backend

backend/src/routes/auth.rs

@@ -186,15 +186,19 @@ pub async fn select_tenant(
     TypedHeader(Authorization(bearer)): TypedHeader<Authorization<Bearer>>,
     Json(payload): Json<TenantSelectionRequest>,
 ) -> AppResult<Response> {
-    let claims = state
-        .jwt
-        .verify_tenant_selector_token(bearer.token())
-        .map_err(|_| AppError::unauthorized())?;
+    let user_id = match state.jwt.verify_tenant_selector_token(bearer.token()) {
+        Ok(claims) => claims.sub,
+        Err(_) => state
+            .jwt
+            .verify_token(bearer.token())
+            .map(|claims| claims.sub)
+            .map_err(|_| AppError::unauthorized())?,
+    };
 
     let mut conn = state.db_unscoped()?;
 
     let membership_exists = memberships_dsl::user_memberships
-        .filter(memberships_dsl::user_id.eq(claims.sub))
+        .filter(memberships_dsl::user_id.eq(user_id))
         .filter(memberships_dsl::tenant_id.eq(payload.tenant_id))
         .inner_join(tenant_dsl::tenants)
         .select(memberships_dsl::id)
@@ -206,7 +210,7 @@ pub async fn select_tenant(
     }
 
     let user: User = dsl::users
-        .find(claims.sub)
+        .find(user_id)
         .first(&mut conn)
         .map_err(AppError::from)?;