feat: formatted text, a list view, ticket details, public proposals and votes

Formatted text
- Descriptions, comments, replies and release notes render Markdown,
  sanitised with DOMPurify (tested against scripts, handlers and
  javascript: links). A pasted image is uploaded and written as
  ![name](attachment:<id>); the web fetches it with the reader's session,
  so it works on private projects. Every text box has a preview. The
  attachment upload now answers its attachmentId.

List view
- /p/:key/list: every ticket as rows, sortable by any column, filtered by
  text, open/closed, type, priority and assignee; status, priority and
  assignee change in place; bulk edit (the backlog's bar, now shared).

Ticket details
- Reactions on comments (GitHub's eight), for members and viewers.
- Duplicate a ticket: what it says, not where it stands.
- blockedBy: open tickets it waits for (BLOCKS / DEPENDS_ON), worked out
  when reading with one query per board or page; shown on cards, list
  rows and the ticket.

Public proposals
- A public project can take bug reports and ideas from anyone
  (acceptsProposals): POST /api/explore/projects/{project}/proposals and
  the form at /p/:key/proponer. They become tickets labelled «propuesta»,
  opened by TaskStream; a honeypot field and 5 per address every 15
  minutes keep spam out. No e-mail is asked: it would be public.

Votes
- Anyone signed in votes on a public project's tickets, members on a
  private one (voteIssue, PUT/DELETE /api/issues/{issue}/vote): votes and
  voted on each ticket, buttons on the ticket and the roadmap, a column
  in the list. The showcase carries votes and the open proposals.

MCP: vote_issue, duplicate_issue, react_to_comment; listings show
blockers and votes. Docs, Word and PDF updated; chat notifications
(Discord, Slack, Telegram) noted for later.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

libs/api/tracker/presenters/src/lib/graphql/comment.resolver.ts

@@ -31,6 +31,18 @@ export class CommentResolver {
     return this.comments.edit(me.id, commentId, body);
   }
 
+  @Mutation(() => CommandResultGql, {
+    description: 'React (👍 👎 😄 🎉 😕 ❤️ 🚀 👀) or take it back (on: false)',
+  })
+  reactToComment(
+    @CurrentUser() me: User,
+    @Args('commentId', { type: () => ID }) commentId: string,
+    @Args('emoji') emoji: string,
+    @Args('on') on: boolean,
+  ) {
+    return this.comments.react(me.id, commentId, emoji, on);
+  }
+
   @Mutation(() => CommandResultGql, { description: 'Author or project admin' })
   deleteComment(
     @CurrentUser() me: User,

libs/api/tracker/presenters/src/lib/graphql/inputs.ts

@@ -74,6 +74,14 @@ export class UpdateProjectInput {
   @IsOptional()
   @IsBoolean()
   isPublic?: boolean;
+  @Field({
+    nullable: true,
+    description:
+      'Take bug reports and ideas from anyone through the public form (while public)',
+  })
+  @IsOptional()
+  @IsBoolean()
+  acceptsProposals?: boolean;
 }
 
 @InputType()

libs/api/tracker/presenters/src/lib/graphql/issue.resolver.ts

@@ -14,6 +14,7 @@ import {
   OptionalAuth,
 } from '@task-stream/api/identity/presenters';
 import {
+  BlockersService,
   CommentsService,
   IssuesService,
   WorkflowsService,
@@ -44,6 +45,7 @@ import {
   EpicGql,
   IssueGql,
   IssuePageGql,
+  IssueParentGql,
 } from './types';
 
 @Resolver(() => IssueGql)
@@ -52,6 +54,7 @@ export class IssueResolver {
     private readonly issuesService: IssuesService,
     private readonly commentsService: CommentsService,
     private readonly workflows: WorkflowsService,
+    private readonly blockers: BlockersService,
   ) {}
 
   @OptionalAuth()
@@ -154,6 +157,22 @@ export class IssueResolver {
     return this.workflows.allowedTransitions(issue);
   }
 
+  @ResolveField(() => [IssueParentGql], {
+    description:
+      'Open tickets it waits for: the ones that block it and the ones it depends on',
+  })
+  blockedBy(@Parent() issue: IssueReadModel) {
+    return this.blockers.blockedBy(issue);
+  }
+
+  @ResolveField(() => Boolean, { description: 'Whether I voted for it' })
+  voted(
+    @CurrentUser() me: User | undefined,
+    @Parent() issue: IssueReadModel,
+  ): boolean {
+    return !!me && issue.voterIds.includes(me.id);
+  }
+
   @ResolveField(() => [IssueGql], { description: 'Linked tickets I can see' })
   linkedIssues(
     @CurrentUser() me: User | undefined,
@@ -307,6 +326,29 @@ export class IssueResolver {
     return this.issuesService.trash(me.id, issueId);
   }
 
+  @Mutation(() => CommandResultGql, {
+    description:
+      'A new ticket like this one: what it says, not where it stands (the key comes in the result)',
+  })
+  duplicateIssue(
+    @CurrentUser() me: User,
+    @Args('issueId', { type: () => ID }) issueId: string,
+  ) {
+    return this.issuesService.duplicate(me.id, issueId);
+  }
+
+  @Mutation(() => CommandResultGql, {
+    description:
+      'Vote for a ticket (on) or take the vote back: anyone signed in on a public project, members on a private one',
+  })
+  voteIssue(
+    @CurrentUser() me: User,
+    @Args('issueId', { type: () => ID }) issueId: string,
+    @Args('on') on: boolean,
+  ) {
+    return this.issuesService.vote(me.id, issueId, on);
+  }
+
   @Mutation(() => CommandResultGql, { description: 'Back from the trash' })
   restoreIssue(
     @CurrentUser() me: User,

libs/api/tracker/presenters/src/lib/graphql/types.ts

@@ -102,6 +102,10 @@ export class ProjectGql {
   @Field(() => String, { nullable: true }) description!: string | null;
   @Field({ description: 'Anyone can read it, also without signing in' })
   isPublic!: boolean;
+  @Field({
+    description: 'Takes bug reports and ideas from anyone (while public)',
+  })
+  acceptsProposals!: boolean;
   @Field(() => UserRefGql) owner!: UserRefGql;
   @Field(() => [ProjectMemberGql]) members!: ProjectMemberGql[];
   @Field() createdAt!: string;
@@ -374,6 +378,8 @@ export class IssueGql {
   })
   devLinks!: DevLinkGql[];
   @Field(() => Int) commentCount!: number;
+  @Field(() => Int, { description: 'How many want it done' })
+  votes!: number;
   @Field() createdAt!: string;
   @Field() updatedAt!: string;
   @Field(() => Int) version!: number;
@@ -440,6 +446,13 @@ export class BoardColumnGql {
   @Field(() => Int) total!: number;
 }
 
+@ObjectType('CommentReaction', { description: 'One emoji on a comment' })
+export class CommentReactionGql {
+  @Field() emoji!: string;
+  @Field(() => [UserRefGql], { description: 'Who chose it' })
+  users!: UserRefGql[];
+}
+
 @ObjectType('Comment')
 export class CommentGql {
   @Field(() => ID) id!: string;
@@ -456,6 +469,10 @@ export class CommentGql {
     description: 'Deleted, but kept (without its text) while it has replies',
   })
   deleted!: boolean;
+  @Field(() => [CommentReactionGql], {
+    description: 'In the order they are offered; only the ones somebody chose',
+  })
+  reactions!: CommentReactionGql[];
   @Field() createdAt!: string;
   @Field(() => String, { nullable: true }) editedAt!: string | null;
   @Field(() => Int) version!: number;

libs/api/tracker/presenters/src/lib/http/attachments.controller.ts

@@ -36,7 +36,7 @@ import { IssuesService } from '@task-stream/api/tracker/application';
 import type { Response } from 'express';
 import { viewerOf } from '../common/viewer';
 import { AttachFileDto } from './dto/requests.dto';
-import { CommandResultDto } from './dto/responses.dto';
+import { AttachmentResultDto, CommandResultDto } from './dto/responses.dto';
 import { Refs } from './refs';
 
 const ISSUE = ApiParam({
@@ -80,7 +80,7 @@ export class AttachmentsController {
       'Multipart with the file as `file` and, optionally, `commentId` to place it under a comment. ' +
       'Up to ATTACHMENTS_MAX_MB megabytes (25 by default) and 50 files per ticket.',
   })
-  @ApiCreatedResponse({ type: CommandResultDto })
+  @ApiCreatedResponse({ type: AttachmentResultDto })
   @ApiCommandErrors()
   async attach(
     @CurrentUser() me: User,

libs/api/tracker/presenters/src/lib/http/comments.controller.ts

@@ -1,4 +1,12 @@
-import { Body, Controller, Delete, Param, Patch } from '@nestjs/common';
+import {
+  Body,
+  Controller,
+  Delete,
+  HttpCode,
+  Param,
+  Patch,
+  Post,
+} from '@nestjs/common';
 import { ApiOkResponse, ApiOperation, ApiTags } from '@nestjs/swagger';
 import { User } from '@task-stream/api/identity/domain';
 import {
@@ -7,7 +15,8 @@ import {
 } from '@task-stream/api/identity/presenters';
 import { ApiCommandErrors } from '@task-stream/api/shared/presenters';
 import { CommentsService } from '@task-stream/api/tracker/application';
-import { CommentBodyDto } from './dto/requests.dto';
+import { REACTIONS } from '@task-stream/api/tracker/domain';
+import { CommentBodyDto, ReactToCommentDto } from './dto/requests.dto';
 import { CommandResultDto } from './dto/responses.dto';
 
 /** REST adapter of the comment use cases (listing and adding live under /issues). */
@@ -29,6 +38,22 @@ export class CommentsController {
     return this.comments.edit(me.id, commentId, body.body);
   }
 
+  @Post(':commentId/reactions')
+  @HttpCode(200)
+  @ApiOperation({
+    summary: 'React to a comment, or take the reaction back (members)',
+    description: `One of ${REACTIONS.join(' ')}; repeating it changes nothing.`,
+  })
+  @ApiOkResponse({ type: CommandResultDto })
+  @ApiCommandErrors()
+  react(
+    @CurrentUser() me: User,
+    @Param('commentId') commentId: string,
+    @Body() body: ReactToCommentDto,
+  ) {
+    return this.comments.react(me.id, commentId, body.emoji, body.on);
+  }
+
   @Delete(':commentId')
   @ApiOperation({ summary: 'Delete a comment (author or project admin)' })
   @ApiOkResponse({ type: CommandResultDto })

libs/api/tracker/presenters/src/lib/http/dto/requests.dto.ts

@@ -8,6 +8,7 @@ import {
   IssueLinkType,
   IssuePriority,
   ProjectRole,
+  REACTIONS,
   SETTING_COLORS,
   StatusCategory,
   TYPE_ICONS,
@@ -88,7 +89,15 @@ export class CreateProjectDto {
 
 export class UpdateProjectDto extends PartialType(
   OmitType(CreateProjectDto, ['key'] as const),
-) {}
+) {
+  @ApiPropertyOptional({
+    description:
+      'Take bug reports and ideas from anyone through the public form (while public)',
+  })
+  @IsOptional()
+  @IsBoolean()
+  acceptsProposals?: boolean;
+}
 
 export class DeleteProjectQueryDto {
   @ApiProperty({
@@ -985,6 +994,59 @@ export class AddCommentDto extends CommentBodyDto {
   replyTo?: string;
 }
 
+export class ReactToCommentDto {
+  @ApiProperty({ enum: REACTIONS, example: '👍' })
+  @IsIn(REACTIONS)
+  emoji!: string;
+
+  @ApiProperty({ description: 'true adds the reaction, false takes it back' })
+  @IsBoolean()
+  on!: boolean;
+}
+
+// ---- Public proposals -------------------------------------------------------
+
+export class ProposalDto {
+  @ApiProperty({
+    enum: ['BUG', 'IDEA'],
+    description: 'A bug report or an idea',
+  })
+  @IsIn(['BUG', 'IDEA'])
+  kind!: 'BUG' | 'IDEA';
+
+  @ApiProperty({ minLength: 3, maxLength: 150 })
+  @IsString()
+  @MinLength(3)
+  @MaxLength(150)
+  title!: string;
+
+  @ApiPropertyOptional({
+    maxLength: 5000,
+    description: 'What happens, or what they would like (Markdown)',
+  })
+  @IsOptional()
+  @IsString()
+  @MaxLength(5000)
+  description?: string;
+
+  @ApiPropertyOptional({
+    maxLength: 80,
+    description:
+      'How they sign it; shown in the ticket (no e-mail: it would be public)',
+  })
+  @IsOptional()
+  @IsString()
+  @MaxLength(80)
+  author?: string;
+
+  @ApiPropertyOptional({
+    description: 'Leave empty: a field only bots fill in',
+  })
+  @IsOptional()
+  @IsString()
+  website?: string;
+}
+
 // ---- Releases ---------------------------------------------------------------
 
 export class CreateReleaseDto {

libs/api/tracker/presenters/src/lib/http/dto/responses.dto.ts

@@ -96,6 +96,11 @@ export class ProjectDto {
   @ApiProperty({ type: String, nullable: true }) description!: string | null;
   @ApiProperty({ description: 'Readable by anyone, also without a token' })
   isPublic!: boolean;
+  @ApiProperty({
+    description:
+      'Takes bug reports and ideas from anyone (POST /api/explore/projects/{project}/proposals) while public',
+  })
+  acceptsProposals!: boolean;
   @ApiProperty({ type: UserRefDto }) owner!: UserRefDto;
   @ApiProperty({ type: [ProjectMemberDto] }) members!: ProjectMemberDto[];
   @ApiProperty({ type: ProjectSettingsDto })
@@ -279,6 +284,7 @@ class ShowcaseEpicDto {
   dueDate!: string | null;
   @ApiProperty() percent!: number;
   @ApiProperty() done!: boolean;
+  @ApiProperty({ description: 'How many want it' }) votes!: number;
   @ApiProperty({
     example: '/p/WEB/issues/WEB-3',
     description: 'In the web app',
@@ -308,6 +314,27 @@ class ShowcaseIssueDto {
   @ApiProperty({ example: '/p/WEB/issues/WEB-9' }) path!: string;
 }
 
+class ShowcaseProposalDto extends ShowcaseIssueDto {
+  @ApiProperty({ description: 'How many want it' }) votes!: number;
+}
+
+class ShowcaseProposalsDto {
+  @ApiProperty({ description: 'Whether it takes bug reports and ideas now' })
+  open!: boolean;
+  @ApiProperty({
+    type: String,
+    nullable: true,
+    example: '/p/WEB/proponer',
+    description: 'The form in the web app, while it takes them',
+  })
+  path!: string | null;
+  @ApiProperty({
+    type: [ShowcaseProposalDto],
+    description: 'Open proposals, most voted first',
+  })
+  top!: ShowcaseProposalDto[];
+}
+
 export class ShowcaseDto {
   @ApiProperty({ type: ShowcaseProjectDto }) project!: ShowcaseProjectDto;
   @ApiProperty({ type: ShowcaseSprintDto, nullable: true })
@@ -319,6 +346,25 @@ export class ShowcaseDto {
     description: 'Open tickets labelled good-first-issue',
   })
   goodFirst!: ShowcaseIssueDto[];
+  @ApiProperty({ type: ShowcaseProposalsDto })
+  proposals!: ShowcaseProposalsDto;
+}
+
+export class ProposalResultDto {
+  @ApiProperty({
+    type: String,
+    nullable: true,
+    example: 'WEB-42',
+    description: 'The ticket it became',
+  })
+  key!: string | null;
+  @ApiProperty({
+    type: String,
+    nullable: true,
+    example: '/p/WEB/issues/WEB-42',
+    description: 'Where to see it in the web app',
+  })
+  path!: string | null;
 }
 
 export class GitDeliveryResultDto {
@@ -390,6 +436,13 @@ export class IssueDto {
     description: 'The epic or ticket this one breaks down',
   })
   parent!: IssueParentDto | null;
+  @ApiProperty({
+    type: [IssueParentDto],
+    description:
+      'Open tickets it waits for: the ones that block it and the ones it depends on',
+  })
+  blockedBy!: IssueParentDto[];
+  @ApiProperty({ description: 'How many want it done' }) votes!: number;
   @ApiProperty({
     description:
       'Place in the backlog and its board column (ascending, as text)',
@@ -462,6 +515,11 @@ export class BoardColumnDto {
   total!: number;
 }
 
+export class CommentReactionDto {
+  @ApiProperty({ example: '👍' }) emoji!: string;
+  @ApiProperty({ type: [UserRefDto] }) users!: UserRefDto[];
+}
+
 export class CommentDto {
   @ApiProperty({ format: 'uuid' }) id!: string;
   @ApiProperty({ format: 'uuid' }) issueId!: string;
@@ -481,6 +539,11 @@ export class CommentDto {
     description: 'Deleted, but kept (without its text) while it has replies',
   })
   deleted!: boolean;
+  @ApiProperty({
+    type: [CommentReactionDto],
+    description: 'In the order they are offered; only the ones somebody chose',
+  })
+  reactions!: CommentReactionDto[];
   @ApiProperty({ format: 'date-time' }) createdAt!: string;
   @ApiProperty({ type: String, nullable: true, format: 'date-time' })
   editedAt!: string | null;
@@ -649,6 +712,15 @@ export class CommandResultDto {
   version!: number;
 }
 
+export class AttachmentResultDto extends CommandResultDto {
+  @ApiProperty({
+    format: 'uuid',
+    description:
+      'The new file; `![name](attachment:<id>)` shows an image inside a description or comment',
+  })
+  attachmentId!: string;
+}
+
 // ---- Statistics ---------------------------------------------------------------
 
 export class CreatedResolvedDto {

libs/api/tracker/presenters/src/lib/http/explore.controller.ts

@@ -1,6 +1,17 @@
-import { Controller, Get, Header, Param } from '@nestjs/common';
 import {
+  Body,
+  Controller,
+  Get,
+  Header,
+  Param,
+  Post,
+  Req,
+} from '@nestjs/common';
+import {
+  ApiCreatedResponse,
+  ApiForbiddenResponse,
   ApiNotFoundResponse,
+  ApiTooManyRequestsResponse,
   ApiOkResponse,
   ApiOperation,
   ApiParam,
@@ -8,14 +19,24 @@ import {
 } from '@nestjs/swagger';
 import { Public } from '@task-stream/api/identity/presenters';
 import { ProjectsService } from '@task-stream/api/tracker/application';
-import { ProjectDto, ShowcaseDto } from './dto/responses.dto';
+import { Request } from 'express';
+import { ProposalDto } from './dto/requests.dto';
+import {
+  ProjectDto,
+  ProposalResultDto,
+  ShowcaseDto,
+} from './dto/responses.dto';
+import { ProposalLimiter } from './proposal-limiter';
 import { toProjectDto } from './refs';
 
 /** What anyone can read without signing in. */
 @ApiTags('Explore')
 @Controller('explore')
 export class ExploreController {
-  constructor(private readonly projects: ProjectsService) {}
+  constructor(
+    private readonly projects: ProjectsService,
+    private readonly limiter: ProposalLimiter,
+  ) {}
 
   @Get('projects')
   @Public()
@@ -47,4 +68,51 @@ export class ExploreController {
   showcase(@Param('project') project: string) {
     return this.projects.showcase(project);
   }
+
+  @Post('projects/:project/proposals')
+  @Public()
+  @ApiParam({
+    name: 'project',
+    description: 'Project id or key',
+    example: 'WEB',
+  })
+  @ApiOperation({
+    summary: 'Report a bug or propose an idea (no token needed)',
+    description:
+      'For public projects that take proposals. It becomes a ticket labelled `propuesta`, opened by TaskStream in the first status (Bug or Feature), signed with `author` if given. Five per address every 15 minutes.',
+  })
+  @ApiCreatedResponse({ type: ProposalResultDto })
+  @ApiNotFoundResponse({ description: 'Not a public project' })
+  @ApiForbiddenResponse({ description: 'It does not take proposals' })
+  @ApiTooManyRequestsResponse({ description: 'Too many from this address' })
+  async propose(
+    @Param('project') project: string,
+    @Body() body: ProposalDto,
+    @Req() req: Request,
+  ): Promise<ProposalResultDto> {
+    // Bots fill in every field: pretend it worked, and keep nothing.
+    if (body.website?.trim()) return { key: null, path: null };
+    this.limiter.take(addressOf(req));
+    const result = await this.projects.propose(
+      project,
+      body.kind,
+      body.title,
+      body.description ?? '',
+      body.author ?? null,
+    );
+    const key = result.key ?? null;
+    return {
+      key,
+      path: key ? `/p/${key.split('-')[0]}/issues/${key}` : null,
+    };
+  }
+}
+
+/** Behind a proxy (Traefik, nginx), who asked comes in X-Forwarded-For. */
+function addressOf(req: Request): string {
+  const forwarded = req.headers['x-forwarded-for'];
+  const first = (Array.isArray(forwarded) ? forwarded[0] : forwarded)
+    ?.split(',')[0]
+    ?.trim();
+  return first || req.ip || 'unknown';
 }

libs/api/tracker/presenters/src/lib/http/issues.controller.ts

@@ -338,6 +338,45 @@ export class IssuesController {
     return this.issues.restore(me.id, await this.refs.issueId(me.id, issue));
   }
 
+  @Put('issues/:issue/vote')
+  @ISSUE
+  @ApiOperation({
+    summary: 'Vote for the ticket',
+    description:
+      'Anyone signed in, on a public project (that is the point: the people it is for say what they want); members on a private one. Voting twice changes nothing.',
+  })
+  @ApiOkResponse({ type: CommandResultDto })
+  @ApiCommandErrors()
+  async vote(@CurrentUser() me: User, @Param('issue') issue: string) {
+    return this.issues.vote(me.id, await this.refs.issueId(me.id, issue), true);
+  }
+
+  @Delete('issues/:issue/vote')
+  @ISSUE
+  @ApiOperation({ summary: 'Take back my vote for the ticket' })
+  @ApiOkResponse({ type: CommandResultDto })
+  @ApiCommandErrors()
+  async unvote(@CurrentUser() me: User, @Param('issue') issue: string) {
+    return this.issues.vote(
+      me.id,
+      await this.refs.issueId(me.id, issue),
+      false,
+    );
+  }
+
+  @Post('issues/:issue/duplicate')
+  @ISSUE
+  @ApiOperation({
+    summary: 'Duplicate the ticket',
+    description:
+      'Copies what it says (type, title, description, area, priority, labels, Figma, estimate, dates, parent and checklist steps, unticked), not where it stands: the copy starts in the first status, unassigned, out of sprints and releases, without comments or files. The result carries its key.',
+  })
+  @ApiCreatedResponse({ type: CommandResultDto })
+  @ApiCommandErrors()
+  async duplicate(@CurrentUser() me: User, @Param('issue') issue: string) {
+    return this.issues.duplicate(me.id, await this.refs.issueId(me.id, issue));
+  }
+
   @Get('projects/:project/trash')
   @ApiOptionalPireonAuth()
   @PROJECT

libs/api/tracker/presenters/src/lib/http/proposal-limiter.ts

@@ -0,0 +1,33 @@
+import { HttpException, HttpStatus, Injectable } from '@nestjs/common';
+
+/** Proposals from one address within the window. */
+const LIMIT = 5;
+const WINDOW_MS = 15 * 60_000;
+
+/**
+ * Keeps one address from flooding a project with proposals. In memory:
+ * enough for one instance, and an approximation with several (each counts
+ * its own), which is fine for what it guards against.
+ */
+@Injectable()
+export class ProposalLimiter {
+  private readonly sent = new Map<string, number[]>();
+
+  take(address: string): void {
+    const now = Date.now();
+    const recent = (this.sent.get(address) ?? []).filter(
+      (at) => now - at < WINDOW_MS,
+    );
+    if (recent.length >= LIMIT)
+      throw new HttpException(
+        'Too many proposals from here; try again in a few minutes',
+        HttpStatus.TOO_MANY_REQUESTS,
+      );
+    recent.push(now);
+    this.sent.set(address, recent);
+    // Forget quiet addresses now and then, so the map does not grow forever.
+    if (this.sent.size > 10_000)
+      for (const [key, times] of this.sent)
+        if (times.every((at) => now - at >= WINDOW_MS)) this.sent.delete(key);
+  }
+}

libs/api/tracker/presenters/src/lib/http/refs.ts

@@ -1,5 +1,6 @@
 import { Injectable } from '@nestjs/common';
 import {
+  BlockersService,
   IssuesService,
   ProjectsService,
   WorkflowsService,
@@ -23,6 +24,7 @@ export class Refs {
     private readonly projects: ProjectsService,
     private readonly issues: IssuesService,
     private readonly workflows: WorkflowsService,
+    private readonly blockers: BlockersService,
   ) {}
 
   async projectId(viewerId: string | null, ref: string): Promise<string> {
@@ -35,12 +37,15 @@ export class Refs {
     return (await this.issues.findOne(viewerId, ref)).id;
   }
 
-  /** The ticket as the REST API returns it: read model + allowed transitions. */
+  /** The ticket as the REST API returns it: read model, allowed transitions and what blocks it. */
   async issueDto(issue: IssueReadModel) {
-    return {
-      ...issue,
-      allowedTransitions: await this.workflows.allowedTransitions(issue),
-    };
+    const [allowedTransitions, blockedBy] = await Promise.all([
+      this.workflows.allowedTransitions(issue),
+      this.blockers.blockedBy(issue),
+    ]);
+    // Who voted is only for telling someone whether they did.
+    const { voterIds: _voters, ...shown } = issue;
+    return { ...shown, allowedTransitions, blockedBy };
   }
 
   issueDtos(issues: IssueReadModel[]) {

libs/api/tracker/presenters/src/lib/tracker-presenters.module.ts

@@ -12,6 +12,7 @@ import { AttachmentsController } from './http/attachments.controller';
 import { CommentsController } from './http/comments.controller';
 import { IssuesController } from './http/issues.controller';
 import { ExploreController } from './http/explore.controller';
+import { ProposalLimiter } from './http/proposal-limiter';
 import { ProjectsController } from './http/projects.controller';
 import { Refs } from './http/refs';
 import { ReleasesController } from './http/releases.controller';
@@ -63,6 +64,7 @@ import { AutomationResolver } from './graphql/automation.resolver';
   ],
   providers: [
     Refs,
+    ProposalLimiter,
     ProjectResolver,
     IssueResolver,
     CommentResolver,