TRPCError UNAUTHORIZED during integration testing of context-dependent procedures

Answer

Define a single shared Context interface and use it as the generic argument for every router’s createRouter call. When merging, pass the same interface to mergeRouters. This preserves the exact context shape, so your test harness can supply a mock ctx that triggers TRPCError.UNAUTHORIZED without TypeScript errors or runtime undefined.

Confirmed facts

• tRPC v10+ routers are generic over the context type; createRouter<Context>() fixes that type.
• mergeRouters<Context>(routerA, routerB) retains the generic, preventing widening to a union.
• If each router omits the generic or uses a different one, TypeScript widens the context, making required properties optional and causing undefined checks before middleware runs.

Likely explanation of the problem

When routers are defined in separate files without explicitly specifying the context generic, each file may infer a slightly different context (e.g., from local middleware). During mergeRouters the inferred types are merged, producing a union where fields like user become optional. Your test harness then passes a ctx missing user, causing the procedure to fail with a TypeError before the unauthorized middleware can throw TRPCError.UNAUTHORIZED.

Steps to align ctx type and test unauthorized access

1. Create a shared context file, e.g., src/trpc/context.ts:

   export interface Context {
     user?: { id: string; role: string } | null;
     // add any other fields your procedures need
   }

2. In each router module, import the interface and use it:

   import { initTRPC } from '@trpc/server';
   import type { Context } from '../context';
   
   const t = initTRPC.context<Context>().createRouter();
   
   export const publicRouter = t.router({
     // …
   });
   
   export const protectedRouter = t.router({
     // middleware that checks ctx.user and throws TRPCError.UNAUTHORIZED if missing
     middleware: t.middleware(({ ctx, next }) => {
       if (!ctx.user) {
         throw new t.TRPCError({ code: 'UNAUTHORIZED', message: 'Missing user' });
       }
       return next();
     }),
     procedure: t.procedure,
     // …
   });
   

3. Merge routers with the same generic:

   import { mergeRouters } from '@trpc/server';
   import { publicRouter } from './public';
   import { protectedRouter } from './protected';
   
   export const appRouter = mergeRouters<Context>(publicRouter, protectedRouter);
   // export type AppRouter = typeof appRouter;
   

4. In your integration test, build a mock ctx that satisfies the shared type but omits the user (or sets it to null) to trigger the unauthorized path:

   import { appRouter } from '@/trpc/_app';
   import type { Context } from '@/trpc/context';
   
   const mockCtx: Context = { user: null }; // or {} if user is optional
   
   // call a protected procedure
   await appRouter.protectedProcedure.someQuery.call({ ctx: mockCtx });
   // expect TRPCError with code 'UNAUTHORIZED'
   

5. Run the test; you should receive a TRPCError with code === 'UNAUTHORIZED'. If you see a TypeError about undefined user, verify that the merged router was typed with <Context> and that the mock ctx includes all required non‑optional fields.

Verification

Compile the project (tsc --noEmit) and check that the inferred type of appRouter shows Context exactly, not a union. Then run the test; the assertion should pass.

If you are unsure whether your middleware is the source of the UNAUTHORIZED error, share the middleware code so we can confirm it throws TRPCError.UNAUTHORIZED when ctx.user is missing.