Add manager GraphQL endpoint

src/auth.ts

@@ -1,4 +1,4 @@
-import { createRemoteJWKSet, jwtVerify, type JWTPayload } from 'jose'
+import { createRemoteJWKSet, jwtVerify, SignJWT, decodeJwt, type JWTPayload } from 'jose'
 import { GraphQLError } from 'graphql'
 import type { Request } from 'express'
 import { prisma } from './db.js'
@@ -6,6 +6,8 @@ import { prisma } from './db.js'
 const LOGTO_JWKS_URL = process.env.LOGTO_JWKS_URL || 'https://auth.optovia.ru/oidc/jwks'
 const LOGTO_ISSUER = process.env.LOGTO_ISSUER || 'https://auth.optovia.ru/oidc'
 const LOGTO_TEAMS_AUDIENCE = process.env.LOGTO_TEAMS_AUDIENCE || 'https://teams.optovia.ru'
+const MANAGER_JWT_ISSUER = 'optovia:teams'
+const MANAGER_JWT_AUDIENCES = ['https://teams.optovia.ru', 'https://orders.optovia.ru', 'https://logistics.optovia.ru']
 
 const jwks = createRemoteJWKSet(new URL(LOGTO_JWKS_URL))
 
@@ -44,6 +46,41 @@ function scopesFromPayload(payload: JWTPayload): string[] {
 
 export async function publicContext(): Promise<AuthContext> { return { scopes: [] } }
 
+function managerJwtSecret(): Uint8Array {
+  const secret = process.env.MANAGER_JWT_SECRET
+  if (!secret) throw new GraphQLError('MANAGER_JWT_SECRET is required', { extensions: { code: 'INTERNAL_SERVER_ERROR' } })
+  return new TextEncoder().encode(secret)
+}
+
+export async function issueManagerJwt(input: { userId: string; teamUuid?: string | null }): Promise<string> {
+  return new SignJWT({
+    scope: 'manager',
+    role: 'manager',
+    team_uuid: input.teamUuid ?? undefined,
+  })
+    .setProtectedHeader({ alg: 'HS256', typ: 'JWT' })
+    .setIssuer(MANAGER_JWT_ISSUER)
+    .setAudience(MANAGER_JWT_AUDIENCES)
+    .setSubject(input.userId)
+    .setIssuedAt()
+    .setExpirationTime(`${Number.parseInt(process.env.LOGIN_SESSION_TTL_DAYS || '30', 10)}d`)
+    .sign(managerJwtSecret())
+}
+
+async function verifyManagerJwt(token: string, audience: string = LOGTO_TEAMS_AUDIENCE): Promise<AuthContext> {
+  const { payload } = await jwtVerify(token, managerJwtSecret(), { issuer: MANAGER_JWT_ISSUER, audience })
+  const scopes = scopesFromPayload(payload)
+  const role = (payload as Record<string, unknown>).role
+  if (!scopes.includes('manager') || role !== 'manager' || !payload.sub) {
+    throw new GraphQLError('Unauthorized', { extensions: { code: 'UNAUTHENTICATED' } })
+  }
+  return {
+    userId: payload.sub,
+    teamUuid: (payload as Record<string, unknown>).team_uuid as string | undefined,
+    scopes,
+  }
+}
+
 export async function userContext(req: Request): Promise<AuthContext> {
   const token = optionalBearerToken(req)
   if (token === null) return { scopes: [] }
@@ -54,10 +91,18 @@ export async function userContext(req: Request): Promise<AuthContext> {
     }
     return { userId: session.user.username, sessionToken: token, scopes: ['teams:user'] }
   }
+  const unverifiedPayload = decodeJwt(token)
+  if (unverifiedPayload.iss === MANAGER_JWT_ISSUER) return verifyManagerJwt(token)
   const { payload } = await jwtVerify(token, jwks, { issuer: LOGTO_ISSUER })
   return { userId: payload.sub, scopes: [] }
 }
 
+export async function managerContext(req: Request): Promise<AuthContext> {
+  const token = optionalBearerToken(req)
+  if (token === null) return { scopes: [] }
+  return verifyManagerJwt(token)
+}
+
 export async function teamContext(req: Request): Promise<AuthContext> {
   const token = getBearerToken(req)
   const { payload } = await jwtVerify(token, jwks, { issuer: LOGTO_ISSUER, audience: LOGTO_TEAMS_AUDIENCE })