🐛 Actionable token permission guidance with GitHub + Settings links by clubanderson · Pull Request #4236 · kubestellar/console

clubanderson · 2026-04-02T13:19:53Z

Summary

Follow-up to #4226. When screenshot uploads fail or the feedback token is missing, users had no clear guidance on what to do. Now:

Missing token banner: Lists the exact permissions needed (Issues + Contents read/write for fine-grained PATs, repo scope for classic PATs) with links to Create token on GitHub and Console Settings
Screenshot upload failure warnings: Explain which permission is missing and link to Update token on GitHub and Console Settings
.env.example: Documents both classic and fine-grained PAT requirements
Backend logs: Startup warning and 503 error now specify both token types

Test plan

Remove FEEDBACK_GITHUB_TOKEN → missing token banner shows permission list + both links
Use a token without Contents permission → submit with screenshot → yellow warning shows with both links
Click "Create token on GitHub" link → opens GitHub fine-grained PAT page in new tab
Click "Console Settings" link → navigates to /settings

When screenshot uploads fail or the feedback token is missing, the UI now tells users exactly which permissions they need (Issues + Contents for fine-grained PATs, repo scope for classic PATs) and provides direct links to update their token on GitHub and in Console Settings. Updated: .env.example comments, feedbackTokenMissing banner, screenshot failure warnings in both modals, and backend startup/503 log messages. Signed-off-by: Andrew Anderson <andy@clubanderson.com>

kubestellar-prow · 2026-04-02T13:19:59Z

[APPROVALNOTIFIER] This PR is NOT APPROVED

This pull-request has been approved by:
Once this PR has been reviewed and has the lgtm label, please assign mikespreitzer for approval. For more information see the Code Review Process.

The full list of commands accepted by this bot can be found here.

Details

Needs approval from an approver in each of these files:

OWNERS

Approvers can indicate their approval by writing /approve in a comment
Approvers can cancel approval by writing /approve cancel in a comment

netlify · 2026-04-02T13:20:00Z

✅ Deploy Preview for kubestellarconsole ready!

Name	Link
🔨 Latest commit	`bce905e`
🔍 Latest deploy log	https://app.netlify.com/projects/kubestellarconsole/deploys/69ce6cfdc16e810007c55a8d
😎 Deploy Preview	https://deploy-preview-4236.console-deploy-preview.kubestellar.io
📱 Preview on mobile	Toggle QR Code... Use your smartphone camera to open QR code link.

To edit notification comments on pull requests, go to your Netlify project configuration.

github-actions · 2026-04-02T13:20:03Z

👋 Hey @clubanderson — thanks for opening this PR!

🤖 This project is developed exclusively using AI coding assistants.

Please do not attempt to code anything for this project manually.
All contributions should be authored using an AI coding tool such as:

Claude Code (Opus 4.5 / 4.6) — recommended

GitHub Copilot

Cursor

Other AI coding assistants

This ensures consistency in code style, architecture patterns, test coverage,
and commit quality across the entire codebase.

This is an automated message.

github-actions · 2026-04-02T13:20:07Z

Thank you for your contribution! Your PR has been merged.

Check out what's new:

KubeStellar Console — Live multi-cluster dashboard
Marketplace — Community extensions
Knowledge Base — Troubleshooting and how-tos

Stay connected: Slack #kubestellar-dev | Multi-Cluster Survey

Copilot

Pull request overview

Improves user-facing guidance when GitHub issue creation/screenshot uploads fail due to missing or insufficient GitHub PAT permissions, by adding clearer UI messaging (with GitHub + Settings links), enhancing backend log/error messages, and documenting PAT requirements in .env.example.

Changes:

Add “Update/Create token on GitHub” and “Console Settings” links plus expanded permission guidance in feedback/feature request modals.
Expand backend startup warning and 503 error text to describe both classic and fine-grained PAT requirements.
Update .env.example to document classic vs fine-grained PAT permissions and the screenshot-upload implication.

Reviewed changes

Copilot reviewed 4 out of 4 changed files in this pull request and generated 5 comments.

File	Description
web/src/components/feedback/FeedbackModal.tsx	Expands screenshot-upload failure warnings with permission guidance and links.
web/src/components/feedback/FeatureRequestModal.tsx	Adds missing-token permission list + links; expands screenshot-upload failure warnings with links.
pkg/api/handlers/feedback.go	Enhances startup warning and 503 message with classic vs fine-grained PAT guidance.
.env.example	Documents PAT requirements for issue creation and screenshot uploads.

Copilot · 2026-04-02T13:23:47Z

web/src/components/feedback/FeedbackModal.tsx

+                  <p className="text-xs text-muted-foreground mt-1">
+                    <a href="https://github.com/settings/personal-access-tokens" target="_blank" rel="noopener noreferrer" className="text-purple-400 hover:text-purple-300 underline underline-offset-2">Update token on GitHub</a>
+                    {' · '}
+                    <button type="button" onClick={() => { window.location.href = '/settings' }} className="text-purple-400 hover:text-purple-300 underline underline-offset-2">Console Settings</button>
                  </p>


This navigation uses window.location.href = '/settings', which forces a full page reload and hard-codes the route. The app has centralized route constants (web/src/config/routes.ts explicitly recommends using them instead of hardcoding paths), so prefer Link/useNavigate with ROUTES.SETTINGS here for SPA navigation and maintainability.

Copilot · 2026-04-02T13:23:48Z

web/src/components/feedback/FeatureRequestModal.tsx

+                  <p className="text-xs text-muted-foreground mt-1">
+                    <a href="https://github.com/settings/personal-access-tokens" target="_blank" rel="noopener noreferrer" className="text-purple-400 hover:text-purple-300 underline underline-offset-2">Update token on GitHub</a>
+                    {' · '}
+                    <button type="button" onClick={() => { window.location.href = '/settings' }} className="text-purple-400 hover:text-purple-300 underline underline-offset-2">Console Settings</button>
                  </p>


window.location.href = '/settings' hard-codes the path and triggers a full reload. Please switch to SPA navigation (e.g., Link/useNavigate) and use ROUTES.SETTINGS per the route-constants convention in web/src/config/routes.ts.

Copilot · 2026-04-02T13:23:48Z

web/src/components/feedback/FeatureRequestModal.tsx

+                  <p className="text-xs text-muted-foreground mt-1">
+                    <a href="https://github.com/settings/personal-access-tokens" target="_blank" rel="noopener noreferrer" className="text-purple-400 hover:text-purple-300 underline underline-offset-2">Update token on GitHub</a>
+                    {' · '}
+                    <button type="button" onClick={() => { window.location.href = '/settings' }} className="text-purple-400 hover:text-purple-300 underline underline-offset-2">Console Settings</button>
                  </p>


Same as above: this uses window.location.href = '/settings' (hard-coded + full reload). Prefer Link/useNavigate with ROUTES.SETTINGS for internal navigation.

Copilot · 2026-04-02T13:23:48Z

web/src/components/feedback/FeatureRequestModal.tsx

                      <p className="text-muted-foreground text-xs">
                        The <code className="px-1 py-0.5 rounded bg-secondary text-foreground text-2xs">FEEDBACK_GITHUB_TOKEN</code> is
-                        not set. Issue submission requires a GitHub personal access token with <em>repo</em> scope.
-                        Add it to your <code className="px-1 py-0.5 rounded bg-secondary text-foreground text-2xs">.env</code> file or
-                        configure it in{' '}
+                        not set. Issue submission requires a GitHub personal access token with these permissions:
+                      </p>
+                      <ul className="text-muted-foreground text-xs list-disc ml-4 mt-1 space-y-0.5">
+                        <li><em>Issues: Read and write</em> — to create GitHub issues</li>
+                        <li><em>Contents: Read and write</em> — to upload screenshots</li>
+                      </ul>


The “missing token” banner text lists fine-grained PAT permissions but doesn’t mention the classic PAT requirement (repo scope), even though the PR description says both token types are covered. Consider adding a short classic-PAT note here to avoid misleading users who follow the classic token flow.

Copilot · 2026-04-02T13:23:49Z

pkg/api/handlers/feedback.go

+		return fiber.NewError(fiber.StatusServiceUnavailable, "Issue submission is not available: FEEDBACK_GITHUB_TOKEN is not configured. "+
+			"Add FEEDBACK_GITHUB_TOKEN=<your-pat> to your .env file. "+
+			"Classic PAT: needs 'repo' scope. Fine-grained PAT: needs 'Issues' + 'Contents' read/write permissions.")


The 503 condition checks token || repoOwner || repoName (any missing config), but the error message only says the token is not configured. This is misleading when FEEDBACK_REPO_OWNER/FEEDBACK_REPO_NAME are unset; either split the checks/messages or change the message to reflect all required config.

Suggested change

return fiber.NewError(fiber.StatusServiceUnavailable, "Issue submission is not available: FEEDBACK_GITHUB_TOKEN is not configured. "+

"Add FEEDBACK_GITHUB_TOKEN=<your-pat> to your .env file. "+

"Classic PAT: needs 'repo' scope. Fine-grained PAT: needs 'Issues' + 'Contents' read/write permissions.")

return fiber.NewError(fiber.StatusServiceUnavailable, "Issue submission is not available: feedback GitHub integration is not fully configured. "+

"Please set FEEDBACK_GITHUB_TOKEN, FEEDBACK_REPO_OWNER, and FEEDBACK_REPO_NAME in your environment. "+

"Add FEEDBACK_GITHUB_TOKEN=<your-pat> to your .env file. Classic PAT: needs 'repo' scope. Fine-grained PAT: needs 'Issues' + 'Contents' read/write permissions.")

clubanderson · 2026-04-02T13:23:58Z

🔄 Auto-Applying Copilot Code Review

Copilot code review found 1 code suggestion(s) and 4 general comment(s).

@copilot Please apply all of the following code review suggestions:

pkg/api/handlers/feedback.go (line 127): return fiber.NewError(fiber.StatusServiceUnavailable, "Issue submission is not a...

Also address these general comments:

web/src/components/feedback/FeedbackModal.tsx (line 393): This navigation uses window.location.href = '/settings', which forces a full page reload and hard-codes the route. The
web/src/components/feedback/FeatureRequestModal.tsx (line 1267): window.location.href = '/settings' hard-codes the path and triggers a full reload. Please switch to SPA navigation (e.
web/src/components/feedback/FeatureRequestModal.tsx (line 1279): Same as above: this uses window.location.href = '/settings' (hard-coded + full reload). Prefer Link/useNavigate wi
web/src/components/feedback/FeatureRequestModal.tsx (line 1301): The “missing token” banner text lists fine-grained PAT permissions but doesn’t mention the classic PAT requirement (`rep

Push all fixes in a single commit. Run cd web && npm run build && npm run lint before committing.

Auto-generated by copilot-review-apply workflow.

Copilot AI review requested due to automatic review settings April 2, 2026 13:19

kubestellar-prow bot added the dco-signoff: yes Indicates the PR's author has signed the DCO. label Apr 2, 2026

clubanderson merged commit 91e01c2 into main Apr 2, 2026
1 check passed

kubestellar-prow bot deleted the fix/token-permission-docs branch April 2, 2026 13:20

kubestellar-prow bot added the size/M Denotes a PR that changes 30-99 lines, ignoring generated files. label Apr 2, 2026

Copilot started reviewing on behalf of clubanderson April 2, 2026 13:20 View session

Copilot AI reviewed Apr 2, 2026

View reviewed changes

clubanderson assigned Copilot Apr 2, 2026

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

🐛 Actionable token permission guidance with GitHub + Settings links#4236

🐛 Actionable token permission guidance with GitHub + Settings links#4236
clubanderson merged 1 commit intomainfrom
fix/token-permission-docs

clubanderson commented Apr 2, 2026

Uh oh!

kubestellar-prow bot commented Apr 2, 2026

Uh oh!

Uh oh!

netlify bot commented Apr 2, 2026 •

edited

Loading

Uh oh!

github-actions bot commented Apr 2, 2026

Uh oh!

github-actions bot commented Apr 2, 2026

Uh oh!

Copilot AI left a comment

Uh oh!

Copilot AI Apr 2, 2026

Uh oh!

Copilot AI Apr 2, 2026

Uh oh!

Copilot AI Apr 2, 2026

Uh oh!

Copilot AI Apr 2, 2026

Uh oh!

Copilot AI Apr 2, 2026

Uh oh!

clubanderson commented Apr 2, 2026

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

3 participants

Conversation

clubanderson commented Apr 2, 2026

Summary

Test plan

Uh oh!

kubestellar-prow bot commented Apr 2, 2026

Uh oh!

Uh oh!

netlify bot commented Apr 2, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

✅ Deploy Preview for kubestellarconsole ready!

Uh oh!

github-actions bot commented Apr 2, 2026

Uh oh!

github-actions bot commented Apr 2, 2026

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

Pull request overview

Reviewed changes

Uh oh!

Copilot AI Apr 2, 2026

Choose a reason for hiding this comment

Uh oh!

Copilot AI Apr 2, 2026

Choose a reason for hiding this comment

Uh oh!

Copilot AI Apr 2, 2026

Choose a reason for hiding this comment

Uh oh!

Copilot AI Apr 2, 2026

Choose a reason for hiding this comment

Uh oh!

Copilot AI Apr 2, 2026

Choose a reason for hiding this comment

Uh oh!

clubanderson commented Apr 2, 2026

🔄 Auto-Applying Copilot Code Review

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

3 participants

netlify bot commented Apr 2, 2026 •

edited

Loading