fix(ui): clear the invitation ticket when a sign-in completes on a challenge

.changeset/clear-ticket-after-challenge.md

@@ -0,0 +1,5 @@
+---
+'@clerk/ui': patch
+---
+
+Clear the invitation ticket from the URL when a sign-in completes on a verification challenge.

packages/ui/src/components/SignIn/SignInProtectCheck.tsx

@@ -1,3 +1,4 @@
+import { removeClerkQueryParam } from '@clerk/shared/internal/clerk-js/queryParams';
 import { useClerk } from '@clerk/shared/react';
 import type { SignInResource } from '@clerk/shared/types';
 import { useEffect, useRef, useState } from 'react';
@@ -72,6 +73,9 @@ function SignInProtectCheckInternal(): JSX.Element | null {
         return;
       }
       if (updatedSignIn.status === 'complete' && updatedSignIn.createdSessionId) {
+        // A ticket sign-in that would have completed on the start page is completing here
+        // instead, so the ticket has to be cleared here too — otherwise it stays in the URL.
+        removeClerkQueryParam('__clerk_ticket');
         await setActive({
           session: updatedSignIn.createdSessionId,
           navigate: async ({ session, decorateUrl }) => {

packages/ui/src/components/SignIn/__tests__/SignInProtectCheck.test.tsx

@@ -23,6 +23,29 @@ beforeEach(() => {
 });
 
 describe('SignInProtectCheck', () => {
+  it('clears the invitation ticket when the sign-in completes on the challenge', async () => {
+    const { wrapper, fixtures } = await createFixtures(f => {
+      f.startSignInWithProtectCheck();
+    });
+    const url = new URL(window.location.href);
+    url.searchParams.set('__clerk_ticket', 'tkt_abc');
+    window.history.replaceState({}, '', url.toString());
+
+    mockExecute.mockResolvedValue('proof-abc');
+    fixtures.signIn.submitProtectCheck.mockResolvedValue({
+      status: 'complete',
+      protectCheck: null,
+      createdSessionId: 'sess_1',
+    } as unknown as SignInResource);
+
+    render(<SignInProtectCheck />, { wrapper });
+
+    await waitFor(() => {
+      expect(fixtures.clerk.setActive).toHaveBeenCalled();
+    });
+    expect(new URL(window.location.href).searchParams.get('__clerk_ticket')).toBeNull();
+  });
+
   describe('enterprise SSO', () => {
     const enterpriseSSOSignIn = (supportedFirstFactors: unknown[]) =>
       ({