Provision default client team context

.gitea/workflows/build.yaml

@@ -1,6 +1,7 @@
 name: Build and deploy Docker image
 
 on:
+  workflow_dispatch:
   push:
     branches: [main]
 
@@ -12,19 +13,21 @@ jobs:
     steps:
       - uses: actions/checkout@v4
 
-      - name: Login to Gitea Registry
+      - name: Build and publish
-        uses: docker/login-action@v3
-        with:
-          registry: gitea.dsrptlab.com
-          username: ${{ gitea.actor }}
-          password: ${{ secrets.REGISTRY_TOKEN }}
-
-      - name: Build and push
         run: |
+          set -euo pipefail
           docker build -t "$IMAGE:latest" -t "$IMAGE:${{ gitea.sha }}" .
           docker push "$IMAGE:latest"
           docker push "$IMAGE:${{ gitea.sha }}"
-          docker image rm -f "$IMAGE:latest" "$IMAGE:${{ gitea.sha }}"
 
-      - name: Deploy to Dokploy
+      - name: Remove local image tags
-        run: curl -fsS -X POST "https://ind.dsrptlab.com/api/deploy/2Y2RjGRTm4HIkcO2UmyHL"
+        run: docker image rm -f "$IMAGE:latest" "$IMAGE:${{ gitea.sha }}"
+
+      - name: Deploy in Dokploy
+        env:
+          DOKPLOY_DEPLOY_WEBHOOK: ${{ secrets.DOKPLOY_DEPLOY_WEBHOOK }}
+        run: |
+          set -euo pipefail
+          test -n "$DOKPLOY_DEPLOY_WEBHOOK"
+          curl -fsS -X POST "$DOKPLOY_DEPLOY_WEBHOOK"
+

Dockerfile

@@ -7,12 +7,13 @@ RUN npm ci
 
 FROM deps AS builder
 
+COPY prisma.config.ts ./
 COPY prisma ./prisma
-RUN npx prisma generate
+RUN TEAMS_DATABASE_URL=postgresql://postgres:postgres@localhost:5432/postgres npx prisma generate
 
 COPY tsconfig.json ./
 COPY src ./src
-RUN npm run build
+RUN TEAMS_DATABASE_URL=postgresql://postgres:postgres@localhost:5432/postgres npm run build
 
 FROM deps AS runtime-deps
 
@@ -28,9 +29,10 @@ COPY --from=runtime-deps /app/node_modules ./node_modules
 COPY --from=builder /app/node_modules/.prisma ./node_modules/.prisma
 COPY --from=builder /app/node_modules/@prisma/client ./node_modules/@prisma/client
 COPY --from=builder /app/dist ./dist
+COPY prisma.config.ts ./
 COPY prisma ./prisma
 COPY scripts ./scripts
 
 EXPOSE 8000
 
-CMD ["sh", "-c", ". /app/scripts/load-vault-env.sh && set +e && npx prisma migrate resolve --applied 0_init 2>/dev/null; set -e && npx prisma migrate deploy && node dist/index.js"]
+CMD ["sh", "-c", ". /app/scripts/load-vault-env.sh && npx prisma migrate deploy && node dist/index.js"]

package.json

@@ -6,22 +6,26 @@
   "scripts": {
     "dev": "tsx watch src/index.ts",
     "build": "prisma generate && tsc",
-    "start": "prisma migrate deploy && node dist/index.js"
+    "start": "prisma migrate deploy && node dist/index.js",
+    "seed:demo": "tsx scripts/seed-demo.ts"
   },
   "dependencies": {
     "@fastify/cors": "^11.2.0",
-    "@prisma/client": "^6.5.0",
+    "@prisma/adapter-pg": "^7.8.0",
-    "@sentry/node": "^9.5.0",
+    "@prisma/client": "^7.8.0",
+    "@sentry/node": "^10.56.0",
     "fastify": "^5.8.5",
-    "graphql": "^16.10.0",
+    "graphql": "^16.14.1",
     "graphql-tag": "^2.12.6",
-    "jose": "^6.0.11",
+    "jose": "^6.2.3",
-    "mercurius": "^16.9.0"
+    "mercurius": "^16.9.0",
+    "pg": "^8.21.0",
+    "tsx": "^4.22.4"
   },
   "devDependencies": {
-    "@types/node": "^22.13.0",
+    "@types/node": "^25.9.2",
-    "prisma": "^6.5.0",
+    "@types/pg": "^8.20.0",
-    "tsx": "^4.19.0",
+    "prisma": "^7.8.0",
-    "typescript": "^5.7.0"
+    "typescript": "^6.0.3"
   }
 }

prisma.config.ts

@@ -0,0 +1,12 @@
+import 'dotenv/config'
+import { defineConfig, env } from 'prisma/config'
+
+export default defineConfig({
+  schema: 'prisma/schema.prisma',
+  migrations: {
+    path: 'prisma/migrations',
+  },
+  datasource: {
+    url: env('TEAMS_DATABASE_URL'),
+  },
+})

prisma/schema.prisma

@@ -4,7 +4,6 @@ generator client {
 
 datasource db {
   provider = "postgresql"
-  url      = env("TEAMS_DATABASE_URL")
 }
 
 model Team {

scripts/seed-demo.ts

@@ -0,0 +1,137 @@
+import { prisma } from '../dist/db.js'
+
+const DEMO_TEAM_UUID = process.env.DEMO_TEAM_UUID ?? '11111111-1111-4111-8111-111111111111'
+const DEMO_TEAM_NAME = process.env.DEMO_TEAM_NAME ?? 'Optovia Demo Client'
+const DEMO_ADDRESS_COUNT = Number(process.env.DEMO_ADDRESS_COUNT ?? '3')
+
+function requiredEnv(name: string): string {
+  const value = process.env[name]?.trim()
+  if (!value) throw new Error(`${name} is required`)
+  return value
+}
+
+function demoAddress(index: number) {
+  const row = Math.floor(index / 60)
+  const col = index % 60
+  const latitude = 43.238949 + row * 0.018 + (col % 5) * 0.002
+  const longitude = 76.889709 + col * 0.021 + (row % 5) * 0.002
+
+  return {
+    uuid: `11111111-2222-4${String(index).padStart(3, '0').slice(-3)}-8${String(index).padStart(3, '0').slice(-3)}-111111${String(index).padStart(6, '0')}`,
+    name: `Demo address ${index + 1}`,
+    address: `Warehouse ${index + 1}, Almaty logistics area`,
+    latitude,
+    longitude,
+    countryCode: 'KZ',
+    isDefault: index === 0,
+    status: 'processed',
+    processedAt: new Date(),
+  }
+}
+
+const logtoId = requiredEnv('DEMO_LOGTO_USER_ID')
+const email = process.env.DEMO_USER_EMAIL ?? 'demo@optovia.ru'
+const phone = process.env.DEMO_USER_PHONE ?? '+79990000000'
+const firstName = process.env.DEMO_USER_FIRST_NAME ?? 'Demo'
+const lastName = process.env.DEMO_USER_LAST_NAME ?? 'Client'
+
+let profile = await prisma.userProfile.findUnique({
+  where: { logtoId },
+  include: { user: true },
+})
+
+if (profile === null) {
+  const user = await prisma.user.upsert({
+    where: { username: logtoId },
+    create: { username: logtoId, firstName, lastName, email },
+    update: { firstName, lastName, email, isActive: true },
+  })
+  profile = await prisma.userProfile.create({
+    data: { userId: user.id, logtoId, phone, avatarId: 'demo-client' },
+    include: { user: true },
+  })
+} else {
+  await prisma.user.update({
+    where: { id: profile.userId },
+    data: { firstName, lastName, email, isActive: true },
+  })
+  profile = await prisma.userProfile.update({
+    where: { id: profile.id },
+    data: { phone, avatarId: 'demo-client' },
+    include: { user: true },
+  })
+}
+
+const team = await prisma.team.upsert({
+  where: { uuid: DEMO_TEAM_UUID },
+  create: {
+    uuid: DEMO_TEAM_UUID,
+    name: DEMO_TEAM_NAME,
+    teamType: 'BUYER',
+    ownerId: profile.userId,
+    selectedLocationType: 'ADDRESS',
+    selectedLocationUuid: '11111111-2222-4000-8000-111111000000',
+    selectedLocationName: 'Demo address 1',
+    selectedLocationLat: 43.238949,
+    selectedLocationLon: 76.889709,
+  },
+  update: {
+    name: DEMO_TEAM_NAME,
+    teamType: 'BUYER',
+    ownerId: profile.userId,
+    selectedLocationType: 'ADDRESS',
+    selectedLocationUuid: '11111111-2222-4000-8000-111111000000',
+    selectedLocationName: 'Demo address 1',
+    selectedLocationLat: 43.238949,
+    selectedLocationLon: 76.889709,
+  },
+})
+
+await prisma.teamMember.upsert({
+  where: {
+    teamId_userId: {
+      teamId: team.id,
+      userId: profile.userId,
+    },
+  },
+  create: { teamId: team.id, userId: profile.userId, role: 'OWNER' },
+  update: { role: 'OWNER' },
+})
+
+await prisma.userProfile.update({
+  where: { id: profile.id },
+  data: { activeTeamId: team.id },
+})
+
+const addresses = Array.from({ length: DEMO_ADDRESS_COUNT }, (_, index) => ({
+  ...demoAddress(index),
+  teamId: team.id,
+}))
+const addressUuids = addresses.map((address) => address.uuid)
+
+await prisma.teamAddress.deleteMany({
+  where: {
+    teamId: team.id,
+    name: { startsWith: 'Demo address ' },
+    uuid: { notIn: addressUuids },
+  },
+})
+
+await prisma.teamAddress.createMany({
+  data: addresses,
+  skipDuplicates: true,
+})
+
+await prisma.teamAddress.updateMany({
+  where: { teamId: team.id },
+  data: { isDefault: false },
+})
+
+await prisma.teamAddress.update({
+  where: { uuid: '11111111-2222-4000-8000-111111000000' },
+  data: { isDefault: true },
+})
+
+console.log(`Seeded teams demo data for ${logtoId}: team ${DEMO_TEAM_UUID}, addresses ${DEMO_ADDRESS_COUNT}`)
+
+await prisma.$disconnect()

src/auth.ts

@@ -50,6 +50,12 @@ function scopesFromPayload(payload: JWTPayload): string[] {
   return [];
 }
 
+function clientScopes(payload: JWTPayload): string[] {
+  return [
+    ...new Set([...scopesFromPayload(payload), "teams:user", "teams:member"]),
+  ];
+}
+
 export async function publicContext(): Promise<AuthContext> {
   return { scopes: [] };
 }
@@ -72,7 +78,7 @@ function teamClaims(payload: JWTPayload): Pick<
   "teamUuid" | "teamName" | "teamType" | "logtoOrgId"
 > {
   return {
-    teamUuid: claimString(payload, "team_uuid"),
+    teamUuid: claimString(payload, "team_uuid") ?? payload.sub,
     teamName:
       claimString(payload, "team_name") ??
       claimString(payload, "organization_name") ??
@@ -97,10 +103,18 @@ function hasManagerClaim(payload: JWTPayload): boolean {
 export async function userContext(req: FastifyRequest): Promise<AuthContext> {
   const token = optionalBearerToken(req);
   if (token === null) return { scopes: [] };
-  const { payload } = await jwtVerify(token, jwks, { issuer: LOGTO_ISSUER });
+  const { payload } = await jwtVerify(token, jwks, {
+    issuer: LOGTO_ISSUER,
+    audience: LOGTO_TEAMS_AUDIENCE,
+  });
+  if (!payload.sub) {
+    throw new GraphQLError("User subject is required", {
+      extensions: { code: "UNAUTHENTICATED" },
+    });
+  }
   return {
     userId: payload.sub,
-    scopes: scopesFromPayload(payload),
+    scopes: clientScopes(payload),
     ...teamClaims(payload),
   };
 }
@@ -132,8 +146,8 @@ export async function teamContext(req: FastifyRequest): Promise<AuthContext> {
     audience: LOGTO_TEAMS_AUDIENCE,
   });
   const claims = teamClaims(payload);
-  const scopes = scopesFromPayload(payload);
+  const scopes = clientScopes(payload);
-  if (!claims.teamUuid || !scopes.includes("teams:member"))
+  if (!payload.sub || !claims.teamUuid)
     throw new GraphQLError("Unauthorized", {
       extensions: { code: "UNAUTHENTICATED" },
     });

src/db.ts

@@ -1,3 +1,11 @@
 import { PrismaClient } from '@prisma/client'
+import { PrismaPg } from '@prisma/adapter-pg'
 
-export const prisma = new PrismaClient()
+const connectionString = process.env.TEAMS_DATABASE_URL
+if (!connectionString) {
+  throw new Error('TEAMS_DATABASE_URL is required')
+}
+
+const adapter = new PrismaPg({ connectionString })
+
+export const prisma = new PrismaClient({ adapter })