fix: validate auth provider conformance - #1072
Merged
Merged
Conversation
|
Warning Review limit reached
More reviews will be available in 53 minutes and 11 seconds. Learn how PR review limits work. Your organization has used up its prepaid credits, and credit purchases are no longer available. Enable the review add-on in the billing tab to keep reviews running — you're only billed for reviews past your plan's rate limits ($0.25/file). ⌛ How to resolve this issue?After more reviews become available, a review can be triggered using the To avoid repeated limits, reduce automatic review volume by pausing incremental auto-reviews earlier, using label-based review opt-in, excluding WIP or generated PR titles, or requesting reviews manually when the PR is ready. If your team needs uninterrupted high-volume reviews, an organization admin can enable usage-based credits. 🚦 How do rate limits work?CodeRabbit enforces per-developer PR review limits for each organization. Most developers receive the normal plan refill rate. For paid Pro and Pro+ PR reviews, CodeRabbit uses adaptive limits for sustained high-volume activity. When a developer's recent PR review activity reaches the 95th percentile or higher among CodeRabbit users, the refill rate gradually slows as usage increases. The highest same-day bursts are limited more strictly. Please see our Fair Usage Limits Policy for further information. ℹ️ Review info⚙️ Run configurationConfiguration used: Organization UI Review profile: ASSERTIVE Plan: Pro Run ID: ⛔ Files ignored due to path filters (1)
📒 Files selected for processing (135)
📝 WalkthroughWalkthrough
ChangesAuth Provider Conformance Suite & Diagnostics
Estimated code review effort🎯 4 (Complex) | ⏱️ ~60 minutes Possibly related issues
Possibly related PRs
🚥 Pre-merge checks | ✅ 4 | ❌ 1❌ Failed checks (1 warning)
✅ Passed checks (4 passed)
✏️ Tip: You can configure your own custom pre-merge checks in the settings. ✨ Finishing Touches🧪 Generate unit tests (beta)
Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out. Comment |
kang-heewon
force-pushed
the
fix/942-auth-conformance
branch
from
June 21, 2026 14:48
8b420ac to
87760dc
Compare
📊 Benchmark Results❌ Some benchmarks failed Gate failures
Updated: 2026-06-21T18:49:19.850Z · Commit: f6710c2 |
kang-heewon
force-pushed
the
fix/942-auth-conformance
branch
6 times, most recently
from
June 21, 2026 17:17
dffbe68 to
e4bcc34
Compare
There was a problem hiding this comment.
Actionable comments posted: 18
🤖 Prompt for all review comments with AI agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
Inline comments:
In `@packages/auth-better-auth/src/libs/BetterAuthDiagnosticsProvider.ts`:
- Around line 149-150: The SENSITIVE_DIAGNOSTIC_KEY regex pattern used for
redacting object keys is missing several patterns that are being redacted in the
text-based redaction logic at line 186. Update the SENSITIVE_DIAGNOSTIC_KEY
regex pattern to include the missing patterns: cookie, credential,
private[-_]?key, and better[-_]?auth[-_]?url. This ensures that object keys
containing these patterns are redacted consistently with the text-based
redaction logic, preventing sensitive information from being exposed when these
patterns appear in diagnostic object keys.
In
`@packages/auth-better-auth/src/libs/problems/BetterAuthAuthenticationProblem.ts`:
- Around line 90-95: The redactSensitiveValue function and its regex pattern are
duplicated across multiple files including BetterAuthAuthenticationProblem.ts
and BetterAuthDiagnosticsProvider.ts. Extract the SENSITIVE_VALUE_PATTERN regex
constant and the redactSensitiveValue function into a shared utility module
(e.g., shared/redaction.ts or utils/sanitize.ts), then update both files to
import and use this shared function instead of maintaining duplicate
implementations. This will eliminate code duplication and make future updates to
the redaction logic easier to maintain in a single location.
In `@packages/auth-better-auth/vitest.config.ts`:
- Line 14: The `@croco/testing` alias in the vitest.config.ts file is currently
pointing to an internal file path
(../testing/src/libs/auth-provider-conformance.ts) instead of the public entry
point, which is inconsistent with other `@croco/*` package aliases. Change the
alias resolution path for `@croco/testing` to point to the public index file
(../testing/src/index.ts) instead of the internal libs file, since the exported
functions like createAuthProviderConformanceSuite are re-exported from the
package's public index entry point.
In `@packages/auth-clerk/src/libs/ClerkAuthDiagnosticsProvider.ts`:
- Around line 179-180: The isNonEmptyString function in
ClerkAuthDiagnosticsProvider.ts only validates that a string has length greater
than zero, which means whitespace-only strings like " " would incorrectly pass
validation and be treated as valid configuration values. This causes false
positives in readiness checks when required settings like secretKey are actually
missing or contain only spaces. Update the isNonEmptyString type guard to also
check that the trimmed string has non-zero length, ensuring whitespace-only
values are properly rejected as invalid configuration.
In `@packages/auth-clerk/src/tests/AuthConformance.spec.ts`:
- Around line 212-213: The live smoke guard check is throwing a generic Error
instance instead of a Problem subclass, which violates the coding guideline that
requires throwing only Problem subclasses. In the Clerk live smoke validation
block where it checks for secret key and session token presence, replace the
generic Error with an appropriate Problem subclass constructor to maintain
consistency with the project's error handling standards.
In `@packages/auth-clerk/vitest.config.ts`:
- Line 15: The `@croco/testing` alias in the vitest config is pointing directly to
an internal implementation file at
../testing/src/libs/auth-provider-conformance.ts instead of the public barrel
entry. This bypasses the public API contract validation. Change the alias path
to point to the root entry file at ../testing/src/index.ts so that the test
validates the actual public API export path that users would consume.
In
`@packages/docs/src/content/docs/api/auth-clerk/src/classes/ClerkExternalServiceProblem.md`:
- Line 8: The JSDoc comment at line 87 in packages/auth-clerk/src/index.ts is a
shared block comment that applies to all exported classes in that section, but
the comment "Clerk 조직이 이미 다른 tenant에 매핑되어 있을 때 발생하는 Problem입니다." only describes
DuplicateTenantMappingProblem, causing incorrect documentation for
ClerkExternalServiceProblem and other classes. Remove or replace the block-level
JSDoc comment and instead add individual JSDoc comments above each class export
(DuplicateTenantMappingProblem, ClerkExternalServiceProblem, and any others in
that block), with each comment accurately describing only that specific class.
In
`@packages/docs/src/content/docs/api/auth-clerk/src/classes/ClerkMalformedClaimProblem.md`:
- Line 8: The JSDoc comment for the ClerkMalformedClaimProblem class in
packages/auth-clerk/src/libs/problems/ClerkProblems.ts contains an incorrect
description that does not match the actual implementation. Update the JSDoc
documentation to accurately describe that this problem occurs when a Clerk token
contains a malformed claim (matching the actual error message pattern of "Clerk
token contained a malformed '${claimName}' claim"), instead of the current
description about organization-to-tenant mapping. This will ensure the
auto-generated documentation reflects the correct purpose of the
ClerkMalformedClaimProblem class.
In
`@packages/docs/src/content/docs/api/auth-clerk/src/classes/ClerkPublicUserDataMissingProblem.md`:
- Line 8: The JSDoc comment for the ClerkPublicUserDataMissingProblem class
contains an incorrect description that is confused with
DuplicateTenantMappingProblem. Update the JSDoc comment for
ClerkPublicUserDataMissingProblem to accurately describe that this Problem
occurs when publicUserData is missing from the organization membership response,
which aligns with the actual problem code auth-clerk/public-user-data-missing.
Remove the incorrect reference to tenant mapping and replace it with the correct
description of the missing public user data scenario.
In
`@packages/docs/src/content/docs/api/auth-clerk/src/classes/ClerkTokenVerificationProblem.md`:
- Line 8: The JSDoc comment for the ClerkTokenVerificationProblem class in
packages/auth-clerk/src/libs/problems/ClerkProblems.ts contains an incorrect
description about tenant mapping, which is a copy-paste error. Update the JSDoc
comment for the ClerkTokenVerificationProblem class to accurately describe its
actual purpose: indicating a Clerk JWT token verification failure (associated
with error code auth-clerk/token-verification-failed), rather than describing
tenant mapping issues. Ensure the description clearly communicates that this
problem represents a failed token verification attempt.
In
`@packages/docs/src/content/docs/api/auth-clerk/src/classes/ClerkTokenVerificationUpstreamProblem.md`:
- Line 8: The description for the ClerkTokenVerificationUpstreamProblem class in
the documentation file has been incorrectly copied from the
DuplicateTenantMappingProblem class. The current description "Clerk 조직이 이미 다른
tenant에 매핑되어 있을 때 발생하는 Problem입니다." does not match what
ClerkTokenVerificationUpstreamProblem represents. Replace this description with
the correct one that accurately describes upstream token verification failures,
such as "Clerk 토큰 검증 중 업스트림 서비스 오류가 발생했을 때의 문제입니다." or similar content that
reflects the purpose of the ClerkTokenVerificationUpstreamProblem class.
In
`@packages/docs/src/content/docs/api/auth-clerk/src/classes/InvalidWebhookPayloadProblem.md`:
- Around line 36-42: The category property documentation for
InvalidWebhookPayloadProblem only references the generic ProblemCategory
enumeration link without specifying the actual concrete category value assigned
to this class. Update the category property documentation in
InvalidWebhookPayloadProblem.md to explicitly show the specific category value
(such as BadRequest or InternalServerError) that this problem uses, following
the same documentation pattern used in other Problem class documentation like
DuplicateTenantMappingProblem.md to provide clarity on the actual assigned
value.
- Line 8: The description in the InvalidWebhookPayloadProblem.md file at line 8
is incorrect and has been copied from the DuplicateTenantMappingProblem class.
Replace the current description "Clerk 조직이 이미 다른 tenant에 매핑되어 있을 때 발생하는
Problem입니다." with an accurate description for InvalidWebhookPayloadProblem that
explains it occurs when a Clerk webhook payload is invalid or does not have the
expected structure, such as "Clerk 웹훅 페이로드가 유효하지 않거나 예상되는 구조를 가지지 않을 때 발생합니다."
or similar wording that correctly describes invalid webhook payload scenarios.
In
`@packages/docs/src/content/docs/api/auth-clerk/src/classes/WebhookVerificationProblem.md`:
- Line 8: The description text for the WebhookVerificationProblem class at line
8 is incorrect and appears to be copied from DuplicateTenantMappingProblem
documentation. Update this description to accurately reflect what
WebhookVerificationProblem represents, which is a problem that occurs when
webhook verification fails (as indicated by the error code
auth-clerk/webhook-verification-failed). The description should be based on the
WebhookVerificationProblem class JSDoc comments in the source TypeScript file to
ensure accuracy and consistency.
In
`@packages/docs/src/content/docs/api/auth-clerk/src/functions/createClerkTokenVerificationProblem.md`:
- Line 10: The description text on line 10 for the
createClerkTokenVerificationProblem function is incorrect and appears to be
copied from a different problem type (DuplicateTenantMappingProblem). The
current description about tenant mapping is unrelated to token verification and
does not match the function name and return type (ClerkTokenVerificationProblem
| ClerkTokenVerificationUpstreamProblem). Locate the JSDoc comment for the
createClerkTokenVerificationProblem function in the source TypeScript file and
update it with an accurate description explaining what problem occurs during
Clerk token verification, then regenerate the documentation from that updated
JSDoc comment.
In
`@packages/docs/src/content/docs/api/protocols-rest/src/interfaces/ArgumentMetadata.md`:
- Line 24: The type property definition in ArgumentMetadata.md has the union
types in a different order than the source code definition in PipeTransform.ts.
Update line 24 in ArgumentMetadata.md to reorder the type union from the current
sequence of body, query, header, custom, param to match the source code order of
param, query, body, header, custom. This ensures documentation consistency with
the actual implementation.
In `@packages/docs/src/content/docs/en/reference/problem-recovery-cookbook.md`:
- Around line 773-789: The markdown file contains inaccurate source line number
references for multiple problem classes. Update all source line references in
the problem-recovery-cookbook.md file: change the reference for
BetterAuthAuthenticationProblem from line 7:3 to 6, ClerkMalformedClaimProblem
from 65 to 64, DuplicateTenantMappingProblem from 73 to 72,
ClerkPublicUserDataMissingProblem from 85 to 84, and ClerkExternalServiceProblem
from 94 to 92. Verify the actual line numbers in the corresponding source files
(BetterAuthAuthenticationProblem.ts and ClerkProblems.ts) to ensure all
references match the current definitions.
In `@packages/testing/src/tests/testing.spec.ts`:
- Around line 917-923: The code uses optional chaining on upstreamCase and then
passes the result directly to await and expect, which obscures the actual
failure cause if the case is not found. Add an explicit assertion immediately
after the find operation to verify that upstreamCase exists before attempting to
call the run() method. This separation ensures that if the "upstream auth
failures" test case is not found in suite.cases, the test will fail with a clear
error about the missing case rather than a confusing Promise-related error.
🪄 Autofix (Beta)
Fix all unresolved CodeRabbit comments on this PR:
- Push a commit to this branch (recommended)
- Create a new PR with the fixes
ℹ️ Review info
⚙️ Run configuration
Configuration used: Organization UI
Review profile: ASSERTIVE
Plan: Pro
Run ID: 6f3eb999-d2cf-4bc8-8f5f-1c7732e07f7c
⛔ Files ignored due to path filters (1)
pnpm-lock.yamlis excluded by!**/pnpm-lock.yaml
📒 Files selected for processing (133)
.changeset/auth-provider-conformance.md.github/workflows/ci.ymlREADME.mddocs/package-catalog.jsondocs/package-docs-baseline.jsondocs/package-docs-report.mddocs/problem-code-registry.jsonpackages/auth-better-auth/README.mdpackages/auth-better-auth/package.jsonpackages/auth-better-auth/src/index.tspackages/auth-better-auth/src/libs/BetterAuthDiagnosticsProvider.tspackages/auth-better-auth/src/libs/BetterAuthProvider.tspackages/auth-better-auth/src/libs/problems/BetterAuthAuthenticationProblem.tspackages/auth-better-auth/src/tests/AuthConformance.spec.tspackages/auth-better-auth/src/tests/BetterAuthProvider.spec.tspackages/auth-better-auth/src/tests/Problems.spec.tspackages/auth-better-auth/vitest.config.tspackages/auth-clerk/README.mdpackages/auth-clerk/package.jsonpackages/auth-clerk/src/index.tspackages/auth-clerk/src/libs/ClerkAuthDiagnosticsProvider.tspackages/auth-clerk/src/libs/ClerkAuthProvider.tspackages/auth-clerk/src/libs/problems/ClerkProblems.tspackages/auth-clerk/src/tests/AuthConformance.spec.tspackages/auth-clerk/src/tests/ClerkAuthProvider.spec.tspackages/auth-clerk/src/tests/ClerkProblems.spec.tspackages/auth-clerk/vitest.config.tspackages/create-croco-app/src/tests/PublishedCli.spec.tspackages/docs/astro.config.mjspackages/docs/package.jsonpackages/docs/src/content/docs/api/auth-better-auth/src/classes/BetterAuthAuthenticationProblem.mdpackages/docs/src/content/docs/api/auth-better-auth/src/classes/BetterAuthDiagnosticsProvider.mdpackages/docs/src/content/docs/api/auth-better-auth/src/classes/BetterAuthFactory.mdpackages/docs/src/content/docs/api/auth-better-auth/src/classes/BetterAuthInvalidSessionProblem.mdpackages/docs/src/content/docs/api/auth-better-auth/src/classes/BetterAuthNotInitializedProblem.mdpackages/docs/src/content/docs/api/auth-better-auth/src/classes/BetterAuthProvider.mdpackages/docs/src/content/docs/api/auth-better-auth/src/classes/BetterAuthSessionLookupProblem.mdpackages/docs/src/content/docs/api/auth-better-auth/src/classes/BetterAuthSessionManager.mdpackages/docs/src/content/docs/api/auth-better-auth/src/classes/BetterAuthSessionNotFoundProblem.mdpackages/docs/src/content/docs/api/auth-better-auth/src/classes/BetterAuthUserNotFoundProblem.mdpackages/docs/src/content/docs/api/auth-better-auth/src/classes/BetterAuthWebhookProcessor.mdpackages/docs/src/content/docs/api/auth-better-auth/src/classes/InvalidWebhookPayloadProblem.mdpackages/docs/src/content/docs/api/auth-better-auth/src/classes/InvalidWebhookSignatureProblem.mdpackages/docs/src/content/docs/api/auth-better-auth/src/functions/isRetryableBetterAuthError.mdpackages/docs/src/content/docs/api/auth-better-auth/src/interfaces/BetterAuthConfig.mdpackages/docs/src/content/docs/api/auth-better-auth/src/interfaces/BetterAuthSessionProvider.mdpackages/docs/src/content/docs/api/auth-better-auth/src/type-aliases/BetterAuthDiagnosticsConfig.mdpackages/docs/src/content/docs/api/auth-better-auth/src/type-aliases/BetterAuthDiagnosticsOptions.mdpackages/docs/src/content/docs/api/auth-better-auth/src/type-aliases/BetterAuthReadinessCheckContext.mdpackages/docs/src/content/docs/api/auth-better-auth/src/type-aliases/BetterAuthReadinessCheckResult.mdpackages/docs/src/content/docs/api/auth-better-auth/src/type-aliases/BetterAuthSession.mdpackages/docs/src/content/docs/api/auth-better-auth/src/type-aliases/BetterAuthUser.mdpackages/docs/src/content/docs/api/auth-better-auth/src/type-aliases/BetterAuthWebhookEvent.mdpackages/docs/src/content/docs/api/auth-better-auth/src/type-aliases/BetterAuthWebhookHandler.mdpackages/docs/src/content/docs/api/auth-better-auth/src/type-aliases/BetterAuthWebhookOptions.mdpackages/docs/src/content/docs/api/auth-better-auth/src/variables/DRIZZLE_TOKEN.mdpackages/docs/src/content/docs/api/auth-better-auth/src/variables/account.mdpackages/docs/src/content/docs/api/auth-better-auth/src/variables/session.mdpackages/docs/src/content/docs/api/auth-better-auth/src/variables/user.mdpackages/docs/src/content/docs/api/auth-better-auth/src/variables/verification.mdpackages/docs/src/content/docs/api/auth-clerk/src/classes/ClerkAuthDiagnosticsProvider.mdpackages/docs/src/content/docs/api/auth-clerk/src/classes/ClerkAuthProvider.mdpackages/docs/src/content/docs/api/auth-clerk/src/classes/ClerkExternalServiceProblem.mdpackages/docs/src/content/docs/api/auth-clerk/src/classes/ClerkMalformedClaimProblem.mdpackages/docs/src/content/docs/api/auth-clerk/src/classes/ClerkOrganizationService.mdpackages/docs/src/content/docs/api/auth-clerk/src/classes/ClerkPublicUserDataMissingProblem.mdpackages/docs/src/content/docs/api/auth-clerk/src/classes/ClerkSessionProvider.mdpackages/docs/src/content/docs/api/auth-clerk/src/classes/ClerkTenantMapper.mdpackages/docs/src/content/docs/api/auth-clerk/src/classes/ClerkTokenVerificationProblem.mdpackages/docs/src/content/docs/api/auth-clerk/src/classes/ClerkTokenVerificationUpstreamProblem.mdpackages/docs/src/content/docs/api/auth-clerk/src/classes/ClerkUserService.mdpackages/docs/src/content/docs/api/auth-clerk/src/classes/ClerkWebhookHandler.mdpackages/docs/src/content/docs/api/auth-clerk/src/classes/DuplicateTenantMappingProblem.mdpackages/docs/src/content/docs/api/auth-clerk/src/classes/InvalidWebhookPayloadProblem.mdpackages/docs/src/content/docs/api/auth-clerk/src/classes/WebhookVerificationProblem.mdpackages/docs/src/content/docs/api/auth-clerk/src/functions/createClerkTokenVerificationProblem.mdpackages/docs/src/content/docs/api/auth-clerk/src/interfaces/TenantMappingStore.mdpackages/docs/src/content/docs/api/auth-clerk/src/type-aliases/AuthorizationHeaderCarrier.mdpackages/docs/src/content/docs/api/auth-clerk/src/type-aliases/ClerkAuthDiagnosticsConfig.mdpackages/docs/src/content/docs/api/auth-clerk/src/type-aliases/ClerkAuthDiagnosticsOptions.mdpackages/docs/src/content/docs/api/auth-clerk/src/type-aliases/ClerkAuthOptions.mdpackages/docs/src/content/docs/api/auth-clerk/src/type-aliases/ClerkAuthReadinessCheckContext.mdpackages/docs/src/content/docs/api/auth-clerk/src/type-aliases/ClerkAuthReadinessCheckResult.mdpackages/docs/src/content/docs/api/auth-clerk/src/type-aliases/ClerkMembershipEvent.mdpackages/docs/src/content/docs/api/auth-clerk/src/type-aliases/ClerkOrgEvent.mdpackages/docs/src/content/docs/api/auth-clerk/src/type-aliases/ClerkOrganization.mdpackages/docs/src/content/docs/api/auth-clerk/src/type-aliases/ClerkOrganizationInvitation.mdpackages/docs/src/content/docs/api/auth-clerk/src/type-aliases/ClerkOrganizationMembership.mdpackages/docs/src/content/docs/api/auth-clerk/src/type-aliases/ClerkTenantRequest.mdpackages/docs/src/content/docs/api/auth-clerk/src/type-aliases/ClerkTokenVerificationOperation.mdpackages/docs/src/content/docs/api/auth-clerk/src/type-aliases/ClerkUser.mdpackages/docs/src/content/docs/api/auth-clerk/src/type-aliases/ClerkUserEvent.mdpackages/docs/src/content/docs/api/auth-clerk/src/type-aliases/CreateClerkUserInput.mdpackages/docs/src/content/docs/api/auth-clerk/src/type-aliases/CreateInvitationInput.mdpackages/docs/src/content/docs/api/auth-clerk/src/type-aliases/CreateMembershipInput.mdpackages/docs/src/content/docs/api/auth-clerk/src/type-aliases/CreateOrganizationInput.mdpackages/docs/src/content/docs/api/auth-clerk/src/type-aliases/OrganizationListOptions.mdpackages/docs/src/content/docs/api/auth-clerk/src/type-aliases/OrganizationListResult.mdpackages/docs/src/content/docs/api/auth-clerk/src/type-aliases/UpdateClerkUserInput.mdpackages/docs/src/content/docs/api/auth-clerk/src/type-aliases/UpdateOrganizationInput.mdpackages/docs/src/content/docs/api/auth-clerk/src/type-aliases/UserListOptions.mdpackages/docs/src/content/docs/api/auth-clerk/src/type-aliases/UserListResult.mdpackages/docs/src/content/docs/api/auth-clerk/src/type-aliases/WebhookEventHandler.mdpackages/docs/src/content/docs/api/auth-clerk/src/type-aliases/WebhookEventType.mdpackages/docs/src/content/docs/api/auth-clerk/src/type-aliases/WebhookHandlerOptions.mdpackages/docs/src/content/docs/api/protocols-core/src/interfaces/ParamIR.mdpackages/docs/src/content/docs/api/protocols-rest/src/classes/RequestValidationProblem.mdpackages/docs/src/content/docs/api/protocols-rest/src/functions/validateRequest.mdpackages/docs/src/content/docs/api/protocols-rest/src/interfaces/ArgumentMetadata.mdpackages/docs/src/content/docs/api/testing/src/functions/createAuthProviderConformanceSuite.mdpackages/docs/src/content/docs/api/testing/src/type-aliases/AuthProviderAuthConformance.mdpackages/docs/src/content/docs/api/testing/src/type-aliases/AuthProviderConformanceCase.mdpackages/docs/src/content/docs/api/testing/src/type-aliases/AuthProviderConformanceOptions.mdpackages/docs/src/content/docs/api/testing/src/type-aliases/AuthProviderConformanceSuite.mdpackages/docs/src/content/docs/api/testing/src/type-aliases/AuthProviderCredentialFailureExpectation.mdpackages/docs/src/content/docs/api/testing/src/type-aliases/AuthProviderLiveSmokeGate.mdpackages/docs/src/content/docs/api/testing/src/type-aliases/AuthProviderProblemExpectation.mdpackages/docs/src/content/docs/api/testing/src/type-aliases/AuthProviderReadinessConformance.mdpackages/docs/src/content/docs/api/testing/src/type-aliases/AuthProviderTenantMappingConformance.mdpackages/docs/src/content/docs/api/testing/src/type-aliases/AuthProviderTenantMappingEvidence.mdpackages/docs/src/content/docs/api/testing/src/type-aliases/AuthProviderWebhookConformance.mdpackages/docs/src/content/docs/en/reference/extension-matrix.mdpackages/docs/src/content/docs/en/reference/problem-recovery-cookbook.mdpackages/docs/tsconfig.typedoc.jsonpackages/migration-runner/src/tests/PublishedCli.spec.tspackages/testing/README.mdpackages/testing/package.jsonpackages/testing/src/index.tspackages/testing/src/libs/auth-provider-conformance.tspackages/testing/src/tests/testing.spec.tspackages/testing/tsconfig.jsonpackages/testing/vitest.config.tspublic-api-surface.snapshot.json
💤 Files with no reviewable changes (2)
- docs/package-docs-baseline.json
- packages/migration-runner/src/tests/PublishedCli.spec.ts
kang-heewon
force-pushed
the
fix/942-auth-conformance
branch
2 times, most recently
from
June 21, 2026 18:38
86c8d25 to
510ba79
Compare
kang-heewon
force-pushed
the
fix/942-auth-conformance
branch
from
June 21, 2026 18:43
510ba79 to
934436f
Compare
This was referenced Jul 16, 2026
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Fixes #942.
Summary
Verification
pnpm format- passed.pnpm --filter @croco/testing test- passed, 61 tests.pnpm --filter @croco/auth-better-auth test- passed, 6 files / 101 tests.pnpm --filter @croco/auth-clerk test- passed, 8 files / 90 tests; existing package export-condition warning remains.pnpm typecheck --filter=@croco/testing --filter=@croco/auth-better-auth --filter=@croco/auth-clerk- passed, 54 Turbo tasks.pnpm check- passed.pnpm --filter @croco/docs docs:build- passed, 1821 pages; existing TypeDoc unknown-tag warnings and sitemapsitewarning remain.pnpm changeset-required:check -- --base origin/trunk --head HEAD- passed.git diff --check- passed before commit.Self-review gates
@croco/testing, provider-specific behavior stays in the provider packages, maturity remains alpha/WIP, and no new provider or credential requirement is introduced.Independent review
A read-only adversarial review found three blockers before final verification: Better Auth masked retryable 408/429 upstream auth failures as null, Clerk accepted missing token subjects as invalid
AuthUserids, and readiness diagnostics could leak raw configured secrets in generic fields. The final patch classifies those upstream failures as Problems, rejects missing ClerksubwithClerkMalformedClaimProblem, exact-redacts configured secrets, and adds regression coverage for each case.Risk
Low-medium. The shared conformance contract is additive, but Better Auth and Clerk now fail closed for malformed payloads and retryable upstream failures instead of treating them as unauthenticated sessions.
Summary by CodeRabbit
릴리스 노트
New Features
auth-better-auth/authentication-failed,auth-clerk/token-verification-upstream-failedDocumentation