fix(clerk-js): Bypass captcha on OAuth backport for Core 2 (#8734)

Co-authored-by: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

Author: dmoerner

.changeset/oauth-captcha-callback-backport.md

@@ -0,0 +1,5 @@
+---
+'@clerk/clerk-js': patch
+---
+
+Fix new OAuth users hanging on the SSO callback. When an OAuth sign-in transfers to a sign-up, the captcha is now correctly bypassed for providers in the captcha OAuth bypass list, instead of unconditionally showing a captcha that could never be completed.

packages/clerk-js/src/core/resources/SignUp.ts

@@ -182,13 +182,6 @@ export class SignUp extends BaseResource implements SignUpResource {
       finalParams = { ...finalParams, ...captchaParams };
     }
 
-    if (finalParams.transfer && this.shouldBypassCaptchaForAttempt(finalParams)) {
-      const strategy = SignUp.clerk.client?.signIn.firstFactorVerification.strategy;
-      if (strategy) {
-        finalParams = { ...finalParams, strategy: strategy as SignUpCreateParams['strategy'] };
-      }
-    }
-
     return this._basePost({
       path: this.pathRoot,
       body: normalizeUnsafeMetadata(finalParams),
@@ -562,17 +555,13 @@ export class SignUp extends BaseResource implements SignUpResource {
    * We delegate bot detection to the following providers, instead of relying on turnstile exclusively
    */
   protected shouldBypassCaptchaForAttempt(params: SignUpCreateParams) {
-    if (!params.strategy) {
-      return false;
-    }
-
     // eslint-disable-next-line @typescript-eslint/no-non-null-assertion
     const captchaOauthBypass = SignUp.clerk.__unstable__environment!.displayConfig.captchaOauthBypass;
 
-    if (captchaOauthBypass.some(strategy => strategy === params.strategy)) {
-      return true;
-    }
-
+    // OAuth transfers: If we delegate captcha detection to the OAuth provider,
+    // do not show another captcha on sign up. The strategy lives on the sign in
+    // verification rather than on `params`, so this must be checked before any
+    // early return based on `params.strategy`.
     if (
       params.transfer &&
       // eslint-disable-next-line @typescript-eslint/no-non-null-assertion
@@ -581,6 +570,12 @@ export class SignUp extends BaseResource implements SignUpResource {
       return true;
     }
 
+    // OAuth sign ups: If we delegate captcha detection to the OAuth provider,
+    // do not show another captcha on sign up.
+    if (params.strategy && captchaOauthBypass.some(strategy => strategy === params.strategy)) {
+      return true;
+    }
+
     return false;
   }
 

packages/clerk-js/src/core/resources/__tests__/SignUp.test.ts

@@ -25,13 +25,90 @@ vi.mock('../../../utils/captcha/CaptchaChallenge', () => ({
   })),
 }));
 
+// Import the mocked CaptchaChallenge after mocking
+import { CaptchaChallenge } from '../../../utils/captcha/CaptchaChallenge';
+
 describe('SignUp', () => {
   it('can be serialized with JSON.stringify', () => {
     const signUp = new SignUp();
     const snapshot = JSON.stringify(signUp);
     expect(snapshot).toBeDefined();
   });
 
+  describe('create', () => {
+    beforeEach(() => {
+      SignUp.clerk = {
+        __unstable__environment: {
+          displayConfig: {
+            captchaOauthBypass: [],
+          },
+        },
+      } as any;
+    });
+
+    afterEach(() => {
+      vi.clearAllMocks();
+      vi.unstubAllGlobals();
+      SignUp.clerk = {} as any;
+    });
+
+    it('skips captcha challenge for oauth transfer when strategy is in captchaOauthBypass', async () => {
+      const mockFetch = vi.fn().mockResolvedValue({
+        client: null,
+        response: { id: 'signup_123', status: 'missing_requirements' },
+      });
+      BaseResource._fetch = mockFetch;
+      SignUp.clerk = {
+        client: {
+          signIn: {
+            firstFactorVerification: {
+              status: 'transferable',
+              strategy: 'oauth_google',
+            },
+          },
+        },
+        __unstable__environment: {
+          displayConfig: {
+            captchaOauthBypass: ['oauth_google', 'oauth_apple'],
+          },
+        },
+      } as any;
+
+      const signUp = new SignUp();
+      await signUp.create({ transfer: true });
+
+      expect(CaptchaChallenge).not.toHaveBeenCalled();
+    });
+
+    it('does not skip captcha challenge for enterprise_sso transfer', async () => {
+      const mockFetch = vi.fn().mockResolvedValue({
+        client: null,
+        response: { id: 'signup_123', status: 'missing_requirements' },
+      });
+      BaseResource._fetch = mockFetch;
+      SignUp.clerk = {
+        client: {
+          signIn: {
+            firstFactorVerification: {
+              status: 'transferable',
+              strategy: 'enterprise_sso',
+            },
+          },
+        },
+        __unstable__environment: {
+          displayConfig: {
+            captchaOauthBypass: [],
+          },
+        },
+      } as any;
+
+      const signUp = new SignUp();
+      await signUp.create({ transfer: true });
+
+      expect(CaptchaChallenge).toHaveBeenCalledWith(SignUp.clerk);
+    });
+  });
+
   describe('SignUpFuture', () => {
     it('can be serialized with JSON.stringify', () => {
       const signUp = new SignUp();