@rage-against-the-pixel/app-store-connect-api 3.7.0 → 3.7.1

package/README.md

@@ -1,5 +1,7 @@
 # app-store-connect-api
 
+[![Discord](https://img.shields.io/discord/855294214065487932.svg?label=&logo=discord&logoColor=ffffff&color=7389D8&labelColor=6A7EC2)](https://discord.gg/xQgMW9ufN4) [![NPM Version](https://img.shields.io/npm/v/%40rage-against-the-pixel%2Fapp-store-connect-api)](https://www.npmjs.com/package/@rage-against-the-pixel/app-store-connect-api) [![NPM Downloads](https://img.shields.io/npm/dw/%40rage-against-the-pixel%2Fapp-store-connect-api)](https://www.npmjs.com/package/@rage-against-the-pixel/app-store-connect-api)
+
 A TypeScript package for communicating with Apple [App Store Connect API](https://developer.apple.com/documentation/appstoreconnectapi)
 
 - Automatically generated API client using the latest [OpenAPI specification](https://developer.apple.com/sample-code/app-store-connect/app-store-connect-openapi-specification.zip) from Apple.
@@ -20,6 +22,9 @@ Download and save the private key `.p8` file to a save, secure location.
 The contents of this file is your `privateKey`.
 The `privateKeyId` and `issuerId` are both listed on the same page where you create your private key.
 
+> [!NOTE]
+> Individual keys do not require `issuerId`.
+
 ## Example
 
 ```ts

package/dist/client.d.ts

@@ -41,5 +41,10 @@ declare class AppStoreConnectClient {
      * @see https://developer.apple.com/documentation/appstoreconnectapi/generating_tokens_for_api_requests
     */
     private generateAuthToken;
+    /**
+     * Generates a user auth token for authenticating with the App Store Connect API.
+     * @see https://developer.apple.com/documentation/appstoreconnectapi/generating-tokens-for-api-requests#Create-the-JWT-Payload-for-Individual-Keys
+     */
+    private generateUserAuthToken;
 }
 export { AppStoreConnectOptions, AppStoreConnectClient };

package/dist/client.js

@@ -15,13 +15,23 @@ var __setModuleDefault = (this && this.__setModuleDefault) || (Object.create ? (
 }) : function(o, v) {
     o["default"] = v;
 });
-var __importStar = (this && this.__importStar) || function (mod) {
-    if (mod && mod.__esModule) return mod;
-    var result = {};
-    if (mod != null) for (var k in mod) if (k !== "default" && Object.prototype.hasOwnProperty.call(mod, k)) __createBinding(result, mod, k);
-    __setModuleDefault(result, mod);
-    return result;
-};
+var __importStar = (this && this.__importStar) || (function () {
+    var ownKeys = function(o) {
+        ownKeys = Object.getOwnPropertyNames || function (o) {
+            var ar = [];
+            for (var k in o) if (Object.prototype.hasOwnProperty.call(o, k)) ar[ar.length] = k;
+            return ar;
+        };
+        return ownKeys(o);
+    };
+    return function (mod) {
+        if (mod && mod.__esModule) return mod;
+        var result = {};
+        if (mod != null) for (var k = ownKeys(mod), i = 0; i < k.length; i++) if (k[i] !== "default") __createBinding(result, mod, k[i]);
+        __setModuleDefault(result, mod);
+        return result;
+    };
+})();
 var __importDefault = (this && this.__importDefault) || function (mod) {
     return (mod && mod.__esModule) ? mod : { "default": mod };
 };
@@ -51,14 +61,13 @@ class AppStoreConnectClient {
             this.bearerToken = this.appStoreConnectOptions.bearerToken;
         }
         else {
-            if (this.appStoreConnectOptions.privateKeyId &&
-                this.appStoreConnectOptions.issuerId &&
-                (this.appStoreConnectOptions.privateKey || this.appStoreConnectOptions.privateKeyFile)) {
+            const { privateKeyId, issuerId, privateKey, privateKeyFile, expirationTime } = this.appStoreConnectOptions;
+            if (privateKeyId && (privateKey || privateKeyFile)) {
                 const defaultExpirationTime = 600; // 10 minutes
-                const expirationTime = this.appStoreConnectOptions.expirationTime ?? defaultExpirationTime;
-                if (!this.bearerToken || this.bearerTokenGeneratedAt + expirationTime * 1000 < Date.now()) {
-                    if (this.appStoreConnectOptions.privateKeyFile) {
-                        const fileHandle = await fs_1.default.promises.open(this.appStoreConnectOptions.privateKeyFile, 'r');
+                const tokenExpirationTime = expirationTime ?? defaultExpirationTime;
+                if (!this.bearerToken || this.bearerTokenGeneratedAt + tokenExpirationTime * 1000 < Date.now()) {
+                    if (privateKeyFile) {
+                        const fileHandle = await fs_1.default.promises.open(privateKeyFile, fs_1.default.constants.O_RDONLY);
                         try {
                             this.appStoreConnectOptions.privateKey = await fileHandle.readFile('utf8');
                         }
@@ -66,7 +75,13 @@ class AppStoreConnectClient {
                             await fileHandle.close();
                         }
                     }
-                    this.bearerToken = await this.generateAuthToken(this.appStoreConnectOptions.issuerId, this.appStoreConnectOptions.privateKeyId, this.appStoreConnectOptions.privateKey, expirationTime);
+                    if (issuerId) {
+                        this.bearerToken = await this.generateAuthToken(issuerId, privateKeyId, this.appStoreConnectOptions.privateKey, tokenExpirationTime);
+                    }
+                    else {
+                        this.bearerToken = await this.generateUserAuthToken(privateKeyId, this.appStoreConnectOptions.privateKey, tokenExpirationTime);
+                    }
+                    this.bearerTokenGeneratedAt = Date.now();
                 }
             }
             else {
@@ -80,12 +95,27 @@ class AppStoreConnectClient {
      * @see https://developer.apple.com/documentation/appstoreconnectapi/generating_tokens_for_api_requests
     */
     async generateAuthToken(issuerId, privateKeyId, privateKey, expirationTime) {
-        const alg = "ES256";
+        const alg = 'ES256';
         const key = await jose.importPKCS8(privateKey, alg);
         const token = await new jose.SignJWT({})
-            .setProtectedHeader({ alg, kid: privateKeyId, typ: "JWT" })
+            .setProtectedHeader({ alg, kid: privateKeyId, typ: 'JWT' })
             .setIssuer(issuerId)
-            .setAudience("appstoreconnect-v1")
+            .setAudience('appstoreconnect-v1')
+            .setExpirationTime(new Date(Date.now() + expirationTime * 1000))
+            .sign(key);
+        return token;
+    }
+    /**
+     * Generates a user auth token for authenticating with the App Store Connect API.
+     * @see https://developer.apple.com/documentation/appstoreconnectapi/generating-tokens-for-api-requests#Create-the-JWT-Payload-for-Individual-Keys
+     */
+    async generateUserAuthToken(privateKeyId, privateKey, expirationTime) {
+        const alg = 'ES256';
+        const key = await jose.importPKCS8(privateKey, alg);
+        const token = await new jose.SignJWT({})
+            .setProtectedHeader({ alg, kid: privateKeyId, typ: 'JWT' })
+            .setSubject('user')
+            .setAudience('appstoreconnect-v1')
             .setExpirationTime(new Date(Date.now() + expirationTime * 1000))
             .sign(key);
         return token;

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@rage-against-the-pixel/app-store-connect-api",
-  "version": "3.7.0",
+  "version": "3.7.1",
   "description": "A TypeScript package for communicating with Apple App Store Connect API",
   "author": "RageAgainstThePixel",
   "license": "MIT",
@@ -46,4 +46,4 @@
     "@hey-api/client-fetch": "^0.4.1",
     "jose": "^5.9.4"
   }
-}
+}