dctest-sdk-ruby 5.0.3

data/lib/clerk/authenticatable.rb

@@ -0,0 +1,32 @@
+# frozen_string_literal: true
+
+require 'active_support/concern'
+
+module Clerk
+  module Authenticatable
+    extend ActiveSupport::Concern
+
+    protected
+
+    def clerk
+      request.env['clerk']
+    end
+
+    def require_reverification!(preset = StepUp::Preset::STRICT, &block)
+      clerk.user_require_reverification!(preset) do
+        return yield(preset) if block_given?
+        render_reverification!(preset)
+      end
+    end
+
+    def render_reverification!(preset = nil)
+      render status: 403, json: StepUp::Reverification.error_payload(preset)
+    end
+
+    included do
+      if respond_to?(:helper_method)
+        helper_method :clerk, :require_reverification!, :render_reverification!
+      end
+    end
+  end
+end

data/lib/clerk/authenticate_context.rb

@@ -0,0 +1,168 @@
+# frozen_string_literal: true
+
+require 'ostruct'
+require 'forwardable'
+
+module Clerk
+  # This class represents a parameter object used to contain all request and configuration
+  # information required by the middleware to resolve the current request state.
+  # link: https://refactoring.guru/introduce-parameter-object
+  class AuthenticateContext
+    extend Forwardable
+
+    # Expose the url of the request that this parameter object was created from as a URI object.
+    attr_reader :clerk_url
+
+    # Expose properties that does not require validations or complex logic to retrieve
+    # values by delegating them to the cookies or headers variables.
+    def_delegators :@cookies, :session_token_in_cookie, :client_uat
+    def_delegators :@headers, :session_token_in_header, :sec_fetch_dest
+
+    # Creates a new parameter object using ::Rack::Request and Clerk::Config objects.
+    def initialize(request, config)
+      @clerk_url = URI.parse(request.url)
+      @config = config
+
+      @cookies = OpenStruct.new({
+        client_uat: request.cookies[CLIENT_UAT_COOKIE],
+        dev_browser: request.cookies[DEV_BROWSER_COOKIE],
+        handshake_token: request.cookies[HANDSHAKE_COOKIE],
+        session_token_in_cookie: request.cookies[SESSION_COOKIE]
+      })
+
+      @headers = OpenStruct.new({
+        accept: Utils.retrieve_header_from_request(request, ACCEPT_HEADER),
+        host: request.host,
+        origin: Utils.retrieve_header_from_request(request, ORIGIN_HEADER),
+        port: request.port,
+        sec_fetch_dest: Utils.retrieve_header_from_request(request, SEC_FETCH_DEST_HEADER),
+        session_token_in_header: Utils.retrieve_header_from_request(request, AUTHORIZATION_HEADER).gsub(/bearer/i, '').strip
+      })
+    end
+
+    # The following properties are part of the props supported in all the AuthenticateContext
+    # objects across all of our SDKs (eg JS, Go)
+    def secret_key
+      raise ConfigurationError, 'Clerk secret key is not set' if @config.secret_key.to_s.empty?
+
+      @config.secret_key.to_s
+    end
+
+    def publishable_key
+      raise ConfigurationError, 'Clerk publishable key is not set' if @config.publishable_key.to_s.to_s.empty?
+
+      @config.publishable_key.to_s
+    end
+
+    def proxy_url?
+      !proxy_url.empty?
+    end
+
+    def handshake_token
+      @handshake_token ||= Utils.retrieve_from_query_string(@clerk_url, HANDSHAKE_COOKIE) || @cookies.handshake_token.to_s
+    end
+
+    def dev_browser
+      @dev_browser ||= dev_browser_in_url || @cookies.dev_browser.to_s
+    end
+
+    # The frontend_api returned is without protocol prefix
+    def frontend_api
+      return '' unless Utils.valid_publishable_key?(publishable_key.to_s)
+
+      @frontend_api ||= if proxy_url?
+        proxy_url
+      elsif development_instance? && !domain.empty?
+        "clerk.#{domain}"
+      else
+        # remove $ postfix
+        Utils.decode_publishable_key(publishable_key).chop.to_s
+      end
+    end
+
+    def development_instance?
+      secret_key.start_with?('sk_test_')
+    end
+
+    def production_instance?
+      secret_key.start_with?('sk_live_')
+    end
+
+    def document_request?
+      @headers.sec_fetch_dest == 'document'
+    end
+
+    def accepts_html?
+      @headers.accept&.start_with?('text/html')
+    end
+
+    def eligible_for_multi_domain?
+      satellite? && document_request? && !clerk_synced?
+    end
+
+    def active_client?
+      @cookies.client_uat.to_i.positive?
+    end
+
+    def cross_origin_request?
+      # origin contains scheme+host and optionally port (omitted if 80 or 443)
+      # ref. https://www.rfc-editor.org/rfc/rfc6454#section-6.1
+      return false if @headers.origin.nil?
+
+      # strip scheme
+      origin = @headers.origin.strip.sub(%r{\A(\w+:)?//}, '')
+      return false if origin.empty?
+
+      # Rack's host and port helpers are reverse-proxy-aware; that
+      # is, they prefer the de-facto X-Forwarded-* headers if they're set
+      request_host = @headers.host
+      request_host << ":#{@headers.port}" if @headers.port != 80 && @headers.port != 443
+
+      origin != request_host
+    end
+
+    def dev_browser?
+      !dev_browser.empty?
+    end
+
+    def session_token_in_header?
+      !session_token_in_header.to_s.empty?
+    end
+
+    def handshake_token?
+      !handshake_token.to_s.empty?
+    end
+
+    def session_token_in_cookie?
+      !session_token_in_cookie.to_s.empty?
+    end
+
+    def dev_browser_in_url
+      Utils.retrieve_from_query_string(@clerk_url, DEV_BROWSER_COOKIE)
+    end
+
+    def dev_browser_in_url?
+      !!dev_browser_in_url
+    end
+
+    def domain
+      '' # TODO: Add multi-domain support
+    end
+
+    def satellite?
+      false # TODO: Add multi-domain support
+    end
+
+    def proxy_url
+      '' # TODO: Add multi-domain support
+    end
+
+    def clerk_synced?
+      false # TODO: Add multi-domain support
+    end
+
+    def clerk_redirect_url
+      '' # TODO: Add multi-domain support
+    end
+  end
+end

data/lib/clerk/authenticate_request.rb

@@ -0,0 +1,261 @@
+# frozen_string_literal: true
+
+require 'clerk/proxy'
+require 'rack/utils'
+
+module Clerk
+  # This class represents a service object used to determine the current request state
+  # for the current env passed based on a provided Clerk::AuthenticateContext.
+  # There is only 1 public method exposed (`resolve`) to be invoked with a env parameter.
+  class AuthenticateRequest
+    attr_reader :auth_context
+
+    # Creates a new instance using Clerk::AuthenticateContext object.
+    def initialize(auth_context)
+      @auth_context = auth_context
+    end
+
+    # Determines the current request state by verifying a Clerk token in headers or cookies.
+    # The possible outcomes of this method are `signed-in`, `signed-out` or `handshake` states.
+    # The return values are the same as a return value of a rack middleware `[http_status_code, headers, body]`.
+    # When used in a middleware the consumer of this service should return the return value when there is an
+    # `http_status_code` provided otherwise the should continue with the middleware chain.
+    # The headers provided in the return value is a hash of { header_key => header_value } and in the case
+    # of a `Set-Cookie` header the `header_value` used is a list of raw HTTP Set-Cookie directives.
+    def resolve(env)
+      if auth_context.session_token_in_header?
+        resolve_header_token(env)
+      else
+        resolve_cookie_token(env)
+      end
+    end
+
+    protected
+
+    def resolve_header_token(env)
+      begin
+        # malformed JWT
+        unless sdk.decode_token(auth_context.session_token_in_header)
+          return signed_out(reason: TokenVerificationErrorReason::TOKEN_INVALID)
+        end
+
+        claims = verify_token(auth_context.session_token_in_header)
+        return signed_in(env, claims, auth_context.session_token_in_header) if claims
+      rescue JWT::ExpiredSignature
+        # Expired token
+        return signed_out(enforce_auth: true, reason: TokenVerificationErrorReason::TOKEN_EXPIRED)
+      rescue JWT::InvalidIatError
+        # Token not active yet
+        return signed_out(enforce_auth: true, reason: TokenVerificationErrorReason::TOKEN_NOT_ACTIVE_YET)
+      rescue JWT::DecodeError
+        # Malformed JWT (NOTE: Must be the last rescue block as it catches all decoding errors)
+        return signed_out(reason: TokenVerificationErrorReason::TOKEN_INVALID)
+      end
+
+      # Clerk.js should refresh the token and retry
+      signed_out(enforce_auth: true)
+    end
+
+    def resolve_cookie_token(env)
+      # in cross-origin XHRs the use of Authorization header is mandatory.
+      # TODO: add reason
+      return signed_out if auth_context.cross_origin_request?
+
+      return resolve_handshake(env) if auth_context.handshake_token?
+
+      if auth_context.development_instance? && auth_context.dev_browser_in_url?
+        return handle_handshake_maybe_status(env, reason: AuthErrorReason::DEV_BROWSER_SYNC)
+      end
+
+      if auth_context.development_instance? && !auth_context.dev_browser?
+        return handle_handshake_maybe_status(env, reason: AuthErrorReason::DEV_BROWSER_MISSING)
+      end
+
+      # TODO: Add multi-domain support for production
+      # if auth_context.production_instance? && auth_context.eligible_for_multi_domain?
+      #   return handle_handshake_maybe_status(env, reason: AuthErrorReason::SATELLITE_COOKIE_NEEDS_SYNCING)
+      # end
+
+      # TODO: Add multi-domain support for development
+      # if auth_context.development_instance? && auth_context.eligible_for_multi_domain?
+      #   # trigger handshake using auth_context.sign_in_url as base redirect_url
+      #   # return handle_handshake_maybe_status(env, reason: AuthErrorReason::SATELLITE_COOKIE_NEEDS_SYNCING, '', headers)
+      # end
+
+      # TODO: Add multi-domain support for development in primary
+      # if auth_context.development_instance? && !auth_context.is_satellite? && auth_context.clerk_redirect_url
+      #   # trigger handshake using auth_context.clerk_redirect_url as base redirect_url + mark it as clerk_synced
+      #   # return handle_handshake_maybe_status(env, reason: AuthErrorReason::PRIMARY_RESPONDS_TO_SYNCING, '', headers)
+      # end
+
+      if !auth_context.active_client? && !auth_context.session_token_in_cookie?
+        return signed_out(reason: AuthErrorReason::SESSION_TOKEN_AND_UAT_MISSING)
+      end
+
+      # This can eagerly run handshake since client_uat is SameSite=Strict in dev
+      if !auth_context.active_client? && auth_context.session_token_in_cookie?
+        return handle_handshake_maybe_status(env, reason: AuthErrorReason::SESSION_TOKEN_WITHOUT_CLIENT_UAT)
+      end
+
+      if auth_context.active_client? && !auth_context.session_token_in_cookie?
+        return handle_handshake_maybe_status(env, reason: AuthErrorReason::CLIENT_UAT_WITHOUT_SESSION_TOKEN)
+      end
+
+      begin
+        claims = verify_token(auth_context.session_token_in_cookie)
+        return signed_out unless claims
+
+        if claims['iat'] < auth_context.client_uat.to_i
+          return handle_handshake_maybe_status(env, reason: AuthErrorReason::SESSION_TOKEN_OUTDATED)
+        end
+
+        signed_in(env, claims, auth_context.session_token_in_cookie)
+      rescue JWT::ExpiredSignature
+        handshake(env, reason: TokenVerificationErrorReason::TOKEN_EXPIRED)
+      rescue JWT::InvalidIatError
+        handshake(env, reason: TokenVerificationErrorReason::TOKEN_NOT_ACTIVE_YET)
+      rescue JWT::DecodeError
+        signed_out(reason: TokenVerificationErrorReason::TOKEN_INVALID)
+      rescue StandardError
+        signed_out
+      end
+    end
+
+    def resolve_handshake(env)
+      headers = {
+        Clerk::ACCESS_CONTROL_ALLOW_ORIGIN_HEADER => 'null',
+        Clerk::ACCESS_CONTROL_ALLOW_CREDENTIALS_HEADER => 'true'
+      }
+      session_token = nil
+
+      # Return signed-out outcome if the handshake verification fails
+      handshake_payload = verify_token(auth_context.handshake_token)
+      unless handshake_payload
+        return signed_out(enforce_auth: true, reason: TokenVerificationErrorReason::JWK_FAILED_TO_RESOLVE)
+      end
+
+      # Retrieve the cookie directives included in handshake token payload and convert it to set-cookie headers
+      # Also retrieve the session token separately to determine the outcome of the request
+      cookies_to_set = handshake_payload[HANDSHAKE_COOKIE_DIRECTIVES_KEY] || []
+      cookies_to_set.each do |cookie|
+        headers[SET_COOKIE_HEADER] ||= []
+        headers[SET_COOKIE_HEADER] << cookie
+
+        session_token = cookie.split(';')[0].split('=')[1] if cookie.start_with?("#{SESSION_COOKIE}=")
+      end
+
+      # Clear handshake token from query params and set headers to redirect to the initial request url
+      if auth_context.development_instance?
+        redirect_url = auth_context.clerk_url.dup
+        remove_from_query_string(redirect_url, HANDSHAKE_COOKIE)
+
+        headers[LOCATION_HEADER] = redirect_url.to_s
+      end
+
+      return signed_out(reason: AuthErrorReason::SESSION_TOKEN_MISSING, headers: headers) unless session_token
+
+      verify_token_with_retry(env, session_token, headers:)
+    end
+
+    def handle_handshake_maybe_status(env, **opts)
+      return signed_out unless eligible_for_handshake?
+
+      handshake(env, **opts)
+    end
+
+    # A outcome
+    def handshake(_env, **opts)
+      redirect_headers = {LOCATION_HEADER => redirect_to_handshake}
+      [307, debug_auth_headers(**opts).merge(redirect_headers), []]
+    end
+
+    # B outcome
+    def signed_out(**opts)
+      headers = opts.delete(:headers) || {}
+      enforce_auth = opts.delete(:enforce_auth)
+
+      [
+        enforce_auth ? 401 : nil,
+        debug_auth_headers(**opts).merge(headers),
+        []
+      ]
+    end
+
+    # C outcome
+    def signed_in(env, claims, token, **headers)
+      env['clerk'] = Proxy.new(session_claims: claims, session_token: token)
+      [nil, headers, []]
+    end
+
+    def eligible_for_handshake?
+      auth_context.document_request? || (!auth_context.document_request? && auth_context.accepts_html?)
+    end
+
+    private
+
+    def redirect_to_handshake
+      redirect_url = auth_context.clerk_url.dup
+      remove_from_query_string(redirect_url, DEV_BROWSER_COOKIE)
+
+      handshake_url = URI.parse("https://#{auth_context.frontend_api}/v1/client/handshake")
+      handshake_url_qs = ::Rack::Utils.parse_query(handshake_url.query)
+      handshake_url_qs['redirect_url'] = redirect_url
+
+      if auth_context.development_instance? && auth_context.dev_browser?
+        handshake_url_qs[DEV_BROWSER_COOKIE] = auth_context.dev_browser
+      end
+
+      handshake_url.query = ::Rack::Utils.build_query(handshake_url_qs)
+      handshake_url.to_s
+    end
+
+    def remove_from_query_string(url, key)
+      qs = ::Rack::Utils.parse_query(url.query)
+      qs.delete(key)
+
+      url.query = ::Rack::Utils.build_query(qs)
+    end
+
+    def verify_token(token, **opts)
+      return false if token.nil? || token.strip.empty?
+
+      begin
+        sdk.verify_token(token, **opts)
+      rescue JWT::ExpiredSignature, JWT::InvalidIatError => e
+        raise e
+      rescue JWT::DecodeError => _e
+        false
+      end
+    end
+
+    # Verify session token and provide a 1-day leeway for development if initial verification
+    # fails for development instance due to invalid exp or iat
+    def verify_token_with_retry(env, token, headers: {})
+      claims = verify_token(token)
+      signed_in(env, claims, token, **headers) if claims
+    rescue JWT::ExpiredSignature, JWT::InvalidIatError => e
+      if auth_context.development_instance?
+        # TODO: log possible Clock skew detected
+
+        # Retry with a generous clock skew allowance (1 day)
+        claims = verify_token(token, timeout: 86_400)
+        return signed_in(env, claims, token, **headers) if claims
+      end
+
+      # Raise error if handshake resolution fails in production
+      raise e
+    end
+
+    def sdk
+      SDK.new
+    end
+
+    def debug_auth_headers(reason: nil, message: nil, status: nil)
+      {
+        AUTH_REASON_HEADER => reason,
+        AUTH_MESSAGE_HEADER => message,
+        AUTH_STATUS_HEADER => status
+      }.compact
+    end
+  end
+end