feat: support Flow Secret for embedded flows#9
Conversation
|
Warning Review limit reached
Next review available in: 19 minutes Enable usage-based reviews in Billing to review now. Otherwise, wait until the next included review is available. How can I continue?After more reviews become available, a review can be triggered using the To avoid repeated limits, reduce automatic review volume by pausing incremental auto-reviews earlier, using label-based review opt-in, excluding WIP or generated PR titles, or requesting reviews manually when the PR is ready. If your team needs uninterrupted high-volume reviews, an organization admin can enable usage-based reviews. How do review limits work?CodeRabbit enforces per-developer PR review limits for each organization. Most developers receive the normal plan review availability. For paid Pro and Pro+ PR reviews, CodeRabbit uses adaptive limits for sustained high-volume activity. When a developer's recent PR review activity reaches the 95th percentile or higher among CodeRabbit users, additional reviews become available more gradually as earlier reviews age out of the rolling window. Please refer docs for additional details. Review details⚙️ Run configurationConfiguration used: Path: .coderabbit.yaml Review profile: CHILL Plan: Pro Plus Run ID: 📒 Files selected for processing (8)
📝 WalkthroughWalkthroughThe SDK adds optional Flow Execution API secret support. The secret is read from quickstart configuration, passed through ChangesFlow secret support
Estimated code review effort: 2 (Simple) | ~10 minutes Sequence Diagram(s)sequenceDiagram
participant App
participant ThunderIDClient
participant FlowExecutionClient
participant HttpClient
participant FlowExecutionAPI
App->>ThunderIDClient: initialize ThunderIDConfig with flowSecret
ThunderIDClient->>FlowExecutionClient: create with flowSecret
FlowExecutionClient->>HttpClient: POST /flow/execute with Flow-Secret
HttpClient->>FlowExecutionAPI: send flow request
Suggested reviewers: 🚥 Pre-merge checks | ✅ 4 | ❌ 1❌ Failed checks (1 warning)
✅ Passed checks (4 passed)
✨ Finishing Touches🧪 Generate unit tests (beta)
Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out. Comment |
![coderabbitai[bot]](https://avatars.githubusercontent.com/in/347564?s=60&v=4){kind=small}
There was a problem hiding this comment.
Actionable comments posted: 1
🤖 Prompt for all review comments with AI agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
Inline comments:
In `@samples/quickstart/README.md`:
- Around line 11-34: Specify the properties language on the fenced configuration
block in the quickstart documentation by changing its opening fence to use
properties, while leaving the configuration values and surrounding instructions
unchanged.
🪄 Autofix (Beta)
Fix all unresolved CodeRabbit comments on this PR:
- Push a commit to this branch (recommended)
- Create a new PR with the fixes
ℹ️ Review info
⚙️ Run configuration
Configuration used: Path: .coderabbit.yaml
Review profile: CHILL
Plan: Pro Plus
Run ID: 9d9d6491-d669-48e0-9ae6-ac256abbcb98
📒 Files selected for processing (8)
samples/quickstart/README.mdsamples/quickstart/build.gradle.ktssamples/quickstart/config.properties.examplesamples/quickstart/src/main/kotlin/dev/thunderid/quickstart/MainActivity.ktsrc/main/kotlin/dev/thunderid/android/ThunderIDClient.ktsrc/main/kotlin/dev/thunderid/android/ThunderIDConfig.ktsrc/main/kotlin/dev/thunderid/android/auth/FlowExecutionClient.ktsrc/main/kotlin/dev/thunderid/android/http/HttpClient.kt
35312a4 to
941a372
Compare
941a372 to
0a93a46
Compare
Flow Execution API calls require a Flow-Secret header when an application enforces it, but the SDK had no way to send one. Wire ThunderIDConfig.flowSecret through to FlowExecutionClient and add sample app + docs guidance for setting it up locally.
0a93a46 to
01faa3d
Compare
| ## Setup | ||
|
|
||
| Copy `.env.example` to `.env` and add your ThunderID credentials: | ||
| Copy `config.properties.example` to `config.properties` (gitignored) and add your ThunderID credentials: |
There was a problem hiding this comment.
Shall we double check changes done to readme?
There was a problem hiding this comment.
I have to use the config.properties file and using .env didn't worked for me. That's why this update.
cc: @brionmario can you confirm this?
There was a problem hiding this comment.
Also in the repo we don't have env.example file too
There was a problem hiding this comment.
config.properties is the right approach. I think README wasn't updated.
| THUNDERID_APPLICATION_ID=your-application-id | ||
| THUNDERID_AFTER_SIGN_IN_URL= | ||
| THUNDERID_AFTER_SIGN_OUT_URL= | ||
| THUNDERID_FLOW_SECRET=your-flow-secret |
There was a problem hiding this comment.
Is there a meaning of flow secret for a mobile client?
There was a problem hiding this comment.
This is when they not using attestation. In that case they have to go with the secret.
There was a problem hiding this comment.
Once they configure the attestation, secret will be skipped and attestation will be validated.
There was a problem hiding this comment.
Can't we just mention something like THUNDERID_ATTESTATION or THUNDERID_ATTESTATION_KEY?
There was a problem hiding this comment.
You mean instead of FLOW_SECRET value? If yes, in the attestation case we need to have some more parameters here (This will be sent via separate PR). So having a common name for both attestation and secret will confuse users IMO.
There was a problem hiding this comment.
Public clients usually can't securely hold a secret. My concern is, calling this THUNDERID_FLOW_SECRET is a bit misleading because it implies the app should embed a secret.
|
Closing — we've decided to proceed without requiring a Flow Secret for mobile apps, so this isn't needed. A new PR for Play Integrity support is coming instead. |
3 participants
Purpose
The Flow Execution API (
/flow/execute) requires aFlow-Secretheader when an application enforces it, but the Android SDK had no way to supply one —FlowExecutionClientnever set the header andThunderIDConfighad no field for it. This caused registration/sign-in via the embedded flow to fail with400 Invalid requestfor applications that enforce a flow secret.Also fixes stale setup docs in the quickstart sample: the README told users to create a
.envfile, but the Gradle build (build.gradle.kts) actually reads fromconfig.properties—.envwas dead, unused, and untracked-example-less (.env.examplenever existed in the repo).Approach
ThunderIDConfig.flowSecret: String?headersparam toHttpClient.post/requestFlowExecutionClientsendsFlow-Secretoninitiate/submitwhen configuredconfig.flowSecretthroughThunderIDClient.initializebuild.gradle.kts,MainActivity.kt,config.properties.example) to read/passTHUNDERID_FLOW_SECRETsamples/quickstart/.envsamples/quickstart/README.md:config.properties(the file the build actually reads) instead of the nonexistent.env.exampleTHUNDERID_FLOW_SECRETand where to find it (Applications → app → General, shown once at creation)clientIdis only needed for the redirect-based OAuth flow, not the embedded Flow Execution API this sample useshttps://10.0.2.2:8090, nothttps://localhost:8090self_reg_disabled_for_user_typeRelated Issues
Related PRs
Checklist
Security checks
Summary by CodeRabbit
New Features
Documentation