Class: Clerk::SDK

Inherits:
ClerkHttpClient::SDK
  • Object
show all
Defined in:
lib/clerk/sdk.rb

Constant Summary collapse

DEFAULT_HEADERS = 
{
  "User-Agent": "Clerk/#{Clerk::VERSION}; Faraday/#{Faraday::VERSION}; Ruby/#{RUBY_VERSION}",
  "X-Clerk-SDK": "ruby/#{Clerk::VERSION}",
  "Clerk-API-Version": "2025-04-10",
}
JWKS_CACHE_LIFETIME =

How often (in seconds) should JWKs be refreshed

3600
@@jwks_cache =

1 hour

JWKSCache.new(JWKS_CACHE_LIFETIME)

Class Method Summary collapse

Instance Method Summary collapse

Class Method Details

.jwks_cache ⇒ Object 



19
20
21
 
# File 'lib/clerk/sdk.rb', line 19

def self.jwks_cache
  @@jwks_cache
end

Instance Method Details

#decode_token(token) ⇒ Object

Returns the decoded JWT payload without verifying if the signature is valid.

WARNING: This will not verify whether the signature is valid. You should not use this for untrusted messages! You most likely want to use verify_token.



27
28
29
 
# File 'lib/clerk/sdk.rb', line 27

def decode_token(token)
  JWT.decode(token, nil, false).first
end

#verify_token(token, force_refresh_jwks: false, algorithms: ["RS256"], timeout: 5) ⇒ Object

Decode the JWT and verify it’s valid (verify claims, signature etc.) using the provided algorithms.

JWKS are cached for JWKS_CACHE_LIFETIME seconds, in order to avoid unecessary roundtrips. In order to invalidate the cache, pass ‘force_refresh_jwks: true`.

A timeout for the request to the JWKs endpoint can be set with the timeout argument.



37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
 
# File 'lib/clerk/sdk.rb', line 37

def verify_token(token, force_refresh_jwks: false, algorithms: ["RS256"], timeout: 5)
  jwk_loader = ->(options) do
    # JWT.decode requires that the 'keys' key in the Hash is a symbol (as
    # opposed to a string which our SDK returns by default)
    {keys: SDK.jwks_cache.fetch(self, kid_not_found: options[:invalidate] || options[:kid_not_found], force_refresh: force_refresh_jwks)}
  end

  claims = JWT.decode(token, nil, true, algorithms: algorithms, exp_leeway: timeout, jwks: jwk_loader).first

  # orgs
  if claims["v"].nil? || claims["v"] == 1
    claims["v"] = 1
  elsif claims["v"] == 2 && claims["o"]
    claims["org_id"]          = claims["o"].fetch("id", nil)
    claims["org_slug"]        = claims["o"].fetch("slg", nil)
    claims["org_role"]        = "org:#{claims["o"].fetch("rol", nil)}"

    org_permissions = compute_org_permissions_from_v2_token(claims)
    claims["org_permissions"] = org_permissions if org_permissions.any?
    claims.delete("o")
    claims.delete("fea")
  end

  claims
end