Initial pass at adding clerk login flow to tina by ajolipa · Pull Request #577 · performant-software/core-data-places

ajolipa · 2026-03-18T20:21:57Z

In this PR

Migrates SSO from Keycloak to Clerk.

Notes and limitations

To make the Clerk integration work smoothly, TinaCMS was updated to the latest version (3.6.1), along with some of its related packages. The Keycloak integration no longer works as previously configured in the older version, so is removed entirely in this PR. If we wanted to support both Keycloak and Clerk simultaneously (which I don't think we do), more work would have to be done to figure out how to make that possible.
Ideally we would hide or disable any fields that the current user is not allowed to alter, but that would involve creating custom components for each of them that work along the same model as the current PublishToggle component. Certainly possible, but a lot of busywork (maybe this is where Claude could actually step up and help?).
If a non-admin user attempts to delete or rename a post from the list of all posts, the whole page crashes, due to some sort of bug on Tina's end about how the error handling is done. If you reload the page everything's fine and the document was not deleted/renamed.

How to test

Go to https://padp.staging.performant.studio/admin/ and attempt to log in with an account that's a member of the Performant Software organization within the Performant Studio Staging application. You should receive an email code (or enter your password, depending on the user settings in Clerk I believe) and successfully log in to Tina. Once logged in you should see the PADP staging homepage and the Tina sidebar on the left.
Click on the hamburger menu in the top left and go to the Posts collection. You should be able to create a new post. When you create your post, you should not be able to edit the Published field. (You should just see the word "Unpublished" and not be able to interact with it.) The post should publish successfully and redirect you once saved to the visual editor view.
You should now see your own email as the creator, and be able to edit any field except for the creator and published fields, using the visual editor. You should be able to save your edits.

If you attempt to do anything other than edit your own post, you should receive some sort of error message. (Note: this is the main thing I would like to improve if there's any further time -- the error messages currently are not helpful to the user, and in some cases put the site in a temporarily broken state (fixed by refreshing).) This includes editing other people's posts, attempting to delete or rename a post, or trying to access any of the collections other than Posts and Paths.
Log out using the button at the bottom of the sidebar menu.

Log in again, this time with a user with the admin role in the organization. You should now be able to do anything you want, including editing other collections, deleting posts, and toggling the Published state of posts. (Note even admins cannot currently edit the Creator field of a post.) Go ahead and publish the post that your student account made.
Log out and back in as the student. Now that your post was published, you should no longer be able to make edits to it.
All of the above should also work for the Paths collection.
Log out and attempt to log in as a user who is not part of the correct organization. You should not be authenticated.

netlify · 2026-03-18T20:22:03Z

❌ Deploy Preview for juel-staging failed. Why did it fail? →

Name	Link
🔨 Latest commit	`8540b3a`
🔍 Latest deploy log	https://app.netlify.com/projects/juel-staging/deploys/69c6ce0bca70af0008720e70

netlify · 2026-03-18T20:22:03Z

❌ Deploy Preview for pss-scavenger-hunt failed. Why did it fail? →

Name	Link
🔨 Latest commit	`8540b3a`
🔍 Latest deploy log	https://app.netlify.com/projects/pss-scavenger-hunt/deploys/69c6ce0ad64d420007399e4f

netlify · 2026-03-18T20:22:03Z

✅ Deploy Preview for padp-staging ready!

Name	Link
🔨 Latest commit	`8540b3a`
🔍 Latest deploy log	https://app.netlify.com/projects/padp-staging/deploys/69c6ce0a93e9bb0009324cef
😎 Deploy Preview	https://deploy-preview-577--padp-staging.netlify.app
📱 Preview on mobile	Toggle QR Code... Use your smartphone camera to open QR code link.

To edit notification comments on pull requests, go to your Netlify project configuration.

netlify · 2026-03-18T20:22:03Z

❌ Deploy Preview for juel-ancestry failed. Why did it fail? →

Name	Link
🔨 Latest commit	`8540b3a`
🔍 Latest deploy log	https://app.netlify.com/projects/juel-ancestry/deploys/69c6ce0a80f14a000811e1c9

netlify · 2026-03-18T20:22:04Z

❌ Deploy Preview for gbof-c19nyc-staging failed. Why did it fail? →

Name	Link
🔨 Latest commit	`8540b3a`
🔍 Latest deploy log	https://app.netlify.com/projects/gbof-c19nyc-staging/deploys/69c6ce0a65b8c60008be8f55

netlify · 2026-03-18T20:23:31Z

❌ Deploy Preview for registro-project failed. Why did it fail? →

Name	Link
🔨 Latest commit	`8540b3a`
🔍 Latest deploy log	https://app.netlify.com/projects/registro-project/deploys/69c6ce0a99eff20007e3ccb4

netlify · 2026-03-18T20:23:57Z

❌ Deploy Preview for universities-studying-slavery failed. Why did it fail? →

Name	Link
🔨 Latest commit	`8540b3a`
🔍 Latest deploy log	https://app.netlify.com/projects/universities-studying-slavery/deploys/69c6ce0a0ba0fd000824f422

netlify · 2026-03-18T20:23:59Z

❌ Deploy Preview for juel-life failed. Why did it fail? →

Name	Link
🔨 Latest commit	`8540b3a`
🔍 Latest deploy log	https://app.netlify.com/projects/juel-life/deploys/69c6ce0a11d8d90008d9dad4

netlify · 2026-03-18T20:24:01Z

❌ Deploy Preview for libertos failed. Why did it fail? →

Name	Link
🔨 Latest commit	`8540b3a`
🔍 Latest deploy log	https://app.netlify.com/projects/libertos/deploys/69c6ce0af2cbda0008689378

netlify · 2026-03-18T20:24:09Z

❌ Deploy Preview for gamepossible failed. Why did it fail? →

Name	Link
🔨 Latest commit	`8540b3a`
🔍 Latest deploy log	https://app.netlify.com/projects/gamepossible/deploys/69c6ce0abdc48800086840b5

camdendotlol · 2026-03-20T15:31:42Z

Does this make Tina entirely dependent on Clerk, or is there still a way to set up local authentication?

ajolipa · 2026-03-20T15:51:06Z

Does this make Tina entirely dependent on Clerk, or is there still a way to set up local authentication?

It just replaces Keycloak. The native Tina user management is still possible (and is the default unless you set a certain env variable to true).

Expanding on this -- one thing that hasn't been done yet but could/should be is to implement the role-based permissions stuff for the default user management. Right now it's all tied to the way Clerk does organizations and roles, but in principle there's no reason we can't also have a role field on users in the Tina user collection and use it for some of these same permissions, although it might be somewhat involved to implement because right now we're using the backend auth provider just out-of-the-box, and we'd presumably have to make a custom version that takes the role field into consideration. I don't think it's unreasonable for now to basically just say that if all you need is a simple users list that's unique to the Tina project then you can use the native user management, and if you want all the bells and whistles of Performant Studio SSO and role management you can use Clerk. But it's something to think about in the future at least.

jamiefolsom · 2026-03-20T16:58:27Z

A few testing notes:

I logged in with my PSS email, which I believe is an admin account, and created a test post but did not check "published"; yet when I visit https://padp.staging.performant.studio/en/posts/ in an incognito window, I do see that test post live on the site. Should have to check "published" to see it.
Likewise, I've logged in as a Member, and while I am correctly prevented from editing another user's existing post, and from toggling the published field, when I go to https://padp.staging.performant.studio/en/posts/Member-Test-Post/ in a browser where I'm not logged in at all, I do see the member test post, when I should not, since it's supposedly not published.

session.remove() ends the current session token but leaves Clerk's browser-level sign-in state intact via cookies. signOut() clears both, ensuring a full logout. In practice the current code works because Clerk's UI re-prompts on the next page load, but signOut() is the documented way to fully end a Clerk session.

In SSR mode, any post/path slug is handled dynamically regardless of getStaticPaths. Unpublished content was accessible by direct URL. Now the page routes check published status before rendering.

- Shared getUserRole helper with dev-mode override for local testing - MutationObserver locks admin-only sidebar links (Settings, Branding, Internationalization, Navbar) with gray styling and lock icon - Ownership notice banner on posts/paths when viewing another user's content - beforeSubmit guard blocks saves for non-owners with clear error - Refactor PublishToggle to use shared role detection

use signOut() for Clerk logout

- CSS-disable all form fields (inputs, buttons, date picker, dropzone) - Hide status dot SVG, show lock icon in form header - Fix banner text and sizing (remove email, fix overflow) - Use useEffect for data attribute to avoid render loops - Add Pages to admin-only sidebar collections - Consolidate CSS selectors to target form scroll area

- cmsCallback only loads role-ui when TINA_PUBLIC_AUTH_USE_SSO is true - getUserRole defaults to admin when no Clerk user is found - Non-Clerk sites are unaffected by RBAC restrictions

Extensible `netlify.toml`

…s-ssr return 404 for unpublished posts and paths in SSR

add role-based UI restrictions for TinaCMS editors

Redeploy button

* admin redirect * don't crash site if the env vars aren't set * remove debug * reset config.json

* admin redirect * don't crash site if the env vars aren't set * remove debug * reset config.json * edge function fixes * slightly different approach

jamiefolsom

Staging is working for me as described. There is a short list of other issues to be addressed, but that need not block merging this PR. #602

jamiefolsom · 2026-03-25T22:06:39Z

scripts/build.content.mjs

  // Copy the "content" folder to the current directory
  fs.cpSync(`${TEMP_DIR}/content`, './content', { recursive: true });

+  // Append any custom Netlify config to the main one


See #594 -- both frames of the Tina Visual Editor have to be served from the same origin, likely the *.performant.studio subdomain, or else we get a cross origin security error.

initial pass at adding clerk login flow to tina

87bd949

ajolipa added 8 commits March 19, 2026 10:19

improving error message

617ac64

adding some console logs to netlify function

0f81aca

more logging

84a9b71

updating org membership check on backend

1209620

add 100 member org limit in backend auth

58e02fa

hide published field from non-admins; fix some permissions

97775a1

update publish field styling

9c0ccf7

improve published toggle; add checks for doc deletion/renaming

3ab3faf

ajolipa marked this pull request as ready for review March 20, 2026 14:52

ajolipa requested review from camdendotlol and jamiefolsom March 20, 2026 14:52

update paths schema to match posts

48d2b02

ajolipa and others added 3 commits March 20, 2026 15:53

updating paths config stuff

1a71a82

return 404 for unpublished posts and paths in SSR mode

4b41517

In SSR mode, any post/path slug is handled dynamically regardless of getStaticPaths. Unpublished content was accessible by direct URL. Now the page routes check published status before rendering.

jamiefolsom mentioned this pull request Mar 23, 2026

Upgrade TinaCMS to 3.6.x #575

Closed

7 tasks

jamiefolsom mentioned this pull request Mar 23, 2026

Add Clerk-based RBAC for TinaCMS #576

Closed

5 tasks

jamiefolsom and others added 3 commits March 23, 2026 22:05

Merge pull request #583 from performant-software/fix/clerk-logout

2fb2397

use signOut() for Clerk logout

jamiefolsom mentioned this pull request Mar 24, 2026

add role-based UI restrictions for TinaCMS editors #586

Merged

gate role-based UI behind SSO flag for non-Clerk site compatibility

5e98e1c

- cmsCallback only loads role-ui when TINA_PUBLIC_AUTH_USE_SSO is true - getUserRole defaults to admin when no Clerk user is found - Non-Clerk sites are unaffected by RBAC restrictions

jamiefolsom mentioned this pull request Mar 24, 2026

Pre-existing content without creator field is editable by all editors #587

Open

camdendotlol and others added 21 commits March 24, 2026 17:49

admin redirect

2bbc29a

reset config.json

9f6859f

one more newline

fca5e15

Merge pull request #593 from performant-software/cm/admin-redirect

16bbe92

Extensible `netlify.toml`

moving 404 logic to child components

9d14906

Merge pull request #584 from performant-software/fix/unpublished-post…

6e6f4cb

…s-ssr return 404 for unpublished posts and paths in SSR

fixing getUserRole function; disabling editing of published content

0c8f87b

Merge pull request #586 from performant-software/fix/role-based-ui

d4637df

add role-based UI restrictions for TinaCMS editors

fix custom netlify.toml script

c130a42

initial commit

e0a7938

add handling for null document to role-ui

06374e0

more troubleshooting

8b84b7d

WIP

3208903

check in edge function too

e7b9e16

fixes

51309ec

Merge pull request #595 from performant-software/cm/rebuild-function

78846fc

Redeploy button

loading indicator (#596)

6bf03fe

Admin redirect (#597)

3cdb27d

* admin redirect * don't crash site if the env vars aren't set * remove debug * reset config.json

Redirect edge function fixes (#598)

bef3444

* admin redirect * don't crash site if the env vars aren't set * remove debug * reset config.json * edge function fixes * slightly different approach

add _astro to routes ignored by redirect (#599)

04598a0

fix pathname (#600)

8540b3a

jamiefolsom mentioned this pull request Mar 31, 2026

Release Punchlist #602

Open

11 tasks

jamiefolsom approved these changes Mar 31, 2026

View reviewed changes

Conversation

ajolipa commented Mar 18, 2026 • edited by jamiefolsom Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

In this PR

Notes and limitations

How to test

Uh oh!

netlify bot commented Mar 18, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

❌ Deploy Preview for juel-staging failed. Why did it fail? →

Uh oh!

netlify bot commented Mar 18, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

❌ Deploy Preview for pss-scavenger-hunt failed. Why did it fail? →

Uh oh!

netlify bot commented Mar 18, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

✅ Deploy Preview for padp-staging ready!

Uh oh!

netlify bot commented Mar 18, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

❌ Deploy Preview for juel-ancestry failed. Why did it fail? →

Uh oh!

netlify bot commented Mar 18, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

❌ Deploy Preview for gbof-c19nyc-staging failed. Why did it fail? →

Uh oh!

netlify bot commented Mar 18, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

❌ Deploy Preview for registro-project failed. Why did it fail? →

Uh oh!

netlify bot commented Mar 18, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

❌ Deploy Preview for universities-studying-slavery failed. Why did it fail? →

Uh oh!

netlify bot commented Mar 18, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

❌ Deploy Preview for juel-life failed. Why did it fail? →

Uh oh!

netlify bot commented Mar 18, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

❌ Deploy Preview for libertos failed. Why did it fail? →

Uh oh!

netlify bot commented Mar 18, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

❌ Deploy Preview for gamepossible failed. Why did it fail? →

Uh oh!

camdendotlol commented Mar 20, 2026

Uh oh!

ajolipa commented Mar 20, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

jamiefolsom commented Mar 20, 2026

Uh oh!

jamiefolsom left a comment

Choose a reason for hiding this comment

Uh oh!

jamiefolsom Mar 25, 2026

Choose a reason for hiding this comment

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

3 participants

ajolipa commented Mar 18, 2026 •

edited by jamiefolsom

Loading

netlify bot commented Mar 18, 2026 •

edited

Loading

netlify bot commented Mar 18, 2026 •

edited

Loading

netlify bot commented Mar 18, 2026 •

edited

Loading

netlify bot commented Mar 18, 2026 •

edited

Loading

netlify bot commented Mar 18, 2026 •

edited

Loading

netlify bot commented Mar 18, 2026 •

edited

Loading

netlify bot commented Mar 18, 2026 •

edited

Loading

netlify bot commented Mar 18, 2026 •

edited

Loading

netlify bot commented Mar 18, 2026 •

edited

Loading

netlify bot commented Mar 18, 2026 •

edited

Loading

ajolipa commented Mar 20, 2026 •

edited

Loading