Function oauthAccountIdentity

apps/cli/src/main.ts:2405–2412

(connection: ExecutorServerConnection)

// recognize a re-login to the SAME account (update in place) versus a
// different account on the same host (needs its own profile).
const oauthAccountIdentity = (connection: ExecutorServerConnection): string | null => {
  const auth = connection.auth;
  if (!auth || auth.kind !== "oauth") return null;
  const claims = decodeAccessTokenClaims(auth.accessToken);
  const sub = typeof claims?.sub === "string" ? claims.sub : undefined;
  const org = typeof claims?.org_id === "string" ? claims.org_id : undefined;
  return sub && org ? `${connection.origin}|${sub}|${org}` : null;
};

// Name a login's profile by the ACCOUNT it authenticates (email, falling back
// to user id), not the hostname, so two accounts on the same server get