Customers and Auth

1. User signs up in your identity provider (Auth0, Clerk, ...)
   ↓
2. Your provider fires a post-signup webhook
   ↓
3. Your backend receives the webhook
   ↓
4. Backend calls POST /v1/customers with the user's profile + their upstream id
       client.customers.createCustomer({
         requestBody: {
           email, name, phone,
           external_id: 'auth0|66a3f8c2b1d9c204a1f7e3d1',
         }
       })
   ↓
5. Galactic Core returns { customer } — store customer.id alongside the
   upstream user record (or rely on external_id for lookups)
   ↓
6. For every subsequent order / cart / review, your backend passes
   customer_id to the relevant Galactic Core endpoint

// On signup webhook from Auth0
await client.customers.createCustomer({
  requestBody: {
    email: user.email,
    name: user.name,
    external_id: user.sub, // Auth0 subject — store it
  }
});

// Later, in any backend code that needs the Galactic Core customer:
// 1. You stored the GC customer.id when you created it → use that directly.
// 2. Or, store only the external_id and look up the GC customer when needed
//    via your own DB / cache, or by fetching `/v1/customers?external_id=…`
//    once that filter ships.

X-External-Auth: <base64url(JSON)>.<base64url(HMAC-SHA256(JSON))>

{
  "external_id": "auth0|66a3f8c2b1d9c204a1f7e3d1",
  "iat": 1780045000,
  "exp": 1780045300
}

import { createHmac } from 'node:crypto';

function signCustomerAssertion(externalId: string, hmacSecret: string) {
  const now = Math.floor(Date.now() / 1000);
  const claim = JSON.stringify({
    external_id: externalId,
    iat: now,
    exp: now + 240, // 4 minutes — well inside the 300s cap
  });
  const b64url = (b: Buffer) => b.toString('base64url');
  const sig = createHmac('sha256', hmacSecret).update(claim).digest();
  return `${b64url(Buffer.from(claim))}.${b64url(sig)}`;
}

// On a request from your storefront:
async function handleCustomerProfileFetch(req, res) {
  // 1. Verify the customer's session in YOUR identity provider
  const upstreamUser = await yourProvider.verifySession(req);
  if (!upstreamUser) return res.status(401).end();

  // 2. Sign the assertion for Galactic Core
  const assertion = signCustomerAssertion(upstreamUser.id, process.env.GC_HMAC_SECRET!);

  // 3. Call Galactic Core on the customer's behalf
  const r = await fetch(`https://api.tybritelabs.com/v1/customers/${gcCustomerId}`, {
    headers: {
      'Authorization': `Bearer ${process.env.GC_SECRET_KEY}`,
      'x-external-auth': assertion,
    },
  });
  return res.json(await r.json());
}