Skip to content

Teams/User Groups - #64

Merged
pradhamk merged 21 commits into
mainfrom
user-groups
Sep 11, 2026
Merged

Teams/User Groups#64
pradhamk merged 21 commits into
mainfrom
user-groups

Conversation

@hujalex

@hujalex hujalex commented Aug 4, 2026

Copy link
Copy Markdown
Contributor

No description provided.

@hujalex
hujalex marked this pull request as ready for review August 25, 2026 05:44
@hujalex
hujalex requested review from HangYeung1 and pradhamk and removed request for HangYeung1 August 27, 2026 21:07
@hujalex hujalex changed the title first draft of user groups Teams/User Groups Aug 27, 2026
@hujalex
hujalex requested a review from HangYeung1 August 27, 2026 21:07

@pradhamk pradhamk left a comment

Copy link
Copy Markdown
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

One thing that I think is worth considering is filtering team names? However, since filtering out "bad" team names is effectively impossible here, maybe add a notice when the user is creating a team name that makes it clear than inappropriate team names will result in the entire hacker team having their acceptances revoked and that the tech team is actively checking team names.

Comment thread app/dashboard/team/page.tsx
Comment thread lib/email/team-invite-template.ts Outdated
Comment thread components/decision/team-section.tsx Outdated
@hujalex
hujalex requested a review from pradhamk September 4, 2026 00:33
@HangYeung1

Copy link
Copy Markdown
Contributor

OH FUCK I DID NOT SANDBOX MY AGENT CORRECTLY

Schema definitions stay on this branch; the SQL migration will be regenerated separately before deploy.

Co-authored-by: Cursor <cursoragent@cursor.com>
HangYeung1 and others added 2 commits September 10, 2026 18:15
Regenerated with a current timestamp so production will apply it after merge.

Co-authored-by: Cursor <cursoragent@cursor.com>
Surfaces reviewer feedback that inappropriate names may revoke acceptances for the whole team.

Co-authored-by: Cursor <cursoragent@cursor.com>
@HangYeung1

Copy link
Copy Markdown
Contributor

Addressed the review feedback:

  • Loading / errors: /dashboard/team now uses Suspense + TeamSkeleton, and error.tsx catches fetch failures in-shell with a retry.
  • Email team name length: invite emails slice team names to TEAM_NAME_MAX_LENGTH before rendering.
  • Copy spacing: fixed the missing space before max team size in the decision letter.
  • Team name policy: added a notice on team creation that inappropriate names may revoke acceptances for the whole team and that staff actively review names.

Require accepted hackers for team mutations, dedupe pending invites at app and DB layers, and sanitize invite email display names.

Co-authored-by: Cursor <cursoragent@cursor.com>
@HangYeung1

Copy link
Copy Markdown
Contributor

Addressed Bugbot + security review findings:

  • Accepted-hacker gate: team mutations (create, invite, accept, cancel) now require role === "hacker" and an accepted application decision, matching the decision-letter admission policy.
  • Duplicate pending invites: reject re-invites when a pending row already exists, with a partial unique index on (team_id, invited_user_id) WHERE status = 'pending'.
  • Email subject injection: strip control characters from inviter display names before composing subject/plain-text invite mail.

HangYeung1 and others added 2 commits September 10, 2026 18:40
Redirect non-accepted hackers away from /dashboard/team and count pending invitations against open team slots.

Co-authored-by: Cursor <cursoragent@cursor.com>
The auth container cannot reach Mailpit on 127.0.0.1:54325 from inside Docker, which caused OTP sends to fail with connection refused.

Co-authored-by: Cursor <cursoragent@cursor.com>
HangYeung1 and others added 5 commits September 10, 2026 18:56
Keeps the warning on-brand with the console UI instead of a native dialog.

Co-authored-by: Cursor <cursoragent@cursor.com>
Render the template asynchronously with React Email while matching OTP colors and layout.

Co-authored-by: Cursor <cursoragent@cursor.com>
Replace the two branch migrations with one regenerated user_groups migration so deploy order stays correct after rebasing on main.

Co-authored-by: Cursor <cursoragent@cursor.com>
The Google Fonts head links match otp.html and are rendered as email HTML, not Next.js pages.

Co-authored-by: Cursor <cursoragent@cursor.com>
Keep team formation off until launch by toggling TEAM_PAGE_ENABLED in lib/features.ts.

Co-authored-by: Cursor <cursoragent@cursor.com>

@HangYeung1 HangYeung1 left a comment

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

good

@pradhamk pradhamk left a comment

Copy link
Copy Markdown
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

good

@pradhamk
pradhamk merged commit 3577467 into main Sep 11, 2026
1 check passed
@HangYeung1
HangYeung1 deleted the user-groups branch September 11, 2026 00:43
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

3 participants