Act on Behalf of a User

// lib/act-as-user.ts
import { getCachedAccessToken } from './token-cache';

const API_BASE_URL = 'https://api.jtl-cloud.com';

export interface OnBehalfOfToken {
    accessToken: string;
    refreshToken: string;
    expiresIn: number;
}

export async function actAsUser(
    userId: string,
    tenantId: string,
): Promise<OnBehalfOfToken> {
    const accessToken = await getCachedAccessToken();

    const response = await fetch(
        `${API_BASE_URL}/account/identity/act-as-user-token`,
        {
            method: 'POST',
            headers: {
                Authorization: `Bearer ${accessToken}`,
                'Content-Type': 'application/json',
            },
            body: JSON.stringify({ userId, tenantId }),
        },
    );

    if (!response.ok) {
        const error = await response.json().catch(() => null);
        throw new Error(
            `Exchange failed (${response.status}): ${error?.error || 'unknown'}`,
        );
    }

    return response.json();
}

// Services/ActAsUserService.cs
using System.Net.Http.Headers;
using System.Text;
using System.Text.Json;

namespace Backend.Services;

public record OnBehalfOfToken(string AccessToken, string RefreshToken, int ExpiresIn);

public class ActAsUserService
{
    private const string ApiBaseUrl = "https://api.jtl-cloud.com";

    private readonly HttpClient _http;

    public ActAsUserService(HttpClient http)
    {
        _http = http;
    }

    public async Task<OnBehalfOfToken> ActAsUserAsync(string userId, string tenantId)
    {
        var accessToken = await TokenCache.GetCachedAccessTokenAsync();

        var request = new HttpRequestMessage(
            HttpMethod.Post,
            $"{ApiBaseUrl}/account/identity/act-as-user-token");
        request.Headers.Authorization = new AuthenticationHeaderValue("Bearer", accessToken);
        request.Content = new StringContent(
            JsonSerializer.Serialize(new { userId, tenantId }),
            Encoding.UTF8,
            "application/json");

        var response = await _http.SendAsync(request);
        var body = await response.Content.ReadAsStringAsync();

        if (!response.IsSuccessStatusCode)
        {
            throw new HttpRequestException(
                $"Exchange failed ({(int)response.StatusCode}): {body}");
        }

        using var doc = JsonDocument.Parse(body);
        var root = doc.RootElement;

        return new OnBehalfOfToken(
            root.GetProperty("accessToken").GetString()!,
            root.GetProperty("refreshToken").GetString()!,
            root.GetProperty("expiresIn").GetInt32());
    }
}

<?php
// src/Jtl/ActAsUser.php
declare(strict_types=1);

namespace App\Jtl;

use GuzzleHttp\Client;
use RuntimeException;

final class ActAsUser
{
    private const API_BASE_URL = 'https://api.jtl-cloud.com';

    public function __construct(private readonly Client $httpClient) {}

    public function actAsUser(string $userId, string $tenantId): array
    {
        $accessToken = TokenCache::getCachedAccessToken();

        $response = $this->httpClient->post(
            self::API_BASE_URL . '/account/identity/act-as-user-token',
            [
                'headers' => [
                    'Authorization' => "Bearer {$accessToken}",
                    'Content-Type' => 'application/json',
                ],
                'json' => [
                    'userId' => $userId,
                    'tenantId' => $tenantId,
                ],
                'http_errors' => false,
            ]
        );

        $body = (string) $response->getBody();

        if ($response->getStatusCode() >= 400) {
            throw new RuntimeException(
                "Exchange failed ({$response->getStatusCode()}): {$body}"
            );
        }

        return json_decode($body, true, flags: JSON_THROW_ON_ERROR);
    }
}