@peektravel/app-utilities 0.7.0 → 0.7.1

package/dist/index.d.cts

@@ -1926,9 +1926,10 @@ declare class PeekAccessService {
      * decoded claims.
      *
      * Validates the HMAC signature (using this service's `jwtSecret`), the token
-     * expiry, the `"app_registry_v2"` issuer, and the `"Joken"` audience. Throws
-     * from the `jsonwebtoken` library on any failure — callers should catch to
-     * distinguish error kinds:
+     * expiry, the `"app_registry_v2"` issuer, and the `"Joken"` audience. Pass the
+     * raw `x-peek-auth` request header value — a leading `Bearer ` prefix, if
+     * present, is stripped for you. Throws from the `jsonwebtoken` library on any
+     * failure — callers should catch to distinguish error kinds:
      *
      * - `JsonWebTokenError` — signature invalid, wrong issuer/audience, or token
      *   malformed
@@ -2542,7 +2543,9 @@ interface InstallWebhook {
  * }
  * ```
  *
- * @param token the raw JWT delivered by the install webhook (no `Bearer` prefix)
+ * @param token the JWT delivered by the install webhook. Pass the raw
+ *   `x-peek-auth` header value directly — a leading `Bearer ` prefix, if
+ *   present, is stripped for you.
  * @param body the delivered JSON body (raw object or a JSON string)
  * @param secret the app's HMAC signing secret (the `jwtSecret` you construct
  *   `PeekAccessService` with)
@@ -2572,7 +2575,9 @@ declare function parseInstallWebhook(token: string, body: unknown, secret: strin
  * - `TokenExpiredError` — past `exp`
  * - `NotBeforeError` — before `nbf`
  *
- * @param token the raw JWT delivered by the install webhook (no `Bearer` prefix)
+ * @param token the JWT delivered by the install webhook. Pass the raw
+ *   `x-peek-auth` header value directly — a leading `Bearer ` prefix, if
+ *   present, is stripped for you.
  * @param secret the app's HMAC signing secret (the `jwtSecret` you construct
  *   `PeekAccessService` with)
  * @throws {JsonWebTokenError} signature invalid or token malformed

package/dist/index.d.ts

@@ -1926,9 +1926,10 @@ declare class PeekAccessService {
      * decoded claims.
      *
      * Validates the HMAC signature (using this service's `jwtSecret`), the token
-     * expiry, the `"app_registry_v2"` issuer, and the `"Joken"` audience. Throws
-     * from the `jsonwebtoken` library on any failure — callers should catch to
-     * distinguish error kinds:
+     * expiry, the `"app_registry_v2"` issuer, and the `"Joken"` audience. Pass the
+     * raw `x-peek-auth` request header value — a leading `Bearer ` prefix, if
+     * present, is stripped for you. Throws from the `jsonwebtoken` library on any
+     * failure — callers should catch to distinguish error kinds:
      *
      * - `JsonWebTokenError` — signature invalid, wrong issuer/audience, or token
      *   malformed
@@ -2542,7 +2543,9 @@ interface InstallWebhook {
  * }
  * ```
  *
- * @param token the raw JWT delivered by the install webhook (no `Bearer` prefix)
+ * @param token the JWT delivered by the install webhook. Pass the raw
+ *   `x-peek-auth` header value directly — a leading `Bearer ` prefix, if
+ *   present, is stripped for you.
  * @param body the delivered JSON body (raw object or a JSON string)
  * @param secret the app's HMAC signing secret (the `jwtSecret` you construct
  *   `PeekAccessService` with)
@@ -2572,7 +2575,9 @@ declare function parseInstallWebhook(token: string, body: unknown, secret: strin
  * - `TokenExpiredError` — past `exp`
  * - `NotBeforeError` — before `nbf`
  *
- * @param token the raw JWT delivered by the install webhook (no `Bearer` prefix)
+ * @param token the JWT delivered by the install webhook. Pass the raw
+ *   `x-peek-auth` header value directly — a leading `Bearer ` prefix, if
+ *   present, is stripped for you.
  * @param secret the app's HMAC signing secret (the `jwtSecret` you construct
  *   `PeekAccessService` with)
  * @throws {JsonWebTokenError} signature invalid or token malformed

package/dist/index.js

@@ -2039,8 +2039,13 @@ var GraphQLClient = class {
 };
 var PEEK_TOKEN_ISSUER = "app_registry_v2";
 var PEEK_TOKEN_AUDIENCE = "Joken";
+var BEARER_PREFIX = "bearer ";
+function stripBearer(token) {
+  const trimmed = token.trim();
+  return trimmed.toLowerCase().startsWith(BEARER_PREFIX) ? trimmed.slice(BEARER_PREFIX.length).trim() : trimmed;
+}
 function verifyPeekJwt(token, secret) {
-  return jwt.verify(token, secret, {
+  return jwt.verify(stripBearer(token), secret, {
     issuer: PEEK_TOKEN_ISSUER,
     audience: PEEK_TOKEN_AUDIENCE
   });
@@ -3564,9 +3569,10 @@ var PeekAccessService = class {
    * decoded claims.
    *
    * Validates the HMAC signature (using this service's `jwtSecret`), the token
-   * expiry, the `"app_registry_v2"` issuer, and the `"Joken"` audience. Throws
-   * from the `jsonwebtoken` library on any failure — callers should catch to
-   * distinguish error kinds:
+   * expiry, the `"app_registry_v2"` issuer, and the `"Joken"` audience. Pass the
+   * raw `x-peek-auth` request header value — a leading `Bearer ` prefix, if
+   * present, is stripped for you. Throws from the `jsonwebtoken` library on any
+   * failure — callers should catch to distinguish error kinds:
    *
    * - `JsonWebTokenError` — signature invalid, wrong issuer/audience, or token
    *   malformed