[ForeignKeyCN]

Summary

Trello 1.0.0 adds Each user signs in next to the existing API key + token and adds the common Trello operations that were missing. It also fixes two problems in the existing plugin:

• Tokens were sent in URLs. The 13 original tools put the API key and token in query strings, so they ended up in proxy and server logs. They now go in the Authorization: OAuth oauth_consumer_key=…, oauth_token=… header. The original tools import a small requests shim (tools/trello_http.py) that moves key/token out of the URL, so their code is otherwise unchanged.
• create_board failed on current Trello accounts. Trello answers 500 {"message":"Unable to auto-create an organization."} when a board is created without a Workspace. create_board now uses the account's first Workspace, unless the new optional idOrganization parameter names one.

The original tools also return Trello's error text ("Failed to create board: Trello API error 500: …") instead of a bare "Failed to …". Existing credentials, tool names and parameters are unchanged. It follows the same per-user design as #4163–#4170.

Each user signs in

Trello's API-key authorization has no code flow: the Allow page hands the token to the browser in the URL fragment (#token=…), which never reaches a server.

1. The tool creates a random state and a one-time RSA-2048 key pair. The private key goes into the user's Fernet-encrypted record; the public key is stored with the state.
2. The tool returns https://trello.com/1/authorize?…&response_type=token&callback_method=fragment&return_url=<endpoint>?state=….
3. The endpoint's GET /trello/callback page script reads the fragment, removes it from the address bar, and POSTs the token to POST /trello/callback.
4. The POST seals the token with the state's public key (RSA-OAEP) and stores only the ciphertext. Each state can be completed once.
5. On the next tool call, the tool opens the sealed token with its private key, checks it with /members/me (which also gives the account name it reports), and stores it encrypted with a key derived from the API secret.

Other details:

• Plugin storage never holds a readable token.
• When Trello later rejects the token (expired or revoked), the next call returns a new sign-in link.
• The callback page warns about forwarded links and offers cancel. trello_sign_out forgets the sign-in.
• Settings: API Secret (only used for encryption), Sign-in Callback URL, Sign-in Lasts (1 day / 30 days / until revoked).
• The callback URL's origin must be in the API key's Allowed origins.

Why not Trello's new OAuth 2.0?

• It exists (auth.atlassian.com, PKCE), but a developer report from October 2026 says its tokens are refused by the attachment download endpoint.
• Our download works with key + token (tested below).
• It can be added later as another mode.

New tools (prefixed trello_: the new Agent rejects duplicate tool names across plugins)

Operation	Tool
(search)	trello_search (text and Trello search operators), trello_list_workspaces
Card: Get	trello_get_card (list, labels, members, checklists with progress, attachments)
Card: Update	update_card_by_id gains due, dueComplete, closed, pos, idMembers, idLabels
Card Comment: Create / Update / Delete	trello_add_comment, trello_update_comment, trello_delete_comment, plus trello_list_comments
Checklist: Create / Delete / Get(All) / Create, Update, Delete Check Item / Completed items	trello_create_checklist (with items), trello_delete_checklist, trello_list_checklists, trello_add_checklist_item, trello_update_checklist_item, trello_delete_checklist_item
Label: Create / Get(All) / Update / Delete / Add / Remove	trello_create_label, trello_list_labels, trello_update_label, trello_delete_label, trello_add_card_label, trello_remove_card_label
List: Update / Archive / Get Cards	trello_update_list (rename, archive, reorder, move), trello_get_list_cards
Board Member: Get All / Add / Invite / Remove	trello_list_board_members, trello_add_board_member, trello_invite_board_member, trello_remove_board_member
Attachment: Create / Get / Get All / Delete	trello_add_attachment (file, text + name, or link), trello_get_attachment (returns the file, up to 50 MB), trello_list_attachments, trello_delete_attachment

• The new tools share tools/trello_ops.py; each tool file is a thin wrapper, because Dify loads one Tool class per file.
• Every new tool returns typed output variables (success / error plus its fields).
• IDs are encoded as one path segment each.

Release Notes

• Each user signs in: chat agents can let every user work in Trello with their own account.
• 30 new tools: search, card details, comments, checklists, labels, lists, board members, attachments and workspaces.
• create_board works on current Trello accounts (it failed with "Unable to auto-create an organization") and can take a Workspace.
• update_card_by_id takes due date, archive, position, members and labels.
• Credentials no longer in URLs: the API key and token are sent in a header.
• Clearer errors: the original tools show Trello's error message.

Change Type

• Documentation / non-plugin change
• Non-LLM plugin (tools, extensions, datasource, etc.)
• LLM plugin

Screenshots / Videos

The README shows the agent configuration, Trello's Allow page and a chat where the agent creates a board, list, card and checklist as the signed-in user.

Testing

• Unit tests: 103 passed (pytest tests). They cover:
  • The sign-in flow: authorize link, callback page, sealed POST, single use, open and check, cancel, bad or expired state, malformed token, per-user isolation, secret rotation, revoked token → new link, sign-out.
  • The URL shim (no key/token in URLs, header set).
  • Every new tool, the create_board Workspace lookup, path encoding, error text.
  • Every tool's output variables, the manifest and both endpoint routes, provider validation.
• Self-hosted Dify (Community), Each user signs in: both callback routes answer through Dify's endpoint routing, and in an agent chat the following worked against a real Trello account:
  • Trello's Allow page → Signed in → the agent named the account.
  • Created a board (after the Workspace fix), a list, a card and a checklist with two items.
  • Added a comment and created a red label and put it on the card.
  • Uploaded notes.txt, ticked a checklist item, read the card back, and downloaded notes.txt (content matches).
• Not run against Trello: board member add/invite/remove (needs a second account) and the delete/update tools not used in the chat above. These are covered by unit tests only.

Checklist

• I have read the contribution guidelines
• Version bumped: 0.0.10 → 1.0.0

[crazywoola]

Reviewed the plugin scope, manifest, documentation, and relevant source changes. Approving this revision to run the repository pre-merge plugin validation; merge is contingent on successful validation.