lib/auth.ts

Purpose

Resolve current org/project from bearer tokens or dev flags.

Public Surface

• getCurrentOrg()
• getProjectFromAuth(authorizationHeader: string | null)

Behavior & Invariants

• Dev shortcuts when RUNFORGE_DEV_MODE=1 or tokens are dev|test|local.
• Production path is TODO: should hash token (SHA‑256) and look up ApiKey by keyHash.

Security

• Do not rely on dev shortcuts in production.

TODO

• Implement DB lookup with Prisma ApiKey and join to project.