optovia/kyc
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

Use Fastify Mercurius and GraphQL contracts
Build Docker Image / build (push) Has been cancelled
Details

Browse Source
This commit is contained in:
Ruslan Bakiev
2026-06-01 00:25:27 +05:00
parent 147202022a
commit 62beff96a1
6 changed files with 1264 additions and 1619 deletions
Download Patch File Download Diff File Expand all files Collapse all files
src/auth.ts
+42 -40
View File
@@ -1,65 +1,67 @@
import { createRemoteJWKSet, jwtVerify, type JWTPayload } from 'jose'
import { GraphQLError } from 'graphql'
import type { Request } from 'express'
import { createRemoteJWKSet, jwtVerify, type JWTPayload } from "jose";
import { GraphQLError } from "graphql";
import type { FastifyRequest } from "fastify";
const LOGTO_JWKS_URL = process.env.LOGTO_JWKS_URL || 'https://auth.optovia.ru/oidc/jwks'
const LOGTO_ISSUER = process.env.LOGTO_ISSUER || 'https://auth.optovia.ru/oidc'
const TEAMS_USER_GRAPHQL_URL = process.env.TEAMS_USER_GRAPHQL_URL || 'https://teams.optovia.ru/graphql/user/'
const SESSION_TOKEN_PREFIX = 'optovia-session:'
const LOGTO_JWKS_URL =
process.env.LOGTO_JWKS_URL || "https://auth.optovia.ru/oidc/jwks";
const LOGTO_ISSUER = process.env.LOGTO_ISSUER || "https://auth.optovia.ru/oidc";
const TEAMS_USER_GRAPHQL_URL =
process.env.TEAMS_USER_GRAPHQL_URL ||
"https://teams.optovia.ru/graphql/user/";
const SESSION_TOKEN_PREFIX = "optovia-session:";
const jwks = createRemoteJWKSet(new URL(LOGTO_JWKS_URL))
const jwks = createRemoteJWKSet(new URL(LOGTO_JWKS_URL));
export interface AuthContext {
userId?: string
scopes: string[]
isM2M?: boolean
userId?: string;
scopes: string[];
isM2M?: boolean;
}
function getBearerToken(req: Request): string | null {
const auth = req.headers.authorization || ''
if (!auth.startsWith('Bearer ')) return null
const token = auth.slice(7)
if (!token || token === 'undefined') return null
return token
function getBearerToken(req: FastifyRequest): string | null {
const auth = req.headers.authorization || "";
if (!auth.startsWith("Bearer ")) return null;
const token = auth.slice(7);
if (!token || token === "undefined") return null;
return token;
}
export async function publicContext(req: Request): Promise<AuthContext> {
// Optional auth - try to extract userId if token present
const token = getBearerToken(req)
if (!token) return { scopes: [] }
try {
const { payload } = await jwtVerify(token, jwks, { issuer: LOGTO_ISSUER })
return { userId: payload.sub, scopes: [] }
} catch {
return { scopes: [] }
}
export async function publicContext(req: FastifyRequest): Promise<AuthContext> {
const token = getBearerToken(req);
if (!token) return { scopes: [] };
const { payload } = await jwtVerify(token, jwks, { issuer: LOGTO_ISSUER });
return { userId: payload.sub, scopes: [] };
}
export async function userContext(req: Request): Promise<AuthContext> {
const token = getBearerToken(req)
export async function userContext(req: FastifyRequest): Promise<AuthContext> {
const token = getBearerToken(req);
if (!token) {
throw new GraphQLError('Unauthorized', { extensions: { code: 'UNAUTHENTICATED' } })
throw new GraphQLError("Unauthorized", {
extensions: { code: "UNAUTHENTICATED" },
});
}
if (token.startsWith(SESSION_TOKEN_PREFIX)) {
const response = await fetch(TEAMS_USER_GRAPHQL_URL, {
method: 'POST',
method: "POST",
headers: {
'content-type': 'application/json',
"content-type": "application/json",
authorization: `Bearer ${token}`,
},
body: JSON.stringify({ query: `query KycSessionMe { me { id } }` }),
})
const body = await response.json() as { data?: { me?: { id?: string } } }
const userId = body.data?.me?.id
});
const body = (await response.json()) as { data?: { me?: { id?: string } } };
const userId = body.data?.me?.id;
if (!userId) {
throw new GraphQLError('Unauthorized', { extensions: { code: 'UNAUTHENTICATED' } })
throw new GraphQLError("Unauthorized", {
extensions: { code: "UNAUTHENTICATED" },
});
}
return { userId, scopes: [] }
return { userId, scopes: [] };
}
const { payload } = await jwtVerify(token, jwks, { issuer: LOGTO_ISSUER })
return { userId: payload.sub, scopes: [] }
const { payload } = await jwtVerify(token, jwks, { issuer: LOGTO_ISSUER });
return { userId: payload.sub, scopes: [] };
}
export async function m2mContext(): Promise<AuthContext> {
return { scopes: [], isM2M: true }
return { scopes: [], isM2M: true };
}