Accept Flutter sessions for KYC

src/auth.ts

@@ -4,6 +4,8 @@ import type { Request } from 'express'
 
 const LOGTO_JWKS_URL = process.env.LOGTO_JWKS_URL || 'https://auth.optovia.ru/oidc/jwks'
 const LOGTO_ISSUER = process.env.LOGTO_ISSUER || 'https://auth.optovia.ru/oidc'
+const TEAMS_USER_GRAPHQL_URL = process.env.TEAMS_USER_GRAPHQL_URL || 'https://teams.optovia.ru/graphql/user/'
+const SESSION_TOKEN_PREFIX = 'optovia-session:'
 
 const jwks = createRemoteJWKSet(new URL(LOGTO_JWKS_URL))
 
@@ -38,6 +40,22 @@ export async function userContext(req: Request): Promise<AuthContext> {
   if (!token) {
     throw new GraphQLError('Unauthorized', { extensions: { code: 'UNAUTHENTICATED' } })
   }
+  if (token.startsWith(SESSION_TOKEN_PREFIX)) {
+    const response = await fetch(TEAMS_USER_GRAPHQL_URL, {
+      method: 'POST',
+      headers: {
+        'content-type': 'application/json',
+        authorization: `Bearer ${token}`,
+      },
+      body: JSON.stringify({ query: `query KycSessionMe { me { id } }` }),
+    })
+    const body = await response.json() as { data?: { me?: { id?: string } } }
+    const userId = body.data?.me?.id
+    if (!userId) {
+      throw new GraphQLError('Unauthorized', { extensions: { code: 'UNAUTHENTICATED' } })
+    }
+    return { userId, scopes: [] }
+  }
   const { payload } = await jwtVerify(token, jwks, { issuer: LOGTO_ISSUER })
   return { userId: payload.sub, scopes: [] }
 }