Function verifyJwtWithRefreshRetry

apps/cloud/src/auth/workos.ts:186–208

(
  accessToken: string,
  jwks: CachedRemoteJWKSet,
)

  });

const verifyJwtWithRefreshRetry = (
  accessToken: string,
  jwks: CachedRemoteJWKSet,
): Effect.Effect<boolean, ServiceAdapterError> =>
  verifyJwtOnce(accessToken, jwks).pipe(
    Effect.as(true),
    Effect.catchTag("ServiceAdapterError", (error) => {
      if (isErrorWithCode(error.cause) && error.cause.code === JWKSNoMatchingKey.code) {
        return Effect.sync(() => jwks.forceRefresh()).pipe(
          Effect.flatMap(() => verifyJwtOnce(accessToken, jwks)),
          Effect.as(true),
          Effect.catchTag("ServiceAdapterError", (retryError) =>
            isJwtVerificationFailure(retryError.cause)
              ? Effect.succeed(false)
              : Effect.fail(retryError),
          ),
        );
      }
      if (isJwtVerificationFailure(error.cause)) return Effect.succeed(false);
      if (isJwksSystemFailure(error.cause)) return Effect.fail(error);
      return Effect.fail(error);
    }),
  );

const verifySealedSessionLocally = (
  sessionData: string,