@neetru/sdk 3.4.7 → 3.6.0

package/dist/mobile.mjs

@@ -0,0 +1,513 @@
+// src/errors.ts
+var NeetruError = class _NeetruError extends Error {
+  code;
+  status;
+  requestId;
+  /**
+   * Motivo semântico opcional propagado pelo Core no corpo do erro (campo
+   * `reason` no TOPO do body, fora de `error`). Usado principalmente pelo 503
+   * de lease de DB, onde `reason` discrimina o estado do ambiente
+   * (`suspended` | `archived` | `revoked` | `provisioning` | `degraded` |
+   * `no_route` | `expired`). Camadas superiores (ex.: `db/sql`) mapeiam isso
+   * para um `NeetruDbErrorCode` mais específico (recuperável vs não).
+   */
+  reason;
+  constructor(code, message, status, requestId, reason) {
+    super(message);
+    this.name = "NeetruError";
+    this.code = code;
+    this.status = status;
+    this.requestId = requestId;
+    this.reason = reason;
+    Object.setPrototypeOf(this, _NeetruError.prototype);
+  }
+};
+
+// src/types.ts
+var DEFAULT_BASE_URL = "https://api.neetru.com";
+
+// src/base-url-allowlist.ts
+var LOOPBACK_HOSTS = /* @__PURE__ */ new Set(["localhost", "127.0.0.1", "[::1]", "::1"]);
+var NEETRU_SUFFIX = ".neetru.com";
+var NEETRU_APEX = "neetru.com";
+var SAFE_DEV_HOST_RE = /^[a-z0-9](?:[a-z0-9-]{0,62}[a-z0-9])?\.(test|localhost)$/;
+function isSafeDevHost(hostname) {
+  return SAFE_DEV_HOST_RE.test(hostname);
+}
+function normalizeHostname(hostname) {
+  return hostname.toLowerCase().replace(/\.+$/, "");
+}
+function validateBaseUrl(baseUrl, allowedHosts = []) {
+  if (typeof baseUrl !== "string" || baseUrl.length === 0) {
+    throw new NeetruError("invalid_config", "baseUrl is required");
+  }
+  let parsed;
+  try {
+    parsed = new URL(baseUrl);
+  } catch {
+    throw new NeetruError("invalid_config", `baseUrl is not a valid URL: ${baseUrl}`);
+  }
+  const protocol = parsed.protocol;
+  const hostname = normalizeHostname(parsed.hostname);
+  if (isInsecureBypassActive()) {
+    if (typeof console !== "undefined") {
+      console.warn(
+        `[neetru-sdk] NEETRU_ALLOW_INSECURE_BASEURL=1 ativo. baseUrl=${baseUrl} aceito sem valida\xE7\xE3o.`
+      );
+    }
+    return baseUrl.replace(/\/+$/, "");
+  }
+  if (protocol !== "https:" && protocol !== "http:") {
+    throw new NeetruError(
+      "invalid_config",
+      `baseUrl protocol must be http: or https:, got ${protocol}`
+    );
+  }
+  if (protocol === "http:") {
+    const isLoopback = LOOPBACK_HOSTS.has(hostname) || isSafeDevHost(hostname);
+    if (!isLoopback) {
+      throw new NeetruError(
+        "invalid_config",
+        `baseUrl with http: only allowed for localhost/127.0.0.1/*.test/*.localhost. Got: ${hostname}. Use https: or set NEETRU_ALLOW_INSECURE_BASEURL=1 to bypass.`
+      );
+    }
+    return baseUrl.replace(/\/+$/, "");
+  }
+  const isNeetruDomain = hostname === NEETRU_APEX || hostname.endsWith(NEETRU_SUFFIX);
+  const isAllowedHost = allowedHosts.some((allowed) => {
+    const norm = allowed.toLowerCase();
+    return hostname === norm || hostname.endsWith(`.${norm}`);
+  });
+  const isLoopbackHttps = LOOPBACK_HOSTS.has(hostname) || isSafeDevHost(hostname);
+  if (!isNeetruDomain && !isAllowedHost && !isLoopbackHttps) {
+    throw new NeetruError(
+      "invalid_config",
+      `baseUrl ${hostname} is not in the allowlist. Allowed: *.neetru.com, localhost, or configure { allowedHosts: ['...'] }. Bypass: NEETRU_ALLOW_INSECURE_BASEURL=1.`
+    );
+  }
+  return baseUrl.replace(/\/+$/, "");
+}
+function isInsecureBypassActive() {
+  try {
+    const proc = globalThis.process;
+    const envVal = proc?.env?.NEETRU_ALLOW_INSECURE_BASEURL;
+    if (envVal === "1" || envVal === "true") return true;
+  } catch {
+  }
+  try {
+    const g = globalThis.NEETRU_ALLOW_INSECURE_BASEURL;
+    if (g === "1" || g === "true" || g === true) return true;
+  } catch {
+  }
+  return false;
+}
+
+// src/api-key.ts
+var API_KEY_RE = /^nrt_([A-Za-z0-9]+)_([A-Za-z0-9]+)$/;
+function parseApiKey(apiKey) {
+  if (typeof apiKey !== "string" || apiKey.length === 0) {
+    throw new NeetruError(
+      "invalid_config",
+      "apiKey is required (formato nrt_<keyId>_<secret>)"
+    );
+  }
+  const match = API_KEY_RE.exec(apiKey);
+  if (!match) {
+    throw new NeetruError(
+      "invalid_config",
+      "apiKey malformado - esperado formato nrt_<keyId>_<secret>"
+    );
+  }
+  return { keyId: match[1], secret: match[2] };
+}
+
+// src/auth-pkce-shared.ts
+function getWebCrypto() {
+  const c = globalThis.crypto;
+  if (!c || typeof c.getRandomValues !== "function" || !c.subtle) {
+    throw new NeetruError(
+      "runtime_unsupported",
+      "auth.signIn requer WebCrypto (crypto.subtle) \u2014 indispon\xEDvel neste runtime. Use HTTPS (ou http://localhost) num browser moderno, ou instale um polyfill WebCrypto (ex: react-native-quick-crypto) em React Native."
+    );
+  }
+  return c;
+}
+function base64UrlFromBytes(bytes) {
+  let str = "";
+  for (const b of bytes) str += String.fromCharCode(b);
+  const b64 = typeof btoa === "function" ? btoa(str) : Buffer.from(str, "binary").toString("base64");
+  return b64.replace(/\+/g, "-").replace(/\//g, "_").replace(/=/g, "");
+}
+function randomUrlSafe(crypto, byteLen) {
+  const bytes = new Uint8Array(byteLen);
+  crypto.getRandomValues(bytes);
+  return base64UrlFromBytes(bytes);
+}
+async function pkceChallengeS256(crypto, verifier) {
+  const data = new TextEncoder().encode(verifier);
+  const digest = await crypto.subtle.digest("SHA-256", data);
+  return base64UrlFromBytes(new Uint8Array(digest));
+}
+function resolveIdpOrigin(baseUrl) {
+  const overrideAuthUrl = typeof globalThis.NEETRU_AUTH_URL === "string" ? globalThis.NEETRU_AUTH_URL : null;
+  return overrideAuthUrl ?? baseUrl.replace(/^https?:\/\/api\./, "https://auth.");
+}
+function resolveOidcClientId(config) {
+  let clientId = config.oidcClientId;
+  if (!clientId && config.apiKey) {
+    clientId = parseApiKey(config.apiKey).keyId;
+  }
+  if (!clientId) {
+    throw new NeetruError(
+      "invalid_config",
+      "auth OIDC requer `oidcClientId` (ou `apiKey`) configurado para montar o client_id."
+    );
+  }
+  return clientId;
+}
+function buildAuthorizeUrl(params) {
+  const url = new URL("/api/v1/oauth/authorize", params.idpOrigin);
+  url.searchParams.set("response_type", "code");
+  url.searchParams.set("client_id", params.clientId);
+  url.searchParams.set("redirect_uri", params.redirectUri);
+  url.searchParams.set("scope", params.scope);
+  url.searchParams.set("state", params.state);
+  url.searchParams.set("nonce", params.nonce);
+  url.searchParams.set("code_challenge", params.codeChallenge);
+  url.searchParams.set("code_challenge_method", "S256");
+  return url;
+}
+var OAUTH_TOKEN_PATH = "/api/v1/oauth/token";
+function decodeJwtPayload(token) {
+  const parts = token.split(".");
+  if (parts.length !== 3) return null;
+  try {
+    const b64 = parts[1].replace(/-/g, "+").replace(/_/g, "/");
+    const pad = "=".repeat((4 - b64.length % 4) % 4);
+    const decoded = typeof atob === "function" ? atob(b64 + pad) : Buffer.from(b64 + pad, "base64").toString("utf-8");
+    return JSON.parse(decoded);
+  } catch {
+    return null;
+  }
+}
+function jwtToNeetruUser(token) {
+  const payload = decodeJwtPayload(token);
+  if (!payload || typeof payload.sub !== "string") return null;
+  if (typeof payload.exp === "number" && payload.exp * 1e3 < Date.now()) {
+    return null;
+  }
+  return {
+    uid: payload.sub,
+    email: typeof payload.email === "string" ? payload.email : "",
+    emailVerified: typeof payload.email_verified === "boolean" ? payload.email_verified : void 0,
+    displayName: typeof payload.name === "string" ? payload.name : void 0,
+    photoURL: typeof payload.picture === "string" ? payload.picture : void 0,
+    isStaff: payload.is_staff === true,
+    isCustomer: payload.is_customer === true,
+    tenantId: typeof payload.tenant_id === "string" ? payload.tenant_id : void 0,
+    ...payload
+  };
+}
+
+// src/mobile.ts
+var OIDC_TX_KEY = "neetru_oauth_tx";
+var ID_TOKEN_KEY = "neetru_id_token";
+var REFRESH_TOKEN_KEY = "neetru_refresh_token";
+function resolveMobileConfig(config) {
+  if (!config.storage) {
+    throw new NeetruError(
+      "invalid_config",
+      "createMobileAuthNamespace requer `storage` (MobileAuthStorage) \u2014 ver JSDoc de src/mobile.ts requisito 4."
+    );
+  }
+  if (typeof config.openAuthUrl !== "function") {
+    throw new NeetruError(
+      "invalid_config",
+      "createMobileAuthNamespace requer `openAuthUrl` (browser externo, NUNCA WebView embutida) \u2014 ver JSDoc de src/mobile.ts requisito 3."
+    );
+  }
+  const fetchImpl = config.fetch ?? globalThis.fetch;
+  if (typeof fetchImpl !== "function") {
+    throw new NeetruError(
+      "invalid_config",
+      "fetch is not available in this runtime. Pass `fetch` explicitly to createMobileAuthNamespace."
+    );
+  }
+  const baseUrl = validateBaseUrl(config.baseUrl ?? DEFAULT_BASE_URL, config.allowedHosts ?? []);
+  return {
+    fetchImpl: fetchImpl.bind(globalThis),
+    baseUrl,
+    oidcClientId: config.oidcClientId,
+    apiKey: config.apiKey,
+    storage: config.storage,
+    openAuthUrl: config.openAuthUrl
+  };
+}
+async function postToken(fetchImpl, tokenUrl, form) {
+  let res;
+  try {
+    res = await fetchImpl(tokenUrl, {
+      method: "POST",
+      headers: { "content-type": "application/x-www-form-urlencoded" },
+      body: form.toString()
+    });
+  } catch (err) {
+    throw new NeetruError(
+      "network_error",
+      `POST ${tokenUrl} falhou (network): ${err?.message ?? String(err)}`
+    );
+  }
+  let payload = null;
+  try {
+    payload = await res.json();
+  } catch {
+    payload = null;
+  }
+  if (!res.ok || typeof payload?.error === "string") {
+    const desc = typeof payload?.error_description === "string" && payload.error_description || typeof payload?.error === "string" && payload.error || `HTTP ${res.status}`;
+    throw new NeetruError(
+      "token_exchange_failed",
+      `Troca de tokens falhou no /token: ${desc}`,
+      res.status
+    );
+  }
+  return payload ?? {};
+}
+function createMobileAuthNamespace(config) {
+  const resolved = resolveMobileConfig(config);
+  const listeners = /* @__PURE__ */ new Set();
+  function tokenUrl() {
+    return `${resolveIdpOrigin(resolved.baseUrl)}${OAUTH_TOKEN_PATH}`;
+  }
+  async function notify() {
+    const user = await getUser();
+    for (const l of listeners) {
+      try {
+        l(user);
+      } catch {
+      }
+    }
+  }
+  async function signIn(options) {
+    if (!options?.redirectUri) {
+      throw new NeetruError(
+        "invalid_config",
+        "mobile auth.signIn requer `redirectUri` (Universal Link/App Link https://... registrado no Core) \u2014 n\xE3o h\xE1 location.origin impl\xEDcito em React Native."
+      );
+    }
+    const crypto = getWebCrypto();
+    const scope = options.scope ?? "openid profile email";
+    const clientId = resolveOidcClientId(resolved);
+    const state = randomUrlSafe(crypto, 16);
+    const nonce = randomUrlSafe(crypto, 16);
+    const codeVerifier = randomUrlSafe(crypto, 32);
+    const codeChallenge = await pkceChallengeS256(crypto, codeVerifier);
+    const tx = {
+      state,
+      nonce,
+      codeVerifier,
+      redirectUri: options.redirectUri,
+      postLoginRedirect: options.postLoginRedirect
+    };
+    await resolved.storage.setItem(OIDC_TX_KEY, JSON.stringify(tx));
+    const idpOrigin = resolveIdpOrigin(resolved.baseUrl);
+    const url = buildAuthorizeUrl({
+      idpOrigin,
+      clientId,
+      redirectUri: options.redirectUri,
+      scope,
+      state,
+      nonce,
+      codeChallenge
+    });
+    await resolved.openAuthUrl(url.toString());
+  }
+  async function completeSignIn(callbackUrl) {
+    if (!callbackUrl || typeof callbackUrl !== "string") {
+      throw new NeetruError(
+        "invalid_config",
+        "mobile auth.completeSignIn requer `callbackUrl` (a URL completa do deep link de retorno) \u2014 mobile n\xE3o tem location.href impl\xEDcito."
+      );
+    }
+    let parsed;
+    try {
+      parsed = new URL(callbackUrl);
+    } catch {
+      throw new NeetruError("invalid_config", `callbackUrl n\xE3o \xE9 uma URL v\xE1lida: ${callbackUrl}`);
+    }
+    const params = parsed.searchParams;
+    const idpError = params.get("error");
+    if (idpError) {
+      const desc = params.get("error_description") ?? idpError;
+      await resolved.storage.removeItem(OIDC_TX_KEY);
+      throw new NeetruError(idpError, `OIDC authorize falhou: ${desc}`);
+    }
+    const code = params.get("code");
+    if (!code) {
+      await resolved.storage.removeItem(OIDC_TX_KEY);
+      throw new NeetruError(
+        "invalid_config",
+        "callbackUrl n\xE3o cont\xE9m `?code=` nem `?error=` \u2014 n\xE3o \xE9 um callback OIDC v\xE1lido."
+      );
+    }
+    const returnedState = params.get("state");
+    const txRaw = await resolved.storage.getItem(OIDC_TX_KEY);
+    let tx = null;
+    if (txRaw) {
+      try {
+        tx = JSON.parse(txRaw);
+      } catch {
+        tx = null;
+      }
+    }
+    if (!tx) {
+      throw new NeetruError(
+        "oidc_state_mismatch",
+        "Callback OIDC sem transa\xE7\xE3o pendente \u2014 `signIn` n\xE3o foi iniciado (ou j\xE1 consumido)."
+      );
+    }
+    if (!returnedState || returnedState !== tx.state) {
+      await resolved.storage.removeItem(OIDC_TX_KEY);
+      throw new NeetruError(
+        "oidc_state_mismatch",
+        "state do callback OIDC n\xE3o confere com o da transa\xE7\xE3o (poss\xEDvel CSRF)."
+      );
+    }
+    await resolved.storage.removeItem(OIDC_TX_KEY);
+    const clientId = resolveOidcClientId(resolved);
+    const form = new URLSearchParams({
+      grant_type: "authorization_code",
+      code,
+      redirect_uri: tx.redirectUri,
+      client_id: clientId,
+      code_verifier: tx.codeVerifier
+    });
+    const payload = await postToken(resolved.fetchImpl, tokenUrl(), form);
+    const idToken = payload.id_token;
+    if (typeof idToken !== "string" || idToken.length === 0) {
+      throw new NeetruError(
+        "token_exchange_failed",
+        "Resposta do /token sem `id_token` \u2014 o login n\xE3o pode ser completado."
+      );
+    }
+    const claims = decodeJwtPayload(idToken);
+    if (!claims) {
+      throw new NeetruError(
+        "token_exchange_failed",
+        "id_token retornado pelo /token \xE9 malformado (payload indecodific\xE1vel)."
+      );
+    }
+    if (claims.nonce !== tx.nonce) {
+      throw new NeetruError(
+        "oidc_nonce_mismatch",
+        "nonce do id_token n\xE3o confere com o da transa\xE7\xE3o OIDC (poss\xEDvel replay). Token descartado."
+      );
+    }
+    const user = jwtToNeetruUser(idToken);
+    if (!user) {
+      throw new NeetruError(
+        "token_exchange_failed",
+        "id_token retornado pelo /token n\xE3o tem `sub` ou j\xE1 est\xE1 expirado."
+      );
+    }
+    await resolved.storage.setItem(ID_TOKEN_KEY, idToken);
+    const refreshToken = payload.refresh_token;
+    if (typeof refreshToken === "string" && refreshToken.length > 0) {
+      await resolved.storage.setItem(REFRESH_TOKEN_KEY, refreshToken);
+    }
+    await notify();
+    return { user, postLoginRedirect: tx.postLoginRedirect };
+  }
+  async function getIdToken() {
+    const token = await resolved.storage.getItem(ID_TOKEN_KEY);
+    if (!token) return null;
+    return jwtToNeetruUser(token) ? token : null;
+  }
+  async function getUser() {
+    const token = await resolved.storage.getItem(ID_TOKEN_KEY);
+    if (!token) return null;
+    return jwtToNeetruUser(token);
+  }
+  async function refreshTokens() {
+    const refreshToken = await resolved.storage.getItem(REFRESH_TOKEN_KEY);
+    if (!refreshToken) return false;
+    let clientId;
+    try {
+      clientId = resolveOidcClientId(resolved);
+    } catch {
+      return false;
+    }
+    const form = new URLSearchParams({
+      grant_type: "refresh_token",
+      refresh_token: refreshToken,
+      client_id: clientId
+    });
+    let payload;
+    try {
+      payload = await postToken(resolved.fetchImpl, tokenUrl(), form);
+    } catch {
+      return false;
+    }
+    const idToken = payload.id_token;
+    if (typeof idToken !== "string" || idToken.length === 0) return false;
+    const user = jwtToNeetruUser(idToken);
+    if (!user) return false;
+    await resolved.storage.setItem(ID_TOKEN_KEY, idToken);
+    const rotated = payload.refresh_token;
+    if (typeof rotated === "string" && rotated.length > 0) {
+      await resolved.storage.setItem(REFRESH_TOKEN_KEY, rotated);
+    }
+    await notify();
+    return true;
+  }
+  async function signOut() {
+    const storedToken = await resolved.storage.getItem(ID_TOKEN_KEY);
+    await resolved.storage.removeItem(ID_TOKEN_KEY);
+    await resolved.storage.removeItem(REFRESH_TOKEN_KEY);
+    if (storedToken) {
+      const idpOrigin = resolveIdpOrigin(resolved.baseUrl);
+      const revokeUrl = `${idpOrigin}/api/v1/oauth/revoke`;
+      try {
+        await resolved.fetchImpl(revokeUrl, {
+          method: "POST",
+          headers: { "content-type": "application/json" },
+          body: JSON.stringify({ token: storedToken })
+        });
+      } catch (err) {
+        if (typeof console !== "undefined") {
+          console.warn(
+            "[neetru-sdk] mobile signOut: server-side revoke falhou. Refresh token pode estar stale.",
+            err
+          );
+        }
+      }
+    }
+    await notify();
+  }
+  return {
+    signIn,
+    completeSignIn,
+    getIdToken,
+    getUser,
+    onAuthStateChanged(listener) {
+      listeners.add(listener);
+      void getUser().then((user) => {
+        if (listeners.has(listener)) {
+          try {
+            listener(user);
+          } catch {
+          }
+        }
+      });
+      return () => {
+        listeners.delete(listener);
+      };
+    },
+    refreshTokens,
+    signOut
+  };
+}
+
+export { createMobileAuthNamespace };
+//# sourceMappingURL=mobile.mjs.map
+//# sourceMappingURL=mobile.mjs.map