Make the user object a dynamic claim set

[brionmario]

Purpose

The profile screen in the Quickstart sample showed only the user ID and username, even when the signed in user had a first name, last name, mobile number and profile picture on their token. It also rendered the heading as "Guest" for users who have a first name and last name but no single combined name attribute.

The cause was in the SDK rather than the sample: User declared a fixed list of fields and the client hand picked claims into them, so any attribute a deployment configures beyond that list was dropped before the app could see it.

Approach

User is now the claim set itself. It holds the claims exactly as the server sent them, subscript(claim:) reads any of them, and sub, username, email, displayName, givenName and familyName are accessors that read the claim of the same name and nothing else. There are no fallback chains and no composed values, which mirrors KnownUser in the JavaScript SDK. Codable moved to a single value container so a userinfo or SCIM response lands in the claim set whole.

profileClaims returns the claims with reservedClaims removed. That set holds only protocol claims, the ones describing the token rather than the user: sub, iss, aud, exp, iat, nbf, jti, azp, nonce, typ, at_hash, c_hash, sid, scope, client_id, acr, amr and auth_time. Everything else reaches the app.

ThunderIDClient maps nothing now. Both the token path in getUser() and the sign in path construct User(claims:).

Name and avatar precedence stays in the presentation layer where it already lived, so UserAvatar keeps deciding how to seed initials and which claim to use for a picture. The sample's profile screen iterates profileClaims, humanises each key for its label (given_name becomes "Given Name") and formats values by type, so a newly configured attribute shows up without a code change.

Related Issues

• Mobile SDKs doesn't display all the user attributes thunderid#5094

Related PRs

• Android equivalent: Make the user object a dynamic claim set android-sdks#25

Checklist

• Followed the contribution guidelines.
• Manual test round performed and verified.
• Documentation provided. (Add links if there are any)
• Tests provided. (Add links if there are any)
  • Unit Tests
  • Integration Tests
• Breaking changes. (Fill if applicable)
  • Breaking changes section filled.
  • breaking change label added.

Security checks

• Followed secure coding standards.
• Confirmed that this PR doesn't commit any keys, passwords, tokens, usernames, or other secrets.

[coderabbitai]

Important

• 🔍 Trigger review

This repository does not receive automatic reviews because it has fewer than 10 stars.

⚙️ Run configuration

Configuration used: Path: .coderabbit.yaml

Review profile: CHILL

Plan: Pro Plus

Run ID: 05e4a9a2-64ea-4451-b72e-3fd823148677

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}