- Shipped
- August 4, 2026 at 4:07 AM UTC
- Author
- kamo
- Commit
- db0f088
God mode had no UI at all in kamo-internal: a localStorage boolean that a mount effect mirrored into ***, re-asserted on every new tab forever. That made the browser the authority on whether platform staff were elevated, and made elevation something you could be in without ever deciding to be. - GodModeJustificationDialog prompts for the reason BEFORE elevating. A reason collected afterwards is a reason written to fit what was already done. The copy states plainly what the operator is about to see and that their name goes on it. - GodModeIndicator is a full-width bottom bar plus a red frame around the whole viewport, with a live countdown and "End now". Someone who forgets they are in god mode is the exact scenario the control exists to prevent, so it is not a subtle badge — but it is pointer-events:none outside the bar and sits outside layout flow, so it never intercepts a click or reflows a screen. - Both are mounted once in the root layout, next to AutomaticLogoff, so the indicator is present wherever the operator ends up rather than on the screens someone remembered. Renders nothing unless the session is god-ELIGIBLE. - The server owns the state. app/lib/godMode holds a single coalesced store; the client only ever reads the expiry SecurityService stamped and can never extend it. setIsGodMode is gone — elevating takes a justification, so it cannot be a setter. - The status poll doubles as the durable clear: GET /session/god-mode is where SecurityService writes an elapsed elevation out of Redis for the services that read the session directly. usePlatformAdminGuard now waits for the god status for god-eligible sessions. Access used to be readable synchronously from localStorage; without the wait an operator with an open window would be bounced to /settings in the gap. Strings are in **************** (pushed first, per the build's clone order). npx vitest run: 329 passed (32 files), 17 of them new. npx tsc --noEmit: clean.