Class: Clerk::RackMiddlewareV2

Inherits:

Object

• Object
• Clerk::RackMiddlewareV2

Defined in:

lib/clerk/rack_middleware_v2.rb

Instance Method Summary

• #call(env) ⇒ Object
• #initialize(app) ⇒ RackMiddlewareV2 constructor

  A new instance of RackMiddlewareV2.

Constructor Details

#initialize(app) ⇒ RackMiddlewareV2

Returns a new instance of RackMiddlewareV2.

# File 'lib/clerk/rack_middleware_v2.rb', line 136

def initialize(app)
  @app = app
  @excluded_routes = {}
  @excluded_routes_wildcards = []

  Clerk.configuration.excluded_routes.each do |route|
    route = route.strip

    if route.ends_with?("/*")
      @excluded_routes_wildcards << route[0..-2]
    else
      @excluded_routes[route] = true
    end
  end

  @excluded_routes_wildcards.uniq!
end

Instance Method Details

#call(env) ⇒ Object

# File 'lib/clerk/rack_middleware_v2.rb', line 154

def call(env)
  env = env
  req = Rack::Request.new(env)

  if @excluded_routes[req.path]
    return @app.call(env)
  end

  @excluded_routes_wildcards.each do |route|
    return @app.call(env) if req.path.starts_with?(route)
  end

  env["clerk"] = Clerk::ProxyV2.new
  header_token = req.env["HTTP_AUTHORIZATION"]
  header_token = header_token.strip.sub(/\ABearer /, '') if header_token
  cookie_token = req.cookies["__session"]
  client_uat = req.cookies["__client_uat"]

  ##########################################################################
  #                                                                        #
  #                          HEADER AUTHENTICATION                         #
  #                                                                        #
  ##########################################################################
  if header_token
    begin
      return signed_out(env) if !sdk.decode_token(header_token) # malformed JWT
    rescue JWT::DecodeError
      return signed_out(env)  # malformed JSON authorization header
    end

    begin
      token = verify_token(header_token)
      return signed_in(env, token, header_token) if token
    rescue JWT::ExpiredSignature, JWT::InvalidIatError
      unknown(interstitial: false)
    end

    # Clerk.js should refresh the token and retry
    return unknown(interstitial: false)
  end

  # in cross-origin XHRs the use of Authorization header is mandatory.
  if cross_origin_request?(req)
    return signed_out(env)
  end

  if development_or_staging? && !browser_request?(req)
    # the interstitial won't work if the user agent is not a browser, so
    # short-circuit and avoid rendering it
    #
    # We only limit this to dev/stg because we're not yet sure how robust
    # this strategy is, yet. In the future, we might enable it for prod too.
    return signed_out(env)
  end

  ##########################################################################
  #                                                                        #
  #                             COOKIE AUTHENTICATION                      #
  #                                                                        #
  ##########################################################################

  if development_or_staging? && (req.referrer.nil? || cross_origin_request?(req))
    return unknown(interstitial: true)
  end

  # Show interstitial when there is no client_uat and cookie token
  if client_uat.to_s.empty? && cookie_token.to_s.empty?
    return unknown(interstitial: true)
  end

  if client_uat == "0"
    return signed_out(env)
  end

  # Show interstitial when there is client_uat is incompatible with cookie token
  has_cookie_token_without_client = client_uat.to_s.empty? && cookie_token
  has_client_without_cookie_token = client_uat.to_s != "" && cookie_token.to_s.empty?
  return unknown(interstitial: true) if has_cookie_token_without_client || has_client_without_cookie_token

  begin
    token = verify_token(cookie_token)
    return signed_out(env) if !token

    if token["iat"] && client_uat && Integer(client_uat) <= token["iat"]
      return signed_in(env, token, cookie_token)
    end
  rescue JWT::ExpiredSignature, JWT::InvalidIatError
    unknown(interstitial: true)
  end

  unknown(interstitial: true)
end