clerk · dimkl · Nov 22, 2023 · Oct 11, 2023 · Nov 17, 2023 · Nov 17, 2023
diff --git a/.changeset/red-worms-fetch.md b/.changeset/red-worms-fetch.md
@@ -0,0 +1,26 @@
+---
+'@clerk/clerk-js': major
+'@clerk/shared': major
+'@clerk/clerk-sdk-node': minor
+'@clerk/backend': minor
+'@clerk/nextjs': minor
+'@clerk/clerk-react': minor
+'@clerk/clerk-expo': minor
+---
+
+Breaking Changes:
+
+- Drop `isLegacyFrontendApiKey` from `@clerk/shared`
+- Drop default exports from `@clerk/clerk-js`
+    - on headless Clerk type
+    - on ui and ui.retheme `Portal`
+- Use `isProductionFromSecretKey` instead of `isProductionFromApiKey`
+- Use `isDevelopmentFromSecretKey` instead of `isDevelopmentFromApiKey`
+
+Changes:
+
+- Rename `HeadlessBrowserClerkConstrutor` / `HeadlessBrowserClerkConstructor` (typo)
+- Use `isomorphicAtob` / `isomorhpicBtoa` to replace `base-64` in `@clerk/expo`
+- Refactor merging build-time and runtime props in `@clerk/backend` clerk client
+- Drop `node-fetch` dependency from `@clerk/backend`
+- Drop duplicate test in `@clerk/backend`
diff --git a/package-lock.json b/package-lock.json
diff --git a/packages/backend/src/tokens/authStatus.ts b/packages/backend/src/tokens/authStatus.ts
@@ -81,7 +81,7 @@ export type AuthReason = AuthErrorReason | TokenVerificationErrorReason;
 
 export type RequestState = SignedInState | SignedOutState | InterstitialState | UnknownState;
 
-export type LoadResourcesOptions = {
+type LoadResourcesOptions = {
   loadSession?: boolean;
   loadUser?: boolean;
   loadOrganization?: boolean;

diff --git a/packages/backend/src/tokens/factory.test.ts b/packages/backend/src/tokens/factory.test.ts
@@ -0,0 +1,96 @@
+import type QUnit from 'qunit';
+
+import type { ApiClient } from '../api';
+import { createAuthenticateRequest } from './factory';
+
+export default (QUnit: QUnit) => {
+  const { module, test } = QUnit;
+
+  module('createAuthenticateRequest({ options, apiClient })', hooks => {
+    let fakeAuthenticateRequest;
+    hooks.afterEach(() => {
+      fakeAuthenticateRequest?.restore();
+    });
+
+    test('fallbacks to build-time options', async assert => {
+      const buildTimeOptions = {
+        secretKey: 'sk',
+        jwtKey: 'jwtKey',
+        apiUrl: 'apiUrl',
+        apiVersion: 'apiVersion',
+        proxyUrl: 'proxyUrl',
+        publishableKey: 'pk',
+        isSatellite: false,
+        domain: 'domain',
+        audience: 'domain',
+      };
+
+      const { authenticateRequest } = createAuthenticateRequest({
+        options: buildTimeOptions,
+        apiClient: {} as ApiClient,
+      });
+
+      const requestState = await authenticateRequest({ request: new Request('http://example.com/') });
+      assert.propContains(requestState.toAuth()?.debug(), buildTimeOptions);
+    });
+
+    test('overrides build-time options with runtime options', async assert => {
+      const buildTimeOptions = {
+        secretKey: 'sk',
+        jwtKey: 'jwtKey',
+        apiUrl: 'apiUrl',
+        apiVersion: 'apiVersion',
+        proxyUrl: 'proxyUrl',
+        publishableKey: 'pk',
+        isSatellite: false,
+        domain: 'domain',
+        audience: 'domain',
+      };
+
+      const { authenticateRequest } = createAuthenticateRequest({
+        options: buildTimeOptions,
+        apiClient: {} as ApiClient,
+      });
+
+      const overrides = {
+        secretKey: 'r-sk',
+        publishableKey: 'r-pk',
+      };
+      const requestState = await authenticateRequest({
+        request: new Request('http://example.com/'),
+        ...overrides,
+      });
+      assert.propContains(requestState.toAuth()?.debug(), {
+        ...buildTimeOptions,
+        ...overrides,
+      });
+    });
+
+    test('ignore runtime apiUrl and apiVersion options', async assert => {
+      const buildTimeOptions = {
+        secretKey: 'sk',
+        jwtKey: 'jwtKey',
+        apiUrl: 'apiUrl',
+        apiVersion: 'apiVersion',
+        proxyUrl: 'proxyUrl',
+        publishableKey: 'pk',
+        isSatellite: false,
+        domain: 'domain',
+        audience: 'domain',
+      };
+
+      const { authenticateRequest } = createAuthenticateRequest({
+        options: buildTimeOptions,
+        apiClient: {} as ApiClient,
+      });
+
+      const requestState = await authenticateRequest({
+        request: new Request('http://example.com/'),
+        // @ts-expect-error is used to check runtime code
+        apiUrl: 'r-apiUrl',
+        apiVersion: 'r-apiVersion',
+      });
+      assert.propContains(requestState.toAuth()?.debug(), buildTimeOptions);
+    });
+  });
+};
diff --git a/packages/backend/src/tokens/factory.ts b/packages/backend/src/tokens/factory.ts
@@ -1,80 +1,65 @@
 import type { ApiClient } from '../api';
-import { API_URL, API_VERSION } from '../constants';
+import { mergePreDefinedOptions } from '../util/mergePreDefinedOptions';
 import type { LoadInterstitialOptions } from './interstitial';
 import { loadInterstitialFromLocal } from './interstitial';
 import type { AuthenticateRequestOptions } from './request';
 import { authenticateRequest as authenticateRequestOriginal, debugRequestState } from './request';
 
+type RunTimeOptions = Omit<AuthenticateRequestOptions, 'apiUrl' | 'apiVersion'>;
+
+type BuildTimeOptions = Partial<
+  Pick<
+    AuthenticateRequestOptions,
+    | 'apiUrl'
+    | 'apiVersion'
+    | 'audience'
+    | 'domain'
+    | 'isSatellite'
+    | 'jwtKey'
+    | 'proxyUrl'
+    | 'publishableKey'
+    | 'secretKey'
+  >
+>;
+
+const defaultOptions = {
+  secretKey: '',
+  jwtKey: '',
+  apiUrl: undefined,
+  apiVersion: undefined,
+  proxyUrl: '',
+  publishableKey: '',
+  isSatellite: false,
+  domain: '',
+  audience: '',
+} satisfies BuildTimeOptions;
+
 export type CreateAuthenticateRequestOptions = {
-  options: Partial<
-    Pick<
-      AuthenticateRequestOptions,
-      | 'audience'
-      | 'secretKey'
-      | 'apiUrl'
-      | 'apiVersion'
-      | 'publishableKey'
-      | 'jwtKey'
-      | 'proxyUrl'
-      | 'domain'
-      | 'isSatellite'
-    >
-  >;
+  options: BuildTimeOptions;
   apiClient: ApiClient;
 };
 
 export function createAuthenticateRequest(params: CreateAuthenticateRequestOptions) {
   const { apiClient } = params;
-  const {
-    secretKey: buildtimeSecretKey = '',
-    jwtKey: buildtimeJwtKey = '',
-    apiUrl = API_URL,
-    apiVersion = API_VERSION,
-    proxyUrl: buildProxyUrl = '',
-    publishableKey: buildtimePublishableKey = '',
-    isSatellite: buildtimeIsSatellite = false,
-    domain: buildtimeDomain = '',
-    audience: buildtimeAudience = '',
-  } = params.options;
+  const buildTimeOptions = mergePreDefinedOptions(defaultOptions, params.options);
 
-  const authenticateRequest = ({
-    secretKey: runtimeSecretKey,
-    audience: runtimeAudience,
-    proxyUrl: runtimeProxyUrl,
-    publishableKey: runtimePublishableKey,
-    jwtKey: runtimeJwtKey,
-    isSatellite: runtimeIsSatellite,
-    domain: runtimeDomain,
-    ...rest
-  }: Omit<AuthenticateRequestOptions, 'apiUrl' | 'apiVersion'>) => {
+  const authenticateRequest = (options: RunTimeOptions) => {
+    const { apiUrl, apiVersion } = buildTimeOptions;
+    const runTimeOptions = mergePreDefinedOptions(buildTimeOptions, options);
     return authenticateRequestOriginal({
-      ...rest,
-      secretKey: runtimeSecretKey || buildtimeSecretKey,
-      audience: runtimeAudience || buildtimeAudience,
+      ...options,
+      ...runTimeOptions,
+      // We should add all the omitted props from options here (eg apiUrl / apiVersion)
+      // to avoid runtime options override them.
       apiUrl,
       apiVersion,
-      proxyUrl: runtimeProxyUrl || buildProxyUrl,
-      publishableKey: runtimePublishableKey || buildtimePublishableKey,
-      isSatellite: runtimeIsSatellite || buildtimeIsSatellite,
-      domain: runtimeDomain || buildtimeDomain,
-      jwtKey: runtimeJwtKey || buildtimeJwtKey,
     });
   };
 
-  const localInterstitial = ({
-    publishableKey: runtimePublishableKey,
-    proxyUrl: runtimeProxyUrl,
-    isSatellite: runtimeIsSatellite,
-    domain: runtimeDomain,
-    ...rest
-  }: Omit<LoadInterstitialOptions, 'apiUrl'>) =>
-    loadInterstitialFromLocal({
-      ...rest,
-      proxyUrl: runtimeProxyUrl || buildProxyUrl,
-      publishableKey: runtimePublishableKey || buildtimePublishableKey,
-      isSatellite: runtimeIsSatellite || buildtimeIsSatellite,
-      domain: runtimeDomain || buildtimeDomain,
-    });
+  const localInterstitial = (options: Omit<LoadInterstitialOptions, 'apiUrl'>) => {
+    const runTimeOptions = mergePreDefinedOptions(buildTimeOptions, options);
+    return loadInterstitialFromLocal({ ...options, ...runTimeOptions });
+  };
 
   // TODO: Replace this function with remotePublicInterstitial
   const remotePrivateInterstitial = () => apiClient.interstitial.getInterstitial();

diff --git a/packages/backend/src/tokens/interstitialRule.ts b/packages/backend/src/tokens/interstitialRule.ts
@@ -1,5 +1,5 @@
 import { checkCrossOrigin } from '../util/request';
-import { isDevelopmentFromApiKey, isProductionFromApiKey } from '../util/shared';
+import { isDevelopmentFromSecretKey, isProductionFromSecretKey } from '../util/shared';
 import type { AuthStatusOptionsType, RequestState } from './authStatus';
 import { AuthErrorReason, interstitial, signedIn, signedOut } from './authStatus';
 import { verifyToken } from './verify';
@@ -45,7 +45,7 @@ const isBrowser = (userAgent: string | undefined) => VALID_USER_AGENTS.test(user
 // automatically treated as signed out. This exception is needed for development, because the any // missing uat throws an interstitial in development.
 export const nonBrowserRequestInDevRule: InterstitialRule = options => {
   const { secretKey, userAgent } = options;
-  if (isDevelopmentFromApiKey(secretKey || '') && !isBrowser(userAgent)) {
+  if (isDevelopmentFromSecretKey(secretKey || '') && !isBrowser(userAgent)) {
     return signedOut(options, AuthErrorReason.HeaderMissingNonBrowser);
   }
   return undefined;
@@ -70,7 +70,7 @@ export const crossOriginRequestWithoutHeader: InterstitialRule = options => {
 
 export const isPrimaryInDevAndRedirectsToSatellite: InterstitialRule = options => {
   const { secretKey = '', isSatellite, searchParams } = options;
-  const isDev = isDevelopmentFromApiKey(secretKey);
+  const isDev = isDevelopmentFromSecretKey(secretKey);
 
   if (isDev && !isSatellite && shouldRedirectToSatelliteUrl(searchParams)) {
     return interstitial(options, AuthErrorReason.PrimaryRespondsToSyncing);
@@ -80,7 +80,7 @@ export const isPrimaryInDevAndRedirectsToSatellite: InterstitialRule = options =
 
 export const potentialFirstLoadInDevWhenUATMissing: InterstitialRule = options => {
   const { secretKey = '', clientUat } = options;
-  const res = isDevelopmentFromApiKey(secretKey);
+  const res = isDevelopmentFromSecretKey(secretKey);
   if (res && !clientUat) {
     return interstitial(options, AuthErrorReason.CookieUATMissing);
   }
@@ -96,7 +96,7 @@ export const potentialRequestAfterSignInOrOutFromClerkHostedUiInDev: Interstitia
   const crossOriginReferrer =
     referrer && checkCrossOrigin({ originURL: new URL(referrer), host, forwardedHost, forwardedProto });
 
-  if (isDevelopmentFromApiKey(secretKey) && crossOriginReferrer) {
+  if (isDevelopmentFromSecretKey(secretKey) && crossOriginReferrer) {
     return interstitial(options, AuthErrorReason.CrossOriginReferrer);
   }
   return undefined;
@@ -105,7 +105,7 @@ export const potentialRequestAfterSignInOrOutFromClerkHostedUiInDev: Interstitia
 export const potentialFirstRequestOnProductionEnvironment: InterstitialRule = options => {
   const { secretKey = '', clientUat, cookieToken } = options;
 
-  if (isProductionFromApiKey(secretKey) && !clientUat && !cookieToken) {
+  if (isProductionFromSecretKey(secretKey) && !clientUat && !cookieToken) {
     return signedOut(options, AuthErrorReason.CookieAndUATMissing);
   }
   return undefined;

diff --git a/packages/backend/src/tokens/request.ts b/packages/backend/src/tokens/request.ts
@@ -1,8 +1,8 @@
 import { constants } from '../constants';
 import { assertValidSecretKey } from '../util/assertValidSecretKey';
 import { buildRequest, stripAuthorizationHeader } from '../util/IsomorphicRequest';
-import { isDevelopmentFromApiKey } from '../util/shared';
-import type { AuthStatusOptionsType, LoadResourcesOptions, RequestState } from './authStatus';
+import { isDevelopmentFromSecretKey } from '../util/shared';
+import type { AuthStatusOptionsType, RequestState } from './authStatus';
 import { AuthErrorReason, interstitial, signedOut, unknownState } from './authStatus';
 import type { TokenCarrier } from './errors';
 import { TokenVerificationError, TokenVerificationErrorReason } from './errors';
@@ -32,7 +32,7 @@ export type OptionalVerifyTokenOptions = Partial<
 export type AuthenticateRequestOptions = AuthStatusOptionsType & OptionalVerifyTokenOptions & { request: Request };
 
 function assertSignInUrlExists(signInUrl: string | undefined, key: string): asserts signInUrl is string {
-  if (!signInUrl && isDevelopmentFromApiKey(key)) {
+  if (!signInUrl && isDevelopmentFromSecretKey(key)) {
     throw new Error(`Missing signInUrl. Pass a signInUrl for dev instances if an app is satellite`);
   }
 }

diff --git a/packages/backend/src/util/mergePreDefinedOptions.ts b/packages/backend/src/util/mergePreDefinedOptions.ts
@@ -0,0 +1,8 @@
+export function mergePreDefinedOptions<T extends Record<string, any>>(preDefinedOptions: T, options: Partial<T>): T {
+  return Object.keys(preDefinedOptions).reduce(
+    (obj: T, key: string) => {
+      return { ...obj, [key]: options[key] || obj[key] };
+    },
+    { ...preDefinedOptions },
+  );
+}
diff --git a/packages/backend/src/util/shared.ts b/packages/backend/src/util/shared.ts
@@ -1,6 +1,6 @@
 export { addClerkPrefix, getScriptUrl, getClerkJsMajorVersionOrTag } from '@clerk/shared/url';
 export { callWithRetry } from '@clerk/shared/callWithRetry';
-export { isDevelopmentFromApiKey, isProductionFromApiKey, parsePublishableKey } from '@clerk/shared/keys';
+export { isDevelopmentFromSecretKey, isProductionFromSecretKey, parsePublishableKey } from '@clerk/shared/keys';
 export { deprecated, deprecatedProperty } from '@clerk/shared/deprecated';
 
 import { buildErrorThrower } from '@clerk/shared/error';