74 lines
2.2 KiB
TypeScript
74 lines
2.2 KiB
TypeScript
import { createRemoteJWKSet, jwtVerify, type JWTPayload } from "jose";
|
|
import { GraphQLError } from "graphql";
|
|
import type { FastifyRequest } from "fastify";
|
|
|
|
const LOGTO_JWKS_URL =
|
|
process.env.LOGTO_JWKS_URL || "https://auth.optovia.ru/oidc/jwks";
|
|
const LOGTO_ISSUER = process.env.LOGTO_ISSUER || "https://auth.optovia.ru/oidc";
|
|
const LOGTO_KYC_AUDIENCE =
|
|
process.env.LOGTO_KYC_AUDIENCE || "https://kyc.optovia.ru";
|
|
|
|
const jwks = createRemoteJWKSet(new URL(LOGTO_JWKS_URL));
|
|
|
|
export interface AuthContext {
|
|
userId?: string;
|
|
scopes: string[];
|
|
isM2M?: boolean;
|
|
}
|
|
|
|
function getBearerToken(req: FastifyRequest): string | null {
|
|
const auth = req.headers.authorization || "";
|
|
if (!auth.startsWith("Bearer ")) return null;
|
|
const token = auth.slice(7);
|
|
if (!token || token === "undefined") return null;
|
|
return token;
|
|
}
|
|
|
|
function scopesFromPayload(payload: JWTPayload): string[] {
|
|
const scope = payload.scope;
|
|
if (!scope) return [];
|
|
if (typeof scope === "string") return scope.split(" ");
|
|
if (Array.isArray(scope)) return scope as string[];
|
|
return [];
|
|
}
|
|
|
|
export async function publicContext(req: FastifyRequest): Promise<AuthContext> {
|
|
const token = getBearerToken(req);
|
|
if (!token) return { scopes: [] };
|
|
const { payload } = await jwtVerify(token, jwks, {
|
|
issuer: LOGTO_ISSUER,
|
|
audience: LOGTO_KYC_AUDIENCE,
|
|
});
|
|
const scopes = scopesFromPayload(payload);
|
|
if (!scopes.includes("teams:user")) {
|
|
throw new GraphQLError("Unauthorized", {
|
|
extensions: { code: "UNAUTHENTICATED" },
|
|
});
|
|
}
|
|
return { userId: payload.sub, scopes };
|
|
}
|
|
|
|
export async function userContext(req: FastifyRequest): Promise<AuthContext> {
|
|
const token = getBearerToken(req);
|
|
if (!token) {
|
|
throw new GraphQLError("Unauthorized", {
|
|
extensions: { code: "UNAUTHENTICATED" },
|
|
});
|
|
}
|
|
const { payload } = await jwtVerify(token, jwks, {
|
|
issuer: LOGTO_ISSUER,
|
|
audience: LOGTO_KYC_AUDIENCE,
|
|
});
|
|
const scopes = scopesFromPayload(payload);
|
|
if (!scopes.includes("teams:user")) {
|
|
throw new GraphQLError("Unauthorized", {
|
|
extensions: { code: "UNAUTHENTICATED" },
|
|
});
|
|
}
|
|
return { userId: payload.sub, scopes };
|
|
}
|
|
|
|
export async function m2mContext(): Promise<AuthContext> {
|
|
return { scopes: [], isM2M: true };
|
|
}
|