Method ListUserAuthTokens

admin/server/users.go:177–254

(ctx context.Context, req *adminv1.ListUserAuthTokensRequest)

}

func (s *Server) ListUserAuthTokens(ctx context.Context, req *adminv1.ListUserAuthTokensRequest) (*adminv1.ListUserAuthTokensResponse, error) {
	observability.AddRequestAttributes(ctx,
		attribute.String("args.user_id", req.UserId),
	)

	claims := auth.GetClaims(ctx)
	forceAccess := claims.Superuser(ctx) && req.SuperuserForceAccess

	userID := req.UserId
	if userID == "current" { // Special alias for the current user
		if claims.OwnerType() != auth.OwnerTypeUser {
			return nil, status.Error(codes.Unauthenticated, "not authenticated as a user")
		}
		userID = claims.OwnerID()
	}
	if userID != claims.OwnerID() && !forceAccess {
		return nil, status.Error(codes.PermissionDenied, "not authorized to list auth tokens for other users")
	}

	pageSize := validPageSize(req.PageSize)
	pageToken, err := unmarshalPageToken(req.PageToken)
	if err != nil {
		return nil, err
	}

	authTokens, err := s.admin.DB.FindUserAuthTokens(ctx, userID, pageToken.Val, pageSize, req.Refresh)
	if err != nil {
		return nil, err
	}

	nextToken := ""
	if len(authTokens) >= pageSize {
		nextToken = marshalPageToken(authTokens[len(authTokens)-1].ID)
	}

	dtos := make([]*adminv1.UserAuthToken, len(authTokens))
	for i, t := range authTokens {
		var authClientID, authClientDisplayName, representingUserID string
		var expiresOn *timestamppb.Timestamp
		if t.AuthClientID != nil {
			authClientID = *t.AuthClientID
		}
		if t.AuthClientDisplayName != nil {
			authClientDisplayName = *t.AuthClientDisplayName
		}
		if t.RepresentingUserID != nil {
			representingUserID = *t.RepresentingUserID
		}
		if t.ExpiresOn != nil {
			expiresOn = timestamppb.New(*t.ExpiresOn)
		}

		id, err := uuid.Parse(t.ID)
		if err != nil {
			return nil, status.Errorf(codes.Internal, "invalid token ID %q: %v", t.ID, err)
		}

		prefix := authtoken.FromID(authtoken.TypeUser, id).Prefix()