@seedgrid/fe-security 2026.7.0 → 2026.7.2

package/scaffold/src/modules/security/services/auth-service.ts

@@ -0,0 +1,332 @@
+// seedgrid:managed
+
+import { ApiClientError } from "@/modules/core";
+
+import type {
+  AuthTokens,
+  ForgotPasswordPayload,
+  LoginCredentials,
+  PendingTwoFactorSession,
+  PermissionEnvelope,
+} from "../types";
+import { securityApi } from "./security-api";
+
+const SESSION_ROUTE_BASE = "/api/security/session";
+
+export type LoginOutcome =
+  | {
+      kind: "authenticated";
+      tokens: AuthTokens;
+    }
+  | {
+      kind: "two_factor_required";
+      pending: PendingTwoFactorSession;
+    };
+
+export const authService = {
+  async signIn(credentials: LoginCredentials): Promise<LoginOutcome> {
+    const response = await callSessionRoute<unknown>(`${SESSION_ROUTE_BASE}/login`, {
+      method: "POST",
+      body: credentials,
+    });
+
+    const accessToken = pickString(response, "accessToken", "token");
+    const tempToken = pickString(response, "tempToken", "twoFactorToken");
+    const status = pickString(response, "status");
+
+    if (!accessToken && tempToken && (status?.includes("2F") ?? true)) {
+      return {
+        kind: "two_factor_required",
+        pending: {
+          login: credentials.login,
+          tempToken,
+          method: pickString(response, "method"),
+        },
+      };
+    }
+
+    return {
+      kind: "authenticated",
+      tokens: parseAuthTokens(response),
+    };
+  },
+
+  async verifyTwoFactor(
+    pendingSession: PendingTwoFactorSession,
+    code: string
+  ) {
+    const normalizedCode = code.trim();
+
+    const response = await callSessionRoute<unknown>(
+      `${SESSION_ROUTE_BASE}/2fa/verify`,
+      {
+        method: "POST",
+        body: {
+          tempToken:
+            pendingSession.tempToken || pendingSession.twoFactorToken || "",
+          code: normalizedCode,
+          twoFactorCode: normalizedCode,
+          backupCode: normalizedCode,
+        },
+      }
+    );
+
+    return parseAuthTokens(response);
+  },
+
+  async resendTwoFactor(pendingSession: PendingTwoFactorSession) {
+    return callSessionRoute<unknown>(`${SESSION_ROUTE_BASE}/2fa/resend`, {
+      method: "POST",
+      body: {
+        tempToken:
+          pendingSession.tempToken || pendingSession.twoFactorToken || "",
+      },
+    });
+  },
+
+  async refresh() {
+    const response = await callSessionRoute<unknown>(`${SESSION_ROUTE_BASE}/refresh`, {
+      method: "POST",
+    });
+
+    return parseAuthTokens(response);
+  },
+
+  async logout() {
+    await callSessionRoute<unknown>(`${SESSION_ROUTE_BASE}/logout`, {
+      method: "POST",
+    });
+  },
+
+  async forgotPassword(payload: ForgotPasswordPayload) {
+    return securityApi.public.post<unknown>("/public/auth/forgot-password", {
+      body: payload,
+      retry: false,
+    });
+  },
+
+  async confirmPasswordReset(token: string) {
+    const encodedToken = encodeURIComponent(token.trim());
+
+    return securityApi.public.get<unknown>(
+      `/public/auth/reset-password?token=${encodedToken}`,
+      {
+        retry: false,
+      }
+    );
+  },
+
+  async confirmEmail(token: string) {
+    const encodedToken = encodeURIComponent(token.trim());
+
+    return securityApi.public.get<unknown>(
+      `/public/auth/confirm-email?token=${encodedToken}`,
+      {
+        retry: false,
+      }
+    );
+  },
+
+  async loadPermissions(accessToken?: string): Promise<PermissionEnvelope> {
+    const response = await securityApi.get<unknown>("/me/permissions", {
+      requireAuth: !accessToken,
+      retry: false,
+      headers: accessToken
+        ? {
+            Authorization: `Bearer ${accessToken}`,
+          }
+        : undefined,
+    });
+
+    return {
+      permissions: readStringArray(response, "permissions"),
+      roles: readStringArray(response, "roles"),
+      login:
+        pickString(response, "login", "username", "email", "userName") ??
+        undefined,
+      publicId: pickString(response, "publicId") ?? undefined,
+      name: pickString(response, "name", "fullName") ?? undefined,
+    };
+  },
+};
+
+function parseAuthTokens(response: unknown): AuthTokens {
+  const accessToken = pickString(response, "accessToken", "token");
+
+  if (!accessToken) {
+    throw new Error("Security authentication response is missing access token.");
+  }
+
+  const expiresIn = pickNumber(response, "expiresIn");
+  const accessTokenClaims = parseJwtClaims(accessToken);
+
+  return {
+    accessToken,
+    refreshToken: pickString(response, "refreshToken"),
+    tokenType: pickString(response, "tokenType") ?? "Bearer",
+    expiresIn,
+    expiresAt:
+      typeof expiresIn === "number" ? Date.now() + expiresIn * 1000 : null,
+    allowedCompanies: readNumberArray(accessTokenClaims, "allowedCompanies"),
+    publicId:
+      pickString(response, "publicId") ??
+      pickString(
+        accessTokenClaims,
+        "publicId",
+        "userPublicId",
+        "uid",
+        "sub"
+      ) ??
+      undefined,
+    name:
+      pickString(response, "name", "fullName") ??
+      pickString(accessTokenClaims, "name", "fullName", "given_name") ??
+      undefined,
+    changePasswordRequired: pickBoolean(response, "changePasswordRequired") ?? undefined,
+  };
+}
+
+function parseJwtClaims(token: string) {
+  const parts = token.split(".");
+
+  if (parts.length < 2) {
+    return null;
+  }
+
+  try {
+    const normalizedPayload = parts[1].replace(/-/g, "+").replace(/_/g, "/");
+    const paddedPayload = normalizedPayload.padEnd(
+      Math.ceil(normalizedPayload.length / 4) * 4,
+      "="
+    );
+    const decodedPayload = atob(paddedPayload);
+
+    return JSON.parse(decodedPayload) as Record<string, unknown>;
+  } catch {
+    return null;
+  }
+}
+
+async function callSessionRoute<T>(
+  path: string,
+  init: {
+    method?: string;
+    body?: unknown;
+  } = {}
+): Promise<T> {
+  const headers = new Headers();
+
+  if (init.body != null) {
+    headers.set("Content-Type", "application/json");
+  }
+
+  const response = await fetch(path, {
+    method: init.method ?? "GET",
+    headers,
+    body: init.body == null ? undefined : JSON.stringify(init.body),
+    cache: "no-store",
+    credentials: "same-origin",
+  });
+
+  if (response.ok) {
+    if (response.status === 204) {
+      return null as T;
+    }
+
+    return (await response.json()) as T;
+  }
+
+  throw new ApiClientError(
+    `API request failed with status ${response.status}`,
+    response.status,
+    await readResponseBody(response)
+  );
+}
+
+async function readResponseBody(response: Response) {
+  const contentType = response.headers.get("Content-Type") ?? "";
+  console.log("[readResponseBody] contentType:", contentType);
+
+  if (isJsonContentType(contentType)) {
+    const json = await response.json();
+    console.log("[readResponseBody] response json:", JSON.stringify(json, null, 2));
+    return json;
+  }
+
+  const text = await response.text();
+  console.log("[readResponseBody] response text:", text);
+  return text;
+}
+
+function isJsonContentType(contentType: string) {
+  const normalized = contentType.trim().toLowerCase();
+
+  return normalized.includes("/json") || normalized.includes("+json");
+}
+
+function pickBoolean(value: unknown, ...keys: string[]): boolean | null {
+  const candidate = keys.length > 0 ? readValue(value, keys) : value;
+
+  return typeof candidate === "boolean" ? candidate : null;
+}
+
+function pickString(value: unknown, ...keys: string[]): string | null {
+  const candidate = keys.length > 0 ? readValue(value, keys) : value;
+
+  return typeof candidate === "string" && candidate.trim().length > 0
+    ? candidate.trim()
+    : null;
+}
+
+function pickNumber(value: unknown, ...keys: string[]) {
+  const candidate = keys.length > 0 ? readValue(value, keys) : value;
+
+  return typeof candidate === "number" && Number.isFinite(candidate)
+    ? candidate
+    : null;
+}
+
+function readStringArray(value: unknown, key: string) {
+  if (!value || typeof value !== "object") {
+    return [] as string[];
+  }
+
+  const candidate = (value as Record<string, unknown>)[key];
+
+  return Array.isArray(candidate)
+    ? candidate.filter((entry): entry is string => typeof entry === "string")
+    : [];
+}
+
+function readNumberArray(value: unknown, key: string) {
+  if (!value || typeof value !== "object") {
+    return [] as number[];
+  }
+
+  const candidate = (value as Record<string, unknown>)[key];
+
+  return Array.isArray(candidate)
+    ? candidate.filter(
+        (entry): entry is number =>
+          typeof entry === "number" && Number.isFinite(entry)
+      )
+    : [];
+}
+
+function readValue(value: unknown, keys: string[]) {
+  if (!value || typeof value !== "object") {
+    return null;
+  }
+
+  const record = value as Record<string, unknown>;
+
+  for (const key of keys) {
+    const candidate = record[key];
+
+    if (candidate !== undefined && candidate !== null) {
+      return candidate;
+    }
+  }
+
+  return null;
+}

package/scaffold/src/modules/security/services/security-api.test.ts

@@ -0,0 +1,178 @@
+import { describe, expect, it } from "vitest";
+
+import { ApiClientError } from "@/modules/core";
+
+import { extractApiMessage } from "./security-api";
+
+describe("extractApiMessage", () => {
+  it("returns the first violation message from backend validation errors", () => {
+    const error = new ApiClientError("API request failed with status 400", 400, {
+      type: "https://seedgrid.com.br/dados-invalidos",
+      title: "Dados invalidos",
+      status: 400,
+      detail: "Revise os campos informados.",
+      devMessage: "",
+      instance: "/public/auth/login",
+      violations: [
+        {
+          field: "login.loginDTO.password",
+          message: "Senha e obrigatoria",
+        },
+      ],
+    });
+
+    expect(extractApiMessage(error)).toBe("Senha e obrigatoria");
+  });
+
+  it("prioritizes violation messages over generic rfc7807 detail", () => {
+    const error = new ApiClientError("API request failed with status 400", 400, {
+      type: "https://seedgrid.com.br/dados-invalidos",
+      title: "Dados invalidos",
+      status: 400,
+      detail: "Revise os campos informados.",
+      devMessage:
+        "create.dto.name: Nome da role deve ter entre 5 e 30 caracteres alfanuméricos maiúsculos e _",
+      instance: "/roles",
+      violations: [
+        {
+          field: "create.dto.name",
+          message:
+            "Nome da role deve ter entre 5 e 30 caracteres alfanuméricos maiúsculos e _",
+        },
+      ],
+    });
+
+    expect(extractApiMessage(error)).toBe(
+      "Nome da role deve ter entre 5 e 30 caracteres alfanuméricos maiúsculos e _"
+    );
+  });
+
+  it("returns the rfc7807 detail when the response has no violations", () => {
+    const error = new ApiClientError("API request failed with status 401", 401, {
+      type: "https://seedgrid.com.br/autenticacao-negada",
+      title: "Autenticacao negada",
+      status: 401,
+      detail: "Usuario ou senha invalido",
+      devMessage: "",
+      instance: "/public/auth/login",
+    });
+
+    expect(extractApiMessage(error)).toBe("Usuario ou senha invalido");
+  });
+
+  it("parses stringified problem json responses before extracting the message", () => {
+    const error = new ApiClientError(
+      "API request failed with status 400",
+      400,
+      JSON.stringify({
+        type: "https://seedgrid.com.br/dados-invalidos",
+        title: "Dados invalidos",
+        status: 400,
+        detail: "Revise os campos informados.",
+        devMessage: "",
+        instance: "/public/auth/login",
+        violations: [
+          {
+            field: "login.loginDTO.login",
+            message: "Login e obrigatorio",
+          },
+          {
+            field: "login.loginDTO.password",
+            message: "Senha e obrigatoria",
+          },
+        ],
+      })
+    );
+
+    expect(extractApiMessage(error)).toBe("Login e obrigatorio");
+  });
+
+  it("reads violation messages from api-client-like errors even without instanceof", () => {
+    const error = {
+      message: "API request failed with status 400",
+      status: 400,
+      responseBody: {
+        type: "https://seedgrid.com.br/dados-invalidos",
+        title: "Dados invalidos",
+        status: 400,
+        detail: "Revise os campos informados.",
+        devMessage:
+          "create.dto.name: Nome da role deve conter apenas letras maiusculas e _",
+        instance: "/roles",
+        violations: [
+          {
+            field: "create.dto.name",
+            message:
+              "Nome da role deve conter apenas letras maiusculas e _",
+          },
+        ],
+      },
+    };
+
+    expect(extractApiMessage(error)).toBe(
+      "Nome da role deve conter apenas letras maiusculas e _"
+    );
+  });
+
+  it("reads violation messages from wrapped api errors", () => {
+    const error = {
+      message: "API request failed with status 400",
+      cause: {
+        responseBody: JSON.stringify({
+          type: "https://seedgrid.com.br/dados-invalidos",
+          title: "Dados invalidos",
+          status: 400,
+          detail: "Revise os campos informados.",
+          instance: "/roles",
+          violations: [
+            {
+              field: "create.dto.name",
+              message: "Nome da role deve conter apenas letras maiusculas e _",
+            },
+          ],
+        }),
+      },
+    };
+
+    expect(extractApiMessage(error)).toBe(
+      "Nome da role deve conter apenas letras maiusculas e _"
+    );
+  });
+
+  it("falls back to the api client message when the response has no readable details", () => {
+    const error = new ApiClientError("API request failed with status 400", 400, {
+      status: 400,
+    });
+
+    expect(extractApiMessage(error)).toBe("API request failed with status 400");
+  });
+
+  it("maps fetch failures to a friendly server connection message", () => {
+    expect(extractApiMessage(new Error("fetch failed"))).toBe(
+      "Erro ao conectar ao servidor"
+    );
+  });
+
+  it("reproduces the role creation error scenario from issue", () => {
+    const error = new ApiClientError("API request failed with status 400", 400, {
+      type: "https://seedgrid.com.br/dados-invalidos",
+      title: "Dados invalidos",
+      status: 400,
+      detail: "Revise os campos informados.",
+      devMessage:
+        "create.dto.name: Nome da role deve ter entre 5 e 30 caracteres alfanuméricos maiúsculos e _",
+      instance: "http://crm.seedgrid.com.br:8085/roles",
+      violations: [
+        {
+          field: "create.dto.name",
+          message:
+            "Nome da role deve ter entre 5 e 30 caracteres alfanuméricos maiúsculos e _",
+        },
+      ],
+    });
+
+    expect(extractApiMessage(error)).toBe(
+      "Nome da role deve ter entre 5 e 30 caracteres alfanuméricos maiúsculos e _"
+    );
+  });
+});