(ctx context.Context, in *approveInput)
| 82 | } |
| 83 | |
| 84 | func (s *Server) handleApprove(ctx context.Context, in *approveInput) (*approveOutput, error) { |
| 85 | // HITL approval is an account-owner action. An agent-scoped credential |
| 86 | // approving its OWN held outbound is self-approval, which defeats the |
| 87 | // human-in-the-loop gate — so require account scope (403 for agent-scoped). |
| 88 | // The human magic-link flow is a separate, token-gated handler and is |
| 89 | // unaffected. |
| 90 | p, err := s.requireAccountScope(ctx) |
| 91 | if err != nil { |
| 92 | return nil, err |
| 93 | } |
| 94 | ag, err := s.resolveOwnedAgent(ctx, in.Address) |
| 95 | if err != nil { |
| 96 | return nil, err |
| 97 | } |
| 98 | view, err := s.approveHeld(ctx, p.User.ID, in.ID, ag.Email, in.Body, in.IdempotencyKey, in.RawBody) |
| 99 | if err != nil { |
| 100 | return nil, err |
| 101 | } |
| 102 | return &approveOutput{Body: view}, nil |
| 103 | } |
| 104 | |
| 105 | // approveHeld is the shared approve dispatch (used by the agent-path |
| 106 | // /messages/{id}/approve and the account-path /reviews/{id}/approve). The |
nothing calls this directly
no test coverage detected