Skip to content

WIP: Allow machine secret key authentication for M2M endpoints #6229

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Open
wants to merge 28 commits into
base: main
Choose a base branch
from

Conversation

wobsoriano
Copy link
Member

@wobsoriano wobsoriano commented Jul 1, 2025

Description

This PR adds ability to create, update, revoke and verify m2m tokens:

const clerkClient = createClerkClient()

clerkClient.machineTokens.create({...})

clerkClient.machineTokens.verifySecret({...})

and also accepts a machine secret as authentication header instead of a Clerk instance secret:

clerkClient.machineTokens.create({ machineSecret: 'ak_xxx', ...body })

Resolves USER-2264

Checklist

  • pnpm test runs as expected.
  • pnpm build runs as expected.
  • (If applicable) JSDoc comments have been added or updated for any package exports
  • (If applicable) Documentation has been updated

Type of change

  • 🐛 Bug fix
  • 🌟 New feature
  • 🔨 Breaking change
  • 📖 Refactoring / dependency upgrade / documentation
  • other:

Summary by CodeRabbit

  • New Features

    • Added support for providing an optional machine secret when creating, updating, revoking, or verifying machine tokens.
    • Exposed a new API client for machine-related operations.
  • Improvements

    • Enhanced machine token management to allow more flexible authorization.
    • Updated machine token data structures to include an optional secret property.
    • Improved authorization header handling to avoid overwriting existing headers in API requests.

Copy link

changeset-bot bot commented Jul 1, 2025

🦋 Changeset detected

Latest commit: f78ddcc

The changes in this PR will be included in the next version bump.

This PR includes changesets to release 11 packages
Name Type
@clerk/backend Minor
@clerk/agent-toolkit Patch
@clerk/astro Patch
@clerk/express Patch
@clerk/fastify Patch
@clerk/nextjs Patch
@clerk/nuxt Patch
@clerk/react-router Patch
@clerk/remix Patch
@clerk/tanstack-react-start Patch
@clerk/testing Patch

Not sure what this means? Click here to learn what changesets are.

Click here if you're a maintainer who wants to add another changeset to this PR

Copy link

vercel bot commented Jul 1, 2025

The latest updates on your projects. Learn more about Vercel for Git ↗︎

Name Status Preview Comments Updated (UTC)
clerk-js-sandbox ❌ Failed (Inspect) Jul 25, 2025 10:54pm

@wobsoriano wobsoriano force-pushed the rob/user-2264-m2m branch from 06c8514 to af6a27b Compare July 1, 2025 15:03
@wobsoriano wobsoriano marked this pull request as ready for review July 1, 2025 15:12
Copy link
Contributor

coderabbitai bot commented Jul 1, 2025

📝 Walkthrough

Walkthrough

This change introduces support for an optional or required machineSecret parameter across all methods of the MachineTokensApi class, enforcing its presence where necessary and including it as a bearer token in authorization headers. New parameter types are defined for create, update, revoke, and verify operations to accommodate these changes. The MachineTokenJSON interface and MachineToken class are updated to include an optional secret property while removing previously existing properties name, created_by, and creation_reason. The buildRequest function is modified to use header constants and to avoid overwriting existing authorization headers. The API client factory now exposes a new machines client and adjusts the construction of the machineTokens client with updated request options.

Estimated code review effort

🎯 3 (Moderate) | ⏱️ ~15–20 minutes

  • Complexity arises from the introduction of new parameter types, changes to method signatures, and the addition of conditional authorization logic.
  • Updates touch multiple files but are focused on a single area of functionality.
  • Review requires attention to type safety, backward compatibility, and correct propagation of the new machineSecret option.

📜 Recent review details

Configuration used: CodeRabbit UI
Review profile: CHILL
Plan: Pro

📥 Commits

Reviewing files that changed from the base of the PR and between 0f7387d and f78ddcc.

📒 Files selected for processing (2)
  • packages/backend/src/api/resources/JSON.ts (1 hunks)
  • packages/backend/src/api/resources/MachineToken.ts (1 hunks)
🧰 Additional context used
📓 Path-based instructions (7)
**/*.{js,jsx,ts,tsx}

📄 CodeRabbit Inference Engine (.cursor/rules/development.mdc)

**/*.{js,jsx,ts,tsx}: All code must pass ESLint checks with the project's configuration
Follow established naming conventions (PascalCase for components, camelCase for variables)
Maintain comprehensive JSDoc comments for public APIs
Use dynamic imports for optional features
All public APIs must be documented with JSDoc
Provide meaningful error messages to developers
Include error recovery suggestions where applicable
Log errors appropriately for debugging
Lazy load components and features when possible
Implement proper caching strategies
Use efficient data structures and algorithms
Profile and optimize critical paths
Validate all inputs and sanitize outputs
Implement proper logging with different levels

Files:

  • packages/backend/src/api/resources/JSON.ts
  • packages/backend/src/api/resources/MachineToken.ts
**/*.{js,jsx,ts,tsx,json,css,scss,md,yaml,yml}

📄 CodeRabbit Inference Engine (.cursor/rules/development.mdc)

Use Prettier for consistent code formatting

Files:

  • packages/backend/src/api/resources/JSON.ts
  • packages/backend/src/api/resources/MachineToken.ts
packages/**/*.{ts,tsx}

📄 CodeRabbit Inference Engine (.cursor/rules/development.mdc)

TypeScript is required for all packages

Files:

  • packages/backend/src/api/resources/JSON.ts
  • packages/backend/src/api/resources/MachineToken.ts
packages/**/*.{ts,tsx,d.ts}

📄 CodeRabbit Inference Engine (.cursor/rules/development.mdc)

Packages should export TypeScript types alongside runtime code

Files:

  • packages/backend/src/api/resources/JSON.ts
  • packages/backend/src/api/resources/MachineToken.ts
**/*.{ts,tsx}

📄 CodeRabbit Inference Engine (.cursor/rules/development.mdc)

Use proper TypeScript error types

**/*.{ts,tsx}: Always define explicit return types for functions, especially public APIs
Use proper type annotations for variables and parameters where inference isn't clear
Avoid any type - prefer unknown when type is uncertain, then narrow with type guards
Use interface for object shapes that might be extended
Use type for unions, primitives, and computed types
Prefer readonly properties for immutable data structures
Use private for internal implementation details
Use protected for inheritance hierarchies
Use public explicitly for clarity in public APIs
Prefer readonly for properties that shouldn't change after construction
Prefer composition and interfaces over deep inheritance chains
Use mixins for shared behavior across unrelated classes
Implement dependency injection for loose coupling
Let TypeScript infer when types are obvious
Use const assertions for literal types: as const
Use satisfies operator for type checking without widening
Use mapped types for transforming object types
Use conditional types for type-level logic
Leverage template literal types for string manipulation
Use ES6 imports/exports consistently
Use default exports sparingly, prefer named exports
Use type-only imports: import type { ... } from ...
No any types without justification
Proper error handling with typed errors
Consistent use of readonly for immutable data
Proper generic constraints
No unused type parameters
Proper use of utility types instead of manual type construction
Type-only imports where possible
Proper tree-shaking friendly exports
No circular dependencies
Efficient type computations (avoid deep recursion)

Files:

  • packages/backend/src/api/resources/JSON.ts
  • packages/backend/src/api/resources/MachineToken.ts
**/*.{js,ts,tsx,jsx}

📄 CodeRabbit Inference Engine (.cursor/rules/monorepo.mdc)

Support multiple Clerk environment variables (CLERK_, NEXT_PUBLIC_CLERK_, etc.) for configuration.

Files:

  • packages/backend/src/api/resources/JSON.ts
  • packages/backend/src/api/resources/MachineToken.ts
**/*

⚙️ CodeRabbit Configuration File

**/*: If there are no tests added or modified as part of the PR, please suggest that tests be added to cover the changes.

Whenever reviewing a pull request, if there are any changes that could impact security, always tag @clerk/security in the PR.

Security-impacting changes include, but are not limited to:

  • Changes to authentication logic or mechanisms (e.g. login, session handling, token issuance)
  • Any modification to access control, authorization checks, or role-based permissions
  • Introduction or modification of hashing algorithms, signature verification, or cryptographic primitives
  • Handling of sensitive data (e.g. passwords, tokens, secrets, PII)
  • Integration with external identity providers (e.g. SSO, OAuth, OpenID Connect)
  • Modifications to security headers, cookie flags, CORS policies, or CSRF protections
  • Bypass mechanisms (e.g. feature flags, testing overrides) that could weaken protections
  • Changes to rate limiting, abuse prevention, or input validation

If you're unsure whether a change is security-relevant, err on the side of caution and tag @clerk/security.

Any time that you tag @clerk/security, please do so explicitly in a code comment, rather than within a collapsed section in a coderabbit comment, such as the "recent review details" section. If you do use the team name in any thinking or non-direct-code-comment content, it can be referred to as "clerk security team" to avoid accidentally printing the tag which sends a notification to the team.

Files:

  • packages/backend/src/api/resources/JSON.ts
  • packages/backend/src/api/resources/MachineToken.ts
🧬 Code Graph Analysis (1)
packages/backend/src/api/resources/MachineToken.ts (1)
packages/backend/src/api/resources/JSON.ts (1)
  • MachineTokenJSON (715-727)
⏰ Context from checks skipped due to timeout of 90000ms. You can increase the timeout in your CodeRabbit configuration to a maximum of 15 minutes (900000ms). (5)
  • GitHub Check: Build Packages
  • GitHub Check: Formatting | Dedupe | Changeset
  • GitHub Check: semgrep-cloud-platform/scan
  • GitHub Check: semgrep/ci
  • GitHub Check: Analyze (javascript-typescript)
🔇 Additional comments (5)
packages/backend/src/api/resources/JSON.ts (1)

717-717: Security-sensitive change: Adding secret property to machine tokens.

The addition of a secret property to MachineTokenJSON introduces sensitive authentication data into the machine token model. This change should be reviewed by the security team to ensure proper handling, storage, and transmission of these secrets.

@clerk/security - Please review the addition of machine token secrets as part of the M2M token implementation.

Consider adding JSDoc documentation for the new property:

export interface MachineTokenJSON extends ClerkResourceJSON {
  object: typeof ObjectType.MachineToken;
+ /**
+  * Optional secret for machine-to-machine token authentication
+  */
  secret?: string;
  subject: string;
packages/backend/src/api/resources/MachineToken.ts (4)

15-15: LGTM: Optional secret parameter added correctly.

The optional secret parameter is properly typed as readonly string | undefined and positioned appropriately at the end of the constructor parameters.


18-18: Good practice: Explicit return type annotation.

Adding the explicit MachineToken return type to the fromJSON method improves type safety and API clarity.


30-30: LGTM: Secret property correctly mapped from JSON.

The data.secret is properly passed to the constructor, maintaining consistency between the JSON interface and the class implementation.


1-33: Consider adding tests for the new secret functionality.

Since this is a new feature (M2M tokens with secrets), please ensure that tests are added to cover:

  • MachineToken creation with and without secrets
  • fromJSON method with secret property
  • Proper handling of undefined secrets

The coding guidelines specify that tests should be added when no test changes are included in the PR. Are there corresponding test updates for these changes?


🪧 Tips

Chat

There are 3 ways to chat with CodeRabbit:

  • Review comments: Directly reply to a review comment made by CodeRabbit. Example:
    • I pushed a fix in commit <commit_id>, please review it.
    • Explain this complex logic.
    • Open a follow-up GitHub issue for this discussion.
  • Files and specific lines of code (under the "Files changed" tab): Tag @coderabbitai in a new review comment at the desired location with your query. Examples:
    • @coderabbitai explain this code block.
    • @coderabbitai modularize this function.
  • PR comments: Tag @coderabbitai in a new PR comment to ask questions about the PR branch. For the best results, please provide a very specific query, as very limited context is provided in this mode. Examples:
    • @coderabbitai gather interesting stats about this repository and render them as a table. Additionally, render a pie chart showing the language distribution in the codebase.
    • @coderabbitai read src/utils.ts and explain its main purpose.
    • @coderabbitai read the files in the src/scheduler package and generate a class diagram using mermaid and a README in the markdown format.
    • @coderabbitai help me debug CodeRabbit configuration file.

Support

Need help? Create a ticket on our support page for assistance with any issues or questions.

Note: Be mindful of the bot's finite context window. It's strongly recommended to break down tasks such as reading entire modules into smaller chunks. For a focused discussion, use review comments to chat about specific files and their changes, instead of using the PR comments.

CodeRabbit Commands (Invoked using PR comments)

  • @coderabbitai pause to pause the reviews on a PR.
  • @coderabbitai resume to resume the paused reviews.
  • @coderabbitai review to trigger an incremental review. This is useful when automatic reviews are disabled for the repository.
  • @coderabbitai full review to do a full review from scratch and review all the files again.
  • @coderabbitai summary to regenerate the summary of the PR.
  • @coderabbitai generate sequence diagram to generate a sequence diagram of the changes in this PR.
  • @coderabbitai resolve resolve all the CodeRabbit review comments.
  • @coderabbitai configuration to show the current CodeRabbit configuration for the repository.
  • @coderabbitai help to get help.

Other keywords and placeholders

  • Add @coderabbitai ignore anywhere in the PR description to prevent this PR from being reviewed.
  • Add @coderabbitai summary to generate the high-level summary at a specific location in the PR description.
  • Add @coderabbitai anywhere in the PR title to generate the title automatically.

CodeRabbit Configuration File (.coderabbit.yaml)

  • You can programmatically configure CodeRabbit by adding a .coderabbit.yaml file to the root of your repository.
  • Please see the configuration documentation for more information.
  • If your editor has YAML language server enabled, you can add the path at the top of this file to enable auto-completion and validation: # yaml-language-server: $schema=https://coderabbit.ai/integrations/schema.v2.json

Documentation and Community

  • Visit our Documentation for detailed information on how to use CodeRabbit.
  • Join our Discord Community to get help, request features, and share feedback.
  • Follow us on X/Twitter for updates and announcements.

Copy link

pkg-pr-new bot commented Jul 1, 2025

Open in StackBlitz

@clerk/agent-toolkit

npm i https://pkg.pr.new/@clerk/agent-toolkit@6229

@clerk/astro

npm i https://pkg.pr.new/@clerk/astro@6229

@clerk/backend

npm i https://pkg.pr.new/@clerk/backend@6229

@clerk/chrome-extension

npm i https://pkg.pr.new/@clerk/chrome-extension@6229

@clerk/clerk-js

npm i https://pkg.pr.new/@clerk/clerk-js@6229

@clerk/dev-cli

npm i https://pkg.pr.new/@clerk/dev-cli@6229

@clerk/elements

npm i https://pkg.pr.new/@clerk/elements@6229

@clerk/clerk-expo

npm i https://pkg.pr.new/@clerk/clerk-expo@6229

@clerk/expo-passkeys

npm i https://pkg.pr.new/@clerk/expo-passkeys@6229

@clerk/express

npm i https://pkg.pr.new/@clerk/express@6229

@clerk/fastify

npm i https://pkg.pr.new/@clerk/fastify@6229

@clerk/localizations

npm i https://pkg.pr.new/@clerk/localizations@6229

@clerk/nextjs

npm i https://pkg.pr.new/@clerk/nextjs@6229

@clerk/nuxt

npm i https://pkg.pr.new/@clerk/nuxt@6229

@clerk/clerk-react

npm i https://pkg.pr.new/@clerk/clerk-react@6229

@clerk/react-router

npm i https://pkg.pr.new/@clerk/react-router@6229

@clerk/remix

npm i https://pkg.pr.new/@clerk/remix@6229

@clerk/shared

npm i https://pkg.pr.new/@clerk/shared@6229

@clerk/tanstack-react-start

npm i https://pkg.pr.new/@clerk/tanstack-react-start@6229

@clerk/testing

npm i https://pkg.pr.new/@clerk/testing@6229

@clerk/themes

npm i https://pkg.pr.new/@clerk/themes@6229

@clerk/types

npm i https://pkg.pr.new/@clerk/types@6229

@clerk/upgrade

npm i https://pkg.pr.new/@clerk/upgrade@6229

@clerk/vue

npm i https://pkg.pr.new/@clerk/vue@6229

commit: 0f7387d

Copy link
Contributor

@coderabbitai coderabbitai bot left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Actionable comments posted: 2

📜 Review details

Configuration used: CodeRabbit UI
Review profile: CHILL
Plan: Pro

📥 Commits

Reviewing files that changed from the base of the PR and between 3b4b3cb and fa94227.

📒 Files selected for processing (4)
  • .changeset/hot-tables-worry.md (1 hunks)
  • packages/backend/src/api/endpoints/MachineTokensApi.ts (1 hunks)
  • packages/backend/src/api/factory.ts (1 hunks)
  • packages/backend/src/api/request.ts (1 hunks)
🧰 Additional context used
📓 Path-based instructions (5)
`**/*.{js,jsx,ts,tsx}`: All code must pass ESLint checks with the project's conf...

**/*.{js,jsx,ts,tsx}: All code must pass ESLint checks with the project's configuration
Use Prettier for consistent code formatting
Follow established naming conventions (PascalCase for components, camelCase for variables)
Maintain comprehensive JSDoc comments for public APIs
Use dynamic imports for optional features
All public APIs must be documented with JSDoc
Lazy load components and features when possible
Implement proper caching strategies
Use efficient data structures and algorithms
Validate all inputs and sanitize outputs
Implement proper logging with different levels

📄 Source: CodeRabbit Inference Engine (.cursor/rules/development.mdc)

List of files the instruction was applied to:

  • packages/backend/src/api/request.ts
  • packages/backend/src/api/factory.ts
  • packages/backend/src/api/endpoints/MachineTokensApi.ts
`packages/**/*.ts`: TypeScript is required for all packages

packages/**/*.ts: TypeScript is required for all packages

📄 Source: CodeRabbit Inference Engine (.cursor/rules/development.mdc)

List of files the instruction was applied to:

  • packages/backend/src/api/request.ts
  • packages/backend/src/api/factory.ts
  • packages/backend/src/api/endpoints/MachineTokensApi.ts
`packages/**/*.{ts,tsx,d.ts}`: Packages should export TypeScript types alongside runtime code

packages/**/*.{ts,tsx,d.ts}: Packages should export TypeScript types alongside runtime code

📄 Source: CodeRabbit Inference Engine (.cursor/rules/development.mdc)

List of files the instruction was applied to:

  • packages/backend/src/api/request.ts
  • packages/backend/src/api/factory.ts
  • packages/backend/src/api/endpoints/MachineTokensApi.ts
`**/*.{ts,tsx}`: Use proper TypeScript error types

**/*.{ts,tsx}: Use proper TypeScript error types

📄 Source: CodeRabbit Inference Engine (.cursor/rules/development.mdc)

List of files the instruction was applied to:

  • packages/backend/src/api/request.ts
  • packages/backend/src/api/factory.ts
  • packages/backend/src/api/endpoints/MachineTokensApi.ts
`**/*.{ts,tsx}`: Always define explicit return types for functions, especially p...

**/*.{ts,tsx}: Always define explicit return types for functions, especially public APIs
Use proper type annotations for variables and parameters where inference isn't clear
Avoid any type - prefer unknown when type is uncertain, then narrow with type guards
Use interface for object shapes that might be extended
Use type for unions, primitives, and computed types
Prefer readonly properties for immutable data structures
Use private for internal implementation details
Use protected for inheritance hierarchies
Use public explicitly for clarity in public APIs
Prefer readonly for properties that shouldn't change after construction
Use mapped types for transforming object types
Use conditional types for type-level logic
Leverage template literal types for string manipulation
Use ES6 imports/exports consistently
Use default exports sparingly, prefer named exports
Document public functions and APIs with JSDoc-style comments including @param, @returns, @throws, and @example
Define custom error classes for domain-specific errors
Use the Result pattern for error handling instead of throwing exceptions
Use optional chaining and nullish coalescing for safe property access
Let TypeScript infer types when types are obvious
Use const assertions for literal types: as const
Use satisfies operator for type checking without widening
Use readonly arrays and objects for immutability
Use immutable update patterns (spread, etc.) for objects and arrays
Use lazy loading for large types
Prefer unknown over any for performance
Use type-only imports: import type { ... }
Use branded types for domain safety
No any types without justification
Proper error handling with typed errors
Consistent use of readonly for immutable data
Proper generic constraints in TypeScript generics
No unused type parameters in generics
Proper use of utility types instead of manual type construction
Type-only imports where possible for performance
Proper tree-shaking friendly exports
No circular dependencies
Efficient type computations (avoid deep recursion)

📄 Source: CodeRabbit Inference Engine (.cursor/rules/typescript.mdc)

List of files the instruction was applied to:

  • packages/backend/src/api/request.ts
  • packages/backend/src/api/factory.ts
  • packages/backend/src/api/endpoints/MachineTokensApi.ts
🧠 Learnings (5)
📓 Common learnings
Learnt from: dstaley
PR: clerk/javascript#6116
File: .changeset/tangy-garlics-say.md:1-2
Timestamp: 2025-06-13T16:09:53.061Z
Learning: In the Clerk JavaScript repository, contributors create intentionally empty changeset files (containing only the YAML delimiters) when a PR touches only non-published parts of the codebase (e.g., sandbox assets). This signals that no package release is required, so such changesets should not be flagged as missing content.
Learnt from: wobsoriano
PR: clerk/javascript#6099
File: packages/backend/src/api/endpoints/IdPOAuthAccessTokenApi.ts:7-14
Timestamp: 2025-06-10T20:38:08.982Z
Learning: Methods in `packages/backend/src/api/endpoints` (e.g., `IdPOAuthAccessTokenApi.verifySecret`) are currently not exposed publicly, so renaming them does not constitute a breaking change.
Learnt from: CR
PR: clerk/javascript#0
File: .cursor/rules/development.mdc:0-0
Timestamp: 2025-06-30T10:29:42.997Z
Learning: Update documentation for API changes
Learnt from: wobsoriano
PR: clerk/javascript#6163
File: packages/backend/src/api/endpoints/APIKeysApi.ts:60-70
Timestamp: 2025-06-20T17:44:17.570Z
Learning: The Clerk codebase uses POST method for API key update operations instead of the typical PATCH method, as clarified by the maintainer wobsoriano.
packages/backend/src/api/request.ts (1)
Learnt from: wobsoriano
PR: clerk/javascript#6099
File: packages/backend/src/api/endpoints/IdPOAuthAccessTokenApi.ts:7-14
Timestamp: 2025-06-10T20:38:08.982Z
Learning: Methods in `packages/backend/src/api/endpoints` (e.g., `IdPOAuthAccessTokenApi.verifySecret`) are currently not exposed publicly, so renaming them does not constitute a breaking change.
.changeset/hot-tables-worry.md (4)
Learnt from: dstaley
PR: clerk/javascript#6116
File: .changeset/tangy-garlics-say.md:1-2
Timestamp: 2025-06-13T16:09:53.061Z
Learning: In the Clerk JavaScript repository, contributors create intentionally empty changeset files (containing only the YAML delimiters) when a PR touches only non-published parts of the codebase (e.g., sandbox assets). This signals that no package release is required, so such changesets should not be flagged as missing content.
Learnt from: CR
PR: clerk/javascript#0
File: .cursor/rules/monorepo.mdc:0-0
Timestamp: 2025-06-30T10:30:56.197Z
Learning: Applies to .changeset/config.json : Automated releases must be managed with Changesets.
Learnt from: CR
PR: clerk/javascript#0
File: .cursor/rules/development.mdc:0-0
Timestamp: 2025-06-30T10:29:42.997Z
Learning: Use Changesets for version management and changelogs
Learnt from: jacekradko
PR: clerk/javascript#5905
File: .changeset/six-ears-wash.md:1-3
Timestamp: 2025-06-26T03:27:05.535Z
Learning: In the Clerk JavaScript repository, changeset headers support single quotes syntax (e.g., '@clerk/backend': minor) and work fine with their current changesets integration, so there's no need to change them to double quotes.
packages/backend/src/api/factory.ts (1)
Learnt from: wobsoriano
PR: clerk/javascript#6099
File: packages/backend/src/api/endpoints/IdPOAuthAccessTokenApi.ts:7-14
Timestamp: 2025-06-10T20:38:08.982Z
Learning: Methods in `packages/backend/src/api/endpoints` (e.g., `IdPOAuthAccessTokenApi.verifySecret`) are currently not exposed publicly, so renaming them does not constitute a breaking change.
packages/backend/src/api/endpoints/MachineTokensApi.ts (3)
Learnt from: wobsoriano
PR: clerk/javascript#6099
File: packages/backend/src/api/endpoints/IdPOAuthAccessTokenApi.ts:7-14
Timestamp: 2025-06-10T20:38:08.982Z
Learning: Methods in `packages/backend/src/api/endpoints` (e.g., `IdPOAuthAccessTokenApi.verifySecret`) are currently not exposed publicly, so renaming them does not constitute a breaking change.
Learnt from: CR
PR: clerk/javascript#0
File: .cursor/rules/development.mdc:0-0
Timestamp: 2025-06-30T10:29:42.997Z
Learning: Update documentation for API changes
Learnt from: wobsoriano
PR: clerk/javascript#5858
File: packages/clerk-js/src/core/modules/apiKeys/index.ts:84-97
Timestamp: 2025-06-10T17:35:08.986Z
Learning: In the APIKeys service methods (packages/clerk-js/src/core/modules/apiKeys/index.ts), error handling is intentionally delegated to the component level rather than being implemented within the service methods themselves. This architectural pattern allows calling components to handle errors according to their specific UI needs.
⏰ Context from checks skipped due to timeout of 90000ms (24)
  • GitHub Check: Integration Tests (nextjs, chrome, 14)
  • GitHub Check: Integration Tests (billing, chrome)
  • GitHub Check: Integration Tests (nextjs, chrome, 15)
  • GitHub Check: Integration Tests (tanstack-react-router, chrome)
  • GitHub Check: Integration Tests (tanstack-react-start, chrome)
  • GitHub Check: Integration Tests (nextjs, chrome, 13)
  • GitHub Check: Integration Tests (react-router, chrome)
  • GitHub Check: Integration Tests (nuxt, chrome)
  • GitHub Check: Integration Tests (vue, chrome)
  • GitHub Check: Integration Tests (localhost, chrome)
  • GitHub Check: Integration Tests (quickstart, chrome)
  • GitHub Check: Integration Tests (expo-web, chrome)
  • GitHub Check: Integration Tests (express, chrome)
  • GitHub Check: Integration Tests (ap-flows, chrome)
  • GitHub Check: Integration Tests (astro, chrome)
  • GitHub Check: Integration Tests (sessions, chrome)
  • GitHub Check: Integration Tests (elements, chrome)
  • GitHub Check: Integration Tests (generic, chrome)
  • GitHub Check: Publish with pkg-pr-new
  • GitHub Check: Unit Tests (18, --filter=@clerk/astro --filter=@clerk/backend --filter=@clerk/express --filter=@c...
  • GitHub Check: Unit Tests (22, **)
  • GitHub Check: Static analysis
  • GitHub Check: semgrep-cloud-platform/scan
  • GitHub Check: Analyze (javascript-typescript)
🔇 Additional comments (5)
.changeset/hot-tables-worry.md (1)

1-6: LGTM! Changeset correctly specifies minor version bump.

The changeset is properly formatted and appropriately specifies a minor version bump for the new M2M tokens functionality.

packages/backend/src/api/request.ts (1)

111-113: LGTM! Prevents overwriting existing Authorization headers.

This change correctly prevents the default secretKey from overwriting an existing Authorization header, enabling the new M2M token functionality where methods can set their own authorization headers.

packages/backend/src/api/factory.ts (1)

71-71: LGTM! Correctly configures MachineTokensApi to not require secret key.

This configuration allows M2M token operations to use their own authorization mechanism via machineTokenSecret instead of requiring the global secret key.

packages/backend/src/api/endpoints/MachineTokensApi.ts (2)

8-29: LGTM! Well-designed type definitions following TypeScript best practices.

The utility type WithMachineTokenSecret<T> provides good reusability, and the parameter types are properly structured with clear field definitions.


63-63: LGTM! Proper ID validation using inherited requireId method.

Both update and revoke methods correctly validate the m2mTokenId parameter using the inherited requireId method before proceeding with the request.

Also applies to: 78-78

@wobsoriano wobsoriano marked this pull request as ready for review July 1, 2025 21:58
Copy link
Contributor

@coderabbitai coderabbitai bot left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Actionable comments posted: 2

🧹 Nitpick comments (5)
packages/backend/src/api/endpoints/MachineTokensApi.ts (4)

54-66: Add explicit return type for better TypeScript compliance.

The method correctly implements the new parameter object pattern, but coding guidelines require explicit return types for public API functions.

-  async create(params: CreateMachineTokenParams) {
+  async create(params: CreateMachineTokenParams): Promise<MachineToken> {

68-81: Add explicit return type for consistency.

The method correctly implements parameter validation and the new parameter object pattern.

-  async update(params: UpdateMachineTokenParams) {
+  async update(params: UpdateMachineTokenParams): Promise<MachineToken> {

83-96: Add explicit return type for consistency.

The method correctly implements parameter validation and the new parameter object pattern.

-  async revoke(params: RevokeMachineTokenParams) {
+  async revoke(params: RevokeMachineTokenParams): Promise<MachineToken> {

98-110: Add explicit return type for consistency.

The method correctly implements the new parameter object pattern and maintains backward compatibility while adding machine secret support.

-  async verifySecret(params: VerifyMachineTokenParams) {
+  async verifySecret(params: VerifyMachineTokenParams): Promise<MachineToken> {
packages/backend/src/api/endpoints/MachineApi.ts (1)

28-69: Add explicit return types for all public API methods.

The methods correctly implement REST patterns and use appropriate HTTP methods with proper parameter validation. However, coding guidelines require explicit return types for public API functions.

-  async list(queryParams: GetMachineListParams = {}) {
+  async list(queryParams: GetMachineListParams = {}): Promise<PaginatedResourceResponse<Machine[]>> {
     return this.request<PaginatedResourceResponse<Machine[]>>({

-  async create(bodyParams: CreateMachineParams) {
+  async create(bodyParams: CreateMachineParams): Promise<Machine> {
     return this.request<Machine>({

-  async update(params: UpdateMachineParams) {
+  async update(params: UpdateMachineParams): Promise<Machine> {
     const { machineId, ...bodyParams } = params;

-  async delete(params: DeleteMachineParams) {
+  async delete(params: DeleteMachineParams): Promise<Machine> {
     const { machineId } = params;

-  async get(machineId: string) {
+  async get(machineId: string): Promise<Machine> {
     this.requireId(machineId);
📜 Review details

Configuration used: CodeRabbit UI
Review profile: CHILL
Plan: Pro

📥 Commits

Reviewing files that changed from the base of the PR and between 9dab708 and e900e13.

📒 Files selected for processing (9)
  • packages/backend/src/api/endpoints/MachineApi.ts (1 hunks)
  • packages/backend/src/api/endpoints/MachineTokensApi.ts (1 hunks)
  • packages/backend/src/api/endpoints/index.ts (1 hunks)
  • packages/backend/src/api/factory.ts (2 hunks)
  • packages/backend/src/api/resources/Deserializer.ts (2 hunks)
  • packages/backend/src/api/resources/JSON.ts (2 hunks)
  • packages/backend/src/api/resources/Machine.ts (1 hunks)
  • packages/backend/src/api/resources/MachineToken.ts (2 hunks)
  • packages/backend/src/api/resources/index.ts (1 hunks)
✅ Files skipped from review due to trivial changes (2)
  • packages/backend/src/api/resources/index.ts
  • packages/backend/src/api/endpoints/index.ts
🚧 Files skipped from review as they are similar to previous changes (3)
  • packages/backend/src/api/factory.ts
  • packages/backend/src/api/resources/MachineToken.ts
  • packages/backend/src/api/resources/JSON.ts
🧰 Additional context used
📓 Path-based instructions (6)
`**/*.{js,jsx,ts,tsx}`: All code must pass ESLint checks with the project's conf...

**/*.{js,jsx,ts,tsx}: All code must pass ESLint checks with the project's configuration
Use Prettier for consistent code formatting
Follow established naming conventions (PascalCase for components, camelCase for variables)
Maintain comprehensive JSDoc comments for public APIs
Use dynamic imports for optional features
All public APIs must be documented with JSDoc
Lazy load components and features when possible
Implement proper caching strategies
Use efficient data structures and algorithms
Validate all inputs and sanitize outputs
Implement proper logging with different levels

📄 Source: CodeRabbit Inference Engine (.cursor/rules/development.mdc)

List of files the instruction was applied to:

  • packages/backend/src/api/resources/Machine.ts
  • packages/backend/src/api/resources/Deserializer.ts
  • packages/backend/src/api/endpoints/MachineTokensApi.ts
  • packages/backend/src/api/endpoints/MachineApi.ts
`packages/**/*.ts`: TypeScript is required for all packages

packages/**/*.ts: TypeScript is required for all packages

📄 Source: CodeRabbit Inference Engine (.cursor/rules/development.mdc)

List of files the instruction was applied to:

  • packages/backend/src/api/resources/Machine.ts
  • packages/backend/src/api/resources/Deserializer.ts
  • packages/backend/src/api/endpoints/MachineTokensApi.ts
  • packages/backend/src/api/endpoints/MachineApi.ts
`packages/**/*.{ts,tsx,d.ts}`: Packages should export TypeScript types alongside runtime code

packages/**/*.{ts,tsx,d.ts}: Packages should export TypeScript types alongside runtime code

📄 Source: CodeRabbit Inference Engine (.cursor/rules/development.mdc)

List of files the instruction was applied to:

  • packages/backend/src/api/resources/Machine.ts
  • packages/backend/src/api/resources/Deserializer.ts
  • packages/backend/src/api/endpoints/MachineTokensApi.ts
  • packages/backend/src/api/endpoints/MachineApi.ts
`**/*.{ts,tsx}`: Use proper TypeScript error types

**/*.{ts,tsx}: Use proper TypeScript error types

📄 Source: CodeRabbit Inference Engine (.cursor/rules/development.mdc)

List of files the instruction was applied to:

  • packages/backend/src/api/resources/Machine.ts
  • packages/backend/src/api/resources/Deserializer.ts
  • packages/backend/src/api/endpoints/MachineTokensApi.ts
  • packages/backend/src/api/endpoints/MachineApi.ts
`**/*.{ts,tsx}`: Always define explicit return types for functions, especially p...

**/*.{ts,tsx}: Always define explicit return types for functions, especially public APIs
Use proper type annotations for variables and parameters where inference isn't clear
Avoid any type - prefer unknown when type is uncertain, then narrow with type guards
Use interface for object shapes that might be extended
Use type for unions, primitives, and computed types
Prefer readonly properties for immutable data structures
Use private for internal implementation details
Use protected for inheritance hierarchies
Use public explicitly for clarity in public APIs
Prefer readonly for properties that shouldn't change after construction
Use mapped types for transforming object types
Use conditional types for type-level logic
Leverage template literal types for string manipulation
Use ES6 imports/exports consistently
Use default exports sparingly, prefer named exports
Document public functions and APIs with JSDoc-style comments including @param, @returns, @throws, and @example
Define custom error classes for domain-specific errors
Use the Result pattern for error handling instead of throwing exceptions
Use optional chaining and nullish coalescing for safe property access
Let TypeScript infer types when types are obvious
Use const assertions for literal types: as const
Use satisfies operator for type checking without widening
Use readonly arrays and objects for immutability
Use immutable update patterns (spread, etc.) for objects and arrays
Use lazy loading for large types
Prefer unknown over any for performance
Use type-only imports: import type { ... }
Use branded types for domain safety
No any types without justification
Proper error handling with typed errors
Consistent use of readonly for immutable data
Proper generic constraints in TypeScript generics
No unused type parameters in generics
Proper use of utility types instead of manual type construction
Type-only imports where possible for performance
Proper tree-shaking friendly exports
No circular dependencies
Efficient type computations (avoid deep recursion)

📄 Source: CodeRabbit Inference Engine (.cursor/rules/typescript.mdc)

List of files the instruction was applied to:

  • packages/backend/src/api/resources/Machine.ts
  • packages/backend/src/api/resources/Deserializer.ts
  • packages/backend/src/api/endpoints/MachineTokensApi.ts
  • packages/backend/src/api/endpoints/MachineApi.ts
`**/*.ts`: If there are no tests added or modified as part of the PR, please suggest that tests be added to cover the changes.

**/*.ts: If there are no tests added or modified as part of the PR, please suggest that tests be added to cover the changes.

⚙️ Source: CodeRabbit Configuration File

List of files the instruction was applied to:

  • packages/backend/src/api/resources/Machine.ts
  • packages/backend/src/api/resources/Deserializer.ts
  • packages/backend/src/api/endpoints/MachineTokensApi.ts
  • packages/backend/src/api/endpoints/MachineApi.ts
🧠 Learnings (5)
📓 Common learnings
Learnt from: wobsoriano
PR: clerk/javascript#6229
File: packages/backend/src/api/endpoints/MachineTokensApi.ts:47-89
Timestamp: 2025-07-01T15:20:41.834Z
Learning: In the Clerk JavaScript repository, for the MachineTokensApi class (packages/backend/src/api/endpoints/MachineTokensApi.ts), the maintainers prefer to rely on TypeScript types and readable property names for API documentation rather than JSDoc comments.
Learnt from: dstaley
PR: clerk/javascript#6116
File: .changeset/tangy-garlics-say.md:1-2
Timestamp: 2025-06-13T16:09:53.061Z
Learning: In the Clerk JavaScript repository, contributors create intentionally empty changeset files (containing only the YAML delimiters) when a PR touches only non-published parts of the codebase (e.g., sandbox assets). This signals that no package release is required, so such changesets should not be flagged as missing content.
Learnt from: wobsoriano
PR: clerk/javascript#6229
File: packages/backend/src/api/endpoints/MachineTokensApi.ts:32-45
Timestamp: 2025-07-01T15:20:59.456Z
Learning: In the MachineTokensApi class (packages/backend/src/api/endpoints/MachineTokensApi.ts), the #withMachineTokenSecretHeader method intentionally overwrites the entire headerParams object with only the Authorization header when machineTokenSecret is provided, rather than merging with existing headers. This is by design to ensure only the Authorization header is present in requests.
Learnt from: wobsoriano
PR: clerk/javascript#6099
File: packages/backend/src/api/endpoints/IdPOAuthAccessTokenApi.ts:7-14
Timestamp: 2025-06-10T20:38:08.982Z
Learning: Methods in `packages/backend/src/api/endpoints` (e.g., `IdPOAuthAccessTokenApi.verifySecret`) are currently not exposed publicly, so renaming them does not constitute a breaking change.
Learnt from: CR
PR: clerk/javascript#0
File: .cursor/rules/development.mdc:0-0
Timestamp: 2025-06-30T10:29:42.997Z
Learning: Update documentation for API changes
packages/backend/src/api/resources/Machine.ts (2)
Learnt from: wobsoriano
PR: clerk/javascript#6229
File: packages/backend/src/api/endpoints/MachineTokensApi.ts:47-89
Timestamp: 2025-07-01T15:20:41.834Z
Learning: In the Clerk JavaScript repository, for the MachineTokensApi class (packages/backend/src/api/endpoints/MachineTokensApi.ts), the maintainers prefer to rely on TypeScript types and readable property names for API documentation rather than JSDoc comments.
Learnt from: wobsoriano
PR: clerk/javascript#6229
File: packages/backend/src/api/endpoints/MachineTokensApi.ts:32-45
Timestamp: 2025-07-01T15:20:59.456Z
Learning: In the MachineTokensApi class (packages/backend/src/api/endpoints/MachineTokensApi.ts), the #withMachineTokenSecretHeader method intentionally overwrites the entire headerParams object with only the Authorization header when machineTokenSecret is provided, rather than merging with existing headers. This is by design to ensure only the Authorization header is present in requests.
packages/backend/src/api/resources/Deserializer.ts (1)
Learnt from: wobsoriano
PR: clerk/javascript#6229
File: packages/backend/src/api/endpoints/MachineTokensApi.ts:47-89
Timestamp: 2025-07-01T15:20:41.834Z
Learning: In the Clerk JavaScript repository, for the MachineTokensApi class (packages/backend/src/api/endpoints/MachineTokensApi.ts), the maintainers prefer to rely on TypeScript types and readable property names for API documentation rather than JSDoc comments.
packages/backend/src/api/endpoints/MachineTokensApi.ts (27)
Learnt from: wobsoriano
PR: clerk/javascript#6229
File: packages/backend/src/api/endpoints/MachineTokensApi.ts:32-45
Timestamp: 2025-07-01T15:20:59.456Z
Learning: In the MachineTokensApi class (packages/backend/src/api/endpoints/MachineTokensApi.ts), the #withMachineTokenSecretHeader method intentionally overwrites the entire headerParams object with only the Authorization header when machineTokenSecret is provided, rather than merging with existing headers. This is by design to ensure only the Authorization header is present in requests.
Learnt from: wobsoriano
PR: clerk/javascript#6229
File: packages/backend/src/api/endpoints/MachineTokensApi.ts:47-89
Timestamp: 2025-07-01T15:20:41.834Z
Learning: In the Clerk JavaScript repository, for the MachineTokensApi class (packages/backend/src/api/endpoints/MachineTokensApi.ts), the maintainers prefer to rely on TypeScript types and readable property names for API documentation rather than JSDoc comments.
Learnt from: wobsoriano
PR: clerk/javascript#6099
File: packages/backend/src/api/endpoints/IdPOAuthAccessTokenApi.ts:7-14
Timestamp: 2025-06-10T20:38:08.982Z
Learning: Methods in `packages/backend/src/api/endpoints` (e.g., `IdPOAuthAccessTokenApi.verifySecret`) are currently not exposed publicly, so renaming them does not constitute a breaking change.
Learnt from: CR
PR: clerk/javascript#0
File: .cursor/rules/development.mdc:0-0
Timestamp: 2025-06-30T10:29:42.997Z
Learning: Update documentation for API changes
Learnt from: wobsoriano
PR: clerk/javascript#5858
File: packages/clerk-js/src/core/modules/apiKeys/index.ts:84-97
Timestamp: 2025-06-10T17:35:08.986Z
Learning: In the APIKeys service methods (packages/clerk-js/src/core/modules/apiKeys/index.ts), error handling is intentionally delegated to the component level rather than being implemented within the service methods themselves. This architectural pattern allows calling components to handle errors according to their specific UI needs.
Learnt from: wobsoriano
PR: clerk/javascript#6123
File: packages/nextjs/src/server/__tests__/getAuthDataFromRequest.test.ts:63-75
Timestamp: 2025-06-16T01:27:54.563Z
Learning: In packages/nextjs/src/server/data/getAuthDataFromRequest.ts, the tokenType behavior on mismatch is intentionally different between array and single acceptsToken values: when acceptsToken is an array and the token type doesn't match any in the array, tokenType returns null; when acceptsToken is a single value and the token type doesn't match, tokenType returns the requested single value. This design aligns with developer intent and provides a more ergonomic API for common use cases.
Learnt from: CR
PR: clerk/javascript#0
File: .cursor/rules/development.mdc:0-0
Timestamp: 2025-06-30T10:29:42.997Z
Learning: Applies to **/*.{js,jsx,ts,tsx} : All public APIs must be documented with JSDoc
Learnt from: CR
PR: clerk/javascript#0
File: .cursor/rules/development.mdc:0-0
Timestamp: 2025-06-30T10:29:42.997Z
Learning: Applies to **/*.{js,jsx,ts,tsx} : Maintain comprehensive JSDoc comments for public APIs
Learnt from: CR
PR: clerk/javascript#0
File: .cursor/rules/typescript.mdc:0-0
Timestamp: 2025-06-30T10:33:45.961Z
Learning: Applies to **/*.{ts,tsx} : Document public functions and APIs with JSDoc-style comments including @param, @returns, @throws, and @example
Learnt from: CR
PR: clerk/javascript#0
File: .cursor/rules/development.mdc:0-0
Timestamp: 2025-06-30T10:29:42.997Z
Learning: Use TypeDoc for generating API documentation
Learnt from: CR
PR: clerk/javascript#0
File: .cursor/rules/nextjs.mdc:0-0
Timestamp: 2025-06-30T10:31:43.578Z
Learning: Applies to app/api/**/*.ts : Document API endpoints with TypeScript interfaces
Learnt from: CR
PR: clerk/javascript#0
File: .cursor/rules/typescript.mdc:0-0
Timestamp: 2025-06-30T10:33:45.961Z
Learning: Applies to **/*.{ts,tsx} : Always define explicit return types for functions, especially public APIs
Learnt from: CR
PR: clerk/javascript#0
File: .cursor/rules/typescript.mdc:0-0
Timestamp: 2025-06-30T10:33:45.961Z
Learning: Applies to **/*.{ts,tsx} : Use `public` explicitly for clarity in public APIs
Learnt from: CR
PR: clerk/javascript#0
File: .cursor/rules/react.mdc:0-0
Timestamp: 2025-06-30T10:32:37.848Z
Learning: Applies to **/*.{jsx,tsx} : Use proper prop naming
Learnt from: CR
PR: clerk/javascript#0
File: .cursor/rules/typescript.mdc:0-0
Timestamp: 2025-06-30T10:33:45.961Z
Learning: Applies to **/*.{ts,tsx} : Prefer `readonly` properties for immutable data structures
Learnt from: CR
PR: clerk/javascript#0
File: .cursor/rules/typescript.mdc:0-0
Timestamp: 2025-06-30T10:33:45.961Z
Learning: Applies to **/*.{ts,tsx} : Proper use of utility types instead of manual type construction
Learnt from: CR
PR: clerk/javascript#0
File: .cursor/rules/typescript.mdc:0-0
Timestamp: 2025-06-30T10:33:45.961Z
Learning: Applies to **/*.{ts,tsx} : Prefer `readonly` for properties that shouldn't change after construction
Learnt from: CR
PR: clerk/javascript#0
File: .cursor/rules/typescript.mdc:0-0
Timestamp: 2025-06-30T10:33:45.961Z
Learning: Applies to **/*.{ts,tsx} : Consistent use of `readonly` for immutable data
Learnt from: CR
PR: clerk/javascript#0
File: .cursor/rules/react.mdc:0-0
Timestamp: 2025-06-30T10:32:37.848Z
Learning: Applies to **/*.tsx : Use proper type definitions for props and state
Learnt from: CR
PR: clerk/javascript#0
File: .cursor/rules/typescript.mdc:0-0
Timestamp: 2025-06-30T10:33:45.961Z
Learning: Applies to **/*.{ts,tsx} : Use readonly arrays and objects for immutability
Learnt from: CR
PR: clerk/javascript#0
File: .cursor/rules/react.mdc:0-0
Timestamp: 2025-06-30T10:32:37.848Z
Learning: Applies to **/*.{jsx,tsx} : Implement proper state naming
Learnt from: CR
PR: clerk/javascript#0
File: .cursor/rules/typescript.mdc:0-0
Timestamp: 2025-06-30T10:33:45.961Z
Learning: Applies to **/*.{ts,tsx} : Use `type` for unions, primitives, and computed types
Learnt from: CR
PR: clerk/javascript#0
File: .cursor/rules/typescript.mdc:0-0
Timestamp: 2025-06-30T10:33:45.961Z
Learning: Applies to **/*.{ts,tsx} : Use branded types for domain safety
Learnt from: dstaley
PR: clerk/javascript#6116
File: .changeset/tangy-garlics-say.md:1-2
Timestamp: 2025-06-13T16:09:53.061Z
Learning: In the Clerk JavaScript repository, contributors create intentionally empty changeset files (containing only the YAML delimiters) when a PR touches only non-published parts of the codebase (e.g., sandbox assets). This signals that no package release is required, so such changesets should not be flagged as missing content.
Learnt from: jacekradko
PR: clerk/javascript#5905
File: .changeset/six-ears-wash.md:1-3
Timestamp: 2025-06-26T03:27:05.535Z
Learning: In the Clerk JavaScript repository, changeset headers support single quotes syntax (e.g., '@clerk/backend': minor) and work fine with their current changesets integration, so there's no need to change them to double quotes.
Learnt from: wobsoriano
PR: clerk/javascript#6163
File: packages/backend/src/api/endpoints/APIKeysApi.ts:60-70
Timestamp: 2025-06-20T17:44:17.570Z
Learning: The Clerk codebase uses POST method for API key update operations instead of the typical PATCH method, as clarified by the maintainer wobsoriano.
Learnt from: bratsos
PR: clerk/javascript#6259
File: packages/clerk-js/src/ui/components/SignUp/signUpFormHelpers.ts:377-379
Timestamp: 2025-07-07T16:57:10.869Z
Learning: In the Clerk JavaScript repository, when working with TypeScript decision tables or rule-based systems, redundant-looking ternary operators may be intentionally kept for TypeScript type narrowing when the compiler cannot infer that a value is non-null despite conditional checks. This is a pragmatic approach to handle TypeScript's type system limitations without overcomplicating the code.
packages/backend/src/api/endpoints/MachineApi.ts (4)
Learnt from: wobsoriano
PR: clerk/javascript#6229
File: packages/backend/src/api/endpoints/MachineTokensApi.ts:47-89
Timestamp: 2025-07-01T15:20:41.834Z
Learning: In the Clerk JavaScript repository, for the MachineTokensApi class (packages/backend/src/api/endpoints/MachineTokensApi.ts), the maintainers prefer to rely on TypeScript types and readable property names for API documentation rather than JSDoc comments.
Learnt from: wobsoriano
PR: clerk/javascript#6229
File: packages/backend/src/api/endpoints/MachineTokensApi.ts:32-45
Timestamp: 2025-07-01T15:20:59.456Z
Learning: In the MachineTokensApi class (packages/backend/src/api/endpoints/MachineTokensApi.ts), the #withMachineTokenSecretHeader method intentionally overwrites the entire headerParams object with only the Authorization header when machineTokenSecret is provided, rather than merging with existing headers. This is by design to ensure only the Authorization header is present in requests.
Learnt from: CR
PR: clerk/javascript#0
File: .cursor/rules/nextjs.mdc:0-0
Timestamp: 2025-06-30T10:31:43.578Z
Learning: Applies to app/api/**/*.ts : Document API endpoints with TypeScript interfaces
Learnt from: CR
PR: clerk/javascript#0
File: .cursor/rules/nextjs.mdc:0-0
Timestamp: 2025-06-30T10:31:43.578Z
Learning: Applies to app/api/**/*.ts : Use TypeScript interfaces for API response types
🧬 Code Graph Analysis (3)
packages/backend/src/api/resources/Machine.ts (1)
packages/backend/src/api/resources/JSON.ts (1)
  • MachineJSON (702-709)
packages/backend/src/api/resources/Deserializer.ts (2)
packages/backend/src/api/resources/JSON.ts (2)
  • ObjectType (19-66)
  • ObjectType (68-68)
packages/backend/src/api/resources/Machine.ts (1)
  • Machine (3-15)
packages/backend/src/api/endpoints/MachineApi.ts (2)
packages/backend/src/api/resources/Deserializer.ts (1)
  • PaginatedResourceResponse (60-65)
packages/backend/src/api/resources/Machine.ts (1)
  • Machine (3-15)
⏰ Context from checks skipped due to timeout of 90000ms. You can increase the timeout in your CodeRabbit configuration to a maximum of 15 minutes (900000ms). (3)
  • GitHub Check: semgrep-cloud-platform/scan
  • GitHub Check: semgrep/ci
  • GitHub Check: Analyze (javascript-typescript)
🔇 Additional comments (6)
packages/backend/src/api/endpoints/MachineTokensApi.ts (2)

8-33: Well-structured type definitions with good reusability.

The WithMachineSecret utility type provides a clean way to add optional machine secret support across all parameter types. The type definitions are consistent and follow TypeScript best practices.


36-52: Helper method correctly implements machine secret authorization.

The method appropriately handles conditional header injection and follows the intended design pattern of replacing headers with only the Authorization header when machineSecret is provided.

packages/backend/src/api/resources/Deserializer.ts (2)

18-18: Machine import correctly added.

The import is properly placed in alphabetical order and follows the existing import pattern.


136-137: Machine deserialization case correctly implemented.

The case follows the established pattern of using the static fromJSON method and is properly placed in alphabetical order within the switch statement.

packages/backend/src/api/resources/Machine.ts (1)

3-15: Well-structured Machine resource class.

The class follows TypeScript best practices with readonly properties, proper constructor initialization, and consistent camelCase property naming. The fromJSON method correctly maps snake_case JSON properties to camelCase class properties, maintaining consistency with the existing codebase patterns.

packages/backend/src/api/endpoints/MachineApi.ts (1)

8-25: Clean and well-defined parameter types.

The type definitions are descriptive and provide good type safety for the API operations. The GetMachineListParams appropriately supports pagination and search functionality.

Comment on lines 35 to 111
export class MachineTokensApi extends AbstractAPI {
async verifySecret(secret: string) {
return this.request<MachineToken>({
method: 'POST',
path: joinPaths(basePath, 'verify'),
bodyParams: { secret },
});
/**
* Overrides the instance secret with the machine secret.
*/
#withMachineSecretHeader(
options: ClerkBackendApiRequestOptions,
machineSecret?: string | null,
): ClerkBackendApiRequestOptions {
if (machineSecret) {
return {
...options,
headerParams: {
Authorization: `Bearer ${machineSecret}`,
},
};
}
return options;
}

async create(params: CreateMachineTokenParams) {
const { machineSecret, ...bodyParams } = params;
return this.request<MachineToken>(
this.#withMachineSecretHeader(
{
method: 'POST',
path: basePath,
bodyParams,
},
machineSecret,
),
);
}

async update(params: UpdateMachineTokenParams) {
const { m2mTokenId, machineSecret, ...bodyParams } = params;
this.requireId(m2mTokenId);
return this.request<MachineToken>(
this.#withMachineSecretHeader(
{
method: 'PATCH',
path: joinPaths(basePath, m2mTokenId),
bodyParams,
},
machineSecret,
),
);
}

async revoke(params: RevokeMachineTokenParams) {
const { m2mTokenId, machineSecret, ...bodyParams } = params;
this.requireId(m2mTokenId);
return this.request<MachineToken>(
this.#withMachineSecretHeader(
{
method: 'POST',
path: joinPaths(basePath, m2mTokenId, 'revoke'),
bodyParams,
},
machineSecret,
),
);
}

async verifySecret(params: VerifyMachineTokenParams) {
const { secret, machineSecret } = params;
return this.request<MachineToken>(
this.#withMachineSecretHeader(
{
method: 'POST',
path: joinPaths(basePath, 'verify'),
bodyParams: { secret },
},
machineSecret,
),
);
}
}
Copy link
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

💡 Verification agent

❓ Verification inconclusive

Consider adding tests for the refactored API methods.

The significant refactoring of method signatures and addition of machine secret support would benefit from comprehensive test coverage to ensure the new parameter object pattern works correctly and machine secret authorization functions as expected.


🏁 Script executed:

#!/bin/bash
# Search for existing tests for MachineTokensApi to verify test coverage
fd "MachineTokensApi" --type f --extension ts --extension js | grep -i test

Length of output: 75


Let’s check for any references to MachineTokensApi within your test files:


🏁 Script executed:

#!/bin/bash
# Search for references to MachineTokensApi in all test files
rg --files-with-matches 'MachineTokensApi' -g '*.{test,spec}.{ts,tsx,js}'
rg --files-with-matches 'MachineTokensApi' -g '**/__tests__/**/*.{ts,tsx,js}'

Length of output: 151


Add unit tests for MachineTokensApi methods

The refactoring introduces new parameter patterns and machine-secret header logic that currently lack test coverage. Please add tests in packages/backend to ensure:

create, update, revoke, and verifySecret calls
• behavior with and without machineSecret
• correct override of headerParams.Authorization when machineSecret is provided
• preservation of existing headers when machineSecret is absent

🤖 Prompt for AI Agents
In packages/backend/src/api/endpoints/MachineTokensApi.ts from lines 35 to 111,
add unit tests for the MachineTokensApi class methods create, update, revoke,
and verifySecret. The tests should cover calls with and without the
machineSecret parameter, verify that when machineSecret is provided the
headerParams.Authorization is correctly overridden with the Bearer token, and
confirm that existing headers remain unchanged when machineSecret is not
provided. Ensure the tests validate the request options passed to the request
method to confirm the header behavior and parameter handling.

Comment on lines 27 to 70
export class MachineApi extends AbstractAPI {
async list(queryParams: GetMachineListParams = {}) {
return this.request<PaginatedResourceResponse<Machine[]>>({
method: 'GET',
path: basePath,
queryParams,
});
}

async create(bodyParams: CreateMachineParams) {
return this.request<Machine>({
method: 'POST',
path: basePath,
bodyParams,
});
}

async update(params: UpdateMachineParams) {
const { machineId, ...bodyParams } = params;
this.requireId(machineId);
return this.request<Machine>({
method: 'PATCH',
path: joinPaths(basePath, machineId),
bodyParams,
});
}

async delete(params: DeleteMachineParams) {
const { machineId } = params;
this.requireId(machineId);
return this.request<Machine>({
method: 'DELETE',
path: joinPaths(basePath, machineId),
});
}

async get(machineId: string) {
this.requireId(machineId);
return this.request<Machine>({
method: 'GET',
path: joinPaths(basePath, machineId),
});
}
}
Copy link
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

💡 Verification agent

🧩 Analysis chain

Consider adding comprehensive tests for the new MachineApi.

This new API client provides full CRUD operations for machines and would benefit from test coverage to ensure all operations work correctly, including parameter validation and proper HTTP method usage.


🏁 Script executed:

#!/bin/bash
# Search for existing tests for MachineApi to verify test coverage
fd "MachineApi" --type f --extension ts --extension js | grep -i test

Length of output: 69


🏁 Script executed:

#!/bin/bash
# Search within unit and integration test files for references to MachineApi
rg -n "MachineApi" --glob "*.{test,spec}.{ts,tsx,js}" .
rg -n "machine" --glob "*.{test,spec}.{ts,tsx,js}" .

Length of output: 13112


Add unit tests for MachineApi

No existing tests reference the new MachineApi class. Per our testing requirements, please add a Jest/Vitest unit-test suite covering all CRUD methods:

• Create a test file, e.g.
packages/backend/src/api/endpoints/tests/MachineApi.test.ts
• Mock the underlying HTTP request handler and verify:

  • list(queryParams) issues a GET to /machines with proper query params
  • create(body) issues a POST and correctly handles the response
  • update({ machineId, ... }) calls PATCH on /machines/:id, and throws when machineId is missing
  • delete({ machineId }) issues DELETE to /machines/:id, and throws when machineId is missing
  • get(id) issues GET to /machines/:id, and throws when id is missing
    • Assert correct typing of request and response payloads, and error handling
🤖 Prompt for AI Agents
In packages/backend/src/api/endpoints/MachineApi.ts around lines 27 to 70, there
are no unit tests for the MachineApi class. Create a new test file named
MachineApi.test.ts in the __tests__ directory. Mock the HTTP request method used
in MachineApi and write tests for all CRUD methods: verify list sends a GET with
query params to /machines, create sends a POST with body and handles response,
update sends PATCH to /machines/:id and throws if machineId is missing, delete
sends DELETE to /machines/:id and throws if machineId is missing, and get sends
GET to /machines/:id and throws if id is missing. Also, assert correct typing of
request/response payloads and proper error handling in these tests.

@wobsoriano wobsoriano changed the title chore(backend): WIP M2M Tokens feat(backend): WIP M2M Tokens Jul 8, 2025
Copy link
Contributor

@coderabbitai coderabbitai bot left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Actionable comments posted: 1

♻️ Duplicate comments (1)
packages/backend/src/api/endpoints/MachineTokensApi.ts (1)

1-107: Consider adding comprehensive test coverage for the refactored API.

Based on previous review comments, there appears to be insufficient test coverage for these significantly refactored methods. The new parameter object pattern and machine secret authorization logic should be thoroughly tested to ensure:

  • Correct behavior with and without machineSecret parameters
  • Proper authorization header handling
  • Validation of required parameters like m2mTokenId
  • Integration with the existing authentication flow
📜 Review details

Configuration used: CodeRabbit UI
Review profile: CHILL
Plan: Pro

📥 Commits

Reviewing files that changed from the base of the PR and between d87f937 and 7ff0538.

📒 Files selected for processing (1)
  • packages/backend/src/api/endpoints/MachineTokensApi.ts (1 hunks)
🧰 Additional context used
📓 Path-based instructions (7)
**/*.{js,jsx,ts,tsx}

📄 CodeRabbit Inference Engine (.cursor/rules/development.mdc)

**/*.{js,jsx,ts,tsx}: All code must pass ESLint checks with the project's configuration
Follow established naming conventions (PascalCase for components, camelCase for variables)
Maintain comprehensive JSDoc comments for public APIs
Use dynamic imports for optional features
All public APIs must be documented with JSDoc
Provide meaningful error messages to developers
Include error recovery suggestions where applicable
Log errors appropriately for debugging
Lazy load components and features when possible
Implement proper caching strategies
Use efficient data structures and algorithms
Profile and optimize critical paths
Validate all inputs and sanitize outputs
Implement proper logging with different levels

Files:

  • packages/backend/src/api/endpoints/MachineTokensApi.ts
**/*.{js,jsx,ts,tsx,json,css,scss,md,yaml,yml}

📄 CodeRabbit Inference Engine (.cursor/rules/development.mdc)

Use Prettier for consistent code formatting

Files:

  • packages/backend/src/api/endpoints/MachineTokensApi.ts
packages/**/*.{ts,tsx}

📄 CodeRabbit Inference Engine (.cursor/rules/development.mdc)

TypeScript is required for all packages

Files:

  • packages/backend/src/api/endpoints/MachineTokensApi.ts
packages/**/*.{ts,tsx,d.ts}

📄 CodeRabbit Inference Engine (.cursor/rules/development.mdc)

Packages should export TypeScript types alongside runtime code

Files:

  • packages/backend/src/api/endpoints/MachineTokensApi.ts
**/*.{ts,tsx}

📄 CodeRabbit Inference Engine (.cursor/rules/development.mdc)

Use proper TypeScript error types

**/*.{ts,tsx}: Always define explicit return types for functions, especially public APIs
Use proper type annotations for variables and parameters where inference isn't clear
Avoid any type - prefer unknown when type is uncertain, then narrow with type guards
Use interface for object shapes that might be extended
Use type for unions, primitives, and computed types
Prefer readonly properties for immutable data structures
Use private for internal implementation details
Use protected for inheritance hierarchies
Use public explicitly for clarity in public APIs
Prefer readonly for properties that shouldn't change after construction
Prefer composition and interfaces over deep inheritance chains
Use mixins for shared behavior across unrelated classes
Implement dependency injection for loose coupling
Let TypeScript infer when types are obvious
Use const assertions for literal types: as const
Use satisfies operator for type checking without widening
Use mapped types for transforming object types
Use conditional types for type-level logic
Leverage template literal types for string manipulation
Use ES6 imports/exports consistently
Use default exports sparingly, prefer named exports
Use type-only imports: import type { ... } from ...
No any types without justification
Proper error handling with typed errors
Consistent use of readonly for immutable data
Proper generic constraints
No unused type parameters
Proper use of utility types instead of manual type construction
Type-only imports where possible
Proper tree-shaking friendly exports
No circular dependencies
Efficient type computations (avoid deep recursion)

Files:

  • packages/backend/src/api/endpoints/MachineTokensApi.ts
**/*.{js,ts,tsx,jsx}

📄 CodeRabbit Inference Engine (.cursor/rules/monorepo.mdc)

Support multiple Clerk environment variables (CLERK_, NEXT_PUBLIC_CLERK_, etc.) for configuration.

Files:

  • packages/backend/src/api/endpoints/MachineTokensApi.ts
**/*

⚙️ CodeRabbit Configuration File

**/*: If there are no tests added or modified as part of the PR, please suggest that tests be added to cover the changes.

Whenever reviewing a pull request, if there are any changes that could impact security, always tag @clerk/security in the PR.

Security-impacting changes include, but are not limited to:

  • Changes to authentication logic or mechanisms (e.g. login, session handling, token issuance)
  • Any modification to access control, authorization checks, or role-based permissions
  • Introduction or modification of hashing algorithms, signature verification, or cryptographic primitives
  • Handling of sensitive data (e.g. passwords, tokens, secrets, PII)
  • Integration with external identity providers (e.g. SSO, OAuth, OpenID Connect)
  • Modifications to security headers, cookie flags, CORS policies, or CSRF protections
  • Bypass mechanisms (e.g. feature flags, testing overrides) that could weaken protections
  • Changes to rate limiting, abuse prevention, or input validation

If you're unsure whether a change is security-relevant, err on the side of caution and tag @clerk/security.

Any time that you tag @clerk/security, please do so explicitly in a code comment, rather than within a collapsed section in a coderabbit comment, such as the "recent review details" section. If you do use the team name in any thinking or non-direct-code-comment content, it can be referred to as "clerk security team" to avoid accidentally printing the tag which sends a notification to the team.

Files:

  • packages/backend/src/api/endpoints/MachineTokensApi.ts
🧬 Code Graph Analysis (1)
packages/backend/src/api/endpoints/MachineTokensApi.ts (2)
packages/backend/src/api/request.ts (1)
  • ClerkBackendApiRequestOptions (11-26)
packages/backend/src/api/resources/MachineToken.ts (1)
  • MachineToken (3-39)
⏰ Context from checks skipped due to timeout of 90000ms. You can increase the timeout in your CodeRabbit configuration to a maximum of 15 minutes (900000ms). (5)
  • GitHub Check: semgrep-cloud-platform/scan
  • GitHub Check: Formatting | Dedupe | Changeset
  • GitHub Check: Build Packages
  • GitHub Check: semgrep/ci
  • GitHub Check: Analyze (javascript-typescript)
🔇 Additional comments (3)
packages/backend/src/api/endpoints/MachineTokensApi.ts (3)

8-30: Well-structured type definitions following TypeScript best practices.

The WithMachineSecret<T> utility type and parameter type definitions are well-designed, using proper generic patterns and utility types like Pick for code reuse. The consistent naming and optional machineSecret parameter support backward compatibility while enabling the new authorization flow.


33-49: Security-sensitive authentication logic requires review.

The helper method correctly implements conditional authorization header override using Bearer token format. The intentional replacement of headerParams (rather than merging) aligns with the previous clarification from the maintainer.

However, since this involves authentication token handling and authorization mechanisms, the security team should review these changes.

@clerk/security - Please review the machine secret authorization implementation in this method.


51-107: Critical: Security team review required for authentication changes.

This refactoring introduces machine secret authorization across all token operations, which significantly impacts the authentication and authorization mechanisms. The changes involve:

  • Machine secret token handling and validation
  • Authorization header manipulation
  • Token verification and management operations

Given the security-sensitive nature of these changes, a thorough security review is essential.

@clerk/security - Please review this implementation of machine-to-machine token authentication, particularly the authorization header override logic and secret handling across all API methods.

Comment on lines 51 to 107
async create(params: CreateMachineTokenParams) {
const { machineSecret, ...bodyParams } = params;
return this.request<MachineToken>(
this.#withMachineSecretHeader(
{
method: 'POST',
path: basePath,
bodyParams,
},
machineSecret,
),
);
}

async update(params: UpdateMachineTokenParams) {
const { m2mTokenId, machineSecret, ...bodyParams } = params;
this.requireId(m2mTokenId);
return this.request<MachineToken>(
this.#withMachineSecretHeader(
{
method: 'PATCH',
path: joinPaths(basePath, m2mTokenId),
bodyParams,
},
machineSecret,
),
);
}

async revoke(params: RevokeMachineTokenParams) {
const { m2mTokenId, machineSecret, ...bodyParams } = params;
this.requireId(m2mTokenId);
return this.request<MachineToken>(
this.#withMachineSecretHeader(
{
method: 'POST',
path: joinPaths(basePath, m2mTokenId, 'revoke'),
bodyParams,
},
machineSecret,
),
);
}

async verifySecret(params: VerifyMachineTokenParams) {
const { secret, machineSecret } = params;
return this.request<MachineToken>(
this.#withMachineSecretHeader(
{
method: 'POST',
path: joinPaths(basePath, 'verify'),
bodyParams: { secret },
},
machineSecret,
),
);
}
Copy link
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

🛠️ Refactor suggestion

Add explicit return types for public API methods.

The method implementations are well-structured and follow consistent patterns. However, the coding guidelines require explicit return types for public APIs, especially for functions.

Add explicit return types to each method:

- async create(params: CreateMachineTokenParams) {
+ async create(params: CreateMachineTokenParams): Promise<MachineToken> {

- async update(params: UpdateMachineTokenParams) {
+ async update(params: UpdateMachineTokenParams): Promise<MachineToken> {

- async revoke(params: RevokeMachineTokenParams) {
+ async revoke(params: RevokeMachineTokenParams): Promise<MachineToken> {

- async verifySecret(params: VerifyMachineTokenParams) {
+ async verifySecret(params: VerifyMachineTokenParams): Promise<MachineToken> {
📝 Committable suggestion

‼️ IMPORTANT
Carefully review the code before committing. Ensure that it accurately replaces the highlighted code, contains no missing lines, and has no issues with indentation. Thoroughly test & benchmark the code to ensure it meets the requirements.

Suggested change
async create(params: CreateMachineTokenParams) {
const { machineSecret, ...bodyParams } = params;
return this.request<MachineToken>(
this.#withMachineSecretHeader(
{
method: 'POST',
path: basePath,
bodyParams,
},
machineSecret,
),
);
}
async update(params: UpdateMachineTokenParams) {
const { m2mTokenId, machineSecret, ...bodyParams } = params;
this.requireId(m2mTokenId);
return this.request<MachineToken>(
this.#withMachineSecretHeader(
{
method: 'PATCH',
path: joinPaths(basePath, m2mTokenId),
bodyParams,
},
machineSecret,
),
);
}
async revoke(params: RevokeMachineTokenParams) {
const { m2mTokenId, machineSecret, ...bodyParams } = params;
this.requireId(m2mTokenId);
return this.request<MachineToken>(
this.#withMachineSecretHeader(
{
method: 'POST',
path: joinPaths(basePath, m2mTokenId, 'revoke'),
bodyParams,
},
machineSecret,
),
);
}
async verifySecret(params: VerifyMachineTokenParams) {
const { secret, machineSecret } = params;
return this.request<MachineToken>(
this.#withMachineSecretHeader(
{
method: 'POST',
path: joinPaths(basePath, 'verify'),
bodyParams: { secret },
},
machineSecret,
),
);
}
async create(params: CreateMachineTokenParams): Promise<MachineToken> {
const { machineSecret, ...bodyParams } = params;
return this.request<MachineToken>(
this.#withMachineSecretHeader(
{
method: 'POST',
path: basePath,
bodyParams,
},
machineSecret,
),
);
}
async update(params: UpdateMachineTokenParams): Promise<MachineToken> {
const { m2mTokenId, machineSecret, ...bodyParams } = params;
this.requireId(m2mTokenId);
return this.request<MachineToken>(
this.#withMachineSecretHeader(
{
method: 'PATCH',
path: joinPaths(basePath, m2mTokenId),
bodyParams,
},
machineSecret,
),
);
}
async revoke(params: RevokeMachineTokenParams): Promise<MachineToken> {
const { m2mTokenId, machineSecret, ...bodyParams } = params;
this.requireId(m2mTokenId);
return this.request<MachineToken>(
this.#withMachineSecretHeader(
{
method: 'POST',
path: joinPaths(basePath, m2mTokenId, 'revoke'),
bodyParams,
},
machineSecret,
),
);
}
async verifySecret(params: VerifyMachineTokenParams): Promise<MachineToken> {
const { secret, machineSecret } = params;
return this.request<MachineToken>(
this.#withMachineSecretHeader(
{
method: 'POST',
path: joinPaths(basePath, 'verify'),
bodyParams: { secret },
},
machineSecret,
),
);
}
🤖 Prompt for AI Agents
In packages/backend/src/api/endpoints/MachineTokensApi.ts between lines 51 and
107, the public async methods create, update, revoke, and verifySecret lack
explicit return types. To comply with coding guidelines, add explicit return
types to each method signature, specifying the Promise type they return, such as
Promise<MachineToken>. This clarifies the expected return type and improves code
readability and type safety.

Copy link
Contributor

@coderabbitai coderabbitai bot left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Actionable comments posted: 2

♻️ Duplicate comments (3)
packages/backend/src/api/endpoints/MachineTokensApi.ts (3)

66-83: Add explicit return type for public API method.

The method correctly handles optional machine secret authorization and follows the established pattern for conditional header setting.

- async revoke(params: RevokeMachineTokenParams) {
+ async revoke(params: RevokeMachineTokenParams): Promise<MachineToken> {

39-50: Add explicit return type for public API method.

The method implementation follows good patterns with proper validation and authorization handling. However, coding guidelines require explicit return types for public APIs.

- async create(params: CreateMachineTokenParams) {
+ async create(params: CreateMachineTokenParams): Promise<MachineToken> {

52-64: Add explicit return type for public API method.

The method correctly validates both the machine secret and token ID, and follows consistent patterns with proper authorization handling.

- async update(params: UpdateMachineTokenParams) {
+ async update(params: UpdateMachineTokenParams): Promise<MachineToken> {
📜 Review details

Configuration used: CodeRabbit UI
Review profile: CHILL
Plan: Pro

📥 Commits

Reviewing files that changed from the base of the PR and between 7ff0538 and e844565.

📒 Files selected for processing (1)
  • packages/backend/src/api/endpoints/MachineTokensApi.ts (1 hunks)
🧰 Additional context used
📓 Path-based instructions (7)
**/*.{js,jsx,ts,tsx}

📄 CodeRabbit Inference Engine (.cursor/rules/development.mdc)

**/*.{js,jsx,ts,tsx}: All code must pass ESLint checks with the project's configuration
Follow established naming conventions (PascalCase for components, camelCase for variables)
Maintain comprehensive JSDoc comments for public APIs
Use dynamic imports for optional features
All public APIs must be documented with JSDoc
Provide meaningful error messages to developers
Include error recovery suggestions where applicable
Log errors appropriately for debugging
Lazy load components and features when possible
Implement proper caching strategies
Use efficient data structures and algorithms
Profile and optimize critical paths
Validate all inputs and sanitize outputs
Implement proper logging with different levels

Files:

  • packages/backend/src/api/endpoints/MachineTokensApi.ts
**/*.{js,jsx,ts,tsx,json,css,scss,md,yaml,yml}

📄 CodeRabbit Inference Engine (.cursor/rules/development.mdc)

Use Prettier for consistent code formatting

Files:

  • packages/backend/src/api/endpoints/MachineTokensApi.ts
packages/**/*.{ts,tsx}

📄 CodeRabbit Inference Engine (.cursor/rules/development.mdc)

TypeScript is required for all packages

Files:

  • packages/backend/src/api/endpoints/MachineTokensApi.ts
packages/**/*.{ts,tsx,d.ts}

📄 CodeRabbit Inference Engine (.cursor/rules/development.mdc)

Packages should export TypeScript types alongside runtime code

Files:

  • packages/backend/src/api/endpoints/MachineTokensApi.ts
**/*.{ts,tsx}

📄 CodeRabbit Inference Engine (.cursor/rules/development.mdc)

Use proper TypeScript error types

**/*.{ts,tsx}: Always define explicit return types for functions, especially public APIs
Use proper type annotations for variables and parameters where inference isn't clear
Avoid any type - prefer unknown when type is uncertain, then narrow with type guards
Use interface for object shapes that might be extended
Use type for unions, primitives, and computed types
Prefer readonly properties for immutable data structures
Use private for internal implementation details
Use protected for inheritance hierarchies
Use public explicitly for clarity in public APIs
Prefer readonly for properties that shouldn't change after construction
Prefer composition and interfaces over deep inheritance chains
Use mixins for shared behavior across unrelated classes
Implement dependency injection for loose coupling
Let TypeScript infer when types are obvious
Use const assertions for literal types: as const
Use satisfies operator for type checking without widening
Use mapped types for transforming object types
Use conditional types for type-level logic
Leverage template literal types for string manipulation
Use ES6 imports/exports consistently
Use default exports sparingly, prefer named exports
Use type-only imports: import type { ... } from ...
No any types without justification
Proper error handling with typed errors
Consistent use of readonly for immutable data
Proper generic constraints
No unused type parameters
Proper use of utility types instead of manual type construction
Type-only imports where possible
Proper tree-shaking friendly exports
No circular dependencies
Efficient type computations (avoid deep recursion)

Files:

  • packages/backend/src/api/endpoints/MachineTokensApi.ts
**/*.{js,ts,tsx,jsx}

📄 CodeRabbit Inference Engine (.cursor/rules/monorepo.mdc)

Support multiple Clerk environment variables (CLERK_, NEXT_PUBLIC_CLERK_, etc.) for configuration.

Files:

  • packages/backend/src/api/endpoints/MachineTokensApi.ts
**/*

⚙️ CodeRabbit Configuration File

**/*: If there are no tests added or modified as part of the PR, please suggest that tests be added to cover the changes.

Whenever reviewing a pull request, if there are any changes that could impact security, always tag @clerk/security in the PR.

Security-impacting changes include, but are not limited to:

  • Changes to authentication logic or mechanisms (e.g. login, session handling, token issuance)
  • Any modification to access control, authorization checks, or role-based permissions
  • Introduction or modification of hashing algorithms, signature verification, or cryptographic primitives
  • Handling of sensitive data (e.g. passwords, tokens, secrets, PII)
  • Integration with external identity providers (e.g. SSO, OAuth, OpenID Connect)
  • Modifications to security headers, cookie flags, CORS policies, or CSRF protections
  • Bypass mechanisms (e.g. feature flags, testing overrides) that could weaken protections
  • Changes to rate limiting, abuse prevention, or input validation

If you're unsure whether a change is security-relevant, err on the side of caution and tag @clerk/security.

Any time that you tag @clerk/security, please do so explicitly in a code comment, rather than within a collapsed section in a coderabbit comment, such as the "recent review details" section. If you do use the team name in any thinking or non-direct-code-comment content, it can be referred to as "clerk security team" to avoid accidentally printing the tag which sends a notification to the team.

Files:

  • packages/backend/src/api/endpoints/MachineTokensApi.ts
⏰ Context from checks skipped due to timeout of 90000ms. You can increase the timeout in your CodeRabbit configuration to a maximum of 15 minutes (900000ms). (5)
  • GitHub Check: semgrep-cloud-platform/scan
  • GitHub Check: Build Packages
  • GitHub Check: Formatting | Dedupe | Changeset
  • GitHub Check: semgrep/ci
  • GitHub Check: Analyze (javascript-typescript)
🔇 Additional comments (3)
packages/backend/src/api/endpoints/MachineTokensApi.ts (3)

8-30: Well-structured type definitions with good TypeScript practices.

The type definitions effectively use intersection types, utility types, and proper optional property handling. The WithMachineSecret<T> pattern provides clean reusability across all parameter types.


33-37: Good use of TypeScript assertion function for validation.

The private assertion method effectively validates the machine secret presence and provides proper type narrowing with a clear error message.


1-102: Security review required for authentication token changes.

This PR introduces significant changes to machine-to-machine token handling, including:

  • New authorization mechanisms with machine secrets
  • Token creation, updating, and verification workflows
  • Bearer token authentication patterns

Given the security-sensitive nature of authentication token management, please have the clerk security team review these changes.

@clerk/security

Comment on lines 39 to 101
async create(params: CreateMachineTokenParams) {
const { machineSecret, ...bodyParams } = params;
this.#requireMachineSecret(machineSecret);
return this.request<MachineToken>({
method: 'POST',
path: basePath,
bodyParams,
headerParams: {
Authorization: `Bearer ${machineSecret}`,
},
});
}

async update(params: UpdateMachineTokenParams) {
const { m2mTokenId, machineSecret, ...bodyParams } = params;
this.#requireMachineSecret(machineSecret);
this.requireId(m2mTokenId);
return this.request<MachineToken>({
method: 'PATCH',
path: joinPaths(basePath, m2mTokenId),
bodyParams,
headerParams: {
Authorization: `Bearer ${machineSecret}`,
},
});
}

async revoke(params: RevokeMachineTokenParams) {
const { m2mTokenId, machineSecret, ...bodyParams } = params;
this.requireId(m2mTokenId);

const requestOptions: ClerkBackendApiRequestOptions = {
method: 'POST',
path: joinPaths(basePath, m2mTokenId, 'revoke'),
bodyParams,
};

if (machineSecret) {
requestOptions.headerParams = {
Authorization: `Bearer ${machineSecret}`,
};
}

return this.request<MachineToken>(requestOptions);
}

async verifySecret(params: VerifyMachineTokenParams) {
const { secret, machineSecret } = params;

const requestOptions: ClerkBackendApiRequestOptions = {
method: 'POST',
path: joinPaths(basePath, 'verify'),
bodyParams: { secret },
});
};

if (machineSecret) {
requestOptions.headerParams = {
Authorization: `Bearer ${machineSecret}`,
};
}

return this.request<MachineToken>(requestOptions);
}
Copy link
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

🛠️ Refactor suggestion

Consider comprehensive testing for refactored authorization patterns.

The significant refactoring of method signatures and addition of machine secret authorization logic introduces new complexity that would benefit from thorough test coverage to ensure the conditional authorization and parameter object patterns work correctly across all scenarios.

🤖 Prompt for AI Agents
In packages/backend/src/api/endpoints/MachineTokensApi.ts between lines 39 and
101, the refactoring introduced conditional authorization headers using machine
secrets and changed method parameter handling. To fix this, add comprehensive
unit and integration tests covering all methods (create, update, revoke,
verifySecret) to verify that authorization headers are correctly included or
omitted based on the presence of machineSecret, and that parameter objects are
handled properly in all scenarios.

Comment on lines 85 to 101
async verifySecret(params: VerifyMachineTokenParams) {
const { secret, machineSecret } = params;

const requestOptions: ClerkBackendApiRequestOptions = {
method: 'POST',
path: joinPaths(basePath, 'verify'),
bodyParams: { secret },
});
};

if (machineSecret) {
requestOptions.headerParams = {
Authorization: `Bearer ${machineSecret}`,
};
}

return this.request<MachineToken>(requestOptions);
}
Copy link
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

💡 Verification agent

🧩 Analysis chain

Add explicit return type and note potential breaking change.

The method correctly handles optional machine secret authorization. However, the signature change from verifySecret(secret: string) to verifySecret(params: VerifyMachineTokenParams) appears to be a breaking change.

- async verifySecret(params: VerifyMachineTokenParams) {
+ async verifySecret(params: VerifyMachineTokenParams): Promise<MachineToken> {

🏁 Script executed:

#!/bin/bash
# Locate the revoke and verifySecret method definitions
grep -n "async revoke" packages/backend/src/api/endpoints/MachineTokensApi.ts
grep -n "async verifySecret" packages/backend/src/api/endpoints/MachineTokensApi.ts

# Find all other call sites of verifySecret to see how it's invoked
rg -n "verifySecret\(" --glob "!packages/backend/src/api/endpoints/MachineTokensApi.ts"

Length of output: 692


Add explicit return type and highlight breaking change for verifySecret

The verifySecret method in packages/backend/src/api/endpoints/MachineTokensApi.ts currently omits an explicit return type and its signature has changed from the old verifySecret(secret: string) to the new object-based form. Update it as follows and verify all call sites:

• File: packages/backend/src/api/endpoints/MachineTokensApi.ts
• Line: 85

- async verifySecret(params: VerifyMachineTokenParams) {
+ async verifySecret(params: VerifyMachineTokenParams): Promise<MachineToken> {

This is a breaking change—ensure callers (e.g., in packages/backend/src/tokens/verify.ts) pass { secret } and handle the MachineToken return.

📝 Committable suggestion

‼️ IMPORTANT
Carefully review the code before committing. Ensure that it accurately replaces the highlighted code, contains no missing lines, and has no issues with indentation. Thoroughly test & benchmark the code to ensure it meets the requirements.

Suggested change
async verifySecret(params: VerifyMachineTokenParams) {
const { secret, machineSecret } = params;
const requestOptions: ClerkBackendApiRequestOptions = {
method: 'POST',
path: joinPaths(basePath, 'verify'),
bodyParams: { secret },
});
};
if (machineSecret) {
requestOptions.headerParams = {
Authorization: `Bearer ${machineSecret}`,
};
}
return this.request<MachineToken>(requestOptions);
}
async verifySecret(params: VerifyMachineTokenParams): Promise<MachineToken> {
const { secret, machineSecret } = params;
const requestOptions: ClerkBackendApiRequestOptions = {
method: 'POST',
path: joinPaths(basePath, 'verify'),
bodyParams: { secret },
};
if (machineSecret) {
requestOptions.headerParams = {
Authorization: `Bearer ${machineSecret}`,
};
}
return this.request<MachineToken>(requestOptions);
}
🤖 Prompt for AI Agents
In packages/backend/src/api/endpoints/MachineTokensApi.ts around lines 85 to
101, the verifySecret method lacks an explicit return type and its signature has
changed from a single string parameter to an object parameter. Add an explicit
return type of Promise<MachineToken> to the method signature and update the
parameter to accept an object with the secret property. Review and update all
call sites, such as in packages/backend/src/tokens/verify.ts, to pass an object
with the secret key and handle the returned MachineToken accordingly, as this is
a breaking change.

Copy link
Contributor

@coderabbitai coderabbitai bot left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Actionable comments posted: 1

♻️ Duplicate comments (3)
packages/backend/src/api/endpoints/MachineTokensApi.ts (3)

70-88: Add explicit return type and good conditional authorization handling.

The method correctly implements conditional authorization for optional machineSecret while properly validating the required m2mTokenId. The request options pattern is well-structured.

- async revoke(params: RevokeMachineTokenParams) {
+ async revoke(params: RevokeMachineTokenParams): Promise<MachineToken> {

39-52: Add explicit return type for public API method.

The method implementation is well-structured with proper parameter destructuring and authorization handling. However, the coding guidelines require explicit return types for public APIs.

- async create(params: CreateMachineTokenParams) {
+ async create(params: CreateMachineTokenParams): Promise<MachineToken> {

54-68: Add explicit return type for consistency with coding guidelines.

The method correctly validates both machineSecret and m2mTokenId with proper parameter destructuring and authorization handling. Add an explicit return type for compliance with coding guidelines.

- async update(params: UpdateMachineTokenParams) {
+ async update(params: UpdateMachineTokenParams): Promise<MachineToken> {
📜 Review details

Configuration used: CodeRabbit UI
Review profile: CHILL
Plan: Pro

📥 Commits

Reviewing files that changed from the base of the PR and between e844565 and 017bb4b.

📒 Files selected for processing (1)
  • packages/backend/src/api/endpoints/MachineTokensApi.ts (1 hunks)
🧰 Additional context used
📓 Path-based instructions (7)
**/*.{js,jsx,ts,tsx}

📄 CodeRabbit Inference Engine (.cursor/rules/development.mdc)

**/*.{js,jsx,ts,tsx}: All code must pass ESLint checks with the project's configuration
Follow established naming conventions (PascalCase for components, camelCase for variables)
Maintain comprehensive JSDoc comments for public APIs
Use dynamic imports for optional features
All public APIs must be documented with JSDoc
Provide meaningful error messages to developers
Include error recovery suggestions where applicable
Log errors appropriately for debugging
Lazy load components and features when possible
Implement proper caching strategies
Use efficient data structures and algorithms
Profile and optimize critical paths
Validate all inputs and sanitize outputs
Implement proper logging with different levels

Files:

  • packages/backend/src/api/endpoints/MachineTokensApi.ts
**/*.{js,jsx,ts,tsx,json,css,scss,md,yaml,yml}

📄 CodeRabbit Inference Engine (.cursor/rules/development.mdc)

Use Prettier for consistent code formatting

Files:

  • packages/backend/src/api/endpoints/MachineTokensApi.ts
packages/**/*.{ts,tsx}

📄 CodeRabbit Inference Engine (.cursor/rules/development.mdc)

TypeScript is required for all packages

Files:

  • packages/backend/src/api/endpoints/MachineTokensApi.ts
packages/**/*.{ts,tsx,d.ts}

📄 CodeRabbit Inference Engine (.cursor/rules/development.mdc)

Packages should export TypeScript types alongside runtime code

Files:

  • packages/backend/src/api/endpoints/MachineTokensApi.ts
**/*.{ts,tsx}

📄 CodeRabbit Inference Engine (.cursor/rules/development.mdc)

Use proper TypeScript error types

**/*.{ts,tsx}: Always define explicit return types for functions, especially public APIs
Use proper type annotations for variables and parameters where inference isn't clear
Avoid any type - prefer unknown when type is uncertain, then narrow with type guards
Use interface for object shapes that might be extended
Use type for unions, primitives, and computed types
Prefer readonly properties for immutable data structures
Use private for internal implementation details
Use protected for inheritance hierarchies
Use public explicitly for clarity in public APIs
Prefer readonly for properties that shouldn't change after construction
Prefer composition and interfaces over deep inheritance chains
Use mixins for shared behavior across unrelated classes
Implement dependency injection for loose coupling
Let TypeScript infer when types are obvious
Use const assertions for literal types: as const
Use satisfies operator for type checking without widening
Use mapped types for transforming object types
Use conditional types for type-level logic
Leverage template literal types for string manipulation
Use ES6 imports/exports consistently
Use default exports sparingly, prefer named exports
Use type-only imports: import type { ... } from ...
No any types without justification
Proper error handling with typed errors
Consistent use of readonly for immutable data
Proper generic constraints
No unused type parameters
Proper use of utility types instead of manual type construction
Type-only imports where possible
Proper tree-shaking friendly exports
No circular dependencies
Efficient type computations (avoid deep recursion)

Files:

  • packages/backend/src/api/endpoints/MachineTokensApi.ts
**/*.{js,ts,tsx,jsx}

📄 CodeRabbit Inference Engine (.cursor/rules/monorepo.mdc)

Support multiple Clerk environment variables (CLERK_, NEXT_PUBLIC_CLERK_, etc.) for configuration.

Files:

  • packages/backend/src/api/endpoints/MachineTokensApi.ts
**/*

⚙️ CodeRabbit Configuration File

**/*: If there are no tests added or modified as part of the PR, please suggest that tests be added to cover the changes.

Whenever reviewing a pull request, if there are any changes that could impact security, always tag @clerk/security in the PR.

Security-impacting changes include, but are not limited to:

  • Changes to authentication logic or mechanisms (e.g. login, session handling, token issuance)
  • Any modification to access control, authorization checks, or role-based permissions
  • Introduction or modification of hashing algorithms, signature verification, or cryptographic primitives
  • Handling of sensitive data (e.g. passwords, tokens, secrets, PII)
  • Integration with external identity providers (e.g. SSO, OAuth, OpenID Connect)
  • Modifications to security headers, cookie flags, CORS policies, or CSRF protections
  • Bypass mechanisms (e.g. feature flags, testing overrides) that could weaken protections
  • Changes to rate limiting, abuse prevention, or input validation

If you're unsure whether a change is security-relevant, err on the side of caution and tag @clerk/security.

Any time that you tag @clerk/security, please do so explicitly in a code comment, rather than within a collapsed section in a coderabbit comment, such as the "recent review details" section. If you do use the team name in any thinking or non-direct-code-comment content, it can be referred to as "clerk security team" to avoid accidentally printing the tag which sends a notification to the team.

Files:

  • packages/backend/src/api/endpoints/MachineTokensApi.ts
⏰ Context from checks skipped due to timeout of 90000ms. You can increase the timeout in your CodeRabbit configuration to a maximum of 15 minutes (900000ms). (5)
  • GitHub Check: semgrep-cloud-platform/scan
  • GitHub Check: Build Packages
  • GitHub Check: Formatting | Dedupe | Changeset
  • GitHub Check: semgrep/ci
  • GitHub Check: Analyze (javascript-typescript)
🔇 Additional comments (3)
packages/backend/src/api/endpoints/MachineTokensApi.ts (3)

8-30: Well-structured type definitions following TypeScript best practices.

The parameter types are well-designed with appropriate use of required/optional properties, utility types like Pick, and consistent naming conventions. The variance in machineSecret requirements across different operations correctly reflects the business logic.


33-37: Excellent use of TypeScript assertion function pattern.

The private assertion method effectively narrows the type while providing clear error messaging. The use of private fields (#) and the asserts keyword demonstrates modern TypeScript best practices.


8-98: Security review required for authentication and token handling changes.

This PR introduces significant changes to authentication logic, token issuance, and handling of machine secrets. Please ensure security review.

@clerk/security - This PR modifies authentication mechanisms, token issuance logic, and handling of sensitive machine secrets.

Copy link
Contributor

@coderabbitai coderabbitai bot left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Actionable comments posted: 1

📜 Review details

Configuration used: CodeRabbit UI
Review profile: CHILL
Plan: Pro

📥 Commits

Reviewing files that changed from the base of the PR and between 017bb4b and e26660e.

📒 Files selected for processing (1)
  • packages/backend/src/api/endpoints/MachineTokensApi.ts (1 hunks)
🧰 Additional context used
📓 Path-based instructions (7)
**/*.{js,jsx,ts,tsx}

📄 CodeRabbit Inference Engine (.cursor/rules/development.mdc)

**/*.{js,jsx,ts,tsx}: All code must pass ESLint checks with the project's configuration
Follow established naming conventions (PascalCase for components, camelCase for variables)
Maintain comprehensive JSDoc comments for public APIs
Use dynamic imports for optional features
All public APIs must be documented with JSDoc
Provide meaningful error messages to developers
Include error recovery suggestions where applicable
Log errors appropriately for debugging
Lazy load components and features when possible
Implement proper caching strategies
Use efficient data structures and algorithms
Profile and optimize critical paths
Validate all inputs and sanitize outputs
Implement proper logging with different levels

Files:

  • packages/backend/src/api/endpoints/MachineTokensApi.ts
**/*.{js,jsx,ts,tsx,json,css,scss,md,yaml,yml}

📄 CodeRabbit Inference Engine (.cursor/rules/development.mdc)

Use Prettier for consistent code formatting

Files:

  • packages/backend/src/api/endpoints/MachineTokensApi.ts
packages/**/*.{ts,tsx}

📄 CodeRabbit Inference Engine (.cursor/rules/development.mdc)

TypeScript is required for all packages

Files:

  • packages/backend/src/api/endpoints/MachineTokensApi.ts
packages/**/*.{ts,tsx,d.ts}

📄 CodeRabbit Inference Engine (.cursor/rules/development.mdc)

Packages should export TypeScript types alongside runtime code

Files:

  • packages/backend/src/api/endpoints/MachineTokensApi.ts
**/*.{ts,tsx}

📄 CodeRabbit Inference Engine (.cursor/rules/development.mdc)

Use proper TypeScript error types

**/*.{ts,tsx}: Always define explicit return types for functions, especially public APIs
Use proper type annotations for variables and parameters where inference isn't clear
Avoid any type - prefer unknown when type is uncertain, then narrow with type guards
Use interface for object shapes that might be extended
Use type for unions, primitives, and computed types
Prefer readonly properties for immutable data structures
Use private for internal implementation details
Use protected for inheritance hierarchies
Use public explicitly for clarity in public APIs
Prefer readonly for properties that shouldn't change after construction
Prefer composition and interfaces over deep inheritance chains
Use mixins for shared behavior across unrelated classes
Implement dependency injection for loose coupling
Let TypeScript infer when types are obvious
Use const assertions for literal types: as const
Use satisfies operator for type checking without widening
Use mapped types for transforming object types
Use conditional types for type-level logic
Leverage template literal types for string manipulation
Use ES6 imports/exports consistently
Use default exports sparingly, prefer named exports
Use type-only imports: import type { ... } from ...
No any types without justification
Proper error handling with typed errors
Consistent use of readonly for immutable data
Proper generic constraints
No unused type parameters
Proper use of utility types instead of manual type construction
Type-only imports where possible
Proper tree-shaking friendly exports
No circular dependencies
Efficient type computations (avoid deep recursion)

Files:

  • packages/backend/src/api/endpoints/MachineTokensApi.ts
**/*.{js,ts,tsx,jsx}

📄 CodeRabbit Inference Engine (.cursor/rules/monorepo.mdc)

Support multiple Clerk environment variables (CLERK_, NEXT_PUBLIC_CLERK_, etc.) for configuration.

Files:

  • packages/backend/src/api/endpoints/MachineTokensApi.ts
**/*

⚙️ CodeRabbit Configuration File

**/*: If there are no tests added or modified as part of the PR, please suggest that tests be added to cover the changes.

Whenever reviewing a pull request, if there are any changes that could impact security, always tag @clerk/security in the PR.

Security-impacting changes include, but are not limited to:

  • Changes to authentication logic or mechanisms (e.g. login, session handling, token issuance)
  • Any modification to access control, authorization checks, or role-based permissions
  • Introduction or modification of hashing algorithms, signature verification, or cryptographic primitives
  • Handling of sensitive data (e.g. passwords, tokens, secrets, PII)
  • Integration with external identity providers (e.g. SSO, OAuth, OpenID Connect)
  • Modifications to security headers, cookie flags, CORS policies, or CSRF protections
  • Bypass mechanisms (e.g. feature flags, testing overrides) that could weaken protections
  • Changes to rate limiting, abuse prevention, or input validation

If you're unsure whether a change is security-relevant, err on the side of caution and tag @clerk/security.

Any time that you tag @clerk/security, please do so explicitly in a code comment, rather than within a collapsed section in a coderabbit comment, such as the "recent review details" section. If you do use the team name in any thinking or non-direct-code-comment content, it can be referred to as "clerk security team" to avoid accidentally printing the tag which sends a notification to the team.

Files:

  • packages/backend/src/api/endpoints/MachineTokensApi.ts
⏰ Context from checks skipped due to timeout of 90000ms. You can increase the timeout in your CodeRabbit configuration to a maximum of 15 minutes (900000ms). (5)
  • GitHub Check: Formatting | Dedupe | Changeset
  • GitHub Check: Build Packages
  • GitHub Check: semgrep-cloud-platform/scan
  • GitHub Check: semgrep/ci
  • GitHub Check: Analyze (javascript-typescript)
🔇 Additional comments (3)
packages/backend/src/api/endpoints/MachineTokensApi.ts (3)

8-25: Well-structured parameter types with proper TypeScript patterns.

The type definitions follow TypeScript best practices using utility types like Pick and appropriate optional/required field patterns for different operations.


28-32: Good use of TypeScript assertion functions.

The private assertion method properly validates required machine secrets with clear error messaging and correct assertion syntax.


34-83: Security review needed for machine token authentication changes.

These methods handle machine secrets for authentication and authorization. The implementation includes bearer token generation and conditional authorization headers.

@clerk/security - Please review the machine token authentication patterns, particularly:

  • Bearer token authorization header construction
  • Machine secret validation and handling
  • Authorization flow for M2M token operations

@wobsoriano wobsoriano changed the title feat(backend): WIP M2M Tokens feat(backend): Allow machine secret key authentication for M2M endpoints Jul 25, 2025
@wobsoriano wobsoriano changed the title feat(backend): Allow machine secret key authentication for M2M endpoints WIP: Allow machine secret key authentication for M2M endpoints Jul 26, 2025
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Projects
None yet
Development

Successfully merging this pull request may close these issues.

2 participants