jjkiers/azure-devops-pr-dashboard
Watch
1
0
Fork
You've already forked azure-devops-pr-dashboard
 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions
Dashboard to show all PRs across all repo's for an Azure Devops account
11 commits 1 branch 0 tags 159 KiB
  • JavaScript 66.6%
  • CSS 22.3%
  • HTML 11.1%
Find a file
Exact
Repository files (latest commit first)
Filename Latest commit message Latest commit date
Jacob Kiers 6423e1e2f0 Add some more security controls 
The node proxy now rejects all URLs except for those towards Azure
DevOps.

Reset button in the dashboard settings to clear the PAT and settings.
2026-06-24 10:26:02 +02:00
.gitignore Initialize Azure DevOps PR dashboard app 2026-06-23 17:32:18 +02:00
AGENTS.md Initialize Azure DevOps PR dashboard app 2026-06-23 17:32:18 +02:00
dashboard.js Add some more security controls 2026-06-24 10:26:02 +02:00
package-lock.json Initialize Azure DevOps PR dashboard app 2026-06-23 17:32:18 +02:00
package.json Initialize Azure DevOps PR dashboard app 2026-06-23 17:32:18 +02:00
prs.html Add some more security controls 2026-06-24 10:26:02 +02:00
README.md Add some more security controls 2026-06-24 10:26:02 +02:00
server.js Add some more security controls 2026-06-24 10:26:02 +02:00
styles.css Load settings options dynamically from ADO 2026-06-23 17:49:56 +02:00

README.md

Azure DevOps PR Dashboard

A self-hosted, lightweight dashboard that aggregates pull requests across all repositories in an Azure DevOps project. This tool solves a common pain point: Azure DevOps does not provide a built-in, unified view to monitor and manage all active PRs across multiple repositories in a single workspace.

Key Features

  • Unified Cross-Repo View: See every pull request across all repositories within your project in one central list.
  • Smart Categorization:
    • Requires My Attention: Active PRs where you are a required reviewer or have pending requests.
    • Assigned to Me: PRs assigned to your user account.
    • Assigned to My Teams: PRs assigned to specific team groups (configurable).
    • My PRs: Pull requests authored by you.
  • Quick Filters & Search: Dynamically filter PRs by title or ID on-the-fly.
  • Tabbed Views: Switch easily between custom dashboard categories or view standard categorizations ("Mine", "Active", "Completed").
  • Secure Cache & Proxied Avatars: An on-device Node.js proxy server caches user avatars locally and protects your Personal Access Token (PAT) by forwarding API calls securely.

Getting Started

Prerequisites

  • Node.js (v16 or higher recommended)
  • An Azure DevOps Personal Access Token (PAT) with minimal read-only scopes required by this app (Git/Code read, Project/Team read, and Graph read if reviewer-group auto-selection is enabled).

Installation

  1. Clone or download this repository.
  2. Install the lightweight proxy dependencies: 
    npm install

Running the App

Start the backend proxy and static server:

npm start

The application will run at: http://localhost:4000

Initial Configuration

When opening the dashboard for the first time, you will see a banner prompting you to configure settings:

  1. Click Configure Now (or the settings gear icon in the top right).
  2. Paste your Personal Access Token (PAT).
  3. Enter your Azure DevOps Organization.
  4. Select your Azure DevOps Project from the loaded list.
  5. (Optional) Review and adjust auto-selected reviewer groups in My Teams.
  6. Click Save & Refresh.

Security Checklist

This project can only enforce controls in the app and proxy. PAT governance itself is an Azure DevOps admin concern.

App/Proxy controls implemented

  • Proxy only allows Azure DevOps API hosts (dev.azure.com and vssps.dev.azure.com) and only /_apis/ paths.
  • Proxy requires x-pat on proxied requests.
  • Settings include a Reset Stored Data action to clear all saved dashboard config values.

Recommended admin-side PAT policies (Azure DevOps)

  • Restrict global PAT creation.
  • Restrict full-scoped PAT creation.
  • Enforce maximum PAT lifespan.
  • Restrict PAT creation (with allowlist exceptions where needed).
  • Keep automatic leaked-PAT revocation enabled.

Technical Architecture

  • Frontend: Plain HTML5, pure CSS (highly responsive, custom layout similar to native ADO but with cross-repo support), and vanilla JavaScript (dashboard.js). No build step or bloated frameworks required.
  • Backend: Express proxy server (server.js) to bypass local browser CORS policies and safely append the authorization header to Azure DevOps API endpoints. It features an in-memory caching mechanism for user avatars to keep requests minimal and efficient.