feat: add Clerk Auth #43
No reviewers
Labels
No labels
bug
documentation
duplicate
enhancement
good first issue
help wanted
invalid
question
refactor
wontfix
No milestone
No project
No assignees
1 participant
Notifications
Due date
No due date set.
Dependencies
No dependencies set.
Reference: pantheon/hestia#43
Loading…
Add table
Reference in a new issue
No description provided.
Delete branch "please-god-help-us"
Deleting a branch is permanent. Although the deleted branch may continue to exist for a short time before it actually gets removed, it CANNOT be undone in most cases. Continue?
Closes #13
@ -12,6 +12,7 @@ node_modules# OS.DS_StoreThumbs.db.idea😂
@ -7,1 +6,4 @@DATABASE_URL="postgres://hestia:test123@localhost:5432/hestia"# CLERKthats a bit wordy
Add
--watchto generateIf you add watch the next command won't run, will need to use the package concurrency to make it work
It might make more sense to move prisma:push to database:up since its a one-shot and you need to run it manually when you make DB changes
@uniqueI believe we can drop oslo
???
@ -22,1 +52,4 @@return {user: { name: user.name },};}You can have multiple per user..?
@ -22,1 +52,4 @@return {user: { name: user.name },};}yeah but at least one
at this point you could just do
export const load = validateSession;I didn't put it to allow multiple users (on different tenant) to have the same clerkId. Like you could be managing multiple orgs and in the db it will correspond to two different users with the same clerk id
don't like that 😉 ?
when we have a tenant table, I could add
unique('clerkId', 'tenantId')@ -0,0 +1,3 @@import { withClerkHandler } from 'clerk-sveltekit/server';export const handle = withClerkHandler();https://github.com/wobsoriano/clerk-sveltekit?tab=readme-ov-file#configure-the-server-hook
Why are we using clerk/express?
@ -14,0 +25,4 @@await clerk.signOut();return;}Can you explain what this is doing?
@ -0,0 +1,3 @@import { withClerkHandler } from 'clerk-sveltekit/server';export const handle = withClerkHandler();I am using UI components from the lib so no headless
Because clerk is deprecating the nodejs package and is recommending to use this one for backend
@ -22,1 +52,4 @@return {user: { name: user.name },};}Okay. Somewhat of a nitpick, Ive never been a fan of hard-coding an array index like this in the situation the array is null or the element doesn't exist.
WE ARE PROFESSIONALS HERE MOE
@ -14,0 +25,4 @@await clerk.signOut();return;}I will add some comment, it is automatically selecting the first organization that the user is part of, if you don't do that the user get login without an organization
@ -22,1 +52,4 @@return {user: { name: user.name },};}I will add a check, I don't think it will ever happen that a user doesn't have an email, you can't register to Clerk without it
@ -7,1 +6,4 @@DATABASE_URL="postgres://hestia:test123@localhost:5432/hestia"# CLERKMaking sure no one try to change it
I will change it to an empty string, I thought we were fun professionals
Yeah, I guess tenants have 'their own' users, but this is the id coming from clerk and shouldn't ever be duplicated, unless we make the tenants bring their own clerk account like with twilio?
@ -0,0 +1,3 @@import { withClerkHandler } from 'clerk-sveltekit/server';export const handle = withClerkHandler();Oh the part your linked, I am using a new version of the lib that using the latest API of Clerk so things changed a lot from that ReadMe
is the user fullName optional...? I'd rather not default to a magic string
If there is a situation where name will be empty/undefined consider changing the db schema
for the sake of consistency and a bit readability, I will keep it like this
@ -14,0 +25,4 @@await clerk.signOut();return;}It would be better to do this check on the server to prevent anything from being leaked to the client side, you can use
+layout.server.ts. We could throw an error,403 - User does not belong to a Tenant@ -14,0 +25,4 @@await clerk.signOut();return;}I am already logging out the user on the backend, this is only selecting an org for him
@ -14,0 +25,4 @@await clerk.signOut();return;}Also, modify the error page to contain a signout button, perhaps under certain http codes (like 403)