Fix adding users when deployed as federated login to console - #4527
Conversation
|
No actionable comments were generated in the recent review. 🎉 ℹ️ Recent review info⚙️ Run configurationConfiguration used: Path: .coderabbit.yaml Review profile: CHILL Plan: Pro Plus Run ID: ⛔ Files ignored due to path filters (1)
📒 Files selected for processing (3)
🚧 Files skipped from review as they are similar to previous changes (3)
📝 WalkthroughWalkthroughThe console now configures resource-server endpoints for trusted-issuer deployments. SDK documentation describes the endpoint overrides, and workspace catalog versions are updated. ChangesTrusted issuer endpoint configuration
Estimated code review effort: 3 (Moderate) | ~20 minutes Sequence Diagram(s)sequenceDiagram
participant HOC as withConfig HOC
participant SDK as ThunderID SDK
participant RS as Resource Server
HOC->>SDK: Configure flowExecute, flowMeta, and usersMe endpoints
SDK->>RS: Send flow and user-profile requests
Possibly related PRs
Suggested reviewers: 🚥 Pre-merge checks | ✅ 5✅ Passed checks (5 passed)
✨ Finishing Touches🧪 Generate unit tests (beta)
Warning There were issues while running some tools. Please review the errors and either fix the tool's configuration or disable the tool if it's a critical failure. 🔧 ESLint
docs/content/sdks/javascript/apis/configuration.mdxESLint skipped: missing config or dependency (missing-dependency). The ESLint configuration references a package that is not available in the sandbox. frontend/apps/console/src/hocs/withConfig.tsxESLint skipped: missing config or dependency (missing-dependency). The ESLint configuration references a package that is not available in the sandbox. Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out. Comment |
![coderabbitai[bot]](https://avatars.githubusercontent.com/in/347564?s=60&v=4){kind=small}
There was a problem hiding this comment.
Actionable comments posted: 2
🤖 Prompt for all review comments with AI agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
Inline comments:
In `@docs/content/sdks/javascript/apis/configuration.mdx`:
- Around line 95-98: Replace both prose occurrences of the hardcoded “ThunderID”
product name in the configuration guidance with the <ProductName /> component,
while keeping SDK identifiers and any content inside fenced code blocks
unchanged.
- Around line 90-93: Update the endpoint documentation paragraph to remove
endpoints.wellKnown from the list described as resolved from the discovery
document, while retaining it as an override for the discovery document URL. Keep
the remaining OIDC/OAuth endpoint descriptions and resource-server endpoint
descriptions unchanged.
🪄 Autofix (Beta)
Fix all unresolved CodeRabbit comments on this PR:
- Push a commit to this branch (recommended)
- Create a new PR with the fixes
ℹ️ Review info
⚙️ Run configuration
Configuration used: Path: .coderabbit.yaml
Review profile: CHILL
Plan: Pro Plus
Run ID: 577a0a3c-0142-4b3e-a059-627125985d41
⛔ Files ignored due to path filters (1)
pnpm-lock.yamlis excluded by!**/pnpm-lock.yaml
📒 Files selected for processing (3)
docs/content/sdks/javascript/apis/configuration.mdxfrontend/apps/console/src/hocs/withConfig.tsxpnpm-workspace.yaml
| Split these two groups when the OAuth authorization server and the ThunderID resource server are different hosts, for | ||
| example when two ThunderID instances are connected as trusted issuers. Point `baseUrl` (and hence the OAuth/discovery | ||
| endpoints) at the authorization server, and override the resource-server endpoints to target the resource server that | ||
| owns the users and flows: |
There was a problem hiding this comment.
📐 Maintainability & Code Quality | 🟠 Major | ⚡ Quick win
Replace hardcoded product names in prose.
🔴 Hardcoded product name: ThunderID must use <ProductName /> in these prose lines. Replace both occurrences. Keep SDK identifiers inside fenced code blocks unchanged.
As per path instructions, prose in docs/** must render product names with <ProductName />. Based on learnings, SDK identifiers in code blocks must remain literal.
🧰 Tools
🪛 GitHub Actions: 🥒 Docs Lint (Changed Files Only) / 0_Docs lint.txt
[error] 95-96: Structural docs lint error: hardcoded 'ThunderID' in prose; use instead. Command './scripts/docs-lint.sh' failed with exit code 1.
🪛 GitHub Actions: 🥒 Docs Lint (Changed Files Only) / Docs lint
[error] 95-95: Structural docs lint error: hardcoded 'ThunderID' in prose; use instead.
[error] 96-96: Structural docs lint error: hardcoded 'ThunderID' in prose; use instead.
🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
In `@docs/content/sdks/javascript/apis/configuration.mdx` around lines 95 - 98,
Replace both prose occurrences of the hardcoded “ThunderID” product name in the
configuration guidance with the <ProductName /> component, while keeping SDK
identifiers and any content inside fenced code blocks unchanged.
Sources: Path instructions, Learnings
d99684c to
a355cce
Compare
rajithacharith
added
the
trigger-pr-builder
Codecov Report✅ All modified and coverable lines are covered by tests. 📢 Thoughts on this report? Let us know! |
2 participants
Purpose
Fix user creation on a resource-server instance that is federated to an authorization server (trusted issuer).
In the trusted-issuer model the Console's
baseUrlpoints at the authorization server (IdP), so the SDK was sending the resource-server calls (user onboarding via/flow/execute,/flow/meta,/users/me) to the IdP instead of the resource server that owns the users. Creating a user therefore failed.Approach
The
@thunderid/javascriptSDK now supports overriding the resource-server endpoints independently of the OAuth/discovery endpoints (viaconfig.endpoints.flowExecute/flowMeta/usersMe). This PR wires that up on the Console side:frontend/apps/console/src/hocs/withConfig.tsx— whenconfig.trusted_issueris set, derive the resource-server URL fromgetServerUrl()and passendpoints: { flowExecute, flowMeta, usersMe }pointing at the resource server, whilebaseUrlcontinues to target the authorization server for OAuth/discovery.pnpm-workspace.yaml/pnpm-lock.yaml— bump the SDK catalog to the released versions that include the endpoint-override support and theInviteUseronboarding fix (@thunderid/react0.11.3,@thunderid/react-router0.10.2).docs/content/sdks/javascript/apis/configuration.mdx— document the resource-server endpoint overrides and the trusted-issuer scenario.The change is additive: without
trusted_issuer,getServerUrl()resolves to the served origin and behavior is unchanged.Related Issues
Related PRs
Checklist
docs/content/sdks/javascript/apis/configuration.mdx)breaking changelabel added.Security checks
Summary by CodeRabbit