diff --git a/.changeset/expo-native-mobile-verification-key.md b/.changeset/expo-native-mobile-verification-key.md new file mode 100644 index 00000000000..a845151cc84 --- /dev/null +++ b/.changeset/expo-native-mobile-verification-key.md @@ -0,0 +1,2 @@ +--- +--- diff --git a/.claude/skills/verify-clerk-expo/SKILL.md b/.claude/skills/verify-clerk-expo/SKILL.md index cb7dcb56b67..b33e9060c43 100644 --- a/.claude/skills/verify-clerk-expo/SKILL.md +++ b/.claude/skills/verify-clerk-expo/SKILL.md @@ -21,7 +21,7 @@ Set up each machine once. 1. Install Node 24, at 24.15.0 or newer, which the `pnpm install` below needs. For a local iOS device, install Xcode with an iOS simulator runtime. For a local Android device, install Android Studio with the SDK, the emulator, and Java 21. The CLI looks for the SDK in `ANDROID_HOME`, `ANDROID_SDK_ROOT`, and `~/Library/Android/sdk`. 2. Create the iOS template simulator, which the CLI clones to make each simulator it drives, with `xcrun simctl create "Clerk Verify Template iOS" "iPhone Air"`. That makes a new simulator that holds only the system's apps. Do not clone a simulator you already use: a clone holds every app of the original, and those apps show on the home screen at the start of a video. Boot the template once and shut it down: a clone of a template that never booted takes about twenty seconds longer to boot. `doctor` says when a system HTTPS proxy needs its CA trusted there. Android needs no template: the first `up --platform android` writes the `Clerk_Verify_Pixel` AVD. -3. Give the machine the team's Clerk Platform API key. Set `CLERK_PLATFORM_API_KEY` to the key. Or set `CLERK_PLATFORM_API_KEY_FILE` to a file that holds it and that only you can read (mode 0600). Or set `VERIFY_PLATFORM_KEY_REFERENCE` to the key's 1Password secret reference, which the 1Password CLI reads once a person approves the request in the 1Password app, within 60 seconds. Never put the key or the reference in a file inside a repository. +3. Give the machine the team's Clerk Platform API key. Set `MOBILE_VERIFICATION_PLATFORM_API_KEY` to the key. Or set `MOBILE_VERIFICATION_PLATFORM_API_KEY_FILE` to a file that holds it and that only you can read (mode 0600). Or set `MOBILE_VERIFICATION_PLATFORM_API_KEY_REFERENCE` to the key's 1Password secret reference, which the 1Password CLI reads once a person approves the request in the 1Password app, within 60 seconds. Never put the key or the reference in a file inside a repository. 4. Install ffmpeg (`brew install ffmpeg`), which `attach --video` uses to cut the video to the part that `host.evidence` marks. Without it, `attach` posts the whole video and says that ffmpeg is not installed. 5. Install simslim (`brew install mobai-app/tap/simslim`), so that each local iOS simulator boots without its background services and uses about a quarter of the memory. `doctor` says whether it is installed. Set `VERIFY_SIMSLIM=0` to boot stock simulators. diff --git a/.claude/skills/verify-clerk-expo/references/instances.md b/.claude/skills/verify-clerk-expo/references/instances.md index 4dad1d9588f..037f5a35e2f 100644 --- a/.claude/skills/verify-clerk-expo/references/instances.md +++ b/.claude/skills/verify-clerk-expo/references/instances.md @@ -85,7 +85,7 @@ An array leaf is set whole: name every value it keeps. The standard values are i ## The credential -One team key creates, changes, and deletes the application, and reads its secret key. The key needs four scopes: `applications:read`, `applications:manage`, `applications:delete`, and `application_secret_keys:read`. The CLI reads `CLERK_PLATFORM_API_KEY` first, then the file that `CLERK_PLATFORM_API_KEY_FILE` names. A variable that is set and does not work is an error. With neither variable set, the CLI reads the key's 1Password secret reference from `VERIFY_PLATFORM_KEY_REFERENCE` and asks the 1Password CLI for the key. The 1Password app then asks a person to approve, and a refused or unanswered request is an error. +One team key creates, changes, and deletes the application, and reads its secret key. The key needs four scopes: `applications:read`, `applications:manage`, `applications:delete`, and `application_secret_keys:read`. The CLI reads `MOBILE_VERIFICATION_PLATFORM_API_KEY` first, then the file that `MOBILE_VERIFICATION_PLATFORM_API_KEY_FILE` names. A variable that is set and does not work is an error. With neither variable set, the CLI reads the key's 1Password secret reference from `MOBILE_VERIFICATION_PLATFORM_API_KEY_REFERENCE` and asks the 1Password CLI for the key. The 1Password app then asks a person to approve, and a refused or unanswered request is an error. Before it asks 1Password, the CLI sends one request with no key. In a cloud environment that holds the key as an API credential for `api.clerk.com`, the environment adds the key after the request leaves the machine, so that request succeeds and no key is ever in the session. The output then names the source as `a key attached outside this machine (no key is in this process)`. [Remote devices](remote.md) has the setup. diff --git a/.github/workflows/verify-e2e.yml b/.github/workflows/verify-e2e.yml index 8ca2d3cfd04..956c71e3f90 100644 --- a/.github/workflows/verify-e2e.yml +++ b/.github/workflows/verify-e2e.yml @@ -138,7 +138,7 @@ jobs: - name: Build the fixture and boot a device timeout-minutes: 30 env: - CLERK_PLATFORM_API_KEY: ${{ secrets.MOBILE_VERIFICATION_PLATFORM_API_KEY }} + MOBILE_VERIFICATION_PLATFORM_API_KEY: ${{ secrets.MOBILE_VERIFICATION_PLATFORM_API_KEY }} VERIFY_SIMSLIM: ${{ matrix.platform == 'ios' && '1' || '' }} SIMSLIM_BOOT_TIMEOUT: 15m SIMSLIM_SPAWN_TIMEOUT: 5m @@ -182,7 +182,7 @@ jobs: - name: Run the end-to-end tests timeout-minutes: 30 env: - CLERK_PLATFORM_API_KEY: ${{ secrets.MOBILE_VERIFICATION_PLATFORM_API_KEY }} + MOBILE_VERIFICATION_PLATFORM_API_KEY: ${{ secrets.MOBILE_VERIFICATION_PLATFORM_API_KEY }} GITHUB_TOKEN: ${{ github.token }} run: | "$CLI" run --all --platform "$PLATFORM" --backend local --retries 1 --max-failures 5 --github-report @@ -190,7 +190,7 @@ jobs: - name: Release the device and delete the Clerk application if: always() && steps.install.outcome == 'success' env: - CLERK_PLATFORM_API_KEY: ${{ secrets.MOBILE_VERIFICATION_PLATFORM_API_KEY }} + MOBILE_VERIFICATION_PLATFORM_API_KEY: ${{ secrets.MOBILE_VERIFICATION_PLATFORM_API_KEY }} run: | "$CLI" down diff --git a/integration/expo-native/package-lock.json b/integration/expo-native/package-lock.json index 32e7deae22c..c50c9f356e2 100644 --- a/integration/expo-native/package-lock.json +++ b/integration/expo-native/package-lock.json @@ -6,7 +6,7 @@ "": { "name": "verify-clerk-expo", "devDependencies": { - "@clerk/internal-mobile-e2e": "github:clerk/internal-mobile-e2e#6db71a0aaa96eb6436ee63104ad22a9a70ebf55d", + "@clerk/internal-mobile-e2e": "github:clerk/internal-mobile-e2e#0889a2d95f23f0bb43a615a931d4dca742f9acba", "@types/node": "24.19.1", "typescript": "7.0.2" }, @@ -122,7 +122,7 @@ } }, "node_modules/@clerk/internal-mobile-e2e": { - "resolved": "git+ssh://git@github.com/clerk/internal-mobile-e2e.git#6db71a0aaa96eb6436ee63104ad22a9a70ebf55d", + "resolved": "git+ssh://git@github.com/clerk/internal-mobile-e2e.git#0889a2d95f23f0bb43a615a931d4dca742f9acba", "integrity": "sha512-3XTTA8cOTRZMVCwZMMWxzHVxMG1V0Lv22e5ZZmfZ7mOajWd8CMWdmt1qFMNdxyU8bfnsPhIELr3zte0wLa2v2A==", "dev": true, "dependencies": { diff --git a/integration/expo-native/package.json b/integration/expo-native/package.json index 69386e34d5f..5a848746349 100644 --- a/integration/expo-native/package.json +++ b/integration/expo-native/package.json @@ -7,7 +7,7 @@ "typecheck": "tsc -p ." }, "devDependencies": { - "@clerk/internal-mobile-e2e": "github:clerk/internal-mobile-e2e#6db71a0aaa96eb6436ee63104ad22a9a70ebf55d", + "@clerk/internal-mobile-e2e": "github:clerk/internal-mobile-e2e#0889a2d95f23f0bb43a615a931d4dca742f9acba", "@types/node": "24.19.1", "typescript": "7.0.2" }, diff --git a/integration/expo-native/test/host.test.ts b/integration/expo-native/test/host.test.ts index 714cb76ccff..f53d7eda8ca 100644 --- a/integration/expo-native/test/host.test.ts +++ b/integration/expo-native/test/host.test.ts @@ -99,9 +99,9 @@ describe('a step of the test app build', () => { const scratch = mkdtempSync(join(tmpdir(), 'verify-build-step-')); const before = { ...process.env }; const set = { - CLERK_PLATFORM_API_KEY: 'ak_platform', - CLERK_PLATFORM_API_KEY_FILE: '/home/x/key', - VERIFY_PLATFORM_KEY_REFERENCE: 'op://vault/item', + MOBILE_VERIFICATION_PLATFORM_API_KEY: 'ak_platform', + MOBILE_VERIFICATION_PLATFORM_API_KEY_FILE: '/home/x/key', + MOBILE_VERIFICATION_PLATFORM_API_KEY_REFERENCE: 'op://vault/item', CLERK_SECRET_KEY: 'sk_test_instance', AI_GATEWAY_API_KEY: 'vck_gateway', AI_GATEWAY_API_KEY_FILE: '/home/x/gateway',