Method IssueRepresentativeAuthToken

admin/server/users.go:403–439

IssueRepresentativeAuthToken returns the temporary auth token for representing email

(ctx context.Context, req *adminv1.IssueRepresentativeAuthTokenRequest)

// IssueRepresentativeAuthToken returns the temporary auth token for representing email
func (s *Server) IssueRepresentativeAuthToken(ctx context.Context, req *adminv1.IssueRepresentativeAuthTokenRequest) (*adminv1.IssueRepresentativeAuthTokenResponse, error) {
	observability.AddRequestAttributes(ctx,
		attribute.Int64("args.ttl_minutes", req.TtlMinutes),
	)

	claims := auth.GetClaims(ctx)

	if !claims.Superuser(ctx) {
		return nil, status.Error(codes.PermissionDenied, "only superusers can search users by email")
	}

	// Error if authenticated as anything other than a user
	if claims.OwnerType() != auth.OwnerTypeUser {
		return nil, status.Error(codes.Unauthenticated, "not authenticated as a user")
	}

	u, err := s.admin.DB.FindUserByEmail(ctx, req.Email)
	if err != nil {
		return nil, err
	}

	observability.AddRequestAttributes(ctx,
		attribute.String("args.user_id", u.ID),
	)

	ttl := time.Duration(req.TtlMinutes) * time.Minute
	displayName := fmt.Sprintf("Support for %s", u.Email)

	token, err := s.admin.IssueUserAuthToken(ctx, claims.OwnerID(), database.AuthClientIDRillSupport, displayName, &u.ID, &ttl, false)
	if err != nil {
		return nil, err
	}

	return &adminv1.IssueRepresentativeAuthTokenResponse{
		Token: token.Token().String(),
	}, nil
}

// RevokeCurrentAuthToken revokes the current auth token
func (s *Server) RevokeCurrentAuthToken(ctx context.Context, req *adminv1.RevokeCurrentAuthTokenRequest) (*adminv1.RevokeCurrentAuthTokenResponse, error) {