psa-systems/lets-chat
Watch
9
0
Fork
You've already forked lets-chat
 0
Code Issues Pull requests Projects Releases 2 Packages Wiki Activity Actions

fix(enclave): friendly redirect for invalid/revoked invite code (LC-544) #513

Merged
nrupard merged 2 commits from fix/LC-544-friendly-invalid-invite-code into main 2026-07-06 21:00:26 +02:00
Conversation 0 Commits 2 Files changed 2 +164 -3
nrupard commented 2026-07-06 20:41:06 +02:00
Owner
Copy link

What

Joining an enclave with a bad invite code used to dump the user on a raw "400 Bad Request: invalid or revoked code" page, a leftover from early development. post_join_by_code now redirects (303) back to /enclaves/discover?error=invalid_invite_code, which renders a friendly, actionable banner through the existing flash_message machinery. The discover page is itself the next step: the join form is right there to retry a mistyped code, and the public-enclave list is a way forward.

Invalid, revoked, and expired codes all collapse to the same get_enclave_by_invite_code None branch, so one path covers all three (a revoked or rotated code simply no longer matches any row; a cleared code is NULL and never matches a bound value).

Changes

  • server/src/routes/enclave.rs: on the no-match branch of post_join_by_code, return Redirect::to("/enclaves/discover?error=invalid_invite_code") instead of AppError::BadRequest. Add the invalid_invite_code arm to flash_message (plain-string, matching the sibling enclave_name_taken / room_name_taken arms).

Testing

just test and just test-saas both green; just check clean (clippy + fmt + desktop compile).

New route tests in server/tests/routes_enclave.rs cover all three acceptance-criteria paths: invalid code -> 303 to discover; revoked code (rotate the live code, retry the old one) -> 303 to discover; valid code -> 303 to /enclave/{id} and the joiner reaches the enclave landing as a member. A create_enclave_with_code helper reads the server-generated code back off the settings page. The stale join_by_invalid_invite_code_400 assertion (which pinned the old raw-400 behavior) is replaced.

Notes

Not operator-visible: no env var, config, or API-contract change, so no [operator-action] marker. The two remaining "invalid or revoked code" string hits are in historical docs/superpowers/** build-plan/spec files (immutable build-history; the spec actually recorded the original intent as a "form re-render", which this restores) and are intentionally left untouched.

#LC-544

## What Joining an enclave with a bad invite code used to dump the user on a raw "400 Bad Request: invalid or revoked code" page, a leftover from early development. `post_join_by_code` now redirects (303) back to `/enclaves/discover?error=invalid_invite_code`, which renders a friendly, actionable banner through the existing `flash_message` machinery. The discover page is itself the next step: the join form is right there to retry a mistyped code, and the public-enclave list is a way forward. Invalid, revoked, and expired codes all collapse to the same `get_enclave_by_invite_code` `None` branch, so one path covers all three (a revoked or rotated code simply no longer matches any row; a cleared code is NULL and never matches a bound value). ## Changes - `server/src/routes/enclave.rs`: on the no-match branch of `post_join_by_code`, return `Redirect::to("/enclaves/discover?error=invalid_invite_code")` instead of `AppError::BadRequest`. Add the `invalid_invite_code` arm to `flash_message` (plain-string, matching the sibling `enclave_name_taken` / `room_name_taken` arms). ## Testing `just test` and `just test-saas` both green; `just check` clean (clippy + fmt + desktop compile). New route tests in `server/tests/routes_enclave.rs` cover all three acceptance-criteria paths: invalid code -> 303 to discover; revoked code (rotate the live code, retry the old one) -> 303 to discover; valid code -> 303 to `/enclave/{id}` and the joiner reaches the enclave landing as a member. A `create_enclave_with_code` helper reads the server-generated code back off the settings page. The stale `join_by_invalid_invite_code_400` assertion (which pinned the old raw-400 behavior) is replaced. ## Notes Not operator-visible: no env var, config, or API-contract change, so no `[operator-action]` marker. The two remaining "invalid or revoked code" string hits are in historical `docs/superpowers/**` build-plan/spec files (immutable build-history; the spec actually recorded the original intent as a "form re-render", which this restores) and are intentionally left untouched. #LC-544
fix(enclave): friendly redirect for invalid/revoked invite code (LC-544)
All checks were successful
check-secrets / Nosey parker (push) Successful in 4s
Details
check-secrets / TruffleHog (push) Successful in 4s
Details
check-secrets / Kingfisher (push) Successful in 6s
Details
check-secrets / Nosey parker (pull_request) Successful in 3s
Details
check-secrets / TruffleHog (pull_request) Successful in 4s
Details
check-secrets / Kingfisher (pull_request) Successful in 5s
Details
Check / clippy + fmt + tests (pull_request) Successful in 3m7s
Details
28ef74f661 
An invalid, revoked, or expired enclave invite code POSTed to /enclaves/join used to return a raw 400 error page (AppError::BadRequest "invalid or revoked code"), a leftover from early development. It now redirects (303) to /enclaves/discover?error=invalid_invite_code, which renders a friendly, actionable banner through the existing flash_message machinery: the discover page's join form is right there to retry a mistyped code and the public-enclave list is a way forward. Invalid, revoked, and expired codes all collapse to the same get_enclave_by_invite_code None branch, so one path covers all three.

Tests: the stale join_by_invalid_invite_code_400 assertion is replaced by three route tests covering the invalid, revoked (rotate the code then retry the old one), and valid join paths, plus a create_enclave_with_code helper that reads the generated code back off the settings page.

#LC-544

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
test(enclave): assert discover renders the invalid-invite-code banner (LC-544)
All checks were successful
check-secrets / Nosey parker (push) Successful in 3s
Details
check-secrets / TruffleHog (push) Successful in 4s
Details
check-secrets / Nosey parker (pull_request) Successful in 4s
Details
check-secrets / TruffleHog (pull_request) Successful in 5s
Details
check-secrets / Kingfisher (pull_request) Successful in 5s
Details
check-secrets / Kingfisher (push) Successful in 6s
Details
Check / clippy + fmt + tests (pull_request) Successful in 3m25s
Details
Create release / Create release from merged PR (pull_request) Has been skipped
Details
fa92f0aeb1 
Follow the redirect in join_by_invalid_invite_code_redirects_to_discover and assert the discover page body contains the friendly message. Asserting the Location alone stayed green even if the flash_message arm were removed (fix and arm coupled only by the invalid_invite_code string), so this closes the AC#1 loop end-to-end.

#LC-544

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
nrupard scheduled this pull request to auto merge when all checks succeed 2026-07-06 21:00:01 +02:00
nrupard deleted branch fix/LC-544-friendly-invalid-invite-code 2026-07-06 21:00:26 +02:00
Sign in to join this conversation.
Reviewers
No reviewers
Labels
Clear labels
No items
No labels
Milestone
Clear milestone
No items
No milestone
Projects
Clear projects
No items
No project
Assignees
Clear assignees
No assignees
1 participant
Notifications
Due date
The due date is invalid or out of range. Please use the format "yyyy-mm-dd".

No due date set.

Dependencies

No dependencies set

Reference
psa-systems/lets-chat!513
No description provided.