Function getAuthedUser

api/src/plugins/auth.ts:74–105

(this: FastifyRequest)

    (req.accessDeniedMessage = { type: 'info', content });

  async function getAuthedUser(this: FastifyRequest): Promise<AuthResult> {
    const tokenCookie = this.cookies.jwt_access_token;
    if (!tokenCookie) return { message: TOKEN_REQUIRED };

    const unsignedToken = this.unsignCookie(tokenCookie);
    if (!unsignedToken.valid) return { message: TOKEN_REQUIRED };

    const jwtAccessToken = unsignedToken.value;

    try {
      jwt.verify(jwtAccessToken, JWT_SECRET);
    } catch {
      return { message: TOKEN_INVALID };
    }

    const { accessToken } = jwt.decode(jwtAccessToken) as {
      accessToken: Token;
    };

    if (isExpired(accessToken)) return { message: TOKEN_EXPIRED };
    // We're using token.userId since it's possible for the user record to be
    // malformed and for prisma to throw while trying to find the user.
    fastify.Sentry?.setUser({
      id: accessToken.userId
    });

    const user = await fastify.prisma.user.findUnique({
      where: { id: accessToken.userId }
    });

    return user ? { user } : { message: TOKEN_INVALID };
  }

  fastify.decorateRequest('getAuthedUser', getAuthedUser);