Documentação

# .env.local
GATE_URL=http://localhost:3011
NEXT_PUBLIC_GATE_URL=http://localhost:3011

// lib/gate.ts
// eximIA Gate integration — contract v1
// Troque APP_SLUG pelo slug do seu app registrado no Gate

const GATE_URL = process.env.GATE_URL || process.env.NEXT_PUBLIC_GATE_URL || "http://localhost:3011";
const APP_SLUG = "YOUR_APP_SLUG"; // ← TROCAR: academy, forms, profiler, etc.

// ─── Types ───

export interface GateUser {
  id: string;
  email: string;
  name: string;
  role: "user" | "admin";
  avatar_url: string | null;
  apps: string[];
  created_at: string;
}

export interface AuthResponse {
  token: string;
  refresh_token: string;
  user: GateUser;
}

export interface VerifyResponse {
  user: GateUser;
  scopes: string[];
  apps_allowed: string[];
}

// ─── Client-side: Auth actions ───

export async function gateLogin(email: string, password: string): Promise<AuthResponse> {
  const res = await fetch(`${GATE_URL}/api/v1/gate/login`, {
    method: "POST",
    headers: { "Content-Type": "application/json" },
    body: JSON.stringify({ email, password }),
  });
  const data = await res.json();
  if (!res.ok) throw new Error(data.error || "Login failed");
  return data;
}

export async function gateRegister(name: string, email: string, password: string): Promise<AuthResponse> {
  const res = await fetch(`${GATE_URL}/api/v1/gate/register`, {
    method: "POST",
    headers: { "Content-Type": "application/json" },
    body: JSON.stringify({ name, email, password }),
  });
  const data = await res.json();
  if (!res.ok) throw new Error(data.error || "Registration failed");
  return data;
}

export async function gateRefresh(refresh_token: string): Promise<{ token: string; refresh_token: string }> {
  const res = await fetch(`${GATE_URL}/api/v1/gate/refresh`, {
    method: "POST",
    headers: { "Content-Type": "application/json" },
    body: JSON.stringify({ refresh_token }),
  });
  const data = await res.json();
  if (!res.ok) throw new Error(data.error || "Refresh failed");
  return data;
}

// ─── Client-side: Token management (localStorage) ───

export function saveAuth(data: AuthResponse): void {
  localStorage.setItem("gate_token", data.token);
  localStorage.setItem("gate_refresh", data.refresh_token);
  localStorage.setItem("gate_user", JSON.stringify(data.user));
}

export function getToken(): string | null {
  if (typeof window === "undefined") return null;
  return localStorage.getItem("gate_token");
}

export function getUser(): GateUser | null {
  if (typeof window === "undefined") return null;
  const raw = localStorage.getItem("gate_user");
  return raw ? JSON.parse(raw) : null;
}

export function isAuthenticated(): boolean {
  return !!getToken();
}

export function logout(): void {
  localStorage.removeItem("gate_token");
  localStorage.removeItem("gate_refresh");
  localStorage.removeItem("gate_user");
}

export async function getValidToken(): Promise<string | null> {
  const token = getToken();
  if (!token) return null;
  try {
    const payload = JSON.parse(atob(token.split(".")[1]));
    const expiresIn = payload.exp * 1000 - Date.now();
    if (expiresIn < 5 * 60 * 1000) {
      const refresh = localStorage.getItem("gate_refresh");
      if (!refresh) return null;
      try {
        const data = await gateRefresh(refresh);
        localStorage.setItem("gate_token", data.token);
        localStorage.setItem("gate_refresh", data.refresh_token);
        return data.token;
      } catch {
        logout();
        return null;
      }
    }
    return token;
  } catch {
    return token;
  }
}

// ─── Server-side: Protect API routes ───

export async function withGateAuth(req: Request): Promise<
  { user: VerifyResponse["user"]; scopes: string[]; error?: never } |
  { user?: never; scopes?: never; error: Response }
> {
  const authHeader = req.headers.get("authorization");
  if (!authHeader?.startsWith("Bearer ")) {
    return { error: Response.json({ error: "Missing authorization", code: "UNAUTHORIZED" }, { status: 401 }) };
  }
  try {
    const res = await fetch(`${GATE_URL}/api/v1/gate/verify`, {
      method: "POST",
      headers: { "Content-Type": "application/json" },
      body: JSON.stringify({ token: authHeader.slice(7) }),
      signal: AbortSignal.timeout(5000),
    });
    if (!res.ok) {
      return { error: Response.json({ error: "Invalid token", code: "INVALID_TOKEN" }, { status: 401 }) };
    }
    const data: VerifyResponse = await res.json();
    if (!data.apps_allowed.includes(APP_SLUG)) {
      return { error: Response.json({ error: "No access to this app", code: "APP_ACCESS_DENIED" }, { status: 403 }) };
    }
    return { user: data.user, scopes: data.scopes };
  } catch {
    return { error: Response.json({ error: "Gate unavailable", code: "GATE_UNAVAILABLE" }, { status: 503 }) };
  }
}