> ## Documentation Index
> Fetch the complete documentation index at: https://docs.nextmed.med.br/llms.txt
> Use this file to discover all available pages before exploring further.

# Autenticação

> Contratos de login, sessão, refresh token e logout.

## Autenticacao

## Login no gateway

```http theme={"system"}
POST {NEXT_PUBLIC_GATEWAY_HOST_WEB}/auth-service/auth
```

Headers:

```http theme={"system"}
app-name: nextmed-web
Content-Type: application/json
```

Body:

```json theme={"system"}
{
  "type": "USERPASS",
  "platform": "WEB",
  "email": "medico@example.com",
  "password": "senha"
}
```

Resposta esperada pelo frontend:

```ts theme={"system"}
type SignInOutput = {
  token: string;
  refreshToken: string;
  authToken: string;
  user: User;
};
```

Depois do login:

* `token` e usado no header `Authorization`.
* `authToken` autentica o usuario no Firebase via `signInWithCustomToken`.
* o frontend chama `POST /api/update-token` para persistir cookies.

## Persistir sessao

```http theme={"system"}
POST /api/update-token
```

Body para persistir tokens ja obtidos:

```json theme={"system"}
{
  "data": {
    "user_id": "user-id",
    "token": "jwt",
    "refresh_token": "refresh-token"
  }
}
```

Body para renovar token via gateway:

```json theme={"system"}
{
  "url": "auth-service/refresh-token",
  "data": {
    "refresh_token": "refresh-token"
  }
}
```

Resposta:

```json theme={"system"}
{
  "token": "jwt",
  "refreshToken": "refresh-token"
}
```

Efeitos colaterais:

* grava cookies `TOKEN`, `REFRESH_TOKEN` e, quando informado, `USER_ID`.
* atualiza o header default do Axios.
* em erro, remove sessao e retorna `401`.

## Logout

```http theme={"system"}
POST /api/sign-out
```

Comportamento:

* remove todos os cookies definidos em `AuthenticationTokens`.
* redireciona para `/` com status `301`.

## Cadastro

```http theme={"system"}
POST /auth-service/signup
```

Body:

```ts theme={"system"}
type SignUpMutationInput = {
  notificationProviderType: string;
  firstName: string;
  lastName: string;
  birthDate: string;
  phone: string;
  acceptTerms: boolean;
  gender: string;
  auth: {
    email: string;
    password: string;
    type: "USERPASS";
  };
  profiles: Array<{
    documentDoctor: string;
    documentDoctorState: string;
    documentDoctorUpdatedAt: string;
    specialties: Array<{
      description: string;
      document: string;
    }>;
    type: string;
  }>;
};
```

## Codigo de ativacao

Endpoints externos observados:

```http theme={"system"}
GET /auth-service/activation-code?ownerRef={userId}
POST /auth-service/change-phone
POST /auth-service/signup-model
```