From 67a45302b273390d909f1cfba56c6850564ab920 Mon Sep 17 00:00:00 2001
From: Ruslan Bakiev <572431+veikab@users.noreply.github.com>
Date: Fri, 5 Jun 2026 12:52:50 +0700
Subject: [PATCH] Require Logto team claim for billing auth

---
 src/auth.ts | 30 ------------------------------
 1 file changed, 30 deletions(-)

diff --git a/src/auth.ts b/src/auth.ts
index 8c9f660..ba7b0f7 100644
--- a/src/auth.ts
+++ b/src/auth.ts
@@ -7,10 +7,6 @@ const LOGTO_JWKS_URL =
 const LOGTO_ISSUER = process.env.LOGTO_ISSUER || "https://auth.optovia.ru/oidc";
 const LOGTO_BILLING_AUDIENCE =
   process.env.LOGTO_BILLING_AUDIENCE || "https://billing.optovia.ru";
-const TEAMS_USER_GRAPHQL_URL =
-  process.env.TEAMS_USER_GRAPHQL_URL ||
-  "https://teams.optovia.ru/graphql/user/";
-const SESSION_TOKEN_PREFIX = "optovia-session:";
 
 const jwks = createRemoteJWKSet(new URL(LOGTO_JWKS_URL));
 
@@ -51,32 +47,6 @@ export async function m2mContext(): Promise<AuthContext> {
 
 export async function teamContext(req: FastifyRequest): Promise<AuthContext> {
   const token = getBearerToken(req);
-  if (token.startsWith(SESSION_TOKEN_PREFIX)) {
-    const response = await fetch(TEAMS_USER_GRAPHQL_URL, {
-      method: "POST",
-      headers: {
-        "content-type": "application/json",
-        authorization: `Bearer ${token}`,
-      },
-      body: JSON.stringify({
-        query: `query BillingSessionMe { me { id activeTeamId } }`,
-      }),
-    });
-    const body = (await response.json()) as {
-      data?: { me?: { id?: string; activeTeamId?: string } };
-    };
-    const me = body.data?.me;
-    if (!me?.id || !me.activeTeamId) {
-      throw new GraphQLError("Unauthorized", {
-        extensions: { code: "UNAUTHENTICATED" },
-      });
-    }
-    return {
-      userId: me.id,
-      teamUuid: me.activeTeamId,
-      scopes: ["teams:member"],
-    };
-  }
   const { payload } = await jwtVerify(token, jwks, {
     issuer: LOGTO_ISSUER,
     audience: LOGTO_BILLING_AUDIENCE,