@geekapps/auth-nextjs 0.12.0 → 0.14.0

package/dist/connections.js

@@ -1,10 +1,803 @@
+// src/connections.ts
+import { createHash as createHash2, randomBytes as randomBytes2 } from "crypto";
+import { buildModel, fetchRemoteCatalog, renderAugmentation, toRegistry } from "@geekapps/auth-cli/lib";
+import { cookies as cookies2 } from "next/headers";
+import { redirect as redirect2 } from "next/navigation";
+
 // src/server.ts
 import { createHash, randomBytes } from "crypto";
 import { cookies, headers } from "next/headers";
 import { redirect } from "next/navigation";
 import { NextResponse } from "next/server";
 import { createRemoteJWKSet, jwtVerify } from "jose";
+var GeekappsSessionExpiredError = class extends Error {
+  code = "session_expired";
+  constructor(message = "A sess\xE3o expirou ou foi revogada. Entre novamente.") {
+    super(message);
+    this.name = "GeekappsSessionExpiredError";
+  }
+};
 var GEEKAPPS_AUTH_SERVER_URL = "https://accounts-api.geekapps.com.br";
+var MAX_ACCOUNTS = 8;
+function normalizeBaseUrl(url) {
+  return url.replace(/\/$/, "");
+}
+function normalizeBasePath(path = "/api/auth") {
+  if (!path.startsWith("/")) return `/${path}`;
+  return path.replace(/\/$/, "");
+}
+function createUrl(baseUrl, path) {
+  if (/^https?:\/\//.test(path)) return path;
+  const normalizedPath = path.startsWith("/") ? path : `/${path}`;
+  return `${normalizeBaseUrl(baseUrl)}${normalizedPath}`;
+}
+function env(name) {
+  const value = process.env[name];
+  return value && value.trim().length > 0 ? value : void 0;
+}
+function resolveIssuer(input) {
+  return normalizeBaseUrl(
+    input.issuer ?? env("GEEKAPPS_AUTH_SERVER_ISSUER") ?? env("GEEKAPPS_AUTH_SERVER_URL") ?? // Deprecated: kept for backwards compatibility during the auth-server rename.
+    env("GEEKAPPS_AUTH_ISSUER") ?? env("GEEKAPPS_AUTH_API_URL") ?? GEEKAPPS_AUTH_SERVER_URL
+  );
+}
+function resolveClientId(input) {
+  return input.clientId ?? env("GEEKAPPS_AUTH_CLIENT_ID") ?? "";
+}
+function resolveClientSecret(input) {
+  return input.clientSecret ?? env("GEEKAPPS_AUTH_CLIENT_SECRET");
+}
+function applyClientCredentials(url, config) {
+  if (!config.clientId || !config.clientSecret) return;
+  url.searchParams.set("client_id", config.clientId);
+  url.searchParams.set("client_secret", config.clientSecret);
+}
+function resolveConfiguredRedirectUri(input) {
+  return input.redirectUri ?? env("GEEKAPPS_AUTH_REDIRECT_URI");
+}
+function hashClientId(clientId) {
+  let h = 5381;
+  for (let i = 0; i < clientId.length; i++) {
+    h = (h << 5) + h ^ clientId.charCodeAt(i) & 255;
+    h = h >>> 0;
+  }
+  return h.toString(16).padStart(8, "0");
+}
+function deriveCookiePrefix(clientId) {
+  if (!clientId) return "gk";
+  return `gk_${hashClientId(clientId)}`;
+}
+function requestOrigin(request) {
+  const configured = env("GEEKAPPS_APP_URL");
+  if (configured) return configured.replace(/\/$/, "");
+  if (request.nextUrl?.origin) return request.nextUrl.origin;
+  throw new Error(
+    "Cannot determine app origin. Set GEEKAPPS_APP_URL or ensure request.nextUrl is available."
+  );
+}
+function resolveRedirectUri(config, request) {
+  return config.redirectUri ?? `${requestOrigin(request)}${config.basePath}/callback`;
+}
+function tokenFromResponse(data) {
+  return {
+    accessToken: data.accessToken ?? data.access_token ?? data.tokens?.accessToken ?? data.tokens?.access_token ?? null,
+    refreshToken: data.refreshToken ?? data.refresh_token ?? data.tokens?.refreshToken ?? data.tokens?.refresh_token ?? null,
+    idToken: data.idToken ?? data.id_token ?? data.tokens?.idToken ?? data.tokens?.id_token ?? null,
+    sessionId: data.sessionId ?? data.session_id ?? data.tokens?.sessionId ?? data.tokens?.session_id ?? null
+  };
+}
+function decodeJwtPayload(token) {
+  try {
+    const parts = token.split(".");
+    if (parts.length < 2) return null;
+    const payload = parts[1];
+    if (!payload) return null;
+    return JSON.parse(Buffer.from(payload, "base64url").toString("utf8"));
+  } catch {
+    return null;
+  }
+}
+function parseAccountFromJwt(tokens) {
+  if (!tokens.accessToken) return null;
+  const jwtToParse = tokens.idToken ?? tokens.accessToken;
+  const payload = decodeJwtPayload(jwtToParse);
+  if (!payload) return null;
+  const sub = typeof payload.sub === "string" ? payload.sub : null;
+  const id = sub ?? tokens.sessionId;
+  if (!id) return null;
+  return {
+    id,
+    accessToken: tokens.accessToken,
+    refreshToken: tokens.refreshToken,
+    idToken: tokens.idToken ?? null,
+    sessionId: tokens.sessionId,
+    user: {
+      sub: id,
+      name: typeof payload.name === "string" ? payload.name : null,
+      email: typeof payload.email === "string" ? payload.email : null,
+      picture: typeof payload.picture === "string" ? payload.picture : null,
+      phone: typeof payload.phone_number === "string" ? payload.phone_number : null
+    }
+  };
+}
+function getCookieNames(prefix) {
+  return {
+    active: `${prefix}_active`,
+    count: `${prefix}_count`,
+    activeOrganizationId: `${prefix}_ao`,
+    tokenPub: `${prefix}_tp`,
+    pkceVerifier: `${prefix}_pkce`,
+    slotMeta: (n) => `${prefix}_m${n}`,
+    slotAt: (n) => `${prefix}_at${n}`,
+    slotRt: (n) => `${prefix}_rt${n}`
+  };
+}
+function generateCodeVerifier() {
+  return randomBytes(64).toString("base64url");
+}
+function createCodeChallenge(codeVerifier) {
+  return createHash("sha256").update(codeVerifier).digest("base64url");
+}
+function encodeMeta(account) {
+  const m = { id: account.id };
+  if (account.sessionId) m.sid = account.sessionId;
+  if (account.user.name) m.n = account.user.name;
+  if (account.user.email) m.e = account.user.email;
+  if (account.user.picture) m.p = account.user.picture;
+  return Buffer.from(JSON.stringify(m), "utf8").toString("base64url");
+}
+function decodeMeta(value) {
+  try {
+    const m = JSON.parse(Buffer.from(value, "base64url").toString("utf8"));
+    return m.id ? m : null;
+  } catch {
+    return null;
+  }
+}
+function getCookieOptions(config) {
+  return {
+    httpOnly: true,
+    secure: config.secureCookies ?? process.env.NODE_ENV === "production",
+    sameSite: "lax",
+    path: "/"
+  };
+}
+async function readBody(request) {
+  const text = await request.text();
+  if (!text) return void 0;
+  try {
+    return JSON.parse(text);
+  } catch {
+    return text;
+  }
+}
+function appendSearchParams(url, request) {
+  const target = new URL(url);
+  request.nextUrl.searchParams.forEach((value, key) => {
+    target.searchParams.set(key, value);
+  });
+  return target.toString();
+}
+function routeFromRequest(request, basePath) {
+  const pathname = request.nextUrl.pathname;
+  if (!pathname.startsWith(basePath)) return pathname;
+  const route = pathname.slice(basePath.length);
+  return route || "/";
+}
+function isJsonResponse(response) {
+  return response.headers.get("content-type")?.includes("application/json");
+}
+async function responseFromApi(response) {
+  if (response.status === 204) return new NextResponse(null, { status: 204 });
+  const body = isJsonResponse(response) ? await response.json().catch(() => null) : await response.text();
+  return NextResponse.json(body, { status: response.status });
+}
+var _remoteJWKSCache = /* @__PURE__ */ new Map();
+function getRemoteJWKS(issuer) {
+  if (!_remoteJWKSCache.has(issuer)) {
+    _remoteJWKSCache.set(issuer, createRemoteJWKSet(new URL(`${issuer}/.well-known/jwks.json`)));
+  }
+  return _remoteJWKSCache.get(issuer);
+}
+async function verifyToken(token, issuer) {
+  try {
+    const { payload } = await jwtVerify(token, getRemoteJWKS(issuer), {
+      algorithms: ["RS256"],
+      issuer
+    });
+    return payload;
+  } catch {
+    return null;
+  }
+}
+function configureGeekappsAuth(input = {}) {
+  const clientId = resolveClientId(input);
+  const config = {
+    ...input,
+    issuer: resolveIssuer(input),
+    clientId,
+    clientSecret: resolveClientSecret(input),
+    redirectUri: resolveConfiguredRedirectUri(input),
+    afterSignInRedirectTo: input.afterSignInRedirectTo ?? input.redirectTo ?? "/",
+    basePath: normalizeBasePath(input.basePath),
+    cookiePrefix: deriveCookiePrefix(clientId)
+  };
+  const cn = getCookieNames(config.cookiePrefix);
+  async function getCount() {
+    const cookieStore = await cookies();
+    const raw = cookieStore.get(cn.count)?.value;
+    const n = raw ? Number.parseInt(raw, 10) : 0;
+    return Number.isNaN(n) ? 0 : n;
+  }
+  async function getActiveIndex() {
+    const cookieStore = await cookies();
+    const raw = cookieStore.get(cn.active)?.value;
+    if (!raw) return 0;
+    const n = Number.parseInt(raw, 10);
+    return Number.isNaN(n) ? 0 : n;
+  }
+  function readSlot(cookieStore, n) {
+    const at = cookieStore.get(cn.slotAt(n))?.value;
+    if (!at) return null;
+    const meta = decodeMeta(cookieStore.get(cn.slotMeta(n))?.value ?? "");
+    if (!meta) return null;
+    return {
+      id: meta.id,
+      accessToken: at,
+      refreshToken: cookieStore.get(cn.slotRt(n))?.value ?? null,
+      idToken: null,
+      // not stored in cookies; claims are in meta
+      sessionId: meta.sid ?? null,
+      user: {
+        sub: meta.id,
+        name: meta.n ?? null,
+        email: meta.e ?? null,
+        picture: meta.p ?? null
+      }
+    };
+  }
+  function writeSlot(cookieStore, n, account) {
+    const opts = { ...getCookieOptions(config), maxAge: 60 * 60 * 24 * 30 };
+    cookieStore.set(cn.slotMeta(n), encodeMeta(account), opts);
+    cookieStore.set(cn.slotAt(n), account.accessToken, opts);
+    if (account.refreshToken) cookieStore.set(cn.slotRt(n), account.refreshToken, opts);
+  }
+  function clearSlot(cookieStore, n) {
+    const clear = { ...getCookieOptions(config), maxAge: 0 };
+    cookieStore.set(cn.slotMeta(n), "", clear);
+    cookieStore.set(cn.slotAt(n), "", clear);
+    cookieStore.set(cn.slotRt(n), "", clear);
+  }
+  async function getAccountsList() {
+    const [cookieStore, count] = await Promise.all([cookies(), getCount()]);
+    const accounts = [];
+    for (let i = 1; i <= count; i++) {
+      const slot = readSlot(cookieStore, i);
+      if (slot) accounts.push(slot);
+    }
+    return accounts;
+  }
+  async function getActiveAccount() {
+    const [cookieStore, activeIdx, count] = await Promise.all([cookies(), getActiveIndex(), getCount()]);
+    if (count === 0) return null;
+    if (activeIdx >= 1 && activeIdx <= count) {
+      const slot = readSlot(cookieStore, activeIdx);
+      if (slot) return slot;
+    }
+    return readSlot(cookieStore, 1);
+  }
+  async function getAccessToken() {
+    try {
+      const hdrs = await headers();
+      const auth = hdrs.get("authorization");
+      if (auth?.startsWith("Bearer ")) return auth.slice(7);
+    } catch {
+    }
+    const active = await getActiveAccount();
+    return active?.accessToken ?? null;
+  }
+  async function getRefreshToken() {
+    const active = await getActiveAccount();
+    return active?.refreshToken ?? null;
+  }
+  async function getSession() {
+    const active = await getActiveAccount();
+    if (!active) return null;
+    return {
+      accessToken: active.accessToken,
+      refreshToken: active.refreshToken,
+      idToken: active.idToken,
+      sessionId: active.sessionId
+    };
+  }
+  async function getUser() {
+    const active = await getActiveAccount();
+    return active?.user ?? null;
+  }
+  async function getUserById(userId, applicationId) {
+    const qs = new URLSearchParams({ ...applicationId ? { applicationId } : {} });
+    try {
+      return await apiRequest(`/users/${userId}?${qs}`);
+    } catch {
+      return null;
+    }
+  }
+  async function getOrganizations() {
+    const cookieStore = await cookies();
+    const currentOrgId = cookieStore.get(cn.activeOrganizationId)?.value ?? null;
+    try {
+      const data = await apiRequest("/organizations");
+      const organizations = Array.isArray(data) ? data : data.organizations;
+      return { organizations, currentOrgId };
+    } catch {
+      return { organizations: [], currentOrgId };
+    }
+  }
+  function clearPublicTokenCookie(cookieStore) {
+    if (cookieStore.get(cn.tokenPub)?.value) {
+      cookieStore.set(cn.tokenPub, "", { httpOnly: false, maxAge: 0, path: "/" });
+    }
+  }
+  async function saveAccountToList(tokens) {
+    const account = parseAccountFromJwt(tokens);
+    if (!account) return;
+    const cookieStore = await cookies();
+    const opts = { ...getCookieOptions(config), maxAge: 60 * 60 * 24 * 30 };
+    const count = await getCount();
+    let targetSlot = 0;
+    for (let i = 1; i <= count; i++) {
+      const existing = readSlot(cookieStore, i);
+      if (existing?.id === account.id) {
+        targetSlot = i;
+        break;
+      }
+    }
+    if (targetSlot === 0) {
+      if (count >= MAX_ACCOUNTS) return;
+      targetSlot = count + 1;
+      cookieStore.set(cn.count, String(targetSlot), opts);
+    }
+    writeSlot(cookieStore, targetSlot, account);
+    cookieStore.set(cn.active, String(targetSlot), opts);
+    clearPublicTokenCookie(cookieStore);
+  }
+  const setSessionCookies = saveAccountToList;
+  async function switchAccount(accountId) {
+    const [cookieStore, count] = await Promise.all([cookies(), getCount()]);
+    const opts = { ...getCookieOptions(config), maxAge: 60 * 60 * 24 * 30 };
+    for (let i = 1; i <= count; i++) {
+      const slot = readSlot(cookieStore, i);
+      if (slot && (slot.id === accountId || slot.sessionId === accountId)) {
+        cookieStore.set(cn.active, String(i), opts);
+        clearPublicTokenCookie(cookieStore);
+        return true;
+      }
+    }
+    return false;
+  }
+  async function removeActiveAccount() {
+    const [cookieStore, activeIdx, count] = await Promise.all([cookies(), getActiveIndex(), getCount()]);
+    const opts = { ...getCookieOptions(config), maxAge: 60 * 60 * 24 * 30 };
+    const clear = { ...getCookieOptions(config), maxAge: 0 };
+    if (count === 0) return;
+    const remaining = [];
+    for (let i = 1; i <= count; i++) {
+      if (i === activeIdx) continue;
+      const slot = readSlot(cookieStore, i);
+      if (slot) remaining.push(slot);
+    }
+    for (let i = 1; i <= count; i++) {
+      clearSlot(cookieStore, i);
+    }
+    if (remaining.length === 0) {
+      cookieStore.set(cn.count, "0", clear);
+      cookieStore.set(cn.active, "0", clear);
+      await clearPublicTokenCookie(cookieStore);
+      return;
+    }
+    for (let i = 0; i < remaining.length; i++) {
+      await writeSlot(cookieStore, i + 1, remaining[i]);
+    }
+    cookieStore.set(cn.count, String(remaining.length), opts);
+    cookieStore.set(cn.active, "1", opts);
+    clearPublicTokenCookie(cookieStore);
+  }
+  async function clearAllSessionCookies() {
+    const [cookieStore, count] = await Promise.all([cookies(), getCount()]);
+    const clear = { ...getCookieOptions(config), maxAge: 0 };
+    for (let i = 1; i <= count; i++) {
+      clearSlot(cookieStore, i);
+    }
+    cookieStore.set(cn.count, "0", clear);
+    cookieStore.set(cn.active, "0", clear);
+    clearPublicTokenCookie(cookieStore);
+  }
+  async function tryRefreshTokens() {
+    const refreshToken = await getRefreshToken();
+    if (!refreshToken || !config.clientId) return null;
+    const basicAuth = Buffer.from(`${config.clientId}:${config.clientSecret ?? ""}`).toString("base64");
+    const response = await fetch(createUrl(config.issuer, "/auth/token"), {
+      method: "POST",
+      headers: {
+        "content-type": "application/x-www-form-urlencoded",
+        authorization: `Basic ${basicAuth}`
+      },
+      body: new URLSearchParams({
+        grant_type: "refresh_token",
+        refresh_token: refreshToken
+      }),
+      cache: "no-store"
+    });
+    if (!response.ok) return null;
+    const data = await response.json().catch(() => null);
+    if (!data) return null;
+    const tokens = tokenFromResponse(data);
+    if (!tokens.accessToken) return null;
+    await saveAccountToList(tokens);
+    return tokens.accessToken;
+  }
+  async function apiRequest(path, init = {}) {
+    const accessToken = await getAccessToken();
+    const requestHeaders = new Headers(init.headers);
+    if (accessToken) requestHeaders.set("authorization", `Bearer ${accessToken}`);
+    if (init.body !== void 0 && !requestHeaders.has("content-type")) {
+      requestHeaders.set("content-type", "application/json");
+    }
+    const url = new URL(createUrl(config.issuer, path));
+    applyClientCredentials(url, config);
+    const response = await fetch(url, {
+      ...init,
+      headers: requestHeaders,
+      cache: "no-store"
+    });
+    if (response.status === 401) {
+      const newAccessToken = await tryRefreshTokens();
+      if (!newAccessToken) {
+        await clearAllSessionCookies().catch(() => {
+        });
+        throw new GeekappsSessionExpiredError();
+      }
+      if (newAccessToken) {
+        const retryHeaders = new Headers(init.headers);
+        retryHeaders.set("authorization", `Bearer ${newAccessToken}`);
+        if (init.body !== void 0 && !retryHeaders.has("content-type")) {
+          retryHeaders.set("content-type", "application/json");
+        }
+        const retryUrl = new URL(createUrl(config.issuer, path));
+        applyClientCredentials(retryUrl, config);
+        const retryResponse = await fetch(retryUrl, {
+          ...init,
+          headers: retryHeaders,
+          cache: "no-store"
+        });
+        if (!retryResponse.ok) {
+          const error = await retryResponse.json().catch(() => null);
+          throw new Error(error?.error_description ?? error?.error ?? error?.message ?? `Auth API error ${retryResponse.status}`);
+        }
+        if (retryResponse.status === 204) return null;
+        return await retryResponse.json();
+      }
+    }
+    if (!response.ok) {
+      const error = await response.json().catch(() => null);
+      throw new Error(error?.error_description ?? error?.error ?? error?.message ?? `Auth API error ${response.status}`);
+    }
+    if (response.status === 204) return null;
+    return await response.json();
+  }
+  function createApiClient() {
+    return {
+      get: (path) => apiRequest(path),
+      post: (path, body) => apiRequest(path, { method: "POST", body: body === void 0 ? void 0 : JSON.stringify(body) }),
+      patch: (path, body) => apiRequest(path, { method: "PATCH", body: body === void 0 ? void 0 : JSON.stringify(body) }),
+      put: (path, body) => apiRequest(path, { method: "PUT", body: body === void 0 ? void 0 : JSON.stringify(body) }),
+      delete: (path) => apiRequest(path, { method: "DELETE" })
+    };
+  }
+  async function requireUser(options = {}) {
+    const accessToken = await getAccessToken();
+    if (!accessToken) {
+      redirect(options.redirectTo ?? "/");
+    }
+    return accessToken;
+  }
+  function escapeHtml(str) {
+    return str.replace(/&/g, "&amp;").replace(/</g, "&lt;").replace(/>/g, "&gt;").replace(/"/g, "&quot;");
+  }
+  function sanitizeRedirectTo(value) {
+    const raw = value ?? "/";
+    if (raw.startsWith(config.basePath)) return "/";
+    if (raw.startsWith("/") && !raw.startsWith("//")) return raw;
+    return "/";
+  }
+  async function createAuthorizeRedirect(request, mode) {
+    const redirectTo = sanitizeRedirectTo(request.nextUrl.searchParams.get("redirectTo") ?? config.afterSignInRedirectTo);
+    const flowId = request.nextUrl.searchParams.get("flow_id");
+    const url = new URL(createUrl(config.issuer, mode === "google" ? "/auth/google" : "/authorize"));
+    if (!config.clientId) {
+      return NextResponse.json(
+        { error: "missing_client_id", message: "Missing GEEKAPPS_AUTH_CLIENT_ID or clientId." },
+        { status: 500 }
+      );
+    }
+    url.searchParams.set("client_id", config.clientId);
+    url.searchParams.set("redirect_uri", resolveRedirectUri(config, request));
+    url.searchParams.set("response_type", "code");
+    const scopes = config.scopes ?? ["openid", "profile", "email"];
+    if (!scopes.includes("offline_access")) scopes.push("offline_access");
+    url.searchParams.set("scope", scopes.join(" "));
+    url.searchParams.set("state", Buffer.from(JSON.stringify({ redirectTo, mode })).toString("base64url"));
+    if (mode === "register") url.searchParams.set("screen_hint", "signup");
+    if (mode === "add-account") {
+      url.searchParams.set("prompt", "login");
+    } else {
+      const prompt = request.nextUrl.searchParams.get("prompt");
+      const silentLogin = request.nextUrl.searchParams.get("silentLogin");
+      const resolvedPrompt = prompt ?? (silentLogin === "false" ? "login" : null);
+      if (resolvedPrompt) url.searchParams.set("prompt", resolvedPrompt);
+    }
+    if (flowId) url.searchParams.set("flow_id", flowId);
+    const codeVerifier = generateCodeVerifier();
+    url.searchParams.set("code_challenge", createCodeChallenge(codeVerifier));
+    url.searchParams.set("code_challenge_method", "S256");
+    const response = NextResponse.redirect(url);
+    const cn2 = getCookieNames(config.cookiePrefix);
+    response.cookies.set(cn2.pkceVerifier, codeVerifier, {
+      ...getCookieOptions(config),
+      maxAge: 60 * 10
+    });
+    return response;
+  }
+  async function exchangeCode(request) {
+    const code = request.nextUrl.searchParams.get("code");
+    const state = request.nextUrl.searchParams.get("state");
+    const origin = requestOrigin(request);
+    if (!code) {
+      const err = request.nextUrl.searchParams.get("error") ?? "missing_code";
+      const desc = request.nextUrl.searchParams.get("error_description") ?? request.nextUrl.searchParams.get("error_message") ?? "No authorization code received";
+      return NextResponse.redirect(new URL(`${config.basePath}/callback?error=${encodeURIComponent(err)}&error_description=${encodeURIComponent(desc)}`, origin));
+    }
+    if (!config.clientId) {
+      return NextResponse.redirect(new URL(`${config.basePath}/callback?error=missing_client_id&error_description=Auth+client+is+not+configured`, origin));
+    }
+    const basicAuth = Buffer.from(
+      `${config.clientId}:${config.clientSecret ?? ""}`
+    ).toString("base64");
+    const cn2 = getCookieNames(config.cookiePrefix);
+    const cookieStore = await cookies();
+    const codeVerifier = cookieStore.get(cn2.pkceVerifier)?.value;
+    cookieStore.set(cn2.pkceVerifier, "", { ...getCookieOptions(config), maxAge: 0 });
+    const tokenBody = new URLSearchParams({
+      grant_type: "authorization_code",
+      code,
+      redirect_uri: resolveRedirectUri(config, request)
+    });
+    if (codeVerifier) tokenBody.set("code_verifier", codeVerifier);
+    const response = await fetch(createUrl(config.issuer, "/auth/token"), {
+      method: "POST",
+      headers: {
+        "content-type": "application/x-www-form-urlencoded",
+        authorization: `Basic ${basicAuth}`
+      },
+      body: tokenBody,
+      cache: "no-store"
+    });
+    const data = await response.json().catch(() => ({}));
+    if (!response.ok) {
+      const error = encodeURIComponent(data.error ?? "token_exchange_failed");
+      const desc = encodeURIComponent(data.error_description ?? `Token exchange failed with status ${response.status}`);
+      return NextResponse.redirect(new URL(`${config.basePath}/callback?error=${error}&error_description=${desc}`, origin));
+    }
+    await saveAccountToList(tokenFromResponse(data));
+    let redirectTo = sanitizeRedirectTo(config.afterSignInRedirectTo);
+    if (state) {
+      try {
+        const parsed = JSON.parse(Buffer.from(state, "base64url").toString("utf8"));
+        redirectTo = sanitizeRedirectTo(parsed.redirectTo);
+      } catch {
+      }
+    }
+    return NextResponse.redirect(new URL(redirectTo, origin));
+  }
+  function mapLocalPathToApiPath(route) {
+    if (route === "/me") return "/auth/me";
+    if (route === "/accounts/switch") return "/auth/accounts/switch";
+    if (route === "/organizations/active") return "/auth/organizations/active";
+    if (route === "/permissions/check") return "/auth/permissions/check";
+    if (route === "/login/password") return "/auth/login/password";
+    if (route === "/register/password") return "/auth/register/password";
+    if (route === "/passwordless/link") return "/auth/passwordless/link";
+    return route;
+  }
+  async function handleAccountsLocal() {
+    const [accounts, activeIdx] = await Promise.all([getAccountsList(), getActiveIndex()]);
+    return NextResponse.json({
+      accounts: accounts.map((a, i) => ({
+        id: a.id,
+        sessionId: a.sessionId ?? a.id,
+        isActive: i + 1 === activeIdx,
+        user: {
+          id: a.user.sub,
+          name: a.user.name ?? null,
+          email: a.user.email ?? null,
+          imageUrl: a.user.picture ?? null,
+          phone: a.user.phone ?? null
+        }
+      }))
+    });
+  }
+  async function handleOrganizationsLocal() {
+    const cookieStore = await cookies();
+    const activeOrgId = cookieStore.get(cn.activeOrganizationId)?.value ?? null;
+    try {
+      const data = await apiRequest("/organizations");
+      const organizations = Array.isArray(data) ? data : data.organizations;
+      return NextResponse.json({ organizations, currentOrgId: activeOrgId });
+    } catch {
+      return NextResponse.json({ organizations: [], currentOrgId: activeOrgId });
+    }
+  }
+  async function handleSwitchAccountLocal(request) {
+    const body = await readBody(request);
+    const targetId = body && typeof body === "object" ? String(
+      body.accountId ?? body.sessionId ?? ""
+    ) : "";
+    if (!targetId) {
+      return NextResponse.json({ error: "accountId required" }, { status: 400 });
+    }
+    const switched = await switchAccount(targetId);
+    if (!switched) {
+      return NextResponse.json({ error: "Account not found" }, { status: 404 });
+    }
+    return NextResponse.json({ ok: true });
+  }
+  async function proxy(request, route) {
+    const accessToken = await getAccessToken();
+    const body = ["GET", "HEAD"].includes(request.method) ? void 0 : await readBody(request);
+    const url = new URL(appendSearchParams(createUrl(config.issuer, mapLocalPathToApiPath(route)), request));
+    applyClientCredentials(url, config);
+    const requestHeaders = new Headers();
+    if (accessToken) requestHeaders.set("authorization", `Bearer ${accessToken}`);
+    if (body !== void 0) requestHeaders.set("content-type", "application/json");
+    let response = await fetch(url, {
+      method: request.method,
+      headers: requestHeaders,
+      body: body === void 0 ? void 0 : typeof body === "string" ? body : JSON.stringify(body),
+      cache: "no-store"
+    });
+    if (response.status === 401) {
+      const refreshed = await tryRefreshTokens();
+      if (refreshed) {
+        requestHeaders.set("authorization", `Bearer ${refreshed}`);
+        response = await fetch(url, {
+          method: request.method,
+          headers: requestHeaders,
+          body: body === void 0 ? void 0 : typeof body === "string" ? body : JSON.stringify(body),
+          cache: "no-store"
+        });
+      } else {
+        await clearAllSessionCookies().catch(() => {
+        });
+        return NextResponse.json(
+          { error: "session_expired" },
+          { status: 401 }
+        );
+      }
+    }
+    const data = isJsonResponse(response) ? await response.json().catch(() => null) : null;
+    if (data) {
+      const tokens = tokenFromResponse(data);
+      if (tokens.accessToken || tokens.refreshToken || tokens.idToken || tokens.sessionId) {
+        await saveAccountToList(tokens);
+      }
+      return NextResponse.json(data, { status: response.status });
+    }
+    return responseFromApi(response);
+  }
+  async function handle(request) {
+    const route = routeFromRequest(request, config.basePath);
+    if (request.method === "GET" && route === "/sign-in") return createAuthorizeRedirect(request, "login");
+    if (request.method === "GET" && route === "/sign-up") return createAuthorizeRedirect(request, "register");
+    if (request.method === "GET" && route === "/add-account") return createAuthorizeRedirect(request, "add-account");
+    if (request.method === "GET" && route === "/login/google") return createAuthorizeRedirect(request, "google");
+    if (request.method === "GET" && route === "/callback") {
+      const error = request.nextUrl.searchParams.get("error");
+      if (error) {
+        const description = request.nextUrl.searchParams.get("error_description") ?? request.nextUrl.searchParams.get("error_message") ?? "An authentication error occurred.";
+        return new NextResponse(
+          `<!doctype html><html><head><meta charset="utf-8"><title>Authentication Error</title></head><body style="font-family:sans-serif;max-width:480px;margin:80px auto;padding:0 16px"><h2>Authentication Error</h2><p><strong>${escapeHtml(error)}</strong></p><p>${escapeHtml(description)}</p><a href="/">Go back</a></body></html>`,
+          { status: 400, headers: { "content-type": "text/html; charset=utf-8" } }
+        );
+      }
+      return exchangeCode(request);
+    }
+    if (request.method === "GET" && route === "/token") {
+      const accessToken = await getAccessToken();
+      if (!accessToken) return NextResponse.json({ error: "missing_token" }, { status: 401 });
+      return NextResponse.json({ accessToken });
+    }
+    if (request.method === "GET" && route === "/accounts") return handleAccountsLocal();
+    if (request.method === "POST" && route === "/accounts/switch") return handleSwitchAccountLocal(request);
+    if (request.method === "GET" && route === "/organizations") return handleOrganizationsLocal();
+    if (request.method === "POST" && route === "/organizations") {
+      const accessToken = await getAccessToken();
+      const body = await readBody(request);
+      if (body && accessToken && !body.applicationId) {
+        const claims = decodeJwtPayload(accessToken);
+        const applicationId = (typeof claims?.application_id === "string" ? claims.application_id : null) ?? (typeof claims?.client_id === "string" ? claims.client_id : null) ?? (typeof claims?.applicationId === "string" ? claims.applicationId : null);
+        if (applicationId) body.applicationId = applicationId;
+      }
+      const orgUrl = new URL(createUrl(config.issuer, "/organizations"));
+      applyClientCredentials(orgUrl, config);
+      const requestHeaders = new Headers();
+      if (accessToken) requestHeaders.set("authorization", `Bearer ${accessToken}`);
+      if (body !== void 0) requestHeaders.set("content-type", "application/json");
+      const response = await fetch(orgUrl, {
+        method: "POST",
+        headers: requestHeaders,
+        body: JSON.stringify(body),
+        cache: "no-store"
+      });
+      return responseFromApi(response);
+    }
+    if (request.method === "POST" && route === "/sign-out") {
+      await apiRequest("/auth/sign-out", { method: "POST" }).catch(() => null);
+      await removeActiveAccount();
+      return NextResponse.json({ ok: true });
+    }
+    if (request.method === "POST" && route === "/sign-out-all") {
+      await apiRequest("/auth/sign-out-all", { method: "POST" }).catch(() => null);
+      await clearAllSessionCookies();
+      return NextResponse.json({ ok: true });
+    }
+    if (request.method === "POST" && route === "/organizations/active") {
+      const body = await readBody(request);
+      const organizationId = body && typeof body === "object" && "organizationId" in body ? body.organizationId : null;
+      const response = NextResponse.json({ ok: true });
+      if (typeof organizationId === "string") {
+        const cookieOpts = {
+          httpOnly: true,
+          sameSite: "lax",
+          path: "/",
+          secure: process.env.NODE_ENV === "production",
+          maxAge: 60 * 60 * 24 * 7
+        };
+        response.cookies.set(cn.activeOrganizationId, organizationId, cookieOpts);
+      }
+      return response;
+    }
+    return proxy(request, route);
+  }
+  return {
+    handlers: {
+      GET: handle,
+      POST: handle,
+      PATCH: handle,
+      DELETE: handle
+    },
+    GetSession: getSession,
+    GetUser: getUser,
+    GetUserById: getUserById,
+    GetOrganizations: getOrganizations,
+    SaveSession: saveAccountToList,
+    GetAccessToken: getAccessToken,
+    GetRefreshToken: getRefreshToken,
+    IsAuthenticated: async () => await getAccessToken() !== null,
+    TryRefreshTokens: tryRefreshTokens,
+    RequireUser: requireUser,
+    CreateAuthApiClient: createApiClient,
+    cookiePrefix: config.cookiePrefix,
+    VerifyToken: (token) => verifyToken(token, config.issuer),
+    SignInUrl: async (redirectTo) => {
+      const configured = env("GEEKAPPS_APP_URL");
+      if (!configured) throw new Error("Cannot determine app origin. Set GEEKAPPS_APP_URL.");
+      const origin = configured.replace(/\/$/, "");
+      const url = new URL(`${origin}${config.basePath}/sign-in`);
+      if (redirectTo) url.searchParams.set("redirectTo", redirectTo);
+      return url.toString();
+    }
+  };
+}
 
 // src/connections.ts
 var AppConnectionError = class extends Error {
@@ -19,16 +812,16 @@ var AppConnectionError = class extends Error {
     this.body = body;
   }
 };
-function env(name) {
+function env2(name) {
   const value = process.env[name];
   return value && value.trim().length > 0 ? value : void 0;
 }
 function resolveConfig(config) {
-  const issuer = (config.issuer ?? env("GEEKAPPS_AUTH_SERVER_ISSUER") ?? env("GEEKAPPS_AUTH_SERVER_URL") ?? GEEKAPPS_AUTH_SERVER_URL).replace(/\/$/, "");
+  const issuer = (config.issuer ?? env2("GEEKAPPS_AUTH_SERVER_ISSUER") ?? env2("GEEKAPPS_AUTH_SERVER_URL") ?? GEEKAPPS_AUTH_SERVER_URL).replace(/\/$/, "");
   return {
     issuer,
-    clientId: config.clientId ?? env("GEEKAPPS_AUTH_CLIENT_ID") ?? "",
-    clientSecret: config.clientSecret ?? env("GEEKAPPS_AUTH_CLIENT_SECRET") ?? ""
+    clientId: config.clientId ?? env2("GEEKAPPS_AUTH_CLIENT_ID") ?? "",
+    clientSecret: config.clientSecret ?? env2("GEEKAPPS_AUTH_CLIENT_SECRET") ?? ""
   };
 }
 async function callAppConnection(params) {
@@ -38,12 +831,22 @@ async function callAppConnection(params) {
       "App Connections: defina GEEKAPPS_AUTH_CLIENT_ID e GEEKAPPS_AUTH_CLIENT_SECRET \u2014 \xE9 com essas credenciais que o proxy identifica a app que est\xE1 chamando."
     );
   }
+  const userToken = params.userToken ?? await configureGeekappsAuth().GetAccessToken();
+  if (!userToken) {
+    throw new AppConnectionError(
+      "App Connections: n\xE3o h\xE1 usu\xE1rio logado \u2014 a conex\xE3o \xE9 do usu\xE1rio, a chamada precisa do access token dele.",
+      401,
+      "user_token_required",
+      null
+    );
+  }
   const url = `${issuer}/connections/${encodeURIComponent(params.targetAppId)}/actions/${encodeURIComponent(params.actionKey)}`;
   const credentials = Buffer.from(`${clientId}:${clientSecret}`).toString("base64");
   const response = await fetch(url, {
     method: "POST",
     headers: {
       authorization: `Basic ${credentials}`,
+      "x-user-token": userToken,
       "content-type": "application/json"
     },
     body: JSON.stringify(params.payload === void 0 ? {} : { payload: params.payload }),
@@ -65,54 +868,193 @@ var _registry = /* @__PURE__ */ new Map();
 function registerConnections(entries) {
   for (const [name, entry] of Object.entries(entries)) _registry.set(name, entry);
 }
-function resolveEntry(appName, registry = _registry) {
-  const entry = registry.get(appName);
-  if (!entry) {
-    throw new Error(
-      `App Connections: app "${appName}" desconhecida. Rode "npx geekapps-connections" para gerar o cat\xE1logo e importe o arquivo gerado uma vez no boot da app.`
-    );
+var TYPES_MODULE = "@geekapps/auth-nextjs/connections";
+var TYPES_FILE = "geekapps-connections.d.ts";
+var REFRESH_MIN_INTERVAL_MS = 5e3;
+var _remote = /* @__PURE__ */ new Map();
+var _inflight = /* @__PURE__ */ new Map();
+async function writeTypesInDev(model) {
+  if (process.env.NODE_ENV !== "development" || process.env.GEEKAPPS_CONNECTIONS_TYPES === "off") return;
+  try {
+    const { existsSync, readFileSync, writeFileSync } = await import("fs");
+    const { resolve } = await import("path");
+    const file = resolve(process.cwd(), TYPES_FILE);
+    const content = renderAugmentation(model, TYPES_MODULE);
+    if (existsSync(file) && readFileSync(file, "utf-8") === content) return;
+    writeFileSync(file, content, "utf-8");
+  } catch {
   }
-  return entry;
 }
-function resolveActionKey(appName, actionName, registry = _registry) {
-  const key = resolveEntry(appName, registry).actions[actionName];
-  if (!key) {
+async function loadRemoteRegistry(config, force = false) {
+  const { issuer, clientId, clientSecret } = resolveConfig(config);
+  if (!clientId || !clientSecret) {
     throw new Error(
-      `App Connections: a\xE7\xE3o "${actionName}" n\xE3o existe em "${appName}", ou n\xE3o foi liberada na aprova\xE7\xE3o da conex\xE3o. Rode "npx geekapps-connections" para atualizar o cat\xE1logo.`
+      "App Connections: defina GEEKAPPS_AUTH_CLIENT_ID e GEEKAPPS_AUTH_CLIENT_SECRET \u2014 \xE9 com essas credenciais que o SDK descobre as apps conect\xE1veis."
     );
   }
-  return key;
+  const cacheKey = `${issuer}|${clientId}`;
+  const ttl = process.env.NODE_ENV === "development" ? 3e4 : 5 * 6e4;
+  const cached = _remote.get(cacheKey);
+  const age = cached ? Date.now() - cached.at : Infinity;
+  if (cached && (force ? age < REFRESH_MIN_INTERVAL_MS : age < ttl)) return cached.registry;
+  const pending = _inflight.get(cacheKey);
+  if (pending) return pending;
+  const request = (async () => {
+    try {
+      const model = buildModel(await fetchRemoteCatalog({ issuer, clientId, clientSecret }));
+      const registry = new Map(Object.entries(toRegistry(model)));
+      _remote.set(cacheKey, { at: Date.now(), registry });
+      void writeTypesInDev(model);
+      return registry;
+    } catch (error) {
+      if (cached) return cached.registry;
+      throw new AppConnectionError(`App Connections: ${error.message}`, 502, "catalog_unavailable", null);
+    } finally {
+      _inflight.delete(cacheKey);
+    }
+  })();
+  _inflight.set(cacheKey, request);
+  return request;
+}
+async function resolveTarget(provider, appName, actionName) {
+  for (const force of [false, true]) {
+    const registry = await provider(force);
+    const entry = registry.get(appName);
+    const key = entry?.actions[actionName];
+    if (entry && key) return { appId: entry.appId, key };
+  }
+  throw new Error(
+    `App Connections: "${appName}.${actionName}" n\xE3o existe no cat\xE1logo. Confira se a app alvo cadastrou a a\xE7\xE3o (geekapps-actions sync).`
+  );
 }
-function createCatalog(config, registry = _registry) {
+function createCatalog(config, provider) {
   return new Proxy(/* @__PURE__ */ Object.create(null), {
     get(_target, appName) {
       if (typeof appName !== "string") return void 0;
       return new Proxy(/* @__PURE__ */ Object.create(null), {
         get(_t, actionName) {
           if (typeof actionName !== "string") return void 0;
-          return (payload) => callAppConnection({
-            targetAppId: resolveEntry(appName, registry).appId,
-            actionKey: resolveActionKey(appName, actionName, registry),
-            payload,
-            config
-          });
+          return async (payload, options) => {
+            const target = await resolveTarget(provider, appName, actionName);
+            return callAppConnection({
+              targetAppId: target.appId,
+              actionKey: target.key,
+              payload,
+              userToken: options?.userToken,
+              config
+            });
+          };
         }
       });
     }
   });
 }
+var _devRefresh = /* @__PURE__ */ new Set();
+function startDevRefresh(config) {
+  if (process.env.NODE_ENV !== "development") return;
+  const { issuer, clientId, clientSecret } = resolveConfig(config);
+  if (!clientId || !clientSecret) return;
+  const key = `${issuer}|${clientId}`;
+  if (_devRefresh.has(key)) return;
+  _devRefresh.add(key);
+  const tick = () => void loadRemoteRegistry(config, true).catch(() => void 0);
+  tick();
+  setInterval(tick, 3e4).unref?.();
+}
 function createAppConnections(config = {}) {
-  return createCatalog(config);
+  startDevRefresh(config);
+  const provider = async (force) => {
+    const remote = await loadRemoteRegistry(config, force);
+    return new Map([..._registry, ...remote]);
+  };
+  return createCatalog(config, provider);
 }
 function defineAppConnections(catalog, config = {}) {
   const registry = new Map(Object.entries(catalog));
-  return createCatalog(config, registry);
+  return createCatalog(config, async () => registry);
 }
 var appConnections = createAppConnections();
+var CONNECT_COOKIES = {
+  verifier: "gk_conn_pkce",
+  state: "gk_conn_state",
+  returnTo: "gk_conn_return",
+  redirectUri: "gk_conn_redirect"
+};
+async function connectApp(params) {
+  const { issuer, clientId } = resolveConfig(params.config ?? {});
+  if (!clientId) {
+    throw new Error("App Connections: defina GEEKAPPS_AUTH_CLIENT_ID \u2014 \xE9 o client_id desta app, a que pede a conex\xE3o.");
+  }
+  if (params.actions.length === 0) {
+    throw new Error("App Connections: informe ao menos uma a\xE7\xE3o em `actions`.");
+  }
+  const codeVerifier = randomBytes2(64).toString("base64url");
+  const state = randomBytes2(24).toString("base64url");
+  const store = await cookies2();
+  const options = { httpOnly: true, secure: true, sameSite: "lax", path: "/", maxAge: 600 };
+  store.set(CONNECT_COOKIES.verifier, codeVerifier, options);
+  store.set(CONNECT_COOKIES.state, state, options);
+  store.set(CONNECT_COOKIES.returnTo, params.returnTo ?? "/", options);
+  store.set(CONNECT_COOKIES.redirectUri, params.redirectUri, options);
+  const url = new URL(`${issuer}/authorize`);
+  url.searchParams.set("client_id", clientId);
+  url.searchParams.set("redirect_uri", params.redirectUri);
+  url.searchParams.set("response_type", "code");
+  url.searchParams.set("scope", `openid ${params.actions.join(" ")}`);
+  url.searchParams.set("state", state);
+  url.searchParams.set("code_challenge", createHash2("sha256").update(codeVerifier).digest("base64url"));
+  url.searchParams.set("code_challenge_method", "S256");
+  url.searchParams.set("target_app_id", params.targetAppId);
+  if (params.displayName) url.searchParams.set("connection_display_name", params.displayName);
+  redirect2(url.toString());
+}
+async function completeAppConnection(params) {
+  const { issuer, clientId, clientSecret } = resolveConfig(params.config ?? {});
+  if (!clientId || !clientSecret) {
+    throw new Error("App Connections: defina GEEKAPPS_AUTH_CLIENT_ID e GEEKAPPS_AUTH_CLIENT_SECRET.");
+  }
+  const store = await cookies2();
+  const read = (name) => store.get(name)?.value;
+  const expectedState = read(CONNECT_COOKIES.state);
+  const codeVerifier = read(CONNECT_COOKIES.verifier);
+  const redirectUri = read(CONNECT_COOKIES.redirectUri);
+  const returnTo = read(CONNECT_COOKIES.returnTo) ?? "/";
+  for (const name of Object.values(CONNECT_COOKIES)) store.set(name, "", { maxAge: 0, path: "/" });
+  if (!expectedState || !codeVerifier || !redirectUri || params.state !== expectedState) {
+    throw new AppConnectionError("App Connections: estado inv\xE1lido \u2014 inicie a conex\xE3o novamente.", 400, "invalid_state", null);
+  }
+  const response = await fetch(`${issuer}/oauth/token`, {
+    method: "POST",
+    headers: {
+      authorization: `Basic ${Buffer.from(`${clientId}:${clientSecret}`).toString("base64")}`,
+      "content-type": "application/x-www-form-urlencoded"
+    },
+    body: new URLSearchParams({
+      grant_type: "authorization_code",
+      code: params.code,
+      redirect_uri: redirectUri,
+      code_verifier: codeVerifier
+    }),
+    cache: "no-store"
+  });
+  if (!response.ok) {
+    const body = await response.json().catch(() => null);
+    const code = body && typeof body.error === "string" ? body.error : void 0;
+    throw new AppConnectionError(
+      `App Connections: n\xE3o foi poss\xEDvel concluir a conex\xE3o (${response.status}${code ? ` ${code}` : ""})`,
+      response.status,
+      code,
+      body
+    );
+  }
+  return { returnTo };
+}
 export {
   AppConnectionError,
   appConnections,
   callAppConnection,
+  completeAppConnection,
+  connectApp,
   createAppConnections,
   defineAppConnections,
   registerConnections