feat(web): auth-gate code search submit on Ask GH

[msukkari]

Fixes SOU-2307

Summary

• Adds a client-side login gate to non-empty code search submissions only when EXPERIMENT_ASK_GH_ENABLED=true and the user is anonymous.
• Reuses Ask Sourcebot's server-derived isAuthenticated / isLoginWallEnabled contract, shared LoginDialog, empty-submission behavior, and wa_askgh_login_wall_prompted event.
• Preserves anonymous access to existing search results, code previews, files, repository trees, and file history.
• Carries the requested search URL through authentication so the pending search runs automatically after login.
• Leaves Ask GH-off behavior unchanged.

E2E matrix

Tested the final changed branch at 81846d3b. For regression comparisons, tested the exact pre-change baseline at a28b1812 with the same indexed repository, database, and action sequence.

Ask GH on + anonymous access enabled

• Main /search: anonymous SearchBar submission opened Sign in to continue; after credentials login, the browser automatically reached /search?query=SearchBar and rendered results without query re-entry.
• Anonymous browsing: directly opened existing SearchBar results, opened code preview and full file browser, navigated from layoutClient.tsx to layout.tsx, and viewed commit history without a login wall.
• Existing result page: anonymous user changed SearchBar to LoginDialog; login wall appeared over the old results; after login, the browser automatically reached /search?query=LoginDialog and rendered the new results.
• Empty submission: pressing Enter with an empty search did not open the login wall or navigate.

ask_gh_main_search_login_resume.mp4
ask_gh_anonymous_results_files_history_browse.mp4
ask_gh_result_page_search_login_resume.mp4
final_empty_and_nonempty_search_gate.mp4

Ask GH off + anonymous access enabled

Ran the same script on changed and baseline deployments: anonymous SearchBar search, result preview, full file browser, file-tree navigation to layout.tsx, history view, and LoginDialog search from the result page. Both remained ungated and produced matching behavior.

Changed deployment:
changed_flag_off_anonymous_enabled_full_flow.mp4

Pre-change baseline:
baseline_flag_off_anonymous_enabled_full_flow.mp4

Ask GH off + anonymous access disabled

Ran the same script on changed and baseline deployments. Both redirected logged-out /search requests to /login with no guest option. After authentication, both completed the same search, preview, file-tree, history, and second-search flow with matching behavior.

Changed deployment:
changed_flag_off_anonymous_disabled_full_flow_retry.mp4

Pre-change baseline:
baseline_flag_off_anonymous_disabled_full_flow.mp4

Automated validation

• yarn workspace @sourcebot/web lint
• yarn workspace @sourcebot/web test --run (147 files, 1,503 tests)
• GitHub build, lint, test, OpenAPI generation, CodeQL, and vulnerability checks pass.

_{To show artifacts inline, enable in settings.}

  

---

Summary by cubic

Gates code search submissions behind a client-side login for anonymous users when EXPERIMENT_ASK_GH_ENABLED=true, while preserving anonymous access to results and repository browsing.

• Sections: Unauthenticated users see a login dialog instead of being sent to search results, with their pending search automatically resuming at the result URL after sign-in.
• Empty searches don't trigger the login wall.
• Deployments without the flag keep existing behavior, and the changelog documents the change.

^{Written for commit e372c86. Summary will update on new commits.}

[coderabbitai]

Important

Draft PR not reviewed

Draft PRs are not automatically reviewed by default.

• Trigger a manual review

To automatically review draft PRs, update your CodeRabbit configuration:

reviews:
  auto_review:
    drafts: true

---

_{Comment @coderabbitai help to get the list of available commands.}