Repository navigation
Let admin components run administration flows and lifecycle actions - #57
Open
brionmario wants to merge 1 commit into
Open
brionmario wants to merge 1 commit into
brionmario wants to merge 1 commit into
Conversation
The admin widgets called the management API directly, so an app that cleans up runtime state through administration flows (revoking grants and ending sessions) could not use them, and they had no way to suspend, unsuspend or unlock an identity. - `administrationMode` (default `native`) on UserDetails, GroupMembers, RoleAssignments and ApplicationDetails, passed to the delete, member removal, assignment removal and secret regeneration mutations. - `lifecycleActions` on UserDetails, AgentDetails and ApplicationDetails. When on, the widget reads the configured flows and offers only the actions the identity's status allows and whose flow is configured. Suspend and unsuspend confirm inline, a suspension of a user or agent takes an optional operator note (max 100), and unlock runs straight away. The Base variants and their builder state get `lifecycleActions`, `onLifecycleAction` and `isRunningLifecycleAction`. - The access status is typed on users, agents and applications (`AccessStatus`) and shown as a translated label; an application no longer sends its server-set status back on an update. - Core: `getAccountLifecycleActions`, `runAccountLifecycleAction`, `AccountLifecycleAction` and `AccountLifecycleSubjectKind`, plus the state-layer query and mutation; new strings in the bundled locale. - Tests, and playground controls for the details, members and assignments stories. Signed-off-by: Brion <info@brionmario.com>
|
Important
This repository does not receive automatic reviews because it has fewer than 10 stars.
 |
🔀 Cross-SDK feature parity, ports raisedThis pull request is labelled Ports (DO NOT EDIT)
3 of 3 sibling SDKs accounted for. Every sibling SDK is accounted for. The contract is in the SDK development specification. |
brionmario
added
the
parity/prs-raised
Member
Author
|
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Purpose
Port of thunder-id/javascript-sdks#141. The admin components called the management API directly, so an app that cleans up runtime state through the server's administration flows (revoking grants and ending sessions before a record changes) couldn't use them. They also had no way to suspend, unsuspend or unlock an identity, which only work through flows. This implements UI requirement 8 of the SDK specification (thunder-id/thunderid#6080).
Approach
administrationMode(defaultnative) onUserDetails,GroupMembers,RoleAssignmentsandApplicationDetails, passed to the user deletion, group member removal, role assignment removal, application deletion and client secret regeneration calls. Agent details has none, because agent deletion has no flow.lifecycleActions(default off) on user, agent and application details. When on, the component reads the configured flows (only then) and offers the actions the record's status allows whose flow is configured:ACTIVE→ suspend;LOCKED→ unlock, suspend;SUSPENDED→ unsuspend. Applications are never locked. Suspend and unsuspend ask for confirmation inline, a user or agent suspension takes an optional operator note (up to 100 characters), and unlock runs straight away. The record and its list reload afterwards.builderstates:UserDetailsState,AgentDetailsState,ApplicationDetailsState) receivelifecycleActions,onLifecycleActionandisRunningLifecycleAction. These apply to read-only records too, since they change only runtime state.admin.common.lifecycle.load_error, and a failed action showsadmin.common.lifecycle.error.AccessStatus(withAccessStatusDetailsandAccessLockedMethod) read onManagedUser,AgentandApplication. Unknown values are kept as sent.AccountLifecycleAction, andAccountLifecycleSubjectKindwith itsflowConfigKeys. The client gainsrunAccountLifecycleAction(...), which refuses an application unlock withinvalidInput, plus a top-levelgetAccountLifecycleActions. The state layer gainsaccountLifecycleFlowsQuery,accountLifecycleMutation, andadministrationModeon the affected mutations.admin.common.status.*,admin.common.lifecycle.*andadmin.common.columns.statuskeys. This SDK ships English defaults only, so there are no other locales to fill.Application.statusis now typed and no longer kept inadditionalFields. It used to be sent back on updates, which the server never accepts. The round-trip test checks it.administrationModecontrols on the admin stories, and lifecycle actions in the custom-render user card.Related Issues
Related PRs
Checklist
flutter test532 passed;flutter analyzecleanbreaking changelabel added.parity/prs-raisedorparity/prs-not-neededadded.parity/prs-raised, the port links are posted as a reply on the parity check's comment.Security checks