forge/forge
11
8
Fork 7
Code Issues 97 Pull requests Projects 2 Wiki Activity Actions

Private Issues: “Privatize” Comments #594

New issue
Open
opened 2026-05-26 12:16:33 +00:00 by nphilipp · 2 comments
nphilipp commented 2026-05-26 12:16:33 +00:00
Member
Copy link

Story

As someone posting sensitive data in a private issue,
I want that my comments stay private and don’t get leaked,
so that I can confidently share information in these tickets.

Acceptance Criteria

  • Internal API is adapted to accommodate both.
  • Data structures are adapted for private comments.
  • A migration exists which modifies the DB schema appropriately.
  • Functions and methods for creating public comments are adapted so they can create either.

Tasks & Spikes

  • Verify public/private ID pairs (#634)
  • Fundamental changes for public/private comments (#635)
  • Related types
  • Deal with leaky comment IDs
    • [Spike] Figure out how to deal with leaky comment IDs in the web API (#652)
    • Enable comment and private_comment tables to share unique IDs between them
  • Rebase shared branches on top of this work

Background

As discussed with Gusted from Forgejo, private comments should live in their own DB table, too, so they need the same treatment as issues, i.e.: issue & private_issue tables ⇒ comment & private_comment.

The existing migration script for issues should be extended, so it covers both issues and comments.

See #168 about issues for reference.

# Story As someone posting sensitive data in a private issue, I want that my comments stay private and don’t get leaked, so that I can confidently share information in these tickets. # Acceptance Criteria - [ ] Internal API is adapted to accommodate both. - [ ] Data structures are adapted for private comments. - [ ] A migration exists which modifies the DB schema appropriately. - [ ] Functions and methods for creating public comments are adapted so they can create either. # Tasks & Spikes - [x] Verify public/private ID pairs (#634) - [x] Fundamental changes for public/private comments (#635) - [x] Related types - [x] Action, etc. (#636) - [x] Attachment (#637) - [x] ContentHistory (#638) - [x] Reaction (#639) - [ ] Deal with leaky comment IDs - [x] \[Spike\] Figure out how to deal with leaky comment IDs in the web API (#652) - [ ] Enable `comment` and `private_comment` tables to share unique IDs between them - [ ] Rebase shared branches on top of this work # Background As discussed with [Gusted from Forgejo](https://codeberg.org/forgejo/design/issues/2#issuecomment-13899974), private comments should live in their own DB table, too, so they need the same treatment as issues, i.e.: `issue` & `private_issue` tables ⇒ `comment` & `private_comment`. The existing migration script for issues should be extended, so it covers both issues and comments. See #168 about issues for reference.
nphilipp added this to the Backlog project 2026-05-26 12:16:34 +00:00
nphilipp removed their assignment 2026-05-26 12:26:06 +00:00
nphilipp changed title from Private Issues: Privatize Comments to Private Issues: “Privatize” Comments 2026-06-01 08:14:01 +00:00
nphilipp modified the project from Backlog to Sprint 22 2026-06-01 10:22:46 +00:00
nphilipp commented 2026-06-15 11:04:42 +00:00
Author
Member
Copy link

Bumping SPs to reflect increased complexity.

Bumping SPs to reflect increased complexity.
nphilipp commented 2026-06-30 11:29:50 +00:00
Author
Member
Copy link

Hmm, having banged my head against this for a while, this feels more like a (sub-) epic which can be broken down into smaller tickets.

Also, here’s some progress (against the "Foundational Changes") commit/branch: https://codeberg.org/nilsph/forgejo/src/branch/private-issues-backend-foundational

Hmm, having banged my head against this for a while, this feels more like a (sub-) epic which can be broken down into smaller tickets. Also, here’s some progress (against the "Foundational Changes") commit/branch: https://codeberg.org/nilsph/forgejo/src/branch/private-issues-backend-foundational
nphilipp modified the project from Sprint 24 to Backlog 2026-06-30 11:55:13 +00:00
Sign in to join this conversation.
No Branch/Tag specified
Branches Tags
main
test
docs
No results found.
Labels
Clear labels   
Backlog Status
Needs Review
 Work items that have been created or updated but need review, refinement, or approval before they can be considered ready for sprint planning.

  
Backlog Status
Ready
 Work items that have been reviewed, refined, and are ready to be committed to a sprint. These items have clear requirements and could be worked on immediately when capacity is available.

  
Chore
Tasks that are necessary but don't directly deliver new value to the end-user. These are internal tasks like updating a library, managing user accounts, or setting up a new service.

  
points
01
 A task that is simple, small, and has very little uncertainty. It should be easy enough for any team member to pick up and complete quickly, without a lot of discussion or research.

  
points
02
 This is a task that is slightly more complex or larger than a "1." It might involve two or three simple steps, but the outcome is still very clear and there's little uncertainty.

  
points
03
 medium-sized task with some noticeable complexity. It might require a bit more thought or collaboration. The steps are well-defined, but it's not a trivial change.

  
points
05
 a significant piece of work. It has more complexity and a higher degree of uncertainty than smaller tasks. It might require some research, a design discussion, or collaboration across multiple teams.

  
points
08
 complex task with a lot of uncertainty. It's often the largest size that a team will consider for a single sprint. It likely requires a detailed breakdown and multiple team members to complete.

  
points
13
 Any task that feels like it's a "13" or more is considered an Epic. These are too large and uncertain to be worked on in a single sprint.

  
Priority
High
 This is for work that is critical and needs to be addressed in the next sprint. It's often for urgent bugs, important features, or a major piece of technical debt that is blocking other work.

  
Priority
Low
 This is for work that is good to do but not urgent. It's a candidate for being worked on when there's extra time or when it rises in importance. It can stay in the backlog for a longer period.

  
Priority
Medium
 This is for important work that should be done soon, but isn't as urgent as a high-priority item. It will likely be considered for the next 1-2 sprints.

  
Sprint Status
Blocked
 Indicates the work cannot proceed. There is a dependency or an issue that is preventing the team from completing the task. This is a flag for the Scrum Master to help unblock the team.

  
Sprint Status
Done
 Work items that have been completed, reviewed, and integrated. No further work is needed within the current sprint.

  
Sprint Status
In Progress
 This label is for work that a developer is actively working on. This is usually what you'll see on the "In Progress" column of your project board.

  
Sprint Status
Review
 This indicates that the work is complete, but it is now in a review state. This could mean a peer code review, a QA check, or a review by the Product Owner.

  
Sprint Status
To Do
 Work items that are committed to the sprint but haven't been started yet. These items are ready to be picked up by team members.

  
Technical Debt
work that improves the codebase without adding new features. It's work that pays down the "debt" you've accumulated, such as refactoring a messy piece of code, improving test coverage.

  
Work Item
Bug
 Issues where the system is not working as intended or designed. Bugs represent deviations from expected behavior.

  
Work Item
Epic

  
Work Item
Spike

  
Work Item
Task

  
Work Item
User Story

No labels
Backlog Status
Needs Review
Backlog Status
Ready
Chore
points
01
points
02
points
03
points
05
points
08
points
13
Priority
High
Priority
Low
Priority
Medium
Sprint Status
Blocked
Sprint Status
Done
Sprint Status
In Progress
Sprint Status
Review
Sprint Status
To Do
Technical Debt
Work Item
Bug
Work Item
Epic
Work Item
Spike
Work Item
Task
Work Item
User Story
Milestone
Clear milestone
No items
No milestone
Projects
Clear projects
No items
No project
Backlog
Assignees
Clear assignees
No assignees
nphilipp
1 participant
Notifications
Due date
The due date is invalid or out of range. Please use the format "yyyy-mm-dd".

No due date set.

Blocks
#585 Private Issues: Get foundational changes integrated upstream
forge/forge
Depends on
#583 Private Issues: Refactor sql.NullInt64 to optional.Option
forge/forge
#602 Private Issues: Research questions about public/private comment split
forge/forge
#634 Private Issues: Verify public/private ID pairs
forge/forge
#635 Private Issues: Fundamental changes for public/private comments
forge/forge
#636 Private Issue Comments: Action, etc.
forge/forge
#637 Private Issue Comments: Attachment
forge/forge
#638 Private Issue Comments: ContentHistory
forge/forge
#639 Private Issue Comments: Reaction
forge/forge
#652 Figure out how to deal with leaky comment IDs in the web API
forge/forge
Reference
forge/forge#594
No description provided.