Fix all unresolved CodeRabbit comments on this PR:

• Push a commit to this branch (recommended)
• Create a new PR with the fixes

packages/ui/src/components/OAuthConsent/OAuthConsent.tsx (2)

49-53: ⚠️ Potential issue | 🔴 Critical

Partial callback mode breaks one consent action.

Line 49 treats “either callback exists” as full context mode. Then Line 94 always prevents native submit, and Line 341 suppresses hidden fallback params. If only one callback is provided, the other button becomes a no-op.

Suggested fix

- const hasContextCallbacks = Boolean(ctx.onAllow || ctx.onDeny);
+ const hasAllowCallback = Boolean(ctx.onAllow);
+ const hasDenyCallback = Boolean(ctx.onDeny);
+ const hasBothContextCallbacks = hasAllowCallback && hasDenyCallback;

- const isPublicFlow = !hasContextCallbacks;
+ const isPublicFlow = !hasBothContextCallbacks;

  const handleSubmit = (e: React.FormEvent<HTMLFormElement>) => {
-   if (!hasContextCallbacks) {
-     return;
-   }
-   e.preventDefault();
    const submitter = (e.nativeEvent as SubmitEvent).submitter as HTMLButtonElement | null;
-   if (submitter?.value === 'true') {
-     ctx.onAllow?.();
-   } else {
-     ctx.onDeny?.();
-   }
+   const callback = submitter?.value === 'true' ? ctx.onAllow : ctx.onDeny;
+   if (!callback) {
+     return;
+   }
+   e.preventDefault();
+   callback();
  };

- {!hasContextCallbacks &&
+ {!hasBothContextCallbacks &&
    forwardedParams.map(([key, value]) => (
      <input key={key} type='hidden' name={key} value={value} />
    ))}

As per coding guidelines, “Highlight only issues that could cause runtime errors, data loss, or severe maintainability issues.”

Also applies to: 93-104, 341-349

🤖 Prompt for AI Agents

Verify each finding against the current code and only fix it if needed.

In `@packages/ui/src/components/OAuthConsent/OAuthConsent.tsx` around lines 49 -
53, The code treats "hasContextCallbacks" as true if either ctx.onAllow or
ctx.onDeny exists, which breaks the other action when only one callback is
provided; change the logic to require both callbacks (use both ctx.onAllow &&
ctx.onDeny) when deciding full-context behavior (adjust
hasContextCallbacks/isPublicFlow accordingly), update the submit handler (the
function that currently always prevents native submission) to only prevent
default when both callbacks are present, and stop suppressing the hidden
fallback params unless both callbacks exist so the fallback submit will work
when one callback is missing.

---

78-85: ⚠️ Potential issue | 🔴 Critical

Native POST auth is incomplete for development instances.

Line 83 explicitly leaves dev JWT forwarding as TODO. This keeps the dev consent POST path potentially unauthenticated and failing in development environments.

#!/bin/bash
set -euo pipefail

# Verify whether repo already has a canonical helper/field for dev browser JWT forwarding.
rg -n -C3 --type=ts --type=tsx 'dev_browser_jwt|devBrowserJWT|getDevBrowserJWT|CLERK_DEV_FRONTEND|frontendApi'

# Verify all OAuth consent POST action builders for consistency.
rg -n -C3 --type=ts --type=tsx '/v1/internal/oauth-consent'

As per coding guidelines, “Comment only when the issue must be resolved before merge, otherwise remain silent.”

🤖 Prompt for AI Agents

Verify each finding against the current code and only fix it if needed.

In `@packages/ui/src/components/OAuthConsent/OAuthConsent.tsx` around lines 78 -
85, The actionUrl builder currently omits forwarding the dev browser JWT,
causing dev POSTs to /v1/internal/oauth-consent to be unauthenticated; update
the IIFE that constructs actionUrl to detect development instances and append
the dev JWT (e.g., use the project's canonical helper such as getDevBrowserJWT
or devBrowserJWT if present, or read CLERK_DEV_FRONTEND token) as a query param
(e.g., dev_browser_jwt) when available, ensuring the URL includes
url.searchParams.set('_clerk_dev_browser_jwt', token) or the agreed param name;
reference the actionUrl constant and clerk.session usage so you add the token
only in dev contexts and do not change production behavior.

packages/ui/src/components/OAuthConsent/OAuthConsent.tsx (1)

55-57: ⚠️ Potential issue | 🔴 Critical

Require both context callbacks before switching out of the native POST flow.

A single onAllow or onDeny is enough to disable the public-flow fetch, suppress the hidden fallback inputs, and preventDefault() every submit. If a caller provides only one callback, the other button becomes a no-op instead of falling back to the native consent POST.

Suggested fix

-  // onAllow and onDeny are always provided as a pair by the accounts portal.
-  const hasContextCallbacks = Boolean(ctx.onAllow || ctx.onDeny);
+  const hasBothContextCallbacks = Boolean(ctx.onAllow && ctx.onDeny);
...
   const { data, isLoading, error } = useOAuthConsent({
     oauthClientId,
     scope,
     // TODO: Remove this once account portal is refactored to use this component
-    enabled: !hasContextCallbacks,
+    enabled: !hasBothContextCallbacks,
   });
...
   const handleSubmit = (e: React.FormEvent<HTMLFormElement>) => {
-    if (!hasContextCallbacks) {
-      return;
-    }
-    e.preventDefault();
     const submitter = (e.nativeEvent as SubmitEvent).submitter as HTMLButtonElement | null;
-    if (submitter?.value === 'true') {
-      ctx.onAllow?.();
-    } else {
-      ctx.onDeny?.();
+    const callback = submitter?.value === 'true' ? ctx.onAllow : ctx.onDeny;
+    if (!callback) {
+      return;
     }
+    e.preventDefault();
+    callback();
   };
...
-        {!hasContextCallbacks &&
+        {!hasBothContextCallbacks &&
           forwardedParams.map(([key, value]) => (
             <input
               key={key}
               type='hidden'
               name={key}
               value={value}
             />
           ))}
-        {!hasContextCallbacks && ctx.enableOrgSelection && selectedOrg && (
+        {!hasBothContextCallbacks && ctx.enableOrgSelection && selectedOrg && (
           <input
             type='hidden'
             name='organization_id'
             value={selectedOrg}
           />
         )}

Also applies to: 65-70, 131-141, 299-314

🤖 Prompt for AI Agents

Verify each finding against the current code and only fix it if needed.

In `@packages/ui/src/components/OAuthConsent/OAuthConsent.tsx` around lines 55 -
57, The current logic treats the presence of either ctx.onAllow or ctx.onDeny as
sufficient to disable the native POST flow; change this to require both
callbacks be provided before switching flows by replacing Boolean(ctx.onAllow ||
ctx.onDeny) with Boolean(ctx.onAllow && ctx.onDeny) (update the
hasContextCallbacks variable and any other places that check these callbacks),
and use that stricter condition in the form submit handler (where preventDefault
is called), in the rendering decision for the hidden fallback inputs, and in the
button click handlers so that if only one callback is present the component
remains in the native POST flow.

Fix all unresolved CodeRabbit comments on this PR:

• Push a commit to this branch (recommended)
• Create a new PR with the fixes

Fix all unresolved CodeRabbit comments on this PR:

• Push a commit to this branch (recommended)
• Create a new PR with the fixes