Method renderConfirmPage

internal/agent/hitl_magic_api.go:43–76

renderConfirmPage validates the token, loads the pending message, and renders an HTML page with a POST form targeting the same endpoint. The body preview lives on this page — not in the notification email — so sensitive content stays behind a token-gated server render rather than passing through the

(w http.ResponseWriter, r *http.Request, endpointAction string)

// so sensitive content stays behind a token-gated server render rather
// than passing through the reviewer's mail infrastructure.
func (a *API) renderConfirmPage(w http.ResponseWriter, r *http.Request, endpointAction string) {
	if a.approvalSigner == nil {
		http.NotFound(w, r)
		return
	}
	token := r.URL.Query().Get("t")
	claims, status, errMsg := a.verifyMagicToken(token, endpointAction)
	if errMsg != "" {
		writeMagicMessage(w, status, pageTitleForAction(endpointAction, "Invalid link"), errMsg)
		return
	}

	// Load message via ownership-scoped read so the confirmation page
	// surfaces the real detail (recipients, subject, body preview).
	userID, _, err := a.store.ResolveOutboundOwner(r.Context(), claims.MessageID)
	if err != nil {
		writeMagicMessage(w, http.StatusNotFound, "Message not found",
			"This message no longer exists.")
		return
	}
	msg, err := a.store.GetOutboundMessageForUser(r.Context(), claims.MessageID, userID)
	if err != nil {
		writeMagicMessage(w, http.StatusNotFound, "Message not found",
			"This message no longer exists.")
		return
	}
	if msg.Status != identity.MessageStatusPendingReview {
		writeMagicMessage(w, http.StatusConflict, "Already resolved",
			"This message has already been approved, rejected, or expired.")
		return
	}

	writeConfirmPage(w, http.StatusOK, endpointAction, token, msg)
}

// --- POST executors ---