Allow guest interviews without GitHub sign-in

Merged
TM
1d ago
+949-215

Summary

  • Allow users to start interviews without GitHub sign-in when recording is disabled and guest access is available.
  • Keep authenticated interview behavior unchanged and enforce separate guest token rate limits.
  • Avoid persisting guest interview reports across sessions and inform guests to download temporary reports before leaving.
  • Add regression tests for guest access, session state, report persistence, and token authorization.

Screenshots

The following screenshots demonstrate the guest-mode interface using a local frontend preview with mocked API responses and sample report data. They illustrate the intended UI behavior and are provided for visual reference; they do not independently verify the complete end-to-end guest interview flow.

Guest interview lobby

The guest interview lobby allows users to start an interview without entering a GitHub username or signing in.

codetrial-guest-home-white

Guest interview report

Guest reports are temporary and are not persisted across sessions. The interface reminds guests to download their reports before leaving.

codetrial-guest-report

Testing

  • Browser tests: 1,234 passed.
  • RustSec dependency audit: passed.
  • Project hooks: 49 checks passed.
  • Formatting check: passed.

Notes

Guest access remains unavailable when recording is enabled or the required account infrastructure is unavailable.


Summary by cubic

Allows starting interviews without GitHub sign-in when recording is disabled and guest mode is enabled, while keeping authenticated interview behavior unchanged. Token responses now flag guests, live-room and guest-capacity bookkeeping share one mutex so concurrent reservations cannot oversubscribe a room, and the server-check script adapts to whether guest mode is available.

  • Guest mode is opt-in via CODETRIAL_GUEST_MODE_ENABLED (default off) and available only when recording is disabled, the account database is reachable, and the dispatcher supports guest admission.
  • Guests and signed-in callers share the IP-based token rate limit so switching auth state can't reset the request budget; guest interviews draw from a separate two-interview capacity cap and cannot share a live room with signed-in interviews.
  • Guest reports skip persistent history entirely, so the "Temporary guest report. Download it before leaving." warning stays, and leaving or report delivery is guarded until the report is safely handled.

close #316