Provide support to use separate resource servers - #46
Conversation
|
Warning Review limit reached
Next review available in: 13 minutes Enable usage-based reviews in Billing to review now. Otherwise, wait until the next included review is available. How can I continue?After more reviews become available, a review can be triggered using the To avoid repeated limits, reduce automatic review volume by pausing incremental auto-reviews earlier, using label-based review opt-in, excluding WIP or generated PR titles, or requesting reviews manually when the PR is ready. If your team needs uninterrupted high-volume reviews, an organization admin can enable usage-based reviews. How do review limits work?CodeRabbit enforces per-developer PR review limits for each organization. Most developers receive the normal plan review availability. For paid Pro and Pro+ PR reviews, CodeRabbit uses adaptive limits for sustained high-volume activity. When a developer's recent PR review activity reaches the 95th percentile or higher among CodeRabbit users, additional reviews become available more gradually as earlier reviews age out of the rolling window. Please refer docs for additional details. Review details⚙️ Run configurationConfiguration used: Path: .coderabbit.yaml Review profile: CHILL Plan: Pro Plus Run ID: 📒 Files selected for processing (19)
📝 WalkthroughWalkthroughThe SDKs add configurable resource-server endpoints for flow execution, flow metadata, and current-user operations. React, Vue, Next.js, and Express integrations now resolve these endpoints from configuration or explicit URLs. ChangesResource endpoint configuration
Estimated code review effort: 3 (Moderate) | ~25 minutes Sequence Diagram(s)sequenceDiagram
participant Provider
participant resolveResourceEndpoint
participant ResourceAPI
Provider->>resolveResourceEndpoint: Resolve flow or profile endpoint
resolveResourceEndpoint-->>Provider: Return configured or explicit URL
Provider->>ResourceAPI: Send request to resolved endpoint
Possibly related PRs
Suggested reviewers: 🚥 Pre-merge checks | ✅ 4 | ❌ 1❌ Failed checks (1 warning)
✅ Passed checks (4 passed)
✨ Finishing Touches🧪 Generate unit tests (beta)
Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out. Comment |
![coderabbitai[bot]](https://avatars.githubusercontent.com/in/347564?s=60&v=4){kind=small}
There was a problem hiding this comment.
Actionable comments posted: 2
🧹 Nitpick comments (1)
packages/javascript/src/utils/__tests__/AuthenticationHelper.resourceEndpoints.test.ts (1)
35-64: 📐 Maintainability & Code Quality | 🔵 Trivial | ⚡ Quick winCover all endpoint-resolution methods.
This test only calls
resolveEndpointsByBaseURL. Add the same resource-endpoint exclusion assertions forresolveEndpointsandresolveEndpointsExplicitly.🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the rest with a brief reason, keep changes minimal, and validate. In `@packages/javascript/src/utils/__tests__/AuthenticationHelper.resourceEndpoints.test.ts` around lines 35 - 64, Extend the AuthenticationHelper resource-endpoint filtering test to also call resolveEndpoints and resolveEndpointsExplicitly, asserting each result excludes flowExecute, flowMeta, and usersMe in both camelCase and snake_case while preserving OIDC endpoint resolution and overrides.
🤖 Prompt for all review comments with AI agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
Inline comments:
In `@packages/javascript/src/utils/AuthenticationHelper.ts`:
- Around line 75-86: Replace the repeated dynamic endpoint assignments with one
typed helper that filters out RESOURCE_ENDPOINT_KEYS, converts OIDC endpoint
names to snake_case, and safely maps configured endpoint values. Use this helper
in resolveEndpoints, resolveEndpointsExplicitly, and resolveEndpointsByBaseURL;
apply the change at packages/javascript/src/utils/AuthenticationHelper.ts lines
75-86, 139-150, and 179-190, respectively.
In `@packages/react/src/ThunderIDReactClient.ts`:
- Line 173: Reload the recovered configuration after client initialization and
before the endpoint resolution in the flow execution path. Update the logic
around this._initializeConfig and resolveResourceEndpoint so it uses the
persisted flowExecute/baseUrl values instead of the stale config loaded before
initialization.
---
Nitpick comments:
In
`@packages/javascript/src/utils/__tests__/AuthenticationHelper.resourceEndpoints.test.ts`:
- Around line 35-64: Extend the AuthenticationHelper resource-endpoint filtering
test to also call resolveEndpoints and resolveEndpointsExplicitly, asserting
each result excludes flowExecute, flowMeta, and usersMe in both camelCase and
snake_case while preserving OIDC endpoint resolution and overrides.
🪄 Autofix (Beta)
Fix all unresolved CodeRabbit comments on this PR:
- Push a commit to this branch (recommended)
- Create a new PR with the fixes
ℹ️ Review info
⚙️ Run configuration
Configuration used: Path: .coderabbit.yaml
Review profile: CHILL
Plan: Pro Plus
Run ID: f6abc3b9-4169-4f73-a88f-8655111769c9
📒 Files selected for processing (18)
packages/express/src/middleware/flow.tspackages/javascript/src/index.tspackages/javascript/src/models/config.tspackages/javascript/src/utils/AuthenticationHelper.tspackages/javascript/src/utils/__tests__/AuthenticationHelper.resourceEndpoints.test.tspackages/javascript/src/utils/__tests__/resolveResourceEndpoint.test.tspackages/javascript/src/utils/resolveResourceEndpoint.tspackages/nextjs/src/ThunderIDNextClient.tspackages/nextjs/src/server/ThunderIDProvider.tsxpackages/react/src/ThunderIDReactClient.tspackages/react/src/contexts/FlowMeta/FlowMetaProvider.tsxpackages/react/src/contexts/ThunderID/ThunderIDContext.tspackages/react/src/contexts/ThunderID/ThunderIDProvider.tsxpackages/vue/src/ThunderIDVueClient.tspackages/vue/src/components/presentation/user-profile/UserProfile.tspackages/vue/src/models/contexts.tspackages/vue/src/providers/FlowMetaProvider.tspackages/vue/src/providers/ThunderIDProvider.ts
There was a problem hiding this comment.
Actionable comments posted: 2
♻️ Duplicate comments (1)
packages/javascript/src/utils/AuthenticationHelper.ts (1)
75-86: 📐 Maintainability & Code Quality | 🟠 Major | ⚡ Quick winRestore type-safe OIDC endpoint mapping.
Static analysis still reports an unsafe assignment at each dynamic endpoint assignment. Resource-key filtering does not narrow arbitrary strings to valid OIDC metadata keys. Convert recognized OIDC endpoint names through one typed mapping before assigning values.
packages/javascript/src/utils/AuthenticationHelper.ts#L75-L86: use the typed mapping inresolveEndpoints.packages/javascript/src/utils/AuthenticationHelper.ts#L139-L150: use the typed mapping inresolveEndpointsExplicitly.packages/javascript/src/utils/AuthenticationHelper.ts#L179-L190: use the typed mapping inresolveEndpointsByBaseURL.🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the rest with a brief reason, keep changes minimal, and validate. In `@packages/javascript/src/utils/AuthenticationHelper.ts` around lines 75 - 86, Restore type-safe OIDC endpoint assignment by introducing or reusing one typed mapping from recognized endpoint names to OIDC metadata keys, then use it in resolveEndpoints, resolveEndpointsExplicitly, and resolveEndpointsByBaseURL instead of assigning through arbitrary dynamic strings. Apply this change at packages/javascript/src/utils/AuthenticationHelper.ts lines 75-86, 139-150, and 179-190, preserving resource-endpoint filtering and existing value resolution.Sources: Coding guidelines, Linters/SAST tools
🤖 Prompt for all review comments with AI agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
Inline comments:
In `@packages/react/src/contexts/ThunderID/ThunderIDProvider.tsx`:
- Line 464: Update the reInitialize flow so that after the client is
reinitialized, React config state is refreshed from client.getConfiguration().
Ensure both context endpoint usages receive the updated configuration rather
than stale config state, while preserving the existing client reinitialization
behavior.
In `@packages/vue/src/ThunderIDVueClient.ts`:
- Around line 101-107: The User profile request flow in ThunderIDVueClient must
use typed request options and ThunderIDVueConfig instead of method- or
variable-level any annotations. Update both affected sites in
packages/vue/src/ThunderIDVueClient.ts (lines 101-107 and 126-133): type the
method options with the intended option shape, type configuration data as
ThunderIDVueConfig, and preserve the existing baseUrl, url, and
resolveResourceEndpoint behavior.
---
Duplicate comments:
In `@packages/javascript/src/utils/AuthenticationHelper.ts`:
- Around line 75-86: Restore type-safe OIDC endpoint assignment by introducing
or reusing one typed mapping from recognized endpoint names to OIDC metadata
keys, then use it in resolveEndpoints, resolveEndpointsExplicitly, and
resolveEndpointsByBaseURL instead of assigning through arbitrary dynamic
strings. Apply this change at
packages/javascript/src/utils/AuthenticationHelper.ts lines 75-86, 139-150, and
179-190, preserving resource-endpoint filtering and existing value resolution.
🪄 Autofix (Beta)
Fix all unresolved CodeRabbit comments on this PR:
- Push a commit to this branch (recommended)
- Create a new PR with the fixes
ℹ️ Review info
⚙️ Run configuration
Configuration used: Path: .coderabbit.yaml
Review profile: CHILL
Plan: Pro Plus
Run ID: 9e1d9dbb-1c07-45f7-b7b2-421a1134de44
📒 Files selected for processing (19)
packages/express/src/middleware/flow.tspackages/javascript/src/index.tspackages/javascript/src/models/config.tspackages/javascript/src/utils/AuthenticationHelper.tspackages/javascript/src/utils/__tests__/AuthenticationHelper.resourceEndpoints.test.tspackages/javascript/src/utils/__tests__/resolveResourceEndpoint.test.tspackages/javascript/src/utils/resolveResourceEndpoint.tspackages/nextjs/src/ThunderIDNextClient.tspackages/nextjs/src/server/ThunderIDProvider.tsxpackages/react/src/ThunderIDReactClient.tspackages/react/src/components/presentation/auth/InviteUser/InviteUser.tsxpackages/react/src/contexts/FlowMeta/FlowMetaProvider.tsxpackages/react/src/contexts/ThunderID/ThunderIDContext.tspackages/react/src/contexts/ThunderID/ThunderIDProvider.tsxpackages/vue/src/ThunderIDVueClient.tspackages/vue/src/components/presentation/user-profile/UserProfile.tspackages/vue/src/models/contexts.tspackages/vue/src/providers/FlowMetaProvider.tspackages/vue/src/providers/ThunderIDProvider.ts
🚧 Files skipped from review as they are similar to previous changes (7)
- packages/javascript/src/utils/tests/AuthenticationHelper.resourceEndpoints.test.ts
- packages/javascript/src/utils/tests/resolveResourceEndpoint.test.ts
- packages/javascript/src/index.ts
- packages/react/src/contexts/ThunderID/ThunderIDContext.ts
- packages/vue/src/models/contexts.ts
- packages/javascript/src/utils/resolveResourceEndpoint.ts
- packages/javascript/src/models/config.ts
| * }); | ||
| * ``` | ||
| */ | ||
| const resolveResourceEndpoint = ( |
There was a problem hiding this comment.
Do we really need this wrapper?
There was a problem hiding this comment.
Will fix this with a followup PR as discussed
2 participants
Purpose
Add support for overriding the resource-server endpoints (
/flow/execute,/flow/meta,/users/me) independently of the OAuth/OIDC endpoints.Today the SDK derives both the OAuth endpoints and the Thunder resource APIs from a single
config.baseUrl. In a trusted-issuer (federated) setup the two live on different hosts: OAuth/discovery must target the authorization server (IdP), while flow and user-management calls must target the resource server. Because everything was pinned tobaseUrl, creating a user (USER_ONBOARDING→POST /flow/execute) was sent to the IdP instead of the resource server and failed.The OAuth endpoints were already overridable via
config.endpoints; this PR extends that same mechanism to the resource-server endpoints.Approach
config.endpointswithflowExecute,flowMeta, andusersMe, documented alongside the existing OAuth overrides (packages/javascript/src/models/config.ts).resolveResourceEndpoint(key, config, explicitUrl?)helper that resolves the effectiveurl(explicit per-call URL → config override →undefinedto fall back tobaseUrl), so behavior is unchanged when no override is set. Exported from the package index.AuthenticationHelperso they never leak into the OAuth endpoint resolution.javascript,react,vue,nextjs, andexpress. For the React/Vue context-based providers, exposeendpointsthrough the ThunderID context soFlowMetaProvider/UserProfilecan resolve it.The change is additive and backward-compatible: with no
endpointsoverride set, resolution falls back to${baseUrl}/...exactly as before.Related Issues
Related PRs
Checklist
config.endpoints; docs site page updated separately)resolveResourceEndpoint.test.ts,AuthenticationHelper.resourceEndpoints.test.ts)breaking changelabel added.Security checks
Summary by CodeRabbit
New Features
Bug Fixes
Tests