feat(clerk-js): Add default Allowed redirect origins

[octoper]

Description

This PR introduces default values for the allowedRedirectOrigins option, the current implementation does not provide any defaults, with this change if there is no option provided the default will be similar to the example below.

Let's say the host of the application is test.host, the origins will be

• https://test.host/
• https://yourawesomeapp.clerk.accounts.dev/
• https://*.yourawesomeapp.clerk.accounts.dev/

Checklist

• npm test runs as expected.
• npm run build runs as expected.
• (If applicable) JSDoc comments have been added or updated for any package exports
• (If applicable) Documentation has been updated

Type of change

• 🐛 Bug fix
• 🌟 New feature
• 🔨 Breaking change
• 📖 Refactoring / dependency upgrade / documentation
• other:

Packages affected

• @clerk/backend
• @clerk/chrome-extension
• @clerk/clerk-js
• @clerk/clerk-expo
• @clerk/fastify
• gatsby-plugin-clerk
• @clerk/localizations
• @clerk/nextjs
• @clerk/clerk-react
• @clerk/remix
• @clerk/clerk-sdk-node
• @clerk/shared
• @clerk/themes
• @clerk/types
• build/tooling/chore

[changeset-bot]

🦋 Changeset detected

Latest commit: 419ead7

The changes in this PR will be included in the next version bump.

This PR includes changesets to release 3 packages

Name	Type
@clerk/clerk-js	Minor
@clerk/chrome-extension	Patch
@clerk/clerk-expo	Patch

Not sure what this means? Click here to learn what changesets are.

Click here if you're a maintainer who wants to add another changeset to this PR

[dimkl]

🔧 Based on the definition of the origin from MDN docs, I think that we should only allow passing origin values to the allowedRedirectOrigins option (eg ${protocol}://${domain}:${port}). Doing that will also allow us to drop the /* path default origins. If we want to match paths in allowedRedirectOrigins i would advise we rename the options.
cc: @nikosdouvlis

[octoper]

!preview

[clerk-cookie]

Hey @octoper, your preview is available.

Status	Preview	Updated (UTC)
🍪 Deployed	Visit preview	Nov 15, 2023 10:50 AM

[nikosdouvlis]

@octoper this looks good, we need a minor change but apart from that everything is in place. Let's try and merge it today :)

[nikosdouvlis]

🔧 Based on the definition of the origin from MDN docs, I think that we should only allow passing origin values to the allowedRedirectOrigins option (eg ${protocol}://${domain}:${port}). Doing that will also allow us to drop the /* path default origins. If we want to match paths in allowedRedirectOrigins i would advise we rename the options. cc: @nikosdouvlis

The /* part should not be required for someone to use allowedRedirectOrigins successfully. These tests cover almost all valid use cases (

javascript/packages/clerk-js/src/utils/__tests__/url.test.ts

Line 421 in d37d44a

const cases: [string, Array<string | RegExp> | undefined, boolean][] = [

) without /*

Are you suggesting we manually remove /* if the user passes it in? Would that offer any benefit DX-wise?

[dimkl]

❓ could we use the inBrowser() helper instead? @anagstef wdyt?

[octoper]

Oh I had that but change it as another utility function in the same file had it like this so I stick with that for consistency, but I can change to the inBrowser for every function here.

[dimkl]

🚀