Skip to content

Gate Favourites to signed-in users with Your library sidebar - #931

Merged
BigSimmo merged 4 commits into
mainfrom
cursor/auth-gate-favourites-a26d
Jul 19, 2026
Merged

Gate Favourites to signed-in users with Your library sidebar#931
BigSimmo merged 4 commits into
mainfrom
cursor/auth-gate-favourites-a26d

Conversation

@BigSimmo

@BigSimmo BigSimmo commented Jul 19, 2026

Copy link
Copy Markdown
Owner

Summary

Favourites is account-scoped and should not be discoverable for public (signed-out, non-demo) users.

  • Signed-out (non-demo): Favourites is hidden from the mode menu and sidebar Tools. Visiting /favourites stays on the page, shows a gate panel, and auto-opens account setup with Sign up to save favourites copy.
  • Signed-in or demo mode: Favourites appears in the mode dropdown and in a new sidebar section Your library (including the collapsed rail).
  • Demo/local CI keeps Favourites reachable so existing Playwright/prototype flows continue to work.

Key implementation: canAccessFavouritesMode / visibleAppModeDefinitionsForSession, shared useFavouritesAccess, Favourites moved from Tools into Your library, favourites-intent account setup, and PriorAnswerTurnSurface extraction to keep ClinicalDashboard under the maintainability budget.

Verification

  • npm run verify:pr-local
  • UI verification not run: full npm run verify:ui suite is covered by the CI Production UI job on this PR; local offline-demo Playwright favourites smoke (npm run test:e2e -- tests/ui-smoke.spec.ts — tablet rail, mode menu, favourites routes) passed 7/7.

Risk and rollout

  • Risk: medium; auth-gated Favourites navigation and signed-out page gate change account-scoped discovery without changing favourites API auth contracts.
  • Rollback: revert this PR merge commit; Favourites returns to public Tools/mode-menu discovery with the previous soft sign-in banner.
  • Provider or production effects: None

Clinical Governance Preflight

  • Source-backed claims still require linked source verification before clinical use
  • No patient-identifiable document workflow was introduced or expanded without explicit governance approval
  • Supabase target remains Clinical KB Database (sjrfecxgysukkwxsowpy)
  • Service-role keys and private document access remain server-only
  • Demo/synthetic content remains clearly separated from real clinical sources
  • Source metadata, review status, and outdated/unknown-source behavior remain conservative
  • Deployment classification/TGA SaMD impact was checked when clinical decision-support behavior changed

Notes

  • No unresolved GitHub review threads on this PR (Codex review skipped due to usage limits; CodeRabbit summary only).
  • Supabase Preview skipped: no supabase/ directory changes.
Open in Web Open in Cursor 

Summary by CodeRabbit

  • New Features

    • Added access controls for Favourites based on sign-in and demo mode.
    • Added a dedicated “Your library” section for Favourites navigation.
    • Added Favourites-specific account setup messaging and benefits.
    • Added a collapsible, read-only view for prior answer turns.
  • Bug Fixes

    • Prevented unauthorized users from opening Favourites and provided an account setup path.
  • Tests

    • Added coverage for Favourites visibility, access gating, demo mode, and account setup messaging.

Hide Favourites from public Tools and the mode menu unless the user is
authenticated or demo mode is active. Surface it under a new Your library
sidebar section when allowed, and keep /favourites on-page with a
favourites-intent account setup dialog for signed-out visitors.
@supabase

supabase Bot commented Jul 19, 2026

Copy link
Copy Markdown

This pull request has been ignored for the connected project sjrfecxgysukkwxsowpy because there are no changes detected in supabase directory. You can change this behaviour in Project Integrations Settings ↗︎.


Preview Branches by Supabase.
Learn more about Supabase Branching ↗︎.

@coderabbitai

coderabbitai Bot commented Jul 19, 2026

Copy link
Copy Markdown
Contributor

Review Change Stack

📝 Walkthrough

Walkthrough

Favourites access is now session-aware across app modes, sidebars, search navigation, the command library, and account setup. Account setup supports favourites-specific intent copy, and the prior-answer surface is extracted into its own component.

Changes

Favourites access and account setup

Layer / File(s) Summary
Session access policy and state
src/lib/app-modes.ts, src/components/clinical-dashboard/use-favourites-access.ts, tests/app-modes.test.ts
Favourites visibility and account-setup state are derived from authentication and demo mode, with coverage for all session combinations.
Account library and setup surfaces
src/components/clinical-dashboard/ClinicalSidebar.tsx, src/components/clinical-dashboard/account-setup-dialog.tsx, src/components/clinical-dashboard/favourites-command-library-page.tsx, tests/favourites-auth-gate*, tests/ui-smoke.spec.ts
Favourites moves into a conditional “Your library” section; the library page gates signed-out access; account setup renders favourites-specific copy.
Dashboard navigation integration
src/components/ClinicalDashboard.tsx, src/components/clinical-dashboard/global-search-shell.tsx, src/components/clinical-dashboard/master-search-header.tsx
Navigation blocks inaccessible favourites modes, opens account setup with the correct intent, closes transient surfaces, and propagates access state to headers and sidebars.
Prior answer surface extraction
src/components/ClinicalDashboard.tsx, src/components/clinical-dashboard/prior-answer-turn-surface.tsx
The prior-answer turn UI is moved from ClinicalDashboard into a dedicated client component.

Estimated code review effort: 4 (Complex) | ~60 minutes

Sequence Diagram(s)

sequenceDiagram
  participant User
  participant MasterSearchHeader
  participant ClinicalDashboard
  participant useFavouritesAccess
  participant AccountSetupDialog
  User->>MasterSearchHeader: select favourites mode
  MasterSearchHeader->>ClinicalDashboard: request account setup when access is unavailable
  ClinicalDashboard->>useFavouritesAccess: openAccountSetup("favourites")
  useFavouritesAccess->>AccountSetupDialog: provide open state and intent
  AccountSetupDialog-->>User: render favourites setup content
Loading

Possibly related PRs

Suggested reviewers: claude

🚥 Pre-merge checks | ✅ 4 | ❌ 1

❌ Failed checks (1 warning)

Check name Status Explanation Resolution
Docstring Coverage ⚠️ Warning Docstring coverage is 30.00% which is insufficient. The required threshold is 80.00%. Write docstrings for the functions missing them to satisfy the coverage threshold.
✅ Passed checks (4 passed)
Check name Status Explanation
Linked Issues check ✅ Passed Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check ✅ Passed Check skipped because no linked issues were found for this pull request.
Title check ✅ Passed The title clearly matches the main change: gating Favourites and adding the Your library sidebar section.
Description check ✅ Passed The description follows the required template and includes summary, verification, risk/rollback, clinical governance, and notes.
✨ Finishing Touches
📝 Generate docstrings
  • Create stacked PR
  • Commit on current branch
🧪 Generate unit tests (beta)
  • Create PR with unit tests
  • Commit unit tests in branch cursor/auth-gate-favourites-a26d

Comment @coderabbitai help to get the list of available commands.

Extract PriorAnswerTurnSurface and share useFavouritesAccess between the
shell and dashboard so Favourites gating does not grow the monolith.
Derive the favourites signup dialog open state without setState-in-effect.
Cover sidebar visibility, signed-out signup intent, and demo-mode library
access. Note that tablet rail Favourites remains available under demo mode.
@BigSimmo
BigSimmo marked this pull request as ready for review July 19, 2026 16:24
@chatgpt-codex-connector

Copy link
Copy Markdown

You have reached your Codex usage limits for code reviews. You can see your limits in the Codex usage dashboard.
To continue using code reviews, add credits to your account and enable them for code reviews in your settings.

@BigSimmo
BigSimmo enabled auto-merge (squash) July 19, 2026 16:24
@BigSimmo

Copy link
Copy Markdown
Owner Author

@cursoragent Please can you resolve all failing CI testing for me and resolve any unresolved comments

@cursor

cursor Bot commented Jul 19, 2026

Copy link
Copy Markdown
Contributor

PR #931 is fixed and already merged.

What failed

Only PR policy — the body was missing the required ## Verification checkboxes, ## Risk and rollout, and ## Clinical Governance Preflight sections.

What I did

  • Updated the PR description with those sections (locally validated against pr-policy.mjs)
  • Confirmed there were no unresolved review threads (Codex hit usage limits; CodeRabbit was summary-only; Supabase bot is informational)

CI outcome

  • PR policy → pass
  • Production UI → pass
  • PR required → pass
  • All other required checks → pass

PR state: MERGED (2026-07-19T16:31:27Z) — #931

Open in Web Open in Cursor 

@BigSimmo
BigSimmo merged commit 3b8c58f into main Jul 19, 2026
15 of 17 checks passed
@BigSimmo
BigSimmo deleted the cursor/auth-gate-favourites-a26d branch July 19, 2026 16:31

@coderabbitai coderabbitai Bot left a comment

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Actionable comments posted: 1

🤖 Prompt for all review comments with AI agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

Inline comments:
In `@src/components/ClinicalDashboard.tsx`:
- Around line 2658-2663: Update the searchParams/bootstrap handling in
ClinicalDashboard so URL-driven mode=favourites is validated with
favouritesAccessible before rendering or selecting FavouritesHub. When access is
unavailable, route through the existing account-setup fallback (or another
permitted mode), matching selectSearchMode’s behavior, while preserving
accessible favourites navigation.
🪄 Autofix (Beta)

Fix all unresolved CodeRabbit comments on this PR:

  • Push a commit to this branch (recommended)
  • Create a new PR with the fixes

ℹ️ Review info
⚙️ Run configuration

Configuration used: Path: .coderabbit.yaml

Review profile: CHILL

Plan: Pro Plus

Run ID: d7e565e8-9796-4954-b647-14a7d47ab550

📥 Commits

Reviewing files that changed from the base of the PR and between 274b40f and 1b24a07.

📒 Files selected for processing (13)
  • src/components/ClinicalDashboard.tsx
  • src/components/clinical-dashboard/ClinicalSidebar.tsx
  • src/components/clinical-dashboard/account-setup-dialog.tsx
  • src/components/clinical-dashboard/favourites-command-library-page.tsx
  • src/components/clinical-dashboard/global-search-shell.tsx
  • src/components/clinical-dashboard/master-search-header.tsx
  • src/components/clinical-dashboard/prior-answer-turn-surface.tsx
  • src/components/clinical-dashboard/use-favourites-access.ts
  • src/lib/app-modes.ts
  • tests/app-modes.test.ts
  • tests/favourites-auth-gate.dom.test.tsx
  • tests/favourites-auth-gate.test.ts
  • tests/ui-smoke.spec.ts

Comment on lines 2658 to +2663
function selectSearchMode(mode: AppModeId) {
if (mode === "favourites" && !favouritesAccessible) {
closeDashboardTransientSurfaces("accountSetup");
openAccountSetup("favourites");
return;
}

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

🔒 Security & Privacy | 🟠 Major | ⚡ Quick win

🧩 Analysis chain

🏁 Script executed:

#!/bin/bash
fd -i favourites-hub | xargs -I{} ast-grep outline {} --items all
rg -n "favouritesAccessible|canAccessFavouritesMode" src/components/clinical-dashboard/favourites-hub.tsx 2>/dev/null || echo "favourites-hub.tsx not found by that name; search broader"
rg -n "FavouritesHub" -g '*.tsx' -A2 -B2

Repository: BigSimmo/Database

Length of output: 1490


🏁 Script executed:

#!/bin/bash
set -euo pipefail

# Map relevant files and inspect the specific sections mentioned in the comment.
ast-grep outline src/components/ClinicalDashboard.tsx --items all | sed -n '1,220p'
printf '\n--- ClinicalDashboard around mode-sync / search-mode logic ---\n'
sed -n '2500,2745p' src/components/ClinicalDashboard.tsx
printf '\n--- ClinicalDashboard FavouritesHub rendering area ---\n'
sed -n '3725,3785p' src/components/ClinicalDashboard.tsx
printf '\n--- Favourites hub component outline ---\n'
ast-grep outline src/components/clinical-dashboard/favourites-hub.tsx --items all | sed -n '1,220p'
printf '\n--- Favourites hub access-related searches ---\n'
rg -n "favouritesAccessible|sign up to save favourites|account setup|openAccountSetup|useSavedRegistryFavourites|useDemoMode|isDemoMode|accessible" src/components/clinical-dashboard/favourites-hub.tsx src/components/ClinicalDashboard.tsx tests/favourites-hub-unavailable-controls.dom.test.tsx
printf '\n--- Favourites hub relevant top/mid sections ---\n'
sed -n '1,220p' src/components/clinical-dashboard/favourites-hub.tsx
printf '\n--- Favourites hub later sections ---\n'
sed -n '220,620p' src/components/clinical-dashboard/favourites-hub.tsx

Repository: BigSimmo/Database

Length of output: 46458


🏁 Script executed:

#!/bin/bash
set -euo pipefail

# Inspect the dashboard effects that react to search params / initial URL state.
rg -n "searchParams|window.location.search|setSearchMode\\(|appModeId|appModeVisible|modeSearchSubmitted|executeSearch\\(" src/components/ClinicalDashboard.tsx
printf '\n--- search-param/bootstrap effect region ---\n'
sed -n '1500,1825p' src/components/ClinicalDashboard.tsx
printf '\n--- executeSearch region around the unconditional setSearchMode ---\n'
sed -n '2560,2715p' src/components/ClinicalDashboard.tsx
printf '\n--- any favourites-specific route/guard helpers in dashboard ---\n'
rg -n "favouritesAccessible|openAccountSetup\\(\"favourites\"\\)|mode === \"favourites\"|appModeHomeHref\\(\"favourites\"|appModeVisible" src/components/ClinicalDashboard.tsx src/lib src/components/clinical-dashboard tests

Repository: BigSimmo/Database

Length of output: 25197


Guard dashboard URL-driven favourites navigation. searchParams/bootstrap handling in src/components/ClinicalDashboard.tsx still accepts mode=favourites without favouritesAccessible, so a signed-out non-demo user can land in the inline FavouritesHub even though the UI entry point is blocked. Add the same access check there and fall back to account setup or another mode.

🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

In `@src/components/ClinicalDashboard.tsx` around lines 2658 - 2663, Update the
searchParams/bootstrap handling in ClinicalDashboard so URL-driven
mode=favourites is validated with favouritesAccessible before rendering or
selecting FavouritesHub. When access is unavailable, route through the existing
account-setup fallback (or another permitted mode), matching selectSearchMode’s
behavior, while preserving accessible favourites navigation.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

2 participants