From a1fa0c652de1a6e2e482d0c9b6996120e78a940c Mon Sep 17 00:00:00 2001
From: Daniel Hougaard <62331820+DanielHougaard@users.noreply.github.com>
Date: Sat, 9 Mar 2024 08:56:43 +0100
Subject: [PATCH] Feat: Org Scoped JWT Tokens

---
 backend/src/server/plugins/auth/verify-auth.ts | 9 ++++++++-
 1 file changed, 8 insertions(+), 1 deletion(-)

diff --git a/backend/src/server/plugins/auth/verify-auth.ts b/backend/src/server/plugins/auth/verify-auth.ts
index a1274f356..db9700867 100644
--- a/backend/src/server/plugins/auth/verify-auth.ts
+++ b/backend/src/server/plugins/auth/verify-auth.ts
@@ -4,7 +4,7 @@ import { UnauthorizedError } from "@app/lib/errors";
 import { AuthMode } from "@app/services/auth/auth-type";
 
 export const verifyAuth =
-  <T extends FastifyRequest>(authStrats: AuthMode[]) =>
+  <T extends FastifyRequest>(authStrats: AuthMode[], options: { requireOrg: boolean } = { requireOrg: true }) =>
   (req: T, _res: FastifyReply, done: HookHandlerDoneFunction) => {
     if (!Array.isArray(authStrats)) throw new Error("Auth strategy must be array");
     if (!req.auth) throw new UnauthorizedError({ name: "Unauthorized access", message: "Token missing" });
@@ -13,5 +13,12 @@ export const verifyAuth =
     if (!isAccessAllowed) {
       throw new UnauthorizedError({ name: `${req.url} Unauthorized Access` });
     }
+
+    // New optional option. There are some routes which do not require an organization ID to be present on the request.
+    // En example of this is the /v1 auth routes.
+    if (options.requireOrg === true && !req.permission.orgId) {
+      throw new UnauthorizedError({ name: `${req.url} Unauthorized Access, no organization found` });
+    }
+
     done();
   };