feat(reactjs-todo-davinci): add ValidatedPasswordCollector support#116
Open
ryanbas21 wants to merge 6 commits into
Open
feat(reactjs-todo-davinci): add ValidatedPasswordCollector support#116ryanbas21 wants to merge 6 commits into
ryanbas21 wants to merge 6 commits into
Conversation
📝 WalkthroughWalkthroughThis PR adds password validation support to the DaVinci form integration, enabling inline validation requirements display, error messaging, and optional password confirmation fields. It also updates SDK dependencies to pinned beta versions and upgrades test infrastructure across related packages. ChangesPassword Validation in DaVinci Forms
Estimated code review effort🎯 3 (Moderate) | ⏱️ ~25 minutes Suggested reviewers
🚥 Pre-merge checks | ✅ 4 | ❌ 1❌ Failed checks (1 warning)
✅ Passed checks (4 passed)
✏️ Tip: You can configure your own custom pre-merge checks in the settings. ✨ Finishing Touches📝 Generate docstrings
🧪 Generate unit tests (beta)
Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out. Comment |
![coderabbitai[bot]](https://avatars.githubusercontent.com/in/347564?s=60&v=4){kind=small}
There was a problem hiding this comment.
Actionable comments posted: 1
🤖 Prompt for all review comments with AI agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
Inline comments:
In `@javascript/reactjs-todo-davinci/package.json`:
- Line 42: The package.json currently pins `@forgerock/davinci-client` to a
preview pkg.pr.new URL; replace that entry in
javascript/reactjs-todo-davinci/package.json so the dependency references the
published npm version string (e.g. "`@forgerock/davinci-client`":
">=<stable-version>" or a specific semver) instead of the pkg.pr.new URL, then
regenerate the lockfile (run npm install/npm ci locally) so package-lock.json no
longer contains a resolved pkg.pr.new URL; ensure the final package-lock.json
committed to the repo points to the stable registry artifact so CI installs
reliably.
🪄 Autofix (Beta)
Fix all unresolved CodeRabbit comments on this PR:
- Push a commit to this branch (recommended)
- Create a new PR with the fixes
ℹ️ Review info
⚙️ Run configuration
Configuration used: Path: .coderabbit.yaml
Review profile: CHILL
Plan: Pro
Run ID: 518e875a-ed2f-4793-b3ca-eb263fe249c5
⛔ Files ignored due to path filters (1)
package-lock.jsonis excluded by!**/package-lock.json
📒 Files selected for processing (6)
javascript/reactjs-todo-davinci/client/components/davinci-client/form.jsjavascript/reactjs-todo-davinci/client/components/davinci-client/hooks/davinci.hook.jsjavascript/reactjs-todo-davinci/client/components/davinci-client/password.jsjavascript/reactjs-todo-davinci/e2e/davinci-validated-password.spec.jsjavascript/reactjs-todo-davinci/package.jsonjavascript/reactjs-todo-davinci/playwright.config.ts
- Upgrades @forgerock/davinci-client to latest (2.0.0) which ships ValidatedPasswordCollector with password policy validation support - Extends the Password component to render a static requirements list from the password policy, inline validation errors on keystroke, and an optional confirm field with real-time mismatch feedback - Wires ValidatedPasswordCollector into form.js via a new validator function exposed from useDavinci with proper error handling - Adds a second webServer (port 8444, 356a254c tenant) in playwright config for ValidatedPasswordCollector e2e tests; skipped in CI where only the 02fb4743 tenant is available
ryanbas21
force-pushed
the
feat/validated-password-collector
branch
from
41d7602 to
cf50b48
Compare
…ssword tests on port 8443
…ed collectors list
- Add defensive null check in request listener to handle non-JSON requests - Use optional chaining for safe property access - Fix swapped assertions in collector test (was checking bootstrap log instead of collector log) - Tests now pass with beta packages which have different request patterns These bugs were pre-existing but masked by original package's request order. Beta package's different request pattern exposed them.
- Upgrade @playwright/test from 1.41.2 to 1.60.0 for better ESM support - Remove 'type: module' from reactjs-todo-journey/package.json - Convert playwright.config.js to CommonJS (require/module.exports) - Journey e2e tests now run (5 passed, 7 failed due to pre-existing backend issues) The ESM config issue was caused by Playwright 1.41.2 not properly handling ESM configs when package.json has 'type: module'. Upgrading Playwright and using CommonJS config resolves the issue.
ancheetah
reviewed
Jun 11, 2026
ancheetah
left a comment
ancheetah
left a comment
Contributor
There was a problem hiding this comment.
Left some comments about error handling.
Comment on lines
+14
to
+29
| /** | ||
| * Override configs keyed by clientId URL param — allows tests to target a | ||
| * different PingOne tenant without recompiling the app. | ||
| */ | ||
| const CLIENT_CONFIGS = { | ||
| 'fb456db5-2e08-46d3-adf0-05bf8d26ad60': { | ||
| clientId: 'fb456db5-2e08-46d3-adf0-05bf8d26ad60', | ||
| redirectUri: `${window.location.origin}/callback.html`, | ||
| scope: 'openid profile email phone name revoke', | ||
| serverConfig: { | ||
| wellknown: | ||
| 'https://auth.pingone.ca/356a254c-cba3-4ade-be1a-860136e8df01/as/.well-known/openid-configuration', | ||
| }, | ||
| }, | ||
| }; | ||
|
|
Contributor
There was a problem hiding this comment.
Why are we hardcoding a tenant here? I feel like this should be moved into a test and not something exposed to the customer.
Comment on lines
+104
to
+107
| } catch (error) { | ||
| console.error('Error creating validator for collector:', error); | ||
| return () => []; | ||
| } |
Contributor
There was a problem hiding this comment.
I don't believe validate can throw. Can we remove this? If we want to handle errors then we should look for them like if (error) in validateResult {}.
|
|
||
| if (validator) { | ||
| const errors = validator(value); | ||
| setValidationErrors(Array.isArray(errors) ? errors : []); |
Contributor
There was a problem hiding this comment.
Do we need to do the Array.isArray check? Validators should always return an array even if it's empty.
Comment on lines
+72
to
+82
| const result = updater(value); | ||
| if (result && result.error) { | ||
| console.error('Error updating password collector:', result.error.message); | ||
| } | ||
|
|
||
| // Keep confirm error in sync as the primary value changes | ||
| if (confirmValue && value !== confirmValue) { | ||
| setConfirmError('Passwords do not match'); | ||
| } else if (confirmValue) { | ||
| setConfirmError(''); | ||
| } |
Contributor
There was a problem hiding this comment.
Is there anything blocking the user from submitting the form if there is an error? Or are these just UI hints?
- Remove hardcoded CLIENT_CONFIGS from create-client.utils.js (production code should not contain test-specific config) - Remove unnecessary try/catch from validator function (davinciClient.validate doesn't throw) - Remove redundant Array.isArray check in password.js (validators always return arrays) - Update e2e test to use standard CONFIG instead of clientId URL param override
cerebrl
approved these changes
Jun 11, 2026
ancheetah
approved these changes
Jun 16, 2026
ancheetah
left a comment
ancheetah
left a comment
Contributor
There was a problem hiding this comment.
Approved. I added a do not merge label. Let's remember to update the deps to latest once we release and this is ready.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
3 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
DO NOT MERGE: Pending 2.1 release. Dependencies need to be updated to latest.
Summary
@forgerock/davinci-clientto PR#638 preview build (addsValidatedPasswordCollectorsupport)Passwordcomponent to render a static requirements list, inline validation errors on keystroke, and an optional confirm field (whenverify: true) with real-time mismatch feedbackValidatedPasswordCollectorintoform.jsvia a newvalidatorfunction exposed fromuseDavinci356a254cPingOne tenant (which returns apasswordPolicyon the registration password field)Changes
package.json@forgerock/davinci-client→pkg.pr.newPR#638 buildhooks/davinci.hook.jsvalidator(collector)with try/catch safety fallbackpassword.jsform.jsValidatedPasswordCollectorcase inmapCollectorsToComponentse2e/davinci-validated-password.spec.jsplaywright.config.ts356a254ctenant for ValidatedPassword testsNotes
pkg.pr.newURL should be replaced with the published npm tag once PR#638 is merged to the SDKverify: trueconfirm field is implemented but not reachable in the current PingOne environment (collector.output.verifyisfalse) — the code is correct and will activate automatically when the environment is configured356a254ctenant'spingOneSSOConnector/createUserstep is returning "requestTimedOut" so a happy-path registration e2e test is not included — covered by the existingdavinci-register-user.spec.jsagainst02fb4743Test plan
npm run e2e -- --grep "ValidatedPasswordCollector"— 4 passing (Chromium + Firefox)npm run e2e -- --grep "Login"— existing login tests still pass🤖 Generated with Claude Code
Summary by CodeRabbit
New Features
Bug Fixes
Documentation
Tests