Description

Adds @clerk/eslint-plugin-next, an ESLint plugin for the Next app router. Adds a first rule, require-auth-protection that enforces auth protections at the page/route/server action level.

The rule flags any page, layout, template, default, route, or Server Action under folders configured as protected that doesn't guard itself with await auth.protect() (or an equivalent early-exit auth() check).

What's included

• New package packages/eslint-plugin-next (dual CJS/ESM, type-only deps, eslint >=9 peer, ships at 0.0.0 → 0.1.0)
• require-auth-protection rule with protected (required), public, and mixedScopeLayouts options
• Full test suite
• CI setup

Config

import clerkNext from '@clerk/eslint-plugin-next';

export default [
  {
    plugins: { '@clerk/next': clerkNext },
    rules: {
      '@clerk/next/require-auth-protection': [
        'error',
        {
          protected: ['app/**'],
          public: ['app/sign-in/**', 'app/sign-up/**'],
        },
      ],
    },
  },
];

Also see README.

Errors

• missingProtect:
  • 'Expected await auth.protect() at the top of {{subject}} in a folder configured as protected. Add the call to the top of the function, move the file into a public folder, or configure this folder as public.',
• exportImported:
  • "This {{subject}} is exported from '{{source}}'. The rule cannot follow imports across files. Add a wrapper with await auth.protect(), or ensure the imported function calls it and add an eslint-disable comment with a reason.",
• unverifiableExport:
  • 'This {{subject}} could not be verified as being protected, likely because it is assigned from a call expression (e.g. const handler = withAuth(impl)). Inline a function literal that calls await auth.protect(), or add an eslint-disable comment with a reason.',
• unlistedMixedScopeLayout (only if an explicit mixedScopeLayouts was provided in config):
  • "This {{fileKind}} at '{{folder}}/' wraps both protected and public descendants but is not listed in mixedScopeLayouts. Either add '{{folder}}' to the list to acknowledge the mixed scope, or restructure so the {{fileKind}} wraps only public or protected descendants.",

Notes

• Verified against our internal dashboard repo
• Other tooling is upcoming
• Before merging and releasing, we need to double check first time publish via OIDC will work

Checklist

• pnpm test runs as expected.
• pnpm build runs as expected.
• (If applicable) JSDoc comments have been added or updated for any package exports
• (If applicable) Documentation has been updated

Type of change

• 🐛 Bug fix
• 🌟 New feature
• 🔨 Breaking change
• 📖 Refactoring / dependency upgrade / documentation
• other:

Summary by CodeRabbit

Release Notes

• New Features
  • Introduced @clerk/eslint-plugin-next ESLint plugin for Next.js App Router
  • Added require-auth-protection rule to enforce authentication protection in pages, routes, layouts, and server actions
  • Plugin supports configurable folder patterns and validates proper authentication guard placement