@neetru/sdk 3.5.0 → 3.6.0

package/CHANGELOG.md

@@ -5,6 +5,28 @@ All notable changes to `@neetru/sdk` will be documented in this file.
 The format is based on [Keep a Changelog](https://keepachangelog.com/en/1.1.0/),
 and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0.html).
 
+## [3.6.0] - 2026-09-24 — **feat(mobile): `@neetru/sdk/mobile` — namespace de auth OIDC+PKCE para React Native/Expo**
+
+Release **minor** (capacidade nova, aditiva — subpath novo, nenhuma API existente muda).
+
+### Contexto
+
+O namespace `auth` existente (`createNeetruClient(...).auth`) é hardcoded em três APIs que não existem em React Native: `globalThis.location.assign(url)` pra iniciar o redirect do `signIn`, e `sessionStorage`/`localStorage` pra persistir a transação PKCE e os tokens. Não havia seam de injeção pra nenhum dos três, então nenhum app RN conseguia usar login Neetru via o SDK — cada squad de app mobile reimplementaria PKCE do zero (risco de bug criptográfico duplicado).
+
+### Adicionado (aditivo, novo subpath — não muda nada em `.`/`./auth`)
+
+- **`@neetru/sdk/mobile`** — `createMobileAuthNamespace(config)`, com `config.storage` (`MobileAuthStorage` assíncrono — o app injeta `expo-secure-store`/Keychain/etc) e `config.openAuthUrl` (o app injeta `expo-web-browser`/`Linking.openURL` — **browser externo, nunca WebView embutida**, requisito de segurança RFC 8252 §8.12, documentado no JSDoc do módulo).
+- Namespace expõe `signIn(options)`, `completeSignIn(callbackUrl)` (recebe a URL do deep link explicitamente — mobile não tem `location.href` implícito), `getIdToken()`/`getUser()` (**assíncronos** — contrato diferente do `auth` web, porque `config.storage` é sempre `Promise`), `onAuthStateChanged(listener)`, `refreshTokens()`, `signOut()`.
+- **`src/auth-pkce-shared.ts`** (interno, não exportado publicamente) — a lógica criptográfica PKCE (WebCrypto, geração `state`/`nonce`/`code_verifier`/`code_challenge` S256, parsing/validação de `id_token`) foi extraída do `auth.ts` web pra ser reaproveitada 1:1 por `mobile.ts`, em vez de duplicada por copy-paste. `auth.ts` foi refatorado pra importar dali — comportamento idêntico, coberto pelos 78 testes pré-existentes de `client.auth`, que continuam verdes sem alteração.
+
+### Requisitos do app consumidor (documentados no JSDoc do módulo)
+
+- Polyfill de WebCrypto (`react-native-get-random-values` + `react-native-quick-crypto` ou equivalente) — Hermes não tem `crypto.subtle` nativo. Sem o polyfill, `signIn`/`completeSignIn` lançam `NeetruError('runtime_unsupported', ...)` com mensagem clara — o SDK não tenta poliflar sozinho nem gera PKCE fraco.
+- `config.openAuthUrl` deve abrir um browser externo (`ASWebAuthenticationSession`/Custom Tabs via `expo-web-browser`, ou `Linking.openURL`) — nunca uma WebView in-app.
+- `client.db` (offline-first, IndexedDB) **não tem storage persistente equivalente em React Native ainda** — cai no `MemoryStore` in-memory (não sobrevive a restart do app). Limitação conhecida e aceita de v1, não resolvida por este subpath.
+
+Nenhuma remoção de API, nenhuma mudança de wire nos namespaces existentes.
+
 ## [3.5.0] - 2026-09-19 — **feat(http): header `X-Neetru-Sdk-Version` em toda request**
 
 Release **minor** (capacidade nova, sem quebra de contrato existente).
@@ -28,7 +50,6 @@ Nenhuma remoção de API, nenhuma mudança de wire nos endpoints existentes —
 - **Remoção de código morto** — deletado `src/db.ts` legado (namespace v0.3.1 Sprint 8, sem nenhum import; o namespace `db` público vive em `src/db/client-db.ts`).
 - Doc: exemplo do JSDoc em `auth.ts` corrigido de `usage.track(...)` (API inexistente) para `usage.report(...)`.
 - Tooling: script `test:coverage` + devDeps `@testing-library/dom` e `@vitest/coverage-v8`.
-
 ## [3.4.7] - 2026-09-19 — **fix(a11y): NeetruLoginButton — foco de teclado visível (bug_62edcfb0)**
 
 Release **patch** (correção de bug de acessibilidade — publica o fix já mesclado no PR #28).

package/dist/ai.cjs

@@ -47,7 +47,7 @@ function compareCalVer(a, b) {
 }
 function readInjectedSdkVersion() {
   try {
-    return "3.5.0";
+    return "3.6.0";
   } catch {
     return void 0;
   }

package/dist/ai.mjs

@@ -45,7 +45,7 @@ function compareCalVer(a, b) {
 }
 function readInjectedSdkVersion() {
   try {
-    return "3.5.0";
+    return "3.6.0";
   } catch {
     return void 0;
   }

package/dist/auth.cjs

@@ -83,7 +83,7 @@ function compareCalVer(a, b) {
 }
 function readInjectedSdkVersion() {
   try {
-    return "3.5.0";
+    return "3.6.0";
   } catch {
     return void 0;
   }
@@ -6990,6 +6990,94 @@ var MockAi = class {
   }
 };
 
+// src/auth-pkce-shared.ts
+init_errors();
+function getWebCrypto() {
+  const c = globalThis.crypto;
+  if (!c || typeof c.getRandomValues !== "function" || !c.subtle) {
+    throw new NeetruError(
+      "runtime_unsupported",
+      "auth.signIn requer WebCrypto (crypto.subtle) \u2014 indispon\xEDvel neste runtime. Use HTTPS (ou http://localhost) num browser moderno, ou instale um polyfill WebCrypto (ex: react-native-quick-crypto) em React Native."
+    );
+  }
+  return c;
+}
+function base64UrlFromBytes(bytes) {
+  let str = "";
+  for (const b of bytes) str += String.fromCharCode(b);
+  const b64 = typeof btoa === "function" ? btoa(str) : Buffer.from(str, "binary").toString("base64");
+  return b64.replace(/\+/g, "-").replace(/\//g, "_").replace(/=/g, "");
+}
+function randomUrlSafe(crypto2, byteLen) {
+  const bytes = new Uint8Array(byteLen);
+  crypto2.getRandomValues(bytes);
+  return base64UrlFromBytes(bytes);
+}
+async function pkceChallengeS256(crypto2, verifier) {
+  const data = new TextEncoder().encode(verifier);
+  const digest = await crypto2.subtle.digest("SHA-256", data);
+  return base64UrlFromBytes(new Uint8Array(digest));
+}
+function resolveIdpOrigin(baseUrl) {
+  const overrideAuthUrl = typeof globalThis.NEETRU_AUTH_URL === "string" ? globalThis.NEETRU_AUTH_URL : null;
+  return overrideAuthUrl ?? baseUrl.replace(/^https?:\/\/api\./, "https://auth.");
+}
+function resolveOidcClientId(config) {
+  let clientId = config.oidcClientId;
+  if (!clientId && config.apiKey) {
+    clientId = parseApiKey(config.apiKey).keyId;
+  }
+  if (!clientId) {
+    throw new NeetruError(
+      "invalid_config",
+      "auth OIDC requer `oidcClientId` (ou `apiKey`) configurado para montar o client_id."
+    );
+  }
+  return clientId;
+}
+function buildAuthorizeUrl(params) {
+  const url = new URL("/api/v1/oauth/authorize", params.idpOrigin);
+  url.searchParams.set("response_type", "code");
+  url.searchParams.set("client_id", params.clientId);
+  url.searchParams.set("redirect_uri", params.redirectUri);
+  url.searchParams.set("scope", params.scope);
+  url.searchParams.set("state", params.state);
+  url.searchParams.set("nonce", params.nonce);
+  url.searchParams.set("code_challenge", params.codeChallenge);
+  url.searchParams.set("code_challenge_method", "S256");
+  return url;
+}
+function decodeJwtPayload(token) {
+  const parts = token.split(".");
+  if (parts.length !== 3) return null;
+  try {
+    const b64 = parts[1].replace(/-/g, "+").replace(/_/g, "/");
+    const pad = "=".repeat((4 - b64.length % 4) % 4);
+    const decoded = typeof atob === "function" ? atob(b64 + pad) : Buffer.from(b64 + pad, "base64").toString("utf-8");
+    return JSON.parse(decoded);
+  } catch {
+    return null;
+  }
+}
+function jwtToNeetruUser(token) {
+  const payload = decodeJwtPayload(token);
+  if (!payload || typeof payload.sub !== "string") return null;
+  if (typeof payload.exp === "number" && payload.exp * 1e3 < Date.now()) {
+    return null;
+  }
+  return {
+    uid: payload.sub,
+    email: typeof payload.email === "string" ? payload.email : "",
+    emailVerified: typeof payload.email_verified === "boolean" ? payload.email_verified : void 0,
+    displayName: typeof payload.name === "string" ? payload.name : void 0,
+    photoURL: typeof payload.picture === "string" ? payload.picture : void 0,
+    isStaff: payload.is_staff === true,
+    isCustomer: payload.is_customer === true,
+    tenantId: typeof payload.tenant_id === "string" ? payload.tenant_id : void 0,
+    ...payload
+  };
+}
+
 // src/auth.ts
 function readEnvApiKey() {
   try {
@@ -7047,36 +7135,6 @@ function _jwtPayloadToUser(payload) {
   };
 }
 var OIDC_TX_KEY = "neetru_oauth_tx";
-function resolveIdpOrigin(baseUrl) {
-  const overrideAuthUrl = typeof globalThis.NEETRU_AUTH_URL === "string" ? globalThis.NEETRU_AUTH_URL : null;
-  return overrideAuthUrl ?? baseUrl.replace(/^https?:\/\/api\./, "https://auth.");
-}
-function getWebCrypto() {
-  const c = globalThis.crypto;
-  if (!c || typeof c.getRandomValues !== "function" || !c.subtle) {
-    throw new NeetruError(
-      "runtime_unsupported",
-      "auth.signIn requer WebCrypto (crypto.subtle) \u2014 indispon\xEDvel neste runtime. Use HTTPS (ou http://localhost) num browser moderno."
-    );
-  }
-  return c;
-}
-function base64UrlFromBytes(bytes) {
-  let str = "";
-  for (const b of bytes) str += String.fromCharCode(b);
-  const b64 = typeof btoa === "function" ? btoa(str) : Buffer.from(str, "binary").toString("base64");
-  return b64.replace(/\+/g, "-").replace(/\//g, "_").replace(/=/g, "");
-}
-function randomUrlSafe(crypto2, byteLen) {
-  const bytes = new Uint8Array(byteLen);
-  crypto2.getRandomValues(bytes);
-  return base64UrlFromBytes(bytes);
-}
-async function pkceChallengeS256(crypto2, verifier) {
-  const data = new TextEncoder().encode(verifier);
-  const digest = await crypto2.subtle.digest("SHA-256", data);
-  return base64UrlFromBytes(new Uint8Array(digest));
-}
 function cleanCallbackUrl(parsed) {
   try {
     const history = globalThis.history;
@@ -7110,36 +7168,6 @@ function createOidcAuthNamespace(config) {
       return null;
     }
   }
-  function decodeJwtPayload(token) {
-    const parts = token.split(".");
-    if (parts.length !== 3) return null;
-    try {
-      const b64 = parts[1].replace(/-/g, "+").replace(/_/g, "/");
-      const pad = "=".repeat((4 - b64.length % 4) % 4);
-      const decoded = typeof atob === "function" ? atob(b64 + pad) : Buffer.from(b64 + pad, "base64").toString("utf-8");
-      return JSON.parse(decoded);
-    } catch {
-      return null;
-    }
-  }
-  function tokenToUser(token) {
-    const payload = decodeJwtPayload(token);
-    if (!payload || typeof payload.sub !== "string") return null;
-    if (typeof payload.exp === "number" && payload.exp * 1e3 < Date.now()) {
-      return null;
-    }
-    return {
-      uid: payload.sub,
-      email: typeof payload.email === "string" ? payload.email : "",
-      emailVerified: typeof payload.email_verified === "boolean" ? payload.email_verified : void 0,
-      displayName: typeof payload.name === "string" ? payload.name : void 0,
-      photoURL: typeof payload.picture === "string" ? payload.picture : void 0,
-      isStaff: payload.is_staff === true,
-      isCustomer: payload.is_customer === true,
-      tenantId: typeof payload.tenant_id === "string" ? payload.tenant_id : void 0,
-      ...payload
-    };
-  }
   function loadCachedUser() {
     if (cachedUser) {
       const exp = cachedUser.exp;
@@ -7160,7 +7188,7 @@ function createOidcAuthNamespace(config) {
       attemptSilentRefresh();
       return null;
     }
-    const user = tokenToUser(token);
+    const user = jwtToNeetruUser(token);
     if (!user) {
       storage.removeItem(STORAGE_KEY);
       attemptSilentRefresh();
@@ -7231,7 +7259,7 @@ function createOidcAuthNamespace(config) {
       if (!res.ok || typeof payload?.error === "string") return false;
       const idToken = payload?.id_token;
       if (typeof idToken !== "string" || idToken.length === 0) return false;
-      const user = tokenToUser(idToken);
+      const user = jwtToNeetruUser(idToken);
       if (!user) return false;
       const storage = getStorage();
       storage?.setItem(STORAGE_KEY, idToken);
@@ -7277,17 +7305,7 @@ function createOidcAuthNamespace(config) {
     }, msUntilExpiry + 1);
   }
   function resolveClientId() {
-    let clientId = config.oidcClientId;
-    if (!clientId && config.apiKey) {
-      clientId = parseApiKey(config.apiKey).keyId;
-    }
-    if (!clientId) {
-      throw new NeetruError(
-        "invalid_config",
-        "auth OIDC requer `oidcClientId` (ou `apiKey`) configurado para montar o client_id."
-      );
-    }
-    return clientId;
+    return resolveOidcClientId(config);
   }
   async function handleRedirectCallback(currentUrl) {
     const href = currentUrl ?? (typeof globalThis.location !== "undefined" ? globalThis.location.href : void 0);
@@ -7405,7 +7423,7 @@ function createOidcAuthNamespace(config) {
         "nonce do id_token n\xE3o confere com o da transa\xE7\xE3o OIDC (poss\xEDvel replay). Token descartado."
       );
     }
-    const user = tokenToUser(idToken);
+    const user = jwtToNeetruUser(idToken);
     if (!user) {
       throw new NeetruError(
         "token_exchange_failed",
@@ -7450,15 +7468,15 @@ function createOidcAuthNamespace(config) {
         };
         session.setItem(OIDC_TX_KEY, JSON.stringify(tx));
         const idpOrigin = resolveIdpOrigin(config.baseUrl);
-        const url = new URL("/api/v1/oauth/authorize", idpOrigin);
-        url.searchParams.set("response_type", "code");
-        url.searchParams.set("client_id", clientId);
-        url.searchParams.set("redirect_uri", redirectUri);
-        url.searchParams.set("scope", scope);
-        url.searchParams.set("state", state);
-        url.searchParams.set("nonce", nonce);
-        url.searchParams.set("code_challenge", codeChallenge);
-        url.searchParams.set("code_challenge_method", "S256");
+        const url = buildAuthorizeUrl({
+          idpOrigin,
+          clientId,
+          redirectUri,
+          scope,
+          state,
+          nonce,
+          codeChallenge
+        });
         globalThis.location.assign(url.toString());
         return;
       }
@@ -7473,7 +7491,7 @@ function createOidcAuthNamespace(config) {
       const storage = getStorage();
       const token = storage?.getItem(STORAGE_KEY) ?? null;
       if (!token) return null;
-      return tokenToUser(token) ? token : null;
+      return jwtToNeetruUser(token) ? token : null;
     },
     async signOut() {
       const storage = getStorage();