9 Authentication
8 operations.
9.0.1 checkAuth
GET /api/auth/check
Answers “is this person signed in?”
Why it exists. † Report whether the current request carries a valid session, so the interface can decide between showing the application and redirecting to sign-in.
Reports whether the caller has a valid session. Auth is optional — an unauthenticated call is not an error and returns 200 with authenticated:false (this endpoint never returns 401).
Authentication: CookieAuth
Returns — authenticated · user · timestamp
Field names as the handler returns them; the source states no types for them.
Responses
| Status | Meaning | Body |
|---|---|---|
200 |
Authentication status | |
500 |
Server error | Error |
9.0.2 createOrganizationForAuthenticatedUser
POST /api/auth/create-organization
Creates an organization for a signed-in user who has none.
Why it exists. † Create the caller’s first organisation, or return the one they already have. Idempotent, because sign-up can retry.
Creates a new organization for the authenticated user if they do not already have one.
Authentication: CookieAuth, SupabaseAuth
Uses a service-role client (row-level security bypassed).
Returns — success · organization · message · isNewOrganization
Field names as the handler returns them; the source states no types for them.
Effect — writes (delete, insert) organization_members · organizations
Request body
| Field | Type | Required |
|---|---|---|
name |
string | no |
Responses
| Status | Meaning | Body |
|---|---|---|
200 |
Organization created or already exists | Organization |
401 |
Not authenticated | Error |
500 |
Server error | Error |
9.0.3 createOrganizationAfterLogin
POST /api/auth/create-organization-after-login
Same, triggered right after login.
Why it exists. † Ensure a user who signed in has an organisation, for the case where sign- up completed without creating one.
Creates a new organization for the authenticated user after login if they do not already have one.
Authentication: CookieAuth, SupabaseAuth
Uses a service-role client (row-level security bypassed).
Returns — success · organization · message
Field names as the handler returns them; the source states no types for them.
Effect — writes (delete, insert) organization_members · organizations
Responses
| Status | Meaning | Body |
|---|---|---|
200 |
Organization created or already exists | Organization |
401 |
Not authenticated | Error |
500 |
Server error | Error |
9.0.4 ensureUserOrganization
GET /api/auth/ensure-organization
Verifies the user has an organization, creating one if needed.
Why it exists. † Return the caller’s organisation, creating one if they have none, so a newly signed-up user lands in a working workspace rather than an empty state. Cached briefly, since it is called on nearly every page.
Ensures the authenticated user has an organization, creating one if necessary.
Authentication: CookieAuth, SupabaseAuth
Uses a service-role client (row-level security bypassed).
Returns — success · organization · message
Field names as the handler returns them; the source states no types for them.
Effect — writes (delete, insert) organization_members · organizations
Responses
| Status | Meaning | Body |
|---|---|---|
200 |
Organization ensured | Organization |
401 |
Not authenticated | Error |
500 |
Server error | Error |
9.0.5 createJwtFromSession
POST /api/auth/generate-jwt-from-session
Hands the chat layer the user’s current sign-in token (refreshing it if it is about to expire).
Why it exists. † Exchange a browser session for a bearer token, refreshing it if it is near expiry, so components that talk to the AI engine can present a credential it accepts.
Called by — components/chat-sidebar.tsx · hooks/use-auth-token.ts · hooks/use-jwt-auth.ts
Reached from — /w/data-explorer/assets · /w/integrity/assets · /w/integrity/evidence-explorer
Returns the caller’s live Supabase access token (refreshing it first when it expires within 5 minutes) so the chat/MCP layer can forward it as a bearer token. No new JWT is minted.
Authentication: CookieAuth
Returns — jwt_token · user_id · user_email · success · source · expires_at
Field names as the handler returns them; the source states no types for them.
Responses
| Status | Meaning | Body |
|---|---|---|
200 |
Token issued from the existing session. | |
401 |
Not authenticated, stale session, or token expired. | Error |
500 |
Failed to generate JWT from session. | Error |
9.0.6 listSsoProviders
GET /api/auth/sso
Lists the available enterprise single-sign-on providers (no login — it powers the login screen; currently returns an empty stub list).
Why it exists. † List the configured single sign-on providers. Currently a stub returning an empty list, since none are registered yet.
Unauthenticated — lists available SSO providers for login-UI discovery. Currently a hardcoded stub returning an empty list.
Authentication: none
Returns — providers · message
Field names as the handler returns them; the source states no types for them.
Responses
| Status | Meaning | Body |
|---|---|---|
200 |
Provider list (currently always empty). |
9.0.7 startSsoSignIn
POST /api/auth/sso
Starts an enterprise single-sign-on login and returns where to redirect the user (no login — it is the login entry point).
Why it exists. † Begin single sign-on for a customer’s identity provider, resolved either by email domain or by provider id, and return the address to send the browser to.
Unauthenticated login entry point — initiates SAML SSO through Supabase for an email domain or a specific provider id and returns the IdP redirect URL.
Authentication: none
Bypasses row-level security with no verified caller. This handler builds a service-role client and contains no call that resolves a user. Listed in the security appendix for review — which is not the same as a defect: a sign-in entry point cannot verify a caller who is not yet signed in.
Returns — url
Field names as the handler returns them; the source states no types for them.
Request body
| Field | Type | Required |
|---|---|---|
domain |
string | no |
providerId |
string | no |
Responses
| Status | Meaning | Body |
|---|---|---|
200 |
IdP redirect URL. | |
400 |
Either domain or providerId is required. | Error |
422 |
Supabase SSO error (e.g. no provider matches the domain). | Error |
500 |
Internal server error. | Error |
503 |
SSO not configured (missing Supabase credentials). | Error |
9.0.8 setOrganizationCookie
POST /api/set-org-cookie
Remembers which organization the user is currently working in.
Why it exists. † Record which organisation the user is currently working in, as a cookie, so the rest of the interface can scope itself without being told each time.
Sets the current organization ID in a cookie for the user’s session.
Authentication: CookieAuth, SupabaseAuth
Returns — success
Field names as the handler returns them; the source states no types for them.
Request body
| Field | Type | Required |
|---|---|---|
orgId |
string (uuid) | yes |
Responses
| Status | Meaning | Body |
|---|---|---|
200 |
Cookie set successfully. | |
400 |
Bad request | Error |
401 |
Not authenticated | Error |
500 |
Server error | Error |