Security Release for Redwood Apps Using Clerk

We've made a security improvement to the getCurrentUser function in the api-side Clerk auth template (PR here: #7668). Existing projects using Clerk as an auth provider should run the codemod or make the changes manually.

In detail, with Clerk, you can set privateMetadata on a user. (Note that you have to set data on this property via the Clerk API for there to be data there.) The template getCurrentUser was returning this data to the frontend by default, making it available to your frontend code when a user was logged in.

Clerk users should run this codemod:

npx @redwoodjs/codemods@canary update-clerk-get-current-user

Or make the changes manually:

 // api/src/lib/auth.ts

 export const getCurrentUser = async (
   decoded,
   /* eslint-disable-next-line @typescript-eslint/no-unused-vars */
   { token, type },
   /* eslint-disable-next-line @typescript-eslint/no-unused-vars */
   { event, context }
 ) => {
   if (!decoded) {
     logger.warn('Missing decoded user')
     return null
   }

   const { roles } = parseJWT({ decoded })

+  const { privateMetadata, ...userWithoutPrivateMetadata } = decoded

   if (roles) {
-    return { ...decoded, roles }
+    return { ...userWithoutPrivateMetadata, roles }
   }

-  return { ...decoded }
+  return { ...userWithoutPrivateMetadata }
 }

Changelog

Features

• 7482/validators exclude include caseinsensitive #7573 by @taivo

Fixed

• fix(clerk): Remove privateMetadata property from getCurrentUser #7668 by @anagstef
• Fix yarn rw exec to set nonzero exit code on error #7660 by @rcrogers
• Get rid of red squiggles in new lambda functions #7640 by @Tobbe
• Forms: Export EmptyAsValue #7656 by @Tobbe

Docs

• Update CORS docs to reflect Redwood 4 changes #7627 by @schybo
• fix(docs): typo in GraphQL docs #7634 by @BlackHawkSigma
• Fix the world's most minor typo (txs -> tsx) #7658 by @CarlQLange
• Update useRequireAuth docs to v4 auth #7646 by @Tobbe
• Update directives.md #7670 by @alirezaRaisSattari

Chore

• chore(deps): bump @sideway/formula from 3.0.0 to 3.0.1 in /docs #7593 by @dependabot
• chore(CI): CI telemetry checking #7623 by @Josh-Walker-GM

Core dependencies

• fix(deps): update prisma monorepo to v4.10.1 #7601
• fix(deps): update dependency fastify to v4.13.0 #7604

Dependencies