From fbe961c358cc83804333a162068b41797f489f42 Mon Sep 17 00:00:00 2001
From: Ruslan Bakiev <572431+veikab@users.noreply.github.com>
Date: Fri, 8 May 2026 17:41:34 +0700
Subject: [PATCH] Require Telegram auth for app data

---
 src/graphql/schema.ts | 12 ++++++++++--
 1 file changed, 10 insertions(+), 2 deletions(-)

diff --git a/src/graphql/schema.ts b/src/graphql/schema.ts
index b329b54..21e8eed 100644
--- a/src/graphql/schema.ts
+++ b/src/graphql/schema.ts
@@ -83,8 +83,16 @@ export const resolvers = {
   JSON: GraphQLJSONObject,
   Query: {
     health: () => 'ok',
-    places: () => listPlaces(),
-    voiceExperiences: () => listVoiceExperiences(),
+    places: async (_: unknown, __: unknown, context: unknown) => {
+      const graphqlContext = context as GraphqlContext;
+      await requireTelegramUser(graphqlContext.telegramInitData);
+      return listPlaces();
+    },
+    voiceExperiences: async (_: unknown, __: unknown, context: unknown) => {
+      const graphqlContext = context as GraphqlContext;
+      await requireTelegramUser(graphqlContext.telegramInitData);
+      return listVoiceExperiences();
+    },
   },
   Mutation: {
     authenticateTelegram: async (