feat(feedback): admin-only in-app feedback inbox at /dashboard/feedback

- Add ListFeedback SQL query (sqlc generated) to fetch up to 200 rows newest-first
- Add SHOPLIT_ADMIN_USER_IDS config (default "1") for controlling inbox access
- Extend feedback.Service with admins set; change NewService signature to accept []int64
- Add ListHandler (GET /api/v1/feedback) — 403 for non-admins, JSON array for admins
- Parse admin IDs from cfg.AdminUserIDs in main.go; register route in /api/v1 group
- Add listFeedback() + FeedbackItem to web/lib/api-client.ts
- Add /dashboard/feedback server component: editorial card list, 403 guard, empty state

Author: mayur-tolexo

cmd/shoplit-api/main.go

@@ -7,6 +7,8 @@ import (
 	"net/http"
 	"os"
 	"os/signal"
+	"strconv"
+	"strings"
 	"syscall"
 	"time"
 
@@ -63,7 +65,18 @@ func run() error {
 
 	q := sqlcgen.New(pool)
 	mlr := mailer.NewResend(cfg.ResendAPIKey, cfg.FeedbackFrom)
-	fb := feedback.NewService(q, mlr, cfg.FeedbackEmail)
+
+	var adminIDs []int64
+	for _, part := range strings.Split(cfg.AdminUserIDs, ",") {
+		part = strings.TrimSpace(part)
+		if part == "" {
+			continue
+		}
+		if id, err := strconv.ParseInt(part, 10, 64); err == nil {
+			adminIDs = append(adminIDs, id)
+		}
+	}
+	fb := feedback.NewService(q, mlr, cfg.FeedbackEmail, adminIDs)
 
 	sm := auth.NewSessionManager(cfg.SessionSecret).
 		WithSecure(cfg.CookieSecure).
@@ -110,6 +123,7 @@ func run() error {
 	r.Route("/api/v1", func(r chi.Router) {
 		r.Use(sm.RequireUser())
 		r.Post("/extension/token", exttoken.MintHandler(q))
+		r.Get("/feedback", fb.ListHandler())
 		carts.RegisterRoutes(r, svc, fetcher)
 	})
 

internal/config/config.go

@@ -57,6 +57,8 @@ type Config struct {
 	// Where feature-request notifications are sent, and the From line Resend uses.
 	FeedbackEmail string `env:"SHOPLIT_FEEDBACK_EMAIL" envDefault:"mayur.das4@gmail.com"`
 	FeedbackFrom  string `env:"SHOPLIT_FEEDBACK_FROM" envDefault:"shoplit <onboarding@resend.dev>"`
+	// Comma-separated user IDs allowed to view the in-app feedback inbox.
+	AdminUserIDs string `env:"SHOPLIT_ADMIN_USER_IDS" envDefault:"1"`
 
 	// Origin allowed to make credentialed cross-origin requests to the API.
 	// In dev this is the Next.js frontend.

internal/db/queries.sql

@@ -136,6 +136,10 @@ UPDATE extension_tokens SET last_used_at = now() WHERE id = $1;
 -- name: InsertFeedback :exec
 INSERT INTO feedback (message, email, name, page) VALUES ($1, $2, $3, $4);
 
+-- name: ListFeedback :many
+SELECT id, message, email, name, page, created_at
+FROM feedback ORDER BY created_at DESC LIMIT 200;
+
 -- ─── ANALYTICS (reads) ──────────────────────────────────────────────────────
 
 -- name: CartViews7d :one

internal/db/sqlc/querier.go

@@ -6,10 +6,12 @@ import (
 	"encoding/json"
 	"log/slog"
 	"net/http"
+	"strconv"
 	"strings"
 	"time"
 
 	"github.com/jackc/pgx/v5/pgtype"
+	"github.com/mayur-tolexo/shoplit/internal/auth"
 	"github.com/mayur-tolexo/shoplit/internal/mailer"
 	sqlcgen "github.com/mayur-tolexo/shoplit/internal/db/sqlc"
 )
@@ -24,11 +26,16 @@ type Service struct {
 	q      *sqlcgen.Queries
 	mailer Mailer
 	to     string
+	admins map[int64]bool
 }
 
 // NewService constructs a Service.
-func NewService(q *sqlcgen.Queries, m Mailer, to string) *Service {
-	return &Service{q: q, mailer: m, to: to}
+func NewService(q *sqlcgen.Queries, m Mailer, to string, adminIDs []int64) *Service {
+	admins := make(map[int64]bool, len(adminIDs))
+	for _, id := range adminIDs {
+		admins[id] = true
+	}
+	return &Service{q: q, mailer: m, to: to, admins: admins}
 }
 
 type feedbackRequest struct {
@@ -107,3 +114,48 @@ func (s *Service) Handler() http.HandlerFunc {
 		w.WriteHeader(http.StatusNoContent)
 	}
 }
+
+type feedbackItem struct {
+	ID        string `json:"id"`
+	Message   string `json:"message"`
+	Email     string `json:"email"`
+	Name      string `json:"name"`
+	Page      string `json:"page"`
+	CreatedAt string `json:"createdAt"`
+}
+
+// ListHandler returns an http.HandlerFunc for admin-only listing of feedback.
+// It must be registered under the authenticated /api/v1 group.
+func (s *Service) ListHandler() http.HandlerFunc {
+	return func(w http.ResponseWriter, r *http.Request) {
+		uid, ok := auth.UserIDFromContext(r.Context())
+		if !ok || !s.admins[uid] {
+			http.Error(w, "forbidden", http.StatusForbidden)
+			return
+		}
+
+		rows, err := s.q.ListFeedback(r.Context())
+		if err != nil {
+			slog.Error("feedback: list", "err", err)
+			http.Error(w, "internal error", http.StatusInternalServerError)
+			return
+		}
+
+		items := make([]feedbackItem, 0, len(rows))
+		for _, row := range rows {
+			items = append(items, feedbackItem{
+				ID:        strconv.FormatInt(row.ID, 10),
+				Message:   row.Message,
+				Email:     row.Email.String,
+				Name:      row.Name.String,
+				Page:      row.Page.String,
+				CreatedAt: row.CreatedAt.Time.Format(time.RFC3339),
+			})
+		}
+
+		w.Header().Set("Content-Type", "application/json")
+		if err := json.NewEncoder(w).Encode(items); err != nil {
+			slog.Error("feedback: encode list", "err", err)
+		}
+	}
+}

internal/db/sqlc/queries.sql.go

@@ -0,0 +1,100 @@
+import { cookies } from "next/headers";
+import { listFeedback, type FeedbackItem } from "@/lib/api-client";
+
+export const dynamic = "force-dynamic";
+
+function formatDate(iso: string): string {
+  try {
+    return new Date(iso).toLocaleDateString("en-IN", {
+      day: "numeric",
+      month: "short",
+      year: "numeric",
+    });
+  } catch {
+    return iso;
+  }
+}
+
+export default async function FeedbackInboxPage() {
+  const cookie = cookies().toString();
+
+  let items: FeedbackItem[] = [];
+  let forbidden = false;
+  let error = false;
+
+  try {
+    items = await listFeedback({ cookie });
+  } catch (e) {
+    const msg = e instanceof Error ? e.message : String(e);
+    if (msg.includes("403") || msg.toLowerCase().includes("forbidden")) {
+      forbidden = true;
+    } else {
+      error = true;
+    }
+  }
+
+  if (forbidden) {
+    return (
+      <div className="flex items-center justify-center min-h-[40vh]">
+        <p className="text-muted text-sm">You don&apos;t have access to this page.</p>
+      </div>
+    );
+  }
+
+  if (error) {
+    return (
+      <div className="flex items-center justify-center min-h-[40vh]">
+        <p className="text-muted text-sm">Something went wrong loading the feedback inbox.</p>
+      </div>
+    );
+  }
+
+  return (
+    <div className="mx-auto max-w-3xl px-4 sm:px-6 py-10">
+      <div className="mb-8">
+        <h1 className="font-serif text-3xl sm:text-4xl tracking-tight leading-none mb-1">
+          Feature requests
+        </h1>
+        <p className="text-muted text-sm">
+          {items.length === 0
+            ? "No requests yet."
+            : `${items.length} ${items.length === 1 ? "submission" : "submissions"}`}
+        </p>
+      </div>
+
+      {items.length === 0 ? (
+        <div className="rounded-xl border border-rule bg-cream px-6 py-10 text-center">
+          <p className="text-muted text-sm">No requests yet.</p>
+        </div>
+      ) : (
+        <ul className="flex flex-col gap-4">
+          {items.map((item) => (
+            <li
+              key={item.id}
+              className="rounded-xl border border-rule bg-cream px-5 py-4"
+            >
+              <p className="text-ink leading-relaxed mb-3 whitespace-pre-wrap">{item.message}</p>
+              <p className="text-muted text-xs flex flex-wrap gap-x-2 gap-y-0.5">
+                {(item.name || item.email) && (
+                  <span>
+                    {item.name && item.email
+                      ? `${item.name} (${item.email})`
+                      : item.name || item.email}
+                  </span>
+                )}
+                {item.page && (
+                  <>
+                    <span aria-hidden="true">&middot;</span>
+                    <span className="truncate max-w-[200px]">{item.page}</span>
+                  </>
+                )}
+                <span aria-hidden="true">&middot;</span>
+                <span>{formatDate(item.createdAt)}</span>
+              </p>
+            </li>
+          ))}
+        </ul>
+      )}
+    </div>
+  );
+}

internal/feedback/feedback.go

@@ -198,3 +198,8 @@ export async function logout(): Promise<void> {
 export async function submitFeedback(input: { message: string; email?: string; name?: string; page?: string }): Promise<void> {
   await jsonFetch("/api/public/feedback", { method: "POST", body: JSON.stringify(input) });
 }
+
+export interface FeedbackItem { id: string; message: string; email: string; name: string; page: string; createdAt: string }
+export async function listFeedback(opts?: { cookie?: string }): Promise<FeedbackItem[]> {
+  return jsonFetch<FeedbackItem[]>("/api/v1/feedback", opts);
+}