Repository navigation
feat(webchat): verify workspace member links - #53
Merged
Merged
Conversation
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Signed-in webchat visitors need a supported way to prove their chat identity belongs to a workspace member before a credential request can be offered. This adds a separate workspace-link form, forwards the one-time proof through the Node/Workers and PHP adapters with a fresh authenticated session, and refuses proof codes in chat payloads. A member must still confirm the account in the workspace.
The UI appears only when the host opts in and the Gateway/CCP advertise the separately gated capability. The Gateway and CCP implementation is pending in nextlevelbuilder/dewee#2242; this PR must not be treated as deployed end-to-end support until that dependency and the real staging journey are verified. Refs #1 and nextlevelbuilder/dewee-web-v2#133.
Validation on the merged base:
pnpm typecheck;PHP_BIN=C:/tools/php/php.exe pnpm test(415 passed, 5 skipped). Focused tests cover Node, PHP, signed-in/anonymous widget states and keeping proof out of chat. Independent review covered the proof path and resulted in added page-context and handoff guards. Gateway PostgreSQL/SQLite tests and the complete browser journey are tracked in the dependent change.