BookStack, mapped: 298 features in 13 modules, and 149 flows ending at 89 features
BookStack is an open-source wiki. featkpr read its features from the code at one commit, walked a throwaway copy for its user flows and goals, then tested it per route and role, each test sent again as the wrong user, someone who should get the opposite answer.
Ask for a private demoRead the report
- What it is
- an open-source wiki: shelves, books, chapters and pages, with roles and permissions down to a single page
- Its stack
- PHP · Laravel · MIT licence
- The latest run
- BookStack's development branch at 1633b3ab, released as v26.09 the same day · run 20 Oct 2026, 03:18 UTC
- The copy featkpr ran
- a throwaway copy. Until 27 Sep on PHP's built-in server, not production-like; since 28 Sep it sends real mail and runs a real queue, and a production-like copy beside it matches real hosting on 11 of 17 checks
BookStack’s own site · official demo · source · the commit featkpr ran
What each of its goals does, in plain words: BookStack’s mechanics
Who may do what, in the copy featkpr tested
- Admin holds all 62 permissions. The crawl signed in as it, and it is the wrong user for every test that expects a refusal.
- Editor, Viewer and Public are BookStack's own roles, as it ships.
- Our seed added four roles (their names start with M6), so that for most permissions some user holds it and some does not.
- The Content-only reader holds one permission: it is the wrong user in the report's example test.
Six steps, each with its date and its source #
The features, the tests and the run are featkpr’s records, exported 20 Oct 2026. The crawl and the flows were read from the app on the day each names. Each step opens its section of the report.
- 1 · code read 343 routes26 Sep 2026
the missed-items check, exported routes, handlers and permission checks read at one commit - 2 · features named 298 features in 13 modulesexported 20 Oct 2026
featkpr's records each feature cites the routes and screens it was named from - 3 · screens crawled 167 screens, 8 create forms sent25 Sep 2026
read from the app a throwaway copy walked as the Admin, a picture of every screen - 4 · flows drafted 149 flows ending at 89 features20 Oct 2026
read from the app's Flows board screen by screen; 148 wait for a person to keep or drop them - 5 · tests run 311 pass, of 497 written so far20 Oct 2026, 03:18 UTC
featkpr's records pytest calling BookStack's routes directly, per route and role - 6 · wrong-user check 276 proven, 35 unchecked20 Oct 2026, 03:29 UTC
featkpr's records each test sent again as the wrong user; it must then fail
How each step works, for any product: the product tour · the services
The report and the news #
BookStack: 304 tests pass, and 269 fail as they must when sent as the wrong userfeatkpr ran on a throwaway copy of BookStack at the head of one of its pull requests. It read the code, walked the screens, wrote tests per route and role, and sent each test again as the wrong user.- 30 Sep 2026BookStack's 165 goals, in one overview with a side-by-side compare
- 27 Sep 2026307 features in 12 modules, from featkpr's records
- 26 Sep 2026304 tests pass, 269 proven by the wrong-user check
- 26 Sep 2026163 flows drafted to 69 goals
- 26 Sep 2026what featkpr missed, 605 of 2,372, step by step
- 25 Sep 2026167 screens crawled, 8 create forms sent
What comes next for BookStack #
- Immich's crawl and flows in productionshipped 9 Oct 2026the latest step on the roadmap
- Effects and OpenTelemetry on BookStack's runsplanned, not datedeffects recorded on BookStack's run of 28 Sep at its development tip, not shown here yet; OpenTelemetry measured on one capture run, not on every run yet
- The merge-request verdict, posted with the change's own code runplanned, not datedthe pull request's own code ran on BookStack #6213 on 28 Sep (0 broke, 19 held, 5 not proven); next, it posts on every push and fills the Goal sheets page; its first verdict was on pull request #6213, in a private mirror, and on 28 Sep 2026 that pull request's own code ran
- Your verdict on the drafted flowswaiting on a person148 flows wait to be kept or dropped; a kept one's checks become its test once browser tests exist
- Viewer and guest flowsplanned, not datedthe crawl signs in as the admin today; other roles once Flows filters by role; the crawl signed in as the Admin only; pages only a signed-out visitor sees are among the misses
from the plan of 1 Oct 2026 (/roadmap)
featkpr is not affiliated with BookStack. It ran on its own throwaway copy, never on BookStack's servers. Ask for a correction or a removal at /removal.
See BookStack in featkpr, privately #
A live walkthrough of the map, the flows and the runs, your questions first.