Intercept authentication flows

1
import express from 'express';
2
import { ScalekitClient } from '@scalekit-sdk/node';
3

4
const app = express();
5
const scalekit = new ScalekitClient(
6
  process.env.SCALEKIT_ENVIRONMENT_URL,
7
  process.env.SCALEKIT_CLIENT_ID,
8
  process.env.SCALEKIT_CLIENT_SECRET
9
);
10

11
// Verify every interceptor route against the raw body, then hand handlers the parsed JSON
12
function verifyInterceptor(req, res, next) {
13
  const rawBody = req.body.toString('utf8');
14
  try {
15
    scalekit.verifyInterceptorPayload(process.env.SCALEKIT_INTERCEPTOR_SECRET, req.headers, rawBody);
16
  } catch (error) {
17
    console.error('Interceptor verification failed:', error);
18
    return res.json({ decision: 'DENY', error: { message: 'Unable to process request.' } });
19
  }
20
  req.body = JSON.parse(rawBody);
21
  next();
22
}
23

24
app.use('/auth/interceptors', express.raw({ type: 'application/json' }), verifyInterceptor);

1
import os
2
from flask import Flask, request
3
from scalekit import ScalekitClient
4

5
app = Flask(__name__)
6
scalekit_client = ScalekitClient(
7
    env_url=os.getenv('SCALEKIT_ENVIRONMENT_URL'),
8
    client_id=os.getenv('SCALEKIT_CLIENT_ID'),
9
    client_secret=os.getenv('SCALEKIT_CLIENT_SECRET'),
10
)
11

12
def verified_body():
13
    """Returns the parsed body, or None when the signature is invalid."""
14
    headers = {
15
        'interceptor-id': request.headers.get('interceptor-id'),
16
        'interceptor-signature': request.headers.get('interceptor-signature'),
17
        'interceptor-timestamp': request.headers.get('interceptor-timestamp'),
18
    }
19
    try:
20
        if not scalekit_client.verify_interceptor_payload(
21
            secret=os.getenv('SCALEKIT_INTERCEPTOR_SECRET'),
22
            headers=headers,
23
            payload=request.get_data(),
24
        ):
25
            return None
26
    except Exception as error:
27
        print(f'Interceptor verification failed: {error}')
28
        return None
29
    return request.get_json()
30

31
DENY_UNVERIFIED = {'decision': 'DENY', 'error': {'message': 'Unable to process request.'}}

1
package main
2

3
import (
4
    "io"
5
    "log"
6
    "os"
7

8
    "github.com/gin-gonic/gin"
9
    "github.com/scalekit-inc/scalekit-sdk-go/v2"
10
)
11

12
var scalekitClient = scalekit.NewScalekitClient(
13
    os.Getenv("SCALEKIT_ENVIRONMENT_URL"),
14
    os.Getenv("SCALEKIT_CLIENT_ID"),
15
    os.Getenv("SCALEKIT_CLIENT_SECRET"),
16
)
17

18
// verifiedBody returns the raw body once the signature checks out
19
func verifiedBody(c *gin.Context) ([]byte, bool) {
20
    body, err := io.ReadAll(c.Request.Body)
21
    if err != nil {
22
        return nil, false
23
    }
24
    headers := map[string]string{
25
        "interceptor-id":        c.GetHeader("interceptor-id"),
26
        "interceptor-signature": c.GetHeader("interceptor-signature"),
27
        "interceptor-timestamp": c.GetHeader("interceptor-timestamp"),
28
    }
29
    if _, err := scalekitClient.VerifyInterceptorPayload(os.Getenv("SCALEKIT_INTERCEPTOR_SECRET"), headers, body); err != nil {
30
        log.Printf("Interceptor verification failed: %v", err)
31
        return nil, false
32
    }
33
    return body, true
34
}

1
import com.scalekit.webhooks.ScalekitInterceptor;
2
import java.nio.charset.StandardCharsets;
3
import java.util.Map;
4

5
@RestController
6
@RequestMapping("/auth/interceptors")
7
public class InterceptorController {
8

9
    private final ScalekitInterceptor interceptor = new ScalekitInterceptor();
10

11
    // Returns true once the signature over the raw body checks out
12
    private boolean isVerified(String body, Map<String, String> headers) {
13
        try {
14
            return interceptor.verifyInterceptorPayload(
15
                System.getenv("SCALEKIT_INTERCEPTOR_SECRET"),
16
                headers,
17
                body.getBytes(StandardCharsets.UTF_8));
18
        } catch (Exception error) {
19
            System.err.println("Interceptor verification failed: " + error.getMessage());
20
            return false;
21
        }
22
    }
23
}

{
  "decision": "ALLOW"
}

{
  "decision": "ALLOW",
  "response": {
    "select_organization": {
      "organization_id": "org_93418204671239865", // Scalekit's organization ID
      "external_organization_id": "your_external_org_id" // Or your own ID for the organization; used only when organization_id is absent
    }
  }
}

{
  "decision": "ALLOW",
  "response": {
    "create_organization_membership": {
      "organization_id": "org_93418204671239865", // Scalekit's organization ID
      "external_organization_id": "your_external_org_id", // Or your own ID for the organization; used only when organization_id is absent
      "roles": ["member"] // Optional: roles for a new membership; an existing one keeps its roles
    }
  }
}

{
  "decision": "DENY",
  "error": { "message": "Your account is suspended. Contact your administrator." }
}

1
app.post('/auth/interceptors/post-user-authentication', (req, res) => {
2
  const { interceptor_context, data } = req.body;
3
  const workspaceOrgId = interceptor_context.auth_request?.organization_id;
4
  const memberships = data.user?.memberships ?? [];
5

6
  const isActiveMember = memberships.some(
7
    (m) => m.organization_id === workspaceOrgId && m.status === 'ACTIVE'
8
  );
9
  if (!workspaceOrgId || !isActiveMember) {
10
    return res.json({ decision: 'ALLOW' }); // The user picks an organization
11
  }
12

13
  return res.json({
14
    decision: 'ALLOW',
15
    response: { select_organization: { organization_id: workspaceOrgId } }
16
  });
17
});

1
@app.post('/auth/interceptors/post-user-authentication')
2
def post_user_authentication():
3
    body = verified_body()
4
    if body is None:
5
        return DENY_UNVERIFIED
6

7
    workspace_org_id = (body['interceptor_context'].get('auth_request') or {}).get('organization_id')
8
    memberships = (body['data'].get('user') or {}).get('memberships', [])
9

10
    is_active_member = any(
11
        m['organization_id'] == workspace_org_id and m['status'] == 'ACTIVE' for m in memberships
12
    )
13
    if not workspace_org_id or not is_active_member:
14
        return {'decision': 'ALLOW'}  # The user picks an organization
15

16
    return {
17
        'decision': 'ALLOW',
18
        'response': {'select_organization': {'organization_id': workspace_org_id}},
19
    }

{
  "decision": "ALLOW"
}

{
  "decision": "ALLOW",
  "response": {
    "create_organization_membership": {
      "organization_id": "org_93731871904672153", // Scalekit's organization ID
      "external_organization_id": "your_external_org_id", // Or your own ID for the organization; used only when organization_id is absent
      "roles": ["member"] // Optional: roles for the new membership
    }
  }
}

{
  "decision": "DENY",
  "error": { "message": "Sign up with your work email address." }
}

1
// Email domain → your external ID for the organization
2
const domainToOrg = {
3
  'northwind.com': 'northwind',
4
  'globex.com': 'globex',
5
  'initech.com': 'initech'
6
};
7

8
app.post('/auth/interceptors/pre-signup', (req, res) => {
9
  const email = req.body.interceptor_context.user_email;
10
  const externalOrgId = domainToOrg[email.split('@')[1]?.toLowerCase()];
11

12
  if (!externalOrgId) {
13
    return res.json({ decision: 'ALLOW' }); // Creates a new organization
14
  }
15
  return res.json({
16
    decision: 'ALLOW',
17
    response: {
18
      create_organization_membership: { external_organization_id: externalOrgId, roles: ['member'] }
19
    }
20
  });
21
});

1
# Email domain → your external ID for the organization
2
DOMAIN_TO_ORG = {
3
    'northwind.com': 'northwind',
4
    'globex.com': 'globex',
5
    'initech.com': 'initech',
6
}
7

8
@app.post('/auth/interceptors/pre-signup')
9
def pre_signup():
10
    body = verified_body()
11
    if body is None:
12
        return DENY_UNVERIFIED
13

14
    email = body['interceptor_context']['user_email']
15
    external_org_id = DOMAIN_TO_ORG.get(email.split('@')[-1].lower())
16

17
    if not external_org_id:
18
        return {'decision': 'ALLOW'}  # Creates a new organization
19
    return {
20
        'decision': 'ALLOW',
21
        'response': {
22
            'create_organization_membership': {
23
                'external_organization_id': external_org_id,
24
                'roles': ['member'],
25
            }
26
        },
27
    }

{
  "decision": "ALLOW"
}

{
  "decision": "ALLOW",
  "response": {
    "claims": { "plan": "pro", "features": ["forecasting", "api_access"] }
  }
}

{
  "decision": "DENY",
  "error": { "message": "Your trial has ended. Contact sales to continue." }
}

app.post('/auth/interceptors/pre-session-creation', async (req, res) => {
  const { user_id, organization_id } = req.body.interceptor_context;

  // Look up what your app knows about this user in this organization
  const account = await getAccount(user_id, organization_id);

  return res.json({
    decision: 'ALLOW',
    response: {
      claims: { plan: account.plan, features: account.features }
    }
  });
});

@app.post('/auth/interceptors/pre-session-creation')
def pre_session_creation():
    body = verified_body()
    if body is None:
        return DENY_UNVERIFIED

    context = body['interceptor_context']
    # Look up what your app knows about this user in this organization
    account = get_account(context['user_id'], context['organization_id'])

    return {
        'decision': 'ALLOW',
        'response': {'claims': {'plan': account['plan'], 'features': account['features']}},
    }

{
  "decision": "ALLOW"
}

{
  "decision": "DENY",
  "error": { "message": "Invite people with an @initech.com address." }
}

{
  "decision": "ALLOW"
}

{
  "decision": "ALLOW",
  "response": {
    "claims": { "rate_limit": 1000 }
  }
}

{
  "decision": "DENY",
  "error": { "message": "This client is disabled." }
}