fix(tanstack-react-start): Do not consume the body of the request in middleware (#7020)

Co-authored-by: Robert Soriano <sorianorobertc@gmail.com>

Author: p9f

.changeset/full-horses-repair.md

@@ -0,0 +1,5 @@
+---
+'@clerk/tanstack-react-start': patch
+---
+
+Fixed a bug where the `clerkMiddleware()` helper would consume the body of the request

packages/tanstack-react-start/src/server/clerkMiddleware.ts

@@ -1,5 +1,5 @@
 import type { RequestState } from '@clerk/backend/internal';
-import { AuthStatus, constants } from '@clerk/backend/internal';
+import { AuthStatus, constants, createClerkRequest } from '@clerk/backend/internal';
 import { handleNetlifyCacheInDevInstance } from '@clerk/shared/netlifyCacheHandler';
 import type { PendingSessionOptions } from '@clerk/types';
 import type { AnyRequestMiddleware } from '@tanstack/react-start';
@@ -8,12 +8,13 @@ import { createMiddleware, json } from '@tanstack/react-start';
 import { clerkClient } from './clerkClient';
 import { loadOptions } from './loadOptions';
 import type { ClerkMiddlewareOptions } from './types';
-import { getResponseClerkState } from './utils';
+import { getResponseClerkState, patchRequest } from './utils';
 
 export const clerkMiddleware = (options?: ClerkMiddlewareOptions): AnyRequestMiddleware => {
   return createMiddleware().server(async args => {
-    const loadedOptions = loadOptions(args.request, options);
-    const requestState = await clerkClient().authenticateRequest(args.request, {
+    const clerkRequest = createClerkRequest(patchRequest(args.request));
+    const loadedOptions = loadOptions(clerkRequest, options);
+    const requestState = await clerkClient().authenticateRequest(clerkRequest, {
       ...loadedOptions,
       acceptsToken: 'any',
     });

packages/tanstack-react-start/src/server/loadOptions.ts

@@ -1,4 +1,4 @@
-import { createClerkRequest } from '@clerk/backend/internal';
+import type { ClerkRequest } from '@clerk/backend/internal';
 import { apiUrlFromPublishableKey } from '@clerk/shared/apiUrlFromPublishableKey';
 import { getEnvVariable } from '@clerk/shared/getEnvVariable';
 import { isDevelopmentFromSecretKey } from '@clerk/shared/keys';
@@ -9,10 +9,8 @@ import { errorThrower } from '../utils';
 import { getPublicEnvVariables } from '../utils/env';
 import { commonEnvs } from './constants';
 import type { LoaderOptions } from './types';
-import { patchRequest } from './utils';
 
-export const loadOptions = (request: Request, overrides: LoaderOptions = {}) => {
-  const clerkRequest = createClerkRequest(patchRequest(request));
+export const loadOptions = (request: ClerkRequest, overrides: LoaderOptions = {}) => {
   const commonEnv = commonEnvs();
   const secretKey = overrides.secretKey || commonEnv.SECRET_KEY;
   const machineSecretKey = overrides.machineSecretKey || commonEnv.MACHINE_SECRET_KEY;
@@ -21,15 +19,15 @@ export const loadOptions = (request: Request, overrides: LoaderOptions = {}) =>
   const apiUrl = getEnvVariable('CLERK_API_URL') || apiUrlFromPublishableKey(publishableKey);
   const domain = handleValueOrFn(overrides.domain, new URL(request.url)) || commonEnv.DOMAIN;
   const isSatellite = handleValueOrFn(overrides.isSatellite, new URL(request.url)) || commonEnv.IS_SATELLITE;
-  const relativeOrAbsoluteProxyUrl = handleValueOrFn(overrides?.proxyUrl, clerkRequest.clerkUrl, commonEnv.PROXY_URL);
+  const relativeOrAbsoluteProxyUrl = handleValueOrFn(overrides?.proxyUrl, request.clerkUrl, commonEnv.PROXY_URL);
   const signInUrl = overrides.signInUrl || commonEnv.SIGN_IN_URL;
   const signUpUrl = overrides.signUpUrl || commonEnv.SIGN_UP_URL;
   const afterSignInUrl = overrides.afterSignInUrl || getPublicEnvVariables().afterSignInUrl;
   const afterSignUpUrl = overrides.afterSignUpUrl || getPublicEnvVariables().afterSignUpUrl;
 
   let proxyUrl;
   if (!!relativeOrAbsoluteProxyUrl && isProxyUrlRelative(relativeOrAbsoluteProxyUrl)) {
-    proxyUrl = new URL(relativeOrAbsoluteProxyUrl, clerkRequest.clerkUrl).toString();
+    proxyUrl = new URL(relativeOrAbsoluteProxyUrl, request.clerkUrl).toString();
   } else {
     proxyUrl = relativeOrAbsoluteProxyUrl;
   }