@peektravel/app-utilities 0.7.0 → 0.7.1

package/README.md

@@ -276,8 +276,9 @@ app.post("/waiver-webhook", (req, res) => {
 app.post("/install-webhook", async (req, res) => {
   let event: InstallWebhook;
   try {
-    // Verifies the signed token, then merges in the JSON body:
-    event = parseInstallWebhook(req.token, req.body, process.env.PEEK_INTERNAL_SECRET!);
+    // Token rides in the `x-peek-auth` header (a `Bearer ` prefix is stripped for you):
+    const token = req.header("x-peek-auth") ?? "";
+    event = parseInstallWebhook(token, req.body, process.env.PEEK_INTERNAL_SECRET!);
   } catch {
     return res.sendStatus(401); // bad signature / issuer / audience / expired
   }
@@ -301,7 +302,9 @@ is the receiver's job**. `parseWaiverWebhook` also takes an optional
 below.
 
 `parseInstallWebhook(token, body, secret)` is different: the delivery carries a
-signed `app_registry_v2` JWT plus a JSON body. It validates the HMAC signature,
+signed `app_registry_v2` JWT plus a JSON body. Peek sends the token in the
+`x-peek-auth` header — pass that value straight in (`token` accepts it with or
+without a `Bearer ` prefix). It validates the HMAC signature,
 expiry, issuer, and `"Joken"` audience (the same checks as `verifyPeekAuthToken`,
 throwing the underlying `jsonwebtoken` error — or `InvalidPeekTokenError` when a
 present `user` block has no `id`), then returns one flat, JSON-safe

package/dist/index.cjs

@@ -2061,8 +2061,13 @@ var GraphQLClient = class {
 };
 var PEEK_TOKEN_ISSUER = "app_registry_v2";
 var PEEK_TOKEN_AUDIENCE = "Joken";
+var BEARER_PREFIX = "bearer ";
+function stripBearer(token) {
+  const trimmed = token.trim();
+  return trimmed.toLowerCase().startsWith(BEARER_PREFIX) ? trimmed.slice(BEARER_PREFIX.length).trim() : trimmed;
+}
 function verifyPeekJwt(token, secret) {
-  return jwt__namespace.verify(token, secret, {
+  return jwt__namespace.verify(stripBearer(token), secret, {
     issuer: PEEK_TOKEN_ISSUER,
     audience: PEEK_TOKEN_AUDIENCE
   });
@@ -3586,9 +3591,10 @@ var PeekAccessService = class {
    * decoded claims.
    *
    * Validates the HMAC signature (using this service's `jwtSecret`), the token
-   * expiry, the `"app_registry_v2"` issuer, and the `"Joken"` audience. Throws
-   * from the `jsonwebtoken` library on any failure — callers should catch to
-   * distinguish error kinds:
+   * expiry, the `"app_registry_v2"` issuer, and the `"Joken"` audience. Pass the
+   * raw `x-peek-auth` request header value — a leading `Bearer ` prefix, if
+   * present, is stripped for you. Throws from the `jsonwebtoken` library on any
+   * failure — callers should catch to distinguish error kinds:
    *
    * - `JsonWebTokenError` — signature invalid, wrong issuer/audience, or token
    *   malformed