merges with main

.github/workflows/ci.yml

@@ -1,12 +1,6 @@
 name: CI
 
 on:
-  workflow_dispatch:
-    inputs:
-      run_integration_tests:
-        description: 'Run integration tests'
-        type: boolean
-        default: false
   merge_group:
   pull_request:
     branches:
@@ -18,7 +12,28 @@ concurrency:
   cancel-in-progress: true
 
 jobs:
+  # Check triggering actor permissions to prevent PRs from forks accessing secrets by default, preventing them from exfiltrating secrets for malicious purposes
+  check-permissions:
+    runs-on: 'blacksmith-8vcpu-ubuntu-2204'
+    steps:
+      - name: Get User Permission
+        id: checkAccess
+        uses: actions-cool/check-user-permission@v2
+        with:
+          require: write
+          username: ${{ github.triggering_actor }}
+        env:
+          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+      - name: Check User Permission
+        if: steps.checkAccess.outputs.require-result == 'false'
+        run: |
+          echo "${{ github.triggering_actor }} does not have permissions on this repo."
+          echo "Current permission level is ${{ steps.checkAccess.outputs.user-permission }}"
+          echo "Job originally triggered by ${{ github.actor }}"
+          exit 1
+
   formatting-linting:
+    needs: [check-permissions]
     name: Formatting, linting & changeset checks
     runs-on: 'blacksmith-8vcpu-ubuntu-2204'
     timeout-minutes: ${{ vars.TIMEOUT_MINUTES_NORMAL && fromJSON(vars.TIMEOUT_MINUTES_NORMAL) || 10 }}
@@ -85,6 +100,7 @@ jobs:
           retention-days: 5
 
   unit-tests:
+    needs: [check-permissions]
     name: Unit Tests
     runs-on: 'blacksmith-8vcpu-ubuntu-2204'
     timeout-minutes: ${{ vars.TIMEOUT_MINUTES_NORMAL && fromJSON(vars.TIMEOUT_MINUTES_NORMAL) || 10 }}
@@ -118,9 +134,9 @@ jobs:
         run: |
           if [ "${{ matrix.node-version }}" == "18" ]; then
             echo "Running tests on Node 18 only for packages with LTS support."
-            pnpm turbo test $TURBO_ARGS --filter="@clerk/astro" --filter="@clerk/backend" --filter="@clerk/express" --filter="@clerk/nextjs" --filter="@clerk/clerk-react" --filter="@clerk/clerk-sdk-node" --filter="@clerk/shared" --filter="@clerk/remix" --filter="@clerk/tanstack-start" --filter="@clerk/elements" --filter="@clerk/vue" --filter="@clerk/nuxt"
+            pnpm turbo test $TURBO_ARGS --filter="@clerk/astro" --filter="@clerk/backend" --filter="@clerk/express" --filter="@clerk/nextjs" --filter="@clerk/clerk-react" --filter="@clerk/clerk-sdk-node" --filter="@clerk/shared" --filter="@clerk/remix" --filter="@clerk/tanstack-start" --filter="@clerk/elements" --filter="@clerk/vue" --filter="@clerk/nuxt" --filter="@clerk/clerk-expo"
           else
-            echo "Running tests for all packages on Node 20."
+            echo "Running tests for all packages on Node 22."
             pnpm turbo test $TURBO_ARGS
           fi
         env:
@@ -136,14 +152,15 @@ jobs:
           retention-days: 5
 
   integration-tests:
+    needs: [check-permissions]
     name: Integration Tests
     runs-on: 'blacksmith-8vcpu-ubuntu-2204'
     timeout-minutes: ${{ vars.TIMEOUT_MINUTES_LONG && fromJSON(vars.TIMEOUT_MINUTES_LONG) || 15 }}
 
     strategy:
       fail-fast: false
       matrix:
-        test-name: [ 'generic', 'express', 'quickstart', 'ap-flows', 'elements', 'sessions', 'astro', 'expo-web', 'tanstack-start', 'tanstack-router', 'vue', 'nuxt']
+        test-name: [ 'generic', 'express', 'quickstart', 'ap-flows', 'elements', 'sessions', 'astro', 'expo-web', 'tanstack-start', 'tanstack-router', 'vue', 'nuxt', 'react-router']
         test-project: ['chrome']
         include:
           - test-name: 'nextjs'
@@ -157,30 +174,11 @@ jobs:
             next-version: '15'
 
     steps:
-      # Skip integration tests from fork PRs to prevent secret exfiltration
-      - name: Get User Permission
-        id: checkAccess
-        uses: actions-cool/check-user-permission@v2
-        with:
-          require: write
-          username: ${{ github.triggering_actor }}
-        env:
-          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
-      - name: Check User Permission
-        if: steps.checkAccess.outputs.require-result == 'false'
-        run: |
-          echo "${{ github.triggering_actor }} does not have permissions on this repo."
-          echo "Current permission level is ${{ steps.checkAccess.outputs.user-permission }}"
-          echo "Job originally triggered by ${{ github.actor }}"
-          exit 1
-
       - name: Checkout Repo
         uses: actions/checkout@v4
         with:
           fetch-depth: 0
           show-progress: false
-          # We must first verify the user permissions before checking out PR code
-          ref: ${{ github.event.pull_request.head.sha }}
 
       - name: Setup
         id: config

.github/workflows/validate-renovate-config.yml

@@ -28,4 +28,4 @@ jobs:
       - name: Validate Renovate Config
         env:
           RENOVATE_VERSION: 37.440.7 # Last version compatible with Node 18
-        run: pnpm dlx renovate@${{ env.RENOVATE_VERSION }} renovate-config-validator
+        run: npx --yes --package renovate@${{ env.RENOVATE_VERSION }} renovate-config-validator

integration/.keys.json.sample

@@ -14,5 +14,37 @@
   "core-2-all-enabled": {
     "pk": "",
     "sk": ""
+  },
+  "sessions-prod-1": {
+    "pk": "",
+    "sk": ""
+  },
+  "sessions-dev-1": {
+    "pk": "",
+    "sk": ""
+  },
+  "sessions-prod-2": {
+    "pk": "",
+    "sk": ""
+  },
+  "sessions-dev-2": {
+    "pk": "",
+    "sk": ""
+  },
+  "with-restricted-mode": {
+    "pk": "",
+    "sk": ""
+  },
+  "with-reverification": {
+    "pk": "",
+    "sk": ""
+  },
+  "with-legal-consent": {
+    "pk": "",
+    "sk": ""
+  },
+  "with-waitlist-mode": {
+    "pk": "",
+    "sk": ""
   }
 }

integration/presets/envs.ts

@@ -113,6 +113,15 @@ const withWaitlistdMode = withEmailCodes
   .setEnvVariable('private', 'CLERK_SECRET_KEY', instanceKeys.get('with-waitlist-mode').sk)
   .setEnvVariable('public', 'CLERK_PUBLISHABLE_KEY', instanceKeys.get('with-waitlist-mode').pk);
 
+const withCombinedFlow = withEmailCodes
+  .clone()
+  .setId('withCombinedFlow')
+  .setEnvVariable('private', 'CLERK_SECRET_KEY', instanceKeys.get('with-email-codes').sk)
+  .setEnvVariable('public', 'CLERK_PUBLISHABLE_KEY', instanceKeys.get('with-email-codes').pk)
+  .setEnvVariable('public', 'EXPERIMENTAL_COMBINED_FLOW', 'true')
+  .setEnvVariable('public', 'CLERK_SIGN_IN_URL', '/sign-in')
+  .setEnvVariable('public', 'CLERK_SIGN_UP_URL', '/sign-in');
+
 export const envs = {
   base,
   withEmailCodes,
@@ -129,4 +138,5 @@ export const envs = {
   withRestrictedMode,
   withLegalConsent,
   withWaitlistdMode,
+  withCombinedFlow,
 } as const;

integration/presets/index.ts

@@ -7,6 +7,7 @@ import { createLongRunningApps } from './longRunningApps';
 import { next } from './next';
 import { nuxt } from './nuxt';
 import { react } from './react';
+import { reactRouter } from './react-router';
 import { remix } from './remix';
 import { tanstack } from './tanstack';
 
@@ -22,6 +23,7 @@ export const appConfigs = {
   astro,
   tanstack,
   nuxt,
+  reactRouter,
   secrets: {
     instanceKeys,
   },

integration/presets/longRunningApps.ts

@@ -8,6 +8,7 @@ import { express } from './express';
 import { next } from './next';
 import { nuxt } from './nuxt';
 import { react } from './react';
+import { reactRouter } from './react-router';
 import { remix } from './remix';
 import { tanstack } from './tanstack';
 import { vue } from './vue';
@@ -32,6 +33,7 @@ export const createLongRunningApps = () => {
     },
     { id: 'next.appRouter.withCustomRoles', config: next.appRouter, env: envs.withCustomRoles },
     { id: 'next.appRouter.withReverification', config: next.appRouter, env: envs.withReverification },
+    { id: 'next.appRouter.withCombinedFlow', config: next.appRouter, env: envs.withCombinedFlow },
     { id: 'quickstart.next.appRouter', config: next.appRouterQuickstart, env: envs.withEmailCodesQuickstart },
     { id: 'elements.next.appRouter', config: elements.nextAppRouter, env: envs.withEmailCodes },
     { id: 'astro.node.withCustomRoles', config: astro.node, env: envs.withCustomRoles },
@@ -41,6 +43,7 @@ export const createLongRunningApps = () => {
     { id: 'tanstack.router', config: tanstack.router, env: envs.withEmailCodes },
     { id: 'vue.vite', config: vue.vite, env: envs.withCustomRoles },
     { id: 'nuxt.node', config: nuxt.node, env: envs.withCustomRoles },
+    { id: 'react-router.node', config: reactRouter.reactRouterNode, env: envs.withEmailCodes },
   ] as const;
 
   const apps = configs.map(longRunningApplication);

integration/presets/react-router.ts

@@ -0,0 +1,17 @@
+import { constants } from '../constants';
+import { applicationConfig } from '../models/applicationConfig.js';
+import { templates } from '../templates/index.js';
+
+const reactRouterNode = applicationConfig()
+  .setName('react-router-node')
+  .useTemplate(templates['react-router-node'])
+  .setEnvFormatter('public', key => `VITE_${key}`)
+  .addScript('setup', 'pnpm install')
+  .addScript('dev', 'pnpm dev')
+  .addScript('build', 'pnpm build')
+  .addScript('serve', 'pnpm start')
+  .addDependency('@clerk/react-router', constants.E2E_CLERK_VERSION || '*');
+
+export const reactRouter = {
+  reactRouterNode,
+} as const;

integration/templates/astro-node/package.json

@@ -11,15 +11,15 @@
   },
   "dependencies": {
     "@astrojs/check": "^0.9.4",
-    "@astrojs/node": "^8.3.4",
-    "@astrojs/react": "^3.6.2",
-    "@astrojs/tailwind": "^5.1.1",
-    "@types/react": "18.3.12",
-    "@types/react-dom": "18.3.1",
-    "astro": "^4.15.11",
+    "@astrojs/node": "^9.0.0",
+    "@astrojs/react": "^4.0.0",
+    "@astrojs/tailwind": "^5.1.3",
+    "@types/react": "18.3.7",
+    "@types/react-dom": "18.3.0",
+    "astro": "^5.0.3",
     "react": "18.3.1",
     "react-dom": "18.3.1",
-    "tailwindcss": "^3.4.4",
-    "typescript": "^5.6.3"
+    "tailwindcss": "^3.4.12",
+    "typescript": "^5.7.2"
   }
 }

integration/templates/astro-node/src/env.d.ts

@@ -1,3 +1,2 @@
 /// <reference path="../.astro/types.d.ts" />
 /// <reference types="astro/client" />
-/// <reference types="@clerk/astro/env" />

integration/templates/astro-node/src/layouts/ViewTransitionsLayout.astro

@@ -1,5 +1,5 @@
 ---
-import { ViewTransitions } from 'astro:transitions';
+import { ClientRouter } from 'astro:transitions';
 
 interface Props {
   title: string;
@@ -17,7 +17,7 @@ const { title } = Astro.props;
     <link rel="icon" type="image/svg+xml" href="/favicon.svg" />
     <meta name="generator" content={Astro.generator} />
     <title>{title}</title>
-    <ViewTransitions />
+    <ClientRouter />
   </head>
   <body>
     <main>

integration/templates/index.ts

@@ -18,6 +18,7 @@ export const templates = {
   'tanstack-router': resolve(__dirname, './tanstack-router'),
   'vue-vite': resolve(__dirname, './vue-vite'),
   'nuxt-node': resolve(__dirname, './nuxt-node'),
+  'react-router-node': resolve(__dirname, './react-router-node'),
 } as const;
 
 if (new Set([...Object.values(templates)]).size !== Object.values(templates).length) {

integration/templates/next-app-router/src/app/layout.tsx

@@ -13,6 +13,9 @@ export default function RootLayout({ children }: { children: React.ReactNode })
   return (
     <ClerkProvider
       experimental={{
+        combinedFlow: process.env.NEXT_PUBLIC_EXPERIMENTAL_COMBINED_FLOW
+          ? process.env.NEXT_PUBLIC_EXPERIMENTAL_COMBINED_FLOW === 'true'
+          : undefined,
         persistClient: process.env.NEXT_PUBLIC_EXPERIMENTAL_PERSIST_CLIENT
           ? process.env.NEXT_PUBLIC_EXPERIMENTAL_PERSIST_CLIENT === 'true'
           : undefined,

integration/templates/next-app-router/src/app/sign-in/[[...catchall]]/page.tsx

@@ -8,6 +8,9 @@ export default function Page() {
         path={'/sign-in'}
         signUpUrl={'/sign-up'}
         fallback={<>Loading sign in</>}
+        __experimental={{
+          combinedProps: {},
+        }}
       />
     </div>
   );

integration/templates/react-router-node/.gitignore

@@ -0,0 +1,8 @@
+.env
+!.env.example
+.DS_Store
+.react-router
+build
+node_modules
+*.tsbuildinfo
+.seccorc

integration/templates/react-router-node/README.md

@@ -0,0 +1,3 @@
+# react-router
+
+Example playground for React Router (Framework mode) and Clerk.