Implement authentication and RBAC

middleware.ts

@@ -0,0 +1,25 @@
+import { NextResponse } from "next/server";
+
+import { auth } from "@/lib/auth";
+
+const protectedRoutes = ["/dashboard", "/capture"];
+
+export default auth((req) => {
+  const { nextUrl } = req;
+  const isProtected = protectedRoutes.some((path) =>
+    nextUrl.pathname.startsWith(path)
+  );
+
+  if (isProtected && !req.auth) {
+    const loginUrl = new URL("/login", nextUrl.origin);
+    const callbackUrl = `${nextUrl.pathname}${nextUrl.search}`;
+    loginUrl.searchParams.set("callbackUrl", callbackUrl);
+    return NextResponse.redirect(loginUrl);
+  }
+
+  return NextResponse.next();
+});
+
+export const config = {
+  matcher: ["/dashboard/:path*", "/capture/:path*"],
+};

package.json

@@ -20,10 +20,13 @@
     "@radix-ui/react-label": "^2.1.0",
     "@radix-ui/react-select": "^2.1.4",
     "@radix-ui/react-slot": "^1.1.2",
+    "@auth/prisma-adapter": "^1.0.13",
     "@prisma/client": "^5.20.0",
+    "bcryptjs": "^2.4.3",
     "class-variance-authority": "^0.7.0",
     "clsx": "^2.1.1",
     "lucide-react": "^0.469.0",
+    "next-auth": "^5.0.0-beta.25",
     "next": "15.1.2",
     "react": "19.0.0-rc.1",
     "react-dom": "19.0.0-rc.1",

src/app/api/auth/[...nextauth]/route.ts

@@ -0,0 +1 @@
+export { handlers as GET, handlers as POST } from "@/lib/auth";

src/app/api/auth/register/route.ts

@@ -0,0 +1,66 @@
+import { NextResponse } from "next/server";
+import bcrypt from "bcryptjs";
+import { Role } from "@prisma/client";
+import { z } from "zod";
+
+import prisma from "@/lib/db";
+
+const registerSchema = z.object({
+  email: z.string().email({ message: "E-mail inválido." }),
+  password: z
+    .string()
+    .min(8, { message: "A senha deve ter pelo menos 8 caracteres." })
+    .max(64, { message: "A senha deve ter no máximo 64 caracteres." }),
+  orgName: z
+    .string()
+    .min(2, { message: "Informe o nome da organização." })
+    .max(120, { message: "Nome da organização muito longo." }),
+});
+
+export async function POST(request: Request) {
+  try {
+    const body = await request.json();
+    const { email, password, orgName } = registerSchema.parse(body);
+
+    const existingUser = await prisma.user.findUnique({ where: { email } });
+
+    if (existingUser) {
+      return NextResponse.json(
+        { error: "E-mail já registrado." },
+        { status: 400 }
+      );
+    }
+
+    const passwordHash = await bcrypt.hash(password, 12);
+
+    const organization = await prisma.organization.create({
+      data: { name: orgName },
+    });
+
+    await prisma.user.create({
+      data: {
+        email,
+        passwordHash,
+        memberships: {
+          create: {
+            orgId: organization.id,
+            role: Role.ADMIN,
+          },
+        },
+      },
+    });
+
+    return NextResponse.json({ message: "Conta criada com sucesso." }, { status: 201 });
+  } catch (error) {
+    if (error instanceof z.ZodError) {
+      const message = error.issues[0]?.message ?? "Dados inválidos.";
+      return NextResponse.json({ error: message }, { status: 400 });
+    }
+
+    console.error("Erro ao registrar usuário", error);
+    return NextResponse.json(
+      { error: "Não foi possível criar a conta agora." },
+      { status: 500 }
+    );
+  }
+}

src/app/dashboard/page.tsx

@@ -0,0 +1,30 @@
+import { redirect } from "next/navigation";
+
+import { auth } from "@/lib/auth";
+
+export default async function DashboardPage() {
+  const session = await auth();
+
+  if (!session?.user) {
+    redirect("/login");
+  }
+
+  return (
+    <main className="mx-auto flex min-h-screen w-full max-w-4xl flex-col gap-6 px-4 py-12">
+      <header className="space-y-2">
+        <p className="text-sm text-muted-foreground">Painel</p>
+        <h1 className="text-3xl font-bold">Bem-vindo(a), {session.user.email}</h1>
+        <p className="text-muted-foreground">
+          Use este espaço para acompanhar planos, gravações e atividades geradas.
+        </p>
+      </header>
+      <section className="rounded-lg border bg-card p-6 shadow-sm">
+        <p className="text-sm text-muted-foreground">
+          Em breve você verá aqui os indicadores da sua organização {"("}
+          {session.user.orgId ?? "sem organização"}
+          {")"}. Perfil atual: {session.user.role ?? "sem papel"}.
+        </p>
+      </section>
+    </main>
+  );
+}

src/app/login/page.tsx

@@ -0,0 +1,93 @@
+"use client";
+
+import Link from "next/link";
+import { useRouter, useSearchParams } from "next/navigation";
+import { FormEvent, useState, useTransition } from "react";
+import { signIn } from "next-auth/react";
+
+import { Button } from "@/components/ui/button";
+import { Card, CardContent, CardDescription, CardHeader, CardTitle } from "@/components/ui/card";
+import { Input } from "@/components/ui/input";
+import { Label } from "@/components/ui/label";
+
+export default function LoginPage() {
+  const router = useRouter();
+  const searchParams = useSearchParams();
+  const [error, setError] = useState<string | null>(null);
+  const [isPending, startTransition] = useTransition();
+
+  const onSubmit = async (event: FormEvent<HTMLFormElement>) => {
+    event.preventDefault();
+    setError(null);
+
+    const formData = new FormData(event.currentTarget);
+    const email = (formData.get("email") as string) ?? "";
+    const password = (formData.get("password") as string) ?? "";
+    const callbackUrl = searchParams.get("callbackUrl") ?? "/dashboard";
+
+    startTransition(async () => {
+      const result = await signIn("credentials", {
+        email,
+        password,
+        redirect: false,
+        callbackUrl,
+      });
+
+      if (result?.error) {
+        setError("Não foi possível entrar. Confira suas credenciais.");
+        return;
+      }
+
+      router.push(result?.url ?? "/dashboard");
+    });
+  };
+
+  return (
+    <main className="mx-auto flex min-h-screen w-full max-w-lg items-center px-4 py-12">
+      <Card className="w-full">
+        <CardHeader>
+          <CardTitle>Entrar</CardTitle>
+          <CardDescription>
+            Use seu e-mail e senha para acessar o painel da organização.
+          </CardDescription>
+        </CardHeader>
+        <CardContent className="space-y-4">
+          <form className="space-y-4" onSubmit={onSubmit}>
+            <div className="space-y-2">
+              <Label htmlFor="email">E-mail</Label>
+              <Input
+                id="email"
+                name="email"
+                type="email"
+                autoComplete="email"
+                required
+                disabled={isPending}
+              />
+            </div>
+            <div className="space-y-2">
+              <Label htmlFor="password">Senha</Label>
+              <Input
+                id="password"
+                name="password"
+                type="password"
+                autoComplete="current-password"
+                required
+                disabled={isPending}
+              />
+            </div>
+            {error ? <p className="text-sm text-destructive">{error}</p> : null}
+            <Button className="w-full" type="submit" disabled={isPending}>
+              {isPending ? "Entrando..." : "Entrar"}
+            </Button>
+          </form>
+          <p className="text-sm text-muted-foreground">
+            Ainda não tem conta? {" "}
+            <Link className="underline" href="/register">
+              Cadastre-se
+            </Link>
+          </p>
+        </CardContent>
+      </Card>
+    </main>
+  );
+}

src/app/register/page.tsx

@@ -0,0 +1,108 @@
+"use client";
+
+import Link from "next/link";
+import { useRouter } from "next/navigation";
+import { FormEvent, useState, useTransition } from "react";
+
+import { Button } from "@/components/ui/button";
+import { Card, CardContent, CardDescription, CardHeader, CardTitle } from "@/components/ui/card";
+import { Input } from "@/components/ui/input";
+import { Label } from "@/components/ui/label";
+
+export default function RegisterPage() {
+  const router = useRouter();
+  const [message, setMessage] = useState<string | null>(null);
+  const [error, setError] = useState<string | null>(null);
+  const [isPending, startTransition] = useTransition();
+
+  const onSubmit = (event: FormEvent<HTMLFormElement>) => {
+    event.preventDefault();
+    setMessage(null);
+    setError(null);
+
+    const formData = new FormData(event.currentTarget);
+    const orgName = (formData.get("orgName") as string) ?? "";
+    const email = (formData.get("email") as string) ?? "";
+    const password = (formData.get("password") as string) ?? "";
+
+    startTransition(async () => {
+      const response = await fetch("/api/auth/register", {
+        method: "POST",
+        headers: { "Content-Type": "application/json" },
+        body: JSON.stringify({ orgName, email, password }),
+      });
+
+      const data = (await response.json()) as { message?: string; error?: string };
+
+      if (!response.ok) {
+        setError(data.error ?? "Não foi possível criar sua conta.");
+        return;
+      }
+
+      setMessage(data.message ?? "Conta criada com sucesso.");
+      setTimeout(() => router.push("/login"), 500);
+    });
+  };
+
+  return (
+    <main className="mx-auto flex min-h-screen w-full max-w-lg items-center px-4 py-12">
+      <Card className="w-full">
+        <CardHeader>
+          <CardTitle>Criar conta</CardTitle>
+          <CardDescription>
+            Cadastre sua organização e receba acesso ao painel administrativo.
+          </CardDescription>
+        </CardHeader>
+        <CardContent className="space-y-4">
+          <form className="space-y-4" onSubmit={onSubmit}>
+            <div className="space-y-2">
+              <Label htmlFor="orgName">Organização</Label>
+              <Input
+                id="orgName"
+                name="orgName"
+                placeholder="Escola, centro ou grupo"
+                required
+                disabled={isPending}
+              />
+            </div>
+            <div className="space-y-2">
+              <Label htmlFor="email">E-mail</Label>
+              <Input
+                id="email"
+                name="email"
+                type="email"
+                autoComplete="email"
+                required
+                disabled={isPending}
+              />
+            </div>
+            <div className="space-y-2">
+              <Label htmlFor="password">Senha</Label>
+              <Input
+                id="password"
+                name="password"
+                type="password"
+                autoComplete="new-password"
+                minLength={8}
+                maxLength={64}
+                required
+                disabled={isPending}
+              />
+            </div>
+            {error ? <p className="text-sm text-destructive">{error}</p> : null}
+            {message ? <p className="text-sm text-green-600">{message}</p> : null}
+            <Button className="w-full" type="submit" disabled={isPending}>
+              {isPending ? "Criando conta..." : "Registrar"}
+            </Button>
+          </form>
+          <p className="text-sm text-muted-foreground">
+            Já tem acesso? {" "}
+            <Link className="underline" href="/login">
+              Entre aqui
+            </Link>
+          </p>
+        </CardContent>
+      </Card>
+    </main>
+  );
+}

src/lib/auth.ts

@@ -0,0 +1,96 @@
+import type { NextAuthConfig } from "next-auth";
+import NextAuth from "next-auth";
+import Credentials from "next-auth/providers/credentials";
+import { PrismaAdapter } from "@auth/prisma-adapter";
+import bcrypt from "bcryptjs";
+import { Role } from "@prisma/client";
+
+import prisma from "@/lib/db";
+
+export const authOptions = {
+  adapter: PrismaAdapter(prisma),
+  session: { strategy: "jwt" },
+  pages: { signIn: "/login" },
+  providers: [
+    Credentials({
+      name: "Credenciais",
+      credentials: {
+        email: { label: "E-mail", type: "email" },
+        password: { label: "Senha", type: "password" },
+      },
+      async authorize(credentials) {
+        if (!credentials?.email || !credentials?.password) {
+          return null;
+        }
+
+        const user = await prisma.user.findUnique({
+          where: { email: credentials.email },
+        });
+
+        if (!user) {
+          return null;
+        }
+
+        const passwordMatch = await bcrypt.compare(
+          credentials.password,
+          user.passwordHash
+        );
+
+        if (!passwordMatch) {
+          return null;
+        }
+
+        const membership = await prisma.membership.findFirst({
+          where: { userId: user.id },
+          orderBy: { createdAt: "asc" },
+        });
+
+        return {
+          id: user.id,
+          email: user.email,
+          orgId: membership?.orgId ?? null,
+          role: membership?.role ?? null,
+        } satisfies {
+          id: string;
+          email: string;
+          orgId: string | null;
+          role: Role | null;
+        };
+      },
+    }),
+  ],
+  callbacks: {
+    async jwt({ token, user }) {
+      if (user) {
+        token.userId = user.id;
+        token.orgId = (user as { orgId?: string | null }).orgId ?? null;
+        token.role = (user as { role?: Role | null }).role ?? null;
+      }
+
+      if (token.userId && (!token.orgId || !token.role)) {
+        const membership = await prisma.membership.findFirst({
+          where: { userId: token.userId as string },
+          orderBy: { createdAt: "asc" },
+        });
+
+        token.orgId = membership?.orgId ?? null;
+        token.role = membership?.role ?? null;
+      }
+
+      return token;
+    },
+    async session({ session, token }) {
+      if (session.user) {
+        session.user.id = token.userId as string;
+        session.user.orgId = (token.orgId as string | null) ?? null;
+        session.user.role = (token.role as Role | null) ?? null;
+      }
+
+      return session;
+    },
+  },
+  secret: process.env.AUTH_SECRET,
+  trustHost: true,
+} satisfies NextAuthConfig;
+
+export const { handlers, auth, signIn, signOut } = NextAuth(authOptions);

src/lib/rbac.ts

@@ -0,0 +1,14 @@
+import { Role } from "@prisma/client";
+import { Session } from "next-auth";
+
+export function requireRole(session: Session | null, roles: Role[]) {
+  if (!session?.user?.role) {
+    throw new Error("Usuário sem sessão ativa.");
+  }
+
+  if (!roles.includes(session.user.role)) {
+    throw new Error("Acesso negado para este perfil.");
+  }
+
+  return true;
+}

src/types/next-auth.d.ts

@@ -0,0 +1,28 @@
+import { Role } from "@prisma/client";
+import NextAuth from "next-auth";
+
+declare module "next-auth" {
+  interface Session {
+    user?: {
+      id: string;
+      email?: string | null;
+      orgId: string | null;
+      role: Role | null;
+    };
+  }
+
+  interface User {
+    id: string;
+    email?: string | null;
+    orgId?: string | null;
+    role?: Role | null;
+  }
+}
+
+declare module "next-auth/jwt" {
+  interface JWT {
+    userId?: string;
+    orgId?: string | null;
+    role?: Role | null;
+  }
+}