Public/Get-OnePAMAuthStatus.ps1

function Get-OnePAMAuthStatus {
    <#
    .SYNOPSIS
        Shows current OnePAM authentication status.
    .DESCRIPTION
        Displays the authenticated user email, organization, token expiry,
        and whether the token is still valid.
    .EXAMPLE
        Get-OnePAMAuthStatus
    #>

    [CmdletBinding()]
    param()

    $token = Get-OpToken
    $cfg   = Get-OpConfig

    if (-not $token) {
        Write-Host 'Not authenticated. Run Connect-OnePAM to log in.' -ForegroundColor Yellow
        return
    }

    $expired = Test-OpTokenExpired -Token $token
    $status  = if ($expired) { 'Expired' } else { 'Active' }
    $color   = if ($expired) { 'Red' } else { 'Green' }

    $expiresAt = try { [DateTimeOffset]::Parse($token.expires_at).LocalDateTime.ToString('yyyy-MM-dd HH:mm:ss') } catch { $token.expires_at }

    [PSCustomObject]@{
        Status       = $status
        UserEmail    = $token.user_email
        Organization = $token.org_uuid
        APIBase      = $cfg.api_base
        ExpiresAt    = $expiresAt
    }

    Write-Host ''
    Write-Host " Status: $status" -ForegroundColor $color
    Write-Host " User: $($token.user_email)"
    Write-Host " Organization: $($token.org_uuid)"
    Write-Host " API Base: $($cfg.api_base)"
    Write-Host " Expires: $expiresAt"
    Write-Host ''
}