From 1de563203d91191ddd24352fb8fa2edf9d08ec45 Mon Sep 17 00:00:00 2001
From: Scott Idem <stidem@gmail.com>
Date: Wed, 25 Mar 2026 18:04:53 -0400
Subject: [PATCH] fix(idaa): add reload button to Access Denied screen in
 iframe mode
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

WHY: Novi UUID verification is async — on first iframe load the API call
may not complete before the access gate renders, leaving the user stuck on
Access Denied with no way to retry without manually reloading the host page.
The Reload/Retry button calls location.reload() to re-trigger verification.
Only shown in iframe mode where the timing race is the known failure path.

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
---
 src/routes/idaa/(idaa)/+layout.svelte | 16 ++++++++++++++++
 1 file changed, 16 insertions(+)

diff --git a/src/routes/idaa/(idaa)/+layout.svelte b/src/routes/idaa/(idaa)/+layout.svelte
index 867f7a60..b9865d08 100644
--- a/src/routes/idaa/(idaa)/+layout.svelte
+++ b/src/routes/idaa/(idaa)/+layout.svelte
@@ -251,5 +251,21 @@ async function verify_novi_uuid(
         {:else}
             <p>IDAA Novi UUID not found!</p>
         {/if}
+
+        {#if $ae_loc.iframe}
+            <!-- WHY: In iframe mode the Novi UUID is passed via URL param on first load.
+                 If verification hasn't completed yet (timing race on Novi API), the user
+                 lands on Access Denied. Reloading the iframe re-triggers verification. -->
+            <button
+                type="button"
+                class="btn btn-sm preset-tonal-primary border-primary-500 mt-4 border"
+                onclick={() => location.reload()}>
+                <span class="fas fa-redo m-1"></span>
+                Reload / Retry
+            </button>
+            <p class="mt-1 text-xs text-gray-500">
+                If your session just started, try reloading.
+            </p>
+        {/if}
     </div>
 {/if}