Enable request object signature validation config #9570
Conversation
WalkthroughEnable request object signature validation by default, consolidate Request Object UI so signature-validation control and signing/encryption fields render together, add a changeset bumping related packages, and update the translation string describing signature validation. Changes
Estimated code review effort🎯 3 (Moderate) | ⏱️ ~20 minutes Poem
🚥 Pre-merge checks | ✅ 3✅ Passed checks (3 passed)
✏️ Tip: You can configure your own custom pre-merge checks in the settings. ✨ Finishing touches
Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out. Comment |
![coderabbitai[bot]](https://avatars.githubusercontent.com/in/347564?s=60&v=4){kind=small}
There was a problem hiding this comment.
Actionable comments posted: 1
Caution
Some comments are outside the diff and can’t be posted inline due to platform limitations.
⚠️ Outside diff range comments (1)
features/admin.applications.v1/components/forms/inbound-oidc-form.tsx (1)
2724-2892: GuardrequestObjectupdates when configuration fields are hidden.When
showRequestObjectConfigurationsisfalsebutshowRequestObjectSignatureValidationistrue, the Request Object section renders but the signing and encryption fields are not mounted. However,updateConfigurationunconditionally buildsrequestObjectfrom form values, resulting inundefinedvalues being sent to the API and potentially clearing existing request-object settings. Add a guard to deleterequestObjectwhen the configuration is hidden, matching the existing pattern forvalidateRequestObjectSignature:!applicationConfig.inboundOIDCForm.showRequestObjectSignatureValidation && delete inboundConfigFormValues.validateRequestObjectSignature; +!applicationConfig.inboundOIDCForm.showRequestObjectConfigurations + && delete inboundConfigFormValues.requestObject;
🤖 Fix all issues with AI agents
In `@features/admin.applications.v1/components/forms/inbound-oidc-form.tsx`:
- Around line 2739-2876: The four Field components (refs
requestObjectSigningAlg, requestObjectEncryptionAlgorithm,
requestObjectEncryptionMethod, and enableRequestObjectSignatureValidation) are
passing options via a children prop which triggers Biome's noChildrenProp rule;
change each to use standard JSX children instead (i.e., remove the children=...
prop and place the array or JSX elements between the <Field>...</Field> tags),
keeping all other props (name, label, default, placeholder, readOnly,
data-componentId/testid) intact and preserving the exact option arrays/JSX (for
checkbox entries keep the array of { label, value } objects as the inner
children).
features/admin.applications.v1/components/forms/inbound-oidc-form.tsx
Outdated
Show resolved
Hide resolved
Codecov Report✅ All modified and coverable lines are covered by tests. Additional details and impacted files@@ Coverage Diff @@
## master #9570 +/- ##
=======================================
Coverage 55.88% 55.88%
=======================================
Files 42 42
Lines 1020 1020
Branches 231 246 +15
=======================================
Hits 570 570
+ Misses 450 416 -34
- Partials 0 34 +34
Flags with carried forward coverage won't be shown. Click here to find out more. 🚀 New features to boost your workflow:
|
There was a problem hiding this comment.
Actionable comments posted: 1
🤖 Fix all issues with AI agents
In `@features/admin.applications.v1/components/forms/inbound-oidc-form.tsx`:
- Around line 2724-2726: The new OR condition can render the signature
validation checkbox while the request object signing/encryption fields are
hidden, causing updateConfiguration to serialize a potentially undefined
requestObject and overwrite existing settings; modify updateConfiguration to
check the visibility flags
(applicationConfig.inboundOIDCForm.showRequestObjectConfigurations and
showRequestObjectSignatureValidation) and, if the full requestObject fields are
hidden, either preserve initialValues.requestObject or omit requestObject from
the payload so hidden/undefined form fields do not overwrite stored
requestObject settings when saving.
| && (applicationConfig?.inboundOIDCForm?.showRequestObjectConfigurations | ||
| || applicationConfig.inboundOIDCForm.showRequestObjectSignatureValidation) | ||
| && ( |
There was a problem hiding this comment.
Prevent clearing request object settings when only signature validation is shown.
With the new OR-gate (Line 2724), the signature validation checkbox (Line 2856) can render while the request object signing/encryption fields remain hidden. updateConfiguration still serializes requestObject from form values, so hidden fields will likely be undefined and can overwrite existing request object settings on save. Consider preserving initialValues.requestObject or omitting requestObject when configs are hidden.
🛠️ Suggested guard in updateConfiguration
- inboundConfigFormValues = {
- ...inboundConfigFormValues,
- pushAuthorizationRequest: {
- requirePushAuthorizationRequest: values.get("requirePushAuthorizationRequest")?.length > 0
- },
- requestObject: {
- encryption: {
- algorithm: values.get("requestObjectEncryptionAlgorithm"),
- method: values.get("requestObjectEncryptionMethod")
- },
- requestObjectSigningAlg: values.get("requestObjectSigningAlg")
- },
- subject: {
- sectorIdentifierUri: initialValues?.subject?.sectorIdentifierUri,
- subjectType: initialValues?.subject?.subjectType
- }
- };
+ const requestObjectConfig = applicationConfig.inboundOIDCForm.showRequestObjectConfigurations
+ ? {
+ encryption: {
+ algorithm: values.get("requestObjectEncryptionAlgorithm"),
+ method: values.get("requestObjectEncryptionMethod")
+ },
+ requestObjectSigningAlg: values.get("requestObjectSigningAlg")
+ }
+ : initialValues?.requestObject;
+
+ inboundConfigFormValues = {
+ ...inboundConfigFormValues,
+ pushAuthorizationRequest: {
+ requirePushAuthorizationRequest: values.get("requirePushAuthorizationRequest")?.length > 0
+ },
+ ...(requestObjectConfig ? { requestObject: requestObjectConfig } : {}),
+ subject: {
+ sectorIdentifierUri: initialValues?.subject?.sectorIdentifierUri,
+ subjectType: initialValues?.subject?.subjectType
+ }
+ };Also applies to: 2856-2896
🤖 Prompt for AI Agents
In `@features/admin.applications.v1/components/forms/inbound-oidc-form.tsx` around
lines 2724 - 2726, The new OR condition can render the signature validation
checkbox while the request object signing/encryption fields are hidden, causing
updateConfiguration to serialize a potentially undefined requestObject and
overwrite existing settings; modify updateConfiguration to check the visibility
flags (applicationConfig.inboundOIDCForm.showRequestObjectConfigurations and
showRequestObjectSignatureValidation) and, if the full requestObject fields are
hidden, either preserve initialValues.requestObject or omit requestObject from
the payload so hidden/undefined form fields do not overwrite stored
requestObject settings when saving.
hwupathum
force-pushed
the
hwupathum-patch-3
branch
3 times, most recently
from
378a7fe to
0545767
Compare
hwupathum
force-pushed
the
hwupathum-patch-3
branch
from
0545767 to
6a610a5
Compare
This pull request enables the request object signature validation configuration by default in the admin applications UI and refactors the related form logic to improve how the configuration is displayed. The main focus is on making the signature validation option visible and manageable by default, with some code cleanup and conditional rendering improvements.
Configuration changes:
showRequestObjectSignatureValidationflag in theapplicationConfigobject is now set totrueby default, enabling the request object signature validation configuration for all relevant applications.UI and form rendering improvements:
InboundOIDCFormwas updated so that the request object signature validation option is now shown by default where appropriate, and its checkbox is rendered within the main request object section instead of as a separate section. [1] [2] [3] [4]Related Issues
Related PRs
Checklist
Security checks
Developer Checklist (Mandatory)
product-isissue to track any behavioral change or migration impact.Summary by CodeRabbit
New Features
UI
Chores
✏️ Tip: You can customize this high-level summary in your review settings.