@neetru/sdk 3.1.4 → 3.1.7

package/dist/index.d.cts

@@ -1,7 +1,7 @@
 export { createNeetruClient } from './auth.cjs';
 export { NeetruError, NeetruErrorCode } from './errors.cjs';
-export { A as AuthNamespace, a as AuthStateListener, C as CatalogListOptions, b as CatalogListResponse, d as CheckoutIntentInfo, e as CheckoutIntentStatus, f as CheckoutNamespace, g as CheckoutStartInput, h as CheckoutStartResult, i as CheckoutTenantType, l as CreateTicketInput, D as DEFAULT_BASE_URL, m as DbBatchOp, n as DbChangeType, o as DbCollectionRef, p as DbDoc, q as DbDocRef, r as DbGetResult, s as DbListResult, t as DbNamespace, u as DbQuery, v as DbSqlLease, w as DbWhereFilter, E as EntitlementCheck, F as FieldSentinel, I as IncrementSentinel, L as ListNotificationsOptions, M as MockCheckout, y as MockNotifications, z as MockWebhooks, N as NEETRU_SENTINEL_KEY, B as NeetruClient, G as NeetruClientConfig, H as NeetruDb, K as NeetruDbEngine, O as NeetruDbError, P as NeetruDbErrorCode, Q as NeetruDbOptions, R as NeetruDbTransport, S as NeetruEnv, T as NeetruSqlClient, U as NeetruUser, V as NotificationScopeOptions, W as NotificationsNamespace, X as Product, Y as ProductNotification, Z as ProductNotificationSeverity, _ as ProductPlan, $ as ProductStatus, a1 as RedirectCallbackResult, a2 as RegisterWebhookInput, a3 as ResolvedConfig, a4 as SendNotificationInput, a5 as ServerTimestampSentinel, a6 as SignInOptions, a8 as SupportNamespace, a9 as SupportSeverity, aa as SupportStatus, ab as SupportTicket, ad as TelemetryEventAck, ae as TelemetryEventInput, ai as UsageEventInput, aj as UsageNamespace, ak as UsageQuota, al as VerifyTokenOptions, am as VerifyWebhookRequestOptions, an as VerifyWebhookRequestResult, ao as WebhookEndpoint, ap as WebhookEvent, aq as WebhookScopeOptions, ar as WebhookTestResult, as as WebhooksNamespace, at as WithFieldSentinels, au as createCheckoutNamespace, av as createNeetruDb, aw as createNotificationsNamespace, ay as createWebhooksNamespace, aA as increment, aB as isFieldSentinel, aC as isIncrementSentinel, aD as isServerTimestampSentinel, aE as serverTimestamp, aF as verifyWebhookRequest, aG as verifyWebhookSignature } from './types-DvMdYbfV.cjs';
-export { DEV_FIXTURE_USER, MockAuth, MockDb, MockEntitlements, MockSupport, MockUsage } from './mocks.cjs';
+export { A as AuthNamespace, a as AuthStateListener, C as CatalogListOptions, b as CatalogListResponse, d as CheckoutIntentInfo, e as CheckoutIntentStatus, f as CheckoutNamespace, g as CheckoutStartInput, h as CheckoutStartResult, i as CheckoutTenantType, l as CreateTicketInput, D as DEFAULT_BASE_URL, m as DbBatchOp, n as DbChangeType, o as DbCollectionRef, p as DbDoc, q as DbDocRef, r as DbGetResult, s as DbListResult, t as DbNamespace, u as DbQuery, v as DbSqlLease, w as DbWhereFilter, E as EntitlementCheck, F as FieldSentinel, I as IncrementSentinel, L as ListNotificationsOptions, M as MockCheckout, y as MockNotifications, z as MockWebhooks, N as NEETRU_SENTINEL_KEY, B as NeetruClient, G as NeetruClientConfig, H as NeetruDb, K as NeetruDbEngine, O as NeetruDbError, P as NeetruDbErrorCode, Q as NeetruDbOptions, R as NeetruDbTransport, S as NeetruEnv, T as NeetruSqlClient, U as NeetruUser, V as NotificationScopeOptions, W as NotificationsNamespace, X as Product, Y as ProductNotification, Z as ProductNotificationSeverity, _ as ProductPlan, $ as ProductStatus, a1 as RedirectCallbackResult, a2 as RegisterWebhookInput, a3 as ResolvedConfig, a4 as SendNotificationInput, a5 as ServerTimestampSentinel, a6 as SignInOptions, a8 as SupportNamespace, a9 as SupportSeverity, aa as SupportStatus, ab as SupportTicket, ad as TelemetryEventAck, ae as TelemetryEventInput, ai as UsageEventInput, aj as UsageNamespace, ak as UsageQuota, al as VerifyTokenOptions, am as VerifyWebhookRequestOptions, an as VerifyWebhookRequestResult, ao as WebhookEndpoint, ap as WebhookEvent, aq as WebhookScopeOptions, ar as WebhookTestResult, as as WebhooksNamespace, at as WithFieldSentinels, au as createCheckoutNamespace, av as createNeetruDb, aw as createNotificationsNamespace, ay as createWebhooksNamespace, aA as increment, aB as isFieldSentinel, aC as isIncrementSentinel, aD as isServerTimestampSentinel, aE as serverTimestamp, aF as verifyWebhookRequest, aG as verifyWebhookSignature } from './types-BXvGHppn.cjs';
+export { DEV_FIXTURE_USER, MockAuth, MockAuthOptions, MockDb, MockEntitlements, MockSupport, MockUsage } from './mocks.cjs';
 import 'drizzle-orm/node-postgres';
 
 /**
@@ -42,6 +42,6 @@ declare function checkCoreVersionCompat(coreVersion: string): void;
  */
 
 /** Versão do SDK — exportada explicitamente pra detecção em runtime. */
-declare const VERSION: "3.1.3";
+declare const VERSION: "3.1.7";
 
 export { VERSION, checkCoreVersionCompat };

package/dist/index.d.ts

@@ -1,7 +1,7 @@
 export { createNeetruClient } from './auth.js';
 export { NeetruError, NeetruErrorCode } from './errors.js';
-export { A as AuthNamespace, a as AuthStateListener, C as CatalogListOptions, b as CatalogListResponse, d as CheckoutIntentInfo, e as CheckoutIntentStatus, f as CheckoutNamespace, g as CheckoutStartInput, h as CheckoutStartResult, i as CheckoutTenantType, l as CreateTicketInput, D as DEFAULT_BASE_URL, m as DbBatchOp, n as DbChangeType, o as DbCollectionRef, p as DbDoc, q as DbDocRef, r as DbGetResult, s as DbListResult, t as DbNamespace, u as DbQuery, v as DbSqlLease, w as DbWhereFilter, E as EntitlementCheck, F as FieldSentinel, I as IncrementSentinel, L as ListNotificationsOptions, M as MockCheckout, y as MockNotifications, z as MockWebhooks, N as NEETRU_SENTINEL_KEY, B as NeetruClient, G as NeetruClientConfig, H as NeetruDb, K as NeetruDbEngine, O as NeetruDbError, P as NeetruDbErrorCode, Q as NeetruDbOptions, R as NeetruDbTransport, S as NeetruEnv, T as NeetruSqlClient, U as NeetruUser, V as NotificationScopeOptions, W as NotificationsNamespace, X as Product, Y as ProductNotification, Z as ProductNotificationSeverity, _ as ProductPlan, $ as ProductStatus, a1 as RedirectCallbackResult, a2 as RegisterWebhookInput, a3 as ResolvedConfig, a4 as SendNotificationInput, a5 as ServerTimestampSentinel, a6 as SignInOptions, a8 as SupportNamespace, a9 as SupportSeverity, aa as SupportStatus, ab as SupportTicket, ad as TelemetryEventAck, ae as TelemetryEventInput, ai as UsageEventInput, aj as UsageNamespace, ak as UsageQuota, al as VerifyTokenOptions, am as VerifyWebhookRequestOptions, an as VerifyWebhookRequestResult, ao as WebhookEndpoint, ap as WebhookEvent, aq as WebhookScopeOptions, ar as WebhookTestResult, as as WebhooksNamespace, at as WithFieldSentinels, au as createCheckoutNamespace, av as createNeetruDb, aw as createNotificationsNamespace, ay as createWebhooksNamespace, aA as increment, aB as isFieldSentinel, aC as isIncrementSentinel, aD as isServerTimestampSentinel, aE as serverTimestamp, aF as verifyWebhookRequest, aG as verifyWebhookSignature } from './types-CRIIjqzC.js';
-export { DEV_FIXTURE_USER, MockAuth, MockDb, MockEntitlements, MockSupport, MockUsage } from './mocks.js';
+export { A as AuthNamespace, a as AuthStateListener, C as CatalogListOptions, b as CatalogListResponse, d as CheckoutIntentInfo, e as CheckoutIntentStatus, f as CheckoutNamespace, g as CheckoutStartInput, h as CheckoutStartResult, i as CheckoutTenantType, l as CreateTicketInput, D as DEFAULT_BASE_URL, m as DbBatchOp, n as DbChangeType, o as DbCollectionRef, p as DbDoc, q as DbDocRef, r as DbGetResult, s as DbListResult, t as DbNamespace, u as DbQuery, v as DbSqlLease, w as DbWhereFilter, E as EntitlementCheck, F as FieldSentinel, I as IncrementSentinel, L as ListNotificationsOptions, M as MockCheckout, y as MockNotifications, z as MockWebhooks, N as NEETRU_SENTINEL_KEY, B as NeetruClient, G as NeetruClientConfig, H as NeetruDb, K as NeetruDbEngine, O as NeetruDbError, P as NeetruDbErrorCode, Q as NeetruDbOptions, R as NeetruDbTransport, S as NeetruEnv, T as NeetruSqlClient, U as NeetruUser, V as NotificationScopeOptions, W as NotificationsNamespace, X as Product, Y as ProductNotification, Z as ProductNotificationSeverity, _ as ProductPlan, $ as ProductStatus, a1 as RedirectCallbackResult, a2 as RegisterWebhookInput, a3 as ResolvedConfig, a4 as SendNotificationInput, a5 as ServerTimestampSentinel, a6 as SignInOptions, a8 as SupportNamespace, a9 as SupportSeverity, aa as SupportStatus, ab as SupportTicket, ad as TelemetryEventAck, ae as TelemetryEventInput, ai as UsageEventInput, aj as UsageNamespace, ak as UsageQuota, al as VerifyTokenOptions, am as VerifyWebhookRequestOptions, an as VerifyWebhookRequestResult, ao as WebhookEndpoint, ap as WebhookEvent, aq as WebhookScopeOptions, ar as WebhookTestResult, as as WebhooksNamespace, at as WithFieldSentinels, au as createCheckoutNamespace, av as createNeetruDb, aw as createNotificationsNamespace, ay as createWebhooksNamespace, aA as increment, aB as isFieldSentinel, aC as isIncrementSentinel, aD as isServerTimestampSentinel, aE as serverTimestamp, aF as verifyWebhookRequest, aG as verifyWebhookSignature } from './types-CQVak2a3.js';
+export { DEV_FIXTURE_USER, MockAuth, MockAuthOptions, MockDb, MockEntitlements, MockSupport, MockUsage } from './mocks.js';
 import 'drizzle-orm/node-postgres';
 
 /**
@@ -42,6 +42,6 @@ declare function checkCoreVersionCompat(coreVersion: string): void;
  */
 
 /** Versão do SDK — exportada explicitamente pra detecção em runtime. */
-declare const VERSION: "3.1.3";
+declare const VERSION: "3.1.7";
 
 export { VERSION, checkCoreVersionCompat };

package/dist/index.mjs

@@ -5565,9 +5565,19 @@ var DEV_FIXTURE_USER = Object.freeze({
 var MockAuth = class {
   _user;
   _listeners;
-  constructor(initialUser = null) {
+  _allowUnsignedDecode;
+  constructor(initialUser = null, options) {
     this._user = initialUser;
     this._listeners = /* @__PURE__ */ new Set();
+    this._allowUnsignedDecode = options?.allowUnsignedDecode ?? false;
+    if (this._allowUnsignedDecode) {
+      const isTestEnv = typeof process !== "undefined" && (process.env?.NODE_ENV === "test" || process.env?.VITEST === "true" || process.env?.VITEST != null);
+      if (!isTestEnv && typeof console !== "undefined") {
+        console.warn(
+          "[neetru-sdk] MockAuth.verifyToken est\xE1 em modo allowUnsignedDecode=true: tokens N\xC3O t\xEAm assinatura verificada. Este modo \xE9 exclusivo para testes \u2014 NUNCA use como security boundary em c\xF3digo deployado."
+        );
+      }
+    }
   }
   async signIn(_options) {
     if (!this._user) this._user = { ...DEV_FIXTURE_USER };
@@ -5592,18 +5602,27 @@ var MockAuth = class {
     };
   }
   /**
-   * Mock de `verifyToken` — decodifica o JWT sem verificar assinatura (pra testes).
-   * Em dev, retorna o user atual do mock se já estiver logado. Aceita qualquer token
-   * não-vazio sem chamar rede.
+   * Mock de `verifyToken` — por default lança `unauthorized` pra prevenir uso
+   * acidental como security boundary em código deployado.
+   *
+   * Para decodificar JWTs sem verificar assinatura em testes, crie a instância
+   * com `new MockAuth(user, { allowUnsignedDecode: true })`. Isso é um opt-in
+   * explícito — nunca acontece silenciosamente.
    *
-   * Para simular falhas em testes, use `MockAuth.__mockVerifyToken(fn)`.
+   * Para simular falhas ou resultados customizados, use `__mockVerifyToken(fn)`.
    */
   async verifyToken(token) {
     if (this._verifyTokenOverride) {
       return this._verifyTokenOverride(token);
     }
     if (!token) {
-      throw Object.assign(new Error("Token inv\xE1lido"), { code: "token_invalid_signature" });
+      throw new NeetruError("token_invalid_signature", "Token inv\xE1lido: string vazia");
+    }
+    if (!this._allowUnsignedDecode) {
+      throw new NeetruError(
+        "unauthorized",
+        "MockAuth.verifyToken n\xE3o verifica assinaturas JWT e N\xC3O deve ser usado como security boundary em c\xF3digo deployado. Em testes, use new MockAuth(user, { allowUnsignedDecode: true }) para habilitar decodifica\xE7\xE3o sem assinatura, ou __mockVerifyToken(fn) para injetar resultado customizado."
+      );
     }
     try {
       const parts = token.split(".");
@@ -5630,7 +5649,7 @@ var MockAuth = class {
     } catch {
     }
     if (this._user) return this._user;
-    throw Object.assign(new Error("Nenhum user mock dispon\xEDvel"), { code: "token_invalid_signature" });
+    throw new NeetruError("token_invalid_signature", "Nenhum user mock dispon\xEDvel e JWT sem sub v\xE1lido");
   }
   /**
    * Mock de `handleRedirectCallback` (Bug 2 / 3.1.3) — não há redirect real no
@@ -6501,13 +6520,20 @@ function createOidcAuthNamespace(config) {
       const issuer = idpOrigin;
       const jwksUrl = `${idpOrigin}/api/v1/oauth/.well-known/jwks.json`;
       const cacheTtlMs = options?.jwksCacheTtlMs ?? DEFAULT_JWKS_TTL_MS;
+      const audienceFromOptions = options?.audience;
       const parsedKey = tryParseApiKey(config.apiKey);
-      const audience = parsedKey?.keyId;
+      const audience = audienceFromOptions ?? parsedKey?.keyId;
+      if (!audience) {
+        throw new NeetruError(
+          "invalid_config",
+          "verifyToken requires an audience: provide apiKey on the client or pass options.audience. Calling jwtVerify without an audience allows tokens issued for other OIDC clients to pass."
+        );
+      }
       const jwks = _getJwks(jwksUrl, cacheTtlMs);
       try {
         const { payload } = await jwtVerify(token, jwks, {
           issuer,
-          ...audience ? { audience } : {},
+          audience,
           algorithms: ["RS256"]
         });
         return _jwtPayloadToUser(payload);
@@ -6583,7 +6609,7 @@ function createNeetruClient(config = {}) {
 init_errors();
 init_db_errors();
 init_http();
-var VERSION = "3.1.3";
+var VERSION = "3.1.7";
 
 export { DEFAULT_BASE_URL, DEV_FIXTURE_USER, MockAuth, MockCheckout, MockDb, MockEntitlements, MockNotifications, MockSupport, MockUsage, MockWebhooks, NEETRU_SENTINEL_KEY, NeetruDbError, NeetruError, VERSION, checkCoreVersionCompat, createCheckoutNamespace, createNeetruClient, createNeetruDb, createNotificationsNamespace, createWebhooksNamespace, increment, isFieldSentinel, isIncrementSentinel, isServerTimestampSentinel, serverTimestamp, verifyWebhookRequest, verifyWebhookSignature };
 //# sourceMappingURL=index.mjs.map