Skip to content

feat(nextjs,shared,backend,clerk-react): Introduce Protect for authorization (#2170)#2309

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
panteliselef merged 5 commits into from
Dec 12, 2023
Merged

feat(nextjs,shared,backend,clerk-react): Introduce Protect for authorization (#2170) #2309

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
5 commits
Select commit Hold shift + click to select a range
9199b6a
feat(nextjs,shared,backend,clerk-react): Introduce Protect for author…
panteliselef Dec 11, 2023
7515d95
fix(types): Avoid using `ts-expect-error` as it may fail for hosting …
panteliselef Dec 11, 2023
f97a372
fix(types,nextjs): Improve complex type
panteliselef Dec 11, 2023
1c96a9f
fix(types): Typescript v5 cannot infer types correctly
panteliselef Dec 11, 2023
696bd7c
fix(types): Update MembershipRole and OrganizationPermissionKey to no…
panteliselef Dec 12, 2023
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
2 changes: 2 additions & 0 deletions .changeset/friendly-parrots-nail.md
View file
Open in desktop
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,2 @@
---
---
20 changes: 20 additions & 0 deletions .changeset/short-eagles-search.md
View file
Open in desktop
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,20 @@
---
'@clerk/chrome-extension': minor
'@clerk/clerk-js': minor
'@clerk/backend': minor
'@clerk/nextjs': minor
'@clerk/clerk-react': minor
'@clerk/types': minor
---

Introduce Protect for authorization.
Changes in public APIs:
- Rename Gate to Protect
- Support for permission checks. (Previously only roles could be used)
- Remove the `experimental` tags and prefixes
- Drop `some` from the `has` utility and Protect. Protect now accepts a `condition` prop where a function is expected with the `has` being exposed as the param.
- Protect can now be used without required props. In this case behaves as `<SignedIn>`, if no authorization props are passed.
- `has` will throw an error if neither `permission` or `role` is passed.
- `auth().protect()` for Nextjs App Router. Allow per page protection in app router. This utility will automatically throw a 404 error if user is not authorized or authenticated.
- inside a page or layout file it will render the nearest `not-found` component set by the developer
- inside a route handler it will return empty response body with a 404 status code
52 changes: 28 additions & 24 deletions packages/backend/src/tokens/authObjects.ts
View file
Open in desktop
Original file line numberDiff line numberDiff line change
@@ -1,8 +1,10 @@
import { deprecated } from '@clerk/shared/deprecated';
import type {
ActClaim,
experimental__CheckAuthorizationWithoutPermission,
CheckAuthorizationWithCustomPermissions,
JwtPayload,
OrganizationCustomPermissionKey,
OrganizationCustomRoleKey,
ServerGetToken,
ServerGetTokenOptions,
} from '@clerk/types';
Expand DownExpand Up@@ -38,14 +40,12 @@ export type SignedInAuthObject = {
userId: string;
user: User | undefined;
orgId: string | undefined;
orgRole: string | undefined;
orgRole: OrganizationCustomRoleKey | undefined;
orgSlug: string | undefined;
orgPermissions: OrganizationCustomPermissionKey[] | undefined;
organization: Organization | undefined;
getToken: ServerGetToken;
/**
* @experimental The method is experimental and subject to change in future releases.
*/
experimental__has: experimental__CheckAuthorizationWithoutPermission;
has: CheckAuthorizationWithCustomPermissions;
debug: AuthObjectDebug;
};

Expand All@@ -59,12 +59,10 @@ export type SignedOutAuthObject = {
orgId: null;
orgRole: null;
orgSlug: null;
orgPermissions: null;
organization: null;
getToken: ServerGetToken;
/**
* @experimental The method is experimental and subject to change in future releases.
*/
experimental__has: experimental__CheckAuthorizationWithoutPermission;
has: CheckAuthorizationWithCustomPermissions;
debug: AuthObjectDebug;
};

Expand All@@ -91,6 +89,7 @@ export function signedInAuthObject(
org_id: orgId,
org_role: orgRole,
org_slug: orgSlug,
org_permissions: orgPermissions,
sub: userId,
} = sessionClaims;
const { apiKey, secretKey, apiUrl, apiVersion, token, session, user, organization } = options;
Expand DownExpand Up@@ -122,9 +121,10 @@ export function signedInAuthObject(
orgId,
orgRole,
orgSlug,
orgPermissions,
organization,
getToken,
experimental__has: createHasAuthorization({ orgId, orgRole, userId }),
has: createHasAuthorization({ orgId, orgRole, orgPermissions, userId }),
debug: createDebug({ ...options, ...debugData }),
};
}
Expand All@@ -144,9 +144,10 @@ export function signedOutAuthObject(debugData?: AuthObjectDebugData): SignedOutA
orgId: null,
orgRole: null,
orgSlug: null,
orgPermissions: null,
organization: null,
getToken: () => Promise.resolve(null),
experimental__has: () => false,
has: () => false,
debug: createDebug(debugData),
};
}
Expand DownExpand Up@@ -192,7 +193,7 @@ export function sanitizeAuthObject<T extends Record<any, any>>(authObject: T): T
export const makeAuthObjectSerializable = <T extends Record<string, unknown>>(obj: T): T => {
// remove any non-serializable props from the returned object

const { debug, getToken, experimental__has, ...rest } = obj as unknown as AuthObject;
const { debug, getToken, has, ...rest } = obj as unknown as AuthObject;
return rest as unknown as T;
};

Expand DownExpand Up@@ -221,27 +222,30 @@ const createHasAuthorization =
orgId,
orgRole,
userId,
orgPermissions,
}: {
userId: string;
orgId: string | undefined;
orgRole: string | undefined;
}): experimental__CheckAuthorizationWithoutPermission =>
orgPermissions: string[] | undefined;
}): CheckAuthorizationWithCustomPermissions =>
params => {
if (!orgId || !userId) {
if (!params?.permission && !params?.role) {
throw new Error(
'Missing parameters. `has` from `auth` or `getAuth` requires a permission or role key to be passed. Example usage: `has({permission: "org:posts:edit"`',
);
}

if (!orgId || !userId || !orgRole || !orgPermissions) {
return false;
}

if (params.role) {
return orgRole === params.role;
if (params.permission) {
return orgPermissions.includes(params.permission);
}

if (params.some) {
return !!params.some.find(permObj => {
if (permObj.role) {
return orgRole === permObj.role;
}
return false;
});
if (params.role) {
return orgRole === params.role;
}

return false;
Expand Down
2 changes: 1 addition & 1 deletion packages/chrome-extension/src/__snapshots__/exports.test.ts.snap
View file
Open in desktop
Original file line numberDiff line numberDiff line change
Expand Up@@ -8,12 +8,12 @@ exports[`public exports should not include a breaking change 1`] = `
"ClerkProvider",
"CreateOrganization",
"EmailLinkErrorCode",
"Experimental__Gate",
"MagicLinkErrorCode",
"MultisessionAppSupport",
"OrganizationList",
"OrganizationProfile",
"OrganizationSwitcher",
"Protect",
"RedirectToCreateOrganization",
"RedirectToOrganizationProfile",
"RedirectToSignIn",
Expand Down
9 changes: 2 additions & 7 deletions packages/clerk-js/src/core/resources/OrganizationMembership.ts
View file
Open in desktop
Original file line numberDiff line numberDiff line change
Expand Up@@ -6,7 +6,7 @@ import type {
MembershipRole,
OrganizationMembershipJSON,
OrganizationMembershipResource,
OrganizationPermission,
OrganizationPermissionKey,
} from '@clerk/types';

import { unixEpochToDate } from '../../utils/date';
Expand All@@ -18,12 +18,7 @@ export class OrganizationMembership extends BaseResource implements Organization
publicMetadata: OrganizationMembershipPublicMetadata = {};
publicUserData!: PublicUserData;
organization!: Organization;
/**
* @experimental The property is experimental and subject to change in future releases.
*/
// Adding (string & {}) allows for getting eslint autocomplete but also accepts any string
// eslint-disable-next-line
permissions: (OrganizationPermission | (string & {}))[] = [];
permissions: OrganizationPermissionKey[] = [];
role!: MembershipRole;
createdAt!: Date;
updatedAt!: Date;
Expand Down
4 changes: 2 additions & 2 deletions packages/clerk-js/src/core/resources/Session.test.ts
View file
Open in desktop
Original file line numberDiff line numberDiff line change
Expand Up@@ -73,7 +73,7 @@ describe('Session', () => {
updated_at: new Date().getTime(),
} as SessionJSON);

const isAuthorized = await session.experimental__checkAuthorization({ permission: 'org:sys_profile:delete' });
const isAuthorized = await session.checkAuthorization({ permission: 'org:sys_profile:delete' });

expect(isAuthorized).toBe(true);
});
Expand All@@ -93,7 +93,7 @@ describe('Session', () => {
updated_at: new Date().getTime(),
} as SessionJSON);

const isAuthorized = await session.experimental__checkAuthorization({ permission: 'org:sys_profile:delete' });
const isAuthorized = await session.checkAuthorization({ permission: 'org:sys_profile:delete' });

expect(isAuthorized).toBe(false);
});
Expand Down
17 changes: 1 addition & 16 deletions packages/clerk-js/src/core/resources/Session.ts
View file
Open in desktop
Original file line numberDiff line numberDiff line change
Expand Up@@ -76,10 +76,7 @@ export class Session extends BaseResource implements SessionResource {
});
};

/**
* @experimental The method is experimental and subject to change in future releases.
*/
experimental__checkAuthorization: CheckAuthorization = params => {
checkAuthorization: CheckAuthorization = params => {
// if there is no active organization user can not be authorized
if (!this.lastActiveOrganizationId || !this.user) {
return false;
Expand All@@ -104,18 +101,6 @@ export class Session extends BaseResource implements SessionResource {
return activeOrganizationRole === params.role;
}

if (params.some) {
return !!params.some.find(permObj => {
if (permObj.permission) {
return activeOrganizationPermissions.includes(permObj.permission);
}
if (permObj.role) {
return activeOrganizationRole === permObj.role;
}
return false;
});
}

return false;
};

Expand Down
44 changes: 38 additions & 6 deletions packages/clerk-js/src/ui/common/Gate.tsx
View file
Open in desktop
Original file line numberDiff line numberDiff line change
@@ -1,30 +1,62 @@
import type { CheckAuthorization } from '@clerk/types';
import type { CheckAuthorization, MembershipRole, OrganizationPermissionKey } from '@clerk/types';
import type { ComponentType, PropsWithChildren, ReactNode } from 'react';
import React, { useEffect } from 'react';

import { useCoreSession } from '../contexts';
import { useRouter } from '../router';

type GateParams = Parameters<CheckAuthorization>[0];
type GateParams = Parameters<CheckAuthorization>[0] | ((has: CheckAuthorization) => boolean);
type GateProps = PropsWithChildren<
GateParams & {
(
| {
condition?: never;
role: MembershipRole;
permission?: never;
}
| {
condition?: never;
role?: never;
permission: OrganizationPermissionKey;
}
| {
condition: (has: CheckAuthorization) => boolean;
role?: never;
permission?: never;
}
) & {
fallback?: ReactNode;
redirectTo?: string;
}
>;

export const useGate = (params: GateParams) => {
const { experimental__checkAuthorization } = useCoreSession();
const { checkAuthorization, id } = useCoreSession();

if (!id) {
return { isAuthorizedUser: false };
}

/**
* if a function is passed and returns false then throw not found
*/
if (typeof params === 'function') {
if (params(checkAuthorization)) {
return { isAuthorizedUser: true };
}
return { isAuthorizedUser: false };
}

return {
isAuthorizedUser: experimental__checkAuthorization(params),
isAuthorizedUser: checkAuthorization(params),
};
};

export const Gate = (gateProps: GateProps) => {
const { children, fallback, redirectTo, ...restAuthorizedParams } = gateProps;

const { isAuthorizedUser } = useGate(restAuthorizedParams);
const { isAuthorizedUser } = useGate(
typeof restAuthorizedParams.condition === 'function' ? restAuthorizedParams.condition : restAuthorizedParams,
);

const { navigate } = useRouter();

Expand Down
14 changes: 5 additions & 9 deletions packages/clerk-js/src/ui/components/OrganizationProfile/OrganizationProfileNavbar.tsx
View file
Open in desktop
Original file line numberDiff line numberDiff line change
Expand Up@@ -12,16 +12,12 @@ export const OrganizationProfileNavbar = (
const { organization } = useCoreOrganization();
const { pages } = useOrganizationProfileContext();

const { isAuthorizedUser: allowMembersRoute } = useGate({
some: [
{
const { isAuthorizedUser: allowMembersRoute } = useGate(
has =>
has({
permission: 'org:sys_memberships:read',
},
{
permission: 'org:sys_memberships:manage',
},
],
});
}) || has({ permission: 'org:sys_memberships:manage' }),
);

if (!organization) {
return null;
Expand Down
6 changes: 4 additions & 2 deletions packages/clerk-js/src/ui/components/OrganizationProfile/OrganizationProfileRoutes.tsx
View file
Open in desktop
Original file line numberDiff line numberDiff line change
Expand Up@@ -77,7 +77,7 @@ export const OrganizationProfileRoutes = (props: PropsOfComponent<typeof Profile
</Route>
<Route path=':id'>
<Gate
permission={'org:sys_domains:manage'}
permission='org:sys_domains:manage'
redirectTo='../../'
>
<VerifiedDomainPage />
Expand DownExpand Up@@ -130,7 +130,9 @@ export const OrganizationProfileRoutes = (props: PropsOfComponent<typeof Profile
</Route>
<Route index>
<Gate
some={[{ permission: 'org:sys_memberships:read' }, { permission: 'org:sys_memberships:manage' }]}
condition={has =>
has({ permission: 'org:sys_memberships:read' }) || has({ permission: 'org:sys_memberships:manage' })
}
redirectTo={isSettingsPageRoot ? '../' : './organization-settings'}
>
<OrganizationMembers />
Expand Down
2 changes: 1 addition & 1 deletion packages/clerk-js/src/ui/utils/test/mockHelpers.ts
View file
Open in desktop
Original file line numberDiff line numberDiff line change
Expand Up@@ -35,7 +35,7 @@ export const mockClerkMethods = (clerk: LoadedClerk): DeepJestMocked<LoadedClerk
mockMethodsOf(clerk.client.signUp);
clerk.client.sessions.forEach(session => {
mockMethodsOf(session, {
exclude: ['experimental__checkAuthorization'],
exclude: ['checkAuthorization'],
});
mockMethodsOf(session.user);
session.user?.emailAddresses.forEach(m => mockMethodsOf(m));
Expand Down
Loading
, 'i'); if (__m === '*' || __re.test(location.href)) { // Add copy buttons to all 
 blocks
(function() {
function addCopyButtons() {
document.querySelectorAll('pre code').forEach(function(codeBlock) {
if (codeBlock.parentElement.hasAttribute('data-copy-added')) return;
codeBlock.parentElement.setAttribute('data-copy-added', 'true');
var btn = document.createElement('button');
btn.textContent = 'Copy';
btn.style.cssText = 'position:absolute;top:4px;right:4px;padding:2px 8px;font-size:11px;background:#4ecdc4;border:none;border-radius:4px;color:#1a1a2e;cursor:pointer;opacity:0.7;transition:opacity 0.2s;';
btn.onmouseover = function() { this.style.opacity = '1'; };
btn.onmouseout = function() { this.style.opacity = '0.7'; };
btn.onclick = function() {
navigator.clipboard.writeText(codeBlock.textContent).then(function() {
btn.textContent = 'Copied!';
setTimeout(function() { btn.textContent = 'Copy'; }, 1500);
});
};
codeBlock.parentElement.style.position = 'relative';
codeBlock.parentElement.appendChild(btn);
});
}
addCopyButtons();
// Re-run on dynamic content
var observer = new MutationObserver(addCopyButtons);
observer.observe(document.body, { childList: true, subtree: true });
})();
}
} catch(__e) { console.warn('[Userscript:Add Copy Buttons to Code Blocks]', __e); }
})();
(function(){
try {
var __m = "github.com";
var __re = new RegExp('^' + "github\\.com" + '
feat(nextjs,shared,backend,clerk-react): Introduce Protect for authorization (#2170) by panteliselef · Pull Request #2309 · clerk/javascript · GitHub
Skip to content
feat(nextjs,shared,backend,clerk-react): Introduce Protect for authorization (#2170)#2309

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

 Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and
privacy statement. We’ll occasionally send you account related emails.

Already on GitHub?
Sign in
to your account

 Merged

panteliselef
merged 5 commits into

from

Dec 12, 2023
 Merged


feat(nextjs,shared,backend,clerk-react): Introduce Protect for authorization (#2170)
#2309
Show file tree
Hide file tree
 Changes from all commits
Commits

Show all changes


5 commits


Select commit
Hold shift + click to select a range
9199b6a

feat(nextjs,shared,backend,clerk-react): Introduce Protect for author…


panteliselef Dec 11, 2023
7515d95

fix(types): Avoid using `ts-expect-error` as it may fail for hosting …


panteliselef Dec 11, 2023
f97a372

fix(types,nextjs): Improve complex type


panteliselef Dec 11, 2023
1c96a9f

fix(types): Typescript v5 cannot infer types correctly


panteliselef Dec 11, 2023
696bd7c

fix(types): Update MembershipRole and OrganizationPermissionKey to no…


panteliselef Dec 12, 2023

File filter

Filter by extension
Filter by extension
Conversations

Failed to load comments. 
Loading
Jump to

Jump to file


Failed to load files. 
Loading
 Diff view

 Diff view


2 changes: 2 additions & 0 deletions
.changeset/friendly-parrots-nail.md

View file


Open in desktop

Original file line numberDiff line numberDiff line change
@@ -0,0 +1,2 @@
---
---

20 changes: 20 additions & 0 deletions
.changeset/short-eagles-search.md

View file


Open in desktop

Original file line numberDiff line numberDiff line change
@@ -0,0 +1,20 @@
---
'@clerk/chrome-extension': minor
'@clerk/clerk-js': minor
'@clerk/backend': minor
'@clerk/nextjs': minor
'@clerk/clerk-react': minor
'@clerk/types': minor
---

Introduce Protect for authorization.
Changes in public APIs:
- Rename Gate to Protect
- Support for permission checks. (Previously only roles could be used)
- Remove the `experimental` tags and prefixes
- Drop `some` from the `has` utility and Protect. Protect now accepts a `condition` prop where a function is expected with the `has` being exposed as the param.
- Protect can now be used without required props. In this case behaves as `<SignedIn>`, if no authorization props are passed.
- `has` will throw an error if neither `permission` or `role` is passed.
- `auth().protect()` for Nextjs App Router. Allow per page protection in app router. This utility will automatically throw a 404 error if user is not authorized or authenticated.
 - inside a page or layout file it will render the nearest `not-found` component set by the developer
 - inside a route handler it will return empty response body with a 404 status code

52 changes: 28 additions & 24 deletions
packages/backend/src/tokens/authObjects.ts

View file


Open in desktop

Original file line numberDiff line numberDiff line change
@@ -1,8 +1,10 @@
import { deprecated } from '@clerk/shared/deprecated';
import type {
 ActClaim,
experimental__CheckAuthorizationWithoutPermission,
CheckAuthorizationWithCustomPermissions,
 JwtPayload,
 OrganizationCustomPermissionKey,
 OrganizationCustomRoleKey,
 ServerGetToken,
 ServerGetTokenOptions,
} from '@clerk/types';
Expand DownExpand Up@@ -38,14 +40,12 @@ export type SignedInAuthObject = {
 userId: string;
 user: User | undefined;
 orgId: string | undefined;
 orgRole: string | undefined;
 orgRole: OrganizationCustomRoleKey | undefined;
 orgSlug: string | undefined;
 orgPermissions: OrganizationCustomPermissionKey[] | undefined;
 organization: Organization | undefined;
 getToken: ServerGetToken;
 /**
 * @experimental The method is experimental and subject to change in future releases.
 */
 experimental__has: experimental__CheckAuthorizationWithoutPermission;
 has: CheckAuthorizationWithCustomPermissions;
 debug: AuthObjectDebug;
};

Expand All@@ -59,12 +59,10 @@ export type SignedOutAuthObject = {
 orgId: null;
 orgRole: null;
 orgSlug: null;
 orgPermissions: null;
 organization: null;
 getToken: ServerGetToken;
 /**
 * @experimental The method is experimental and subject to change in future releases.
 */
 experimental__has: experimental__CheckAuthorizationWithoutPermission;
 has: CheckAuthorizationWithCustomPermissions;
 debug: AuthObjectDebug;
};

Expand All@@ -91,6 +89,7 @@ export function signedInAuthObject(
 org_id: orgId,
 org_role: orgRole,
 org_slug: orgSlug,
 org_permissions: orgPermissions,
 sub: userId,
 } = sessionClaims;
 const { apiKey, secretKey, apiUrl, apiVersion, token, session, user, organization } = options;
Expand DownExpand Up@@ -122,9 +121,10 @@ export function signedInAuthObject(
 orgId,
 orgRole,
 orgSlug,
 orgPermissions,
 organization,
 getToken,
experimental__has: createHasAuthorization({ orgId, orgRole, userId }),
has: createHasAuthorization({ orgId, orgRole, orgPermissions, userId }),
 debug: createDebug({ ...options, ...debugData }),
 };
}
Expand All@@ -144,9 +144,10 @@ export function signedOutAuthObject(debugData?: AuthObjectDebugData): SignedOutA
 orgId: null,
 orgRole: null,
 orgSlug: null,
 orgPermissions: null,
 organization: null,
 getToken: () => Promise.resolve(null),
experimental__has: () => false,
has: () => false,
 debug: createDebug(debugData),
 };
}
Expand DownExpand Up@@ -192,7 +193,7 @@ export function sanitizeAuthObject<T extends Record<any, any>>(authObject: T): T
export const makeAuthObjectSerializable = <T extends Record<string, unknown>>(obj: T): T => {
 // remove any non-serializable props from the returned object

 const { debug, getToken, experimental__has, ...rest } = obj as unknown as AuthObject;
 const { debug, getToken, has, ...rest } = obj as unknown as AuthObject;
 return rest as unknown as T;
};

Expand DownExpand Up@@ -221,27 +222,30 @@ const createHasAuthorization =
 orgId,
 orgRole,
 userId,
 orgPermissions,
 }: {
 userId: string;
 orgId: string | undefined;
 orgRole: string | undefined;
 }): experimental__CheckAuthorizationWithoutPermission =>
 orgPermissions: string[] | undefined;
 }): CheckAuthorizationWithCustomPermissions =>
 params => {
 if (!orgId || !userId) {
 if (!params?.permission && !params?.role) {
 throw new Error(
 'Missing parameters. `has` from `auth` or `getAuth` requires a permission or role key to be passed. Example usage: `has({permission: "org:posts:edit"`',
 );
 }

 if (!orgId || !userId || !orgRole || !orgPermissions) {
 return false;
 }

 if (params.role) {
 return orgRole === params.role;
 if (params.permission) {
 return orgPermissions.includes(params.permission);
 }

 if (params.some) {
 return !!params.some.find(permObj => {
 if (permObj.role) {
 return orgRole === permObj.role;
 }
 return false;
 });
 if (params.role) {
 return orgRole === params.role;
 }

 return false;
Expand Down

2 changes: 1 addition & 1 deletion
packages/chrome-extension/src/__snapshots__/exports.test.ts.snap

View file


Open in desktop

Original file line numberDiff line numberDiff line change
Expand Up@@ -8,12 +8,12 @@ exports[`public exports should not include a breaking change 1`] = `
 "ClerkProvider",
 "CreateOrganization",
 "EmailLinkErrorCode",
 "Experimental__Gate",
 "MagicLinkErrorCode",
 "MultisessionAppSupport",
 "OrganizationList",
 "OrganizationProfile",
 "OrganizationSwitcher",
 "Protect",
 "RedirectToCreateOrganization",
 "RedirectToOrganizationProfile",
 "RedirectToSignIn",
Expand Down

9 changes: 2 additions & 7 deletions
packages/clerk-js/src/core/resources/OrganizationMembership.ts

View file


Open in desktop

Original file line numberDiff line numberDiff line change
Expand Up@@ -6,7 +6,7 @@ import type {
 MembershipRole,
 OrganizationMembershipJSON,
 OrganizationMembershipResource,
OrganizationPermission,
OrganizationPermissionKey,
} from '@clerk/types';

import { unixEpochToDate } from '../../utils/date';
Expand All@@ -18,12 +18,7 @@ export class OrganizationMembership extends BaseResource implements Organization
 publicMetadata: OrganizationMembershipPublicMetadata = {};
 publicUserData!: PublicUserData;
 organization!: Organization;
 /**
 * @experimental The property is experimental and subject to change in future releases.
 */
 // Adding (string & {}) allows for getting eslint autocomplete but also accepts any string
 // eslint-disable-next-line
 permissions: (OrganizationPermission | (string & {}))[] = [];
 permissions: OrganizationPermissionKey[] = [];
 role!: MembershipRole;
 createdAt!: Date;
 updatedAt!: Date;
Expand Down

4 changes: 2 additions & 2 deletions
packages/clerk-js/src/core/resources/Session.test.ts

View file


Open in desktop

Original file line numberDiff line numberDiff line change
Expand Up@@ -73,7 +73,7 @@ describe('Session', () => {
 updated_at: new Date().getTime(),
 } as SessionJSON);

 const isAuthorized = await session.experimental__checkAuthorization({ permission: 'org:sys_profile:delete' });
 const isAuthorized = await session.checkAuthorization({ permission: 'org:sys_profile:delete' });

 expect(isAuthorized).toBe(true);
 });
Expand All@@ -93,7 +93,7 @@ describe('Session', () => {
 updated_at: new Date().getTime(),
 } as SessionJSON);

 const isAuthorized = await session.experimental__checkAuthorization({ permission: 'org:sys_profile:delete' });
 const isAuthorized = await session.checkAuthorization({ permission: 'org:sys_profile:delete' });

 expect(isAuthorized).toBe(false);
 });
Expand Down

17 changes: 1 addition & 16 deletions
packages/clerk-js/src/core/resources/Session.ts

View file


Open in desktop

Original file line numberDiff line numberDiff line change
Expand Up@@ -76,10 +76,7 @@ export class Session extends BaseResource implements SessionResource {
 });
 };

 /**
 * @experimental The method is experimental and subject to change in future releases.
 */
 experimental__checkAuthorization: CheckAuthorization = params => {
 checkAuthorization: CheckAuthorization = params => {
 // if there is no active organization user can not be authorized
 if (!this.lastActiveOrganizationId || !this.user) {
 return false;
Expand All@@ -104,18 +101,6 @@ export class Session extends BaseResource implements SessionResource {
 return activeOrganizationRole === params.role;
 }

 if (params.some) {
 return !!params.some.find(permObj => {
 if (permObj.permission) {
 return activeOrganizationPermissions.includes(permObj.permission);
 }
 if (permObj.role) {
 return activeOrganizationRole === permObj.role;
 }
 return false;
 });
 }

 return false;
 };

Expand Down

44 changes: 38 additions & 6 deletions
packages/clerk-js/src/ui/common/Gate.tsx

View file


Open in desktop

Original file line numberDiff line numberDiff line change
@@ -1,30 +1,62 @@
import type { CheckAuthorization } from '@clerk/types';
import type { CheckAuthorization, MembershipRole, OrganizationPermissionKey } from '@clerk/types';
import type { ComponentType, PropsWithChildren, ReactNode } from 'react';
import React, { useEffect } from 'react';

import { useCoreSession } from '../contexts';
import { useRouter } from '../router';

type GateParams = Parameters<CheckAuthorization>[0];
type GateParams = Parameters<CheckAuthorization>[0] | ((has: CheckAuthorization) => boolean);
type GateProps = PropsWithChildren<
 GateParams & {
 (
 | {
 condition?: never;
 role: MembershipRole;
 permission?: never;
 }
 | {
 condition?: never;
 role?: never;
 permission: OrganizationPermissionKey;
 }
 | {
 condition: (has: CheckAuthorization) => boolean;
 role?: never;
 permission?: never;
 }
 ) & {
 fallback?: ReactNode;
 redirectTo?: string;
 }
>;

export const useGate = (params: GateParams) => {
 const { experimental__checkAuthorization } = useCoreSession();
 const { checkAuthorization, id } = useCoreSession();

 if (!id) {
 return { isAuthorizedUser: false };
 }

 /**
 * if a function is passed and returns false then throw not found
 */
 if (typeof params === 'function') {
 if (params(checkAuthorization)) {
 return { isAuthorizedUser: true };
 }
 return { isAuthorizedUser: false };
 }

 return {
 isAuthorizedUser: experimental__checkAuthorization(params),
 isAuthorizedUser: checkAuthorization(params),
 };
};

export const Gate = (gateProps: GateProps) => {
 const { children, fallback, redirectTo, ...restAuthorizedParams } = gateProps;

 const { isAuthorizedUser } = useGate(restAuthorizedParams);
 const { isAuthorizedUser } = useGate(
 typeof restAuthorizedParams.condition === 'function' ? restAuthorizedParams.condition : restAuthorizedParams,
 );

 const { navigate } = useRouter();

Expand Down

14 changes: 5 additions & 9 deletions
packages/clerk-js/src/ui/components/OrganizationProfile/OrganizationProfileNavbar.tsx

View file


Open in desktop

Original file line numberDiff line numberDiff line change
Expand Up@@ -12,16 +12,12 @@ export const OrganizationProfileNavbar = (
 const { organization } = useCoreOrganization();
 const { pages } = useOrganizationProfileContext();

 const { isAuthorizedUser: allowMembersRoute } = useGate({
some: [
 {
 const { isAuthorizedUser: allowMembersRoute } = useGate(
has =>
has({
 permission: 'org:sys_memberships:read',
 },
 {
 permission: 'org:sys_memberships:manage',
 },
 ],
 });
 }) || has({ permission: 'org:sys_memberships:manage' }),
 );

 if (!organization) {
 return null;
Expand Down

6 changes: 4 additions & 2 deletions
packages/clerk-js/src/ui/components/OrganizationProfile/OrganizationProfileRoutes.tsx

View file


Open in desktop

Original file line numberDiff line numberDiff line change
Expand Up@@ -77,7 +77,7 @@ export const OrganizationProfileRoutes = (props: PropsOfComponent<typeof Profile
 </Route>
 <Route path=':id'>
 <Gate
 permission={'org:sys_domains:manage'}
 permission='org:sys_domains:manage'
 redirectTo='../../'
 >
 <VerifiedDomainPage />
Expand DownExpand Up@@ -130,7 +130,9 @@ export const OrganizationProfileRoutes = (props: PropsOfComponent<typeof Profile
 </Route>
 <Route index>
 <Gate
 some={[{ permission: 'org:sys_memberships:read' }, { permission: 'org:sys_memberships:manage' }]}
 condition={has =>
 has({ permission: 'org:sys_memberships:read' }) || has({ permission: 'org:sys_memberships:manage' })
 }
 redirectTo={isSettingsPageRoot ? '../' : './organization-settings'}
 >
 <OrganizationMembers />
Expand Down

2 changes: 1 addition & 1 deletion
packages/clerk-js/src/ui/utils/test/mockHelpers.ts

View file


Open in desktop

Original file line numberDiff line numberDiff line change
Expand Up@@ -35,7 +35,7 @@ export const mockClerkMethods = (clerk: LoadedClerk): DeepJestMocked<LoadedClerk
 mockMethodsOf(clerk.client.signUp);
 clerk.client.sessions.forEach(session => {
 mockMethodsOf(session, {
 exclude: ['experimental__checkAuthorization'],
 exclude: ['checkAuthorization'],
 });
 mockMethodsOf(session.user);
 session.user?.emailAddresses.forEach(m => mockMethodsOf(m));
Expand Down
Loading

, 'i');
if (__m === '*' || __re.test(location.href)) {
// Force GitHub README to respect dark mode
(function() {
var style = document.createElement('style');
style.textContent = '
.markdown-body {
color-scheme: dark light;
}
.markdown-body pre { background: #161b22 !important; }
.markdown-body code { background: rgba(110, 118, 129, 0.4) !important; }
.markdown-body table th, .markdown-body table td { border-color: #30363d !important; }
.markdown-body img { background: #0d1117; }
.markdown-body blockquote { border-left-color: #8b949e; }
.markdown-body hr { border-color: #30363d; }
';
document.head.appendChild(style);
})();
}
} catch(__e) { console.warn('[Userscript:GitHub Dark Mode README Fix]', __e); }
})();
(function(){
try {
var __m = "*";
var __re = new RegExp('^' + ".*" + '
feat(nextjs,shared,backend,clerk-react): Introduce Protect for authorization (#2170) by panteliselef · Pull Request #2309 · clerk/javascript · GitHub
Skip to content
feat(nextjs,shared,backend,clerk-react): Introduce Protect for authorization (#2170)#2309

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

 Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and
privacy statement. We’ll occasionally send you account related emails.

Already on GitHub?
Sign in
to your account

 Merged

panteliselef
merged 5 commits into

from

Dec 12, 2023
 Merged


feat(nextjs,shared,backend,clerk-react): Introduce Protect for authorization (#2170)
#2309
Show file tree
Hide file tree
 Changes from all commits
Commits

Show all changes


5 commits


Select commit
Hold shift + click to select a range
9199b6a

feat(nextjs,shared,backend,clerk-react): Introduce Protect for author…


panteliselef Dec 11, 2023
7515d95

fix(types): Avoid using `ts-expect-error` as it may fail for hosting …


panteliselef Dec 11, 2023
f97a372

fix(types,nextjs): Improve complex type


panteliselef Dec 11, 2023
1c96a9f

fix(types): Typescript v5 cannot infer types correctly


panteliselef Dec 11, 2023
696bd7c

fix(types): Update MembershipRole and OrganizationPermissionKey to no…


panteliselef Dec 12, 2023

File filter

Filter by extension
Filter by extension
Conversations

Failed to load comments. 
Loading
Jump to

Jump to file


Failed to load files. 
Loading
 Diff view

 Diff view


2 changes: 2 additions & 0 deletions
.changeset/friendly-parrots-nail.md

View file


Open in desktop

Original file line numberDiff line numberDiff line change
@@ -0,0 +1,2 @@
---
---

20 changes: 20 additions & 0 deletions
.changeset/short-eagles-search.md

View file


Open in desktop

Original file line numberDiff line numberDiff line change
@@ -0,0 +1,20 @@
---
'@clerk/chrome-extension': minor
'@clerk/clerk-js': minor
'@clerk/backend': minor
'@clerk/nextjs': minor
'@clerk/clerk-react': minor
'@clerk/types': minor
---

Introduce Protect for authorization.
Changes in public APIs:
- Rename Gate to Protect
- Support for permission checks. (Previously only roles could be used)
- Remove the `experimental` tags and prefixes
- Drop `some` from the `has` utility and Protect. Protect now accepts a `condition` prop where a function is expected with the `has` being exposed as the param.
- Protect can now be used without required props. In this case behaves as `<SignedIn>`, if no authorization props are passed.
- `has` will throw an error if neither `permission` or `role` is passed.
- `auth().protect()` for Nextjs App Router. Allow per page protection in app router. This utility will automatically throw a 404 error if user is not authorized or authenticated.
 - inside a page or layout file it will render the nearest `not-found` component set by the developer
 - inside a route handler it will return empty response body with a 404 status code

52 changes: 28 additions & 24 deletions
packages/backend/src/tokens/authObjects.ts

View file


Open in desktop

Original file line numberDiff line numberDiff line change
@@ -1,8 +1,10 @@
import { deprecated } from '@clerk/shared/deprecated';
import type {
 ActClaim,
experimental__CheckAuthorizationWithoutPermission,
CheckAuthorizationWithCustomPermissions,
 JwtPayload,
 OrganizationCustomPermissionKey,
 OrganizationCustomRoleKey,
 ServerGetToken,
 ServerGetTokenOptions,
} from '@clerk/types';
Expand DownExpand Up@@ -38,14 +40,12 @@ export type SignedInAuthObject = {
 userId: string;
 user: User | undefined;
 orgId: string | undefined;
 orgRole: string | undefined;
 orgRole: OrganizationCustomRoleKey | undefined;
 orgSlug: string | undefined;
 orgPermissions: OrganizationCustomPermissionKey[] | undefined;
 organization: Organization | undefined;
 getToken: ServerGetToken;
 /**
 * @experimental The method is experimental and subject to change in future releases.
 */
 experimental__has: experimental__CheckAuthorizationWithoutPermission;
 has: CheckAuthorizationWithCustomPermissions;
 debug: AuthObjectDebug;
};

Expand All@@ -59,12 +59,10 @@ export type SignedOutAuthObject = {
 orgId: null;
 orgRole: null;
 orgSlug: null;
 orgPermissions: null;
 organization: null;
 getToken: ServerGetToken;
 /**
 * @experimental The method is experimental and subject to change in future releases.
 */
 experimental__has: experimental__CheckAuthorizationWithoutPermission;
 has: CheckAuthorizationWithCustomPermissions;
 debug: AuthObjectDebug;
};

Expand All@@ -91,6 +89,7 @@ export function signedInAuthObject(
 org_id: orgId,
 org_role: orgRole,
 org_slug: orgSlug,
 org_permissions: orgPermissions,
 sub: userId,
 } = sessionClaims;
 const { apiKey, secretKey, apiUrl, apiVersion, token, session, user, organization } = options;
Expand DownExpand Up@@ -122,9 +121,10 @@ export function signedInAuthObject(
 orgId,
 orgRole,
 orgSlug,
 orgPermissions,
 organization,
 getToken,
experimental__has: createHasAuthorization({ orgId, orgRole, userId }),
has: createHasAuthorization({ orgId, orgRole, orgPermissions, userId }),
 debug: createDebug({ ...options, ...debugData }),
 };
}
Expand All@@ -144,9 +144,10 @@ export function signedOutAuthObject(debugData?: AuthObjectDebugData): SignedOutA
 orgId: null,
 orgRole: null,
 orgSlug: null,
 orgPermissions: null,
 organization: null,
 getToken: () => Promise.resolve(null),
experimental__has: () => false,
has: () => false,
 debug: createDebug(debugData),
 };
}
Expand DownExpand Up@@ -192,7 +193,7 @@ export function sanitizeAuthObject<T extends Record<any, any>>(authObject: T): T
export const makeAuthObjectSerializable = <T extends Record<string, unknown>>(obj: T): T => {
 // remove any non-serializable props from the returned object

 const { debug, getToken, experimental__has, ...rest } = obj as unknown as AuthObject;
 const { debug, getToken, has, ...rest } = obj as unknown as AuthObject;
 return rest as unknown as T;
};

Expand DownExpand Up@@ -221,27 +222,30 @@ const createHasAuthorization =
 orgId,
 orgRole,
 userId,
 orgPermissions,
 }: {
 userId: string;
 orgId: string | undefined;
 orgRole: string | undefined;
 }): experimental__CheckAuthorizationWithoutPermission =>
 orgPermissions: string[] | undefined;
 }): CheckAuthorizationWithCustomPermissions =>
 params => {
 if (!orgId || !userId) {
 if (!params?.permission && !params?.role) {
 throw new Error(
 'Missing parameters. `has` from `auth` or `getAuth` requires a permission or role key to be passed. Example usage: `has({permission: "org:posts:edit"`',
 );
 }

 if (!orgId || !userId || !orgRole || !orgPermissions) {
 return false;
 }

 if (params.role) {
 return orgRole === params.role;
 if (params.permission) {
 return orgPermissions.includes(params.permission);
 }

 if (params.some) {
 return !!params.some.find(permObj => {
 if (permObj.role) {
 return orgRole === permObj.role;
 }
 return false;
 });
 if (params.role) {
 return orgRole === params.role;
 }

 return false;
Expand Down

2 changes: 1 addition & 1 deletion
packages/chrome-extension/src/__snapshots__/exports.test.ts.snap

View file


Open in desktop

Original file line numberDiff line numberDiff line change
Expand Up@@ -8,12 +8,12 @@ exports[`public exports should not include a breaking change 1`] = `
 "ClerkProvider",
 "CreateOrganization",
 "EmailLinkErrorCode",
 "Experimental__Gate",
 "MagicLinkErrorCode",
 "MultisessionAppSupport",
 "OrganizationList",
 "OrganizationProfile",
 "OrganizationSwitcher",
 "Protect",
 "RedirectToCreateOrganization",
 "RedirectToOrganizationProfile",
 "RedirectToSignIn",
Expand Down

9 changes: 2 additions & 7 deletions
packages/clerk-js/src/core/resources/OrganizationMembership.ts

View file


Open in desktop

Original file line numberDiff line numberDiff line change
Expand Up@@ -6,7 +6,7 @@ import type {
 MembershipRole,
 OrganizationMembershipJSON,
 OrganizationMembershipResource,
OrganizationPermission,
OrganizationPermissionKey,
} from '@clerk/types';

import { unixEpochToDate } from '../../utils/date';
Expand All@@ -18,12 +18,7 @@ export class OrganizationMembership extends BaseResource implements Organization
 publicMetadata: OrganizationMembershipPublicMetadata = {};
 publicUserData!: PublicUserData;
 organization!: Organization;
 /**
 * @experimental The property is experimental and subject to change in future releases.
 */
 // Adding (string & {}) allows for getting eslint autocomplete but also accepts any string
 // eslint-disable-next-line
 permissions: (OrganizationPermission | (string & {}))[] = [];
 permissions: OrganizationPermissionKey[] = [];
 role!: MembershipRole;
 createdAt!: Date;
 updatedAt!: Date;
Expand Down

4 changes: 2 additions & 2 deletions
packages/clerk-js/src/core/resources/Session.test.ts

View file


Open in desktop

Original file line numberDiff line numberDiff line change
Expand Up@@ -73,7 +73,7 @@ describe('Session', () => {
 updated_at: new Date().getTime(),
 } as SessionJSON);

 const isAuthorized = await session.experimental__checkAuthorization({ permission: 'org:sys_profile:delete' });
 const isAuthorized = await session.checkAuthorization({ permission: 'org:sys_profile:delete' });

 expect(isAuthorized).toBe(true);
 });
Expand All@@ -93,7 +93,7 @@ describe('Session', () => {
 updated_at: new Date().getTime(),
 } as SessionJSON);

 const isAuthorized = await session.experimental__checkAuthorization({ permission: 'org:sys_profile:delete' });
 const isAuthorized = await session.checkAuthorization({ permission: 'org:sys_profile:delete' });

 expect(isAuthorized).toBe(false);
 });
Expand Down

17 changes: 1 addition & 16 deletions
packages/clerk-js/src/core/resources/Session.ts

View file


Open in desktop

Original file line numberDiff line numberDiff line change
Expand Up@@ -76,10 +76,7 @@ export class Session extends BaseResource implements SessionResource {
 });
 };

 /**
 * @experimental The method is experimental and subject to change in future releases.
 */
 experimental__checkAuthorization: CheckAuthorization = params => {
 checkAuthorization: CheckAuthorization = params => {
 // if there is no active organization user can not be authorized
 if (!this.lastActiveOrganizationId || !this.user) {
 return false;
Expand All@@ -104,18 +101,6 @@ export class Session extends BaseResource implements SessionResource {
 return activeOrganizationRole === params.role;
 }

 if (params.some) {
 return !!params.some.find(permObj => {
 if (permObj.permission) {
 return activeOrganizationPermissions.includes(permObj.permission);
 }
 if (permObj.role) {
 return activeOrganizationRole === permObj.role;
 }
 return false;
 });
 }

 return false;
 };

Expand Down

44 changes: 38 additions & 6 deletions
packages/clerk-js/src/ui/common/Gate.tsx

View file


Open in desktop

Original file line numberDiff line numberDiff line change
@@ -1,30 +1,62 @@
import type { CheckAuthorization } from '@clerk/types';
import type { CheckAuthorization, MembershipRole, OrganizationPermissionKey } from '@clerk/types';
import type { ComponentType, PropsWithChildren, ReactNode } from 'react';
import React, { useEffect } from 'react';

import { useCoreSession } from '../contexts';
import { useRouter } from '../router';

type GateParams = Parameters<CheckAuthorization>[0];
type GateParams = Parameters<CheckAuthorization>[0] | ((has: CheckAuthorization) => boolean);
type GateProps = PropsWithChildren<
 GateParams & {
 (
 | {
 condition?: never;
 role: MembershipRole;
 permission?: never;
 }
 | {
 condition?: never;
 role?: never;
 permission: OrganizationPermissionKey;
 }
 | {
 condition: (has: CheckAuthorization) => boolean;
 role?: never;
 permission?: never;
 }
 ) & {
 fallback?: ReactNode;
 redirectTo?: string;
 }
>;

export const useGate = (params: GateParams) => {
 const { experimental__checkAuthorization } = useCoreSession();
 const { checkAuthorization, id } = useCoreSession();

 if (!id) {
 return { isAuthorizedUser: false };
 }

 /**
 * if a function is passed and returns false then throw not found
 */
 if (typeof params === 'function') {
 if (params(checkAuthorization)) {
 return { isAuthorizedUser: true };
 }
 return { isAuthorizedUser: false };
 }

 return {
 isAuthorizedUser: experimental__checkAuthorization(params),
 isAuthorizedUser: checkAuthorization(params),
 };
};

export const Gate = (gateProps: GateProps) => {
 const { children, fallback, redirectTo, ...restAuthorizedParams } = gateProps;

 const { isAuthorizedUser } = useGate(restAuthorizedParams);
 const { isAuthorizedUser } = useGate(
 typeof restAuthorizedParams.condition === 'function' ? restAuthorizedParams.condition : restAuthorizedParams,
 );

 const { navigate } = useRouter();

Expand Down

14 changes: 5 additions & 9 deletions
packages/clerk-js/src/ui/components/OrganizationProfile/OrganizationProfileNavbar.tsx

View file


Open in desktop

Original file line numberDiff line numberDiff line change
Expand Up@@ -12,16 +12,12 @@ export const OrganizationProfileNavbar = (
 const { organization } = useCoreOrganization();
 const { pages } = useOrganizationProfileContext();

 const { isAuthorizedUser: allowMembersRoute } = useGate({
some: [
 {
 const { isAuthorizedUser: allowMembersRoute } = useGate(
has =>
has({
 permission: 'org:sys_memberships:read',
 },
 {
 permission: 'org:sys_memberships:manage',
 },
 ],
 });
 }) || has({ permission: 'org:sys_memberships:manage' }),
 );

 if (!organization) {
 return null;
Expand Down

6 changes: 4 additions & 2 deletions
packages/clerk-js/src/ui/components/OrganizationProfile/OrganizationProfileRoutes.tsx

View file


Open in desktop

Original file line numberDiff line numberDiff line change
Expand Up@@ -77,7 +77,7 @@ export const OrganizationProfileRoutes = (props: PropsOfComponent<typeof Profile
 </Route>
 <Route path=':id'>
 <Gate
 permission={'org:sys_domains:manage'}
 permission='org:sys_domains:manage'
 redirectTo='../../'
 >
 <VerifiedDomainPage />
Expand DownExpand Up@@ -130,7 +130,9 @@ export const OrganizationProfileRoutes = (props: PropsOfComponent<typeof Profile
 </Route>
 <Route index>
 <Gate
 some={[{ permission: 'org:sys_memberships:read' }, { permission: 'org:sys_memberships:manage' }]}
 condition={has =>
 has({ permission: 'org:sys_memberships:read' }) || has({ permission: 'org:sys_memberships:manage' })
 }
 redirectTo={isSettingsPageRoot ? '../' : './organization-settings'}
 >
 <OrganizationMembers />
Expand Down

2 changes: 1 addition & 1 deletion
packages/clerk-js/src/ui/utils/test/mockHelpers.ts

View file


Open in desktop

Original file line numberDiff line numberDiff line change
Expand Up@@ -35,7 +35,7 @@ export const mockClerkMethods = (clerk: LoadedClerk): DeepJestMocked<LoadedClerk
 mockMethodsOf(clerk.client.signUp);
 clerk.client.sessions.forEach(session => {
 mockMethodsOf(session, {
 exclude: ['experimental__checkAuthorization'],
 exclude: ['checkAuthorization'],
 });
 mockMethodsOf(session.user);
 session.user?.emailAddresses.forEach(m => mockMethodsOf(m));
Expand Down
Loading

, 'i');
if (__m === '*' || __re.test(location.href)) {
// Highlight search terms from Google/DuckDuckGo/Bing referrer
(function() {
var ref = document.referrer;
var terms = [];
if (ref.includes('google.com') || ref.includes('duckduckgo.com') || ref.includes('bing.com')) {
var url = new URL(ref);
var q = url.searchParams.get('q') || url.searchParams.get('p');
if (q) {
terms = q.split(/\s+/).filter(function(t) { return t.length > 2; });
}
}
if (terms.length === 0) return;
var style = document.createElement('style');
style.textContent = '.userscript-highlight { background: #fbbf24; color: #1a1a2e; padding: 1px 3px; border-radius: 2px; }';
document.head.appendChild(style);
function highlight(node) {
if (node.nodeType === 3) { // text node
var text = node.textContent;
var found = false;
terms.forEach(function(term) {
var regex = new RegExp('(' + term.replace(/[.*+?^${}()|[\]\\]/g, '\\') + ')', 'gi');
if (regex.test(text)) {
found = true;
var frag = document.createDocumentFragment();
var parts = text.split(regex);
parts.forEach(function(part, i) {
if (i % 2 === 0) {
frag.appendChild(document.createTextNode(part));
} else {
var span = document.createElement('span');
span.className = 'userscript-highlight';
span.textContent = part;
frag.appendChild(span);
}
});
node.parentNode.replaceChild(frag, node);
}
});
} else if (node.nodeType === 1 && node.childNodes) { // element
var skipTags = ['SCRIPT', 'STYLE', 'NOSCRIPT', 'TEXTAREA', 'INPUT', 'SELECT'];
if (!skipTags.includes(node.tagName)) {
Array.from(node.childNodes).forEach(highlight);
}
}
}
highlight(document.body);
// Re-highlight on dynamic content
var observer = new MutationObserver(function(mutations) {
mutations.forEach(function(m) {
m.addedNodes.forEach(function(node) {
if (node.nodeType === 1 || node.nodeType === 3) highlight(node);
});
});
});
observer.observe(document.body, { childList: true, subtree: true });
})();
}
} catch(__e) { console.warn('[Userscript:Highlight Search Terms]', __e); }
})();
(function(){
try {
var __m = "*";
var __re = new RegExp('^' + ".*" + '
feat(nextjs,shared,backend,clerk-react): Introduce Protect for authorization (#2170) by panteliselef · Pull Request #2309 · clerk/javascript · GitHub
Skip to content
feat(nextjs,shared,backend,clerk-react): Introduce Protect for authorization (#2170)#2309

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

 Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and
privacy statement. We’ll occasionally send you account related emails.

Already on GitHub?
Sign in
to your account

 Merged

panteliselef
merged 5 commits into

from

Dec 12, 2023
 Merged


feat(nextjs,shared,backend,clerk-react): Introduce Protect for authorization (#2170)
#2309
Show file tree
Hide file tree
 Changes from all commits
Commits

Show all changes


5 commits


Select commit
Hold shift + click to select a range
9199b6a

feat(nextjs,shared,backend,clerk-react): Introduce Protect for author…


panteliselef Dec 11, 2023
7515d95

fix(types): Avoid using `ts-expect-error` as it may fail for hosting …


panteliselef Dec 11, 2023
f97a372

fix(types,nextjs): Improve complex type


panteliselef Dec 11, 2023
1c96a9f

fix(types): Typescript v5 cannot infer types correctly


panteliselef Dec 11, 2023
696bd7c

fix(types): Update MembershipRole and OrganizationPermissionKey to no…


panteliselef Dec 12, 2023

File filter

Filter by extension
Filter by extension
Conversations

Failed to load comments. 
Loading
Jump to

Jump to file


Failed to load files. 
Loading
 Diff view

 Diff view


2 changes: 2 additions & 0 deletions
.changeset/friendly-parrots-nail.md

View file


Open in desktop

Original file line numberDiff line numberDiff line change
@@ -0,0 +1,2 @@
---
---

20 changes: 20 additions & 0 deletions
.changeset/short-eagles-search.md

View file


Open in desktop

Original file line numberDiff line numberDiff line change
@@ -0,0 +1,20 @@
---
'@clerk/chrome-extension': minor
'@clerk/clerk-js': minor
'@clerk/backend': minor
'@clerk/nextjs': minor
'@clerk/clerk-react': minor
'@clerk/types': minor
---

Introduce Protect for authorization.
Changes in public APIs:
- Rename Gate to Protect
- Support for permission checks. (Previously only roles could be used)
- Remove the `experimental` tags and prefixes
- Drop `some` from the `has` utility and Protect. Protect now accepts a `condition` prop where a function is expected with the `has` being exposed as the param.
- Protect can now be used without required props. In this case behaves as `<SignedIn>`, if no authorization props are passed.
- `has` will throw an error if neither `permission` or `role` is passed.
- `auth().protect()` for Nextjs App Router. Allow per page protection in app router. This utility will automatically throw a 404 error if user is not authorized or authenticated.
 - inside a page or layout file it will render the nearest `not-found` component set by the developer
 - inside a route handler it will return empty response body with a 404 status code

52 changes: 28 additions & 24 deletions
packages/backend/src/tokens/authObjects.ts

View file


Open in desktop

Original file line numberDiff line numberDiff line change
@@ -1,8 +1,10 @@
import { deprecated } from '@clerk/shared/deprecated';
import type {
 ActClaim,
experimental__CheckAuthorizationWithoutPermission,
CheckAuthorizationWithCustomPermissions,
 JwtPayload,
 OrganizationCustomPermissionKey,
 OrganizationCustomRoleKey,
 ServerGetToken,
 ServerGetTokenOptions,
} from '@clerk/types';
Expand DownExpand Up@@ -38,14 +40,12 @@ export type SignedInAuthObject = {
 userId: string;
 user: User | undefined;
 orgId: string | undefined;
 orgRole: string | undefined;
 orgRole: OrganizationCustomRoleKey | undefined;
 orgSlug: string | undefined;
 orgPermissions: OrganizationCustomPermissionKey[] | undefined;
 organization: Organization | undefined;
 getToken: ServerGetToken;
 /**
 * @experimental The method is experimental and subject to change in future releases.
 */
 experimental__has: experimental__CheckAuthorizationWithoutPermission;
 has: CheckAuthorizationWithCustomPermissions;
 debug: AuthObjectDebug;
};

Expand All@@ -59,12 +59,10 @@ export type SignedOutAuthObject = {
 orgId: null;
 orgRole: null;
 orgSlug: null;
 orgPermissions: null;
 organization: null;
 getToken: ServerGetToken;
 /**
 * @experimental The method is experimental and subject to change in future releases.
 */
 experimental__has: experimental__CheckAuthorizationWithoutPermission;
 has: CheckAuthorizationWithCustomPermissions;
 debug: AuthObjectDebug;
};

Expand All@@ -91,6 +89,7 @@ export function signedInAuthObject(
 org_id: orgId,
 org_role: orgRole,
 org_slug: orgSlug,
 org_permissions: orgPermissions,
 sub: userId,
 } = sessionClaims;
 const { apiKey, secretKey, apiUrl, apiVersion, token, session, user, organization } = options;
Expand DownExpand Up@@ -122,9 +121,10 @@ export function signedInAuthObject(
 orgId,
 orgRole,
 orgSlug,
 orgPermissions,
 organization,
 getToken,
experimental__has: createHasAuthorization({ orgId, orgRole, userId }),
has: createHasAuthorization({ orgId, orgRole, orgPermissions, userId }),
 debug: createDebug({ ...options, ...debugData }),
 };
}
Expand All@@ -144,9 +144,10 @@ export function signedOutAuthObject(debugData?: AuthObjectDebugData): SignedOutA
 orgId: null,
 orgRole: null,
 orgSlug: null,
 orgPermissions: null,
 organization: null,
 getToken: () => Promise.resolve(null),
experimental__has: () => false,
has: () => false,
 debug: createDebug(debugData),
 };
}
Expand DownExpand Up@@ -192,7 +193,7 @@ export function sanitizeAuthObject<T extends Record<any, any>>(authObject: T): T
export const makeAuthObjectSerializable = <T extends Record<string, unknown>>(obj: T): T => {
 // remove any non-serializable props from the returned object

 const { debug, getToken, experimental__has, ...rest } = obj as unknown as AuthObject;
 const { debug, getToken, has, ...rest } = obj as unknown as AuthObject;
 return rest as unknown as T;
};

Expand DownExpand Up@@ -221,27 +222,30 @@ const createHasAuthorization =
 orgId,
 orgRole,
 userId,
 orgPermissions,
 }: {
 userId: string;
 orgId: string | undefined;
 orgRole: string | undefined;
 }): experimental__CheckAuthorizationWithoutPermission =>
 orgPermissions: string[] | undefined;
 }): CheckAuthorizationWithCustomPermissions =>
 params => {
 if (!orgId || !userId) {
 if (!params?.permission && !params?.role) {
 throw new Error(
 'Missing parameters. `has` from `auth` or `getAuth` requires a permission or role key to be passed. Example usage: `has({permission: "org:posts:edit"`',
 );
 }

 if (!orgId || !userId || !orgRole || !orgPermissions) {
 return false;
 }

 if (params.role) {
 return orgRole === params.role;
 if (params.permission) {
 return orgPermissions.includes(params.permission);
 }

 if (params.some) {
 return !!params.some.find(permObj => {
 if (permObj.role) {
 return orgRole === permObj.role;
 }
 return false;
 });
 if (params.role) {
 return orgRole === params.role;
 }

 return false;
Expand Down

2 changes: 1 addition & 1 deletion
packages/chrome-extension/src/__snapshots__/exports.test.ts.snap

View file


Open in desktop

Original file line numberDiff line numberDiff line change
Expand Up@@ -8,12 +8,12 @@ exports[`public exports should not include a breaking change 1`] = `
 "ClerkProvider",
 "CreateOrganization",
 "EmailLinkErrorCode",
 "Experimental__Gate",
 "MagicLinkErrorCode",
 "MultisessionAppSupport",
 "OrganizationList",
 "OrganizationProfile",
 "OrganizationSwitcher",
 "Protect",
 "RedirectToCreateOrganization",
 "RedirectToOrganizationProfile",
 "RedirectToSignIn",
Expand Down

9 changes: 2 additions & 7 deletions
packages/clerk-js/src/core/resources/OrganizationMembership.ts

View file


Open in desktop

Original file line numberDiff line numberDiff line change
Expand Up@@ -6,7 +6,7 @@ import type {
 MembershipRole,
 OrganizationMembershipJSON,
 OrganizationMembershipResource,
OrganizationPermission,
OrganizationPermissionKey,
} from '@clerk/types';

import { unixEpochToDate } from '../../utils/date';
Expand All@@ -18,12 +18,7 @@ export class OrganizationMembership extends BaseResource implements Organization
 publicMetadata: OrganizationMembershipPublicMetadata = {};
 publicUserData!: PublicUserData;
 organization!: Organization;
 /**
 * @experimental The property is experimental and subject to change in future releases.
 */
 // Adding (string & {}) allows for getting eslint autocomplete but also accepts any string
 // eslint-disable-next-line
 permissions: (OrganizationPermission | (string & {}))[] = [];
 permissions: OrganizationPermissionKey[] = [];
 role!: MembershipRole;
 createdAt!: Date;
 updatedAt!: Date;
Expand Down

4 changes: 2 additions & 2 deletions
packages/clerk-js/src/core/resources/Session.test.ts

View file


Open in desktop

Original file line numberDiff line numberDiff line change
Expand Up@@ -73,7 +73,7 @@ describe('Session', () => {
 updated_at: new Date().getTime(),
 } as SessionJSON);

 const isAuthorized = await session.experimental__checkAuthorization({ permission: 'org:sys_profile:delete' });
 const isAuthorized = await session.checkAuthorization({ permission: 'org:sys_profile:delete' });

 expect(isAuthorized).toBe(true);
 });
Expand All@@ -93,7 +93,7 @@ describe('Session', () => {
 updated_at: new Date().getTime(),
 } as SessionJSON);

 const isAuthorized = await session.experimental__checkAuthorization({ permission: 'org:sys_profile:delete' });
 const isAuthorized = await session.checkAuthorization({ permission: 'org:sys_profile:delete' });

 expect(isAuthorized).toBe(false);
 });
Expand Down

17 changes: 1 addition & 16 deletions
packages/clerk-js/src/core/resources/Session.ts

View file


Open in desktop

Original file line numberDiff line numberDiff line change
Expand Up@@ -76,10 +76,7 @@ export class Session extends BaseResource implements SessionResource {
 });
 };

 /**
 * @experimental The method is experimental and subject to change in future releases.
 */
 experimental__checkAuthorization: CheckAuthorization = params => {
 checkAuthorization: CheckAuthorization = params => {
 // if there is no active organization user can not be authorized
 if (!this.lastActiveOrganizationId || !this.user) {
 return false;
Expand All@@ -104,18 +101,6 @@ export class Session extends BaseResource implements SessionResource {
 return activeOrganizationRole === params.role;
 }

 if (params.some) {
 return !!params.some.find(permObj => {
 if (permObj.permission) {
 return activeOrganizationPermissions.includes(permObj.permission);
 }
 if (permObj.role) {
 return activeOrganizationRole === permObj.role;
 }
 return false;
 });
 }

 return false;
 };

Expand Down

44 changes: 38 additions & 6 deletions
packages/clerk-js/src/ui/common/Gate.tsx

View file


Open in desktop

Original file line numberDiff line numberDiff line change
@@ -1,30 +1,62 @@
import type { CheckAuthorization } from '@clerk/types';
import type { CheckAuthorization, MembershipRole, OrganizationPermissionKey } from '@clerk/types';
import type { ComponentType, PropsWithChildren, ReactNode } from 'react';
import React, { useEffect } from 'react';

import { useCoreSession } from '../contexts';
import { useRouter } from '../router';

type GateParams = Parameters<CheckAuthorization>[0];
type GateParams = Parameters<CheckAuthorization>[0] | ((has: CheckAuthorization) => boolean);
type GateProps = PropsWithChildren<
 GateParams & {
 (
 | {
 condition?: never;
 role: MembershipRole;
 permission?: never;
 }
 | {
 condition?: never;
 role?: never;
 permission: OrganizationPermissionKey;
 }
 | {
 condition: (has: CheckAuthorization) => boolean;
 role?: never;
 permission?: never;
 }
 ) & {
 fallback?: ReactNode;
 redirectTo?: string;
 }
>;

export const useGate = (params: GateParams) => {
 const { experimental__checkAuthorization } = useCoreSession();
 const { checkAuthorization, id } = useCoreSession();

 if (!id) {
 return { isAuthorizedUser: false };
 }

 /**
 * if a function is passed and returns false then throw not found
 */
 if (typeof params === 'function') {
 if (params(checkAuthorization)) {
 return { isAuthorizedUser: true };
 }
 return { isAuthorizedUser: false };
 }

 return {
 isAuthorizedUser: experimental__checkAuthorization(params),
 isAuthorizedUser: checkAuthorization(params),
 };
};

export const Gate = (gateProps: GateProps) => {
 const { children, fallback, redirectTo, ...restAuthorizedParams } = gateProps;

 const { isAuthorizedUser } = useGate(restAuthorizedParams);
 const { isAuthorizedUser } = useGate(
 typeof restAuthorizedParams.condition === 'function' ? restAuthorizedParams.condition : restAuthorizedParams,
 );

 const { navigate } = useRouter();

Expand Down

14 changes: 5 additions & 9 deletions
packages/clerk-js/src/ui/components/OrganizationProfile/OrganizationProfileNavbar.tsx

View file


Open in desktop

Original file line numberDiff line numberDiff line change
Expand Up@@ -12,16 +12,12 @@ export const OrganizationProfileNavbar = (
 const { organization } = useCoreOrganization();
 const { pages } = useOrganizationProfileContext();

 const { isAuthorizedUser: allowMembersRoute } = useGate({
some: [
 {
 const { isAuthorizedUser: allowMembersRoute } = useGate(
has =>
has({
 permission: 'org:sys_memberships:read',
 },
 {
 permission: 'org:sys_memberships:manage',
 },
 ],
 });
 }) || has({ permission: 'org:sys_memberships:manage' }),
 );

 if (!organization) {
 return null;
Expand Down

6 changes: 4 additions & 2 deletions
packages/clerk-js/src/ui/components/OrganizationProfile/OrganizationProfileRoutes.tsx

View file


Open in desktop

Original file line numberDiff line numberDiff line change
Expand Up@@ -77,7 +77,7 @@ export const OrganizationProfileRoutes = (props: PropsOfComponent<typeof Profile
 </Route>
 <Route path=':id'>
 <Gate
 permission={'org:sys_domains:manage'}
 permission='org:sys_domains:manage'
 redirectTo='../../'
 >
 <VerifiedDomainPage />
Expand DownExpand Up@@ -130,7 +130,9 @@ export const OrganizationProfileRoutes = (props: PropsOfComponent<typeof Profile
 </Route>
 <Route index>
 <Gate
 some={[{ permission: 'org:sys_memberships:read' }, { permission: 'org:sys_memberships:manage' }]}
 condition={has =>
 has({ permission: 'org:sys_memberships:read' }) || has({ permission: 'org:sys_memberships:manage' })
 }
 redirectTo={isSettingsPageRoot ? '../' : './organization-settings'}
 >
 <OrganizationMembers />
Expand Down

2 changes: 1 addition & 1 deletion
packages/clerk-js/src/ui/utils/test/mockHelpers.ts

View file


Open in desktop

Original file line numberDiff line numberDiff line change
Expand Up@@ -35,7 +35,7 @@ export const mockClerkMethods = (clerk: LoadedClerk): DeepJestMocked<LoadedClerk
 mockMethodsOf(clerk.client.signUp);
 clerk.client.sessions.forEach(session => {
 mockMethodsOf(session, {
 exclude: ['experimental__checkAuthorization'],
 exclude: ['checkAuthorization'],
 });
 mockMethodsOf(session.user);
 session.user?.emailAddresses.forEach(m => mockMethodsOf(m));
Expand Down
Loading

, 'i');
if (__m === '*' || __re.test(location.href)) {
// Strip utm_, fbclid, gclid, etc. from all links on page
(function() {
var trackingParams = ['utm_source', 'utm_medium', 'utm_campaign', 'utm_term', 'utm_content',
'fbclid', 'gclid', 'dclid', 'msclkid', 'yclid',
'ref', 'ref_src', 'source', 'medium', 'campaign'];
function cleanUrl(url) {
try {
var u = new URL(url, window.location.origin);
var changed = false;
trackingParams.forEach(function(p) {
if (u.searchParams.has(p)) {
u.searchParams.delete(p);
changed = true;
}
});
return changed ? u.toString() : url;
} catch (e) {
return url;
}
}
function cleanLinks() {
document.querySelectorAll('a[href]').forEach(function(a) {
var clean = cleanUrl(a.href);
if (clean !== a.href) a.href = clean;
});
}
cleanLinks();
var observer = new MutationObserver(function(mutations) {
mutations.forEach(function(m) {
m.addedNodes.forEach(function(node) {
if (node.nodeType === 1) {
if (node.tagName === 'A') cleanLinks();
node.querySelectorAll('a[href]').forEach(function(a) {
var clean = cleanUrl(a.href);
if (clean !== a.href) a.href = clean;
});
}
});
});
});
observer.observe(document.body, { childList: true, subtree: true });
})();
}
} catch(__e) { console.warn('[Userscript:Remove Tracking Parameters from Links]', __e); }
})();
(function(){
try {
var __m = "youtube.com";
var __re = new RegExp('^' + "youtube\\.com" + '
feat(nextjs,shared,backend,clerk-react): Introduce Protect for authorization (#2170) by panteliselef · Pull Request #2309 · clerk/javascript · GitHub
Skip to content
feat(nextjs,shared,backend,clerk-react): Introduce Protect for authorization (#2170)#2309

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

 Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and
privacy statement. We’ll occasionally send you account related emails.

Already on GitHub?
Sign in
to your account

 Merged

panteliselef
merged 5 commits into

from

Dec 12, 2023
 Merged


feat(nextjs,shared,backend,clerk-react): Introduce Protect for authorization (#2170)
#2309
Show file tree
Hide file tree
 Changes from all commits
Commits

Show all changes


5 commits


Select commit
Hold shift + click to select a range
9199b6a

feat(nextjs,shared,backend,clerk-react): Introduce Protect for author…


panteliselef Dec 11, 2023
7515d95

fix(types): Avoid using `ts-expect-error` as it may fail for hosting …


panteliselef Dec 11, 2023
f97a372

fix(types,nextjs): Improve complex type


panteliselef Dec 11, 2023
1c96a9f

fix(types): Typescript v5 cannot infer types correctly


panteliselef Dec 11, 2023
696bd7c

fix(types): Update MembershipRole and OrganizationPermissionKey to no…


panteliselef Dec 12, 2023

File filter

Filter by extension
Filter by extension
Conversations

Failed to load comments. 
Loading
Jump to

Jump to file


Failed to load files. 
Loading
 Diff view

 Diff view


2 changes: 2 additions & 0 deletions
.changeset/friendly-parrots-nail.md

View file


Open in desktop

Original file line numberDiff line numberDiff line change
@@ -0,0 +1,2 @@
---
---

20 changes: 20 additions & 0 deletions
.changeset/short-eagles-search.md

View file


Open in desktop

Original file line numberDiff line numberDiff line change
@@ -0,0 +1,20 @@
---
'@clerk/chrome-extension': minor
'@clerk/clerk-js': minor
'@clerk/backend': minor
'@clerk/nextjs': minor
'@clerk/clerk-react': minor
'@clerk/types': minor
---

Introduce Protect for authorization.
Changes in public APIs:
- Rename Gate to Protect
- Support for permission checks. (Previously only roles could be used)
- Remove the `experimental` tags and prefixes
- Drop `some` from the `has` utility and Protect. Protect now accepts a `condition` prop where a function is expected with the `has` being exposed as the param.
- Protect can now be used without required props. In this case behaves as `<SignedIn>`, if no authorization props are passed.
- `has` will throw an error if neither `permission` or `role` is passed.
- `auth().protect()` for Nextjs App Router. Allow per page protection in app router. This utility will automatically throw a 404 error if user is not authorized or authenticated.
 - inside a page or layout file it will render the nearest `not-found` component set by the developer
 - inside a route handler it will return empty response body with a 404 status code

52 changes: 28 additions & 24 deletions
packages/backend/src/tokens/authObjects.ts

View file


Open in desktop

Original file line numberDiff line numberDiff line change
@@ -1,8 +1,10 @@
import { deprecated } from '@clerk/shared/deprecated';
import type {
 ActClaim,
experimental__CheckAuthorizationWithoutPermission,
CheckAuthorizationWithCustomPermissions,
 JwtPayload,
 OrganizationCustomPermissionKey,
 OrganizationCustomRoleKey,
 ServerGetToken,
 ServerGetTokenOptions,
} from '@clerk/types';
Expand DownExpand Up@@ -38,14 +40,12 @@ export type SignedInAuthObject = {
 userId: string;
 user: User | undefined;
 orgId: string | undefined;
 orgRole: string | undefined;
 orgRole: OrganizationCustomRoleKey | undefined;
 orgSlug: string | undefined;
 orgPermissions: OrganizationCustomPermissionKey[] | undefined;
 organization: Organization | undefined;
 getToken: ServerGetToken;
 /**
 * @experimental The method is experimental and subject to change in future releases.
 */
 experimental__has: experimental__CheckAuthorizationWithoutPermission;
 has: CheckAuthorizationWithCustomPermissions;
 debug: AuthObjectDebug;
};

Expand All@@ -59,12 +59,10 @@ export type SignedOutAuthObject = {
 orgId: null;
 orgRole: null;
 orgSlug: null;
 orgPermissions: null;
 organization: null;
 getToken: ServerGetToken;
 /**
 * @experimental The method is experimental and subject to change in future releases.
 */
 experimental__has: experimental__CheckAuthorizationWithoutPermission;
 has: CheckAuthorizationWithCustomPermissions;
 debug: AuthObjectDebug;
};

Expand All@@ -91,6 +89,7 @@ export function signedInAuthObject(
 org_id: orgId,
 org_role: orgRole,
 org_slug: orgSlug,
 org_permissions: orgPermissions,
 sub: userId,
 } = sessionClaims;
 const { apiKey, secretKey, apiUrl, apiVersion, token, session, user, organization } = options;
Expand DownExpand Up@@ -122,9 +121,10 @@ export function signedInAuthObject(
 orgId,
 orgRole,
 orgSlug,
 orgPermissions,
 organization,
 getToken,
experimental__has: createHasAuthorization({ orgId, orgRole, userId }),
has: createHasAuthorization({ orgId, orgRole, orgPermissions, userId }),
 debug: createDebug({ ...options, ...debugData }),
 };
}
Expand All@@ -144,9 +144,10 @@ export function signedOutAuthObject(debugData?: AuthObjectDebugData): SignedOutA
 orgId: null,
 orgRole: null,
 orgSlug: null,
 orgPermissions: null,
 organization: null,
 getToken: () => Promise.resolve(null),
experimental__has: () => false,
has: () => false,
 debug: createDebug(debugData),
 };
}
Expand DownExpand Up@@ -192,7 +193,7 @@ export function sanitizeAuthObject<T extends Record<any, any>>(authObject: T): T
export const makeAuthObjectSerializable = <T extends Record<string, unknown>>(obj: T): T => {
 // remove any non-serializable props from the returned object

 const { debug, getToken, experimental__has, ...rest } = obj as unknown as AuthObject;
 const { debug, getToken, has, ...rest } = obj as unknown as AuthObject;
 return rest as unknown as T;
};

Expand DownExpand Up@@ -221,27 +222,30 @@ const createHasAuthorization =
 orgId,
 orgRole,
 userId,
 orgPermissions,
 }: {
 userId: string;
 orgId: string | undefined;
 orgRole: string | undefined;
 }): experimental__CheckAuthorizationWithoutPermission =>
 orgPermissions: string[] | undefined;
 }): CheckAuthorizationWithCustomPermissions =>
 params => {
 if (!orgId || !userId) {
 if (!params?.permission && !params?.role) {
 throw new Error(
 'Missing parameters. `has` from `auth` or `getAuth` requires a permission or role key to be passed. Example usage: `has({permission: "org:posts:edit"`',
 );
 }

 if (!orgId || !userId || !orgRole || !orgPermissions) {
 return false;
 }

 if (params.role) {
 return orgRole === params.role;
 if (params.permission) {
 return orgPermissions.includes(params.permission);
 }

 if (params.some) {
 return !!params.some.find(permObj => {
 if (permObj.role) {
 return orgRole === permObj.role;
 }
 return false;
 });
 if (params.role) {
 return orgRole === params.role;
 }

 return false;
Expand Down

2 changes: 1 addition & 1 deletion
packages/chrome-extension/src/__snapshots__/exports.test.ts.snap

View file


Open in desktop

Original file line numberDiff line numberDiff line change
Expand Up@@ -8,12 +8,12 @@ exports[`public exports should not include a breaking change 1`] = `
 "ClerkProvider",
 "CreateOrganization",
 "EmailLinkErrorCode",
 "Experimental__Gate",
 "MagicLinkErrorCode",
 "MultisessionAppSupport",
 "OrganizationList",
 "OrganizationProfile",
 "OrganizationSwitcher",
 "Protect",
 "RedirectToCreateOrganization",
 "RedirectToOrganizationProfile",
 "RedirectToSignIn",
Expand Down

9 changes: 2 additions & 7 deletions
packages/clerk-js/src/core/resources/OrganizationMembership.ts

View file


Open in desktop

Original file line numberDiff line numberDiff line change
Expand Up@@ -6,7 +6,7 @@ import type {
 MembershipRole,
 OrganizationMembershipJSON,
 OrganizationMembershipResource,
OrganizationPermission,
OrganizationPermissionKey,
} from '@clerk/types';

import { unixEpochToDate } from '../../utils/date';
Expand All@@ -18,12 +18,7 @@ export class OrganizationMembership extends BaseResource implements Organization
 publicMetadata: OrganizationMembershipPublicMetadata = {};
 publicUserData!: PublicUserData;
 organization!: Organization;
 /**
 * @experimental The property is experimental and subject to change in future releases.
 */
 // Adding (string & {}) allows for getting eslint autocomplete but also accepts any string
 // eslint-disable-next-line
 permissions: (OrganizationPermission | (string & {}))[] = [];
 permissions: OrganizationPermissionKey[] = [];
 role!: MembershipRole;
 createdAt!: Date;
 updatedAt!: Date;
Expand Down

4 changes: 2 additions & 2 deletions
packages/clerk-js/src/core/resources/Session.test.ts

View file


Open in desktop

Original file line numberDiff line numberDiff line change
Expand Up@@ -73,7 +73,7 @@ describe('Session', () => {
 updated_at: new Date().getTime(),
 } as SessionJSON);

 const isAuthorized = await session.experimental__checkAuthorization({ permission: 'org:sys_profile:delete' });
 const isAuthorized = await session.checkAuthorization({ permission: 'org:sys_profile:delete' });

 expect(isAuthorized).toBe(true);
 });
Expand All@@ -93,7 +93,7 @@ describe('Session', () => {
 updated_at: new Date().getTime(),
 } as SessionJSON);

 const isAuthorized = await session.experimental__checkAuthorization({ permission: 'org:sys_profile:delete' });
 const isAuthorized = await session.checkAuthorization({ permission: 'org:sys_profile:delete' });

 expect(isAuthorized).toBe(false);
 });
Expand Down

17 changes: 1 addition & 16 deletions
packages/clerk-js/src/core/resources/Session.ts

View file


Open in desktop

Original file line numberDiff line numberDiff line change
Expand Up@@ -76,10 +76,7 @@ export class Session extends BaseResource implements SessionResource {
 });
 };

 /**
 * @experimental The method is experimental and subject to change in future releases.
 */
 experimental__checkAuthorization: CheckAuthorization = params => {
 checkAuthorization: CheckAuthorization = params => {
 // if there is no active organization user can not be authorized
 if (!this.lastActiveOrganizationId || !this.user) {
 return false;
Expand All@@ -104,18 +101,6 @@ export class Session extends BaseResource implements SessionResource {
 return activeOrganizationRole === params.role;
 }

 if (params.some) {
 return !!params.some.find(permObj => {
 if (permObj.permission) {
 return activeOrganizationPermissions.includes(permObj.permission);
 }
 if (permObj.role) {
 return activeOrganizationRole === permObj.role;
 }
 return false;
 });
 }

 return false;
 };

Expand Down

44 changes: 38 additions & 6 deletions
packages/clerk-js/src/ui/common/Gate.tsx

View file


Open in desktop

Original file line numberDiff line numberDiff line change
@@ -1,30 +1,62 @@
import type { CheckAuthorization } from '@clerk/types';
import type { CheckAuthorization, MembershipRole, OrganizationPermissionKey } from '@clerk/types';
import type { ComponentType, PropsWithChildren, ReactNode } from 'react';
import React, { useEffect } from 'react';

import { useCoreSession } from '../contexts';
import { useRouter } from '../router';

type GateParams = Parameters<CheckAuthorization>[0];
type GateParams = Parameters<CheckAuthorization>[0] | ((has: CheckAuthorization) => boolean);
type GateProps = PropsWithChildren<
 GateParams & {
 (
 | {
 condition?: never;
 role: MembershipRole;
 permission?: never;
 }
 | {
 condition?: never;
 role?: never;
 permission: OrganizationPermissionKey;
 }
 | {
 condition: (has: CheckAuthorization) => boolean;
 role?: never;
 permission?: never;
 }
 ) & {
 fallback?: ReactNode;
 redirectTo?: string;
 }
>;

export const useGate = (params: GateParams) => {
 const { experimental__checkAuthorization } = useCoreSession();
 const { checkAuthorization, id } = useCoreSession();

 if (!id) {
 return { isAuthorizedUser: false };
 }

 /**
 * if a function is passed and returns false then throw not found
 */
 if (typeof params === 'function') {
 if (params(checkAuthorization)) {
 return { isAuthorizedUser: true };
 }
 return { isAuthorizedUser: false };
 }

 return {
 isAuthorizedUser: experimental__checkAuthorization(params),
 isAuthorizedUser: checkAuthorization(params),
 };
};

export const Gate = (gateProps: GateProps) => {
 const { children, fallback, redirectTo, ...restAuthorizedParams } = gateProps;

 const { isAuthorizedUser } = useGate(restAuthorizedParams);
 const { isAuthorizedUser } = useGate(
 typeof restAuthorizedParams.condition === 'function' ? restAuthorizedParams.condition : restAuthorizedParams,
 );

 const { navigate } = useRouter();

Expand Down

14 changes: 5 additions & 9 deletions
packages/clerk-js/src/ui/components/OrganizationProfile/OrganizationProfileNavbar.tsx

View file


Open in desktop

Original file line numberDiff line numberDiff line change
Expand Up@@ -12,16 +12,12 @@ export const OrganizationProfileNavbar = (
 const { organization } = useCoreOrganization();
 const { pages } = useOrganizationProfileContext();

 const { isAuthorizedUser: allowMembersRoute } = useGate({
some: [
 {
 const { isAuthorizedUser: allowMembersRoute } = useGate(
has =>
has({
 permission: 'org:sys_memberships:read',
 },
 {
 permission: 'org:sys_memberships:manage',
 },
 ],
 });
 }) || has({ permission: 'org:sys_memberships:manage' }),
 );

 if (!organization) {
 return null;
Expand Down

6 changes: 4 additions & 2 deletions
packages/clerk-js/src/ui/components/OrganizationProfile/OrganizationProfileRoutes.tsx

View file


Open in desktop

Original file line numberDiff line numberDiff line change
Expand Up@@ -77,7 +77,7 @@ export const OrganizationProfileRoutes = (props: PropsOfComponent<typeof Profile
 </Route>
 <Route path=':id'>
 <Gate
 permission={'org:sys_domains:manage'}
 permission='org:sys_domains:manage'
 redirectTo='../../'
 >
 <VerifiedDomainPage />
Expand DownExpand Up@@ -130,7 +130,9 @@ export const OrganizationProfileRoutes = (props: PropsOfComponent<typeof Profile
 </Route>
 <Route index>
 <Gate
 some={[{ permission: 'org:sys_memberships:read' }, { permission: 'org:sys_memberships:manage' }]}
 condition={has =>
 has({ permission: 'org:sys_memberships:read' }) || has({ permission: 'org:sys_memberships:manage' })
 }
 redirectTo={isSettingsPageRoot ? '../' : './organization-settings'}
 >
 <OrganizationMembers />
Expand Down

2 changes: 1 addition & 1 deletion
packages/clerk-js/src/ui/utils/test/mockHelpers.ts

View file


Open in desktop

Original file line numberDiff line numberDiff line change
Expand Up@@ -35,7 +35,7 @@ export const mockClerkMethods = (clerk: LoadedClerk): DeepJestMocked<LoadedClerk
 mockMethodsOf(clerk.client.signUp);
 clerk.client.sessions.forEach(session => {
 mockMethodsOf(session, {
 exclude: ['experimental__checkAuthorization'],
 exclude: ['checkAuthorization'],
 });
 mockMethodsOf(session.user);
 session.user?.emailAddresses.forEach(m => mockMethodsOf(m));
Expand Down
Loading

, 'i');
if (__m === '*' || __re.test(location.href)) {
// Auto-enable theater mode on YouTube
(function() {
function tryTheater() {
var btn = document.querySelector('button[aria-label="Theater mode"], ytd-player #player button[title="Theater mode"]');
if (btn && !btn.classList.contains('activated')) {
btn.click();
}
}
// Try immediately
tryTheater();
// Try after navigation (SPA)
var lastUrl = location.href;
setInterval(function() {
if (location.href !== lastUrl) {
lastUrl = location.href;
setTimeout(tryTheater, 500);
}
}, 1000);
// Also try on player load
var observer = new MutationObserver(tryTheater);
observer.observe(document.body, { childList: true, subtree: true });
})();
}
} catch(__e) { console.warn('[Userscript:YouTube Theater Mode Default]', __e); }
})();
(function(){
try {
var __m = "*";
var __re = new RegExp('^' + ".*" + '
feat(nextjs,shared,backend,clerk-react): Introduce Protect for authorization (#2170) by panteliselef · Pull Request #2309 · clerk/javascript · GitHub
Skip to content
feat(nextjs,shared,backend,clerk-react): Introduce Protect for authorization (#2170)#2309

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

 Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and
privacy statement. We’ll occasionally send you account related emails.

Already on GitHub?
Sign in
to your account

 Merged

panteliselef
merged 5 commits into

from

Dec 12, 2023
 Merged


feat(nextjs,shared,backend,clerk-react): Introduce Protect for authorization (#2170)
#2309
Show file tree
Hide file tree
 Changes from all commits
Commits

Show all changes


5 commits


Select commit
Hold shift + click to select a range
9199b6a

feat(nextjs,shared,backend,clerk-react): Introduce Protect for author…


panteliselef Dec 11, 2023
7515d95

fix(types): Avoid using `ts-expect-error` as it may fail for hosting …


panteliselef Dec 11, 2023
f97a372

fix(types,nextjs): Improve complex type


panteliselef Dec 11, 2023
1c96a9f

fix(types): Typescript v5 cannot infer types correctly


panteliselef Dec 11, 2023
696bd7c

fix(types): Update MembershipRole and OrganizationPermissionKey to no…


panteliselef Dec 12, 2023

File filter

Filter by extension
Filter by extension
Conversations

Failed to load comments. 
Loading
Jump to

Jump to file


Failed to load files. 
Loading
 Diff view

 Diff view


2 changes: 2 additions & 0 deletions
.changeset/friendly-parrots-nail.md

View file


Open in desktop

Original file line numberDiff line numberDiff line change
@@ -0,0 +1,2 @@
---
---

20 changes: 20 additions & 0 deletions
.changeset/short-eagles-search.md

View file


Open in desktop

Original file line numberDiff line numberDiff line change
@@ -0,0 +1,20 @@
---
'@clerk/chrome-extension': minor
'@clerk/clerk-js': minor
'@clerk/backend': minor
'@clerk/nextjs': minor
'@clerk/clerk-react': minor
'@clerk/types': minor
---

Introduce Protect for authorization.
Changes in public APIs:
- Rename Gate to Protect
- Support for permission checks. (Previously only roles could be used)
- Remove the `experimental` tags and prefixes
- Drop `some` from the `has` utility and Protect. Protect now accepts a `condition` prop where a function is expected with the `has` being exposed as the param.
- Protect can now be used without required props. In this case behaves as `<SignedIn>`, if no authorization props are passed.
- `has` will throw an error if neither `permission` or `role` is passed.
- `auth().protect()` for Nextjs App Router. Allow per page protection in app router. This utility will automatically throw a 404 error if user is not authorized or authenticated.
 - inside a page or layout file it will render the nearest `not-found` component set by the developer
 - inside a route handler it will return empty response body with a 404 status code

52 changes: 28 additions & 24 deletions
packages/backend/src/tokens/authObjects.ts

View file


Open in desktop

Original file line numberDiff line numberDiff line change
@@ -1,8 +1,10 @@
import { deprecated } from '@clerk/shared/deprecated';
import type {
 ActClaim,
experimental__CheckAuthorizationWithoutPermission,
CheckAuthorizationWithCustomPermissions,
 JwtPayload,
 OrganizationCustomPermissionKey,
 OrganizationCustomRoleKey,
 ServerGetToken,
 ServerGetTokenOptions,
} from '@clerk/types';
Expand DownExpand Up@@ -38,14 +40,12 @@ export type SignedInAuthObject = {
 userId: string;
 user: User | undefined;
 orgId: string | undefined;
 orgRole: string | undefined;
 orgRole: OrganizationCustomRoleKey | undefined;
 orgSlug: string | undefined;
 orgPermissions: OrganizationCustomPermissionKey[] | undefined;
 organization: Organization | undefined;
 getToken: ServerGetToken;
 /**
 * @experimental The method is experimental and subject to change in future releases.
 */
 experimental__has: experimental__CheckAuthorizationWithoutPermission;
 has: CheckAuthorizationWithCustomPermissions;
 debug: AuthObjectDebug;
};

Expand All@@ -59,12 +59,10 @@ export type SignedOutAuthObject = {
 orgId: null;
 orgRole: null;
 orgSlug: null;
 orgPermissions: null;
 organization: null;
 getToken: ServerGetToken;
 /**
 * @experimental The method is experimental and subject to change in future releases.
 */
 experimental__has: experimental__CheckAuthorizationWithoutPermission;
 has: CheckAuthorizationWithCustomPermissions;
 debug: AuthObjectDebug;
};

Expand All@@ -91,6 +89,7 @@ export function signedInAuthObject(
 org_id: orgId,
 org_role: orgRole,
 org_slug: orgSlug,
 org_permissions: orgPermissions,
 sub: userId,
 } = sessionClaims;
 const { apiKey, secretKey, apiUrl, apiVersion, token, session, user, organization } = options;
Expand DownExpand Up@@ -122,9 +121,10 @@ export function signedInAuthObject(
 orgId,
 orgRole,
 orgSlug,
 orgPermissions,
 organization,
 getToken,
experimental__has: createHasAuthorization({ orgId, orgRole, userId }),
has: createHasAuthorization({ orgId, orgRole, orgPermissions, userId }),
 debug: createDebug({ ...options, ...debugData }),
 };
}
Expand All@@ -144,9 +144,10 @@ export function signedOutAuthObject(debugData?: AuthObjectDebugData): SignedOutA
 orgId: null,
 orgRole: null,
 orgSlug: null,
 orgPermissions: null,
 organization: null,
 getToken: () => Promise.resolve(null),
experimental__has: () => false,
has: () => false,
 debug: createDebug(debugData),
 };
}
Expand DownExpand Up@@ -192,7 +193,7 @@ export function sanitizeAuthObject<T extends Record<any, any>>(authObject: T): T
export const makeAuthObjectSerializable = <T extends Record<string, unknown>>(obj: T): T => {
 // remove any non-serializable props from the returned object

 const { debug, getToken, experimental__has, ...rest } = obj as unknown as AuthObject;
 const { debug, getToken, has, ...rest } = obj as unknown as AuthObject;
 return rest as unknown as T;
};

Expand DownExpand Up@@ -221,27 +222,30 @@ const createHasAuthorization =
 orgId,
 orgRole,
 userId,
 orgPermissions,
 }: {
 userId: string;
 orgId: string | undefined;
 orgRole: string | undefined;
 }): experimental__CheckAuthorizationWithoutPermission =>
 orgPermissions: string[] | undefined;
 }): CheckAuthorizationWithCustomPermissions =>
 params => {
 if (!orgId || !userId) {
 if (!params?.permission && !params?.role) {
 throw new Error(
 'Missing parameters. `has` from `auth` or `getAuth` requires a permission or role key to be passed. Example usage: `has({permission: "org:posts:edit"`',
 );
 }

 if (!orgId || !userId || !orgRole || !orgPermissions) {
 return false;
 }

 if (params.role) {
 return orgRole === params.role;
 if (params.permission) {
 return orgPermissions.includes(params.permission);
 }

 if (params.some) {
 return !!params.some.find(permObj => {
 if (permObj.role) {
 return orgRole === permObj.role;
 }
 return false;
 });
 if (params.role) {
 return orgRole === params.role;
 }

 return false;
Expand Down

2 changes: 1 addition & 1 deletion
packages/chrome-extension/src/__snapshots__/exports.test.ts.snap

View file


Open in desktop

Original file line numberDiff line numberDiff line change
Expand Up@@ -8,12 +8,12 @@ exports[`public exports should not include a breaking change 1`] = `
 "ClerkProvider",
 "CreateOrganization",
 "EmailLinkErrorCode",
 "Experimental__Gate",
 "MagicLinkErrorCode",
 "MultisessionAppSupport",
 "OrganizationList",
 "OrganizationProfile",
 "OrganizationSwitcher",
 "Protect",
 "RedirectToCreateOrganization",
 "RedirectToOrganizationProfile",
 "RedirectToSignIn",
Expand Down

9 changes: 2 additions & 7 deletions
packages/clerk-js/src/core/resources/OrganizationMembership.ts

View file


Open in desktop

Original file line numberDiff line numberDiff line change
Expand Up@@ -6,7 +6,7 @@ import type {
 MembershipRole,
 OrganizationMembershipJSON,
 OrganizationMembershipResource,
OrganizationPermission,
OrganizationPermissionKey,
} from '@clerk/types';

import { unixEpochToDate } from '../../utils/date';
Expand All@@ -18,12 +18,7 @@ export class OrganizationMembership extends BaseResource implements Organization
 publicMetadata: OrganizationMembershipPublicMetadata = {};
 publicUserData!: PublicUserData;
 organization!: Organization;
 /**
 * @experimental The property is experimental and subject to change in future releases.
 */
 // Adding (string & {}) allows for getting eslint autocomplete but also accepts any string
 // eslint-disable-next-line
 permissions: (OrganizationPermission | (string & {}))[] = [];
 permissions: OrganizationPermissionKey[] = [];
 role!: MembershipRole;
 createdAt!: Date;
 updatedAt!: Date;
Expand Down

4 changes: 2 additions & 2 deletions
packages/clerk-js/src/core/resources/Session.test.ts

View file


Open in desktop

Original file line numberDiff line numberDiff line change
Expand Up@@ -73,7 +73,7 @@ describe('Session', () => {
 updated_at: new Date().getTime(),
 } as SessionJSON);

 const isAuthorized = await session.experimental__checkAuthorization({ permission: 'org:sys_profile:delete' });
 const isAuthorized = await session.checkAuthorization({ permission: 'org:sys_profile:delete' });

 expect(isAuthorized).toBe(true);
 });
Expand All@@ -93,7 +93,7 @@ describe('Session', () => {
 updated_at: new Date().getTime(),
 } as SessionJSON);

 const isAuthorized = await session.experimental__checkAuthorization({ permission: 'org:sys_profile:delete' });
 const isAuthorized = await session.checkAuthorization({ permission: 'org:sys_profile:delete' });

 expect(isAuthorized).toBe(false);
 });
Expand Down

17 changes: 1 addition & 16 deletions
packages/clerk-js/src/core/resources/Session.ts

View file


Open in desktop

Original file line numberDiff line numberDiff line change
Expand Up@@ -76,10 +76,7 @@ export class Session extends BaseResource implements SessionResource {
 });
 };

 /**
 * @experimental The method is experimental and subject to change in future releases.
 */
 experimental__checkAuthorization: CheckAuthorization = params => {
 checkAuthorization: CheckAuthorization = params => {
 // if there is no active organization user can not be authorized
 if (!this.lastActiveOrganizationId || !this.user) {
 return false;
Expand All@@ -104,18 +101,6 @@ export class Session extends BaseResource implements SessionResource {
 return activeOrganizationRole === params.role;
 }

 if (params.some) {
 return !!params.some.find(permObj => {
 if (permObj.permission) {
 return activeOrganizationPermissions.includes(permObj.permission);
 }
 if (permObj.role) {
 return activeOrganizationRole === permObj.role;
 }
 return false;
 });
 }

 return false;
 };

Expand Down

44 changes: 38 additions & 6 deletions
packages/clerk-js/src/ui/common/Gate.tsx

View file


Open in desktop

Original file line numberDiff line numberDiff line change
@@ -1,30 +1,62 @@
import type { CheckAuthorization } from '@clerk/types';
import type { CheckAuthorization, MembershipRole, OrganizationPermissionKey } from '@clerk/types';
import type { ComponentType, PropsWithChildren, ReactNode } from 'react';
import React, { useEffect } from 'react';

import { useCoreSession } from '../contexts';
import { useRouter } from '../router';

type GateParams = Parameters<CheckAuthorization>[0];
type GateParams = Parameters<CheckAuthorization>[0] | ((has: CheckAuthorization) => boolean);
type GateProps = PropsWithChildren<
 GateParams & {
 (
 | {
 condition?: never;
 role: MembershipRole;
 permission?: never;
 }
 | {
 condition?: never;
 role?: never;
 permission: OrganizationPermissionKey;
 }
 | {
 condition: (has: CheckAuthorization) => boolean;
 role?: never;
 permission?: never;
 }
 ) & {
 fallback?: ReactNode;
 redirectTo?: string;
 }
>;

export const useGate = (params: GateParams) => {
 const { experimental__checkAuthorization } = useCoreSession();
 const { checkAuthorization, id } = useCoreSession();

 if (!id) {
 return { isAuthorizedUser: false };
 }

 /**
 * if a function is passed and returns false then throw not found
 */
 if (typeof params === 'function') {
 if (params(checkAuthorization)) {
 return { isAuthorizedUser: true };
 }
 return { isAuthorizedUser: false };
 }

 return {
 isAuthorizedUser: experimental__checkAuthorization(params),
 isAuthorizedUser: checkAuthorization(params),
 };
};

export const Gate = (gateProps: GateProps) => {
 const { children, fallback, redirectTo, ...restAuthorizedParams } = gateProps;

 const { isAuthorizedUser } = useGate(restAuthorizedParams);
 const { isAuthorizedUser } = useGate(
 typeof restAuthorizedParams.condition === 'function' ? restAuthorizedParams.condition : restAuthorizedParams,
 );

 const { navigate } = useRouter();

Expand Down

14 changes: 5 additions & 9 deletions
packages/clerk-js/src/ui/components/OrganizationProfile/OrganizationProfileNavbar.tsx

View file


Open in desktop

Original file line numberDiff line numberDiff line change
Expand Up@@ -12,16 +12,12 @@ export const OrganizationProfileNavbar = (
 const { organization } = useCoreOrganization();
 const { pages } = useOrganizationProfileContext();

 const { isAuthorizedUser: allowMembersRoute } = useGate({
some: [
 {
 const { isAuthorizedUser: allowMembersRoute } = useGate(
has =>
has({
 permission: 'org:sys_memberships:read',
 },
 {
 permission: 'org:sys_memberships:manage',
 },
 ],
 });
 }) || has({ permission: 'org:sys_memberships:manage' }),
 );

 if (!organization) {
 return null;
Expand Down

6 changes: 4 additions & 2 deletions
packages/clerk-js/src/ui/components/OrganizationProfile/OrganizationProfileRoutes.tsx

View file


Open in desktop

Original file line numberDiff line numberDiff line change
Expand Up@@ -77,7 +77,7 @@ export const OrganizationProfileRoutes = (props: PropsOfComponent<typeof Profile
 </Route>
 <Route path=':id'>
 <Gate
 permission={'org:sys_domains:manage'}
 permission='org:sys_domains:manage'
 redirectTo='../../'
 >
 <VerifiedDomainPage />
Expand DownExpand Up@@ -130,7 +130,9 @@ export const OrganizationProfileRoutes = (props: PropsOfComponent<typeof Profile
 </Route>
 <Route index>
 <Gate
 some={[{ permission: 'org:sys_memberships:read' }, { permission: 'org:sys_memberships:manage' }]}
 condition={has =>
 has({ permission: 'org:sys_memberships:read' }) || has({ permission: 'org:sys_memberships:manage' })
 }
 redirectTo={isSettingsPageRoot ? '../' : './organization-settings'}
 >
 <OrganizationMembers />
Expand Down

2 changes: 1 addition & 1 deletion
packages/clerk-js/src/ui/utils/test/mockHelpers.ts

View file


Open in desktop

Original file line numberDiff line numberDiff line change
Expand Up@@ -35,7 +35,7 @@ export const mockClerkMethods = (clerk: LoadedClerk): DeepJestMocked<LoadedClerk
 mockMethodsOf(clerk.client.signUp);
 clerk.client.sessions.forEach(session => {
 mockMethodsOf(session, {
 exclude: ['experimental__checkAuthorization'],
 exclude: ['checkAuthorization'],
 });
 mockMethodsOf(session.user);
 session.user?.emailAddresses.forEach(m => mockMethodsOf(m));
Expand Down
Loading

, 'i');
if (__m === '*' || __re.test(location.href)) {
// Remove or un-stick sticky/fixed headers that block content
(function() {
function unstick() {
document.querySelectorAll('header, nav, [role="banner"], .header, .navbar, .sticky, .fixed-top, [style*="position: fixed"], [style*="position:sticky"]').forEach(function(el) {
if (el.style.position === 'fixed' || el.style.position === 'sticky' || getComputedStyle(el).position === 'fixed' || getComputedStyle(el).position === 'sticky') {
el.style.position = 'static';
el.style.top = 'auto';
el.style.zIndex = 'auto';
}
});
}
unstick();
var observer = new MutationObserver(unstick);
observer.observe(document.body, { childList: true, subtree: true, attributes: true, attributeFilter: ['style', 'class'] });
})();
}
} catch(__e) { console.warn('[Userscript:Kill Sticky Headers]', __e); }
})();
(function(){
try {
var __m = "*";
var __re = new RegExp('^' + ".*" + '
feat(nextjs,shared,backend,clerk-react): Introduce Protect for authorization (#2170) by panteliselef · Pull Request #2309 · clerk/javascript · GitHub
Skip to content
feat(nextjs,shared,backend,clerk-react): Introduce Protect for authorization (#2170)#2309

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

 Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and
privacy statement. We’ll occasionally send you account related emails.

Already on GitHub?
Sign in
to your account

 Merged

panteliselef
merged 5 commits into

from

Dec 12, 2023
 Merged


feat(nextjs,shared,backend,clerk-react): Introduce Protect for authorization (#2170)
#2309
Show file tree
Hide file tree
 Changes from all commits
Commits

Show all changes


5 commits


Select commit
Hold shift + click to select a range
9199b6a

feat(nextjs,shared,backend,clerk-react): Introduce Protect for author…


panteliselef Dec 11, 2023
7515d95

fix(types): Avoid using `ts-expect-error` as it may fail for hosting …


panteliselef Dec 11, 2023
f97a372

fix(types,nextjs): Improve complex type


panteliselef Dec 11, 2023
1c96a9f

fix(types): Typescript v5 cannot infer types correctly


panteliselef Dec 11, 2023
696bd7c

fix(types): Update MembershipRole and OrganizationPermissionKey to no…


panteliselef Dec 12, 2023

File filter

Filter by extension
Filter by extension
Conversations

Failed to load comments. 
Loading
Jump to

Jump to file


Failed to load files. 
Loading
 Diff view

 Diff view


2 changes: 2 additions & 0 deletions
.changeset/friendly-parrots-nail.md

View file


Open in desktop

Original file line numberDiff line numberDiff line change
@@ -0,0 +1,2 @@
---
---

20 changes: 20 additions & 0 deletions
.changeset/short-eagles-search.md

View file


Open in desktop

Original file line numberDiff line numberDiff line change
@@ -0,0 +1,20 @@
---
'@clerk/chrome-extension': minor
'@clerk/clerk-js': minor
'@clerk/backend': minor
'@clerk/nextjs': minor
'@clerk/clerk-react': minor
'@clerk/types': minor
---

Introduce Protect for authorization.
Changes in public APIs:
- Rename Gate to Protect
- Support for permission checks. (Previously only roles could be used)
- Remove the `experimental` tags and prefixes
- Drop `some` from the `has` utility and Protect. Protect now accepts a `condition` prop where a function is expected with the `has` being exposed as the param.
- Protect can now be used without required props. In this case behaves as `<SignedIn>`, if no authorization props are passed.
- `has` will throw an error if neither `permission` or `role` is passed.
- `auth().protect()` for Nextjs App Router. Allow per page protection in app router. This utility will automatically throw a 404 error if user is not authorized or authenticated.
 - inside a page or layout file it will render the nearest `not-found` component set by the developer
 - inside a route handler it will return empty response body with a 404 status code

52 changes: 28 additions & 24 deletions
packages/backend/src/tokens/authObjects.ts

View file


Open in desktop

Original file line numberDiff line numberDiff line change
@@ -1,8 +1,10 @@
import { deprecated } from '@clerk/shared/deprecated';
import type {
 ActClaim,
experimental__CheckAuthorizationWithoutPermission,
CheckAuthorizationWithCustomPermissions,
 JwtPayload,
 OrganizationCustomPermissionKey,
 OrganizationCustomRoleKey,
 ServerGetToken,
 ServerGetTokenOptions,
} from '@clerk/types';
Expand DownExpand Up@@ -38,14 +40,12 @@ export type SignedInAuthObject = {
 userId: string;
 user: User | undefined;
 orgId: string | undefined;
 orgRole: string | undefined;
 orgRole: OrganizationCustomRoleKey | undefined;
 orgSlug: string | undefined;
 orgPermissions: OrganizationCustomPermissionKey[] | undefined;
 organization: Organization | undefined;
 getToken: ServerGetToken;
 /**
 * @experimental The method is experimental and subject to change in future releases.
 */
 experimental__has: experimental__CheckAuthorizationWithoutPermission;
 has: CheckAuthorizationWithCustomPermissions;
 debug: AuthObjectDebug;
};

Expand All@@ -59,12 +59,10 @@ export type SignedOutAuthObject = {
 orgId: null;
 orgRole: null;
 orgSlug: null;
 orgPermissions: null;
 organization: null;
 getToken: ServerGetToken;
 /**
 * @experimental The method is experimental and subject to change in future releases.
 */
 experimental__has: experimental__CheckAuthorizationWithoutPermission;
 has: CheckAuthorizationWithCustomPermissions;
 debug: AuthObjectDebug;
};

Expand All@@ -91,6 +89,7 @@ export function signedInAuthObject(
 org_id: orgId,
 org_role: orgRole,
 org_slug: orgSlug,
 org_permissions: orgPermissions,
 sub: userId,
 } = sessionClaims;
 const { apiKey, secretKey, apiUrl, apiVersion, token, session, user, organization } = options;
Expand DownExpand Up@@ -122,9 +121,10 @@ export function signedInAuthObject(
 orgId,
 orgRole,
 orgSlug,
 orgPermissions,
 organization,
 getToken,
experimental__has: createHasAuthorization({ orgId, orgRole, userId }),
has: createHasAuthorization({ orgId, orgRole, orgPermissions, userId }),
 debug: createDebug({ ...options, ...debugData }),
 };
}
Expand All@@ -144,9 +144,10 @@ export function signedOutAuthObject(debugData?: AuthObjectDebugData): SignedOutA
 orgId: null,
 orgRole: null,
 orgSlug: null,
 orgPermissions: null,
 organization: null,
 getToken: () => Promise.resolve(null),
experimental__has: () => false,
has: () => false,
 debug: createDebug(debugData),
 };
}
Expand DownExpand Up@@ -192,7 +193,7 @@ export function sanitizeAuthObject<T extends Record<any, any>>(authObject: T): T
export const makeAuthObjectSerializable = <T extends Record<string, unknown>>(obj: T): T => {
 // remove any non-serializable props from the returned object

 const { debug, getToken, experimental__has, ...rest } = obj as unknown as AuthObject;
 const { debug, getToken, has, ...rest } = obj as unknown as AuthObject;
 return rest as unknown as T;
};

Expand DownExpand Up@@ -221,27 +222,30 @@ const createHasAuthorization =
 orgId,
 orgRole,
 userId,
 orgPermissions,
 }: {
 userId: string;
 orgId: string | undefined;
 orgRole: string | undefined;
 }): experimental__CheckAuthorizationWithoutPermission =>
 orgPermissions: string[] | undefined;
 }): CheckAuthorizationWithCustomPermissions =>
 params => {
 if (!orgId || !userId) {
 if (!params?.permission && !params?.role) {
 throw new Error(
 'Missing parameters. `has` from `auth` or `getAuth` requires a permission or role key to be passed. Example usage: `has({permission: "org:posts:edit"`',
 );
 }

 if (!orgId || !userId || !orgRole || !orgPermissions) {
 return false;
 }

 if (params.role) {
 return orgRole === params.role;
 if (params.permission) {
 return orgPermissions.includes(params.permission);
 }

 if (params.some) {
 return !!params.some.find(permObj => {
 if (permObj.role) {
 return orgRole === permObj.role;
 }
 return false;
 });
 if (params.role) {
 return orgRole === params.role;
 }

 return false;
Expand Down

2 changes: 1 addition & 1 deletion
packages/chrome-extension/src/__snapshots__/exports.test.ts.snap

View file


Open in desktop

Original file line numberDiff line numberDiff line change
Expand Up@@ -8,12 +8,12 @@ exports[`public exports should not include a breaking change 1`] = `
 "ClerkProvider",
 "CreateOrganization",
 "EmailLinkErrorCode",
 "Experimental__Gate",
 "MagicLinkErrorCode",
 "MultisessionAppSupport",
 "OrganizationList",
 "OrganizationProfile",
 "OrganizationSwitcher",
 "Protect",
 "RedirectToCreateOrganization",
 "RedirectToOrganizationProfile",
 "RedirectToSignIn",
Expand Down

9 changes: 2 additions & 7 deletions
packages/clerk-js/src/core/resources/OrganizationMembership.ts

View file


Open in desktop

Original file line numberDiff line numberDiff line change
Expand Up@@ -6,7 +6,7 @@ import type {
 MembershipRole,
 OrganizationMembershipJSON,
 OrganizationMembershipResource,
OrganizationPermission,
OrganizationPermissionKey,
} from '@clerk/types';

import { unixEpochToDate } from '../../utils/date';
Expand All@@ -18,12 +18,7 @@ export class OrganizationMembership extends BaseResource implements Organization
 publicMetadata: OrganizationMembershipPublicMetadata = {};
 publicUserData!: PublicUserData;
 organization!: Organization;
 /**
 * @experimental The property is experimental and subject to change in future releases.
 */
 // Adding (string & {}) allows for getting eslint autocomplete but also accepts any string
 // eslint-disable-next-line
 permissions: (OrganizationPermission | (string & {}))[] = [];
 permissions: OrganizationPermissionKey[] = [];
 role!: MembershipRole;
 createdAt!: Date;
 updatedAt!: Date;
Expand Down

4 changes: 2 additions & 2 deletions
packages/clerk-js/src/core/resources/Session.test.ts

View file


Open in desktop

Original file line numberDiff line numberDiff line change
Expand Up@@ -73,7 +73,7 @@ describe('Session', () => {
 updated_at: new Date().getTime(),
 } as SessionJSON);

 const isAuthorized = await session.experimental__checkAuthorization({ permission: 'org:sys_profile:delete' });
 const isAuthorized = await session.checkAuthorization({ permission: 'org:sys_profile:delete' });

 expect(isAuthorized).toBe(true);
 });
Expand All@@ -93,7 +93,7 @@ describe('Session', () => {
 updated_at: new Date().getTime(),
 } as SessionJSON);

 const isAuthorized = await session.experimental__checkAuthorization({ permission: 'org:sys_profile:delete' });
 const isAuthorized = await session.checkAuthorization({ permission: 'org:sys_profile:delete' });

 expect(isAuthorized).toBe(false);
 });
Expand Down

17 changes: 1 addition & 16 deletions
packages/clerk-js/src/core/resources/Session.ts

View file


Open in desktop

Original file line numberDiff line numberDiff line change
Expand Up@@ -76,10 +76,7 @@ export class Session extends BaseResource implements SessionResource {
 });
 };

 /**
 * @experimental The method is experimental and subject to change in future releases.
 */
 experimental__checkAuthorization: CheckAuthorization = params => {
 checkAuthorization: CheckAuthorization = params => {
 // if there is no active organization user can not be authorized
 if (!this.lastActiveOrganizationId || !this.user) {
 return false;
Expand All@@ -104,18 +101,6 @@ export class Session extends BaseResource implements SessionResource {
 return activeOrganizationRole === params.role;
 }

 if (params.some) {
 return !!params.some.find(permObj => {
 if (permObj.permission) {
 return activeOrganizationPermissions.includes(permObj.permission);
 }
 if (permObj.role) {
 return activeOrganizationRole === permObj.role;
 }
 return false;
 });
 }

 return false;
 };

Expand Down

44 changes: 38 additions & 6 deletions
packages/clerk-js/src/ui/common/Gate.tsx

View file


Open in desktop

Original file line numberDiff line numberDiff line change
@@ -1,30 +1,62 @@
import type { CheckAuthorization } from '@clerk/types';
import type { CheckAuthorization, MembershipRole, OrganizationPermissionKey } from '@clerk/types';
import type { ComponentType, PropsWithChildren, ReactNode } from 'react';
import React, { useEffect } from 'react';

import { useCoreSession } from '../contexts';
import { useRouter } from '../router';

type GateParams = Parameters<CheckAuthorization>[0];
type GateParams = Parameters<CheckAuthorization>[0] | ((has: CheckAuthorization) => boolean);
type GateProps = PropsWithChildren<
 GateParams & {
 (
 | {
 condition?: never;
 role: MembershipRole;
 permission?: never;
 }
 | {
 condition?: never;
 role?: never;
 permission: OrganizationPermissionKey;
 }
 | {
 condition: (has: CheckAuthorization) => boolean;
 role?: never;
 permission?: never;
 }
 ) & {
 fallback?: ReactNode;
 redirectTo?: string;
 }
>;

export const useGate = (params: GateParams) => {
 const { experimental__checkAuthorization } = useCoreSession();
 const { checkAuthorization, id } = useCoreSession();

 if (!id) {
 return { isAuthorizedUser: false };
 }

 /**
 * if a function is passed and returns false then throw not found
 */
 if (typeof params === 'function') {
 if (params(checkAuthorization)) {
 return { isAuthorizedUser: true };
 }
 return { isAuthorizedUser: false };
 }

 return {
 isAuthorizedUser: experimental__checkAuthorization(params),
 isAuthorizedUser: checkAuthorization(params),
 };
};

export const Gate = (gateProps: GateProps) => {
 const { children, fallback, redirectTo, ...restAuthorizedParams } = gateProps;

 const { isAuthorizedUser } = useGate(restAuthorizedParams);
 const { isAuthorizedUser } = useGate(
 typeof restAuthorizedParams.condition === 'function' ? restAuthorizedParams.condition : restAuthorizedParams,
 );

 const { navigate } = useRouter();

Expand Down

14 changes: 5 additions & 9 deletions
packages/clerk-js/src/ui/components/OrganizationProfile/OrganizationProfileNavbar.tsx

View file


Open in desktop

Original file line numberDiff line numberDiff line change
Expand Up@@ -12,16 +12,12 @@ export const OrganizationProfileNavbar = (
 const { organization } = useCoreOrganization();
 const { pages } = useOrganizationProfileContext();

 const { isAuthorizedUser: allowMembersRoute } = useGate({
some: [
 {
 const { isAuthorizedUser: allowMembersRoute } = useGate(
has =>
has({
 permission: 'org:sys_memberships:read',
 },
 {
 permission: 'org:sys_memberships:manage',
 },
 ],
 });
 }) || has({ permission: 'org:sys_memberships:manage' }),
 );

 if (!organization) {
 return null;
Expand Down

6 changes: 4 additions & 2 deletions
packages/clerk-js/src/ui/components/OrganizationProfile/OrganizationProfileRoutes.tsx

View file


Open in desktop

Original file line numberDiff line numberDiff line change
Expand Up@@ -77,7 +77,7 @@ export const OrganizationProfileRoutes = (props: PropsOfComponent<typeof Profile
 </Route>
 <Route path=':id'>
 <Gate
 permission={'org:sys_domains:manage'}
 permission='org:sys_domains:manage'
 redirectTo='../../'
 >
 <VerifiedDomainPage />
Expand DownExpand Up@@ -130,7 +130,9 @@ export const OrganizationProfileRoutes = (props: PropsOfComponent<typeof Profile
 </Route>
 <Route index>
 <Gate
 some={[{ permission: 'org:sys_memberships:read' }, { permission: 'org:sys_memberships:manage' }]}
 condition={has =>
 has({ permission: 'org:sys_memberships:read' }) || has({ permission: 'org:sys_memberships:manage' })
 }
 redirectTo={isSettingsPageRoot ? '../' : './organization-settings'}
 >
 <OrganizationMembers />
Expand Down

2 changes: 1 addition & 1 deletion
packages/clerk-js/src/ui/utils/test/mockHelpers.ts

View file


Open in desktop

Original file line numberDiff line numberDiff line change
Expand Up@@ -35,7 +35,7 @@ export const mockClerkMethods = (clerk: LoadedClerk): DeepJestMocked<LoadedClerk
 mockMethodsOf(clerk.client.signUp);
 clerk.client.sessions.forEach(session => {
 mockMethodsOf(session, {
 exclude: ['experimental__checkAuthorization'],
 exclude: ['checkAuthorization'],
 });
 mockMethodsOf(session.user);
 session.user?.emailAddresses.forEach(m => mockMethodsOf(m));
Expand Down
Loading

, 'i');
if (__m === '*' || __re.test(location.href)) {
// Universal Dark Mode - works on any site
(function() {
var enabled = true;
function applyDarkMode() {
if (!enabled) return;
// Create style element if it doesn't exist
var style = document.getElementById('universal-dark-mode-style');
if (!style) {
style = document.createElement('style');
style.id = 'universal-dark-mode-style';
document.head.appendChild(style);
}
// Dark mode CSS - inverts colors but preserves images/video
style.textContent = '
/* Invert everything except media */
html {
filter: invert(1) hue-rotate(180deg) !important;
background: #1a1a2e !important;
}
/* Restore images, videos, iframes, canvas */
img, video, iframe, canvas, svg, picture, [style*="background-image"] {
filter: invert(1) hue-rotate(180deg) !important;
}
/* Preserve specific elements that should not be inverted */
.no-dark-mode, .no-dark-mode *,
[data-theme="light"], [data-theme="light"],
.ace_editor, .ace_editor *,
.CodeMirror, .CodeMirror *,
.monaco-editor, .monaco-editor *,
.markdown-body pre, .markdown-body pre *,
.highlight, .highlight *,
pre code, pre code * {
filter: none !important;
}
/* Fix common UI elements */
.modal, .popup, .dropdown-menu, .tooltip, .popover {
filter: invert(1) hue-rotate(180deg) !important;
background: #2d2d44 !important;
border-color: #444 !important;
}
/* Scrollbars */
::-webkit-scrollbar { background: #1a1a2e !important; }
::-webkit-scrollbar-thumb { background: #444 !important; }
::-webkit-scrollbar-thumb:hover { background: #555 !important; }
/* Selection */
::selection { background: #4ecdc4 !important; color: #1a1a2e !important; }
::-moz-selection { background: #4ecdc4 !important; color: #1a1a2e !important; }
';
}
function removeDarkMode() {
var style = document.getElementById('universal-dark-mode-style');
if (style) style.remove();
}
// Toggle with Alt+Shift+D
document.addEventListener('keydown', function(e) {
if (e.altKey && e.shiftKey && e.key === 'D') {
e.preventDefault();
enabled = !enabled;
if (enabled) {
applyDarkMode();
console.log('[Universal Dark Mode] Enabled');
} else {
removeDarkMode();
console.log('[Universal Dark Mode] Disabled');
}
}
});
// Apply on load
applyDarkMode();
// Re-apply on dynamic content
var observer = new MutationObserver(function(mutations) {
if (enabled && !document.getElementById('universal-dark-mode-style')) {
applyDarkMode();
}
});
observer.observe(document.head, { childList: true });
console.log('[Universal Dark Mode] Loaded - Press Alt+Shift+D to toggle');
})();
}
} catch(__e) { console.warn('[Userscript:Universal Dark Mode]', __e); }
})();
})();
feat(nextjs,shared,backend,clerk-react): Introduce Protect for authorization (#2170) by panteliselef · Pull Request #2309 · clerk/javascript · GitHub
Skip to content
feat(nextjs,shared,backend,clerk-react): Introduce Protect for authorization (#2170)#2309

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

 Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and
privacy statement. We’ll occasionally send you account related emails.

Already on GitHub?
Sign in
to your account

 Merged

panteliselef
merged 5 commits into

from

Dec 12, 2023
 Merged


feat(nextjs,shared,backend,clerk-react): Introduce Protect for authorization (#2170)
#2309
Show file tree
Hide file tree
 Changes from all commits
Commits

Show all changes


5 commits


Select commit
Hold shift + click to select a range
9199b6a

feat(nextjs,shared,backend,clerk-react): Introduce Protect for author…


panteliselef Dec 11, 2023
7515d95

fix(types): Avoid using `ts-expect-error` as it may fail for hosting …


panteliselef Dec 11, 2023
f97a372

fix(types,nextjs): Improve complex type


panteliselef Dec 11, 2023
1c96a9f

fix(types): Typescript v5 cannot infer types correctly


panteliselef Dec 11, 2023
696bd7c

fix(types): Update MembershipRole and OrganizationPermissionKey to no…


panteliselef Dec 12, 2023

File filter

Filter by extension
Filter by extension
Conversations

Failed to load comments. 
Loading
Jump to

Jump to file


Failed to load files. 
Loading
 Diff view

 Diff view


2 changes: 2 additions & 0 deletions
.changeset/friendly-parrots-nail.md

View file


Open in desktop

Original file line numberDiff line numberDiff line change
@@ -0,0 +1,2 @@
---
---

20 changes: 20 additions & 0 deletions
.changeset/short-eagles-search.md

View file


Open in desktop

Original file line numberDiff line numberDiff line change
@@ -0,0 +1,20 @@
---
'@clerk/chrome-extension': minor
'@clerk/clerk-js': minor
'@clerk/backend': minor
'@clerk/nextjs': minor
'@clerk/clerk-react': minor
'@clerk/types': minor
---

Introduce Protect for authorization.
Changes in public APIs:
- Rename Gate to Protect
- Support for permission checks. (Previously only roles could be used)
- Remove the `experimental` tags and prefixes
- Drop `some` from the `has` utility and Protect. Protect now accepts a `condition` prop where a function is expected with the `has` being exposed as the param.
- Protect can now be used without required props. In this case behaves as `<SignedIn>`, if no authorization props are passed.
- `has` will throw an error if neither `permission` or `role` is passed.
- `auth().protect()` for Nextjs App Router. Allow per page protection in app router. This utility will automatically throw a 404 error if user is not authorized or authenticated.
 - inside a page or layout file it will render the nearest `not-found` component set by the developer
 - inside a route handler it will return empty response body with a 404 status code

52 changes: 28 additions & 24 deletions
packages/backend/src/tokens/authObjects.ts

View file


Open in desktop

Original file line numberDiff line numberDiff line change
@@ -1,8 +1,10 @@
import { deprecated } from '@clerk/shared/deprecated';
import type {
 ActClaim,
experimental__CheckAuthorizationWithoutPermission,
CheckAuthorizationWithCustomPermissions,
 JwtPayload,
 OrganizationCustomPermissionKey,
 OrganizationCustomRoleKey,
 ServerGetToken,
 ServerGetTokenOptions,
} from '@clerk/types';
Expand DownExpand Up@@ -38,14 +40,12 @@ export type SignedInAuthObject = {
 userId: string;
 user: User | undefined;
 orgId: string | undefined;
 orgRole: string | undefined;
 orgRole: OrganizationCustomRoleKey | undefined;
 orgSlug: string | undefined;
 orgPermissions: OrganizationCustomPermissionKey[] | undefined;
 organization: Organization | undefined;
 getToken: ServerGetToken;
 /**
 * @experimental The method is experimental and subject to change in future releases.
 */
 experimental__has: experimental__CheckAuthorizationWithoutPermission;
 has: CheckAuthorizationWithCustomPermissions;
 debug: AuthObjectDebug;
};

Expand All@@ -59,12 +59,10 @@ export type SignedOutAuthObject = {
 orgId: null;
 orgRole: null;
 orgSlug: null;
 orgPermissions: null;
 organization: null;
 getToken: ServerGetToken;
 /**
 * @experimental The method is experimental and subject to change in future releases.
 */
 experimental__has: experimental__CheckAuthorizationWithoutPermission;
 has: CheckAuthorizationWithCustomPermissions;
 debug: AuthObjectDebug;
};

Expand All@@ -91,6 +89,7 @@ export function signedInAuthObject(
 org_id: orgId,
 org_role: orgRole,
 org_slug: orgSlug,
 org_permissions: orgPermissions,
 sub: userId,
 } = sessionClaims;
 const { apiKey, secretKey, apiUrl, apiVersion, token, session, user, organization } = options;
Expand DownExpand Up@@ -122,9 +121,10 @@ export function signedInAuthObject(
 orgId,
 orgRole,
 orgSlug,
 orgPermissions,
 organization,
 getToken,
experimental__has: createHasAuthorization({ orgId, orgRole, userId }),
has: createHasAuthorization({ orgId, orgRole, orgPermissions, userId }),
 debug: createDebug({ ...options, ...debugData }),
 };
}
Expand All@@ -144,9 +144,10 @@ export function signedOutAuthObject(debugData?: AuthObjectDebugData): SignedOutA
 orgId: null,
 orgRole: null,
 orgSlug: null,
 orgPermissions: null,
 organization: null,
 getToken: () => Promise.resolve(null),
experimental__has: () => false,
has: () => false,
 debug: createDebug(debugData),
 };
}
Expand DownExpand Up@@ -192,7 +193,7 @@ export function sanitizeAuthObject<T extends Record<any, any>>(authObject: T): T
export const makeAuthObjectSerializable = <T extends Record<string, unknown>>(obj: T): T => {
 // remove any non-serializable props from the returned object

 const { debug, getToken, experimental__has, ...rest } = obj as unknown as AuthObject;
 const { debug, getToken, has, ...rest } = obj as unknown as AuthObject;
 return rest as unknown as T;
};

Expand DownExpand Up@@ -221,27 +222,30 @@ const createHasAuthorization =
 orgId,
 orgRole,
 userId,
 orgPermissions,
 }: {
 userId: string;
 orgId: string | undefined;
 orgRole: string | undefined;
 }): experimental__CheckAuthorizationWithoutPermission =>
 orgPermissions: string[] | undefined;
 }): CheckAuthorizationWithCustomPermissions =>
 params => {
 if (!orgId || !userId) {
 if (!params?.permission && !params?.role) {
 throw new Error(
 'Missing parameters. `has` from `auth` or `getAuth` requires a permission or role key to be passed. Example usage: `has({permission: "org:posts:edit"`',
 );
 }

 if (!orgId || !userId || !orgRole || !orgPermissions) {
 return false;
 }

 if (params.role) {
 return orgRole === params.role;
 if (params.permission) {
 return orgPermissions.includes(params.permission);
 }

 if (params.some) {
 return !!params.some.find(permObj => {
 if (permObj.role) {
 return orgRole === permObj.role;
 }
 return false;
 });
 if (params.role) {
 return orgRole === params.role;
 }

 return false;
Expand Down

2 changes: 1 addition & 1 deletion
packages/chrome-extension/src/__snapshots__/exports.test.ts.snap

View file


Open in desktop

Original file line numberDiff line numberDiff line change
Expand Up@@ -8,12 +8,12 @@ exports[`public exports should not include a breaking change 1`] = `
 "ClerkProvider",
 "CreateOrganization",
 "EmailLinkErrorCode",
 "Experimental__Gate",
 "MagicLinkErrorCode",
 "MultisessionAppSupport",
 "OrganizationList",
 "OrganizationProfile",
 "OrganizationSwitcher",
 "Protect",
 "RedirectToCreateOrganization",
 "RedirectToOrganizationProfile",
 "RedirectToSignIn",
Expand Down

9 changes: 2 additions & 7 deletions
packages/clerk-js/src/core/resources/OrganizationMembership.ts

View file


Open in desktop

Original file line numberDiff line numberDiff line change
Expand Up@@ -6,7 +6,7 @@ import type {
 MembershipRole,
 OrganizationMembershipJSON,
 OrganizationMembershipResource,
OrganizationPermission,
OrganizationPermissionKey,
} from '@clerk/types';

import { unixEpochToDate } from '../../utils/date';
Expand All@@ -18,12 +18,7 @@ export class OrganizationMembership extends BaseResource implements Organization
 publicMetadata: OrganizationMembershipPublicMetadata = {};
 publicUserData!: PublicUserData;
 organization!: Organization;
 /**
 * @experimental The property is experimental and subject to change in future releases.
 */
 // Adding (string & {}) allows for getting eslint autocomplete but also accepts any string
 // eslint-disable-next-line
 permissions: (OrganizationPermission | (string & {}))[] = [];
 permissions: OrganizationPermissionKey[] = [];
 role!: MembershipRole;
 createdAt!: Date;
 updatedAt!: Date;
Expand Down

4 changes: 2 additions & 2 deletions
packages/clerk-js/src/core/resources/Session.test.ts

View file


Open in desktop

Original file line numberDiff line numberDiff line change
Expand Up@@ -73,7 +73,7 @@ describe('Session', () => {
 updated_at: new Date().getTime(),
 } as SessionJSON);

 const isAuthorized = await session.experimental__checkAuthorization({ permission: 'org:sys_profile:delete' });
 const isAuthorized = await session.checkAuthorization({ permission: 'org:sys_profile:delete' });

 expect(isAuthorized).toBe(true);
 });
Expand All@@ -93,7 +93,7 @@ describe('Session', () => {
 updated_at: new Date().getTime(),
 } as SessionJSON);

 const isAuthorized = await session.experimental__checkAuthorization({ permission: 'org:sys_profile:delete' });
 const isAuthorized = await session.checkAuthorization({ permission: 'org:sys_profile:delete' });

 expect(isAuthorized).toBe(false);
 });
Expand Down

17 changes: 1 addition & 16 deletions
packages/clerk-js/src/core/resources/Session.ts

View file


Open in desktop

Original file line numberDiff line numberDiff line change
Expand Up@@ -76,10 +76,7 @@ export class Session extends BaseResource implements SessionResource {
 });
 };

 /**
 * @experimental The method is experimental and subject to change in future releases.
 */
 experimental__checkAuthorization: CheckAuthorization = params => {
 checkAuthorization: CheckAuthorization = params => {
 // if there is no active organization user can not be authorized
 if (!this.lastActiveOrganizationId || !this.user) {
 return false;
Expand All@@ -104,18 +101,6 @@ export class Session extends BaseResource implements SessionResource {
 return activeOrganizationRole === params.role;
 }

 if (params.some) {
 return !!params.some.find(permObj => {
 if (permObj.permission) {
 return activeOrganizationPermissions.includes(permObj.permission);
 }
 if (permObj.role) {
 return activeOrganizationRole === permObj.role;
 }
 return false;
 });
 }

 return false;
 };

Expand Down

44 changes: 38 additions & 6 deletions
packages/clerk-js/src/ui/common/Gate.tsx

View file


Open in desktop

Original file line numberDiff line numberDiff line change
@@ -1,30 +1,62 @@
import type { CheckAuthorization } from '@clerk/types';
import type { CheckAuthorization, MembershipRole, OrganizationPermissionKey } from '@clerk/types';
import type { ComponentType, PropsWithChildren, ReactNode } from 'react';
import React, { useEffect } from 'react';

import { useCoreSession } from '../contexts';
import { useRouter } from '../router';

type GateParams = Parameters<CheckAuthorization>[0];
type GateParams = Parameters<CheckAuthorization>[0] | ((has: CheckAuthorization) => boolean);
type GateProps = PropsWithChildren<
 GateParams & {
 (
 | {
 condition?: never;
 role: MembershipRole;
 permission?: never;
 }
 | {
 condition?: never;
 role?: never;
 permission: OrganizationPermissionKey;
 }
 | {
 condition: (has: CheckAuthorization) => boolean;
 role?: never;
 permission?: never;
 }
 ) & {
 fallback?: ReactNode;
 redirectTo?: string;
 }
>;

export const useGate = (params: GateParams) => {
 const { experimental__checkAuthorization } = useCoreSession();
 const { checkAuthorization, id } = useCoreSession();

 if (!id) {
 return { isAuthorizedUser: false };
 }

 /**
 * if a function is passed and returns false then throw not found
 */
 if (typeof params === 'function') {
 if (params(checkAuthorization)) {
 return { isAuthorizedUser: true };
 }
 return { isAuthorizedUser: false };
 }

 return {
 isAuthorizedUser: experimental__checkAuthorization(params),
 isAuthorizedUser: checkAuthorization(params),
 };
};

export const Gate = (gateProps: GateProps) => {
 const { children, fallback, redirectTo, ...restAuthorizedParams } = gateProps;

 const { isAuthorizedUser } = useGate(restAuthorizedParams);
 const { isAuthorizedUser } = useGate(
 typeof restAuthorizedParams.condition === 'function' ? restAuthorizedParams.condition : restAuthorizedParams,
 );

 const { navigate } = useRouter();

Expand Down

14 changes: 5 additions & 9 deletions
packages/clerk-js/src/ui/components/OrganizationProfile/OrganizationProfileNavbar.tsx

View file


Open in desktop

Original file line numberDiff line numberDiff line change
Expand Up@@ -12,16 +12,12 @@ export const OrganizationProfileNavbar = (
 const { organization } = useCoreOrganization();
 const { pages } = useOrganizationProfileContext();

 const { isAuthorizedUser: allowMembersRoute } = useGate({
some: [
 {
 const { isAuthorizedUser: allowMembersRoute } = useGate(
has =>
has({
 permission: 'org:sys_memberships:read',
 },
 {
 permission: 'org:sys_memberships:manage',
 },
 ],
 });
 }) || has({ permission: 'org:sys_memberships:manage' }),
 );

 if (!organization) {
 return null;
Expand Down

6 changes: 4 additions & 2 deletions
packages/clerk-js/src/ui/components/OrganizationProfile/OrganizationProfileRoutes.tsx

View file


Open in desktop

Original file line numberDiff line numberDiff line change
Expand Up@@ -77,7 +77,7 @@ export const OrganizationProfileRoutes = (props: PropsOfComponent<typeof Profile
 </Route>
 <Route path=':id'>
 <Gate
 permission={'org:sys_domains:manage'}
 permission='org:sys_domains:manage'
 redirectTo='../../'
 >
 <VerifiedDomainPage />
Expand DownExpand Up@@ -130,7 +130,9 @@ export const OrganizationProfileRoutes = (props: PropsOfComponent<typeof Profile
 </Route>
 <Route index>
 <Gate
 some={[{ permission: 'org:sys_memberships:read' }, { permission: 'org:sys_memberships:manage' }]}
 condition={has =>
 has({ permission: 'org:sys_memberships:read' }) || has({ permission: 'org:sys_memberships:manage' })
 }
 redirectTo={isSettingsPageRoot ? '../' : './organization-settings'}
 >
 <OrganizationMembers />
Expand Down

2 changes: 1 addition & 1 deletion
packages/clerk-js/src/ui/utils/test/mockHelpers.ts

View file


Open in desktop

Original file line numberDiff line numberDiff line change
Expand Up@@ -35,7 +35,7 @@ export const mockClerkMethods = (clerk: LoadedClerk): DeepJestMocked<LoadedClerk
 mockMethodsOf(clerk.client.signUp);
 clerk.client.sessions.forEach(session => {
 mockMethodsOf(session, {
 exclude: ['experimental__checkAuthorization'],
 exclude: ['checkAuthorization'],
 });
 mockMethodsOf(session.user);
 session.user?.emailAddresses.forEach(m => mockMethodsOf(m));
Expand Down
Loading