[Bug-fix] Fix stale challenge token on redirection

[NutharaNR]

Purpose

Fixes: thunder-id/thunderid#3956

Approach

Related Issues

• [Bug][SDK] Challenge token is not properly updated in sign up flows after redirection thunderid#3956

Related PRs

• N/A

Checklist

• Followed the contribution guidelines.
• Manual test round performed and verified.
• Documentation provided. (Add links if there are any)
• Tests provided. (Add links if there are any)
  • Unit Tests
  • Integration Tests
• Breaking changes. (Fill if applicable)
  • Breaking changes section filled.
  • breaking change label added.

Security checks

• Followed secure coding standards in WSO2 Secure Coding Guidelines
• Confirmed that this PR doesn't commit any keys, passwords, tokens, usernames, or other secrets.

Summary by CodeRabbit

• Bug Fixes
  • Improved OAuth sign-up flow handling by preserving the challenge token returned after authentication.
  • Helps ensure sign-up continues reliably when authentication completes through a popup or redirect.

[coderabbitai]

No actionable comments were generated in the recent review. 🎉

ℹ️ Recent review info

⚙️ Run configuration

Configuration used: Path: .coderabbit.yaml

Review profile: CHILL

Plan: Pro Plus

Run ID: d3eb8bad-6293-4374-8847-08aaa9f237dc

📥 Commits

Reviewing files that changed from the base of the PR and between 0b37b6d and 3ccf538.

📒 Files selected for processing (1)

• packages/react/src/components/presentation/auth/SignUp/BaseSignUp.tsx

---

📝 Walkthrough

Walkthrough

OAuth sign-up callback handling now persists the returned challenge token before continuing flow processing in both popup message and popup URL polling paths.

Changes

OAuth sign-up continuation

Layer / File(s)	Summary
Persist challenge tokens across OAuth callbacks packages/react/src/components/presentation/auth/SignUp/BaseSignUp.tsx	Both OAuth callback paths await setChallengeToken with the returned token before calling onFlowChange and handling status.

Estimated code review effort: 1 (Trivial) | ~5 minutes

🚥 Pre-merge checks | ✅ 4 | ❌ 1

❌ Failed checks (1 warning)

Check name	Status	Explanation	Resolution
Description check	⚠️ Warning	The template is present, but the Approach section and checklist/security details are still placeholders, so the description is incomplete.	Add a real Approach summary and complete the checklist/security sections with any testing, documentation, and breaking-change details that apply.

✅ Passed checks (4 passed)

Check name	Status	Explanation
Title check	✅ Passed	The title accurately summarizes the main fix: refreshing a stale challenge token during redirection.
Linked Issues check	✅ Passed	The code update persists the refreshed challengeToken after OAuth callback in both popup paths, matching issue #3956's stale-token fix.
Out of Scope Changes check	✅ Passed	No unrelated code changes are evident; the edit is a targeted two-line fix in the sign-up callback flow.
Docstring Coverage	✅ Passed	No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check.

✨ Finishing Touches

🧪 Generate unit tests (beta)

• Create PR with unit tests

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}