NextjsAuthTagger
Inherits FrameworkTagger < FileHelper < Tagger < Reference < Object
Constants
A read of the submitted body. With a password in it, the helper is a login.
auth = await checkAuth(request), const session = await getSession():
group 1 the value, group 2 the callee. Whether the callee checks the
caller is judged by its definition (caller_check_callee?).
error = () => unauthorized();: group 1 the name a refusal is stored in.
How far above the 401 its if may sit (a Prettier-wrapped reply).
Starting a session (cookies().set(...), a Set-Cookie header) is a login too.
const { auth, error } = await parseRequest(request);
} else if (…) {, else {: a sibling branch of the if above it.
if (process.env.CLOUD_MODE) { / if (process.env.X !== '1') return notFound();:
a deployment switch. One that refuses everyone may come before the
check; any other runs for a caller the check would refuse, when set.
A server-side secret: not one the browser is given (NEXT_PUBLIC_*,
Stripe's *_PUBLISHABLE_KEY).
A statement of the handler that starts with a call:
const user = await authMiddleware();, validateRequest(request);,
return await handler(request);. Group 1 is the callee.
How many helper hops to follow (GET → handler → checkCronKey).
const method = req.method, const isGet = request.method === 'GET',
const { method } = req: names the verb is read into.
if (![process.env.CRON_API_KEY, Bearer ${process.env.CRON_SECRET}] .includes(apiKey)): the key is none of the accepted secrets. Read on
the line as written, since the template literal holds a secret.
if (!auth): group 1 the value whose absence is refused.
return unauthorized(), throw unauthorized(), error = () => forbidden(): a call whose own definition replies 401/403 is that reply.
Group 1 the callee.
const denied = await checkAuth(); if (denied) return denied;
if (authHeader !== `Bearer ${process.env.CRON_SECRET}`): also read
as written, the secret being inside a template literal.
throw new DubApiError({ code: "unauthorized" }): the word lives in a
string, so this is matched on text that still has strings. The { sits
between throw and the word, and the object may wrap a line or two.
Next.js has no route-level guard syntax: an API route checks the caller
in its own body (if (!session) return NextResponse.json(.., { status: 401 })). A 401 reply under a condition on the session, or on a value
compared with a process.env secret, is that check. A 401 under any
other condition (if (!user) after a password lookup) is a login
failure anonymous callers are meant to reach, so it does not count.
401, or 403 ({ status: 403 } for a wrong cron key): both refuse the
caller, and SESSION_DENIED decides whether the condition is about them.
A pages-router handler serves every verb from one body; a 401 after a
branch on req.method that answers some verbs guards only the others.
A branch that just refuses other verbs with 405 leaves one verb, and one
that answers nothing (else if (isGet) { query = … }) splits no verbs.
export const GET = withSession(async ...). The wrapper is the guard.
export const GET = defaultResponderForAppDir(handler): group 1 the
handler the wrapper is handed.