Function verifyAuthCookie

apps/api/src/api/auth/auth.plugin.ts:97–140

(
  jwt: { verify: (token: string) => Promise<unknown> },
  cookieValue: unknown
)

 * the two guards interpret differently.
 */
const verifyAuthCookie = async (
  jwt: { verify: (token: string) => Promise<unknown> },
  cookieValue: unknown
): Promise<{ user: IUser; accountId: string } | null> => {
  if (cookieValue === undefined) {
    return null;
  }

  if (typeof cookieValue !== "string") {
    throw ApiErrors.unauthorized("Invalid authentication cookie");
  }

  try {
    const verified = await jwt.verify(cookieValue);
    const parsed = parseAuthJWTPayload(verified);

    if (parsed.kind !== "ok") {
      throw ApiErrors.unauthorized("Invalid token payload");
    }

    await assertNotRevoked(parsed);

    const user = await db.query.users.findFirst({
      where: eq(users.id, parsed.userId),
    });

    if (!user) {
      throw ApiErrors.unauthorized("User not found");
    }

    /*
     * Tag the active Sentry scope with the user so any error captured
     * for the rest of this request carries `user.id` + `user.email`.
     * The Pino mixin also reads this scope to inject `userId` on every
     * log record, so a Grafana log line and a GlitchTip error event can
     * be correlated by the same id. No-op when SENTRY_DSN is unset.
     */
    Sentry.setUser({ id: user.id, email: user.email });

    return { user, accountId: parsed.accountId };
  } catch (err: unknown) {
    return translateJwtError(err);
  }
};

/**
 * Required-auth guard. Use on every endpoint where an anonymous caller