The latest updates on your projects. Learn more about Vercel for GitHub.

1 Skipped Deployment

Project	Deployment	Actions	Updated (UTC)
worldmonitor	Ignored		Apr 2, 2026 10:03pm

Greptile Summary

This PR adds a single documentation comment to server/auth-session.ts identifying CLERK_PUBLISHABLE_KEY and CLERK_JWT_ISSUER_DOMAIN as required server-side environment variables. The functional purpose is to trigger a Vercel rebuild so that the separately-added CLERK_PUBLISHABLE_KEY env var is picked up, restoring correct JWT audience validation on /api/notification-channels (broken since #2024 when CLERK_PUBLISHABLE_KEY was added to getAllowedAudiences() but not yet provisioned in Vercel).

Key points:

• The only code change is one comment line — no logic is modified.
• The underlying logic (getAllowedAudiences consuming CLERK_PUBLISHABLE_KEY) was already in place; this deploy makes the env var available so that function returns a non-empty audience set.
• One pre-existing style issue found: the Clerk API fetch inside lookupPlanFromClerk is missing a User-Agent header, which violates the project's documented convention in AGENTS.md.

Confidence Score: 5/5

Safe to merge — change is a doc comment only, with no logic or behaviour altered.

The diff is a single comment line addition with no executable code changes. The sole risk is that the Vercel rebuild may not behave as expected if the env var was not correctly provisioned separately, but that is outside the scope of this code change.

No files require special attention.

Important Files Changed

Sequence Diagram

sequenceDiagram
    participant Client
    participant EdgeGW as Vercel Edge Gateway
    participant AuthSession as server/auth-session.ts
    participant ClerkJWKS as Clerk JWKS Endpoint
    participant ClerkAPI as Clerk Backend API

    Client->>EdgeGW: Request with Bearer token
    EdgeGW->>AuthSession: validateBearerToken(token)
    AuthSession->>ClerkJWKS: Fetch JWKS (cached, lazy via getJWKS())
    ClerkJWKS-->>AuthSession: Public keys
    AuthSession->>AuthSession: jwtVerify(token, jwks, { issuer, audience: [convex, CLERK_PUBLISHABLE_KEY] })
    alt JWT has `plan` claim
        AuthSession-->>EdgeGW: { valid: true, userId, role }
    else Standard session token
        AuthSession->>ClerkAPI: GET /v1/users/:userId (Bearer CLERK_SECRET_KEY)
        ClerkAPI-->>AuthSession: User public_metadata.plan
        AuthSession-->>EdgeGW: { valid: true, userId, role }
    end
    EdgeGW-->>Client: Response

_{Reviews (1): Last reviewed commit: "chore(auth): document required server en..." | Re-trigger Greptile}