chore: gussy the consent page a bit#2854
Conversation
|
|
The latest updates on your projects. Learn more about Vercel for GitHub.
|
![claude[bot]](https://avatars.githubusercontent.com/in/1236702?s=60&v=4){kind=small}
There was a problem hiding this comment.
Claude Code Review
This repository is configured for manual code reviews. Comment @claude review to trigger a review and subscribe this PR to future pushes, or @claude review once for a one-time review.
Tip: disable this comment in your organization's Code Review settings.
![chatgpt-codex-connector[bot]](https://avatars.githubusercontent.com/in/1144995?s=60&v=4){kind=small}
There was a problem hiding this comment.
💡 Codex Review
Here are some automated review suggestions for this pull request.
Reviewed commit: 9d3f5bc289
ℹ️ About Codex in GitHub
Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you
- Open a pull request for review
- Mark a draft as ready
- Comment "@codex review".
If Codex has suggestions, it will comment; otherwise it will react with 👍.
Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".
| name="action" | ||
| value="approve" | ||
| class="btn btn-primary" | ||
| {{if not .ConsentEnabled}}disabled{{end}} |
There was a problem hiding this comment.
Disabling the Give Access button in the template is only a client-side control; a user can still submit action=approve directly (e.g., via devtools or curl) while no required remote session is connected. handleConsentPost currently accepts approve without re-checking remote connection state, so this change can be bypassed and grants can still be minted for disconnected sessions. Add a server-side validation in the approve path that mirrors the .ConsentEnabled rule before issuing the grant.
Useful? React with 👍 / 👎.
🚀 Preview Environment (PR #2854)Preview URL: https://pr-2854.dev.getgram.ai
Gram Preview Bot |
alx-xo
left a comment
alx-xo
left a comment
There was a problem hiding this comment.
damn, bootstrap classes. that takes me back 😆
qstearns
force-pushed
the
gussy-login-challenge-more-QJVj
branch
from
92029f3 to
f9e0690
Compare
3 participants
this gussies the consent page a little further (namely by showing the users name instead of ID and setting more sensible rules for when to enable the continue button)