diff --git a/.changeset/floppy-buckets-help.md b/.changeset/floppy-buckets-help.md deleted file mode 100644 index df357898e2b..00000000000 --- a/.changeset/floppy-buckets-help.md +++ /dev/null @@ -1,5 +0,0 @@ ---- -"@clerk/astro": major ---- - -Add support for Astro 7 and drop support for Astro 4. If you are still on Astro 4, follow the [Astro upgrade guide](https://docs.astro.build/en/guides/upgrade-to/v6/) to upgrade your project before updating `@clerk/astro`. diff --git a/.changeset/major-astro-remove-route-matcher.md b/.changeset/major-astro-remove-route-matcher.md deleted file mode 100644 index 6c2727e58e3..00000000000 --- a/.changeset/major-astro-remove-route-matcher.md +++ /dev/null @@ -1,43 +0,0 @@ ---- -'@clerk/astro': major ---- - -Remove `createRouteMatcher` from `@clerk/astro/server`. Use resource-based auth checks instead: move auth checks into each Astro page, API route, or server-side handler that accesses protected data. Middleware-based auth checks rely on path matching, which can diverge from how Astro routes requests and leave protected resources reachable. - -```ts -import type { APIRoute } from 'astro'; - -export const GET: APIRoute = ({ locals }) => { - const { userId } = locals.auth(); - - if (!userId) { - return new Response('Unauthorized', { status: 401 }); - } - - return Response.json({ userId }); -}; -``` - -If you want to hand this work to a coding agent, use this migration prompt: - -```md -Migrate my Astro project away from Clerk's removed `createRouteMatcher` API. - -1. Open `src/middleware.ts` (or `src/middleware.js`) and find every matcher created - with `createRouteMatcher` from `@clerk/astro/server`, along with the middleware - logic that uses it (returning 401s, calling `auth().redirectToSignIn()`, etc.). -2. For every route those matchers protected, move the auth check into the resource itself: - - In `.astro` pages, add this to the frontmatter: - const { userId, redirectToSignIn } = Astro.locals.auth(); - if (!userId) return redirectToSignIn(); - - In API routes and server handlers, add this at the top of the handler: - const { userId } = locals.auth(); - if (!userId) return new Response('Unauthorized', { status: 401 }); - - Keep any role or permission checks (`auth().has(...)`) with the resource as well. -3. Remove the `createRouteMatcher` import and calls from the middleware. Keep - `clerkMiddleware()` itself. Middleware logic unrelated to auth protection - (locale redirects, headers, etc.) may stay, using plain `URL`/pathname checks. -4. Make sure every page and endpoint previously covered by a matcher pattern - (including glob patterns like `/dashboard(.*)`) now has its own check, then - verify the project builds. -``` diff --git a/.changeset/swift-plums-cover.md b/.changeset/swift-plums-cover.md deleted file mode 100644 index f1ddcc3f9ce..00000000000 --- a/.changeset/swift-plums-cover.md +++ /dev/null @@ -1,5 +0,0 @@ ---- -'@clerk/nextjs': patch ---- - -Remove the redundant `https://*.client.protect.clerk.com` source from CSP headers generated by `clerkMiddleware()`. diff --git a/.changeset/typedoc-multi-example-double-comma.md b/.changeset/typedoc-multi-example-double-comma.md deleted file mode 100644 index a845151cc84..00000000000 --- a/.changeset/typedoc-multi-example-double-comma.md +++ /dev/null @@ -1,2 +0,0 @@ ---- ---- diff --git a/packages/astro/CHANGELOG.md b/packages/astro/CHANGELOG.md index 46ddd952dcf..21c5db36866 100644 --- a/packages/astro/CHANGELOG.md +++ b/packages/astro/CHANGELOG.md @@ -1,5 +1,51 @@ # @clerk/astro +## 4.0.0 + +### Major Changes + +- Add support for Astro 7 and drop support for Astro 4. If you are still on Astro 4, follow the [Astro upgrade guide](https://docs.astro.build/en/guides/upgrade-to/v6/) to upgrade your project before updating `@clerk/astro`. ([#8974](https://github.com/clerk/javascript/pull/8974)) by [@wobsoriano](https://github.com/wobsoriano) + +- Remove `createRouteMatcher` from `@clerk/astro/server`. Use resource-based auth checks instead: move auth checks into each Astro page, API route, or server-side handler that accesses protected data. Middleware-based auth checks rely on path matching, which can diverge from how Astro routes requests and leave protected resources reachable. ([#8974](https://github.com/clerk/javascript/pull/8974)) by [@wobsoriano](https://github.com/wobsoriano) + + ```ts + import type { APIRoute } from 'astro'; + + export const GET: APIRoute = ({ locals }) => { + const { userId } = locals.auth(); + + if (!userId) { + return new Response('Unauthorized', { status: 401 }); + } + + return Response.json({ userId }); + }; + ``` + + If you want to hand this work to a coding agent, use this migration prompt: + + ```md + Migrate my Astro project away from Clerk's removed `createRouteMatcher` API. + + 1. Open `src/middleware.ts` (or `src/middleware.js`) and find every matcher created + with `createRouteMatcher` from `@clerk/astro/server`, along with the middleware + logic that uses it (returning 401s, calling `auth().redirectToSignIn()`, etc.). + 2. For every route those matchers protected, move the auth check into the resource itself: + - In `.astro` pages, add this to the frontmatter: + const { userId, redirectToSignIn } = Astro.locals.auth(); + if (!userId) return redirectToSignIn(); + - In API routes and server handlers, add this at the top of the handler: + const { userId } = locals.auth(); + if (!userId) return new Response('Unauthorized', { status: 401 }); + - Keep any role or permission checks (`auth().has(...)`) with the resource as well. + 3. Remove the `createRouteMatcher` import and calls from the middleware. Keep + `clerkMiddleware()` itself. Middleware logic unrelated to auth protection + (locale redirects, headers, etc.) may stay, using plain `URL`/pathname checks. + 4. Make sure every page and endpoint previously covered by a matcher pattern + (including glob patterns like `/dashboard(.*)`) now has its own check, then + verify the project builds. + ``` + ## 3.4.20 ### Patch Changes diff --git a/packages/astro/package.json b/packages/astro/package.json index 98ad1acb642..452052f58d4 100644 --- a/packages/astro/package.json +++ b/packages/astro/package.json @@ -1,6 +1,6 @@ { "name": "@clerk/astro", - "version": "3.4.20", + "version": "4.0.0", "description": "Clerk SDK for Astro", "keywords": [ "auth", diff --git a/packages/nextjs/CHANGELOG.md b/packages/nextjs/CHANGELOG.md index feff6323284..0dde311ea72 100644 --- a/packages/nextjs/CHANGELOG.md +++ b/packages/nextjs/CHANGELOG.md @@ -1,5 +1,11 @@ # Change Log +## 7.5.22 + +### Patch Changes + +- Remove the redundant `https://*.client.protect.clerk.com` source from CSP headers generated by `clerkMiddleware()`. ([#9207](https://github.com/clerk/javascript/pull/9207)) by [@mwickett](https://github.com/mwickett) + ## 7.5.21 ### Patch Changes diff --git a/packages/nextjs/package.json b/packages/nextjs/package.json index 9ea11fcec47..2eb2b5ebf62 100644 --- a/packages/nextjs/package.json +++ b/packages/nextjs/package.json @@ -1,6 +1,6 @@ { "name": "@clerk/nextjs", - "version": "7.5.21", + "version": "7.5.22", "description": "Clerk SDK for NextJS", "keywords": [ "clerk",