diff --git a/clerk/authorization.go b/clerk/authorization.go new file mode 100644 index 00000000..ab53a876 --- /dev/null +++ b/clerk/authorization.go @@ -0,0 +1,47 @@ +package clerk + +import "slices" + +type CheckAuthorizationParams struct { + Permission string + Role string +} + +// CheckAuthorization verifies if the user has the given permission or role. +// Performing role checks is not considered a best-practice and +// developers should avoid it as much as possible. +// Usually, complex role checks can be refactored with a single permission check. +func (c *client) CheckAuthorization(token string, params CheckAuthorizationParams) (bool, error) { + claims, err := c.VerifyToken(token) + if err != nil { + return false, err + } + + permission := params.Permission + role := params.Role + + if permission != "" && slices.Contains(claims.ActiveOrganizationPermissions, permission) { + return true, nil + } + + if claims.ActiveOrganizationRole == role { + return true, nil + } + + return false, nil +} + +// CheckPermission checks if the user has the specific permission +// in their session claims. +func (s *SessionClaims) CheckPermission(permission string) bool { + return slices.Contains(s.ActiveOrganizationPermissions, permission) +} + +// CheckRole checks if the user has the specific role +// in their session claims. +// Performing role checks is not considered a best-practice and +// developers should avoid it as much as possible. +// Usually, complex role checks can be refactored with a single permission check. +func (s *SessionClaims) CheckRole(role string) bool { + return s.ActiveOrganizationRole == role +} diff --git a/clerk/authorization_test.go b/clerk/authorization_test.go new file mode 100644 index 00000000..d6d3450c --- /dev/null +++ b/clerk/authorization_test.go @@ -0,0 +1,90 @@ +package clerk + +import ( + "testing" + + "github.com/go-jose/go-jose/v3" +) + +func TestClient_CheckAuthorization(t *testing.T) { + c, _ := NewClient("token") + token, pubKey := testGenerateTokenJWT(t, dummySessionClaims, "kid") + client := c.(*client) + client.jwksCache.set(testBuildJWKS(t, pubKey, jose.RS256, "kid")) + + // user has permission + hasPermission, err := c.CheckAuthorization( + token, + CheckAuthorizationParams{Permission: "org:billing:manage"}, + ) + if err != nil { + t.Error(err) + } + if !hasPermission { + t.Errorf("Expected user to have permission: %s", "org:billing:manage") + } + + // user does not have permission + hasPermission, err = c.CheckAuthorization( + token, + CheckAuthorizationParams{Permission: "org:billing:create"}, + ) + if err != nil { + t.Error(err) + } + if hasPermission { + t.Errorf("Expected user to not have permission: %s", "org:billing:create") + } + + // user has role + hasRole, err := c.CheckAuthorization( + token, + CheckAuthorizationParams{Role: "org_role"}, + ) + if err != nil { + t.Error(err) + } + if !hasRole { + t.Errorf("Expected user to have role: %s", "org_role") + } + + // user does not have role + hasRole, err = c.CheckAuthorization( + token, + CheckAuthorizationParams{Role: "org_role_nonexistent"}, + ) + if err != nil { + t.Error(err) + } + if hasRole { + t.Errorf("Expected user to not have role: %s", "org_role_nonexistent") + } +} + +func TestSessionClaims_CheckPermission(t *testing.T) { + // user has permission + hasPermission := dummySessionClaims.CheckPermission("org:billing:manage") + if !hasPermission { + t.Errorf("Expected user to have permission: %s", "org:billing:manage") + } + + // user does not have permission + hasPermission = dummySessionClaims.CheckPermission("org:billing:create") + if hasPermission { + t.Errorf("Expected user to not have permission: %s", "org:billing:create") + } +} + +func TestSessionClaims_CheckRole(t *testing.T) { + // user has role + hasRole := dummySessionClaims.CheckRole("org_role") + if !hasRole { + t.Errorf("Expected user to have role: %s", "org_role") + } + + // user does not have role + hasRole = dummySessionClaims.CheckPermission("org_role_nonexistent") + if hasRole { + t.Errorf("Expected user to not have role: %s", "org_role_nonexistent") + } +} diff --git a/clerk/clerk.go b/clerk/clerk.go index f5d125d2..38abf094 100644 --- a/clerk/clerk.go +++ b/clerk/clerk.go @@ -49,6 +49,7 @@ type Client interface { DecodeToken(token string) (*TokenClaims, error) VerifyToken(token string, opts ...VerifyTokenOption) (*SessionClaims, error) + CheckAuthorization(token string, params CheckAuthorizationParams) (bool, error) Allowlists() *AllowlistsService Blocklists() *BlocklistsService diff --git a/go.mod b/go.mod index 7110e7aa..96a2aec2 100644 --- a/go.mod +++ b/go.mod @@ -1,11 +1,16 @@ module github.com/clerkinc/clerk-sdk-go -go 1.16 +go 1.21 require ( - github.com/brianvoe/gofakeit/v6 v6.19.0 - github.com/go-jose/go-jose/v3 v3.0.0 - github.com/google/go-cmp v0.5.6 // indirect - github.com/stretchr/testify v1.7.0 - golang.org/x/crypto v0.1.0 // indirect + github.com/brianvoe/gofakeit/v6 v6.26.4 + github.com/go-jose/go-jose/v3 v3.0.1 + github.com/stretchr/testify v1.8.4 +) + +require ( + github.com/davecgh/go-spew v1.1.1 // indirect + github.com/pmezard/go-difflib v1.0.0 // indirect + golang.org/x/crypto v0.0.0-20190911031432-227b76d455e7 // indirect + gopkg.in/yaml.v3 v3.0.1 // indirect ) diff --git a/go.sum b/go.sum index 2c160d8c..d4bf07cf 100644 --- a/go.sum +++ b/go.sum @@ -1,52 +1,28 @@ -github.com/brianvoe/gofakeit/v6 v6.19.0 h1:g+yJ+meWVEsAmR+bV4mNM/eXI0N+0pZ3D+Mi+G5+YQo= -github.com/brianvoe/gofakeit/v6 v6.19.0/go.mod h1:Ow6qC71xtwm79anlwKRlWZW6zVq9D2XHE4QSSMP/rU8= -github.com/davecgh/go-spew v1.1.0 h1:ZDRjVQ15GmhC3fiQ8ni8+OwkZQO4DARzQgrnXU1Liz8= +github.com/brianvoe/gofakeit/v6 v6.26.4 h1:+7JwTAXxw46Hdo1hA/F92Wi7x8vTwbjdFtBWYdm8eII= +github.com/brianvoe/gofakeit/v6 v6.26.4/go.mod h1:Xj58BMSnFqcn/fAQeSK+/PLtC5kSb7FJIq4JyGa8vEs= github.com/davecgh/go-spew v1.1.0/go.mod h1:J7Y8YcW2NihsgmVo/mv3lAwl/skON4iLHjSsI+c5H38= -github.com/go-jose/go-jose/v3 v3.0.0 h1:s6rrhirfEP/CGIoc6p+PZAeogN2SxKav6Wp7+dyMWVo= -github.com/go-jose/go-jose/v3 v3.0.0/go.mod h1:RNkWWRld676jZEYoV3+XK8L2ZnNSvIsxFMht0mSX+u8= +github.com/davecgh/go-spew v1.1.1 h1:vj9j/u1bqnvCEfJOwUhtlOARqs3+rkHYY13jYWTU97c= +github.com/davecgh/go-spew v1.1.1/go.mod h1:J7Y8YcW2NihsgmVo/mv3lAwl/skON4iLHjSsI+c5H38= +github.com/go-jose/go-jose/v3 v3.0.1 h1:pWmKFVtt+Jl0vBZTIpz/eAKwsm6LkIxDVVbFHKkchhA= +github.com/go-jose/go-jose/v3 v3.0.1/go.mod h1:RNkWWRld676jZEYoV3+XK8L2ZnNSvIsxFMht0mSX+u8= +github.com/google/go-cmp v0.5.0 h1:/QaMHBdZ26BB3SSst0Iwl10Epc+xhTquomWX0oZEB6w= github.com/google/go-cmp v0.5.0/go.mod h1:v8dTdLbMG2kIc/vJvl+f65V22dbkXbowE6jgT/gNBxE= -github.com/google/go-cmp v0.5.6 h1:BKbKCqvP6I+rmFHt06ZmyQtvB8xAkWdhFyr0ZUNZcxQ= -github.com/google/go-cmp v0.5.6/go.mod h1:v8dTdLbMG2kIc/vJvl+f65V22dbkXbowE6jgT/gNBxE= github.com/pmezard/go-difflib v1.0.0 h1:4DBwDE0NGyQoBHbLQYPwSUPoCMWR5BEzIk/f1lZbAQM= github.com/pmezard/go-difflib v1.0.0/go.mod h1:iKH77koFhYxTK1pcRnkKkqfTogsbg7gZNVY4sRDYZ/4= github.com/stretchr/objx v0.1.0/go.mod h1:HFkY916IF+rwdDfMAkV7OtwuqBVzrE8GR6GFx+wExME= github.com/stretchr/testify v1.6.1/go.mod h1:6Fq8oRcR53rry900zMqJjRRixrwX3KX962/h/Wwjteg= -github.com/stretchr/testify v1.7.0 h1:nwc3DEeHmmLAfoZucVR881uASk0Mfjw8xYJ99tb5CcY= -github.com/stretchr/testify v1.7.0/go.mod h1:6Fq8oRcR53rry900zMqJjRRixrwX3KX962/h/Wwjteg= -github.com/yuin/goldmark v1.4.13/go.mod h1:6yULJ656Px+3vBD8DxQVa3kxgyrAnzto9xy5taEt/CY= +github.com/stretchr/testify v1.8.4 h1:CcVxjf3Q8PM0mHUKJCdn+eZZtm5yQwehR5yeSVQQcUk= +github.com/stretchr/testify v1.8.4/go.mod h1:sz/lmYIOXD/1dqDmKjjqLyZ2RngseejIcXlSw2iwfAo= golang.org/x/crypto v0.0.0-20190308221718-c2843e01d9a2/go.mod h1:djNgcEr1/C05ACkg1iLfiJU5Ep61QUkGW8qpdssI0+w= +golang.org/x/crypto v0.0.0-20190911031432-227b76d455e7 h1:0hQKqeLdqlt5iIwVOBErRisrHJAN57yOiPRQItI20fU= golang.org/x/crypto v0.0.0-20190911031432-227b76d455e7/go.mod h1:yigFU9vqHzYiE8UmvKecakEJjdnWj3jj499lnFckfCI= -golang.org/x/crypto v0.0.0-20210921155107-089bfa567519/go.mod h1:GvvjBRRGRdwPK5ydBHafDWAxML/pGHZbMvKqRZ5+Abc= -golang.org/x/crypto v0.1.0 h1:MDRAIl0xIo9Io2xV565hzXHw3zVseKrJKodhohM5CjU= -golang.org/x/crypto v0.1.0/go.mod h1:RecgLatLF4+eUMCP1PoPZQb+cVrJcOPbHkTkbkB9sbw= -golang.org/x/mod v0.6.0-dev.0.20220419223038-86c51ed26bb4/go.mod h1:jJ57K6gSWd91VN4djpZkiMVwK6gcyfeH4XE8wZrZaV4= golang.org/x/net v0.0.0-20190404232315-eb5bcb51f2a3/go.mod h1:t9HGtf8HONx5eT2rtn7q6eTqICYqUVnKs3thJo3Qplg= -golang.org/x/net v0.0.0-20190620200207-3b0461eec859/go.mod h1:z5CRVTTTmAJ677TzLLGU+0bjPO0LkuOLi4/5GtJWs/s= -golang.org/x/net v0.0.0-20210226172049-e18ecbb05110/go.mod h1:m0MpNAwzfU5UDzcl9v0D8zg8gWTRqZa9RBIspLL5mdg= -golang.org/x/net v0.0.0-20220722155237-a158d28d115b/go.mod h1:XRhObCWvk6IyKnWLug+ECip1KBveYUHfp+8e9klMJ9c= -golang.org/x/net v0.1.0/go.mod h1:Cx3nUiGt4eDBEyega/BKRp+/AlGL8hYe7U9odMt2Cco= -golang.org/x/sync v0.0.0-20190423024810-112230192c58/go.mod h1:RxMgew5VJxzue5/jJTE5uejpjVlOe/izrB70Jof72aM= -golang.org/x/sync v0.0.0-20220722155255-886fb9371eb4/go.mod h1:RxMgew5VJxzue5/jJTE5uejpjVlOe/izrB70Jof72aM= golang.org/x/sys v0.0.0-20190215142949-d0b11bdaac8a/go.mod h1:STP8DvDyc/dI5b8T5hshtkjS+E42TnysNCUPdjciGhY= golang.org/x/sys v0.0.0-20190412213103-97732733099d/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs= -golang.org/x/sys v0.0.0-20201119102817-f84b799fce68/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs= -golang.org/x/sys v0.0.0-20210615035016-665e8c7367d1/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg= -golang.org/x/sys v0.0.0-20220520151302-bc2c85ada10a/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg= -golang.org/x/sys v0.0.0-20220722155257-8c9f86f7a55f/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg= -golang.org/x/sys v0.1.0/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg= -golang.org/x/term v0.0.0-20201126162022-7de9c90e9dd1/go.mod h1:bj7SfCRtBDWHUb9snDiAeCFNEtKQo2Wmx5Cou7ajbmo= -golang.org/x/term v0.0.0-20210927222741-03fcf44c2211/go.mod h1:jbD1KX2456YbFQfuXm/mYQcufACuNUgVhRMnK/tPxf8= -golang.org/x/term v0.1.0/go.mod h1:jbD1KX2456YbFQfuXm/mYQcufACuNUgVhRMnK/tPxf8= golang.org/x/text v0.3.0/go.mod h1:NqM8EUOU14njkJ3fqMW+pc6Ldnwhi/IjpwHt7yyuwOQ= -golang.org/x/text v0.3.3/go.mod h1:5Zoc/QRtKVWzQhOtBMvqHzDpF6irO9z98xDceosuGiQ= -golang.org/x/text v0.3.7/go.mod h1:u+2+/6zg+i71rQMx5EYifcz6MCKuco9NR6JIITiCfzQ= -golang.org/x/text v0.4.0/go.mod h1:mrYo+phRRbMaCq/xk9113O4dZlRixOauAjOtrjsXDZ8= -golang.org/x/tools v0.0.0-20180917221912-90fa682c2a6e/go.mod h1:n7NCudcB/nEzxVGmLbDWY5pfWTLqBcC2KZ6jyYvM4mQ= -golang.org/x/tools v0.0.0-20191119224855-298f0cb1881e/go.mod h1:b+2E5dAYhXwXZwtnZ6UAqBI28+e2cm9otk0dWdXHAEo= -golang.org/x/tools v0.1.12/go.mod h1:hNGJHUnrk76NpqgfD5Aqm5Crs+Hm0VOH/i9J2+nxYbc= -golang.org/x/xerrors v0.0.0-20190717185122-a985d3407aa7/go.mod h1:I/5z698sn9Ka8TeJc9MKroUUfqBBauWjQqLJ2OPfmY0= golang.org/x/xerrors v0.0.0-20191204190536-9bdfabe68543/go.mod h1:I/5z698sn9Ka8TeJc9MKroUUfqBBauWjQqLJ2OPfmY0= gopkg.in/check.v1 v0.0.0-20161208181325-20d25e280405 h1:yhCVgyC4o1eVCa2tZl7eS0r+SDo693bJlVdllGtEeKM= gopkg.in/check.v1 v0.0.0-20161208181325-20d25e280405/go.mod h1:Co6ibVJAznAaIkqp8huTwlJQCZ016jof/cbN4VW5Yz0= -gopkg.in/yaml.v3 v3.0.0-20200313102051-9f266ea9e77c h1:dUUwHk2QECo/6vqA44rthZ8ie2QXMNeKRTHCNY2nXvo= gopkg.in/yaml.v3 v3.0.0-20200313102051-9f266ea9e77c/go.mod h1:K4uyk7z7BCEPqu6E+C64Yfv1cQ7kz7rIZviUmN+EgEM= +gopkg.in/yaml.v3 v3.0.1 h1:fxVm/GzAzEWqLHuvctI91KS9hhNmmWOoWu0XTYJS7CA= +gopkg.in/yaml.v3 v3.0.1/go.mod h1:K4uyk7z7BCEPqu6E+C64Yfv1cQ7kz7rIZviUmN+EgEM=