Execute Request

1#!/usr/bin/env bash
2
3# Execute a Clerk Backend API request with scope enforcement.
4#
5# Usage: bash execute-request.sh [--admin] <METHOD> <PATH> [BODY]
6#
7# Scope enforcement:
8#   GET     — always allowed
9#   POST, PUT, PATCH — requires CLERK_BAPI_SCOPES="write" or --admin flag
10#   DELETE  — requires CLERK_BAPI_SCOPES="write,delete" or --admin flag
11
12set -euo pipefail
13
14# Walk up from $PWD to find .env/.env.local (mirrors Clerk CLI behavior).
15# Stops at the first directory that provides CLERK_SECRET_KEY.
16_dir="$PWD"
17while true; do
18  for _envfile in "$_dir/.env" "$_dir/.env.local"; do
19    if [[ -f "$_envfile" ]]; then
20      set -a
21      source "$_envfile"
22      set +a
23    fi
24  done
25  [[ -n "${CLERK_SECRET_KEY:-}" ]] && break
26  _parent="$(dirname "$_dir")"
27  [[ "$_parent" == "$_dir" ]] && break
28  _dir="$_parent"
29done
30unset _dir _parent _envfile
31
32# Parse --admin flag
33ADMIN=false
34if [[ "${1:-}" == "--admin" ]]; then
35  ADMIN=true
36  shift
37fi
38
39METHOD="${1:?Usage: execute-request.sh [--admin] <METHOD> <PATH> [BODY]}"
40PATH_ARG="${2:?Usage: execute-request.sh [--admin] <METHOD> <PATH> [BODY]}"
41BODY="${3:-}"
42
43METHOD_UPPER=$(echo "$METHOD" | tr '[:lower:]' '[:upper:]')
44SCOPES="${CLERK_BAPI_SCOPES:-}"
45
46# Scope check
47if [[ "$ADMIN" == false ]]; then
48  case "$METHOD_UPPER" in
49    GET)
50      ;; # always allowed
51    POST|PUT|PATCH)
52      if [[ "$SCOPES" != *"write"* ]]; then
53        echo "ERROR: $METHOD_UPPER requests require CLERK_BAPI_SCOPES=\"write\" or --admin flag." >&2
54        echo "Current CLERK_BAPI_SCOPES: \"$SCOPES\"" >&2
55        exit 1
56      fi
57      ;;
58    DELETE)
59      if [[ "$SCOPES" != *"write"* ]] || [[ "$SCOPES" != *"delete"* ]]; then
60        echo "ERROR: DELETE requests require CLERK_BAPI_SCOPES=\"write,delete\" or --admin flag." >&2
61        echo "Current CLERK_BAPI_SCOPES: \"$SCOPES\"" >&2
62        exit 1
63      fi
64      ;;
65    *)
66      echo "ERROR: Unknown HTTP method: $METHOD_UPPER" >&2
67      exit 1
68      ;;
69  esac
70fi
71
72# Base URL: use CLERK_REST_API_URL if set, otherwise default to production
73BASE_URL="${CLERK_REST_API_URL:-https://api.clerk.com}"
74
75# Build curl command
76CURL_ARGS=(
77  -s
78  -X "$METHOD_UPPER"
79  "${BASE_URL}/v1${PATH_ARG}"
80  -H "Authorization: Bearer ${CLERK_SECRET_KEY:?CLERK_SECRET_KEY is not set}"
81  -H "Content-Type: application/json"
82)
83
84if [[ -n "$BODY" ]]; then
85  CURL_ARGS+=(-d "$BODY")
86fi
87
88curl "${CURL_ARGS[@]}"