test: pin biometric credential storage format by mikepitre · Pull Request #584 · clerk/clerk-ios

mikepitre · 2026-09-27T14:17:55Z

What & why

@clerk/expo-biometrics reads and writes the same on-device biometric credential store as clerk-ios, so an app using both it and the prebuilt UI sees one set of credentials (the server allows one active credential per client, platform and app). That makes the current storage format a cross-SDK dependency. These tests pin it so a change here fails loudly instead of silently breaking the Expo module:

Secure Enclave key tag dev.clerk.trusted_device.<localKeyId>, key attributes and per-policy access control flags
the trustedDeviceCredentials generic-password item and its attributes
the record JSON (field names, millisecond dates, unknown-field handling, hint normalization), round-tripped against a checked-in fixture
the reinstall marker key format
the JWK string and DER → raw r||s signature conversion

No behavior change.

What to focus on

The reinstall marker: another SDK that enrolls before clerk-ios is first configured must write the same marker, or clerk-ios's first configure wipes its record. The Expo module does this.
With a Keychain access group configured, records live under a separate <bundle id>.clerk.app service (since refactor: share the device token through the Keychain access group #579). Expo doesn't use an access group, so these tests cover the default setup only.

🤖 Generated with Claude Code

coderabbitai · 2026-09-27T14:18:02Z

Navigate logical layers of code changes, visualize relationships, and explore their blast radius.

No actionable comments were generated in the recent review. 🎉

ℹ️ Recent review info

⚙️ Run configuration

Configuration used: Organization UI

Review profile: ASSERTIVE

Plan: Team

Run ID: 80b5cd89-d7ad-459e-8318-490afad90d2c

📥 Commits

Reviewing files that changed from the base of the PR and between 15ef565 and cfbe1f0.

📒 Files selected for processing (2)

Tests/Domains/Auth/BiometricCredential/BiometricCredentialStorageContractTests.swift
Tests/Resources/BiometricCredentialStorageContractV1.json

🔗 Linked repositories identified

CodeRabbit considers these linked repositories for cross-repo context during reviews:

clerk/clerk_go (manual)
clerk/dashboard (manual)
clerk/accounts (manual)
clerk/backoffice (manual)
clerk/clerk (manual)
clerk/clerk-docs (manual)
clerk/cloudflare-workers (manual)
clerk/javascript (auto-detected)

Included review availability: This review used your included allowance. 5 included reviews remain after this review. Your included PR review attempts over the past 7 days set your current allowance at 8 reviews per hour.

📝 Walkthrough

Walkthrough

The change adds a serialized test suite for biometric credential storage contracts and a v1 JSON fixture. The tests cover Secure Enclave key attributes, policy values, JWK and signature encodings, Keychain metadata, v1 record decoding and encoding, unknown-field handling, identifier normalization, and reinstall-marker key formatting.

Priority: ➖ Normal

Estimated code review effort: 3 (Moderate) | ~20 minutes

Merge Risk: ⚪ Minimal · up to cfbe1

This change only adds tests that pin the biometric credential storage format, so it does not affect runtime behavior. No actionable merge-blocking risk remains.

🚥 Pre-merge checks | ✅ 4 | ❌ 1

❌ Failed checks (1 warning)

Check name	Status	Explanation	Resolution
Docstring Coverage	⚠️ Warning	Docstring coverage is 0.00% which is insufficient. The required threshold is 80.00%. Docstring coverage is scoped to functions touched by this diff. Analyzed 14 functions across 1 files. (1 skipped: 1…	Write docstrings for the functions missing them to satisfy the coverage threshold.

✅ Passed checks (4 passed)

Check name	Status	Explanation
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Title check	✅ Passed	The title clearly and concisely describes the main change: adding tests that pin the biometric credential storage format.
Description check	✅ Passed	The description directly explains the shared storage format, the interoperability risk, and the test coverage added by the pull request.

Full details: Docstring Coverage

Explanation

Docstring coverage is 0.00% which is insufficient. The required threshold is 80.00%. Docstring coverage is scoped to functions touched by this diff. Analyzed 14 functions across 1 files. (1 skipped: 1 unsupported.)

Fix all pre-merge checks with AI

Autopilot · Keep fixing CodeRabbit findings and required CI, and resolving merge conflicts

Autopilot is currently an internal CodeRabbit preview.

_{Comment @coderabbitai help to get the list of available commands.}

github-actions · 2026-09-27T14:18:03Z

CI paused

CI does not run automatically on pull request updates.

Before merging, manual CI must be run and pass for the latest commit.

When this PR is ready for CI, a Clerk organization member can comment:

/run ci

Clerk members with write access can also use the quick action below:

Run CI

Co-Authored-By: Claude Opus 5.5 (1M context) <[email protected]>

mikepitre mentioned this pull request Sep 27, 2026

feat(expo-biometrics): add biometric credential native module clerk/javascript#9959

Closed

4 of 9 tasks

test: pin biometric credential storage format

cfbe1f0

Co-Authored-By: Claude Opus 5.5 (1M context) <[email protected]>

mikepitre changed the title ~~docs: define biometric credential storage contract~~ test: pin biometric credential storage format Sep 28, 2026

mikepitre force-pushed the mike/biometric-credential-storage-contract branch from c3cdf7d to cfbe1f0 Compare September 28, 2026 15:02

mikepitre mentioned this pull request Sep 29, 2026

feat(expo): move biometric credentials to JS with @clerk/expo-biometrics clerk/javascript#9989

Merged

4 of 9 tasks

mikepitre marked this pull request as ready for review September 30, 2026 18:03

seanperez29 approved these changes Sep 30, 2026

View reviewed changes

mikepitre merged commit fd4bf6c into main Sep 30, 2026
14 checks passed

mikepitre deleted the mike/biometric-credential-storage-contract branch September 30, 2026 18:43

Navigation Menu

Repository navigation

test: pin biometric credential storage format - #584

test: pin biometric credential storage format#584
mikepitre merged 1 commit into
mainfrom
mike/biometric-credential-storage-contract

mikepitre commented Sep 27, 2026 •

edited

Loading

Uh oh!

coderabbitai Bot commented Sep 27, 2026 •

edited

Loading

Walkthrough

❌ Failed checks (1 warning)

Uh oh!

github-actions Bot commented Sep 27, 2026 •

edited

Loading

Uh oh!

Uh oh!

Reviewers

Uh oh!

Assignees

Labels

Projects

Milestone

Development

Uh oh!

2 participants

Conversation

mikepitre commented Sep 27, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

What & why

What to focus on

Uh oh!

coderabbitai Bot commented Sep 27, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Walkthrough

❌ Failed checks (1 warning)

Uh oh!

github-actions Bot commented Sep 27, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

CI paused

Uh oh!

Uh oh!

Reviewers

Uh oh!

Assignees

Labels

Projects

Milestone

Development

Uh oh!

2 participants

mikepitre commented Sep 27, 2026 •

edited

Loading

coderabbitai Bot commented Sep 27, 2026 •

edited

Loading

github-actions Bot commented Sep 27, 2026 •

edited

Loading