feat(dashboard): show categories brought by tapped repositories in the sidebars by tym83 · Pull Request #4741 · cozystack/cozystack

Timur Tukaev (tym83) · 2026-10-04T09:28:44Z

What this PR does

The marketplace and console sidebars render a fixed category list, ["IaaS", "PaaS", "NaaS"], and drop every other spec.dashboard.category. A repository tapped with cozypkg that brings its own category is reachable only at the bottom of the full application list, and its installed applications get no console section at all.

Both sidebars now follow groupByCategory, the order the marketplace page already uses: IaaS, PaaS, NaaS first, then any other category alphabetically. Administration stays in the Admin portal, as before. Unknown categories get the generic grid icon.

The note in docs/agents/contributing.md that described the hardcoded list is removed, since it no longer holds.

Tests: two new cases in sidebar-sections.test.tsx (a tapped Paleocomputing category appears after the built-in ones in both sidebars, Administration stays out). Both fail on the previous code. The console suite (448 tests), pnpm typecheck and eslint on the changed files pass.

Screenshots

Same cluster and tenant, a repository tapped that brings the Paleocomputing category.

Before, marketplace: the category is only reachable at the bottom of the full list.

After, marketplace: the category gets its own filter.

Before, console: no section for the tapped applications.

After, console: installed applications of that category get their own section.

Downstream repositories

Walked the trigger map against the diff: it touches only the console sidebar code and a note in docs/agents/contributing.md. No package, values schema, CRD, installer value or ApplicationDefinition field changes. The website page on ApplicationDefinition does not restrict spec.dashboard.category values, and external-apps-example uses PaaS, which keeps working as before.

Release note

feat(dashboard): categories brought by tapped repositories now appear in the marketplace and console sidebars, after IaaS, PaaS and NaaS, instead of only in the full application list.

Summary by CodeRabbit

New Features
- Marketplace and Console sidebars now show application categories beyond the built-in options, including custom categories. Categories appear in the order provided by the application grouping.
- The Administration category remains excluded from both sidebars.

…e sidebars The marketplace and console sidebars rendered a fixed IaaS / PaaS / NaaS list and dropped every other spec.dashboard.category. A repository tapped with cozypkg that brings its own category was reachable only through the full application list, and its installed applications had no console section. Follow groupByCategory instead, the order the marketplace page already uses, and keep Administration in the Admin portal. Assisted-by: LLM Signed-off-by: tym83 <[email protected]>

The sidebars now follow every category but Administration, so the note describes behaviour that no longer exists. Assisted-by: LLM Signed-off-by: tym83 <[email protected]>

coderabbitai · 2026-10-04T09:28:51Z

Navigate logical layers of code changes, visualize relationships, and explore their blast radius.

No actionable comments were generated in the recent review. 🎉

ℹ️ Recent review info

⚙️ Run configuration

Configuration used: Repository: cozystack/cozystack/.coderabbit.yaml
Review profile: CHILL
Plan: Advanced
Run ID: be69a5ad-f338-45e3-a6d1-879336262558

📥 Commits

Reviewing files that changed from the base of the PR and between 091b854 and a3b8024.

📒 Files selected for processing (3)

docs/agents/contributing.md
packages/system/dashboard/images/console/apps/console/src/routes/sidebar-sections.test.tsx
packages/system/dashboard/images/console/apps/console/src/routes/sidebar-sections.tsx

Included review availability: This review used your included allowance. Your plan provides up to 8 included reviews per hour; 7 remain after this review.

📝 Walkthrough

Walkthrough

The Marketplace and Console sidebars now show every category returned by groupByCategory except Administration. Tests cover a custom category, its application route, and the exclusion of Administration.

Changes

Sidebar category coverage

Layer / File(s)	Summary
Include grouped categories in both sidebars `packages/system/dashboard/images/console/apps/console/src/routes/sidebar-sections.tsx`, `packages/system/dashboard/images/console/apps/console/src/routes/sidebar-sections.test.tsx`, `docs/agents/contributing.md`	Both sidebars retain grouped category order and exclude Administration. Tests cover a custom category and its application route. The contributing guidance no longer describes the previous sidebar limitation.

Priority: ⬇️ Low

Estimated code review effort: 2 (Simple) | ~10 minutes

Change: Feature

Suggested reviewers: kvaps

Merge Risk: ⚪ Minimal · up to a3b80

Tapped-repository categories now appear in the Marketplace and Console sidebars, while Administration remains in the Admin portal. No merge-blocking risk was identified.

Security Architecture Review

Security architecture risk: 🔵 Low · up to a3b80

Custom categories do not change tenant selection or authorization. However, a specially named category can select an invalid icon and prevent the Marketplace interface from rendering for users sharing that catalog. Exploitation requires contributing an accepted application definition; no backend privilege escalation was identified.

Retained concerns

Medium · security · inferred: Repository-supplied category names now reach a prototype-bearing icon lookup. An accepted non-module application definition with category proto survives grouping, selects Object.prototype instead of the fallback icon, and supplies an invalid component type to the Marketplace sidebar. This can prevent Marketplace rendering for catalog readers across tenants. The fixed category allowlist previously prevented this input from reaching the lookup.

Security review details

Security Blast Radius

inferred — A problematic definition can affect Marketplace views for every user whose catalog response includes it, independently of the selected tenant. The demonstrated source path concerns browser-interface availability, not server execution or access to other tenants' application instances.

Security Findings and Attack Paths

inferred — The attack requires authority to contribute an accepted, eligible application definition, directly or through a tapped repository. Setting its category to proto bypasses the intended generic-icon fallback through ordinary JavaScript prototype lookup and reaches an invalid React component type. Publication permissions and additional deployed admission controls remain unverified.

Trust Boundaries and Controls

observed — Existing route consumers still resolve application definitions and fetch application instances in the selected tenant namespace. Category metadata does not replace those identity or resource-selection mechanisms. The newly exposed boundary is metadata-to-component selection.

Resilience and Maintainability Implications

inferred — The inspected Sidebar, AppShell, App, and root mounting path provide no render-error boundary around sidebar icons. Consequently, invalid catalog metadata can disrupt the enclosing Marketplace interface rather than being contained to one icon.

Hardening Proposals

proposed — Use an own-property lookup or Map for category icons so every unrecognized category receives LayoutGrid without inheriting JavaScript object properties.

🚥 Pre-merge checks | ✅ 4 | ❌ 1

❌ Failed checks (1 warning)

Check name	Status	Explanation	Resolution
Docstring Coverage	⚠️ Warning	Docstring coverage is 75.00% which is insufficient. The required threshold is 80.00%. Docstring coverage is scoped to functions touched by this diff. Analyzed 4 functions across 2 files. (1 skipped: 1…	Write docstrings for the functions missing them to satisfy the coverage threshold.

✅ Passed checks (4 passed)

Check name	Status	Explanation
Description Check	✅ Passed	Check skipped - CodeRabbit’s high-level summary is enabled.
Title check	✅ Passed	The title clearly and concisely describes the main change: showing categories from tapped repositories in the sidebars.
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.

Full details: Docstring Coverage

Explanation

Docstring coverage is 75.00% which is insufficient. The required threshold is 80.00%. Docstring coverage is scoped to functions touched by this diff. Analyzed 4 functions across 2 files. (1 skipped: 1 unsupported.)

Fix all pre-merge checks with AI

✨ Finishing Touches

🧪 Generate unit tests (beta)

Create a new PR

Autopilot · Keep fixing CodeRabbit findings and required CI, and resolving merge conflicts

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

_{Comment @coderabbitai help to get the list of available commands.}

Aleksei Sviridkin (lexfrei)

Timur Tukaev (@tym83) LGTM. On a trial merge with current main, sidebar-sections.test.tsx passes, and both new cases fail when sidebar-sections.tsx is put back to main. So the tests pin the change. CATEGORY_ICON[category] ?? LayoutGrid covers the unknown-category icon, and the removed note in docs/agents/contributing.md described exactly the behaviour this replaces.

Non-blocking: this also changes a stock install, which the PR body does not mention. external-dns-rd ships category: Networking without module: true, so a default cluster gets a new "Networking" section in both sidebars, next to "NaaS". If that is intended, fine. If not, moving ExternalDNS to NaaS would keep one networking section.

Timur Tukaev (tym83) added 2 commits October 4, 2026 14:20

docs(agents): drop the note on hardcoded sidebar categories

a3b8024

The sidebars now follow every category but Administration, so the note describes behaviour that no longer exists. Assisted-by: LLM Signed-off-by: tym83 <[email protected]>

github-actions Bot added area/dashboard Issues or PRs related to the dashboard / UI kind/feature Categorizes issue or PR as related to a new feature size/M This PR changes 30-99 lines, ignoring generated files labels Oct 4, 2026

Timur Tukaev (tym83) marked this pull request as ready for review October 5, 2026 07:42

Timur Tukaev (tym83) requested review from IvanHunters, Andrei Kvapil (kvaps), Aleksei Sviridkin (lexfrei), Timofei Larkin (lllamnyp), mattia-eleuteri, myasnikovdaniil and Kirill Ilin (sircthulhu) as code owners October 5, 2026 07:42

Aleksei Sviridkin (lexfrei) approved these changes Oct 11, 2026

View reviewed changes

Aleksei Sviridkin (lexfrei) merged commit 4295930 into cozystack:main Oct 11, 2026
21 checks passed

This was referenced Oct 20, 2026

[Epic] Marketplace: fix tap defects in 1.7.x patches #4981

Open

[Epic] Split cozystack into platform and catalogs: step 0 #4982

Open

Navigation Menu

Repository navigation

feat(dashboard): show categories brought by tapped repositories in the sidebars - #4741

feat(dashboard): show categories brought by tapped repositories in the sidebars#4741
Aleksei Sviridkin (lexfrei) merged 2 commits into
cozystack:mainfrom
tym83:feat/dashboard-custom-categories

Timur Tukaev (tym83) commented Oct 4, 2026 •

edited by coderabbitai Bot

Loading

Uh oh!

coderabbitai Bot commented Oct 4, 2026 •

edited

Loading

Walkthrough

Changes

❌ Failed checks (1 warning)

Uh oh!

Aleksei Sviridkin (lexfrei) left a comment

Uh oh!

Uh oh!

Reviewers

Uh oh!

Assignees

Labels

Projects

Milestone

Development

Uh oh!

2 participants

Conversation

Timur Tukaev (tym83) commented Oct 4, 2026 • edited by coderabbitai Bot Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

What this PR does

Screenshots

Downstream repositories

Release note

Summary by CodeRabbit

Uh oh!

coderabbitai Bot commented Oct 4, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Walkthrough

Changes

Security Architecture Review

❌ Failed checks (1 warning)

Uh oh!

Aleksei Sviridkin (lexfrei) left a comment

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Reviewers

Uh oh!

Assignees

Labels

Projects

Milestone

Development

Uh oh!

2 participants

Timur Tukaev (tym83) commented Oct 4, 2026 •

edited by coderabbitai Bot

Loading

coderabbitai Bot commented Oct 4, 2026 •

edited

Loading