Skip to content
Closed
Show file tree
Hide file tree
Changes from all commits
Commits
File filter

Filter by extension

Filter by extension

Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
2 changes: 2 additions & 0 deletions apps/dashboard/src/@/constants/thirdweb-client.client.ts
Original file line number Diff line number Diff line change
Expand Up @@ -3,9 +3,11 @@ import { getConfiguredThirdwebClient } from "./thirdweb.server";
export function getClientThirdwebClient(params?: {
jwt: string | undefined | null;
teamId: string | undefined | null;
projectClientId?: string;
}) {
return getConfiguredThirdwebClient({
secretKey: params?.jwt ?? undefined,
teamId: params?.teamId ?? undefined,
projectClientId: params?.projectClientId,
});
}
2 changes: 2 additions & 0 deletions apps/dashboard/src/@/constants/thirdweb.server.ts
Original file line number Diff line number Diff line change
Expand Up @@ -25,6 +25,7 @@ import { getVercelEnv } from "@/utils/vercel";
export function getConfiguredThirdwebClient(options: {
secretKey: string | undefined;
teamId: string | undefined;
projectClientId: string | undefined;
}): ThirdwebClient {
if (getVercelEnv() !== "production") {
// if not on production: run this when creating a client to set the domains
Expand Down Expand Up @@ -89,6 +90,7 @@ export function getConfiguredThirdwebClient(options: {
},
secretKey: secretKey,
teamId: options.teamId,
projectClientId: options.projectClientId,
});
}

Expand Down
Original file line number Diff line number Diff line change
Expand Up @@ -36,7 +36,8 @@ export default async function Page(props: {
const client = getClientThirdwebClient({
jwt: authToken,
teamId: team.id,
});
projectClientId: project.publishableKey,
});

return (
<div className="flex grow flex-col">
Expand Down
6 changes: 6 additions & 0 deletions packages/thirdweb/src/client/client.ts
Original file line number Diff line number Diff line change
Expand Up @@ -55,6 +55,12 @@ type ClientOptions = Prettify<{
* @hidden
*/
teamId?: string;

/**
* The project client ID for thirdweb dashboard usage.
* @hidden
*/
projectClientId?: string;
}>;

export type CreateThirdwebClientOptions = Prettify<
Expand Down
11 changes: 3 additions & 8 deletions packages/thirdweb/src/utils/fetch.ts
Original file line number Diff line number Diff line change
Expand Up @@ -57,15 +57,10 @@ export function getClientFetch(client: ThirdwebClient, ecosystem?: Ecosystem) {
: undefined;
const clientId = client.clientId;

if (authToken && isBundlerUrl(urlString)) {
if (authToken && isBundlerUrl(urlString) && client.projectClientId && client.teamId) {
headers.set("authorization", `Bearer ${authToken}`);
if (client.teamId) {
headers.set("x-team-id", client.teamId);
}

if (clientId) {
headers.set("x-client-id", clientId);
}
headers.set("x-team-id", client.teamId);
headers.set("x-client-id", client.projectClientId);
}
Comment on lines +60 to 64
Copy link
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

💡 Verification agent

🧩 Analysis chain

Verify that stricter bundler URL authorization doesn't break existing functionality.

The condition now requires both client.projectClientId AND client.teamId to be truthy, and uses client.projectClientId instead of client.clientId for the x-client-id header. This stricter validation aligns with the PR's goal of fixing team identification issues, but could potentially break existing code that doesn't provide both values.


🏁 Script executed:

#!/bin/bash
# Search for existing bundler URL usage that might be affected by the stricter condition
echo "Searching for bundler URL usage patterns..."
rg -A 5 -B 5 "bundler\.(thirdweb|thirdweb-dev)\.com" --type ts --type tsx

echo "Searching for client creation without projectClientId..."
rg -A 10 "createThirdwebClient" --type ts --type tsx | grep -v "projectClientId"

echo "Searching for getClientThirdwebClient calls..."
rg -A 5 "getClientThirdwebClient" --type ts --type tsx

Length of output: 616


🏁 Script executed:

#!/bin/bash
echo "Searching for bundler URL usage patterns..."
rg -g "*.{ts,tsx}" -A5 -B5 'bundler\.(thirdweb|thirdweb-dev)\.com'

echo "Searching for client creation without projectClientId..."
rg -g "*.{ts,tsx}" -A10 'createThirdwebClient' | grep -v 'projectClientId'

echo "Searching for getClientThirdwebClient calls..."
rg -g "*.{ts,tsx}" -A5 'getClientThirdwebClient'

Length of output: 255442


🏁 Script executed:

#!/bin/bash
echo "Searching for CreateThirdwebClientOptions definition..."
rg -n "CreateThirdwebClientOptions" packages/thirdweb/src/client/client.ts

echo -e "\nShowing the first 200 lines of client.ts:"
sed -n '1,200p' packages/thirdweb/src/client/client.ts

Length of output: 4304


#!/bin/bash
echo "Showing fetch utility implementation around header logic..."
sed -n '40,100p' packages/thirdweb/src/utils/fetch.ts

echo -e "\nShowing fetch tests to verify projectClientId usage..."
sed -n '1,200p' packages/thirdweb/src/utils/fetch.test.ts

Action required: Ensure projectClientId is populated for bundler requests

The updated fetch utility now only sets headers when both client.teamId and client.projectClientId are truthy—and uses projectClientId (not clientId) for the x-client-id header. By default, createThirdwebClient({ clientId, teamId }) does not set projectClientId, so:

  • Existing code and tests that only pass clientId & teamId will no longer attach any headers.
  • The fetch tests in packages/thirdweb/src/utils/fetch.test.ts will fail unless they explicitly pass projectClientId.

To address this breaking change:

  • In createThirdwebClient (or your dashboard wrapper), default projectClientIdclientId when none is provided.
  • Update the header condition in packages/thirdweb/src/utils/fetch.ts or ensure callers always supply projectClientId.
  • Adjust packages/thirdweb/src/utils/fetch.test.ts to pass projectClientId (or to reflect the new default behavior).

Locations needing updates:

  • packages/thirdweb/src/client/client.ts (populate projectClientId by default)
  • packages/thirdweb/src/utils/fetch.ts (header‐setting logic)
  • packages/thirdweb/src/utils/fetch.test.ts (test setup and assertions)
🤖 Prompt for AI Agents
In packages/thirdweb/src/utils/fetch.ts lines 60 to 64, the headers are only set
if both client.teamId and client.projectClientId are truthy, but projectClientId
is not set by default in createThirdwebClient. To fix this, update
packages/thirdweb/src/client/client.ts to default projectClientId to clientId if
not provided, adjust the header-setting condition in fetch.ts to rely on this
default, and modify packages/thirdweb/src/utils/fetch.test.ts to pass
projectClientId or reflect the new default behavior in tests.

// if we have an auth token set, use that (thirdweb dashboard sets this for the user)
// pay urls should never send the auth token, because we always want the "developer" to be the one making the request, not the "end user"
Expand Down
Loading