feat: prefer canonical awaiting-input contract #20
+222
−19
There are no files selected for viewing
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,5 @@ | ||
| --- | ||
| "@onkernel/managed-auth-react": patch | ||
| --- | ||
|
|
||
| Prefer the canonical managed-auth awaiting-input contract (`fields` and `choices`) when present, while continuing to fall back to legacy `discovered_fields`, `pending_sso_buttons`, `mfa_options`, and `sign_in_options` during the deprecation window. |
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
|
|
@@ -5,7 +5,9 @@ import { | |
| retrieveManagedAuth, | ||
| streamManagedAuthEvents, | ||
| submitFieldValues, | ||
| submitCanonicalFieldValues, | ||
| submitMFASelection, | ||
| submitSelectedChoice, | ||
| submitSignInOption, | ||
| submitSSOButton, | ||
| type ApiClientOptions, | ||
|
|
@@ -14,8 +16,13 @@ import { | |
| import type { | ||
| AuthErrorPayload, | ||
| AuthSuccessPayload, | ||
| DiscoveredField, | ||
| ManagedAuthChoice, | ||
| ManagedAuthField, | ||
| ManagedAuthResponse, | ||
| MFAType, | ||
| MFAOption, | ||
| SignInOption, | ||
| SSOButton, | ||
| UIState, | ||
| } from "../lib/types"; | ||
|
|
@@ -57,6 +64,13 @@ function mergeStateEvent( | |
| flow_status: ev.flow_status, | ||
| flow_step: ev.flow_step, | ||
| flow_type: ev.flow_type ?? base.flow_type ?? null, | ||
| // State events carry a complete snapshot of the awaiting-input state: | ||
| // the server omits fields/choices when the current step has none, so an | ||
| // absent key means "cleared", not "unchanged". Falling back to the prior | ||
| // state here leaks a previous step's inputs (e.g. login SSO buttons | ||
| // rendering on the MFA step). | ||
| fields: ev.fields ?? null, | ||
| choices: ev.choices ?? null, | ||
| discovered_fields: ev.discovered_fields ?? null, | ||
| pending_sso_buttons: ev.pending_sso_buttons ?? null, | ||
| mfa_options: ev.mfa_options ?? null, | ||
|
|
@@ -71,6 +85,128 @@ function mergeStateEvent( | |
| }; | ||
| } | ||
|
|
||
| function fieldTypeToDiscoveredType( | ||
| field: ManagedAuthField, | ||
| ): DiscoveredField["type"] { | ||
| switch (field.type) { | ||
| case "identifier": | ||
| return "email"; | ||
| case "totp_code": | ||
| return "totp"; | ||
| case "totp_secret": | ||
| return "text"; | ||
| default: | ||
| return field.type; | ||
| } | ||
| } | ||
|
|
||
| function fieldsFromCanonical( | ||
| fields?: ManagedAuthField[] | null, | ||
| ): DiscoveredField[] | null { | ||
| if (!fields?.length) return null; | ||
| return fields.map((field) => ({ | ||
| id: field.id, | ||
| ref: field.ref, | ||
| name: field.id, | ||
| type: fieldTypeToDiscoveredType(field), | ||
| label: field.label || field.ref, | ||
| required: field.required ?? true, | ||
| })); | ||
| } | ||
|
|
||
| function ssoButtonsFromCanonical( | ||
| choices?: ManagedAuthChoice[] | null, | ||
| ): SSOButton[] | null { | ||
| if (!choices?.length) return null; | ||
| const buttons = choices | ||
| .filter((choice) => choice.type === "sso_provider") | ||
| .map((choice) => ({ | ||
| id: choice.id, | ||
| provider: choice.id, | ||
| selector: choice.observed_selector || choice.id, | ||
| label: choice.label, | ||
| })); | ||
| return buttons.length ? buttons : null; | ||
| } | ||
|
|
||
| function normalizeMFAChoiceId(id: string): MFAType { | ||
| switch (id.trim().toLowerCase()) { | ||
| case "sms_code": | ||
| case "sms": | ||
| return "sms"; | ||
| case "email_code": | ||
| case "email": | ||
| return "email"; | ||
| case "totp_code": | ||
| case "totp": | ||
| case "authenticator": | ||
| case "authenticator_app": | ||
| return "totp"; | ||
| case "phone_call": | ||
| case "call": | ||
| return "call"; | ||
| case "push": | ||
| return "push"; | ||
| case "password": | ||
| return "password"; | ||
| case "passkey": | ||
| return "passkey"; | ||
| case "switch": | ||
| return "switch"; | ||
| default: | ||
| return "other"; | ||
| } | ||
| } | ||
|
|
||
| function mfaOptionsFromCanonical( | ||
| choices?: ManagedAuthChoice[] | null, | ||
| ): MFAOption[] | null { | ||
| if (!choices?.length) return null; | ||
| const options = choices | ||
| .filter((choice) => choice.type === "mfa_method") | ||
| .map((choice) => ({ | ||
| type: normalizeMFAChoiceId(choice.id), | ||
| label: choice.label, | ||
| description: choice.description ?? undefined, | ||
| })); | ||
| return options.length ? options : null; | ||
| } | ||
|
|
||
| function signInOptionsFromCanonical( | ||
| choices?: ManagedAuthChoice[] | null, | ||
| ): SignInOption[] | null { | ||
| if (!choices?.length) return null; | ||
| const options = choices | ||
| .filter( | ||
| (choice) => | ||
| choice.type !== "sso_provider" && choice.type !== "mfa_method", | ||
| ) | ||
| .map((choice) => ({ | ||
| id: choice.id, | ||
| label: choice.label, | ||
| description: | ||
| choice.description ?? choice.context ?? choice.display_text ?? null, | ||
| })); | ||
| return options.length ? options : null; | ||
| } | ||
|
|
||
| function normalizeManagedAuthState( | ||
| state: ManagedAuthResponse, | ||
| ): ManagedAuthResponse { | ||
| return { | ||
| ...state, | ||
| // Prefer the canonical contract when present; legacy fields stay as fallback | ||
| // during the deprecation period. | ||
| discovered_fields: | ||
| fieldsFromCanonical(state.fields) ?? state.discovered_fields, | ||
| pending_sso_buttons: | ||
| ssoButtonsFromCanonical(state.choices) ?? state.pending_sso_buttons, | ||
| mfa_options: mfaOptionsFromCanonical(state.choices) ?? state.mfa_options, | ||
| sign_in_options: | ||
| signInOptionsFromCanonical(state.choices) ?? state.sign_in_options, | ||
|
There was a problem hiding this comment. Legacy fallback ignores canonical presenceMedium Severity
  Reviewed by Cursor Bugbot for commit aa4d14b. Configure here. |
||
| }; | ||
| } | ||
|
|
||
| export interface ManagedAuthSessionOptions extends ApiClientOptions { | ||
| sessionId: string; | ||
| handoffCode: string; | ||
|
|
@@ -167,7 +303,7 @@ export function useManagedAuthSession( | |
| setSubmitError(null); | ||
| const base = stateRef.current; | ||
| if (!base) return; | ||
| const merged = normalizeManagedAuthState(mergeStateEvent(base, ev)); | ||
| stateRef.current = merged; | ||
| setState(merged); | ||
| const nextUI = deriveUIState(merged); | ||
|
|
@@ -214,7 +350,9 @@ export function useManagedAuthSession( | |
| const gen = generationRef.current; | ||
| if (terminalRef.current) return; | ||
| try { | ||
| const fresh = normalizeManagedAuthState( | ||
| await retrieveManagedAuth(sessionId, t, options), | ||
| ); | ||
| if (gen !== generationRef.current) return; | ||
| if (terminalRef.current) return; | ||
| stateRef.current = fresh; | ||
|
|
@@ -338,7 +476,9 @@ export function useManagedAuthSession( | |
| ); | ||
| if (exchangeRef.current !== ref || !ref.active) return; | ||
| setJwt(token); | ||
| const initial = normalizeManagedAuthState( | ||
| await retrieveManagedAuth(sessionId, token, options), | ||
| ); | ||
| if (exchangeRef.current !== ref || !ref.active) return; | ||
| stateRef.current = initial; | ||
| setState(initial); | ||
|
|
@@ -410,8 +550,12 @@ export function useManagedAuthSession( | |
| const submitFields = useCallback( | ||
| async (credentials: Record<string, string>) => { | ||
| if (!jwt) return; | ||
| const hasCanonicalFields = (stateRef.current?.fields?.length ?? 0) > 0; | ||
| return submit( | ||
| () => | ||
| hasCanonicalFields | ||
| ? submitCanonicalFieldValues(sessionId, jwt, credentials, options) | ||
| : submitFieldValues(sessionId, jwt, credentials, options), | ||
| "Failed to submit credentials", | ||
| ); | ||
| }, | ||
|
|
@@ -422,7 +566,10 @@ export function useManagedAuthSession( | |
| async (button: SSOButton) => { | ||
| if (!jwt) return; | ||
| return submit( | ||
| () => | ||
| button.id | ||
| ? submitSelectedChoice(sessionId, jwt, button.id, options) | ||
| : submitSSOButton(sessionId, jwt, button.selector, options), | ||
|
There was a problem hiding this comment. MFA ignores canonical choice submitMedium Severity MFA options built from canonical Additional Locations (1)Reviewed by Cursor Bugbot for commit 30a2d0b. Configure here. |
||
| "Failed to initiate SSO login", | ||
| ); | ||
| }, | ||
|
|
||
Oops, something went wrong.
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
MFA canonical mapping drops display text
Medium Severity
mfaOptionsFromCanonicalonly copiesdescriptionfrom each MFA choice, whilesignInOptionsFromCanonicalalso falls back tocontextanddisplay_text. Masked phone numbers or similar MFA hints often live in those fields, so canonical MFA steps can show labels without the extra detail legacytargetused to provide.Reviewed by Cursor Bugbot for commit aa4d14b. Configure here.