Say a wrong claim link finds no sandbox, and load the claim page again when Back restores it#2192

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review" or "@codex security review".

Codex reacts with 👀 while any review is running, comments if it has suggestions, and reacts with 👍 once all reviews finish with no findings.

⚙️ Run configuration

• Configuration used: Organization UI
• Review profile: CHILL
• Plan: Advanced
• Run ID: da0566bc-74ba-49ab-be45-ec6c738dc9c2

📥 Commits

Reviewing files that changed from the base of the PR and between 03c670edd484d8f946fb7fe8e1e0ab2772bda059 and dd65cd5b1eb3e6081bea9a572bcb31759052c22b.

📒 Files selected for processing: 5

• dashboard/src/modules/identity/claim.server.postgres.test.ts
• dashboard/src/modules/identity/claim.server.ts
• dashboard/src/routes/claim/$secret.tsx
• dashboard/src/routes/claim/-components/use-restored.test.tsx
• dashboard/src/routes/claim/-components/use-restored.ts

Included review availability: This review used your included allowance. Your plan provides up to 10 included reviews per hour; 1 remain after this review.

Summary by CodeRabbit

• Bug Fixes
  • Invalid or altered claim links now show a not-found message instead of an expired-link message.
  • Claim pages now refresh when restored from browser history, helping ensure the displayed claim status is current.
  • Not-found guidance directs signed-in visitors to Cloud and other visitors to sign in.

The claim flow now distinguishes unknown secrets from retired secrets. The claim page renders a not-found view for unknown secrets and reloads when the browser restores a persisted page.

Changes: Claim flow

Layer / File(s)	Summary
Classify claim secrets dashboard/src/modules/identity/claim.server.ts, dashboard/src/modules/identity/claim.server.postgres.test.ts	Secret lookup distinguishes unknown secrets from retired secrets. readClaim maps these results to not_found and expired, and claim tests cover invalid and tampered secrets.
Handle not-found claims and restored pages dashboard/src/routes/claim/$secret.tsx, dashboard/src/routes/claim/-components/use-restored.ts, dashboard/src/routes/claim/-components/use-restored.test.tsx	The claim page renders a not-found view with links based on sign-in status. The useRestored hook reloads on persisted pageshow events and removes its listener during cleanup. Its test checks persisted and non-persisted events and unmount behavior.

Priority: ➖ Normal

Estimated code review effort: 2 (Simple) | ~10 minutes

Change: Bug fix

The claim-page changes appear mergeable after normal checks; no concrete outstanding issue is identified.

The changes are narrowly scoped. Unknown links reveal no organization details, retired links remain unable to claim a sandbox, and ownership-transfer protections remain in place. Browser restoration repeats an existing session-checked flow rather than granting new authority.

Retained concerns No architecture-level concerns identified.

Security review details

Security Blast Radius

• inferred — The changed public response exposes a lifecycle distinction for a supplied candidate capability, not an organization identifier or cross-organization listing. A retired matching capability receives expired; an unmatched capability receives not_found. Neither response includes organization details or authorizes transfer.

Trust Boundaries and Controls

• observed — The read path obtains identity from the current server session. Automatic sign-in completion requires a non-anonymous session and a recent cookie matching the presented secret's hash; the handler deletes that cookie when consumed. Explicit Keep retains actor middleware. Restoration adds no alternative identity source or admission rule.

Resilience and Maintainability Implications

• observed — The existing transfer locks the organization and member rows, revalidates admission, and performs ownership, credential, anonymous-user, session, and sign-in cleanup within one database transaction. An already-claimed member returns without repeating transfer writes; another actor is refused. Inspected tests assert repetition stability, concurrent-claim serialization, expiry refusal, and rotation rejection. Rollback remains delegated to the unchanged transaction implementation rather than demonstrated by per-write failure injection.

^Failed Failed checks: 1 warning

Check name	Status	Explanation	Resolution
Docstring Coverage	Warning	Docstring coverage is 20.00% which is insufficient. The required threshold is 80.00%. Docstring coverage is scoped to functions touched by this diff. Analyzed 5 functions across 5 files.	Write docstrings for the functions missing them to satisfy the coverage threshold.

^Passed Passed checks: 4 passed

Check name	Status	Explanation
Title check	Passed	The title clearly summarizes both main changes: invalid claim links show no sandbox, and the claim page reloads after back-forward cache restoration.
Description check	Passed	The description directly explains the claim-state correction, the useRestored behavior, the tests, and the reported verification steps.
Linked Issues check	Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	Passed	Check skipped because no linked issues were found for this pull request.

📝 Generate docstrings: 💡

• Commit to this branch
• Create a new PR

🧪 Generate unit tests (beta)

• Commit to this branch
• Create a new PR