Michael Freno
7287f10c9a
- src/server/nessa-auth.ts: replace jose HS256 sign/verify with Clerk session JWT verification via @clerk/backend verifyToken (RS256/JWKS). signNessaToken removed — frontend now supplies Clerk session tokens. - src/server/api/utils.ts: createTRPCContext verifies Clerk JWT, resolves ctx.nessaUserId via SELECT id FROM users WHERE clerkUserId=? on the shared NessaConnectionFactory. Lookup miss throws typed UNAUTHORIZED (webhook has not run yet). Invalid/expired tokens are swallowed; the enforceNessaUser middleware rejects null nessaUserId. - src/server/api/routers/nessa-community-authz.test.ts: add clerkUserId lookup tests (seeded match, missing row, mismatched id, local≠clerk). - src/server/nessa-auth.test.ts: verifyNessaToken unit tests with mocked @clerk/backend (valid sub, missing sub, malformed/expired/wrong-signature rejection) plus static audit that signNessaToken is gone. - src/server/clerk-user-webhook.ts + src/routes/api/clerk-webhook.ts: Clerk user.created/user.updated webhook handler (Svix signature verification, idempotent upsert by clerkUserId, lazy ALTER TABLE migration) with full test suite. - src/server/api/routers/nessa.ts: remove legacy register/login/google/ apple sign-in mutations (Clerk is now the sole identity provider). - src/env/server.ts: add NESSA_CLERK_SECRET, NESSA_CLERK_JWT_ISSUER, NESSA_CLERK_WEBHOOK_SECRET; NESSA_JWT_SECRET moved to optional. - package.json: add @clerk/backend, svix; lineage/auth.test.ts and nessa-ownership.test.ts: add Clerk env vars to env mocks. - .env.example: document Clerk config vars and rotation. - delete nessa-google-oauth.test.ts (Google auth removed). ctx.nessaUserId remains the local users.id — router bodies are untouched.
85 lines
2.7 KiB
JSON
85 lines
2.7 KiB
JSON
{
|
|
"name": "example-with-trpc",
|
|
"type": "module",
|
|
"scripts": {
|
|
"dev": "vinxi dev",
|
|
"dev-flush": "vinxi dev --env-file=.env",
|
|
"build": "vinxi build",
|
|
"start": "vinxi start",
|
|
"test": "bun test",
|
|
"test:security": "bun test src/server/security/",
|
|
"test:watch": "bun test --watch",
|
|
"test:coverage": "bun test --coverage",
|
|
"perf": "bun run scripts/perf-test.ts",
|
|
"perf:compare": "bun run scripts/perf-compare.ts"
|
|
},
|
|
"dependencies": {
|
|
"@aws-sdk/client-s3": "^3.953.0",
|
|
"@aws-sdk/s3-request-presigner": "^3.953.0",
|
|
"@clerk/backend": "^3.12.0",
|
|
"@libsql/client": "^0.15.15",
|
|
"@motionone/solid": "^10.16.4",
|
|
"@solidjs/meta": "^0.29.4",
|
|
"@solidjs/router": "^0.15.0",
|
|
"@solidjs/start": "^1.1.0",
|
|
"@tailwindcss/vite": "^4.0.7",
|
|
"@tiptap/core": "^3.14.0",
|
|
"@tiptap/extension-code-block-lowlight": "^3.14.0",
|
|
"@tiptap/extension-color": "^3.14.0",
|
|
"@tiptap/extension-details": "^3.14.0",
|
|
"@tiptap/extension-details-content": "^2.26.2",
|
|
"@tiptap/extension-details-summary": "^2.26.2",
|
|
"@tiptap/extension-image": "^3.14.0",
|
|
"@tiptap/extension-link": "^3.14.0",
|
|
"@tiptap/extension-list-item": "^3.14.0",
|
|
"@tiptap/extension-subscript": "^3.14.0",
|
|
"@tiptap/extension-superscript": "^3.14.0",
|
|
"@tiptap/extension-table": "^3.14.0",
|
|
"@tiptap/extension-table-cell": "^3.14.0",
|
|
"@tiptap/extension-table-header": "^3.14.0",
|
|
"@tiptap/extension-table-row": "^3.14.0",
|
|
"@tiptap/extension-task-item": "^3.14.0",
|
|
"@tiptap/extension-task-list": "^3.14.0",
|
|
"@tiptap/extension-text-align": "^3.14.0",
|
|
"@tiptap/extension-text-style": "^3.14.0",
|
|
"@tiptap/pm": "^3.14.0",
|
|
"@tiptap/starter-kit": "^3.14.0",
|
|
"@trpc/client": "^10.45.2",
|
|
"@trpc/server": "^10.45.2",
|
|
"@tursodatabase/api": "^1.9.2",
|
|
"@typeschema/valibot": "^0.13.4",
|
|
"bcrypt": "^6.0.0",
|
|
"es-toolkit": "^1.43.0",
|
|
"fast-diff": "^1.3.0",
|
|
"google-auth-library": "^10.5.0",
|
|
"highlight.js": "^11.11.1",
|
|
"jose": "^6.1.3",
|
|
"mermaid": "^11.12.2",
|
|
"motion": "^12.23.26",
|
|
"solid-js": "^1.9.5",
|
|
"solid-tiptap": "^0.8.0",
|
|
"svix": "^1.98.0",
|
|
"ua-parser-js": "^2.0.7",
|
|
"uuid": "^13.0.0",
|
|
"vinxi": "^0.5.7",
|
|
"zod": "^4.2.1"
|
|
},
|
|
"engines": {
|
|
"node": "24.x"
|
|
},
|
|
"devDependencies": {
|
|
"@playwright/test": "^1.57.0",
|
|
"@tailwindcss/typography": "^0.5.19",
|
|
"@types/bcrypt": "^6.0.0",
|
|
"@types/fast-diff": "^1.2.2",
|
|
"chrome-launcher": "^1.2.1",
|
|
"lighthouse": "^13.0.1",
|
|
"playwright": "^1.57.0",
|
|
"prettier": "^3.7.4",
|
|
"prettier-plugin-tailwindcss": "^0.7.2",
|
|
"rollup-plugin-visualizer": "^6.0.5",
|
|
"trpc-panel": "^1.3.4",
|
|
"vite-bundle-visualizer": "^1.2.1"
|
|
}
|
|
}
|