Repository navigation
fix(email): RI-exchange approve/reject email links hit POST-only API routes and return 401 #579
Description
Summary
Found in the review of PR #577. RI-exchange approve and reject emails link directly to /api/ri-exchange/approve|reject/{id}?token= (internal/email/templates.go ~308-309 and ~366-367), but only POST is routed for those paths (internal/api/router.go ~316-317), so clicking the email link returns 401 on main today.
Acceptance
Point the emails at an SPA deep link that shows a confirm dialog and POSTs the token (as the purchase approval email does at templates.go ~609), with a test on the rendered email and a Playwright or deep-link test for the route. Do not reintroduce a side-effecting GET.
Activity
IAmJSD commentedon Oct 16, 2026
Released: needs frontend work (details below)
IAmJSD commentedon Oct 16, 2026
Released. The fix in this issue's acceptance criteria is mostly frontend: an SPA deep-link route that shows a confirm dialog and POSTs the token, plus a Playwright or deep-link test. I'm leaving
frontend/alone while you do the UI work. Changing only the email templates would point at a route that doesn't exist yet. Happy to do the backend and email-template half once the route exists. The purchase deep link (purchases-deeplink.tsand the approval-details flow from #990) is the pattern to follow.IAmJSD commentedon Oct 23, 2026
Claiming: working on this
IAmJSD commentedon Oct 23, 2026
Released: my claim above was a mistake by my automation, which missed our earlier release. Nothing has changed since then: the fix is mostly frontend (SPA deep-link confirm route), so I'm leaving it for the UI work. @cristim
fix(frontend): add confirm-then-POST deep link for RI-exchange approv…