Skip to content

feat(backend): WIP M2M#5564

Closed
wobsoriano wants to merge 55 commits into
mainfrom
rob/robo-36-sdk-implement-support-for-m2m-tokens
Closed

feat(backend): WIP M2M#5564
wobsoriano wants to merge 55 commits into
mainfrom
rob/robo-36-sdk-implement-support-for-m2m-tokens

Conversation

@wobsoriano

@wobsoriano wobsoriano commented Apr 9, 2025

Copy link
Copy Markdown
Member

Description

This is a work-in-progress PR for adding Machine-to-Machine requests in the Backend SDK. Soon, you'll be able to do:

From C1:

import { Hono } from 'hono'
import { createMiddleware } from 'hono/factory'

const app = new Hono()

const clerkMiddleware = createMiddleware(async (c, next) => {
  const authReq = await clerkClient.authenticateRequest(c.req.raw, {
    entity: 'any'
  })

  if (!authReq.isSignedIn) {
    throw new HTTPException(401, { message: 'Not authorized' })
  }
  
  const authObject = authReq.toAuth({ entity: 'any' })
  
  if (authObject.entity === 'user') {
    const { userId, sessionClaims } = authObject
    // do something
  }
  
  if (authObject.entity === 'api_key') {
    const { machineId, userId: userId2, claims } = authObject
    // do something
  }

  await next()
})

app.post('/api/protected', clerkMiddleware, async (c, next) => {
  return c.text('Hello from /api/protected')
})

From C2:

const resp = await fetch('https://c1-site.com/api/protected', {
  method: 'POST',
  headers: {
    'Content-Type': 'application/json',
    'Authorization': `Bearer api_key_foobaryeah1234567890`
  },
})

Checklist

  • pnpm test runs as expected.
  • pnpm build runs as expected.
  • (If applicable) JSDoc comments have been added or updated for any package exports
  • (If applicable) Documentation has been updated

Type of change

  • 🐛 Bug fix
  • 🌟 New feature
  • 🔨 Breaking change
  • 📖 Refactoring / dependency upgrade / documentation
  • other:

@changeset-bot

changeset-bot Bot commented Apr 9, 2025

Copy link
Copy Markdown

⚠️ No Changeset found

Latest commit: 8503eda

Merging this PR will not cause a version bump for any packages. If these changes should not result in a new version, you're good to go. If these changes should result in a version bump, you need to add a changeset.

This PR includes no changesets

When changesets are added to this PR, you'll see the packages that this PR includes changesets for and the associated semver types

Click here to learn what changesets are, and how to add one.

Click here if you're a maintainer who wants to add a changeset to this PR

@vercel

vercel Bot commented Apr 9, 2025

Copy link
Copy Markdown

The latest updates on your projects. Learn more about Vercel for Git ↗︎

Name Status Preview Comments Updated (UTC)
clerk-js-sandbox ✅ Ready (Inspect) Visit Preview 💬 Add feedback Apr 22, 2025 0:03am


const result = await verifyMachineAuthToken(token, {
apiUrl: 'https://api.clerk.test',
secretKey: 'a-valid-key',

Check failure

Code scanning / CodeQL

Hard-coded credentials

The hard-coded value "a-valid-key" is used as [authorization header](1).

const result = await verifyMachineAuthToken(token, {
apiUrl: 'https://api.clerk.test',
secretKey: 'a-valid-key',

Check failure

Code scanning / CodeQL

Hard-coded credentials

The hard-coded value "a-valid-key" is used as [authorization header](1).

const result = await verifyMachineAuthToken(token, {
apiUrl: 'https://api.clerk.test',
secretKey: 'a-valid-key',

Check failure

Code scanning / CodeQL

Hard-coded credentials

The hard-coded value "a-valid-key" is used as [authorization header](1).

const result = await verifyMachineAuthToken(token, {
apiUrl: 'https://api.clerk.test',
secretKey: 'a-valid-key',

Check failure

Code scanning / CodeQL

Hard-coded credentials

The hard-coded value "a-valid-key" is used as [authorization header](1).

const result = await verifyMachineAuthToken(token, {
apiUrl: 'https://api.clerk.test',
secretKey: 'a-valid-key',

Check failure

Code scanning / CodeQL

Hard-coded credentials

The hard-coded value "a-valid-key" is used as [authorization header](1).

const result = await verifyMachineAuthToken(token, {
apiUrl: 'https://api.clerk.test',
secretKey: 'a-valid-key',

Check failure

Code scanning / CodeQL

Hard-coded credentials

The hard-coded value "a-valid-key" is used as [authorization header](1).

const result = await verifyMachineAuthToken(token, {
apiUrl: 'https://api.clerk.test',
secretKey: 'a-valid-key',

Check failure

Code scanning / CodeQL

Hard-coded credentials

The hard-coded value "a-valid-key" is used as [authorization header](1).

const result = await verifyMachineAuthToken(token, {
apiUrl: 'https://api.clerk.test',
secretKey: 'a-valid-key',

Check failure

Code scanning / CodeQL

Hard-coded credentials

The hard-coded value "a-valid-key" is used as [authorization header](1).

const result = await verifyMachineAuthToken(token, {
apiUrl: 'https://api.clerk.test',
secretKey: 'a-valid-key',

Check failure

Code scanning / CodeQL

Hard-coded credentials

The hard-coded value "a-valid-key" is used as [authorization header](1).
Comment thread packages/backend/src/tokens/__tests__/request.test.ts Fixed
Comment thread packages/backend/src/tokens/__tests__/request.test.ts Fixed
Comment thread packages/backend/src/tokens/__tests__/request.test.ts Fixed
Comment thread packages/backend/src/tokens/__tests__/request.test.ts Fixed
@@ -0,0 +1,47 @@
export const mockApiKey = 'api_key_LCWGdaM8mv8K4PC/57IICZQXAeWfCgF30DZaFXHoGn9=';

Check failure

Code scanning / CodeQL

Hard-coded credentials

The hard-coded value "api_key_LCWGdaM8mv8K4PC/57IICZQXAeWfCgF30DZaFXHoGn9=" is used as [authorization header](1). The hard-coded value "api_key_LCWGdaM8mv8K4PC/57IICZQXAeWfCgF30DZaFXHoGn9=" is used as [authorization header](2).
@wobsoriano

Copy link
Copy Markdown
Member Author

Closed in favor of #5689

@wobsoriano wobsoriano closed this Apr 24, 2025
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Projects

None yet

Development

Successfully merging this pull request may close these issues.

3 participants