Overview - Ping-javascript-sdk

7 days30 days

Latest CI Pipeline Executions

Fuzzy

Succeeded
729
28d2507f refactor(store): remove unused createStoreExtra export
by Ryan Bas
Succeeded
729
aae6ae59 feat(sdk): shared store for multiple SDK clients + @forgerock/sdk-store Allow davinci(), journey(), and oidc() to share a single Redux store, so the OpenID Connect discovery document is fetched once regardless of how many clients are initialised. Three ownership modes are supported: // Mode 1 — implicit (unchanged default) const client = await oidc({ config }); // Mode 2 — one client owns the store (primary sharing story) const dv = await davinci({ config: davinciConfig }); const oc = await oidc({ config: oidcConfig, store: dv.store }); // Mode 3 — consumer owns the store const store = createSdkStore(); await davinci({ config: davinciConfig, store }); await oidc({ config: oidcConfig, store }); New @forgerock/sdk-store package (scope:sdk-effects) owns: - The single canonical wellknownApi instance and its RTK Query selectors. createWellknownSelector was rebuilt on every call; it is now memoized per URL via a module-level Map, restoring the memoization that was always cold. - initWellknownQuery and isValidWellknownResponse (moved from sdk-oidc). - The shared store contract: SdkStore / SdkStoreHandle / createSdkStore / injectClient / isSdkStoreHandle. - clientExtra() — the per-client slot resolver used by every *.api.ts. Request middleware and logger are scoped per client (security fix): Before, every *.api.ts resolved its middleware and logger from the store's store-wide thunk extraArgument. On a shared store that extra belongs to the owning client, so DaVinci middleware ran against AUTHORIZE, PAR, TOKEN_EXCHANGE, REVOKE, USER_INFO and END_SESSION, and oidc's own logger was silently discarded. extraArgument is now a registry keyed by each api's reducerPath; clientExtra() returns only the calling client's slot. A missing or malformed slot yields empty middleware and an error-level fallback logger — never another client's values. Public API changes: - oidc() takes store as part of its options object (not a positional second arg), consistent with every other factory in the SDK. - davinci() and journey() expose store: SdkStore on the returned client. Both factories also accept store?: SdkStore as input (mode 2 / 3). - One OIDC client per store: a second oidc() with a different clientId returns argument_error instead of silently overwriting token state. - oidc() validates arguments before injecting into a store (RTK inject is irreversible); a rejected call leaves a caller-owned store unchanged. - A value that fails isSdkStoreHandle() returns argument_error, not TypeError. Store contract is declared once structurally: InjectableStore was declared three times — twice identically and once as a weaker mirror — joined only by `as unknown as`. The fictional __sdkStoreBrand required casts on both sides with no compile-time link between them. There is now one structural interface in sdk-store; producers satisfy it without a cast, consumers receive it without a cast. The two unavoidable widenings live in store.effects.ts with documented rationale. Deleted: toSdkStore, fromSdkStore x3, InjectableStore x3, __sdkStoreBrand, JourneyStore, injectIntoStore, the requestMiddleware log.warn (obsolete under per-client scoping), and the two tests that existed only to cover that warning. Layering enforcement: sdk-store previously depended on sdk-oidc to access initWellknownQuery, which violated the scope:sdk-effects constraint that allows only sdk-types and sdk-utilities. Moving the file removes the only cross-effects dependency and promotes enforce-module-boundaries from warn to error. All 23 affected projects lint clean. Tests: - sdk-store: 40 tests (was 0; passWithNoTests removed). - wellknownApi: cache-per-URL, error mapping, selector memoization (instance identity asserted). - clientExtra: never returns another client's slot; degrades gracefully on any malformed extra. - Middleware isolation: DaVinci middleware does not run against OIDC requests, proven for both the foreign-slot shape and the old flat shape. - State-shape assertions: combineSlices keys are now implicit (via slice.name) rather than literal; pinned so a rename fails here, not in selectors. - shared-store.test.ts fully rewritten: fake handle removed; all three D1 modes tested against the real factories and real createSdkStore(). - store-lifecycle.test.ts: validate-before-inject; clientId conflict guard. - store.effects.test.ts: createSdkStore, isSdkStoreHandle, injectClient. E2E: - Playwright suite in davinci-suites asserts exactly one .well-known network request when davinci() and oidc() share a store (mode 2). Requests are intercepted via page.route() so no live credential is needed. BREAKING (sdk-oidc): initWellknownQuery and isValidWellknownResponse are removed from @forgerock/sdk-oidc and are now exported from @forgerock/sdk-store. Update imports if you were using them directly.
by Ryan Bas
Succeeded
729
9a87a401 chore: add-changeset
by Ryan Bas
Succeeded
729
410cb722 chore: add-changeset
by Ryan Bas
Succeeded
729
88d1cac5 fix(oidc): warn when requestMiddleware is silently dropped with sharedStore requestMiddleware has no effect when oidc() uses an injected store — the owning store's thunk.extraArgument is used instead. Emit an explicit warn so callers aren't left debugging silent behavior. Test coverage: adds idempotency, behavioral subscribe, cache-reuse, requestMiddleware-warning, and state-after-injection assertions.
by Ryan Bas
Succeeded
729
88d1cac5 fix(oidc): warn when requestMiddleware is silently dropped with sharedStore requestMiddleware has no effect when oidc() uses an injected store — the owning store's thunk.extraArgument is used instead. Emit an explicit warn so callers aren't left debugging silent behavior. Test coverage: adds idempotency, behavioral subscribe, cache-reuse, requestMiddleware-warning, and state-after-injection assertions.
by Ryan Bas