Repository navigation
Polish recovery alert guidance and compact account flow - #60
Conversation
|
@codex review |
Codex Review SummaryThis comment shows the latest Codex review activity on this pull request.
ℹ️ About Codex in GitHubYour team has set up Codex to review pull requests in this repo. Reviews are triggered when you
Codex reacts with 👀 while any review is running, comments if it has suggestions, and reacts with 👍 once all reviews finish with no findings. |
![chatgpt-codex-connector[bot]](https://avatars.githubusercontent.com/in/1144995?s=60&v=4){kind=small}
There was a problem hiding this comment.
💡 Codex Review
Here are some automated review suggestions for this pull request.
Reviewed commit: 6491de3011
ℹ️ About Codex in GitHub
Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you
- Open a pull request for review
- Mark a draft as ready
- Comment "@codex review".
If Codex has suggestions, it will comment; otherwise it will react with 👍.
Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".
| setNotice(null); | ||
| const id = userId; | ||
| try { | ||
| const updated = await refresh(); |
There was a problem hiding this comment.
If an unverified user clicks “Check verification status” and /auth/me encounters a network error or HTTP 5xx, this call signs them out locally instead of displaying a retryable verification error. AuthContext.refresh() clears the user and sets the status to anonymous on every failure (src/context/AuthContext.js:148–155), so the /account route's PrivateRoute redirects to login and unmounts this card before its local error can remain visible. Use a refresh mode that preserves authenticated state on non-authentication failures, while still handling an actual expired session.
Useful? React with 👍 / 👎.
There was a problem hiding this comment.
Fixed at 789cab2. The verification action now explicitly opts in to preserving an established session only for network/408/429/5xx errors; authentication failures still clear it. Default bootstrap/refresh semantics remain unchanged. Stale, unmounted and logout-overtaken results cannot update or return old user data. Added real AuthProvider and PrivateRoute regressions for transient failures, successful retry, expired authentication and overlapping login/logout. Final local suite: 69/1160; 67 focused cases; 12 actual browser cases; independent security review passed.
|
@codex review |
|
Codex Review: Didn't find any major issues. Can't wait for the next one! Reviewed commit: ℹ️ About Codex in GitHubYour team has set up Codex to review pull requests in this repo. Reviews are triggered when you
If Codex has suggestions, it will comment; otherwise it will react with 👍. Codex can also answer questions or update the PR. Try commenting "@codex address that feedback". |
|
Codex Review: Didn't find any major issues. Delightful! Reviewed commit: ℹ️ About Codex in GitHubYour team has set up Codex to review pull requests in this repo. Reviews are triggered when you
If Codex has suggestions, it will comment; otherwise it will react with 👍. Codex can also answer questions or update the PR. Try commenting "@codex address that feedback". |
|
Qualification at 789cab2 / tree 7c5429cbf04367c588411e29fb581224e0cdba3e: both push and PR Node 20/22 gates passed. CI confirms 69 suites / 1,160 tests and 21 combined recovery/dashboard browser cases. The actual PR checkout d5fca44 has the same qualified tree. Independent security review covered the exact new refresh-mode diff and passed 67 focused cases; the earlier automated security summary remains tied to 6491de3 and is not being represented as a review of the follow-up. Current-head automated code review is clean. No live wallet signing or on-chain action was used in this UI qualification. |
Summary
Polish recovery alerts within the existing Sysnode account-card design:
Enrollment/signature payloads, enrollment/opt-out service requests, CSRF checks, password/TOTP step-up, and recovery authority are unchanged. The new read-only verification check opts in to retaining an established session on network, 408, 429 and 5xx read failures. Actual authentication failures still clear it; default bootstrap/refresh behavior is unchanged, and stale or logout-overtaken results cannot update or return an old user.
Validation
Exact reviewed head:
789cab251e97202646a49e4b12b95822e42a9e1c(tree7c5429cbf04367c588411e29fb581224e0cdba3e).Browser cases use controlled public fixture data. No live wallet signatures, transactions, emails or recovery changes were performed for this UI patch.
The shared recovery-docs screenshot and explicit Sysnode links are being updated separately after this UI is frozen. Deployment follows review and CI; no Pali release publication is part of this PR.