From 490fee002ef6aa78512ccd76dec6b459806499a9 Mon Sep 17 00:00:00 2001
From: Shinji-Li <onlyyoulove3@gmail.com>
Date: Fri, 24 Oct 2025 12:08:22 +0800
Subject: [PATCH] =?UTF-8?q?=E2=9C=A8=20feat:=20use=20env=20to=20control=20?=
 =?UTF-8?q?clerk=20allow=20origin=20feature=20(#9863)?=
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

feat: use clerk allow origin feature
---
 .env.example                            |  3 +++
 src/layout/AuthProvider/Clerk/index.tsx | 12 ++++++++++++
 2 files changed, 15 insertions(+)

diff --git a/.env.example b/.env.example
index bf895ddb7a..5b3ef3600a 100644
--- a/.env.example
+++ b/.env.example
@@ -256,6 +256,9 @@ OPENAI_API_KEY=sk-xxxxxxxxx
 # you need to config the clerk webhook secret key if you want to use the clerk with database
 #CLERK_WEBHOOK_SECRET=whsec_xxxxxxxxxxxxxxxxxxxxxx
 
+# Clear allow origin https://clerk.com/docs/guides/dashboard/dns-domains/satellite-domains
+# Authentication across different domains , use,to splite different origin
+# NEXT_PUBLIC_CLERK_AUTH_ALLOW_ORIGINS='https://market.lobehub.com,https://lobehub.com'
 
 # NextAuth related configurations
 # NEXT_PUBLIC_ENABLE_NEXT_AUTH=1
diff --git a/src/layout/AuthProvider/Clerk/index.tsx b/src/layout/AuthProvider/Clerk/index.tsx
index 7604845ba5..b984bfa04c 100644
--- a/src/layout/AuthProvider/Clerk/index.tsx
+++ b/src/layout/AuthProvider/Clerk/index.tsx
@@ -30,6 +30,17 @@ const Clerk = memo(({ children }: PropsWithChildren) => {
     });
   }, [count, setCount, isPending, startTransition]);
 
+  const allowedRedirectOrigins = useMemo(() => {
+    const rawOrigins = process.env.NEXT_PUBLIC_CLERK_AUTH_ALLOW_ORIGINS;
+    if (!rawOrigins) return undefined;
+
+    const origins = rawOrigins
+      .split(',')
+      .map((origin) => origin.trim())
+      .filter(Boolean);
+    return origins.length ? origins : undefined;
+  }, []);
+
   const updatedAppearance = useMemo(
     () => ({
       ...appearance,
@@ -43,6 +54,7 @@ const Clerk = memo(({ children }: PropsWithChildren) => {
 
   return (
     <ClerkProvider
+      allowedRedirectOrigins={allowedRedirectOrigins}
       appearance={updatedAppearance}
       localization={localization}
       signUpUrl={!enableClerkSignUp ? '/login' : '/signup'} // Redirect sign-up to sign-in if disabled