@mybuildex/pkg 0.6.1 → 0.8.0

package/dist/tenant/permissions.js

@@ -0,0 +1,187 @@
+"use strict";
+// Resolver de permissões por papel (is_full / is_teacher / is_student),
+// fonte única para atendimento e pedagogico, que tinham cópias idênticas do
+// hook `onTenantResolved` com um defeito comum: começavam com
+// `is_full = true` e mantinham isso quando o usuário não existia na escola,
+// quando a lista vinha vazia ou quando a consulta falhava (fail-open, erro
+// só no console).
+//
+// Regra:
+//   - sem id_school: não mexe no request (igual ao legado);
+//   - tudo começa false; sem user_id ou lista vazia continua tudo false;
+//   - is_full = a lista tem a permissão `full` — e SÓ isso. Antes qualquer
+//     perfil sem teacher/student virava is_full (inclusive responsável e
+//     aluno com o identificador `aluno`) e via tudo nos services;
+//   - is_teacher = teacher|professor; is_student = student|aluno;
+//     is_responsible = responsible|responsavel (nomes en ou pt, como o front);
+//   - erro em qualquer etapa: tudo false, permissions=[],
+//     permissions_error=true e log.
+//
+// Cache Redis `perms:<idSchool>:v<versão>:<uid>` (TTL 3600s), best-effort.
+// A versão vem de `perms_ver:<idSchool>`: o v1_acls invalida a escola
+// inteira com um INCR (invalidatePermissionsCache) — atômico e O(1), sem o
+// `KEYS perms:<id>:*` que varria o Redis todo. Chaves de versões antigas
+// morrem pelo TTL.
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.defaultPermissionsQuery = defaultPermissionsQuery;
+exports.createPermissionsResolver = createPermissionsResolver;
+exports.permissionsVersionKey = permissionsVersionKey;
+exports.permissionsCacheKey = permissionsCacheKey;
+exports.invalidatePermissionsCache = invalidatePermissionsCache;
+const roles_1 = require("../acl/roles");
+const SCHEMA_RE = /^[A-Za-z0-9_]+$/;
+/** A mesma consulta que as APIs usavam, com o uid como parâmetro. */
+async function defaultPermissionsQuery(prisma, uid) {
+    const schema = String(prisma?.$schema ?? "");
+    if (!SCHEMA_RE.test(schema))
+        throw new Error(`schema inválido: ${schema}`);
+    const db = "`" + schema + "`";
+    const sql = `select distinct identifier
+                 from ${db}.permissions
+                 where id in (select id_permission from ${db}.rules_permissions
+                              where id_rule in (select id_rule from ${db}.policies_rules
+                                                where id_policie in (select id_policie from ${db}.profiles_policies
+                                                                     where id_profile in (select id_profile from ${db}.users_profiles
+                                                                                          where id_user in (select id from ${db}.users where firebase_id = ?)))))`;
+    const rows = await prisma.$queryRawUnsafe(sql, uid);
+    return (rows ?? []).map((r) => String(r.identifier));
+}
+function createPermissionsResolver(options = {}) {
+    const ttl = options.cacheTtlSeconds ?? 3600;
+    const asList = (v, fallback) => v === undefined ? [...fallback] : Array.isArray(v) ? v : [v];
+    const teacher = asList(options.roles?.teacher, roles_1.TEACHER_ACLS);
+    const student = asList(options.roles?.student, roles_1.STUDENT_ACLS);
+    const responsible = asList(options.roles?.responsible, roles_1.RESPONSIBLE_ACLS);
+    const query = options.query ?? defaultPermissionsQuery;
+    const log = options.logger ?? ((m, e) => console.error(m, e));
+    return async function resolvePermissions(req, idSchool) {
+        if (!idSchool)
+            return;
+        req.is_full = false;
+        req.is_teacher = false;
+        req.is_student = false;
+        req.is_responsible = false;
+        req.permissions = [];
+        req.permissions_error = false;
+        const uid = req.user_id;
+        if (!uid)
+            return;
+        // serviço interno (auth internalAuth): não é usuário da escola — não consulta
+        if (req.internal === true)
+            return;
+        let cacheKey = null;
+        try {
+            let permissions = null;
+            if (options.redis) {
+                try {
+                    const version = await readPermissionsVersion(options.redis, idSchool);
+                    cacheKey = permissionsCacheKey(idSchool, version, uid);
+                }
+                catch (e) {
+                    // sem a versão não dá para saber se o cache vale: segue sem cache
+                    log("permissions: redis get da versão falhou, consultando o banco", e);
+                }
+            }
+            if (options.redis && cacheKey) {
+                try {
+                    const cached = await options.redis.get(cacheKey);
+                    if (cached) {
+                        const parsed = JSON.parse(cached);
+                        if (Array.isArray(parsed))
+                            permissions = parsed.map(String);
+                    }
+                }
+                catch (e) {
+                    log("permissions: redis get falhou, consultando o banco", e);
+                }
+            }
+            if (!permissions) {
+                permissions = await query(req.prisma, uid);
+                if (options.redis && cacheKey) {
+                    try {
+                        await options.redis.setEx(cacheKey, ttl, JSON.stringify(permissions));
+                    }
+                    catch (e) {
+                        log("permissions: redis setEx falhou", e);
+                    }
+                }
+            }
+            req.permissions = permissions;
+            if (permissions.length === 0)
+                return;
+            req.is_full = permissions.includes("full");
+            req.is_teacher = teacher.some(r => permissions.includes(r));
+            req.is_student = student.some(r => permissions.includes(r));
+            req.is_responsible = responsible.some(r => permissions.includes(r));
+        }
+        catch (e) {
+            log(`permissions: falha ao resolver permissões de ${uid} na escola ${idSchool}`, e);
+            req.is_full = false;
+            req.is_teacher = false;
+            req.is_student = false;
+            req.is_responsible = false;
+            req.permissions = [];
+            req.permissions_error = true;
+        }
+    };
+}
+// --------------------------------------------------- versão do cache ----
+const SCHOOL_RE = /^\d+$/;
+/** Chave da versão do cache de permissões de uma escola. */
+function permissionsVersionKey(idSchool) {
+    return `perms_ver:${idSchool}`;
+}
+/** Chave do cache de permissões de um usuário numa versão. */
+function permissionsCacheKey(idSchool, version, uid) {
+    return `perms:${idSchool}:v${version}:${uid}`;
+}
+async function readPermissionsVersion(redis, idSchool) {
+    const raw = await redis.get(permissionsVersionKey(idSchool));
+    // só inteiro: qualquer lixo na chave vira versão 0 (nunca entra na chave de cache)
+    return raw && /^\d+$/.test(raw) ? raw : "0";
+}
+/**
+ * Invalida o cache de permissões de UMA escola: INCR em `perms_ver:<id>`.
+ * Chamar depois de qualquer escrita em permissões, regras, políticas,
+ * perfis ou vínculo usuário↔perfil (v1_acls). Nunca lança.
+ */
+async function invalidatePermissionsCache(redis, idSchool, options = {}) {
+    const log = options.logger ?? ((m, e) => console.error(m, e));
+    const result = { version: null, legacyDeleted: 0 };
+    const id = idSchool === null || idSchool === undefined ? "" : String(idSchool);
+    if (!redis)
+        return result;
+    if (!SCHOOL_RE.test(id) || Number(id) <= 0) {
+        log(`permissions: invalidação sem id_school válido (${id || "vazio"}) ignorada`);
+        return result;
+    }
+    try {
+        result.version = await redis.incr(permissionsVersionKey(id));
+    }
+    catch (e) {
+        log(`permissions: INCR da versão falhou na escola ${id}`, e);
+    }
+    if (options.legacy && typeof redis.scanIterator === "function" && typeof redis.del === "function") {
+        try {
+            const batch = [];
+            for await (const item of redis.scanIterator({ MATCH: `perms:${id}:*`, COUNT: 200 })) {
+                for (const key of Array.isArray(item) ? item : [item])
+                    batch.push(key);
+                if (batch.length >= 200) {
+                    const keys = batch.splice(0);
+                    await redis.del(keys);
+                    result.legacyDeleted += keys.length;
+                }
+            }
+            if (batch.length) {
+                await redis.del(batch);
+                result.legacyDeleted += batch.length;
+            }
+        }
+        catch (e) {
+            log(`permissions: limpeza das chaves antigas falhou na escola ${id}`, e);
+        }
+    }
+    return result;
+}
+//# sourceMappingURL=permissions.js.map

package/dist/tenant/permissions.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"permissions.js","sourceRoot":"","sources":["../../src/tenant/permissions.ts"],"names":[],"mappings":";AAAA,wEAAwE;AACxE,4EAA4E;AAC5E,8DAA8D;AAC9D,4EAA4E;AAC5E,2EAA2E;AAC3E,kBAAkB;AAClB,EAAE;AACF,SAAS;AACT,4DAA4D;AAC5D,yEAAyE;AACzE,2EAA2E;AAC3E,yEAAyE;AACzE,kEAAkE;AAClE,kEAAkE;AAClE,+EAA+E;AAC/E,0DAA0D;AAC1D,oCAAoC;AACpC,EAAE;AACF,2EAA2E;AAC3E,sEAAsE;AACtE,2EAA2E;AAC3E,yEAAyE;AACzE,mBAAmB;;AA0BnB,0DAaC;AAED,8DA+EC;AAOD,sDAEC;AAGD,kDAEC;AAoCD,gEAwCC;AA3MD,wCAA0E;AAgB1E,MAAM,SAAS,GAAG,iBAAiB,CAAC;AAEpC,qEAAqE;AAC9D,KAAK,UAAU,uBAAuB,CAAC,MAAW,EAAE,GAAW;IAClE,MAAM,MAAM,GAAG,MAAM,CAAC,MAAM,EAAE,OAAO,IAAI,EAAE,CAAC,CAAC;IAC7C,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,MAAM,CAAC;QAAE,MAAM,IAAI,KAAK,CAAC,oBAAoB,MAAM,EAAE,CAAC,CAAC;IAC3E,MAAM,EAAE,GAAG,GAAG,GAAG,MAAM,GAAG,GAAG,CAAC;IAC9B,MAAM,GAAG,GAAG;wBACQ,EAAE;0DACgC,EAAE;sEACU,EAAE;8FACsB,EAAE;mHACmB,EAAE;6HACQ,EAAE,mCAAmC,CAAC;IAC/J,MAAM,IAAI,GAAU,MAAM,MAAM,CAAC,eAAe,CAAC,GAAG,EAAE,GAAG,CAAC,CAAC;IAC3D,OAAO,CAAC,IAAI,IAAI,EAAE,CAAC,CAAC,GAAG,CAAC,CAAC,CAAM,EAAE,EAAE,CAAC,MAAM,CAAC,CAAC,CAAC,UAAU,CAAC,CAAC,CAAC;AAC9D,CAAC;AAED,SAAgB,yBAAyB,CAAC,UAAsC,EAAE;IAC9E,MAAM,GAAG,GAAG,OAAO,CAAC,eAAe,IAAI,IAAI,CAAC;IAC5C,MAAM,MAAM,GAAG,CAAC,CAAgC,EAAE,QAA2B,EAAE,EAAE,CAC7E,CAAC,KAAK,SAAS,CAAC,CAAC,CAAC,CAAC,GAAG,QAAQ,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;IACjE,MAAM,OAAO,GAAG,MAAM,CAAC,OAAO,CAAC,KAAK,EAAE,OAAO,EAAE,oBAAY,CAAC,CAAC;IAC7D,MAAM,OAAO,GAAG,MAAM,CAAC,OAAO,CAAC,KAAK,EAAE,OAAO,EAAE,oBAAY,CAAC,CAAC;IAC7D,MAAM,WAAW,GAAG,MAAM,CAAC,OAAO,CAAC,KAAK,EAAE,WAAW,EAAE,wBAAgB,CAAC,CAAC;IACzE,MAAM,KAAK,GAAG,OAAO,CAAC,KAAK,IAAI,uBAAuB,CAAC;IACvD,MAAM,GAAG,GAAG,OAAO,CAAC,MAAM,IAAI,CAAC,CAAC,CAAS,EAAE,CAAW,EAAE,EAAE,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC;IAEhF,OAAO,KAAK,UAAU,kBAAkB,CAAC,GAAQ,EAAE,QAAuB;QACtE,IAAI,CAAC,QAAQ;YAAE,OAAO;QAEtB,GAAG,CAAC,OAAO,GAAG,KAAK,CAAC;QACpB,GAAG,CAAC,UAAU,GAAG,KAAK,CAAC;QACvB,GAAG,CAAC,UAAU,GAAG,KAAK,CAAC;QACvB,GAAG,CAAC,cAAc,GAAG,KAAK,CAAC;QAC3B,GAAG,CAAC,WAAW,GAAG,EAAE,CAAC;QACrB,GAAG,CAAC,iBAAiB,GAAG,KAAK,CAAC;QAE9B,MAAM,GAAG,GAAG,GAAG,CAAC,OAAO,CAAC;QACxB,IAAI,CAAC,GAAG;YAAE,OAAO;QACjB,8EAA8E;QAC9E,IAAI,GAAG,CAAC,QAAQ,KAAK,IAAI;YAAE,OAAO;QAElC,IAAI,QAAQ,GAAkB,IAAI,CAAC;QACnC,IAAI,CAAC;YACD,IAAI,WAAW,GAAoB,IAAI,CAAC;YAExC,IAAI,OAAO,CAAC,KAAK,EAAE,CAAC;gBAChB,IAAI,CAAC;oBACD,MAAM,OAAO,GAAG,MAAM,sBAAsB,CAAC,OAAO,CAAC,KAAK,EAAE,QAAQ,CAAC,CAAC;oBACtE,QAAQ,GAAG,mBAAmB,CAAC,QAAQ,EAAE,OAAO,EAAE,GAAG,CAAC,CAAC;gBAC3D,CAAC;gBAAC,OAAO,CAAC,EAAE,CAAC;oBACT,kEAAkE;oBAClE,GAAG,CAAC,8DAA8D,EAAE,CAAC,CAAC,CAAC;gBAC3E,CAAC;YACL,CAAC;YAED,IAAI,OAAO,CAAC,KAAK,IAAI,QAAQ,EAAE,CAAC;gBAC5B,IAAI,CAAC;oBACD,MAAM,MAAM,GAAG,MAAM,OAAO,CAAC,KAAK,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC;oBACjD,IAAI,MAAM,EAAE,CAAC;wBACT,MAAM,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC;wBAClC,IAAI,KAAK,CAAC,OAAO,CAAC,MAAM,CAAC;4BAAE,WAAW,GAAG,MAAM,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC;oBAChE,CAAC;gBACL,CAAC;gBAAC,OAAO,CAAC,EAAE,CAAC;oBACT,GAAG,CAAC,oDAAoD,EAAE,CAAC,CAAC,CAAC;gBACjE,CAAC;YACL,CAAC;YAED,IAAI,CAAC,WAAW,EAAE,CAAC;gBACf,WAAW,GAAG,MAAM,KAAK,CAAC,GAAG,CAAC,MAAM,EAAE,GAAG,CAAC,CAAC;gBAC3C,IAAI,OAAO,CAAC,KAAK,IAAI,QAAQ,EAAE,CAAC;oBAC5B,IAAI,CAAC;wBACD,MAAM,OAAO,CAAC,KAAK,CAAC,KAAK,CAAC,QAAQ,EAAE,GAAG,EAAE,IAAI,CAAC,SAAS,CAAC,WAAW,CAAC,CAAC,CAAC;oBAC1E,CAAC;oBAAC,OAAO,CAAC,EAAE,CAAC;wBACT,GAAG,CAAC,iCAAiC,EAAE,CAAC,CAAC,CAAC;oBAC9C,CAAC;gBACL,CAAC;YACL,CAAC;YAED,GAAG,CAAC,WAAW,GAAG,WAAW,CAAC;YAC9B,IAAI,WAAW,CAAC,MAAM,KAAK,CAAC;gBAAE,OAAO;YAErC,GAAG,CAAC,OAAO,GAAG,WAAW,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC;YAC3C,GAAG,CAAC,UAAU,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,WAAY,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,CAAC;YAC7D,GAAG,CAAC,UAAU,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,WAAY,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,CAAC;YAC7D,GAAG,CAAC,cAAc,GAAG,WAAW,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,WAAY,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,CAAC;QACzE,CAAC;QAAC,OAAO,CAAC,EAAE,CAAC;YACT,GAAG,CAAC,gDAAgD,GAAG,cAAc,QAAQ,EAAE,EAAE,CAAC,CAAC,CAAC;YACpF,GAAG,CAAC,OAAO,GAAG,KAAK,CAAC;YACpB,GAAG,CAAC,UAAU,GAAG,KAAK,CAAC;YACvB,GAAG,CAAC,UAAU,GAAG,KAAK,CAAC;YACvB,GAAG,CAAC,cAAc,GAAG,KAAK,CAAC;YAC3B,GAAG,CAAC,WAAW,GAAG,EAAE,CAAC;YACrB,GAAG,CAAC,iBAAiB,GAAG,IAAI,CAAC;QACjC,CAAC;IACL,CAAC,CAAC;AACN,CAAC;AAED,2EAA2E;AAE3E,MAAM,SAAS,GAAG,OAAO,CAAC;AAE1B,4DAA4D;AAC5D,SAAgB,qBAAqB,CAAC,QAAyB;IAC3D,OAAO,aAAa,QAAQ,EAAE,CAAC;AACnC,CAAC;AAED,8DAA8D;AAC9D,SAAgB,mBAAmB,CAAC,QAAyB,EAAE,OAAe,EAAE,GAAW;IACvF,OAAO,SAAS,QAAQ,KAAK,OAAO,IAAI,GAAG,EAAE,CAAC;AAClD,CAAC;AAED,KAAK,UAAU,sBAAsB,CAAC,KAA2B,EAAE,QAAgB;IAC/E,MAAM,GAAG,GAAG,MAAM,KAAK,CAAC,GAAG,CAAC,qBAAqB,CAAC,QAAQ,CAAC,CAAC,CAAC;IAC7D,mFAAmF;IACnF,OAAO,GAAG,IAAI,OAAO,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,GAAG,CAAC;AAChD,CAAC;AAyBD;;;;GAIG;AACI,KAAK,UAAU,0BAA0B,CAC5C,KAA0D,EAC1D,QAA4C,EAC5C,UAAwC,EAAE;IAE1C,MAAM,GAAG,GAAG,OAAO,CAAC,MAAM,IAAI,CAAC,CAAC,CAAS,EAAE,CAAW,EAAE,EAAE,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC;IAChF,MAAM,MAAM,GAAgC,EAAC,OAAO,EAAE,IAAI,EAAE,aAAa,EAAE,CAAC,EAAC,CAAC;IAC9E,MAAM,EAAE,GAAG,QAAQ,KAAK,IAAI,IAAI,QAAQ,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC;IAC/E,IAAI,CAAC,KAAK;QAAE,OAAO,MAAM,CAAC;IAC1B,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,EAAE,CAAC,IAAI,MAAM,CAAC,EAAE,CAAC,IAAI,CAAC,EAAE,CAAC;QACzC,GAAG,CAAC,kDAAkD,EAAE,IAAI,OAAO,YAAY,CAAC,CAAC;QACjF,OAAO,MAAM,CAAC;IAClB,CAAC;IAED,IAAI,CAAC;QACD,MAAM,CAAC,OAAO,GAAG,MAAM,KAAK,CAAC,IAAI,CAAC,qBAAqB,CAAC,EAAE,CAAC,CAAC,CAAC;IACjE,CAAC;IAAC,OAAO,CAAC,EAAE,CAAC;QACT,GAAG,CAAC,gDAAgD,EAAE,EAAE,EAAE,CAAC,CAAC,CAAC;IACjE,CAAC;IAED,IAAI,OAAO,CAAC,MAAM,IAAI,OAAO,KAAK,CAAC,YAAY,KAAK,UAAU,IAAI,OAAO,KAAK,CAAC,GAAG,KAAK,UAAU,EAAE,CAAC;QAChG,IAAI,CAAC;YACD,MAAM,KAAK,GAAa,EAAE,CAAC;YAC3B,IAAI,KAAK,EAAE,MAAM,IAAI,IAAI,KAAK,CAAC,YAAY,CAAC,EAAC,KAAK,EAAE,SAAS,EAAE,IAAI,EAAE,KAAK,EAAE,GAAG,EAAC,CAAC,EAAE,CAAC;gBAChF,KAAK,MAAM,GAAG,IAAI,KAAK,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC;oBAAE,KAAK,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;gBACvE,IAAI,KAAK,CAAC,MAAM,IAAI,GAAG,EAAE,CAAC;oBACtB,MAAM,IAAI,GAAG,KAAK,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC;oBAC7B,MAAM,KAAK,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;oBACtB,MAAM,CAAC,aAAa,IAAI,IAAI,CAAC,MAAM,CAAC;gBACxC,CAAC;YACL,CAAC;YACD,IAAI,KAAK,CAAC,MAAM,EAAE,CAAC;gBACf,MAAM,KAAK,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC;gBACvB,MAAM,CAAC,aAAa,IAAI,KAAK,CAAC,MAAM,CAAC;YACzC,CAAC;QACL,CAAC;QAAC,OAAO,CAAC,EAAE,CAAC;YACT,GAAG,CAAC,4DAA4D,EAAE,EAAE,EAAE,CAAC,CAAC,CAAC;QAC7E,CAAC;IACL,CAAC;IACD,OAAO,MAAM,CAAC;AAClB,CAAC"}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@mybuildex/pkg",
-  "version": "0.6.1",
+  "version": "0.8.0",
   "description": "Infra comum das APIs MyBuilder: multitenancy Prisma (pool único), middleware de tenant e CORS",
   "license": "MIT",
   "repository": {
@@ -28,7 +28,8 @@
     "build": "tsc",
     "test": "vitest run",
     "test:watch": "vitest",
-    "prepack": "npm run build"
+    "prepack": "npm run build",
+    "acl:generate": "node scripts/generate-acl-map.mjs"
   },
   "dependencies": {
     "@fastify/compress": "^7.0.3",
@@ -41,7 +42,8 @@
     "firebase": "^10.6.0",
     "firebase-admin": "^11.11.0",
     "mariadb": "3.4.5",
-    "prisma": "7.10.0"
+    "prisma": "7.10.0",
+    "redis": "^5.12.1"
   },
   "peerDependencies": {
     "fastify": ">=4"