@brightweblabs/core-auth 0.1.1 → 0.2.0

package/package.json

@@ -1,9 +1,7 @@
 {
   "name": "@brightweblabs/core-auth",
   "private": false,
-  "version": "0.1.1",
-  "main": "./src/index.ts",
-  "types": "./src/index.ts",
+  "version": "0.2.0",
   "files": [
     "src"
   ],
@@ -16,15 +14,16 @@
     "access": "public"
   },
   "exports": {
-    ".": "./src/index.ts",
     "./client": "./src/client.ts",
-    "./server": "./src/server.ts"
+    "./server": "./src/server.ts",
+    "./shared": "./src/shared.ts"
   },
   "dependencies": {
-    "@brightweblabs/infra": "^0.1.0",
-    "@supabase/supabase-js": "^2.89.0"
+    "next": "16.1.1",
+    "@supabase/supabase-js": "^2.89.0",
+    "@brightweblabs/infra": "0.1.1"
   },
   "peerDependencies": {
     "react": "^19.0.0"
   }
-}
+}

package/src/client.ts

@@ -2,13 +2,6 @@
 
 import { useCallback, useEffect, useRef, useState } from "react";
 
-export const AUTH_RESEND_COOLDOWN_SECONDS = 60;
-
-export interface PasswordValidationResult {
-  isValid: boolean;
-  errors: string[];
-}
-
 interface CooldownTimerResult {
   remaining: number;
   isCoolingDown: boolean;
@@ -16,57 +9,6 @@ interface CooldownTimerResult {
   reset: () => void;
 }
 
-export function getAuthBaseUrl(): string {
-  const configuredUrl = process.env.NEXT_PUBLIC_APP_URL?.trim();
-  if (!configuredUrl) {
-    throw new Error("Falta NEXT_PUBLIC_APP_URL para redirecionamentos de email de autenticação.");
-  }
-
-  try {
-    return new URL(configuredUrl).toString().replace(/\/$/, "");
-  } catch {
-    throw new Error("NEXT_PUBLIC_APP_URL inválido. Esperado URL absoluto (ex.: https://exemplo.com).");
-  }
-}
-
-export function buildSignupCallbackUrl(): string {
-  return new URL("auth/callback", `${getAuthBaseUrl()}/`).toString();
-}
-
-export function buildResetPasswordRedirectUrl(): string {
-  return `${getAuthBaseUrl()}/reset-password`;
-}
-
-export function validatePassword(password: string): PasswordValidationResult {
-  const errors: string[] = [];
-
-  if (password.length < 8) {
-    errors.push("A palavra-passe deve ter pelo menos 8 caracteres");
-  }
-
-  if (!/[A-Z]/.test(password)) {
-    errors.push("A palavra-passe deve conter pelo menos uma letra maiúscula");
-  }
-
-  if (!/[a-z]/.test(password)) {
-    errors.push("A palavra-passe deve conter pelo menos uma letra minúscula");
-  }
-
-  if (!/[0-9]/.test(password)) {
-    errors.push("A palavra-passe deve conter pelo menos um número");
-  }
-
-  return {
-    isValid: errors.length === 0,
-    errors,
-  };
-}
-
-export function validateEmail(email: string): boolean {
-  const emailRegex = /^[^\s@]+@[^\s@]+\.[^\s@]+$/;
-  return emailRegex.test(email.trim().toLowerCase());
-}
-
 export function useCooldownTimer(durationSeconds: number): CooldownTimerResult {
   const [remaining, setRemaining] = useState(0);
   const intervalRef = useRef<ReturnType<typeof setInterval> | null>(null);

package/src/server.ts

@@ -1,7 +1,12 @@
 import type { User } from "@supabase/supabase-js";
+import { redirect } from "next/navigation";
 import { createServerSupabase } from "@brightweblabs/infra/server";
-
-export type GlobalRole = "client" | "staff" | "admin";
+import {
+  canAccessInsightsCms,
+  normalizeGlobalRole,
+  resolvePostLoginPath,
+  type GlobalRole,
+} from "./shared";
 
 type Profile = {
   id: string;
@@ -29,31 +34,21 @@ type ServerRoleAccess =
     error: string;
   };
 
-const INSIGHTS_CMS_ALLOWED_ROLES: GlobalRole[] = ["admin"];
-const DASHBOARD_LANDING_ROLES: GlobalRole[] = ["staff", "admin"];
-
-export function normalizeGlobalRole(value: string | null | undefined): GlobalRole | null {
-  const normalizedValue = (value ?? "").trim().toLowerCase();
-  if (normalizedValue === "client" || normalizedValue === "staff" || normalizedValue === "admin") {
-    return normalizedValue;
+type ServerUserAccess =
+  | {
+    ok: true;
+    supabase: Awaited<ReturnType<typeof createServerSupabase>>;
+    user: User;
+    profileId: string;
+    role: GlobalRole | null;
   }
+  | {
+    ok: false;
+    status: number;
+    error: string;
+  };
 
-  return null;
-}
-
-export function canAccessInsightsCms(role: string | null | undefined): boolean {
-  const normalizedRole = normalizeGlobalRole(role);
-  return normalizedRole !== null && INSIGHTS_CMS_ALLOWED_ROLES.some((allowedRole) => allowedRole === normalizedRole);
-}
-
-export function resolvePostLoginPath(role: string | null | undefined): "/dashboard" | "/account" {
-  const normalizedRole = normalizeGlobalRole(role);
-  const shouldLandOnDashboard = normalizedRole !== null
-    && DASHBOARD_LANDING_ROLES.some((allowedRole) => allowedRole === normalizedRole);
-  return shouldLandOnDashboard ? "/dashboard" : "/account";
-}
-
-export async function requireServerRoleAccess(allowedRoles: GlobalRole | GlobalRole[]): Promise<ServerRoleAccess> {
+export async function requireServerUserAccess(): Promise<ServerUserAccess> {
   const supabase = await createServerSupabase();
   const {
     data: { user },
@@ -64,9 +59,81 @@ export async function requireServerRoleAccess(allowedRoles: GlobalRole | GlobalR
     return { ok: false, status: 401, error: "Não autorizado." };
   }
 
+  const { profileId, error: profileError } = await getProfileIdForUser(supabase, user.id);
+  if (!profileId) {
+    return { ok: false, status: 409, error: profileError ?? "Perfil em falta." };
+  }
+
   const { data: roleRaw } = await supabase.rpc("current_global_role");
   const role = normalizeGlobalRole(typeof roleRaw === "string" ? roleRaw : null);
 
+  return { ok: true, supabase, user, profileId, role };
+}
+
+export async function requireServerPageAccess(): Promise<{
+  supabase: Awaited<ReturnType<typeof createServerSupabase>>;
+  user: User;
+  profileId: string;
+  role: GlobalRole | null;
+}> {
+  const access = await requireServerUserAccess();
+
+  if (!access.ok) {
+    if (access.status === 401) {
+      redirect("/login");
+    }
+
+    if (access.status === 409) {
+      redirect("/account");
+    }
+
+    throw new Error(access.error);
+  }
+
+  return access;
+}
+
+export async function requireServerPageRoleAccess(
+  allowedRoles: GlobalRole | GlobalRole[],
+): Promise<{
+  supabase: Awaited<ReturnType<typeof createServerSupabase>>;
+  user: User;
+  role: GlobalRole;
+}> {
+  const access = await requireServerUserAccess();
+
+  if (!access.ok) {
+    if (access.status === 401) {
+      redirect("/login");
+    }
+
+    if (access.status === 409) {
+      redirect("/account");
+    }
+
+    throw new Error(access.error);
+  }
+
+  const allowed = Array.isArray(allowedRoles) ? allowedRoles : [allowedRoles];
+  if (!access.role || !allowed.includes(access.role)) {
+    redirect(resolvePostLoginPath(access.role));
+  }
+
+  return {
+    supabase: access.supabase,
+    user: access.user,
+    role: access.role,
+  };
+}
+
+export async function requireServerRoleAccess(allowedRoles: GlobalRole | GlobalRole[]): Promise<ServerRoleAccess> {
+  const access = await requireServerUserAccess();
+  if (!access.ok) {
+    return access;
+  }
+
+  const { supabase, user, role } = access;
+
   if (!role) {
     return { ok: false, status: 403, error: "Acesso proibido." };
   }

package/src/shared.ts

@@ -0,0 +1,83 @@
+export const AUTH_RESEND_COOLDOWN_SECONDS = 60;
+
+export interface PasswordValidationResult {
+  isValid: boolean;
+  errors: string[];
+}
+
+export type GlobalRole = "client" | "staff" | "admin";
+
+const INSIGHTS_CMS_ALLOWED_ROLES: GlobalRole[] = ["admin"];
+const DASHBOARD_LANDING_ROLES: GlobalRole[] = ["staff", "admin"];
+
+export function getAuthBaseUrl(): string {
+  const configuredUrl = process.env.NEXT_PUBLIC_APP_URL?.trim();
+  if (!configuredUrl) {
+    throw new Error("Falta NEXT_PUBLIC_APP_URL para redirecionamentos de email de autenticação.");
+  }
+
+  try {
+    return new URL(configuredUrl).toString().replace(/\/$/, "");
+  } catch {
+    throw new Error("NEXT_PUBLIC_APP_URL inválido. Esperado URL absoluto (ex.: https://exemplo.com).");
+  }
+}
+
+export function buildSignupCallbackUrl(): string {
+  return new URL("auth/callback", `${getAuthBaseUrl()}/`).toString();
+}
+
+export function buildResetPasswordRedirectUrl(): string {
+  return `${getAuthBaseUrl()}/reset-password`;
+}
+
+export function validatePassword(password: string): PasswordValidationResult {
+  const errors: string[] = [];
+
+  if (password.length < 8) {
+    errors.push("A palavra-passe deve ter pelo menos 8 caracteres");
+  }
+
+  if (!/[A-Z]/.test(password)) {
+    errors.push("A palavra-passe deve conter pelo menos uma letra maiúscula");
+  }
+
+  if (!/[a-z]/.test(password)) {
+    errors.push("A palavra-passe deve conter pelo menos uma letra minúscula");
+  }
+
+  if (!/[0-9]/.test(password)) {
+    errors.push("A palavra-passe deve conter pelo menos um número");
+  }
+
+  return {
+    isValid: errors.length === 0,
+    errors,
+  };
+}
+
+export function validateEmail(email: string): boolean {
+  const emailRegex = /^[^\s@]+@[^\s@]+\.[^\s@]+$/;
+  return emailRegex.test(email.trim().toLowerCase());
+}
+
+export function normalizeGlobalRole(value: string | null | undefined): GlobalRole | null {
+  const normalizedValue = (value ?? "").trim().toLowerCase();
+  if (normalizedValue === "client" || normalizedValue === "staff" || normalizedValue === "admin") {
+    return normalizedValue;
+  }
+
+  return null;
+}
+
+export function canAccessInsightsCms(role: string | null | undefined): boolean {
+  const normalizedRole = normalizeGlobalRole(role);
+  return normalizedRole !== null && INSIGHTS_CMS_ALLOWED_ROLES.some((allowedRole) => allowedRole === normalizedRole);
+}
+
+export function resolvePostLoginPath(role: string | null | undefined): "/dashboard" | "/account" {
+  const normalizedRole = normalizeGlobalRole(role);
+  const shouldLandOnDashboard = normalizedRole !== null
+    && DASHBOARD_LANDING_ROLES.some((allowedRole) => allowedRole === normalizedRole);
+  return shouldLandOnDashboard ? "/dashboard" : "/account";
+}

package/src/index.ts

@@ -1 +0,0 @@
-export * from "./client";