Function optionalAuth

server/src/middleware/auth.ts:1490–1679

(req: Request, res: Response, next: NextFunction)

 * Supports both cookie-based auth (web) and Authorization header (native apps)
 */
export async function optionalAuth(req: Request, res: Response, next: NextFunction) {
  // Dev mode: set dev user if logged in via dev-session cookie
  if (DEV_MODE_ENABLED) {
    const devUser = createDevUser(req);
    if (devUser) {
      req.user = devUser;
      req.accessToken = 'dev-mode-token';
      // Carry over dev config flags (isMember, isAdmin) so enrichUserWithMembership skips DB lookup
      const devConfig = getDevUser(req);
      if (devConfig) {
        (req.user as unknown as Record<string, unknown>).isMember = devConfig.isMember;
      }
    }
    // No dev session = not logged in (which is fine for optional auth)
    return next();
  }

  const sessionCookie = extractSealedSession(req);

  if (!sessionCookie) {
    return next();
  }

  try {
    // Check session cache first to avoid repeated WorkOS API calls
    const cacheKey = hashSessionCookie(sessionCookie);
    const cached = sessionCache.get(cacheKey);
    const now = Date.now();

    // Fast-reject sessions already known to be dead
    const deadAt = deadSessionCache.get(cacheKey);
    if (deadAt) {
      if (now - deadAt < DEAD_SESSION_TTL_MS) {
        return next(); // optional auth: just proceed without user
      }
      deadSessionCache.delete(cacheKey);
    }

    if (cached && cached.expiresAt > now) {
      // Cache hit - use cached session data
      logger.debug({ userId: cached.user.id }, 'Using cached session (optional auth)');
      req.user = cached.user;
      req.accessToken = cached.accessToken;

      // If session was refreshed, update the cookie
      if (cached.newSealedSession) {
        setSessionCookie(res, cached.newSealedSession);
      }

      return next();
    }

    // Cache miss or expired - validate with WorkOS
    // Load the sealed session to get access to both authenticate and refresh methods
    const session = workos.userManagement.loadSealedSession({
      sessionData: sessionCookie,
      cookiePassword: WORKOS_COOKIE_PASSWORD,
    });