@hed-hog/core 0.0.387 → 0.0.393

package/hedhog/data/route.yaml

@@ -1,3 +1,31 @@
+- url: /incident
+  method: GET
+  type: HTTP
+  relations:
+    role:
+      - where:
+          slug: admin
+- url: /incident/summary
+  method: GET
+  type: HTTP
+  relations:
+    role:
+      - where:
+          slug: admin
+- url: /incident/:id/resolve
+  method: PATCH
+  type: HTTP
+  relations:
+    role:
+      - where:
+          slug: admin
+- url: /incident/:id/reopen
+  method: PATCH
+  type: HTTP
+  relations:
+    role:
+      - where:
+          slug: admin
 - url: /access-log
   method: GET
   type: HTTP
@@ -12,6 +40,8 @@
     role:
       - where:
           slug: admin
+      - where:
+          slug: admin-mail
 - url: /user/:userId/verify-identifier/:identifierId
   method: POST
   type: HTTP
@@ -59,6 +89,45 @@
           slug: admin-access
       - where:
           slug: user
+# Dispositivos conhecidos do proprio usuario. Mesmos papeis das sessoes: e a
+# mesma area de seguranca da conta.
+- url: /user-device
+  method: GET
+  type: HTTP
+  relations:
+    role:
+      - where:
+          slug: admin
+      - where:
+          slug: admin-access
+      - where:
+          slug: user
+- url: /user-device/:deviceId
+  method: DELETE
+  type: HTTP
+  relations:
+    role:
+      - where:
+          slug: admin
+      - where:
+          slug: admin-access
+      - where:
+          slug: user
+# Dispositivos de OUTRO usuario (sheet do admin): so admin.
+- url: /user-device/user/:userId
+  method: GET
+  type: HTTP
+  relations:
+    role:
+      - where:
+          slug: admin
+- url: /user-device/user/:userId/:deviceId
+  method: DELETE
+  type: HTTP
+  relations:
+    role:
+      - where:
+          slug: admin
 - url: /sessions/:sessionId/revoke
   method: DELETE
   type: HTTP
@@ -397,6 +466,42 @@
           slug: admin
       - where:
           slug: admin-user
+      # A acao "simular acesso" vive na tela de usuarios, entao quem so tem o
+      # papel de simulacao ainda precisa listar usuarios.
+      - where:
+          slug: admin-impersonation
+# Simulacao de acesso. /impersonation/redeem e @Public() e /impersonation/stop e
+# /impersonation/session sao @NoRole(), entao nao entram aqui — o RoleGuard
+# retorna true antes de consultar a tabela nos tres casos.
+- url: /impersonation/start
+  method: POST
+  type: HTTP
+  relations:
+    role:
+      - where:
+          slug: admin
+      - where:
+          slug: admin-impersonation
+- url: /impersonation/history
+  method: GET
+  type: HTTP
+  relations:
+    role:
+      - where:
+          slug: admin
+      - where:
+          slug: admin-impersonation
+- url: /impersonation/apps
+  method: GET
+  type: HTTP
+  relations:
+    role:
+      - where:
+          slug: admin
+      - where:
+          slug: admin-impersonation
+# Gestao de papeis de um usuario: exige o papel dedicado admin-user-permission.
+# admin-user administra o cadastro, mas nao concede/revoga papeis (escalonamento de privilegio).
 - url: /user/:userId/role
   method: GET
   type: HTTP
@@ -405,7 +510,7 @@
       - where:
           slug: admin
       - where:
-          slug: admin-user
+          slug: admin-user-permission
 - url: /user/:userId/role/:roleId
   method: DELETE
   type: HTTP
@@ -414,7 +519,7 @@
       - where:
           slug: admin
       - where:
-          slug: admin-user
+          slug: admin-user-permission
 - url: /user/:userId/role/:roleId
   method: POST
   type: HTTP
@@ -423,7 +528,7 @@
       - where:
           slug: admin
       - where:
-          slug: admin-user
+          slug: admin-user-permission
 - url: /user/:userId
   method: GET
   type: HTTP
@@ -442,6 +547,15 @@
           slug: admin
       - where:
           slug: admin-user
+- url: /user/:userId/mail
+  method: GET
+  type: HTTP
+  relations:
+    role:
+      - where:
+          slug: admin
+      - where:
+          slug: admin-user
 - url: /user/:userId/menu
   method: GET
   type: HTTP
@@ -451,6 +565,8 @@
           slug: admin
       - where:
           slug: admin-access
+      - where:
+          slug: admin-user-permission
 - url: /user/:userId/route
   method: GET
   type: HTTP
@@ -460,6 +576,8 @@
           slug: admin
       - where:
           slug: admin-access
+      - where:
+          slug: admin-user-permission
 - url: /user
   method: POST
   type: HTTP
@@ -623,6 +741,11 @@
           slug: admin
       - where:
           slug: admin-access
+      # O editor do CMS sobe capa de post e imagem de Open Graph por aqui.
+      - where:
+          slug: admin-cms
+      - where:
+          slug: cms-editor
 - url: /file
   method: DELETE
   type: HTTP
@@ -1160,6 +1283,21 @@
     role:
       - where:
           slug: admin
+      - where:
+          slug: admin-mail
+# Provisiona o webhook que recebe bounce/complaint/delivery do SES e devolve a
+# URL para assinar no topico SNS. O endpoint que recebe os eventos e o
+# /webhook/:uuid publico do core: ele nao entra aqui porque o RoleGuard
+# curto-circuita em IS_PUBLIC_KEY antes de ler a tabela `route`.
+- url: /mail-delivery/provision/:integrationProfileId
+  method: POST
+  type: HTTP
+  relations:
+    role:
+      - where:
+          slug: admin
+      - where:
+          slug: admin-mail
 - url: /mail-sent
   method: GET
   type: HTTP
@@ -1202,6 +1340,8 @@
     role:
       - where:
           slug: admin
+      - where:
+          slug: admin-mail
 - url: /mail/:id/html
   method: GET
   type: HTTP
@@ -1209,6 +1349,8 @@
     role:
       - where:
           slug: admin
+      - where:
+          slug: admin-mail
 - url: /mail
   method: POST
   type: HTTP
@@ -1216,6 +1358,8 @@
     role:
       - where:
           slug: admin
+      - where:
+          slug: admin-mail
 - url: /mail/import
   method: POST
   type: HTTP
@@ -1223,6 +1367,8 @@
     role:
       - where:
           slug: admin
+      - where:
+          slug: admin-mail
 - url: /mail/:id
   method: PATCH
   type: HTTP
@@ -1230,6 +1376,8 @@
     role:
       - where:
           slug: admin
+      - where:
+          slug: admin-mail
 - url: /mail
   method: DELETE
   type: HTTP
@@ -1237,6 +1385,8 @@
     role:
       - where:
           slug: admin
+      - where:
+          slug: admin-mail
 - url: /mail/test
   method: POST
   type: HTTP
@@ -1244,6 +1394,44 @@
     role:
       - where:
           slug: admin
+      - where:
+          slug: admin-mail
+- url: /mail/preview
+  method: POST
+  type: HTTP
+  relations:
+    role:
+      - where:
+          slug: admin
+      - where:
+          slug: admin-mail
+- url: /mail-layout
+  method: GET
+  type: HTTP
+  relations:
+    role:
+      - where:
+          slug: admin
+      - where:
+          slug: admin-mail
+- url: /mail-layout/:id
+  method: GET
+  type: HTTP
+  relations:
+    role:
+      - where:
+          slug: admin
+      - where:
+          slug: admin-mail
+- url: /mail-layout/:id
+  method: PATCH
+  type: HTTP
+  relations:
+    role:
+      - where:
+          slug: admin
+      - where:
+          slug: admin-mail
 
 # ─── Integration Profile ──────────────────────────────────────────────────────
 
@@ -1428,6 +1616,47 @@
           slug: admin
       - where:
           slug: admin-access
+- url: /ai/richtext/edit-html
+  method: POST
+  type: HTTP
+  relations:
+    role:
+      - where:
+          slug: admin
+      - where:
+          slug: admin-access
+      - where:
+          slug: admin-campaign
+      - where:
+          slug: admin-cms
+      - where:
+          slug: cms-editor
+      - where:
+          slug: cms-publisher
+      - where:
+          slug: admin-finance
+      - where:
+          slug: admin-finance-operator
+      - where:
+          slug: finance-statements-editor
+      - where:
+          slug: admin-inbox
+      - where:
+          slug: inbox-owner
+      - where:
+          slug: admin-lms
+      - where:
+          slug: lms-instructor
+      - where:
+          slug: admin-operations-director
+      - where:
+          slug: admin-operations-project-manager
+      - where:
+          slug: operations-collaborator
+      - where:
+          slug: admin-sac
+      - where:
+          slug: sac-agent
 - url: /integration-event-catalog
   method: GET
   type: HTTP
@@ -3149,6 +3378,36 @@
       - where:
           slug: admin-access
 
+- url: /ai-instruction/modules
+  method: GET
+  type: HTTP
+  relations:
+    role:
+      - where:
+          slug: admin
+      - where:
+          slug: admin-access
+
+- url: /ai-instruction/registry
+  method: GET
+  type: HTTP
+  relations:
+    role:
+      - where:
+          slug: admin
+      - where:
+          slug: admin-access
+
+- url: /ai-instruction/preview
+  method: POST
+  type: HTTP
+  relations:
+    role:
+      - where:
+          slug: admin
+      - where:
+          slug: admin-access
+
 - url: /ai-instruction/:id
   method: GET
   type: HTTP
@@ -3236,6 +3495,37 @@
   method: POST
   type: HTTP
   relations: *core_user_roles
+# Pareamento por QR. Só as rotas que exigem sessão entram aqui: /auth/pairing/claim,
+# /auth/pairing/redeem, /auth/pairing/reverse e /auth/pairing/reverse/poll são
+# @Public() — o aparelho que as chama ainda não tem sessão nenhuma.
+- url: /auth/pairing
+  method: POST
+  type: HTTP
+  relations: *core_user_roles
+- url: /auth/pairing/:id
+  method: GET
+  type: HTTP
+  relations: *core_user_roles
+- url: /auth/pairing/:id/confirm
+  method: POST
+  type: HTTP
+  relations: *core_user_roles
+- url: /auth/pairing/:id
+  method: DELETE
+  type: HTTP
+  relations: *core_user_roles
+- url: /auth/pairing/reverse/:id
+  method: GET
+  type: HTTP
+  relations: *core_user_roles
+- url: /auth/pairing/reverse/:id/approve
+  method: POST
+  type: HTTP
+  relations: *core_user_roles
+- url: /auth/pairing/reverse/:id/reject
+  method: POST
+  type: HTTP
+  relations: *core_user_roles
 - url: /auth/roles
   method: GET
   type: HTTP
@@ -3380,3 +3670,17 @@
   method: PUT
   type: HTTP
   relations: *core_user_roles
+- url: /profile/account
+  method: DELETE
+  type: HTTP
+  relations: *core_user_roles
+# Corpus de senhas vazadas. O filtro e consumido pelo cofre e pelos formularios
+# de senha, entao vale para qualquer usuario autenticado.
+- url: /leaked-password/filter
+  method: GET
+  type: HTTP
+  relations: *core_user_roles
+- url: /leaked-password/stats
+  method: GET
+  type: HTTP
+  relations: *core_user_roles