Function runHttpAuthHook

src/daemon/server/http-server.ts:426–487

(
  authHook: HttpAuthHook | null,
  context: HttpAuthHookContext,
)

}

async function runHttpAuthHook(
  authHook: HttpAuthHook | null,
  context: HttpAuthHookContext,
): Promise<HttpAuthDecision> {
  if (!authHook) return { ok: true };
  const result = await authHook(context);
  if (result === undefined || result === true) return { ok: true };
  if (result === false) {
    const normalized = normalizeError(
      new AppError('UNAUTHORIZED', 'Request rejected by auth hook'),
    );
    return {
      ok: false,
      statusCode: 401,
      response: createRpcError(
        context.rpcRequest.id ?? null,
        -32001,
        normalized.message,
        normalized,
      ),
    };
  }
  if (result.ok === false) {
    const normalized = normalizeError(
      new AppError(
        toAppErrorCode(result.code, 'UNAUTHORIZED'),
        result.message ?? 'Request rejected by auth hook',
        result.details,
      ),
    );
    return {
      ok: false,
      statusCode: 401,
      response: createRpcError(
        context.rpcRequest.id ?? null,
        -32001,
        normalized.message,
        normalized,
      ),
    };
  }
  if (typeof result.tenantId === 'string' && result.tenantId.length > 0) {
    const tenantId = normalizeTenantId(result.tenantId);
    if (!tenantId) {
      const normalized = normalizeError(
        new AppError('INVALID_ARGS', 'Auth hook returned invalid tenantId'),
      );
      return {
        ok: false,
        statusCode: 500,
        response: createRpcError(
          context.rpcRequest.id ?? null,
          -32000,
          normalized.message,
          normalized,
        ),
      };
    }