OpenAM UI JS SDK by maximthomas · Pull Request #941 · OpenIdentityPlatform/OpenAM

maximthomas · 2025-11-26T10:05:25Z

Experimental UI based on React JS library.
Allows to develop a custom OpenAM UI using pluggable components, see the README.md file

Copilot

Pull request overview

Adds an experimental React/Vite-based “OpenAM UI JS SDK” module to the OpenAM UI build, packages it as distributable ZIP artifacts (app + library), and wires the app bundle into the openam-server-only WAR under extui/ (with a small CORS schema update to allow Accept-API-Version).

Changes:

Introduce new openam-ui-js-sdk Maven module with Vite/Vitest/TypeScript project (app + library builds, plus assemblies).
Package and embed the generated app ZIP into openam-server-only WAR under extui/.
Bump frontend build toolchain versions (frontend-maven-plugin, Node, npm) and update CORS allowed headers.

Reviewed changes

Copilot reviewed 48 out of 50 changed files in this pull request and generated 23 comments.

Show a summary per file

File	Description
`pom.xml`	Adds `openam-ui-js-sdk` app ZIP as a dependency in the root build.
`openam-ui/pom.xml`	Registers new UI module and bumps frontend-maven-plugin/Node/npm versions.
`openam-ui/openam-ui-js-sdk/vitest.config.js`	Vitest configuration (jsdom + setup file).
`openam-ui/openam-ui-js-sdk/vite.lib.config.ts`	Vite config for library build + DTS generation.
`openam-ui/openam-ui-js-sdk/vite.config.ts`	Vite config for app build output to `target/app`.
`openam-ui/openam-ui-js-sdk/tsconfig.node.json`	TS config for Vite config files.
`openam-ui/openam-ui-js-sdk/tsconfig.lib.json`	TS config for library build typings/source scope.
`openam-ui/openam-ui-js-sdk/tsconfig.json`	Project references for TS build mode.
`openam-ui/openam-ui-js-sdk/tsconfig.app.json`	TS config for app compilation scope.
`openam-ui/openam-ui-js-sdk/src/main.tsx`	App entry point rendering `OpenAMUI`.
`openam-ui/openam-ui-js-sdk/src/lib/userService.ts`	Client-side calls for user/session/profile/password operations.
`openam-ui/openam-ui-js-sdk/src/lib/types.ts`	SDK response/data type definitions.
`openam-ui/openam-ui-js-sdk/src/lib/setupTests.ts`	Test environment setup for RTL matchers.
`openam-ui/openam-ui-js-sdk/src/lib/router.tsx`	Hash router definition + service instantiation.
`openam-ui/openam-ui-js-sdk/src/lib/loginService.ts`	Client-side authentication request/callback submission helpers.
`openam-ui/openam-ui-js-sdk/src/lib/index.ts`	Library public exports (components + config/types).
`openam-ui/openam-ui-js-sdk/src/lib/env.d.ts`	Vite env typings for OpenAM URL configuration variables.
`openam-ui/openam-ui-js-sdk/src/lib/config.ts`	Global mutable config + default component implementations.
`openam-ui/openam-ui-js-sdk/src/lib/components/types.ts`	Pluggable UI component type contracts.
`openam-ui/openam-ui-js-sdk/src/lib/components/DefaultUserForm.tsx`	Default user profile + change password modal UI.
`openam-ui/openam-ui-js-sdk/src/lib/components/DefaultUserForm.test.tsx`	Tests for default user form behavior.
`openam-ui/openam-ui-js-sdk/src/lib/components/DefaultLoginForm.tsx`	Default login form rendering callbacks + actions.
`openam-ui/openam-ui-js-sdk/src/lib/components/DefaultLoginForm.test.tsx`	Tests for default login form integration with config.
`openam-ui/openam-ui-js-sdk/src/lib/components/DefaultErrorForm.tsx`	Default error UI component.
`openam-ui/openam-ui-js-sdk/src/lib/components/DefaultErrorForm.test.tsx`	Tests for default error UI.
`openam-ui/openam-ui-js-sdk/src/lib/components/DefaultCallbackElement.tsx`	Default rendering for OpenAM callback types.
`openam-ui/openam-ui-js-sdk/src/lib/components/DefaultCallbackElement.test.tsx`	Tests for callback element rendering/value updates.
`openam-ui/openam-ui-js-sdk/src/lib/components/DefaultActionElements.tsx`	Default submit/action button rendering for callbacks.
`openam-ui/openam-ui-js-sdk/src/lib/components/DefaultActionElements.test.tsx`	Tests for action element behavior.
`openam-ui/openam-ui-js-sdk/src/lib/__tests__/mocks.ts`	Mock auth/user payloads for component tests.
`openam-ui/openam-ui-js-sdk/src/lib/User.tsx`	User route: session check, profile load/save, password update.
`openam-ui/openam-ui-js-sdk/src/lib/OpenAMUI.tsx`	SDK root component mounting the router provider.
`openam-ui/openam-ui-js-sdk/src/lib/NotFoundPage.tsx`	404 page component.
`openam-ui/openam-ui-js-sdk/src/lib/Login.tsx`	Login route: init, submit callbacks, redirect or route change.
`openam-ui/openam-ui-js-sdk/src/lib/Home.tsx`	Home route: redirect to login or user based on session.
`openam-ui/openam-ui-js-sdk/src/index.scss`	Basic styling for forms/modals.
`openam-ui/openam-ui-js-sdk/pom.xml`	Maven build for npm test/build + assembly ZIPs (app + lib).
`openam-ui/openam-ui-js-sdk/package.json`	React/React Router/Vite/Vitest/TS toolchain definitions and scripts.
`openam-ui/openam-ui-js-sdk/index.html`	Vite HTML entry document.
`openam-ui/openam-ui-js-sdk/eslint.config.js`	ESLint config for TS/React hooks/refresh.
`openam-ui/openam-ui-js-sdk/assembly/lib-zip.xml`	Assembly descriptor for library ZIP artifact.
`openam-ui/openam-ui-js-sdk/assembly/app-zip.xml`	Assembly descriptor for app ZIP artifact.
`openam-ui/openam-ui-js-sdk/README.md`	Usage/customization docs for app and SDK consumption.
`openam-ui/openam-ui-js-sdk/.gitignore`	Ignores for node/vite outputs and zips.
`openam-ui/openam-ui-js-sdk/.env.development`	Dev env defaults for OpenAM server/context path.
`openam-ui/openam-ui-js-sdk/.env`	Sample env variables (commented).
`openam-server-only/src/main/resources/services/amCORS.xml`	Allows `Accept-API-Version` header; bumps revisionNumber.
`openam-server-only/pom.xml`	Downloads app ZIP, stages under `extui/`, and includes it in WAR resources; adds ZIP dependency.
`.github/workflows/deploy.yml`	Excludes `openam-ui-js-sdk` from javadoc aggregate build.

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

openam-ui/openam-ui-js-sdk/pom.xml

Copilot · 2026-03-26T11:17:44Z

openam-ui/openam-ui-js-sdk/src/lib/components/DefaultErrorForm.tsx

+import type { ErrorForm } from "./types";
+
+const DefaultErrorForm: ErrorForm = ({ error, resetError }) => {


This file is missing the standard CDDL header block that is present in the other new JS SDK source files. Please add the project’s license header here as well for consistency/compliance.

Copilot · 2026-03-26T11:17:44Z

openam-ui/openam-ui-js-sdk/src/lib/userService.ts

+      const response = await fetch(userUrl, {
+        method: "GET",
+        mode: "cors",
+        credentials: "include",
+        headers: {
+          "Content-Type": "application/json"
+        },
+      })
+      return await response.json();
+    } catch (e) {


getUserData returns response.json() without checking response.ok. For non-2xx responses, this can silently propagate error payloads as UserData and break callers. Handle non-OK responses (e.g., parse an error shape and throw) before returning data.

Copilot · 2026-03-26T11:17:45Z

openam-ui/openam-ui-js-sdk/src/lib/userService.ts

+      const response = await fetch(userUrl, {
+        method: "PUT",
+        mode: "cors",
+        credentials: "include",
+        headers: {
+          "Accept-API-Version": "resource=2.0, protocol=1.0",
+          "Content-Type": "application/json"
+        },
+        body: JSON.stringify(dataToUpdate),
+      }
+      )
+      return await response.json();
+    }


saveUserData returns response.json() even when the server responds with a non-2xx status. This can make the UI treat error payloads as successful updates. Add a response.ok check and surface a useful error (similar to savePassword).

openam-ui/openam-ui-js-sdk/README.md

Copilot · 2026-03-26T11:17:48Z

openam-ui/openam-ui-js-sdk/README.md

+import { setConfig } from 'openam-js-sdk'
+
+setConfig({
+  openamServer: 'https://openam.example.org:443',
+  openamContextPath: '/am',
+  errorForm: ({ error, resetError }) => {
+    return <div>
+      <h1>An error occurred</h1>
+      <p>{error?.message}</p>
+      <input type="button" value="Retry" onClick={() => resetError()} />
+    </div>
+})
+


The customization example uses errorForm, but the config interface property is ErrorForm (capital E) and the default config also uses ErrorForm. As written, the example won’t override the error UI. Update the README example to match the actual config API shape.

Copilot · 2026-03-26T11:17:48Z

openam-ui/openam-ui-js-sdk/src/lib/components/DefaultLoginForm.test.tsx

+    setConfig({
+        CallbackElement: mockCallbackElement,
+        ActionElements: mockActionElements,
+    })
+


This test mutates the global singleton config via setConfig at module initialization time, which can leak state into other test files depending on execution order. Prefer setting config in beforeEach/beforeAll and restoring the previous config in afterEach/afterAll to keep tests isolated.

openam-ui/openam-ui-js-sdk/README.md

Copilot · 2026-03-26T11:17:49Z

openam-ui/openam-ui-js-sdk/src/lib/router.tsx

+const config = getConfig();
+const userService = new UserService(config.getOpenAmUrl());
+const loginService = new LoginService(config.getOpenAmUrl());
+
+const router = createHashRouter([


config, userService, loginService, and the router are instantiated at module load time. Since consumers are expected to call setConfig(...) to customize openamServer/openamContextPath, importing OpenAMUI (via src/lib/index.ts) will run this file before setConfig is called, so the services/router can be locked to the default URL. Consider creating the router/services lazily (e.g., factory function or inside OpenAMUI with useMemo) so updates via setConfig take effect.

Co-authored-by: Copilot <175728472+Copilot@users.noreply.github.com>

…tyPlatform#943) Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>

…#940)

…rm#946)

…andler.codec.http.HttpRequestEncoder (OpenIdentityPlatform#949) Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>

…DoS via memory exhaustion (OpenIdentityPlatform#950) Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>

…federation-library (OpenIdentityPlatform#952)

…et` and `_.omit` functions (OpenIdentityPlatform#953) Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>

…o prototype pollution in the _.unset and _.omit functions. (OpenIdentityPlatform#954)

…IdentityPlatform#957)

…er test in build.yml (OpenIdentityPlatform#959) Co-authored-by: Valery Kharseko <vharseko@3a-systems.ru>

…#947)

…f service (OpenIdentityPlatform#960) Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>

…on DoS in parse() + Prototype Pollution via parse() in NodeJS flatted (OpenIdentityPlatform#966) Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>

…ntSession Deserialization in OpenAM

…asses causes incorrect glob matching Related glob security issue patched in the same release (OpenIdentityPlatform#970) Co-authored-by: copilot-swe-agent[bot] <198982749+Copilot@users.noreply.github.com> Co-authored-by: vharseko <6818498+vharseko@users.noreply.github.com>

…oted-String Parsing (OpenIdentityPlatform#972) Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>

Co-authored-by: Copilot <175728472+Copilot@users.noreply.github.com>

Copilot

Pull request overview

Copilot reviewed 48 out of 50 changed files in this pull request and generated 4 comments.

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

Copilot · 2026-03-30T19:56:00Z

openam-ui/openam-ui-js-sdk/src/lib/userService.ts

+        console.log("request error ocurred:", e)
+      }


Typo in log message: "request error ocurred" should be "request error occurred".

Copilot · 2026-03-30T19:56:00Z

openam-ui/openam-ui-js-sdk/README.md

+
+```tsx
+import React from 'react';
+import OpenAMUI from 'openam-js-sdk';


The README uses a default import (import OpenAMUI from 'openam-js-sdk'), but the library entrypoint exports OpenAMUI as a named export. Update the example to use import { OpenAMUI } ... (or add a default export if that’s the intended API).

Suggested change

import OpenAMUI from 'openam-js-sdk';

import { OpenAMUI } from 'openam-js-sdk';

Copilot · 2026-03-30T19:56:00Z

openam-ui/openam-ui-js-sdk/src/lib/components/DefaultCallbackElement.tsx

+
+    const renderTextOutputCallback = (callback: Callback) => {
+        const propMap = Object.fromEntries(callback.output.map((o) => [o.name, o.value]))
+        const messageType = propMap['messageType']


messageType is read from callback.output and can be a number (per CallbackOutput.value). The switch compares it to string literals ("0", "1", ...), so numeric values (0/1/2/4) will fall into the default branch. Normalize messageType (e.g., String(messageType)) or add numeric cases.

Suggested change

const messageType = propMap['messageType']

const messageType = String(propMap["messageType"] ?? "");

Copilot · 2026-03-30T19:56:01Z

openam-ui/openam-ui-js-sdk/src/lib/components/DefaultCallbackElement.tsx

+const ScriptElement = (scriptText: string) => {
+    useEffect(() => {
+        const script = document.createElement('script');


ScriptElement calls useEffect but is invoked as a plain function later (return ScriptElement(message)), not rendered as a React component/custom hook. This violates the Rules of Hooks and can trigger an “Invalid hook call” at runtime. Refactor it into a real component (e.g., <ScriptElement scriptText={...} />) or a custom hook used by a component.

OpenAM UI JS SDK initial commit

5cce4e7

maximthomas requested a review from vharseko November 26, 2025 10:05

maximthomas added the javascript Pull requests that update Javascript code label Nov 26, 2025

vharseko approved these changes Nov 26, 2025

View reviewed changes

vharseko changed the title ~~OpenAM UI JS SDK initial commit~~ OpenAM UI JS SDK Nov 26, 2025

maximthomas added 4 commits November 27, 2025 10:20

Add react router and realm and login url parameters

30044e5

update README

c1bab4d

fix openam-ui-js-sdk build

58ba2d3

add save password function to the default user form

c2a3ec7

vharseko requested a review from Copilot March 26, 2026 11:04

Copilot started reviewing on behalf of vharseko March 26, 2026 11:05 View session

Copilot AI reviewed Mar 26, 2026

View reviewed changes

maximthomas and others added 18 commits March 30, 2026 10:25

Apply suggestions from code review

371dddd

Co-authored-by: Copilot <175728472+Copilot@users.noreply.github.com>

CVE-2025-66453 Rhino has high CPU usage and potential DoS (OpenIdenti…

f1414b8

…tyPlatform#943) Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>

Update org.openidentityplatform.opendj to 5.0.2 (OpenIdentityPlatform…

26c46cd

…#940)

CVE-2025-64718 js-yaml has prototype pollution in merge (<<)

e4e72e0

CVE-2025-12183 CVE-2025-66566 LZ4 vulnerabilities (OpenIdentityPlatfo…

4bb652d

…rm#946)

Docs: set supported Java and Tomcat versions (OpenIdentityPlatform#944)

06daa71

[maven-release-plugin] prepare release 16.0.4

d4767d1

[maven-release-plugin] prepare for next development iteration

ceec917

fix javadoc build (OpenIdentityPlatform#948)

84d7115

CVE-2025-67735 Netty has a CRLF Injection vulnerability in io.netty.h…

b8e5872

…andler.codec.http.HttpRequestEncoder (OpenIdentityPlatform#949) Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>

CVE-2025-15284 qs's arrayLimit bypass in its bracket notation allows …

587ef61

…DoS via memory exhaustion (OpenIdentityPlatform#950) Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>

[OpenIdentityPlatform#951] Set explicit xmlsec dependency for openam-…

64a29a8

…federation-library (OpenIdentityPlatform#952)

CVE-2025-13465 Lodash has Prototype Pollution Vulnerability in `_.uns…

448c6bd

…et` and `_.omit` functions (OpenIdentityPlatform#953) Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>

CVE-2025-13465 Lodash versions 4.0.0 through 4.17.22 are vulnerable t…

1bcf57e

…o prototype pollution in the _.unset and _.omit functions. (OpenIdentityPlatform#954)

[OpenIdentityPlatform#955] Update JSTL to Jakarta 2.0.0 version (Open…

21fc6e0

…IdentityPlatform#957)

[OpenIdentityPlatform#956] Add OpenAM secondary instances to the Dock…

57d3429

…er test in build.yml (OpenIdentityPlatform#959) Co-authored-by: Valery Kharseko <vharseko@3a-systems.ru>

Update org.openidentityplatform.opendj to 5.0.3 (OpenIdentityPlatform…

f4423ff

…#947)

[maven-release-plugin] prepare release 16.0.5

7810d74

Open Identity Platform Community and others added 16 commits March 30, 2026 10:30

[maven-release-plugin] prepare for next development iteration

0b35489

CVE-2026-2391 qs's arrayLimit bypass in comma parsing allows denial o…

cbc01e7

…f service (OpenIdentityPlatform#960) Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>

CVE-2026-33439 Pre-Authentication Remote Code Execution via jato.clie…

195c53a

…ntSession Deserialization in OpenAM

Update opendj.version to 5.0.4 (OpenIdentityPlatform#964)

7af7143

[maven-release-plugin] prepare release 16.0.6

0b654a6

[maven-release-plugin] prepare for next development iteration

9cbe55b

Update build.yml add JDK 26 support (OpenIdentityPlatform#967)

6382e00

CVE-2026-33870 Netty: HTTP Request Smuggling via Chunked Extension Qu…

e420345

…oted-String Parsing (OpenIdentityPlatform#972) Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>

disable resource filtering for openam-ui-js-sdk

7ab7133

add missing copyright

f663164

process response errors for userService

9ac2134

Merge remote-tracking branch 'origin/master' into openam-js-sdk

1d1c858

Apply suggestions from code review

72eca21

Co-authored-by: Copilot <175728472+Copilot@users.noreply.github.com>

update parent pom version

31dc8a7

vharseko requested a review from Copilot March 30, 2026 17:24

Copilot started reviewing on behalf of vharseko March 30, 2026 19:50 View session

Copilot AI reviewed Mar 30, 2026

View reviewed changes

		import type { ErrorForm } from "./types";

		const DefaultErrorForm: ErrorForm = ({ error, resetError }) => {

	import OpenAMUI from 'openam-js-sdk';
	import { OpenAMUI } from 'openam-js-sdk';

	const messageType = propMap['messageType']
	const messageType = String(propMap["messageType"] ?? "");

Uh oh!

Conversation

maximthomas commented Nov 26, 2025

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

Pull request overview

Reviewed changes

Uh oh!

Uh oh!

Copilot AI Mar 26, 2026

Choose a reason for hiding this comment

Uh oh!

Copilot AI Mar 26, 2026

Choose a reason for hiding this comment

Uh oh!

Copilot AI Mar 26, 2026

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Copilot AI Mar 26, 2026

Choose a reason for hiding this comment

Uh oh!

Copilot AI Mar 26, 2026

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Uh oh!

Copilot AI Mar 26, 2026

Choose a reason for hiding this comment

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

Pull request overview

Uh oh!

Copilot AI Mar 30, 2026

Choose a reason for hiding this comment

Uh oh!

Copilot AI Mar 30, 2026

Choose a reason for hiding this comment

Uh oh!

Copilot AI Mar 30, 2026

Choose a reason for hiding this comment

Uh oh!

Copilot AI Mar 30, 2026

Choose a reason for hiding this comment

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

4 participants