SDKS-4202: Update Signals SDK to v5.6.0 by ancheetah · Pull Request #362 · ForgeRock/ping-javascript-sdk

ancheetah · 2025-07-31T15:31:15Z

JIRA Ticket

https://pingidentity.atlassian.net/browse/SDKS-4202

Description

fixes unecessary re-renders in @pingidentity/protect-app
Updates Signals SDK to v5.6.0
Improves protect native e2e test
Updates Protect config
Updates Protect module readme with DaVinci quickstart
Changes namespace to @forgerock
Implements internal try-catch in protect module for improved error handling

Changeset added

changeset-bot · 2025-07-31T15:31:19Z

🦋 Changeset detected

Latest commit: 4f19711

The changes in this PR will be included in the next version bump.

This PR includes changesets to release 10 packages

Name	Type
@forgerock/protect	Minor
@forgerock/davinci-client	Minor
@forgerock/oidc-client	Minor
@forgerock/sdk-types	Minor
@forgerock/sdk-utilities	Minor
@forgerock/iframe-manager	Minor
@forgerock/sdk-logger	Minor
@forgerock/sdk-oidc	Minor
@forgerock/sdk-request-middleware	Minor
@forgerock/storage	Minor

Not sure what this means? Click here to learn what changesets are.

Click here if you're a maintainer who wants to add another changeset to this PR

nx-cloud · 2025-07-31T15:31:54Z

View your CI Pipeline Execution ↗ for commit 18677d9

Command	Status	Duration	Result
`nx run-many -t build`	✅ Succeeded	<1s	View ↗
`nx affected -t build typecheck lint test e2e-ci`	✅ Succeeded	2m 36s	View ↗
`nx-cloud record -- nx format:check`	✅ Succeeded	3s	View ↗

☁️ Nx Cloud last updated this comment at 2025-08-11 22:52:09 UTC

github-actions · 2025-07-31T15:34:31Z

Deployed 3b5d297 to https://ForgeRock.github.io/ping-javascript-sdk/pr-362/3b5d29766977dd2f4d90486bce21b405efa97858 branch gh-pages in ForgeRock/ping-javascript-sdk

github-actions · 2025-07-31T15:34:36Z

📦 Bundle Size Analysis

🆕 New Packages

🆕 @forgerock/protect - 152.3 KB (new)

➖ No Changes

➖ @forgerock/oidc-client - 17.9 KB
➖ @forgerock/davinci-client - 34.1 KB
➖ @forgerock/sdk-utilities - 4.0 KB
➖ @forgerock/device-client - 9.2 KB
➖ @forgerock/sdk-types - 5.9 KB
➖ @forgerock/iframe-manager - 2.4 KB
➖ @forgerock/sdk-request-middleware - 4.2 KB
➖ @forgerock/storage - 1.4 KB
➖ @forgerock/sdk-logger - 1.6 KB
➖ @forgerock/sdk-oidc - 3.5 KB

11 packages analyzed • Baseline from latest main build

Legend

🆕 New package
🔺 Size increased
🔻 Size decreased
➖ No change

ℹ️ How bundle sizes are calculated

Current Size: Total gzipped size of all files in the package's dist directory
Baseline: Comparison against the latest build from the main branch
Files included: All build outputs except source maps and TypeScript build cache
Exclusions: .map, .tsbuildinfo, and .d.ts.map files

_{🔄 Updated automatically on each push to this PR}

ancheetah · 2025-08-05T15:03:12Z

Pending verification of agentTrust configuration option but can add later

ryanbas21

@ancheetah Can we just get a confirmation that we do not intend to release the signals SDK here?

This would be considered a major change i'd think.

cerebrl

Just a few questions and suggestions.

cerebrl · 2025-08-06T14:58:24Z

packages/protect/README.md

+# PingOne Protect

-The Ping Protect module is intended to be used along with the ForgeRock JavaScript SDK to provide the Ping Protect feature.
+The PingOne Protect module provides an API for interacting with the PingOne Signals (Protect) SDK to perform risk evaluations. It can be used with either a PingOne AIC/PingAM authentication journey with Protect callbacks or with a PingOne DaVinci flow with Protect connectors.


To keep things symmetric, I'd use Nodes and Connectors, or use Callbacks and Collectors. In the above sentence your using terms from different categories.

Good point. I'll change this to callbacks and collectors here. I do use the term connectors in the DaVinci section but I think it is more clear there the relationship between collectors and connectors.

ping-javascript-sdk/packages/protect/README.md

Line 183 in a7e22ea

Alternatively, you can delay the initialization until you receive the instruction from the server by way of the `ProtectCollector`. To do this, you would call the `start` method when the collector is present in the flow. The Protect collector is returned from the server when it is configured with either a PingOne Forms connector or HTTP connector with Custom HTML Template.

cerebrl · 2025-08-06T15:02:45Z

packages/protect/README.md

+```js
+// PingOneProtectInitializeCallback methods
+callback.getConfig();
+callback.setClientError();
+```
+
+```js
+// PingOneProtectEvaluationCallback methods
+callback.setData();
+callback.setClientError();
+callback.getPauseBehavioralData();
+```


This may be a bit confusing for readers. This example block of APIs are really about this module but about the callback methods from the legacy SDK. We should probably preface this with a bit of explanation and also distinguish it from DaVinci Collectors.

What about removing this from the Full API section and moving it into a section at the bottom of the AIC quickstart with the title Protect Callback Methods. It would have some description like Relevant callback methods for PingOneProtectInitializeCallback and PingOneProtectEvaluationCallback.

We could even just remove these lines altogether since they're already covered in the quickstart.

If we already cover it in a different section, let's go with your second statement.

cerebrl · 2025-08-06T15:05:53Z

packages/protect/README.md

 ```

-The `@pingidentity/protect` module has a `protect()` function that accepts configuration options and returns a set of methods for interacting with Protect. The two main responsibilities of the Ping Protect module are the initialization of the profiling and data collection and the completion and preparation of the collected data for the server. You can find these two methods on the API returned by `protect()`.
+The `@pingidentity/protect` module has a `protect()` function that accepts configuration options and returns a set of methods for interacting with Protect. The two main responsibilities of the PingOne Protect module are the initialization of the profiling and data collection and the completion and preparation of the collected data for the server. You can find these two methods on the API returned by `protect()`.


What was the reason for converting Ping to PingOne? I also noticed the one above. PingOne specifically refers to the multi-tenant, server product, of which this module doesn't directly relate to it.

My bad, didn't know this. I can change it back everywhere. I updated it to PingOne because that is how I saw Protect being referred to everywhere in the docs. But I suppose the module isn't necessarily the same thing.
https://docs.pingidentity.com/sdks/latest/sdks/integrations/integrate-with-pingone-protect.html
https://docs.pingidentity.com/connectors/p1_protect_connector.html

Yeah, in the context of building a DaVinci flow, the Protect feature is configured and comes from the PingOne server and implemented wit that connector. But, from an SDK standpoint, PingOne itself is never directly used, and all interaction is with DaVinci.

Changed it back to just 'Ping' everywhere where it should be. Let me know if I missed one.

cerebrl · 2025-08-06T15:08:43Z

packages/protect/README.md

@@ -66,7 +91,7 @@ let data;
 if (step.getCallbacksOfType('PingOneProtectEvaluationCallback')) {
  try {


I'd like to prevent the wrapping of these methods with a try-catch. I wonder if we should at least have an internal try-catch to prevent this burden on the user.

We could add an internal try-catch to each method in our module to ensure they only return an error object instead of throwing. This does simplify the error handling section as well since we would be able to remove the try catches there too.

I think this would be good as it would help align this module more with our other modules where "throwing errors" is completely avoided.

cerebrl · 2025-08-06T15:14:31Z

packages/protect/README.md

    // Asynchronous call
-    data = await protectAPI.getData();
+    data = await protectApi.getData();
+    if (typeof data !== 'string' && 'error' in data) {


The convention I have in my head for recommended patterns is something like this (which you're very close to):

const result = api.method(); if ('error' in result) { // handle error and return early } // handle success

My intent is for all errors to have an error property, so this can be relied on across all of our modules. If this is present, they have an error, if not, they have a success.

We can do this for most of the methods except for getData because the return type is a string instead of void. If you remove the typeof data !== 'string' check then you'll get a typescript error:

Type 'string | { error: unknown; }' is not assignable to type 'object'. Type 'string' is not assignable to type 'object'.

Hmm, yeah, makes sense. I wonder if it's worth it to have a discussion around functions that return a primitive but also return errors. That would prevent the need to handle two different kinds of data types.

cerebrl · 2025-08-06T23:18:01Z

packages/protect/README.md

+
+When calling `protect()`, you have many different options to configure what and how the data is collected. The most important and required of these settings is the `envId`. All other settings are optional.
+
+The `start` method can be called at application startup, or when you receive the `ProtectCollector` from the server. We recommend you call `start` as soon as you can to collect as much data as possible for higher accuracy.


I'd like to emphasize this a bit more than this paragraph. Can we use headers for the different approaches and place "(recommended)" in the header text for startup time approach?

codecov-commenter · 2025-08-08T15:33:25Z

Codecov Report

✅ All modified and coverable lines are covered by tests.
✅ Project coverage is 57.58%. Comparing base (e393843) to head (18677d9).

Additional details and impacted files

@@           Coverage Diff           @@
##             main     #362   +/-   ##
=======================================
  Coverage   57.58%   57.58%           
=======================================
  Files          32       32           
  Lines        2044     2044           
  Branches      320      320           
=======================================
  Hits         1177     1177           
  Misses        867      867

🚀 New features to boost your workflow:

❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.

ancheetah force-pushed the SDKS-4202-update-protect branch from 3163ccd to a7e22ea Compare August 5, 2025 14:55

ancheetah marked this pull request as ready for review August 5, 2025 15:02

ancheetah requested review from cerebrl and ryanbas21 August 5, 2025 15:03

ryanbas21 approved these changes Aug 6, 2025

View reviewed changes

cerebrl requested changes Aug 6, 2025

View reviewed changes

ryanbas21 mentioned this pull request Aug 7, 2025

signals-sdk.js: uses vulnerable "ua-parser-js" version #364

Closed

ancheetah force-pushed the SDKS-4202-update-protect branch 4 times, most recently from 474b08a to f1b1830 Compare August 8, 2025 15:30

ancheetah requested a review from cerebrl August 8, 2025 15:36

ancheetah force-pushed the SDKS-4202-update-protect branch from f1b1830 to 4f19711 Compare August 8, 2025 16:48

cerebrl approved these changes Aug 11, 2025

View reviewed changes

ancheetah added 3 commits August 11, 2025 18:42

chore(protect): update signals sdk to 5.6.0

98891f9

chore(protect): update readme

47878c0

chore(protect): update protect module and tests

18677d9

ancheetah force-pushed the SDKS-4202-update-protect branch from 4f19711 to 18677d9 Compare August 11, 2025 22:48

ancheetah merged commit 19e72ce into main Aug 12, 2025
4 checks passed

ancheetah deleted the SDKS-4202-update-protect branch August 12, 2025 13:44

ryanbas21 mentioned this pull request Aug 11, 2025

Release PR #345

Merged

		@@ -66,7 +91,7 @@ let data;
		if (step.getCallbacksOfType('PingOneProtectEvaluationCallback')) {
		try {


		When calling `protect()`, you have many different options to configure what and how the data is collected. The most important and required of these settings is the `envId`. All other settings are optional.

		The `start` method can be called at application startup, or when you receive the `ProtectCollector` from the server. We recommend you call `start` as soon as you can to collect as much data as possible for higher accuracy.

Conversation

ancheetah commented Jul 31, 2025 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

JIRA Ticket

Description

Uh oh!

changeset-bot bot commented Jul 31, 2025 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

🦋 Changeset detected

Uh oh!

nx-cloud bot commented Jul 31, 2025 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

github-actions bot commented Jul 31, 2025 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

github-actions bot commented Jul 31, 2025 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

📦 Bundle Size Analysis

📦 Bundle Size Analysis

🆕 New Packages

Legend

Uh oh!

ancheetah commented Aug 5, 2025

Uh oh!

ryanbas21 left a comment

Choose a reason for hiding this comment

Uh oh!

cerebrl left a comment

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

codecov-commenter commented Aug 8, 2025 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Codecov Report

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Milestone

Development

Uh oh!

4 participants

ancheetah commented Jul 31, 2025 •

edited

Loading

changeset-bot bot commented Jul 31, 2025 •

edited

Loading

nx-cloud bot commented Jul 31, 2025 •

edited

Loading

github-actions bot commented Jul 31, 2025 •

edited

Loading

github-actions bot commented Jul 31, 2025 •

edited

Loading

codecov-commenter commented Aug 8, 2025 •

edited

Loading