feat(eslint-plugin): Resolve globs relative to the project root instead of /app by Ephem · Pull Request #8942 · clerk/javascript

Ephem · 2026-06-22T14:10:18Z

Description

The previous glob pattern behavior was that they resolved from app/, and not from the project root, this had two downsides:

Patterns like public: ['src/app/sign-in/**'] would fail
- This is how ESLint resolves paths, so it was a very natural thing to write and expect to work
Server Functions can live outside app/ and we still want to protect them

This PR makes a breaking change (but in a minor pre-stable version) to always anchor to the project root instead, and changes the default pattern in the Readme to protected: ['**'] to include Server Functions. The reason it's breaking is that you now have to specify src/ if that's what your project is using.

The PR also expands the Readme with some more details and specifics, including on public first patterns and monorepo setups.

The rule still only checks page.jsx, route.js etc if the file is inside of an src/app/ or app/ folder.

I also included some extra validation for the path patterns provided via the config.

Checklist

pnpm test runs as expected.
pnpm build runs as expected.
(If applicable) JSDoc comments have been added or updated for any package exports
(If applicable) Documentation has been updated

Type of change

Summary by CodeRabbit

Documentation
- Updated configuration and “fix auth protection” examples to use protected/public globs aligned with project-root-relative matching, including src/app guidance.
- Added monorepo setup instructions for rootDir (single vs per-app ESLint configs).
Bug Fixes
- require-auth-protection now matches protected/public patterns relative to the project root, with App Router-aware behavior.
- Improved validation for protected/public/mixedScopeLayouts patterns and refined App Router file classification.
Tests
- Expanded unit test coverage for project root resolution and App Router path utilities and rule behavior.

changeset-bot · 2026-06-22T14:10:24Z

🦋 Changeset detected

Latest commit: b945c14

The changes in this PR will be included in the next version bump.

This PR includes changesets to release 1 package

Name	Type
@clerk/eslint-plugin	Minor

Not sure what this means? Click here to learn what changesets are.

Click here if you're a maintainer who wants to add another changeset to this PR

vercel · 2026-06-22T14:10:25Z

The latest updates on your projects. Learn more about Vercel for GitHub.

Project	Deployment	Actions	Updated (UTC)
swingset	Ready	Preview, Comment	Jun 24, 2026 12:30pm

1 Skipped Deployment

Project	Deployment	Actions	Updated (UTC)
clerk-js-sandbox	Skipped		Jun 24, 2026 12:30pm

coderabbitai · 2026-06-22T14:10:38Z

No actionable comments were generated in the recent review. 🎉

ℹ️ Recent review info

⚙️ Run configuration

Configuration used: Repository YAML (base), Repository UI (inherited)

Review profile: CHILL

Plan: Pro Plus

Run ID: 0f8ab588-ae0c-4e87-832e-3ea473371cbc

📥 Commits

Reviewing files that changed from the base of the PR and between cc25b29 and b945c14.

📒 Files selected for processing (3)

packages/eslint-plugin/README.md
packages/eslint-plugin/src/next/__tests__/project-root.test.ts
packages/eslint-plugin/src/next/lib/project-root.ts

✅ Files skipped from review due to trivial changes (1)

packages/eslint-plugin/README.md

📝 Walkthrough

Walkthrough

The require-auth-protection rule now resolves protected and public globs from the project root, adds App Router-aware file classification, validates path pattern syntax during rule setup, and updates related tests, documentation, and release notes.

Changes

Project-relative glob matching for require-auth-protection

Layer / File(s)	Summary
Project root resolution `packages/eslint-plugin/src/next/lib/project-root.ts`, `packages/eslint-plugin/src/next/__tests__/project-root.test.ts`	`resolveProjectRoot` now resolves relative `rootDir` values against `cwd`, keeps absolute values unchanged, and adds tests for relative root resolution and downstream classification.
File-info helpers `packages/eslint-plugin/src/next/lib/file-info.ts`, `packages/eslint-plugin/src/next/__tests__/file-info.test.ts`	`getRelativeFolder()` now computes a POSIX-relative path from `rootDir` and returns `null` for missing roots or out-of-scope files. New exports `isUnderAppRouterRoot` and `getAppRouterFileKind` detect App Router roots and classify resource file types. The corresponding tests cover `src/app`, null cases, dot-prefixed folders, and non-router paths.
Rule wiring and path validation `packages/eslint-plugin/src/next/require-auth-protection.ts`	`require-auth-protection` now uses `getAppRouterFileKind(filename, folder)` for file classification and validates `protected`, `public`, and array-form `mixedScopeLayouts` patterns during `create()`. New helpers enforce allowed glob syntax and produce rule-scoped errors.
Rule tests `packages/eslint-plugin/src/next/__tests__/require-auth-protection.test.ts`, `packages/eslint-plugin/src/next/__tests__/require-auth-protection.suggestions.test.ts`	Rule tests switch to project-root-relative `protected` globs with `rootDir: projectRoot`, add `src/app` and outside-App-Router coverage, and expand schema validation for invalid glob forms plus rule-id-specific error reporting. The suggestions test is updated to the same config.
Docs and changeset `packages/eslint-plugin/README.md`, `.changeset/eslint-plugin-project-relative-paths.md`	The README updates examples, options text, monorepo setup guidance, and fix command samples for project-root-relative globs, and the changeset records the release note and `src/app/` breaking-change guidance.

Estimated code review effort

🎯 3 (Moderate) | ⏱️ ~25 minutes

Poem

🐇 I hopped through roots and paths so neat,
src/app now lands where globs should meet.
The rule checks kinds, and patterns too,
With rootDir set, the view rings true.
A little carrot for the docs today—
The paths know home and find their way. 🌿

Suggested reviewers

jacekradko

🚥 Pre-merge checks | ✅ 5

✅ Passed checks (5 passed)

Check name	Status	Explanation
Description Check	✅ Passed	Check skipped - CodeRabbit’s high-level summary is enabled.
Title check	✅ Passed	The title accurately summarizes the main change: glob resolution moved from /app to the project root.
Docstring Coverage	✅ Passed	Docstring coverage is 100.00% which is sufficient. The required threshold is 80.00%.
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.

_{✏️ Tip: You can configure your own custom pre-merge checks in the settings.}

✨ Finishing Touches

📝 Generate docstrings

Create stacked PR
Commit on current branch

_{Comment @coderabbitai help to get the list of available commands.}

pkg-pr-new · 2026-06-22T14:12:42Z

Open in StackBlitz

@clerk/astro

npm i https://pkg.pr.new/@clerk/astro@8942

@clerk/backend

npm i https://pkg.pr.new/@clerk/backend@8942

@clerk/chrome-extension

npm i https://pkg.pr.new/@clerk/chrome-extension@8942

@clerk/clerk-js

npm i https://pkg.pr.new/@clerk/clerk-js@8942

@clerk/electron

npm i https://pkg.pr.new/@clerk/electron@8942

@clerk/electron-passkeys

npm i https://pkg.pr.new/@clerk/electron-passkeys@8942

@clerk/eslint-plugin

npm i https://pkg.pr.new/@clerk/eslint-plugin@8942

@clerk/expo

npm i https://pkg.pr.new/@clerk/expo@8942

@clerk/expo-passkeys

npm i https://pkg.pr.new/@clerk/expo-passkeys@8942

@clerk/express

npm i https://pkg.pr.new/@clerk/express@8942

@clerk/fastify

npm i https://pkg.pr.new/@clerk/fastify@8942

@clerk/hono

npm i https://pkg.pr.new/@clerk/hono@8942

@clerk/localizations

npm i https://pkg.pr.new/@clerk/localizations@8942

@clerk/nextjs

npm i https://pkg.pr.new/@clerk/nextjs@8942

@clerk/nuxt

npm i https://pkg.pr.new/@clerk/nuxt@8942

@clerk/react

npm i https://pkg.pr.new/@clerk/react@8942

@clerk/react-router

npm i https://pkg.pr.new/@clerk/react-router@8942

@clerk/shared

npm i https://pkg.pr.new/@clerk/shared@8942

@clerk/tanstack-react-start

npm i https://pkg.pr.new/@clerk/tanstack-react-start@8942

@clerk/testing

npm i https://pkg.pr.new/@clerk/testing@8942

@clerk/ui

npm i https://pkg.pr.new/@clerk/ui@8942

@clerk/upgrade

npm i https://pkg.pr.new/@clerk/upgrade@8942

@clerk/vue

npm i https://pkg.pr.new/@clerk/vue@8942

commit: b945c14

coderabbitai

Actionable comments posted: 2

🤖 Prompt for all review comments with AI agents

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

Inline comments:
In `@packages/eslint-plugin/src/next/__tests__/file-info.test.ts`:
- Around line 39-56: Add a new test case to cover the edge case where a file is
within the project root but the folder name starts with `..` (e.g.,
`/proj/..internal/actions.ts`). The test should verify that getRelativeFolder
correctly returns the project-relative folder path (`..internal`) rather than
null, ensuring that the function distinguishes between paths that are truly
outside the root versus paths with unusual but valid folder names that contain
`..` as part of the directory name.

In `@packages/eslint-plugin/src/next/lib/file-info.ts`:
- Around line 33-35: The condition in the file-info.ts file that checks
`rel.startsWith('..')` is too broad and incorrectly rejects valid in-root paths
that happen to start with two dots (like `..internal/foo.ts`). Modify the check
to specifically detect actual parent directory traversal by checking for `..`
followed by a path separator (forward slash `/` or backslash `\`) instead of
just checking if the relative path starts with `..`.

🪄 Autofix (Beta)

Fix all unresolved CodeRabbit comments on this PR:

Push a commit to this branch (recommended)
Create a new PR with the fixes

ℹ️ Review info

⚙️ Run configuration

Configuration used: Repository YAML (base), Repository UI (inherited)

Review profile: CHILL

Plan: Pro

Run ID: 4517c2c6-7ec5-441a-a137-ba9cae90d5f5

📥 Commits

Reviewing files that changed from the base of the PR and between 7e3174a and c41f2ab.

📒 Files selected for processing (7)

.changeset/eslint-plugin-project-relative-paths.md
packages/eslint-plugin/README.md
packages/eslint-plugin/src/next/__tests__/file-info.test.ts
packages/eslint-plugin/src/next/__tests__/require-auth-protection.suggestions.test.ts
packages/eslint-plugin/src/next/__tests__/require-auth-protection.test.ts
packages/eslint-plugin/src/next/lib/file-info.ts
packages/eslint-plugin/src/next/require-auth-protection.ts

Ephem added 2 commits June 22, 2026 15:31

Resolve globs relative to the project root instead of /app

4d40ec8

Only match app/ and src/app/

c41f2ab

github-actions Bot added the eslint-plugin label Jun 22, 2026

vercel Bot deployed to Preview – swingset June 22, 2026 14:11 View deployment

coderabbitai Bot reviewed Jun 22, 2026

View reviewed changes

Comment thread packages/eslint-plugin/src/next/__tests__/file-info.test.ts

Comment thread packages/eslint-plugin/src/next/lib/file-info.ts Outdated

Ephem added 2 commits June 23, 2026 10:25

Tighten handling of .. in paths

3860d9d

Add some more path config validation

cc25b29

vercel Bot temporarily deployed to Preview – clerk-js-sandbox June 23, 2026 08:32 Inactive

vercel Bot deployed to Preview – swingset June 23, 2026 08:34 View deployment

Explicitly resolve relative rootDir to cwd

b945c14

vercel Bot temporarily deployed to Preview – clerk-js-sandbox June 24, 2026 12:29 Inactive

vercel Bot deployed to Preview – swingset June 24, 2026 12:30 View deployment

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

feat(eslint-plugin): Resolve globs relative to the project root instead of /app#8942

feat(eslint-plugin): Resolve globs relative to the project root instead of /app#8942
Ephem wants to merge 5 commits into
mainfrom
fredrik/eslint-plugin-path-matching

Ephem commented Jun 22, 2026 •

edited by coderabbitai Bot

Loading

Uh oh!

changeset-bot Bot commented Jun 22, 2026 •

edited

Loading

Uh oh!

vercel Bot commented Jun 22, 2026 •

edited

Loading

Uh oh!

coderabbitai Bot commented Jun 22, 2026 •

edited

Loading

Walkthrough

Changes

Estimated code review effort

Poem

Suggested reviewers

Uh oh!

pkg-pr-new Bot commented Jun 22, 2026 •

edited

Loading

Uh oh!

coderabbitai Bot left a comment

Uh oh!

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

1 participant

Conversation

Ephem commented Jun 22, 2026 • edited by coderabbitai Bot Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Description

Checklist

Type of change

Summary by CodeRabbit

Uh oh!

changeset-bot Bot commented Jun 22, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

🦋 Changeset detected

Uh oh!

vercel Bot commented Jun 22, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

coderabbitai Bot commented Jun 22, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Walkthrough

Changes

Estimated code review effort

Poem

Suggested reviewers

Uh oh!

pkg-pr-new Bot commented Jun 22, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

coderabbitai Bot left a comment

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

1 participant

Ephem commented Jun 22, 2026 •

edited by coderabbitai Bot

Loading

changeset-bot Bot commented Jun 22, 2026 •

edited

Loading

vercel Bot commented Jun 22, 2026 •

edited

Loading

coderabbitai Bot commented Jun 22, 2026 •

edited

Loading

pkg-pr-new Bot commented Jun 22, 2026 •

edited

Loading