fix(clerk-js,react,shared,ui): resume an OAuth transfer after a verification challenge

.changeset/resume-oauth-transfer-after-protect-check.md

@@ -0,0 +1,8 @@
+---
+'@clerk/clerk-js': minor
+'@clerk/react': patch
+'@clerk/shared': minor
+'@clerk/ui': patch
+---
+
+Fixes an issue where OAuth account transfers that needed additional verification were returned to the beginning of sign-in.

packages/clerk-js/src/core/__tests__/clerk.test.ts

@@ -1850,6 +1850,220 @@ describe('Clerk singleton', () => {
  expect(mockNavigate).not.toHaveBeenCalled();
  });
 
+ describe('__internal_resumeAfterProtectCheck', () => {
+ // A verification challenge can interrupt an OAuth callback partway through routing. The
+ // challenge card clears it and hands control back here, from a page that is no longer
+ // the callback route, so the remaining routing has to run rather than start over.
+
+ const gatedTransferableSignIn = (extra: Record<string, unknown> = {}) =>
+ new SignIn({
+ status: 'needs_identifier',
+ first_factor_verification: {
+ status: 'transferable',
+ strategy: 'oauth_google',
+ external_verification_redirect_url: '',
+ error: {
+ code: 'external_account_not_found',
+ long_message: 'The External Account was not found.',
+ message: 'Invalid external account',
+ },
+ },
+ second_factor_verification: null,
+ identifier: '',
+ user_data: null,
+ created_session_id: null,
+ created_user_id: null,
+ ...extra,
+ } as any as SignInJSON);
+
+ const loadEnvironment = () =>
+ mockEnvironmentFetch.mockReturnValue(
+ Promise.resolve({
+ authConfig: {},
+ userSettings: mockUserSettings,
+ displayConfig: mockDisplayConfig,
+ isSingleSession: () => false,
+ isProduction: () => false,
+ isDevelopmentOrStaging: () => true,
+ onWindowLocationHost: () => false,
+ }),
+ );
+
+ it('completes the transfer as a SIGN-UP and activates the created session', async () => {
+ loadEnvironment();
+ mockClientFetch.mockReturnValue(
+ Promise.resolve({
+ signedInSessions: [],
+ signIn: gatedTransferableSignIn(),
+ signUp: new SignUp(null),
+ }),
+ );
+
+ const mockSetActive = vi.fn();
+ const mockSignUpCreate = vi
+ .fn()
+ .mockReturnValue(Promise.resolve({ status: 'complete', createdSessionId: '123' }));
+
+ const sut = new Clerk(productionPublishableKey);
+ await sut.load(mockedLoadOptions);
+ if (!sut.client) {
+ fail('we should always have a client');
+ }
+ sut.client.signUp.create = mockSignUpCreate;
+ sut.setActive = mockSetActive;
+
+ await sut.__internal_resumeAfterProtectCheck({ continuation: 'transfer_to_sign_up' });
+
+ await waitFor(() => {
+ expect(mockSignUpCreate).toHaveBeenCalledTimes(1);
+ expect(mockSignUpCreate).toHaveBeenCalledWith({ transfer: true, unsafeMetadata: undefined });
+ expect(mockSetActive).toHaveBeenCalledWith(expect.objectContaining({ session: '123' }));
+ });
+ });
+
+ it('completes the transfer even when the cleared response dropped the transferable marker', async () => {
+ // `SignIn.fromJSON` replaces `firstFactorVerification` wholesale on every write, so the
+ // caller latches the continuation before running the challenge and passes it explicitly.
+ // Re-reading it here would silently fall back to returning the user to sign-in.
+ loadEnvironment();
+ mockClientFetch.mockReturnValue(
+ Promise.resolve({
+ signedInSessions: [],
+ signIn: new SignIn({
+ status: 'needs_identifier',
+ first_factor_verification: null,
+ second_factor_verification: null,
+ identifier: '',
+ user_data: null,
+ created_session_id: null,
+ created_user_id: null,
+ } as any as SignInJSON),
+ signUp: new SignUp(null),
+ }),
+ );
+
+ const mockSignUpCreate = vi
+ .fn()
+ .mockReturnValue(Promise.resolve({ status: 'complete', createdSessionId: '123' }));
+
+ const sut = new Clerk(productionPublishableKey);
+ await sut.load(mockedLoadOptions);
+ if (!sut.client) {
+ fail('we should always have a client');
+ }
+ sut.client.signUp.create = mockSignUpCreate;
+ sut.setActive = vi.fn();
+
+ await sut.__internal_resumeAfterProtectCheck({ continuation: 'transfer_to_sign_up' });
+
+ await waitFor(() =>
+ expect(mockSignUpCreate).toHaveBeenCalledWith({ transfer: true, unsafeMetadata: undefined }),
+ );
+ });
+
+ it('does not divert to the sign-up card when a stale gate is on the sign-up resource', async () => {
+ // The sign-in variant below covers the first short-circuit; `resuming` skips a second one
+ // keyed on the SIGN-UP resource, and that is the arm that sends the user to a different
+ // card entirely rather than back to this one.
+ loadEnvironment();
+ mockClientFetch.mockReturnValue(
+ Promise.resolve({
+ signedInSessions: [],
+ signIn: gatedTransferableSignIn(),
+ signUp: new SignUp({
+ protect_check: { status: 'pending', token: 'stale-signup-token', sdk_url: 'https://example.com/sdk.js' },
+ } as any),
+ }),
+ );
+
+ const mockSignUpCreate = vi
+ .fn()
+ .mockReturnValue(Promise.resolve({ status: 'complete', createdSessionId: '123' }));
+
+ const sut = new Clerk(productionPublishableKey);
+ await sut.load(mockedLoadOptions);
+ if (!sut.client) {
+ fail('we should always have a client');
+ }
+ sut.client.signUp.create = mockSignUpCreate;
+ sut.setActive = vi.fn();
+
+ await sut.__internal_resumeAfterProtectCheck({ continuation: 'transfer_to_sign_up' });
+
+ await waitFor(() =>
+ expect(mockSignUpCreate).toHaveBeenCalledWith({ transfer: true, unsafeMetadata: undefined }),
+ );
+ expect(mockNavigate.mock.calls.some(([to]) => typeof to === 'string' && to.includes('protect-check'))).toBe(
+ false,
+ );
+ });
+
+ it('does not bounce back into the challenge when a stale gate is still on the resource', async () => {
+ // This is the test that proves `resuming` is load-bearing rather than decorative. The
+ // caller IS the challenge card; re-checking the gate here would hand control straight
+ // back to it, or — through the sign-up arm — to the wrong card entirely.
+ loadEnvironment();
+ mockClientFetch.mockReturnValue(
+ Promise.resolve({
+ signedInSessions: [],
+ signIn: gatedTransferableSignIn({
+ protect_check: { status: 'pending', token: 'stale-token', sdk_url: 'https://example.com/sdk.js' },
+ }),
+ signUp: new SignUp(null),
+ }),
+ );
+
+ const mockSignUpCreate = vi
+ .fn()
+ .mockReturnValue(Promise.resolve({ status: 'complete', createdSessionId: '123' }));
+
+ const sut = new Clerk(productionPublishableKey);
+ await sut.load(mockedLoadOptions);
+ if (!sut.client) {
+ fail('we should always have a client');
+ }
+ sut.client.signUp.create = mockSignUpCreate;
+ sut.setActive = vi.fn();
+
+ await sut.__internal_resumeAfterProtectCheck({ continuation: 'transfer_to_sign_up' });
+
+ await waitFor(() =>
+ expect(mockSignUpCreate).toHaveBeenCalledWith({ transfer: true, unsafeMetadata: undefined }),
+ );
+ expect(mockNavigate.mock.calls.some(([to]) => typeof to === 'string' && to.includes('protect-check'))).toBe(
+ false,
+ );
+ });
+
+ it('still honours transferable: false', async () => {
+ loadEnvironment();
+ mockClientFetch.mockReturnValue(
+ Promise.resolve({
+ signedInSessions: [],
+ signIn: gatedTransferableSignIn(),
+ signUp: new SignUp(null),
+ }),
+ );
+
+ const mockSignUpCreate = vi.fn();
+
+ const sut = new Clerk(productionPublishableKey);
+ await sut.load(mockedLoadOptions);
+ if (!sut.client) {
+ fail('we should always have a client');
+ }
+ sut.client.signUp.create = mockSignUpCreate;
+ sut.setActive = vi.fn();
+
+ await sut.__internal_resumeAfterProtectCheck({
+ continuation: 'transfer_to_sign_up',
+ transferable: false,
+ });
+
+ await waitFor(() => expect(mockSignUpCreate).not.toHaveBeenCalled());
+ });
+ });
+
  it('does not initiate the transfer flow when transferable: false is passed', async () => {
  mockEnvironmentFetch.mockReturnValue(
  Promise.resolve({

packages/clerk-js/src/core/clerk.ts

@@ -112,6 +112,7 @@ import type {
  PublicKeyCredentialWithAuthenticatorAttestationResponse,
  RedirectOptions,
  Resources,
+ ResumeAfterProtectCheckParams,
  SDKMetadata,
  SessionResource,
  SessionTouchParams,
@@ -2450,15 +2451,17 @@ export class Clerk implements ClerkInterface {
  };
 
  private _handleRedirectCallback = async (
- params: HandleOAuthCallbackParams,
+ params: ResumeAfterProtectCheckParams,
  {
  signIn,
  signUp,
  navigate,
+ resuming = false,
  }: {
  signIn: SignInResource;
  signUp: SignUpResource;
  navigate: (to: string) => Promise<unknown>;
+ resuming?: boolean;
  },
  ): Promise<unknown> => {
  if (!this.loaded || !this.environment || !this.client) {
@@ -2602,14 +2605,14 @@ export class Clerk implements ClerkInterface {
  // sign-in's challenge. We only consult `si` here unless this is explicitly a sign-up callback.
  // Transfers are unaffected: the `signIn.create({ transfer })` path below checks its own fresh
  // response for the gate.
- if (params.reloadResource !== 'signUp' && (si.protectCheck || si.status === 'needs_protect_check')) {
+ if (!resuming && params.reloadResource !== 'signUp' && (si.protectCheck || si.status === 'needs_protect_check')) {
  return navigateToSignInProtectCheck();
  }
 
  // The sign-up resource can be gated the same way (e.g. a callback that resolves straight into a
  // gated sign-up). Scope to the sign-up intent for the symmetric reason — a stale sign-up's gate
  // shouldn't hijack a sign-in callback.
- if (params.reloadResource !== 'signIn' && su.protectCheck) {
+ if (!resuming && params.reloadResource !== 'signIn' && su.protectCheck) {
  return navigateToSignUpProtectCheck();
  }
 
@@ -2669,7 +2672,8 @@ export class Clerk implements ClerkInterface {
  return navigateToResetPassword();
  }
 
- const userNeedsToBeCreated = si.firstFactorVerificationStatus === 'transferable';
+ const userNeedsToBeCreated =
+ si.firstFactorVerificationStatus === 'transferable' || params.continuation === 'transfer_to_sign_up';
 
  if (userNeedsToBeCreated) {
  if (params.transferable === false) {
@@ -2772,6 +2776,27 @@ export class Clerk implements ClerkInterface {
  return navigateToSignIn();
  };
 
+ public __internal_resumeAfterProtectCheck = async (
+ params: ResumeAfterProtectCheckParams = {},
+ customNavigate?: (to: string) => Promise<unknown>,
+ ): Promise<unknown> => {
+ if (!this.loaded || !this.environment || !this.client) {
+ return;
+ }
+ const { signIn, signUp } = this.client;
+
+ const resolvedNavigate = customNavigate ?? params.__internal_navigate;
+ const navigate = (to: string) =>
+ resolvedNavigate && typeof resolvedNavigate === 'function' ? resolvedNavigate(to) : this.navigate(to);
+
+ return this._handleRedirectCallback(params, {
+ signUp,
+ signIn,
+ navigate,
+ resuming: true,
+ });
+ };
+
  public handleRedirectCallback = async (
  params: HandleOAuthCallbackParams = {},
  customNavigate?: (to: string) => Promise<unknown>,

packages/react/src/__tests__/isomorphicClerk.test.ts

@@ -178,6 +178,70 @@ describe('isomorphicClerk', () => {
  expect(handleResourceCallback).toHaveBeenCalledWith(signInOrUp, params, customNavigate);
  });
 
+ // Regression: a call queued before clerk-js loads is replayed by
+ // `replayInterceptedInvocations`, whose loop discards whatever its callbacks
+ // return. The queued copy therefore has no caller left to reject to -- the
+ // original `await` resolved the moment the call was queued -- so without its
+ // own rejection handler a failed resume becomes an unhandled rejection in the
+ // host app. Asserting that `catch` is attached, rather than waiting for the
+ // symptom, keeps the check deterministic under fake timers.
+ it('attaches a rejection handler to __internal_resumeAfterProtectCheck when it is queued until clerk-js has loaded', async () => {
+ const params = { continuation: 'transfer_to_sign_up' } as const;
+ const catchSpy = vi.fn();
+ const resumeAfterProtectCheck = vi.fn().mockReturnValue({ catch: catchSpy });
+ const clerkjs = {
+ addListener: vi.fn(),
+ loaded: true,
+ __internal_resumeAfterProtectCheck: resumeAfterProtectCheck,
+ } as unknown as BrowserClerk;
+ const isomorphicClerk = new IsomorphicClerk({ publishableKey: 'pk_test_XXX' });
+
+ const customNavigate = vi.fn();
+
+ await isomorphicClerk.__internal_resumeAfterProtectCheck(params, customNavigate);
+
+ expect(resumeAfterProtectCheck).not.toHaveBeenCalled();
+
+ (isomorphicClerk as any).replayInterceptedInvocations(clerkjs);
+
+ expect(resumeAfterProtectCheck).toHaveBeenCalledWith(params, customNavigate);
+ expect(catchSpy).toHaveBeenCalledTimes(1);
+ });
+
+ it('attaches a rejection handler to __internal_resumeAfterProtectCheck after clerk-js has loaded', async () => {
+ const params = { continuation: 'transfer_to_sign_up' } as const;
+ const catchSpy = vi.fn();
+ const resumeAfterProtectCheck = vi.fn().mockReturnValue({ catch: catchSpy });
+ const isomorphicClerk = new IsomorphicClerk({ publishableKey: 'pk_test_XXX' });
+
+ (isomorphicClerk as any).clerkjs = {
+ loaded: true,
+ __internal_resumeAfterProtectCheck: resumeAfterProtectCheck,
+ } as unknown as BrowserClerk;
+
+ const customNavigate = vi.fn();
+
+ await isomorphicClerk.__internal_resumeAfterProtectCheck(params, customNavigate);
+
+ // The navigator is the component router's; dropping it falls back to Clerk.navigate,
+ // which resolves component-relative destinations against the origin instead.
+ expect(resumeAfterProtectCheck).toHaveBeenCalledWith(params, customNavigate);
+ expect(catchSpy).toHaveBeenCalledTimes(1);
+ });
+
+ // This wrapper is always defined on IsomorphicClerk, so it cannot itself signal whether the
+ // loaded runtime supports the call. An older clerk-js has no such method, and calling straight
+ // through would throw a TypeError at a host caller instead of doing nothing.
+ it('does nothing when the loaded clerk-js predates __internal_resumeAfterProtectCheck', async () => {
+ const isomorphicClerk = new IsomorphicClerk({ publishableKey: 'pk_test_XXX' });
+
+ (isomorphicClerk as any).clerkjs = { loaded: true } as unknown as BrowserClerk;
+
+ await expect(
+ isomorphicClerk.__internal_resumeAfterProtectCheck({ continuation: 'transfer_to_sign_up' }),
+ ).resolves.toBeUndefined();
+ });
+
  it('calls __internal_handleResourceCallback immediately after clerk-js has loaded', async () => {
  const signInOrUp = {} as unknown as SignInResource;
  const params: HandleOAuthCallbackParams = { signInUrl: '/sign-in' };

.changeset/resume-oauth-transfer-after-protect-check.md

@@ -0,0 +1,8 @@
+---
+'@clerk/clerk-js': minor
+'@clerk/react': patch
+'@clerk/shared': minor
+'@clerk/ui': patch
+---
+
+Fixes an issue where OAuth account transfers that needed additional verification were returned to the beginning of sign-in.

packages/clerk-js/src/core/__tests__/clerk.test.ts

@@ -1850,6 +1850,220 @@ describe('Clerk singleton', () => {
  expect(mockNavigate).not.toHaveBeenCalled();
  });
 
+ describe('__internal_resumeAfterProtectCheck', () => {
+ // A verification challenge can interrupt an OAuth callback partway through routing. The
+ // challenge card clears it and hands control back here, from a page that is no longer
+ // the callback route, so the remaining routing has to run rather than start over.
+
+ const gatedTransferableSignIn = (extra: Record<string, unknown> = {}) =>
+ new SignIn({
+ status: 'needs_identifier',
+ first_factor_verification: {
+ status: 'transferable',
+ strategy: 'oauth_google',
+ external_verification_redirect_url: '',
+ error: {
+ code: 'external_account_not_found',
+ long_message: 'The External Account was not found.',
+ message: 'Invalid external account',
+ },
+ },
+ second_factor_verification: null,
+ identifier: '',
+ user_data: null,
+ created_session_id: null,
+ created_user_id: null,
+ ...extra,
+ } as any as SignInJSON);
+
+ const loadEnvironment = () =>
+ mockEnvironmentFetch.mockReturnValue(
+ Promise.resolve({
+ authConfig: {},
+ userSettings: mockUserSettings,
+ displayConfig: mockDisplayConfig,
+ isSingleSession: () => false,
+ isProduction: () => false,
+ isDevelopmentOrStaging: () => true,
+ onWindowLocationHost: () => false,
+ }),
+ );
+
+ it('completes the transfer as a SIGN-UP and activates the created session', async () => {
+ loadEnvironment();
+ mockClientFetch.mockReturnValue(
+ Promise.resolve({
+ signedInSessions: [],
+ signIn: gatedTransferableSignIn(),
+ signUp: new SignUp(null),
+ }),
+ );
+
+ const mockSetActive = vi.fn();
+ const mockSignUpCreate = vi
+ .fn()
+ .mockReturnValue(Promise.resolve({ status: 'complete', createdSessionId: '123' }));
+
+ const sut = new Clerk(productionPublishableKey);
+ await sut.load(mockedLoadOptions);
+ if (!sut.client) {
+ fail('we should always have a client');
+ }
+ sut.client.signUp.create = mockSignUpCreate;
+ sut.setActive = mockSetActive;
+
+ await sut.__internal_resumeAfterProtectCheck({ continuation: 'transfer_to_sign_up' });
+
+ await waitFor(() => {
+ expect(mockSignUpCreate).toHaveBeenCalledTimes(1);
+ expect(mockSignUpCreate).toHaveBeenCalledWith({ transfer: true, unsafeMetadata: undefined });
+ expect(mockSetActive).toHaveBeenCalledWith(expect.objectContaining({ session: '123' }));
+ });
+ });
+
+ it('completes the transfer even when the cleared response dropped the transferable marker', async () => {
+ // `SignIn.fromJSON` replaces `firstFactorVerification` wholesale on every write, so the
+ // caller latches the continuation before running the challenge and passes it explicitly.
+ // Re-reading it here would silently fall back to returning the user to sign-in.
+ loadEnvironment();
+ mockClientFetch.mockReturnValue(
+ Promise.resolve({
+ signedInSessions: [],
+ signIn: new SignIn({
+ status: 'needs_identifier',
+ first_factor_verification: null,
+ second_factor_verification: null,
+ identifier: '',
+ user_data: null,
+ created_session_id: null,
+ created_user_id: null,
+ } as any as SignInJSON),
+ signUp: new SignUp(null),
+ }),
+ );
+
+ const mockSignUpCreate = vi
+ .fn()
+ .mockReturnValue(Promise.resolve({ status: 'complete', createdSessionId: '123' }));
+
+ const sut = new Clerk(productionPublishableKey);
+ await sut.load(mockedLoadOptions);
+ if (!sut.client) {
+ fail('we should always have a client');
+ }
+ sut.client.signUp.create = mockSignUpCreate;
+ sut.setActive = vi.fn();
+
+ await sut.__internal_resumeAfterProtectCheck({ continuation: 'transfer_to_sign_up' });
+
+ await waitFor(() =>
+ expect(mockSignUpCreate).toHaveBeenCalledWith({ transfer: true, unsafeMetadata: undefined }),
+ );
+ });
+
+ it('does not divert to the sign-up card when a stale gate is on the sign-up resource', async () => {
+ // The sign-in variant below covers the first short-circuit; `resuming` skips a second one
+ // keyed on the SIGN-UP resource, and that is the arm that sends the user to a different
+ // card entirely rather than back to this one.
+ loadEnvironment();
+ mockClientFetch.mockReturnValue(
+ Promise.resolve({
+ signedInSessions: [],
+ signIn: gatedTransferableSignIn(),
+ signUp: new SignUp({
+ protect_check: { status: 'pending', token: 'stale-signup-token', sdk_url: 'https://example.com/sdk.js' },
+ } as any),
+ }),
+ );
+
+ const mockSignUpCreate = vi
+ .fn()
+ .mockReturnValue(Promise.resolve({ status: 'complete', createdSessionId: '123' }));
+
+ const sut = new Clerk(productionPublishableKey);
+ await sut.load(mockedLoadOptions);
+ if (!sut.client) {
+ fail('we should always have a client');
+ }
+ sut.client.signUp.create = mockSignUpCreate;
+ sut.setActive = vi.fn();
+
+ await sut.__internal_resumeAfterProtectCheck({ continuation: 'transfer_to_sign_up' });
+
+ await waitFor(() =>
+ expect(mockSignUpCreate).toHaveBeenCalledWith({ transfer: true, unsafeMetadata: undefined }),
+ );
+ expect(mockNavigate.mock.calls.some(([to]) => typeof to === 'string' && to.includes('protect-check'))).toBe(
+ false,
+ );
+ });
+
+ it('does not bounce back into the challenge when a stale gate is still on the resource', async () => {
+ // This is the test that proves `resuming` is load-bearing rather than decorative. The
+ // caller IS the challenge card; re-checking the gate here would hand control straight
+ // back to it, or — through the sign-up arm — to the wrong card entirely.
+ loadEnvironment();
+ mockClientFetch.mockReturnValue(
+ Promise.resolve({
+ signedInSessions: [],
+ signIn: gatedTransferableSignIn({
+ protect_check: { status: 'pending', token: 'stale-token', sdk_url: 'https://example.com/sdk.js' },
+ }),
+ signUp: new SignUp(null),
+ }),
+ );
+
+ const mockSignUpCreate = vi
+ .fn()
+ .mockReturnValue(Promise.resolve({ status: 'complete', createdSessionId: '123' }));
+
+ const sut = new Clerk(productionPublishableKey);
+ await sut.load(mockedLoadOptions);
+ if (!sut.client) {
+ fail('we should always have a client');
+ }
+ sut.client.signUp.create = mockSignUpCreate;
+ sut.setActive = vi.fn();
+
+ await sut.__internal_resumeAfterProtectCheck({ continuation: 'transfer_to_sign_up' });
+
+ await waitFor(() =>
+ expect(mockSignUpCreate).toHaveBeenCalledWith({ transfer: true, unsafeMetadata: undefined }),
+ );
+ expect(mockNavigate.mock.calls.some(([to]) => typeof to === 'string' && to.includes('protect-check'))).toBe(
+ false,
+ );
+ });
+
+ it('still honours transferable: false', async () => {
+ loadEnvironment();
+ mockClientFetch.mockReturnValue(
+ Promise.resolve({
+ signedInSessions: [],
+ signIn: gatedTransferableSignIn(),
+ signUp: new SignUp(null),
+ }),
+ );
+
+ const mockSignUpCreate = vi.fn();
+
+ const sut = new Clerk(productionPublishableKey);
+ await sut.load(mockedLoadOptions);
+ if (!sut.client) {
+ fail('we should always have a client');
+ }
+ sut.client.signUp.create = mockSignUpCreate;
+ sut.setActive = vi.fn();
+
+ await sut.__internal_resumeAfterProtectCheck({
+ continuation: 'transfer_to_sign_up',
+ transferable: false,
+ });
+
+ await waitFor(() => expect(mockSignUpCreate).not.toHaveBeenCalled());
+ });
+ });
+
  it('does not initiate the transfer flow when transferable: false is passed', async () => {
  mockEnvironmentFetch.mockReturnValue(
  Promise.resolve({

packages/clerk-js/src/core/clerk.ts

@@ -112,6 +112,7 @@ import type {
  PublicKeyCredentialWithAuthenticatorAttestationResponse,
  RedirectOptions,
  Resources,
+ ResumeAfterProtectCheckParams,
  SDKMetadata,
  SessionResource,
  SessionTouchParams,
@@ -2450,15 +2451,17 @@ export class Clerk implements ClerkInterface {
  };
 
  private _handleRedirectCallback = async (
- params: HandleOAuthCallbackParams,
+ params: ResumeAfterProtectCheckParams,
  {
  signIn,
  signUp,
  navigate,
+ resuming = false,
  }: {
  signIn: SignInResource;
  signUp: SignUpResource;
  navigate: (to: string) => Promise<unknown>;
+ resuming?: boolean;
  },
  ): Promise<unknown> => {
  if (!this.loaded || !this.environment || !this.client) {
@@ -2602,14 +2605,14 @@ export class Clerk implements ClerkInterface {
  // sign-in's challenge. We only consult `si` here unless this is explicitly a sign-up callback.
  // Transfers are unaffected: the `signIn.create({ transfer })` path below checks its own fresh
  // response for the gate.
- if (params.reloadResource !== 'signUp' && (si.protectCheck || si.status === 'needs_protect_check')) {
+ if (!resuming && params.reloadResource !== 'signUp' && (si.protectCheck || si.status === 'needs_protect_check')) {
  return navigateToSignInProtectCheck();
  }
 
  // The sign-up resource can be gated the same way (e.g. a callback that resolves straight into a
  // gated sign-up). Scope to the sign-up intent for the symmetric reason — a stale sign-up's gate
  // shouldn't hijack a sign-in callback.
- if (params.reloadResource !== 'signIn' && su.protectCheck) {
+ if (!resuming && params.reloadResource !== 'signIn' && su.protectCheck) {
  return navigateToSignUpProtectCheck();
  }
 
@@ -2669,7 +2672,8 @@ export class Clerk implements ClerkInterface {
  return navigateToResetPassword();
  }
 
- const userNeedsToBeCreated = si.firstFactorVerificationStatus === 'transferable';
+ const userNeedsToBeCreated =
+ si.firstFactorVerificationStatus === 'transferable' || params.continuation === 'transfer_to_sign_up';
 
  if (userNeedsToBeCreated) {
  if (params.transferable === false) {
@@ -2772,6 +2776,27 @@ export class Clerk implements ClerkInterface {
  return navigateToSignIn();
  };
 
+ public __internal_resumeAfterProtectCheck = async (
+ params: ResumeAfterProtectCheckParams = {},
+ customNavigate?: (to: string) => Promise<unknown>,
+ ): Promise<unknown> => {
+ if (!this.loaded || !this.environment || !this.client) {
+ return;
+ }
+ const { signIn, signUp } = this.client;
+
+ const resolvedNavigate = customNavigate ?? params.__internal_navigate;
+ const navigate = (to: string) =>
+ resolvedNavigate && typeof resolvedNavigate === 'function' ? resolvedNavigate(to) : this.navigate(to);
+
+ return this._handleRedirectCallback(params, {
+ signUp,
+ signIn,
+ navigate,
+ resuming: true,
+ });
+ };
+
  public handleRedirectCallback = async (
  params: HandleOAuthCallbackParams = {},
  customNavigate?: (to: string) => Promise<unknown>,

packages/react/src/__tests__/isomorphicClerk.test.ts

@@ -178,6 +178,70 @@ describe('isomorphicClerk', () => {
  expect(handleResourceCallback).toHaveBeenCalledWith(signInOrUp, params, customNavigate);
  });
 
+ // Regression: a call queued before clerk-js loads is replayed by
+ // `replayInterceptedInvocations`, whose loop discards whatever its callbacks
+ // return. The queued copy therefore has no caller left to reject to -- the
+ // original `await` resolved the moment the call was queued -- so without its
+ // own rejection handler a failed resume becomes an unhandled rejection in the
+ // host app. Asserting that `catch` is attached, rather than waiting for the
+ // symptom, keeps the check deterministic under fake timers.
+ it('attaches a rejection handler to __internal_resumeAfterProtectCheck when it is queued until clerk-js has loaded', async () => {
+ const params = { continuation: 'transfer_to_sign_up' } as const;
+ const catchSpy = vi.fn();
+ const resumeAfterProtectCheck = vi.fn().mockReturnValue({ catch: catchSpy });
+ const clerkjs = {
+ addListener: vi.fn(),
+ loaded: true,
+ __internal_resumeAfterProtectCheck: resumeAfterProtectCheck,
+ } as unknown as BrowserClerk;
+ const isomorphicClerk = new IsomorphicClerk({ publishableKey: 'pk_test_XXX' });
+
+ const customNavigate = vi.fn();
+
+ await isomorphicClerk.__internal_resumeAfterProtectCheck(params, customNavigate);
+
+ expect(resumeAfterProtectCheck).not.toHaveBeenCalled();
+
+ (isomorphicClerk as any).replayInterceptedInvocations(clerkjs);
+
+ expect(resumeAfterProtectCheck).toHaveBeenCalledWith(params, customNavigate);
+ expect(catchSpy).toHaveBeenCalledTimes(1);
+ });
+
+ it('attaches a rejection handler to __internal_resumeAfterProtectCheck after clerk-js has loaded', async () => {
+ const params = { continuation: 'transfer_to_sign_up' } as const;
+ const catchSpy = vi.fn();
+ const resumeAfterProtectCheck = vi.fn().mockReturnValue({ catch: catchSpy });
+ const isomorphicClerk = new IsomorphicClerk({ publishableKey: 'pk_test_XXX' });
+
+ (isomorphicClerk as any).clerkjs = {
+ loaded: true,
+ __internal_resumeAfterProtectCheck: resumeAfterProtectCheck,
+ } as unknown as BrowserClerk;
+
+ const customNavigate = vi.fn();
+
+ await isomorphicClerk.__internal_resumeAfterProtectCheck(params, customNavigate);
+
+ // The navigator is the component router's; dropping it falls back to Clerk.navigate,
+ // which resolves component-relative destinations against the origin instead.
+ expect(resumeAfterProtectCheck).toHaveBeenCalledWith(params, customNavigate);
+ expect(catchSpy).toHaveBeenCalledTimes(1);
+ });
+
+ // This wrapper is always defined on IsomorphicClerk, so it cannot itself signal whether the
+ // loaded runtime supports the call. An older clerk-js has no such method, and calling straight
+ // through would throw a TypeError at a host caller instead of doing nothing.
+ it('does nothing when the loaded clerk-js predates __internal_resumeAfterProtectCheck', async () => {
+ const isomorphicClerk = new IsomorphicClerk({ publishableKey: 'pk_test_XXX' });
+
+ (isomorphicClerk as any).clerkjs = { loaded: true } as unknown as BrowserClerk;
+
+ await expect(
+ isomorphicClerk.__internal_resumeAfterProtectCheck({ continuation: 'transfer_to_sign_up' }),
+ ).resolves.toBeUndefined();
+ });
+
  it('calls __internal_handleResourceCallback immediately after clerk-js has loaded', async () => {
  const signInOrUp = {} as unknown as SignInResource;
  const params: HandleOAuthCallbackParams = { signInUrl: '/sign-in' };

.changeset/resume-oauth-transfer-after-protect-check.md

@@ -0,0 +1,8 @@
+---
+'@clerk/clerk-js': minor
+'@clerk/react': patch
+'@clerk/shared': minor
+'@clerk/ui': patch
+---
+
+Fixes an issue where OAuth account transfers that needed additional verification were returned to the beginning of sign-in.

packages/clerk-js/src/core/__tests__/clerk.test.ts

@@ -1850,6 +1850,220 @@ describe('Clerk singleton', () => {
  expect(mockNavigate).not.toHaveBeenCalled();
  });
 
+ describe('__internal_resumeAfterProtectCheck', () => {
+ // A verification challenge can interrupt an OAuth callback partway through routing. The
+ // challenge card clears it and hands control back here, from a page that is no longer
+ // the callback route, so the remaining routing has to run rather than start over.
+
+ const gatedTransferableSignIn = (extra: Record<string, unknown> = {}) =>
+ new SignIn({
+ status: 'needs_identifier',
+ first_factor_verification: {
+ status: 'transferable',
+ strategy: 'oauth_google',
+ external_verification_redirect_url: '',
+ error: {
+ code: 'external_account_not_found',
+ long_message: 'The External Account was not found.',
+ message: 'Invalid external account',
+ },
+ },
+ second_factor_verification: null,
+ identifier: '',
+ user_data: null,
+ created_session_id: null,
+ created_user_id: null,
+ ...extra,
+ } as any as SignInJSON);
+
+ const loadEnvironment = () =>
+ mockEnvironmentFetch.mockReturnValue(
+ Promise.resolve({
+ authConfig: {},
+ userSettings: mockUserSettings,
+ displayConfig: mockDisplayConfig,
+ isSingleSession: () => false,
+ isProduction: () => false,
+ isDevelopmentOrStaging: () => true,
+ onWindowLocationHost: () => false,
+ }),
+ );
+
+ it('completes the transfer as a SIGN-UP and activates the created session', async () => {
+ loadEnvironment();
+ mockClientFetch.mockReturnValue(
+ Promise.resolve({
+ signedInSessions: [],
+ signIn: gatedTransferableSignIn(),
+ signUp: new SignUp(null),
+ }),
+ );
+
+ const mockSetActive = vi.fn();
+ const mockSignUpCreate = vi
+ .fn()
+ .mockReturnValue(Promise.resolve({ status: 'complete', createdSessionId: '123' }));
+
+ const sut = new Clerk(productionPublishableKey);
+ await sut.load(mockedLoadOptions);
+ if (!sut.client) {
+ fail('we should always have a client');
+ }
+ sut.client.signUp.create = mockSignUpCreate;
+ sut.setActive = mockSetActive;
+
+ await sut.__internal_resumeAfterProtectCheck({ continuation: 'transfer_to_sign_up' });
+
+ await waitFor(() => {
+ expect(mockSignUpCreate).toHaveBeenCalledTimes(1);
+ expect(mockSignUpCreate).toHaveBeenCalledWith({ transfer: true, unsafeMetadata: undefined });
+ expect(mockSetActive).toHaveBeenCalledWith(expect.objectContaining({ session: '123' }));
+ });
+ });
+
+ it('completes the transfer even when the cleared response dropped the transferable marker', async () => {
+ // `SignIn.fromJSON` replaces `firstFactorVerification` wholesale on every write, so the
+ // caller latches the continuation before running the challenge and passes it explicitly.
+ // Re-reading it here would silently fall back to returning the user to sign-in.
+ loadEnvironment();
+ mockClientFetch.mockReturnValue(
+ Promise.resolve({
+ signedInSessions: [],
+ signIn: new SignIn({
+ status: 'needs_identifier',
+ first_factor_verification: null,
+ second_factor_verification: null,
+ identifier: '',
+ user_data: null,
+ created_session_id: null,
+ created_user_id: null,
+ } as any as SignInJSON),
+ signUp: new SignUp(null),
+ }),
+ );
+
+ const mockSignUpCreate = vi
+ .fn()
+ .mockReturnValue(Promise.resolve({ status: 'complete', createdSessionId: '123' }));
+
+ const sut = new Clerk(productionPublishableKey);
+ await sut.load(mockedLoadOptions);
+ if (!sut.client) {
+ fail('we should always have a client');
+ }
+ sut.client.signUp.create = mockSignUpCreate;
+ sut.setActive = vi.fn();
+
+ await sut.__internal_resumeAfterProtectCheck({ continuation: 'transfer_to_sign_up' });
+
+ await waitFor(() =>
+ expect(mockSignUpCreate).toHaveBeenCalledWith({ transfer: true, unsafeMetadata: undefined }),
+ );
+ });
+
+ it('does not divert to the sign-up card when a stale gate is on the sign-up resource', async () => {
+ // The sign-in variant below covers the first short-circuit; `resuming` skips a second one
+ // keyed on the SIGN-UP resource, and that is the arm that sends the user to a different
+ // card entirely rather than back to this one.
+ loadEnvironment();
+ mockClientFetch.mockReturnValue(
+ Promise.resolve({
+ signedInSessions: [],
+ signIn: gatedTransferableSignIn(),
+ signUp: new SignUp({
+ protect_check: { status: 'pending', token: 'stale-signup-token', sdk_url: 'https://example.com/sdk.js' },
+ } as any),
+ }),
+ );
+
+ const mockSignUpCreate = vi
+ .fn()
+ .mockReturnValue(Promise.resolve({ status: 'complete', createdSessionId: '123' }));
+
+ const sut = new Clerk(productionPublishableKey);
+ await sut.load(mockedLoadOptions);
+ if (!sut.client) {
+ fail('we should always have a client');
+ }
+ sut.client.signUp.create = mockSignUpCreate;
+ sut.setActive = vi.fn();
+
+ await sut.__internal_resumeAfterProtectCheck({ continuation: 'transfer_to_sign_up' });
+
+ await waitFor(() =>
+ expect(mockSignUpCreate).toHaveBeenCalledWith({ transfer: true, unsafeMetadata: undefined }),
+ );
+ expect(mockNavigate.mock.calls.some(([to]) => typeof to === 'string' && to.includes('protect-check'))).toBe(
+ false,
+ );
+ });
+
+ it('does not bounce back into the challenge when a stale gate is still on the resource', async () => {
+ // This is the test that proves `resuming` is load-bearing rather than decorative. The
+ // caller IS the challenge card; re-checking the gate here would hand control straight
+ // back to it, or — through the sign-up arm — to the wrong card entirely.
+ loadEnvironment();
+ mockClientFetch.mockReturnValue(
+ Promise.resolve({
+ signedInSessions: [],
+ signIn: gatedTransferableSignIn({
+ protect_check: { status: 'pending', token: 'stale-token', sdk_url: 'https://example.com/sdk.js' },
+ }),
+ signUp: new SignUp(null),
+ }),
+ );
+
+ const mockSignUpCreate = vi
+ .fn()
+ .mockReturnValue(Promise.resolve({ status: 'complete', createdSessionId: '123' }));
+
+ const sut = new Clerk(productionPublishableKey);
+ await sut.load(mockedLoadOptions);
+ if (!sut.client) {
+ fail('we should always have a client');
+ }
+ sut.client.signUp.create = mockSignUpCreate;
+ sut.setActive = vi.fn();
+
+ await sut.__internal_resumeAfterProtectCheck({ continuation: 'transfer_to_sign_up' });
+
+ await waitFor(() =>
+ expect(mockSignUpCreate).toHaveBeenCalledWith({ transfer: true, unsafeMetadata: undefined }),
+ );
+ expect(mockNavigate.mock.calls.some(([to]) => typeof to === 'string' && to.includes('protect-check'))).toBe(
+ false,
+ );
+ });
+
+ it('still honours transferable: false', async () => {
+ loadEnvironment();
+ mockClientFetch.mockReturnValue(
+ Promise.resolve({
+ signedInSessions: [],
+ signIn: gatedTransferableSignIn(),
+ signUp: new SignUp(null),
+ }),
+ );
+
+ const mockSignUpCreate = vi.fn();
+
+ const sut = new Clerk(productionPublishableKey);
+ await sut.load(mockedLoadOptions);
+ if (!sut.client) {
+ fail('we should always have a client');
+ }
+ sut.client.signUp.create = mockSignUpCreate;
+ sut.setActive = vi.fn();
+
+ await sut.__internal_resumeAfterProtectCheck({
+ continuation: 'transfer_to_sign_up',
+ transferable: false,
+ });
+
+ await waitFor(() => expect(mockSignUpCreate).not.toHaveBeenCalled());
+ });
+ });
+
  it('does not initiate the transfer flow when transferable: false is passed', async () => {
  mockEnvironmentFetch.mockReturnValue(
  Promise.resolve({

packages/clerk-js/src/core/clerk.ts

@@ -112,6 +112,7 @@ import type {
  PublicKeyCredentialWithAuthenticatorAttestationResponse,
  RedirectOptions,
  Resources,
+ ResumeAfterProtectCheckParams,
  SDKMetadata,
  SessionResource,
  SessionTouchParams,
@@ -2450,15 +2451,17 @@ export class Clerk implements ClerkInterface {
  };
 
  private _handleRedirectCallback = async (
- params: HandleOAuthCallbackParams,
+ params: ResumeAfterProtectCheckParams,
  {
  signIn,
  signUp,
  navigate,
+ resuming = false,
  }: {
  signIn: SignInResource;
  signUp: SignUpResource;
  navigate: (to: string) => Promise<unknown>;
+ resuming?: boolean;
  },
  ): Promise<unknown> => {
  if (!this.loaded || !this.environment || !this.client) {
@@ -2602,14 +2605,14 @@ export class Clerk implements ClerkInterface {
  // sign-in's challenge. We only consult `si` here unless this is explicitly a sign-up callback.
  // Transfers are unaffected: the `signIn.create({ transfer })` path below checks its own fresh
  // response for the gate.
- if (params.reloadResource !== 'signUp' && (si.protectCheck || si.status === 'needs_protect_check')) {
+ if (!resuming && params.reloadResource !== 'signUp' && (si.protectCheck || si.status === 'needs_protect_check')) {
  return navigateToSignInProtectCheck();
  }
 
  // The sign-up resource can be gated the same way (e.g. a callback that resolves straight into a
  // gated sign-up). Scope to the sign-up intent for the symmetric reason — a stale sign-up's gate
  // shouldn't hijack a sign-in callback.
- if (params.reloadResource !== 'signIn' && su.protectCheck) {
+ if (!resuming && params.reloadResource !== 'signIn' && su.protectCheck) {
  return navigateToSignUpProtectCheck();
  }
 
@@ -2669,7 +2672,8 @@ export class Clerk implements ClerkInterface {
  return navigateToResetPassword();
  }
 
- const userNeedsToBeCreated = si.firstFactorVerificationStatus === 'transferable';
+ const userNeedsToBeCreated =
+ si.firstFactorVerificationStatus === 'transferable' || params.continuation === 'transfer_to_sign_up';
 
  if (userNeedsToBeCreated) {
  if (params.transferable === false) {
@@ -2772,6 +2776,27 @@ export class Clerk implements ClerkInterface {
  return navigateToSignIn();
  };
 
+ public __internal_resumeAfterProtectCheck = async (
+ params: ResumeAfterProtectCheckParams = {},
+ customNavigate?: (to: string) => Promise<unknown>,
+ ): Promise<unknown> => {
+ if (!this.loaded || !this.environment || !this.client) {
+ return;
+ }
+ const { signIn, signUp } = this.client;
+
+ const resolvedNavigate = customNavigate ?? params.__internal_navigate;
+ const navigate = (to: string) =>
+ resolvedNavigate && typeof resolvedNavigate === 'function' ? resolvedNavigate(to) : this.navigate(to);
+
+ return this._handleRedirectCallback(params, {
+ signUp,
+ signIn,
+ navigate,
+ resuming: true,
+ });
+ };
+
  public handleRedirectCallback = async (
  params: HandleOAuthCallbackParams = {},
  customNavigate?: (to: string) => Promise<unknown>,

packages/react/src/__tests__/isomorphicClerk.test.ts

@@ -178,6 +178,70 @@ describe('isomorphicClerk', () => {
  expect(handleResourceCallback).toHaveBeenCalledWith(signInOrUp, params, customNavigate);
  });
 
+ // Regression: a call queued before clerk-js loads is replayed by
+ // `replayInterceptedInvocations`, whose loop discards whatever its callbacks
+ // return. The queued copy therefore has no caller left to reject to -- the
+ // original `await` resolved the moment the call was queued -- so without its
+ // own rejection handler a failed resume becomes an unhandled rejection in the
+ // host app. Asserting that `catch` is attached, rather than waiting for the
+ // symptom, keeps the check deterministic under fake timers.
+ it('attaches a rejection handler to __internal_resumeAfterProtectCheck when it is queued until clerk-js has loaded', async () => {
+ const params = { continuation: 'transfer_to_sign_up' } as const;
+ const catchSpy = vi.fn();
+ const resumeAfterProtectCheck = vi.fn().mockReturnValue({ catch: catchSpy });
+ const clerkjs = {
+ addListener: vi.fn(),
+ loaded: true,
+ __internal_resumeAfterProtectCheck: resumeAfterProtectCheck,
+ } as unknown as BrowserClerk;
+ const isomorphicClerk = new IsomorphicClerk({ publishableKey: 'pk_test_XXX' });
+
+ const customNavigate = vi.fn();
+
+ await isomorphicClerk.__internal_resumeAfterProtectCheck(params, customNavigate);
+
+ expect(resumeAfterProtectCheck).not.toHaveBeenCalled();
+
+ (isomorphicClerk as any).replayInterceptedInvocations(clerkjs);
+
+ expect(resumeAfterProtectCheck).toHaveBeenCalledWith(params, customNavigate);
+ expect(catchSpy).toHaveBeenCalledTimes(1);
+ });
+
+ it('attaches a rejection handler to __internal_resumeAfterProtectCheck after clerk-js has loaded', async () => {
+ const params = { continuation: 'transfer_to_sign_up' } as const;
+ const catchSpy = vi.fn();
+ const resumeAfterProtectCheck = vi.fn().mockReturnValue({ catch: catchSpy });
+ const isomorphicClerk = new IsomorphicClerk({ publishableKey: 'pk_test_XXX' });
+
+ (isomorphicClerk as any).clerkjs = {
+ loaded: true,
+ __internal_resumeAfterProtectCheck: resumeAfterProtectCheck,
+ } as unknown as BrowserClerk;
+
+ const customNavigate = vi.fn();
+
+ await isomorphicClerk.__internal_resumeAfterProtectCheck(params, customNavigate);
+
+ // The navigator is the component router's; dropping it falls back to Clerk.navigate,
+ // which resolves component-relative destinations against the origin instead.
+ expect(resumeAfterProtectCheck).toHaveBeenCalledWith(params, customNavigate);
+ expect(catchSpy).toHaveBeenCalledTimes(1);
+ });
+
+ // This wrapper is always defined on IsomorphicClerk, so it cannot itself signal whether the
+ // loaded runtime supports the call. An older clerk-js has no such method, and calling straight
+ // through would throw a TypeError at a host caller instead of doing nothing.
+ it('does nothing when the loaded clerk-js predates __internal_resumeAfterProtectCheck', async () => {
+ const isomorphicClerk = new IsomorphicClerk({ publishableKey: 'pk_test_XXX' });
+
+ (isomorphicClerk as any).clerkjs = { loaded: true } as unknown as BrowserClerk;
+
+ await expect(
+ isomorphicClerk.__internal_resumeAfterProtectCheck({ continuation: 'transfer_to_sign_up' }),
+ ).resolves.toBeUndefined();
+ });
+
  it('calls __internal_handleResourceCallback immediately after clerk-js has loaded', async () => {
  const signInOrUp = {} as unknown as SignInResource;
  const params: HandleOAuthCallbackParams = { signInUrl: '/sign-in' };

.changeset/resume-oauth-transfer-after-protect-check.md

@@ -0,0 +1,8 @@
+---
+'@clerk/clerk-js': minor
+'@clerk/react': patch
+'@clerk/shared': minor
+'@clerk/ui': patch
+---
+
+Fixes an issue where OAuth account transfers that needed additional verification were returned to the beginning of sign-in.

packages/clerk-js/src/core/__tests__/clerk.test.ts

@@ -1850,6 +1850,220 @@ describe('Clerk singleton', () => {
  expect(mockNavigate).not.toHaveBeenCalled();
  });
 
+ describe('__internal_resumeAfterProtectCheck', () => {
+ // A verification challenge can interrupt an OAuth callback partway through routing. The
+ // challenge card clears it and hands control back here, from a page that is no longer
+ // the callback route, so the remaining routing has to run rather than start over.
+
+ const gatedTransferableSignIn = (extra: Record<string, unknown> = {}) =>
+ new SignIn({
+ status: 'needs_identifier',
+ first_factor_verification: {
+ status: 'transferable',
+ strategy: 'oauth_google',
+ external_verification_redirect_url: '',
+ error: {
+ code: 'external_account_not_found',
+ long_message: 'The External Account was not found.',
+ message: 'Invalid external account',
+ },
+ },
+ second_factor_verification: null,
+ identifier: '',
+ user_data: null,
+ created_session_id: null,
+ created_user_id: null,
+ ...extra,
+ } as any as SignInJSON);
+
+ const loadEnvironment = () =>
+ mockEnvironmentFetch.mockReturnValue(
+ Promise.resolve({
+ authConfig: {},
+ userSettings: mockUserSettings,
+ displayConfig: mockDisplayConfig,
+ isSingleSession: () => false,
+ isProduction: () => false,
+ isDevelopmentOrStaging: () => true,
+ onWindowLocationHost: () => false,
+ }),
+ );
+
+ it('completes the transfer as a SIGN-UP and activates the created session', async () => {
+ loadEnvironment();
+ mockClientFetch.mockReturnValue(
+ Promise.resolve({
+ signedInSessions: [],
+ signIn: gatedTransferableSignIn(),
+ signUp: new SignUp(null),
+ }),
+ );
+
+ const mockSetActive = vi.fn();
+ const mockSignUpCreate = vi
+ .fn()
+ .mockReturnValue(Promise.resolve({ status: 'complete', createdSessionId: '123' }));
+
+ const sut = new Clerk(productionPublishableKey);
+ await sut.load(mockedLoadOptions);
+ if (!sut.client) {
+ fail('we should always have a client');
+ }
+ sut.client.signUp.create = mockSignUpCreate;
+ sut.setActive = mockSetActive;
+
+ await sut.__internal_resumeAfterProtectCheck({ continuation: 'transfer_to_sign_up' });
+
+ await waitFor(() => {
+ expect(mockSignUpCreate).toHaveBeenCalledTimes(1);
+ expect(mockSignUpCreate).toHaveBeenCalledWith({ transfer: true, unsafeMetadata: undefined });
+ expect(mockSetActive).toHaveBeenCalledWith(expect.objectContaining({ session: '123' }));
+ });
+ });
+
+ it('completes the transfer even when the cleared response dropped the transferable marker', async () => {
+ // `SignIn.fromJSON` replaces `firstFactorVerification` wholesale on every write, so the
+ // caller latches the continuation before running the challenge and passes it explicitly.
+ // Re-reading it here would silently fall back to returning the user to sign-in.
+ loadEnvironment();
+ mockClientFetch.mockReturnValue(
+ Promise.resolve({
+ signedInSessions: [],
+ signIn: new SignIn({
+ status: 'needs_identifier',
+ first_factor_verification: null,
+ second_factor_verification: null,
+ identifier: '',
+ user_data: null,
+ created_session_id: null,
+ created_user_id: null,
+ } as any as SignInJSON),
+ signUp: new SignUp(null),
+ }),
+ );
+
+ const mockSignUpCreate = vi
+ .fn()
+ .mockReturnValue(Promise.resolve({ status: 'complete', createdSessionId: '123' }));
+
+ const sut = new Clerk(productionPublishableKey);
+ await sut.load(mockedLoadOptions);
+ if (!sut.client) {
+ fail('we should always have a client');
+ }
+ sut.client.signUp.create = mockSignUpCreate;
+ sut.setActive = vi.fn();
+
+ await sut.__internal_resumeAfterProtectCheck({ continuation: 'transfer_to_sign_up' });
+
+ await waitFor(() =>
+ expect(mockSignUpCreate).toHaveBeenCalledWith({ transfer: true, unsafeMetadata: undefined }),
+ );
+ });
+
+ it('does not divert to the sign-up card when a stale gate is on the sign-up resource', async () => {
+ // The sign-in variant below covers the first short-circuit; `resuming` skips a second one
+ // keyed on the SIGN-UP resource, and that is the arm that sends the user to a different
+ // card entirely rather than back to this one.
+ loadEnvironment();
+ mockClientFetch.mockReturnValue(
+ Promise.resolve({
+ signedInSessions: [],
+ signIn: gatedTransferableSignIn(),
+ signUp: new SignUp({
+ protect_check: { status: 'pending', token: 'stale-signup-token', sdk_url: 'https://example.com/sdk.js' },
+ } as any),
+ }),
+ );
+
+ const mockSignUpCreate = vi
+ .fn()
+ .mockReturnValue(Promise.resolve({ status: 'complete', createdSessionId: '123' }));
+
+ const sut = new Clerk(productionPublishableKey);
+ await sut.load(mockedLoadOptions);
+ if (!sut.client) {
+ fail('we should always have a client');
+ }
+ sut.client.signUp.create = mockSignUpCreate;
+ sut.setActive = vi.fn();
+
+ await sut.__internal_resumeAfterProtectCheck({ continuation: 'transfer_to_sign_up' });
+
+ await waitFor(() =>
+ expect(mockSignUpCreate).toHaveBeenCalledWith({ transfer: true, unsafeMetadata: undefined }),
+ );
+ expect(mockNavigate.mock.calls.some(([to]) => typeof to === 'string' && to.includes('protect-check'))).toBe(
+ false,
+ );
+ });
+
+ it('does not bounce back into the challenge when a stale gate is still on the resource', async () => {
+ // This is the test that proves `resuming` is load-bearing rather than decorative. The
+ // caller IS the challenge card; re-checking the gate here would hand control straight
+ // back to it, or — through the sign-up arm — to the wrong card entirely.
+ loadEnvironment();
+ mockClientFetch.mockReturnValue(
+ Promise.resolve({
+ signedInSessions: [],
+ signIn: gatedTransferableSignIn({
+ protect_check: { status: 'pending', token: 'stale-token', sdk_url: 'https://example.com/sdk.js' },
+ }),
+ signUp: new SignUp(null),
+ }),
+ );
+
+ const mockSignUpCreate = vi
+ .fn()
+ .mockReturnValue(Promise.resolve({ status: 'complete', createdSessionId: '123' }));
+
+ const sut = new Clerk(productionPublishableKey);
+ await sut.load(mockedLoadOptions);
+ if (!sut.client) {
+ fail('we should always have a client');
+ }
+ sut.client.signUp.create = mockSignUpCreate;
+ sut.setActive = vi.fn();
+
+ await sut.__internal_resumeAfterProtectCheck({ continuation: 'transfer_to_sign_up' });
+
+ await waitFor(() =>
+ expect(mockSignUpCreate).toHaveBeenCalledWith({ transfer: true, unsafeMetadata: undefined }),
+ );
+ expect(mockNavigate.mock.calls.some(([to]) => typeof to === 'string' && to.includes('protect-check'))).toBe(
+ false,
+ );
+ });
+
+ it('still honours transferable: false', async () => {
+ loadEnvironment();
+ mockClientFetch.mockReturnValue(
+ Promise.resolve({
+ signedInSessions: [],
+ signIn: gatedTransferableSignIn(),
+ signUp: new SignUp(null),
+ }),
+ );
+
+ const mockSignUpCreate = vi.fn();
+
+ const sut = new Clerk(productionPublishableKey);
+ await sut.load(mockedLoadOptions);
+ if (!sut.client) {
+ fail('we should always have a client');
+ }
+ sut.client.signUp.create = mockSignUpCreate;
+ sut.setActive = vi.fn();
+
+ await sut.__internal_resumeAfterProtectCheck({
+ continuation: 'transfer_to_sign_up',
+ transferable: false,
+ });
+
+ await waitFor(() => expect(mockSignUpCreate).not.toHaveBeenCalled());
+ });
+ });
+
  it('does not initiate the transfer flow when transferable: false is passed', async () => {
  mockEnvironmentFetch.mockReturnValue(
  Promise.resolve({

packages/clerk-js/src/core/clerk.ts

@@ -112,6 +112,7 @@ import type {
  PublicKeyCredentialWithAuthenticatorAttestationResponse,
  RedirectOptions,
  Resources,
+ ResumeAfterProtectCheckParams,
  SDKMetadata,
  SessionResource,
  SessionTouchParams,
@@ -2450,15 +2451,17 @@ export class Clerk implements ClerkInterface {
  };
 
  private _handleRedirectCallback = async (
- params: HandleOAuthCallbackParams,
+ params: ResumeAfterProtectCheckParams,
  {
  signIn,
  signUp,
  navigate,
+ resuming = false,
  }: {
  signIn: SignInResource;
  signUp: SignUpResource;
  navigate: (to: string) => Promise<unknown>;
+ resuming?: boolean;
  },
  ): Promise<unknown> => {
  if (!this.loaded || !this.environment || !this.client) {
@@ -2602,14 +2605,14 @@ export class Clerk implements ClerkInterface {
  // sign-in's challenge. We only consult `si` here unless this is explicitly a sign-up callback.
  // Transfers are unaffected: the `signIn.create({ transfer })` path below checks its own fresh
  // response for the gate.
- if (params.reloadResource !== 'signUp' && (si.protectCheck || si.status === 'needs_protect_check')) {
+ if (!resuming && params.reloadResource !== 'signUp' && (si.protectCheck || si.status === 'needs_protect_check')) {
  return navigateToSignInProtectCheck();
  }
 
  // The sign-up resource can be gated the same way (e.g. a callback that resolves straight into a
  // gated sign-up). Scope to the sign-up intent for the symmetric reason — a stale sign-up's gate
  // shouldn't hijack a sign-in callback.
- if (params.reloadResource !== 'signIn' && su.protectCheck) {
+ if (!resuming && params.reloadResource !== 'signIn' && su.protectCheck) {
  return navigateToSignUpProtectCheck();
  }
 
@@ -2669,7 +2672,8 @@ export class Clerk implements ClerkInterface {
  return navigateToResetPassword();
  }
 
- const userNeedsToBeCreated = si.firstFactorVerificationStatus === 'transferable';
+ const userNeedsToBeCreated =
+ si.firstFactorVerificationStatus === 'transferable' || params.continuation === 'transfer_to_sign_up';
 
  if (userNeedsToBeCreated) {
  if (params.transferable === false) {
@@ -2772,6 +2776,27 @@ export class Clerk implements ClerkInterface {
  return navigateToSignIn();
  };
 
+ public __internal_resumeAfterProtectCheck = async (
+ params: ResumeAfterProtectCheckParams = {},
+ customNavigate?: (to: string) => Promise<unknown>,
+ ): Promise<unknown> => {
+ if (!this.loaded || !this.environment || !this.client) {
+ return;
+ }
+ const { signIn, signUp } = this.client;
+
+ const resolvedNavigate = customNavigate ?? params.__internal_navigate;
+ const navigate = (to: string) =>
+ resolvedNavigate && typeof resolvedNavigate === 'function' ? resolvedNavigate(to) : this.navigate(to);
+
+ return this._handleRedirectCallback(params, {
+ signUp,
+ signIn,
+ navigate,
+ resuming: true,
+ });
+ };
+
  public handleRedirectCallback = async (
  params: HandleOAuthCallbackParams = {},
  customNavigate?: (to: string) => Promise<unknown>,

packages/react/src/__tests__/isomorphicClerk.test.ts

@@ -178,6 +178,70 @@ describe('isomorphicClerk', () => {
  expect(handleResourceCallback).toHaveBeenCalledWith(signInOrUp, params, customNavigate);
  });
 
+ // Regression: a call queued before clerk-js loads is replayed by
+ // `replayInterceptedInvocations`, whose loop discards whatever its callbacks
+ // return. The queued copy therefore has no caller left to reject to -- the
+ // original `await` resolved the moment the call was queued -- so without its
+ // own rejection handler a failed resume becomes an unhandled rejection in the
+ // host app. Asserting that `catch` is attached, rather than waiting for the
+ // symptom, keeps the check deterministic under fake timers.
+ it('attaches a rejection handler to __internal_resumeAfterProtectCheck when it is queued until clerk-js has loaded', async () => {
+ const params = { continuation: 'transfer_to_sign_up' } as const;
+ const catchSpy = vi.fn();
+ const resumeAfterProtectCheck = vi.fn().mockReturnValue({ catch: catchSpy });
+ const clerkjs = {
+ addListener: vi.fn(),
+ loaded: true,
+ __internal_resumeAfterProtectCheck: resumeAfterProtectCheck,
+ } as unknown as BrowserClerk;
+ const isomorphicClerk = new IsomorphicClerk({ publishableKey: 'pk_test_XXX' });
+
+ const customNavigate = vi.fn();
+
+ await isomorphicClerk.__internal_resumeAfterProtectCheck(params, customNavigate);
+
+ expect(resumeAfterProtectCheck).not.toHaveBeenCalled();
+
+ (isomorphicClerk as any).replayInterceptedInvocations(clerkjs);
+
+ expect(resumeAfterProtectCheck).toHaveBeenCalledWith(params, customNavigate);
+ expect(catchSpy).toHaveBeenCalledTimes(1);
+ });
+
+ it('attaches a rejection handler to __internal_resumeAfterProtectCheck after clerk-js has loaded', async () => {
+ const params = { continuation: 'transfer_to_sign_up' } as const;
+ const catchSpy = vi.fn();
+ const resumeAfterProtectCheck = vi.fn().mockReturnValue({ catch: catchSpy });
+ const isomorphicClerk = new IsomorphicClerk({ publishableKey: 'pk_test_XXX' });
+
+ (isomorphicClerk as any).clerkjs = {
+ loaded: true,
+ __internal_resumeAfterProtectCheck: resumeAfterProtectCheck,
+ } as unknown as BrowserClerk;
+
+ const customNavigate = vi.fn();
+
+ await isomorphicClerk.__internal_resumeAfterProtectCheck(params, customNavigate);
+
+ // The navigator is the component router's; dropping it falls back to Clerk.navigate,
+ // which resolves component-relative destinations against the origin instead.
+ expect(resumeAfterProtectCheck).toHaveBeenCalledWith(params, customNavigate);
+ expect(catchSpy).toHaveBeenCalledTimes(1);
+ });
+
+ // This wrapper is always defined on IsomorphicClerk, so it cannot itself signal whether the
+ // loaded runtime supports the call. An older clerk-js has no such method, and calling straight
+ // through would throw a TypeError at a host caller instead of doing nothing.
+ it('does nothing when the loaded clerk-js predates __internal_resumeAfterProtectCheck', async () => {
+ const isomorphicClerk = new IsomorphicClerk({ publishableKey: 'pk_test_XXX' });
+
+ (isomorphicClerk as any).clerkjs = { loaded: true } as unknown as BrowserClerk;
+
+ await expect(
+ isomorphicClerk.__internal_resumeAfterProtectCheck({ continuation: 'transfer_to_sign_up' }),
+ ).resolves.toBeUndefined();
+ });
+
  it('calls __internal_handleResourceCallback immediately after clerk-js has loaded', async () => {
  const signInOrUp = {} as unknown as SignInResource;
  const params: HandleOAuthCallbackParams = { signInUrl: '/sign-in' };

.changeset/resume-oauth-transfer-after-protect-check.md

@@ -0,0 +1,8 @@
+---
+'@clerk/clerk-js': minor
+'@clerk/react': patch
+'@clerk/shared': minor
+'@clerk/ui': patch
+---
+
+Fixes an issue where OAuth account transfers that needed additional verification were returned to the beginning of sign-in.

packages/clerk-js/src/core/__tests__/clerk.test.ts

@@ -1850,6 +1850,220 @@ describe('Clerk singleton', () => {
  expect(mockNavigate).not.toHaveBeenCalled();
  });
 
+ describe('__internal_resumeAfterProtectCheck', () => {
+ // A verification challenge can interrupt an OAuth callback partway through routing. The
+ // challenge card clears it and hands control back here, from a page that is no longer
+ // the callback route, so the remaining routing has to run rather than start over.
+
+ const gatedTransferableSignIn = (extra: Record<string, unknown> = {}) =>
+ new SignIn({
+ status: 'needs_identifier',
+ first_factor_verification: {
+ status: 'transferable',
+ strategy: 'oauth_google',
+ external_verification_redirect_url: '',
+ error: {
+ code: 'external_account_not_found',
+ long_message: 'The External Account was not found.',
+ message: 'Invalid external account',
+ },
+ },
+ second_factor_verification: null,
+ identifier: '',
+ user_data: null,
+ created_session_id: null,
+ created_user_id: null,
+ ...extra,
+ } as any as SignInJSON);
+
+ const loadEnvironment = () =>
+ mockEnvironmentFetch.mockReturnValue(
+ Promise.resolve({
+ authConfig: {},
+ userSettings: mockUserSettings,
+ displayConfig: mockDisplayConfig,
+ isSingleSession: () => false,
+ isProduction: () => false,
+ isDevelopmentOrStaging: () => true,
+ onWindowLocationHost: () => false,
+ }),
+ );
+
+ it('completes the transfer as a SIGN-UP and activates the created session', async () => {
+ loadEnvironment();
+ mockClientFetch.mockReturnValue(
+ Promise.resolve({
+ signedInSessions: [],
+ signIn: gatedTransferableSignIn(),
+ signUp: new SignUp(null),
+ }),
+ );
+
+ const mockSetActive = vi.fn();
+ const mockSignUpCreate = vi
+ .fn()
+ .mockReturnValue(Promise.resolve({ status: 'complete', createdSessionId: '123' }));
+
+ const sut = new Clerk(productionPublishableKey);
+ await sut.load(mockedLoadOptions);
+ if (!sut.client) {
+ fail('we should always have a client');
+ }
+ sut.client.signUp.create = mockSignUpCreate;
+ sut.setActive = mockSetActive;
+
+ await sut.__internal_resumeAfterProtectCheck({ continuation: 'transfer_to_sign_up' });
+
+ await waitFor(() => {
+ expect(mockSignUpCreate).toHaveBeenCalledTimes(1);
+ expect(mockSignUpCreate).toHaveBeenCalledWith({ transfer: true, unsafeMetadata: undefined });
+ expect(mockSetActive).toHaveBeenCalledWith(expect.objectContaining({ session: '123' }));
+ });
+ });
+
+ it('completes the transfer even when the cleared response dropped the transferable marker', async () => {
+ // `SignIn.fromJSON` replaces `firstFactorVerification` wholesale on every write, so the
+ // caller latches the continuation before running the challenge and passes it explicitly.
+ // Re-reading it here would silently fall back to returning the user to sign-in.
+ loadEnvironment();
+ mockClientFetch.mockReturnValue(
+ Promise.resolve({
+ signedInSessions: [],
+ signIn: new SignIn({
+ status: 'needs_identifier',
+ first_factor_verification: null,
+ second_factor_verification: null,
+ identifier: '',
+ user_data: null,
+ created_session_id: null,
+ created_user_id: null,
+ } as any as SignInJSON),
+ signUp: new SignUp(null),
+ }),
+ );
+
+ const mockSignUpCreate = vi
+ .fn()
+ .mockReturnValue(Promise.resolve({ status: 'complete', createdSessionId: '123' }));
+
+ const sut = new Clerk(productionPublishableKey);
+ await sut.load(mockedLoadOptions);
+ if (!sut.client) {
+ fail('we should always have a client');
+ }
+ sut.client.signUp.create = mockSignUpCreate;
+ sut.setActive = vi.fn();
+
+ await sut.__internal_resumeAfterProtectCheck({ continuation: 'transfer_to_sign_up' });
+
+ await waitFor(() =>
+ expect(mockSignUpCreate).toHaveBeenCalledWith({ transfer: true, unsafeMetadata: undefined }),
+ );
+ });
+
+ it('does not divert to the sign-up card when a stale gate is on the sign-up resource', async () => {
+ // The sign-in variant below covers the first short-circuit; `resuming` skips a second one
+ // keyed on the SIGN-UP resource, and that is the arm that sends the user to a different
+ // card entirely rather than back to this one.
+ loadEnvironment();
+ mockClientFetch.mockReturnValue(
+ Promise.resolve({
+ signedInSessions: [],
+ signIn: gatedTransferableSignIn(),
+ signUp: new SignUp({
+ protect_check: { status: 'pending', token: 'stale-signup-token', sdk_url: 'https://example.com/sdk.js' },
+ } as any),
+ }),
+ );
+
+ const mockSignUpCreate = vi
+ .fn()
+ .mockReturnValue(Promise.resolve({ status: 'complete', createdSessionId: '123' }));
+
+ const sut = new Clerk(productionPublishableKey);
+ await sut.load(mockedLoadOptions);
+ if (!sut.client) {
+ fail('we should always have a client');
+ }
+ sut.client.signUp.create = mockSignUpCreate;
+ sut.setActive = vi.fn();
+
+ await sut.__internal_resumeAfterProtectCheck({ continuation: 'transfer_to_sign_up' });
+
+ await waitFor(() =>
+ expect(mockSignUpCreate).toHaveBeenCalledWith({ transfer: true, unsafeMetadata: undefined }),
+ );
+ expect(mockNavigate.mock.calls.some(([to]) => typeof to === 'string' && to.includes('protect-check'))).toBe(
+ false,
+ );
+ });
+
+ it('does not bounce back into the challenge when a stale gate is still on the resource', async () => {
+ // This is the test that proves `resuming` is load-bearing rather than decorative. The
+ // caller IS the challenge card; re-checking the gate here would hand control straight
+ // back to it, or — through the sign-up arm — to the wrong card entirely.
+ loadEnvironment();
+ mockClientFetch.mockReturnValue(
+ Promise.resolve({
+ signedInSessions: [],
+ signIn: gatedTransferableSignIn({
+ protect_check: { status: 'pending', token: 'stale-token', sdk_url: 'https://example.com/sdk.js' },
+ }),
+ signUp: new SignUp(null),
+ }),
+ );
+
+ const mockSignUpCreate = vi
+ .fn()
+ .mockReturnValue(Promise.resolve({ status: 'complete', createdSessionId: '123' }));
+
+ const sut = new Clerk(productionPublishableKey);
+ await sut.load(mockedLoadOptions);
+ if (!sut.client) {
+ fail('we should always have a client');
+ }
+ sut.client.signUp.create = mockSignUpCreate;
+ sut.setActive = vi.fn();
+
+ await sut.__internal_resumeAfterProtectCheck({ continuation: 'transfer_to_sign_up' });
+
+ await waitFor(() =>
+ expect(mockSignUpCreate).toHaveBeenCalledWith({ transfer: true, unsafeMetadata: undefined }),
+ );
+ expect(mockNavigate.mock.calls.some(([to]) => typeof to === 'string' && to.includes('protect-check'))).toBe(
+ false,
+ );
+ });
+
+ it('still honours transferable: false', async () => {
+ loadEnvironment();
+ mockClientFetch.mockReturnValue(
+ Promise.resolve({
+ signedInSessions: [],
+ signIn: gatedTransferableSignIn(),
+ signUp: new SignUp(null),
+ }),
+ );
+
+ const mockSignUpCreate = vi.fn();
+
+ const sut = new Clerk(productionPublishableKey);
+ await sut.load(mockedLoadOptions);
+ if (!sut.client) {
+ fail('we should always have a client');
+ }
+ sut.client.signUp.create = mockSignUpCreate;
+ sut.setActive = vi.fn();
+
+ await sut.__internal_resumeAfterProtectCheck({
+ continuation: 'transfer_to_sign_up',
+ transferable: false,
+ });
+
+ await waitFor(() => expect(mockSignUpCreate).not.toHaveBeenCalled());
+ });
+ });
+
  it('does not initiate the transfer flow when transferable: false is passed', async () => {
  mockEnvironmentFetch.mockReturnValue(
  Promise.resolve({

packages/clerk-js/src/core/clerk.ts

@@ -112,6 +112,7 @@ import type {
  PublicKeyCredentialWithAuthenticatorAttestationResponse,
  RedirectOptions,
  Resources,
+ ResumeAfterProtectCheckParams,
  SDKMetadata,
  SessionResource,
  SessionTouchParams,
@@ -2450,15 +2451,17 @@ export class Clerk implements ClerkInterface {
  };
 
  private _handleRedirectCallback = async (
- params: HandleOAuthCallbackParams,
+ params: ResumeAfterProtectCheckParams,
  {
  signIn,
  signUp,
  navigate,
+ resuming = false,
  }: {
  signIn: SignInResource;
  signUp: SignUpResource;
  navigate: (to: string) => Promise<unknown>;
+ resuming?: boolean;
  },
  ): Promise<unknown> => {
  if (!this.loaded || !this.environment || !this.client) {
@@ -2602,14 +2605,14 @@ export class Clerk implements ClerkInterface {
  // sign-in's challenge. We only consult `si` here unless this is explicitly a sign-up callback.
  // Transfers are unaffected: the `signIn.create({ transfer })` path below checks its own fresh
  // response for the gate.
- if (params.reloadResource !== 'signUp' && (si.protectCheck || si.status === 'needs_protect_check')) {
+ if (!resuming && params.reloadResource !== 'signUp' && (si.protectCheck || si.status === 'needs_protect_check')) {
  return navigateToSignInProtectCheck();
  }
 
  // The sign-up resource can be gated the same way (e.g. a callback that resolves straight into a
  // gated sign-up). Scope to the sign-up intent for the symmetric reason — a stale sign-up's gate
  // shouldn't hijack a sign-in callback.
- if (params.reloadResource !== 'signIn' && su.protectCheck) {
+ if (!resuming && params.reloadResource !== 'signIn' && su.protectCheck) {
  return navigateToSignUpProtectCheck();
  }
 
@@ -2669,7 +2672,8 @@ export class Clerk implements ClerkInterface {
  return navigateToResetPassword();
  }
 
- const userNeedsToBeCreated = si.firstFactorVerificationStatus === 'transferable';
+ const userNeedsToBeCreated =
+ si.firstFactorVerificationStatus === 'transferable' || params.continuation === 'transfer_to_sign_up';
 
  if (userNeedsToBeCreated) {
  if (params.transferable === false) {
@@ -2772,6 +2776,27 @@ export class Clerk implements ClerkInterface {
  return navigateToSignIn();
  };
 
+ public __internal_resumeAfterProtectCheck = async (
+ params: ResumeAfterProtectCheckParams = {},
+ customNavigate?: (to: string) => Promise<unknown>,
+ ): Promise<unknown> => {
+ if (!this.loaded || !this.environment || !this.client) {
+ return;
+ }
+ const { signIn, signUp } = this.client;
+
+ const resolvedNavigate = customNavigate ?? params.__internal_navigate;
+ const navigate = (to: string) =>
+ resolvedNavigate && typeof resolvedNavigate === 'function' ? resolvedNavigate(to) : this.navigate(to);
+
+ return this._handleRedirectCallback(params, {
+ signUp,
+ signIn,
+ navigate,
+ resuming: true,
+ });
+ };
+
  public handleRedirectCallback = async (
  params: HandleOAuthCallbackParams = {},
  customNavigate?: (to: string) => Promise<unknown>,

packages/react/src/__tests__/isomorphicClerk.test.ts

@@ -178,6 +178,70 @@ describe('isomorphicClerk', () => {
  expect(handleResourceCallback).toHaveBeenCalledWith(signInOrUp, params, customNavigate);
  });
 
+ // Regression: a call queued before clerk-js loads is replayed by
+ // `replayInterceptedInvocations`, whose loop discards whatever its callbacks
+ // return. The queued copy therefore has no caller left to reject to -- the
+ // original `await` resolved the moment the call was queued -- so without its
+ // own rejection handler a failed resume becomes an unhandled rejection in the
+ // host app. Asserting that `catch` is attached, rather than waiting for the
+ // symptom, keeps the check deterministic under fake timers.
+ it('attaches a rejection handler to __internal_resumeAfterProtectCheck when it is queued until clerk-js has loaded', async () => {
+ const params = { continuation: 'transfer_to_sign_up' } as const;
+ const catchSpy = vi.fn();
+ const resumeAfterProtectCheck = vi.fn().mockReturnValue({ catch: catchSpy });
+ const clerkjs = {
+ addListener: vi.fn(),
+ loaded: true,
+ __internal_resumeAfterProtectCheck: resumeAfterProtectCheck,
+ } as unknown as BrowserClerk;
+ const isomorphicClerk = new IsomorphicClerk({ publishableKey: 'pk_test_XXX' });
+
+ const customNavigate = vi.fn();
+
+ await isomorphicClerk.__internal_resumeAfterProtectCheck(params, customNavigate);
+
+ expect(resumeAfterProtectCheck).not.toHaveBeenCalled();
+
+ (isomorphicClerk as any).replayInterceptedInvocations(clerkjs);
+
+ expect(resumeAfterProtectCheck).toHaveBeenCalledWith(params, customNavigate);
+ expect(catchSpy).toHaveBeenCalledTimes(1);
+ });
+
+ it('attaches a rejection handler to __internal_resumeAfterProtectCheck after clerk-js has loaded', async () => {
+ const params = { continuation: 'transfer_to_sign_up' } as const;
+ const catchSpy = vi.fn();
+ const resumeAfterProtectCheck = vi.fn().mockReturnValue({ catch: catchSpy });
+ const isomorphicClerk = new IsomorphicClerk({ publishableKey: 'pk_test_XXX' });
+
+ (isomorphicClerk as any).clerkjs = {
+ loaded: true,
+ __internal_resumeAfterProtectCheck: resumeAfterProtectCheck,
+ } as unknown as BrowserClerk;
+
+ const customNavigate = vi.fn();
+
+ await isomorphicClerk.__internal_resumeAfterProtectCheck(params, customNavigate);
+
+ // The navigator is the component router's; dropping it falls back to Clerk.navigate,
+ // which resolves component-relative destinations against the origin instead.
+ expect(resumeAfterProtectCheck).toHaveBeenCalledWith(params, customNavigate);
+ expect(catchSpy).toHaveBeenCalledTimes(1);
+ });
+
+ // This wrapper is always defined on IsomorphicClerk, so it cannot itself signal whether the
+ // loaded runtime supports the call. An older clerk-js has no such method, and calling straight
+ // through would throw a TypeError at a host caller instead of doing nothing.
+ it('does nothing when the loaded clerk-js predates __internal_resumeAfterProtectCheck', async () => {
+ const isomorphicClerk = new IsomorphicClerk({ publishableKey: 'pk_test_XXX' });
+
+ (isomorphicClerk as any).clerkjs = { loaded: true } as unknown as BrowserClerk;
+
+ await expect(
+ isomorphicClerk.__internal_resumeAfterProtectCheck({ continuation: 'transfer_to_sign_up' }),
+ ).resolves.toBeUndefined();
+ });
+
  it('calls __internal_handleResourceCallback immediately after clerk-js has loaded', async () => {
  const signInOrUp = {} as unknown as SignInResource;
  const params: HandleOAuthCallbackParams = { signInUrl: '/sign-in' };

.changeset/resume-oauth-transfer-after-protect-check.md

@@ -0,0 +1,8 @@
+---
+'@clerk/clerk-js': minor
+'@clerk/react': patch
+'@clerk/shared': minor
+'@clerk/ui': patch
+---
+
+Fixes an issue where OAuth account transfers that needed additional verification were returned to the beginning of sign-in.

packages/clerk-js/src/core/__tests__/clerk.test.ts

@@ -1850,6 +1850,220 @@ describe('Clerk singleton', () => {
  expect(mockNavigate).not.toHaveBeenCalled();
  });
 
+ describe('__internal_resumeAfterProtectCheck', () => {
+ // A verification challenge can interrupt an OAuth callback partway through routing. The
+ // challenge card clears it and hands control back here, from a page that is no longer
+ // the callback route, so the remaining routing has to run rather than start over.
+
+ const gatedTransferableSignIn = (extra: Record<string, unknown> = {}) =>
+ new SignIn({
+ status: 'needs_identifier',
+ first_factor_verification: {
+ status: 'transferable',
+ strategy: 'oauth_google',
+ external_verification_redirect_url: '',
+ error: {
+ code: 'external_account_not_found',
+ long_message: 'The External Account was not found.',
+ message: 'Invalid external account',
+ },
+ },
+ second_factor_verification: null,
+ identifier: '',
+ user_data: null,
+ created_session_id: null,
+ created_user_id: null,
+ ...extra,
+ } as any as SignInJSON);
+
+ const loadEnvironment = () =>
+ mockEnvironmentFetch.mockReturnValue(
+ Promise.resolve({
+ authConfig: {},
+ userSettings: mockUserSettings,
+ displayConfig: mockDisplayConfig,
+ isSingleSession: () => false,
+ isProduction: () => false,
+ isDevelopmentOrStaging: () => true,
+ onWindowLocationHost: () => false,
+ }),
+ );
+
+ it('completes the transfer as a SIGN-UP and activates the created session', async () => {
+ loadEnvironment();
+ mockClientFetch.mockReturnValue(
+ Promise.resolve({
+ signedInSessions: [],
+ signIn: gatedTransferableSignIn(),
+ signUp: new SignUp(null),
+ }),
+ );
+
+ const mockSetActive = vi.fn();
+ const mockSignUpCreate = vi
+ .fn()
+ .mockReturnValue(Promise.resolve({ status: 'complete', createdSessionId: '123' }));
+
+ const sut = new Clerk(productionPublishableKey);
+ await sut.load(mockedLoadOptions);
+ if (!sut.client) {
+ fail('we should always have a client');
+ }
+ sut.client.signUp.create = mockSignUpCreate;
+ sut.setActive = mockSetActive;
+
+ await sut.__internal_resumeAfterProtectCheck({ continuation: 'transfer_to_sign_up' });
+
+ await waitFor(() => {
+ expect(mockSignUpCreate).toHaveBeenCalledTimes(1);
+ expect(mockSignUpCreate).toHaveBeenCalledWith({ transfer: true, unsafeMetadata: undefined });
+ expect(mockSetActive).toHaveBeenCalledWith(expect.objectContaining({ session: '123' }));
+ });
+ });
+
+ it('completes the transfer even when the cleared response dropped the transferable marker', async () => {
+ // `SignIn.fromJSON` replaces `firstFactorVerification` wholesale on every write, so the
+ // caller latches the continuation before running the challenge and passes it explicitly.
+ // Re-reading it here would silently fall back to returning the user to sign-in.
+ loadEnvironment();
+ mockClientFetch.mockReturnValue(
+ Promise.resolve({
+ signedInSessions: [],
+ signIn: new SignIn({
+ status: 'needs_identifier',
+ first_factor_verification: null,
+ second_factor_verification: null,
+ identifier: '',
+ user_data: null,
+ created_session_id: null,
+ created_user_id: null,
+ } as any as SignInJSON),
+ signUp: new SignUp(null),
+ }),
+ );
+
+ const mockSignUpCreate = vi
+ .fn()
+ .mockReturnValue(Promise.resolve({ status: 'complete', createdSessionId: '123' }));
+
+ const sut = new Clerk(productionPublishableKey);
+ await sut.load(mockedLoadOptions);
+ if (!sut.client) {
+ fail('we should always have a client');
+ }
+ sut.client.signUp.create = mockSignUpCreate;
+ sut.setActive = vi.fn();
+
+ await sut.__internal_resumeAfterProtectCheck({ continuation: 'transfer_to_sign_up' });
+
+ await waitFor(() =>
+ expect(mockSignUpCreate).toHaveBeenCalledWith({ transfer: true, unsafeMetadata: undefined }),
+ );
+ });
+
+ it('does not divert to the sign-up card when a stale gate is on the sign-up resource', async () => {
+ // The sign-in variant below covers the first short-circuit; `resuming` skips a second one
+ // keyed on the SIGN-UP resource, and that is the arm that sends the user to a different
+ // card entirely rather than back to this one.
+ loadEnvironment();
+ mockClientFetch.mockReturnValue(
+ Promise.resolve({
+ signedInSessions: [],
+ signIn: gatedTransferableSignIn(),
+ signUp: new SignUp({
+ protect_check: { status: 'pending', token: 'stale-signup-token', sdk_url: 'https://example.com/sdk.js' },
+ } as any),
+ }),
+ );
+
+ const mockSignUpCreate = vi
+ .fn()
+ .mockReturnValue(Promise.resolve({ status: 'complete', createdSessionId: '123' }));
+
+ const sut = new Clerk(productionPublishableKey);
+ await sut.load(mockedLoadOptions);
+ if (!sut.client) {
+ fail('we should always have a client');
+ }
+ sut.client.signUp.create = mockSignUpCreate;
+ sut.setActive = vi.fn();
+
+ await sut.__internal_resumeAfterProtectCheck({ continuation: 'transfer_to_sign_up' });
+
+ await waitFor(() =>
+ expect(mockSignUpCreate).toHaveBeenCalledWith({ transfer: true, unsafeMetadata: undefined }),
+ );
+ expect(mockNavigate.mock.calls.some(([to]) => typeof to === 'string' && to.includes('protect-check'))).toBe(
+ false,
+ );
+ });
+
+ it('does not bounce back into the challenge when a stale gate is still on the resource', async () => {
+ // This is the test that proves `resuming` is load-bearing rather than decorative. The
+ // caller IS the challenge card; re-checking the gate here would hand control straight
+ // back to it, or — through the sign-up arm — to the wrong card entirely.
+ loadEnvironment();
+ mockClientFetch.mockReturnValue(
+ Promise.resolve({
+ signedInSessions: [],
+ signIn: gatedTransferableSignIn({
+ protect_check: { status: 'pending', token: 'stale-token', sdk_url: 'https://example.com/sdk.js' },
+ }),
+ signUp: new SignUp(null),
+ }),
+ );
+
+ const mockSignUpCreate = vi
+ .fn()
+ .mockReturnValue(Promise.resolve({ status: 'complete', createdSessionId: '123' }));
+
+ const sut = new Clerk(productionPublishableKey);
+ await sut.load(mockedLoadOptions);
+ if (!sut.client) {
+ fail('we should always have a client');
+ }
+ sut.client.signUp.create = mockSignUpCreate;
+ sut.setActive = vi.fn();
+
+ await sut.__internal_resumeAfterProtectCheck({ continuation: 'transfer_to_sign_up' });
+
+ await waitFor(() =>
+ expect(mockSignUpCreate).toHaveBeenCalledWith({ transfer: true, unsafeMetadata: undefined }),
+ );
+ expect(mockNavigate.mock.calls.some(([to]) => typeof to === 'string' && to.includes('protect-check'))).toBe(
+ false,
+ );
+ });
+
+ it('still honours transferable: false', async () => {
+ loadEnvironment();
+ mockClientFetch.mockReturnValue(
+ Promise.resolve({
+ signedInSessions: [],
+ signIn: gatedTransferableSignIn(),
+ signUp: new SignUp(null),
+ }),
+ );
+
+ const mockSignUpCreate = vi.fn();
+
+ const sut = new Clerk(productionPublishableKey);
+ await sut.load(mockedLoadOptions);
+ if (!sut.client) {
+ fail('we should always have a client');
+ }
+ sut.client.signUp.create = mockSignUpCreate;
+ sut.setActive = vi.fn();
+
+ await sut.__internal_resumeAfterProtectCheck({
+ continuation: 'transfer_to_sign_up',
+ transferable: false,
+ });
+
+ await waitFor(() => expect(mockSignUpCreate).not.toHaveBeenCalled());
+ });
+ });
+
  it('does not initiate the transfer flow when transferable: false is passed', async () => {
  mockEnvironmentFetch.mockReturnValue(
  Promise.resolve({

packages/clerk-js/src/core/clerk.ts

@@ -112,6 +112,7 @@ import type {
  PublicKeyCredentialWithAuthenticatorAttestationResponse,
  RedirectOptions,
  Resources,
+ ResumeAfterProtectCheckParams,
  SDKMetadata,
  SessionResource,
  SessionTouchParams,
@@ -2450,15 +2451,17 @@ export class Clerk implements ClerkInterface {
  };
 
  private _handleRedirectCallback = async (
- params: HandleOAuthCallbackParams,
+ params: ResumeAfterProtectCheckParams,
  {
  signIn,
  signUp,
  navigate,
+ resuming = false,
  }: {
  signIn: SignInResource;
  signUp: SignUpResource;
  navigate: (to: string) => Promise<unknown>;
+ resuming?: boolean;
  },
  ): Promise<unknown> => {
  if (!this.loaded || !this.environment || !this.client) {
@@ -2602,14 +2605,14 @@ export class Clerk implements ClerkInterface {
  // sign-in's challenge. We only consult `si` here unless this is explicitly a sign-up callback.
  // Transfers are unaffected: the `signIn.create({ transfer })` path below checks its own fresh
  // response for the gate.
- if (params.reloadResource !== 'signUp' && (si.protectCheck || si.status === 'needs_protect_check')) {
+ if (!resuming && params.reloadResource !== 'signUp' && (si.protectCheck || si.status === 'needs_protect_check')) {
  return navigateToSignInProtectCheck();
  }
 
  // The sign-up resource can be gated the same way (e.g. a callback that resolves straight into a
  // gated sign-up). Scope to the sign-up intent for the symmetric reason — a stale sign-up's gate
  // shouldn't hijack a sign-in callback.
- if (params.reloadResource !== 'signIn' && su.protectCheck) {
+ if (!resuming && params.reloadResource !== 'signIn' && su.protectCheck) {
  return navigateToSignUpProtectCheck();
  }
 
@@ -2669,7 +2672,8 @@ export class Clerk implements ClerkInterface {
  return navigateToResetPassword();
  }
 
- const userNeedsToBeCreated = si.firstFactorVerificationStatus === 'transferable';
+ const userNeedsToBeCreated =
+ si.firstFactorVerificationStatus === 'transferable' || params.continuation === 'transfer_to_sign_up';
 
  if (userNeedsToBeCreated) {
  if (params.transferable === false) {
@@ -2772,6 +2776,27 @@ export class Clerk implements ClerkInterface {
  return navigateToSignIn();
  };
 
+ public __internal_resumeAfterProtectCheck = async (
+ params: ResumeAfterProtectCheckParams = {},
+ customNavigate?: (to: string) => Promise<unknown>,
+ ): Promise<unknown> => {
+ if (!this.loaded || !this.environment || !this.client) {
+ return;
+ }
+ const { signIn, signUp } = this.client;
+
+ const resolvedNavigate = customNavigate ?? params.__internal_navigate;
+ const navigate = (to: string) =>
+ resolvedNavigate && typeof resolvedNavigate === 'function' ? resolvedNavigate(to) : this.navigate(to);
+
+ return this._handleRedirectCallback(params, {
+ signUp,
+ signIn,
+ navigate,
+ resuming: true,
+ });
+ };
+
  public handleRedirectCallback = async (
  params: HandleOAuthCallbackParams = {},
  customNavigate?: (to: string) => Promise<unknown>,

packages/react/src/__tests__/isomorphicClerk.test.ts

@@ -178,6 +178,70 @@ describe('isomorphicClerk', () => {
  expect(handleResourceCallback).toHaveBeenCalledWith(signInOrUp, params, customNavigate);
  });
 
+ // Regression: a call queued before clerk-js loads is replayed by
+ // `replayInterceptedInvocations`, whose loop discards whatever its callbacks
+ // return. The queued copy therefore has no caller left to reject to -- the
+ // original `await` resolved the moment the call was queued -- so without its
+ // own rejection handler a failed resume becomes an unhandled rejection in the
+ // host app. Asserting that `catch` is attached, rather than waiting for the
+ // symptom, keeps the check deterministic under fake timers.
+ it('attaches a rejection handler to __internal_resumeAfterProtectCheck when it is queued until clerk-js has loaded', async () => {
+ const params = { continuation: 'transfer_to_sign_up' } as const;
+ const catchSpy = vi.fn();
+ const resumeAfterProtectCheck = vi.fn().mockReturnValue({ catch: catchSpy });
+ const clerkjs = {
+ addListener: vi.fn(),
+ loaded: true,
+ __internal_resumeAfterProtectCheck: resumeAfterProtectCheck,
+ } as unknown as BrowserClerk;
+ const isomorphicClerk = new IsomorphicClerk({ publishableKey: 'pk_test_XXX' });
+
+ const customNavigate = vi.fn();
+
+ await isomorphicClerk.__internal_resumeAfterProtectCheck(params, customNavigate);
+
+ expect(resumeAfterProtectCheck).not.toHaveBeenCalled();
+
+ (isomorphicClerk as any).replayInterceptedInvocations(clerkjs);
+
+ expect(resumeAfterProtectCheck).toHaveBeenCalledWith(params, customNavigate);
+ expect(catchSpy).toHaveBeenCalledTimes(1);
+ });
+
+ it('attaches a rejection handler to __internal_resumeAfterProtectCheck after clerk-js has loaded', async () => {
+ const params = { continuation: 'transfer_to_sign_up' } as const;
+ const catchSpy = vi.fn();
+ const resumeAfterProtectCheck = vi.fn().mockReturnValue({ catch: catchSpy });
+ const isomorphicClerk = new IsomorphicClerk({ publishableKey: 'pk_test_XXX' });
+
+ (isomorphicClerk as any).clerkjs = {
+ loaded: true,
+ __internal_resumeAfterProtectCheck: resumeAfterProtectCheck,
+ } as unknown as BrowserClerk;
+
+ const customNavigate = vi.fn();
+
+ await isomorphicClerk.__internal_resumeAfterProtectCheck(params, customNavigate);
+
+ // The navigator is the component router's; dropping it falls back to Clerk.navigate,
+ // which resolves component-relative destinations against the origin instead.
+ expect(resumeAfterProtectCheck).toHaveBeenCalledWith(params, customNavigate);
+ expect(catchSpy).toHaveBeenCalledTimes(1);
+ });
+
+ // This wrapper is always defined on IsomorphicClerk, so it cannot itself signal whether the
+ // loaded runtime supports the call. An older clerk-js has no such method, and calling straight
+ // through would throw a TypeError at a host caller instead of doing nothing.
+ it('does nothing when the loaded clerk-js predates __internal_resumeAfterProtectCheck', async () => {
+ const isomorphicClerk = new IsomorphicClerk({ publishableKey: 'pk_test_XXX' });
+
+ (isomorphicClerk as any).clerkjs = { loaded: true } as unknown as BrowserClerk;
+
+ await expect(
+ isomorphicClerk.__internal_resumeAfterProtectCheck({ continuation: 'transfer_to_sign_up' }),
+ ).resolves.toBeUndefined();
+ });
+
  it('calls __internal_handleResourceCallback immediately after clerk-js has loaded', async () => {
  const signInOrUp = {} as unknown as SignInResource;
  const params: HandleOAuthCallbackParams = { signInUrl: '/sign-in' };

.changeset/resume-oauth-transfer-after-protect-check.md

@@ -0,0 +1,8 @@
+---
+'@clerk/clerk-js': minor
+'@clerk/react': patch
+'@clerk/shared': minor
+'@clerk/ui': patch
+---
+
+Fixes an issue where OAuth account transfers that needed additional verification were returned to the beginning of sign-in.

packages/clerk-js/src/core/__tests__/clerk.test.ts

@@ -1850,6 +1850,220 @@ describe('Clerk singleton', () => {
  expect(mockNavigate).not.toHaveBeenCalled();
  });
 
+ describe('__internal_resumeAfterProtectCheck', () => {
+ // A verification challenge can interrupt an OAuth callback partway through routing. The
+ // challenge card clears it and hands control back here, from a page that is no longer
+ // the callback route, so the remaining routing has to run rather than start over.
+
+ const gatedTransferableSignIn = (extra: Record<string, unknown> = {}) =>
+ new SignIn({
+ status: 'needs_identifier',
+ first_factor_verification: {
+ status: 'transferable',
+ strategy: 'oauth_google',
+ external_verification_redirect_url: '',
+ error: {
+ code: 'external_account_not_found',
+ long_message: 'The External Account was not found.',
+ message: 'Invalid external account',
+ },
+ },
+ second_factor_verification: null,
+ identifier: '',
+ user_data: null,
+ created_session_id: null,
+ created_user_id: null,
+ ...extra,
+ } as any as SignInJSON);
+
+ const loadEnvironment = () =>
+ mockEnvironmentFetch.mockReturnValue(
+ Promise.resolve({
+ authConfig: {},
+ userSettings: mockUserSettings,
+ displayConfig: mockDisplayConfig,
+ isSingleSession: () => false,
+ isProduction: () => false,
+ isDevelopmentOrStaging: () => true,
+ onWindowLocationHost: () => false,
+ }),
+ );
+
+ it('completes the transfer as a SIGN-UP and activates the created session', async () => {
+ loadEnvironment();
+ mockClientFetch.mockReturnValue(
+ Promise.resolve({
+ signedInSessions: [],
+ signIn: gatedTransferableSignIn(),
+ signUp: new SignUp(null),
+ }),
+ );
+
+ const mockSetActive = vi.fn();
+ const mockSignUpCreate = vi
+ .fn()
+ .mockReturnValue(Promise.resolve({ status: 'complete', createdSessionId: '123' }));
+
+ const sut = new Clerk(productionPublishableKey);
+ await sut.load(mockedLoadOptions);
+ if (!sut.client) {
+ fail('we should always have a client');
+ }
+ sut.client.signUp.create = mockSignUpCreate;
+ sut.setActive = mockSetActive;
+
+ await sut.__internal_resumeAfterProtectCheck({ continuation: 'transfer_to_sign_up' });
+
+ await waitFor(() => {
+ expect(mockSignUpCreate).toHaveBeenCalledTimes(1);
+ expect(mockSignUpCreate).toHaveBeenCalledWith({ transfer: true, unsafeMetadata: undefined });
+ expect(mockSetActive).toHaveBeenCalledWith(expect.objectContaining({ session: '123' }));
+ });
+ });
+
+ it('completes the transfer even when the cleared response dropped the transferable marker', async () => {
+ // `SignIn.fromJSON` replaces `firstFactorVerification` wholesale on every write, so the
+ // caller latches the continuation before running the challenge and passes it explicitly.
+ // Re-reading it here would silently fall back to returning the user to sign-in.
+ loadEnvironment();
+ mockClientFetch.mockReturnValue(
+ Promise.resolve({
+ signedInSessions: [],
+ signIn: new SignIn({
+ status: 'needs_identifier',
+ first_factor_verification: null,
+ second_factor_verification: null,
+ identifier: '',
+ user_data: null,
+ created_session_id: null,
+ created_user_id: null,
+ } as any as SignInJSON),
+ signUp: new SignUp(null),
+ }),
+ );
+
+ const mockSignUpCreate = vi
+ .fn()
+ .mockReturnValue(Promise.resolve({ status: 'complete', createdSessionId: '123' }));
+
+ const sut = new Clerk(productionPublishableKey);
+ await sut.load(mockedLoadOptions);
+ if (!sut.client) {
+ fail('we should always have a client');
+ }
+ sut.client.signUp.create = mockSignUpCreate;
+ sut.setActive = vi.fn();
+
+ await sut.__internal_resumeAfterProtectCheck({ continuation: 'transfer_to_sign_up' });
+
+ await waitFor(() =>
+ expect(mockSignUpCreate).toHaveBeenCalledWith({ transfer: true, unsafeMetadata: undefined }),
+ );
+ });
+
+ it('does not divert to the sign-up card when a stale gate is on the sign-up resource', async () => {
+ // The sign-in variant below covers the first short-circuit; `resuming` skips a second one
+ // keyed on the SIGN-UP resource, and that is the arm that sends the user to a different
+ // card entirely rather than back to this one.
+ loadEnvironment();
+ mockClientFetch.mockReturnValue(
+ Promise.resolve({
+ signedInSessions: [],
+ signIn: gatedTransferableSignIn(),
+ signUp: new SignUp({
+ protect_check: { status: 'pending', token: 'stale-signup-token', sdk_url: 'https://example.com/sdk.js' },
+ } as any),
+ }),
+ );
+
+ const mockSignUpCreate = vi
+ .fn()
+ .mockReturnValue(Promise.resolve({ status: 'complete', createdSessionId: '123' }));
+
+ const sut = new Clerk(productionPublishableKey);
+ await sut.load(mockedLoadOptions);
+ if (!sut.client) {
+ fail('we should always have a client');
+ }
+ sut.client.signUp.create = mockSignUpCreate;
+ sut.setActive = vi.fn();
+
+ await sut.__internal_resumeAfterProtectCheck({ continuation: 'transfer_to_sign_up' });
+
+ await waitFor(() =>
+ expect(mockSignUpCreate).toHaveBeenCalledWith({ transfer: true, unsafeMetadata: undefined }),
+ );
+ expect(mockNavigate.mock.calls.some(([to]) => typeof to === 'string' && to.includes('protect-check'))).toBe(
+ false,
+ );
+ });
+
+ it('does not bounce back into the challenge when a stale gate is still on the resource', async () => {
+ // This is the test that proves `resuming` is load-bearing rather than decorative. The
+ // caller IS the challenge card; re-checking the gate here would hand control straight
+ // back to it, or — through the sign-up arm — to the wrong card entirely.
+ loadEnvironment();
+ mockClientFetch.mockReturnValue(
+ Promise.resolve({
+ signedInSessions: [],
+ signIn: gatedTransferableSignIn({
+ protect_check: { status: 'pending', token: 'stale-token', sdk_url: 'https://example.com/sdk.js' },
+ }),
+ signUp: new SignUp(null),
+ }),
+ );
+
+ const mockSignUpCreate = vi
+ .fn()
+ .mockReturnValue(Promise.resolve({ status: 'complete', createdSessionId: '123' }));
+
+ const sut = new Clerk(productionPublishableKey);
+ await sut.load(mockedLoadOptions);
+ if (!sut.client) {
+ fail('we should always have a client');
+ }
+ sut.client.signUp.create = mockSignUpCreate;
+ sut.setActive = vi.fn();
+
+ await sut.__internal_resumeAfterProtectCheck({ continuation: 'transfer_to_sign_up' });
+
+ await waitFor(() =>
+ expect(mockSignUpCreate).toHaveBeenCalledWith({ transfer: true, unsafeMetadata: undefined }),
+ );
+ expect(mockNavigate.mock.calls.some(([to]) => typeof to === 'string' && to.includes('protect-check'))).toBe(
+ false,
+ );
+ });
+
+ it('still honours transferable: false', async () => {
+ loadEnvironment();
+ mockClientFetch.mockReturnValue(
+ Promise.resolve({
+ signedInSessions: [],
+ signIn: gatedTransferableSignIn(),
+ signUp: new SignUp(null),
+ }),
+ );
+
+ const mockSignUpCreate = vi.fn();
+
+ const sut = new Clerk(productionPublishableKey);
+ await sut.load(mockedLoadOptions);
+ if (!sut.client) {
+ fail('we should always have a client');
+ }
+ sut.client.signUp.create = mockSignUpCreate;
+ sut.setActive = vi.fn();
+
+ await sut.__internal_resumeAfterProtectCheck({
+ continuation: 'transfer_to_sign_up',
+ transferable: false,
+ });
+
+ await waitFor(() => expect(mockSignUpCreate).not.toHaveBeenCalled());
+ });
+ });
+
  it('does not initiate the transfer flow when transferable: false is passed', async () => {
  mockEnvironmentFetch.mockReturnValue(
  Promise.resolve({

packages/clerk-js/src/core/clerk.ts

@@ -112,6 +112,7 @@ import type {
  PublicKeyCredentialWithAuthenticatorAttestationResponse,
  RedirectOptions,
  Resources,
+ ResumeAfterProtectCheckParams,
  SDKMetadata,
  SessionResource,
  SessionTouchParams,
@@ -2450,15 +2451,17 @@ export class Clerk implements ClerkInterface {
  };
 
  private _handleRedirectCallback = async (
- params: HandleOAuthCallbackParams,
+ params: ResumeAfterProtectCheckParams,
  {
  signIn,
  signUp,
  navigate,
+ resuming = false,
  }: {
  signIn: SignInResource;
  signUp: SignUpResource;
  navigate: (to: string) => Promise<unknown>;
+ resuming?: boolean;
  },
  ): Promise<unknown> => {
  if (!this.loaded || !this.environment || !this.client) {
@@ -2602,14 +2605,14 @@ export class Clerk implements ClerkInterface {
  // sign-in's challenge. We only consult `si` here unless this is explicitly a sign-up callback.
  // Transfers are unaffected: the `signIn.create({ transfer })` path below checks its own fresh
  // response for the gate.
- if (params.reloadResource !== 'signUp' && (si.protectCheck || si.status === 'needs_protect_check')) {
+ if (!resuming && params.reloadResource !== 'signUp' && (si.protectCheck || si.status === 'needs_protect_check')) {
  return navigateToSignInProtectCheck();
  }
 
  // The sign-up resource can be gated the same way (e.g. a callback that resolves straight into a
  // gated sign-up). Scope to the sign-up intent for the symmetric reason — a stale sign-up's gate
  // shouldn't hijack a sign-in callback.
- if (params.reloadResource !== 'signIn' && su.protectCheck) {
+ if (!resuming && params.reloadResource !== 'signIn' && su.protectCheck) {
  return navigateToSignUpProtectCheck();
  }
 
@@ -2669,7 +2672,8 @@ export class Clerk implements ClerkInterface {
  return navigateToResetPassword();
  }
 
- const userNeedsToBeCreated = si.firstFactorVerificationStatus === 'transferable';
+ const userNeedsToBeCreated =
+ si.firstFactorVerificationStatus === 'transferable' || params.continuation === 'transfer_to_sign_up';
 
  if (userNeedsToBeCreated) {
  if (params.transferable === false) {
@@ -2772,6 +2776,27 @@ export class Clerk implements ClerkInterface {
  return navigateToSignIn();
  };
 
+ public __internal_resumeAfterProtectCheck = async (
+ params: ResumeAfterProtectCheckParams = {},
+ customNavigate?: (to: string) => Promise<unknown>,
+ ): Promise<unknown> => {
+ if (!this.loaded || !this.environment || !this.client) {
+ return;
+ }
+ const { signIn, signUp } = this.client;
+
+ const resolvedNavigate = customNavigate ?? params.__internal_navigate;
+ const navigate = (to: string) =>
+ resolvedNavigate && typeof resolvedNavigate === 'function' ? resolvedNavigate(to) : this.navigate(to);
+
+ return this._handleRedirectCallback(params, {
+ signUp,
+ signIn,
+ navigate,
+ resuming: true,
+ });
+ };
+
  public handleRedirectCallback = async (
  params: HandleOAuthCallbackParams = {},
  customNavigate?: (to: string) => Promise<unknown>,

packages/react/src/__tests__/isomorphicClerk.test.ts

@@ -178,6 +178,70 @@ describe('isomorphicClerk', () => {
  expect(handleResourceCallback).toHaveBeenCalledWith(signInOrUp, params, customNavigate);
  });
 
+ // Regression: a call queued before clerk-js loads is replayed by
+ // `replayInterceptedInvocations`, whose loop discards whatever its callbacks
+ // return. The queued copy therefore has no caller left to reject to -- the
+ // original `await` resolved the moment the call was queued -- so without its
+ // own rejection handler a failed resume becomes an unhandled rejection in the
+ // host app. Asserting that `catch` is attached, rather than waiting for the
+ // symptom, keeps the check deterministic under fake timers.
+ it('attaches a rejection handler to __internal_resumeAfterProtectCheck when it is queued until clerk-js has loaded', async () => {
+ const params = { continuation: 'transfer_to_sign_up' } as const;
+ const catchSpy = vi.fn();
+ const resumeAfterProtectCheck = vi.fn().mockReturnValue({ catch: catchSpy });
+ const clerkjs = {
+ addListener: vi.fn(),
+ loaded: true,
+ __internal_resumeAfterProtectCheck: resumeAfterProtectCheck,
+ } as unknown as BrowserClerk;
+ const isomorphicClerk = new IsomorphicClerk({ publishableKey: 'pk_test_XXX' });
+
+ const customNavigate = vi.fn();
+
+ await isomorphicClerk.__internal_resumeAfterProtectCheck(params, customNavigate);
+
+ expect(resumeAfterProtectCheck).not.toHaveBeenCalled();
+
+ (isomorphicClerk as any).replayInterceptedInvocations(clerkjs);
+
+ expect(resumeAfterProtectCheck).toHaveBeenCalledWith(params, customNavigate);
+ expect(catchSpy).toHaveBeenCalledTimes(1);
+ });
+
+ it('attaches a rejection handler to __internal_resumeAfterProtectCheck after clerk-js has loaded', async () => {
+ const params = { continuation: 'transfer_to_sign_up' } as const;
+ const catchSpy = vi.fn();
+ const resumeAfterProtectCheck = vi.fn().mockReturnValue({ catch: catchSpy });
+ const isomorphicClerk = new IsomorphicClerk({ publishableKey: 'pk_test_XXX' });
+
+ (isomorphicClerk as any).clerkjs = {
+ loaded: true,
+ __internal_resumeAfterProtectCheck: resumeAfterProtectCheck,
+ } as unknown as BrowserClerk;
+
+ const customNavigate = vi.fn();
+
+ await isomorphicClerk.__internal_resumeAfterProtectCheck(params, customNavigate);
+
+ // The navigator is the component router's; dropping it falls back to Clerk.navigate,
+ // which resolves component-relative destinations against the origin instead.
+ expect(resumeAfterProtectCheck).toHaveBeenCalledWith(params, customNavigate);
+ expect(catchSpy).toHaveBeenCalledTimes(1);
+ });
+
+ // This wrapper is always defined on IsomorphicClerk, so it cannot itself signal whether the
+ // loaded runtime supports the call. An older clerk-js has no such method, and calling straight
+ // through would throw a TypeError at a host caller instead of doing nothing.
+ it('does nothing when the loaded clerk-js predates __internal_resumeAfterProtectCheck', async () => {
+ const isomorphicClerk = new IsomorphicClerk({ publishableKey: 'pk_test_XXX' });
+
+ (isomorphicClerk as any).clerkjs = { loaded: true } as unknown as BrowserClerk;
+
+ await expect(
+ isomorphicClerk.__internal_resumeAfterProtectCheck({ continuation: 'transfer_to_sign_up' }),
+ ).resolves.toBeUndefined();
+ });
+
  it('calls __internal_handleResourceCallback immediately after clerk-js has loaded', async () => {
  const signInOrUp = {} as unknown as SignInResource;
  const params: HandleOAuthCallbackParams = { signInUrl: '/sign-in' };

.changeset/resume-oauth-transfer-after-protect-check.md

@@ -0,0 +1,8 @@
+---
+'@clerk/clerk-js': minor
+'@clerk/react': patch
+'@clerk/shared': minor
+'@clerk/ui': patch
+---
+
+Fixes an issue where OAuth account transfers that needed additional verification were returned to the beginning of sign-in.

packages/clerk-js/src/core/__tests__/clerk.test.ts

@@ -1850,6 +1850,220 @@ describe('Clerk singleton', () => {
  expect(mockNavigate).not.toHaveBeenCalled();
  });
 
+ describe('__internal_resumeAfterProtectCheck', () => {
+ // A verification challenge can interrupt an OAuth callback partway through routing. The
+ // challenge card clears it and hands control back here, from a page that is no longer
+ // the callback route, so the remaining routing has to run rather than start over.
+
+ const gatedTransferableSignIn = (extra: Record<string, unknown> = {}) =>
+ new SignIn({
+ status: 'needs_identifier',
+ first_factor_verification: {
+ status: 'transferable',
+ strategy: 'oauth_google',
+ external_verification_redirect_url: '',
+ error: {
+ code: 'external_account_not_found',
+ long_message: 'The External Account was not found.',
+ message: 'Invalid external account',
+ },
+ },
+ second_factor_verification: null,
+ identifier: '',
+ user_data: null,
+ created_session_id: null,
+ created_user_id: null,
+ ...extra,
+ } as any as SignInJSON);
+
+ const loadEnvironment = () =>
+ mockEnvironmentFetch.mockReturnValue(
+ Promise.resolve({
+ authConfig: {},
+ userSettings: mockUserSettings,
+ displayConfig: mockDisplayConfig,
+ isSingleSession: () => false,
+ isProduction: () => false,
+ isDevelopmentOrStaging: () => true,
+ onWindowLocationHost: () => false,
+ }),
+ );
+
+ it('completes the transfer as a SIGN-UP and activates the created session', async () => {
+ loadEnvironment();
+ mockClientFetch.mockReturnValue(
+ Promise.resolve({
+ signedInSessions: [],
+ signIn: gatedTransferableSignIn(),
+ signUp: new SignUp(null),
+ }),
+ );
+
+ const mockSetActive = vi.fn();
+ const mockSignUpCreate = vi
+ .fn()
+ .mockReturnValue(Promise.resolve({ status: 'complete', createdSessionId: '123' }));
+
+ const sut = new Clerk(productionPublishableKey);
+ await sut.load(mockedLoadOptions);
+ if (!sut.client) {
+ fail('we should always have a client');
+ }
+ sut.client.signUp.create = mockSignUpCreate;
+ sut.setActive = mockSetActive;
+
+ await sut.__internal_resumeAfterProtectCheck({ continuation: 'transfer_to_sign_up' });
+
+ await waitFor(() => {
+ expect(mockSignUpCreate).toHaveBeenCalledTimes(1);
+ expect(mockSignUpCreate).toHaveBeenCalledWith({ transfer: true, unsafeMetadata: undefined });
+ expect(mockSetActive).toHaveBeenCalledWith(expect.objectContaining({ session: '123' }));
+ });
+ });
+
+ it('completes the transfer even when the cleared response dropped the transferable marker', async () => {
+ // `SignIn.fromJSON` replaces `firstFactorVerification` wholesale on every write, so the
+ // caller latches the continuation before running the challenge and passes it explicitly.
+ // Re-reading it here would silently fall back to returning the user to sign-in.
+ loadEnvironment();
+ mockClientFetch.mockReturnValue(
+ Promise.resolve({
+ signedInSessions: [],
+ signIn: new SignIn({
+ status: 'needs_identifier',
+ first_factor_verification: null,
+ second_factor_verification: null,
+ identifier: '',
+ user_data: null,
+ created_session_id: null,
+ created_user_id: null,
+ } as any as SignInJSON),
+ signUp: new SignUp(null),
+ }),
+ );
+
+ const mockSignUpCreate = vi
+ .fn()
+ .mockReturnValue(Promise.resolve({ status: 'complete', createdSessionId: '123' }));
+
+ const sut = new Clerk(productionPublishableKey);
+ await sut.load(mockedLoadOptions);
+ if (!sut.client) {
+ fail('we should always have a client');
+ }
+ sut.client.signUp.create = mockSignUpCreate;
+ sut.setActive = vi.fn();
+
+ await sut.__internal_resumeAfterProtectCheck({ continuation: 'transfer_to_sign_up' });
+
+ await waitFor(() =>
+ expect(mockSignUpCreate).toHaveBeenCalledWith({ transfer: true, unsafeMetadata: undefined }),
+ );
+ });
+
+ it('does not divert to the sign-up card when a stale gate is on the sign-up resource', async () => {
+ // The sign-in variant below covers the first short-circuit; `resuming` skips a second one
+ // keyed on the SIGN-UP resource, and that is the arm that sends the user to a different
+ // card entirely rather than back to this one.
+ loadEnvironment();
+ mockClientFetch.mockReturnValue(
+ Promise.resolve({
+ signedInSessions: [],
+ signIn: gatedTransferableSignIn(),
+ signUp: new SignUp({
+ protect_check: { status: 'pending', token: 'stale-signup-token', sdk_url: 'https://example.com/sdk.js' },
+ } as any),
+ }),
+ );
+
+ const mockSignUpCreate = vi
+ .fn()
+ .mockReturnValue(Promise.resolve({ status: 'complete', createdSessionId: '123' }));
+
+ const sut = new Clerk(productionPublishableKey);
+ await sut.load(mockedLoadOptions);
+ if (!sut.client) {
+ fail('we should always have a client');
+ }
+ sut.client.signUp.create = mockSignUpCreate;
+ sut.setActive = vi.fn();
+
+ await sut.__internal_resumeAfterProtectCheck({ continuation: 'transfer_to_sign_up' });
+
+ await waitFor(() =>
+ expect(mockSignUpCreate).toHaveBeenCalledWith({ transfer: true, unsafeMetadata: undefined }),
+ );
+ expect(mockNavigate.mock.calls.some(([to]) => typeof to === 'string' && to.includes('protect-check'))).toBe(
+ false,
+ );
+ });
+
+ it('does not bounce back into the challenge when a stale gate is still on the resource', async () => {
+ // This is the test that proves `resuming` is load-bearing rather than decorative. The
+ // caller IS the challenge card; re-checking the gate here would hand control straight
+ // back to it, or — through the sign-up arm — to the wrong card entirely.
+ loadEnvironment();
+ mockClientFetch.mockReturnValue(
+ Promise.resolve({
+ signedInSessions: [],
+ signIn: gatedTransferableSignIn({
+ protect_check: { status: 'pending', token: 'stale-token', sdk_url: 'https://example.com/sdk.js' },
+ }),
+ signUp: new SignUp(null),
+ }),
+ );
+
+ const mockSignUpCreate = vi
+ .fn()
+ .mockReturnValue(Promise.resolve({ status: 'complete', createdSessionId: '123' }));
+
+ const sut = new Clerk(productionPublishableKey);
+ await sut.load(mockedLoadOptions);
+ if (!sut.client) {
+ fail('we should always have a client');
+ }
+ sut.client.signUp.create = mockSignUpCreate;
+ sut.setActive = vi.fn();
+
+ await sut.__internal_resumeAfterProtectCheck({ continuation: 'transfer_to_sign_up' });
+
+ await waitFor(() =>
+ expect(mockSignUpCreate).toHaveBeenCalledWith({ transfer: true, unsafeMetadata: undefined }),
+ );
+ expect(mockNavigate.mock.calls.some(([to]) => typeof to === 'string' && to.includes('protect-check'))).toBe(
+ false,
+ );
+ });
+
+ it('still honours transferable: false', async () => {
+ loadEnvironment();
+ mockClientFetch.mockReturnValue(
+ Promise.resolve({
+ signedInSessions: [],
+ signIn: gatedTransferableSignIn(),
+ signUp: new SignUp(null),
+ }),
+ );
+
+ const mockSignUpCreate = vi.fn();
+
+ const sut = new Clerk(productionPublishableKey);
+ await sut.load(mockedLoadOptions);
+ if (!sut.client) {
+ fail('we should always have a client');
+ }
+ sut.client.signUp.create = mockSignUpCreate;
+ sut.setActive = vi.fn();
+
+ await sut.__internal_resumeAfterProtectCheck({
+ continuation: 'transfer_to_sign_up',
+ transferable: false,
+ });
+
+ await waitFor(() => expect(mockSignUpCreate).not.toHaveBeenCalled());
+ });
+ });
+
  it('does not initiate the transfer flow when transferable: false is passed', async () => {
  mockEnvironmentFetch.mockReturnValue(
  Promise.resolve({

packages/clerk-js/src/core/clerk.ts

@@ -112,6 +112,7 @@ import type {
  PublicKeyCredentialWithAuthenticatorAttestationResponse,
  RedirectOptions,
  Resources,
+ ResumeAfterProtectCheckParams,
  SDKMetadata,
  SessionResource,
  SessionTouchParams,
@@ -2450,15 +2451,17 @@ export class Clerk implements ClerkInterface {
  };
 
  private _handleRedirectCallback = async (
- params: HandleOAuthCallbackParams,
+ params: ResumeAfterProtectCheckParams,
  {
  signIn,
  signUp,
  navigate,
+ resuming = false,
  }: {
  signIn: SignInResource;
  signUp: SignUpResource;
  navigate: (to: string) => Promise<unknown>;
+ resuming?: boolean;
  },
  ): Promise<unknown> => {
  if (!this.loaded || !this.environment || !this.client) {
@@ -2602,14 +2605,14 @@ export class Clerk implements ClerkInterface {
  // sign-in's challenge. We only consult `si` here unless this is explicitly a sign-up callback.
  // Transfers are unaffected: the `signIn.create({ transfer })` path below checks its own fresh
  // response for the gate.
- if (params.reloadResource !== 'signUp' && (si.protectCheck || si.status === 'needs_protect_check')) {
+ if (!resuming && params.reloadResource !== 'signUp' && (si.protectCheck || si.status === 'needs_protect_check')) {
  return navigateToSignInProtectCheck();
  }
 
  // The sign-up resource can be gated the same way (e.g. a callback that resolves straight into a
  // gated sign-up). Scope to the sign-up intent for the symmetric reason — a stale sign-up's gate
  // shouldn't hijack a sign-in callback.
- if (params.reloadResource !== 'signIn' && su.protectCheck) {
+ if (!resuming && params.reloadResource !== 'signIn' && su.protectCheck) {
  return navigateToSignUpProtectCheck();
  }
 
@@ -2669,7 +2672,8 @@ export class Clerk implements ClerkInterface {
  return navigateToResetPassword();
  }
 
- const userNeedsToBeCreated = si.firstFactorVerificationStatus === 'transferable';
+ const userNeedsToBeCreated =
+ si.firstFactorVerificationStatus === 'transferable' || params.continuation === 'transfer_to_sign_up';
 
  if (userNeedsToBeCreated) {
  if (params.transferable === false) {
@@ -2772,6 +2776,27 @@ export class Clerk implements ClerkInterface {
  return navigateToSignIn();
  };
 
+ public __internal_resumeAfterProtectCheck = async (
+ params: ResumeAfterProtectCheckParams = {},
+ customNavigate?: (to: string) => Promise<unknown>,
+ ): Promise<unknown> => {
+ if (!this.loaded || !this.environment || !this.client) {
+ return;
+ }
+ const { signIn, signUp } = this.client;
+
+ const resolvedNavigate = customNavigate ?? params.__internal_navigate;
+ const navigate = (to: string) =>
+ resolvedNavigate && typeof resolvedNavigate === 'function' ? resolvedNavigate(to) : this.navigate(to);
+
+ return this._handleRedirectCallback(params, {
+ signUp,
+ signIn,
+ navigate,
+ resuming: true,
+ });
+ };
+
  public handleRedirectCallback = async (
  params: HandleOAuthCallbackParams = {},
  customNavigate?: (to: string) => Promise<unknown>,

packages/react/src/__tests__/isomorphicClerk.test.ts

@@ -178,6 +178,70 @@ describe('isomorphicClerk', () => {
  expect(handleResourceCallback).toHaveBeenCalledWith(signInOrUp, params, customNavigate);
  });
 
+ // Regression: a call queued before clerk-js loads is replayed by
+ // `replayInterceptedInvocations`, whose loop discards whatever its callbacks
+ // return. The queued copy therefore has no caller left to reject to -- the
+ // original `await` resolved the moment the call was queued -- so without its
+ // own rejection handler a failed resume becomes an unhandled rejection in the
+ // host app. Asserting that `catch` is attached, rather than waiting for the
+ // symptom, keeps the check deterministic under fake timers.
+ it('attaches a rejection handler to __internal_resumeAfterProtectCheck when it is queued until clerk-js has loaded', async () => {
+ const params = { continuation: 'transfer_to_sign_up' } as const;
+ const catchSpy = vi.fn();
+ const resumeAfterProtectCheck = vi.fn().mockReturnValue({ catch: catchSpy });
+ const clerkjs = {
+ addListener: vi.fn(),
+ loaded: true,
+ __internal_resumeAfterProtectCheck: resumeAfterProtectCheck,
+ } as unknown as BrowserClerk;
+ const isomorphicClerk = new IsomorphicClerk({ publishableKey: 'pk_test_XXX' });
+
+ const customNavigate = vi.fn();
+
+ await isomorphicClerk.__internal_resumeAfterProtectCheck(params, customNavigate);
+
+ expect(resumeAfterProtectCheck).not.toHaveBeenCalled();
+
+ (isomorphicClerk as any).replayInterceptedInvocations(clerkjs);
+
+ expect(resumeAfterProtectCheck).toHaveBeenCalledWith(params, customNavigate);
+ expect(catchSpy).toHaveBeenCalledTimes(1);
+ });
+
+ it('attaches a rejection handler to __internal_resumeAfterProtectCheck after clerk-js has loaded', async () => {
+ const params = { continuation: 'transfer_to_sign_up' } as const;
+ const catchSpy = vi.fn();
+ const resumeAfterProtectCheck = vi.fn().mockReturnValue({ catch: catchSpy });
+ const isomorphicClerk = new IsomorphicClerk({ publishableKey: 'pk_test_XXX' });
+
+ (isomorphicClerk as any).clerkjs = {
+ loaded: true,
+ __internal_resumeAfterProtectCheck: resumeAfterProtectCheck,
+ } as unknown as BrowserClerk;
+
+ const customNavigate = vi.fn();
+
+ await isomorphicClerk.__internal_resumeAfterProtectCheck(params, customNavigate);
+
+ // The navigator is the component router's; dropping it falls back to Clerk.navigate,
+ // which resolves component-relative destinations against the origin instead.
+ expect(resumeAfterProtectCheck).toHaveBeenCalledWith(params, customNavigate);
+ expect(catchSpy).toHaveBeenCalledTimes(1);
+ });
+
+ // This wrapper is always defined on IsomorphicClerk, so it cannot itself signal whether the
+ // loaded runtime supports the call. An older clerk-js has no such method, and calling straight
+ // through would throw a TypeError at a host caller instead of doing nothing.
+ it('does nothing when the loaded clerk-js predates __internal_resumeAfterProtectCheck', async () => {
+ const isomorphicClerk = new IsomorphicClerk({ publishableKey: 'pk_test_XXX' });
+
+ (isomorphicClerk as any).clerkjs = { loaded: true } as unknown as BrowserClerk;
+
+ await expect(
+ isomorphicClerk.__internal_resumeAfterProtectCheck({ continuation: 'transfer_to_sign_up' }),
+ ).resolves.toBeUndefined();
+ });
+
  it('calls __internal_handleResourceCallback immediately after clerk-js has loaded', async () => {
  const signInOrUp = {} as unknown as SignInResource;
  const params: HandleOAuthCallbackParams = { signInUrl: '/sign-in' };