|
| 1 | +import type { |
| 2 | + __experimental_SessionVerificationLevel, |
| 3 | + __experimental_SessionVerificationMaxAge, |
| 4 | + CheckAuthorizationWithCustomPermissions, |
| 5 | + OrganizationCustomPermissionKey, |
| 6 | + OrganizationCustomRoleKey, |
| 7 | +} from '@clerk/types'; |
| 8 | + |
| 9 | +type MaxAgeMap = Record<__experimental_SessionVerificationMaxAge, number>; |
| 10 | +type AuthorizationOptions = { |
| 11 | + userId: string | null | undefined; |
| 12 | + orgId: string | null | undefined; |
| 13 | + orgRole: string | null | undefined; |
| 14 | + orgPermissions: string[] | null | undefined; |
| 15 | + __experimental_factorVerificationAge: [number, number] | null; |
| 16 | +}; |
| 17 | + |
| 18 | +type CheckOrgAuthorization = ( |
| 19 | + params: { role?: OrganizationCustomRoleKey; permission?: OrganizationCustomPermissionKey }, |
| 20 | + { orgId, orgRole, orgPermissions }: AuthorizationOptions, |
| 21 | +) => boolean | null; |
| 22 | + |
| 23 | +type CheckStepUpAuthorization = ( |
| 24 | + params: { |
| 25 | + __experimental_assurance?: { |
| 26 | + level: __experimental_SessionVerificationLevel; |
| 27 | + maxAge: __experimental_SessionVerificationMaxAge; |
| 28 | + }; |
| 29 | + }, |
| 30 | + { __experimental_factorVerificationAge }: AuthorizationOptions, |
| 31 | +) => boolean | null; |
| 32 | + |
| 33 | +const MAX_AGE_TO_MINUTES: MaxAgeMap = { |
| 34 | + 'A1.10min': 10, |
| 35 | + 'A2.1hr': 60, |
| 36 | + 'A3.4hr': 240, //4 * 60 |
| 37 | + 'A4.1day': 1440, //24 * 60, |
| 38 | + 'A5.1wk': 10080, //7 * 24 * 60, |
| 39 | +}; |
| 40 | + |
| 41 | +const ALLOWED_MAX_AGES = new Set<__experimental_SessionVerificationMaxAge>( |
| 42 | + Object.keys(MAX_AGE_TO_MINUTES) as __experimental_SessionVerificationMaxAge[], |
| 43 | +); |
| 44 | +const ALLOWED_LEVELS = new Set<__experimental_SessionVerificationLevel>([ |
| 45 | + 'L1.firstFactor', |
| 46 | + 'L2.secondFactor', |
| 47 | + 'L3.multiFactor', |
| 48 | +]); |
| 49 | + |
| 50 | +// Helper functions |
| 51 | +const isValidMaxAge = (maxAge: __experimental_SessionVerificationMaxAge) => ALLOWED_MAX_AGES.has(maxAge); |
| 52 | +const isValidLevel = (level: __experimental_SessionVerificationLevel) => ALLOWED_LEVELS.has(level); |
| 53 | + |
| 54 | +/** |
| 55 | + * Checks if a user has the required organization-level authorization. |
| 56 | + * Verifies if the user has the specified role or permission within their organization. |
| 57 | + * @returns null, if unable to determine due to missing data or unspecified role/permission. |
| 58 | + */ |
| 59 | +const checkOrgAuthorization: CheckOrgAuthorization = (params, options) => { |
| 60 | + const { orgId, orgRole, orgPermissions } = options; |
| 61 | + if (!params.role && !params.permission) { |
| 62 | + return null; |
| 63 | + } |
| 64 | + if (!orgId || !orgRole || !orgPermissions) { |
| 65 | + return null; |
| 66 | + } |
| 67 | + |
| 68 | + if (params.permission) { |
| 69 | + return orgPermissions.includes(params.permission); |
| 70 | + } |
| 71 | + if (params.role) { |
| 72 | + return orgRole === params.role; |
| 73 | + } |
| 74 | + return null; |
| 75 | +}; |
| 76 | + |
| 77 | +/** |
| 78 | + * Evaluates if the user meets step-up authentication requirements. |
| 79 | + * Compares the user's factor verification ages against the specified maxAge. |
| 80 | + * Handles different verification levels (first factor, second factor, multi-factor). |
| 81 | + * @returns null, if requirements or verification data are missing. |
| 82 | + */ |
| 83 | +const checkStepUpAuthorization: CheckStepUpAuthorization = (params, { __experimental_factorVerificationAge }) => { |
| 84 | + if (!params.__experimental_assurance || !__experimental_factorVerificationAge) { |
| 85 | + return null; |
| 86 | + } |
| 87 | + const { level, maxAge } = params.__experimental_assurance; |
| 88 | + |
| 89 | + if (!isValidLevel(level) || !isValidMaxAge(maxAge)) { |
| 90 | + return null; |
| 91 | + } |
| 92 | + |
| 93 | + const [factor1Age, factor2Age] = __experimental_factorVerificationAge; |
| 94 | + const maxAgeInMinutes = MAX_AGE_TO_MINUTES[maxAge]; |
| 95 | + |
| 96 | + // -1 indicates the factor group (1fa,2fa) is not enabled |
| 97 | + // -1 for 1fa is not a valid scenario, but we need to make sure we handle it properly |
| 98 | + const isValidFactor1 = factor1Age !== -1 ? maxAgeInMinutes > factor1Age : null; |
| 99 | + const isValidFactor2 = factor2Age !== -1 ? maxAgeInMinutes > factor2Age : null; |
| 100 | + |
| 101 | + switch (level) { |
| 102 | + case 'L1.firstFactor': |
| 103 | + return isValidFactor1; |
| 104 | + case 'L2.secondFactor': |
| 105 | + return factor2Age !== -1 ? isValidFactor2 : isValidFactor1; |
| 106 | + case 'L3.multiFactor': |
| 107 | + return factor2Age === -1 ? isValidFactor1 : isValidFactor1 && isValidFactor2; |
| 108 | + } |
| 109 | +}; |
| 110 | + |
| 111 | +/** |
| 112 | + * Creates a function for comprehensive user authorization checks. |
| 113 | + * Combines organization-level and step-up authentication checks. |
| 114 | + * The returned function authorizes if both checks pass, or if at least one passes |
| 115 | + * when the other is indeterminate. Fails if userId is missing. |
| 116 | + */ |
| 117 | +export const createCheckAuthorization = (options: AuthorizationOptions): CheckAuthorizationWithCustomPermissions => { |
| 118 | + return (params): boolean => { |
| 119 | + if (!options.userId) { |
| 120 | + return false; |
| 121 | + } |
| 122 | + |
| 123 | + const orgAuthorization = checkOrgAuthorization(params, options); |
| 124 | + const stepUpAuthorization = checkStepUpAuthorization(params, options); |
| 125 | + |
| 126 | + if ([orgAuthorization, stepUpAuthorization].some(a => a === null)) { |
| 127 | + return [orgAuthorization, stepUpAuthorization].some(a => a === true); |
| 128 | + } |
| 129 | + |
| 130 | + return [orgAuthorization, stepUpAuthorization].every(a => a === true); |
| 131 | + }; |
| 132 | +}; |
0 commit comments