Add device registration flow support to flow management API

[kaviska]

Purpose

This PR adds DEVICE_REGISTRATION as a supported flow type in the Flow Management API (/api/server/v1/flow). It allows tenant administrators to design, retrieve, and manage a device registration flow through the same endpoints already used for registration, password recovery, and ask password flows.

Goals

The flow type is supported across the existing Flow Management operations:

• Retrieve meta information for the device registration flow (GET /flow/meta).
• Retrieve, update, and delete a device registration flow (GET /flow, PUT /flow, DELETE /flow).
• Retrieve the flow configuration for the device registration flow (GET /flow/config).
• Allow the DeviceRegistrationExecutor to be used as a step within the registration and ask password flows.

Implementation

The change follows the existing meta response handler pattern in org.wso2.carbon.identity.api.server.flow.management.v1, so no new Maven component is introduced.

Changes

response/handlers

• DeviceRegistrationFlowMetaHandler is a new handler extending AbstractMetaResponseHandler, supplying the meta information for the device registration flow.
• The handler declares the endUser attribute profile, the username claim as the required input field, and the DeviceRegistrationExecutor, EmailOTPExecutor, SMSOTPExecutor and UserResolveExecutor executors.
• RegistrationFlowMetaHandler and AskPasswordFlowMetaHandler now include DeviceRegistrationExecutor in their supported executors, so device registration can be composed into those flows as a step.

core and constants

• ServerFlowMgtService.resolveHandler maps the DEVICE_REGISTRATION flow type to the new handler.
• FlowEndpointConstants defines the DEVICE_REGISTRATION_EXECUTOR constant.

utils

• Utils.validateExecutors rejects a device registration flow that does not contain the DeviceRegistrationExecutor, mirroring the existing validation for the password recovery flow.

flow.yaml

• DEVICE_REGISTRATION is added to the flowType enum on all endpoints that accept it.

The endUser attribute profile is used because the device registration flow operates on an existing user who is resolved by username and verified before the device is registered, which matches how the password recovery flow resolves its attribute set. Flow type validation and flow completion configuration resolution are already driven by the Constants.FlowTypes enum, so no changes were required there.

No changes are required in the Flow Execution API. It validates the flow type against the same enum and gates execution on the flow configuration, without any per-flow-type handling.

User stories

• As a tenant administrator, I can design a device registration flow in the console using the device registration, OTP, and user resolve executors.
• As a tenant administrator, I can add a device registration step to an existing registration or ask password flow.
• As a tenant administrator, I am prevented from saving a device registration flow that does not include the device registration executor.

Developer Checklist (Mandatory)

• Complete the Developer Checklist in the related product-is issue to capture any behavioral changes or migration impacts.

Release note

N/A

Documentation

N/A

Training

N/A

Certification

N/A

Marketing

N/A

Automation tests

N/A

Security checks

• Followed the WSO2 Secure Engineering Guidelines: Yes
• Ran the FindSecurityBugs plugin and verified the report:
• Confirmed that no keys, passwords, tokens, or other secrets are included: Yes

Samples

N/A

Related PRs

This PR depends on a carbon-identity-framework release that includes Constants.FlowTypes.DEVICE_REGISTRATION.

Migrations

N/A – This adds a new flow type to an existing API and does not require any migration.

Test environment

N/A

Learning

N/A

[coderabbitai]

Important

Review skipped

Draft detected.

Please check the settings in the CodeRabbit UI or the .coderabbit.yaml file in this repository. To trigger a single review, invoke the @coderabbitai review command.

⚙️ Run configuration

Configuration used: Organization UI

Review profile: CHILL

Plan: Pro

Run ID: c924286c-4256-4041-911c-3874451625e4

You can disable this status message by setting the reviews.review_status to false in the CodeRabbit configuration file.

Use the checkbox below for a quick retry:

• 🔍 Trigger review

✨ Finishing Touches

🧪 Generate unit tests (beta)

• Create PR with unit tests

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}