feat(react,shared): Ensure has is always defined

.changeset/steady-has-default.md

@@ -0,0 +1,6 @@
+---
+'@clerk/react': patch
+'@clerk/shared': patch
+---
+
+Ensure `useAuth().has` is always defined by defaulting to false when auth data is missing.

packages/react/src/hooks/__tests__/useAuth.test.tsx

@@ -98,7 +98,8 @@ describe('useDerivedAuth', () => {
     expect(current.orgId).toBeUndefined();
     expect(current.orgRole).toBeUndefined();
     expect(current.orgSlug).toBeUndefined();
-    expect(current.has).toBeUndefined();
+    expect(current.has).toBeInstanceOf(Function);
+    expect(current.has?.({ permission: 'test' })).toBe(false);
   });
 
   it('returns loaded but not signed in when sessionId and userId are null', () => {

packages/react/src/hooks/__tests__/useAuth.type.test.ts

@@ -4,7 +4,7 @@ import { describe, expectTypeOf, it } from 'vitest';
 import type { useAuth } from '../useAuth';
 
 type UseAuthParameters = Parameters<typeof useAuth>[0];
-type HasFunction = Exclude<ReturnType<typeof useAuth>['has'], undefined>;
+type HasFunction = ReturnType<typeof useAuth>['has'];
 type ParamsOfHas = Parameters<HasFunction>[0];
 
 describe('useAuth type tests', () => {

packages/shared/src/authorization.ts

@@ -260,86 +260,86 @@ const resolveAuthState = ({
 }: AuthStateOptions): UseAuthReturn | undefined => {
   if (sessionId === undefined && userId === undefined) {
     return {
+      actor: undefined,
+      getToken,
+      has: () => false,
       isLoaded: false,
       isSignedIn: undefined,
-      sessionId,
-      sessionClaims: undefined,
-      userId,
-      actor: undefined,
       orgId: undefined,
       orgRole: undefined,
       orgSlug: undefined,
-      has: undefined,
+      sessionClaims: undefined,
+      sessionId,
       signOut,
-      getToken,
+      userId,
     } as const;
   }
 
   if (sessionId === null && userId === null) {
     return {
+      actor: null,
+      getToken,
+      has: () => false,
       isLoaded: true,
       isSignedIn: false,
-      sessionId,
-      userId,
-      sessionClaims: null,
-      actor: null,
       orgId: null,
       orgRole: null,
       orgSlug: null,
-      has: () => false,
+      sessionClaims: null,
+      sessionId,
       signOut,
-      getToken,
+      userId,
     } as const;
   }
 
   if (treatPendingAsSignedOut && sessionStatus === 'pending') {
     return {
+      actor: null,
+      getToken,
+      has: () => false,
       isLoaded: true,
       isSignedIn: false,
-      sessionId: null,
-      userId: null,
-      sessionClaims: null,
-      actor: null,
       orgId: null,
       orgRole: null,
       orgSlug: null,
-      has: () => false,
+      sessionClaims: null,
+      sessionId: null,
       signOut,
-      getToken,
+      userId: null,
     } as const;
   }
 
   if (!!sessionId && !!sessionClaims && !!userId && !!orgId && !!orgRole) {
     return {
+      actor: actor || null,
+      getToken,
+      has,
       isLoaded: true,
       isSignedIn: true,
-      sessionId,
-      sessionClaims,
-      userId,
-      actor: actor || null,
       orgId,
       orgRole,
       orgSlug: orgSlug || null,
-      has,
+      sessionClaims,
+      sessionId,
       signOut,
-      getToken,
+      userId,
     } as const;
   }
 
   if (!!sessionId && !!sessionClaims && !!userId && !orgId) {
     return {
+      actor: actor || null,
+      getToken,
+      has,
       isLoaded: true,
       isSignedIn: true,
-      sessionId,
-      sessionClaims,
-      userId,
-      actor: actor || null,
       orgId: null,
       orgRole: null,
       orgSlug: null,
-      has,
+      sessionClaims,
+      sessionId,
       signOut,
-      getToken,
+      userId,
     } as const;
   }
 };

packages/shared/src/types/hooks.ts

@@ -14,11 +14,11 @@ import type { UserResource } from './user';
 /**
  * @inline
  */
-type CheckAuthorizationSignedOut = undefined;
+type CheckAuthorizationWithoutOrgOrUser = (params: Parameters<CheckAuthorizationWithCustomPermissions>[0]) => false;
 /**
  * @inline
  */
-type CheckAuthorizationWithoutOrgOrUser = (params: Parameters<CheckAuthorizationWithCustomPermissions>[0]) => false;
+type CheckAuthorizationSignedOut = CheckAuthorizationWithoutOrgOrUser;
 
 /**
  * @inline