From 902b73347fb299c5c0c9c9f9a0776e6214e5c9af Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Daniel=20R=C3=BCedin?= <daniel@lumethos.ai>
Date: Sun, 12 Jul 2026 01:27:10 +0200
Subject: [PATCH] fix(widget): show comments after verified identify

---
 .../widget-comment-form-visibility.test.ts    | 45 +++++++++++++++++++
 .../components/widget/widget-post-detail.tsx  | 25 ++++++++++-
 2 files changed, 69 insertions(+), 1 deletion(-)
 create mode 100644 apps/web/src/components/widget/__tests__/widget-comment-form-visibility.test.ts

diff --git a/apps/web/src/components/widget/__tests__/widget-comment-form-visibility.test.ts b/apps/web/src/components/widget/__tests__/widget-comment-form-visibility.test.ts
new file mode 100644
index 000000000..d3929bc94
--- /dev/null
+++ b/apps/web/src/components/widget/__tests__/widget-comment-form-visibility.test.ts
@@ -0,0 +1,45 @@
+import { describe, expect, it } from 'vitest'
+import { shouldShowWidgetCommentForm } from '../widget-post-detail'
+
+describe('shouldShowWidgetCommentForm', () => {
+  it('shows the editor for an identified user when verified identity is required', () => {
+    expect(
+      shouldShowWidgetCommentForm({
+        isCommentsLocked: false,
+        commentNoAccess: false,
+        hmacRequired: true,
+        isIdentified: true,
+      })
+    ).toBe(true)
+  })
+
+  it('keeps anonymous visitors read-only when verified identity is required', () => {
+    expect(
+      shouldShowWidgetCommentForm({
+        isCommentsLocked: false,
+        commentNoAccess: false,
+        hmacRequired: true,
+        isIdentified: false,
+      })
+    ).toBe(false)
+  })
+
+  it('does not show the editor when comments are locked or access is denied', () => {
+    expect(
+      shouldShowWidgetCommentForm({
+        isCommentsLocked: true,
+        commentNoAccess: false,
+        hmacRequired: false,
+        isIdentified: true,
+      })
+    ).toBe(false)
+    expect(
+      shouldShowWidgetCommentForm({
+        isCommentsLocked: false,
+        commentNoAccess: true,
+        hmacRequired: false,
+        isIdentified: true,
+      })
+    ).toBe(false)
+  })
+})
diff --git a/apps/web/src/components/widget/widget-post-detail.tsx b/apps/web/src/components/widget/widget-post-detail.tsx
index 324decc07..1277327cb 100644
--- a/apps/web/src/components/widget/widget-post-detail.tsx
+++ b/apps/web/src/components/widget/widget-post-detail.tsx
@@ -31,6 +31,24 @@ interface WidgetPostDetailProps {
   statuses: StatusInfo[]
 }
 
+/**
+ * Verified-identity mode blocks anonymous email capture, but it must not hide
+ * the editor after the host has successfully identified the visitor.
+ */
+export function shouldShowWidgetCommentForm({
+  isCommentsLocked,
+  commentNoAccess,
+  hmacRequired,
+  isIdentified,
+}: {
+  isCommentsLocked: boolean
+  commentNoAccess: boolean
+  hmacRequired: boolean
+  isIdentified: boolean
+}): boolean {
+  return !isCommentsLocked && !commentNoAccess && (!hmacRequired || isIdentified)
+}
+
 export function WidgetPostDetail({ postId, statuses }: WidgetPostDetailProps) {
   const intl = useIntl()
   const {
@@ -284,7 +302,12 @@ export function WidgetPostDetail({ postId, statuses }: WidgetPostDetailProps) {
 
           {/* Root comment form — unified: textarea + email (when anonymous) + single Post.
               For an anonymous viewer the email field escalates them to a real user. */}
-          {!post.isCommentsLocked && !commentNoAccess && !hmacRequired && (
+          {shouldShowWidgetCommentForm({
+            isCommentsLocked: post.isCommentsLocked,
+            commentNoAccess,
+            hmacRequired,
+            isIdentified,
+          }) && (
             <WidgetCommentForm
               isIdentified={isIdentified}
               user={user}