Return KYC approval timestamps

.gitea/workflows/build.yaml

@@ -1,6 +1,7 @@
 name: Build and deploy Docker image
 
 on:
+  workflow_dispatch:
   push:
     branches: [main]
 
@@ -12,24 +13,21 @@ jobs:
     steps:
       - uses: actions/checkout@v4
 
-      - name: Isolate Docker auth
+      - name: Build and publish
-        run: |
-          mkdir -p "$RUNNER_TEMP/docker-config"
-          echo "DOCKER_CONFIG=$RUNNER_TEMP/docker-config" >> "$GITHUB_ENV"
-
-      - name: Login to Gitea Registry
-        uses: docker/login-action@v3
-        with:
-          registry: gitea.dsrptlab.com
-          username: ${{ gitea.actor }}
-          password: ${{ secrets.REGISTRY_TOKEN }}
-
-      - name: Build and push
         run: |
+          set -euo pipefail
           docker build -t "$IMAGE:latest" -t "$IMAGE:${{ gitea.sha }}" .
           docker push "$IMAGE:latest"
           docker push "$IMAGE:${{ gitea.sha }}"
-          docker image rm -f "$IMAGE:latest" "$IMAGE:${{ gitea.sha }}"
 
-      - name: Deploy to Dokploy
+      - name: Remove local image tags
-        run: curl -fsS -X POST "https://ind.dsrptlab.com/api/deploy/ETL39L4zhtAK7QoXCX-aE"
+        run: docker image rm -f "$IMAGE:latest" "$IMAGE:${{ gitea.sha }}"
+
+      - name: Deploy in Dokploy
+        env:
+          DOKPLOY_DEPLOY_WEBHOOK: ${{ secrets.DOKPLOY_DEPLOY_WEBHOOK }}
+        run: |
+          set -euo pipefail
+          test -n "$DOKPLOY_DEPLOY_WEBHOOK"
+          curl -fsS -X POST "$DOKPLOY_DEPLOY_WEBHOOK"
+

src/auth.ts

@@ -32,6 +32,10 @@ function scopesFromPayload(payload: JWTPayload): string[] {
   return [];
 }
 
+function clientScopes(payload: JWTPayload): string[] {
+  return [...new Set([...scopesFromPayload(payload), "teams:user"])];
+}
+
 function claimList(payload: JWTPayload, key: string): string[] {
   const value = (payload as Record<string, unknown>)[key];
   if (typeof value === "string") return value.split(" ");
@@ -57,12 +61,12 @@ export async function publicContext(req: FastifyRequest): Promise<AuthContext> {
     issuer: LOGTO_ISSUER,
     audience: LOGTO_KYC_AUDIENCE,
   });
-  const scopes = scopesFromPayload(payload);
+  if (!payload.sub) {
-  if (!scopes.includes("teams:user")) {
     throw new GraphQLError("Unauthorized", {
       extensions: { code: "UNAUTHENTICATED" },
     });
   }
+  const scopes = clientScopes(payload);
   return { userId: payload.sub, scopes };
 }
 
@@ -77,12 +81,12 @@ export async function userContext(req: FastifyRequest): Promise<AuthContext> {
     issuer: LOGTO_ISSUER,
     audience: LOGTO_KYC_AUDIENCE,
   });
-  const scopes = scopesFromPayload(payload);
+  if (!payload.sub) {
-  if (!scopes.includes("teams:user")) {
     throw new GraphQLError("Unauthorized", {
       extensions: { code: "UNAUTHENTICATED" },
     });
   }
+  const scopes = clientScopes(payload);
   return { userId: payload.sub, scopes };
 }
 

src/schemas/user.ts

@@ -14,6 +14,7 @@ export const userTypeDefs = `#graphql
     contactPerson: String
     contactEmail: String
     contactPhone: String
+    approvedAt: String
     countryData: String
     createdAt: String!
     updatedAt: String!
@@ -140,6 +141,7 @@ export const userResolvers = {
     createKycRequestRussia: createApplicationRussia,
   },
   KYCApplication: {
+    approvedAt: (parent: { approvedAt: Date | null }) => parent.approvedAt?.toISOString() ?? null,
     countryData: async (parent: { objectId: number | null }) => getCountryData(parent),
     createdAt: (parent: { createdAt: Date }) => parent.createdAt.toISOString(),
     updatedAt: (parent: { updatedAt: Date }) => parent.updatedAt.toISOString(),