| 155 | ); |
| 156 | |
| 157 | const authenticateSealedSession = (sessionData: string) => |
| 158 | Effect.gen(function* () { |
| 159 | if (!sessionData) return null; |
| 160 | |
| 161 | const session = workos.userManagement.loadSealedSession({ |
| 162 | sessionData, |
| 163 | cookiePassword, |
| 164 | }); |
| 165 | |
| 166 | const result = yield* use(() => session.authenticate()); |
| 167 | |
| 168 | if (result.authenticated) { |
| 169 | return { |
| 170 | userId: result.user.id, |
| 171 | email: result.user.email, |
| 172 | firstName: result.user.firstName, |
| 173 | lastName: result.user.lastName, |
| 174 | avatarUrl: result.user.profilePictureUrl, |
| 175 | organizationId: result.organizationId, |
| 176 | sessionId: result.sessionId, |
| 177 | refreshedSession: undefined as string | undefined, |
| 178 | }; |
| 179 | } |
| 180 | |
| 181 | if (result.reason === "no_session_cookie_provided") return null; |
| 182 | |
| 183 | // Try refreshing |
| 184 | const refreshed = yield* use(() => session.refresh()).pipe( |
| 185 | Effect.orElseSucceed(() => ({ authenticated: false as const })), |
| 186 | ); |
| 187 | |
| 188 | if (!refreshed.authenticated || !("sealedSession" in refreshed) || !refreshed.sealedSession) |
| 189 | return null; |
| 190 | |
| 191 | return { |
| 192 | userId: refreshed.user.id, |
| 193 | email: refreshed.user.email, |
| 194 | firstName: refreshed.user.firstName, |
| 195 | lastName: refreshed.user.lastName, |
| 196 | avatarUrl: refreshed.user.profilePictureUrl, |
| 197 | organizationId: refreshed.organizationId, |
| 198 | sessionId: refreshed.sessionId, |
| 199 | refreshedSession: refreshed.sealedSession, |
| 200 | }; |
| 201 | }); |
| 202 | |
| 203 | return { |
| 204 | getAuthorizationUrl: (redirectUri: string, state?: string) => |