Function GetUserEmailFromMFATempToken

backend/api/auth/auth.go:297–317

GetUserEmailFromMFATempToken returns the user email from the MFA temp token.

(token string, secret string)

// GetUserEmailFromMFATempToken returns the user email from the MFA temp token.
func GetUserEmailFromMFATempToken(token string, secret string) (string, error) {
	claims := &claimsMessage{}
	_, err := jwt.ParseWithClaims(token, claims, func(t *jwt.Token) (any, error) {
		if t.Method.Alg() != jwt.SigningMethodHS256.Name {
			return nil, connect.NewError(connect.CodeUnauthenticated, errs.Errorf("unexpected MFA temp token signing method=%v, expect %v", t.Header["alg"], jwt.SigningMethodHS256))
		}
		if kid, ok := t.Header["kid"].(string); ok {
			if kid == "v1" {
				return []byte(secret), nil
			}
		}
		return nil, connect.NewError(connect.CodeUnauthenticated, errs.Errorf("unexpected MFA temp token kid=%v", t.Header["kid"]))
	})
	if err != nil {
		return "", connect.NewError(connect.CodeUnauthenticated, errs.New("failed to parse claim"))
	}
	if !audienceContains(claims.Audience, MFATempTokenAudience) {
		return "", connect.NewError(connect.CodeUnauthenticated, errs.New("invalid MFA temp token, audience mismatch"))
	}
	return claims.Subject, nil
}

// AuthenticateToken validates a JWT access token and returns the user and token expiry.
// This is a non-ConnectRPC version that returns regular errors instead of ConnectRPC errors.