[2177] Added Captcha UI#2183
Conversation
Signed-off-by: Zeeshan Mehboob <zeeshan.mehboob@infosys.com>
|
Warning Review limit reached
Next review available in: 44 minutes Enable usage-based reviews in Billing to review now. Otherwise, wait until the next included review is available. How can I continue?After more reviews become available, a review can be triggered using the To avoid repeated limits, reduce automatic review volume by pausing incremental auto-reviews earlier, using label-based review opt-in, excluding WIP or generated PR titles, or requesting reviews manually when the PR is ready. If your team needs uninterrupted high-volume reviews, an organization admin can enable usage-based reviews. How do review limits work?CodeRabbit enforces per-developer PR review limits for each organization. Most developers receive the normal plan review availability. For paid Pro and Pro+ PR reviews, CodeRabbit uses adaptive limits for sustained high-volume activity. When a developer's recent PR review activity reaches the 95th percentile or higher among CodeRabbit users, additional reviews become available more gradually as earlier reviews age out of the rolling window. Please refer docs for additional details. Review details⚙️ Run configurationConfiguration used: Repository UI Review profile: ASSERTIVE Plan: Pro Plus Run ID: ⛔ Files ignored due to path filters (1)
📒 Files selected for processing (2)
WalkthroughAdds configurable CAPTCHA rendering for Google reCAPTCHA, Cloudflare Turnstile, and hCaptcha, registers it with the OIDC UI, and includes CAPTCHA inputs in OTP, credential, and KBI authentication flows. ChangesCAPTCHA integration
Estimated code review effort: 4 (Complex) | ~45 minutes Sequence Diagram(s)sequenceDiagram
participant LoginPage
participant ThunderIDProvider
participant CaptchaRenderer
participant CaptchaProvider
participant AuthFlow
LoginPage->>ThunderIDProvider: render SignIn with revalidation
ThunderIDProvider->>CaptchaRenderer: render CAPTCHA_BOX
CaptchaRenderer->>CaptchaProvider: render configured provider
CaptchaProvider->>CaptchaRenderer: return CAPTCHA token or event
CaptchaRenderer->>AuthFlow: submit captcha with authentication inputs
Suggested reviewers: Poem
🚥 Pre-merge checks | ✅ 3 | ❌ 2❌ Failed checks (2 warnings)
✅ Passed checks (3 passed)
✨ Finishing Touches🧪 Generate unit tests (beta)
Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out. Comment |
![coderabbitai[bot]](https://avatars.githubusercontent.com/in/347564?s=60&v=4){kind=small}
There was a problem hiding this comment.
Actionable comments posted: 6
🤖 Prompt for all review comments with AI agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
Inline comments:
In `@esignet-service/data/flows/flow-esignet.yaml`:
- Around line 710-713: In esignet-service/data/flows/flow-esignet.yaml at lines
710-713 and 962-965, correct the CAPTCHA field property from reuired to required
in basic_cred_auth and basic_kbi_auth so both CAPTCHA inputs are enforced.
- Around line 151-152: Replace the hardcoded siteKey under the google-recaptcha
provider with the designated environment-variable reference, following the
repository’s existing configuration syntax and naming conventions. Keep the
provider setting unchanged and ensure no secret value remains in the YAML.
In `@oidc-ui/src/components/CaptchaComponent/CaptchaComponent.tsx`:
- Around line 52-86: Update the currentProvider selection in CaptchaComponent to
store the selected provider’s JSX element directly instead of wrapping it in an
inline function. Adjust the render path to render currentProvider directly while
preserving the existing provider conditions and FormControl error handling.
- Around line 20-43: Remove onInputChangeRef and its assignment, then update
handleSuccess, handleExpire, and handleError to call context.onInputChange
directly while preserving their existing fieldRef and empty-token behavior.
- Around line 14-17: Replace the local error state in CaptchaComponent with a
render-time value derived from formErrors[fieldRef], and remove the associated
useEffect that validates and updates that state. Ensure the component uses the
derived error value so externally updated server-side errors are reflected
immediately.
In `@oidc-ui/src/components/CaptchaComponent/CaptchaModel.tsx`:
- Around line 11-16: Replace the unconstrained size field in CaptchaComponent
with provider-specific validation, using a discriminated type keyed by provider
so Google reCAPTCHA and hCaptcha accept only normal, compact, or invisible,
while Cloudflare Turnstile accepts only normal, compact, or flexible. Update the
adapter usage in GoogleReCaptcha, CloudflareTurnstile, and HCaptcha to rely on
the validated type and remove casts that only suppress TypeScript errors.
🪄 Autofix (Beta)
Fix all unresolved CodeRabbit comments on this PR:
- Push a commit to this branch (recommended)
- Create a new PR with the fixes
ℹ️ Review info
⚙️ Run configuration
Configuration used: Repository UI
Review profile: ASSERTIVE
Plan: Pro
Run ID: 11fd3473-c15d-41d4-ab92-b763aa9b2b0f
⛔ Files ignored due to path filters (1)
oidc-ui/package-lock.jsonis excluded by!**/package-lock.json,!**/package-lock.json
📒 Files selected for processing (11)
esignet-service/data/flows/flow-esignet.yamloidc-ui/package.jsonoidc-ui/src/components/CaptchaComponent/CaptchaComponent.tsxoidc-ui/src/components/CaptchaComponent/CaptchaModel.tsxoidc-ui/src/components/CaptchaComponent/CaptchaRenderer.tsxoidc-ui/src/components/CaptchaComponent/CloudflareTurnstile.tsxoidc-ui/src/components/CaptchaComponent/GoogleReCaptcha.tsxoidc-ui/src/components/CaptchaComponent/HCaptcha.tsxoidc-ui/src/components/index.tsxoidc-ui/src/main.tsxoidc-ui/src/pages/LoginPage.tsx
Signed-off-by: Zeeshan Mehboob <zeeshan.mehboob@infosys.com>
There was a problem hiding this comment.
Caution
Some comments are outside the diff and can’t be posted inline due to platform limitations.
⚠️ Outside diff range comments (1)
esignet-service/data/flows/flow-esignet.yaml (1)
930-933: 🔒 Security & Privacy | 🔴 Critical | ⚡ Quick winFix type mismatch for CAPTCHA input to prevent bot-mitigation bypass.
The
CAPTCHA_BOXinput is defined astype: CUSTOMhere, but the downstreambasic_kbi_authexecutor requires it to betype: PASSWORD_INPUT. According to the flow engine contract, onlyPASSWORD_INPUTandOTP_INPUTfields are forwarded to the credentials map. This mismatch will cause the engine to drop the CAPTCHA response, either breaking the KBI flow or silently bypassing the CAPTCHA check entirely, which violates strict MOSIP bot-mitigation compliance requirements.🔒️ Proposed fix
- ref: CAPTCHA_BOX identifier: captcha - type: CUSTOM + type: PASSWORD_INPUT required: true🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the rest with a brief reason, keep changes minimal, and validate. In `@esignet-service/data/flows/flow-esignet.yaml` around lines 930 - 933, Update the CAPTCHA_BOX input definition for identifier captcha to use type PASSWORD_INPUT instead of CUSTOM, ensuring the CAPTCHA response is forwarded in the credentials map to the basic_kbi_auth executor and the existing required behavior remains unchanged.
🤖 Prompt for all review comments with AI agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
Outside diff comments:
In `@esignet-service/data/flows/flow-esignet.yaml`:
- Around line 930-933: Update the CAPTCHA_BOX input definition for identifier
captcha to use type PASSWORD_INPUT instead of CUSTOM, ensuring the CAPTCHA
response is forwarded in the credentials map to the basic_kbi_auth executor and
the existing required behavior remains unchanged.
ℹ️ Review info
⚙️ Run configuration
Configuration used: Repository UI
Review profile: ASSERTIVE
Plan: Pro
Run ID: 7f421a52-49f7-4f2d-a588-a9f6db726520
📒 Files selected for processing (2)
esignet-service/data/flows/flow-esignet.yamloidc-ui/src/components/CaptchaComponent/CaptchaComponent.tsx
Signed-off-by: Zeeshan Mehboob <zeeshan.mehboob@infosys.com>
Signed-off-by: Zeeshan Mehboob <zeeshan.mehboob@infosys.com>
There was a problem hiding this comment.
Actionable comments posted: 2
🤖 Prompt for all review comments with AI agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
Inline comments:
In `@oidc-ui/package.json`:
- Line 42: Align the `@vitest/coverage-v8` devDependency with the project's Vitest
version by pinning both packages to the same exact installed version, 4.1.10;
update the related Vitest dependency entry alongside the coverage entry and
preserve the existing dependency configuration.
In `@oidc-ui/src/components/CaptchaComponent/CaptchaComponent.tsx`:
- Around line 63-64: Update the invalid-provider branch in CaptchaComponent so
it records a CAPTCHA_BOX validation error and blocks submission when
providerElement remains null, rather than allowing the authentication flow to
continue. Remove the production console.warn call while preserving normal
rendering and submission behavior for supported providers.
🪄 Autofix (Beta)
Fix all unresolved CodeRabbit comments on this PR:
- Push a commit to this branch (recommended)
- Create a new PR with the fixes
ℹ️ Review info
⚙️ Run configuration
Configuration used: Repository UI
Review profile: ASSERTIVE
Plan: Pro Plus
Run ID: 1fcbefc6-d97a-4ad0-ad8f-2ddcfb9d030b
⛔ Files ignored due to path filters (1)
oidc-ui/package-lock.jsonis excluded by!**/package-lock.json,!**/package-lock.json
📒 Files selected for processing (4)
.gitignoreoidc-ui/package.jsonoidc-ui/src/__tests__/pages/PageNotFoundPage.test.tsxoidc-ui/src/components/CaptchaComponent/CaptchaComponent.tsx
Signed-off-by: Zeeshan Mehboob <zeeshan.mehboob@infosys.com>
2 participants
resolve #2177
Summary by CodeRabbit