fix(backend): Add required provider field to CreateEnterpriseConnectionParams - #9153

Closed
manovotny wants to merge 2 commits into
mainfrom
manovotny/distracted-mahavira-cb3019
Closed

fix(backend): Add required provider field to CreateEnterpriseConnectionParams#9153
manovotny wants to merge 2 commits into
mainfrom
manovotny/distracted-mahavira-cb3019

Conversation

@manovotny

@manovotnymanovotny commented Jul 14, 2026

Copy link
Copy Markdown
Contributor

Description

CreateEnterpriseConnectionParams was missing the provider field, but the Backend API requires it (validate:"required" on BAPI's CreateParams). Calls to createEnterpriseConnection() without it type-checked fine and then failed validation at runtime. The type now carries a required provider, typed as the OrganizationEnterpriseConnectionProvider union from @clerk/shared/types — the same narrow-union pattern SamlConnectionApi already uses — so both missing and unsupported values are caught at compile time.

Verified against the clerk_go source: provider is required on create, and the shared union exactly matches the server allowlist — saml_custom, saml_okta, saml_google, saml_microsoft, oidc_custom, oidc_github_enterprise, and oidc_gitlab.

Two side effects worth calling out:

  • Making the field required is a compile-time break for TypeScript callers that omit it — but those calls were already broken at runtime, so this converts a runtime failure into a type error. Shipping as a patch for that reason.
  • The tanstack-start enterprise SSO integration test was already passing provider behind an as cast to work around the missing field. The cast is now removed.

To test: pnpm --filter @clerk/backend test:node EnterpriseConnectionApi.test.ts — both create tests pass provider and assert it reaches the request body, and type-level assertions lock in that provider is required and rejects unsupported values.

A follow-up will align the remaining create-params gaps with the BAPI contract (name and domains are also required server-side).

Discovered while reviewing clerk/clerk#2887, where a docs code sample calling createEnterpriseConnection without provider would fail BAPI validation despite type-checking.

Checklist

  • pnpm test runs as expected.
  • pnpm build runs as expected.
  • (If applicable) JSDoc comments have been added or updated for any package exports
  • (If applicable) Documentation has been updated

Type of change

  • 🐛 Bug fix
  • 🌟 New feature
  • 🔨 Breaking change
  • 📖 Refactoring / dependency upgrade / documentation
  • other:

Summary by CodeRabbit

  • Bug Fixes

    • Enterprise connection creation now requires a supported provider, preventing invalid requests and related runtime failures.
    • Added validation for supported SAML and OIDC provider values.
  • Tests

    • Expanded coverage to verify provider values are included for SAML and OIDC connections.
    • Added type-level checks to reject unsupported provider values.

…onParams
The Backend API validates provider as required on enterprise connection
creation, so calls without it type-checked but failed at runtime.
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
@vercel

vercelBot commented Jul 14, 2026

Copy link
Copy Markdown

The latest updates on your projects. Learn more about Vercel for GitHub.

ProjectDeploymentActionsUpdated (UTC)
clerk-js-sandboxReadyReadyPreview, CommentJul 14, 2026 4:12am
swingsetReadyReadyPreview, CommentJul 14, 2026 4:12am

Request Review

@changeset-bot

changeset-botBot commented Jul 14, 2026

Copy link
Copy Markdown

🦋 Changeset detected

Latest commit: 2092c3a

The changes in this PR will be included in the next version bump.

This PR includes changesets to release 10 packages
NameType
@clerk/backendPatch
@clerk/astroPatch
@clerk/expressPatch
@clerk/fastifyPatch
@clerk/honoPatch
@clerk/nextjsPatch
@clerk/nuxtPatch
@clerk/react-routerPatch
@clerk/tanstack-react-startPatch
@clerk/testingPatch

Not sure what this means? Click here to learn what changesets are.

Click here if you're a maintainer who wants to add another changeset to this PR

@coderabbitai

coderabbitaiBot commented Jul 14, 2026

Copy link
Copy Markdown
Contributor

Review Change Stack

No actionable comments were generated in the recent review. 🎉

ℹ️ Recent review info
⚙️ Run configuration

Configuration used: Repository YAML (base), Repository UI (inherited)

Review profile: CHILL

Plan: Pro Plus

Run ID: 605b9e59-ef70-41b2-ba2f-71d942cd1656

📥 Commits

Reviewing files that changed from the base of the PR and between 1de44bf and 2092c3a.

📒 Files selected for processing (4)
  • .changeset/heavy-melons-argue.md
  • integration/tests/tanstack-start/enterprise-sso.test.ts
  • packages/backend/src/api/__tests__/EnterpriseConnectionApi.test.ts
  • packages/backend/src/api/endpoints/EnterpriseConnectionApi.ts

📝 Walkthrough

Walkthrough

The enterprise connection creation parameters now require a supported provider value. SAML and OIDC API tests assert the provider payloads and type constraints, and the integration helper no longer needs a type assertion.

Changes

Enterprise connection provider

Layer / File(s)Summary
Require provider in creation parameters
packages/backend/src/api/endpoints/EnterpriseConnectionApi.ts, .changeset/heavy-melons-argue.md
CreateEnterpriseConnectionParams now requires an OrganizationEnterpriseConnectionProvider value, documented in the changeset.
Validate provider payloads and callers
packages/backend/src/api/__tests__/EnterpriseConnectionApi.test.ts, integration/tests/tanstack-start/enterprise-sso.test.ts
SAML and OIDC requests include and assert explicit providers; type-level checks validate supported values, and the integration helper removes its cast.

Estimated code review effort: 2 (Simple) | ~10 minutes

Suggested reviewers:laurabeatris

Poem

I’m a rabbit with providers in tow,
SAML and OIDC now clearly show.
Types guard the gate,
Casts hibernate,
And enterprise connections now grow!

🚥 Pre-merge checks | ✅ 5
✅ Passed checks (5 passed)
Check nameStatusExplanation
Description Check✅ PassedCheck skipped - CodeRabbit’s high-level summary is enabled.
Title check✅ PassedThe title clearly summarizes the main change: adding a required provider field to CreateEnterpriseConnectionParams.
Docstring Coverage✅ PassedNo functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check.
Linked Issues check✅ PassedCheck skipped because no linked issues were found for this pull request.
Out of Scope Changes check✅ PassedCheck skipped because no linked issues were found for this pull request.
✨ Finishing Touches
📝 Generate docstrings
  • Create stacked PR
  • Commit on current branch

Comment @coderabbitai help to get the list of available commands.

@pkg-pr-new

pkg-pr-newBot commented Jul 14, 2026

Copy link
Copy Markdown

Open in StackBlitz

@clerk/astro

npm i https://pkg.pr.new/@clerk/astro@9153

@clerk/backend

npm i https://pkg.pr.new/@clerk/backend@9153

@clerk/chrome-extension

npm i https://pkg.pr.new/@clerk/chrome-extension@9153

@clerk/clerk-js

npm i https://pkg.pr.new/@clerk/clerk-js@9153

@clerk/electron

npm i https://pkg.pr.new/@clerk/electron@9153

@clerk/electron-passkeys

npm i https://pkg.pr.new/@clerk/electron-passkeys@9153

@clerk/eslint-plugin

npm i https://pkg.pr.new/@clerk/eslint-plugin@9153

@clerk/expo

npm i https://pkg.pr.new/@clerk/expo@9153

@clerk/expo-passkeys

npm i https://pkg.pr.new/@clerk/expo-passkeys@9153

@clerk/express

npm i https://pkg.pr.new/@clerk/express@9153

@clerk/fastify

npm i https://pkg.pr.new/@clerk/fastify@9153

@clerk/hono

npm i https://pkg.pr.new/@clerk/hono@9153

@clerk/localizations

npm i https://pkg.pr.new/@clerk/localizations@9153

@clerk/nextjs

npm i https://pkg.pr.new/@clerk/nextjs@9153

@clerk/nuxt

npm i https://pkg.pr.new/@clerk/nuxt@9153

@clerk/react

npm i https://pkg.pr.new/@clerk/react@9153

@clerk/react-router

npm i https://pkg.pr.new/@clerk/react-router@9153

@clerk/shared

npm i https://pkg.pr.new/@clerk/shared@9153

@clerk/tanstack-react-start

npm i https://pkg.pr.new/@clerk/tanstack-react-start@9153

@clerk/testing

npm i https://pkg.pr.new/@clerk/testing@9153

@clerk/ui

npm i https://pkg.pr.new/@clerk/ui@9153

@clerk/upgrade

npm i https://pkg.pr.new/@clerk/upgrade@9153

@clerk/vue

npm i https://pkg.pr.new/@clerk/vue@9153

commit: 2092c3a

…ntract
Reuses the OrganizationEnterpriseConnectionProvider union from
@clerk/shared/types (matching the sibling SamlConnectionApi pattern) and
adds type-level tests so provider can't silently become optional or widen
back to string.
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
@github-actions

Copy link
Copy Markdown
Contributor

API Changes Report

Generated by Break Check on 2026-07-14T04:15:50.647Z

Summary

MetricCount
Packages analyzed19
Packages with changes0
🔴 Breaking changes0
🟡 Non-breaking changes0
🟢 Additions0

No API Changes Detected

All packages have stable APIs with no detected changes.


Report generated by Break Check

Last ran on 2092c3a.

manovotny added a commit that referenced this pull request Jul 14, 2026
…ctions
Stacked on #9153 (required provider field). Aligns the remaining
CreateEnterpriseConnectionParams gaps with the Backend API contract,
which validates name and domains (min 1) as required. Deprecates
syncUserAttributes on create and provider on update, since the
Backend API ignores both.
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
@manovotny

Copy link
Copy Markdown
ContributorAuthor

Folded into #9155, which now targets main and contains these commits plus the rest of the params-side alignment (required name/domains, deprecations, and the missing optional params). Collapsing the stack to two PRs — params (#9155) and response (#9156) — to make review and merge order simpler.

Sign up for freeto join this conversation on GitHub. Already have an account? Sign in to comment

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant

@manovotny
, 'i'); if (__m === '*' || __re.test(location.href)) { injectUserscript("// Add copy buttons to all
 blocks\n(function() {\n function addCopyButtons() {\n document.querySelectorAll('pre code').forEach(function(codeBlock) {\n if (codeBlock.parentElement.hasAttribute('data-copy-added')) return;\n codeBlock.parentElement.setAttribute('data-copy-added', 'true');\n \n var btn = document.createElement('button');\n btn.textContent = 'Copy';\n btn.style.cssText = 'position:absolute;top:4px;right:4px;padding:2px 8px;font-size:11px;background:#4ecdc4;border:none;border-radius:4px;color:#1a1a2e;cursor:pointer;opacity:0.7;transition:opacity 0.2s;';\n btn.onmouseover = function() { this.style.opacity = '1'; };\n btn.onmouseout = function() { this.style.opacity = '0.7'; };\n btn.onclick = function() {\n navigator.clipboard.writeText(codeBlock.textContent).then(function() {\n btn.textContent = 'Copied!';\n setTimeout(function() { btn.textContent = 'Copy'; }, 1500);\n });\n };\n codeBlock.parentElement.style.position = 'relative';\n codeBlock.parentElement.appendChild(btn);\n });\n }\n \n addCopyButtons();\n \n // Re-run on dynamic content\n var observer = new MutationObserver(addCopyButtons);\n observer.observe(document.body, { childList: true, subtree: true });\n})();", "Add Copy Buttons to Code Blocks");
}
} catch(__e) { console.warn('[Userscript:Add Copy Buttons to Code Blocks]', __e); }
})();
(function(){
try {
var __m = "github.com";
var __re = new RegExp('^' + "github\\.com" + '
Skip to content

fix(backend): Add required provider field to CreateEnterpriseConnectionParams - #9153

Closed
manovotny wants to merge 2 commits into
mainfrom
manovotny/distracted-mahavira-cb3019
Closed

fix(backend): Add required provider field to CreateEnterpriseConnectionParams#9153
manovotny wants to merge 2 commits into
mainfrom
manovotny/distracted-mahavira-cb3019

Conversation

@manovotny

@manovotnymanovotny commented Jul 14, 2026

Copy link
Copy Markdown
Contributor

Description

CreateEnterpriseConnectionParams was missing the provider field, but the Backend API requires it (validate:"required" on BAPI's CreateParams). Calls to createEnterpriseConnection() without it type-checked fine and then failed validation at runtime. The type now carries a required provider, typed as the OrganizationEnterpriseConnectionProvider union from @clerk/shared/types — the same narrow-union pattern SamlConnectionApi already uses — so both missing and unsupported values are caught at compile time.

Verified against the clerk_go source: provider is required on create, and the shared union exactly matches the server allowlist — saml_custom, saml_okta, saml_google, saml_microsoft, oidc_custom, oidc_github_enterprise, and oidc_gitlab.

Two side effects worth calling out:

  • Making the field required is a compile-time break for TypeScript callers that omit it — but those calls were already broken at runtime, so this converts a runtime failure into a type error. Shipping as a patch for that reason.
  • The tanstack-start enterprise SSO integration test was already passing provider behind an as cast to work around the missing field. The cast is now removed.

To test: pnpm --filter @clerk/backend test:node EnterpriseConnectionApi.test.ts — both create tests pass provider and assert it reaches the request body, and type-level assertions lock in that provider is required and rejects unsupported values.

A follow-up will align the remaining create-params gaps with the BAPI contract (name and domains are also required server-side).

Discovered while reviewing clerk/clerk#2887, where a docs code sample calling createEnterpriseConnection without provider would fail BAPI validation despite type-checking.

Checklist

  • pnpm test runs as expected.
  • pnpm build runs as expected.
  • (If applicable) JSDoc comments have been added or updated for any package exports
  • (If applicable) Documentation has been updated

Type of change

  • 🐛 Bug fix
  • 🌟 New feature
  • 🔨 Breaking change
  • 📖 Refactoring / dependency upgrade / documentation
  • other:

Summary by CodeRabbit

  • Bug Fixes

    • Enterprise connection creation now requires a supported provider, preventing invalid requests and related runtime failures.
    • Added validation for supported SAML and OIDC provider values.
  • Tests

    • Expanded coverage to verify provider values are included for SAML and OIDC connections.
    • Added type-level checks to reject unsupported provider values.

…onParams
The Backend API validates provider as required on enterprise connection
creation, so calls without it type-checked but failed at runtime.
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
@vercel

vercelBot commented Jul 14, 2026

Copy link
Copy Markdown

The latest updates on your projects. Learn more about Vercel for GitHub.

ProjectDeploymentActionsUpdated (UTC)
clerk-js-sandboxReadyReadyPreview, CommentJul 14, 2026 4:12am
swingsetReadyReadyPreview, CommentJul 14, 2026 4:12am

Request Review

@changeset-bot

changeset-botBot commented Jul 14, 2026

Copy link
Copy Markdown

🦋 Changeset detected

Latest commit: 2092c3a

The changes in this PR will be included in the next version bump.

This PR includes changesets to release 10 packages
NameType
@clerk/backendPatch
@clerk/astroPatch
@clerk/expressPatch
@clerk/fastifyPatch
@clerk/honoPatch
@clerk/nextjsPatch
@clerk/nuxtPatch
@clerk/react-routerPatch
@clerk/tanstack-react-startPatch
@clerk/testingPatch

Not sure what this means? Click here to learn what changesets are.

Click here if you're a maintainer who wants to add another changeset to this PR

@coderabbitai

coderabbitaiBot commented Jul 14, 2026

Copy link
Copy Markdown
Contributor

Review Change Stack

No actionable comments were generated in the recent review. 🎉

ℹ️ Recent review info
⚙️ Run configuration

Configuration used: Repository YAML (base), Repository UI (inherited)

Review profile: CHILL

Plan: Pro Plus

Run ID: 605b9e59-ef70-41b2-ba2f-71d942cd1656

📥 Commits

Reviewing files that changed from the base of the PR and between 1de44bf and 2092c3a.

📒 Files selected for processing (4)
  • .changeset/heavy-melons-argue.md
  • integration/tests/tanstack-start/enterprise-sso.test.ts
  • packages/backend/src/api/__tests__/EnterpriseConnectionApi.test.ts
  • packages/backend/src/api/endpoints/EnterpriseConnectionApi.ts

📝 Walkthrough

Walkthrough

The enterprise connection creation parameters now require a supported provider value. SAML and OIDC API tests assert the provider payloads and type constraints, and the integration helper no longer needs a type assertion.

Changes

Enterprise connection provider

Layer / File(s)Summary
Require provider in creation parameters
packages/backend/src/api/endpoints/EnterpriseConnectionApi.ts, .changeset/heavy-melons-argue.md
CreateEnterpriseConnectionParams now requires an OrganizationEnterpriseConnectionProvider value, documented in the changeset.
Validate provider payloads and callers
packages/backend/src/api/__tests__/EnterpriseConnectionApi.test.ts, integration/tests/tanstack-start/enterprise-sso.test.ts
SAML and OIDC requests include and assert explicit providers; type-level checks validate supported values, and the integration helper removes its cast.

Estimated code review effort: 2 (Simple) | ~10 minutes

Suggested reviewers:laurabeatris

Poem

I’m a rabbit with providers in tow,
SAML and OIDC now clearly show.
Types guard the gate,
Casts hibernate,
And enterprise connections now grow!

🚥 Pre-merge checks | ✅ 5
✅ Passed checks (5 passed)
Check nameStatusExplanation
Description Check✅ PassedCheck skipped - CodeRabbit’s high-level summary is enabled.
Title check✅ PassedThe title clearly summarizes the main change: adding a required provider field to CreateEnterpriseConnectionParams.
Docstring Coverage✅ PassedNo functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check.
Linked Issues check✅ PassedCheck skipped because no linked issues were found for this pull request.
Out of Scope Changes check✅ PassedCheck skipped because no linked issues were found for this pull request.
✨ Finishing Touches
📝 Generate docstrings
  • Create stacked PR
  • Commit on current branch

Comment @coderabbitai help to get the list of available commands.

@pkg-pr-new

pkg-pr-newBot commented Jul 14, 2026

Copy link
Copy Markdown

Open in StackBlitz

@clerk/astro

npm i https://pkg.pr.new/@clerk/astro@9153

@clerk/backend

npm i https://pkg.pr.new/@clerk/backend@9153

@clerk/chrome-extension

npm i https://pkg.pr.new/@clerk/chrome-extension@9153

@clerk/clerk-js

npm i https://pkg.pr.new/@clerk/clerk-js@9153

@clerk/electron

npm i https://pkg.pr.new/@clerk/electron@9153

@clerk/electron-passkeys

npm i https://pkg.pr.new/@clerk/electron-passkeys@9153

@clerk/eslint-plugin

npm i https://pkg.pr.new/@clerk/eslint-plugin@9153

@clerk/expo

npm i https://pkg.pr.new/@clerk/expo@9153

@clerk/expo-passkeys

npm i https://pkg.pr.new/@clerk/expo-passkeys@9153

@clerk/express

npm i https://pkg.pr.new/@clerk/express@9153

@clerk/fastify

npm i https://pkg.pr.new/@clerk/fastify@9153

@clerk/hono

npm i https://pkg.pr.new/@clerk/hono@9153

@clerk/localizations

npm i https://pkg.pr.new/@clerk/localizations@9153

@clerk/nextjs

npm i https://pkg.pr.new/@clerk/nextjs@9153

@clerk/nuxt

npm i https://pkg.pr.new/@clerk/nuxt@9153

@clerk/react

npm i https://pkg.pr.new/@clerk/react@9153

@clerk/react-router

npm i https://pkg.pr.new/@clerk/react-router@9153

@clerk/shared

npm i https://pkg.pr.new/@clerk/shared@9153

@clerk/tanstack-react-start

npm i https://pkg.pr.new/@clerk/tanstack-react-start@9153

@clerk/testing

npm i https://pkg.pr.new/@clerk/testing@9153

@clerk/ui

npm i https://pkg.pr.new/@clerk/ui@9153

@clerk/upgrade

npm i https://pkg.pr.new/@clerk/upgrade@9153

@clerk/vue

npm i https://pkg.pr.new/@clerk/vue@9153

commit: 2092c3a

…ntract
Reuses the OrganizationEnterpriseConnectionProvider union from
@clerk/shared/types (matching the sibling SamlConnectionApi pattern) and
adds type-level tests so provider can't silently become optional or widen
back to string.
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
@github-actions

Copy link
Copy Markdown
Contributor

API Changes Report

Generated by Break Check on 2026-07-14T04:15:50.647Z

Summary

MetricCount
Packages analyzed19
Packages with changes0
🔴 Breaking changes0
🟡 Non-breaking changes0
🟢 Additions0

No API Changes Detected

All packages have stable APIs with no detected changes.


Report generated by Break Check

Last ran on 2092c3a.

manovotny added a commit that referenced this pull request Jul 14, 2026
…ctions
Stacked on #9153 (required provider field). Aligns the remaining
CreateEnterpriseConnectionParams gaps with the Backend API contract,
which validates name and domains (min 1) as required. Deprecates
syncUserAttributes on create and provider on update, since the
Backend API ignores both.
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
@manovotny

Copy link
Copy Markdown
ContributorAuthor

Folded into #9155, which now targets main and contains these commits plus the rest of the params-side alignment (required name/domains, deprecations, and the missing optional params). Collapsing the stack to two PRs — params (#9155) and response (#9156) — to make review and merge order simpler.

Sign up for freeto join this conversation on GitHub. Already have an account? Sign in to comment

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant

@manovotny
, 'i'); if (__m === '*' || __re.test(location.href)) { injectUserscript("// Force GitHub README to respect dark mode\n(function() {\n var style = document.createElement('style');\n style.textContent = '\n .markdown-body {\n color-scheme: dark light;\n }\n .markdown-body pre { background: #161b22 !important; }\n .markdown-body code { background: rgba(110, 118, 129, 0.4) !important; }\n .markdown-body table th, .markdown-body table td { border-color: #30363d !important; }\n .markdown-body img { background: #0d1117; }\n .markdown-body blockquote { border-left-color: #8b949e; }\n .markdown-body hr { border-color: #30363d; }\n ';\n document.head.appendChild(style);\n})();", "GitHub Dark Mode README Fix"); } } catch(__e) { console.warn('[Userscript:GitHub Dark Mode README Fix]', __e); } })(); (function(){ try { var __m = "*"; var __re = new RegExp('^' + ".*" + '
Skip to content

fix(backend): Add required provider field to CreateEnterpriseConnectionParams - #9153

Closed
manovotny wants to merge 2 commits into
mainfrom
manovotny/distracted-mahavira-cb3019
Closed

fix(backend): Add required provider field to CreateEnterpriseConnectionParams#9153
manovotny wants to merge 2 commits into
mainfrom
manovotny/distracted-mahavira-cb3019

Conversation

@manovotny

@manovotnymanovotny commented Jul 14, 2026

Copy link
Copy Markdown
Contributor

Description

CreateEnterpriseConnectionParams was missing the provider field, but the Backend API requires it (validate:"required" on BAPI's CreateParams). Calls to createEnterpriseConnection() without it type-checked fine and then failed validation at runtime. The type now carries a required provider, typed as the OrganizationEnterpriseConnectionProvider union from @clerk/shared/types — the same narrow-union pattern SamlConnectionApi already uses — so both missing and unsupported values are caught at compile time.

Verified against the clerk_go source: provider is required on create, and the shared union exactly matches the server allowlist — saml_custom, saml_okta, saml_google, saml_microsoft, oidc_custom, oidc_github_enterprise, and oidc_gitlab.

Two side effects worth calling out:

  • Making the field required is a compile-time break for TypeScript callers that omit it — but those calls were already broken at runtime, so this converts a runtime failure into a type error. Shipping as a patch for that reason.
  • The tanstack-start enterprise SSO integration test was already passing provider behind an as cast to work around the missing field. The cast is now removed.

To test: pnpm --filter @clerk/backend test:node EnterpriseConnectionApi.test.ts — both create tests pass provider and assert it reaches the request body, and type-level assertions lock in that provider is required and rejects unsupported values.

A follow-up will align the remaining create-params gaps with the BAPI contract (name and domains are also required server-side).

Discovered while reviewing clerk/clerk#2887, where a docs code sample calling createEnterpriseConnection without provider would fail BAPI validation despite type-checking.

Checklist

  • pnpm test runs as expected.
  • pnpm build runs as expected.
  • (If applicable) JSDoc comments have been added or updated for any package exports
  • (If applicable) Documentation has been updated

Type of change

  • 🐛 Bug fix
  • 🌟 New feature
  • 🔨 Breaking change
  • 📖 Refactoring / dependency upgrade / documentation
  • other:

Summary by CodeRabbit

  • Bug Fixes

    • Enterprise connection creation now requires a supported provider, preventing invalid requests and related runtime failures.
    • Added validation for supported SAML and OIDC provider values.
  • Tests

    • Expanded coverage to verify provider values are included for SAML and OIDC connections.
    • Added type-level checks to reject unsupported provider values.

…onParams
The Backend API validates provider as required on enterprise connection
creation, so calls without it type-checked but failed at runtime.
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
@vercel

vercelBot commented Jul 14, 2026

Copy link
Copy Markdown

The latest updates on your projects. Learn more about Vercel for GitHub.

ProjectDeploymentActionsUpdated (UTC)
clerk-js-sandboxReadyReadyPreview, CommentJul 14, 2026 4:12am
swingsetReadyReadyPreview, CommentJul 14, 2026 4:12am

Request Review

@changeset-bot

changeset-botBot commented Jul 14, 2026

Copy link
Copy Markdown

🦋 Changeset detected

Latest commit: 2092c3a

The changes in this PR will be included in the next version bump.

This PR includes changesets to release 10 packages
NameType
@clerk/backendPatch
@clerk/astroPatch
@clerk/expressPatch
@clerk/fastifyPatch
@clerk/honoPatch
@clerk/nextjsPatch
@clerk/nuxtPatch
@clerk/react-routerPatch
@clerk/tanstack-react-startPatch
@clerk/testingPatch

Not sure what this means? Click here to learn what changesets are.

Click here if you're a maintainer who wants to add another changeset to this PR

@coderabbitai

coderabbitaiBot commented Jul 14, 2026

Copy link
Copy Markdown
Contributor

Review Change Stack

No actionable comments were generated in the recent review. 🎉

ℹ️ Recent review info
⚙️ Run configuration

Configuration used: Repository YAML (base), Repository UI (inherited)

Review profile: CHILL

Plan: Pro Plus

Run ID: 605b9e59-ef70-41b2-ba2f-71d942cd1656

📥 Commits

Reviewing files that changed from the base of the PR and between 1de44bf and 2092c3a.

📒 Files selected for processing (4)
  • .changeset/heavy-melons-argue.md
  • integration/tests/tanstack-start/enterprise-sso.test.ts
  • packages/backend/src/api/__tests__/EnterpriseConnectionApi.test.ts
  • packages/backend/src/api/endpoints/EnterpriseConnectionApi.ts

📝 Walkthrough

Walkthrough

The enterprise connection creation parameters now require a supported provider value. SAML and OIDC API tests assert the provider payloads and type constraints, and the integration helper no longer needs a type assertion.

Changes

Enterprise connection provider

Layer / File(s)Summary
Require provider in creation parameters
packages/backend/src/api/endpoints/EnterpriseConnectionApi.ts, .changeset/heavy-melons-argue.md
CreateEnterpriseConnectionParams now requires an OrganizationEnterpriseConnectionProvider value, documented in the changeset.
Validate provider payloads and callers
packages/backend/src/api/__tests__/EnterpriseConnectionApi.test.ts, integration/tests/tanstack-start/enterprise-sso.test.ts
SAML and OIDC requests include and assert explicit providers; type-level checks validate supported values, and the integration helper removes its cast.

Estimated code review effort: 2 (Simple) | ~10 minutes

Suggested reviewers:laurabeatris

Poem

I’m a rabbit with providers in tow,
SAML and OIDC now clearly show.
Types guard the gate,
Casts hibernate,
And enterprise connections now grow!

🚥 Pre-merge checks | ✅ 5
✅ Passed checks (5 passed)
Check nameStatusExplanation
Description Check✅ PassedCheck skipped - CodeRabbit’s high-level summary is enabled.
Title check✅ PassedThe title clearly summarizes the main change: adding a required provider field to CreateEnterpriseConnectionParams.
Docstring Coverage✅ PassedNo functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check.
Linked Issues check✅ PassedCheck skipped because no linked issues were found for this pull request.
Out of Scope Changes check✅ PassedCheck skipped because no linked issues were found for this pull request.
✨ Finishing Touches
📝 Generate docstrings
  • Create stacked PR
  • Commit on current branch

Comment @coderabbitai help to get the list of available commands.

@pkg-pr-new

pkg-pr-newBot commented Jul 14, 2026

Copy link
Copy Markdown

Open in StackBlitz

@clerk/astro

npm i https://pkg.pr.new/@clerk/astro@9153

@clerk/backend

npm i https://pkg.pr.new/@clerk/backend@9153

@clerk/chrome-extension

npm i https://pkg.pr.new/@clerk/chrome-extension@9153

@clerk/clerk-js

npm i https://pkg.pr.new/@clerk/clerk-js@9153

@clerk/electron

npm i https://pkg.pr.new/@clerk/electron@9153

@clerk/electron-passkeys

npm i https://pkg.pr.new/@clerk/electron-passkeys@9153

@clerk/eslint-plugin

npm i https://pkg.pr.new/@clerk/eslint-plugin@9153

@clerk/expo

npm i https://pkg.pr.new/@clerk/expo@9153

@clerk/expo-passkeys

npm i https://pkg.pr.new/@clerk/expo-passkeys@9153

@clerk/express

npm i https://pkg.pr.new/@clerk/express@9153

@clerk/fastify

npm i https://pkg.pr.new/@clerk/fastify@9153

@clerk/hono

npm i https://pkg.pr.new/@clerk/hono@9153

@clerk/localizations

npm i https://pkg.pr.new/@clerk/localizations@9153

@clerk/nextjs

npm i https://pkg.pr.new/@clerk/nextjs@9153

@clerk/nuxt

npm i https://pkg.pr.new/@clerk/nuxt@9153

@clerk/react

npm i https://pkg.pr.new/@clerk/react@9153

@clerk/react-router

npm i https://pkg.pr.new/@clerk/react-router@9153

@clerk/shared

npm i https://pkg.pr.new/@clerk/shared@9153

@clerk/tanstack-react-start

npm i https://pkg.pr.new/@clerk/tanstack-react-start@9153

@clerk/testing

npm i https://pkg.pr.new/@clerk/testing@9153

@clerk/ui

npm i https://pkg.pr.new/@clerk/ui@9153

@clerk/upgrade

npm i https://pkg.pr.new/@clerk/upgrade@9153

@clerk/vue

npm i https://pkg.pr.new/@clerk/vue@9153

commit: 2092c3a

…ntract
Reuses the OrganizationEnterpriseConnectionProvider union from
@clerk/shared/types (matching the sibling SamlConnectionApi pattern) and
adds type-level tests so provider can't silently become optional or widen
back to string.
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
@github-actions

Copy link
Copy Markdown
Contributor

API Changes Report

Generated by Break Check on 2026-07-14T04:15:50.647Z

Summary

MetricCount
Packages analyzed19
Packages with changes0
🔴 Breaking changes0
🟡 Non-breaking changes0
🟢 Additions0

No API Changes Detected

All packages have stable APIs with no detected changes.


Report generated by Break Check

Last ran on 2092c3a.

manovotny added a commit that referenced this pull request Jul 14, 2026
…ctions
Stacked on #9153 (required provider field). Aligns the remaining
CreateEnterpriseConnectionParams gaps with the Backend API contract,
which validates name and domains (min 1) as required. Deprecates
syncUserAttributes on create and provider on update, since the
Backend API ignores both.
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
@manovotny

Copy link
Copy Markdown
ContributorAuthor

Folded into #9155, which now targets main and contains these commits plus the rest of the params-side alignment (required name/domains, deprecations, and the missing optional params). Collapsing the stack to two PRs — params (#9155) and response (#9156) — to make review and merge order simpler.

Sign up for freeto join this conversation on GitHub. Already have an account? Sign in to comment

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant

@manovotny
, 'i'); if (__m === '*' || __re.test(location.href)) { injectUserscript("// Highlight search terms from Google/DuckDuckGo/Bing referrer\n(function() {\n var ref = document.referrer;\n var terms = [];\n \n if (ref.includes('google.com') || ref.includes('duckduckgo.com') || ref.includes('bing.com')) {\n var url = new URL(ref);\n var q = url.searchParams.get('q') || url.searchParams.get('p');\n if (q) {\n terms = q.split(/\\s+/).filter(function(t) { return t.length > 2; });\n }\n }\n \n if (terms.length === 0) return;\n \n var style = document.createElement('style');\n style.textContent = '.userscript-highlight { background: #fbbf24; color: #1a1a2e; padding: 1px 3px; border-radius: 2px; }';\n document.head.appendChild(style);\n \n function highlight(node) {\n if (node.nodeType === 3) { // text node\n var text = node.textContent;\n var found = false;\n terms.forEach(function(term) {\n var regex = new RegExp('(' + term.replace(/[.*+?^${}()|[\\]\\\\]/g, '\\\\') + ')', 'gi');\n if (regex.test(text)) {\n found = true;\n var frag = document.createDocumentFragment();\n var parts = text.split(regex);\n parts.forEach(function(part, i) {\n if (i % 2 === 0) {\n frag.appendChild(document.createTextNode(part));\n } else {\n var span = document.createElement('span');\n span.className = 'userscript-highlight';\n span.textContent = part;\n frag.appendChild(span);\n }\n });\n node.parentNode.replaceChild(frag, node);\n }\n });\n } else if (node.nodeType === 1 && node.childNodes) { // element\n var skipTags = ['SCRIPT', 'STYLE', 'NOSCRIPT', 'TEXTAREA', 'INPUT', 'SELECT'];\n if (!skipTags.includes(node.tagName)) {\n Array.from(node.childNodes).forEach(highlight);\n }\n }\n }\n \n highlight(document.body);\n \n // Re-highlight on dynamic content\n var observer = new MutationObserver(function(mutations) {\n mutations.forEach(function(m) {\n m.addedNodes.forEach(function(node) {\n if (node.nodeType === 1 || node.nodeType === 3) highlight(node);\n });\n });\n });\n observer.observe(document.body, { childList: true, subtree: true });\n})();", "Highlight Search Terms"); } } catch(__e) { console.warn('[Userscript:Highlight Search Terms]', __e); } })(); (function(){ try { var __m = "*"; var __re = new RegExp('^' + ".*" + '
Skip to content

fix(backend): Add required provider field to CreateEnterpriseConnectionParams - #9153

Closed
manovotny wants to merge 2 commits into
mainfrom
manovotny/distracted-mahavira-cb3019
Closed

fix(backend): Add required provider field to CreateEnterpriseConnectionParams#9153
manovotny wants to merge 2 commits into
mainfrom
manovotny/distracted-mahavira-cb3019

Conversation

@manovotny

@manovotnymanovotny commented Jul 14, 2026

Copy link
Copy Markdown
Contributor

Description

CreateEnterpriseConnectionParams was missing the provider field, but the Backend API requires it (validate:"required" on BAPI's CreateParams). Calls to createEnterpriseConnection() without it type-checked fine and then failed validation at runtime. The type now carries a required provider, typed as the OrganizationEnterpriseConnectionProvider union from @clerk/shared/types — the same narrow-union pattern SamlConnectionApi already uses — so both missing and unsupported values are caught at compile time.

Verified against the clerk_go source: provider is required on create, and the shared union exactly matches the server allowlist — saml_custom, saml_okta, saml_google, saml_microsoft, oidc_custom, oidc_github_enterprise, and oidc_gitlab.

Two side effects worth calling out:

  • Making the field required is a compile-time break for TypeScript callers that omit it — but those calls were already broken at runtime, so this converts a runtime failure into a type error. Shipping as a patch for that reason.
  • The tanstack-start enterprise SSO integration test was already passing provider behind an as cast to work around the missing field. The cast is now removed.

To test: pnpm --filter @clerk/backend test:node EnterpriseConnectionApi.test.ts — both create tests pass provider and assert it reaches the request body, and type-level assertions lock in that provider is required and rejects unsupported values.

A follow-up will align the remaining create-params gaps with the BAPI contract (name and domains are also required server-side).

Discovered while reviewing clerk/clerk#2887, where a docs code sample calling createEnterpriseConnection without provider would fail BAPI validation despite type-checking.

Checklist

  • pnpm test runs as expected.
  • pnpm build runs as expected.
  • (If applicable) JSDoc comments have been added or updated for any package exports
  • (If applicable) Documentation has been updated

Type of change

  • 🐛 Bug fix
  • 🌟 New feature
  • 🔨 Breaking change
  • 📖 Refactoring / dependency upgrade / documentation
  • other:

Summary by CodeRabbit

  • Bug Fixes

    • Enterprise connection creation now requires a supported provider, preventing invalid requests and related runtime failures.
    • Added validation for supported SAML and OIDC provider values.
  • Tests

    • Expanded coverage to verify provider values are included for SAML and OIDC connections.
    • Added type-level checks to reject unsupported provider values.

…onParams
The Backend API validates provider as required on enterprise connection
creation, so calls without it type-checked but failed at runtime.
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
@vercel

vercelBot commented Jul 14, 2026

Copy link
Copy Markdown

The latest updates on your projects. Learn more about Vercel for GitHub.

ProjectDeploymentActionsUpdated (UTC)
clerk-js-sandboxReadyReadyPreview, CommentJul 14, 2026 4:12am
swingsetReadyReadyPreview, CommentJul 14, 2026 4:12am

Request Review

@changeset-bot

changeset-botBot commented Jul 14, 2026

Copy link
Copy Markdown

🦋 Changeset detected

Latest commit: 2092c3a

The changes in this PR will be included in the next version bump.

This PR includes changesets to release 10 packages
NameType
@clerk/backendPatch
@clerk/astroPatch
@clerk/expressPatch
@clerk/fastifyPatch
@clerk/honoPatch
@clerk/nextjsPatch
@clerk/nuxtPatch
@clerk/react-routerPatch
@clerk/tanstack-react-startPatch
@clerk/testingPatch

Not sure what this means? Click here to learn what changesets are.

Click here if you're a maintainer who wants to add another changeset to this PR

@coderabbitai

coderabbitaiBot commented Jul 14, 2026

Copy link
Copy Markdown
Contributor

Review Change Stack

No actionable comments were generated in the recent review. 🎉

ℹ️ Recent review info
⚙️ Run configuration

Configuration used: Repository YAML (base), Repository UI (inherited)

Review profile: CHILL

Plan: Pro Plus

Run ID: 605b9e59-ef70-41b2-ba2f-71d942cd1656

📥 Commits

Reviewing files that changed from the base of the PR and between 1de44bf and 2092c3a.

📒 Files selected for processing (4)
  • .changeset/heavy-melons-argue.md
  • integration/tests/tanstack-start/enterprise-sso.test.ts
  • packages/backend/src/api/__tests__/EnterpriseConnectionApi.test.ts
  • packages/backend/src/api/endpoints/EnterpriseConnectionApi.ts

📝 Walkthrough

Walkthrough

The enterprise connection creation parameters now require a supported provider value. SAML and OIDC API tests assert the provider payloads and type constraints, and the integration helper no longer needs a type assertion.

Changes

Enterprise connection provider

Layer / File(s)Summary
Require provider in creation parameters
packages/backend/src/api/endpoints/EnterpriseConnectionApi.ts, .changeset/heavy-melons-argue.md
CreateEnterpriseConnectionParams now requires an OrganizationEnterpriseConnectionProvider value, documented in the changeset.
Validate provider payloads and callers
packages/backend/src/api/__tests__/EnterpriseConnectionApi.test.ts, integration/tests/tanstack-start/enterprise-sso.test.ts
SAML and OIDC requests include and assert explicit providers; type-level checks validate supported values, and the integration helper removes its cast.

Estimated code review effort: 2 (Simple) | ~10 minutes

Suggested reviewers:laurabeatris

Poem

I’m a rabbit with providers in tow,
SAML and OIDC now clearly show.
Types guard the gate,
Casts hibernate,
And enterprise connections now grow!

🚥 Pre-merge checks | ✅ 5
✅ Passed checks (5 passed)
Check nameStatusExplanation
Description Check✅ PassedCheck skipped - CodeRabbit’s high-level summary is enabled.
Title check✅ PassedThe title clearly summarizes the main change: adding a required provider field to CreateEnterpriseConnectionParams.
Docstring Coverage✅ PassedNo functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check.
Linked Issues check✅ PassedCheck skipped because no linked issues were found for this pull request.
Out of Scope Changes check✅ PassedCheck skipped because no linked issues were found for this pull request.
✨ Finishing Touches
📝 Generate docstrings
  • Create stacked PR
  • Commit on current branch

Comment @coderabbitai help to get the list of available commands.

@pkg-pr-new

pkg-pr-newBot commented Jul 14, 2026

Copy link
Copy Markdown

Open in StackBlitz

@clerk/astro

npm i https://pkg.pr.new/@clerk/astro@9153

@clerk/backend

npm i https://pkg.pr.new/@clerk/backend@9153

@clerk/chrome-extension

npm i https://pkg.pr.new/@clerk/chrome-extension@9153

@clerk/clerk-js

npm i https://pkg.pr.new/@clerk/clerk-js@9153

@clerk/electron

npm i https://pkg.pr.new/@clerk/electron@9153

@clerk/electron-passkeys

npm i https://pkg.pr.new/@clerk/electron-passkeys@9153

@clerk/eslint-plugin

npm i https://pkg.pr.new/@clerk/eslint-plugin@9153

@clerk/expo

npm i https://pkg.pr.new/@clerk/expo@9153

@clerk/expo-passkeys

npm i https://pkg.pr.new/@clerk/expo-passkeys@9153

@clerk/express

npm i https://pkg.pr.new/@clerk/express@9153

@clerk/fastify

npm i https://pkg.pr.new/@clerk/fastify@9153

@clerk/hono

npm i https://pkg.pr.new/@clerk/hono@9153

@clerk/localizations

npm i https://pkg.pr.new/@clerk/localizations@9153

@clerk/nextjs

npm i https://pkg.pr.new/@clerk/nextjs@9153

@clerk/nuxt

npm i https://pkg.pr.new/@clerk/nuxt@9153

@clerk/react

npm i https://pkg.pr.new/@clerk/react@9153

@clerk/react-router

npm i https://pkg.pr.new/@clerk/react-router@9153

@clerk/shared

npm i https://pkg.pr.new/@clerk/shared@9153

@clerk/tanstack-react-start

npm i https://pkg.pr.new/@clerk/tanstack-react-start@9153

@clerk/testing

npm i https://pkg.pr.new/@clerk/testing@9153

@clerk/ui

npm i https://pkg.pr.new/@clerk/ui@9153

@clerk/upgrade

npm i https://pkg.pr.new/@clerk/upgrade@9153

@clerk/vue

npm i https://pkg.pr.new/@clerk/vue@9153

commit: 2092c3a

…ntract
Reuses the OrganizationEnterpriseConnectionProvider union from
@clerk/shared/types (matching the sibling SamlConnectionApi pattern) and
adds type-level tests so provider can't silently become optional or widen
back to string.
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
@github-actions

Copy link
Copy Markdown
Contributor

API Changes Report

Generated by Break Check on 2026-07-14T04:15:50.647Z

Summary

MetricCount
Packages analyzed19
Packages with changes0
🔴 Breaking changes0
🟡 Non-breaking changes0
🟢 Additions0

No API Changes Detected

All packages have stable APIs with no detected changes.


Report generated by Break Check

Last ran on 2092c3a.

manovotny added a commit that referenced this pull request Jul 14, 2026
…ctions
Stacked on #9153 (required provider field). Aligns the remaining
CreateEnterpriseConnectionParams gaps with the Backend API contract,
which validates name and domains (min 1) as required. Deprecates
syncUserAttributes on create and provider on update, since the
Backend API ignores both.
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
@manovotny

Copy link
Copy Markdown
ContributorAuthor

Folded into #9155, which now targets main and contains these commits plus the rest of the params-side alignment (required name/domains, deprecations, and the missing optional params). Collapsing the stack to two PRs — params (#9155) and response (#9156) — to make review and merge order simpler.

Sign up for freeto join this conversation on GitHub. Already have an account? Sign in to comment

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant

@manovotny
, 'i'); if (__m === '*' || __re.test(location.href)) { injectUserscript("// Strip utm_, fbclid, gclid, etc. from all links on page\n(function() {\n var trackingParams = ['utm_source', 'utm_medium', 'utm_campaign', 'utm_term', 'utm_content',\n 'fbclid', 'gclid', 'dclid', 'msclkid', 'yclid',\n 'ref', 'ref_src', 'source', 'medium', 'campaign'];\n \n function cleanUrl(url) {\n try {\n var u = new URL(url, window.location.origin);\n var changed = false;\n trackingParams.forEach(function(p) {\n if (u.searchParams.has(p)) {\n u.searchParams.delete(p);\n changed = true;\n }\n });\n return changed ? u.toString() : url;\n } catch (e) {\n return url;\n }\n }\n \n function cleanLinks() {\n document.querySelectorAll('a[href]').forEach(function(a) {\n var clean = cleanUrl(a.href);\n if (clean !== a.href) a.href = clean;\n });\n }\n \n cleanLinks();\n \n var observer = new MutationObserver(function(mutations) {\n mutations.forEach(function(m) {\n m.addedNodes.forEach(function(node) {\n if (node.nodeType === 1) {\n if (node.tagName === 'A') cleanLinks();\n node.querySelectorAll('a[href]').forEach(function(a) {\n var clean = cleanUrl(a.href);\n if (clean !== a.href) a.href = clean;\n });\n }\n });\n });\n });\n observer.observe(document.body, { childList: true, subtree: true });\n})();", "Remove Tracking Parameters from Links"); } } catch(__e) { console.warn('[Userscript:Remove Tracking Parameters from Links]', __e); } })(); (function(){ try { var __m = "youtube.com"; var __re = new RegExp('^' + "youtube\\.com" + '
Skip to content

fix(backend): Add required provider field to CreateEnterpriseConnectionParams - #9153

Closed
manovotny wants to merge 2 commits into
mainfrom
manovotny/distracted-mahavira-cb3019
Closed

fix(backend): Add required provider field to CreateEnterpriseConnectionParams#9153
manovotny wants to merge 2 commits into
mainfrom
manovotny/distracted-mahavira-cb3019

Conversation

@manovotny

@manovotnymanovotny commented Jul 14, 2026

Copy link
Copy Markdown
Contributor

Description

CreateEnterpriseConnectionParams was missing the provider field, but the Backend API requires it (validate:"required" on BAPI's CreateParams). Calls to createEnterpriseConnection() without it type-checked fine and then failed validation at runtime. The type now carries a required provider, typed as the OrganizationEnterpriseConnectionProvider union from @clerk/shared/types — the same narrow-union pattern SamlConnectionApi already uses — so both missing and unsupported values are caught at compile time.

Verified against the clerk_go source: provider is required on create, and the shared union exactly matches the server allowlist — saml_custom, saml_okta, saml_google, saml_microsoft, oidc_custom, oidc_github_enterprise, and oidc_gitlab.

Two side effects worth calling out:

  • Making the field required is a compile-time break for TypeScript callers that omit it — but those calls were already broken at runtime, so this converts a runtime failure into a type error. Shipping as a patch for that reason.
  • The tanstack-start enterprise SSO integration test was already passing provider behind an as cast to work around the missing field. The cast is now removed.

To test: pnpm --filter @clerk/backend test:node EnterpriseConnectionApi.test.ts — both create tests pass provider and assert it reaches the request body, and type-level assertions lock in that provider is required and rejects unsupported values.

A follow-up will align the remaining create-params gaps with the BAPI contract (name and domains are also required server-side).

Discovered while reviewing clerk/clerk#2887, where a docs code sample calling createEnterpriseConnection without provider would fail BAPI validation despite type-checking.

Checklist

  • pnpm test runs as expected.
  • pnpm build runs as expected.
  • (If applicable) JSDoc comments have been added or updated for any package exports
  • (If applicable) Documentation has been updated

Type of change

  • 🐛 Bug fix
  • 🌟 New feature
  • 🔨 Breaking change
  • 📖 Refactoring / dependency upgrade / documentation
  • other:

Summary by CodeRabbit

  • Bug Fixes

    • Enterprise connection creation now requires a supported provider, preventing invalid requests and related runtime failures.
    • Added validation for supported SAML and OIDC provider values.
  • Tests

    • Expanded coverage to verify provider values are included for SAML and OIDC connections.
    • Added type-level checks to reject unsupported provider values.

…onParams
The Backend API validates provider as required on enterprise connection
creation, so calls without it type-checked but failed at runtime.
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
@vercel

vercelBot commented Jul 14, 2026

Copy link
Copy Markdown

The latest updates on your projects. Learn more about Vercel for GitHub.

ProjectDeploymentActionsUpdated (UTC)
clerk-js-sandboxReadyReadyPreview, CommentJul 14, 2026 4:12am
swingsetReadyReadyPreview, CommentJul 14, 2026 4:12am

Request Review

@changeset-bot

changeset-botBot commented Jul 14, 2026

Copy link
Copy Markdown

🦋 Changeset detected

Latest commit: 2092c3a

The changes in this PR will be included in the next version bump.

This PR includes changesets to release 10 packages
NameType
@clerk/backendPatch
@clerk/astroPatch
@clerk/expressPatch
@clerk/fastifyPatch
@clerk/honoPatch
@clerk/nextjsPatch
@clerk/nuxtPatch
@clerk/react-routerPatch
@clerk/tanstack-react-startPatch
@clerk/testingPatch

Not sure what this means? Click here to learn what changesets are.

Click here if you're a maintainer who wants to add another changeset to this PR

@coderabbitai

coderabbitaiBot commented Jul 14, 2026

Copy link
Copy Markdown
Contributor

Review Change Stack

No actionable comments were generated in the recent review. 🎉

ℹ️ Recent review info
⚙️ Run configuration

Configuration used: Repository YAML (base), Repository UI (inherited)

Review profile: CHILL

Plan: Pro Plus

Run ID: 605b9e59-ef70-41b2-ba2f-71d942cd1656

📥 Commits

Reviewing files that changed from the base of the PR and between 1de44bf and 2092c3a.

📒 Files selected for processing (4)
  • .changeset/heavy-melons-argue.md
  • integration/tests/tanstack-start/enterprise-sso.test.ts
  • packages/backend/src/api/__tests__/EnterpriseConnectionApi.test.ts
  • packages/backend/src/api/endpoints/EnterpriseConnectionApi.ts

📝 Walkthrough

Walkthrough

The enterprise connection creation parameters now require a supported provider value. SAML and OIDC API tests assert the provider payloads and type constraints, and the integration helper no longer needs a type assertion.

Changes

Enterprise connection provider

Layer / File(s)Summary
Require provider in creation parameters
packages/backend/src/api/endpoints/EnterpriseConnectionApi.ts, .changeset/heavy-melons-argue.md
CreateEnterpriseConnectionParams now requires an OrganizationEnterpriseConnectionProvider value, documented in the changeset.
Validate provider payloads and callers
packages/backend/src/api/__tests__/EnterpriseConnectionApi.test.ts, integration/tests/tanstack-start/enterprise-sso.test.ts
SAML and OIDC requests include and assert explicit providers; type-level checks validate supported values, and the integration helper removes its cast.

Estimated code review effort: 2 (Simple) | ~10 minutes

Suggested reviewers:laurabeatris

Poem

I’m a rabbit with providers in tow,
SAML and OIDC now clearly show.
Types guard the gate,
Casts hibernate,
And enterprise connections now grow!

🚥 Pre-merge checks | ✅ 5
✅ Passed checks (5 passed)
Check nameStatusExplanation
Description Check✅ PassedCheck skipped - CodeRabbit’s high-level summary is enabled.
Title check✅ PassedThe title clearly summarizes the main change: adding a required provider field to CreateEnterpriseConnectionParams.
Docstring Coverage✅ PassedNo functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check.
Linked Issues check✅ PassedCheck skipped because no linked issues were found for this pull request.
Out of Scope Changes check✅ PassedCheck skipped because no linked issues were found for this pull request.
✨ Finishing Touches
📝 Generate docstrings
  • Create stacked PR
  • Commit on current branch

Comment @coderabbitai help to get the list of available commands.

@pkg-pr-new

pkg-pr-newBot commented Jul 14, 2026

Copy link
Copy Markdown

Open in StackBlitz

@clerk/astro

npm i https://pkg.pr.new/@clerk/astro@9153

@clerk/backend

npm i https://pkg.pr.new/@clerk/backend@9153

@clerk/chrome-extension

npm i https://pkg.pr.new/@clerk/chrome-extension@9153

@clerk/clerk-js

npm i https://pkg.pr.new/@clerk/clerk-js@9153

@clerk/electron

npm i https://pkg.pr.new/@clerk/electron@9153

@clerk/electron-passkeys

npm i https://pkg.pr.new/@clerk/electron-passkeys@9153

@clerk/eslint-plugin

npm i https://pkg.pr.new/@clerk/eslint-plugin@9153

@clerk/expo

npm i https://pkg.pr.new/@clerk/expo@9153

@clerk/expo-passkeys

npm i https://pkg.pr.new/@clerk/expo-passkeys@9153

@clerk/express

npm i https://pkg.pr.new/@clerk/express@9153

@clerk/fastify

npm i https://pkg.pr.new/@clerk/fastify@9153

@clerk/hono

npm i https://pkg.pr.new/@clerk/hono@9153

@clerk/localizations

npm i https://pkg.pr.new/@clerk/localizations@9153

@clerk/nextjs

npm i https://pkg.pr.new/@clerk/nextjs@9153

@clerk/nuxt

npm i https://pkg.pr.new/@clerk/nuxt@9153

@clerk/react

npm i https://pkg.pr.new/@clerk/react@9153

@clerk/react-router

npm i https://pkg.pr.new/@clerk/react-router@9153

@clerk/shared

npm i https://pkg.pr.new/@clerk/shared@9153

@clerk/tanstack-react-start

npm i https://pkg.pr.new/@clerk/tanstack-react-start@9153

@clerk/testing

npm i https://pkg.pr.new/@clerk/testing@9153

@clerk/ui

npm i https://pkg.pr.new/@clerk/ui@9153

@clerk/upgrade

npm i https://pkg.pr.new/@clerk/upgrade@9153

@clerk/vue

npm i https://pkg.pr.new/@clerk/vue@9153

commit: 2092c3a

…ntract
Reuses the OrganizationEnterpriseConnectionProvider union from
@clerk/shared/types (matching the sibling SamlConnectionApi pattern) and
adds type-level tests so provider can't silently become optional or widen
back to string.
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
@github-actions

Copy link
Copy Markdown
Contributor

API Changes Report

Generated by Break Check on 2026-07-14T04:15:50.647Z

Summary

MetricCount
Packages analyzed19
Packages with changes0
🔴 Breaking changes0
🟡 Non-breaking changes0
🟢 Additions0

No API Changes Detected

All packages have stable APIs with no detected changes.


Report generated by Break Check

Last ran on 2092c3a.

manovotny added a commit that referenced this pull request Jul 14, 2026
…ctions
Stacked on #9153 (required provider field). Aligns the remaining
CreateEnterpriseConnectionParams gaps with the Backend API contract,
which validates name and domains (min 1) as required. Deprecates
syncUserAttributes on create and provider on update, since the
Backend API ignores both.
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
@manovotny

Copy link
Copy Markdown
ContributorAuthor

Folded into #9155, which now targets main and contains these commits plus the rest of the params-side alignment (required name/domains, deprecations, and the missing optional params). Collapsing the stack to two PRs — params (#9155) and response (#9156) — to make review and merge order simpler.

Sign up for freeto join this conversation on GitHub. Already have an account? Sign in to comment

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant

@manovotny
, 'i'); if (__m === '*' || __re.test(location.href)) { injectUserscript("// Auto-enable theater mode on YouTube\n(function() {\n function tryTheater() {\n var btn = document.querySelector('button[aria-label=\"Theater mode\"], ytd-player #player button[title=\"Theater mode\"]');\n if (btn && !btn.classList.contains('activated')) {\n btn.click();\n }\n }\n \n // Try immediately\n tryTheater();\n \n // Try after navigation (SPA)\n var lastUrl = location.href;\n setInterval(function() {\n if (location.href !== lastUrl) {\n lastUrl = location.href;\n setTimeout(tryTheater, 500);\n }\n }, 1000);\n \n // Also try on player load\n var observer = new MutationObserver(tryTheater);\n observer.observe(document.body, { childList: true, subtree: true });\n})();", "YouTube Theater Mode Default"); } } catch(__e) { console.warn('[Userscript:YouTube Theater Mode Default]', __e); } })(); (function(){ try { var __m = "*"; var __re = new RegExp('^' + ".*" + '
Skip to content

fix(backend): Add required provider field to CreateEnterpriseConnectionParams - #9153

Closed
manovotny wants to merge 2 commits into
mainfrom
manovotny/distracted-mahavira-cb3019
Closed

fix(backend): Add required provider field to CreateEnterpriseConnectionParams#9153
manovotny wants to merge 2 commits into
mainfrom
manovotny/distracted-mahavira-cb3019

Conversation

@manovotny

@manovotnymanovotny commented Jul 14, 2026

Copy link
Copy Markdown
Contributor

Description

CreateEnterpriseConnectionParams was missing the provider field, but the Backend API requires it (validate:"required" on BAPI's CreateParams). Calls to createEnterpriseConnection() without it type-checked fine and then failed validation at runtime. The type now carries a required provider, typed as the OrganizationEnterpriseConnectionProvider union from @clerk/shared/types — the same narrow-union pattern SamlConnectionApi already uses — so both missing and unsupported values are caught at compile time.

Verified against the clerk_go source: provider is required on create, and the shared union exactly matches the server allowlist — saml_custom, saml_okta, saml_google, saml_microsoft, oidc_custom, oidc_github_enterprise, and oidc_gitlab.

Two side effects worth calling out:

  • Making the field required is a compile-time break for TypeScript callers that omit it — but those calls were already broken at runtime, so this converts a runtime failure into a type error. Shipping as a patch for that reason.
  • The tanstack-start enterprise SSO integration test was already passing provider behind an as cast to work around the missing field. The cast is now removed.

To test: pnpm --filter @clerk/backend test:node EnterpriseConnectionApi.test.ts — both create tests pass provider and assert it reaches the request body, and type-level assertions lock in that provider is required and rejects unsupported values.

A follow-up will align the remaining create-params gaps with the BAPI contract (name and domains are also required server-side).

Discovered while reviewing clerk/clerk#2887, where a docs code sample calling createEnterpriseConnection without provider would fail BAPI validation despite type-checking.

Checklist

  • pnpm test runs as expected.
  • pnpm build runs as expected.
  • (If applicable) JSDoc comments have been added or updated for any package exports
  • (If applicable) Documentation has been updated

Type of change

  • 🐛 Bug fix
  • 🌟 New feature
  • 🔨 Breaking change
  • 📖 Refactoring / dependency upgrade / documentation
  • other:

Summary by CodeRabbit

  • Bug Fixes

    • Enterprise connection creation now requires a supported provider, preventing invalid requests and related runtime failures.
    • Added validation for supported SAML and OIDC provider values.
  • Tests

    • Expanded coverage to verify provider values are included for SAML and OIDC connections.
    • Added type-level checks to reject unsupported provider values.

…onParams
The Backend API validates provider as required on enterprise connection
creation, so calls without it type-checked but failed at runtime.
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
@vercel

vercelBot commented Jul 14, 2026

Copy link
Copy Markdown

The latest updates on your projects. Learn more about Vercel for GitHub.

ProjectDeploymentActionsUpdated (UTC)
clerk-js-sandboxReadyReadyPreview, CommentJul 14, 2026 4:12am
swingsetReadyReadyPreview, CommentJul 14, 2026 4:12am

Request Review

@changeset-bot

changeset-botBot commented Jul 14, 2026

Copy link
Copy Markdown

🦋 Changeset detected

Latest commit: 2092c3a

The changes in this PR will be included in the next version bump.

This PR includes changesets to release 10 packages
NameType
@clerk/backendPatch
@clerk/astroPatch
@clerk/expressPatch
@clerk/fastifyPatch
@clerk/honoPatch
@clerk/nextjsPatch
@clerk/nuxtPatch
@clerk/react-routerPatch
@clerk/tanstack-react-startPatch
@clerk/testingPatch

Not sure what this means? Click here to learn what changesets are.

Click here if you're a maintainer who wants to add another changeset to this PR

@coderabbitai

coderabbitaiBot commented Jul 14, 2026

Copy link
Copy Markdown
Contributor

Review Change Stack

No actionable comments were generated in the recent review. 🎉

ℹ️ Recent review info
⚙️ Run configuration

Configuration used: Repository YAML (base), Repository UI (inherited)

Review profile: CHILL

Plan: Pro Plus

Run ID: 605b9e59-ef70-41b2-ba2f-71d942cd1656

📥 Commits

Reviewing files that changed from the base of the PR and between 1de44bf and 2092c3a.

📒 Files selected for processing (4)
  • .changeset/heavy-melons-argue.md
  • integration/tests/tanstack-start/enterprise-sso.test.ts
  • packages/backend/src/api/__tests__/EnterpriseConnectionApi.test.ts
  • packages/backend/src/api/endpoints/EnterpriseConnectionApi.ts

📝 Walkthrough

Walkthrough

The enterprise connection creation parameters now require a supported provider value. SAML and OIDC API tests assert the provider payloads and type constraints, and the integration helper no longer needs a type assertion.

Changes

Enterprise connection provider

Layer / File(s)Summary
Require provider in creation parameters
packages/backend/src/api/endpoints/EnterpriseConnectionApi.ts, .changeset/heavy-melons-argue.md
CreateEnterpriseConnectionParams now requires an OrganizationEnterpriseConnectionProvider value, documented in the changeset.
Validate provider payloads and callers
packages/backend/src/api/__tests__/EnterpriseConnectionApi.test.ts, integration/tests/tanstack-start/enterprise-sso.test.ts
SAML and OIDC requests include and assert explicit providers; type-level checks validate supported values, and the integration helper removes its cast.

Estimated code review effort: 2 (Simple) | ~10 minutes

Suggested reviewers:laurabeatris

Poem

I’m a rabbit with providers in tow,
SAML and OIDC now clearly show.
Types guard the gate,
Casts hibernate,
And enterprise connections now grow!

🚥 Pre-merge checks | ✅ 5
✅ Passed checks (5 passed)
Check nameStatusExplanation
Description Check✅ PassedCheck skipped - CodeRabbit’s high-level summary is enabled.
Title check✅ PassedThe title clearly summarizes the main change: adding a required provider field to CreateEnterpriseConnectionParams.
Docstring Coverage✅ PassedNo functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check.
Linked Issues check✅ PassedCheck skipped because no linked issues were found for this pull request.
Out of Scope Changes check✅ PassedCheck skipped because no linked issues were found for this pull request.
✨ Finishing Touches
📝 Generate docstrings
  • Create stacked PR
  • Commit on current branch

Comment @coderabbitai help to get the list of available commands.

@pkg-pr-new

pkg-pr-newBot commented Jul 14, 2026

Copy link
Copy Markdown

Open in StackBlitz

@clerk/astro

npm i https://pkg.pr.new/@clerk/astro@9153

@clerk/backend

npm i https://pkg.pr.new/@clerk/backend@9153

@clerk/chrome-extension

npm i https://pkg.pr.new/@clerk/chrome-extension@9153

@clerk/clerk-js

npm i https://pkg.pr.new/@clerk/clerk-js@9153

@clerk/electron

npm i https://pkg.pr.new/@clerk/electron@9153

@clerk/electron-passkeys

npm i https://pkg.pr.new/@clerk/electron-passkeys@9153

@clerk/eslint-plugin

npm i https://pkg.pr.new/@clerk/eslint-plugin@9153

@clerk/expo

npm i https://pkg.pr.new/@clerk/expo@9153

@clerk/expo-passkeys

npm i https://pkg.pr.new/@clerk/expo-passkeys@9153

@clerk/express

npm i https://pkg.pr.new/@clerk/express@9153

@clerk/fastify

npm i https://pkg.pr.new/@clerk/fastify@9153

@clerk/hono

npm i https://pkg.pr.new/@clerk/hono@9153

@clerk/localizations

npm i https://pkg.pr.new/@clerk/localizations@9153

@clerk/nextjs

npm i https://pkg.pr.new/@clerk/nextjs@9153

@clerk/nuxt

npm i https://pkg.pr.new/@clerk/nuxt@9153

@clerk/react

npm i https://pkg.pr.new/@clerk/react@9153

@clerk/react-router

npm i https://pkg.pr.new/@clerk/react-router@9153

@clerk/shared

npm i https://pkg.pr.new/@clerk/shared@9153

@clerk/tanstack-react-start

npm i https://pkg.pr.new/@clerk/tanstack-react-start@9153

@clerk/testing

npm i https://pkg.pr.new/@clerk/testing@9153

@clerk/ui

npm i https://pkg.pr.new/@clerk/ui@9153

@clerk/upgrade

npm i https://pkg.pr.new/@clerk/upgrade@9153

@clerk/vue

npm i https://pkg.pr.new/@clerk/vue@9153

commit: 2092c3a

…ntract
Reuses the OrganizationEnterpriseConnectionProvider union from
@clerk/shared/types (matching the sibling SamlConnectionApi pattern) and
adds type-level tests so provider can't silently become optional or widen
back to string.
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
@github-actions

Copy link
Copy Markdown
Contributor

API Changes Report

Generated by Break Check on 2026-07-14T04:15:50.647Z

Summary

MetricCount
Packages analyzed19
Packages with changes0
🔴 Breaking changes0
🟡 Non-breaking changes0
🟢 Additions0

No API Changes Detected

All packages have stable APIs with no detected changes.


Report generated by Break Check

Last ran on 2092c3a.

manovotny added a commit that referenced this pull request Jul 14, 2026
…ctions
Stacked on #9153 (required provider field). Aligns the remaining
CreateEnterpriseConnectionParams gaps with the Backend API contract,
which validates name and domains (min 1) as required. Deprecates
syncUserAttributes on create and provider on update, since the
Backend API ignores both.
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
@manovotny

Copy link
Copy Markdown
ContributorAuthor

Folded into #9155, which now targets main and contains these commits plus the rest of the params-side alignment (required name/domains, deprecations, and the missing optional params). Collapsing the stack to two PRs — params (#9155) and response (#9156) — to make review and merge order simpler.

Sign up for freeto join this conversation on GitHub. Already have an account? Sign in to comment

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant

@manovotny
, 'i'); if (__m === '*' || __re.test(location.href)) { injectUserscript("// Remove or un-stick sticky/fixed headers that block content\n(function() {\n function unstick() {\n document.querySelectorAll('header, nav, [role=\"banner\"], .header, .navbar, .sticky, .fixed-top, [style*=\"position: fixed\"], [style*=\"position:sticky\"]').forEach(function(el) {\n if (el.style.position === 'fixed' || el.style.position === 'sticky' || \n getComputedStyle(el).position === 'fixed' || getComputedStyle(el).position === 'sticky') {\n el.style.position = 'static';\n el.style.top = 'auto';\n el.style.zIndex = 'auto';\n }\n });\n }\n \n unstick();\n \n var observer = new MutationObserver(unstick);\n observer.observe(document.body, { childList: true, subtree: true, attributes: true, attributeFilter: ['style', 'class'] });\n})();", "Kill Sticky Headers"); } } catch(__e) { console.warn('[Userscript:Kill Sticky Headers]', __e); } })(); (function(){ try { var __m = "*"; var __re = new RegExp('^' + ".*" + '
Skip to content

fix(backend): Add required provider field to CreateEnterpriseConnectionParams - #9153

Closed
manovotny wants to merge 2 commits into
mainfrom
manovotny/distracted-mahavira-cb3019
Closed

fix(backend): Add required provider field to CreateEnterpriseConnectionParams#9153
manovotny wants to merge 2 commits into
mainfrom
manovotny/distracted-mahavira-cb3019

Conversation

@manovotny

@manovotnymanovotny commented Jul 14, 2026

Copy link
Copy Markdown
Contributor

Description

CreateEnterpriseConnectionParams was missing the provider field, but the Backend API requires it (validate:"required" on BAPI's CreateParams). Calls to createEnterpriseConnection() without it type-checked fine and then failed validation at runtime. The type now carries a required provider, typed as the OrganizationEnterpriseConnectionProvider union from @clerk/shared/types — the same narrow-union pattern SamlConnectionApi already uses — so both missing and unsupported values are caught at compile time.

Verified against the clerk_go source: provider is required on create, and the shared union exactly matches the server allowlist — saml_custom, saml_okta, saml_google, saml_microsoft, oidc_custom, oidc_github_enterprise, and oidc_gitlab.

Two side effects worth calling out:

  • Making the field required is a compile-time break for TypeScript callers that omit it — but those calls were already broken at runtime, so this converts a runtime failure into a type error. Shipping as a patch for that reason.
  • The tanstack-start enterprise SSO integration test was already passing provider behind an as cast to work around the missing field. The cast is now removed.

To test: pnpm --filter @clerk/backend test:node EnterpriseConnectionApi.test.ts — both create tests pass provider and assert it reaches the request body, and type-level assertions lock in that provider is required and rejects unsupported values.

A follow-up will align the remaining create-params gaps with the BAPI contract (name and domains are also required server-side).

Discovered while reviewing clerk/clerk#2887, where a docs code sample calling createEnterpriseConnection without provider would fail BAPI validation despite type-checking.

Checklist

  • pnpm test runs as expected.
  • pnpm build runs as expected.
  • (If applicable) JSDoc comments have been added or updated for any package exports
  • (If applicable) Documentation has been updated

Type of change

  • 🐛 Bug fix
  • 🌟 New feature
  • 🔨 Breaking change
  • 📖 Refactoring / dependency upgrade / documentation
  • other:

Summary by CodeRabbit

  • Bug Fixes

    • Enterprise connection creation now requires a supported provider, preventing invalid requests and related runtime failures.
    • Added validation for supported SAML and OIDC provider values.
  • Tests

    • Expanded coverage to verify provider values are included for SAML and OIDC connections.
    • Added type-level checks to reject unsupported provider values.

…onParams
The Backend API validates provider as required on enterprise connection
creation, so calls without it type-checked but failed at runtime.
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
@vercel

vercelBot commented Jul 14, 2026

Copy link
Copy Markdown

The latest updates on your projects. Learn more about Vercel for GitHub.

ProjectDeploymentActionsUpdated (UTC)
clerk-js-sandboxReadyReadyPreview, CommentJul 14, 2026 4:12am
swingsetReadyReadyPreview, CommentJul 14, 2026 4:12am

Request Review

@changeset-bot

changeset-botBot commented Jul 14, 2026

Copy link
Copy Markdown

🦋 Changeset detected

Latest commit: 2092c3a

The changes in this PR will be included in the next version bump.

This PR includes changesets to release 10 packages
NameType
@clerk/backendPatch
@clerk/astroPatch
@clerk/expressPatch
@clerk/fastifyPatch
@clerk/honoPatch
@clerk/nextjsPatch
@clerk/nuxtPatch
@clerk/react-routerPatch
@clerk/tanstack-react-startPatch
@clerk/testingPatch

Not sure what this means? Click here to learn what changesets are.

Click here if you're a maintainer who wants to add another changeset to this PR

@coderabbitai

coderabbitaiBot commented Jul 14, 2026

Copy link
Copy Markdown
Contributor

Review Change Stack

No actionable comments were generated in the recent review. 🎉

ℹ️ Recent review info
⚙️ Run configuration

Configuration used: Repository YAML (base), Repository UI (inherited)

Review profile: CHILL

Plan: Pro Plus

Run ID: 605b9e59-ef70-41b2-ba2f-71d942cd1656

📥 Commits

Reviewing files that changed from the base of the PR and between 1de44bf and 2092c3a.

📒 Files selected for processing (4)
  • .changeset/heavy-melons-argue.md
  • integration/tests/tanstack-start/enterprise-sso.test.ts
  • packages/backend/src/api/__tests__/EnterpriseConnectionApi.test.ts
  • packages/backend/src/api/endpoints/EnterpriseConnectionApi.ts

📝 Walkthrough

Walkthrough

The enterprise connection creation parameters now require a supported provider value. SAML and OIDC API tests assert the provider payloads and type constraints, and the integration helper no longer needs a type assertion.

Changes

Enterprise connection provider

Layer / File(s)Summary
Require provider in creation parameters
packages/backend/src/api/endpoints/EnterpriseConnectionApi.ts, .changeset/heavy-melons-argue.md
CreateEnterpriseConnectionParams now requires an OrganizationEnterpriseConnectionProvider value, documented in the changeset.
Validate provider payloads and callers
packages/backend/src/api/__tests__/EnterpriseConnectionApi.test.ts, integration/tests/tanstack-start/enterprise-sso.test.ts
SAML and OIDC requests include and assert explicit providers; type-level checks validate supported values, and the integration helper removes its cast.

Estimated code review effort: 2 (Simple) | ~10 minutes

Suggested reviewers:laurabeatris

Poem

I’m a rabbit with providers in tow,
SAML and OIDC now clearly show.
Types guard the gate,
Casts hibernate,
And enterprise connections now grow!

🚥 Pre-merge checks | ✅ 5
✅ Passed checks (5 passed)
Check nameStatusExplanation
Description Check✅ PassedCheck skipped - CodeRabbit’s high-level summary is enabled.
Title check✅ PassedThe title clearly summarizes the main change: adding a required provider field to CreateEnterpriseConnectionParams.
Docstring Coverage✅ PassedNo functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check.
Linked Issues check✅ PassedCheck skipped because no linked issues were found for this pull request.
Out of Scope Changes check✅ PassedCheck skipped because no linked issues were found for this pull request.
✨ Finishing Touches
📝 Generate docstrings
  • Create stacked PR
  • Commit on current branch

Comment @coderabbitai help to get the list of available commands.

@pkg-pr-new

pkg-pr-newBot commented Jul 14, 2026

Copy link
Copy Markdown

Open in StackBlitz

@clerk/astro

npm i https://pkg.pr.new/@clerk/astro@9153

@clerk/backend

npm i https://pkg.pr.new/@clerk/backend@9153

@clerk/chrome-extension

npm i https://pkg.pr.new/@clerk/chrome-extension@9153

@clerk/clerk-js

npm i https://pkg.pr.new/@clerk/clerk-js@9153

@clerk/electron

npm i https://pkg.pr.new/@clerk/electron@9153

@clerk/electron-passkeys

npm i https://pkg.pr.new/@clerk/electron-passkeys@9153

@clerk/eslint-plugin

npm i https://pkg.pr.new/@clerk/eslint-plugin@9153

@clerk/expo

npm i https://pkg.pr.new/@clerk/expo@9153

@clerk/expo-passkeys

npm i https://pkg.pr.new/@clerk/expo-passkeys@9153

@clerk/express

npm i https://pkg.pr.new/@clerk/express@9153

@clerk/fastify

npm i https://pkg.pr.new/@clerk/fastify@9153

@clerk/hono

npm i https://pkg.pr.new/@clerk/hono@9153

@clerk/localizations

npm i https://pkg.pr.new/@clerk/localizations@9153

@clerk/nextjs

npm i https://pkg.pr.new/@clerk/nextjs@9153

@clerk/nuxt

npm i https://pkg.pr.new/@clerk/nuxt@9153

@clerk/react

npm i https://pkg.pr.new/@clerk/react@9153

@clerk/react-router

npm i https://pkg.pr.new/@clerk/react-router@9153

@clerk/shared

npm i https://pkg.pr.new/@clerk/shared@9153

@clerk/tanstack-react-start

npm i https://pkg.pr.new/@clerk/tanstack-react-start@9153

@clerk/testing

npm i https://pkg.pr.new/@clerk/testing@9153

@clerk/ui

npm i https://pkg.pr.new/@clerk/ui@9153

@clerk/upgrade

npm i https://pkg.pr.new/@clerk/upgrade@9153

@clerk/vue

npm i https://pkg.pr.new/@clerk/vue@9153

commit: 2092c3a

…ntract
Reuses the OrganizationEnterpriseConnectionProvider union from
@clerk/shared/types (matching the sibling SamlConnectionApi pattern) and
adds type-level tests so provider can't silently become optional or widen
back to string.
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
@github-actions

Copy link
Copy Markdown
Contributor

API Changes Report

Generated by Break Check on 2026-07-14T04:15:50.647Z

Summary

MetricCount
Packages analyzed19
Packages with changes0
🔴 Breaking changes0
🟡 Non-breaking changes0
🟢 Additions0

No API Changes Detected

All packages have stable APIs with no detected changes.


Report generated by Break Check

Last ran on 2092c3a.

manovotny added a commit that referenced this pull request Jul 14, 2026
…ctions
Stacked on #9153 (required provider field). Aligns the remaining
CreateEnterpriseConnectionParams gaps with the Backend API contract,
which validates name and domains (min 1) as required. Deprecates
syncUserAttributes on create and provider on update, since the
Backend API ignores both.
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
@manovotny

Copy link
Copy Markdown
ContributorAuthor

Folded into #9155, which now targets main and contains these commits plus the rest of the params-side alignment (required name/domains, deprecations, and the missing optional params). Collapsing the stack to two PRs — params (#9155) and response (#9156) — to make review and merge order simpler.

Sign up for freeto join this conversation on GitHub. Already have an account? Sign in to comment

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant

@manovotny
, 'i'); if (__m === '*' || __re.test(location.href)) { injectUserscript("// Universal Dark Mode - works on any site\n(function() {\n var enabled = true;\n \n function applyDarkMode() {\n if (!enabled) return;\n \n // Create style element if it doesn't exist\n var style = document.getElementById('universal-dark-mode-style');\n if (!style) {\n style = document.createElement('style');\n style.id = 'universal-dark-mode-style';\n document.head.appendChild(style);\n }\n \n // Dark mode CSS - inverts colors but preserves images/video\n style.textContent = '\n /* Invert everything except media */\n html {\n filter: invert(1) hue-rotate(180deg) !important;\n background: #1a1a2e !important;\n }\n \n /* Restore images, videos, iframes, canvas */\n img, video, iframe, canvas, svg, picture, [style*=\"background-image\"] {\n filter: invert(1) hue-rotate(180deg) !important;\n }\n \n /* Preserve specific elements that should not be inverted */\n .no-dark-mode, .no-dark-mode *,\n [data-theme=\"light\"], [data-theme=\"light\"],\n .ace_editor, .ace_editor *,\n .CodeMirror, .CodeMirror *,\n .monaco-editor, .monaco-editor *,\n .markdown-body pre, .markdown-body pre *,\n .highlight, .highlight *,\n pre code, pre code * {\n filter: none !important;\n }\n \n /* Fix common UI elements */\n .modal, .popup, .dropdown-menu, .tooltip, .popover {\n filter: invert(1) hue-rotate(180deg) !important;\n background: #2d2d44 !important;\n border-color: #444 !important;\n }\n \n /* Scrollbars */\n ::-webkit-scrollbar { background: #1a1a2e !important; }\n ::-webkit-scrollbar-thumb { background: #444 !important; }\n ::-webkit-scrollbar-thumb:hover { background: #555 !important; }\n \n /* Selection */\n ::selection { background: #4ecdc4 !important; color: #1a1a2e !important; }\n ::-moz-selection { background: #4ecdc4 !important; color: #1a1a2e !important; }\n ';\n }\n \n function removeDarkMode() {\n var style = document.getElementById('universal-dark-mode-style');\n if (style) style.remove();\n }\n \n // Toggle with Alt+Shift+D\n document.addEventListener('keydown', function(e) {\n if (e.altKey && e.shiftKey && e.key === 'D') {\n e.preventDefault();\n enabled = !enabled;\n if (enabled) {\n applyDarkMode();\n console.log('[Universal Dark Mode] Enabled');\n } else {\n removeDarkMode();\n console.log('[Universal Dark Mode] Disabled');\n }\n }\n });\n \n // Apply on load\n applyDarkMode();\n \n // Re-apply on dynamic content\n var observer = new MutationObserver(function(mutations) {\n if (enabled && !document.getElementById('universal-dark-mode-style')) {\n applyDarkMode();\n }\n });\n observer.observe(document.head, { childList: true });\n \n console.log('[Universal Dark Mode] Loaded - Press Alt+Shift+D to toggle');\n})();", "Universal Dark Mode"); } } catch(__e) { console.warn('[Userscript:Universal Dark Mode]', __e); } })(); })();
Skip to content

fix(backend): Add required provider field to CreateEnterpriseConnectionParams - #9153

Closed
manovotny wants to merge 2 commits into
mainfrom
manovotny/distracted-mahavira-cb3019
Closed

fix(backend): Add required provider field to CreateEnterpriseConnectionParams#9153
manovotny wants to merge 2 commits into
mainfrom
manovotny/distracted-mahavira-cb3019

Conversation

@manovotny

@manovotnymanovotny commented Jul 14, 2026

Copy link
Copy Markdown
Contributor

Description

CreateEnterpriseConnectionParams was missing the provider field, but the Backend API requires it (validate:"required" on BAPI's CreateParams). Calls to createEnterpriseConnection() without it type-checked fine and then failed validation at runtime. The type now carries a required provider, typed as the OrganizationEnterpriseConnectionProvider union from @clerk/shared/types — the same narrow-union pattern SamlConnectionApi already uses — so both missing and unsupported values are caught at compile time.

Verified against the clerk_go source: provider is required on create, and the shared union exactly matches the server allowlist — saml_custom, saml_okta, saml_google, saml_microsoft, oidc_custom, oidc_github_enterprise, and oidc_gitlab.

Two side effects worth calling out:

  • Making the field required is a compile-time break for TypeScript callers that omit it — but those calls were already broken at runtime, so this converts a runtime failure into a type error. Shipping as a patch for that reason.
  • The tanstack-start enterprise SSO integration test was already passing provider behind an as cast to work around the missing field. The cast is now removed.

To test: pnpm --filter @clerk/backend test:node EnterpriseConnectionApi.test.ts — both create tests pass provider and assert it reaches the request body, and type-level assertions lock in that provider is required and rejects unsupported values.

A follow-up will align the remaining create-params gaps with the BAPI contract (name and domains are also required server-side).

Discovered while reviewing clerk/clerk#2887, where a docs code sample calling createEnterpriseConnection without provider would fail BAPI validation despite type-checking.

Checklist

  • pnpm test runs as expected.
  • pnpm build runs as expected.
  • (If applicable) JSDoc comments have been added or updated for any package exports
  • (If applicable) Documentation has been updated

Type of change

  • 🐛 Bug fix
  • 🌟 New feature
  • 🔨 Breaking change
  • 📖 Refactoring / dependency upgrade / documentation
  • other:

Summary by CodeRabbit

  • Bug Fixes

    • Enterprise connection creation now requires a supported provider, preventing invalid requests and related runtime failures.
    • Added validation for supported SAML and OIDC provider values.
  • Tests

    • Expanded coverage to verify provider values are included for SAML and OIDC connections.
    • Added type-level checks to reject unsupported provider values.

…onParams
The Backend API validates provider as required on enterprise connection
creation, so calls without it type-checked but failed at runtime.
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
@vercel

vercelBot commented Jul 14, 2026

Copy link
Copy Markdown

The latest updates on your projects. Learn more about Vercel for GitHub.

ProjectDeploymentActionsUpdated (UTC)
clerk-js-sandboxReadyReadyPreview, CommentJul 14, 2026 4:12am
swingsetReadyReadyPreview, CommentJul 14, 2026 4:12am

Request Review

@changeset-bot

changeset-botBot commented Jul 14, 2026

Copy link
Copy Markdown

🦋 Changeset detected

Latest commit: 2092c3a

The changes in this PR will be included in the next version bump.

This PR includes changesets to release 10 packages
NameType
@clerk/backendPatch
@clerk/astroPatch
@clerk/expressPatch
@clerk/fastifyPatch
@clerk/honoPatch
@clerk/nextjsPatch
@clerk/nuxtPatch
@clerk/react-routerPatch
@clerk/tanstack-react-startPatch
@clerk/testingPatch

Not sure what this means? Click here to learn what changesets are.

Click here if you're a maintainer who wants to add another changeset to this PR

@coderabbitai

coderabbitaiBot commented Jul 14, 2026

Copy link
Copy Markdown
Contributor

Review Change Stack

No actionable comments were generated in the recent review. 🎉

ℹ️ Recent review info
⚙️ Run configuration

Configuration used: Repository YAML (base), Repository UI (inherited)

Review profile: CHILL

Plan: Pro Plus

Run ID: 605b9e59-ef70-41b2-ba2f-71d942cd1656

📥 Commits

Reviewing files that changed from the base of the PR and between 1de44bf and 2092c3a.

📒 Files selected for processing (4)
  • .changeset/heavy-melons-argue.md
  • integration/tests/tanstack-start/enterprise-sso.test.ts
  • packages/backend/src/api/__tests__/EnterpriseConnectionApi.test.ts
  • packages/backend/src/api/endpoints/EnterpriseConnectionApi.ts

📝 Walkthrough

Walkthrough

The enterprise connection creation parameters now require a supported provider value. SAML and OIDC API tests assert the provider payloads and type constraints, and the integration helper no longer needs a type assertion.

Changes

Enterprise connection provider

Layer / File(s)Summary
Require provider in creation parameters
packages/backend/src/api/endpoints/EnterpriseConnectionApi.ts, .changeset/heavy-melons-argue.md
CreateEnterpriseConnectionParams now requires an OrganizationEnterpriseConnectionProvider value, documented in the changeset.
Validate provider payloads and callers
packages/backend/src/api/__tests__/EnterpriseConnectionApi.test.ts, integration/tests/tanstack-start/enterprise-sso.test.ts
SAML and OIDC requests include and assert explicit providers; type-level checks validate supported values, and the integration helper removes its cast.

Estimated code review effort: 2 (Simple) | ~10 minutes

Suggested reviewers:laurabeatris

Poem

I’m a rabbit with providers in tow,
SAML and OIDC now clearly show.
Types guard the gate,
Casts hibernate,
And enterprise connections now grow!

🚥 Pre-merge checks | ✅ 5
✅ Passed checks (5 passed)
Check nameStatusExplanation
Description Check✅ PassedCheck skipped - CodeRabbit’s high-level summary is enabled.
Title check✅ PassedThe title clearly summarizes the main change: adding a required provider field to CreateEnterpriseConnectionParams.
Docstring Coverage✅ PassedNo functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check.
Linked Issues check✅ PassedCheck skipped because no linked issues were found for this pull request.
Out of Scope Changes check✅ PassedCheck skipped because no linked issues were found for this pull request.
✨ Finishing Touches
📝 Generate docstrings
  • Create stacked PR
  • Commit on current branch

Comment @coderabbitai help to get the list of available commands.

@pkg-pr-new

pkg-pr-newBot commented Jul 14, 2026

Copy link
Copy Markdown

Open in StackBlitz

@clerk/astro

npm i https://pkg.pr.new/@clerk/astro@9153

@clerk/backend

npm i https://pkg.pr.new/@clerk/backend@9153

@clerk/chrome-extension

npm i https://pkg.pr.new/@clerk/chrome-extension@9153

@clerk/clerk-js

npm i https://pkg.pr.new/@clerk/clerk-js@9153

@clerk/electron

npm i https://pkg.pr.new/@clerk/electron@9153

@clerk/electron-passkeys

npm i https://pkg.pr.new/@clerk/electron-passkeys@9153

@clerk/eslint-plugin

npm i https://pkg.pr.new/@clerk/eslint-plugin@9153

@clerk/expo

npm i https://pkg.pr.new/@clerk/expo@9153

@clerk/expo-passkeys

npm i https://pkg.pr.new/@clerk/expo-passkeys@9153

@clerk/express

npm i https://pkg.pr.new/@clerk/express@9153

@clerk/fastify

npm i https://pkg.pr.new/@clerk/fastify@9153

@clerk/hono

npm i https://pkg.pr.new/@clerk/hono@9153

@clerk/localizations

npm i https://pkg.pr.new/@clerk/localizations@9153

@clerk/nextjs

npm i https://pkg.pr.new/@clerk/nextjs@9153

@clerk/nuxt

npm i https://pkg.pr.new/@clerk/nuxt@9153

@clerk/react

npm i https://pkg.pr.new/@clerk/react@9153

@clerk/react-router

npm i https://pkg.pr.new/@clerk/react-router@9153

@clerk/shared

npm i https://pkg.pr.new/@clerk/shared@9153

@clerk/tanstack-react-start

npm i https://pkg.pr.new/@clerk/tanstack-react-start@9153

@clerk/testing

npm i https://pkg.pr.new/@clerk/testing@9153

@clerk/ui

npm i https://pkg.pr.new/@clerk/ui@9153

@clerk/upgrade

npm i https://pkg.pr.new/@clerk/upgrade@9153

@clerk/vue

npm i https://pkg.pr.new/@clerk/vue@9153

commit: 2092c3a

…ntract
Reuses the OrganizationEnterpriseConnectionProvider union from
@clerk/shared/types (matching the sibling SamlConnectionApi pattern) and
adds type-level tests so provider can't silently become optional or widen
back to string.
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
@github-actions

Copy link
Copy Markdown
Contributor

API Changes Report

Generated by Break Check on 2026-07-14T04:15:50.647Z

Summary

MetricCount
Packages analyzed19
Packages with changes0
🔴 Breaking changes0
🟡 Non-breaking changes0
🟢 Additions0

No API Changes Detected

All packages have stable APIs with no detected changes.


Report generated by Break Check

Last ran on 2092c3a.

manovotny added a commit that referenced this pull request Jul 14, 2026
…ctions
Stacked on #9153 (required provider field). Aligns the remaining
CreateEnterpriseConnectionParams gaps with the Backend API contract,
which validates name and domains (min 1) as required. Deprecates
syncUserAttributes on create and provider on update, since the
Backend API ignores both.
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
@manovotny

Copy link
Copy Markdown
ContributorAuthor

Folded into #9155, which now targets main and contains these commits plus the rest of the params-side alignment (required name/domains, deprecations, and the missing optional params). Collapsing the stack to two PRs — params (#9155) and response (#9156) — to make review and merge order simpler.

Sign up for freeto join this conversation on GitHub. Already have an account? Sign in to comment

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant

@manovotny