Skip to content

feat(clerk-js): Send previous session token on /tokens requests#8105

Open
nikosdouvlis wants to merge 2 commits intomainfrom
nikos/plat-2566-send-token-on-refresh
Open

feat(clerk-js): Send previous session token on /tokens requests#8105
nikosdouvlis wants to merge 2 commits intomainfrom
nikos/plat-2566-send-token-on-refresh

Conversation

@nikosdouvlis
Copy link
Member

@nikosdouvlis nikosdouvlis commented Mar 18, 2026

Why

Session Minter needs the previous session JWT to clone claims at the edge without hitting the DB.

What

Send token (previous session JWT) in the POST body on non-template /tokens requests. Uses conditional spread so the key is absent (not token=) when there's no previous token.

The token param is currently ignored by the backend and will be wired up in PLAT-2471.

Test plan

  • Verify token appears in POST body when a previous token exists
  • Verify token key is absent on first mint
  • Verify token is not sent for template token requests
  • Existing token refresh flows still work

Summary by CodeRabbit

  • Bug Fixes

    • Session token refresh requests now include the previous session token to support Session Minter edge token minting.
  • Tests

    • Added test suite validating that token refresh requests properly include or exclude the previous token based on availability and request type.

@vercel
Copy link

vercel bot commented Mar 18, 2026

The latest updates on your projects. Learn more about Vercel for GitHub.

Project Deployment Actions Updated (UTC)
clerk-js-sandbox Ready Ready Preview, Comment Mar 18, 2026 1:58pm

Request Review

@changeset-bot
Copy link

changeset-bot bot commented Mar 18, 2026

🦋 Changeset detected

Latest commit: 388086f

The changes in this PR will be included in the next version bump.

This PR includes changesets to release 3 packages
Name Type
@clerk/clerk-js Patch
@clerk/chrome-extension Patch
@clerk/expo Patch

Not sure what this means? Click here to learn what changesets are.

Click here if you're a maintainer who wants to add another changeset to this PR

Send the current session JWT as `token` in the POST body when
requesting a token refresh. This lets the FAPI Proxy forward it to
Session Minter for claim cloning without a DB read.

Uses conditional spread so the key is absent (not `token=`) when
there's no previous token (first mint).
Unit tests verify the token param is present when lastActiveToken
exists, absent on first mint, absent for template requests, and
matches getRawString() exactly. E2e test verifies token refresh
still works with the new param in the POST body.
@coderabbitai
Copy link
Contributor

coderabbitai bot commented Mar 18, 2026

No actionable comments were generated in the recent review. 🎉

ℹ️ Recent review info
⚙️ Run configuration

Configuration used: Repository YAML (base), Organization UI (inherited)

Review profile: ASSERTIVE

Plan: Pro

Run ID: 8b14d87f-1428-4073-937b-d25173eed6be

📥 Commits

Reviewing files that changed from the base of the PR and between 1e36aec and 388086f.

📒 Files selected for processing (4)
  • .changeset/session-minter-send-token.md
  • integration/tests/resiliency.test.ts
  • packages/clerk-js/src/core/resources/Session.ts
  • packages/clerk-js/src/core/resources/__tests__/Session.test.ts

📝 Walkthrough

Walkthrough

This pull request adds functionality to send the previous session token in /tokens requests to support Session Minter edge token minting. The implementation modifies the token resolver creation in Session.ts to conditionally include the current lastActiveToken as a token parameter alongside organizationId. A changeset entry marks the clerk-js package for a patch release. Tests are added to verify the request body formation, confirming the token is included when lastActiveToken exists and excluded for template requests or initial token minting.

🚥 Pre-merge checks | ✅ 3
✅ Passed checks (3 passed)
Check name Status Explanation
Description Check ✅ Passed Check skipped - CodeRabbit’s high-level summary is enabled.
Title check ✅ Passed The title directly and accurately describes the main change: sending the previous session token in /tokens requests, which is the core feature across all modified files.
Docstring Coverage ✅ Passed No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check.

✏️ Tip: You can configure your own custom pre-merge checks in the settings.

📝 Coding Plan
  • Generate coding plan for human review comments

Comment @coderabbitai help to get the list of available commands and usage tips.

Tip

CodeRabbit can generate a title for your PR based on the changes with custom instructions.

Set the reviews.auto_title_instructions setting to generate a title for your PR based on the changes in the PR with custom instructions.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Projects

None yet

Development

Successfully merging this pull request may close these issues.

2 participants