Method SwitchWorkspace

backend/api/v1/auth_service.go:1154–1240

SwitchWorkspace switches the current user's active workspace and issues new tokens.

(ctx context.Context, req *connect.Request[v1pb.SwitchWorkspaceRequest])

// SwitchWorkspace switches the current user's active workspace and issues new tokens.
func (s *AuthService) SwitchWorkspace(ctx context.Context, req *connect.Request[v1pb.SwitchWorkspaceRequest]) (*connect.Response[v1pb.LoginResponse], error) {
	request := req.Msg
	if request.Workspace == "" {
		return nil, connect.NewError(connect.CodeInvalidArgument, errors.New("workspace is required"))
	}

	workspaceID, err := common.GetWorkspaceID(request.Workspace)
	if err != nil {
		return nil, connect.NewError(connect.CodeInvalidArgument, errors.Wrap(err, "invalid workspace name"))
	}

	user, ok := GetUserFromContext(ctx)
	if !ok || user == nil {
		return nil, connect.NewError(connect.CodeUnauthenticated, errors.New("user not found"))
	}
	if user.Type != storepb.PrincipalType_END_USER {
		return nil, connect.NewError(connect.CodeInvalidArgument, errors.New("only end users can switch workspaces"))
	}

	// Reject OAuth2 tokens — they are bound to a specific workspace via the OAuth client
	// and must not be used to mint plain user tokens for other workspaces.
	accessTokenStr, _ := auth.GetTokenFromHeaders(req.Header())
	if accessTokenStr != "" {
		tokenClaims, err := auth.ExtractClaimsFromExpiredToken(accessTokenStr, s.secret)
		if err == nil && slices.Contains(tokenClaims.Audience, auth.OAuth2AccessTokenAudience) {
			return nil, connect.NewError(connect.CodePermissionDenied, errors.New("OAuth2 tokens cannot be used to switch workspaces"))
		}
	}

	// Verify the user is a member of the target workspace.
	ws, err := s.store.FindWorkspace(ctx, &store.FindWorkspaceMessage{
		WorkspaceID:    &workspaceID,
		Email:          user.Email,
		IncludeAllUser: !s.profile.SaaS,
	})
	if err != nil {
		return nil, connect.NewError(connect.CodeInternal, errors.Wrap(err, "failed to find workspace"))
	}
	if ws == nil {
		return nil, connect.NewError(connect.CodePermissionDenied, errors.Errorf("not a member of workspace %q", workspaceID))
	}

	// Validate the target workspace's sign-in policies.
	if user.MemberDeleted {
		return nil, connect.NewError(connect.CodeUnauthenticated, errors.New("user has been deactivated"))
	}
	if err := validateEmailWithDomains(ctx, s.licenseService, s.store, workspaceID, user.Email, false); err != nil {
		return nil, err
	}

	// Check MFA requirement for the target workspace.
	mfaSecondStep := request.GetMfaTempToken() != ""
	if mfaSecondStep {
		// Check MFA lockout before verifying.
		if err := s.checkMFALockout(ctx, user.Email); err != nil {
			return nil, err
		}
		// Verify the MFA temp token and OTP/recovery code.