Function getUserFromAuth

apps/web/src/lib/user/server.ts:987–1046

(opts: RequiredPermissions)

          },
          extra: {
            ...accountInfo,
            isAccountLinking,
            linkingSession,
          },
        });
        if (accountInfo)
          posthogClient.capture({
            distinctId: accountInfo.google_user_email,
            event: operation + '_failed',
            properties: {
              error: error instanceof Error ? error.message : String(error),
              email: accountInfo.google_user_email,
              name: accountInfo.google_user_name,
              hosted_domain: accountInfo.hosted_domain,
              isAccountLinking,
            },
          });

        // Clear linking session if it was an account linking attempt
        return redirectUrlForCode('UNKNOWN-ERROR');
      }
    },
    async jwt({ token, account, user, trigger, profile }) {
      let accountInfo: CreateOrUpdateUserArgs | undefined = undefined;
      try {
        if (!trigger) return token;
        if (!account) throw new Error(`TRAP: No account found: ${trigger}`);

        accountInfo = createAccountInfo(account, user, profile);
        const existingUser = await findAndSyncExistingUser(accountInfo);

        assert(existingUser, `TRAP: No existing user found for ${accountInfo.google_user_email}`);

        token.kiloUserId = existingUser.id;

        token.version = JWT_TOKEN_VERSION;
        token.exp = Math.floor(Date.now() / 1000) + secondsInDay * 30;
        token.iat = Math.floor(Date.now() / 1000);
        token.isNewUser = (profile as ExtendedProfile)?.isNewUser || false;
        token.webSessionPepper = existingUser.web_session_pepper;
        token.isAdmin = existingUser.is_admin;
        token.authProvider = accountInfo.provider;
        token.authenticatedAt = token.iat;
        delete token.ssoSourceOrganizationId;

        if (accountInfo.provider === 'workos') {
          const domain = getLowerDomainFromEmail(existingUser.google_user_email);
          assert(domain, 'WorkOS user must have a valid primary email domain');
          const ssoAuthority = await resolveSsoAuthorityForDomain(domain);
          assert(
            ssoAuthority.status === 'required',
            `WorkOS user does not have one active SSO authority for ${domain}`
          );
          token.ssoSourceOrganizationId = ssoAuthority.sourceOrganizationId;
        }

        if (existingUser.is_admin) {
          // Admin audit trail: identify which Kilocode admin authenticated.