fix(fastify): use runtime keys for auth client

Author: jescalan

.changeset/silent-fastify-handshakes.md

@@ -0,0 +1,10 @@
+---
+'@clerk/fastify': patch
+'@clerk/express': patch
+'@clerk/astro': patch
+'@clerk/nuxt': patch
+'@clerk/tanstack-react-start': patch
+'@clerk/react-router': patch
+---
+
+Use runtime middleware keys when creating the request client used by server-side auth middleware, so nonce handshake payload exchange works when keys are passed directly to framework middleware.

packages/astro/src/server/__tests__/clerk-client.test.ts

@@ -0,0 +1,24 @@
+import { createClerkClient } from '@clerk/backend';
+import { describe, expect, test, vi } from 'vitest';
+
+import { clerkClient } from '../clerk-client';
+
+vi.mock('@clerk/backend', () => ({
+  createClerkClient: vi.fn().mockReturnValue({}),
+}));
+
+describe('clerkClient', () => {
+  test('passes runtime options to createClerkClient', () => {
+    clerkClient({ locals: {} } as any, {
+      secretKey: 'sk_test_runtime',
+      publishableKey: 'pk_test_runtime',
+    });
+
+    expect(vi.mocked(createClerkClient)).toHaveBeenCalledWith(
+      expect.objectContaining({
+        secretKey: 'sk_test_runtime',
+        publishableKey: 'pk_test_runtime',
+      }),
+    );
+  });
+});

packages/astro/src/server/clerk-client.ts

@@ -29,6 +29,6 @@ const createClerkClientWithOptions: CreateClerkClientWithOptions = (context, opt
     ...options,
   });
 
-const clerkClient = (context: APIContext) => createClerkClientWithOptions(context);
+const clerkClient = (context: APIContext, options?: ClerkOptions) => createClerkClientWithOptions(context, options);
 
 export { clerkClient };

packages/astro/src/server/clerk-middleware.ts

@@ -117,7 +117,7 @@ export const clerkMiddleware: ClerkMiddleware = (...args: unknown[]): any => {
       }
     }
 
-    const requestState = await clerkClient(context).authenticateRequest(
+    const requestState = await clerkClient(context, keylessOptions).authenticateRequest(
       clerkRequest,
       createAuthenticateRequestOptions(clerkRequest, keylessOptions, context),
     );

packages/express/src/__tests__/clerkMiddleware.test.ts

@@ -216,7 +216,7 @@ describe('clerkMiddleware', () => {
     expect(forwarded).not.toHaveProperty('frontendApiProxy');
   });
 
-  describe('apiUrl/apiVersion default-client construction', () => {
+  describe('default-client construction overrides', () => {
     beforeEach(() => {
       mockCreateClerkClient.mockClear();
     });
@@ -243,8 +243,22 @@ describe('clerkMiddleware', () => {
       expect(mockCreateClerkClient).toHaveBeenCalledWith(expect.objectContaining({ apiVersion: 'v2' }));
     });
 
-    it('does not call createClerkClient at construction when apiUrl/apiVersion are not set', () => {
-      authenticateAndDecorateRequest({ secretKey: 'sk_test_....' });
+    it('builds a per-middleware ClerkClient with runtime keys when no custom clerkClient is supplied', () => {
+      authenticateAndDecorateRequest({
+        secretKey: 'sk_test_runtime',
+        publishableKey: 'pk_test_runtime',
+      });
+
+      expect(mockCreateClerkClient).toHaveBeenCalledWith(
+        expect.objectContaining({
+          secretKey: 'sk_test_runtime',
+          publishableKey: 'pk_test_runtime',
+        }),
+      );
+    });
+
+    it('does not call createClerkClient at construction when client construction overrides are not set', () => {
+      authenticateAndDecorateRequest({});
 
       expect(mockCreateClerkClient).not.toHaveBeenCalled();
     });

packages/express/src/authenticateRequest.ts

@@ -112,21 +112,26 @@ const absoluteProxyUrl = (relativeOrAbsoluteUrl: string, baseUrl: string): strin
   return new URL(relativeOrAbsoluteUrl, baseUrl).toString();
 };
 
-// `apiUrl` and `apiVersion` are pinned at client construction time inside
-// `@clerk/backend`'s `createAuthenticateRequest` factory (build-time values
-// override runtime ones). The default singleton in `./clerkClient` is built
+// Some options are pinned at client construction time inside `@clerk/backend`'s
+// `createAuthenticateRequest` factory, including the API client used for nonce
+// handshake payload exchange. The default singleton in `./clerkClient` is built
 // from env only, so passing these via `clerkMiddleware()` would be silently
-// ignored. When the caller hasn't supplied their own `clerkClient` but did
-// pass `apiUrl`/`apiVersion`, build a per-middleware client with those values.
+// ignored. When the caller hasn't supplied their own `clerkClient` but did pass
+// client construction options, build a per-middleware client with those values.
 const resolveDefaultClerkClient = (options: ClerkMiddlewareOptions) => {
-  if (!options.apiUrl && !options.apiVersion) {
+  const { apiUrl, apiVersion, secretKey, machineSecretKey, publishableKey, jwtKey } = options;
+  if (!apiUrl && !apiVersion && !secretKey && !machineSecretKey && !publishableKey && !jwtKey) {
     return defaultClerkClient;
   }
   const env = { ...loadApiEnv(), ...loadClientEnv() };
   return createClerkClient({
     ...env,
-    ...(options.apiUrl ? { apiUrl: options.apiUrl } : {}),
-    ...(options.apiVersion ? { apiVersion: options.apiVersion } : {}),
+    ...(apiUrl ? { apiUrl } : {}),
+    ...(apiVersion ? { apiVersion } : {}),
+    ...(secretKey ? { secretKey } : {}),
+    ...(machineSecretKey ? { machineSecretKey } : {}),
+    ...(publishableKey ? { publishableKey } : {}),
+    ...(jwtKey ? { jwtKey } : {}),
     userAgent: `${PACKAGE_NAME}@${PACKAGE_VERSION}`,
   });
 };

packages/fastify/src/__tests__/withClerkMiddleware.test.ts

@@ -4,17 +4,22 @@ import { beforeEach, describe, expect, test, vi } from 'vitest';
 
 import { clerkPlugin, getAuth } from '../index';
 
-const authenticateRequestMock = vi.fn();
+const { authenticateRequestMock, createClerkClientMock } = vi.hoisted(() => {
+  const authenticateRequestMock = vi.fn();
+  const createClerkClientMock = vi.fn(() => {
+    return {
+      authenticateRequest: (...args: any) => authenticateRequestMock(...args),
+    };
+  });
+
+  return { authenticateRequestMock, createClerkClientMock };
+});
 
 vi.mock('@clerk/backend', async () => {
   const actual = await vi.importActual('@clerk/backend');
   return {
     ...actual,
-    createClerkClient: () => {
-      return {
-        authenticateRequest: (...args: any) => authenticateRequestMock(...args),
-      };
-    },
+    createClerkClient: (...args: any[]) => createClerkClientMock(...args),
   };
 });
 
@@ -24,6 +29,38 @@ describe('withClerkMiddleware(options)', () => {
     vi.restoreAllMocks();
   });
 
+  test('creates the request client with plugin runtime keys', async () => {
+    authenticateRequestMock.mockResolvedValueOnce({
+      headers: new Headers(),
+      toAuth: () => ({
+        tokenType: 'session_token',
+      }),
+    });
+    const fastify = Fastify();
+    await fastify.register(clerkPlugin, {
+      secretKey: 'runtime_secret_key',
+      publishableKey: 'runtime_publishable_key',
+    });
+
+    fastify.get('/', (request: FastifyRequest, reply: FastifyReply) => {
+      const auth = getAuth(request);
+      reply.send({ auth });
+    });
+
+    const response = await fastify.inject({
+      method: 'GET',
+      path: '/',
+    });
+
+    expect(response.statusCode).toEqual(200);
+    expect(createClerkClientMock).toHaveBeenLastCalledWith(
+      expect.objectContaining({
+        secretKey: 'runtime_secret_key',
+        publishableKey: 'runtime_publishable_key',
+      }),
+    );
+  });
+
   test('handles signin with Authorization Bearer', async () => {
     authenticateRequestMock.mockResolvedValueOnce({
       headers: new Headers(),

packages/fastify/src/withClerkMiddleware.ts

@@ -1,21 +1,31 @@
+import { createClerkClient } from '@clerk/backend';
 import { AuthStatus } from '@clerk/backend/internal';
 import { clerkFrontendApiProxy, DEFAULT_PROXY_PATH, stripTrailingSlashes } from '@clerk/backend/proxy';
 import type { FastifyReply, FastifyRequest } from 'fastify';
 import { Readable } from 'stream';
 
-import { clerkClient } from './clerkClient';
 import * as constants from './constants';
 import type { ClerkFastifyOptions } from './types';
 import { fastifyRequestToRequest, requestToProxyRequest } from './utils';
 
 export const withClerkMiddleware = (options: ClerkFastifyOptions) => {
   const frontendApiProxy = options.frontendApiProxy;
   const proxyPath = stripTrailingSlashes(frontendApiProxy?.path ?? DEFAULT_PROXY_PATH) || DEFAULT_PROXY_PATH;
+  const publishableKey = options.publishableKey || constants.PUBLISHABLE_KEY;
+  const secretKey = options.secretKey || constants.SECRET_KEY;
+  const clerkClient = createClerkClient({
+    ...options,
+    publishableKey,
+    secretKey,
+    machineSecretKey: options.machineSecretKey || constants.MACHINE_SECRET_KEY,
+    apiUrl: options.apiUrl || constants.API_URL,
+    apiVersion: options.apiVersion || constants.API_VERSION,
+    jwtKey: options.jwtKey || constants.JWT_KEY,
+    userAgent: options.userAgent || `${constants.SDK_METADATA.name}@${constants.SDK_METADATA.version}`,
+    sdkMetadata: options.sdkMetadata || constants.SDK_METADATA,
+  });
 
   return async (fastifyRequest: FastifyRequest, reply: FastifyReply) => {
-    const publishableKey = options.publishableKey || constants.PUBLISHABLE_KEY;
-    const secretKey = options.secretKey || constants.SECRET_KEY;
-
     // Handle Frontend API proxy requests and auto-derive proxyUrl
     let resolvedProxyUrl = options.proxyUrl;
     if (frontendApiProxy) {

packages/nuxt/src/runtime/server/__tests__/clerkClient.test.ts

@@ -90,4 +90,20 @@ describe('clerkClient', () => {
       }),
     );
   });
+
+  it('passes runtime options to createClerkClient', () => {
+    mockRuntimeConfig();
+
+    clerkClient({} as any, {
+      secretKey: 'sk_test_runtime',
+      publishableKey: 'pk_test_runtime',
+    });
+
+    expect(createClerkClientMock).toHaveBeenCalledWith(
+      expect.objectContaining({
+        secretKey: 'sk_test_runtime',
+        publishableKey: 'pk_test_runtime',
+      }),
+    );
+  });
 });

packages/nuxt/src/runtime/server/clerkClient.ts

@@ -1,3 +1,4 @@
+import type { ClerkOptions } from '@clerk/backend';
 import { createClerkClient } from '@clerk/backend';
 import { apiUrlFromPublishableKey } from '@clerk/shared/apiUrlFromPublishableKey';
 import { deprecated } from '@clerk/shared/deprecated';
@@ -28,7 +29,7 @@ function resolveApiVersion(runtimeConfig: ReturnType<typeof useRuntimeConfig>):
   return 'v1';
 }
 
-export function clerkClient(event: H3Event) {
+export function clerkClient(event: H3Event, options?: ClerkOptions) {
   const runtimeConfig = useRuntimeConfig(event);
 
   return createClerkClient({
@@ -51,5 +52,6 @@ export function clerkClient(event: H3Event) {
       version: PACKAGE_VERSION,
       environment: process.env.NODE_ENV,
     },
+    ...options,
   });
 }