tRPC 11 context, auth middleware and createCaller tests: working versions (tested 2026-10-15)

{
  "name": "trpc-context-auth-middleware",
  "private": true,
  "type": "module",
  "scripts": {
    "test": "node --import tsx --test test/*.test.ts"
  },
  "dependencies": {
    "@trpc/server": "11.19.0",
    "zod": "4.6.7"
  },
  "devDependencies": {
    "tsx": "4.23.15",
    "@types/node": "24.19.2"
  }
}

import { initTRPC, TRPCError } from "@trpc/server";
import { z } from "zod";

export type Context = { user: { id: string; role: "admin" | "user" } | null };
const t = initTRPC.context<Context>().create();

const isAuthed = t.middleware(({ ctx, next }) => {
  if (!ctx.user) throw new TRPCError({ code: "UNAUTHORIZED" });
  return next({ ctx: { user: ctx.user } }); // narrows user to non-null downstream
});
export const publicProcedure = t.procedure;
export const protectedProcedure = t.procedure.use(isAuthed);
const adminProcedure = protectedProcedure.use(({ ctx, next }) => {
  if (ctx.user.role !== "admin") throw new TRPCError({ code: "FORBIDDEN" });
  return next();
});

const notes: { id: number; owner: string; text: string }[] = [];

export const appRouter = t.router({
  health: publicProcedure.query(() => "ok"),
  addNote: protectedProcedure.input(z.object({ text: z.string().min(1).max(280) })).mutation(({ ctx, input }) => {
    const note = { id: notes.length + 1, owner: ctx.user.id, text: input.text };
    notes.push(note);
    return note;
  }),
  myNotes: protectedProcedure.query(({ ctx }) => notes.filter((n) => n.owner === ctx.user.id)),
  allNotes: adminProcedure.query(() => notes),
});
export type AppRouter = typeof appRouter;
export const createCaller = t.createCallerFactory(appRouter);

import { test } from "node:test";
import assert from "node:assert/strict";
import { TRPCError } from "@trpc/server";
import { createCaller } from "../src/router.ts";

const anon = createCaller({ user: null });
const ada = createCaller({ user: { id: "ada", role: "user" } });
const root = createCaller({ user: { id: "root", role: "admin" } });
const code = (c: string) => (e: unknown) => e instanceof TRPCError && e.code === c;

test("public works without a user", async () => {
  assert.equal(await anon.health(), "ok");
});

test("protected requires a user", async () => {
  await assert.rejects(anon.addNote({ text: "x" }), code("UNAUTHORIZED"));
  const n = await ada.addNote({ text: "hi" });
  assert.equal(n.owner, "ada");
  assert.equal((await ada.myNotes()).length, 1);
});

test("zod input errors become BAD_REQUEST", async () => {
  await assert.rejects(ada.addNote({ text: "" }), code("BAD_REQUEST"));
});

test("admin-only procedure", async () => {
  await assert.rejects(ada.allNotes(), code("FORBIDDEN"));
  assert.ok(Array.isArray(await root.allNotes()));
});