feat: add actor token support for Custom Token Exchange impersonation & delegation#1595
Merged
Merged
Conversation
|
Note Reviews pausedIt looks like this branch is under active development. To avoid overwhelming you with review comments due to an influx of new commits, CodeRabbit has automatically paused this review. You can configure this behavior by changing the Use the following commands to manage reviews:
Use the checkboxes below for quick actions:
📝 WalkthroughWalkthroughCustom token exchange now supports paired actor-token parameters across web, JavaScript, Android, and iOS paths. Validation prevents incomplete pairs, native requests construct actor tokens, user profiles expose ChangesActor token custom exchange
Estimated code review effort: 3 (Moderate) | ~25 minutes Sequence Diagram(s)sequenceDiagram
participant App
participant Auth0Client
participant WebOrNativeBridge
participant Auth0
App->>Auth0Client: customTokenExchange(actorToken, actorTokenType)
Auth0Client->>Auth0Client: validate paired parameters
Auth0Client->>WebOrNativeBridge: forward actor-token parameters
WebOrNativeBridge->>Auth0: exchange subject and actor tokens
Suggested reviewers: 🚥 Pre-merge checks | ✅ 4 | ❌ 1❌ Failed checks (1 warning)
✅ Passed checks (4 passed)
✨ Finishing Touches🧪 Generate unit tests (beta)
Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out. Comment |
![coderabbitai[bot]](https://avatars.githubusercontent.com/in/347564?s=60&v=4){kind=small}
There was a problem hiding this comment.
Actionable comments posted: 3
🧹 Nitpick comments (1)
src/core/utils/__tests__/validation.spec.ts (1)
24-33: 📐 Maintainability & Code Quality | 🔵 Trivial | 💤 Low valueUse Jest's built-in error matching.
The manual
try/catch/throwpattern can be simplified into a single concise assertion using Jest's.toThrow()combined withexpect.objectContaining().♻️ Proposed fix
- it('should throw with the invalid_actor_token_parameters code', () => { - try { - validateActorTokenParameters(undefined, 'urn:token-type'); - throw new Error('Expected validateActorTokenParameters to throw'); - } catch (e) { - expect(e).toBeInstanceOf(AuthError); - expect((e as AuthError).code).toBe('invalid_actor_token_parameters'); - } - }); + it('should throw with the invalid_actor_token_parameters code', () => { + expect(() => validateActorTokenParameters(undefined, 'urn:token-type')).toThrow( + expect.objectContaining({ code: 'invalid_actor_token_parameters' }) + ); + });🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the rest with a brief reason, keep changes minimal, and validate. In `@src/core/utils/__tests__/validation.spec.ts` around lines 24 - 33, Replace the manual try/catch and fallback throw in the validation test with Jest’s built-in error assertion around validateActorTokenParameters, using toThrow with expect.objectContaining to verify the AuthError instance and invalid_actor_token_parameters code.
🤖 Prompt for all review comments with AI agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
Inline comments:
In `@src/platforms/native/adapters/__tests__/NativeAuth0Client.spec.ts`:
- Around line 281-283: Remove the any casts from both customTokenExchange
assertions in src/platforms/native/adapters/__tests__/NativeAuth0Client.spec.ts
at lines 281-283 and 306-308, using the typed mock function directly or
jest.mocked(mockBridgeInstance.customTokenExchange). In
src/platforms/native/bridge/__tests__/NativeBridgeManager.spec.ts at lines
442-444, replace the any cast with an unknown-to-specific-type cast such as
Credentials, using the correct return type for the test.
In `@src/platforms/web/adapters/WebAuth0Client.ts`:
- Around line 265-266: Update the conditional property spreads in the
WebAuth0Client request payload to check actorToken and actorTokenType against
undefined rather than truthiness, ensuring empty-string values are included
consistently with validateActorTokenParameters and the paired fields are sent
together.
In `@src/types/common.ts`:
- Line 156: Update the act property in the relevant type definition to use
Record<string, unknown> instead of Record<string, any>, preserving its optional
nested actor-claim structure.
---
Nitpick comments:
In `@src/core/utils/__tests__/validation.spec.ts`:
- Around line 24-33: Replace the manual try/catch and fallback throw in the
validation test with Jest’s built-in error assertion around
validateActorTokenParameters, using toThrow with expect.objectContaining to
verify the AuthError instance and invalid_actor_token_parameters code.
🪄 Autofix (Beta)
Fix all unresolved CodeRabbit comments on this PR:
- Push a commit to this branch (recommended)
- Create a new PR with the fixes
ℹ️ Review info
⚙️ Run configuration
Configuration used: defaults
Review profile: CHILL
Plan: Pro Plus
Run ID: 5e711f4b-b1ab-4117-804c-e1a9302fbd32
📒 Files selected for processing (16)
EXAMPLES.mdandroid/src/main/java/com/auth0/react/A0Auth0Module.ktios/NativeBridge.swiftsrc/core/models/__tests__/Auth0User.spec.tssrc/core/utils/__tests__/validation.spec.tssrc/core/utils/validation.tssrc/platforms/native/adapters/NativeAuth0Client.tssrc/platforms/native/adapters/__tests__/NativeAuth0Client.spec.tssrc/platforms/native/bridge/INativeBridge.tssrc/platforms/native/bridge/NativeBridgeManager.tssrc/platforms/native/bridge/__tests__/NativeBridgeManager.spec.tssrc/platforms/web/adapters/WebAuth0Client.tssrc/platforms/web/adapters/__tests__/WebAuth0Client.spec.tssrc/specs/NativeA0Auth0.tssrc/types/common.tssrc/types/parameters.ts
There was a problem hiding this comment.
Actionable comments posted: 1
🤖 Prompt for all review comments with AI agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
Inline comments:
In `@example/src/screens/class-based/ClassApiTests.tsx`:
- Around line 238-253: Update the custom token exchange button’s disabled
condition in the actor-enabled test to also require actorTokenType, alongside
subjectToken, subjectTokenType, and actorToken. Keep the existing runTest and
customTokenExchange behavior unchanged.
🪄 Autofix (Beta)
Fix all unresolved CodeRabbit comments on this PR:
- Push a commit to this branch (recommended)
- Create a new PR with the fixes
ℹ️ Review info
⚙️ Run configuration
Configuration used: defaults
Review profile: CHILL
Plan: Pro Plus
Run ID: 4a615615-4f7a-496a-bdba-9e1eae0ec5cb
📒 Files selected for processing (9)
example/src/navigation/ClassDemoNavigator.tsxexample/src/screens/class-based/ClassApiTests.tsxexample/src/screens/class-based/ClassProfile.tsxios/A0Auth0.mmios/NativeBridge.swiftsrc/platforms/native/adapters/__tests__/NativeAuth0Client.spec.tssrc/platforms/native/bridge/__tests__/NativeBridgeManager.spec.tssrc/platforms/web/adapters/WebAuth0Client.tssrc/types/common.ts
🚧 Files skipped from review as they are similar to previous changes (4)
- src/platforms/web/adapters/WebAuth0Client.ts
- src/types/common.ts
- src/platforms/native/adapters/tests/NativeAuth0Client.spec.ts
- src/platforms/native/bridge/tests/NativeBridgeManager.spec.ts
NandanPrabhu
previously approved these changes
Jul 16, 2026
kishore7snehil
requested changes
Jul 23, 2026
There was a problem hiding this comment.
Actionable comments posted: 1
🤖 Prompt for all review comments with AI agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
Inline comments:
In `@src/core/utils/validation.ts`:
- Around line 82-85: Normalize actor values to undefined when they are empty or
whitespace-only before the exchange boundary, rather than forwarding the
original truthy strings. Update validateActorTokenParameters and the
WebAuth0Client.customTokenExchange/native forwarding paths to reuse the
normalized values, and add an adapter-level regression test covering
whitespace-only inputs.
🪄 Autofix (Beta)
Fix all unresolved CodeRabbit comments on this PR:
- Push a commit to this branch (recommended)
- Create a new PR with the fixes
ℹ️ Review info
⚙️ Run configuration
Configuration used: defaults
Review profile: CHILL
Plan: Pro Plus
Run ID: 5231cf93-a909-486c-8537-51867f1c92d7
📒 Files selected for processing (7)
src/core/utils/__tests__/validation.spec.tssrc/core/utils/validation.tssrc/platforms/native/adapters/NativeAuth0Client.tssrc/platforms/native/bridge/NativeBridgeManager.tssrc/platforms/native/bridge/__tests__/NativeBridgeManager.spec.tssrc/platforms/web/adapters/WebAuth0Client.tssrc/platforms/web/adapters/__tests__/WebAuth0Client.spec.ts
🚧 Files skipped from review as they are similar to previous changes (6)
- src/platforms/native/adapters/NativeAuth0Client.ts
- src/platforms/web/adapters/tests/WebAuth0Client.spec.ts
- src/platforms/web/adapters/WebAuth0Client.ts
- src/platforms/native/bridge/NativeBridgeManager.ts
- src/platforms/native/bridge/tests/NativeBridgeManager.spec.ts
- src/core/utils/tests/validation.spec.ts
kishore7snehil
requested changes
Jul 27, 2026
| console.log(user.act); // The acting party claim | ||
| ``` | ||
|
|
||
| > ⚠️ **Refresh token suppression**: When an actor token is present, Auth0 will **not** issue a refresh token, regardless of whether `offline_access` is in the requested scope. `credentials.refreshToken` will be `undefined` in this case. |
There was a problem hiding this comment.
Since there's no refresh token in this flow, it's worth adding what that means downstream: a later refresh-token grant can't re-issue the tokens, so the act claim can't be re-emitted either and the acting party is effectively fixed at exchange time. That consequence is the part developers tend to get surprised by, more than the missing token itself.
kishore7snehil
requested changes
Jul 27, 2026
…ub.com/auth0/react-native-auth0 into feat/custom-token-exchange-actor-token
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
3 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
This PR adds support for delegation and impersonation in Custom Token Exchange flows, following RFC 8693 OAuth 2.0 Token Exchange.
You can now pass an
actorToken(and itsactorTokenType) tocustomTokenExchangeto indicate the acting party in a delegation or impersonation scenario. When present, the issued tokens carry theactclaim, which is now exposed on the user profile.Supported on web, iOS, and Android.
Summary by CodeRabbit
actorToken/actorTokenTypeacross web, iOS, and Android.actclaim (including nested delegation).actpreservation and actor-token validation/forwarding.