Add Device Grant flow Support by Yathusiga27 · Pull Request #140 · thunder-id/javascript-sdks

Yathusiga27 · 2026-10-28T04:49:59Z

Purpose

Adds Device Grant verification, allowing users to enter a code from their device and complete the server-described authorization flow in the browser.

Approach

Adds a framework-agnostic Device Grant flow executor in @thunderid/javascript.
Renders server-described flow steps and supports prefilled verification codes.
Adds Device Grant stories to the playground.

Related Issues

Related PRs

N/A

Checklist

Security checks

Followed secure coding standards.
Confirmed that this PR doesn't commit any keys, passwords, tokens, usernames, or other secrets.

coderabbitai · 2026-10-28T04:50:07Z

Important

🔍 Trigger review

This repository does not receive automatic reviews because it has fewer than 10 stars.

Run configuration

Source mode: Auto
Repository: thunder-id/javascript-sdks
Branch: main
File: .coderabbit.yaml
Commit: 44e4f95
Layers: Repository YAML
Review profile: CHILL
Plan: Advanced
Run ID: 301074a8-35ca-437e-ab1c-1a1d67df28ad

Autofix · Keep fixing CodeRabbit findings and required CI, and resolving merge conflicts

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

_{Comment @coderabbitai help to get the list of available commands.}

github-actions · 2026-10-28T04:50:10Z

🔀 Cross-SDK feature parity

Does this change need to ship in the other ThunderID SDKs too? This check stays red until one of these labels answers that:

Label	What it asserts
`parity/prs-raised`	The ports exist in every other SDK this change reaches, or are recorded as not applying there.
`parity/prs-not-needed`	Nothing to port: a fix, refactor, docs, CI, dependency bump, release, or a change specific to this platform.

Ports (DO NOT EDIT)

thunder-id/ios-sdks, iOS
thunder-id/android-sdks, Android
thunder-id/flutter-sdks, Flutter

No sibling SDKs accounted for on this thread yet.

Important

Reply to this comment with this block, filled in. The boxes above tick
themselves when you post it.

- thunder-id/ios-sdks: <paste the port link here>
- thunder-id/android-sdks: <paste the port link here>
- thunder-id/flutter-sdks: <paste the port link here>

A link can be a pull request or a tracked issue, written in full or as thunder-id/ios-sdks#123.
Where the change does not reach an SDK, replace the placeholder with N/A and a short
reason, as in - thunder-id/ios-sdks: N/A, the capability has no equivalent there.

The contract is in the SDK development specification.

thiva-k · 2026-10-29T12:52:42Z

+}: DeviceGrantProps): ReactElement => {
+  const {applicationId, baseUrl, meta} = useThunderID();
+  const {t} = useTranslation(preferences?.i18n);
+  const userCodeComponents = useMemo<EmbeddedFlowComponent[]>(


The code prompt comes from the application's configured Device Grant flow and the server checks the code belongs to that application. Since the verification URI already carries the application id, shall we drop the SDK built code form and the start with only the user code? Same for Vue.

thiva-k · 2026-10-29T12:52:43Z

+    'flowType' in payload &&
+    payload.flowType === EmbeddedFlowType.DeviceGrant &&
+    'inputs' in payload &&
+    ((typeof payload.applicationId === 'string' && payload.applicationId.trim().length > 0) ||


Once the code only start is removed, lets make the application id required here and in the start payload type.

thiva-k · 2026-10-29T12:52:43Z

+  headers: HeadersInit | undefined,
+  allowAccessDenied: boolean,
+): Promise<Record<string, unknown>> => {
+  const callbackUrl: string = new URL('/oauth2/auth/callback', endpoint).toString();


This keeps only the origin for the callback URL, so a base URL with a path (e.g. behind a reverse proxy) breaks. Can't we reuse the callback handling in the sign in executor? It uses the base URL and already relays failures.

thiva-k · 2026-10-29T12:52:43Z

-      transition:
-        border-color 0.2s ease,
-        box-shadow 0.2s ease;
+      transition: border-color 0.2s ease;


Why is the focus ring removed? This changes every text field in the SDK and removes the visible focus indicator. Lets revert this and the border radius change, they are unrelated to device grant.

thiva-k · 2026-10-29T12:52:43Z


+  /* Device Grant */
+  'deviceGrant.prompt.heading': 'Enter the code shown on your device',
+  'deviceGrant.prompt.description': 'Enter the verification code to continue.',


deviceGrant.prompt.description and deviceGrant.errors.start aren't used anywhere. The prompt keys also go away once the SDK built form is removed. Check other locales too.

Signed-off-by: Yathusiga27 <yathu2708@gmail.com>

brionmario · 2026-10-30T05:39:19Z

@Yathusiga27 Lets link the parity PRs once you have them ready.

Moves @thunderid/react to 1.11.1 and @thunderid/react-router to 1.10.1 (@thunderid/browser 1.9.1 and @thunderid/javascript 1.10.1 follow transitively). These releases post the SSO sessions a flow's responses return on the authorization callback (thunder-id/javascript-sdks#147), so a sign-in through the Gate that asks for the device_sso scope now receives a device secret (thunder-id#6227). They also bring Device Grant support (thunder-id/javascript-sdks#140), an ouId prop on GroupMembers (thunder-id/javascript-sdks#146), and granted permissions read from the backend session in backend mode (thunder-id/javascript-sdks#148). Refs thunder-id#6144 Signed-off-by: ImalshaD <plid475@gmail.com>

Yathusiga27 force-pushed the feature/device-grant branch 2 times, most recently from 488be89 to eca7963 Compare October 28, 2026 05:19

Yathusiga27 changed the title ~~Add Device Grant flow to React SDK~~ Add Device Grant flow Oct 28, 2026

Yathusiga27 changed the title ~~Add Device Grant flow~~ Add Device Grant flow Support Oct 28, 2026

Yathusiga27 force-pushed the feature/device-grant branch from eca7963 to 3fba018 Compare October 29, 2026 10:36

thiva-k reviewed Oct 29, 2026

View reviewed changes

Add Device Grant support across JavaScript SDKs

972d3a8

Signed-off-by: Yathusiga27 <yathu2708@gmail.com>

Yathusiga27 force-pushed the feature/device-grant branch from 3fba018 to 972d3a8 Compare October 29, 2026 15:02

thiva-k approved these changes Oct 29, 2026

View reviewed changes

brionmario added the parity/prs-pending Porting in the other SDKs are still pending and issues are created label Oct 30, 2026

brionmario merged commit 4d64803 into thunder-id:main Oct 30, 2026
6 of 8 checks passed

ImalshaD mentioned this pull request Oct 30, 2026

Bump the ThunderID JavaScript SDKs to post SSO sessions on the callback thunder-id/thunderid#6245

Merged

4 of 12 tasks

Navigation Menu

Repository navigation

Add Device Grant flow Support - #140

Add Device Grant flow Support#140
brionmario merged 1 commit into
thunder-id:mainfrom
Yathusiga27:feature/device-grant

Yathusiga27 commented Oct 28, 2026 •

edited

Loading

Uh oh!

coderabbitai Bot commented Oct 28, 2026 •

edited

Loading

Uh oh!

github-actions Bot commented Oct 28, 2026

Uh oh!

thiva-k Oct 29, 2026 •

edited

Loading

Uh oh!

thiva-k Oct 29, 2026

Uh oh!

thiva-k Oct 29, 2026

Uh oh!

thiva-k Oct 29, 2026

Uh oh!

thiva-k Oct 29, 2026

Uh oh!

Uh oh!

brionmario commented Oct 30, 2026

Uh oh!

Reviewers

Uh oh!

Assignees

Labels

Projects

Milestone

Development

Uh oh!

3 participants

Conversation

Yathusiga27 commented Oct 28, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Purpose

Approach

Related Issues

Related PRs

Checklist

Security checks

Uh oh!

coderabbitai Bot commented Oct 28, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

github-actions Bot commented Oct 28, 2026

🔀 Cross-SDK feature parity

Ports (DO NOT EDIT)

Uh oh!

thiva-k Oct 29, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Choose a reason for hiding this comment

Uh oh!

thiva-k Oct 29, 2026

Choose a reason for hiding this comment

Uh oh!

thiva-k Oct 29, 2026

Choose a reason for hiding this comment

Uh oh!

thiva-k Oct 29, 2026

Choose a reason for hiding this comment

Uh oh!

thiva-k Oct 29, 2026

Choose a reason for hiding this comment

Uh oh!

Uh oh!

brionmario commented Oct 30, 2026

Uh oh!

Reviewers

Uh oh!

Assignees

Labels

Projects

Milestone

Development

Uh oh!

3 participants

Yathusiga27 commented Oct 28, 2026 •

edited

Loading

coderabbitai Bot commented Oct 28, 2026 •

edited

Loading

thiva-k Oct 29, 2026 •

edited

Loading