fix: hardcode Clerk issuer domain in auth.config.ts (fixes repeated auth failures) - #55
Merged
Merged
Conversation
Reading from process.env.CLERK_JWT_ISSUER_DOMAIN doesn't work reliably here: this file is evaluated by the Convex CLI at deploy time (in whatever environment is running `convex deploy`), not at runtime on Convex's own servers like a regular function - so Convex's dashboard-configured env vars aren't in scope here, unlike e.g. lib/secrets.ts's AWS credential reads, which run as real Convex actions and correctly see dashboard vars at call time. We only ever set CLERK_JWT_ISSUER_DOMAIN in Convex's dashboard, never in Vercel's build environment, so every Vercel-triggered deploy (`npx convex deploy --cmd 'pnpm build'`) was silently pushing an undefined domain - which explains the repeated "No auth provider found matching the given token" failures today. Also added it to Vercel's env vars as a second layer, but hardcoding here is the guaranteed fix regardless of which environment runs the deploy. If this domain ever changes, it needs to be updated here directly.
|
The latest updates on your projects. Learn more about Vercel for GitHub.
|
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Root cause of today's repeated "No auth provider found matching the given token" failures
`auth.config.ts` isn't a regular Convex function - it's evaluated by the Convex CLI at deploy time, in whatever environment is running `convex deploy`, not at runtime on Convex's own servers. That means Convex's dashboard-configured environment variables aren't in scope when this file is read, unlike e.g. `lib/secrets.ts`'s AWS credential reads, which run as real Convex actions and correctly see dashboard vars at call time.
We only ever set `CLERK_JWT_ISSUER_DOMAIN` in Convex's dashboard, never in Vercel's build environment. So every Vercel-triggered production deploy (`npx convex deploy --cmd 'pnpm build'`) was silently pushing an undefined domain to the auth provider config - explaining why this kept breaking after every fresh deploy today, regardless of how correct the Convex dashboard's value looked.
Fix
Hardcode the domain directly, since it's guaranteed correct regardless of which environment runs the deploy. Also added `CLERK_JWT_ISSUER_DOMAIN` to Vercel's env vars as a second layer of defense, but this hardcode is the actual guaranteed fix.
If this domain ever changes, it needs to be updated here directly (documented in the code comment).