Function validateWorkOSBearerJWT

server/src/middleware/auth.ts:302–368

(req: Request)

 * `enrichUserWithMembership` resolves real membership via the DB.
 */
export async function validateWorkOSBearerJWT(req: Request): Promise<ValidatedBearerJWT | null> {
  const authHeader = req.headers.authorization;
  if (!authHeader?.startsWith('Bearer ')) return null;
  const token = authHeader.slice(7);

  if (isWorkOSApiKeyFormat(token)) return null; // handled by validateWorkOSApiKey
  if (ADMIN_API_KEY && token === ADMIN_API_KEY) return null; // handled by hasValidAdminApiKey
  if (!looksLikeJWT(token)) return null;

  const cacheKey = hashBearerToken(token);
  const now = Date.now();
  const cached = bearerJwtCache.get(cacheKey);
  if (cached && cached.expiresAt > now) {
    return { user: cached.user, rawToken: token, orgId: cached.orgId };
  }

  let verified: Awaited<ReturnType<typeof verifyWorkOSJWT>>;
  try {
    verified = await verifyWorkOSJWT(token);
  } catch (err) {
    logger.debug({ err }, 'Bearer JWT verification failed');
    return null;
  }

  if (verified.isM2M || !verified.sub) return null;

  // Confirm the subject corresponds to a real local user. This catches
  // tokens from WorkOS accounts that have been deleted or never synced,
  // and gives us names for the synthesized WorkOSUser.
  const pool = getPool();
  const localUser = await pool.query<{
    first_name: string | null;
    last_name: string | null;
    email: string | null;
  }>(
    `SELECT first_name, last_name, email FROM users WHERE workos_user_id = $1`,
    [verified.sub],
  );
  if (localUser.rowCount === 0) {
    logger.warn({ sub: verified.sub }, 'Bearer JWT verified but user not found in local DB');
    return null;
  }

  const row = localUser.rows[0];
  const email = verified.email ?? row.email ?? '';
  const user: WorkOSUser = {
    id: verified.sub,
    email,
    firstName: row.first_name?.trim() || undefined,
    lastName: row.last_name?.trim() || undefined,
    emailVerified: true,
    createdAt: new Date().toISOString(),
    updatedAt: new Date().toISOString(),
  };

  const tokenExpMs = verified.expiresAt ? verified.expiresAt * 1000 : Infinity;
  const cacheUntil = Math.min(now + BEARER_JWT_CACHE_TTL_MS, tokenExpMs);
  if (cacheUntil > now) {