feat(ui): Support signUpIfMissing with Clerk <SignIn> component by dmoerner · Pull Request #7928 · clerk/javascript

dmoerner · 2026-02-25T18:20:06Z

Description

The <SignIn> component can already be used in a sign-in-or-sign-up flow (CombinedFlow) under certain conditions. When strict enumeration protection is enabled, make that combined flow pass the signUpIfMissing parameter to the backend to allow an enumeration-safe combined flow. Previously, attempting to use a combined flow with strict enumeration protection enabled was silently broken.

Under the hood, the backend treats sign up if missing as an account transfer. We therefore add support for this account transfer logic when handling first factor verification in the combined sign in flow when strict enumeration protection is enabled.

Fixes USER-4769.

We should merge this in coordination with documentation and a Changelog release, since it will change existing behavior (although with a fix for something that is currently broken)

Checklist

pnpm test runs as expected.
pnpm build runs as expected.
(If applicable) JSDoc comments have been added or updated for any package exports
(If applicable) Documentation has been updated

Type of change

Summary by CodeRabbit

New Features
- Added enumeration protection settings to user settings.
- Automatic sign-up handling in combined sign-in/sign-up flows when enumeration protection is enabled (including a transfer path).
- Email link verification now recognizes a transferable status to enable verification transfer flows.
Tests
- Added tests covering sign-up transfer scenarios, sign-up-if-missing behavior, and transferable verification handling.

The `<SignIn>` component can already be used in a sign-in-or-sign-up flow (`CombinedFlow`) under certain conditions. When strict enumeration protection is enabled, make that combined flow pass the `signUpIfMissing` parameter to the backend to allow an enumeration-safe combined flow. Previously, attempting to use a combined flow with strict enumeration protection enabled was silently broken. Under the hood, the backend treats sign up if missing as an account transfer. We therefore add support for this account transfer logic when handling first factor verification in the combined sign in flow when strict enumeration protection is enabled.

changeset-bot · 2026-02-25T18:20:11Z

🦋 Changeset detected

Latest commit: 40d8ceb

The changes in this PR will be included in the next version bump.

This PR includes changesets to release 20 packages

Name	Type
@clerk/clerk-js	Minor
@clerk/shared	Minor
@clerk/ui	Minor
@clerk/chrome-extension	Patch
@clerk/expo	Patch
@clerk/agent-toolkit	Patch
@clerk/astro	Patch
@clerk/backend	Patch
@clerk/expo-passkeys	Patch
@clerk/express	Patch
@clerk/fastify	Patch
@clerk/localizations	Patch
@clerk/msw	Patch
@clerk/nextjs	Patch
@clerk/nuxt	Patch
@clerk/react-router	Patch
@clerk/react	Patch
@clerk/tanstack-react-start	Patch
@clerk/testing	Patch
@clerk/vue	Patch

Not sure what this means? Click here to learn what changesets are.

Click here if you're a maintainer who wants to add another changeset to this PR

vercel · 2026-02-25T18:20:12Z

The latest updates on your projects. Learn more about Vercel for GitHub.

Project	Deployment	Actions	Updated (UTC)
clerk-js-sandbox	Ready	Preview, Comment	Mar 2, 2026 9:56pm

…mponents

coderabbitai · 2026-03-02T21:27:59Z

No actionable comments were generated in the recent review. 🎉

ℹ️ Recent review info

Configuration used: Repository YAML (base), Organization UI (inherited)

Review profile: CHILL

Plan: Pro

Disabled knowledge base sources:

Linear integration is disabled

You can enable these sources in your CodeRabbit configuration.

📥 Commits

Reviewing files that changed from the base of the PR and between 721b518 and 40d8ceb.

📒 Files selected for processing (2)

packages/clerk-js/src/core/resources/SignIn.ts
packages/clerk-js/src/core/resources/__tests__/SignIn.test.ts

📝 Walkthrough

Walkthrough

Adds support for a transferable email-link verification status and related transfer flow: treats transferable as a terminal verification result in sign-in polling and verification handling, surfaces a new attackProtection/attack_protection field and AttackProtectionData type for enumeration protection in UserSettings, introduces handleSignUpIfMissingTransfer to perform sign-up transfers and activation, conditions signUpIfMissing usage in SignInStart for combined/enumeration-protection flows, updates SignIn UI components to invoke the transfer handler, and adds tests and fixtures for these behaviors.

Possibly related PRs

clerk/javascript PR 6614 — Implements transfer-related support and modifies SignIn flows to handle a transferable verification status, closely matching the sign-in/sign-up transfer changes in this PR.

🚥 Pre-merge checks | ✅ 2 | ❌ 1

❌ Failed checks (1 warning)

Check name	Status	Explanation	Resolution
Docstring Coverage	⚠️ Warning	Docstring coverage is 50.00% which is insufficient. The required threshold is 80.00%.	Write docstrings for the functions missing them to satisfy the coverage threshold.

✅ Passed checks (2 passed)

Check name	Status	Explanation
Description Check	✅ Passed	Check skipped - CodeRabbit’s high-level summary is enabled.
Title check	✅ Passed	The title accurately describes the main feature: supporting signUpIfMissing in the component. Changes across clerk-js, shared, and ui packages confirm this is the primary objective.

_{✏️ Tip: You can configure your own custom pre-merge checks in the settings.}

_{Comment @coderabbitai help to get the list of available commands and usage tips.}

coderabbitai

Actionable comments posted: 1

🤖 Prompt for all review comments with AI agents

Verify each finding against the current code and only fix it if needed.

Inline comments:
In `@packages/clerk-js/src/core/resources/SignIn.ts`:
- Around line 311-312: SignInFuture.waitForEmailLinkVerification currently
treats only 'verified' and 'expired' as terminal statuses, which causes
transferable flows started by createEmailLinkFlow to poll indefinitely; update
the status check inside SignInFuture.waitForEmailLinkVerification to include
'transferable' alongside 'verified' and 'expired' so the polling loop calls
stop()/resolves when status === 'transferable', ensuring transferable email-link
flows terminate properly.

ℹ️ Review info

Configuration used: Repository YAML (base), Organization UI (inherited)

Review profile: CHILL

Plan: Pro

Disabled knowledge base sources:

Linear integration is disabled

You can enable these sources in your CodeRabbit configuration.

📥 Commits

Reviewing files that changed from the base of the PR and between cd1973e and 721b518.

📒 Files selected for processing (15)

.changeset/fancy-candies-slide.md
packages/clerk-js/src/core/clerk.ts
packages/clerk-js/src/core/resources/SignIn.ts
packages/clerk-js/src/core/resources/UserSettings.ts
packages/shared/src/errors/emailLinkError.ts
packages/shared/src/types/userSettings.ts
packages/ui/src/components/SignIn/SignInFactorOneCodeForm.tsx
packages/ui/src/components/SignIn/SignInFactorOneEmailLinkCard.tsx
packages/ui/src/components/SignIn/SignInStart.tsx
packages/ui/src/components/SignIn/__tests__/SignInFactorOneTransfer.test.tsx
packages/ui/src/components/SignIn/__tests__/SignInStart.test.tsx
packages/ui/src/components/SignIn/__tests__/handleSignUpIfMissingTransfer.test.ts
packages/ui/src/components/SignIn/handleSignUpIfMissingTransfer.ts
packages/ui/src/test/fixture-helpers.ts
packages/ui/src/test/fixtures.ts

packages/clerk-js/src/core/resources/SignIn.ts

This is connected to custom flows and was missed in the previous PRs supporting custom flows. Let's add it now while we are here.

dmoerner · 2026-03-02T21:56:40Z

packages/clerk-js/src/core/resources/SignIn.ts

            const res = await this.#resource.__internal_baseGet();
            const status = res.firstFactorVerification.status;
-            if (status === 'verified' || status === 'expired') {
+            if (status === 'verified' || status === 'expired' || status === 'transferable') {


This change is not necessary for Clerk builtin components but was missed in #7749. As suggested by CodeRabbit, let's just fix it now.

pkg-pr-new · 2026-03-02T21:58:53Z

Open in StackBlitz

@clerk/agent-toolkit

npm i https://pkg.pr.new/@clerk/agent-toolkit@7928

@clerk/astro

npm i https://pkg.pr.new/@clerk/astro@7928

@clerk/backend

npm i https://pkg.pr.new/@clerk/backend@7928

@clerk/chrome-extension

npm i https://pkg.pr.new/@clerk/chrome-extension@7928

@clerk/clerk-js

npm i https://pkg.pr.new/@clerk/clerk-js@7928

@clerk/dev-cli

npm i https://pkg.pr.new/@clerk/dev-cli@7928

@clerk/expo

npm i https://pkg.pr.new/@clerk/expo@7928

@clerk/expo-passkeys

npm i https://pkg.pr.new/@clerk/expo-passkeys@7928

@clerk/express

npm i https://pkg.pr.new/@clerk/express@7928

@clerk/fastify

npm i https://pkg.pr.new/@clerk/fastify@7928

@clerk/hono

npm i https://pkg.pr.new/@clerk/hono@7928

@clerk/localizations

npm i https://pkg.pr.new/@clerk/localizations@7928

@clerk/nextjs

npm i https://pkg.pr.new/@clerk/nextjs@7928

@clerk/nuxt

npm i https://pkg.pr.new/@clerk/nuxt@7928

@clerk/react

npm i https://pkg.pr.new/@clerk/react@7928

@clerk/react-router

npm i https://pkg.pr.new/@clerk/react-router@7928

@clerk/shared

npm i https://pkg.pr.new/@clerk/shared@7928

@clerk/tanstack-react-start

npm i https://pkg.pr.new/@clerk/tanstack-react-start@7928

@clerk/testing

npm i https://pkg.pr.new/@clerk/testing@7928

@clerk/ui

npm i https://pkg.pr.new/@clerk/ui@7928

@clerk/upgrade

npm i https://pkg.pr.new/@clerk/upgrade@7928

@clerk/vue

npm i https://pkg.pr.new/@clerk/vue@7928

commit: 40d8ceb

dmoerner · 2026-03-03T04:25:44Z

Depends on re-revert of #7962 with Enterprise SSO captcha transfer fix.

github-actions bot added clerk-js core-3 labels Feb 25, 2026

dmoerner added 2 commits February 27, 2026 15:10

Merge branch 'main' into daniel/user-4769-sign-up-if-missing-clerk-co…

bc2274f

…mponents

Merge branch 'main' into daniel/user-4769-sign-up-if-missing-clerk-co…

721b518

…mponents

github-actions bot added the ui label Mar 2, 2026

vercel bot deployed to Preview March 2, 2026 20:36 View deployment

dmoerner marked this pull request as ready for review March 2, 2026 21:23

dmoerner requested a review from wobsoriano March 2, 2026 21:23

coderabbitai bot reviewed Mar 2, 2026

View reviewed changes

packages/clerk-js/src/core/resources/SignIn.ts Show resolved Hide resolved

fix: Also add transferable status to SignInFuture email link

40d8ceb

This is connected to custom flows and was missed in the previous PRs supporting custom flows. Let's add it now while we are here.

vercel bot deployed to Preview March 2, 2026 21:56 View deployment

dmoerner commented Mar 2, 2026

View reviewed changes

dmoerner marked this pull request as draft March 3, 2026 04:25

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

feat(ui): Support signUpIfMissing with Clerk <SignIn> component#7928

feat(ui): Support signUpIfMissing with Clerk <SignIn> component#7928
dmoerner wants to merge 4 commits intomainfrom
daniel/user-4769-sign-up-if-missing-clerk-components

dmoerner commented Feb 25, 2026 •

edited by coderabbitai bot

Loading

Uh oh!

changeset-bot bot commented Feb 25, 2026 •

edited

Loading

Uh oh!

vercel bot commented Feb 25, 2026 •

edited

Loading

Uh oh!

coderabbitai bot commented Mar 2, 2026 •

edited

Loading

Walkthrough

Possibly related PRs

❌ Failed checks (1 warning)

Uh oh!

coderabbitai bot left a comment

Uh oh!

Uh oh!

dmoerner Mar 2, 2026

Uh oh!

pkg-pr-new bot commented Mar 2, 2026

Uh oh!

dmoerner commented Mar 3, 2026

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

1 participant

Conversation

dmoerner commented Feb 25, 2026 • edited by coderabbitai bot Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Description

Checklist

Type of change

Summary by CodeRabbit

Uh oh!

changeset-bot bot commented Feb 25, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

🦋 Changeset detected

Uh oh!

vercel bot commented Feb 25, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

coderabbitai bot commented Mar 2, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Walkthrough

Possibly related PRs

❌ Failed checks (1 warning)

Uh oh!

coderabbitai bot left a comment

Choose a reason for hiding this comment

Uh oh!

Uh oh!

dmoerner Mar 2, 2026

Choose a reason for hiding this comment

Uh oh!

pkg-pr-new bot commented Mar 2, 2026

Uh oh!

dmoerner commented Mar 3, 2026

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

1 participant

dmoerner commented Feb 25, 2026 •

edited by coderabbitai bot

Loading

changeset-bot bot commented Feb 25, 2026 •

edited

Loading

vercel bot commented Feb 25, 2026 •

edited

Loading

coderabbitai bot commented Mar 2, 2026 •

edited

Loading