Enable self-service profile updates in Android SDKs

[janithjay]

Purpose

Currently, the Android SDK's user profile view sources attributes from the JWT/userinfo claims embedded in the sign-in token, which is read-only and limited to whatever claims a given application's token happens to carry.

This PR makes the profile view fetch from GET /users/me by default, matching the JavaScript SDK, and adds,

• Self-service editing per attribute, validated and saved against the schema from GET /users/me/meta (PUT /users/me).
• Avatar picture and display-name sync from the real profile, kept in sync with ThunderIDState.user across sign-in/refresh.
• An opt-out config flag, ThunderIDConfig.fetchUserProfile (default true), for apps that want the previous token-claims-only, read-only behavior instead.

Approach

• ThunderIDClient: fixed getUserProfile()/added getUserSchema() to call the real /users/me / /users/me/meta endpoints (previously pointed at nonexistent /scim2/* routes). updateUserProfile() now does PUT /users/me with {"attributes": {...}}, matching the backend's actual contract.
• UserProfile.kt: schema-driven field building (buildProfileFields), validation (validateField: required + regex, invalid regex ignored rather than blocking save), and a merge-before-save step (deepMergeAttributes) since the backend rejects a save missing any required attribute, even for a single-field edit.
• Token-only mode (fetchUserProfile = false) intentionally mirrors the Quickstart's pre-existing userAttributes() / formatClaim() / claimLabel() behavior verbatim rather than reinventing it, now hoisted from the sample into the reusable SDK component.
• ThunderIDState: the /users/me profile-picture sync is launched on the ThunderIDProvider level CoroutineScope rather than awaited inline, since it's triggered from screens (e.g. SignIn) that unmount and cancel their own rememberCoroutineScope() right as the user signs in.
• New vector drawables (ic_edit, ic_check, ic_close) hand-drawn to match the existing icon convention.

After fix default method (fetchUserProfile = true)

After fix attributes fetch from sign-in token method (fetchUserProfile = false)

Related Issues

• [UserProfile] Enable self-service profile updates in Mobile SDKs thunderid#5152

Related PRs

• iOS equivalent: Enable self-service profile updates in iOS SDKs ios-sdks#20

Checklist

• Followed the contribution guidelines.
• Manual test round performed and verified.
• Documentation provided. (Add links if there are any)
• Tests provided. (Add links if there are any)
  • Unit Tests
  • Integration Tests
• Breaking changes. (Fill if applicable)
  • Breaking changes section filled.
  • breaking change label added.

Security checks

• Followed secure coding standards.
• Confirmed that this PR doesn't commit any keys, passwords, tokens, usernames, or other secrets.

[Copilot]

Copilot was unable to review this pull request because the user who requested the review has reached their quota limit.

[coderabbitai]

Important

• 🔍 Trigger review

This repository does not receive automatic reviews because it has fewer than 10 stars.

⚙️ Run configuration

Configuration used: Path: .coderabbit.yaml

Review profile: CHILL

Plan: Pro Plus

Run ID: 8649d4f1-8c03-4c0a-9bcc-7cf00144a14f

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}