Conversation
|
Important
This repository does not receive automatic reviews because it has fewer than 10 stars. ⚙️ Run configurationConfiguration used: defaults Review profile: CHILL Plan: Advanced Run ID: Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out. Comment |
Codecov Report✅ All modified and coverable lines are covered by tests. Additional details and impacted files@@ Coverage Diff @@
## main #71 +/- ##
=========================================
Coverage 71.09% 71.09%
Complexity 239 239
=========================================
Files 209 209
Lines 24592 24592
Branches 1175 1175
=========================================
Hits 17483 17483
Misses 6937 6937
Partials 172 172
Continue to review full report in Codecov by Harness.
🚀 New features to boost your workflow:
|
|
tsdamas
changed the title
…file re-resolution
… fallback by orchestration type
…tests to avoid racing slow native bridge calls on BrowserStack
![mend-for-github-com[bot]](https://avatars.githubusercontent.com/in/30796?s=60&v=4){kind=small}
| /// store is cleared. HTTPCookieStorage and keychain deletion are synchronous; | ||
| /// WKWebsiteDataStore removal is asynchronous and gates the completion. | ||
| private static func clearAuthStorage(completion: @escaping () -> Void) { | ||
| HTTPCookieStorage.shared.removeCookies(since: Date.distantPast) |
There was a problem hiding this comment.
Mend Code Security Check
New finding (1 of 1)
The Mend Code Security Check of your branch failed because of a Insecure Data Storage finding in this line.
| Severity | Vulnerability Type | CWE | File | Data Flows | Detected |
|---|---|---|---|---|---|
 Medium | Insecure Data Storage | 1 | 2026-09-16 11:48pm | ||
| |||||
There was a problem hiding this comment.
The flagged rule is CWE-200 ("exposes sensitive information to an actor not explicitly authorized"), which Mend pattern-matches against cookie-store APIs is a false-positive. Nothing is read, logged, transmitted, or persisted here- no data crosses to any actor. The call's entire purpose is the opposite of exposure: destroying stale SSO cookies before test flows.
tsdamas
changed the title
1 participant
Summary
Release candidate for the 1.1.0 SDK drop. This PR migrates security scanning from the retired Mend GitHub App to orchestrated Mend CLI workflows, remediates transitive CVEs via dependency resolutions, makes
rn-davincipublishable, and hardens the E2E suites (Detox on Android, XCUITest on iOS/BrowserStack) with new DaVinci hook coverage and session-isolation fixes.Changes
Security scanning (Mend CLI migration)
ci.yml, replacing the retired Mend GitHub App integration (SDKS-5436):mend-prepare-workspace.yml— builds a pruned workspace containing onlypackages/*(the published SDKs) with a generated root manifest that preservespackageManager,engines, andresolutions, then re-resolves the realyarn.lockso scanned versions match what CI tests.mend-sca-scan.yml— dependency scan of the pruned workspace; publishes severity counts, a badge, and the "Mend SCA Report" check run.mend-sast-scan.yml— SAST + secrets scan with JSON report parsing and a "Mend SAST Report" check run..whitesource: setreopenClosedIssues: trueso closed dependency findings re-open when reintroduced.Dependencies
js-yamlresolution to4.3.2and adddecode-uri-componentat0.5.0, with lockfile re-resolution.E2E: new DaVinci hook coverage
PingTestRunner/e2e/use-davinci.test.ts(Detox) andUseDaVinciUITests.swift(XCUITest) covering theuseDaVinci+useDaVinciFormhook API: form rendering, login vianext(), and post-login token/userinfo/refresh/revoke/logout state transitions.UseDaVinciScenario.tsx: surface client-configuration errors through ause-davinci-errormarker instead of tearing down the RN tree, keep asuccessReachedpanel visible afterrevoke()/logoutUser()clear the node, and add a-PING_AUTOSTARTdebug aid.E2E: session isolation and stability
AppDelegate: with the new-PING_CLEAR_STORAGElaunch arg, wipe HTTP cookie stores, WKWebsiteDataStore, and keychain items before RN boots, so each launch starts without a stale SSO session (the SDK's persisted cookies previously let the server resume a prior interaction and return SuccessNode instead of the login form).PINGONE_*namespace across scenarios, Detox tests, and the iOS BrowserStack workflow; add thePINGONE_*secrets tobrowserstack-e2e-ios.ymland pass them into the XCUITest build payload.testID(davinci-submit-{label}) so multi-button flows (Sign On / Register / Trouble) can be targeted precisely; the first submit keeps the shareddavinci-submit-btnalias.noRetryArgsso retries re-run only failed suites, explicitdetoxExpectre-assertions after everywaitFor(BrowserStack derives verdicts from expect calls, not polling), 10s spacing between consecutive shared-account logins on Android, an Android-correct submit selector (uppercase button text breaksby.text('Sign On')),reloadReactNativein journey callback test setups, longer net timeouts, and explicit waits around first-call RSA key generation in device-id tests.EnvFileLoaderreads the PingTestRunner.envfor local runs (process env still wins on BrowserStack), shared login-spacing helper, andtapWhenReady/label-based submit targeting.CI / build reliability
gradle.propertiesheap to match.AGENTS.mdCI table entry for the new Mend CLI scan scope.Docs
packages/external-idp/README.md: clarify native vs. browser fallback per orchestration type (Journey is native-only except Apple Sign-In on Android; DaVinci falls back to the browser when a native provider SDK is not linked).Testing
yarn packages:build, lint, typecheck, and unit tests pass locally.use-davinciscenarios.