fix(e2e): more robust user deletion #9375
There are no files selected for viewing
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,2 @@ | ||
| --- | ||
| --- |
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,42 @@ | ||
| import { createHash } from 'node:crypto'; | ||
|
|
||
| import type { ClerkClient, User } from '@clerk/backend'; | ||
|
|
||
| type E2EUserRecord = { | ||
| username: string | null; | ||
| emailAddresses: Array<{ emailAddress: string }>; | ||
| privateMetadata: Record<string, unknown>; | ||
| }; | ||
|
|
||
| export const getE2ERunMarker = (runKey = process.env.INTEGRATION_TEST_RUN_KEY): string | undefined => { | ||
| if (!runKey) { | ||
| return; | ||
| } | ||
|
|
||
| const digest = createHash('sha256').update(runKey).digest('hex').slice(0, 20); | ||
| return `e2e_${digest}`; | ||
| }; | ||
|
|
||
| export const userMatchesE2ERun = (user: E2EUserRecord, marker: string): boolean => | ||
| Boolean( | ||
| user.username?.includes(marker) || | ||
| user.emailAddresses.some(email => email.emailAddress.includes(marker)) || | ||
| user.privateMetadata.e2eRunMarker === marker, | ||
| ); | ||
|
|
||
| export const findE2ERunUsers = async (clerkClient: ClerkClient, marker: string): Promise<User[]> => { | ||
| const usersById = new Map<string, User>(); | ||
| let offset = 0; | ||
|
|
||
| while (true) { | ||
| const { data } = await clerkClient.users.getUserList({ query: marker, limit: 100, offset }); | ||
| data.filter(user => userMatchesE2ERun(user, marker)).forEach(user => usersById.set(user.id, user)); | ||
|
|
||
| if (data.length < 100) { | ||
| break; | ||
| } | ||
| offset += data.length; | ||
| } | ||
|
|
||
| return Array.from(usersById.values()); | ||
| }; |
| Original file line number | Diff line number | Diff line change |
|---|---|---|
|
|
@@ -34,6 +34,7 @@ | |
| "globalPassThroughEnv": [ | ||
| "AWS_SECRET_KEY", | ||
| "GITHUB_TOKEN", | ||
| "INTEGRATION_TEST_RUN_KEY", | ||
|
Contributor
There was a problem hiding this comment. 🎯 Functional Correctness | 🟡 Minor | ⚡ Quick win 🧩 Analysis chain🏁 Script executed: #!/usr/bin/env bash
set -euo pipefail
# Every integration task must report cache=false.
jq -r '
(.tasks // {}) | to_entries[]
| select(.key | test("test:integration"))
| "\(.key): cache=\(.value.cache // true)"
' turbo.jsonRepository: clerk/javascript Length of output: 1212 🏁 Script executed: #!/usr/bin/env bash
set -euo pipefail
printf '%s\n' '--- turbo.json ---'
cat -n turbo.json | sed -n '1,90p'
printf '%s\n' '--- Turbo version and integration scripts ---'
rg -n '"turbo"|test:integration|INTEGRATION_TEST_RUN_KEY' package.json pnpm-lock.yaml packages apps examples .github 2>/dev/null | head -240Repository: clerk/javascript Length of output: 7965 🌐 Web query:
💡 Result: In Turborepo, both globalPassThroughEnv and passThroughEnv serve to expose environment variables to task runtimes without including them in the task's cache key [1][2][3]. Because these variables are intentionally omitted from the hashing process, changes to their values will not trigger a cache miss, even if the change would logically affect the output of the task [1][4]. The fundamental behaviors for these configurations are: 1. Cache Key Exclusion: Variables listed in either globalPassThroughEnv or passThroughEnv do not contribute to the task hash [2][3]. Consequently, Turborepo may serve a cached result even if the underlying environment variable has changed [1][4]. This is why these keys should only be used for variables that do not affect the build output, such as authentication tokens (e.g., SENTRY_AUTH_TOKEN), CI metadata, or credentials consumed at runtime after the build process [2][4]. 2. Runtime Exposure: By including a variable in either key, you satisfy Turborepo's Strict Environment Mode, ensuring the task has access to that variable at runtime [1][5][3]. If a task attempts to access an environment variable that is not accounted for in env, globalEnv, passThroughEnv, or globalPassThroughEnv while in Strict Mode, the task may fail [1][5]. 3. Scope Differences: - globalPassThroughEnv (or global.passThroughEnv when using the global configuration flag) applies the passthrough behavior to all tasks within the repository [2][6]. - passThroughEnv applies only to the specific task where it is configured [3]. If you need a change in an environment variable to invalidate the cache and trigger a rebuild, you must include that variable in env or globalEnv instead of the passthrough keys [1][3]. Citations:
🏁 Script executed: #!/usr/bin/env bash
set -euo pipefail
printf '%s\n' '--- integration task definitions ---'
rg -n -C 3 '"[`#/`]?test:integration|test:integration' turbo.json
printf '%s\n' '--- CI Turbo arguments and integration invocation ---'
sed -n '400,535p' .github/workflows/ci.yml
sed -n '260,300p' .github/workflows/e2e-staging.yml
printf '%s\n' '--- exact task keys parsed from turbo.json ---'
jq -r '(.tasks // {}) | to_entries[] | select(.key | contains("test:integration")) | [.key, (.value.cache // true | tostring)] | `@tsv`' turbo.jsonRepository: clerk/javascript Length of output: 16346 🏁 Script executed: #!/usr/bin/env bash
set -euo pipefail
python3 - <<'PY'
import json
from pathlib import Path
config = json.loads(Path("turbo.json").read_text())
tasks = config.get("tasks", {})
matches = [(name, task.get("cache", True)) for name, task in tasks.items()
if "test:integration" in name]
print("matching task count:", len(matches))
for name, cache in matches:
print(f"{name}: cache={cache}")
PYRepository: clerk/javascript Length of output: 1236 🏁 Script executed: #!/usr/bin/env bash
set -euo pipefail
printf '%s\n' '--- all Turbo force/argument settings ---'
rg -n -C 4 'TURBO_(ARGS|FORCE)|pnpm turbo test:integration|pnpm turbo run test:integration' .github/workflows package.json
printf '%s\n' '--- CI workflow environment and matrix context ---'
sed -n '1,120p' .github/workflows/ci.yml
sed -n '380,445p' .github/workflows/ci.yml
sed -n '495,535p' .github/workflows/ci.yml
printf '%s\n' '--- staging workflow context ---'
sed -n '1,110p' .github/workflows/e2e-staging.yml
sed -n '270,320p' .github/workflows/e2e-staging.ymlRepository: clerk/javascript Length of output: 30087 Disable caching for CI integration tasks. The CI integration job does not set 🤖 Prompt for AI Agents |
||
| "ACTIONS_RUNNER_DEBUG", | ||
| "ACTIONS_STEP_DEBUG", | ||
| "VERCEL_AUTOMATION_BYPASS_SECRET", | ||
|
|
||
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
🔒 Security & Privacy | 🟡 Minor | ⚡ Quick win
Do not log the supplied email address or phone number.
Line 206 writes a user identifier to CI logs. Log a generic cleanup message instead.
Proposed fix
📝 Committable suggestion
🧰 Tools
🪛 ast-grep (0.45.0)
[warning] 205-205: Avoid logging sensitive data
Context: console.log(
User "${opts.email || opts.phoneNumber}" does not exist!)Note: [CWE-532] Insertion of Sensitive Information into Log File.
(log-sensitive-data-typescript)
🤖 Prompt for AI Agents
Sources: Coding guidelines, Linters/SAST tools