Function validateAuthorizationHeader

apps/web/src/lib/tokens.ts:130–164

(headers: Headers)

    tokenPurpose: 'internal-service',
    credentialExchange: false,
    extra: options.organizationId ? { organizationId: options.organizationId } : undefined,
  });

  if (isBoundedInternalServiceTokenIssuanceEnabled()) {
    return jwt.sign(payload, NEXTAUTH_SECRET, { algorithm: jwtSigningAlgorithm });
  }

  return generateInternalServiceToken(userId, {
    expiresIn: options.expiresIn,
    audience:
      options.audience === SESSION_INGEST_AUDIENCE ||
      options.audience === GITHUB_USER_AUTHORIZATION_DISCONNECT_AUDIENCE
        ? undefined
        : options.audience,
    organizationId: options.organizationId,
  });
}

export function generateApiToken(
  { id, api_token_pepper }: User,
  extraPayload?: JWTTokenExtraPayload,
  options?: { expiresIn?: number }
) {
  return jwt.sign(
    {
      env: process.env.NODE_ENV,
      kiloUserId: id,
      apiTokenPepper: api_token_pepper,
      version: JWT_TOKEN_VERSION,
      ...extraPayload,
    },
    NEXTAUTH_SECRET,
    {
      algorithm: jwtSigningAlgorithm,
      expiresIn: options?.expiresIn ?? FIVE_YEARS_IN_SECONDS,
    }
  );
}