fix(consent): store no consent on a flow that can never record one

[rohanchkrabrty]

Summary

• The consent block went onto flows.metadata whenever a caller sent accepted_document_ids, with no check on whether the deployment asks for consent, or whether the intent could ever produce a record.
• A deployment with app.consent disabled, and a login under any config, therefore persisted unvalidated client ids alongside the caller's IP and a timestamp under a key named consent — for a record that is never written.
• gateFlowConsent already resolves the ids, so it now returns what they resolved to and the write is keyed off that. Nothing resolves with consent disabled, on a login, or with the service unwired, so none of the three carries a block.
• The enabled paths are unchanged: a signup carrying a complete set, and an unspecified intent carrying known ids, both still resolve non-empty and still carry the block through to user creation.
• user_consents and audit_records needed no change — both are reachable only through the branch createUser takes when ResolveAll returns documents, which is empty when consent is disabled.

[vercel]

The latest updates on your projects. Learn more about Vercel for GitHub.

Project	Deployment	Actions	Updated
frontier	Ready	Preview	Sep 3, 2026 5:29pm UTC

[coderabbitai]

Important

Review skipped

Auto reviews are disabled on base/target branches other than the default branch.

Please check the settings in the CodeRabbit UI or the .coderabbit.yaml file in this repository. To trigger a single review, invoke the @coderabbitai review command.

⚙️ Run configuration

Configuration used: Path: .coderabbit.yaml

Review profile: CHILL

Plan: Team

Run ID: c91e5c41-211d-4638-b132-cecd67f9d4f5

You can disable this status message by setting the reviews.review_status to false in the CodeRabbit configuration file.

Use the checkbox below for a quick retry:

• 🔍 Trigger review

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}

[coveralls]

Coverage Report for CI Build 33784841320

Coverage decreased (-0.08%) to 50.138%

Details

• Coverage decreased (-0.08%) from the base build.
• Patch coverage: 10 of 10 lines across 1 file are fully covered (100%).
• 43 coverage regressions across 1 file.

Uncovered Changes

No uncovered changes found.

Coverage Regressions

43 previously-covered lines in 1 file lost coverage.

File	Lines Losing Coverage	Coverage
pkg/db/db.go	43	24.39%

---

Coverage Stats

Relevant Lines:	41081
Covered Lines:	20597
Line Coverage:	50.14%
Coverage Strength:	15.98 hits per line

---

💛 - Coveralls