Method handleApproveMagicLinkGet

internal/agent/hitl_magic_api.go:30–32

The magic-link flow is split into GET (render a confirmation page) and POST (execute the action). This keeps email-client URL scanners — Gmail, Outlook Safe Links, Slack unfurls, corporate mail gateways — from accidentally approving or rejecting on behalf of the reviewer when they preview the link.

(w http.ResponseWriter, r *http.Request)

// --- GET confirmation pages ---

func (a *API) handleApproveMagicLinkGet(w http.ResponseWriter, r *http.Request) {
	a.renderConfirmPage(w, r, approvaltoken.ActionApprove)
}

func (a *API) handleRejectMagicLinkGet(w http.ResponseWriter, r *http.Request) {
	a.renderConfirmPage(w, r, approvaltoken.ActionReject)