Method authenticate

backend/api/auth/auth.go:167–230

authenticate is the shared authentication logic that validates JWT tokens. Returns the user and claims, or an error. This is the single source of truth for token validation.

(ctx context.Context, accessTokenStr string)

// authenticate is the shared authentication logic that validates JWT tokens.
// Returns the user and claims, or an error. This is the single source of truth for token validation.
func (in *APIAuthInterceptor) authenticate(ctx context.Context, accessTokenStr string) (*store.UserMessage, *claimsMessage, error) {
	if accessTokenStr == "" {
		return nil, nil, errs.New("access token not found")
	}

	claims := &claimsMessage{}
	if _, err := jwt.ParseWithClaims(accessTokenStr, claims, func(t *jwt.Token) (any, error) {
		if t.Method.Alg() != jwt.SigningMethodHS256.Name {
			return nil, errs.Errorf("unexpected access token signing method=%v, expect %v", t.Header["alg"], jwt.SigningMethodHS256)
		}
		if kid, ok := t.Header["kid"].(string); ok {
			if kid == "v1" {
				return []byte(in.secret), nil
			}
		}
		return nil, errs.Errorf("unexpected access token kid=%v", t.Header["kid"])
	}); err != nil {
		if errors.Is(err, jwt.ErrTokenExpired) {
			return nil, nil, errs.New("access token expired")
		}
		return nil, nil, errs.New("failed to parse claim")
	}

	// Accept both user access tokens (bb.user.access) and OAuth2 access tokens (bb.oauth2.access)
	if !audienceContains(claims.Audience, AccessTokenAudience) && !audienceContains(claims.Audience, OAuth2AccessTokenAudience) {
		return nil, nil, errs.Errorf(
			"invalid access token, audience mismatch, got %q, expected %q or %q",
			claims.Audience,
			AccessTokenAudience,
			OAuth2AccessTokenAudience,
		)
	}

	account, err := in.store.GetAccountByEmail(ctx, claims.Subject)
	if err != nil {
		return nil, nil, errs.Errorf("failed to find principal %q in the access token", claims.Subject)
	}
	if account == nil {
		return nil, nil, errs.Errorf("principal %q not exists in the access token", claims.Subject)
	}
	if account.MemberDeleted {
		return nil, nil, errs.Errorf("principal %q has been deactivated by administrators", account.Email)
	}

	// Verify workspace membership.
	// We always require workspace_id in the claims even for non-SaaS (single workspace) mode
	if claims.WorkspaceID == "" {
		return nil, nil, errs.New("empty workspace in the token")
	}
	if err := in.verifyWorkspaceMembership(ctx, claims.WorkspaceID, account); err != nil {
		return nil, nil, err
	}

	// Convert to UserMessage for context storage.
	user, err := in.store.ResolvePrincipalAsUser(ctx, account)
	if err != nil {
		return nil, nil, err
	}