[brionmario]

Purpose

In the React SDK, the first signInSilently() on a page can fail straight away:

Error while signing in silently: Some or all of the required endpoints are missing in the object passed to the endpoints attribute of the AuthConfig object.

After a refresh, it works. I hit this in a Vite + React 19 sample running under <StrictMode>, against @thunderid/[email protected]. The call was rejected after 28 ms, before any iframe was created.

ThunderIDReactClient.signIn() already documents the cause:

With React 19 strict mode, the initialization logic runs twice, and there's an intermittent issue where the config object is not getting stored in the storage layer with Vite scaffolding.

signIn() re-runs initialization when it finds the stored config empty, but signInSilently() didn't. So a silent sign-in on an affected page read an empty config. With no baseUrl and no discovery URL, endpoint resolution fell through to resolveEndpointsExplicitly(), which threw the error above.

Approach

• Shared recovery. The existing recovery moves into a private ensureConfigData(), now called by both signIn() and signInSilently().
• Wider check. Besides an empty config, it also treats a stored config as lost when it no longer has the baseUrl the client was initialized with. That is the shape this error implies.
• No root-cause fix. The underlying StrictMode storage race is still unexplained, and this PR doesn't try to fix it. It only stops silent sign-in from failing when the race strikes, the same way signIn() already does. Vue doesn't double-mount, so it doesn't have this workaround and doesn't need it.

Verification

• New ThunderIDReactClient.configRecovery.test.ts covers three cases:
  • signInSilently() re-initializes when the stored config is missing;
  • it re-initializes when the config has lost its baseUrl;
  • it leaves an intact config alone.
• The first two fail without the fix.
• @thunderid/react tests pass (135). Typecheck and format are clean, and lint on ThunderIDReactClient.ts is unchanged.
• Not verified in a browser: the race is intermittent, so I couldn't reproduce it on demand.

Cross-SDK parity: not needed. This is a React 19 StrictMode workaround in the React SDK only.

Related Issues

• Remove OpenID Connect Session Management 1.0 support from the JavaScript SDKs thunderid#5844

Related PRs

• Fix silent sign-in and add an opt-in silent sign-in before redirect #124

Checklist

• Followed the contribution guidelines.
• Manual test round performed and verified.
• Documentation provided. (Add links if there are any)
• Tests provided. (Add links if there are any)
  • Unit Tests
  • Integration Tests
• Breaking changes. (Fill if applicable)
  • Breaking changes section filled.
  • breaking change label added.
• Cross-SDK parity. Exactly one of parity/prs-raised or parity/prs-not-needed added.
  • If parity/prs-raised, the port links are posted as a reply on the parity check's comment.

Security checks

• Followed secure coding standards.
• Confirmed that this PR doesn't commit any keys, passwords, tokens, usernames, or other secrets.

[coderabbitai]

Important

• 🔍 Trigger review

This repository does not receive automatic reviews because it has fewer than 10 stars.

⚙️ Run configuration

• Configuration used: Repository: thunder-id/javascript-sdks/.coderabbit.yaml
• Review profile: CHILL
• Plan: Advanced
• Run ID: b71e8bce-7c8e-49d2-aee5-0163f2bae395

• Autofix · Keep fixing CodeRabbit findings and required CI, and resolving merge conflicts

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}