feat(desktop): add exact owner confirmation action - #7498
Conversation
Signed-off-by: Forge <forge@bluroot.co>
Codex Review SummaryThis comment shows the latest Codex review activity on this pull request.
ℹ️ About Codex in GitHubYour team has set up Codex to review pull requests in this repo. Reviews are triggered when you
Codex reacts with 👀 while any review is running, comments if it has suggestions, and reacts with 👍 once all reviews finish with no findings. |
🔐 Codex Security Review
|
![chatgpt-codex-connector[bot]](https://avatars.githubusercontent.com/in/1144995?s=60&v=4){kind=small}
There was a problem hiding this comment.
💡 Codex Review
Here are some automated review suggestions for this pull request.
Reviewed commit: f15ba8ecf3
ℹ️ About Codex in GitHub
Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you
- Open a pull request for review
- Mark a draft as ready
- Comment "@codex review".
If Codex has suggestions, it will comment; otherwise it will react with 👍.
Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".
| const workDriveConfirmation = React.useMemo(() => { | ||
| if (!channelId) return null; | ||
| const payload = extractWorkDriveOwnerConfirmation(message.body); | ||
| if (!payload || payload.channel_id !== channelId) { | ||
| return null; |
There was a problem hiding this comment.
Any channel message containing a syntactically valid payload for this channel is replaced with the trusted-looking approval card, without checking that payload.owner_pubkey targets the current user or that the raw event signer is a known channel agent. Consequently every non-owner sees an action that can only fail, and an ordinary member can spoof the security prompt even though the native command later rejects approval. Gate rendering on the current pubkey and the authenticated message.signerPubkey/message kind, as the nearby config-nudge path does.
Useful? React with 👍 / 👎.
| let events = query_relay( | ||
| &state, | ||
| &[serde_json::json!({ | ||
| "ids": [request_event_id], | ||
| "kinds": [9], |
There was a problem hiding this comment.
If the user switches communities while this command is awaiting network responses, the first request can be fetched from relay A while the signer, roster query, and final submit_event are independently re-resolved from relay B. This can fail a legitimate approval or, where identities/channel IDs overlap, publish a privileged confirmation into the wrong tenant. Capture the relay and signing keys once, use the explicit-relay query/submission helpers, and reject an active-scope change before publishing.
AGENTS.md reference: AGENTS.md:L176-L179
Useful? React with 👍 / 👎.
| await page.getByRole("button", { name: "Cancel" }).click(); | ||
| await expect( | ||
| page.getByRole("heading", { name: "Allow create-only WorkDrive uploads?" }), | ||
| ).not.toBeVisible(); | ||
| await expect(card.getByRole("button", { name: "Review and approve" })).toBeVisible(); |
There was a problem hiding this comment.
This required smoke test only cancels the dialog, while the Rust tests cover only parsing and validation helpers; no test invokes confirm_workdrive_owner_request or observes its relay queries and signed submission. Removing the command registration, authorization checks, or event publication would therefore leave all added tests green. Add a test that approves through the production command seam against a controlled relay and verifies the owner/bot checks and canonical reply event.
AGENTS.md reference: AGENTS.md:L188-L192
Useful? React with 👍 / 👎.
1 participant
Summary
Adds a fail-closed, client-rendered confirmation action for exact WorkDrive connection upgrades. The native command refetches the request event, requires a bot-role requester and live channel owner signer, rejects unknown or altered fields/scopes/actions, and signs only the canonical create-only approval event.
Related issue
N/A — operational incident tracked in Buzz as f59a78a561a9cbde28aec3e8819ec40c578680022533e1ba338755e512b38bbf.
Testing