@vatts/auth 2.1.2 → 2.1.3-canary.1.0.1

package/dist/core.js

@@ -103,7 +103,8 @@ class VattsAuth {
             path: '/',
             httpOnly: true,
             secure: this.config.secureCookies || false,
-            sameSite: 'strict'
+            sameSite: 'strict',
+            domain: this.config.domain || undefined
         });
     }
     /**
@@ -163,7 +164,7 @@ class VattsAuth {
             sameSite: 'strict', // Prevent CSRF attacks
             maxAge: (this.config.session?.maxAge || 86400) * 1000,
             path: '/',
-            domain: undefined // Let browser set automatically for security
+            domain: this.config.domain || undefined // Let browser set automatically for security
         })
             // SECURITY: Comprehensive security headers
             .header('X-Content-Type-Options', 'nosniff')

package/dist/providers/discord.d.ts

@@ -55,7 +55,7 @@ export declare class DiscordProvider implements AuthProviderClass {
     /**
      * Gera URL de autorização do Discord
      */
-    getAuthorizationUrl(): string;
+    getAuthorizationUrl(isPopup?: boolean): string;
     /**
      * Retorna configuração pública do provider
      */

package/dist/providers/discord.js

@@ -38,7 +38,13 @@ class DiscordProvider {
                 handler: async (req, params) => {
                     const url = new URL(req.url || '', 'http://localhost');
                     const code = url.searchParams.get('code');
+                    const state = url.searchParams.get('state');
+                    // Detecta se é modo popup pela state
+                    const isPopup = state?.includes('popup=true');
                     if (!code) {
+                        if (isPopup) {
+                            return vatts_1.VattsResponse.redirect(`/api/auth/popup-callback?success=false&error=Authorization+code+not+provided&provider=discord`);
+                        }
                         return vatts_1.VattsResponse.json({ error: 'Authorization code not provided' }, { status: 400 });
                     }
                     try {
@@ -56,9 +62,15 @@ class DiscordProvider {
                             })
                         });
                         if (authResponse.ok) {
-                            // Propaga o cookie de sessão retornado pelo endpoint de signin
-                            // e redireciona o usuário para a página de sucesso.
                             const setCookieHeader = authResponse.headers.get('set-cookie');
+                            // Se é popup, redireciona para popup-callback
+                            if (isPopup) {
+                                const callbackUrl = this.config.successUrl || '/';
+                                return vatts_1.VattsResponse
+                                    .redirect(`/api/auth/popup-callback?success=true&provider=discord&callbackUrl=${encodeURIComponent(callbackUrl)}`)
+                                    .header('Set-Cookie', setCookieHeader || '');
+                            }
+                            // Comportamento normal
                             if (this.config.successUrl) {
                                 return vatts_1.VattsResponse
                                     .redirect(this.config.successUrl)
@@ -70,11 +82,17 @@ class DiscordProvider {
                         else {
                             const errorText = await authResponse.text();
                             console.error(`[${this.id} Provider] Session creation failed during callback. Status: ${authResponse.status}, Body: ${errorText}`);
+                            if (isPopup) {
+                                return vatts_1.VattsResponse.redirect(`/api/auth/popup-callback?success=false&error=Session+creation+failed&provider=discord`);
+                            }
                             return vatts_1.VattsResponse.json({ error: 'Session creation failed' }, { status: 500 });
                         }
                     }
                     catch (error) {
                         console.error(`[${this.id} Provider] Callback handler fetch error:`, error);
+                        if (isPopup) {
+                            return vatts_1.VattsResponse.redirect(`/api/auth/popup-callback?success=false&error=Internal+server+error&provider=discord`);
+                        }
                         return vatts_1.VattsResponse.json({ error: 'Internal server error' }, { status: 500 });
                     }
                 }
@@ -88,7 +106,7 @@ class DiscordProvider {
      * Método para gerar URL OAuth (usado pelo handleSignIn)
      */
     handleOauth(credentials = {}) {
-        return this.getAuthorizationUrl();
+        return this.getAuthorizationUrl(credentials.popup === 'true');
     }
     /**
      * Método principal - agora redireciona para OAuth ou processa callback
@@ -164,13 +182,17 @@ class DiscordProvider {
     /**
      * Gera URL de autorização do Discord
      */
-    getAuthorizationUrl() {
+    getAuthorizationUrl(isPopup = false) {
         const params = new URLSearchParams({
             client_id: this.config.clientId,
             redirect_uri: this.config.callbackUrl || '',
             response_type: 'code',
             scope: (this.config.scope || this.defaultScope).join(' ')
         });
+        // Adiciona state para indicar modo popup
+        if (isPopup) {
+            params.set('state', `popup=true&timestamp=${Date.now()}`);
+        }
         return `https://discord.com/api/oauth2/authorize?${params.toString()}`;
     }
     /**

package/dist/providers/github.d.ts

@@ -55,7 +55,7 @@ export declare class GithubProvider implements AuthProviderClass {
     /**
      * Gera a URL de autorização do GitHub
      */
-    getAuthorizationUrl(): string;
+    getAuthorizationUrl(isPopup?: boolean): string;
     /**
      * Retorna a configuração pública do provider
      */

package/dist/providers/github.js

@@ -41,7 +41,13 @@ class GithubProvider {
                 handler: async (req, params) => {
                     const url = new URL(req.url || '', 'http://localhost');
                     const code = url.searchParams.get('code');
+                    const state = url.searchParams.get('state');
+                    // Detecta se é modo popup pela state
+                    const isPopup = state?.includes('popup=true');
                     if (!code) {
+                        if (isPopup) {
+                            return vatts_1.VattsResponse.redirect(`/api/auth/popup-callback?success=false&error=Authorization+code+not+provided&provider=github`);
+                        }
                         return vatts_1.VattsResponse.json({ error: 'Authorization code not provided' }, { status: 400 });
                     }
                     try {
@@ -57,8 +63,15 @@ class GithubProvider {
                             })
                         });
                         if (authResponse.ok) {
-                            // Propaga o cookie de sessão e redireciona para a URL de sucesso
                             const setCookieHeader = authResponse.headers.get('set-cookie');
+                            // Se é popup, redireciona para popup-callback
+                            if (isPopup) {
+                                const callbackUrl = this.config.successUrl || '/';
+                                return vatts_1.VattsResponse
+                                    .redirect(`/api/auth/popup-callback?success=true&provider=github&callbackUrl=${encodeURIComponent(callbackUrl)}`)
+                                    .header('Set-Cookie', setCookieHeader || '');
+                            }
+                            // Comportamento normal
                             if (this.config.successUrl) {
                                 return vatts_1.VattsResponse
                                     .redirect(this.config.successUrl)
@@ -70,11 +83,17 @@ class GithubProvider {
                         else {
                             const errorText = await authResponse.text();
                             console.error(`[${this.id} Provider] Session creation failed during callback. Status: ${authResponse.status}, Body: ${errorText}`);
+                            if (isPopup) {
+                                return vatts_1.VattsResponse.redirect(`/api/auth/popup-callback?success=false&error=Session+creation+failed&provider=github`);
+                            }
                             return vatts_1.VattsResponse.json({ error: 'Session creation failed' }, { status: 500 });
                         }
                     }
                     catch (error) {
                         console.error(`[${this.id} Provider] Callback handler fetch error:`, error);
+                        if (isPopup) {
+                            return vatts_1.VattsResponse.redirect(`/api/auth/popup-callback?success=false&error=Internal+server+error&provider=github`);
+                        }
                         return vatts_1.VattsResponse.json({ error: 'Internal server error' }, { status: 500 });
                     }
                 }
@@ -88,7 +107,7 @@ class GithubProvider {
      * Método para gerar URL OAuth (usado pelo handleSignIn)
      */
     handleOauth(credentials = {}) {
-        return this.getAuthorizationUrl();
+        return this.getAuthorizationUrl(credentials.popup === 'true');
     }
     /**
      * Método principal - redireciona para OAuth ou processa o callback
@@ -191,7 +210,7 @@ class GithubProvider {
     /**
      * Gera a URL de autorização do GitHub
      */
-    getAuthorizationUrl() {
+    getAuthorizationUrl(isPopup = false) {
         const params = new URLSearchParams({
             client_id: this.config.clientId,
             redirect_uri: this.config.callbackUrl || '',
@@ -199,6 +218,10 @@ class GithubProvider {
             // GitHub não usa 'response_type=code' explicitamente na URL padrão, mas aceita.
             // O padrão é web application flow.
         });
+        // Adiciona state para indicar modo popup
+        if (isPopup) {
+            params.set('state', `popup=true&timestamp=${Date.now()}`);
+        }
         return `https://github.com/login/oauth/authorize?${params.toString()}`;
     }
     /**

package/dist/providers/google.d.ts

@@ -55,7 +55,7 @@ export declare class GoogleProvider implements AuthProviderClass {
     /**
      * Gera a URL de autorização do Google
      */
-    getAuthorizationUrl(): string;
+    getAuthorizationUrl(isPopup?: boolean): string;
     /**
      * Retorna a configuração pública do provider
      */

package/dist/providers/google.js

@@ -42,7 +42,13 @@ class GoogleProvider {
                 handler: async (req, params) => {
                     const url = new URL(req.url || '', 'http://localhost');
                     const code = url.searchParams.get('code');
+                    const state = url.searchParams.get('state');
+                    // Detecta se é modo popup pela state
+                    const isPopup = state?.includes('popup=true');
                     if (!code) {
+                        if (isPopup) {
+                            return vatts_1.VattsResponse.redirect(`/api/auth/popup-callback?success=false&error=Authorization+code+not+provided&provider=google`);
+                        }
                         return vatts_1.VattsResponse.json({ error: 'Authorization code not provided' }, { status: 400 });
                     }
                     try {
@@ -58,8 +64,15 @@ class GoogleProvider {
                             })
                         });
                         if (authResponse.ok) {
-                            // Propaga o cookie de sessão e redireciona para a URL de sucesso
                             const setCookieHeader = authResponse.headers.get('set-cookie');
+                            // Se é popup, redireciona para popup-callback
+                            if (isPopup) {
+                                const callbackUrl = this.config.successUrl || '/';
+                                return vatts_1.VattsResponse
+                                    .redirect(`/api/auth/popup-callback?success=true&provider=google&callbackUrl=${encodeURIComponent(callbackUrl)}`)
+                                    .header('Set-Cookie', setCookieHeader || '');
+                            }
+                            // Comportamento normal
                             if (this.config.successUrl) {
                                 return vatts_1.VattsResponse
                                     .redirect(this.config.successUrl)
@@ -71,11 +84,17 @@ class GoogleProvider {
                         else {
                             const errorText = await authResponse.text();
                             console.error(`[${this.id} Provider] Session creation failed during callback. Status: ${authResponse.status}, Body: ${errorText}`);
+                            if (isPopup) {
+                                return vatts_1.VattsResponse.redirect(`/api/auth/popup-callback?success=false&error=Session+creation+failed&provider=google`);
+                            }
                             return vatts_1.VattsResponse.json({ error: 'Session creation failed' }, { status: 500 });
                         }
                     }
                     catch (error) {
                         console.error(`[${this.id} Provider] Callback handler fetch error:`, error);
+                        if (isPopup) {
+                            return vatts_1.VattsResponse.redirect(`/api/auth/popup-callback?success=false&error=Internal+server+error&provider=google`);
+                        }
                         return vatts_1.VattsResponse.json({ error: 'Internal server error' }, { status: 500 });
                     }
                 }
@@ -89,7 +108,7 @@ class GoogleProvider {
      * Método para gerar URL OAuth (usado pelo handleSignIn)
      */
     handleOauth(credentials = {}) {
-        return this.getAuthorizationUrl();
+        return this.getAuthorizationUrl(credentials.popup === 'true');
     }
     /**
      * Método principal - redireciona para OAuth ou processa o callback
@@ -160,13 +179,17 @@ class GoogleProvider {
     /**
      * Gera a URL de autorização do Google
      */
-    getAuthorizationUrl() {
+    getAuthorizationUrl(isPopup = false) {
         const params = new URLSearchParams({
             client_id: this.config.clientId,
             redirect_uri: this.config.callbackUrl || '',
             response_type: 'code',
             scope: (this.config.scope || this.defaultScope).join(' ')
         });
+        // Adiciona state para indicar modo popup
+        if (isPopup) {
+            params.set('state', `popup=true&timestamp=${Date.now()}`);
+        }
         return `https://accounts.google.com/o/oauth2/v2/auth?${params.toString()}`;
     }
     /**

package/dist/react/index.d.ts

@@ -1,5 +1,4 @@
 export * from './react';
-export * from '../client';
 export * from './components';
 export { useSession, useAuth, SessionProvider } from './react';
 export { AuthGuard, GuestOnly } from './components';

package/dist/react/index.js

@@ -33,7 +33,6 @@ exports.GuestOnly = exports.AuthGuard = exports.SessionProvider = exports.useAut
  */
 // Exportações do frontend
 __exportStar(require("./react"), exports);
-__exportStar(require("../client"), exports);
 __exportStar(require("./components"), exports);
 // Re-exports das funções mais usadas para conveniência
 var react_1 = require("./react");

package/dist/react/react.js

@@ -23,6 +23,67 @@ const jsx_runtime_1 = require("react/jsx-runtime");
 const react_1 = require("react");
 const react_2 = require("vatts/react");
 const SessionContext = (0, react_1.createContext)(undefined);
+/**
+ * Abre OAuth em popup e aguarda o resultado
+ */
+function openOAuthPopup(url, provider, fetchSession, redirect) {
+    return new Promise((resolve, reject) => {
+        const width = 600;
+        const height = 700;
+        const left = window.screenX + (window.outerWidth - width) / 2;
+        const top = window.screenY + (window.outerHeight - height) / 2;
+        const popup = window.open(url, `oauth-${provider}`, `width=${width},height=${height},left=${left},top=${top},toolbar=no,location=no,status=no,menubar=no,scrollbars=yes`);
+        if (!popup) {
+            resolve({
+                error: 'Popup blocked',
+                status: 400,
+                ok: false
+            });
+            return;
+        }
+        // Verifica se o popup foi fechado manualmente
+        const checkPopupClosed = setInterval(() => {
+            if (popup.closed) {
+                clearInterval(checkPopupClosed);
+                window.removeEventListener('message', handleMessage);
+                resolve({
+                    error: 'Popup closed',
+                    status: 400,
+                    ok: false
+                });
+            }
+        }, 500);
+        // Listener para mensagens do popup
+        const handleMessage = async (event) => {
+            if (event.data?.type === 'oauth-success' && event.data?.provider === provider) {
+                clearInterval(checkPopupClosed);
+                window.removeEventListener('message', handleMessage);
+                popup.close();
+                // Atualiza a sessão
+                await fetchSession();
+                if (redirect && typeof window !== 'undefined') {
+                    window.location.href = event.data.callbackUrl || '/';
+                }
+                resolve({
+                    ok: true,
+                    status: 200,
+                    url: event.data.callbackUrl || '/'
+                });
+            }
+            else if (event.data?.type === 'oauth-error' && event.data?.provider === provider) {
+                clearInterval(checkPopupClosed);
+                window.removeEventListener('message', handleMessage);
+                popup.close();
+                resolve({
+                    error: event.data.error || 'Authentication failed',
+                    status: 401,
+                    ok: false
+                });
+            }
+        };
+        window.addEventListener('message', handleMessage);
+    });
+}
 function SessionProvider({ children, basePath = '/api/auth', refetchInterval = 0, refetchOnWindowFocus = true }) {
     const [session, setSession] = (0, react_1.useState)(null);
     const [status, setStatus] = (0, react_1.useState)('loading');
@@ -59,7 +120,7 @@ function SessionProvider({ children, basePath = '/api/auth', refetchInterval = 0
     // SignIn function
     const signIn = (0, react_1.useCallback)(async (provider = 'credentials', options = {}) => {
         try {
-            const { redirect = true, callbackUrl, ...credentials } = options;
+            const { redirect = true, callbackUrl, popup = false, ...credentials } = options;
             const response = await fetch(`${basePath}/signin`, {
                 method: 'POST',
                 headers: {
@@ -68,15 +129,19 @@ function SessionProvider({ children, basePath = '/api/auth', refetchInterval = 0
                 credentials: 'include',
                 body: JSON.stringify({
                     provider,
-                    ...credentials
+                    ...credentials,
+                    popup
                 })
             });
             const data = await response.json();
             if (response.ok && data.success) {
-                await fetchSession();
-                // Se é OAuth, redireciona para URL fornecida
+                // Se é OAuth, redireciona para URL fornecida ou abre popup
                 if (data.type === 'oauth' && data.redirectUrl) {
-                    if (redirect && typeof window !== 'undefined') {
+                    if (popup && typeof window !== 'undefined') {
+                        // Abre em popup
+                        return await openOAuthPopup(data.redirectUrl, provider, fetchSession, redirect);
+                    }
+                    else if (redirect && typeof window !== 'undefined') {
                         window.location.href = data.redirectUrl;
                     }
                     return {
@@ -85,7 +150,8 @@ function SessionProvider({ children, basePath = '/api/auth', refetchInterval = 0
                         url: data.redirectUrl
                     };
                 }
-                // Se é sessão (credentials), redireciona para callbackUrl
+                // Se é sessão (credentials), atualiza e redireciona
+                await fetchSession();
                 if (data.type === 'session') {
                     if (redirect && typeof window !== 'undefined') {
                         window.location.href = callbackUrl || '/';

package/dist/routes.js

@@ -54,6 +54,8 @@ function createAuthRoutes(config) {
                     return await handleCsrf(req);
                 case 'providers':
                     return await handleProviders(auth);
+                case 'popup-callback':
+                    return handlePopupCallback(req);
                 default:
                     return vatts_1.VattsResponse.json({ error: 'Route not found' }, { status: 404 });
             }
@@ -120,8 +122,12 @@ async function handleProviders(auth) {
  */
 async function handleSignIn(req, auth) {
     try {
-        const { provider = 'credentials', ...credentials } = await req.json();
-        const result = await auth.signIn(provider, credentials);
+        const { provider = 'credentials', popup, ...credentials } = await req.json();
+        // Se popup está definido, passa para os credentials
+        const credentialsWithPopup = popup !== undefined
+            ? { ...credentials, popup: String(popup) }
+            : credentials;
+        const result = await auth.signIn(provider, credentialsWithPopup);
         if (!result) {
             return vatts_1.VattsResponse.json({ error: 'Invalid credentials' }, { status: 401 });
         }
@@ -145,6 +151,89 @@ async function handleSignIn(req, auth) {
         return vatts_1.VattsResponse.json({ error: 'Authentication failed' }, { status: 500 });
     }
 }
+/**
+ * Handler para GET /api/auth/popup-callback
+ * Retorna uma página HTML que envia mensagem para a janela pai e fecha o popup
+ */
+function handlePopupCallback(req) {
+    const url = new URL(req.url, 'http://localhost');
+    const success = url.searchParams.get('success') === 'true';
+    const error = url.searchParams.get('error');
+    const provider = url.searchParams.get('provider') || 'unknown';
+    const callbackUrl = url.searchParams.get('callbackUrl') || '/';
+    const html = `
+<!DOCTYPE html>
+<html>
+<head>
+    <meta charset="UTF-8">
+    <title>Authenticating...</title>
+    <style>
+        body {
+            font-family: -apple-system, BlinkMacSystemFont, 'Segoe UI', Roboto, 'Helvetica Neue', Arial, sans-serif;
+            display: flex;
+            justify-content: center;
+            align-items: center;
+            height: 100vh;
+            margin: 0;
+            background: linear-gradient(135deg, #667eea 0%, #764ba2 100%);
+            color: white;
+        }
+        .container {
+            text-align: center;
+        }
+        .spinner {
+            border: 4px solid rgba(255,255,255,0.3);
+            border-radius: 50%;
+            border-top: 4px solid white;
+            width: 40px;
+            height: 40px;
+            animation: spin 1s linear infinite;
+            margin: 0 auto 20px;
+        }
+        @keyframes spin {
+            0% { transform: rotate(0deg); }
+            100% { transform: rotate(360deg); }
+        }
+        h2 {
+            margin: 0;
+            font-size: 24px;
+        }
+        p {
+            margin: 10px 0 0;
+            opacity: 0.9;
+        }
+    </style>
+</head>
+<body>
+    <div class="container">
+        <div class="spinner"></div>
+        <h2>${success ? '✓ Autenticação bem-sucedida' : '✗ Erro na autenticação'}</h2>
+        <p>${success ? 'Fechando janela...' : (error || 'Algo deu errado')}</p>
+    </div>
+    <script>
+        (function() {
+            try {
+                if (window.opener) {
+                    console.log('Enviando mensagem para janela pai:')
+                    window.opener.postMessage({
+                        type: ${success ? "'oauth-success'" : "'oauth-error'"},
+                        provider: "${provider}",
+                        ${success ? `callbackUrl: "${callbackUrl}"` : `error: "${error || 'Authentication failed'}"`}
+                    }, window.location.origin);
+                }
+                setTimeout(() => {
+                    window.close();
+                }, 1000);
+            } catch (e) {
+                console.error('Error communicating with parent window:', e);
+            }
+        })();
+    </script>
+</body>
+</html>
+    `;
+    return vatts_1.VattsResponse.html(html);
+}
 /**
  * Handler para POST /api/auth/signout
  */

package/dist/types.d.ts

@@ -7,6 +7,7 @@ export interface Session {
 export interface SignInOptions {
     redirect?: boolean;
     callbackUrl?: string;
+    popup?: boolean;
     [key: string]: any;
 }
 export interface SignInResult {
@@ -63,6 +64,7 @@ export interface AuthConfig {
     secret?: string;
     debug?: boolean;
     secureCookies?: boolean;
+    domain?: string;
 }
 export interface CredentialsConfig {
     id?: string;

package/dist/vue/session.js

@@ -24,6 +24,67 @@ const vue_1 = require("vue");
 const vue_2 = require("vatts/vue");
 // Chave de injeção para o TypeScript
 exports.SessionKey = Symbol('SessionKey');
+/**
+ * Abre OAuth em popup e aguarda o resultado
+ */
+function openOAuthPopup(url, provider, fetchSession, redirect) {
+    return new Promise((resolve, reject) => {
+        const width = 600;
+        const height = 700;
+        const left = window.screenX + (window.outerWidth - width) / 2;
+        const top = window.screenY + (window.outerHeight - height) / 2;
+        const popup = window.open(url, `oauth-${provider}`, `width=${width},height=${height},left=${left},top=${top},toolbar=no,location=no,status=no,menubar=no,scrollbars=yes`);
+        if (!popup) {
+            resolve({
+                error: 'Popup blocked',
+                status: 400,
+                ok: false
+            });
+            return;
+        }
+        // Verifica se o popup foi fechado manualmente
+        const checkPopupClosed = setInterval(() => {
+            if (popup.closed) {
+                clearInterval(checkPopupClosed);
+                window.removeEventListener('message', handleMessage);
+                resolve({
+                    error: 'Popup closed',
+                    status: 400,
+                    ok: false
+                });
+            }
+        }, 500);
+        // Listener para mensagens do popup
+        const handleMessage = async (event) => {
+            if (event.data?.type === 'oauth-success' && event.data?.provider === provider) {
+                clearInterval(checkPopupClosed);
+                window.removeEventListener('message', handleMessage);
+                popup.close();
+                // Atualiza a sessão
+                await fetchSession();
+                if (redirect && typeof window !== 'undefined') {
+                    window.location.href = event.data.callbackUrl || '/';
+                }
+                resolve({
+                    ok: true,
+                    status: 200,
+                    url: event.data.callbackUrl || '/'
+                });
+            }
+            else if (event.data?.type === 'oauth-error' && event.data?.provider === provider) {
+                clearInterval(checkPopupClosed);
+                window.removeEventListener('message', handleMessage);
+                popup.close();
+                resolve({
+                    error: event.data.error || 'Authentication failed',
+                    status: 401,
+                    ok: false
+                });
+            }
+        };
+        window.addEventListener('message', handleMessage);
+    });
+}
 /**
  * Composable que contém toda a lógica do SessionProvider.
  * Deve ser chamado dentro do setup do componente.
@@ -66,7 +127,7 @@ function useSessionProviderLogic(props) {
     // SignIn function
     const signIn = async (provider = 'credentials', options = {}) => {
         try {
-            const { redirect = true, callbackUrl, ...credentials } = options;
+            const { redirect = true, callbackUrl, popup = false, ...credentials } = options;
             const response = await fetch(`${props.basePath}/signin`, {
                 method: 'POST',
                 headers: {
@@ -80,13 +141,18 @@ function useSessionProviderLogic(props) {
             });
             const data = await response.json();
             if (response.ok && data.success) {
-                await fetchSession();
                 if (data.type === 'oauth' && data.redirectUrl) {
-                    if (redirect && typeof window !== 'undefined') {
+                    if (popup && typeof window !== 'undefined') {
+                        // Abre em popup
+                        return await openOAuthPopup(data.redirectUrl, provider, fetchSession, redirect);
+                    }
+                    else if (redirect && typeof window !== 'undefined') {
                         window.location.href = data.redirectUrl;
                     }
                     return { ok: true, status: 200, url: data.redirectUrl };
                 }
+                // Se é sessão (credentials), atualiza e redireciona
+                await fetchSession();
                 if (data.type === 'session') {
                     const finalUrl = callbackUrl || '/';
                     if (redirect && typeof window !== 'undefined') {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@vatts/auth",
-  "version": "2.1.2",
+  "version": "2.1.3-canary.1.0.1",
   "description": "Authentication package for Vatts.js framework",
   "main": "dist/index.js",
   "types": "dist/index.d.ts",
@@ -50,7 +50,7 @@
     "react": "^19.2.0",
     "react-dom": "^19.2.0",
     "vue": "^3.5.27",
-    "vatts": "^2.1.2"
+    "vatts": "^2.1.3-canary.1.0.1"
   },
   "peerDependenciesMeta": {
     "react-dom": {

package/dist/client.d.ts

@@ -1,24 +0,0 @@
-import type { SignInOptions, SignInResult, Session } from './types';
-export declare function setBasePath(path: string): void;
-/**
- * Função para obter a sessão atual (similar ao NextAuth getSession)
- */
-export declare function getSession(): Promise<Session | null>;
-/**
- * Função para obter token CSRF
- */
-export declare function getCsrfToken(): Promise<string | null>;
-/**
- * Função para obter providers disponíveis
- */
-export declare function getProviders(): Promise<any[] | null>;
-/**
- * Função para fazer login (similar ao NextAuth signIn)
- */
-export declare function signIn(provider?: string, options?: SignInOptions): Promise<SignInResult | undefined>;
-/**
- * Função para fazer logout (similar ao NextAuth signOut)
- */
-export declare function signOut(options?: {
-    callbackUrl?: string;
-}): Promise<void>;

package/dist/client.js

@@ -1,146 +0,0 @@
-"use strict";
-Object.defineProperty(exports, "__esModule", { value: true });
-exports.setBasePath = setBasePath;
-exports.getSession = getSession;
-exports.getCsrfToken = getCsrfToken;
-exports.getProviders = getProviders;
-exports.signIn = signIn;
-exports.signOut = signOut;
-// Configuração global do client
-let basePath = '/api/auth';
-function setBasePath(path) {
-    basePath = path;
-}
-/**
- * Função para obter a sessão atual (similar ao NextAuth getSession)
- */
-async function getSession() {
-    try {
-        const response = await fetch(`${basePath}/session`, {
-            credentials: 'include'
-        });
-        if (!response.ok) {
-            return null;
-        }
-        const data = await response.json();
-        return data.session || null;
-    }
-    catch (error) {
-        console.error('[vatts-auth] Error fetching session:', error);
-        return null;
-    }
-}
-/**
- * Função para obter token CSRF
- */
-async function getCsrfToken() {
-    try {
-        const response = await fetch(`${basePath}/csrf`, {
-            credentials: 'include'
-        });
-        if (!response.ok) {
-            return null;
-        }
-        const data = await response.json();
-        return data.csrfToken || null;
-    }
-    catch (error) {
-        console.error('[vatts-auth] Error fetching CSRF token:', error);
-        return null;
-    }
-}
-/**
- * Função para obter providers disponíveis
- */
-async function getProviders() {
-    try {
-        const response = await fetch(`${basePath}/providers`, {
-            credentials: 'include'
-        });
-        if (!response.ok) {
-            return null;
-        }
-        const data = await response.json();
-        return data.providers || [];
-    }
-    catch (error) {
-        console.error('[vatts-auth] Error searching for providers:', error);
-        return null;
-    }
-}
-/**
- * Função para fazer login (similar ao NextAuth signIn)
- */
-async function signIn(provider = 'credentials', options = {}) {
-    try {
-        const { redirect = true, callbackUrl, ...credentials } = options;
-        const response = await fetch(`${basePath}/signin`, {
-            method: 'POST',
-            headers: {
-                'Content-Type': 'application/json',
-            },
-            credentials: 'include',
-            body: JSON.stringify({
-                provider,
-                ...credentials
-            })
-        });
-        const data = await response.json();
-        if (response.ok && data.success) {
-            // Se é OAuth, redireciona para URL fornecida
-            if (data.type === 'oauth' && data.redirectUrl) {
-                if (redirect && typeof window !== 'undefined') {
-                    window.location.href = data.redirectUrl;
-                }
-                return {
-                    ok: true,
-                    status: 200,
-                    url: data.redirectUrl
-                };
-            }
-            // Se é sessão (credentials), redireciona para callbackUrl
-            if (data.type === 'session') {
-                if (redirect && typeof window !== 'undefined') {
-                    window.location.href = callbackUrl || '/';
-                }
-                return {
-                    ok: true,
-                    status: 200,
-                    url: callbackUrl || '/'
-                };
-            }
-        }
-        else {
-            return {
-                error: data.error || 'Authentication failed',
-                status: response.status,
-                ok: false
-            };
-        }
-    }
-    catch (error) {
-        console.error('[vatts-auth] Error on signIn:', error);
-        return {
-            error: 'Network error',
-            status: 500,
-            ok: false
-        };
-    }
-}
-/**
- * Função para fazer logout (similar ao NextAuth signOut)
- */
-async function signOut(options = {}) {
-    try {
-        await fetch(`${basePath}/signout`, {
-            method: 'POST',
-            credentials: 'include'
-        });
-        if (typeof window !== 'undefined') {
-            window.location.href = options.callbackUrl || '/';
-        }
-    }
-    catch (error) {
-        console.error('[vatts-auth] Error on signOut:', error);
-    }
-}