Enable credential reordering via Account REST - #51257
Open
jganczorz-revolve wants to merge 1 commit into
Open
Conversation
Uncomment and modernize the moveToFirst/moveCredentialAfter endpoints in AccountCredentialResource, mirroring the existing admin UserResource endpoints, so users with manage-account can reorder their own credentials without administrator involvement. Closes keycloak#41160 Signed-off-by: Jakub Gańczorz <jakub.ganczorz@revolve.pro>
Contributor
There was a problem hiding this comment.
Pull request overview
Enables users with manage-account to reorder their own credentials through Account REST.
Changes:
- Adds credential reordering endpoints with authorization and ownership validation.
- Adds tests for ordering, invalid credentials, authorization, and cross-user access.
Reviewed changes
Copilot reviewed 2 out of 2 changed files in this pull request and generated no comments.
| File | Description |
|---|---|
services/.../AccountCredentialResource.java |
Implements Account REST credential reordering. |
tests/.../AccountRestServiceTest.java |
Covers successful moves and failure scenarios. |
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
Enables users to reorder their own credentials via the Account REST API. Previously, changing credential priority (e.g. moving a passkey ahead of OTP) required an administrator to do it through the admin console or admin REST API, even for users who already hold
manage-account. The endpoints existed but were commented out inAccountCredentialResourcewith a// TODO: This is kept here for now and commented.note, calling aUserCredentialManagerAPI that no longer exists.This uncomments and modernises them, mirroring the existing admin equivalents in
UserResource.Changes
AccountCredentialResource: addedPOST /realms/{realm}/account/credentials/{credentialId}/moveToFirstPOST /realms/{realm}/account/credentials/{credentialId}/moveAfter/{newPreviousCredentialId}Both require
manage-account(auth.require(AccountRoles.MANAGE_ACCOUNT), same as the siblinglabel/DELETEendpoints). Unlike the admin version, both the credential being moved andnewPreviousCredentialIdare validated up front and return 404 if unknown — the admin endpoint silently discards the move when the "previous" id doesn't exist, which would be a confusing no-op behind a 204 for a brand-new endpoint. No event is fired, consistent with the admin move endpoints and the accountsetLabelendpoint.AccountRestServiceTest: addedtestMoveCredentials(reordering across three credentials, including a self-move no-op),testMoveCredentialWithUnknownPreviousCredential(404),testMoveCredentialRequiresManageAccount(403), and extendedtestCRUDCredentialOfDifferentUserwith 404 checks for moving another user's credential.Test plan
./mvnw -pl tests/base test -Dtest=AccountRestServiceTest— 60/60 passing./mvnw -pl tests/base test -Dtest=AccountRestServiceLightweightTokenTest— 60/60 passing (lightweight-token variant)./mvnw -pl tests/base test -Dtest=UserCredentialTest(admin-side credential reordering) — 11/11 passing, no regressions./mvnw spotless:check -pl services,tests/base— cleanNo OpenAPI/documentation changes: the Account REST API isn't part of the OpenAPI generation pipeline (
scanProfiles=admininservices/pom.xml), and none of the existing account credential endpoints carry OpenAPI annotations either.Closes #41160
This PR was implemented with the assistance of an AI coding agent (Claude Code), which drafted the endpoint implementation and tests from a prompt describing the issue. I have reviewed the change, understand it, and verified it against the existing admin implementation and the test suite.