Function resolveBearerAuth

apps/cloud/src/auth/workos-auth-provider.ts:205–277

(
  request: Request,
  jwt: JwtBearerConfig | null = null,
)

 * resolved (mirrored on first read) for its name and slug.
 */
export const resolveBearerAuth = (
  request: Request,
  jwt: JwtBearerConfig | null = null,
): Effect.Effect<
  BearerAuth,
  | Unauthorized
  | NoOrganization
  | Unavailable
  | UserStoreError
  | WorkOSError
  | WorkOsMirrorError
  | MemberDirectoryError,
  WorkOSClient | ApiKeyService | UserStoreService | MemberDirectory | WorkOsMirror
> =>
  Effect.gen(function* () {
    const authHeader = request.headers.get("authorization");
    if (!authHeader) return null;

    if (!authHeader.startsWith(BEARER_PREFIX)) {
      return yield* new Unauthorized(INVALID_AUTHORIZATION_HEADER);
    }

    const value = authHeader.slice(BEARER_PREFIX.length).trim();
    if (!value) return yield* new Unauthorized(INVALID_API_KEY);

    if (jwt && looksLikeJwt(value)) return yield* resolveJwtPrincipal(value, jwt);

    const apiKeys = yield* ApiKeyService;
    const owner = yield* apiKeys
      .validate(value)
      .pipe(
        Effect.catchTag("ApiKeyValidationError", () =>
          Effect.fail(new Unavailable(API_KEY_VALIDATION_UNAVAILABLE)),
        ),
      );

    if (!owner) return yield* new Unauthorized(INVALID_API_KEY);

    if (owner.scope === "org") {
      const org = yield* resolveOrganization(owner.organizationId);
      // The key outlives the org until the purge removes it; an org marked
      // deleted refuses it as it refuses every member's session.
      if (org.deletedAt !== null) return yield* new NoOrganization(NO_ORGANIZATION_IN_API_KEY);
      return {
        kind: "platform",
        organizationId: org.id,
        organizationName: org.name,
        ...(org.slug === undefined || org.slug === null ? {} : { organizationSlug: org.slug }),
        keyId: owner.keyId,
      } satisfies PlatformAuth;
    }

    // A `"user"` key always carries an accountId (see `ownerFromApiKey`); the
    // guard keeps the narrowing honest rather than asserting.
    if (owner.accountId == null) return yield* new Unauthorized(INVALID_API_KEY);

    const org = yield* authorizeOrganization(owner.accountId, owner.organizationId);
    if (!org) return yield* new NoOrganization(NO_ORGANIZATION_IN_API_KEY);