Repository navigation
fix(presets): make the burndown and burnup presets pass the query guard (#11) - #12
Merged
pikann merged 1 commit intoOct 7, 2026
Conversation
…rd (Paca-AI#11) The "Burndown (active sprint)" and "Burnup (active sprint)" presets in the frontend, and the burndown preset in the paca-dashboard-builder skill, used UNION ALL and repeated {{project_id}} inside nested subqueries. The guard rejects both (compound SELECTs are forbidden because a second branch escapes the project filter; the placeholder must appear once, as a top-level equality), so these presets failed the moment anyone used them. They now select the most recently started active sprint in the outer query and produce one row per day from its start date to today with generate_series, counting scope and completed tasks with correlated subqueries. The skill's safety rules now state the single top-level placeholder rule, the compound-SELECT ban and the subquery restriction for tables with sensitive columns. backend/presets_test.go runs every preset shipped in presets.ts and in the skill through validateQuery, so an invalid preset fails the build. Fixes Paca-AI#11
pikann
approved these changes
Oct 7, 2026
pikann
left a comment
pikann
left a comment
Contributor
There was a problem hiding this comment.
LGTM! Thank you for the contribution! 🚀
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
Fixes #11. The Burndown (active sprint) and Burnup (active sprint) presets in the frontend's preset list, and the burndown preset in the
paca-dashboard-builderskill, were rejected by the plugin's own query guard, so they failed the moment anyone used them:UNION ALL, which the guard forbids (deliberately: a second branch escapes the project filter);{{project_id}}inside nested subqueries, while the guard requires it exactly once, as a top-level equality filter.The presets now select the project's most recently started active sprint in the outer query, generate one row per day from its start date to today with
generate_series, and count scope / completed tasks with correlated subqueries. Days without activity now appear too, which reads better as a burndown. The skill's "Query safety rules" section now states the single top-level placeholder rule, the compound-SELECT ban, and the subquery restriction for tables with sensitive columns, which agents previously had to discover from error messages.New
backend/presets_test.goruns every preset shipped infrontend/src/presets.tsand in the skill throughvalidateQuerywith its declared scope. Before the fix it failed on exactly these three presets; the other seven already passed.Checklist
go test ./...andgo vet ./...pass inbackend/;tsc --noEmitpasses infrontend/./dashboard/query/previewand return the expected columns (day, remaining_tasksandday, total_scope, completed).