refactor: move GitHub GraphQL API logic to server

[kubrickcode]

Changed architecture from Extension directly calling GitHub GraphQL API to routing through server for better separation of concerns

• Add /api/issues/status and /api/issues/status/update endpoints to server
• Simplify Extension's github-api.service.ts
• Move GraphQL query building/parsing logic to Go server
• Improve security by removing direct GitHub token exposure in Extension

fix #81

[vercel]

The latest updates on your projects. Learn more about Vercel for GitHub.

Project	Deployment	Preview	Comments	Updated (UTC)
github-project-status-viewer	Ready	Preview	Comment	Dec 2, 2025 2:49am
github-project-status-viewer-p4ii	Ready	Preview	Comment	Dec 2, 2025 2:49am

[kubrickcode]

/gemini review

[gemini-code-assist]

Summary of Changes

Hello @kubrickcode, I'm Gemini Code Assist¹! I'm currently reviewing this pull request and will post my feedback shortly. In the meantime, here's a summary to help you and other reviewers quickly get up to speed!

This pull request introduces a significant architectural change by implementing a Go server to act as an intermediary for all GitHub GraphQL API requests originating from the browser extension. This strategic move aims to centralize the complex logic of GraphQL query construction and response parsing, thereby streamlining the extension's codebase. Furthermore, it bolsters the application's security posture by preventing the direct exposure of GitHub access tokens within the client-side environment, ensuring that sensitive credentials are handled exclusively on the server.

Highlights

• Architectural Shift: The application architecture has been refactored to route GitHub GraphQL API calls through a new Go server instead of directly from the extension. This centralizes API interaction logic and improves security.
• New Server Endpoints: Two new API endpoints, /api/issues/status and /api/issues/status/update, have been added to the Go server to handle fetching and updating GitHub project issue statuses.
• Extension Simplification: The client-side extension's github-api.service.ts has been significantly simplified by removing direct GraphQL query building, parsing logic, and token verification, delegating these responsibilities to the Go server.
• Enhanced Security: Direct exposure of GitHub tokens within the extension has been eliminated, as all sensitive API interactions are now proxied and managed by the secure Go server.
• Dependency Updates: Several development dependencies, including @eslint and @typescript-eslint packages, have been updated in extension/pnpm-lock.yaml.

Using Gemini Code Assist

The full guide for Gemini Code Assist can be found on our documentation page, here are some quick tips.

Invoking Gemini

You can request assistance from Gemini at any point by creating a comment using either /gemini <command> or @gemini-code-assist <command>. Below is a summary of the supported commands on the current page.

Feature	Command	Description
Code Review	/gemini review	Performs a code review for the current pull request in its current state.
Pull Request Summary	/gemini summary	Provides a summary of the current pull request in its current state.
Comment	@gemini-code-assist	Responds in comments when explicitly tagged, both in pull request comments and review comments.
Help	/gemini help	Displays a list of available commands.

Customization

To customize Gemini Code Assist for GitHub experience, repository maintainers can create a configuration file and/or provide a custom code review style guide (such as PEP-8 for Python) by creating and adding files to a .gemini/ folder in the base of the repository. Detailed instructions can be found here.

Limitations & Feedback

Gemini Code Assist may make mistakes. Please leave feedback on any instances where its feedback is incorrect or counter productive. You can react with 👍 and 👎 on @gemini-code-assist comments. If you're interested in giving your feedback about your experience with Gemini Code Assist for Github and other Google products, sign up here.

You can also get AI-powered code generation, chat, as well as code reviews directly in the IDE at no cost with the Gemini Code Assist IDE Extension.

Footnotes

1. Review the Privacy Notices, Generative AI Prohibited Use Policy, Terms of Service, and learn how to configure Gemini Code Assist in GitHub here. Gemini can make mistakes, so double check it and use code with caution. ↩

[gemini-code-assist]

Code Review

This pull request introduces a significant architectural improvement by routing GitHub API calls through a backend server instead of having the extension call GitHub directly. This enhances security by isolating the GitHub token on the server and centralizes the GraphQL logic in the Go backend, simplifying the extension's codebase. The changes are well-structured, and the addition of new server endpoints and corresponding tests is thorough. My review focuses on a few areas to further improve the code quality, including reducing code duplication in the TypeScript service, increasing the robustness of authentication handling in the Go backend, adhering to the style guide by replacing magic strings with constants, and improving the clarity and correctness of some of the new tests.

[gemini-code-assist]

Code Review

This pull request successfully refactors the architecture to route GitHub API calls through a server, which is a significant improvement for security and separation of concerns. The extension's code is now simpler, and the new server-side Go code is well-structured with good test coverage. I have identified a few areas for improvement, primarily concerning code duplication in the TypeScript service and opportunities to enhance the effectiveness of tests in the Go handlers. Additionally, I've noted a minor style guide violation regarding function ordering in the Go GitHub client. Overall, this is a solid contribution.

[kubrickcode]

/gemini review

[gemini-code-assist]

Code Review

This pull request is a significant and well-executed refactoring that moves the GitHub GraphQL API logic from the browser extension to a new Go server. This change greatly improves the architecture by enhancing security and creating a better separation of concerns. The new Go endpoints and client are well-structured and include a good set of tests. The TypeScript code in the extension has been simplified effectively, with the new withAuth helper centralizing authentication logic. I've included a few suggestions to further align the code with the repository's style guide and to improve the effectiveness of some of the new tests.