feat(epics): Kanban board view with side-panel drill-down#8
Merged
Conversation
Adds a board layout to the Epics page alongside the existing timeline. - `EpicsKanban` renders three columns — Planning (not-started), In Progress, Done — with one card per epic. Each card shows the epic id, title, status badge, story counter, and a segmented progress bar. - `EpicStoriesSheet` is the side-panel drill-down: a shadcn Sheet that first lists the epic's stories, then swaps to `StoryDetailView` when a story is selected, with a "back to stories" affordance. Internal navigation resets whenever the targeted epic changes (derived during render rather than via an effect). - `EpicsBrowser` gains a Timeline / Board toggle on the epics list. Timeline keeps the existing in-page navigation; Board opens the side-panel sheet on click. Timeline stays the default so existing flows are unchanged. Reuses `Sheet`, `StoryDetailView`, `StatusBadge`, `SegmentedProgressBar`, and the `StaggeredList` animation primitives, so the new view inherits the project's visual language without new shared primitives.
Radix Dialog requires a Title to be mounted at all times for the
panel's accessible name. The previous code unmounted SheetTitle when
swapping the sheet body to the story-detail view, leaving the panel
without an accessible name and triggering a Radix warning.
Now a `<SheetTitle className="sr-only">Story {id}: {title}</SheetTitle>`
stays mounted in detail view alongside the visible "Back to stories"
button. The visible heading inside StoryDetailView remains the primary
on-screen title for sighted users; the sr-only one only services screen
readers and Radix's accessibility contract.
This was referenced May 13, 2026
DevHDI
added a commit
that referenced
this pull request
May 13, 2026
* fix(api): handle malformed JSON on /api/revalidate as 400 await request.json() throws SyntaxError on empty bodies, wrong Content-Type, or truncated payloads. The error was not caught, so the endpoint returned an unstructured 500 instead of a 400, and bypassed any error-monitoring middleware that expects structured 4xx responses. Wrap the parse in try/catch and return a clear 400 "Invalid JSON". Addresses finding #8 from bmad-method-ui#5 review. * fix(actions): revalidate cache only after successful refresh refreshGitHubRepo called revalidateTag *before* the GitHub fetch. When the fetch threw (network error, rate limit, 404), the cache was already invalidated: subsequent renders fetched stale or empty data with no recovery until a future successful refresh. Move revalidateTag to the end of the function, after the GitHub fetch and the prisma.repo.update both succeed. If either step fails, the existing cached entry remains valid. Addresses finding #6 from bmad-method-ui#5 review. * fix(api): rate-limit /api/revalidate per client IP The endpoint was protected by a shared secret with no rate limit of its own. If the secret were ever obtained (logs, accidental commit, compromised CI), an attacker could issue unlimited revalidateTag calls to drive continuous cache invalidation and elevate upstream load. Add a per-IP limit using the existing in-memory checkRateLimit helper: 30 requests per minute, which comfortably exceeds any legitimate build/deploy cadence. The IP is read from x-forwarded-for (first hop) with x-real-ip and a literal "unknown" fallback so a missing header cannot bypass the bucket. Defense in depth — the secret remains the primary protection. Addresses finding #13 from bmad-method-ui#5 review. * fix(api): move rate-limit post-auth with global key The per-IP pre-auth limit added in 93023cf trusted the x-forwarded-for header, which is client-controlled. In the very threat the limit was meant to mitigate ("secret leaked"), the attacker can rotate x-forwarded-for on every request and obtain a fresh bucket each time, neutralising the cap. Restructure the handler: 1. Validate the shared secret first. timingSafeEqual on SHA-256 digests is computationally resistant to brute force, so no pre-auth quota is needed. 2. Apply a *post-auth* rate limit with a fixed key `revalidate:authenticated`. This caps total invalidations across all valid-secret holders, so even with a leaked secret an attacker is bounded to 30/min regardless of source IP. Drop the now-unused getClientIp helper. Addresses follow-up review on 93023cf.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
Adds the V1 Kanban view for the Epics page that Brian and Evie validated, alongside the existing timeline. Three pieces, all on the same screen.
EpicsKanbanThree-column board: Planning (not-started), In Progress, Done. Each card carries the epic id, title,
StatusBadge,{completed}/{total} storiescounter, and aSegmentedProgressBar. Layout collapses gracefully on narrow viewports.EpicStoriesSheet(drill-down)Click a card → a shadcn
Sheetslides in from the right. Two-state internal navigation:StatusBadgeand task counters.StoryDetailView(description, acceptance criteria, tasks). A "back to stories" button restores the list.State resets to the list whenever the targeted epic changes — implemented by tracking the epic id during render (not in an effect), per the React 19 / Compiler guidance.
Toggle in
EpicsBrowserA Timeline / Board toggle appears above the epics list (pattern borrowed from the Stories page). Timeline stays the default, so existing user flows are unchanged. Board mode routes clicks to the Sheet rather than the in-page
view: "story"navigation.Reuse
No new shared primitives. The new components compose:
Sheet,SheetContent,SheetHeader,SheetTitle,SheetDescriptionStoryDetailView,StatusBadge,SegmentedProgressBarStaggeredList/StaggeredItemfor the animation rhythmButton+Columns3/GanttChartSquareicons for the toggleTest plan
pnpm test— 151/151 passing (no functional regression — UI-only change)pnpm tsc --noEmit— cleanpnpm lint— clean (only the 2 pre-existing TanStack warnings)StoryDetailView, back button restores the list