@peektravel/app-utilities 0.4.0 → 0.5.0

package/dist/index.js

@@ -181,6 +181,73 @@ var AvailabilityService = class {
   }
 };
 
+// src/access-options.ts
+function resolveAccessOptions(options) {
+  return { fullCustomerAccess: options?.fullCustomerAccess ?? false };
+}
+
+// src/errors.ts
+var AdminAccountRequiredError = class extends Error {
+  /** The HTTP status that triggered this error. */
+  statusCode = 418;
+  constructor(message = "Admin account required") {
+    super(message);
+    this.name = "AdminAccountRequiredError";
+  }
+};
+var RateLimitError = class extends Error {
+  /** The HTTP status that triggered this error. */
+  statusCode = 429;
+  constructor(message = "Rate limit exceeded") {
+    super(message);
+    this.name = "RateLimitError";
+  }
+};
+var PeekGraphQLError = class extends Error {
+  /** The raw `errors` array returned by the GraphQL endpoint. */
+  graphqlErrors;
+  constructor(graphqlErrors, message = "GraphQL request failed") {
+    super(message);
+    this.name = "PeekGraphQLError";
+    this.graphqlErrors = graphqlErrors;
+  }
+};
+var PiiAccessDisabledError = class extends Error {
+  /** The name of the operation that was blocked (e.g. `"makePayment"`). */
+  operation;
+  constructor(operation) {
+    super(
+      `"${operation}" is disabled because this access service was created without "fullCustomerAccess"; enable it to allow payment and booking-modification operations`
+    );
+    this.name = "PiiAccessDisabledError";
+    this.operation = operation;
+  }
+};
+var CngApiError = class extends Error {
+  /** The HTTP status that triggered this error. */
+  statusCode;
+  /** The raw response body (parsed JSON when possible, otherwise text). */
+  body;
+  constructor(statusCode, body, message) {
+    super(message ?? `CNG request failed with HTTP ${statusCode}`);
+    this.name = "CngApiError";
+    this.statusCode = statusCode;
+    this.body = body;
+  }
+};
+var AcmeApiError = class extends Error {
+  /** The HTTP status that triggered this error. */
+  statusCode;
+  /** The raw response body (parsed JSON when possible, otherwise text). */
+  body;
+  constructor(statusCode, body, message) {
+    super(message ?? `ACME request failed with HTTP ${statusCode}`);
+    this.name = "AcmeApiError";
+    this.statusCode = statusCode;
+    this.body = body;
+  }
+};
+
 // src/models/peek/product.ts
 var ACTIVITY_PRODUCT_TYPE = "ACTIVITY";
 var RENTAL_PRODUCT_TYPE = "RENTAL";
@@ -192,17 +259,8 @@ var SEARCH_BY_ACTIVITY_DATE = "activityDate";
 function normalizeBookingId(bookingId) {
   return bookingId.toLowerCase().replace(/-/g, "_");
 }
-var guestFields = `
-  id
-  name
-  country
-  dateOfBirth
-  email
-  isGdpr
-  isParticipant
-  optinSms
-  optinMarketing
-  phone
+var GUEST_IDENTITY_PII_FIELDS = "name country dateOfBirth email isGdpr";
+var GUEST_CONTACT_PII_FIELDS = `phone
   postalCode
   fieldResponses {
     id
@@ -212,9 +270,20 @@ var guestFields = `
         name
       }
     }
-  }
+  }`;
+function buildGuestFields(fullCustomerAccess) {
+  return `
+  id
+  ${fullCustomerAccess ? GUEST_IDENTITY_PII_FIELDS : ""}
+  isParticipant
+  optinSms
+  optinMarketing
+  ${fullCustomerAccess ? GUEST_CONTACT_PII_FIELDS : ""}
 `;
-var bookingGuestsFields = `
+}
+function buildBookingGuestsFields(fullCustomerAccess) {
+  const guestFields = buildGuestFields(fullCustomerAccess);
+  return `
   bookingGuests {
     ${guestFields}
   }
@@ -222,10 +291,9 @@ var bookingGuestsFields = `
     ${guestFields}
   }
 `;
-var bookingQueryFields = `
-  displayId
-  id
-  primaryGuest {
+}
+var bookingGuestsFields = buildBookingGuestsFields(true);
+var BOOKING_PRIMARY_GUEST_PII_FIELDS = `primaryGuest {
     name
     email
     phone
@@ -233,7 +301,26 @@ var bookingQueryFields = `
     optinSms
     isGdpr
     postalCode
+  }`;
+var BOOKING_QUESTION_ANSWERS_PII_FIELDS = `questionAnswers {
+    answer
+    questionText
+    questionLocationSnapshot {
+      latitude
+      longitude
+    }
   }
+  tickets {
+    questionAnswers {
+      answer
+      questionText
+    }
+  }`;
+function buildBookingQueryFields(fullCustomerAccess) {
+  return `
+  displayId
+  id
+  ${fullCustomerAccess ? BOOKING_PRIMARY_GUEST_PII_FIELDS : ""}
   activitySnapshot {
     type
     name
@@ -263,7 +350,7 @@ var bookingQueryFields = `
   endsAt
   endsAtUtc
   availabilityTimeId
-  bookingPortalUrl
+  ${fullCustomerAccess ? "bookingPortalUrl" : ""}
   operatorNotes
   value {
     total {
@@ -305,20 +392,7 @@ var bookingQueryFields = `
       }
     }
   }
-  questionAnswers {
-    answer
-    questionText
-    questionLocationSnapshot {
-      latitude
-      longitude
-    }
-  }
-  tickets {
-    questionAnswers {
-      answer
-      questionText
-    }
-  }
+  ${fullCustomerAccess ? BOOKING_QUESTION_ANSWERS_PII_FIELDS : ""}
   resourcePoolAssignments {
     quantity
     resourcePool {
@@ -336,6 +410,8 @@ var bookingQueryFields = `
     }
   }
 `;
+}
+var bookingQueryFields = buildBookingQueryFields(true);
 var PRICE_BREAKDOWN_FIELDS = `
   convenienceFee { amount formatted }
   deposit { amount formatted }
@@ -354,9 +430,10 @@ var TICKET_VALUE_FIELDS = `
     total { amount formatted }
   }
 `;
-function buildBookingsListingQuery(includeGuests, includePriceBreakdown) {
-  const guestsSection = includeGuests ? bookingGuestsFields : "";
-  const fields = includePriceBreakdown ? bookingQueryFields.replace("value {", `value { ${PRICE_BREAKDOWN_FIELDS}`).replace("ticketQuantities {", `ticketQuantities { ${TICKET_VALUE_FIELDS}`) : bookingQueryFields;
+function buildBookingsListingQuery(includeGuests, includePriceBreakdown, fullCustomerAccess = true) {
+  const guestsSection = includeGuests ? buildBookingGuestsFields(fullCustomerAccess) : "";
+  const baseFields = buildBookingQueryFields(fullCustomerAccess);
+  const fields = includePriceBreakdown ? baseFields.replace("value {", `value { ${PRICE_BREAKDOWN_FIELDS}`).replace("ticketQuantities {", `ticketQuantities { ${TICKET_VALUE_FIELDS}`) : baseFields;
   return `
     query Sales($after: String, $first: Int, $filter: SalesFilter!, $orderBy: SalesOrdering) {
       sales(after: $after, first: $first, filter: $filter, orderBy: $orderBy) {
@@ -373,7 +450,8 @@ function buildBookingsListingQuery(includeGuests, includePriceBreakdown) {
     }
   `;
 }
-var BOOKING_GUESTS_QUERY = `
+function buildBookingGuestsQuery(fullCustomerAccess) {
+  return `
   query Sales($after: String, $first: Int, $filter: SalesFilter!, $orderBy: SalesOrdering) {
     sales(after: $after, first: $first, filter: $filter, orderBy: $orderBy) {
       pageInfo { endCursor hasNextPage }
@@ -382,13 +460,14 @@ var BOOKING_GUESTS_QUERY = `
           ... on Booking {
             displayId
             id
-            ${bookingGuestsFields}
+            ${buildBookingGuestsFields(fullCustomerAccess)}
           }
         }
       }
     }
   }
 `;
+}
 var BOOKING_PAYMENTS_ON_FILE_QUERY = `
   query Sales($after: String, $first: Int, $filter: SalesFilter!, $orderBy: SalesOrdering) {
     sales(after: $after, first: $first, filter: $filter, orderBy: $orderBy) {
@@ -974,10 +1053,23 @@ var BookingService = class {
     this.client = client;
     this.deps = deps;
     this.pageSize = options.pageSize ?? DEFAULT_PAGE_SIZE2;
+    this.fullCustomerAccess = resolveAccessOptions(options.accessOptions).fullCustomerAccess;
   }
   client;
   deps;
   pageSize;
+  /** Whether customer PII is requested and payment operations are allowed. */
+  fullCustomerAccess;
+  /**
+   * Throws a {@link PiiAccessDisabledError} for `operation` when this service was
+   * created without `fullCustomerAccess` — used to gate payment and booking-modification
+   * operations that touch customer financial data.
+   */
+  assertPiiEnabled(operation) {
+    if (!this.fullCustomerAccess) {
+      throw new PiiAccessDisabledError(operation);
+    }
+  }
   /**
    * Returns a single booking by id, or null when not found. The `bookingId` is
    * normalized internally (lowercased, `-` → `_`), so `B-ABC123` and `b_abc123`
@@ -999,7 +1091,7 @@ var BookingService = class {
     const includePriceBreakdown = options.includePriceBreakdown ?? false;
     const body = await this.client.request(
       SALES_ENDPOINT,
-      buildBookingsListingQuery(includeGuests, includePriceBreakdown),
+      buildBookingsListingQuery(includeGuests, includePriceBreakdown, this.fullCustomerAccess),
       buildBookingsVariables({
         pageSize: this.pageSize,
         after: null,
@@ -1017,7 +1109,7 @@ var BookingService = class {
     const includeGuests = input.includeGuests ?? false;
     const includePriceBreakdown = input.includePriceBreakdown ?? false;
     return this.fetchPaginated(
-      buildBookingsListingQuery(includeGuests, includePriceBreakdown),
+      buildBookingsListingQuery(includeGuests, includePriceBreakdown, this.fullCustomerAccess),
       {
         startDateTime: input.start,
         endDateTime: input.end,
@@ -1035,7 +1127,7 @@ var BookingService = class {
     const includeGuests = options.includeGuests ?? false;
     const includePriceBreakdown = options.includePriceBreakdown ?? false;
     return this.fetchPaginated(
-      buildBookingsListingQuery(includeGuests, includePriceBreakdown),
+      buildBookingsListingQuery(includeGuests, includePriceBreakdown, this.fullCustomerAccess),
       { timeslotId },
       includeGuests,
       includePriceBreakdown
@@ -1046,7 +1138,7 @@ var BookingService = class {
     assertBookingId(bookingId);
     const body = await this.client.request(
       SALES_ENDPOINT,
-      BOOKING_GUESTS_QUERY,
+      buildBookingGuestsQuery(this.fullCustomerAccess),
       buildBookingsVariables({
         pageSize: this.pageSize,
         after: null,
@@ -1057,6 +1149,7 @@ var BookingService = class {
   }
   /** Returns the payments on file for a booking, or null when not found. */
   async getPaymentsOnFile(bookingId) {
+    this.assertPiiEnabled("getPaymentsOnFile");
     assertBookingId(bookingId);
     const normalized = normalizeBookingId(bookingId);
     const body = await this.client.request(
@@ -1141,6 +1234,7 @@ ${note}`;
    * charge fails.
    */
   async makePayment(input) {
+    this.assertPiiEnabled("makePayment");
     this.validatePaymentInput(input);
     const normalized = normalizeBookingId(input.bookingId);
     const onFile = await this.getPaymentsOnFile(normalized);
@@ -1183,6 +1277,7 @@ ${note}`;
    * payments-on-file, then applies the refund.
    */
   async refund(input) {
+    this.assertPiiEnabled("refund");
     this.validateRefundInput(input);
     const normalized = normalizeBookingId(input.bookingId);
     const onFile = await this.getPaymentsOnFile(normalized);
@@ -1223,6 +1318,7 @@ ${note}`;
   }
   /** Creates an invoice link for a booking's order. */
   async createInvoiceLink(bookingId) {
+    this.assertPiiEnabled("createInvoiceLink");
     assertBookingId(bookingId);
     const normalized = normalizeBookingId(bookingId);
     const booking = await this.getById(normalized);
@@ -1278,6 +1374,7 @@ ${note}`;
    * the underlying quote/order mutations fail.
    */
   async addAddon(bookingId, input) {
+    this.assertPiiEnabled("addAddon");
     assertBookingId(bookingId);
     const addonOptionId = (input?.addonOptionId || input?.addonId || "").trim();
     if (!addonOptionId) {
@@ -1331,6 +1428,7 @@ ${note}`;
    * variables. Returns the booking's add-ons after the change.
    */
   async removeAddon(bookingId, input) {
+    this.assertPiiEnabled("removeAddon");
     assertBookingId(bookingId);
     const addonOptionId = (input?.addonOptionId || input?.addonId || "").trim();
     if (!addonOptionId) {
@@ -1820,57 +1918,6 @@ function createTokenManager(config) {
   });
 }
 
-// src/errors.ts
-var AdminAccountRequiredError = class extends Error {
-  /** The HTTP status that triggered this error. */
-  statusCode = 418;
-  constructor(message = "Admin account required") {
-    super(message);
-    this.name = "AdminAccountRequiredError";
-  }
-};
-var RateLimitError = class extends Error {
-  /** The HTTP status that triggered this error. */
-  statusCode = 429;
-  constructor(message = "Rate limit exceeded") {
-    super(message);
-    this.name = "RateLimitError";
-  }
-};
-var PeekGraphQLError = class extends Error {
-  /** The raw `errors` array returned by the GraphQL endpoint. */
-  graphqlErrors;
-  constructor(graphqlErrors, message = "GraphQL request failed") {
-    super(message);
-    this.name = "PeekGraphQLError";
-    this.graphqlErrors = graphqlErrors;
-  }
-};
-var CngApiError = class extends Error {
-  /** The HTTP status that triggered this error. */
-  statusCode;
-  /** The raw response body (parsed JSON when possible, otherwise text). */
-  body;
-  constructor(statusCode, body, message) {
-    super(message ?? `CNG request failed with HTTP ${statusCode}`);
-    this.name = "CngApiError";
-    this.statusCode = statusCode;
-    this.body = body;
-  }
-};
-var AcmeApiError = class extends Error {
-  /** The HTTP status that triggered this error. */
-  statusCode;
-  /** The raw response body (parsed JSON when possible, otherwise text). */
-  body;
-  constructor(statusCode, body, message) {
-    super(message ?? `ACME request failed with HTTP ${statusCode}`);
-    this.name = "AcmeApiError";
-    this.statusCode = statusCode;
-    this.body = body;
-  }
-};
-
 // src/internal/http-transport.ts
 var RATE_LIMIT_STATUS = 429;
 var ADMIN_ACCOUNT_REQUIRED_STATUS = 418;
@@ -2289,7 +2336,8 @@ function encodeCursor(offset, pageSize) {
 }
 
 // src/internal/peek/reviews/review-queries.ts
-var REVIEWS_QUERY = `
+function buildReviewsQuery(fullCustomerAccess) {
+  return `
   query Reviews($first: Int, $filter: ReviewFilter, $after: String) {
     reviews(first: $first, filter: $filter, after: $after) {
       edges {
@@ -2303,8 +2351,7 @@ var REVIEWS_QUERY = `
             name
           }
           id
-          name
-          email
+          ${fullCustomerAccess ? "name\n          email" : ""}
           rating
           comment
           reviewedAt
@@ -2315,6 +2362,7 @@ var REVIEWS_QUERY = `
     }
   }
 `;
+}
 function buildReviewsVariables(params) {
   return {
     first: params.first,
@@ -2331,10 +2379,13 @@ var ERROR_PRODUCT_ID_REQUIRED = "productId is required";
 var ERROR_INVALID_REVIEW_COUNT = `reviewCount must be an integer between ${MIN_REVIEW_COUNT} and ${MAX_REVIEW_COUNT}`;
 var ERROR_INVALID_REVIEW_OFFSET = "reviewOffset must be a non-negative integer";
 var ReviewService = class {
-  constructor(client) {
+  constructor(client, accessOptions) {
     this.client = client;
+    this.fullCustomerAccess = resolveAccessOptions(accessOptions).fullCustomerAccess;
   }
   client;
+  /** Whether reviewer PII (name/email) is requested. */
+  fullCustomerAccess;
   /**
    * Returns up to `reviewCount` reviews for an activity in **descending order
    * by review date (newest first)**, skipping the `reviewOffset` newest reviews
@@ -2365,7 +2416,7 @@ var ReviewService = class {
     const after = reviewOffset > 0 ? encodeCursor(reviewOffset - 1, reviewCount) : null;
     const body = await this.client.request(
       SALES_ENDPOINT,
-      REVIEWS_QUERY,
+      buildReviewsQuery(this.fullCustomerAccess),
       buildReviewsVariables({ activityId: productId, first: reviewCount, after })
     );
     const edges = body.data?.reviews?.edges ?? [];
@@ -3007,6 +3058,7 @@ var PEEK_TOKEN_ISSUER = "app_registry_v2";
 var PeekAccessService = class {
   client;
   productServiceOptions;
+  accessOptions;
   jwtSecret;
   productService;
   accountUserService;
@@ -3043,6 +3095,7 @@ var PeekAccessService = class {
     this.productServiceOptions = {
       itemOptionsPageSize: config.itemOptionsPageSize
     };
+    this.accessOptions = resolveAccessOptions(config.accessOptions);
   }
   /**
    * Verifies a Peek auth token issued by the app registry and returns the
@@ -3183,9 +3236,11 @@ var PeekAccessService = class {
    */
   getBookingService() {
     if (!this.bookingService) {
-      this.bookingService = new BookingService(this.client, {
-        productService: this.getProductService()
-      });
+      this.bookingService = new BookingService(
+        this.client,
+        { productService: this.getProductService() },
+        { accessOptions: this.accessOptions }
+      );
     }
     return this.bookingService;
   }
@@ -3195,7 +3250,7 @@ var PeekAccessService = class {
    */
   getReviewService() {
     if (!this.reviewService) {
-      this.reviewService = new ReviewService(this.client);
+      this.reviewService = new ReviewService(this.client, this.accessOptions);
     }
     return this.reviewService;
   }
@@ -3497,7 +3552,7 @@ var CngAccessService = class {
 };
 
 // src/internal/acme/endpoints.ts
-var ACME_EXTENDABLE_SLUG = "acme_backoffice_api@v1";
+var ACME_EXTENDABLE_SLUG = "acme_backoffice_api-v1";
 var TEMPLATES_PATH = "v2/b2b/event/templates/names?pageSize=-1&page=1";
 
 // src/models/acme/product.ts
@@ -3688,8 +3743,13 @@ function hasPriceBreakdown(node) {
 
 // src/internal/peek/waivers/waiver-webhook.ts
 var PAYLOAD_WAIVER_KEY = "waiver";
-function parseWaiverWebhook(payload) {
-  return fromWaiverNode(extractWaiverNode(payload));
+function parseWaiverWebhook(payload, options) {
+  const waiver = fromWaiverNode(extractWaiverNode(payload));
+  if (!resolveAccessOptions(options).fullCustomerAccess) {
+    waiver.guestName = null;
+    waiver.fileUrl = "";
+  }
+  return waiver;
 }
 function fromWaiverNode(node) {
   const data = node ?? {};
@@ -3721,6 +3781,6 @@ function extractWaiverNode(payload) {
   return record;
 }
 
-export { ACTIVITY_PRODUCT_TYPE, ADD_ON_PRODUCT_TYPE, AccountUserService, AcmeAccessService, AcmeApiError, AcmeProductService, AdminAccountRequiredError, AvailabilityService, BookingService, CngAccessService, CngApiError, CngProductService, DailyNoteService, MembershipService, PeekAccessService, PeekGraphQLError, ProductService, PromoCodeService, RENTAL_PRODUCT_TYPE, RateLimitError, ResellerService, ResourcePoolService, ReviewService, TimeslotService, noopLogger, parseBookingWebhook, parseWaiverWebhook };
+export { ACTIVITY_PRODUCT_TYPE, ADD_ON_PRODUCT_TYPE, AccountUserService, AcmeAccessService, AcmeApiError, AcmeProductService, AdminAccountRequiredError, AvailabilityService, BookingService, CngAccessService, CngApiError, CngProductService, DailyNoteService, MembershipService, PeekAccessService, PeekGraphQLError, PiiAccessDisabledError, ProductService, PromoCodeService, RENTAL_PRODUCT_TYPE, RateLimitError, ResellerService, ResourcePoolService, ReviewService, TimeslotService, noopLogger, parseBookingWebhook, parseWaiverWebhook };
 //# sourceMappingURL=index.js.map
 //# sourceMappingURL=index.js.map