Bugs

Things that should work but don't.

Magic link returns "Signups not allowed for OTP"

Trying to sign in via the magic link form on `/login` with a brand-new email returns a Supabase error: `Signups not allowed for otp`. Likely a GoTrue config flag (`GOTRUE_EXTERNAL_EMAIL_ENABLED` / `GOTRUE_DISABLE_SIGNUP`) — needs to be flipped or guarded with an explicit "use OAuth for new accounts" message.

ReviewingBugs·8 days ago·1

Theme toggle flickers on first paint (FOUC)

On first load, the page briefly shows light theme before the saved dark theme is applied. Need to inline the theme-pick script before hydration so the `class="dark"` is set on `<html>` synchronously.

ShippedBugs·7 days ago·0

First-time organisation create fails with row-level security violation

Creating the very first organisation for a new account returned `new row violates row-level security policy for table "organizations"`. Root cause: the `INSERT ... RETURNING` re-checks the SELECT policy, which required org membership — but the `org_members` row was inserted *after* the org. Fixed in `0002_org_self_create.sql` by (1) loosening the SELECT policy to also accept `owner_id = auth.uid()`, and (2) adding an `AFTER INSERT` trigger that seeds the owner's `org_members` row atomically.

ShippedBugs·5 days ago·0

404 on public feedback post detail (PGRST200)

Visiting a post detail URL like `/hollahoop/feedback/feature-requests/p/<id>` returned 404. Real cause was a PGRST200 on the upstream PostgREST query because we tried to embed `author:profiles` on `posts` — but `posts.author_id` references `auth.users`, not `public.profiles`, so PostgREST couldn't infer the relationship. Fixed by removing the embedded select and attaching author profiles via a second query in `lib/data/feedback.ts`.

ShippedBugs·4 days ago·0

Slug auto-fill stops after the first character (org & project create)

Typing the workspace name was supposed to auto-fill the slug, but the slug field froze after one character because the auto-fill only ran when the slug was empty. Fixed with a `slugTouched` flag — auto-fill stays active until the user manually edits the slug.

ShippedBugs·5 days ago·0

Microsoft OAuth doesn't pick up the avatar URL

After signing in via Microsoft, my profile shows the email-prefix initials instead of the Azure avatar. GitHub and Google work fine — Microsoft's `picture` claim is named differently.

PendingBugs·6 days ago·0

/app dashboard had no portal chrome (felt standalone)

`/app`, `/app/new`, and `/app/[org]/new` rendered bare on the body background — no left rail, no nav, no way to switch workspaces. They now render inside a proper workspace shell that mirrors the project sidebar.

ShippedBugs·3 days ago·0