Repository navigation
feat: add a feedback card, a Star CTA and one-click 5xx reports #796
Description
Written-by: HugoXK
Problem
The console has no user-facing way to send feedback, and an unexpected 5xx only writes a log line; the user sees a generic error page with no way to tell the maintainer what happened. The GitHub repository is linked from the footer as a bare GitHub link, with no Star call-to-action. There is no feedback table, no error-report ref, and no in-app report route.
Proposal
- Settings → Feedback: a bilingual card with kind, optional page and message, posting to
POST /feedback. The route requires approved + CSRF, stores afeedbackrow, audits the id/kind/length, mailsFEEDBACK_EMAIL(falling back toADMIN_EMAIL), and flashes the outcome. - Star: the footer link becomes
★ Star Fledge on GitHub, and an About card on Settings repeats the link. No star-count API is called. - Unexpected errors: an HTML 5xx creates an
error_reportsrow with a randomref; the error page offers onePOST /errors/:ref/report. The row keeps only method, pathname, status, error name, redacted message, version, commit and the signed-in login. No query, body, headers, cookies, email or token. The claim is atomic, the route is rate-limited and usable while signed out, and a 4xx never shows the button. FEEDBACK_EMAILis optional in config and falls back toADMIN_EMAILwhen unset.
Scope and tier
src/db.ts, src/app.ts, src/config.ts, src/views/, src/email/templates.ts, src/i18n.ts, tests, docs/architecture.md, docs/security.md, docs/deploy.md, .env.example, one changelog fragment. T3 (src/db.ts, src/app.ts).
Privacy
Feedback is redacted and bounded before storage/mail. Error reports store a pathname only and a redacted, truncated error message; the ref is an unguessable capability, the report route is idempotent and rate-limited, and the mail says what is not included.
Verification
- Feedback stores, audits and mails the fallback address;
FEEDBACK_EMAILoverrides it. - Empty feedback and missing CSRF are refused.
- An injected 5xx renders the report button, stores a pathname-only row, one click marks it reported and mails once; a second click does not mail again.
- A 404 has no report button; the settings page shows the Feedback and About cards, and the footer carries the Star link.
npm run checkpasses.
Activity
HugoXK commentedon Nov 15, 2026
Written-by: HugoXK
Implemented in PR #797. The card is still unclaimed and marked
needs-review; the PR is ready for the Issue-review PASS and the bot's review at the tip.fix: require consent before an error report and include a redacted st…
feat: add feedback, a Star CTA and one-click error reports (#796)
HugoXK-bot commentedon Nov 15, 2026
Issue-review: PASS at issue #796 body d51cecd1fe51
Written-by: HugoXK-bot
Posted-by: HugoXK-bot
Body hash
d51cecd1fe51(raw) is what this verdict binds; state read from the live API this turn, premises checked against live main0883935f.Premise, verified rather than taken on trust:
feedback,error_reportsandFEEDBACK_EMAILdo not occur anywhere undersrc/.src/app.ts:5702is the only unexpected-error surface, and for a 5xx it does exactly what the card says (onelog.error('request failed', …)at:5705) and then renderserrorPageat:5719;errorPage(src/views/pages.ts:2633-2653) can carry one link and no form, so nothing on that page can send a report.src/views/layout.ts:269is the bareGitHubfooter link the Star CTA replaces, and no star-count call exists.ADMIN_EMAILis configured atsrc/config.ts:326asadminEmail.src/app.ts:684, the per-route limiter isRouteLimiters(:579), anddestructiveLimitat:3907is the pattern for a rate-limited POST.Readiness: expected behaviour is observable per route (stored row, audit id/kind/length, mail with the fallback address, one-click report that mails once, no button on a 4xx), the privacy bound is stated as a positive list rather than "redact sensitive data", the ref is described as a capability, and the verification bullets map one-to-one to red tests. Scope paths and T3 are explicit and match the paths named (
src/db.ts,src/app.ts).No duplicate: the only open card in this area is
#814, and it is downstream of this one — it consumes thefeedback/error_reportsrecords and keeps maintainer mail as its unreachable-Lead fallback, so the two do not conflict.Non-blocking:
POST /errors/:ref/report";errorPage(src/views/pages.ts:2639-2644) only renders an optional link today, so the Dev has to extend that signature to carry a form and, for a signed-in reporter, a CSRF field. Say in the body which one the button carries, or the red test for "a second click does not mail again" will pass against a button that cannot submit.#814assumes a per-report consent version, so name the sequence (store on 5xx, claim on POST) and the test follows.user_version = 40(src/db.ts:2111): new tables come fromSCHEMA, so no bump is needed here — worth one line so a Dev does not take 41, which another open card also claims.Not verified by me: no red half exists yet in the tree at this hash; this PASS is on the premise, the expected behaviour and the scope.
Conclusion: PASS at body d51cecd1fe51 — the card is precise, its premises hold at live main, and the verification bullets are testable as written.
merge: bring main 9f2ef3a into the feedback error-report branch (#796)