in api/src/main/scala/com/gu/adapters/http/Authentication.scala [112:130]
def authenticateUser(
scGuUCookie: Option[String],
accessToken: Option[String] = None,
identityAccessScope: IdentityAccessScope
): Either[Error, User] = {
// check if scGuUCookie or accessToken is present and determine correct method to uuse
if (accessToken.isDefined) {
// if access token present, use okta to authenticate
authenticateUserWithOkta(accessToken, identityAccessScope)
} else if (scGuUCookie.isDefined) {
// if only scGuUCookie is present, use idapi to authenticate
authenticateUserWithIdapi(scGuUCookie)
} else {
// if neither are present, return error
Left(userAuthorizationFailed(
List("No secure cookie or access token in request")
))
}
}