From cc64bf8c0ccb2f9f7ed2a57ea0f604f33c31dd34 Mon Sep 17 00:00:00 2001
From: panteliselef <panteliselef@outlook.com>
Date: Mon, 17 Jun 2024 21:59:55 +0300
Subject: [PATCH 1/4] fix(clerk-js): Avoid sending password when saml is
 enabled

---
 .changeset/nine-radios-tap.md                              | 5 +++++
 packages/clerk-js/src/ui/components/SignIn/SignInStart.tsx | 2 +-
 2 files changed, 6 insertions(+), 1 deletion(-)
 create mode 100644 .changeset/nine-radios-tap.md

diff --git a/.changeset/nine-radios-tap.md b/.changeset/nine-radios-tap.md
new file mode 100644
index 00000000000..e284a662a9d
--- /dev/null
+++ b/.changeset/nine-radios-tap.md
@@ -0,0 +1,5 @@
+---
+"@clerk/clerk-js": patch
+---
+
+Avoid sending password when saml is enabled.
diff --git a/packages/clerk-js/src/ui/components/SignIn/SignInStart.tsx b/packages/clerk-js/src/ui/components/SignIn/SignInStart.tsx
index 187571b5d95..95601ac2f7f 100644
--- a/packages/clerk-js/src/ui/components/SignIn/SignInStart.tsx
+++ b/packages/clerk-js/src/ui/components/SignIn/SignInStart.tsx
@@ -236,7 +236,7 @@ export function _SignInStart(): JSX.Element {
     }
     return {
       ...buildRequest(fields),
-      ...(hasPassword && { strategy: 'password' }),
+      ...(hasPassword && !userSettings.saml.enabled ? { strategy: 'password' } : {}),
     } as SignInCreateParams;
   };
 

From 5331bc809ff5d455580bd142ddecb92fcfb77291 Mon Sep 17 00:00:00 2001
From: panteliselef <panteliselef@outlook.com>
Date: Tue, 18 Jun 2024 19:55:41 +0300
Subject: [PATCH 2/4] fix(clerk-js): Avoid sending password when saml is
 enabled

---
 .../src/ui/components/SignIn/SignInStart.tsx  | 21 ++++++++++++++++---
 1 file changed, 18 insertions(+), 3 deletions(-)

diff --git a/packages/clerk-js/src/ui/components/SignIn/SignInStart.tsx b/packages/clerk-js/src/ui/components/SignIn/SignInStart.tsx
index 95601ac2f7f..5e325281cc4 100644
--- a/packages/clerk-js/src/ui/components/SignIn/SignInStart.tsx
+++ b/packages/clerk-js/src/ui/components/SignIn/SignInStart.tsx
@@ -231,18 +231,33 @@ export function _SignInStart(): JSX.Element {
 
   const buildSignInParams = (fields: Array<FormControlState<string>>): SignInCreateParams => {
     const hasPassword = fields.some(f => f.name === 'password' && !!f.value);
-    if (!hasPassword) {
+
+    /**
+     * FAPI will return an error when password is submitted but the user's email matches requires SAML authentication.
+     * We need to strip password from the create request, and reconstruct it later.
+     */
+    if (!hasPassword || userSettings.saml.enabled) {
       fields = fields.filter(f => f.name !== 'password');
     }
     return {
       ...buildRequest(fields),
-      ...(hasPassword && !userSettings.saml.enabled ? { strategy: 'password' } : {}),
+      ...(hasPassword && !userSettings.saml.enabled && { strategy: 'password' }),
     } as SignInCreateParams;
   };
 
   const signInWithFields = async (...fields: Array<FormControlState<string>>) => {
     try {
-      const res = await signIn.create(buildSignInParams(fields));
+      const res = await signIn.create(buildSignInParams(fields)).then(signInResource => {
+        /**
+         * For SAML enabled instances, perform sign in with password only when it is allowed for the identified user.
+         */
+        const passwordField = fields.find(f => f.name === 'password')?.value;
+        if (!passwordField || signInResource.supportedFirstFactors.some(ff => ff.strategy === 'saml')) {
+          return signInResource;
+        }
+        return signInResource.attemptFirstFactor({ strategy: 'password', password: passwordField });
+      });
+
       switch (res.status) {
         case 'needs_identifier':
           // Check if we need to initiate a saml flow

From 731f8f1add07361cb23c814b5fbbe2b4968fa57e Mon Sep 17 00:00:00 2001
From: panteliselef <panteliselef@outlook.com>
Date: Tue, 18 Jun 2024 20:00:00 +0300
Subject: [PATCH 3/4] fix(clerk-js): Avoid sending password when saml is
 enabled

---
 .changeset/nine-radios-tap.md | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/.changeset/nine-radios-tap.md b/.changeset/nine-radios-tap.md
index e284a662a9d..a28a9ea79e0 100644
--- a/.changeset/nine-radios-tap.md
+++ b/.changeset/nine-radios-tap.md
@@ -2,4 +2,4 @@
 "@clerk/clerk-js": patch
 ---
 
-Avoid sending password when saml is enabled.
+Bug fix: Skip password strategy for users who authenticate with SAML. 

From 3470a88335fde0547b42d1562a771466705c0d85 Mon Sep 17 00:00:00 2001
From: panteliselef <panteliselef@outlook.com>
Date: Tue, 18 Jun 2024 21:13:20 +0300
Subject: [PATCH 4/4] fix(upgrade): Add repository url to package.json

---
 packages/upgrade/package.json | 5 +++++
 1 file changed, 5 insertions(+)

diff --git a/packages/upgrade/package.json b/packages/upgrade/package.json
index 4da3d966fd6..61b70823b2e 100644
--- a/packages/upgrade/package.json
+++ b/packages/upgrade/package.json
@@ -17,6 +17,11 @@
     "lint": "eslint src/",
     "lint:publint": "publint"
   },
+  "repository": {
+    "type": "git",
+    "url": "git+https://github.com/clerk/javascript.git",
+    "directory": "packages/upgrade"
+  },
   "babel": {
     "presets": [
       "@babel/preset-react"