-
Notifications
You must be signed in to change notification settings - Fork 20
Commit
This commit does not belong to any branch on this repository, and may belong to a fork outside of the repository.
feat: Add helper methods to check for authorization
using permissions and roles
- Loading branch information
1 parent
fede4e5
commit 2ceaad2
Showing
6 changed files
with
147 additions
and
27 deletions.
There are no files selected for viewing
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,47 @@ | ||
| package clerk | ||
|
|
||
| import "slices" | ||
|
|
||
| type CheckAuthorizationParams struct { | ||
| Permission string | ||
| Role string | ||
| } | ||
|
|
||
| // CheckAuthorization verifies if the user has the given permission or role. | ||
| // Performing role checks is not considered a best-practice and | ||
| // developers should avoid it as much as possible. | ||
| // Usually, complex role checks can be refactored with a single permission check. | ||
| func (c *client) CheckAuthorization(token string, params CheckAuthorizationParams) (bool, error) { | ||
| claims, err := c.VerifyToken(token) | ||
| if err != nil { | ||
| return false, err | ||
| } | ||
|
|
||
| permission := params.Permission | ||
| role := params.Role | ||
|
|
||
| if permission != "" && slices.Contains(claims.ActiveOrganizationPermissions, permission) { | ||
| return true, nil | ||
| } | ||
|
|
||
| if claims.ActiveOrganizationRole == role { | ||
| return true, nil | ||
| } | ||
|
|
||
| return false, nil | ||
| } | ||
|
|
||
| // CheckPermission checks if the user has the specific permission | ||
| // in their session claims. | ||
| func (s *SessionClaims) CheckPermission(permission string) bool { | ||
| return slices.Contains(s.ActiveOrganizationPermissions, permission) | ||
| } | ||
|
|
||
| // CheckRole checks if the user has the specific role | ||
| // in their session claims. | ||
| // Performing role checks is not considered a best-practice and | ||
| // developers should avoid it as much as possible. | ||
| // Usually, complex role checks can be refactored with a single permission check. | ||
| func (s *SessionClaims) CheckRole(role string) bool { | ||
| return s.ActiveOrganizationRole == role | ||
| } |
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,90 @@ | ||
| package clerk | ||
|
|
||
| import ( | ||
| "testing" | ||
|
|
||
| "github.com/go-jose/go-jose/v3" | ||
| ) | ||
|
|
||
| func TestClient_CheckAuthorization(t *testing.T) { | ||
| c, _ := NewClient("token") | ||
| token, pubKey := testGenerateTokenJWT(t, dummySessionClaims, "kid") | ||
| client := c.(*client) | ||
| client.jwksCache.set(testBuildJWKS(t, pubKey, jose.RS256, "kid")) | ||
|
|
||
| // user has permission | ||
| hasPermission, err := c.CheckAuthorization( | ||
| token, | ||
| CheckAuthorizationParams{Permission: "org:billing:manage"}, | ||
| ) | ||
| if err != nil { | ||
| t.Error(err) | ||
| } | ||
| if !hasPermission { | ||
| t.Errorf("Expected user to have permission: %s", "org:billing:manage") | ||
| } | ||
|
|
||
| // user does not have permission | ||
| hasPermission, err = c.CheckAuthorization( | ||
| token, | ||
| CheckAuthorizationParams{Permission: "org:billing:create"}, | ||
| ) | ||
| if err != nil { | ||
| t.Error(err) | ||
| } | ||
| if hasPermission { | ||
| t.Errorf("Expected user to not have permission: %s", "org:billing:create") | ||
| } | ||
|
|
||
| // user has role | ||
| hasRole, err := c.CheckAuthorization( | ||
| token, | ||
| CheckAuthorizationParams{Role: "org_role"}, | ||
| ) | ||
| if err != nil { | ||
| t.Error(err) | ||
| } | ||
| if !hasRole { | ||
| t.Errorf("Expected user to have role: %s", "org_role") | ||
| } | ||
|
|
||
| // user does not have role | ||
| hasRole, err = c.CheckAuthorization( | ||
| token, | ||
| CheckAuthorizationParams{Role: "org_role_nonexistent"}, | ||
| ) | ||
| if err != nil { | ||
| t.Error(err) | ||
| } | ||
| if hasRole { | ||
| t.Errorf("Expected user to not have role: %s", "org_role_nonexistent") | ||
| } | ||
| } | ||
|
|
||
| func TestSessionClaims_CheckPermission(t *testing.T) { | ||
| // user has permission | ||
| hasPermission := dummySessionClaims.CheckPermission("org:billing:manage") | ||
| if !hasPermission { | ||
| t.Errorf("Expected user to have permission: %s", "org:billing:manage") | ||
| } | ||
|
|
||
| // user does not have permission | ||
| hasPermission = dummySessionClaims.CheckPermission("org:billing:create") | ||
| if hasPermission { | ||
| t.Errorf("Expected user to not have permission: %s", "org:billing:create") | ||
| } | ||
| } | ||
|
|
||
| func TestSessionClaims_CheckRole(t *testing.T) { | ||
| // user has role | ||
| hasRole := dummySessionClaims.CheckRole("org_role") | ||
| if !hasRole { | ||
| t.Errorf("Expected user to have role: %s", "org_role") | ||
| } | ||
|
|
||
| // user does not have role | ||
| hasRole = dummySessionClaims.CheckPermission("org_role_nonexistent") | ||
| if hasRole { | ||
| t.Errorf("Expected user to not have role: %s", "org_role_nonexistent") | ||
| } | ||
| } |
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -1,11 +1,17 @@ | ||
| module github.com/clerkinc/clerk-sdk-go | ||
|
|
||
| go 1.16 | ||
| go 1.21 | ||
|
|
||
| require ( | ||
| github.com/brianvoe/gofakeit/v6 v6.19.0 | ||
| github.com/go-jose/go-jose/v3 v3.0.0 | ||
| github.com/google/go-cmp v0.5.6 // indirect | ||
| github.com/stretchr/testify v1.7.0 | ||
| ) | ||
|
|
||
| require ( | ||
| github.com/davecgh/go-spew v1.1.0 // indirect | ||
| github.com/google/go-cmp v0.5.6 // indirect | ||
| github.com/pmezard/go-difflib v1.0.0 // indirect | ||
| golang.org/x/crypto v0.1.0 // indirect | ||
| gopkg.in/yaml.v3 v3.0.0-20200313102051-9f266ea9e77c // indirect | ||
| ) |
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters