fix(clerk): Remove privateMetadata property from getCurrentUser (#7668)

The privateMetadata property should not be accessible on the client side. This commit removes this property from the getCurrentUser function returned user object. Co-authored-by: Stefanos Anagnostou <[email protected]>
redwoodjs · Feb 22, 2023 · fcd350d · fcd350d
1 parent 23cc1b1
commit fcd350d
Showing 1 changed file with 5 additions and 2 deletions.
diff --git a/packages/auth-providers/clerk/setup/src/templates/api/lib/auth.ts.template b/packages/auth-providers/clerk/setup/src/templates/api/lib/auth.ts.template
@@ -29,11 +29,14 @@ export const getCurrentUser = async (
 
   const { roles } = parseJWT({ decoded })
 
+  // Remove privateMetadata property from CurrentUser as it should not be accessible on the web
+  const { privateMetadata, ...userWithoutPrivateMetadata } = decoded
+
   if (roles) {
-    return { ...decoded, roles }
+    return { ...userWithoutPrivateMetadata, roles }
   }
 
-  return { ...decoded }
+  return { ...userWithoutPrivateMetadata }
 }
 
 /**