fix(consent): store no consent on a flow that can never record one

[rohanchkrabrty]

Summary

• The consent block went onto flows.metadata whenever a caller sent accepted_document_ids, with no check on whether the deployment asks for consent, or whether the intent could ever produce a record.
• A deployment with app.consent disabled, and a login under any config, therefore persisted unvalidated client ids alongside the caller's IP and a timestamp under a key named consent — for a record that is never written.
• gateFlowConsent already resolves the ids, so it now returns what they resolved to and the write is keyed off that. Nothing resolves with consent disabled, on a login, or with the service unwired, so none of the three carries a block.
• The enabled paths are unchanged: a signup carrying a complete set, and an unspecified intent carrying known ids, both still resolve non-empty and still carry the block through to user creation.
• user_consents and audit_records needed no change — both are reachable only through the branch createUser takes when ResolveAll returns documents, which is empty when consent is disabled.

[vercel]

The latest updates on your projects. Learn more about Vercel for GitHub.

Project	Deployment	Actions	Updated
frontier	Ready	Preview	Sep 7, 2026 7:59pm UTC

[coderabbitai]

Warning

Review limit reached

Next included review available in 55 minutes.

Check out review usage here.

View limit details

Limit details: You’ve used all 2 included reviews currently available.

You've used all free OSS reviews for now. Wait for the free limit to reset to keep reviewing this public repository.

Learn how review limits work.

Review configuration:

⚙️ Run configuration

Configuration used: Path: .coderabbit.yaml

Review profile: CHILL

Plan: Team

Run ID: ee8c5115-3418-45ad-9eb6-36c51fb5f29a

📥 Commits

Reviewing files that changed from the base of the PR and between e4b1cae and 8cfce91.

📒 Files selected for processing (2)

• core/authenticate/service.go
• core/authenticate/service_test.go

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}

[coveralls]

Coverage Report for CI Build 34157634130

Coverage increased (+0.002%) to 50.214%

Details

• Coverage increased (+0.002%) from the base build.
• Patch coverage: 10 of 10 lines across 1 file are fully covered (100%).
• No coverage regressions found.

Uncovered Changes

No uncovered changes found.

Coverage Regressions

No coverage regressions found.

---

Coverage Stats

Relevant Lines:	41086
Covered Lines:	20631
Line Coverage:	50.21%
Coverage Strength:	16.0 hits per line

---

💛 - Coveralls