fix(FE-567): add approve/reject to API request detail page#569
Merged
Conversation
A reviewer/admin opening a PENDING_REVIEW API request at /api-requests/:id previously found only Execute/Cancel and no way to action it, so the request appeared stuck. Add an inline approve/reject comment modal (reusing the ApiReviewQueuePage pattern and the existing approveApiReview/rejectApiReview API layer), gated by canDecide (REVIEWER/ADMIN, PENDING_REVIEW, not the submitter). Reuses existing apiGov.reviews.* i18n keys (no new keys). Adds an e2e spec (analyst submits a write op -> PENDING_REVIEW -> admin approves from the detail page) plus grant/submit e2e helpers, and updates docs/06-frontend.md. Closes #567
Contributor
Contributor
Coverage Report for Frontend Coverage (frontend)
File CoverageNo changed files found. |
The grant-permission call 500'd because the invitation response carries the
invitation id, not the user id. Resolve the submitter's real user id via
GET /api/v1/me before granting. Also poll GET /api-requests/{id} for
PENDING_REVIEW instead of asserting the async submit response.
The grant body omitted can_break_glass; Jackson 3 maps the absent primitive boolean constructor param to null and fails (FAIL_ON_NULL_FOR_PRIMITIVES), returning 500. Send all three booleans explicitly, matching the frontend.
After approval, 'Approved' renders both in the StatusPill and the decisions table, tripping strict-mode. Scope the assertion to .af-pill.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Closes #567
Problem
A reviewer/admin opening a
PENDING_REVIEWAPI request (apigov / AF-500) from/api-requests→/api-requests/:idhit a dead-end: the detail page rendered only Execute (whenAPPROVED) and Cancel (when pending), with no approve/reject action and no link to the/api-reviewsqueue. The request looked unactionable and appeared stuck inPENDING_REVIEW.Fix (frontend-only)
The backend endpoints (
POST /api/v1/api-reviews/{id}/{approve,reject}) and the frontend API layer (approveApiReview/rejectApiReview) already existed — this wires up the UI.frontend/src/pages/apigov/ApiRequestDetailPage.tsx:ApiReviewQueuePageso the two apigov review surfaces behave identically.canDecide= (REVIEWER/ADMIN) &&PENDING_REVIEW&&submitted_by !== user.id(self-approval also blocked server-side).@Size(max=2000), no@NotBlank— and the queue page), so validation parity holds.!canDecide(a reviewer isn't the submitter, so it wouldn't apply) — the submitter path is unchanged.apiGov.reviews.*block, avoiding 7-locale parity work.E2E (per the e2e-parity rule for new user-facing flows)
e2e/tests/api-request-review.spec.ts: an ANALYST (grantedcan_write) submits a write op → routes toPENDING_REVIEW(defaultrequire_review_writes=true, AI skipped with no ai_config) → the admin approves from the detail page and the status flips toAPPROVED.e2e/helpers/apiConnectors.ts:grantApiConnectorPermissionViaApi,submitApiRequestViaApi.Docs
docs/06-frontend.md— the/api-requests/:idrow now notes the inline reviewer approve/reject modal.docs/04-api-spec.md— no change (endpoints already documented).Deferred
The "link the detail/list view to
/api-reviews" follow-up from the issue is out of scope — the inline actions resolve the dead-end directly.Verification
npm run lint(0 errors),npm run typecheck,npm run test:coverage(1128 tests pass, coverage above thresholds),npm run build— all green.e2eCI job runs the new spec.