fix(web): skip production Clerk on unsupported browser origins

apps/web/src/cloud/publicConfig.test.ts

@@ -1,4 +1,4 @@
-import { afterEach, describe, expect, it, vi } from "vite-plus/test";
+import { afterEach, beforeEach, describe, expect, it, vi } from "vite-plus/test";
 
 import {
   CloudPublicConfigMissingError,
@@ -8,6 +8,7 @@ import {
 
 afterEach(() => {
   vi.unstubAllEnvs();
+  vi.unstubAllGlobals();
 });
 
 describe("hasCloudPublicConfig", () => {
@@ -35,6 +36,80 @@ describe("hasCloudPublicConfig", () => {
     expect(hasCloudPublicConfig()).toBe(false);
   });
 
+  describe("browser origins", () => {
+    beforeEach(() => {
+      vi.stubEnv("VITE_CLERK_PUBLISHABLE_KEY", `pk_live_${btoa("clerk.example.com$")}`);
+      vi.stubEnv("VITE_CLERK_JWT_TEMPLATE", "t3-relay");
+      vi.stubEnv("VITE_T3CODE_RELAY_URL", "https://relay.example.test");
+    });
+
+    it.each(["https://example.com", "https://nightly.app.example.com:443"])(
+      "enables production auth on the configured root and subdomains: %s",
+      (origin) => {
+        vi.stubGlobal("window", { location: new URL(origin) });
+
+        expect(hasCloudPublicConfig()).toBe(true);
+      },
+    );
+
+    it.each(["http://localhost:3773", "https://machine.example.ts.net"])(
+      "disables production auth on private browser origins: %s",
+      (origin) => {
+        vi.stubGlobal("window", { location: new URL(origin) });
+
+        expect(hasCloudPublicConfig()).toBe(false);
+      },
+    );
+
+    it.each(["http://app.example.com:443", "https://app.example.com:3773"])(
+      "rejects unsupported schemes and ports even on the configured domain: %s",
+      (origin) => {
+        vi.stubGlobal("window", { location: new URL(origin) });
+
+        expect(hasCloudPublicConfig()).toBe(false);
+      },
+    );
+
+    it.each(["https://notexample.com", "https://example.com.evil.test"])(
+      "rejects domain lookalikes: %s",
+      (origin) => {
+        vi.stubGlobal("window", { location: new URL(origin) });
+
+        expect(hasCloudPublicConfig()).toBe(false);
+      },
+    );
+
+    it.each([
+      ["https://tenant.clerk.accounts.dev", true],
+      ["https://other.clerk.accounts.dev", false],
+    ])("keeps a provider hostname scoped to its own instance: %s", (origin, expected) => {
+      vi.stubEnv("VITE_CLERK_PUBLISHABLE_KEY", `pk_live_${btoa("tenant.clerk.accounts.dev$")}`);
+      vi.stubGlobal("window", { location: new URL(origin) });
+
+      expect(hasCloudPublicConfig()).toBe(expected);
+    });
+
+    it("keeps development keys available on private browser origins", () => {
+      vi.stubEnv("VITE_CLERK_PUBLISHABLE_KEY", `pk_test_${btoa("tenant.clerk.accounts.dev$")}`);
+      vi.stubGlobal("window", { location: new URL("http://localhost:3773") });
+
+      expect(hasCloudPublicConfig()).toBe(true);
+    });
+
+    it("keeps production keys available in the Electron auth shell", () => {
+      vi.stubGlobal("window", { location: new URL("file:///app/index.html"), desktopBridge: {} });
+
+      expect(hasCloudPublicConfig()).toBe(true);
+    });
+
+    it("disables cloud auth for an invalid production key without throwing", () => {
+      vi.stubEnv("VITE_CLERK_PUBLISHABLE_KEY", "pk_live_!");
+      vi.stubGlobal("window", { location: new URL("https://app.example.com") });
+
+      expect(hasCloudPublicConfig()).toBe(false);
+    });
+  });
+
   it("reports the missing Clerk JWT template as structured configuration", () => {
     vi.stubEnv("VITE_CLERK_JWT_TEMPLATE", "");
 

apps/web/src/cloud/publicConfig.ts

@@ -1,4 +1,7 @@
-import { relayClerkTokenOptions } from "@t3tools/shared/relayAuth";
+import {
+  clerkFrontendApiHostnameFromPublishableKey,
+  relayClerkTokenOptions,
+} from "@t3tools/shared/relayAuth";
 import { normalizeSecureRelayUrl } from "@t3tools/shared/relayUrl";
 import * as Schema from "effect/Schema";
 
@@ -78,7 +81,34 @@ export function resolveRelayTracingConfig() {
 
 export function hasCloudPublicConfig(): boolean {
   const config = resolveCloudPublicConfig();
-  return Boolean(config.clerkPublishableKey && config.clerkJwtTemplate && config.relayUrl);
+  if (!config.clerkPublishableKey || !config.clerkJwtTemplate || !config.relayUrl) {
+    return false;
+  }
+
+  // Electron has its own auth runtime; development keys also support private browser origins.
+  if (
+    typeof window === "undefined" ||
+    window.desktopBridge !== undefined ||
+    !config.clerkPublishableKey.startsWith("pk_live_")
+  ) {
+    return true;
+  }
+
+  try {
+    // Custom Frontend API hosts use clerk.<production domain>.
+    const domain = clerkFrontendApiHostnameFromPublishableKey(config.clerkPublishableKey).replace(
+      /^clerk\./u,
+      "",
+    );
+    const { hostname, protocol, port } = window.location;
+    return (
+      protocol === "https:" &&
+      port === "" &&
+      (hostname === domain || hostname.endsWith(`.${domain}`))
+    );
+  } catch {
+    return false;
+  }
 }
 
 export function resolveRelayClerkTokenOptions() {