Allow manager orders access without team claim

2026-06-05 12:29:38 +07:00
parent 5dd28d388f
commit 2a0fb9936d
2 changed files with 75 additions and 37 deletions
@@ -116,12 +116,16 @@ export async function managerContext(
  const teamUuid = (payload as Record<string, unknown>).team_uuid as
    | string
    | undefined;
-  if (!payload.sub || !hasManagerClaim(payload) || !teamUuid) {
+  if (!payload.sub || !hasManagerClaim(payload)) {
    throw new GraphQLError("Unauthorized", {
      extensions: { code: "UNAUTHENTICATED" },
    });
  }
-  return { userId: payload.sub, teamUuid, scopes: ["teams:member", "manager"] };
+  return {
+    userId: payload.sub,
+    teamUuid,
+    scopes: [...new Set([...scopes, "manager"])],
+  };
 }

 export function requireScopes(ctx: AuthContext, ...required: string[]): void {