optovia/teams
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

Use shared app JWT for manager access

Browse Source
This commit is contained in:
Ruslan Bakiev
2026-05-31 22:00:52 +05:00
parent bca8c0e782
commit 1a3f72205f
3 changed files with 29 additions and 111 deletions
Download Patch File Download Diff File Expand all files Collapse all files
src/auth.ts
+22 -17
View File
@@ -6,8 +6,8 @@ import { prisma } from './db.js'
const LOGTO_JWKS_URL = process.env.LOGTO_JWKS_URL || 'https://auth.optovia.ru/oidc/jwks'
const LOGTO_ISSUER = process.env.LOGTO_ISSUER || 'https://auth.optovia.ru/oidc'
const LOGTO_TEAMS_AUDIENCE = process.env.LOGTO_TEAMS_AUDIENCE || 'https://teams.optovia.ru'
const MANAGER_JWT_ISSUER = 'optovia:teams'
const MANAGER_JWT_AUDIENCES = ['https://teams.optovia.ru', 'https://orders.optovia.ru', 'https://logistics.optovia.ru']
const APP_JWT_ISSUER = 'optovia:teams'
const APP_JWT_AUDIENCES = ['https://teams.optovia.ru', 'https://orders.optovia.ru', 'https://logistics.optovia.ru']
const jwks = createRemoteJWKSet(new URL(LOGTO_JWKS_URL))
@@ -46,32 +46,33 @@ function scopesFromPayload(payload: JWTPayload): string[] {
export async function publicContext(): Promise<AuthContext> { return { scopes: [] } }
function managerJwtSecret(): Uint8Array {
const secret = process.env.MANAGER_JWT_SECRET
if (!secret) throw new GraphQLError('MANAGER_JWT_SECRET is required', { extensions: { code: 'INTERNAL_SERVER_ERROR' } })
function appJwtSecret(): Uint8Array {
const secret = process.env.APP_JWT_SECRET
if (!secret) throw new GraphQLError('APP_JWT_SECRET is required', { extensions: { code: 'INTERNAL_SERVER_ERROR' } })
return new TextEncoder().encode(secret)
}
export async function issueManagerJwt(input: { userId: string; teamUuid?: string | null }): Promise<string> {
export async function issueAppJwt(input: { userId: string; teamUuid?: string | null; isManager: boolean }): Promise<string> {
const scopes = ['teams:user']
if (input.isManager) scopes.push('manager')
return new SignJWT({
scope: 'manager',
role: 'manager',
scope: scopes.join(' '),
roles: input.isManager ? ['manager'] : [],
team_uuid: input.teamUuid ?? undefined,
})
.setProtectedHeader({ alg: 'HS256', typ: 'JWT' })
.setIssuer(MANAGER_JWT_ISSUER)
.setAudience(MANAGER_JWT_AUDIENCES)
.setIssuer(APP_JWT_ISSUER)
.setAudience(APP_JWT_AUDIENCES)
.setSubject(input.userId)
.setIssuedAt()
.setExpirationTime(`${Number.parseInt(process.env.LOGIN_SESSION_TTL_DAYS || '30', 10)}d`)
.sign(managerJwtSecret())
.sign(appJwtSecret())
}
async function verifyManagerJwt(token: string, audience: string = LOGTO_TEAMS_AUDIENCE): Promise<AuthContext> {
const { payload } = await jwtVerify(token, managerJwtSecret(), { issuer: MANAGER_JWT_ISSUER, audience })
async function verifyAppJwt(token: string, audience: string = LOGTO_TEAMS_AUDIENCE): Promise<AuthContext> {
const { payload } = await jwtVerify(token, appJwtSecret(), { issuer: APP_JWT_ISSUER, audience })
const scopes = scopesFromPayload(payload)
const role = (payload as Record<string, unknown>).role
if (!scopes.includes('manager') || role !== 'manager' || !payload.sub) {
if (!payload.sub) {
throw new GraphQLError('Unauthorized', { extensions: { code: 'UNAUTHENTICATED' } })
}
return {
@@ -92,7 +93,7 @@ export async function userContext(req: Request): Promise<AuthContext> {
return { userId: session.user.username, sessionToken: token, scopes: ['teams:user'] }
}
const unverifiedPayload = decodeJwt(token)
if (unverifiedPayload.iss === MANAGER_JWT_ISSUER) return verifyManagerJwt(token)
if (unverifiedPayload.iss === APP_JWT_ISSUER) return verifyAppJwt(token)
const { payload } = await jwtVerify(token, jwks, { issuer: LOGTO_ISSUER })
return { userId: payload.sub, scopes: [] }
}
@@ -100,7 +101,11 @@ export async function userContext(req: Request): Promise<AuthContext> {
export async function managerContext(req: Request): Promise<AuthContext> {
const token = optionalBearerToken(req)
if (token === null) return { scopes: [] }
return verifyManagerJwt(token)
const context = await verifyAppJwt(token)
if (!context.scopes.includes('manager')) {
throw new GraphQLError('Manager access required', { extensions: { code: 'FORBIDDEN' } })
}
return context
}
export async function teamContext(req: Request): Promise<AuthContext> {