@baruk/core 0.1.0

package/dist/users/repository.js

@@ -0,0 +1,78 @@
+import { ConflictError, uuidv7 } from '@baruk/shared';
+const ADMIN_ROLE_KEYS = ['owner', 'admin'];
+export async function listTenantMembers(tx) {
+    const rows = await tx `
+    SELECT
+      m.user_id, u.email, u.full_name, u.user_type, m.status,
+      array_remove(array_agg(DISTINCT r.key), NULL) AS role_keys
+    FROM membership m
+    JOIN "user" u ON u.id = m.user_id
+    LEFT JOIN user_role ur ON ur.user_id = m.user_id AND ur.deleted_at IS NULL
+    LEFT JOIN role r ON r.id = ur.role_id
+    WHERE m.deleted_at IS NULL
+    GROUP BY m.user_id, u.email, u.full_name, u.user_type, m.status
+    ORDER BY u.full_name
+  `;
+    return rows.map((r) => ({
+        userId: r.user_id,
+        email: r.email,
+        fullName: r.full_name,
+        userType: r.user_type,
+        membershipStatus: r.status,
+        roles: r.role_keys ?? [],
+    }));
+}
+async function countActiveAdmins(tx, excludeUserId) {
+    const rows = await tx `
+    SELECT count(DISTINCT m.user_id)::int AS n
+    FROM membership m
+    JOIN user_role ur ON ur.user_id = m.user_id AND ur.deleted_at IS NULL
+    JOIN role r ON r.id = ur.role_id
+    WHERE m.status = 'active' AND m.deleted_at IS NULL
+      AND r.key = ANY(${ADMIN_ROLE_KEYS})
+      AND (${excludeUserId ?? null}::uuid IS NULL OR m.user_id <> ${excludeUserId ?? null})
+  `;
+    return rows[0]?.n ?? 0;
+}
+/** Substitui o(s) papel(is) do usuário no tenant por um único papel (por key). */
+export async function setUserRole(tx, userId, roleKey) {
+    // Guard: não permitir rebaixar o último admin.
+    const isAdminTarget = ADMIN_ROLE_KEYS.includes(roleKey);
+    if (!isAdminTarget && (await isUserAdmin(tx, userId)) && (await countActiveAdmins(tx, userId)) === 0) {
+        throw new ConflictError('Não é possível rebaixar o último administrador do tenant');
+    }
+    const role = await tx `SELECT id FROM role WHERE key = ${roleKey} AND tenant_id IS NULL`;
+    if (!role[0])
+        throw new ConflictError(`Papel desconhecido: ${roleKey}`);
+    await tx `
+    UPDATE user_role SET deleted_at = now()
+    WHERE user_id = ${userId} AND deleted_at IS NULL
+      AND tenant_id = current_setting('app.current_tenant')::uuid
+  `;
+    await tx `
+    INSERT INTO user_role (id, tenant_id, user_id, role_id)
+    VALUES (${uuidv7()}, current_setting('app.current_tenant')::uuid, ${userId}, ${role[0].id})
+  `;
+}
+async function isUserAdmin(tx, userId) {
+    const rows = await tx `
+    SELECT count(*)::int AS n
+    FROM user_role ur JOIN role r ON r.id = ur.role_id
+    WHERE ur.user_id = ${userId} AND ur.deleted_at IS NULL AND r.key = ANY(${ADMIN_ROLE_KEYS})
+  `;
+    return (rows[0]?.n ?? 0) > 0;
+}
+/** Ativa/desativa (ou revoga) a membership. Bloqueia desativar o último admin. */
+export async function setMembershipStatus(tx, userId, status) {
+    if (status !== 'active' && (await isUserAdmin(tx, userId)) && (await countActiveAdmins(tx, userId)) === 0) {
+        throw new ConflictError('Não é possível desativar o último administrador do tenant');
+    }
+    const rows = await tx `
+    UPDATE membership SET status = ${status}, updated_at = now()
+    WHERE user_id = ${userId} AND deleted_at IS NULL
+      AND tenant_id = current_setting('app.current_tenant')::uuid
+    RETURNING id
+  `;
+    return rows.count;
+}
+//# sourceMappingURL=repository.js.map

package/dist/users/repository.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"repository.js","sourceRoot":"","sources":["../../src/users/repository.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,aAAa,EAAE,MAAM,EAAE,MAAM,eAAe,CAAC;AAgBtD,MAAM,eAAe,GAAG,CAAC,OAAO,EAAE,OAAO,CAAC,CAAC;AAE3C,MAAM,CAAC,KAAK,UAAU,iBAAiB,CAAC,EAAM;IAC5C,MAAM,IAAI,GAAG,MAAM,EAAE,CAEpB;;;;;;;;;;;GAWA,CAAC;IACF,OAAO,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;QACtB,MAAM,EAAE,CAAC,CAAC,OAAO;QACjB,KAAK,EAAE,CAAC,CAAC,KAAK;QACd,QAAQ,EAAE,CAAC,CAAC,SAAS;QACrB,QAAQ,EAAE,CAAC,CAAC,SAAS;QACrB,gBAAgB,EAAE,CAAC,CAAC,MAAM;QAC1B,KAAK,EAAE,CAAC,CAAC,SAAS,IAAI,EAAE;KACzB,CAAC,CAAC,CAAC;AACN,CAAC;AAED,KAAK,UAAU,iBAAiB,CAAC,EAAM,EAAE,aAAsB;IAC7D,MAAM,IAAI,GAAG,MAAM,EAAE,CAAiB;;;;;;wBAMhB,eAAe;aAC1B,aAAa,IAAI,IAAI,kCAAkC,aAAa,IAAI,IAAI;GACtF,CAAC;IACF,OAAO,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,IAAI,CAAC,CAAC;AACzB,CAAC;AAED,kFAAkF;AAClF,MAAM,CAAC,KAAK,UAAU,WAAW,CAAC,EAAM,EAAE,MAAc,EAAE,OAAe;IACvE,+CAA+C;IAC/C,MAAM,aAAa,GAAG,eAAe,CAAC,QAAQ,CAAC,OAAO,CAAC,CAAC;IACxD,IAAI,CAAC,aAAa,IAAI,CAAC,MAAM,WAAW,CAAC,EAAE,EAAE,MAAM,CAAC,CAAC,IAAI,CAAC,MAAM,iBAAiB,CAAC,EAAE,EAAE,MAAM,CAAC,CAAC,KAAK,CAAC,EAAE,CAAC;QACrG,MAAM,IAAI,aAAa,CAAC,0DAA0D,CAAC,CAAC;IACtF,CAAC;IACD,MAAM,IAAI,GAAG,MAAM,EAAE,CAAkB,mCAAmC,OAAO,wBAAwB,CAAC;IAC1G,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC;QAAE,MAAM,IAAI,aAAa,CAAC,uBAAuB,OAAO,EAAE,CAAC,CAAC;IACxE,MAAM,EAAE,CAAA;;sBAEY,MAAM;;GAEzB,CAAC;IACF,MAAM,EAAE,CAAA;;cAEI,MAAM,EAAE,kDAAkD,MAAM,KAAK,IAAI,CAAC,CAAC,CAAC,CAAC,EAAE;GAC1F,CAAC;AACJ,CAAC;AAED,KAAK,UAAU,WAAW,CAAC,EAAM,EAAE,MAAc;IAC/C,MAAM,IAAI,GAAG,MAAM,EAAE,CAAiB;;;yBAGf,MAAM,8CAA8C,eAAe;GACzF,CAAC;IACF,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,IAAI,CAAC,CAAC,GAAG,CAAC,CAAC;AAC/B,CAAC;AAED,kFAAkF;AAClF,MAAM,CAAC,KAAK,UAAU,mBAAmB,CACvC,EAAM,EACN,MAAc,EACd,MAAwC;IAExC,IAAI,MAAM,KAAK,QAAQ,IAAI,CAAC,MAAM,WAAW,CAAC,EAAE,EAAE,MAAM,CAAC,CAAC,IAAI,CAAC,MAAM,iBAAiB,CAAC,EAAE,EAAE,MAAM,CAAC,CAAC,KAAK,CAAC,EAAE,CAAC;QAC1G,MAAM,IAAI,aAAa,CAAC,2DAA2D,CAAC,CAAC;IACvF,CAAC;IACD,MAAM,IAAI,GAAG,MAAM,EAAE,CAAA;qCACc,MAAM;sBACrB,MAAM;;;GAGzB,CAAC;IACF,OAAO,IAAI,CAAC,KAAK,CAAC;AACpB,CAAC"}

package/package.json

@@ -0,0 +1,41 @@
+{
+  "name": "@baruk/core",
+  "version": "0.1.0",
+  "license": "UNLICENSED",
+  "type": "module",
+  "publishConfig": {
+    "registry": "https://registry.npmjs.org",
+    "access": "public"
+  },
+  "main": "./dist/index.js",
+  "types": "./dist/index.d.ts",
+  "exports": {
+    ".": {
+      "types": "./dist/index.d.ts",
+      "default": "./dist/index.js"
+    }
+  },
+  "files": [
+    "dist",
+    "!dist/__tests__",
+    "src/db/migrations"
+  ],
+  "dependencies": {
+    "@baruk/identity": "^0.2.0",
+    "postgres": "^3.4.5",
+    "zod": "^3.24.1",
+    "@baruk/shared": "^0.1.0"
+  },
+  "devDependencies": {
+    "tsx": "^4.19.2"
+  },
+  "scripts": {
+    "clean": "node -e \"require('fs').rmSync('dist',{recursive:true,force:true})\"",
+    "build": "node -e \"require('fs').rmSync('dist',{recursive:true,force:true})\" && tsc -p tsconfig.json",
+    "typecheck": "tsc -p tsconfig.json --noEmit",
+    "lint": "eslint src",
+    "test": "vitest run --passWithNoTests",
+    "migrate": "tsx src/db/migrate.ts",
+    "seed": "tsx src/db/seed.ts"
+  }
+}

package/src/db/migrations/0001_extensions.sql

@@ -0,0 +1,5 @@
+-- 0001 — Extensões necessárias.
+-- citext: e-mails case-insensitive (03-data-model §6.1). UUIDs são gerados na
+-- aplicação (uuidv7), portanto não dependemos de pgcrypto/uuid-ossp para PKs.
+
+CREATE EXTENSION IF NOT EXISTS citext;

package/src/db/migrations/0002_core_identity.sql

@@ -0,0 +1,78 @@
+-- 0002 — Identidade & Acesso (entidades globais de SSO) + organização.
+-- Entidades GLOBAIS (sem tenant_id): tenant, "user", user_credential,
+-- user_session, permission. Justificativa: SSO central, um login por staff
+-- acessando vários tenants (ADR 0002 / 03-data-model §2.2). O vínculo ao tenant
+-- vive em `membership` (migration 0003), que é tenant-scoped + RLS.
+
+-- ── tenant (raiz da árvore de tenancy) ──────────────────────────────────────
+CREATE TABLE tenant (
+  id              uuid PRIMARY KEY,
+  code            text NOT NULL,
+  legal_name      text,
+  display_name    text NOT NULL,
+  status          text NOT NULL DEFAULT 'trial'
+                    CHECK (status IN ('active', 'suspended', 'trial', 'churned')),
+  primary_product text NOT NULL DEFAULT 'contabil',
+  settings        jsonb NOT NULL DEFAULT '{}'::jsonb,
+  created_at      timestamptz NOT NULL DEFAULT now(),
+  updated_at      timestamptz NOT NULL DEFAULT now(),
+  deleted_at      timestamptz
+);
+CREATE UNIQUE INDEX tenant_code_uq ON tenant (lower(code)) WHERE deleted_at IS NULL;
+
+-- ── user (identidade única de SSO — global) ─────────────────────────────────
+CREATE TABLE "user" (
+  id            uuid PRIMARY KEY,
+  email         citext NOT NULL,
+  full_name     text NOT NULL,
+  user_type     text NOT NULL DEFAULT 'staff'
+                  CHECK (user_type IN ('staff', 'client_portal', 'service')),
+  status        text NOT NULL DEFAULT 'active'
+                  CHECK (status IN ('active', 'invited', 'disabled')),
+  auth_provider text NOT NULL DEFAULT 'password'
+                  CHECK (auth_provider IN ('password', 'oidc', 'magic_link')),
+  last_login_at timestamptz,
+  metadata      jsonb NOT NULL DEFAULT '{}'::jsonb,
+  created_at    timestamptz NOT NULL DEFAULT now(),
+  updated_at    timestamptz NOT NULL DEFAULT now(),
+  deleted_at    timestamptz
+);
+CREATE UNIQUE INDEX user_email_uq ON "user" (email) WHERE deleted_at IS NULL;
+
+-- ── user_credential (hash de senha p/ auth local — fundação/dev) ────────────
+-- Concessão da fundação: em produção a autenticação vai para o IdP central
+-- (OIDC); aqui guardamos apenas o hash scrypt (nunca a senha) para o walking
+-- skeleton local. Global (segue `user`). NUNCA guarda segredo em claro.
+CREATE TABLE user_credential (
+  user_id       uuid PRIMARY KEY REFERENCES "user"(id) ON DELETE CASCADE,
+  password_hash text NOT NULL,
+  updated_at    timestamptz NOT NULL DEFAULT now()
+);
+
+-- ── user_session (sessão opaca — global, resolvida por hash do token) ───────
+CREATE TABLE user_session (
+  id               uuid PRIMARY KEY,
+  user_id          uuid NOT NULL REFERENCES "user"(id) ON DELETE CASCADE,
+  token_hash       text NOT NULL,
+  active_tenant_id uuid REFERENCES tenant(id),
+  created_at       timestamptz NOT NULL DEFAULT now(),
+  expires_at       timestamptz NOT NULL,
+  revoked_at       timestamptz
+);
+CREATE UNIQUE INDEX user_session_token_uq ON user_session (token_hash);
+CREATE INDEX user_session_user_idx ON user_session (user_id);
+
+-- ── organization (unidade dentro de um tenant — tenant-scoped) ──────────────
+CREATE TABLE organization (
+  id             uuid PRIMARY KEY,
+  tenant_id      uuid NOT NULL REFERENCES tenant(id),
+  name           text NOT NULL,
+  type           text NOT NULL DEFAULT 'headquarters'
+                   CHECK (type IN ('headquarters', 'branch', 'department')),
+  parent_org_id  uuid REFERENCES organization(id),
+  metadata       jsonb NOT NULL DEFAULT '{}'::jsonb,
+  created_at     timestamptz NOT NULL DEFAULT now(),
+  updated_at     timestamptz NOT NULL DEFAULT now(),
+  deleted_at     timestamptz
+);
+CREATE INDEX organization_tenant_idx ON organization (tenant_id);

package/src/db/migrations/0003_rbac.sql

@@ -0,0 +1,68 @@
+-- 0003 — RBAC: permission (catálogo global), role (templates + por tenant),
+-- role_permission, membership (vínculo user×tenant), user_role.
+-- Detalhes em 04-rbac-permissions.md.
+
+-- ── permission (catálogo global, read-only) ─────────────────────────────────
+CREATE TABLE permission (
+  id          uuid PRIMARY KEY,
+  key         text NOT NULL,
+  resource    text NOT NULL,
+  action      text NOT NULL,
+  description text,
+  created_at  timestamptz NOT NULL DEFAULT now()
+);
+CREATE UNIQUE INDEX permission_key_uq ON permission (key);
+
+-- ── role (tenant_id NULL = template de sistema; preenchido = papel do tenant) ─
+CREATE TABLE role (
+  id         uuid PRIMARY KEY,
+  tenant_id  uuid REFERENCES tenant(id),
+  key        text NOT NULL,
+  name       text NOT NULL,
+  is_system  boolean NOT NULL DEFAULT false,
+  created_at timestamptz NOT NULL DEFAULT now()
+);
+-- Um template por key (tenant_id NULL) e um por (tenant, key).
+CREATE UNIQUE INDEX role_system_key_uq ON role (key) WHERE tenant_id IS NULL;
+CREATE UNIQUE INDEX role_tenant_key_uq ON role (tenant_id, key) WHERE tenant_id IS NOT NULL;
+
+-- ── role_permission (N:N role↔permission) ───────────────────────────────────
+CREATE TABLE role_permission (
+  role_id       uuid NOT NULL REFERENCES role(id) ON DELETE CASCADE,
+  permission_id uuid NOT NULL REFERENCES permission(id) ON DELETE CASCADE,
+  tenant_id     uuid REFERENCES tenant(id),
+  PRIMARY KEY (role_id, permission_id)
+);
+
+-- ── membership (vínculo user×tenant — porta de entrada do isolamento staff) ──
+CREATE TABLE membership (
+  id              uuid PRIMARY KEY,
+  tenant_id       uuid NOT NULL REFERENCES tenant(id),
+  user_id         uuid NOT NULL REFERENCES "user"(id),
+  organization_id uuid REFERENCES organization(id),
+  status          text NOT NULL DEFAULT 'active'
+                    CHECK (status IN ('active', 'invited', 'revoked')),
+  invited_by      uuid REFERENCES "user"(id),
+  created_at      timestamptz NOT NULL DEFAULT now(),
+  updated_at      timestamptz NOT NULL DEFAULT now(),
+  deleted_at      timestamptz
+);
+CREATE UNIQUE INDEX membership_tenant_user_uq
+  ON membership (tenant_id, user_id) WHERE deleted_at IS NULL;
+CREATE INDEX membership_user_idx ON membership (user_id);
+
+-- ── user_role (atribuição de papel a um usuário dentro de um tenant) ─────────
+CREATE TABLE user_role (
+  id              uuid PRIMARY KEY,
+  tenant_id       uuid NOT NULL REFERENCES tenant(id),
+  user_id         uuid NOT NULL REFERENCES "user"(id),
+  role_id         uuid NOT NULL REFERENCES role(id),
+  organization_id uuid REFERENCES organization(id),
+  client_id       uuid,
+  created_at      timestamptz NOT NULL DEFAULT now(),
+  deleted_at      timestamptz
+);
+CREATE UNIQUE INDEX user_role_uq
+  ON user_role (tenant_id, user_id, role_id)
+  WHERE deleted_at IS NULL AND organization_id IS NULL AND client_id IS NULL;
+CREATE INDEX user_role_tenant_user_idx ON user_role (tenant_id, user_id);

package/src/db/migrations/0004_directory.sql

@@ -0,0 +1,35 @@
+-- 0004 — Directory/CRM: `client` (o cliente do escritório, PF/PJ).
+-- Entidade de NEGÓCIO tenant-scoped — é a "estrela" dos testes de isolamento RLS.
+-- (03-data-model §6.2). Detalhes PF/PJ ficam para fases seguintes.
+
+CREATE TABLE client (
+  id              uuid PRIMARY KEY,
+  tenant_id       uuid NOT NULL REFERENCES tenant(id),
+  client_type     text NOT NULL DEFAULT 'pj' CHECK (client_type IN ('pf', 'pj')),
+  code            text,
+  display_name    text NOT NULL,
+  legal_name      text,
+  document_number text,                       -- CPF/CNPJ normalizado (só dígitos)
+  status          text NOT NULL DEFAULT 'active'
+                    CHECK (status IN ('active', 'inactive', 'prospect', 'archived')),
+  email           citext,
+  phone           text,
+  onboarded_at    date,
+  metadata        jsonb NOT NULL DEFAULT '{}'::jsonb,
+  created_at      timestamptz NOT NULL DEFAULT now(),
+  updated_at      timestamptz NOT NULL DEFAULT now(),
+  deleted_at      timestamptz,
+  created_by      uuid REFERENCES "user"(id),
+  updated_by      uuid REFERENCES "user"(id),
+  version         int NOT NULL DEFAULT 1,
+  -- Permite FK composta (tenant_id, id) a partir das verticais: garante, no
+  -- nível referencial, que um registro de outro tenant NUNCA seja referenciado
+  -- (FKs ignoram RLS, então a integridade same-tenant precisa ser estrutural —
+  -- 03-data-model §5).
+  CONSTRAINT client_tenant_id_uq UNIQUE (tenant_id, id)
+);
+-- Documento único por tenant (índice único parcial permite reusar após soft-delete).
+CREATE UNIQUE INDEX client_tenant_document_uq
+  ON client (tenant_id, document_number)
+  WHERE deleted_at IS NULL AND document_number IS NOT NULL;
+CREATE INDEX client_tenant_status_idx ON client (tenant_id, status);

package/src/db/migrations/0005_audit.sql

@@ -0,0 +1,35 @@
+-- 0005 — Auditoria append-only (03-data-model §6.9 / 06-audit.md).
+-- Nunca sofre UPDATE/DELETE: um trigger bloqueia mutações e o papel de app
+-- não recebe privilégio de UPDATE/DELETE (defesa em profundidade).
+
+CREATE TABLE audit_log (
+  id            uuid PRIMARY KEY,               -- v7: ordenável no tempo
+  tenant_id     uuid NOT NULL REFERENCES tenant(id),
+  actor_type    text NOT NULL DEFAULT 'user'
+                  CHECK (actor_type IN ('user', 'system', 'automation', 'ai_agent', 'api_key')),
+  actor_id      uuid REFERENCES "user"(id),
+  action        text NOT NULL,                  -- create|update|delete|login|select_tenant|export…
+  resource_type text NOT NULL,
+  resource_id   uuid,
+  result        text NOT NULL DEFAULT 'success'
+                  CHECK (result IN ('success', 'failure', 'denied')),
+  diff          jsonb,                          -- antes/depois (segredos redigidos)
+  metadata      jsonb NOT NULL DEFAULT '{}'::jsonb,
+  ip            inet,
+  user_agent    text,
+  occurred_at   timestamptz NOT NULL DEFAULT now()
+);
+CREATE INDEX audit_log_tenant_time_idx ON audit_log (tenant_id, occurred_at DESC);
+CREATE INDEX audit_log_resource_idx ON audit_log (tenant_id, resource_type, resource_id);
+
+-- Guarda de imutabilidade: proíbe UPDATE/DELETE em qualquer papel.
+CREATE OR REPLACE FUNCTION audit_log_block_mutation()
+RETURNS trigger LANGUAGE plpgsql AS $$
+BEGIN
+  RAISE EXCEPTION 'audit_log é append-only: % não é permitido', TG_OP;
+END;
+$$;
+
+CREATE TRIGGER audit_log_no_update
+  BEFORE UPDATE OR DELETE ON audit_log
+  FOR EACH ROW EXECUTE FUNCTION audit_log_block_mutation();

package/src/db/migrations/0006_rls_policies.sql

@@ -0,0 +1,69 @@
+-- 0006 — Row-Level Security (RLS) em todas as tabelas tenant-scoped.
+--
+-- Mecânica (01-multi-tenancy §2 / 05-security §7.1):
+--   • A GUC `app.current_tenant` é setada por transação via set_config(...,true)
+--     (equivale a SET LOCAL) — ver src/db/context.ts. Nunca vem do cliente.
+--   • `NULLIF(current_setting('app.current_tenant', true), '')::uuid` devolve
+--     NULL quando a GUC não está setada OU voltou a '' após um SET LOCAL numa
+--     conexão reusada do pool (GUCs customizadas revertem para '' , não p/ unset).
+--     Com NULL → `tenant_id = NULL` é falso → NENHUMA linha retorna nem pode ser
+--     inserida: comportamento FAIL-CLOSED por construção (sem erro de cast '').
+--   • ENABLE + FORCE: FORCE sujeita ATÉ O DONO da tabela à RLS (o papel de
+--     migração/seed também precisa do contexto correto para escrever).
+--   • O papel de aplicação (baruk_app) é NOSUPERUSER e NOBYPASSRLS (ver runner).
+--
+-- Entidades globais (tenant, "user", user_credential, user_session, permission)
+-- NÃO recebem RLS por design (SSO/catálogo — 03-data-model §2.2). O escopo de
+-- quais tenants um usuário enxerga é aplicado por JOIN em `membership` (que TEM RLS).
+
+-- ── organization ────────────────────────────────────────────────────────────
+ALTER TABLE organization ENABLE ROW LEVEL SECURITY;
+ALTER TABLE organization FORCE ROW LEVEL SECURITY;
+CREATE POLICY organization_tenant_isolation ON organization
+  USING (tenant_id = NULLIF(current_setting('app.current_tenant', true), '')::uuid)
+  WITH CHECK (tenant_id = NULLIF(current_setting('app.current_tenant', true), '')::uuid);
+
+-- ── membership (com cláusula "self": o usuário vê os próprios vínculos para o
+--    seletor de tenant do SSO, antes de escolher um tenant ativo) ─────────────
+ALTER TABLE membership ENABLE ROW LEVEL SECURITY;
+ALTER TABLE membership FORCE ROW LEVEL SECURITY;
+CREATE POLICY membership_isolation ON membership
+  USING (
+    tenant_id = NULLIF(current_setting('app.current_tenant', true), '')::uuid
+    OR user_id = NULLIF(current_setting('app.current_user', true), '')::uuid
+  )
+  WITH CHECK (tenant_id = NULLIF(current_setting('app.current_tenant', true), '')::uuid);
+
+-- ── user_role ───────────────────────────────────────────────────────────────
+ALTER TABLE user_role ENABLE ROW LEVEL SECURITY;
+ALTER TABLE user_role FORCE ROW LEVEL SECURITY;
+CREATE POLICY user_role_tenant_isolation ON user_role
+  USING (tenant_id = NULLIF(current_setting('app.current_tenant', true), '')::uuid)
+  WITH CHECK (tenant_id = NULLIF(current_setting('app.current_tenant', true), '')::uuid);
+
+-- ── client (entidade de negócio — foco dos testes de isolamento) ────────────
+ALTER TABLE client ENABLE ROW LEVEL SECURITY;
+ALTER TABLE client FORCE ROW LEVEL SECURITY;
+CREATE POLICY client_tenant_isolation ON client
+  USING (tenant_id = NULLIF(current_setting('app.current_tenant', true), '')::uuid)
+  WITH CHECK (tenant_id = NULLIF(current_setting('app.current_tenant', true), '')::uuid);
+
+-- ── audit_log (tenant-scoped; append-only garantido pelo trigger de 0005) ────
+ALTER TABLE audit_log ENABLE ROW LEVEL SECURITY;
+ALTER TABLE audit_log FORCE ROW LEVEL SECURITY;
+CREATE POLICY audit_log_tenant_isolation ON audit_log
+  USING (tenant_id = NULLIF(current_setting('app.current_tenant', true), '')::uuid)
+  WITH CHECK (tenant_id = NULLIF(current_setting('app.current_tenant', true), '')::uuid);
+
+-- ── role / role_permission (template global tenant_id IS NULL, ou do tenant) ─
+ALTER TABLE role ENABLE ROW LEVEL SECURITY;
+ALTER TABLE role FORCE ROW LEVEL SECURITY;
+CREATE POLICY role_visibility ON role
+  USING (tenant_id IS NULL OR tenant_id = NULLIF(current_setting('app.current_tenant', true), '')::uuid)
+  WITH CHECK (tenant_id IS NULL OR tenant_id = NULLIF(current_setting('app.current_tenant', true), '')::uuid);
+
+ALTER TABLE role_permission ENABLE ROW LEVEL SECURITY;
+ALTER TABLE role_permission FORCE ROW LEVEL SECURITY;
+CREATE POLICY role_permission_visibility ON role_permission
+  USING (tenant_id IS NULL OR tenant_id = NULLIF(current_setting('app.current_tenant', true), '')::uuid)
+  WITH CHECK (tenant_id IS NULL OR tenant_id = NULLIF(current_setting('app.current_tenant', true), '')::uuid);

package/src/db/migrations/0007_requests_notifications_portal.sql

@@ -0,0 +1,103 @@
+-- 0007 — Ciclo operacional escritório↔cliente: solicitações, comentários,
+-- notificações in-app e acesso de portal do cliente. Todas tenant-scoped com
+-- RLS FORCE + FK composta (tenant_id, id) para impedir vínculo cross-tenant.
+
+-- ── service_request (solicitação) ───────────────────────────────────────────
+CREATE TABLE service_request (
+  id                  uuid PRIMARY KEY,
+  tenant_id           uuid NOT NULL REFERENCES tenant(id),
+  client_id           uuid NOT NULL,
+  title               text NOT NULL,
+  description         text,
+  category            text NOT NULL DEFAULT 'geral',
+  competence_label    text,                          -- ex.: '2026-07' (competência simplificada nesta fase)
+  priority            text NOT NULL DEFAULT 'medium'
+                        CHECK (priority IN ('low', 'medium', 'high', 'urgent')),
+  status              text NOT NULL DEFAULT 'draft'
+                        CHECK (status IN ('draft','sent','viewed','awaiting_client',
+                                          'answered','in_review','done','canceled','overdue')),
+  due_date            date,
+  responsible_user_id uuid REFERENCES "user"(id),
+  created_by          uuid REFERENCES "user"(id),
+  created_at          timestamptz NOT NULL DEFAULT now(),
+  updated_at          timestamptz NOT NULL DEFAULT now(),
+  deleted_at          timestamptz,
+  version             int NOT NULL DEFAULT 1,
+  CONSTRAINT service_request_tenant_id_uq UNIQUE (tenant_id, id),
+  FOREIGN KEY (tenant_id, client_id) REFERENCES client (tenant_id, id)
+);
+CREATE INDEX service_request_tenant_status_idx ON service_request (tenant_id, status, due_date);
+CREATE INDEX service_request_tenant_client_idx ON service_request (tenant_id, client_id);
+
+-- ── request_comment (thread da solicitação) ─────────────────────────────────
+CREATE TABLE request_comment (
+  id             uuid PRIMARY KEY,
+  tenant_id      uuid NOT NULL REFERENCES tenant(id),
+  request_id     uuid NOT NULL,
+  author_user_id uuid REFERENCES "user"(id),
+  author_kind    text NOT NULL DEFAULT 'staff'
+                   CHECK (author_kind IN ('staff', 'client', 'system')),
+  body           text NOT NULL,
+  created_at     timestamptz NOT NULL DEFAULT now(),
+  FOREIGN KEY (tenant_id, request_id) REFERENCES service_request (tenant_id, id)
+);
+CREATE INDEX request_comment_thread_idx ON request_comment (tenant_id, request_id, created_at);
+
+-- ── notification (in-app) ───────────────────────────────────────────────────
+CREATE TABLE notification (
+  id                 uuid PRIMARY KEY,
+  tenant_id          uuid NOT NULL REFERENCES tenant(id),
+  user_id            uuid NOT NULL REFERENCES "user"(id),
+  type               text NOT NULL DEFAULT 'info'
+                       CHECK (type IN ('info', 'warning', 'action_required')),
+  title              text NOT NULL,
+  body               text,
+  link_ref           jsonb,
+  read_at            timestamptz,
+  delivered_channels jsonb NOT NULL DEFAULT '["in_app"]'::jsonb,
+  created_at         timestamptz NOT NULL DEFAULT now()
+);
+CREATE INDEX notification_user_idx ON notification (tenant_id, user_id, created_at DESC);
+
+-- ── client_portal_access (liga um usuário de portal a um client específico) ──
+CREATE TABLE client_portal_access (
+  id         uuid PRIMARY KEY,
+  tenant_id  uuid NOT NULL REFERENCES tenant(id),
+  user_id    uuid NOT NULL REFERENCES "user"(id),
+  client_id  uuid NOT NULL,
+  status     text NOT NULL DEFAULT 'active' CHECK (status IN ('active', 'revoked')),
+  created_at timestamptz NOT NULL DEFAULT now(),
+  FOREIGN KEY (tenant_id, client_id) REFERENCES client (tenant_id, id)
+);
+CREATE UNIQUE INDEX client_portal_access_uq ON client_portal_access (tenant_id, user_id, client_id);
+CREATE INDEX client_portal_access_user_idx ON client_portal_access (user_id);
+
+-- ── RLS ─────────────────────────────────────────────────────────────────────
+ALTER TABLE service_request ENABLE ROW LEVEL SECURITY;
+ALTER TABLE service_request FORCE ROW LEVEL SECURITY;
+CREATE POLICY service_request_tenant_isolation ON service_request
+  USING (tenant_id = NULLIF(current_setting('app.current_tenant', true), '')::uuid)
+  WITH CHECK (tenant_id = NULLIF(current_setting('app.current_tenant', true), '')::uuid);
+
+ALTER TABLE request_comment ENABLE ROW LEVEL SECURITY;
+ALTER TABLE request_comment FORCE ROW LEVEL SECURITY;
+CREATE POLICY request_comment_tenant_isolation ON request_comment
+  USING (tenant_id = NULLIF(current_setting('app.current_tenant', true), '')::uuid)
+  WITH CHECK (tenant_id = NULLIF(current_setting('app.current_tenant', true), '')::uuid);
+
+ALTER TABLE notification ENABLE ROW LEVEL SECURITY;
+ALTER TABLE notification FORCE ROW LEVEL SECURITY;
+CREATE POLICY notification_tenant_isolation ON notification
+  USING (tenant_id = NULLIF(current_setting('app.current_tenant', true), '')::uuid)
+  WITH CHECK (tenant_id = NULLIF(current_setting('app.current_tenant', true), '')::uuid);
+
+-- Portal access: cláusula "self" (como membership) para o usuário de portal
+-- resolver o próprio vínculo antes de selecionar tenant.
+ALTER TABLE client_portal_access ENABLE ROW LEVEL SECURITY;
+ALTER TABLE client_portal_access FORCE ROW LEVEL SECURITY;
+CREATE POLICY client_portal_access_isolation ON client_portal_access
+  USING (
+    tenant_id = NULLIF(current_setting('app.current_tenant', true), '')::uuid
+    OR user_id = NULLIF(current_setting('app.current_user', true), '')::uuid
+  )
+  WITH CHECK (tenant_id = NULLIF(current_setting('app.current_tenant', true), '')::uuid);

package/src/db/migrations/0008_client_deleted_by.sql

@@ -0,0 +1,5 @@
+-- 0008 — Adiciona `client.deleted_by` (coluna de autoria de soft-delete prevista
+-- em base_columns/03-data-model §2.1, omitida na 0004). Forward-only: migrations
+-- aplicadas são imutáveis, então corrigimos com uma nova migração.
+
+ALTER TABLE client ADD COLUMN IF NOT EXISTS deleted_by uuid REFERENCES "user"(id);

package/src/db/migrations/0009_client_scope_rls.sql

@@ -0,0 +1,50 @@
+-- 0009 — RLS por CLIENTE (defesa no banco para o portal do cliente).
+--
+-- Além do isolamento por tenant, entidades client-scoped passam a respeitar a
+-- GUC `app.current_client`: quando setada (sessão de portal), o banco só revela
+-- linhas daquele client — mesmo que a aplicação esquecesse o filtro. Quando NÃO
+-- setada (staff), o comportamento é o de antes (todos os clientes do tenant).
+--
+-- Fail-closed preservado: NULLIF(...,'') → NULL quando não setada.
+
+-- service_request: escopo por client quando app.current_client presente.
+DROP POLICY IF EXISTS service_request_tenant_isolation ON service_request;
+CREATE POLICY service_request_tenant_isolation ON service_request
+  USING (
+    tenant_id = NULLIF(current_setting('app.current_tenant', true), '')::uuid
+    AND (
+      NULLIF(current_setting('app.current_client', true), '') IS NULL
+      OR client_id = NULLIF(current_setting('app.current_client', true), '')::uuid
+    )
+  )
+  WITH CHECK (
+    tenant_id = NULLIF(current_setting('app.current_tenant', true), '')::uuid
+    AND (
+      NULLIF(current_setting('app.current_client', true), '') IS NULL
+      OR client_id = NULLIF(current_setting('app.current_client', true), '')::uuid
+    )
+  );
+
+-- request_comment: escopo por client via subconsulta ao request dono.
+DROP POLICY IF EXISTS request_comment_tenant_isolation ON request_comment;
+CREATE POLICY request_comment_tenant_isolation ON request_comment
+  USING (
+    tenant_id = NULLIF(current_setting('app.current_tenant', true), '')::uuid
+    AND (
+      NULLIF(current_setting('app.current_client', true), '') IS NULL
+      OR request_id IN (
+        SELECT id FROM service_request
+        WHERE client_id = NULLIF(current_setting('app.current_client', true), '')::uuid
+      )
+    )
+  )
+  WITH CHECK (
+    tenant_id = NULLIF(current_setting('app.current_tenant', true), '')::uuid
+    AND (
+      NULLIF(current_setting('app.current_client', true), '') IS NULL
+      OR request_id IN (
+        SELECT id FROM service_request
+        WHERE client_id = NULLIF(current_setting('app.current_client', true), '')::uuid
+      )
+    )
+  );

package/src/db/migrations/0010_product_entitlements.sql

@@ -0,0 +1,43 @@
+-- 0010 — Catálogo de produtos + entitlements por tenant (IAM multiproduto).
+--
+-- Princípio (ADR 0005): membership no tenant NÃO concede acesso a todos os
+-- produtos Baruk. Acesso = identidade + membership + ENTITLEMENT do produto no
+-- tenant + papel. O Hub bloqueia produto sem entitlement.
+
+-- Catálogo global de produtos (como `permission`: global, read-only p/ app).
+CREATE TABLE product (
+  id         uuid PRIMARY KEY,
+  key        text NOT NULL,                         -- contabil | rep | ind | varejo
+  name       text NOT NULL,
+  kind       text NOT NULL DEFAULT 'internal' CHECK (kind IN ('internal', 'external')),
+  base_url   text,                                  -- destino p/ produtos externos (Rep/Ind)
+  is_active  boolean NOT NULL DEFAULT true,
+  created_at timestamptz NOT NULL DEFAULT now()
+);
+CREATE UNIQUE INDEX product_key_uq ON product (key);
+
+-- Entitlement: quais produtos o tenant contratou/acessa.
+CREATE TABLE tenant_product (
+  id         uuid PRIMARY KEY,
+  tenant_id  uuid NOT NULL REFERENCES tenant(id),
+  product_id uuid NOT NULL REFERENCES product(id),
+  status     text NOT NULL DEFAULT 'active' CHECK (status IN ('active', 'suspended')),
+  enabled_at timestamptz NOT NULL DEFAULT now()
+);
+CREATE UNIQUE INDEX tenant_product_uq ON tenant_product (tenant_id, product_id);
+CREATE INDEX tenant_product_tenant_idx ON tenant_product (tenant_id);
+
+-- RLS: como membership, com cláusula "self" para o Hub resolver os produtos do
+-- usuário ANTES de escolher tenant/produto ativo.
+ALTER TABLE tenant_product ENABLE ROW LEVEL SECURITY;
+ALTER TABLE tenant_product FORCE ROW LEVEL SECURITY;
+CREATE POLICY tenant_product_isolation ON tenant_product
+  USING (
+    tenant_id = NULLIF(current_setting('app.current_tenant', true), '')::uuid
+    OR tenant_id IN (
+      SELECT tenant_id FROM membership
+      WHERE user_id = NULLIF(current_setting('app.current_user', true), '')::uuid
+        AND deleted_at IS NULL
+    )
+  )
+  WITH CHECK (tenant_id = NULLIF(current_setting('app.current_tenant', true), '')::uuid);

package/src/db/migrations/0011_password_reset.sql

@@ -0,0 +1,18 @@
+-- 0011 — Recuperação de senha (token de uso único). Global (segue "user").
+-- Guardamos apenas o HASH do token (nunca o token em claro), com expiração e
+-- uso único. Proteção contra enumeração é feita na camada de aplicação
+-- (resposta genérica).
+
+CREATE TABLE password_reset (
+  id         uuid PRIMARY KEY,
+  user_id    uuid NOT NULL REFERENCES "user"(id) ON DELETE CASCADE,
+  token_hash text NOT NULL,
+  expires_at timestamptz NOT NULL,
+  used_at    timestamptz,
+  created_at timestamptz NOT NULL DEFAULT now()
+);
+CREATE UNIQUE INDEX password_reset_token_uq ON password_reset (token_hash);
+CREATE INDEX password_reset_user_idx ON password_reset (user_id);
+
+-- Marca de "trocar senha no primeiro acesso" para contas provisionadas.
+ALTER TABLE user_credential ADD COLUMN IF NOT EXISTS must_change_password boolean NOT NULL DEFAULT false;