SMOODEV-3066: carry the OTP proof on the widget's resume probe - #56
Open
brentrager wants to merge 1 commit into
Open
SMOODEV-3066: carry the OTP proof on the widget's resume probe#56brentrager wants to merge 1 commit into
brentrager wants to merge 1 commit into
Conversation
…ssion eats it The identity-scoped resume (SMOODEV-3066) lets a CRM-linked participant match when the caller proves the same contact, via optional verifiedSessionId + email on the probe. Both fields already sit in the widget store. The ordering is the part that bites: clearSession() drops the session-scoped OTP proof by design, and both probe sites (dead pointer, dead-session recovery) call it before probing — so reading the proof afterwards would always find nothing, silently, on exactly the visitors the server change exists to help. Read first. chat-ws parses this body as an untyped JSON value, so the new fields are ignored by the wrapper running today and this can land before the server half. Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
🦋 Changeset detectedLatest commit: 010e04f The changes in this PR will be included in the next version bump. This PR includes changesets to release 1 package
Not sure what this means? Click here to learn what changesets are. Click here if you're a maintainer who wants to add another changeset to this PR |
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
What
Follow-up to #54 (merged, released as part of 🦋 #55). This is the client half of
the SMOODEV-3066 identity-scoped resume: the fingerprint probe now carries
the browser's OTP proof so the server can allow a CRM-linked match for the
same contact.
Both new fields are optional and meaningful only together — the widget already
holds both in its store (
verifiedEmail,verifiedEmailSessionId). The serverdoes not trust the email; it re-reads its own verification row, which expires 30
minutes after the OTP.
Lands safely before the server half.
chat-wsparses this body as anuntyped
Json<Value>(rust/chat-ws/src/routes.rs:279-283), so the wrapperrunning today ignores both fields.
The ordering is the actual bug
clearSession()drops the session-scoped OTP proof by design, and bothprobe sites — the dead pointer (#54) and dead-session recovery (#54) — call it
before probing. Reading the proof afterwards would always find nothing,
silently, on exactly the population the server change exists to help: identified
visitors.
So it is read first, and a test fails if that is ever reordered. Positive
control: moving the read back after
clearSession()failscarries the OTP proof on the probe — including after a dead pointer clears itand nothing else.
Also pinned from the SMOODEV-3066 contract
No code needed for these — this client never parses
reason, it logs andexposes the string verbatim and starts fresh on anything that is not
resumable: true. Two tests pin that it stays true:without a client release
Not built
The
identity_required→ offer OTP → re-probe flow. It is multi-step UI, inertuntil the server half is live, and a product decision (when to interrupt a
visitor with a verification prompt). The reason string already reaches the UI
layer, so it is a small addition when someone wants it.
Shipping
Same three steps as #54 — merge → merge the 🦋 release PR → bump
CHAT_WIDGET_VERSIONin the monorepo'sapps/web/lib/smantha.ts. The pin bumpis not done here.
Jira: SMOODEV-3066 (server half:
rust/chat-storage+rust/chat-ws, byidentity-resume)
Follows: #54
🤖 Generated with Claude Code