@clerk/nextjs/dist/esm/server/data/getAuthDataFromRequest.js

Clerk SDK for NextJS

import "../../chunk-BUSYA2B4.js";
import {
  authenticatedMachineObject,
  AuthStatus,
  constants,
  getAuthObjectForAcceptedToken,
  getAuthObjectFromJwt,
  getMachineTokenType,
  invalidTokenAuthObject,
  isMachineTokenByPrefix,
  isTokenTypeAccepted,
  signedOutAuthObject,
  TokenType,
  unauthenticatedMachineObject,
  verifyMachineAuthToken
} from "@clerk/backend/internal";
import { decodeJwt } from "@clerk/backend/jwt";
import { API_URL, API_VERSION, PUBLISHABLE_KEY, SECRET_KEY } from "../constants";
import { getAuthKeyFromRequest, getHeader } from "../headers-utils";
import { assertTokenSignature, decryptClerkRequestData } from "../utils";
const getAuthDataFromRequestSync = (req, { treatPendingAsSignedOut = true, ...opts } = {}) => {
  var _a, _b;
  const { authStatus, authMessage, authReason, authToken, authSignature } = getAuthHeaders(req);
  (_a = opts.logger) == null ? void 0 : _a.debug("headers", { authStatus, authMessage, authReason });
  const encryptedRequestData = getHeader(req, constants.Headers.ClerkRequestData);
  const decryptedRequestData = decryptClerkRequestData(encryptedRequestData);
  const options = {
    secretKey: (opts == null ? void 0 : opts.secretKey) || decryptedRequestData.secretKey || SECRET_KEY,
    publishableKey: decryptedRequestData.publishableKey || PUBLISHABLE_KEY,
    apiUrl: API_URL,
    apiVersion: API_VERSION,
    authStatus,
    authMessage,
    authReason,
    treatPendingAsSignedOut
  };
  if (!isTokenTypeAccepted(TokenType.SessionToken, opts.acceptsToken || TokenType.SessionToken)) {
    return signedOutAuthObject(options);
  }
  let authObject;
  if (!authStatus || authStatus !== AuthStatus.SignedIn) {
    authObject = signedOutAuthObject(options);
  } else {
    assertTokenSignature(authToken, options.secretKey, authSignature);
    const jwt = decodeJwt(authToken);
    (_b = opts.logger) == null ? void 0 : _b.debug("jwt", jwt.raw);
    return getAuthObjectFromJwt(jwt, options);
  }
  return authObject;
};
const handleMachineToken = async (bearerToken, acceptsToken, options) => {
  const hasMachineToken = bearerToken && isMachineTokenByPrefix(bearerToken);
  const acceptsOnlySessionToken = acceptsToken === TokenType.SessionToken || Array.isArray(acceptsToken) && acceptsToken.length === 1 && acceptsToken[0] === TokenType.SessionToken;
  if (hasMachineToken && !acceptsOnlySessionToken) {
    const machineTokenType = getMachineTokenType(bearerToken);
    if (Array.isArray(acceptsToken) && !acceptsToken.includes(machineTokenType)) {
      return invalidTokenAuthObject();
    }
    if (!Array.isArray(acceptsToken) && acceptsToken !== "any" && machineTokenType !== acceptsToken) {
      const authObject2 = unauthenticatedMachineObject(acceptsToken, options);
      return getAuthObjectForAcceptedToken({ authObject: authObject2, acceptsToken });
    }
    const { data, errors } = await verifyMachineAuthToken(bearerToken, options);
    const authObject = errors ? unauthenticatedMachineObject(machineTokenType, options) : authenticatedMachineObject(machineTokenType, bearerToken, data);
    return getAuthObjectForAcceptedToken({ authObject, acceptsToken });
  }
  return null;
};
const getAuthDataFromRequestAsync = async (req, opts = {}) => {
  var _a, _b;
  const { authStatus, authMessage, authReason } = getAuthHeaders(req);
  (_a = opts.logger) == null ? void 0 : _a.debug("headers", { authStatus, authMessage, authReason });
  const bearerToken = (_b = getHeader(req, constants.Headers.Authorization)) == null ? void 0 : _b.replace("Bearer ", "");
  const acceptsToken = opts.acceptsToken || TokenType.SessionToken;
  const options = {
    secretKey: (opts == null ? void 0 : opts.secretKey) || SECRET_KEY,
    publishableKey: PUBLISHABLE_KEY,
    apiUrl: API_URL,
    authStatus,
    authMessage,
    authReason
  };
  const machineAuthObject = await handleMachineToken(bearerToken, acceptsToken, options);
  if (machineAuthObject) {
    return machineAuthObject;
  }
  if (bearerToken && Array.isArray(acceptsToken) && !acceptsToken.includes(TokenType.SessionToken)) {
    return invalidTokenAuthObject();
  }
  const authObject = getAuthDataFromRequestSync(req, opts);
  return getAuthObjectForAcceptedToken({ authObject, acceptsToken });
};
const getAuthHeaders = (req) => {
  const authStatus = getAuthKeyFromRequest(req, "AuthStatus");
  const authToken = getAuthKeyFromRequest(req, "AuthToken");
  const authMessage = getAuthKeyFromRequest(req, "AuthMessage");
  const authReason = getAuthKeyFromRequest(req, "AuthReason");
  const authSignature = getAuthKeyFromRequest(req, "AuthSignature");
  return {
    authStatus,
    authToken,
    authMessage,
    authReason,
    authSignature
  };
};
export {
  getAuthDataFromRequestAsync,
  getAuthDataFromRequestSync
};
//# sourceMappingURL=getAuthDataFromRequest.js.map