chore(backend,nextjs): Improve machine auth type inference and hover types - #9346
chore(backend,nextjs): Improve machine auth type inference and hover types#9346wobsoriano wants to merge 9 commits into
Conversation
|
The latest updates on your projects. Learn more about Vercel for GitHub.
|
🦋 Changeset detectedLatest commit: 41b6633 The changes in this PR will be included in the next version bump. This PR includes changesets to release 10 packages
Not sure what this means? Click here to learn what changesets are. Click here if you're a maintainer who wants to add another changeset to this PR |
@clerk/astro
@clerk/backend
@clerk/chrome-extension
@clerk/clerk-js
@clerk/electron
@clerk/electron-passkeys
@clerk/eslint-plugin
@clerk/expo
@clerk/expo-google-signin
@clerk/expo-passkeys
@clerk/express
@clerk/fastify
@clerk/hono
@clerk/localizations
@clerk/nextjs
@clerk/nuxt
@clerk/react
@clerk/react-router
@clerk/shared
@clerk/tanstack-react-start
@clerk/testing
@clerk/ui
@clerk/upgrade
@clerk/vue
commit: |
API Changes Report
Summary
@clerk/backendCurrent version: 3.15.1 Subpath
|
📝 WalkthroughWalkthroughThe change adds reusable machine authentication object helpers and a distributed Estimated code review effort: 3 (Moderate) | ~25 minutes Suggested reviewers: 🚥 Pre-merge checks | ✅ 5✅ Passed checks (5 passed)
Comment |
![coderabbitai[bot]](https://avatars.githubusercontent.com/in/347564?s=60&v=4){kind=small}
There was a problem hiding this comment.
Actionable comments posted: 1
🤖 Prompt for all review comments with AI agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
Inline comments:
In `@packages/backend/src/tokens/__tests__/getAuth.test-d.ts`:
- Around line 206-223: Strengthen the type assertions in the direct helper
contract tests for ApiKey, Mixed, and MachineOnly so they verify exact
assignability in both directions. Replace the one-way toExtend checks with
toEqualTypeOf where appropriate, or add the inverse assertions, ensuring each
helper remains token-specific rather than accepting broader machine auth
members.
🪄 Autofix
Fix all unresolved CodeRabbit comments on this PR:
- Push a commit to this branch (recommended)
- Create a new PR with the fixes
ℹ️ Review info
⚙️ Run configuration
Configuration used: Repository YAML (base), Organization UI (inherited)
Review profile: CHILL
Plan: Pro Plus
Run ID: ba6721bd-5f76-4549-939f-2740086621f2
📒 Files selected for processing (6)
.changeset/spicy-hover-types.mdpackages/backend/src/tokens/__tests__/getAuth.test-d.tspackages/backend/src/tokens/__tests__/request.test-d.tspackages/backend/src/tokens/authObjects.tspackages/backend/src/tokens/types.tspackages/backend/vitest.config.mts
🔗 Linked repositories identified
CodeRabbit considers these linked repositories for cross-repo context during reviews:
clerk/clerk_go(manual)clerk/dashboard(manual)clerk/accounts(manual)clerk/backoffice(manual)clerk/clerk(manual)clerk/clerk-docs(manual)clerk/cloudflare-workers(manual)clerk/clerk-ios(auto-detected)clerk/clerk-android(auto-detected)clerk/cli(auto-detected)
| type ApiKey = InferAuthObjectFromToken<'api_key', SignedInAuthObject, AuthenticatedMachineObject>; | ||
| expectTypeOf<AuthenticatedMachineObject<'api_key'>>().toExtend<ApiKey>(); | ||
| }); | ||
|
|
||
| test('array helper accepts every clean member per token type', () => { | ||
| type Mixed = InferAuthObjectFromTokenArray< | ||
| ('session_token' | 'm2m_token')[], | ||
| SignedInAuthObject, | ||
| AuthenticatedMachineObject | ||
| >; | ||
| expectTypeOf<SignedInAuthObject | AuthenticatedMachineObject<'m2m_token'>>().toExtend<Mixed>(); | ||
|
|
||
| type MachineOnly = InferAuthObjectFromTokenArray< | ||
| ('m2m_token' | 'oauth_token')[], | ||
| SignedInAuthObject, | ||
| AuthenticatedMachineObject | ||
| >; | ||
| expectTypeOf<AuthenticatedMachineObject<'m2m_token' | 'oauth_token'>>().toExtend<MachineOnly>(); |
There was a problem hiding this comment.
🎯 Functional Correctness | 🟡 Minor | ⚡ Quick win
Assert the inverse assignability for direct helper contracts.
These assertions do not fail if either helper returns all machine auth members. Add the inverse assertion, or use toEqualTypeOf, for ApiKey, Mixed, and MachineOnly. This keeps the direct @clerk/backend/internal helper contract token-specific.
🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
In `@packages/backend/src/tokens/__tests__/getAuth.test-d.ts` around lines 206 -
223, Strengthen the type assertions in the direct helper contract tests for
ApiKey, Mixed, and MachineOnly so they verify exact assignability in both
directions. Replace the one-way toExtend checks with toEqualTypeOf where
appropriate, or add the inverse assertions, ensuring each helper remains
token-specific rather than accepting broader machine auth members.
wobsoriano
changed the title
…-over - Build each constructor branch against its concrete object type so property drift fails compile; the remaining casts only bridge generic correlation - Fix getAuthObjectForAcceptedToken passing the debug function instead of its data, which silently emptied debug output on token-type downgrade - Make AuthenticatedState/UnauthenticatedState distributive so narrowing on tokenType also narrows toAuth()
1 participant
Description
Reworks the internal
acceptsTokentype inference in@clerk/backendfor readability and better editor hovers, with no changes to runtime behavior or type assignability, and moves@clerk/nextjsonto the new helper.InferAuthObject<T, SessionType, MachineType>helper that replaces the manual session-only / mixed / machine-only branch analysis. Union distribution performs the case analysis, andExtractfilters the machine union per token type instead of stamping it with atokenTypeintersection. Exported from@clerk/backend/internal.InferAuthObjectFromTokenandInferAuthObjectFromTokenArrayremain exported from@clerk/backend/internalwith unchanged signatures as one-line delegates, since published framework SDK dists import them by name.AuthenticatedMachineObjectandUnauthenticatedMachineObject, so machine auth results hover asAuthenticatedMachineObjectFor<"api_key"> | UnauthenticatedMachineObjectFor<"api_key">instead of expanded structural intersections.AuthProtectoverloads in@clerk/nextjstoInferAuthObjectand addsprotect.test-d.tspinning every overload's return type, includingtokenTypenarrowing.request.test-d.tsandgetAuth.test-d.ts: exact resolved state unions per accepted token type, mutual assignability of everygetAuth()/auth()return type,Parameters/ReturnTypeextraction, widened and readonly array behavior, and theany-input collapse thatauth.protect()in@clerk/nextjsrelies on. Also fixes the vitesttypecheck.includepatterns in both packages so.test-d.tsfiles are actually collected.Checklist
pnpm testruns as expected.pnpm buildruns as expected.Type of change