Function getUserFromRequest

server/src/http.ts:467–532

* Get user info from request for HTML config injection. * Checks dev mode first, then WorkOS session. * If session is refreshed, updates the cookie in the response.

(
  req: express.Request,
  res?: express.Response
)

 * If session is refreshed, updates the cookie in the response.
 */
async function getUserFromRequest(
  req: express.Request,
  res?: express.Response
): Promise<{ id?: string; email: string; firstName?: string | null; lastName?: string | null } | null> {
  // Check dev mode first
  if (isDevModeEnabled()) {
    const devUser = getDevUser(req);
    if (devUser) {
      return devUser;
    }
  }

  // Then check WorkOS session
  const sessionCookie = req.cookies?.['wos-session'];
  // codeql[js/user-controlled-bypass] - session cookie is verified cryptographically by WorkOS sealed session
  if (sessionCookie && AUTH_ENABLED && workos) {
    try {
      const session = workos.userManagement.loadSealedSession({
        sessionData: sessionCookie,
        cookiePassword: WORKOS_COOKIE_PASSWORD,
      });

      // Try to authenticate with the current session
      let authResult = await session.authenticate();

      // If authentication failed (e.g., expired token), try to refresh
      if (!authResult.authenticated || !authResult.user) {
        try {
          const refreshResult = await session.refresh({
            cookiePassword: WORKOS_COOKIE_PASSWORD,
          });

          if (refreshResult.authenticated && refreshResult.sealedSession) {
            // Update the cookie with the refreshed session
            if (res) {
              res.cookie('wos-session', refreshResult.sealedSession, {
                httpOnly: true,
                secure: process.env.NODE_ENV === 'production',
                sameSite: 'lax',
                path: '/',
                maxAge: 7 * 24 * 60 * 60 * 1000, // 7 days
              });
            }

            // Re-authenticate with the new session
            const newSession = workos.userManagement.loadSealedSession({
              sessionData: refreshResult.sealedSession,
              cookiePassword: WORKOS_COOKIE_PASSWORD,
            });
            authResult = await newSession.authenticate();
          }
        } catch {
          // Refresh failed - continue without user
        }
      }

      if (authResult.authenticated && authResult.user) {
        return authResult.user;