Update integration guides - #4827
Merged
Merged
Conversation
Contributor
|
Warning Review limit reached
Next review available in: 7 minutes You've used all free OSS reviews for now. Wait for the free limit to reset to keep reviewing this public repository. How can I continue?After more reviews become available, a review can be triggered using the To avoid repeated limits, reduce automatic review volume by pausing incremental auto-reviews earlier, using label-based review opt-in, excluding WIP or generated PR titles, or requesting reviews manually when the PR is ready. If your team needs uninterrupted high-volume reviews, an organization admin can enable usage-based reviews. How do review limits work?CodeRabbit enforces per-developer PR review limits for each organization. Most developers receive the normal plan review availability. For paid Pro and Pro+ PR reviews, CodeRabbit uses adaptive limits for sustained high-volume activity. When a developer's recent PR review activity reaches the 95th percentile or higher among CodeRabbit users, additional reviews become available more gradually as earlier reviews age out of the rolling window. Please refer docs for additional details. Review details⚙️ Run configurationConfiguration used: Path: .coderabbit.yaml Review profile: CHILL Plan: Pro Plus Run ID: 📒 Files selected for processing (36)
📝 WalkthroughWalkthroughThe PR updates current and versioned application quickstarts, SDK installation guidance, authentication prompts, local sign-in routes, application credentials, and console template configuration. ChangesApplication quickstarts
Versioned documentation
Integration prompts
Estimated code review effort: 3 (Moderate) | ~30 minutes Possibly related PRs
Suggested reviewers: 🚥 Pre-merge checks | ✅ 4 | ❌ 1❌ Failed checks (1 warning)
✅ Passed checks (4 passed)
✨ Finishing Touches🧪 Generate unit tests (beta)
Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out. Comment |
NipuniBhagya
approved these changes
Aug 11, 2026
brionmario
force-pushed
the
move-roles-feature
branch
from
August 11, 2026 09:06
9823b4a to
e0267e1
Compare
Contributor
There was a problem hiding this comment.
Actionable comments posted: 17
Caution
Some comments are outside the diff and can’t be posted inline due to platform limitations.
⚠️ Outside diff range comments (1)
docs/content/getting-started/connect-your-application/prompts/nuxt/redirect-based.txt (1)
28-38: 🗄️ Data Integrity & Integration | 🟠 Major | ⚡ Quick winAlign the prompt with the Nuxt application-native flow.
Line 28 uses the new prefixed component names, but this prompt still instructs generated code to use a Client ID,
/api/auth/callback, and hosted sign-in pages. The current Nuxt quickstart uses an Application ID and local/signinand/signuppages withThunderIDSignInandThunderIDSignUp.Update the configuration rules and implementation steps together. Otherwise, generated integrations will use incompatible routes and environment variables.
🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the rest with a brief reason, keep changes minimal, and validate. In `@docs/content/getting-started/connect-your-application/prompts/nuxt/redirect-based.txt` around lines 28 - 38, Update the Nuxt prompt’s configuration rules and Implementation Steps to use the application-native flow: replace Client ID and hosted callback/sign-in guidance with Application ID, local /signin and /signup pages, and the ThunderIDSignIn and ThunderIDSignUp components. Keep the prefixed component naming and ensure the environment variables, routes, and generated page setup are consistent throughout the prompt.
🧹 Nitpick comments (6)
docs/content/getting-started/connect-your-application/node.mdx (2)
70-70: 📐 Maintainability & Code Quality | 🔵 Trivial | ⚡ Quick winUse precise, complete wording for the Backend Service note.
Replace
appswithapplicationsand separate the two statements.As per path instructions, spell out informal abbreviations such as
appin prose asapplication.Suggested wording
-Backend Service apps are pre-configured for the `client_credentials` grant with `client_secret_basic` authentication, no OAuth 2.0 redirect URI or extra setup needed. +Backend Service applications are preconfigured for the `client_credentials` grant with `client_secret_basic` authentication. No OAuth 2.0 redirect URI is required.🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the rest with a brief reason, keep changes minimal, and validate. In `@docs/content/getting-started/connect-your-application/node.mdx` at line 70, Update the Backend Service note to use “applications” instead of “apps” and split the configuration statement from the redirect-URI statement into two clear sentences, preserving the existing technical details.Source: Path instructions
65-65: 📐 Maintainability & Code Quality | 🔵 Trivial | ⚡ Quick winSplit the compound actions into separate steps.
Line 65 combines navigation and clicking. Line 67 combines entering a name and creating the application. Use one action per numbered step.
As per path instructions, split steps that chain two actions with
andinto separate steps.Suggested step split
-2. Navigate to **Applications**, and click **Add Application**. +2. Navigate to **Applications**. +3. Click **Add Application**. -4. Enter a name (e.g. `My Node.js Service`) and create an application. +5. Enter a name (e.g. `My Node.js Service`). +6. Click **Create**.Also applies to: 67-67
🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the rest with a brief reason, keep changes minimal, and validate. In `@docs/content/getting-started/connect-your-application/node.mdx` at line 65, Split the compound instructions in the numbered setup steps: update the step containing “Navigate to Applications, and click Add Application” into separate numbered steps, and likewise separate entering the application name from creating the application in the step at line 67. Preserve the existing action order and wording where possible.Source: Path instructions
docs/content/getting-started/connect-your-application/android.mdx (2)
66-68: 📐 Maintainability & Code Quality | 🔵 Trivial | ⚡ Quick winSplit compound application setup steps across the platform guides.
Each affected guide combines multiple actions or uses an unspecified settings list. Make each numbered step contain one action and name the exact UI settings.
docs/content/getting-started/connect-your-application/android.mdx#L66-L68: split naming, creation, sign-in selection, and Theme settings.docs/content/getting-started/connect-your-application/browser.mdx#L64-L65: split naming, creation, sign-in selection, Theme settings, and other options.docs/content/getting-started/connect-your-application/express.mdx#L64-L65: split naming, creation, sign-in selection, and Theme settings.docs/content/getting-started/connect-your-application/flutter.mdx#L67-L68: split naming, creation, sign-in selection, and Theme settings.As per path instructions, “Steps that chain two actions with
and... should be two steps.”🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the rest with a brief reason, keep changes minimal, and validate. In `@docs/content/getting-started/connect-your-application/android.mdx` around lines 66 - 68, Split the compound application setup steps into one action per numbered step and name the exact settings selected. In docs/content/getting-started/connect-your-application/android.mdx lines 66-68, separate naming the application, creating it, choosing the sign-in method, and configuring Theme settings; apply the same separation in browser.mdx lines 64-65, including other options, express.mdx lines 64-65, and flutter.mdx lines 67-68. Preserve the Android-specific Bring Your Own UI instruction as its own step.Source: Path instructions
97-97: 📐 Maintainability & Code Quality | 🔵 Trivial | ⚡ Quick winUse the approved link component for the GitHub release link.
Line 97 uses a raw GitHub URL in an MDX page. Replace it with the repository-link component required by the docs configuration. If
RepoLinkcannot target the SDK repository, confirm the approved external-repository component before merge.As per path instructions, “Repository URLs and GitHub links →
<RepoLink path="/issues">link text</RepoLink>.”🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the rest with a brief reason, keep changes minimal, and validate. In `@docs/content/getting-started/connect-your-application/android.mdx` at line 97, Update the release link in the getting-started Android documentation to use the approved RepoLink component instead of a raw GitHub URL, targeting the android-sdks repository with the appropriate release path and preserving the existing link text.Source: Path instructions
docs/content/getting-started/connect-your-application/nextjs.mdx (1)
70-70: 📐 Maintainability & Code Quality | 🔵 Trivial | ⚡ Quick winUse “application” in prose.
Replace abbreviated “app” where it is not part of a UI label or code identifier.
docs/content/getting-started/connect-your-application/nextjs.mdx#L70-L70: Change “app’s Credentials tab” to “application’s Credentials tab.”docs/content/getting-started/connect-your-application/nextjs.mdx#L286-L286: Change “app’s own/signinpage” to “application’s/signinpage.”docs/content/getting-started/connect-your-application/nuxt.mdx#L70-L70: Change “app’s Credentials tab” to “application’s Credentials tab.”docs/content/getting-started/connect-your-application/nuxt.mdx#L238-L238: Change “app’s own/signinpage” to “application’s/signinpage.”As per path instructions: use “application” instead of “app” in prose.
🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the rest with a brief reason, keep changes minimal, and validate. In `@docs/content/getting-started/connect-your-application/nextjs.mdx` at line 70, Replace “app” with “application” in prose at docs/content/getting-started/connect-your-application/nextjs.mdx lines 70 and 286, and docs/content/getting-started/connect-your-application/nuxt.mdx lines 70 and 238; leave UI labels and code identifiers unchanged.Source: Path instructions
docs/content/getting-started/connect-your-application/ios.mdx (1)
67-70: 📐 Maintainability & Code Quality | 🔵 Trivial | ⚡ Quick winSplit each application-creation action into a separate step.
Several steps combine entering a name, creating an application, selecting sign-in methods, and selecting settings. Each numbered step must contain one action.
docs/content/getting-started/connect-your-application/ios.mdx#L67-L70: Split application creation and settings selection into separate steps.docs/content/getting-started/connect-your-application/react.mdx#L62-L64: Split application creation from sign-in and configuration selection.docs/content/getting-started/connect-your-application/vue.mdx#L64-L66: Split application creation from sign-in and configuration selection.docs/content/getting-started/connect-your-application/nextjs.mdx#L64-L67: Split application creation, sign-in selection, and sign-in approach selection.docs/content/getting-started/connect-your-application/nuxt.mdx#L64-L67: Split application creation, sign-in selection, and sign-in approach selection.As per path instructions: “Steps that chain two actions with ‘and’” must be separate steps.
🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the rest with a brief reason, keep changes minimal, and validate. In `@docs/content/getting-started/connect-your-application/ios.mdx` around lines 67 - 70, Split the chained application-creation actions into one action per numbered step: in docs/content/getting-started/connect-your-application/ios.mdx lines 67-70, separate naming, creation, sign-in selection, and Theme settings; in react.mdx lines 62-64 and vue.mdx lines 64-66, separate application creation from sign-in and configuration selection; and in nextjs.mdx lines 64-67 and nuxt.mdx lines 64-67, separate application creation, sign-in selection, and Sign-In Approach selection. Preserve the existing order and wording while ensuring no step chains actions with “and”.Source: Path instructions
🤖 Prompt for all review comments with AI agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
Inline comments:
In `@docs/content/getting-started/connect-your-application/android.mdx`:
- Around line 106-109: Update the Groovy Gradle example in the Android
getting-started documentation to show the implementation dependency inside a
dependencies block, or explicitly state that it belongs within an existing
dependencies block; keep the dependency coordinates unchanged.
- Around line 85-109: The Android overview still references the stale
dev.thunderid:compose coordinate; update the overview in
docs/content/getting-started/connect-your-application/android.mdx around lines
85-109 to use com.github.thunder-id:android-sdks:<latest-release-tag>, while
preserving dev.thunderid.compose.* imports. The related prompt sites in
docs/content/getting-started/connect-your-application/prompts/android/redirect-based.txt
at lines 7-21 and 29-30 require no direct change because they already use the
correct JitPack coordinate.
In `@docs/content/getting-started/connect-your-application/flutter.mdx`:
- Around line 91-94: Update the wording at
docs/content/getting-started/connect-your-application/flutter.mdx lines 91-94
and
docs/content/getting-started/connect-your-application/prompts/flutter/redirect-based.txt
lines 26-27 to state that flutter pub add writes a version constraint to
pubspec.yaml and records resolved versions in pubspec.lock, rather than saying
it pins the latest published version in pubspec.yaml.
In `@docs/content/getting-started/connect-your-application/nextjs.mdx`:
- Around line 130-133: Update the Next.js environment-variable example to
replace THUNDERID_FLOW_SECRET with THUNDERID_CLIENT_SECRET, preserving the
application ID, sign-in URL, and sign-up URL entries.
In `@docs/content/getting-started/connect-your-application/node.mdx`:
- Around line 130-131: Update both Node SDK examples to read clientId and
clientSecret from the NODE_CLIENT_ID and NODE_CLIENT_SECRET environment
variables instead of hardcoded placeholders. Revise the accompanying warning to
tell readers to set both variables before running the examples, covering the
configurations near clientId/clientSecret and the additional credential
examples.
In
`@docs/content/getting-started/connect-your-application/prompts/android/redirect-based.txt`:
- Line 7: Update the Android authentication prompt to state that the SDK
requires Android API 26 or higher, replacing the current compatibility guidance;
do not imply support for API 24 or 25 unless switching to a compatible SDK
artifact.
In
`@docs/content/getting-started/connect-your-application/prompts/express/embedded.txt`:
- Line 45: Update step 8 in the verification instructions to include requesting
/logout after the authenticated checks, then request /protected again and verify
the session is no longer valid.
- Line 35: Keep application credentials out of all embedded prompt text: in
docs/content/getting-started/connect-your-application/prompts/express/embedded.txt
lines 35 and 40, nextjs/embedded.txt lines 25 and 39, node/embedded.txt lines 36
and 41, and nuxt/embedded.txt lines 27 and 40, replace credential-request steps
with local THUNDERID_FLOW_SECRET or client-secret environment setup guidance,
remove the steps asking users to provide or echo secrets, and ensure generation
stops with a missing-secret error when the locally configured value is
unavailable.
In
`@docs/content/getting-started/connect-your-application/prompts/nextjs/embedded.txt`:
- Line 45: Update step 10 to explicitly include SignOutButton alongside the
other components, or clearly state that UserDropdown provides the sign-out
action for this SDK, keeping the guidance consistent with the requirements and
import list.
- Line 42: Update step 7 to require the page be a Client Component, import
useRouter, and initialize router before rendering SignIn with router.push('/').
- Line 24: Remove NODE_TLS_REJECT_UNAUTHORIZED=0 from the required environment
variables listed in the Next.js embedded application setup instructions. Do not
include it in production guidance; if a development override is retained
elsewhere, clearly label it as local-development-only and recommend using a
trusted local CA.
- Around line 29-32: Update the embedded Next.js prompt to mark the relevant
client component with "use client", import and initialize useRouter before using
router.push('/'), and include SignOutButton in step 10. Remove any requirement
to set NODE_TLS_REJECT_UNAUTHORIZED=0; if a local-development TLS workaround is
documented, scope it explicitly to local development and warn against production
use.
In
`@docs/content/getting-started/connect-your-application/prompts/nextjs/redirect-based.txt`:
- Line 17: Update the redirect-based Next.js prompt’s Client Secret guidance and
the referenced instructions at the later prompt and Step 4: keep
<your-client-secret> as a local placeholder, tell the developer to set
THUNDERID_CLIENT_SECRET locally, and remove any request to provide, collect, or
echo the secret through the prompt or generated response.
- Line 34: Remove NODE_TLS_REJECT_UNAUTHORIZED=0 from the required
environment-variable list and the .env.local setup step in the Next.js
redirect-based prompt. Direct users to use NODE_EXTRA_CA_CERTS or a trusted
local CA for local certificates, and do not document disabling TLS certificate
validation.
In
`@docs/content/getting-started/connect-your-application/prompts/node/embedded.txt`:
- Line 44: Update Step 6’s executeEmbeddedSignInFlow instruction to include
flowType: 'AUTHENTICATION' alongside applicationId, flowSecret, and the user’s
submitted inputs, preserving the instruction to set the session cookie after
completion.
- Line 27: Update the embedded sign-in example and implementation step to call
executeEmbeddedSignInFlow with applicationId and flowType nested under payload,
while keeping flowSecret at the top level. Preserve the existing AUTHENTICATION
flow and SDK import guidance.
In
`@docs/content/getting-started/connect-your-application/prompts/nuxt/embedded.txt`:
- Around line 26-27: Update the Nuxt environment-variable instructions to
require generating THUNDERID_SESSION_SECRET locally as a high-entropy value of
at least 32 characters; do not ask users to provide it in prompt text or leave
it blank or guessed. Keep THUNDERID_CLIENT_SECRET as the only secret requested
before generating .env.
---
Outside diff comments:
In
`@docs/content/getting-started/connect-your-application/prompts/nuxt/redirect-based.txt`:
- Around line 28-38: Update the Nuxt prompt’s configuration rules and
Implementation Steps to use the application-native flow: replace Client ID and
hosted callback/sign-in guidance with Application ID, local /signin and /signup
pages, and the ThunderIDSignIn and ThunderIDSignUp components. Keep the prefixed
component naming and ensure the environment variables, routes, and generated
page setup are consistent throughout the prompt.
---
Nitpick comments:
In `@docs/content/getting-started/connect-your-application/android.mdx`:
- Around line 66-68: Split the compound application setup steps into one action
per numbered step and name the exact settings selected. In
docs/content/getting-started/connect-your-application/android.mdx lines 66-68,
separate naming the application, creating it, choosing the sign-in method, and
configuring Theme settings; apply the same separation in browser.mdx lines
64-65, including other options, express.mdx lines 64-65, and flutter.mdx lines
67-68. Preserve the Android-specific Bring Your Own UI instruction as its own
step.
- Line 97: Update the release link in the getting-started Android documentation
to use the approved RepoLink component instead of a raw GitHub URL, targeting
the android-sdks repository with the appropriate release path and preserving the
existing link text.
In `@docs/content/getting-started/connect-your-application/ios.mdx`:
- Around line 67-70: Split the chained application-creation actions into one
action per numbered step: in
docs/content/getting-started/connect-your-application/ios.mdx lines 67-70,
separate naming, creation, sign-in selection, and Theme settings; in react.mdx
lines 62-64 and vue.mdx lines 64-66, separate application creation from sign-in
and configuration selection; and in nextjs.mdx lines 64-67 and nuxt.mdx lines
64-67, separate application creation, sign-in selection, and Sign-In Approach
selection. Preserve the existing order and wording while ensuring no step chains
actions with “and”.
In `@docs/content/getting-started/connect-your-application/nextjs.mdx`:
- Line 70: Replace “app” with “application” in prose at
docs/content/getting-started/connect-your-application/nextjs.mdx lines 70 and
286, and docs/content/getting-started/connect-your-application/nuxt.mdx lines 70
and 238; leave UI labels and code identifiers unchanged.
In `@docs/content/getting-started/connect-your-application/node.mdx`:
- Line 70: Update the Backend Service note to use “applications” instead of
“apps” and split the configuration statement from the redirect-URI statement
into two clear sentences, preserving the existing technical details.
- Line 65: Split the compound instructions in the numbered setup steps: update
the step containing “Navigate to Applications, and click Add Application” into
separate numbered steps, and likewise separate entering the application name
from creating the application in the step at line 67. Preserve the existing
action order and wording where possible.
🪄 Autofix
Fix all unresolved CodeRabbit comments on this PR:
- Push a commit to this branch (recommended)
- Create a new PR with the fixes
ℹ️ Review info
⚙️ Run configuration
Configuration used: Path: .coderabbit.yaml
Review profile: CHILL
Plan: Pro Plus
Run ID: 074c987f-6738-46ee-9565-de20e229c125
📒 Files selected for processing (31)
docs/content/getting-started/connect-your-application/android.mdxdocs/content/getting-started/connect-your-application/browser.mdxdocs/content/getting-started/connect-your-application/express.mdxdocs/content/getting-started/connect-your-application/flutter.mdxdocs/content/getting-started/connect-your-application/ios.mdxdocs/content/getting-started/connect-your-application/nextjs.mdxdocs/content/getting-started/connect-your-application/node.mdxdocs/content/getting-started/connect-your-application/nuxt.mdxdocs/content/getting-started/connect-your-application/prompts/android/redirect-based.txtdocs/content/getting-started/connect-your-application/prompts/browser/embedded.txtdocs/content/getting-started/connect-your-application/prompts/browser/redirect-based.txtdocs/content/getting-started/connect-your-application/prompts/express/embedded.txtdocs/content/getting-started/connect-your-application/prompts/flutter/redirect-based.txtdocs/content/getting-started/connect-your-application/prompts/ios/redirect-based.txtdocs/content/getting-started/connect-your-application/prompts/nextjs/embedded.txtdocs/content/getting-started/connect-your-application/prompts/nextjs/redirect-based.txtdocs/content/getting-started/connect-your-application/prompts/node/embedded.txtdocs/content/getting-started/connect-your-application/prompts/node/redirect-based.txtdocs/content/getting-started/connect-your-application/prompts/nuxt/embedded.txtdocs/content/getting-started/connect-your-application/prompts/nuxt/redirect-based.txtdocs/content/getting-started/connect-your-application/prompts/react/embedded.txtdocs/content/getting-started/connect-your-application/prompts/vue/embedded.txtdocs/content/getting-started/connect-your-application/prompts/vue/redirect-based.txtdocs/content/getting-started/connect-your-application/react.mdxdocs/content/getting-started/connect-your-application/vue.mdxdocs/static/data/contributors.jsonfrontend/apps/console/public/config.jsfrontend/apps/console/src/features/applications/data/application-templates/technology-based/nuxt.jsonfrontend/apps/console/src/features/applications/data/application-templates/technology-based/react.jsonfrontend/apps/console/src/features/applications/data/application-templates/technology-based/vanilla-js.jsonfrontend/apps/console/src/features/applications/data/application-templates/technology-based/vue.json
💤 Files with no reviewable changes (7)
- frontend/apps/console/src/features/applications/data/application-templates/technology-based/vue.json
- docs/content/getting-started/connect-your-application/prompts/react/embedded.txt
- docs/content/getting-started/connect-your-application/prompts/browser/embedded.txt
- frontend/apps/console/src/features/applications/data/application-templates/technology-based/react.json
- docs/content/getting-started/connect-your-application/prompts/vue/embedded.txt
- frontend/apps/console/src/features/applications/data/application-templates/technology-based/vanilla-js.json
- frontend/apps/console/public/config.js
Comment on lines
+130
to
+131
| clientId: '<your-client-id>', | ||
| clientSecret: '<your-client-secret>', |
Contributor
There was a problem hiding this comment.
🔒 Security & Privacy | 🟠 Major | ⚡ Quick win
Do not instruct readers to put the client secret in source code.
The current warning tells readers to replace the placeholder in index.mjs. This can lead to committing the client secret to source control. Load both values from environment variables and tell readers to set them before running the example.
The Node SDK configuration reference identifies clientSecret as required for confidential clients in docs/content/sdks/node/apis/config/thunderid-node-config.mdx:46-55.
Suggested credential handling
- clientId: '<your-client-id>',
- clientSecret: '<your-client-secret>',
+ clientId: process.env.NODE_CLIENT_ID,
+ clientSecret: process.env.NODE_CLIENT_SECRET,Apply this change to both examples. Update the warning to instruct readers to set NODE_CLIENT_ID and NODE_CLIENT_SECRET in the environment.
Also applies to: 142-142, 165-166
🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
In `@docs/content/getting-started/connect-your-application/node.mdx` around lines
130 - 131, Update both Node SDK examples to read clientId and clientSecret from
the NODE_CLIENT_ID and NODE_CLIENT_SECRET environment variables instead of
hardcoded placeholders. Revise the accompanying warning to tell readers to set
both variables before running the examples, covering the configurations near
clientId/clientSecret and the additional credential examples.
Contributor
There was a problem hiding this comment.
Actionable comments posted: 9
Caution
Some comments are outside the diff and can’t be posted inline due to platform limitations.
⚠️ Outside diff range comments (1)
docs/versioned_docs/version-v1.0.x/getting-started/connect-your-application/prompts/express/embedded.txt (1)
4-4: 📐 Maintainability & Code Quality | 🟠 Major | ⚡ Quick winUse the product-name template in all prompt prose.
Replace each hardcoded product-name occurrence with
{{productName}}.
docs/versioned_docs/version-v1.0.x/getting-started/connect-your-application/prompts/express/embedded.txt#L4-L4: ReplaceThunderID Express SDKwith{{productName}} Express SDK.docs/versioned_docs/version-v1.0.x/getting-started/connect-your-application/prompts/express/embedded.txt#L9-L9: ReplaceThunderID middlewarewith{{productName}} middleware.docs/versioned_docs/version-v1.0.x/getting-started/connect-your-application/prompts/node/embedded.txt#L4-L4: ReplaceThunderID authenticationwith{{productName}} authentication.🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the rest with a brief reason, keep changes minimal, and validate. In `@docs/versioned_docs/version-v1.0.x/getting-started/connect-your-application/prompts/express/embedded.txt` at line 4, Replace hardcoded product names with the {{productName}} template in all affected prompt prose: docs/versioned_docs/version-v1.0.x/getting-started/connect-your-application/prompts/express/embedded.txt lines 4-4 and 9-9 should use {{productName}} Express SDK and {{productName}} middleware, and docs/versioned_docs/version-v1.0.x/getting-started/connect-your-application/prompts/node/embedded.txt lines 4-4 should use {{productName}} authentication.Source: Path instructions
🤖 Prompt for all review comments with AI agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
Inline comments:
In
`@docs/versioned_docs/version-v1.0.x/getting-started/connect-your-application/prompts/express/embedded.txt`:
- Around line 34-35: Update the embedded Express flow documentation to use a
supported flow-secret path: either make handleFlow() forward flowSecret,
including THUNDERID_FLOW_SECRET fallback, or document the handler that passes it
to executeEmbeddedSignInFlow(), while keeping continuation requests secret-free.
Replace hardcoded “ThunderID” references at the indicated prose locations with
{{productName}}.
In
`@docs/versioned_docs/version-v1.0.x/getting-started/connect-your-application/prompts/flutter/redirect-based.txt`:
- Around line 26-27: Update the package-installation step in the Flutter
getting-started instructions to say that flutter pub add selects the latest
compatible stable version and updates pubspec.lock, replacing the claim that it
resolves and pins the latest published version.
In
`@docs/versioned_docs/version-v1.0.x/getting-started/connect-your-application/prompts/nextjs/embedded.txt`:
- Line 45: Update step 10 in the getting-started implementation instructions to
include SignOutButton alongside SignedIn, UserDropdown, SignedOut, and
SignInButton, matching the required component set.
- Around line 24-26: Remove NODE_TLS_REJECT_UNAUTHORIZED=0 from the required
environment variables in the embedded Next.js setup instructions. Keep the
remaining credentials unchanged and direct users to use a trusted local
certificate or development-only CA configuration instead.
- Around line 42-43: Update the app/signin/page.tsx example to declare the
client boundary with 'use client', import useRouter, and initialize router via
useRouter() before passing router.push('/') to SignIn’s onSuccess callback;
leave the signup example unchanged.
- Around line 29-32: Update the implementation steps in the embedded Next.js
setup to include rendering or wiring the imported SignOutButton, ensuring users
can sign out as required. Keep the existing SignInButton and authentication flow
instructions unchanged.
In
`@docs/versioned_docs/version-v1.0.x/getting-started/connect-your-application/prompts/nextjs/redirect-based.txt`:
- Line 34: Update the environment setup instruction near the Next.js
configuration to mark NODE_TLS_REJECT_UNAUTHORIZED=0 as an optional
local-development-only workaround for self-signed certificates, not a required
variable. Direct users to prefer a trusted CA configuration and explicitly state
that this setting must never be used in production.
- Line 34: Update the environment setup instruction to generate THUNDERID_SECRET
before creating .env.local, requiring a cryptographically random server-only
value of at least 32 characters (for example, via openssl rand -base64 32), and
ensure the resulting secret is included rather than left unspecified.
In
`@docs/versioned_docs/version-v1.0.x/getting-started/connect-your-application/prompts/node/embedded.txt`:
- Around line 27-36: Update the embedded sign-in guidance to use
executeEmbeddedSignInFlowV2 instead of executeEmbeddedSignInFlow. Document
continuation calls with executionId, inputs, and optional challengeToken,
sending Flow-Secret only when initiating the backend flow. Add the
completed-flow handoff: exchange the returned assertion for tokens, store those
tokens alongside the generated session ID, and then use that session for
isSignedIn, getUser, and signOut.
---
Outside diff comments:
In
`@docs/versioned_docs/version-v1.0.x/getting-started/connect-your-application/prompts/express/embedded.txt`:
- Line 4: Replace hardcoded product names with the {{productName}} template in
all affected prompt prose:
docs/versioned_docs/version-v1.0.x/getting-started/connect-your-application/prompts/express/embedded.txt
lines 4-4 and 9-9 should use {{productName}} Express SDK and {{productName}}
middleware, and
docs/versioned_docs/version-v1.0.x/getting-started/connect-your-application/prompts/node/embedded.txt
lines 4-4 should use {{productName}} authentication.
🪄 Autofix
Fix all unresolved CodeRabbit comments on this PR:
- Push a commit to this branch (recommended)
- Create a new PR with the fixes
ℹ️ Review info
⚙️ Run configuration
Configuration used: Path: .coderabbit.yaml
Review profile: CHILL
Plan: Pro Plus
Run ID: 8fe1b5b5-412b-4491-aaec-414b41f9732d
📒 Files selected for processing (25)
docs/versioned_docs/version-v1.0.x/getting-started/connect-your-application/android.mdxdocs/versioned_docs/version-v1.0.x/getting-started/connect-your-application/browser.mdxdocs/versioned_docs/version-v1.0.x/getting-started/connect-your-application/express.mdxdocs/versioned_docs/version-v1.0.x/getting-started/connect-your-application/flutter.mdxdocs/versioned_docs/version-v1.0.x/getting-started/connect-your-application/ios.mdxdocs/versioned_docs/version-v1.0.x/getting-started/connect-your-application/nextjs.mdxdocs/versioned_docs/version-v1.0.x/getting-started/connect-your-application/node.mdxdocs/versioned_docs/version-v1.0.x/getting-started/connect-your-application/nuxt.mdxdocs/versioned_docs/version-v1.0.x/getting-started/connect-your-application/prompts/android/redirect-based.txtdocs/versioned_docs/version-v1.0.x/getting-started/connect-your-application/prompts/browser/embedded.txtdocs/versioned_docs/version-v1.0.x/getting-started/connect-your-application/prompts/browser/redirect-based.txtdocs/versioned_docs/version-v1.0.x/getting-started/connect-your-application/prompts/express/embedded.txtdocs/versioned_docs/version-v1.0.x/getting-started/connect-your-application/prompts/flutter/redirect-based.txtdocs/versioned_docs/version-v1.0.x/getting-started/connect-your-application/prompts/ios/redirect-based.txtdocs/versioned_docs/version-v1.0.x/getting-started/connect-your-application/prompts/nextjs/embedded.txtdocs/versioned_docs/version-v1.0.x/getting-started/connect-your-application/prompts/nextjs/redirect-based.txtdocs/versioned_docs/version-v1.0.x/getting-started/connect-your-application/prompts/node/embedded.txtdocs/versioned_docs/version-v1.0.x/getting-started/connect-your-application/prompts/node/redirect-based.txtdocs/versioned_docs/version-v1.0.x/getting-started/connect-your-application/prompts/nuxt/embedded.txtdocs/versioned_docs/version-v1.0.x/getting-started/connect-your-application/prompts/nuxt/redirect-based.txtdocs/versioned_docs/version-v1.0.x/getting-started/connect-your-application/prompts/react/embedded.txtdocs/versioned_docs/version-v1.0.x/getting-started/connect-your-application/prompts/vue/embedded.txtdocs/versioned_docs/version-v1.0.x/getting-started/connect-your-application/prompts/vue/redirect-based.txtdocs/versioned_docs/version-v1.0.x/getting-started/connect-your-application/react.mdxdocs/versioned_docs/version-v1.0.x/getting-started/connect-your-application/vue.mdx
💤 Files with no reviewable changes (3)
- docs/versioned_docs/version-v1.0.x/getting-started/connect-your-application/prompts/react/embedded.txt
- docs/versioned_docs/version-v1.0.x/getting-started/connect-your-application/prompts/browser/embedded.txt
- docs/versioned_docs/version-v1.0.x/getting-started/connect-your-application/prompts/vue/embedded.txt
DonOmalVindula
previously approved these changes
Aug 11, 2026
Codecov Report✅ All modified and coverable lines are covered by tests. 📢 Thoughts on this report? Let us know! |
brionmario
force-pushed
the
move-roles-feature
branch
from
August 11, 2026 09:31
e0267e1 to
68cc63c
Compare
brionmario
force-pushed
the
move-roles-feature
branch
from
August 11, 2026 09:42
68cc63c to
77374ed
Compare
brionmario
enabled auto-merge
August 11, 2026 09:43
DonOmalVindula
approved these changes
Aug 11, 2026
This was referenced Aug 12, 2026
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
3 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Purpose
Updates the "Connect your application" quickstart guides and their companion Console LLM prompts so they match how application creation and the SDKs actually work today.
ThunderIDprefix, e.g.ThunderIDSignIn), which were previously shown without the prefix.flutter pub addso the docs never hardcode a version.10.0.2.2emulator alias instead oflocalhost, which resolves to the emulator itself rather than the host machine.prompts/*.txtLLM integration prompts with the above so the Console's "integrate with AI" flow generates code consistent with the guides.Approach
N/A
Related Issues
Related PRs
Checklist
breaking changelabel added.Security checks
Summary by CodeRabbit