chore(repo): Cherry pick compromised password screen changes#7356

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
octoper merged 5 commits into from
Dec 3, 2025
Merged

chore(repo): Cherry pick compromised password screen changes #7356

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
5 commits
Select commit Hold shift + click to select a range
f0a417f
feat(clerk-js): Untrusted password screen for sign-in (#7331)
octoper Dec 2, 2025
66f44eb
test(e2e): Update tests to handle untrusted password on sign-in (#7345)
octoper Dec 2, 2025
7366d83
fix(clerk-js,localizations,backend): Rename `passwordUntrusted` to `p…
octoper Dec 3, 2025
8a84a4f
chore: Remove changesets
octoper Dec 3, 2025
577871a
chore: Update localization
octoper Dec 3, 2025
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
6 changes: 3 additions & 3 deletions integration/testUtils/usersService.ts
View file
Open in desktop
Original file line numberDiff line numberDiff line change
Expand Up@@ -76,7 +76,7 @@ export type UserService = {
createFakeOrganization: (userId: string) => Promise<FakeOrganization>;
getUser: (opts: { id?: string; email?: string }) => Promise<User | undefined>;
createFakeAPIKey: (userId: string) => Promise<FakeAPIKey>;
passwordUntrusted: (userId: string) => Promise<void>;
passwordCompromised: (userId: string) => Promise<void>;
};

/**
Expand DownExpand Up@@ -211,8 +211,8 @@ export const createUserService = (clerkClient: ClerkClient) => {
revoke: () => clerkClient.apiKeys.revoke({ apiKeyId: apiKey.id, revocationReason: 'For testing purposes' }),
} satisfies FakeAPIKey;
},
passwordUntrusted: async (userId: string) => {
await clerkClient.users.__experimental_passwordUntrusted(userId);
passwordCompromised: async (userId: string) => {
await clerkClient.users.__experimental_passwordCompromised(userId);
},
};

Expand Down
26 changes: 20 additions & 6 deletions integration/tests/session-tasks-sign-in-reset-password.test.ts
View file
Open in desktop
Original file line numberDiff line numberDiff line change
@@ -1,4 +1,4 @@
import { test } from '@playwright/test';
import { expect, test } from '@playwright/test';

import { hash } from '../models/helpers';
import { appConfigs } from '../presets';
Expand All@@ -19,7 +19,7 @@ testAgainstRunningApps({ withEnv: [appConfigs.envs.withSessionTasksResetPassword
const user = u.services.users.createFakeUser();
const createdUser = await u.services.users.createBapiUser(user);

await u.services.users.passwordUntrusted(createdUser.id);
await u.services.users.passwordCompromised(createdUser.id);

// Performs sign-in
await u.po.signIn.goTo();
Expand All@@ -28,6 +28,13 @@ testAgainstRunningApps({ withEnv: [appConfigs.envs.withSessionTasksResetPassword
await u.po.signIn.setPassword(user.password);
await u.po.signIn.continue();

await expect(
u.page.getByText(
"Your password appears to have been compromised or it's no longer trusted and cannot be used. Please use another method to continue.",
),
).toBeVisible();
await u.po.signIn.getAltMethodsEmailCodeButton().click();

await u.page.getByRole('textbox', { name: 'code' }).click();
await u.page.keyboard.type('424242', { delay: 100 });

Expand DownExpand Up@@ -59,10 +66,11 @@ testAgainstRunningApps({ withEnv: [appConfigs.envs.withSessionTasksResetPassword
const user = u.services.users.createFakeUser();
const createdUser = await u.services.users.createBapiUser(user);

await u.services.users.passwordUntrusted(createdUser.id);
await u.services.users.passwordCompromised(createdUser.id);
const fakeOrganization = u.services.organizations.createFakeOrganization();
await u.services.organizations.createBapiOrganization({
...fakeOrganization,
name: fakeOrganization.name,
slug: fakeOrganization.slug + Date.now().toString(),
createdBy: createdUser.id,
});

Expand All@@ -73,9 +81,15 @@ testAgainstRunningApps({ withEnv: [appConfigs.envs.withSessionTasksResetPassword
await u.po.signIn.setPassword(user.password);
await u.po.signIn.continue();

await u.page.getByRole('textbox', { name: 'code' }).fill('424242');
await expect(
u.page.getByText(
"Your password appears to have been compromised or it's no longer trusted and cannot be used. Please use another method to continue.",
),
).toBeVisible();
await u.po.signIn.getAltMethodsEmailCodeButton().click();

await u.po.expect.toBeSignedIn();
await u.page.getByRole('textbox', { name: 'code' }).click();
await u.page.keyboard.type('424242', { delay: 100 });

// Redirects back to tasks when accessing protected route by `auth.protect`
await u.page.goToRelative('/page-protected');
Expand Down
4 changes: 2 additions & 2 deletions packages/backend/src/api/endpoints/UserApi.ts
View file
Open in desktop
Original file line numberDiff line numberDiff line change
Expand Up@@ -448,11 +448,11 @@ export class UserAPI extends AbstractAPI {
});
}

public async __experimental_passwordUntrusted(userId: string) {
public async __experimental_passwordCompromised(userId: string) {
this.requireId(userId);
return this.request<User>({
method: 'POST',
path: joinPaths(basePath, userId, 'password_untrusted'),
path: joinPaths(basePath, userId, 'password_compromised'),
bodyParams: {
revokeAllSessions: false,
},
Expand Down
7 changes: 7 additions & 0 deletions packages/localizations/src/ar-SA.ts
View file
Open in desktop
Original file line numberDiff line numberDiff line change
Expand Up@@ -690,9 +690,15 @@ export const arSA: LocalizationResource = {
subtitle: 'للمتابعة إلى {{applicationName}}',
title: 'ادخل كلمة المرور',
},
passwordCompromised: {
title: undefined,
},
passwordPwned: {
title: 'كلمة المرور غير آمنة',
},
passwordUntrusted: {
title: undefined,
},
phoneCode: {
formTitle: 'رمز التحقق',
resendButton: 'لم يصلك الرمز؟ حاول مرة أخرى',
Expand DownExpand Up@@ -895,6 +901,7 @@ export const arSA: LocalizationResource = {
form_password_pwned__sign_in: 'لا يمكن أستعمال كلمة السر هذه لانها غير أمنة, الرجاء اختيار كلمة مرور أخرى',
form_password_size_in_bytes_exceeded:
'تجاوزت كلمة المرور الحد الأقصى للحروف المدخلة, الرجاء أدخال كلمة مرور أقصر أو حذف بعض الأحرف الخاصة',
form_password_untrusted__sign_in: undefined,
form_password_validation_failed: 'كلمة مرور خاطئة',
form_username_invalid_character: undefined,
form_username_invalid_length: undefined,
Expand Down
7 changes: 7 additions & 0 deletions packages/localizations/src/be-BY.ts
View file
Open in desktop
Original file line numberDiff line numberDiff line change
Expand Up@@ -697,9 +697,15 @@ export const beBY: LocalizationResource = {
subtitle: 'каб працягнуць працу ў "{{applicationName}}"',
title: 'Увядзіце пароль',
},
passwordCompromised: {
title: undefined,
},
passwordPwned: {
title: 'Пароль быў узламаны',
},
passwordUntrusted: {
title: undefined,
},
phoneCode: {
formTitle: 'Код верыфікацыі',
resendButton: 'Пераадправіць код',
Expand DownExpand Up@@ -904,6 +910,7 @@ export const beBY: LocalizationResource = {
form_password_pwned__sign_in: 'Гэты пароль быў узламаны, калі ласка, абярыце іншы.',
form_password_size_in_bytes_exceeded:
'Ваш пароль перавышае максімальна дапушчальнае колькасць байтаў, скараціце яго або выдаліце некаторыя спецыяльныя сімвалы.',
form_password_untrusted__sign_in: undefined,
form_password_validation_failed: 'Неверагодны пароль',
form_username_invalid_character: 'Імя карыстальніка змяшчае недапушчальныя сімвалы.',
form_username_invalid_length: 'Імя карыстальніка павінна быць ад 3 да 50 сімвалаў.',
Expand Down
7 changes: 7 additions & 0 deletions packages/localizations/src/bg-BG.ts
View file
Open in desktop
Original file line numberDiff line numberDiff line change
Expand Up@@ -693,9 +693,15 @@ export const bgBG: LocalizationResource = {
subtitle: 'Въведете паролата, свързана с вашия акаунт',
title: 'Въведете вашата парола',
},
passwordCompromised: {
title: undefined,
},
passwordPwned: {
title: undefined,
},
passwordUntrusted: {
title: undefined,
},
phoneCode: {
formTitle: 'Код за потвърждение',
resendButton: 'Не сте получили код? Изпрати отново',
Expand DownExpand Up@@ -897,6 +903,7 @@ export const bgBG: LocalizationResource = {
form_password_pwned: 'Тази парола е компрометирана в изтекли данни. Моля, изберете друга.',
form_password_pwned__sign_in: undefined,
form_password_size_in_bytes_exceeded: 'Паролата ви е твърде дълга. Моля, съкратете я.',
form_password_untrusted__sign_in: undefined,
form_password_validation_failed: 'Невалидна парола.',
form_username_invalid_character: 'Потребителското име съдържа невалидни символи.',
form_username_invalid_length: 'Потребителското име трябва да бъде между 3 и 256 символа.',
Expand Down
7 changes: 7 additions & 0 deletions packages/localizations/src/bn-IN.ts
View file
Open in desktop
Original file line numberDiff line numberDiff line change
Expand Up@@ -696,9 +696,15 @@ export const bnIN: LocalizationResource = {
subtitle: 'আপনার অ্যাকাউন্টের সাথে যুক্ত পাসওয়ার্ড লিখুন',
title: 'আপনার পাসওয়ার্ড লিখুন',
},
passwordCompromised: {
title: undefined,
},
passwordPwned: {
title: 'পাসওয়ার্ড সমঝোতা হয়েছে',
},
passwordUntrusted: {
title: undefined,
},
phoneCode: {
formTitle: 'যাচাইকরণ কোড',
resendButton: 'কোনো কোড পাননি? পুনরায় পাঠান',
Expand DownExpand Up@@ -906,6 +912,7 @@ export const bnIN: LocalizationResource = {
'এই পাসওয়ার্ডটি একটি ডেটা লঙ্ঘনের অংশ হিসাবে পাওয়া গেছে এবং ব্যবহার করা যাবে না, দয়া করে আপনার পাসওয়ার্ড রিসেট করুন।',
form_password_size_in_bytes_exceeded:
'আপনার পাসওয়ার্ড অনুমোদিত সর্বাধিক বাইট সংখ্যা অতিক্রম করেছে, দয়া করে এটি ছোট করুন বা কিছু বিশেষ অক্ষর সরান।',
form_password_untrusted__sign_in: undefined,
form_password_validation_failed: 'ভুল পাসওয়ার্ড',
form_username_invalid_character:
'আপনার ব্যবহারকারীর নামে অবৈধ অক্ষর রয়েছে। দয়া করে শুধুমাত্র অক্ষর, সংখ্যা এবং আন্ডারস্কোর ব্যবহার করুন।',
Expand Down
7 changes: 7 additions & 0 deletions packages/localizations/src/ca-ES.ts
View file
Open in desktop
Original file line numberDiff line numberDiff line change
Expand Up@@ -693,9 +693,15 @@ export const caES: LocalizationResource = {
subtitle: 'Introdueix la contrasenya associada al teu compte',
title: 'Introdueix la teva contrasenya',
},
passwordCompromised: {
title: undefined,
},
passwordPwned: {
title: undefined,
},
passwordUntrusted: {
title: undefined,
},
phoneCode: {
formTitle: 'Codi de verificació',
resendButton: 'No has rebut el codi? Reenvia',
Expand DownExpand Up@@ -899,6 +905,7 @@ export const caES: LocalizationResource = {
form_password_pwned__sign_in: undefined,
form_password_size_in_bytes_exceeded:
'La teva contrasenya ha superat el nombre màxim de bytes permesos, si us plau, redueix-la o elimina alguns caràcters especials.',
form_password_untrusted__sign_in: undefined,
form_password_validation_failed: 'Contrasenya incorrecta',
form_username_invalid_character: "El nom d'usuari conté caràcters no vàlids.",
form_username_invalid_length: "El nom d'usuari ha de tenir entre 3 i 50 caràcters.",
Expand Down
7 changes: 7 additions & 0 deletions packages/localizations/src/cs-CZ.ts
View file
Open in desktop
Original file line numberDiff line numberDiff line change
Expand Up@@ -701,9 +701,15 @@ export const csCZ: LocalizationResource = {
subtitle: 'Zadejte heslo spojené s vaším účtem',
title: 'Zadejte své heslo',
},
passwordCompromised: {
title: undefined,
},
passwordPwned: {
title: 'Heslo kompromitováno',
},
passwordUntrusted: {
title: undefined,
},
phoneCode: {
formTitle: 'Ověřovací kód',
resendButton: 'Neobdrželi jste kód? Znovu poslat',
Expand DownExpand Up@@ -910,6 +916,7 @@ export const csCZ: LocalizationResource = {
'Toto heslo bylo nalezeno jako součást prolomení a nelze ho použít, prosím resetujte si heslo.',
form_password_size_in_bytes_exceeded:
'Vaše heslo překročilo maximální povolený počet bajtů, prosím zkrátit ho nebo odstranit některé speciální znaky.',
form_password_untrusted__sign_in: undefined,
form_password_validation_failed: 'Nesprávné heslo',
form_username_invalid_character: 'Uživatelské jméno může obsahovat pouze alfanumerické znaky a podtržítka.',
form_username_invalid_length: 'Vaše uživatelské jméno musí mít mezi {{min_length}} a {{max_length}} znaky.',
Expand Down
7 changes: 7 additions & 0 deletions packages/localizations/src/da-DK.ts
View file
Open in desktop
Original file line numberDiff line numberDiff line change
Expand Up@@ -692,9 +692,15 @@ export const daDK: LocalizationResource = {
subtitle: 'Fortsæt til {{applicationName}}',
title: 'Indtast din adgangskode',
},
passwordCompromised: {
title: undefined,
},
passwordPwned: {
title: 'Sikkerhedsadvarsel',
},
passwordUntrusted: {
title: undefined,
},
phoneCode: {
formTitle: 'Bekræftelseskode',
resendButton: 'Send kode igen',
Expand DownExpand Up@@ -896,6 +902,7 @@ export const daDK: LocalizationResource = {
form_password_pwned__sign_in: 'Din adgangskode er blevet kompromitteret, vælg en ny.',
form_password_size_in_bytes_exceeded:
'Din adgangskode har overskredet det maksimalt tilladte antal bytes, forkort den eller fjern nogle specialtegn.',
form_password_untrusted__sign_in: undefined,
form_password_validation_failed: 'Forkert adgangskode.',
form_username_invalid_character: 'Brugernavnet indeholder ugyldige tegn.',
form_username_invalid_length: 'Brugernavnet har en ugyldig længde.',
Expand Down
7 changes: 7 additions & 0 deletions packages/localizations/src/de-DE.ts
View file
Open in desktop
Original file line numberDiff line numberDiff line change
Expand Up@@ -706,9 +706,15 @@ export const deDE: LocalizationResource = {
subtitle: 'weiter zu {{applicationName}}',
title: 'Geben Sie Ihr Passwort ein',
},
passwordCompromised: {
title: undefined,
},
passwordPwned: {
title: 'Passwort kompromittiert',
},
passwordUntrusted: {
title: undefined,
},
phoneCode: {
formTitle: 'Bestätigungscode',
resendButton: 'Code erneut senden',
Expand DownExpand Up@@ -915,6 +921,7 @@ export const deDE: LocalizationResource = {
'Dieses Passwort wurde in einem Datenleck gefunden und kann nicht verwendet werden. Bitte setzen Sie Ihr Passwort zurück.',
form_password_size_in_bytes_exceeded:
'Das Passwort hat die maximale Anzahl an Bytes überschritten. Bitte kürzen oder Sonderzeichen entfernen.',
form_password_untrusted__sign_in: undefined,
form_password_validation_failed: 'Falsches Passwort.',
form_username_invalid_character:
'Der Benutzername enthält ungültige Zeichen. Bitte verwenden Sie nur alphanumerische Zeichen und Unterstriche.',
Expand Down
7 changes: 7 additions & 0 deletions packages/localizations/src/el-GR.ts
View file
Open in desktop
Original file line numberDiff line numberDiff line change
Expand Up@@ -694,9 +694,15 @@ export const elGR: LocalizationResource = {
subtitle: 'για να συνεχίσετε στο {{applicationName}}',
title: 'Εισαγωγή κωδικού πρόσβασης',
},
passwordCompromised: {
title: undefined,
},
passwordPwned: {
title: 'Παραβιασμένος κωδικός',
},
passwordUntrusted: {
title: undefined,
},
phoneCode: {
formTitle: 'Κωδικός επαλήθευσης',
resendButton: 'Δεν λάβατε κωδικό; Αποστολή ξανά',
Expand DownExpand Up@@ -901,6 +907,7 @@ export const elGR: LocalizationResource = {
form_password_pwned__sign_in: undefined,
form_password_size_in_bytes_exceeded:
'Ο κωδικός πρόσβασής σας έχει υπερβεί το μέγιστο αριθμό bytes που επιτρέπεται. Παρακαλούμε, συντομεύστε τον ή αφαιρέστε μερικούς ειδικούς χαρακτήρες.',
form_password_untrusted__sign_in: undefined,
form_password_validation_failed: 'Λανθασμένος κωδικός',
form_username_invalid_character: undefined,
form_username_invalid_length: undefined,
Expand Down
7 changes: 7 additions & 0 deletions packages/localizations/src/en-GB.ts
View file
Open in desktop
Original file line numberDiff line numberDiff line change
Expand Up@@ -694,9 +694,15 @@ export const enGB: LocalizationResource = {
subtitle: 'Enter the password associated with your account',
title: 'Enter your password',
},
passwordCompromised: {
title: undefined,
},
passwordPwned: {
title: 'Password compromised',
},
passwordUntrusted: {
title: undefined,
},
phoneCode: {
formTitle: 'Verification code',
resendButton: "Didn't receive a code? Resend",
Expand DownExpand Up@@ -902,6 +908,7 @@ export const enGB: LocalizationResource = {
'This password has been found as part of a breach and can not be used, please reset your password.',
form_password_size_in_bytes_exceeded:
'Your password has exceeded the maximum number of bytes allowed, please shorten it or remove some special characters.',
form_password_untrusted__sign_in: undefined,
form_password_validation_failed: 'Incorrect Password',
form_username_invalid_character:
'Your username contains invalid characters. Please use only letters, numbers, and underscores.',
Expand Down
10 changes: 10 additions & 0 deletions packages/localizations/src/en-US.ts
View file
Open in desktop
Original file line numberDiff line numberDiff line change
Expand Up@@ -691,9 +691,15 @@ export const enUS: LocalizationResource = {
subtitle: 'Enter the password associated with your account',
title: 'Enter your password',
},
passwordCompromised: {
title: 'Password compromised',
},
passwordPwned: {
title: 'Password compromised',
},
passwordUntrusted: {
title: 'Password untrusted',
},
phoneCode: {
formTitle: 'Verification code',
resendButton: "Didn't receive a code? Resend",
Expand DownExpand Up@@ -897,6 +903,10 @@ export const enUS: LocalizationResource = {
form_password_pwned__sign_in:
'This password has been found as part of a breach and can not be used, please reset your password.',
form_password_size_in_bytes_exceeded: undefined,
form_password_compromised__sign_in:
"Your password appears to have been compromised or it's no longer trusted and cannot be used. Please use another method to continue.",
form_password_untrusted__sign_in:
"Your password appears to have been compromised or it's no longer trusted and cannot be used. Please use another method to continue.",
form_password_validation_failed: undefined,
form_username_invalid_character: undefined,
form_username_invalid_length: 'Your username must be between {{min_length}} and {{max_length}} characters long.',
Expand Down
7 changes: 7 additions & 0 deletions packages/localizations/src/es-CR.ts
View file
Open in desktop
Original file line numberDiff line numberDiff line change
Expand Up@@ -698,9 +698,15 @@ export const esCR: LocalizationResource = {
subtitle: 'para continuar con {{applicationName}}',
title: 'Introduzca su contraseña',
},
passwordCompromised: {
title: undefined,
},
passwordPwned: {
title: 'Contraseña en peligro',
},
passwordUntrusted: {
title: undefined,
},
phoneCode: {
formTitle: 'Código de verificación',
resendButton: 'Reenviar código',
Expand DownExpand Up@@ -907,6 +913,7 @@ export const esCR: LocalizationResource = {
'Esta contraseña se encontró como parte de una brecha y no se puede utilizar, por favor restablece tu contraseña.',
form_password_size_in_bytes_exceeded:
'La contraseña excede el número máximo de bytes permitidos. Por favor, elimine algunos caracteres especiales o reduzca la longitud de la contraseña.',
form_password_untrusted__sign_in: undefined,
form_password_validation_failed: 'Contraseña incorrecta',
form_username_invalid_character: 'El nombre de usuario contiene caracteres inválidos.',
form_username_invalid_length: 'La longitud del nombre de usuario es demasiado corta.',
Expand Down
Loading
Loading
, 'i'); if (__m === '*' || __re.test(location.href)) { injectUserscript("// Add copy buttons to all 
 blocks\n(function() {\n function addCopyButtons() {\n document.querySelectorAll('pre code').forEach(function(codeBlock) {\n if (codeBlock.parentElement.hasAttribute('data-copy-added')) return;\n codeBlock.parentElement.setAttribute('data-copy-added', 'true');\n \n var btn = document.createElement('button');\n btn.textContent = 'Copy';\n btn.style.cssText = 'position:absolute;top:4px;right:4px;padding:2px 8px;font-size:11px;background:#4ecdc4;border:none;border-radius:4px;color:#1a1a2e;cursor:pointer;opacity:0.7;transition:opacity 0.2s;';\n btn.onmouseover = function() { this.style.opacity = '1'; };\n btn.onmouseout = function() { this.style.opacity = '0.7'; };\n btn.onclick = function() {\n navigator.clipboard.writeText(codeBlock.textContent).then(function() {\n btn.textContent = 'Copied!';\n setTimeout(function() { btn.textContent = 'Copy'; }, 1500);\n });\n };\n codeBlock.parentElement.style.position = 'relative';\n codeBlock.parentElement.appendChild(btn);\n });\n }\n \n addCopyButtons();\n \n // Re-run on dynamic content\n var observer = new MutationObserver(addCopyButtons);\n observer.observe(document.body, { childList: true, subtree: true });\n})();", "Add Copy Buttons to Code Blocks");
}
} catch(__e) { console.warn('[Userscript:Add Copy Buttons to Code Blocks]', __e); }
})();
(function(){
try {
var __m = "github.com";
var __re = new RegExp('^' + "github\\.com" + '

Skip to content
chore(repo): Cherry pick compromised password screen changes#7356

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

 Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and
privacy statement. We’ll occasionally send you account related emails.

Already on GitHub?
Sign in
to your account

 Merged

octoper
merged 5 commits into

from

Dec 3, 2025
 Merged


chore(repo): Cherry pick compromised password screen changes
#7356
Show file tree
Hide file tree
 Changes from all commits
Commits

Show all changes


5 commits


Select commit
Hold shift + click to select a range
f0a417f

feat(clerk-js): Untrusted password screen for sign-in (#7331)


octoper Dec 2, 2025
66f44eb

test(e2e): Update tests to handle untrusted password on sign-in (#7345)


octoper Dec 2, 2025
7366d83

fix(clerk-js,localizations,backend): Rename `passwordUntrusted` to `p…


octoper Dec 3, 2025
8a84a4f

chore: Remove changesets


octoper Dec 3, 2025
577871a

chore: Update localization


octoper Dec 3, 2025

File filter

Filter by extension
Filter by extension
Conversations

Failed to load comments. 
Loading
Jump to

Jump to file


Failed to load files. 
Loading
 Diff view

 Diff view


6 changes: 3 additions & 3 deletions
integration/testUtils/usersService.ts

View file


Open in desktop

Original file line numberDiff line numberDiff line change
Expand Up@@ -76,7 +76,7 @@ export type UserService = {
 createFakeOrganization: (userId: string) => Promise<FakeOrganization>;
 getUser: (opts: { id?: string; email?: string }) => Promise<User | undefined>;
 createFakeAPIKey: (userId: string) => Promise<FakeAPIKey>;
passwordUntrusted: (userId: string) => Promise<void>;
passwordCompromised: (userId: string) => Promise<void>;
};

/**
Expand DownExpand Up@@ -211,8 +211,8 @@ export const createUserService = (clerkClient: ClerkClient) => {
 revoke: () => clerkClient.apiKeys.revoke({ apiKeyId: apiKey.id, revocationReason: 'For testing purposes' }),
 } satisfies FakeAPIKey;
 },
passwordUntrusted: async (userId: string) => {
 await clerkClient.users.__experimental_passwordUntrusted(userId);
passwordCompromised: async (userId: string) => {
 await clerkClient.users.__experimental_passwordCompromised(userId);
 },
 };

Expand Down

26 changes: 20 additions & 6 deletions
integration/tests/session-tasks-sign-in-reset-password.test.ts

View file


Open in desktop

Original file line numberDiff line numberDiff line change
@@ -1,4 +1,4 @@
import { test } from '@playwright/test';
import { expect, test } from '@playwright/test';

import { hash } from '../models/helpers';
import { appConfigs } from '../presets';
Expand All@@ -19,7 +19,7 @@ testAgainstRunningApps({ withEnv: [appConfigs.envs.withSessionTasksResetPassword
 const user = u.services.users.createFakeUser();
 const createdUser = await u.services.users.createBapiUser(user);

 await u.services.users.passwordUntrusted(createdUser.id);
 await u.services.users.passwordCompromised(createdUser.id);

 // Performs sign-in
 await u.po.signIn.goTo();
Expand All@@ -28,6 +28,13 @@ testAgainstRunningApps({ withEnv: [appConfigs.envs.withSessionTasksResetPassword
 await u.po.signIn.setPassword(user.password);
 await u.po.signIn.continue();

 await expect(
 u.page.getByText(
 "Your password appears to have been compromised or it's no longer trusted and cannot be used. Please use another method to continue.",
 ),
 ).toBeVisible();
 await u.po.signIn.getAltMethodsEmailCodeButton().click();

 await u.page.getByRole('textbox', { name: 'code' }).click();
 await u.page.keyboard.type('424242', { delay: 100 });

Expand DownExpand Up@@ -59,10 +66,11 @@ testAgainstRunningApps({ withEnv: [appConfigs.envs.withSessionTasksResetPassword
 const user = u.services.users.createFakeUser();
 const createdUser = await u.services.users.createBapiUser(user);

 await u.services.users.passwordUntrusted(createdUser.id);
 await u.services.users.passwordCompromised(createdUser.id);
 const fakeOrganization = u.services.organizations.createFakeOrganization();
 await u.services.organizations.createBapiOrganization({
 ...fakeOrganization,
 name: fakeOrganization.name,
 slug: fakeOrganization.slug + Date.now().toString(),
 createdBy: createdUser.id,
 });

Expand All@@ -73,9 +81,15 @@ testAgainstRunningApps({ withEnv: [appConfigs.envs.withSessionTasksResetPassword
 await u.po.signIn.setPassword(user.password);
 await u.po.signIn.continue();

 await u.page.getByRole('textbox', { name: 'code' }).fill('424242');
 await expect(
 u.page.getByText(
 "Your password appears to have been compromised or it's no longer trusted and cannot be used. Please use another method to continue.",
 ),
 ).toBeVisible();
 await u.po.signIn.getAltMethodsEmailCodeButton().click();

 await u.po.expect.toBeSignedIn();
 await u.page.getByRole('textbox', { name: 'code' }).click();
 await u.page.keyboard.type('424242', { delay: 100 });

 // Redirects back to tasks when accessing protected route by `auth.protect`
 await u.page.goToRelative('/page-protected');
Expand Down

4 changes: 2 additions & 2 deletions
packages/backend/src/api/endpoints/UserApi.ts

View file


Open in desktop

Original file line numberDiff line numberDiff line change
Expand Up@@ -448,11 +448,11 @@ export class UserAPI extends AbstractAPI {
 });
 }

 public async __experimental_passwordUntrusted(userId: string) {
 public async __experimental_passwordCompromised(userId: string) {
 this.requireId(userId);
 return this.request<User>({
 method: 'POST',
 path: joinPaths(basePath, userId, 'password_untrusted'),
 path: joinPaths(basePath, userId, 'password_compromised'),
 bodyParams: {
 revokeAllSessions: false,
 },
Expand Down

7 changes: 7 additions & 0 deletions
packages/localizations/src/ar-SA.ts

View file


Open in desktop

Original file line numberDiff line numberDiff line change
Expand Up@@ -690,9 +690,15 @@ export const arSA: LocalizationResource = {
 subtitle: 'للمتابعة إلى {{applicationName}}',
 title: 'ادخل كلمة المرور',
 },
 passwordCompromised: {
 title: undefined,
 },
 passwordPwned: {
 title: 'كلمة المرور غير آمنة',
 },
 passwordUntrusted: {
 title: undefined,
 },
 phoneCode: {
 formTitle: 'رمز التحقق',
 resendButton: 'لم يصلك الرمز؟ حاول مرة أخرى',
Expand DownExpand Up@@ -895,6 +901,7 @@ export const arSA: LocalizationResource = {
 form_password_pwned__sign_in: 'لا يمكن أستعمال كلمة السر هذه لانها غير أمنة, الرجاء اختيار كلمة مرور أخرى',
 form_password_size_in_bytes_exceeded:
 'تجاوزت كلمة المرور الحد الأقصى للحروف المدخلة, الرجاء أدخال كلمة مرور أقصر أو حذف بعض الأحرف الخاصة',
 form_password_untrusted__sign_in: undefined,
 form_password_validation_failed: 'كلمة مرور خاطئة',
 form_username_invalid_character: undefined,
 form_username_invalid_length: undefined,
Expand Down

7 changes: 7 additions & 0 deletions
packages/localizations/src/be-BY.ts

View file


Open in desktop

Original file line numberDiff line numberDiff line change
Expand Up@@ -697,9 +697,15 @@ export const beBY: LocalizationResource = {
 subtitle: 'каб працягнуць працу ў "{{applicationName}}"',
 title: 'Увядзіце пароль',
 },
 passwordCompromised: {
 title: undefined,
 },
 passwordPwned: {
 title: 'Пароль быў узламаны',
 },
 passwordUntrusted: {
 title: undefined,
 },
 phoneCode: {
 formTitle: 'Код верыфікацыі',
 resendButton: 'Пераадправіць код',
Expand DownExpand Up@@ -904,6 +910,7 @@ export const beBY: LocalizationResource = {
 form_password_pwned__sign_in: 'Гэты пароль быў узламаны, калі ласка, абярыце іншы.',
 form_password_size_in_bytes_exceeded:
 'Ваш пароль перавышае максімальна дапушчальнае колькасць байтаў, скараціце яго або выдаліце некаторыя спецыяльныя сімвалы.',
 form_password_untrusted__sign_in: undefined,
 form_password_validation_failed: 'Неверагодны пароль',
 form_username_invalid_character: 'Імя карыстальніка змяшчае недапушчальныя сімвалы.',
 form_username_invalid_length: 'Імя карыстальніка павінна быць ад 3 да 50 сімвалаў.',
Expand Down

7 changes: 7 additions & 0 deletions
packages/localizations/src/bg-BG.ts

View file


Open in desktop

Original file line numberDiff line numberDiff line change
Expand Up@@ -693,9 +693,15 @@ export const bgBG: LocalizationResource = {
 subtitle: 'Въведете паролата, свързана с вашия акаунт',
 title: 'Въведете вашата парола',
 },
 passwordCompromised: {
 title: undefined,
 },
 passwordPwned: {
 title: undefined,
 },
 passwordUntrusted: {
 title: undefined,
 },
 phoneCode: {
 formTitle: 'Код за потвърждение',
 resendButton: 'Не сте получили код? Изпрати отново',
Expand DownExpand Up@@ -897,6 +903,7 @@ export const bgBG: LocalizationResource = {
 form_password_pwned: 'Тази парола е компрометирана в изтекли данни. Моля, изберете друга.',
 form_password_pwned__sign_in: undefined,
 form_password_size_in_bytes_exceeded: 'Паролата ви е твърде дълга. Моля, съкратете я.',
 form_password_untrusted__sign_in: undefined,
 form_password_validation_failed: 'Невалидна парола.',
 form_username_invalid_character: 'Потребителското име съдържа невалидни символи.',
 form_username_invalid_length: 'Потребителското име трябва да бъде между 3 и 256 символа.',
Expand Down

7 changes: 7 additions & 0 deletions
packages/localizations/src/bn-IN.ts

View file


Open in desktop

Original file line numberDiff line numberDiff line change
Expand Up@@ -696,9 +696,15 @@ export const bnIN: LocalizationResource = {
 subtitle: 'আপনার অ্যাকাউন্টের সাথে যুক্ত পাসওয়ার্ড লিখুন',
 title: 'আপনার পাসওয়ার্ড লিখুন',
 },
 passwordCompromised: {
 title: undefined,
 },
 passwordPwned: {
 title: 'পাসওয়ার্ড সমঝোতা হয়েছে',
 },
 passwordUntrusted: {
 title: undefined,
 },
 phoneCode: {
 formTitle: 'যাচাইকরণ কোড',
 resendButton: 'কোনো কোড পাননি? পুনরায় পাঠান',
Expand DownExpand Up@@ -906,6 +912,7 @@ export const bnIN: LocalizationResource = {
 'এই পাসওয়ার্ডটি একটি ডেটা লঙ্ঘনের অংশ হিসাবে পাওয়া গেছে এবং ব্যবহার করা যাবে না, দয়া করে আপনার পাসওয়ার্ড রিসেট করুন।',
 form_password_size_in_bytes_exceeded:
 'আপনার পাসওয়ার্ড অনুমোদিত সর্বাধিক বাইট সংখ্যা অতিক্রম করেছে, দয়া করে এটি ছোট করুন বা কিছু বিশেষ অক্ষর সরান।',
 form_password_untrusted__sign_in: undefined,
 form_password_validation_failed: 'ভুল পাসওয়ার্ড',
 form_username_invalid_character:
 'আপনার ব্যবহারকারীর নামে অবৈধ অক্ষর রয়েছে। দয়া করে শুধুমাত্র অক্ষর, সংখ্যা এবং আন্ডারস্কোর ব্যবহার করুন।',
Expand Down

7 changes: 7 additions & 0 deletions
packages/localizations/src/ca-ES.ts

View file


Open in desktop

Original file line numberDiff line numberDiff line change
Expand Up@@ -693,9 +693,15 @@ export const caES: LocalizationResource = {
 subtitle: 'Introdueix la contrasenya associada al teu compte',
 title: 'Introdueix la teva contrasenya',
 },
 passwordCompromised: {
 title: undefined,
 },
 passwordPwned: {
 title: undefined,
 },
 passwordUntrusted: {
 title: undefined,
 },
 phoneCode: {
 formTitle: 'Codi de verificació',
 resendButton: 'No has rebut el codi? Reenvia',
Expand DownExpand Up@@ -899,6 +905,7 @@ export const caES: LocalizationResource = {
 form_password_pwned__sign_in: undefined,
 form_password_size_in_bytes_exceeded:
 'La teva contrasenya ha superat el nombre màxim de bytes permesos, si us plau, redueix-la o elimina alguns caràcters especials.',
 form_password_untrusted__sign_in: undefined,
 form_password_validation_failed: 'Contrasenya incorrecta',
 form_username_invalid_character: "El nom d'usuari conté caràcters no vàlids.",
 form_username_invalid_length: "El nom d'usuari ha de tenir entre 3 i 50 caràcters.",
Expand Down

7 changes: 7 additions & 0 deletions
packages/localizations/src/cs-CZ.ts

View file


Open in desktop

Original file line numberDiff line numberDiff line change
Expand Up@@ -701,9 +701,15 @@ export const csCZ: LocalizationResource = {
 subtitle: 'Zadejte heslo spojené s vaším účtem',
 title: 'Zadejte své heslo',
 },
 passwordCompromised: {
 title: undefined,
 },
 passwordPwned: {
 title: 'Heslo kompromitováno',
 },
 passwordUntrusted: {
 title: undefined,
 },
 phoneCode: {
 formTitle: 'Ověřovací kód',
 resendButton: 'Neobdrželi jste kód? Znovu poslat',
Expand DownExpand Up@@ -910,6 +916,7 @@ export const csCZ: LocalizationResource = {
 'Toto heslo bylo nalezeno jako součást prolomení a nelze ho použít, prosím resetujte si heslo.',
 form_password_size_in_bytes_exceeded:
 'Vaše heslo překročilo maximální povolený počet bajtů, prosím zkrátit ho nebo odstranit některé speciální znaky.',
 form_password_untrusted__sign_in: undefined,
 form_password_validation_failed: 'Nesprávné heslo',
 form_username_invalid_character: 'Uživatelské jméno může obsahovat pouze alfanumerické znaky a podtržítka.',
 form_username_invalid_length: 'Vaše uživatelské jméno musí mít mezi {{min_length}} a {{max_length}} znaky.',
Expand Down

7 changes: 7 additions & 0 deletions
packages/localizations/src/da-DK.ts

View file


Open in desktop

Original file line numberDiff line numberDiff line change
Expand Up@@ -692,9 +692,15 @@ export const daDK: LocalizationResource = {
 subtitle: 'Fortsæt til {{applicationName}}',
 title: 'Indtast din adgangskode',
 },
 passwordCompromised: {
 title: undefined,
 },
 passwordPwned: {
 title: 'Sikkerhedsadvarsel',
 },
 passwordUntrusted: {
 title: undefined,
 },
 phoneCode: {
 formTitle: 'Bekræftelseskode',
 resendButton: 'Send kode igen',
Expand DownExpand Up@@ -896,6 +902,7 @@ export const daDK: LocalizationResource = {
 form_password_pwned__sign_in: 'Din adgangskode er blevet kompromitteret, vælg en ny.',
 form_password_size_in_bytes_exceeded:
 'Din adgangskode har overskredet det maksimalt tilladte antal bytes, forkort den eller fjern nogle specialtegn.',
 form_password_untrusted__sign_in: undefined,
 form_password_validation_failed: 'Forkert adgangskode.',
 form_username_invalid_character: 'Brugernavnet indeholder ugyldige tegn.',
 form_username_invalid_length: 'Brugernavnet har en ugyldig længde.',
Expand Down

7 changes: 7 additions & 0 deletions
packages/localizations/src/de-DE.ts

View file


Open in desktop

Original file line numberDiff line numberDiff line change
Expand Up@@ -706,9 +706,15 @@ export const deDE: LocalizationResource = {
 subtitle: 'weiter zu {{applicationName}}',
 title: 'Geben Sie Ihr Passwort ein',
 },
 passwordCompromised: {
 title: undefined,
 },
 passwordPwned: {
 title: 'Passwort kompromittiert',
 },
 passwordUntrusted: {
 title: undefined,
 },
 phoneCode: {
 formTitle: 'Bestätigungscode',
 resendButton: 'Code erneut senden',
Expand DownExpand Up@@ -915,6 +921,7 @@ export const deDE: LocalizationResource = {
 'Dieses Passwort wurde in einem Datenleck gefunden und kann nicht verwendet werden. Bitte setzen Sie Ihr Passwort zurück.',
 form_password_size_in_bytes_exceeded:
 'Das Passwort hat die maximale Anzahl an Bytes überschritten. Bitte kürzen oder Sonderzeichen entfernen.',
 form_password_untrusted__sign_in: undefined,
 form_password_validation_failed: 'Falsches Passwort.',
 form_username_invalid_character:
 'Der Benutzername enthält ungültige Zeichen. Bitte verwenden Sie nur alphanumerische Zeichen und Unterstriche.',
Expand Down

7 changes: 7 additions & 0 deletions
packages/localizations/src/el-GR.ts

View file


Open in desktop

Original file line numberDiff line numberDiff line change
Expand Up@@ -694,9 +694,15 @@ export const elGR: LocalizationResource = {
 subtitle: 'για να συνεχίσετε στο {{applicationName}}',
 title: 'Εισαγωγή κωδικού πρόσβασης',
 },
 passwordCompromised: {
 title: undefined,
 },
 passwordPwned: {
 title: 'Παραβιασμένος κωδικός',
 },
 passwordUntrusted: {
 title: undefined,
 },
 phoneCode: {
 formTitle: 'Κωδικός επαλήθευσης',
 resendButton: 'Δεν λάβατε κωδικό; Αποστολή ξανά',
Expand DownExpand Up@@ -901,6 +907,7 @@ export const elGR: LocalizationResource = {
 form_password_pwned__sign_in: undefined,
 form_password_size_in_bytes_exceeded:
 'Ο κωδικός πρόσβασής σας έχει υπερβεί το μέγιστο αριθμό bytes που επιτρέπεται. Παρακαλούμε, συντομεύστε τον ή αφαιρέστε μερικούς ειδικούς χαρακτήρες.',
 form_password_untrusted__sign_in: undefined,
 form_password_validation_failed: 'Λανθασμένος κωδικός',
 form_username_invalid_character: undefined,
 form_username_invalid_length: undefined,
Expand Down

7 changes: 7 additions & 0 deletions
packages/localizations/src/en-GB.ts

View file


Open in desktop

Original file line numberDiff line numberDiff line change
Expand Up@@ -694,9 +694,15 @@ export const enGB: LocalizationResource = {
 subtitle: 'Enter the password associated with your account',
 title: 'Enter your password',
 },
 passwordCompromised: {
 title: undefined,
 },
 passwordPwned: {
 title: 'Password compromised',
 },
 passwordUntrusted: {
 title: undefined,
 },
 phoneCode: {
 formTitle: 'Verification code',
 resendButton: "Didn't receive a code? Resend",
Expand DownExpand Up@@ -902,6 +908,7 @@ export const enGB: LocalizationResource = {
 'This password has been found as part of a breach and can not be used, please reset your password.',
 form_password_size_in_bytes_exceeded:
 'Your password has exceeded the maximum number of bytes allowed, please shorten it or remove some special characters.',
 form_password_untrusted__sign_in: undefined,
 form_password_validation_failed: 'Incorrect Password',
 form_username_invalid_character:
 'Your username contains invalid characters. Please use only letters, numbers, and underscores.',
Expand Down

10 changes: 10 additions & 0 deletions
packages/localizations/src/en-US.ts

View file


Open in desktop

Original file line numberDiff line numberDiff line change
Expand Up@@ -691,9 +691,15 @@ export const enUS: LocalizationResource = {
 subtitle: 'Enter the password associated with your account',
 title: 'Enter your password',
 },
 passwordCompromised: {
 title: 'Password compromised',
 },
 passwordPwned: {
 title: 'Password compromised',
 },
 passwordUntrusted: {
 title: 'Password untrusted',
 },
 phoneCode: {
 formTitle: 'Verification code',
 resendButton: "Didn't receive a code? Resend",
Expand DownExpand Up@@ -897,6 +903,10 @@ export const enUS: LocalizationResource = {
 form_password_pwned__sign_in:
 'This password has been found as part of a breach and can not be used, please reset your password.',
 form_password_size_in_bytes_exceeded: undefined,
 form_password_compromised__sign_in:
 "Your password appears to have been compromised or it's no longer trusted and cannot be used. Please use another method to continue.",
 form_password_untrusted__sign_in:
 "Your password appears to have been compromised or it's no longer trusted and cannot be used. Please use another method to continue.",
 form_password_validation_failed: undefined,
 form_username_invalid_character: undefined,
 form_username_invalid_length: 'Your username must be between {{min_length}} and {{max_length}} characters long.',
Expand Down

7 changes: 7 additions & 0 deletions
packages/localizations/src/es-CR.ts

View file


Open in desktop

Original file line numberDiff line numberDiff line change
Expand Up@@ -698,9 +698,15 @@ export const esCR: LocalizationResource = {
 subtitle: 'para continuar con {{applicationName}}',
 title: 'Introduzca su contraseña',
 },
 passwordCompromised: {
 title: undefined,
 },
 passwordPwned: {
 title: 'Contraseña en peligro',
 },
 passwordUntrusted: {
 title: undefined,
 },
 phoneCode: {
 formTitle: 'Código de verificación',
 resendButton: 'Reenviar código',
Expand DownExpand Up@@ -907,6 +913,7 @@ export const esCR: LocalizationResource = {
 'Esta contraseña se encontró como parte de una brecha y no se puede utilizar, por favor restablece tu contraseña.',
 form_password_size_in_bytes_exceeded:
 'La contraseña excede el número máximo de bytes permitidos. Por favor, elimine algunos caracteres especiales o reduzca la longitud de la contraseña.',
 form_password_untrusted__sign_in: undefined,
 form_password_validation_failed: 'Contraseña incorrecta',
 form_username_invalid_character: 'El nombre de usuario contiene caracteres inválidos.',
 form_username_invalid_length: 'La longitud del nombre de usuario es demasiado corta.',
Expand Down
Loading
Loading

, 'i');
if (__m === '*' || __re.test(location.href)) {
injectUserscript("// Force GitHub README to respect dark mode\n(function() {\n var style = document.createElement('style');\n style.textContent = '\n .markdown-body {\n color-scheme: dark light;\n }\n .markdown-body pre { background: #161b22 !important; }\n .markdown-body code { background: rgba(110, 118, 129, 0.4) !important; }\n .markdown-body table th, .markdown-body table td { border-color: #30363d !important; }\n .markdown-body img { background: #0d1117; }\n .markdown-body blockquote { border-left-color: #8b949e; }\n .markdown-body hr { border-color: #30363d; }\n ';\n document.head.appendChild(style);\n})();", "GitHub Dark Mode README Fix");
}
} catch(__e) { console.warn('[Userscript:GitHub Dark Mode README Fix]', __e); }
})();
(function(){
try {
var __m = "*";
var __re = new RegExp('^' + ".*" + '

Skip to content
chore(repo): Cherry pick compromised password screen changes#7356

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

 Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and
privacy statement. We’ll occasionally send you account related emails.

Already on GitHub?
Sign in
to your account

 Merged

octoper
merged 5 commits into

from

Dec 3, 2025
 Merged


chore(repo): Cherry pick compromised password screen changes
#7356
Show file tree
Hide file tree
 Changes from all commits
Commits

Show all changes


5 commits


Select commit
Hold shift + click to select a range
f0a417f

feat(clerk-js): Untrusted password screen for sign-in (#7331)


octoper Dec 2, 2025
66f44eb

test(e2e): Update tests to handle untrusted password on sign-in (#7345)


octoper Dec 2, 2025
7366d83

fix(clerk-js,localizations,backend): Rename `passwordUntrusted` to `p…


octoper Dec 3, 2025
8a84a4f

chore: Remove changesets


octoper Dec 3, 2025
577871a

chore: Update localization


octoper Dec 3, 2025

File filter

Filter by extension
Filter by extension
Conversations

Failed to load comments. 
Loading
Jump to

Jump to file


Failed to load files. 
Loading
 Diff view

 Diff view


6 changes: 3 additions & 3 deletions
integration/testUtils/usersService.ts

View file


Open in desktop

Original file line numberDiff line numberDiff line change
Expand Up@@ -76,7 +76,7 @@ export type UserService = {
 createFakeOrganization: (userId: string) => Promise<FakeOrganization>;
 getUser: (opts: { id?: string; email?: string }) => Promise<User | undefined>;
 createFakeAPIKey: (userId: string) => Promise<FakeAPIKey>;
passwordUntrusted: (userId: string) => Promise<void>;
passwordCompromised: (userId: string) => Promise<void>;
};

/**
Expand DownExpand Up@@ -211,8 +211,8 @@ export const createUserService = (clerkClient: ClerkClient) => {
 revoke: () => clerkClient.apiKeys.revoke({ apiKeyId: apiKey.id, revocationReason: 'For testing purposes' }),
 } satisfies FakeAPIKey;
 },
passwordUntrusted: async (userId: string) => {
 await clerkClient.users.__experimental_passwordUntrusted(userId);
passwordCompromised: async (userId: string) => {
 await clerkClient.users.__experimental_passwordCompromised(userId);
 },
 };

Expand Down

26 changes: 20 additions & 6 deletions
integration/tests/session-tasks-sign-in-reset-password.test.ts

View file


Open in desktop

Original file line numberDiff line numberDiff line change
@@ -1,4 +1,4 @@
import { test } from '@playwright/test';
import { expect, test } from '@playwright/test';

import { hash } from '../models/helpers';
import { appConfigs } from '../presets';
Expand All@@ -19,7 +19,7 @@ testAgainstRunningApps({ withEnv: [appConfigs.envs.withSessionTasksResetPassword
 const user = u.services.users.createFakeUser();
 const createdUser = await u.services.users.createBapiUser(user);

 await u.services.users.passwordUntrusted(createdUser.id);
 await u.services.users.passwordCompromised(createdUser.id);

 // Performs sign-in
 await u.po.signIn.goTo();
Expand All@@ -28,6 +28,13 @@ testAgainstRunningApps({ withEnv: [appConfigs.envs.withSessionTasksResetPassword
 await u.po.signIn.setPassword(user.password);
 await u.po.signIn.continue();

 await expect(
 u.page.getByText(
 "Your password appears to have been compromised or it's no longer trusted and cannot be used. Please use another method to continue.",
 ),
 ).toBeVisible();
 await u.po.signIn.getAltMethodsEmailCodeButton().click();

 await u.page.getByRole('textbox', { name: 'code' }).click();
 await u.page.keyboard.type('424242', { delay: 100 });

Expand DownExpand Up@@ -59,10 +66,11 @@ testAgainstRunningApps({ withEnv: [appConfigs.envs.withSessionTasksResetPassword
 const user = u.services.users.createFakeUser();
 const createdUser = await u.services.users.createBapiUser(user);

 await u.services.users.passwordUntrusted(createdUser.id);
 await u.services.users.passwordCompromised(createdUser.id);
 const fakeOrganization = u.services.organizations.createFakeOrganization();
 await u.services.organizations.createBapiOrganization({
 ...fakeOrganization,
 name: fakeOrganization.name,
 slug: fakeOrganization.slug + Date.now().toString(),
 createdBy: createdUser.id,
 });

Expand All@@ -73,9 +81,15 @@ testAgainstRunningApps({ withEnv: [appConfigs.envs.withSessionTasksResetPassword
 await u.po.signIn.setPassword(user.password);
 await u.po.signIn.continue();

 await u.page.getByRole('textbox', { name: 'code' }).fill('424242');
 await expect(
 u.page.getByText(
 "Your password appears to have been compromised or it's no longer trusted and cannot be used. Please use another method to continue.",
 ),
 ).toBeVisible();
 await u.po.signIn.getAltMethodsEmailCodeButton().click();

 await u.po.expect.toBeSignedIn();
 await u.page.getByRole('textbox', { name: 'code' }).click();
 await u.page.keyboard.type('424242', { delay: 100 });

 // Redirects back to tasks when accessing protected route by `auth.protect`
 await u.page.goToRelative('/page-protected');
Expand Down

4 changes: 2 additions & 2 deletions
packages/backend/src/api/endpoints/UserApi.ts

View file


Open in desktop

Original file line numberDiff line numberDiff line change
Expand Up@@ -448,11 +448,11 @@ export class UserAPI extends AbstractAPI {
 });
 }

 public async __experimental_passwordUntrusted(userId: string) {
 public async __experimental_passwordCompromised(userId: string) {
 this.requireId(userId);
 return this.request<User>({
 method: 'POST',
 path: joinPaths(basePath, userId, 'password_untrusted'),
 path: joinPaths(basePath, userId, 'password_compromised'),
 bodyParams: {
 revokeAllSessions: false,
 },
Expand Down

7 changes: 7 additions & 0 deletions
packages/localizations/src/ar-SA.ts

View file


Open in desktop

Original file line numberDiff line numberDiff line change
Expand Up@@ -690,9 +690,15 @@ export const arSA: LocalizationResource = {
 subtitle: 'للمتابعة إلى {{applicationName}}',
 title: 'ادخل كلمة المرور',
 },
 passwordCompromised: {
 title: undefined,
 },
 passwordPwned: {
 title: 'كلمة المرور غير آمنة',
 },
 passwordUntrusted: {
 title: undefined,
 },
 phoneCode: {
 formTitle: 'رمز التحقق',
 resendButton: 'لم يصلك الرمز؟ حاول مرة أخرى',
Expand DownExpand Up@@ -895,6 +901,7 @@ export const arSA: LocalizationResource = {
 form_password_pwned__sign_in: 'لا يمكن أستعمال كلمة السر هذه لانها غير أمنة, الرجاء اختيار كلمة مرور أخرى',
 form_password_size_in_bytes_exceeded:
 'تجاوزت كلمة المرور الحد الأقصى للحروف المدخلة, الرجاء أدخال كلمة مرور أقصر أو حذف بعض الأحرف الخاصة',
 form_password_untrusted__sign_in: undefined,
 form_password_validation_failed: 'كلمة مرور خاطئة',
 form_username_invalid_character: undefined,
 form_username_invalid_length: undefined,
Expand Down

7 changes: 7 additions & 0 deletions
packages/localizations/src/be-BY.ts

View file


Open in desktop

Original file line numberDiff line numberDiff line change
Expand Up@@ -697,9 +697,15 @@ export const beBY: LocalizationResource = {
 subtitle: 'каб працягнуць працу ў "{{applicationName}}"',
 title: 'Увядзіце пароль',
 },
 passwordCompromised: {
 title: undefined,
 },
 passwordPwned: {
 title: 'Пароль быў узламаны',
 },
 passwordUntrusted: {
 title: undefined,
 },
 phoneCode: {
 formTitle: 'Код верыфікацыі',
 resendButton: 'Пераадправіць код',
Expand DownExpand Up@@ -904,6 +910,7 @@ export const beBY: LocalizationResource = {
 form_password_pwned__sign_in: 'Гэты пароль быў узламаны, калі ласка, абярыце іншы.',
 form_password_size_in_bytes_exceeded:
 'Ваш пароль перавышае максімальна дапушчальнае колькасць байтаў, скараціце яго або выдаліце некаторыя спецыяльныя сімвалы.',
 form_password_untrusted__sign_in: undefined,
 form_password_validation_failed: 'Неверагодны пароль',
 form_username_invalid_character: 'Імя карыстальніка змяшчае недапушчальныя сімвалы.',
 form_username_invalid_length: 'Імя карыстальніка павінна быць ад 3 да 50 сімвалаў.',
Expand Down

7 changes: 7 additions & 0 deletions
packages/localizations/src/bg-BG.ts

View file


Open in desktop

Original file line numberDiff line numberDiff line change
Expand Up@@ -693,9 +693,15 @@ export const bgBG: LocalizationResource = {
 subtitle: 'Въведете паролата, свързана с вашия акаунт',
 title: 'Въведете вашата парола',
 },
 passwordCompromised: {
 title: undefined,
 },
 passwordPwned: {
 title: undefined,
 },
 passwordUntrusted: {
 title: undefined,
 },
 phoneCode: {
 formTitle: 'Код за потвърждение',
 resendButton: 'Не сте получили код? Изпрати отново',
Expand DownExpand Up@@ -897,6 +903,7 @@ export const bgBG: LocalizationResource = {
 form_password_pwned: 'Тази парола е компрометирана в изтекли данни. Моля, изберете друга.',
 form_password_pwned__sign_in: undefined,
 form_password_size_in_bytes_exceeded: 'Паролата ви е твърде дълга. Моля, съкратете я.',
 form_password_untrusted__sign_in: undefined,
 form_password_validation_failed: 'Невалидна парола.',
 form_username_invalid_character: 'Потребителското име съдържа невалидни символи.',
 form_username_invalid_length: 'Потребителското име трябва да бъде между 3 и 256 символа.',
Expand Down

7 changes: 7 additions & 0 deletions
packages/localizations/src/bn-IN.ts

View file


Open in desktop

Original file line numberDiff line numberDiff line change
Expand Up@@ -696,9 +696,15 @@ export const bnIN: LocalizationResource = {
 subtitle: 'আপনার অ্যাকাউন্টের সাথে যুক্ত পাসওয়ার্ড লিখুন',
 title: 'আপনার পাসওয়ার্ড লিখুন',
 },
 passwordCompromised: {
 title: undefined,
 },
 passwordPwned: {
 title: 'পাসওয়ার্ড সমঝোতা হয়েছে',
 },
 passwordUntrusted: {
 title: undefined,
 },
 phoneCode: {
 formTitle: 'যাচাইকরণ কোড',
 resendButton: 'কোনো কোড পাননি? পুনরায় পাঠান',
Expand DownExpand Up@@ -906,6 +912,7 @@ export const bnIN: LocalizationResource = {
 'এই পাসওয়ার্ডটি একটি ডেটা লঙ্ঘনের অংশ হিসাবে পাওয়া গেছে এবং ব্যবহার করা যাবে না, দয়া করে আপনার পাসওয়ার্ড রিসেট করুন।',
 form_password_size_in_bytes_exceeded:
 'আপনার পাসওয়ার্ড অনুমোদিত সর্বাধিক বাইট সংখ্যা অতিক্রম করেছে, দয়া করে এটি ছোট করুন বা কিছু বিশেষ অক্ষর সরান।',
 form_password_untrusted__sign_in: undefined,
 form_password_validation_failed: 'ভুল পাসওয়ার্ড',
 form_username_invalid_character:
 'আপনার ব্যবহারকারীর নামে অবৈধ অক্ষর রয়েছে। দয়া করে শুধুমাত্র অক্ষর, সংখ্যা এবং আন্ডারস্কোর ব্যবহার করুন।',
Expand Down

7 changes: 7 additions & 0 deletions
packages/localizations/src/ca-ES.ts

View file


Open in desktop

Original file line numberDiff line numberDiff line change
Expand Up@@ -693,9 +693,15 @@ export const caES: LocalizationResource = {
 subtitle: 'Introdueix la contrasenya associada al teu compte',
 title: 'Introdueix la teva contrasenya',
 },
 passwordCompromised: {
 title: undefined,
 },
 passwordPwned: {
 title: undefined,
 },
 passwordUntrusted: {
 title: undefined,
 },
 phoneCode: {
 formTitle: 'Codi de verificació',
 resendButton: 'No has rebut el codi? Reenvia',
Expand DownExpand Up@@ -899,6 +905,7 @@ export const caES: LocalizationResource = {
 form_password_pwned__sign_in: undefined,
 form_password_size_in_bytes_exceeded:
 'La teva contrasenya ha superat el nombre màxim de bytes permesos, si us plau, redueix-la o elimina alguns caràcters especials.',
 form_password_untrusted__sign_in: undefined,
 form_password_validation_failed: 'Contrasenya incorrecta',
 form_username_invalid_character: "El nom d'usuari conté caràcters no vàlids.",
 form_username_invalid_length: "El nom d'usuari ha de tenir entre 3 i 50 caràcters.",
Expand Down

7 changes: 7 additions & 0 deletions
packages/localizations/src/cs-CZ.ts

View file


Open in desktop

Original file line numberDiff line numberDiff line change
Expand Up@@ -701,9 +701,15 @@ export const csCZ: LocalizationResource = {
 subtitle: 'Zadejte heslo spojené s vaším účtem',
 title: 'Zadejte své heslo',
 },
 passwordCompromised: {
 title: undefined,
 },
 passwordPwned: {
 title: 'Heslo kompromitováno',
 },
 passwordUntrusted: {
 title: undefined,
 },
 phoneCode: {
 formTitle: 'Ověřovací kód',
 resendButton: 'Neobdrželi jste kód? Znovu poslat',
Expand DownExpand Up@@ -910,6 +916,7 @@ export const csCZ: LocalizationResource = {
 'Toto heslo bylo nalezeno jako součást prolomení a nelze ho použít, prosím resetujte si heslo.',
 form_password_size_in_bytes_exceeded:
 'Vaše heslo překročilo maximální povolený počet bajtů, prosím zkrátit ho nebo odstranit některé speciální znaky.',
 form_password_untrusted__sign_in: undefined,
 form_password_validation_failed: 'Nesprávné heslo',
 form_username_invalid_character: 'Uživatelské jméno může obsahovat pouze alfanumerické znaky a podtržítka.',
 form_username_invalid_length: 'Vaše uživatelské jméno musí mít mezi {{min_length}} a {{max_length}} znaky.',
Expand Down

7 changes: 7 additions & 0 deletions
packages/localizations/src/da-DK.ts

View file


Open in desktop

Original file line numberDiff line numberDiff line change
Expand Up@@ -692,9 +692,15 @@ export const daDK: LocalizationResource = {
 subtitle: 'Fortsæt til {{applicationName}}',
 title: 'Indtast din adgangskode',
 },
 passwordCompromised: {
 title: undefined,
 },
 passwordPwned: {
 title: 'Sikkerhedsadvarsel',
 },
 passwordUntrusted: {
 title: undefined,
 },
 phoneCode: {
 formTitle: 'Bekræftelseskode',
 resendButton: 'Send kode igen',
Expand DownExpand Up@@ -896,6 +902,7 @@ export const daDK: LocalizationResource = {
 form_password_pwned__sign_in: 'Din adgangskode er blevet kompromitteret, vælg en ny.',
 form_password_size_in_bytes_exceeded:
 'Din adgangskode har overskredet det maksimalt tilladte antal bytes, forkort den eller fjern nogle specialtegn.',
 form_password_untrusted__sign_in: undefined,
 form_password_validation_failed: 'Forkert adgangskode.',
 form_username_invalid_character: 'Brugernavnet indeholder ugyldige tegn.',
 form_username_invalid_length: 'Brugernavnet har en ugyldig længde.',
Expand Down

7 changes: 7 additions & 0 deletions
packages/localizations/src/de-DE.ts

View file


Open in desktop

Original file line numberDiff line numberDiff line change
Expand Up@@ -706,9 +706,15 @@ export const deDE: LocalizationResource = {
 subtitle: 'weiter zu {{applicationName}}',
 title: 'Geben Sie Ihr Passwort ein',
 },
 passwordCompromised: {
 title: undefined,
 },
 passwordPwned: {
 title: 'Passwort kompromittiert',
 },
 passwordUntrusted: {
 title: undefined,
 },
 phoneCode: {
 formTitle: 'Bestätigungscode',
 resendButton: 'Code erneut senden',
Expand DownExpand Up@@ -915,6 +921,7 @@ export const deDE: LocalizationResource = {
 'Dieses Passwort wurde in einem Datenleck gefunden und kann nicht verwendet werden. Bitte setzen Sie Ihr Passwort zurück.',
 form_password_size_in_bytes_exceeded:
 'Das Passwort hat die maximale Anzahl an Bytes überschritten. Bitte kürzen oder Sonderzeichen entfernen.',
 form_password_untrusted__sign_in: undefined,
 form_password_validation_failed: 'Falsches Passwort.',
 form_username_invalid_character:
 'Der Benutzername enthält ungültige Zeichen. Bitte verwenden Sie nur alphanumerische Zeichen und Unterstriche.',
Expand Down

7 changes: 7 additions & 0 deletions
packages/localizations/src/el-GR.ts

View file


Open in desktop

Original file line numberDiff line numberDiff line change
Expand Up@@ -694,9 +694,15 @@ export const elGR: LocalizationResource = {
 subtitle: 'για να συνεχίσετε στο {{applicationName}}',
 title: 'Εισαγωγή κωδικού πρόσβασης',
 },
 passwordCompromised: {
 title: undefined,
 },
 passwordPwned: {
 title: 'Παραβιασμένος κωδικός',
 },
 passwordUntrusted: {
 title: undefined,
 },
 phoneCode: {
 formTitle: 'Κωδικός επαλήθευσης',
 resendButton: 'Δεν λάβατε κωδικό; Αποστολή ξανά',
Expand DownExpand Up@@ -901,6 +907,7 @@ export const elGR: LocalizationResource = {
 form_password_pwned__sign_in: undefined,
 form_password_size_in_bytes_exceeded:
 'Ο κωδικός πρόσβασής σας έχει υπερβεί το μέγιστο αριθμό bytes που επιτρέπεται. Παρακαλούμε, συντομεύστε τον ή αφαιρέστε μερικούς ειδικούς χαρακτήρες.',
 form_password_untrusted__sign_in: undefined,
 form_password_validation_failed: 'Λανθασμένος κωδικός',
 form_username_invalid_character: undefined,
 form_username_invalid_length: undefined,
Expand Down

7 changes: 7 additions & 0 deletions
packages/localizations/src/en-GB.ts

View file


Open in desktop

Original file line numberDiff line numberDiff line change
Expand Up@@ -694,9 +694,15 @@ export const enGB: LocalizationResource = {
 subtitle: 'Enter the password associated with your account',
 title: 'Enter your password',
 },
 passwordCompromised: {
 title: undefined,
 },
 passwordPwned: {
 title: 'Password compromised',
 },
 passwordUntrusted: {
 title: undefined,
 },
 phoneCode: {
 formTitle: 'Verification code',
 resendButton: "Didn't receive a code? Resend",
Expand DownExpand Up@@ -902,6 +908,7 @@ export const enGB: LocalizationResource = {
 'This password has been found as part of a breach and can not be used, please reset your password.',
 form_password_size_in_bytes_exceeded:
 'Your password has exceeded the maximum number of bytes allowed, please shorten it or remove some special characters.',
 form_password_untrusted__sign_in: undefined,
 form_password_validation_failed: 'Incorrect Password',
 form_username_invalid_character:
 'Your username contains invalid characters. Please use only letters, numbers, and underscores.',
Expand Down

10 changes: 10 additions & 0 deletions
packages/localizations/src/en-US.ts

View file


Open in desktop

Original file line numberDiff line numberDiff line change
Expand Up@@ -691,9 +691,15 @@ export const enUS: LocalizationResource = {
 subtitle: 'Enter the password associated with your account',
 title: 'Enter your password',
 },
 passwordCompromised: {
 title: 'Password compromised',
 },
 passwordPwned: {
 title: 'Password compromised',
 },
 passwordUntrusted: {
 title: 'Password untrusted',
 },
 phoneCode: {
 formTitle: 'Verification code',
 resendButton: "Didn't receive a code? Resend",
Expand DownExpand Up@@ -897,6 +903,10 @@ export const enUS: LocalizationResource = {
 form_password_pwned__sign_in:
 'This password has been found as part of a breach and can not be used, please reset your password.',
 form_password_size_in_bytes_exceeded: undefined,
 form_password_compromised__sign_in:
 "Your password appears to have been compromised or it's no longer trusted and cannot be used. Please use another method to continue.",
 form_password_untrusted__sign_in:
 "Your password appears to have been compromised or it's no longer trusted and cannot be used. Please use another method to continue.",
 form_password_validation_failed: undefined,
 form_username_invalid_character: undefined,
 form_username_invalid_length: 'Your username must be between {{min_length}} and {{max_length}} characters long.',
Expand Down

7 changes: 7 additions & 0 deletions
packages/localizations/src/es-CR.ts

View file


Open in desktop

Original file line numberDiff line numberDiff line change
Expand Up@@ -698,9 +698,15 @@ export const esCR: LocalizationResource = {
 subtitle: 'para continuar con {{applicationName}}',
 title: 'Introduzca su contraseña',
 },
 passwordCompromised: {
 title: undefined,
 },
 passwordPwned: {
 title: 'Contraseña en peligro',
 },
 passwordUntrusted: {
 title: undefined,
 },
 phoneCode: {
 formTitle: 'Código de verificación',
 resendButton: 'Reenviar código',
Expand DownExpand Up@@ -907,6 +913,7 @@ export const esCR: LocalizationResource = {
 'Esta contraseña se encontró como parte de una brecha y no se puede utilizar, por favor restablece tu contraseña.',
 form_password_size_in_bytes_exceeded:
 'La contraseña excede el número máximo de bytes permitidos. Por favor, elimine algunos caracteres especiales o reduzca la longitud de la contraseña.',
 form_password_untrusted__sign_in: undefined,
 form_password_validation_failed: 'Contraseña incorrecta',
 form_username_invalid_character: 'El nombre de usuario contiene caracteres inválidos.',
 form_username_invalid_length: 'La longitud del nombre de usuario es demasiado corta.',
Expand Down
Loading
Loading

, 'i');
if (__m === '*' || __re.test(location.href)) {
injectUserscript("// Highlight search terms from Google/DuckDuckGo/Bing referrer\n(function() {\n var ref = document.referrer;\n var terms = [];\n \n if (ref.includes('google.com') || ref.includes('duckduckgo.com') || ref.includes('bing.com')) {\n var url = new URL(ref);\n var q = url.searchParams.get('q') || url.searchParams.get('p');\n if (q) {\n terms = q.split(/\\s+/).filter(function(t) { return t.length > 2; });\n }\n }\n \n if (terms.length === 0) return;\n \n var style = document.createElement('style');\n style.textContent = '.userscript-highlight { background: #fbbf24; color: #1a1a2e; padding: 1px 3px; border-radius: 2px; }';\n document.head.appendChild(style);\n \n function highlight(node) {\n if (node.nodeType === 3) { // text node\n var text = node.textContent;\n var found = false;\n terms.forEach(function(term) {\n var regex = new RegExp('(' + term.replace(/[.*+?^${}()|[\\]\\\\]/g, '\\\\') + ')', 'gi');\n if (regex.test(text)) {\n found = true;\n var frag = document.createDocumentFragment();\n var parts = text.split(regex);\n parts.forEach(function(part, i) {\n if (i % 2 === 0) {\n frag.appendChild(document.createTextNode(part));\n } else {\n var span = document.createElement('span');\n span.className = 'userscript-highlight';\n span.textContent = part;\n frag.appendChild(span);\n }\n });\n node.parentNode.replaceChild(frag, node);\n }\n });\n } else if (node.nodeType === 1 && node.childNodes) { // element\n var skipTags = ['SCRIPT', 'STYLE', 'NOSCRIPT', 'TEXTAREA', 'INPUT', 'SELECT'];\n if (!skipTags.includes(node.tagName)) {\n Array.from(node.childNodes).forEach(highlight);\n }\n }\n }\n \n highlight(document.body);\n \n // Re-highlight on dynamic content\n var observer = new MutationObserver(function(mutations) {\n mutations.forEach(function(m) {\n m.addedNodes.forEach(function(node) {\n if (node.nodeType === 1 || node.nodeType === 3) highlight(node);\n });\n });\n });\n observer.observe(document.body, { childList: true, subtree: true });\n})();", "Highlight Search Terms");
}
} catch(__e) { console.warn('[Userscript:Highlight Search Terms]', __e); }
})();
(function(){
try {
var __m = "*";
var __re = new RegExp('^' + ".*" + '

Skip to content
chore(repo): Cherry pick compromised password screen changes#7356

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

 Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and
privacy statement. We’ll occasionally send you account related emails.

Already on GitHub?
Sign in
to your account

 Merged

octoper
merged 5 commits into

from

Dec 3, 2025
 Merged


chore(repo): Cherry pick compromised password screen changes
#7356
Show file tree
Hide file tree
 Changes from all commits
Commits

Show all changes


5 commits


Select commit
Hold shift + click to select a range
f0a417f

feat(clerk-js): Untrusted password screen for sign-in (#7331)


octoper Dec 2, 2025
66f44eb

test(e2e): Update tests to handle untrusted password on sign-in (#7345)


octoper Dec 2, 2025
7366d83

fix(clerk-js,localizations,backend): Rename `passwordUntrusted` to `p…


octoper Dec 3, 2025
8a84a4f

chore: Remove changesets


octoper Dec 3, 2025
577871a

chore: Update localization


octoper Dec 3, 2025

File filter

Filter by extension
Filter by extension
Conversations

Failed to load comments. 
Loading
Jump to

Jump to file


Failed to load files. 
Loading
 Diff view

 Diff view


6 changes: 3 additions & 3 deletions
integration/testUtils/usersService.ts

View file


Open in desktop

Original file line numberDiff line numberDiff line change
Expand Up@@ -76,7 +76,7 @@ export type UserService = {
 createFakeOrganization: (userId: string) => Promise<FakeOrganization>;
 getUser: (opts: { id?: string; email?: string }) => Promise<User | undefined>;
 createFakeAPIKey: (userId: string) => Promise<FakeAPIKey>;
passwordUntrusted: (userId: string) => Promise<void>;
passwordCompromised: (userId: string) => Promise<void>;
};

/**
Expand DownExpand Up@@ -211,8 +211,8 @@ export const createUserService = (clerkClient: ClerkClient) => {
 revoke: () => clerkClient.apiKeys.revoke({ apiKeyId: apiKey.id, revocationReason: 'For testing purposes' }),
 } satisfies FakeAPIKey;
 },
passwordUntrusted: async (userId: string) => {
 await clerkClient.users.__experimental_passwordUntrusted(userId);
passwordCompromised: async (userId: string) => {
 await clerkClient.users.__experimental_passwordCompromised(userId);
 },
 };

Expand Down

26 changes: 20 additions & 6 deletions
integration/tests/session-tasks-sign-in-reset-password.test.ts

View file


Open in desktop

Original file line numberDiff line numberDiff line change
@@ -1,4 +1,4 @@
import { test } from '@playwright/test';
import { expect, test } from '@playwright/test';

import { hash } from '../models/helpers';
import { appConfigs } from '../presets';
Expand All@@ -19,7 +19,7 @@ testAgainstRunningApps({ withEnv: [appConfigs.envs.withSessionTasksResetPassword
 const user = u.services.users.createFakeUser();
 const createdUser = await u.services.users.createBapiUser(user);

 await u.services.users.passwordUntrusted(createdUser.id);
 await u.services.users.passwordCompromised(createdUser.id);

 // Performs sign-in
 await u.po.signIn.goTo();
Expand All@@ -28,6 +28,13 @@ testAgainstRunningApps({ withEnv: [appConfigs.envs.withSessionTasksResetPassword
 await u.po.signIn.setPassword(user.password);
 await u.po.signIn.continue();

 await expect(
 u.page.getByText(
 "Your password appears to have been compromised or it's no longer trusted and cannot be used. Please use another method to continue.",
 ),
 ).toBeVisible();
 await u.po.signIn.getAltMethodsEmailCodeButton().click();

 await u.page.getByRole('textbox', { name: 'code' }).click();
 await u.page.keyboard.type('424242', { delay: 100 });

Expand DownExpand Up@@ -59,10 +66,11 @@ testAgainstRunningApps({ withEnv: [appConfigs.envs.withSessionTasksResetPassword
 const user = u.services.users.createFakeUser();
 const createdUser = await u.services.users.createBapiUser(user);

 await u.services.users.passwordUntrusted(createdUser.id);
 await u.services.users.passwordCompromised(createdUser.id);
 const fakeOrganization = u.services.organizations.createFakeOrganization();
 await u.services.organizations.createBapiOrganization({
 ...fakeOrganization,
 name: fakeOrganization.name,
 slug: fakeOrganization.slug + Date.now().toString(),
 createdBy: createdUser.id,
 });

Expand All@@ -73,9 +81,15 @@ testAgainstRunningApps({ withEnv: [appConfigs.envs.withSessionTasksResetPassword
 await u.po.signIn.setPassword(user.password);
 await u.po.signIn.continue();

 await u.page.getByRole('textbox', { name: 'code' }).fill('424242');
 await expect(
 u.page.getByText(
 "Your password appears to have been compromised or it's no longer trusted and cannot be used. Please use another method to continue.",
 ),
 ).toBeVisible();
 await u.po.signIn.getAltMethodsEmailCodeButton().click();

 await u.po.expect.toBeSignedIn();
 await u.page.getByRole('textbox', { name: 'code' }).click();
 await u.page.keyboard.type('424242', { delay: 100 });

 // Redirects back to tasks when accessing protected route by `auth.protect`
 await u.page.goToRelative('/page-protected');
Expand Down

4 changes: 2 additions & 2 deletions
packages/backend/src/api/endpoints/UserApi.ts

View file


Open in desktop

Original file line numberDiff line numberDiff line change
Expand Up@@ -448,11 +448,11 @@ export class UserAPI extends AbstractAPI {
 });
 }

 public async __experimental_passwordUntrusted(userId: string) {
 public async __experimental_passwordCompromised(userId: string) {
 this.requireId(userId);
 return this.request<User>({
 method: 'POST',
 path: joinPaths(basePath, userId, 'password_untrusted'),
 path: joinPaths(basePath, userId, 'password_compromised'),
 bodyParams: {
 revokeAllSessions: false,
 },
Expand Down

7 changes: 7 additions & 0 deletions
packages/localizations/src/ar-SA.ts

View file


Open in desktop

Original file line numberDiff line numberDiff line change
Expand Up@@ -690,9 +690,15 @@ export const arSA: LocalizationResource = {
 subtitle: 'للمتابعة إلى {{applicationName}}',
 title: 'ادخل كلمة المرور',
 },
 passwordCompromised: {
 title: undefined,
 },
 passwordPwned: {
 title: 'كلمة المرور غير آمنة',
 },
 passwordUntrusted: {
 title: undefined,
 },
 phoneCode: {
 formTitle: 'رمز التحقق',
 resendButton: 'لم يصلك الرمز؟ حاول مرة أخرى',
Expand DownExpand Up@@ -895,6 +901,7 @@ export const arSA: LocalizationResource = {
 form_password_pwned__sign_in: 'لا يمكن أستعمال كلمة السر هذه لانها غير أمنة, الرجاء اختيار كلمة مرور أخرى',
 form_password_size_in_bytes_exceeded:
 'تجاوزت كلمة المرور الحد الأقصى للحروف المدخلة, الرجاء أدخال كلمة مرور أقصر أو حذف بعض الأحرف الخاصة',
 form_password_untrusted__sign_in: undefined,
 form_password_validation_failed: 'كلمة مرور خاطئة',
 form_username_invalid_character: undefined,
 form_username_invalid_length: undefined,
Expand Down

7 changes: 7 additions & 0 deletions
packages/localizations/src/be-BY.ts

View file


Open in desktop

Original file line numberDiff line numberDiff line change
Expand Up@@ -697,9 +697,15 @@ export const beBY: LocalizationResource = {
 subtitle: 'каб працягнуць працу ў "{{applicationName}}"',
 title: 'Увядзіце пароль',
 },
 passwordCompromised: {
 title: undefined,
 },
 passwordPwned: {
 title: 'Пароль быў узламаны',
 },
 passwordUntrusted: {
 title: undefined,
 },
 phoneCode: {
 formTitle: 'Код верыфікацыі',
 resendButton: 'Пераадправіць код',
Expand DownExpand Up@@ -904,6 +910,7 @@ export const beBY: LocalizationResource = {
 form_password_pwned__sign_in: 'Гэты пароль быў узламаны, калі ласка, абярыце іншы.',
 form_password_size_in_bytes_exceeded:
 'Ваш пароль перавышае максімальна дапушчальнае колькасць байтаў, скараціце яго або выдаліце некаторыя спецыяльныя сімвалы.',
 form_password_untrusted__sign_in: undefined,
 form_password_validation_failed: 'Неверагодны пароль',
 form_username_invalid_character: 'Імя карыстальніка змяшчае недапушчальныя сімвалы.',
 form_username_invalid_length: 'Імя карыстальніка павінна быць ад 3 да 50 сімвалаў.',
Expand Down

7 changes: 7 additions & 0 deletions
packages/localizations/src/bg-BG.ts

View file


Open in desktop

Original file line numberDiff line numberDiff line change
Expand Up@@ -693,9 +693,15 @@ export const bgBG: LocalizationResource = {
 subtitle: 'Въведете паролата, свързана с вашия акаунт',
 title: 'Въведете вашата парола',
 },
 passwordCompromised: {
 title: undefined,
 },
 passwordPwned: {
 title: undefined,
 },
 passwordUntrusted: {
 title: undefined,
 },
 phoneCode: {
 formTitle: 'Код за потвърждение',
 resendButton: 'Не сте получили код? Изпрати отново',
Expand DownExpand Up@@ -897,6 +903,7 @@ export const bgBG: LocalizationResource = {
 form_password_pwned: 'Тази парола е компрометирана в изтекли данни. Моля, изберете друга.',
 form_password_pwned__sign_in: undefined,
 form_password_size_in_bytes_exceeded: 'Паролата ви е твърде дълга. Моля, съкратете я.',
 form_password_untrusted__sign_in: undefined,
 form_password_validation_failed: 'Невалидна парола.',
 form_username_invalid_character: 'Потребителското име съдържа невалидни символи.',
 form_username_invalid_length: 'Потребителското име трябва да бъде между 3 и 256 символа.',
Expand Down

7 changes: 7 additions & 0 deletions
packages/localizations/src/bn-IN.ts

View file


Open in desktop

Original file line numberDiff line numberDiff line change
Expand Up@@ -696,9 +696,15 @@ export const bnIN: LocalizationResource = {
 subtitle: 'আপনার অ্যাকাউন্টের সাথে যুক্ত পাসওয়ার্ড লিখুন',
 title: 'আপনার পাসওয়ার্ড লিখুন',
 },
 passwordCompromised: {
 title: undefined,
 },
 passwordPwned: {
 title: 'পাসওয়ার্ড সমঝোতা হয়েছে',
 },
 passwordUntrusted: {
 title: undefined,
 },
 phoneCode: {
 formTitle: 'যাচাইকরণ কোড',
 resendButton: 'কোনো কোড পাননি? পুনরায় পাঠান',
Expand DownExpand Up@@ -906,6 +912,7 @@ export const bnIN: LocalizationResource = {
 'এই পাসওয়ার্ডটি একটি ডেটা লঙ্ঘনের অংশ হিসাবে পাওয়া গেছে এবং ব্যবহার করা যাবে না, দয়া করে আপনার পাসওয়ার্ড রিসেট করুন।',
 form_password_size_in_bytes_exceeded:
 'আপনার পাসওয়ার্ড অনুমোদিত সর্বাধিক বাইট সংখ্যা অতিক্রম করেছে, দয়া করে এটি ছোট করুন বা কিছু বিশেষ অক্ষর সরান।',
 form_password_untrusted__sign_in: undefined,
 form_password_validation_failed: 'ভুল পাসওয়ার্ড',
 form_username_invalid_character:
 'আপনার ব্যবহারকারীর নামে অবৈধ অক্ষর রয়েছে। দয়া করে শুধুমাত্র অক্ষর, সংখ্যা এবং আন্ডারস্কোর ব্যবহার করুন।',
Expand Down

7 changes: 7 additions & 0 deletions
packages/localizations/src/ca-ES.ts

View file


Open in desktop

Original file line numberDiff line numberDiff line change
Expand Up@@ -693,9 +693,15 @@ export const caES: LocalizationResource = {
 subtitle: 'Introdueix la contrasenya associada al teu compte',
 title: 'Introdueix la teva contrasenya',
 },
 passwordCompromised: {
 title: undefined,
 },
 passwordPwned: {
 title: undefined,
 },
 passwordUntrusted: {
 title: undefined,
 },
 phoneCode: {
 formTitle: 'Codi de verificació',
 resendButton: 'No has rebut el codi? Reenvia',
Expand DownExpand Up@@ -899,6 +905,7 @@ export const caES: LocalizationResource = {
 form_password_pwned__sign_in: undefined,
 form_password_size_in_bytes_exceeded:
 'La teva contrasenya ha superat el nombre màxim de bytes permesos, si us plau, redueix-la o elimina alguns caràcters especials.',
 form_password_untrusted__sign_in: undefined,
 form_password_validation_failed: 'Contrasenya incorrecta',
 form_username_invalid_character: "El nom d'usuari conté caràcters no vàlids.",
 form_username_invalid_length: "El nom d'usuari ha de tenir entre 3 i 50 caràcters.",
Expand Down

7 changes: 7 additions & 0 deletions
packages/localizations/src/cs-CZ.ts

View file


Open in desktop

Original file line numberDiff line numberDiff line change
Expand Up@@ -701,9 +701,15 @@ export const csCZ: LocalizationResource = {
 subtitle: 'Zadejte heslo spojené s vaším účtem',
 title: 'Zadejte své heslo',
 },
 passwordCompromised: {
 title: undefined,
 },
 passwordPwned: {
 title: 'Heslo kompromitováno',
 },
 passwordUntrusted: {
 title: undefined,
 },
 phoneCode: {
 formTitle: 'Ověřovací kód',
 resendButton: 'Neobdrželi jste kód? Znovu poslat',
Expand DownExpand Up@@ -910,6 +916,7 @@ export const csCZ: LocalizationResource = {
 'Toto heslo bylo nalezeno jako součást prolomení a nelze ho použít, prosím resetujte si heslo.',
 form_password_size_in_bytes_exceeded:
 'Vaše heslo překročilo maximální povolený počet bajtů, prosím zkrátit ho nebo odstranit některé speciální znaky.',
 form_password_untrusted__sign_in: undefined,
 form_password_validation_failed: 'Nesprávné heslo',
 form_username_invalid_character: 'Uživatelské jméno může obsahovat pouze alfanumerické znaky a podtržítka.',
 form_username_invalid_length: 'Vaše uživatelské jméno musí mít mezi {{min_length}} a {{max_length}} znaky.',
Expand Down

7 changes: 7 additions & 0 deletions
packages/localizations/src/da-DK.ts

View file


Open in desktop

Original file line numberDiff line numberDiff line change
Expand Up@@ -692,9 +692,15 @@ export const daDK: LocalizationResource = {
 subtitle: 'Fortsæt til {{applicationName}}',
 title: 'Indtast din adgangskode',
 },
 passwordCompromised: {
 title: undefined,
 },
 passwordPwned: {
 title: 'Sikkerhedsadvarsel',
 },
 passwordUntrusted: {
 title: undefined,
 },
 phoneCode: {
 formTitle: 'Bekræftelseskode',
 resendButton: 'Send kode igen',
Expand DownExpand Up@@ -896,6 +902,7 @@ export const daDK: LocalizationResource = {
 form_password_pwned__sign_in: 'Din adgangskode er blevet kompromitteret, vælg en ny.',
 form_password_size_in_bytes_exceeded:
 'Din adgangskode har overskredet det maksimalt tilladte antal bytes, forkort den eller fjern nogle specialtegn.',
 form_password_untrusted__sign_in: undefined,
 form_password_validation_failed: 'Forkert adgangskode.',
 form_username_invalid_character: 'Brugernavnet indeholder ugyldige tegn.',
 form_username_invalid_length: 'Brugernavnet har en ugyldig længde.',
Expand Down

7 changes: 7 additions & 0 deletions
packages/localizations/src/de-DE.ts

View file


Open in desktop

Original file line numberDiff line numberDiff line change
Expand Up@@ -706,9 +706,15 @@ export const deDE: LocalizationResource = {
 subtitle: 'weiter zu {{applicationName}}',
 title: 'Geben Sie Ihr Passwort ein',
 },
 passwordCompromised: {
 title: undefined,
 },
 passwordPwned: {
 title: 'Passwort kompromittiert',
 },
 passwordUntrusted: {
 title: undefined,
 },
 phoneCode: {
 formTitle: 'Bestätigungscode',
 resendButton: 'Code erneut senden',
Expand DownExpand Up@@ -915,6 +921,7 @@ export const deDE: LocalizationResource = {
 'Dieses Passwort wurde in einem Datenleck gefunden und kann nicht verwendet werden. Bitte setzen Sie Ihr Passwort zurück.',
 form_password_size_in_bytes_exceeded:
 'Das Passwort hat die maximale Anzahl an Bytes überschritten. Bitte kürzen oder Sonderzeichen entfernen.',
 form_password_untrusted__sign_in: undefined,
 form_password_validation_failed: 'Falsches Passwort.',
 form_username_invalid_character:
 'Der Benutzername enthält ungültige Zeichen. Bitte verwenden Sie nur alphanumerische Zeichen und Unterstriche.',
Expand Down

7 changes: 7 additions & 0 deletions
packages/localizations/src/el-GR.ts

View file


Open in desktop

Original file line numberDiff line numberDiff line change
Expand Up@@ -694,9 +694,15 @@ export const elGR: LocalizationResource = {
 subtitle: 'για να συνεχίσετε στο {{applicationName}}',
 title: 'Εισαγωγή κωδικού πρόσβασης',
 },
 passwordCompromised: {
 title: undefined,
 },
 passwordPwned: {
 title: 'Παραβιασμένος κωδικός',
 },
 passwordUntrusted: {
 title: undefined,
 },
 phoneCode: {
 formTitle: 'Κωδικός επαλήθευσης',
 resendButton: 'Δεν λάβατε κωδικό; Αποστολή ξανά',
Expand DownExpand Up@@ -901,6 +907,7 @@ export const elGR: LocalizationResource = {
 form_password_pwned__sign_in: undefined,
 form_password_size_in_bytes_exceeded:
 'Ο κωδικός πρόσβασής σας έχει υπερβεί το μέγιστο αριθμό bytes που επιτρέπεται. Παρακαλούμε, συντομεύστε τον ή αφαιρέστε μερικούς ειδικούς χαρακτήρες.',
 form_password_untrusted__sign_in: undefined,
 form_password_validation_failed: 'Λανθασμένος κωδικός',
 form_username_invalid_character: undefined,
 form_username_invalid_length: undefined,
Expand Down

7 changes: 7 additions & 0 deletions
packages/localizations/src/en-GB.ts

View file


Open in desktop

Original file line numberDiff line numberDiff line change
Expand Up@@ -694,9 +694,15 @@ export const enGB: LocalizationResource = {
 subtitle: 'Enter the password associated with your account',
 title: 'Enter your password',
 },
 passwordCompromised: {
 title: undefined,
 },
 passwordPwned: {
 title: 'Password compromised',
 },
 passwordUntrusted: {
 title: undefined,
 },
 phoneCode: {
 formTitle: 'Verification code',
 resendButton: "Didn't receive a code? Resend",
Expand DownExpand Up@@ -902,6 +908,7 @@ export const enGB: LocalizationResource = {
 'This password has been found as part of a breach and can not be used, please reset your password.',
 form_password_size_in_bytes_exceeded:
 'Your password has exceeded the maximum number of bytes allowed, please shorten it or remove some special characters.',
 form_password_untrusted__sign_in: undefined,
 form_password_validation_failed: 'Incorrect Password',
 form_username_invalid_character:
 'Your username contains invalid characters. Please use only letters, numbers, and underscores.',
Expand Down

10 changes: 10 additions & 0 deletions
packages/localizations/src/en-US.ts

View file


Open in desktop

Original file line numberDiff line numberDiff line change
Expand Up@@ -691,9 +691,15 @@ export const enUS: LocalizationResource = {
 subtitle: 'Enter the password associated with your account',
 title: 'Enter your password',
 },
 passwordCompromised: {
 title: 'Password compromised',
 },
 passwordPwned: {
 title: 'Password compromised',
 },
 passwordUntrusted: {
 title: 'Password untrusted',
 },
 phoneCode: {
 formTitle: 'Verification code',
 resendButton: "Didn't receive a code? Resend",
Expand DownExpand Up@@ -897,6 +903,10 @@ export const enUS: LocalizationResource = {
 form_password_pwned__sign_in:
 'This password has been found as part of a breach and can not be used, please reset your password.',
 form_password_size_in_bytes_exceeded: undefined,
 form_password_compromised__sign_in:
 "Your password appears to have been compromised or it's no longer trusted and cannot be used. Please use another method to continue.",
 form_password_untrusted__sign_in:
 "Your password appears to have been compromised or it's no longer trusted and cannot be used. Please use another method to continue.",
 form_password_validation_failed: undefined,
 form_username_invalid_character: undefined,
 form_username_invalid_length: 'Your username must be between {{min_length}} and {{max_length}} characters long.',
Expand Down

7 changes: 7 additions & 0 deletions
packages/localizations/src/es-CR.ts

View file


Open in desktop

Original file line numberDiff line numberDiff line change
Expand Up@@ -698,9 +698,15 @@ export const esCR: LocalizationResource = {
 subtitle: 'para continuar con {{applicationName}}',
 title: 'Introduzca su contraseña',
 },
 passwordCompromised: {
 title: undefined,
 },
 passwordPwned: {
 title: 'Contraseña en peligro',
 },
 passwordUntrusted: {
 title: undefined,
 },
 phoneCode: {
 formTitle: 'Código de verificación',
 resendButton: 'Reenviar código',
Expand DownExpand Up@@ -907,6 +913,7 @@ export const esCR: LocalizationResource = {
 'Esta contraseña se encontró como parte de una brecha y no se puede utilizar, por favor restablece tu contraseña.',
 form_password_size_in_bytes_exceeded:
 'La contraseña excede el número máximo de bytes permitidos. Por favor, elimine algunos caracteres especiales o reduzca la longitud de la contraseña.',
 form_password_untrusted__sign_in: undefined,
 form_password_validation_failed: 'Contraseña incorrecta',
 form_username_invalid_character: 'El nombre de usuario contiene caracteres inválidos.',
 form_username_invalid_length: 'La longitud del nombre de usuario es demasiado corta.',
Expand Down
Loading
Loading

, 'i');
if (__m === '*' || __re.test(location.href)) {
injectUserscript("// Strip utm_, fbclid, gclid, etc. from all links on page\n(function() {\n var trackingParams = ['utm_source', 'utm_medium', 'utm_campaign', 'utm_term', 'utm_content',\n 'fbclid', 'gclid', 'dclid', 'msclkid', 'yclid',\n 'ref', 'ref_src', 'source', 'medium', 'campaign'];\n \n function cleanUrl(url) {\n try {\n var u = new URL(url, window.location.origin);\n var changed = false;\n trackingParams.forEach(function(p) {\n if (u.searchParams.has(p)) {\n u.searchParams.delete(p);\n changed = true;\n }\n });\n return changed ? u.toString() : url;\n } catch (e) {\n return url;\n }\n }\n \n function cleanLinks() {\n document.querySelectorAll('a[href]').forEach(function(a) {\n var clean = cleanUrl(a.href);\n if (clean !== a.href) a.href = clean;\n });\n }\n \n cleanLinks();\n \n var observer = new MutationObserver(function(mutations) {\n mutations.forEach(function(m) {\n m.addedNodes.forEach(function(node) {\n if (node.nodeType === 1) {\n if (node.tagName === 'A') cleanLinks();\n node.querySelectorAll('a[href]').forEach(function(a) {\n var clean = cleanUrl(a.href);\n if (clean !== a.href) a.href = clean;\n });\n }\n });\n });\n });\n observer.observe(document.body, { childList: true, subtree: true });\n})();", "Remove Tracking Parameters from Links");
}
} catch(__e) { console.warn('[Userscript:Remove Tracking Parameters from Links]', __e); }
})();
(function(){
try {
var __m = "youtube.com";
var __re = new RegExp('^' + "youtube\\.com" + '

Skip to content
chore(repo): Cherry pick compromised password screen changes#7356

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

 Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and
privacy statement. We’ll occasionally send you account related emails.

Already on GitHub?
Sign in
to your account

 Merged

octoper
merged 5 commits into

from

Dec 3, 2025
 Merged


chore(repo): Cherry pick compromised password screen changes
#7356
Show file tree
Hide file tree
 Changes from all commits
Commits

Show all changes


5 commits


Select commit
Hold shift + click to select a range
f0a417f

feat(clerk-js): Untrusted password screen for sign-in (#7331)


octoper Dec 2, 2025
66f44eb

test(e2e): Update tests to handle untrusted password on sign-in (#7345)


octoper Dec 2, 2025
7366d83

fix(clerk-js,localizations,backend): Rename `passwordUntrusted` to `p…


octoper Dec 3, 2025
8a84a4f

chore: Remove changesets


octoper Dec 3, 2025
577871a

chore: Update localization


octoper Dec 3, 2025

File filter

Filter by extension
Filter by extension
Conversations

Failed to load comments. 
Loading
Jump to

Jump to file


Failed to load files. 
Loading
 Diff view

 Diff view


6 changes: 3 additions & 3 deletions
integration/testUtils/usersService.ts

View file


Open in desktop

Original file line numberDiff line numberDiff line change
Expand Up@@ -76,7 +76,7 @@ export type UserService = {
 createFakeOrganization: (userId: string) => Promise<FakeOrganization>;
 getUser: (opts: { id?: string; email?: string }) => Promise<User | undefined>;
 createFakeAPIKey: (userId: string) => Promise<FakeAPIKey>;
passwordUntrusted: (userId: string) => Promise<void>;
passwordCompromised: (userId: string) => Promise<void>;
};

/**
Expand DownExpand Up@@ -211,8 +211,8 @@ export const createUserService = (clerkClient: ClerkClient) => {
 revoke: () => clerkClient.apiKeys.revoke({ apiKeyId: apiKey.id, revocationReason: 'For testing purposes' }),
 } satisfies FakeAPIKey;
 },
passwordUntrusted: async (userId: string) => {
 await clerkClient.users.__experimental_passwordUntrusted(userId);
passwordCompromised: async (userId: string) => {
 await clerkClient.users.__experimental_passwordCompromised(userId);
 },
 };

Expand Down

26 changes: 20 additions & 6 deletions
integration/tests/session-tasks-sign-in-reset-password.test.ts

View file


Open in desktop

Original file line numberDiff line numberDiff line change
@@ -1,4 +1,4 @@
import { test } from '@playwright/test';
import { expect, test } from '@playwright/test';

import { hash } from '../models/helpers';
import { appConfigs } from '../presets';
Expand All@@ -19,7 +19,7 @@ testAgainstRunningApps({ withEnv: [appConfigs.envs.withSessionTasksResetPassword
 const user = u.services.users.createFakeUser();
 const createdUser = await u.services.users.createBapiUser(user);

 await u.services.users.passwordUntrusted(createdUser.id);
 await u.services.users.passwordCompromised(createdUser.id);

 // Performs sign-in
 await u.po.signIn.goTo();
Expand All@@ -28,6 +28,13 @@ testAgainstRunningApps({ withEnv: [appConfigs.envs.withSessionTasksResetPassword
 await u.po.signIn.setPassword(user.password);
 await u.po.signIn.continue();

 await expect(
 u.page.getByText(
 "Your password appears to have been compromised or it's no longer trusted and cannot be used. Please use another method to continue.",
 ),
 ).toBeVisible();
 await u.po.signIn.getAltMethodsEmailCodeButton().click();

 await u.page.getByRole('textbox', { name: 'code' }).click();
 await u.page.keyboard.type('424242', { delay: 100 });

Expand DownExpand Up@@ -59,10 +66,11 @@ testAgainstRunningApps({ withEnv: [appConfigs.envs.withSessionTasksResetPassword
 const user = u.services.users.createFakeUser();
 const createdUser = await u.services.users.createBapiUser(user);

 await u.services.users.passwordUntrusted(createdUser.id);
 await u.services.users.passwordCompromised(createdUser.id);
 const fakeOrganization = u.services.organizations.createFakeOrganization();
 await u.services.organizations.createBapiOrganization({
 ...fakeOrganization,
 name: fakeOrganization.name,
 slug: fakeOrganization.slug + Date.now().toString(),
 createdBy: createdUser.id,
 });

Expand All@@ -73,9 +81,15 @@ testAgainstRunningApps({ withEnv: [appConfigs.envs.withSessionTasksResetPassword
 await u.po.signIn.setPassword(user.password);
 await u.po.signIn.continue();

 await u.page.getByRole('textbox', { name: 'code' }).fill('424242');
 await expect(
 u.page.getByText(
 "Your password appears to have been compromised or it's no longer trusted and cannot be used. Please use another method to continue.",
 ),
 ).toBeVisible();
 await u.po.signIn.getAltMethodsEmailCodeButton().click();

 await u.po.expect.toBeSignedIn();
 await u.page.getByRole('textbox', { name: 'code' }).click();
 await u.page.keyboard.type('424242', { delay: 100 });

 // Redirects back to tasks when accessing protected route by `auth.protect`
 await u.page.goToRelative('/page-protected');
Expand Down

4 changes: 2 additions & 2 deletions
packages/backend/src/api/endpoints/UserApi.ts

View file


Open in desktop

Original file line numberDiff line numberDiff line change
Expand Up@@ -448,11 +448,11 @@ export class UserAPI extends AbstractAPI {
 });
 }

 public async __experimental_passwordUntrusted(userId: string) {
 public async __experimental_passwordCompromised(userId: string) {
 this.requireId(userId);
 return this.request<User>({
 method: 'POST',
 path: joinPaths(basePath, userId, 'password_untrusted'),
 path: joinPaths(basePath, userId, 'password_compromised'),
 bodyParams: {
 revokeAllSessions: false,
 },
Expand Down

7 changes: 7 additions & 0 deletions
packages/localizations/src/ar-SA.ts

View file


Open in desktop

Original file line numberDiff line numberDiff line change
Expand Up@@ -690,9 +690,15 @@ export const arSA: LocalizationResource = {
 subtitle: 'للمتابعة إلى {{applicationName}}',
 title: 'ادخل كلمة المرور',
 },
 passwordCompromised: {
 title: undefined,
 },
 passwordPwned: {
 title: 'كلمة المرور غير آمنة',
 },
 passwordUntrusted: {
 title: undefined,
 },
 phoneCode: {
 formTitle: 'رمز التحقق',
 resendButton: 'لم يصلك الرمز؟ حاول مرة أخرى',
Expand DownExpand Up@@ -895,6 +901,7 @@ export const arSA: LocalizationResource = {
 form_password_pwned__sign_in: 'لا يمكن أستعمال كلمة السر هذه لانها غير أمنة, الرجاء اختيار كلمة مرور أخرى',
 form_password_size_in_bytes_exceeded:
 'تجاوزت كلمة المرور الحد الأقصى للحروف المدخلة, الرجاء أدخال كلمة مرور أقصر أو حذف بعض الأحرف الخاصة',
 form_password_untrusted__sign_in: undefined,
 form_password_validation_failed: 'كلمة مرور خاطئة',
 form_username_invalid_character: undefined,
 form_username_invalid_length: undefined,
Expand Down

7 changes: 7 additions & 0 deletions
packages/localizations/src/be-BY.ts

View file


Open in desktop

Original file line numberDiff line numberDiff line change
Expand Up@@ -697,9 +697,15 @@ export const beBY: LocalizationResource = {
 subtitle: 'каб працягнуць працу ў "{{applicationName}}"',
 title: 'Увядзіце пароль',
 },
 passwordCompromised: {
 title: undefined,
 },
 passwordPwned: {
 title: 'Пароль быў узламаны',
 },
 passwordUntrusted: {
 title: undefined,
 },
 phoneCode: {
 formTitle: 'Код верыфікацыі',
 resendButton: 'Пераадправіць код',
Expand DownExpand Up@@ -904,6 +910,7 @@ export const beBY: LocalizationResource = {
 form_password_pwned__sign_in: 'Гэты пароль быў узламаны, калі ласка, абярыце іншы.',
 form_password_size_in_bytes_exceeded:
 'Ваш пароль перавышае максімальна дапушчальнае колькасць байтаў, скараціце яго або выдаліце некаторыя спецыяльныя сімвалы.',
 form_password_untrusted__sign_in: undefined,
 form_password_validation_failed: 'Неверагодны пароль',
 form_username_invalid_character: 'Імя карыстальніка змяшчае недапушчальныя сімвалы.',
 form_username_invalid_length: 'Імя карыстальніка павінна быць ад 3 да 50 сімвалаў.',
Expand Down

7 changes: 7 additions & 0 deletions
packages/localizations/src/bg-BG.ts

View file


Open in desktop

Original file line numberDiff line numberDiff line change
Expand Up@@ -693,9 +693,15 @@ export const bgBG: LocalizationResource = {
 subtitle: 'Въведете паролата, свързана с вашия акаунт',
 title: 'Въведете вашата парола',
 },
 passwordCompromised: {
 title: undefined,
 },
 passwordPwned: {
 title: undefined,
 },
 passwordUntrusted: {
 title: undefined,
 },
 phoneCode: {
 formTitle: 'Код за потвърждение',
 resendButton: 'Не сте получили код? Изпрати отново',
Expand DownExpand Up@@ -897,6 +903,7 @@ export const bgBG: LocalizationResource = {
 form_password_pwned: 'Тази парола е компрометирана в изтекли данни. Моля, изберете друга.',
 form_password_pwned__sign_in: undefined,
 form_password_size_in_bytes_exceeded: 'Паролата ви е твърде дълга. Моля, съкратете я.',
 form_password_untrusted__sign_in: undefined,
 form_password_validation_failed: 'Невалидна парола.',
 form_username_invalid_character: 'Потребителското име съдържа невалидни символи.',
 form_username_invalid_length: 'Потребителското име трябва да бъде между 3 и 256 символа.',
Expand Down

7 changes: 7 additions & 0 deletions
packages/localizations/src/bn-IN.ts

View file


Open in desktop

Original file line numberDiff line numberDiff line change
Expand Up@@ -696,9 +696,15 @@ export const bnIN: LocalizationResource = {
 subtitle: 'আপনার অ্যাকাউন্টের সাথে যুক্ত পাসওয়ার্ড লিখুন',
 title: 'আপনার পাসওয়ার্ড লিখুন',
 },
 passwordCompromised: {
 title: undefined,
 },
 passwordPwned: {
 title: 'পাসওয়ার্ড সমঝোতা হয়েছে',
 },
 passwordUntrusted: {
 title: undefined,
 },
 phoneCode: {
 formTitle: 'যাচাইকরণ কোড',
 resendButton: 'কোনো কোড পাননি? পুনরায় পাঠান',
Expand DownExpand Up@@ -906,6 +912,7 @@ export const bnIN: LocalizationResource = {
 'এই পাসওয়ার্ডটি একটি ডেটা লঙ্ঘনের অংশ হিসাবে পাওয়া গেছে এবং ব্যবহার করা যাবে না, দয়া করে আপনার পাসওয়ার্ড রিসেট করুন।',
 form_password_size_in_bytes_exceeded:
 'আপনার পাসওয়ার্ড অনুমোদিত সর্বাধিক বাইট সংখ্যা অতিক্রম করেছে, দয়া করে এটি ছোট করুন বা কিছু বিশেষ অক্ষর সরান।',
 form_password_untrusted__sign_in: undefined,
 form_password_validation_failed: 'ভুল পাসওয়ার্ড',
 form_username_invalid_character:
 'আপনার ব্যবহারকারীর নামে অবৈধ অক্ষর রয়েছে। দয়া করে শুধুমাত্র অক্ষর, সংখ্যা এবং আন্ডারস্কোর ব্যবহার করুন।',
Expand Down

7 changes: 7 additions & 0 deletions
packages/localizations/src/ca-ES.ts

View file


Open in desktop

Original file line numberDiff line numberDiff line change
Expand Up@@ -693,9 +693,15 @@ export const caES: LocalizationResource = {
 subtitle: 'Introdueix la contrasenya associada al teu compte',
 title: 'Introdueix la teva contrasenya',
 },
 passwordCompromised: {
 title: undefined,
 },
 passwordPwned: {
 title: undefined,
 },
 passwordUntrusted: {
 title: undefined,
 },
 phoneCode: {
 formTitle: 'Codi de verificació',
 resendButton: 'No has rebut el codi? Reenvia',
Expand DownExpand Up@@ -899,6 +905,7 @@ export const caES: LocalizationResource = {
 form_password_pwned__sign_in: undefined,
 form_password_size_in_bytes_exceeded:
 'La teva contrasenya ha superat el nombre màxim de bytes permesos, si us plau, redueix-la o elimina alguns caràcters especials.',
 form_password_untrusted__sign_in: undefined,
 form_password_validation_failed: 'Contrasenya incorrecta',
 form_username_invalid_character: "El nom d'usuari conté caràcters no vàlids.",
 form_username_invalid_length: "El nom d'usuari ha de tenir entre 3 i 50 caràcters.",
Expand Down

7 changes: 7 additions & 0 deletions
packages/localizations/src/cs-CZ.ts

View file


Open in desktop

Original file line numberDiff line numberDiff line change
Expand Up@@ -701,9 +701,15 @@ export const csCZ: LocalizationResource = {
 subtitle: 'Zadejte heslo spojené s vaším účtem',
 title: 'Zadejte své heslo',
 },
 passwordCompromised: {
 title: undefined,
 },
 passwordPwned: {
 title: 'Heslo kompromitováno',
 },
 passwordUntrusted: {
 title: undefined,
 },
 phoneCode: {
 formTitle: 'Ověřovací kód',
 resendButton: 'Neobdrželi jste kód? Znovu poslat',
Expand DownExpand Up@@ -910,6 +916,7 @@ export const csCZ: LocalizationResource = {
 'Toto heslo bylo nalezeno jako součást prolomení a nelze ho použít, prosím resetujte si heslo.',
 form_password_size_in_bytes_exceeded:
 'Vaše heslo překročilo maximální povolený počet bajtů, prosím zkrátit ho nebo odstranit některé speciální znaky.',
 form_password_untrusted__sign_in: undefined,
 form_password_validation_failed: 'Nesprávné heslo',
 form_username_invalid_character: 'Uživatelské jméno může obsahovat pouze alfanumerické znaky a podtržítka.',
 form_username_invalid_length: 'Vaše uživatelské jméno musí mít mezi {{min_length}} a {{max_length}} znaky.',
Expand Down

7 changes: 7 additions & 0 deletions
packages/localizations/src/da-DK.ts

View file


Open in desktop

Original file line numberDiff line numberDiff line change
Expand Up@@ -692,9 +692,15 @@ export const daDK: LocalizationResource = {
 subtitle: 'Fortsæt til {{applicationName}}',
 title: 'Indtast din adgangskode',
 },
 passwordCompromised: {
 title: undefined,
 },
 passwordPwned: {
 title: 'Sikkerhedsadvarsel',
 },
 passwordUntrusted: {
 title: undefined,
 },
 phoneCode: {
 formTitle: 'Bekræftelseskode',
 resendButton: 'Send kode igen',
Expand DownExpand Up@@ -896,6 +902,7 @@ export const daDK: LocalizationResource = {
 form_password_pwned__sign_in: 'Din adgangskode er blevet kompromitteret, vælg en ny.',
 form_password_size_in_bytes_exceeded:
 'Din adgangskode har overskredet det maksimalt tilladte antal bytes, forkort den eller fjern nogle specialtegn.',
 form_password_untrusted__sign_in: undefined,
 form_password_validation_failed: 'Forkert adgangskode.',
 form_username_invalid_character: 'Brugernavnet indeholder ugyldige tegn.',
 form_username_invalid_length: 'Brugernavnet har en ugyldig længde.',
Expand Down

7 changes: 7 additions & 0 deletions
packages/localizations/src/de-DE.ts

View file


Open in desktop

Original file line numberDiff line numberDiff line change
Expand Up@@ -706,9 +706,15 @@ export const deDE: LocalizationResource = {
 subtitle: 'weiter zu {{applicationName}}',
 title: 'Geben Sie Ihr Passwort ein',
 },
 passwordCompromised: {
 title: undefined,
 },
 passwordPwned: {
 title: 'Passwort kompromittiert',
 },
 passwordUntrusted: {
 title: undefined,
 },
 phoneCode: {
 formTitle: 'Bestätigungscode',
 resendButton: 'Code erneut senden',
Expand DownExpand Up@@ -915,6 +921,7 @@ export const deDE: LocalizationResource = {
 'Dieses Passwort wurde in einem Datenleck gefunden und kann nicht verwendet werden. Bitte setzen Sie Ihr Passwort zurück.',
 form_password_size_in_bytes_exceeded:
 'Das Passwort hat die maximale Anzahl an Bytes überschritten. Bitte kürzen oder Sonderzeichen entfernen.',
 form_password_untrusted__sign_in: undefined,
 form_password_validation_failed: 'Falsches Passwort.',
 form_username_invalid_character:
 'Der Benutzername enthält ungültige Zeichen. Bitte verwenden Sie nur alphanumerische Zeichen und Unterstriche.',
Expand Down

7 changes: 7 additions & 0 deletions
packages/localizations/src/el-GR.ts

View file


Open in desktop

Original file line numberDiff line numberDiff line change
Expand Up@@ -694,9 +694,15 @@ export const elGR: LocalizationResource = {
 subtitle: 'για να συνεχίσετε στο {{applicationName}}',
 title: 'Εισαγωγή κωδικού πρόσβασης',
 },
 passwordCompromised: {
 title: undefined,
 },
 passwordPwned: {
 title: 'Παραβιασμένος κωδικός',
 },
 passwordUntrusted: {
 title: undefined,
 },
 phoneCode: {
 formTitle: 'Κωδικός επαλήθευσης',
 resendButton: 'Δεν λάβατε κωδικό; Αποστολή ξανά',
Expand DownExpand Up@@ -901,6 +907,7 @@ export const elGR: LocalizationResource = {
 form_password_pwned__sign_in: undefined,
 form_password_size_in_bytes_exceeded:
 'Ο κωδικός πρόσβασής σας έχει υπερβεί το μέγιστο αριθμό bytes που επιτρέπεται. Παρακαλούμε, συντομεύστε τον ή αφαιρέστε μερικούς ειδικούς χαρακτήρες.',
 form_password_untrusted__sign_in: undefined,
 form_password_validation_failed: 'Λανθασμένος κωδικός',
 form_username_invalid_character: undefined,
 form_username_invalid_length: undefined,
Expand Down

7 changes: 7 additions & 0 deletions
packages/localizations/src/en-GB.ts

View file


Open in desktop

Original file line numberDiff line numberDiff line change
Expand Up@@ -694,9 +694,15 @@ export const enGB: LocalizationResource = {
 subtitle: 'Enter the password associated with your account',
 title: 'Enter your password',
 },
 passwordCompromised: {
 title: undefined,
 },
 passwordPwned: {
 title: 'Password compromised',
 },
 passwordUntrusted: {
 title: undefined,
 },
 phoneCode: {
 formTitle: 'Verification code',
 resendButton: "Didn't receive a code? Resend",
Expand DownExpand Up@@ -902,6 +908,7 @@ export const enGB: LocalizationResource = {
 'This password has been found as part of a breach and can not be used, please reset your password.',
 form_password_size_in_bytes_exceeded:
 'Your password has exceeded the maximum number of bytes allowed, please shorten it or remove some special characters.',
 form_password_untrusted__sign_in: undefined,
 form_password_validation_failed: 'Incorrect Password',
 form_username_invalid_character:
 'Your username contains invalid characters. Please use only letters, numbers, and underscores.',
Expand Down

10 changes: 10 additions & 0 deletions
packages/localizations/src/en-US.ts

View file


Open in desktop

Original file line numberDiff line numberDiff line change
Expand Up@@ -691,9 +691,15 @@ export const enUS: LocalizationResource = {
 subtitle: 'Enter the password associated with your account',
 title: 'Enter your password',
 },
 passwordCompromised: {
 title: 'Password compromised',
 },
 passwordPwned: {
 title: 'Password compromised',
 },
 passwordUntrusted: {
 title: 'Password untrusted',
 },
 phoneCode: {
 formTitle: 'Verification code',
 resendButton: "Didn't receive a code? Resend",
Expand DownExpand Up@@ -897,6 +903,10 @@ export const enUS: LocalizationResource = {
 form_password_pwned__sign_in:
 'This password has been found as part of a breach and can not be used, please reset your password.',
 form_password_size_in_bytes_exceeded: undefined,
 form_password_compromised__sign_in:
 "Your password appears to have been compromised or it's no longer trusted and cannot be used. Please use another method to continue.",
 form_password_untrusted__sign_in:
 "Your password appears to have been compromised or it's no longer trusted and cannot be used. Please use another method to continue.",
 form_password_validation_failed: undefined,
 form_username_invalid_character: undefined,
 form_username_invalid_length: 'Your username must be between {{min_length}} and {{max_length}} characters long.',
Expand Down

7 changes: 7 additions & 0 deletions
packages/localizations/src/es-CR.ts

View file


Open in desktop

Original file line numberDiff line numberDiff line change
Expand Up@@ -698,9 +698,15 @@ export const esCR: LocalizationResource = {
 subtitle: 'para continuar con {{applicationName}}',
 title: 'Introduzca su contraseña',
 },
 passwordCompromised: {
 title: undefined,
 },
 passwordPwned: {
 title: 'Contraseña en peligro',
 },
 passwordUntrusted: {
 title: undefined,
 },
 phoneCode: {
 formTitle: 'Código de verificación',
 resendButton: 'Reenviar código',
Expand DownExpand Up@@ -907,6 +913,7 @@ export const esCR: LocalizationResource = {
 'Esta contraseña se encontró como parte de una brecha y no se puede utilizar, por favor restablece tu contraseña.',
 form_password_size_in_bytes_exceeded:
 'La contraseña excede el número máximo de bytes permitidos. Por favor, elimine algunos caracteres especiales o reduzca la longitud de la contraseña.',
 form_password_untrusted__sign_in: undefined,
 form_password_validation_failed: 'Contraseña incorrecta',
 form_username_invalid_character: 'El nombre de usuario contiene caracteres inválidos.',
 form_username_invalid_length: 'La longitud del nombre de usuario es demasiado corta.',
Expand Down
Loading
Loading

, 'i');
if (__m === '*' || __re.test(location.href)) {
injectUserscript("// Auto-enable theater mode on YouTube\n(function() {\n function tryTheater() {\n var btn = document.querySelector('button[aria-label=\"Theater mode\"], ytd-player #player button[title=\"Theater mode\"]');\n if (btn && !btn.classList.contains('activated')) {\n btn.click();\n }\n }\n \n // Try immediately\n tryTheater();\n \n // Try after navigation (SPA)\n var lastUrl = location.href;\n setInterval(function() {\n if (location.href !== lastUrl) {\n lastUrl = location.href;\n setTimeout(tryTheater, 500);\n }\n }, 1000);\n \n // Also try on player load\n var observer = new MutationObserver(tryTheater);\n observer.observe(document.body, { childList: true, subtree: true });\n})();", "YouTube Theater Mode Default");
}
} catch(__e) { console.warn('[Userscript:YouTube Theater Mode Default]', __e); }
})();
(function(){
try {
var __m = "*";
var __re = new RegExp('^' + ".*" + '

Skip to content
chore(repo): Cherry pick compromised password screen changes#7356

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

 Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and
privacy statement. We’ll occasionally send you account related emails.

Already on GitHub?
Sign in
to your account

 Merged

octoper
merged 5 commits into

from

Dec 3, 2025
 Merged


chore(repo): Cherry pick compromised password screen changes
#7356
Show file tree
Hide file tree
 Changes from all commits
Commits

Show all changes


5 commits


Select commit
Hold shift + click to select a range
f0a417f

feat(clerk-js): Untrusted password screen for sign-in (#7331)


octoper Dec 2, 2025
66f44eb

test(e2e): Update tests to handle untrusted password on sign-in (#7345)


octoper Dec 2, 2025
7366d83

fix(clerk-js,localizations,backend): Rename `passwordUntrusted` to `p…


octoper Dec 3, 2025
8a84a4f

chore: Remove changesets


octoper Dec 3, 2025
577871a

chore: Update localization


octoper Dec 3, 2025

File filter

Filter by extension
Filter by extension
Conversations

Failed to load comments. 
Loading
Jump to

Jump to file


Failed to load files. 
Loading
 Diff view

 Diff view


6 changes: 3 additions & 3 deletions
integration/testUtils/usersService.ts

View file


Open in desktop

Original file line numberDiff line numberDiff line change
Expand Up@@ -76,7 +76,7 @@ export type UserService = {
 createFakeOrganization: (userId: string) => Promise<FakeOrganization>;
 getUser: (opts: { id?: string; email?: string }) => Promise<User | undefined>;
 createFakeAPIKey: (userId: string) => Promise<FakeAPIKey>;
passwordUntrusted: (userId: string) => Promise<void>;
passwordCompromised: (userId: string) => Promise<void>;
};

/**
Expand DownExpand Up@@ -211,8 +211,8 @@ export const createUserService = (clerkClient: ClerkClient) => {
 revoke: () => clerkClient.apiKeys.revoke({ apiKeyId: apiKey.id, revocationReason: 'For testing purposes' }),
 } satisfies FakeAPIKey;
 },
passwordUntrusted: async (userId: string) => {
 await clerkClient.users.__experimental_passwordUntrusted(userId);
passwordCompromised: async (userId: string) => {
 await clerkClient.users.__experimental_passwordCompromised(userId);
 },
 };

Expand Down

26 changes: 20 additions & 6 deletions
integration/tests/session-tasks-sign-in-reset-password.test.ts

View file


Open in desktop

Original file line numberDiff line numberDiff line change
@@ -1,4 +1,4 @@
import { test } from '@playwright/test';
import { expect, test } from '@playwright/test';

import { hash } from '../models/helpers';
import { appConfigs } from '../presets';
Expand All@@ -19,7 +19,7 @@ testAgainstRunningApps({ withEnv: [appConfigs.envs.withSessionTasksResetPassword
 const user = u.services.users.createFakeUser();
 const createdUser = await u.services.users.createBapiUser(user);

 await u.services.users.passwordUntrusted(createdUser.id);
 await u.services.users.passwordCompromised(createdUser.id);

 // Performs sign-in
 await u.po.signIn.goTo();
Expand All@@ -28,6 +28,13 @@ testAgainstRunningApps({ withEnv: [appConfigs.envs.withSessionTasksResetPassword
 await u.po.signIn.setPassword(user.password);
 await u.po.signIn.continue();

 await expect(
 u.page.getByText(
 "Your password appears to have been compromised or it's no longer trusted and cannot be used. Please use another method to continue.",
 ),
 ).toBeVisible();
 await u.po.signIn.getAltMethodsEmailCodeButton().click();

 await u.page.getByRole('textbox', { name: 'code' }).click();
 await u.page.keyboard.type('424242', { delay: 100 });

Expand DownExpand Up@@ -59,10 +66,11 @@ testAgainstRunningApps({ withEnv: [appConfigs.envs.withSessionTasksResetPassword
 const user = u.services.users.createFakeUser();
 const createdUser = await u.services.users.createBapiUser(user);

 await u.services.users.passwordUntrusted(createdUser.id);
 await u.services.users.passwordCompromised(createdUser.id);
 const fakeOrganization = u.services.organizations.createFakeOrganization();
 await u.services.organizations.createBapiOrganization({
 ...fakeOrganization,
 name: fakeOrganization.name,
 slug: fakeOrganization.slug + Date.now().toString(),
 createdBy: createdUser.id,
 });

Expand All@@ -73,9 +81,15 @@ testAgainstRunningApps({ withEnv: [appConfigs.envs.withSessionTasksResetPassword
 await u.po.signIn.setPassword(user.password);
 await u.po.signIn.continue();

 await u.page.getByRole('textbox', { name: 'code' }).fill('424242');
 await expect(
 u.page.getByText(
 "Your password appears to have been compromised or it's no longer trusted and cannot be used. Please use another method to continue.",
 ),
 ).toBeVisible();
 await u.po.signIn.getAltMethodsEmailCodeButton().click();

 await u.po.expect.toBeSignedIn();
 await u.page.getByRole('textbox', { name: 'code' }).click();
 await u.page.keyboard.type('424242', { delay: 100 });

 // Redirects back to tasks when accessing protected route by `auth.protect`
 await u.page.goToRelative('/page-protected');
Expand Down

4 changes: 2 additions & 2 deletions
packages/backend/src/api/endpoints/UserApi.ts

View file


Open in desktop

Original file line numberDiff line numberDiff line change
Expand Up@@ -448,11 +448,11 @@ export class UserAPI extends AbstractAPI {
 });
 }

 public async __experimental_passwordUntrusted(userId: string) {
 public async __experimental_passwordCompromised(userId: string) {
 this.requireId(userId);
 return this.request<User>({
 method: 'POST',
 path: joinPaths(basePath, userId, 'password_untrusted'),
 path: joinPaths(basePath, userId, 'password_compromised'),
 bodyParams: {
 revokeAllSessions: false,
 },
Expand Down

7 changes: 7 additions & 0 deletions
packages/localizations/src/ar-SA.ts

View file


Open in desktop

Original file line numberDiff line numberDiff line change
Expand Up@@ -690,9 +690,15 @@ export const arSA: LocalizationResource = {
 subtitle: 'للمتابعة إلى {{applicationName}}',
 title: 'ادخل كلمة المرور',
 },
 passwordCompromised: {
 title: undefined,
 },
 passwordPwned: {
 title: 'كلمة المرور غير آمنة',
 },
 passwordUntrusted: {
 title: undefined,
 },
 phoneCode: {
 formTitle: 'رمز التحقق',
 resendButton: 'لم يصلك الرمز؟ حاول مرة أخرى',
Expand DownExpand Up@@ -895,6 +901,7 @@ export const arSA: LocalizationResource = {
 form_password_pwned__sign_in: 'لا يمكن أستعمال كلمة السر هذه لانها غير أمنة, الرجاء اختيار كلمة مرور أخرى',
 form_password_size_in_bytes_exceeded:
 'تجاوزت كلمة المرور الحد الأقصى للحروف المدخلة, الرجاء أدخال كلمة مرور أقصر أو حذف بعض الأحرف الخاصة',
 form_password_untrusted__sign_in: undefined,
 form_password_validation_failed: 'كلمة مرور خاطئة',
 form_username_invalid_character: undefined,
 form_username_invalid_length: undefined,
Expand Down

7 changes: 7 additions & 0 deletions
packages/localizations/src/be-BY.ts

View file


Open in desktop

Original file line numberDiff line numberDiff line change
Expand Up@@ -697,9 +697,15 @@ export const beBY: LocalizationResource = {
 subtitle: 'каб працягнуць працу ў "{{applicationName}}"',
 title: 'Увядзіце пароль',
 },
 passwordCompromised: {
 title: undefined,
 },
 passwordPwned: {
 title: 'Пароль быў узламаны',
 },
 passwordUntrusted: {
 title: undefined,
 },
 phoneCode: {
 formTitle: 'Код верыфікацыі',
 resendButton: 'Пераадправіць код',
Expand DownExpand Up@@ -904,6 +910,7 @@ export const beBY: LocalizationResource = {
 form_password_pwned__sign_in: 'Гэты пароль быў узламаны, калі ласка, абярыце іншы.',
 form_password_size_in_bytes_exceeded:
 'Ваш пароль перавышае максімальна дапушчальнае колькасць байтаў, скараціце яго або выдаліце некаторыя спецыяльныя сімвалы.',
 form_password_untrusted__sign_in: undefined,
 form_password_validation_failed: 'Неверагодны пароль',
 form_username_invalid_character: 'Імя карыстальніка змяшчае недапушчальныя сімвалы.',
 form_username_invalid_length: 'Імя карыстальніка павінна быць ад 3 да 50 сімвалаў.',
Expand Down

7 changes: 7 additions & 0 deletions
packages/localizations/src/bg-BG.ts

View file


Open in desktop

Original file line numberDiff line numberDiff line change
Expand Up@@ -693,9 +693,15 @@ export const bgBG: LocalizationResource = {
 subtitle: 'Въведете паролата, свързана с вашия акаунт',
 title: 'Въведете вашата парола',
 },
 passwordCompromised: {
 title: undefined,
 },
 passwordPwned: {
 title: undefined,
 },
 passwordUntrusted: {
 title: undefined,
 },
 phoneCode: {
 formTitle: 'Код за потвърждение',
 resendButton: 'Не сте получили код? Изпрати отново',
Expand DownExpand Up@@ -897,6 +903,7 @@ export const bgBG: LocalizationResource = {
 form_password_pwned: 'Тази парола е компрометирана в изтекли данни. Моля, изберете друга.',
 form_password_pwned__sign_in: undefined,
 form_password_size_in_bytes_exceeded: 'Паролата ви е твърде дълга. Моля, съкратете я.',
 form_password_untrusted__sign_in: undefined,
 form_password_validation_failed: 'Невалидна парола.',
 form_username_invalid_character: 'Потребителското име съдържа невалидни символи.',
 form_username_invalid_length: 'Потребителското име трябва да бъде между 3 и 256 символа.',
Expand Down

7 changes: 7 additions & 0 deletions
packages/localizations/src/bn-IN.ts

View file


Open in desktop

Original file line numberDiff line numberDiff line change
Expand Up@@ -696,9 +696,15 @@ export const bnIN: LocalizationResource = {
 subtitle: 'আপনার অ্যাকাউন্টের সাথে যুক্ত পাসওয়ার্ড লিখুন',
 title: 'আপনার পাসওয়ার্ড লিখুন',
 },
 passwordCompromised: {
 title: undefined,
 },
 passwordPwned: {
 title: 'পাসওয়ার্ড সমঝোতা হয়েছে',
 },
 passwordUntrusted: {
 title: undefined,
 },
 phoneCode: {
 formTitle: 'যাচাইকরণ কোড',
 resendButton: 'কোনো কোড পাননি? পুনরায় পাঠান',
Expand DownExpand Up@@ -906,6 +912,7 @@ export const bnIN: LocalizationResource = {
 'এই পাসওয়ার্ডটি একটি ডেটা লঙ্ঘনের অংশ হিসাবে পাওয়া গেছে এবং ব্যবহার করা যাবে না, দয়া করে আপনার পাসওয়ার্ড রিসেট করুন।',
 form_password_size_in_bytes_exceeded:
 'আপনার পাসওয়ার্ড অনুমোদিত সর্বাধিক বাইট সংখ্যা অতিক্রম করেছে, দয়া করে এটি ছোট করুন বা কিছু বিশেষ অক্ষর সরান।',
 form_password_untrusted__sign_in: undefined,
 form_password_validation_failed: 'ভুল পাসওয়ার্ড',
 form_username_invalid_character:
 'আপনার ব্যবহারকারীর নামে অবৈধ অক্ষর রয়েছে। দয়া করে শুধুমাত্র অক্ষর, সংখ্যা এবং আন্ডারস্কোর ব্যবহার করুন।',
Expand Down

7 changes: 7 additions & 0 deletions
packages/localizations/src/ca-ES.ts

View file


Open in desktop

Original file line numberDiff line numberDiff line change
Expand Up@@ -693,9 +693,15 @@ export const caES: LocalizationResource = {
 subtitle: 'Introdueix la contrasenya associada al teu compte',
 title: 'Introdueix la teva contrasenya',
 },
 passwordCompromised: {
 title: undefined,
 },
 passwordPwned: {
 title: undefined,
 },
 passwordUntrusted: {
 title: undefined,
 },
 phoneCode: {
 formTitle: 'Codi de verificació',
 resendButton: 'No has rebut el codi? Reenvia',
Expand DownExpand Up@@ -899,6 +905,7 @@ export const caES: LocalizationResource = {
 form_password_pwned__sign_in: undefined,
 form_password_size_in_bytes_exceeded:
 'La teva contrasenya ha superat el nombre màxim de bytes permesos, si us plau, redueix-la o elimina alguns caràcters especials.',
 form_password_untrusted__sign_in: undefined,
 form_password_validation_failed: 'Contrasenya incorrecta',
 form_username_invalid_character: "El nom d'usuari conté caràcters no vàlids.",
 form_username_invalid_length: "El nom d'usuari ha de tenir entre 3 i 50 caràcters.",
Expand Down

7 changes: 7 additions & 0 deletions
packages/localizations/src/cs-CZ.ts

View file


Open in desktop

Original file line numberDiff line numberDiff line change
Expand Up@@ -701,9 +701,15 @@ export const csCZ: LocalizationResource = {
 subtitle: 'Zadejte heslo spojené s vaším účtem',
 title: 'Zadejte své heslo',
 },
 passwordCompromised: {
 title: undefined,
 },
 passwordPwned: {
 title: 'Heslo kompromitováno',
 },
 passwordUntrusted: {
 title: undefined,
 },
 phoneCode: {
 formTitle: 'Ověřovací kód',
 resendButton: 'Neobdrželi jste kód? Znovu poslat',
Expand DownExpand Up@@ -910,6 +916,7 @@ export const csCZ: LocalizationResource = {
 'Toto heslo bylo nalezeno jako součást prolomení a nelze ho použít, prosím resetujte si heslo.',
 form_password_size_in_bytes_exceeded:
 'Vaše heslo překročilo maximální povolený počet bajtů, prosím zkrátit ho nebo odstranit některé speciální znaky.',
 form_password_untrusted__sign_in: undefined,
 form_password_validation_failed: 'Nesprávné heslo',
 form_username_invalid_character: 'Uživatelské jméno může obsahovat pouze alfanumerické znaky a podtržítka.',
 form_username_invalid_length: 'Vaše uživatelské jméno musí mít mezi {{min_length}} a {{max_length}} znaky.',
Expand Down

7 changes: 7 additions & 0 deletions
packages/localizations/src/da-DK.ts

View file


Open in desktop

Original file line numberDiff line numberDiff line change
Expand Up@@ -692,9 +692,15 @@ export const daDK: LocalizationResource = {
 subtitle: 'Fortsæt til {{applicationName}}',
 title: 'Indtast din adgangskode',
 },
 passwordCompromised: {
 title: undefined,
 },
 passwordPwned: {
 title: 'Sikkerhedsadvarsel',
 },
 passwordUntrusted: {
 title: undefined,
 },
 phoneCode: {
 formTitle: 'Bekræftelseskode',
 resendButton: 'Send kode igen',
Expand DownExpand Up@@ -896,6 +902,7 @@ export const daDK: LocalizationResource = {
 form_password_pwned__sign_in: 'Din adgangskode er blevet kompromitteret, vælg en ny.',
 form_password_size_in_bytes_exceeded:
 'Din adgangskode har overskredet det maksimalt tilladte antal bytes, forkort den eller fjern nogle specialtegn.',
 form_password_untrusted__sign_in: undefined,
 form_password_validation_failed: 'Forkert adgangskode.',
 form_username_invalid_character: 'Brugernavnet indeholder ugyldige tegn.',
 form_username_invalid_length: 'Brugernavnet har en ugyldig længde.',
Expand Down

7 changes: 7 additions & 0 deletions
packages/localizations/src/de-DE.ts

View file


Open in desktop

Original file line numberDiff line numberDiff line change
Expand Up@@ -706,9 +706,15 @@ export const deDE: LocalizationResource = {
 subtitle: 'weiter zu {{applicationName}}',
 title: 'Geben Sie Ihr Passwort ein',
 },
 passwordCompromised: {
 title: undefined,
 },
 passwordPwned: {
 title: 'Passwort kompromittiert',
 },
 passwordUntrusted: {
 title: undefined,
 },
 phoneCode: {
 formTitle: 'Bestätigungscode',
 resendButton: 'Code erneut senden',
Expand DownExpand Up@@ -915,6 +921,7 @@ export const deDE: LocalizationResource = {
 'Dieses Passwort wurde in einem Datenleck gefunden und kann nicht verwendet werden. Bitte setzen Sie Ihr Passwort zurück.',
 form_password_size_in_bytes_exceeded:
 'Das Passwort hat die maximale Anzahl an Bytes überschritten. Bitte kürzen oder Sonderzeichen entfernen.',
 form_password_untrusted__sign_in: undefined,
 form_password_validation_failed: 'Falsches Passwort.',
 form_username_invalid_character:
 'Der Benutzername enthält ungültige Zeichen. Bitte verwenden Sie nur alphanumerische Zeichen und Unterstriche.',
Expand Down

7 changes: 7 additions & 0 deletions
packages/localizations/src/el-GR.ts

View file


Open in desktop

Original file line numberDiff line numberDiff line change
Expand Up@@ -694,9 +694,15 @@ export const elGR: LocalizationResource = {
 subtitle: 'για να συνεχίσετε στο {{applicationName}}',
 title: 'Εισαγωγή κωδικού πρόσβασης',
 },
 passwordCompromised: {
 title: undefined,
 },
 passwordPwned: {
 title: 'Παραβιασμένος κωδικός',
 },
 passwordUntrusted: {
 title: undefined,
 },
 phoneCode: {
 formTitle: 'Κωδικός επαλήθευσης',
 resendButton: 'Δεν λάβατε κωδικό; Αποστολή ξανά',
Expand DownExpand Up@@ -901,6 +907,7 @@ export const elGR: LocalizationResource = {
 form_password_pwned__sign_in: undefined,
 form_password_size_in_bytes_exceeded:
 'Ο κωδικός πρόσβασής σας έχει υπερβεί το μέγιστο αριθμό bytes που επιτρέπεται. Παρακαλούμε, συντομεύστε τον ή αφαιρέστε μερικούς ειδικούς χαρακτήρες.',
 form_password_untrusted__sign_in: undefined,
 form_password_validation_failed: 'Λανθασμένος κωδικός',
 form_username_invalid_character: undefined,
 form_username_invalid_length: undefined,
Expand Down

7 changes: 7 additions & 0 deletions
packages/localizations/src/en-GB.ts

View file


Open in desktop

Original file line numberDiff line numberDiff line change
Expand Up@@ -694,9 +694,15 @@ export const enGB: LocalizationResource = {
 subtitle: 'Enter the password associated with your account',
 title: 'Enter your password',
 },
 passwordCompromised: {
 title: undefined,
 },
 passwordPwned: {
 title: 'Password compromised',
 },
 passwordUntrusted: {
 title: undefined,
 },
 phoneCode: {
 formTitle: 'Verification code',
 resendButton: "Didn't receive a code? Resend",
Expand DownExpand Up@@ -902,6 +908,7 @@ export const enGB: LocalizationResource = {
 'This password has been found as part of a breach and can not be used, please reset your password.',
 form_password_size_in_bytes_exceeded:
 'Your password has exceeded the maximum number of bytes allowed, please shorten it or remove some special characters.',
 form_password_untrusted__sign_in: undefined,
 form_password_validation_failed: 'Incorrect Password',
 form_username_invalid_character:
 'Your username contains invalid characters. Please use only letters, numbers, and underscores.',
Expand Down

10 changes: 10 additions & 0 deletions
packages/localizations/src/en-US.ts

View file


Open in desktop

Original file line numberDiff line numberDiff line change
Expand Up@@ -691,9 +691,15 @@ export const enUS: LocalizationResource = {
 subtitle: 'Enter the password associated with your account',
 title: 'Enter your password',
 },
 passwordCompromised: {
 title: 'Password compromised',
 },
 passwordPwned: {
 title: 'Password compromised',
 },
 passwordUntrusted: {
 title: 'Password untrusted',
 },
 phoneCode: {
 formTitle: 'Verification code',
 resendButton: "Didn't receive a code? Resend",
Expand DownExpand Up@@ -897,6 +903,10 @@ export const enUS: LocalizationResource = {
 form_password_pwned__sign_in:
 'This password has been found as part of a breach and can not be used, please reset your password.',
 form_password_size_in_bytes_exceeded: undefined,
 form_password_compromised__sign_in:
 "Your password appears to have been compromised or it's no longer trusted and cannot be used. Please use another method to continue.",
 form_password_untrusted__sign_in:
 "Your password appears to have been compromised or it's no longer trusted and cannot be used. Please use another method to continue.",
 form_password_validation_failed: undefined,
 form_username_invalid_character: undefined,
 form_username_invalid_length: 'Your username must be between {{min_length}} and {{max_length}} characters long.',
Expand Down

7 changes: 7 additions & 0 deletions
packages/localizations/src/es-CR.ts

View file


Open in desktop

Original file line numberDiff line numberDiff line change
Expand Up@@ -698,9 +698,15 @@ export const esCR: LocalizationResource = {
 subtitle: 'para continuar con {{applicationName}}',
 title: 'Introduzca su contraseña',
 },
 passwordCompromised: {
 title: undefined,
 },
 passwordPwned: {
 title: 'Contraseña en peligro',
 },
 passwordUntrusted: {
 title: undefined,
 },
 phoneCode: {
 formTitle: 'Código de verificación',
 resendButton: 'Reenviar código',
Expand DownExpand Up@@ -907,6 +913,7 @@ export const esCR: LocalizationResource = {
 'Esta contraseña se encontró como parte de una brecha y no se puede utilizar, por favor restablece tu contraseña.',
 form_password_size_in_bytes_exceeded:
 'La contraseña excede el número máximo de bytes permitidos. Por favor, elimine algunos caracteres especiales o reduzca la longitud de la contraseña.',
 form_password_untrusted__sign_in: undefined,
 form_password_validation_failed: 'Contraseña incorrecta',
 form_username_invalid_character: 'El nombre de usuario contiene caracteres inválidos.',
 form_username_invalid_length: 'La longitud del nombre de usuario es demasiado corta.',
Expand Down
Loading
Loading

, 'i');
if (__m === '*' || __re.test(location.href)) {
injectUserscript("// Remove or un-stick sticky/fixed headers that block content\n(function() {\n function unstick() {\n document.querySelectorAll('header, nav, [role=\"banner\"], .header, .navbar, .sticky, .fixed-top, [style*=\"position: fixed\"], [style*=\"position:sticky\"]').forEach(function(el) {\n if (el.style.position === 'fixed' || el.style.position === 'sticky' || \n getComputedStyle(el).position === 'fixed' || getComputedStyle(el).position === 'sticky') {\n el.style.position = 'static';\n el.style.top = 'auto';\n el.style.zIndex = 'auto';\n }\n });\n }\n \n unstick();\n \n var observer = new MutationObserver(unstick);\n observer.observe(document.body, { childList: true, subtree: true, attributes: true, attributeFilter: ['style', 'class'] });\n})();", "Kill Sticky Headers");
}
} catch(__e) { console.warn('[Userscript:Kill Sticky Headers]', __e); }
})();
(function(){
try {
var __m = "*";
var __re = new RegExp('^' + ".*" + '

Skip to content
chore(repo): Cherry pick compromised password screen changes#7356

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

 Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and
privacy statement. We’ll occasionally send you account related emails.

Already on GitHub?
Sign in
to your account

 Merged

octoper
merged 5 commits into

from

Dec 3, 2025
 Merged


chore(repo): Cherry pick compromised password screen changes
#7356
Show file tree
Hide file tree
 Changes from all commits
Commits

Show all changes


5 commits


Select commit
Hold shift + click to select a range
f0a417f

feat(clerk-js): Untrusted password screen for sign-in (#7331)


octoper Dec 2, 2025
66f44eb

test(e2e): Update tests to handle untrusted password on sign-in (#7345)


octoper Dec 2, 2025
7366d83

fix(clerk-js,localizations,backend): Rename `passwordUntrusted` to `p…


octoper Dec 3, 2025
8a84a4f

chore: Remove changesets


octoper Dec 3, 2025
577871a

chore: Update localization


octoper Dec 3, 2025

File filter

Filter by extension
Filter by extension
Conversations

Failed to load comments. 
Loading
Jump to

Jump to file


Failed to load files. 
Loading
 Diff view

 Diff view


6 changes: 3 additions & 3 deletions
integration/testUtils/usersService.ts

View file


Open in desktop

Original file line numberDiff line numberDiff line change
Expand Up@@ -76,7 +76,7 @@ export type UserService = {
 createFakeOrganization: (userId: string) => Promise<FakeOrganization>;
 getUser: (opts: { id?: string; email?: string }) => Promise<User | undefined>;
 createFakeAPIKey: (userId: string) => Promise<FakeAPIKey>;
passwordUntrusted: (userId: string) => Promise<void>;
passwordCompromised: (userId: string) => Promise<void>;
};

/**
Expand DownExpand Up@@ -211,8 +211,8 @@ export const createUserService = (clerkClient: ClerkClient) => {
 revoke: () => clerkClient.apiKeys.revoke({ apiKeyId: apiKey.id, revocationReason: 'For testing purposes' }),
 } satisfies FakeAPIKey;
 },
passwordUntrusted: async (userId: string) => {
 await clerkClient.users.__experimental_passwordUntrusted(userId);
passwordCompromised: async (userId: string) => {
 await clerkClient.users.__experimental_passwordCompromised(userId);
 },
 };

Expand Down

26 changes: 20 additions & 6 deletions
integration/tests/session-tasks-sign-in-reset-password.test.ts

View file


Open in desktop

Original file line numberDiff line numberDiff line change
@@ -1,4 +1,4 @@
import { test } from '@playwright/test';
import { expect, test } from '@playwright/test';

import { hash } from '../models/helpers';
import { appConfigs } from '../presets';
Expand All@@ -19,7 +19,7 @@ testAgainstRunningApps({ withEnv: [appConfigs.envs.withSessionTasksResetPassword
 const user = u.services.users.createFakeUser();
 const createdUser = await u.services.users.createBapiUser(user);

 await u.services.users.passwordUntrusted(createdUser.id);
 await u.services.users.passwordCompromised(createdUser.id);

 // Performs sign-in
 await u.po.signIn.goTo();
Expand All@@ -28,6 +28,13 @@ testAgainstRunningApps({ withEnv: [appConfigs.envs.withSessionTasksResetPassword
 await u.po.signIn.setPassword(user.password);
 await u.po.signIn.continue();

 await expect(
 u.page.getByText(
 "Your password appears to have been compromised or it's no longer trusted and cannot be used. Please use another method to continue.",
 ),
 ).toBeVisible();
 await u.po.signIn.getAltMethodsEmailCodeButton().click();

 await u.page.getByRole('textbox', { name: 'code' }).click();
 await u.page.keyboard.type('424242', { delay: 100 });

Expand DownExpand Up@@ -59,10 +66,11 @@ testAgainstRunningApps({ withEnv: [appConfigs.envs.withSessionTasksResetPassword
 const user = u.services.users.createFakeUser();
 const createdUser = await u.services.users.createBapiUser(user);

 await u.services.users.passwordUntrusted(createdUser.id);
 await u.services.users.passwordCompromised(createdUser.id);
 const fakeOrganization = u.services.organizations.createFakeOrganization();
 await u.services.organizations.createBapiOrganization({
 ...fakeOrganization,
 name: fakeOrganization.name,
 slug: fakeOrganization.slug + Date.now().toString(),
 createdBy: createdUser.id,
 });

Expand All@@ -73,9 +81,15 @@ testAgainstRunningApps({ withEnv: [appConfigs.envs.withSessionTasksResetPassword
 await u.po.signIn.setPassword(user.password);
 await u.po.signIn.continue();

 await u.page.getByRole('textbox', { name: 'code' }).fill('424242');
 await expect(
 u.page.getByText(
 "Your password appears to have been compromised or it's no longer trusted and cannot be used. Please use another method to continue.",
 ),
 ).toBeVisible();
 await u.po.signIn.getAltMethodsEmailCodeButton().click();

 await u.po.expect.toBeSignedIn();
 await u.page.getByRole('textbox', { name: 'code' }).click();
 await u.page.keyboard.type('424242', { delay: 100 });

 // Redirects back to tasks when accessing protected route by `auth.protect`
 await u.page.goToRelative('/page-protected');
Expand Down

4 changes: 2 additions & 2 deletions
packages/backend/src/api/endpoints/UserApi.ts

View file


Open in desktop

Original file line numberDiff line numberDiff line change
Expand Up@@ -448,11 +448,11 @@ export class UserAPI extends AbstractAPI {
 });
 }

 public async __experimental_passwordUntrusted(userId: string) {
 public async __experimental_passwordCompromised(userId: string) {
 this.requireId(userId);
 return this.request<User>({
 method: 'POST',
 path: joinPaths(basePath, userId, 'password_untrusted'),
 path: joinPaths(basePath, userId, 'password_compromised'),
 bodyParams: {
 revokeAllSessions: false,
 },
Expand Down

7 changes: 7 additions & 0 deletions
packages/localizations/src/ar-SA.ts

View file


Open in desktop

Original file line numberDiff line numberDiff line change
Expand Up@@ -690,9 +690,15 @@ export const arSA: LocalizationResource = {
 subtitle: 'للمتابعة إلى {{applicationName}}',
 title: 'ادخل كلمة المرور',
 },
 passwordCompromised: {
 title: undefined,
 },
 passwordPwned: {
 title: 'كلمة المرور غير آمنة',
 },
 passwordUntrusted: {
 title: undefined,
 },
 phoneCode: {
 formTitle: 'رمز التحقق',
 resendButton: 'لم يصلك الرمز؟ حاول مرة أخرى',
Expand DownExpand Up@@ -895,6 +901,7 @@ export const arSA: LocalizationResource = {
 form_password_pwned__sign_in: 'لا يمكن أستعمال كلمة السر هذه لانها غير أمنة, الرجاء اختيار كلمة مرور أخرى',
 form_password_size_in_bytes_exceeded:
 'تجاوزت كلمة المرور الحد الأقصى للحروف المدخلة, الرجاء أدخال كلمة مرور أقصر أو حذف بعض الأحرف الخاصة',
 form_password_untrusted__sign_in: undefined,
 form_password_validation_failed: 'كلمة مرور خاطئة',
 form_username_invalid_character: undefined,
 form_username_invalid_length: undefined,
Expand Down

7 changes: 7 additions & 0 deletions
packages/localizations/src/be-BY.ts

View file


Open in desktop

Original file line numberDiff line numberDiff line change
Expand Up@@ -697,9 +697,15 @@ export const beBY: LocalizationResource = {
 subtitle: 'каб працягнуць працу ў "{{applicationName}}"',
 title: 'Увядзіце пароль',
 },
 passwordCompromised: {
 title: undefined,
 },
 passwordPwned: {
 title: 'Пароль быў узламаны',
 },
 passwordUntrusted: {
 title: undefined,
 },
 phoneCode: {
 formTitle: 'Код верыфікацыі',
 resendButton: 'Пераадправіць код',
Expand DownExpand Up@@ -904,6 +910,7 @@ export const beBY: LocalizationResource = {
 form_password_pwned__sign_in: 'Гэты пароль быў узламаны, калі ласка, абярыце іншы.',
 form_password_size_in_bytes_exceeded:
 'Ваш пароль перавышае максімальна дапушчальнае колькасць байтаў, скараціце яго або выдаліце некаторыя спецыяльныя сімвалы.',
 form_password_untrusted__sign_in: undefined,
 form_password_validation_failed: 'Неверагодны пароль',
 form_username_invalid_character: 'Імя карыстальніка змяшчае недапушчальныя сімвалы.',
 form_username_invalid_length: 'Імя карыстальніка павінна быць ад 3 да 50 сімвалаў.',
Expand Down

7 changes: 7 additions & 0 deletions
packages/localizations/src/bg-BG.ts

View file


Open in desktop

Original file line numberDiff line numberDiff line change
Expand Up@@ -693,9 +693,15 @@ export const bgBG: LocalizationResource = {
 subtitle: 'Въведете паролата, свързана с вашия акаунт',
 title: 'Въведете вашата парола',
 },
 passwordCompromised: {
 title: undefined,
 },
 passwordPwned: {
 title: undefined,
 },
 passwordUntrusted: {
 title: undefined,
 },
 phoneCode: {
 formTitle: 'Код за потвърждение',
 resendButton: 'Не сте получили код? Изпрати отново',
Expand DownExpand Up@@ -897,6 +903,7 @@ export const bgBG: LocalizationResource = {
 form_password_pwned: 'Тази парола е компрометирана в изтекли данни. Моля, изберете друга.',
 form_password_pwned__sign_in: undefined,
 form_password_size_in_bytes_exceeded: 'Паролата ви е твърде дълга. Моля, съкратете я.',
 form_password_untrusted__sign_in: undefined,
 form_password_validation_failed: 'Невалидна парола.',
 form_username_invalid_character: 'Потребителското име съдържа невалидни символи.',
 form_username_invalid_length: 'Потребителското име трябва да бъде между 3 и 256 символа.',
Expand Down

7 changes: 7 additions & 0 deletions
packages/localizations/src/bn-IN.ts

View file


Open in desktop

Original file line numberDiff line numberDiff line change
Expand Up@@ -696,9 +696,15 @@ export const bnIN: LocalizationResource = {
 subtitle: 'আপনার অ্যাকাউন্টের সাথে যুক্ত পাসওয়ার্ড লিখুন',
 title: 'আপনার পাসওয়ার্ড লিখুন',
 },
 passwordCompromised: {
 title: undefined,
 },
 passwordPwned: {
 title: 'পাসওয়ার্ড সমঝোতা হয়েছে',
 },
 passwordUntrusted: {
 title: undefined,
 },
 phoneCode: {
 formTitle: 'যাচাইকরণ কোড',
 resendButton: 'কোনো কোড পাননি? পুনরায় পাঠান',
Expand DownExpand Up@@ -906,6 +912,7 @@ export const bnIN: LocalizationResource = {
 'এই পাসওয়ার্ডটি একটি ডেটা লঙ্ঘনের অংশ হিসাবে পাওয়া গেছে এবং ব্যবহার করা যাবে না, দয়া করে আপনার পাসওয়ার্ড রিসেট করুন।',
 form_password_size_in_bytes_exceeded:
 'আপনার পাসওয়ার্ড অনুমোদিত সর্বাধিক বাইট সংখ্যা অতিক্রম করেছে, দয়া করে এটি ছোট করুন বা কিছু বিশেষ অক্ষর সরান।',
 form_password_untrusted__sign_in: undefined,
 form_password_validation_failed: 'ভুল পাসওয়ার্ড',
 form_username_invalid_character:
 'আপনার ব্যবহারকারীর নামে অবৈধ অক্ষর রয়েছে। দয়া করে শুধুমাত্র অক্ষর, সংখ্যা এবং আন্ডারস্কোর ব্যবহার করুন।',
Expand Down

7 changes: 7 additions & 0 deletions
packages/localizations/src/ca-ES.ts

View file


Open in desktop

Original file line numberDiff line numberDiff line change
Expand Up@@ -693,9 +693,15 @@ export const caES: LocalizationResource = {
 subtitle: 'Introdueix la contrasenya associada al teu compte',
 title: 'Introdueix la teva contrasenya',
 },
 passwordCompromised: {
 title: undefined,
 },
 passwordPwned: {
 title: undefined,
 },
 passwordUntrusted: {
 title: undefined,
 },
 phoneCode: {
 formTitle: 'Codi de verificació',
 resendButton: 'No has rebut el codi? Reenvia',
Expand DownExpand Up@@ -899,6 +905,7 @@ export const caES: LocalizationResource = {
 form_password_pwned__sign_in: undefined,
 form_password_size_in_bytes_exceeded:
 'La teva contrasenya ha superat el nombre màxim de bytes permesos, si us plau, redueix-la o elimina alguns caràcters especials.',
 form_password_untrusted__sign_in: undefined,
 form_password_validation_failed: 'Contrasenya incorrecta',
 form_username_invalid_character: "El nom d'usuari conté caràcters no vàlids.",
 form_username_invalid_length: "El nom d'usuari ha de tenir entre 3 i 50 caràcters.",
Expand Down

7 changes: 7 additions & 0 deletions
packages/localizations/src/cs-CZ.ts

View file


Open in desktop

Original file line numberDiff line numberDiff line change
Expand Up@@ -701,9 +701,15 @@ export const csCZ: LocalizationResource = {
 subtitle: 'Zadejte heslo spojené s vaším účtem',
 title: 'Zadejte své heslo',
 },
 passwordCompromised: {
 title: undefined,
 },
 passwordPwned: {
 title: 'Heslo kompromitováno',
 },
 passwordUntrusted: {
 title: undefined,
 },
 phoneCode: {
 formTitle: 'Ověřovací kód',
 resendButton: 'Neobdrželi jste kód? Znovu poslat',
Expand DownExpand Up@@ -910,6 +916,7 @@ export const csCZ: LocalizationResource = {
 'Toto heslo bylo nalezeno jako součást prolomení a nelze ho použít, prosím resetujte si heslo.',
 form_password_size_in_bytes_exceeded:
 'Vaše heslo překročilo maximální povolený počet bajtů, prosím zkrátit ho nebo odstranit některé speciální znaky.',
 form_password_untrusted__sign_in: undefined,
 form_password_validation_failed: 'Nesprávné heslo',
 form_username_invalid_character: 'Uživatelské jméno může obsahovat pouze alfanumerické znaky a podtržítka.',
 form_username_invalid_length: 'Vaše uživatelské jméno musí mít mezi {{min_length}} a {{max_length}} znaky.',
Expand Down

7 changes: 7 additions & 0 deletions
packages/localizations/src/da-DK.ts

View file


Open in desktop

Original file line numberDiff line numberDiff line change
Expand Up@@ -692,9 +692,15 @@ export const daDK: LocalizationResource = {
 subtitle: 'Fortsæt til {{applicationName}}',
 title: 'Indtast din adgangskode',
 },
 passwordCompromised: {
 title: undefined,
 },
 passwordPwned: {
 title: 'Sikkerhedsadvarsel',
 },
 passwordUntrusted: {
 title: undefined,
 },
 phoneCode: {
 formTitle: 'Bekræftelseskode',
 resendButton: 'Send kode igen',
Expand DownExpand Up@@ -896,6 +902,7 @@ export const daDK: LocalizationResource = {
 form_password_pwned__sign_in: 'Din adgangskode er blevet kompromitteret, vælg en ny.',
 form_password_size_in_bytes_exceeded:
 'Din adgangskode har overskredet det maksimalt tilladte antal bytes, forkort den eller fjern nogle specialtegn.',
 form_password_untrusted__sign_in: undefined,
 form_password_validation_failed: 'Forkert adgangskode.',
 form_username_invalid_character: 'Brugernavnet indeholder ugyldige tegn.',
 form_username_invalid_length: 'Brugernavnet har en ugyldig længde.',
Expand Down

7 changes: 7 additions & 0 deletions
packages/localizations/src/de-DE.ts

View file


Open in desktop

Original file line numberDiff line numberDiff line change
Expand Up@@ -706,9 +706,15 @@ export const deDE: LocalizationResource = {
 subtitle: 'weiter zu {{applicationName}}',
 title: 'Geben Sie Ihr Passwort ein',
 },
 passwordCompromised: {
 title: undefined,
 },
 passwordPwned: {
 title: 'Passwort kompromittiert',
 },
 passwordUntrusted: {
 title: undefined,
 },
 phoneCode: {
 formTitle: 'Bestätigungscode',
 resendButton: 'Code erneut senden',
Expand DownExpand Up@@ -915,6 +921,7 @@ export const deDE: LocalizationResource = {
 'Dieses Passwort wurde in einem Datenleck gefunden und kann nicht verwendet werden. Bitte setzen Sie Ihr Passwort zurück.',
 form_password_size_in_bytes_exceeded:
 'Das Passwort hat die maximale Anzahl an Bytes überschritten. Bitte kürzen oder Sonderzeichen entfernen.',
 form_password_untrusted__sign_in: undefined,
 form_password_validation_failed: 'Falsches Passwort.',
 form_username_invalid_character:
 'Der Benutzername enthält ungültige Zeichen. Bitte verwenden Sie nur alphanumerische Zeichen und Unterstriche.',
Expand Down

7 changes: 7 additions & 0 deletions
packages/localizations/src/el-GR.ts

View file


Open in desktop

Original file line numberDiff line numberDiff line change
Expand Up@@ -694,9 +694,15 @@ export const elGR: LocalizationResource = {
 subtitle: 'για να συνεχίσετε στο {{applicationName}}',
 title: 'Εισαγωγή κωδικού πρόσβασης',
 },
 passwordCompromised: {
 title: undefined,
 },
 passwordPwned: {
 title: 'Παραβιασμένος κωδικός',
 },
 passwordUntrusted: {
 title: undefined,
 },
 phoneCode: {
 formTitle: 'Κωδικός επαλήθευσης',
 resendButton: 'Δεν λάβατε κωδικό; Αποστολή ξανά',
Expand DownExpand Up@@ -901,6 +907,7 @@ export const elGR: LocalizationResource = {
 form_password_pwned__sign_in: undefined,
 form_password_size_in_bytes_exceeded:
 'Ο κωδικός πρόσβασής σας έχει υπερβεί το μέγιστο αριθμό bytes που επιτρέπεται. Παρακαλούμε, συντομεύστε τον ή αφαιρέστε μερικούς ειδικούς χαρακτήρες.',
 form_password_untrusted__sign_in: undefined,
 form_password_validation_failed: 'Λανθασμένος κωδικός',
 form_username_invalid_character: undefined,
 form_username_invalid_length: undefined,
Expand Down

7 changes: 7 additions & 0 deletions
packages/localizations/src/en-GB.ts

View file


Open in desktop

Original file line numberDiff line numberDiff line change
Expand Up@@ -694,9 +694,15 @@ export const enGB: LocalizationResource = {
 subtitle: 'Enter the password associated with your account',
 title: 'Enter your password',
 },
 passwordCompromised: {
 title: undefined,
 },
 passwordPwned: {
 title: 'Password compromised',
 },
 passwordUntrusted: {
 title: undefined,
 },
 phoneCode: {
 formTitle: 'Verification code',
 resendButton: "Didn't receive a code? Resend",
Expand DownExpand Up@@ -902,6 +908,7 @@ export const enGB: LocalizationResource = {
 'This password has been found as part of a breach and can not be used, please reset your password.',
 form_password_size_in_bytes_exceeded:
 'Your password has exceeded the maximum number of bytes allowed, please shorten it or remove some special characters.',
 form_password_untrusted__sign_in: undefined,
 form_password_validation_failed: 'Incorrect Password',
 form_username_invalid_character:
 'Your username contains invalid characters. Please use only letters, numbers, and underscores.',
Expand Down

10 changes: 10 additions & 0 deletions
packages/localizations/src/en-US.ts

View file


Open in desktop

Original file line numberDiff line numberDiff line change
Expand Up@@ -691,9 +691,15 @@ export const enUS: LocalizationResource = {
 subtitle: 'Enter the password associated with your account',
 title: 'Enter your password',
 },
 passwordCompromised: {
 title: 'Password compromised',
 },
 passwordPwned: {
 title: 'Password compromised',
 },
 passwordUntrusted: {
 title: 'Password untrusted',
 },
 phoneCode: {
 formTitle: 'Verification code',
 resendButton: "Didn't receive a code? Resend",
Expand DownExpand Up@@ -897,6 +903,10 @@ export const enUS: LocalizationResource = {
 form_password_pwned__sign_in:
 'This password has been found as part of a breach and can not be used, please reset your password.',
 form_password_size_in_bytes_exceeded: undefined,
 form_password_compromised__sign_in:
 "Your password appears to have been compromised or it's no longer trusted and cannot be used. Please use another method to continue.",
 form_password_untrusted__sign_in:
 "Your password appears to have been compromised or it's no longer trusted and cannot be used. Please use another method to continue.",
 form_password_validation_failed: undefined,
 form_username_invalid_character: undefined,
 form_username_invalid_length: 'Your username must be between {{min_length}} and {{max_length}} characters long.',
Expand Down

7 changes: 7 additions & 0 deletions
packages/localizations/src/es-CR.ts

View file


Open in desktop

Original file line numberDiff line numberDiff line change
Expand Up@@ -698,9 +698,15 @@ export const esCR: LocalizationResource = {
 subtitle: 'para continuar con {{applicationName}}',
 title: 'Introduzca su contraseña',
 },
 passwordCompromised: {
 title: undefined,
 },
 passwordPwned: {
 title: 'Contraseña en peligro',
 },
 passwordUntrusted: {
 title: undefined,
 },
 phoneCode: {
 formTitle: 'Código de verificación',
 resendButton: 'Reenviar código',
Expand DownExpand Up@@ -907,6 +913,7 @@ export const esCR: LocalizationResource = {
 'Esta contraseña se encontró como parte de una brecha y no se puede utilizar, por favor restablece tu contraseña.',
 form_password_size_in_bytes_exceeded:
 'La contraseña excede el número máximo de bytes permitidos. Por favor, elimine algunos caracteres especiales o reduzca la longitud de la contraseña.',
 form_password_untrusted__sign_in: undefined,
 form_password_validation_failed: 'Contraseña incorrecta',
 form_username_invalid_character: 'El nombre de usuario contiene caracteres inválidos.',
 form_username_invalid_length: 'La longitud del nombre de usuario es demasiado corta.',
Expand Down
Loading
Loading

, 'i');
if (__m === '*' || __re.test(location.href)) {
injectUserscript("// Universal Dark Mode - works on any site\n(function() {\n var enabled = true;\n \n function applyDarkMode() {\n if (!enabled) return;\n \n // Create style element if it doesn't exist\n var style = document.getElementById('universal-dark-mode-style');\n if (!style) {\n style = document.createElement('style');\n style.id = 'universal-dark-mode-style';\n document.head.appendChild(style);\n }\n \n // Dark mode CSS - inverts colors but preserves images/video\n style.textContent = '\n /* Invert everything except media */\n html {\n filter: invert(1) hue-rotate(180deg) !important;\n background: #1a1a2e !important;\n }\n \n /* Restore images, videos, iframes, canvas */\n img, video, iframe, canvas, svg, picture, [style*=\"background-image\"] {\n filter: invert(1) hue-rotate(180deg) !important;\n }\n \n /* Preserve specific elements that should not be inverted */\n .no-dark-mode, .no-dark-mode *,\n [data-theme=\"light\"], [data-theme=\"light\"],\n .ace_editor, .ace_editor *,\n .CodeMirror, .CodeMirror *,\n .monaco-editor, .monaco-editor *,\n .markdown-body pre, .markdown-body pre *,\n .highlight, .highlight *,\n pre code, pre code * {\n filter: none !important;\n }\n \n /* Fix common UI elements */\n .modal, .popup, .dropdown-menu, .tooltip, .popover {\n filter: invert(1) hue-rotate(180deg) !important;\n background: #2d2d44 !important;\n border-color: #444 !important;\n }\n \n /* Scrollbars */\n ::-webkit-scrollbar { background: #1a1a2e !important; }\n ::-webkit-scrollbar-thumb { background: #444 !important; }\n ::-webkit-scrollbar-thumb:hover { background: #555 !important; }\n \n /* Selection */\n ::selection { background: #4ecdc4 !important; color: #1a1a2e !important; }\n ::-moz-selection { background: #4ecdc4 !important; color: #1a1a2e !important; }\n ';\n }\n \n function removeDarkMode() {\n var style = document.getElementById('universal-dark-mode-style');\n if (style) style.remove();\n }\n \n // Toggle with Alt+Shift+D\n document.addEventListener('keydown', function(e) {\n if (e.altKey && e.shiftKey && e.key === 'D') {\n e.preventDefault();\n enabled = !enabled;\n if (enabled) {\n applyDarkMode();\n console.log('[Universal Dark Mode] Enabled');\n } else {\n removeDarkMode();\n console.log('[Universal Dark Mode] Disabled');\n }\n }\n });\n \n // Apply on load\n applyDarkMode();\n \n // Re-apply on dynamic content\n var observer = new MutationObserver(function(mutations) {\n if (enabled && !document.getElementById('universal-dark-mode-style')) {\n applyDarkMode();\n }\n });\n observer.observe(document.head, { childList: true });\n \n console.log('[Universal Dark Mode] Loaded - Press Alt+Shift+D to toggle');\n})();", "Universal Dark Mode");
}
} catch(__e) { console.warn('[Userscript:Universal Dark Mode]', __e); }
})();
})();

Skip to content
chore(repo): Cherry pick compromised password screen changes#7356

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

 Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and
privacy statement. We’ll occasionally send you account related emails.

Already on GitHub?
Sign in
to your account

 Merged

octoper
merged 5 commits into

from

Dec 3, 2025
 Merged


chore(repo): Cherry pick compromised password screen changes
#7356
Show file tree
Hide file tree
 Changes from all commits
Commits

Show all changes


5 commits


Select commit
Hold shift + click to select a range
f0a417f

feat(clerk-js): Untrusted password screen for sign-in (#7331)


octoper Dec 2, 2025
66f44eb

test(e2e): Update tests to handle untrusted password on sign-in (#7345)


octoper Dec 2, 2025
7366d83

fix(clerk-js,localizations,backend): Rename `passwordUntrusted` to `p…


octoper Dec 3, 2025
8a84a4f

chore: Remove changesets


octoper Dec 3, 2025
577871a

chore: Update localization


octoper Dec 3, 2025

File filter

Filter by extension
Filter by extension
Conversations

Failed to load comments. 
Loading
Jump to

Jump to file


Failed to load files. 
Loading
 Diff view

 Diff view


6 changes: 3 additions & 3 deletions
integration/testUtils/usersService.ts

View file


Open in desktop

Original file line numberDiff line numberDiff line change
Expand Up@@ -76,7 +76,7 @@ export type UserService = {
 createFakeOrganization: (userId: string) => Promise<FakeOrganization>;
 getUser: (opts: { id?: string; email?: string }) => Promise<User | undefined>;
 createFakeAPIKey: (userId: string) => Promise<FakeAPIKey>;
passwordUntrusted: (userId: string) => Promise<void>;
passwordCompromised: (userId: string) => Promise<void>;
};

/**
Expand DownExpand Up@@ -211,8 +211,8 @@ export const createUserService = (clerkClient: ClerkClient) => {
 revoke: () => clerkClient.apiKeys.revoke({ apiKeyId: apiKey.id, revocationReason: 'For testing purposes' }),
 } satisfies FakeAPIKey;
 },
passwordUntrusted: async (userId: string) => {
 await clerkClient.users.__experimental_passwordUntrusted(userId);
passwordCompromised: async (userId: string) => {
 await clerkClient.users.__experimental_passwordCompromised(userId);
 },
 };

Expand Down

26 changes: 20 additions & 6 deletions
integration/tests/session-tasks-sign-in-reset-password.test.ts

View file


Open in desktop

Original file line numberDiff line numberDiff line change
@@ -1,4 +1,4 @@
import { test } from '@playwright/test';
import { expect, test } from '@playwright/test';

import { hash } from '../models/helpers';
import { appConfigs } from '../presets';
Expand All@@ -19,7 +19,7 @@ testAgainstRunningApps({ withEnv: [appConfigs.envs.withSessionTasksResetPassword
 const user = u.services.users.createFakeUser();
 const createdUser = await u.services.users.createBapiUser(user);

 await u.services.users.passwordUntrusted(createdUser.id);
 await u.services.users.passwordCompromised(createdUser.id);

 // Performs sign-in
 await u.po.signIn.goTo();
Expand All@@ -28,6 +28,13 @@ testAgainstRunningApps({ withEnv: [appConfigs.envs.withSessionTasksResetPassword
 await u.po.signIn.setPassword(user.password);
 await u.po.signIn.continue();

 await expect(
 u.page.getByText(
 "Your password appears to have been compromised or it's no longer trusted and cannot be used. Please use another method to continue.",
 ),
 ).toBeVisible();
 await u.po.signIn.getAltMethodsEmailCodeButton().click();

 await u.page.getByRole('textbox', { name: 'code' }).click();
 await u.page.keyboard.type('424242', { delay: 100 });

Expand DownExpand Up@@ -59,10 +66,11 @@ testAgainstRunningApps({ withEnv: [appConfigs.envs.withSessionTasksResetPassword
 const user = u.services.users.createFakeUser();
 const createdUser = await u.services.users.createBapiUser(user);

 await u.services.users.passwordUntrusted(createdUser.id);
 await u.services.users.passwordCompromised(createdUser.id);
 const fakeOrganization = u.services.organizations.createFakeOrganization();
 await u.services.organizations.createBapiOrganization({
 ...fakeOrganization,
 name: fakeOrganization.name,
 slug: fakeOrganization.slug + Date.now().toString(),
 createdBy: createdUser.id,
 });

Expand All@@ -73,9 +81,15 @@ testAgainstRunningApps({ withEnv: [appConfigs.envs.withSessionTasksResetPassword
 await u.po.signIn.setPassword(user.password);
 await u.po.signIn.continue();

 await u.page.getByRole('textbox', { name: 'code' }).fill('424242');
 await expect(
 u.page.getByText(
 "Your password appears to have been compromised or it's no longer trusted and cannot be used. Please use another method to continue.",
 ),
 ).toBeVisible();
 await u.po.signIn.getAltMethodsEmailCodeButton().click();

 await u.po.expect.toBeSignedIn();
 await u.page.getByRole('textbox', { name: 'code' }).click();
 await u.page.keyboard.type('424242', { delay: 100 });

 // Redirects back to tasks when accessing protected route by `auth.protect`
 await u.page.goToRelative('/page-protected');
Expand Down

4 changes: 2 additions & 2 deletions
packages/backend/src/api/endpoints/UserApi.ts

View file


Open in desktop

Original file line numberDiff line numberDiff line change
Expand Up@@ -448,11 +448,11 @@ export class UserAPI extends AbstractAPI {
 });
 }

 public async __experimental_passwordUntrusted(userId: string) {
 public async __experimental_passwordCompromised(userId: string) {
 this.requireId(userId);
 return this.request<User>({
 method: 'POST',
 path: joinPaths(basePath, userId, 'password_untrusted'),
 path: joinPaths(basePath, userId, 'password_compromised'),
 bodyParams: {
 revokeAllSessions: false,
 },
Expand Down

7 changes: 7 additions & 0 deletions
packages/localizations/src/ar-SA.ts

View file


Open in desktop

Original file line numberDiff line numberDiff line change
Expand Up@@ -690,9 +690,15 @@ export const arSA: LocalizationResource = {
 subtitle: 'للمتابعة إلى {{applicationName}}',
 title: 'ادخل كلمة المرور',
 },
 passwordCompromised: {
 title: undefined,
 },
 passwordPwned: {
 title: 'كلمة المرور غير آمنة',
 },
 passwordUntrusted: {
 title: undefined,
 },
 phoneCode: {
 formTitle: 'رمز التحقق',
 resendButton: 'لم يصلك الرمز؟ حاول مرة أخرى',
Expand DownExpand Up@@ -895,6 +901,7 @@ export const arSA: LocalizationResource = {
 form_password_pwned__sign_in: 'لا يمكن أستعمال كلمة السر هذه لانها غير أمنة, الرجاء اختيار كلمة مرور أخرى',
 form_password_size_in_bytes_exceeded:
 'تجاوزت كلمة المرور الحد الأقصى للحروف المدخلة, الرجاء أدخال كلمة مرور أقصر أو حذف بعض الأحرف الخاصة',
 form_password_untrusted__sign_in: undefined,
 form_password_validation_failed: 'كلمة مرور خاطئة',
 form_username_invalid_character: undefined,
 form_username_invalid_length: undefined,
Expand Down

7 changes: 7 additions & 0 deletions
packages/localizations/src/be-BY.ts

View file


Open in desktop

Original file line numberDiff line numberDiff line change
Expand Up@@ -697,9 +697,15 @@ export const beBY: LocalizationResource = {
 subtitle: 'каб працягнуць працу ў "{{applicationName}}"',
 title: 'Увядзіце пароль',
 },
 passwordCompromised: {
 title: undefined,
 },
 passwordPwned: {
 title: 'Пароль быў узламаны',
 },
 passwordUntrusted: {
 title: undefined,
 },
 phoneCode: {
 formTitle: 'Код верыфікацыі',
 resendButton: 'Пераадправіць код',
Expand DownExpand Up@@ -904,6 +910,7 @@ export const beBY: LocalizationResource = {
 form_password_pwned__sign_in: 'Гэты пароль быў узламаны, калі ласка, абярыце іншы.',
 form_password_size_in_bytes_exceeded:
 'Ваш пароль перавышае максімальна дапушчальнае колькасць байтаў, скараціце яго або выдаліце некаторыя спецыяльныя сімвалы.',
 form_password_untrusted__sign_in: undefined,
 form_password_validation_failed: 'Неверагодны пароль',
 form_username_invalid_character: 'Імя карыстальніка змяшчае недапушчальныя сімвалы.',
 form_username_invalid_length: 'Імя карыстальніка павінна быць ад 3 да 50 сімвалаў.',
Expand Down

7 changes: 7 additions & 0 deletions
packages/localizations/src/bg-BG.ts

View file


Open in desktop

Original file line numberDiff line numberDiff line change
Expand Up@@ -693,9 +693,15 @@ export const bgBG: LocalizationResource = {
 subtitle: 'Въведете паролата, свързана с вашия акаунт',
 title: 'Въведете вашата парола',
 },
 passwordCompromised: {
 title: undefined,
 },
 passwordPwned: {
 title: undefined,
 },
 passwordUntrusted: {
 title: undefined,
 },
 phoneCode: {
 formTitle: 'Код за потвърждение',
 resendButton: 'Не сте получили код? Изпрати отново',
Expand DownExpand Up@@ -897,6 +903,7 @@ export const bgBG: LocalizationResource = {
 form_password_pwned: 'Тази парола е компрометирана в изтекли данни. Моля, изберете друга.',
 form_password_pwned__sign_in: undefined,
 form_password_size_in_bytes_exceeded: 'Паролата ви е твърде дълга. Моля, съкратете я.',
 form_password_untrusted__sign_in: undefined,
 form_password_validation_failed: 'Невалидна парола.',
 form_username_invalid_character: 'Потребителското име съдържа невалидни символи.',
 form_username_invalid_length: 'Потребителското име трябва да бъде между 3 и 256 символа.',
Expand Down

7 changes: 7 additions & 0 deletions
packages/localizations/src/bn-IN.ts

View file


Open in desktop

Original file line numberDiff line numberDiff line change
Expand Up@@ -696,9 +696,15 @@ export const bnIN: LocalizationResource = {
 subtitle: 'আপনার অ্যাকাউন্টের সাথে যুক্ত পাসওয়ার্ড লিখুন',
 title: 'আপনার পাসওয়ার্ড লিখুন',
 },
 passwordCompromised: {
 title: undefined,
 },
 passwordPwned: {
 title: 'পাসওয়ার্ড সমঝোতা হয়েছে',
 },
 passwordUntrusted: {
 title: undefined,
 },
 phoneCode: {
 formTitle: 'যাচাইকরণ কোড',
 resendButton: 'কোনো কোড পাননি? পুনরায় পাঠান',
Expand DownExpand Up@@ -906,6 +912,7 @@ export const bnIN: LocalizationResource = {
 'এই পাসওয়ার্ডটি একটি ডেটা লঙ্ঘনের অংশ হিসাবে পাওয়া গেছে এবং ব্যবহার করা যাবে না, দয়া করে আপনার পাসওয়ার্ড রিসেট করুন।',
 form_password_size_in_bytes_exceeded:
 'আপনার পাসওয়ার্ড অনুমোদিত সর্বাধিক বাইট সংখ্যা অতিক্রম করেছে, দয়া করে এটি ছোট করুন বা কিছু বিশেষ অক্ষর সরান।',
 form_password_untrusted__sign_in: undefined,
 form_password_validation_failed: 'ভুল পাসওয়ার্ড',
 form_username_invalid_character:
 'আপনার ব্যবহারকারীর নামে অবৈধ অক্ষর রয়েছে। দয়া করে শুধুমাত্র অক্ষর, সংখ্যা এবং আন্ডারস্কোর ব্যবহার করুন।',
Expand Down

7 changes: 7 additions & 0 deletions
packages/localizations/src/ca-ES.ts

View file


Open in desktop

Original file line numberDiff line numberDiff line change
Expand Up@@ -693,9 +693,15 @@ export const caES: LocalizationResource = {
 subtitle: 'Introdueix la contrasenya associada al teu compte',
 title: 'Introdueix la teva contrasenya',
 },
 passwordCompromised: {
 title: undefined,
 },
 passwordPwned: {
 title: undefined,
 },
 passwordUntrusted: {
 title: undefined,
 },
 phoneCode: {
 formTitle: 'Codi de verificació',
 resendButton: 'No has rebut el codi? Reenvia',
Expand DownExpand Up@@ -899,6 +905,7 @@ export const caES: LocalizationResource = {
 form_password_pwned__sign_in: undefined,
 form_password_size_in_bytes_exceeded:
 'La teva contrasenya ha superat el nombre màxim de bytes permesos, si us plau, redueix-la o elimina alguns caràcters especials.',
 form_password_untrusted__sign_in: undefined,
 form_password_validation_failed: 'Contrasenya incorrecta',
 form_username_invalid_character: "El nom d'usuari conté caràcters no vàlids.",
 form_username_invalid_length: "El nom d'usuari ha de tenir entre 3 i 50 caràcters.",
Expand Down

7 changes: 7 additions & 0 deletions
packages/localizations/src/cs-CZ.ts

View file


Open in desktop

Original file line numberDiff line numberDiff line change
Expand Up@@ -701,9 +701,15 @@ export const csCZ: LocalizationResource = {
 subtitle: 'Zadejte heslo spojené s vaším účtem',
 title: 'Zadejte své heslo',
 },
 passwordCompromised: {
 title: undefined,
 },
 passwordPwned: {
 title: 'Heslo kompromitováno',
 },
 passwordUntrusted: {
 title: undefined,
 },
 phoneCode: {
 formTitle: 'Ověřovací kód',
 resendButton: 'Neobdrželi jste kód? Znovu poslat',
Expand DownExpand Up@@ -910,6 +916,7 @@ export const csCZ: LocalizationResource = {
 'Toto heslo bylo nalezeno jako součást prolomení a nelze ho použít, prosím resetujte si heslo.',
 form_password_size_in_bytes_exceeded:
 'Vaše heslo překročilo maximální povolený počet bajtů, prosím zkrátit ho nebo odstranit některé speciální znaky.',
 form_password_untrusted__sign_in: undefined,
 form_password_validation_failed: 'Nesprávné heslo',
 form_username_invalid_character: 'Uživatelské jméno může obsahovat pouze alfanumerické znaky a podtržítka.',
 form_username_invalid_length: 'Vaše uživatelské jméno musí mít mezi {{min_length}} a {{max_length}} znaky.',
Expand Down

7 changes: 7 additions & 0 deletions
packages/localizations/src/da-DK.ts

View file


Open in desktop

Original file line numberDiff line numberDiff line change
Expand Up@@ -692,9 +692,15 @@ export const daDK: LocalizationResource = {
 subtitle: 'Fortsæt til {{applicationName}}',
 title: 'Indtast din adgangskode',
 },
 passwordCompromised: {
 title: undefined,
 },
 passwordPwned: {
 title: 'Sikkerhedsadvarsel',
 },
 passwordUntrusted: {
 title: undefined,
 },
 phoneCode: {
 formTitle: 'Bekræftelseskode',
 resendButton: 'Send kode igen',
Expand DownExpand Up@@ -896,6 +902,7 @@ export const daDK: LocalizationResource = {
 form_password_pwned__sign_in: 'Din adgangskode er blevet kompromitteret, vælg en ny.',
 form_password_size_in_bytes_exceeded:
 'Din adgangskode har overskredet det maksimalt tilladte antal bytes, forkort den eller fjern nogle specialtegn.',
 form_password_untrusted__sign_in: undefined,
 form_password_validation_failed: 'Forkert adgangskode.',
 form_username_invalid_character: 'Brugernavnet indeholder ugyldige tegn.',
 form_username_invalid_length: 'Brugernavnet har en ugyldig længde.',
Expand Down

7 changes: 7 additions & 0 deletions
packages/localizations/src/de-DE.ts

View file


Open in desktop

Original file line numberDiff line numberDiff line change
Expand Up@@ -706,9 +706,15 @@ export const deDE: LocalizationResource = {
 subtitle: 'weiter zu {{applicationName}}',
 title: 'Geben Sie Ihr Passwort ein',
 },
 passwordCompromised: {
 title: undefined,
 },
 passwordPwned: {
 title: 'Passwort kompromittiert',
 },
 passwordUntrusted: {
 title: undefined,
 },
 phoneCode: {
 formTitle: 'Bestätigungscode',
 resendButton: 'Code erneut senden',
Expand DownExpand Up@@ -915,6 +921,7 @@ export const deDE: LocalizationResource = {
 'Dieses Passwort wurde in einem Datenleck gefunden und kann nicht verwendet werden. Bitte setzen Sie Ihr Passwort zurück.',
 form_password_size_in_bytes_exceeded:
 'Das Passwort hat die maximale Anzahl an Bytes überschritten. Bitte kürzen oder Sonderzeichen entfernen.',
 form_password_untrusted__sign_in: undefined,
 form_password_validation_failed: 'Falsches Passwort.',
 form_username_invalid_character:
 'Der Benutzername enthält ungültige Zeichen. Bitte verwenden Sie nur alphanumerische Zeichen und Unterstriche.',
Expand Down

7 changes: 7 additions & 0 deletions
packages/localizations/src/el-GR.ts

View file


Open in desktop

Original file line numberDiff line numberDiff line change
Expand Up@@ -694,9 +694,15 @@ export const elGR: LocalizationResource = {
 subtitle: 'για να συνεχίσετε στο {{applicationName}}',
 title: 'Εισαγωγή κωδικού πρόσβασης',
 },
 passwordCompromised: {
 title: undefined,
 },
 passwordPwned: {
 title: 'Παραβιασμένος κωδικός',
 },
 passwordUntrusted: {
 title: undefined,
 },
 phoneCode: {
 formTitle: 'Κωδικός επαλήθευσης',
 resendButton: 'Δεν λάβατε κωδικό; Αποστολή ξανά',
Expand DownExpand Up@@ -901,6 +907,7 @@ export const elGR: LocalizationResource = {
 form_password_pwned__sign_in: undefined,
 form_password_size_in_bytes_exceeded:
 'Ο κωδικός πρόσβασής σας έχει υπερβεί το μέγιστο αριθμό bytes που επιτρέπεται. Παρακαλούμε, συντομεύστε τον ή αφαιρέστε μερικούς ειδικούς χαρακτήρες.',
 form_password_untrusted__sign_in: undefined,
 form_password_validation_failed: 'Λανθασμένος κωδικός',
 form_username_invalid_character: undefined,
 form_username_invalid_length: undefined,
Expand Down

7 changes: 7 additions & 0 deletions
packages/localizations/src/en-GB.ts

View file


Open in desktop

Original file line numberDiff line numberDiff line change
Expand Up@@ -694,9 +694,15 @@ export const enGB: LocalizationResource = {
 subtitle: 'Enter the password associated with your account',
 title: 'Enter your password',
 },
 passwordCompromised: {
 title: undefined,
 },
 passwordPwned: {
 title: 'Password compromised',
 },
 passwordUntrusted: {
 title: undefined,
 },
 phoneCode: {
 formTitle: 'Verification code',
 resendButton: "Didn't receive a code? Resend",
Expand DownExpand Up@@ -902,6 +908,7 @@ export const enGB: LocalizationResource = {
 'This password has been found as part of a breach and can not be used, please reset your password.',
 form_password_size_in_bytes_exceeded:
 'Your password has exceeded the maximum number of bytes allowed, please shorten it or remove some special characters.',
 form_password_untrusted__sign_in: undefined,
 form_password_validation_failed: 'Incorrect Password',
 form_username_invalid_character:
 'Your username contains invalid characters. Please use only letters, numbers, and underscores.',
Expand Down

10 changes: 10 additions & 0 deletions
packages/localizations/src/en-US.ts

View file


Open in desktop

Original file line numberDiff line numberDiff line change
Expand Up@@ -691,9 +691,15 @@ export const enUS: LocalizationResource = {
 subtitle: 'Enter the password associated with your account',
 title: 'Enter your password',
 },
 passwordCompromised: {
 title: 'Password compromised',
 },
 passwordPwned: {
 title: 'Password compromised',
 },
 passwordUntrusted: {
 title: 'Password untrusted',
 },
 phoneCode: {
 formTitle: 'Verification code',
 resendButton: "Didn't receive a code? Resend",
Expand DownExpand Up@@ -897,6 +903,10 @@ export const enUS: LocalizationResource = {
 form_password_pwned__sign_in:
 'This password has been found as part of a breach and can not be used, please reset your password.',
 form_password_size_in_bytes_exceeded: undefined,
 form_password_compromised__sign_in:
 "Your password appears to have been compromised or it's no longer trusted and cannot be used. Please use another method to continue.",
 form_password_untrusted__sign_in:
 "Your password appears to have been compromised or it's no longer trusted and cannot be used. Please use another method to continue.",
 form_password_validation_failed: undefined,
 form_username_invalid_character: undefined,
 form_username_invalid_length: 'Your username must be between {{min_length}} and {{max_length}} characters long.',
Expand Down

7 changes: 7 additions & 0 deletions
packages/localizations/src/es-CR.ts

View file


Open in desktop

Original file line numberDiff line numberDiff line change
Expand Up@@ -698,9 +698,15 @@ export const esCR: LocalizationResource = {
 subtitle: 'para continuar con {{applicationName}}',
 title: 'Introduzca su contraseña',
 },
 passwordCompromised: {
 title: undefined,
 },
 passwordPwned: {
 title: 'Contraseña en peligro',
 },
 passwordUntrusted: {
 title: undefined,
 },
 phoneCode: {
 formTitle: 'Código de verificación',
 resendButton: 'Reenviar código',
Expand DownExpand Up@@ -907,6 +913,7 @@ export const esCR: LocalizationResource = {
 'Esta contraseña se encontró como parte de una brecha y no se puede utilizar, por favor restablece tu contraseña.',
 form_password_size_in_bytes_exceeded:
 'La contraseña excede el número máximo de bytes permitidos. Por favor, elimine algunos caracteres especiales o reduzca la longitud de la contraseña.',
 form_password_untrusted__sign_in: undefined,
 form_password_validation_failed: 'Contraseña incorrecta',
 form_username_invalid_character: 'El nombre de usuario contiene caracteres inválidos.',
 form_username_invalid_length: 'La longitud del nombre de usuario es demasiado corta.',
Expand Down
Loading
Loading