Add SSO support to the Wayfinder sample authentication flow

[Dilusha-Madushan]

Purpose

The Wayfinder sample's authentication flow (wayfinder-app-auth-flow) had no SSO
handling, so every authorization request landed on the credentials prompt even when
the user already had a valid session. This PR adds SSO support to that flow, bringing
the sample in line with the default Console app authentication flow.

Scope is limited to wayfinder-app-auth-flow in the two Wayfinder sample
configurations (redirect and app-native). The registration, recovery, CIBA email,
CIBA SMS, and agent authentication flows are unchanged.

Approach

Two nodes were added to the flow:

• sso_check (SSOCheckExecutor), inserted between start and the credentials
  prompt. It declares checkpointRef: session, so on a session hit the flow jumps
  straight to the session join node, and on a miss onFailure falls through to
  prompt_credentials.
• session (SessionExecutor), inserted as the join node before
  authorization_check. credentials_auth.onSuccess now targets it instead of
  authorization_check, so both the SSO path and the interactive login path
  converge on the same node before authorization.

Related Issues

• Add SSO support for the Wayfinder Sample to avoid double login (app + chat) #4237

Summary by CodeRabbit

• New Features

  • Added an existing-session check before requesting authentication credentials.
  • Successful session checks now proceed directly through authentication.
  • Credential-based authentication includes an intermediate session step before authorization.

• Bug Fixes

  • Users with incomplete or failed authentication are returned to the credential prompt.

[coderabbitai]

No actionable comments were generated in the recent review. 🎉

ℹ️ Recent review info

⚙️ Run configuration

Configuration used: Path: .coderabbit.yaml

Review profile: CHILL

Plan: Pro Plus

Run ID: 0a65c578-d064-47ad-987f-f9f2b89837a2

📥 Commits

Reviewing files that changed from the base of the PR and between 057f70c and 8f20f6f.

📒 Files selected for processing (2)

• samples/apps/wayfinder-sample/thunderid-config/app-native/thunderid-config.yaml
• samples/apps/wayfinder-sample/thunderid-config/redirect/thunderid-config.yaml

---

📝 Walkthrough

Walkthrough

The Wayfinder authentication configurations now check for an existing SSO session before prompting for credentials. Successful SSO and credential authentication pass through session handling before authorization.

Changes

Wayfinder authentication flow

Layer / File(s)	Summary
SSO session check entry samples/apps/wayfinder-sample/thunderid-config/app-native/thunderid-config.yaml, samples/apps/wayfinder-sample/thunderid-config/redirect/thunderid-config.yaml	Authentication starts with SSOCheckExecutor. Successful checks continue to the session task. Failed checks continue to the credential prompt.
Credential session transition samples/apps/wayfinder-sample/thunderid-config/app-native/thunderid-config.yaml, samples/apps/wayfinder-sample/thunderid-config/redirect/thunderid-config.yaml	Successful credential authentication enters SessionExecutor before authorization. Incomplete authentication returns to the credential prompt where configured.

Estimated code review effort: 2 (Simple) | ~10 minutes

Possibly related PRs

• thunder-id/thunderid#3898: Modifies the same redirect authentication configuration and its flow handle.
• thunder-id/thunderid#3918: Documents related SSO session and save/load session behavior.
• thunder-id/thunderid#4638: Modifies the same Wayfinder authentication routing and authorization transitions.

Suggested reviewers: brionmario, donomalvindula

🚥 Pre-merge checks | ✅ 5

✅ Passed checks (5 passed)

Check name	Status	Explanation
Title check	✅ Passed	The title clearly and concisely describes the main change: adding SSO support to the Wayfinder sample authentication flow.
Description check	✅ Passed	The description covers the purpose, approach, scope, and related issue, but it omits the template's Related PRs, Checklist, and Security checks sections.
Docstring Coverage	✅ Passed	No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check.
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.

✨ Finishing Touches 💡 1

🛠️ Fix failing CI checks 💡

• Create stacked PR
• Commit on current branch

🧪 Generate unit tests (beta)

• Create PR with unit tests

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}

[codecov]

Codecov Report

✅ All modified and coverable lines are covered by tests.

📢 Thoughts on this report? Let us know!