feat(backend): Introduce M2M endpoints authentication using machine secret keys #6229
Conversation
🦋 Changeset detectedLatest commit: 7371a32 The changes in this PR will be included in the next version bump. This PR includes changesets to release 11 packages
Not sure what this means? Click here to learn what changesets are. Click here if you're a maintainer who wants to add another changeset to this PR |
|
The latest updates on your projects. Learn more about Vercel for Git ↗︎
|
wobsoriano
force-pushed
the
rob/user-2264-m2m
branch
from
06c8514 to
af6a27b
Compare
📝 Walkthrough""" WalkthroughThis change implements SDK support for machine-to-machine (M2M) tokens. It introduces a new Estimated code review effort🎯 3 (Moderate) | ⏱️ ~15–25 minutes Assessment against linked issues
Assessment against linked issues: Out-of-scope changesNo out-of-scope changes were found. All significant code changes directly relate to the objectives stated in the linked issue regarding SDK support for M2M token creation, verification, revocation, and flexible authentication. No unrelated features or modifications were observed. Note ⚡️ Unit Test Generation is now available in beta!Learn more here, or try it out under "Finishing Touches" below. 📜 Recent review detailsConfiguration used: CodeRabbit UI 📒 Files selected for processing (2)
🚧 Files skipped from review as they are similar to previous changes (2)
⏰ Context from checks skipped due to timeout of 90000ms. You can increase the timeout in your CodeRabbit configuration to a maximum of 15 minutes (900000ms). (5)
🪧 TipsChatThere are 3 ways to chat with CodeRabbit:
SupportNeed help? Create a ticket on our support page for assistance with any issues or questions. Note: Be mindful of the bot's finite context window. It's strongly recommended to break down tasks such as reading entire modules into smaller chunks. For a focused discussion, use review comments to chat about specific files and their changes, instead of using the PR comments. CodeRabbit Commands (Invoked using PR comments)
Other keywords and placeholders
CodeRabbit Configuration File (
|
@clerk/agent-toolkit
@clerk/astro
@clerk/backend
@clerk/chrome-extension
@clerk/clerk-js
@clerk/dev-cli
@clerk/elements
@clerk/clerk-expo
@clerk/expo-passkeys
@clerk/express
@clerk/fastify
@clerk/localizations
@clerk/nextjs
@clerk/nuxt
@clerk/clerk-react
@clerk/react-router
@clerk/remix
@clerk/shared
@clerk/tanstack-react-start
@clerk/testing
@clerk/themes
@clerk/types
@clerk/upgrade
@clerk/vue
commit: |
![coderabbitai[bot]](https://avatars.githubusercontent.com/in/347564?s=60&v=4){kind=small}
There was a problem hiding this comment.
Actionable comments posted: 2
📜 Review details
Configuration used: CodeRabbit UI
Review profile: CHILL
Plan: Pro
📒 Files selected for processing (4)
.changeset/hot-tables-worry.md(1 hunks)packages/backend/src/api/endpoints/MachineTokensApi.ts(1 hunks)packages/backend/src/api/factory.ts(1 hunks)packages/backend/src/api/request.ts(1 hunks)
🧰 Additional context used
📓 Path-based instructions (5)
`**/*.{js,jsx,ts,tsx}`: All code must pass ESLint checks with the project's conf...
**/*.{js,jsx,ts,tsx}: All code must pass ESLint checks with the project's configuration
Use Prettier for consistent code formatting
Follow established naming conventions (PascalCase for components, camelCase for variables)
Maintain comprehensive JSDoc comments for public APIs
Use dynamic imports for optional features
All public APIs must be documented with JSDoc
Lazy load components and features when possible
Implement proper caching strategies
Use efficient data structures and algorithms
Validate all inputs and sanitize outputs
Implement proper logging with different levels
📄 Source: CodeRabbit Inference Engine (.cursor/rules/development.mdc)
List of files the instruction was applied to:
packages/backend/src/api/request.tspackages/backend/src/api/factory.tspackages/backend/src/api/endpoints/MachineTokensApi.ts
`packages/**/*.ts`: TypeScript is required for all packages
packages/**/*.ts: TypeScript is required for all packages
📄 Source: CodeRabbit Inference Engine (.cursor/rules/development.mdc)
List of files the instruction was applied to:
packages/backend/src/api/request.tspackages/backend/src/api/factory.tspackages/backend/src/api/endpoints/MachineTokensApi.ts
`packages/**/*.{ts,tsx,d.ts}`: Packages should export TypeScript types alongside runtime code
packages/**/*.{ts,tsx,d.ts}: Packages should export TypeScript types alongside runtime code
📄 Source: CodeRabbit Inference Engine (.cursor/rules/development.mdc)
List of files the instruction was applied to:
packages/backend/src/api/request.tspackages/backend/src/api/factory.tspackages/backend/src/api/endpoints/MachineTokensApi.ts
`**/*.{ts,tsx}`: Use proper TypeScript error types
**/*.{ts,tsx}: Use proper TypeScript error types
📄 Source: CodeRabbit Inference Engine (.cursor/rules/development.mdc)
List of files the instruction was applied to:
packages/backend/src/api/request.tspackages/backend/src/api/factory.tspackages/backend/src/api/endpoints/MachineTokensApi.ts
`**/*.{ts,tsx}`: Always define explicit return types for functions, especially p...
**/*.{ts,tsx}: Always define explicit return types for functions, especially public APIs
Use proper type annotations for variables and parameters where inference isn't clear
Avoidanytype - preferunknownwhen type is uncertain, then narrow with type guards
Useinterfacefor object shapes that might be extended
Usetypefor unions, primitives, and computed types
Preferreadonlyproperties for immutable data structures
Useprivatefor internal implementation details
Useprotectedfor inheritance hierarchies
Usepublicexplicitly for clarity in public APIs
Preferreadonlyfor properties that shouldn't change after construction
Use mapped types for transforming object types
Use conditional types for type-level logic
Leverage template literal types for string manipulation
Use ES6 imports/exports consistently
Use default exports sparingly, prefer named exports
Document public functions and APIs with JSDoc-style comments including @param, @returns, @throws, and @example
Define custom error classes for domain-specific errors
Use the Result pattern for error handling instead of throwing exceptions
Use optional chaining and nullish coalescing for safe property access
Let TypeScript infer types when types are obvious
Useconst assertionsfor literal types:as const
Usesatisfiesoperator for type checking without widening
Use readonly arrays and objects for immutability
Use immutable update patterns (spread, etc.) for objects and arrays
Use lazy loading for large types
Preferunknownoveranyfor performance
Use type-only imports:import type { ... }
Use branded types for domain safety
Noanytypes without justification
Proper error handling with typed errors
Consistent use ofreadonlyfor immutable data
Proper generic constraints in TypeScript generics
No unused type parameters in generics
Proper use of utility types instead of manual type construction
Type-only imports where possible for performance
Proper tree-shaking friendly exports
No circular dependencies
Efficient type computations (avoid deep recursion)
📄 Source: CodeRabbit Inference Engine (.cursor/rules/typescript.mdc)
List of files the instruction was applied to:
packages/backend/src/api/request.tspackages/backend/src/api/factory.tspackages/backend/src/api/endpoints/MachineTokensApi.ts
🧠 Learnings (5)
📓 Common learnings
Learnt from: dstaley
PR: clerk/javascript#6116
File: .changeset/tangy-garlics-say.md:1-2
Timestamp: 2025-06-13T16:09:53.061Z
Learning: In the Clerk JavaScript repository, contributors create intentionally empty changeset files (containing only the YAML delimiters) when a PR touches only non-published parts of the codebase (e.g., sandbox assets). This signals that no package release is required, so such changesets should not be flagged as missing content.
Learnt from: wobsoriano
PR: clerk/javascript#6099
File: packages/backend/src/api/endpoints/IdPOAuthAccessTokenApi.ts:7-14
Timestamp: 2025-06-10T20:38:08.982Z
Learning: Methods in `packages/backend/src/api/endpoints` (e.g., `IdPOAuthAccessTokenApi.verifySecret`) are currently not exposed publicly, so renaming them does not constitute a breaking change.
Learnt from: CR
PR: clerk/javascript#0
File: .cursor/rules/development.mdc:0-0
Timestamp: 2025-06-30T10:29:42.997Z
Learning: Update documentation for API changes
Learnt from: wobsoriano
PR: clerk/javascript#6163
File: packages/backend/src/api/endpoints/APIKeysApi.ts:60-70
Timestamp: 2025-06-20T17:44:17.570Z
Learning: The Clerk codebase uses POST method for API key update operations instead of the typical PATCH method, as clarified by the maintainer wobsoriano.
packages/backend/src/api/request.ts (1)
Learnt from: wobsoriano
PR: clerk/javascript#6099
File: packages/backend/src/api/endpoints/IdPOAuthAccessTokenApi.ts:7-14
Timestamp: 2025-06-10T20:38:08.982Z
Learning: Methods in `packages/backend/src/api/endpoints` (e.g., `IdPOAuthAccessTokenApi.verifySecret`) are currently not exposed publicly, so renaming them does not constitute a breaking change.
.changeset/hot-tables-worry.md (4)
Learnt from: dstaley
PR: clerk/javascript#6116
File: .changeset/tangy-garlics-say.md:1-2
Timestamp: 2025-06-13T16:09:53.061Z
Learning: In the Clerk JavaScript repository, contributors create intentionally empty changeset files (containing only the YAML delimiters) when a PR touches only non-published parts of the codebase (e.g., sandbox assets). This signals that no package release is required, so such changesets should not be flagged as missing content.
Learnt from: CR
PR: clerk/javascript#0
File: .cursor/rules/monorepo.mdc:0-0
Timestamp: 2025-06-30T10:30:56.197Z
Learning: Applies to .changeset/config.json : Automated releases must be managed with Changesets.
Learnt from: CR
PR: clerk/javascript#0
File: .cursor/rules/development.mdc:0-0
Timestamp: 2025-06-30T10:29:42.997Z
Learning: Use Changesets for version management and changelogs
Learnt from: jacekradko
PR: clerk/javascript#5905
File: .changeset/six-ears-wash.md:1-3
Timestamp: 2025-06-26T03:27:05.535Z
Learning: In the Clerk JavaScript repository, changeset headers support single quotes syntax (e.g., '@clerk/backend': minor) and work fine with their current changesets integration, so there's no need to change them to double quotes.
packages/backend/src/api/factory.ts (1)
Learnt from: wobsoriano
PR: clerk/javascript#6099
File: packages/backend/src/api/endpoints/IdPOAuthAccessTokenApi.ts:7-14
Timestamp: 2025-06-10T20:38:08.982Z
Learning: Methods in `packages/backend/src/api/endpoints` (e.g., `IdPOAuthAccessTokenApi.verifySecret`) are currently not exposed publicly, so renaming them does not constitute a breaking change.
packages/backend/src/api/endpoints/MachineTokensApi.ts (3)
Learnt from: wobsoriano
PR: clerk/javascript#6099
File: packages/backend/src/api/endpoints/IdPOAuthAccessTokenApi.ts:7-14
Timestamp: 2025-06-10T20:38:08.982Z
Learning: Methods in `packages/backend/src/api/endpoints` (e.g., `IdPOAuthAccessTokenApi.verifySecret`) are currently not exposed publicly, so renaming them does not constitute a breaking change.
Learnt from: CR
PR: clerk/javascript#0
File: .cursor/rules/development.mdc:0-0
Timestamp: 2025-06-30T10:29:42.997Z
Learning: Update documentation for API changes
Learnt from: wobsoriano
PR: clerk/javascript#5858
File: packages/clerk-js/src/core/modules/apiKeys/index.ts:84-97
Timestamp: 2025-06-10T17:35:08.986Z
Learning: In the APIKeys service methods (packages/clerk-js/src/core/modules/apiKeys/index.ts), error handling is intentionally delegated to the component level rather than being implemented within the service methods themselves. This architectural pattern allows calling components to handle errors according to their specific UI needs.
⏰ Context from checks skipped due to timeout of 90000ms (24)
- GitHub Check: Integration Tests (nextjs, chrome, 14)
- GitHub Check: Integration Tests (billing, chrome)
- GitHub Check: Integration Tests (nextjs, chrome, 15)
- GitHub Check: Integration Tests (tanstack-react-router, chrome)
- GitHub Check: Integration Tests (tanstack-react-start, chrome)
- GitHub Check: Integration Tests (nextjs, chrome, 13)
- GitHub Check: Integration Tests (react-router, chrome)
- GitHub Check: Integration Tests (nuxt, chrome)
- GitHub Check: Integration Tests (vue, chrome)
- GitHub Check: Integration Tests (localhost, chrome)
- GitHub Check: Integration Tests (quickstart, chrome)
- GitHub Check: Integration Tests (expo-web, chrome)
- GitHub Check: Integration Tests (express, chrome)
- GitHub Check: Integration Tests (ap-flows, chrome)
- GitHub Check: Integration Tests (astro, chrome)
- GitHub Check: Integration Tests (sessions, chrome)
- GitHub Check: Integration Tests (elements, chrome)
- GitHub Check: Integration Tests (generic, chrome)
- GitHub Check: Publish with pkg-pr-new
- GitHub Check: Unit Tests (18, --filter=@clerk/astro --filter=@clerk/backend --filter=@clerk/express --filter=@c...
- GitHub Check: Unit Tests (22, **)
- GitHub Check: Static analysis
- GitHub Check: semgrep-cloud-platform/scan
- GitHub Check: Analyze (javascript-typescript)
🔇 Additional comments (5)
.changeset/hot-tables-worry.md (1)
1-6: LGTM! Changeset correctly specifies minor version bump.The changeset is properly formatted and appropriately specifies a minor version bump for the new M2M tokens functionality.
packages/backend/src/api/request.ts (1)
111-113: LGTM! Prevents overwriting existing Authorization headers.This change correctly prevents the default
secretKeyfrom overwriting an existingAuthorizationheader, enabling the new M2M token functionality where methods can set their own authorization headers.packages/backend/src/api/factory.ts (1)
71-71: LGTM! Correctly configures MachineTokensApi to not require secret key.This configuration allows M2M token operations to use their own authorization mechanism via
machineTokenSecretinstead of requiring the global secret key.packages/backend/src/api/endpoints/MachineTokensApi.ts (2)
8-29: LGTM! Well-designed type definitions following TypeScript best practices.The utility type
WithMachineTokenSecret<T>provides good reusability, and the parameter types are properly structured with clear field definitions.
63-63: LGTM! Proper ID validation using inherited requireId method.Both
updateandrevokemethods correctly validate them2mTokenIdparameter using the inheritedrequireIdmethod before proceeding with the request.Also applies to: 78-78
wobsoriano
changed the title
There was a problem hiding this comment.
Actionable comments posted: 1
📜 Review details
Configuration used: CodeRabbit UI
Review profile: CHILL
Plan: Pro
📒 Files selected for processing (13)
packages/backend/src/api/__tests__/MachineTokenApi.test.ts(1 hunks)packages/backend/src/api/endpoints/MachineTokenApi.ts(1 hunks)packages/backend/src/api/resources/JSON.ts(1 hunks)packages/backend/src/api/resources/MachineToken.ts(1 hunks)packages/backend/src/fixtures/machine.ts(1 hunks)packages/backend/src/tokens/__tests__/authObjects.test.ts(1 hunks)packages/backend/src/tokens/__tests__/request.test.ts(4 hunks)packages/backend/src/tokens/__tests__/verify.test.ts(2 hunks)packages/backend/src/tokens/authObjects.ts(0 hunks)packages/backend/src/tokens/authenticateContext.ts(2 hunks)packages/backend/src/tokens/request.ts(3 hunks)packages/backend/src/tokens/types.ts(1 hunks)packages/backend/src/tokens/verify.ts(1 hunks)
💤 Files with no reviewable changes (1)
- packages/backend/src/tokens/authObjects.ts
🚧 Files skipped from review as they are similar to previous changes (6)
- packages/backend/src/tokens/tests/authObjects.test.ts
- packages/backend/src/tokens/verify.ts
- packages/backend/src/api/resources/MachineToken.ts
- packages/backend/src/api/resources/JSON.ts
- packages/backend/src/api/tests/MachineTokenApi.test.ts
- packages/backend/src/api/endpoints/MachineTokenApi.ts
🧰 Additional context used
📓 Path-based instructions (9)
**/*.{js,jsx,ts,tsx}
📄 CodeRabbit Inference Engine (.cursor/rules/development.mdc)
**/*.{js,jsx,ts,tsx}: All code must pass ESLint checks with the project's configuration
Follow established naming conventions (PascalCase for components, camelCase for variables)
Maintain comprehensive JSDoc comments for public APIs
Use dynamic imports for optional features
All public APIs must be documented with JSDoc
Provide meaningful error messages to developers
Include error recovery suggestions where applicable
Log errors appropriately for debugging
Lazy load components and features when possible
Implement proper caching strategies
Use efficient data structures and algorithms
Profile and optimize critical paths
Validate all inputs and sanitize outputs
Implement proper logging with different levels
Files:
packages/backend/src/tokens/authenticateContext.tspackages/backend/src/tokens/types.tspackages/backend/src/fixtures/machine.tspackages/backend/src/tokens/__tests__/request.test.tspackages/backend/src/tokens/request.tspackages/backend/src/tokens/__tests__/verify.test.ts
**/*.{js,jsx,ts,tsx,json,css,scss,md,yaml,yml}
📄 CodeRabbit Inference Engine (.cursor/rules/development.mdc)
Use Prettier for consistent code formatting
Files:
packages/backend/src/tokens/authenticateContext.tspackages/backend/src/tokens/types.tspackages/backend/src/fixtures/machine.tspackages/backend/src/tokens/__tests__/request.test.tspackages/backend/src/tokens/request.tspackages/backend/src/tokens/__tests__/verify.test.ts
packages/**/*.{ts,tsx}
📄 CodeRabbit Inference Engine (.cursor/rules/development.mdc)
TypeScript is required for all packages
Files:
packages/backend/src/tokens/authenticateContext.tspackages/backend/src/tokens/types.tspackages/backend/src/fixtures/machine.tspackages/backend/src/tokens/__tests__/request.test.tspackages/backend/src/tokens/request.tspackages/backend/src/tokens/__tests__/verify.test.ts
packages/**/*.{ts,tsx,d.ts}
📄 CodeRabbit Inference Engine (.cursor/rules/development.mdc)
Packages should export TypeScript types alongside runtime code
Files:
packages/backend/src/tokens/authenticateContext.tspackages/backend/src/tokens/types.tspackages/backend/src/fixtures/machine.tspackages/backend/src/tokens/__tests__/request.test.tspackages/backend/src/tokens/request.tspackages/backend/src/tokens/__tests__/verify.test.ts
**/*.{ts,tsx}
📄 CodeRabbit Inference Engine (.cursor/rules/development.mdc)
Use proper TypeScript error types
**/*.{ts,tsx}: Always define explicit return types for functions, especially public APIs
Use proper type annotations for variables and parameters where inference isn't clear
Avoidanytype - preferunknownwhen type is uncertain, then narrow with type guards
Useinterfacefor object shapes that might be extended
Usetypefor unions, primitives, and computed types
Preferreadonlyproperties for immutable data structures
Useprivatefor internal implementation details
Useprotectedfor inheritance hierarchies
Usepublicexplicitly for clarity in public APIs
Preferreadonlyfor properties that shouldn't change after construction
Prefer composition and interfaces over deep inheritance chains
Use mixins for shared behavior across unrelated classes
Implement dependency injection for loose coupling
Let TypeScript infer when types are obvious
Useconst assertionsfor literal types:as const
Usesatisfiesoperator for type checking without widening
Use mapped types for transforming object types
Use conditional types for type-level logic
Leverage template literal types for string manipulation
Use ES6 imports/exports consistently
Use default exports sparingly, prefer named exports
Use type-only imports:import type { ... } from ...
Noanytypes without justification
Proper error handling with typed errors
Consistent use ofreadonlyfor immutable data
Proper generic constraints
No unused type parameters
Proper use of utility types instead of manual type construction
Type-only imports where possible
Proper tree-shaking friendly exports
No circular dependencies
Efficient type computations (avoid deep recursion)
Files:
packages/backend/src/tokens/authenticateContext.tspackages/backend/src/tokens/types.tspackages/backend/src/fixtures/machine.tspackages/backend/src/tokens/__tests__/request.test.tspackages/backend/src/tokens/request.tspackages/backend/src/tokens/__tests__/verify.test.ts
**/*.{js,ts,tsx,jsx}
📄 CodeRabbit Inference Engine (.cursor/rules/monorepo.mdc)
Support multiple Clerk environment variables (CLERK_, NEXT_PUBLIC_CLERK_, etc.) for configuration.
Files:
packages/backend/src/tokens/authenticateContext.tspackages/backend/src/tokens/types.tspackages/backend/src/fixtures/machine.tspackages/backend/src/tokens/__tests__/request.test.tspackages/backend/src/tokens/request.tspackages/backend/src/tokens/__tests__/verify.test.ts
**/*
⚙️ CodeRabbit Configuration File
**/*: If there are no tests added or modified as part of the PR, please suggest that tests be added to cover the changes.Whenever reviewing a pull request, if there are any changes that could impact security, always tag
@clerk/securityin the PR.Security-impacting changes include, but are not limited to:
- Changes to authentication logic or mechanisms (e.g. login, session handling, token issuance)
- Any modification to access control, authorization checks, or role-based permissions
- Introduction or modification of hashing algorithms, signature verification, or cryptographic primitives
- Handling of sensitive data (e.g. passwords, tokens, secrets, PII)
- Integration with external identity providers (e.g. SSO, OAuth, OpenID Connect)
- Modifications to security headers, cookie flags, CORS policies, or CSRF protections
- Bypass mechanisms (e.g. feature flags, testing overrides) that could weaken protections
- Changes to rate limiting, abuse prevention, or input validation
If you're unsure whether a change is security-relevant, err on the side of caution and tag
@clerk/security.Any time that you tag
@clerk/security, please do so explicitly in a code comment, rather than within a collapsed section in a coderabbit comment, such as the "recent review details" section. If you do use the team name in any thinking or non-direct-code-comment content, it can be referred to as "clerk security team" to avoid accidentally printing the tag which sends a notification to the team.
Files:
packages/backend/src/tokens/authenticateContext.tspackages/backend/src/tokens/types.tspackages/backend/src/fixtures/machine.tspackages/backend/src/tokens/__tests__/request.test.tspackages/backend/src/tokens/request.tspackages/backend/src/tokens/__tests__/verify.test.ts
packages/**/*.{test,spec}.{js,jsx,ts,tsx}
📄 CodeRabbit Inference Engine (.cursor/rules/monorepo.mdc)
Unit tests should use Jest or Vitest as the test runner.
Files:
packages/backend/src/tokens/__tests__/request.test.tspackages/backend/src/tokens/__tests__/verify.test.ts
**/__tests__/**/*.{ts,tsx}
📄 CodeRabbit Inference Engine (.cursor/rules/typescript.mdc)
**/__tests__/**/*.{ts,tsx}: Create type-safe test builders/factories
Use branded types for test isolation
Implement proper mock types that match interfaces
Files:
packages/backend/src/tokens/__tests__/request.test.tspackages/backend/src/tokens/__tests__/verify.test.ts
🧬 Code Graph Analysis (3)
packages/backend/src/tokens/authenticateContext.ts (1)
packages/backend/src/tokens/tokenTypes.ts (2)
TokenType(1-6)TokenType(11-11)
packages/backend/src/tokens/__tests__/request.test.ts (2)
packages/backend/src/mock-server.ts (1)
server(6-6)packages/backend/src/fixtures/machine.ts (1)
mockVerificationResults(7-52)
packages/backend/src/tokens/request.ts (1)
packages/backend/src/tokens/tokenTypes.ts (2)
TokenType(1-6)TokenType(11-11)
🪛 Gitleaks (8.27.2)
packages/backend/src/tokens/__tests__/verify.test.ts
129-129: Detected a Generic API Key, potentially exposing access to various services and sensitive operations.
(generic-api-key)
⏰ Context from checks skipped due to timeout of 90000ms. You can increase the timeout in your CodeRabbit configuration to a maximum of 15 minutes (900000ms). (3)
- GitHub Check: semgrep-cloud-platform/scan
- GitHub Check: Build Packages
- GitHub Check: Analyze (javascript-typescript)
🔇 Additional comments (10)
packages/backend/src/fixtures/machine.ts (1)
42-42: LGTM! Scope values updated for machine tokens.The change from generic scopes to machine-specific identifiers (
mch_1xxxxx,mch_2xxxxx) correctly reflects the new M2M token structure introduced in this PR.packages/backend/src/tokens/types.ts (1)
70-75: LGTM! Well-documented internal option for machine secrets.The
machineSecretproperty is properly typed, marked as internal, and has clear JSDoc documentation explaining its purpose in overriding the Clerk secret key for M2M token verification.packages/backend/src/tokens/authenticateContext.ts (1)
72-76: LGTM! Appropriate conditional logic for machine tokens.The conditional check to skip publishable key initialization for machine tokens is logical and necessary, as machine tokens have a different authentication flow that doesn't require publishable keys.
packages/backend/src/tokens/__tests__/verify.test.ts (2)
100-100: LGTM! More descriptive test name.The test name now clearly indicates it's testing verification with an instance secret key, which helps distinguish it from the new machine secret test case.
125-125: LGTM! Updated scope values match new machine token format.The scope values have been updated to
['mch_1xxxxx', 'mch_2xxxxx']which aligns with the machine-specific identifiers introduced for M2M tokens.packages/backend/src/tokens/__tests__/request.test.ts (2)
1245-1260: LGTM! Proper test coverage for machine secret authentication.The test correctly validates that machine secrets are accepted and used in the Authorization header when verifying M2M tokens. The mock verification ensures the expected behavior is tested properly.
Note: The static analysis tool flagged line 1248 as containing an API key, but this is a false positive as it's a test fixture with a mock value (
ak_xxxxx).
1301-1336: LGTM! Corrected token type expectations in mismatch tests.The updates to expect the accepted token type (rather than the provided token type) in unauthenticated results make sense from a user experience perspective. This helps developers understand what token type was expected when authentication fails due to type mismatch.
packages/backend/src/tokens/request.ts (3)
63-70: LGTM! Proper authentication validation for machine tokens.The function correctly ensures that machine token authentication has either a machine secret or Clerk secret key present, with clear error messaging for developers.
@clerk/security - This adds proper validation for machine token authentication credentials.
90-92: LGTM! Improved token type reporting in mismatch scenarios.The updated logic correctly prioritizes the accepted token type when it's a string, providing more accurate error reporting.
155-171: LGTM! Proper segregation of authentication logic by token type.The changes correctly separate authentication flows:
- Non-machine tokens: Validate secret key and perform satellite-specific assertions
- Machine tokens: Validate presence of machine secret or secret key
This maintains security while enabling machine token authentication.
@clerk/security - This modifies the core authentication flow to support machine tokens with distinct validation logic.
| if (options.acceptsToken !== TokenType.MachineToken) { | ||
| this.initPublishableKeyValues(options); | ||
| } |
There was a problem hiding this comment.
I'm sure publishable key is only applicable to session tokens but I want to make sure first.
We need to add this check because we have publishable key assertion here
wobsoriano
changed the title
wobsoriano
changed the title
Description
This PR adds the ability to create, revoke, and verify machine-to-machine tokens using the BAPI client:
It also allows using a machine secret as an authentication header instead of a Clerk instance secret:
To verify a machine-to-machine token using a machine secret via
authenticateRequest(), amachineSecretoption was added:Additionally, this PR removes the name property from machine tokens. This change is part of the breaking changes to M2M endpoints documented here. Since this feature is still in private beta, a minor version bump should suffice.
Unit tests have been added, but E2E tests will be implemented in a separate PR.
Resolves USER-2264
Checklist
pnpm testruns as expected.pnpm buildruns as expected.Type of change
Summary by CodeRabbit
Summary by CodeRabbit
New Features
Bug Fixes
Tests
Refactor