Resolve orders team from Teams profile

src/auth.ts

@@ -7,6 +7,8 @@ const LOGTO_JWKS_URL =
 const LOGTO_ISSUER = process.env.LOGTO_ISSUER || "https://auth.optovia.ru/oidc";
 const LOGTO_ORDERS_AUDIENCE =
   process.env.LOGTO_ORDERS_AUDIENCE || "https://orders.optovia.ru";
+const TEAMS_USER_GRAPHQL_URL =
+  process.env.TEAMS_USER_GRAPHQL_URL || "https://teams.optovia.ru/graphql/user/";
 
 const jwks = createRemoteJWKSet(new URL(LOGTO_JWKS_URL));
 
@@ -65,6 +67,23 @@ function hasManagerClaim(payload: JWTPayload): boolean {
   );
 }
 
+async function activeTeamUuidFromTeams(token: string): Promise<string | undefined> {
+  const response = await fetch(TEAMS_USER_GRAPHQL_URL, {
+    method: "POST",
+    headers: {
+      "content-type": "application/json",
+      authorization: `Bearer ${token}`,
+    },
+    body: JSON.stringify({
+      query: `query OrdersTeamMe { me { activeTeamId } }`,
+    }),
+  });
+  const body = (await response.json()) as {
+    data?: { me?: { activeTeamId?: string | null } };
+  };
+  return body.data?.me?.activeTeamId ?? undefined;
+}
+
 export async function publicContext(): Promise<AuthContext> {
   return { scopes: [] };
 }
@@ -89,8 +108,10 @@ export async function teamContext(req: FastifyRequest): Promise<AuthContext> {
     | string
     | undefined;
   const scopes = scopesFromPayload(payload);
+  const activeTeamUuid =
+    teamUuid ?? (await activeTeamUuidFromTeams(token));
 
-  if (!teamUuid || !scopes.includes("teams:member")) {
+  if (!activeTeamUuid || !scopes.includes("teams:member")) {
     throw new GraphQLError("Unauthorized", {
       extensions: { code: "UNAUTHENTICATED" },
     });
@@ -98,7 +119,7 @@ export async function teamContext(req: FastifyRequest): Promise<AuthContext> {
 
   return {
     userId: payload.sub,
-    teamUuid,
+    teamUuid: activeTeamUuid,
     scopes,
   };
 }