Skip to content

test(react-router): cover auth context isolation under concurrency#8889

Merged
nikosdouvlis merged 2 commits into
mainfrom
test/react-router-context-isolation
Jun 30, 2026
Merged

test(react-router): cover auth context isolation under concurrency#8889
nikosdouvlis merged 2 commits into
mainfrom
test/react-router-context-isolation

Conversation

@nikosdouvlis

@nikosdouvlis nikosdouvlis commented Jun 17, 2026

Copy link
Copy Markdown
Member

Summary by CodeRabbit

  • Tests
    • Added coverage for concurrent server requests to verify authentication data stays isolated per request.
    • Confirmed that separate request contexts return the correct user identity, while sharing a context can cause cross-request auth leakage.
  • Chores
    • Added a Changeset entry for this update.

clerkMiddleware stores auth in the React Router request context and getAuth reads it back. Pin that a per-request context keeps auth isolated and that a shared context leaks one request's auth into another under concurrency.
@vercel

vercel Bot commented Jun 17, 2026

Copy link
Copy Markdown

The latest updates on your projects. Learn more about Vercel for GitHub.

Project Deployment Actions Updated (UTC)
clerk-js-sandbox Ready Ready Preview, Comment Jun 30, 2026 9:15am
swingset Ready Ready Preview, Comment Jun 30, 2026 9:15am

Request Review

@pkg-pr-new

pkg-pr-new Bot commented Jun 17, 2026

Copy link
Copy Markdown

Open in StackBlitz

@clerk/astro

npm i https://pkg.pr.new/@clerk/astro@8889

@clerk/backend

npm i https://pkg.pr.new/@clerk/backend@8889

@clerk/chrome-extension

npm i https://pkg.pr.new/@clerk/chrome-extension@8889

@clerk/clerk-js

npm i https://pkg.pr.new/@clerk/clerk-js@8889

@clerk/electron

npm i https://pkg.pr.new/@clerk/electron@8889

@clerk/electron-passkeys

npm i https://pkg.pr.new/@clerk/electron-passkeys@8889

@clerk/eslint-plugin

npm i https://pkg.pr.new/@clerk/eslint-plugin@8889

@clerk/expo

npm i https://pkg.pr.new/@clerk/expo@8889

@clerk/expo-passkeys

npm i https://pkg.pr.new/@clerk/expo-passkeys@8889

@clerk/express

npm i https://pkg.pr.new/@clerk/express@8889

@clerk/fastify

npm i https://pkg.pr.new/@clerk/fastify@8889

@clerk/hono

npm i https://pkg.pr.new/@clerk/hono@8889

@clerk/localizations

npm i https://pkg.pr.new/@clerk/localizations@8889

@clerk/nextjs

npm i https://pkg.pr.new/@clerk/nextjs@8889

@clerk/nuxt

npm i https://pkg.pr.new/@clerk/nuxt@8889

@clerk/react

npm i https://pkg.pr.new/@clerk/react@8889

@clerk/react-router

npm i https://pkg.pr.new/@clerk/react-router@8889

@clerk/shared

npm i https://pkg.pr.new/@clerk/shared@8889

@clerk/tanstack-react-start

npm i https://pkg.pr.new/@clerk/tanstack-react-start@8889

@clerk/testing

npm i https://pkg.pr.new/@clerk/testing@8889

@clerk/ui

npm i https://pkg.pr.new/@clerk/ui@8889

@clerk/upgrade

npm i https://pkg.pr.new/@clerk/upgrade@8889

@clerk/vue

npm i https://pkg.pr.new/@clerk/vue@8889

commit: ba9ea4a

@github-actions

github-actions Bot commented Jun 17, 2026

Copy link
Copy Markdown
Contributor

API Changes Report

Generated by Break Check on 2026-06-30T09:18:48.079Z

Summary

Metric Count
Packages analyzed 19
Packages with changes 0
🔴 Breaking changes 0
🟡 Non-breaking changes 0
🟢 Additions 0

No API Changes Detected

All packages have stable APIs with no detected changes.


Report generated by Break Check

Last ran on ba9ea4a.

@coderabbitai

coderabbitai Bot commented Jun 17, 2026

Copy link
Copy Markdown
Contributor

Review Change Stack

No actionable comments were generated in the recent review. 🎉

ℹ️ Recent review info
⚙️ Run configuration

Configuration used: Repository YAML (base), Repository UI (inherited)

Review profile: CHILL

Plan: Pro Plus

Run ID: 0e293887-dcf5-4da5-b247-11b9c95ee255

📥 Commits

Reviewing files that changed from the base of the PR and between f2512d8 and ba9ea4a.

📒 Files selected for processing (2)
  • .changeset/react-router-concurrency-test.md
  • packages/react-router/src/server/__tests__/clerkMiddleware.concurrency.test.ts
✅ Files skipped from review due to trivial changes (1)
  • .changeset/react-router-concurrency-test.md
🚧 Files skipped from review as they are similar to previous changes (1)
  • packages/react-router/src/server/tests/clerkMiddleware.concurrency.test.ts

📝 Walkthrough

Walkthrough

A new Vitest test file verifies concurrent clerkMiddleware() and getAuth() behavior in React Router server usage. It adds an interleaving harness that pauses request A, runs request B, then checks fresh vs shared RouterContextProvider results.

Changes

Concurrency Isolation Tests

Layer / File(s) Summary
Test setup and helpers
packages/react-router/src/server/__tests__/clerkMiddleware.concurrency.test.ts
Top-level comments describe the concurrency hazard, followed by imports, Vitest mocks for clerkClient and loadOptions, deterministic auth state generation, the readUserId helper, and per-test mock setup.
Interleaving harness and test cases
packages/react-router/src/server/__tests__/clerkMiddleware.concurrency.test.ts
runInterleaved pauses request A before its loader reads auth, runs request B, then resumes A. The two cases assert correct identities with fresh providers and auth leakage with a shared provider.

Estimated code review effort

🎯 2 (Simple) | ⏱️ ~10 minutes

Poem

🐇 Two requests hop down the middleware lane,
One waits mid-hop while the other goes plain.
Fresh burrows keep each auth state neat and bright,
Shared warrens get tangled in the testing light.
A little bunny nods: “the race is now in sight!”

🚥 Pre-merge checks | ✅ 4 | ❌ 1

❌ Failed checks (1 warning)

Check name Status Explanation Resolution
Docstring Coverage ⚠️ Warning Docstring coverage is 66.67% which is insufficient. The required threshold is 80.00%. Write docstrings for the functions missing them to satisfy the coverage threshold.
✅ Passed checks (4 passed)
Check name Status Explanation
Description Check ✅ Passed Check skipped - CodeRabbit’s high-level summary is enabled.
Title check ✅ Passed The title clearly matches the change: a React Router test covering auth context isolation under concurrent requests.
Linked Issues check ✅ Passed Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check ✅ Passed Check skipped because no linked issues were found for this pull request.
✨ Finishing Touches
📝 Generate docstrings
  • Create stacked PR
  • Commit on current branch

Comment @coderabbitai help to get the list of available commands.

@coderabbitai coderabbitai Bot left a comment

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

🧹 Nitpick comments (1)
packages/react-router/src/server/__tests__/clerkMiddleware.concurrency.test.ts (1)

72-101: ⚡ Quick win

Consider adding an explicit return type for clarity.

The runInterleaved helper returns a structured object used by multiple test cases. Adding an explicit return type would improve type safety and make the function's contract clearer.

📝 Suggested return type annotation
-async function runInterleaved(contextFor: (req: Request) => RouterContextProvider) {
+async function runInterleaved(contextFor: (req: Request) => RouterContextProvider): Promise<{ A?: string | null; B?: string | null }> {
🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

In
`@packages/react-router/src/server/__tests__/clerkMiddleware.concurrency.test.ts`
around lines 72 - 101, The runInterleaved function lacks an explicit return type
annotation, which reduces type safety and clarity of its contract. Add a return
type annotation to the function signature that reflects the Promise type it
returns, which should be Promise with a structure containing optional properties
A and B, both of type string or null. This will make the function's return type
explicit and improve type checking for callers of this helper function.
🤖 Prompt for all review comments with AI agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

Nitpick comments:
In
`@packages/react-router/src/server/__tests__/clerkMiddleware.concurrency.test.ts`:
- Around line 72-101: The runInterleaved function lacks an explicit return type
annotation, which reduces type safety and clarity of its contract. Add a return
type annotation to the function signature that reflects the Promise type it
returns, which should be Promise with a structure containing optional properties
A and B, both of type string or null. This will make the function's return type
explicit and improve type checking for callers of this helper function.

ℹ️ Review info
⚙️ Run configuration

Configuration used: Repository YAML (base), Repository UI (inherited)

Review profile: CHILL

Plan: Pro

Run ID: 5b3ca5f8-16b3-4a78-9d4e-bbf06e1c4f97

📥 Commits

Reviewing files that changed from the base of the PR and between 3b146a1 and f2512d8.

📒 Files selected for processing (1)
  • packages/react-router/src/server/__tests__/clerkMiddleware.concurrency.test.ts

Add braces to the per-request context check for the curly rule, drop the
unused async from the authenticateRequest mock, and add an empty changeset
since this is a test-only change.
@changeset-bot

changeset-bot Bot commented Jun 30, 2026

Copy link
Copy Markdown

🦋 Changeset detected

Latest commit: ba9ea4a

The changes in this PR will be included in the next version bump.

This PR includes changesets to release 0 packages

When changesets are added to this PR, you'll see the packages that this PR includes changesets for and the associated semver types

Not sure what this means? Click here to learn what changesets are.

Click here if you're a maintainer who wants to add another changeset to this PR

@nikosdouvlis nikosdouvlis merged commit 0551202 into main Jun 30, 2026
52 of 53 checks passed
@nikosdouvlis nikosdouvlis deleted the test/react-router-context-isolation branch June 30, 2026 09:22
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant