Add an Application/User sub-tab split to the application token tab - #4333
Merged
brionmario merged 1 commit intoJul 27, 2026
Merged
Conversation
Dilusha-Madushan
requested review from
DonOmalVindula,
brionmario and
jeradrutnam
as code owners
July 24, 2026 12:47
Contributor
|
Note Reviews pausedIt looks like this branch is under active development. To avoid overwhelming you with review comments due to an influx of new commits, CodeRabbit has automatically paused this review. You can configure this behavior by changing the Use the following commands to manage reviews:
Use the checkboxes below for quick actions:
📝 WalkthroughWalkthroughApplication and agent edit flows now use shared settings lock notices. Application token settings add grant-aware Application/User tabs and client-token claim configuration, while application pages gate user-facing settings and validate required OAuth configuration before saving. ChangesAccess and token settings
Estimated code review effort: 4 (Complex) | ~60 minutes Sequence Diagram(s)sequenceDiagram
participant ApplicationEditPage
participant oauth2Rules
participant EditTokenSettingsTabs
participant SettingsLockNotice
participant ClientAccessTokenSection
ApplicationEditPage->>oauth2Rules: evaluate OAuth2 grant types
ApplicationEditPage->>EditTokenSettingsTabs: pass OAuth2 configuration
EditTokenSettingsTabs->>SettingsLockNotice: pass tab lock state and message
EditTokenSettingsTabs->>ClientAccessTokenSection: render client-token settings
ClientAccessTokenSection->>ApplicationEditPage: report token changes and validation
Possibly related PRs
Suggested reviewers: 🚥 Pre-merge checks | ✅ 4 | ❌ 1❌ Failed checks (1 warning)
✅ Passed checks (4 passed)
✨ Finishing Touches🧪 Generate unit tests (beta)
Warning There were issues while running some tools. Please review the errors and either fix the tool's configuration or disable the tool if it's a critical failure. 🔧 ESLint
docs/content/guides/applications/application-settings.mdxESLint skipped: missing config or dependency (missing-dependency). The ESLint configuration references a package that is not available in the sandbox. frontend/apps/console/src/features/agents/components/edit-agent/flows/EditFlowsSettings.tsxESLint skipped: missing config or dependency (missing-dependency). The ESLint configuration references a package that is not available in the sandbox. frontend/apps/console/src/features/agents/components/edit-agent/tokens/AgentAccessTokenSection.tsxESLint skipped: the ESLint configuration for this file references a package that is not available in the sandbox.
Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out. Comment |
Contributor
Author
|
Here is the new app token config section: |
![coderabbitai[bot]](https://avatars.githubusercontent.com/in/347564?s=60&v=4){kind=small}
Contributor
There was a problem hiding this comment.
Actionable comments posted: 2
🤖 Prompt for all review comments with AI agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
Inline comments:
In
`@frontend/apps/console/src/features/applications/components/edit-application/general-settings/AccessSection.tsx`:
- Around line 324-361: Update the user-access validation flow associated with
showUserAccessConfig so uriErrors and postLogoutUriErrors are cleared or
excluded whenever user access is disabled. Ensure the validation callback and
save-state logic no longer report errors from hidden, no-longer-applicable URI
fields, including the related section around the additional marked lines.
In
`@frontend/apps/console/src/features/applications/pages/ApplicationEditPage.tsx`:
- Around line 238-246: Update the redirect validation in ApplicationEditPage’s
hasValidRedirectUri calculation to reuse the shared wildcard-aware URI-format
check used by AccessSection, rather than calling new URL(uri) directly. Preserve
trimming, invalid-URI rejection, and the existing isMissingRedirectUri behavior.
🪄 Autofix (Beta)
Fix all unresolved CodeRabbit comments on this PR:
- Push a commit to this branch (recommended)
- Create a new PR with the fixes
ℹ️ Review info
⚙️ Run configuration
Configuration used: Path: .coderabbit.yaml
Review profile: CHILL
Plan: Pro Plus
Run ID: 5b599a6f-f3b3-4f3f-8ca3-2f1d82b2e6bc
📒 Files selected for processing (18)
frontend/apps/console/src/features/agents/components/edit-agent/flows/EditFlowsSettings.tsxfrontend/apps/console/src/features/agents/components/edit-agent/tokens/AgentAccessTokenSection.tsxfrontend/apps/console/src/features/agents/components/edit-agent/tokens/EditTokensSettings.tsxfrontend/apps/console/src/features/applications/components/common/SettingsLockNotice.tsxfrontend/apps/console/src/features/applications/components/common/__tests__/SettingsLockNotice.test.tsxfrontend/apps/console/src/features/applications/components/edit-application/general-settings/AccessSection.tsxfrontend/apps/console/src/features/applications/components/edit-application/general-settings/EditGeneralSettings.tsxfrontend/apps/console/src/features/applications/components/edit-application/general-settings/__tests__/AccessSection.test.tsxfrontend/apps/console/src/features/applications/components/edit-application/token-settings/ClientAccessTokenSection.tsxfrontend/apps/console/src/features/applications/components/edit-application/token-settings/EditTokenSettingsTabs.tsxfrontend/apps/console/src/features/applications/components/edit-application/token-settings/__tests__/ClientAccessTokenSection.test.tsxfrontend/apps/console/src/features/applications/components/edit-application/token-settings/__tests__/EditTokenSettingsTabs.test.tsxfrontend/apps/console/src/features/applications/constants/token-constants.tsfrontend/apps/console/src/features/applications/pages/ApplicationEditPage.tsxfrontend/apps/console/src/features/applications/pages/__tests__/ApplicationEditPage.test.tsxfrontend/apps/console/src/features/applications/utils/__tests__/oauth2Rules.test.tsfrontend/apps/console/src/features/applications/utils/oauth2Rules.tsfrontend/packages/i18n/src/locales/en-US.ts
Dilusha-Madushan
force-pushed
the
feature/app-edit-token-grant-parity
branch
from
July 24, 2026 17:11
cb5e7a5 to
b3dc7a3
Compare
rajithacharith
added
the
trigger-pr-builder
Contributor
There was a problem hiding this comment.
Actionable comments posted: 1
🤖 Prompt for all review comments with AI agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
Inline comments:
In
`@frontend/apps/console/src/features/applications/components/edit-application/general-settings/AccessSection.tsx`:
- Around line 146-152: Add fallback default strings to every listed t() call in
AccessSection, including those in validateUri and the other referenced
validation, label, and message paths. Use the corresponding English/user-facing
text as each call’s default while preserving the existing translation keys and
behavior.
🪄 Autofix (Beta)
Fix all unresolved CodeRabbit comments on this PR:
- Push a commit to this branch (recommended)
- Create a new PR with the fixes
ℹ️ Review info
⚙️ Run configuration
Configuration used: Path: .coderabbit.yaml
Review profile: CHILL
Plan: Pro Plus
Run ID: 606ea60c-9d1d-46a5-9e56-25b6c72a047b
📒 Files selected for processing (20)
frontend/apps/console/src/features/agents/components/edit-agent/flows/EditFlowsSettings.tsxfrontend/apps/console/src/features/agents/components/edit-agent/tokens/AgentAccessTokenSection.tsxfrontend/apps/console/src/features/agents/components/edit-agent/tokens/EditTokensSettings.tsxfrontend/apps/console/src/features/applications/components/common/SettingsLockNotice.tsxfrontend/apps/console/src/features/applications/components/common/__tests__/SettingsLockNotice.test.tsxfrontend/apps/console/src/features/applications/components/edit-application/general-settings/AccessSection.tsxfrontend/apps/console/src/features/applications/components/edit-application/general-settings/EditGeneralSettings.tsxfrontend/apps/console/src/features/applications/components/edit-application/general-settings/__tests__/AccessSection.test.tsxfrontend/apps/console/src/features/applications/components/edit-application/token-settings/ClientAccessTokenSection.tsxfrontend/apps/console/src/features/applications/components/edit-application/token-settings/EditTokenSettingsTabs.tsxfrontend/apps/console/src/features/applications/components/edit-application/token-settings/__tests__/ClientAccessTokenSection.test.tsxfrontend/apps/console/src/features/applications/components/edit-application/token-settings/__tests__/EditTokenSettingsTabs.test.tsxfrontend/apps/console/src/features/applications/constants/token-constants.tsfrontend/apps/console/src/features/applications/pages/ApplicationEditPage.tsxfrontend/apps/console/src/features/applications/pages/__tests__/ApplicationEditPage.test.tsxfrontend/apps/console/src/features/applications/utils/__tests__/isValidRedirectUriFormat.test.tsfrontend/apps/console/src/features/applications/utils/__tests__/oauth2Rules.test.tsfrontend/apps/console/src/features/applications/utils/isValidRedirectUriFormat.tsfrontend/apps/console/src/features/applications/utils/oauth2Rules.tsfrontend/packages/i18n/src/locales/en-US.ts
🚧 Files skipped from review as they are similar to previous changes (14)
- frontend/apps/console/src/features/applications/components/edit-application/token-settings/tests/EditTokenSettingsTabs.test.tsx
- frontend/apps/console/src/features/applications/utils/tests/oauth2Rules.test.ts
- frontend/apps/console/src/features/applications/components/common/tests/SettingsLockNotice.test.tsx
- frontend/apps/console/src/features/agents/components/edit-agent/flows/EditFlowsSettings.tsx
- frontend/apps/console/src/features/applications/components/edit-application/general-settings/EditGeneralSettings.tsx
- frontend/apps/console/src/features/agents/components/edit-agent/tokens/EditTokensSettings.tsx
- frontend/apps/console/src/features/applications/utils/oauth2Rules.ts
- frontend/apps/console/src/features/applications/components/common/SettingsLockNotice.tsx
- frontend/apps/console/src/features/applications/pages/tests/ApplicationEditPage.test.tsx
- frontend/apps/console/src/features/applications/pages/ApplicationEditPage.tsx
- frontend/apps/console/src/features/applications/components/edit-application/token-settings/ClientAccessTokenSection.tsx
- frontend/apps/console/src/features/applications/constants/token-constants.ts
- frontend/apps/console/src/features/agents/components/edit-agent/tokens/AgentAccessTokenSection.tsx
- frontend/apps/console/src/features/applications/components/edit-application/token-settings/EditTokenSettingsTabs.tsx
Codecov Report❌ Patch coverage is
📢 Thoughts on this report? Let us know! |
JayaShakthi97
previously approved these changes
Jul 24, 2026
Dilusha-Madushan
force-pushed
the
feature/app-edit-token-grant-parity
branch
from
July 25, 2026 03:21
b3dc7a3 to
80d3bec
Compare
Member
Lets do another UI iteration to get rid of the |
Contributor
Author
Here is the finalized new design: 
cc: @brionmario @coderabbitai create new git issue to track this (add the new UI design preview in the issue description) |
5 tasks
Contributor
|
Tip For best results, initiate chat on the files or code changes. 🧩 Analysis chain🏁 Script executed: #!/bin/bash
set -euo pipefail
repo="thunder-id/thunderid"
pr_url="https://github.com/thunder-id/thunderid/pull/4333"
preview_url="https://github.com/user-attachments/assets/2598c8c0-b959-45df-911d-1dad8671520b"
body="$(cat <<EOF
## Summary
Replace the nested **Application** and **User** token-settings tabs with the finalized audience-selector design.
## Rationale
The current nested tabs add unnecessary navigation within the Application edit page. The finalized design keeps the top-level **Token** tab and presents the token audience through a compact left-side selector.
## Scope
- Update the Application edit Token settings UI to use a left-side audience selector for **Application** and **User**.
- Preserve independent token-claim configuration and validity settings for each audience.
- Keep the Application audience claims configuration and decoded JWT payload preview accessible.
- Maintain the existing grant-type locking behavior and read-only states.
- Update affected UI tests and documentation as needed.
## Design preview
## Acceptance criteria
- [ ] The Token page no longer contains nested Application/User tabs.
- [ ] Application and User audiences can be selected from the new side navigation.
- [ ] The selected audience clearly indicates its purpose and preserves the existing configuration behavior.
- [ ] Existing grant-based locks, validation, and read-only behavior continue to work.
- [ ] Relevant automated tests are updated or added.
## References
- Originating pull request: ${pr_url}
- Requested by: `@Dilusha-Madushan`
EOF
)"
issue_url="$(gh issue create \
--repo "$repo" \
--title "Redesign application token settings to replace nested audience tabs" \
--body "$body" \
--assignee "Dilusha-Madushan")"
echo "Created issue: $issue_url"Length of output: 2049 The Comment image shows the finalized Token settings design with a left-side Application/User audience selector, an Access token claims panel, selectable claims, and a decoded payload preview.
|
Dilusha-Madushan
force-pushed
the
feature/app-edit-token-grant-parity
branch
from
July 27, 2026 03:03
80d3bec to
6940ea1
Compare
Contributor
There was a problem hiding this comment.
Actionable comments posted: 2
🧹 Nitpick comments (2)
frontend/apps/console/src/features/agents/components/edit-agent/tokens/AgentAccessTokenSection.tsx (2)
22-23: 📐 Maintainability & Code Quality | 🔵 Trivial | 💤 Low valueCross-feature deep relative import into
applicationsinternals.
AgentAccessTokenSectionnow reaches four levels up into theapplicationsfeature forClientAccessTokenSectionandTokenConstants. Since this component is genuinely shared between agents and applications, consider promoting it (and the constants) to a shared location (e.g. a commoncomponents/constantsmodule or a package) so the feature boundary isn't inverted.🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the rest with a brief reason, keep changes minimal, and validate. In `@frontend/apps/console/src/features/agents/components/edit-agent/tokens/AgentAccessTokenSection.tsx` around lines 22 - 23, Promote ClientAccessTokenSection and TokenConstants from the applications feature into an appropriate shared components/constants location, then update AgentAccessTokenSection and existing application consumers to import them from that shared module. Remove the deep relative imports into applications internals while preserving the current behavior and public interfaces.
63-65: 🗄️ Data Integrity & Integration | 🔵 Trivial | 💤 Low valueAvoid converting the inbound auth config type through
unknown.
AgentInboundAuthConfigandInboundAuthConfigalready represent the same OAuth2 inbound shape, so preserve type safety by reusing a shared inbound auth config type instead of casting throughunknown as InboundAuthConfig[]. This keeps future model drift from bypassing edit-state type checks.🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the rest with a brief reason, keep changes minimal, and validate. In `@frontend/apps/console/src/features/agents/components/edit-agent/tokens/AgentAccessTokenSection.tsx` around lines 63 - 65, Update the inboundAuthConfig declaration in AgentAccessTokenSection to use the shared inbound auth configuration type directly, removing the unknown-to-InboundAuthConfig[] cast. Preserve the existing editedAgent fallback to agent and then an empty array while retaining type-safe edit-state checks.
🤖 Prompt for all review comments with AI agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
Inline comments:
In
`@frontend/apps/console/src/features/applications/pages/ApplicationEditPage.tsx`:
- Around line 226-227: Update the userAccessUnlocked calculation in
ApplicationEditPage to call hasUserAccess with the optional
oauth2Config?.grantTypes directly, removing the !oauth2Config fallback. Preserve
the existing userGatedApplication behavior so applications without OAuth2
configuration remain read-only.
- Around line 255-256: Update the unsavedChangesMessage expression in
ApplicationEditPage to pass the required fallback default string to the t call
for applications:edit.page.unsavedChanges, while preserving the existing
validationIssues.join(' ') behavior.
---
Nitpick comments:
In
`@frontend/apps/console/src/features/agents/components/edit-agent/tokens/AgentAccessTokenSection.tsx`:
- Around line 22-23: Promote ClientAccessTokenSection and TokenConstants from
the applications feature into an appropriate shared components/constants
location, then update AgentAccessTokenSection and existing application consumers
to import them from that shared module. Remove the deep relative imports into
applications internals while preserving the current behavior and public
interfaces.
- Around line 63-65: Update the inboundAuthConfig declaration in
AgentAccessTokenSection to use the shared inbound auth configuration type
directly, removing the unknown-to-InboundAuthConfig[] cast. Preserve the
existing editedAgent fallback to agent and then an empty array while retaining
type-safe edit-state checks.
🪄 Autofix (Beta)
Fix all unresolved CodeRabbit comments on this PR:
- Push a commit to this branch (recommended)
- Create a new PR with the fixes
ℹ️ Review info
⚙️ Run configuration
Configuration used: Path: .coderabbit.yaml
Review profile: CHILL
Plan: Pro Plus
Run ID: d8c2bc68-e87c-451a-a247-33695cf9b7a1
📒 Files selected for processing (20)
docs/content/guides/applications/application-settings.mdxfrontend/apps/console/src/features/agents/components/edit-agent/flows/EditFlowsSettings.tsxfrontend/apps/console/src/features/agents/components/edit-agent/tokens/AgentAccessTokenSection.tsxfrontend/apps/console/src/features/agents/components/edit-agent/tokens/EditTokensSettings.tsxfrontend/apps/console/src/features/applications/components/common/SettingsLockNotice.tsxfrontend/apps/console/src/features/applications/components/common/__tests__/SettingsLockNotice.test.tsxfrontend/apps/console/src/features/applications/components/edit-application/general-settings/AccessSection.tsxfrontend/apps/console/src/features/applications/components/edit-application/general-settings/EditGeneralSettings.tsxfrontend/apps/console/src/features/applications/components/edit-application/general-settings/__tests__/AccessSection.test.tsxfrontend/apps/console/src/features/applications/components/edit-application/token-settings/ClientAccessTokenSection.tsxfrontend/apps/console/src/features/applications/components/edit-application/token-settings/EditTokenSettingsTabs.tsxfrontend/apps/console/src/features/applications/components/edit-application/token-settings/__tests__/ClientAccessTokenSection.test.tsxfrontend/apps/console/src/features/applications/components/edit-application/token-settings/__tests__/EditTokenSettingsTabs.test.tsxfrontend/apps/console/src/features/applications/constants/token-constants.tsfrontend/apps/console/src/features/applications/pages/ApplicationEditPage.tsxfrontend/apps/console/src/features/applications/pages/__tests__/ApplicationEditPage.test.tsxfrontend/apps/console/src/features/applications/utils/__tests__/isValidRedirectUriFormat.test.tsfrontend/apps/console/src/features/applications/utils/__tests__/oauth2Rules.test.tsfrontend/apps/console/src/features/applications/utils/isValidRedirectUriFormat.tsfrontend/apps/console/src/features/applications/utils/oauth2Rules.ts
🚧 Files skipped from review as they are similar to previous changes (18)
- frontend/apps/console/src/features/applications/utils/tests/isValidRedirectUriFormat.test.ts
- frontend/apps/console/src/features/applications/components/common/tests/SettingsLockNotice.test.tsx
- frontend/apps/console/src/features/applications/components/common/SettingsLockNotice.tsx
- frontend/apps/console/src/features/applications/utils/isValidRedirectUriFormat.ts
- frontend/apps/console/src/features/agents/components/edit-agent/tokens/EditTokensSettings.tsx
- frontend/apps/console/src/features/applications/constants/token-constants.ts
- frontend/apps/console/src/features/applications/components/edit-application/token-settings/tests/EditTokenSettingsTabs.test.tsx
- frontend/apps/console/src/features/applications/components/edit-application/general-settings/EditGeneralSettings.tsx
- docs/content/guides/applications/application-settings.mdx
- frontend/apps/console/src/features/applications/components/edit-application/token-settings/tests/ClientAccessTokenSection.test.tsx
- frontend/apps/console/src/features/applications/utils/oauth2Rules.ts
- frontend/apps/console/src/features/applications/components/edit-application/general-settings/AccessSection.tsx
- frontend/apps/console/src/features/applications/utils/tests/oauth2Rules.test.ts
- frontend/apps/console/src/features/applications/components/edit-application/token-settings/ClientAccessTokenSection.tsx
- frontend/apps/console/src/features/applications/components/edit-application/general-settings/tests/AccessSection.test.tsx
- frontend/apps/console/src/features/applications/pages/tests/ApplicationEditPage.test.tsx
- frontend/apps/console/src/features/agents/components/edit-agent/flows/EditFlowsSettings.tsx
- frontend/apps/console/src/features/applications/components/edit-application/token-settings/EditTokenSettingsTabs.tsx
Comment on lines
+226
to
+227
| const userAccessUnlocked = !oauth2Config || hasUserAccess(oauth2Config.grantTypes); | ||
| const userGatedApplication = userAccessUnlocked ? application : {...application, isReadOnly: true}; |
Contributor
There was a problem hiding this comment.
🎯 Functional Correctness | 🟠 Major | ⚡ Quick win
Lock applications with no OAuth2 configuration.
hasUserAccess(undefined) is false, but !oauth2Config makes these applications unlocked. This exposes user-only Access, Flows, and Customization settings without any user-facing grant, unlike the Token tab’s lock behavior. Use hasUserAccess(oauth2Config?.grantTypes) directly.
🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
In
`@frontend/apps/console/src/features/applications/pages/ApplicationEditPage.tsx`
around lines 226 - 227, Update the userAccessUnlocked calculation in
ApplicationEditPage to call hasUserAccess with the optional
oauth2Config?.grantTypes directly, removing the !oauth2Config fallback. Preserve
the existing userGatedApplication behavior so applications without OAuth2
configuration remain read-only.
Comment on lines
+255
to
+256
| const unsavedChangesMessage = | ||
| validationIssues.length > 0 ? validationIssues.join(' ') : t('applications:edit.page.unsavedChanges'); |
Contributor
There was a problem hiding this comment.
📐 Maintainability & Code Quality | 🟡 Minor | ⚡ Quick win
Add the required translation fallback.
The new t() call has no default string.
Proposed fix
- validationIssues.length > 0 ? validationIssues.join(' ') : t('applications:edit.page.unsavedChanges');
+ validationIssues.length > 0
+ ? validationIssues.join(' ')
+ : t('applications:edit.page.unsavedChanges', 'You have unsaved changes.');As per coding guidelines, “Every t('key') call must provide a fallback default string.”
📝 Committable suggestion
‼️ IMPORTANT
Carefully review the code before committing. Ensure that it accurately replaces the highlighted code, contains no missing lines, and has no issues with indentation. Thoroughly test & benchmark the code to ensure it meets the requirements.
Suggested change
| const unsavedChangesMessage = | |
| validationIssues.length > 0 ? validationIssues.join(' ') : t('applications:edit.page.unsavedChanges'); | |
| const unsavedChangesMessage = | |
| validationIssues.length > 0 | |
| ? validationIssues.join(' ') | |
| : t('applications:edit.page.unsavedChanges', 'You have unsaved changes.'); |
🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
In
`@frontend/apps/console/src/features/applications/pages/ApplicationEditPage.tsx`
around lines 255 - 256, Update the unsavedChangesMessage expression in
ApplicationEditPage to pass the required fallback default string to the t call
for applications:edit.page.unsavedChanges, while preserving the existing
validationIssues.join(' ') behavior.
Source: Coding guidelines
rajithacharith
added
Type/Improvement
trigger-pr-builder
Contributor
|
@coderabbitai help |
Contributor
ChatThere are 3 ways to chat with CodeRabbit:
CodeRabbit commands
Other keywords and placeholders
Status, support, documentation and community
|
Contributor
|
@coderabbitai full review |
Contributor
✅ Action performedFull review finished. |
Contributor
There was a problem hiding this comment.
♻️ Duplicate comments (2)
frontend/apps/console/src/features/applications/pages/ApplicationEditPage.tsx (2)
255-256: 🎯 Functional Correctness | 🟡 Minor | ⚡ Quick winUnresolved from a prior review round: missing
t()fallback.
t('applications:edit.page.unsavedChanges')still has no default string, so an incomplete locale would show the raw key. This is the same gap flagged previously in this file with no visible fix.As per coding guidelines, "Every `t('key')` call must provide a fallback default string."💚 Proposed fix
const unsavedChangesMessage = - validationIssues.length > 0 ? validationIssues.join(' ') : t('applications:edit.page.unsavedChanges'); + validationIssues.length > 0 + ? validationIssues.join(' ') + : t('applications:edit.page.unsavedChanges', 'You have unsaved changes.');🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the rest with a brief reason, keep changes minimal, and validate. In `@frontend/apps/console/src/features/applications/pages/ApplicationEditPage.tsx` around lines 255 - 256, Update the fallback branch in the unsavedChangesMessage construction to pass the English default text to t() for applications:edit.page.unsavedChanges, ensuring incomplete locales display the message instead of the translation key. Preserve the validationIssues.join(' ') behavior when issues exist.Source: Coding guidelines
226-227: 🎯 Functional Correctness | 🟠 Major | ⚡ Quick winUnresolved from a prior review round: no-OAuth2 apps bypass the user-access lock.
This exact pattern was previously flagged as a major issue:
hasUserAccess(undefined)isfalse, but the!oauth2Config ||short-circuit unlocks Flows/Customization/Access for applications with no OAuth2 config at all, regardless of whether they actually support any user-facing grant. No fix or dismissal is visible for this thread (unlike the other two threads in this file, which show "✅ Addressed").That said,
EditGeneralSettings.tsx'sisFlowNativeClientcomment ("embedded apps with no OAuth profile") suggests some apps intentionally have nooauth2Configyet still rely on Flows/Customization via the Flow Execution API — so blindly switching tohasUserAccess(oauth2Config?.grantTypes)(the originally suggested fix) could lock those apps out incorrectly. Please confirm the intended behavior for no-OAuth2-config apps before resolving this.#!/bin/bash set -euo pipefail rg -n -C6 'isFlowNativeClient|embedded app|no OAuth profile|Flow Secret' frontend/apps/console/src/features/applications🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the rest with a brief reason, keep changes minimal, and validate. In `@frontend/apps/console/src/features/applications/pages/ApplicationEditPage.tsx` around lines 226 - 227, The no-oauth2 branch in the user-access gating logic is ambiguous and must not unlock applications by default. Inspect the existing `isFlowNativeClient` behavior and related Flow Execution API handling, then update `userAccessUnlocked` so no-`oauth2Config` applications follow the established intended access policy: preserve access for supported embedded/Flow-native apps while locking other apps, and keep OAuth2 grant checks unchanged.
🤖 Prompt for all review comments with AI agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
Duplicate comments:
In
`@frontend/apps/console/src/features/applications/pages/ApplicationEditPage.tsx`:
- Around line 255-256: Update the fallback branch in the unsavedChangesMessage
construction to pass the English default text to t() for
applications:edit.page.unsavedChanges, ensuring incomplete locales display the
message instead of the translation key. Preserve the validationIssues.join(' ')
behavior when issues exist.
- Around line 226-227: The no-oauth2 branch in the user-access gating logic is
ambiguous and must not unlock applications by default. Inspect the existing
`isFlowNativeClient` behavior and related Flow Execution API handling, then
update `userAccessUnlocked` so no-`oauth2Config` applications follow the
established intended access policy: preserve access for supported
embedded/Flow-native apps while locking other apps, and keep OAuth2 grant checks
unchanged.
ℹ️ Review info
⚙️ Run configuration
Configuration used: Path: .coderabbit.yaml
Review profile: CHILL
Plan: Pro Plus
Run ID: 1b97d3b5-6d79-4c36-8c40-a1383952e6fd
📒 Files selected for processing (21)
docs/content/guides/applications/application-settings.mdxfrontend/apps/console/src/features/agents/components/edit-agent/flows/EditFlowsSettings.tsxfrontend/apps/console/src/features/agents/components/edit-agent/tokens/AgentAccessTokenSection.tsxfrontend/apps/console/src/features/agents/components/edit-agent/tokens/EditTokensSettings.tsxfrontend/apps/console/src/features/applications/components/common/SettingsLockNotice.tsxfrontend/apps/console/src/features/applications/components/common/__tests__/SettingsLockNotice.test.tsxfrontend/apps/console/src/features/applications/components/edit-application/general-settings/AccessSection.tsxfrontend/apps/console/src/features/applications/components/edit-application/general-settings/EditGeneralSettings.tsxfrontend/apps/console/src/features/applications/components/edit-application/general-settings/__tests__/AccessSection.test.tsxfrontend/apps/console/src/features/applications/components/edit-application/token-settings/ClientAccessTokenSection.tsxfrontend/apps/console/src/features/applications/components/edit-application/token-settings/EditTokenSettingsTabs.tsxfrontend/apps/console/src/features/applications/components/edit-application/token-settings/__tests__/ClientAccessTokenSection.test.tsxfrontend/apps/console/src/features/applications/components/edit-application/token-settings/__tests__/EditTokenSettingsTabs.test.tsxfrontend/apps/console/src/features/applications/constants/token-constants.tsfrontend/apps/console/src/features/applications/pages/ApplicationEditPage.tsxfrontend/apps/console/src/features/applications/pages/__tests__/ApplicationEditPage.test.tsxfrontend/apps/console/src/features/applications/utils/__tests__/isValidRedirectUriFormat.test.tsfrontend/apps/console/src/features/applications/utils/__tests__/oauth2Rules.test.tsfrontend/apps/console/src/features/applications/utils/isValidRedirectUriFormat.tsfrontend/apps/console/src/features/applications/utils/oauth2Rules.tsfrontend/packages/i18n/src/locales/en-US.ts
Dilusha-Madushan
force-pushed
the
feature/app-edit-token-grant-parity
branch
from
July 27, 2026 09:02
6940ea1 to
2dec469
Compare
Contributor
There was a problem hiding this comment.
Actionable comments posted: 1
🧹 Nitpick comments (1)
frontend/apps/console/src/features/agents/components/edit-agent/tokens/AgentAccessTokenSection.tsx (1)
63-65: 🗄️ Data Integrity & Integration | 🔵 Trivial | 💤 Low valueUse
AgentInboundAuthConfigforAgentAccessTokenSection's inbound config typing
AgentInboundAuthConfigexplicitly matchesInboundAuthConfigfor the OAuth2 entry, so there’s no real shape divergence to suppress withas unknown as InboundAuthConfig[]. Type the fallback list asAgentInboundAuthConfig[]and either omit the cast here or make the cast explicit.🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the rest with a brief reason, keep changes minimal, and validate. In `@frontend/apps/console/src/features/agents/components/edit-agent/tokens/AgentAccessTokenSection.tsx` around lines 63 - 65, Update the inboundAuthConfig fallback in AgentAccessTokenSection to use AgentInboundAuthConfig[] instead of casting through unknown to InboundAuthConfig[]. Remove the unnecessary cast when the values already have the expected type, or use a direct explicit cast to AgentInboundAuthConfig[] if required by the existing types.
🤖 Prompt for all review comments with AI agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
Inline comments:
In
`@frontend/apps/console/src/features/agents/components/edit-agent/tokens/AgentAccessTokenSection.tsx`:
- Around line 20-25: Update the AgentEditPage lazy route in App.tsx to await the
monaco-setup import before importing AgentEditPage, preserving the existing lazy
loading behavior while gating Monaco-dependent code behind initialization.
---
Nitpick comments:
In
`@frontend/apps/console/src/features/agents/components/edit-agent/tokens/AgentAccessTokenSection.tsx`:
- Around line 63-65: Update the inboundAuthConfig fallback in
AgentAccessTokenSection to use AgentInboundAuthConfig[] instead of casting
through unknown to InboundAuthConfig[]. Remove the unnecessary cast when the
values already have the expected type, or use a direct explicit cast to
AgentInboundAuthConfig[] if required by the existing types.
🪄 Autofix (Beta)
Fix all unresolved CodeRabbit comments on this PR:
- Push a commit to this branch (recommended)
- Create a new PR with the fixes
ℹ️ Review info
⚙️ Run configuration
Configuration used: Path: .coderabbit.yaml
Review profile: CHILL
Plan: Pro Plus
Run ID: 14526752-ce0c-447c-becd-153d69aaeaff
📒 Files selected for processing (21)
docs/content/guides/applications/application-settings.mdxfrontend/apps/console/src/features/agents/components/edit-agent/flows/EditFlowsSettings.tsxfrontend/apps/console/src/features/agents/components/edit-agent/tokens/AgentAccessTokenSection.tsxfrontend/apps/console/src/features/agents/components/edit-agent/tokens/EditTokensSettings.tsxfrontend/apps/console/src/features/applications/components/common/SettingsLockNotice.tsxfrontend/apps/console/src/features/applications/components/common/__tests__/SettingsLockNotice.test.tsxfrontend/apps/console/src/features/applications/components/edit-application/general-settings/AccessSection.tsxfrontend/apps/console/src/features/applications/components/edit-application/general-settings/EditGeneralSettings.tsxfrontend/apps/console/src/features/applications/components/edit-application/general-settings/__tests__/AccessSection.test.tsxfrontend/apps/console/src/features/applications/components/edit-application/token-settings/ClientAccessTokenSection.tsxfrontend/apps/console/src/features/applications/components/edit-application/token-settings/EditTokenSettingsTabs.tsxfrontend/apps/console/src/features/applications/components/edit-application/token-settings/__tests__/ClientAccessTokenSection.test.tsxfrontend/apps/console/src/features/applications/components/edit-application/token-settings/__tests__/EditTokenSettingsTabs.test.tsxfrontend/apps/console/src/features/applications/constants/token-constants.tsfrontend/apps/console/src/features/applications/pages/ApplicationEditPage.tsxfrontend/apps/console/src/features/applications/pages/__tests__/ApplicationEditPage.test.tsxfrontend/apps/console/src/features/applications/utils/__tests__/isValidRedirectUriFormat.test.tsfrontend/apps/console/src/features/applications/utils/__tests__/oauth2Rules.test.tsfrontend/apps/console/src/features/applications/utils/isValidRedirectUriFormat.tsfrontend/apps/console/src/features/applications/utils/oauth2Rules.tsfrontend/packages/i18n/src/locales/en-US.ts
🚧 Files skipped from review as they are similar to previous changes (18)
- frontend/apps/console/src/features/applications/constants/token-constants.ts
- frontend/apps/console/src/features/applications/utils/isValidRedirectUriFormat.ts
- frontend/apps/console/src/features/applications/utils/oauth2Rules.ts
- frontend/apps/console/src/features/applications/components/edit-application/token-settings/tests/ClientAccessTokenSection.test.tsx
- frontend/apps/console/src/features/applications/components/edit-application/general-settings/EditGeneralSettings.tsx
- frontend/apps/console/src/features/applications/pages/ApplicationEditPage.tsx
- frontend/apps/console/src/features/applications/components/edit-application/token-settings/tests/EditTokenSettingsTabs.test.tsx
- frontend/apps/console/src/features/applications/utils/tests/oauth2Rules.test.ts
- frontend/apps/console/src/features/applications/components/common/SettingsLockNotice.tsx
- frontend/apps/console/src/features/applications/components/edit-application/token-settings/ClientAccessTokenSection.tsx
- frontend/packages/i18n/src/locales/en-US.ts
- frontend/apps/console/src/features/applications/components/edit-application/general-settings/tests/AccessSection.test.tsx
- frontend/apps/console/src/features/applications/components/edit-application/token-settings/EditTokenSettingsTabs.tsx
- frontend/apps/console/src/features/applications/pages/tests/ApplicationEditPage.test.tsx
- frontend/apps/console/src/features/agents/components/edit-agent/flows/EditFlowsSettings.tsx
- docs/content/guides/applications/application-settings.mdx
- frontend/apps/console/src/features/agents/components/edit-agent/tokens/EditTokensSettings.tsx
- frontend/apps/console/src/features/applications/components/edit-application/general-settings/AccessSection.tsx
Comment on lines
+20
to
+25
| import {type JSX} from 'react'; | ||
| import {useTranslation} from 'react-i18next'; | ||
| import JwtPreview from '../../../../applications/components/edit-application/token-settings/JwtPreview'; | ||
| import ClientAccessTokenSection from '../../../../applications/components/edit-application/token-settings/ClientAccessTokenSection'; | ||
| import TokenConstants from '../../../../applications/constants/token-constants'; | ||
| import type {OAuth2Config} from '../../../../applications/models/oauth'; | ||
| import type {Agent, AgentInboundAuthConfig, OAuthAgentConfig} from '../../../models/agent'; | ||
| import type {InboundAuthConfig} from '../../../../applications/models/inbound-auth'; | ||
| import type {Agent, OAuthAgentConfig} from '../../../models/agent'; |
Contributor
There was a problem hiding this comment.
🩺 Stability & Availability | 🟠 Major | ⚡ Quick win
🧩 Analysis chain
🏁 Script executed:
#!/bin/bash
# Locate the app router and inspect lazy imports for agent/application edit pages
fd -t f 'App.tsx' frontend/apps/console/src | xargs -r rg -n -C2 'lazy\(\s*\(\)\s*=>'
# Confirm monaco-setup exists and where it is chained
fd -t f 'monaco-setup*' frontend/apps/console/src
rg -n 'monaco-setup' frontend/apps/console/srcRepository: thunder-id/thunderid
Length of output: 7944
🏁 Script executed:
#!/bin/bash
set -euo pipefail
echo "== AgentAccessTokenSection =="
fd -t f 'AgentAccessTokenSection.tsx' frontend/apps/console/src | while read -r f; do
echo "-- $f --"
cat -n "$f"
done
echo
echo "== JwtPreview references =="
rg -n "function JwtPreview|const JwtPreview|class JwtPreview|JwtPreview|monaco" frontend/apps/console/src -g '*.{ts,tsx}' | head -200
echo
echo "== Edit agent page =="
fd -t f 'AgentEditPage.tsx' frontend/apps/console/src | while read -r f; do
echo "-- $f --"
rg -n "AgentAccessTokenSection|accessToken|AgentAccessToken" "$f" -C 4
doneRepository: thunder-id/thunderid
Length of output: 21007
Gate the agent edit lazy import behind monaco-setup.
AgentEditPage includes AgentAccessTokenSection, which branches through ClientAccessTokenSection into JwtPreview and Monaco. Update the router path in frontend/apps/console/src/App.tsx:
const AgentEditPage = lazy(() =>
import('./lib/monaco-setup').then(() => import('./features/agents/pages/AgentEditPage')),
);This keeps Monaco offline / strict-CSP safe when the agent edit route is loaded.
🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
In
`@frontend/apps/console/src/features/agents/components/edit-agent/tokens/AgentAccessTokenSection.tsx`
around lines 20 - 25, Update the AgentEditPage lazy route in App.tsx to await
the monaco-setup import before importing AgentEditPage, preserving the existing
lazy loading behavior while gating Monaco-dependent code behind initialization.
Sources: Path instructions, Learnings
Member
+1 Lets implement this in a follow up PR. |
brionmario
approved these changes
Jul 27, 2026
Contributor
|
Tip For best results, initiate chat on the files or code changes.
Agreed—this is tracked in 🐇✨ ✏️ Learnings added
|
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
4 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Purpose
Bring the agent edit page's token and grant-type experience to the application
edit page.
Previously the application Token tab exposed only user-token config, while the
agent Token tab already had a separate Application (client_credentials) token
tab, grant-type-aware locking of user-facing settings, and named save-time
validation. This PR gives applications the same behavior:
The Application tab lets you add optional
ouHandle,ouId,ouName,roles,and
groupsclaims to the client access token and configure its own validityperiod, independent of the user token.
section (allowed user types, redirect URIs) are frozen or hidden when no
user-facing grant (
authorization_code, CIBA,password) is selected, and theApplication token tab is frozen when
client_credentialsis not selected.fix (e.g. "Before saving, add a redirect URI and select at least one allowed
user type") instead of a generic message, matching the agent edit page.
Approach
The change is frontend only. The data model already supported it
(
AccessTokenConfigcarries separateuserConfigandclientConfig, each withits own
validityPeriodand attributes).Key design decisions:
convention, the client-credentials token section was extracted into a shared
ClientAccessTokenSection(inapplications/.../token-settings/), parameterizedby attribute source and display copy. The agent tab now consumes it, passing its
type-schema attributes merged with the agent system/OU/role attributes; the
application tab passes the fixed OU/roles/groups claim list. The agent-only
DelegationLockNoticewas promoted to a shared, domain-neutralSettingsLockNoticeused by both features.hasUserAccess/hasClientAccesswere added tooauth2Rulesso the page and token container derive tab locking from granttypes in one place. User access =
authorization_code, CIBA, orpassword.(dimmed, non-interactive) via
SettingsLockNoticeplus a forcedisReadOnly,mirroring the agent UX. Only the user-oriented fields inside the general Access
section are hidden outright, since they are meaningless for a machine client.
certificate) are computed in
ApplicationEditPagefrom state and gated on thegrant types they apply to, so inactive/unmounted tabs still contribute. MCP
clients keep their own
McpConnectTabvalidation and single token view and areleft unchanged to keep the scope focused.
Note: applications with a user-facing grant but no allowed user type now require one before saving (parity with the agent page). This is a UX validation change, not an API/config breaking change.
Related Issues
Related PRs
Summary by CodeRabbit
Summary