From bbee0eb28801d83fba9416d4b40e07581ed16ffc Mon Sep 17 00:00:00 2001
From: kemal <hello@kemal.earth>
Date: Mon, 7 Sep 2026 14:56:56 +0100
Subject: [PATCH] feat: drop the upfront over-role warning from the consent
 screen

Role validation is post-submit only, so the screen no longer pre-computes
over-role scope groups or warns about them before authorizing. The test now
guards that neither the banner nor the per-scope annotation renders for the
read-only fixture.

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
---
 .../Consent/OAuthAppsAuthorizeScreen.test.tsx | 14 +++--------
 .../Consent/OAuthAppsAuthorizeScreen.tsx      | 25 ++-----------------
 2 files changed, 6 insertions(+), 33 deletions(-)

diff --git a/apps/studio/components/interfaces/Organization/OAuthApps/Consent/OAuthAppsAuthorizeScreen.test.tsx b/apps/studio/components/interfaces/Organization/OAuthApps/Consent/OAuthAppsAuthorizeScreen.test.tsx
index d457a95b4fe..8270b7061ce 100644
--- a/apps/studio/components/interfaces/Organization/OAuthApps/Consent/OAuthAppsAuthorizeScreen.test.tsx
+++ b/apps/studio/components/interfaces/Organization/OAuthApps/Consent/OAuthAppsAuthorizeScreen.test.tsx
@@ -19,20 +19,14 @@ describe('OAuthAppsAuthorizeScreen', () => {
     expect(screen.getByText('Must select at least one project to authorize.')).toBeInTheDocument()
   })
 
-  test('shows the over-role warning only for the read-only fixture', async () => {
-    const { unmount } = customRender(
-      <OAuthAppsAuthorizeScreen mockState="ideal" navigate={vi.fn()} />
-    )
+  test('shows no upfront over-role warning, even for the read-only fixture', async () => {
+    customRender(<OAuthAppsAuthorizeScreen mockState="over_role" navigate={vi.fn()} />)
+
     await screen.findByText('Permissions requested')
     expect(
       screen.queryByText('Some requested permissions exceed your role')
     ).not.toBeInTheDocument()
-    unmount()
-
-    customRender(<OAuthAppsAuthorizeScreen mockState="over_role" navigate={vi.fn()} />)
-    expect(
-      await screen.findByText('Some requested permissions exceed your role')
-    ).toBeInTheDocument()
+    expect(screen.queryByText('Read-only for your role')).not.toBeInTheDocument()
   })
 
   test('renders the empty-org notice, hides permissions, and shows the cancel footer', async () => {
diff --git a/apps/studio/components/interfaces/Organization/OAuthApps/Consent/OAuthAppsAuthorizeScreen.tsx b/apps/studio/components/interfaces/Organization/OAuthApps/Consent/OAuthAppsAuthorizeScreen.tsx
index 17e75dfd624..e09c8bd1923 100644
--- a/apps/studio/components/interfaces/Organization/OAuthApps/Consent/OAuthAppsAuthorizeScreen.tsx
+++ b/apps/studio/components/interfaces/Organization/OAuthApps/Consent/OAuthAppsAuthorizeScreen.tsx
@@ -1,12 +1,11 @@
 import { BadgeCheck } from 'lucide-react'
-import { useMemo, useState } from 'react'
+import { useState } from 'react'
 import { Button } from 'ui'
 import { Admonition } from 'ui-patterns/Admonition'
 
 import { AuthorizingAsCard } from './AuthorizingAsCard'
 import { NoProjectsNotice } from './NoProjectsNotice'
 import { EMPTY_ORG_MOCK_SLUG, getMockScenarioId } from './OAuthAppsAuthorizeScreen.utils'
-import { isScopeGroupOverRole } from './OverRoleAnnotation.utils'
 import { ProjectMultiSelect } from './ProjectMultiSelect'
 import { ScopeGroupCard } from './ScopeGroupCard'
 import {
@@ -70,14 +69,6 @@ export const OAuthAppsAuthorizeScreen = ({
   const isSubmitting = approveMutation.isPending
   const hasProjects = (projects?.length ?? 0) > 0
 
-  const overRoleGroups = useMemo(
-    () =>
-      (request?.scope_groups ?? []).filter((group) =>
-        isScopeGroupOverRole(group.level, memberOrg?.role ?? '')
-      ),
-    [request?.scope_groups, memberOrg?.role]
-  )
-
   if (!request || !identity || !orgSlug || !memberOrg) return null
 
   const handleSignOut = async () => {
@@ -172,19 +163,7 @@ export const OAuthAppsAuthorizeScreen = ({
 
           {hasProjects && (
             <>
-              <ScopeGroupCard
-                appName={request.app_name}
-                scopeGroups={request.scope_groups}
-                memberRole={memberOrg.role}
-              />
-
-              {overRoleGroups.length > 0 && (
-                <Admonition
-                  type="default"
-                  title="Some requested permissions exceed your role"
-                  description={`You can still authorize, ${request.app_name} will work within what your role allows.`}
-                />
-              )}
+              <ScopeGroupCard appName={request.app_name} scopeGroups={request.scope_groups} />
 
               <Admonition
                 type="default"