diff --git a/.changeset/major-nuxt-remove-route-matcher.md b/.changeset/major-nuxt-remove-route-matcher.md index abcf03453ca..2feb9a193cc 100644 --- a/.changeset/major-nuxt-remove-route-matcher.md +++ b/.changeset/major-nuxt-remove-route-matcher.md @@ -8,9 +8,9 @@ Protect API routes inside the event handler itself: ```ts export default defineEventHandler(event => { - const { userId } = event.context.auth(); + const { isAuthenticated, userId } = event.context.auth(); - if (!userId) { + if (!isAuthenticated) { throw createError({ statusCode: 401, statusMessage: 'Unauthorized' }); } @@ -48,8 +48,8 @@ Migrate my Nuxt project away from Clerk's removed `createRouteMatcher` API. `@clerk/nuxt/server`) or in Nuxt route middleware (auto-imported). 2. For every API route those matchers protected, move the auth check into the event handler itself: - const { userId } = event.context.auth(); - if (!userId) throw createError({ statusCode: 401, statusMessage: 'Unauthorized' }); + const { isAuthenticated } = event.context.auth(); + if (!isAuthenticated) throw createError({ statusCode: 401, statusMessage: 'Unauthorized' }); Keep any role or permission checks (`event.context.auth().has(...)`) with the resource as well. 3. For every page those matchers protected, create a named route middleware in diff --git a/packages/astro/CHANGELOG.md b/packages/astro/CHANGELOG.md index dde5b66ef6f..0faa333dde6 100644 --- a/packages/astro/CHANGELOG.md +++ b/packages/astro/CHANGELOG.md @@ -39,9 +39,9 @@ import type { APIRoute } from 'astro'; export const GET: APIRoute = ({ locals }) => { - const { userId } = locals.auth(); + const { isAuthenticated, userId } = locals.auth(); - if (!userId) { + if (!isAuthenticated) { return new Response('Unauthorized', { status: 401 }); } @@ -59,11 +59,11 @@ logic that uses it (returning 401s, calling `auth().redirectToSignIn()`, etc.). 2. For every route those matchers protected, move the auth check into the resource itself: - In `.astro` pages, add this to the frontmatter: - const { userId, redirectToSignIn } = Astro.locals.auth(); - if (!userId) return redirectToSignIn(); + const { isAuthenticated, redirectToSignIn } = Astro.locals.auth(); + if (!isAuthenticated) return redirectToSignIn(); - In API routes and server handlers, add this at the top of the handler: - const { userId } = locals.auth(); - if (!userId) return new Response('Unauthorized', { status: 401 }); + const { isAuthenticated } = locals.auth(); + if (!isAuthenticated) return new Response('Unauthorized', { status: 401 }); - Keep any role or permission checks (`auth().has(...)`) with the resource as well. 3. Remove the `createRouteMatcher` import and calls from the middleware. Keep `clerkMiddleware()` itself. Middleware logic unrelated to auth protection