@alliance-droid/status-feedback-system 4.2.2 → 4.2.3

package/CHANGELOG.md

@@ -1,31 +1,37 @@
-# Changelog
-
-## 4.2.2
-
-### Fixed
-
-- SvelteKit feedback proxy: read-only board status transition probes now return `200` with `canManage: false` when the browser has no usable management bearer token, avoiding noisy console `401` / `403` errors. Status mutations still require and forward a valid bearer token.
-
-## 4.2.1
-
-### Fixed
-
-- SvelteKit feedback proxy: private-app authentication/authorization now runs before missing proxy configuration is reported, so unauthenticated callers receive `401` instead of learning whether `SF_API_URL` / `SF_API_KEY` are configured.
-
-## 4.2.0
-
-### Added
-
-- Added `@alliance-droid/status-feedback-system/sveltekit/server`, a server-only SvelteKit proxy adapter that lets consuming apps keep the project API key in private server environment variables. The adapter maps the package's existing `/api/...` client paths to `status-feedback-admin`, injects the private `x-api-key`, strips browser `key` query params, validates request bodies, forwards bearer tokens for privileged status endpoints, and can derive feedback `email` / response `author` from the host app's authenticated user.
-
-### Changed
-
-- `apiKey` is now optional for `createStatusClient`, `StatusPage`, `StatusBanner`, `FeedbackForm`, `FeedbackButton`, `DevFeedback`, and `createFeedbackBoard`. When omitted, the client no longer appends `?key=...`, which enables same-origin proxy mode with `apiUrl="/svc/feedback"`.
-- Updated README and integration docs to make the SvelteKit proxy the recommended hardened default. Direct admin calls with an embedded project key remain supported for existing consumers.
-
-## 4.1.6
-
-### Fixed
+# Changelog
+
+## 4.2.3
+
+### Changed
+
+- Board status badges now show each item's **real, granular status to every viewer** — not just ProductOwners. Previously non-privileged viewers saw only the coarse public bucket ("In progress") for every internal status, and ProductOwners saw the real status but only after the privilege probe resolved. Each board item already carries its internal `status` from the API, so the badge now renders `internalStatusLabel(item.status)` for everyone on first paint (no privilege check, no per-item transitions fetch, no delay). **Changing** status remains ProductOwner-only. Note: this makes the granular internal statuses (e.g. "QA / UAT", "Technical review") visible to anyone who can see the board.
+
+## 4.2.2
+
+### Fixed
+
+- SvelteKit feedback proxy: read-only board status transition probes now return `200` with `canManage: false` when the browser has no usable management bearer token, avoiding noisy console `401` / `403` errors. Status mutations still require and forward a valid bearer token.
+
+## 4.2.1
+
+### Fixed
+
+- SvelteKit feedback proxy: private-app authentication/authorization now runs before missing proxy configuration is reported, so unauthenticated callers receive `401` instead of learning whether `SF_API_URL` / `SF_API_KEY` are configured.
+
+## 4.2.0
+
+### Added
+
+- Added `@alliance-droid/status-feedback-system/sveltekit/server`, a server-only SvelteKit proxy adapter that lets consuming apps keep the project API key in private server environment variables. The adapter maps the package's existing `/api/...` client paths to `status-feedback-admin`, injects the private `x-api-key`, strips browser `key` query params, validates request bodies, forwards bearer tokens for privileged status endpoints, and can derive feedback `email` / response `author` from the host app's authenticated user.
+
+### Changed
+
+- `apiKey` is now optional for `createStatusClient`, `StatusPage`, `StatusBanner`, `FeedbackForm`, `FeedbackButton`, `DevFeedback`, and `createFeedbackBoard`. When omitted, the client no longer appends `?key=...`, which enables same-origin proxy mode with `apiUrl="/svc/feedback"`.
+- Updated README and integration docs to make the SvelteKit proxy the recommended hardened default. Direct admin calls with an embedded project key remain supported for existing consumers.
+
+## 4.1.6
+
+### Fixed
 
 - Board status badges: for privileged viewers (Admin / ProductOwner), **every** item now shows its real internal status (e.g. "QA / UAT"), not just the first one. Previously the list badge derived its label solely from the per-item transitions cache, which is only populated lazily (on menu open) plus a one-time privilege probe of `items[0]` — so exactly the first item showed its real status and the rest stayed on the coarse public projection ("In progress"). The badge now derives the privileged label from each item's own `status` (already present on every board item) via a new `internalStatusLabel`, so all rows resolve consistently once privilege is confirmed. Non-privileged viewers are unchanged (they still see the public status bucket).
 

package/dist/components/board/StatusBadgeMenu.svelte

@@ -21,7 +21,7 @@
 	import { onMount } from 'svelte';
 	import type { BoardItem, BoardTransition } from '../../api.js';
 	import type { FeedbackBoardState } from './state.svelte.js';
-	import { getStatusBadgeVariant, publicStatusLabel, internalStatusLabel } from './utils.js';
+	import { getStatusBadgeVariant, internalStatusLabel } from './utils.js';
 
 	interface Props {
 		board: FeedbackBoardState;
@@ -45,15 +45,12 @@
 
 	// Read from the board's shared cache so detail + list reuse the same fetch.
 	let txns = $derived(board.transitions[item.id] ?? null);
-	// Label priority: the authoritative loaded transitions display (if this item's
-	// transitions have been fetched) → for privileged viewers, the item's own
-	// internal status (present on every board item, so ALL rows show their real
-	// status, not just the one the privilege probe happened to load) → otherwise
-	// the coarse public projection shown to everyone else.
-	let badgeLabel = $derived(
-		txns?.current.display ??
-			(board.canManageStatus ? internalStatusLabel(item.status) : publicStatusLabel(item.publicStatus))
-	);
+	// Everyone sees the item's real granular status — `item.status` is present on
+	// every board item (the board endpoint returns it), so all rows render their
+	// actual status on first paint, no privilege or transitions fetch required.
+	// Only *changing* status is gated (below, on canManageStatus). The loaded
+	// transitions display, when present, is the same value and stays authoritative.
+	let badgeLabel = $derived(txns?.current.display ?? internalStatusLabel(item.status));
 	// Changes whenever the menu's content (and thus its size) changes — drives a
 	// reposition so the teleported menu stays anchored after it loads/expands.
 	let posKey = $derived(`${menuOpen}:${loading}:${pendingTarget?.status ?? ''}:${txns?.targets.length ?? 0}`);
@@ -269,6 +266,6 @@
 	{/if}
 {:else}
 	<Badge variant={getStatusBadgeVariant(item.publicStatus)} size="sm">
-		{publicStatusLabel(item.publicStatus)}
+		{badgeLabel}
 	</Badge>
 {/if}

package/package.json

@@ -1,20 +1,20 @@
 {
-	"name": "@alliance-droid/status-feedback-system",
-	"version": "4.2.2",
+	"name": "@alliance-droid/status-feedback-system",
+	"version": "4.2.3",
 	"type": "module",
 	"description": "Drop-in system status pages and user feedback forms for SvelteKit apps",
 	"svelte": "./dist/index.js",
 	"types": "./dist/index.d.ts",
-	"exports": {
-		".": {
-			"types": "./dist/index.d.ts",
-			"svelte": "./dist/index.js"
-		},
-		"./sveltekit/server": {
-			"types": "./dist/sveltekit/server.d.ts",
-			"default": "./dist/sveltekit/server.js"
-		}
-	},
+	"exports": {
+		".": {
+			"types": "./dist/index.d.ts",
+			"svelte": "./dist/index.js"
+		},
+		"./sveltekit/server": {
+			"types": "./dist/sveltekit/server.d.ts",
+			"default": "./dist/sveltekit/server.js"
+		}
+	},
 	"files": [
 		"dist",
 		"!dist/**/*.test.*",