Skip to content
Merged
Show file tree
Hide file tree
Changes from all commits
Commits
File filter

Filter by extension

Filter by extension

Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
8 changes: 4 additions & 4 deletions .changeset/major-nuxt-remove-route-matcher.md
Original file line number Diff line number Diff line change
Expand Up @@ -8,9 +8,9 @@ Protect API routes inside the event handler itself:

```ts
export default defineEventHandler(event => {
const { userId } = event.context.auth();
const { isAuthenticated, userId } = event.context.auth();

if (!userId) {
if (!isAuthenticated) {
throw createError({ statusCode: 401, statusMessage: 'Unauthorized' });
}

Expand Down Expand Up @@ -48,8 +48,8 @@ Migrate my Nuxt project away from Clerk's removed `createRouteMatcher` API.
`@clerk/nuxt/server`) or in Nuxt route middleware (auto-imported).
2. For every API route those matchers protected, move the auth check into the
event handler itself:
const { userId } = event.context.auth();
if (!userId) throw createError({ statusCode: 401, statusMessage: 'Unauthorized' });
const { isAuthenticated } = event.context.auth();
if (!isAuthenticated) throw createError({ statusCode: 401, statusMessage: 'Unauthorized' });
Keep any role or permission checks (`event.context.auth().has(...)`) with
the resource as well.
3. For every page those matchers protected, create a named route middleware in
Expand Down
12 changes: 6 additions & 6 deletions packages/astro/CHANGELOG.md
Original file line number Diff line number Diff line change
Expand Up @@ -39,9 +39,9 @@
import type { APIRoute } from 'astro';

export const GET: APIRoute = ({ locals }) => {
const { userId } = locals.auth();
const { isAuthenticated, userId } = locals.auth();

if (!userId) {
if (!isAuthenticated) {
return new Response('Unauthorized', { status: 401 });
}

Expand All @@ -59,11 +59,11 @@
logic that uses it (returning 401s, calling `auth().redirectToSignIn()`, etc.).
2. For every route those matchers protected, move the auth check into the resource itself:
- In `.astro` pages, add this to the frontmatter:
const { userId, redirectToSignIn } = Astro.locals.auth();
if (!userId) return redirectToSignIn();
const { isAuthenticated, redirectToSignIn } = Astro.locals.auth();
if (!isAuthenticated) return redirectToSignIn();
- In API routes and server handlers, add this at the top of the handler:
const { userId } = locals.auth();
if (!userId) return new Response('Unauthorized', { status: 401 });
const { isAuthenticated } = locals.auth();
if (!isAuthenticated) return new Response('Unauthorized', { status: 401 });
- Keep any role or permission checks (`auth().has(...)`) with the resource as well.
3. Remove the `createRouteMatcher` import and calls from the middleware. Keep
`clerkMiddleware()` itself. Middleware logic unrelated to auth protection
Expand Down
Loading