@geekapps/auth-nextjs 0.18.0 → 0.21.0

package/README.md

@@ -100,6 +100,62 @@ const { requestToJoin, getMyJoinRequest, listJoinRequests, approveJoinRequest }
 await requestToJoin(org.id, { message: "Trabalho na região" });
 ```
 
+## Organizações com CNPJ / Tax ID (`type: "legal"`)
+
+Toda organização tem um `type`: `"standard"` (padrão, sem documento) ou `"legal"` (pessoa jurídica, associada a um Tax ID). O Tax ID é único por aplicação e não muda depois da criação.
+
+- `taxIdType: "br_cnpj"` (padrão) — valida os dígitos verificadores (inclusive CNPJ alfanumérico) e **busca automaticamente** razão social, nome fantasia, contato e endereço na Receita (via BrasilAPI).
+- `taxIdType: "generic"` — Tax ID de outro país; só é normalizado, e `taxIdCountry` (ISO, ex.: `"US"`) é obrigatório.
+
+Obrigatórios de uma organização legal: `legalName` e `legalAddress.street`, `.city`, `.postalCode`, `.country`. O que a consulta não trouxer precisa ser informado pelo usuário.
+
+```tsx
+// 1. Pré-preenche o formulário e descobre o que ainda falta pedir
+const { lookupTaxId, createOrganization } = useOrg();
+const result = await lookupTaxId("12.345.678/0001-95"); // type padrão: "br_cnpj"
+if (!result.success) throw new Error(result.error);
+const lookup = result.data;
+// lookup.data → { legalName, tradeName, legalEmail, legalPhone, legalAddress }
+// lookup.missingFields → ex.: ["legalAddress.postalCode"]
+// lookup.alreadyRegistered → já existe org com esse CNPJ neste app
+
+// 2. Cria — o servidor refaz a consulta e completa o que não foi enviado
+const org = await createOrganization({
+  name: lookup.suggestedName ?? "Acme",
+  slug: "acme",
+  type: "legal",
+  taxId: lookup.taxId,
+  legalAddress: { postalCode: "01001000" }, // só o que faltou
+});
+// Se ainda faltar obrigatório: { success: false, code: "legal_fields_required", missingFields }.
+
+// Tax ID genérico (outro país)
+await createOrganization({
+  name: "Acme LLC", slug: "acme-llc", type: "legal",
+  taxId: "12-3456789", taxIdType: "generic", taxIdCountry: "US",
+  legalName: "Acme LLC",
+  legalAddress: { street: "1 Main St", city: "Austin", postalCode: "73301", country: "US" },
+});
+```
+
+Com `@geekapps/auth-elements-nextjs` (0.3+), o `CreateOrganizationForm` (também usado no `OrgSwitcher` e no `ManageOrganizationModal`) já entrega essa UI pronta: alterna Padrão/Empresa, busca o CNPJ e pede só os obrigatórios que faltarem.
+
+## Papel do usuário na organização
+
+`useOrg()` traz a participação do usuário logado na organização ativa, carregada sozinha ao trocar de organização:
+
+```tsx
+const { currentMembership, getMyMembership, refreshMembership } = useOrg();
+
+currentMembership?.role?.key;               // ex.: "admin"
+currentMembership?.isOwner;                 // dono passa em qualquer checagem
+currentMembership?.permissions.includes("org:update");
+
+const other = await getMyMembership(orgId); // outra organização
+```
+
+Qualquer membro ativo pode listar os membros da organização com a role de cada um (`listMembers`). Editar, adicionar ou remover membros continua exigindo as permissões `org:members:*`.
+
 ## Standalone client auth actions
 
 `@geekapps/auth-nextjs/client` exporta funções standalone usadas pela `auth-screens`:
@@ -118,3 +174,23 @@ Depois de aplicar esse source, rode o build do package para gerar o `dist`:
 ```bash
 bun --filter @geekapps/auth-nextjs build
 ```
+
+## Tipos das App Connections
+
+Em desenvolvimento (`NODE_ENV=development`), o SDK baixa o OpenAPI de cada app conectável e escreve os tipos em `geekapps-connections/`, ao subir e depois a cada minuto. O gerador vem embutido no próprio SDK; só é preciso ter o `openapi-typescript` como devDependency:
+
+```bash
+npm i -D openapi-typescript
+```
+
+Sem ele, a geração simplesmente não roda e o app funciona normalmente. Para desligar, use `GEEKAPPS_CONNECTIONS_TYPES=off`. Para checar no CI se os tipos estão em dia:
+
+```ts
+import { generateConnectionTypes } from "@geekapps/auth-nextjs/typegen";
+
+const { stale } = await generateConnectionTypes({
+  credentials: { issuer, clientId, clientSecret },
+  check: true,
+});
+if (stale.length) process.exit(1);
+```

package/dist/client.d.ts

@@ -18,6 +18,54 @@ type AuthResult<T = unknown> = {
     success: false;
     error: string;
     status?: number;
+    /** Código de erro da API (ex.: "legal_fields_required", "invalid_tax_id"). */
+    code?: string;
+    /** Campos obrigatórios que faltaram (ex.: "legalName", "legalAddress.city"). */
+    missingFields?: string[];
+};
+/** Erro de request com o corpo estruturado da API (code/missingFields). */
+declare class GeekappsApiError extends Error {
+    readonly status: number;
+    readonly code?: string | undefined;
+    readonly missingFields?: string[] | undefined;
+    constructor(message: string, status: number, code?: string | undefined, missingFields?: string[] | undefined);
+}
+/** standard: organização comum. legal: pessoa jurídica associada a um Tax ID (CNPJ ou genérico). */
+type OrganizationType = "standard" | "legal";
+type TaxIdType = "br_cnpj" | "generic";
+type OrganizationLegalAddress = {
+    street?: string | null;
+    number?: string | null;
+    complement?: string | null;
+    district?: string | null;
+    city?: string | null;
+    state?: string | null;
+    postalCode?: string | null;
+    /** ISO 3166-1 alpha-2 */
+    country?: string | null;
+};
+type OrganizationLegalData = {
+    legalName: string | null;
+    tradeName: string | null;
+    legalEmail: string | null;
+    legalPhone: string | null;
+    legalAddress: OrganizationLegalAddress | null;
+};
+type TaxIdLookupResult = {
+    taxId: string;
+    taxIdType: TaxIdType;
+    taxIdCountry: string | null;
+    valid: boolean;
+    /** Já existe uma organização deste app com esse Tax ID. */
+    alreadyRegistered: boolean;
+    /** false quando a fonte pública estava indisponível — preencha manualmente. */
+    lookupAvailable: boolean;
+    found: boolean;
+    registrationStatus: string | null;
+    suggestedName: string | null;
+    data: OrganizationLegalData;
+    /** Obrigatórios que a consulta não conseguiu preencher — peça ao usuário. */
+    missingFields: string[];
 };
 type User = {
     id: string;
@@ -74,14 +122,38 @@ type RoleAssignment = {
     roleDefinition?: Role | null;
     customRole?: Role | null;
 };
+/** Role de um membro, como o auth-server devolve. */
+type MemberRole = {
+    id: string;
+    key: string;
+    name: string;
+    isDefault: boolean;
+    isActive: boolean;
+};
 type OrganizationMember = {
     id: string;
     organizationId?: string;
     userId?: string;
+    status?: OrganizationStatus;
     createdAt?: string | Date;
     user: User;
+    /** Role do membro na organização (null = sem role atribuída). */
+    role?: MemberRole | null;
+    /** @deprecated formato antigo — o auth-server devolve `role`. */
     roleAssignments?: RoleAssignment[];
 };
+/** Participação do usuário logado numa organização (GET /organizations/:id/members/me). */
+type OrganizationMembership = {
+    organizationId: string;
+    membershipId: string | null;
+    status: OrganizationStatus;
+    /** Dono da organização: passa em qualquer checagem de permissão. */
+    isOwner: boolean;
+    role: MemberRole | null;
+    /** Permissões efetivas da role (keys). Para o dono, use `isOwner`. */
+    permissions: string[];
+    joinedAt: string | Date | null;
+};
 type OrganizationInvite = {
     id: string;
     organizationId: string;
@@ -227,6 +299,16 @@ type Organization = {
     status: OrganizationStatus;
     /** "private" (padrão) nunca sai em listPublicOrganizations(); "public" sai, e aceita join requests. */
     visibility?: "public" | "private";
+    type?: OrganizationType;
+    taxId?: string | null;
+    taxIdType?: TaxIdType | null;
+    taxIdCountry?: string | null;
+    legalName?: string | null;
+    tradeName?: string | null;
+    legalEmail?: string | null;
+    legalPhone?: string | null;
+    legalAddress?: OrganizationLegalAddress | null;
+    taxIdVerifiedAt?: string | Date | null;
     members?: OrganizationMember[];
     ownedApplications?: OrganizationOwnedApplication[];
     applicationLinks?: Array<{
@@ -280,8 +362,16 @@ type OrganizationInput = {
     domain?: string | null;
     imageUrl?: string | null;
     faviconUrl?: string | null;
-};
-type OrganizationUpdateInput = Partial<OrganizationInput> & {
+    visibility?: "public" | "private";
+    /** "legal" exige taxId; dados da empresa (CNPJ) são buscados automaticamente no servidor. */
+    type?: OrganizationType;
+    taxId?: string | null;
+    /** Padrão: "br_cnpj". */
+    taxIdType?: TaxIdType | null;
+    /** Obrigatório para taxIdType "generic". */
+    taxIdCountry?: string | null;
+} & Partial<OrganizationLegalData>;
+type OrganizationUpdateInput = Partial<Omit<OrganizationInput, "type" | "taxId" | "taxIdType" | "taxIdCountry">> & {
     status?: OrganizationStatus;
 };
 type RoleInput = {
@@ -451,9 +541,17 @@ type GeekappsAuthContextValue = {
     refreshOrganizations: () => Promise<void>;
     setCurrentOrg: (organizationId: string | null) => Promise<void>;
     createOrganization: (input: OrganizationInput) => Promise<AuthResult<Organization>>;
+    /** Valida o Tax ID e busca os dados da empresa (CNPJ) para pré-preencher a criação. */
+    lookupTaxId: (value: string, type?: TaxIdType) => Promise<AuthResult<TaxIdLookupResult>>;
     updateOrganization: (id: string, input: OrganizationUpdateInput) => Promise<AuthResult<Organization>>;
     deleteOrganization: (id: string) => Promise<AuthResult<null>>;
     hasPermission: (options: PermissionCheckOptions) => Promise<boolean>;
+    /** Participação do usuário na organização ativa (role, permissões, dono). Carregada sozinha ao trocar de organização. */
+    currentMembership: OrganizationMembership | null;
+    isLoadingMembership: boolean;
+    /** Participação do usuário numa organização qualquer (padrão: a ativa). */
+    getMyMembership: (organizationId?: string) => Promise<OrganizationMembership | null>;
+    refreshMembership: () => Promise<void>;
     /** Organizações públicas e ativas deste app — nunca inclui privadas, não exige membership. Separado de `organizations` (só as do próprio usuário). */
     listPublicOrganizations: () => Promise<PublicOrganization[]>;
     requestToJoin: (organizationId: string, input?: {
@@ -523,7 +621,7 @@ type GeekappsAuthContextValue = {
     listInvites: (organizationId: string) => Promise<OrganizationInvite[]>;
     revokeInvite: (organizationId: string, inviteId: string) => Promise<AuthResult<null>>;
 };
-type UseOrgResult = Pick<GeekappsAuthContextValue, "organizations" | "currentOrg" | "currentOrgId" | "isLoadingOrganizations" | "refreshOrganizations" | "setCurrentOrg" | "createOrganization" | "updateOrganization" | "deleteOrganization" | "hasPermission">;
+type UseOrgResult = Pick<GeekappsAuthContextValue, "organizations" | "currentOrg" | "currentOrgId" | "isLoadingOrganizations" | "refreshOrganizations" | "setCurrentOrg" | "createOrganization" | "lookupTaxId" | "updateOrganization" | "deleteOrganization" | "hasPermission" | "currentMembership" | "isLoadingMembership" | "getMyMembership" | "refreshMembership">;
 type UseAccountsResult = Pick<GeekappsAuthContextValue, "accounts" | "addAccount" | "isLoadingAccounts" | "refreshAccounts" | "switchAccount">;
 type UseUsersResult = Pick<GeekappsAuthContextValue, "listUsers" | "getUser" | "createUser" | "updateUser" | "deleteUser">;
 type UseRolesResult = Pick<GeekappsAuthContextValue, "listRoles" | "getRole" | "createRole" | "updateRole" | "deleteRole">;
@@ -607,4 +705,4 @@ type UseServiceAccountResult = {
 };
 declare function useServiceAccount(): UseServiceAccountResult;
 
-export { type AcceptInviteResult, type AddMemberInput, type AuthResult, type CallbackUrlOptions, type ConnectedAccount, type CreateServiceAccountInput, type GeekappsAuthContextValue, GeekappsAuthProvider, type GeekappsAuthProviderProps, GeekappsSessionExpiredError, type JoinRequestStatus, type LoginResponse, type MemberInviteInput, type OAuthClientType, type OidcPrompt, type Organization, type OrganizationInput, type OrganizationInvite, type OrganizationInvitePreview, type OrganizationJoinRequest, type OrganizationMember, type OrganizationOwnedApplication, type OrganizationStatus, type OrganizationUpdateInput, type Permission, type PermissionCheckOptions, type PermissionInput, type PermissionUpdateInput, type PublicOrganization, type RegisterResponse, type Role, type RoleAssignment, type RoleInput, type RolePermission, type RoleUpdateInput, type ServiceAccount, type ServiceAccountWithSecret, type SessionApplication, type SignInInput, type SignInOptions, type UpdateMemberInput, type UpdateMemberRoleInput, type UseAccountsResult, type UseInvitesResult, type UseJoinRequestsResult, type UseMembersResult, type UseOrgResult, type UsePermissionsResult, type UsePublicOrganizationsResult, type UseRolesResult, type UseServiceAccountResult, type UseSessionsResult, type UseUsersResult, type User, type UserInput, type UserSession, type UserStatus, loginWithPassword, registerWithPassword, requestPasswordlessLink, startGoogleLogin, useAccounts, useAuth, useInvites, useJoinRequests, useMembers, useOrg, usePermissions, usePublicOrganizations, useRoles, useServiceAccount, useSessions, useUsers };
+export { type AcceptInviteResult, type AddMemberInput, type AuthResult, type CallbackUrlOptions, type ConnectedAccount, type CreateServiceAccountInput, GeekappsApiError, type GeekappsAuthContextValue, GeekappsAuthProvider, type GeekappsAuthProviderProps, GeekappsSessionExpiredError, type JoinRequestStatus, type LoginResponse, type MemberInviteInput, type MemberRole, type OAuthClientType, type OidcPrompt, type Organization, type OrganizationInput, type OrganizationInvite, type OrganizationInvitePreview, type OrganizationJoinRequest, type OrganizationLegalAddress, type OrganizationLegalData, type OrganizationMember, type OrganizationMembership, type OrganizationOwnedApplication, type OrganizationStatus, type OrganizationType, type OrganizationUpdateInput, type Permission, type PermissionCheckOptions, type PermissionInput, type PermissionUpdateInput, type PublicOrganization, type RegisterResponse, type Role, type RoleAssignment, type RoleInput, type RolePermission, type RoleUpdateInput, type ServiceAccount, type ServiceAccountWithSecret, type SessionApplication, type SignInInput, type SignInOptions, type TaxIdLookupResult, type TaxIdType, type UpdateMemberInput, type UpdateMemberRoleInput, type UseAccountsResult, type UseInvitesResult, type UseJoinRequestsResult, type UseMembersResult, type UseOrgResult, type UsePermissionsResult, type UsePublicOrganizationsResult, type UseRolesResult, type UseServiceAccountResult, type UseSessionsResult, type UseUsersResult, type User, type UserInput, type UserSession, type UserStatus, loginWithPassword, registerWithPassword, requestPasswordlessLink, startGoogleLogin, useAccounts, useAuth, useInvites, useJoinRequests, useMembers, useOrg, usePermissions, usePublicOrganizations, useRoles, useServiceAccount, useSessions, useUsers };

package/dist/client.js

@@ -18,6 +18,18 @@ var GeekappsSessionExpiredError = class extends Error {
     this.name = "GeekappsSessionExpiredError";
   }
 };
+var GeekappsApiError = class extends Error {
+  constructor(message, status, code, missingFields) {
+    super(message);
+    this.status = status;
+    this.code = code;
+    this.missingFields = missingFields;
+    this.name = "GeekappsApiError";
+  }
+  status;
+  code;
+  missingFields;
+};
 function normalizeBasePath(basePath) {
   return basePath.endsWith("/") ? basePath.slice(0, -1) : basePath;
 }
@@ -164,7 +176,13 @@ function GeekappsAuthProvider({
         throw new GeekappsSessionExpiredError();
       }
       if (!response.ok) {
-        throw new Error(await parseError(response));
+        const data = await response.clone().json().catch(() => null);
+        throw new GeekappsApiError(
+          await parseError(response),
+          response.status,
+          typeof data?.code === "string" ? data.code : void 0,
+          Array.isArray(data?.missingFields) ? data.missingFields : void 0
+        );
       }
       if (response.status === 204) {
         return null;
@@ -223,6 +241,37 @@ function GeekappsAuthProvider({
     () => organizations.find((organization) => organization.id === currentOrgId) ?? null,
     [currentOrgId, organizations]
   );
+  const [currentMembership, setCurrentMembership] = useState(null);
+  const [isLoadingMembership, setIsLoadingMembership] = useState(false);
+  const getMyMembership = useCallback(
+    async (organizationId) => {
+      const orgId = organizationId ?? currentOrgId;
+      if (!orgId) return null;
+      try {
+        return await request(
+          `/organizations/${encodeURIComponent(orgId)}/members/me`
+        );
+      } catch {
+        return null;
+      }
+    },
+    [currentOrgId, request]
+  );
+  const refreshMembership = useCallback(async () => {
+    if (!currentOrgId || !user) {
+      setCurrentMembership(null);
+      return;
+    }
+    setIsLoadingMembership(true);
+    try {
+      setCurrentMembership(await getMyMembership(currentOrgId));
+    } finally {
+      setIsLoadingMembership(false);
+    }
+  }, [currentOrgId, getMyMembership, user]);
+  useEffect(() => {
+    void refreshMembership();
+  }, [refreshMembership]);
   const setCurrentOrg = useCallback(
     async (organizationId) => {
       await request("/organizations/active", {
@@ -291,6 +340,15 @@ function GeekappsAuthProvider({
     try {
       return { success: true, data: await fn() };
     } catch (error) {
+      if (error instanceof GeekappsApiError) {
+        return {
+          success: false,
+          error: error.message,
+          status: error.status,
+          code: error.code,
+          missingFields: error.missingFields
+        };
+      }
       return { success: false, error: error instanceof Error ? error.message : "Unexpected error" };
     }
   }
@@ -371,6 +429,10 @@ function GeekappsAuthProvider({
       organizations,
       currentOrg,
       currentOrgId,
+      currentMembership,
+      isLoadingMembership,
+      getMyMembership,
+      refreshMembership,
       isLoadingOrganizations,
       request,
       signIn,
@@ -409,6 +471,11 @@ function GeekappsAuthProvider({
         setCurrentOrgId(organization.id);
         return organization;
       }),
+      lookupTaxId: (value2, type = "br_cnpj") => toAuthResult(
+        () => request(
+          `/organizations/tax-id/lookup?type=${encodeURIComponent(type)}&value=${encodeURIComponent(value2)}`
+        )
+      ),
       updateOrganization: (id, input) => toAuthResult(async () => {
         const organization = await request(`/organizations/${id}`, { method: "PATCH", body: input });
         await refreshOrganizations();
@@ -589,6 +656,10 @@ function GeekappsAuthProvider({
       basePath,
       currentOrg,
       currentOrgId,
+      currentMembership,
+      isLoadingMembership,
+      getMyMembership,
+      refreshMembership,
       getInvitePreview,
       getMyJoinRequest,
       isLoading,
@@ -626,9 +697,14 @@ function useOrg() {
     refreshOrganizations: context.refreshOrganizations,
     setCurrentOrg: context.setCurrentOrg,
     createOrganization: context.createOrganization,
+    lookupTaxId: context.lookupTaxId,
     updateOrganization: context.updateOrganization,
     deleteOrganization: context.deleteOrganization,
-    hasPermission: context.hasPermission
+    hasPermission: context.hasPermission,
+    currentMembership: context.currentMembership,
+    isLoadingMembership: context.isLoadingMembership,
+    getMyMembership: context.getMyMembership,
+    refreshMembership: context.refreshMembership
   };
 }
 function useAccounts() {
@@ -764,6 +840,7 @@ function useServiceAccount() {
   };
 }
 export {
+  GeekappsApiError,
   GeekappsAuthProvider,
   GeekappsSessionExpiredError,
   loginWithPassword,