fix: move WeakSet registration after validation to prevent poisoned context

jacekradko · jacekradko · commit c78248028768 · 2026-03-27T14:13:51.000-05:00
diff --git a/packages/testing/src/playwright/setupClerkTestingToken.ts b/packages/testing/src/playwright/setupClerkTestingToken.ts
@@ -47,7 +47,6 @@ export const setupClerkTestingToken = async ({ context, options, page }: SetupCl
     }
     return;
   }
-  setupContexts.add(browserContext);
 
   const fapiUrl = options?.frontendApiUrl || process.env.CLERK_FAPI;
   if (!fapiUrl) {
@@ -57,6 +56,7 @@ export const setupClerkTestingToken = async ({ context, options, page }: SetupCl
   const escapedFapiUrl = fapiUrl.replace(/[.*+?^${}()|[\]\\]/g, '\\$&');
   const apiUrl = new RegExp(`^https://${escapedFapiUrl}/v1/.*?(\\?.*)?$`);
 
+  setupContexts.add(browserContext);
   await browserContext.route(apiUrl, async route => {
     const originalUrl = new URL(route.request().url());
     const testingToken = process.env.CLERK_TESTING_TOKEN;

Original file line number	Diff line number	Diff line change
`@@ -47,7 +47,6 @@ export const setupClerkTestingToken = async ({ context, options, page }: SetupCl`
`47`	`47`	`}`
`48`	`48`	`return;`
`49`	`49`	`}`
`50`		`- setupContexts.add(browserContext);`
`51`	`50`
`52`	`51`	`const fapiUrl = options?.frontendApiUrl \|\| process.env.CLERK_FAPI;`
`53`	`52`	`if (!fapiUrl) {`
`@@ -57,6 +56,7 @@ export const setupClerkTestingToken = async ({ context, options, page }: SetupCl`
`57`	`56`	`const escapedFapiUrl = fapiUrl.replace(/[.*+?^${}()\|[\]\\]/g, '\\$&');`
`58`	`57`	const apiUrl = new RegExp(`^https://${escapedFapiUrl}/v1/.?(\\?.)?$`);
`59`	`58`
	`59`	`+ setupContexts.add(browserContext);`
`60`	`60`	`await browserContext.route(apiUrl, async route => {`
`61`	`61`	`const originalUrl = new URL(route.request().url());`
`62`	`62`	`const testingToken = process.env.CLERK_TESTING_TOKEN;`