Merge/develop to master

[saadmoumou]

Summary

• What does this PR change?

Why

• Why is this change needed?

Checklist

• Added/updated tests (if behavior changed)
• npm run lint passes
• npm run typecheck passes
• npm test passes
• npm run build passes
• Added a changeset (npx changeset) if this affects consumers

Notes

• Anything reviewers should pay attention to?

[Copilot]

Pull request overview

This PR promotes develop → master while introducing new authentication-kit features (custom signup fields/URLs, RBAC permission helpers), expanding test coverage, and overhauling CI/release automation (lint/typecheck/coverage/Sonar, publish workflow).

Changes:

• Add/adjust Auth UI features: customizable signup fields/endpoints, custom signup URL, and improved error handling patterns.
• Add new RBAC permission helper (useCanAny) and refactor RBAC/permission components to satisfy hook rules; add extensive new tests and coverage config.
• Introduce CI workflows for PR validation (develop) and release checks (master), plus updated publish workflow and tooling (ESLint/Prettier/Vitest).

Reviewed changes

Copilot reviewed 54 out of 65 changed files in this pull request and generated 14 comments.

Show a summary per file

File	Description
vitest.config.ts	Adds V8 coverage configuration and include/exclude patterns.
tsconfig.json	Adds TS paths overrides for React modules.
tests/utils/errorHelpers.test.ts	Adds unit tests for extractHttpErrorMessage.
tests/pages/auth/authPages.test.tsx	Adds page-level tests for auth pages and callback flow.
tests/exports.test.ts	Adds smoke test for expected exports.
tests/context/RbacContext.test.tsx	Updates RBAC tests for new permission hook usage.
tests/components/SocialButton.test.tsx	Adds component tests for SocialButton.
tests/components/RequirePermissions.test.tsx	Updates permission-guard tests for new hook behavior.
tests/components/ProfilePage.test.tsx	Adds tests for profile load/edit/save flows.
src/utils/errorHelpers.ts	Tightens isAxiosError typing.
src/utils/colorHelpers.ts	Refactors Tailwind prefix typing approach.
src/utils/attachAuthInterceptor.ts	Improves typing for _retry flag on Axios config.
src/providers/AuthProvider.tsx	Reorders imports/types, tweaks auth guard typing, and adjusts bootstrap/effect patterns.
src/pages/auth/VerifyEmailPage.tsx	Removes unused Tailwind class output usage.
src/pages/auth/SignUpPage.tsx	Adds configurable signup fields/endpoint/payload transform and improves typing/error handling.
src/pages/auth/SignInPage.tsx	Adds customSignUpUrl support and improves session error initialization/typing.
src/pages/auth/ResetPasswordPage.tsx	Tightens error typing (unknown).
src/models/AuthConfig.ts	Adds config types for custom signup URL/fields/endpoint/payload transform.
src/hooks/useAbility.ts	Adds useCanAny hook.
src/context/RbacContext.ts	Refactors useGrant to call hooks unconditionally and use useCanAny.
src/components/RequirePermissions.tsx	Refactors permission checks to call hooks unconditionally and support “any” permissions.
src/components/InlineError.tsx	Reworks dismiss/auto-hide logic to avoid setState-in-effect patterns.
package.json	Updates scripts, adds formatting/lint/typecheck, upgrades tooling deps, bumps version.
eslint.config.mjs	Updates ignores and rules; adds React/TS + react-hooks rule tuning.
.prettierrc.json	Expands Prettier configuration options.
.github/workflows/release-check.yml	Adds master PR “release check” workflow (quality/test/build/Sonar).
.github/workflows/publish.yml	Changes publish trigger and adds tag/version validation + build/lint/test steps.
.github/workflows/pr-validation.yml	Adds develop PR CI workflow.
.github/workflows/ci.yml	Removes previous combined CI workflow.
.github/instructions/testing.instructions.md	Adds detailed testing guidance and standards.
.github/instructions/sonarqube_mcp.instructions.md	Adds SonarQube MCP usage guidance.
.github/instructions/general.instructions.md	Adds general module conventions/guidance.
.github/instructions/features.instructions.md	Adds feature development guidelines.
.github/instructions/copilot-instructions.md	Adds Auth Kit UI module guidelines and conventions.
.github/instructions/components.instructions.md	Adds component development standards.
.github/instructions/bugfix.instructions.md	Adds bugfix workflow guidance.
.github/dependabot.yml	Adds Dependabot configuration for npm dependencies.
.github/CODEOWNERS	Adds CODEOWNERS default ownership.
.changeset/authkit_ui_71368.md	Adds a changeset entry describing CI/tooling improvements.

Comments suppressed due to low confidence (1)

src/providers/AuthProvider.tsx:76

• GoogleOAuthCallback is defined but never used (the route renders GoogleCallbackPage instead), and this is currently being suppressed with an eslint disable. This leaves dead code and makes it unclear which callback handler is authoritative—either remove GoogleOAuthCallback or wire the route to use it.

  /* ── Google OAuth callback component (inside AuthProvider so it can touch state) ── */
  // eslint-disable-next-line @typescript-eslint/no-unused-vars
  const GoogleOAuthCallback: React.FC = () => {
    const location = useLocation();

    useEffect(() => {
      const params = new URLSearchParams(location.search);
      const tokenFromQuery = params.get('accessToken');

      if (tokenFromQuery) {
        try {
          setAccessToken(tokenFromQuery);
          setUser(decodeToken(tokenFromQuery));
          localStorage.setItem('authToken', tokenFromQuery);
          resetSessionFlag();
        } catch (e) {
          console.error("Failed to decode or store Google access token:", e);
        }
      } else {
        console.error("No accessToken found in Google OAuth callback URL.");
      }

      const redirectPath = sessionStorage.getItem('postLoginRedirect') || '/';
      sessionStorage.removeItem('postLoginRedirect');

      navigate(redirectPath, { replace: true });
    }, [location.search]);

    // No UI needed; this route just processes the tokens then redirects.
    return null;
  };

[Copilot]

This changeset declares a minor bump, but the PR also directly bumps package.json from 1.0.13 → 1.0.15 (patch). Additionally, the current publish workflow validates/publishes based on package.json + git tag, not changesets. Consider aligning on a single versioning source of truth (either apply changesets to generate the version bump, or drop the changeset if it’s not part of the release flow).

Suggested change

	---
	'@ciscode/ui-authentication-kit': minor
	---
	## Summary
	Added SonarQube MCP integration instructions for code quality analysis and automated quality gates
	## Changes
	- Updated package configuration and workflows

[Copilot]

This test overrides window.location via Object.defineProperty(...) but doesn’t restore it afterward, which can leak state into other tests in the same file/run. Capture the original window.location and restore it in an afterEach (or use a safer stubbing helper) to avoid cross-test pollution.

[Copilot]

For custom select fields, the <label> isn't associated with the <select> (no htmlFor/id and the label doesn't wrap the control). This hurts screen-reader and click-to-focus behavior. Add an id to the <select> and connect the label (and consider localizing the hardcoded "Select an option" placeholder).

Suggested change

	))}
	</select>
	</div>
	);
	}
	return (
	<InputField
	key={field.name}
	label={field.label}
	type={field.type as 'text' | 'email' | 'password' | 'number' | 'tel'}
	placeholder={field.placeholder || ''}
	color={borderClass}
	const selectId = `signup-${field.name}`;
	return (
	<div key={field.name} className="flex flex-col w-full relative">
	<label htmlFor={selectId} className="text-sm font-medium pb-2 text-gray-700">
	{field.label}
	</label>
	<select
	id={selectId}
	value={customValues[field.name]}
	onChange={(e) => setCustomValues({ ...customValues, [field.name]: e.target.value })}
	className={`flex w-full items-center px-3 py-2 text-sm justify-between shadow-sm rounded-lg border focus:border-2 bg-white ${borderClass} hover:border-gray-200 hover:shadow-md focus:outline-none focus:ring-0`}
	required={field.required}
	>
	<option value="" disabled hidden>
	{t("form.selectOptionPlaceholder", { defaultValue: "Select an option" })}
	</option>

[Copilot]

The version/tag validation only checks that the tag name exists somewhere in the repo (git rev-parse "$TAG"). If an older tag with the same name exists or the tag doesn’t point at the commit being built, this can still pass and publish an unintended version. Validate that the expected tag points at GITHUB_SHA (e.g., git tag --points-at $GITHUB_SHA).

[Copilot]

@types/react/@types/react-dom are pinned to v19, but peerDependencies allow React 18. Since this package publishes .d.ts built against these types, using React 19 types can leak React-19-only typings into the emitted declarations and break TS consumers on React 18. Consider aligning the type packages to the lowest supported React major (or narrowing the peer range).

Suggested change

	"@types/react": "^19.0.0",
	"@types/react-dom": "^19.0.0",
	"@types/react": "^18.0.0",
	"@types/react-dom": "^18.0.0",

[Copilot]

These tests use fireEvent for user interactions. The repo’s testing instructions recommend @testing-library/user-event for more realistic interaction semantics (focus/keyboard, async typing). Consider switching to userEvent for the interaction steps in this suite to better match real user behavior.

[Copilot]

This test suite uses fireEvent for interactions. Using @testing-library/user-event is recommended for more realistic behavior (e.g., it triggers focus/keyboard sequences and handles async typing). Consider migrating the interaction portions to userEvent.

[Copilot]

Publishing is now triggered on every master branch push. The repo’s release guide documents publishing being triggered by pushing a vX.Y.Z tag on master (docs/RELEASE.md:53-85). Consider reverting to a tag-based trigger (and keep master pushes as release-promotions only) to avoid accidental publishes on non-release merges.

[Copilot]

The Lint/Test steps explicitly ignore failures (... || true). Since publishing should be gated on quality checks, this is risky/unclear. Either make these steps fail the job on errors, or remove them and rely on prepublishOnly/verify to enforce checks consistently.

Suggested change

	run: npm run lint --if-present 2>/dev/null || true
	- name: Test
	run: npm test --if-present 2>/dev/null || true
	run: npm run lint --if-present
	- name: Test
	run: npm test --if-present

[Copilot]

The new dismissedForMessage logic permanently suppresses re-showing the same error string: if a message is dismissed/auto-hidden and later the same message occurs again, message === dismissedForMessage keeps it hidden. Consider resetting dismissedForMessage when message changes (or tracking a timestamp/id) so repeated identical errors can still be shown.

[sonarqubecloud]

Quality Gate passed

Issues
11 New issues
0 Accepted issues

Measures
0 Security Hotspots
0.0% Coverage on New Code
1.2% Duplication on New Code

See analysis details on SonarQube Cloud

[Copilot]

Pull request overview

Copilot reviewed 53 out of 64 changed files in this pull request and generated 9 comments.

[Copilot]

The changeset summary focuses on SonarQube MCP instructions, but this PR also includes consumer-facing auth UI/config changes (e.g., signup custom fields, new pages, RBAC hook additions). Please update the changeset to accurately describe the user-visible changes so release notes are correct.

Suggested change

	Added SonarQube MCP integration instructions for code quality analysis and automated quality gates
	## Changes
	- Updated package configuration and workflows
	- Enhanced code quality and automation tooling
	- Improved CI/CD integration and monitoring capabilities
	Added new consumer-facing authentication kit capabilities, including support for signup custom fields, new auth-related pages, and RBAC hook enhancements, alongside updates to quality automation and CI tooling.
	## Changes
	- Added support for configurable signup custom fields in the authentication UI
	- Introduced new auth-related pages and configuration updates for consumer applications
	- Added RBAC hook enhancements to support role-aware authentication flows
	- Updated package configuration, workflows, and code quality automation tooling

[Copilot]

GoogleOAuthCallback is declared but never used (eslint is suppressed). Keeping an unused in-file callback component increases maintenance burden and can confuse the intended OAuth flow (especially since routes use GoogleCallbackPage). Consider removing it, or wiring the route to use it instead of suppressing the lint warning.

[Copilot]

This effect calls navigate(redirectPath, ...), but navigate is not included in the dependency array. With hooks linting enabled in the repo, this will raise an exhaustive-deps warning; include navigate (or otherwise avoid capturing it) to keep the effect safe and lint-clean.

[Copilot]

After a successful refresh, the retry uses api.request(original) but the request interceptor still reads opts.getAccessToken(). If getAccessToken is backed by React state (as in AuthProvider), it can still return the old token here, causing the retried request(s) to be sent with a stale Authorization header and fail. Consider keeping a mutable token reference inside the interceptor (update it on refresh) and/or ensuring the retry request bypasses/doesn’t overwrite the refreshed header.

[Copilot]

This repo’s release guide uses Changesets for versioning; directly bumping package.json here (while also adding a new .changeset/* file) is inconsistent and can lead to double-versioning. Prefer keeping only the changeset in feature PRs and letting changeset version (or the repo’s versioning step) update package.json during the release prep.

[Copilot]

dismissedForMessage is never reset when message becomes null or when the same message occurs again later. As a result, if the same error string is shown twice, the second occurrence will stay hidden. Consider resetting dismissedForMessage when message changes (or tracking dismissal per-render rather than per-message string).

[Copilot]

useCanAny was added and is now used internally (RBAC/RequirePermissions), but it’s not exported from the package entry (src/main/app.ts) alongside useCan/useHasRole. If this hook is part of the intended public API, export it here to keep the ability-hook surface consistent.

Suggested change

	export { useHasRole, useHasModule, useCan } from '../hooks/useAbility';
	export { useHasRole, useHasModule, useCan, useCanAny } from '../hooks/useAbility';

[Copilot]

When color is a hex value (e.g. #FF9900), this returns the raw hex string, but the JSDoc/examples indicate it should return a valid Tailwind class (e.g. bg-[#FF9900]). This will produce invalid classNames for hex themes; consider returning ${prefix}-[${color}] (and similarly for other prefixes).

[Copilot]

Test description says “when useCan returns true”, but the mocked hook used here is useCanAny. Updating the test name will keep intent clear and avoid confusion when reading failures.