DEV Community: Tomasz

OpenSparrow v3.7 - brings an automation email queue to the admin panel and unifies the entire admin UI

Tomasz — Fri, 18 Sep 2026 05:58:12 +0000

OpenSparrow v3.7 brings an automation email queue to the admin panel and unifies the entire admin UI around a single section-card pattern. The email queue gives admins full visibility and control over outgoing automation emails — filter, requeue, bulk delete, purge — while the rest of the release is a consistent overhaul of how admin screens are built: one card style, one width, one typography scale, one statistics tile pattern. Below is a breakdown of what changed and why it matters.

Automation email queue

A new section in Admin → System → Cron lists the queued automation emails stored in the existing spw_automation_emails table. Until now those rows were written by the notification cron but invisible from the UI — if a message bounced or sat undelivered, there was nowhere to see it.

Filter the queue by status — pending / sent / error — with live per-status counters
Bulk requeue resets the attempts counter and error message, so failed sends retry cleanly
Bulk delete works on up to 500 rows at once
Purge by status, optionally limited to entries older than a configurable retention window

The queue tab reports a missing table instead of failing, so an instance that never ran email automations degrades gracefully.

RAG document preview

A Preview button in the Centrum AI documents list opens a modal with the stored document content — filename, tags, size and dates included — so you can inspect what the RAG pipeline actually chunked without downloading the file. The rechunk action now shows success feedback, and the documents table respects container width with vertically stacked action buttons on narrow screens.

The RAG section is now Centrum AI

The admin section formerly known as RAG is renamed to Centrum AI across the sidebar, breadcrumbs, demo copy and guidance docs. The RAG settings fields gained explanatory tooltips covering context-file limits, upload size and timeout constraints — previously you had to check the docs to know what a field accepted.

One admin UI pattern instead of twenty

The bulk of the release is invisible until you open two tabs side by side. Every settings form, data table and log in the admin panel now renders inside a buildSectionCard section with a consistent header style:

Section cards are never nested — one card is one section, a tab is a flat sequence of cards in reading order
All settings tabs share one width via the .admin-page wrapper; per-panel max-width inline styles were removed
Statistics and log tabs (External API Usage, Click Statistics, Cron email queue, Users) follow the same tile-grid pattern as Centrum AI → Query Statistics
Typography was unified to three sizes and two weights via CSS tokens; .adm-sec-hdr styling now lives in the stylesheet instead of inline overrides

Fixed

Admin tab renderers no longer wipe section descriptions when re-rendering a tab — content is now rendered into the inner content div instead of replacing the whole panel.

Upgrade note

No database migration and no configuration keys are removed by this release. The email queue operates on the existing spw_automation_emails table (created by earlier releases); if the table does not exist, the queue tab says so instead of erroring.

Following this series?

OpenSparrow v3.6 — External API Module with Encrypted Read-Only Keys

Websites

https://opensparrow.org

OpenSparrow v3.6 adds an External API module

Tomasz — Tue, 08 Sep 2026 15:41:24 +0000

OpenSparrow v3.6 adds an External API module that lets admins expose table data to external services through read-only, encrypted API keys. Each key is bound to a single table with a fixed column set, server-side filters and a row limit, and is served by a sessionless JSON endpoint that accepts nothing from the client except the key itself. Below is a breakdown of what changed and why it matters.

External API module

A new Admin → System → API tab lets admins define read-only API keys. Each definition is bound to one schema table, a chosen set of columns, fixed server-side filters and a row limit, so the data an external service can see is decided entirely by the admin — never by the caller.

Keys are stored encrypted (key_enc) plus an HMAC key_hash for constant-time lookup, and are never returned to the browser after generation
A new or regenerated key is generated server-side and shown exactly once in a modal
Filter values are type-checked against the column's schema type on save, so a stored filter can't 500 at query time

A sessionless JSON endpoint

public/api/external.php is the single endpoint. External services authenticate with an Authorization: Bearer <key> header and receive JSON rows.

The endpoint accepts no table, column or filter names from the client — everything comes from the config
Hidden and system (spw_) tables are refused, both on save and at request time
Rate limiting is enforced per key and per IP, answering 429 with a Retry-After header
Responses are 401 (missing/bad key), 403 (disabled), 404 (configured table gone) and 429 (rate limited)

Usage statistics

A new spw_external_api_log table records each successful request — API, table, rows returned and duration — with a stats/log view and a purge action in the admin module, so you can see exactly how your keys are being used.

Changed

includes/db.php gained sys_table_prefix() / is_system_table() helpers so the endpoint can refuse system tables.
includes/crypto.php gained secret_hash() (HMAC-SHA256) so keys can be matched without decrypting every entry.

Fixed

nginx and Apache configs now forward the Authorization header to PHP (fastcgi_param HTTP_AUTHORIZATION / SetEnvIf), so Bearer auth works out of the box instead of silently 401ing.

Upgrade note

No database migration and no configuration keys are removed by this release. The external_api config key is created on first save; an unknown key is ignored, so the document upgrades itself.

Following this series?

OpenSparrow v3.5 — Language Selector, Searchable FK Pickers and Notification Timestamps

Websites

https://opensparrow.org

OpenSparrow v3.5 - Login language selector, searchable FK pickers & notification polish

Tomasz — Fri, 04 Sep 2026 15:13:20 +0000

OpenSparrow v3.5 is a usability release that adds a language selector to the login page, searchable foreign-key pickers, and notification timestamps, while unifying the notifications dropdown with the shared panel style. This update makes the app friendlier for international users, speeds up data entry on long foreign-key lists, and tidies a few small UI details. Below is a breakdown of what changed and why it matters.

Language selector on the login page

Users can now pick their locale before signing in. The login form gains a language <select> populated from the available locales, and the <html lang> attribute follows the active locale so screen readers and browsers render the page in the right language from the very first screen.

Locale is chosen before authentication, so the whole session starts in the user's language
The <html lang> attribute now tracks the active locale instead of a hardcoded value
Selection is driven by I18n::availableLanguageMeta(), so new locales appear automatically

Searchable foreign-key pickers

Edit and create forms replace the plain <select> on foreign-key fields with a searchable input backed by a <datalist>. Long FK lists are now filterable by typing instead of scrolling through a dropdown.

New public/assets/js/edit/fk-search.js wires up the search behaviour
Typing filters the datalist; the selected value is synced to a hidden field carrying the real FK id
Blurring with an unmatched value restores the original label, so invalid selections can't slip through

Notification timestamps

Each item in the notifications dropdown now shows its created_at time, formatted with the browser's locale. You can tell at a glance how old a notification is.

GitHub link in the footer

A GitHub lockup badge now links to the project repository from the footer, so the source is one click away from anywhere in the app.

Changed

The notifications dropdown was unified with the shared bp-panel style (header, close button, overlay) instead of its own bespoke markup.
Notes UI strings are now translated into all 19 locales.

Fixed

The #debug bar no longer flashes before JS hides it on page load — it is now hidden inline.

Upgrade note

No database migration and no configuration keys are removed by this release. Upgrading is a drop-in replacement.

Following this series?

OpenSparrow v3.4 — Material Symbols Outlined and a Searchable Icon Picker

Websites

https://opensparrow.org

OpenSparrow v3.4 — replaces the bundled icon set with Material Symbols Outlined and adds a searchable icon picker

Tomasz — Wed, 02 Sep 2026 06:30:41 +0000

OpenSparrow v3.4 is a design-focused release that replaces the bundled icon set with Material Symbols Outlined and adds a searchable icon picker to the admin panel. This update modernizes the visual language across the whole application, gives admins a fast way to find the right icon, and cleans up a handful of smaller UI details. Below is a breakdown of what changed and why it matters.

Material Symbols Outlined

The bundled icon set has been replaced with Google's Material Symbols Outlined. The new set lives in public/assets/icons/material/ and carries the full collection — 3,899 SVG files at optical size 24, normalized to 48×48 so they match the intrinsic size of the PNG icons they sit next to.

84 files removed from public/assets/icons/ (83 PNG plus chevron-down-white.svg)
The dropdown arrow on <select> elements is now an inline data URI in styles.css
Eight PNG icons the system still references by name (book_3s, delete, folder_zip, grid_on, notifications, picture_as_pdf, search, settings) stay where they are
Generated manifests (index.json, tags.json, README.txt) ship alongside the SVGs

Searchable icon picker

The icon field in the admin now gets a proper picker instead of a bare text input:

Matches icon names and the full Google tag list
Understands common Polish words (e.g. "ciężarówka" → local shipping)
Category chips for quick filtering
Remembers recently picked icons in the browser

Upgrade note: icon paths live in the database

This is the one thing to know before upgrading. Icon paths are stored in the database, not in code — the menu_icon keys of the dashboard, calendar, files, board, views and workflows config, the per-table icon in the schema config, and the printout icons.

A stored path naming one of the removed files stays valid as far as validation is concerned and renders as a broken image — nothing rewrites those values automatically. Repoint them in the admin with the Browse picker. 79 of the 84 removed names have an identically named .svg under assets/icons/material/, so assets/icons/NAME.png usually becomes assets/icons/material/NAME.svg. The exceptions are calendar.png (use calendar_month.svg) and folder_zip_blue.png, grid_on_blue.png, picture_as_pdf_blue.png, which have no direct counterpart.

No database migration and no configuration keys are removed by this release.

Also in this release

Removed the GitHub link from the login page
Fixed demo image seeding; long lines wrapped; Files menu icon unified
Updated grid action icon names in the admin docs
Refreshed module demo video links and images in the README

Following this series?

OpenSparrow v3.3 — Click Statistics, Production Readiness Checks, and Deployment Hardening

Websites

https://opensparrow.org

MatrAIx consists of 8.3 billion agent-persons who statistically represent the entire human population

Tomasz — Fri, 28 Aug 2026 20:52:27 +0000

It is an open-source research community that has created an infrastructure for simulating user behavior. At its core is a database of 8.3 billion virtual agents (personas) that statistically represent the entire human population, allowing digital products and AI to be tested without involving real people.

How are users created?
Personas are created using a hybrid approach—combining real-world data (Wikipedia, surveys) and synthetic data (generated by AI). Each of the 8.3 billion personas has 1,290 detailed traits (demographics, psychology, skills) and is then materialized as an LLM agent that makes decisions.

How do you use them technically?

Resources: Download a ready-made set of 1 million personas from Hugging Face (or the full 8B dataset).
Requirements: You’ll need Docker, uv (Python), Node.js, and API keys (primarily from Anthropic).
Setup: Clone the repo, install dependencies, and download the data.
Running: Create test tasks (surveys, chat, browser, app) and run them on individual personas, in batch mode, or via the Playground GUI.
Applications: Market research, chatbot testing, website usability assessment, and evaluation of AI models for different user groups.

The developers emphasize that MatrAIx is intended for preliminary testing and hypothesis evaluation, but does not fully replace final testing with real people. An interesting application is simulating user behavior in applications (Web & App UI/UX): Agents interact with websites or apps (by controlling the browser or default API) to test purchase paths and the intuitiveness of the interface.

What does the trained data look like (data structure)?
It consists of structured attribute profiles (JSON / Parquet).

Before an agent is used, its attributes are dynamically converted into a system prompt for the LLM.

On the project website, you'll find something interesting: graphical interface at matraix.ai/playground

You select a persona (e.g., from the Persona-1M database based on filters such as age, country, and education).
You choose one of 8 tasks (e.g., Web Browsing or Survey).
You run the simulation and observe in real time (or analyze in the summary) how that profile performs the assigned task.

Website: matraix.ai

What do you think of this project?
In what areas can this project be used?

OpenSparrow v3.3 — Click Statistics, Production Readiness Check, and Deployment Hardening

Tomasz — Thu, 20 Aug 2026 18:25:47 +0000

OpenSparrow v3.3 is a stability‑focused and deployment‑focused release that brings real‑world operational visibility, a production‑readiness checklist, and a full hardening pass across environment variables and configuration defaults.

This update introduces an optional Click Statistics module, expands the Admin Health Check into a proper production‑readiness validator, and tightens deployment settings for anyone running OpenSparrow outside a local dev box. Below is a detailed breakdown of what changed, why it matters, and how it improves day‑to‑day operations.

Click Statistics

A new optional module — off by default, and off genuinely means off.
When the module disabled, no collector script is emitted, nothing is downloaded, and the endpoint returns 204 without writing even if a page stays open across a toggle‑off.

Records who clicked what, when, on which page, and optionally the table/record in context (“Record Table And Record” can be turned off to keep entries to just user/time/element)
Log tab: recent clicks newest‑first, filterable by element and user, with a Top Elements rollup of the 20 most‑clicked elements
Retention: “Delete Automatically After N days” (default 90, 0 = keep forever) enforced by the notifications cron so the table doesn’t grow unbounded

Admin Health Check: Production Readiness tab

Health Check now includes a dedicated tab answering is this deployment actually production‑ready? instead of just “is the database reachable.

It validates:

APP_ENV
demo mode being off
secure cookies
HTTPS (including behind reverse proxies via X-Forwarded-Proto / CF-Visitor)
display_errors off
Argon2id availability
minimum password length of 12
API rate limiting configuration
SESSION_SAMESITE
trusted‑proxy‑header configuration

Existing checks were refreshed as well — minimum supported PHP version now correctly requires 8.4, matching the rest of the codebase.

Deployment hardening

A broad pass through .env.example and includes/config.php:

every environment variable is now documented
numeric config values are clamped to sane ranges
APP_TIMEZONE and SESSION_SAMESITE are validated instead of trusted blindly
new settings cover: APP_URL, STORAGE_PATH, SESSION_COOKIE_NAME, DB_SSLMODE, API rate limiting, statement/SMTP/HTTP client timeouts, session idle timeout, Argon2 tuning, and a trusted‑proxy IP list

Additional hardening:

API throttle now fails open (instead of blocking all requests) if its state store becomes unwritable
libpq connection‑info values are quoted
CSP report URI restricted to same‑origin

Also in this release

Optional first name, last name, email, and phone fields on admin user accounts (informational only — not used for login, ownership, or notifications)
Logo and favicon refreshed; login/admin brand text sized down to match
Large internal cleanup: PHP/JS variable names expanded from abbreviations to full words, public API endpoints moved behind typed controllers (App\Controller), and die() / exit() replaced with a typed exception hierarchy — no behavior change, but relevant if you track the codebase

Following this series?

OpenSparrow v3.2 — Per‑User Access Control, Materialized Views in RAG, and a Business Design Refresh

Websites

https://opensparrow.org

OpenSparrow v3.2 - Per-User Access Control, Materialized Views in RAG, and a Business Design Refresh

Tomasz — Thu, 13 Aug 2026 14:22:39 +0000

OpenSparrow v3.2 is a security‑focused and consistency‑focused release that strengthens access boundaries, improves AI‑driven aggregate queries, and unifies the entire admin and frontend experience under one design system.

This update introduces per‑user access control across all major scopes, brings materialized‑view support to RAG aggregate queries, and delivers a full visual refresh that aligns every UI surface with the new Business design language.

Below is a detailed breakdown of the changes, including how they work, why they matter, and what they unlock for real deployments.

Per-user access control

New Users → Access tab. Each user gets independent allow‑lists across five scopes — tables, views, printouts, boards, workflows — stored as user_table_access in config.

The default is unrestricted: an absent or empty list means “no restriction”, not “no access”. To fully cut a user off, deactivate the account instead.

Enforced at the API boundary by default, not just hidden in the UI — os_api_action() / os_api_dispatch() gate table, view, print, board, and workflow endpoints, and FK/file/comment/mass‑edit/data‑cleanup endpoints were extended to respect the same restrictions
Granting a board or workflow does not implicitly grant the tables it touches — a board whose table isn’t granted won’t show up, and a workflow drops if any step targets a table the user can’t reach
Hidden tables (no menu entry, no grid) can’t be ticked and are granted automatically
Delegated FK lookups and the schema endpoint are now scoped to what the requesting user can actually access, and the file listing is filtered by record ownership

RAG: materialized views as aggregate views

The aggregate‑view feature from 3.1 (attach a PostgreSQL view to a table so the AI assistant can answer exact “total/how many” questions) now also accepts materialized views, flagged as such in the admin UI — useful when the aggregate query is expensive enough that you’d rather refresh it on a schedule than recompute it on every chat message.

Views sync also discovers materialized views alongside regular ones.

A unified “Business” look

The admin panel, setup wizard, and frontend were unified onto a single Business 4+1 color palette and one system‑ui font stack, replacing a mix of ad-hoc colors and font declarations across dozens of JS/CSS files.

Every front‑end button now shares one height, weight, border radius, and font size instead of drifting per page.

Also in this release

CRM demo: richer install description, plus optional demo‑user and audit‑history install toggles
Release packaging excludes creator/, dist-local/, and storage/tmp/ from image and release archives
Admin docs updated to match actual current module behavior across several sections

Websites

opensparrow.org

Discussion

I encourage a substantive discussion, and I'll do my best to answer any questions regarding implementation and configuration.

OpenSparrow v3.1 - RAG assistant, Record Image Galleries, and Workflow Stored Procedures

Tomasz — Thu, 06 Aug 2026 06:12:57 +0000

Automation rules can now call out to n8n, the RAG assistant can answer exact aggregate questions via admin-configured views, tables can have their own image galleries, workflow steps can run a PostgreSQL stored procedure, and the grid gets conditional row highlighting.

Automations: n8n webhooks

The Automations admin is now split into two tabs - Record (the existing field-update/notification/create-record rules) and n8n. The n8n tab lets a rule fire an outgoing webhook to an n8n workflow instead of (or alongside) the built-in actions, with webhook credentials encrypted at rest. Useful for handing off to Slack, email marketing, or any of the hundreds of services n8n already integrates with, without writing custom PHP.

RAG assistant: aggregate views

The AI assistant used to be limited to whatever was on the current grid page, so it had to refuse "how many / total" questions about the whole table. In 3.1, an admin can attach a PostgreSQL view (schema.view) to a table under RAG settings - a pre-vetted, read-only aggregate query. When that table's page is open, the assistant runs the view (capped at a configurable row limit) and gets the exact figures fenced into the prompt as authoritative data, separate from page content and record text.

The model still never writes or chooses the query itself - it only ever sees the output of a view an admin explicitly configured, with an extra guard that skips owner-restricted tables since a plain view has no per-user filter. The result: questions like "what's the total invoice value this quarter" get an exact answer instead of "I can only see this page."

Record image galleries

New per-table image galleries - configure an image column and records show a thumbnail strip in the grid plus an upload gallery on the edit form.

Comes with full Cypress E2E coverage and demo data (contact photos in the CRM demo).

Workflow steps: PostgreSQL procedure hook

Workflow steps can now call a PostgreSQL stored procedure as part of a guided flow, in addition to the existing table-form steps. The CRM demo ships a worked example. Combined with the record-image upload option added to workflow steps, workflows can now do a lot more than collect form fields.

Grid: conditional row highlighting

Schema-configured row highlight rules color entire grid rows based on column conditions - e.g. flag overdue invoices or high-value deals at a glance - seeded with an invoice example in the CRM demo.

Grid hover/crosshair styling was also reworked: a vertical column highlight alongside the existing row highlight, solid accent header fills, and a fix for the FK cell tooltip getting stuck over open dropdowns.

Also in this release

Notes reminders now take a date and time, not just a date
Optional CRM demo install directly from the first-run setup wizard
RAG: grid context now built from the actual data model and fenced in the prompt, with a hardened no-answer/partial-answer prompt
Security: all admin write actions are now guarded by require_not_demo(), closing a demo-mode bypass in five admin actions; additional CSRF/demo-mode gaps fixed
License compliance pass: SPDX headers, NOTICE file, canonical FSF license texts, and initials-on-color avatars replacing bundled stock photos
spw_* system tables now carry COMMENT ON descriptions for easier DB introspection

Following this series?

OpenSparrow v3.0 - GDPR Anonymization Goes Production, User Records/Comments, and Ollama Cloud

Websites

opensparrow.org
github.com/wrobeltomasz/OpenSparrow
demo.opensparrow.org

OpenSparrow v3.0 - GDPR anonymization, ETL, PostgreSQL-Native Config, and a Unified UI

Tomasz — Sat, 25 Jul 2026 09:32:17 +0000

OpenSparrow v3.0 is out. The GDPR anonymization module introduced in 2.9 is now fully covered by end-to-end tests and runs on the new PostgreSQL-native config store, the user menu gets a "My comments" panel and a restyled "My records" list, and the RAG assistant can talk to Ollama Cloud.

Data Anonymization (GDPR/EDPB) - hardened for production

The anonymization module (System > Anonymization) - per-column rules with a date threshold, dry-run preview, EDPB-style risk reports, and a scheduled cron worker - now has full end-to-end test coverage, so rule creation, scheduling, and the dry-run/report flow are regression-tested on every release. It also picked up a dedicated tile on the admin overview dashboard for quicker access alongside ETL, Print, and Workflows.

Under the hood, anonymization rules moved along with the rest of the app's configuration onto the new spw_config PostgreSQL store (see below), which means rule changes now get the same optimistic locking and full audit trail as everything else - no more silently-clobbered config files.

User Records & My Comments

My comments - a new panel in the avatar menu lists every comment you've written, newest first. Each entry shows the start of the comment plus which table/record it belongs to; clicking it jumps straight to that record's Comments tab.
My records restyled - the existing "My records" quick list (records assigned to you, configured per table in admin) now shows the assignment date next to each entry, and a bug where the admin's "clear config" action didn't actually persist has been fixed.

RAG assistant: Ollama Cloud

The AI assistant's admin settings gained an encrypted Ollama Cloud API key field - stored encrypted at rest, sent as a Bearer token, and never shown back in the UI (only whether one is configured, with a button to clear it). This lets the assistant use the paid Ollama Cloud tier instead of a local Ollama install. The cloud connectivity check timeout was also bumped from 8s to 30s after real-world testing showed the shorter window was too aggressive.

Also in this release

Application configuration (schema, menu, dashboard, calendar, automations, users, anonymization rules...) moved from JSON files into a spw_config PostgreSQL table with optimistic locking and full change history
New Print module for block-based report templates
Views got grid-style filters, row grouping with subtotals, and inline drill-down
A UI unification pass across admin and frontend - shared search/filter bar, one button component, unified typography, collapsed row actions
Multiple Kanban boards, a private Notes panel with reminders, and a configurable password policy for users
New admin module - System > ETL. Define named source connections (MySQL, MariaDB, PostgreSQL, SQLite, or a CSV file over FTP/FTPS), then jobs that load them into local PostgreSQL tables.

Following this series?

OpenSparrow v2.9 - GDPR Anonymization, Automation Emails, and a PHP 8.4 Refactor

Websites

opensparrow.org
github.com/wrobeltomasz/OpenSparrow
demo.opensparrow.org

OpenSparrow v2.9 – GDPR Anonymization, Automation Emails, and a PHP 8.4 Refactor

Tomasz — Mon, 06 Jul 2026 18:11:44 +0000

OpenSparrow v2.9 is out. The headline feature is a full data anonymization module for GDPR compliance, alongside new automation actions, dashboard/calendar filtering, and a codebase modernized for PHP 8.4.

Data Anonymization (GDPR/EDPB)

New admin module — System → Anonymization. Define per-column rules (table, column, replacement value) to scrub PII on a schedule.

Four tabs — Rules (CRUD + run history), Schedule (manual/daily/weekly/monthly + Run Now), Suggestions (scans your schema's column names against a PII keyword dictionary and proposes rules), Dictionary (edit keywords, purge old logs)
Dry-run preview — see exactly how many rows each rule would affect via COUNT(*) with the rule's WHERE clause, before touching any data
EDPB compliance reports — every run writes a structured JSON report (linkability/inference/single-out risk assessment per rule) to a dedicated report table, viewable and downloadable from Run History
A companion CLI cron worker enforces the configured frequency window internally, so a simple daily OS scheduler entry covers all modes

Automations: email actions

The rule engine gains an email action — queue a message to be sent when a rule fires, with templated recipients/subject/body ({{ record.field }}, {{ old_record.field }}, {{ current_user.id }}, {{ today }}). Delivery runs async through the notifications cron with retry/attempt tracking and header-injection protection.

Also added: numeric/date comparison operators (>, <, >=, <=) and change-detection operators (changed, changed_from, changed_to) for writing more precise trigger conditions, plus a quick enable/disable toggle and a "Duplicate rule" button.

Dashboard & calendar filters

Dashboard — a global period filter (All time / Today / 7d / 30d / This month) reloads every widget; count/sum cards now show deltas vs. the previous period, and widgets can be exported to CSV directly from the dashboard
Calendar — a filter bar lets you toggle event sources on/off per configured table color

PHP 8.4 refactor

The whole backend was modernized for PHP 8.4: enums for user roles, readonly classes and constructor property promotion, #[\Override] attributes on interface implementations, json_validate(), first-class callable syntax, and hardened type hints across the DB/repository layer. CI now targets PHP 8.4/8.5.

Page bootstrapping was also consolidated — the repeated session/CSRF/CSP-header boilerplate that used to be copy-pasted at the top of every page now lives in a single os_page_bootstrap() / os_boot_app() helper.

Following this series?

OpenSparrow v2.8 – Kanban board, MySQL Gateway, and major security hardening

Websites

opensparrow.org
github.com/wrobeltomasz/OpenSparrow
demo.opensparrow.org

OpenSparrow v2.8 – Kanban board, MySQL Gateway, and major security hardening

Tomasz — Fri, 26 Jun 2026 14:01:04 +0000

OpenSparrow v2.8 is out. This one's focused on security, new visualization options, and better multi-database support.

Board (Kanban) view
New module — visualize your records as draggable cards organized into lanes. Each lane represents a status value (enum recommended). Drag a card to another lane and it updates instantly, with the change logged to the audit trail and restricted by record ownership.
Configure it from the new Board tab in the admin panel. The CRM demo now ships with a ready-made "Deals Board" grouped by Stage.

MySQL Gateway improvements
You can now connect to external MySQL databases and manage them alongside.
Add a MySQL table to the routing list, it auto-discovers columns from INFORMATION_SCHEMA and writes them to schema.json. New admin panel section lists all MySQL-routed tables with a per-table sync button.

Security hardening

Ownership guards — mass edit, duplicate, and delete now respect row ownership on restricted tables. Calendar drag-and-drop also enforces this.
Random setup password — the initial admin account gets a random 24-character password instead of hardcoded admin/admin
Session protection — storage/sessions/ now has .htaccess denying direct web access on Apache
File uploads security — uploads are now stored outside the web docroot (storage/files/), closing a potential exposure
Config import hardening — rejects empty archives, enforces 512 KB per-file limits, validates JSON properly

Infrastructure improvements

Web-root restructure — all web entry points now live in public/; backend code stays outside the docroot
Cypress test overhaul — 18 spec files, new seed endpoint, admin panel tests now fully active
CI/CD — added source integrity checks, version tag validation, PHP 8.1–8.3 syntax checks
Docs update — removed all references to default credentials, updated for random setup password

Small but useful

Linked record count badges now show on grid expand buttons — tells you how many related records exist before you click
Calendar API now queries only the visible month — better performance on large datasets
Login attempts table auto-purges rows older than 30 days

Following this series?

OpenSparrow v2.7 – Enhanced RAG, rebuilt admin UI, and Automations (beta)

OpenSparrow v2.6 – AI-powered search (RAG), bulk operations, and keyboard shortcuts

Websites

opensparrow.org
github.com/wrobeltomasz/OpenSparrow
demo.opensparrow.org

OpenSparrow v2.7 – Enhanced RAG, rebuilt admin UI, and Automations (beta)

Tomasz — Tue, 09 Jun 2026 15:11:04 +0000

v2.7 is out. This release focuses on AI improvements, a major admin UI overhaul, and the first iteration of workflow automations.

RAG enhancements
The AI module got a significant upgrade. Better document parsing, improved query handling, and now Ollama connections support SSL verification toggle — useful if you're running it locally with custom certificates.

Admin panel redesign
The admin UI has been completely rebuilt with:

Card-based editors for cleaner form layouts
Inline item panel for faster configuration
Refactored styles and improved visual hierarchy
Inner-tabs for better information organization

Automations (beta)
We're introducing workflow automations — still early, but usable. You can create if-then rules with:

OR group logic for complex conditions
3 action types to start
Run log to track executions
User picker for assignment actions

This is beta. Expect improvements in v2.8.

Security & quality

CSP nonces and XSS hardening across the admin panel
Unified session enforcement and role checks
Expanded Cypress E2E test suite to 12 spec files (~300 tests) — fixed 3 flaky tests

One-click deployment
Deploy to Render or Railway directly from GitHub — no manual server setup needed.

Other improvements

Server-side search with load-more pagination
Row cap for large tables (configurable)
Better CSV import with delimiter and encoding options
Improved malformed data parsing

Following this series?

OpenSparrow v2.6 – AI-powered search (RAG), bulk operations, and keyboard shortcuts

OpenSparrow v2.3 – visual admin panel, zero dependencies, now with ERD and M2M support

OpenSparrow – open-source admin panel builder, zero dependencies, v2.1 just dropped

Websites

opensparrow.org
github.com/wrobeltomasz/OpenSparrow
demo.opensparrow.org

What AI features would be useful in your own projects? Drop your thoughts in the comments.