Feature requests

Ideas the community would love to see.

Widget: identified end users via a signed JWT

Split out of the Embeddable feedback widget card (whose MVP has shipped). Today the widget signs visitors in anonymously; this card lets a host site submit feedback as a known user. Proposed shape: - A signing endpoint: the customer's backend calls Hollahoop with their API key plus the end user's id/email/name and gets back a short-lived JWT we sign. - The host passes that token to the widget via a data-user attribute or window.__hollahoop.identify(token). - /embed verifies the token (it is our own JWT), and submitPostAction associates the post with that identity instead of an anonymous user. - Anti-spoofing: verify signature + expiry server side; never trust client-supplied identity without a valid token. Out of scope: full SSO, per-user notification routing. Needs a decision on the JWT signing secret / key management before build.

FeatureIn progressFeature requests·2 months ago·0

Redis: shared rate limiting and hot-read cache for API and MCP

Context: API and MCP rate limiting is currently in-memory per pm2 process, so limits are roughly 2x intended and reset on every deploy. Public pages and hot queries hit Postgres directly. Scope: - Add a Redis client with graceful in-memory fallback when REDIS_URL is unset or unreachable. - Move the REST rate limiter (src/lib/api/rest.ts) to Redis atomic INCR + TTL, shared across instances. - Extend rate limiting to the MCP endpoint (tools/call) with a batch-size cap. - Add a small cache helper for hot reads (status lists, project settings, public board payloads) with TTL + invalidation. Infra: Redis LXC at 192.168.1.239:6379 (LAN). Requires a firewall allow from the prod VM 192.168.1.172 and REDIS_URL in /opt/hollahoop/.env. Rotate the Redis password before go-live. Done when: limits are exact across both pm2 instances and survive a deploy; cache has TTL and invalidation; the app falls back cleanly when REDIS_URL is absent. Backs the broader abuse-hardening cards for API and MCP.

FeatureShippedFeature requests·2 months ago·1

Storage hardening: signed direct uploads, image resizing, and malware scanning

Context: Uploads currently route bytes through the Node server with service-role writes (src/app/api/uploads). Migration 0022 flagged signed upload URLs, image resizing, and virus scanning as a follow-up. Scope: - Signed direct-to-Storage upload URLs so large files skip the app server. - Server-side image resizing and thumbnails for avatars and inline media. - A malware/content scanning step before a file becomes public. Done when: large media uploads do not pass through the Node process; resized variants are served; unsafe files are rejected.

FeaturePlannedFeature requests·2 months ago·0

RabbitMQ durable job queue for email outbox, webhooks, and AI tasks

Context: The email outbox drains inline in the request path, and outbound Slack/Discord webhooks fire synchronously. Under a traffic spike this adds latency and risks lost work. Scope: - Stand up a RabbitMQ producer/consumer with ack, retry, and a dead-letter queue. - Move email_outbox processing to a worker. - Move outbound webhook delivery to the queue with retries and idempotency (webhook_events). - Reserve a queue for future AI tasks (drafts, moderation). Infra: RabbitMQ is already available on the LAN. Add the AMQP URL to /opt/hollahoop/.env. Done when: emails and webhooks are enqueued and delivered by a worker, with retries and visibility into failures.

FeaturePlannedFeature requests·2 months ago·0

Self-hosted Supabase backups and PITR: verify and run a restore drill

Context: Backup and point-in-time-recovery posture for the self-hosted Supabase Postgres is not visible from the app repo. This is a priority before marketing traffic. Scope: - Confirm automated Postgres backups exist (frequency, retention, offsite copy). - Confirm WAL archiving / PITR is configured. - Document and rehearse a full restore into a scratch environment. - Include Garage S3 bucket backup or replication for uploaded media. Done when: a restore drill succeeds and the runbook is written.

FeaturePlannedFeature requests·2 months ago·0

Search upgrade: Postgres full-text (tsvector) and pgvector semantic search

Context: Search is ILIKE-based today (src/lib/mcp/tools.ts). pgvector is enabled but unused; pg_trgm powers duplicate suggestions only. Scope: - Add tsvector columns and GIN indexes for posts, docs, and changelog; rank results. - Add an embeddings pipeline and pgvector index for semantic search and better duplicate detection. - Blend lexical and semantic results in the search UI and the MCP search tool. Done when: search returns ranked, relevant results across posts, docs, and changelog with semantic recall.

FeaturePlannedFeature requests·2 months ago·0

Edge caching and CDN headers for public pages and media (/m/*)

Context: Public pages (board, roadmap, changelog, docs) render with full SSR and no revalidation; the media resolver /m/* has no documented cache or CDN strategy. Scope: - Add ISR/revalidate to public pages with tag-based invalidation on writes. - Set long-lived cache-control plus immutable on /m/* responses and front with Cloudflare. - Ensure authed and admin pages stay uncached. Done when: anonymous public pages and media are served largely from cache/edge, cutting origin load during spikes.

FeatureShippedFeature requests·2 months ago·1

Verify and tune Postgres connection pooling for traffic spikes

Context: Each Next.js instance opens DB connections via Supabase. Under a spike, unpooled connections can exhaust Postgres. Scope: - Confirm whether Supavisor or PgBouncer fronts Postgres on the Supabase host. - Point the app at the pooled endpoint (transaction mode) where appropriate. - Set sane pool sizes versus Postgres max_connections, accounting for 2 pm2 instances. - Load test to validate headroom. Done when: connection counts stay bounded under load and the app uses the pooler.

FeatureShippedFeature requests·2 months ago·1

Guest posting redirect should explain why login is required

**UX audit finding** `/feedback/new` redirects straight to `/login` with no explanation when guest posting is disabled. Users who expect "submit without account" (marketed on landing page) hit a wall. **Fix:** On login page when `next` ends with `/feedback/new`, show a short note: "This project requires sign-in to post" OR enable guest posting in community settings with a guest form.

FeatureShippedFeature requests·1 month ago·0

i18n: pre-paint UI locale script + admin language switcher polish

**UX audit finding** Admin language switcher (`LanguageSwitcher`) persists locale but UI strings remain English. `document.documentElement.lang` should be set before first paint to avoid flash and assistive tech mismatch. **Fix:** Add pre-hydration script in root layout (mirror theme/sidebar pattern) + wire `applyUiLocale` on switch.

FeatureShippedFeature requests·1 month ago·0

Show org logo in public project header

**Severity:** Medium **Area:** Branding / navigation Org settings support logo upload and the admin sidebar shows it, but `ProjectHeader` always renders a letter-on-accent tile. Customers expect their logo on the public portal chrome, not just in admin. **Fix:** Pass org logo into `ProjectHeader` with fallback to accent initial.