feat(repo): Migrate Protect to Show #7373
Conversation
🦋 Changeset detectedLatest commit: 72f3d07 The changes in this PR will be included in the next version bump. This PR includes changesets to release 20 packages
Not sure what this means? Click here to learn what changesets are. Click here if you're a maintainer who wants to add another changeset to this PR |
|
The latest updates on your projects. Learn more about Vercel for GitHub.
|
📝 WalkthroughWalkthroughReplaces Protect, SignedIn, and SignedOut with a single Show component (prop: when: ShowWhenCondition) across multiple packages and frameworks. Adds ShowProps and ShowWhenCondition to shared types (introduces ProtectParams with a deprecated ProtectProps alias). Adds ClerkLoaded, ClerkLoading and an internal useSafeIsLoaded hook. Updates React, Next.js (app router server), Astro (CSR/SSR), Vue, Expo, Nuxt integrations, docs, examples, tests, and adds a codemod transform-protect-to-show to migrate usages. Pre-merge checks❌ Failed checks (1 warning)
✅ Passed checks (4 passed)
📜 Recent review detailsConfiguration used: Repository YAML (base), Organization UI (inherited) Review profile: CHILL Plan: Pro Disabled knowledge base sources:
📒 Files selected for processing (2)
🧰 Additional context used📓 Path-based instructions (7)**/*⚙️ CodeRabbit configuration file
Files:
**/*.{js,jsx,ts,tsx}📄 CodeRabbit inference engine (.cursor/rules/development.mdc)
Files:
**/*.{js,jsx,ts,tsx,json,md,yml,yaml}📄 CodeRabbit inference engine (.cursor/rules/development.mdc)
Files:
**/*.{ts,tsx,js,jsx}📄 CodeRabbit inference engine (.cursor/rules/development.mdc)
Files:
packages/**/src/**/*.{ts,tsx,js,jsx}📄 CodeRabbit inference engine (.cursor/rules/development.mdc)
Files:
**/*.{js,ts,jsx,tsx}📄 CodeRabbit inference engine (.cursor/rules/monorepo.mdc)
Files:
**/*.{js,ts,jsx,tsx,json,md,yml,yaml}📄 CodeRabbit inference engine (.cursor/rules/monorepo.mdc)
Files:
🧬 Code graph analysis (1)packages/upgrade/src/codemods/transform-protect-to-show.cjs (1)
⏰ Context from checks skipped due to timeout of 90000ms. You can increase the timeout in your CodeRabbit configuration to a maximum of 15 minutes (900000ms). (29)
Comment |
jacekradko
changed the title
@clerk/agent-toolkit
@clerk/astro
@clerk/backend
@clerk/chrome-extension
@clerk/clerk-js
@clerk/dev-cli
@clerk/expo
@clerk/expo-passkeys
@clerk/express
@clerk/fastify
@clerk/localizations
@clerk/nextjs
@clerk/nuxt
@clerk/react
@clerk/react-router
@clerk/shared
@clerk/tanstack-react-start
@clerk/testing
@clerk/ui
@clerk/upgrade
@clerk/vue
commit: |
![coderabbitai[bot]](https://avatars.githubusercontent.com/in/347564?s=60&v=4){kind=small}
There was a problem hiding this comment.
Actionable comments posted: 2
🧹 Nitpick comments (2)
packages/astro/src/astro-components/control/ShowSSR.astro (1)
10-11: Simplify the redundant conditional logic.Both lines always evaluate, creating unnecessary complexity. The nested ternaries can be simplified for better readability and performance.
Apply this diff to simplify:
-{when === 'signedIn' ? (userId ? <slot /> : null) : null} -{when === 'signedOut' ? (!userId ? <slot /> : null) : null} +{ + ((when === 'signedIn' && userId) || (when === 'signedOut' && !userId)) + ? <slot /> + : null +}packages/astro/src/astro-components/control/ShowCSR.astro (1)
21-45: Optional: simplify hidden toggling to reduce branching.You can collapse the nested conditionals into a single boolean and use
toggleAttribute('hidden', shouldHide)to make this easier to maintain.
📜 Review details
Configuration used: Path: .coderabbit.yaml
Review profile: CHILL
Plan: Pro
Disabled knowledge base sources:
- Linear integration is disabled by default for public repositories
You can enable these sources in your CodeRabbit configuration.
📒 Files selected for processing (15)
.changeset/show-the-guards.md(1 hunks)integration/templates/astro-hybrid/src/pages/index.astro(1 hunks)integration/templates/astro-hybrid/src/pages/ssr.astro(1 hunks)integration/templates/astro-node/src/layouts/Layout.astro(3 hunks)integration/templates/astro-node/src/layouts/react/Layout.astro(3 hunks)integration/templates/astro-node/src/pages/billing/checkout-btn.astro(1 hunks)integration/templates/astro-node/src/pages/index.astro(4 hunks)integration/templates/astro-node/src/pages/react/index.astro(5 hunks)integration/templates/astro-node/src/pages/react/only-admins.astro(1 hunks)integration/templates/astro-node/src/pages/react/only-members.astro(1 hunks)integration/templates/astro-node/src/pages/transitions/index.astro(1 hunks)packages/astro/src/astro-components/control/Show.astro(1 hunks)packages/astro/src/astro-components/control/ShowCSR.astro(1 hunks)packages/astro/src/astro-components/control/ShowSSR.astro(1 hunks)packages/astro/src/astro-components/index.ts(1 hunks)
🧰 Additional context used
📓 Path-based instructions (10)
**/*.{js,jsx,ts,tsx}
📄 CodeRabbit inference engine (.cursor/rules/development.mdc)
All code must pass ESLint checks with the project's configuration
Files:
packages/astro/src/astro-components/index.ts
**/*.{js,jsx,ts,tsx,json,md,yml,yaml}
📄 CodeRabbit inference engine (.cursor/rules/development.mdc)
Use Prettier for consistent code formatting
Files:
packages/astro/src/astro-components/index.ts
packages/**/src/**/*.{ts,tsx}
📄 CodeRabbit inference engine (.cursor/rules/development.mdc)
TypeScript is required for all packages
Files:
packages/astro/src/astro-components/index.ts
**/*.{ts,tsx,js,jsx}
📄 CodeRabbit inference engine (.cursor/rules/development.mdc)
Follow established naming conventions (PascalCase for components, camelCase for variables)
Files:
packages/astro/src/astro-components/index.ts
packages/**/src/**/*.{ts,tsx,js,jsx}
📄 CodeRabbit inference engine (.cursor/rules/development.mdc)
packages/**/src/**/*.{ts,tsx,js,jsx}: Maintain comprehensive JSDoc comments for public APIs
Use tree-shaking friendly exports
Validate all inputs and sanitize outputs
All public APIs must be documented with JSDoc
Use dynamic imports for optional features
Provide meaningful error messages to developers
Include error recovery suggestions where applicable
Log errors appropriately for debugging
Lazy load components and features when possible
Implement proper caching strategies
Use efficient data structures and algorithms
Implement proper logging with different levels
Files:
packages/astro/src/astro-components/index.ts
**/*.ts?(x)
📄 CodeRabbit inference engine (.cursor/rules/development.mdc)
Use proper TypeScript error types
Files:
packages/astro/src/astro-components/index.ts
**/*.{ts,tsx}
📄 CodeRabbit inference engine (.cursor/rules/typescript.mdc)
**/*.{ts,tsx}: Always define explicit return types for functions, especially public APIs
Use proper type annotations for variables and parameters where inference isn't clear
Avoidanytype - preferunknownwhen type is uncertain, then narrow with type guards
Implement type guards forunknowntypes using the patternfunction isType(value: unknown): value is Type
Useinterfacefor object shapes that might be extended
Usetypefor unions, primitives, and computed types
Preferreadonlyproperties for immutable data structures
Useprivatefor internal implementation details in classes
Useprotectedfor inheritance hierarchies
Usepublicexplicitly for clarity in public APIs
Use mixins for shared behavior across unrelated classes in TypeScript
Use generic constraints with bounded type parameters like<T extends { id: string }>
Use utility types likeOmit,Partial, andPickfor data transformation instead of manual type construction
Use discriminated unions instead of boolean flags for state management and API responses
Use mapped types for transforming object types
Use conditional types for type-level logic
Leverage template literal types for string manipulation at the type level
Use ES6 imports/exports consistently
Use default exports sparingly, prefer named exports
Document functions with JSDoc comments including @param, @returns, @throws, and @example tags
Create custom error classes that extend Error for specific error types
Use the Result pattern for error handling instead of throwing exceptions
Use optional chaining (?.) and nullish coalescing (??) operators for safe property access
Let TypeScript infer obvious types to reduce verbosity
Useconst assertionswithas constfor literal types
Usesatisfiesoperator for type checking without widening types
Declare readonly arrays and objects for immutable data structures
Use spread operator and array spread for immutable updates instead of mutations
Use lazy loading for large types...
Files:
packages/astro/src/astro-components/index.ts
**/index.ts
📄 CodeRabbit inference engine (.cursor/rules/typescript.mdc)
Avoid barrel files (index.ts re-exports) as they can cause circular dependencies
Files:
packages/astro/src/astro-components/index.ts
**/*.{js,ts,jsx,tsx}
📄 CodeRabbit inference engine (.cursor/rules/monorepo.mdc)
Use ESLint with custom configurations tailored for different package types
Files:
packages/astro/src/astro-components/index.ts
**/*.{js,ts,jsx,tsx,json,md,yml,yaml}
📄 CodeRabbit inference engine (.cursor/rules/monorepo.mdc)
Use Prettier for code formatting across all packages
Files:
packages/astro/src/astro-components/index.ts
⏰ Context from checks skipped due to timeout of 90000ms. You can increase the timeout in your CodeRabbit configuration to a maximum of 15 minutes (900000ms). (25)
- GitHub Check: Integration Tests (custom, chrome)
- GitHub Check: Integration Tests (nextjs, chrome, 16, RQ)
- GitHub Check: Integration Tests (billing, chrome, RQ)
- GitHub Check: Integration Tests (nextjs, chrome, 15)
- GitHub Check: Integration Tests (nextjs, chrome, 16)
- GitHub Check: Integration Tests (billing, chrome)
- GitHub Check: Integration Tests (machine, chrome, RQ)
- GitHub Check: Integration Tests (quickstart, chrome, 15)
- GitHub Check: Integration Tests (machine, chrome)
- GitHub Check: Integration Tests (react-router, chrome)
- GitHub Check: Integration Tests (quickstart, chrome, 16)
- GitHub Check: Integration Tests (ap-flows, chrome)
- GitHub Check: Integration Tests (tanstack-react-start, chrome)
- GitHub Check: Integration Tests (sessions:staging, chrome)
- GitHub Check: Integration Tests (vue, chrome)
- GitHub Check: Integration Tests (localhost, chrome)
- GitHub Check: Integration Tests (astro, chrome)
- GitHub Check: Integration Tests (sessions, chrome)
- GitHub Check: Integration Tests (nuxt, chrome)
- GitHub Check: Integration Tests (handshake, chrome)
- GitHub Check: Integration Tests (generic, chrome)
- GitHub Check: Integration Tests (handshake:staging, chrome)
- GitHub Check: Integration Tests (express, chrome)
- GitHub Check: Analyze (javascript-typescript)
- GitHub Check: semgrep-cloud-platform/scan
🔇 Additional comments (13)
integration/templates/astro-node/src/pages/react/only-admins.astro (1)
8-26: Refactor to use a singleShowblock with afallbackprop instead of two separate blocks.The current implementation duplicates the role condition across two separate
Showblocks. Use the supportedfallbackprop to eliminate the duplication:- <Show - client:load - when={{ role: 'org:admin' }} - > - <h1 class='text-2xl text-center'>I'm an admin</h1> - </Show> - - <Show - client:load - when={(has) => !has({ role: 'org:admin' })} - > - <h1 class='text-2xl text-center'>Not an admin</h1> - <a - class='text-sm text-center text-gray-100 transition hover:text-gray-400' - href='/only-members' - > - Go to Members Page - </a> - </Show> + <Show + client:load + when={{ role: 'org:admin' }} + fallback={ + <> + <h1 class='text-2xl text-center'>Not an admin</h1> + <a + class='text-sm text-center text-gray-100 transition hover:text-gray-400' + href='/only-members' + > + Go to Members Page + </a> + </> + } + > + <h1 class='text-2xl text-center'>I'm an admin</h1> + </Show>This eliminates the maintenance burden of keeping two opposite conditions in sync and avoids potential layout shifts from conditionally rendered blocks.
Likely an incorrect or invalid review comment.
integration/templates/astro-hybrid/src/pages/ssr.astro (1)
2-21: LGTM! Clean migration to Show component.The migration from
SignedIn/SignedOuttoShowis correct. TheisStatic={false}prop is appropriate for this SSR context (prerender = false), ensuring proper hydration behavior.integration/templates/astro-node/src/pages/react/index.astro (1)
5-72: LGTM! Correct React component migration.The migration correctly uses
Showwithclient:loadfor React components. The import from@clerk/astro/reactis appropriate for this context.integration/templates/astro-node/src/layouts/react/Layout.astro (1)
8-112: LGTM! Consistent React component usage.The migration correctly applies
client:loadto React components withinShowblocks. This matches the expected pattern for React integration in Astro.integration/templates/astro-node/src/pages/billing/checkout-btn.astro (1)
2-15: LGTM! Consistent Astro component migration.The migration correctly wraps the
CheckoutButtonwithShow. The lack ofclient:loadorisStaticattributes is consistent with other pure Astro component usage in this PR.integration/templates/astro-node/src/pages/react/only-members.astro (1)
8-26: Dual Show pattern correctly handles complementary conditions.The use of two separate
Showcomponents with complementary conditions (when={{ role: 'basic_member' }}andwhen={(has) => !has({ role: 'basic_member' })}) is correct. This demonstrates thatShowsupports object and function conditions in addition to string literals.Note: This usage confirms that the
ShowSSR.astroProps type may be too narrow (see comment on that file).integration/templates/astro-node/src/layouts/Layout.astro (1)
83-113: Show components correctly default to server-side rendering in this template.The
Showcomponents are correctly configured withoutisStaticorclient:loadattributes. Since the Astro config usesoutput: 'server', theShowcomponent automatically usesShowSSR(server-side rendering) when no explicitisStaticprop is provided. This is the appropriate behavior for wrapping pure Astro components likeCustomUserButton, which require no client-side hydration.packages/astro/src/astro-components/control/ShowSSR.astro (1)
2-4: Props type is intentionally limited to simple string conditions for Astro components.The
ShowSSR.astrocomponent (along withShow.astroandShowCSR.astro) only supports'signedIn' | 'signedOut'string literals. This is by design—the ReactShowcomponent incontrolComponents.tsximplements the fullShowWhenConditiontype (supporting object conditions like{ role: 'basic_member' }and function callbacks), but the Astro equivalents deliberately restrict to simple string conditions. No changes needed unless extending Astro Show to support the full authorization API is a planned feature.packages/astro/src/astro-components/index.ts (1)
4-6: The code is correct as-is.ShowandProtectserve different purposes and coexist without deprecation.Showhandles conditional rendering based on authentication state (signedIn|signedOut), whileProtectenforces role/permission-based access control. No deprecation warnings are needed, no migration guide is required, and no codemod is applicable since they address distinct use cases.Likely an incorrect or invalid review comment.
integration/templates/astro-node/src/pages/transitions/index.astro (1)
2-13: Template migration to<Show when=...>looks correct.integration/templates/astro-hybrid/src/pages/index.astro (1)
6-21: Verify<Show>behaves correctly onprerender = trueroutes (CSR vs SSR selection).If the page is prerendered but the app’s output is server, ensure
Showstill chooses the intended static/CSR behavior (or update template usage to passisStaticwhere required).integration/templates/astro-node/src/pages/index.astro (1)
5-21: Show-based conditional sections look consistent and correctly nested.Also applies to: 29-67
.changeset/show-the-guards.md (1)
1-11: Security caveat requirement cannot be verified; consider whether the suggested additions are truly mandatory.The changeset accurately describes introducing
<Show when={...}>and removing<Protect>,<SignedIn>, and<SignedOut>. However, no evidence of an explicit "objective requirement" for security messaging was found in the codebase, commit history, or accessible documentation.If security messaging is a documented requirement from the PR or linked issue, please reference it. Otherwise, the suggested wording additions may represent good UX/security practice but should not be framed as mandatory. The
@clerk/sharedminor bump also appears defensible if the type changes are additive.
| type Props = { | ||
| when: 'signedIn' | 'signedOut'; | ||
| isStatic?: boolean; | ||
| /** | ||
| * The class name to apply to the outermost element of the component. | ||
| * This class is only applied to static components. | ||
| */ | ||
| class?: string; | ||
| }; | ||
| const { when, isStatic, class: className } = Astro.props; | ||
| const ShowComponent = isStaticOutput(isStatic) ? ShowCSR : ShowSSR; | ||
| --- | ||
|
|
||
| <ShowComponent | ||
| when={when} | ||
| class={className} | ||
| > | ||
| <slot /> | ||
| </ShowComponent> |
There was a problem hiding this comment.
Align class prop behavior with docs (only apply it on static/CSR path).
const { when, isStatic, class: className } = Astro.props;
-const ShowComponent = isStaticOutput(isStatic) ? ShowCSR : ShowSSR;
+const isStaticResolved = isStaticOutput(isStatic);
+const ShowComponent = isStaticResolved ? ShowCSR : ShowSSR;
---
<ShowComponent
when={when}
- class={className}
+ {...(isStaticResolved ? { class: className } : {})}
>
<slot />
</ShowComponent>📝 Committable suggestion
‼️ IMPORTANT
Carefully review the code before committing. Ensure that it accurately replaces the highlighted code, contains no missing lines, and has no issues with indentation. Thoroughly test & benchmark the code to ensure it meets the requirements.
| type Props = { | |
| when: 'signedIn' | 'signedOut'; | |
| isStatic?: boolean; | |
| /** | |
| * The class name to apply to the outermost element of the component. | |
| * This class is only applied to static components. | |
| */ | |
| class?: string; | |
| }; | |
| const { when, isStatic, class: className } = Astro.props; | |
| const ShowComponent = isStaticOutput(isStatic) ? ShowCSR : ShowSSR; | |
| --- | |
| <ShowComponent | |
| when={when} | |
| class={className} | |
| > | |
| <slot /> | |
| </ShowComponent> | |
| type Props = { | |
| when: 'signedIn' | 'signedOut'; | |
| isStatic?: boolean; | |
| /** | |
| * The class name to apply to the outermost element of the component. | |
| * This class is only applied to static components. | |
| */ | |
| class?: string; | |
| }; | |
| const { when, isStatic, class: className } = Astro.props; | |
| const isStaticResolved = isStaticOutput(isStatic); | |
| const ShowComponent = isStaticResolved ? ShowCSR : ShowSSR; | |
| --- | |
| <ShowComponent | |
| when={when} | |
| {...(isStaticResolved ? { class: className } : {})} | |
| > | |
| <slot /> | |
| </ShowComponent> |
🤖 Prompt for AI Agents
In packages/astro/src/astro-components/control/Show.astro around lines 7 to 27,
the component always forwards the class prop to ShowComponent but the docs
require the class be applied only on the static/CSR path; update the JSX so the
class prop is only passed when isStaticOutput(isStatic) is truthy (i.e., pass
class={className} only for the ShowCSR/static branch or conditionally spread
it), leaving the SSR path without the class attribute.
There was a problem hiding this comment.
Actionable comments posted: 1
♻️ Duplicate comments (1)
packages/astro/src/astro-components/control/ShowCSR.astro (1)
48-50: Past review concern addressed: custom element registration is now properly guarded.The check for existing registration before calling
customElements.defineprevents runtime crashes when the<Show>component is used multiple times on a page. This resolves the critical issue flagged in the previous review.
📜 Review details
Configuration used: Path: .coderabbit.yaml
Review profile: CHILL
Plan: Pro
Disabled knowledge base sources:
- Linear integration is disabled by default for public repositories
You can enable these sources in your CodeRabbit configuration.
⛔ Files ignored due to path filters (1)
pnpm-lock.yamlis excluded by!**/pnpm-lock.yaml
📒 Files selected for processing (1)
packages/astro/src/astro-components/control/ShowCSR.astro(1 hunks)
⏰ Context from checks skipped due to timeout of 90000ms. You can increase the timeout in your CodeRabbit configuration to a maximum of 15 minutes (900000ms). (29)
- GitHub Check: Unit Tests (shared, clerk-js, RQ)
- GitHub Check: Unit Tests (**)
- GitHub Check: Publish with pkg-pr-new
- GitHub Check: Static analysis
- GitHub Check: Integration Tests (nextjs, chrome, 15)
- GitHub Check: Integration Tests (astro, chrome)
- GitHub Check: Integration Tests (sessions:staging, chrome)
- GitHub Check: Integration Tests (ap-flows, chrome)
- GitHub Check: Integration Tests (react-router, chrome)
- GitHub Check: Integration Tests (machine, chrome)
- GitHub Check: Integration Tests (nuxt, chrome)
- GitHub Check: Integration Tests (quickstart, chrome, 15)
- GitHub Check: Integration Tests (custom, chrome)
- GitHub Check: Integration Tests (billing, chrome, RQ)
- GitHub Check: Integration Tests (generic, chrome)
- GitHub Check: Integration Tests (vue, chrome)
- GitHub Check: Integration Tests (nextjs, chrome, 16)
- GitHub Check: Integration Tests (sessions, chrome)
- GitHub Check: Integration Tests (express, chrome)
- GitHub Check: Integration Tests (tanstack-react-start, chrome)
- GitHub Check: Integration Tests (quickstart, chrome, 16)
- GitHub Check: Integration Tests (handshake:staging, chrome)
- GitHub Check: Integration Tests (nextjs, chrome, 16, RQ)
- GitHub Check: Integration Tests (handshake, chrome)
- GitHub Check: Integration Tests (billing, chrome)
- GitHub Check: Integration Tests (machine, chrome, RQ)
- GitHub Check: Integration Tests (localhost, chrome)
- GitHub Check: Analyze (javascript-typescript)
- GitHub Check: semgrep-cloud-platform/scan
🔇 Additional comments (2)
packages/astro/src/astro-components/control/ShowCSR.astro (2)
1-16: LGTM! Clean props definition and template structure.The Props type is well-defined with appropriate literal types for
when, and the template correctly initializes the custom element with thehiddenattribute to prevent flash of content during hydration. The attribute forwarding and slot usage follow Astro best practices.
43-44: Good defensive fallback for unknown states.Hiding content by default when the
whenattribute has an unexpected value is the right approach for access control components. This ensures content is not inadvertently shown.
| protected onAuthStateChange(state: AuthState): void { | ||
| const when = this.getAttribute('when'); | ||
|
|
||
| if (when === 'signedIn') { | ||
| if (state.userId) { | ||
| this.removeAttribute('hidden'); | ||
| } else { | ||
| this.setAttribute('hidden', ''); | ||
| } | ||
| return; | ||
| } | ||
|
|
||
| if (when === 'signedOut') { | ||
| if (state.userId) { | ||
| this.setAttribute('hidden', ''); | ||
| } else { | ||
| this.removeAttribute('hidden'); | ||
| } | ||
| return; | ||
| } | ||
|
|
||
| // Unknown state; be conservative. | ||
| this.setAttribute('hidden', ''); | ||
| } |
There was a problem hiding this comment.
🧩 Analysis chain
🏁 Script executed:
rg "removeAttribute.*hidden|setAttribute.*hidden" -B2 -A2 | head -50Repository: clerk/javascript
Length of output: 3775
🌐 Web query:
Clerk authentication state loading userId falsy behavior astro
💡 Result:
Short answer: Clerk’s Astro client returns userId === undefined while Clerk is still loading, userId === null when signed out, and a string when signed in. Don’t treat any falsy check (if (!userId)) as enough — explicitly check for undefined (loading) vs null (signed out) or use isLoaded / isSignedIn from useAuth / $authStore. [1][3][4]
How to handle (concise examples)
-
Using $authStore (nanostores): check undefined vs null
- if (userId === undefined) { /* loading */ }
- else if (userId === null) { /* signed out */ }
- else { /* signed in, userId is string */ } [3][4]
-
Using useAuth():
- if (!isLoaded) return /* loading */
- if (!isSignedIn) return /* signed out */
- otherwise use userId. [2]
References
- $userStore / loading vs null behavior (Astro docs). [1]
- useAuth() (isLoaded / isSignedIn / userId). [2]
- $authStore examples showing userId === undefined vs null. [3]
- SDK/Astro overview referencing client stores. [4]
🏁 Script executed:
rg "onAuthStateChange\|AuthState" -A5 -B5 | head -100Repository: clerk/javascript
Length of output: 42
🏁 Script executed:
find . -type f \( -name "*.ts" -o -name "*.js" -o -name "*.astro" \) 2>/dev/null | wc -l && find . -type f \( -name "*.ts" -o -name "*.js" -o -name "*.astro" \) 2>/dev/null | head -20Repository: clerk/javascript
Length of output: 780
Add explicit loading state handling for when="signedOut".
The visibility logic cannot distinguish between a loading state (userId falsy due to unfinished auth initialization) and a signed-out state (userId null after auth is complete). For when="signedOut", if state.userId is falsy during the loading phase, removeAttribute('hidden') is called (line 38), potentially showing content before authentication finishes.
While the initial hidden attribute (line 13) provides partial protection, it assumes the component is rendered with this attribute set and that onAuthStateChange is not invoked until after session loading completes. Verify that:
- Clerk's
authStateStoresubscription only fires afterClerk.load()completes, or - Add an explicit loading state check (e.g., check for a
sessionIdor similar indicator inAuthStateto distinguish loading from signed-out), or - Defer visibility updates until auth is definitively loaded.
Same concern applies to SignedOutCSR.astro which has identical logic.
🤖 Prompt for AI Agents
In packages/astro/src/astro-components/control/ShowCSR.astro around lines 22 to
45, the when="signedOut" branch treats any falsy userId as signed-out and calls
removeAttribute('hidden'), which can expose content during auth loading; update
the handler to detect and respect an explicit "loading" indicator on AuthState
(e.g., sessionId, isLoaded, or a similar flag) and only
removeAttribute('hidden') for when="signedOut" if auth is fully initialized and
userId is null; if no such flag exists on AuthState, defer visibility changes
until Clerk.load() completes (or the authStateStore signals loaded) so that the
component stays hidden during the loading phase; apply the same change to
SignedOutCSR.astro which contains identical logic.
There was a problem hiding this comment.
Actionable comments posted: 1
📜 Review details
Configuration used: Repository YAML (base), Organization UI (inherited)
Review profile: CHILL
Plan: Pro
Disabled knowledge base sources:
- Linear integration is disabled by default for public repositories
You can enable these sources in your CodeRabbit configuration.
📒 Files selected for processing (12)
packages/astro/src/astro-components/control/Protect.astro(0 hunks)packages/astro/src/astro-components/control/ProtectCSR.astro(0 hunks)packages/astro/src/astro-components/control/ProtectSSR.astro(0 hunks)packages/astro/src/astro-components/control/SignedIn.astro(0 hunks)packages/astro/src/astro-components/control/SignedInCSR.astro(0 hunks)packages/astro/src/astro-components/control/SignedInSSR.astro(0 hunks)packages/astro/src/astro-components/control/SignedOut.astro(0 hunks)packages/astro/src/astro-components/control/SignedOutCSR.astro(0 hunks)packages/astro/src/astro-components/control/SignedOutSSR.astro(0 hunks)packages/astro/src/types.ts(2 hunks)packages/shared/src/types/authorization.ts(1 hunks)packages/shared/src/types/index.ts(1 hunks)
💤 Files with no reviewable changes (9)
- packages/astro/src/astro-components/control/SignedOutSSR.astro
- packages/astro/src/astro-components/control/SignedIn.astro
- packages/astro/src/astro-components/control/ProtectCSR.astro
- packages/astro/src/astro-components/control/SignedInCSR.astro
- packages/astro/src/astro-components/control/Protect.astro
- packages/astro/src/astro-components/control/SignedInSSR.astro
- packages/astro/src/astro-components/control/ProtectSSR.astro
- packages/astro/src/astro-components/control/SignedOutCSR.astro
- packages/astro/src/astro-components/control/SignedOut.astro
🧰 Additional context used
📓 Path-based instructions (11)
**/*.{js,jsx,ts,tsx}
📄 CodeRabbit inference engine (.cursor/rules/development.mdc)
All code must pass ESLint checks with the project's configuration
Files:
packages/shared/src/types/index.tspackages/astro/src/types.tspackages/shared/src/types/authorization.ts
**/*.{js,jsx,ts,tsx,json,md,yml,yaml}
📄 CodeRabbit inference engine (.cursor/rules/development.mdc)
Use Prettier for consistent code formatting
Files:
packages/shared/src/types/index.tspackages/astro/src/types.tspackages/shared/src/types/authorization.ts
packages/**/src/**/*.{ts,tsx}
📄 CodeRabbit inference engine (.cursor/rules/development.mdc)
TypeScript is required for all packages
Files:
packages/shared/src/types/index.tspackages/astro/src/types.tspackages/shared/src/types/authorization.ts
**/*.{ts,tsx,js,jsx}
📄 CodeRabbit inference engine (.cursor/rules/development.mdc)
Follow established naming conventions (PascalCase for components, camelCase for variables)
Files:
packages/shared/src/types/index.tspackages/astro/src/types.tspackages/shared/src/types/authorization.ts
packages/**/src/**/*.{ts,tsx,js,jsx}
📄 CodeRabbit inference engine (.cursor/rules/development.mdc)
packages/**/src/**/*.{ts,tsx,js,jsx}: Maintain comprehensive JSDoc comments for public APIs
Use tree-shaking friendly exports
Validate all inputs and sanitize outputs
All public APIs must be documented with JSDoc
Use dynamic imports for optional features
Provide meaningful error messages to developers
Include error recovery suggestions where applicable
Log errors appropriately for debugging
Lazy load components and features when possible
Implement proper caching strategies
Use efficient data structures and algorithms
Implement proper logging with different levels
Files:
packages/shared/src/types/index.tspackages/astro/src/types.tspackages/shared/src/types/authorization.ts
**/*.ts?(x)
📄 CodeRabbit inference engine (.cursor/rules/development.mdc)
Use proper TypeScript error types
Files:
packages/shared/src/types/index.tspackages/astro/src/types.tspackages/shared/src/types/authorization.ts
**/*.{ts,tsx}
📄 CodeRabbit inference engine (.cursor/rules/typescript.mdc)
**/*.{ts,tsx}: Always define explicit return types for functions, especially public APIs
Use proper type annotations for variables and parameters where inference isn't clear
Avoidanytype - preferunknownwhen type is uncertain, then narrow with type guards
Implement type guards forunknowntypes using the patternfunction isType(value: unknown): value is Type
Useinterfacefor object shapes that might be extended
Usetypefor unions, primitives, and computed types
Preferreadonlyproperties for immutable data structures
Useprivatefor internal implementation details in classes
Useprotectedfor inheritance hierarchies
Usepublicexplicitly for clarity in public APIs
Use mixins for shared behavior across unrelated classes in TypeScript
Use generic constraints with bounded type parameters like<T extends { id: string }>
Use utility types likeOmit,Partial, andPickfor data transformation instead of manual type construction
Use discriminated unions instead of boolean flags for state management and API responses
Use mapped types for transforming object types
Use conditional types for type-level logic
Leverage template literal types for string manipulation at the type level
Use ES6 imports/exports consistently
Use default exports sparingly, prefer named exports
Document functions with JSDoc comments including @param, @returns, @throws, and @example tags
Create custom error classes that extend Error for specific error types
Use the Result pattern for error handling instead of throwing exceptions
Use optional chaining (?.) and nullish coalescing (??) operators for safe property access
Let TypeScript infer obvious types to reduce verbosity
Useconst assertionswithas constfor literal types
Usesatisfiesoperator for type checking without widening types
Declare readonly arrays and objects for immutable data structures
Use spread operator and array spread for immutable updates instead of mutations
Use lazy loading for large types...
Files:
packages/shared/src/types/index.tspackages/astro/src/types.tspackages/shared/src/types/authorization.ts
**/index.ts
📄 CodeRabbit inference engine (.cursor/rules/typescript.mdc)
Avoid barrel files (index.ts re-exports) as they can cause circular dependencies
Files:
packages/shared/src/types/index.ts
**/*.{js,ts,jsx,tsx}
📄 CodeRabbit inference engine (.cursor/rules/monorepo.mdc)
Use ESLint with custom configurations tailored for different package types
Files:
packages/shared/src/types/index.tspackages/astro/src/types.tspackages/shared/src/types/authorization.ts
**/*.{js,ts,jsx,tsx,json,md,yml,yaml}
📄 CodeRabbit inference engine (.cursor/rules/monorepo.mdc)
Use Prettier for code formatting across all packages
Files:
packages/shared/src/types/index.tspackages/astro/src/types.tspackages/shared/src/types/authorization.ts
**/*
⚙️ CodeRabbit configuration file
If there are no tests added or modified as part of the PR, please suggest that tests be added to cover the changes.
**/*: Only comment on issues that would block merging, ignore minor or stylistic concerns.
Restrict feedback to errors, security risks, or functionality-breaking problems.
Do not post comments on code style, formatting, or non-critical improvements.
Keep reviews short: flag only issues that make the PR unsafe to merge.
Group similar issues into a single comment instead of posting multiple notes.
Skip repetition: if a pattern repeats, mention it once at a summary level only.
Do not add general suggestions, focus strictly on merge-blocking concerns.
If there are no critical problems, respond with minimal approval (e.g., 'Looks good'). Do not add additional review.
Avoid line-by-line commentary unless it highlights a critical bug or security hole.
Highlight only issues that could cause runtime errors, data loss, or severe maintainability issues.
Ignore minor optimization opportunities, focus solely on correctness and safety.
Provide a top-level summary of critical blockers rather than detailed per-line notes.
Comment only when the issue must be resolved before merge, otherwise remain silent.
When in doubt, err on the side of fewer comments, brevity and blocking issues only.
Avoid posting any refactoring issues.
Files:
packages/shared/src/types/index.tspackages/astro/src/types.tspackages/shared/src/types/authorization.ts
⏰ Context from checks skipped due to timeout of 90000ms. You can increase the timeout in your CodeRabbit configuration to a maximum of 15 minutes (900000ms). (29)
- GitHub Check: Static analysis
- GitHub Check: Unit Tests (**)
- GitHub Check: Unit Tests (shared, clerk-js, RQ)
- GitHub Check: Publish with pkg-pr-new
- GitHub Check: Integration Tests (tanstack-react-start, chrome)
- GitHub Check: Integration Tests (billing, chrome, RQ)
- GitHub Check: Integration Tests (machine, chrome, RQ)
- GitHub Check: Integration Tests (nuxt, chrome)
- GitHub Check: Integration Tests (astro, chrome)
- GitHub Check: Integration Tests (nextjs, chrome, 16)
- GitHub Check: Integration Tests (billing, chrome)
- GitHub Check: Integration Tests (quickstart, chrome, 16)
- GitHub Check: Integration Tests (nextjs, chrome, 16, RQ)
- GitHub Check: Integration Tests (custom, chrome)
- GitHub Check: Integration Tests (vue, chrome)
- GitHub Check: Integration Tests (quickstart, chrome, 15)
- GitHub Check: Integration Tests (handshake, chrome)
- GitHub Check: Integration Tests (handshake:staging, chrome)
- GitHub Check: Integration Tests (nextjs, chrome, 15)
- GitHub Check: Integration Tests (machine, chrome)
- GitHub Check: Integration Tests (react-router, chrome)
- GitHub Check: Integration Tests (ap-flows, chrome)
- GitHub Check: Integration Tests (generic, chrome)
- GitHub Check: Integration Tests (sessions:staging, chrome)
- GitHub Check: Integration Tests (localhost, chrome)
- GitHub Check: Integration Tests (sessions, chrome)
- GitHub Check: Integration Tests (express, chrome)
- GitHub Check: Analyze (javascript-typescript)
- GitHub Check: semgrep-cloud-platform/scan
🔇 Additional comments (1)
packages/shared/src/types/authorization.ts (1)
1-89: Add tests for new public API types.No test files were included for these new public types. Tests should verify:
- Each ProtectParams variant accepts valid inputs and rejects invalid combinations
- ShowWhenCondition accepts all documented options
- Type narrowing works correctly for discriminated union variants
Description
Fixes: USER-3389
Checklist
pnpm testruns as expected.pnpm buildruns as expected.Type of change
Summary by CodeRabbit
New Features
Breaking / API Changes
Chores
Tests
✏️ Tip: You can customize this high-level summary in your review settings.