@neetru/sdk 3.1.11 → 3.1.13

package/dist/auth.cjs

@@ -5835,6 +5835,15 @@ var MockAuth = class {
   async handleRedirectCallback(_currentUrl) {
     return this._pendingCallback;
   }
+  /**
+   * Mock de `completeSignIn` (3.1.12) — em dev não há redirect real pro IdP,
+   * então não existe callback a completar: retorna `null` sempre (mesmo
+   * contrato "no-op seguro em todo page load" da implementação real). O login
+   * mock acontece direto via `signIn()`.
+   */
+  async completeSignIn(_currentUrl) {
+    return null;
+  }
   /**
    * Mock de `getIdToken` (Bug 2 / 3.1.3). Retorna `null` por default; use
    * `__setIdToken(token)` pra injetar um token cru em testes.
@@ -6263,22 +6272,155 @@ function createOidcAuthNamespace(config) {
       loadCachedUser();
     }, msUntilExpiry + 1);
   }
+  function resolveClientId() {
+    let clientId = config.oidcClientId;
+    if (!clientId && config.apiKey) {
+      clientId = parseApiKey(config.apiKey).keyId;
+    }
+    if (!clientId) {
+      throw new NeetruError(
+        "invalid_config",
+        "auth OIDC requer `oidcClientId` (ou `apiKey`) configurado para montar o client_id."
+      );
+    }
+    return clientId;
+  }
+  async function handleRedirectCallback(currentUrl) {
+    const href = currentUrl ?? (typeof globalThis.location !== "undefined" ? globalThis.location.href : void 0);
+    if (!href) return null;
+    let parsed;
+    try {
+      parsed = new URL(href);
+    } catch {
+      return null;
+    }
+    const params = parsed.searchParams;
+    const idpError = params.get("error");
+    if (idpError) {
+      const desc = params.get("error_description") ?? idpError;
+      getSessionStorage()?.removeItem(OIDC_TX_KEY);
+      cleanCallbackUrl(parsed);
+      throw new NeetruError(idpError, `OIDC authorize falhou: ${desc}`);
+    }
+    const code = params.get("code");
+    if (!code) return null;
+    const returnedState = params.get("state");
+    const session = getSessionStorage();
+    const txRaw = session?.getItem(OIDC_TX_KEY) ?? null;
+    let tx = null;
+    if (txRaw) {
+      try {
+        tx = JSON.parse(txRaw);
+      } catch {
+        tx = null;
+      }
+    }
+    if (!tx) {
+      throw new NeetruError(
+        "oidc_state_mismatch",
+        "Callback OIDC sem transa\xE7\xE3o pendente \u2014 `signIn` n\xE3o foi iniciado nesta sess\xE3o (ou j\xE1 consumido)."
+      );
+    }
+    if (!returnedState || returnedState !== tx.state) {
+      session?.removeItem(OIDC_TX_KEY);
+      cleanCallbackUrl(parsed);
+      throw new NeetruError(
+        "oidc_state_mismatch",
+        "state do callback OIDC n\xE3o confere com o da transa\xE7\xE3o (poss\xEDvel CSRF)."
+      );
+    }
+    session?.removeItem(OIDC_TX_KEY);
+    cleanCallbackUrl(parsed);
+    return {
+      code,
+      codeVerifier: tx.codeVerifier,
+      redirectUri: tx.redirectUri,
+      nonce: tx.nonce,
+      state: tx.state,
+      postLoginRedirect: tx.postLoginRedirect
+    };
+  }
+  async function completeSignIn(currentUrl) {
+    const tx = await handleRedirectCallback(currentUrl);
+    if (!tx) return null;
+    const clientId = resolveClientId();
+    const idpOrigin = resolveIdpOrigin(config.baseUrl);
+    const tokenUrl = `${idpOrigin}/api/v1/oauth/token`;
+    const form = new URLSearchParams({
+      grant_type: "authorization_code",
+      code: tx.code,
+      redirect_uri: tx.redirectUri,
+      client_id: clientId,
+      code_verifier: tx.codeVerifier
+    });
+    let res;
+    try {
+      res = await config.fetch(tokenUrl, {
+        method: "POST",
+        headers: { "content-type": "application/x-www-form-urlencoded" },
+        body: form.toString()
+      });
+    } catch (err) {
+      throw new NeetruError(
+        "network_error",
+        `POST ${tokenUrl} falhou (network): ${err?.message ?? String(err)}`
+      );
+    }
+    let payload = null;
+    try {
+      payload = await res.json();
+    } catch {
+      payload = null;
+    }
+    if (!res.ok || typeof payload?.error === "string") {
+      const desc = typeof payload?.error_description === "string" && payload.error_description || typeof payload?.error === "string" && payload.error || `HTTP ${res.status}`;
+      throw new NeetruError(
+        "token_exchange_failed",
+        `Troca do authorization_code por tokens falhou no /token: ${desc}`,
+        res.status
+      );
+    }
+    const idToken = payload?.id_token;
+    if (typeof idToken !== "string" || idToken.length === 0) {
+      throw new NeetruError(
+        "token_exchange_failed",
+        "Resposta do /token sem `id_token` \u2014 o login n\xE3o pode ser completado.",
+        res.status
+      );
+    }
+    const claims = decodeJwtPayload(idToken);
+    if (!claims) {
+      throw new NeetruError(
+        "token_exchange_failed",
+        "id_token retornado pelo /token \xE9 malformado (payload indecodific\xE1vel)."
+      );
+    }
+    if (claims.nonce !== tx.nonce) {
+      throw new NeetruError(
+        "oidc_nonce_mismatch",
+        "nonce do id_token n\xE3o confere com o da transa\xE7\xE3o OIDC (poss\xEDvel replay). Token descartado."
+      );
+    }
+    const user = tokenToUser(idToken);
+    if (!user) {
+      throw new NeetruError(
+        "token_exchange_failed",
+        "id_token retornado pelo /token n\xE3o tem `sub` ou j\xE1 est\xE1 expirado."
+      );
+    }
+    getStorage()?.setItem(STORAGE_KEY, idToken);
+    cachedUser = user;
+    scheduleExpiryTimer(user);
+    notify();
+    return { user, postLoginRedirect: tx.postLoginRedirect };
+  }
   return {
     async signIn(options) {
       if (typeof globalThis.location !== "undefined" && typeof globalThis.location.assign === "function") {
         const crypto2 = getWebCrypto();
         const redirectUri = options?.redirectUri ?? globalThis.location.origin;
         const scope = options?.scope ?? "openid profile email";
-        let clientId = config.oidcClientId;
-        if (!clientId && config.apiKey) {
-          clientId = parseApiKey(config.apiKey).keyId;
-        }
-        if (!clientId) {
-          throw new NeetruError(
-            "invalid_config",
-            "auth.signIn requer `oidcClientId` (ou `apiKey`) configurado para montar o client_id."
-          );
-        }
+        const clientId = resolveClientId();
         const state = randomUrlSafe(crypto2, 16);
         const nonce = randomUrlSafe(crypto2, 16);
         const codeVerifier = randomUrlSafe(crypto2, 32);
@@ -6316,61 +6458,8 @@ function createOidcAuthNamespace(config) {
         "auth.signIn requires a browser context or mocks. Use NEETRU_ENV=dev or pass mocks.auth."
       );
     },
-    async handleRedirectCallback(currentUrl) {
-      const href = currentUrl ?? (typeof globalThis.location !== "undefined" ? globalThis.location.href : void 0);
-      if (!href) return null;
-      let parsed;
-      try {
-        parsed = new URL(href);
-      } catch {
-        return null;
-      }
-      const params = parsed.searchParams;
-      const idpError = params.get("error");
-      if (idpError) {
-        const desc = params.get("error_description") ?? idpError;
-        getSessionStorage()?.removeItem(OIDC_TX_KEY);
-        cleanCallbackUrl(parsed);
-        throw new NeetruError(idpError, `OIDC authorize falhou: ${desc}`);
-      }
-      const code = params.get("code");
-      if (!code) return null;
-      const returnedState = params.get("state");
-      const session = getSessionStorage();
-      const txRaw = session?.getItem(OIDC_TX_KEY) ?? null;
-      let tx = null;
-      if (txRaw) {
-        try {
-          tx = JSON.parse(txRaw);
-        } catch {
-          tx = null;
-        }
-      }
-      if (!tx) {
-        throw new NeetruError(
-          "oidc_state_mismatch",
-          "Callback OIDC sem transa\xE7\xE3o pendente \u2014 `signIn` n\xE3o foi iniciado nesta sess\xE3o (ou j\xE1 consumido)."
-        );
-      }
-      if (!returnedState || returnedState !== tx.state) {
-        session?.removeItem(OIDC_TX_KEY);
-        cleanCallbackUrl(parsed);
-        throw new NeetruError(
-          "oidc_state_mismatch",
-          "state do callback OIDC n\xE3o confere com o da transa\xE7\xE3o (poss\xEDvel CSRF)."
-        );
-      }
-      session?.removeItem(OIDC_TX_KEY);
-      cleanCallbackUrl(parsed);
-      return {
-        code,
-        codeVerifier: tx.codeVerifier,
-        redirectUri: tx.redirectUri,
-        nonce: tx.nonce,
-        state: tx.state,
-        postLoginRedirect: tx.postLoginRedirect
-      };
-    },
+    handleRedirectCallback,
+    completeSignIn,
     getIdToken() {
       const storage = getStorage();
       const token = storage?.getItem(STORAGE_KEY) ?? null;