Current Limitation
The JavaScript SDK profile flows were built against SCIM2 endpoints (/scim2/Me, /scim2/Schemas) that the backend never implemented. In practice:
- Profile data was read from decoded ID-token claims only, and self-service profile updates (
<UserProfile />) targeted a non-existent endpoint, so edits never persisted.
- The SCIM schema machinery in the SDK (schema fetch, flattening, schema-driven rendering) was effectively dead code — it never ran, because the schema list was always empty.
PR thunder-id/javascript-sdks#9 retires SCIM and moves profile read/update to /users/me (GET + PUT) as an interim MVP. However, two gaps remain:
/users/me returns the full user object, whereas the ID token previously acted as an implicit allowlist of presentable claims. The profile component now has no field metadata to decide what to show, how to label it, whether it is editable / required / secret, or how to validate it.- SCIM2 terminology still lingers across the SDK's declarative surface (types, interfaces, JSDoc, error codes, naming), so the public API no longer reflects reality.
Suggested Improvement
-
Complete the SCIM2 retirement. Standardize all SDK profile read/update on /users/me and remove the remaining SCIM2 concepts across every framework package (React, Vue, Next.js, Nuxt).
-
Consume the new schemas endpoint and revamp <UserProfile />. Once the planned schemas endpoint lands (a flat list of field descriptors — display name, required, secret, regex/validation, etc.), revamp the profile component to render declaratively from it: field visibility, labels, ordering, editability, secret masking, and input validation. This replaces the interim MVP that renders the raw /users/me payload behind a static skiplist.
-
Refactor the declaratives. Update the declarative definitions across the SDKs — type declarations, interfaces, JSDoc/comments, error codes, and naming — that still reference SCIM2, so the declarative/public API reflects the /users/me + schemas model.
Current Limitation
The JavaScript SDK profile flows were built against SCIM2 endpoints (
/scim2/Me,/scim2/Schemas) that the backend never implemented. In practice:<UserProfile />) targeted a non-existent endpoint, so edits never persisted.PR thunder-id/javascript-sdks#9 retires SCIM and moves profile read/update to
/users/me(GET + PUT) as an interim MVP. However, two gaps remain:/users/mereturns the full user object, whereas the ID token previously acted as an implicit allowlist of presentable claims. The profile component now has no field metadata to decide what to show, how to label it, whether it is editable / required / secret, or how to validate it.Suggested Improvement
Complete the SCIM2 retirement. Standardize all SDK profile read/update on
/users/meand remove the remaining SCIM2 concepts across every framework package (React, Vue, Next.js, Nuxt).Consume the new schemas endpoint and revamp
<UserProfile />. Once the planned schemas endpoint lands (a flat list of field descriptors — display name, required, secret, regex/validation, etc.), revamp the profile component to render declaratively from it: field visibility, labels, ordering, editability, secret masking, and input validation. This replaces the interim MVP that renders the raw/users/mepayload behind a static skiplist.Refactor the declaratives. Update the declarative definitions across the SDKs — type declarations, interfaces, JSDoc/comments, error codes, and naming — that still reference SCIM2, so the declarative/public API reflects the
/users/me+ schemas model.