* Extract sealed session from request * Supports both cookie-based auth (web) and Authorization header (native apps) * Native apps send: Authorization: Bearer
(req: Request)
| 1460 | * Native apps send: Authorization: Bearer <sealed-session> |
| 1461 | */ |
| 1462 | function extractSealedSession(req: Request): string | undefined { |
| 1463 | // First check for cookie (web browsers) |
| 1464 | const sessionCookie = req.cookies['wos-session']; |
| 1465 | if (sessionCookie) { |
| 1466 | return sessionCookie; |
| 1467 | } |
| 1468 | |
| 1469 | // Then check Authorization header (native apps like Tauri) |
| 1470 | // Format: Authorization: Bearer <sealed-session> |
| 1471 | // Note: We differentiate from WorkOS API keys by checking prefix |
| 1472 | const authHeader = req.headers.authorization; |
| 1473 | if (authHeader?.startsWith('Bearer ')) { |
| 1474 | const token = authHeader.slice(7); |
| 1475 | // WorkOS API keys use known prefixes, sealed sessions don't |
| 1476 | if (!isWorkOSApiKeyFormat(token)) { |
| 1477 | return token; |
| 1478 | } |
| 1479 | } |
| 1480 | |
| 1481 | return undefined; |
| 1482 | } |
| 1483 | |
| 1484 | /** |
| 1485 | * Optional auth middleware - loads user if authenticated, but doesn't require it |
no test coverage detected