clerk-sdk-ruby 3.1.0 → 3.3.0.beta1

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: 8c00fcf8ae50b346d735c9faf512ebfd48a47244988903f7dc8aaf142d5a5a67
-  data.tar.gz: c3a313b88d7bc9f82bb9c7e9c32bb62a44d6d589b66738749e0090b56849344d
+  metadata.gz: 3610550618f6e172b7e27eb9bb64e8a1c95b06b0f802f55b7ee8b9dfb06759a8
+  data.tar.gz: 2af0974d0977d33036b9e4a6f940ea6778c876597de0e9c54fdc390f4fe88224
 SHA512:
-  metadata.gz: 02a881ea0849691692a877da064f3c3d94b460dbb2af9a85c8c858cf1c15d41efdf35f4556c87ec7b483712b682808ebb960536121007f51b49aa71e4f059f36
-  data.tar.gz: c3e1f52085ee821fc566a9137344e944fd1845f4debda895852e85bb040b058f7c1080d005d5bc585835121f934d2a93b18da3d81510c10f1151fb299e6defaa
+  metadata.gz: 60be7cafb11ba31d1a059e0b04950f8711c4377f3c9ba7277454513727d251d3896e76607f5c7b61dbf29393f2cebdac87b32e4ea621747b9e140e4c243ff7e3
+  data.tar.gz: d9ef3b2f0ff6d52dbc7b1755c9092d594d065c07a0039acf5c49ca217b375bee30a4607fab964cfdaf72eb934ef05c34c2663bdc68d32d4190fd8f508f54df5c

data/CHANGELOG.md

@@ -1,11 +1,18 @@
 ## unreleased
 
+## 3.3.0.beta1 - 2024-11-04
+
+- feat: Add helpers for Step Up auth / re-verification [https://github.com/clerk/clerk-sdk-ruby/pull/72]
+
+## 3.2.0 - 2024-04-08
+
+- fix: Infinite redirect loop when client_uat=0 and __session exists [https://github.com/clerk/clerk-sdk-ruby/pull/55]
+
 ## 3.1.0 - 2024-03-19
 
 - fix: Incompatible __client_uat & __session should show interstitial (#51) [https://github.com/clerk/clerk-sdk-ruby/pull/51]
 - fix: Incorrect check that lead to infinite redirect loop introduced by (#51) [https://github.com/clerk/clerk-sdk-ruby/pull/51]
 
-
 ## 3.0.0 - 2024-01-09
 
 Note: this is identical to 2.12.0, which was yanked because it contained a

data/Gemfile.lock

@@ -1,7 +1,7 @@
 PATH
   remote: .
   specs:
-    clerk-sdk-ruby (3.1.0)
+    clerk-sdk-ruby (3.2.0)
       concurrent-ruby (~> 1.1)
       faraday (>= 1.4.1, < 3.0)
       jwt (~> 2.5)
@@ -9,21 +9,19 @@ PATH
 GEM
   remote: https://rubygems.org/
   specs:
-    base64 (0.2.0)
+    base64 (0.1.1)
     byebug (11.1.3)
-    concurrent-ruby (1.2.3)
-    faraday (2.9.0)
-      faraday-net_http (>= 2.0, < 3.2)
-    faraday-net_http (3.1.0)
-      net-http
-    jwt (2.8.1)
+    concurrent-ruby (1.2.2)
+    faraday (2.7.11)
       base64
+      faraday-net_http (>= 2.0, < 3.1)
+      ruby2_keywords (>= 0.0.4)
+    faraday-net_http (3.0.2)
+    jwt (2.7.1)
     minitest (5.20.0)
-    net-http (0.4.1)
-      uri
     rake (13.1.0)
+    ruby2_keywords (0.0.5)
     timecop (0.9.8)
-    uri (0.13.0)
 
 PLATFORMS
   arm64-darwin-22

data/lib/clerk/authenticatable.rb

@@ -73,6 +73,16 @@ module Clerk
       !!clerk_verified_session_claims
     end
 
+    def clerk_user_needs_reverification?(params=StepUp::PRESETS[:strict])
+      !request.env['clerk'].is_user_reverified?(params)
+    end
+
+    def clerk_render_reverification(missing_config=nil)
+      payload = request.env['clerk'].reverification_mismatch_payload(missing_config)
+
+      render status: 403, json: payload
+    end
+
     def clerk_sign_in_url
       ENV.fetch("CLERK_SIGN_IN_URL")
     end

data/lib/clerk/constants.rb

@@ -0,0 +1,10 @@
+module Clerk
+  module StepUp
+    PRESETS = {
+      very_strict: { after_minutes: 10,   level: :multi_factor  },
+      strict:      { after_minutes: 10,   level: :second_factor },
+      moderate:    { after_minutes: 60,   level: :second_factor },
+      lax:         { after_minutes: 1440, level: :second_factor }
+    }
+  end
+end

data/lib/clerk/rack_middleware_v2.rb

@@ -60,6 +60,51 @@ module Clerk
       @session_claims["org_permissions"]
     end
 
+    # Returns true if the session needs to perform step up verification
+    def is_user_reverified?(params)
+      return false if session_claims.nil?
+
+      fva           = session_claims["fva"]
+      level         = params[:level]
+      after_minutes = Integer(params[:after_minutes])
+
+      # the feature is disabled
+      return true if fva.nil?
+
+      return false if after_minutes.nil? || level.nil?
+
+      factor1_age, factor2_age = fva
+      is_valid_factor1 = factor1_age != -1 && after_minutes > factor1_age
+      is_valid_factor2 = factor2_age != -1 && after_minutes > factor2_age
+
+      case level
+      when :first_factor
+        is_valid_factor1
+      when :second_factor
+        factor2_age == -1 ? is_valid_factor1 : is_valid_factor2
+      when :multi_factor
+        factor2_age == -1 ? is_valid_factor1 : is_valid_factor1 && is_valid_factor2
+      end
+    end
+
+    def reverification_mismatch_payload(missing_config)
+      {
+        clerk_error: {
+          type:     "forbidden",
+          reason:   "reverification-mismatch",
+          metadata: { reverification: missing_config, }
+        }
+      }
+    end
+
+    def reverification_response(missing_config=nil)
+      [
+        403,
+        { "Content-Type" => "application/json" },
+        [reverification_mismatch_payload(missing_config).to_json],
+      ]
+    end
+
     private
 
     def fetch_user(user_id)
@@ -176,15 +221,15 @@ module Clerk
         return unknown(interstitial: true)
       end
 
-      # Show interstitial when there is client_uat is incompatible with cookie token
-      has_cookie_token_without_client = (client_uat == "0" || client_uat.to_s.empty?) && cookie_token
-      has_client_without_cookie_token = (client_uat.to_s != "0" && client_uat.to_s != "") && cookie_token.to_s.empty?
-      return unknown(interstitial: true) if has_cookie_token_without_client || has_client_without_cookie_token
-
       if client_uat == "0"
         return signed_out(env)
       end
 
+      # Show interstitial when there is client_uat is incompatible with cookie token
+      has_cookie_token_without_client = client_uat.to_s.empty? && cookie_token
+      has_client_without_cookie_token = client_uat.to_s != "" && cookie_token.to_s.empty?
+      return unknown(interstitial: true) if has_cookie_token_without_client || has_client_without_cookie_token
+
       begin
         token = verify_token(cookie_token)
         return signed_out(env) if !token

data/lib/clerk/version.rb

@@ -1,5 +1,5 @@
 # frozen_string_literal: true
 
 module Clerk
-  VERSION = "3.1.0"
+  VERSION = "3.3.0.beta1"
 end

data/lib/clerk.rb

@@ -2,6 +2,7 @@
 
 require_relative "clerk/version"
 require_relative "clerk/sdk"
+require_relative "clerk/constants"
 
 module Clerk
   class << self

metadata

@@ -1,14 +1,14 @@
 --- !ruby/object:Gem::Specification
 name: clerk-sdk-ruby
 version: !ruby/object:Gem::Version
-  version: 3.1.0
+  version: 3.3.0.beta1
 platform: ruby
 authors:
 - Clerk
 autorequire:
 bindir: exe
 cert_chain: []
-date: 2024-03-19 00:00:00.000000000 Z
+date: 2024-11-04 00:00:00.000000000 Z
 dependencies:
 - !ruby/object:Gem::Dependency
   name: faraday
@@ -109,6 +109,7 @@ files:
 - docs/clerk-logo-light.png
 - lib/clerk.rb
 - lib/clerk/authenticatable.rb
+- lib/clerk/constants.rb
 - lib/clerk/errors.rb
 - lib/clerk/jwks_cache.rb
 - lib/clerk/rack_middleware.rb
@@ -152,7 +153,7 @@ required_rubygems_version: !ruby/object:Gem::Requirement
     - !ruby/object:Gem::Version
       version: '0'
 requirements: []
-rubygems_version: 3.2.3
+rubygems_version: 3.5.3
 signing_key:
 specification_version: 4
 summary: Clerk SDK for Ruby.