[sulimanbenhalim]

someone in timeout can still post by opening public GitHub issues here with /bug and /feature
every other way of posting goes through PreventPostingInTimeout but issue.store only had throttle:10,1

• adds PreventPostingInTimeout to issue.store
• the issue draft now shows the timeout dialog on that 403 like replies do instead of the "GitHub did not confirm the issue" toast
• adds open issues to the timeout list in KNOWLEDGE_BASE.md
• new test in UserTimeoutControllerTest next to the remotes and orgs ones

Summary by CodeRabbit

• Bug Fixes
  • Users with an active timeout can no longer open issues.
  • Timeout-related errors during issue submission now display the timeout notice instead of a generic or rate-limit error.

[coderabbitai]

No actionable comments were generated in the recent review.

Recent review info

Run configuration

• Source mode: Auto
• Repository: Unavailable
• Branch: Unavailable
• File: No configuration file from this repository applied
• Commit: Unavailable
• Layers: defaults
• Review profile: CHILL
• Plan: Advanced
• Run ID: 930f6890-c897-44e9-9e83-25dc09b3936a

Commits

Reviewing files that changed from the base of the PR and between dcf4a6a and a277384.

Files selected for processing: 4

• KNOWLEDGE_BASE.md
• resources/js/components/issue-command.tsx
• routes/web.php
• tests/Feature/Controllers/UserTimeoutControllerTest.php

Included review availability: This review used your included allowance. Your plan provides up to 10 included reviews per hour; 9 remain after this review.

Walkthrough

The issue-submission route now blocks users with active timeouts. When the client receives a timeout response, it displays the timeout details. A feature test checks the forbidden response and its reason.

Changes: Issue creation timeout enforcement

Layer / File(s)	Summary
Enforce and report issue timeouts routes/web.php, resources/js/components/issue-command.tsx, tests/Feature/Controllers/UserTimeoutControllerTest.php, KNOWLEDGE_BASE.md	The issue route adds PreventPostingInTimeout while retaining its throttle. The client shows timeout details for timeout responses and preserves existing rate-limit and generic error toasts otherwise. A feature test checks the forbidden response and timeout reason. The knowledge base lists opening issues as a restricted action.

Priority: Normal

Estimated code review effort: 2 (Simple) | ~10 minutes

Change: Bug fix

Possibly related issues

• Users in timeout can still start orgs through the API #972: This issue identifies API org creation as another timeout bypass. Both changes address timeout coverage on posting paths.

Possibly related PRs

• dev-null-sh/dev-null.sh#653: Adds issue creation through the API and shares issue throttling with the web route, which this change protects with timeout middleware.
• dev-null-sh/dev-null.sh#501: Changes CreateIssue and useIssueCommand, the same issue-submission path whose timeout handling this change updates.
• dev-null-sh/dev-null.sh#359: Introduces the /bug and /feature flow through useIssueCommand, where this change handles timeout responses.

Suggested reviewers: nunomaduro, simonhamp

Merge Risk: Minimal · up to a2773

The timeout restriction and corresponding user-facing feedback are implemented consistently, with no merge-blocking risk identified.

Security architecture risk: Low · up to a2773

This closes an issue-posting bypass for timed-out accounts without granting additional privileges. No introduced security concern was established, but end-to-end failure and retry behavior remains partly unverified.

Retained concerns
No architecture-level concerns identified.

Security review details

Security Blast Radius

• inferred — The affected attack path is an authenticated, timed-out account submitting issue content through the application’s existing GitHub creation capability. The PR narrows access to that capability; it does not add a new destination, credential, or privilege.

Trust Boundaries and Controls

• observed — The timeout decision and returned details derive from request authentication, not a submitted account identifier. Dialog dismissal clears presentation state only and cannot change the server-side posting restriction.

Resilience and Maintainability Implications

• inferred — A timeout refusal occurs before external creation and therefore needs no compensating deletion or success-limit rollback. Ambiguous upstream outcomes and duplicate creation on retry remain possible in the unchanged issue flow, which has no visible idempotency identity; the exact base comparison confirms this is not introduced or worsened by the timeout branch.

Pre-merge checks: 5

Check name	Status	Explanation
Description Check		Check skipped - CodeRabbit’s high-level summary is enabled.
Title check		The title clearly and concisely describes the main change: preventing users in timeout from opening issues.
Docstring Coverage		Docstring coverage is 100.00% which is sufficient. The required threshold is 80.00%. Docstring coverage is scoped to functions touched by this diff. Analyzed 1 functions across 3 files. (1 skipped: 1 …
Linked Issues check		Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check		Check skipped because no linked issues were found for this pull request.

Full details: Docstring Coverage

Explanation

Docstring coverage is 100.00% which is sufficient. The required threshold is 80.00%. Docstring coverage is scoped to functions touched by this diff. Analyzed 1 functions across 3 files. (1 skipped: 1 unsupported.)

Finishing Touches

🧪 Generate unit tests (beta)

• Create a new PR

• Autofix · Keep fixing CodeRabbit findings and required CI, and resolving merge conflicts

_{Comment @coderabbitai help to get the list of available commands.}