@peektravel/app-utilities 0.1.6 → 0.2.3

package/dist/index.cjs

@@ -1,7 +1,7 @@
 'use strict';
 
-var crypto = require('crypto');
 var jwt = require('jsonwebtoken');
+var crypto = require('crypto');
 
 function _interopNamespace(e) {
   if (e && e.__esModule) return e;
@@ -23,8 +23,11 @@ function _interopNamespace(e) {
 
 var jwt__namespace = /*#__PURE__*/_interopNamespace(jwt);
 
+// src/peek-access-service.ts
+
 // src/internal/gateway-endpoints.ts
 var SALES_ENDPOINT = "sales";
+var V2_EXTENDABLE_SLUG = "peek_backoffice_api-v1";
 
 // src/internal/account-users/account-user-converter.ts
 var ACTIVE_STATUS = "ACTIVE";
@@ -1841,14 +1844,19 @@ var GraphQLClient = class {
     throw new RateLimitError();
   }
   endpoint(endpointName) {
-    return `${this.options.baseUrl}/${this.options.appId}/${endpointName}`;
+    const { baseUrl, appId, endpointPathPrefix } = this.options;
+    const prefix = endpointPathPrefix ? `${endpointPathPrefix}/` : "";
+    return `${baseUrl}/${appId}/${prefix}${endpointName}`;
   }
   buildHeaders() {
-    return {
+    const headers = {
       "X-Peek-Auth": `Bearer ${this.options.getToken()}`,
-      "pk-api-key": this.options.gatewayKey,
       "Content-Type": "application/json"
     };
+    if (this.options.gatewayKey) {
+      headers["pk-api-key"] = this.options.gatewayKey;
+    }
+    return headers;
   }
 };
 
@@ -2908,12 +2916,15 @@ var noopLogger = {
 
 // src/peek-access-service.ts
 var DEFAULT_BASE_URL = "https://apps.peekapis.com/backoffice-gql";
+var DEFAULT_V2_BASE_URL = "https://app-registry.peeklabs.com/installations-api";
 var DEFAULT_TOKEN_TTL_SECONDS = 3600;
 var DEFAULT_TOKEN_REFRESH_LEEWAY_SECONDS = 60;
 var DEFAULT_RETRY_DELAYS_MS = [1e3, 2e3, 4e3];
+var PEEK_TOKEN_ISSUER = "app_registry_v2";
 var PeekAccessService = class {
   client;
   productServiceOptions;
+  jwtSecret;
   productService;
   accountUserService;
   resourcePoolService;
@@ -2926,11 +2937,13 @@ var PeekAccessService = class {
   bookingService;
   reviewService;
   constructor(config) {
+    const isV2 = config.mode === "v2";
     requireNonEmpty(config.installId, "installId");
     requireNonEmpty(config.jwtSecret, "jwtSecret");
     requireNonEmpty(config.issuer, "issuer");
     requireNonEmpty(config.appId, "appId");
-    requireNonEmpty(config.gatewayKey, "gatewayKey");
+    if (!isV2) requireNonEmpty(config.gatewayKey ?? "", "gatewayKey");
+    this.jwtSecret = config.jwtSecret;
     const logger = config.logger ?? noopLogger;
     const tokens = new TokenManager({
       secret: config.jwtSecret,
@@ -2939,19 +2952,56 @@ var PeekAccessService = class {
       ttlSeconds: config.tokenTtlSeconds ?? DEFAULT_TOKEN_TTL_SECONDS,
       leewaySeconds: config.tokenRefreshLeewaySeconds ?? DEFAULT_TOKEN_REFRESH_LEEWAY_SECONDS
     });
+    const defaultBaseUrl = isV2 ? DEFAULT_V2_BASE_URL : DEFAULT_BASE_URL;
     this.client = new GraphQLClient({
-      baseUrl: config.baseUrl ?? DEFAULT_BASE_URL,
+      baseUrl: config.baseUrl ?? defaultBaseUrl,
       appId: config.appId,
       gatewayKey: config.gatewayKey,
       getToken: () => tokens.getToken(),
       retryDelaysMs: config.retryDelaysMs ?? DEFAULT_RETRY_DELAYS_MS,
       logger,
-      fetchFn: config.fetch ?? globalThis.fetch
+      fetchFn: config.fetch ?? globalThis.fetch,
+      endpointPathPrefix: isV2 ? V2_EXTENDABLE_SLUG : void 0
     });
     this.productServiceOptions = {
       itemOptionsPageSize: config.itemOptionsPageSize
     };
   }
+  /**
+   * Verifies a Peek auth token issued by the app registry and returns the
+   * decoded claims.
+   *
+   * Validates the HMAC signature (using this service's `jwtSecret`), the token
+   * expiry, the `"app_registry_v2"` issuer, and the `"Joken"` audience. Throws
+   * from the `jsonwebtoken` library on any failure — callers should catch to
+   * distinguish error kinds:
+   *
+   * - `JsonWebTokenError` — signature invalid, wrong issuer/audience, or token
+   *   malformed
+   * - `TokenExpiredError` — past `exp`
+   * - `NotBeforeError` — before `nbf`
+   *
+   * @throws {JsonWebTokenError} signature invalid or token malformed
+   * @throws {TokenExpiredError} token has expired
+   * @throws {NotBeforeError} token not yet valid
+   */
+  verifyPeekAuthToken(token) {
+    const payload = jwt__namespace.verify(token, this.jwtSecret, {
+      issuer: PEEK_TOKEN_ISSUER
+    });
+    const { user: u } = payload;
+    return {
+      installId: payload.sub,
+      displayVersion: payload.display_version,
+      user: {
+        email: u.email,
+        id: u.id,
+        isAdmin: u.is_admin,
+        locale: u.locale,
+        name: u.name
+      }
+    };
+  }
   /**
    * Returns the {@link ProductService} for this install, bound to the shared
    * authenticated transport. The instance is created lazily and reused.