Approve org AI data processing inline during onboarding

[Twixes]

Summary

The AI approval onboarding screen used to dead-end on a button that opened PostHog web, asking the user to flip the org-level "AI data processing approval" toggle there and come back. The user note describes this as painful and easy to abandon, especially because the screen sits between the user and the rest of the app.

The screen now calls PATCH /api/organizations/<id>/ with {is_ai_data_processing_approved: true} directly. The matching backend change (posthog-code/allow-code-app-org-ai-toggle) carves out a narrow exemption for project-scoped OAuth tokens to flip exactly this one field. After the call succeeds we invalidate the useCurrentUser query so the needsAiApproval gate clears automatically and onboarding continues without a refresh.

Robustness

• Older backend / 403 / network failure → we set fellBackToWeb and render the original "Approve in PostHog" button so the user is never stuck on a non-functional screen.
• Non-admin user → unchanged; we still show "Ask an organization admin to approve AI data processing."
• Missing client or org id → the inline path is hidden; we render the web fallback instead.
• Dismissal / skip → there is no skip button; the existing footer's Log out handles "I want out" without a loop.

Test plan

• pnpm --filter code typecheck (passes)
• pnpm lint (passes)
• pnpm --filter code test (1145 tests passing)
• Manual: with a project-scoped OAuth token (PostHog Code's normal flow), the inline approve button flips the org toggle and onboarding proceeds without leaving the app.
• Manual: simulate a 403 from the org PATCH and verify we fall back to "Approve in PostHog" with an explanatory hint.
• Manual: non-admin user still sees the "ask an admin" copy.

---

Created with PostHog Code