@peektravel/app-utilities 0.2.2 → 0.2.3

package/dist/index.cjs

@@ -1,7 +1,7 @@
 'use strict';
 
-var crypto = require('crypto');
 var jwt = require('jsonwebtoken');
+var crypto = require('crypto');
 
 function _interopNamespace(e) {
   if (e && e.__esModule) return e;
@@ -23,6 +23,8 @@ function _interopNamespace(e) {
 
 var jwt__namespace = /*#__PURE__*/_interopNamespace(jwt);
 
+// src/peek-access-service.ts
+
 // src/internal/gateway-endpoints.ts
 var SALES_ENDPOINT = "sales";
 var V2_EXTENDABLE_SLUG = "peek_backoffice_api-v1";
@@ -2918,9 +2920,11 @@ var DEFAULT_V2_BASE_URL = "https://app-registry.peeklabs.com/installations-api";
 var DEFAULT_TOKEN_TTL_SECONDS = 3600;
 var DEFAULT_TOKEN_REFRESH_LEEWAY_SECONDS = 60;
 var DEFAULT_RETRY_DELAYS_MS = [1e3, 2e3, 4e3];
+var PEEK_TOKEN_ISSUER = "app_registry_v2";
 var PeekAccessService = class {
   client;
   productServiceOptions;
+  jwtSecret;
   productService;
   accountUserService;
   resourcePoolService;
@@ -2939,6 +2943,7 @@ var PeekAccessService = class {
     requireNonEmpty(config.issuer, "issuer");
     requireNonEmpty(config.appId, "appId");
     if (!isV2) requireNonEmpty(config.gatewayKey ?? "", "gatewayKey");
+    this.jwtSecret = config.jwtSecret;
     const logger = config.logger ?? noopLogger;
     const tokens = new TokenManager({
       secret: config.jwtSecret,
@@ -2962,6 +2967,41 @@ var PeekAccessService = class {
       itemOptionsPageSize: config.itemOptionsPageSize
     };
   }
+  /**
+   * Verifies a Peek auth token issued by the app registry and returns the
+   * decoded claims.
+   *
+   * Validates the HMAC signature (using this service's `jwtSecret`), the token
+   * expiry, the `"app_registry_v2"` issuer, and the `"Joken"` audience. Throws
+   * from the `jsonwebtoken` library on any failure — callers should catch to
+   * distinguish error kinds:
+   *
+   * - `JsonWebTokenError` — signature invalid, wrong issuer/audience, or token
+   *   malformed
+   * - `TokenExpiredError` — past `exp`
+   * - `NotBeforeError` — before `nbf`
+   *
+   * @throws {JsonWebTokenError} signature invalid or token malformed
+   * @throws {TokenExpiredError} token has expired
+   * @throws {NotBeforeError} token not yet valid
+   */
+  verifyPeekAuthToken(token) {
+    const payload = jwt__namespace.verify(token, this.jwtSecret, {
+      issuer: PEEK_TOKEN_ISSUER
+    });
+    const { user: u } = payload;
+    return {
+      installId: payload.sub,
+      displayVersion: payload.display_version,
+      user: {
+        email: u.email,
+        id: u.id,
+        isAdmin: u.is_admin,
+        locale: u.locale,
+        name: u.name
+      }
+    };
+  }
   /**
    * Returns the {@link ProductService} for this install, bound to the shared
    * authenticated transport. The instance is created lazily and reused.