feat: Add active organization's permission in session claims

When decoding and verifying a session token, we are now parsing any organization permissions that might be included and make them available as part of the SessionClaims struct
clerk · Nov 17, 2023 · 6ac8d1b · 6ac8d1b
1 parent 714a002
commit 6ac8d1b
Show file tree

Hide file tree

Showing 2 changed files with 13 additions and 11 deletions.
diff --git a/clerk/tokens.go b/clerk/tokens.go
@@ -18,12 +18,13 @@ type TokenClaims struct {
 
 type SessionClaims struct {
 	jwt.Claims
-	SessionID              string          `json:"sid"`
-	AuthorizedParty        string          `json:"azp"`
-	ActiveOrganizationID   string          `json:"org_id"`
-	ActiveOrganizationSlug string          `json:"org_slug"`
-	ActiveOrganizationRole string          `json:"org_role"`
-	Actor                  json.RawMessage `json:"act,omitempty"`
+	SessionID                     string          `json:"sid"`
+	AuthorizedParty               string          `json:"azp"`
+	ActiveOrganizationID          string          `json:"org_id"`
+	ActiveOrganizationSlug        string          `json:"org_slug"`
+	ActiveOrganizationRole        string          `json:"org_role"`
+	ActiveOrganizationPermissions []string        `json:"org_permissions"`
+	Actor                         json.RawMessage `json:"act,omitempty"`
 }
 
 // DecodeToken decodes a jwt token without verifying it.

diff --git a/clerk/tokens_test.go b/clerk/tokens_test.go
@@ -48,11 +48,12 @@ var (
 			Expiry:   nil,
 			IssuedAt: nil,
 		},
-		SessionID:              "session_id",
-		AuthorizedParty:        "authorized_party",
-		ActiveOrganizationID:   "org_id",
-		ActiveOrganizationSlug: "org_slug",
-		ActiveOrganizationRole: "org_role",
+		SessionID:                     "session_id",
+		AuthorizedParty:               "authorized_party",
+		ActiveOrganizationID:          "org_id",
+		ActiveOrganizationSlug:        "org_slug",
+		ActiveOrganizationRole:        "org_role",
+		ActiveOrganizationPermissions: []string{"org:billing:manage", "org:report:view"},
 	}
 )