[brionmario]

Purpose

Adds group, role and permission management to the JavaScript SDKs.

Approach

• Endpoints: endpoints.groups, endpoints.roles and endpoints.agentTypes join the existing management keys. A collection URL resolves from the call's url, then endpoints.<key>, then {baseUrl}/{collection}.
• @thunderid/javascript:
  • Group and role APIs: list, get, create, update and delete, plus group members and role assignments.
  • Agent groups, agent roles, agent types and user groups.
  • getTokenPermissions() and hasPermission(): read the permissions an access token grants and match them the way the server does (system:user covers system:user:view).
  • createResourceInvalidator moves here from @thunderid/react. resolveManagedIdentityName and toManagementErrorMessage are new.
• @thunderid/react and @thunderid/vue:
  • Query and mutation hooks (composables in Vue) for every new resource, and useGrantedPermissions().
  • Admin components for users, groups, roles and agents (list, create, details, members, permissions and assignments), each with a Base* variant.
  • Search and filters: UserList and AgentList search on the server (users by username or email, agents by name), and RoleAssignments filters by assignee type. The server matches one attribute exactly, so the search applies on submit. getAgents gains filter, and toEqualityFilter builds the expression. Groups, roles and group members have no server filter, so they stay unfiltered.
  • Render props on every admin component, the same pattern as SignIn: a children function in React and the default scoped slot in Vue receive the data, loading and error state, and handlers, so the UI can come from any library. A list hands over its rows, default columns, limit, offset, totalResults, onPageChange and onSelect, enough to drive a third-party data grid with server-side paging; a form hands over values, handleInputChange, handleSubmit and isValid.
  • A DataTable primitive and an Attribution component.
• @thunderid/nextjs: the admin components and hooks, with management calls relayed through server actions (managementRequestAction, getGrantedPermissionsAction), so the browser never calls the management API or holds the token.
• @thunderid/nuxt: a management module option that auto-imports the admin components and composables, and a /api/auth/management route that relays management calls.
• @thunderid/node and @thunderid/express: client.management(sessionId) and managementFromRequest(req) bind management operations to a session. The session's token stays on the server and is read on every call.
• @thunderid/react-router and @thunderid/tanstack-router: admin routes (createAdminRoutes, AdminPage).
• i18n: the admin strings are translated in every locale.

Playgrounds

Every playground exercises the new APIs:

• capability checks
• admin, DataTable and Attribution stories with sample data and live variants
• hooks and composables views
• a Custom rendering group: UserList as an MUI DataGrid, GroupCreate as an MUI form and UserDetails as an MUI card in React and Next.js, and the same with PrimeVue in Vue and Nuxt (playground-only dependencies)
• a card showing where each management collection resolves

They read THUNDERID_ENDPOINT_<KEY> (with VITE_ or NUXT_PUBLIC_ where the framework needs it) to override one management collection's URL. The server playgrounds show management calls going through the server. The SDK gaps the playgrounds hit are listed in each README.

Screenshots

From the React playground's component explorer, with sample data.

Admin components, including the server-side search and the assignee type filter:

UserList	UserList, searching by email

UserDetails	UserCreate

GroupMembers	RoleAssignments, filtered to groups

Custom rendering through render props, drawn with MUI. Each admin component has a Custom (MUI) story; the Code tab shows the render function:

UserList as an MUI DataGrid, with search	The render function

GroupCreate as an MUI form	UserDetails as an MUI card

GroupMembers with an MUI picker	RoleAssignments with type chips

RolePermissions as MUI cards	AgentCreate as an MUI form

Vue, through the default scoped slot with PrimeVue:

UserList as a PrimeVue DataTable	GroupCreate	UserDetails

Verified locally:

• pnpm build (18/18) and pnpm test across the packages (2,233 passed, 3 skipped).
• Typecheck, lint and format:check for all seven playgrounds, and builds for React, Vue, Next.js and Nuxt.
• Admin stories rendered in headless Chromium without errors.
• Render props: React (459 tests) and Vue (346 passed, 3 skipped) suites include the new render props tests; the MUI and PrimeVue stories rendered headlessly in React, Next.js, Vue and Nuxt, with the grid's paging driving onPageChange.
• The live management checks have only run signed out so far.

[coderabbitai]

Important

• 🔍 Trigger review

This repository does not receive automatic reviews because it has fewer than 10 stars.

⚙️ Run configuration

• Source mode: Auto
• Repository: thunder-id/javascript-sdks
• Branch: main
• File: .coderabbit.yaml
• Commit: ecd5729
• Layers: Repository YAML
• Review profile: CHILL
• Plan: Advanced
• Run ID: dd3c8262-e91d-4134-ad17-8547eb96d775

• Autofix · Keep fixing CodeRabbit findings and required CI, and resolving merge conflicts

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}

[github-actions]

🔀 Cross-SDK feature parity

Does this change need to ship in the other ThunderID SDKs too? This check stays red until one of these labels answers that:

Label	What it asserts
parity/prs-raised	The ports exist in every other SDK this change reaches, or are recorded as not applying there.
parity/prs-not-needed	Nothing to port: a fix, refactor, docs, CI, dependency bump, release, or a change specific to this platform.

Ports (DO NOT EDIT)

• thunder-id/ios-sdks, iOS
• thunder-id/android-sdks, Android
• thunder-id/flutter-sdks, Flutter

No sibling SDKs accounted for on this thread yet.

Important

Reply to this comment with this block, filled in. The boxes above tick
themselves when you post it.

- thunder-id/ios-sdks: <paste the port link here>
- thunder-id/android-sdks: <paste the port link here>
- thunder-id/flutter-sdks: <paste the port link here>

A link can be a pull request or a tracked issue, written in full or as thunder-id/ios-sdks#123.
Where the change does not reach an SDK, replace the placeholder with N/A and a short
reason, as in - thunder-id/ios-sdks: N/A, the capability has no equivalent there.

The contract is in the SDK development specification.