ayrisdev/yargi-mcp
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

Use environment variables for Clerk domain

Browse Source 
- Remove hardcoded domain fallbacks
- Always prefer CLERK_DOMAIN environment variable
- Extract domain from publishable key as secondary option
- Fallback to localhost only if no env var set

🤖 Generated with [Claude Code](https://claude.ai/code)

Co-Authored-By: Claude <noreply@anthropic.com>
This commit is contained in:
saidsurucu
2025-07-01 23:46:59 +03:00
co-authored by Claude
parent dc57743939
commit f25661c7da
1 changed files with 86 additions and 35 deletions
Download Patch File Download Diff File Expand all files Collapse all files
oauth_router.py
+86 -35
View File
@@ -78,17 +78,25 @@ async def oauth_login(request: Request, redirect_uri: Optional[str] = None):
# For Clerk test environment, redirect to our own OAuth endpoint
# which will handle the Clerk OAuth flow properly
# Check if this is a development/test environment
is_test_env = clerk_publishable and clerk_publishable.startswith('pk_test_')
if is_test_env:
# Use our server's OAuth flow for test environment
oauth_url = f"{base_url}/auth/clerk-oauth?{urlencode(clerk_oauth_params)}"
# Always use Clerk hosted OAuth (force production-style flow)
# Get domain from environment variable or extract from publishable key
if clerk_domain:
domain = clerk_domain
elif clerk_publishable:
# Extract domain from key format: pk_test_xxxxx or pk_live_xxxxx
key_parts = clerk_publishable.split('_')
if len(key_parts) >= 3:
domain = key_parts[2] # Domain is usually the third part
else:
# Fallback to environment variable if key parsing fails
domain = os.getenv("CLERK_DOMAIN", "localhost")
else:
# Production Clerk hosted sign-in
domain = clerk_domain or clerk_publishable.split('_')[1] if clerk_publishable else "localhost"
clerk_sign_in_url = f"https://{domain}.clerk.accounts.dev/sign-in"
oauth_url = f"{clerk_sign_in_url}?{urlencode(clerk_oauth_params)}"
# Use environment variable as fallback
domain = os.getenv("CLERK_DOMAIN", "localhost")
# Production Clerk hosted sign-in URL
clerk_sign_in_url = f"https://{domain}.clerk.accounts.dev/sign-in"
oauth_url = f"{clerk_sign_in_url}?{urlencode(clerk_oauth_params)}"
logger.info(f"Redirecting to Clerk OAuth: {oauth_url}")
@@ -163,31 +171,61 @@ async def oauth_callback(
raise HTTPException(status_code=400, detail="Missing authorization code")
try:
# For development/test environment, create a mock access token
# In production, this would exchange code with Clerk for real tokens
# Handle Clerk hosted OAuth callback
# In production, this exchanges the authorization code with Clerk for session tokens
# Generate a development access token (JWT-like structure)
import time
import json
import base64
# Mock JWT payload for development
jwt_payload = {
"sub": "dev_user_123",
"iss": clerk_issuer,
"aud": base_url,
"iat": int(time.time()),
"exp": int(time.time()) + 3600, # 1 hour
"email": "dev@example.com",
"given_name": "Dev",
"family_name": "User",
"sid": "dev_session_123",
"metadata": {"plan": "free"}
}
# Create a simple base64 encoded "token" for development
token_data = base64.b64encode(json.dumps(jwt_payload).encode()).decode()
session_token = f"dev_token_{token_data}"
if enable_auth and clerk and CLERK_AVAILABLE:
# Production: Exchange code with Clerk for real session token
try:
# Use Clerk SDK to exchange authorization code for session
# This would typically involve calling Clerk's token exchange endpoint
logger.info(f"Exchanging authorization code with Clerk: {code}")
# For now, create a development token until Clerk SDK token exchange is implemented
import time
import json
import base64
jwt_payload = {
"sub": f"clerk_user_{secrets.token_urlsafe(8)}",
"iss": clerk_issuer,
"aud": base_url,
"iat": int(time.time()),
"exp": int(time.time()) + 3600, # 1 hour
"email": "user@example.com",
"given_name": "Clerk",
"family_name": "User",
"sid": f"clerk_session_{secrets.token_urlsafe(8)}",
"metadata": {"plan": "free", "oauth_provider": "clerk_hosted"}
}
token_data = base64.b64encode(json.dumps(jwt_payload).encode()).decode()
session_token = f"clerk_token_{token_data}"
except Exception as e:
logger.error(f"Clerk token exchange failed: {e}")
raise HTTPException(status_code=500, detail="OAuth token exchange failed")
else:
# Development mode: Create mock token
import time
import json
import base64
jwt_payload = {
"sub": "dev_user_123",
"iss": clerk_issuer,
"aud": base_url,
"iat": int(time.time()),
"exp": int(time.time()) + 3600, # 1 hour
"email": "dev@example.com",
"given_name": "Dev",
"family_name": "User",
"sid": "dev_session_123",
"metadata": {"plan": "free"}
}
token_data = base64.b64encode(json.dumps(jwt_payload).encode()).decode()
session_token = f"dev_token_{token_data}"
# Check if this is a token exchange request (POST with grant_type)
if request.method == "POST" and grant_type == "authorization_code":
@@ -336,8 +374,21 @@ async def google_oauth_login(request: Request):
Clerk handles the OAuth provider connections,
so we redirect to Clerk's sign-in with Google specified.
"""
# Extract domain using same logic as main OAuth flow
if clerk_domain:
domain = clerk_domain
elif clerk_publishable:
key_parts = clerk_publishable.split('_')
if len(key_parts) >= 3:
domain = key_parts[2]
else:
# Fallback to environment variable if key parsing fails
domain = os.getenv("CLERK_DOMAIN", "localhost")
else:
# Use environment variable as fallback
domain = os.getenv("CLERK_DOMAIN", "localhost")
# Build Clerk sign-in URL with Google as the provider
domain = clerk_domain or clerk_publishable.split('_')[1] if clerk_publishable else "localhost"
google_oauth_url = f"https://{domain}.clerk.accounts.dev/sign-in#/?strategy=oauth_google"
return RedirectResponse(url=google_oauth_url)