Class: Clerk::SDK

Inherits:
Object
  • Object
show all
Defined in:
lib/clerk/sdk.rb

Constant Summary collapse

DEFAULT_HEADERS = 
{
  "User-Agent" => "Clerk/#{Clerk::VERSION}; Faraday/#{Faraday::VERSION}; Ruby/#{RUBY_VERSION}",
  "X-Clerk-SDK" => "ruby/#{Clerk::VERSION}"
}
JWKS_CACHE_LIFETIME =

How often (in seconds) should JWKs be refreshed

3600
@@jwks_cache =

1 hour

JWKSCache.new(JWKS_CACHE_LIFETIME)

Class Method Summary collapse

Instance Method Summary collapse

Constructor Details

#initialize(api_key: nil, base_url: nil, logger: nil, ssl_verify: true, connection: nil) ⇒ SDK

Returns a new instance of SDK.



41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
 
# File 'lib/clerk/sdk.rb', line 41

def initialize(api_key: nil, base_url: nil, logger: nil, ssl_verify: true,
               connection: nil)
  if connection
    # Inject a Faraday::Connection for testing or full control over Faraday
    @conn = connection
    return
  else
    base_url = base_url || Clerk.configuration.base_url
    base_uri = if !base_url.end_with?("/")
                 URI("#{base_url}/")
               else
                 URI(base_url)
               end

    api_key ||= Clerk.configuration.api_key

    if Faraday::VERSION.to_i >= 2 && api_key.nil?
      api_key = -> { raise ArgumentError, "Clerk secret key is not set" }
    end

    logger = logger || Clerk.configuration.logger
    @conn = Faraday.new(
      url: base_uri, headers: DEFAULT_HEADERS, ssl: {verify: ssl_verify}
    ) do |f|
      f.request :url_encoded
      f.request :authorization, "Bearer", api_key
      if logger
        f.response :logger, logger do |l|
          l.filter(/(Authorization: "Bearer) (\w+)/, '\1 [SECRET]')
        end
      end
    end
  end
end

Class Method Details

.jwks_cache ⇒ Object 



37
38
39
 
# File 'lib/clerk/sdk.rb', line 37

def self.jwks_cache
  @@jwks_cache
end

Instance Method Details

#allowlist ⇒ Object 



123
124
125
 
# File 'lib/clerk/sdk.rb', line 123

def allowlist
  Resources::Allowlist.new(self)
end

#allowlist_identifiers ⇒ Object 



119
120
121
 
# File 'lib/clerk/sdk.rb', line 119

def allowlist_identifiers
  Resources::AllowlistIdentifiers.new(self)
end

#clients ⇒ Object 



127
128
129
 
# File 'lib/clerk/sdk.rb', line 127

def clients
  Resources::Clients.new(self)
end

#decode_token(token) ⇒ Object

Returns the decoded JWT payload without verifying if the signature is valid.

WARNING: This will not verify whether the signature is valid. You should not use this for untrusted messages! You most likely want to use verify_token.



173
174
175
 
# File 'lib/clerk/sdk.rb', line 173

def decode_token(token)
  JWT.decode(token, nil, false).first
end

#email_addresses ⇒ Object 



131
132
133
 
# File 'lib/clerk/sdk.rb', line 131

def email_addresses
  Resources::EmailAddresses.new(self)
end

#emails ⇒ Object 



135
136
137
 
# File 'lib/clerk/sdk.rb', line 135

def emails
  Resources::Emails.new(self)
end

#interstitial(refresh = false) ⇒ Object 



163
164
165
 
# File 'lib/clerk/sdk.rb', line 163

def interstitial(refresh=false)
  request(:get, "internal/interstitial")
end

#jwks ⇒ Object 



159
160
161
 
# File 'lib/clerk/sdk.rb', line 159

def jwks
  Resources::JWKS.new(self)
end

#organizations ⇒ Object 



139
140
141
 
# File 'lib/clerk/sdk.rb', line 139

def organizations
  Resources::Organizations.new(self)
end

#phone_numbers ⇒ Object 



143
144
145
 
# File 'lib/clerk/sdk.rb', line 143

def phone_numbers
  Resources::PhoneNumbers.new(self)
end

#request(method, path, query: [], body: nil, timeout: nil) ⇒ Object 



76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
 
# File 'lib/clerk/sdk.rb', line 76

def request(method, path, query: [], body: nil, timeout: nil)
  response = case method
             when :get
               @conn.get(path, query) do |req|
                 req.options.timeout = timeout if timeout
               end
             when :post
               @conn.post(path, body) do |req|
                 req.body = body.to_json
                 req.headers[:content_type] = "application/json"
                 req.options.timeout = timeout if timeout
               end
             when :patch
               @conn.patch(path, body) do |req|
                 req.body = body.to_json
                 req.headers[:content_type] = "application/json"
                 req.options.timeout = timeout if timeout
               end
             when :delete
               @conn.delete(path) do |req|
                 req.options.timeout = timeout if timeout
               end
             end

  body = if response["Content-Type"] == "application/json"
           JSON.parse(response.body)
         else
           response.body
         end

  if response.success?
    body
  else
    klass = case body.dig("errors", 0, "code")
            when "cookie_invalid", "client_not_found", "resource_not_found"
              Errors::Authentication
            else
              Errors::Fatal
            end
    raise klass.new(body, status: response.status)
  end
end

#sessions ⇒ Object 



147
148
149
 
# File 'lib/clerk/sdk.rb', line 147

def sessions
  Resources::Sessions.new(self)
end

#sms_messages ⇒ Object 



151
152
153
 
# File 'lib/clerk/sdk.rb', line 151

def sms_messages
  Resources::SMSMessages.new(self)
end

#users ⇒ Object 



155
156
157
 
# File 'lib/clerk/sdk.rb', line 155

def users
  Resources::Users.new(self)
end

#verify_token(token, force_refresh_jwks: false, algorithms: ['RS256'], timeout: 5) ⇒ Object

Decode the JWT and verify it’s valid (verify claims, signature etc.) using the provided algorithms.

JWKS are cached for JWKS_CACHE_LIFETIME seconds, in order to avoid unecessary roundtrips. In order to invalidate the cache, pass ‘force_refresh_jwks: true`.

A timeout for the request to the JWKs endpoint can be set with the ‘timeout` argument.



186
187
188
189
190
191
192
193
194
 
# File 'lib/clerk/sdk.rb', line 186

def verify_token(token, force_refresh_jwks: false, algorithms: ['RS256'], timeout: 5)
  jwk_loader = ->(options) do
    # JWT.decode requires that the 'keys' key in the Hash is a symbol (as
    # opposed to a string which our SDK returns by default)
    { keys: SDK.jwks_cache.fetch(self, kid_not_found: (options[:invalidate] || options[:kid_not_found]), force_refresh: force_refresh_jwks) }
  end

  JWT.decode(token, nil, true, algorithms: algorithms, jwks: jwk_loader).first
end