Skip to content

fix(ui): correct OAuth redirect_url for openSignUp modal in combined flow#8388

Draft
nikosdouvlis wants to merge 1 commit intomainfrom
nikos/fix-opensignup-url
Draft

fix(ui): correct OAuth redirect_url for openSignUp modal in combined flow#8388
nikosdouvlis wants to merge 1 commit intomainfrom
nikos/fix-opensignup-url

Conversation

@nikosdouvlis
Copy link
Copy Markdown
Member

Why

Follow up to #8385. When a customer configures combined flow (CLERK_SIGN_IN_URL set, CLERK_SIGN_UP_URL unset, public signup mode) and calls openSignUp() directly, signUpUrl in SignUp.ts falls back to displayConfig.signUpUrl, which is the accounts portal. Customers that dont use the accounts portal end up with a broken OAuth redirect_url on the wrong origin.

The SignIn side of the same bug was fixed in #8385, but the openSignUp path wasnt touched.

What changed

Anchor the callback base to options.signInUrl when in a combined-flow modal. The create/sso-callback and create/verify routes are mounted under the SignIn tree (packages/ui/src/components/SignIn/index.tsx), so the redirect resolves against the app origin and lands on LazySignUpSSOCallback.

Path and hash routing are unchanged since buildRedirectUrl ignores baseUrl for those modes, so this is modal-only.

Test coverage

Added an integration test in integration/tests/oauth-flows.test.ts that exercises openSignUp with the same withSignInOrUpFlow fixture #8385 uses, asserting the redirect_url lands on /sign-in#/create/sso-callback.

Packages affected

  • @clerk/ui: SignUp context anchors callback URLs to options.signInUrl under combined-flow modal mode

…flow

Follow up to #8385. When CLERK_SIGN_UP_URL is unset (combined flow config) and a customer calls openSignUp() directly, signUpUrl in SignUp.ts falls back to displayConfig.signUpUrl, which is the accounts portal. For customers that dont use the accounts portal, the OAuth redirect_url ends up on the wrong origin.

Anchor the callback base to options.signInUrl when in a combined-flow modal, since the create/sso-callback and create/verify routes are mounted under the SignIn tree.
@changeset-bot
Copy link
Copy Markdown

changeset-bot Bot commented Apr 23, 2026

🦋 Changeset detected

Latest commit: 11f1773

The changes in this PR will be included in the next version bump.

This PR includes changesets to release 2 packages
Name Type
@clerk/ui Patch
@clerk/chrome-extension Patch

Not sure what this means? Click here to learn what changesets are.

Click here if you're a maintainer who wants to add another changeset to this PR

@vercel
Copy link
Copy Markdown

vercel Bot commented Apr 23, 2026

The latest updates on your projects. Learn more about Vercel for GitHub.

Project Deployment Actions Updated (UTC)
clerk-js-sandbox Ready Ready Preview, Comment Apr 23, 2026 9:58am

Request Review

@pkg-pr-new
Copy link
Copy Markdown

pkg-pr-new Bot commented Apr 23, 2026

Open in StackBlitz

@clerk/astro

npm i https://pkg.pr.new/@clerk/astro@8388

@clerk/backend

npm i https://pkg.pr.new/@clerk/backend@8388

@clerk/chrome-extension

npm i https://pkg.pr.new/@clerk/chrome-extension@8388

@clerk/clerk-js

npm i https://pkg.pr.new/@clerk/clerk-js@8388

@clerk/dev-cli

npm i https://pkg.pr.new/@clerk/dev-cli@8388

@clerk/expo

npm i https://pkg.pr.new/@clerk/expo@8388

@clerk/expo-passkeys

npm i https://pkg.pr.new/@clerk/expo-passkeys@8388

@clerk/express

npm i https://pkg.pr.new/@clerk/express@8388

@clerk/fastify

npm i https://pkg.pr.new/@clerk/fastify@8388

@clerk/hono

npm i https://pkg.pr.new/@clerk/hono@8388

@clerk/localizations

npm i https://pkg.pr.new/@clerk/localizations@8388

@clerk/nextjs

npm i https://pkg.pr.new/@clerk/nextjs@8388

@clerk/nuxt

npm i https://pkg.pr.new/@clerk/nuxt@8388

@clerk/react

npm i https://pkg.pr.new/@clerk/react@8388

@clerk/react-router

npm i https://pkg.pr.new/@clerk/react-router@8388

@clerk/shared

npm i https://pkg.pr.new/@clerk/shared@8388

@clerk/tanstack-react-start

npm i https://pkg.pr.new/@clerk/tanstack-react-start@8388

@clerk/testing

npm i https://pkg.pr.new/@clerk/testing@8388

@clerk/ui

npm i https://pkg.pr.new/@clerk/ui@8388

@clerk/upgrade

npm i https://pkg.pr.new/@clerk/upgrade@8388

@clerk/vue

npm i https://pkg.pr.new/@clerk/vue@8388

commit: 11f1773

@coderabbitai
Copy link
Copy Markdown
Contributor

coderabbitai Bot commented Apr 23, 2026

No actionable comments were generated in the recent review. 🎉

ℹ️ Recent review info
⚙️ Run configuration

Configuration used: Repository YAML (base), Organization UI (inherited)

Review profile: CHILL

Plan: Pro

Run ID: 1367adfb-dbf0-4e5c-bc26-62889552f2ee

📥 Commits

Reviewing files that changed from the base of the PR and between 26847fe and 11f1773.

📒 Files selected for processing (3)
  • .changeset/fix-opensignup-combined-flow-redirect.md
  • integration/tests/oauth-flows.test.ts
  • packages/ui/src/contexts/components/SignUp.ts

📝 Walkthrough

Walkthrough

This pull request fixes an OAuth redirect URL issue in the openSignUp modal when using the combined flow without CLERK_SIGN_UP_URL configured. The fix introduces a modalCallbackBaseUrl in the SignUp context that anchors OAuth and magic-link callbacks to options.signInUrl instead of signUpUrl for the combined-flow scenario. A new Playwright test validates that the openSignUp flow correctly redirects through the sign-in route's SSO callback handler when triggered without an explicit sign-up URL.

Estimated code review effort

🎯 3 (Moderate) | ⏱️ ~20 minutes

Detailed analysis

Changesets documentation: Introduces a patch-level change note for @clerk/ui clearly documenting the fix scope.

Test coverage: Adds a focused Playwright test that mirrors the existing openSignIn combined-flow test pattern, validating the openSignUp path with OAuth provider selection and callback URL interception.

Implementation logic: Updates the SignUp context component to conditionally compute a modalCallbackBaseUrl and reference it in both email link and SSO callback URL builders. The logic is scoped to the combined-flow modal condition and involves straightforward URL-base switching.

The changes are cohesive in addressing a single issue but require careful verification that the callback URL routing logic functions correctly under the combined-flow conditions specified.

🚥 Pre-merge checks | ✅ 5
✅ Passed checks (5 passed)
Check name Status Explanation
Title check ✅ Passed The title directly and concisely summarizes the main change: fixing OAuth redirect_url for openSignUp modal in combined flow.
Description check ✅ Passed The description comprehensively explains the bug context, the specific fix applied, and test coverage added, all directly related to the changeset.
Docstring Coverage ✅ Passed No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check.
Linked Issues check ✅ Passed Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check ✅ Passed Check skipped because no linked issues were found for this pull request.

✏️ Tip: You can configure your own custom pre-merge checks in the settings.


Comment @coderabbitai help to get the list of available commands and usage tips.

@nikosdouvlis nikosdouvlis marked this pull request as draft April 23, 2026 10:21
Copy link
Copy Markdown
Member

@Ephem Ephem left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Nice find!

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Projects

None yet

Development

Successfully merging this pull request may close these issues.

2 participants