Function verifySealedSessionLocally

apps/cloud/src/auth/workos.ts:210–242

(
  sessionData: string,
  cookiePassword: string,
  jwks: CachedRemoteJWKSet,
)

  );

const verifySealedSessionLocally = (
  sessionData: string,
  cookiePassword: string,
  jwks: CachedRemoteJWKSet,
): Effect.Effect<LocalSessionVerification, ServiceAdapterError> =>
  Effect.gen(function* () {
    const unsealed = yield* Effect.tryPromise({
      try: () => unsealWorkOSSession(sessionData, cookiePassword),
      catch: (cause) => new LocalSessionCookieError({ cause }),
    }).pipe(
      Effect.catchTag("LocalSessionCookieError", () => Effect.succeed(null as unknown | null)),
    );
    if (!unsealed) return { _tag: "InvalidCookie" };

    const session = Option.match(decodeSealedSessionPayload(unsealed), {
      onNone: (): SealedSessionPayload | null => null,
      onSome: (payload) => payload,
    });
    if (!session) return { _tag: "InvalidCookie" };

    const verified = yield* verifyJwtWithRefreshRetry(session.accessToken, jwks);
    if (!verified) return { _tag: "Refresh" };

    const claims = Option.getOrNull(decodeJwtClaims(decodeJwt(session.accessToken)));
    if (!claims) return { _tag: "Refresh" };

    return {
      _tag: "Valid",
      session,
      organizationId: claims.org_id,
      sessionId: claims.sid,
    };
  });

const completedListMetadata = {
  before: null,