Fetch the flow metadata once while the React SDK initializes

[brionmario]

Purpose

FlowMetaProvider sends the same GET /flow/meta request up to three times on every page load when the app passes an applicationId up front, as the Gate's sign-in page does. Each response is about 190 kB, and the theme and translations it carries are applied once per response.

The provider fetched every time its fetch callback was recreated. It fetches before ThunderID finishes initializing when an applicationId is known, and the callback is then recreated twice more while initialization settles: once when isInitialized turns true, and once when endpoints is replaced by the resolved configuration. None of those changes alter the request.

Approach

• The provider now remembers the last request it dispatched as a key of everything that shapes it: base URL, resolved flow meta endpoint, application ID, namespace, language, and the fetchMeta override. It fetches only when that key changes, so a language switch still refetches while identity-only changes do not.
• The key is null while the fetch would be skipped (not initialized and no applicationId), so the first request after initialization still goes out.
• The same key covers the React StrictMode re-mount that the previous reference check handled, and the SSR initialMeta seeding.
• Vue fetches once on mount and is not affected. The mobile SDKs have no equivalent provider, so no ports are needed.

Related Issues

• Fixes React SDK requests the flow metadata three times on every sign-in page load thunderid#5809

Related PRs

• N/A

Checklist

• Followed the contribution guidelines.
• Manual test round performed and verified.
• Documentation provided. (Add links if there are any)
• Tests provided. (Add links if there are any)
  • Unit Tests
  • Integration Tests
• Breaking changes. (Fill if applicable)
  • Breaking changes section filled.
  • breaking change label added.
• Cross-SDK parity. Exactly one of parity/prs-raised or parity/prs-not-needed added.
  • If parity/prs-raised, the port links are posted as a reply on the parity check's comment.

Security checks

• Followed secure coding standards.
• Confirmed that this PR doesn't commit any keys, passwords, tokens, usernames, or other secrets.

[coderabbitai]

Important

• 🔍 Trigger review

This repository does not receive automatic reviews because it has fewer than 10 stars.

⚙️ Run configuration

• Configuration used: Repository: thunder-id/javascript-sdks/.coderabbit.yaml
• Review profile: CHILL
• Plan: Advanced
• Run ID: 5f09709a-d0c3-45aa-acc1-8ca593bd3307

• Autofix · Keep fixing CodeRabbit findings and required CI, and resolving merge conflicts

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}