feat: vercel-basic-auth に beforeAuth / afterAuth コールバックを追加#23
Draft
amotarao wants to merge 1 commit into
Draft
Conversation
Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
Walkthrough
Changes
Sequence Diagram(s)sequenceDiagram
participant Client
participant basicAuth as basicAuth<br/>Middleware
participant beforeAuth as beforeAuth<br/>Hook
participant validate as Credential<br/>Validation
participant afterAuth as afterAuth<br/>Hook
Client->>basicAuth: Request with/without Auth Header
basicAuth->>beforeAuth: Call beforeAuth(request)
alt beforeAuth returns false
beforeAuth-->>basicAuth: false
basicAuth-->>Client: 401 Unauthorized
else beforeAuth returns true or undefined
beforeAuth-->>basicAuth: true/undefined
basicAuth->>validate: Validate credentials
alt Credentials valid
validate-->>basicAuth: ✓
basicAuth->>afterAuth: Call afterAuth(request)
alt afterAuth returns false
afterAuth-->>basicAuth: false
basicAuth-->>Client: 401 Unauthorized
else afterAuth returns true or undefined
afterAuth-->>basicAuth: true/undefined
basicAuth-->>Client: null (Allow)
end
else Credentials invalid
validate-->>basicAuth: ✗
basicAuth-->>Client: 401 Unauthorized
end
end
Estimated code review effort🎯 3 (Moderate) | ⏱️ ~25 minutes Possibly related PRs
Suggested reviewers
Poem
🚥 Pre-merge checks | ✅ 4 | ❌ 1❌ Failed checks (1 warning)
✅ Passed checks (4 passed)
✏️ Tip: You can configure your own custom pre-merge checks in the settings. ✨ Finishing Touches📝 Generate docstrings
🧪 Generate unit tests (beta)
Comment |
![coderabbitai[bot]](https://avatars.githubusercontent.com/in/347564?s=60&v=4){kind=small}
There was a problem hiding this comment.
Actionable comments posted: 1
🤖 Prompt for all review comments with AI agents
Verify each finding against the current code and only fix it if needed.
Inline comments:
In `@packages/vercel-basic-auth/src/index.ts`:
- Around line 16-20: The JSDoc for beforeAuth is incorrect about when it's
invoked; update the comment to state that beforeAuth is executed before the
built-in environment check (i.e., called prior to any environment gating) and
that returning true continues the normal auth flow while false returns a 401.
Locate the beforeAuth parameter/option in this module (the beforeAuth callback
referenced in the exported auth setup) and change the JSDoc text to reflect
"called before environment check" and keep the existing behavior description
(true -> proceed, false -> return 401).
🪄 Autofix (Beta)
Fix all unresolved CodeRabbit comments on this PR:
- Push a commit to this branch (recommended)
- Create a new PR with the fixes
ℹ️ Review info
⚙️ Run configuration
Configuration used: Organization UI
Review profile: CHILL
Plan: Pro
Run ID: 7df4e47d-dfc4-4902-ae8a-67a8b31217e6
📒 Files selected for processing (3)
.changeset/vercel-basic-auth-callbacks.mdpackages/vercel-basic-auth/src/index.test.tspackages/vercel-basic-auth/src/index.ts
Comment on lines
+16
to
+20
| /** | ||
| * 組み込みの環境判定後、認証チェック前に呼ばれるコールバック | ||
| * - true を返すと通常の認証フローに進む | ||
| * - false を返すと認証失敗 (401) を返す | ||
| */ |
There was a problem hiding this comment.
beforeAuth の JSDoc が実装順序と逆です。
Line 17 は「環境判定後」となっていますが、実装は Line 50 で環境判定より前に beforeAuth を実行しています。利用者向け仕様説明が誤るため修正してください。
修正案（JSDoc のみ）
/**
- * 組み込みの環境判定後、認証チェック前に呼ばれるコールバック
+ * 組み込みの環境判定前に呼ばれるコールバック
* - true を返すと通常の認証フローに進む
* - false を返すと認証失敗 (401) を返す
*/📝 Committable suggestion
‼️ IMPORTANT
Carefully review the code before committing. Ensure that it accurately replaces the highlighted code, contains no missing lines, and has no issues with indentation. Thoroughly test & benchmark the code to ensure it meets the requirements.
Suggested change
| /** | |
| * 組み込みの環境判定後、認証チェック前に呼ばれるコールバック | |
| * - true を返すと通常の認証フローに進む | |
| * - false を返すと認証失敗 (401) を返す | |
| */ | |
| /** | |
| * 組み込みの環境判定前に呼ばれるコールバック | |
| * - true を返すと通常の認証フローに進む | |
| * - false を返すと認証失敗 (401) を返す | |
| */ |
🤖 Prompt for AI Agents
Verify each finding against the current code and only fix it if needed.
In `@packages/vercel-basic-auth/src/index.ts` around lines 16 - 20, The JSDoc for
beforeAuth is incorrect about when it's invoked; update the comment to state
that beforeAuth is executed before the built-in environment check (i.e., called
prior to any environment gating) and that returning true continues the normal
auth flow while false returns a 401. Locate the beforeAuth parameter/option in
this module (the beforeAuth callback referenced in the exported auth setup) and
change the JSDoc text to reflect "called before environment check" and keep the
existing behavior description (true -> proceed, false -> return 401).
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
basicAuthにbeforeAuth/afterAuthコールバックオプションを追加beforeAuth(request): boolean— 環境判定より先に実行。falseを返すと即 401、trueで通常の認証フローに進むafterAuth(request): boolean— 認証成功後に実行。falseを返すと 401、trueで通過Test plan
beforeAuthがfalseのとき 401 を返すことbeforeAuthがtrueのとき通常の認証フローに進むことNODE_ENV=developmentでもbeforeAuthが呼ばれることafterAuthがfalseのとき 401 を返すことafterAuthが呼ばれないことCloses #21
🤖 Generated with Claude Code
Summary by CodeRabbit
リリースノート
basicAuthAPI に認証前後で実行されるコールバック機能を追加。beforeAuthで認証前のカスタム処理、afterAuthで認証後のカスタム処理が可能になり、どちらかがfalseを返すと 401 レスポンスとなります。