@greatapps/common 1.1.771 → 1.1.773

package/src/modules/auth/services/auth.service.ts

@@ -1,693 +1,707 @@
-import { cookies } from "next/headers";
-
-import { api, type RequestConfig } from "../../../infra/api/client";
-import { ApiError } from "../../../infra/api/types";
-import { whitelabelService } from "../../whitelabel/services/whitelabel.service";
-import { buildWlOverrideFromJwt } from "../utils/build-wl-override";
-import {
-  ClientInfo,
-  ForgotPasswordRequest,
-  ForgotPasswordResponse,
-  GeoLocation,
-  LoginApiResponse,
-  LoginRequest,
-  LoginResponse,
-  LogoutApiResponse,
-  LogoutRequest,
-  LogoutResponse,
-  RegisterApiRequest,
-  RegisterApiResponse,
-  RegisterRequest,
-  RegisterResponse,
-  ResendVerificationRequest,
-  ResendVerificationResponse,
-  ResetPasswordRequest,
-  ResetPasswordResponse,
-  SearchPlansApiResponse,
-  SessionKeepRequest,
-  SessionKeepResponse,
-  SocialGoogleApiResponse,
-  SocialGoogleResponse,
-  SocialOnboardingApiResponse,
-  SocialOnboardingRequest,
-  SocialOnboardingResponse,
-  IsolatedLoginResponse,
-  TwoFactorApiResponse,
-  TwoFactorRequest,
-  TwoFactorResponse,
-  UnlinkGoogleApiResponse,
-  UnlinkGoogleResponse,
-  VerifyEmailRequest,
-  VerifyEmailResponse,
-} from "../schema";
-import { findWhitelabel } from "../../../server";
-
-const AUTH_COOKIE_NAME = "greatapps";
-const COOKIE_MAX_AGE = 60 * 60 * 24 * 30;
-
-const COOKIE_OPTIONS = {
-  httpOnly: true,
-  secure: process.env.NODE_ENV === "production",
-  sameSite: "lax" as const,
-  path: "/",
-};
-
-class AuthService {
-  async login(
-    credentials: LoginRequest,
-    clientInfo: ClientInfo,
-  ): Promise<LoginResponse>;
-  async login(
-    credentials: LoginRequest,
-    clientInfo: ClientInfo,
-    options: { setCookie: false },
-  ): Promise<IsolatedLoginResponse>;
-  async login(
-    credentials: LoginRequest,
-    clientInfo: ClientInfo,
-    options?: { setCookie?: boolean },
-  ): Promise<LoginResponse | IsolatedLoginResponse>;
-  async login(
-    credentials: LoginRequest,
-    clientInfo: ClientInfo,
-    options?: { setCookie?: boolean },
-  ): Promise<LoginResponse | IsolatedLoginResponse> {
-    let requestConfig: RequestConfig | undefined;
-    if (credentials.id_wl) {
-      const wlToken = await whitelabelService.getTokenByWhitelabelId(
-        credentials.id_wl,
-      );
-      requestConfig = { whiteLabelId: credentials.id_wl, authToken: wlToken };
-    }
-
-    const response = await api.apps.post<LoginApiResponse>(
-      "/auth/login",
-      {
-        email: credentials.email,
-        password: credentials.password,
-        source: credentials?.source,
-        location: clientInfo.location,
-        ip: clientInfo.ip,
-        timezone: clientInfo.timezone,
-        agent: clientInfo.agent,
-      },
-      requestConfig,
-    );
-
-    if (response.status === 0) {
-      throw new ApiError(
-        response.message || "E-mail ou senha incorretos",
-        response.code || "LOGIN_FAILED",
-        401,
-      );
-    }
-
-    if (!response.cookie) {
-      throw new ApiError(
-        "Resposta de autenticação inválida",
-        "INVALID_RESPONSE",
-        500,
-      );
-    }
-
-    if (response.two_factor_required) {
-      return { result: "two_factor_required", cookie: response.cookie, twoFactorMode: response.two_factor_required };
-    }
-
-    // Modo isolado: caller só quer o token, sem afetar a sessão do navegador
-    // nem pagar pelas chamadas de user/account (ex.: fluxo de SSO).
-    if (options?.setCookie === false) {
-      return { result: "success", accessToken: response.cookie };
-    }
-
-    await this.setAuthCookie(response.cookie);
-
-    const [{ userService }, { accountService }] = await Promise.all([
-      import("../../users/services/user.service"),
-      import("../../accounts/services/account.service"),
-    ]);
-    const [user, account] = await Promise.all([
-      userService.findById(
-        requestConfig ? { authToken: requestConfig.authToken } : undefined,
-      ),
-      accountService.findCurrentAccount(requestConfig),
-    ]);
-
-    return {
-      result: "success",
-      user,
-      account,
-      accessToken: response.cookie,
-      refreshToken: "",
-      expiresAt: new Date(Date.now() + COOKIE_MAX_AGE * 1000).toISOString(),
-    };
-  }
-
-  async verifyTwoFactor(
-    cookie: string,
-    code: string,
-    clientInfo: ClientInfo,
-    options?: { window?: number; setCookie?: boolean },
-  ): Promise<TwoFactorResponse> {
-    const payload: TwoFactorRequest = {
-      location: clientInfo.location,
-      ip: clientInfo.ip,
-      timezone: clientInfo.timezone,
-      agent: clientInfo.agent,
-      cookie,
-      code,
-    };
-
-    const endpoint = options?.window !== undefined ? `/auth/code?window=${options.window}` : '/auth/code';
-    const response = await api.apps.post<TwoFactorApiResponse>(
-      endpoint,
-      payload,
-    );
-
-    if (response.status === 0) {
-      throw new ApiError("Código 2FA inválido", "TWO_FACTOR_FAILED", 401);
-    }
-
-    if (!response?.data?.cookie) {
-      throw new ApiError(
-        "Resposta de autenticação inválida após 2FA",
-        "INVALID_RESPONSE",
-        500,
-      );
-    }
-
-    // Modo isolado: devolve o token sem gravar o cookie — o caller redireciona
-    // pra outro lugar (ex.: SSO callback) e não quer mexer na sessão atual.
-    if (options?.setCookie === false) {
-      return { status: 1, accessToken: response.data.cookie };
-    }
-
-    await this.setAuthCookie(response.data.cookie);
-
-    return { status: 1 };
-  }
-
-  async socialLoginGoogle(
-    code: string,
-    clientInfo: ClientInfo,
-  ): Promise<SocialGoogleResponse> {
-    const response = await api.apps.post<SocialGoogleApiResponse>(
-      "/auth/social/google",
-      {
-        code,
-        location: clientInfo.location,
-        ip: clientInfo.ip,
-        timezone: clientInfo.timezone,
-        agent: clientInfo.agent,
-        verification: true,
-      },
-    );
-
-    if (response.status === 0) {
-      if (response.code === "link_requires_password") {
-        return {
-          result: "link_requires_password",
-          message:
-            response.message ||
-            "Uma conta com esse e-mail já existe. Faça login com e-mail e senha para vincular sua conta Google.",
-        };
-      }
-      throw new ApiError(
-        response.message || "Falha no login com Google",
-        response.code || "GOOGLE_LOGIN_FAILED",
-        401,
-      );
-    }
-
-    if (response.needs_onboarding) {
-      if (!response.onboarding_token || !response.partial?.email) {
-        throw new ApiError(
-          "Resposta de onboarding inválida",
-          "INVALID_RESPONSE",
-          500,
-        );
-      }
-      return {
-        result: "needs_onboarding",
-        onboardingToken: response.onboarding_token,
-        partial: response.partial,
-      };
-    }
-
-    if (!response.cookie) {
-      throw new ApiError(
-        "Resposta de autenticação inválida",
-        "INVALID_RESPONSE",
-        500,
-      );
-    }
-
-    if (response.two_factor_required) {
-      return {
-        result: "two_factor_required",
-        cookie: response.cookie,
-        twoFactorMode: response.two_factor_required,
-      };
-    }
-
-    await this.setAuthCookie(response.cookie);
-
-    const [{ userService }, { accountService }] = await Promise.all([
-      import("../../users/services/user.service"),
-      import("../../accounts/services/account.service"),
-    ]);
-    const [user, account] = await Promise.all([
-      userService.findById(),
-      accountService.findCurrentAccount(),
-    ]);
-
-    return {
-      result: "success",
-      user,
-      account,
-      accessToken: response.cookie,
-      expiresAt: new Date(Date.now() + COOKIE_MAX_AGE * 1000).toISOString(),
-    };
-  }
-
-  async completeGoogleOnboarding(
-    data: SocialOnboardingRequest,
-    clientInfo: ClientInfo,
-  ): Promise<SocialOnboardingResponse> {
-    const today = new Date();
-    const trialEndDate = new Date(today);
-    const trialDays = Math.min(Math.max(data.trialDays ?? 7, 1), 90);
-    trialEndDate.setDate(today.getDate() + trialDays);
-
-    const idPlan = await this.resolvePlanId(data.idPlan);
-
-    const payload = {
-      onboarding_token: data.onboardingToken,
-      name: data.user.name,
-      bussiness_type: data.businessType ?? 0,
-      language: "pt-br",
-      timezone: "America/Sao_Paulo",
-      currency: "BRL",
-      location: clientInfo.location,
-      ip: clientInfo.ip,
-      agent: clientInfo.agent,
-      id_affiliate: data.affiliateId || 0,
-      origin: data.origin,
-      user: {
-        id_api: "",
-        name: data.user.name || "",
-        last_name: data.user.last_name || "",
-        rg: data.user.rg || "",
-        cpf: data.user.cpf || "",
-        gender: data.user.gender ?? 1,
-        ddi: data.user.ddi || "55",
-        phone: data.user.phone || "",
-        profile: "owner",
-        language: "pt-br",
-      },
-      subscription:
-        idPlan === -1
-          ? {
-              type: "free",
-              id_coupon: data.couponId || 0,
-              id_plan: 5,
-              id_product: 1,
-            }
-          : {
-              type: "trial",
-              id_coupon: data.couponId || 0,
-              id_plan: idPlan,
-              date_due: trialEndDate.toISOString().split("T")[0],
-              trial_days: trialDays,
-              id_product: 1,
-            },
-    };
-
-    const response = await api.apps.post<SocialOnboardingApiResponse>(
-      "/auth/social/onboarding",
-      payload,
-    );
-
-    if (response.status === 0) {
-      throw new ApiError(
-        response.message || "Erro ao finalizar cadastro com Google",
-        "ONBOARDING_FAILED",
-        400,
-      );
-    }
-
-    if (!response.data?.length || !response.cookie) {
-      throw new ApiError(
-        "Resposta de cadastro inválida",
-        "INVALID_RESPONSE",
-        500,
-      );
-    }
-
-    await this.setAuthCookie(response.cookie);
-
-    const [{ userService }, { accountService }] = await Promise.all([
-      import("../../users/services/user.service"),
-      import("../../accounts/services/account.service"),
-    ]);
-    const [user, account] = await Promise.all([
-      userService.findById(),
-      accountService.findCurrentAccount(),
-    ]);
-
-    return {
-      user,
-      account,
-      accessToken: response.cookie,
-      expiresAt: new Date(Date.now() + COOKIE_MAX_AGE * 1000).toISOString(),
-    };
-  }
-
-  async unlinkGoogle(): Promise<UnlinkGoogleResponse> {
-    const { id_account, id_user } = await import(
-      "../utils/get-user-context"
-    ).then((m) => m.getUserContext());
-
-    const response = await api.apps.delete<UnlinkGoogleApiResponse>(
-      `/accounts/${id_account}/users/${id_user}/social/google`,
-    );
-
-    if (response.status === 0) {
-      throw new ApiError(
-        response.message || "Erro ao desvincular conta Google",
-        "UNLINK_FAILED",
-        400,
-      );
-    }
-
-    return {
-      success: true,
-      message: response.message,
-    };
-  }
-
-  async register(
-    data: RegisterRequest,
-    clientInfo: ClientInfo,
-  ): Promise<RegisterResponse> {
-    const today = new Date();
-    const trialEndDate = new Date(today);
-    const trialDays = Math.min(Math.max(data.trialDays ?? 7, 1), 90);
-    trialEndDate.setDate(today.getDate() + trialDays);
-
-    const idPlan = await this.resolvePlanId(data.idPlan);
-
-    const payload: RegisterApiRequest = {
-      name: data.accountName,
-      bussiness_type: data.businessType ?? 0,
-      language: "pt-br",
-      timezone: "America/Sao_Paulo",
-      currency: "BRL",
-      location: clientInfo.location,
-      ip: clientInfo.ip,
-      agent: clientInfo.agent,
-      id_affiliate: data.affiliateId || 0,
-      origin: data.origin,
-      user: {
-        id_api: "",
-        name: data.name,
-        last_name: data.lastName || "",
-        rg: data.rg || "",
-        cpf: data.cpf || "",
-        gender: data.gender,
-        email: data.email,
-        phone: data.phone,
-        password: data.password,
-        profile: "owner",
-        language: "pt-br",
-      },
-      subscription:
-        idPlan === -1
-          ? {
-              type: "free",
-              id_coupon: data.couponId || 0,
-              id_plan: 5, // Plano Free (ID fixo)
-              id_product: 1,
-            }
-          : {
-              type: "trial",
-              id_coupon: data.couponId || 0,
-              id_plan: idPlan,
-              // Fluxo não-Stripe lê `date_due`; fluxo Stripe lê `trial_days`.
-              // Mandamos os dois pra cobrir ambos os caminhos da API.
-              date_due: trialEndDate.toISOString().split("T")[0],
-              trial_days: trialDays,
-              id_product: 1,
-            },
-    };
-
-    const response = await api.apps.post<RegisterApiResponse>(
-      "/accounts",
-      payload,
-    );
-
-    if (response.status === 0) {
-      throw new ApiError(
-        response.message || "Erro ao criar conta",
-        "REGISTER_FAILED",
-        400,
-      );
-    }
-
-    if (!response.data || response.data.length === 0) {
-      throw new ApiError(
-        "Resposta de registro inválida",
-        "INVALID_RESPONSE",
-        500,
-      );
-    }
-
-    if (!response.cookie) {
-      throw new ApiError(
-        "Resposta de autenticação inválida",
-        "INVALID_RESPONSE",
-        500,
-      );
-    }
-
-    const accountData = response.data[0];
-
-    await this.setAuthCookie(response.cookie);
-
-    const [{ userService }, { accountService }] = await Promise.all([
-      import("../../users/services/user.service"),
-      import("../../accounts/services/account.service"),
-    ]);
-    const [user, account] = await Promise.all([
-      userService.findById(),
-      accountService.findCurrentAccount(),
-    ]);
-
-    return {
-      user,
-      account,
-      accessToken: response.cookie,
-      refreshToken: "",
-      expiresAt: new Date(Date.now() + COOKIE_MAX_AGE * 1000).toISOString(),
-      requiresEmailVerification: !accountData.verified,
-    };
-  }
-
-  async logout(clientInfo: ClientInfo): Promise<LogoutResponse> {
-    const cookie = await this.getToken();
-
-    if (!cookie) {
-      throw new ApiError(
-        "Usuário não autenticado",
-        "NOT_AUTHENTICATED_LOGOUT",
-        401
-      );
-    }
-
-    const payload: LogoutRequest = {
-      location: clientInfo.location,
-      ip: clientInfo.ip,
-      timezone: clientInfo.timezone,
-      agent: clientInfo.agent,
-      cookie,
-    };
-
-    try {
-      const response = await api.apps.post<LogoutApiResponse>(
-        "/auth/logout",
-        payload,
-      );
-
-      if (response.status === 0) {
-        throw new ApiError(
-          response.message || "Erro ao realizar logout",
-          response.code || "LOGOUT_FAILED",
-          400,
-        );
-      }
-    } finally {
-      await this.removeAuthCookie();
-    }
-
-    return {
-      success: true,
-    };
-  }
-
-  async forgotPassword(
-    _data: ForgotPasswordRequest,
-  ): Promise<ForgotPasswordResponse> {
-    throw new ApiError(
-      "Recuperação de senha não implementada",
-      "NOT_IMPLEMENTED",
-      501,
-    );
-  }
-
-  async resetPassword(
-    _data: ResetPasswordRequest,
-  ): Promise<ResetPasswordResponse> {
-    throw new ApiError(
-      "Redefinição de senha não implementada",
-      "NOT_IMPLEMENTED",
-      501,
-    );
-  }
-
-  async verifyEmail(_data: VerifyEmailRequest): Promise<VerifyEmailResponse> {
-    throw new ApiError(
-      "Verificação de email não implementada",
-      "NOT_IMPLEMENTED",
-      501,
-    );
-  }
-
-  async resendVerification(
-    _data: ResendVerificationRequest,
-  ): Promise<ResendVerificationResponse> {
-    throw new ApiError(
-      "Reenvio de verificação não implementado",
-      "NOT_IMPLEMENTED",
-      501,
-    );
-  }
-
-  async validateSession(clientInfo: ClientInfo): Promise<boolean> {
-    const cookie = await this.getToken();
-
-    if (!cookie) {
-      return false;
-    }
-
-    try {
-      const requestConfig = await buildWlOverrideFromJwt(cookie);
-
-      const payload: SessionKeepRequest = {
-        location: clientInfo.location,
-        ip: clientInfo.ip,
-        timezone: clientInfo.timezone,
-        agent: clientInfo.agent,
-        cookie,
-      };
-
-      const response = await api.apps.post<SessionKeepResponse>(
-        "/auth/keep",
-        payload,
-        requestConfig,
-      );
-
-      return response.status === 1;
-    } catch (error) {
-      console.error("[AuthService] validateSession error", error);
-      return false;
-    }
-  }
-
-  async isAuthenticated(): Promise<boolean> {
-    const token = await this.getToken();
-    return !!token;
-  }
-
-  async getToken(): Promise<string | undefined> {
-    if (process.env.DUMMY_AUTH_TOKEN) return process.env.DUMMY_AUTH_TOKEN;
-    const cookieStore = await cookies();
-    return cookieStore.get(AUTH_COOKIE_NAME)?.value;
-  }
-
-  private async resolvePlanId(idPlan?: number | string | null): Promise<number> {
-    if (idPlan == null || idPlan === "") return -1;
-    if (typeof idPlan === "number" || Number(idPlan)) return Number(idPlan);
-
-    if (typeof idPlan === "string") {
-      const response = await api.apps.get<SearchPlansApiResponse>(
-        `/plans?search=${encodeURIComponent(idPlan)}`,
-      );
-
-      if (response.status === 1 && response.data?.length) {
-        return response.data[0].id;
-      }
-
-      throw new ApiError(
-        `Plano "${idPlan}" não encontrado`,
-        "PLAN_NOT_FOUND",
-        404,
-      );
-    }
-    return -1;
-  }
-
-  private async setAuthCookie(token: string): Promise<void> {
-    const cookieStore = await cookies();
-    const whitelabel = await findWhitelabel().catch(() => null);
-    const cookieDomain =
-      this.normalizeCookieDomain(whitelabel?.domain);
-
-    cookieStore.set(AUTH_COOKIE_NAME, token, {
-      ...COOKIE_OPTIONS,
-      ...(cookieDomain ? { domain: cookieDomain } : {}),
-      maxAge: COOKIE_MAX_AGE,
-    });
-  }
-
-  async removeAuthCookie(): Promise<void> {
-    const cookieStore = await cookies();
-    const whitelabel = await findWhitelabel().catch(() => null);
-    const cookieDomain =
-      this.normalizeCookieDomain(whitelabel?.domain);
-
-    cookieStore.delete({
-      name: AUTH_COOKIE_NAME,
-      ...COOKIE_OPTIONS,
-      ...(cookieDomain ? { domain: cookieDomain } : {}),
-    });
-  }
-
-  private normalizeCookieDomain(domain?: string | null): string | undefined {
-    if (!domain) return undefined;
-
-    const normalized = domain.trim();
-    if (!normalized) return undefined;
-
-    const rawHost = (() => {
-      try {
-        return new URL(normalized).hostname;
-      } catch {
-        return normalized
-          .replace(/^https?:\/\//i, "")
-          .replace(/^www\./i, "")
-          .split("/")[0]
-          .split(":")[0];
-      }
-    })();
-
-    if (!rawHost || rawHost === "localhost") {
-      return undefined;
-    }
-
-    return rawHost.startsWith(".") ? rawHost : `.${rawHost}`;
-  }
-}
-
-export const authService = new AuthService();
-
-export type { ClientInfo, GeoLocation };
+import { cookies } from "next/headers";
+
+import { api, type RequestConfig } from "../../../infra/api/client";
+import { ApiError } from "../../../infra/api/types";
+import { whitelabelService } from "../../whitelabel/services/whitelabel.service";
+import { buildWlOverrideFromJwt } from "../utils/build-wl-override";
+import {
+  ClientInfo,
+  ForgotPasswordRequest,
+  ForgotPasswordResponse,
+  GeoLocation,
+  LoginApiResponse,
+  LoginRequest,
+  LoginResponse,
+  LogoutApiResponse,
+  LogoutRequest,
+  LogoutResponse,
+  RegisterApiRequest,
+  RegisterApiResponse,
+  RegisterRequest,
+  RegisterResponse,
+  ResendVerificationRequest,
+  ResendVerificationResponse,
+  ResetPasswordRequest,
+  ResetPasswordResponse,
+  SearchPlansApiResponse,
+  SessionKeepRequest,
+  SessionKeepResponse,
+  SocialGoogleApiResponse,
+  SocialGoogleResponse,
+  SocialOnboardingApiResponse,
+  SocialOnboardingRequest,
+  SocialOnboardingResponse,
+  IsolatedLoginResponse,
+  TwoFactorApiResponse,
+  TwoFactorRequest,
+  TwoFactorResponse,
+  UnlinkGoogleApiResponse,
+  UnlinkGoogleResponse,
+  VerifyEmailRequest,
+  VerifyEmailResponse,
+} from "../schema";
+import { findWhitelabel } from "../../../server";
+
+const AUTH_COOKIE_NAME = "greatapps";
+const COOKIE_MAX_AGE = 60 * 60 * 24 * 30;
+
+/** Plano Free (ID fixo). */
+const FREE_PLAN_ID = 5;
+
+/**
+ * O cadastro pede o Free de duas formas, e as duas valem: ausência de plano (que o
+ * `resolvePlanId` traduz para o sentinela -1) e o id do próprio Free.
+ *
+ * Olhar só o sentinela fazia `?id_plan=5` cair no ramo `trial` e criar um trial de 7 dias
+ * do plano gratuito, com `date_due` e `trial_days` — estado que não existe no produto.
+ */
+function isFreePlan(idPlan: number): boolean {
+  return idPlan === -1 || idPlan === FREE_PLAN_ID;
+}
+
+const COOKIE_OPTIONS = {
+  httpOnly: true,
+  secure: process.env.NODE_ENV === "production",
+  sameSite: "lax" as const,
+  path: "/",
+};
+
+class AuthService {
+  async login(
+    credentials: LoginRequest,
+    clientInfo: ClientInfo,
+  ): Promise<LoginResponse>;
+  async login(
+    credentials: LoginRequest,
+    clientInfo: ClientInfo,
+    options: { setCookie: false },
+  ): Promise<IsolatedLoginResponse>;
+  async login(
+    credentials: LoginRequest,
+    clientInfo: ClientInfo,
+    options?: { setCookie?: boolean },
+  ): Promise<LoginResponse | IsolatedLoginResponse>;
+  async login(
+    credentials: LoginRequest,
+    clientInfo: ClientInfo,
+    options?: { setCookie?: boolean },
+  ): Promise<LoginResponse | IsolatedLoginResponse> {
+    let requestConfig: RequestConfig | undefined;
+    if (credentials.id_wl) {
+      const wlToken = await whitelabelService.getTokenByWhitelabelId(
+        credentials.id_wl,
+      );
+      requestConfig = { whiteLabelId: credentials.id_wl, authToken: wlToken };
+    }
+
+    const response = await api.apps.post<LoginApiResponse>(
+      "/auth/login",
+      {
+        email: credentials.email,
+        password: credentials.password,
+        source: credentials?.source,
+        location: clientInfo.location,
+        ip: clientInfo.ip,
+        timezone: clientInfo.timezone,
+        agent: clientInfo.agent,
+      },
+      requestConfig,
+    );
+
+    if (response.status === 0) {
+      throw new ApiError(
+        response.message || "E-mail ou senha incorretos",
+        response.code || "LOGIN_FAILED",
+        401,
+      );
+    }
+
+    if (!response.cookie) {
+      throw new ApiError(
+        "Resposta de autenticação inválida",
+        "INVALID_RESPONSE",
+        500,
+      );
+    }
+
+    if (response.two_factor_required) {
+      return { result: "two_factor_required", cookie: response.cookie, twoFactorMode: response.two_factor_required };
+    }
+
+    // Modo isolado: caller só quer o token, sem afetar a sessão do navegador
+    // nem pagar pelas chamadas de user/account (ex.: fluxo de SSO).
+    if (options?.setCookie === false) {
+      return { result: "success", accessToken: response.cookie };
+    }
+
+    await this.setAuthCookie(response.cookie);
+
+    const [{ userService }, { accountService }] = await Promise.all([
+      import("../../users/services/user.service"),
+      import("../../accounts/services/account.service"),
+    ]);
+    const [user, account] = await Promise.all([
+      userService.findById(
+        requestConfig ? { authToken: requestConfig.authToken } : undefined,
+      ),
+      accountService.findCurrentAccount(requestConfig),
+    ]);
+
+    return {
+      result: "success",
+      user,
+      account,
+      accessToken: response.cookie,
+      refreshToken: "",
+      expiresAt: new Date(Date.now() + COOKIE_MAX_AGE * 1000).toISOString(),
+    };
+  }
+
+  async verifyTwoFactor(
+    cookie: string,
+    code: string,
+    clientInfo: ClientInfo,
+    options?: { window?: number; setCookie?: boolean },
+  ): Promise<TwoFactorResponse> {
+    const payload: TwoFactorRequest = {
+      location: clientInfo.location,
+      ip: clientInfo.ip,
+      timezone: clientInfo.timezone,
+      agent: clientInfo.agent,
+      cookie,
+      code,
+    };
+
+    const endpoint = options?.window !== undefined ? `/auth/code?window=${options.window}` : '/auth/code';
+    const response = await api.apps.post<TwoFactorApiResponse>(
+      endpoint,
+      payload,
+    );
+
+    if (response.status === 0) {
+      throw new ApiError("Código 2FA inválido", "TWO_FACTOR_FAILED", 401);
+    }
+
+    if (!response?.data?.cookie) {
+      throw new ApiError(
+        "Resposta de autenticação inválida após 2FA",
+        "INVALID_RESPONSE",
+        500,
+      );
+    }
+
+    // Modo isolado: devolve o token sem gravar o cookie — o caller redireciona
+    // pra outro lugar (ex.: SSO callback) e não quer mexer na sessão atual.
+    if (options?.setCookie === false) {
+      return { status: 1, accessToken: response.data.cookie };
+    }
+
+    await this.setAuthCookie(response.data.cookie);
+
+    return { status: 1 };
+  }
+
+  async socialLoginGoogle(
+    code: string,
+    clientInfo: ClientInfo,
+  ): Promise<SocialGoogleResponse> {
+    const response = await api.apps.post<SocialGoogleApiResponse>(
+      "/auth/social/google",
+      {
+        code,
+        location: clientInfo.location,
+        ip: clientInfo.ip,
+        timezone: clientInfo.timezone,
+        agent: clientInfo.agent,
+        verification: true,
+      },
+    );
+
+    if (response.status === 0) {
+      if (response.code === "link_requires_password") {
+        return {
+          result: "link_requires_password",
+          message:
+            response.message ||
+            "Uma conta com esse e-mail já existe. Faça login com e-mail e senha para vincular sua conta Google.",
+        };
+      }
+      throw new ApiError(
+        response.message || "Falha no login com Google",
+        response.code || "GOOGLE_LOGIN_FAILED",
+        401,
+      );
+    }
+
+    if (response.needs_onboarding) {
+      if (!response.onboarding_token || !response.partial?.email) {
+        throw new ApiError(
+          "Resposta de onboarding inválida",
+          "INVALID_RESPONSE",
+          500,
+        );
+      }
+      return {
+        result: "needs_onboarding",
+        onboardingToken: response.onboarding_token,
+        partial: response.partial,
+      };
+    }
+
+    if (!response.cookie) {
+      throw new ApiError(
+        "Resposta de autenticação inválida",
+        "INVALID_RESPONSE",
+        500,
+      );
+    }
+
+    if (response.two_factor_required) {
+      return {
+        result: "two_factor_required",
+        cookie: response.cookie,
+        twoFactorMode: response.two_factor_required,
+      };
+    }
+
+    await this.setAuthCookie(response.cookie);
+
+    const [{ userService }, { accountService }] = await Promise.all([
+      import("../../users/services/user.service"),
+      import("../../accounts/services/account.service"),
+    ]);
+    const [user, account] = await Promise.all([
+      userService.findById(),
+      accountService.findCurrentAccount(),
+    ]);
+
+    return {
+      result: "success",
+      user,
+      account,
+      accessToken: response.cookie,
+      expiresAt: new Date(Date.now() + COOKIE_MAX_AGE * 1000).toISOString(),
+    };
+  }
+
+  async completeGoogleOnboarding(
+    data: SocialOnboardingRequest,
+    clientInfo: ClientInfo,
+  ): Promise<SocialOnboardingResponse> {
+    const today = new Date();
+    const trialEndDate = new Date(today);
+    const trialDays = Math.min(Math.max(data.trialDays ?? 7, 1), 90);
+    trialEndDate.setDate(today.getDate() + trialDays);
+
+    const idPlan = await this.resolvePlanId(data.idPlan);
+
+    const payload = {
+      onboarding_token: data.onboardingToken,
+      name: data.user.name,
+      bussiness_type: data.businessType ?? 0,
+      language: "pt-br",
+      timezone: "America/Sao_Paulo",
+      currency: "BRL",
+      location: clientInfo.location,
+      ip: clientInfo.ip,
+      agent: clientInfo.agent,
+      id_affiliate: data.affiliateId || 0,
+      origin: data.origin,
+      user: {
+        id_api: "",
+        name: data.user.name || "",
+        last_name: data.user.last_name || "",
+        rg: data.user.rg || "",
+        cpf: data.user.cpf || "",
+        gender: data.user.gender ?? 1,
+        ddi: data.user.ddi || "55",
+        phone: data.user.phone || "",
+        profile: "owner",
+        language: "pt-br",
+      },
+      subscription:
+        isFreePlan(idPlan)
+          ? {
+              type: "free",
+              id_coupon: data.couponId || 0,
+              id_plan: FREE_PLAN_ID,
+              id_product: 1,
+            }
+          : {
+              type: "trial",
+              id_coupon: data.couponId || 0,
+              id_plan: idPlan,
+              date_due: trialEndDate.toISOString().split("T")[0],
+              trial_days: trialDays,
+              id_product: 1,
+            },
+    };
+
+    const response = await api.apps.post<SocialOnboardingApiResponse>(
+      "/auth/social/onboarding",
+      payload,
+    );
+
+    if (response.status === 0) {
+      throw new ApiError(
+        response.message || "Erro ao finalizar cadastro com Google",
+        "ONBOARDING_FAILED",
+        400,
+      );
+    }
+
+    if (!response.data?.length || !response.cookie) {
+      throw new ApiError(
+        "Resposta de cadastro inválida",
+        "INVALID_RESPONSE",
+        500,
+      );
+    }
+
+    await this.setAuthCookie(response.cookie);
+
+    const [{ userService }, { accountService }] = await Promise.all([
+      import("../../users/services/user.service"),
+      import("../../accounts/services/account.service"),
+    ]);
+    const [user, account] = await Promise.all([
+      userService.findById(),
+      accountService.findCurrentAccount(),
+    ]);
+
+    return {
+      user,
+      account,
+      accessToken: response.cookie,
+      expiresAt: new Date(Date.now() + COOKIE_MAX_AGE * 1000).toISOString(),
+    };
+  }
+
+  async unlinkGoogle(): Promise<UnlinkGoogleResponse> {
+    const { id_account, id_user } = await import(
+      "../utils/get-user-context"
+    ).then((m) => m.getUserContext());
+
+    const response = await api.apps.delete<UnlinkGoogleApiResponse>(
+      `/accounts/${id_account}/users/${id_user}/social/google`,
+    );
+
+    if (response.status === 0) {
+      throw new ApiError(
+        response.message || "Erro ao desvincular conta Google",
+        "UNLINK_FAILED",
+        400,
+      );
+    }
+
+    return {
+      success: true,
+      message: response.message,
+    };
+  }
+
+  async register(
+    data: RegisterRequest,
+    clientInfo: ClientInfo,
+  ): Promise<RegisterResponse> {
+    const today = new Date();
+    const trialEndDate = new Date(today);
+    const trialDays = Math.min(Math.max(data.trialDays ?? 7, 1), 90);
+    trialEndDate.setDate(today.getDate() + trialDays);
+
+    const idPlan = await this.resolvePlanId(data.idPlan);
+
+    const payload: RegisterApiRequest = {
+      name: data.accountName,
+      bussiness_type: data.businessType ?? 0,
+      language: "pt-br",
+      timezone: "America/Sao_Paulo",
+      currency: "BRL",
+      location: clientInfo.location,
+      ip: clientInfo.ip,
+      agent: clientInfo.agent,
+      id_affiliate: data.affiliateId || 0,
+      origin: data.origin,
+      user: {
+        id_api: "",
+        name: data.name,
+        last_name: data.lastName || "",
+        rg: data.rg || "",
+        cpf: data.cpf || "",
+        gender: data.gender,
+        email: data.email,
+        phone: data.phone,
+        password: data.password,
+        profile: "owner",
+        language: "pt-br",
+      },
+      subscription:
+        isFreePlan(idPlan)
+          ? {
+              type: "free",
+              id_coupon: data.couponId || 0,
+              id_plan: FREE_PLAN_ID,
+              id_product: 1,
+            }
+          : {
+              type: "trial",
+              id_coupon: data.couponId || 0,
+              id_plan: idPlan,
+              // Fluxo não-Stripe lê `date_due`; fluxo Stripe lê `trial_days`.
+              // Mandamos os dois pra cobrir ambos os caminhos da API.
+              date_due: trialEndDate.toISOString().split("T")[0],
+              trial_days: trialDays,
+              id_product: 1,
+            },
+    };
+
+    const response = await api.apps.post<RegisterApiResponse>(
+      "/accounts",
+      payload,
+    );
+
+    if (response.status === 0) {
+      throw new ApiError(
+        response.message || "Erro ao criar conta",
+        "REGISTER_FAILED",
+        400,
+      );
+    }
+
+    if (!response.data || response.data.length === 0) {
+      throw new ApiError(
+        "Resposta de registro inválida",
+        "INVALID_RESPONSE",
+        500,
+      );
+    }
+
+    if (!response.cookie) {
+      throw new ApiError(
+        "Resposta de autenticação inválida",
+        "INVALID_RESPONSE",
+        500,
+      );
+    }
+
+    const accountData = response.data[0];
+
+    await this.setAuthCookie(response.cookie);
+
+    const [{ userService }, { accountService }] = await Promise.all([
+      import("../../users/services/user.service"),
+      import("../../accounts/services/account.service"),
+    ]);
+    const [user, account] = await Promise.all([
+      userService.findById(),
+      accountService.findCurrentAccount(),
+    ]);
+
+    return {
+      user,
+      account,
+      accessToken: response.cookie,
+      refreshToken: "",
+      expiresAt: new Date(Date.now() + COOKIE_MAX_AGE * 1000).toISOString(),
+      requiresEmailVerification: !accountData.verified,
+    };
+  }
+
+  async logout(clientInfo: ClientInfo): Promise<LogoutResponse> {
+    const cookie = await this.getToken();
+
+    if (!cookie) {
+      throw new ApiError(
+        "Usuário não autenticado",
+        "NOT_AUTHENTICATED_LOGOUT",
+        401
+      );
+    }
+
+    const payload: LogoutRequest = {
+      location: clientInfo.location,
+      ip: clientInfo.ip,
+      timezone: clientInfo.timezone,
+      agent: clientInfo.agent,
+      cookie,
+    };
+
+    try {
+      const response = await api.apps.post<LogoutApiResponse>(
+        "/auth/logout",
+        payload,
+      );
+
+      if (response.status === 0) {
+        throw new ApiError(
+          response.message || "Erro ao realizar logout",
+          response.code || "LOGOUT_FAILED",
+          400,
+        );
+      }
+    } finally {
+      await this.removeAuthCookie();
+    }
+
+    return {
+      success: true,
+    };
+  }
+
+  async forgotPassword(
+    _data: ForgotPasswordRequest,
+  ): Promise<ForgotPasswordResponse> {
+    throw new ApiError(
+      "Recuperação de senha não implementada",
+      "NOT_IMPLEMENTED",
+      501,
+    );
+  }
+
+  async resetPassword(
+    _data: ResetPasswordRequest,
+  ): Promise<ResetPasswordResponse> {
+    throw new ApiError(
+      "Redefinição de senha não implementada",
+      "NOT_IMPLEMENTED",
+      501,
+    );
+  }
+
+  async verifyEmail(_data: VerifyEmailRequest): Promise<VerifyEmailResponse> {
+    throw new ApiError(
+      "Verificação de email não implementada",
+      "NOT_IMPLEMENTED",
+      501,
+    );
+  }
+
+  async resendVerification(
+    _data: ResendVerificationRequest,
+  ): Promise<ResendVerificationResponse> {
+    throw new ApiError(
+      "Reenvio de verificação não implementado",
+      "NOT_IMPLEMENTED",
+      501,
+    );
+  }
+
+  async validateSession(clientInfo: ClientInfo): Promise<boolean> {
+    const cookie = await this.getToken();
+
+    if (!cookie) {
+      return false;
+    }
+
+    try {
+      const requestConfig = await buildWlOverrideFromJwt(cookie);
+
+      const payload: SessionKeepRequest = {
+        location: clientInfo.location,
+        ip: clientInfo.ip,
+        timezone: clientInfo.timezone,
+        agent: clientInfo.agent,
+        cookie,
+      };
+
+      const response = await api.apps.post<SessionKeepResponse>(
+        "/auth/keep",
+        payload,
+        requestConfig,
+      );
+
+      return response.status === 1;
+    } catch (error) {
+      console.error("[AuthService] validateSession error", error);
+      return false;
+    }
+  }
+
+  async isAuthenticated(): Promise<boolean> {
+    const token = await this.getToken();
+    return !!token;
+  }
+
+  async getToken(): Promise<string | undefined> {
+    if (process.env.DUMMY_AUTH_TOKEN) return process.env.DUMMY_AUTH_TOKEN;
+    const cookieStore = await cookies();
+    return cookieStore.get(AUTH_COOKIE_NAME)?.value;
+  }
+
+  private async resolvePlanId(idPlan?: number | string | null): Promise<number> {
+    if (idPlan == null || idPlan === "") return -1;
+    if (typeof idPlan === "number" || Number(idPlan)) return Number(idPlan);
+
+    if (typeof idPlan === "string") {
+      const response = await api.apps.get<SearchPlansApiResponse>(
+        `/plans?search=${encodeURIComponent(idPlan)}`,
+      );
+
+      if (response.status === 1 && response.data?.length) {
+        return response.data[0].id;
+      }
+
+      throw new ApiError(
+        `Plano "${idPlan}" não encontrado`,
+        "PLAN_NOT_FOUND",
+        404,
+      );
+    }
+    return -1;
+  }
+
+  private async setAuthCookie(token: string): Promise<void> {
+    const cookieStore = await cookies();
+    const whitelabel = await findWhitelabel().catch(() => null);
+    const cookieDomain =
+      this.normalizeCookieDomain(whitelabel?.domain);
+
+    cookieStore.set(AUTH_COOKIE_NAME, token, {
+      ...COOKIE_OPTIONS,
+      ...(cookieDomain ? { domain: cookieDomain } : {}),
+      maxAge: COOKIE_MAX_AGE,
+    });
+  }
+
+  async removeAuthCookie(): Promise<void> {
+    const cookieStore = await cookies();
+    const whitelabel = await findWhitelabel().catch(() => null);
+    const cookieDomain =
+      this.normalizeCookieDomain(whitelabel?.domain);
+
+    cookieStore.delete({
+      name: AUTH_COOKIE_NAME,
+      ...COOKIE_OPTIONS,
+      ...(cookieDomain ? { domain: cookieDomain } : {}),
+    });
+  }
+
+  private normalizeCookieDomain(domain?: string | null): string | undefined {
+    if (!domain) return undefined;
+
+    const normalized = domain.trim();
+    if (!normalized) return undefined;
+
+    const rawHost = (() => {
+      try {
+        return new URL(normalized).hostname;
+      } catch {
+        return normalized
+          .replace(/^https?:\/\//i, "")
+          .replace(/^www\./i, "")
+          .split("/")[0]
+          .split(":")[0];
+      }
+    })();
+
+    if (!rawHost || rawHost === "localhost") {
+      return undefined;
+    }
+
+    return rawHost.startsWith(".") ? rawHost : `.${rawHost}`;
+  }
+}
+
+export const authService = new AuthService();
+
+export type { ClientInfo, GeoLocation };