Skip to content

fix: update QuickStart guide and SSL config for local Postgres dev#4

Merged
michaelmcnees merged 20 commits into
mainfrom
fix/quickstart-ssl-config
Mar 24, 2026
Merged

fix: update QuickStart guide and SSL config for local Postgres dev#4
michaelmcnees merged 20 commits into
mainfrom
fix/quickstart-ssl-config

Conversation

@michaelmcnees

@michaelmcnees michaelmcnees commented Mar 23, 2026

Copy link
Copy Markdown
Collaborator

Summary

  • Fix critical grpc vulnerability (CVE-2026-33186)
  • Improve default SSL mode for local development
  • Address all Copilot review feedback
  • Various site fixes from frontend review

Changes

Security

  • google.golang.org/grpc v1.79.1 → v1.79.3 (fixes CVE-2026-33186 CRITICAL)

Configuration

  • Default sslmode=prefer (tries TLS, falls back gracefully for local dev without triggering warnings)
  • Updated config tests to match

Copilot Review Fixes

  1. sslmode=prefer instead of disable (better security posture)
  2. Table scroll CSS comment updated to match unconditional behavior
  3. isDocs derived from URL pathname, not !isHome (fixes 404 page showing docs menu)
  4. 404 page gets mobile bottom nav padding
  5. Broken /configuration link → /docs/configuration in getting-started

Site Fixes

  • Overlay cloneNode bug: closeSidebar() referenced detached DOM node
  • Safe-area-inset: bottom padding accounts for iOS home indicator
  • Tables: display:block + overflow-x:auto directly (removed unused .table-wrapper)
  • Removed overflow-x-hidden from docs container (was clipping wide tables)
  • CI triggers: push only on main, pull_request on branches (no double runs)

Test plan

  • go build ./... passes
  • go test ./internal/config/ passes
  • npx astro build — 30 pages
  • QuickStart with docker-compose works with sslmode=prefer

Summary by CodeRabbit

  • New Features

    • Added a fixed mobile bottom navigation and simplified mobile docs sidebar with improved mobile link behavior and accessibility.
  • Documentation

    • Removed multiple legacy guide pages; added a short Getting Started note about default DB SSL and a production recommendation.
    • Updated site/docs URLs, canonical/Open Graph metadata, and README links to a new hostname.
  • Bug Fixes

    • Adjusted default database SSL mode and emit a warning for non-local hosts.
  • Chores

    • Tightened CI push trigger to main and bumped an indirect dependency.

michaelmcnees and others added 4 commits March 23, 2026 10:10
Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
…achability

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
The default database URL used sslmode=require, but the docker-compose
Postgres has no SSL configured — causing mantle init to fail for users
following the QuickStart guide. Change the code default to sslmode=disable
(matching the docs and the localhost dev URL) and add SSL guidance to
the Getting Started guide. Production examples throughout the docs
already use sslmode=require.

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
- google.golang.org/grpc v1.79.1 → v1.79.3 (fixes CVE-2026-33186)
- Fix overlay cloneNode bug: closeSidebar referenced detached node
  (use onclick assignment instead of cloneNode pattern)
- Safe-area-inset: bottom padding accounts for iOS home indicator
- Tables: display:block + overflow-x:auto directly (no wrapper needed)
- Remove overflow-x-hidden from docs container (was clipping tables)
- Restore sslmode=disable as default for local dev (sslmode=require
  broke docker-compose dev workflow; warning still logs in production)

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
Copilot AI review requested due to automatic review settings March 23, 2026 14:46

Copilot AI left a comment

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Pull request overview

Aligns Mantle’s local-development Postgres defaults with the QuickStart experience by switching the default DB SSL mode to disable, and updates docs/site UI to reduce friction on mobile.

Changes:

  • Updated default database.url to sslmode=disable and adjusted config tests accordingly.
  • Updated Getting Started docs (repo docs + site docs) to explain SSL mode defaults and production recommendations.
  • Improved mobile docs UX (bottom nav, padding, sidebar behavior) and prose responsiveness (tables/code sizing).

Reviewed changes

Copilot reviewed 11 out of 12 changed files in this pull request and generated 6 comments.

Show a summary per file
File Description
internal/config/config.go Changes default Postgres URL to sslmode=disable.
internal/config/config_test.go Updates assertions to match the new default DB URL.
docs/getting-started.md Adds guidance about SSL mode defaults and production SSL settings.
site/src/content/docs/getting-started/index.md Adds the same SSL guidance to the site’s Getting Started page.
site/src/components/Nav.astro Replaces the hamburger menu with a fixed mobile bottom navigation and docs menu trigger.
site/src/components/DocsSidebar.astro Adjusts mobile sidebar sizing/spacing and simplifies close handlers.
site/src/layouts/Docs.astro Adds bottom padding to avoid mobile bottom-nav overlap.
site/src/pages/index.astro Adds bottom padding to avoid mobile bottom-nav overlap.
site/src/styles/global.css Makes prose tables scrollable and tweaks mobile typography/code rendering.
go.mod Bumps indirect google.golang.org/grpc version.
go.sum Updates checksums for the gRPC version bump.

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

Comment thread internal/config/config.go Outdated
Comment thread go.mod
Comment thread site/src/styles/global.css Outdated
Comment thread site/src/components/Nav.astro
Comment thread site/src/components/Nav.astro
Comment thread site/src/content/docs/getting-started/index.md Outdated
1. sslmode=disable → sslmode=prefer (tries TLS, graceful fallback for local dev)
2. grpc bump is intentional (CVE-2026-33186) — already noted in PR description
3. Table scroll comment updated to match unconditional behavior
4. isDocs derived from pathname (/docs prefix) not !isHome — fixes 404 page
5. 404 page gets pb-20 for mobile bottom nav clearance
6. Broken /configuration link → /docs/configuration in getting-started

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

Copilot AI left a comment

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Pull request overview

Copilot reviewed 12 out of 13 changed files in this pull request and generated 2 comments.


💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

Comment thread site/src/styles/global.css Outdated
Comment thread docs/getting-started.md Outdated
1. Table CSS: removed display:block (breaks border-collapse), use
   :has(> table) for scrollable parent instead, preserving table layout
2. getting-started.md: sslmode=disable → sslmode=prefer to match code default

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

Copilot AI left a comment

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Pull request overview

Copilot reviewed 12 out of 13 changed files in this pull request and generated 2 comments.


💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

Comment thread site/src/layouts/Docs.astro Outdated
Comment thread site/src/components/DocsSidebar.astro Outdated
…fset

1. Bottom nav: md:hidden → lg:hidden so menu button is visible at
   768-1023px (bridging the gap between mobile and desktop sidebar)
2. Bottom padding: md:pb-0 → lg:pb-0 on all pages to match
3. Sidebar mobile bottom: responsive class instead of inline style,
   only reserves bottom-nav space below lg breakpoint

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
@cloudflare-workers-and-pages

cloudflare-workers-and-pages Bot commented Mar 23, 2026

Copy link
Copy Markdown

Deploying mantle with  Cloudflare Pages  Cloudflare Pages

Latest commit: fa47ef6
Status: ✅  Deploy successful!
Preview URL: https://0d028c1e.mantle-cxy.pages.dev
Branch Preview URL: https://fix-quickstart-ssl-config.mantle-cxy.pages.dev

View logs

Copilot AI left a comment

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Pull request overview

Copilot reviewed 12 out of 13 changed files in this pull request and generated 2 comments.


💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

Comment thread site/src/styles/global.css Outdated
Comment thread site/src/components/Nav.astro Outdated
1. Table scroll: .prose :has(> table) → .prose:has(table) so it matches
   when table is a direct child of the prose article
2. Sidebar toggle: aria-expanded on button, aria-hidden toggled on
   overlay in sync with visibility state

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

Copilot AI left a comment

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Pull request overview

Copilot reviewed 12 out of 13 changed files in this pull request and generated 3 comments.


💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

Comment thread site/src/content/docs/getting-started/index.md Outdated
Comment thread site/src/components/Nav.astro Outdated
Comment on lines 190 to 198
function closeSidebar() {
mobileSidebar.classList.add('-translate-x-full');
overlay.classList.add('hidden');
}

const newBtn = toggleBtn.cloneNode(true);
toggleBtn.parentNode?.replaceChild(newBtn, toggleBtn);
newBtn.addEventListener('click', () => {
const isOpen = !mobileSidebar.classList.contains('-translate-x-full');
if (isOpen) closeSidebar(); else openSidebar();
});

const newOverlay = overlay.cloneNode(true);
overlay.parentNode?.replaceChild(newOverlay, overlay);
newOverlay.addEventListener('click', closeSidebar);

overlay.onclick = closeSidebar;
mobileSidebar.querySelectorAll('a').forEach((a) => {
a.addEventListener('click', closeSidebar);
a.onclick = closeSidebar;
});

Copilot AI Mar 23, 2026

Copy link

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

closeSidebar() hides the overlay and drawer but does not restore aria-hidden on the overlay or reset aria-expanded on the docs menu button. If the user closes via overlay click or by selecting a link, assistive tech state can remain stuck as “expanded/visible”. Update closeSidebar() to set overlay.setAttribute('aria-hidden','true') and reset the button’s aria-expanded as well.

Copilot uses AI. Check for mistakes.
1. Distinct aria-labels: "Main navigation" and "Mobile navigation"
2. closeSidebar() now resets aria-hidden on overlay and aria-expanded
   on the menu button (fixes stuck state on overlay/link close)

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

Copilot AI left a comment

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Pull request overview

Copilot reviewed 12 out of 13 changed files in this pull request and generated no new comments.


💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

@coderabbitai

coderabbitai Bot commented Mar 23, 2026

Copy link
Copy Markdown
Contributor

Caution

Review failed

The pull request is closed.

Note

Reviews paused

It looks like this branch is under active development. To avoid overwhelming you with review comments due to an influx of new commits, CodeRabbit has automatically paused this review. You can configure this behavior by changing the reviews.auto_review.auto_pause_after_reviewed_commits setting.

Use the following commands to manage reviews:

  • @coderabbitai resume to resume automatic reviews.
  • @coderabbitai review to trigger a single review.

Use the checkboxes below for quick actions:

  • ▶️ Resume reviews
  • 🔍 Trigger review
ℹ️ Recent review info
⚙️ Run configuration

Configuration used: Organization UI

Review profile: ASSERTIVE

Plan: Pro

Run ID: 9eee4b38-e479-4984-a932-9b219cb32a98

📥 Commits

Reviewing files that changed from the base of the PR and between 152d518 and 00bca25.

📒 Files selected for processing (2)
  • internal/config/config.go
  • site/src/components/Nav.astro

📝 Walkthrough

Walkthrough

Narrowed CI push trigger to main, bumped an indirect gRPC dep, changed default Postgres sslmode to prefer (with runtime warning for non-loopback hosts), removed many docs pages (moved/added a short getting-started note), replaced mobile hamburger with a fixed bottom nav and simplified sidebar/overlay accessibility and styles, and updated site URLs to mantle.dvflw.co.

Changes

Cohort / File(s) Summary
CI & Go deps
\.github/workflows/ci.yml, go.mod
Push workflow limited to main; indirect module google.golang.org/grpc bumped v1.79.1 → v1.79.3.
Database config & tests
internal/config/config.go, internal/config/config_test.go
Default DB URL sslmode changed require → prefer; added parsing+warning for non-loopback hosts using sslmode=prefer; tests updated accordingly.
Large docs removals
docs/* (e.g. docs/getting-started.md, docs/authentication-guide.md, docs/cli-reference.md, docs/concepts.md, docs/configuration.md, docs/deployment-guide.md, docs/observability-guide.md, docs/plugins-guide.md, docs/secrets-guide.md, docs/server-guide.md, docs/workflow-reference.md, docs/comparison.md)
Multiple full documentation pages deleted.
Docs site content & notes
site/src/content/docs/getting-started/index.md
Added note explaining sslmode=prefer for development and a production MANTLE_DATABASE_URL example using sslmode=require.
Mobile navigation & sidebar
site/src/components/Nav.astro, site/src/components/DocsSidebar.astro, site/src/layouts/Docs.astro
Removed hamburger/mobile menu; added fixed bottom nav, updated aria attributes, simplified overlay/sidebar handlers to direct onclicks, adjusted mobile link classes, and removed old toggle markup.
Site config & metadata
site/astro.config.mjs, site/src/layouts/Base.astro, internal/cli/root.go, marketing/*, README.md
Rebased site URL and canonical/OG links from https://mantle.devhttps://mantle.dvflw.co; updated CLI help and marketing/README links.
Styles & responsive pages
site/src/styles/global.css, site/src/pages/index.astro, site/src/pages/404.astro
Added .sidebar-mobile-bottom helper, conditional .prose:has(table) overflow rule, mobile prose typography adjustments, and applied pb-20 lg:pb-0 responsive bottom padding.

Sequence Diagram(s)

sequenceDiagram
  participant User as "User (Mobile)"
  participant BottomNav as "Mobile Bottom Nav\n(site/src/components/Nav.astro)"
  participant DocsSidebar as "Docs Sidebar\n(site/src/components/DocsSidebar.astro)"
  participant Overlay as "Backdrop Overlay\n(`#sidebar-overlay`)"

  rect rgba(240,248,255,0.5)
    User->>BottomNav: tap Docs Menu button
    BottomNav->>DocsSidebar: toggle open (remove -translate-x-full)
    BottomNav->>Overlay: show (hidden=false, aria-hidden=false)
    DocsSidebar->>Overlay: set link onclick to close
  end

  rect rgba(245,255,240,0.5)
    User->>Overlay: tap overlay or nav link
    Overlay->>DocsSidebar: close (add -translate-x-full, inert=true, aria-hidden=true)
    Overlay->>BottomNav: update button aria-expanded=false
  end
Loading

Estimated code review effort

🎯 3 (Moderate) | ⏱️ ~25 minutes

Possibly related PRs

Poem

🐇 I nudged the links and softened SSL,
A bottom bar now hums where hamburgers fell,
Sidebars whisper closed with a single tap,
Tables slide in view when screens are wrapped,
Small hops, tidy trails — a fresh deploy clap.

🚥 Pre-merge checks | ✅ 2 | ❌ 1

❌ Failed checks (1 warning)

Check name Status Explanation Resolution
Docstring Coverage ⚠️ Warning Docstring coverage is 50.00% which is insufficient. The required threshold is 80.00%. Write docstrings for the functions missing them to satisfy the coverage threshold.
✅ Passed checks (2 passed)
Check name Status Explanation
Description Check ✅ Passed Check skipped - CodeRabbit’s high-level summary is enabled.
Title check ✅ Passed The title accurately describes the two main changes: updating the QuickStart/Getting Started guide and adjusting SSL configuration (sslmode) for local Postgres development.

✏️ Tip: You can configure your own custom pre-merge checks in the settings.

✨ Finishing Touches
📝 Generate docstrings
  • Create stacked PR
  • Commit on current branch
🧪 Generate unit tests (beta)
  • Create PR with unit tests
  • Commit unit tests in branch fix/quickstart-ssl-config

Comment @coderabbitai help to get the list of available commands and usage tips.

@coderabbitai coderabbitai Bot left a comment

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Actionable comments posted: 4

🤖 Prompt for all review comments with AI agents
Verify each finding against the current code and only fix it if needed.

Inline comments:
In `@site/src/components/DocsSidebar.astro`:
- Around line 162-180: The external GitHub anchor (the <a> element with
href="https://github.com/dvflw/mantle" and link text "GitHub") should open in a
new tab and avoid exposing the opener; update that anchor to include
target="_blank" and rel="noopener" (or rel="noopener noreferrer") to implement
the change.

In `@site/src/components/Nav.astro`:
- Around line 77-99: The sidebar toggle logic in initNav duplicates the code in
DocsSidebar; extract a shared function (e.g., toggleDocsSidebar(open: boolean))
that encapsulates the DOM manipulations now in initNav (toggling
'-translate-x-full' on docsSidebar, adding/removing 'hidden' on overlay, and
setting overlay aria-hidden and btn aria-expanded) and export or import it so
both Nav.astro's initNav and DocsSidebar call the same function (use a single
source of truth for open/close), keep the early guards for missing elements in
the shared helper or have callers validate, and ensure both components still
re-initialize on astro:after-swap to preserve view transition behavior.
- Around line 37-59: The external GitHub anchor
(href="https://github.com/dvflw/mantle", the element using class
"bottom-nav-item") must open in a new tab and avoid opener leaks; update that
<a> to include target="_blank" and rel="noopener" (or rel="noopener noreferrer")
so the external link behavior matches DocsSidebar and is secure.

In `@site/src/styles/global.css`:
- Around line 405-407: The CSS rule for the ".prose code" selector uses the
deprecated property value "word-break: break-word"; update that rule by removing
"word-break: break-word" and replace it with the modern equivalent, e.g. set
"overflow-wrap: anywhere" (optionally paired with "word-break: normal") inside
the ".prose code" block to preserve wrapping behavior without triggering
stylelint warnings.

ℹ️ Review info
⚙️ Run configuration

Configuration used: Organization UI

Review profile: ASSERTIVE

Plan: Pro

Run ID: 3e4238c0-18dc-4fc9-940d-9ef46fa17063

📥 Commits

Reviewing files that changed from the base of the PR and between 1e04e15 and f0c8cda.

⛔ Files ignored due to path filters (1)
  • go.sum is excluded by !**/*.sum
📒 Files selected for processing (12)
  • .github/workflows/ci.yml
  • docs/getting-started.md
  • go.mod
  • internal/config/config.go
  • internal/config/config_test.go
  • site/src/components/DocsSidebar.astro
  • site/src/components/Nav.astro
  • site/src/content/docs/getting-started/index.md
  • site/src/layouts/Docs.astro
  • site/src/pages/404.astro
  • site/src/pages/index.astro
  • site/src/styles/global.css

Comment thread site/src/components/DocsSidebar.astro
Comment thread site/src/components/Nav.astro
Comment on lines 77 to +99
<script is:inline>
function initNav() {
const btn = document.getElementById('mobile-menu-btn');
const menu = document.getElementById('mobile-menu');
if (!btn || !menu) return;
// Remove old listeners by cloning
const newBtn = btn.cloneNode(true);
btn.parentNode?.replaceChild(newBtn, btn);
newBtn.addEventListener('click', () => menu.classList.toggle('hidden'));
const btn = document.getElementById('bottom-nav-docs-btn');
const docsSidebar = document.getElementById('docs-sidebar-mobile');
const overlay = document.getElementById('sidebar-overlay');
if (!btn || !docsSidebar || !overlay) return;

btn.setAttribute('aria-expanded', 'false');

btn.onclick = () => {
const isOpen = !docsSidebar.classList.contains('-translate-x-full');
if (isOpen) {
docsSidebar.classList.add('-translate-x-full');
overlay.classList.add('hidden');
overlay.setAttribute('aria-hidden', 'true');
btn.setAttribute('aria-expanded', 'false');
} else {
docsSidebar.classList.remove('-translate-x-full');
overlay.classList.remove('hidden');
overlay.setAttribute('aria-hidden', 'false');
btn.setAttribute('aria-expanded', 'true');
}
};

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

🧹 Nitpick | 🔵 Trivial

Consider extracting shared sidebar toggle logic to avoid duplication.

Both Nav.astro (lines 86-98) and DocsSidebar.astro (lines 190-196) manage the same sidebar/overlay state with similar code. The open logic here and close logic in DocsSidebar could drift out of sync.

Consider extracting a shared utility (e.g., toggleDocsSidebar(open: boolean)) that both components invoke, or consolidating all toggle/close logic in one place.

Otherwise, the implementation is correct:

  • Early return guards against missing elements on non-docs pages
  • ARIA state is properly synchronized with visual state
  • Re-initialization on astro:after-swap handles View Transitions correctly
🤖 Prompt for AI Agents
Verify each finding against the current code and only fix it if needed.

In `@site/src/components/Nav.astro` around lines 77 - 99, The sidebar toggle logic
in initNav duplicates the code in DocsSidebar; extract a shared function (e.g.,
toggleDocsSidebar(open: boolean)) that encapsulates the DOM manipulations now in
initNav (toggling '-translate-x-full' on docsSidebar, adding/removing 'hidden'
on overlay, and setting overlay aria-hidden and btn aria-expanded) and export or
import it so both Nav.astro's initNav and DocsSidebar call the same function
(use a single source of truth for open/close), keep the early guards for missing
elements in the shared helper or have callers validate, and ensure both
components still re-initialize on astro:after-swap to preserve view transition
behavior.

Comment thread site/src/styles/global.css
michaelmcnees and others added 4 commits March 23, 2026 12:46
- Remove 12 docs/*.md files (content lives in site/src/content/docs/)
- Update all mantle.dev references → mantle.dvflw.co across:
  internal/cli/root.go, site/src/layouts/Base.astro, astro.config.mjs,
  site/src/pages/404.astro, marketing/*.md

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
Co-authored-by: coderabbitai[bot] <136622811+coderabbitai[bot]@users.noreply.github.com>
…ted CSS

- README doc links now point to https://mantle.dvflw.co/docs/*
- GitHub external links get target="_blank" rel="noopener"
- word-break: break-word → overflow-wrap: anywhere (deprecated property)

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

@coderabbitai coderabbitai Bot left a comment

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Actionable comments posted: 4

🤖 Prompt for all review comments with AI agents
Verify each finding against the current code and only fix it if needed.

Inline comments:
In `@README.md`:
- Line 53: The README contains two broken documentation links
(https://mantle.dvflw.co/docs/plugins and
https://mantle.dvflw.co/docs/contributing) that return 404; update or remove
them by either deploying the missing docs or replacing the links in README.md
with correct, working URLs (or remove the link text) so the README no longer
references the two failing URLs; ensure both instances (the plugins link and the
contributing link) are fixed.

In `@site/src/components/DocsSidebar.astro`:
- Line 96: The mobile docs sidebar (`#docs-sidebar-mobile`) is only visually
hidden via CSS transform so its links remain in the accessibility tree; update
the toggle logic that controls the sidebar (the element referenced by id
"docs-sidebar-mobile" and the corresponding Nav.astro drawer toggle) to set
aria-hidden="true" when closed and remove it when opened, and also apply an
inert equivalent (e.g., inert property or a data-inert attribute with matching
CSS/JS to prevent focus) so links are removed from the tab order; ensure the
same change is applied to the other drawer control in Nav.astro (and the related
lines around 190-195) so both visual and assistive-state are synchronized when
opening/closing.

In `@site/src/components/Nav.astro`:
- Line 7: The docs-route test using Astro.url.pathname.startsWith('/docs') is
too loose and matches paths like /docs-preview; update the isDocs check (where
isDocs is defined) to only be true when the path is exactly '/docs' or begins
with '/docs/' (i.e., replace the current startsWith check with a combined
condition that checks Astro.url.pathname === '/docs' ||
Astro.url.pathname.startsWith('/docs/')) so the Docs highlight and Menu
rendering only apply within the docs tree.
- Around line 79-82: The inline script in Nav.astro exits early because
document.getElementById calls for btn, docsSidebar, and overlay run before the
sidebar/overlay are parsed; update the initialization so it waits for the DOM or
for the sidebar elements: wrap the existing initialization logic that references
btn, docsSidebar, and overlay into a DOMContentLoaded handler or implement a
MutationObserver that watches for the presence of the docsSidebar and overlay
elements and only then attaches event listeners to btn; keep the same element
IDs (bottom-nav-docs-btn, docs-sidebar-mobile, sidebar-overlay) and move all
code that currently returns when elements are missing into the deferred callback
so the button works on first load.

ℹ️ Review info
⚙️ Run configuration

Configuration used: Organization UI

Review profile: ASSERTIVE

Plan: Pro

Run ID: db7f5231-9646-4a47-9918-1064a267d78c

📥 Commits

Reviewing files that changed from the base of the PR and between e952982 and b82e26f.

📒 Files selected for processing (3)
  • README.md
  • site/src/components/DocsSidebar.astro
  • site/src/components/Nav.astro

Comment thread README.md
Comment thread site/src/components/DocsSidebar.astro Outdated
Comment thread site/src/components/Nav.astro Outdated
Comment thread site/src/components/Nav.astro
Verified each finding — all 4 needed fixes:

1. README: /docs/plugins → /docs/plugins-guide, /docs/contributing → CONTRIBUTING.md
2. Sidebar: aria-hidden="true" + inert on mobile drawer when closed,
   synced on open/close in both Nav and DocsSidebar handlers
3. isDocs: strict check — pathname === '/docs' || startsWith('/docs/')
4. Nav script timing: deferred init via requestAnimationFrame loop
   until sidebar DOM exists (Nav renders before DocsSidebar)

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

@coderabbitai coderabbitai Bot left a comment

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Actionable comments posted: 1

🤖 Prompt for all review comments with AI agents
Verify each finding against the current code and only fix it if needed.

Inline comments:
In `@site/src/components/Nav.astro`:
- Around line 104-115: The deferInitNav loop can spin forever on non-docs pages;
modify deferInitNav (and its astro:after-swap handler) to stop rescheduling when
the docs sidebar is never present — add a small retry/backoff and bail-out:
introduce a counter (e.g. retryCount with MAX_RETRIES) and a stored
requestAnimationFrame id, call initNav() when
document.getElementById('docs-sidebar-mobile') exists, otherwise increment
retryCount and only call requestAnimationFrame(deferInitNav) while retryCount <
MAX_RETRIES; also update the astro:after-swap listener to check for the sidebar
presence before scheduling or reset retryCount when the current route/page
clearly contains docs so the loop isn’t restarted on non-doc pages (referencing
deferInitNav, initNav, 'docs-sidebar-mobile', and the 'astro:after-swap'
listener).

ℹ️ Review info
⚙️ Run configuration

Configuration used: Organization UI

Review profile: ASSERTIVE

Plan: Pro

Run ID: 7976e31c-f06f-4a57-a31e-d7af59ac8f27

📥 Commits

Reviewing files that changed from the base of the PR and between b82e26f and 152d518.

📒 Files selected for processing (3)
  • README.md
  • site/src/components/DocsSidebar.astro
  • site/src/components/Nav.astro

Comment thread site/src/components/Nav.astro Outdated
michaelmcnees and others added 2 commits March 23, 2026 19:54
- Warn at startup when database URL uses sslmode=prefer with a
  non-loopback host (localhost/127.0.0.1/::1 are excluded)
- Prefix inline script globals in Nav.astro (_mantleNavRetries,
  _mantleDeferInitNav) to avoid collisions

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

@coderabbitai coderabbitai Bot left a comment

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Actionable comments posted: 1

Caution

Some comments are outside the diff and can’t be posted inline due to platform limitations.

⚠️ Outside diff range comments (1)
site/src/components/Nav.astro (1)

2-7: ⚠️ Potential issue | 🟡 Minor

Hide the mobile docs menu when the sidebar isn't mounted.

isDocs is path-based, so /docs/... 404s render the Menu button too. site/src/pages/404.astro currently uses <Base><Nav /></Base> without DocsSidebar, so the retry loop bails out and mobile docs 404s are left with a dead control; gate this button on whether the current layout actually renders the sidebar, or move docs-scoped 404s onto the docs layout. (github.com)

♻️ Possible direction
 interface Props {
   isHome?: boolean;
+  hasDocsSidebar?: boolean;
 }
-const { isHome = false } = Astro.props;
+const { isHome = false, hasDocsSidebar = false } = Astro.props;
 const prefix = isHome ? '' : '/';
 const isDocs = Astro.url.pathname === '/docs' || Astro.url.pathname.startsWith('/docs/');
@@
-    {isDocs && (
+    {isDocs && hasDocsSidebar && (
       <button id="bottom-nav-docs-btn" class="bottom-nav-item flex flex-col items-center gap-0.5 px-3 py-1 text-[11px] text-on-surface-variant hover:text-on-surface transition-colors" aria-label="Documentation menu">

Then have site/src/layouts/Docs.astro opt in with hasDocsSidebar={true}.

Also applies to: 44-49, 103-120

🤖 Prompt for AI Agents
Verify each finding against the current code and only fix it if needed.

In `@site/src/components/Nav.astro` around lines 2 - 7, The Nav component
currently computes isDocs from the URL and always shows the mobile Docs Menu
button even when the DocsSidebar isn't mounted; update Nav to accept a prop
(e.g., hasDocsSidebar) and change the logic that renders the Menu button and any
docs-scoped controls (currently guarded by isDocs) to require hasDocsSidebar &&
isDocs so the button is hidden when the sidebar isn't present; then have the
Docs layout (Docs.astro) pass hasDocsSidebar={true} into Nav and leave other
consumers (like the 404 page using Base<Nav />) unchanged so they no longer
render the dead Menu control.
🤖 Prompt for all review comments with AI agents
Verify each finding against the current code and only fix it if needed.

Inline comments:
In `@internal/config/config.go`:
- Around line 236-247: Replace the fragile literal host checks after
url.Parse(dbURL) with proper loopback detection: skip empty host; treat
"localhost" case-insensitively via strings.EqualFold(host, "localhost");
otherwise try net.ParseIP(host) and consider it loopback if ip != nil &&
ip.IsLoopback(); only emit the sslmode=prefer warning when the host is neither
"localhost" (case-insensitive) nor an IP that IsLoopback(); update imports to
include "net" and "strings" as needed and keep the existing q.Get("sslmode") and
log.Printf usage.

---

Outside diff comments:
In `@site/src/components/Nav.astro`:
- Around line 2-7: The Nav component currently computes isDocs from the URL and
always shows the mobile Docs Menu button even when the DocsSidebar isn't
mounted; update Nav to accept a prop (e.g., hasDocsSidebar) and change the logic
that renders the Menu button and any docs-scoped controls (currently guarded by
isDocs) to require hasDocsSidebar && isDocs so the button is hidden when the
sidebar isn't present; then have the Docs layout (Docs.astro) pass
hasDocsSidebar={true} into Nav and leave other consumers (like the 404 page
using Base<Nav />) unchanged so they no longer render the dead Menu control.

ℹ️ Review info
⚙️ Run configuration

Configuration used: Organization UI

Review profile: ASSERTIVE

Plan: Pro

Run ID: 10d8c881-1ca7-4098-a3af-b8a772d670d8

📥 Commits

Reviewing files that changed from the base of the PR and between 152d518 and 815ec70.

📒 Files selected for processing (2)
  • internal/config/config.go
  • site/src/components/Nav.astro

Comment thread internal/config/config.go
michaelmcnees and others added 2 commits March 23, 2026 20:28
Co-authored-by: coderabbitai[bot] <136622811+coderabbitai[bot]@users.noreply.github.com>
The CodeRabbit suggestion (4b48827) replaced the simple string
comparison with net.ParseIP/strings.EqualFold but didn't add the
required imports, breaking CI.

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
@michaelmcnees michaelmcnees marked this pull request as draft March 24, 2026 01:14
@michaelmcnees michaelmcnees marked this pull request as ready for review March 24, 2026 01:14
@michaelmcnees

Copy link
Copy Markdown
Collaborator Author

@coderabbitai this is ready for review

@coderabbitai

coderabbitai Bot commented Mar 24, 2026

Copy link
Copy Markdown
Contributor

@michaelmcnees: Sure! I'll start reviewing the changes in PR #4 right away.

✅ Actions performed

Review triggered.

Note: CodeRabbit is an incremental review system and does not re-review already reviewed commits. This command is applicable only when automatic reviews are paused.

@michaelmcnees michaelmcnees merged commit 613b506 into main Mar 24, 2026
6 checks passed
@michaelmcnees michaelmcnees deleted the fix/quickstart-ssl-config branch March 24, 2026 01:18
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

2 participants