Function resolveUserFromJwt

apps/sim/lib/auth/hybrid.ts:46–59

* Resolves userId from a verified internal JWT token. * Only trusts the userId embedded in the JWT payload — never from user-controlled sources.

(
  verificationUserId: string | null,
  options: { requireWorkflowId?: boolean }
)

 * Only trusts the userId embedded in the JWT payload — never from user-controlled sources.
 */
function resolveUserFromJwt(
  verificationUserId: string | null,
  options: { requireWorkflowId?: boolean }
): AuthResult {
  if (verificationUserId) {
    return { success: true, userId: verificationUserId, authType: AuthType.INTERNAL_JWT }
  }

  if (options.requireWorkflowId !== false) {
    return { success: false, error: 'userId required but not present in JWT' }
  }

  return { success: true, authType: AuthType.INTERNAL_JWT }
}

/**
 * Check for internal JWT authentication only.