@wix/sdk 1.11.1 → 1.12.1

package/build/auth/AppStrategy.d.ts

@@ -1,11 +1,5 @@
 import { AuthenticationStrategy } from '@wix/sdk-types';
-export type AppStrategy = AuthenticationStrategy<undefined, (opts: {
-    instanceId: string;
-} | {
-    refreshToken: string;
-} | {
-    fromRequest: Request;
-}) => AppStrategy> & {
+export type AppStrategy = AuthenticationStrategy<undefined> & {
     getInstallUrl(opts: {
         redirectUrl: string;
         state?: string;
@@ -18,6 +12,7 @@ export type AppStrategy = AuthenticationStrategy<undefined, (opts: {
         accessToken: string;
         refreshToken: string;
     }>;
+    elevated(): Promise<AppStrategy>;
 };
 /**
  * Creates an authentication strategy for Wix Apps OAuth installation process.

package/build/auth/AppStrategy.js

@@ -53,39 +53,6 @@ export function AppStrategy(opts) {
             }
             return `https://www.wix.com/installer/install?${params.toString()}`;
         },
-        withAuth(params) {
-            if ('instanceId' in params) {
-                return AppStrategy({
-                    appId: opts.appId,
-                    appSecret: opts.appSecret,
-                    publicKey: opts.publicKey,
-                    instanceId: params.instanceId,
-                });
-            }
-            else if ('refreshToken' in params) {
-                return AppStrategy({
-                    appId: opts.appId,
-                    appSecret: opts.appSecret,
-                    publicKey: opts.publicKey,
-                    refreshToken: params.refreshToken,
-                });
-            }
-            else if ('fromRequest' in params) {
-                const authFromRequest = params.fromRequest.headers.get('Authorization');
-                if (!authFromRequest) {
-                    throw new Error('Missing Authorization header in the request');
-                }
-                return AppStrategy({
-                    appId: opts.appId,
-                    appSecret: opts.appSecret,
-                    publicKey: opts.publicKey,
-                    accessToken: authFromRequest,
-                });
-            }
-            else {
-                throw new Error('Invalid parameters for withAuth');
-            }
-        },
         async handleOAuthCallback(url, oauthOpts) {
             if (!opts.appSecret) {
                 throw new Error('App secret is required for handling OAuth callback. Make sure to pass it to the AppStrategy');
@@ -185,6 +152,38 @@ export function AppStrategy(opts) {
                 throw new Error('Missing refresh token or instance ID. Either one is needed to get app level access tokens. Make sure to pass one of them to the AppStrategy');
             }
         },
+        async elevated() {
+            if ('accessToken' in opts && opts.accessToken) {
+                const tokenInfoRes = await fetch('https://www.wixapis.com/oauth2/token-info', {
+                    method: 'POST',
+                    headers: {
+                        'Content-Type': 'application/json',
+                    },
+                    body: JSON.stringify({
+                        token: opts.accessToken,
+                    }),
+                });
+                if (tokenInfoRes.status !== 200) {
+                    throw new Error(`Failed to get token info. Unexpected status code from Wix OAuth API: ${tokenInfoRes.status}`);
+                }
+                const tokenInfo = await tokenInfoRes.json();
+                if (tokenInfo.app_id !== opts.appId) {
+                    throw new Error(`Invalid access token. The token is not issued for the app with ID "${opts.appId}"`);
+                }
+                if (!tokenInfo.instanceId) {
+                    throw new Error('Unexpected token info. The token does not contain instance ID');
+                }
+                return AppStrategy({
+                    appId: opts.appId,
+                    appSecret: opts.appSecret,
+                    publicKey: opts.publicKey,
+                    instanceId: tokenInfo.instanceId,
+                });
+            }
+            else {
+                throw new Error('Providing an access token is required to perform elevation. Make sure to pass it to the AppStrategy');
+            }
+        },
         async decodeJWT(token, verifyCallerClaims = false) {
             if (!opts.publicKey) {
                 throw new Error('Missing public key. Make sure to pass it to the AppStrategy');

package/build/auth/oauth2/types.d.ts

@@ -66,6 +66,18 @@ export interface IOAuthStrategy extends AuthenticationStrategy {
     captchaInvisibleSiteKey: string;
     captchaVisibleSiteKey: string;
     loggedIn: () => boolean;
+    /**
+     * Retrieves and authenticates site member's access and refresh tokens given a member ID.
+     * A member ID for external login can be retrieved from the Wix Members API using `queryMembers`
+     * function, using any externally identifiable field (e.g. email, phone number, etc.).
+     *
+     * In addition to the member ID, an API Key with permissions on Wix Contacts & Members is required
+     * (this is an administrative API that bypasses the need for a session token and so can only be used
+     * from confidential clients).
+     * @param memberId The member ID to get the tokens for
+     * @param apiKey An API Key with permissions on Wix Contacts & Members
+     * @returns Tokens (access and refresh) for the member
+     */
     getMemberTokensForExternalLogin: (memberId: string, apiKey: string) => Promise<Tokens>;
 }
 export declare enum LoginState {

package/build/wixClient.d.ts

@@ -29,11 +29,12 @@ type TypedQueryInput<Result = {
 export type WixClient<H extends Host<any> | undefined = undefined, Z extends AuthenticationStrategy<H> = AuthenticationStrategy<H>, T extends Descriptors = {}> = {
     setHeaders(headers: Headers): void;
     auth: Omit<Z, 'getAuthHeaders'> & BoundAuthenticationStrategy;
-    withAuth: Z['withAuth'] extends undefined ? never : (...args: Parameters<NonNullable<Z['withAuth']>>) => WixClient<H, Z, T>;
     fetch(relativeUrl: string, options: RequestInit): Promise<Response>;
     fetchWithAuth: typeof fetch;
     use<R extends Descriptors = EmptyObject>(modules: H extends Host<any> ? AssertHostMatches<R, H> : R): BuildDescriptors<R, H>;
-    enableContext(contextType: ContextType): void;
+    enableContext(contextType: ContextType, opts?: {
+        elevated: boolean;
+    }): void;
     graphql<Result, Variables>(query: string | ((string | String) & TypedQueryInput<Result, Variables>), variables?: Variables): Promise<{
         data: Result;
         errors?: GraphQLFormattedError[];
@@ -46,6 +47,9 @@ export type WixClient<H extends Host<any> | undefined = undefined, Z extends Aut
         processRequest<ExpectedEvents extends EventDefinition<any>[] = []>(request: Request, opts?: {
             expectedEvents: ExpectedEvents;
         }): Promise<ProcessedEvent<ExpectedEvents>>;
+        parseJWT(jwt: string): Promise<ProcessedEvent>;
+        parseRequest(request: Request): Promise<ProcessedEvent>;
+        executeHandlers(event: ProcessedEvent): Promise<void>;
         apps: {
             AppInstalled: EventDefinition<{
                 appId: string;
@@ -66,6 +70,9 @@ export type WixClient<H extends Host<any> | undefined = undefined, Z extends Aut
             body: string;
         }): Promise<unknown>;
         processRequest(request: Request): Promise<Response>;
+        parseJWT(jwt: string): Promise<unknown>;
+        parseRequest(request: Request): Promise<unknown>;
+        executeHandler(servicePluginRequest: ProcessedEvent): Promise<void>;
     };
 } & BuildDescriptors<T, H>;
 type ResolvePossibleEvents<T extends EventDefinition<any>[]> = {
@@ -81,7 +88,7 @@ export type ProcessedEvent<T extends EventDefinition<any>[] = []> = {
     eventType: string;
     payload: unknown;
 } : ResolvePossibleEvents<T>);
-export declare function createClient<H extends Host<any> | undefined = undefined, Z extends AuthenticationStrategy<H, any> = AuthenticationStrategy<H>, T extends Descriptors = EmptyObject>(config: {
+export declare function createClient<H extends Host<any> | undefined = undefined, Z extends AuthenticationStrategy<H> = AuthenticationStrategy<H>, T extends Descriptors = EmptyObject>(config: {
     modules?: H extends Host<any> ? AssertHostMatches<T, H> : T;
     auth?: Z;
     headers?: Headers;

package/build/wixClient.js

@@ -87,25 +87,34 @@ export function createClient(config) {
     return {
         ...wrappedModules,
         auth: authStrategy,
-        withAuth: (authStrategy.withAuth
-            ? (...args) => createClient({
-                ...config,
-                auth: authStrategy.withAuth(...args),
-            })
-            : undefined),
         setHeaders,
         use,
-        enableContext(contextType) {
+        enableContext(contextType, opts = { elevated: false }) {
             if (contextType === 'global') {
                 if (globalThis.__wix_context__ != null) {
-                    globalThis.__wix_context__.client = this;
+                    if (opts.elevated) {
+                        globalThis.__wix_context__.elevatedClient = this;
+                    }
+                    else {
+                        globalThis.__wix_context__.client = this;
+                    }
                 }
                 else {
-                    globalThis.__wix_context__ = { client: this };
+                    if (opts.elevated) {
+                        globalThis.__wix_context__ = { elevatedClient: this };
+                    }
+                    else {
+                        globalThis.__wix_context__ = { client: this };
+                    }
                 }
             }
             else {
-                wixContext.client = this;
+                if (opts.elevated) {
+                    wixContext.elevatedClient = this;
+                }
+                else {
+                    wixContext.client = this;
+                }
             }
         },
         fetch: (relativeUrl, options) => {
@@ -149,26 +158,10 @@ export function createClient(config) {
         },
         webhooks: {
             getRegisteredEvents: () => Array.from(eventHandlers.keys()),
-            process: async (jwt, opts = {
+            async process(jwt, opts = {
                 expectedEvents: [],
-            }) => {
-                if (!authStrategy.decodeJWT) {
-                    throw new Error('decodeJWT is not supported by the authentication strategy');
-                }
-                const { decoded, valid } = await authStrategy.decodeJWT(jwt);
-                if (!valid) {
-                    throw new Error('JWT is not valid');
-                }
-                if (typeof decoded.data !== 'string') {
-                    throw new Error(`Unexpected type of JWT data: expected string, got ${typeof decoded.data}`);
-                }
-                const parsedDecoded = JSON.parse(decoded.data);
-                const eventType = parsedDecoded.eventType;
-                const instanceId = parsedDecoded.instanceId;
-                const identity = parsedDecoded.identity
-                    ? JSON.parse(parsedDecoded.identity)
-                    : undefined;
-                const payload = JSON.parse(parsedDecoded.data);
+            }) {
+                const { eventType, identity, instanceId, payload } = await this.parseJWT(jwt);
                 const allExpectedEvents = [
                     ...opts.expectedEvents,
                     ...Array.from(eventHandlers.keys()).map((type) => ({ type })),
@@ -195,6 +188,49 @@ export function createClient(config) {
                 const body = await request.text();
                 return this.process(body, opts);
             },
+            async parseJWT(jwt) {
+                if (!authStrategy.decodeJWT) {
+                    throw new Error('decodeJWT is not supported by the authentication strategy');
+                }
+                const { decoded, valid } = await authStrategy.decodeJWT(jwt);
+                if (!valid) {
+                    throw new Error('JWT is not valid');
+                }
+                if (typeof decoded.data !== 'string') {
+                    throw new Error(`Unexpected type of JWT data: expected string, got ${typeof decoded.data}`);
+                }
+                const parsedDecoded = JSON.parse(decoded.data);
+                const eventType = parsedDecoded.eventType;
+                const instanceId = parsedDecoded.instanceId;
+                const identity = parsedDecoded.identity
+                    ? JSON.parse(parsedDecoded.identity)
+                    : undefined;
+                const payload = JSON.parse(parsedDecoded.data);
+                return {
+                    instanceId,
+                    eventType,
+                    payload,
+                    identity,
+                };
+            },
+            async parseRequest(request) {
+                const jwt = await request.text();
+                return this.parseJWT(jwt);
+            },
+            async executeHandlers(event) {
+                const allExpectedEvents = Array.from(eventHandlers.keys()).map((type) => ({ type }));
+                if (allExpectedEvents.length > 0 &&
+                    !allExpectedEvents.some(({ type }) => type === event.eventType)) {
+                    throw new Error(`Unexpected event type: ${event.eventType}. Expected one of: ${allExpectedEvents
+                        .map((x) => x.type)
+                        .join(', ')}`);
+                }
+                const handlers = eventHandlers.get(event.eventType) ?? [];
+                await Promise.all(handlers.map(({ eventDefinition, handler }) => runHandler(eventDefinition, handler, event.payload, {
+                    instanceId: event.instanceId,
+                    identity: event.identity,
+                })));
+            },
             apps: {
                 AppInstalled: EventDefinition('AppInstalled')(),
                 AppRemoved: EventDefinition('AppRemoved')(),
@@ -203,10 +239,20 @@ export function createClient(config) {
         servicePlugins: {
             getRegisteredServicePlugins: () => servicePluginsImplementations,
             async process(request) {
+                const servicePluginRequest = await this.parseJWT(request.body);
+                return this.executeHandler(servicePluginRequest, request.url);
+            },
+            async processRequest(request) {
+                const url = request.url;
+                const body = await request.text();
+                const implMethodResult = await this.process({ url, body });
+                return Response.json(implMethodResult);
+            },
+            async parseJWT(jwt) {
                 if (!authStrategy.decodeJWT) {
                     throw new Error('decodeJWT is not supported by the authentication strategy');
                 }
-                const { decoded, valid } = await authStrategy.decodeJWT(request.body, true);
+                const { decoded, valid } = await authStrategy.decodeJWT(jwt, true);
                 if (!valid) {
                     throw new Error('JWT is not valid');
                 }
@@ -219,7 +265,10 @@ export function createClient(config) {
                     typeof decoded.data.metadata.appExtensionType !== 'string') {
                     throw new Error('Unexpected JWT data: expected object with metadata.appExtensionType string');
                 }
-                const componentType = decoded.data?.metadata.appExtensionType.toLowerCase();
+                return decoded.data;
+            },
+            async executeHandler(servicePluginRequest, url) {
+                const componentType = servicePluginRequest.metadata.appExtensionType.toLowerCase();
                 const implementations = servicePluginsImplementations.get(componentType) ?? [];
                 if (implementations.length === 0) {
                     throw new Error(`No service plugin implementations found for component type ${componentType}`);
@@ -228,22 +277,15 @@ export function createClient(config) {
                     throw new Error(`Multiple service plugin implementations found for component type ${componentType}. This is currently not supported`);
                 }
                 const { implementation: impl, servicePluginDefinition } = implementations[0];
-                const method = servicePluginDefinition.methods.find((m) => request.url.endsWith(m.primaryHttpMappingPath));
+                const method = servicePluginDefinition.methods.find((m) => url.endsWith(m.primaryHttpMappingPath));
                 if (!method) {
-                    throw new Error('Unexpect request: request url did not match any method: ' +
-                        request.url);
+                    throw new Error('Unexpect request: request url did not match any method: ' + url);
                 }
                 const implMethod = impl[method.name];
                 if (!implMethod) {
                     throw new Error(`Got request for service plugin method ${method.name} but no implementation was provided. Available methods: ${Object.keys(impl).join(', ')}`);
                 }
-                return method.transformations.toREST(await implMethod(method.transformations.fromREST(decoded.data)));
-            },
-            async processRequest(request) {
-                const url = request.url;
-                const body = await request.text();
-                const implMethodResult = await this.process({ url, body });
-                return Response.json(implMethodResult);
+                return method.transformations.toREST(await implMethod(method.transformations.fromREST(servicePluginRequest)));
             },
         },
     };

package/cjs/build/auth/AppStrategy.d.ts

@@ -1,11 +1,5 @@
 import { AuthenticationStrategy } from '@wix/sdk-types';
-export type AppStrategy = AuthenticationStrategy<undefined, (opts: {
-    instanceId: string;
-} | {
-    refreshToken: string;
-} | {
-    fromRequest: Request;
-}) => AppStrategy> & {
+export type AppStrategy = AuthenticationStrategy<undefined> & {
     getInstallUrl(opts: {
         redirectUrl: string;
         state?: string;
@@ -18,6 +12,7 @@ export type AppStrategy = AuthenticationStrategy<undefined, (opts: {
         accessToken: string;
         refreshToken: string;
     }>;
+    elevated(): Promise<AppStrategy>;
 };
 /**
  * Creates an authentication strategy for Wix Apps OAuth installation process.

package/cjs/build/auth/AppStrategy.js

@@ -79,39 +79,6 @@ function AppStrategy(opts) {
             }
             return `https://www.wix.com/installer/install?${params.toString()}`;
         },
-        withAuth(params) {
-            if ('instanceId' in params) {
-                return AppStrategy({
-                    appId: opts.appId,
-                    appSecret: opts.appSecret,
-                    publicKey: opts.publicKey,
-                    instanceId: params.instanceId,
-                });
-            }
-            else if ('refreshToken' in params) {
-                return AppStrategy({
-                    appId: opts.appId,
-                    appSecret: opts.appSecret,
-                    publicKey: opts.publicKey,
-                    refreshToken: params.refreshToken,
-                });
-            }
-            else if ('fromRequest' in params) {
-                const authFromRequest = params.fromRequest.headers.get('Authorization');
-                if (!authFromRequest) {
-                    throw new Error('Missing Authorization header in the request');
-                }
-                return AppStrategy({
-                    appId: opts.appId,
-                    appSecret: opts.appSecret,
-                    publicKey: opts.publicKey,
-                    accessToken: authFromRequest,
-                });
-            }
-            else {
-                throw new Error('Invalid parameters for withAuth');
-            }
-        },
         async handleOAuthCallback(url, oauthOpts) {
             if (!opts.appSecret) {
                 throw new Error('App secret is required for handling OAuth callback. Make sure to pass it to the AppStrategy');
@@ -211,6 +178,38 @@ function AppStrategy(opts) {
                 throw new Error('Missing refresh token or instance ID. Either one is needed to get app level access tokens. Make sure to pass one of them to the AppStrategy');
             }
         },
+        async elevated() {
+            if ('accessToken' in opts && opts.accessToken) {
+                const tokenInfoRes = await fetch('https://www.wixapis.com/oauth2/token-info', {
+                    method: 'POST',
+                    headers: {
+                        'Content-Type': 'application/json',
+                    },
+                    body: JSON.stringify({
+                        token: opts.accessToken,
+                    }),
+                });
+                if (tokenInfoRes.status !== 200) {
+                    throw new Error(`Failed to get token info. Unexpected status code from Wix OAuth API: ${tokenInfoRes.status}`);
+                }
+                const tokenInfo = await tokenInfoRes.json();
+                if (tokenInfo.app_id !== opts.appId) {
+                    throw new Error(`Invalid access token. The token is not issued for the app with ID "${opts.appId}"`);
+                }
+                if (!tokenInfo.instanceId) {
+                    throw new Error('Unexpected token info. The token does not contain instance ID');
+                }
+                return AppStrategy({
+                    appId: opts.appId,
+                    appSecret: opts.appSecret,
+                    publicKey: opts.publicKey,
+                    instanceId: tokenInfo.instanceId,
+                });
+            }
+            else {
+                throw new Error('Providing an access token is required to perform elevation. Make sure to pass it to the AppStrategy');
+            }
+        },
         async decodeJWT(token, verifyCallerClaims = false) {
             if (!opts.publicKey) {
                 throw new Error('Missing public key. Make sure to pass it to the AppStrategy');

package/cjs/build/auth/oauth2/types.d.ts

@@ -66,6 +66,18 @@ export interface IOAuthStrategy extends AuthenticationStrategy {
     captchaInvisibleSiteKey: string;
     captchaVisibleSiteKey: string;
     loggedIn: () => boolean;
+    /**
+     * Retrieves and authenticates site member's access and refresh tokens given a member ID.
+     * A member ID for external login can be retrieved from the Wix Members API using `queryMembers`
+     * function, using any externally identifiable field (e.g. email, phone number, etc.).
+     *
+     * In addition to the member ID, an API Key with permissions on Wix Contacts & Members is required
+     * (this is an administrative API that bypasses the need for a session token and so can only be used
+     * from confidential clients).
+     * @param memberId The member ID to get the tokens for
+     * @param apiKey An API Key with permissions on Wix Contacts & Members
+     * @returns Tokens (access and refresh) for the member
+     */
     getMemberTokensForExternalLogin: (memberId: string, apiKey: string) => Promise<Tokens>;
 }
 export declare enum LoginState {

package/cjs/build/wixClient.d.ts

@@ -29,11 +29,12 @@ type TypedQueryInput<Result = {
 export type WixClient<H extends Host<any> | undefined = undefined, Z extends AuthenticationStrategy<H> = AuthenticationStrategy<H>, T extends Descriptors = {}> = {
     setHeaders(headers: Headers): void;
     auth: Omit<Z, 'getAuthHeaders'> & BoundAuthenticationStrategy;
-    withAuth: Z['withAuth'] extends undefined ? never : (...args: Parameters<NonNullable<Z['withAuth']>>) => WixClient<H, Z, T>;
     fetch(relativeUrl: string, options: RequestInit): Promise<Response>;
     fetchWithAuth: typeof fetch;
     use<R extends Descriptors = EmptyObject>(modules: H extends Host<any> ? AssertHostMatches<R, H> : R): BuildDescriptors<R, H>;
-    enableContext(contextType: ContextType): void;
+    enableContext(contextType: ContextType, opts?: {
+        elevated: boolean;
+    }): void;
     graphql<Result, Variables>(query: string | ((string | String) & TypedQueryInput<Result, Variables>), variables?: Variables): Promise<{
         data: Result;
         errors?: GraphQLFormattedError[];
@@ -46,6 +47,9 @@ export type WixClient<H extends Host<any> | undefined = undefined, Z extends Aut
         processRequest<ExpectedEvents extends EventDefinition<any>[] = []>(request: Request, opts?: {
             expectedEvents: ExpectedEvents;
         }): Promise<ProcessedEvent<ExpectedEvents>>;
+        parseJWT(jwt: string): Promise<ProcessedEvent>;
+        parseRequest(request: Request): Promise<ProcessedEvent>;
+        executeHandlers(event: ProcessedEvent): Promise<void>;
         apps: {
             AppInstalled: EventDefinition<{
                 appId: string;
@@ -66,6 +70,9 @@ export type WixClient<H extends Host<any> | undefined = undefined, Z extends Aut
             body: string;
         }): Promise<unknown>;
         processRequest(request: Request): Promise<Response>;
+        parseJWT(jwt: string): Promise<unknown>;
+        parseRequest(request: Request): Promise<unknown>;
+        executeHandler(servicePluginRequest: ProcessedEvent): Promise<void>;
     };
 } & BuildDescriptors<T, H>;
 type ResolvePossibleEvents<T extends EventDefinition<any>[]> = {
@@ -81,7 +88,7 @@ export type ProcessedEvent<T extends EventDefinition<any>[] = []> = {
     eventType: string;
     payload: unknown;
 } : ResolvePossibleEvents<T>);
-export declare function createClient<H extends Host<any> | undefined = undefined, Z extends AuthenticationStrategy<H, any> = AuthenticationStrategy<H>, T extends Descriptors = EmptyObject>(config: {
+export declare function createClient<H extends Host<any> | undefined = undefined, Z extends AuthenticationStrategy<H> = AuthenticationStrategy<H>, T extends Descriptors = EmptyObject>(config: {
     modules?: H extends Host<any> ? AssertHostMatches<T, H> : T;
     auth?: Z;
     headers?: Headers;

package/cjs/build/wixClient.js

@@ -90,25 +90,34 @@ function createClient(config) {
     return {
         ...wrappedModules,
         auth: authStrategy,
-        withAuth: (authStrategy.withAuth
-            ? (...args) => createClient({
-                ...config,
-                auth: authStrategy.withAuth(...args),
-            })
-            : undefined),
         setHeaders,
         use,
-        enableContext(contextType) {
+        enableContext(contextType, opts = { elevated: false }) {
             if (contextType === 'global') {
                 if (globalThis.__wix_context__ != null) {
-                    globalThis.__wix_context__.client = this;
+                    if (opts.elevated) {
+                        globalThis.__wix_context__.elevatedClient = this;
+                    }
+                    else {
+                        globalThis.__wix_context__.client = this;
+                    }
                 }
                 else {
-                    globalThis.__wix_context__ = { client: this };
+                    if (opts.elevated) {
+                        globalThis.__wix_context__ = { elevatedClient: this };
+                    }
+                    else {
+                        globalThis.__wix_context__ = { client: this };
+                    }
                 }
             }
             else {
-                sdk_context_1.wixContext.client = this;
+                if (opts.elevated) {
+                    sdk_context_1.wixContext.elevatedClient = this;
+                }
+                else {
+                    sdk_context_1.wixContext.client = this;
+                }
             }
         },
         fetch: (relativeUrl, options) => {
@@ -152,26 +161,10 @@ function createClient(config) {
         },
         webhooks: {
             getRegisteredEvents: () => Array.from(eventHandlers.keys()),
-            process: async (jwt, opts = {
+            async process(jwt, opts = {
                 expectedEvents: [],
-            }) => {
-                if (!authStrategy.decodeJWT) {
-                    throw new Error('decodeJWT is not supported by the authentication strategy');
-                }
-                const { decoded, valid } = await authStrategy.decodeJWT(jwt);
-                if (!valid) {
-                    throw new Error('JWT is not valid');
-                }
-                if (typeof decoded.data !== 'string') {
-                    throw new Error(`Unexpected type of JWT data: expected string, got ${typeof decoded.data}`);
-                }
-                const parsedDecoded = JSON.parse(decoded.data);
-                const eventType = parsedDecoded.eventType;
-                const instanceId = parsedDecoded.instanceId;
-                const identity = parsedDecoded.identity
-                    ? JSON.parse(parsedDecoded.identity)
-                    : undefined;
-                const payload = JSON.parse(parsedDecoded.data);
+            }) {
+                const { eventType, identity, instanceId, payload } = await this.parseJWT(jwt);
                 const allExpectedEvents = [
                     ...opts.expectedEvents,
                     ...Array.from(eventHandlers.keys()).map((type) => ({ type })),
@@ -198,6 +191,49 @@ function createClient(config) {
                 const body = await request.text();
                 return this.process(body, opts);
             },
+            async parseJWT(jwt) {
+                if (!authStrategy.decodeJWT) {
+                    throw new Error('decodeJWT is not supported by the authentication strategy');
+                }
+                const { decoded, valid } = await authStrategy.decodeJWT(jwt);
+                if (!valid) {
+                    throw new Error('JWT is not valid');
+                }
+                if (typeof decoded.data !== 'string') {
+                    throw new Error(`Unexpected type of JWT data: expected string, got ${typeof decoded.data}`);
+                }
+                const parsedDecoded = JSON.parse(decoded.data);
+                const eventType = parsedDecoded.eventType;
+                const instanceId = parsedDecoded.instanceId;
+                const identity = parsedDecoded.identity
+                    ? JSON.parse(parsedDecoded.identity)
+                    : undefined;
+                const payload = JSON.parse(parsedDecoded.data);
+                return {
+                    instanceId,
+                    eventType,
+                    payload,
+                    identity,
+                };
+            },
+            async parseRequest(request) {
+                const jwt = await request.text();
+                return this.parseJWT(jwt);
+            },
+            async executeHandlers(event) {
+                const allExpectedEvents = Array.from(eventHandlers.keys()).map((type) => ({ type }));
+                if (allExpectedEvents.length > 0 &&
+                    !allExpectedEvents.some(({ type }) => type === event.eventType)) {
+                    throw new Error(`Unexpected event type: ${event.eventType}. Expected one of: ${allExpectedEvents
+                        .map((x) => x.type)
+                        .join(', ')}`);
+                }
+                const handlers = eventHandlers.get(event.eventType) ?? [];
+                await Promise.all(handlers.map(({ eventDefinition, handler }) => (0, event_handlers_modules_js_1.runHandler)(eventDefinition, handler, event.payload, {
+                    instanceId: event.instanceId,
+                    identity: event.identity,
+                })));
+            },
             apps: {
                 AppInstalled: (0, sdk_types_1.EventDefinition)('AppInstalled')(),
                 AppRemoved: (0, sdk_types_1.EventDefinition)('AppRemoved')(),
@@ -206,10 +242,20 @@ function createClient(config) {
         servicePlugins: {
             getRegisteredServicePlugins: () => servicePluginsImplementations,
             async process(request) {
+                const servicePluginRequest = await this.parseJWT(request.body);
+                return this.executeHandler(servicePluginRequest, request.url);
+            },
+            async processRequest(request) {
+                const url = request.url;
+                const body = await request.text();
+                const implMethodResult = await this.process({ url, body });
+                return Response.json(implMethodResult);
+            },
+            async parseJWT(jwt) {
                 if (!authStrategy.decodeJWT) {
                     throw new Error('decodeJWT is not supported by the authentication strategy');
                 }
-                const { decoded, valid } = await authStrategy.decodeJWT(request.body, true);
+                const { decoded, valid } = await authStrategy.decodeJWT(jwt, true);
                 if (!valid) {
                     throw new Error('JWT is not valid');
                 }
@@ -222,7 +268,10 @@ function createClient(config) {
                     typeof decoded.data.metadata.appExtensionType !== 'string') {
                     throw new Error('Unexpected JWT data: expected object with metadata.appExtensionType string');
                 }
-                const componentType = decoded.data?.metadata.appExtensionType.toLowerCase();
+                return decoded.data;
+            },
+            async executeHandler(servicePluginRequest, url) {
+                const componentType = servicePluginRequest.metadata.appExtensionType.toLowerCase();
                 const implementations = servicePluginsImplementations.get(componentType) ?? [];
                 if (implementations.length === 0) {
                     throw new Error(`No service plugin implementations found for component type ${componentType}`);
@@ -231,22 +280,15 @@ function createClient(config) {
                     throw new Error(`Multiple service plugin implementations found for component type ${componentType}. This is currently not supported`);
                 }
                 const { implementation: impl, servicePluginDefinition } = implementations[0];
-                const method = servicePluginDefinition.methods.find((m) => request.url.endsWith(m.primaryHttpMappingPath));
+                const method = servicePluginDefinition.methods.find((m) => url.endsWith(m.primaryHttpMappingPath));
                 if (!method) {
-                    throw new Error('Unexpect request: request url did not match any method: ' +
-                        request.url);
+                    throw new Error('Unexpect request: request url did not match any method: ' + url);
                 }
                 const implMethod = impl[method.name];
                 if (!implMethod) {
                     throw new Error(`Got request for service plugin method ${method.name} but no implementation was provided. Available methods: ${Object.keys(impl).join(', ')}`);
                 }
-                return method.transformations.toREST(await implMethod(method.transformations.fromREST(decoded.data)));
-            },
-            async processRequest(request) {
-                const url = request.url;
-                const body = await request.text();
-                const implMethodResult = await this.process({ url, body });
-                return Response.json(implMethodResult);
+                return method.transformations.toREST(await implMethod(method.transformations.fromREST(servicePluginRequest)));
             },
         },
     };

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@wix/sdk",
-  "version": "1.11.1",
+  "version": "1.12.1",
   "license": "UNLICENSED",
   "author": {
     "name": "Ronny Ringel",
@@ -65,11 +65,11 @@
   "dependencies": {
     "@babel/runtime": "^7.23.2",
     "@wix/identity": "^1.0.78",
-    "@wix/image-kit": "^1.70.0",
+    "@wix/image-kit": "^1.71.0",
     "@wix/redirects": "^1.0.41",
     "@wix/sdk-context": "^0.0.1",
-    "@wix/sdk-runtime": "0.3.0",
-    "@wix/sdk-types": "^1.9.0",
+    "@wix/sdk-runtime": "0.3.3",
+    "@wix/sdk-types": "^1.9.1",
     "crypto-js": "^4.2.0",
     "jose": "^5.2.1",
     "pkce-challenge": "^3.1.0",
@@ -88,7 +88,7 @@
     "@wix/events": "^1.0.179",
     "@wix/metro": "^1.0.73",
     "@wix/metro-runtime": "^1.1677.0",
-    "@wix/sdk-runtime": "0.3.0",
+    "@wix/sdk-runtime": "0.3.3",
     "eslint": "^8.56.0",
     "eslint-config-sdk": "0.0.0",
     "graphql": "^16.8.0",
@@ -122,5 +122,5 @@
   "wallaby": {
     "autoDetect": true
   },
-  "falconPackageHash": "463d0e16e85562d2b889feb9295a186f2437388d43ef754d18ab5ad7"
+  "falconPackageHash": "177ec0d44fe0da191345f8a3682db306bf5ed81105ff12431590e217"
 }