Function validate_superadmin_api_token

apps/api/src/security/auth.py:542–566

Validate a cross-org superadmin API token (lh_sa_...). Returns a SuperadminAPITokenUser principal on success, None otherwise. The principal's `id` is the token id (not a user id) — code that needs the acting user must use `created_by_user_id`.

(
    token: str,
    db_session: AsyncSession,
)

async def validate_superadmin_api_token(
    token: str,
    db_session: AsyncSession,
) -> Optional[SuperadminAPITokenUser]:
    """Validate a cross-org superadmin API token (lh_sa_...).

    Returns a SuperadminAPITokenUser principal on success, None otherwise.
    The principal's `id` is the token id (not a user id) — code that needs
    the acting user must use `created_by_user_id`.
    """
    from src.services.api_tokens.superadmin_api_tokens import (
        validate_superadmin_token_for_auth,
    )

    api_token = await validate_superadmin_token_for_auth(token, db_session)
    if not api_token:
        return None

    return SuperadminAPITokenUser(
        id=api_token.id,
        user_uuid=api_token.token_uuid,
        username=f"superadmin_api_token_{api_token.name}",
        token_name=api_token.name,
        created_by_user_id=api_token.created_by_user_id,
    )