wave: require KYC to apply for issues + KYC prompt step

[efstajas]

Summary

Frontend companion to drips-network/wave#596 for drips-network/wave#592. Pushes KYC earlier in the contributor funnel: blocks the apply page when the user is not verified, and surfaces a dedicated "Verify your identity" step once after login.

• New /wave/kyc-required step: yellow warning AnnotationBox + primary "Verify identity" / ghost "Skip for now" buttons. Reachable only from the post-login redirect (and direct nav). Self-resolves if the user is already verified.
• Login callback: after login, redirects non-verified users to /wave/kyc-required. RED-reviewed (rejected) users skip the prompt — the "please verify your identity" pitch is misleading for them.
• Apply page:
  • apply/+layout.ts fetches KYC status and returns isKycVerified. No redirect — the apply page is reachable, just blocked.
  • apply/+page.svelte shows a red Identity verification (KYC) required AnnotationBox with a "Verify identity" action; both FormFields (application text + Turnstile) get disabled so the wrapper greys out and ignores input; the application-slots info box is hidden in this state. Backend 403 still guards submission.
• Settings/profile: tiny copy tweak on the existing KYC nudge to align with the new gate framing.
• Support page: unrelated one-line response-time copy tweak.

Test plan

• Logged out → log in as a user without KYC → expect /wave/kyc-required after the callback (wrapping the welcome flow for new users).
• Same flow as a RED-reviewed user → expect direct redirect to backTo, no kyc-required step.
• Navigate directly to /wave/<slug>/issues/<id>/apply without KYC → expect the red KYC AnnotationBox, disabled form, no slots info box; "Verify identity" button links to /wave/kyc?backTo=….
• Complete KYC, return to the apply page → form renders live, slots AnnotationBox returns, submit works.
• On /wave/kyc-required: "Skip for now" lands on backTo; "Verify identity" lands on /wave/kyc?backTo=….
• Visit /wave/kyc-required directly while already verified → expect redirect to backTo.

Note

The "Learn more" link in the warning AnnotationBox points to docs.drips.network/wave/contributors/solving-issues-and-earning-rewards#verifying-your-identity — that docs section needs to be authored before merge / shortly after.

[Copilot]

Pull request overview

Adds a frontend KYC gate earlier in the Wave contributor funnel by introducing a post-login “KYC required” prompt and disabling issue applications for users without verified identity.

Changes:

• Redirects newly-logged-in, non-verified users to a new /wave/kyc-required step (with a “verify” CTA and a “skip” option).
• Fetches KYC status on the issue apply route and blocks the apply form UI when the user is not KYC-verified.
• Updates small bits of copy on the support page and the profile settings KYC nudge.

Reviewed changes

Copilot reviewed 7 out of 7 changed files in this pull request and generated 3 comments.

Show a summary per file

File	Description
src/routes/(pages)/wave/(flows)/support/+page.svelte	Updates support response-time copy.
src/routes/(pages)/wave/(flows)/login/callback/+page.svelte	Adds post-login KYC status fetch + redirect to /wave/kyc-required for non-verified users.
src/routes/(pages)/wave/(flows)/kyc-required/+page.ts	Implements server load: validates backTo, fetches KYC status, redirects if already verified, otherwise requires auth.
src/routes/(pages)/wave/(flows)/kyc-required/+page.svelte	New UI step prompting identity verification with “Verify identity” / “Skip for now”.
src/routes/(pages)/wave/(flows)/[waveProgramSlug]/issues/[issueId]/apply/+layout.ts	Adds KYC status fetch and computes isKycVerified for the apply page.
src/routes/(pages)/wave/(flows)/[waveProgramSlug]/issues/[issueId]/apply/+page.svelte	Blocks apply UI when not KYC-verified; adds KYC-required AnnotationBox and disables form + submit.
src/routes/(pages)/wave/(base-layout)/settings/profile/+page.svelte	Adjusts KYC nudge copy to match new gating framing.

Comments suppressed due to low confidence (1)

src/routes/(pages)/wave/(flows)/[waveProgramSlug]/issues/[issueId]/apply/+page.svelte:203

• Even when the form is "disabled" via the FormField wrapper, the Turnstile component still mounts and runs its onMount logic (polling for the script + rendering the widget). For non-KYC users this is wasted work and may still create network/activity. Consider conditionally rendering the Turnstile (and/or the whole verification FormField) only when data.isKycVerified is true.

    <FormField
      title="Verification*"
      description="Confirm you're not a robot with a quick check."
      type="div"
      disabled={!data.isKycVerified}
    >
      <div class="turnstile-wrapper">
        <Turnstile ontoken={(t) => (turnstileToken = t)} />
      </div>
    </FormField>

---

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

[Copilot]

Pull request overview

Copilot reviewed 7 out of 7 changed files in this pull request and generated 3 comments.

Comments suppressed due to low confidence (1)

src/routes/(pages)/wave/(flows)/kyc-required/+page.ts:27

• The catch redirects to /wave/login for any error from getKycStatus(). If the user is already logged in (JWT present) but the KYC status endpoint errors (5xx/network), /wave/login immediately redirects back to backTo (this page), creating an infinite redirect loop. Consider checking parent() for user and only redirecting to login when unauthenticated/401; for other errors, render the page (best-effort) or redirect to safeBackTo instead of login.

  try {
    const kycStatus = await getKycStatus(fetch);
    const isKycVerified =
      kycStatus.status === 'applicantReviewed' && kycStatus.reviewAnswer === 'GREEN';
    // RED users have already attempted KYC; the "please verify" pitch on this
    // page is misleading for them. Mirror the login callback's behavior.
    const isKycRejected = kycStatus.reviewAnswer === 'RED';

    if (isKycVerified || isKycRejected) {
      throw redirect(302, safeBackTo);
    }
  } catch (err) {
    if (err && typeof err === 'object' && 'status' in err && err.status === 302) {
      throw err;
    }
    // If not authenticated or other error, redirect to login
    throw redirect(302, `/wave/login?backTo=${encodeURIComponent(url.pathname + url.search)}`);
  }

[Copilot]

Pull request overview

Copilot reviewed 7 out of 7 changed files in this pull request and generated 4 comments.

Comments suppressed due to low confidence (1)

src/routes/(pages)/wave/(flows)/kyc-required/+page.ts:26

• The catch-all error handler redirects to /wave/login for any failure (including transient backend/network errors while the user is already authenticated). This can cause confusing login loops and hides real failures. Consider only redirecting to login on 401/unauthenticated, and otherwise either allow rendering the page (best-effort) or surface an error state.

  } catch (err) {
    if (err && typeof err === 'object' && 'status' in err && err.status === 302) {
      throw err;
    }
    // If not authenticated or other error, redirect to login
    throw redirect(302, `/wave/login?backTo=${encodeURIComponent(url.pathname + url.search)}`);
  }

[Copilot]

Pull request overview

Copilot reviewed 7 out of 7 changed files in this pull request and generated 3 comments.

[Copilot]

Pull request overview

Copilot reviewed 8 out of 8 changed files in this pull request and generated no new comments.