Claude: changes for issue #194 #204

Merged

Grandiras merged 1 commit from claude/issue-194 into main

2026-09-18 23:31:17 +00:00

claude-bot commented

2026-09-18 22:44:02 +00:00

Collaborator

Closes #194.

claude-bot added 1 commit

2026-09-18 22:44:02 +00:00

A home page at /, and members create their own boards

CI / build (pull_request) Successful in 37s

Details

2557d53f87

`/` was the default board — the first one in the switcher that the member
could see — so every visit began on somebody else's board, and a member
with none had nowhere to be at all. It is the place you start from now:
a tile per board you can see, and the way to one more.

- **Home** (`Components/Pages/Home.razor`): a tile per board, wearing the
  colour `BoardPalette` already gives it on the general calendar, with a
  count, a little picture of its columns, who else can see it, and — on a
  board you run — its settings. `BoardService.GetTilesAsync` reads all of
  that in three queries for the whole list, and none of it decrypts
  anything but the board's own name: a count per column is a count on a
  foreign key. "Due soon" is the line that cannot be crossed, because
  `Card.DueDate` is ciphertext.
- **Members make boards.** The form is a tile in the same grid, and the
  board it makes is `Restricted` to its creator, who is its admin —
  starting something of your own is not an act of publishing. It still
  arrives with To Do / Doing / Done. `/admin/boards` is gone and
  redirects home; the Admin flyout it lived in opened onto a single row
  after that, so it is the Members link now.
- **`/` resumes, but only from outside.** A document request the browser
  marks `Sec-Fetch-Site: none` — typed, bookmarked, launched — is sent
  where this browser left off, through the same checked target `/launch`
  uses; everything else renders the page, which is what makes the
  wordmark and a reload stay put. The service worker had to stop
  re-issuing navigations with `fetch(event.request)` to make it work at
  all: that request carries the *worker's* Fetch Metadata, so the header
  said `same-origin` for every member who had been here before.
  Navigation preload is the fix.
- **What goes away**: the default board (`GetDefaultAsync`,
  `BoardOutcome.None`, the `board.none` empty state), `LastBoardException`,
  and the bare board-scoped paths — `/calendar` is the general calendar
  and `HomeHref` is deleted, since the wordmark goes to `/` from
  everywhere. An `.ics` link with no `board` means every board rather
  than 404ing a subscription that has been syncing for a year.

Tests: `home.spec.js` for the tiles, the private board and the four rows
of the resume table; `helpers/boards.js` for the fixtures every other
spec copied; `LastPageTests` for the header rule, including the browser
that sends none.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>

claude-bot referenced this pull request

2026-09-18 22:44:04 +00:00

A home page at /, and members create their own boards #194

Grandiras commented

2026-09-18 23:26:35 +00:00

Owner

@claude-reviewer

claude-bot commented

2026-09-18 23:26:38 +00:00

Author

Collaborator

🤖 Reviewing this PR — follow along in the action run; the reply will link the full session transcript.

📜 Live transcript — updating every ~5 minutes while the task runs.

🤖 Reviewing this PR — follow along in [the action run](https://git.grandiras.net/Grandiras/claude-bot/actions/runs/562); the reply will link the full session transcript.  📜 [Live transcript](https://git.grandiras.net/Grandiras/claude-bot/src/branch/claude-logs/transcripts/Grandiras/Ponente/pr-204/run-562.md) — updating every ~5 minutes while the task runs.

claude-reviewer approved these changes

2026-09-18 23:30:15 +00:00

claude-reviewer left a comment

✅ Verdict: approve — no blocking issues found.

This is a large, well-executed change implementing issue #194: / becomes a home page listing a member's boards (with in-place board creation) instead of resolving to a "default board", and the docs are updated thoroughly and consistently with the code.

I checked the parts most likely to hide correctness bugs:

NavHeader.razor: ActiveSection/ActiveBoardId/IsAllCalendar were reworked to stop substituting a default board, and the nav-tabs/switcher visibility rules (home tab vs board tab, switcher hidden on the home page, Board link only drawn when there is a board) all match what the accompanying doc changes describe. Path trims the trailing slash so IsHomeActive (Path.Length == 0) is correct for /.
Program.cs / LastPage.cs: the new / resume middleware reads Sec-Fetch-Site/Sec-Fetch-Dest and reuses the same ResumeTargetAsync board-visibility check as /launch. I specifically checked the ordering concern of registering app.Use(...) for / after MapRazorComponents/MapGet in source: since this Program.cs never calls UseRouting/UseEndpoints explicitly, ASP.NET Core auto-inserts endpoint execution as the terminal step of the pipeline, so this middleware still runs before the Razor Components endpoint for every request — confirmed against current ASP.NET Core docs/behavior. The open-redirect gate (LastPage.Remember/ReturnUrl.Sanitize) and the board-existence/visibility fallback are unchanged in spirit and covered by LastPageTests, including the //evil.example and missing-header cases.
BoardService.GetTilesAsync / CreateAsync: three batched queries for the whole tile list (no per-board decryption beyond the board name), and a created board gets Restricted visibility plus an admin grant for its creator, matching the documented "a board you make is private until you share it" rule.
Home.razor: policy-gated behind AllowlistRequirement like other member pages, reacts to both BoardsChanged and BoardChanged notifications as the docs require, and the empty/loading/tile states look correct.
Locale keys (home.*, nav.home, nav.members) are present in both en and de, satisfying the i18n convention, and the changelog entries were added/updated appropriately without a version header.
No dangling references to removed concepts (LastBoardException, GetDefaultAsync, HomeHref, board.none) remain anywhere in src or tests.

I did not find any correctness, security, or omission issues worth blocking on. This looks ready to merge.

⏱ 3m 27s · 20 turns · tokens: 104.3k in / 12.2k out (+1706.4k cache-read)
📜 Full session transcript

✅ **Verdict: approve** — no blocking issues found. This is a large, well-executed change implementing issue #194: `/` becomes a home page listing a member's boards (with in-place board creation) instead of resolving to a "default board", and the docs are updated thoroughly and consistently with the code. I checked the parts most likely to hide correctness bugs: - **`NavHeader.razor`**: `ActiveSection`/`ActiveBoardId`/`IsAllCalendar` were reworked to stop substituting a default board, and the nav-tabs/switcher visibility rules (home tab vs board tab, switcher hidden on the home page, Board link only drawn when there is a board) all match what the accompanying doc changes describe. `Path` trims the trailing slash so `IsHomeActive` (`Path.Length == 0`) is correct for `/`. - **`Program.cs` / `LastPage.cs`**: the new `/` resume middleware reads `Sec-Fetch-Site`/`Sec-Fetch-Dest` and reuses the same `ResumeTargetAsync` board-visibility check as `/launch`. I specifically checked the ordering concern of registering `app.Use(...)` for `/` *after* `MapRazorComponents`/`MapGet` in source: since this Program.cs never calls `UseRouting`/`UseEndpoints` explicitly, ASP.NET Core auto-inserts endpoint execution as the terminal step of the pipeline, so this middleware still runs before the Razor Components endpoint for every request — confirmed against current ASP.NET Core docs/behavior. The open-redirect gate (`LastPage.Remember`/`ReturnUrl.Sanitize`) and the board-existence/visibility fallback are unchanged in spirit and covered by `LastPageTests`, including the `//evil.example` and missing-header cases. - **`BoardService.GetTilesAsync` / `CreateAsync`**: three batched queries for the whole tile list (no per-board decryption beyond the board name), and a created board gets `Restricted` visibility plus an admin grant for its creator, matching the documented "a board you make is private until you share it" rule. - **`Home.razor`**: policy-gated behind `AllowlistRequirement` like other member pages, reacts to both `BoardsChanged` and `BoardChanged` notifications as the docs require, and the empty/loading/tile states look correct. - Locale keys (`home.*`, `nav.home`, `nav.members`) are present in both `en` and `de`, satisfying the i18n convention, and the changelog entries were added/updated appropriately without a version header. - No dangling references to removed concepts (`LastBoardException`, `GetDefaultAsync`, `HomeHref`, `board.none`) remain anywhere in src or tests. I did not find any correctness, security, or omission issues worth blocking on. This looks ready to merge. --- ⏱ 3m 27s · 20 turns · tokens: 104.3k in / 12.2k out (+1706.4k cache-read) 📜 [Full session transcript](https://git.grandiras.net/Grandiras/claude-bot/src/branch/claude-logs/transcripts/Grandiras/Ponente/pr-204/run-562.md)

Grandiras merged commit 0750572546 into main

2026-09-18 23:31:17 +00:00

Grandiras deleted branch claude/issue-194

2026-09-18 23:31:17 +00:00

Grandiras referenced this pull request from a commit

2026-09-18 23:31:18 +00:00

Claude: changes for issue #194 (#204)

Grandiras referenced this pull request

2026-09-22 21:19:18 +00:00

Member-owned boards and a home page: decisions and order of work #190