stackchain/stackchain-dashboard
1
0
Fork 0
Code Issues 9 Pull Requests 1 Actions Packages Projects Releases 713 Wiki Activity

Mark unread updates read from Web Push #561

New Issue
Closed
opened 2026-08-11 09:51:03 +00:00 by timmy · 0 comments
timmy commented 2026-08-11 09:51:03 +00:00
Owner
Copy Link

Product gap

Inbound Web Push opens the update reader, but routine unread updates still require launching and hydrating the full PWA before they can be cleared. The existing authenticated mark-read endpoint and service-worker CSRF/session flow can support a privacy-safe notification action.

Scope

  • Add a generic Mark read action to update notifications without exposing repository, title, author, or comment content.
  • Validate the notification ID and route before mutation.
  • Perform one CSRF-protected mark-read request from the service worker.
  • Close on confirmed success; on offline/session/server failure, focus or open the existing update-reader route.
  • Preserve body-tap behavior and browsers without action support.

Acceptance criteria

  • Generic push payload carries only the bounded update identifier/action metadata required for the action.
  • Mark read sends exactly one authenticated PATCH and opens no window after confirmed success.
  • Invalid payloads never mutate state.
  • Failure falls back to the existing update reader so no update is silently discarded.
  • Body taps and action-unsupported browsers retain tap-to-review behavior.
  • Behavioral tests cover success, malformed data, and failure fallback.
## Product gap Inbound Web Push opens the update reader, but routine unread updates still require launching and hydrating the full PWA before they can be cleared. The existing authenticated mark-read endpoint and service-worker CSRF/session flow can support a privacy-safe notification action. ## Scope - Add a generic **Mark read** action to update notifications without exposing repository, title, author, or comment content. - Validate the notification ID and route before mutation. - Perform one CSRF-protected mark-read request from the service worker. - Close on confirmed success; on offline/session/server failure, focus or open the existing update-reader route. - Preserve body-tap behavior and browsers without action support. ## Acceptance criteria - [ ] Generic push payload carries only the bounded update identifier/action metadata required for the action. - [ ] Mark read sends exactly one authenticated PATCH and opens no window after confirmed success. - [ ] Invalid payloads never mutate state. - [ ] Failure falls back to the existing update reader so no update is silently discarded. - [ ] Body taps and action-unsupported browsers retain tap-to-review behavior. - [ ] Behavioral tests cover success, malformed data, and failure fallback.
timmy self-assigned this 2026-08-11 09:51:03 +00:00
timmy closed this issue 2026-08-11 09:58:57 +00:00
Sign in to join this conversation.
No Branch/Tag Specified
Branches Tags
Labels
Clear labels   
P0

Drop everything

  
P1

High priority

  
P2

Medium priority

  
agent:nightprowl

Assignments routed to the LongCat NightProwl evaluation worker

  
backend

Backend service

  
ci

Continuous integration / actions

  
frontend

Frontend / UI

  
meta

Meta / planning

  
pages

Gitea Pages

  
template

Repo template / standards

No Label
P0
P1
P2
agent:nightprowl
backend
ci
frontend
meta
pages
template
Milestone
Clear milestone
No items
No Milestone
Projects
Clear projects
No project
Assignees
Clear assignees
No Assignees
timmy
1 Participants
Notifications
Due Date
The due date is invalid or out of range. Please use the format 'yyyy-mm-dd'.

No due date set.

Dependencies

No dependencies set.

Reference: stackchain/stackchain-dashboard#561
No description provided.
Delete Branch "%!s()"

Deleting a branch is permanent. Although the deleted branch may continue to exist for a short time before it actually gets removed, it CANNOT be undone in most cases. Continue?