Function getOrganizationUUID

src/services/oauth/client.ts:591–621

()

 * @returns The organization UUID or null if not authenticated
 */
export async function getOrganizationUUID(): Promise<string | null> {
  const globalConfig = getGlobalConfig()
  const cachedOrgUUID = globalConfig.oauthAccount?.organizationUuid
  const session = getCurrentOAuthClientSession()
  const accessToken =
    session?.headersKind === 'bearer' ? session.accessToken : null
  const hasInjectedOAuthToken = Boolean(
    process.env.CLAUDE_CODE_OAUTH_TOKEN ||
      getOAuthTokenFileDescriptorEnvVarName(),
  )

  // Env-injected OAuth tokens can override or outlive cached local account
  // state. Revalidate them against the profile endpoint when possible so
  // remote-session flows don't blindly reuse a stale organization UUID.
  if (accessToken && (hasInjectedOAuthToken || !cachedOrgUUID)) {
    const profileOrgUUID = await getOrganizationUUIDFromProfile(accessToken)
    if (profileOrgUUID) {
      return profileOrgUUID
    }
  }

  if (cachedOrgUUID) {
    return cachedOrgUUID
  }

  // Fall back to fetching from profile (requires user:profile scope)
  if (!accessToken || !hasOauthProfileAccess(session)) {
    return null
  }
  return getOrganizationUUIDFromProfile(accessToken)
}

/**
 * Populate the OAuth account info if it has not already been cached in config.