fix: registration hook type (#3975)

shuowu-okta · web-flow · commit 5d61062f28ac · 2026-03-10T15:10:19.000Z
OKTA-720583 fix: registration hook type

retirejs ignorefile update

fix release-update script
diff --git a/.retireignore.json b/.retireignore.json
@@ -4,6 +4,11 @@
     "version": "1.12.4",
     "justification": "CVE issues (CVE-2019-11358, CVE-2020-11023) have been mitigated with a patched version of jQuery (packages/@okta/courage-dist/esm/src/courage/vendor/lib/jquery-1.12.4.js)"
   },
+  {
+    "component": "underscore.js",
+    "version": "1.13.1",
+    "justification": "CVE-2026-27601: _.flatten and _.isEqual DoS via unbounded recursion. Mitigated - the widget does not pass untrusted external input to these functions. Upstream fix requires rebuilding courage-dist with underscore 1.13.8."
+  },
   {
     "component": "dompurify",
     "version": "2.5.8",
diff --git a/package.json b/package.json
@@ -263,7 +263,7 @@
     "parse-ms": "^2.0.0",
     "q": "1.4.1",
     "u2f-api-polyfill": "0.4.3",
-    "underscore": "1.13.1"
+    "underscore": "1.13.8"
   },
   "optionalDependencies": {
     "fsevents": "*"
@@ -286,7 +286,8 @@
     "**/testcafe-hammerhead/tough-cookie": "^4.1.4",
     "stylis": "^4.3.0",
     "**/debug": "^4.3.4",
-    "**/mout": "^1.2.4"
+    "**/mout": "^1.2.4",
+    "underscore": "1.13.8"
   },
   "workspaces": {
     "packages": [
diff --git a/scripts/release-update.sh b/scripts/release-update.sh
@@ -19,6 +19,7 @@ if ! npm install -g yarn@1.22.19; then
 fi
 
 export PATH="$PATH:$(npm config get prefix)/bin"
+export PATH="$PATH:$(yarn global bin)"
 
 # get latest
 git fetch origin && \
diff --git a/src/types/registration.ts b/src/types/registration.ts
@@ -1,4 +1,4 @@
-import { APIError } from '@okta/okta-auth-js';
+import { APIError, Input } from '@okta/okta-auth-js';
 import {
   SimpleCallback
 } from './results';
@@ -88,6 +88,24 @@ export type Field =
   FieldBoolean |
   FieldArray;
 
+/**
+ * Schema element used in OIE (Identity Engine) registration flows.
+ * In OIE mode, the parseSchema callback receives an array of these elements
+ * rather than a single RegistrationSchema object.
+ *
+ * This type extends the Input type from @okta/okta-auth-js, which represents
+ * an IDX remediation input field. At runtime, the widget converts Input[]
+ * into RegistrationElementSchema[] by spreading each Input and adding
+ * UI-specific properties ('label-top', 'data-se', 'wide', etc.).
+ */
+export interface RegistrationElementSchema extends Input {
+  'label-top'?: boolean;
+  placeholder?: string;
+  'data-se'?: string;
+  sublabel?: string;
+  wide?: boolean;
+}
+
 export interface RegistrationSchema {
   lastUpdate: number;
   policyId: string;
@@ -106,14 +124,14 @@ export interface RegistrationData {
   [key: string]: FieldValue;
 }
 
-export type RegistrationSchemaCallback = (schema: RegistrationSchema) => void;
+export type RegistrationSchemaCallback = (schema: RegistrationSchema | RegistrationElementSchema[]) => void;
 export type RegistrationDataCallback = (data: RegistrationData) => void;
 export type RegistrationPostSubmitCallback = (response: string) => void;
 export type RegistrationErrorCallback = (error: APIError) => void
 export interface RegistrationOptions {
   click?: SimpleCallback;
   parseSchema?: (
-    schema: RegistrationSchema,
+    schema: RegistrationSchema | RegistrationElementSchema[],
     onSuccess: RegistrationSchemaCallback,
     onFailure: RegistrationErrorCallback
   ) => void;
diff --git a/test/types/options.test-d.ts b/test/types/options.test-d.ts
@@ -1,6 +1,5 @@
 import OktaSignIn, {
   FieldStringWithFormatAndEnum,
-  RegistrationSchema,
   RegistrationData,
   RegistrationSchemaCallback,
   RegistrationDataCallback,
@@ -113,25 +112,32 @@ const signIn2 = new OktaSignIn({
     click: () => {
       window.location.href = 'https://acme.com/sign-up';
     },
-    parseSchema: (schema: RegistrationSchema, onSuccess: RegistrationSchemaCallback, _onFailure: RegistrationErrorCallback) => {
-      schema.profileSchema.properties.address = {
-        type: 'string',
-        description: 'Street Address',
-        default: 'Enter your street address',
-        maxLength: 255
-      };
-      const countryCode: FieldStringWithFormatAndEnum = {
-        type: 'country_code',
-        enum: ['US', 'CA'],
-        oneOf: [
-          {title: 'Canada', const: 'CA'},
-          {title: 'United States', const: 'US'},
-        ]
-      };
-      schema.profileSchema.properties['country_code'] = countryCode;
-      schema.profileSchema.fieldOrder.push('address');
-      schema.profileSchema.required.push('country_code');
-      onSuccess(schema);
+    parseSchema: (schema, onSuccess: RegistrationSchemaCallback, _onFailure: RegistrationErrorCallback) => {
+      // Classic (V1) path: schema is RegistrationSchema object
+      if (!Array.isArray(schema)) {
+        schema.profileSchema.properties.address = {
+          type: 'string',
+          description: 'Street Address',
+          default: 'Enter your street address',
+          maxLength: 255
+        };
+        const countryCode: FieldStringWithFormatAndEnum = {
+          type: 'country_code',
+          enum: ['US', 'CA'],
+          oneOf: [
+            {title: 'Canada', const: 'CA'},
+            {title: 'United States', const: 'US'},
+          ]
+        };
+        schema.profileSchema.properties['country_code'] = countryCode;
+        schema.profileSchema.fieldOrder.push('address');
+        schema.profileSchema.required.push('country_code');
+        onSuccess(schema);
+      } else {
+        // OIE (V2/V3) path: schema is RegistrationElementSchema[]
+        schema.push({ name: 'address', label: 'Street Address' });
+        onSuccess(schema);
+      }
     },
     preSubmit: (postData: RegistrationData, onSuccess: RegistrationDataCallback, onFailure: RegistrationErrorCallback) => {
       const username = <string> postData.username;
diff --git a/test/types/registration.test-d.ts b/test/types/registration.test-d.ts
@@ -1,7 +1,6 @@
 /* eslint-disable @typescript-eslint/no-unused-vars */
 import OktaSignIn, {
   FieldStringWithFormatAndEnum,
-  RegistrationSchema,
   RegistrationData,
   RegistrationSchemaCallback,
   RegistrationDataCallback,
@@ -19,25 +18,32 @@ const signIn = new OktaSignIn({
     click: () => {
       window.location.href = 'https://acme.com/sign-up';
     },
-    parseSchema: (schema: RegistrationSchema, onSuccess: RegistrationSchemaCallback, _onFailure: RegistrationErrorCallback) => {
-      schema.profileSchema.properties.address = {
-        type: 'string',
-        description: 'Street Address',
-        default: 'Enter your street address',
-        maxLength: 255
-      };
-      const countryCode: FieldStringWithFormatAndEnum = {
-        type: 'country_code',
-        enum: ['US', 'CA'],
-        oneOf: [
-          {title: 'Canada', const: 'CA'},
-          {title: 'United States', const: 'US'},
-        ]
-      };
-      schema.profileSchema.properties['country_code'] = countryCode;
-      schema.profileSchema.fieldOrder.push('address');
-      schema.profileSchema.required.push('country_code');
-      onSuccess(schema);
+    parseSchema: (schema, onSuccess: RegistrationSchemaCallback, _onFailure: RegistrationErrorCallback) => {
+      // Classic (V1) path: schema is RegistrationSchema object
+      if (!Array.isArray(schema)) {
+        schema.profileSchema.properties.address = {
+          type: 'string',
+          description: 'Street Address',
+          default: 'Enter your street address',
+          maxLength: 255
+        };
+        const countryCode: FieldStringWithFormatAndEnum = {
+          type: 'country_code',
+          enum: ['US', 'CA'],
+          oneOf: [
+            {title: 'Canada', const: 'CA'},
+            {title: 'United States', const: 'US'},
+          ]
+        };
+        schema.profileSchema.properties['country_code'] = countryCode;
+        schema.profileSchema.fieldOrder.push('address');
+        schema.profileSchema.required.push('country_code');
+        onSuccess(schema);
+      } else {
+        // OIE (V2/V3) path: schema is RegistrationElementSchema[]
+        schema.push({ name: 'address', label: 'Street Address' });
+        onSuccess(schema);
+      }
     },
     preSubmit: (postData: RegistrationData, onSuccess: RegistrationDataCallback, onFailure: RegistrationErrorCallback) => {
       const username = <string> postData.username;
@@ -65,3 +71,21 @@ const signIn = new OktaSignIn({
   },
 });
 expectType<OktaSignIn>(signIn);
+
+// Test OIE registration with RegistrationElementSchema[]
+const signInOIE = new OktaSignIn({
+  baseUrl: 'https://{yourOktaDomain}',
+  registration: {
+    parseSchema: (schema, onSuccess: RegistrationSchemaCallback, _onFailure: RegistrationErrorCallback) => {
+      // OIE path: schema is RegistrationElementSchema[]
+      if (Array.isArray(schema)) {
+        schema.push({ name: 'address', label: 'Street Address' });
+        onSuccess(schema);
+      }
+    },
+    preSubmit: (postData: RegistrationData, onSuccess: RegistrationDataCallback, _onFailure: RegistrationErrorCallback) => {
+      onSuccess(postData);
+    },
+  },
+});
+expectType<OktaSignIn>(signInOIE);
diff --git a/yarn.lock b/yarn.lock
@@ -20777,15 +20777,10 @@ underscore.string@~3.3.5:
     sprintf-js "^1.1.1"
     util-deprecate "^1.0.2"
 
-underscore@1.13.1:
-  version "1.13.1"
-  resolved "https://registry.yarnpkg.com/underscore/-/underscore-1.13.1.tgz#0c1c6bd2df54b6b69f2314066d65b6cde6fcf9d1"
-  integrity sha512-hzSoAVtJF+3ZtiFX0VgfFPHEDRm7Y/QPjGyNo4TVdnDTdft3tr8hEkD25a1jC+TjTuE7tkHGKkhwCgs9dgBB2g==
-
-underscore@~1.12.1:
-  version "1.12.1"
-  resolved "https://registry.npmjs.org/underscore/-/underscore-1.12.1.tgz#7bb8cc9b3d397e201cf8553336d262544ead829e"
-  integrity sha512-hEQt0+ZLDVUMhebKxL4x1BTtDY7bavVofhZ9KZ4aI26X9SRaE+Y3m83XUL1UP2jn8ynjndwCCpEHdUG+9pP1Tw==
+underscore@1.13.8, underscore@~1.12.1:
+  version "1.13.8"
+  resolved "https://registry.npmjs.org/underscore/-/underscore-1.13.8.tgz#a93a21186c049dbf0e847496dba72b7bd8c1e92b"
+  integrity sha512-DXtD3ZtEQzc7M8m4cXotyHR+FAS18C64asBYY5vqZexfYryNNnDc02W4hKg3rdQuqOYas1jkseX0+nZXjTXnvQ==
 
 undici-types@~5.26.4:
   version "5.26.5"
