[brionmario]

Purpose

The admin components call the management API directly. An app that cleans up runtime state through the server's administration flows (revoking grants and ending sessions before a record changes), such as the ThunderID Admin App, could not use them. They also had no way to suspend, unsuspend or unlock an identity, which only work through flows.

Approach

• administrationMode (default 'native') on UserDetails, GroupMembers, RoleAssignments and ApplicationDetails. It is passed to the operations that already accept it: user deletion, group member removal, role assignment removal, and application deletion and client secret regeneration. AgentDetails has no such prop because deleteAgent has no flow.
• lifecycleActions (default false) on UserDetails, AgentDetails and ApplicationDetails. When it is on:
  • The component reads the configured flows (/server-config/flow, /flows). It reads them only then.
  • It offers the actions the record's status allows (ACTIVE → suspend; LOCKED → unlock, suspend; SUSPENDED → unsuspend) whose flow is configured. Applications are never locked.
  • Suspend and unsuspend confirm inline, and a suspension of a user or an agent takes an optional operator note (up to 100 characters). Unlock runs straight away.
  • The record and its list are refetched afterwards.
• Errors: a failed read of the configured flows shows admin.common.lifecycle.load_error, and a failed action shows admin.common.lifecycle.error.
• Base variants and custom renders receive lifecycleActions, onLifecycleAction and isRunningLifecycleAction. Lifecycle actions change only runtime state, so they apply to read-only records too.
• Status label: the access status shows as a translated label, next to the organization unit for users and as a Status row for agents and applications.
• Core (@thunderid/javascript, re-exported through browser, react and vue):
  • the AccessStatus model on ManagedUser and Agent
  • AccountLifecycleAction, AccountLifecycleSubjectKind and AccountLifecycleFlowConfigKey
  • getAccountLifecycleActions(kind, status, configuredFlows)
  • runAccountLifecycleAction({action, kind, subject, operatorNote}), which dispatches to the existing suspendUser, unlockAgent and similar functions so each keeps its own error codes
  • new admin.common.status.*, admin.common.lifecycle.* and admin.common.columns.status strings in every bundled locale
• Frameworks: React and Vue both implement this. Next.js and Nuxt wrap them.
• Playgrounds: the React and Vue UserDetails stories gain lifecycleActions, status and administrationMode controls, plus "Suspended" and "Live through administration flows" stories.

Known limit: the Next.js/Nuxt management relay doesn't forward /flow/execute, so administrationMode: 'flow' and the lifecycle actions don't work through the relay yet. The same is true of the flow-mode API functions released earlier. Opening the relay to flow execution needs its own security review, so it is out of scope here.

Related Issues

• Management operations support for ThunderID SDKs thunderid#5162

Related PRs

• [Spec] Specify backend sign-in, group and role management, and admin components for the SDKs thunderid#6080 (spec: admin components requirement 8)
• Let admin components run administration flows and lifecycle actions ios-sdks#36
• Let admin components run administration flows and lifecycle actions android-sdks#44
• Let admin components run administration flows and lifecycle actions flutter-sdks#57

Checklist

• Followed the contribution guidelines.
• Manual test round performed and verified.
• Documentation provided. (TSDoc on the new props and functions, and playground stories)
• Tests provided.
  • Unit Tests: core getAccountLifecycleActions and runAccountLifecycleAction (17), React and Vue admin components (10 each)
  • Integration Tests
• Breaking changes. (Fill if applicable)
  • Breaking changes section filled.
  • breaking change label added.
• Cross-SDK parity. Exactly one of parity/prs-raised or parity/prs-not-needed added.
  • If parity/prs-raised, the port links are posted as a reply on the parity check's comment.

Security checks

• Followed secure coding standards.
• Confirmed that this PR doesn't commit any keys, passwords, tokens, usernames, or other secrets.

[coderabbitai]

Important

• 🔍 Trigger review

This repository does not receive automatic reviews because it has fewer than 10 stars.

Run configuration

• Source mode: Auto
• Repository: thunder-id/javascript-sdks
• Branch: main
• File: .coderabbit.yaml
• Commit: e5918c5
• Layers: Repository YAML
• Review profile: CHILL
• Plan: Advanced
• Run ID: 0133bf28-3b38-492f-ba19-131931d463f0

• Autofix · Keep fixing CodeRabbit findings and required CI, and resolving merge conflicts

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}

[github-actions]

🔀 Cross-SDK feature parity, ports raised

This pull request is labelled parity/prs-raised, so the capability it introduces is expected in the other ThunderID SDKs as well.

Ports (DO NOT EDIT)

• thunder-id/ios-sdks, iOS => #36
• thunder-id/android-sdks, Android => #44
• thunder-id/flutter-sdks, Flutter => #57

3 of 3 sibling SDKs accounted for.

Every sibling SDK is accounted for.

The contract is in the SDK development specification.

[brionmario]

• thunder-id/ios-sdks: Let admin components run administration flows and lifecycle actions ios-sdks#36
• thunder-id/android-sdks: Let admin components run administration flows and lifecycle actions android-sdks#44
• thunder-id/flutter-sdks: Let admin components run administration flows and lifecycle actions flutter-sdks#57