feat: sessions not revoked after password/role/ user activation status change #2545
Conversation
…s change Signed-off-by: duttarnab <arnab.bdutta@gmail.com>
📝 WalkthroughWalkthroughAdds UI and logic to revoke a user's active sessions when administrators modify specific user fields (password, status, admin role). Introduces localized messages, surfaces an alert in the commit dialog, and calls a revoke-session mutation from user-management flows. Changes
Sequence Diagram(s)sequenceDiagram
autonumber
actor Admin as Admin (Browser)
participant UI as Admin UI
participant API as Backend API
participant Session as Session Service
Admin->>UI: Edit user (password/status/role)
UI->>UI: Compare modified fields with revoke-trigger list
alt revoke-trigger present
UI->>UI: Set alertMessage & alertSeverity
UI-->>Admin: Show warning in GluuCommitDialog (Alert)
end
Admin->>UI: Confirm submit
UI->>API: Submit user update
API->>API: Persist changes
API-->>UI: Return success
alt revoke-trigger present
UI->>API: Call revoke-session mutation (useRevokeUserSession)
API->>Session: Invalidate user sessions/tokens
Session-->>API: Revocation complete
API-->>UI: Mutation resolved
end
UI-->>Admin: Show final status
Estimated Code Review Effort🎯 3 (Moderate) | ⏱️ ~20 minutes Possibly Related PRs
Suggested Reviewers
Poem
Pre-merge checks and finishing touches❌ Failed checks (2 warnings)
✅ Passed checks (3 passed)
✨ Finishing touches
🧪 Generate unit tests (beta)
📜 Recent review detailsConfiguration used: Organization UI Review profile: ASSERTIVE Plan: Pro 📒 Files selected for processing (5)
🧰 Additional context used🧠 Learnings (2)📚 Learning: 2025-11-06T08:23:20.948ZApplied to files:
📚 Learning: 2025-11-10T14:18:58.310ZApplied to files:
🧬 Code graph analysis (2)admin-ui/plugins/user-management/components/UserForm.tsx (1)
admin-ui/plugins/user-management/components/UserEditPage.tsx (3)
🔇 Additional comments (2)
Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out. Comment |
mo-auto
added
comp-admin-ui
…s change Signed-off-by: duttarnab <arnab.bdutta@gmail.com>
![coderabbitai[bot]](https://avatars.githubusercontent.com/in/347564?s=60&v=4){kind=small}
There was a problem hiding this comment.
Actionable comments posted: 6
Caution
Some comments are outside the diff and can’t be posted inline due to platform limitations.
⚠️ Outside diff range comments (1)
admin-ui/app/routes/Apps/Gluu/GluuCommitDialog.tsx (1)
283-294: Consider extending PropTypes for new alert props (optional)For runtime prop validation parity with TypeScript, it would be good to add
alertMessage(string) andalertSeverity(string, ideally constrained) toGluuCommitDialog.propTypes.
📜 Review details
Configuration used: Organization UI
Review profile: ASSERTIVE
Plan: Pro
📒 Files selected for processing (10)
admin-ui/app/locales/en/translation.jsonadmin-ui/app/locales/es/translation.jsonadmin-ui/app/locales/fr/translation.jsonadmin-ui/app/locales/pt/translation.jsonadmin-ui/app/routes/Apps/Gluu/GluuCommitDialog.tsxadmin-ui/app/routes/Apps/Gluu/types/GluuCommitDialog.tsadmin-ui/plugins/user-management/components/PasswordChangeModal.tsxadmin-ui/plugins/user-management/components/UserEditPage.tsxadmin-ui/plugins/user-management/components/UserForm.tsxadmin-ui/plugins/user-management/utils/attributeTransformUtils.ts
🧰 Additional context used
🧠 Learnings (1)
📚 Learning: 2025-11-06T08:23:20.948Z
Learnt from: faisalsiddique4400
Repo: GluuFederation/flex PR: 2418
File: admin-ui/plugins/user-management/components/UserForm.tsx:290-297
Timestamp: 2025-11-06T08:23:20.948Z
Learning: In the UserForm component (admin-ui/plugins/user-management/components/UserForm.tsx), the Back button should fall back to '/user/usersmanagement' when browser history is unavailable, not '/home/dashboard', as this keeps users in the user management context. This aligns with the new requirement that users should be redirected to the respective listing screen of the component rather than the dashboard.
Applied to files:
admin-ui/plugins/user-management/components/UserForm.tsx
🧬 Code graph analysis (2)
admin-ui/app/routes/Apps/Gluu/GluuCommitDialog.tsx (1)
admin-ui/app/components/index.tsx (2)
FormGroup(70-70)Alert(36-36)
admin-ui/plugins/user-management/components/UserEditPage.tsx (2)
admin-ui/plugins/user-management/types/ComponentTypes.ts (2)
UserEditFormValues(5-13)ModifiedFields(16-16)admin-ui/plugins/auth-server/components/Scopes/types/formTypes.ts (1)
ModifiedFields(17-19)
🔇 Additional comments (9)
admin-ui/app/locales/es/translation.json (1)
888-888: LGTM! Spanish translation added correctly.The translation key
revokeUserSessionhas been added appropriately to support the session revocation notification feature. The Spanish text clearly communicates that the user's session will be revoked when password, status, or admin role fields are modified.admin-ui/plugins/user-management/utils/attributeTransformUtils.ts (1)
104-110: The CustomObjectAttribute type from the external 'JansConfigApi' library supports both properties. Multiple files in the codebase confirm this:validations.tsaccesses bothattr.value(singular) andattr.values(array), anduserAuditHelpers.tsusesattr.valuesas an array. The function change is correct and properly handles both cases.admin-ui/app/locales/fr/translation.json (1)
821-821: French revokeUserSession string looks correct and consistentKey name and wording align with the intended behavior (revocation on password/status/admin-role change) and with other locales.
admin-ui/app/routes/Apps/Gluu/types/GluuCommitDialog.ts (1)
22-23: Types for alert props are appropriateOptional
alertMessageandalertSeverityaccurately model how the dialog uses these props and match the allowed severities.admin-ui/app/locales/pt/translation.json (1)
816-816: Portuguese revokeUserSession string is clear and aligned with behaviorMessage correctly communicates that the session will be revoked when password, status, or admin role are modified.
admin-ui/plugins/user-management/components/UserForm.tsx (1)
120-122: Back navigation correctly returns to user management listUsing
navigateBack(ROUTES.USER_MANAGEMENT)keeps users in the user‑management context rather than sending them to the dashboard, which matches the documented navigation preference.Based on learnings, this aligns with the desired fallback behavior.
admin-ui/plugins/user-management/components/PasswordChangeModal.tsx (2)
50-53: Session‑revoke warning wiring into GluuCommitDialog looks goodLocal
alertMessage/alertSeverityare set when the password form is submitted and passed intoGluuCommitDialog, so users see a clear warning about session revocation before confirming the change.Also applies to: 147-152, 215-222
116-132: Plaintext password logging is already mitigated with redactionThe
logPasswordChangefunction callsredactSensitiveDatabefore logging the audit payload (line 231 of userAuditHelpers.ts). This function explicitly redactsjsonPatchStringand other sensitive fields, replacing them with[REDACTED]placeholders before the payload reaches the audit logger.The password is never persisted to logs in plaintext.
Likely an incorrect or invalid review comment.
admin-ui/app/routes/Apps/Gluu/GluuCommitDialog.tsx (1)
46-47: Alert integration into commit dialog is functionally soundThe dialog cleanly supports optional alerts via
alertMessage/alertSeverity, rendering them above the change list only when present. This aligns with the new session‑revocation UX without affecting existing callers.Also applies to: 174-180
admin-ui/plugins/user-management/utils/attributeTransformUtils.ts
Outdated
Show resolved
Hide resolved
Signed-off-by: duttarnab <arnab.bdutta@gmail.com>
|
closes #2543
Summary by CodeRabbit
New Features
Localization
Bug Fixes
✏️ Tip: You can customize this high-level summary in your review settings.