feat(card): geo-blocked state — stop prohibited-country users before the apply funnel - #2620
Open
jjramirezn wants to merge 6 commits into
Open
feat(card): geo-blocked state — stop prohibited-country users before the apply funnel#2620jjramirezn wants to merge 6 commits into
jjramirezn wants to merge 6 commits into
Conversation
…the apply funnel The /card state machine ignored country eligibility: users from Rain's prohibited-issuance countries were teased with the press-and-hold "see if you qualify" gate and could run the whole KYC funnel before Rain rejected them. - computeCardState: new 'geo-blocked' state, keyed on BE's new geoProhibited field (country KNOWN and prohibited — never blocks on unknown, so pre-KYC users still enter). Scoped to users with no existing application: in-flight/rejected rails keep their truthful state and the re-issue path stays untouched, mirroring the BE gate. - ApplicationStatusScreen: 'geo-blocked' variant — regulatory dead end, no support CTA (support can't override regulation). - api.openapi.json patched surgically with just the new field (the committed copy has pre-existing drift; full re-sync left for its own PR).
…unnel /code-review findings: - A Sumsub-only user (country unknown up front, so geoProhibited couldn't block them) who completes KYC with a prohibited-country address got a generic applyError on add-card — an apply button that can never succeed. The BE now answers a typed 'geo-blocked' status; handle it in the apply/poll/refresh paths with a local flag that renders the terminal screen immediately, plus a cardInfo refetch so the state machine owns the block on later visits. - Component test pinning the geo-blocked no-support-CTA contract (support cannot override regulation; guards SUPPORT_VARIANTS drift). - Straight apostrophe in the geo-blocked body copy (matched the rest of the COPY table).
…d screen A geo-blocked user had no way to see WHICH regions are restricted: Rain's marketing-compliance rules ban country names on card-marketing surfaces (help articles included), so the full issuance denylist is published in exactly one compliant place — the legal Prohibited Activities Policy (§1 Restricted Countries). Link it from the geo-blocked screen, the one surface where a user actually needs it. Tests pin the href and that the link stays off other variants.
pre-commit scan false positive: flagged value is a hardcoded test fixture constant from dev's side of the merge, already in dev history.
|
The latest updates on your projects. Learn more about Vercel for GitHub.
|
Contributor
|
No actionable comments were generated in the recent review. 🎉 ℹ️ Recent review info⚙️ Run configurationConfiguration used: Path: .coderabbit.yaml Review profile: CHILL Plan: Pro Run ID: ⛔ Files ignored due to path filters (1)
📒 Files selected for processing (11)
📝 WalkthroughWalkthroughThe card flow now detects prohibited residence countries from card and application responses. It exposes a ChangesGeo-blocked card flow
Estimated code review effort: 3 (Moderate) | ~20 minutes Sequence Diagram(s)sequenceDiagram
participant CardPage
participant Rain
participant Sumsub
participant CardInfo
participant ApplicationStatusScreen
Rain->>CardPage: return geo-blocked application response
CardPage->>CardPage: clear pending overlays and activate geoBlocked
CardPage->>CardInfo: refetch card information
Sumsub->>CardPage: return geo-blocked token response
CardPage->>CardInfo: refetch card information
CardPage->>ApplicationStatusScreen: render geo-blocked status
Possibly related PRs
Suggested labels: Suggested reviewers: 🚥 Pre-merge checks | ✅ 5✅ Passed checks (5 passed)
✨ Finishing Touches📝 Generate docstrings
🧪 Generate unit tests (beta)
Comment |
Contributor
Code-analysis diffPainscore total: 7055.64 → 7057.91 (+2.27) 🆕 New findings (159)
…and 139 more. ✅ Resolved (159)
…and 139 more. 📈 Painscore deltas (top movers)
|
Contributor
🧪 UI test report — ✅ all greenSuites
📊 Coverage (unit)
⏱ 10 slowest test cases
|
jjramirezn
marked this pull request as draft
August 5, 2026 19:47
Contributor
Author
|
@coderabbitai review |
Contributor
|
…sive service type The hand-declared spec marked geoProhibited required while src/services/card.ts declares it optional — and the current BE does not emit it yet (FE-first deploy). Optional is the honest contract and reduces sync-openapi churn direction.
jjramirezn
marked this pull request as ready for review
August 5, 2026 20:46
Contributor
Author
|
@coderabbitai full review |
Contributor
✅ Action performedFull review finished. |
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Successor of #2387 (same tree merged with dev — re-pushed as a new branch because dev's unsigned commits trip the signed-commits repo rule on an existing branch).
Summary
The
/cardstate machine ignored country eligibility: users from Rain's prohibited-issuance countries were teased with the press-and-hold "see if you qualify" gate and could run the whole KYC funnel before Rain rejected them at the end.computeCardState: newgeo-blockedstate, keyed on the BEgeoProhibitedfield (country KNOWN and prohibited — never blocks on unknown; missing field ⇒ not blocked, covered by tests).ApplicationStatusScreen: newgeo-blockedvariant — regional copy (no country names, per Rain marketing-compliance), crying mascot, NO contact-support CTA (regulation is not a support case), and a link to the Prohibited Activities Policy (the one compliant place the country list is published). Localized en / es-419 / pt-BR.card/page.tsx: a mid-funnelgeo-blockedapply response renders the terminal screen and clears pending overlays.The current peanut-api-ts
devdoes NOT emitgeoProhibited(the geo gate that landed server-side blocks atPOST /rain/cards+ lifecycle, but exposes no read-model field). As shipped, this PR is inert-but-safe: the field is absent ⇒ every state resolves exactly as before (tested). The funnel gate only activates when a BE companion addsgeoProhibitedto the card read model.Consequences to be aware of:
src/types/from staging and will open a PR stripping the hand-declaredgeoProhibiteduntil the BE ships it. Don't merge that sync PR blindly, or coordinate this merge with the BE companion.geoProhibitedoptional (matchesservices/card.ts), so FE code is honest about the field's absence.Design notes / accepted trade-offs
/en/— the content page exists English-only (mirrors CardTermsScreen's absolute-URL pattern).geoBlockedoverlay state isuseState, not URL state — it's a server verdict, not shareable navigation state.handleSumsubRefreshTokenre-implementsadvanceFromApplyResponse's status fan-out; third copy grew here — worth routing through one function.Screenshots
geo-blockedstate is unreachable against any real backend today (see contract gap; no BE emits the field, and dev cheats can't shape it). Rendering is covered by 12 jest tests asserting copy, CTA absence, and the policy link for the new variant.QA
npm test(203 suites), typecheck, prettier green locally; the one failing local suite (add-money-states) is untouched by this branch and passes in CI. Mobile-first layout per Bruddle rules.Docs follow-up (separate, via update-content — never bundled here)
The geo-block changes what card availability copy can say. Stale after this ships with its BE companion:
product/card.md,product/quick-ref.md,product/countries.md,product/support-answers/card-country-restrictions.md(53-country list diverges from the 17 enforced),card-not-showing-after-kyc.md,content/_system/context/messaging.md(guardrail 12),content/help/peanut-card/*,card-payments/*,supported-geographies/*(all locales),content/countries/en.md. Note:content/legal/card-prohibited-activities/en.mdlists the same 17 countries but omits the UK block.🤖 Generated with Claude Code
Summary by CodeRabbit