fix(mosaic): reject a repeated reverification hint

.changeset/mosaic-reverification-incomplete.md

@@ -0,0 +1,2 @@
+---
+---

packages/mosaic/src/features/reverification/__tests__/use-reverification-with-state.test.tsx

@@ -1,3 +1,4 @@
+import { reverificationError } from '@clerk/shared/authorization-errors';
 import { ClerkRuntimeError, isClerkRuntimeError, isReverificationCancelledError } from '@clerk/shared/error';
 import type * as SharedReact from '@clerk/shared/react';
 import type { SessionVerificationLevel } from '@clerk/shared/types';
@@ -122,6 +123,32 @@ describe('useReverificationWithState', () => {
     expect(challengeCancel).not.toHaveBeenCalled();
   });
 
+  it('rejects when the retry is asked to reverify again', async () => {
+    const fetcher = vi
+      .fn()
+      .mockResolvedValueOnce({ reverificationLevel: 'first_factor' } satisfies Hint)
+      .mockResolvedValueOnce(reverificationError());
+    const { result } = renderHook(() => useReverificationWithState(fetcher));
+
+    let pending!: Promise<unknown>;
+    act(() => {
+      pending = result.current[0]();
+    });
+    await waitFor(() => expect(result.current[1].phase).toBe('active'));
+    act(() => {
+      assertActive(result.current[1]);
+      result.current[1].complete();
+    });
+
+    await act(async () => {
+      await expect(pending).rejects.toSatisfy(
+        error => isClerkRuntimeError(error) && error.code === 'reverification_incomplete',
+      );
+    });
+    await waitFor(() => expect(result.current[1]).toEqual({ phase: 'settled' }));
+    expect(fetcher).toHaveBeenCalledTimes(2);
+  });
+
   it('settles when the delayed retry fails', async () => {
     const retry = deferred<never>();
     const fetcher = vi

packages/mosaic/src/features/reverification/use-reverification-with-state.ts

@@ -1,3 +1,4 @@
+import { isReverificationHint } from '@clerk/shared/authorization-errors';
 import { ClerkRuntimeError } from '@clerk/shared/error';
 import { useReverification, useSafeLayoutEffect, useSession } from '@clerk/shared/react';
 import { useCallback, useEffect, useRef, useState } from 'react';
@@ -42,6 +43,14 @@ function requestAlreadyInProgressError(): ClerkRuntimeError {
   });
 }
 
+const REVERIFICATION_INCOMPLETE_CODE = 'reverification_incomplete';
+
+function reverificationIncompleteError(): ClerkRuntimeError {
+  return new ClerkRuntimeError('The action still requires verification after it was verified.', {
+    code: REVERIFICATION_INCOMPLETE_CODE,
+  });
+}
+
 /**
  * Wraps useReverification without the default UI. Returns [handler, state]: call handler
  * to run the action, and render your own UI from state.phase ('inactive' | 'active' |
@@ -52,6 +61,9 @@ function requestAlreadyInProgressError(): ClerkRuntimeError {
  * is called again, or when the third return value, reset, is called. A run that was never
  * interrupted stays 'inactive' throughout.
  *
+ * A retry that is asked to reverify again rejects with a ClerkRuntimeError with code
+ * 'reverification_incomplete', so the handler never resolves with a reverification hint.
+ *
  * The handler runs one call at a time. A call made while another is pending rejects with a
  * ClerkRuntimeError with code 'request_already_in_progress'.
  */
@@ -132,7 +144,14 @@ export function useReverificationWithState<F extends ReverificationFetcher>(
 
       setReverificationState(releaseSettled);
 
-      const invocation = Promise.resolve().then(() => wrapped(...args));
+      const invocation = Promise.resolve()
+        .then(() => wrapped(...args))
+        .then(result => {
+          if (isReverificationHint(result)) {
+            throw reverificationIncompleteError();
+          }
+          return result;
+        });
       runtimeRef.current.operation = { status: 'requesting', promise: invocation };
       void invocation
         .finally(() => {

packages/mosaic/src/localization/errors.messages.ts

@@ -78,6 +78,7 @@ export const errorMessages: { readonly generic: string } & Readonly<Record<strin
   protect_check_timed_out: "Verification didn't complete in time. Please try again.",
   protect_check_unsupported_environment:
     "Verification isn't supported in this environment. Please continue in a standard browser or contact support.",
+  reverification_incomplete: 'Your request was not completed. Please try verifying again.',
   role_unavailable: 'This role is no longer available.',
   sso_bypass_domain_not_served:
     'This member could not be added because their email address is not served by a connection.',