Autenticação e Segurança

import axios from 'axios';

// Configurar interceptor para adicionar token
axios.interceptors.request.use(
  config => {
    const token = localStorage.getItem('access_token');
    if (token) {
      config.headers.Authorization = `Bearer ${token}`;
    }
    return config;
  },
  error => Promise.reject(error)
);

// Interceptor para renovar token automaticamente
axios.interceptors.response.use(
  response => response,
  async error => {
    const originalRequest = error.config;
    
    if (error.response?.status === 401 && !originalRequest._retry) {
      originalRequest._retry = true;
      
      try {
        const refreshToken = localStorage.getItem('refresh_token');
        const response = await axios.post('/auth/refresh', {
          refresh_token: refreshToken
        });
        
        const { access_token } = response.data;
        localStorage.setItem('access_token', access_token);
        
        // Repetir requisição original com novo token
        originalRequest.headers.Authorization = `Bearer ${access_token}`;
        return axios(originalRequest);
      } catch (refreshError) {
        // Refresh falhou, redirecionar para login
        window.location.href = '/login';
        return Promise.reject(refreshError);
      }
    }
    
    return Promise.reject(error);
  }
);

class ApiClient {
  constructor(baseURL) {
    this.baseURL = baseURL;
  }
  
  async request(endpoint, options = {}) {
    const token = localStorage.getItem('access_token');
    
    const config = {
      ...options,
      headers: {
        'Content-Type': 'application/json',
        ...options.headers,
        ...(token && { Authorization: `Bearer ${token}` })
      }
    };
    
    let response = await fetch(`${this.baseURL}${endpoint}`, config);
    
    // Se token expirado, tentar renovar
    if (response.status === 401) {
      const newToken = await this.refreshToken();
      if (newToken) {
        config.headers.Authorization = `Bearer ${newToken}`;
        response = await fetch(`${this.baseURL}${endpoint}`, config);
      } else {
        window.location.href = '/login';
      }
    }
    
    if (!response.ok) {
      throw new Error(`API Error: ${response.status}`);
    }
    
    return response.json();
  }
  
  async refreshToken() {
    const refreshToken = localStorage.getItem('refresh_token');
    if (!refreshToken) return null;
    
    try {
      const response = await fetch(`${this.baseURL}/auth/refresh`, {
        method: 'POST',
        headers: { 'Content-Type': 'application/json' },
        body: JSON.stringify({ refresh_token: refreshToken })
      });
      
      if (!response.ok) return null;
      
      const data = await response.json();
      localStorage.setItem('access_token', data.access_token);
      return data.access_token;
    } catch {
      return null;
    }
  }
}

// Uso
const api = new ApiClient('https://api.sinapse.org.br/v1');
const casos = await api.request('/agravos/casos');

import requests
from datetime import datetime, timedelta

class SinapseAPI:
    def __init__(self, base_url, email=None, senha=None):
        self.base_url = base_url
        self.session = requests.Session()
        self.token_expires_at = None
        
        if email and senha:
            self.login(email, senha)
    
    def login(self, email, senha):
        response = self.session.post(
            f"{self.base_url}/auth/login",
            json={"email": email, "senha": senha}
        )
        response.raise_for_status()
        
        data = response.json()
        self.session.headers.update({
            "Authorization": f"Bearer {data['access_token']}"
        })
        self.refresh_token = data['refresh_token']
        self.token_expires_at = datetime.now() + timedelta(
            seconds=data['expires_in']
        )
    
    def _ensure_authenticated(self):
        if self.token_expires_at and datetime.now() >= self.token_expires_at:
            self._refresh_token()
    
    def _refresh_token(self):
        response = self.session.post(
            f"{self.base_url}/auth/refresh",
            json={"refresh_token": self.refresh_token}
        )
        response.raise_for_status()
        
        data = response.json()
        self.session.headers.update({
            "Authorization": f"Bearer {data['access_token']}"
        })
        self.token_expires_at = datetime.now() + timedelta(
            seconds=data['expires_in']
        )
    
    def request(self, method, endpoint, **kwargs):
        self._ensure_authenticated()
        
        response = self.session.request(
            method,
            f"{self.base_url}{endpoint}",
            **kwargs
        )
        
        # Tentar renovar token se 401
        if response.status_code == 401:
            self._refresh_token()
            response = self.session.request(
                method,
                f"{self.base_url}{endpoint}",
                **kwargs
            )
        
        response.raise_for_status()
        return response.json()

# Uso
api = SinapseAPI(
    "https://api.sinapse.org.br/v1",
    email="[email protected]",
    senha="senhaSegura"
)

casos = api.request("GET", "/agravos/casos")

// Para aplicações web, use cookies httpOnly
// Configuração no backend:
res.cookie('access_token', token, {
  httpOnly: true,
  secure: true, // HTTPS only
  sameSite: 'strict',
  maxAge: 3600000 // 1 hora
});

// Ou use sessionStorage para sessões temporárias
sessionStorage.setItem('access_token', token);

// Para aplicações menos sensíveis, localStorage com criptografia
import CryptoJS from 'crypto-js';

const encryptedToken = CryptoJS.AES.encrypt(
  token, 
  'chave-secreta'
).toString();
localStorage.setItem('token', encryptedToken);

// Android - Use Android Keystore
val keyAlias = "SinapseTokenKey"

// Armazenar
val keyStore = KeyStore.getInstance("AndroidKeyStore")
keyStore.load(null)

val cipher = Cipher.getInstance("AES/GCM/NoPadding")
cipher.init(Cipher.ENCRYPT_MODE, getSecretKey(keyAlias))

val encryptedToken = cipher.doFinal(token.toByteArray())
sharedPrefs.edit()
  .putString("encrypted_token", Base64.encodeToString(encryptedToken, Base64.DEFAULT))
  .putString("iv", Base64.encodeToString(cipher.iv, Base64.DEFAULT))
  .apply()

// iOS - Use Keychain
let token = "seu_token_aqui"
let tokenData = token.data(using: .utf8)!

let query: [String: Any] = [
  kSecClass as String: kSecClassGenericPassword,
  kSecAttrAccount as String: "SinapseToken",
  kSecValueData as String: tokenData
]

SecItemAdd(query as CFDictionary, nil)

# Use variáveis de ambiente
import os
from cryptography.fernet import Fernet

# Criptografar antes de armazenar
key = os.getenv('ENCRYPTION_KEY').encode()
cipher = Fernet(key)

encrypted_token = cipher.encrypt(token.encode())

# Armazenar em cache seguro (Redis com TLS)
redis_client.setex(
  f"token:{user_id}",
  3600,  # TTL de 1 hora
  encrypted_token
)

# Usar secrets manager em produção
# AWS Secrets Manager, Azure Key Vault, etc.