apigw_sinatra.rb

def decode_jwt(id_token)
  id_token = id_token.slice(7 .. -1) if id_token =~ /^Bearer/i

  JWT.decode id_token, ENV['AUTH0_CLIENT_SECRET'], true,
    algorithm: ENV['AUTH0_JWT_ALGO'], verify_iss: true,
    aud: ENV['AUTH0_CLIENT_ID'],
    verify_aud: true
end

before do
  content_type :json

  begin
    @jwt = decode_jwt(request.env["HTTP_AUTHORIZATION"])
    raise "JWT decode error" if @jwt.nil?

    payload = @jwt.first
    raise "User is not provisioned: customer_id missing" if payload['app_metadata'].nil? or 
      payload['app_metadata']['customer_id'].nil?

    @data_service = DataServiceClient.new(payload['app_metadata']['customer_id'].to_i)

  rescue JWT::DecodeError, RuntimeError => e
    halt 403, { error: 'Unauthorized', message: e.message }.to_json
  end

end