[leowilkin]

why

for account recovery we sometimes need someone to verify who can't sign in to auth.hackclub.com or read their email. staff make an inquiry by hand in the Persona dashboard, set the reference id to the identity's public id, and send the person Persona's hosted link.

until now, the webhooks for those inquiries matched no Verification or VerificationCase and were dropped, so nothing ended up on the identity.

what

• inquiry.created now passes the inquiry's creator and reference-id to the new Persona::LinkStaffInquiryJob. HCA's own inquiries have creator: "API", so they're skipped in the controller.
• the job only links the inquiry when the creator email matches an active backend user who is a super admin or manual document verifier, ignoring case. the webhook is already HMAC-verified, so that field can be trusted.
• the inquiry becomes a draft PersonaVerification on the identity, so the usual completed / approved / declined webhooks handle it from there. the activity log records which reviewer linked it.
• these never auto-approve. persona passing the document doesn't show that the person owns the account, so they carry a STAFF_CREATED_ISSUE and always go to manual review.
• if the identity has a pending verification, the job leaves it alone and sends a Sentry warning. a stale draft gets the same cleanup the normal flow does: it's deleted and its inquiry expired. an inquiry that's already linked is a no-op.

before merging

• check that inquiry.created is enabled on the Persona webhook subscription

not covered

• a decisioning denial still auto-rejects, and that email goes to the primary address, which the person may not be able to read.
• giving them access to the account again (for example, changing the email) is still a manual step.

tests

14 new examples, all passing, and rubocop is clean on the changed files. the full suite has 74 failures, but it's the same 74 with and without this change. most come from the :pending verification factory trait building a persona record with a mismatched inquiry id. separately, schema.rb on main is missing the registration_ip migration.

[leowilkin]

heads up: rails 8.0 support ends on 2026-11-07.

brakeman 8.1.0 started flagging it, and since bin/brakeman runs --ensure-latest, scan_ruby was failing on every PR, main included. 4113fb6 ignores the EOL warning in config/brakeman.ignore with a note so CI goes green again. the 8.0 → 8.1 upgrade still needs its own PR before the 7th, and the ignore entry should be removed in that PR.

same commit also fixes two other things that were already broken on main:

• a rubocop offense in backup_code.rb
• brakeman 8.1.0's new XSS warning on the email typo banner, fixed by switching to an _html translation key

[socket-security]

Review the following changes in direct dependencies. Learn more about Socket for GitHub.

Diff	Package	Supply Chain Security	Vulnerability	Quality	Maintenance	License
	gem/​brakeman@​8.0.6 ⏵ 8.1.0	+1

View full report