@neetru/sdk 2.1.0 → 2.2.0

package/dist/auth.d.cts

@@ -1,9 +1,11 @@
-import { o as NeetruClientConfig, N as NeetruClient } from './types-Kmt4y1FQ.cjs';
-import './collection-ref-BBvTTXoG.cjs';
+import { o as NeetruClientConfig, N as NeetruClient } from './types-DlDxttiG.cjs';
+import './collection-ref-DqAAhuhX.cjs';
 import '@neetru/realtime-protocol';
 import 'drizzle-orm/node-postgres';
 import './errors.cjs';
 
+/** Limpa o cache de JWKS — uso exclusivo em testes. */
+declare function __resetJwksCacheForTests(): void;
 /**
  * Cria uma instância imutável do cliente Neetru SDK.
  *
@@ -26,4 +28,4 @@ import './errors.cjs';
  */
 declare function createNeetruClient(config?: NeetruClientConfig): NeetruClient;
 
-export { createNeetruClient };
+export { __resetJwksCacheForTests, createNeetruClient };

package/dist/auth.d.ts

@@ -1,9 +1,11 @@
-import { o as NeetruClientConfig, N as NeetruClient } from './types-B1jylbMC.js';
-import './collection-ref-BBvTTXoG.js';
+import { o as NeetruClientConfig, N as NeetruClient } from './types-CvTje138.js';
+import './collection-ref-DqAAhuhX.js';
 import '@neetru/realtime-protocol';
 import 'drizzle-orm/node-postgres';
 import './errors.js';
 
+/** Limpa o cache de JWKS — uso exclusivo em testes. */
+declare function __resetJwksCacheForTests(): void;
 /**
  * Cria uma instância imutável do cliente Neetru SDK.
  *
@@ -26,4 +28,4 @@ import './errors.js';
  */
 declare function createNeetruClient(config?: NeetruClientConfig): NeetruClient;
 
-export { createNeetruClient };
+export { __resetJwksCacheForTests, createNeetruClient };

package/dist/auth.mjs

@@ -1,3 +1,4 @@
+import { jwtVerify, createRemoteJWKSet } from 'jose';
 import { openDB } from 'idb';
 
 var __defProp = Object.defineProperty;
@@ -2954,10 +2955,9 @@ var DbCollectionRefImpl = class {
     const batchId = `batch-${Date.now()}-${Math.random().toString(36).slice(2)}`;
     const busChanges = [];
     for (const op of ops) {
-      const id = op.id ?? `${Date.now()}-${Math.random().toString(36).slice(2)}`;
-      const data = op.data ?? {};
-      const collection = op.collection;
-      if (op.op === "add") {
+      const collection = this._collection;
+      if (op.kind === "add") {
+        const data = op.data;
         const mutation = await this._queue.enqueue({
           collection,
           op: "add",
@@ -2981,7 +2981,9 @@ var DbCollectionRefImpl = class {
           }
         });
         busChanges.push({ type: "added", collection, doc: { id: docId, data } });
-      } else if (op.op === "set") {
+      } else if (op.kind === "set") {
+        const id = op.id;
+        const data = op.data;
         const existing = await this._store.getDoc(collection, id);
         const mutation = await this._queue.enqueue({
           collection,
@@ -3010,7 +3012,9 @@ var DbCollectionRefImpl = class {
           collection,
           doc: { id, data }
         });
-      } else if (op.op === "update") {
+      } else if (op.kind === "update") {
+        const id = op.id;
+        const data = op.data;
         const existing = await this._store.getDoc(collection, id);
         const merged = { ...existing?.data ?? {}, ...data };
         const mutation = await this._queue.enqueue({
@@ -3039,7 +3043,8 @@ var DbCollectionRefImpl = class {
           }
         });
         busChanges.push({ type: "modified", collection, doc: { id, data: merged } });
-      } else if (op.op === "remove") {
+      } else if (op.kind === "remove") {
+        const id = op.id;
         const existing = await this._store.getDoc(collection, id);
         await this._queue.enqueue({
           collection,
@@ -3148,6 +3153,15 @@ var DbCollectionRefImpl = class {
     assertValidId(id);
     const self = this;
     return {
+      get id() {
+        return id;
+      },
+      get path() {
+        return `${self._collection}/${id}`;
+      },
+      get collection() {
+        return self._collection;
+      },
       async get() {
         return self._buildGetResult(id);
       },
@@ -4281,6 +4295,15 @@ function createLazyCollectionRef(name, getDocsPromise) {
     },
     doc(id) {
       return {
+        get id() {
+          return id;
+        },
+        get path() {
+          return `${name}/${id}`;
+        },
+        get collection() {
+          return name;
+        },
         async get() {
           return (await getRef()).doc(id).get();
         },
@@ -4821,6 +4844,61 @@ var MockAuth = class {
       this._listeners.delete(listener);
     };
   }
+  /**
+   * Mock de `verifyToken` — decodifica o JWT sem verificar assinatura (pra testes).
+   * Em dev, retorna o user atual do mock se já estiver logado. Aceita qualquer token
+   * não-vazio sem chamar rede.
+   *
+   * Para simular falhas em testes, use `MockAuth.__mockVerifyToken(fn)`.
+   */
+  async verifyToken(token) {
+    if (this._verifyTokenOverride) {
+      return this._verifyTokenOverride(token);
+    }
+    if (!token) {
+      throw Object.assign(new Error("Token inv\xE1lido"), { code: "token_invalid_signature" });
+    }
+    try {
+      const parts = token.split(".");
+      if (parts.length === 3) {
+        const b64 = parts[1].replace(/-/g, "+").replace(/_/g, "/");
+        const pad = "=".repeat((4 - b64.length % 4) % 4);
+        const decoded = JSON.parse(
+          typeof atob === "function" ? atob(b64 + pad) : Buffer.from(b64 + pad, "base64").toString("utf-8")
+        );
+        if (typeof decoded.sub === "string") {
+          return {
+            uid: decoded.sub,
+            email: typeof decoded.email === "string" ? decoded.email : "",
+            emailVerified: typeof decoded.email_verified === "boolean" ? decoded.email_verified : void 0,
+            displayName: typeof decoded.name === "string" ? decoded.name : void 0,
+            photoURL: typeof decoded.picture === "string" ? decoded.picture : void 0,
+            isStaff: decoded.is_staff === true,
+            isCustomer: decoded.is_customer === true,
+            tenantId: typeof decoded.tenant_id === "string" ? decoded.tenant_id : void 0,
+            ...decoded
+          };
+        }
+      }
+    } catch {
+    }
+    if (this._user) return this._user;
+    throw Object.assign(new Error("Nenhum user mock dispon\xEDvel"), { code: "token_invalid_signature" });
+  }
+  _verifyTokenOverride = null;
+  /**
+   * Injeta override pra `verifyToken` em testes — permite simular expiração,
+   * assinatura inválida etc sem precisar de JWT real.
+   *
+   * @example
+   * ```ts
+   * const mock = new MockAuth(null);
+   * mock.__mockVerifyToken(async () => { throw new NeetruError('token_expired', '...'); });
+   * ```
+   */
+  __mockVerifyToken(fn) {
+    this._verifyTokenOverride = fn;
+  }
   /** Helper de tests — força um user state arbitrário. */
   __setUser(user) {
     this._user = user;
@@ -4994,6 +5072,37 @@ function resolveEnv(configEnv) {
   }
   return "prod";
 }
+var _jwksCache = /* @__PURE__ */ new Map();
+var DEFAULT_JWKS_TTL_MS = 60 * 60 * 1e3;
+function _getJwks(jwksUrl, cacheTtlMs) {
+  const now = Date.now();
+  const cached = _jwksCache.get(jwksUrl);
+  if (cached && now - cached.createdAt < cacheTtlMs) {
+    return cached.jwks;
+  }
+  const jwks = createRemoteJWKSet(new URL(jwksUrl));
+  _jwksCache.set(jwksUrl, { jwks, createdAt: now });
+  return jwks;
+}
+function __resetJwksCacheForTests() {
+  _jwksCache.clear();
+}
+function _jwtPayloadToUser(payload) {
+  const sub = payload.sub ?? "";
+  const email = typeof payload.email === "string" ? payload.email : "";
+  return {
+    uid: sub,
+    email,
+    emailVerified: typeof payload.email_verified === "boolean" ? payload.email_verified : void 0,
+    displayName: typeof payload.name === "string" ? payload.name : void 0,
+    photoURL: typeof payload.picture === "string" ? payload.picture : void 0,
+    isStaff: payload.is_staff === true,
+    isCustomer: payload.is_customer === true,
+    tenantId: typeof payload.tenant_id === "string" ? payload.tenant_id : void 0,
+    // Spreads todos os claims originais (aud, iss, iat, exp, etc).
+    ...payload
+  };
+}
 function createOidcAuthNamespace(config) {
   const STORAGE_KEY = "neetru_id_token";
   const listeners = /* @__PURE__ */ new Set();
@@ -5101,6 +5210,45 @@ function createOidcAuthNamespace(config) {
       return () => {
         listeners.delete(listener);
       };
+    },
+    async verifyToken(token, options) {
+      if (!token || typeof token !== "string") {
+        throw new NeetruError("token_invalid_signature", "token must be a non-empty string");
+      }
+      const overrideAuthUrl = typeof globalThis.NEETRU_AUTH_URL === "string" ? globalThis.NEETRU_AUTH_URL : null;
+      const idpOrigin = overrideAuthUrl ?? config.baseUrl.replace(/^https?:\/\/api\./, "https://auth.");
+      const issuer = idpOrigin;
+      const jwksUrl = `${idpOrigin}/api/v1/oauth/.well-known/jwks.json`;
+      const cacheTtlMs = options?.jwksCacheTtlMs ?? DEFAULT_JWKS_TTL_MS;
+      const audience = config.apiKey ? config.apiKey.split("_")[1] ?? void 0 : void 0;
+      const jwks = _getJwks(jwksUrl, cacheTtlMs);
+      try {
+        const { payload } = await jwtVerify(token, jwks, {
+          issuer,
+          ...audience ? { audience } : {},
+          algorithms: ["RS256"]
+        });
+        return _jwtPayloadToUser(payload);
+      } catch (err) {
+        const errName = err?.code ?? err?.name ?? "";
+        const errMsg = err?.message ?? String(err);
+        if (errName === "ERR_JWT_EXPIRED") {
+          throw new NeetruError("token_expired", `Token expired: ${errMsg}`);
+        }
+        if (errName === "ERR_JWS_SIGNATURE_VERIFICATION_FAILED") {
+          throw new NeetruError("token_invalid_signature", `Token signature invalid: ${errMsg}`);
+        }
+        if (errName === "ERR_JWT_CLAIM_VALIDATION_FAILED") {
+          if (errMsg.includes('"aud"') || errMsg.includes("audience")) {
+            throw new NeetruError("token_invalid_audience", `Token audience mismatch: ${errMsg}`);
+          }
+          if (errMsg.includes('"iss"') || errMsg.includes("issuer")) {
+            throw new NeetruError("token_invalid_issuer", `Token issuer mismatch: ${errMsg}`);
+          }
+          throw new NeetruError("token_invalid_signature", `Token claim validation failed: ${errMsg}`);
+        }
+        throw new NeetruError("token_invalid_signature", `Token verification failed: ${errMsg}`);
+      }
     }
   };
 }
@@ -5147,6 +5295,6 @@ function createNeetruClient(config = {}) {
   return client;
 }
 
-export { createNeetruClient };
+export { __resetJwksCacheForTests, createNeetruClient };
 //# sourceMappingURL=auth.mjs.map
 //# sourceMappingURL=auth.mjs.map