Superminaren/hackerspace.sh
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

docs: polish Tiers 1-3 complete; Tier 2+3 local pending deploy

Browse Source
This commit is contained in:
Moheeb Zara
2026-05-16 14:14:04 -07:00
parent b7461f07fd
commit 3ace1afa17
2 changed files with 6 additions and 5 deletions
Download Patch File Download Diff File Expand all files Collapse all files
CHANGELOG.md
+1 -1
View File
@@ -20,7 +20,7 @@ All notable changes to this project are documented here. Format follows [Keep a
- Production report: a basic member filing an incident hit `new row violates row-level security policy for table "incidents"`, including the anonymous path. Not reproducible from source (the code and the 016/017 policy both permit it). Migration 025 idempotently re-asserts the hardened `incidents_insert` policy verbatim so the deployed policy converges to the known-good definition (access-neutral, no schema change). The file-incident action now maps an RLS rejection to an actionable message and logs the technical detail server-side. If the report persists after deploy, the root cause is not policy drift; see `docs/HANDOFF.md` for the discriminating queries.
### UX
- Accessibility and consistency polish pass (Tier 1 systemic, in progress): distinct Ops nav icon (was a duplicate of Settings), `aria-current` on active nav, accessible mobile drawer (role/aria-modal, Escape, scroll lock, focus management), skip-to-content link, shared `BrandMark` in the sidebar, a shared `PageTitle`/`SectionTitle` primitive adopted app-wide, a single shared `Empty` primitive replacing ~18 ad-hoc empty states (projects gains a real empty state with a CTA), a shared accessible confirm dialog replacing all 13 native `window.confirm()` guards, a perceivable keyboard focus ring for form controls and links, larger touch targets at dense action hotspots, programmatic label/field association across the list-page forms, and surfaced toast errors on row mutations that previously failed silently. Still open: hand-rolled modals to Radix Dialog (Tier 1), plus Tier 2 first-run and Tier 3 security-adjacent polish.
- Accessibility and consistency polish pass (Tier 1 systemic, in progress): distinct Ops nav icon (was a duplicate of Settings), `aria-current` on active nav, accessible mobile drawer (role/aria-modal, Escape, scroll lock, focus management), skip-to-content link, shared `BrandMark` in the sidebar, a shared `PageTitle`/`SectionTitle` primitive adopted app-wide, a single shared `Empty` primitive replacing ~18 ad-hoc empty states (projects gains a real empty state with a CTA), a shared accessible confirm dialog replacing all 13 native `window.confirm()` guards, a perceivable keyboard focus ring for form controls and links, larger touch targets at dense action hotspots, programmatic label/field association across the list-page forms, and surfaced toast errors on row mutations that previously failed silently. All hand-rolled modals were converted to the accessible Radix dialog (focus trap, ESC, aria). A founder alone in a new empty space now sees a guided getting-started checklist instead of a grid of zeros; the onboarding Skills field is controlled (survives Back/forward) with a hint when a required acknowledgement is unchecked. Security-adjacent UX (presentational only, no RLS change): revealed secrets get copy-to-clipboard plus auto re-hide after 30s / on window blur / on unmount; the permissions matrix shows a view-only notice to non-admins and labels every checkbox; the Ops access editor pills are accessible toggles with a saved-state toast. Polish Tiers 1-3 complete; Tiers 4-5 (auth/landing brand coherence, per-surface) deferred.
### Security
- Closed two member self-escalation paths: a non-privileged member can no longer change their own `tier_id` or `onboarding_completed_at` on the `space_members` row (migration 024 extends the self-change trigger). Onboarding completion now goes through the service client after server-side validation.