Function getAuthenticatedUser

packages/web/src/middleware/withAuth.ts:134–230

()

type AuthSource = 'session' | 'oauth' | 'api_key';

export const getAuthenticatedUser = async (): Promise<{ user: UserWithAccounts, source: AuthSource } | undefined> => {
    // First, check if we have a valid JWT session.
    const session = await auth();
    if (session) {
        const userId = session.user.id;
        const user = await __unsafePrisma.user.findUnique({
            where: {
                id: userId,
            },
            include: {
                accounts: true,
            }
        });

        return user ? { user, source: 'session' } : undefined;
    }

    // If not, check for a Bearer token in the Authorization header.
    const authorizationHeader = (await headers()).get("Authorization") ?? undefined;
    if (authorizationHeader?.startsWith("Bearer ")) {
        const bearerToken = authorizationHeader.slice(7);

        // OAuth access token
        if (bearerToken.startsWith(OAUTH_ACCESS_TOKEN_PREFIX)) {
            if (!await hasEntitlement('oauth')) {
                return undefined;
            }

            const secret = bearerToken.slice(OAUTH_ACCESS_TOKEN_PREFIX.length);
            const hash = hashSecret(secret);
            const oauthToken = await __unsafePrisma.oAuthToken.findUnique({
                where: { hash },
                include: { user: { include: { accounts: true } } },
            });
            if (oauthToken && oauthToken.expiresAt > new Date()) {
                await __unsafePrisma.oAuthToken.update({
                    where: { hash },
                    data: { lastUsedAt: new Date() },
                });
                return { user: oauthToken.user, source: 'oauth' };
            }
        }

        // API key Bearer token (sourcebot-<hex>)
        const apiKey = await getVerifiedApiObject(bearerToken);
        if (apiKey) {
            const user = await __unsafePrisma.user.findUnique({
                where: { id: apiKey.createdById },
                include: { accounts: true },
            });
            if (user) {
                await __unsafePrisma.apiKey.update({
                    where: { hash: apiKey.hash },
                    data: { lastUsedAt: new Date() },
                });
                return { user, source: 'api_key' };
            }
        }