Function authenticateSealedSession

apps/cloud/src/auth/workos.ts:412–460

(sessionData: string)

    );

  const authenticateSealedSession = (sessionData: string) =>
    Effect.gen(function* () {
      if (!sessionData) return null;

      const session = workos.userManagement.loadSealedSession({
        sessionData,
        cookiePassword,
      });

      const local = yield* withServiceLogging(
        "workos.session.local_verify",
        workosErrorFromFailure,
        verifySealedSessionLocally(sessionData, cookiePassword, sessionJwks),
      );

      if (isLocalSessionValid(local)) {
        return {
          userId: local.session.user.id,
          email: local.session.user.email,
          firstName: local.session.user.firstName,
          lastName: local.session.user.lastName,
          avatarUrl: local.session.user.profilePictureUrl,
          organizationId: local.organizationId,
          sessionId: local.sessionId,
          refreshedSession: undefined as string | undefined,
        };
      }

      if (isLocalSessionInvalidCookie(local)) return null;

      // Try refreshing
      const refreshed = yield* use("session.refresh", () => session.refresh()).pipe(
        Effect.orElseSucceed(() => ({ authenticated: false as const })),
      );

      if (!refreshed.authenticated || !("sealedSession" in refreshed) || !refreshed.sealedSession)
        return null;

      return {
        userId: refreshed.user.id,
        email: refreshed.user.email,
        firstName: refreshed.user.firstName,
        lastName: refreshed.user.lastName,
        avatarUrl: refreshed.user.profilePictureUrl,
        organizationId: refreshed.organizationId,
        sessionId: refreshed.sessionId,
        refreshedSession: refreshed.sealedSession,
      };
    });

  return {
    getAuthorizationUrl: (redirectUri: string, state?: string) =>