Prevent future dates for Date of Birth in registration and user profile forms by RushanNanayakkara · Pull Request #10558 · wso2/identity-apps

RushanNanayakkara · 2026-07-22T05:45:03Z

Purpose

The Date of Birth (http://wso2.org/claims/dob) attribute accepts a future date during self-registration and during admin user creation/editing, but the My Account profile page rejects future dates. This inconsistency lets invalid DOB values (for example 2027-04-20) be stored, while the same value is blocked when the user later edits their profile in My Account.

This PR makes the Date of Birth validation consistent across all end-user and admin UIs by rejecting:

Values that match the YYYY-MM-DD pattern but are not real calendar dates (for example 2025-02-30).
Future dates.

Changes

Classic self-registration page — identity-apps-core/apps/recovery-portal/.../self-registration-username-request.jsp
- showDateOfBirthValidationStatus() now checks, after the existing format regex, that the value is an existing calendar date and is not in the future.
- Added the i18n key dob.cannot.be.future.date to the base resource bundle.
Dynamic registration flow date field — identity-apps-core/react-ui-core
- Rather than special-casing the DOB claim URI, use-field-validations.js gained a generic DateValidator rule case (real-date + disallow.future conditions), with a matching label in validation-criteria.js and shared date helpers in validation-utils.js.
- date-field-adapter.js no longer knows about DOB at all — it derives maxDate and dateFormat from whichever DateValidator rule the field's validations config carries, so the calendar and inline error activate for any date claim configured this way, not just DOB.
- This only activates when the server actually attaches a DateValidator rule to the field, which is what the companion carbon-identity-framework change does for the DOB claim (see Related PRs).
Console user management — features/admin.users.v1/...
- form-field-renderer.tsx: added a dedicated DOB validator (required → regex → strict date parse → future check) used by both the text and date-picker branches. The DOB branch previously used the generic validator despite a comment claiming a special one.
- legacy-user-profile-form.tsx and wizard/steps/legacy-add-user-basic.tsx: extended the DOB validation callbacks with the strict-parse and future-date checks.
- Hardened strict date parsing with the dayjs/plugin/customParseFormat plugin so impossible dates are rejected.

Related PRs

Backend enforcement (all create/update paths): Reject non-existing and future dates for the Date of Birth claim wso2-extensions/identity-inbound-provisioning-scim2#800
Dynamic-flow server-side rule authoring, needed for the inline error on the dynamic registration flow's date field: Emit DateValidator client rule for date claims that disallow future values carbon-identity-framework#8212

Testing

ESLint clean on the changed lines (pre-existing warnings only).
The self-registration JSP validation was exercised against the real rendered page in jsdom across 11 cases: the reported 2027-04-20, tomorrow, today (allowed), valid/invalid leap days, impossible dates, and wrong-order formats — all behave as expected.

coderabbitai · 2026-07-22T05:45:28Z

No actionable comments were generated in the recent review. 🎉

ℹ️ Recent review info

⚙️ Run configuration

Configuration used: Path: .coderabbit.yml

Review profile: CHILL

Plan: Pro Plus

Run ID: 1622f1f1-14a0-4ba2-a965-3c575f16624e

📥 Commits

Reviewing files that changed from the base of the PR and between 7ca047b and 71fb43e.

📒 Files selected for processing (1)

identity-apps-core/react-ui-core/src/utils/validation-utils.js

🚧 Files skipped from review as they are similar to previous changes (1)

identity-apps-core/react-ui-core/src/utils/validation-utils.js

📝 Walkthrough

Walkthrough

Changes

The pull request adds strict YYYY-MM-DD and future-date validation for Date of Birth fields across shared React inputs, Console profile and add-user forms, and the self-registration page. It also adds a translation entry and Changeset metadata.

Date of Birth validation

Layer / File(s)	Summary
Shared DOB validation `identity-apps-core/react-ui-core/src/components/...`, `identity-apps-core/react-ui-core/src/hooks/use-field-validations.js`, `identity-apps-core/react-ui-core/src/utils/validation-utils.js`	Shared validation utilities and field components validate ISO dates, reject future dates when configured, and apply matching date-input constraints and labels.
Console profile and add-user validation `features/admin.users.v1/components/user-profile/...`, `features/admin.users.v1/components/wizard/steps/legacy-add-user-basic.tsx`	Console DOB validators use strict Day.js parsing and reject future dates across profile, date-picker, legacy profile, and add-user flows.
Self-registration validation and release metadata `identity-apps-core/apps/recovery-portal/src/main/webapp/self-registration-username-request.jsp`, `identity-apps-core/apps/recovery-portal/src/main/resources/.../Resources.properties`, `.changeset/tidy-months-tell.md`	Self-registration rejects invalid calendar and future dates, adds the future-date translation, and records patch releases for the affected packages.

Suggested reviewers: pavindulakshan

🚥 Pre-merge checks | ✅ 6

✅ Passed checks (6 passed)

Check name	Status	Explanation
Title check	✅ Passed	The title clearly matches the PR's main change: blocking future DOB dates in registration and profile forms.
Description check	✅ Passed	Covers purpose, changes, related PRs, and testing, but omits the template's checklist, security, and developer checklist sections.
Docstring Coverage	✅ Passed	No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check.
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Changeset Required	✅ Passed	The PR chain adds .changeset/tidy-months-tell.md, and it lists `@wso2is/identity-apps-core`, `@wso2is/admin.users.v1`, and `@wso2is/console` as patch releases.

✨ Finishing Touches

🧪 Generate unit tests (beta)

Create PR with unit tests

🛠️ create changeset

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

_{Comment @coderabbitai help to get the list of available commands.}

coderabbitai

Actionable comments posted: 1

🤖 Prompt for all review comments with AI agents

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

Inline comments:
In
`@identity-apps-core/react-ui-core/src/components/adapters/date-field-adapter.js`:
- Around line 32-33: Update the DOB validation messages represented by
DOB_FORMAT_ERROR and DOB_FUTURE_DATE_ERROR to use the existing translation path
used by other user-facing text in the date-field adapter. Preserve their current
meanings and validation behavior while ensuring both messages are localized for
the active locale.

🪄 Autofix (Beta)

Fix all unresolved CodeRabbit comments on this PR:

Push a commit to this branch (recommended)
Create a new PR with the fixes

ℹ️ Review info

⚙️ Run configuration

Configuration used: Path: .coderabbit.yml

Review profile: CHILL

Plan: Pro

Run ID: c1d50149-45db-4f95-b02d-0d54bc686133

📥 Commits

Reviewing files that changed from the base of the PR and between 62451ea and 7c3a6c9.

📒 Files selected for processing (7)

.changeset/tidy-months-tell.md
features/admin.users.v1/components/user-profile/fields/form-field-renderer.tsx
features/admin.users.v1/components/user-profile/legacy-user-profile-form.tsx
features/admin.users.v1/components/wizard/steps/legacy-add-user-basic.tsx
identity-apps-core/apps/recovery-portal/src/main/resources/org/wso2/carbon/identity/mgt/recovery/endpoint/i18n/Resources.properties
identity-apps-core/apps/recovery-portal/src/main/webapp/self-registration-username-request.jsp
identity-apps-core/react-ui-core/src/components/adapters/date-field-adapter.js

codecov · 2026-07-22T08:06:39Z

Codecov Report

✅ All modified and coverable lines are covered by tests.
✅ Project coverage is 73.46%. Comparing base (77691f3) to head (71fb43e).
⚠️ Report is 164 commits behind head on master.

Additional details and impacted files

@@            Coverage Diff             @@
##           master   #10558      +/-   ##
==========================================
+ Coverage   72.85%   73.46%   +0.61%     
==========================================
  Files         470      471       +1     
  Lines       71238    71449     +211     
  Branches      240      266      +26     
==========================================
+ Hits        51902    52492     +590     
+ Misses      19225    18850     -375     
+ Partials      111      107       -4

see 38 files with indirect coverage changes

🚀 New features to boost your workflow:

❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.
📦 JS Bundle Analysis: Save yourself from yourself by tracking and limiting bundle sizes in JS merges.

The date field adapter special-cased the DOB claim URI to add format and future-date checks, so any other date claim configured with the same rules would get no validation at all, and the DOB check couldn't be reused or reconfigured without editing this component again. Move the rule interpretation into the shared field-validation hook as a generic DateValidator case (real-date + disallow.future conditions), and have the adapter derive its calendar constraints (max date, date format) from whatever DateValidator rule the field was actually given, rather than from a hardcoded claim URI check. The adapter now activates automatically for any date field the server attaches a DateValidator rule to (see the companion carbon-identity-framework change that authors this rule from claim metadata).

admin.users.v1 changes are bundled into the console app, so console needs a version bump too, per review feedback on PR wso2#10558.

coderabbitai

Actionable comments posted: 1

🤖 Prompt for all review comments with AI agents

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

Inline comments:
In `@identity-apps-core/react-ui-core/src/utils/validation-utils.js`:
- Around line 44-47: Update parseIsoDate’s date construction to preserve
four-digit years below 0100: create the date without relying on the
multi-argument constructor’s 1900 offset, then apply the parsed year with
setFullYear(). Keep the existing component validation unchanged so inputs such
as 0099-01-01 are accepted only when valid.

🪄 Autofix (Beta)

Fix all unresolved CodeRabbit comments on this PR:

Push a commit to this branch (recommended)
Create a new PR with the fixes

ℹ️ Review info

⚙️ Run configuration

Configuration used: Path: .coderabbit.yml

Review profile: CHILL

Plan: Pro Plus

Run ID: 7fcf40ef-ae35-4716-b965-d1a5db21cea3

📥 Commits

Reviewing files that changed from the base of the PR and between 7c3a6c9 and 7ca047b.

📒 Files selected for processing (5)

.changeset/tidy-months-tell.md
identity-apps-core/react-ui-core/src/components/adapters/date-field-adapter.js
identity-apps-core/react-ui-core/src/components/validation-criteria.js
identity-apps-core/react-ui-core/src/hooks/use-field-validations.js
identity-apps-core/react-ui-core/src/utils/validation-utils.js

🚧 Files skipped from review as they are similar to previous changes (1)

.changeset/tidy-months-tell.md

new Date(year, month, day) maps a 2-digit year (0-99) to 1900+year, so a valid string like "0099-01-01" would round-trip to 1999 and get rejected as invalid. Build the date with setFullYear() instead, which does not apply that offset. Addresses a CodeRabbit review comment on PR wso2#10558.

Prevent future dates for Date of Birth in registration and user forms

7c3a6c9

coderabbitai Bot requested a review from pavinduLakshan July 22, 2026 05:45

coderabbitai Bot reviewed Jul 22, 2026

View reviewed changes

Comment thread identity-apps-core/react-ui-core/src/components/adapters/date-field-adapter.js Outdated

This was referenced Jul 22, 2026

Emit DateValidator client rule for date claims that disallow future values wso2/carbon-identity-framework#8212

Merged

Reject non-existing and future dates for the Date of Birth claim wso2-extensions/identity-inbound-provisioning-scim2#800

Merged

pavinduLakshan reviewed Jul 24, 2026

View reviewed changes

Comment thread .changeset/tidy-months-tell.md

pavinduLakshan previously approved these changes Jul 24, 2026

View reviewed changes

Add @wso2is/console to the changeset

7ca047b

admin.users.v1 changes are bundled into the console app, so console needs a version bump too, per review feedback on PR wso2#10558.

RushanNanayakkara dismissed pavinduLakshan’s stale review via 7ca047b July 24, 2026 09:10

coderabbitai Bot requested a review from pavinduLakshan July 24, 2026 09:11

coderabbitai Bot reviewed Jul 24, 2026

View reviewed changes

Comment thread identity-apps-core/react-ui-core/src/utils/validation-utils.js

pavinduLakshan approved these changes Jul 24, 2026

View reviewed changes

RushanNanayakkara merged commit 168df3a into wso2:master Jul 26, 2026
15 checks passed

wso2-jenkins-bot mentioned this pull request Jul 26, 2026

[Release] [GitHub Action] [master] Update package versions #10578

Merged

Navigation Menu

Uh oh!

Prevent future dates for Date of Birth in registration and user profile forms - #10558

Prevent future dates for Date of Birth in registration and user profile forms#10558
RushanNanayakkara merged 4 commits into
wso2:masterfrom
RushanNanayakkara:fix-dob-future-date-validation

RushanNanayakkara commented Jul 22, 2026 •

edited by pavinduLakshan

Loading

Uh oh!

coderabbitai Bot commented Jul 22, 2026 •

edited

Loading

Walkthrough

Changes

Uh oh!

coderabbitai Bot left a comment

Uh oh!

Uh oh!

codecov Bot commented Jul 22, 2026 •

edited

Loading

Uh oh!

Uh oh!

coderabbitai Bot left a comment

Uh oh!

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

2 participants

Uh oh!

Conversation

RushanNanayakkara commented Jul 22, 2026 • edited by pavinduLakshan Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Purpose

Changes

Related PRs

Testing

Uh oh!

coderabbitai Bot commented Jul 22, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Walkthrough

Changes

Uh oh!

coderabbitai Bot left a comment

Choose a reason for hiding this comment

Uh oh!

Uh oh!

codecov Bot commented Jul 22, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Codecov Report

Uh oh!

Uh oh!

coderabbitai Bot left a comment

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

2 participants

RushanNanayakkara commented Jul 22, 2026 •

edited by pavinduLakshan

Loading

coderabbitai Bot commented Jul 22, 2026 •

edited

Loading

codecov Bot commented Jul 22, 2026 •

edited

Loading