@alliance-droid/status-feedback-system 4.2.3 → 4.3.0

package/dist/components/board/state.svelte.js

@@ -6,6 +6,7 @@
  *   <FeedbackSidebar {board} />
  *   <FeedbackList {board} />
  */
+import { createBoardStatusState } from './status-state.svelte.js';
 import { FEEDBACK_CATEGORY_ICONS } from '../../types.js';
 import { createStatusClient, } from '../../api.js';
 export function createFeedbackBoard(options) {
@@ -25,10 +26,8 @@ export function createFeedbackBoard(options) {
     let votedItems = $state({});
     let voteErrors = $state({});
     let loadMoreError = $state('');
-    let transitions = $state({});
-    // Resolved status-management privilege (one-time backend probe, not token presence).
-    let statusPrivilege = $state(false);
-    let privilegeProbed = false;
+    const statusState = createBoardStatusState(client, getAuthToken);
+    let requestVersion = 0;
     // Response cache
     const responseCache = {};
     // Track in-flight votes to prevent duplicate requests. A plain Set is correct
@@ -36,6 +35,9 @@ export function createFeedbackBoard(options) {
     // eslint-disable-next-line svelte/prefer-svelte-reactivity
     const pendingVotes = new Set();
     async function load() {
+        const version = ++requestVersion;
+        loadingMore = false;
+        loadMoreError = '';
         loading = true;
         error = '';
         try {
@@ -45,22 +47,28 @@ export function createFeedbackBoard(options) {
                 sort: sortBy,
                 limit: pageSize,
                 offset: 0,
-            });
+            }, await statusState.resolveToken());
+            if (version !== requestVersion)
+                return;
             items = data.items;
             total = data.total;
             categories = data.categories;
-            void ensureStatusPrivilege();
+            statusState.reset(data.canManageStatus ?? false);
         }
         catch (e) {
+            if (version !== requestVersion)
+                return;
             error = e instanceof Error ? e.message : 'Failed to load';
         }
         finally {
-            loading = false;
+            if (version === requestVersion)
+                loading = false;
         }
     }
     async function loadMore() {
-        if (loadingMore || items.length >= total)
+        if (loading || loadingMore || items.length >= total)
             return;
+        const version = requestVersion;
         loadingMore = true;
         loadMoreError = '';
         try {
@@ -70,15 +78,21 @@ export function createFeedbackBoard(options) {
                 sort: sortBy,
                 limit: pageSize,
                 offset: items.length,
-            });
+            }, await statusState.resolveToken());
+            if (version !== requestVersion)
+                return;
             items = [...items, ...data.items];
             total = data.total;
+            statusState.reset(data.canManageStatus ?? false);
         }
         catch (e) {
+            if (version !== requestVersion)
+                return;
             loadMoreError = e instanceof Error ? e.message : 'Failed to load more';
         }
         finally {
-            loadingMore = false;
+            if (version === requestVersion)
+                loadingMore = false;
         }
     }
     // Auto-reload when filters change
@@ -167,51 +181,8 @@ export function createFeedbackBoard(options) {
         if (item)
             item.responseCount += 1;
     }
-    async function resolveToken() {
-        if (!getAuthToken)
-            return null;
-        try {
-            return (await getAuthToken()) ?? null;
-        }
-        catch {
-            return null;
-        }
-    }
-    async function loadTransitions(itemId) {
-        const token = await resolveToken();
-        if (!token)
-            return null;
-        try {
-            const result = await client.getBoardTransitions(itemId, token);
-            transitions = { ...transitions, [itemId]: result };
-            // The backend tells us whether this user may manage status (200 either
-            // way — no 403 console noise for ordinary signed-in users).
-            statusPrivilege = result.canManage;
-            return result;
-        }
-        catch {
-            // 401 (no/invalid token) or network error → no control.
-            return null;
-        }
-    }
-    /**
-     * One-time probe so the UI can gate the status control by *actual* privilege
-     * (valid token + qualifying role + project access), not merely token presence.
-     * Loads the first item's transitions once; a non-null result confirms the
-     * backend authorized the user. No token / no items / a 403 leaves it `false`.
-     */
-    async function ensureStatusPrivilege() {
-        if (privilegeProbed || !getAuthToken)
-            return;
-        const sample = items[0];
-        if (!sample)
-            return;
-        privilegeProbed = true;
-        // loadTransitions sets statusPrivilege from the result's canManage flag.
-        await loadTransitions(sample.id);
-    }
     async function setStatus(itemId, status, reason) {
-        const token = await resolveToken();
+        const token = await statusState.resolveToken();
         if (!token)
             throw new Error('Authentication required to set status');
         const result = await client.updateBoardStatus(itemId, { status, reason }, token);
@@ -219,9 +190,11 @@ export function createFeedbackBoard(options) {
         if (item) {
             item.status = result.status;
             item.publicStatus = result.publicStatus;
+            item.canChangeStatus = result.canChangeStatus;
+            item.needsInput = result.needsInput;
         }
-        // Allowed targets depend on the new status — refresh the cache.
-        await loadTransitions(itemId);
+        // Re-query to keep the current filter, counts, and pagination accurate.
+        await load();
     }
     return {
         get client() { return client; },
@@ -249,9 +222,9 @@ export function createFeedbackBoard(options) {
         getResponses,
         submitFeedback,
         submitResponse,
-        get canManageStatus() { return statusPrivilege; },
-        get transitions() { return transitions; },
-        loadTransitions,
+        get canManageStatus() { return statusState.canManage; },
+        get transitions() { return statusState.transitions; },
+        loadTransitions: statusState.loadTransitions,
         setStatus,
         getCategoryIcon(name) {
             return (categoryConfig[name]?.icon ||

package/dist/components/board/status-state.svelte.d.ts

@@ -0,0 +1,10 @@
+/** Server-authorized status capabilities and transition cache for a single board. */
+import type { BoardTransitions, StatusClient } from '../../api.js';
+import type { FeedbackBoardOptions } from './state.svelte.js';
+export declare function createBoardStatusState(client: StatusClient, getAuthToken: FeedbackBoardOptions['getAuthToken']): {
+    readonly canManage: boolean;
+    readonly transitions: Record<string, BoardTransitions>;
+    resolveToken: () => Promise<string | null>;
+    loadTransitions: (itemId: string) => Promise<BoardTransitions | null>;
+    reset(allowed: boolean): void;
+};

package/dist/components/board/status-state.svelte.js

@@ -0,0 +1,41 @@
+export function createBoardStatusState(client, getAuthToken) {
+    let canManage = $state(false);
+    let transitions = $state({});
+    let generation = 0;
+    async function resolveToken() {
+        try {
+            return (await getAuthToken?.()) ?? null;
+        }
+        catch {
+            return null;
+        }
+    }
+    async function loadTransitions(itemId) {
+        const currentGeneration = generation;
+        const token = await resolveToken();
+        if (!token)
+            return null;
+        try {
+            const result = await client.getBoardTransitions(itemId, token);
+            if (currentGeneration !== generation)
+                return null;
+            transitions = { ...transitions, [itemId]: result };
+            canManage = result.canManage;
+            return result;
+        }
+        catch {
+            return null;
+        }
+    }
+    return {
+        get canManage() { return canManage; },
+        get transitions() { return transitions; },
+        resolveToken,
+        loadTransitions,
+        reset(allowed) {
+            generation += 1;
+            canManage = allowed;
+            transitions = {};
+        }
+    };
+}

package/dist/sveltekit/server.js

@@ -64,11 +64,15 @@ async function handleProxyRequest(event, options) {
     if (route.forwardBearerToken) {
         const authorization = event.request.headers.get('authorization');
         if (!authorization?.toLowerCase().startsWith('bearer ')) {
-            if (route.operation === 'transitions')
-                return statusManagementUnavailable();
-            return feedbackError(401, 'Status feedback access token required');
+            if (route.forwardBearerToken !== 'optional') {
+                if (route.operation === 'transitions')
+                    return statusManagementUnavailable();
+                return feedbackError(401, 'Status feedback access token required');
+            }
+        }
+        else {
+            headers.set('Authorization', authorization);
         }
-        headers.set('Authorization', authorization);
     }
     const method = event.request.method.toUpperCase();
     let body;
@@ -137,6 +141,7 @@ function getRouteSpec(method, path) {
             upstreamPath: '/api/board',
             bodyKind: 'none',
             allowedSearchParams: BOARD_QUERY_KEYS,
+            forwardBearerToken: 'optional',
         };
     }
     if (normalizedMethod === 'POST' && normalizedPath === 'api/board/vote') {

package/package.json

@@ -1,70 +1,70 @@
-{
-	"name": "@alliance-droid/status-feedback-system",
-	"version": "4.2.3",
-	"type": "module",
-	"description": "Drop-in system status pages and user feedback forms for SvelteKit apps",
-	"svelte": "./dist/index.js",
-	"types": "./dist/index.d.ts",
-	"exports": {
-		".": {
-			"types": "./dist/index.d.ts",
-			"svelte": "./dist/index.js"
-		},
-		"./sveltekit/server": {
-			"types": "./dist/sveltekit/server.d.ts",
-			"default": "./dist/sveltekit/server.js"
-		}
-	},
-	"files": [
-		"dist",
-		"!dist/**/*.test.*",
-		"CHANGELOG.md"
-	],
-	"scripts": {
-		"build": "svelte-package -o dist && publint",
-		"lint": "eslint src",
-		"check": "svelte-check --tsconfig ./tsconfig.json",
-		"test": "vitest run",
-		"test:watch": "vitest",
-		"prepublishOnly": "npm run build"
-	},
-	"peerDependencies": {
-		"@alliance-droid/svelte-component-library": ">=1.3.2",
-		"svelte": "^5.48.0"
-	},
-	"devDependencies": {
-		"@alliance-droid/svelte-component-library": "^1.3.2",
-		"@eslint/js": "^10.0.1",
-		"@sveltejs/package": "^2.3.0",
-		"@sveltejs/vite-plugin-svelte": "^6.0.0",
-		"@testing-library/jest-dom": "^6.9.1",
-		"@testing-library/svelte": "^5.3.1",
-		"eslint": "^10.4.0",
-		"eslint-plugin-svelte": "^3.17.1",
-		"globals": "^17.6.0",
-		"jsdom": "^29.0.0",
-		"publint": "^0.3.0",
-		"svelte": "^5.48.0",
-		"svelte-check": "^4.3.0",
-		"typescript": "^5.9.0",
-		"typescript-eslint": "^8.59.4",
-		"vite": "^7.3.0",
-		"vitest": "^4.0.0"
-	},
-	"keywords": [
-		"svelte",
-		"sveltekit",
-		"status-page",
-		"feedback",
-		"uptime"
-	],
-	"author": "Alliance Technical Group",
-	"license": "UNLICENSED",
-	"publishConfig": {
-		"access": "restricted"
-	},
-	"repository": {
-		"type": "git",
-		"url": "git+https://alliance.ghe.com/alliance/status-feedback-system.git"
-	}
-}
+{
+	"name": "@alliance-droid/status-feedback-system",
+	"version": "4.3.0",
+	"type": "module",
+	"description": "Drop-in system status pages and user feedback forms for SvelteKit apps",
+	"svelte": "./dist/index.js",
+	"types": "./dist/index.d.ts",
+	"exports": {
+		".": {
+			"types": "./dist/index.d.ts",
+			"svelte": "./dist/index.js"
+		},
+		"./sveltekit/server": {
+			"types": "./dist/sveltekit/server.d.ts",
+			"default": "./dist/sveltekit/server.js"
+		}
+	},
+	"files": [
+		"dist",
+		"!dist/**/*.test.*",
+		"CHANGELOG.md"
+	],
+	"scripts": {
+		"build": "svelte-package -o dist && publint",
+		"lint": "eslint src",
+		"check": "svelte-check --tsconfig ./tsconfig.json",
+		"test": "vitest run",
+		"test:watch": "vitest",
+		"prepublishOnly": "npm run build"
+	},
+	"peerDependencies": {
+		"@alliance-droid/svelte-component-library": ">=1.3.2",
+		"svelte": "^5.55.7"
+	},
+	"devDependencies": {
+		"@alliance-droid/svelte-component-library": "^1.20.2",
+		"@eslint/js": "^10.0.1",
+		"@sveltejs/package": "^2.5.8",
+		"@sveltejs/vite-plugin-svelte": "^6.2.4",
+		"@testing-library/jest-dom": "^6.9.1",
+		"@testing-library/svelte": "^5.4.2",
+		"eslint": "^10.10.0",
+		"eslint-plugin-svelte": "^3.23.0",
+		"globals": "^17.12.0",
+		"jsdom": "^29.1.1",
+		"publint": "^0.3.24",
+		"svelte": "^5.57.0",
+		"svelte-check": "^4.7.6",
+		"typescript": "^5.9.3",
+		"typescript-eslint": "^8.70.0",
+		"vite": "^7.3.6",
+		"vitest": "^4.1.11"
+	},
+	"keywords": [
+		"svelte",
+		"sveltekit",
+		"status-page",
+		"feedback",
+		"uptime"
+	],
+	"author": "Alliance Technical Group",
+	"license": "UNLICENSED",
+	"publishConfig": {
+		"access": "restricted"
+	},
+	"repository": {
+		"type": "git",
+		"url": "git+https://alliance.ghe.com/alliance/status-feedback-system.git"
+	}
+}