Require Logto team claim for orders auth

src/auth.ts

@@ -7,8 +7,6 @@ const LOGTO_JWKS_URL =
 const LOGTO_ISSUER = process.env.LOGTO_ISSUER || "https://auth.optovia.ru/oidc";
 const LOGTO_ORDERS_AUDIENCE =
   process.env.LOGTO_ORDERS_AUDIENCE || "https://orders.optovia.ru";
-const TEAMS_USER_GRAPHQL_URL =
-  process.env.TEAMS_USER_GRAPHQL_URL || "https://teams.optovia.ru/graphql/user/";
 
 const jwks = createRemoteJWKSet(new URL(LOGTO_JWKS_URL));
 
@@ -67,23 +65,6 @@ function hasManagerClaim(payload: JWTPayload): boolean {
   );
 }
 
-async function activeTeamUuidFromTeams(token: string): Promise<string | undefined> {
-  const response = await fetch(TEAMS_USER_GRAPHQL_URL, {
-    method: "POST",
-    headers: {
-      "content-type": "application/json",
-      authorization: `Bearer ${token}`,
-    },
-    body: JSON.stringify({
-      query: `query OrdersTeamMe { me { activeTeamId } }`,
-    }),
-  });
-  const body = (await response.json()) as {
-    data?: { me?: { activeTeamId?: string | null } };
-  };
-  return body.data?.me?.activeTeamId ?? undefined;
-}
-
 export async function publicContext(): Promise<AuthContext> {
   return { scopes: [] };
 }
@@ -108,10 +89,8 @@ export async function teamContext(req: FastifyRequest): Promise<AuthContext> {
     | string
     | undefined;
   const scopes = scopesFromPayload(payload);
-  const activeTeamUuid =
-    teamUuid ?? (await activeTeamUuidFromTeams(token));
 
-  if (!activeTeamUuid || !scopes.includes("teams:member")) {
+  if (!teamUuid || !scopes.includes("teams:member")) {
     throw new GraphQLError("Unauthorized", {
       extensions: { code: "UNAUTHENTICATED" },
     });
@@ -119,7 +98,7 @@ export async function teamContext(req: FastifyRequest): Promise<AuthContext> {
 
   return {
     userId: payload.sub,
-    teamUuid: activeTeamUuid,
+    teamUuid,
     scopes,
   };
 }