Function unsealWorkOSSession

apps/cloud/src/auth/workos.ts:150–166

(
  sessionData: string,
  cookiePassword: string,
)

};

const unsealWorkOSSession = async (
  sessionData: string,
  cookiePassword: string,
): Promise<unknown> => {
  const { sealWithoutVersion, tokenVersion } = parseWorkOSSeal(sessionData);
  const data =
    (await unsealIron(sealWithoutVersion, { 1: cookiePassword }, { ...ironDefaults, ttl: 0 })) ??
    {};
  // Mirrors the SDK's unsealData version handling: current (v2) seals hold the
  // payload directly, OTHER versioned seals nest it under `persistent`, and an
  // unversioned seal is the payload itself.
  if (tokenVersion === 2 || tokenVersion === null) return data;
  return Option.match(decodeLegacySealedSessionPayload(data), {
    onNone: () => data,
    onSome: (legacy) => legacy.persistent,
  });
};

const getWorkOSSessionJwks = (() => {
  const resolvers = new Map<string, CachedRemoteJWKSet>();