fix(backend,shared,types): Do not check for sessionClaims on auth state
#6164
Conversation
🦋 Changeset detectedLatest commit: a5b9528 The changes in this PR will be included in the next version bump. This PR includes changesets to release 22 packages
Not sure what this means? Click here to learn what changesets are. Click here if you're a maintainer who wants to add another changeset to this PR |
|
The latest updates on your projects. Learn more about Vercel for Git ↗︎
|
📝 WalkthroughWalkthroughThe changes introduce console.log statements for debugging in the synchronous and asynchronous Possibly related PRs
Suggested labels
📜 Recent review detailsConfiguration used: CodeRabbit UI 📒 Files selected for processing (4)
✅ Files skipped from review due to trivial changes (1)
🚧 Files skipped from review as they are similar to previous changes (3)
⏰ Context from checks skipped due to timeout of 90000ms (3)
🪧 TipsChatThere are 3 ways to chat with CodeRabbit:
SupportNeed help? Create a ticket on our support page for assistance with any issues or questions. Note: Be mindful of the bot's finite context window. It's strongly recommended to break down tasks such as reading entire modules into smaller chunks. For a focused discussion, use review comments to chat about specific files and their changes, instead of using the PR comments. CodeRabbit Commands (Invoked using PR comments)
Other keywords and placeholders
CodeRabbit Configuration File (
|
![coderabbitai[bot]](https://avatars.githubusercontent.com/in/347564?s=60&v=4){kind=small}
There was a problem hiding this comment.
Actionable comments posted: 2
📜 Review details
Configuration used: CodeRabbit UI
Review profile: CHILL
Plan: Pro
📒 Files selected for processing (3)
packages/nextjs/src/server/data/getAuthDataFromRequest.ts(2 hunks)packages/shared/src/authorization.ts(6 hunks)packages/types/src/hooks.ts(2 hunks)
⏰ Context from checks skipped due to timeout of 90000ms (3)
- GitHub Check: semgrep-cloud-platform/scan
- GitHub Check: Analyze (javascript-typescript)
- GitHub Check: semgrep/ci
🔇 Additional comments (6)
packages/types/src/hooks.ts (1)
97-97: The previous search failed due to the unrecognizedtsxfile type. Let’s rerun a broader search for any direct property access ofsessionClaimsacross.tsand.tsxfiles:#!/bin/bash # Broader search for sessionClaims property access in TS/TSX files rg -A 3 -B 3 "sessionClaims\." -g '*.ts' -g '*.tsx'packages/shared/src/authorization.ts (5)
78-79: Minor JSDoc formatting improvement.The capitalization of "Null" in the return description improves consistency with standard documentation conventions.
166-167: Minor JSDoc formatting improvement.The capitalization of "Null" in the return description improves consistency with standard documentation conventions.
329-329: Correctly removes sessionClaims check from auth state resolution.This change aligns with the PR objective to not check for sessionClaims when determining auth state. The logic now correctly considers a user signed in based on sessionId and userId presence, with sessionClaims being optional.
347-347: Export order changed without functional impact.The reordering of exports doesn't affect functionality but changes the order in which functions are exported. This is a minor organizational change.
312-312: Correctly removes sessionClaims check from auth state resolution.This change aligns with the PR objective to not check for sessionClaims when determining auth state. The logic now correctly considers a user signed in based on sessionId and userId presence, with sessionClaims being optional.
Verify that this change doesn't break existing functionality by ensuring all test cases pass:
#!/bin/bash # Search for tests related to resolveAuthState to verify they still pass rg -A 10 -B 5 "resolveAuthState" --type ts --type js packages/*/test* packages/*/src/**/*test*
| @@ -78,6 +78,8 @@ export const getAuthDataFromRequestSync = ( | |||
| return getAuthObjectFromJwt(jwt, options); | |||
| } | |||
|
|
|||
| console.log('auth object from auth data request', { authObject }); | |||
There was a problem hiding this comment.
Remove console.log statement before production.
This debugging statement should be removed as it may expose sensitive authentication data in production logs and create unnecessary console noise.
- console.log('auth object from auth data request', { authObject });📝 Committable suggestion
‼️ IMPORTANT
Carefully review the code before committing. Ensure that it accurately replaces the highlighted code, contains no missing lines, and has no issues with indentation. Thoroughly test & benchmark the code to ensure it meets the requirements.
| console.log('auth object from auth data request', { authObject }); |
🤖 Prompt for AI Agents
In packages/nextjs/src/server/data/getAuthDataFromRequest.ts at line 81, remove
the console.log statement that outputs the authObject to prevent exposing
sensitive authentication data and avoid unnecessary console noise in production
environments.
LauraBeatris
force-pushed
the
laura/fix-auth-state
branch
from
8d12e9f to
d9fad15
Compare
LauraBeatris
force-pushed
the
laura/fix-auth-state
branch
from
d9fad15 to
a5b9528
Compare
@clerk/agent-toolkit
@clerk/astro
@clerk/backend
@clerk/chrome-extension
@clerk/clerk-js
@clerk/dev-cli
@clerk/elements
@clerk/clerk-expo
@clerk/expo-passkeys
@clerk/express
@clerk/fastify
@clerk/localizations
@clerk/nextjs
@clerk/nuxt
@clerk/clerk-react
@clerk/react-router
@clerk/remix
@clerk/shared
@clerk/tanstack-react-start
@clerk/testing
@clerk/themes
@clerk/types
@clerk/upgrade
@clerk/vue
commit: |
Description
Checklist
pnpm testruns as expected.pnpm buildruns as expected.Type of change
Summary by CodeRabbit