stackchain/stackchain-dashboard
1
0
Fork 0
Code Issues 9 Pull Requests 1 Actions Packages Projects Releases 713 Wiki Activity

Complete authored pull request workspace access #1348

New Issue
Closed
opened 2026-08-24 11:52:36 +00:00 by timmy · 0 comments
timmy commented 2026-08-24 11:52:36 +00:00
Owner
Copy Link

Problem

My Work now surfaces open pull requests authored by the current operator (#1346), but the pull workspace still authorizes every detail/review/check/conversation path only through assignment. An authored, unassigned pull can therefore appear in My PRs, open its route, and fail with “Assigned pull request not found.” Ownership controls also remain visible although there is no assignment to release or hand off.

Evidence on origin/main (050390d):

  • frontend/my-work.js admits authored_by_me independently of assignment.
  • src/gitea_proxy.py:is_assigned_pull is the sole gate used by pull detail, review data, checks, feedback, and conversation routes in src/main.py.
  • frontend/pull-sheet.js resets assignment handoff/release controls unconditionally.
  • The #1346 mobile gate verifies routing only, not a populated workspace.

All 677 historical issue titles and recent commits were checked. #1346 covers queue discovery, while #1330–#1344 cover assigned pull actions; none completes workspace access for an authored, unassigned pull.

Vertical slice

Introduce an explicit open-pull capability result for the confirmed operator (authored, assigned) and apply it consistently:

  1. Allow authored, unassigned open pulls to load detail, conversation, review data, checks, and reviewer feedback.
  2. Allow author lifecycle actions (edit context, publish draft, request/cancel review, comment, and safeguarded merge) without requiring assignment.
  3. Keep release/handoff strictly assignment-only and hide that ownership group when assigned=false.
  4. Return normalized capabilities with workspace payloads so mobile controls reflect authorization instead of failing after a tap.
  5. Preserve assignment access for non-author assignees and return 404 for unrelated users.

Acceptance tests

  • An authored, unassigned open pull loads a populated mobile workspace with capabilities.authored=true and assigned=false.
  • Detail, conversation, review data, checks, feedback, context edit, draft publication, review request/cancellation, comments, and guarded merge accept that relationship.
  • Ownership controls have no rendered layout space for authored-unassigned pulls, while author controls remain available.
  • An assigned non-author retains existing workspace/ownership behavior; an unrelated user gets 404.
  • Packaged 320×568 and 390×844 browser journeys exercise My PRs → populated pull sheet with no horizontal overflow and 44px action targets.
## Problem My Work now surfaces open pull requests authored by the current operator (#1346), but the pull workspace still authorizes every detail/review/check/conversation path only through assignment. An authored, unassigned pull can therefore appear in **My PRs**, open its route, and fail with “Assigned pull request not found.” Ownership controls also remain visible although there is no assignment to release or hand off. Evidence on `origin/main` (`050390d`): - `frontend/my-work.js` admits `authored_by_me` independently of assignment. - `src/gitea_proxy.py:is_assigned_pull` is the sole gate used by pull detail, review data, checks, feedback, and conversation routes in `src/main.py`. - `frontend/pull-sheet.js` resets assignment handoff/release controls unconditionally. - The #1346 mobile gate verifies routing only, not a populated workspace. All 677 historical issue titles and recent commits were checked. #1346 covers queue discovery, while #1330–#1344 cover assigned pull actions; none completes workspace access for an authored, unassigned pull. ## Vertical slice Introduce an explicit open-pull capability result for the confirmed operator (`authored`, `assigned`) and apply it consistently: 1. Allow authored, unassigned open pulls to load detail, conversation, review data, checks, and reviewer feedback. 2. Allow author lifecycle actions (edit context, publish draft, request/cancel review, comment, and safeguarded merge) without requiring assignment. 3. Keep release/handoff strictly assignment-only and hide that ownership group when `assigned=false`. 4. Return normalized capabilities with workspace payloads so mobile controls reflect authorization instead of failing after a tap. 5. Preserve assignment access for non-author assignees and return 404 for unrelated users. ## Acceptance tests - An authored, unassigned open pull loads a populated mobile workspace with `capabilities.authored=true` and `assigned=false`. - Detail, conversation, review data, checks, feedback, context edit, draft publication, review request/cancellation, comments, and guarded merge accept that relationship. - Ownership controls have no rendered layout space for authored-unassigned pulls, while author controls remain available. - An assigned non-author retains existing workspace/ownership behavior; an unrelated user gets 404. - Packaged 320×568 and 390×844 browser journeys exercise My PRs → populated pull sheet with no horizontal overflow and 44px action targets.
timmy self-assigned this 2026-08-24 11:52:36 +00:00
timmy closed this issue 2026-08-24 12:20:22 +00:00
Sign in to join this conversation.
No Branch/Tag Specified
Branches Tags
Labels
Clear labels   
P0

Drop everything

  
P1

High priority

  
P2

Medium priority

  
agent:nightprowl

Assignments routed to the LongCat NightProwl evaluation worker

  
backend

Backend service

  
ci

Continuous integration / actions

  
frontend

Frontend / UI

  
meta

Meta / planning

  
pages

Gitea Pages

  
template

Repo template / standards

No Label
P0
P1
P2
agent:nightprowl
backend
ci
frontend
meta
pages
template
Milestone
Clear milestone
No items
No Milestone
Projects
Clear projects
No project
Assignees
Clear assignees
No Assignees
timmy
1 Participants
Notifications
Due Date
The due date is invalid or out of range. Please use the format 'yyyy-mm-dd'.

No due date set.

Dependencies

No dependencies set.

Reference: stackchain/stackchain-dashboard#1348
No description provided.
Delete Branch "%!s()"

Deleting a branch is permanent. Although the deleted branch may continue to exist for a short time before it actually gets removed, it CANNOT be undone in most cases. Continue?