Skip to content

feat(OIDC): API Access tab with trust relationships UI#8044

Open
khvn26 wants to merge 4 commits into
feat/oidc-token-exchangefrom
feat/trust-relationships-ui
Open

feat(OIDC): API Access tab with trust relationships UI#8044
khvn26 wants to merge 4 commits into
feat/oidc-token-exchangefrom
feat/trust-relationships-ui

Conversation

@khvn26

@khvn26 khvn26 commented Jul 19, 2026 •
edited
Loading

Copy link
Copy Markdown
Member

Thanks for submitting a PR! Please check the boxes below:

  • I have read the Contributing Guide.
  • I have added information to docs/ if required so people know about the feature.
  • I have filled in the "Changes" section below.
  • I have filled in the "How did you test this code" section below.

Changes

Contributes to #8040

In this PR, we add a Trust relationships management UI.

The organisation settings "API Keys" tab is renamed to "API Access" and gains a Trust Relationships section, gated by the trust_relationships feature flag.

Tabs now pass their stable key as the slug, and the label-derived legacy slug ?tab=api-keys redirects, like ?tab=saml already did.

Creation is preset-based: a provider chooser offers "GitHub Actions" or a freeform "Other OIDC provider", kept for other providers and self-hosted issuers. The GitHub form asks for a repository, picked from the org's GitHub integration if configured, or typed manually otherwise, plus an optional environment. The audience is auto-derived: https://github.com/<owner> (GitHub's zero-config default) for the first trust relationship per owner, a repo-scoped value once the default is taken.

A YAML snippet for Flagsmith/setup-cli action is presented in create/edit modals for GitHub trust relationships.

The "Is Admin" toggle is now accompanied by "available in enterprise" banner both for Master API Keys and Trust relationships.

Built in the modern RTK style (new useTrustRelationship service, typed requests/responses) rather than extending the legacy AdminAPIKeys.js. Also fixes two latent types surfaced by typed usage: createRoleMasterApiKey was missing its body, and the deleteMasterAPIKeyWithMasterAPIKeyRoles helper was annotated with the wrong request type.

How did you test this code?

Locally, by hand; no new E2E tests yet.

Screenshots

Trust relationships list:
image

New trust relationship provider chooser:
image

GitHub modal:
image

GitHub setup snippet:
image

Generic provider modal:
image

@khvn26
khvn26 requested a review from a team as a code owner July 19, 2026 16:50
@khvn26
khvn26 requested review from kyle-ssg and removed request for a team July 19, 2026 16:50
@vercel

vercel Bot commented Jul 19, 2026 •
edited
Loading

Copy link
Copy Markdown

The latest updates on your projects. Learn more about Vercel for GitHub.

Project Deployment Actions Updated (UTC)
flagsmith-frontend-preview Ready Ready Preview, Comment Jul 20, 2026 12:51pm
flagsmith-frontend-staging Ready Ready Preview, Comment Jul 20, 2026 12:51pm
1 Skipped Deployment
Project Deployment Actions Updated (UTC)
docs Ignored Ignored Preview Jul 20, 2026 12:51pm

Request Review

@coderabbitai

coderabbitai Bot commented Jul 19, 2026 •
edited
Loading

Copy link
Copy Markdown

Important

Review skipped

Auto reviews are disabled on base/target branches other than the default branch.

Please check the settings in the CodeRabbit UI or the .coderabbit.yaml file in this repository. To trigger a single review, invoke the @coderabbitai review command.

⚙️ Run configuration

Configuration used: Organization UI

Review profile: ASSERTIVE

Plan: Pro Plus

Run ID: 94c8dc44-6fd0-4c04-8216-3b3c933bb1c6

You can disable this status message by setting the reviews.review_status to false in the CodeRabbit configuration file.

Use the checkbox below for a quick retry:

  • 🔍 Trigger review

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

Comment @coderabbitai help to get the list of available commands.

@github-actions github-actions Bot added the front-end Issue related to the React Front End Dashboard label Jul 19, 2026
@khvn26 khvn26 changed the title feat(trust-relationships): Add API Access tab with trust relationships UI feat(OIDC): Add API Access tab with trust relationships UI Jul 19, 2026
@github-actions

github-actions Bot commented Jul 19, 2026 •
edited
Loading

Copy link
Copy Markdown
Contributor

Docker builds report

Image Build Status Security report
ghcr.io/flagsmith/flagsmith-api-test:pr-8044 Finished ✅ Skipped
ghcr.io/flagsmith/flagsmith-e2e:pr-8044 Finished ✅ Skipped
ghcr.io/flagsmith/flagsmith-frontend:pr-8044 Finished ✅ Results ✅
ghcr.io/flagsmith/flagsmith-api:pr-8044 Finished ✅ Results ✅
ghcr.io/flagsmith/flagsmith:pr-8044 Finished ✅ Results ✅
ghcr.io/flagsmith/flagsmith-private-cloud:pr-8044 Finished ✅ Results ✅

@github-actions github-actions Bot added the feature New feature or request label Jul 19, 2026
@khvn26
khvn26 force-pushed the feat/trust-relationships-ui branch from f52d48d to 897e6b5 Compare July 19, 2026 16:54
@khvn26
khvn26 force-pushed the feat/oidc-token-exchange branch from a9bf1ff to 5478a2a Compare July 19, 2026 16:54
@github-actions github-actions Bot added feature New feature or request and removed feature New feature or request labels Jul 19, 2026
@khvn26
khvn26 force-pushed the feat/oidc-token-exchange branch from 5478a2a to b88bd0c Compare July 19, 2026 17:00
@khvn26
khvn26 force-pushed the feat/trust-relationships-ui branch from 897e6b5 to ac0eb55 Compare July 19, 2026 17:00
@github-actions

This comment was marked as duplicate.

Sign in to view
@github-actions github-actions Bot added feature New feature or request and removed feature New feature or request labels Jul 19, 2026
@github-actions

github-actions Bot commented Jul 19, 2026 •
edited
Loading

Copy link
Copy Markdown
Contributor

Visual Regression

19 screenshots compared. See report for details.
View full report

@khvn26
khvn26 force-pushed the feat/trust-relationships-ui branch from ac0eb55 to f3d09e9 Compare July 19, 2026 17:08
@khvn26
khvn26 force-pushed the feat/oidc-token-exchange branch from b88bd0c to b767571 Compare July 19, 2026 17:08
@khvn26
khvn26 requested review from emyller and removed request for a team July 20, 2026 10:19
@khvn26
khvn26 force-pushed the feat/trust-relationships-ui branch from c920f26 to 83c6bd9 Compare July 20, 2026 10:19
@github-actions github-actions Bot added feature New feature or request and removed feature New feature or request labels Jul 20, 2026
@khvn26
khvn26 force-pushed the feat/oidc-token-exchange branch from 11cd374 to 2d8d889 Compare July 20, 2026 10:23
@khvn26
khvn26 force-pushed the feat/trust-relationships-ui branch from 83c6bd9 to 8a8c79c Compare July 20, 2026 10:23
@github-actions github-actions Bot added feature New feature or request and removed feature New feature or request labels Jul 20, 2026
@khvn26
khvn26 force-pushed the feat/trust-relationships-ui branch from 8a8c79c to 153457d Compare July 20, 2026 10:38
@github-actions github-actions Bot added feature New feature or request and removed feature New feature or request labels Jul 20, 2026
@github-actions github-actions Bot added the docs Documentation updates label Jul 20, 2026
@github-actions github-actions Bot removed feature New feature or request docs Documentation updates labels Jul 20, 2026
@github-actions

github-actions Bot commented Jul 20, 2026 •
edited
Loading

Copy link
Copy Markdown
Contributor

Playwright Test Results (oss - depot-ubuntu-latest-16)

passed  2 passed

Details

stats  2 tests across 2 suites
duration  41.6 seconds
commit  7dd2cf6
info  🔄 Run: #18515 (attempt 1)

Playwright Test Results (oss - depot-ubuntu-latest-arm-16)

passed  1 passed

Details

stats  1 test across 1 suite
duration  6.3 seconds
commit  7dd2cf6
info  🔄 Run: #18515 (attempt 1)

Playwright Test Results (private-cloud - depot-ubuntu-latest-arm-16)

passed  1 passed

Details

stats  1 test across 1 suite
duration  6.9 seconds
commit  7dd2cf6
info  🔄 Run: #18515 (attempt 1)

Playwright Test Results (private-cloud - depot-ubuntu-latest-16)

passed  5 passed

Details

stats  5 tests across 5 suites
duration  55.8 seconds
commit  7dd2cf6
info  🔄 Run: #18515 (attempt 1)

Playwright Test Results (oss - depot-ubuntu-latest-16)

passed  2 passed

Details

stats  2 tests across 2 suites
duration  37.1 seconds
commit  5b9a755
info  🔄 Run: #18516 (attempt 1)

Playwright Test Results (oss - depot-ubuntu-latest-arm-16)

passed  2 passed

Details

stats  2 tests across 2 suites
duration  44.6 seconds
commit  5b9a755
info  🔄 Run: #18516 (attempt 1)

Playwright Test Results (private-cloud - depot-ubuntu-latest-arm-16)

passed  3 passed

Details

stats  3 tests across 3 suites
duration  58.5 seconds
commit  5b9a755
info  🔄 Run: #18516 (attempt 1)

Playwright Test Results (private-cloud - depot-ubuntu-latest-16)

passed  4 passed

Details

stats  4 tests across 4 suites
duration  36.1 seconds
commit  5b9a755
info  🔄 Run: #18516 (attempt 1)

Playwright Test Results (oss - depot-ubuntu-latest-16)

passed  1 passed

Details

stats  1 test across 1 suite
duration  40.9 seconds
commit  5d102e2
info  🔄 Run: #18518 (attempt 1)

Playwright Test Results (oss - depot-ubuntu-latest-arm-16)

passed  1 passed

Details

stats  1 test across 1 suite
duration  46.7 seconds
commit  5d102e2
info  🔄 Run: #18518 (attempt 1)

Playwright Test Results (private-cloud - depot-ubuntu-latest-16)

passed  2 passed

Details

stats  2 tests across 2 suites
duration  33.7 seconds
commit  5d102e2
info  🔄 Run: #18518 (attempt 1)

Playwright Test Results (private-cloud - depot-ubuntu-latest-arm-16)

passed  2 passed

Details

stats  2 tests across 2 suites
duration  58 seconds
commit  5d102e2
info  🔄 Run: #18518 (attempt 1)

Playwright Test Results (oss - depot-ubuntu-latest-16)

passed  1 passed

Details

stats  1 test across 1 suite
duration  39.9 seconds
commit  471197e
info  🔄 Run: #18521 (attempt 1)

Playwright Test Results (oss - depot-ubuntu-latest-arm-16)

passed  1 passed

Details

stats  1 test across 1 suite
duration  45.7 seconds
commit  471197e
info  🔄 Run: #18521 (attempt 1)

Playwright Test Results (private-cloud - depot-ubuntu-latest-16)

passed  3 passed

Details

stats  3 tests across 3 suites
duration  32 seconds
commit  471197e
info  🔄 Run: #18521 (attempt 1)

Playwright Test Results (private-cloud - depot-ubuntu-latest-arm-16)

passed  5 passed

Details

stats  5 tests across 4 suites
duration  36.3 seconds
commit  471197e
info  🔄 Run: #18521 (attempt 1)

khvn26 added 4 commits July 20, 2026 13:50
@khvn26
feat(trust-relationships): Add API Access tab with trust relationship…
b1476b2 
…s UI

The organisation settings API Keys tab becomes API Access and gains a
Trust Relationships section behind the trust_relationships feature flag:
list, create, edit and delete, with a claim-rules editor and the same
admin toggle and RBAC role assignment flow as master API keys, attached
via the backing key. Also fixes two latent request types in the master
API key role services.

beep boop
@khvn26
fix(OIDC): Provider selection cards are not keyboard accessible
ff2e4b5 
The GitHub/Other provider cards were div+onClick only, so keyboard and
screen-reader users could not start the create flow. Add role="button",
tabIndex and an Enter/Space onKeyDown handler.

beep boop
@khvn26
fix(OIDC): Trust relationship role changes ignore API failures
b703c21 
addRole/removeRole mutated local role state unconditionally and never
inspected the request result, so a failed assignment left the UI showing
a role the backend never stored, with no error surfaced. Update local
state only on success and toast on failure; also flag when role
assignment fails during creation instead of silently swallowing it.

beep boop
@khvn26
refactor(OIDC): Give each trust relationship component its own folder
5a3a2d8 
Adopt the component-folder layout the frontend guideline expects: every
new component now lives in its own directory with an index.ts barrel
(ComponentName/ComponentName.tsx + index.ts). providers.ts and errors.ts
stay as flat modules, being exempt constants/util. Cross-component
imports use the components/ alias, as the import-alias lint rule requires
for parent-traversal paths; APIKeysTab keeps importing the tab via the
unchanged ./trust-relationships path.

beep boop
@github-actions

github-actions Bot commented Jul 20, 2026 •
edited
Loading

Copy link
Copy Markdown
Contributor
✅ private-cloud · depot-ubuntu-latest-arm-16 — run #18528 (attempt 1)

Playwright Test Results (private-cloud - depot-ubuntu-latest-arm-16)

passed  2 passed

Details

stats  2 tests across 2 suites
duration  54.5 seconds
commit  5a3a2d8
info  🔄 Run: #18528 (attempt 1)

🗂️ Previous results
✅ private-cloud · depot-ubuntu-latest-16 — run #18528 (attempt 1)

Playwright Test Results (private-cloud - depot-ubuntu-latest-16)

passed  3 passed

Details

stats  3 tests across 3 suites
duration  32.3 seconds
commit  5a3a2d8
info  🔄 Run: #18528 (attempt 1)

✅ oss · depot-ubuntu-latest-16 — run #18528 (attempt 1)

Playwright Test Results (oss - depot-ubuntu-latest-16)

passed  1 passed

Details

stats  1 test across 1 suite
duration  37.4 seconds
commit  5a3a2d8
info  🔄 Run: #18528 (attempt 1)

✅ oss · depot-ubuntu-latest-arm-16 — run #18528 (attempt 1)

Playwright Test Results (oss - depot-ubuntu-latest-arm-16)

passed  2 passed

Details

stats  2 tests across 2 suites
duration  40.6 seconds
commit  5a3a2d8
info  🔄 Run: #18528 (attempt 1)

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

@coderabbitai coderabbitai[bot] coderabbitai[bot] left review comments
@kyle-ssg kyle-ssg Awaiting requested review from kyle-ssg kyle-ssg is a code owner automatically assigned from Flagsmith/flagsmith-front-end
@emyller emyller Awaiting requested review from emyller emyller was automatically assigned from Flagsmith/flagsmith-back-end

At least 1 approving review is required to merge this pull request.

Assignees

@emyller emyller

@kyle-ssg kyle-ssg

Labels

feature New feature or request front-end Issue related to the React Front End Dashboard

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

3 participants

@khvn26 @emyller @kyle-ssg