feat(express): add express integration package (@aura-stack/express)#138
feat(express): add express integration package (@aura-stack/express)#138halvaradop merged 4 commits intomasterfrom
Conversation
|
The latest updates on your projects. Learn more about Vercel for GitHub. |
|
Warning Rate limit exceeded
Your organization is not enrolled in usage-based pricing. Contact your admin to enable usage-based pricing to continue reviews beyond the rate limit, or try again in 5 minutes and 27 seconds. ⌛ How to resolve this issue?After the wait time has elapsed, a review can be triggered using the We recommend that you space out your commits to avoid hitting the rate limit. 🚦 How do rate limits work?CodeRabbit enforces hourly rate limits for each developer per organization. Our paid plans have higher rate limits than the trial, open-source and free plans. In all cases, we re-allow further reviews after a brief timeout. Please see our FAQ for further information. ℹ️ Review info⚙️ Run configurationConfiguration used: defaults Review profile: CHILL Plan: Pro Run ID: 📒 Files selected for processing (1)
📝 WalkthroughWalkthroughA new Changes
Sequence DiagramsequenceDiagram
participant Client
participant Express as "Express App"
participant withAuth as "withAuth Middleware"
participant AuthAPI as "Auth API (api.getSession)"
participant Handler as "Route Handler"
participant Response
Client->>Express: HTTP Request
Express->>withAuth: invoke middleware
withAuth->>AuthAPI: getSession(headers)
AuthAPI-->>withAuth: session | null
withAuth->>Express: set res.locals.session
withAuth->>Handler: next()
alt session exists
Handler->>Response: 200 + session data
else session missing
Handler->>Response: 401 { message: "Unauthorized" }
end
Response-->>Client: HTTP Response
Estimated code review effort🎯 4 (Complex) | ⏱️ ~45 minutes Possibly related PRs
Suggested labels
Poem
🚥 Pre-merge checks | ✅ 3✅ Passed checks (3 passed)
✏️ Tip: You can configure your own custom pre-merge checks in the settings. ✨ Finishing Touches🧪 Generate unit tests (beta)
Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out. Comment |
![coderabbitai[bot]](https://avatars.githubusercontent.com/in/347564?s=60&v=4){kind=small}
There was a problem hiding this comment.
Actionable comments posted: 4
🧹 Nitpick comments (1)
packages/express/test/index.test.ts (1)
25-29: Consider deduplicating the repeated JWT payload setup.Both tests construct the same token payload; extracting a small helper/fixture would reduce drift risk in future edits.
Also applies to: 67-71
🤖 Prompt for AI Agents
Verify each finding against the current code and only fix it if needed. In `@packages/express/test/index.test.ts` around lines 25 - 29, Extract the repeated JWT payload used with auth.jose.encodeJWT into a shared test fixture/helper (e.g., a const jwtPayload or function makeTestJwtPayload and/or helper makeSessionToken that calls auth.jose.encodeJWT) and replace the duplicate inline payloads in the tests that call auth.jose.encodeJWT (the occurrences around the current tests and the ones at lines ~67-71) to use the shared helper; ensure the helper is exported or available in the test scope so both tests import/use the same payload/creation logic to avoid drift.
🤖 Prompt for all review comments with AI agents
Verify each finding against the current code and only fix it if needed.
Inline comments:
In `@apps/express/src/app.ts`:
- Around line 12-18: The handler currently sends a 401 with
res.status(401).json({ message: "Unauthorized" }) but does not stop execution,
causing a second res.json(...) send and a "Cannot set headers after they are
sent" crash; change the control flow around the res.locals.session check in
app.ts to return immediately after sending the 401 (or use an else block) so
execution does not fall through to the subsequent res.json(...) that references
res.locals.session.
In `@packages/express/package.json`:
- Around line 19-20: The package.json scripts use "prepublish" and run
"clean:cts" which is deprecated and can run at install time; change the
lifecycle hook to "prepublishOnly" and update the "clean:cts" script to guard
against a missing dist directory (e.g., test for existence of dist before
running find) so the command returns zero when dist is absent; update the
"clean:cts" and replace the "prepublish" entry with "prepublishOnly" in
package.json to ensure cleanup runs only on publish and does not fail when dist/
doesn't exist.
In `@packages/express/test/presets.ts`:
- Around line 12-18: The handler currently checks res.locals.session then calls
res.status(401).json(...) but does not return, so execution continues and later
calls res.json(...) again; update the control flow in the block that inspects
res.locals.session so that after sending the 401 response you return immediately
(e.g., add a return before/after res.status(401).json(...)), and likewise ensure
the success path returns after sending the JSON response to avoid
double-response errors; locate the conditional using res.locals.session and the
two res.json/res.status calls to apply the fixes.
In `@packages/express/test/types.test-d.ts`:
- Around line 9-13: The test assertions wrongly expect res.locals.session to
allow undefined and be optional; update the two type assertions to match the
middleware's LocalsWithSession from with-auth.ts by removing "| undefined" from
the concrete type and removing the optional property form—i.e., assert
res.locals.session is exactly Session<ShapeToObject<EditableShape<UserShape>>> |
null (no undefined) and assert res.locals equals an object with a required
session: Session<ShapeToObject<EditableShape<UserShape>>> | null combined with
Locals, matching the LocalsWithSession definition.
---
Nitpick comments:
In `@packages/express/test/index.test.ts`:
- Around line 25-29: Extract the repeated JWT payload used with
auth.jose.encodeJWT into a shared test fixture/helper (e.g., a const jwtPayload
or function makeTestJwtPayload and/or helper makeSessionToken that calls
auth.jose.encodeJWT) and replace the duplicate inline payloads in the tests that
call auth.jose.encodeJWT (the occurrences around the current tests and the ones
at lines ~67-71) to use the shared helper; ensure the helper is exported or
available in the test scope so both tests import/use the same payload/creation
logic to avoid drift.
🪄 Autofix (Beta)
Fix all unresolved CodeRabbit comments on this PR:
- Push a commit to this branch (recommended)
- Create a new PR with the fixes
ℹ️ Review info
⚙️ Run configuration
Configuration used: defaults
Review profile: CHILL
Plan: Pro
Run ID: 509c0f8d-fb34-4b33-88bf-5ec6cbd85ca0
⛔ Files ignored due to path filters (1)
pnpm-lock.yamlis excluded by!**/pnpm-lock.yaml
📒 Files selected for processing (25)
apps/express/README.mdapps/express/package.jsonapps/express/src/app.tsapps/express/src/auth.tsapps/express/src/index.tsapps/express/src/lib/auth.tsapps/express/src/lib/verify-session.tsapps/express/src/server.tsapps/express/src/types.d.tsapps/express/tsconfig.jsonpackages/express/CHANGELOG.mdpackages/express/README.mdpackages/express/deno.jsonpackages/express/package.jsonpackages/express/src/createAuth.tspackages/express/src/index.tspackages/express/src/lib/handler.tspackages/express/src/lib/with-auth.tspackages/express/src/oauth/index.tspackages/express/test/index.test.tspackages/express/test/presets.tspackages/express/test/types.test-d.tspackages/express/tsconfig.jsonpackages/express/tsup.config.tspackages/express/vitest.config.ts
💤 Files with no reviewable changes (4)
- apps/express/src/types.d.ts
- apps/express/src/server.ts
- apps/express/src/lib/verify-session.ts
- apps/express/src/auth.ts
| "clean:cts": "find dist -type f -name \"*.cts\" -delete", | ||
| "prepublish": "pnpm clean:cts" |
There was a problem hiding this comment.
🧩 Analysis chain
🏁 Script executed:
#!/bin/bash
set -u
echo "Inspecting scripts in packages/express/package.json"
jq -r '.scripts | {clean_cts: ."clean:cts", prepublish, prepublishOnly}' packages/express/package.json
echo
echo "Checking current behavior of clean:cts command when dist is missing/present"
code=0
(
cd packages/express || exit 1
find dist -type f -name "*.cts" -print >/dev/null
) || code=$?
echo "find command exit code: $code (non-zero indicates fragility if dist is absent)"Repository: aura-stack-ts/auth
Length of output: 445
🏁 Script executed:
# Check if there are any other prepublish uses in the repo that might provide context
rg -i "prepublish" --type json
# Check the project structure and build configuration
cat -n packages/express/package.json | head -40Repository: aura-stack-ts/auth
Length of output: 1513
🌐 Web query:
npm prepublish vs prepublishOnly lifecycle hooks
💡 Result:
npm prepublish and prepublishOnly are lifecycle scripts in package.json with distinct behaviors. prepublish (DEPRECATED): Does not run during npm publish. Runs during npm install and npm ci (in the package directory). This changed from its original behavior due to historical reasons causing confusion. prepublishOnly: Runs BEFORE the package is prepared and packed, ONLY during npm publish. Ideal for final validation like tests or linting before publishing, without running on install. Key difference: prepublishOnly is exclusive to npm publish, while prepublish runs on install/ci but skips publish. Lifecycle order for npm publish: - prepublishOnly - prepack - prepare - postpack - publish - postpublish Use prepublishOnly for publish-only checks. For build steps needed on both publish and local install, use prepare instead. prepublish usage triggers deprecation warnings and is not recommended. As of npm v11.12.0 (latest in 2026), no further changes to these scripts are planned.
Citations:
- 1: https://docs.npmjs.com/cli/v8/using-npm/scripts/
- 2: https://docs.npmjs.com/cli/v11/using-npm/scripts/
- 3: https://docs.npmjs.com/cli/v9/using-npm/scripts/
- 4: https://github.com/npm/cli/blob/e2346e7702acccefe6d711168c2b0e0e272e194a/doc/misc/npm-scripts.md
- 5: Are changes to
prepublishOnlyandprepublishstill planned? npm/cli#8191
Use prepublishOnly instead of prepublish for the clean:cts script.
The prepublish hook is deprecated and runs during npm install/npm ci, not during npm publish. This means the .cts file cleanup won't execute when actually publishing the package. Additionally, the find dist command will fail with a non-zero exit code if the dist/ directory doesn't exist.
Update to:
- Use
prepublishOnlyto ensure the script runs only during publish - Add a directory existence check to prevent failures when
dist/is absent
Suggested fix
- "clean:cts": "find dist -type f -name \"*.cts\" -delete",
- "prepublish": "pnpm clean:cts"
+ "clean:cts": "[ -d dist ] && find dist -type f -name \"*.cts\" -delete || true",
+ "prepublishOnly": "pnpm clean:cts"📝 Committable suggestion
‼️ IMPORTANT
Carefully review the code before committing. Ensure that it accurately replaces the highlighted code, contains no missing lines, and has no issues with indentation. Thoroughly test & benchmark the code to ensure it meets the requirements.
| "clean:cts": "find dist -type f -name \"*.cts\" -delete", | |
| "prepublish": "pnpm clean:cts" | |
| "clean:cts": "[ -d dist ] && find dist -type f -name \"*.cts\" -delete || true", | |
| "prepublishOnly": "pnpm clean:cts" |
🤖 Prompt for AI Agents
Verify each finding against the current code and only fix it if needed.
In `@packages/express/package.json` around lines 19 - 20, The package.json scripts
use "prepublish" and run "clean:cts" which is deprecated and can run at install
time; change the lifecycle hook to "prepublishOnly" and update the "clean:cts"
script to guard against a missing dist directory (e.g., test for existence of
dist before running find) so the command returns zero when dist is absent;
update the "clean:cts" and replace the "prepublish" entry with "prepublishOnly"
in package.json to ensure cleanup runs only on publish and does not fail when
dist/ doesn't exist.
There was a problem hiding this comment.
Actionable comments posted: 1
🤖 Prompt for all review comments with AI agents
Verify each finding against the current code and only fix it if needed.
Inline comments:
In `@packages/express/src/lib/with-auth.ts`:
- Around line 25-29: getSession is returning response headers that are currently
discarded; update the handler around the api.getSession call so you capture the
returned headers and forward them to the outgoing Express response before
calling next() (e.g., assign const { session, headers } = await
api.getSession(...); set those headers onto res using the appropriate Express
method and then set res.locals.session = session and return next()). Ensure you
forward all header entries from headers and do this in the same block where
webRequest.headers is passed to getSession.
🪄 Autofix (Beta)
Fix all unresolved CodeRabbit comments on this PR:
- Push a commit to this branch (recommended)
- Create a new PR with the fixes
ℹ️ Review info
⚙️ Run configuration
Configuration used: defaults
Review profile: CHILL
Plan: Pro
Run ID: 44a2cdf5-5cd9-44d7-bbaa-01e4626a2861
📒 Files selected for processing (4)
apps/express/src/app.tspackages/express/src/lib/with-auth.tspackages/express/test/index.test.tspackages/express/test/presets.ts
🚧 Files skipped from review as they are similar to previous changes (3)
- apps/express/src/app.ts
- packages/express/test/index.test.ts
- packages/express/test/presets.ts
halvaradop
added
enhancement
1 participant
Description
This pull request introduces the
@aura-stack/expresspackage, providing seamless integration for Express applications. The package includes built-in middlewares and adapters that bridge Web Standard APIs (Request,Response) with Express’sIncomingMessageandServerResponse.This enables Aura Auth to run natively within Express environments while preserving compatibility with its internal Web API-based architecture.
Key Changes
@aura-stack/expresspackagewithAuthmiddleware for protected routestoHandleradapter to connect Aura Auth handlers with Express routescreateAuthapps/expressto use the dedicated packageUsage