feat(auth): pending-approval page + role-gated routes - #13
Merged
Conversation
Standalone page rendered through AuthShell. Tells the user their access is queued for admin review, offers a "Check approval status" button that re-pulls their roles, and a sign-out fallback. Routes them straight to "/" the moment a role lands so a freshly-approved user doesn't get stuck on this screen. Strings in en, pt-BR, es, fr. The page is not yet wired to anything — the route gate that redirects pending users here lands in the next commit. Co-Authored-By: Claude Opus 4.7 (1M context) <[email protected]>
Pending users used to land on /chat with a session, then hit a 403 the moment they tried to send a message. Add a requireAppRole prop to ProtectedRoute (default true) that, when the user has no roles for this app and isn't a platform admin, redirects to /pending-approval. Opted out for /profile and /settings so pending users can still update their display name / locale; /admin/prompts continues to use requirePlatformAdmin which already bypasses the role check. Co-Authored-By: Claude Opus 4.7 (1M context) <[email protected]>
Two small wins for the approval flow: - signup() now calls refreshMyRoles() after queuing the access request. When the app has auto_approve on, the role is granted server-side during the request — fetching it back in here means the user goes straight into the app instead of bouncing through /pending-approval. - bootstrapAuth() installs a one-time focus listener that re-pulls the user's roles whenever they tab back into the app. So when an admin approves a pending user, they see the change the next time they look at the tab — no hard reload required. Co-Authored-By: Claude Opus 4.7 (1M context) <[email protected]>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
Closes the broken-chat experience for pending users. Today, after signup a user gets a session, lands on `/chat`, and only discovers they have no access when they try to send a message and the backend 403s. This PR adds:
Test plan
Dependent PRs
🤖 Generated with Claude Code