Function validateUserAuthorization

apps/web/src/lib/user/server.ts:1081–1122

(
  kiloUserId: string,
  user: User | undefined,
  opts: RequiredPermissions,
  isNewUser?: boolean,
  organizationId?: Organization['id'],
  internalApiUse?: boolean,
  fromDb: typeof db = db,
  botId?: string,
  tokenSource?: string
)

      session.ssoSourceOrganizationId = castToken.ssoSourceOrganizationId;
      return session;
    },
  },
  pages: {
    signIn: '/users/sign_in',
    error: '/users/sign_in',
  },
  debug: !!getEnvVariable('DEBUG_AUTH'),
};

export const nextAuthHttpHandler = NextAuth(authOptions);

export type RequiredPermissions = {
  adminOnly: boolean;
  DANGEROUS_allowBlockedUsers?: boolean;
  expectedAudience?: string;
};

type GetAuthResponse =
  | {
      user: null;
      authFailedResponse: NextResponse<FailureResult<string>>;
      isNewUser?: undefined;
      organizationId?: undefined;
      internalApiUse?: undefined;
      botId?: undefined;
      tokenSource?: undefined;
      deviceSessionId?: undefined;
    }
  | {
      user: User;
      authFailedResponse: null;
      isNewUser?: boolean;
      organizationId?: Organization['id'];
      internalApiUse?: boolean;
      botId?: string;
      tokenSource?: string;
      deviceSessionId?: string;
    };

export async function getUserFromAuth(opts: RequiredPermissions): Promise<GetAuthResponse> {
  const headersList = await headers();
  const result = await resolveUserFromAuth(opts, headersList);

  // Admin audit trail: emit exactly one identity-attributed event per authorized
  // admin request. Guarded strictly on adminOnly so the millions of