@appconda/nextjs 1.0.160 → 1.1.2

package/src/client.ts

@@ -291,7 +291,7 @@ class Client {
         }
 
         let start = 0;
-        let response = null;
+        let response: any = null;
 
         while (start < file.size) {
             let end = start + Client.CHUNK_SIZE; // Prepare end for the next chunk

package/src/getAppcondaClient.ts

@@ -1,4 +1,5 @@
 import { Client } from "./client";
+import { getEnv } from "./lib/env";
 
 function getPortAndHostname(urlString: string): { hostname: string; port: string; protocol: string } {
     try {
@@ -17,8 +18,8 @@ function getPortAndHostname(urlString: string): { hostname: string; port: string
 export async function getAppcondaClient() {
 
     let url;
-    if (process.env.NEXT_PUBLIC_APPCONDA_CLIENT_ENDPOINT) {
-        url = process.env.NEXT_PUBLIC_APPCONDA_CLIENT_ENDPOINT;
+    if (getEnv().APPCONDA_ENDPOINT) {
+        url = getEnv().APPCONDA_ENDPOINT;
     } else if (typeof window !== 'undefined') {
         const hostInfo = getPortAndHostname(window.location.href);
         if (hostInfo.port) {
@@ -27,7 +28,7 @@ export async function getAppcondaClient() {
             url = `${hostInfo.protocol}//${hostInfo.hostname}/v1`
         }
     } else {
-        url = 'http://appconda/v1'
+        url = getEnv().APPCONDA_ENDPOINT || 'http://appconda/v1'
     }
 
     /*  if (ApplicationConfig.Port == null) {

package/src/getSDKForCurrentUser.ts

@@ -9,7 +9,6 @@ import { Roles } from "./services/roles";
 import { Schemas } from "./services/schema";
 import { Subscription } from "./services/subscription";
 import { Teams } from "./services/teams";
-import { Tenant } from "./services/tenant";
 import { TenantSubscription } from "./services/tenant-subscription";
 import { Users } from "./services/users";
 import { Permissions } from "./services/permissions";
@@ -18,6 +17,10 @@ import { Account } from "./modules/account/service";
 import { Node } from "./modules/ai/node/service";
 import { AgentService } from "./modules/agent/service";
 import { ChatFlow } from "./services/chat-flow";
+import { TenantService } from "./modules";
+import { Acl } from "./modules/acl/service";
+import { TaskService } from "./modules/task/service";
+import { ScheduledJobService } from "./modules/scheduled-job";
 
 export async function getSDKForCurrentUser() {
     const adminClient = await getAppcondaClient();
@@ -40,7 +43,7 @@ export async function getSDKForCurrentUser() {
     const users = new Users(adminClient);
     const teams = new Teams(adminClient);
 
-    const tenants = new Tenant(adminClient);
+    const tenants = new TenantService(adminClient);
     const roles = new Roles(adminClient);
     const permissions = new Permissions(adminClient);
     const schemas = new Schemas(adminClient);
@@ -52,12 +55,14 @@ export async function getSDKForCurrentUser() {
     const subscription = new Subscription(adminClient);
     const pricing = new Pricing(adminClient);
     const configuration = new Configuration(adminClient);
-    //const acl = new Acl(adminClient);
+    const acl = new Acl(adminClient);
 
     const node = new Node(adminClient);
     const waitlist = new WaitlistService(adminClient);
     const agent = new AgentService(adminClient);
     const chatFlow = new ChatFlow(adminClient);
+    const task = new TaskService(adminClient);
+    const scheduledJob = new ScheduledJobService(adminClient);
 
     return {
         currentUser,
@@ -75,10 +80,12 @@ export async function getSDKForCurrentUser() {
         subscription,
         pricing,
         configuration,
-       // acl,
+        acl,
         node,
         waitlist,
         agent,
-        chatFlow
+        chatFlow,
+        task,
+        scheduledJob
     }
 }

package/src/getSDKForService.ts

@@ -1,11 +1,12 @@
 import { getAppcondaClient } from "./getAppcondaClient";
+import { getEnv } from "./lib/env";
 import { WaitlistService } from "./modules";
 import { Configuration } from "./services/configuration";
 
 export async function getSDKForService() {
     const adminClient = await getAppcondaClient();
 
-    adminClient.addHeader('x-service-token', process.env._SERVICE_TOKEN ?? '');
+    adminClient.addHeader('x-service-token', getEnv()._SERVICE_TOKEN ?? '');
 /* 
     const accounts = new Account(adminClient);
     const databases = new Databases(adminClient);

package/src/getSDKForTenant.ts

@@ -0,0 +1,52 @@
+import { cookies } from "next/headers";
+import { getAppcondaClient } from "./getAppcondaClient";
+import { Account, TenantService } from "./modules";
+import { Databases } from "./services/databases";
+import { Projects } from "./services/projects";
+import { Roles } from "./services/roles";
+import { Schemas } from "./services/schema";
+import { Teams } from "./services/teams";
+import { Users } from "./services/users";
+import { Permissions } from "./services/permissions";
+
+export async function getSDKForTenant(tenantId: string) {
+    const adminClient = await getAppcondaClient();
+    adminClient.setProject(tenantId);
+    adminClient.setMode('admin');
+
+    const c = await cookies()
+    const s = c.get('a_session') || c.get('a_session_console_legacy');
+    if (!s || !s.value) {
+        throw new Error("No session");
+    }
+
+    adminClient.setSession(s.value);
+
+    const accounts = new Account(adminClient);
+    const databases = new Databases(adminClient);
+
+    const projects = new Projects(adminClient);
+
+    const currentUser = await accounts.get();
+
+    const users = new Users(adminClient);
+    const teams = new Teams(adminClient);
+
+    const tenants = new TenantService(adminClient);
+    const roles = new Roles(adminClient);
+    const permissions = new Permissions(adminClient);
+    const schemas = new Schemas(adminClient);
+
+    return {
+        currentUser,
+        accounts,
+        databases,
+        projects,
+        users,
+        teams,
+        tenants,
+        roles,
+        permissions,
+        schemas
+    }
+}

package/src/index.ts

@@ -36,7 +36,9 @@ export { PasswordHash } from './enums/password-hash';
 export { MessagingProviderType } from './enums/messaging-provider-type';
 export { getSDKForCurrentUser } from './getSDKForCurrentUser';
 export { getSDKForService } from './getSDKForService';
+export { getAppcondaClient } from './getAppcondaClient';
+export { getSDKForTenant } from './getSDKForTenant';
 export * from './modules';
 export type { SafeActionFn } from 'next-safe-action'; 
-
-export  { getAppcondaClient } from './getAppcondaClient'; 
+export * from './actions';
+export * from './lib';

package/src/lib/crypto.ts

@@ -0,0 +1,105 @@
+import crypto from "crypto";
+import { createCipheriv, createDecipheriv, createHash, createHmac, randomBytes } from "crypto";
+import { getEnv } from "./env";
+
+
+const ALGORITHM = "aes256";
+const INPUT_ENCODING = "utf8";
+const OUTPUT_ENCODING = "hex";
+
+const IV_LENGTH = 16; // AES blocksize
+
+/**
+ *
+ * @param text Value to be encrypted
+ * @param key Key used to encrypt value must be 32 bytes for AES256 encryption algorithm
+ *
+ * @returns Encrypted value using key
+ */
+export const symmetricEncrypt = (text: string, key: string) => {
+  const BUFFER_ENCODING = getEnv().ENCRYPTION_KEY!.length === 32 ? "latin1" : "hex";
+  const _key = Buffer.from(key, BUFFER_ENCODING);
+  const iv = crypto.randomBytes(IV_LENGTH);
+
+  // @ts-ignore -- the package needs to be built
+  const cipher = crypto.createCipheriv(ALGORITHM, _key, iv);
+  let ciphered = cipher.update(text, INPUT_ENCODING, OUTPUT_ENCODING);
+  ciphered += cipher.final(OUTPUT_ENCODING);
+  const ciphertext = iv.toString(OUTPUT_ENCODING) + ":" + ciphered;
+
+  return ciphertext;
+};
+
+/**
+ *
+ * @param text Value to decrypt
+ * @param key Key used to decrypt value must be 32 bytes for AES256 encryption algorithm
+ */
+export const symmetricDecrypt = (text: string, key: string) => {
+  const BUFFER_ENCODING = getEnv().ENCRYPTION_KEY!.length === 32 ? "latin1" : "hex";
+  const _key = Buffer.from(key, BUFFER_ENCODING);
+
+  const components = text.split(":");
+  const iv_from_ciphertext = Buffer.from(components.shift() || "", OUTPUT_ENCODING);
+  // @ts-ignore -- the package needs to be built
+  const decipher = crypto.createDecipheriv(ALGORITHM, _key, iv_from_ciphertext);
+  let deciphered = decipher.update(components.join(":"), OUTPUT_ENCODING, INPUT_ENCODING);
+  deciphered += decipher.final(INPUT_ENCODING);
+
+  return deciphered;
+};
+
+export const getHash = (key: string): string => createHash("sha256").update(key).digest("hex");
+
+// create an aes128 encryption function
+export const encryptAES128 = (encryptionKey: string, data: string): string => {
+  // @ts-ignore -- the package needs to be built
+  const cipher = createCipheriv("aes-128-ecb", Buffer.from(encryptionKey, "base64"), "");
+  let encrypted = cipher.update(data, "utf-8", "hex");
+  encrypted += cipher.final("hex");
+  return encrypted;
+};
+// create an aes128 decryption function
+export const decryptAES128 = (encryptionKey: string, data: string): string => {
+  // @ts-ignore -- the package needs to be built
+  const cipher = createDecipheriv("aes-128-ecb", Buffer.from(encryptionKey, "base64"), "");
+  let decrypted = cipher.update(data, "hex", "utf-8");
+  decrypted += cipher.final("utf-8");
+  return decrypted;
+};
+
+export const generateLocalSignedUrl = (
+  fileName: string,
+  environmentId: string,
+  fileType: string
+): { signature: string; uuid: string; timestamp: number } => {
+  const uuid = randomBytes(16).toString("hex");
+  const timestamp = Date.now();
+  const data = `${uuid}:${fileName}:${environmentId}:${fileType}:${timestamp}`;
+  const signature = createHmac("sha256", getEnv().ENCRYPTION_KEY!).update(data).digest("hex");
+  return { signature, uuid, timestamp };
+};
+
+export const validateLocalSignedUrl = (
+  uuid: string,
+  fileName: string,
+  environmentId: string,
+  fileType: string,
+  timestamp: number,
+  signature: string,
+  secret: string
+): boolean => {
+  const data = `${uuid}:${fileName}:${environmentId}:${fileType}:${timestamp}`;
+  const expectedSignature = createHmac("sha256", secret).update(data).digest("hex");
+
+  if (expectedSignature !== signature) {
+    return false;
+  }
+
+  // valid for 5 minutes
+  if (Date.now() - timestamp > 1000 * 60 * 5) {
+    return false;
+  }
+
+  return true;
+};

package/src/lib/env.ts

@@ -0,0 +1,145 @@
+import { createEnv } from "@t3-oss/env-nextjs";
+import { z } from "zod";
+
+
+export const getEnv = (() => {
+    let env: any = null;
+    return () => {
+        if (env == null) {
+            env = createEnv({
+                /*
+                 * Serverside Environment variables, not available on the client.
+                 * Will throw if you access these variables on the client.
+                 */
+                server: {
+                    APPCONDA_ENDPOINT: z.string(),
+                    APPCONDA_CLIENT_ENDPOINT: z.string(),
+                    _SERVICE_TOKEN: z.string(),
+                    ENTERPRISE_LICENSE_KEY: z.string(),
+                    NEXTAUTH_SECRET: z.string().min(1),
+                    ENCRYPTION_KEY: z.string().length(64).or(z.string().length(32)),
+                    CRON_SECRET: z.string().min(10),
+                    _ADMIN_DOMAIN: z.string().optional(),
+                    /* AI_AZURE_LLM_API_KEY: z.string().optional(),
+                    AI_AZURE_EMBEDDINGS_DEPLOYMENT_ID: z.string().optional(),
+                    AI_AZURE_LLM_DEPLOYMENT_ID: z.string().optional(),
+                    AI_AZURE_EMBEDDINGS_RESSOURCE_NAME: z.string().optional(),
+                    AI_AZURE_LLM_RESSOURCE_NAME: z.string().optional(),
+                    AIRTABLE_CLIENT_ID: z.string().optional(),
+                    AZUREAD_CLIENT_ID: z.string().optional(),
+                    AZUREAD_CLIENT_SECRET: z.string().optional(),
+                    AZUREAD_TENANT_ID: z.string().optional(),
+                    CRON_SECRET: z.string().min(10),
+                    CUSTOMER_IO_API_KEY: z.string().optional(),
+                    CUSTOMER_IO_SITE_ID: z.string().optional(),
+                    DATABASE_URL: z.string().url(),
+                    DEBUG: z.enum(["1", "0"]).optional(),
+                    DEFAULT_ORGANIZATION_ID: z.string().optional(),
+                    DEFAULT_ORGANIZATION_ROLE: z.enum(["owner", "manager", "member", "billing"]).optional(),
+                    E2E_TESTING: z.enum(["1", "0"]).optional(),
+                    EMAIL_AUTH_DISABLED: z.enum(["1", "0"]).optional(),
+                    EMAIL_VERIFICATION_DISABLED: z.enum(["1", "0"]).optional(),
+                   
+                    ENTERPRISE_LICENSE_KEY: z.string().optional(),
+                    FORMBRICKS_ENCRYPTION_KEY: z.string().length(24).or(z.string().length(0)).optional(),
+                    GITHUB_ID: z.string().optional(),
+                    GITHUB_SECRET: z.string().optional(),
+                    GOOGLE_CLIENT_ID: z.string().optional(),
+                    GOOGLE_CLIENT_SECRET: z.string().optional(),
+                    GOOGLE_SHEETS_CLIENT_ID: z.string().optional(),
+                    GOOGLE_SHEETS_CLIENT_SECRET: z.string().optional(),
+                    GOOGLE_SHEETS_REDIRECT_URL: z.string().optional(),
+                    HTTP_PROXY: z.string().url().optional(),
+                    HTTPS_PROXY: z.string().url().optional(),
+                    IMPRINT_URL: z
+                      .string()
+                      .url()
+                      .optional()
+                      .or(z.string().refine((str) => str === "")),
+                    IMPRINT_ADDRESS: z.string().optional(),
+                    INVITE_DISABLED: z.enum(["1", "0"]).optional(),
+                    INTERCOM_SECRET_KEY: z.string().optional(),
+                    IS_FORMBRICKS_CLOUD: z.enum(["1", "0"]).optional(),
+                    MAIL_FROM: z.string().email().optional(),
+                    
+                    NOTION_OAUTH_CLIENT_ID: z.string().optional(),
+                    NOTION_OAUTH_CLIENT_SECRET: z.string().optional(),
+                    OIDC_CLIENT_ID: z.string().optional(),
+                    OIDC_CLIENT_SECRET: z.string().optional(),
+                    OIDC_DISPLAY_NAME: z.string().optional(),
+                    OIDC_ISSUER: z.string().optional(),
+                    OIDC_SIGNING_ALGORITHM: z.string().optional(),
+                    OPENTELEMETRY_LISTENER_URL: z.string().optional(),
+                    REDIS_URL: z.string().optional(),
+                    REDIS_HTTP_URL: z.string().optional(),
+                    PASSWORD_RESET_DISABLED: z.enum(["1", "0"]).optional(),
+                    PRIVACY_URL: z
+                      .string()
+                      .url()
+                      .optional()
+                      .or(z.string().refine((str) => str === "")),
+                    RATE_LIMITING_DISABLED: z.enum(["1", "0"]).optional(),
+                    S3_ACCESS_KEY: z.string().optional(),
+                    S3_BUCKET_NAME: z.string().optional(),
+                    S3_REGION: z.string().optional(),
+                    S3_SECRET_KEY: z.string().optional(),
+                    S3_ENDPOINT_URL: z.string().optional(),
+                    S3_FORCE_PATH_STYLE: z.enum(["1", "0"]).optional(),
+                    SHORT_URL_BASE: z.string().url().optional().or(z.string().length(0)),
+                    SIGNUP_DISABLED: z.enum(["1", "0"]).optional(),
+                    SLACK_CLIENT_ID: z.string().optional(),
+                    SLACK_CLIENT_SECRET: z.string().optional(),
+                    SMTP_HOST: z.string().min(1).optional(),
+                    SMTP_PORT: z.string().min(1).optional(),
+                    SMTP_SECURE_ENABLED: z.enum(["1", "0"]).optional(),
+                    SMTP_USER: z.string().min(1).optional(),
+                    SMTP_PASSWORD: z.string().min(1).optional(),
+                    SMTP_AUTHENTICATED: z.enum(["1", "0"]).optional(),
+                    SMTP_REJECT_UNAUTHORIZED_TLS: z.enum(["1", "0"]).optional(),
+                    STRIPE_SECRET_KEY: z.string().optional(),
+                    STRIPE_WEBHOOK_SECRET: z.string().optional(),
+                    TELEMETRY_DISABLED: z.enum(["1", "0"]).optional(),
+                    TERMS_URL: z
+                      .string()
+                      .url()
+                      .optional()
+                      .or(z.string().refine((str) => str === "")),
+                    TURNSTILE_SECRET_KEY: z.string().optional(),
+                    UPLOADS_DIR: z.string().min(1).optional(),
+                    VERCEL_URL: z.string().optional(),
+                  
+                    ADMIN_URL: z.string().url().optional(),
+                    UNSPLASH_ACCESS_KEY: z.string().optional(),
+                    LANGFUSE_SECRET_KEY: z.string().optional(),
+                    LANGFUSE_PUBLIC_KEY: z.string().optional(),
+                    LANGFUSE_BASEURL: z.string().optional(), */
+                },
+
+                /*
+                 * Due to how Next.js bundles environment variables on Edge and Client,
+                 * we need to manually destructure them to make sure all are included in bundle.
+                 *
+                 * 💡 You'll get type errors if not all variables from `server` & `client` are included here.
+                 */
+                runtimeEnv: {
+                    APPCONDA_ENDPOINT: process.env.APPCONDA_ENDPOINT,
+                    APPCONDA_CLIENT_ENDPOINT: process.env.APPCONDA_CLIENT_ENDPOINT,
+                    _SERVICE_TOKEN: process.env._SERVICE_TOKEN,
+                    ENTERPRISE_LICENSE_KEY: process.env.ENTERPRISE_LICENSE_KEY,
+                    NEXTAUTH_SECRET: process.env.NEXTAUTH_SECRET,
+                    ENCRYPTION_KEY: process.env.ENCRYPTION_KEY,
+                    CRON_SECRET: process.env.CRON_SECRET,
+                    _ADMIN_DOMAIN: process.env._ADMIN_DOMAIN,
+                },
+            });
+            console.log(env);
+        }
+
+        return env;
+
+    };
+})();
+
+
+
+

package/src/lib/errors.ts

@@ -0,0 +1,138 @@
+import { z } from "zod";
+
+class ResourceNotFoundError extends Error {
+  statusCode = 404;
+  resourceId: string | null;
+  resourceType: string;
+
+  constructor(resource: string, id: string | null) {
+    super(id ? `${resource} with ID ${id} not found` : `${resource} not found`);
+    this.name = "ResourceNotFoundError";
+    this.resourceType = resource;
+    this.resourceId = id;
+  }
+}
+
+class InvalidInputError extends Error {
+  statusCode = 400;
+  constructor(message: string) {
+    super(message);
+    this.name = "InvalidInputError";
+  }
+}
+
+class ValidationError extends Error {
+  statusCode = 400;
+  constructor(message: string) {
+    super(message);
+    this.name = "ValidationError";
+  }
+}
+
+class UnknownError extends Error {
+  statusCode = 500;
+  constructor(message: string) {
+    super(message);
+    this.name = "UnknownError";
+  }
+}
+
+class DatabaseError extends Error {
+  statusCode = 500;
+  constructor(message: string) {
+    super(message);
+    this.name = "DatabaseError";
+  }
+}
+
+class UniqueConstraintError extends Error {
+  statusCode = 409;
+  constructor(message: string) {
+    super(message);
+    this.name = "UniqueConstraintError";
+  }
+}
+
+class ForeignKeyConstraintError extends Error {
+  statusCode = 409;
+  constructor(message: string) {
+    super(message);
+    this.name = "ForeignKeyConstraintError";
+  }
+}
+
+class OperationNotAllowedError extends Error {
+  statusCode = 403;
+  constructor(message: string) {
+    super(message);
+    this.name = "OperationNotAllowedError";
+  }
+}
+
+class AuthenticationError extends Error {
+  statusCode = 401;
+  constructor(message: string) {
+    super(message);
+    this.name = "AuthenticationError";
+  }
+}
+
+class AuthorizationError extends Error {
+  statusCode = 403;
+  constructor(message: string) {
+    super(message);
+    this.name = "AuthorizationError";
+  }
+}
+
+interface NetworkError {
+  code: "network_error";
+  message: string;
+  status: number;
+  url: URL;
+  responseMessage?: string;
+  details?: Record<string, string | string[] | number | number[] | boolean | boolean[]>;
+}
+
+interface ForbiddenError {
+  code: "forbidden";
+  message: string;
+  status: number;
+  url: URL;
+  responseMessage?: string;
+  details?: Record<string, string | string[] | number | number[] | boolean | boolean[]>;
+}
+
+export const ZErrorHandler = z.function().args(z.any()).returns(z.void());
+
+export {
+  ResourceNotFoundError,
+  InvalidInputError,
+  ValidationError,
+  DatabaseError,
+  UniqueConstraintError,
+  UnknownError,
+  ForeignKeyConstraintError,
+  OperationNotAllowedError,
+  AuthenticationError,
+  AuthorizationError,
+};
+export type { NetworkError, ForbiddenError };
+
+export interface ApiErrorResponse {
+  code:
+    | "not_found"
+    | "gone"
+    | "bad_request"
+    | "internal_server_error"
+    | "unauthorized"
+    | "method_not_allowed"
+    | "not_authenticated"
+    | "forbidden"
+    | "network_error";
+  message: string;
+  status: number;
+  url: URL;
+  details?: Record<string, string | string[] | number | number[] | boolean | boolean[]>;
+  responseMessage?: string;
+}

package/src/lib/index.ts

@@ -0,0 +1,2 @@
+export * from "./jwt";
+export * from "./env";

package/src/lib/jwt.ts

@@ -0,0 +1,113 @@
+import jwt, { JwtPayload } from "jsonwebtoken";
+import { symmetricDecrypt, symmetricEncrypt } from "./crypto";
+import { getEnv } from "./env";
+
+export const createToken = (userId: string, userEmail: string, options = {}): string => {
+  const encryptedUserId = symmetricEncrypt(userId, getEnv().ENCRYPTION_KEY);
+  return jwt.sign({ id: encryptedUserId }, getEnv().NEXTAUTH_SECRET + userEmail, options);
+};
+export const createTokenForLinkSurvey = (surveyId: string, userEmail: string): string => {
+  const encryptedEmail = symmetricEncrypt(userEmail, getEnv().ENCRYPTION_KEY);
+  return jwt.sign({ email: encryptedEmail }, getEnv().NEXTAUTH_SECRET + surveyId);
+};
+
+export const createEmailToken = (email: string): string => {
+  const encryptedEmail = symmetricEncrypt(email, getEnv().ENCRYPTION_KEY);
+  return jwt.sign({ email: encryptedEmail }, getEnv().NEXTAUTH_SECRET);
+};
+
+export const getEmailFromEmailToken = (token: string): string => {
+  const payload = jwt.verify(token, getEnv().NEXTAUTH_SECRET) as JwtPayload;
+  try {
+    // Try to decrypt first (for newer tokens)
+    const decryptedEmail = symmetricDecrypt(payload.email, getEnv().ENCRYPTION_KEY);
+    return decryptedEmail;
+  } catch {
+    // If decryption fails, return the original email (for older tokens)
+    return payload.email;
+  }
+};
+
+export const createInviteToken = (inviteId: string, email: string, options = {}): string => {
+  const encryptedInviteId = symmetricEncrypt(inviteId, getEnv().ENCRYPTION_KEY);
+  const encryptedEmail = symmetricEncrypt(email, getEnv().ENCRYPTION_KEY);
+  return jwt.sign({ inviteId: encryptedInviteId, email: encryptedEmail }, getEnv().NEXTAUTH_SECRET, options);
+};
+
+export const verifyTokenForLinkSurvey = (token: string, surveyId: string): string | null => {
+  try {
+    const { email } = jwt.verify(token, getEnv().NEXTAUTH_SECRET + surveyId) as JwtPayload;
+    try {
+      // Try to decrypt first (for newer tokens)
+      const decryptedEmail = symmetricDecrypt(email, getEnv().ENCRYPTION_KEY);
+      return decryptedEmail;
+    } catch {
+      // If decryption fails, return the original email (for older tokens)
+      return email;
+    }
+  } catch (err) {
+    return null;
+  }
+};
+
+export const verifyToken = async (token: string): Promise<JwtPayload> => {
+  // First decode to get the ID
+  const decoded = jwt.decode(token);
+  const payload: JwtPayload = decoded as JwtPayload;
+
+  const { id } = payload;
+  if (!id) {
+    throw new Error("Token missing required field: id");
+  }
+
+  // Try to decrypt the ID (for newer tokens), if it fails use the ID as-is (for older tokens)
+  let decryptedId: string;
+  try {
+    decryptedId = symmetricDecrypt(id, getEnv().ENCRYPTION_KEY);
+  } catch {
+    decryptedId = id;
+  }
+
+  // If no email provided, look up the user
+  const foundUser: any = null;/* await prisma.user.findUnique({
+    where: { id: decryptedId },
+  }); */
+
+  if (!foundUser) {
+    throw new Error("User not found");
+  }
+
+  const userEmail = foundUser.email;
+
+  return { id: decryptedId, email: userEmail };
+};
+
+export const verifyInviteToken = (token: string): { inviteId: string; email: string } => {
+  try {
+    const decoded = jwt.decode(token);
+    const payload: JwtPayload = decoded as JwtPayload;
+
+    const { inviteId, email } = payload;
+
+    let decryptedInviteId: string;
+    let decryptedEmail: string;
+
+    try {
+      // Try to decrypt first (for newer tokens)
+      decryptedInviteId = symmetricDecrypt(inviteId, getEnv().ENCRYPTION_KEY);
+      decryptedEmail = symmetricDecrypt(email, getEnv().ENCRYPTION_KEY);
+    } catch {
+      // If decryption fails, use original values (for older tokens)
+      decryptedInviteId = inviteId;
+      decryptedEmail = email;
+    }
+
+    return {
+      inviteId: decryptedInviteId,
+      email: decryptedEmail,
+    };
+  } catch (error) {
+    console.error(`Error verifying invite token: ${error}`);
+    throw new Error("Invalid or expired invite token");
+  }
+};