feat(ui): upgrade affiliation domains for SSO - #9356
Conversation
🦋 Changeset detectedLatest commit: ff305cb The changes in this PR will be included in the next version bump. This PR includes changesets to release 23 packages
Not sure what this means? Click here to learn what changesets are. Click here if you're a maintainer who wants to add another changeset to this PR |
|
The latest updates on your projects. Learn more about Vercel for GitHub.
|
|
Note Reviews pausedIt looks like this branch is under active development. To avoid overwhelming you with review comments due to an influx of new commits, CodeRabbit has automatically paused this review. You can configure this behavior by changing the Use the following commands to manage reviews:
Use the checkboxes below for quick actions:
📝 WalkthroughWalkthroughConfigureSSO now supports ownership verification for existing affiliation-verified organization domains. Domain creation accepts a separate enrollment mode. Enterprise connections use only domains with verified ownership. Domain cards distinguish affiliation and ownership verification states. Removal can preserve affiliation verification. Tests cover verification preparation, domain filtering, connection payloads, and removal messaging. Estimated code review effort: 3 (Moderate) | ~20 minutes Possibly related PRs
Suggested reviewers: 🚥 Pre-merge checks | ✅ 5✅ Passed checks (5 passed)
✨ Finishing Touches 💡 1🛠️ Fix failing CI checks 💡
Comment |
![coderabbitai[bot]](https://avatars.githubusercontent.com/in/347564?s=60&v=4){kind=small}
There was a problem hiding this comment.
Actionable comments posted: 3
🤖 Prompt for all review comments with AI agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
Inline comments:
In
`@packages/ui/src/components/ConfigureSSO/hooks/__tests__/useOrganizationEnterpriseConnection.test.tsx`:
- Around line 189-192: Update the mock domainsState.data element type from `{
name: string }` to include the ownershipVerification property used by the test
fixtures, allowing both the verified status object and null while preserving the
existing name field.
In
`@packages/ui/src/components/ConfigureSSO/hooks/useOrganizationEnterpriseConnection.ts`:
- Line 251: Update the domains selection in useOrganizationEnterpriseConnection
so existing connection domains are restricted to names present in
verifiedOwnershipDomains before provider replacement; retain only verified names
and preserve the fallback behavior when no existing domains are available. Add a
changeProvider test covering an existing unverified domain and assert it is
excluded.
In `@packages/ui/src/components/ConfigureSSO/steps/OrganizationDomainsStep.tsx`:
- Around line 472-478: Update the ownership-verification preparation flow used
by ExpiredNotice and onPrepareOwnershipVerification so rejected promises are
explicitly caught rather than discarded after finally(). Surface the failure
through the existing mutation error state or established error message, while
preserving the current success and cleanup behavior.
🪄 Autofix
Fix all unresolved CodeRabbit comments on this PR:
- Push a commit to this branch (recommended)
- Create a new PR with the fixes
ℹ️ Review info
⚙️ Run configuration
Configuration used: Repository YAML (base), Organization UI (inherited)
Review profile: CHILL
Plan: Pro Plus
Run ID: 29826ac4-101d-4fbd-83b7-ece13a362a4f
📒 Files selected for processing (8)
.changeset/bright-geese-upgrade.mdpackages/shared/src/react/hooks/useOrganizationDomains.tsxpackages/ui/src/components/ConfigureSSO/__tests__/ConfigureSSO.test.tsxpackages/ui/src/components/ConfigureSSO/domain/__tests__/organizationEnterpriseConnection.test.tspackages/ui/src/components/ConfigureSSO/domain/organizationEnterpriseConnection.tspackages/ui/src/components/ConfigureSSO/hooks/__tests__/useOrganizationEnterpriseConnection.test.tsxpackages/ui/src/components/ConfigureSSO/hooks/useOrganizationEnterpriseConnection.tspackages/ui/src/components/ConfigureSSO/steps/OrganizationDomainsStep.tsx
🔗 Linked repositories identified
CodeRabbit considers these linked repositories for cross-repo context during reviews:
clerk/clerk_go(manual)clerk/dashboard(manual)clerk/accounts(manual)clerk/backoffice(manual)clerk/clerk(manual)clerk/clerk-docs(manual)clerk/cloudflare-workers(manual)clerk/clerk-ios(auto-detected)clerk/clerk-android(auto-detected)clerk/cli(auto-detected)
| } | ||
|
|
||
| const domains = enterpriseConnection?.domains ?? organizationDomains?.map(domain => domain.name); | ||
| const domains = enterpriseConnection?.domains ?? verifiedOwnershipDomains?.map(domain => domain.name); |
There was a problem hiding this comment.
🗄️ Data Integrity & Integration | 🟠 Major | ⚡ Quick win
Filter existing connection domains before provider replacement.
Line 251 reuses every existing connection domain. This can recreate a connection with affiliation-only or unverified domains after deleting the old connection. Filter the existing names against verifiedOwnershipDomains, or use only the verified names.
Add a changeProvider test with an existing unverified domain.
🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
In
`@packages/ui/src/components/ConfigureSSO/hooks/useOrganizationEnterpriseConnection.ts`
at line 251, Update the domains selection in useOrganizationEnterpriseConnection
so existing connection domains are restricted to names present in
verifiedOwnershipDomains before provider replacement; retain only verified names
and preserve the fallback behavior when no existing domains are available. Add a
changeProvider test covering an existing unverified domain and assert it is
excluded.
Source: Linked repositories
| {!hasOwnershipVerification || isExpired ? ( | ||
| <ExpiredNotice | ||
| key='expired' | ||
| key={isExpired ? 'expired' : 'unprepared'} | ||
| isExpired={isExpired} | ||
| expiresAt={ownershipVerification?.expiresAt ?? null} | ||
| onPrepareOwnershipVerification={onPrepareOwnershipVerification} | ||
| /> |
There was a problem hiding this comment.
🩺 Stability & Availability | 🟡 Minor | ⚡ Quick win
Handle ownership-verification preparation failures.
This new path calls ExpiredNotice, whose handler discards a rejected promise after .finally(). If preparation fails, the UI provides no error and can produce an unhandled rejection. Catch the error and show the existing mutation error state or message.
🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
In `@packages/ui/src/components/ConfigureSSO/steps/OrganizationDomainsStep.tsx`
around lines 472 - 478, Update the ownership-verification preparation flow used
by ExpiredNotice and onPrepareOwnershipVerification so rejected promises are
explicitly caught rather than discarded after finally(). Surface the failure
through the existing mutation error state or established error message, while
preserving the current success and cleanup behavior.
There was a problem hiding this comment.
Actionable comments posted: 1
🤖 Prompt for all review comments with AI agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
Inline comments:
In `@packages/ui/src/components/ConfigureSSO/steps/OrganizationDomainsStep.tsx`:
- Around line 439-464: Add elementDescriptor props to the affiliation and
ownership Text elements, the verified Badge, and the ArrowRight Icon within the
isAffiliationVerified block in OrganizationDomainsStep. Use matching, unique
descriptors consistent with the component’s existing descriptor naming
conventions so Appearance customizations can target each new status element.
🪄 Autofix
Fix all unresolved CodeRabbit comments on this PR:
- Push a commit to this branch (recommended)
- Create a new PR with the fixes
ℹ️ Review info
⚙️ Run configuration
Configuration used: Repository YAML (base), Organization UI (inherited)
Review profile: CHILL
Plan: Pro Plus
Run ID: da01ea36-50d2-43ca-b001-a0ddaac2647f
📒 Files selected for processing (3)
packages/localizations/src/en-US.tspackages/ui/src/components/ConfigureSSO/__tests__/ConfigureSSO.test.tsxpackages/ui/src/components/ConfigureSSO/steps/OrganizationDomainsStep.tsx
🔗 Linked repositories identified
CodeRabbit considers these linked repositories for cross-repo context during reviews:
clerk/clerk_go(manual)clerk/dashboard(manual)clerk/accounts(manual)clerk/backoffice(manual)clerk/clerk(manual)clerk/clerk-docs(manual)clerk/cloudflare-workers(manual)clerk/clerk-ios(auto-detected)clerk/clerk-android(auto-detected)clerk/cli(auto-detected)
🚧 Files skipped from review as they are similar to previous changes (1)
- packages/ui/src/components/ConfigureSSO/tests/ConfigureSSO.test.tsx
There was a problem hiding this comment.
Actionable comments posted: 1
🤖 Prompt for all review comments with AI agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
Inline comments:
In `@packages/ui/src/components/ConfigureSSO/steps/OrganizationDomainsStep.tsx`:
- Around line 100-102: Update the catch block in the organization-domain
submission flow to catch unknown errors instead of using err: any. Preserve
Clerk-specific handling via getFieldError and getGlobalError, but route
non-Clerk failures through the shared handleError path used by
RemoveDomainDialog or provide a generic user-facing fallback before calling
card.setError.
🪄 Autofix
Fix all unresolved CodeRabbit comments on this PR:
- Push a commit to this branch (recommended)
- Create a new PR with the fixes
ℹ️ Review info
⚙️ Run configuration
Configuration used: Repository YAML (base), Organization UI (inherited)
Review profile: CHILL
Plan: Pro Plus
Run ID: af531d0a-a130-4422-b31d-84191bb9a242
📒 Files selected for processing (4)
.changeset/bright-geese-upgrade.mdpackages/localizations/src/en-US.tspackages/ui/src/components/ConfigureSSO/__tests__/ConfigureSSO.test.tsxpackages/ui/src/components/ConfigureSSO/steps/OrganizationDomainsStep.tsx
🔗 Linked repositories identified
CodeRabbit considers these linked repositories for cross-repo context during reviews:
clerk/clerk_go(manual)clerk/dashboard(manual)clerk/accounts(manual)clerk/backoffice(manual)clerk/clerk(manual)clerk/clerk-docs(manual)clerk/cloudflare-workers(manual)clerk/clerk-ios(auto-detected)clerk/clerk-android(auto-detected)clerk/cli(auto-detected)
🚧 Files skipped from review as they are similar to previous changes (3)
- .changeset/bright-geese-upgrade.md
- packages/ui/src/components/ConfigureSSO/tests/ConfigureSSO.test.tsx
- packages/localizations/src/en-US.ts
| } catch (err: any) { | ||
| const apiError = getFieldError(err) ?? getGlobalError(err); | ||
| card.setError(apiError); |
There was a problem hiding this comment.
🩺 Stability & Availability | 🟠 Major | ⚡ Quick win
Preserve a fallback error for non-Clerk failures.
getFieldError and getGlobalError return undefined for non-ClerkAPIResponseError failures. card.setError(apiError) then provides no user-facing error after a network or unexpected failure.
Catch unknown, narrow it, and use the shared handleError path used by RemoveDomainDialog.tsx Lines 63-70, or provide a generic fallback. Do not use err: any.
As per coding guidelines, use typed errors and avoid unjustified any. The shared error helpers are defined in packages/ui/src/utils/errorHandler.ts Lines 89-112.
🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
In `@packages/ui/src/components/ConfigureSSO/steps/OrganizationDomainsStep.tsx`
around lines 100 - 102, Update the catch block in the organization-domain
submission flow to catch unknown errors instead of using err: any. Preserve
Clerk-specific handling via getFieldError and getGlobalError, but route
non-Clerk failures through the shared handleError path used by
RemoveDomainDialog or provide a generic user-facing fallback before calling
card.setError.
Source: Coding guidelines
There was a problem hiding this comment.
Actionable comments posted: 1
🤖 Prompt for all review comments with AI agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
Inline comments:
In `@packages/ui/src/components/ConfigureSSO/RemoveDomainDialog.tsx`:
- Around line 49-59: Update RemoveDomainDialog’s subtitle selection to use a
combined active-preservation message when preserveAffiliationVerification and
isConnectionActive are both true, while retaining existing copy for the other
states. Add the corresponding English localization in
packages/localizations/src/en-US.ts:691-692 explaining that SSO will no longer
be used with the domain while affiliation verification remains active. Update
packages/ui/src/components/ConfigureSSO/__tests__/RemoveDomainDialog.test.tsx:85-94
to set isConnectionActive to true and assert the combined message.
🪄 Autofix
Fix all unresolved CodeRabbit comments on this PR:
- Push a commit to this branch (recommended)
- Create a new PR with the fixes
ℹ️ Review info
⚙️ Run configuration
Configuration used: Repository YAML (base), Organization UI (inherited)
Review profile: CHILL
Plan: Pro Plus
Run ID: 1484e26c-f2be-4638-90dc-e7fb13d666f3
📒 Files selected for processing (5)
packages/localizations/src/en-US.tspackages/ui/src/components/ConfigureSSO/RemoveDomainDialog.tsxpackages/ui/src/components/ConfigureSSO/__tests__/ConfigureSSO.test.tsxpackages/ui/src/components/ConfigureSSO/__tests__/RemoveDomainDialog.test.tsxpackages/ui/src/components/ConfigureSSO/steps/OrganizationDomainsStep.tsx
🔗 Linked repositories identified
CodeRabbit considers these linked repositories for cross-repo context during reviews:
clerk/clerk_go(manual)clerk/dashboard(manual)clerk/accounts(manual)clerk/backoffice(manual)clerk/clerk(manual)clerk/clerk-docs(manual)clerk/cloudflare-workers(manual)clerk/clerk-ios(auto-detected)clerk/clerk-android(auto-detected)clerk/cli(auto-detected)
🚧 Files skipped from review as they are similar to previous changes (2)
- packages/ui/src/components/ConfigureSSO/tests/ConfigureSSO.test.tsx
- packages/ui/src/components/ConfigureSSO/steps/OrganizationDomainsStep.tsx
Adds the affiliation/ownership domain card and remove-dialog keys to __internal_LocalizationResource and regenerates the locale files.
@clerk/astro
@clerk/backend
@clerk/chrome-extension
@clerk/clerk-js
@clerk/electron
@clerk/electron-passkeys
@clerk/eslint-plugin
@clerk/expo
@clerk/expo-google-signin
@clerk/expo-passkeys
@clerk/express
@clerk/fastify
@clerk/hono
@clerk/localizations
@clerk/nextjs
@clerk/nuxt
@clerk/react
@clerk/react-router
@clerk/shared
@clerk/tanstack-react-start
@clerk/testing
@clerk/ui
@clerk/upgrade
@clerk/vue
commit: |
API Changes Report
Summary
🔴 Breaking changes index (56)Every breaking change, up front. Full diffs are in the package sections below.
@clerk/sharedVersion: 4.27.0 → 4.25.8 Subpath
|
Adds a combined subtitle for removing an affiliation-verified domain from an active connection, element descriptors for the new domain card status elements, and drops the comments added in this branch.
1 participant
Summary