@geekapps/auth-nextjs 0.22.0 → 0.25.0

package/dist/connections.js

@@ -14,27 +14,117 @@ __export(typegen_exports, {
   DEFAULT_ISSUER: () => DEFAULT_ISSUER,
   DEFAULT_OUT_DIR: () => DEFAULT_OUT_DIR,
   fetchCatalog: () => fetchCatalog,
-  generateConnectionTypes: () => generateConnectionTypes
+  fetchManifest: () => fetchManifest,
+  generateConnectionTypes: () => generateConnectionTypes,
+  generateManifestTypes: () => generateManifestTypes
 });
 import { mkdirSync, readdirSync, readFileSync, rmSync, writeFileSync, existsSync } from "fs";
 import { join, resolve } from "path";
-async function fetchCatalog({ issuer, clientId, clientSecret }) {
-  const response = await fetch(`${issuer.replace(/\/$/, "")}/connections/catalog`, {
-    headers: { authorization: `Basic ${Buffer.from(`${clientId}:${clientSecret}`).toString("base64")}` },
+async function fetchCatalog(credentials) {
+  const issuer = credentials.issuer.replace(/\/$/, "");
+  const asUser = "accessToken" in credentials;
+  const response = await fetch(`${issuer}${asUser ? "/me/connections/catalog" : "/connections/catalog"}`, {
+    headers: {
+      authorization: asUser ? `Bearer ${credentials.accessToken}` : `Basic ${Buffer.from(`${credentials.clientId}:${credentials.clientSecret}`).toString("base64")}`
+    },
     cache: "no-store"
   });
   if (!response.ok) {
-    throw new Error(`cat\xE1logo indispon\xEDvel (${response.status}) \u2014 confira GEEKAPPS_AUTH_CLIENT_ID e GEEKAPPS_AUTH_CLIENT_SECRET`);
+    throw new Error(
+      asUser ? `cat\xE1logo indispon\xEDvel (${response.status}) \u2014 rode \`geekapps login\` de novo` : `cat\xE1logo indispon\xEDvel (${response.status}) \u2014 confira GEEKAPPS_AUTH_CLIENT_ID e GEEKAPPS_AUTH_CLIENT_SECRET`
+    );
   }
   return await response.json();
 }
+async function fetchManifest(manifestUrl) {
+  const response = await fetch(manifestUrl, { headers: { accept: "application/json" }, cache: "no-store" });
+  if (!response.ok) throw new Error(`manifesto indispon\xEDvel (${response.status})`);
+  const manifest = await response.json();
+  if (manifest?.version !== 1 || !manifest.scopes || !Array.isArray(manifest.routes)) {
+    throw new Error("manifesto em formato inv\xE1lido");
+  }
+  return manifest;
+}
+function pascal(name) {
+  return name.split(/[^a-zA-Z0-9]+/).filter(Boolean).map((part) => part[0].toUpperCase() + part.slice(1)).join("");
+}
+function properties(schema) {
+  return schema?.properties ?? {};
+}
+function required(schema) {
+  return Array.isArray(schema?.required) ? schema.required : [];
+}
+function mergeInputSchema(route) {
+  const parts = [route.params, route.query, route.body];
+  const pathParams = [...route.path.matchAll(/:([A-Za-z0-9_]+)/g)].map((m) => m[1]);
+  return {
+    type: "object",
+    properties: Object.assign({}, ...parts.map(properties)),
+    required: [.../* @__PURE__ */ new Set([...pathParams, ...parts.flatMap(required)])],
+    additionalProperties: false
+  };
+}
+async function generateManifestTypes(app, manifest) {
+  const { compile } = await import("json-schema-to-typescript");
+  const options = { bannerComment: "", additionalProperties: false, format: false, declareExternallyReferenced: true };
+  const blocks = [];
+  const routeEntries = [];
+  for (const route of manifest.routes) {
+    const base = pascal(route.route);
+    const input = `${base}Input`;
+    const output = `${base}Output`;
+    blocks.push(await compile(mergeInputSchema(route), input, options));
+    blocks.push(
+      route.response ? await compile({ ...route.response, title: void 0 }, output, options) : `export type ${output} = unknown;
+`
+    );
+    routeEntries.push(
+      `  ${JSON.stringify(route.route)}: {
+    scope: ${JSON.stringify(route.scope)};
+    method: ${JSON.stringify(route.method)};
+    path: ${JSON.stringify(route.path)};
+    input: ${input};
+    output: ${output};
+  };`
+    );
+  }
+  const scopeIds = Object.keys(manifest.scopes);
+  const scopeDocs = scopeIds.map((id) => `  ${JSON.stringify(id)}: ${JSON.stringify(manifest.scopes[id].description)};`).join("\n");
+  return `${HEADER}/** Escopos que esta app aceita em conex\xF5es. */
+export type Scope = ${scopeIds.length ? scopeIds.map((id) => JSON.stringify(id)).join(" | ") : "never"};
+
+/** Descri\xE7\xE3o de cada escopo, como aparece no consent. */
+export interface ScopeDescriptions {
+${scopeDocs}
+}
+
+/** Rotas liberadas por escopo, pelo nome usado no cliente (\`post.messages.send(...)\`). */
+export interface Routes {
+${routeEntries.join("\n")}
+}
+
+export interface App {
+  slug: ${JSON.stringify(app.slug)};
+  targetAppId: ${JSON.stringify(app.targetAppId)};
+  scopes: Scope;
+  routes: Routes;
+}
+
+${blocks.join("\n")}`;
+}
 async function generateOpenApiTypes(openApiUrl) {
   const { default: openapiTS, astToString } = await import("openapi-typescript");
   return HEADER + astToString(await openapiTS(new URL(openApiUrl)));
 }
 function renderIndex(apps, augment) {
-  const imports = apps.map((app, i) => `import type { paths as paths${i} } from "./${app.slug}";`).join("\n");
-  const members = apps.map((app, i) => `    ${JSON.stringify(app.slug)}: paths${i};`).join("\n");
+  const imports = apps.flatMap(({ app, manifest, openApi }, i) => [
+    manifest ? `import type { App as App${i} } from "./${app.slug}";` : null,
+    openApi ? `import type { paths as paths${i} } from "./${app.slug}.openapi";` : null
+  ]).filter(Boolean).join("\n");
+  const members = apps.map(({ app, manifest, openApi }, i) => {
+    const fields = [manifest ? `app: App${i};` : null, openApi ? `paths: paths${i};` : null].filter(Boolean).join(" ");
+    return `    ${JSON.stringify(app.slug)}: { ${fields} };`;
+  }).join("\n");
   return `${HEADER}${imports}
 
 declare module ${JSON.stringify(augment)} {
@@ -52,22 +142,38 @@ async function generateConnectionTypes(params) {
   const files = /* @__PURE__ */ new Map();
   const result = { apps: [], failed: [], stale: [] };
   const generated = [];
+  const keepExisting = (file) => {
+    const existing = join(outDir, file);
+    if (!existsSync(existing)) return false;
+    files.set(file, readFileSync(existing, "utf-8"));
+    return true;
+  };
   for (const app of catalog) {
-    const file = `${app.slug}.d.ts`;
-    try {
-      files.set(file, await generateOpenApiTypes(app.openApiUrl));
-      generated.push(app);
-    } catch (error) {
-      result.failed.push({ name: app.name, reason: error.message });
-      const existing = join(outDir, file);
-      if (existsSync(existing)) {
-        files.set(file, readFileSync(existing, "utf-8"));
-        generated.push(app);
+    const entry = { app, manifest: false, openApi: false };
+    if (app.manifestUrl) {
+      const file = `${app.slug}.d.ts`;
+      try {
+        files.set(file, await generateManifestTypes(app, await fetchManifest(app.manifestUrl)));
+        entry.manifest = true;
+      } catch (error) {
+        result.failed.push({ name: app.name, reason: `manifesto: ${error.message}` });
+        entry.manifest = keepExisting(file);
       }
     }
+    if (app.openApiUrl) {
+      const file = `${app.slug}.openapi.d.ts`;
+      try {
+        files.set(file, await generateOpenApiTypes(app.openApiUrl));
+        entry.openApi = true;
+      } catch (error) {
+        result.failed.push({ name: app.name, reason: `openapi: ${error.message}` });
+        entry.openApi = keepExisting(file);
+      }
+    }
+    if (entry.manifest || entry.openApi) generated.push(entry);
   }
-  result.apps = generated.map((app) => app.name);
-  files.set("index.d.ts", renderIndex(generated, params.augment ?? "@geekapps/auth-nextjs/connections"));
+  result.apps = generated.map(({ app }) => app.name);
+  files.set("index.d.ts", renderIndex(generated, params.augment ?? DEFAULT_AUGMENT));
   const current = existsSync(outDir) ? new Set(readdirSync(outDir).filter((f) => f.endsWith(".d.ts"))) : /* @__PURE__ */ new Set();
   if (params.check) {
     for (const [file, content] of files) {
@@ -85,12 +191,13 @@ async function generateConnectionTypes(params) {
   for (const file of current) if (!files.has(file)) rmSync(join(outDir, file));
   return result;
 }
-var DEFAULT_ISSUER, DEFAULT_OUT_DIR, HEADER;
+var DEFAULT_ISSUER, DEFAULT_OUT_DIR, DEFAULT_AUGMENT, HEADER;
 var init_typegen = __esm({
   "src/typegen.ts"() {
     "use strict";
     DEFAULT_ISSUER = "https://accounts-api.geekapps.com.br";
     DEFAULT_OUT_DIR = "geekapps-connections";
+    DEFAULT_AUGMENT = "@geekapps/auth-nextjs/connections";
     HEADER = "// Gerado pelo SDK do Geekapps Auth. N\xE3o edite \xE0 m\xE3o.\n\n";
   }
 });
@@ -112,15 +219,41 @@ var GEEKAPPS_AUTH_SERVER_URL = "https://accounts-api.geekapps.com.br";
 var AppConnectionError = class extends Error {
   status;
   code;
+  /** Código de erro como o servidor mandou (ex: "connection_inactive", "invalid_state"). */
+  reason;
+  /** Escopo que faltou, quando `code` é "missing_scope". */
+  scope;
   body;
-  constructor(message, status, code, body) {
+  constructor(message, status, reason, body) {
     super(message);
     this.name = "AppConnectionError";
     this.status = status;
-    this.code = code;
+    this.reason = reason;
+    this.code = toErrorCode(status, reason);
     this.body = body;
+    this.scope = body && typeof body === "object" && typeof body.scope === "string" ? body.scope : void 0;
   }
 };
+function toErrorCode(status, reason) {
+  switch (reason) {
+    case "missing_scope":
+    case "app_connection_not_allowed":
+      return "missing_scope";
+    case "connection_expired":
+      return "connection_expired";
+    case "app_not_allowed":
+      return "app_not_allowed";
+    case "connection_inactive":
+    case "connection_revoked":
+    case "invalid_token":
+    case "membership_required":
+      return "connection_revoked";
+    case "network_error":
+      return "network_error";
+  }
+  if (status === 400 || status === 422) return "validation_error";
+  return "unknown";
+}
 function env(name) {
   const value = process.env[name];
   return value && value.trim().length > 0 ? value : void 0;
@@ -154,6 +287,7 @@ async function connectApp(params) {
   if (!clientId) {
     throw new Error("App Connections: defina GEEKAPPS_AUTH_CLIENT_ID \u2014 \xE9 o client_id desta app, a que pede a conex\xE3o.");
   }
+  const targetAppId = params.targetAppId ?? await resolveAppSlug(params.app, params.config ?? {});
   const codeVerifier = randomBytes2(64).toString("base64url");
   const state = randomBytes2(24).toString("base64url");
   const store = await cookies2();
@@ -170,7 +304,10 @@ async function connectApp(params) {
   url.searchParams.set("state", state);
   url.searchParams.set("code_challenge", createHash2("sha256").update(codeVerifier).digest("base64url"));
   url.searchParams.set("code_challenge_method", "S256");
-  url.searchParams.set("target_app_id", params.targetAppId);
+  url.searchParams.set("target_app_id", targetAppId);
+  if (params.scopes && params.scopes.length > 0) {
+    url.searchParams.set("connection_scopes", [...new Set(params.scopes)].join(" "));
+  }
   url.searchParams.set("prompt", "select_account consent");
   if (params.displayName) url.searchParams.set("connection_display_name", params.displayName);
   redirect2(url.toString());
@@ -222,6 +359,21 @@ async function completeAppConnection(params) {
     }
   };
 }
+var _catalogCache = {
+  value: null,
+  fetchedAt: 0
+};
+async function resolveAppSlug(slug, config) {
+  if (!_catalogCache.value || Date.now() - _catalogCache.fetchedAt > 5 * 6e4) {
+    const { issuer, clientId, clientSecret } = requireCredentials(config);
+    const { fetchCatalog: fetchCatalog2 } = await Promise.resolve().then(() => (init_typegen(), typegen_exports));
+    _catalogCache.value = await fetchCatalog2({ issuer, clientId, clientSecret });
+    _catalogCache.fetchedAt = Date.now();
+  }
+  const app = _catalogCache.value.find((item) => item.slug === slug);
+  if (!app) throw new Error(`App Connections: a app "${slug}" n\xE3o est\xE1 no cat\xE1logo do Geekapps Auth.`);
+  return app.targetAppId;
+}
 var _jwtCache = /* @__PURE__ */ new Map();
 async function postToAuthServer(path, connectionToken, config) {
   const { issuer, clientId, clientSecret } = requireCredentials(config);
@@ -309,29 +461,162 @@ async function rotateConnectionToken(params) {
   _jwtCache.delete(params.connectionToken);
   return { token: data.connection_token, expiresAt: data.expires_at };
 }
-var TYPES_AUGMENT_MODULE = "@geekapps/auth-nextjs/connections";
-async function syncTypes() {
-  const { issuer, clientId, clientSecret } = resolveConfig({});
-  if (!clientId || !clientSecret) return;
+var MANIFEST_PATH = "/.well-known/geekapps-app.json";
+var MANIFEST_TTL_MS = 5 * 6e4;
+var _manifestCache = /* @__PURE__ */ new Map();
+async function getRuntimeManifest(baseUrl, force = false) {
+  const url = `${baseUrl.replace(/\/+$/, "")}${MANIFEST_PATH}`;
+  const cached = _manifestCache.get(url);
+  if (cached && !force && Date.now() - cached.fetchedAt < MANIFEST_TTL_MS) return cached.value;
   try {
-    const { generateConnectionTypes: generateConnectionTypes2 } = await Promise.resolve().then(() => (init_typegen(), typegen_exports));
-    await generateConnectionTypes2({
-      credentials: { issuer, clientId, clientSecret },
-      augment: TYPES_AUGMENT_MODULE
-    });
-  } catch {
+    const response = await fetch(url, { headers: { accept: "application/json" }, cache: "no-store" });
+    if (!response.ok) throw new Error(`status ${response.status}`);
+    const value = await response.json();
+    if (value?.version !== 1 || !Array.isArray(value.routes)) throw new Error("formato inv\xE1lido");
+    _manifestCache.set(url, { value, fetchedAt: Date.now() });
+    return value;
+  } catch (error) {
+    if (cached) return cached.value;
+    throw new AppConnectionError(
+      `App Connections: manifesto da app alvo indispon\xEDvel em ${url} (${error.message})`,
+      0,
+      "network_error",
+      null
+    );
+  }
+}
+function propertyNames(schema) {
+  const properties2 = schema?.properties;
+  return properties2 && typeof properties2 === "object" ? Object.keys(properties2) : [];
+}
+function appendQuery(url, key, value) {
+  if (value === void 0) return;
+  if (Array.isArray(value)) {
+    for (const item of value) appendQuery(url, key, item);
+    return;
+  }
+  url.searchParams.append(key, value !== null && typeof value === "object" ? JSON.stringify(value) : String(value));
+}
+function buildRequest(baseUrl, route, input) {
+  const rest = { ...input };
+  const path = route.path.replace(/:([A-Za-z0-9_]+)/g, (_, name) => {
+    const value = rest[name];
+    delete rest[name];
+    if (value === void 0 || value === null || value === "") {
+      throw new AppConnectionError(`App Connections: falta o par\xE2metro "${name}" em ${route.route}.`, 0, "validation_error", null);
+    }
+    return encodeURIComponent(String(value));
+  });
+  const url = new URL(path.replace(/^\//, ""), `${baseUrl.replace(/\/+$/, "")}/`);
+  const method = route.method.toUpperCase();
+  const bodyless = method === "GET" || method === "DELETE" || method === "HEAD";
+  const queryFields = new Set(propertyNames(route.query));
+  const body = {};
+  for (const [key, value] of Object.entries(rest)) {
+    if (bodyless || queryFields.has(key)) appendQuery(url, key, value);
+    else if (value !== void 0) body[key] = value;
+  }
+  const hasBody = !bodyless && (route.body !== null || Object.keys(body).length > 0);
+  return { url, method, body: hasBody ? JSON.stringify(body) : void 0 };
+}
+async function accessTokenFor(connectionToken, config) {
+  try {
+    return await getConnectionAccessToken({ connectionToken, config });
+  } catch (error) {
+    if (error instanceof AppConnectionError) throw error;
+    throw new AppConnectionError(`App Connections: auth-server inacess\xEDvel (${error.message})`, 0, "network_error", null);
+  }
+}
+async function callRoute(connectionToken, options, routeName, input = {}) {
+  const config = options.config ?? {};
+  let token = await accessTokenFor(connectionToken, config);
+  const baseUrl = options.baseUrl ?? token.targetApiBaseUrl;
+  if (!baseUrl) {
+    throw new AppConnectionError("App Connections: a app alvo n\xE3o declarou apiBaseUrl \u2014 passe `baseUrl`.", 0, "unknown", null);
+  }
+  let manifest = await getRuntimeManifest(baseUrl);
+  let route = manifest.routes.find((item) => item.route === routeName);
+  if (!route) {
+    manifest = await getRuntimeManifest(baseUrl, true);
+    route = manifest.routes.find((item) => item.route === routeName);
   }
+  if (!route) {
+    throw new AppConnectionError(`App Connections: a app alvo n\xE3o tem a rota "${routeName}".`, 404, "route_not_found", null);
+  }
+  const request = buildRequest(baseUrl, route, input);
+  for (let attempt = 0; ; attempt++) {
+    let response;
+    try {
+      response = await fetch(request.url, {
+        method: request.method,
+        headers: {
+          authorization: `Bearer ${token.accessToken}`,
+          accept: "application/json",
+          ...request.body !== void 0 && { "content-type": "application/json" }
+        },
+        body: request.body,
+        cache: "no-store"
+      });
+    } catch (error) {
+      throw new AppConnectionError(`App Connections: app alvo inacess\xEDvel (${error.message})`, 0, "network_error", null);
+    }
+    if (response.status === 401 && attempt === 0) {
+      _jwtCache.delete(connectionToken);
+      token = await accessTokenFor(connectionToken, config);
+      continue;
+    }
+    const text = await response.text();
+    let body = null;
+    try {
+      body = text ? JSON.parse(text) : null;
+    } catch {
+      body = text;
+    }
+    if (!response.ok) {
+      const reason = errorCode(body) ?? (response.status === 401 ? "connection_revoked" : void 0);
+      throw new AppConnectionError(
+        `App Connections: ${route.route} falhou (${response.status}${reason ? ` ${reason}` : ""})`,
+        response.status,
+        reason,
+        body
+      );
+    }
+    return body ?? void 0;
+  }
+}
+function routeProxy(call, path) {
+  return new Proxy(function() {
+  }, {
+    get(_target, property) {
+      if (typeof property !== "string" || property === "then") return void 0;
+      return routeProxy(call, [...path, property]);
+    },
+    apply(_target, _this, args) {
+      if (path.length === 0) throw new Error("App Connections: chame uma rota, ex: post.messages.send({ ... }).");
+      return call(path.join("."), args[0]);
+    }
+  });
 }
-if (process.env.NODE_ENV === "development" && process.env.GEEKAPPS_CONNECTIONS_TYPES !== "off") {
-  void syncTypes();
-  setInterval(() => void syncTypes(), 6e4).unref?.();
+function createConnections(config = {}) {
+  return new Proxy({}, {
+    get(_target, slug) {
+      if (typeof slug !== "string" || slug === "then") return void 0;
+      return (connectionToken, options = {}) => routeProxy(
+        (route, input) => callRoute(connectionToken, { config, ...options }, route, input),
+        []
+      );
+    }
+  });
 }
+var connections = createConnections();
 export {
   AppConnectionError,
   completeAppConnection,
   connectApp,
   connectionFetch,
+  connections,
   createConnectionClient,
+  createConnections,
   getConnectionAccessToken,
   rotateConnectionToken
 };