[USER-2344] add /oauth/authorize-with-immediate-redirect endpoint to the frontendApiRedirectPathsNoUserInput list #6292
Conversation
|
|
The latest updates on your projects. Learn more about Vercel for Git ↗︎
|
📝 WalkthroughWalkthroughA new path string, Assessment against linked issues
Assessment against linked issues: Out-of-scope changesNo out-of-scope changes were found. 🪧 TipsChatThere are 3 ways to chat with CodeRabbit:
SupportNeed help? Create a ticket on our support page for assistance with any issues or questions. Note: Be mindful of the bot's finite context window. It's strongly recommended to break down tasks such as reading entire modules into smaller chunks. For a focused discussion, use review comments to chat about specific files and their changes, instead of using the PR comments. CodeRabbit Commands (Invoked using PR comments)
Other keywords and placeholders
CodeRabbit Configuration File (
|
![coderabbitai[bot]](https://avatars.githubusercontent.com/in/347564?s=60&v=4){kind=small}
There was a problem hiding this comment.
Actionable comments posted: 0
🧹 Nitpick comments (1)
packages/clerk-js/src/utils/url.ts (1)
338-341: Fix typo in inline comment and consider marking arrayas constThe new entry is fine, but:
- “Similiar” → “Similar”.
- Since this array is meant to be a fixed whitelist, declaring it
as constwould give stronger type-safety and prevent accidental mutations.-const frontendApiRedirectPathsNoUserInput: string[] = [ +const frontendApiRedirectPathsNoUserInput = [ '/v1/verify', // magic links '/v1/tickets/accept', // ticket flow - '/oauth/authorize-with-immediate-redirect', // Similiar to OAuth Authorize, but even if a user is signed out - we immediately redirect + '/oauth/authorize-with-immediate-redirect', // Similar to OAuth Authorize, but even if a user is signed out we immediately redirect -]; +] as const;This is a minor polish, but worth doing while the code is fresh.
@clerk/security – heads-up: list of OAuth redirect endpoints changed.
📜 Review details
Configuration used: CodeRabbit UI
Review profile: CHILL
Plan: Pro
📒 Files selected for processing (2)
packages/clerk-js/src/utils/__tests__/url.spec.ts(2 hunks)packages/clerk-js/src/utils/url.ts(1 hunks)
🧰 Additional context used
📓 Path-based instructions (10)
**/*.{js,jsx,ts,tsx}
Instructions used from:
Sources:
📄 CodeRabbit Inference Engine
- .cursor/rules/development.mdc
packages/**/*.ts
Instructions used from:
Sources:
📄 CodeRabbit Inference Engine
- .cursor/rules/development.mdc
packages/**/*.{ts,tsx,d.ts}
Instructions used from:
Sources:
📄 CodeRabbit Inference Engine
- .cursor/rules/development.mdc
**/*.{ts,tsx}
Instructions used from:
Sources:
📄 CodeRabbit Inference Engine
- .cursor/rules/development.mdc
- .cursor/rules/typescript.mdc
packages/{clerk-js,elements,themes}/**/*
Instructions used from:
Sources:
📄 CodeRabbit Inference Engine
- .cursor/rules/monorepo.mdc
**/*.ts
Instructions used from:
Sources:
⚙️ CodeRabbit Configuration File
**/*
Instructions used from:
Sources:
⚙️ CodeRabbit Configuration File
**/{__tests__,**/__tests__}/**/*.{js,jsx,ts,tsx}
Instructions used from:
Sources:
📄 CodeRabbit Inference Engine
- .cursor/rules/development.mdc
**/*.{test,spec}.{js,ts,tsx}
Instructions used from:
Sources:
📄 CodeRabbit Inference Engine
- .cursor/rules/monorepo.mdc
**/__tests__/**/*.{ts,tsx}
Instructions used from:
Sources:
📄 CodeRabbit Inference Engine
- .cursor/rules/typescript.mdc
🧠 Learnings (3)
📓 Common learnings
Learnt from: wobsoriano
PR: clerk/javascript#6099
File: packages/backend/src/api/endpoints/IdPOAuthAccessTokenApi.ts:7-14
Timestamp: 2025-06-10T20:38:08.982Z
Learning: Methods in `packages/backend/src/api/endpoints` (e.g., `IdPOAuthAccessTokenApi.verifySecret`) are currently not exposed publicly, so renaming them does not constitute a breaking change.
packages/clerk-js/src/utils/url.ts (2)
Learnt from: CR
PR: clerk/javascript#0
File: .cursor/rules/nextjs.mdc:0-0
Timestamp: 2025-06-30T10:31:43.578Z
Learning: Applies to app/**/*.tsx : Use redirect function for server-side redirects in Server Components
Learnt from: CR
PR: clerk/javascript#0
File: .cursor/rules/typescript.mdc:0-0
Timestamp: 2025-06-30T10:33:45.961Z
Learning: Applies to tsconfig.json : Set up path aliases in tsconfig.json for cleaner imports
packages/clerk-js/src/utils/__tests__/url.spec.ts (7)
Learnt from: CR
PR: clerk/javascript#0
File: .cursor/rules/monorepo.mdc:0-0
Timestamp: 2025-06-30T10:30:56.197Z
Learning: Applies to packages/{clerk-js,elements,themes}/**/* : Visual regression testing should be performed for UI components.
Learnt from: CR
PR: clerk/javascript#0
File: .cursor/rules/monorepo.mdc:0-0
Timestamp: 2025-06-30T10:30:56.197Z
Learning: Applies to packages/clerk-react/**/*.{test,spec}.{js,ts,tsx} : Component testing should use React Testing Library.
Learnt from: CR
PR: clerk/javascript#0
File: .cursor/rules/monorepo.mdc:0-0
Timestamp: 2025-06-30T10:30:56.197Z
Learning: Applies to packages/@clerk/*/jest.config.{js,ts} : Each framework integration package must have its own test configuration.
Learnt from: CR
PR: clerk/javascript#0
File: .cursor/rules/nextjs.mdc:0-0
Timestamp: 2025-06-30T10:31:43.578Z
Learning: Applies to app/**/*.tsx : Use redirect function for server-side redirects in Server Components
Learnt from: CR
PR: clerk/javascript#0
File: .cursor/rules/typescript.mdc:0-0
Timestamp: 2025-06-30T10:33:45.961Z
Learning: Applies to **/__tests__/**/*.{ts,tsx} : Use branded types for test isolation
Learnt from: LauraBeatris
PR: clerk/javascript#6273
File: packages/testing/src/playwright/unstable/page-objects/sessionTask.ts:22-27
Timestamp: 2025-07-11T17:12:28.461Z
Learning: In Clerk's test utilities, particularly for page objects like sessionTask.ts, when handling task type enums, prefer graceful handling of unknown/unsupported task types rather than throwing errors. This prevents breaking existing tests when new task types are introduced to the SessionTask['key'] union type.
Learnt from: CR
PR: clerk/javascript#0
File: .cursor/rules/development.mdc:0-0
Timestamp: 2025-06-30T10:29:42.997Z
Learning: Include tests for all new features
⏰ Context from checks skipped due to timeout of 90000ms. You can increase the timeout in your CodeRabbit configuration to a maximum of 15 minutes (900000ms). (5)
- GitHub Check: semgrep-cloud-platform/scan
- GitHub Check: Build Packages
- GitHub Check: Formatting | Dedupe | Changeset
- GitHub Check: semgrep/ci
- GitHub Check: Analyze (javascript-typescript)
🔇 Additional comments (2)
packages/clerk-js/src/utils/__tests__/url.spec.ts (2)
425-426: New path added toisRedirectForFAPIInitiatedFlowtests – 👍The extra case ensures the helper recognises the immediate-redirect variant; assertion is correct.
445-446:requiresUserInputtest updated – 👍Confirms that the immediate-redirect path is treated as no-input; reads clearly and passes.
@clerk/agent-toolkit
@clerk/astro
@clerk/backend
@clerk/chrome-extension
@clerk/clerk-js
@clerk/dev-cli
@clerk/elements
@clerk/clerk-expo
@clerk/expo-passkeys
@clerk/express
@clerk/fastify
@clerk/localizations
@clerk/nextjs
@clerk/nuxt
@clerk/clerk-react
@clerk/react-router
@clerk/remix
@clerk/shared
@clerk/tanstack-react-start
@clerk/testing
@clerk/themes
@clerk/types
@clerk/upgrade
@clerk/vue
commit: |
Currently, to complete an oauth flow, the sign in page is usually hit. This is because the FAPI endpoint
/oauth/authorizeneeds to get the user's session to complete the flow.However, there are cases where FAPI's
/oauth/authorizeendpoint needs to know if the user is not logged into clerk. For example when handlingprompt=nonefor OIDC.This PR adds
/oauth/authorize-with-immediate-redirectto frontendApiRedirectPathsNoUserInput. This makes it so we can immediately redirect back to the oauth flow, but attach the client cookie or dev browser to the flow without requiring user interactionSummary by CodeRabbit