Validate a Cognito bearer token from the raw cloud function event and
normalize its subject and groups into Voltra auth info.
Token signature, issuer, expiration/not-before claims, token use, and app
client are verified by AWS's aws-jwt-verify Cognito verifier. The
verifier also discovers, fetches, caches, and refreshes the Cognito signing
keys for the configured user pool.
Missing, malformed, expired, incorrectly scoped, or unverifiable tokens
resolve to anonymous auth info instead of throwing. This allows
handleCloudFunctionEvent to continue routing public requests while its
route authorization still denies protected routes without valid auth.
Validate a Cognito bearer token from the raw cloud function event and normalize its subject and groups into Voltra auth info.
Token signature, issuer, expiration/not-before claims, token use, and app client are verified by AWS's
aws-jwt-verifyCognito verifier. The verifier also discovers, fetches, caches, and refreshes the Cognito signing keys for the configured user pool.Missing, malformed, expired, incorrectly scoped, or unverifiable tokens resolve to anonymous auth info instead of throwing. This allows
handleCloudFunctionEventto continue routing public requests while its route authorization still denies protected routes without valid auth.