Add manager orders endpoint

src/auth.ts

@@ -5,6 +5,7 @@ import type { Request } from 'express'
 const LOGTO_JWKS_URL = process.env.LOGTO_JWKS_URL || 'https://auth.optovia.ru/oidc/jwks'
 const LOGTO_ISSUER = process.env.LOGTO_ISSUER || 'https://auth.optovia.ru/oidc'
 const LOGTO_ORDERS_AUDIENCE = process.env.LOGTO_ORDERS_AUDIENCE || 'https://orders.optovia.ru'
+const MANAGER_JWT_ISSUER = 'optovia:teams'
 
 const jwks = createRemoteJWKSet(new URL(LOGTO_JWKS_URL))
 
@@ -68,6 +69,27 @@ export async function teamContext(req: Request): Promise<AuthContext> {
   }
 }
 
+function managerJwtSecret(): Uint8Array {
+  const secret = process.env.MANAGER_JWT_SECRET
+  if (!secret) throw new GraphQLError('MANAGER_JWT_SECRET is required', { extensions: { code: 'INTERNAL_SERVER_ERROR' } })
+  return new TextEncoder().encode(secret)
+}
+
+export async function managerContext(req: Request): Promise<AuthContext> {
+  const token = getBearerToken(req)
+  const { payload } = await jwtVerify(token, managerJwtSecret(), {
+    issuer: MANAGER_JWT_ISSUER,
+    audience: LOGTO_ORDERS_AUDIENCE,
+  })
+  const scopes = scopesFromPayload(payload)
+  const role = (payload as Record<string, unknown>).role
+  const teamUuid = (payload as Record<string, unknown>).team_uuid as string | undefined
+  if (!payload.sub || role !== 'manager' || !scopes.includes('manager') || !teamUuid) {
+    throw new GraphQLError('Unauthorized', { extensions: { code: 'UNAUTHENTICATED' } })
+  }
+  return { userId: payload.sub, teamUuid, scopes: ['teams:member', 'manager'] }
+}
+
 export function requireScopes(ctx: AuthContext, ...required: string[]): void {
   const missing = required.filter(s => !ctx.scopes.includes(s))
   if (missing.length > 0) {