@geekapps/auth-nextjs 0.13.0 → 0.14.0

package/dist/connections.d.ts

@@ -1,114 +0,0 @@
-/**
- * App Connections — chamar ações de negócio de OUTRA Application.
- *
- * Uma conexão liga um USUÁRIO desta app (X) a uma app alvo (Y). Ele a aprova
- * uma vez no consent, escolhendo as ações liberadas e a organização dentro do
- * Y sob a qual elas rodam. A chamada vai com o access token desse usuário (o
- * da sessão, por padrão): é ele que diz ao proxy qual conexão usar.
- *
- * Nada aqui fala com a API do Y diretamente: tudo passa pelo proxy do
- * auth-server, que valida a conexão e injeta a credencial. Esta app nunca vê
- * essa credencial — é esse o ponto do proxy.
- *
- * O catálogo tipado (`GeekappsConnections`) vem do arquivo gerado por
- * `npx geekapps-connections`.
- */
-/** Opções por chamada. Sem `userToken`, usa o access token do usuário logado na sessão. */
-type ConnectionCallOptions = {
-    userToken?: string;
-};
-type AppConnectionsConfig = {
-    issuer?: string;
-    /** client_id/secret desta app (a consumidora, X). */
-    clientId?: string;
-    clientSecret?: string;
-};
-/**
- * Preenchida por declaration merging no arquivo gerado
- * (`geekapps-connections.d.ts`). Vazia aqui de propósito: o SDK não sabe
- * quais apps existem — quem sabe é o auth-server, no momento da geração.
- */
-interface GeekappsConnections {
-}
-/** Erro de uma chamada de proxy — carrega o status HTTP para dar pra tratar. */
-declare class AppConnectionError extends Error {
-    readonly status: number;
-    readonly code: string | undefined;
-    readonly body: unknown;
-    constructor(message: string, status: number, code: string | undefined, body: unknown);
-}
-/**
- * A chamada crua do proxy, para quando não há catálogo gerado. `targetAppId` é
- * o client_id da app alvo e `actionKey` é a AppAction.key — o mesmo valor que
- * aparece como scope no consent.
- */
-declare function callAppConnection<T = unknown>(params: {
-    targetAppId: string;
-    actionKey: string;
-    payload?: unknown;
-    /** Access token do usuário dono da conexão. Padrão: o do usuário logado. */
-    userToken?: string;
-    config?: AppConnectionsConfig;
-}): Promise<T>;
-/**
- * Registry preenchido pelo arquivo gerado via `registerConnections()`. Mapeia
- * o nome amigável da app (`billing`) para o client_id real, e o nome da ação
- * (`createCharge`) para a AppAction.key (`billing.charges.create`).
- */
-type ConnectionRegistryEntry = {
-    appId: string;
-    actions: Record<string, string>;
-};
-/** Chamado pelo arquivo gerado. Não edite à mão — ele é reescrito a cada geração. */
-declare function registerConnections(entries: Record<string, ConnectionRegistryEntry>): void;
-type AppConnectionsClient = GeekappsConnections;
-/** Cliente com config explícita — para quem não usa as env vars padrão. */
-declare function createAppConnections(config?: AppConnectionsConfig): AppConnectionsClient;
-/** Catálogo gerado por `npx geekapps-connections` (`geekappsConnectionsCatalog`). */
-type ConnectionsCatalog = Record<string, ConnectionRegistryEntry | {
-    readonly appId: string;
-    readonly actions: Readonly<Record<string, string>>;
-}>;
-/**
- * Liga o catálogo gerado ao cliente, sem registry global:
- *
- *   import { geekappsConnectionsCatalog, type GeekappsConnections } from "./geekapps-connections";
- *   export const connections = defineAppConnections<GeekappsConnections>(geekappsConnectionsCatalog);
- *   await connections.billing.chargesCreate({ ... });
- */
-declare function defineAppConnections<T>(catalog: ConnectionsCatalog, config?: AppConnectionsConfig): T;
-/** Cliente padrão, lendo GEEKAPPS_AUTH_CLIENT_ID / _SECRET do ambiente. */
-declare const appConnections: AppConnectionsClient;
-type ConnectAppParams = {
-    /** client_id da app ALVO (a que expõe as ações). */
-    targetAppId: string;
-    /** AppAction.key das ações pedidas — as mesmas que aparecem no consent. */
-    actions: string[];
-    /** URL desta app que recebe o retorno do consent (rota que chama `completeAppConnection`). Precisa estar nos redirect URIs desta app. */
-    redirectUri: string;
-    /** Para onde `completeAppConnection` manda o usuário depois (padrão "/"). */
-    returnTo?: string;
-    /** Nome desta app exibido no consent. */
-    displayName?: string;
-    config?: AppConnectionsConfig;
-};
-/**
- * Inicia a conexão desta app com `targetAppId`: guarda PKCE/state em cookies
- * httpOnly e redireciona para o consent. Chame de um Server Action ou Route
- * Handler — não retorna (o `redirect` do Next interrompe a execução).
- */
-declare function connectApp(params: ConnectAppParams): Promise<never>;
-/**
- * Fecha o fluxo de `connectApp`. Chame no callback com o `code` e o `state`
- * da query; devolve o `returnTo` para você redirecionar. Lança
- * AppConnectionError se o state não bater ou o auth-server recusar.
- */
-declare function completeAppConnection(params: {
-    code: string;
-    state: string;
-    config?: AppConnectionsConfig;
-}): Promise<{
-    returnTo: string;
-}>;
-
-export { AppConnectionError, type AppConnectionsClient, type AppConnectionsConfig, type ConnectAppParams, type ConnectionCallOptions, type ConnectionsCatalog, type GeekappsConnections, appConnections, callAppConnection, completeAppConnection, connectApp, createAppConnections, defineAppConnections, registerConnections };

package/dist/middleware.d.ts

@@ -1,22 +0,0 @@
-import { NextRequest, NextResponse } from 'next/server';
-
-type AuthMiddlewareConfig = {
-    issuer?: string;
-    basePath?: string;
-    /**
-     * @deprecated cookiePrefix is now auto-derived from GEEKAPPS_AUTH_CLIENT_ID.
-     * This field is kept for backwards compatibility but is ignored.
-     */
-    cookiePrefix?: string;
-    secureCookies?: boolean;
-    /** Base URL of this app (e.g. "https://meuapp.com"). Overrides the GEEKAPPS_APP_URL env var. */
-    appUrl?: string;
-    /**
-     * When true, unauthenticated requests are redirected to sign-in.
-     * Defaults to false — the app controls its own auth-gating.
-     */
-    forceLoginOnUnauthenticated?: boolean;
-};
-declare function createAuthMiddleware(input?: AuthMiddlewareConfig): (request: NextRequest) => Promise<NextResponse>;
-
-export { type AuthMiddlewareConfig, createAuthMiddleware };

package/dist/server.d.ts

@@ -1,138 +0,0 @@
-import { NextRequest, NextResponse } from 'next/server';
-import { JWTPayload } from 'jose';
-
-/**
- * A sessão não vale mais: expirou, foi revogada no painel ou o refresh token
- * foi invalidado. Os cookies já foram limpos quando este erro é lançado, então
- * o tratamento normal é redirecionar para o login.
- */
-declare class GeekappsSessionExpiredError extends Error {
-    readonly code: "session_expired";
-    constructor(message?: string);
-}
-/**
- * Fixed URL of the Geekapps Auth Server (OIDC issuer + API). This never
- * changes per-environment, so it is hardcoded rather than read from env.
- */
-declare const GEEKAPPS_AUTH_SERVER_URL = "https://accounts-api.geekapps.com.br";
-type GeekappsAuthConfig = {
-    /**
-     * Auth Server (OIDC) issuer URL. Defaults to GEEKAPPS_AUTH_SERVER_URL and
-     * should not need overriding in normal use.
-     *
-     * Deprecated (still supported as a fallback): GEEKAPPS_AUTH_SERVER_ISSUER,
-     * GEEKAPPS_AUTH_ISSUER, GEEKAPPS_AUTH_SERVER_URL env, GEEKAPPS_AUTH_API_URL
-     */
-    issuer?: string;
-    /**
-     * OAuth client id. Optional when GEEKAPPS_AUTH_CLIENT_ID is defined.
-     */
-    clientId?: string;
-    /**
-     * OAuth client secret for confidential clients. Optional when
-     * GEEKAPPS_AUTH_CLIENT_SECRET is defined.
-     */
-    clientSecret?: string;
-    /**
-     * Callback URL. Optional when GEEKAPPS_AUTH_REDIRECT_URI is defined.
-     * If omitted, it is inferred from the current request origin + basePath/callback.
-     */
-    redirectUri?: string;
-    scopes?: string[];
-    basePath?: string;
-    /**
-     * @deprecated cookiePrefix is now auto-derived from clientId.
-     * This field is kept for backwards compatibility but is ignored.
-     */
-    cookiePrefix?: string;
-    secureCookies?: boolean;
-    /**
-     * Friendly alias used by apps. Same as afterSignInRedirectTo.
-     */
-    redirectTo?: string;
-    afterSignInRedirectTo?: string;
-    afterSignOutRedirectTo?: string;
-};
-type SessionTokens = {
-    accessToken: string | null;
-    refreshToken: string | null;
-    idToken: string | null;
-    sessionId: string | null;
-};
-type StoredAccount = {
-    /** Stable identifier — `sub` from id_token or fallback to sessionId. */
-    id: string;
-    accessToken: string;
-    refreshToken: string | null;
-    idToken: string | null;
-    sessionId: string | null;
-    user: {
-        sub: string;
-        name?: string | null;
-        email?: string | null;
-        picture?: string | null;
-        phone?: string | null;
-    };
-};
-type ServerAuthApiClient = {
-    get: <T>(path: string) => Promise<T>;
-    post: <T>(path: string, body?: unknown) => Promise<T>;
-    patch: <T>(path: string, body?: unknown) => Promise<T>;
-    put: <T>(path: string, body?: unknown) => Promise<T>;
-    delete: <T>(path: string) => Promise<T>;
-};
-type ServiceAccountConfig = {
-    issuer?: string;
-    clientId?: string;
-    clientSecret?: string;
-};
-/**
- * Returns a service account access token.
- * The issuer is always the Geekapps Auth Server (GEEKAPPS_AUTH_SERVER_URL) —
- * it does not need to be configured. Reads GEEKAPPS_SERVICE_ACCOUNT_CLIENT_ID,
- * GEEKAPPS_SERVICE_ACCOUNT_CLIENT_SECRET by default.
- * Any field can be overridden via the optional config argument.
- * Tokens are cached per client and auto-renewed before expiry (~7 min TTL).
- */
-declare function getServiceAccountToken(override?: ServiceAccountConfig): Promise<string | null>;
-declare function verifyToken(token: string, issuer: string): Promise<JWTPayload | null>;
-declare function configureGeekappsAuth(input?: GeekappsAuthConfig): {
-    handlers: {
-        GET: (request: NextRequest) => Promise<NextResponse<any>>;
-        POST: (request: NextRequest) => Promise<NextResponse<any>>;
-        PATCH: (request: NextRequest) => Promise<NextResponse<any>>;
-        DELETE: (request: NextRequest) => Promise<NextResponse<any>>;
-    };
-    GetSession: () => Promise<SessionTokens | null>;
-    GetUser: () => Promise<StoredAccount["user"] | null>;
-    GetUserById: (userId: string, applicationId?: string) => Promise<unknown | null>;
-    GetOrganizations: () => Promise<{
-        organizations: unknown[];
-        currentOrgId: string | null;
-    }>;
-    SaveSession: (tokens: SessionTokens) => Promise<void>;
-    GetAccessToken: () => Promise<string | null>;
-    GetRefreshToken: () => Promise<string | null>;
-    IsAuthenticated: () => Promise<boolean>;
-    TryRefreshTokens: () => Promise<string | null>;
-    RequireUser: (options?: {
-        redirectTo?: string;
-    }) => Promise<string>;
-    CreateAuthApiClient: () => ServerAuthApiClient;
-    cookiePrefix: string;
-    VerifyToken: (token: string) => Promise<JWTPayload | null>;
-    SignInUrl: (redirectTo?: string) => Promise<string>;
-};
-declare function handlers(options?: GeekappsAuthConfig): {
-    GET: (request: NextRequest) => Promise<NextResponse<any>>;
-    POST: (request: NextRequest) => Promise<NextResponse<any>>;
-    PATCH: (request: NextRequest) => Promise<NextResponse<any>>;
-    DELETE: (request: NextRequest) => Promise<NextResponse<any>>;
-};
-/**
- * Returns true if the current request has a valid access token in cookies.
- * Safe to call in Server Components, Server Actions, and Route Handlers.
- */
-declare function isAuthenticated(options?: GeekappsAuthConfig): Promise<boolean>;
-
-export { GEEKAPPS_AUTH_SERVER_URL, type GeekappsAuthConfig, GeekappsSessionExpiredError, type ServerAuthApiClient, type SessionTokens, type StoredAccount, configureGeekappsAuth, getServiceAccountToken, handlers, isAuthenticated, verifyToken };