[Feature Request] Opt out of global middleware

[GuilhermeAmado]

I have a server function that shouldn't run one of the global middlewares I've registered.
It would be great to have the option to opt out of that middleware.

[schiller-manuel]

so you would like to skip a single one but not all of the global ones?

[GuilhermeAmado]

I want to skip a single global middleware on a single function.

This is the use case currently:
I have a global middleware that requires authentication for all server function calls. However, one of these server functions is used to check the Clerk auth status, and it fails because the global middleware returns a 401 error. I use the Clerk auth status to determine whether the user should be redirected to the login page or not.

[willhoney7]

Yeah I feel like this is an important missing piece.

I'd like to set a global authentication middleware... but my sign in routes obviously shouldn't run the authentication middleware.

The only hack I can think of is to hijack generateFunctionId to prefix the server function URL with the route name... then the middleware will check request.url and allow the "public" functions to pass without authentication. I have no idea if this would even be secure and feels pretty bad so I'll probably avoid it entirely.

 serverFns: {
        generateFunctionId: ({ filename, functionName }) => {
          // something like this
          return filename + '-' + crypto
            .createHash('sha1')
            .update(`${filename}--${functionName}`)
            .digest('hex')
          return undefined
        },
      },

[schiller-manuel]

you need to approach this differently.

if you set a global middleware, it will run for EVERY server function.

however, if you have authenticated server functions and want to run a specific middleware only for those, you need to use a custom server function factory

const createAuthServerFn = creatServerFn().middleware([myAuthMiddlware])

const someAuthedFn = createAuthServerFn().handler(() => ...)

[willhoney7]

you're right, this is a much better approach. I can additionally even set an eslint rule to discourage importing createServerFn directly and point our devs to use createAuthServerFn instead. Thank you!