()
| 1971 | * token's org (network error, missing profile data), validation fails. |
| 1972 | */ |
| 1973 | export async function validateForceLoginOrg(): Promise<OrgValidationResult> { |
| 1974 | // `claude ssh` remote: real auth lives on the local machine and is injected |
| 1975 | // by the proxy. The placeholder token can't be validated against the profile |
| 1976 | // endpoint. The local side already ran this check before establishing the session. |
| 1977 | if (process.env.ANTHROPIC_UNIX_SOCKET) { |
| 1978 | return { valid: true } |
| 1979 | } |
| 1980 | |
| 1981 | if (!isAnthropicAuthEnabled()) { |
| 1982 | return { valid: true } |
| 1983 | } |
| 1984 | |
| 1985 | const requiredOrgUuid = |
| 1986 | getSettingsForSource('policySettings')?.forceLoginOrgUUID |
| 1987 | if (!requiredOrgUuid) { |
| 1988 | return { valid: true } |
| 1989 | } |
| 1990 | |
| 1991 | // Ensure the access token is fresh before hitting the profile endpoint. |
| 1992 | // No-op for env-var tokens (refreshToken is null). |
| 1993 | await checkAndRefreshOAuthTokenIfNeeded() |
| 1994 | |
| 1995 | const tokens = getClaudeAIOAuthTokens() |
| 1996 | if (!tokens) { |
| 1997 | return { valid: true } |
| 1998 | } |
| 1999 | |
| 2000 | // Always fetch the authoritative org UUID from the profile endpoint. |
| 2001 | // Even keychain-sourced tokens verify server-side: the cached org UUID |
| 2002 | // in ~/.claude.json is user-writable and cannot be trusted. |
| 2003 | const { source } = getAuthTokenSource() |
| 2004 | const isEnvVarToken = |
| 2005 | source === 'CLAUDE_CODE_OAUTH_TOKEN' || |
| 2006 | source === 'CLAUDE_CODE_OAUTH_TOKEN_FILE_DESCRIPTOR' |
| 2007 | |
| 2008 | const profile = await getOauthProfileFromOauthToken(tokens.accessToken) |
| 2009 | if (!profile) { |
| 2010 | // Fail closed — we can't verify the org |
| 2011 | return { |
| 2012 | valid: false, |
| 2013 | message: |
| 2014 | `Unable to verify organization for the current authentication token.\n` + |
| 2015 | `This machine requires organization ${requiredOrgUuid} but the profile could not be fetched.\n` + |
| 2016 | `This may be a network error, or the token may lack the user:profile scope required for\n` + |
| 2017 | `verification (tokens from 'claude setup-token' do not include this scope).\n` + |
| 2018 | `Try again, or obtain a full-scope token via 'claude auth login'.`, |
| 2019 | } |
| 2020 | } |
| 2021 | |
| 2022 | const tokenOrgUuid = profile.organization.uuid |
| 2023 | if (tokenOrgUuid === requiredOrgUuid) { |
| 2024 | return { valid: true } |
| 2025 | } |
| 2026 | |
| 2027 | if (isEnvVarToken) { |
| 2028 | const envVarName = |
| 2029 | source === 'CLAUDE_CODE_OAUTH_TOKEN' |
| 2030 | ? 'CLAUDE_CODE_OAUTH_TOKEN' |
no test coverage detected