Skip to content

fix(ui): Fix email link race with sign up if missing - #9328

Merged
dmoerner merged 2 commits into
mainfrom
daniel/signupifmissing-transfer-race
Aug 4, 2026
Merged

fix(ui): Fix email link race with sign up if missing#9328
dmoerner merged 2 commits into
mainfrom
daniel/signupifmissing-transfer-race

Conversation

@dmoerner

@dmoerner dmoerner commented Aug 4, 2026

Copy link
Copy Markdown
Contributor

Follow up fix for #7928 after additional testing in staging.

With development instances, there can be races between the polling and new email link tabs when processing a sign up through the sign-in-or-up flow with strict enumeration protection enabled. Late in the review process on that PR, I added an attempt to avoid these kinds of races, but it was a regression on dev instances when the sign up completes without extra requirements. ec83f7c

Revert that fix, and also add improved redirect handling in the case where the flow completes immediately.

This has the cost that if someone closes the original tab, they are unable to complete the sign up. (That was what we were trying to fix during PR review.) However, there is no easy solution to that problem (and the solution that we attempted to implement to fix it was not successful.) Since email links are so little used, I think we should accept that as a cost for now. If someone closes the original tab, they will just need to start the flow again.

This was tested locally against staging and I was no longer able to produce races with dev instances.

End to end validation I performed on this branch:

  • Email link sign in with existing user
  • Email link sign in transfer to sign up missing requirements
  • Email link sign in transfer to sign up complete (this was the regression)
  • Email link sign up
  • Email code sign in transfer to sign up missing requirements
  • Email code sign in with existing user

Description

Checklist

  • pnpm test runs as expected.
  • pnpm build runs as expected.
  • (If applicable) JSDoc comments have been added or updated for any package exports
  • (If applicable) Documentation has been updated

Type of change

  • 🐛 Bug fix
  • 🌟 New feature
  • 🔨 Breaking change
  • 📖 Refactoring / dependency upgrade / documentation
  • other:

Follow up fix for #7928 after
additional test in staging.

With development instances, there can be races between the polling and
new email link tabs. These races were made worse by an attempted fix
late in the review process on that PR, and although I thought I tested
the different flows, I missed cases where the sign up completes
immediately without extra requirements ec83f7c

Revert that fix, and also add improved redirect handling in the case
where the flow completes immediately.

This was tested locally against staging and I was no longer able to
produce races with dev instances.
@vercel

vercel Bot commented Aug 4, 2026

Copy link
Copy Markdown

The latest updates on your projects. Learn more about Vercel for GitHub.

Project Deployment Actions Updated (UTC)
clerk-js-sandbox Ready Ready Preview Aug 4, 2026 3:54pm
swingset Ready Ready Preview Aug 4, 2026 3:54pm

Request Review

@changeset-bot

changeset-bot Bot commented Aug 4, 2026

Copy link
Copy Markdown

🦋 Changeset detected

Latest commit: 05b94d6

The changes in this PR will be included in the next version bump.

This PR includes changesets to release 3 packages
Name Type
@clerk/ui Patch
@clerk/chrome-extension Patch
@clerk/swingset Patch

Not sure what this means? Click here to learn what changesets are.

Click here if you're a maintainer who wants to add another changeset to this PR

@coderabbitai

coderabbitai Bot commented Aug 4, 2026

Copy link
Copy Markdown
Contributor

Review Change Stack

📝 Walkthrough

Walkthrough

Transferable email-link verification now uses the sign-up-if-missing transfer flow from the sign-in factor card. The verification tab no longer consumes transfers through a local callback. Completed transfers activate the session. Pending tasks use in-component navigation, while terminal redirects use window navigation. Tests cover these flows.

Estimated code review effort: 3 (Moderate) | ~25 minutes

Possibly related PRs

Suggested reviewers: wobsoriano

🚥 Pre-merge checks | ✅ 5
✅ Passed checks (5 passed)
Check name Status Explanation
Docstring Coverage ✅ Passed No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check.
Linked Issues check ✅ Passed Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check ✅ Passed Check skipped because no linked issues were found for this pull request.
Title check ✅ Passed The title clearly identifies the email-link race fix in the sign-up-if-missing flow.
Description check ✅ Passed The description explains the race condition, redirect handling, trade-offs, and validation performed for the changeset.

Comment @coderabbitai help to get the list of available commands.

@pkg-pr-new

pkg-pr-new Bot commented Aug 4, 2026

Copy link
Copy Markdown

Open in StackBlitz

@clerk/astro

npm i https://pkg.pr.new/@clerk/astro@9328

@clerk/backend

npm i https://pkg.pr.new/@clerk/backend@9328

@clerk/chrome-extension

npm i https://pkg.pr.new/@clerk/chrome-extension@9328

@clerk/clerk-js

npm i https://pkg.pr.new/@clerk/clerk-js@9328

@clerk/electron

npm i https://pkg.pr.new/@clerk/electron@9328

@clerk/electron-passkeys

npm i https://pkg.pr.new/@clerk/electron-passkeys@9328

@clerk/eslint-plugin

npm i https://pkg.pr.new/@clerk/eslint-plugin@9328

@clerk/expo

npm i https://pkg.pr.new/@clerk/expo@9328

@clerk/expo-google-signin

npm i https://pkg.pr.new/@clerk/expo-google-signin@9328

@clerk/expo-passkeys

npm i https://pkg.pr.new/@clerk/expo-passkeys@9328

@clerk/express

npm i https://pkg.pr.new/@clerk/express@9328

@clerk/fastify

npm i https://pkg.pr.new/@clerk/fastify@9328

@clerk/hono

npm i https://pkg.pr.new/@clerk/hono@9328

@clerk/localizations

npm i https://pkg.pr.new/@clerk/localizations@9328

@clerk/nextjs

npm i https://pkg.pr.new/@clerk/nextjs@9328

@clerk/nuxt

npm i https://pkg.pr.new/@clerk/nuxt@9328

@clerk/react

npm i https://pkg.pr.new/@clerk/react@9328

@clerk/react-router

npm i https://pkg.pr.new/@clerk/react-router@9328

@clerk/shared

npm i https://pkg.pr.new/@clerk/shared@9328

@clerk/tanstack-react-start

npm i https://pkg.pr.new/@clerk/tanstack-react-start@9328

@clerk/testing

npm i https://pkg.pr.new/@clerk/testing@9328

@clerk/ui

npm i https://pkg.pr.new/@clerk/ui@9328

@clerk/upgrade

npm i https://pkg.pr.new/@clerk/upgrade@9328

@clerk/vue

npm i https://pkg.pr.new/@clerk/vue@9328

commit: 05b94d6

@github-actions

github-actions Bot commented Aug 4, 2026

Copy link
Copy Markdown
Contributor

API Changes Report

Generated by Break Check on 2026-08-04T15:54:18.462Z

Summary

Metric Count
Packages analyzed 19
Packages with changes 0
🔴 Breaking changes 0
🟡 Non-breaking changes 0
🟢 Additions 0

No API Changes Detected

All packages have stable APIs with no detected changes.


Report generated by Break Check

Last ran on 05b94d6.

@wobsoriano wobsoriano left a comment

Copy link
Copy Markdown
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

i got you

@dmoerner
dmoerner merged commit 83a8fc5 into main Aug 4, 2026
86 of 87 checks passed
@dmoerner
dmoerner deleted the daniel/signupifmissing-transfer-race branch August 4, 2026 16:17
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

Projects

None yet

Development

Successfully merging this pull request may close these issues.

2 participants