@vegait/accounts-sdk 0.1.0-beta.0

package/README.md

@@ -0,0 +1,25 @@
+# @vegait/accounts-sdk
+
+Cola de integracao frontend do Accounts: persona, catalogo de produtos VEGA,
+tipos de claims e o adapter da casca de identidade (`buildIdentityModel`).
+Puro TS — sem React, sem dependencia do design system.
+
+## Uso
+
+```ts
+import { buildIdentityModel, decodeAccessToken } from "@vegait/accounts-sdk";
+
+const claims = decodeAccessToken(accessToken);
+const model = buildIdentityModel(claims, {
+  currentProductCode: "accounts",
+  urls: { "media-hub": mediaHubUrl }, // o host resolve o env; o SDK nunca toca process.env
+});
+// host mapeia `model` -> props da IdentityBar do @vegait/lyra-ds-v2
+```
+
+## ⚠️ Seguranca: `derivePersona` NAO e autorizacao
+
+`derivePersona` e o `IdentityModel` servem para **gating de apresentacao**
+(o que mostrar/esconder na UI). **Nunca** os use como controle de acesso.
+A autorizacao real e feita **server-side** (scopes/claims OIDC, RBAC+ABAC no
+`accounts.api`). Gating de UI e defense-in-depth, nunca o unico controle.

package/dist/index.cjs

@@ -0,0 +1,216 @@
+"use strict";
+var __defProp = Object.defineProperty;
+var __getOwnPropDesc = Object.getOwnPropertyDescriptor;
+var __getOwnPropNames = Object.getOwnPropertyNames;
+var __hasOwnProp = Object.prototype.hasOwnProperty;
+var __export = (target, all) => {
+  for (var name in all)
+    __defProp(target, name, { get: all[name], enumerable: true });
+};
+var __copyProps = (to, from, except, desc) => {
+  if (from && typeof from === "object" || typeof from === "function") {
+    for (let key of __getOwnPropNames(from))
+      if (!__hasOwnProp.call(to, key) && key !== except)
+        __defProp(to, key, { get: () => from[key], enumerable: !(desc = __getOwnPropDesc(from, key)) || desc.enumerable });
+  }
+  return to;
+};
+var __toCommonJS = (mod) => __copyProps(__defProp({}, "__esModule", { value: true }), mod);
+
+// src/index.ts
+var index_exports = {};
+__export(index_exports, {
+  PRODUCT_CATALOG: () => PRODUCT_CATALOG,
+  buildIdentityModel: () => buildIdentityModel,
+  decodeAccessToken: () => decodeAccessToken,
+  decodeJwtPayload: () => decodeJwtPayload,
+  derivePersona: () => derivePersona,
+  getAccessibleProducts: () => getAccessibleProducts,
+  getCatalogWithAccess: () => getCatalogWithAccess,
+  normalizeClaimArray: () => normalizeClaimArray,
+  parseJsonArrayClaim: () => parseJsonArrayClaim,
+  resolveProduct: () => resolveProduct
+});
+module.exports = __toCommonJS(index_exports);
+
+// src/claims.ts
+function decodeJwtPayload(token) {
+  const parts = token.split(".");
+  if (parts.length !== 3) {
+    throw new Error("Invalid JWT format");
+  }
+  const payload = parts[1].replace(/-/g, "+").replace(/_/g, "/");
+  const padded = payload + "=".repeat((4 - payload.length % 4) % 4);
+  const binary = atob(padded);
+  const bytes = new Uint8Array(binary.length);
+  for (let i = 0; i < binary.length; i++) {
+    bytes[i] = binary.charCodeAt(i);
+  }
+  const json = new TextDecoder("utf-8").decode(bytes);
+  return JSON.parse(json);
+}
+function normalizeClaimArray(value) {
+  if (!value) return [];
+  return Array.isArray(value) ? value : [value];
+}
+function parseJsonArrayClaim(value) {
+  if (!value) return [];
+  try {
+    const parsed = JSON.parse(value);
+    return Array.isArray(parsed) ? parsed.filter((v) => typeof v === "string") : [];
+  } catch {
+    return [];
+  }
+}
+function decodeAccessToken(token) {
+  if (!token) return null;
+  try {
+    return decodeJwtPayload(token);
+  } catch {
+    return null;
+  }
+}
+
+// src/persona.ts
+function derivePersona(claims) {
+  if (claims?.platform_role) return "vega";
+  if (claims?.can_manage_scope_members === "true") return "gestor";
+  return "usuario";
+}
+
+// src/productCatalog.ts
+var PRODUCT_CATALOG = {
+  accounts: {
+    code: "accounts",
+    name: "Accounts",
+    description: "Identidade unificada do ecossistema",
+    url: "/",
+    accent: "#1F2E52",
+    ssoEnabled: true
+    // e o proprio IdP; excluido da gaveta de qualquer forma
+  },
+  "media-hub": {
+    code: "media-hub",
+    name: "Media Hub",
+    description: "Sinalizacao digital nas unidades",
+    url: "https://media-hub.vega.com.br/",
+    accent: "#EF802D",
+    ssoEnabled: true
+  },
+  sig: {
+    code: "sig",
+    name: "SIG",
+    description: "Housekeeping e governanca das unidades",
+    url: "https://sig.app.vegait.com/",
+    accent: "#B0C925",
+    ssoEnabled: true
+  },
+  gdi: {
+    code: "gdi",
+    name: "GDI",
+    description: "Gestao de dispositivos e internet",
+    url: "https://gdi.vega.com.br/",
+    accent: "#7B8B7E",
+    ssoEnabled: false
+  },
+  sim: {
+    code: "sim",
+    name: "SIM",
+    description: "Service Issue Management",
+    url: "https://sim.vega.com.br/",
+    accent: "#5B7DB1",
+    ssoEnabled: false
+  },
+  hxp: {
+    code: "hxp",
+    name: "HXP",
+    description: "Hotel Experience Platform",
+    url: "https://hxp.vega.com.br/",
+    accent: "#9B6A4F",
+    ssoEnabled: false
+  },
+  feedback: {
+    code: "feedback",
+    name: "Feedback",
+    description: "Pesquisas e NPS de hospedes",
+    url: "https://feedback.vega.com.br/",
+    accent: "#C26A8C",
+    ssoEnabled: false
+  },
+  behavior: {
+    code: "behavior",
+    name: "Behavior",
+    description: "Inteligencia comportamental",
+    url: "https://behavior.vega.com.br/",
+    accent: "#4A7C7E",
+    ssoEnabled: false
+  }
+};
+var LEGACY_CODE_ALIASES = {
+  governanca: "sig"
+};
+function resolveProduct(code, urls) {
+  const canonical = LEGACY_CODE_ALIASES[code] ?? code;
+  const base = PRODUCT_CATALOG[canonical] ?? {
+    code,
+    name: code,
+    description: "",
+    url: "#",
+    accent: "#1F2E52",
+    ssoEnabled: false
+  };
+  const override = urls?.[canonical];
+  return override ? { ...base, url: override } : base;
+}
+function getCatalogWithAccess(claims, opts) {
+  const urls = opts?.urls;
+  const isVega = claims != null && derivePersona(claims) === "vega";
+  const accessibleCodes = new Set(
+    parseJsonArrayClaim(claims?.products).map(
+      (code) => LEGACY_CODE_ALIASES[code] ?? code
+    )
+  );
+  return Object.values(PRODUCT_CATALOG).filter((p) => p.code !== "accounts").map((p) => ({
+    ...urls?.[p.code] ? { ...p, url: urls[p.code] } : p,
+    accessible: isVega || accessibleCodes.has(p.code)
+  }));
+}
+function getAccessibleProducts(claims, opts) {
+  if (!claims) return [];
+  const urls = opts?.urls;
+  if (derivePersona(claims) === "vega") {
+    return Object.values(PRODUCT_CATALOG).filter((p) => p.code !== "accounts" && p.ssoEnabled).map((p) => urls?.[p.code] ? { ...p, url: urls[p.code] } : p);
+  }
+  return parseJsonArrayClaim(claims.products).map((code) => resolveProduct(code, urls)).filter((p) => p.ssoEnabled);
+}
+
+// src/identityModel.ts
+function buildIdentityModel(claims, cfg) {
+  const persona = derivePersona(claims);
+  return {
+    persona,
+    user: { name: claims?.name ?? "", email: claims?.email ?? "" },
+    products: getAccessibleProducts(claims, { urls: cfg?.urls }),
+    catalog: getCatalogWithAccess(claims, { urls: cfg?.urls }),
+    currentProductCode: cfg?.currentProductCode,
+    capabilities: {
+      manageUsers: persona === "gestor" || persona === "vega",
+      adminConsole: persona === "vega",
+      switchContext: persona === "gestor" || persona === "vega",
+      manageNetwork: persona === "gestor"
+    }
+  };
+}
+// Annotate the CommonJS export names for ESM import in node:
+0 && (module.exports = {
+  PRODUCT_CATALOG,
+  buildIdentityModel,
+  decodeAccessToken,
+  decodeJwtPayload,
+  derivePersona,
+  getAccessibleProducts,
+  getCatalogWithAccess,
+  normalizeClaimArray,
+  parseJsonArrayClaim,
+  resolveProduct
+});

package/dist/index.d.cts

@@ -0,0 +1,68 @@
+declare function decodeJwtPayload<T = Record<string, unknown>>(token: string): T;
+type AccountsClaims = {
+    sub?: string;
+    email?: string;
+    name?: string;
+    platform_role?: string;
+    can_manage_scope_members?: string;
+    org_id?: string | string[];
+    unit_ids?: string;
+    active_unit_id?: string;
+    products?: string;
+    exp?: number;
+    iat?: number;
+    iss?: string;
+    aud?: string | string[];
+};
+declare function normalizeClaimArray(value: string | string[] | undefined): string[];
+declare function parseJsonArrayClaim(value: string | undefined): string[];
+declare function decodeAccessToken(token: string | null | undefined): AccountsClaims | null;
+
+type Persona = "usuario" | "gestor" | "vega";
+declare function derivePersona(claims: AccountsClaims | null): Persona;
+
+type ProductMeta = {
+    code: string;
+    name: string;
+    description: string;
+    url: string;
+    accent: string;
+    ssoEnabled: boolean;
+};
+declare const PRODUCT_CATALOG: Record<string, ProductMeta>;
+declare function resolveProduct(code: string, urls?: Record<string, string>): ProductMeta;
+type CatalogProduct = ProductMeta & {
+    accessible: boolean;
+};
+declare function getCatalogWithAccess(claims: AccountsClaims | null, opts?: {
+    urls?: Record<string, string>;
+}): CatalogProduct[];
+declare function getAccessibleProducts(claims: AccountsClaims | null, opts?: {
+    urls?: Record<string, string>;
+}): ProductMeta[];
+
+type IdentityModel = {
+    persona: Persona;
+    user: {
+        name: string;
+        email: string;
+    };
+    products: ProductMeta[];
+    /** Catalogo completo (menos Accounts) com flag de acesso — pro waffle
+     *  mostrar tudo e desabilitar o que a persona nao acessa. `products`
+     *  permanece so-acessiveis por retrocompat (SIG consome hoje). */
+    catalog: CatalogProduct[];
+    currentProductCode?: string;
+    capabilities: {
+        manageUsers: boolean;
+        adminConsole: boolean;
+        switchContext: boolean;
+        manageNetwork: boolean;
+    };
+};
+declare function buildIdentityModel(claims: AccountsClaims | null, cfg?: {
+    currentProductCode?: string;
+    urls?: Record<string, string>;
+}): IdentityModel;
+
+export { type AccountsClaims, type CatalogProduct, type IdentityModel, PRODUCT_CATALOG, type Persona, type ProductMeta, buildIdentityModel, decodeAccessToken, decodeJwtPayload, derivePersona, getAccessibleProducts, getCatalogWithAccess, normalizeClaimArray, parseJsonArrayClaim, resolveProduct };

package/dist/index.d.ts

@@ -0,0 +1,68 @@
+declare function decodeJwtPayload<T = Record<string, unknown>>(token: string): T;
+type AccountsClaims = {
+    sub?: string;
+    email?: string;
+    name?: string;
+    platform_role?: string;
+    can_manage_scope_members?: string;
+    org_id?: string | string[];
+    unit_ids?: string;
+    active_unit_id?: string;
+    products?: string;
+    exp?: number;
+    iat?: number;
+    iss?: string;
+    aud?: string | string[];
+};
+declare function normalizeClaimArray(value: string | string[] | undefined): string[];
+declare function parseJsonArrayClaim(value: string | undefined): string[];
+declare function decodeAccessToken(token: string | null | undefined): AccountsClaims | null;
+
+type Persona = "usuario" | "gestor" | "vega";
+declare function derivePersona(claims: AccountsClaims | null): Persona;
+
+type ProductMeta = {
+    code: string;
+    name: string;
+    description: string;
+    url: string;
+    accent: string;
+    ssoEnabled: boolean;
+};
+declare const PRODUCT_CATALOG: Record<string, ProductMeta>;
+declare function resolveProduct(code: string, urls?: Record<string, string>): ProductMeta;
+type CatalogProduct = ProductMeta & {
+    accessible: boolean;
+};
+declare function getCatalogWithAccess(claims: AccountsClaims | null, opts?: {
+    urls?: Record<string, string>;
+}): CatalogProduct[];
+declare function getAccessibleProducts(claims: AccountsClaims | null, opts?: {
+    urls?: Record<string, string>;
+}): ProductMeta[];
+
+type IdentityModel = {
+    persona: Persona;
+    user: {
+        name: string;
+        email: string;
+    };
+    products: ProductMeta[];
+    /** Catalogo completo (menos Accounts) com flag de acesso — pro waffle
+     *  mostrar tudo e desabilitar o que a persona nao acessa. `products`
+     *  permanece so-acessiveis por retrocompat (SIG consome hoje). */
+    catalog: CatalogProduct[];
+    currentProductCode?: string;
+    capabilities: {
+        manageUsers: boolean;
+        adminConsole: boolean;
+        switchContext: boolean;
+        manageNetwork: boolean;
+    };
+};
+declare function buildIdentityModel(claims: AccountsClaims | null, cfg?: {
+    currentProductCode?: string;
+    urls?: Record<string, string>;
+}): IdentityModel;
+
+export { type AccountsClaims, type CatalogProduct, type IdentityModel, PRODUCT_CATALOG, type Persona, type ProductMeta, buildIdentityModel, decodeAccessToken, decodeJwtPayload, derivePersona, getAccessibleProducts, getCatalogWithAccess, normalizeClaimArray, parseJsonArrayClaim, resolveProduct };

package/dist/index.js

@@ -0,0 +1,180 @@
+// src/claims.ts
+function decodeJwtPayload(token) {
+  const parts = token.split(".");
+  if (parts.length !== 3) {
+    throw new Error("Invalid JWT format");
+  }
+  const payload = parts[1].replace(/-/g, "+").replace(/_/g, "/");
+  const padded = payload + "=".repeat((4 - payload.length % 4) % 4);
+  const binary = atob(padded);
+  const bytes = new Uint8Array(binary.length);
+  for (let i = 0; i < binary.length; i++) {
+    bytes[i] = binary.charCodeAt(i);
+  }
+  const json = new TextDecoder("utf-8").decode(bytes);
+  return JSON.parse(json);
+}
+function normalizeClaimArray(value) {
+  if (!value) return [];
+  return Array.isArray(value) ? value : [value];
+}
+function parseJsonArrayClaim(value) {
+  if (!value) return [];
+  try {
+    const parsed = JSON.parse(value);
+    return Array.isArray(parsed) ? parsed.filter((v) => typeof v === "string") : [];
+  } catch {
+    return [];
+  }
+}
+function decodeAccessToken(token) {
+  if (!token) return null;
+  try {
+    return decodeJwtPayload(token);
+  } catch {
+    return null;
+  }
+}
+
+// src/persona.ts
+function derivePersona(claims) {
+  if (claims?.platform_role) return "vega";
+  if (claims?.can_manage_scope_members === "true") return "gestor";
+  return "usuario";
+}
+
+// src/productCatalog.ts
+var PRODUCT_CATALOG = {
+  accounts: {
+    code: "accounts",
+    name: "Accounts",
+    description: "Identidade unificada do ecossistema",
+    url: "/",
+    accent: "#1F2E52",
+    ssoEnabled: true
+    // e o proprio IdP; excluido da gaveta de qualquer forma
+  },
+  "media-hub": {
+    code: "media-hub",
+    name: "Media Hub",
+    description: "Sinalizacao digital nas unidades",
+    url: "https://media-hub.vega.com.br/",
+    accent: "#EF802D",
+    ssoEnabled: true
+  },
+  sig: {
+    code: "sig",
+    name: "SIG",
+    description: "Housekeeping e governanca das unidades",
+    url: "https://sig.app.vegait.com/",
+    accent: "#B0C925",
+    ssoEnabled: true
+  },
+  gdi: {
+    code: "gdi",
+    name: "GDI",
+    description: "Gestao de dispositivos e internet",
+    url: "https://gdi.vega.com.br/",
+    accent: "#7B8B7E",
+    ssoEnabled: false
+  },
+  sim: {
+    code: "sim",
+    name: "SIM",
+    description: "Service Issue Management",
+    url: "https://sim.vega.com.br/",
+    accent: "#5B7DB1",
+    ssoEnabled: false
+  },
+  hxp: {
+    code: "hxp",
+    name: "HXP",
+    description: "Hotel Experience Platform",
+    url: "https://hxp.vega.com.br/",
+    accent: "#9B6A4F",
+    ssoEnabled: false
+  },
+  feedback: {
+    code: "feedback",
+    name: "Feedback",
+    description: "Pesquisas e NPS de hospedes",
+    url: "https://feedback.vega.com.br/",
+    accent: "#C26A8C",
+    ssoEnabled: false
+  },
+  behavior: {
+    code: "behavior",
+    name: "Behavior",
+    description: "Inteligencia comportamental",
+    url: "https://behavior.vega.com.br/",
+    accent: "#4A7C7E",
+    ssoEnabled: false
+  }
+};
+var LEGACY_CODE_ALIASES = {
+  governanca: "sig"
+};
+function resolveProduct(code, urls) {
+  const canonical = LEGACY_CODE_ALIASES[code] ?? code;
+  const base = PRODUCT_CATALOG[canonical] ?? {
+    code,
+    name: code,
+    description: "",
+    url: "#",
+    accent: "#1F2E52",
+    ssoEnabled: false
+  };
+  const override = urls?.[canonical];
+  return override ? { ...base, url: override } : base;
+}
+function getCatalogWithAccess(claims, opts) {
+  const urls = opts?.urls;
+  const isVega = claims != null && derivePersona(claims) === "vega";
+  const accessibleCodes = new Set(
+    parseJsonArrayClaim(claims?.products).map(
+      (code) => LEGACY_CODE_ALIASES[code] ?? code
+    )
+  );
+  return Object.values(PRODUCT_CATALOG).filter((p) => p.code !== "accounts").map((p) => ({
+    ...urls?.[p.code] ? { ...p, url: urls[p.code] } : p,
+    accessible: isVega || accessibleCodes.has(p.code)
+  }));
+}
+function getAccessibleProducts(claims, opts) {
+  if (!claims) return [];
+  const urls = opts?.urls;
+  if (derivePersona(claims) === "vega") {
+    return Object.values(PRODUCT_CATALOG).filter((p) => p.code !== "accounts" && p.ssoEnabled).map((p) => urls?.[p.code] ? { ...p, url: urls[p.code] } : p);
+  }
+  return parseJsonArrayClaim(claims.products).map((code) => resolveProduct(code, urls)).filter((p) => p.ssoEnabled);
+}
+
+// src/identityModel.ts
+function buildIdentityModel(claims, cfg) {
+  const persona = derivePersona(claims);
+  return {
+    persona,
+    user: { name: claims?.name ?? "", email: claims?.email ?? "" },
+    products: getAccessibleProducts(claims, { urls: cfg?.urls }),
+    catalog: getCatalogWithAccess(claims, { urls: cfg?.urls }),
+    currentProductCode: cfg?.currentProductCode,
+    capabilities: {
+      manageUsers: persona === "gestor" || persona === "vega",
+      adminConsole: persona === "vega",
+      switchContext: persona === "gestor" || persona === "vega",
+      manageNetwork: persona === "gestor"
+    }
+  };
+}
+export {
+  PRODUCT_CATALOG,
+  buildIdentityModel,
+  decodeAccessToken,
+  decodeJwtPayload,
+  derivePersona,
+  getAccessibleProducts,
+  getCatalogWithAccess,
+  normalizeClaimArray,
+  parseJsonArrayClaim,
+  resolveProduct
+};

package/package.json

@@ -0,0 +1,35 @@
+{
+  "name": "@vegait/accounts-sdk",
+  "version": "0.1.0-beta.0",
+  "publishConfig": {
+    "access": "public",
+    "tag": "beta"
+  },
+  "description": "Cola de integracao frontend do Accounts (persona, catalogo de produtos, adapter da casca de identidade).",
+  "type": "module",
+  "main": "./dist/index.cjs",
+  "module": "./dist/index.js",
+  "types": "./dist/index.d.ts",
+  "exports": {
+    ".": {
+      "types": "./dist/index.d.ts",
+      "import": "./dist/index.js",
+      "require": "./dist/index.cjs"
+    }
+  },
+  "files": [
+    "dist"
+  ],
+  "sideEffects": false,
+  "scripts": {
+    "build": "tsup",
+    "prepublishOnly": "tsup",
+    "test": "vitest run",
+    "typecheck": "tsc --noEmit"
+  },
+  "devDependencies": {
+    "tsup": "^8.0.0",
+    "typescript": "^5.4.0",
+    "vitest": "^2.0.0"
+  }
+}