Fix all unresolved CodeRabbit comments on this PR:

• Push a commit to this branch (recommended)
• Create a new PR with the fixes

Fix all unresolved CodeRabbit comments on this PR:

• Push a commit to this branch (recommended)
• Create a new PR with the fixes

src/entities/side-project/sprint/api/update-sprint.ts (1)

13-26: 🔒 Security & Privacy | 🟠 Major | ⚡ Quick win

🧩 Analysis chain

🏁 Script executed:

#!/bin/bash
# sprints 테이블에 대한 RLS 정책 확인
rg -n "sprints" supabase/migrations -l
rg -n "policy|RLS|ENABLE ROW LEVEL SECURITY" supabase/migrations -i -A5 | rg -B5 -A5 "sprints"

Repository: TeampleRun/syncly

Length of output: 1489

---

🏁 Script executed:

#!/bin/bash
set -euo pipefail

printf '\n== migrations mentioning sprints ==\n'
rg -n "sprints|ENABLE ROW LEVEL SECURITY|CREATE POLICY|ALTER TABLE.*ROW LEVEL SECURITY|workspace_members|auth.uid" supabase/migrations -i -A4 -B4

printf '\n== sprints table definition ==\n'
sed -n '1,260p' supabase/migrations/20260709025327_create_enums_and_core_tables.sql

printf '\n== auth RLS policies migration ==\n'
sed -n '1,260p' supabase/migrations/20260709025820_add_auth_rls_policies.sql

printf '\n== sprint RPCs migration ==\n'
sed -n '1,240p' supabase/migrations/20260712220809_create_sprint_rpcs.sql

printf '\n== updateSprint implementation and callers ==\n'
sed -n '1,220p' src/entities/side-project/sprint/api/update-sprint.ts
rg -n "updateSprint\\(" src -A3 -B3

Repository: TeampleRun/syncly

Length of output: 46072

---

🏁 Script executed:

#!/bin/bash
set -euo pipefail

printf '\n== dev_full_access references ==\n'
rg -n "dev_full_access|drop policy|drop all policies|disable row level security|enable row level security" supabase/migrations -i -A3 -B3

printf '\n== any later sprint policy changes ==\n'
rg -n "sprints_member_all|create policy.*sprints|drop policy.*sprints" supabase/migrations -i -A3 -B3

printf '\n== updateSprint call sites with workspace context ==\n'
rg -n "updateSprint\\(" src -A5 -B5

Repository: TeampleRun/syncly

Length of output: 2397

---

workspace_id 기준 스코프를 추가하세요.
지금은 public.sprints에 dev_full_access RLS가 남아 있어 id만 알면 다른 워크스페이스 스프린트도 수정됩니다. updateSprint에 workspace_id 조건을 넣고, 운영 환경에선 이 permissive 정책을 제거해야 합니다.

🤖 Prompt for AI Agents

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

In `@src/entities/side-project/sprint/api/update-sprint.ts` around lines 13 - 26,
Update updateSprint to require and apply a workspace_id equality filter
alongside the existing id filter when updating sprints, using the authenticated
workspace context rather than trusting an arbitrary client value. Also remove
the permissive dev_full_access RLS policy from the production database
configuration or migration.

src/entities/side-project/task/api/create-task.ts (1)

3-3: 🗄️ Data Integrity & Integration | 🟠 Major | ⚡ Quick win

🧩 Analysis chain

🏁 Script executed:

#!/bin/bash
# DEV_USER_ID 사용처와 실제 인증(세션) 연동 여부 확인
rg -n "DEV_USER_ID" --type=ts
rg -n "auth.getUser|getSession" --type=ts -g '!**/node_modules/**'

Repository: TeampleRun/syncly

Length of output: 155

---

🏁 Script executed:

#!/bin/bash
set -euo pipefail

printf '\n## target file\n'
if [ -f src/entities/side-project/task/api/create-task.ts ]; then
  wc -l src/entities/side-project/task/api/create-task.ts
  cat -n src/entities/side-project/task/api/create-task.ts
else
  echo "missing target file"
fi

printf '\n## nearby task api files\n'
fd -a 'create-task.ts' src || true
fd -a 'task' src/entities/side-project || true

printf '\n## search for relevant symbols\n'
rg -n "DEV_USER_ID|created_by|createdBy|auth\\.getUser|auth\\.getSession|getSession\\(|user\\.id|session\\.user|supabase\\.auth" src

Repository: TeampleRun/syncly

Length of output: 6698

---

🏁 Script executed:

#!/bin/bash
set -euo pipefail

printf '\n## current-user helper\n'
wc -l src/shared/api/supabase/current-user.ts
cat -n src/shared/api/supabase/current-user.ts

printf '\n## actions using getCurrentUserId\n'
rg -n "getCurrentUserId\(" src/entities src/shared

printf '\n## DEV_USER_ID direct usages around create/update actions\n'
rg -n "DEV_USER_ID" src/entities/side-project src/entities/work-schedule src/entities/workspace src/shared/config

Repository: TeampleRun/syncly

Length of output: 2491

---

create-task.ts에서 DEV_USER_ID 대신 getCurrentUserId()를 사용하세요.

주석과 달리 현재 생성자(created_by)가 실제 로그인 유저가 아니라 고정 DEV_USER_ID로 저장됩니다. src/shared/api/supabase/current-user.ts의 공용 헬퍼로 바꿔 개발 환경만 fallback 되게 맞춰야 합니다.

🤖 Prompt for AI Agents

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

In `@src/entities/side-project/task/api/create-task.ts` at line 3, Update the task
creation flow in create-task.ts to use the shared getCurrentUserId() helper from
current-user.ts instead of DEV_USER_ID when populating created_by, preserving
the existing validation and insert behavior so development-only fallback remains
centralized in the helper.

src/entities/side-project/task/api/get-backlog-tasks.ts (1)

7-20: 🔒 Security & Privacy | 🟠 Major | ⚡ Quick win

🧩 Analysis chain

🏁 Script executed:

#!/bin/bash
# tasks 테이블 RLS 정책 확인
rg -n "tasks" supabase/migrations --iglob '*.sql' -A3 -B3 | rg -n "policy|rls" -i

Repository: TeampleRun/syncly

Length of output: 978

---

🏁 Script executed:

#!/bin/bash
set -euo pipefail

# 1) tasks 관련 RLS 정책 정의 확인
sed -n '1,220p' supabase/migrations/20260709025820_add_auth_rls_policies.sql

# 2) tasks 테이블에서 select 정책이 별도로 정의됐는지 확인
rg -n "create policy|policy .*tasks|tasks" supabase/migrations --iglob '*.sql' -A4 -B4

Repository: TeampleRun/syncly

Length of output: 26466

---

🏁 Script executed:

#!/bin/bash
set -euo pipefail

# 1) dev_full_access가 제거되는지 확인
rg -n "drop policy .*dev_full_access|dev_full_access" supabase/migrations --iglob '*.sql' -A3 -B3

# 2) 브라우저용 Supabase 클라이언트가 anon/publishable key를 쓰는지 확인
rg -n "getSupabaseBrowserClient|createBrowserClient|NEXT_PUBLIC_SUPABASE|publishable|anon" src supabase --iglob '*.{ts,tsx,ts,mts,cts,js,mjs,cjs,sql}' -A2 -B2

Repository: TeampleRun/syncly

Length of output: 11559

---

브라우저 조회는 현재 dev_full_access 때문에 워크스페이스 경계가 막히지 않습니다.
tasks에는 멤버십 RLS가 추가돼 있지만, public.* 전체에 적용된 dev_full_access가 아직 남아 있어 이 조회로 다른 워크스페이스 데이터가 읽힐 수 있습니다. 이 정책을 제거하거나 더 좁은 권한으로 제한해야 합니다.

🤖 Prompt for AI Agents

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

In `@src/entities/side-project/task/api/get-backlog-tasks.ts` around lines 7 - 20,
Update the database RLS configuration governing the tasks query used by
getBacklogTasks to remove or narrowly restrict the public.* dev_full_access
policy, ensuring access is limited to the authenticated user’s workspace
membership while preserving legitimate backlog reads.

src/entities/side-project/task/api/use-update-task-status.ts (1)

30-34: 🩺 Stability & Availability | 🟠 Major | ⚡ Quick win

옵셔널 체이닝 누락으로 롤백 시 런타임 에러 위험.

context?.previous.forEach(...)에서 ?.는 previous 접근만 보호하며, context가 undefined일 경우 context?.previous는 undefined가 되고 이어지는 .forEach(...) 호출에서 TypeError가 발생합니다. onMutate에서 cancelQueries가 실패하는 등 예외가 던져지면 context가 정의되지 않은 채로 onError가 호출될 수 있습니다.

🐛 제안 수정

-      context?.previous.forEach(([key, data]) => queryClient.setQueryData(key, data));
+      context?.previous.forEach(([key, data]) => queryClient.setQueryData(key, data)); // 기존 유지 시 아래로 대체
+      context?.previous?.forEach(([key, data]) => queryClient.setQueryData(key, data));

🤖 Prompt for AI Agents

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

In `@src/entities/side-project/task/api/use-update-task-status.ts` around lines 30
- 34, Update the rollback loop in the mutation’s onError handler to safely skip
iteration when context or its previous snapshot is undefined, while preserving
restoration of every snapshot when available. Keep the existing error toast
behavior unchanged.

src/entities/side-project/task/model/task.schema.ts (1)

16-16: 📐 Maintainability & Code Quality | 🔵 Trivial | 💤 Low value

🧩 Analysis chain

🌐 Web query:

Zod 4 z.string().uuid() deprecated in favor of z.uuid()?

💡 Result:

Yes, in Zod 4, the method z.string.uuid is deprecated in favor of the top-level z.uuid [1][2]. In Zod 4, common string validation methods like.email,.url, and.uuid have been moved from the ZodString prototype to the top-level z namespace [1]. While the previous method-chaining syntax (e.g., z.string.uuid) continues to work, it is considered deprecated in favor of the new, more tree-shakable and concise top-level API [1]. Additionally, it is important to note that Zod 4 introduced a breaking change regarding UUID validation behavior. The new z.uuid strictly enforces RFC 9562/4122 compliance, meaning it will reject some UUIDs that were accepted by Zod 3 [3][4][1]. If you require a more permissive validator that accepts any 8-4-4-4-12 hex pattern (similar to the legacy behavior), you should use z.guid instead [3][1].

Citations:

• 1: https://github.com/colinhacks/zod/blob/c7805073/packages/docs/content/v4/changelog.mdx
• 2: colinhacks/zod#5205
• 3: https://gist.github.com/imaman/a62d1c7bab770a3b49fe3be10a66f48a
• 4: colinhacks/zod#4969

---

🏁 Script executed:

#!/bin/bash
set -euo pipefail

# 확인: Zod 버전과 해당 스키마 사용 맥락을 봅니다.
git ls-files package.json pnpm-lock.yaml package-lock.json yarn.lock src/entities/side-project/task/model/task.schema.ts \
  | xargs -r -I{} sh -c 'echo "=== {} ==="; sed -n "1,220p" "{}"; echo'

Repository: TeampleRun/syncly

Length of output: 10820

---

🏁 Script executed:

#!/bin/bash
set -euo pipefail

# 확인: Zod 버전과 해당 스키마 사용 맥락을 봅니다.
for f in package.json pnpm-lock.yaml package-lock.json yarn.lock src/entities/side-project/task/model/task.schema.ts; do
  if git ls-files --error-unmatch "$f" >/dev/null 2>&1; then
    echo "=== $f ==="
    sed -n '1,220p' "$f"
    echo
  fi
done

Repository: TeampleRun/syncly

Length of output: 10820

---

z.string().uuid() 대신 z.uuid()로 바꾸세요.
Zod 4.4.3에서는 UUID 검증의 표준 API가 z.uuid()라서, 이 필드는 z.uuid().nullable()로 쓰면 됩니다.

🤖 Prompt for AI Agents

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

In `@src/entities/side-project/task/model/task.schema.ts` at line 16, Update the
assigneeId schema to use Zod’s standard z.uuid() validator followed by
.nullable(), replacing the current z.string().uuid() chain while preserving
nullable UUID validation.

src/features/manage-calendar/ui/CalendarView.tsx (1)

353-365: 📐 Maintainability & Code Quality | 🟡 Minor | ⚡ Quick win

라벨-인풋 연결 누락 (접근성)

시간 (선택) 라벨도 동일하게 대응하는 입력과 연결되어 있지 않습니다. htmlFor/id로 연결하면 353, 356 두 정적 분석 경고를 모두 해소할 수 있습니다.

♿ 제안 수정

-                <label className="text-brand-muted block text-[12px] font-semibold">
+                <label htmlFor="calendar-event-time" className="text-brand-muted block text-[12px] font-semibold">
                   시간 (선택)
                 </label>
                 <input
+                  id="calendar-event-time"
                   type="text"

📝 Committable suggestion

‼️ IMPORTANT
Carefully review the code before committing. Ensure that it accurately replaces the highlighted code, contains no missing lines, and has no issues with indentation. Thoroughly test & benchmark the code to ensure it meets the requirements.

                <label htmlFor="calendar-event-time" className="text-brand-muted block text-[12px] font-semibold">
                  시간 (선택)
                </label>
                <input
                  id="calendar-event-time"
                  type="text"
                  value={formValues.time}
                  onChange={(event) =>
                    setFormValues((current) => ({ ...current, time: event.target.value }))
                  }
                  placeholder="예: 오후 3:00"
                  className="text-brand-ink focus:ring-brand mt-2 h-11 w-full rounded-[16px] bg-[`#f1f3fb`] px-4 text-[14px] transition outline-none placeholder:text-[`#a8afc8`] focus:ring-1"
                />
              </div>

🧰 Tools

🪛 React Doctor (0.5.8)

[warning] 353-353: Screen reader users can't tell which input this label names because it's tied to none, so add htmlFor or wrap the input inside it.

Tie every label to a control with htmlFor, or by nesting the input.

(label-has-associated-control)

---

[warning] 356-356: Blind users can't tell what this control does because screen readers find no label, so add visible text, aria-label, or aria-labelledby.

Give every interactive control a label screen readers can read.

(control-has-associated-label)

🤖 Prompt for AI Agents

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

In `@src/features/manage-calendar/ui/CalendarView.tsx` around lines 353 - 365,
Connect the “시간 (선택)” label to its input by adding a matching htmlFor and id
pair around the time field in CalendarView, using a unique identifier and
preserving the existing input behavior.

Source: Linters/SAST tools

src/features/manage-sprint-tasks/model/use-task-dnd.ts (1)

9-41: 🎯 Functional Correctness | 🟠 Major | 🏗️ Heavy lift

🧩 Analysis chain

🏁 Script executed:

#!/bin/bash
# Check whether TaskFormDialog/task-form.ts expose a status field as a drag alternative
fd -e ts -e tsx . src/features/manage-sprint-tasks | xargs rg -n -i 'status' -C3

Repository: TeampleRun/syncly

Length of output: 14514

---

🏁 Script executed:

#!/bin/bash
set -euo pipefail

echo "== files =="
git ls-files 'src/features/manage-sprint-tasks/**' | sed -n '1,200p'

echo
echo "== outline task-form.ts =="
ast-grep outline src/features/manage-sprint-tasks/model/task-form.ts --view expanded || true

echo
echo "== task-form.ts relevant lines =="
sed -n '1,220p' src/features/manage-sprint-tasks/model/task-form.ts

echo
echo "== SprintColumn.tsx relevant lines =="
sed -n '1,240p' src/features/manage-sprint-tasks/ui/SprintColumn.tsx

echo
echo "== TaskCard.tsx relevant lines =="
sed -n '1,260p' src/features/manage-sprint-tasks/ui/TaskCard.tsx

echo
echo "== SprintBoard.tsx relevant lines =="
sed -n '1,220p' src/features/manage-sprint-tasks/ui/SprintBoard.tsx

Repository: TeampleRun/syncly

Length of output: 11033

---

상태 변경에 키보드/단일 포인터 대안을 추가하세요

src/features/manage-sprint-tasks/model/use-task-dnd.ts의 상태 변경은 네이티브 드래그에만 연결돼 있고, TaskFormDialog에도 status 필드가 없어 카드 이동을 드래그 없이 할 수 없습니다. 카드나 컬럼에 상태 변경 버튼/셀렉트 같은 대안을 두어야 합니다.

🤖 Prompt for AI Agents

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

In `@src/features/manage-sprint-tasks/model/use-task-dnd.ts` around lines 9 - 41,
Extend useTaskDnd beyond native drag events by exposing a keyboard- and
single-pointer-accessible status-change action, such as a status selector or
change handler that invokes onMove with the task ID and target TaskStatus.
Integrate this alternative with the task card or column UI, and add the missing
status control to TaskFormDialog or the relevant card component so users can
move tasks without dragging.

src/features/manage-sprints/ui/SprintDeleteDialog.tsx (2)

3-4: 📐 Maintainability & Code Quality | 🔵 Trivial | ⚡ Quick win

TODO 주석이 실제 배선 상태와 불일치

"UI 전용 셸(삭제 로직 미배선)"이라는 주석과 TODO가 남아있지만, SprintToolbar.tsx의 onConfirm={() => deleteSprint.mutate(sprint.id)}(91번째 줄)에서 이미 useDeleteSprint 뮤테이션에 연결되어 있습니다. 오래된 주석은 향후 혼동이나 중복 작업을 유발할 수 있으니 정리해주세요.

📝 주석 정리 제안

-// 스프린트 삭제 확인 모달 — UI 전용 셸(삭제 로직 미배선).
-// TODO(후속): onConfirm을 스프린트 삭제 서버액션(useMutation)에 연결한다.
+// 스프린트 삭제 확인 모달 — onConfirm은 SprintToolbar에서 useDeleteSprint 뮤테이션으로 연결된다.

📝 Committable suggestion

‼️ IMPORTANT
Carefully review the code before committing. Ensure that it accurately replaces the highlighted code, contains no missing lines, and has no issues with indentation. Thoroughly test & benchmark the code to ensure it meets the requirements.

// 스프린트 삭제 확인 모달 — onConfirm은 SprintToolbar에서 useDeleteSprint 뮤테이션으로 연결된다.

🤖 Prompt for AI Agents

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

In `@src/features/manage-sprints/ui/SprintDeleteDialog.tsx` around lines 3 - 4,
Remove the outdated UI-only and future-wiring comments from
SprintDeleteDialog.tsx, since SprintToolbar’s onConfirm already invokes the
useDeleteSprint mutation via deleteSprint.mutate(sprint.id). Do not change the
existing deletion wiring.

---

13-26: 📐 Maintainability & Code Quality | 🟠 Major | ⚡ Quick win

다이얼로그 오픈/취소 처리 로직 중복 — 공용 훅 추출 제안

이 useEffect(showModal + cancel 리스너) 블록이 SprintFormDialog.tsx(47-57)와 기존 TaskFormDialog.tsx(58-70)에도 그대로 반복됩니다. useNativeDialog(onClose) 같은 공용 훅으로 추출해 src/shared/lib에 두는 것을 제안합니다.

♻️ 공용 훅 추출 예시

// src/shared/lib/use-native-dialog.ts
import { useEffect, useRef } from 'react';

export function useNativeDialog(onClose: () => void) {
  const dialogRef = useRef<HTMLDialogElement>(null);

  useEffect(() => {
    const dialog = dialogRef.current;
    if (!dialog) return undefined;
    dialog.showModal();
    const handleCancel = (event: Event) => {
      event.preventDefault();
      onClose();
    };
    dialog.addEventListener('cancel', handleCancel);
    return () => dialog.removeEventListener('cancel', handleCancel);
  }, [onClose]);

  return dialogRef;
}

-  const dialogRef = useRef<HTMLDialogElement>(null);
-
-  useEffect(() => {
-    const dialog = dialogRef.current;
-    if (!dialog) return undefined;
-    dialog.showModal();
-    const handleCancel = (event: Event) => {
-      event.preventDefault();
-      onClose();
-    };
-    dialog.addEventListener('cancel', handleCancel);
-    return () => dialog.removeEventListener('cancel', handleCancel);
-  }, [onClose]);
+  const dialogRef = useNativeDialog(onClose);

As per coding guidelines, "src/shared/**/*.{ts,tsx}: Place reusable common code in src/shared, including UI components and libraries."

🤖 Prompt for AI Agents

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

In `@src/features/manage-sprints/ui/SprintDeleteDialog.tsx` around lines 13 - 26,
Extract the repeated dialog setup from SprintDeleteDialog, SprintFormDialog, and
TaskFormDialog into a shared useNativeDialog hook under src/shared, preserving
showModal, cancel prevention, onClose invocation, listener cleanup, and the
onClose dependency. Replace each component’s local ref/effect block with the
shared hook and use its returned dialog ref.

Source: Coding guidelines

src/features/manage-sprints/ui/SprintFormDialog.tsx (2)

3-5: 📐 Maintainability & Code Quality | 🔵 Trivial | ⚡ Quick win

TODO 주석이 실제 배선 상태와 불일치

"저장 로직 미배선" TODO가 남아있지만, SprintToolbar.tsx의 handleSubmit(39-45번째 줄)에서 updateSprint.mutate(...)/createSprint.mutate(...)로 이미 연결되어 있습니다. SprintDeleteDialog.tsx와 동일한 패턴이니 함께 정리해주세요.

📝 주석 정리 제안

-// 스프린트 생성/수정 모달 — UI 전용 셸(저장 로직 미배선).
-// 톤은 TaskFormDialog와 동일(네이티브 <dialog>.showModal, rounded-2xl 패널, 슬레이트 입력).
-// TODO(후속): onSubmit을 스프린트 생성/수정 서버액션(useMutation)에 연결한다.
+// 스프린트 생성/수정 모달 — 톤은 TaskFormDialog와 동일(네이티브 <dialog>.showModal, rounded-2xl 패널, 슬레이트 입력).
+// onSubmit은 SprintToolbar에서 useCreateSprint/useUpdateSprint 뮤테이션으로 연결된다.

📝 Committable suggestion

‼️ IMPORTANT
Carefully review the code before committing. Ensure that it accurately replaces the highlighted code, contains no missing lines, and has no issues with indentation. Thoroughly test & benchmark the code to ensure it meets the requirements.

// 스프린트 생성/수정 모달 — 톤은 TaskFormDialog와 동일(네이티브 <dialog>.showModal, rounded-2xl 패널, 슬레이트 입력).
// onSubmit은 SprintToolbar에서 useCreateSprint/useUpdateSprint 뮤테이션으로 연결된다.

🤖 Prompt for AI Agents

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

In `@src/features/manage-sprints/ui/SprintFormDialog.tsx` around lines 3 - 5,
Remove the outdated “저장 로직 미배선” and follow-up onSubmit TODO comments from
SprintFormDialog.tsx, since SprintToolbar.handleSubmit already routes create and
update operations through the appropriate mutations. Keep the existing UI shell
comments that remain accurate.

---

90-90: 📐 Maintainability & Code Quality | 🔵 Trivial | 💤 Low value

정적 분석: autoFocus 사용 경고 — 모달 컨텍스트에서는 참고용

React Doctor(no-autofocus)가 autoFocus를 경고했습니다. 다만 네이티브 <dialog>.showModal() 안에서 첫 입력 필드에 초기 포커스를 주는 것은 WAI-ARIA 모달 다이얼로그 패턴에서 흔히 권장되는 방식이며, 같은 코드베이스의 TaskFormDialog.tsx도 동일하게 사용 중입니다. 다만 스크린리더 사용자 경험에 문제가 없는지 한 번 확인해보시는 것을 권장합니다.

🧰 Tools

🪛 React Doctor (0.5.8)

[warning] 90-90: autoFocus moves focus on load, which can disrupt screen reader and keyboard users. Remove it and let users choose where to focus.

Do not use autoFocus. It disorients users on load.

(no-autofocus)

🤖 Prompt for AI Agents

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

In `@src/features/manage-sprints/ui/SprintFormDialog.tsx` at line 90, Review the
autoFocus prop in SprintFormDialog and verify that focusing the initial field on
native modal open is intentional and accessible. Preserve it if it matches the
established TaskFormDialog pattern and does not harm screen-reader behavior;
otherwise replace it with the project’s existing modal-focus approach.

Source: Linters/SAST tools

src/widgets/side-project/dashboard-my-tasks/ui/MyTasks.tsx (1)

7-12: 📐 Maintainability & Code Quality | 🔵 Trivial | ⚡ Quick win

타입 전용 import 스타일 불일치

같은 모듈에서 TaskStatus는 type 접두사를 사용하지만 Task는 사용하지 않습니다 (Backlog.tsx에서는 type Task로 일관되게 사용). verbatimModuleSyntax가 활성화된 경우 타입만 사용되는 식별자에 type 접두사가 없으면 빌드/린트 오류가 날 수 있습니다.

🔧 제안 수정

 import {
   getMockSprintTasks,
-  Task,
+  type Task,
   TASK_STATUS,
   type TaskStatus,
 } from '`@/entities/side-project/task`';

📝 Committable suggestion

‼️ IMPORTANT
Carefully review the code before committing. Ensure that it accurately replaces the highlighted code, contains no missing lines, and has no issues with indentation. Thoroughly test & benchmark the code to ensure it meets the requirements.

import {
  getMockSprintTasks,
  type Task,
  TASK_STATUS,
  type TaskStatus,
} from '`@/entities/side-project/task`';

🤖 Prompt for AI Agents

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

In `@src/widgets/side-project/dashboard-my-tasks/ui/MyTasks.tsx` around lines 7 -
12, Update the import from the task module in MyTasks.tsx so Task is also marked
as a type-only import, matching TaskStatus and the convention used by
Backlog.tsx; leave the runtime imports getMockSprintTasks and TASK_STATUS
unchanged.

supabase/migrations/20260712220809_create_sprint_rpcs.sql (1)

1-8: 🔒 Security & Privacy | 🟠 Major | ⚡ Quick win

🧩 Analysis chain

🏁 Script executed:

#!/bin/bash
set -euo pipefail

echo "== locate relevant files =="
git ls-files | rg 'supabase/migrations/20260712220809_create_sprint_rpcs.sql|src/entities/side-project/sprint/api/create-sprint.ts|get-sprints.ts|supabase/.+sql$|migrations/.+sql$' || true

echo
echo "== outline migration file =="
ast-grep outline supabase/migrations/20260712220809_create_sprint_rpcs.sql --view expanded || true

echo
echo "== outline create-sprint api file if present =="
fd -a 'create-sprint.ts' src || true

echo
echo "== search for sprint RLS/policies/functions =="
rg -n --hidden -S "create policy|alter table .* enable row level security|get_sprints|create_sprint|workspace_id|auth\.uid\(\)" supabase src | sed -n '1,240p'

Repository: TeampleRun/syncly

Length of output: 28349

---

🏁 Script executed:

#!/bin/bash
set -euo pipefail

echo "== file stats =="
for f in supabase/migrations/20260712220809_create_sprint_rpcs.sql src/entities/side-project/sprint/api/create-sprint.ts; do
  if [ -f "$f" ]; then
    wc -l "$f"
  fi
done

echo
echo "== migration excerpt =="
sed -n '1,220p' supabase/migrations/20260712220809_create_sprint_rpcs.sql

echo
echo "== create-sprint excerpt =="
if [ -f src/entities/side-project/sprint/api/create-sprint.ts ]; then
  sed -n '1,220p' src/entities/side-project/sprint/api/create-sprint.ts
fi

echo
echo "== migrations mentioning sprints/tasks policies =="
rg -n --hidden -S "enable row level security|create policy|sprints|tasks" supabase/migrations | sed -n '1,260p'

Repository: TeampleRun/syncly

Length of output: 8726

---

🏁 Script executed:

#!/bin/bash
set -euo pipefail

echo "== inspect auth RLS migration around sprints/tasks =="
sed -n '1,180p' supabase/migrations/20260709025820_add_auth_rls_policies.sql

echo
echo "== search for dev_full_access removal or policy replacement =="
rg -n --hidden -S "dev_full_access|drop policy|alter policy|sprints_select_member|tasks_select_member" supabase/migrations | sed -n '1,240p'

Repository: TeampleRun/syncly

Length of output: 4702

---

🏁 Script executed:

#!/bin/bash
set -euo pipefail

python3 - <<'PY'
from pathlib import Path
p = Path('supabase/migrations/20260709025820_add_auth_rls_policies.sql')
text = p.read_text()
for needle in ['sprints','tasks','dev_full_access','create policy']:
    print(f'-- {needle} --')
    for i, line in enumerate(text.splitlines(), 1):
        if needle in line:
            print(f'{i}: {line}')
PY

Repository: TeampleRun/syncly

Length of output: 1718

---

RPC/서버액션에서 워크스페이스 멤버십을 직접 확인해야 합니다

sprints/tasks용 RLS 정책은 이미 있지만, dev_full_access가 살아 있는 동안에는 get_sprints와 createSprint가 p_workspace_id만 믿고 다른 워크스페이스를 조회/수정할 수 있습니다. public.is_workspace_member(p_workspace_id) 가드를 이 경로에 추가하세요.

🤖 Prompt for AI Agents

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

In `@supabase/migrations/20260712220809_create_sprint_rpcs.sql` around lines 1 -
8, Update the get_sprints RPC and the createSprint server action to explicitly
require public.is_workspace_member(p_workspace_id) before reading or modifying
workspace data. Reject unauthorized requests and preserve the existing behavior
for valid workspace members; do not rely solely on the existing RLS policies
while dev_full_access remains enabled.

Fix all unresolved CodeRabbit comments on this PR:

• Push a commit to this branch (recommended)
• Create a new PR with the fixes

Fix all unresolved CodeRabbit comments on this PR:

• Push a commit to this branch (recommended)
• Create a new PR with the fixes