@geekapps/post-fastify 0.1.0 → 0.1.2

package/dist/plugin.d.ts

@@ -4,8 +4,6 @@ import { type ServiceAccountOptions } from "./service-account.js";
 export interface PostPluginOptions {
     /** Geekapps Post API base URL */
     baseUrl: string;
-    /** Organization ID to use on all requests */
-    organizationId: string;
     /** Service account credentials — required */
     serviceAccount: ServiceAccountOptions;
 }

package/dist/plugin.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"plugin.d.ts","sourceRoot":"","sources":["../src/plugin.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAmB,kBAAkB,EAAE,MAAM,SAAS,CAAC;AAEnE,OAAO,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AACzC,OAAO,EAA+B,KAAK,qBAAqB,EAAE,MAAM,sBAAsB,CAAC;AAE/F,MAAM,WAAW,iBAAiB;IAChC,iCAAiC;IACjC,OAAO,EAAE,MAAM,CAAC;IAChB,6CAA6C;IAC7C,cAAc,EAAE,MAAM,CAAC;IACvB,6CAA6C;IAC7C,cAAc,EAAE,qBAAqB,CAAC;CACvC;AAED,OAAO,QAAQ,SAAS,CAAC;IACvB,UAAU,eAAe;QACvB,UAAU,EAAE,UAAU,CAAC;KACxB;CACF;;AAiBD,wBAGG"}
+{"version":3,"file":"plugin.d.ts","sourceRoot":"","sources":["../src/plugin.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAmB,kBAAkB,EAAE,MAAM,SAAS,CAAC;AAEnE,OAAO,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AACzC,OAAO,EAA+B,KAAK,qBAAqB,EAAE,MAAM,sBAAsB,CAAC;AAE/F,MAAM,WAAW,iBAAiB;IAChC,iCAAiC;IACjC,OAAO,EAAE,MAAM,CAAC;IAChB,6CAA6C;IAC7C,cAAc,EAAE,qBAAqB,CAAC;CACvC;AAED,OAAO,QAAQ,SAAS,CAAC;IACvB,UAAU,eAAe;QACvB,UAAU,EAAE,UAAU,CAAC;KACxB;CACF;;AAiBD,wBAGG"}

package/dist/plugin.js

@@ -6,7 +6,7 @@ const postPlugin = async (fastify, options) => {
     const client = new PostClient({
         baseUrl: options.baseUrl,
         token: () => tokenProvider.getToken(),
-        organizationId: options.organizationId,
+        organizationId: () => tokenProvider.getOrganizationId(),
     });
     fastify.decorate("postClient", client);
 };

package/dist/plugin.js.map

@@ -1 +1 @@
-{"version":3,"file":"plugin.js","sourceRoot":"","sources":["../src/plugin.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,MAAM,gBAAgB,CAAC;AAChC,OAAO,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AACzC,OAAO,EAAE,2BAA2B,EAA8B,MAAM,sBAAsB,CAAC;AAiB/F,MAAM,UAAU,GAA0C,KAAK,EAC7D,OAAwB,EACxB,OAA0B,EAC1B,EAAE;IACF,MAAM,aAAa,GAAG,IAAI,2BAA2B,CAAC,OAAO,CAAC,cAAc,CAAC,CAAC;IAE9E,MAAM,MAAM,GAAG,IAAI,UAAU,CAAC;QAC5B,OAAO,EAAE,OAAO,CAAC,OAAO;QACxB,KAAK,EAAE,GAAG,EAAE,CAAC,aAAa,CAAC,QAAQ,EAAE;QACrC,cAAc,EAAE,OAAO,CAAC,cAAc;KACvC,CAAC,CAAC;IAEH,OAAO,CAAC,QAAQ,CAAC,YAAY,EAAE,MAAM,CAAC,CAAC;AACzC,CAAC,CAAC;AAEF,eAAe,EAAE,CAAC,UAAU,EAAE;IAC5B,OAAO,EAAE,SAAS;IAClB,IAAI,EAAE,wBAAwB;CAC/B,CAAC,CAAC"}
+{"version":3,"file":"plugin.js","sourceRoot":"","sources":["../src/plugin.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,MAAM,gBAAgB,CAAC;AAChC,OAAO,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AACzC,OAAO,EAAE,2BAA2B,EAA8B,MAAM,sBAAsB,CAAC;AAe/F,MAAM,UAAU,GAA0C,KAAK,EAC7D,OAAwB,EACxB,OAA0B,EAC1B,EAAE;IACF,MAAM,aAAa,GAAG,IAAI,2BAA2B,CAAC,OAAO,CAAC,cAAc,CAAC,CAAC;IAE9E,MAAM,MAAM,GAAG,IAAI,UAAU,CAAC;QAC5B,OAAO,EAAE,OAAO,CAAC,OAAO;QACxB,KAAK,EAAE,GAAG,EAAE,CAAC,aAAa,CAAC,QAAQ,EAAE;QACrC,cAAc,EAAE,GAAG,EAAE,CAAC,aAAa,CAAC,iBAAiB,EAAqB;KAC3E,CAAC,CAAC;IAEH,OAAO,CAAC,QAAQ,CAAC,YAAY,EAAE,MAAM,CAAC,CAAC;AACzC,CAAC,CAAC;AAEF,eAAe,EAAE,CAAC,UAAU,EAAE;IAC5B,OAAO,EAAE,SAAS;IAClB,IAAI,EAAE,wBAAwB;CAC/B,CAAC,CAAC"}

package/dist/service-account.d.ts

@@ -12,6 +12,7 @@ export interface ServiceAccountOptions {
  * client_credentials grant and caches it until near expiry.
  *
  * Tokens are valid for ~7 min. A new one is fetched 30 s before that.
+ * The organizationId claim is extracted automatically from the JWT payload.
  */
 export declare class ServiceAccountTokenProvider {
     private readonly issuerUrl;
@@ -21,27 +22,17 @@ export declare class ServiceAccountTokenProvider {
     private cached;
     private inflight;
     constructor(options: ServiceAccountOptions);
-    /** Returns a valid token, fetching a new one if necessary. */
+    private ensureFresh;
+    /** Returns a valid access token. */
     getToken(): Promise<string>;
+    /** Returns the organizationId embedded in the service account JWT. */
+    getOrganizationId(): Promise<string | undefined>;
     private fetchToken;
     /** Returns this provider as a TokenResolver to pass directly to PostClient. */
     asTokenResolver(): TokenResolver;
 }
 /**
  * Convenience factory. Returns a TokenResolver ready for use in PostClient.
- *
- * @example
- * ```ts
- * const post = new PostClient({
- *   baseUrl: process.env.POST_API_URL!,
- *   token: createServiceAccountToken({
- *     issuerUrl: process.env.GEEKAPPS_AUTH_ISSUER!,
- *     clientId: process.env.GEEKAPPS_SERVICE_ACCOUNT_CLIENT_ID!,
- *     clientSecret: process.env.GEEKAPPS_SERVICE_ACCOUNT_CLIENT_SECRET!,
- *   }),
- *   organizationId: process.env.POST_ORGANIZATION_ID!,
- * });
- * ```
  */
 export declare function createServiceAccountToken(options: ServiceAccountOptions): TokenResolver;
 //# sourceMappingURL=service-account.d.ts.map

package/dist/service-account.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"service-account.d.ts","sourceRoot":"","sources":["../src/service-account.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,WAAW,CAAC;AAE/C,MAAM,WAAW,qBAAqB;IACpC,wEAAwE;IACxE,SAAS,EAAE,MAAM,CAAC;IAClB,QAAQ,EAAE,MAAM,CAAC;IACjB,YAAY,EAAE,MAAM,CAAC;IACrB,oEAAoE;IACpE,0BAA0B,CAAC,EAAE,MAAM,CAAC;CACrC;AAOD;;;;;GAKG;AACH,qBAAa,2BAA2B;IACtC,OAAO,CAAC,QAAQ,CAAC,SAAS,CAAS;IACnC,OAAO,CAAC,QAAQ,CAAC,QAAQ,CAAS;IAClC,OAAO,CAAC,QAAQ,CAAC,YAAY,CAAS;IACtC,OAAO,CAAC,QAAQ,CAAC,eAAe,CAAS;IACzC,OAAO,CAAC,MAAM,CAA4B;IAC1C,OAAO,CAAC,QAAQ,CAAgC;gBAEpC,OAAO,EAAE,qBAAqB;IAO1C,8DAA8D;IAC9D,QAAQ,IAAI,OAAO,CAAC,MAAM,CAAC;YAiBb,UAAU;IA8BxB,+EAA+E;IAC/E,eAAe,IAAI,aAAa;CAGjC;AAED;;;;;;;;;;;;;;;GAeG;AACH,wBAAgB,yBAAyB,CACvC,OAAO,EAAE,qBAAqB,GAC7B,aAAa,CAEf"}
+{"version":3,"file":"service-account.d.ts","sourceRoot":"","sources":["../src/service-account.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,WAAW,CAAC;AAE/C,MAAM,WAAW,qBAAqB;IACpC,wEAAwE;IACxE,SAAS,EAAE,MAAM,CAAC;IAClB,QAAQ,EAAE,MAAM,CAAC;IACjB,YAAY,EAAE,MAAM,CAAC;IACrB,oEAAoE;IACpE,0BAA0B,CAAC,EAAE,MAAM,CAAC;CACrC;AAmBD;;;;;;GAMG;AACH,qBAAa,2BAA2B;IACtC,OAAO,CAAC,QAAQ,CAAC,SAAS,CAAS;IACnC,OAAO,CAAC,QAAQ,CAAC,QAAQ,CAAS;IAClC,OAAO,CAAC,QAAQ,CAAC,YAAY,CAAS;IACtC,OAAO,CAAC,QAAQ,CAAC,eAAe,CAAS;IACzC,OAAO,CAAC,MAAM,CAA4B;IAC1C,OAAO,CAAC,QAAQ,CAAqC;gBAEzC,OAAO,EAAE,qBAAqB;YAO5B,WAAW;IAgBzB,oCAAoC;IACpC,QAAQ,IAAI,OAAO,CAAC,MAAM,CAAC;IAI3B,sEAAsE;IACtE,iBAAiB,IAAI,OAAO,CAAC,MAAM,GAAG,SAAS,CAAC;YAIlC,UAAU;IAqCxB,+EAA+E;IAC/E,eAAe,IAAI,aAAa;CAGjC;AAED;;GAEG;AACH,wBAAgB,yBAAyB,CACvC,OAAO,EAAE,qBAAqB,GAC7B,aAAa,CAEf"}

package/dist/service-account.js

@@ -1,8 +1,21 @@
+function decodeJwtPayload(token) {
+    try {
+        const [, payload] = token.split(".");
+        if (!payload)
+            return {};
+        const json = Buffer.from(payload, "base64url").toString("utf-8");
+        return JSON.parse(json);
+    }
+    catch {
+        return {};
+    }
+}
 /**
  * Fetches a short-lived token from the Geekapps Auth service using
  * client_credentials grant and caches it until near expiry.
  *
  * Tokens are valid for ~7 min. A new one is fetched 30 s before that.
+ * The organizationId claim is extracted automatically from the JWT payload.
  */
 export class ServiceAccountTokenProvider {
     constructor(options) {
@@ -13,13 +26,11 @@ export class ServiceAccountTokenProvider {
         this.clientSecret = options.clientSecret;
         this.refreshBeforeMs = (options.refreshBeforeExpirySeconds ?? 30) * 1000;
     }
-    /** Returns a valid token, fetching a new one if necessary. */
-    getToken() {
+    async ensureFresh() {
         const now = Date.now();
         if (this.cached && this.cached.expiresAt - now > this.refreshBeforeMs) {
-            return Promise.resolve(this.cached.value);
+            return this.cached;
         }
-        // Deduplicate concurrent calls — only one fetch in flight at a time
         if (this.inflight)
             return this.inflight;
         this.inflight = this.fetchToken().finally(() => {
@@ -27,27 +38,40 @@ export class ServiceAccountTokenProvider {
         });
         return this.inflight;
     }
+    /** Returns a valid access token. */
+    getToken() {
+        return this.ensureFresh().then((c) => c.value);
+    }
+    /** Returns the organizationId embedded in the service account JWT. */
+    getOrganizationId() {
+        return this.ensureFresh().then((c) => c.organizationId);
+    }
     async fetchToken() {
-        const body = new URLSearchParams();
-        body.set("grant_type", "client_credentials");
-        body.set("client_id", this.clientId);
-        body.set("client_secret", this.clientSecret);
+        const credentials = Buffer.from(`${this.clientId}:${this.clientSecret}`).toString("base64");
         const res = await fetch(`${this.issuerUrl}/auth/token`, {
             method: "POST",
-            headers: { "Content-Type": "application/x-www-form-urlencoded" },
-            body,
+            headers: {
+                "Content-Type": "application/json",
+                Authorization: `Basic ${credentials}`,
+            },
+            body: JSON.stringify({ grant_type: "service_account" }),
         });
         if (!res.ok) {
             const err = await res.json().catch(() => ({}));
             throw new Error(`ServiceAccount token fetch failed (${res.status}): ${err.error ?? "unknown error"}`);
         }
         const data = await res.json();
+        const claims = decodeJwtPayload(data.access_token);
+        const organizationId = typeof claims.organizationId === "string" ? claims.organizationId :
+            typeof claims.organization_id === "string" ? claims.organization_id :
+                undefined;
         const expiresInMs = (data.expires_in ?? 420) * 1000;
         this.cached = {
             value: data.access_token,
             expiresAt: Date.now() + expiresInMs,
+            organizationId,
         };
-        return this.cached.value;
+        return this.cached;
     }
     /** Returns this provider as a TokenResolver to pass directly to PostClient. */
     asTokenResolver() {
@@ -56,19 +80,6 @@ export class ServiceAccountTokenProvider {
 }
 /**
  * Convenience factory. Returns a TokenResolver ready for use in PostClient.
- *
- * @example
- * ```ts
- * const post = new PostClient({
- *   baseUrl: process.env.POST_API_URL!,
- *   token: createServiceAccountToken({
- *     issuerUrl: process.env.GEEKAPPS_AUTH_ISSUER!,
- *     clientId: process.env.GEEKAPPS_SERVICE_ACCOUNT_CLIENT_ID!,
- *     clientSecret: process.env.GEEKAPPS_SERVICE_ACCOUNT_CLIENT_SECRET!,
- *   }),
- *   organizationId: process.env.POST_ORGANIZATION_ID!,
- * });
- * ```
  */
 export function createServiceAccountToken(options) {
     return new ServiceAccountTokenProvider(options).asTokenResolver();

package/dist/service-account.js.map

@@ -1 +1 @@
-{"version":3,"file":"service-account.js","sourceRoot":"","sources":["../src/service-account.ts"],"names":[],"mappings":"AAgBA;;;;;GAKG;AACH,MAAM,OAAO,2BAA2B;IAQtC,YAAY,OAA8B;QAHlC,WAAM,GAAuB,IAAI,CAAC;QAClC,aAAQ,GAA2B,IAAI,CAAC;QAG9C,IAAI,CAAC,SAAS,GAAG,OAAO,CAAC,SAAS,CAAC,OAAO,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC;QACtD,IAAI,CAAC,QAAQ,GAAG,OAAO,CAAC,QAAQ,CAAC;QACjC,IAAI,CAAC,YAAY,GAAG,OAAO,CAAC,YAAY,CAAC;QACzC,IAAI,CAAC,eAAe,GAAG,CAAC,OAAO,CAAC,0BAA0B,IAAI,EAAE,CAAC,GAAG,IAAI,CAAC;IAC3E,CAAC;IAED,8DAA8D;IAC9D,QAAQ;QACN,MAAM,GAAG,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;QAEvB,IAAI,IAAI,CAAC,MAAM,IAAI,IAAI,CAAC,MAAM,CAAC,SAAS,GAAG,GAAG,GAAG,IAAI,CAAC,eAAe,EAAE,CAAC;YACtE,OAAO,OAAO,CAAC,OAAO,CAAC,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;QAC5C,CAAC;QAED,oEAAoE;QACpE,IAAI,IAAI,CAAC,QAAQ;YAAE,OAAO,IAAI,CAAC,QAAQ,CAAC;QAExC,IAAI,CAAC,QAAQ,GAAG,IAAI,CAAC,UAAU,EAAE,CAAC,OAAO,CAAC,GAAG,EAAE;YAC7C,IAAI,CAAC,QAAQ,GAAG,IAAI,CAAC;QACvB,CAAC,CAAC,CAAC;QAEH,OAAO,IAAI,CAAC,QAAQ,CAAC;IACvB,CAAC;IAEO,KAAK,CAAC,UAAU;QACtB,MAAM,IAAI,GAAG,IAAI,eAAe,EAAE,CAAC;QACnC,IAAI,CAAC,GAAG,CAAC,YAAY,EAAE,oBAAoB,CAAC,CAAC;QAC7C,IAAI,CAAC,GAAG,CAAC,WAAW,EAAE,IAAI,CAAC,QAAQ,CAAC,CAAC;QACrC,IAAI,CAAC,GAAG,CAAC,eAAe,EAAE,IAAI,CAAC,YAAY,CAAC,CAAC;QAE7C,MAAM,GAAG,GAAG,MAAM,KAAK,CAAC,GAAG,IAAI,CAAC,SAAS,aAAa,EAAE;YACtD,MAAM,EAAE,MAAM;YACd,OAAO,EAAE,EAAE,cAAc,EAAE,mCAAmC,EAAE;YAChE,IAAI;SACL,CAAC,CAAC;QAEH,IAAI,CAAC,GAAG,CAAC,EAAE,EAAE,CAAC;YACZ,MAAM,GAAG,GAAG,MAAM,GAAG,CAAC,IAAI,EAAE,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,CAAC,EAAE,CAAC,CAAuB,CAAC;YACrE,MAAM,IAAI,KAAK,CACb,sCAAsC,GAAG,CAAC,MAAM,MAAM,GAAG,CAAC,KAAK,IAAI,eAAe,EAAE,CACrF,CAAC;QACJ,CAAC;QAED,MAAM,IAAI,GAAG,MAAM,GAAG,CAAC,IAAI,EAAmD,CAAC;QAE/E,MAAM,WAAW,GAAG,CAAC,IAAI,CAAC,UAAU,IAAI,GAAG,CAAC,GAAG,IAAI,CAAC;QACpD,IAAI,CAAC,MAAM,GAAG;YACZ,KAAK,EAAE,IAAI,CAAC,YAAY;YACxB,SAAS,EAAE,IAAI,CAAC,GAAG,EAAE,GAAG,WAAW;SACpC,CAAC;QAEF,OAAO,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC;IAC3B,CAAC;IAED,+EAA+E;IAC/E,eAAe;QACb,OAAO,GAAG,EAAE,CAAC,IAAI,CAAC,QAAQ,EAAE,CAAC;IAC/B,CAAC;CACF;AAED;;;;;;;;;;;;;;;GAeG;AACH,MAAM,UAAU,yBAAyB,CACvC,OAA8B;IAE9B,OAAO,IAAI,2BAA2B,CAAC,OAAO,CAAC,CAAC,eAAe,EAAE,CAAC;AACpE,CAAC"}
+{"version":3,"file":"service-account.js","sourceRoot":"","sources":["../src/service-account.ts"],"names":[],"mappings":"AAiBA,SAAS,gBAAgB,CAAC,KAAa;IACrC,IAAI,CAAC;QACH,MAAM,CAAC,EAAE,OAAO,CAAC,GAAG,KAAK,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;QACrC,IAAI,CAAC,OAAO;YAAE,OAAO,EAAE,CAAC;QACxB,MAAM,IAAI,GAAG,MAAM,CAAC,IAAI,CAAC,OAAO,EAAE,WAAW,CAAC,CAAC,QAAQ,CAAC,OAAO,CAAC,CAAC;QACjE,OAAO,IAAI,CAAC,KAAK,CAAC,IAAI,CAA4B,CAAC;IACrD,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,EAAE,CAAC;IACZ,CAAC;AACH,CAAC;AAED;;;;;;GAMG;AACH,MAAM,OAAO,2BAA2B;IAQtC,YAAY,OAA8B;QAHlC,WAAM,GAAuB,IAAI,CAAC;QAClC,aAAQ,GAAgC,IAAI,CAAC;QAGnD,IAAI,CAAC,SAAS,GAAG,OAAO,CAAC,SAAS,CAAC,OAAO,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC;QACtD,IAAI,CAAC,QAAQ,GAAG,OAAO,CAAC,QAAQ,CAAC;QACjC,IAAI,CAAC,YAAY,GAAG,OAAO,CAAC,YAAY,CAAC;QACzC,IAAI,CAAC,eAAe,GAAG,CAAC,OAAO,CAAC,0BAA0B,IAAI,EAAE,CAAC,GAAG,IAAI,CAAC;IAC3E,CAAC;IAEO,KAAK,CAAC,WAAW;QACvB,MAAM,GAAG,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;QAEvB,IAAI,IAAI,CAAC,MAAM,IAAI,IAAI,CAAC,MAAM,CAAC,SAAS,GAAG,GAAG,GAAG,IAAI,CAAC,eAAe,EAAE,CAAC;YACtE,OAAO,IAAI,CAAC,MAAM,CAAC;QACrB,CAAC;QAED,IAAI,IAAI,CAAC,QAAQ;YAAE,OAAO,IAAI,CAAC,QAAQ,CAAC;QAExC,IAAI,CAAC,QAAQ,GAAG,IAAI,CAAC,UAAU,EAAE,CAAC,OAAO,CAAC,GAAG,EAAE;YAC7C,IAAI,CAAC,QAAQ,GAAG,IAAI,CAAC;QACvB,CAAC,CAAC,CAAC;QAEH,OAAO,IAAI,CAAC,QAAQ,CAAC;IACvB,CAAC;IAED,oCAAoC;IACpC,QAAQ;QACN,OAAO,IAAI,CAAC,WAAW,EAAE,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC;IACjD,CAAC;IAED,sEAAsE;IACtE,iBAAiB;QACf,OAAO,IAAI,CAAC,WAAW,EAAE,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,cAAc,CAAC,CAAC;IAC1D,CAAC;IAEO,KAAK,CAAC,UAAU;QACtB,MAAM,WAAW,GAAG,MAAM,CAAC,IAAI,CAAC,GAAG,IAAI,CAAC,QAAQ,IAAI,IAAI,CAAC,YAAY,EAAE,CAAC,CAAC,QAAQ,CAAC,QAAQ,CAAC,CAAC;QAE5F,MAAM,GAAG,GAAG,MAAM,KAAK,CAAC,GAAG,IAAI,CAAC,SAAS,aAAa,EAAE;YACtD,MAAM,EAAE,MAAM;YACd,OAAO,EAAE;gBACP,cAAc,EAAE,kBAAkB;gBAClC,aAAa,EAAE,SAAS,WAAW,EAAE;aACtC;YACD,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC,EAAE,UAAU,EAAE,iBAAiB,EAAE,CAAC;SACxD,CAAC,CAAC;QAEH,IAAI,CAAC,GAAG,CAAC,EAAE,EAAE,CAAC;YACZ,MAAM,GAAG,GAAG,MAAM,GAAG,CAAC,IAAI,EAAE,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,CAAC,EAAE,CAAC,CAAuB,CAAC;YACrE,MAAM,IAAI,KAAK,CACb,sCAAsC,GAAG,CAAC,MAAM,MAAM,GAAG,CAAC,KAAK,IAAI,eAAe,EAAE,CACrF,CAAC;QACJ,CAAC;QAED,MAAM,IAAI,GAAG,MAAM,GAAG,CAAC,IAAI,EAAmD,CAAC;QAE/E,MAAM,MAAM,GAAG,gBAAgB,CAAC,IAAI,CAAC,YAAY,CAAC,CAAC;QACnD,MAAM,cAAc,GAClB,OAAO,MAAM,CAAC,cAAc,KAAK,QAAQ,CAAC,CAAC,CAAC,MAAM,CAAC,cAAc,CAAC,CAAC;YACnE,OAAO,MAAM,CAAC,eAAe,KAAK,QAAQ,CAAC,CAAC,CAAC,MAAM,CAAC,eAAe,CAAC,CAAC;gBACrE,SAAS,CAAC;QAEZ,MAAM,WAAW,GAAG,CAAC,IAAI,CAAC,UAAU,IAAI,GAAG,CAAC,GAAG,IAAI,CAAC;QACpD,IAAI,CAAC,MAAM,GAAG;YACZ,KAAK,EAAE,IAAI,CAAC,YAAY;YACxB,SAAS,EAAE,IAAI,CAAC,GAAG,EAAE,GAAG,WAAW;YACnC,cAAc;SACf,CAAC;QAEF,OAAO,IAAI,CAAC,MAAM,CAAC;IACrB,CAAC;IAED,+EAA+E;IAC/E,eAAe;QACb,OAAO,GAAG,EAAE,CAAC,IAAI,CAAC,QAAQ,EAAE,CAAC;IAC/B,CAAC;CACF;AAED;;GAEG;AACH,MAAM,UAAU,yBAAyB,CACvC,OAA8B;IAE9B,OAAO,IAAI,2BAA2B,CAAC,OAAO,CAAC,CAAC,eAAe,EAAE,CAAC;AACpE,CAAC"}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@geekapps/post-fastify",
-  "version": "0.1.0",
+  "version": "0.1.2",
   "description": "Geekapps Post SDK for Fastify",
   "type": "module",
   "main": "./dist/index.js",
@@ -17,6 +17,7 @@
     "dev": "tsc --watch"
   },
   "devDependencies": {
+    "@types/node": "^25.9.1",
     "fastify": "^5.8.5",
     "fastify-plugin": "^5.1.0",
     "typescript": "^5.9.3"

package/src/plugin.ts

@@ -6,8 +6,6 @@ import { ServiceAccountTokenProvider, type ServiceAccountOptions } from "./servi
 export interface PostPluginOptions {
   /** Geekapps Post API base URL */
   baseUrl: string;
-  /** Organization ID to use on all requests */
-  organizationId: string;
   /** Service account credentials — required */
   serviceAccount: ServiceAccountOptions;
 }
@@ -27,7 +25,7 @@ const postPlugin: FastifyPluginAsync<PostPluginOptions> = async (
   const client = new PostClient({
     baseUrl: options.baseUrl,
     token: () => tokenProvider.getToken(),
-    organizationId: options.organizationId,
+    organizationId: () => tokenProvider.getOrganizationId() as Promise<string>,
   });
 
   fastify.decorate("postClient", client);

package/src/service-account.ts

@@ -12,6 +12,18 @@ export interface ServiceAccountOptions {
 interface CachedToken {
   value: string;
   expiresAt: number; // ms epoch
+  organizationId: string | undefined;
+}
+
+function decodeJwtPayload(token: string): Record<string, unknown> {
+  try {
+    const [, payload] = token.split(".");
+    if (!payload) return {};
+    const json = Buffer.from(payload, "base64url").toString("utf-8");
+    return JSON.parse(json) as Record<string, unknown>;
+  } catch {
+    return {};
+  }
 }
 
 /**
@@ -19,6 +31,7 @@ interface CachedToken {
  * client_credentials grant and caches it until near expiry.
  *
  * Tokens are valid for ~7 min. A new one is fetched 30 s before that.
+ * The organizationId claim is extracted automatically from the JWT payload.
  */
 export class ServiceAccountTokenProvider {
   private readonly issuerUrl: string;
@@ -26,7 +39,7 @@ export class ServiceAccountTokenProvider {
   private readonly clientSecret: string;
   private readonly refreshBeforeMs: number;
   private cached: CachedToken | null = null;
-  private inflight: Promise<string> | null = null;
+  private inflight: Promise<CachedToken> | null = null;
 
   constructor(options: ServiceAccountOptions) {
     this.issuerUrl = options.issuerUrl.replace(/\/$/, "");
@@ -35,15 +48,13 @@ export class ServiceAccountTokenProvider {
     this.refreshBeforeMs = (options.refreshBeforeExpirySeconds ?? 30) * 1000;
   }
 
-  /** Returns a valid token, fetching a new one if necessary. */
-  getToken(): Promise<string> {
+  private async ensureFresh(): Promise<CachedToken> {
     const now = Date.now();
 
     if (this.cached && this.cached.expiresAt - now > this.refreshBeforeMs) {
-      return Promise.resolve(this.cached.value);
+      return this.cached;
     }
 
-    // Deduplicate concurrent calls — only one fetch in flight at a time
     if (this.inflight) return this.inflight;
 
     this.inflight = this.fetchToken().finally(() => {
@@ -53,16 +64,26 @@ export class ServiceAccountTokenProvider {
     return this.inflight;
   }
 
-  private async fetchToken(): Promise<string> {
-    const body = new URLSearchParams();
-    body.set("grant_type", "client_credentials");
-    body.set("client_id", this.clientId);
-    body.set("client_secret", this.clientSecret);
+  /** Returns a valid access token. */
+  getToken(): Promise<string> {
+    return this.ensureFresh().then((c) => c.value);
+  }
+
+  /** Returns the organizationId embedded in the service account JWT. */
+  getOrganizationId(): Promise<string | undefined> {
+    return this.ensureFresh().then((c) => c.organizationId);
+  }
+
+  private async fetchToken(): Promise<CachedToken> {
+    const credentials = Buffer.from(`${this.clientId}:${this.clientSecret}`).toString("base64");
 
     const res = await fetch(`${this.issuerUrl}/auth/token`, {
       method: "POST",
-      headers: { "Content-Type": "application/x-www-form-urlencoded" },
-      body,
+      headers: {
+        "Content-Type": "application/json",
+        Authorization: `Basic ${credentials}`,
+      },
+      body: JSON.stringify({ grant_type: "service_account" }),
     });
 
     if (!res.ok) {
@@ -74,13 +95,20 @@ export class ServiceAccountTokenProvider {
 
     const data = await res.json() as { access_token: string; expires_in?: number };
 
+    const claims = decodeJwtPayload(data.access_token);
+    const organizationId =
+      typeof claims.organizationId === "string" ? claims.organizationId :
+      typeof claims.organization_id === "string" ? claims.organization_id :
+      undefined;
+
     const expiresInMs = (data.expires_in ?? 420) * 1000;
     this.cached = {
       value: data.access_token,
       expiresAt: Date.now() + expiresInMs,
+      organizationId,
     };
 
-    return this.cached.value;
+    return this.cached;
   }
 
   /** Returns this provider as a TokenResolver to pass directly to PostClient. */
@@ -91,19 +119,6 @@ export class ServiceAccountTokenProvider {
 
 /**
  * Convenience factory. Returns a TokenResolver ready for use in PostClient.
- *
- * @example
- * ```ts
- * const post = new PostClient({
- *   baseUrl: process.env.POST_API_URL!,
- *   token: createServiceAccountToken({
- *     issuerUrl: process.env.GEEKAPPS_AUTH_ISSUER!,
- *     clientId: process.env.GEEKAPPS_SERVICE_ACCOUNT_CLIENT_ID!,
- *     clientSecret: process.env.GEEKAPPS_SERVICE_ACCOUNT_CLIENT_SECRET!,
- *   }),
- *   organizationId: process.env.POST_ORGANIZATION_ID!,
- * });
- * ```
  */
 export function createServiceAccountToken(
   options: ServiceAccountOptions,

package/tsconfig.json

@@ -4,6 +4,7 @@
     "module": "ESNext",
     "moduleResolution": "bundler",
     "lib": ["ES2020", "DOM"],
+    "types": ["node"],
     "outDir": "./dist",
     "rootDir": "./src",
     "declaration": true,