feat: Client Trust #304

tmilewski · 2025-12-15T21:22:29Z

This PR enables handling of the new needs_client_trust sign-in status.

Additionally, it adds:

NoticeText: Similar to ErrorText, with differing formatting.
ClerkClientWarning model: Similar to ClerkClientError but does not rely on the Error/LocalizedError foundations.
Applicable localized strings, previews, and tests

Simulator Screenshot - iPhone 17 Pro - 2025-12-15 at 15 58 18

Summary by CodeRabbit

New Features
- Introduced client trust verification to strengthen security when signing in from new devices
- Users can verify identity through email code or phone code verification methods
- Enhanced authentication flows to support new device trust verification scenarios
- Added multi-language support for new verification messages

_{✏️ Tip: You can customize this high-level summary in your review settings.}

coderabbitai · 2025-12-15T21:22:39Z

Walkthrough

Introduces client trust verification flow by adding a new sign-in status case, creating dedicated UI routing logic, and refactoring the factor code view to support three distinct modes (first factor, second factor, client trust) instead of a boolean flag.

Changes

Cohort / File(s)	Summary
Auth Flow Routing `Sources/Clerk/Models/SignIn/SignInStatus.swift`, `Sources/Clerk/ClerkUI/Components/Auth/AuthState.swift`, `Sources/Clerk/ClerkUI/Components/Auth/AuthView.swift`	Adds `needsClientTrust` status case; AuthState routes this status to new `signInClientTrust` destination; AuthView maps destination to `SignInClientTrustView` with associated factor.
Client Trust View `Sources/Clerk/ClerkUI/Components/Auth/SignIn/SignInClientTrustView.swift`	New view that conditionally renders `SignInFactorCodeView` (mode: `.clientTrust`) for phone/email code strategies, or `SignInGetHelpView` otherwise.
Factor Code View Refactoring `Sources/Clerk/ClerkUI/Components/Auth/SignIn/SignInFactorCodeView.swift`, `Sources/Clerk/ClerkUI/Components/Auth/SignIn/SignInFactorTwoView.swift`	Replaces `isSecondFactor: Bool` parameter with `mode: FactorMode` enum (cases: `firstFactor`, `secondFactor`, `clientTrust`); adds computed property `usesSecondFactorAPI`; updates all conditional logic and API selection; adds client-trust-specific UI message; includes preview scenarios.
Localization `Sources/Clerk/ClerkUI/Resources/Localizable.xcstrings`	Adds translated string for client device verification message across multiple languages.

Estimated code review effort

🎯 3 (Moderate) | ⏱️ ~25 minutes

SignInFactorCodeView refactoring requires careful attention: boolean flag replaced with enum mode pattern; all conditional branches and API calls must be verified to use mode.usesSecondFactorAPI correctly
Factor code view logic: Verify that client trust mode is routed appropriately alongside first and second factor flows
New status case integration: Ensure needsClientTrust correctly flows through AuthState and AuthView routing logic

Poem

🐰 A new trust path hops into view,
Three modes replace a boolean's clue,
From device new, verification clear—
Client trust flow brings users near! ✨

Pre-merge checks and finishing touches

❌ Failed checks (1 warning)

Check name	Status	Explanation	Resolution
Docstring Coverage	⚠️ Warning	Docstring coverage is 0.00% which is insufficient. The required threshold is 80.00%.	You can run `@coderabbitai generate docstrings` to improve docstring coverage.

✅ Passed checks (2 passed)

Check name	Status	Explanation
Description Check	✅ Passed	Check skipped - CodeRabbit’s high-level summary is enabled.
Title check	✅ Passed	The title 'feat: Client Trust' is concise and directly describes the main feature being added, matching the PR's primary objective of enabling client trust functionality.

✨ Finishing touches

📝 Generate docstrings

🧪 Generate unit tests (beta)

Create PR with unit tests
Post copyable unit tests in a comment
Commit unit tests in branch tom/user-4232-enable-ios-functionality

_{Comment @coderabbitai help to get the list of available commands and usage tips.}

mikepitre · 2025-12-18T16:39:19Z

Simulator.Screen.Recording.-.iPhone.Air.+.Watch.-.2025-12-18.at.11.30.37.mov

tmilewski · 2025-12-18T16:40:57Z

@mikepitre Feel free to merge as you see fit.

coderabbitai

Actionable comments posted: 0

🧹 Nitpick comments (2)

Sources/Clerk/ClerkUI/Components/Auth/SignIn/SignInFactorCodeView.swift (2)
145-151: Client trust notification correctly implemented.

The warning message is properly localized and styled with theme.colors.warning. The implementation is functional and clear.
Optional: Extract message to computed property

For better maintainability and DRY, consider extracting the message to a computed property:
+    var clientTrustNotice: LocalizedStringKey {
+        "You're signing in from a new device. We're asking for verification to keep your account secure."
+    }
+
     var body: some View {
         ...
                 if mode == .clientTrust {
-                    Text("You're signing in from a new device. We're asking for verification to keep your account secure.", bundle: .module)
+                    Text(clientTrustNotice, bundle: .module)
                         .foregroundStyle(theme.colors.warning)
429-463: Well-implemented preview scenarios for client trust.

The new preview sections correctly demonstrate the client trust flow:

Properly instantiate with mode: .clientTrust

Mock the appropriate second factor APIs (prepareSecondFactor, attemptSecondFactor)

Provide visual validation for both email and phone code scenarios

The static analysis flags force tries (try!) in the preview code. While acceptable in preview/test contexts, you could optionally replace them with try? for consistency:
-                try! await Task.sleep(for: .seconds(1))
+                try? await Task.sleep(for: .seconds(1))

📜 Review details

Configuration used: Repository UI

Review profile: CHILL

Plan: Pro

Disabled knowledge base sources:

Linear integration is disabled by default for public repositories

You can enable these sources in your CodeRabbit configuration.

📥 Commits

Reviewing files that changed from the base of the PR and between f0b5678 and cf113eb.

📒 Files selected for processing (3)

Sources/Clerk/ClerkUI/Components/Auth/SignIn/SignInClientTrustView.swift (1 hunks)
Sources/Clerk/ClerkUI/Components/Auth/SignIn/SignInFactorCodeView.swift (7 hunks)
Sources/Clerk/ClerkUI/Components/Auth/SignIn/SignInFactorTwoView.swift (1 hunks)

🚧 Files skipped from review as they are similar to previous changes (1)

Sources/Clerk/ClerkUI/Components/Auth/SignIn/SignInClientTrustView.swift

🧰 Additional context used

🧬 Code graph analysis (1)

Sources/Clerk/ClerkUI/Components/Auth/SignIn/SignInFactorCodeView.swift (1)

Sources/Clerk/Models/SignIn/SignIn.swift (3)

attemptSecondFactor (235-238)

attemptFirstFactor (199-202)

prepareSecondFactor (216-219)

🪛 SwiftLint (0.57.0)

Sources/Clerk/ClerkUI/Components/Auth/SignIn/SignInFactorCodeView.swift

[Error] 433-433: Force tries should be avoided

(force_try)

[Error] 437-437: Force tries should be avoided

(force_try)

[Error] 451-451: Force tries should be avoided

(force_try)

[Error] 455-455: Force tries should be avoided

(force_try)

⏰ Context from checks skipped due to timeout of 90000ms. You can increase the timeout in your CodeRabbit configuration to a maximum of 15 minutes (900000ms). (6)

GitHub Check: Build on all platforms (macCatalyst)
GitHub Check: Build on all platforms (macOS)
GitHub Check: Build on all platforms (iOS)
GitHub Check: Build on all platforms (visionOS)
GitHub Check: Build on all platforms (tvOS)
GitHub Check: semgrep-cloud-platform/scan

🔇 Additional comments (3)

Sources/Clerk/ClerkUI/Components/Auth/SignIn/SignInFactorTwoView.swift (1)

21-21: LGTM! Clean refactoring from boolean to enum.

The change from isSecondFactor: true to mode: .secondFactor improves code clarity and aligns with the new FactorMode enum pattern introduced in SignInFactorCodeView.

Sources/Clerk/ClerkUI/Components/Auth/SignIn/SignInFactorCodeView.swift (2)

27-46: LGTM! Excellent refactoring from boolean to enum.

The FactorMode enum is well-designed:

Three semantic cases clearly express intent

usesSecondFactorAPI appropriately groups secondFactor and clientTrust since both use the same API endpoints

Default value of .firstFactor maintains backward compatibility

This improves code maintainability and makes future extensions easier.

223-235: Consistent and correct API selection logic.

The use of mode.usesSecondFactorAPI is applied consistently across:

Navigation to "Use another method" (line 223)

Prepare flows for email/phone codes (lines 301, 311)

Attempt flows for email/phone codes (lines 355, 361)

The logic correctly branches between prepareFirstFactor/attemptFirstFactor and prepareSecondFactor/attemptSecondFactor based on the mode, ensuring client trust uses the second factor APIs as intended.

Also applies to: 301-319, 355-365

feat: Client Trust

ebcae17

tmilewski requested a review from mikepitre December 15, 2025 21:22

tmilewski self-assigned this Dec 15, 2025

This comment was marked as resolved.

Sign in to view

Apply comments

8c71245

This comment was marked as resolved.

Sign in to view

tmilewski and others added 2 commits December 15, 2025 16:44

chore: Extract clientTrustNoticeMessage

f0b5678

client trust changes (#305)

cf113eb

coderabbitai bot reviewed Dec 18, 2025

View reviewed changes

mikepitre approved these changes Dec 18, 2025

View reviewed changes

mikepitre merged commit a9123a5 into main Dec 18, 2025
9 checks passed

mikepitre deleted the tom/user-4232-enable-ios-functionality branch December 18, 2025 16:42

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Uh oh!

feat: Client Trust #304

feat: Client Trust #304

Uh oh!

tmilewski commented Dec 15, 2025 •

edited by coderabbitai bot

Loading

Uh oh!

coderabbitai bot commented Dec 15, 2025 •

edited

Loading

Uh oh!

This comment was marked as resolved.

Uh oh!

This comment was marked as resolved.

Uh oh!

mikepitre commented Dec 18, 2025

Uh oh!

tmilewski commented Dec 18, 2025

Uh oh!

coderabbitai bot left a comment

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

3 participants

feat: Client Trust #304

feat: Client Trust #304

Uh oh!

Conversation

tmilewski commented Dec 15, 2025 • edited by coderabbitai bot Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Summary by CodeRabbit

Uh oh!

coderabbitai bot commented Dec 15, 2025 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Walkthrough

Changes

Estimated code review effort

Poem

Pre-merge checks and finishing touches

Uh oh!

This comment was marked as resolved.

Uh oh!

This comment was marked as resolved.

Uh oh!

mikepitre commented Dec 18, 2025

Uh oh!

tmilewski commented Dec 18, 2025

Uh oh!

coderabbitai bot left a comment

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

3 participants

tmilewski commented Dec 15, 2025 •

edited by coderabbitai bot

Loading

coderabbitai bot commented Dec 15, 2025 •

edited

Loading