Function resolveClient

packages/cli/src/actions/proxy.ts:394–428

* Resolves the appropriate client for a request based on the Authorization header. * * - No studioAuthKey configured (authDb is undefined): always return the base client. * - SuperUser claim: return the base client (full access, no policy enforcement). * - Regular user claim: return authDb with

(
    client: ClientContract<SchemaDef>,
    authDb: ClientContract<SchemaDef>,
    req: express.Request,
    isAuthKeyEnabled: boolean,
)

 * - No / invalid token: return the base client.
 */
function resolveClient(
    client: ClientContract<SchemaDef>,
    authDb: ClientContract<SchemaDef>,
    req: express.Request,
    isAuthKeyEnabled: boolean,
): ClientContract<SchemaDef> {
    const authHeader = req.headers['authorization'];

    // If AuthKey is not enabled, and Authorization header is not present, then it is the basic access without auth.
    if (!isAuthKeyEnabled && !authHeader) {
        return client;
    }

    if (!authHeader?.startsWith('Bearer ')) {
        return authDb;
    }

    const token = authHeader.substring(7);
    let claim: UserClaim;
    try {
        claim = UserClaimSchema.parse(JSON.parse(Buffer.from(token, 'base64').toString('utf8')));
    } catch (err) {
        console.error(
            colors.red(`Failed to parse user claim from token: ${err instanceof Error ? err.message : String(err)}`),
        );
        return authDb;
    }

    if (claim.type === 'superUser') {
        // SuperUser has full access without policy enforcement, so we return the base client directly.
        return client;
    } else {
        return authDb.$setAuth(claim.data) as ClientContract<SchemaDef>;
    }
}

function startServer(
    client: ClientContract<SchemaDef>,