Separate authToken from secretKey in ThirdwebClient #6983
Conversation
|
The latest updates on your projects. Learn more about Vercel for Git ↗︎
|
|
github-actions
bot
added
Dashboard
How to use the Graphite Merge QueueAdd either label to this PR to merge it via the merge queue:
You must have a Graphite account in order to use the merge queue. Sign up using this link. An organization admin has enabled the Graphite Merge Queue in this repository. Please do not merge from GitHub as this will restart CI on PRs being processed by the merge queue. This stack of pull requests is managed by Graphite. Learn more about stacking. |
jnsdls
force-pushed
the
Separate_authToken_from_secretKey_in_ThirdwebClient
branch
from
2eadf4f to
f2b9861
Compare
![graphite-app[bot]](https://avatars.githubusercontent.com/in/158384?s=60&v=4){kind=small}
| if (!headers) { | ||
| headers = new Headers(); | ||
| } | ||
| // auth token if secret key === jwt | ||
| const authToken = | ||
| useAuthToken && client.secretKey && isJWT(client.secretKey) | ||
| ? client.secretKey | ||
| : undefined; | ||
| // secret key if secret key !== jwt | ||
| const secretKey = | ||
| client.secretKey && !isJWT(client.secretKey) | ||
| ? client.secretKey | ||
| : undefined; | ||
| const clientId = client.clientId; | ||
|
|
||
| // if we have an auth token set, use that (thirdweb dashboard sets this for the user) | ||
|
|
||
| // if we have an auth token set & useAuthToken is true, use the auth token (thirdweb dashboard sets this for the user) | ||
| // pay urls should never send the auth token, because we always want the "developer" to be the one making the request, not the "end user" | ||
| if ( | ||
| authToken && | ||
| useAuthToken && | ||
| client.authToken && | ||
| !isPayUrl(urlString) && | ||
| !isInAppWalletUrl(urlString) && | ||
| !isBundlerUrl(urlString) | ||
| ) { | ||
| headers.set("authorization", `Bearer ${authToken}`); | ||
| headers.set("authorization", `Bearer ${client.authToken}`); |
There was a problem hiding this comment.
The code should be modified to maintain backward compatibility with tests that expect JWT tokens to be passed as secretKey. We should check both client.authToken and if client.secretKey is a JWT. For example: if (useAuthToken && (client.authToken || (client.secretKey && isJWT(client.secretKey))) && ...)
Spotted by Diamond (based on CI logs)
Is this helpful? React 👍 or 👎 to let us know.
size-limit report 📦
|
PR-Codex overview
This PR focuses on refactoring the
createThirdwebClientfunction to replace the use ofsecretKeywithauthToken, enhancing how authentication is managed and improving error handling related to client creation.Detailed summary
secretKeywithauthTokenincreateThirdwebClientoptions.clientIdmust accompanyauthToken.authToken.authTokenoversecretKey.