Conversation
|
Note Reviews pausedIt looks like this branch is under active development. To avoid overwhelming you with review comments due to an influx of new commits, CodeRabbit has automatically paused this review. You can configure this behavior by changing the Use the following commands to manage reviews:
Use the checkboxes below for quick actions:
No actionable comments were generated in the recent review. 🎉 ℹ️ Recent review info⚙️ Run configurationConfiguration used: defaults Review profile: CHILL Plan: Pro Plus Run ID: 📒 Files selected for processing (1)
📝 WalkthroughWalkthroughAdds a new ChangesPasswordless Login Feature
gitignore update
Estimated code review effort🎯 3 (Moderate) | ⏱️ ~25 minutes Poem
🚥 Pre-merge checks | ✅ 4 | ❌ 1❌ Failed checks (1 warning)
✅ Passed checks (4 passed)
✏️ Tip: You can configure your own custom pre-merge checks in the settings. ✨ Finishing Touches🧪 Generate unit tests (beta)
Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out. Comment |
![coderabbitai[bot]](https://avatars.githubusercontent.com/in/347564?s=60&v=4){kind=small}
There was a problem hiding this comment.
🧹 Nitpick comments (1)
auth0/src/main/java/com/auth0/android/authentication/passwordless/PasswordlessClient.kt (1)
95-99: 📐 Maintainability & Code Quality | 🔵 TrivialAdd
@JvmOverloadson defaulted public APIs for Java interop.Both
challengeWithEmailandchallengeWithPhoneNumberexpose default parameters but lack Java overloads, forcing Java consumers to pass optional values explicitly. Adding@JvmOverloadsaligns with the established pattern inAuthenticationAPIClient.ktand ensures parity between Kotlin and Java APIs.♻️ Proposed change
+ `@JvmOverloads` public fun challengeWithEmail( email: String, connection: String, allowSignup: Boolean = false ): Request<PasswordlessChallenge, AuthenticationException> { @@ + `@JvmOverloads` public fun challengeWithPhoneNumber( phoneNumber: String, connection: String, deliveryMethod: DeliveryMethod = DeliveryMethod.TEXT, allowSignup: Boolean = false ): Request<PasswordlessChallenge, AuthenticationException> {🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the rest with a brief reason, keep changes minimal, and validate. In `@auth0/src/main/java/com/auth0/android/authentication/passwordless/PasswordlessClient.kt` around lines 95 - 99, The challengeWithEmail and challengeWithPhoneNumber methods in PasswordlessClient.kt expose default parameters but lack proper Java interoperability. Add the `@JvmOverloads` annotation to both the challengeWithEmail and challengeWithPhoneNumber method signatures to automatically generate Java overloads for each parameter combination. This will allow Java consumers to call these methods without explicitly passing optional values, following the established pattern used in AuthenticationAPIClient.kt and ensuring consistency across the API.Source: Coding guidelines
🤖 Prompt for all review comments with AI agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
Nitpick comments:
In
`@auth0/src/main/java/com/auth0/android/authentication/passwordless/PasswordlessClient.kt`:
- Around line 95-99: The challengeWithEmail and challengeWithPhoneNumber methods
in PasswordlessClient.kt expose default parameters but lack proper Java
interoperability. Add the `@JvmOverloads` annotation to both the
challengeWithEmail and challengeWithPhoneNumber method signatures to
automatically generate Java overloads for each parameter combination. This will
allow Java consumers to call these methods without explicitly passing optional
values, following the established pattern used in AuthenticationAPIClient.kt and
ensuring consistency across the API.
ℹ️ Review info
⚙️ Run configuration
Configuration used: defaults
Review profile: CHILL
Plan: Pro Plus
Run ID: cc56a76e-0efb-448e-a5c3-ef5eea8ec13e
📒 Files selected for processing (8)
.gitignoreEXAMPLES.mdauth0/src/main/java/com/auth0/android/authentication/AuthenticationAPIClient.ktauth0/src/main/java/com/auth0/android/authentication/passwordless/DeliveryMethod.ktauth0/src/main/java/com/auth0/android/authentication/passwordless/PasswordlessClient.ktauth0/src/main/java/com/auth0/android/result/PasswordlessChallenge.ktauth0/src/test/java/com/auth0/android/authentication/AuthenticationAPIClientTest.ktauth0/src/test/java/com/auth0/android/authentication/PasswordlessClientTest.kt
| @JvmOverloads | ||
| public fun challengeWithEmail( | ||
| email: String, | ||
| connection: String, |
There was a problem hiding this comment.
nit: should we add default connection as "Username-Password-Authentication". Since it's the built-in database connection created for every Auth0 tenant, does it make sense to have it as default
There was a problem hiding this comment.
Valid point. But none of our existing embedded API like ROPG has the default value set to Username-Password-Authentication . Keeping it consistent with existing APIs
pmathew92
dismissed stale reviews from sanchitmehtagit and subhankarmaiti
via
6fba199
There was a problem hiding this comment.
Caution
Some comments are outside the diff and can’t be posted inline due to platform limitations.
⚠️ Outside diff range comments (1)
auth0/src/main/java/com/auth0/android/authentication/passwordless/PasswordlessClient.kt (1)
213-227: 🎯 Functional Correctness | 🟡 Minor | ⚡ Quick winValidate the challenge auth session before posting.
Line 213 sends
passwordlessChallenge.authSession, but the validator only checksotp. A blankauth_sessionshould fail locally with the same typedAuthenticationExceptionpattern instead of making a doomed token request.Proposed fix
).apply { addParameters(parameters) addValidator(object : RequestValidator { override fun validate(options: RequestOptions) { + requireNotBlank(passwordlessChallenge.authSession, AUTH_SESSION_KEY) requireNotBlank(otp, ONE_TIME_PASSWORD_KEY) } }) }🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the rest with a brief reason, keep changes minimal, and validate. In `@auth0/src/main/java/com/auth0/android/authentication/passwordless/PasswordlessClient.kt` around lines 213 - 227, The PasswordlessClient request currently validates only the OTP, so a blank auth session can still reach the token endpoint. Update the request validation in PasswordlessClient to also check passwordlessChallenge.authSession before posting, using the same requireNotBlank/AuthenticationException flow as the OTP validation so failures are raised locally and consistently.
🤖 Prompt for all review comments with AI agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
Outside diff comments:
In
`@auth0/src/main/java/com/auth0/android/authentication/passwordless/PasswordlessClient.kt`:
- Around line 213-227: The PasswordlessClient request currently validates only
the OTP, so a blank auth session can still reach the token endpoint. Update the
request validation in PasswordlessClient to also check
passwordlessChallenge.authSession before posting, using the same
requireNotBlank/AuthenticationException flow as the OTP validation so failures
are raised locally and consistently.
ℹ️ Review info
⚙️ Run configuration
Configuration used: defaults
Review profile: CHILL
Plan: Pro Plus
Run ID: 9ec90c8c-a459-4a8f-92f3-2b88c95f99d7
📒 Files selected for processing (3)
EXAMPLES.mdauth0/src/main/java/com/auth0/android/authentication/passwordless/PasswordlessClient.ktauth0/src/test/java/com/auth0/android/authentication/PasswordlessClientTest.kt
🚧 Files skipped from review as they are similar to previous changes (2)
- auth0/src/test/java/com/auth0/android/authentication/PasswordlessClientTest.kt
- EXAMPLES.md
3 participants
Changes
Adds support for the database-connection passwordless (OTP) authentication flow via a new
PasswordlessClientThis drives a two-step flow against a database connection that has email_otp or phone_otp enabled:
challengeWithEmail(...)/challengeWithPhoneNumber(...)issue a one-time code (POST /otp/challenge) and return an opaquePasswordlessChallengecontaining an auth_session.loginWithOTP(authSession, otp)exchanges the session and code forCredentialsusing the passwordless-OTP grant (POST /oauth/token).This is distinct from the SDK's existing
/passwordless/startflow.What's included
PasswordlessClient— new sub-client obtained from AuthenticationAPIClient.passwordlessClient().PasswordlessChallenge— result type wrapping the opaque auth_session.DeliveryMethod— TEXT / VOICE enum for phone challenges.AuthenticationAPIClient.passwordlessClient()— factory method that forwards the client's private dPoP instance.Testing
on /oauth/token, absent on /otp/challenge).
Checklist
I have read the Auth0 general contribution guidelines
I have read the Auth0 Code of Conduct
All existing and new tests complete without errors
Summary by CodeRabbit
auth_sessionplus OTP for credentials.docs/directory.