Function requireAuth

server/src/middleware/auth.ts:590–1020

(req: Request, res: Response, next: NextFunction)

 * Automatically refreshes expired access tokens using the refresh token
 */
export async function requireAuth(req: Request, res: Response, next: NextFunction) {
  const isHtmlRequest = req.accepts('html') && !req.originalUrl.startsWith('/api/');

  // Check for static admin API key first (for internal tooling)
  if (hasValidAdminApiKey(req)) {
    logger.debug({ path: req.path }, 'Authenticated via static admin API key');
    req.user = {
      id: 'admin_api_key',
      email: 'admin-api-key@internal',
      firstName: 'Admin',
      lastName: 'API Key',
      emailVerified: true,
      createdAt: new Date().toISOString(),
      updatedAt: new Date().toISOString(),
    };
    req.accessToken = 'admin-api-key';
    // Mark this request as using the static admin API key for requireAdmin check
    (req as Request & { isStaticAdminApiKey?: boolean }).isStaticAdminApiKey = true;
    return next();
  }

  // Check for WorkOS API key (for programmatic access)
  const apiKey = await validateWorkOSApiKey(req);
  if (apiKey) {
    logger.debug({ path: req.path, apiKeyId: apiKey.id }, 'Authenticated via WorkOS API key');
    // Create a synthetic user for API key auth - the organization owns the key
    req.user = {
      id: `api_key_${apiKey.id}`,
      email: `api-key@org-${apiKey.organizationId}`,
      firstName: 'API',
      lastName: apiKey.name,
      emailVerified: true,
      createdAt: new Date().toISOString(),
      updatedAt: new Date().toISOString(),
    };
    req.accessToken = 'workos-api-key';
    // Store API key info for permission checks
    (req as Request & { apiKey?: ValidatedApiKey }).apiKey = apiKey;
    // API keys are org-scoped, so the caller is a member by definition
    (req.user as unknown as Record<string, unknown>).isMember = true;

    // Check platform ban for API key
    const apiKeyBan = await checkPlatformBan(
      `apikey:${apiKey.id}`,
      () => bansDb.checkPlatformBanForApiKey(apiKey.id, apiKey.organizationId)
    );
    if (apiKeyBan) {
      logger.info({ apiKeyId: apiKey.id, banId: apiKeyBan.id }, 'API key request blocked by platform ban');
      return sendBanResponse(res, apiKeyBan);
    }

    return next();
  }

  // Check for OAuth-issued user JWT (user SSO'd via AuthKit through the
  // MCP OAuth flow and is now calling the REST API with that token).
  const jwtAuth = await validateWorkOSBearerJWT(req);
  if (jwtAuth) {