Repository navigation
fix(hub): resume confirmed actions after GitHub verification - #84
Merged
Merged
Conversation
Retain allowlisted actions in encrypted, browser-bound challenges and continue them once through the original routes after verification. Preserve permission checks, expiry, cancellation, and explicit failure handling across all supported gated browser actions. Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
There was a problem hiding this comment.
Copilot was unable to review this pull request because there is no eligible user to bill.
An enterprise owner can allow the organization to be billed for reviews like this by enabling Copilot code review for users without a license.
Keep happy paths and critical continuation failures, reuse existing integration cases, and remove exhaustive boundary and duplicate coverage without changing production behavior. Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
Pass server-claimed key bytes directly to credential validation while keeping ordinary requests upload-only. Remove upload reconstruction and cleanup from the shared continuation concern and strengthen the existing credential tests. Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
Keep the existing credential continuation happy-path coverage without the added Tempfile guard. Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
nshki
approved these changes
Oct 22, 2026
nshki
left a comment
nshki
left a comment
Contributor
There was a problem hiding this comment.
@alliscode and I gave this a look over separately and discussed. Approving.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Why
GitHub verification currently succeeds without completing the action that prompted it. People adding an administrator must select the accounts and confirm again, and other sensitive settings have the same confusing interruption. Closes #79.
What changes
Hub remembers the confirmed action for every currently supported browser verification flow: administrator roles, analytics destinations, public sharing settings, ending all sessions, GitHub App reset and credentials, webhook rotation, and Copilot connection changes. After verification, it automatically submits a one-use reference to the original route and shows the actual result. A Continue button is available if automatic submission does not run.
Saved fields, including credentials and uploaded keys, are encrypted and bound to the original browser, account, route and operation. The original permission, confirmation, version and freshness checks still apply. Hub removes saved fields before one execution attempt; cancellation or failed verification discards them, and expired challenges are cleaned up. An interrupted attempt is not automatically retried.
The guides and confirmation copy describe the new flow. Obsolete submit-again stories and a duplicate viewport story are removed, and a test fixture is excluded from the story catalogue. Live GitHub verification against a deployed Hub has not been exercised.
Storybook screenshots
These are synthetic local Storybook states. The narrow continuation capture uses the existing collapsed sidebar.
Fresh authorization
Hub administrator confirmation
End all sessions
Public sharing
GitHub App
Copilot