Skip to content

Fix/2155#323

Open
conradmugabe wants to merge 2 commits into
mainfrom
fix/2155
Open

Fix/2155#323
conradmugabe wants to merge 2 commits into
mainfrom
fix/2155

Conversation

@conradmugabe

Copy link
Copy Markdown
Contributor

Checklist

  • Tests were added/updated according to the feature/bugfix/change made
  • Version was rolled according to semver requirements
  • API endpoints openapi schema was updated if applicable

Changes

conradmugabe and others added 2 commits July 10, 2026 18:34
A visitor arriving via a shareable link (`?token=...`) should be able to
chat regardless of RBAC. The backend validates the token on session
creation and only returns a sessionId when it accepts it, so a token
paired with an active session bypasses the RBAC chat gate. A token alone
is not enough (invalid token, or the brief window before create-session
resolves), so the input stays gated until the session exists. The RBAC
"no permission" placeholder is suppressed whenever a token is present,
since RBAC does not apply to share-link visitors.

Also extract `isSendDisabled` (RBAC gate + active session) to replace the
duplicated `isChatDisabledByRbac || !sessionId` check across the submit
guard and send/tool buttons, and add unit coverage for the bypass. This
also repairs the chat-input-form test suite, which was failing on main
for lack of next/navigation and useChatPrivacy mocks.

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
@conradmugabe
conradmugabe requested a review from sonegillis1 July 10, 2026 17:26
@conradmugabe
conradmugabe requested a review from mamigot as a code owner July 10, 2026 17:26
@mamigot

mamigot commented Jul 10, 2026

Copy link
Copy Markdown
Member

Claude finished @conradmugabe's task —— View job


E2E Coverage Review

  • Dismiss stale REQUEST_CHANGES reviews (none found)
  • Identify changed files — only component files changed, no new page.tsx routes
  • Run mechanical coverage check — passed (545 checkpoints, 25/25 files covered)
  • Read current coverage state — all existing coverage intact
  • Applied decision logic — CASE E: No new routes, mechanical check passed → Approved

Result: ✅ PR approved. No new app routes were introduced and all existing coverage (545 checkpoints) remains intact.

@mamigot mamigot left a comment

Copy link
Copy Markdown
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

✅ E2E Coverage — No Issues

No new app routes were introduced. All existing coverage is intact.

@conradmugabe conradmugabe added the run-tests Trigger PR validation pipeline label Jul 13, 2026
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

run-tests Trigger PR validation pipeline

Projects

None yet

Development

Successfully merging this pull request may close these issues.

2 participants