feat(expo): add biometric trusted devices - #9257
Conversation
🦋 Changeset detectedLatest commit: 714b97f The changes in this PR will be included in the next version bump. This PR includes changesets to release 1 package
Not sure what this means? Click here to learn what changesets are. Click here if you're a maintainer who wants to add another changeset to this PR |
|
The latest updates on your projects. Learn more about Vercel for GitHub.
|
@clerk/astro
@clerk/backend
@clerk/chrome-extension
@clerk/clerk-js
@clerk/electron
@clerk/electron-passkeys
@clerk/eslint-plugin
@clerk/expo
@clerk/expo-google-signin
@clerk/expo-passkeys
@clerk/express
@clerk/fastify
@clerk/hono
@clerk/localizations
@clerk/nextjs
@clerk/nuxt
@clerk/react
@clerk/react-router
@clerk/shared
@clerk/tanstack-react-start
@clerk/testing
@clerk/ui
@clerk/upgrade
@clerk/vue
commit: |
|
@coderabbitai review |
|
@macroscope-app review |
|
Manual reviews triggered for commit All prior checks · these links stay valid even if you push more commits. |
|
Review triggered. The Approvability and Correctness checks are running now — results will be posted when complete. |
✅ Action performedReview finished.
|
📝 WalkthroughWalkthroughThe Expo package adds biometric trusted-device enrollment, listing, availability, revocation, and sign-in APIs for iOS and Android, with structured native errors and forward-compatible fields. It adds Estimated code review effort: 4 (Complex) | ~60 minutes Possibly related PRs
Suggested reviewers: 🚥 Pre-merge checks | ✅ 4 | ❌ 1❌ Failed checks (1 warning)
✅ Passed checks (4 passed)
Warning Review ran into problems🔥 ProblemsRepository analysis: Couldn't refresh Linked repositories: Couldn't analyze
Errors logged to '/home/jailuser/git/.git/lfs/logs/20260727T185355.998291611.log'. Errors logged to '/home/jailuser/git/.git/lfs/logs/20260727T185516.506366854.log'. Comment |
![coderabbitai[bot]](https://cdn.github.com/in/347564?s=60&v=4){kind=small}
There was a problem hiding this comment.
Actionable comments posted: 2
🧹 Nitpick comments (1)
packages/expo/src/trusted-devices/index.ts (1)
1-3: 📐 Maintainability & Code Quality | 🔵 Trivial | ⚡ Quick winRemove this feature-module barrel.
Keep re-exports at
packages/expo/src/index.tsand export the three trusted-device modules there directly; this avoids introducing an internal circular-dependency hub.Based on learnings, only package-level entry points are exempted; as per coding guidelines, “Avoid barrel files (index.ts re-exports) as they can cause circular dependencies.”
🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the rest with a brief reason, keep changes minimal, and validate. In `@packages/expo/src/trusted-devices/index.ts` around lines 1 - 3, Remove the trusted-devices feature-module barrel by deleting its index re-exports, then update the package-level packages/expo/src/index.ts entry point to export errors, types, and useTrustedDevices directly. Do not add or retain another internal index.ts re-export hub.Sources: Coding guidelines, Learnings
🤖 Prompt for all review comments with AI agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
Inline comments:
In `@packages/expo/android/build.gradle`:
- Around line 23-24: Update the clerkAndroidApiVersion and clerkAndroidUiVersion
pins to published Clerk Android SDK versions before merging, ensuring both
dependency coordinates resolve successfully for `@clerk/expo` consumers.
In `@packages/expo/src/native/useAuthFlow.ts`:
- Around line 71-87: Update the getAuthFlowState promise handler in useAuthFlow
so a resolved value that fails isNativeAuthFlowState is treated like a failed
native-state lookup: when still mounted and no event has been received, call
setUseJsFallback(true) instead of leaving nativeState unloaded. Preserve
setNativeState for valid payloads and retain the existing rejection handling.
---
Nitpick comments:
In `@packages/expo/src/trusted-devices/index.ts`:
- Around line 1-3: Remove the trusted-devices feature-module barrel by deleting
its index re-exports, then update the package-level packages/expo/src/index.ts
entry point to export errors, types, and useTrustedDevices directly. Do not add
or retain another internal index.ts re-export hub.
🪄 Autofix (Beta)
Fix all unresolved CodeRabbit comments on this PR:
- Push a commit to this branch (recommended)
- Create a new PR with the fixes
ℹ️ Review info
⚙️ Run configuration
Configuration used: Repository YAML (base), Organization UI (inherited)
Review profile: CHILL
Plan: Pro Plus
Run ID: 89ef4001-80da-4149-b7ff-47d48402780a
📒 Files selected for processing (28)
.changeset/thin-spoons-trust.mdpackages/expo/README.mdpackages/expo/android/build.gradlepackages/expo/android/src/main/java/expo/modules/clerk/ClerkExpoModule.ktpackages/expo/android/src/test/java/expo/modules/clerk/TrustedDeviceBridgeTest.ktpackages/expo/app.plugin.jspackages/expo/ios/ClerkExpo.podspecpackages/expo/ios/ClerkExpoModule.swiftpackages/expo/ios/ClerkNativeBridge.swiftpackages/expo/src/__tests__/appPlugin.theme.test.jspackages/expo/src/index.tspackages/expo/src/native/AuthView.tsxpackages/expo/src/native/AuthView.types.tspackages/expo/src/native/__tests__/useAuthFlow.test.tsxpackages/expo/src/native/index.tspackages/expo/src/native/useAuthFlow.tspackages/expo/src/specs/NativeClerkModule.android.tspackages/expo/src/specs/NativeClerkModule.tspackages/expo/src/specs/NativeClerkModule.types.tspackages/expo/src/trusted-devices/__tests__/useTrustedDevices.test.tspackages/expo/src/trusted-devices/errors.tspackages/expo/src/trusted-devices/index.tspackages/expo/src/trusted-devices/types.tspackages/expo/src/trusted-devices/useTrustedDevices.android.tspackages/expo/src/trusted-devices/useTrustedDevices.ios.tspackages/expo/src/trusted-devices/useTrustedDevices.shared.tspackages/expo/src/trusted-devices/useTrustedDevices.tspackages/expo/src/utils/native-module.ts
🔗 Linked repositories identified
CodeRabbit considers these linked repositories for cross-repo context during reviews:
clerk/clerk_go(manual) → reviewed against branchsean/Trusted-device-sign-ininstead of the default branchclerk/dashboard(manual) → reviewed against open PR#9624sean/Trusted-device-sign-ininstead of the default branchclerk/accounts(manual)clerk/backoffice(manual)clerk/clerk(manual) → reviewed against open PR#3039sean/Trusted-device-sign-ininstead of the default branchclerk/clerk-docs(manual)clerk/cloudflare-workers(manual)clerk/clerk-ios(auto-detected) → reviewed against open PR#486sean/Trusted-device-sign-ininstead of the default branchclerk/clerk-android(auto-detected)clerk/cli(auto-detected)
| clerkAndroidApiVersion = "1.0.37" | ||
| clerkAndroidUiVersion = "1.0.37" |
There was a problem hiding this comment.
🩺 Stability & Availability | 🟠 Major | ⚡ Quick win
🧩 Analysis chain
🌐 Web query:
Are com.clerk:clerk-android-api:1.0.37andcom.clerk:clerk-android-ui:1.0.37 released and publicly available from the Maven repository used by Clerk Expo consumers?
💡 Result:
As of July 27, 2026, the artifacts com.clerk:clerk-android-api:1.0.37 and com.clerk:clerk-android-ui:1.0.37 are not released and publicly available in Maven Central. The official Clerk Android SDK, which is published to Maven Central under the com.clerk group, currently has a latest released version of 1.0.33, published on July 8, 2026 [1][2]. There is no record of a 1.0.37 release for these specific artifacts in the official Maven repository used by Clerk consumers [3][4][1]. Clerk recommends checking their official GitHub releases page [1] or Maven Central directly to confirm the availability of specific versions [5][6].
Citations:
- 1: https://github.com/clerk/clerk-android/releases
- 2: https://github.com/clerk/clerk-android/releases/tag/v1.0.33
- 3: https://mvnrepository.com/artifact/com.clerk/clerk-android-api
- 4: https://mvnrepository.com/artifact/com.clerk/clerk-android-api/1.0.34
- 5: https://github.com/clerk/clerk-android
- 6: https://clerk.com/docs/android/getting-started/quickstart
🏁 Script executed:
#!/bin/bash
set -euo pipefail
printf '\n== build.gradle snippet ==\n'
sed -n '1,80p' packages/expo/android/build.gradle
printf '\n== search for 1.0.37 references ==\n'
rg -n '1\.0\.37|clerk-android-(api|ui)' packages/expo -S || true
printf '\n== repository declarations ==\n'
rg -n 'mavenCentral|google\(\)|maven \{' packages/expo/android -S || trueRepository: clerk/javascript
Length of output: 1908
🏁 Script executed (no clone):
#!/bin/bash
set -euo pipefail
python3 - <<'PY'
import json, urllib.request, urllib.error
urls = {
"maven_api_1_0_37": "https://repo1.maven.org/maven2/com/clerk/clerk-android-api/1.0.37/",
"maven_ui_1_0_37": "https://repo1.maven.org/maven2/com/clerk/clerk-android-ui/1.0.37/",
}
for name, url in urls.items():
try:
with urllib.request.urlopen(url, timeout=20) as r:
print(name, r.status, r.geturl())
print(r.read(200).decode("utf-8", "ignore"))
except Exception as e:
print(name, "ERROR", repr(e))
PY
Length of output: 327
Replace the Android SDK pins before merging. com.clerk:clerk-android-api:1.0.37 and com.clerk:clerk-android-ui:1.0.37 aren’t published yet, so @clerk/expo will fail to resolve Android dependencies for consumers.
🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
In `@packages/expo/android/build.gradle` around lines 23 - 24, Update the
clerkAndroidApiVersion and clerkAndroidUiVersion pins to published Clerk Android
SDK versions before merging, ensuring both dependency coordinates resolve
successfully for `@clerk/expo` consumers.
There was a problem hiding this comment.
Agreed. This PR is intentionally a draft and is blocked on the native SDK releases. These are temporary placeholder pins for the upcoming Android trusted-device release, so the Android CI failures are currently expected. Once Clerk Android is published, its release workflow will automatically open an Expo dependency-bump PR. I’ll rebase that change and use the published version before marking this PR ready or merging it.
There was a problem hiding this comment.
@seanperez29, thanks for clarifying. That release-gating plan addresses the concern: keeping the placeholder pins is reasonable while this remains a draft, provided they are replaced by the published dependency-bump before the PR is marked ready or merged. I’ll leave the finding open until then.
✏️ Learnings added
Learnt from: seanperez29
Repo: clerk/javascript PR: 9257
File: packages/expo/android/build.gradle:23-24
Timestamp: 2026-07-27T19:04:52.833Z
Learning: For GitHub pull request `#9257` in `clerk/javascript`, `packages/expo/android/build.gradle` intentionally uses temporary unreleased Clerk Android SDK pins for trusted-device support while the PR remains a draft. Android CI failures are expected until Clerk Android publishes the release; its release workflow will open an Expo dependency-bump PR, which must be rebased and applied before this PR is marked ready or merged.
Note: Learnings are effective only in the context of similar code segments. To apply general coding guidelines, please configure review instructions. You can manage existing learnings in the app.
|
|
||
| clerk_ios_repo = 'https://github.com/clerk/clerk-ios.git' | ||
| clerk_ios_version = '1.3.4' | ||
| clerk_ios_requirement = { :kind => 'revision', :revision => '1026c9d6fb8183b6eb2a0f67bed25d2a5a3ce2cd' } |
There was a problem hiding this comment.
Will correct this once iOS is released
2 participants
Description
Adds biometric trusted-device support to
@clerk/expofor iOS and Android.This PR:
useTrustedDevices()APIs for checking availability, enrolling, listing, revoking, and signing in with trusted devices.useAuthFlow()for gating authenticated content until native authentication and Clerk-owned post-authentication steps are complete.faceIDPermissionconfig-plugin setting forNSFaceIDUsageDescription.Testing
Tested in an Expo development build on a physical iOS device:
faceIDPermissionthrough the Expo config plugin.AuthView.useAuthFlow()correctly gates authenticated content.Automated validation:
pnpm --filter @clerk/expo test— 137 tests passed.pnpm --filter @clerk/expo build— passed.pnpm --filter @clerk/expo format:check— passed.pnpm --filter @clerk/expo lint— passed with no errors.Release coordination
This PR currently depends on unreleased Clerk iOS and Android trusted-device APIs. The temporary native dependency pins must be replaced with the officially released versions from the automated Expo bump PRs before this PR is merged.
Checklist
Type of change