IS-11215: Auto-redirect on authentication completed with success by aleixsuau · Pull Request #125 · curityio/ui-kit

aleixsuau · 2026-04-08T10:13:08Z

Summary

Remove unused HaapiStepperCompletedStepUI component
Add redirectOnAuthenticationCompletedWithSuccess config flag to HaapiStepperConfig (default: true)
When enabled, the stepper auto-redirects to the authorization-response link URL on COMPLETED_WITH_SUCCESS, consistent with how REDIRECTION and POLLING steps are handled internally
When disabled, the completed step is passed through to the UI layer for custom rendering
Extract redirect logic to step-handlers/completed-with-success-step.ts
Add dedicated test suite for the redirect behaviour

Jira

IS-11215

Test plan

Verify default config redirects to authorization-response URL on completed step
Verify redirectOnAuthenticationCompletedWithSuccess: false renders the completed step
All existing tests pass

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

…aapiStepper. Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

Copilot

Pull request overview

This PR updates the HAAPI Stepper flow to optionally auto-redirect when receiving a COMPLETED_WITH_SUCCESS step, aligning it with the stepper’s internal handling of REDIRECTION and POLLING, and adds test coverage for the new redirect behavior.

Changes:

Added redirectOnAuthenticationCompletedWithSuccess to HaapiStepperConfig (default true) and routed COMPLETED_WITH_SUCCESS through a dedicated handler.
Removed the unused HaapiStepperCompletedStepUI component and its export.
Updated and added tests to validate redirect vs. render behavior depending on config.

Reviewed changes

Copilot reviewed 5 out of 5 changed files in this pull request and generated 3 comments.

Show a summary per file

File	Description
`src/login-web-app/src/haapi-stepper/feature/steps/HaapiStepperCompletedStep.tsx`	Removes the completed-step UI component (previously responsible for manual redirect).
`src/login-web-app/src/haapi-stepper/feature/stepper/step-handlers/completed-with-success-step.ts`	Adds new handler to auto-redirect (or pass step through to UI when disabled).
`src/login-web-app/src/haapi-stepper/feature/stepper/HaapiStepper.tsx`	Adds config flag + routes `COMPLETED_WITH_SUCCESS` to the new handler.
`src/login-web-app/src/haapi-stepper/feature/stepper/HaapiStepper.spec.tsx`	Adjusts existing tests and adds a new suite validating redirect behavior.
`src/login-web-app/src/haapi-stepper/feature/index.ts`	Removes export for the deleted completed-step UI component.

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

...login-web-app/src/haapi-stepper/feature/stepper/step-handlers/completed-with-success-step.ts

Copilot · 2026-04-09T10:16:35Z

...login-web-app/src/haapi-stepper/feature/stepper/step-handlers/completed-with-success-step.ts

+    if (redirectHref) {
+      window.location.href = redirectHref;
+      return { nextStepData: undefined };
+    }


When redirectOnAuthenticationCompletedWithSuccess is enabled, failing to find an authorization-response link currently falls back to rendering the completed step. This is a behavior change from the previous completed-step UI (which threw when the link was missing) and can leave consumers in an unexpected state despite the redirect config being enabled. Consider throwing an error (or otherwise surfacing a hard failure) when the link is missing and redirect is enabled, so the flow doesn't silently deviate.

Suggested change

if (redirectHref) {

window.location.href = redirectHref;

return { nextStepData: undefined };

}

if (!redirectHref) {

throw new Error(

'redirectOnAuthenticationCompletedWithSuccess is enabled, but the completed-with-success step did not include an authorization-response link.'

);

}

window.location.href = redirectHref;

return { nextStepData: undefined };

@luisgoncalves, I assume the redirect link is mandatory, right?

Yes. Unfortunately the schema doesn't require it, but since the properties (https://curity.io/docs/haapi-data-model/latest/oauth-authorization-response.html) don't include a redirect URI, it would be impossible to return to the client application if the link is not there. AFAIK the server always adds the link.

Copilot · 2026-04-09T10:16:35Z

src/login-web-app/src/haapi-stepper/feature/stepper/HaapiStepper.tsx

 const DEFAULT_CONFIG: Required<HaapiStepperConfig> = {
  pollingInterval: 3000,
  bankIdAutostart: true,
+  redirectOnAuthenticationCompletedWithSuccess: true,
 };

 export interface HaapiStepperConfig {
  pollingInterval: number;
  bankIdAutostart: boolean;
+  redirectOnAuthenticationCompletedWithSuccess: boolean;
 }


HaapiStepper's config prop accepts Partial<HaapiStepperConfig> and defaults are provided via DEFAULT_CONFIG, but HaapiStepperConfig itself has all fields required. Adding a new required field (redirectOnAuthenticationCompletedWithSuccess) can be a breaking type change for downstream consumers that annotate config objects as HaapiStepperConfig. Consider making this flag optional (and relying on DEFAULT_CONFIG), or adjusting the config type(s) so the public type matches how consumers are expected to provide config.

@luisgoncalves FYI

I don't have anything to add about Copilot's comment, if that's why you tagged me.

However, I disagree with adding this config option, because YAGNI. Can you detail why you added it?

In the LWA, not redirecting back automatically means adding a new user interaction when it isn't necessary. I don't think we have a use case for that, and we don't do this in "full page" flows. No need to increase the API surface here.

OTOH, in a scenario where the stepper is used as a "library" (which you usually mention), automatically redirecting may be undesirable, no? In that case, the stepper is running in the client SPA code, so changing the window location could mean reloading the SPA and losing context...? An alternative to this would be that the stepper config takes a "flow ended callback", so that the consumer can do whatever it wants when the flow ends - but I didn't think this through.

Perhaps we don't need to worry about this last case, but I still think we can avoid the setting for now.

…step.ts Agent-Logs-Url: https://github.com/curityio/ui-kit/sessions/0edfd471-eaa5-4544-bcfa-4af503534b25 Co-authored-by: aleixsuau <25689432+aleixsuau@users.noreply.github.com>

luisgoncalves · 2026-04-10T17:01:49Z

package-lock.json

Why did this change if package.json didn't change?

luisgoncalves · 2026-04-10T17:08:46Z

...login-web-app/src/haapi-stepper/feature/stepper/step-handlers/completed-with-success-step.ts

+    if (redirectHref) {
+      window.location.href = redirectHref;
+      return { nextStepData: undefined };
+    }


Yes. Unfortunately the schema doesn't require it, but since the properties (https://curity.io/docs/haapi-data-model/latest/oauth-authorization-response.html) don't include a redirect URI, it would be impossible to return to the client application if the link is not there. AFAIK the server always adds the link.

luisgoncalves · 2026-04-10T17:19:25Z

src/login-web-app/src/haapi-stepper/feature/stepper/HaapiStepper.tsx

 const DEFAULT_CONFIG: Required<HaapiStepperConfig> = {
  pollingInterval: 3000,
  bankIdAutostart: true,
+  redirectOnAuthenticationCompletedWithSuccess: true,
 };

 export interface HaapiStepperConfig {
  pollingInterval: number;
  bankIdAutostart: boolean;
+  redirectOnAuthenticationCompletedWithSuccess: boolean;
 }


I don't have anything to add about Copilot's comment, if that's why you tagged me.

However, I disagree with adding this config option, because YAGNI. Can you detail why you added it?

In the LWA, not redirecting back automatically means adding a new user interaction when it isn't necessary. I don't think we have a use case for that, and we don't do this in "full page" flows. No need to increase the API surface here.

OTOH, in a scenario where the stepper is used as a "library" (which you usually mention), automatically redirecting may be undesirable, no? In that case, the stepper is running in the client SPA code, so changing the window location could mean reloading the SPA and losing context...? An alternative to this would be that the stepper config takes a "flow ended callback", so that the consumer can do whatever it wants when the flow ends - but I didn't think this through.

Perhaps we don't need to worry about this last case, but I still think we can avoid the setting for now.

luisgoncalves · 2026-04-10T17:20:40Z

src/login-web-app/src/haapi-stepper/feature/stepper/HaapiStepper.tsx


+    case HAAPI_STEPS.COMPLETED_WITH_SUCCESS:
+      return handleCompletedWithSuccessStep(nextStepResponse, config);
+


What about COMPLETED_WITH_ERROR below? IINM an OAuth error authorization response also means "flow ended" and should also redirect to the client application.

aleixsuau and others added 2 commits April 8, 2026 12:10

IS-11215 Remove unused HaapiStepperCompletedStepUI component.

71f74ab

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

IS-11215 Add redirectOnAuthenticationCompletedWithSuccess config to H…

2e43566

…aapiStepper. Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

aleixsuau requested review from adnantariq-aurora, Copilot, luisgoncalves, urre and vahag-curity and removed request for Copilot April 9, 2026 10:11

aleixsuau marked this pull request as ready for review April 9, 2026 10:11

Copilot started reviewing on behalf of aleixsuau April 9, 2026 10:12 View session

Copilot AI reviewed Apr 9, 2026

View reviewed changes

Copilot started work on behalf of aleixsuau April 10, 2026 10:43 View session

fix: use import type for type-only imports in completed-with-success-…

ca4d0db

…step.ts Agent-Logs-Url: https://github.com/curityio/ui-kit/sessions/0edfd471-eaa5-4544-bcfa-4af503534b25 Co-authored-by: aleixsuau <25689432+aleixsuau@users.noreply.github.com>

Copilot finished work on behalf of aleixsuau April 10, 2026 10:47

luisgoncalves requested changes Apr 10, 2026

View reviewed changes

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

IS-11215: Auto-redirect on authentication completed with success#125

IS-11215: Auto-redirect on authentication completed with success#125
aleixsuau wants to merge 3 commits intointegration/IS-5161/login-web-appfrom
feature/IS-11215/auto-redirect-on-auth-completed

aleixsuau commented Apr 8, 2026

Uh oh!

Copilot AI left a comment

Uh oh!

Uh oh!

Copilot AI Apr 9, 2026

Uh oh!

aleixsuau Apr 10, 2026

Uh oh!

luisgoncalves Apr 10, 2026

Uh oh!

Copilot AI Apr 9, 2026

Uh oh!

aleixsuau Apr 10, 2026

Uh oh!

luisgoncalves Apr 10, 2026

Uh oh!

luisgoncalves Apr 10, 2026

Uh oh!

luisgoncalves Apr 10, 2026

Uh oh!

luisgoncalves Apr 10, 2026

Uh oh!

luisgoncalves Apr 10, 2026

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

4 participants


		case HAAPI_STEPS.COMPLETED_WITH_SUCCESS:
		return handleCompletedWithSuccessStep(nextStepResponse, config);

Conversation

aleixsuau commented Apr 8, 2026

Summary

Jira

Test plan

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

Pull request overview

Reviewed changes

Uh oh!

Uh oh!

Copilot AI Apr 9, 2026

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Copilot AI Apr 9, 2026

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

4 participants