Consent: optional at registration, a consent page, CSRF-guarded accept/withdraw, notice v2 #58

Merged

heimdall merged 4 commits from heimdall/consent-optional into main

2026-11-11 12:11:03 +00:00

heimdall commented

2026-11-11 11:34:52 +00:00

Member

Follow-up chat-s6209-6210: steward's ruling on PR #55 (merged as a record). Consent is optional (null acceptedNoticeVersion registers without a receipt); GET /auth/bifrost/consent lets any signed-in account agree or withdraw (strict origin guard on both POSTs, which closes the withdrawal CSRF gap); one live receipt per account and version (filtered unique index, migration ConsentReceiptsOneLivePerVersion); notice version 2. A version bump re-asks on the consent page and silence means no. Rulings on Eureka's five gaps in docs/training-notice.md. Not deployed; the migration has not been run on Postgres by Hands.

🤖 Generated with Claude Code

Follow-up chat-s6209-6210: steward's ruling on PR #55 (merged as a record). Consent is optional (null `acceptedNoticeVersion` registers without a receipt); `GET /auth/bifrost/consent` lets any signed-in account agree or withdraw (strict origin guard on both POSTs, which closes the withdrawal CSRF gap); one live receipt per account and version (filtered unique index, migration `ConsentReceiptsOneLivePerVersion`); notice version 2. A version bump re-asks on the consent page and silence means no. Rulings on Eureka's five gaps in `docs/training-notice.md`. Not deployed; the migration has not been run on Postgres by Hands. 🤖 Generated with [Claude Code](https://claude.com/claude-code)

heimdall added 4 commits

2026-11-11 11:34:52 +00:00

Consent: optional at registration, a consent page with accept and withdraw, notice version 2 8c3827b36d

Registration without acceptedNoticeVersion (JSON) or with the box unticked (form) creates the account with no receipt; a version sent must still equal the one in force. GET /auth/bifrost/consent shows the notice and the account's state with the one applicable button. POST accept and withdraw are forms behind the strict RequestOriginGuard.Allows (403 before any read or write), idempotent, and withdraw is no longer JSON. The ConsentReceipt unique index becomes filtered to live rows so a person can agree again after withdrawing. TrainingNotice.Version = 2 with the ruled text.

Co-Authored-By: Claude Sonnet 5.5 <noreply@anthropic.com>

Consent tests: a live receipt for the version in force outranks an older live one 6a797cb3fa

Co-Authored-By: Claude Sonnet 5.5 <noreply@anthropic.com>

Consent page: Withdraw whenever any live receipt exists, Agree whenever none is live for the version in force c9387a255d

An account on an older receipt sees both buttons.

Co-Authored-By: Claude Sonnet 5.5 <noreply@anthropic.com>

Docs: training notice v2 rulings, optional consent, consent page, version-bump behavior e4b31b8940

Co-Authored-By: Claude Sonnet 5.5 <noreply@anthropic.com>

heimdall merged commit 1571bf3e32 into main

2026-11-11 12:11:03 +00:00

heimdall deleted branch heimdall/consent-optional

2026-11-11 12:11:03 +00:00

heimdall referenced this pull request from a commit

2026-11-11 12:11:04 +00:00

Consent: optional at registration, a consent page, CSRF-guarded accept/withdraw, notice v2 (#58)

No reviewers

No labels

No milestone

No project

No assignees

1 participant

Notifications

Due date

The due date is invalid or out of range. Please use the format "yyyy-mm-dd".

No due date set.

Dependencies

No dependencies set

Reference

GameCult/Bifrost!58

No description provided.

Rows
Columns