# API token examples

## Fluxo

1. Login retorna `token` e `refresh_token`.
2. Use `Authorization: Bearer <token>` nas rotas protegidas.
3. Quando receber `401 Token expirado`, chame `/api/auth/refresh`.
4. Substitua os dois valores salvos: `token` e `refresh_token`.

## Next.js

```ts
const API_URL = process.env.NEXT_PUBLIC_SUPERLEGIS_API_URL!;

export async function loginGed(tenant: string, email: string, password: string) {
  const response = await fetch(`${API_URL}/api/ged/v1/loginGed`, {
    method: "POST",
    headers: {
      "Content-Type": "application/json",
      "X-Tenant": tenant,
    },
    body: JSON.stringify({ tenant, email, password }),
  });

  if (!response.ok) throw new Error("Login failed");

  const data = await response.json();
  localStorage.setItem("superlegis_token", data.token);
  localStorage.setItem("superlegis_refresh_token", data.refresh_token);
  localStorage.setItem("superlegis_tenant", tenant);
  return data;
}

export async function apiFetch(path: string, init: RequestInit = {}) {
  const tenant = localStorage.getItem("superlegis_tenant")!;
  let token = localStorage.getItem("superlegis_token")!;

  let response = await fetch(`${API_URL}${path}`, {
    ...init,
    headers: {
      ...(init.headers || {}),
      "Content-Type": "application/json",
      "X-Tenant": tenant,
      Authorization: `Bearer ${token}`,
    },
  });

  if (response.status !== 401) return response;

  const refreshResponse = await fetch(`${API_URL}/api/auth/refresh`, {
    method: "POST",
    headers: {
      "Content-Type": "application/json",
      "X-Tenant": tenant,
    },
    body: JSON.stringify({
      refresh_token: localStorage.getItem("superlegis_refresh_token"),
    }),
  });

  if (!refreshResponse.ok) throw new Error("Session expired");

  const refreshed = await refreshResponse.json();
  localStorage.setItem("superlegis_token", refreshed.token);
  localStorage.setItem("superlegis_refresh_token", refreshed.refresh_token);
  token = refreshed.token;

  return fetch(`${API_URL}${path}`, {
    ...init,
    headers: {
      ...(init.headers || {}),
      "Content-Type": "application/json",
      "X-Tenant": tenant,
      Authorization: `Bearer ${token}`,
    },
  });
}
```

## React Native

Use `expo-secure-store` ou Keychain/Keystore equivalente. Nao salve refresh token em AsyncStorage.

```ts
import * as SecureStore from "expo-secure-store";

const API_URL = "https://seu-dominio.com.br";

export async function loginGed(tenant: string, email: string, password: string) {
  const response = await fetch(`${API_URL}/api/ged/v1/loginGed`, {
    method: "POST",
    headers: {
      "Content-Type": "application/json",
      "X-Tenant": tenant,
    },
    body: JSON.stringify({ tenant, email, password }),
  });

  if (!response.ok) throw new Error("Login failed");

  const data = await response.json();
  await SecureStore.setItemAsync("superlegis_token", data.token);
  await SecureStore.setItemAsync("superlegis_refresh_token", data.refresh_token);
  await SecureStore.setItemAsync("superlegis_tenant", tenant);
  return data;
}

async function refreshToken() {
  const tenant = await SecureStore.getItemAsync("superlegis_tenant");
  const refreshToken = await SecureStore.getItemAsync("superlegis_refresh_token");

  const response = await fetch(`${API_URL}/api/auth/refresh`, {
    method: "POST",
    headers: {
      "Content-Type": "application/json",
      "X-Tenant": tenant || "",
    },
    body: JSON.stringify({ refresh_token: refreshToken }),
  });

  if (!response.ok) throw new Error("Session expired");

  const data = await response.json();
  await SecureStore.setItemAsync("superlegis_token", data.token);
  await SecureStore.setItemAsync("superlegis_refresh_token", data.refresh_token);
  return data.token;
}

export async function apiFetch(path: string, init: RequestInit = {}) {
  const tenant = await SecureStore.getItemAsync("superlegis_tenant");
  let token = await SecureStore.getItemAsync("superlegis_token");

  let response = await fetch(`${API_URL}${path}`, {
    ...init,
    headers: {
      ...(init.headers || {}),
      "Content-Type": "application/json",
      "X-Tenant": tenant || "",
      Authorization: `Bearer ${token}`,
    },
  });

  if (response.status !== 401) return response;

  token = await refreshToken();

  return fetch(`${API_URL}${path}`, {
    ...init,
    headers: {
      ...(init.headers || {}),
      "Content-Type": "application/json",
      "X-Tenant": tenant || "",
      Authorization: `Bearer ${token}`,
    },
  });
}
```