@greatapps/common 1.1.588 → 1.1.589

package/dist/modules/auth/utils/require-token-not-expired.mjs

@@ -0,0 +1,26 @@
+import "server-only";
+import { cookies } from "next/headers";
+import { ApiError } from "../../../infra/api/types";
+const AUTH_COOKIE_NAME = "greatapps";
+async function requireTokenNotExpired() {
+  if (process.env.DUMMY_AUTH_TOKEN) return;
+  const cookieStore = await cookies();
+  const token = cookieStore.get(AUTH_COOKIE_NAME)?.value;
+  if (!token) {
+    throw new ApiError("Sess\xE3o inv\xE1lida ou expirada", "SESSION_INVALID", 401);
+  }
+  try {
+    const payload = JSON.parse(atob(token.split(".")[1]));
+    const now = Math.floor(Date.now() / 1e3);
+    if (!payload.exp || payload.exp <= now) {
+      throw new ApiError("Sess\xE3o inv\xE1lida ou expirada", "SESSION_INVALID", 401);
+    }
+  } catch (err) {
+    if (err instanceof ApiError) throw err;
+    throw new ApiError("Sess\xE3o inv\xE1lida ou expirada", "SESSION_INVALID", 401);
+  }
+}
+export {
+  requireTokenNotExpired
+};
+//# sourceMappingURL=require-token-not-expired.mjs.map

package/dist/modules/auth/utils/require-token-not-expired.mjs.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../../../../src/modules/auth/utils/require-token-not-expired.ts"],"sourcesContent":["import 'server-only';\n\nimport { cookies } from 'next/headers';\nimport { ApiError } from '../../../infra/api/types';\n\nconst AUTH_COOKIE_NAME = 'greatapps';\n\n/**\n * Verifica se o JWT do cookie `greatapps` não expirou checando o campo `exp`\n * no payload, sem bater no backend.\n *\n * - Se o token não existe → SESSION_INVALID 401\n * - Se o token é malformado → SESSION_INVALID 401\n * - Se `exp` não existe ou já passou → SESSION_INVALID 401\n *\n * Isso substitui o `requireValidSession` (que fazia POST /auth/keep) no\n * `safeMutationAction`, eliminando 1 round-trip ao backend por mutation.\n */\nexport async function requireTokenNotExpired(): Promise<void> {\n  if (process.env.DUMMY_AUTH_TOKEN) return;\n\n  const cookieStore = await cookies();\n  const token = cookieStore.get(AUTH_COOKIE_NAME)?.value;\n\n  if (!token) {\n    throw new ApiError('Sessão inválida ou expirada', 'SESSION_INVALID', 401);\n  }\n\n  try {\n    const payload = JSON.parse(atob(token.split('.')[1]));\n    const now = Math.floor(Date.now() / 1000);\n\n    if (!payload.exp || payload.exp <= now) {\n      throw new ApiError('Sessão inválida ou expirada', 'SESSION_INVALID', 401);\n    }\n  } catch (err) {\n    if (err instanceof ApiError) throw err;\n    throw new ApiError('Sessão inválida ou expirada', 'SESSION_INVALID', 401);\n  }\n}\n"],"mappings":"AAAA,OAAO;AAEP,SAAS,eAAe;AACxB,SAAS,gBAAgB;AAEzB,MAAM,mBAAmB;AAazB,eAAsB,yBAAwC;AAC5D,MAAI,QAAQ,IAAI,iBAAkB;AAElC,QAAM,cAAc,MAAM,QAAQ;AAClC,QAAM,QAAQ,YAAY,IAAI,gBAAgB,GAAG;AAEjD,MAAI,CAAC,OAAO;AACV,UAAM,IAAI,SAAS,qCAA+B,mBAAmB,GAAG;AAAA,EAC1E;AAEA,MAAI;AACF,UAAM,UAAU,KAAK,MAAM,KAAK,MAAM,MAAM,GAAG,EAAE,CAAC,CAAC,CAAC;AACpD,UAAM,MAAM,KAAK,MAAM,KAAK,IAAI,IAAI,GAAI;AAExC,QAAI,CAAC,QAAQ,OAAO,QAAQ,OAAO,KAAK;AACtC,YAAM,IAAI,SAAS,qCAA+B,mBAAmB,GAAG;AAAA,IAC1E;AAAA,EACF,SAAS,KAAK;AACZ,QAAI,eAAe,SAAU,OAAM;AACnC,UAAM,IAAI,SAAS,qCAA+B,mBAAmB,GAAG;AAAA,EAC1E;AACF;","names":[]}

package/dist/server.mjs

@@ -61,6 +61,7 @@ import {
 import { getClientInfoFromRequest } from "./infra/utils/client-info";
 import { getUserContext } from "./modules/auth/utils/get-user-context";
 import { requireValidSession } from "./modules/auth/utils/require-valid-session";
+import { requireTokenNotExpired } from "./modules/auth/utils/require-token-not-expired";
 import { buildWlOverride, buildWlOverrideFromJwt } from "./modules/auth/utils/build-wl-override";
 import { safeServerAction } from "./utils/safeServerAction";
 import { safeMutationAction } from "./utils/safeMutationAction";
@@ -120,6 +121,7 @@ export {
   removeProjectUserAction,
   requestEmailChangeAction,
   requestPhoneChangeAction,
+  requireTokenNotExpired,
   requireValidSession,
   resolvePlanExtrasPrices,
   revalidateWhitelabelAction,

package/dist/server.mjs.map

@@ -1 +1 @@
-{"version":3,"sources":["../src/server.ts"],"sourcesContent":["import 'server-only';\r\n\r\n// API Client\r\nexport { ApiClient, api, apiClient } from './infra/api/client';\r\n\r\n// Services\r\nexport { authService } from './modules/auth/services/auth.service';\r\nexport { whitelabelService } from './modules/whitelabel/services/whitelabel.service';\r\nexport { revalidateWhitelabelAction } from './modules/whitelabel/actions/revalidate-whitelabel.action';\r\nexport { assertManagementPermission } from './modules/auth/utils/assert-management-permission';\r\nexport { assertManagementSubscription } from './modules/auth/utils/assert-management-subscription';\r\nexport { assertSubscriptionAddon } from './modules/auth/utils/assert-subscription-addon';\r\nexport { assertPaidSubscription } from './modules/auth/utils/assert-paid-subscription';\r\nexport { subscriptionsService } from './modules/subscriptions/services/subscriptions.service';\r\nexport { plansService } from './modules/plans/services/plans.service';\r\nexport { cardsService } from './modules/cards/services/cards.service';\r\nexport { iaCreditsService } from './modules/ia-credits/services/ia-credits.service';\r\n\r\n// Actions\r\nexport { findWhitelabel } from './modules/whitelabel/actions/find-whitelabel.action';\r\nexport { validateSessionAction } from './modules/auth/actions/validate-session.action';\r\nexport { findUserById } from './modules/users/action/find-user-by-id.action';\r\nexport { findCurrentAccount } from './modules/accounts/actions/find-current-account.action';\r\nexport { getAccountTokenAction } from './modules/accounts/actions/get-account-token.action';\r\nexport { listSubscriptionsAction } from './modules/subscriptions/actions/list-subscriptions.action';\r\nexport { findPlanByIdAction } from './modules/plans/actions/find-plan-by-id.action';\r\nexport { listPlansAction } from './modules/plans/actions/list-plans.action';\r\nexport { calculateSubscriptionAction } from './modules/subscriptions/actions/calculate-subscription.action';\r\nexport { updateSubscriptionPlanAction } from './modules/subscriptions/actions/update-subscription-plan.action';\r\nexport { updateSubscriptionPaymentAction } from './modules/subscriptions/actions/update-subscription-payment.action';\r\nexport { listCardsAction } from './modules/cards/actions/list-cards.action';\r\nexport { createCardAction } from './modules/cards/actions/create-card.action';\r\nexport { resolvePlanExtrasPrices } from './modules/subscriptions/utils/resolve-plan-extras-prices';\r\nexport { hasSubscriptionExpired } from './modules/subscriptions/utils/has-subscription-expired';\r\nexport { listIaCreditsAction } from './modules/ia-credits/actions/list-ia-credits.action';\r\nexport { countPagesAction } from './modules/pages/actions/count-pages.action';\r\n\r\n// Project Services & Actions (server-only)\r\nexport { projectsService } from './modules/projects/services/projects.service';\r\nexport { listProjectsAction } from './modules/projects/actions/list-projects.action';\r\nexport { findProjectAction } from './modules/projects/actions/find-project.action';\r\nexport { createProjectAction } from './modules/projects/actions/create-project.action';\r\nexport { updateProjectAction } from './modules/projects/actions/update-project.action';\r\nexport { deleteProjectAction } from './modules/projects/actions/delete-project.action';\r\n\r\n// Project Users Services & Actions (server-only)\r\nexport { projectUsersService } from './modules/projects/services/project-users.service';\r\nexport { listProjectUsersAction } from './modules/projects/actions/list-project-users.action';\r\nexport { listAvailableUsersAction } from './modules/projects/actions/list-available-users.action';\r\nexport { addProjectUserAction } from './modules/projects/actions/add-project-user.action';\r\nexport { removeProjectUserAction } from './modules/projects/actions/remove-project-user.action';\r\n\r\n// Account Services & Actions (server-only)\r\nexport { accountService } from './modules/accounts/services/account.service';\r\nexport { twoFactorService } from './modules/accounts/services/two-factor.service';\r\nexport {\r\n  listAccountUsersAction,\r\n  updateUserAction,\r\n  updateAccountAction,\r\n  updateAccountUserByIdAction,\r\n  deleteAccountUserAction,\r\n  deleteAccountAction,\r\n  createAccountUserAction,\r\n  changePasswordAction,\r\n  requestEmailChangeAction,\r\n  confirmEmailChangeAction,\r\n  requestPhoneChangeAction,\r\n  confirmPhoneChangeAction,\r\n  generateTwoFactorAction,\r\n  confirmTwoFactorAction,\r\n  disableTwoFactorAction,\r\n} from './modules/accounts/actions/account-management.action';\r\n\r\n// Server Utils\r\nexport { getClientInfoFromRequest } from './infra/utils/client-info';\r\nexport { getUserContext } from './modules/auth/utils/get-user-context';\r\nexport { requireValidSession } from './modules/auth/utils/require-valid-session';\r\nexport { buildWlOverride, buildWlOverrideFromJwt } from './modules/auth/utils/build-wl-override';\r\nexport { safeServerAction } from './utils/safeServerAction';\r\nexport { safeMutationAction } from './utils/safeMutationAction';\r\n\r\n// Image Processing (server-side)\r\nexport { processImageAction } from './modules/images/actions/process-image.action';\r\nexport { processImage } from './modules/images/services/image-processing.service';\r\nexport type {\r\n  ProcessImageInput,\r\n  ProcessImageOutput,\r\n  ProcessImageActionInput,\r\n  ProcessImageActionOutput,\r\n} from './modules/images/types/image.type';\r\n"],"mappings":"AAAA,OAAO;AAGP,SAAS,WAAW,KAAK,iBAAiB;AAG1C,SAAS,mBAAmB;AAC5B,SAAS,yBAAyB;AAClC,SAAS,kCAAkC;AAC3C,SAAS,kCAAkC;AAC3C,SAAS,oCAAoC;AAC7C,SAAS,+BAA+B;AACxC,SAAS,8BAA8B;AACvC,SAAS,4BAA4B;AACrC,SAAS,oBAAoB;AAC7B,SAAS,oBAAoB;AAC7B,SAAS,wBAAwB;AAGjC,SAAS,sBAAsB;AAC/B,SAAS,6BAA6B;AACtC,SAAS,oBAAoB;AAC7B,SAAS,0BAA0B;AACnC,SAAS,6BAA6B;AACtC,SAAS,+BAA+B;AACxC,SAAS,0BAA0B;AACnC,SAAS,uBAAuB;AAChC,SAAS,mCAAmC;AAC5C,SAAS,oCAAoC;AAC7C,SAAS,uCAAuC;AAChD,SAAS,uBAAuB;AAChC,SAAS,wBAAwB;AACjC,SAAS,+BAA+B;AACxC,SAAS,8BAA8B;AACvC,SAAS,2BAA2B;AACpC,SAAS,wBAAwB;AAGjC,SAAS,uBAAuB;AAChC,SAAS,0BAA0B;AACnC,SAAS,yBAAyB;AAClC,SAAS,2BAA2B;AACpC,SAAS,2BAA2B;AACpC,SAAS,2BAA2B;AAGpC,SAAS,2BAA2B;AACpC,SAAS,8BAA8B;AACvC,SAAS,gCAAgC;AACzC,SAAS,4BAA4B;AACrC,SAAS,+BAA+B;AAGxC,SAAS,sBAAsB;AAC/B,SAAS,wBAAwB;AACjC;AAAA,EACE;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,OACK;AAGP,SAAS,gCAAgC;AACzC,SAAS,sBAAsB;AAC/B,SAAS,2BAA2B;AACpC,SAAS,iBAAiB,8BAA8B;AACxD,SAAS,wBAAwB;AACjC,SAAS,0BAA0B;AAGnC,SAAS,0BAA0B;AACnC,SAAS,oBAAoB;","names":[]}
+{"version":3,"sources":["../src/server.ts"],"sourcesContent":["import 'server-only';\r\n\r\n// API Client\r\nexport { ApiClient, api, apiClient } from './infra/api/client';\r\n\r\n// Services\r\nexport { authService } from './modules/auth/services/auth.service';\r\nexport { whitelabelService } from './modules/whitelabel/services/whitelabel.service';\r\nexport { revalidateWhitelabelAction } from './modules/whitelabel/actions/revalidate-whitelabel.action';\r\nexport { assertManagementPermission } from './modules/auth/utils/assert-management-permission';\r\nexport { assertManagementSubscription } from './modules/auth/utils/assert-management-subscription';\r\nexport { assertSubscriptionAddon } from './modules/auth/utils/assert-subscription-addon';\r\nexport { assertPaidSubscription } from './modules/auth/utils/assert-paid-subscription';\r\nexport { subscriptionsService } from './modules/subscriptions/services/subscriptions.service';\r\nexport { plansService } from './modules/plans/services/plans.service';\r\nexport { cardsService } from './modules/cards/services/cards.service';\r\nexport { iaCreditsService } from './modules/ia-credits/services/ia-credits.service';\r\n\r\n// Actions\r\nexport { findWhitelabel } from './modules/whitelabel/actions/find-whitelabel.action';\r\nexport { validateSessionAction } from './modules/auth/actions/validate-session.action';\r\nexport { findUserById } from './modules/users/action/find-user-by-id.action';\r\nexport { findCurrentAccount } from './modules/accounts/actions/find-current-account.action';\r\nexport { getAccountTokenAction } from './modules/accounts/actions/get-account-token.action';\r\nexport { listSubscriptionsAction } from './modules/subscriptions/actions/list-subscriptions.action';\r\nexport { findPlanByIdAction } from './modules/plans/actions/find-plan-by-id.action';\r\nexport { listPlansAction } from './modules/plans/actions/list-plans.action';\r\nexport { calculateSubscriptionAction } from './modules/subscriptions/actions/calculate-subscription.action';\r\nexport { updateSubscriptionPlanAction } from './modules/subscriptions/actions/update-subscription-plan.action';\r\nexport { updateSubscriptionPaymentAction } from './modules/subscriptions/actions/update-subscription-payment.action';\r\nexport { listCardsAction } from './modules/cards/actions/list-cards.action';\r\nexport { createCardAction } from './modules/cards/actions/create-card.action';\r\nexport { resolvePlanExtrasPrices } from './modules/subscriptions/utils/resolve-plan-extras-prices';\r\nexport { hasSubscriptionExpired } from './modules/subscriptions/utils/has-subscription-expired';\r\nexport { listIaCreditsAction } from './modules/ia-credits/actions/list-ia-credits.action';\r\nexport { countPagesAction } from './modules/pages/actions/count-pages.action';\r\n\r\n// Project Services & Actions (server-only)\r\nexport { projectsService } from './modules/projects/services/projects.service';\r\nexport { listProjectsAction } from './modules/projects/actions/list-projects.action';\r\nexport { findProjectAction } from './modules/projects/actions/find-project.action';\r\nexport { createProjectAction } from './modules/projects/actions/create-project.action';\r\nexport { updateProjectAction } from './modules/projects/actions/update-project.action';\r\nexport { deleteProjectAction } from './modules/projects/actions/delete-project.action';\r\n\r\n// Project Users Services & Actions (server-only)\r\nexport { projectUsersService } from './modules/projects/services/project-users.service';\r\nexport { listProjectUsersAction } from './modules/projects/actions/list-project-users.action';\r\nexport { listAvailableUsersAction } from './modules/projects/actions/list-available-users.action';\r\nexport { addProjectUserAction } from './modules/projects/actions/add-project-user.action';\r\nexport { removeProjectUserAction } from './modules/projects/actions/remove-project-user.action';\r\n\r\n// Account Services & Actions (server-only)\r\nexport { accountService } from './modules/accounts/services/account.service';\r\nexport { twoFactorService } from './modules/accounts/services/two-factor.service';\r\nexport {\r\n  listAccountUsersAction,\r\n  updateUserAction,\r\n  updateAccountAction,\r\n  updateAccountUserByIdAction,\r\n  deleteAccountUserAction,\r\n  deleteAccountAction,\r\n  createAccountUserAction,\r\n  changePasswordAction,\r\n  requestEmailChangeAction,\r\n  confirmEmailChangeAction,\r\n  requestPhoneChangeAction,\r\n  confirmPhoneChangeAction,\r\n  generateTwoFactorAction,\r\n  confirmTwoFactorAction,\r\n  disableTwoFactorAction,\r\n} from './modules/accounts/actions/account-management.action';\r\n\r\n// Server Utils\r\nexport { getClientInfoFromRequest } from './infra/utils/client-info';\r\nexport { getUserContext } from './modules/auth/utils/get-user-context';\r\nexport { requireValidSession } from './modules/auth/utils/require-valid-session';\r\nexport { requireTokenNotExpired } from './modules/auth/utils/require-token-not-expired';\r\nexport { buildWlOverride, buildWlOverrideFromJwt } from './modules/auth/utils/build-wl-override';\r\nexport { safeServerAction } from './utils/safeServerAction';\r\nexport { safeMutationAction } from './utils/safeMutationAction';\r\n\r\n// Image Processing (server-side)\r\nexport { processImageAction } from './modules/images/actions/process-image.action';\r\nexport { processImage } from './modules/images/services/image-processing.service';\r\nexport type {\r\n  ProcessImageInput,\r\n  ProcessImageOutput,\r\n  ProcessImageActionInput,\r\n  ProcessImageActionOutput,\r\n} from './modules/images/types/image.type';\r\n"],"mappings":"AAAA,OAAO;AAGP,SAAS,WAAW,KAAK,iBAAiB;AAG1C,SAAS,mBAAmB;AAC5B,SAAS,yBAAyB;AAClC,SAAS,kCAAkC;AAC3C,SAAS,kCAAkC;AAC3C,SAAS,oCAAoC;AAC7C,SAAS,+BAA+B;AACxC,SAAS,8BAA8B;AACvC,SAAS,4BAA4B;AACrC,SAAS,oBAAoB;AAC7B,SAAS,oBAAoB;AAC7B,SAAS,wBAAwB;AAGjC,SAAS,sBAAsB;AAC/B,SAAS,6BAA6B;AACtC,SAAS,oBAAoB;AAC7B,SAAS,0BAA0B;AACnC,SAAS,6BAA6B;AACtC,SAAS,+BAA+B;AACxC,SAAS,0BAA0B;AACnC,SAAS,uBAAuB;AAChC,SAAS,mCAAmC;AAC5C,SAAS,oCAAoC;AAC7C,SAAS,uCAAuC;AAChD,SAAS,uBAAuB;AAChC,SAAS,wBAAwB;AACjC,SAAS,+BAA+B;AACxC,SAAS,8BAA8B;AACvC,SAAS,2BAA2B;AACpC,SAAS,wBAAwB;AAGjC,SAAS,uBAAuB;AAChC,SAAS,0BAA0B;AACnC,SAAS,yBAAyB;AAClC,SAAS,2BAA2B;AACpC,SAAS,2BAA2B;AACpC,SAAS,2BAA2B;AAGpC,SAAS,2BAA2B;AACpC,SAAS,8BAA8B;AACvC,SAAS,gCAAgC;AACzC,SAAS,4BAA4B;AACrC,SAAS,+BAA+B;AAGxC,SAAS,sBAAsB;AAC/B,SAAS,wBAAwB;AACjC;AAAA,EACE;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,OACK;AAGP,SAAS,gCAAgC;AACzC,SAAS,sBAAsB;AAC/B,SAAS,2BAA2B;AACpC,SAAS,8BAA8B;AACvC,SAAS,iBAAiB,8BAA8B;AACxD,SAAS,wBAAwB;AACjC,SAAS,0BAA0B;AAGnC,SAAS,0BAA0B;AACnC,SAAS,oBAAoB;","names":[]}

package/dist/utils/safeMutationAction.mjs

@@ -1,9 +1,9 @@
 import "server-only";
-import { requireValidSession } from "../modules/auth/utils/require-valid-session";
+import { requireTokenNotExpired } from "../modules/auth/utils/require-token-not-expired";
 import { safeServerAction } from "./safeServerAction";
 async function safeMutationAction(fn) {
   return safeServerAction(async () => {
-    await requireValidSession();
+    await requireTokenNotExpired();
     return fn();
   });
 }

package/dist/utils/safeMutationAction.mjs.map

@@ -1 +1 @@
-{"version":3,"sources":["../../src/utils/safeMutationAction.ts"],"sourcesContent":["import 'server-only';\n\nimport type { ActionResult } from '../infra/api/types';\nimport { requireValidSession } from '../modules/auth/utils/require-valid-session';\nimport { safeServerAction } from './safeServerAction';\n\n/**\n * Wrapper para server actions que mutam estado (delete/update/create/publish/\n * billing/etc.). Faz validação de sessão contra o backend (`POST /auth/keep`)\n * antes de executar a ação e roteia erros via `safeServerAction`.\n *\n * A validação é deduplicada por request — múltiplas actions sensíveis que\n * rodem dentro de uma mesma request pagam 1 round-trip ao backend, não N.\n *\n * Motivação (resumo): o backend confia no par `(whitelabel-token, id_account\n * no path)` nos endpoints de CRUD; o Next.js deriva `id_account` de\n * `atob(cookie)` sem verificar assinatura. Chamar `requireValidSession`\n * aqui garante que o cookie corresponde a uma sessão real no banco antes\n * de qualquer mutação.\n *\n * Para reads não-sensíveis, continue usando `safeServerAction` direto.\n */\nexport async function safeMutationAction<T>(\n  fn: () => Promise<T>\n): Promise<ActionResult<T>> {\n  return safeServerAction(async () => {\n    await requireValidSession();\n    return fn();\n  });\n}\n"],"mappings":"AAAA,OAAO;AAGP,SAAS,2BAA2B;AACpC,SAAS,wBAAwB;AAkBjC,eAAsB,mBACpB,IAC0B;AAC1B,SAAO,iBAAiB,YAAY;AAClC,UAAM,oBAAoB;AAC1B,WAAO,GAAG;AAAA,EACZ,CAAC;AACH;","names":[]}
+{"version":3,"sources":["../../src/utils/safeMutationAction.ts"],"sourcesContent":["import 'server-only';\n\nimport type { ActionResult } from '../infra/api/types';\nimport { requireTokenNotExpired } from '../modules/auth/utils/require-token-not-expired';\nimport { safeServerAction } from './safeServerAction';\n\n/**\n * Wrapper para server actions que mutam estado (delete/update/create/publish/\n * billing/etc.). Verifica se o JWT do cookie não expirou antes de executar\n * a ação e roteia erros via `safeServerAction`.\n *\n * A verificação é feita localmente decodificando o campo `exp` do JWT —\n * sem round-trip ao backend.\n *\n * Para reads não-sensíveis, continue usando `safeServerAction` direto.\n */\nexport async function safeMutationAction<T>(\n  fn: () => Promise<T>\n): Promise<ActionResult<T>> {\n  return safeServerAction(async () => {\n    await requireTokenNotExpired();\n    return fn();\n  });\n}\n"],"mappings":"AAAA,OAAO;AAGP,SAAS,8BAA8B;AACvC,SAAS,wBAAwB;AAYjC,eAAsB,mBACpB,IAC0B;AAC1B,SAAO,iBAAiB,YAAY;AAClC,UAAM,uBAAuB;AAC7B,WAAO,GAAG;AAAA,EACZ,CAAC;AACH;","names":[]}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@greatapps/common",
-  "version": "1.1.588",
+  "version": "1.1.589",
   "description": "Shared library for GreatApps frontend applications",
   "main": "./dist/index.mjs",
   "types": "./src/index.ts",

package/src/modules/auth/utils/require-token-not-expired.ts

@@ -0,0 +1,40 @@
+import 'server-only';
+
+import { cookies } from 'next/headers';
+import { ApiError } from '../../../infra/api/types';
+
+const AUTH_COOKIE_NAME = 'greatapps';
+
+/**
+ * Verifica se o JWT do cookie `greatapps` não expirou checando o campo `exp`
+ * no payload, sem bater no backend.
+ *
+ * - Se o token não existe → SESSION_INVALID 401
+ * - Se o token é malformado → SESSION_INVALID 401
+ * - Se `exp` não existe ou já passou → SESSION_INVALID 401
+ *
+ * Isso substitui o `requireValidSession` (que fazia POST /auth/keep) no
+ * `safeMutationAction`, eliminando 1 round-trip ao backend por mutation.
+ */
+export async function requireTokenNotExpired(): Promise<void> {
+  if (process.env.DUMMY_AUTH_TOKEN) return;
+
+  const cookieStore = await cookies();
+  const token = cookieStore.get(AUTH_COOKIE_NAME)?.value;
+
+  if (!token) {
+    throw new ApiError('Sessão inválida ou expirada', 'SESSION_INVALID', 401);
+  }
+
+  try {
+    const payload = JSON.parse(atob(token.split('.')[1]));
+    const now = Math.floor(Date.now() / 1000);
+
+    if (!payload.exp || payload.exp <= now) {
+      throw new ApiError('Sessão inválida ou expirada', 'SESSION_INVALID', 401);
+    }
+  } catch (err) {
+    if (err instanceof ApiError) throw err;
+    throw new ApiError('Sessão inválida ou expirada', 'SESSION_INVALID', 401);
+  }
+}

package/src/server.ts

@@ -75,6 +75,7 @@ export {
 export { getClientInfoFromRequest } from './infra/utils/client-info';
 export { getUserContext } from './modules/auth/utils/get-user-context';
 export { requireValidSession } from './modules/auth/utils/require-valid-session';
+export { requireTokenNotExpired } from './modules/auth/utils/require-token-not-expired';
 export { buildWlOverride, buildWlOverrideFromJwt } from './modules/auth/utils/build-wl-override';
 export { safeServerAction } from './utils/safeServerAction';
 export { safeMutationAction } from './utils/safeMutationAction';

package/src/utils/safeMutationAction.ts

@@ -1,22 +1,16 @@
 import 'server-only';
 
 import type { ActionResult } from '../infra/api/types';
-import { requireValidSession } from '../modules/auth/utils/require-valid-session';
+import { requireTokenNotExpired } from '../modules/auth/utils/require-token-not-expired';
 import { safeServerAction } from './safeServerAction';
 
 /**
  * Wrapper para server actions que mutam estado (delete/update/create/publish/
- * billing/etc.). Faz validação de sessão contra o backend (`POST /auth/keep`)
- * antes de executar a ação e roteia erros via `safeServerAction`.
+ * billing/etc.). Verifica se o JWT do cookie não expirou antes de executar
+ * a ação e roteia erros via `safeServerAction`.
  *
- * A validação é deduplicada por request — múltiplas actions sensíveis que
- * rodem dentro de uma mesma request pagam 1 round-trip ao backend, não N.
- *
- * Motivação (resumo): o backend confia no par `(whitelabel-token, id_account
- * no path)` nos endpoints de CRUD; o Next.js deriva `id_account` de
- * `atob(cookie)` sem verificar assinatura. Chamar `requireValidSession`
- * aqui garante que o cookie corresponde a uma sessão real no banco antes
- * de qualquer mutação.
+ * A verificação é feita localmente decodificando o campo `exp` do JWT —
+ * sem round-trip ao backend.
  *
  * Para reads não-sensíveis, continue usando `safeServerAction` direto.
  */
@@ -24,7 +18,7 @@ export async function safeMutationAction<T>(
   fn: () => Promise<T>
 ): Promise<ActionResult<T>> {
   return safeServerAction(async () => {
-    await requireValidSession();
+    await requireTokenNotExpired();
     return fn();
   });
 }