@wix/sdk 1.7.4 → 1.7.6

package/build/auth/WixAppOAuthStrategy.d.ts

@@ -1,5 +1,11 @@
 import { AuthenticationStrategy } from '@wix/sdk-types';
-export type WixAppOAuthStrategy = AuthenticationStrategy & {
+export type WixAppOAuthStrategy = AuthenticationStrategy<undefined, (opts: {
+    instanceId: string;
+} | {
+    refreshToken: string;
+} | {
+    fromRequest: Request;
+}) => WixAppOAuthStrategy> & {
     getInstallUrl(opts: {
         redirectUrl: string;
         state?: string;
@@ -20,6 +26,7 @@ export type WixAppOAuthStrategy = AuthenticationStrategy & {
  * @param opts.appId The Wix App ID
  * @param opts.appSecret The Wix App Secret
  * @param opts.refreshToken An optional refresh token previously retrieved from Wix OAuth API
+ * @param opts.instanceId An optional instance ID of the Wix App instance the client is making requests on behalf of
  * @param opts.publicKey An optional public key for validating webhook requests (supports both PEM and base64 encoded keys)
  * @returns An authentication strategy that can be used with WixClient
  * @example
@@ -54,5 +61,10 @@ export declare function WixAppOAuthStrategy(opts: {
     appId: string;
     appSecret?: string;
     publicKey?: string;
+} & ({
     refreshToken?: string;
-}): WixAppOAuthStrategy;
+} | {
+    instanceId?: string;
+} | {
+    accessToken?: string;
+})): WixAppOAuthStrategy;

package/build/auth/WixAppOAuthStrategy.js

@@ -1,4 +1,4 @@
-import { verify } from 'jsonwebtoken';
+import { jwtVerify, importSPKI } from 'jose';
 import { parsePublicKeyIfEncoded } from '../helpers.js';
 /**
  * Creates an authentication strategy for Wix Apps OAuth installation process.
@@ -7,6 +7,7 @@ import { parsePublicKeyIfEncoded } from '../helpers.js';
  * @param opts.appId The Wix App ID
  * @param opts.appSecret The Wix App Secret
  * @param opts.refreshToken An optional refresh token previously retrieved from Wix OAuth API
+ * @param opts.instanceId An optional instance ID of the Wix App instance the client is making requests on behalf of
  * @param opts.publicKey An optional public key for validating webhook requests (supports both PEM and base64 encoded keys)
  * @returns An authentication strategy that can be used with WixClient
  * @example
@@ -39,7 +40,7 @@ import { parsePublicKeyIfEncoded } from '../helpers.js';
  */
 // eslint-disable-next-line @typescript-eslint/no-redeclare
 export function WixAppOAuthStrategy(opts) {
-    let refreshToken = opts.refreshToken;
+    let refreshToken = 'refreshToken' in opts ? opts.refreshToken : undefined;
     return {
         getInstallUrl({ redirectUrl, token, state }) {
             const params = new URLSearchParams();
@@ -53,6 +54,39 @@ export function WixAppOAuthStrategy(opts) {
             }
             return `https://www.wix.com/installer/install?${params.toString()}`;
         },
+        withAuth(params) {
+            if ('instanceId' in params) {
+                return WixAppOAuthStrategy({
+                    appId: opts.appId,
+                    appSecret: opts.appSecret,
+                    publicKey: opts.publicKey,
+                    instanceId: params.instanceId,
+                });
+            }
+            else if ('refreshToken' in params) {
+                return WixAppOAuthStrategy({
+                    appId: opts.appId,
+                    appSecret: opts.appSecret,
+                    publicKey: opts.publicKey,
+                    refreshToken: params.refreshToken,
+                });
+            }
+            else if ('fromRequest' in params) {
+                const authFromRequest = params.fromRequest.headers.get('Authorization');
+                if (!authFromRequest) {
+                    throw new Error('Missing Authorization header in the request');
+                }
+                return WixAppOAuthStrategy({
+                    appId: opts.appId,
+                    appSecret: opts.appSecret,
+                    publicKey: opts.publicKey,
+                    accessToken: authFromRequest,
+                });
+            }
+            else {
+                throw new Error('Invalid parameters for withAuth');
+            }
+        },
         async handleOAuthCallback(url, oauthOpts) {
             if (!opts.appSecret) {
                 throw new Error('App secret is required for handling OAuth callback. Make sure to pass it to the WixAppOAuthStrategy');
@@ -91,48 +125,82 @@ export function WixAppOAuthStrategy(opts) {
             };
         },
         async getAuthHeaders() {
-            if (!refreshToken) {
-                throw new Error('Missing refresh token. Either pass it to the WixAppOAuthStrategy or use the handleOAuthCallback method to retrieve it.');
-            }
             if (!opts.appSecret) {
-                throw new Error('App secret is required for refreshing access tokens. Make sure to pass it to the WixAppOAuthStrategy');
+                throw new Error('App secret is required for retrieveing app-level access tokens. Make sure to pass it to the WixAppOAuthStrategy');
             }
-            const tokensRes = await fetch('https://www.wixapis.com/oauth/access', {
-                method: 'POST',
-                headers: {
-                    'Content-Type': 'application/json',
-                },
-                body: JSON.stringify({
-                    refresh_token: refreshToken,
-                    client_id: opts.appId,
-                    client_secret: opts.appSecret,
-                    grant_type: 'refresh_token',
-                }),
-            });
-            if (tokensRes.status !== 200) {
-                throw new Error(`Failed to exchange refresh token for access token. Unexpected status code from Wix OAuth API: ${tokensRes.status}`);
+            if ('refreshToken' in opts || refreshToken) {
+                const tokensRes = await fetch('https://www.wixapis.com/oauth/access', {
+                    method: 'POST',
+                    headers: {
+                        'Content-Type': 'application/json',
+                    },
+                    body: JSON.stringify({
+                        refresh_token: refreshToken,
+                        client_id: opts.appId,
+                        client_secret: opts.appSecret,
+                        grant_type: 'refresh_token',
+                    }),
+                });
+                if (tokensRes.status !== 200) {
+                    throw new Error(`Failed to exchange refresh token for access token. Unexpected status code from Wix OAuth API: ${tokensRes.status}`);
+                }
+                const tokens = (await tokensRes.json());
+                refreshToken = tokens.refresh_token;
+                return {
+                    headers: {
+                        Authorization: tokens.access_token,
+                    },
+                };
+            }
+            else if ('instanceId' in opts) {
+                const tokensRes = await fetch('https://www.wixapis.com/oauth2/token', {
+                    method: 'POST',
+                    headers: {
+                        'Content-Type': 'application/json',
+                    },
+                    body: JSON.stringify({
+                        instance_id: opts.instanceId,
+                        client_id: opts.appId,
+                        client_secret: opts.appSecret,
+                        grant_type: 'client_credentials',
+                    }),
+                });
+                if (tokensRes.status !== 200) {
+                    throw new Error(`Failed to exchange instance ID for access token. Unexpected status code from Wix OAuth API: ${tokensRes.status}`);
+                }
+                const tokens = (await tokensRes.json());
+                return {
+                    headers: {
+                        Authorization: tokens.access_token,
+                    },
+                };
+            }
+            else if ('accessToken' in opts && opts.accessToken) {
+                return {
+                    headers: {
+                        Authorization: opts.accessToken,
+                    },
+                };
+            }
+            else {
+                throw new Error('Missing refresh token or instance ID. Either one is needed to get app level access tokens. Make sure to pass one of them to the WixAppOAuthStrategy');
             }
-            const tokens = (await tokensRes.json());
-            refreshToken = tokens.refresh_token;
-            return {
-                headers: {
-                    Authorization: tokens.access_token,
-                },
-            };
         },
-        decodeJWT(token, verifyCallerClaims = false) {
+        async decodeJWT(token, verifyCallerClaims = false) {
             if (!opts.publicKey) {
                 throw new Error('Missing public key. Make sure to pass it to the WixAppOAuthStrategy');
             }
-            const publicKey = parsePublicKeyIfEncoded(opts.publicKey);
-            const decoded = verify(token, publicKey, verifyCallerClaims
+            const publicKey = await importSPKI(parsePublicKeyIfEncoded(opts.publicKey), 'RS256');
+            const decoded = await jwtVerify(token, publicKey, verifyCallerClaims
                 ? {
                     issuer: 'wix.com',
                     audience: opts.appId,
                 }
                 : undefined);
             return {
-                decoded,
+                decoded: {
+                    data: decoded.payload.data,
+                },
                 valid: true,
             };
         },

package/build/auth/oauth2/OAuthStrategy.js

@@ -118,7 +118,7 @@ export function OAuthStrategy(config) {
     const getAuthUrl = async (oauthData, opts = {
         prompt: 'login',
     }) => {
-        return getAuthorizationUrlWithOptions(oauthData, opts.responseMode ?? 'fragment', opts.prompt ?? 'login');
+        return getAuthorizationUrlWithOptions(oauthData, opts.responseMode ?? 'fragment', opts.prompt ?? 'login', opts.sessionToken);
     };
     const parseFromUrl = (url, responseMode = 'fragment') => {
         const parsedUrl = new URL(url ?? window.location.href);

package/build/index.d.ts

@@ -3,6 +3,7 @@ export * from './wixMedia.js';
 export * from './auth/oauth2/OAuthStrategy.js';
 export * from './auth/oauth2/types.js';
 export * from './auth/ApiKeyAuthStrategy.js';
+export * from './auth/WixAppOAuthStrategy.js';
 export * from '@wix/sdk-types';
 export { getDefaultDomain } from './rest-modules.js';
 export { API_URL } from './common.js';

package/build/index.js

@@ -3,6 +3,7 @@ export * from './wixMedia.js';
 export * from './auth/oauth2/OAuthStrategy.js';
 export * from './auth/oauth2/types.js';
 export * from './auth/ApiKeyAuthStrategy.js';
+export * from './auth/WixAppOAuthStrategy.js';
 export * from '@wix/sdk-types';
 export { getDefaultDomain } from './rest-modules.js';
 export { API_URL } from './common.js';

package/build/wixClient.d.ts

@@ -1,4 +1,4 @@
-import { AuthenticationStrategy, BoundAuthenticationStrategy, BuildRESTFunction, Host, HostModule, HostModuleAPI, RESTFunctionDescriptor, EventDefinition, SPIDefinition } from '@wix/sdk-types';
+import { AuthenticationStrategy, BoundAuthenticationStrategy, BuildRESTFunction, Host, HostModule, HostModuleAPI, RESTFunctionDescriptor, SPIDefinition, EventDefinition } from '@wix/sdk-types';
 import { ConditionalExcept, EmptyObject } from 'type-fest';
 import { AmbassadorFunctionDescriptor, BuildAmbassadorFunction } from './ambassador-modules.js';
 import { PublicMetadata } from './common.js';
@@ -54,7 +54,9 @@ type TypedQueryInput<Result = {
 export type WixClient<H extends Host<any> | undefined = undefined, Z extends AuthenticationStrategy<H> = AuthenticationStrategy<H>, T extends Descriptors = Descriptors> = {
     setHeaders(headers: Headers): void;
     auth: Omit<Z, 'getAuthHeaders'> & BoundAuthenticationStrategy;
+    withAuth: Z['withAuth'] extends undefined ? never : (...args: Parameters<NonNullable<Z['withAuth']>>) => WixClient<H, Z, T>;
     fetch(relativeUrl: string, options: RequestInit): Promise<Response>;
+    fetchWithAuth: typeof fetch;
     use<R extends Descriptors = EmptyObject>(modules: H extends Host<any> ? AssertHostMatches<R, H> : R): BuildDescriptors<R, H>;
     graphql<Result, Variables>(query: string | ((string | String) & TypedQueryInput<Result, Variables>), variables?: Variables): Promise<{
         data: Result;
@@ -63,7 +65,7 @@ export type WixClient<H extends Host<any> | undefined = undefined, Z extends Aut
     webhooks: {
         process<ExpectedEvents extends EventDefinition<any>[] = []>(jwt: string, opts?: {
             expectedEvents: ExpectedEvents;
-        }): ProcessedEvent<ExpectedEvents>;
+        }): Promise<ProcessedEvent<ExpectedEvents>>;
         processRequest<ExpectedEvents extends EventDefinition<any>[] = []>(request: Request, opts?: {
             expectedEvents: ExpectedEvents;
         }): Promise<ProcessedEvent<ExpectedEvents>>;
@@ -71,14 +73,14 @@ export type WixClient<H extends Host<any> | undefined = undefined, Z extends Aut
             AppInstalled: EventDefinition<{
                 appId: string;
                 originInstanceId: string;
-            }>;
+            }, 'AppInstalled'>;
             AppRemoved: EventDefinition<{
                 appId: string;
-            }>;
+            }, 'AppRemoved'>;
         };
     };
     spi: <S extends SPIDefinition<any, any>>() => {
-        process(jwt: string): S['__input'];
+        process(jwt: string): Promise<S['__input']>;
         processRequest(request: Request): Promise<S['__input']>;
         result(result: S['__result']): S['__result'];
     };
@@ -95,7 +97,7 @@ export type ProcessedEvent<T extends EventDefinition<any>[] = []> = {
     eventType: string;
     payload: unknown;
 } : ResolvePossibleEvents<T>);
-export declare function createClient<H extends Host<any> | undefined = undefined, Z extends AuthenticationStrategy<H> = AuthenticationStrategy<H>, T extends Descriptors = EmptyObject>(config: {
+export declare function createClient<H extends Host<any> | undefined = undefined, Z extends AuthenticationStrategy<H, any> = AuthenticationStrategy<H>, T extends Descriptors = EmptyObject>(config: {
     modules?: H extends Host<any> ? AssertHostMatches<T, H> : T;
     auth?: Z;
     headers?: Headers;

package/build/wixClient.js

@@ -1,3 +1,4 @@
+import { EventDefinition, } from '@wix/sdk-types';
 import { toHTTPModule, isAmbassadorModule, ambassadorModuleOptions, } from './ambassador-modules.js';
 import { API_URL, PUBLIC_METADATA_KEY } from './common.js';
 import { getDefaultContentHeader, isObject } from './helpers.js';
@@ -61,6 +62,12 @@ export function createClient(config) {
     return {
         ...wrappedModules,
         auth: authStrategy,
+        withAuth: (authStrategy.withAuth
+            ? (...args) => createClient({
+                ...config,
+                auth: authStrategy.withAuth(...args),
+            })
+            : undefined),
         setHeaders,
         use,
         fetch: (relativeUrl, options) => {
@@ -69,6 +76,23 @@ export function createClient(config) {
             finalUrl.protocol = 'https';
             return boundFetch(finalUrl.toString(), options);
         },
+        fetchWithAuth: async (urlOrRequest, requestInit) => {
+            if (typeof urlOrRequest === 'string' || urlOrRequest instanceof URL) {
+                return fetch(urlOrRequest, {
+                    ...requestInit,
+                    headers: {
+                        ...requestInit?.headers,
+                        ...(await boundGetAuthHeaders()).headers,
+                    },
+                });
+            }
+            else {
+                for (const [k, v] of Object.entries((await boundGetAuthHeaders()).headers)) {
+                    urlOrRequest.headers.set(k, v);
+                }
+                return fetch(urlOrRequest, requestInit);
+            }
+        },
         async graphql(query, variables, opts = {
             apiVersion: 'alpha',
         }) {
@@ -86,13 +110,13 @@ export function createClient(config) {
             return { data: data ?? {}, errors };
         },
         webhooks: {
-            process: (jwt, opts = {
+            process: async (jwt, opts = {
                 expectedEvents: [],
             }) => {
                 if (!authStrategy.decodeJWT) {
                     throw new Error('decodeJWT is not supported by the authentication strategy');
                 }
-                const { decoded, valid } = authStrategy.decodeJWT(jwt);
+                const { decoded, valid } = await authStrategy.decodeJWT(jwt);
                 if (!valid) {
                     throw new Error('JWT is not valid');
                 }
@@ -117,23 +141,17 @@ export function createClient(config) {
                 return this.process(body, opts);
             },
             apps: {
-                AppInstalled: {
-                    type: 'AppInstalled',
-                    __payload: void 0,
-                },
-                AppRemoved: {
-                    type: 'AppRemoved',
-                    __payload: void 0,
-                },
+                AppInstalled: EventDefinition('AppInstalled')(),
+                AppRemoved: EventDefinition('AppRemoved')(),
             },
         },
         spi() {
             return {
-                process(jwt) {
+                async process(jwt) {
                     if (!authStrategy.decodeJWT) {
                         throw new Error('decodeJWT is not supported by the authentication strategy');
                     }
-                    const { decoded, valid } = authStrategy.decodeJWT(jwt, true);
+                    const { decoded, valid } = await authStrategy.decodeJWT(jwt, true);
                     if (!valid) {
                         throw new Error('JWT is not valid');
                     }

package/cjs/build/auth/WixAppOAuthStrategy.d.ts

@@ -1,5 +1,11 @@
 import { AuthenticationStrategy } from '@wix/sdk-types';
-export type WixAppOAuthStrategy = AuthenticationStrategy & {
+export type WixAppOAuthStrategy = AuthenticationStrategy<undefined, (opts: {
+    instanceId: string;
+} | {
+    refreshToken: string;
+} | {
+    fromRequest: Request;
+}) => WixAppOAuthStrategy> & {
     getInstallUrl(opts: {
         redirectUrl: string;
         state?: string;
@@ -20,6 +26,7 @@ export type WixAppOAuthStrategy = AuthenticationStrategy & {
  * @param opts.appId The Wix App ID
  * @param opts.appSecret The Wix App Secret
  * @param opts.refreshToken An optional refresh token previously retrieved from Wix OAuth API
+ * @param opts.instanceId An optional instance ID of the Wix App instance the client is making requests on behalf of
  * @param opts.publicKey An optional public key for validating webhook requests (supports both PEM and base64 encoded keys)
  * @returns An authentication strategy that can be used with WixClient
  * @example
@@ -54,5 +61,10 @@ export declare function WixAppOAuthStrategy(opts: {
     appId: string;
     appSecret?: string;
     publicKey?: string;
+} & ({
     refreshToken?: string;
-}): WixAppOAuthStrategy;
+} | {
+    instanceId?: string;
+} | {
+    accessToken?: string;
+})): WixAppOAuthStrategy;

package/cjs/build/auth/WixAppOAuthStrategy.js

@@ -1,7 +1,7 @@
 "use strict";
 Object.defineProperty(exports, "__esModule", { value: true });
 exports.WixAppOAuthStrategy = void 0;
-const jsonwebtoken_1 = require("jsonwebtoken");
+const jose_1 = require("jose");
 const helpers_js_1 = require("../helpers.js");
 /**
  * Creates an authentication strategy for Wix Apps OAuth installation process.
@@ -10,6 +10,7 @@ const helpers_js_1 = require("../helpers.js");
  * @param opts.appId The Wix App ID
  * @param opts.appSecret The Wix App Secret
  * @param opts.refreshToken An optional refresh token previously retrieved from Wix OAuth API
+ * @param opts.instanceId An optional instance ID of the Wix App instance the client is making requests on behalf of
  * @param opts.publicKey An optional public key for validating webhook requests (supports both PEM and base64 encoded keys)
  * @returns An authentication strategy that can be used with WixClient
  * @example
@@ -42,7 +43,7 @@ const helpers_js_1 = require("../helpers.js");
  */
 // eslint-disable-next-line @typescript-eslint/no-redeclare
 function WixAppOAuthStrategy(opts) {
-    let refreshToken = opts.refreshToken;
+    let refreshToken = 'refreshToken' in opts ? opts.refreshToken : undefined;
     return {
         getInstallUrl({ redirectUrl, token, state }) {
             const params = new URLSearchParams();
@@ -56,6 +57,39 @@ function WixAppOAuthStrategy(opts) {
             }
             return `https://www.wix.com/installer/install?${params.toString()}`;
         },
+        withAuth(params) {
+            if ('instanceId' in params) {
+                return WixAppOAuthStrategy({
+                    appId: opts.appId,
+                    appSecret: opts.appSecret,
+                    publicKey: opts.publicKey,
+                    instanceId: params.instanceId,
+                });
+            }
+            else if ('refreshToken' in params) {
+                return WixAppOAuthStrategy({
+                    appId: opts.appId,
+                    appSecret: opts.appSecret,
+                    publicKey: opts.publicKey,
+                    refreshToken: params.refreshToken,
+                });
+            }
+            else if ('fromRequest' in params) {
+                const authFromRequest = params.fromRequest.headers.get('Authorization');
+                if (!authFromRequest) {
+                    throw new Error('Missing Authorization header in the request');
+                }
+                return WixAppOAuthStrategy({
+                    appId: opts.appId,
+                    appSecret: opts.appSecret,
+                    publicKey: opts.publicKey,
+                    accessToken: authFromRequest,
+                });
+            }
+            else {
+                throw new Error('Invalid parameters for withAuth');
+            }
+        },
         async handleOAuthCallback(url, oauthOpts) {
             if (!opts.appSecret) {
                 throw new Error('App secret is required for handling OAuth callback. Make sure to pass it to the WixAppOAuthStrategy');
@@ -94,48 +128,82 @@ function WixAppOAuthStrategy(opts) {
             };
         },
         async getAuthHeaders() {
-            if (!refreshToken) {
-                throw new Error('Missing refresh token. Either pass it to the WixAppOAuthStrategy or use the handleOAuthCallback method to retrieve it.');
-            }
             if (!opts.appSecret) {
-                throw new Error('App secret is required for refreshing access tokens. Make sure to pass it to the WixAppOAuthStrategy');
+                throw new Error('App secret is required for retrieveing app-level access tokens. Make sure to pass it to the WixAppOAuthStrategy');
             }
-            const tokensRes = await fetch('https://www.wixapis.com/oauth/access', {
-                method: 'POST',
-                headers: {
-                    'Content-Type': 'application/json',
-                },
-                body: JSON.stringify({
-                    refresh_token: refreshToken,
-                    client_id: opts.appId,
-                    client_secret: opts.appSecret,
-                    grant_type: 'refresh_token',
-                }),
-            });
-            if (tokensRes.status !== 200) {
-                throw new Error(`Failed to exchange refresh token for access token. Unexpected status code from Wix OAuth API: ${tokensRes.status}`);
+            if ('refreshToken' in opts || refreshToken) {
+                const tokensRes = await fetch('https://www.wixapis.com/oauth/access', {
+                    method: 'POST',
+                    headers: {
+                        'Content-Type': 'application/json',
+                    },
+                    body: JSON.stringify({
+                        refresh_token: refreshToken,
+                        client_id: opts.appId,
+                        client_secret: opts.appSecret,
+                        grant_type: 'refresh_token',
+                    }),
+                });
+                if (tokensRes.status !== 200) {
+                    throw new Error(`Failed to exchange refresh token for access token. Unexpected status code from Wix OAuth API: ${tokensRes.status}`);
+                }
+                const tokens = (await tokensRes.json());
+                refreshToken = tokens.refresh_token;
+                return {
+                    headers: {
+                        Authorization: tokens.access_token,
+                    },
+                };
+            }
+            else if ('instanceId' in opts) {
+                const tokensRes = await fetch('https://www.wixapis.com/oauth2/token', {
+                    method: 'POST',
+                    headers: {
+                        'Content-Type': 'application/json',
+                    },
+                    body: JSON.stringify({
+                        instance_id: opts.instanceId,
+                        client_id: opts.appId,
+                        client_secret: opts.appSecret,
+                        grant_type: 'client_credentials',
+                    }),
+                });
+                if (tokensRes.status !== 200) {
+                    throw new Error(`Failed to exchange instance ID for access token. Unexpected status code from Wix OAuth API: ${tokensRes.status}`);
+                }
+                const tokens = (await tokensRes.json());
+                return {
+                    headers: {
+                        Authorization: tokens.access_token,
+                    },
+                };
+            }
+            else if ('accessToken' in opts && opts.accessToken) {
+                return {
+                    headers: {
+                        Authorization: opts.accessToken,
+                    },
+                };
+            }
+            else {
+                throw new Error('Missing refresh token or instance ID. Either one is needed to get app level access tokens. Make sure to pass one of them to the WixAppOAuthStrategy');
             }
-            const tokens = (await tokensRes.json());
-            refreshToken = tokens.refresh_token;
-            return {
-                headers: {
-                    Authorization: tokens.access_token,
-                },
-            };
         },
-        decodeJWT(token, verifyCallerClaims = false) {
+        async decodeJWT(token, verifyCallerClaims = false) {
             if (!opts.publicKey) {
                 throw new Error('Missing public key. Make sure to pass it to the WixAppOAuthStrategy');
             }
-            const publicKey = (0, helpers_js_1.parsePublicKeyIfEncoded)(opts.publicKey);
-            const decoded = (0, jsonwebtoken_1.verify)(token, publicKey, verifyCallerClaims
+            const publicKey = await (0, jose_1.importSPKI)((0, helpers_js_1.parsePublicKeyIfEncoded)(opts.publicKey), 'RS256');
+            const decoded = await (0, jose_1.jwtVerify)(token, publicKey, verifyCallerClaims
                 ? {
                     issuer: 'wix.com',
                     audience: opts.appId,
                 }
                 : undefined);
             return {
-                decoded,
+                decoded: {
+                    data: decoded.payload.data,
+                },
                 valid: true,
             };
         },

package/cjs/build/auth/oauth2/OAuthStrategy.js

@@ -121,7 +121,7 @@ function OAuthStrategy(config) {
     const getAuthUrl = async (oauthData, opts = {
         prompt: 'login',
     }) => {
-        return getAuthorizationUrlWithOptions(oauthData, opts.responseMode ?? 'fragment', opts.prompt ?? 'login');
+        return getAuthorizationUrlWithOptions(oauthData, opts.responseMode ?? 'fragment', opts.prompt ?? 'login', opts.sessionToken);
     };
     const parseFromUrl = (url, responseMode = 'fragment') => {
         const parsedUrl = new URL(url ?? window.location.href);

package/cjs/build/index.d.ts

@@ -3,6 +3,7 @@ export * from './wixMedia.js';
 export * from './auth/oauth2/OAuthStrategy.js';
 export * from './auth/oauth2/types.js';
 export * from './auth/ApiKeyAuthStrategy.js';
+export * from './auth/WixAppOAuthStrategy.js';
 export * from '@wix/sdk-types';
 export { getDefaultDomain } from './rest-modules.js';
 export { API_URL } from './common.js';

package/cjs/build/index.js

@@ -20,6 +20,7 @@ __exportStar(require("./wixMedia.js"), exports);
 __exportStar(require("./auth/oauth2/OAuthStrategy.js"), exports);
 __exportStar(require("./auth/oauth2/types.js"), exports);
 __exportStar(require("./auth/ApiKeyAuthStrategy.js"), exports);
+__exportStar(require("./auth/WixAppOAuthStrategy.js"), exports);
 __exportStar(require("@wix/sdk-types"), exports);
 var rest_modules_js_1 = require("./rest-modules.js");
 Object.defineProperty(exports, "getDefaultDomain", { enumerable: true, get: function () { return rest_modules_js_1.getDefaultDomain; } });

package/cjs/build/wixClient.d.ts

@@ -1,4 +1,4 @@
-import { AuthenticationStrategy, BoundAuthenticationStrategy, BuildRESTFunction, Host, HostModule, HostModuleAPI, RESTFunctionDescriptor, EventDefinition, SPIDefinition } from '@wix/sdk-types';
+import { AuthenticationStrategy, BoundAuthenticationStrategy, BuildRESTFunction, Host, HostModule, HostModuleAPI, RESTFunctionDescriptor, SPIDefinition, EventDefinition } from '@wix/sdk-types';
 import { ConditionalExcept, EmptyObject } from 'type-fest';
 import { AmbassadorFunctionDescriptor, BuildAmbassadorFunction } from './ambassador-modules.js';
 import { PublicMetadata } from './common.js';
@@ -54,7 +54,9 @@ type TypedQueryInput<Result = {
 export type WixClient<H extends Host<any> | undefined = undefined, Z extends AuthenticationStrategy<H> = AuthenticationStrategy<H>, T extends Descriptors = Descriptors> = {
     setHeaders(headers: Headers): void;
     auth: Omit<Z, 'getAuthHeaders'> & BoundAuthenticationStrategy;
+    withAuth: Z['withAuth'] extends undefined ? never : (...args: Parameters<NonNullable<Z['withAuth']>>) => WixClient<H, Z, T>;
     fetch(relativeUrl: string, options: RequestInit): Promise<Response>;
+    fetchWithAuth: typeof fetch;
     use<R extends Descriptors = EmptyObject>(modules: H extends Host<any> ? AssertHostMatches<R, H> : R): BuildDescriptors<R, H>;
     graphql<Result, Variables>(query: string | ((string | String) & TypedQueryInput<Result, Variables>), variables?: Variables): Promise<{
         data: Result;
@@ -63,7 +65,7 @@ export type WixClient<H extends Host<any> | undefined = undefined, Z extends Aut
     webhooks: {
         process<ExpectedEvents extends EventDefinition<any>[] = []>(jwt: string, opts?: {
             expectedEvents: ExpectedEvents;
-        }): ProcessedEvent<ExpectedEvents>;
+        }): Promise<ProcessedEvent<ExpectedEvents>>;
         processRequest<ExpectedEvents extends EventDefinition<any>[] = []>(request: Request, opts?: {
             expectedEvents: ExpectedEvents;
         }): Promise<ProcessedEvent<ExpectedEvents>>;
@@ -71,14 +73,14 @@ export type WixClient<H extends Host<any> | undefined = undefined, Z extends Aut
             AppInstalled: EventDefinition<{
                 appId: string;
                 originInstanceId: string;
-            }>;
+            }, 'AppInstalled'>;
             AppRemoved: EventDefinition<{
                 appId: string;
-            }>;
+            }, 'AppRemoved'>;
         };
     };
     spi: <S extends SPIDefinition<any, any>>() => {
-        process(jwt: string): S['__input'];
+        process(jwt: string): Promise<S['__input']>;
         processRequest(request: Request): Promise<S['__input']>;
         result(result: S['__result']): S['__result'];
     };
@@ -95,7 +97,7 @@ export type ProcessedEvent<T extends EventDefinition<any>[] = []> = {
     eventType: string;
     payload: unknown;
 } : ResolvePossibleEvents<T>);
-export declare function createClient<H extends Host<any> | undefined = undefined, Z extends AuthenticationStrategy<H> = AuthenticationStrategy<H>, T extends Descriptors = EmptyObject>(config: {
+export declare function createClient<H extends Host<any> | undefined = undefined, Z extends AuthenticationStrategy<H, any> = AuthenticationStrategy<H>, T extends Descriptors = EmptyObject>(config: {
     modules?: H extends Host<any> ? AssertHostMatches<T, H> : T;
     auth?: Z;
     headers?: Headers;

package/cjs/build/wixClient.js

@@ -1,6 +1,7 @@
 "use strict";
 Object.defineProperty(exports, "__esModule", { value: true });
 exports.createClient = void 0;
+const sdk_types_1 = require("@wix/sdk-types");
 const ambassador_modules_js_1 = require("./ambassador-modules.js");
 const common_js_1 = require("./common.js");
 const helpers_js_1 = require("./helpers.js");
@@ -64,6 +65,12 @@ function createClient(config) {
     return {
         ...wrappedModules,
         auth: authStrategy,
+        withAuth: (authStrategy.withAuth
+            ? (...args) => createClient({
+                ...config,
+                auth: authStrategy.withAuth(...args),
+            })
+            : undefined),
         setHeaders,
         use,
         fetch: (relativeUrl, options) => {
@@ -72,6 +79,23 @@ function createClient(config) {
             finalUrl.protocol = 'https';
             return boundFetch(finalUrl.toString(), options);
         },
+        fetchWithAuth: async (urlOrRequest, requestInit) => {
+            if (typeof urlOrRequest === 'string' || urlOrRequest instanceof URL) {
+                return fetch(urlOrRequest, {
+                    ...requestInit,
+                    headers: {
+                        ...requestInit?.headers,
+                        ...(await boundGetAuthHeaders()).headers,
+                    },
+                });
+            }
+            else {
+                for (const [k, v] of Object.entries((await boundGetAuthHeaders()).headers)) {
+                    urlOrRequest.headers.set(k, v);
+                }
+                return fetch(urlOrRequest, requestInit);
+            }
+        },
         async graphql(query, variables, opts = {
             apiVersion: 'alpha',
         }) {
@@ -89,13 +113,13 @@ function createClient(config) {
             return { data: data ?? {}, errors };
         },
         webhooks: {
-            process: (jwt, opts = {
+            process: async (jwt, opts = {
                 expectedEvents: [],
             }) => {
                 if (!authStrategy.decodeJWT) {
                     throw new Error('decodeJWT is not supported by the authentication strategy');
                 }
-                const { decoded, valid } = authStrategy.decodeJWT(jwt);
+                const { decoded, valid } = await authStrategy.decodeJWT(jwt);
                 if (!valid) {
                     throw new Error('JWT is not valid');
                 }
@@ -120,23 +144,17 @@ function createClient(config) {
                 return this.process(body, opts);
             },
             apps: {
-                AppInstalled: {
-                    type: 'AppInstalled',
-                    __payload: void 0,
-                },
-                AppRemoved: {
-                    type: 'AppRemoved',
-                    __payload: void 0,
-                },
+                AppInstalled: (0, sdk_types_1.EventDefinition)('AppInstalled')(),
+                AppRemoved: (0, sdk_types_1.EventDefinition)('AppRemoved')(),
             },
         },
         spi() {
             return {
-                process(jwt) {
+                async process(jwt) {
                     if (!authStrategy.decodeJWT) {
                         throw new Error('decodeJWT is not supported by the authentication strategy');
                     }
-                    const { decoded, valid } = authStrategy.decodeJWT(jwt, true);
+                    const { decoded, valid } = await authStrategy.decodeJWT(jwt, true);
                     if (!valid) {
                         throw new Error('JWT is not valid');
                     }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@wix/sdk",
-  "version": "1.7.4",
+  "version": "1.7.6",
   "license": "UNLICENSED",
   "author": {
     "name": "Ronny Ringel",
@@ -59,12 +59,12 @@
   },
   "dependencies": {
     "@babel/runtime": "^7.23.2",
-    "@wix/identity": "^1.0.72",
-    "@wix/image-kit": "^1.50.0",
+    "@wix/identity": "^1.0.73",
+    "@wix/image-kit": "^1.56.0",
     "@wix/redirects": "^1.0.32",
-    "@wix/sdk-types": "^1.5.6",
+    "@wix/sdk-types": "^1.5.9",
     "crypto-js": "^4.2.0",
-    "jsonwebtoken": "^9.0.2",
+    "jose": "^5.2.1",
     "pkce-challenge": "^3.1.0",
     "querystring": "^0.2.1",
     "type-fest": "^4.9.0"
@@ -75,14 +75,13 @@
   "devDependencies": {
     "@types/crypto-js": "^4.2.1",
     "@types/is-ci": "^3.0.4",
-    "@types/jsonwebtoken": "^9.0.5",
     "@types/node": "^20.10.6",
     "@vitest/ui": "^1.1.3",
-    "@wix/ecom": "^1.0.474",
+    "@wix/ecom": "^1.0.477",
     "@wix/events": "^1.0.145",
     "@wix/metro": "^1.0.73",
-    "@wix/metro-runtime": "^1.1618.0",
-    "@wix/sdk-runtime": "0.2.7",
+    "@wix/metro-runtime": "^1.1635.0",
+    "@wix/sdk-runtime": "0.2.8",
     "eslint": "^8.56.0",
     "eslint-config-sdk": "0.0.0",
     "graphql": "^16.8.0",
@@ -116,5 +115,5 @@
   "wallaby": {
     "autoDetect": true
   },
-  "falconPackageHash": "93a9673030401f9f114208015d7df832e9f3e9b1189763fcd4380c61"
+  "falconPackageHash": "676b313e3902721adc8337cd1542cd05dbe775e43ddee5030eef4706"
 }