@neetru/sdk 3.5.0 → 3.6.0

package/dist/auth.mjs

@@ -81,7 +81,7 @@ function compareCalVer(a, b) {
 }
 function readInjectedSdkVersion() {
   try {
-    return "3.5.0";
+    return "3.6.0";
   } catch {
     return void 0;
   }
@@ -6988,6 +6988,94 @@ var MockAi = class {
   }
 };
 
+// src/auth-pkce-shared.ts
+init_errors();
+function getWebCrypto() {
+  const c = globalThis.crypto;
+  if (!c || typeof c.getRandomValues !== "function" || !c.subtle) {
+    throw new NeetruError(
+      "runtime_unsupported",
+      "auth.signIn requer WebCrypto (crypto.subtle) \u2014 indispon\xEDvel neste runtime. Use HTTPS (ou http://localhost) num browser moderno, ou instale um polyfill WebCrypto (ex: react-native-quick-crypto) em React Native."
+    );
+  }
+  return c;
+}
+function base64UrlFromBytes(bytes) {
+  let str = "";
+  for (const b of bytes) str += String.fromCharCode(b);
+  const b64 = typeof btoa === "function" ? btoa(str) : Buffer.from(str, "binary").toString("base64");
+  return b64.replace(/\+/g, "-").replace(/\//g, "_").replace(/=/g, "");
+}
+function randomUrlSafe(crypto2, byteLen) {
+  const bytes = new Uint8Array(byteLen);
+  crypto2.getRandomValues(bytes);
+  return base64UrlFromBytes(bytes);
+}
+async function pkceChallengeS256(crypto2, verifier) {
+  const data = new TextEncoder().encode(verifier);
+  const digest = await crypto2.subtle.digest("SHA-256", data);
+  return base64UrlFromBytes(new Uint8Array(digest));
+}
+function resolveIdpOrigin(baseUrl) {
+  const overrideAuthUrl = typeof globalThis.NEETRU_AUTH_URL === "string" ? globalThis.NEETRU_AUTH_URL : null;
+  return overrideAuthUrl ?? baseUrl.replace(/^https?:\/\/api\./, "https://auth.");
+}
+function resolveOidcClientId(config) {
+  let clientId = config.oidcClientId;
+  if (!clientId && config.apiKey) {
+    clientId = parseApiKey(config.apiKey).keyId;
+  }
+  if (!clientId) {
+    throw new NeetruError(
+      "invalid_config",
+      "auth OIDC requer `oidcClientId` (ou `apiKey`) configurado para montar o client_id."
+    );
+  }
+  return clientId;
+}
+function buildAuthorizeUrl(params) {
+  const url = new URL("/api/v1/oauth/authorize", params.idpOrigin);
+  url.searchParams.set("response_type", "code");
+  url.searchParams.set("client_id", params.clientId);
+  url.searchParams.set("redirect_uri", params.redirectUri);
+  url.searchParams.set("scope", params.scope);
+  url.searchParams.set("state", params.state);
+  url.searchParams.set("nonce", params.nonce);
+  url.searchParams.set("code_challenge", params.codeChallenge);
+  url.searchParams.set("code_challenge_method", "S256");
+  return url;
+}
+function decodeJwtPayload(token) {
+  const parts = token.split(".");
+  if (parts.length !== 3) return null;
+  try {
+    const b64 = parts[1].replace(/-/g, "+").replace(/_/g, "/");
+    const pad = "=".repeat((4 - b64.length % 4) % 4);
+    const decoded = typeof atob === "function" ? atob(b64 + pad) : Buffer.from(b64 + pad, "base64").toString("utf-8");
+    return JSON.parse(decoded);
+  } catch {
+    return null;
+  }
+}
+function jwtToNeetruUser(token) {
+  const payload = decodeJwtPayload(token);
+  if (!payload || typeof payload.sub !== "string") return null;
+  if (typeof payload.exp === "number" && payload.exp * 1e3 < Date.now()) {
+    return null;
+  }
+  return {
+    uid: payload.sub,
+    email: typeof payload.email === "string" ? payload.email : "",
+    emailVerified: typeof payload.email_verified === "boolean" ? payload.email_verified : void 0,
+    displayName: typeof payload.name === "string" ? payload.name : void 0,
+    photoURL: typeof payload.picture === "string" ? payload.picture : void 0,
+    isStaff: payload.is_staff === true,
+    isCustomer: payload.is_customer === true,
+    tenantId: typeof payload.tenant_id === "string" ? payload.tenant_id : void 0,
+    ...payload
+  };
+}
+
 // src/auth.ts
 function readEnvApiKey() {
   try {
@@ -7045,36 +7133,6 @@ function _jwtPayloadToUser(payload) {
   };
 }
 var OIDC_TX_KEY = "neetru_oauth_tx";
-function resolveIdpOrigin(baseUrl) {
-  const overrideAuthUrl = typeof globalThis.NEETRU_AUTH_URL === "string" ? globalThis.NEETRU_AUTH_URL : null;
-  return overrideAuthUrl ?? baseUrl.replace(/^https?:\/\/api\./, "https://auth.");
-}
-function getWebCrypto() {
-  const c = globalThis.crypto;
-  if (!c || typeof c.getRandomValues !== "function" || !c.subtle) {
-    throw new NeetruError(
-      "runtime_unsupported",
-      "auth.signIn requer WebCrypto (crypto.subtle) \u2014 indispon\xEDvel neste runtime. Use HTTPS (ou http://localhost) num browser moderno."
-    );
-  }
-  return c;
-}
-function base64UrlFromBytes(bytes) {
-  let str = "";
-  for (const b of bytes) str += String.fromCharCode(b);
-  const b64 = typeof btoa === "function" ? btoa(str) : Buffer.from(str, "binary").toString("base64");
-  return b64.replace(/\+/g, "-").replace(/\//g, "_").replace(/=/g, "");
-}
-function randomUrlSafe(crypto2, byteLen) {
-  const bytes = new Uint8Array(byteLen);
-  crypto2.getRandomValues(bytes);
-  return base64UrlFromBytes(bytes);
-}
-async function pkceChallengeS256(crypto2, verifier) {
-  const data = new TextEncoder().encode(verifier);
-  const digest = await crypto2.subtle.digest("SHA-256", data);
-  return base64UrlFromBytes(new Uint8Array(digest));
-}
 function cleanCallbackUrl(parsed) {
   try {
     const history = globalThis.history;
@@ -7108,36 +7166,6 @@ function createOidcAuthNamespace(config) {
       return null;
     }
   }
-  function decodeJwtPayload(token) {
-    const parts = token.split(".");
-    if (parts.length !== 3) return null;
-    try {
-      const b64 = parts[1].replace(/-/g, "+").replace(/_/g, "/");
-      const pad = "=".repeat((4 - b64.length % 4) % 4);
-      const decoded = typeof atob === "function" ? atob(b64 + pad) : Buffer.from(b64 + pad, "base64").toString("utf-8");
-      return JSON.parse(decoded);
-    } catch {
-      return null;
-    }
-  }
-  function tokenToUser(token) {
-    const payload = decodeJwtPayload(token);
-    if (!payload || typeof payload.sub !== "string") return null;
-    if (typeof payload.exp === "number" && payload.exp * 1e3 < Date.now()) {
-      return null;
-    }
-    return {
-      uid: payload.sub,
-      email: typeof payload.email === "string" ? payload.email : "",
-      emailVerified: typeof payload.email_verified === "boolean" ? payload.email_verified : void 0,
-      displayName: typeof payload.name === "string" ? payload.name : void 0,
-      photoURL: typeof payload.picture === "string" ? payload.picture : void 0,
-      isStaff: payload.is_staff === true,
-      isCustomer: payload.is_customer === true,
-      tenantId: typeof payload.tenant_id === "string" ? payload.tenant_id : void 0,
-      ...payload
-    };
-  }
   function loadCachedUser() {
     if (cachedUser) {
       const exp = cachedUser.exp;
@@ -7158,7 +7186,7 @@ function createOidcAuthNamespace(config) {
       attemptSilentRefresh();
       return null;
     }
-    const user = tokenToUser(token);
+    const user = jwtToNeetruUser(token);
     if (!user) {
       storage.removeItem(STORAGE_KEY);
       attemptSilentRefresh();
@@ -7229,7 +7257,7 @@ function createOidcAuthNamespace(config) {
       if (!res.ok || typeof payload?.error === "string") return false;
       const idToken = payload?.id_token;
       if (typeof idToken !== "string" || idToken.length === 0) return false;
-      const user = tokenToUser(idToken);
+      const user = jwtToNeetruUser(idToken);
       if (!user) return false;
       const storage = getStorage();
       storage?.setItem(STORAGE_KEY, idToken);
@@ -7275,17 +7303,7 @@ function createOidcAuthNamespace(config) {
     }, msUntilExpiry + 1);
   }
   function resolveClientId() {
-    let clientId = config.oidcClientId;
-    if (!clientId && config.apiKey) {
-      clientId = parseApiKey(config.apiKey).keyId;
-    }
-    if (!clientId) {
-      throw new NeetruError(
-        "invalid_config",
-        "auth OIDC requer `oidcClientId` (ou `apiKey`) configurado para montar o client_id."
-      );
-    }
-    return clientId;
+    return resolveOidcClientId(config);
   }
   async function handleRedirectCallback(currentUrl) {
     const href = currentUrl ?? (typeof globalThis.location !== "undefined" ? globalThis.location.href : void 0);
@@ -7403,7 +7421,7 @@ function createOidcAuthNamespace(config) {
         "nonce do id_token n\xE3o confere com o da transa\xE7\xE3o OIDC (poss\xEDvel replay). Token descartado."
       );
     }
-    const user = tokenToUser(idToken);
+    const user = jwtToNeetruUser(idToken);
     if (!user) {
       throw new NeetruError(
         "token_exchange_failed",
@@ -7448,15 +7466,15 @@ function createOidcAuthNamespace(config) {
         };
         session.setItem(OIDC_TX_KEY, JSON.stringify(tx));
         const idpOrigin = resolveIdpOrigin(config.baseUrl);
-        const url = new URL("/api/v1/oauth/authorize", idpOrigin);
-        url.searchParams.set("response_type", "code");
-        url.searchParams.set("client_id", clientId);
-        url.searchParams.set("redirect_uri", redirectUri);
-        url.searchParams.set("scope", scope);
-        url.searchParams.set("state", state);
-        url.searchParams.set("nonce", nonce);
-        url.searchParams.set("code_challenge", codeChallenge);
-        url.searchParams.set("code_challenge_method", "S256");
+        const url = buildAuthorizeUrl({
+          idpOrigin,
+          clientId,
+          redirectUri,
+          scope,
+          state,
+          nonce,
+          codeChallenge
+        });
         globalThis.location.assign(url.toString());
         return;
       }
@@ -7471,7 +7489,7 @@ function createOidcAuthNamespace(config) {
       const storage = getStorage();
       const token = storage?.getItem(STORAGE_KEY) ?? null;
       if (!token) return null;
-      return tokenToUser(token) ? token : null;
+      return jwtToNeetruUser(token) ? token : null;
     },
     async signOut() {
       const storage = getStorage();