Minting search tokens

POST https://api.[tenant].getomneo.com/api/v3/auth/discovery

{
  "rules": {
    "profiles": {},
    "products": {}
  }
}

{
  "data": {
    "token": "[search token]"
  }
}

{
  "rules": {
    "profiles": {
      "filter": "id = 12345"
    }
  }
}

// Node 18+ (built-in fetch). Keep OMNEO_API_TOKEN in server environment variables,
// never in client code.
let cached = null;

function decodeTokenPayload(token) {
  const payload = token.split('.')[1];
  return JSON.parse(Buffer.from(payload, 'base64url').toString('utf8'));
}

export async function getSearchToken() {
  const now = Math.floor(Date.now() / 1000);

  // Refresh 60s before expiry so in-flight searches do not race the expiry.
  if (cached && cached.exp - 60 > now) {
    return cached.token;
  }

  const response = await fetch(
    'https://api.[tenant].getomneo.com/api/v3/auth/discovery',
    {
      method: 'POST',
      headers: {
        Authorization: `Bearer ${process.env.OMNEO_API_TOKEN}`,
        'Content-Type': 'application/json',
        Accept: 'application/json'
      },
      body: JSON.stringify({ rules: { profiles: {} } })
    }
  );

  if (!response.ok) {
    throw new Error(`Search token mint failed: ${response.status}`);
  }

  const { data: { token } } = await response.json();
  cached = { token, exp: decodeTokenPayload(token).exp };
  return token;
}