Function jwt

packages/web/src/auth.ts:349–418

({ token, user: _user })

            return baseUrl;
        },
        async jwt({ token, user: _user }) {
            const user = _user as User | undefined;
            // @note: `user` will be available on signUp or signIn triggers.
            // Cache the userId in the JWT for later use.
            if (user) {
                token.userId = user.id;
                token.sessionVersion = user.sessionVersion ?? 0;
            }

            if (token.userId) {
                // Single query: fetch the user's current sessionVersion for
                // the cross-check below, plus any accounts that still need
                // the issuerUrl lazy migration.
                //
                // @see https://github.com/sourcebot-dev/sourcebot/pull/993
                const dbUser = await __unsafePrisma.user.findUnique({
                    where: {
                        id: token.userId as string,
                    },
                    select: {
                        sessionVersion: true,
                        accounts: {
                            where: {
                                issuerUrl: null,
                            },
                        },
                    },
                });

                // The user row was removed (e.g., deleted via /api/ee/user
                // or org-removal cascade). Treat the JWT as invalid so
                // /api/auth/session reports logged-out and @auth/core clears
                // the cookie from the browser.
                if (!dbUser) {
                    return null;
                }

                // On every non-login request, cross-check the JWT's
                // sessionVersion against the user's current sessionVersion in
                // the database. A mismatch means the user signed out, was
                // removed from the org, or their sessions were otherwise
                // invalidated since the JWT was minted. Returning null here
                // is what makes invalidation visible at /api/auth/session,
                // not just at withAuth-gated endpoints.
                const tokenSessionVersion = token.sessionVersion ?? 0;
                if (!user && tokenSessionVersion !== dbUser.sessionVersion) {
                    return null;
                }

                // Lazy migration of issuerUrl on accounts created before
                // the column was introduced in v4.15.4. The where clause
                // above scopes this to only accounts that still need it,
                // so the loop is a no-op once everyone is backfilled.
                for (const account of dbUser.accounts) {
                    const issuerUrl = await getIssuerUrlForProviderId(account.providerId);
                    if (issuerUrl) {
                        await __unsafePrisma.account.update({
                            where: {