fix(clerk): Remove privateMetadata property from getCurrentUser (#7668)

The privateMetadata property should not be accessible on the client side. This commit removes this property from the getCurrentUser function returned user object. Co-authored-by: Stefanos Anagnostou <stefanos@clerk.dev>
redwoodjs · Feb 22, 2023 · 3303ee7 · 3303ee7
1 parent d3d4f2b
commit 3303ee7
Showing 1 changed file with 5 additions and 2 deletions.
diff --git a/packages/auth-providers/clerk/setup/src/templates/api/lib/auth.ts.template b/packages/auth-providers/clerk/setup/src/templates/api/lib/auth.ts.template
@@ -29,11 +29,14 @@ export const getCurrentUser = async (
 
   const { roles } = parseJWT({ decoded })
 
+  // Remove privateMetadata property from CurrentUser as it should not be accessible on the web
+  const { privateMetadata, ...userWithoutPrivateMetadata } = decoded
+
   if (roles) {
-    return { ...decoded, roles }
+    return { ...userWithoutPrivateMetadata, roles }
   }
 
-  return { ...decoded }
+  return { ...userWithoutPrivateMetadata }
 }
 
 /**