Method getAndVerifyUser

backend/api/v1/auth_service.go:521–552

(ctx context.Context, request *v1pb.LoginRequest)

}

func (s *AuthService) getAndVerifyUser(ctx context.Context, request *v1pb.LoginRequest) (*store.UserMessage, error) {
	// Check if user is locked out due to too many failed password attempts.
	if err := s.checkPasswordLockout(ctx, request.Email); err != nil {
		return nil, err
	}

	// GetAccountByEmail is cross-workspace, which is correct for login.
	// Email is globally unique (PK). The token gets workspace from account.Workspace (SA/WI)
	// or from the default workspace (END_USER).
	account, err := s.store.GetAccountByEmail(ctx, request.Email)
	if err != nil {
		return nil, connect.NewError(connect.CodeInternal, errors.Wrapf(err, "failed to get user by email %q", request.Email))
	}
	if account == nil {
		return nil, invalidCredentialsError
	}
	// Compare the stored hashed password, with the hashed version of the password that was received.
	if err := bcrypt.CompareHashAndPassword([]byte(account.PasswordHash), []byte(request.Password)); err != nil {
		// If the two passwords don't match, return a 401 status.
		return nil, invalidCredentialsError
	}

	// Convert AccountMessage to UserMessage for downstream use.
	user, err := s.store.ResolvePrincipalAsUser(ctx, account)
	if err != nil {
		return nil, connect.NewError(connect.CodeInternal, errors.Wrapf(err, "failed to resolve principal %q", account.Email))
	}
	if user == nil {
		return nil, connect.NewError(connect.CodeUnauthenticated, errors.Errorf("user %q not found", account.Email))
	}
	return user, nil
}

// getOrCreateUserWithIDP authenticates a user via an identity provider (SSO).
// Login API has allow_without_credential, so there's no workspace in the token context.