fix(demo+passkey): /rain/cards demo fixture, WebKit 'Load failed' classification, full auth clear by innolope-dev · Pull Request #2517 · peanutprotocol/peanut-ui

innolope-dev · 2026-07-27T12:00:50Z

Ports the applicable subset of the v1.0.40 mobile-release fix (9cdb8aec0) to main.

Context

Two native regressions reported on TestFlight 1.0.39 (34):

Entering the demo invite code crashed the app on /home (PEANUT-UI-RM6): the demo router has no /rain/cards route, so its shape-aware fallback returned {}, and overview consumers deref .status/.cards.
First passkey sign-in attempt fails with the LOGIN_ERROR modal, second succeeds (PEANUT-UI-QV6 / R0X). One contributing defect applies to main: WebKit reports failed fetches as TypeError: Load failed, which isNetworkError didn't match, so transient connection drops (typical right as the app foregrounds from the passkey sheet) surfaced as "We couldn't verify your passkey" instead of the network-error copy.

Changes

demo-api.ts: GET /rain/cards → { status: { hasApplication: false }, balance: null, cards: [] } (+ test). Also future-proofs the guarded refetchInterval that currently lives on mobile-release.
webauthn.utils.ts: add load failed to the network-error heuristic (+ test).
auth.utils.ts: clearAuthState delegates to clearAuthToken() so native token stores are cleared too, not just the jwt cookie.

Not ported (mobile-release-only stack): the /passkeys/* non-2xx Sentry reporting in native-auth-capture.ts and the mid-flight token-rotation guard in useUserQuery — those files/mechanisms don't exist on main yet and will arrive with the next mobile-release↔main sync.

Testing

jest demo-api.test.ts webauthn.utils.test.ts — 28 passed.
Same changes are already live in the v1.0.40 TestFlight build for on-device verification.

Summary by CodeRabbit

Bug Fixes
- Improved passkey error handling by treating additional “load failed” WebKit fetch failures as network errors.
- Updated auth cleanup to reliably clear stored JWTs during sign-out and failed login flows.
- Added a demo-mode fallback for Rain card overview requests to prevent client crashes when data is missing.
Tests
- Added coverage for the Rain card overview fallback response shape.
- Added coverage for WebKit “load failed” error classification as NETWORK.

…ssification, full auth clear Ports the applicable subset of mobile-release 9cdb8ae: - demo: add /rain/cards fixture so overview consumers never see the {} fallback (crashes deref of .status/.cards — PEANUT-UI-RM6 on native) - passkey: classify WebKit 'Load failed' fetch errors as NETWORK instead of the LOGIN_ERROR modal (PEANUT-UI-QV6) - auth: clearAuthState delegates to clearAuthToken so native token stores are cleared too, not just the jwt cookie

vercel · 2026-07-27T12:00:57Z

The latest updates on your projects. Learn more about Vercel for GitHub.

Project	Deployment	Actions	Updated (UTC)
peanut-wallet	Ready	Preview, Comment	Jul 27, 2026 12:18pm

coderabbitai · 2026-07-27T12:01:12Z

No actionable comments were generated in the recent review. 🎉

ℹ️ Recent review info

⚙️ Run configuration

Configuration used: Path: .coderabbit.yaml

Review profile: CHILL

Plan: Pro

Run ID: 37c7a57e-d993-445b-9593-9b3bbf644819

📥 Commits

Reviewing files that changed from the base of the PR and between e2c8a9a and 69499e8.

📒 Files selected for processing (3)

src/hooks/useAccountSetup.ts
src/hooks/useZeroDev.ts
src/utils/auth.utils.ts

🚧 Files skipped from review as they are similar to previous changes (1)

src/utils/auth.utils.ts

📝 Walkthrough

Walkthrough

Adds a demo /rain/cards fallback and test, routes authentication cleanup through the shared token helper with awaited failure handling, and classifies WebKit “Load failed” errors as WebAuthn network errors with test coverage.

Changes

Rain cards demo fallback

Layer / File(s)	Summary
Rain cards fallback route `src/utils/demo-api.ts`, `src/utils/__tests__/demo-api.test.ts`	Adds `GET /rain/cards` with `status.hasApplication: false`, `balance: null`, and an empty `cards` array, then tests the response shape.

Shared authentication token cleanup

Layer / File(s)	Summary
Shared auth token clearing `src/utils/auth.utils.ts`	Makes `clearAuthState` asynchronous and replaces direct JWT cookie expiration with the shared `clearAuthToken()` helper.
Auth failure cleanup sequencing `src/hooks/useAccountSetup.ts`, `src/hooks/useZeroDev.ts`	Awaits authentication cleanup before returning from account setup failure handling or reporting and rethrowing login errors.

WebAuthn network-error classification

Layer / File(s)	Summary
WebKit network-error handling `src/utils/webauthn.utils.ts`, `src/utils/__tests__/webauthn.utils.test.ts`	Recognizes “Load failed” as a network error and verifies the resulting `NETWORK` classification.

Estimated code review effort: 2 (Simple) | ~10 minutes

Suggested reviewers: hugo0

🚥 Pre-merge checks | ✅ 5

✅ Passed checks (5 passed)

Check name	Status	Explanation
Description Check	✅ Passed	Check skipped - CodeRabbit’s high-level summary is enabled.
Title check	✅ Passed	The title clearly reflects the main changes: demo fixture support, WebKit passkey error classification, and auth state clearing.
Docstring Coverage	✅ Passed	No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check.
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.

✨ Finishing Touches

📝 Generate docstrings

Create stacked PR
Commit on current branch

🧪 Generate unit tests (beta)

Create PR with unit tests
Commit unit tests in branch fix/native-demo-passkey-regressions

Warning

There were issues while running some tools. Please review the errors and either fix the tool's configuration or disable the tool if it's a critical failure.

🔧 ESLint

If the error stems from missing dependencies, add them to the package.json file. For unrecoverable errors (e.g., due to private dependencies), disable the tool in the CodeRabbit configuration.

ESLint install failed: dependency version conflict. Check your lock file or package.json.

_{Comment @coderabbitai help to get the list of available commands.}

github-actions · 2026-07-27T12:02:13Z

Code-analysis diff

Painscore total: 6273.99 → 6275.16 (+1.17)
Findings: 0 net (+7 new, -7 resolved)

🆕 New findings (7)

critical complexity — src/utils/demo-api.ts — CC 108, MI 59.56, SLOC 923
high hotspot — src/hooks/useZeroDev.ts — 31 commits, +242/-175 lines since 6 months ago
medium complexity — src/hooks/useAccountSetup.ts — CC 15, MI 52.97, SLOC 107
low high-mdd — src/utils/webauthn.utils.ts:101 — withWebAuthnRetry: MDD 18.3 (uses across many lines from declarations)
low high-mdd — src/utils/webauthn.utils.ts:56 — classifyPasskeyError: MDD 13.9 (uses across many lines from declarations)
low high-mdd — src/utils/demo-api.ts:597 — : MDD 11.2 (uses across many lines from declarations)
low missing-return-type — src/utils/auth.utils.ts:14 — clearAuthState: exported fn missing return type annotation

✅ Resolved (7)

src/utils/demo-api.ts — CC 107, MI 59.55, SLOC 914
src/hooks/useZeroDev.ts — 30 commits, +241/-174 lines since 6 months ago
src/hooks/useAccountSetup.ts — CC 15, MI 53.06, SLOC 106
src/utils/webauthn.utils.ts:99 — withWebAuthnRetry: MDD 18.3 (uses across many lines from declarations)
src/utils/webauthn.utils.ts:54 — classifyPasskeyError: MDD 13.9 (uses across many lines from declarations)
src/utils/demo-api.ts:589 — : MDD 11.2 (uses across many lines from declarations)
src/utils/auth.utils.ts:13 — clearAuthState: exported fn missing return type annotation

github-actions · 2026-07-27T12:02:43Z

🧪 UI test report — ✅ all green

Suites

✅ unit: 2158 ran, 0 failed, 0 skipped, 36.9s

📊 Coverage (unit)

metric	%
statements	60.9%
branches	44.5%
functions	50.0%
lines	61.3%

⏱ 10 slowest test cases

time	test
3.8s	`src/components/Card/share-asset/__tests__/shareAssetLayout.test.ts` › never places two stickers in heavy overlap (broad seed sweep)
1.1s	`src/utils/__tests__/demo-api.test.ts` › isDemoMode() is false when not running under Capacitor
0.7s	`src/components/Card/share-asset/__tests__/shareAssetLayout.test.ts` › every sticker stays within canvas at any count
0.5s	`src/utils/__tests__/demo-balance.test.ts` › starts at the full balance on a fresh install and stamps a timestamp
0.3s	`src/app/actions/__tests__/api-headers-extended.test.ts` › should not include apiKey in validateInviteCode body
0.3s	`src/app/actions/__tests__/api-headers.test.ts` › should include Content-Type in validateInviteCode
0.3s	`src/app/(mobile-ui)/withdraw/__tests__/withdraw-states.test.tsx` › Bank withdrawal keeps the $1 minimum for sub-$1 amounts
0.3s	`src/components/Card/share-asset/__tests__/shareAssetLayout.test.ts` › keeps stickers off the username pill (final pass respects the keep-out)
0.2s	`src/utils/__tests__/demo-balance.test.ts` › resetDemoBalance refills and restarts the TTL window
0.2s	`src/utils/__tests__/demo-balance.test.ts` › keeps a spent-down balance across a cold start within the TTL

_{📍 Inline annotations are in the **Unit test report** check above. Coverage artifact: `coverage-unit`. Generated by `.github/workflows/tests.yml`.}

coderabbitai

Actionable comments posted: 1

🧹 Nitpick comments (1)

src/utils/__tests__/demo-api.test.ts (1)
81-88: 🎯 Functional Correctness | 🔵 Trivial | ⚡ Quick win

Assert that the fallback cards list is empty.

Line 87 only verifies the type, so the test would still pass if demo mode returned unexpected cards. Assert the exact fallback value.
Proposed test assertion
-        expect(Array.isArray(data.cards)).toBe(true)
+        expect(data.cards).toEqual([])
🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

In `@src/utils/__tests__/demo-api.test.ts` around lines 81 - 88, The rain card
overview test should verify the fallback cards list is empty, not only that
data.cards is an array. Update the assertion in the “demoRespond — rain card
overview” test to check the exact empty-array value while preserving the
existing response status, status, and balance assertions.

🤖 Prompt for all review comments with AI agents

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

Inline comments:
In `@src/utils/auth.utils.ts`:
- Around line 24-26: Update clearAuthState to be asynchronous and await
clearAuthToken instead of discarding its Promise, ensuring native token cleanup
completes before the function returns. Find every caller of clearAuthState and
await the returned Promise, preserving the existing cleanup behavior.

---

Nitpick comments:
In `@src/utils/__tests__/demo-api.test.ts`:
- Around line 81-88: The rain card overview test should verify the fallback
cards list is empty, not only that data.cards is an array. Update the assertion
in the “demoRespond — rain card overview” test to check the exact empty-array
value while preserving the existing response status, status, and balance
assertions.

🪄 Autofix (Beta)

Fix all unresolved CodeRabbit comments on this PR:

Push a commit to this branch (recommended)
Create a new PR with the fixes

ℹ️ Review info

⚙️ Run configuration

Configuration used: Path: .coderabbit.yaml

Review profile: CHILL

Plan: Pro

Run ID: 105a83f7-6017-4223-967e-d0b895443421

📥 Commits

Reviewing files that changed from the base of the PR and between e52eb69 and e2c8a9a.

📒 Files selected for processing (5)

src/utils/__tests__/demo-api.test.ts
src/utils/__tests__/webauthn.utils.test.ts
src/utils/auth.utils.ts
src/utils/demo-api.ts
src/utils/webauthn.utils.ts

Review follow-up: clearAuthToken's Preferences/cookie-jar clears are async; make clearAuthState await them so callers can't proceed on a half-cleared session (in-memory clear was already synchronous).

…s, PIX exit, verification tasks Cherry-picks the open native-facing work onto the release branch: - KYC now routes every native entry point through the Sumsub Cordova SDK instead of the WebSDK (peanut-ui #2562) — the one change here that genuinely requires a new binary rather than an OTA. - Deferred deep linking survives the store install, so a link followed before install lands on its destination on first launch (#2560, TASK-20772). - PIX deposit "Done" exits to home from both the completed and processing states instead of dropping the user into a new deposit (#2548). - Pending Bridge verification tasks card on home, dismissible and resurfaced under Unlocked regions (#2549). - Native demo/passkey follow-ups: the awaited token clear in clearAuthState plus the two callers it changed (#2517 — the rest shipped in 1.0.40). - Documents left running on a superseded deployment now reload (#2563). - Android safe zone sized from natively measured insets. Not carried: the CSP allow-list gaps (#2564). It builds on the #2519 collector rework — a /api/csp-report route and ten commits that are not on this branch — and the policy is report-only, so the gaps cost report fidelity, not behaviour.

innolope-dev self-assigned this Jul 27, 2026

coderabbitai Bot reviewed Jul 27, 2026

View reviewed changes

Comment thread src/utils/auth.utils.ts Outdated

vercel Bot deployed to Preview July 27, 2026 12:06 View deployment

fix(auth): await native token clear in clearAuthState

69499e8

Review follow-up: clearAuthToken's Preferences/cookie-jar clears are async; make clearAuthState await them so callers can't proceed on a half-cleared session (in-memory clear was already synchronous).

vercel Bot deployed to Preview July 27, 2026 12:18 View deployment

innolope-dev requested a review from kushagrasarathe July 27, 2026 12:19

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Uh oh!

fix(demo+passkey): /rain/cards demo fixture, WebKit 'Load failed' classification, full auth clear - #2517

fix(demo+passkey): /rain/cards demo fixture, WebKit 'Load failed' classification, full auth clear#2517
innolope-dev wants to merge 2 commits into
mainfrom
fix/native-demo-passkey-regressions

innolope-dev commented Jul 27, 2026 •

edited by coderabbitai Bot

Loading

Uh oh!

vercel Bot commented Jul 27, 2026 •

edited

Loading

Uh oh!

coderabbitai Bot commented Jul 27, 2026 •

edited

Loading

Walkthrough

Changes

Uh oh!

github-actions Bot commented Jul 27, 2026 •

edited

Loading

Uh oh!

github-actions Bot commented Jul 27, 2026 •

edited

Loading

Uh oh!

coderabbitai Bot left a comment

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

1 participant

Uh oh!

Conversation

innolope-dev commented Jul 27, 2026 • edited by coderabbitai Bot Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Context

Changes

Testing

Summary by CodeRabbit

Uh oh!

vercel Bot commented Jul 27, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

coderabbitai Bot commented Jul 27, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Walkthrough

Changes

Uh oh!

github-actions Bot commented Jul 27, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Code-analysis diff

🆕 New findings (7)

✅ Resolved (7)

Uh oh!

github-actions Bot commented Jul 27, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

🧪 UI test report — ✅ all green

Suites

📊 Coverage (unit)

Uh oh!

coderabbitai Bot left a comment

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

1 participant

innolope-dev commented Jul 27, 2026 •

edited by coderabbitai Bot

Loading

vercel Bot commented Jul 27, 2026 •

edited

Loading

coderabbitai Bot commented Jul 27, 2026 •

edited

Loading

github-actions Bot commented Jul 27, 2026 •

edited

Loading

github-actions Bot commented Jul 27, 2026 •

edited

Loading