Skip to content

feat: unlock signing request approvals#1074

Merged
beeman merged 1 commit into
mainfrom
beeman/request-signing-unlock-ux
May 14, 2026
Merged

feat: unlock signing request approvals#1074
beeman merged 1 commit into
mainfrom
beeman/request-signing-unlock-ux

Conversation

@beeman
Copy link
Copy Markdown
Member

@beeman beeman commented May 12, 2026

Add a request-local unlock flow before signing approvals so locked password and PIN wallets prompt for credentials before resolving a signing request.

Wire the shared approval helper into sign message, sign transaction, sign and send transaction, and sign in request screens while leaving connect requests unchanged.


Open in Devin Review

Summary by CodeRabbit

  • New Features
    • Added a unified unlock dialog for signing/approval flows supporting Password, PIN, or Wallet modes.
    • Introduced a centralized approval flow used by sign-in, sign-message, sign-transaction, and send flows.
    • Improved button states and labels: “Checking...”, “Approving...”, disabled while busy, and “Unlocking...” during unlock.
    • Preserved existing reject behavior.

Review Change Stack

@coderabbitai
Copy link
Copy Markdown

coderabbitai Bot commented May 12, 2026

No actionable comments were generated in the recent review. 🎉

ℹ️ Recent review info
⚙️ Run configuration

Configuration used: defaults

Review profile: CHILL

Plan: Pro Plus

Run ID: 3370d2b6-c86f-425a-aa31-e686bd622b4a

📥 Commits

Reviewing files that changed from the base of the PR and between 23d77e8 and 69e4304.

⛔ Files ignored due to path filters (1)
  • bun.lock is excluded by !**/*.lock
📒 Files selected for processing (7)
  • packages/feature-request/package.json
  • packages/feature-request/src/data-access/use-request-sign-approval.tsx
  • packages/feature-request/src/ui/request-ui-sign-and-send-transaction.tsx
  • packages/feature-request/src/ui/request-ui-sign-in.tsx
  • packages/feature-request/src/ui/request-ui-sign-message.tsx
  • packages/feature-request/src/ui/request-ui-sign-transaction.tsx
  • packages/feature-request/src/ui/request-ui-unlock-dialog.tsx
✅ Files skipped from review due to trivial changes (1)
  • packages/feature-request/package.json
🚧 Files skipped from review as they are similar to previous changes (6)
  • packages/feature-request/src/ui/request-ui-unlock-dialog.tsx
  • packages/feature-request/src/ui/request-ui-sign-and-send-transaction.tsx
  • packages/feature-request/src/ui/request-ui-sign-in.tsx
  • packages/feature-request/src/ui/request-ui-sign-message.tsx
  • packages/feature-request/src/ui/request-ui-sign-transaction.tsx
  • packages/feature-request/src/data-access/use-request-sign-approval.tsx

📝 Walkthrough

Walkthrough

Adds a reusable useRequestSignApproval() hook and RequestUiUnlockDialog component, wires a react-query dependency, and updates request signing UI components to use the approval flow that mediates unlock-before-approve for signing actions.

Changes

Approval Flow Integration

Layer / File(s) Summary
Dependency and approval hook contract
packages/feature-request/package.json, packages/feature-request/src/data-access/use-request-sign-approval.tsx
@tanstack/react-query added as dependency. RequestUnlockMode type and RequestSignApproval controller interface exported, defining unlock modes (password/pin/unsecured) and public actions/state shape.
Approval hook implementation
packages/feature-request/src/data-access/use-request-sign-approval.tsx
Hook manages pending approval actions in a ref, uses approval and unlock mutations to determine if wallet unlock is required, tracks credential input and UI open/busy/checking/unlocking state, exposes action handlers for credential entry/submission/cancellation, and wraps approval execution with error reporting via toastError.
Unlock dialog component
packages/feature-request/src/ui/request-ui-unlock-dialog.tsx
Modal dialog for credential entry; wired to approval.actions.changeOpen, changeCredential, submitUnlock, and cancelUnlock. Input labeling/constraints and button states adapt to approval.state.mode and approval.state.isUnlocking; errors shown from approval.state.error.
Request UI component integrations
packages/feature-request/src/ui/request-ui-sign-*.tsx
RequestUiSignAndSendTransaction, RequestUiSignIn, RequestUiSignMessage, and RequestUiSignTransaction each instantiate useRequestSignApproval(), wrap their signing action in approval.approve(...), disable/relabel the Approve button based on approval.state.isBusy/isChecking/isApproving, and render RequestUiUnlockDialog with the approval controller.

Sequence Diagram

sequenceDiagram
  participant Component
  participant useRequestSignApproval
  participant ApprovalMutation
  participant UnlockMutation
  participant UnlockDialog
  participant SignService
  Component->>useRequestSignApproval: approve(signAction)
  useRequestSignApproval->>ApprovalMutation: mutate (check if unlock needed)
  ApprovalMutation->>useRequestSignApproval: need_unlock or immediate_success
  alt Unlock Required
    useRequestSignApproval->>UnlockDialog: open dialog
    UnlockDialog->>useRequestSignApproval: submitUnlock(credential)
    useRequestSignApproval->>UnlockMutation: mutate with credential
    UnlockMutation->>useRequestSignApproval: unlocked
  end
  useRequestSignApproval->>SignService: runApproval(signAction)
  SignService->>Component: resolve or error
Loading

Estimated code review effort

🎯 3 (Moderate) | ⏱️ ~20 minutes

Possibly related PRs

  • samui-build/samui-wallet#997: Related changes moving TanStack Query packages into the repository catalog and updating tanstack query dependencies.

Poem

A rabbit guards the vault tonight,
Soft paws tap keys in gentle light,
A hook, a dialog, coins in line—
Unlock, approve, then all is fine. 🐇🔐

🚥 Pre-merge checks | ✅ 3 | ❌ 2

❌ Failed checks (2 warnings)

Check name Status Explanation Resolution
Description check ⚠️ Warning The description explains the change and motivation, but is missing the linked issue reference and doesn't complete the checklist items as required by the template. Add 'Closes #<issue_number>' at the top, and complete the checklist by marking items as done or noting why they don't apply.
Docstring Coverage ⚠️ Warning Docstring coverage is 0.00% which is insufficient. The required threshold is 80.00%. Write docstrings for the functions missing them to satisfy the coverage threshold.
✅ Passed checks (3 passed)
Check name Status Explanation
Title check ✅ Passed The title 'feat: unlock signing request approvals' accurately describes the main change—adding an unlock flow before signing approvals.
Linked Issues check ✅ Passed Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check ✅ Passed Check skipped because no linked issues were found for this pull request.

✏️ Tip: You can configure your own custom pre-merge checks in the settings.

✨ Finishing Touches
📝 Generate docstrings
  • Create stacked PR
  • Commit on current branch
🧪 Generate unit tests (beta)
  • Create PR with unit tests
  • Commit unit tests in branch beeman/request-signing-unlock-ux

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

Comment @coderabbitai help to get the list of available commands and usage tips.

@bundlemon
Copy link
Copy Markdown

bundlemon Bot commented May 12, 2026

BundleMon

Files updated (4)
Status Path Size Limits
apps/extension/.output/chrome-mv3/chunks/inde
x.browser-(hash).js
9.13KB (+4.49KB +96.6%) -
apps/web/dist/assets/index.browser-(hash).js
4.65KB (+3.83KB +471.07%) -
apps/extension/.output/chrome-mv3/chunks/requ
est-(hash).js
2.86KB (+2.13KB +290.4%) -
apps/web/dist/assets/request-(hash).js
2.85KB (+2.13KB +292.08%) -
Unchanged files (71)
Status Path Size Limits
apps/web/dist/assets/index-(hash).js
300.54KB -
apps/extension/.output/chrome-mv3/chunks/clie
nt-(hash).js
275.73KB -
apps/web/dist/assets/combobox-(hash).js
45.75KB -
apps/extension/.output/chrome-mv3/chunks/comb
obox-(hash).js
45.74KB -
apps/web/dist/assets/toggle-(hash).js
27.61KB -
apps/extension/.output/chrome-mv3/chunks/togg
le-(hash).js
27.59KB -
apps/extension/.output/chrome-mv3/chunks/sett
ings-(hash).js
26.08KB -
apps/web/dist/assets/settings-(hash).js
26.08KB -
apps/extension/.output/chrome-mv3/chunks/form
-(hash).js
13.17KB -
apps/web/dist/assets/form-(hash).js
13.16KB -
apps/web/dist/assets/select-(hash).js
8.54KB -
apps/extension/.output/chrome-mv3/chunks/sele
ct-(hash).js
8.54KB -
apps/extension/.output/chrome-mv3/chunks/onbo
arding-(hash).js
5.83KB -
apps/web/dist/assets/onboarding-(hash).js
5.83KB -
apps/extension/.output/chrome-mv3/chunks/crea
te-(hash).js
4.56KB -
apps/web/dist/assets/create-(hash).js
4.55KB -
apps/extension/.output/chrome-mv3/chunks/cons
tants-(hash).js
3.6KB -
apps/web/dist/assets/constants-(hash).js
3.6KB -
apps/extension/.output/chrome-mv3/chunks/useQ
uery-(hash).js
3.12KB -
apps/web/dist/assets/useQuery-(hash).js
3.12KB -
apps/extension/.output/chrome-mv3/assets/vani
ty-(hash).js
2.79KB -
apps/web/dist/assets/vanity-(hash).js
2.79KB -
apps/web/dist/assets/portfolio-(hash).js
2.69KB -
apps/extension/.output/chrome-mv3/chunks/port
folio-(hash).js
2.69KB -
apps/extension/.output/chrome-mv3/chunks/send
-(hash).js
2.46KB -
apps/web/dist/assets/send-(hash).js
2.46KB -
apps/extension/.output/chrome-mv3/chunks/drop
down-(hash).js
2.16KB -
apps/web/dist/assets/dropdown-(hash).js
2.16KB -
apps/extension/.output/chrome-mv3/chunks/chec
kbox-(hash).js
1.89KB -
apps/web/dist/assets/checkbox-(hash).js
1.88KB -
apps/web/dist/assets/tools-(hash).js
1.84KB -
apps/extension/.output/chrome-mv3/chunks/tool
s-(hash).js
1.84KB -
apps/extension/.output/chrome-mv3/chunks/expl
orer-(hash).js
1.52KB -
apps/web/dist/assets/explorer-(hash).js
1.52KB -
apps/web/dist/assets/badge-(hash).js
769B -
apps/extension/.output/chrome-mv3/chunks/badg
e-(hash).js
767B -
apps/web/dist/assets/zod-(hash).js
767B -
apps/extension/.output/chrome-mv3/chunks/zod-
(hash).js
763B -
apps/web/dist/assets/standard-(hash).js
654B -
apps/extension/.output/chrome-mv3/chunks/stan
dard-(hash).js
653B -
apps/extension/.output/chrome-mv3/chunks/tabl
e-(hash).js
596B -
apps/web/dist/assets/table-(hash).js
592B -
apps/web/dist/assets/button-(hash).js
579B -
apps/extension/.output/chrome-mv3/chunks/butt
on-(hash).js
574B -
apps/extension/.output/chrome-mv3/chunks/book
mark-(hash).js
555B -
apps/web/dist/assets/bookmark-(hash).js
549B -
apps/web/dist/assets/ui-(hash).js
526B -
apps/extension/.output/chrome-mv3/chunks/ui-(
hash).js
525B -
apps/extension/.output/chrome-mv3/chunks/text
area-(hash).js
497B -
apps/web/dist/assets/textarea-(hash).js
494B -
apps/web/dist/assets/dev-(hash).js
278B -
apps/extension/.output/chrome-mv3/chunks/dev-
(hash).js
274B -
apps/web/dist/assets/use-(hash).js
228B -
apps/extension/.output/chrome-mv3/chunks/use-
(hash).js
226B -
apps/extension/.output/chrome-mv3/chunks/side
panel-(hash).js
202B -
apps/extension/.output/chrome-mv3/chunks/popu
p-(hash).js
201B -
apps/extension/.output/chrome-mv3/chunks/inde
x-(hash).js
173B -
apps/extension/.output/chrome-mv3/chunks/form
at-(hash).js
166B -
apps/web/dist/assets/format-(hash).js
166B -
apps/extension/.output/chrome-mv3/chunks/sol-
(hash).js
149B -
apps/web/dist/assets/sol-(hash).js
148B -
apps/extension/.output/chrome-mv3/chunks/elli
psify-(hash).js
145B -
apps/web/dist/assets/ellipsify-(hash).js
145B -
apps/web/dist/assets/chevron-(hash).js
142B -
apps/extension/.output/chrome-mv3/chunks/chev
ron-(hash).js
141B -
apps/extension/.output/chrome-mv3/chunks/stri
ngify-(hash).js
139B -
apps/web/dist/assets/stringify-(hash).js
138B -
apps/extension/.output/chrome-mv3/chunks/toas
t-(hash).js
137B -
apps/web/dist/assets/toast-(hash).js
137B -
apps/extension/.output/chrome-mv3/chunks/netw
ork-(hash).js
121B -
apps/web/dist/assets/network-(hash).js
121B -

Total files change +12.49KB +1.38%

Groups updated (2)
Status Path Size Limits
apps/web/dist/**/*-.js
584.27KB (+2.07KB +0.36%) -
apps/extension/.output/chrome-mv3/**/*-
.js
558.94KB (+2.03KB +0.36%) -

Final result: ✅

View report in BundleMon website ➡️


Current branch size history | Target branch size history

@cloudflare-workers-and-pages
Copy link
Copy Markdown

cloudflare-workers-and-pages Bot commented May 12, 2026

Deploying with  Cloudflare Workers  Cloudflare Workers

The latest updates on your project. Learn more about integrating Git with Workers.

Status Name Latest Commit Preview URL Updated (UTC)
✅ Deployment successful!
View logs
samui-wallet-api 69e4304 Commit Preview URL

Branch Preview URL
May 12 2026, 01:41 PM

Copy link
Copy Markdown

@coderabbitai coderabbitai Bot left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

🧹 Nitpick comments (1)
packages/feature-request/src/ui/request-ui-unlock-dialog.tsx (1)

54-63: 💤 Low value

Optional cleanup: unreachable 'unsecured' case.

The 'unsecured' case in getCredentialLabel is unreachable because the approval hook (lines 42-47 in use-request-sign-approval.tsx) handles unsecured wallets by auto-unlocking with an empty credential and never opening the dialog. This is defensive code that doesn't harm functionality but could be removed for clarity.

♻️ Optional simplification
 function getCredentialLabel(mode: RequestUnlockMode): string {
   switch (mode) {
     case 'password':
       return 'Password'
     case 'pin':
       return 'PIN'
-    case 'unsecured':
-      return 'Wallet'
   }
 }

Alternatively, keep it as defensive programming if there's any possibility of future logic changes.

🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

In `@packages/feature-request/src/ui/request-ui-unlock-dialog.tsx` around lines 54
- 63, The switch in getCredentialLabel contains an unreachable 'unsecured'
branch; remove that case from the function so only the actual RequestUnlockMode
values handled ('password' and 'pin') are returned (update getCredentialLabel to
have just the two cases and a default/fallback if desired), referencing the
getCredentialLabel function and the RequestUnlockMode type to locate the code;
if you prefer defensive coding instead, add an explicit default that throws or
logs instead of keeping the unreachable 'unsecured' branch.
🤖 Prompt for all review comments with AI agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

Nitpick comments:
In `@packages/feature-request/src/ui/request-ui-unlock-dialog.tsx`:
- Around line 54-63: The switch in getCredentialLabel contains an unreachable
'unsecured' branch; remove that case from the function so only the actual
RequestUnlockMode values handled ('password' and 'pin') are returned (update
getCredentialLabel to have just the two cases and a default/fallback if
desired), referencing the getCredentialLabel function and the RequestUnlockMode
type to locate the code; if you prefer defensive coding instead, add an explicit
default that throws or logs instead of keeping the unreachable 'unsecured'
branch.

ℹ️ Review info
⚙️ Run configuration

Configuration used: defaults

Review profile: CHILL

Plan: Pro Plus

Run ID: b5f4e97a-e6e0-4f12-ae33-e5f66262df94

📥 Commits

Reviewing files that changed from the base of the PR and between 3dbba25 and 23d77e8.

⛔ Files ignored due to path filters (1)
  • bun.lock is excluded by !**/*.lock
📒 Files selected for processing (7)
  • packages/feature-request/package.json
  • packages/feature-request/src/data-access/use-request-sign-approval.tsx
  • packages/feature-request/src/ui/request-ui-sign-and-send-transaction.tsx
  • packages/feature-request/src/ui/request-ui-sign-in.tsx
  • packages/feature-request/src/ui/request-ui-sign-message.tsx
  • packages/feature-request/src/ui/request-ui-sign-transaction.tsx
  • packages/feature-request/src/ui/request-ui-unlock-dialog.tsx

@cloudflare-workers-and-pages
Copy link
Copy Markdown

cloudflare-workers-and-pages Bot commented May 12, 2026

Deploying with  Cloudflare Workers  Cloudflare Workers

The latest updates on your project. Learn more about integrating Git with Workers.

Status Name Latest Commit Preview URL Updated (UTC)
✅ Deployment successful!
View logs
samui-wallet-web 69e4304 Commit Preview URL

Branch Preview URL
May 12 2026, 01:42 PM

Copy link
Copy Markdown

@chatgpt-codex-connector chatgpt-codex-connector Bot left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

💡 Codex Review

Here are some automated review suggestions for this pull request.

Reviewed commit: 23d77e8366

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

  • Open a pull request for review
  • Mark a draft as ready
  • Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".

Comment thread packages/feature-request/src/data-access/use-request-sign-approval.tsx Outdated
Copy link
Copy Markdown

@devin-ai-integration devin-ai-integration Bot left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Devin Review found 2 potential issues.

View 3 additional findings in Devin Review.

Open in Devin Review

Comment thread packages/feature-request/src/data-access/use-request-sign-approval.tsx Outdated
Comment thread packages/feature-request/src/data-access/use-request-sign-approval.tsx Outdated
Add a request-local unlock flow before signing approvals so locked password and PIN wallets prompt for credentials before resolving a signing request.

Wire the shared approval helper into sign message, sign transaction, sign and send transaction, and sign in request screens while leaving connect requests unchanged.
@beeman beeman force-pushed the beeman/request-signing-unlock-ux branch from 23d77e8 to 69e4304 Compare May 12, 2026 13:37
Copy link
Copy Markdown
Member Author

beeman commented May 12, 2026

@codex review

Copy link
Copy Markdown
Member Author

beeman commented May 12, 2026

@coderabbitai review

@coderabbitai
Copy link
Copy Markdown

coderabbitai Bot commented May 12, 2026

✅ Actions performed

Review triggered.

Note: CodeRabbit is an incremental review system and does not re-review already reviewed commits. This command is applicable only when automatic reviews are paused.

@chatgpt-codex-connector
Copy link
Copy Markdown

Codex Review: Didn't find any major issues. Already looking forward to the next diff.

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

  • Open a pull request for review
  • Mark a draft as ready
  • Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".

@beeman beeman merged commit 69e4304 into main May 14, 2026
22 checks passed
@beeman beeman deleted the beeman/request-signing-unlock-ux branch May 14, 2026 12:21
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant