supabase.auth.ring — io.github.supabase-community/auth 0.4.0

Ring middleware for Supabase Auth JWT verification.

Verifies the bearer token on incoming requests via supabase.auth/get-claims (local JWKS verification for asymmetric algorithms, server-side check for HS256) and attaches the verified claims to the request map. Depends only on the Ring request/response map shape, not on Ring itself.

Example

(require '[supabase.auth.ring :as auth.ring])

(def app
  (-> handler
      (auth.ring/wrap-authentication client {:required? true})))

;; downstream handlers read the verified identity:
(defn handler [request]
  (let [user-id (get-in request [:supabase/claims :sub])]
    ...))

bearer-token clj

(bearer-token request)

Extracts the bearer token from a Ring request's authorization header. Returns nil when the header is absent or uses another scheme.

wrap-authentication clj

(wrap-authentication handler client)

(wrap-authentication handler client opts)

Middleware that verifies the request's bearer token against Supabase Auth and assocs the result onto the request:

• :supabase/claims — the verified JWT claims map
• :supabase/token — the raw access token

Without a (valid) token the request passes through untouched, unless :required? is set, in which case the middleware short-circuits with a 401 response.

Supports both sync and async Ring handlers.

Options

• :required? — reject unauthenticated requests (default false)
• :on-unauthenticated — fn of the request returning the rejection response (default: plain 401)

Example

;; optional auth: handler decides per route
(wrap-authentication handler client)

;; hard requirement with custom rejection
(wrap-authentication handler client
                     {:required? true
                      :on-unauthenticated (fn [_] {:status 302
                                                   :headers {"location" "/login"}
                                                   :body ""})})