Feat/311 sensitive action stepup confirmation

[Stanley471]

Title

feat(admin): Sensitive-action step-up confirmation pattern (#311)

Summary

Creates a reusable step-up confirmation modal (StepUpConfirmModal) for destructive admin operations requiring exact target-derived typed phrases and client-side rate-limiting cooldown protection. Applies this pattern across three core reference flows: Bans, Refunds, and Role Grants.

Key Changes

• Client-Side Rate Limiter Utility (lib/utils/rateLimiter.js):
  • Tracks rapid confirmation attempts using a sliding window algorithm (max 3 attempts per 30s window).
  • Triggers a 15-second cooldown timer when rapid action patterns are detected.
• StepUpConfirmModal Component (components/admin/StepUpConfirmModal.jsx):
  • Dynamically derives expected verification phrases from target identifiers (e.g. BAN user@example.com, REFUND PLT-10042, GRANT SUPER_ADMIN bilal@deenbridge.org).
  • Disables submit button until exact typed phrase match is entered.
  • Displays a prominent alert notice with a live countdown timer during active cooldowns.
• Reference Admin Flows Integration:
  • Ban Flow (app/[locale]/admin/users/page.jsx): Banning a user requires typing BAN <user.email>.
  • Role Grant Flow (app/[locale]/admin/users/page.jsx): Elevating privileges / granting roles requires typing GRANT <ROLE> <user.email>.
  • Refund Flow (app/[locale]/admin/payments/disputes/page.jsx): Authorizing dispute refunds requires typing REFUND <dispute.transactionId>.
• Automated Tests (__tests__/admin/StepUpConfirmModal.test.jsx):
  • Unit test suite verifying phrase derivation, exact match validation, rate-limiting triggers, and reference flow integrations.

How to Test

1. Ban Flow: Navigate to /admin/users, select Ban User Account from the user dropdown. Verify phrase BAN <user.email> is required; verify submit button stays disabled until typed phrase matches exactly.
2. Role Grant Flow: On /admin/users, select Grant Super Admin Role from the user dropdown. Verify phrase GRANT SUPER_ADMIN <user.email> is required.
3. Refund Flow: Navigate to /admin/payments/disputes, click Resolve with Refund (Step-Up). Verify phrase REFUND <transactionId> is required.
4. Rate Limiting: Execute 3 rapid confirmations within 30 seconds to verify the cooldown alert notice and countdown timer block rapid-fire operations.

Closes #311

[vercel]

@Stanley471 is attempting to deploy a commit to the Deen Bridge Team on Vercel.

A member of the Team first needs to authorize it.

[drips-wave]

@Stanley471 Great news! 🎉 Based on an automated assessment of this PR, the linked Wave issue(s) no longer count against your application limits.

You can now already apply to more issues while waiting for a review of this PR. Keep up the great work! 🚀

Learn more about application limits

[coderabbitai]

Warning

Review limit reached

Next included review available in 55 minutes.

View limit details

Limit details: You’ve used the included review currently available.

You've used all free OSS reviews for now. Wait for the free limit to reset to keep reviewing this public repository.

Learn how review limits work.

Review configuration:

⚙️ Run configuration

Configuration used: Path: .coderabbit.yaml

Review profile: CHILL

Plan: Pro Plus

Run ID: 16f464a8-cc48-4d17-b0ad-44c2b0d84053

📥 Commits

Reviewing files that changed from the base of the PR and between 45819f7 and 0a88d52.

📒 Files selected for processing (5)

• __tests__/admin/StepUpConfirmModal.test.jsx
• app/[locale]/admin/payments/disputes/page.jsx
• app/[locale]/admin/users/page.jsx
• components/admin/StepUpConfirmModal.jsx
• lib/utils/rateLimiter.js

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}

[zeemscript]

Strict review blocker: this branch conflicts with the base branch, and Lint and Build, Lighthouse CI, and Vercel are failing. Please rebase, resolve conflicts, and restore checks.

[zeemscript]

Strict review blocker: this branch has merge conflicts with the base branch and/or failing deployment checks. Please rebase, resolve conflicts, and restore checks before requesting merge.

[Stanley471]

conflicts resolved

[zeemscript]

Strict review blocker: this branch conflicts with the base branch, and , , and are failing. Please rebase, resolve conflicts, and restore checks.

[zeemscript]

@Stanley471 this PR has merge conflicts with the main branch. Please resolve the conflicts (merge main in or rebase) and push the fix so it can be merged. Thanks!