@jumentix/cli-init 0.0.0

package/templates/backend/src/modules/Users/domain/Model/User.ts

@@ -0,0 +1,445 @@
+/* eslint-disable no-underscore-dangle */
+// import * as bcrypt from 'bcrypt';
+import {
+  BaseModel,
+  belongsTo
+} from '@src/modules/port';
+import {
+  canNotBeEmpty,
+  throwIfReadOnly
+  // mustBePassword
+} from '@src/shared/validators';
+import {
+  EmailValueObject,
+  DocumentValueObject,
+  PhoneValueObject
+} from '@src/modules/ddd/valueObjects';
+import type {
+  IUser
+} from '@src/modules/Users/domain/Entity/IUser';
+import type { RequestCreateUser } from '@src/modules/Users/interface/dto/RequestCreateUser';
+import type { RequestCreatePhone } from '@src/modules/Users/interface/dto/RequestCreatePhone';
+import type { RequestUpdatePhone } from '@src/modules/Users/interface/dto/RequestUpdatePhone';
+import type { RequestCreateDocument } from '@src/modules/Users/interface/dto/RequestCreateDocument';
+import type { RequestUpdateDocument } from '@src/modules/Users/interface/dto/RequestUpdateDocument';
+import type { RequestCreateEmail } from '@src/modules/Users/interface/dto/RequestCreateEmail';
+import type { RequestUpdateEmail } from '@src/modules/Users/interface/dto/RequestUpdateEmail';
+import { DomainValidationError } from '@src/infra/exceptions';
+import {
+  normalizeRoles,
+  shouldRequireOrganization
+} from '@src/modules/Users/domain/security/Rbac';
+
+interface UserFactory extends RequestCreateUser {
+  id?: string;
+  createdAt?: Date | string;
+  updatedAt?: Date | string;
+  deletedAt?: Date | string | null;
+  readOnly?: boolean;
+  active?: boolean;
+}
+
+export class User extends BaseModel<IUser> implements IUser {
+  public static readonly dataEntitySchema = {
+    name: 'User',
+    fields: [
+      {
+        name: 'id',
+        type: 'string',
+        format: 'uuid',
+        required: true,
+        validations: ['pattern:^[0-9a-fA-F-]{36}$']
+      },
+      {
+        name: 'createdAt',
+        type: 'string',
+        format: 'date-time',
+        required: true,
+        validations: []
+      },
+      {
+        name: 'updatedAt',
+        type: 'string',
+        format: 'date-time',
+        required: true,
+        validations: []
+      },
+      {
+        name: 'firstName',
+        type: 'string',
+        required: true,
+        validations: ['minLength:1']
+      },
+      {
+        name: 'lastName',
+        type: 'string',
+        validations: []
+      },
+      {
+        name: 'avatar',
+        type: 'string',
+        format: 'none',
+        validations: []
+      },
+      {
+        name: 'username',
+        type: 'string',
+        required: true,
+        validations: ['minLength:1']
+      },
+      {
+        name: 'organization',
+        type: 'string',
+        format: 'uuid',
+        required: false,
+        validations: []
+      },
+      {
+        name: 'password',
+        type: 'string',
+        format: 'password',
+        required: false,
+        validations: []
+      },
+      {
+        name: 'salt',
+        type: 'string',
+        required: false,
+        validations: []
+      },
+      {
+        name: 'roles',
+        type: 'array',
+        required: false,
+        validations: []
+      },
+      {
+        name: 'emails',
+        type: 'array',
+        required: false,
+        validations: []
+      },
+      {
+        name: 'documents',
+        type: 'array',
+        required: false,
+        validations: []
+      },
+      {
+        name: 'phones',
+        type: 'array',
+        required: false,
+        validations: []
+      },
+      {
+        name: 'deletedAt',
+        type: 'string',
+        format: 'date-time',
+        required: false,
+        validations: []
+      }
+    ]
+  } as const;
+
+  private _firstName: string = '';
+
+  private _lastName: string = '';
+
+  private _username: string = '';
+
+  private _password: string = '';
+
+  private _salt: string = '';
+
+  private _organization: string = '';
+
+  private _avatar: string = 'avatar.png';
+
+  private _emails: EmailValueObject[] = [];
+
+  private _documents: DocumentValueObject[] = [];
+
+  private _phones: PhoneValueObject[] = [];
+
+  private readonly _roles: string[] = [];
+
+  private readonly _readOnly: boolean = false;
+
+  public _excludeOnSerialize: string[] = ['login'];
+
+  public _active: boolean = true;
+
+  private _skipDomainValidation: boolean = true;
+
+  constructor(payload: UserFactory) {
+    super({
+      id: payload.id,
+      createdAt: payload.createdAt,
+      updatedAt: payload.updatedAt,
+      deletedAt: payload.deletedAt
+    });
+    BaseModel.throwIfDataEntitySchemaIsNotOpenApi31Compliant(User.dataEntitySchema as any);
+    const {
+      firstName,
+      lastName,
+      avatar,
+      username,
+      organization,
+      password,
+      salt,
+      emails,
+      documents,
+      phones,
+      roles,
+      readOnly
+    } = payload;
+
+    this.firstName = firstName;
+    this.lastName = lastName ?? '';
+    this.avatar = avatar ?? 'avatar.png';
+    this.username = username;
+    this.organization = organization ?? '';
+    this.password = password || '';
+    this.salt = salt ?? '';
+
+    emails.forEach((e) => this.createEmail(e));
+    documents?.forEach((d) => this.createDocument(d));
+    phones?.forEach((p) => this.createPhone(p));
+    this._roles = normalizeRoles(roles || []);
+
+    this._readOnly = readOnly ?? false;
+
+    this._excludeOnSerialize = [
+      'createPhone',
+      'updatePhone',
+      'deletePhone',
+      'createDocument',
+      'updateDocument',
+      'deleteDocument',
+      'createEmail',
+      'updateEmail',
+      'deleteEmail'
+    ];
+
+    this._skipDomainValidation = false;
+    this.validateDomainState();
+  }
+
+  private validateDomainState(): void {
+    if (this._skipDomainValidation) return;
+    this.ensureTenancyRules();
+    const payload: Record<string, any> = {
+      id: this.id,
+      createdAt: this.createdAt.toISOString(),
+      updatedAt: this.updatedAt.toISOString(),
+      firstName: this.firstName,
+      lastName: this.lastName,
+      avatar: this.avatar,
+      username: this.username,
+      password: this.password,
+      salt: this.salt,
+      roles: this.roles,
+      emails: this.emails.map((entry) => ({ ...entry })),
+      documents: this.documents.map((entry) => ({ ...entry })),
+      phones: this.phones.map((entry) => ({ ...entry }))
+    };
+    if (this.organization) payload.organization = this.organization;
+    BaseModel.throwIfModelPayloadIsNotOpenApi31Compliant(
+      payload,
+      User.dataEntitySchema as any
+    );
+  }
+
+  public get firstName(): string {
+    return this._firstName;
+  }
+
+  public set firstName(firstName: string) {
+    throwIfReadOnly('firstName', this._readOnly);
+    canNotBeEmpty('firstName', firstName);
+    this._firstName = firstName;
+    this.validateDomainState();
+  }
+
+  public get lastName(): string {
+    return this._lastName;
+  }
+
+  public set lastName(lastName: string) {
+    throwIfReadOnly('lastName', this._readOnly);
+    this._lastName = lastName;
+    this.validateDomainState();
+  }
+
+  public get avatar(): string {
+    return this._avatar;
+  }
+
+  public set avatar(avatar: string) {
+    throwIfReadOnly('avatar', this._readOnly);
+    canNotBeEmpty('avatar', avatar);
+    this._avatar = avatar;
+    this.validateDomainState();
+  }
+
+  public createPhone(payload: RequestCreatePhone): boolean {
+    throwIfReadOnly('phone', this._readOnly);
+    this._phones.push(new PhoneValueObject(payload));
+    this.validateDomainState();
+    return true;
+  }
+
+  public updatePhone(payload: RequestUpdatePhone): boolean {
+    throwIfReadOnly('phone', this._readOnly);
+    for (let i = 0; i < this._phones.length; i += 1) {
+      if (this._phones[i].id === payload.id) {
+        this._phones[i] = new PhoneValueObject({ ...this._phones[i], ...payload });
+        this.validateDomainState();
+        return true;
+      }
+    }
+    return false;
+  }
+
+  public deletePhone(id: string): boolean {
+    throwIfReadOnly('phone', this._readOnly);
+    for (let i = 0; i < this._phones.length; i += 1) {
+      if (this._phones[i].id === id) {
+        this._phones.splice(i, 1);
+        this.validateDomainState();
+        return true;
+      }
+    }
+    return false;
+  }
+
+  public createDocument(payload: RequestCreateDocument): boolean {
+    throwIfReadOnly('document', this._readOnly);
+    this._documents.push(new DocumentValueObject(payload));
+    this.validateDomainState();
+    return true;
+  }
+
+  public updateDocument(payload: RequestUpdateDocument): boolean {
+    throwIfReadOnly('document', this._readOnly);
+    for (let i = 0; i < this._documents.length; i += 1) {
+      if (this._documents[i].id === payload.id) {
+        this._documents[i] = new DocumentValueObject({ ...this._documents[i], ...payload });
+        this.validateDomainState();
+        return true;
+      }
+    }
+    return false;
+  }
+
+  public deleteDocument(id: string): boolean {
+    throwIfReadOnly('document', this._readOnly);
+    for (let i = 0; i < this._documents.length; i += 1) {
+      if (this._documents[i].id === id) {
+        this._documents.splice(i, 1);
+        this.validateDomainState();
+        return true;
+      }
+    }
+    return false;
+  }
+
+  public createEmail(payload: RequestCreateEmail): boolean {
+    throwIfReadOnly('email', this._readOnly);
+    this._emails.push(new EmailValueObject(payload));
+    this.validateDomainState();
+    return true;
+  }
+
+  public updateEmail(payload: RequestUpdateEmail): boolean {
+    throwIfReadOnly('email', this._readOnly);
+    for (let i = 0; i < this._emails.length; i += 1) {
+      if (this._emails[i].id === payload.id) {
+        this._emails[i] = new EmailValueObject({ ...this._emails[i], ...payload });
+        this.validateDomainState();
+        return true;
+      }
+    }
+    return false;
+  }
+
+  public deleteEmail(id: string): boolean {
+    throwIfReadOnly('email', this._readOnly);
+    for (let i = 0; i < this._emails.length; i += 1) {
+      if (this._emails[i].id === id) {
+        this._emails.splice(i, 1);
+        this.validateDomainState();
+        return true;
+      }
+    }
+    return false;
+  }
+
+  public get username(): string {
+    return this._username;
+  }
+
+  public set username(username: string) {
+    throwIfReadOnly('username', this._readOnly);
+    canNotBeEmpty('username', username);
+    this._username = username;
+    this.validateDomainState();
+  }
+
+  public get password(): string {
+    return this._password;
+  }
+
+  public set password(password: string) {
+    throwIfReadOnly('password', this._readOnly);
+    if (password === '') return;
+    // canNotBeEmpty('password', password);
+    // mustBePassword('password', password);
+    this._password = password;
+    this.validateDomainState();
+  }
+
+  public get salt(): string {
+    return this._salt;
+  }
+
+  public set salt(salt: string) {
+    throwIfReadOnly('salt', this._readOnly);
+    if (salt === '') return;
+    this._salt = salt;
+    this.validateDomainState();
+  }
+
+  @belongsTo('Organization')
+  public get organization(): string {
+    return this._organization;
+  }
+
+  public set organization(organization: string) {
+    throwIfReadOnly('organization', this._readOnly);
+    this._organization = organization || '';
+    this.validateDomainState();
+  }
+
+  public get roles(): string[] {
+    return [...this._roles];
+  }
+
+  public get emails(): EmailValueObject[] {
+    return [...this._emails];
+  }
+
+  public get documents(): DocumentValueObject[] {
+    return [...this._documents];
+  }
+
+  public get phones(): PhoneValueObject[] {
+    return [...this._phones];
+  }
+
+  private ensureTenancyRules(): void {
+    if (shouldRequireOrganization(this.roles) && !this.organization) {
+      throw new DomainValidationError('organization is required for admin and user roles');
+    }
+  }
+}

package/templates/backend/src/modules/Users/domain/security/Rbac.ts

@@ -0,0 +1,87 @@
+// eslint-disable-next-line no-shadow
+export enum EUserRole {
+  superadmin = 'superadmin',
+  admin = 'admin',
+  user = 'user'
+}
+
+const LEGACY_ROLE_SCOPES = [
+  'access_allow',
+  'create_account',
+  'read_account',
+  'update_account',
+  'delete_account',
+  'create_transaction',
+  'delete_transaction',
+  'read_transaction',
+  'create_user',
+  'read_user',
+  'update_user',
+  'delete_user',
+  'create_organization',
+  'read_organization',
+  'update_organization',
+  'delete_organization'
+] as const;
+
+export const ROLE_SCOPE_MATRIX: Record<EUserRole, string[]> = {
+  [EUserRole.superadmin]: ['*'],
+  // Only superadmins manage multiple organizations (JUM-772): admin has no
+  // create_organization/delete_organization. Keep in sync with the OAS
+  // `x-rbac` extension (spec/1.0.0.yml) — the frontend reads the matrix from
+  // the bundled spec, never from backend code (requirement 136).
+  [EUserRole.admin]: [
+    'access_allow',
+    'read_user',
+    'create_user',
+    'update_user',
+    'delete_user',
+    'read_organization',
+    'update_organization'
+  ],
+  [EUserRole.user]: [
+    'access_allow',
+    'read_user'
+  ]
+};
+
+const isNormalizedRole = (role: string): role is EUserRole => {
+  return Object.values(EUserRole).includes(role as EUserRole);
+};
+
+export const normalizeRoles = (roles: string[] = []): string[] => {
+  if (roles.length === 0) return [];
+  return [...new Set(roles)];
+};
+
+export const hasSuperadminRole = (roles: string[] = []): boolean => {
+  return normalizeRoles(roles).includes(EUserRole.superadmin);
+};
+
+export const shouldRequireOrganization = (roles: string[] = []): boolean => {
+  const normalized = normalizeRoles(roles);
+  if (normalized.some((role) => isNormalizedRole(role))) {
+    return normalized.includes(EUserRole.admin) || normalized.includes(EUserRole.user);
+  }
+  return false;
+};
+
+export const resolveRoleScopes = (roles: string[] = []): string[] => {
+  const normalized = normalizeRoles(roles);
+  const granted = new Set<string>();
+  normalized.forEach((role) => {
+    if (isNormalizedRole(role)) {
+      ROLE_SCOPE_MATRIX[role].forEach((scope) => granted.add(scope));
+      return;
+    }
+    if ((LEGACY_ROLE_SCOPES as readonly string[]).includes(role)) {
+      granted.add(role);
+    }
+  });
+  return [...granted];
+};
+
+export const userCanAccessScope = (roles: string[], scope: string): boolean => {
+  const scopes = resolveRoleScopes(roles);
+  return scopes.includes('*') || scopes.includes(scope);
+};

package/templates/backend/src/modules/Users/domain/security/TenantAuthorizationPolicy.ts

@@ -0,0 +1,126 @@
+import {
+  EUserRole,
+  hasSuperadminRole,
+  normalizeRoles,
+  shouldRequireOrganization
+} from './Rbac';
+
+export const TENANT_AUTHORIZATION_REASONS = {
+  organizationRequired: 'Insufficient permission - organization scope is required',
+  crossOrganization: 'Insufficient permission - cross organization access is forbidden',
+  selfOnly: 'Insufficient permission - user scope is restricted to the authenticated user'
+} as const;
+
+export interface ITenantPrincipal {
+  id?: string;
+  organization?: string;
+  roles?: string[];
+}
+
+export interface IUserTenantTarget {
+  id?: string;
+  organization?: string;
+}
+
+export type ITenantAuthorizationDecision =
+  | { allowed: true; reason?: never }
+  | { allowed: false; reason: string };
+
+const allow = (): ITenantAuthorizationDecision => ({ allowed: true });
+const deny = (reason: string): ITenantAuthorizationDecision => ({ allowed: false, reason });
+
+const isTenantPrincipal = (principal: ITenantPrincipal): boolean => {
+  return shouldRequireOrganization(principal.roles);
+};
+
+const isNormalizedUser = (principal: ITenantPrincipal): boolean => {
+  const roles = normalizeRoles(principal.roles);
+  return roles.includes(EUserRole.user) && !roles.includes(EUserRole.admin);
+};
+
+export const decideOrganizationAccess = (
+  principal: ITenantPrincipal,
+  organizationId: string
+): ITenantAuthorizationDecision => {
+  if (!isTenantPrincipal(principal) || hasSuperadminRole(principal.roles)) return allow();
+  if (!principal.organization) {
+    return deny(TENANT_AUTHORIZATION_REASONS.organizationRequired);
+  }
+  if (principal.organization !== organizationId) {
+    return deny(TENANT_AUTHORIZATION_REASONS.crossOrganization);
+  }
+  return allow();
+};
+
+export const decideUserAccess = (
+  principal: ITenantPrincipal,
+  target: IUserTenantTarget
+): ITenantAuthorizationDecision => {
+  if (!isTenantPrincipal(principal) || hasSuperadminRole(principal.roles)) return allow();
+  if (!principal.organization) {
+    return deny(TENANT_AUTHORIZATION_REASONS.organizationRequired);
+  }
+  if (target.id === principal.id) return allow();
+  if (isNormalizedUser(principal)) {
+    return deny(TENANT_AUTHORIZATION_REASONS.selfOnly);
+  }
+  if (target.organization !== principal.organization) {
+    return deny(TENANT_AUTHORIZATION_REASONS.crossOrganization);
+  }
+  return allow();
+};
+
+export const resolveUserCreationOrganization = (
+  principal: ITenantPrincipal,
+  requestedOrganization?: string
+): { decision: ITenantAuthorizationDecision; organization?: string } => {
+  if (!isTenantPrincipal(principal) || hasSuperadminRole(principal.roles)) {
+    return { decision: allow(), organization: requestedOrganization };
+  }
+  if (!principal.organization) {
+    return { decision: deny(TENANT_AUTHORIZATION_REASONS.organizationRequired) };
+  }
+  if (requestedOrganization && requestedOrganization !== principal.organization) {
+    return { decision: deny(TENANT_AUTHORIZATION_REASONS.crossOrganization) };
+  }
+  return { decision: allow(), organization: principal.organization };
+};
+
+export const resolveUserCollectionScope = (
+  principal: ITenantPrincipal
+): { decision: ITenantAuthorizationDecision; filters: Record<string, string> } => {
+  if (!isTenantPrincipal(principal) || hasSuperadminRole(principal.roles)) {
+    return { decision: allow(), filters: {} };
+  }
+  if (!principal.organization) {
+    return {
+      decision: deny(TENANT_AUTHORIZATION_REASONS.organizationRequired),
+      filters: {}
+    };
+  }
+  return {
+    decision: allow(),
+    filters: {
+      organization: principal.organization,
+      ...(isNormalizedUser(principal) && principal.id ? { id: principal.id } : {})
+    }
+  };
+};
+
+export const resolveOrganizationCollectionScope = (
+  principal: ITenantPrincipal
+): { decision: ITenantAuthorizationDecision; filters: Record<string, string> } => {
+  if (!isTenantPrincipal(principal) || hasSuperadminRole(principal.roles)) {
+    return { decision: allow(), filters: {} };
+  }
+  if (!principal.organization) {
+    return {
+      decision: deny(TENANT_AUTHORIZATION_REASONS.organizationRequired),
+      filters: {}
+    };
+  }
+  return {
+    decision: allow(),
+    filters: { id: principal.organization }
+  };
+};

package/templates/backend/src/modules/Users/events/LoginRequestEvent.ts

@@ -0,0 +1,18 @@
+import { BaseDomainEvent } from '@src/modules/port/BaseDomainEvent';
+import type { IEventMessage } from '@src/modules/port/IEventMessage';
+import { canNotBeEmpty } from '@src/shared/validators';
+import { ComposeEventError } from '@src/infra/exceptions';
+
+export class LoginRequestEvent<TPayload = any> extends BaseDomainEvent<TPayload> {
+  constructor(message: IEventMessage<TPayload>) {
+    super(message);
+    try {
+      this.entity = 'Auth';
+      this.action = 'register';
+      // canNotBeEmpty('message.authorization', message.authorization);
+      canNotBeEmpty('message.input', message.input);
+    } catch (err) {
+      throw new ComposeEventError((err as any).message);
+    }
+  }
+}

package/templates/backend/src/modules/Users/events/LogoutRequestEvent.ts

@@ -0,0 +1,18 @@
+import { BaseDomainEvent } from '@src/modules/port/BaseDomainEvent';
+import type { IEventMessage } from '@src/modules/port/IEventMessage';
+import { canNotBeEmpty } from '@src/shared/validators';
+import { ComposeEventError } from '@src/infra/exceptions';
+
+export class LogoutRequestEvent<TPayload = any> extends BaseDomainEvent<TPayload> {
+  constructor(message: IEventMessage<TPayload>) {
+    super(message);
+    try {
+      this.entity = 'Auth';
+      this.action = 'logout';
+      // canNotBeEmpty('message.authorization', message.authorization);
+      canNotBeEmpty('message.input', message.input);
+    } catch (err) {
+      throw new ComposeEventError((err as any).message);
+    }
+  }
+}