From 53f2b49049f4af39494b7ecade116d0f835c13b8 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?=E2=80=9CNaeel=E2=80=9D?= <tazet@narod.ru>
Date: Fri, 12 Jun 2026 16:41:39 +0400
Subject: [PATCH] =?UTF-8?q?v2:=20=D1=83=D0=B1=D1=80=D0=B0=D0=BD=20JWT=20fa?=
 =?UTF-8?q?llback=20=E2=80=94=20IAM=20=D0=BE=D0=B1=D1=8F=D0=B7=D0=B0=D1=82?=
 =?UTF-8?q?=D0=B5=D0=BB=D0=B5=D0=BD,=20=D0=BD=D0=B5=D1=82=20IAM=20=3D=20?=
 =?UTF-8?q?=D0=BE=D1=88=D0=B8=D0=B1=D0=BA=D0=B0?=
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

---
 package.json         |  2 +-
 v2/src/auth/index.js | 77 ++++++++++++--------------------------------
 2 files changed, 21 insertions(+), 58 deletions(-)

diff --git a/package.json b/package.json
index a5b44a1..f6a01b8 100644
--- a/package.json
+++ b/package.json
@@ -1,6 +1,6 @@
 {
   "name": "ipwhitelist",
-  "version": "0.5.64",
+  "version": "0.5.65",
   "description": "IP WhiteList microservice for cloud provider",
   "main": "server.js",
   "scripts": {
diff --git a/v2/src/auth/index.js b/v2/src/auth/index.js
index 8bf66c8..1aa236c 100644
--- a/v2/src/auth/index.js
+++ b/v2/src/auth/index.js
@@ -2,7 +2,6 @@
 const crypto = require('crypto');
 const https  = require('https');
 const http   = require('http');
-const jwt    = require('jsonwebtoken');
 
 function buildAuthUrl(config) {
   const { baseUrl, clientId, redirectUri, state } = config;
@@ -25,11 +24,7 @@ async function exchangeCode(code, config) {
     client_secret: clientSecret,
     redirect_uri:  redirectUri,
   });
-
-  console.log('[v2:auth] exchangeCode →', tokenUrl);
-  const result = await postForm(tokenUrl, body);
-  console.log('[v2:auth] response keys:', Object.keys(result));
-  return result;
+  return postForm(tokenUrl, body);
 }
 
 function generateState() {
@@ -65,62 +60,30 @@ async function fetchIamUser(token, iamUrl) {
   };
 }
 
-function fallbackSessionUser(accessToken) {
-  const payload = jwt.decode(accessToken);
-  if (!payload) throw new Error('Failed to decode JWT');
-
-  const email = payload.email || payload.preferred_username || '';
-  const name  = payload.name  || payload.preferred_username || email;
-
-  return {
-    email:               email,
-    clientId:            payload.azp || payload.client_id || '',
-    allClientIds:        [payload.azp || ''].filter(Boolean),
-    activeClientId:      payload.azp || '',
-    activeProfileId:     null,
-    companyId:           '',
-    companyName:         payload.azp || '',
-    isAdmin:             false,
-    fio:                 name,
-    profiles:            [],
-    isImpersonated:      false,
-    impersonationType:   null,
-    originalUserEmail:    '',
-    originalUserFullName: '',
-    originalUserCompany:  '',
-  };
-}
-
 async function login(code, oidcConfig, iamUrl) {
   const tokenData = await exchangeCode(code, oidcConfig);
   const accessToken = tokenData.access_token;
   if (!accessToken) throw new Error('No access_token in Keycloak response');
 
-  let sessionUser;
-  try {
-    const iamData = await fetchIamUser(accessToken, iamUrl);
-    sessionUser = {
-      email:               iamData.email,
-      clientId:            iamData.clientId,
-      allClientIds:        iamData.allClientIds,
-      activeClientId:      iamData.clientId,
-      activeProfileId:     iamData.activeProfileId,
-      companyId:           iamData.companyId,
-      companyName:         iamData.companyName,
-      isAdmin:             iamData.isAdmin,
-      fio:                 iamData.fio,
-      profiles:            iamData.profiles,
-      isImpersonated:      iamData.isImpersonated,
-      impersonationType:   iamData.impersonationType,
-      originalUserEmail:    iamData.originalUserEmail,
-      originalUserFullName: iamData.originalUserFullName,
-      originalUserCompany:  iamData.originalUserCompany,
-    };
-    console.log('[v2:auth] IAM OK:', iamData.email, iamData.clientId);
-  } catch (iamErr) {
-    console.log('[v2:auth] IAM unavailable, using JWT fallback:', iamErr.message);
-    sessionUser = fallbackSessionUser(accessToken);
-  }
+  const iamData = await fetchIamUser(accessToken, iamUrl);
+
+  const sessionUser = {
+    email:               iamData.email,
+    clientId:            iamData.clientId,
+    allClientIds:        iamData.allClientIds,
+    activeClientId:      iamData.clientId,
+    activeProfileId:     iamData.activeProfileId,
+    companyId:           iamData.companyId,
+    companyName:         iamData.companyName,
+    isAdmin:             iamData.isAdmin,
+    fio:                 iamData.fio,
+    profiles:            iamData.profiles,
+    isImpersonated:      iamData.isImpersonated,
+    impersonationType:   iamData.impersonationType,
+    originalUserEmail:    iamData.originalUserEmail,
+    originalUserFullName: iamData.originalUserFullName,
+    originalUserCompany:  iamData.originalUserCompany,
+  };
 
   return { sessionUser, token: accessToken, idToken: tokenData.id_token || null };
 }