AFT permission pop-ups still fire when token-requirement / verified-bypass toggles are ON

[iduartgomez]

Reported by

Beta tester (lvvor), 2026-05-26: "I've turned on the two options in settings that are supposed to turn off the token requirements. I'm still getting the token pop-ups."

Scope

The 403 errors in the node log are freenet-side (forwarded to Ian, not this repo). This issue is the UI side: the Settings toggles that should suppress the AFT permission pop-up are not suppressing it.

Relevant toggles

• "verify-on-send" (default OFF since fix(ui): style contact modals in inbox view, overlay Settings, default verify-on-send off #262)
• verified-sender bypass (AFT: skip token requirement when sender is verified by recipient #150 — skip token requirement when sender is verified by recipient)

Expectation

With the relevant toggle(s) ON, sending to a verified contact should NOT raise an AFT permission pop-up.

Investigation pointers

• ui/src/aft.rs — assign_token, tier resolution, verified-bypass path (AFT: skip token requirement when sender is verified by recipient #150, AFT: sender uses stale recipient tier from contact card (post-#85 follow-up) #221).
• The permission-request modal trigger path.
• Confirm the toggle state is actually read on the send path and short-circuits the token/permission request, not just hidden in UI.
• Note AFT: sender uses stale recipient tier from contact card (post-#85 follow-up) #221: sender resolves recipient tier from live state — verify the bypass decision uses the right (live, not stale-card) verified status.

Acceptance

• Toggle ON + verified recipient => no pop-up, send proceeds.
• e2e covering the bypass toggle round-trip (partially exists per test(e2e): verified-sender bypass toggle round-trip (#157, closes a #180 row) #220 — extend to assert no pop-up).

[iduartgomez]

Root-cause analysis (code, not yet live-repro'd)

Two distinct toggles, and the one whose label matches the tester's words has no sender-side effect.

auto_accept_verified_contacts (sender-side — DOES suppress pop-ups)

resolve_auto_response / resolve_permission_decision (ui/src/api.rs ~3617, ui/src/app/settings.rs:648) correctly return Accept when the recipient is a verified=true contact. Logic is unit-tested (auto_accept_verified_returns_accept_for_verified, etc.) and passes. If pop-ups persist with this toggle ON, the likely operational causes are:

• the contact is not actually marked verified=true (verification step skipped at import), so neither priority fires → modal shown; or
• the permission pump is async-polling, so the modal can flash before the auto-accept tick fires.

allow_verified_skip_token (the "turn off token requirement" toggle — NO sender effect)

Every reference (ui/src/api.rs:1486/1634/1762, ui/src/inbox.rs:318/366) only syncs the recipient's inbox-contract verified_senders set + settings deltas. It is the recipient's policy: "I accept verified senders' mail without a token." The send path (inbox.rs::start_sending → aft.rs::assign_token) never reads it — assign_token unconditionally mints a token and triggers the permission flow.

For a sender to skip minting, the sender must know the recipient set this flag — that info is not propagated to the sender today. This is an architectural gap, not a one-line fix.

Why the tester sees pop-ups

He toggled allow_verified_skip_token expecting it to kill pop-ups (its label/placement implies "turn off token requirements"). That toggle has zero sender-side effect by design, so sends still mint + prompt. Across his 5 nodes he is both sender and recipient, so every send prompts regardless.

Proposed fix (design, deferred)

Propagate the recipient's allow_verified_skip_token to the sender so the sender can short-circuit assign_token when (a) the sender is in the recipient's verified set and (b) the recipient allows verified-skip. Candidate channels:

• bake it into the contact card at import time (alongside inbox_wasm_hash, Inbox migration: improvements for robustness #251 improvement 4); or
• read it from the recipient's live inbox settings on the send path (already fetched for tier resolution, AFT: sender uses stale recipient tier from contact card (post-#85 follow-up) #221).

Until then, at minimum fix the label/help text so allow_verified_skip_token doesn't read as a sender-side "disable token pop-ups" switch.

Status

• auto_accept_verified_contacts logic verified correct (existing unit tests pass).
• allow_verified_skip_token sender-side skip confirmed missing.
• Live-node repro to confirm which toggle the tester flipped + whether the modal flashes: TODO.