From d81fc10b818565dd9b82e374be42400cb19150d5 Mon Sep 17 00:00:00 2001
From: Ruslan Bakiev <572431+veikab@users.noreply.github.com>
Date: Fri, 5 Jun 2026 12:52:50 +0700
Subject: [PATCH] Require Logto team claim for orders auth

---
 src/auth.ts | 25 ++-----------------------
 1 file changed, 2 insertions(+), 23 deletions(-)

diff --git a/src/auth.ts b/src/auth.ts
index 93346c0..b6c462c 100644
--- a/src/auth.ts
+++ b/src/auth.ts
@@ -7,8 +7,6 @@ const LOGTO_JWKS_URL =
 const LOGTO_ISSUER = process.env.LOGTO_ISSUER || "https://auth.optovia.ru/oidc";
 const LOGTO_ORDERS_AUDIENCE =
   process.env.LOGTO_ORDERS_AUDIENCE || "https://orders.optovia.ru";
-const TEAMS_USER_GRAPHQL_URL =
-  process.env.TEAMS_USER_GRAPHQL_URL || "https://teams.optovia.ru/graphql/user/";
 
 const jwks = createRemoteJWKSet(new URL(LOGTO_JWKS_URL));
 
@@ -67,23 +65,6 @@ function hasManagerClaim(payload: JWTPayload): boolean {
   );
 }
 
-async function activeTeamUuidFromTeams(token: string): Promise<string | undefined> {
-  const response = await fetch(TEAMS_USER_GRAPHQL_URL, {
-    method: "POST",
-    headers: {
-      "content-type": "application/json",
-      authorization: `Bearer ${token}`,
-    },
-    body: JSON.stringify({
-      query: `query OrdersTeamMe { me { activeTeamId } }`,
-    }),
-  });
-  const body = (await response.json()) as {
-    data?: { me?: { activeTeamId?: string | null } };
-  };
-  return body.data?.me?.activeTeamId ?? undefined;
-}
-
 export async function publicContext(): Promise<AuthContext> {
   return { scopes: [] };
 }
@@ -108,10 +89,8 @@ export async function teamContext(req: FastifyRequest): Promise<AuthContext> {
     | string
     | undefined;
   const scopes = scopesFromPayload(payload);
-  const activeTeamUuid =
-    teamUuid ?? (await activeTeamUuidFromTeams(token));
 
-  if (!activeTeamUuid || !scopes.includes("teams:member")) {
+  if (!teamUuid || !scopes.includes("teams:member")) {
     throw new GraphQLError("Unauthorized", {
       extensions: { code: "UNAUTHENTICATED" },
     });
@@ -119,7 +98,7 @@ export async function teamContext(req: FastifyRequest): Promise<AuthContext> {
 
   return {
     userId: payload.sub,
-    teamUuid: activeTeamUuid,
+    teamUuid,
     scopes,
   };
 }