feat(backend): WIP M2M Tokens #6229
Conversation
🦋 Changeset detectedLatest commit: c1d1ae2 The changes in this PR will be included in the next version bump. This PR includes changesets to release 11 packages
Not sure what this means? Click here to learn what changesets are. Click here if you're a maintainer who wants to add another changeset to this PR |
|
The latest updates on your projects. Learn more about Vercel for Git ↗︎
|
wobsoriano
force-pushed
the
rob/user-2264-m2m
branch
from
06c8514 to
af6a27b
Compare
📝 WalkthroughWalkthroughThis change introduces new functionality for managing "machines" and machine-to-machine (M2M) tokens in the backend package. It adds a new Suggested reviewers
📜 Recent review detailsConfiguration used: CodeRabbit UI 📒 Files selected for processing (1)
🚧 Files skipped from review as they are similar to previous changes (1)
⏰ Context from checks skipped due to timeout of 90000ms. You can increase the timeout in your CodeRabbit configuration to a maximum of 15 minutes (900000ms). (5)
🪧 TipsChatThere are 3 ways to chat with CodeRabbit:
SupportNeed help? Create a ticket on our support page for assistance with any issues or questions. Note: Be mindful of the bot's finite context window. It's strongly recommended to break down tasks such as reading entire modules into smaller chunks. For a focused discussion, use review comments to chat about specific files and their changes, instead of using the PR comments. CodeRabbit Commands (Invoked using PR comments)
Other keywords and placeholders
CodeRabbit Configuration File (
|
@clerk/agent-toolkit
@clerk/astro
@clerk/backend
@clerk/chrome-extension
@clerk/clerk-js
@clerk/dev-cli
@clerk/elements
@clerk/clerk-expo
@clerk/expo-passkeys
@clerk/express
@clerk/fastify
@clerk/localizations
@clerk/nextjs
@clerk/nuxt
@clerk/clerk-react
@clerk/react-router
@clerk/remix
@clerk/shared
@clerk/tanstack-react-start
@clerk/testing
@clerk/themes
@clerk/types
@clerk/upgrade
@clerk/vue
commit: |
![coderabbitai[bot]](https://avatars.githubusercontent.com/in/347564?s=60&v=4){kind=small}
There was a problem hiding this comment.
Actionable comments posted: 2
📜 Review details
Configuration used: CodeRabbit UI
Review profile: CHILL
Plan: Pro
📒 Files selected for processing (4)
.changeset/hot-tables-worry.md(1 hunks)packages/backend/src/api/endpoints/MachineTokensApi.ts(1 hunks)packages/backend/src/api/factory.ts(1 hunks)packages/backend/src/api/request.ts(1 hunks)
🧰 Additional context used
📓 Path-based instructions (5)
`**/*.{js,jsx,ts,tsx}`: All code must pass ESLint checks with the project's conf...
**/*.{js,jsx,ts,tsx}: All code must pass ESLint checks with the project's configuration
Use Prettier for consistent code formatting
Follow established naming conventions (PascalCase for components, camelCase for variables)
Maintain comprehensive JSDoc comments for public APIs
Use dynamic imports for optional features
All public APIs must be documented with JSDoc
Lazy load components and features when possible
Implement proper caching strategies
Use efficient data structures and algorithms
Validate all inputs and sanitize outputs
Implement proper logging with different levels
📄 Source: CodeRabbit Inference Engine (.cursor/rules/development.mdc)
List of files the instruction was applied to:
packages/backend/src/api/request.tspackages/backend/src/api/factory.tspackages/backend/src/api/endpoints/MachineTokensApi.ts
`packages/**/*.ts`: TypeScript is required for all packages
packages/**/*.ts: TypeScript is required for all packages
📄 Source: CodeRabbit Inference Engine (.cursor/rules/development.mdc)
List of files the instruction was applied to:
packages/backend/src/api/request.tspackages/backend/src/api/factory.tspackages/backend/src/api/endpoints/MachineTokensApi.ts
`packages/**/*.{ts,tsx,d.ts}`: Packages should export TypeScript types alongside runtime code
packages/**/*.{ts,tsx,d.ts}: Packages should export TypeScript types alongside runtime code
📄 Source: CodeRabbit Inference Engine (.cursor/rules/development.mdc)
List of files the instruction was applied to:
packages/backend/src/api/request.tspackages/backend/src/api/factory.tspackages/backend/src/api/endpoints/MachineTokensApi.ts
`**/*.{ts,tsx}`: Use proper TypeScript error types
**/*.{ts,tsx}: Use proper TypeScript error types
📄 Source: CodeRabbit Inference Engine (.cursor/rules/development.mdc)
List of files the instruction was applied to:
packages/backend/src/api/request.tspackages/backend/src/api/factory.tspackages/backend/src/api/endpoints/MachineTokensApi.ts
`**/*.{ts,tsx}`: Always define explicit return types for functions, especially p...
**/*.{ts,tsx}: Always define explicit return types for functions, especially public APIs
Use proper type annotations for variables and parameters where inference isn't clear
Avoidanytype - preferunknownwhen type is uncertain, then narrow with type guards
Useinterfacefor object shapes that might be extended
Usetypefor unions, primitives, and computed types
Preferreadonlyproperties for immutable data structures
Useprivatefor internal implementation details
Useprotectedfor inheritance hierarchies
Usepublicexplicitly for clarity in public APIs
Preferreadonlyfor properties that shouldn't change after construction
Use mapped types for transforming object types
Use conditional types for type-level logic
Leverage template literal types for string manipulation
Use ES6 imports/exports consistently
Use default exports sparingly, prefer named exports
Document public functions and APIs with JSDoc-style comments including @param, @returns, @throws, and @example
Define custom error classes for domain-specific errors
Use the Result pattern for error handling instead of throwing exceptions
Use optional chaining and nullish coalescing for safe property access
Let TypeScript infer types when types are obvious
Useconst assertionsfor literal types:as const
Usesatisfiesoperator for type checking without widening
Use readonly arrays and objects for immutability
Use immutable update patterns (spread, etc.) for objects and arrays
Use lazy loading for large types
Preferunknownoveranyfor performance
Use type-only imports:import type { ... }
Use branded types for domain safety
Noanytypes without justification
Proper error handling with typed errors
Consistent use ofreadonlyfor immutable data
Proper generic constraints in TypeScript generics
No unused type parameters in generics
Proper use of utility types instead of manual type construction
Type-only imports where possible for performance
Proper tree-shaking friendly exports
No circular dependencies
Efficient type computations (avoid deep recursion)
📄 Source: CodeRabbit Inference Engine (.cursor/rules/typescript.mdc)
List of files the instruction was applied to:
packages/backend/src/api/request.tspackages/backend/src/api/factory.tspackages/backend/src/api/endpoints/MachineTokensApi.ts
🧠 Learnings (5)
📓 Common learnings
Learnt from: dstaley
PR: clerk/javascript#6116
File: .changeset/tangy-garlics-say.md:1-2
Timestamp: 2025-06-13T16:09:53.061Z
Learning: In the Clerk JavaScript repository, contributors create intentionally empty changeset files (containing only the YAML delimiters) when a PR touches only non-published parts of the codebase (e.g., sandbox assets). This signals that no package release is required, so such changesets should not be flagged as missing content.
Learnt from: wobsoriano
PR: clerk/javascript#6099
File: packages/backend/src/api/endpoints/IdPOAuthAccessTokenApi.ts:7-14
Timestamp: 2025-06-10T20:38:08.982Z
Learning: Methods in `packages/backend/src/api/endpoints` (e.g., `IdPOAuthAccessTokenApi.verifySecret`) are currently not exposed publicly, so renaming them does not constitute a breaking change.
Learnt from: CR
PR: clerk/javascript#0
File: .cursor/rules/development.mdc:0-0
Timestamp: 2025-06-30T10:29:42.997Z
Learning: Update documentation for API changes
Learnt from: wobsoriano
PR: clerk/javascript#6163
File: packages/backend/src/api/endpoints/APIKeysApi.ts:60-70
Timestamp: 2025-06-20T17:44:17.570Z
Learning: The Clerk codebase uses POST method for API key update operations instead of the typical PATCH method, as clarified by the maintainer wobsoriano.
packages/backend/src/api/request.ts (1)
Learnt from: wobsoriano
PR: clerk/javascript#6099
File: packages/backend/src/api/endpoints/IdPOAuthAccessTokenApi.ts:7-14
Timestamp: 2025-06-10T20:38:08.982Z
Learning: Methods in `packages/backend/src/api/endpoints` (e.g., `IdPOAuthAccessTokenApi.verifySecret`) are currently not exposed publicly, so renaming them does not constitute a breaking change.
.changeset/hot-tables-worry.md (4)
Learnt from: dstaley
PR: clerk/javascript#6116
File: .changeset/tangy-garlics-say.md:1-2
Timestamp: 2025-06-13T16:09:53.061Z
Learning: In the Clerk JavaScript repository, contributors create intentionally empty changeset files (containing only the YAML delimiters) when a PR touches only non-published parts of the codebase (e.g., sandbox assets). This signals that no package release is required, so such changesets should not be flagged as missing content.
Learnt from: CR
PR: clerk/javascript#0
File: .cursor/rules/monorepo.mdc:0-0
Timestamp: 2025-06-30T10:30:56.197Z
Learning: Applies to .changeset/config.json : Automated releases must be managed with Changesets.
Learnt from: CR
PR: clerk/javascript#0
File: .cursor/rules/development.mdc:0-0
Timestamp: 2025-06-30T10:29:42.997Z
Learning: Use Changesets for version management and changelogs
Learnt from: jacekradko
PR: clerk/javascript#5905
File: .changeset/six-ears-wash.md:1-3
Timestamp: 2025-06-26T03:27:05.535Z
Learning: In the Clerk JavaScript repository, changeset headers support single quotes syntax (e.g., '@clerk/backend': minor) and work fine with their current changesets integration, so there's no need to change them to double quotes.
packages/backend/src/api/factory.ts (1)
Learnt from: wobsoriano
PR: clerk/javascript#6099
File: packages/backend/src/api/endpoints/IdPOAuthAccessTokenApi.ts:7-14
Timestamp: 2025-06-10T20:38:08.982Z
Learning: Methods in `packages/backend/src/api/endpoints` (e.g., `IdPOAuthAccessTokenApi.verifySecret`) are currently not exposed publicly, so renaming them does not constitute a breaking change.
packages/backend/src/api/endpoints/MachineTokensApi.ts (3)
Learnt from: wobsoriano
PR: clerk/javascript#6099
File: packages/backend/src/api/endpoints/IdPOAuthAccessTokenApi.ts:7-14
Timestamp: 2025-06-10T20:38:08.982Z
Learning: Methods in `packages/backend/src/api/endpoints` (e.g., `IdPOAuthAccessTokenApi.verifySecret`) are currently not exposed publicly, so renaming them does not constitute a breaking change.
Learnt from: CR
PR: clerk/javascript#0
File: .cursor/rules/development.mdc:0-0
Timestamp: 2025-06-30T10:29:42.997Z
Learning: Update documentation for API changes
Learnt from: wobsoriano
PR: clerk/javascript#5858
File: packages/clerk-js/src/core/modules/apiKeys/index.ts:84-97
Timestamp: 2025-06-10T17:35:08.986Z
Learning: In the APIKeys service methods (packages/clerk-js/src/core/modules/apiKeys/index.ts), error handling is intentionally delegated to the component level rather than being implemented within the service methods themselves. This architectural pattern allows calling components to handle errors according to their specific UI needs.
⏰ Context from checks skipped due to timeout of 90000ms (24)
- GitHub Check: Integration Tests (nextjs, chrome, 14)
- GitHub Check: Integration Tests (billing, chrome)
- GitHub Check: Integration Tests (nextjs, chrome, 15)
- GitHub Check: Integration Tests (tanstack-react-router, chrome)
- GitHub Check: Integration Tests (tanstack-react-start, chrome)
- GitHub Check: Integration Tests (nextjs, chrome, 13)
- GitHub Check: Integration Tests (react-router, chrome)
- GitHub Check: Integration Tests (nuxt, chrome)
- GitHub Check: Integration Tests (vue, chrome)
- GitHub Check: Integration Tests (localhost, chrome)
- GitHub Check: Integration Tests (quickstart, chrome)
- GitHub Check: Integration Tests (expo-web, chrome)
- GitHub Check: Integration Tests (express, chrome)
- GitHub Check: Integration Tests (ap-flows, chrome)
- GitHub Check: Integration Tests (astro, chrome)
- GitHub Check: Integration Tests (sessions, chrome)
- GitHub Check: Integration Tests (elements, chrome)
- GitHub Check: Integration Tests (generic, chrome)
- GitHub Check: Publish with pkg-pr-new
- GitHub Check: Unit Tests (18, --filter=@clerk/astro --filter=@clerk/backend --filter=@clerk/express --filter=@c...
- GitHub Check: Unit Tests (22, **)
- GitHub Check: Static analysis
- GitHub Check: semgrep-cloud-platform/scan
- GitHub Check: Analyze (javascript-typescript)
🔇 Additional comments (5)
.changeset/hot-tables-worry.md (1)
1-6: LGTM! Changeset correctly specifies minor version bump.The changeset is properly formatted and appropriately specifies a minor version bump for the new M2M tokens functionality.
packages/backend/src/api/request.ts (1)
111-113: LGTM! Prevents overwriting existing Authorization headers.This change correctly prevents the default
secretKeyfrom overwriting an existingAuthorizationheader, enabling the new M2M token functionality where methods can set their own authorization headers.packages/backend/src/api/factory.ts (1)
71-71: LGTM! Correctly configures MachineTokensApi to not require secret key.This configuration allows M2M token operations to use their own authorization mechanism via
machineTokenSecretinstead of requiring the global secret key.packages/backend/src/api/endpoints/MachineTokensApi.ts (2)
8-29: LGTM! Well-designed type definitions following TypeScript best practices.The utility type
WithMachineTokenSecret<T>provides good reusability, and the parameter types are properly structured with clear field definitions.
63-63: LGTM! Proper ID validation using inherited requireId method.Both
updateandrevokemethods correctly validate them2mTokenIdparameter using the inheritedrequireIdmethod before proceeding with the request.Also applies to: 78-78
There was a problem hiding this comment.
Actionable comments posted: 2
🧹 Nitpick comments (5)
packages/backend/src/api/endpoints/MachineTokensApi.ts (4)
54-66: Add explicit return type for better TypeScript compliance.The method correctly implements the new parameter object pattern, but coding guidelines require explicit return types for public API functions.
- async create(params: CreateMachineTokenParams) { + async create(params: CreateMachineTokenParams): Promise<MachineToken> {
68-81: Add explicit return type for consistency.The method correctly implements parameter validation and the new parameter object pattern.
- async update(params: UpdateMachineTokenParams) { + async update(params: UpdateMachineTokenParams): Promise<MachineToken> {
83-96: Add explicit return type for consistency.The method correctly implements parameter validation and the new parameter object pattern.
- async revoke(params: RevokeMachineTokenParams) { + async revoke(params: RevokeMachineTokenParams): Promise<MachineToken> {
98-110: Add explicit return type for consistency.The method correctly implements the new parameter object pattern and maintains backward compatibility while adding machine secret support.
- async verifySecret(params: VerifyMachineTokenParams) { + async verifySecret(params: VerifyMachineTokenParams): Promise<MachineToken> {packages/backend/src/api/endpoints/MachineApi.ts (1)
28-69: Add explicit return types for all public API methods.The methods correctly implement REST patterns and use appropriate HTTP methods with proper parameter validation. However, coding guidelines require explicit return types for public API functions.
- async list(queryParams: GetMachineListParams = {}) { + async list(queryParams: GetMachineListParams = {}): Promise<PaginatedResourceResponse<Machine[]>> { return this.request<PaginatedResourceResponse<Machine[]>>({ - async create(bodyParams: CreateMachineParams) { + async create(bodyParams: CreateMachineParams): Promise<Machine> { return this.request<Machine>({ - async update(params: UpdateMachineParams) { + async update(params: UpdateMachineParams): Promise<Machine> { const { machineId, ...bodyParams } = params; - async delete(params: DeleteMachineParams) { + async delete(params: DeleteMachineParams): Promise<Machine> { const { machineId } = params; - async get(machineId: string) { + async get(machineId: string): Promise<Machine> { this.requireId(machineId);
📜 Review details
Configuration used: CodeRabbit UI
Review profile: CHILL
Plan: Pro
📒 Files selected for processing (9)
packages/backend/src/api/endpoints/MachineApi.ts(1 hunks)packages/backend/src/api/endpoints/MachineTokensApi.ts(1 hunks)packages/backend/src/api/endpoints/index.ts(1 hunks)packages/backend/src/api/factory.ts(2 hunks)packages/backend/src/api/resources/Deserializer.ts(2 hunks)packages/backend/src/api/resources/JSON.ts(2 hunks)packages/backend/src/api/resources/Machine.ts(1 hunks)packages/backend/src/api/resources/MachineToken.ts(2 hunks)packages/backend/src/api/resources/index.ts(1 hunks)
✅ Files skipped from review due to trivial changes (2)
- packages/backend/src/api/resources/index.ts
- packages/backend/src/api/endpoints/index.ts
🚧 Files skipped from review as they are similar to previous changes (3)
- packages/backend/src/api/factory.ts
- packages/backend/src/api/resources/MachineToken.ts
- packages/backend/src/api/resources/JSON.ts
🧰 Additional context used
📓 Path-based instructions (6)
`**/*.{js,jsx,ts,tsx}`: All code must pass ESLint checks with the project's conf...
**/*.{js,jsx,ts,tsx}: All code must pass ESLint checks with the project's configuration
Use Prettier for consistent code formatting
Follow established naming conventions (PascalCase for components, camelCase for variables)
Maintain comprehensive JSDoc comments for public APIs
Use dynamic imports for optional features
All public APIs must be documented with JSDoc
Lazy load components and features when possible
Implement proper caching strategies
Use efficient data structures and algorithms
Validate all inputs and sanitize outputs
Implement proper logging with different levels
📄 Source: CodeRabbit Inference Engine (.cursor/rules/development.mdc)
List of files the instruction was applied to:
packages/backend/src/api/resources/Machine.tspackages/backend/src/api/resources/Deserializer.tspackages/backend/src/api/endpoints/MachineTokensApi.tspackages/backend/src/api/endpoints/MachineApi.ts
`packages/**/*.ts`: TypeScript is required for all packages
packages/**/*.ts: TypeScript is required for all packages
📄 Source: CodeRabbit Inference Engine (.cursor/rules/development.mdc)
List of files the instruction was applied to:
packages/backend/src/api/resources/Machine.tspackages/backend/src/api/resources/Deserializer.tspackages/backend/src/api/endpoints/MachineTokensApi.tspackages/backend/src/api/endpoints/MachineApi.ts
`packages/**/*.{ts,tsx,d.ts}`: Packages should export TypeScript types alongside runtime code
packages/**/*.{ts,tsx,d.ts}: Packages should export TypeScript types alongside runtime code
📄 Source: CodeRabbit Inference Engine (.cursor/rules/development.mdc)
List of files the instruction was applied to:
packages/backend/src/api/resources/Machine.tspackages/backend/src/api/resources/Deserializer.tspackages/backend/src/api/endpoints/MachineTokensApi.tspackages/backend/src/api/endpoints/MachineApi.ts
`**/*.{ts,tsx}`: Use proper TypeScript error types
**/*.{ts,tsx}: Use proper TypeScript error types
📄 Source: CodeRabbit Inference Engine (.cursor/rules/development.mdc)
List of files the instruction was applied to:
packages/backend/src/api/resources/Machine.tspackages/backend/src/api/resources/Deserializer.tspackages/backend/src/api/endpoints/MachineTokensApi.tspackages/backend/src/api/endpoints/MachineApi.ts
`**/*.{ts,tsx}`: Always define explicit return types for functions, especially p...
**/*.{ts,tsx}: Always define explicit return types for functions, especially public APIs
Use proper type annotations for variables and parameters where inference isn't clear
Avoidanytype - preferunknownwhen type is uncertain, then narrow with type guards
Useinterfacefor object shapes that might be extended
Usetypefor unions, primitives, and computed types
Preferreadonlyproperties for immutable data structures
Useprivatefor internal implementation details
Useprotectedfor inheritance hierarchies
Usepublicexplicitly for clarity in public APIs
Preferreadonlyfor properties that shouldn't change after construction
Use mapped types for transforming object types
Use conditional types for type-level logic
Leverage template literal types for string manipulation
Use ES6 imports/exports consistently
Use default exports sparingly, prefer named exports
Document public functions and APIs with JSDoc-style comments including @param, @returns, @throws, and @example
Define custom error classes for domain-specific errors
Use the Result pattern for error handling instead of throwing exceptions
Use optional chaining and nullish coalescing for safe property access
Let TypeScript infer types when types are obvious
Useconst assertionsfor literal types:as const
Usesatisfiesoperator for type checking without widening
Use readonly arrays and objects for immutability
Use immutable update patterns (spread, etc.) for objects and arrays
Use lazy loading for large types
Preferunknownoveranyfor performance
Use type-only imports:import type { ... }
Use branded types for domain safety
Noanytypes without justification
Proper error handling with typed errors
Consistent use ofreadonlyfor immutable data
Proper generic constraints in TypeScript generics
No unused type parameters in generics
Proper use of utility types instead of manual type construction
Type-only imports where possible for performance
Proper tree-shaking friendly exports
No circular dependencies
Efficient type computations (avoid deep recursion)
📄 Source: CodeRabbit Inference Engine (.cursor/rules/typescript.mdc)
List of files the instruction was applied to:
packages/backend/src/api/resources/Machine.tspackages/backend/src/api/resources/Deserializer.tspackages/backend/src/api/endpoints/MachineTokensApi.tspackages/backend/src/api/endpoints/MachineApi.ts
`**/*.ts`: If there are no tests added or modified as part of the PR, please suggest that tests be added to cover the changes.
**/*.ts: If there are no tests added or modified as part of the PR, please suggest that tests be added to cover the changes.
⚙️ Source: CodeRabbit Configuration File
List of files the instruction was applied to:
packages/backend/src/api/resources/Machine.tspackages/backend/src/api/resources/Deserializer.tspackages/backend/src/api/endpoints/MachineTokensApi.tspackages/backend/src/api/endpoints/MachineApi.ts
🧠 Learnings (5)
📓 Common learnings
Learnt from: wobsoriano
PR: clerk/javascript#6229
File: packages/backend/src/api/endpoints/MachineTokensApi.ts:47-89
Timestamp: 2025-07-01T15:20:41.834Z
Learning: In the Clerk JavaScript repository, for the MachineTokensApi class (packages/backend/src/api/endpoints/MachineTokensApi.ts), the maintainers prefer to rely on TypeScript types and readable property names for API documentation rather than JSDoc comments.
Learnt from: dstaley
PR: clerk/javascript#6116
File: .changeset/tangy-garlics-say.md:1-2
Timestamp: 2025-06-13T16:09:53.061Z
Learning: In the Clerk JavaScript repository, contributors create intentionally empty changeset files (containing only the YAML delimiters) when a PR touches only non-published parts of the codebase (e.g., sandbox assets). This signals that no package release is required, so such changesets should not be flagged as missing content.
Learnt from: wobsoriano
PR: clerk/javascript#6229
File: packages/backend/src/api/endpoints/MachineTokensApi.ts:32-45
Timestamp: 2025-07-01T15:20:59.456Z
Learning: In the MachineTokensApi class (packages/backend/src/api/endpoints/MachineTokensApi.ts), the #withMachineTokenSecretHeader method intentionally overwrites the entire headerParams object with only the Authorization header when machineTokenSecret is provided, rather than merging with existing headers. This is by design to ensure only the Authorization header is present in requests.
Learnt from: wobsoriano
PR: clerk/javascript#6099
File: packages/backend/src/api/endpoints/IdPOAuthAccessTokenApi.ts:7-14
Timestamp: 2025-06-10T20:38:08.982Z
Learning: Methods in `packages/backend/src/api/endpoints` (e.g., `IdPOAuthAccessTokenApi.verifySecret`) are currently not exposed publicly, so renaming them does not constitute a breaking change.
Learnt from: CR
PR: clerk/javascript#0
File: .cursor/rules/development.mdc:0-0
Timestamp: 2025-06-30T10:29:42.997Z
Learning: Update documentation for API changes
packages/backend/src/api/resources/Machine.ts (2)
Learnt from: wobsoriano
PR: clerk/javascript#6229
File: packages/backend/src/api/endpoints/MachineTokensApi.ts:47-89
Timestamp: 2025-07-01T15:20:41.834Z
Learning: In the Clerk JavaScript repository, for the MachineTokensApi class (packages/backend/src/api/endpoints/MachineTokensApi.ts), the maintainers prefer to rely on TypeScript types and readable property names for API documentation rather than JSDoc comments.
Learnt from: wobsoriano
PR: clerk/javascript#6229
File: packages/backend/src/api/endpoints/MachineTokensApi.ts:32-45
Timestamp: 2025-07-01T15:20:59.456Z
Learning: In the MachineTokensApi class (packages/backend/src/api/endpoints/MachineTokensApi.ts), the #withMachineTokenSecretHeader method intentionally overwrites the entire headerParams object with only the Authorization header when machineTokenSecret is provided, rather than merging with existing headers. This is by design to ensure only the Authorization header is present in requests.
packages/backend/src/api/resources/Deserializer.ts (1)
Learnt from: wobsoriano
PR: clerk/javascript#6229
File: packages/backend/src/api/endpoints/MachineTokensApi.ts:47-89
Timestamp: 2025-07-01T15:20:41.834Z
Learning: In the Clerk JavaScript repository, for the MachineTokensApi class (packages/backend/src/api/endpoints/MachineTokensApi.ts), the maintainers prefer to rely on TypeScript types and readable property names for API documentation rather than JSDoc comments.
packages/backend/src/api/endpoints/MachineTokensApi.ts (27)
Learnt from: wobsoriano
PR: clerk/javascript#6229
File: packages/backend/src/api/endpoints/MachineTokensApi.ts:32-45
Timestamp: 2025-07-01T15:20:59.456Z
Learning: In the MachineTokensApi class (packages/backend/src/api/endpoints/MachineTokensApi.ts), the #withMachineTokenSecretHeader method intentionally overwrites the entire headerParams object with only the Authorization header when machineTokenSecret is provided, rather than merging with existing headers. This is by design to ensure only the Authorization header is present in requests.
Learnt from: wobsoriano
PR: clerk/javascript#6229
File: packages/backend/src/api/endpoints/MachineTokensApi.ts:47-89
Timestamp: 2025-07-01T15:20:41.834Z
Learning: In the Clerk JavaScript repository, for the MachineTokensApi class (packages/backend/src/api/endpoints/MachineTokensApi.ts), the maintainers prefer to rely on TypeScript types and readable property names for API documentation rather than JSDoc comments.
Learnt from: wobsoriano
PR: clerk/javascript#6099
File: packages/backend/src/api/endpoints/IdPOAuthAccessTokenApi.ts:7-14
Timestamp: 2025-06-10T20:38:08.982Z
Learning: Methods in `packages/backend/src/api/endpoints` (e.g., `IdPOAuthAccessTokenApi.verifySecret`) are currently not exposed publicly, so renaming them does not constitute a breaking change.
Learnt from: CR
PR: clerk/javascript#0
File: .cursor/rules/development.mdc:0-0
Timestamp: 2025-06-30T10:29:42.997Z
Learning: Update documentation for API changes
Learnt from: wobsoriano
PR: clerk/javascript#5858
File: packages/clerk-js/src/core/modules/apiKeys/index.ts:84-97
Timestamp: 2025-06-10T17:35:08.986Z
Learning: In the APIKeys service methods (packages/clerk-js/src/core/modules/apiKeys/index.ts), error handling is intentionally delegated to the component level rather than being implemented within the service methods themselves. This architectural pattern allows calling components to handle errors according to their specific UI needs.
Learnt from: wobsoriano
PR: clerk/javascript#6123
File: packages/nextjs/src/server/__tests__/getAuthDataFromRequest.test.ts:63-75
Timestamp: 2025-06-16T01:27:54.563Z
Learning: In packages/nextjs/src/server/data/getAuthDataFromRequest.ts, the tokenType behavior on mismatch is intentionally different between array and single acceptsToken values: when acceptsToken is an array and the token type doesn't match any in the array, tokenType returns null; when acceptsToken is a single value and the token type doesn't match, tokenType returns the requested single value. This design aligns with developer intent and provides a more ergonomic API for common use cases.
Learnt from: CR
PR: clerk/javascript#0
File: .cursor/rules/development.mdc:0-0
Timestamp: 2025-06-30T10:29:42.997Z
Learning: Applies to **/*.{js,jsx,ts,tsx} : All public APIs must be documented with JSDoc
Learnt from: CR
PR: clerk/javascript#0
File: .cursor/rules/development.mdc:0-0
Timestamp: 2025-06-30T10:29:42.997Z
Learning: Applies to **/*.{js,jsx,ts,tsx} : Maintain comprehensive JSDoc comments for public APIs
Learnt from: CR
PR: clerk/javascript#0
File: .cursor/rules/typescript.mdc:0-0
Timestamp: 2025-06-30T10:33:45.961Z
Learning: Applies to **/*.{ts,tsx} : Document public functions and APIs with JSDoc-style comments including @param, @returns, @throws, and @example
Learnt from: CR
PR: clerk/javascript#0
File: .cursor/rules/development.mdc:0-0
Timestamp: 2025-06-30T10:29:42.997Z
Learning: Use TypeDoc for generating API documentation
Learnt from: CR
PR: clerk/javascript#0
File: .cursor/rules/nextjs.mdc:0-0
Timestamp: 2025-06-30T10:31:43.578Z
Learning: Applies to app/api/**/*.ts : Document API endpoints with TypeScript interfaces
Learnt from: CR
PR: clerk/javascript#0
File: .cursor/rules/typescript.mdc:0-0
Timestamp: 2025-06-30T10:33:45.961Z
Learning: Applies to **/*.{ts,tsx} : Always define explicit return types for functions, especially public APIs
Learnt from: CR
PR: clerk/javascript#0
File: .cursor/rules/typescript.mdc:0-0
Timestamp: 2025-06-30T10:33:45.961Z
Learning: Applies to **/*.{ts,tsx} : Use `public` explicitly for clarity in public APIs
Learnt from: CR
PR: clerk/javascript#0
File: .cursor/rules/react.mdc:0-0
Timestamp: 2025-06-30T10:32:37.848Z
Learning: Applies to **/*.{jsx,tsx} : Use proper prop naming
Learnt from: CR
PR: clerk/javascript#0
File: .cursor/rules/typescript.mdc:0-0
Timestamp: 2025-06-30T10:33:45.961Z
Learning: Applies to **/*.{ts,tsx} : Prefer `readonly` properties for immutable data structures
Learnt from: CR
PR: clerk/javascript#0
File: .cursor/rules/typescript.mdc:0-0
Timestamp: 2025-06-30T10:33:45.961Z
Learning: Applies to **/*.{ts,tsx} : Proper use of utility types instead of manual type construction
Learnt from: CR
PR: clerk/javascript#0
File: .cursor/rules/typescript.mdc:0-0
Timestamp: 2025-06-30T10:33:45.961Z
Learning: Applies to **/*.{ts,tsx} : Prefer `readonly` for properties that shouldn't change after construction
Learnt from: CR
PR: clerk/javascript#0
File: .cursor/rules/typescript.mdc:0-0
Timestamp: 2025-06-30T10:33:45.961Z
Learning: Applies to **/*.{ts,tsx} : Consistent use of `readonly` for immutable data
Learnt from: CR
PR: clerk/javascript#0
File: .cursor/rules/react.mdc:0-0
Timestamp: 2025-06-30T10:32:37.848Z
Learning: Applies to **/*.tsx : Use proper type definitions for props and state
Learnt from: CR
PR: clerk/javascript#0
File: .cursor/rules/typescript.mdc:0-0
Timestamp: 2025-06-30T10:33:45.961Z
Learning: Applies to **/*.{ts,tsx} : Use readonly arrays and objects for immutability
Learnt from: CR
PR: clerk/javascript#0
File: .cursor/rules/react.mdc:0-0
Timestamp: 2025-06-30T10:32:37.848Z
Learning: Applies to **/*.{jsx,tsx} : Implement proper state naming
Learnt from: CR
PR: clerk/javascript#0
File: .cursor/rules/typescript.mdc:0-0
Timestamp: 2025-06-30T10:33:45.961Z
Learning: Applies to **/*.{ts,tsx} : Use `type` for unions, primitives, and computed types
Learnt from: CR
PR: clerk/javascript#0
File: .cursor/rules/typescript.mdc:0-0
Timestamp: 2025-06-30T10:33:45.961Z
Learning: Applies to **/*.{ts,tsx} : Use branded types for domain safety
Learnt from: dstaley
PR: clerk/javascript#6116
File: .changeset/tangy-garlics-say.md:1-2
Timestamp: 2025-06-13T16:09:53.061Z
Learning: In the Clerk JavaScript repository, contributors create intentionally empty changeset files (containing only the YAML delimiters) when a PR touches only non-published parts of the codebase (e.g., sandbox assets). This signals that no package release is required, so such changesets should not be flagged as missing content.
Learnt from: jacekradko
PR: clerk/javascript#5905
File: .changeset/six-ears-wash.md:1-3
Timestamp: 2025-06-26T03:27:05.535Z
Learning: In the Clerk JavaScript repository, changeset headers support single quotes syntax (e.g., '@clerk/backend': minor) and work fine with their current changesets integration, so there's no need to change them to double quotes.
Learnt from: wobsoriano
PR: clerk/javascript#6163
File: packages/backend/src/api/endpoints/APIKeysApi.ts:60-70
Timestamp: 2025-06-20T17:44:17.570Z
Learning: The Clerk codebase uses POST method for API key update operations instead of the typical PATCH method, as clarified by the maintainer wobsoriano.
Learnt from: bratsos
PR: clerk/javascript#6259
File: packages/clerk-js/src/ui/components/SignUp/signUpFormHelpers.ts:377-379
Timestamp: 2025-07-07T16:57:10.869Z
Learning: In the Clerk JavaScript repository, when working with TypeScript decision tables or rule-based systems, redundant-looking ternary operators may be intentionally kept for TypeScript type narrowing when the compiler cannot infer that a value is non-null despite conditional checks. This is a pragmatic approach to handle TypeScript's type system limitations without overcomplicating the code.
packages/backend/src/api/endpoints/MachineApi.ts (4)
Learnt from: wobsoriano
PR: clerk/javascript#6229
File: packages/backend/src/api/endpoints/MachineTokensApi.ts:47-89
Timestamp: 2025-07-01T15:20:41.834Z
Learning: In the Clerk JavaScript repository, for the MachineTokensApi class (packages/backend/src/api/endpoints/MachineTokensApi.ts), the maintainers prefer to rely on TypeScript types and readable property names for API documentation rather than JSDoc comments.
Learnt from: wobsoriano
PR: clerk/javascript#6229
File: packages/backend/src/api/endpoints/MachineTokensApi.ts:32-45
Timestamp: 2025-07-01T15:20:59.456Z
Learning: In the MachineTokensApi class (packages/backend/src/api/endpoints/MachineTokensApi.ts), the #withMachineTokenSecretHeader method intentionally overwrites the entire headerParams object with only the Authorization header when machineTokenSecret is provided, rather than merging with existing headers. This is by design to ensure only the Authorization header is present in requests.
Learnt from: CR
PR: clerk/javascript#0
File: .cursor/rules/nextjs.mdc:0-0
Timestamp: 2025-06-30T10:31:43.578Z
Learning: Applies to app/api/**/*.ts : Document API endpoints with TypeScript interfaces
Learnt from: CR
PR: clerk/javascript#0
File: .cursor/rules/nextjs.mdc:0-0
Timestamp: 2025-06-30T10:31:43.578Z
Learning: Applies to app/api/**/*.ts : Use TypeScript interfaces for API response types
🧬 Code Graph Analysis (3)
packages/backend/src/api/resources/Machine.ts (1)
packages/backend/src/api/resources/JSON.ts (1)
MachineJSON(702-709)
packages/backend/src/api/resources/Deserializer.ts (2)
packages/backend/src/api/resources/JSON.ts (2)
ObjectType(19-66)ObjectType(68-68)packages/backend/src/api/resources/Machine.ts (1)
Machine(3-15)
packages/backend/src/api/endpoints/MachineApi.ts (2)
packages/backend/src/api/resources/Deserializer.ts (1)
PaginatedResourceResponse(60-65)packages/backend/src/api/resources/Machine.ts (1)
Machine(3-15)
⏰ Context from checks skipped due to timeout of 90000ms. You can increase the timeout in your CodeRabbit configuration to a maximum of 15 minutes (900000ms). (3)
- GitHub Check: semgrep-cloud-platform/scan
- GitHub Check: semgrep/ci
- GitHub Check: Analyze (javascript-typescript)
🔇 Additional comments (6)
packages/backend/src/api/endpoints/MachineTokensApi.ts (2)
8-33: Well-structured type definitions with good reusability.The
WithMachineSecretutility type provides a clean way to add optional machine secret support across all parameter types. The type definitions are consistent and follow TypeScript best practices.
36-52: Helper method correctly implements machine secret authorization.The method appropriately handles conditional header injection and follows the intended design pattern of replacing headers with only the Authorization header when machineSecret is provided.
packages/backend/src/api/resources/Deserializer.ts (2)
18-18: Machine import correctly added.The import is properly placed in alphabetical order and follows the existing import pattern.
136-137: Machine deserialization case correctly implemented.The case follows the established pattern of using the static
fromJSONmethod and is properly placed in alphabetical order within the switch statement.packages/backend/src/api/resources/Machine.ts (1)
3-15: Well-structured Machine resource class.The class follows TypeScript best practices with readonly properties, proper constructor initialization, and consistent camelCase property naming. The
fromJSONmethod correctly maps snake_case JSON properties to camelCase class properties, maintaining consistency with the existing codebase patterns.packages/backend/src/api/endpoints/MachineApi.ts (1)
8-25: Clean and well-defined parameter types.The type definitions are descriptive and provide good type safety for the API operations. The
GetMachineListParamsappropriately supports pagination and search functionality.
| export class MachineTokensApi extends AbstractAPI { | ||
| async verifySecret(secret: string) { | ||
| return this.request<MachineToken>({ | ||
| method: 'POST', | ||
| path: joinPaths(basePath, 'verify'), | ||
| bodyParams: { secret }, | ||
| }); | ||
| /** | ||
| * Overrides the instance secret with the machine secret. | ||
| */ | ||
| #withMachineSecretHeader( | ||
| options: ClerkBackendApiRequestOptions, | ||
| machineSecret?: string | null, | ||
| ): ClerkBackendApiRequestOptions { | ||
| if (machineSecret) { | ||
| return { | ||
| ...options, | ||
| headerParams: { | ||
| Authorization: `Bearer ${machineSecret}`, | ||
| }, | ||
| }; | ||
| } | ||
| return options; | ||
| } | ||
|
|
||
| async create(params: CreateMachineTokenParams) { | ||
| const { machineSecret, ...bodyParams } = params; | ||
| return this.request<MachineToken>( | ||
| this.#withMachineSecretHeader( | ||
| { | ||
| method: 'POST', | ||
| path: basePath, | ||
| bodyParams, | ||
| }, | ||
| machineSecret, | ||
| ), | ||
| ); | ||
| } | ||
|
|
||
| async update(params: UpdateMachineTokenParams) { | ||
| const { m2mTokenId, machineSecret, ...bodyParams } = params; | ||
| this.requireId(m2mTokenId); | ||
| return this.request<MachineToken>( | ||
| this.#withMachineSecretHeader( | ||
| { | ||
| method: 'PATCH', | ||
| path: joinPaths(basePath, m2mTokenId), | ||
| bodyParams, | ||
| }, | ||
| machineSecret, | ||
| ), | ||
| ); | ||
| } | ||
|
|
||
| async revoke(params: RevokeMachineTokenParams) { | ||
| const { m2mTokenId, machineSecret, ...bodyParams } = params; | ||
| this.requireId(m2mTokenId); | ||
| return this.request<MachineToken>( | ||
| this.#withMachineSecretHeader( | ||
| { | ||
| method: 'POST', | ||
| path: joinPaths(basePath, m2mTokenId, 'revoke'), | ||
| bodyParams, | ||
| }, | ||
| machineSecret, | ||
| ), | ||
| ); | ||
| } | ||
|
|
||
| async verifySecret(params: VerifyMachineTokenParams) { | ||
| const { secret, machineSecret } = params; | ||
| return this.request<MachineToken>( | ||
| this.#withMachineSecretHeader( | ||
| { | ||
| method: 'POST', | ||
| path: joinPaths(basePath, 'verify'), | ||
| bodyParams: { secret }, | ||
| }, | ||
| machineSecret, | ||
| ), | ||
| ); | ||
| } | ||
| } |
There was a problem hiding this comment.
💡 Verification agent
❓ Verification inconclusive
Consider adding tests for the refactored API methods.
The significant refactoring of method signatures and addition of machine secret support would benefit from comprehensive test coverage to ensure the new parameter object pattern works correctly and machine secret authorization functions as expected.
🏁 Script executed:
#!/bin/bash
# Search for existing tests for MachineTokensApi to verify test coverage
fd "MachineTokensApi" --type f --extension ts --extension js | grep -i testLength of output: 75
Let’s check for any references to MachineTokensApi within your test files:
🏁 Script executed:
#!/bin/bash
# Search for references to MachineTokensApi in all test files
rg --files-with-matches 'MachineTokensApi' -g '*.{test,spec}.{ts,tsx,js}'
rg --files-with-matches 'MachineTokensApi' -g '**/__tests__/**/*.{ts,tsx,js}'Length of output: 151
Add unit tests for MachineTokensApi methods
The refactoring introduces new parameter patterns and machine-secret header logic that currently lack test coverage. Please add tests in packages/backend to ensure:
• create, update, revoke, and verifySecret calls
• behavior with and without machineSecret
• correct override of headerParams.Authorization when machineSecret is provided
• preservation of existing headers when machineSecret is absent
🤖 Prompt for AI Agents
In packages/backend/src/api/endpoints/MachineTokensApi.ts from lines 35 to 111,
add unit tests for the MachineTokensApi class methods create, update, revoke,
and verifySecret. The tests should cover calls with and without the
machineSecret parameter, verify that when machineSecret is provided the
headerParams.Authorization is correctly overridden with the Bearer token, and
confirm that existing headers remain unchanged when machineSecret is not
provided. Ensure the tests validate the request options passed to the request
method to confirm the header behavior and parameter handling.
| export class MachineApi extends AbstractAPI { | ||
| async list(queryParams: GetMachineListParams = {}) { | ||
| return this.request<PaginatedResourceResponse<Machine[]>>({ | ||
| method: 'GET', | ||
| path: basePath, | ||
| queryParams, | ||
| }); | ||
| } | ||
|
|
||
| async create(bodyParams: CreateMachineParams) { | ||
| return this.request<Machine>({ | ||
| method: 'POST', | ||
| path: basePath, | ||
| bodyParams, | ||
| }); | ||
| } | ||
|
|
||
| async update(params: UpdateMachineParams) { | ||
| const { machineId, ...bodyParams } = params; | ||
| this.requireId(machineId); | ||
| return this.request<Machine>({ | ||
| method: 'PATCH', | ||
| path: joinPaths(basePath, machineId), | ||
| bodyParams, | ||
| }); | ||
| } | ||
|
|
||
| async delete(params: DeleteMachineParams) { | ||
| const { machineId } = params; | ||
| this.requireId(machineId); | ||
| return this.request<Machine>({ | ||
| method: 'DELETE', | ||
| path: joinPaths(basePath, machineId), | ||
| }); | ||
| } | ||
|
|
||
| async get(machineId: string) { | ||
| this.requireId(machineId); | ||
| return this.request<Machine>({ | ||
| method: 'GET', | ||
| path: joinPaths(basePath, machineId), | ||
| }); | ||
| } | ||
| } |
There was a problem hiding this comment.
💡 Verification agent
🧩 Analysis chain
Consider adding comprehensive tests for the new MachineApi.
This new API client provides full CRUD operations for machines and would benefit from test coverage to ensure all operations work correctly, including parameter validation and proper HTTP method usage.
🏁 Script executed:
#!/bin/bash
# Search for existing tests for MachineApi to verify test coverage
fd "MachineApi" --type f --extension ts --extension js | grep -i testLength of output: 69
🏁 Script executed:
#!/bin/bash
# Search within unit and integration test files for references to MachineApi
rg -n "MachineApi" --glob "*.{test,spec}.{ts,tsx,js}" .
rg -n "machine" --glob "*.{test,spec}.{ts,tsx,js}" .Length of output: 13112
Add unit tests for MachineApi
No existing tests reference the new MachineApi class. Per our testing requirements, please add a Jest/Vitest unit-test suite covering all CRUD methods:
• Create a test file, e.g.
packages/backend/src/api/endpoints/tests/MachineApi.test.ts
• Mock the underlying HTTP request handler and verify:
- list(queryParams) issues a GET to
/machineswith proper query params - create(body) issues a POST and correctly handles the response
- update({ machineId, ... }) calls PATCH on
/machines/:id, and throws when machineId is missing - delete({ machineId }) issues DELETE to
/machines/:id, and throws when machineId is missing - get(id) issues GET to
/machines/:id, and throws when id is missing
• Assert correct typing of request and response payloads, and error handling
🤖 Prompt for AI Agents
In packages/backend/src/api/endpoints/MachineApi.ts around lines 27 to 70, there
are no unit tests for the MachineApi class. Create a new test file named
MachineApi.test.ts in the __tests__ directory. Mock the HTTP request method used
in MachineApi and write tests for all CRUD methods: verify list sends a GET with
query params to /machines, create sends a POST with body and handles response,
update sends PATCH to /machines/:id and throws if machineId is missing, delete
sends DELETE to /machines/:id and throws if machineId is missing, and get sends
GET to /machines/:id and throws if id is missing. Also, assert correct typing of
request/response payloads and proper error handling in these tests.
Description
Checklist
pnpm testruns as expected.pnpm buildruns as expected.Type of change
Summary by CodeRabbit
New Features
Improvements
Bug Fixes