@baruk/core 0.1.0

package/dist/products/repository.js

@@ -0,0 +1,56 @@
+import { uuidv7 } from '@baruk/shared';
+import { withContext } from '../db/context.js';
+import { PRODUCTS } from './catalog.js';
+/**
+ * Produtos acessíveis ao usuário: cruza suas memberships ativas com os
+ * entitlements (tenant_product) ativos. Rode dentro de `withContext({ userId })`
+ * — é assim que o Hub sabe a que produtos a pessoa tem direito. Sem entitlement
+ * = sem acesso (bloqueio no Hub).
+ */
+export async function listProductsForUser(tx, userId) {
+    const rows = await tx `
+    SELECT DISTINCT t.id AS tenant_id, t.display_name AS tenant_name, t.code AS tenant_code,
+           p.key AS product_key, p.name AS product_name, p.kind, p.base_url
+    FROM membership m
+    JOIN tenant t ON t.id = m.tenant_id
+    JOIN tenant_product tp ON tp.tenant_id = m.tenant_id AND tp.status = 'active'
+    JOIN product p ON p.id = tp.product_id AND p.is_active
+    WHERE m.user_id = ${userId} AND m.status = 'active' AND m.deleted_at IS NULL
+    ORDER BY t.display_name, p.name
+  `;
+    return rows.map((r) => ({
+        tenantId: r.tenant_id,
+        tenantName: r.tenant_name,
+        tenantCode: r.tenant_code,
+        productKey: r.product_key,
+        productName: r.product_name,
+        kind: r.kind,
+        baseUrl: r.base_url,
+    }));
+}
+/** Materializa o catálogo global de produtos (idempotente). */
+export async function ensureProductCatalog(db) {
+    for (const p of PRODUCTS) {
+        await db `
+      INSERT INTO product (id, key, name, kind, base_url, is_active)
+      VALUES (${uuidv7()}, ${p.key}, ${p.name}, ${p.kind}, ${p.baseUrl ?? null}, ${p.isActive ?? true})
+      ON CONFLICT (key) DO UPDATE
+        SET name = EXCLUDED.name, kind = EXCLUDED.kind,
+            base_url = EXCLUDED.base_url, is_active = EXCLUDED.is_active
+    `;
+    }
+}
+/** Concede (ou reativa) um produto a um tenant. */
+export async function ensureTenantProduct(db, tenantId, productKey) {
+    await withContext(db, { tenantId }, async (tx) => {
+        const prod = await tx `SELECT id FROM product WHERE key = ${productKey}`;
+        if (!prod[0])
+            throw new Error(`Produto desconhecido: ${productKey}`);
+        await tx `
+      INSERT INTO tenant_product (id, tenant_id, product_id, status)
+      VALUES (${uuidv7()}, current_setting('app.current_tenant')::uuid, ${prod[0].id}, 'active')
+      ON CONFLICT (tenant_id, product_id) DO UPDATE SET status = 'active'
+    `;
+    });
+}
+//# sourceMappingURL=repository.js.map

package/dist/products/repository.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"repository.js","sourceRoot":"","sources":["../../src/products/repository.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,MAAM,EAAE,MAAM,eAAe,CAAC;AAEvC,OAAO,EAAE,WAAW,EAAE,MAAM,kBAAkB,CAAC;AAC/C,OAAO,EAAE,QAAQ,EAAE,MAAM,cAAc,CAAC;AAYxC;;;;;GAKG;AACH,MAAM,CAAC,KAAK,UAAU,mBAAmB,CAAC,EAAM,EAAE,MAAc;IAC9D,MAAM,IAAI,GAAG,MAAM,EAAE,CAUpB;;;;;;;wBAOqB,MAAM;;GAE3B,CAAC;IACF,OAAO,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;QACtB,QAAQ,EAAE,CAAC,CAAC,SAAS;QACrB,UAAU,EAAE,CAAC,CAAC,WAAW;QACzB,UAAU,EAAE,CAAC,CAAC,WAAW;QACzB,UAAU,EAAE,CAAC,CAAC,WAAW;QACzB,WAAW,EAAE,CAAC,CAAC,YAAY;QAC3B,IAAI,EAAE,CAAC,CAAC,IAAI;QACZ,OAAO,EAAE,CAAC,CAAC,QAAQ;KACpB,CAAC,CAAC,CAAC;AACN,CAAC;AAED,+DAA+D;AAC/D,MAAM,CAAC,KAAK,UAAU,oBAAoB,CAAC,EAAM;IAC/C,KAAK,MAAM,CAAC,IAAI,QAAQ,EAAE,CAAC;QACzB,MAAM,EAAE,CAAA;;gBAEI,MAAM,EAAE,KAAK,CAAC,CAAC,GAAG,KAAK,CAAC,CAAC,IAAI,KAAK,CAAC,CAAC,IAAI,KAAK,CAAC,CAAC,OAAO,IAAI,IAAI,KAAK,CAAC,CAAC,QAAQ,IAAI,IAAI;;;;KAIhG,CAAC;IACJ,CAAC;AACH,CAAC;AAED,mDAAmD;AACnD,MAAM,CAAC,KAAK,UAAU,mBAAmB,CAAC,EAAM,EAAE,QAAgB,EAAE,UAAkB;IACpF,MAAM,WAAW,CAAC,EAAE,EAAE,EAAE,QAAQ,EAAE,EAAE,KAAK,EAAE,EAAE,EAAE,EAAE;QAC/C,MAAM,IAAI,GAAG,MAAM,EAAE,CAAkB,sCAAsC,UAAU,EAAE,CAAC;QAC1F,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC;YAAE,MAAM,IAAI,KAAK,CAAC,yBAAyB,UAAU,EAAE,CAAC,CAAC;QACrE,MAAM,EAAE,CAAA;;gBAEI,MAAM,EAAE,kDAAkD,IAAI,CAAC,CAAC,CAAC,CAAC,EAAE;;KAE/E,CAAC;IACJ,CAAC,CAAC,CAAC;AACL,CAAC"}

package/dist/rbac/authorize.d.ts

@@ -0,0 +1,18 @@
+import type { Tx } from '../db/client.js';
+/**
+ * Avaliação de permissão (04-rbac §6) — CONVERGIDO sobre @baruk/identity
+ * (RFC-IDENTITY-003 §3.4). Decisão sempre no backend; a RLS no banco é a última
+ * linha de defesa. `canDo` delega ao avaliador canônico (aceita `Iterable`, logo
+ * `ReadonlySet`); `assertPermission` PRESERVA o `ForbiddenError` do domínio — o
+ * contrato de erro/HTTP fica intacto (o canônico lançaria um `Error` genérico).
+ */
+export declare function canDo(permissions: ReadonlySet<string>, required: string): boolean;
+export declare function assertPermission(permissions: ReadonlySet<string>, required: string): void;
+/**
+ * Carrega as permissões efetivas de um usuário DENTRO do tenant corrente.
+ * Permanece no core: é I/O de domínio (RLS/tenant), não primitiva canônica.
+ * Deve rodar dentro de `withContext({ tenantId, userId })` — a RLS de
+ * `user_role`/`role_permission` já restringe as linhas ao tenant ativo.
+ */
+export declare function loadUserPermissions(tx: Tx, userId: string): Promise<Set<string>>;
+//# sourceMappingURL=authorize.d.ts.map

package/dist/rbac/authorize.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"authorize.d.ts","sourceRoot":"","sources":["../../src/rbac/authorize.ts"],"names":[],"mappings":"AAEA,OAAO,KAAK,EAAE,EAAE,EAAE,MAAM,iBAAiB,CAAC;AAE1C;;;;;;GAMG;AACH,wBAAgB,KAAK,CAAC,WAAW,EAAE,WAAW,CAAC,MAAM,CAAC,EAAE,QAAQ,EAAE,MAAM,GAAG,OAAO,CAEjF;AAED,wBAAgB,gBAAgB,CAAC,WAAW,EAAE,WAAW,CAAC,MAAM,CAAC,EAAE,QAAQ,EAAE,MAAM,GAAG,IAAI,CAIzF;AAED;;;;;GAKG;AACH,wBAAsB,mBAAmB,CAAC,EAAE,EAAE,EAAE,EAAE,MAAM,EAAE,MAAM,GAAG,OAAO,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC,CAUtF"}

package/dist/rbac/authorize.js

@@ -0,0 +1,35 @@
+import { ForbiddenError } from '@baruk/shared';
+import { canDo as canonicalCanDo } from '@baruk/identity';
+/**
+ * Avaliação de permissão (04-rbac §6) — CONVERGIDO sobre @baruk/identity
+ * (RFC-IDENTITY-003 §3.4). Decisão sempre no backend; a RLS no banco é a última
+ * linha de defesa. `canDo` delega ao avaliador canônico (aceita `Iterable`, logo
+ * `ReadonlySet`); `assertPermission` PRESERVA o `ForbiddenError` do domínio — o
+ * contrato de erro/HTTP fica intacto (o canônico lançaria um `Error` genérico).
+ */
+export function canDo(permissions, required) {
+    return canonicalCanDo(permissions, required);
+}
+export function assertPermission(permissions, required) {
+    if (!canDo(permissions, required)) {
+        throw new ForbiddenError(`Permissão necessária: ${required}`);
+    }
+}
+/**
+ * Carrega as permissões efetivas de um usuário DENTRO do tenant corrente.
+ * Permanece no core: é I/O de domínio (RLS/tenant), não primitiva canônica.
+ * Deve rodar dentro de `withContext({ tenantId, userId })` — a RLS de
+ * `user_role`/`role_permission` já restringe as linhas ao tenant ativo.
+ */
+export async function loadUserPermissions(tx, userId) {
+    const rows = await tx `
+    SELECT DISTINCT p.key
+    FROM user_role ur
+    JOIN role_permission rp ON rp.role_id = ur.role_id
+    JOIN permission p ON p.id = rp.permission_id
+    WHERE ur.user_id = ${userId}
+      AND ur.deleted_at IS NULL
+  `;
+    return new Set(rows.map((r) => r.key));
+}
+//# sourceMappingURL=authorize.js.map

package/dist/rbac/authorize.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"authorize.js","sourceRoot":"","sources":["../../src/rbac/authorize.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,cAAc,EAAE,MAAM,eAAe,CAAC;AAC/C,OAAO,EAAE,KAAK,IAAI,cAAc,EAAE,MAAM,iBAAiB,CAAC;AAG1D;;;;;;GAMG;AACH,MAAM,UAAU,KAAK,CAAC,WAAgC,EAAE,QAAgB;IACtE,OAAO,cAAc,CAAC,WAAW,EAAE,QAAQ,CAAC,CAAC;AAC/C,CAAC;AAED,MAAM,UAAU,gBAAgB,CAAC,WAAgC,EAAE,QAAgB;IACjF,IAAI,CAAC,KAAK,CAAC,WAAW,EAAE,QAAQ,CAAC,EAAE,CAAC;QAClC,MAAM,IAAI,cAAc,CAAC,yBAAyB,QAAQ,EAAE,CAAC,CAAC;IAChE,CAAC;AACH,CAAC;AAED;;;;;GAKG;AACH,MAAM,CAAC,KAAK,UAAU,mBAAmB,CAAC,EAAM,EAAE,MAAc;IAC9D,MAAM,IAAI,GAAG,MAAM,EAAE,CAAmB;;;;;yBAKjB,MAAM;;GAE5B,CAAC;IACF,OAAO,IAAI,GAAG,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC;AACzC,CAAC"}

package/dist/rbac/catalog.d.ts

@@ -0,0 +1,21 @@
+/**
+ * Catálogo de permissões e papéis de sistema (04-rbac-permissions.md).
+ * É a fonte que o seed materializa no banco. A vertical registra permissões
+ * adicionais via seu próprio seed — sem alterar o Core.
+ */
+export interface PermissionDef {
+    key: string;
+    resource: string;
+    action: string;
+    description: string;
+}
+export declare const PERMISSIONS: readonly PermissionDef[];
+export declare const ALL_PERMISSION_KEYS: readonly string[];
+export interface RoleDef {
+    key: string;
+    name: string;
+    permissions: readonly string[];
+}
+/** Papéis de sistema (seed, imutáveis). São templates globais (tenant_id NULL). */
+export declare const SYSTEM_ROLES: readonly RoleDef[];
+//# sourceMappingURL=catalog.d.ts.map

package/dist/rbac/catalog.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"catalog.d.ts","sourceRoot":"","sources":["../../src/rbac/catalog.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AAEH,MAAM,WAAW,aAAa;IAC5B,GAAG,EAAE,MAAM,CAAC;IACZ,QAAQ,EAAE,MAAM,CAAC;IACjB,MAAM,EAAE,MAAM,CAAC;IACf,WAAW,EAAE,MAAM,CAAC;CACrB;AAED,eAAO,MAAM,WAAW,EAAE,SAAS,aAAa,EAmB/C,CAAC;AAEF,eAAO,MAAM,mBAAmB,EAAE,SAAS,MAAM,EAAkC,CAAC;AAEpF,MAAM,WAAW,OAAO;IACtB,GAAG,EAAE,MAAM,CAAC;IACZ,IAAI,EAAE,MAAM,CAAC;IACb,WAAW,EAAE,SAAS,MAAM,EAAE,CAAC;CAChC;AAID,mFAAmF;AACnF,eAAO,MAAM,YAAY,EAAE,SAAS,OAAO,EA6B1C,CAAC"}

package/dist/rbac/catalog.js

@@ -0,0 +1,59 @@
+/**
+ * Catálogo de permissões e papéis de sistema (04-rbac-permissions.md).
+ * É a fonte que o seed materializa no banco. A vertical registra permissões
+ * adicionais via seu próprio seed — sem alterar o Core.
+ */
+export const PERMISSIONS = [
+    { key: 'client.read', resource: 'client', action: 'read', description: 'Ver clientes' },
+    { key: 'client.write', resource: 'client', action: 'write', description: 'Criar/editar clientes' },
+    { key: 'client.delete', resource: 'client', action: 'delete', description: 'Remover clientes' },
+    { key: 'client.import', resource: 'client', action: 'manage', description: 'Importar clientes (CSV)' },
+    { key: 'request.read', resource: 'request', action: 'read', description: 'Ver solicitações' },
+    { key: 'request.create', resource: 'request', action: 'write', description: 'Criar solicitações' },
+    { key: 'request.comment', resource: 'request', action: 'write', description: 'Comentar solicitações' },
+    { key: 'request.status.update', resource: 'request', action: 'manage', description: 'Alterar status de solicitações' },
+    { key: 'user.manage', resource: 'user', action: 'manage', description: 'Gerenciar usuários e memberships' },
+    { key: 'document.read', resource: 'document', action: 'read', description: 'Ver documentos' },
+    { key: 'document.write', resource: 'document', action: 'write', description: 'Enviar documentos' },
+    { key: 'finance.charge.create', resource: 'finance', action: 'write', description: 'Emitir cobranças' },
+    { key: 'vault.credential.decrypt', resource: 'vault', action: 'manage', description: 'Descriptografar credencial do cofre' },
+    { key: 'communication.send', resource: 'communication', action: 'write', description: 'Enviar comunicações' },
+    { key: 'audit.read', resource: 'audit', action: 'read', description: 'Ler trilha de auditoria' },
+    { key: 'tenant.settings.update', resource: 'tenant', action: 'manage', description: 'Alterar configurações do tenant' },
+    { key: 'rbac.role.update', resource: 'rbac', action: 'manage', description: 'Gerenciar papéis e permissões' },
+    { key: 'user.invite', resource: 'user', action: 'manage', description: 'Convidar usuários' },
+];
+export const ALL_PERMISSION_KEYS = PERMISSIONS.map((p) => p.key);
+const ALL = ALL_PERMISSION_KEYS;
+/** Papéis de sistema (seed, imutáveis). São templates globais (tenant_id NULL). */
+export const SYSTEM_ROLES = [
+    { key: 'owner', name: 'Owner', permissions: ALL },
+    { key: 'admin', name: 'Administrador', permissions: ALL.filter((p) => p !== 'tenant.settings.update') },
+    {
+        key: 'accountant',
+        name: 'Contador',
+        permissions: [
+            'client.read', 'client.write', 'client.import', 'document.read', 'document.write',
+            'communication.send', 'vault.credential.decrypt',
+            'request.read', 'request.create', 'request.comment', 'request.status.update',
+        ],
+    },
+    {
+        key: 'assistant',
+        name: 'Assistente',
+        permissions: ['client.read', 'document.read', 'document.write', 'request.read', 'request.comment'],
+    },
+    { key: 'finance', name: 'Financeiro', permissions: ['client.read', 'finance.charge.create'] },
+    {
+        key: 'communication',
+        name: 'Comunicação',
+        permissions: ['client.read', 'communication.send', 'request.read', 'request.comment'],
+    },
+    { key: 'readonly', name: 'Somente leitura', permissions: ['client.read', 'document.read', 'request.read'] },
+    {
+        key: 'client_titular',
+        name: 'Cliente — Titular',
+        permissions: ['document.read', 'communication.send', 'request.read', 'request.comment'],
+    },
+];
+//# sourceMappingURL=catalog.js.map

package/dist/rbac/catalog.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"catalog.js","sourceRoot":"","sources":["../../src/rbac/catalog.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AASH,MAAM,CAAC,MAAM,WAAW,GAA6B;IACnD,EAAE,GAAG,EAAE,aAAa,EAAE,QAAQ,EAAE,QAAQ,EAAE,MAAM,EAAE,MAAM,EAAE,WAAW,EAAE,cAAc,EAAE;IACvF,EAAE,GAAG,EAAE,cAAc,EAAE,QAAQ,EAAE,QAAQ,EAAE,MAAM,EAAE,OAAO,EAAE,WAAW,EAAE,uBAAuB,EAAE;IAClG,EAAE,GAAG,EAAE,eAAe,EAAE,QAAQ,EAAE,QAAQ,EAAE,MAAM,EAAE,QAAQ,EAAE,WAAW,EAAE,kBAAkB,EAAE;IAC/F,EAAE,GAAG,EAAE,eAAe,EAAE,QAAQ,EAAE,QAAQ,EAAE,MAAM,EAAE,QAAQ,EAAE,WAAW,EAAE,yBAAyB,EAAE;IACtG,EAAE,GAAG,EAAE,cAAc,EAAE,QAAQ,EAAE,SAAS,EAAE,MAAM,EAAE,MAAM,EAAE,WAAW,EAAE,kBAAkB,EAAE;IAC7F,EAAE,GAAG,EAAE,gBAAgB,EAAE,QAAQ,EAAE,SAAS,EAAE,MAAM,EAAE,OAAO,EAAE,WAAW,EAAE,oBAAoB,EAAE;IAClG,EAAE,GAAG,EAAE,iBAAiB,EAAE,QAAQ,EAAE,SAAS,EAAE,MAAM,EAAE,OAAO,EAAE,WAAW,EAAE,uBAAuB,EAAE;IACtG,EAAE,GAAG,EAAE,uBAAuB,EAAE,QAAQ,EAAE,SAAS,EAAE,MAAM,EAAE,QAAQ,EAAE,WAAW,EAAE,gCAAgC,EAAE;IACtH,EAAE,GAAG,EAAE,aAAa,EAAE,QAAQ,EAAE,MAAM,EAAE,MAAM,EAAE,QAAQ,EAAE,WAAW,EAAE,kCAAkC,EAAE;IAC3G,EAAE,GAAG,EAAE,eAAe,EAAE,QAAQ,EAAE,UAAU,EAAE,MAAM,EAAE,MAAM,EAAE,WAAW,EAAE,gBAAgB,EAAE;IAC7F,EAAE,GAAG,EAAE,gBAAgB,EAAE,QAAQ,EAAE,UAAU,EAAE,MAAM,EAAE,OAAO,EAAE,WAAW,EAAE,mBAAmB,EAAE;IAClG,EAAE,GAAG,EAAE,uBAAuB,EAAE,QAAQ,EAAE,SAAS,EAAE,MAAM,EAAE,OAAO,EAAE,WAAW,EAAE,kBAAkB,EAAE;IACvG,EAAE,GAAG,EAAE,0BAA0B,EAAE,QAAQ,EAAE,OAAO,EAAE,MAAM,EAAE,QAAQ,EAAE,WAAW,EAAE,qCAAqC,EAAE;IAC5H,EAAE,GAAG,EAAE,oBAAoB,EAAE,QAAQ,EAAE,eAAe,EAAE,MAAM,EAAE,OAAO,EAAE,WAAW,EAAE,qBAAqB,EAAE;IAC7G,EAAE,GAAG,EAAE,YAAY,EAAE,QAAQ,EAAE,OAAO,EAAE,MAAM,EAAE,MAAM,EAAE,WAAW,EAAE,yBAAyB,EAAE;IAChG,EAAE,GAAG,EAAE,wBAAwB,EAAE,QAAQ,EAAE,QAAQ,EAAE,MAAM,EAAE,QAAQ,EAAE,WAAW,EAAE,iCAAiC,EAAE;IACvH,EAAE,GAAG,EAAE,kBAAkB,EAAE,QAAQ,EAAE,MAAM,EAAE,MAAM,EAAE,QAAQ,EAAE,WAAW,EAAE,+BAA+B,EAAE;IAC7G,EAAE,GAAG,EAAE,aAAa,EAAE,QAAQ,EAAE,MAAM,EAAE,MAAM,EAAE,QAAQ,EAAE,WAAW,EAAE,mBAAmB,EAAE;CAC7F,CAAC;AAEF,MAAM,CAAC,MAAM,mBAAmB,GAAsB,WAAW,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC;AAQpF,MAAM,GAAG,GAAG,mBAAmB,CAAC;AAEhC,mFAAmF;AACnF,MAAM,CAAC,MAAM,YAAY,GAAuB;IAC9C,EAAE,GAAG,EAAE,OAAO,EAAE,IAAI,EAAE,OAAO,EAAE,WAAW,EAAE,GAAG,EAAE;IACjD,EAAE,GAAG,EAAE,OAAO,EAAE,IAAI,EAAE,eAAe,EAAE,WAAW,EAAE,GAAG,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,KAAK,wBAAwB,CAAC,EAAE;IACvG;QACE,GAAG,EAAE,YAAY;QACjB,IAAI,EAAE,UAAU;QAChB,WAAW,EAAE;YACX,aAAa,EAAE,cAAc,EAAE,eAAe,EAAE,eAAe,EAAE,gBAAgB;YACjF,oBAAoB,EAAE,0BAA0B;YAChD,cAAc,EAAE,gBAAgB,EAAE,iBAAiB,EAAE,uBAAuB;SAC7E;KACF;IACD;QACE,GAAG,EAAE,WAAW;QAChB,IAAI,EAAE,YAAY;QAClB,WAAW,EAAE,CAAC,aAAa,EAAE,eAAe,EAAE,gBAAgB,EAAE,cAAc,EAAE,iBAAiB,CAAC;KACnG;IACD,EAAE,GAAG,EAAE,SAAS,EAAE,IAAI,EAAE,YAAY,EAAE,WAAW,EAAE,CAAC,aAAa,EAAE,uBAAuB,CAAC,EAAE;IAC7F;QACE,GAAG,EAAE,eAAe;QACpB,IAAI,EAAE,aAAa;QACnB,WAAW,EAAE,CAAC,aAAa,EAAE,oBAAoB,EAAE,cAAc,EAAE,iBAAiB,CAAC;KACtF;IACD,EAAE,GAAG,EAAE,UAAU,EAAE,IAAI,EAAE,iBAAiB,EAAE,WAAW,EAAE,CAAC,aAAa,EAAE,eAAe,EAAE,cAAc,CAAC,EAAE;IAC3G;QACE,GAAG,EAAE,gBAAgB;QACrB,IAAI,EAAE,mBAAmB;QACzB,WAAW,EAAE,CAAC,eAAe,EAAE,oBAAoB,EAAE,cAAc,EAAE,iBAAiB,CAAC;KACxF;CACF,CAAC"}

package/dist/requests/repository.d.ts

@@ -0,0 +1,66 @@
+import type { Tx } from '../db/client.js';
+/**
+ * Solicitações (service_request) — o núcleo do ciclo operacional escritório↔cliente.
+ * Tenant-scoped por RLS. Endpoints de portal restringem adicionalmente por
+ * `clientId` (o cliente só vê as próprias solicitações) — passado como filtro.
+ */
+export type RequestStatus = 'draft' | 'sent' | 'viewed' | 'awaiting_client' | 'answered' | 'in_review' | 'done' | 'canceled' | 'overdue';
+export type RequestPriority = 'low' | 'medium' | 'high' | 'urgent';
+export interface ServiceRequestRecord {
+    id: string;
+    tenantId: string;
+    clientId: string;
+    title: string;
+    description: string | null;
+    category: string;
+    competenceLabel: string | null;
+    priority: RequestPriority;
+    status: RequestStatus;
+    dueDate: string | null;
+    responsibleUserId: string | null;
+    createdBy: string | null;
+    createdAt: string;
+    updatedAt: string;
+}
+export interface CreateRequestInput {
+    clientId: string;
+    title: string;
+    description?: string | null;
+    category?: string;
+    competenceLabel?: string | null;
+    priority?: RequestPriority;
+    dueDate?: string | null;
+    responsibleUserId?: string | null;
+    status?: RequestStatus;
+    createdBy?: string | null;
+}
+export declare function createRequest(tx: Tx, input: CreateRequestInput): Promise<ServiceRequestRecord>;
+export interface ListRequestFilter {
+    clientId?: string;
+    status?: RequestStatus;
+    search?: string;
+    limit?: number;
+    offset?: number;
+}
+export declare function listRequests(tx: Tx, filter?: ListRequestFilter): Promise<{
+    items: ServiceRequestRecord[];
+    total: number;
+}>;
+export declare function getRequest(tx: Tx, id: string, clientId?: string): Promise<ServiceRequestRecord>;
+export declare function updateRequestStatus(tx: Tx, id: string, status: RequestStatus, clientId?: string): Promise<number>;
+export interface CommentRecord {
+    id: string;
+    requestId: string;
+    authorUserId: string | null;
+    authorKind: 'staff' | 'client' | 'system';
+    body: string;
+    createdAt: string;
+}
+export declare function addComment(tx: Tx, input: {
+    requestId: string;
+    body: string;
+    authorUserId?: string | null;
+    authorKind?: 'staff' | 'client' | 'system';
+}): Promise<CommentRecord>;
+export declare function listComments(tx: Tx, requestId: string): Promise<CommentRecord[]>;
+//# sourceMappingURL=repository.d.ts.map

package/dist/requests/repository.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"repository.d.ts","sourceRoot":"","sources":["../../src/requests/repository.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EAAE,EAAE,EAAE,MAAM,iBAAiB,CAAC;AAE1C;;;;GAIG;AAEH,MAAM,MAAM,aAAa,GACrB,OAAO,GACP,MAAM,GACN,QAAQ,GACR,iBAAiB,GACjB,UAAU,GACV,WAAW,GACX,MAAM,GACN,UAAU,GACV,SAAS,CAAC;AAEd,MAAM,MAAM,eAAe,GAAG,KAAK,GAAG,QAAQ,GAAG,MAAM,GAAG,QAAQ,CAAC;AAEnE,MAAM,WAAW,oBAAoB;IACnC,EAAE,EAAE,MAAM,CAAC;IACX,QAAQ,EAAE,MAAM,CAAC;IACjB,QAAQ,EAAE,MAAM,CAAC;IACjB,KAAK,EAAE,MAAM,CAAC;IACd,WAAW,EAAE,MAAM,GAAG,IAAI,CAAC;IAC3B,QAAQ,EAAE,MAAM,CAAC;IACjB,eAAe,EAAE,MAAM,GAAG,IAAI,CAAC;IAC/B,QAAQ,EAAE,eAAe,CAAC;IAC1B,MAAM,EAAE,aAAa,CAAC;IACtB,OAAO,EAAE,MAAM,GAAG,IAAI,CAAC;IACvB,iBAAiB,EAAE,MAAM,GAAG,IAAI,CAAC;IACjC,SAAS,EAAE,MAAM,GAAG,IAAI,CAAC;IACzB,SAAS,EAAE,MAAM,CAAC;IAClB,SAAS,EAAE,MAAM,CAAC;CACnB;AAsCD,MAAM,WAAW,kBAAkB;IACjC,QAAQ,EAAE,MAAM,CAAC;IACjB,KAAK,EAAE,MAAM,CAAC;IACd,WAAW,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IAC5B,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,eAAe,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IAChC,QAAQ,CAAC,EAAE,eAAe,CAAC;IAC3B,OAAO,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IACxB,iBAAiB,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IAClC,MAAM,CAAC,EAAE,aAAa,CAAC;IACvB,SAAS,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;CAC3B;AAED,wBAAsB,aAAa,CAAC,EAAE,EAAE,EAAE,EAAE,KAAK,EAAE,kBAAkB,GAAG,OAAO,CAAC,oBAAoB,CAAC,CAepG;AAED,MAAM,WAAW,iBAAiB;IAChC,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,MAAM,CAAC,EAAE,aAAa,CAAC;IACvB,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,MAAM,CAAC,EAAE,MAAM,CAAC;CACjB;AAED,wBAAsB,YAAY,CAChC,EAAE,EAAE,EAAE,EACN,MAAM,GAAE,iBAAsB,GAC7B,OAAO,CAAC;IAAE,KAAK,EAAE,oBAAoB,EAAE,CAAC;IAAC,KAAK,EAAE,MAAM,CAAA;CAAE,CAAC,CAiB3D;AAED,wBAAsB,UAAU,CAAC,EAAE,EAAE,EAAE,EAAE,EAAE,EAAE,MAAM,EAAE,QAAQ,CAAC,EAAE,MAAM,GAAG,OAAO,CAAC,oBAAoB,CAAC,CAQrG;AAED,wBAAsB,mBAAmB,CACvC,EAAE,EAAE,EAAE,EACN,EAAE,EAAE,MAAM,EACV,MAAM,EAAE,aAAa,EACrB,QAAQ,CAAC,EAAE,MAAM,GAChB,OAAO,CAAC,MAAM,CAAC,CASjB;AAGD,MAAM,WAAW,aAAa;IAC5B,EAAE,EAAE,MAAM,CAAC;IACX,SAAS,EAAE,MAAM,CAAC;IAClB,YAAY,EAAE,MAAM,GAAG,IAAI,CAAC;IAC5B,UAAU,EAAE,OAAO,GAAG,QAAQ,GAAG,QAAQ,CAAC;IAC1C,IAAI,EAAE,MAAM,CAAC;IACb,SAAS,EAAE,MAAM,CAAC;CACnB;AAED,wBAAsB,UAAU,CAC9B,EAAE,EAAE,EAAE,EACN,KAAK,EAAE;IAAE,SAAS,EAAE,MAAM,CAAC;IAAC,IAAI,EAAE,MAAM,CAAC;IAAC,YAAY,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IAAC,UAAU,CAAC,EAAE,OAAO,GAAG,QAAQ,GAAG,QAAQ,CAAA;CAAE,GACnH,OAAO,CAAC,aAAa,CAAC,CAoBxB;AAED,wBAAsB,YAAY,CAAC,EAAE,EAAE,EAAE,EAAE,SAAS,EAAE,MAAM,GAAG,OAAO,CAAC,aAAa,EAAE,CAAC,CAetF"}

package/dist/requests/repository.js

@@ -0,0 +1,106 @@
+import { NotFoundError, uuidv7 } from '@baruk/shared';
+function mapRow(r) {
+    return {
+        id: r.id,
+        tenantId: r.tenant_id,
+        clientId: r.client_id,
+        title: r.title,
+        description: r.description,
+        category: r.category,
+        competenceLabel: r.competence_label,
+        priority: r.priority,
+        status: r.status,
+        dueDate: r.due_date ? r.due_date.toISOString().slice(0, 10) : null,
+        responsibleUserId: r.responsible_user_id,
+        createdBy: r.created_by,
+        createdAt: r.created_at.toISOString(),
+        updatedAt: r.updated_at.toISOString(),
+    };
+}
+export async function createRequest(tx, input) {
+    const rows = await tx `
+    INSERT INTO service_request (
+      id, tenant_id, client_id, title, description, category, competence_label,
+      priority, status, due_date, responsible_user_id, created_by
+    ) VALUES (
+      ${uuidv7()}, current_setting('app.current_tenant')::uuid, ${input.clientId},
+      ${input.title}, ${input.description ?? null}, ${input.category ?? 'geral'},
+      ${input.competenceLabel ?? null}, ${input.priority ?? 'medium'},
+      ${input.status ?? 'sent'}, ${input.dueDate ?? null},
+      ${input.responsibleUserId ?? null}, ${input.createdBy ?? null}
+    )
+    RETURNING *
+  `;
+    return mapRow(rows[0]);
+}
+export async function listRequests(tx, filter = {}) {
+    const limit = Math.min(filter.limit ?? 20, 100);
+    const offset = filter.offset ?? 0;
+    const like = filter.search ? `%${filter.search}%` : null;
+    const rows = await tx `
+    SELECT sr.*, count(*) OVER() AS total
+    FROM service_request sr
+    WHERE sr.deleted_at IS NULL
+      AND (${filter.clientId ?? null}::uuid IS NULL OR sr.client_id = ${filter.clientId ?? null})
+      AND (${filter.status ?? null}::text IS NULL OR sr.status = ${filter.status ?? null})
+      AND (${like}::text IS NULL OR sr.title ILIKE ${like} OR sr.description ILIKE ${like})
+    ORDER BY sr.created_at DESC
+    LIMIT ${limit} OFFSET ${offset}
+  `;
+    const total = rows[0] ? Number(rows[0].total) : 0;
+    return { items: rows.map(mapRow), total };
+}
+export async function getRequest(tx, id, clientId) {
+    const rows = await tx `
+    SELECT * FROM service_request
+    WHERE id = ${id} AND deleted_at IS NULL
+      AND (${clientId ?? null}::uuid IS NULL OR client_id = ${clientId ?? null})
+  `;
+    if (!rows[0])
+        throw new NotFoundError('Solicitação não encontrada');
+    return mapRow(rows[0]);
+}
+export async function updateRequestStatus(tx, id, status, clientId) {
+    const rows = await tx `
+    UPDATE service_request
+    SET status = ${status}, updated_at = now(), version = version + 1
+    WHERE id = ${id} AND deleted_at IS NULL
+      AND (${clientId ?? null}::uuid IS NULL OR client_id = ${clientId ?? null})
+    RETURNING id
+  `;
+    return rows.count;
+}
+export async function addComment(tx, input) {
+    const rows = await tx `
+    INSERT INTO request_comment (id, tenant_id, request_id, author_user_id, author_kind, body)
+    VALUES (
+      ${uuidv7()}, current_setting('app.current_tenant')::uuid, ${input.requestId},
+      ${input.authorUserId ?? null}, ${input.authorKind ?? 'staff'}, ${input.body}
+    )
+    RETURNING id, request_id, author_user_id, author_kind, body, created_at
+  `;
+    const r = rows[0];
+    return {
+        id: r.id,
+        requestId: r.request_id,
+        authorUserId: r.author_user_id,
+        authorKind: r.author_kind,
+        body: r.body,
+        createdAt: r.created_at.toISOString(),
+    };
+}
+export async function listComments(tx, requestId) {
+    const rows = await tx `
+    SELECT id, request_id, author_user_id, author_kind, body, created_at
+    FROM request_comment WHERE request_id = ${requestId} ORDER BY created_at ASC
+  `;
+    return rows.map((r) => ({
+        id: r.id,
+        requestId: r.request_id,
+        authorUserId: r.author_user_id,
+        authorKind: r.author_kind,
+        body: r.body,
+        createdAt: r.created_at.toISOString(),
+    }));
+}
+//# sourceMappingURL=repository.js.map

package/dist/requests/repository.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"repository.js","sourceRoot":"","sources":["../../src/requests/repository.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,aAAa,EAAE,MAAM,EAAE,MAAM,eAAe,CAAC;AAwDtD,SAAS,MAAM,CAAC,CAAM;IACpB,OAAO;QACL,EAAE,EAAE,CAAC,CAAC,EAAE;QACR,QAAQ,EAAE,CAAC,CAAC,SAAS;QACrB,QAAQ,EAAE,CAAC,CAAC,SAAS;QACrB,KAAK,EAAE,CAAC,CAAC,KAAK;QACd,WAAW,EAAE,CAAC,CAAC,WAAW;QAC1B,QAAQ,EAAE,CAAC,CAAC,QAAQ;QACpB,eAAe,EAAE,CAAC,CAAC,gBAAgB;QACnC,QAAQ,EAAE,CAAC,CAAC,QAAQ;QACpB,MAAM,EAAE,CAAC,CAAC,MAAM;QAChB,OAAO,EAAE,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,WAAW,EAAE,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC,IAAI;QAClE,iBAAiB,EAAE,CAAC,CAAC,mBAAmB;QACxC,SAAS,EAAE,CAAC,CAAC,UAAU;QACvB,SAAS,EAAE,CAAC,CAAC,UAAU,CAAC,WAAW,EAAE;QACrC,SAAS,EAAE,CAAC,CAAC,UAAU,CAAC,WAAW,EAAE;KACtC,CAAC;AACJ,CAAC;AAeD,MAAM,CAAC,KAAK,UAAU,aAAa,CAAC,EAAM,EAAE,KAAyB;IACnE,MAAM,IAAI,GAAG,MAAM,EAAE,CAAO;;;;;QAKtB,MAAM,EAAE,kDAAkD,KAAK,CAAC,QAAQ;QACxE,KAAK,CAAC,KAAK,KAAK,KAAK,CAAC,WAAW,IAAI,IAAI,KAAK,KAAK,CAAC,QAAQ,IAAI,OAAO;QACvE,KAAK,CAAC,eAAe,IAAI,IAAI,KAAK,KAAK,CAAC,QAAQ,IAAI,QAAQ;QAC5D,KAAK,CAAC,MAAM,IAAI,MAAM,KAAK,KAAK,CAAC,OAAO,IAAI,IAAI;QAChD,KAAK,CAAC,iBAAiB,IAAI,IAAI,KAAK,KAAK,CAAC,SAAS,IAAI,IAAI;;;GAGhE,CAAC;IACF,OAAO,MAAM,CAAC,IAAI,CAAC,CAAC,CAAE,CAAC,CAAC;AAC1B,CAAC;AAUD,MAAM,CAAC,KAAK,UAAU,YAAY,CAChC,EAAM,EACN,SAA4B,EAAE;IAE9B,MAAM,KAAK,GAAG,IAAI,CAAC,GAAG,CAAC,MAAM,CAAC,KAAK,IAAI,EAAE,EAAE,GAAG,CAAC,CAAC;IAChD,MAAM,MAAM,GAAG,MAAM,CAAC,MAAM,IAAI,CAAC,CAAC;IAClC,MAAM,IAAI,GAAG,MAAM,CAAC,MAAM,CAAC,CAAC,CAAC,IAAI,MAAM,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,IAAI,CAAC;IAEzD,MAAM,IAAI,GAAG,MAAM,EAAE,CAA6B;;;;aAIvC,MAAM,CAAC,QAAQ,IAAI,IAAI,oCAAoC,MAAM,CAAC,QAAQ,IAAI,IAAI;aAClF,MAAM,CAAC,MAAM,IAAI,IAAI,iCAAiC,MAAM,CAAC,MAAM,IAAI,IAAI;aAC3E,IAAI,oCAAoC,IAAI,4BAA4B,IAAI;;YAE7E,KAAK,WAAW,MAAM;GAC/B,CAAC;IACF,MAAM,KAAK,GAAG,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;IAClD,OAAO,EAAE,KAAK,EAAE,IAAI,CAAC,GAAG,CAAC,MAAM,CAAC,EAAE,KAAK,EAAE,CAAC;AAC5C,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,UAAU,CAAC,EAAM,EAAE,EAAU,EAAE,QAAiB;IACpE,MAAM,IAAI,GAAG,MAAM,EAAE,CAAO;;iBAEb,EAAE;aACN,QAAQ,IAAI,IAAI,iCAAiC,QAAQ,IAAI,IAAI;GAC3E,CAAC;IACF,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC;QAAE,MAAM,IAAI,aAAa,CAAC,4BAA4B,CAAC,CAAC;IACpE,OAAO,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC;AACzB,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,mBAAmB,CACvC,EAAM,EACN,EAAU,EACV,MAAqB,EACrB,QAAiB;IAEjB,MAAM,IAAI,GAAG,MAAM,EAAE,CAAA;;mBAEJ,MAAM;iBACR,EAAE;aACN,QAAQ,IAAI,IAAI,iCAAiC,QAAQ,IAAI,IAAI;;GAE3E,CAAC;IACF,OAAO,IAAI,CAAC,KAAK,CAAC;AACpB,CAAC;AAYD,MAAM,CAAC,KAAK,UAAU,UAAU,CAC9B,EAAM,EACN,KAAoH;IAEpH,MAAM,IAAI,GAAG,MAAM,EAAE,CAEpB;;;QAGK,MAAM,EAAE,kDAAkD,KAAK,CAAC,SAAS;QACzE,KAAK,CAAC,YAAY,IAAI,IAAI,KAAK,KAAK,CAAC,UAAU,IAAI,OAAO,KAAK,KAAK,CAAC,IAAI;;;GAG9E,CAAC;IACF,MAAM,CAAC,GAAG,IAAI,CAAC,CAAC,CAAE,CAAC;IACnB,OAAO;QACL,EAAE,EAAE,CAAC,CAAC,EAAE;QACR,SAAS,EAAE,CAAC,CAAC,UAAU;QACvB,YAAY,EAAE,CAAC,CAAC,cAAc;QAC9B,UAAU,EAAE,CAAC,CAAC,WAAW;QACzB,IAAI,EAAE,CAAC,CAAC,IAAI;QACZ,SAAS,EAAE,CAAC,CAAC,UAAU,CAAC,WAAW,EAAE;KACtC,CAAC;AACJ,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,YAAY,CAAC,EAAM,EAAE,SAAiB;IAC1D,MAAM,IAAI,GAAG,MAAM,EAAE,CAEpB;;8CAE2C,SAAS;GACpD,CAAC;IACF,OAAO,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;QACtB,EAAE,EAAE,CAAC,CAAC,EAAE;QACR,SAAS,EAAE,CAAC,CAAC,UAAU;QACvB,YAAY,EAAE,CAAC,CAAC,cAAc;QAC9B,UAAU,EAAE,CAAC,CAAC,WAAW;QACzB,IAAI,EAAE,CAAC,CAAC,IAAI;QACZ,SAAS,EAAE,CAAC,CAAC,UAAU,CAAC,WAAW,EAAE;KACtC,CAAC,CAAC,CAAC;AACN,CAAC"}

package/dist/tenancy/provisioning.d.ts

@@ -0,0 +1,25 @@
+import { type TenantStatus } from '@baruk/shared';
+import type { Db } from '../db/client.js';
+/**
+ * Provisionamento de tenancy (01-multi-tenancy §5 — founding pattern). Todas as
+ * funções são IDEMPOTENTES: rodar o seed duas vezes não duplica nada. As
+ * inserções tenant-scoped derivam `tenant_id` da GUC, satisfazendo a RLS.
+ */
+/** Materializa o catálogo global de permissões e os papéis de sistema (templates). */
+export declare function ensureRbacCatalog(db: Db): Promise<void>;
+export interface EnsureTenantInput {
+    code: string;
+    displayName: string;
+    legalName?: string | null;
+    status?: TenantStatus;
+    primaryProduct?: string;
+}
+/** Cria (ou retorna) o tenant pelo `code`. */
+export declare function ensureTenant(db: Db, input: EnsureTenantInput): Promise<string>;
+/** Cria (ou retorna) a organização/unidade default de um tenant. */
+export declare function ensureOrganization(db: Db, tenantId: string, name: string): Promise<string>;
+/** Vincula um usuário a um tenant (membership ativa). */
+export declare function ensureMembership(db: Db, tenantId: string, userId: string): Promise<string>;
+/** Atribui um papel de sistema (por key) a um usuário dentro de um tenant. */
+export declare function assignSystemRole(db: Db, tenantId: string, userId: string, roleKey: string): Promise<void>;
+//# sourceMappingURL=provisioning.d.ts.map

package/dist/tenancy/provisioning.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"provisioning.d.ts","sourceRoot":"","sources":["../../src/tenancy/provisioning.ts"],"names":[],"mappings":"AAAA,OAAO,EAAU,KAAK,YAAY,EAAE,MAAM,eAAe,CAAC;AAC1D,OAAO,KAAK,EAAE,EAAE,EAAE,MAAM,iBAAiB,CAAC;AAI1C;;;;GAIG;AAEH,sFAAsF;AACtF,wBAAsB,iBAAiB,CAAC,EAAE,EAAE,EAAE,GAAG,OAAO,CAAC,IAAI,CAAC,CAgC7D;AAED,MAAM,WAAW,iBAAiB;IAChC,IAAI,EAAE,MAAM,CAAC;IACb,WAAW,EAAE,MAAM,CAAC;IACpB,SAAS,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IAC1B,MAAM,CAAC,EAAE,YAAY,CAAC;IACtB,cAAc,CAAC,EAAE,MAAM,CAAC;CACzB;AAED,8CAA8C;AAC9C,wBAAsB,YAAY,CAAC,EAAE,EAAE,EAAE,EAAE,KAAK,EAAE,iBAAiB,GAAG,OAAO,CAAC,MAAM,CAAC,CAcpF;AAED,oEAAoE;AACpE,wBAAsB,kBAAkB,CACtC,EAAE,EAAE,EAAE,EACN,QAAQ,EAAE,MAAM,EAChB,IAAI,EAAE,MAAM,GACX,OAAO,CAAC,MAAM,CAAC,CAejB;AAED,yDAAyD;AACzD,wBAAsB,gBAAgB,CAAC,EAAE,EAAE,EAAE,EAAE,QAAQ,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC,CAgBhG;AAED,8EAA8E;AAC9E,wBAAsB,gBAAgB,CACpC,EAAE,EAAE,EAAE,EACN,QAAQ,EAAE,MAAM,EAChB,MAAM,EAAE,MAAM,EACd,OAAO,EAAE,MAAM,GACd,OAAO,CAAC,IAAI,CAAC,CAkBf"}

package/dist/tenancy/provisioning.js

@@ -0,0 +1,119 @@
+import { uuidv7 } from '@baruk/shared';
+import { withContext } from '../db/context.js';
+import { PERMISSIONS, SYSTEM_ROLES } from '../rbac/catalog.js';
+/**
+ * Provisionamento de tenancy (01-multi-tenancy §5 — founding pattern). Todas as
+ * funções são IDEMPOTENTES: rodar o seed duas vezes não duplica nada. As
+ * inserções tenant-scoped derivam `tenant_id` da GUC, satisfazendo a RLS.
+ */
+/** Materializa o catálogo global de permissões e os papéis de sistema (templates). */
+export async function ensureRbacCatalog(db) {
+    for (const p of PERMISSIONS) {
+        await db `
+      INSERT INTO permission (id, key, resource, action, description)
+      VALUES (${uuidv7()}, ${p.key}, ${p.resource}, ${p.action}, ${p.description})
+      ON CONFLICT (key) DO NOTHING
+    `;
+    }
+    for (const role of SYSTEM_ROLES) {
+        const existing = await db `
+      SELECT id FROM role WHERE key = ${role.key} AND tenant_id IS NULL
+    `;
+        let roleId = existing[0]?.id;
+        if (!roleId) {
+            const inserted = await db `
+        INSERT INTO role (id, tenant_id, key, name, is_system)
+        VALUES (${uuidv7()}, NULL, ${role.key}, ${role.name}, true)
+        RETURNING id
+      `;
+            roleId = inserted[0].id;
+        }
+        for (const permKey of role.permissions) {
+            const perm = await db `SELECT id FROM permission WHERE key = ${permKey}`;
+            if (!perm[0])
+                continue;
+            await db `
+        INSERT INTO role_permission (role_id, permission_id, tenant_id)
+        VALUES (${roleId}, ${perm[0].id}, NULL)
+        ON CONFLICT (role_id, permission_id) DO NOTHING
+      `;
+        }
+    }
+}
+/** Cria (ou retorna) o tenant pelo `code`. */
+export async function ensureTenant(db, input) {
+    const existing = await db `
+    SELECT id FROM tenant WHERE lower(code) = lower(${input.code}) AND deleted_at IS NULL
+  `;
+    if (existing[0])
+        return existing[0].id;
+    const rows = await db `
+    INSERT INTO tenant (id, code, legal_name, display_name, status, primary_product)
+    VALUES (
+      ${uuidv7()}, ${input.code}, ${input.legalName ?? null}, ${input.displayName},
+      ${input.status ?? 'active'}, ${input.primaryProduct ?? 'contabil'}
+    )
+    RETURNING id
+  `;
+    return rows[0].id;
+}
+/** Cria (ou retorna) a organização/unidade default de um tenant. */
+export async function ensureOrganization(db, tenantId, name) {
+    return withContext(db, { tenantId }, async (tx) => {
+        const existing = await tx `
+      SELECT id FROM organization
+      WHERE tenant_id = current_setting('app.current_tenant')::uuid
+        AND name = ${name} AND deleted_at IS NULL
+    `;
+        if (existing[0])
+            return existing[0].id;
+        const rows = await tx `
+      INSERT INTO organization (id, tenant_id, name, type)
+      VALUES (${uuidv7()}, current_setting('app.current_tenant')::uuid, ${name}, 'headquarters')
+      RETURNING id
+    `;
+        return rows[0].id;
+    });
+}
+/** Vincula um usuário a um tenant (membership ativa). */
+export async function ensureMembership(db, tenantId, userId) {
+    return withContext(db, { tenantId, userId }, async (tx) => {
+        const existing = await tx `
+      SELECT id FROM membership
+      WHERE user_id = ${userId}
+        AND tenant_id = current_setting('app.current_tenant')::uuid
+        AND deleted_at IS NULL
+    `;
+        if (existing[0])
+            return existing[0].id;
+        const rows = await tx `
+      INSERT INTO membership (id, tenant_id, user_id, status)
+      VALUES (${uuidv7()}, current_setting('app.current_tenant')::uuid, ${userId}, 'active')
+      RETURNING id
+    `;
+        return rows[0].id;
+    });
+}
+/** Atribui um papel de sistema (por key) a um usuário dentro de um tenant. */
+export async function assignSystemRole(db, tenantId, userId, roleKey) {
+    await withContext(db, { tenantId, userId }, async (tx) => {
+        const role = await tx `
+      SELECT id FROM role WHERE key = ${roleKey} AND tenant_id IS NULL
+    `;
+        if (!role[0])
+            throw new Error(`Papel de sistema desconhecido: ${roleKey}`);
+        const existing = await tx `
+      SELECT id FROM user_role
+      WHERE user_id = ${userId} AND role_id = ${role[0].id}
+        AND tenant_id = current_setting('app.current_tenant')::uuid
+        AND deleted_at IS NULL AND organization_id IS NULL AND client_id IS NULL
+    `;
+        if (existing[0])
+            return;
+        await tx `
+      INSERT INTO user_role (id, tenant_id, user_id, role_id)
+      VALUES (${uuidv7()}, current_setting('app.current_tenant')::uuid, ${userId}, ${role[0].id})
+    `;
+    });
+}
+//# sourceMappingURL=provisioning.js.map

package/dist/tenancy/provisioning.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"provisioning.js","sourceRoot":"","sources":["../../src/tenancy/provisioning.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,MAAM,EAAqB,MAAM,eAAe,CAAC;AAE1D,OAAO,EAAE,WAAW,EAAE,MAAM,kBAAkB,CAAC;AAC/C,OAAO,EAAE,WAAW,EAAE,YAAY,EAAE,MAAM,oBAAoB,CAAC;AAE/D;;;;GAIG;AAEH,sFAAsF;AACtF,MAAM,CAAC,KAAK,UAAU,iBAAiB,CAAC,EAAM;IAC5C,KAAK,MAAM,CAAC,IAAI,WAAW,EAAE,CAAC;QAC5B,MAAM,EAAE,CAAA;;gBAEI,MAAM,EAAE,KAAK,CAAC,CAAC,GAAG,KAAK,CAAC,CAAC,QAAQ,KAAK,CAAC,CAAC,MAAM,KAAK,CAAC,CAAC,WAAW;;KAE3E,CAAC;IACJ,CAAC;IAED,KAAK,MAAM,IAAI,IAAI,YAAY,EAAE,CAAC;QAChC,MAAM,QAAQ,GAAG,MAAM,EAAE,CAAkB;wCACP,IAAI,CAAC,GAAG;KAC3C,CAAC;QACF,IAAI,MAAM,GAAG,QAAQ,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC;QAC7B,IAAI,CAAC,MAAM,EAAE,CAAC;YACZ,MAAM,QAAQ,GAAG,MAAM,EAAE,CAAkB;;kBAE/B,MAAM,EAAE,WAAW,IAAI,CAAC,GAAG,KAAK,IAAI,CAAC,IAAI;;OAEpD,CAAC;YACF,MAAM,GAAG,QAAQ,CAAC,CAAC,CAAE,CAAC,EAAE,CAAC;QAC3B,CAAC;QACD,KAAK,MAAM,OAAO,IAAI,IAAI,CAAC,WAAW,EAAE,CAAC;YACvC,MAAM,IAAI,GAAG,MAAM,EAAE,CAAkB,yCAAyC,OAAO,EAAE,CAAC;YAC1F,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC;gBAAE,SAAS;YACvB,MAAM,EAAE,CAAA;;kBAEI,MAAM,KAAK,IAAI,CAAC,CAAC,CAAC,CAAC,EAAE;;OAEhC,CAAC;QACJ,CAAC;IACH,CAAC;AACH,CAAC;AAUD,8CAA8C;AAC9C,MAAM,CAAC,KAAK,UAAU,YAAY,CAAC,EAAM,EAAE,KAAwB;IACjE,MAAM,QAAQ,GAAG,MAAM,EAAE,CAAkB;sDACS,KAAK,CAAC,IAAI;GAC7D,CAAC;IACF,IAAI,QAAQ,CAAC,CAAC,CAAC;QAAE,OAAO,QAAQ,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;IACvC,MAAM,IAAI,GAAG,MAAM,EAAE,CAAkB;;;QAGjC,MAAM,EAAE,KAAK,KAAK,CAAC,IAAI,KAAK,KAAK,CAAC,SAAS,IAAI,IAAI,KAAK,KAAK,CAAC,WAAW;QACzE,KAAK,CAAC,MAAM,IAAI,QAAQ,KAAK,KAAK,CAAC,cAAc,IAAI,UAAU;;;GAGpE,CAAC;IACF,OAAO,IAAI,CAAC,CAAC,CAAE,CAAC,EAAE,CAAC;AACrB,CAAC;AAED,oEAAoE;AACpE,MAAM,CAAC,KAAK,UAAU,kBAAkB,CACtC,EAAM,EACN,QAAgB,EAChB,IAAY;IAEZ,OAAO,WAAW,CAAC,EAAE,EAAE,EAAE,QAAQ,EAAE,EAAE,KAAK,EAAE,EAAE,EAAE,EAAE;QAChD,MAAM,QAAQ,GAAG,MAAM,EAAE,CAAkB;;;qBAG1B,IAAI;KACpB,CAAC;QACF,IAAI,QAAQ,CAAC,CAAC,CAAC;YAAE,OAAO,QAAQ,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;QACvC,MAAM,IAAI,GAAG,MAAM,EAAE,CAAkB;;gBAE3B,MAAM,EAAE,kDAAkD,IAAI;;KAEzE,CAAC;QACF,OAAO,IAAI,CAAC,CAAC,CAAE,CAAC,EAAE,CAAC;IACrB,CAAC,CAAC,CAAC;AACL,CAAC;AAED,yDAAyD;AACzD,MAAM,CAAC,KAAK,UAAU,gBAAgB,CAAC,EAAM,EAAE,QAAgB,EAAE,MAAc;IAC7E,OAAO,WAAW,CAAC,EAAE,EAAE,EAAE,QAAQ,EAAE,MAAM,EAAE,EAAE,KAAK,EAAE,EAAE,EAAE,EAAE;QACxD,MAAM,QAAQ,GAAG,MAAM,EAAE,CAAkB;;wBAEvB,MAAM;;;KAGzB,CAAC;QACF,IAAI,QAAQ,CAAC,CAAC,CAAC;YAAE,OAAO,QAAQ,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;QACvC,MAAM,IAAI,GAAG,MAAM,EAAE,CAAkB;;gBAE3B,MAAM,EAAE,kDAAkD,MAAM;;KAE3E,CAAC;QACF,OAAO,IAAI,CAAC,CAAC,CAAE,CAAC,EAAE,CAAC;IACrB,CAAC,CAAC,CAAC;AACL,CAAC;AAED,8EAA8E;AAC9E,MAAM,CAAC,KAAK,UAAU,gBAAgB,CACpC,EAAM,EACN,QAAgB,EAChB,MAAc,EACd,OAAe;IAEf,MAAM,WAAW,CAAC,EAAE,EAAE,EAAE,QAAQ,EAAE,MAAM,EAAE,EAAE,KAAK,EAAE,EAAE,EAAE,EAAE;QACvD,MAAM,IAAI,GAAG,MAAM,EAAE,CAAkB;wCACH,OAAO;KAC1C,CAAC;QACF,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC;YAAE,MAAM,IAAI,KAAK,CAAC,kCAAkC,OAAO,EAAE,CAAC,CAAC;QAC3E,MAAM,QAAQ,GAAG,MAAM,EAAE,CAAkB;;wBAEvB,MAAM,kBAAkB,IAAI,CAAC,CAAC,CAAC,CAAC,EAAE;;;KAGrD,CAAC;QACF,IAAI,QAAQ,CAAC,CAAC,CAAC;YAAE,OAAO;QACxB,MAAM,EAAE,CAAA;;gBAEI,MAAM,EAAE,kDAAkD,MAAM,KAAK,IAAI,CAAC,CAAC,CAAC,CAAC,EAAE;KAC1F,CAAC;IACJ,CAAC,CAAC,CAAC;AACL,CAAC"}

package/dist/users/repository.d.ts

@@ -0,0 +1,19 @@
+import type { Tx } from '../db/client.js';
+/**
+ * Gestão de usuários e memberships DENTRO do tenant corrente (RLS garante o
+ * escopo). Inclui a proteção contra remoção/rebaixamento do último administrador.
+ */
+export interface TenantMember {
+    userId: string;
+    email: string;
+    fullName: string;
+    userType: string;
+    membershipStatus: string;
+    roles: string[];
+}
+export declare function listTenantMembers(tx: Tx): Promise<TenantMember[]>;
+/** Substitui o(s) papel(is) do usuário no tenant por um único papel (por key). */
+export declare function setUserRole(tx: Tx, userId: string, roleKey: string): Promise<void>;
+/** Ativa/desativa (ou revoga) a membership. Bloqueia desativar o último admin. */
+export declare function setMembershipStatus(tx: Tx, userId: string, status: 'active' | 'invited' | 'revoked'): Promise<number>;
+//# sourceMappingURL=repository.d.ts.map

package/dist/users/repository.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"repository.d.ts","sourceRoot":"","sources":["../../src/users/repository.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EAAE,EAAE,EAAE,MAAM,iBAAiB,CAAC;AAE1C;;;GAGG;AACH,MAAM,WAAW,YAAY;IAC3B,MAAM,EAAE,MAAM,CAAC;IACf,KAAK,EAAE,MAAM,CAAC;IACd,QAAQ,EAAE,MAAM,CAAC;IACjB,QAAQ,EAAE,MAAM,CAAC;IACjB,gBAAgB,EAAE,MAAM,CAAC;IACzB,KAAK,EAAE,MAAM,EAAE,CAAC;CACjB;AAID,wBAAsB,iBAAiB,CAAC,EAAE,EAAE,EAAE,GAAG,OAAO,CAAC,YAAY,EAAE,CAAC,CAuBvE;AAeD,kFAAkF;AAClF,wBAAsB,WAAW,CAAC,EAAE,EAAE,EAAE,EAAE,MAAM,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAiBxF;AAWD,kFAAkF;AAClF,wBAAsB,mBAAmB,CACvC,EAAE,EAAE,EAAE,EACN,MAAM,EAAE,MAAM,EACd,MAAM,EAAE,QAAQ,GAAG,SAAS,GAAG,SAAS,GACvC,OAAO,CAAC,MAAM,CAAC,CAWjB"}