Function checkSessionOrInternalAuth

apps/sim/lib/auth/hybrid.ts:118–166

(
  request: NextRequest,
  options: { requireWorkflowId?: boolean } = {}
)

 * @param options.requireWorkflowId - Whether workflowId/userId is required for JWT (default: true)
 */
export async function checkSessionOrInternalAuth(
  request: NextRequest,
  options: { requireWorkflowId?: boolean } = {}
): Promise<AuthResult> {
  try {
    // 1. Reject API keys first
    const apiKeyHeader = request.headers.get('x-api-key')
    if (apiKeyHeader) {
      return {
        success: false,
        error: 'API key access not allowed for this endpoint',
      }
    }

    // 2. Check for internal JWT token
    const authHeader = request.headers.get('authorization')
    if (authHeader?.startsWith('Bearer ')) {
      const token = authHeader.split(' ')[1]
      const verification = await verifyInternalToken(token)

      if (verification.valid) {
        return resolveUserFromJwt(verification.userId || null, options)
      }
    }

    // 3. Try session auth (for web UI)
    const session = await getSession()
    if (session?.user?.id) {
      return {
        success: true,
        userId: session.user.id,
        userName: session.user.name,
        userEmail: session.user.email,
        authType: AuthType.SESSION,
      }
    }

    return {
      success: false,
      error: 'Unauthorized',
    }
  } catch (error) {
    logger.error('Error in session/internal authentication:', error)
    return {
      success: false,
      error: 'Authentication error',
    }
  }
}

/**
 * Check for authentication using any of the 3 supported methods: