw are told apart.

Changed (internal)

• Dropped the redundant 'self' entries added to the page's Content Security Policy. Nextcloud's ContentSecurityPolicy already ships 'self' for scripts, styles and connections (and 'self' data: for fonts), so the extra calls changed nothing. The strict default-src 'none' seen in the browser console comes from Nextcloud's own error pages (a 401 response carries it), which an app's policy cannot influence.

Fixed

• Non-administrators were told "could not save — check your connection" when the real answer was "you are not allowed to do that". Writing is administrator-only, but the "New collection" button was shown to everyone and every failure was reported as a network problem, so a permission rule looked like a broken server. Failures now carry their real cause: 403, 401 and 429 each get their own message.
• Planting the sample collection on an empty instance produced a repeating 403 in the console for non-administrators (POST /api/import is administrator-only). It is now skipped silently — it was never an error, just an optional convenience.
• The reading canvas no longer throws when its container is missing from the page.

Changed (internal)

• Controller permissions moved from docblock annotations (@NoAdminRequired, @NoCSRFRequired, @UserRateThrottle) to the PHP attributes #[NoAdminRequired], #[NoCSRFRequired] and #[UserRateLimit]. Nextcloud still honours the annotations (SecurityMiddleware::hasAnnotationOrAttribute falls back to them and logs a deprecation notice), but they are deprecated and the attributes are the supported form on every version this app targets (Nextcloud 28–34). This is future-proofing, not a bug fix.

Changed (user visible)

• Opening a collection no longer hides the other collections from the sidebar. Creating a collection opens its first page, which used to leave that one collection alone in the tree — it looked as if the existing collections had been deleted. All collections now stay listed; only the current one is expanded.
• The "New collection" and "Trash bin" buttons are hidden for accounts that cannot write (writing stays administrator-only). They used to be shown to everyone and produced a 403 on click.
• Planting the sample collection on an empty instance is skipped silently for non-administrators instead of raising an error toast.

Changed

• Raised the supported PHP version to 8.4 (was capped at 8.3), so the app installs on Nextcloud 34 servers running PHP 8.4. Without this, occ app:install reported the app as not found because no published release matched the server's PHP version.

Changed

• Raised the supported Nextcloud version to 34 (was capped at 31), so the app can be installed on current Nextcloud releases.

Added

• Administrators can now hand out editing rights. Until now writing was hard-wired to Nextcloud administrators: there was no way to let a colleague add a page without making them an administrator of the whole server. A new page under Administration → Knowledge Cards lets an administrator pick accounts and groups as editors. An editor has the same rights inside the app as an administrator — creating, editing and deleting collections and pages, uploading media, managing members and the trash bin — and no extra rights at all outside it.
• Editors are chosen once for the whole app, not per collection. Group membership counts, so adding a group is enough; people who join that group later become editors automatically.

Changed

• Only real Nextcloud administrators can change the editor list. Editors match administrators everywhere else in the app, but deliberately cannot appoint or remove editors — otherwise an editor could make themselves permanent and take the decision away from the administrator.
• Wording that promised administrator-only writing was corrected: the visibility hints in the member dialog, the message shown when a write is refused, and the App Store description.
• Accounts and groups that no longer exist are dropped when the editor list is saved, so a mistyped name cannot sit in the list looking as though it grants something.

Note on upgrading

Nothing changes for existing instances until an administrator appoints someone: with an empty editor list the app behaves exactly as it did in 1.6.0.

Fixed

• Sections were counted as cards waiting to be read. A section holds no text and cannot be marked as read, so counting it made progress impossible to finish — a collection with one page and one section sat at "2 pages · 1/2 read (50%)" forever. Reading progress — the collection cover, the sidebar badge and bar, the home cards and the section header — now counts pages only.

Fixed

• An icon chosen while creating a collection came out as an empty frame. The picture is uploaded before the collection exists, so it lands in the shared icon folder, but it was then requested under the new collection's own folder and answered with a 404 — the file was always there, just looked for in the wrong place. Serving now falls back to the shared folder, which also repairs icons uploaded before this release.

Fixed

• A white or light logo uploaded with a transparent background looked like an empty frame, because it sat on a light surface. Icons now carry a hairline shadow — invisible on dark logos, an outline on pale ones. (The upload itself was always fine: a 4000×4000 square PNG scales down and stores correctly.)

• Downscaling only limited the width, so a narrow, very tall picture was uploaded almost full size. Height is now limited too.

• Delete buttons looked washed out on some themes. They took their colour from Nextcloud's --color-error, which a theme may define as a pale warning tint; they now use a fixed red, so a permanent action always looks like one.

Changed

• The ＋ button in the tree asks what to add — a page or a section — instead of silently creating an empty page. Nothing is created until you pick. The same two choices already existed in card menus; now every entry point offers both.
• Reading stays inside the folder you are in. "Next"/"Previous" walk the current folder's cards only — they used to run through the whole instance in one flat order and could jump into a different folder, or another collection entirely — and the cards under a page are its folder's cards, not loosely related pages from everywhere. Word-scored "related pages" is gone with them.
• The trash bin's buttons read "Delete" and "Delete selected" instead of the longer "Delete for good"; the permanence is in the tooltip and the confirmation.

Added

• Cards inside cards, as deep as you like. A card is no longer only a page: it can hold other cards, which can hold their own, without a depth limit. Opening a card shows its own grid of cards, the same way opening a collection does — the "go into a folder" feeling now works at every level.
• The sidebar tree expands and collapses per card; the path to the card you are reading stays open, and search reveals the ancestors of every match instead of showing orphaned children.
• Breadcrumbs show the full path (collection › card › card › …), and every step is clickable.
• A card's context menu and its page footer both offer "Add a card inside".
• The new-collection dialog builds the whole tree up front: every row has a ＋ that adds an indented row beneath it.
• Collection cards show how many cards live inside them.

Changed

• Deleting a card takes everything inside it to the trash bin, and restoring brings the whole branch back. The confirmation says how many cards will go. If a card is restored while its parent is still in the trash, it returns to the top level of its collection rather than becoming unreachable.
• The editor ↔ visitor preview button is hidden for accounts that cannot write; it only ever made sense for editors, and a read-only account is already in visitor mode.

Database

• nextlibrary_pages gains a parent_id column (0 = top level of the collection). Existing pages keep parent_id = 0, so nothing moves and every collection looks exactly as it did before the update.

Fixed

• Adding a page appeared to do nothing. The page was created on the server, but the reading canvas (#viewer) had gone missing from the page, so drawing the new page threw and nothing appeared — and because the error landed in the request's catch, it was reported as "could not save to the server" even though the save had succeeded. The canvas is now recreated if it is missing, and drawing errors are no longer reported as save failures: a failed save and a failed redraw are told apart.

Changed (internal)

• Dropped the redundant 'self' entries added to the page's Content Security Policy. Nextcloud's ContentSecurityPolicy already ships 'self' for scripts, styles and connections (and 'self' data: for fonts), so the extra calls changed nothing. The strict default-src 'none' seen in the browser console comes from Nextcloud's own error pages (a 401 response carries it), which an app's policy cannot influence.

Fixed

• Non-administrators were told "could not save — check your connection" when the real answer was "you are not allowed to do that". Writing is administrator-only, but the "New collection" button was shown to everyone and every failure was reported as a network problem, so a permission rule looked like a broken server. Failures now carry their real cause: 403, 401 and 429 each get their own message.
• Planting the sample collection on an empty instance produced a repeating 403 in the console for non-administrators (POST /api/import is administrator-only). It is now skipped silently — it was never an error, just an optional convenience.
• The reading canvas no longer throws when its container is missing from the page.

Changed (internal)

• Controller permissions moved from docblock annotations (@NoAdminRequired, @NoCSRFRequired, @UserRateThrottle) to the PHP attributes #[NoAdminRequired], #[NoCSRFRequired] and #[UserRateLimit]. Nextcloud still honours the annotations (SecurityMiddleware::hasAnnotationOrAttribute falls back to them and logs a deprecation notice), but they are deprecated and the attributes are the supported form on every version this app targets (Nextcloud 28–34). This is future-proofing, not a bug fix.

Changed (user visible)

• Opening a collection no longer hides the other collections from the sidebar. Creating a collection opens its first page, which used to leave that one collection alone in the tree — it looked as if the existing collections had been deleted. All collections now stay listed; only the current one is expanded.
• The "New collection" and "Trash bin" buttons are hidden for accounts that cannot write (writing stays administrator-only). They used to be shown to everyone and produced a 403 on click.
• Planting the sample collection on an empty instance is skipped silently for non-administrators instead of raising an error toast.

Changed

• Raised the supported PHP version to 8.4 (was capped at 8.3), so the app installs on Nextcloud 34 servers running PHP 8.4. Without this, occ app:install reported the app as not found because no published release matched the server's PHP version.

Changed

• Raised the supported Nextcloud version to 34 (was capped at 31), so the app can be installed on current Nextcloud releases.

Added

• Administrators can now hand out editing rights. Until now writing was hard-wired to Nextcloud administrators: there was no way to let a colleague add a page without making them an administrator of the whole server. A new page under Administration → Knowledge Cards lets an administrator pick accounts and groups as editors. An editor has the same rights inside the app as an administrator — creating, editing and deleting collections and pages, uploading media, managing members and the trash bin — and no extra rights at all outside it.
• Editors are chosen once for the whole app, not per collection. Group membership counts, so adding a group is enough; people who join that group later become editors automatically.

Changed

• Only real Nextcloud administrators can change the editor list. Editors match administrators everywhere else in the app, but deliberately cannot appoint or remove editors — otherwise an editor could make themselves permanent and take the decision away from the administrator.
• Wording that promised administrator-only writing was corrected: the visibility hints in the member dialog, the message shown when a write is refused, and the App Store description.
• Accounts and groups that no longer exist are dropped when the editor list is saved, so a mistyped name cannot sit in the list looking as though it grants something.

Note on upgrading

Nothing changes for existing instances until an administrator appoints someone: with an empty editor list the app behaves exactly as it did in 1.6.0.

Fixed

• Sections were counted as cards waiting to be read. A section holds no text and cannot be marked as read, so counting it made progress impossible to finish — a collection with one page and one section sat at "2 pages · 1/2 read (50%)" forever. Reading progress — the collection cover, the sidebar badge and bar, the home cards and the section header — now counts pages only.

Fixed

• An icon chosen while creating a collection came out as an empty frame. The picture is uploaded before the collection exists, so it lands in the shared icon folder, but it was then requested under the new collection's own folder and answered with a 404 — the file was always there, just looked for in the wrong place. Serving now falls back to the shared folder, which also repairs icons uploaded before this release.

Fixed

• A white or light logo uploaded with a transparent background looked like an empty frame, because it sat on a light surface. Icons now carry a hairline shadow — invisible on dark logos, an outline on pale ones. (The upload itself was always fine: a 4000×4000 square PNG scales down and stores correctly.)

• Downscaling only limited the width, so a narrow, very tall picture was uploaded almost full size. Height is now limited too.

• Delete buttons looked washed out on some themes. They took their colour from Nextcloud's --color-error, which a theme may define as a pale warning tint; they now use a fixed red, so a permanent action always looks like one.

Changed

• The ＋ button in the tree asks what to add — a page or a section — instead of silently creating an empty page. Nothing is created until you pick. The same two choices already existed in card menus; now every entry point offers both.
• Reading stays inside the folder you are in. "Next"/"Previous" walk the current folder's cards only — they used to run through the whole instance in one flat order and could jump into a different folder, or another collection entirely — and the cards under a page are its folder's cards, not loosely related pages from everywhere. Word-scored "related pages" is gone with them.
• The trash bin's buttons read "Delete" and "Delete selected" instead of the longer "Delete for good"; the permanence is in the tooltip and the confirmation.

Added

• Cards inside cards, as deep as you like. A card is no longer only a page: it can hold other cards, which can hold their own, without a depth limit. Opening a card shows its own grid of cards, the same way opening a collection does — the "go into a folder" feeling now works at every level.
• The sidebar tree expands and collapses per card; the path to the card you are reading stays open, and search reveals the ancestors of every match instead of showing orphaned children.
• Breadcrumbs show the full path (collection › card › card › …), and every step is clickable.
• A card's context menu and its page footer both offer "Add a card inside".
• The new-collection dialog builds the whole tree up front: every row has a ＋ that adds an indented row beneath it.
• Collection cards show how many cards live inside them.

Changed

• Deleting a card takes everything inside it to the trash bin, and restoring brings the whole branch back. The confirmation says how many cards will go. If a card is restored while its parent is still in the trash, it returns to the top level of its collection rather than becoming unreachable.
• The editor ↔ visitor preview button is hidden for accounts that cannot write; it only ever made sense for editors, and a read-only account is already in visitor mode.

Database

• nextlibrary_pages gains a parent_id column (0 = top level of the collection). Existing pages keep parent_id = 0, so nothing moves and every collection looks exactly as it did before the update.

Fixed

• Adding a page appeared to do nothing. The page was created on the server, but the reading canvas (#viewer) had gone missing from the page, so drawing the new page threw and nothing appeared — and because the error landed in the request's catch, it was reported as "could not save to the server" even though the save had succeeded. The canvas is now recreated if it is missing, and drawing errors are no longer reported as save failures: a failed save and a failed redraw are told apart.

Changed (internal)

• Dropped the redundant 'self' entries added to the page's Content Security Policy. Nextcloud's ContentSecurityPolicy already ships 'self' for scripts, styles and connections (and 'self' data: for fonts), so the extra calls changed nothing. The strict default-src 'none' seen in the browser console comes from Nextcloud's own error pages (a 401 response carries it), which an app's policy cannot influence.

Fixed

• Non-administrators were told "could not save — check your connection" when the real answer was "you are not allowed to do that". Writing is administrator-only, but the "New collection" button was shown to everyone and every failure was reported as a network problem, so a permission rule looked like a broken server. Failures now carry their real cause: 403, 401 and 429 each get their own message.
• Planting the sample collection on an empty instance produced a repeating 403 in the console for non-administrators (POST /api/import is administrator-only). It is now skipped silently — it was never an error, just an optional convenience.
• The reading canvas no longer throws when its container is missing from the page.

Changed (internal)

• Controller permissions moved from docblock annotations (@NoAdminRequired, @NoCSRFRequired, @UserRateThrottle) to the PHP attributes #[NoAdminRequired], #[NoCSRFRequired] and #[UserRateLimit]. Nextcloud still honours the annotations (SecurityMiddleware::hasAnnotationOrAttribute falls back to them and logs a deprecation notice), but they are deprecated and the attributes are the supported form on every version this app targets (Nextcloud 28–34). This is future-proofing, not a bug fix.

Changed (user visible)

• Opening a collection no longer hides the other collections from the sidebar. Creating a collection opens its first page, which used to leave that one collection alone in the tree — it looked as if the existing collections had been deleted. All collections now stay listed; only the current one is expanded.
• The "New collection" and "Trash bin" buttons are hidden for accounts that cannot write (writing stays administrator-only). They used to be shown to everyone and produced a 403 on click.
• Planting the sample collection on an empty instance is skipped silently for non-administrators instead of raising an error toast.

Changed

• Raised the supported PHP version to 8.4 (was capped at 8.3), so the app installs on Nextcloud 34 servers running PHP 8.4. Without this, occ app:install reported the app as not found because no published release matched the server's PHP version.

Changed

• Raised the supported Nextcloud version to 34 (was capped at 31), so the app can be installed on current Nextcloud releases.

Added

• Screenshots and a repository link in the app metadata, so the App Store listing shows what the app looks like instead of a wall of text.

Changed

• Contact address updated to saficeylan89@gmail.com.
• Bug report link now points at this app's own repository instead of the old development repository.

Added

• Administrators can now hand out editing rights. Until now writing was hard-wired to Nextcloud administrators: there was no way to let a colleague add a page without making them an administrator of the whole server. A new page under Administration → Knowledge Cards lets an administrator pick accounts and groups as editors. An editor has the same rights inside the app as an administrator — creating, editing and deleting collections and pages, uploading media, managing members and the trash bin — and no extra rights at all outside it.
• Editors are chosen once for the whole app, not per collection. Group membership counts, so adding a group is enough; people who join that group later become editors automatically.

Changed

• Only real Nextcloud administrators can change the editor list. Editors match administrators everywhere else in the app, but deliberately cannot appoint or remove editors — otherwise an editor could make themselves permanent and take the decision away from the administrator.
• Wording that promised administrator-only writing was corrected: the visibility hints in the member dialog, the message shown when a write is refused, and the App Store description.
• Accounts and groups that no longer exist are dropped when the editor list is saved, so a mistyped name cannot sit in the list looking as though it grants something.

Note on upgrading

Nothing changes for existing instances until an administrator appoints someone: with an empty editor list the app behaves exactly as it did in 1.6.0.

Fixed

• Sections were counted as cards waiting to be read. A section holds no text and cannot be marked as read, so counting it made progress impossible to finish — a collection with one page and one section sat at "2 pages · 1/2 read (50%)" forever. Reading progress — the collection cover, the sidebar badge and bar, the home cards and the section header — now counts pages only.

Fixed

• An icon chosen while creating a collection came out as an empty frame. The picture is uploaded before the collection exists, so it lands in the shared icon folder, but it was then requested under the new collection's own folder and answered with a 404 — the file was always there, just looked for in the wrong place. Serving now falls back to the shared folder, which also repairs icons uploaded before this release.

Fixed

• A white or light logo uploaded with a transparent background looked like an empty frame, because it sat on a light surface. Icons now carry a hairline shadow — invisible on dark logos, an outline on pale ones. (The upload itself was always fine: a 4000×4000 square PNG scales down and stores correctly.)

• Downscaling only limited the width, so a narrow, very tall picture was uploaded almost full size. Height is now limited too.

• Delete buttons looked washed out on some themes. They took their colour from Nextcloud's --color-error, which a theme may define as a pale warning tint; they now use a fixed red, so a permanent action always looks like one.

Changed

• The ＋ button in the tree asks what to add — a page or a section — instead of silently creating an empty page. Nothing is created until you pick. The same two choices already existed in card menus; now every entry point offers both.
• Reading stays inside the folder you are in. "Next"/"Previous" walk the current folder's cards only — they used to run through the whole instance in one flat order and could jump into a different folder, or another collection entirely — and the cards under a page are its folder's cards, not loosely related pages from everywhere. Word-scored "related pages" is gone with them.
• The trash bin's buttons read "Delete" and "Delete selected" instead of the longer "Delete for good"; the permanence is in the tooltip and the confirmation.

Added

• Cards inside cards, as deep as you like. A card is no longer only a page: it can hold other cards, which can hold their own, without a depth limit. Opening a card shows its own grid of cards, the same way opening a collection does — the "go into a folder" feeling now works at every level.
• The sidebar tree expands and collapses per card; the path to the card you are reading stays open, and search reveals the ancestors of every match instead of showing orphaned children.
• Breadcrumbs show the full path (collection › card › card › …), and every step is clickable.
• A card's context menu and its page footer both offer "Add a card inside".
• The new-collection dialog builds the whole tree up front: every row has a ＋ that adds an indented row beneath it.
• Collection cards show how many cards live inside them.

Changed

• Deleting a card takes everything inside it to the trash bin, and restoring brings the whole branch back. The confirmation says how many cards will go. If a card is restored while its parent is still in the trash, it returns to the top level of its collection rather than becoming unreachable.
• The editor ↔ visitor preview button is hidden for accounts that cannot write; it only ever made sense for editors, and a read-only account is already in visitor mode.

Database

• nextlibrary_pages gains a parent_id column (0 = top level of the collection). Existing pages keep parent_id = 0, so nothing moves and every collection looks exactly as it did before the update.

Fixed

• Adding a page appeared to do nothing. The page was created on the server, but the reading canvas (#viewer) had gone missing from the page, so drawing the new page threw and nothing appeared — and because the error landed in the request's catch, it was reported as "could not save to the server" even though the save had succeeded. The canvas is now recreated if it is missing, and drawing errors are no longer reported as save failures: a failed save and a failed redraw are told apart.

Changed (internal)

• Dropped the redundant 'self' entries added to the page's Content Security Policy. Nextcloud's ContentSecurityPolicy already ships 'self' for scripts, styles and connections (and 'self' data: for fonts), so the extra calls changed nothing. The strict default-src 'none' seen in the browser console comes from Nextcloud's own error pages (a 401 response carries it), which an app's policy cannot influence.

Fixed

• Non-administrators were told "could not save — check your connection" when the real answer was "you are not allowed to do that". Writing is administrator-only, but the "New collection" button was shown to everyone and every failure was reported as a network problem, so a permission rule looked like a broken server. Failures now carry their real cause: 403, 401 and 429 each get their own message.
• Planting the sample collection on an empty instance produced a repeating 403 in the console for non-administrators (POST /api/import is administrator-only). It is now skipped silently — it was never an error, just an optional convenience.
• The reading canvas no longer throws when its container is missing from the page.

Changed (internal)

• Controller permissions moved from docblock annotations (@NoAdminRequired, @NoCSRFRequired, @UserRateThrottle) to the PHP attributes #[NoAdminRequired], #[NoCSRFRequired] and #[UserRateLimit]. Nextcloud still honours the annotations (SecurityMiddleware::hasAnnotationOrAttribute falls back to them and logs a deprecation notice), but they are deprecated and the attributes are the supported form on every version this app targets (Nextcloud 28–34). This is future-proofing, not a bug fix.

Changed (user visible)

• Opening a collection no longer hides the other collections from the sidebar. Creating a collection opens its first page, which used to leave that one collection alone in the tree — it looked as if the existing collections had been deleted. All collections now stay listed; only the current one is expanded.
• The "New collection" and "Trash bin" buttons are hidden for accounts that cannot write (writing stays administrator-only). They used to be shown to everyone and produced a 403 on click.
• Planting the sample collection on an empty instance is skipped silently for non-administrators instead of raising an error toast.

Changed

• Raised the supported PHP version to 8.4 (was capped at 8.3), so the app installs on Nextcloud 34 servers running PHP 8.4. Without this, occ app:install reported the app as not found because no published release matched the server's PHP version.

Changed

• Raised the supported Nextcloud version to 34 (was capped at 31), so the app can be installed on current Nextcloud releases.

Added

• Screenshots and a repository link in the app metadata, so the App Store listing shows what the app looks like instead of a wall of text.

Changed

• Contact address updated to saficeylan89@gmail.com.
• Bug report link now points at this app's own repository instead of the old development repository.

Added

• Administrators can now hand out editing rights. Until now writing was hard-wired to Nextcloud administrators: there was no way to let a colleague add a page without making them an administrator of the whole server. A new page under Administration → Knowledge Cards lets an administrator pick accounts and groups as editors. An editor has the same rights inside the app as an administrator — creating, editing and deleting collections and pages, uploading media, managing members and the trash bin — and no extra rights at all outside it.
• Editors are chosen once for the whole app, not per collection. Group membership counts, so adding a group is enough; people who join that group later become editors automatically.

Changed

• Only real Nextcloud administrators can change the editor list. Editors match administrators everywhere else in the app, but deliberately cannot appoint or remove editors — otherwise an editor could make themselves permanent and take the decision away from the administrator.
• Wording that promised administrator-only writing was corrected: the visibility hints in the member dialog, the message shown when a write is refused, and the App Store description.
• Accounts and groups that no longer exist are dropped when the editor list is saved, so a mistyped name cannot sit in the list looking as though it grants something.

Note on upgrading

Nothing changes for existing instances until an administrator appoints someone: with an empty editor list the app behaves exactly as it did in 1.6.0.

Fixed

• Sections were counted as cards waiting to be read. A section holds no text and cannot be marked as read, so counting it made progress impossible to finish — a collection with one page and one section sat at "2 pages · 1/2 read (50%)" forever. Reading progress — the collection cover, the sidebar badge and bar, the home cards and the section header — now counts pages only.

Fixed

• An icon chosen while creating a collection came out as an empty frame. The picture is uploaded before the collection exists, so it lands in the shared icon folder, but it was then requested under the new collection's own folder and answered with a 404 — the file was always there, just looked for in the wrong place. Serving now falls back to the shared folder, which also repairs icons uploaded before this release.

Fixed

• A white or light logo uploaded with a transparent background looked like an empty frame, because it sat on a light surface. Icons now carry a hairline shadow — invisible on dark logos, an outline on pale ones. (The upload itself was always fine: a 4000×4000 square PNG scales down and stores correctly.)

• Downscaling only limited the width, so a narrow, very tall picture was uploaded almost full size. Height is now limited too.

• Delete buttons looked washed out on some themes. They took their colour from Nextcloud's --color-error, which a theme may define as a pale warning tint; they now use a fixed red, so a permanent action always looks like one.

Changed

• The ＋ button in the tree asks what to add — a page or a section — instead of silently creating an empty page. Nothing is created until you pick. The same two choices already existed in card menus; now every entry point offers both.
• Reading stays inside the folder you are in. "Next"/"Previous" walk the current folder's cards only — they used to run through the whole instance in one flat order and could jump into a different folder, or another collection entirely — and the cards under a page are its folder's cards, not loosely related pages from everywhere. Word-scored "related pages" is gone with them.
• The trash bin's buttons read "Delete" and "Delete selected" instead of the longer "Delete for good"; the permanence is in the tooltip and the confirmation.

Added

• Cards inside cards, as deep as you like. A card is no longer only a page: it can hold other cards, which can hold their own, without a depth limit. Opening a card shows its own grid of cards, the same way opening a collection does — the "go into a folder" feeling now works at every level.
• The sidebar tree expands and collapses per card; the path to the card you are reading stays open, and search reveals the ancestors of every match instead of showing orphaned children.
• Breadcrumbs show the full path (collection › card › card › …), and every step is clickable.
• A card's context menu and its page footer both offer "Add a card inside".
• The new-collection dialog builds the whole tree up front: every row has a ＋ that adds an indented row beneath it.
• Collection cards show how many cards live inside them.

Changed

• Deleting a card takes everything inside it to the trash bin, and restoring brings the whole branch back. The confirmation says how many cards will go. If a card is restored while its parent is still in the trash, it returns to the top level of its collection rather than becoming unreachable.
• The editor ↔ visitor preview button is hidden for accounts that cannot write; it only ever made sense for editors, and a read-only account is already in visitor mode.

Database

• nextlibrary_pages gains a parent_id column (0 = top level of the collection). Existing pages keep parent_id = 0, so nothing moves and every collection looks exactly as it did before the update.

Fixed

• Adding a page appeared to do nothing. The page was created on the server, but the reading canvas (#viewer) had gone missing from the page, so drawing the new page threw and nothing appeared — and because the error landed in the request's catch, it was reported as "could not save to the server" even though the save had succeeded. The canvas is now recreated if it is missing, and drawing errors are no longer reported as save failures: a failed save and a failed redraw are told apart.

Changed (internal)

• Dropped the redundant 'self' entries added to the page's Content Security Policy. Nextcloud's ContentSecurityPolicy already ships 'self' for scripts, styles and connections (and 'self' data: for fonts), so the extra calls changed nothing. The strict default-src 'none' seen in the browser console comes from Nextcloud's own error pages (a 401 response carries it), which an app's policy cannot influence.

Fixed

• Non-administrators were told "could not save — check your connection" when the real answer was "you are not allowed to do that". Writing is administrator-only, but the "New collection" button was shown to everyone and every failure was reported as a network problem, so a permission rule looked like a broken server. Failures now carry their real cause: 403, 401 and 429 each get their own message.
• Planting the sample collection on an empty instance produced a repeating 403 in the console for non-administrators (POST /api/import is administrator-only). It is now skipped silently — it was never an error, just an optional convenience.
• The reading canvas no longer throws when its container is missing from the page.

Changed (internal)

• Controller permissions moved from docblock annotations (@NoAdminRequired, @NoCSRFRequired, @UserRateThrottle) to the PHP attributes #[NoAdminRequired], #[NoCSRFRequired] and #[UserRateLimit]. Nextcloud still honours the annotations (SecurityMiddleware::hasAnnotationOrAttribute falls back to them and logs a deprecation notice), but they are deprecated and the attributes are the supported form on every version this app targets (Nextcloud 28–34). This is future-proofing, not a bug fix.

Changed (user visible)

• Opening a collection no longer hides the other collections from the sidebar. Creating a collection opens its first page, which used to leave that one collection alone in the tree — it looked as if the existing collections had been deleted. All collections now stay listed; only the current one is expanded.
• The "New collection" and "Trash bin" buttons are hidden for accounts that cannot write (writing stays administrator-only). They used to be shown to everyone and produced a 403 on click.
• Planting the sample collection on an empty instance is skipped silently for non-administrators instead of raising an error toast.

Changed

• Raised the supported PHP version to 8.4 (was capped at 8.3), so the app installs on Nextcloud 34 servers running PHP 8.4. Without this, occ app:install reported the app as not found because no published release matched the server's PHP version.

Changed

• Raised the supported Nextcloud version to 34 (was capped at 31), so the app can be installed on current Nextcloud releases.

Added

• Screenshots and a repository link in the app metadata, so the App Store listing shows what the app looks like instead of a wall of text.

Changed

• Contact address updated to saficeylan89@gmail.com.
• Bug report link now points at this app's own repository instead of the old development repository.

Added

• Administrators can now hand out editing rights. Until now writing was hard-wired to Nextcloud administrators: there was no way to let a colleague add a page without making them an administrator of the whole server. A new page under Administration → Knowledge Cards lets an administrator pick accounts and groups as editors. An editor has the same rights inside the app as an administrator — creating, editing and deleting collections and pages, uploading media, managing members and the trash bin — and no extra rights at all outside it.
• Editors are chosen once for the whole app, not per collection. Group membership counts, so adding a group is enough; people who join that group later become editors automatically.

Changed

• Only real Nextcloud administrators can change the editor list. Editors match administrators everywhere else in the app, but deliberately cannot appoint or remove editors — otherwise an editor could make themselves permanent and take the decision away from the administrator.
• Wording that promised administrator-only writing was corrected: the visibility hints in the member dialog, the message shown when a write is refused, and the App Store description.
• Accounts and groups that no longer exist are dropped when the editor list is saved, so a mistyped name cannot sit in the list looking as though it grants something.

Note on upgrading

Nothing changes for existing instances until an administrator appoints someone: with an empty editor list the app behaves exactly as it did in 1.6.0.

Fixed

• Sections were counted as cards waiting to be read. A section holds no text and cannot be marked as read, so counting it made progress impossible to finish — a collection with one page and one section sat at "2 pages · 1/2 read (50%)" forever. Reading progress — the collection cover, the sidebar badge and bar, the home cards and the section header — now counts pages only.

Fixed

• An icon chosen while creating a collection came out as an empty frame. The picture is uploaded before the collection exists, so it lands in the shared icon folder, but it was then requested under the new collection's own folder and answered with a 404 — the file was always there, just looked for in the wrong place. Serving now falls back to the shared folder, which also repairs icons uploaded before this release.

Fixed

• A white or light logo uploaded with a transparent background looked like an empty frame, because it sat on a light surface. Icons now carry a hairline shadow — invisible on dark logos, an outline on pale ones. (The upload itself was always fine: a 4000×4000 square PNG scales down and stores correctly.)

• Downscaling only limited the width, so a narrow, very tall picture was uploaded almost full size. Height is now limited too.

• Delete buttons looked washed out on some themes. They took their colour from Nextcloud's --color-error, which a theme may define as a pale warning tint; they now use a fixed red, so a permanent action always looks like one.

Changed

• The ＋ button in the tree asks what to add — a page or a section — instead of silently creating an empty page. Nothing is created until you pick. The same two choices already existed in card menus; now every entry point offers both.
• Reading stays inside the folder you are in. "Next"/"Previous" walk the current folder's cards only — they used to run through the whole instance in one flat order and could jump into a different folder, or another collection entirely — and the cards under a page are its folder's cards, not loosely related pages from everywhere. Word-scored "related pages" is gone with them.
• The trash bin's buttons read "Delete" and "Delete selected" instead of the longer "Delete for good"; the permanence is in the tooltip and the confirmation.

Added

• Cards inside cards, as deep as you like. A card is no longer only a page: it can hold other cards, which can hold their own, without a depth limit. Opening a card shows its own grid of cards, the same way opening a collection does — the "go into a folder" feeling now works at every level.
• The sidebar tree expands and collapses per card; the path to the card you are reading stays open, and search reveals the ancestors of every match instead of showing orphaned children.
• Breadcrumbs show the full path (collection › card › card › …), and every step is clickable.
• A card's context menu and its page footer both offer "Add a card inside".
• The new-collection dialog builds the whole tree up front: every row has a ＋ that adds an indented row beneath it.
• Collection cards show how many cards live inside them.

Changed

• Deleting a card takes everything inside it to the trash bin, and restoring brings the whole branch back. The confirmation says how many cards will go. If a card is restored while its parent is still in the trash, it returns to the top level of its collection rather than becoming unreachable.
• The editor ↔ visitor preview button is hidden for accounts that cannot write; it only ever made sense for editors, and a read-only account is already in visitor mode.

Database

• nextlibrary_pages gains a parent_id column (0 = top level of the collection). Existing pages keep parent_id = 0, so nothing moves and every collection looks exactly as it did before the update.

Fixed

• Adding a page appeared to do nothing. The page was created on the server, but the reading canvas (#viewer) had gone missing from the page, so drawing the new page threw and nothing appeared — and because the error landed in the request's catch, it was reported as "could not save to the server" even though the save had succeeded. The canvas is now recreated if it is missing, and drawing errors are no longer reported as save failures: a failed save and a failed redraw are told apart.

Changed (internal)

• Dropped the redundant 'self' entries added to the page's Content Security Policy. Nextcloud's ContentSecurityPolicy already ships 'self' for scripts, styles and connections (and 'self' data: for fonts), so the extra calls changed nothing. The strict default-src 'none' seen in the browser console comes from Nextcloud's own error pages (a 401 response carries it), which an app's policy cannot influence.

Fixed

• Non-administrators were told "could not save — check your connection" when the real answer was "you are not allowed to do that". Writing is administrator-only, but the "New collection" button was shown to everyone and every failure was reported as a network problem, so a permission rule looked like a broken server. Failures now carry their real cause: 403, 401 and 429 each get their own message.
• Planting the sample collection on an empty instance produced a repeating 403 in the console for non-administrators (POST /api/import is administrator-only). It is now skipped silently — it was never an error, just an optional convenience.
• The reading canvas no longer throws when its container is missing from the page.

Changed (internal)

• Controller permissions moved from docblock annotations (@NoAdminRequired, @NoCSRFRequired, @UserRateThrottle) to the PHP attributes #[NoAdminRequired], #[NoCSRFRequired] and #[UserRateLimit]. Nextcloud still honours the annotations (SecurityMiddleware::hasAnnotationOrAttribute falls back to them and logs a deprecation notice), but they are deprecated and the attributes are the supported form on every version this app targets (Nextcloud 28–34). This is future-proofing, not a bug fix.

Changed (user visible)

• Opening a collection no longer hides the other collections from the sidebar. Creating a collection opens its first page, which used to leave that one collection alone in the tree — it looked as if the existing collections had been deleted. All collections now stay listed; only the current one is expanded.
• The "New collection" and "Trash bin" buttons are hidden for accounts that cannot write (writing stays administrator-only). They used to be shown to everyone and produced a 403 on click.
• Planting the sample collection on an empty instance is skipped silently for non-administrators instead of raising an error toast.

Changed

• Raised the supported PHP version to 8.4 (was capped at 8.3), so the app installs on Nextcloud 34 servers running PHP 8.4. Without this, occ app:install reported the app as not found because no published release matched the server's PHP version.

Changed

• Raised the supported Nextcloud version to 34 (was capped at 31), so the app can be installed on current Nextcloud releases.

Added

• Screenshots and a repository link in the app metadata, so the App Store listing shows what the app looks like instead of a wall of text.

Changed

• Contact address updated to saficeylan89@gmail.com.
• Bug report link now points at this app's own repository instead of the old development repository.