fix(express): forward clockSkewInMs in clerkMiddleware

.changeset/red-pans-sing.md

@@ -0,0 +1,5 @@
+---
+"@clerk/express": patch
+---
+
+Forward `clockSkewInMs` from `clerkMiddleware()` to backend `authenticateRequest()`.

packages/express/src/__tests__/clerkMiddleware.test.ts

@@ -12,6 +12,7 @@ vi.mock('@clerk/backend/proxy', async () => {
  };
 });
 
+import { authenticateRequest } from '../authenticateRequest';
 import { clerkMiddleware } from '../clerkMiddleware';
 import { getAuth } from '../getAuth';
 import { assertNoDebugHeaders, assertSignedOutDebugHeaders, runMiddleware, runMiddlewareOnPath } from './helpers';
@@ -94,6 +95,36 @@ describe('clerkMiddleware', () => {
  assertSignedOutDebugHeaders(response);
  });
 
+ it('forwards clockSkewInMs to authenticateRequest', async () => {
+ const authenticateRequestMock = vi.fn().mockResolvedValue({});
+ const clerkClient = {
+ authenticateRequest: authenticateRequestMock,
+ } as any;
+
+ await authenticateRequest({
+ clerkClient,
+ request: {
+ method: 'GET',
+ url: '/',
+ headers: {
+ host: 'example.com',
+ },
+ } as Request,
+ options: {
+ publishableKey: 'pk_test_Y2xlcmsuZXhhbXBsZS5jb20k',
+ secretKey: 'sk_test_....',
+ clockSkewInMs: 12_345,
+ },
+ });
+
+ expect(authenticateRequestMock).toHaveBeenCalledWith(
+ expect.any(Object),
+ expect.objectContaining({
+ clockSkewInMs: 12_345,
+ }),
+ );
+ });
+
  it('throws error if clerkMiddleware is not executed before getAuth', async () => {
  const customMiddleware: RequestHandler = (request, response, next) => {
  const auth = getAuth(request);

packages/express/src/authenticateRequest.ts

@@ -24,7 +24,7 @@
  */
 export const authenticateRequest = (opts: AuthenticateRequestParams) => {
  const { clerkClient, request, options } = opts;
- const { jwtKey, authorizedParties, audience, acceptsToken } = options || {};
+ const { jwtKey, authorizedParties, audience, acceptsToken, clockSkewInMs } = options || {};
 
  const clerkRequest = createClerkRequest(incomingMessageToRequest(request));
  const env = { ...loadApiEnv(), ...loadClientEnv() };
@@ -55,6 +55,7 @@
  machineSecretKey,
  publishableKey,
  jwtKey,
+ clockSkewInMs,
  authorizedParties,
  proxyUrl,
  isSatellite,
@@ -143,7 +144,7 @@
  if (proxyResponse.body) {
  const reader = proxyResponse.body.getReader();
  const stream = new Readable({
  async read() {
  try {
  const { done, value } = await reader.read();
  if (done) {