[jubianchi]

Summary

Hovering a person's avatar or name on a commit opens their hover card, but an organization's commits had none. They now open one too, with the organization's bio, how many commits it has published, how many follow it, and a Follow button.

Changes

• New GET /mentions/organizations/{organization}/preview (OrganizationPreviewController, throttle:people like the user preview) returning commitsCount, followersCount and isFollowing. Commits count approved ones, like a user's card; followers and isFollowing use the same queries as the organization page.
• UserPreview no longer skips organization authors: it fetches that endpoint and renders an organization card (square avatar, lane ring, "Organization" badge) in the same popover. Every place that hovers a commit's author gets it.
• One sentence in KNOWLEDGE_BASE.md.

Validation

• New OrganizationPreviewControllerTest (counts, follow state for a follower, a member and a guest, pending and deleted commits left out, 404) and a case in AuthorHover.test.tsx.
• pest --no-tia on tests/Feature/Controllers, ArchTest and RateLimitTest: 2901 passed. vp test run --config tests/draft-images.config.ts: 883 passed.
• phpstan, pint --test, rector --dry-run, tsc, vp fmt --check, vp lint: passed.
• Coverage could not be measured locally (no coverage driver); left to CI.

Visual evidence

Latest log as a guest, mouse resting on the Laravel organization's avatar for 1.5 s. Chrome, 1440 px wide, local app with seeded data. Before is production at 9c74e97d, after is this branch at 734b6952.

Before: nothing opens	After, dark	After, light

Device verification

Not applicable: hover cards only open with a mouse on devices that can hover, so nothing changes on touch screens.

Independent review

Reviewed by a separate read-only agent on base 9c74e97d, head 734b6952: CODE: PASS and VISUAL: PASS on the three captures above. Two of its findings were fixed before publishing (the endpoint returned an unused copy of the organization; a redundant null check).

Limitations

• Following from the card refreshes only auth, as on the organization's page, so the Following log shows the organization's commits on the next visit rather than at once.
• Captured as a guest at desktop width only; no capture of the followed state.

Summary by CodeRabbit

• New Features
  • Organization mentions can now display a hover card with follower and approved commit counts, plus a follow control.
  • Added an organization preview endpoint that reports whether the viewer follows the organization.
• Documentation
  • Clarified organization-posting behavior, including visibility and scheduling rules, and noted that posting options remain unavailable until enabled by administrators.

[coderabbitai]

No actionable comments were generated in the recent review.

Walkthrough

The change adds an organization preview endpoint and enables organization hover cards. The cards display organization details, follow controls, commit counts, and follower counts. Documentation also describes organization posting behavior and rollout gating.

Changes: Organization Author Previews

Layer / File(s)	Summary
Preview endpoint and route app/Http/Controllers/OrganizationPreviewController.php, routes/web.php, tests/Feature/Controllers/OrganizationPreviewControllerTest.php	The endpoint returns approved commit and follower counts, plus whether the current user follows the organization. The route applies the people throttle and UUID validation. Feature tests cover response data and unknown organizations.
Organization-aware fetching resources/js/components/user-preview.tsx	The preview cache supports user and organization data. UserPreview selects the organization route for organization authors and enables hover previews for them.
Organization hover card and supporting coverage resources/js/components/user-preview.tsx, tests/Unit/AuthorHover.test.tsx, KNOWLEDGE_BASE.md	The card displays organization details, a follow control, and commit and follower counts. The unit test checks its accessible label. The documentation describes organization posting behavior and rollout gating.

Estimated code review effort: 3 (Moderate) | ~20 minutes

Change: Feature

Sequence Diagram(s)

sequenceDiagram
  participant UserPreview
  participant OrganizationPreviewController
  participant OrganizationPreviewContent
  UserPreview->>OrganizationPreviewController: Request organization preview data
  OrganizationPreviewController-->>UserPreview: Return commit count, follower count, and follow state
  UserPreview->>OrganizationPreviewContent: Render organization details and preview data

Loading

Possibly related issues

• dev-null-sh/dev-null.sh#938 — The changes display organization profiles, follower counts, and a Follow action in organization previews.

Possibly related PRs

• dev-null-sh/dev-null.sh#1361 — Adds organization-authored commits, which this change supports with organization author previews.
• dev-null-sh/dev-null.sh#1305 — Adds organization follow behavior used by the preview follow control and follow-state response.
• dev-null-sh/dev-null.sh#1359 — Adds organization-authored commit display and routes used by organization preview selection.

Suggested reviewers: mnapoli, xheaven, nunomaduro

Merge Risk: Minimal · up to 734b6

Organization hover cards add counts and follow controls. No concrete merge-blocking risk was established.

Security architecture risk: Low · up to 734b6

The new endpoint provides bounded summary data using existing visibility, identity, and throttling controls. Follow actions retain server-side authentication. No material security regression was established, although generated client routing and all browser-session transition behavior were not verified end to end.

Retained concerns
No architecture-level concerns identified.

Security review details

Security Blast Radius

• observed — Unauthenticated callers can request summary counts for organizations whose UUIDs they supply. The endpoint shares the existing people throttle: 120 requests per minute, keyed by authenticated user or guest IP. It introduces no write operation or follower-identity enumeration in its response.

Trust Boundaries and Controls

• observed — The client does not choose the acting user's identity. Preview relationship state comes from CurrentUser, and follow mutations remain inside the authenticated route group with a separate follows throttle. Their controllers apply actions to the authenticated user and bound organization.

Resilience and Maintainability Implications

• observed — Server follow creation uses syncWithoutDetaching and deletion uses detach, limiting repeated operations to the requesting user's relationship with one organization. The shared-state hook reads an initial value without storing it, so the card's loading fallback alone does not establish persistent false follow state.

Hardening Proposals

• proposed — Consider explicitly scoping viewer-sensitive preview and shared follow caches to the authenticated identity, or clearing them on identity changes. This is lifecycle hardening, not a verified cross-user disclosure or authorization bypass; normal sign-in already performs a full-page navigation.

Pre-merge checks: 4 · 1

Failed checks: 1 warning

Check name	Status	Explanation	Resolution
Docstring Coverage		Docstring coverage is 20.00% which is insufficient. The required threshold is 80.00%. Docstring coverage is scoped to functions touched by this diff with cyclomatic complexity of at least 2. Documenta…	Write docstrings for the functions missing them to satisfy the coverage threshold.

Passed checks: 4 passed

Check name	Status	Explanation
Description Check		Check skipped - CodeRabbit’s high-level summary is enabled.
Title check		The title clearly and concisely describes the main change: adding organization previews when hovering commit authors.
Linked Issues check		Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check		Check skipped because no linked issues were found for this pull request.

Full details: Docstring Coverage

Explanation

Docstring coverage is 20.00% which is insufficient. The required threshold is 80.00%. Docstring coverage is scoped to functions touched by this diff with cyclomatic complexity of at least 2. Documentation-only edits and deletions within surviving functions are included; unchanged diff context and fully deleted functions are excluded. Analyzed 5 functions across 5 files. (1 skipped: 1 unsupported.)

Resolution

Write docstrings for the functions missing them to satisfy the coverage threshold.

Finishing Touches

Generate unit tests (beta)

• Create a new PR

• Autofix · Keep fixing CodeRabbit findings and required CI, and resolving merge conflicts

Recent review info

Run configuration

• Source mode: Auto
• Repository: Unavailable
• Branch: Unavailable
• File: No configuration file from this repository applied
• Commit: Unavailable
• Layers: defaults
• Review profile: CHILL
• Plan: Advanced
• Run ID: 0c54b456-e2d2-4bc2-897e-8e549da6ab80

Commits

Reviewing files that changed from the base of the PR and between 9c74e97 and 734b695.

Files selected for processing: 6

• KNOWLEDGE_BASE.md
• app/Http/Controllers/OrganizationPreviewController.php
• resources/js/components/user-preview.tsx
• routes/web.php
• tests/Feature/Controllers/OrganizationPreviewControllerTest.php
• tests/Unit/AuthorHover.test.tsx

Included review availability: This review used your included allowance. Your plan provides up to 10 included reviews per hour; 8 remain after this review.

[jubianchi]

Note

This message is generated by an AI agent on behalf of @jubianchi. It may contain errors—verify important details.

Now that UserPreview handles organizations too, ProfilePreview (profile-preview.tsx) would be a better name, matching the profiles table and ProfileType. It isn't renamed here, on purpose:

• The rename touches 16 files (12 components and pages, 4 tests), plus the user-preview data-test values two tests rely on. It would bury this change in the diff.
• The frontend already has a Profile type (resources/js/types/auth.ts), but it means a user with their counts, never an organization, and this file uses it for the user card's data. Inside a ProfilePreview that also previews organizations, "profile" would then mean two different things, so a clean rename should rename that type too (e.g. UserWithCounts).
• Five other open PRs edit user-preview.tsx (#1249, #1126, #732, #699, #690), so moving the file now would force them to rebase.

If it's welcome, I can open a separate refactor: PR for it once this one is settled, whenever suits the PRs above.