Release: develop -> main - #1235
Merged
Merged
Conversation
* feat(kyc): explain a staff KYC block and offer to start KYC
Staff endpoints now answer 403 { code: 'STAFF_KYC_REQUIRED' } when the role is fine but
the account behind it has not completed an identification. Surfacing that as a raw error
would leave staff with a bare 403 and no idea that their own KYC is what unblocks it.
useGuardedApi handles the code centrally, next to the existing TFA_REQUIRED redirect, so
every staff hook is covered rather than one dashboard. It routes to a screen that states
the role is unchanged, explains that the identification is missing, and offers a button
that starts the regular KYC onboarding via useKycHelper.
Translations added for de, fr and it.
* fix(kyc): reach every staff screen and stop the back-bounce
Review found that the handling did not reach every staff screen, contradicting the
comment this branch added. Six staff screens and the dashboard hook called useApi()
directly instead of useGuardedApi(), so they would keep showing a raw 403 - and they
already missed the 2FA redirect for the same reason, which the hook has required all
along. All seven now use the guarded call; each used only `call`, so this is a
one-to-one swap.
The redirect no longer stores the blocked path. Unlike 2FA, which resolves in one step,
the screen stays blocked until an identification is completed, so remembering it sent
the user straight back into the same 403. The regular KYC flow never consumes the stored
path either, so it would linger and misdirect a later goBack(). The Back button now goes
to the account page, which is reachable without staff clearance.
* fix(kyc): clear the stored redirect and correct the hook claim
Back now clears the stored redirect path explicitly. Dropping goBack() also dropped the
only place that cleared it, so a path set by an unrelated flow before the block would
survive the detour and misdirect a later consumer of that single slot.
Corrects the comment as well: it claimed every staff call goes through the guarded hook.
The staff data hooks and screens do, but individual SDK calls such as useKyc().getFile in
the compliance screens do not, and those still surface the error inline.
github-actions
Bot
requested review from
TaprootFreak and
davidleomay
as code owners
August 1, 2026 10:26
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Automatic Release PR
This PR was automatically created after changes were pushed to develop.
Commits: 1 new commit(s)
Checklist