fix(consent): send CSRF token on agent auth-request approve/deny

[jaylfc]

ConsentActions used a plain fetch() with no X-CSRF-Token header, so every external-agent access approval/denial (bell notification, toast, Decisions app) failed with 'CSRF token missing'. Wraps the fetch init in withCsrf() like AgentKillSwitch. tsc clean. Unblocks the whole agent consent flow.

---

Summary by Gitar

• New doc-review system:
  • Added DocReviewStore for tracking document states (awaiting_review, approved, changes_requested) with SQL persistence.
  • Implemented project_doc_review API routes for managing state transitions and actor tracking.
• UI integration:
  • Integrated ReviewBadge into FilesApp to display and cycle review states for project documents.
• Security:
  • Added _AGENT_DOC_REVIEW_ROUTES allowlist and middleware gating to ensure agents can only access doc-review routes for their scoped projects.
• Testing:
  • Added comprehensive test_doc_review.py covering state transitions, actor recording, and security gating (scoped tokens vs 404/403 scenarios).

_{This will update automatically on new commits.}

Summary by CodeRabbit

• Bug Fixes
  • Improved security handling for consent approval and denial requests.
  • Preserved existing request details while ensuring required CSRF protection is applied.

[qodo-code-review]

Qodo reviews are paused for this user.

Troubleshooting steps vary by plan Learn more →

On a Teams plan?
Reviews resume once this user has a paid seat and their Git account is linked in Qodo.
Link Git account →

Using GitHub Enterprise Server, GitLab Self-Managed, or Bitbucket Data Center?
These require an Enterprise plan - Contact us
Contact us →

[coderabbitai]

Caution

Review failed

The pull request is closed.

ℹ️ Recent review info

⚙️ Run configuration

Configuration used: Path: .coderabbit.yaml

Review profile: CHILL

Plan: Pro Plus

Run ID: 66e1534a-b64f-4cfd-b7ab-3e4403ba9a5f

📥 Commits

Reviewing files that changed from the base of the PR and between af97986 and b49844e.

📒 Files selected for processing (1)

• desktop/src/components/ConsentActions.tsx

---

📝 Walkthrough

Walkthrough

Changes

Consent decision request

Layer / File(s)	Summary
Wrap consent POST with CSRF handling desktop/src/components/ConsentActions.tsx	The approve/deny POST options are passed through withCsrf, preserving the request body and included credentials.

Estimated code review effort: 2 (Simple) | ~5 minutes

Possibly related PRs

• jaylfc/taOS#1777: Updates the same consent decision payload in ConsentActions.tsx.

✨ Finishing Touches

📝 Generate docstrings

• Create stacked PR
• Commit on current branch

🧪 Generate unit tests (beta)

• Create PR with unit tests
• Commit unit tests in branch fix/consent-actions-csrf

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}

[gitar-bot]

Important

You are using the Gitar free plan. Upgrade to unlock code review, CI analysis, auto-apply, custom automations, and more.

_Gitar

[kilo-code-bot]

Code Review Summary

Status: No Issues Found | Recommendation: Merge

Files Reviewed (1 files)

• desktop/src/components/ConsentActions.tsx

---

_{Reviewed by hy3:free · Input: 37.7K · Output: 1.5K · Cached: 97.5K}