Private Issues, Web UI: Show the private issue ticket contents #496

Open
opened 2026-04-07 03:30:13 +00:00 by t0xic0der · 3 comments
Member

Summary

Private Issues, Web UI: Show the private issue ticket contents

Details

Private Issues, Web UI: Show the private issue ticket contents

Associated with issue forge/forge#442

### Summary Private Issues, Web UI: Show the private issue ticket contents ### Details Private Issues, Web UI: Show the private issue ticket contents Associated with issue forge/forge#442
t0xic0der added this to the Backlog project 2026-04-07 03:30:14 +00:00
t0xic0der modified the project from Backlog to Sprint 18 2026-04-07 10:15:53 +00:00
Author
Member

We need to complete forge/forge#464 before we start with this.

We need to complete forge/forge#464 before we start with this.
Author
Member

Here's some progress from the frontend implementation 🖌️

image

The repo owner and those having the access can see the contents of the ticket.

It has features of the a normal ticket because that is exactly where I derived this from.

I am yet to test things out like attachments, labels, milestones, projects, participants etc.

I want to see if changing anything from the above leads to the ticket to be exposed.

This would need some more time in the oven. I am not showing changes just yet.

Regarding the conversion of public tickets to privates ones (and vice versa), nope!

Here's some progress from the frontend implementation 🖌️ ![image](/attachments/1891861a-5870-4e92-95b8-459d4be8fd42) The repo owner and those having the access can see the contents of the ticket. It has features of the a normal ticket because that is exactly where I derived this from. I am yet to test things out like attachments, labels, milestones, projects, participants etc. I want to see if changing anything from the above leads to the ticket to be exposed. This would need some more time in the oven. I am not showing changes just yet. Regarding the conversion of public tickets to privates ones (and vice versa), nope!
113 KiB
Author
Member

I hereby increase the points assigned to this issue ticket from 5 to 8.

For what its worth, this implementation has too many moving pieces to tackle before it becomes functional.

image

What if the creator assigns the private issue ticket a label and a person looks issue tickets up having that label? What if a milestone gets added to the issue ticket and it inadvertently ends up being visible to folks from the milestone listing? What happens to the ticket's visibility when it gets added to the project board? Do we make this ticket visible to folks that get referenced in the issue comments? Does a notification consisting of the private issue ticket contents get shared to them when someone gets referenced in either the issue body or issue comments? How would we treat the visibility to those whom we assign this issue ticket? What if someone references this private ticket (noticing the gap in the counting indices) under their public ticket as either a dependency or a dependent?

We need to ensure that the issue ticket remains accessible to only those to whom this should be accessible to, and hence, that would require for us to go through all these cases one by one to see if we are not leaving a hole to be exploited. Once we are able to achieve this, creating predictable test cases for these conditions could probably end up being a separate issue ticket altogether. All-in-all, this implementation is definitely not as easy as I thought it would be and we need to spend more efforts into getting it right.

I hereby increase the points assigned to this issue ticket from 5 to 8. For what its worth, this implementation has too many moving pieces to tackle before it becomes functional. ![image](/attachments/41b9bb79-461a-41b2-986a-251d5b6e0808) What if the creator assigns the private issue ticket a label and a person looks issue tickets up having that label? What if a milestone gets added to the issue ticket and it inadvertently ends up being visible to folks from the milestone listing? What happens to the ticket's visibility when it gets added to the project board? Do we make this ticket visible to folks that get referenced in the issue comments? Does a notification consisting of the private issue ticket contents get shared to them when someone gets referenced in either the issue body or issue comments? How would we treat the visibility to those whom we assign this issue ticket? What if someone references this private ticket (noticing the gap in the counting indices) under their public ticket as either a dependency or a dependent? We need to ensure that the issue ticket remains accessible to only those to whom this should be accessible to, and hence, that would require for us to go through all these cases one by one to see if we are not leaving a hole to be exploited. Once we are able to achieve this, creating predictable test cases for these conditions could probably end up being a separate issue ticket altogether. All-in-all, this implementation is definitely not as easy as I thought it would be and we need to spend more efforts into getting it right.
110 KiB
humaton modified the project from Sprint 19 to Sprint 20 2026-05-05 10:19:29 +00:00
Sign in to join this conversation.
No milestone
No project
No assignees
1 participant
Notifications
Due date
The due date is invalid or out of range. Please use the format "yyyy-mm-dd".

No due date set.

Reference
forge/forge#496
No description provided.