| 90 | * scoped to `orgSelector` — carrying the cookie alone would leave every |
| 91 | * org-scoped read the identity goes on to make failing closed. */ |
| 92 | export const withRefreshedSession = ( |
| 93 | identity: Identity, |
| 94 | response: Response, |
| 95 | orgSelector: string, |
| 96 | ): Identity => { |
| 97 | const refreshed = (response.headers.getSetCookie?.() ?? []) |
| 98 | .find((header) => header.startsWith("wos-session=")) |
| 99 | ?.split(";")[0]; |
| 100 | if (!refreshed) throw new Error("response did not refresh the session cookie"); |
| 101 | return { ...identity, headers: { cookie: refreshed, [ORG_SELECTOR_HEADER]: orgSelector } }; |
| 102 | }; |
| 103 | |
| 104 | /** The org selector this identity's requests carry — the same header the web |
| 105 | * client derives from the console URL's slug. */ |