Clerk

import { createClerkClient, verifyToken } from "@clerk/backend";
import { NoResponse, fromClerk } from "@noresponse/node";

const clerk = createClerkClient({ secretKey: process.env.CLERK_SECRET_KEY });
const nr = new NoResponse(); // reads NORESPONSE_API_KEY

// Clerk's Backend API gives times in Unix milliseconds.
const rfc3339 = (ms: number) => new Date(ms).toISOString().replace(/\.\d+Z$/, "Z");

export async function assessAccountCreation(sessionToken: string, ip: string) {
  // 1. Clerk verifies the session token and returns its claims.
  const claims = await verifyToken(sessionToken, {
    secretKey: process.env.CLERK_SECRET_KEY,
    authorizedParties: ["https://app.example.com"],
  });
  const [user, session] = await Promise.all([
    clerk.users.getUser(claims.sub),
    clerk.sessions.getSession(claims.sid),
  ]);

  // 2. The adapter maps the claims; the records supply the rest.
  const authContext = fromClerk(claims, {
    sessionCreatedAt: rfc3339(session.createdAt),
    accountCreatedAt: rfc3339(user.createdAt),
    emailVerified: user.primaryEmailAddress?.verification?.status === "verified",
    phoneVerified: user.primaryPhoneNumber?.verification?.status === "verified",
  });

  // 3. NoResponse assesses the account creation.
  return nr.assessments.create({
    accountId: user.id,
    identifiers: { email: user.primaryEmailAddress?.emailAddress, ip },
    flow: "account_creation",
    authContext,
  });
}

import os
from datetime import datetime, timezone
from typing import Any

from clerk_backend_api import Clerk
from clerk_backend_api.security import verify_token
from clerk_backend_api.security.types import VerifyTokenOptions
from noresponse import Assessment, NoResponse, from_clerk

clerk = Clerk(bearer_auth=os.environ["CLERK_SECRET_KEY"])
nr = NoResponse()  # reads NORESPONSE_API_KEY


def rfc3339(ms: int) -> str:
    """Clerk's Backend API gives times in Unix milliseconds."""
    return datetime.fromtimestamp(ms / 1000, tz=timezone.utc).strftime("%Y-%m-%dT%H:%M:%SZ")


def primary_verified(items: list[Any], primary_id: str | None) -> bool:
    """True when the primary email address or phone number is verified."""
    return any(item.id == primary_id and item.verification is not None and item.verification.status == "verified" for item in items)


def assess_account_creation(session_token: str, ip: str) -> Assessment:
    # 1. Clerk verifies the session token and returns its claims.
    claims = verify_token(session_token, VerifyTokenOptions(
        secret_key=os.environ["CLERK_SECRET_KEY"],
        authorized_parties=["https://app.example.com"],
    ))
    user = clerk.users.get(user_id=claims["sub"])
    session = clerk.sessions.get(session_id=claims["sid"])

    # 2. The adapter maps the claims; the records supply the rest.
    auth_context = from_clerk(claims, {
        "session_created_at": rfc3339(session.created_at),
        "account_created_at": rfc3339(user.created_at),
        "email_verified": primary_verified(user.email_addresses, user.primary_email_address_id),
        "phone_verified": primary_verified(user.phone_numbers, user.primary_phone_number_id),
    })

    # 3. NoResponse assesses the account creation.
    email = next((item.email_address for item in user.email_addresses if item.id == user.primary_email_address_id), None)
    return nr.assessments.create(
        account_id=user.id,
        identifiers={"email": email, "ip": ip} if email else {"ip": ip},
        flow="account_creation",
        auth_context=auth_context,
    )

package accounts

import (
	"context"
	"os"
	"sync"
	"time"

	"github.com/clerk/clerk-sdk-go/v2"
	"github.com/clerk/clerk-sdk-go/v2/jwt"
	"github.com/clerk/clerk-sdk-go/v2/session"
	"github.com/clerk/clerk-sdk-go/v2/user"
	noresponse "github.com/noresponsehq/go/v5"
	"github.com/noresponsehq/go/v5/models/components"
)

var (
	nr   = noresponse.NewClient(os.Getenv("NORESPONSE_API_KEY"))
	keys sync.Map // Clerk signing keys by key id, so each is fetched once
)

func init() { clerk.SetKey(os.Getenv("CLERK_SECRET_KEY")) }

// signingKey returns the Clerk key that signed the token.
func signingKey(ctx context.Context, token string) (*clerk.JSONWebKey, error) {
	unverified, err := jwt.Decode(ctx, &jwt.DecodeParams{Token: token})
	if err != nil {
		return nil, err
	}
	if k, ok := keys.Load(unverified.KeyID); ok {
		return k.(*clerk.JSONWebKey), nil
	}
	k, err := jwt.GetJSONWebKey(ctx, &jwt.GetJSONWebKeyParams{KeyID: unverified.KeyID})
	if err != nil {
		return nil, err
	}
	keys.Store(unverified.KeyID, k)
	return k, nil
}

// rfc3339 formats a Clerk Backend API time, which is in Unix milliseconds.
func rfc3339(ms int64) string { return time.UnixMilli(ms).UTC().Format(time.RFC3339) }

// primaryEmail returns the user's primary email address and whether it is verified.
func primaryEmail(u *clerk.User) (*string, bool) {
	for _, e := range u.EmailAddresses {
		if u.PrimaryEmailAddressID != nil && e.ID == *u.PrimaryEmailAddressID {
			return &e.EmailAddress, e.Verification != nil && e.Verification.Status == "verified"
		}
	}
	return nil, false
}

// primaryPhoneVerified reports whether the user's primary phone number is verified.
func primaryPhoneVerified(u *clerk.User) bool {
	for _, p := range u.PhoneNumbers {
		if u.PrimaryPhoneNumberID != nil && p.ID == *u.PrimaryPhoneNumberID {
			return p.Verification != nil && p.Verification.Status == "verified"
		}
	}
	return false
}

func AssessAccountCreation(ctx context.Context, sessionToken, ip string) (*components.Assessment, error) {
	// 1. Clerk verifies the session token and returns its claims.
	jwk, err := signingKey(ctx, sessionToken)
	if err != nil {
		return nil, err
	}
	claims, err := jwt.Verify(ctx, &jwt.VerifyParams{
		Token:                  sessionToken,
		JWK:                    jwk,
		AuthorizedPartyHandler: func(azp string) bool { return azp == "https://app.example.com" },
		// Also decode every claim into a map for the adapter. Clerk's typed
		// claims report a missing fva as 0, which reads as a second factor
		// passed just now.
		CustomClaimsConstructor: func(context.Context) any { return &map[string]any{} },
	})
	if err != nil {
		return nil, err
	}
	raw := *claims.Custom.(*map[string]any)
	usr, err := user.Get(ctx, claims.Subject)
	if err != nil {
		return nil, err
	}
	sess, err := session.Get(ctx, claims.SessionID)
	if err != nil {
		return nil, err
	}

	// 2. The adapter maps the claims; the records supply the rest.
	email, emailVerified := primaryEmail(usr)
	authContext, err := noresponse.FromClerkClaims(raw, map[string]any{
		"session_created_at": rfc3339(sess.CreatedAt),
		"account_created_at": rfc3339(usr.CreatedAt),
		"email_verified":     emailVerified,
		"phone_verified":     primaryPhoneVerified(usr),
	})
	if err != nil {
		return nil, err
	}

	// 3. NoResponse assesses the account creation. The second argument is the
	// Idempotency-Key, which the SDK reuses across its own retries.
	res, err := nr.Assessments.Create(ctx, noresponse.NewIdempotencyKey(), components.AssessmentRequest{
		AccountID:   usr.ID,
		Identifiers: components.AssessmentRequestIdentifiers{Email: email, IP: noresponse.Pointer(ip)},
		Flow:        components.FlowAccountCreation,
		AuthContext: authContext,
	})
	if err != nil {
		return nil, err
	}
	return &res.Result, nil
}