Uh oh!
There was an error while loading. Please reload this page.
feat(backend,nextjs): Add support for M2M JWT creation and verification - #7955
Conversation
🦋 Changeset detectedLatest commit: 13609a6 The changes in this PR will be included in the next version bump. This PR includes changesets to release 0 packagesWhen changesets are added to this PR, you'll see the packages that this PR includes changesets for and the associated semver types Not sure what this means? Click here to learn what changesets are. Click here if you're a maintainer who wants to add another changeset to this PR |
The latest updates on your projects. Learn more about Vercel for GitHub.
|
@clerk/agent-toolkit@clerk/astro@clerk/backend@clerk/chrome-extension@clerk/clerk-js@clerk/dev-cli@clerk/expo@clerk/expo-passkeys@clerk/express@clerk/fastify@clerk/hono@clerk/localizations@clerk/nextjs@clerk/nuxt@clerk/react@clerk/react-router@clerk/shared@clerk/tanstack-react-start@clerk/testing@clerk/ui@clerk/upgrade@clerk/vuecommit: |
📝 WalkthroughWalkthroughAdds JWT-format support for M2M tokens alongside opaque tokens: new 🚥 Pre-merge checks | ✅ 2 | ❌ 1❌ Failed checks (1 warning)
✅ Passed checks (2 passed)
✏️ Tip: You can configure your own custom pre-merge checks in the settings. Tip Try Coding Plans. Let us write the prompt for your AI agent so you can ship faster (with fewer bugs). Comment |
There was a problem hiding this comment.
Actionable comments posted: 2
🤖 Prompt for all review comments with AI agents
Verify each finding against the current code and only fix it if needed.
Inline comments:
In `@packages/backend/src/jwt/verifyMachineJwt.ts`:
- Line 89: The JWT header's `kid` must be validated before calling
resolveKeyAndVerifyJwt to avoid using undefined keys; in both verifyM2MJwt and
verifyOAuthJwt check that decoded.header.kid is a non-empty string and
throw/return a clear error (e.g., "missing JWT kid in header") if absent,
preventing downstream cache lookups like
loadClerkJwkFromPem/loadClerkJWKFromRemote from receiving `undefined`; update
the call sites that currently pass decoded.header.kid to first validate and fail
fast with a descriptive error when the kid is missing.
In `@packages/backend/src/tokens/verify.ts`:
- Around line 264-266: The code calls decodedResult.payload.sub.startsWith(...)
which can throw if sub is undefined or not a string; update the conditional in
the verify flow (the branch that currently checks M2M_SUBJECT_PREFIX) to first
ensure typeof decodedResult.payload.sub === 'string' (or use the existing
isM2MJwt type guard from machine.ts) before calling startsWith, and only call
verifyM2MJwt(token, decodedResult, options) when that guard passes; otherwise
fall through to the non-M2M verification path.
ℹ️ Review info
Configuration used: Repository YAML (base), Organization UI (inherited)
Review profile: CHILL
Plan: Pro
Disabled knowledge base sources:
- Linear integration is disabled
You can enable these sources in your CodeRabbit configuration.
📒 Files selected for processing (25)
.changeset/clever-ways-raise.mdintegration/tests/machine-auth/m2m.test.tspackages/backend/src/__tests__/exports.test.tspackages/backend/src/api/__tests__/M2MTokenApi.test.tspackages/backend/src/api/endpoints/M2MTokenApi.tspackages/backend/src/api/factory.tspackages/backend/src/api/resources/M2MToken.tspackages/backend/src/api/resources/__tests__/M2MToken.test.tspackages/backend/src/errors.tspackages/backend/src/fixtures/index.tspackages/backend/src/fixtures/machine.tspackages/backend/src/internal.tspackages/backend/src/jwt/verifyMachineJwt.tspackages/backend/src/tokens/__tests__/authObjects.test.tspackages/backend/src/tokens/__tests__/machine.test.tspackages/backend/src/tokens/__tests__/verify.test.tspackages/backend/src/tokens/machine.tspackages/backend/src/tokens/request.tspackages/backend/src/tokens/verify.tspackages/express/src/__tests__/getAuth.test.tspackages/fastify/src/__tests__/getAuth.test.tspackages/nextjs/src/server/__tests__/clerkMiddleware.test.tspackages/nextjs/src/server/__tests__/getAuthDataFromRequest.test.tspackages/nextjs/src/server/data/getAuthDataFromRequest.tspackages/nextjs/src/server/protect.ts
💤 Files with no reviewable changes (1)
- packages/backend/src/tests/exports.test.ts
Uh oh!
There was an error while loading. Please reload this page.
Uh oh!
There was an error while loading. Please reload this page.
There was a problem hiding this comment.
changeset available in core 2
Description
Cherry-picked from Core 2 PR #7883
Checklist
pnpm testruns as expected.pnpm buildruns as expected.Type of change
Summary by CodeRabbit
New Features
Bug Fixes / Behavior
Tests