clerk-sdk-ruby 2.0.4 → 2.2.0

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: e443f464076d7d267af214c5e2d12847aec0bf5bac6e80479736d02fbf92a8ae
-  data.tar.gz: a3b0457f1402594db56968d7af4e6dcc4674276f248083aad09f278530b22d57
+  metadata.gz: 0beece8585345751d91279f43af6fc81ea3bed2274988ffcaf711cd9e6212203
+  data.tar.gz: fe3cda34f2c460f9b79a1da4a68d5931c4ca68454e869afa27676c72d68414c3
 SHA512:
-  metadata.gz: dfb091cbe8eb5a88881db5294927eb849d20e8f802a6cac697f8c865328a5a29afe69e3467eb1c8aea74265f96ce8d4ca0d93d1533513c0c6f6aad1e32537463
-  data.tar.gz: 66e0af91ac94339b1b10f4507b936b9c38083cd1f5a9deb69cccfd8177e44c08f65d838e9bc00e8c543ac9396fffa19da7243eeb271ae203c3d2856ee3c5ba5f
+  metadata.gz: 94fdbacc63e4af0fc4084aad5db8a17904eda58c42f60b1f951e7dc351b3ea543299b12668bc96fad63a0afed7967f6d8e9eda4053b454a769601f4cee71a03b
+  data.tar.gz: 4fe7fee577704f10027ea812cacbbf7482b112b5a7423b041debfd332bb97cbc5cc2a2e026910aff8d7b0559e3d3132d7df4fc048e4c12c9507974a72d2ccec0

data/CHANGELOG.md

@@ -1,5 +1,13 @@
 ## unreleased
 
+## 2.1.2 - 2022-08-26
+
+- fix: Gracefully handle invalid JSON in Authorization header [https://github.com/clerkinc/clerk-sdk-ruby/pull/16]
+
+## 2.1.1 - 2022-02-24
+
+- fix: Make Authv2 middleware thread-safe
+
 ## 2.0.0 - 2021-10-21
 
 This release introduces the new networkless middleware which works with the new 

data/Gemfile.lock

@@ -1,7 +1,7 @@
 PATH
   remote: .
   specs:
-    clerk-sdk-ruby (1.0.3)
+    clerk-sdk-ruby (2.2.0)
       faraday (~> 1.4.1)
       jwt (~> 2.2)
 
@@ -22,9 +22,9 @@ GEM
     faraday-excon (1.1.0)
     faraday-net_http (1.0.1)
     faraday-net_http_persistent (1.2.0)
-    jwt (2.2.3)
+    jwt (2.5.0)
     minitest (5.14.2)
-    multipart-post (2.1.1)
+    multipart-post (2.2.3)
     rake (13.0.3)
     ruby2_keywords (0.0.5)
     timecop (0.9.4)
@@ -40,4 +40,4 @@ DEPENDENCIES
   timecop (~> 0.9.4)
 
 BUNDLED WITH
-   2.2.24
+   2.2.32

data/README.md

@@ -1,20 +1,25 @@
 # Clerk Ruby SDK
 
+
 Thank you for choosing [Clerk](https://clerk.dev/) for your authentication,
 session & user management needs!
 
 This SDK allows you to call the Clerk Backend API from Ruby code without having
 to implement the calls yourself.
 
----------
-
-**Note**: This is the v2 branch, which requires that you use [Auth 
+**Note**: You're looking at the main branch, which requires that you use [Auth 
 v2](https://docs.clerk.dev/main-concepts/auth-v2).
 
-If you're looking for the legacy authentication scheme (Auth v1), refer to the 
-[`main`](https://github.com/clerkinc/clerk-sdk-ruby/tree/main) branch.
+If you're looking for the legacy authentication scheme, refer to the 
+[`v1`](https://github.com/clerkinc/clerk-sdk-ruby/tree/v1) branch.
+
+---
+
+**Clerk is Hiring!**
+
+Would you like to work on Open Source software and help maintain this repository? Apply today https://apply.workable.com/clerk-dev/.
 
-----------
+---
 
 ## Installation
 

data/lib/clerk/authenticatable.rb

@@ -10,7 +10,7 @@ module Clerk
     # the Session object. Subsequent calls to this method will return the cached
     # Session object.
     #
-    # NOTE: For better performance, you can instead use `#clerk_session_claims`
+    # NOTE: For better performance, you can instead use `#clerk_verified_session_claims`
     # which already contains the verified claims as retrieved from the session
     # token.
     def clerk_session
@@ -20,7 +20,7 @@ module Clerk
     # Makes a request to the Clerk API to verify the session again. Returns the
     # session object as fetched from the API.
     #
-    # NOTE: For better performance, you can instead use `#clerk_session_claims`
+    # NOTE: For better performance, you can instead use `#clerk_verified_session_claims`
     # which already contains the verified claims as retrieved from the session
     # token.
     #

data/lib/clerk/rack_middleware_v2.rb

@@ -1,94 +1,107 @@
 require "clerk"
 
 module Clerk
-  class RackMiddlewareV2
-    class ProxyV2
-      CACHE_TTL = 60 # seconds
+  class ProxyV2
+    CACHE_TTL = 60 # seconds
 
-      attr_reader :session_claims, :session_token
+    attr_reader :session_claims, :session_token
 
-      def initialize(session_claims: nil, session_token: nil)
-        @session_claims = session_claims
-        @session_token = session_token
-        @session = nil
-      end
+    def initialize(session_claims: nil, session_token: nil)
+      @session_claims = session_claims
+      @session_token = session_token
+      @session = nil
+    end
 
-      def session
-        return nil if @session_claims.nil?
+    def session
+      return nil if @session_claims.nil?
 
-        @session ||= verify_session
-      end
+      @session ||= verify_session
+    end
 
-      def verify_session
-        return nil if @session_claims.nil?
+    def verify_session
+      return nil if @session_claims.nil?
 
-        sdk.sessions.verify_token(@session_claims["sid"], @session_token)
-      end
+      sdk.sessions.verify_token(@session_claims["sid"], @session_token)
+    end
 
-      def user
-        return nil if user_id.nil?
+    def user
+      return nil if user_id.nil?
 
-        @user ||= fetch_user(user_id)
-      end
+      @user ||= fetch_user(user_id)
+    end
 
-      def user_id
-        return nil if @session_claims.nil?
+    def user_id
+      return nil if @session_claims.nil?
 
-        @session_claims["sub"]
-      end
+      @session_claims["sub"]
+    end
 
-      private
+    private
 
-      def fetch_user(user_id)
-        cached_fetch("clerk_user:#{user_id}") do
-          sdk.users.find(user_id)
-        end
+    def fetch_user(user_id)
+      cached_fetch("clerk_user:#{user_id}") do
+        sdk.users.find(user_id)
       end
+    end
 
-      def cached_fetch(key, &block)
-        if store = Clerk.configuration.middleware_cache_store
-          store.fetch(key, expires_in: CACHE_TTL, &block)
-        else
-          yield
-        end
+    def cached_fetch(key, &block)
+      if store = Clerk.configuration.middleware_cache_store
+        store.fetch(key, expires_in: CACHE_TTL, &block)
+      else
+        yield
       end
+    end
 
-      def sdk
-        @sdk ||= Clerk::SDK.new
-      end
+    def sdk
+      @sdk ||= Clerk::SDK.new
     end
+  end
 
+  class RackMiddlewareV2
     def initialize(app)
       @app = app
     end
 
     def call(env)
-      @env = env
-      @req = Rack::Request.new(env)
-      @env["clerk"] = ProxyV2.new
-      @header_token = @req.env["HTTP_AUTHORIZATION"]
-      @header_token = @header_token.strip.sub(/\ABearer /, '') if @header_token
-      @cookie_token = @req.cookies["__session"]
-      @client_uat = @req.cookies["__client_uat"]
+      env = env
+      req = Rack::Request.new(env)
+      env["clerk"] = Clerk::ProxyV2.new
+      header_token = req.env["HTTP_AUTHORIZATION"]
+      header_token = header_token.strip.sub(/\ABearer /, '') if header_token
+      cookie_token = req.cookies["__session"]
+      client_uat = req.cookies["__client_uat"]
 
       ##########################################################################
       #                                                                        #
       #                          HEADER AUTHENTICATION                         #
       #                                                                        #
       ##########################################################################
-      if @header_token
-        return signed_out if !sdk.decode_token(@header_token) # malformed JWT
-
-        token = verify_token(@header_token)
-        return signed_in(token, @header_token) if token
+      if header_token
+        begin
+          return signed_out(env) if !sdk.decode_token(header_token) # malformed JWT
+        rescue JWT::DecodeError
+          return signed_out(env)  # malformed JSON authorization header
+        end
+        
+        token = verify_token(header_token)
+        return signed_in(env, token, header_token) if token
 
         # Clerk.js should refresh the token and retry
         return unknown(interstitial: false)
       end
 
       # in cross-origin XHRs the use of Authorization header is mandatory.
-      if cross_origin_request?(@req)
-        return signed_out
+      if cross_origin_request?(req)
+        return signed_out(env)
+      end
+
+      if development_or_staging? && !browser_request?(req)
+        # the interstitial won't work if the user agent is not a browser, so
+        # short-circuit and avoid rendering it
+        #
+        # We only limit this to dev/stg because we're not yet sure how robust
+        # this strategy is, yet. In the future, we might enable it for prod too.
+        return signed_out(env)
       end
 
       ##########################################################################
@@ -96,22 +109,22 @@ module Clerk
       #                             COOKIE AUTHENTICATION                      #
       #                                                                        #
       ##########################################################################
-      if development_or_staging? && (@req.referrer.nil? || cross_origin_request?(@req))
+      if development_or_staging? && (req.referrer.nil? || cross_origin_request?(req))
         return unknown(interstitial: true)
       end
 
-      if production? && @client_uat.nil?
-        return signed_out
+      if production? && client_uat.nil?
+        return signed_out(env)
       end
 
-      if @client_uat == "0"
-        return signed_out
+      if client_uat == "0"
+        return signed_out(env)
       end
 
-      token = verify_token(@cookie_token)
+      token = verify_token(cookie_token)
 
-      if token && token["iat"] && @client_uat && Integer(@client_uat) <= token["iat"]
-        return signed_in(token, @cookie_token)
+      if token && token["iat"] && client_uat && Integer(client_uat) <= token["iat"]
+        return signed_in(env, token, cookie_token)
       end
 
       unknown(interstitial: true)
@@ -120,15 +133,15 @@ module Clerk
     private
 
     # Outcome A
-    def signed_in(claims, token)
-      @env["clerk"] = ProxyV2.new(session_claims: claims, session_token: token)
+    def signed_in(env, claims, token)
+      env["clerk"] = ProxyV2.new(session_claims: claims, session_token: token)
 
-      @app.call(@env)
+      @app.call(env)
     end
 
     # Outcome B
-    def signed_out
-      @app.call(@env)
+    def signed_out(env)
+      @app.call(env)
     end
 
     # Outcome C
@@ -165,18 +178,24 @@ module Clerk
       origin != request_host
     end
 
+    def browser_request?(req)
+      user_agent = req.env["HTTP_USER_AGENT"]
+
+      !user_agent.nil? && user_agent.starts_with?("Mozilla/")
+    end
+
     def verify_token(token)
       return false if token.nil? || token.strip.empty?
 
       begin
-        @session = sdk.verify_token(token)
+        sdk.verify_token(token)
       rescue JWT::DecodeError, JWT::RequiredDependencyError => e
         false
       end
     end
 
     def sdk
-      @sdk ||= Clerk::SDK.new
+      Clerk::SDK.new
     end
   end
 end

data/lib/clerk/resources/users.rb

@@ -11,7 +11,7 @@ module Clerk
         @resource = PluralResource.new(client, "users")
       end
 
-      def_delegators :@resource, :all, :find, :update, :delete
+      def_delegators :@resource, :all, :find, :create, :update, :delete
 
       def oauth_access_token(user_id, provider)
         @client.request(:get, "#{@resource.resource_path(user_id)}/oauth_access_tokens/#{provider}")

data/lib/clerk/sdk.rb

@@ -20,7 +20,8 @@ require_relative "errors"
 module Clerk
   class SDK
     DEFAULT_HEADERS = {
-      "User-Agent" => "Clerk/#{Clerk::VERSION}; Faraday/#{Faraday::VERSION}; Ruby/#{RUBY_VERSION}"
+      "User-Agent" => "Clerk/#{Clerk::VERSION}; Faraday/#{Faraday::VERSION}; Ruby/#{RUBY_VERSION}",
+      "X-Clerk-SDK" => "ruby/#{Clerk::VERSION}"
     }
 
     # How often (in seconds) should JWKs be refreshed

data/lib/clerk/version.rb

@@ -1,5 +1,5 @@
 # frozen_string_literal: true
 
 module Clerk
-  VERSION = "2.0.4"
+  VERSION = "2.2.0"
 end

metadata

@@ -1,14 +1,14 @@
 --- !ruby/object:Gem::Specification
 name: clerk-sdk-ruby
 version: !ruby/object:Gem::Version
-  version: 2.0.4
+  version: 2.2.0
 platform: ruby
 authors:
 - Clerk
 autorequire: 
 bindir: exe
 cert_chain: []
-date: 2021-10-25 00:00:00.000000000 Z
+date: 2022-08-26 00:00:00.000000000 Z
 dependencies:
 - !ruby/object:Gem::Dependency
   name: faraday
@@ -127,7 +127,7 @@ required_rubygems_version: !ruby/object:Gem::Requirement
     - !ruby/object:Gem::Version
       version: '0'
 requirements: []
-rubygems_version: 3.2.5
+rubygems_version: 3.2.32
 signing_key: 
 specification_version: 4
 summary: Clerk SDK for Ruby.