v2: убран JWT fallback — IAM обязателен, нет IAM = ошибка

package.json

@@ -1,6 +1,6 @@
 {
   "name": "ipwhitelist",
-  "version": "0.5.64",
+  "version": "0.5.65",
   "description": "IP WhiteList microservice for cloud provider",
   "main": "server.js",
   "scripts": {

v2/src/auth/index.js

@@ -2,7 +2,6 @@
 const crypto = require('crypto');
 const https  = require('https');
 const http   = require('http');
-const jwt    = require('jsonwebtoken');
 
 function buildAuthUrl(config) {
   const { baseUrl, clientId, redirectUri, state } = config;
@@ -25,11 +24,7 @@ async function exchangeCode(code, config) {
     client_secret: clientSecret,
     redirect_uri:  redirectUri,
   });
-
+  return postForm(tokenUrl, body);
-  console.log('[v2:auth] exchangeCode →', tokenUrl);
-  const result = await postForm(tokenUrl, body);
-  console.log('[v2:auth] response keys:', Object.keys(result));
-  return result;
 }
 
 function generateState() {
@@ -65,62 +60,30 @@ async function fetchIamUser(token, iamUrl) {
   };
 }
 
-function fallbackSessionUser(accessToken) {
-  const payload = jwt.decode(accessToken);
-  if (!payload) throw new Error('Failed to decode JWT');
-
-  const email = payload.email || payload.preferred_username || '';
-  const name  = payload.name  || payload.preferred_username || email;
-
-  return {
-    email:               email,
-    clientId:            payload.azp || payload.client_id || '',
-    allClientIds:        [payload.azp || ''].filter(Boolean),
-    activeClientId:      payload.azp || '',
-    activeProfileId:     null,
-    companyId:           '',
-    companyName:         payload.azp || '',
-    isAdmin:             false,
-    fio:                 name,
-    profiles:            [],
-    isImpersonated:      false,
-    impersonationType:   null,
-    originalUserEmail:    '',
-    originalUserFullName: '',
-    originalUserCompany:  '',
-  };
-}
-
 async function login(code, oidcConfig, iamUrl) {
   const tokenData = await exchangeCode(code, oidcConfig);
   const accessToken = tokenData.access_token;
   if (!accessToken) throw new Error('No access_token in Keycloak response');
 
-  let sessionUser;
+  const iamData = await fetchIamUser(accessToken, iamUrl);
-  try {
+
-    const iamData = await fetchIamUser(accessToken, iamUrl);
+  const sessionUser = {
-    sessionUser = {
+    email:               iamData.email,
-      email:               iamData.email,
+    clientId:            iamData.clientId,
-      clientId:            iamData.clientId,
+    allClientIds:        iamData.allClientIds,
-      allClientIds:        iamData.allClientIds,
+    activeClientId:      iamData.clientId,
-      activeClientId:      iamData.clientId,
+    activeProfileId:     iamData.activeProfileId,
-      activeProfileId:     iamData.activeProfileId,
+    companyId:           iamData.companyId,
-      companyId:           iamData.companyId,
+    companyName:         iamData.companyName,
-      companyName:         iamData.companyName,
+    isAdmin:             iamData.isAdmin,
-      isAdmin:             iamData.isAdmin,
+    fio:                 iamData.fio,
-      fio:                 iamData.fio,
+    profiles:            iamData.profiles,
-      profiles:            iamData.profiles,
+    isImpersonated:      iamData.isImpersonated,
-      isImpersonated:      iamData.isImpersonated,
+    impersonationType:   iamData.impersonationType,
-      impersonationType:   iamData.impersonationType,
+    originalUserEmail:    iamData.originalUserEmail,
-      originalUserEmail:    iamData.originalUserEmail,
+    originalUserFullName: iamData.originalUserFullName,
-      originalUserFullName: iamData.originalUserFullName,
+    originalUserCompany:  iamData.originalUserCompany,
-      originalUserCompany:  iamData.originalUserCompany,
+  };
-    };
-    console.log('[v2:auth] IAM OK:', iamData.email, iamData.clientId);
-  } catch (iamErr) {
-    console.log('[v2:auth] IAM unavailable, using JWT fallback:', iamErr.message);
-    sessionUser = fallbackSessionUser(accessToken);
-  }
 
   return { sessionUser, token: accessToken, idToken: tokenData.id_token || null };
 }