krz/hutch

 1# Out of Scope Features
 2
 3- Universal links (requires Sourcehut to host an apple-app-site-association
 4  file)
 5- Push notifications for builds and tickets (requires a backend relay server)
 6  - ref: https://git.sr.ht/~ccleberg/hutch-notify
 7- Explore / search (hub.sr.ht) (no public discovery API)
 8- Pronouns on profile (not in GraphQL schema)
 9- Revoke personal access tokens (`@internal` in schema, inaccessible)
10- Archive a message to a list (`archiveMessage` is `@internal`, inaccessible)
11- Ticket activity feed (todo.sr.ht's root `events` query is broken upstream and
12  returns an empty list for every user). `event.participant_id` references
13  `participant(id)`, but the resolver joins it against `participant.user_id`:
14
15  ```sql
16  FROM event ev
17  JOIN participant p ON p.user_id = ev.participant_id   -- id space vs user id space
18  WHERE p.user_id = <viewer>
19  ```
20
21  The rows exist — the writer inserts `participant.ID` for the submitter and for
22  every subscriber — but that join cannot find them. `Ticket.events` is
23  unaffected because it filters on `ev.ticket_id`, which is why ticket timelines
24  work. Nothing a client can do fixes this; revisit only if sr.ht changes the
25  resolver.
26- Subscribe to a mailing list (`mailingListSubscribe` exists, but `MailingList`
27  has no `subscription` field and sr.ht has no discovery API, so there is no way
28  to find a list you are not already subscribed to — see hub.sr.ht above)
29- Submitting patches (a `git send-email` flow, not a GraphQL mutation; Hutch
30  reviews patchsets but cannot send them)
31
32## Declined rather than blocked
33
34These are reachable in the API. They are left out on judgement, not capability.
35
36- **Webhook management** (24 fields across five services). A webhook needs an
37  HTTPS endpoint you control to receive POSTs. Without the relay above, this
38  only serves someone already running their own endpoint, and that person is not
39  managing it from a phone. Reconsider if `hutch-notify` ever ships.
40- **`shareSecret`.** Shares a build secret — an SSH key or PAT — with another
41  user. A mistap grants someone else a credential, and nothing in the app can
42  take it back. That belongs on the web behind a full-size confirmation. The
43  read-only `secrets` list would be fine on its own.
44- **Build groups** (`createGroup`, `startGroup`). Multi-job pipelines are
45  authored in `.build.yml`, not composed on a phone.