fix(express): forward clockSkewInMs

Author: jeremy-clerk

packages/express/src/__tests__/clerkMiddleware.test.ts

@@ -14,6 +14,7 @@ vi.mock('@clerk/backend/proxy', async () => {
 
 import { clerkMiddleware } from '../clerkMiddleware';
 import { getAuth } from '../getAuth';
+import { authenticateRequest } from '../authenticateRequest';
 import { assertNoDebugHeaders, assertSignedOutDebugHeaders, runMiddleware, runMiddlewareOnPath } from './helpers';
 
 describe('clerkMiddleware', () => {
@@ -94,6 +95,36 @@ describe('clerkMiddleware', () => {
     assertSignedOutDebugHeaders(response);
   });
 
+  it('forwards clockSkewInMs to authenticateRequest', async () => {
+    const authenticateRequestMock = vi.fn().mockResolvedValue({});
+    const clerkClient = {
+      authenticateRequest: authenticateRequestMock,
+    } as any;
+
+    await authenticateRequest({
+      clerkClient,
+      request: {
+        method: 'GET',
+        url: '/',
+        headers: {
+          host: 'example.com',
+        },
+      } as Request,
+      options: {
+        publishableKey: 'pk_test_Y2xlcmsuZXhhbXBsZS5jb20k',
+        secretKey: 'sk_test_....',
+        clockSkewInMs: 12_345,
+      },
+    });
+
+    expect(authenticateRequestMock).toHaveBeenCalledWith(
+      expect.any(Request),
+      expect.objectContaining({
+        clockSkewInMs: 12_345,
+      }),
+    );
+  });
+
   it('throws error if clerkMiddleware is not executed before getAuth', async () => {
     const customMiddleware: RequestHandler = (request, response, next) => {
       const auth = getAuth(request);

packages/express/src/authenticateRequest.ts

@@ -24,7 +24,7 @@ import { incomingMessageToRequest, loadApiEnv, loadClientEnv, requestToProxyRequ
  */
 export const authenticateRequest = (opts: AuthenticateRequestParams) => {
   const { clerkClient, request, options } = opts;
-  const { jwtKey, authorizedParties, audience, acceptsToken } = options || {};
+  const { jwtKey, authorizedParties, audience, acceptsToken, clockSkewInMs } = options || {};
 
   const clerkRequest = createClerkRequest(incomingMessageToRequest(request));
   const env = { ...loadApiEnv(), ...loadClientEnv() };
@@ -55,6 +55,7 @@ export const authenticateRequest = (opts: AuthenticateRequestParams) => {
     machineSecretKey,
     publishableKey,
     jwtKey,
+    clockSkewInMs,
     authorizedParties,
     proxyUrl,
     isSatellite,