From 7a92dcc71af259270da8aad4c6db59a752d3a196 Mon Sep 17 00:00:00 2001
From: Ruslan Bakiev <572431+veikab@users.noreply.github.com>
Date: Fri, 5 Jun 2026 12:43:44 +0700
Subject: [PATCH] Resolve orders team from Teams profile

---
 src/auth.ts | 25 +++++++++++++++++++++++--
 1 file changed, 23 insertions(+), 2 deletions(-)

diff --git a/src/auth.ts b/src/auth.ts
index b6c462c..93346c0 100644
--- a/src/auth.ts
+++ b/src/auth.ts
@@ -7,6 +7,8 @@ const LOGTO_JWKS_URL =
 const LOGTO_ISSUER = process.env.LOGTO_ISSUER || "https://auth.optovia.ru/oidc";
 const LOGTO_ORDERS_AUDIENCE =
   process.env.LOGTO_ORDERS_AUDIENCE || "https://orders.optovia.ru";
+const TEAMS_USER_GRAPHQL_URL =
+  process.env.TEAMS_USER_GRAPHQL_URL || "https://teams.optovia.ru/graphql/user/";
 
 const jwks = createRemoteJWKSet(new URL(LOGTO_JWKS_URL));
 
@@ -65,6 +67,23 @@ function hasManagerClaim(payload: JWTPayload): boolean {
   );
 }
 
+async function activeTeamUuidFromTeams(token: string): Promise<string | undefined> {
+  const response = await fetch(TEAMS_USER_GRAPHQL_URL, {
+    method: "POST",
+    headers: {
+      "content-type": "application/json",
+      authorization: `Bearer ${token}`,
+    },
+    body: JSON.stringify({
+      query: `query OrdersTeamMe { me { activeTeamId } }`,
+    }),
+  });
+  const body = (await response.json()) as {
+    data?: { me?: { activeTeamId?: string | null } };
+  };
+  return body.data?.me?.activeTeamId ?? undefined;
+}
+
 export async function publicContext(): Promise<AuthContext> {
   return { scopes: [] };
 }
@@ -89,8 +108,10 @@ export async function teamContext(req: FastifyRequest): Promise<AuthContext> {
     | string
     | undefined;
   const scopes = scopesFromPayload(payload);
+  const activeTeamUuid =
+    teamUuid ?? (await activeTeamUuidFromTeams(token));
 
-  if (!teamUuid || !scopes.includes("teams:member")) {
+  if (!activeTeamUuid || !scopes.includes("teams:member")) {
     throw new GraphQLError("Unauthorized", {
       extensions: { code: "UNAUTHENTICATED" },
     });
@@ -98,7 +119,7 @@ export async function teamContext(req: FastifyRequest): Promise<AuthContext> {
 
   return {
     userId: payload.sub,
-    teamUuid,
+    teamUuid: activeTeamUuid,
     scopes,
   };
 }