Return GraphQL auth errors for manager requests

src/auth.ts

@@ -32,6 +32,14 @@ function getBearerToken(req: FastifyRequest): string {
   return token;
 }
 
+function optionalBearerToken(req: FastifyRequest): string | null {
+  const auth = req.headers.authorization || "";
+  if (!auth.startsWith("Bearer ")) return null;
+  const token = auth.slice(7);
+  if (!token || token === "undefined") return null;
+  return token;
+}
+
 function scopesFromPayload(payload: JWTPayload): string[] {
   const scope = payload.scope;
   if (!scope) return [];
@@ -98,7 +106,8 @@ export async function teamContext(req: FastifyRequest): Promise<AuthContext> {
 export async function managerContext(
   req: FastifyRequest,
 ): Promise<AuthContext> {
-  const token = getBearerToken(req);
+  const token = optionalBearerToken(req);
+  if (token === null) return { scopes: [] };
   const { payload } = await jwtVerify(token, jwks, {
     issuer: LOGTO_ISSUER,
     audience: LOGTO_ORDERS_AUDIENCE,

src/index.ts

@@ -28,12 +28,6 @@ if (SENTRY_DSN) {
 const app = Fastify();
 await app.register(cors, { origin: ["https://optovia.ru"], credentials: true });
 
-type GraphqlBody = {
-  query?: string;
-  variables?: Record<string, unknown>;
-  operationName?: string;
-};
-
 async function registerGraphqlEndpoint(
   server: FastifyInstance,
   path: string,
@@ -46,19 +40,9 @@ async function registerGraphqlEndpoint(
       await route.register(mercurius, {
         schema,
         resolvers: resolvers as never,
-        routes: false,
+        path: "/",
-      });
+        context: async (request) =>
-      route.post("/", async (request, reply) => {
+          (await context(request as FastifyRequest)) as Record<string, unknown>,
-        const body = request.body as GraphqlBody;
-        if (typeof body.query !== "string") {
-          throw new Error("GraphQL query is required");
-        }
-        return reply.graphql(
-          body.query,
-          (await context(request)) as Record<string, unknown>,
-          body.variables,
-          body.operationName,
-        );
       });
     },
     { prefix: path },