Function getSession

packages/core/src/server/auth.ts:990–1067

(event: H3Event)

 * page load.
 */
export async function getSession(event: H3Event): Promise<AuthSession | null> {
  // 1. ACCESS_TOKEN check (programmatic/agent access)
  const accessTokens = getAccessTokens();
  if (accessTokens.length > 0) {
    const cookie = getCookie(event, COOKIE_NAME);
    if (cookie) {
      const email = await getSessionEmail(cookie);
      if (email) return { email, token: cookie };
    }
  }

  // 2. BYOA custom getSession
  if (customGetSession) {
    const session = await customGetSession(event);
    if (session) return session;

    const bearerSession = await getBearerLegacySession(event);
    if (bearerSession) return bearerSession;

    // Desktop SSO broker: even with BYOA auth, fall back to the broker
    // for Electron requests so cross-template SSO works for custom-auth
    // templates too. Gated on `readDesktopSsoSafely` so a non-loopback
    // request that spoofs `User-Agent: ... Electron/...` cannot read the
    // home-dir broker file (and so production builds never consult it).
    const sso = await readDesktopSsoSafely(event);
    if (sso?.email) return { email: sso.email, token: sso.token };
    // Fall through to mobile _session check
  } else {
    // 3. Bearer legacy session. Desktop/native clients can persist a session
    // token outside the WebView cookie jar and attach it to all app requests.
    const bearerSession = await getBearerLegacySession(event);
    if (bearerSession) return bearerSession;

    // 4. Better Auth session (cookie or Bearer token)
    try {
      const ba = getBetterAuthSync();
      if (ba) {
        const baSession = await ba.api.getSession({
          headers: event.headers,
        });
        if (baSession?.user?.email) {
          return mapBetterAuthSession(baSession);
        }
      }
    } catch (e) {
      console.error("[auth] ba.api.getSession error:", e);
    }

    // 5. Legacy cookie fallback (for sessions created before migration)
    const cookie = getCookie(event, COOKIE_NAME);
    if (cookie) {
      const email = await getSessionEmail(cookie);
      if (email) {
        return { email, token: cookie };
      }
    }

    // 6. Desktop SSO broker fallback.