Repository navigation
CodeDiag 0.9 "Perimeter" - #39
Merged
Merged
Conversation
Mutations are not reported as missing auth middleware when the whole router is authenticated before procedures run: - a createContext (or a project function it calls) that throws TRPCError UNAUTHORIZED/FORBIDDEN or throws when the session is missing; T3's createTRPCContext, which only reads the session, does not count; - auth middleware ahead of the Express mount that serves the adapter, in the same use() call or an earlier global or enclosing-path use(); - a Next.js middleware.ts (proxy.ts in Next.js 16) that rejects anonymous requests (next-auth/middleware, Clerk auth.protect() under a route matcher, or a redirect or 401/403 when the session is missing) and whose matcher covers the tRPC route. Matchers are tested against the route path only, so the common /((?!api|...).*) matcher that skips the API does not count. The API Health summary names where the perimeter was found.
Dependency updates that change dist/action.cjs failed bundle:check until someone rebuilt the bundle by hand. A read-only job now runs npm ci and the build on Dependabot pull requests; when the bundle changes, a second job that runs no repository or dependency code commits only the two bundle files and starts CI for the new commit through workflow_dispatch, since commits pushed with GITHUB_TOKEN do not trigger pull_request runs. Dependabot groups minor and patch npm updates into one pull request.
…concurrently Successful audits are written to node_modules/.cache/codediag, keyed by the audit command and the exact lock file and package.json contents, and reused for an hour by later scans and editor saves; entries are validated on read, failed audits are never kept, and nothing is written when the project has no node_modules. A reused result is named in the Dependencies summary with its age. --workspaces scans start every package's audit up front, four at a time, and the package scans reuse those outcomes, so the waiting overlaps instead of adding up. On a three-package npm workspace the scan takes 2.8 s, and 0.9 s once the audits are cached.
Contributor
✅ CodeDiag: 95/100 (A+)threshold 0
No findings in the files this pull request changes. Not listed: 2 findings elsewhere in the project, 1 suppressed. Scanned by CodeDiag · updated on every push |
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
CodeDiag 0.9 "Perimeter": tRPC apps that authenticate in front of their procedures stop getting missing-auth warnings, dependency audits are cached and run concurrently across monorepo packages, and Dependabot updates keep the Action bundle in step.
Changes
src/analyzers/trpc-perimeter.ts): mutations are not reported as missing auth when the whole router is authenticated first:createContext(or a project function it calls) that throwsTRPCErrorUNAUTHORIZED/FORBIDDENor throws when the session is missing; T3's session-readingcreateTRPCContextdoes not count;use()or an earlier global/enclosing-pathuse();middleware.ts/proxy.tsthat rejects anonymous requests (next-auth/middleware, Clerkauth.protect()under a route matcher, or a redirect/401/403 when the session is missing) and whosematchercovers the tRPC route. Matchers are tested against the route path only, so/((?!api|...).*)does not count.src/analyzers/audit-cache.ts): successful audits are kept for an hour innode_modules/.cache/codediag, keyed by command, lock file, andpackage.json; validated on read; failures never kept; nothing written withoutnode_modules. The Dependencies summary says when a result was reused.--workspacesstarts every package's audit up front, four at a time; package scans reuse the outcomes.dist/action.cjs; a job that runs no repository or dependency code commits the two bundle files and starts CI throughworkflow_dispatch. Dependabot groups minor and patch npm updates.Verification
npm run check: lint, format, typecheck, extension, 362 unit tests (361 pass, 1 skipped on Windows for symlinks), build,bundle:check, 33 CLI/Action tests.npm auditon a three-package npm workspace: 2.8 s cold, 0.9 s with the cache; every package reports itsvuln-high.