HollaHoop
Sign in
Feedback

Bugs

Things that should work but don't.

New post
All typesFeatureBugTweak

First-time organisation create fails with row-level security violation

Creating the very first organisation for a new account returned `new row violates row-level security policy for table "organizations"`. Root cause: the `INSERT ... RETURNING` re-checks the SELECT policy, which required org membership — but the `org_members` row was inserted *after* the org. Fixed in `0002_org_self_create.sql` by (1) loosening the SELECT policy to also accept `owner_id = auth.uid()`, and (2) adding an `AFTER INSERT` trigger that seeds the owner's `org_members` row atomically.

ShippedBugs·5 months ago·0

404 on public feedback post detail (PGRST200)

Visiting a post detail URL like `/hollahoop/feedback/feature-requests/p/<id>` returned 404. Real cause was a PGRST200 on the upstream PostgREST query because we tried to embed `author:profiles` on `posts` — but `posts.author_id` references `auth.users`, not `public.profiles`, so PostgREST couldn't infer the relationship. Fixed by removing the embedded select and attaching author profiles via a second query in `lib/data/feedback.ts`.

ShippedBugs·5 months ago·0

[Agent] Embed form submittable before anonymous auth completes

## Agent brief **Category:** bug | **Severity:** high | **Effort:** S ### Problem Embed `authState` starts as `'pending'` but the submit form renders immediately. User can submit before `signInAnonymously()` completes → `unauthenticated` error. ### Repro 1. Open embed on anonymous project 2. Type title quickly and submit before auth resolves 3. Error: "Please reload and try again" ### Files - `src/app/embed/[projectSlug]/client.tsx` — add pending loading state ### Acceptance criteria - [ ] Show spinner/skeleton while `authState === 'pending'` - [ ] Submit disabled until `authState === 'ok'` - [ ] No race on fast submit ### Suggested approach Early return loading UI for pending; disable submit button until ok.

BugShippedBugs·4 months ago·0

[Agent] Sitemap lists URLs for disabled portal features

## Agent brief **Category:** bug | **Severity:** medium | **Effort:** M ### Problem Sitemap always emits `/changelog`, `/leaderboard`, etc. for every public project via static `PROJECT_SURFACES`. Disabled features produce 404 URLs indexed by crawlers. ### Repro 1. Disable changelog or leaderboard 2. Check `/sitemap.xml` — dead URLs still listed ### Files - `src/lib/seo/sitemap.ts` — `PROJECT_SURFACES` - `src/lib/seo/sitemap-data.ts` — include project flags ### Acceptance criteria - [ ] Sitemap omits `/changelog` when `changelog_enabled=false` - [ ] Sitemap omits `/leaderboard` when disabled - [ ] Update `sitemap.test.ts` ### Suggested approach Filter surfaces per-project in `buildProjectSurfaceEntries` using flags from DB.

BugShippedBugs·4 months ago·0

[Agent] Viewer role sees write UI but RLS blocks actions

## Agent brief **Category:** bug | **Severity:** high | **Effort:** M ### Problem `viewer` org role can access admin UI and see create/edit buttons, but RLS blocks writes. Users get cryptic permission errors instead of read-only UI. ### Repro 1. Invite user as Viewer 2. Open admin feedback, try to change status or create post 3. Action fails at DB layer ### Files - `supabase/migrations/0035_viewer_role.sql` — policy reference - Admin components under `src/components/admin/` and `src/app/admin/` - Grep `org_role`, `viewer`, `canWrite` ### Acceptance criteria - [ ] Viewer sees read-only admin (no create/edit/delete controls) - [ ] Write server actions return clear 403 before DB - [ ] Tests for viewer cannot mutate ### Suggested approach Central `useOrgPermissions()` or server helper; gate buttons and routes.

BugShippedBugs·4 months ago·2

[Agent] Vote button requires sign-in on anonymous projects

## Agent brief **Category:** bug | **Severity:** medium | **Effort:** S ### Problem Vote button always redirects to sign-in even when project allows anonymous auth. Anonymous users cannot upvote on public feedback. ### Repro 1. Set auth_mode to anonymous 2. Log out, open feedback post detail 3. Click vote → forced login ### Files - `src/components/feedback/vote-button.tsx` (or similar) - Compare embed auth flow ### Acceptance criteria - [ ] Anonymous/optional projects allow voting without manual login - [ ] Required mode still needs sign-in ### Suggested approach Ensure anonymous session exists before vote action; mirror embed signInAnonymously.

BugShippedBugs·4 months ago·0

[Agent] New post form breaks when project has zero boards

## Agent brief **Category:** bug | **Severity:** medium | **Effort:** S ### Problem When project has zero feedback boards, `/feedback/new` still renders form; submit fails with confusing error. ### Repro 1. New project with no boards configured 2. Visit `/feedback/new` 3. Form renders but cannot submit successfully ### Files - `src/app/[projectSlug]/feedback/new/page.tsx` - `src/components/feedback/new-post-form.tsx` ### Acceptance criteria - [ ] Empty boards → friendly empty state with admin hint - [ ] Submit disabled when no board selected ### Suggested approach Early return empty state when `boards.length === 0`.

BugShippedBugs·4 months ago·0

[Agent] Private project 404s for signed-in org members

## Agent brief **Category:** bug | **Severity:** critical | **Effort:** M ### Problem Privacy settings say private boards are visible to signed-in workspace members, but all public routes use `getPublicProject()` which requires `is_public = true`. Making a project private 404s the entire portal for everyone, including org members and admins using "Open public site". ### Repro 1. Admin → Project settings → disable public visibility 2. Visit `/{projectSlug}` while signed in as org member 3. Observe 404 ### Files - `src/lib/data/projects.ts` — add `getProjectForPortal(slug, userId?)` - `src/app/[projectSlug]/layout.tsx` — use member-aware resolver - Grep all `getPublicProject` under `src/app/[projectSlug]/` ### Acceptance criteria - [ ] Org members can view private projects when signed in - [ ] Anonymous users still get 404 for private projects - [ ] Embed/widget routes follow same rule (see related card) ### Suggested approach Extend resolver: return project if `is_public OR is_project_member(project.id)`. Cache carefully per session. ### Out of scope Custom domain routing.

BugShippedBugs·4 months ago·0

Hub section toggles do not hide matching nav tabs

**Severity:** Medium **Area:** Project hub / settings Admin "Public hub" toggles (`hub_show_feedback`, etc.) only change content on `/{projectSlug}`. Primary tabs (Feedback, Roadmap, Updates, Docs) always show regardless of toggles. Admins can hide a section on the hub while navigation still advertises it, which feels broken. **Fix:** Either gate `ProjectTabs` on the same hub flags or document that toggles are hub-only and rename the settings copy.

BugShippedBugs·4 months ago·0

[Agent] Domain settings hardcode hollahoop.app hostname

## Agent brief **Category:** bug | **Severity:** low | **Effort:** XS ### Problem Custom domain settings UI hardcodes `hollahoop.app` in CNAME instructions instead of reading from env/config. ### Repro 1. Admin → Project → Domain settings 2. CNAME target always shows hollahoop.app even on self-hosted/staging ### Files - Grep `hollahoop.app` in domain settings components ### Acceptance criteria - [ ] CNAME/host values use `NEXT_PUBLIC_APP_URL` or dedicated env - [ ] Staging shows correct hostname ### Suggested approach Use existing `getAppOrigin()` helper if present.

BugShippedBugs·4 months ago·0

Updates nav tab 404s when changelog is disabled

**Severity:** High **Area:** Changelog / navigation `ProjectTabs` always renders the Updates tab, but `changelog/page.tsx` calls `notFound()` when `project.changelog_enabled` is false. Admins can disable the feed in settings while end users still see a tab that 404s. Leaderboard already gates on `community_leaderboard_enabled`; changelog should match. **Fix:** Hide the Updates tab when changelog is disabled, or redirect to a friendly disabled state.

BugShippedBugs·4 months ago·0

[Agent] Search shows changelog results when feed disabled

## Agent brief **Category:** bug | **Severity:** medium | **Effort:** S ### Problem Search API returns changelog hits even when `project.changelog_enabled` is false. Users click a result and land on a 404 Updates page. ### Repro 1. Disable changelog in project settings 2. Open command palette, search for a known changelog title 3. Result appears; click → 404 ### Files - `src/app/api/search/route.ts` — filter changelog query on `changelog_enabled` ### Acceptance criteria - [ ] No changelog results when feed disabled - [ ] Docs/posts still searchable - [ ] Add test in route test file if exists ### Suggested approach Join projects table or filter in post-processing; mirror leaderboard gating pattern.

BugShippedBugs·4 months ago·0

[Agent] Invalid ?board= slug silently ignored on new post

## Agent brief **Category:** bug | **Severity:** low | **Effort:** XS ### Problem `?board=invalid-slug` on `/feedback/new` is silently ignored; form defaults to first board without warning. ### Repro 1. Visit `/feedback/new?board=nonexistent` 2. Form opens with wrong board pre-selected ### Files - `src/app/[projectSlug]/feedback/new/page.tsx` line 28 ### Acceptance criteria - [ ] Invalid board slug shows inline warning or 404 - [ ] Valid slug pre-selects correctly ### Suggested approach If `board` param present but not found, show toast or banner.

BugShippedBugs·4 months ago·0

[Agent] Ticket→feedback redirect uses dead highlight param

## Agent brief **Category:** bug | **Severity:** medium | **Effort:** XS ### Problem Support ticket → feedback conversion redirects with `?highlight={id}` but feedback list does not read that param. Link does nothing useful. ### Repro 1. Admin support → convert ticket to feedback 2. Follow redirect URL with `?highlight=` 3. No scroll/highlight on target post ### Files - `src/app/admin/support/ai-actions.ts` — redirect URL - `src/components/feedback/` — add highlight handler or remove param ### Acceptance criteria - [ ] After conversion, user lands on post with visible highlight OR - [ ] Redirect uses direct post URL `/feedback/p/{id}` ### Suggested approach Prefer direct post detail URL over list highlight param.

BugShippedBugs·4 months ago·0

Admin chrome 500: UTF-16 corrupted nav files break changelog, docs, and /app

**Found during UX audit (Jun 2026)** Visiting `/hollahoop/changelog`, `/hollahoop/docs`, and `/app` returned Next.js 500 errors locally because `workspace-top-bar.tsx` was saved as UTF-16LE (`'use client'` parsed as invalid characters). `admin-top-bar.tsx` and `language-switcher.tsx` also exported the wrong component (`SidebarCollapseToggle` duplicate). **Impact:** Entire admin workspace shell and any route importing `WorkspaceShell` fails to compile. **Fix:** Re-encode files as UTF-8 and restore proper `AdminTopBar` + `LanguageSwitcher` exports.

BugShippedBugs·4 months ago·0

[Agent] Search changelog URLs use broken hash anchors

## Agent brief **Category:** bug | **Severity:** medium | **Effort:** XS ### Problem Changelog search hits link to `/{slug}/changelog#${entry.slug}` but real URLs are `/{slug}/changelog/${slug}`. Hash anchors do not exist on index page. ### Repro 1. Search palette → pick a changelog hit 2. Lands on changelog index with hash that does nothing ### Files - `src/app/api/search/route.ts` line ~205 ### Acceptance criteria - [ ] Changelog search URLs match `changelog/[slug]/page.tsx` routes - [ ] Click navigates to correct entry page ### Suggested approach Change to `/${c.project.slug}/changelog/${c.slug}`.

BugShippedBugs·4 months ago·0

[Agent] /feedback/new ignores anonymous auth_mode

## Agent brief **Category:** bug | **Severity:** critical | **Effort:** S ### Problem `/feedback/new` always redirects to sign-in when no session, ignoring `project.auth_mode` of `anonymous` or `optional`. Only the embed iframe calls `signInAnonymously()`. ### Repro 1. Settings → Login & SSO → set Anonymous or Optional 2. Log out, visit `/{slug}/feedback/new` 3. Forced redirect to login instead of anonymous session ### Files - `src/app/[projectSlug]/feedback/new/page.tsx` (lines 22-25) - Reference: `src/app/embed/[projectSlug]/client.tsx` auth effect ### Acceptance criteria - [ ] Anonymous/optional projects allow posting without manual login - [ ] Required mode still redirects to sign-in - [ ] Matches embed widget behavior ### Suggested approach Client wrapper or server action that signs in anonymously before render when `auth_mode !== 'required'`.

BugShippedBugs·4 months ago·0
HollahoopGet yours