create-feedbax 0.2.1 → 0.2.2

package/template/src/public-release-links.test.ts

@@ -0,0 +1,120 @@
+import { expect, it } from "vitest";
+import { createFeedbackModule } from "@feedbax/feedback";
+import {
+  createChangelogModule,
+  createInMemoryChangelogStorage,
+} from "@feedbax/changelog";
+import { createPublicReleaseFeedbackModule } from "./public-release-links";
+
+it("links only published local Changelog Entries or safe explicit external release notes", async () => {
+  const entry = {
+    id: "entry",
+    slug: "released-export",
+    title: "Export",
+    summary: "Public",
+    body: "Public",
+    date: "2026-10-15" as const,
+    labels: [],
+    images: [],
+    published: true,
+    createdAt: new Date(1000),
+    updatedAt: new Date(1000),
+  };
+  const changelog = createChangelogModule({
+    storage: createInMemoryChangelogStorage([
+      entry,
+      { ...entry, id: "draft", slug: "private-release", published: false },
+    ]),
+  });
+  const post = {
+    id: "p",
+    slug: "export",
+    title: "Export",
+    description: "Public",
+    type: "Feature Request" as const,
+    status: "Shipped" as const,
+    published: true,
+    createdAt: new Date(1000),
+    updatedAt: new Date(1000),
+  };
+  const module = (url: string) =>
+    createPublicReleaseFeedbackModule({
+      feedback: createFeedbackModule({
+        initialItems: [{ ...post, releaseNotesUrl: url }],
+      }),
+      siteUrl: "https://portal.example",
+      changelog,
+    });
+  expect(
+    (await module("/changelog#released-export").getPublicPost(post.slug))
+      ?.releaseNotesUrl,
+  ).toBe("/changelog#released-export");
+  for (const url of [
+    "/changelog#private-release",
+    "/internal/private",
+    "//evil.example",
+    "https://user:password@release.example",
+    "javascript:alert(1)",
+    "https://portal.example/changelog#private-release",
+    "https://github.com/private-team/private-repo/issues/1",
+    "https://github.com/private-team/private-repo/pull/2",
+    "https://github.com/private-team/private-repo/%69ssues/1",
+    "https://github.com./private-team/private-repo/issues/1",
+  ])
+    expect(
+      (await module(url).getPublicPost(post.slug))?.releaseNotesUrl,
+    ).toBeUndefined();
+  expect(
+    (
+      await module("https://example.com/releases/export").getPublicPost(
+        post.slug,
+      )
+    )?.releaseNotesUrl,
+  ).toBe("https://example.com/releases/export");
+  expect(
+    (await module("/changelog#private-release").listPublicPosts()).items[0]
+      ?.releaseNotesUrl,
+  ).toBeUndefined();
+});
+
+it("checks current public visibility before exposing a GitHub release URL", async () => {
+  const post = {
+    id: "p",
+    slug: "export",
+    title: "Export",
+    description: "Public",
+    type: "Feature Request" as const,
+    status: "Shipped" as const,
+    published: true,
+    createdAt: new Date(1000),
+    updatedAt: new Date(1000),
+  };
+  const module = (owner: string) =>
+    createPublicReleaseFeedbackModule({
+      feedback: createFeedbackModule({
+        initialItems: [
+          {
+            ...post,
+            releaseNotesUrl: `https://github.com/${owner}/feedback/releases/tag/v1`,
+          },
+        ],
+      }),
+      siteUrl: "https://portal.example",
+      request: async (input, init) => {
+        expect(String(input)).toBe(
+          `https://api.github.com/repos/${owner}/feedback`,
+        );
+        expect(init?.redirect).toBe("manual");
+        expect(new Headers(init?.headers).has("Authorization")).toBe(false);
+        return owner === "public-team"
+          ? Response.json({ id: 123, private: false })
+          : new Response(null, { status: 404 });
+      },
+    });
+  expect(
+    (await module("public-team").getPublicPost(post.slug))?.releaseNotesUrl,
+  ).toBe("https://github.com/public-team/feedback/releases/tag/v1");
+  expect(
+    (await module("private-team").getPublicPost(post.slug))?.releaseNotesUrl,
+  ).toBeUndefined();
+});

package/template/src/public-release-links.ts

@@ -0,0 +1,130 @@
+import type { FeedbackModule, PublicPost } from "@feedbax/feedback";
+import type { ChangelogModule } from "@feedbax/changelog";
+
+export function createPublicReleaseFeedbackModule(options: {
+  feedback: FeedbackModule;
+  siteUrl?: string;
+  changelog?: ChangelogModule;
+  request?: typeof fetch;
+}): FeedbackModule {
+  const { feedback } = options;
+  let published: Promise<Set<string>> | undefined;
+  const publishedSlugs = () =>
+    (published ??= (async () => {
+      const slugs = new Set<string>();
+      if (!options.changelog) return slugs;
+      let cursor: string | undefined;
+      for (let page = 0; page < 10; page++) {
+        const result = await options.changelog.listPublishedEntries({ cursor });
+        for (const entry of result.items) slugs.add(entry.slug);
+        cursor = result.nextCursor;
+        if (!cursor) break;
+      }
+      return slugs;
+    })());
+  const resolve = async (value: string) => {
+    if (
+      /[\\\s]/u.test(value) ||
+      Array.from(value).some(
+        (character) =>
+          character.charCodeAt(0) < 32 || character.charCodeAt(0) === 127,
+      )
+    )
+      return;
+    try {
+      const url = new URL(value, options.siteUrl ?? "https://feedbax.invalid");
+      if (
+        url.protocol !== "https:" ||
+        url.username ||
+        url.password ||
+        value.startsWith("//")
+      )
+        return;
+      const local =
+        value.startsWith("/") ||
+        (options.siteUrl && url.origin === new URL(options.siteUrl).origin);
+      if (!local) {
+        const host = url.hostname.toLowerCase().replace(/\.+$/, "");
+        if (
+          [
+            "api.github.com",
+            "gist.github.com",
+            "raw.githubusercontent.com",
+          ].includes(host)
+        )
+          return;
+        if (host === "github.com" || host === "www.github.com") {
+          const path = decodeURIComponent(url.pathname);
+          const release = path.match(
+            /^\/([A-Za-z0-9-]+)\/([A-Za-z0-9_.-]+)\/releases(?:\/|$)/,
+          );
+          if (!release || path.includes("%")) return;
+          const response = await (options.request ?? fetch)(
+            `https://api.github.com/repos/${release[1]}/${release[2]}`,
+            {
+              redirect: "manual",
+              signal: AbortSignal.timeout(5000),
+              headers: {
+                Accept: "application/vnd.github+json",
+                "User-Agent": "Feedbax",
+                "X-GitHub-Api-Version": "2026-03-10",
+              },
+            },
+          );
+          if (!response.ok) return;
+          const repository: unknown = await response.json();
+          if (
+            !repository ||
+            typeof repository !== "object" ||
+            Reflect.get(repository, "private") !== false
+          )
+            return;
+        }
+        return value;
+      }
+      if (
+        url.pathname !== "/changelog" ||
+        url.search ||
+        !/^#[a-z0-9]+(?:-[a-z0-9]+)*$/.test(url.hash)
+      )
+        return;
+      return (await publishedSlugs()).has(url.hash.slice(1))
+        ? value
+        : undefined;
+    } catch {
+      return;
+    }
+  };
+  const project = async <T extends PublicPost>(post: T): Promise<T> => {
+    if (!post.releaseNotesUrl) return post;
+    const url = await resolve(post.releaseNotesUrl);
+    const result = { ...post };
+    if (url) result.releaseNotesUrl = url;
+    else delete result.releaseNotesUrl;
+    return result;
+  };
+  const roadmap: FeedbackModule["listPublicRoadmapPosts"] = async (query) => {
+    const page = await feedback.listPublicRoadmapPosts(query);
+    return { ...page, items: await Promise.all(page.items.map(project)) };
+  };
+  return {
+    ...feedback,
+    async getPublicPost(slug) {
+      const post = await feedback.getPublicPost(slug);
+      return post ? project(post) : undefined;
+    },
+    async listPublicPosts(query) {
+      const page = await feedback.listPublicPosts(query);
+      return { ...page, items: await Promise.all(page.items.map(project)) };
+    },
+    listPublicRoadmapPosts: roadmap,
+    async getPublicPostRoadmap() {
+      const [planned, progress, shipped] = await Promise.all([
+        roadmap({ status: "Planned" }),
+        roadmap({ status: "In Progress" }),
+        roadmap({ status: "Shipped" }),
+      ]);
+      return { Planned: planned, "In Progress": progress, Shipped: shipped };
+    },
+  };
+}

package/template/src/routeTree.gen.ts

@@ -12,6 +12,7 @@ import { Route as rootRouteImport } from './routes/__root'
 import { Route as IndexRouteImport } from './routes/index'
 import { Route as ChangelogRouteImport } from './routes/changelog'
 import { Route as EmailPreferencesRouteImport } from './routes/email-preferences'
+import { Route as MyFeedbackRouteImport } from './routes/my-feedback'
 import { Route as RoadmapRouteImport } from './routes/roadmap'
 import { Route as SubmitRouteImport } from './routes/submit'
 import { Route as PSlugRouteImport } from './routes/p.$slug'
@@ -31,6 +32,11 @@ const EmailPreferencesRoute = EmailPreferencesRouteImport.update({
   path: '/email-preferences',
   getParentRoute: () => rootRouteImport,
 } as any)
+const MyFeedbackRoute = MyFeedbackRouteImport.update({
+  id: '/my-feedback',
+  path: '/my-feedback',
+  getParentRoute: () => rootRouteImport,
+} as any)
 const RoadmapRoute = RoadmapRouteImport.update({
   id: '/roadmap',
   path: '/roadmap',
@@ -51,6 +57,7 @@ export interface FileRoutesByFullPath {
   '/': typeof IndexRoute
   '/changelog': typeof ChangelogRoute
   '/email-preferences': typeof EmailPreferencesRoute
+  '/my-feedback': typeof MyFeedbackRoute
   '/roadmap': typeof RoadmapRoute
   '/submit': typeof SubmitRoute
   '/p/$slug': typeof PSlugRoute
@@ -59,6 +66,7 @@ export interface FileRoutesByTo {
   '/': typeof IndexRoute
   '/changelog': typeof ChangelogRoute
   '/email-preferences': typeof EmailPreferencesRoute
+  '/my-feedback': typeof MyFeedbackRoute
   '/roadmap': typeof RoadmapRoute
   '/submit': typeof SubmitRoute
   '/p/$slug': typeof PSlugRoute
@@ -68,6 +76,7 @@ export interface FileRoutesById {
   '/': typeof IndexRoute
   '/changelog': typeof ChangelogRoute
   '/email-preferences': typeof EmailPreferencesRoute
+  '/my-feedback': typeof MyFeedbackRoute
   '/roadmap': typeof RoadmapRoute
   '/submit': typeof SubmitRoute
   '/p/$slug': typeof PSlugRoute
@@ -78,6 +87,7 @@ export interface FileRouteTypes {
     | '/'
     | '/changelog'
     | '/email-preferences'
+    | '/my-feedback'
     | '/roadmap'
     | '/submit'
     | '/p/$slug'
@@ -86,6 +96,7 @@ export interface FileRouteTypes {
     | '/'
     | '/changelog'
     | '/email-preferences'
+    | '/my-feedback'
     | '/roadmap'
     | '/submit'
     | '/p/$slug'
@@ -94,6 +105,7 @@ export interface FileRouteTypes {
     | '/'
     | '/changelog'
     | '/email-preferences'
+    | '/my-feedback'
     | '/roadmap'
     | '/submit'
     | '/p/$slug'
@@ -103,6 +115,7 @@ export interface RootRouteChildren {
   IndexRoute: typeof IndexRoute
   ChangelogRoute: typeof ChangelogRoute
   EmailPreferencesRoute: typeof EmailPreferencesRoute
+  MyFeedbackRoute: typeof MyFeedbackRoute
   RoadmapRoute: typeof RoadmapRoute
   SubmitRoute: typeof SubmitRoute
   PSlugRoute: typeof PSlugRoute
@@ -131,6 +144,13 @@ declare module '@tanstack/react-router' {
       preLoaderRoute: typeof EmailPreferencesRouteImport
       parentRoute: typeof rootRouteImport
     }
+    '/my-feedback': {
+      id: '/my-feedback'
+      path: '/my-feedback'
+      fullPath: '/my-feedback'
+      preLoaderRoute: typeof MyFeedbackRouteImport
+      parentRoute: typeof rootRouteImport
+    }
     '/roadmap': {
       id: '/roadmap'
       path: '/roadmap'
@@ -159,6 +179,7 @@ const rootRouteChildren: RootRouteChildren = {
   IndexRoute: IndexRoute,
   ChangelogRoute: ChangelogRoute,
   EmailPreferencesRoute: EmailPreferencesRoute,
+  MyFeedbackRoute: MyFeedbackRoute,
   RoadmapRoute: RoadmapRoute,
   SubmitRoute: SubmitRoute,
   PSlugRoute: PSlugRoute,

package/template/src/routes/my-feedback.tsx

@@ -0,0 +1,16 @@
+import { createFileRoute, notFound } from "@tanstack/react-router";
+import feedbax from "../feedbax";
+import { MyFeedbackPage } from "../my-feedback-page";
+export const Route = createFileRoute("/my-feedback")({
+  beforeLoad: () => {
+    if (!feedbax.connected) throw notFound();
+  },
+  head: () => ({
+    meta: [
+      { title: "My feedback" },
+      { name: "robots", content: "noindex,nofollow" },
+      { name: "referrer", content: "no-referrer" },
+    ],
+  }),
+  component: MyFeedbackPage,
+});

package/template/src/server.ts

@@ -1,3 +1,5 @@
+import { createMyFeedbackRequestHandler } from "./my-feedback-runtime";
+import { createPublicHistoryRequestHandler } from "./history-runtime";
 import { handleImageRequest } from "./images-runtime";
 import {
   handleParticipationRequest,
@@ -8,7 +10,13 @@ import { configuredTurnstileSecret } from "./turnstile-configuration";
 import { createPortalServerEntry } from "./portal-server-entry";
 import { createConfiguredTrustedFeedbackHandler } from "./trusted-feedback-runtime";
 import { env } from "cloudflare:workers";
-import { createConfiguredFeedbackModule } from "./feedback-runtime";
+import {
+  configuredIntegration,
+  configuredHistory,
+  createConfiguredContentFeedbackModule,
+  createConfiguredFeedbackModule,
+  requestParticipant,
+} from "./feedback-runtime";
 import { createPortalVoteHandler } from "./portal-voting";
 import { createCloudflareTurnstileVerifier } from "./cloudflare-turnstile";
 import feedbax from "./feedbax";
@@ -20,7 +28,39 @@ import {
 } from "./portal-comments";
 
 const application = createPortalServerEntry({
+  cachePublicReads: feedbax.provider !== "github" && !feedbax.history,
   connectedHandler: async (request) =>
+    (await createPublicHistoryRequestHandler({
+      enabled: Boolean(feedbax.history),
+      history: feedbax.history ? configuredHistory() : undefined,
+      rateLimit: async (input) =>
+        (
+          await env.TRUSTED_SUBMISSIONS_RATE_LIMITER.limit({
+            key: `history:${input.headers.get("CF-Connecting-IP") ?? "unknown"}`,
+          })
+        ).success,
+    })(request)) ??
+    (feedbax.connected &&
+    env.FEEDBAX_DB &&
+    request.url.includes("/internal/my-feedback")
+      ? await createMyFeedbackRequestHandler({
+          enabled: true,
+          siteUrl: feedbax.product.siteUrl!,
+          database: env.FEEDBAX_DB,
+          getParticipant: requestParticipant,
+          getFeedback: createConfiguredFeedbackModule,
+          rateLimit: async (input) =>
+            (
+              await env.TRUSTED_SUBMISSIONS_RATE_LIMITER.limit({
+                key: `my-feedback:${input.headers.get("CF-Connecting-IP") ?? "unknown"}`,
+              })
+            ).success,
+          limits: feedbax.submissions,
+        })(request)
+      : undefined) ??
+    (feedbax.provider === "github"
+      ? await configuredIntegration().handle(request)
+      : undefined) ??
     (await handleImageRequest(request)) ??
     (await handleParticipationRequest(request)) ??
     handleConnectedRequest(request),
@@ -123,6 +163,11 @@ const application = createPortalServerEntry({
 export default {
   ...application,
   async scheduled() {
+    if (feedbax.history) await configuredHistory().synchronize();
+    if (feedbax.provider === "github")
+      await configuredIntegration().reconcile(
+        createConfiguredContentFeedbackModule(),
+      );
     if (!feedbax.connected) return;
     if (feedbax.connected.processing === "standard") {
       await synchronizeConnectedUpdates();

package/template/src/submission-intent.ts

@@ -0,0 +1,26 @@
+// Session storage is tab-scoped. A failed request reuses the same secret intent
+// across a retry/reload; successful completion makes a later submission distinct.
+export async function submissionIntent(
+  storage: Pick<Storage, "getItem" | "setItem" | "removeItem">,
+  input: unknown,
+) {
+  const bytes = await crypto.subtle.digest(
+    "SHA-256",
+    new TextEncoder().encode(JSON.stringify(input)),
+  );
+  const digest = Array.from(new Uint8Array(bytes), (value) =>
+    value.toString(16).padStart(2, "0"),
+  ).join("");
+  const slot = `feedbax:pending-submission:${digest}`;
+  let key = storage.getItem(slot);
+  if (!key || !/^[A-Za-z0-9_-]{43}$/.test(key)) {
+    key = btoa(
+      String.fromCharCode(...crypto.getRandomValues(new Uint8Array(32))),
+    )
+      .replaceAll("+", "-")
+      .replaceAll("/", "_")
+      .replace(/=+$/, "");
+    storage.setItem(slot, key);
+  }
+  return { key, complete: () => storage.removeItem(slot) };
+}

package/template/vite.config.ts

@@ -3,6 +3,7 @@ import tailwindcss from "@tailwindcss/vite";
 import { tanstackStart } from "@tanstack/react-start/plugin/vite";
 import viteReact from "@vitejs/plugin-react";
 import { defineConfig } from "vite";
+import { publicFeedbaxConfiguration } from "./feedbax-vite";
 
 export default defineConfig({
   server: {
@@ -12,6 +13,7 @@ export default defineConfig({
     tsconfigPaths: true,
   },
   plugins: [
+    publicFeedbaxConfiguration(),
     cloudflare({ viteEnvironment: { name: "ssr" } }),
     tailwindcss(),
     tanstackStart({ server: { entry: "./server.ts" } }),