Mockup: per-component file dropdowns in the sticky PR comment

[brovatten]

Not for merge — visual mockup for discussion.

Today the sticky PR comment shows the Mermaid diff diagram but never says which files made a component change color, even though every component already carries file_methods[] (files + methods) that the diff logic uses internally and then discards.

The two comments below mock up candidate formats, exactly as the action would post them (toy data):

• Variant A — one collapsed dropdown per changed component; expanding lists the changed files in it.
• Variant B — same, but each file is itself a dropdown revealing the changed methods, tagged 🟩 added / 🟨 modified / 🟥 removed.

The committed doc (docs/mockups/pr-comment-file-dropdowns.md) has the same mockups plus implementation notes: intersect file_methods[] with the git diff (changed files only, not the component's full file list), respect GitHub's 65,536-char comment cap (cap files per component, drop dropdowns before dropping the diagram), and build the block in a Python helper next to build_cta.py rather than inline bash.

🤖 Generated with Claude Code

[brovatten]

Architecture review · 3 components changed

graph LR
    API["API Gateway"]
    AUTH["AuthService"]
    RL["RateLimiter"]
    LSS["LegacySessionStore"]
    DB["UserStore"]
    API -- "authenticates via" --> AUTH
    API -- "throttled by" --> RL
    AUTH -- "reads/writes" --> DB
    AUTH -- "persisted sessions in" --> LSS
    classDef added fill:#1f883d,stroke:#0b5d23,color:#ffffff;
    classDef modified fill:#bf8700,stroke:#7d4e00,color:#ffffff;
    classDef deleted fill:#cf222e,stroke:#82071e,color:#ffffff,stroke-dasharray:5 3;
    class RL added;
    class AUTH modified;
    class LSS deleted;
    linkStyle 1 stroke:#0b5d23,stroke-width:2px;
    linkStyle 3 stroke:#82071e,stroke-width:2px,stroke-dasharray:5 3;

Loading

Colors indicate component changes compared to main: 🟩 Added · 🟨 Modified · 🟥 Removed

🟨 AuthService — 3 files changed

• src/auth/handler.py
• src/auth/session.py
• src/auth/middleware.py

🟩 RateLimiter — 2 files added

• src/ratelimit/bucket.py
• src/ratelimit/config.py

🟥 LegacySessionStore — 2 files removed

• src/auth/legacy/store.py
• src/auth/legacy/migrations.py

---

See this architecture in your editor: Open in VS Code →

_{codeboarding-action · run 0000000001 · mockup — Variant A: component → changed files}

[brovatten]

Architecture review · 3 components changed

graph LR
    API["API Gateway"]
    AUTH["AuthService"]
    RL["RateLimiter"]
    LSS["LegacySessionStore"]
    DB["UserStore"]
    API -- "authenticates via" --> AUTH
    API -- "throttled by" --> RL
    AUTH -- "reads/writes" --> DB
    AUTH -- "persisted sessions in" --> LSS
    classDef added fill:#1f883d,stroke:#0b5d23,color:#ffffff;
    classDef modified fill:#bf8700,stroke:#7d4e00,color:#ffffff;
    classDef deleted fill:#cf222e,stroke:#82071e,color:#ffffff,stroke-dasharray:5 3;
    class RL added;
    class AUTH modified;
    class LSS deleted;
    linkStyle 1 stroke:#0b5d23,stroke-width:2px;
    linkStyle 3 stroke:#82071e,stroke-width:2px,stroke-dasharray:5 3;

Loading

Colors indicate component changes compared to main: 🟩 Added · 🟨 Modified · 🟥 Removed

🟨 AuthService — 3 files · 6 methods changed

🟨 src/auth/handler.py · 3 methods

• 🟩 validate_token _added
• 🟨 login _modified
• 🟥 legacy_login _removed

🟨 src/auth/session.py · 1 method

• 🟨 refresh _modified

🟩 src/auth/middleware.py · 2 methods

• 🟩 require_auth _added
• 🟩 inject_claims _added

🟩 RateLimiter — 2 files · 3 methods added

🟩 src/ratelimit/bucket.py · 2 methods

• 🟩 acquire _added
• 🟩 refill _added

🟩 src/ratelimit/config.py · 1 method

• 🟩 load_limits _added

🟥 LegacySessionStore — 2 files · 4 methods removed

🟥 src/auth/legacy/store.py · 3 methods

• 🟥 get_session _removed
• 🟥 put_session _removed
• 🟥 evict_expired _removed

🟥 src/auth/legacy/migrations.py · 1 method

• 🟥 migrate_v1_sessions _removed

---

See this architecture in your editor: Open in VS Code →

_{codeboarding-action · run 0000000002 · mockup — Variant B: component → files → methods}

[brovatten]

_{Variant C — compact table · mockup (diagram + CTA omitted — same as A/B)}

Architecture review · 3 components changed

	Component	Files	Methods	Changed files
🟨	AuthService	3	+3 ~2 −1	handler.py · session.py · middleware.py
🟩	RateLimiter	2	+3	bucket.py · config.py
🟥	LegacySessionStore	2	−4	store.py · migrations.py

_{Methods: + added · ~ modified · − removed. Basenames shown; full paths in the Files tab.}

_{codeboarding-action · run 0000000003 · mockup}

[brovatten]

_{Variant D — diff manifest · mockup (diagram + CTA omitted — same as A/B)}

Architecture review · 3 components changed

File & method manifest — 7 files · 13 methods (+6 ~2 −5)

@@ AuthService — modified @@
  src/auth/handler.py
+     validate_token
      login            (modified)
-     legacy_login
  src/auth/session.py
      refresh          (modified)
+ src/auth/middleware.py   (new file)
+     require_auth
+     inject_claims
@@ RateLimiter — added @@
+ src/ratelimit/bucket.py
+     acquire
+     refill
+ src/ratelimit/config.py
+     load_limits
@@ LegacySessionStore — removed @@
- src/auth/legacy/store.py
-     get_session
-     put_session
-     evict_expired
- src/auth/legacy/migrations.py
-     migrate_v1_sessions

_{codeboarding-action · run 0000000004 · mockup}

[brovatten]

_{Variant E — file tree · mockup (diagram + CTA omitted, same as A/B)}

Architecture review · 3 components changed

Changed files — 7 files, grouped by directory

src/
├── auth/
│   ├── handler.py        🟨 AuthService        ~login  +validate_token  -legacy_login
│   ├── session.py        🟨 AuthService        ~refresh
│   ├── middleware.py     🟨 AuthService        +require_auth  +inject_claims
│   └── legacy/
│       ├── store.py      🟥 LegacySessionStore -get_session  -put_session  -evict_expired
│       └── migrations.py 🟥 LegacySessionStore -migrate_v1_sessions
└── ratelimit/
    ├── bucket.py         🟩 RateLimiter        +acquire  +refill
    └── config.py         🟩 RateLimiter        +load_limits

_{codeboarding-action · run 0000000005 · mockup}

[brovatten]

_{Variant F — review flightplan · mockup (diagram + CTA omitted — same as A/B)}

Architecture review · 3 components changed

Suggested review path

Ordered by blast radius — start at the top, tick items off as you go.

1. 🟥 LegacySessionStore deleted — get_session, put_session, evict_expired, migrate_v1_sessions are gone. Confirm no callers remain.
2. 🟨 AuthService — legacy_login removed and login modified in src/auth/handler.py; this is the PR's behavior change.
3. 🟨 AuthService — new src/auth/middleware.py adds require_auth + inject_claims; check they're wired into the request path (refresh also modified).
4. 🟩 RateLimiter — all-new component (acquire, refill, load_limits). Skim last.

_{In the real comment each file deep-links to its diff in the Files tab, and ticks are re-applied when the comment refreshes on a new push.}

_{codeboarding-action · run 0000000006 · mockup}

[brovatten]

_{Variant G — three reviewer questions · mockup (diagram + CTA omitted — same as A/B)}

Architecture review · 3 components changed

Important

Could anything break? 5 methods removed — 🟥 LegacySessionStore deleted whole (store.py, migrations.py) and 🟨 AuthService.legacy_login dropped. Verify no callers remain.

What behavior changed? · 2 methods, both in 🟨 AuthService

• login — src/auth/handler.py
• refresh — src/auth/session.py

What's new? · 6 methods across 🟩 RateLimiter and 🟨 AuthService

• 🟩 RateLimiter (new component): acquire, refill (bucket.py) · load_limits (config.py)
• 🟨 AuthService: validate_token (handler.py) · require_auth, inject_claims (middleware.py, new file)

_{codeboarding-action · run 0000000007 · mockup}

[brovatten]

_{Variant H — matrix table with in-cell dropdowns · mockup (diagram + CTA omitted — same as A/B)}

Architecture review · 3 components changed

Component	Files	+	~	−	Methods
🟨 AuthService	3	3	2	1	6 changed handler.py: +validate_token, ~login, −legacy_login session.py: ~refresh middleware.py (new): +require_auth, +inject_claims
🟩 RateLimiter	2	3	·	·	3 added bucket.py: +acquire, +refill config.py: +load_limits
🟥 LegacySessionStore	2	·	·	4	4 removed store.py: −get_session, −put_session, −evict_expired migrations.py: −migrate_v1_sessions

_{Method columns: + added · ~ modified · − removed. "·" = none.}

_{codeboarding-action · run 0000000008 · mockup}

[brovatten]

_{Variant I — release notes · mockup (diagram + CTA omitted — same as A/B)}

Architecture review · 3 components changed

Added · RateLimiter — two new files: bucket.py (acquire, refill) and config.py (load_limits).

Changed · AuthService — gains validate_token and an auth middleware (require_auth, inject_claims); login and refresh reworked; legacy_login retired.

Removed · LegacySessionStore — store.py and migrations.py deleted, taking get_session, put_session, evict_expired, and migrate_v1_sessions with them.

_{3 components · 7 files · 13 methods}

_{codeboarding-action · run 0000000009 · mockup}

[brovatten]

_{Variant J — the dek · mockup (CTA omitted; the dek sits above the diagram)}

Architecture review · 3 components changed

RateLimiter arrives, LegacySessionStore departs, and AuthService is rebuilt around token validation.

_{‹mermaid diagram renders here — same as Variants A/B›}

Changelog · 7 files · 13 methods

🟨 AuthService — new validate_token plus a middleware file (require_auth, inject_claims); login and refresh modified; legacy_login removed.
_{src/auth/handler.py · src/auth/session.py · src/auth/middleware.py (new)}

🟩 RateLimiter — acquire and refill in bucket.py; load_limits in config.py.
_{src/ratelimit/bucket.py · src/ratelimit/config.py}

🟥 LegacySessionStore — removed entirely: get_session, put_session, evict_expired, migrate_v1_sessions.
_{src/auth/legacy/store.py · src/auth/legacy/migrations.py}

_{codeboarding-action · run 0000000010 · mockup}

[brovatten]

_{Variant K — the ledger · mockup (diagram + CTA omitted — same as A/B)}

Architecture review · 3 components changed

🟨 AuthService · handler.py _{+validate_token ±login −legacy_login} · session.py _±refresh · middleware.py† _{+require_auth +inject_claims}
🟩 RateLimiter · bucket.py _{+acquire +refill} · config.py _{+load_limits}
🟥 LegacySessionStore · store.py _{−get_session −put_session −evict_expired} · migrations.py _{−migrate_v1_sessions}

_{+ added · ± modified · − removed · † new file — 7 files · 13 methods}

_{codeboarding-action · run 0000000011 · mockup}

[brovatten]

_{Variant L — footnoted narrative · mockup (diagram + CTA omitted — same as A/B; GitHub hoists footnotes to the very bottom)}

Architecture review · 3 components changed

This PR introduces RateLimiter¹, retires LegacySessionStore², and reworks AuthService³ — new token validation and auth middleware, with the legacy login path removed. Seven files, thirteen methods.

_{codeboarding-action · run 0000000012 · mockup}

Footnotes

1. src/ratelimit/bucket.py — acquire 🟩, refill 🟩 · src/ratelimit/config.py — load_limits 🟩 ↩

2. src/auth/legacy/store.py — get_session, put_session, evict_expired 🟥 · src/auth/legacy/migrations.py — migrate_v1_sessions 🟥 ↩

3. src/auth/handler.py — validate_token 🟩, login 🟨, legacy_login 🟥 · src/auth/session.py — refresh 🟨 · src/auth/middleware.py (new) — require_auth 🟩, inject_claims 🟩 ↩

[brovatten]

_{Variant M — one-liner · mockup (diagram + CTA omitted — same as A/B)}

Architecture review · 3 components changed

Changed: 🟨 AuthService (3 files) · 🟩 RateLimiter (2) · 🟥 LegacySessionStore (2)

_{codeboarding-action · run 0000000013 · mockup}

[brovatten]

_{Variant N — flat bullets · mockup (diagram + CTA omitted — same as A/B)}

Architecture review · 3 components changed

• 🟨 AuthService — handler.py · session.py · middleware.py
• 🟩 RateLimiter — bucket.py · config.py
• 🟥 LegacySessionStore — store.py · migrations.py

_{codeboarding-action · run 0000000014 · mockup}

[brovatten]

_{Variant O — single manifest dropdown · mockup (diagram + CTA omitted — same as A/B)}

Architecture review · 3 components changed

Changed files — 7 across 3 components

• 🟨 AuthService
  • src/auth/handler.py
  • src/auth/session.py
  • src/auth/middleware.py
• 🟩 RateLimiter
  • src/ratelimit/bucket.py
  • src/ratelimit/config.py
• 🟥 LegacySessionStore
  • src/auth/legacy/store.py
  • src/auth/legacy/migrations.py

_{codeboarding-action · run 0000000015 · mockup}

[brovatten]

_{Variant P — plain text block · mockup (diagram + CTA omitted — same as A/B)}

Architecture review · 3 components changed

AuthService          modified    handler.py  session.py  middleware.py
RateLimiter          added       bucket.py  config.py
LegacySessionStore   removed     store.py  migrations.py

_{codeboarding-action · run 0000000016 · mockup}

[brovatten]

Architecture review · 3 components changed

🔍 Open interactive graph in VS Code →

Component state vs main: 🟩 Added · 🟨 Modified · 🟥 Removed

graph LR
    API["API Gateway"]
    AUTH["AuthService"]
    RL["RateLimiter"]
    LSS["LegacySessionStore"]
    DB["UserStore"]
    API -- "authenticates via" --> AUTH
    API -- "throttled by" --> RL
    AUTH -- "reads/writes" --> DB
    AUTH -- "persisted sessions in" --> LSS
    classDef added fill:#1f883d,stroke:#0b5d23,color:#ffffff;
    classDef modified fill:#bf8700,stroke:#7d4e00,color:#ffffff;
    classDef deleted fill:#cf222e,stroke:#82071e,color:#ffffff,stroke-dasharray:5 3;
    class RL added;
    class AUTH modified;
    class LSS deleted;
    linkStyle 1 stroke:#0b5d23,stroke-width:2px;
    linkStyle 3 stroke:#82071e,stroke-width:2px,stroke-dasharray:5 3;

Loading