Let users verify their email address and mobile number from their account by PasinduYeshan · Pull Request #39 · thunder-id/ios-sdks

PasinduYeshan · 2026-10-29T17:00:41Z

Purpose

Lets a signed-in user verify their own email address or mobile number from their account, using the server's SELF_SERVICE attribute verification flow (thunder-id/thunderid#6050).

Client: verifyAttribute starts the flow by handle (default default-self-attribute-verification-flow) with the user's token, and a payload variant continues it. A refused step surfaces as a verification error.
UserProfile exposes verifiedAttributes from /users/me.
SwiftUI VerifyAttribute and BaseVerifyAttribute render each step from the flow response, with a custom render through content. UserProfile shows each contact's verification status and offers Verify for an unverified one, including right after the user changes it.
Verification strings in every shipped locale, a capability check and playground stories with a Custom rendering variant.

Approach

Follows the specification in thunder-id/thunderid#5905 and matches the JavaScript port (thunder-id/javascript-sdks#145). Verification posts to /flow/execute through the shared HTTP client, like the other flows. A flow is started once per showing, since a start sends a message; overlapping submits are ignored; failures show a translated generic message.

Related Issues

Related PRs

Checklist

SDK parity

javascript-sdks: Let users verify their email address and mobile number from their account javascript-sdks#145
android-sdks: Let users verify their email address and mobile number from their account android-sdks#47
flutter-sdks: Let users verify their email address and mobile number from their account flutter-sdks#60 (draft until this SDK is released)

Security checks

Followed secure coding standards.
Confirmed that this PR doesn't commit any keys, passwords, tokens, usernames, or other secrets.

🤖 Generated with Claude Code

Summary by CodeRabbit

New Features
- Added email and mobile attribute verification for signed-in users, including code entry, resend, link confirmation, and completion states.
- Profile screens now show verification status and offer verification when available. Email verification can begin after a successful profile update.
- Added customizable verification views and Playground examples for standard and custom presentations.
Documentation
- Updated Playground guidance to include attribute verification among available checks and clarify that interactive checks run when tapped.

…ount Signed-off-by: Pasindu Yeshan <pasinduyeshan98@gmail.com>

coderabbitai · 2026-10-29T17:00:52Z

Walkthrough

The SDK adds self-service attribute verification for email and mobile attributes. SwiftUI components provide verification flows and profile status. The Playground adds checks and examples for the feature.

Changes: Attribute verification SDK and flow

Layer / File(s)	Summary
Verification contracts and SDK transport `Sources/ThunderID/AttributeVerification.swift`, `Sources/ThunderID/Models.swift`, `Sources/ThunderID/ThunderIDClient+Verification.swift`, `Sources/ThunderID/auth/FlowExecutionClient.swift`, `Sources/ThunderID/http/HTTPClient.swift`, `Sources/ThunderID/ThunderIDError.swift`, `Sources/ThunderID/ThunderIDClient.swift`, `Tests/ThunderIDTests/VerifyAttributeTests.swift`	The SDK adds verification metadata and eligibility rules, self-service start and continuation requests, and response error mapping. Tests cover request payloads, authentication, errors, and decoding.
Verification flow state and rendering `Sources/ThunderIDSwiftUI/components/account/BaseVerifyAttribute.swift`, `Sources/ThunderIDSwiftUI/components/account/VerifyAttribute.swift`, `Sources/ThunderIDSwiftUI/i18n/DefaultStrings.swift`, `Tests/ThunderIDSwiftUITests/components/account/VerifyAttributeStateTests.swift`	The SwiftUI components load the attribute schema, manage flow steps and callbacks, and render verification forms. Tests cover startup, submissions, resend, completion, and errors.
Profile verification and save integration `Sources/ThunderIDSwiftUI/components/account/BaseUserProfile.swift`, `Sources/ThunderIDSwiftUI/components/account/UserProfile.swift`, `Tests/ThunderIDSwiftUITests/components/account/UserProfileVerificationTests.swift`, `Tests/ThunderIDSwiftUITests/components/account/VerificationFollowsStoredValueTests.swift`	Profile views show available verification status and offer a Verify action when eligible. A changed email can open verification after a successful save when the returned profile reports it as unverified.
Playground checks and examples `Playground/README.md`, `Playground/Sources/Capability.swift`, `Playground/Sources/CapabilityChecks.swift`, `Playground/Sources/CustomRenderCatalog.swift`, `Playground/Sources/CustomRenderPreview.swift`, `Playground/Sources/ExplorerCatalog.swift`, `Playground/Sources/ExplorerPreview.swift`	The Playground adds an attribute-verification check, Explorer and custom-render stories, and documentation of the interactive check.

Priority: Normal

Estimated code review effort: 4 (Complex) | ~45 minutes

Change: Feature

Sequence Diagram(s)

sequenceDiagram
  participant User
  participant UserProfile
  participant VerifyAttribute
  participant ThunderIDClient
  participant ProfileAPI
  User->>UserProfile: Select Verify for an eligible field
  UserProfile->>VerifyAttribute: Present verification for the field
  VerifyAttribute->>ThunderIDClient: Start or continue verification
  ThunderIDClient-->>VerifyAttribute: Return flow step
  VerifyAttribute->>ThunderIDClient: Submit action or resend
  ThunderIDClient-->>VerifyAttribute: Return updated flow step
  VerifyAttribute->>ProfileAPI: Read profile after completion
  ProfileAPI-->>VerifyAttribute: Return updated profile
  VerifyAttribute-->>UserProfile: Apply refreshed profile and close sheet

Suggested labels: enhancement

Suggested reviewers: brionmario, janithjay

Merge Risk: Minimal · up to 8db1d

The account verification change is ready to merge after normal checks.

Pre-merge checks: 4 · 1

Failed checks: 1 warning

Check name	Status	Explanation	Resolution
Docstring Coverage		Docstring coverage is 39.22% which is insufficient. The required threshold is 80.00%. Docstring coverage is scoped to functions touched by this diff with cyclomatic complexity of at least 2. Documenta…	Write docstrings for the functions missing them to satisfy the coverage threshold.

Passed checks: 4 passed

Check name	Status	Explanation
Title check		The title states the main change: signed-in users can verify their email address and mobile number from their account. The changeset adds the self-service attribute verification flow (client `verifyAt…
Linked Issues check		Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check		Check skipped because no linked issues were found for this pull request.
Description check		The description is complete and relevant. It includes the purpose, implementation approach, related issues and pull requests, testing details, security checks, SDK parity references, and checklist sta…

Full details: Title check

Explanation

The title states the main change: signed-in users can verify their email address and mobile number from their account. The changeset adds the self-service attribute verification flow (client verifyAttribute, VerifyAttribute and BaseVerifyAttribute SwiftUI components, UserProfile verification status, and verifiedAttributes on UserProfile), which matches this title.

Full details: Description check

Explanation

The description is complete and relevant. It includes the purpose, implementation approach, related issues and pull requests, testing details, security checks, SDK parity references, and checklist status. Documentation and the required parity label remain unchecked, but these are non-critical omissions because the PR includes documentation changes and lists parity pull requests.

Full details: Docstring Coverage

Explanation

Docstring coverage is 39.22% which is insufficient. The required threshold is 80.00%. Docstring coverage is scoped to functions touched by this diff with cyclomatic complexity of at least 2. Documentation-only edits and deletions within surviving functions are included; unchanged diff context and fully deleted functions are excluded. Analyzed 51 functions across 22 files. (1 skipped: 1 unsupported.)

Resolution

Write docstrings for the functions missing them to satisfy the coverage threshold.

Finishing Touches: 💡 1

🛠️ Fix failing CI checks: 💡

Commit to this branch
Create a new PR

🧪 Generate unit tests (beta)

Create a new PR

Autofix · Keep fixing CodeRabbit findings and required CI, and resolving merge conflicts

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

_{Comment @coderabbitai help to get the list of available commands.}

github-actions · 2026-10-29T17:00:53Z

🔀 Cross-SDK feature parity, ports raised

This pull request is labelled parity/prs-raised, so the capability it introduces is expected in the other ThunderID SDKs as well.

Ports (DO NOT EDIT)

thunder-id/javascript-sdks, JavaScript (React, Vue, Nuxt, Next.js, Express, React Router, TanStack Router, Browser, Node) => #145
thunder-id/android-sdks, Android => #47
thunder-id/flutter-sdks, Flutter => #60

3 of 3 sibling SDKs accounted for.

Every sibling SDK is accounted for.

The contract is in the SDK development specification.

Signed-off-by: Pasindu Yeshan <pasinduyeshan98@gmail.com>

PasinduYeshan · 2026-10-30T03:04:14Z

@coderabbitai review.

coderabbitai · 2026-10-30T03:04:35Z

@PasinduYeshan I’ll review the changes in this PR.

✅ Action performed

Review finished.

Note: CodeRabbit is an incremental review system and does not re-review already reviewed commits. This command is applicable only when automatic reviews are paused.

PasinduYeshan · 2026-10-30T04:28:20Z

iOS verification workaround: The existing iOS SDK sign-in paths have two issues:

App-native sign-in stores the assertion as an access token, resulting in 401 errors. Related: [#5421](Improve the authorization experience for native mobile clients thunderid#5421).
Browser sign-in sends JSON instead of form-encoded token requests, resulting in 400 errors.

For verification only, I temporarily added a Proof sign-in button to the Playground to complete the authorization code + PKCE flow and store valid tokens. The verification feature was then tested against the unchanged SDK.

The workaround was removed and is not included in this PR.

iOS Verification Screenshots

Unverified profile	Invalid verification code

Mobile verified	Both attributes verified

Let users verify their email address and mobile number from their acc…

9bdbf0d

…ount Signed-off-by: Pasindu Yeshan <pasinduyeshan98@gmail.com>

Read only the verification suite's own requests in its tests

8db1ddf

Signed-off-by: Pasindu Yeshan <pasinduyeshan98@gmail.com>

PasinduYeshan added the parity/prs-raised Ports exist in the other SDKs, or are recorded as not applying there label Oct 30, 2026

PasinduYeshan mentioned this pull request Oct 30, 2026

Support Self-Service User Attribute Verification Across ThunderID SDKs thunder-id/thunderid#6230

Open

Navigation Menu

Repository navigation

Let users verify their email address and mobile number from their account - #39

Let users verify their email address and mobile number from their account#39
PasinduYeshan wants to merge 2 commits into
thunder-id:mainfrom
PasinduYeshan:self-attribute-verification

PasinduYeshan commented Oct 29, 2026 •

edited

Loading

Uh oh!

coderabbitai Bot commented Oct 29, 2026 •

edited

Loading

Sequence Diagram(s)

Uh oh!

github-actions Bot commented Oct 29, 2026 •

edited

Loading

Uh oh!

PasinduYeshan commented Oct 30, 2026

Uh oh!

coderabbitai Bot commented Oct 30, 2026 •

edited

Loading

Uh oh!

PasinduYeshan commented Oct 30, 2026 •

edited

Loading

Uh oh!

Reviewers

Uh oh!

Assignees

Labels

Projects

Milestone

Development

Uh oh!

1 participant

Conversation

PasinduYeshan commented Oct 29, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Purpose

Approach

Related Issues

Related PRs

Checklist

SDK parity

Security checks

Summary by CodeRabbit

Uh oh!

coderabbitai Bot commented Oct 29, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Sequence Diagram(s)

Uh oh!

github-actions Bot commented Oct 29, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

🔀 Cross-SDK feature parity, ports raised

Ports (DO NOT EDIT)

Uh oh!

PasinduYeshan commented Oct 30, 2026

Uh oh!

coderabbitai Bot commented Oct 30, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

PasinduYeshan commented Oct 30, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

iOS Verification Screenshots

Uh oh!

Reviewers

Uh oh!

Assignees

Labels

Projects

Milestone

Development

Uh oh!

1 participant

PasinduYeshan commented Oct 29, 2026 •

edited

Loading

coderabbitai Bot commented Oct 29, 2026 •

edited

Loading

github-actions Bot commented Oct 29, 2026 •

edited

Loading

coderabbitai Bot commented Oct 30, 2026 •

edited

Loading

PasinduYeshan commented Oct 30, 2026 •

edited

Loading