@oktis-works/api 0.1.4 → 0.1.7

This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
Files changed (116) hide show
  1. package/dist/index.js +15 -26
  2. package/dist/index.js.map +1 -1
  3. package/dist/middleware/auth.d.ts +2 -2
  4. package/dist/middleware/auth.d.ts.map +1 -1
  5. package/dist/middleware/auth.js +7 -4
  6. package/dist/middleware/auth.js.map +1 -1
  7. package/dist/middleware/csrf.d.ts +10 -6
  8. package/dist/middleware/csrf.d.ts.map +1 -1
  9. package/dist/middleware/csrf.js +27 -8
  10. package/dist/middleware/csrf.js.map +1 -1
  11. package/dist/routes/audit-logs/index.d.ts +1 -1
  12. package/dist/routes/audit-logs/index.d.ts.map +1 -1
  13. package/dist/routes/auth/index.d.ts +1 -1
  14. package/dist/routes/auth/index.d.ts.map +1 -1
  15. package/dist/routes/auth/index.js +97 -15
  16. package/dist/routes/auth/index.js.map +1 -1
  17. package/dist/routes/builds/index.d.ts +4 -0
  18. package/dist/routes/builds/index.d.ts.map +1 -0
  19. package/dist/routes/builds/index.js +45 -0
  20. package/dist/routes/builds/index.js.map +1 -0
  21. package/dist/routes/categories/index.d.ts +1 -1
  22. package/dist/routes/categories/index.d.ts.map +1 -1
  23. package/dist/routes/content/index.d.ts +1 -1
  24. package/dist/routes/content/index.d.ts.map +1 -1
  25. package/dist/routes/content/index.js +86 -1
  26. package/dist/routes/content/index.js.map +1 -1
  27. package/dist/routes/content-types/index.d.ts +1 -1
  28. package/dist/routes/content-types/index.d.ts.map +1 -1
  29. package/dist/routes/deployments/index.d.ts +1 -1
  30. package/dist/routes/deployments/index.d.ts.map +1 -1
  31. package/dist/routes/deployments/index.js +14 -1
  32. package/dist/routes/deployments/index.js.map +1 -1
  33. package/dist/routes/docs/index.d.ts +1 -1
  34. package/dist/routes/docs/index.d.ts.map +1 -1
  35. package/dist/routes/docs/index.js +1 -0
  36. package/dist/routes/docs/index.js.map +1 -1
  37. package/dist/routes/events/index.d.ts +1 -1
  38. package/dist/routes/events/index.d.ts.map +1 -1
  39. package/dist/routes/field-groups/index.d.ts +1 -1
  40. package/dist/routes/field-groups/index.d.ts.map +1 -1
  41. package/dist/routes/field-types/index.d.ts +1 -1
  42. package/dist/routes/field-types/index.d.ts.map +1 -1
  43. package/dist/routes/health/index.d.ts +1 -1
  44. package/dist/routes/health/index.d.ts.map +1 -1
  45. package/dist/routes/hooks/index.d.ts +1 -1
  46. package/dist/routes/hooks/index.d.ts.map +1 -1
  47. package/dist/routes/media/index.d.ts +1 -1
  48. package/dist/routes/media/index.d.ts.map +1 -1
  49. package/dist/routes/media/index.js +135 -19
  50. package/dist/routes/media/index.js.map +1 -1
  51. package/dist/routes/menus/index.d.ts +1 -1
  52. package/dist/routes/menus/index.d.ts.map +1 -1
  53. package/dist/routes/metrics/index.d.ts +1 -1
  54. package/dist/routes/metrics/index.d.ts.map +1 -1
  55. package/dist/routes/pages/index.d.ts +1 -1
  56. package/dist/routes/pages/index.d.ts.map +1 -1
  57. package/dist/routes/plugins/index.d.ts +1 -1
  58. package/dist/routes/plugins/index.d.ts.map +1 -1
  59. package/dist/routes/posts/index.d.ts +1 -1
  60. package/dist/routes/posts/index.d.ts.map +1 -1
  61. package/dist/routes/roles/index.d.ts +1 -1
  62. package/dist/routes/roles/index.d.ts.map +1 -1
  63. package/dist/routes/settings/index.d.ts +1 -1
  64. package/dist/routes/settings/index.d.ts.map +1 -1
  65. package/dist/routes/shared/content-collection.d.ts.map +1 -1
  66. package/dist/routes/shared/content-collection.js +4 -0
  67. package/dist/routes/shared/content-collection.js.map +1 -1
  68. package/dist/routes/tags/index.d.ts +1 -1
  69. package/dist/routes/tags/index.d.ts.map +1 -1
  70. package/dist/routes/taxonomies/index.d.ts +1 -1
  71. package/dist/routes/taxonomies/index.d.ts.map +1 -1
  72. package/dist/routes/tenants/index.d.ts +1 -1
  73. package/dist/routes/tenants/index.d.ts.map +1 -1
  74. package/dist/routes/themes/index.d.ts +1 -1
  75. package/dist/routes/themes/index.d.ts.map +1 -1
  76. package/dist/routes/users/index.d.ts +1 -1
  77. package/dist/routes/users/index.d.ts.map +1 -1
  78. package/dist/routes/users/index.js +94 -4
  79. package/dist/routes/users/index.js.map +1 -1
  80. package/dist/routes/webhooks/index.d.ts +1 -1
  81. package/dist/routes/webhooks/index.d.ts.map +1 -1
  82. package/dist/routes/webhooks/index.js +1 -1
  83. package/dist/routes/webhooks/index.js.map +1 -1
  84. package/dist/storage.d.ts +17 -0
  85. package/dist/storage.d.ts.map +1 -0
  86. package/dist/storage.js +95 -0
  87. package/dist/storage.js.map +1 -0
  88. package/dist/utils/csrf.d.ts +6 -0
  89. package/dist/utils/csrf.d.ts.map +1 -0
  90. package/dist/utils/csrf.js +29 -0
  91. package/dist/utils/csrf.js.map +1 -0
  92. package/package.json +8 -8
  93. package/dist/middleware/csrf.test.d.ts +0 -2
  94. package/dist/middleware/csrf.test.d.ts.map +0 -1
  95. package/dist/middleware/csrf.test.js +0 -94
  96. package/dist/middleware/csrf.test.js.map +0 -1
  97. package/dist/middleware/rate-limit.test.d.ts +0 -2
  98. package/dist/middleware/rate-limit.test.d.ts.map +0 -1
  99. package/dist/middleware/rate-limit.test.js +0 -58
  100. package/dist/middleware/rate-limit.test.js.map +0 -1
  101. package/dist/middleware/trace.test.d.ts +0 -2
  102. package/dist/middleware/trace.test.d.ts.map +0 -1
  103. package/dist/middleware/trace.test.js +0 -27
  104. package/dist/middleware/trace.test.js.map +0 -1
  105. package/dist/routes/auth/me.d.ts +0 -4
  106. package/dist/routes/auth/me.d.ts.map +0 -1
  107. package/dist/routes/auth/me.js +0 -16
  108. package/dist/routes/auth/me.js.map +0 -1
  109. package/dist/routes/metrics/index.test.d.ts +0 -2
  110. package/dist/routes/metrics/index.test.d.ts.map +0 -1
  111. package/dist/routes/metrics/index.test.js +0 -64
  112. package/dist/routes/metrics/index.test.js.map +0 -1
  113. package/dist/routes/posts/revisions.test.d.ts +0 -2
  114. package/dist/routes/posts/revisions.test.d.ts.map +0 -1
  115. package/dist/routes/posts/revisions.test.js +0 -57
  116. package/dist/routes/posts/revisions.test.js.map +0 -1
@@ -1,3 +1,3 @@
1
- declare const postsRouter: import("hono").Hono<import("hono").Env, import("hono/types").BlankSchema, "/">;
1
+ declare const postsRouter: import("hono").Hono<import("hono/types").BlankEnv, import("hono/types").BlankSchema, "/">;
2
2
  export default postsRouter;
3
3
  //# sourceMappingURL=index.d.ts.map
@@ -1 +1 @@
1
- {"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../../src/routes/posts/index.ts"],"names":[],"mappings":"AAKA,QAAA,MAAM,WAAW,gFAAgE,CAAC;AAElF,eAAe,WAAW,CAAC"}
1
+ {"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../../src/routes/posts/index.ts"],"names":[],"mappings":"AAKA,QAAA,MAAM,WAAW,2FAAgE,CAAC;AAElF,eAAe,WAAW,CAAC"}
@@ -1,4 +1,4 @@
1
1
  import { Hono } from 'hono';
2
- declare const rolesRouter: Hono<import("hono").Env, import("hono/types").BlankSchema, "/">;
2
+ declare const rolesRouter: Hono<import("hono/types").BlankEnv, import("hono/types").BlankSchema, "/">;
3
3
  export default rolesRouter;
4
4
  //# sourceMappingURL=index.d.ts.map
@@ -1 +1 @@
1
- {"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../../src/routes/roles/index.ts"],"names":[],"mappings":"AAEA,OAAO,EAAE,IAAI,EAAE,MAAM,MAAM,CAAC;AAI5B,QAAA,MAAM,WAAW,iEAAa,CAAC;AA0D/B,eAAe,WAAW,CAAC"}
1
+ {"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../../src/routes/roles/index.ts"],"names":[],"mappings":"AAEA,OAAO,EAAE,IAAI,EAAE,MAAM,MAAM,CAAC;AAI5B,QAAA,MAAM,WAAW,4EAAa,CAAC;AA0D/B,eAAe,WAAW,CAAC"}
@@ -1,4 +1,4 @@
1
1
  import { Hono } from 'hono';
2
- declare const router: Hono<import("hono").Env, import("hono/types").BlankSchema, "/">;
2
+ declare const router: Hono<import("hono/types").BlankEnv, import("hono/types").BlankSchema, "/">;
3
3
  export default router;
4
4
  //# sourceMappingURL=index.d.ts.map
@@ -1 +1 @@
1
- {"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../../src/routes/settings/index.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,IAAI,EAAE,MAAM,MAAM,CAAC;AAI5B,QAAA,MAAM,MAAM,iEAAa,CAAC;AA+B1B,eAAe,MAAM,CAAC"}
1
+ {"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../../src/routes/settings/index.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,IAAI,EAAE,MAAM,MAAM,CAAC;AAI5B,QAAA,MAAM,MAAM,4EAAa,CAAC;AA+B1B,eAAe,MAAM,CAAC"}
@@ -1 +1 @@
1
- {"version":3,"file":"content-collection.d.ts","sourceRoot":"","sources":["../../../src/routes/shared/content-collection.ts"],"names":[],"mappings":"AAGA,OAAO,EAAE,IAAI,EAAE,MAAM,MAAM,CAAC;AAK5B,MAAM,WAAW,uBAAuB;IACtC,kFAAkF;IAClF,IAAI,EAAE,MAAM,CAAC;IACb,8DAA8D;IAC9D,IAAI,EAAE,MAAM,CAAC;CACd;AAED,wBAAgB,6BAA6B,CAAC,MAAM,EAAE,uBAAuB,GAAG,IAAI,CAqHnF"}
1
+ {"version":3,"file":"content-collection.d.ts","sourceRoot":"","sources":["../../../src/routes/shared/content-collection.ts"],"names":[],"mappings":"AAGA,OAAO,EAAE,IAAI,EAAE,MAAM,MAAM,CAAC;AAM5B,MAAM,WAAW,uBAAuB;IACtC,kFAAkF;IAClF,IAAI,EAAE,MAAM,CAAC;IACb,8DAA8D;IAC9D,IAAI,EAAE,MAAM,CAAC;CACd;AAED,wBAAgB,6BAA6B,CAAC,MAAM,EAAE,uBAAuB,GAAG,IAAI,CAwHnF"}
@@ -2,6 +2,7 @@
2
2
  // Elimina duplicação entre /posts e /pages (mesmo contrato, type diferente).
3
3
  import { Hono } from 'hono';
4
4
  import { contentService } from '@oktis-works/core';
5
+ import { resolveTenantId } from '@oktis-works/database';
5
6
  import { authMiddleware, requirePermission } from '../../middleware/auth.js';
6
7
  export function createContentCollectionRouter(config) {
7
8
  const Label = config.name.charAt(0).toUpperCase() + config.name.slice(1);
@@ -21,8 +22,11 @@ export function createContentCollectionRouter(config) {
21
22
  try {
22
23
  const body = await c.req.json();
23
24
  const userId = c.get('userId');
25
+ // Depois do spread: tenant/autoridade vêm do JWT, nunca do body do cliente.
26
+ const tenantId = await resolveTenantId(String(c.get('tenantId') ?? 'default'));
24
27
  const content = await contentService.create({
25
28
  ...body,
29
+ tenantId,
26
30
  type: config.type,
27
31
  authorId: userId,
28
32
  });
@@ -1 +1 @@
1
- {"version":3,"file":"content-collection.js","sourceRoot":"","sources":["../../../src/routes/shared/content-collection.ts"],"names":[],"mappings":"AAAA,oEAAoE;AACpE,6EAA6E;AAE7E,OAAO,EAAE,IAAI,EAAE,MAAM,MAAM,CAAC;AAC5B,OAAO,EAAE,cAAc,EAAE,MAAM,mBAAmB,CAAC;AAEnD,OAAO,EAAE,cAAc,EAAE,iBAAiB,EAAE,MAAM,0BAA0B,CAAC;AAS7E,MAAM,UAAU,6BAA6B,CAAC,MAA+B;IAC3E,MAAM,KAAK,GAAG,MAAM,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,WAAW,EAAE,GAAG,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC;IACzE,MAAM,MAAM,GAAG,IAAI,IAAI,EAAE,CAAC;IAE1B,MAAM,CAAC,GAAG,CAAC,GAAG,EAAE,cAAc,CAAC,CAAC;IAEhC,eAAe;IACf,MAAM,CAAC,GAAG,CAAC,GAAG,EAAE,iBAAiB,CAAC,MAAM,EAAE,SAAS,CAAC,EAAE,KAAK,EAAE,CAAC,EAAE,EAAE;QAChE,MAAM,IAAI,GAAG,MAAM,CAAC,CAAC,CAAC,GAAG,CAAC,KAAK,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC;QAC9C,MAAM,KAAK,GAAG,MAAM,CAAC,CAAC,CAAC,GAAG,CAAC,KAAK,CAAC,OAAO,CAAC,IAAI,EAAE,CAAC,CAAC;QACjD,MAAM,MAAM,GAAG,CAAC,CAAC,CAAC,GAAG,CAAC,KAAK,CAAC,QAAQ,CAAC,IAAI,SAAS,CAA8B,CAAC;QACjF,MAAM,MAAM,GAAG,CAAC,CAAC,GAAG,CAAC,KAAK,CAAC,QAAQ,CAAC,IAAI,SAAS,CAAC;QAElD,MAAM,MAAM,GAAG,MAAM,cAAc,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,KAAK,EAAE,IAAI,EAAE,MAAM,CAAC,IAAI,EAAE,MAAM,EAAE,MAAM,EAAE,CAAC,CAAC;QAC7F,OAAO,CAAC,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;IACxB,CAAC,CAAC,CAAC;IAEH,kBAAkB;IAClB,MAAM,CAAC,IAAI,CAAC,GAAG,EAAE,iBAAiB,CAAC,QAAQ,EAAE,SAAS,CAAC,EAAE,KAAK,EAAE,CAAC,EAAE,EAAE;QACnE,IAAI,CAAC;YACH,MAAM,IAAI,GAAG,MAAM,CAAC,CAAC,GAAG,CAAC,IAAI,EAAE,CAAC;YAChC,MAAM,MAAM,GAAG,CAAC,CAAC,GAAG,CAAC,QAAiB,CAAW,CAAC;YAElD,MAAM,OAAO,GAAG,MAAM,cAAc,CAAC,MAAM,CAAC;gBAC1C,GAAG,IAAI;gBACP,IAAI,EAAE,MAAM,CAAC,IAAI;gBACjB,QAAQ,EAAE,MAAM;aACjB,CAAC,CAAC;YAEH,OAAO,CAAC,CAAC,IAAI,CAAC,OAAO,EAAE,GAAG,CAAC,CAAC;QAC9B,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,MAAM,OAAO,GAAG,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,oBAAoB,MAAM,CAAC,IAAI,EAAE,CAAC;YAC3F,OAAO,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,OAAO,EAAE,EAAE,GAAG,CAAC,CAAC;QACzC,CAAC;IACH,CAAC,CAAC,CAAC;IAEH,uBAAuB;IACvB,MAAM,CAAC,GAAG,CAAC,MAAM,EAAE,iBAAiB,CAAC,MAAM,EAAE,SAAS,CAAC,EAAE,KAAK,EAAE,CAAC,EAAE,EAAE;QACnE,MAAM,EAAE,GAAG,CAAC,CAAC,GAAG,CAAC,KAAK,CAAC,IAAI,CAAW,CAAC;QACvC,MAAM,OAAO,GAAG,MAAM,cAAc,CAAC,OAAO,CAAC,EAAE,CAAC,CAAC;QAEjD,IAAI,CAAC,OAAO,IAAI,OAAO,CAAC,IAAI,KAAK,MAAM,CAAC,IAAI,EAAE,CAAC;YAC7C,OAAO,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,GAAG,KAAK,YAAY,EAAE,EAAE,GAAG,CAAC,CAAC;QACtD,CAAC;QAED,OAAO,CAAC,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;IACzB,CAAC,CAAC,CAAC;IAEH,oBAAoB;IACpB,MAAM,CAAC,GAAG,CAAC,MAAM,EAAE,iBAAiB,CAAC,QAAQ,EAAE,SAAS,CAAC,EAAE,KAAK,EAAE,CAAC,EAAE,EAAE;QACrE,IAAI,CAAC;YACH,MAAM,EAAE,GAAG,CAAC,CAAC,GAAG,CAAC,KAAK,CAAC,IAAI,CAAW,CAAC;YACvC,MAAM,IAAI,GAAG,MAAM,CAAC,CAAC,GAAG,CAAC,IAAI,EAAE,CAAC;YAEhC,MAAM,OAAO,GAAG,MAAM,cAAc,CAAC,MAAM,CAAC,EAAE,EAAE,IAAI,CAAC,CAAC;YAEtD,IAAI,CAAC,OAAO,EAAE,CAAC;gBACb,OAAO,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,GAAG,KAAK,YAAY,EAAE,EAAE,GAAG,CAAC,CAAC;YACtD,CAAC;YAED,OAAO,CAAC,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;QACzB,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,MAAM,OAAO,GAAG,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,oBAAoB,MAAM,CAAC,IAAI,EAAE,CAAC;YAC3F,OAAO,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,OAAO,EAAE,EAAE,GAAG,CAAC,CAAC;QACzC,CAAC;IACH,CAAC,CAAC,CAAC;IAEH,mDAAmD;IACnD,MAAM,CAAC,GAAG,CAAC,gBAAgB,EAAE,iBAAiB,CAAC,MAAM,EAAE,SAAS,CAAC,EAAE,KAAK,EAAE,CAAC,EAAE,EAAE;QAC7E,MAAM,EAAE,GAAG,CAAC,CAAC,GAAG,CAAC,KAAK,CAAC,IAAI,CAAW,CAAC;QACvC,MAAM,OAAO,GAAG,MAAM,cAAc,CAAC,OAAO,CAAC,EAAE,CAAC,CAAC;QAEjD,IAAI,CAAC,OAAO,IAAI,OAAO,CAAC,IAAI,KAAK,MAAM,CAAC,IAAI,EAAE,CAAC;YAC7C,OAAO,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,GAAG,KAAK,YAAY,EAAE,EAAE,GAAG,CAAC,CAAC;QACtD,CAAC;QAED,MAAM,SAAS,GAAG,MAAM,cAAc,CAAC,YAAY,CAAC,EAAE,CAAC,CAAC;QACxD,OAAO,CAAC,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,SAAS,EAAE,KAAK,EAAE,SAAS,CAAC,MAAM,EAAE,CAAC,CAAC;IAC9D,CAAC,CAAC,CAAC;IAEH,+DAA+D;IAC/D,MAAM,CAAC,IAAI,CAAC,oCAAoC,EAAE,iBAAiB,CAAC,QAAQ,EAAE,SAAS,CAAC,EAAE,KAAK,EAAE,CAAC,EAAE,EAAE;QACpG,IAAI,CAAC;YACH,MAAM,EAAE,GAAG,CAAC,CAAC,GAAG,CAAC,KAAK,CAAC,IAAI,CAAW,CAAC;YACvC,MAAM,UAAU,GAAG,CAAC,CAAC,GAAG,CAAC,KAAK,CAAC,YAAY,CAAW,CAAC;YAEvD,MAAM,QAAQ,GAAG,MAAM,cAAc,CAAC,eAAe,CAAC,EAAE,EAAE,UAAU,CAAC,CAAC;YAEtE,IAAI,CAAC,QAAQ,EAAE,CAAC;gBACd,OAAO,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,oBAAoB,EAAE,EAAE,GAAG,CAAC,CAAC;YACtD,CAAC;YAED,OAAO,CAAC,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC;QAC1B,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,MAAM,OAAO,GAAG,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,4BAA4B,CAAC;YACtF,OAAO,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,OAAO,EAAE,EAAE,GAAG,CAAC,CAAC;QACzC,CAAC;IACH,CAAC,CAAC,CAAC;IAEH,uBAAuB;IACvB,MAAM,CAAC,MAAM,CAAC,MAAM,EAAE,iBAAiB,CAAC,QAAQ,EAAE,SAAS,CAAC,EAAE,KAAK,EAAE,CAAC,EAAE,EAAE;QACxE,IAAI,CAAC;YACH,MAAM,EAAE,GAAG,CAAC,CAAC,GAAG,CAAC,KAAK,CAAC,IAAI,CAAW,CAAC;YACvC,MAAM,OAAO,GAAG,MAAM,cAAc,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC;YAEhD,IAAI,CAAC,OAAO,EAAE,CAAC;gBACb,OAAO,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,GAAG,KAAK,YAAY,EAAE,EAAE,GAAG,CAAC,CAAC;YACtD,CAAC;YAED,OAAO,CAAC,CAAC,IAAI,CAAC,EAAE,OAAO,EAAE,IAAI,EAAE,CAAC,CAAC;QACnC,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,MAAM,OAAO,GAAG,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,oBAAoB,MAAM,CAAC,IAAI,EAAE,CAAC;YAC3F,OAAO,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,OAAO,EAAE,EAAE,GAAG,CAAC,CAAC;QACzC,CAAC;IACH,CAAC,CAAC,CAAC;IAEH,OAAO,MAAM,CAAC;AAChB,CAAC"}
1
+ {"version":3,"file":"content-collection.js","sourceRoot":"","sources":["../../../src/routes/shared/content-collection.ts"],"names":[],"mappings":"AAAA,oEAAoE;AACpE,6EAA6E;AAE7E,OAAO,EAAE,IAAI,EAAE,MAAM,MAAM,CAAC;AAC5B,OAAO,EAAE,cAAc,EAAE,MAAM,mBAAmB,CAAC;AACnD,OAAO,EAAE,eAAe,EAAE,MAAM,uBAAuB,CAAC;AAExD,OAAO,EAAE,cAAc,EAAE,iBAAiB,EAAE,MAAM,0BAA0B,CAAC;AAS7E,MAAM,UAAU,6BAA6B,CAAC,MAA+B;IAC3E,MAAM,KAAK,GAAG,MAAM,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,WAAW,EAAE,GAAG,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC;IACzE,MAAM,MAAM,GAAG,IAAI,IAAI,EAAE,CAAC;IAE1B,MAAM,CAAC,GAAG,CAAC,GAAG,EAAE,cAAc,CAAC,CAAC;IAEhC,eAAe;IACf,MAAM,CAAC,GAAG,CAAC,GAAG,EAAE,iBAAiB,CAAC,MAAM,EAAE,SAAS,CAAC,EAAE,KAAK,EAAE,CAAC,EAAE,EAAE;QAChE,MAAM,IAAI,GAAG,MAAM,CAAC,CAAC,CAAC,GAAG,CAAC,KAAK,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC;QAC9C,MAAM,KAAK,GAAG,MAAM,CAAC,CAAC,CAAC,GAAG,CAAC,KAAK,CAAC,OAAO,CAAC,IAAI,EAAE,CAAC,CAAC;QACjD,MAAM,MAAM,GAAG,CAAC,CAAC,CAAC,GAAG,CAAC,KAAK,CAAC,QAAQ,CAAC,IAAI,SAAS,CAA8B,CAAC;QACjF,MAAM,MAAM,GAAG,CAAC,CAAC,GAAG,CAAC,KAAK,CAAC,QAAQ,CAAC,IAAI,SAAS,CAAC;QAElD,MAAM,MAAM,GAAG,MAAM,cAAc,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,KAAK,EAAE,IAAI,EAAE,MAAM,CAAC,IAAI,EAAE,MAAM,EAAE,MAAM,EAAE,CAAC,CAAC;QAC7F,OAAO,CAAC,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;IACxB,CAAC,CAAC,CAAC;IAEH,kBAAkB;IAClB,MAAM,CAAC,IAAI,CAAC,GAAG,EAAE,iBAAiB,CAAC,QAAQ,EAAE,SAAS,CAAC,EAAE,KAAK,EAAE,CAAC,EAAE,EAAE;QACnE,IAAI,CAAC;YACH,MAAM,IAAI,GAAG,MAAM,CAAC,CAAC,GAAG,CAAC,IAAI,EAAE,CAAC;YAChC,MAAM,MAAM,GAAG,CAAC,CAAC,GAAG,CAAC,QAAiB,CAAW,CAAC;YAClD,4EAA4E;YAC5E,MAAM,QAAQ,GAAG,MAAM,eAAe,CAAC,MAAM,CAAC,CAAC,CAAC,GAAG,CAAC,UAAmB,CAAC,IAAI,SAAS,CAAC,CAAC,CAAC;YAExF,MAAM,OAAO,GAAG,MAAM,cAAc,CAAC,MAAM,CAAC;gBAC1C,GAAG,IAAI;gBACP,QAAQ;gBACR,IAAI,EAAE,MAAM,CAAC,IAAI;gBACjB,QAAQ,EAAE,MAAM;aACjB,CAAC,CAAC;YAEH,OAAO,CAAC,CAAC,IAAI,CAAC,OAAO,EAAE,GAAG,CAAC,CAAC;QAC9B,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,MAAM,OAAO,GAAG,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,oBAAoB,MAAM,CAAC,IAAI,EAAE,CAAC;YAC3F,OAAO,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,OAAO,EAAE,EAAE,GAAG,CAAC,CAAC;QACzC,CAAC;IACH,CAAC,CAAC,CAAC;IAEH,uBAAuB;IACvB,MAAM,CAAC,GAAG,CAAC,MAAM,EAAE,iBAAiB,CAAC,MAAM,EAAE,SAAS,CAAC,EAAE,KAAK,EAAE,CAAC,EAAE,EAAE;QACnE,MAAM,EAAE,GAAG,CAAC,CAAC,GAAG,CAAC,KAAK,CAAC,IAAI,CAAW,CAAC;QACvC,MAAM,OAAO,GAAG,MAAM,cAAc,CAAC,OAAO,CAAC,EAAE,CAAC,CAAC;QAEjD,IAAI,CAAC,OAAO,IAAI,OAAO,CAAC,IAAI,KAAK,MAAM,CAAC,IAAI,EAAE,CAAC;YAC7C,OAAO,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,GAAG,KAAK,YAAY,EAAE,EAAE,GAAG,CAAC,CAAC;QACtD,CAAC;QAED,OAAO,CAAC,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;IACzB,CAAC,CAAC,CAAC;IAEH,oBAAoB;IACpB,MAAM,CAAC,GAAG,CAAC,MAAM,EAAE,iBAAiB,CAAC,QAAQ,EAAE,SAAS,CAAC,EAAE,KAAK,EAAE,CAAC,EAAE,EAAE;QACrE,IAAI,CAAC;YACH,MAAM,EAAE,GAAG,CAAC,CAAC,GAAG,CAAC,KAAK,CAAC,IAAI,CAAW,CAAC;YACvC,MAAM,IAAI,GAAG,MAAM,CAAC,CAAC,GAAG,CAAC,IAAI,EAAE,CAAC;YAEhC,MAAM,OAAO,GAAG,MAAM,cAAc,CAAC,MAAM,CAAC,EAAE,EAAE,IAAI,CAAC,CAAC;YAEtD,IAAI,CAAC,OAAO,EAAE,CAAC;gBACb,OAAO,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,GAAG,KAAK,YAAY,EAAE,EAAE,GAAG,CAAC,CAAC;YACtD,CAAC;YAED,OAAO,CAAC,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;QACzB,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,MAAM,OAAO,GAAG,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,oBAAoB,MAAM,CAAC,IAAI,EAAE,CAAC;YAC3F,OAAO,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,OAAO,EAAE,EAAE,GAAG,CAAC,CAAC;QACzC,CAAC;IACH,CAAC,CAAC,CAAC;IAEH,mDAAmD;IACnD,MAAM,CAAC,GAAG,CAAC,gBAAgB,EAAE,iBAAiB,CAAC,MAAM,EAAE,SAAS,CAAC,EAAE,KAAK,EAAE,CAAC,EAAE,EAAE;QAC7E,MAAM,EAAE,GAAG,CAAC,CAAC,GAAG,CAAC,KAAK,CAAC,IAAI,CAAW,CAAC;QACvC,MAAM,OAAO,GAAG,MAAM,cAAc,CAAC,OAAO,CAAC,EAAE,CAAC,CAAC;QAEjD,IAAI,CAAC,OAAO,IAAI,OAAO,CAAC,IAAI,KAAK,MAAM,CAAC,IAAI,EAAE,CAAC;YAC7C,OAAO,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,GAAG,KAAK,YAAY,EAAE,EAAE,GAAG,CAAC,CAAC;QACtD,CAAC;QAED,MAAM,SAAS,GAAG,MAAM,cAAc,CAAC,YAAY,CAAC,EAAE,CAAC,CAAC;QACxD,OAAO,CAAC,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,SAAS,EAAE,KAAK,EAAE,SAAS,CAAC,MAAM,EAAE,CAAC,CAAC;IAC9D,CAAC,CAAC,CAAC;IAEH,+DAA+D;IAC/D,MAAM,CAAC,IAAI,CAAC,oCAAoC,EAAE,iBAAiB,CAAC,QAAQ,EAAE,SAAS,CAAC,EAAE,KAAK,EAAE,CAAC,EAAE,EAAE;QACpG,IAAI,CAAC;YACH,MAAM,EAAE,GAAG,CAAC,CAAC,GAAG,CAAC,KAAK,CAAC,IAAI,CAAW,CAAC;YACvC,MAAM,UAAU,GAAG,CAAC,CAAC,GAAG,CAAC,KAAK,CAAC,YAAY,CAAW,CAAC;YAEvD,MAAM,QAAQ,GAAG,MAAM,cAAc,CAAC,eAAe,CAAC,EAAE,EAAE,UAAU,CAAC,CAAC;YAEtE,IAAI,CAAC,QAAQ,EAAE,CAAC;gBACd,OAAO,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,oBAAoB,EAAE,EAAE,GAAG,CAAC,CAAC;YACtD,CAAC;YAED,OAAO,CAAC,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC;QAC1B,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,MAAM,OAAO,GAAG,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,4BAA4B,CAAC;YACtF,OAAO,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,OAAO,EAAE,EAAE,GAAG,CAAC,CAAC;QACzC,CAAC;IACH,CAAC,CAAC,CAAC;IAEH,uBAAuB;IACvB,MAAM,CAAC,MAAM,CAAC,MAAM,EAAE,iBAAiB,CAAC,QAAQ,EAAE,SAAS,CAAC,EAAE,KAAK,EAAE,CAAC,EAAE,EAAE;QACxE,IAAI,CAAC;YACH,MAAM,EAAE,GAAG,CAAC,CAAC,GAAG,CAAC,KAAK,CAAC,IAAI,CAAW,CAAC;YACvC,MAAM,OAAO,GAAG,MAAM,cAAc,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC;YAEhD,IAAI,CAAC,OAAO,EAAE,CAAC;gBACb,OAAO,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,GAAG,KAAK,YAAY,EAAE,EAAE,GAAG,CAAC,CAAC;YACtD,CAAC;YAED,OAAO,CAAC,CAAC,IAAI,CAAC,EAAE,OAAO,EAAE,IAAI,EAAE,CAAC,CAAC;QACnC,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,MAAM,OAAO,GAAG,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,oBAAoB,MAAM,CAAC,IAAI,EAAE,CAAC;YAC3F,OAAO,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,OAAO,EAAE,EAAE,GAAG,CAAC,CAAC;QACzC,CAAC;IACH,CAAC,CAAC,CAAC;IAEH,OAAO,MAAM,CAAC;AAChB,CAAC"}
@@ -1,4 +1,4 @@
1
1
  import { Hono } from 'hono';
2
- declare const router: Hono<import("hono").Env, import("hono/types").BlankSchema, "/">;
2
+ declare const router: Hono<import("hono/types").BlankEnv, import("hono/types").BlankSchema, "/">;
3
3
  export default router;
4
4
  //# sourceMappingURL=index.d.ts.map
@@ -1 +1 @@
1
- {"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../../src/routes/tags/index.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,IAAI,EAAE,MAAM,MAAM,CAAC;AAI5B,QAAA,MAAM,MAAM,iEAAa,CAAC;AA8B1B,eAAe,MAAM,CAAC"}
1
+ {"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../../src/routes/tags/index.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,IAAI,EAAE,MAAM,MAAM,CAAC;AAI5B,QAAA,MAAM,MAAM,4EAAa,CAAC;AA8B1B,eAAe,MAAM,CAAC"}
@@ -1,4 +1,4 @@
1
1
  import { Hono } from 'hono';
2
- declare const router: Hono<import("hono").Env, import("hono/types").BlankSchema, "/">;
2
+ declare const router: Hono<import("hono/types").BlankEnv, import("hono/types").BlankSchema, "/">;
3
3
  export default router;
4
4
  //# sourceMappingURL=index.d.ts.map
@@ -1 +1 @@
1
- {"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../../src/routes/taxonomies/index.ts"],"names":[],"mappings":"AAEA,OAAO,EAAE,IAAI,EAAE,MAAM,MAAM,CAAC;AAI5B,QAAA,MAAM,MAAM,iEAAa,CAAC;AA+G1B,eAAe,MAAM,CAAC"}
1
+ {"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../../src/routes/taxonomies/index.ts"],"names":[],"mappings":"AAEA,OAAO,EAAE,IAAI,EAAE,MAAM,MAAM,CAAC;AAI5B,QAAA,MAAM,MAAM,4EAAa,CAAC;AA+G1B,eAAe,MAAM,CAAC"}
@@ -1,4 +1,4 @@
1
1
  import { Hono } from 'hono';
2
- declare const tenantsRouter: Hono<import("hono").Env, import("hono/types").BlankSchema, "/">;
2
+ declare const tenantsRouter: Hono<import("hono/types").BlankEnv, import("hono/types").BlankSchema, "/">;
3
3
  export default tenantsRouter;
4
4
  //# sourceMappingURL=index.d.ts.map
@@ -1 +1 @@
1
- {"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../../src/routes/tenants/index.ts"],"names":[],"mappings":"AAEA,OAAO,EAAE,IAAI,EAAE,MAAM,MAAM,CAAC;AAI5B,QAAA,MAAM,aAAa,iEAAa,CAAC;AAwEjC,eAAe,aAAa,CAAC"}
1
+ {"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../../src/routes/tenants/index.ts"],"names":[],"mappings":"AAEA,OAAO,EAAE,IAAI,EAAE,MAAM,MAAM,CAAC;AAI5B,QAAA,MAAM,aAAa,4EAAa,CAAC;AAwEjC,eAAe,aAAa,CAAC"}
@@ -1,4 +1,4 @@
1
1
  import { Hono } from 'hono';
2
- declare const themes: Hono<import("hono").Env, import("hono/types").BlankSchema, "/">;
2
+ declare const themes: Hono<import("hono/types").BlankEnv, import("hono/types").BlankSchema, "/">;
3
3
  export default themes;
4
4
  //# sourceMappingURL=index.d.ts.map
@@ -1 +1 @@
1
- {"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../../src/routes/themes/index.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,IAAI,EAAE,MAAM,MAAM,CAAA;AAI3B,QAAA,MAAM,MAAM,iEAAa,CAAA;AAmDzB,eAAe,MAAM,CAAA"}
1
+ {"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../../src/routes/themes/index.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,IAAI,EAAE,MAAM,MAAM,CAAA;AAI3B,QAAA,MAAM,MAAM,4EAAa,CAAA;AAmDzB,eAAe,MAAM,CAAA"}
@@ -1,4 +1,4 @@
1
1
  import { Hono } from 'hono';
2
- declare const router: Hono<import("hono").Env, import("hono/types").BlankSchema, "/">;
2
+ declare const router: Hono<import("hono/types").BlankEnv, import("hono/types").BlankSchema, "/">;
3
3
  export default router;
4
4
  //# sourceMappingURL=index.d.ts.map
@@ -1 +1 @@
1
- {"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../../src/routes/users/index.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,IAAI,EAAE,MAAM,MAAM,CAAC;AAM5B,QAAA,MAAM,MAAM,iEAAa,CAAC;AAiE1B,eAAe,MAAM,CAAC"}
1
+ {"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../../src/routes/users/index.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,IAAI,EAAE,MAAM,MAAM,CAAC;AAO5B,QAAA,MAAM,MAAM,4EAAa,CAAC;AA2K1B,eAAe,MAAM,CAAC"}
@@ -1,28 +1,60 @@
1
1
  import { Hono } from 'hono';
2
2
  import { userService } from '@oktis-works/core';
3
+ import { resolveTenantId } from '@oktis-works/database';
3
4
  import { authMiddleware, requirePermission } from '../../middleware/auth.js';
4
5
  import { hashPassword } from '@oktis-works/auth';
5
6
  const router = new Hono();
6
7
  router.use('*', authMiddleware);
8
+ /** JWT guarda o slug (ex.: "default") ou UUID — resolve para o UUID do tenant. */
9
+ async function tenantUuid(c) {
10
+ const raw = c.get('tenantId') ?? 'default';
11
+ return resolveTenantId(raw);
12
+ }
13
+ /** Remove credenciais da resposta (o SELECT * traz password_hash). */
14
+ function sanitizeUser(user) {
15
+ const { password_hash: _ph, passwordHash: _ph2, ...rest } = user;
16
+ return rest;
17
+ }
7
18
  router.get('/', requirePermission('read', 'user'), async (c) => {
8
19
  const page = Number(c.req.query('page') ?? 1);
9
20
  const limit = Number(c.req.query('limit') ?? 20);
10
21
  const search = c.req.query('search') || undefined;
11
22
  const status = (c.req.query('status') || undefined);
12
23
  const result = await userService.list({ page, limit, search, status });
13
- return c.json(result);
24
+ const tenantId = await tenantUuid(c);
25
+ const rolesMap = await userService.rolesForUsers(result.data.map((u) => u.id), tenantId);
26
+ return c.json({
27
+ data: result.data.map((u) => ({
28
+ ...sanitizeUser(u),
29
+ roles: rolesMap[u.id] ?? [],
30
+ })),
31
+ total: result.total,
32
+ });
14
33
  });
15
34
  router.post('/', requirePermission('create', 'user'), async (c) => {
16
35
  try {
17
36
  const body = await c.req.json();
18
37
  const passwordHash = await hashPassword(body.password);
38
+ // Valida o papel ANTES de criar (evita usuário órfão se o roleId for ruim)
39
+ let role = null;
40
+ if (typeof body.roleId === 'string' && body.roleId) {
41
+ role = await userService.getRoleById(body.roleId);
42
+ if (!role)
43
+ return c.json({ error: 'Role not found' }, 404);
44
+ }
19
45
  const result = await userService.create({
20
46
  email: body.email,
21
47
  name: body.name,
22
48
  passwordHash,
23
49
  avatar: body.avatar,
24
50
  });
25
- return c.json(result, 201);
51
+ let roles = [];
52
+ if (role) {
53
+ const tenantId = await tenantUuid(c);
54
+ await userService.addToTenant(result.id, tenantId, role.id);
55
+ roles = [role.slug];
56
+ }
57
+ return c.json({ ...sanitizeUser(result), roles }, 201);
26
58
  }
27
59
  catch (error) {
28
60
  const message = error instanceof Error ? error.message : 'Failed to create user';
@@ -34,7 +66,12 @@ router.get('/:id', requirePermission('read', 'user'), async (c) => {
34
66
  const result = await userService.getById(id);
35
67
  if (!result)
36
68
  return c.json({ error: 'User not found' }, 404);
37
- return c.json(result);
69
+ const tenantId = await tenantUuid(c);
70
+ const roles = await userService.rolesFor(result.id, tenantId);
71
+ return c.json({
72
+ ...sanitizeUser(result),
73
+ roles,
74
+ });
38
75
  });
39
76
  router.put('/:id', requirePermission('update', 'user'), async (c) => {
40
77
  try {
@@ -48,13 +85,66 @@ router.put('/:id', requirePermission('update', 'user'), async (c) => {
48
85
  });
49
86
  if (!result)
50
87
  return c.json({ error: 'User not found' }, 404);
51
- return c.json(result);
88
+ return c.json(sanitizeUser(result));
52
89
  }
53
90
  catch (error) {
54
91
  const message = error instanceof Error ? error.message : 'Failed to update user';
55
92
  return c.json({ error: message }, 400);
56
93
  }
57
94
  });
95
+ router.put('/:id/password', requirePermission('update', 'user'), async (c) => {
96
+ try {
97
+ const id = c.req.param('id');
98
+ const body = await c.req.json();
99
+ if (typeof body.password !== 'string' || body.password.length < 8) {
100
+ return c.json({ error: 'Password must be at least 8 characters' }, 400);
101
+ }
102
+ const passwordHash = await hashPassword(body.password);
103
+ const updated = await userService.updatePassword(id, passwordHash);
104
+ if (!updated)
105
+ return c.json({ error: 'User not found' }, 404);
106
+ return c.json({ success: true });
107
+ }
108
+ catch (error) {
109
+ const message = error instanceof Error ? error.message : 'Failed to update password';
110
+ return c.json({ error: message }, 400);
111
+ }
112
+ });
113
+ /** Atribui (ou troca) o papel do usuário no tenant atual. */
114
+ router.post('/:id/roles', requirePermission('update', 'user'), async (c) => {
115
+ try {
116
+ const id = c.req.param('id');
117
+ const body = await c.req.json();
118
+ if (typeof body.roleId !== 'string' || !body.roleId) {
119
+ return c.json({ error: 'Missing roleId' }, 400);
120
+ }
121
+ const user = await userService.getById(id);
122
+ if (!user)
123
+ return c.json({ error: 'User not found' }, 404);
124
+ const tenantId = await tenantUuid(c);
125
+ const roleExists = await userService.getRoleById(body.roleId);
126
+ if (!roleExists)
127
+ return c.json({ error: 'Role not found' }, 404);
128
+ await userService.addToTenant(user.id, tenantId, body.roleId);
129
+ const roles = await userService.rolesFor(user.id, tenantId);
130
+ return c.json({ success: true, roles });
131
+ }
132
+ catch (error) {
133
+ const message = error instanceof Error ? error.message : 'Failed to assign role';
134
+ return c.json({ error: message }, 400);
135
+ }
136
+ });
137
+ router.delete('/:id/roles/:roleId', requirePermission('update', 'user'), async (c) => {
138
+ const id = c.req.param('id');
139
+ const roleId = c.req.param('roleId');
140
+ const user = await userService.getById(id);
141
+ if (!user)
142
+ return c.json({ error: 'User not found' }, 404);
143
+ const tenantId = await tenantUuid(c);
144
+ await userService.removeFromTenant(user.id, tenantId, roleId);
145
+ const roles = await userService.rolesFor(user.id, tenantId);
146
+ return c.json({ success: true, roles });
147
+ });
58
148
  router.delete('/:id', requirePermission('delete', 'user'), async (c) => {
59
149
  const id = c.req.param('id');
60
150
  const deleted = await userService.delete(id);
@@ -1 +1 @@
1
- {"version":3,"file":"index.js","sourceRoot":"","sources":["../../../src/routes/users/index.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,IAAI,EAAE,MAAM,MAAM,CAAC;AAC5B,OAAO,EAAE,WAAW,EAAE,MAAM,mBAAmB,CAAC;AAEhD,OAAO,EAAE,cAAc,EAAE,iBAAiB,EAAE,MAAM,0BAA0B,CAAC;AAC7E,OAAO,EAAE,YAAY,EAAE,MAAM,mBAAmB,CAAC;AAEjD,MAAM,MAAM,GAAG,IAAI,IAAI,EAAE,CAAC;AAE1B,MAAM,CAAC,GAAG,CAAC,GAAG,EAAE,cAAc,CAAC,CAAC;AAEhC,MAAM,CAAC,GAAG,CAAC,GAAG,EAAE,iBAAiB,CAAC,MAAM,EAAE,MAAM,CAAC,EAAE,KAAK,EAAE,CAAC,EAAE,EAAE;IAC7D,MAAM,IAAI,GAAG,MAAM,CAAC,CAAC,CAAC,GAAG,CAAC,KAAK,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC;IAC9C,MAAM,KAAK,GAAG,MAAM,CAAC,CAAC,CAAC,GAAG,CAAC,KAAK,CAAC,OAAO,CAAC,IAAI,EAAE,CAAC,CAAC;IACjD,MAAM,MAAM,GAAG,CAAC,CAAC,GAAG,CAAC,KAAK,CAAC,QAAQ,CAAC,IAAI,SAAS,CAAC;IAClD,MAAM,MAAM,GAAG,CAAC,CAAC,CAAC,GAAG,CAAC,KAAK,CAAC,QAAQ,CAAC,IAAI,SAAS,CAA2B,CAAC;IAE9E,MAAM,MAAM,GAAG,MAAM,WAAW,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,KAAK,EAAE,MAAM,EAAE,MAAM,EAAE,CAAC,CAAC;IACvE,OAAO,CAAC,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;AACxB,CAAC,CAAC,CAAC;AAEH,MAAM,CAAC,IAAI,CAAC,GAAG,EAAE,iBAAiB,CAAC,QAAQ,EAAE,MAAM,CAAC,EAAE,KAAK,EAAE,CAAC,EAAE,EAAE;IAChE,IAAI,CAAC;QACH,MAAM,IAAI,GAAG,MAAM,CAAC,CAAC,GAAG,CAAC,IAAI,EAAE,CAAC;QAChC,MAAM,YAAY,GAAG,MAAM,YAAY,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC;QAEvD,MAAM,MAAM,GAAG,MAAM,WAAW,CAAC,MAAM,CAAC;YACtC,KAAK,EAAE,IAAI,CAAC,KAAK;YACjB,IAAI,EAAE,IAAI,CAAC,IAAI;YACf,YAAY;YACZ,MAAM,EAAE,IAAI,CAAC,MAAM;SACpB,CAAC,CAAC;QACH,OAAO,CAAC,CAAC,IAAI,CAAC,MAAM,EAAE,GAAG,CAAC,CAAC;IAC7B,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,MAAM,OAAO,GAAG,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,uBAAuB,CAAC;QACjF,OAAO,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,OAAO,EAAE,EAAE,GAAG,CAAC,CAAC;IACzC,CAAC;AACH,CAAC,CAAC,CAAC;AAEH,MAAM,CAAC,GAAG,CAAC,MAAM,EAAE,iBAAiB,CAAC,MAAM,EAAE,MAAM,CAAC,EAAE,KAAK,EAAE,CAAC,EAAE,EAAE;IAChE,MAAM,EAAE,GAAG,CAAC,CAAC,GAAG,CAAC,KAAK,CAAC,IAAI,CAAW,CAAC;IACvC,MAAM,MAAM,GAAG,MAAM,WAAW,CAAC,OAAO,CAAC,EAAE,CAAC,CAAC;IAC7C,IAAI,CAAC,MAAM;QAAE,OAAO,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,gBAAgB,EAAE,EAAE,GAAG,CAAC,CAAC;IAC7D,OAAO,CAAC,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;AACxB,CAAC,CAAC,CAAC;AAEH,MAAM,CAAC,GAAG,CAAC,MAAM,EAAE,iBAAiB,CAAC,QAAQ,EAAE,MAAM,CAAC,EAAE,KAAK,EAAE,CAAC,EAAE,EAAE;IAClE,IAAI,CAAC;QACH,MAAM,EAAE,GAAG,CAAC,CAAC,GAAG,CAAC,KAAK,CAAC,IAAI,CAAW,CAAC;QACvC,MAAM,IAAI,GAAG,MAAM,CAAC,CAAC,GAAG,CAAC,IAAI,EAAE,CAAC;QAEhC,MAAM,MAAM,GAAG,MAAM,WAAW,CAAC,MAAM,CAAC,EAAE,EAAE;YAC1C,IAAI,EAAE,IAAI,CAAC,IAAI;YACf,KAAK,EAAE,IAAI,CAAC,KAAK;YACjB,MAAM,EAAE,IAAI,CAAC,MAAM;YACnB,MAAM,EAAE,IAAI,CAAC,MAAM;SACpB,CAAC,CAAC;QACH,IAAI,CAAC,MAAM;YAAE,OAAO,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,gBAAgB,EAAE,EAAE,GAAG,CAAC,CAAC;QAC7D,OAAO,CAAC,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;IACxB,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,MAAM,OAAO,GAAG,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,uBAAuB,CAAC;QACjF,OAAO,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,OAAO,EAAE,EAAE,GAAG,CAAC,CAAC;IACzC,CAAC;AACH,CAAC,CAAC,CAAC;AAEH,MAAM,CAAC,MAAM,CAAC,MAAM,EAAE,iBAAiB,CAAC,QAAQ,EAAE,MAAM,CAAC,EAAE,KAAK,EAAE,CAAC,EAAE,EAAE;IACrE,MAAM,EAAE,GAAG,CAAC,CAAC,GAAG,CAAC,KAAK,CAAC,IAAI,CAAW,CAAC;IACvC,MAAM,OAAO,GAAG,MAAM,WAAW,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC;IAC7C,IAAI,CAAC,OAAO;QAAE,OAAO,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,gBAAgB,EAAE,EAAE,GAAG,CAAC,CAAC;IAC9D,OAAO,CAAC,CAAC,IAAI,CAAC,EAAE,OAAO,EAAE,IAAI,EAAE,CAAC,CAAC;AACnC,CAAC,CAAC,CAAC;AAEH,eAAe,MAAM,CAAC"}
1
+ {"version":3,"file":"index.js","sourceRoot":"","sources":["../../../src/routes/users/index.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,IAAI,EAAE,MAAM,MAAM,CAAC;AAC5B,OAAO,EAAE,WAAW,EAAE,MAAM,mBAAmB,CAAC;AAChD,OAAO,EAAE,eAAe,EAAE,MAAM,uBAAuB,CAAC;AAExD,OAAO,EAAE,cAAc,EAAE,iBAAiB,EAAE,MAAM,0BAA0B,CAAC;AAC7E,OAAO,EAAE,YAAY,EAAE,MAAM,mBAAmB,CAAC;AAEjD,MAAM,MAAM,GAAG,IAAI,IAAI,EAAE,CAAC;AAE1B,MAAM,CAAC,GAAG,CAAC,GAAG,EAAE,cAAc,CAAC,CAAC;AAEhC,kFAAkF;AAClF,KAAK,UAAU,UAAU,CAAC,CAAoC;IAC5D,MAAM,GAAG,GAAI,CAAC,CAAC,GAAG,CAAC,UAAU,CAAwB,IAAI,SAAS,CAAC;IACnE,OAAO,eAAe,CAAC,GAAG,CAAC,CAAC;AAC9B,CAAC;AAED,sEAAsE;AACtE,SAAS,YAAY,CAAC,IAA6B;IACjD,MAAM,EAAE,aAAa,EAAE,GAAG,EAAE,YAAY,EAAE,IAAI,EAAE,GAAG,IAAI,EAAE,GAAG,IAAI,CAAC;IACjE,OAAO,IAAI,CAAC;AACd,CAAC;AAED,MAAM,CAAC,GAAG,CAAC,GAAG,EAAE,iBAAiB,CAAC,MAAM,EAAE,MAAM,CAAC,EAAE,KAAK,EAAE,CAAC,EAAE,EAAE;IAC7D,MAAM,IAAI,GAAG,MAAM,CAAC,CAAC,CAAC,GAAG,CAAC,KAAK,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC;IAC9C,MAAM,KAAK,GAAG,MAAM,CAAC,CAAC,CAAC,GAAG,CAAC,KAAK,CAAC,OAAO,CAAC,IAAI,EAAE,CAAC,CAAC;IACjD,MAAM,MAAM,GAAG,CAAC,CAAC,GAAG,CAAC,KAAK,CAAC,QAAQ,CAAC,IAAI,SAAS,CAAC;IAClD,MAAM,MAAM,GAAG,CAAC,CAAC,CAAC,GAAG,CAAC,KAAK,CAAC,QAAQ,CAAC,IAAI,SAAS,CAA2B,CAAC;IAE9E,MAAM,MAAM,GAAG,MAAM,WAAW,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,KAAK,EAAE,MAAM,EAAE,MAAM,EAAE,CAAC,CAAC;IACvE,MAAM,QAAQ,GAAG,MAAM,UAAU,CAAC,CAAC,CAAC,CAAC;IACrC,MAAM,QAAQ,GAAG,MAAM,WAAW,CAAC,aAAa,CAC9C,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,EAC5B,QAAQ,CACT,CAAC;IAEF,OAAO,CAAC,CAAC,IAAI,CAAC;QACZ,IAAI,EAAE,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;YAC5B,GAAG,YAAY,CAAC,CAAuC,CAAC;YACxD,KAAK,EAAE,QAAQ,CAAC,CAAC,CAAC,EAAE,CAAC,IAAI,EAAE;SAC5B,CAAC,CAAC;QACH,KAAK,EAAE,MAAM,CAAC,KAAK;KACpB,CAAC,CAAC;AACL,CAAC,CAAC,CAAC;AAEH,MAAM,CAAC,IAAI,CAAC,GAAG,EAAE,iBAAiB,CAAC,QAAQ,EAAE,MAAM,CAAC,EAAE,KAAK,EAAE,CAAC,EAAE,EAAE;IAChE,IAAI,CAAC;QACH,MAAM,IAAI,GAAG,MAAM,CAAC,CAAC,GAAG,CAAC,IAAI,EAAE,CAAC;QAChC,MAAM,YAAY,GAAG,MAAM,YAAY,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC;QAEvD,2EAA2E;QAC3E,IAAI,IAAI,GAAwC,IAAI,CAAC;QACrD,IAAI,OAAO,IAAI,CAAC,MAAM,KAAK,QAAQ,IAAI,IAAI,CAAC,MAAM,EAAE,CAAC;YACnD,IAAI,GAAG,MAAM,WAAW,CAAC,WAAW,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;YAClD,IAAI,CAAC,IAAI;gBAAE,OAAO,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,gBAAgB,EAAE,EAAE,GAAG,CAAC,CAAC;QAC7D,CAAC;QAED,MAAM,MAAM,GAAG,MAAM,WAAW,CAAC,MAAM,CAAC;YACtC,KAAK,EAAE,IAAI,CAAC,KAAK;YACjB,IAAI,EAAE,IAAI,CAAC,IAAI;YACf,YAAY;YACZ,MAAM,EAAE,IAAI,CAAC,MAAM;SACpB,CAAC,CAAC;QAEH,IAAI,KAAK,GAAa,EAAE,CAAC;QACzB,IAAI,IAAI,EAAE,CAAC;YACT,MAAM,QAAQ,GAAG,MAAM,UAAU,CAAC,CAAC,CAAC,CAAC;YACrC,MAAM,WAAW,CAAC,WAAW,CAAC,MAAM,CAAC,EAAE,EAAE,QAAQ,EAAE,IAAI,CAAC,EAAE,CAAC,CAAC;YAC5D,KAAK,GAAG,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QACtB,CAAC;QAED,OAAO,CAAC,CAAC,IAAI,CACX,EAAE,GAAG,YAAY,CAAC,MAA4C,CAAC,EAAE,KAAK,EAAE,EACxE,GAAG,CACJ,CAAC;IACJ,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,MAAM,OAAO,GAAG,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,uBAAuB,CAAC;QACjF,OAAO,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,OAAO,EAAE,EAAE,GAAG,CAAC,CAAC;IACzC,CAAC;AACH,CAAC,CAAC,CAAC;AAEH,MAAM,CAAC,GAAG,CAAC,MAAM,EAAE,iBAAiB,CAAC,MAAM,EAAE,MAAM,CAAC,EAAE,KAAK,EAAE,CAAC,EAAE,EAAE;IAChE,MAAM,EAAE,GAAG,CAAC,CAAC,GAAG,CAAC,KAAK,CAAC,IAAI,CAAW,CAAC;IACvC,MAAM,MAAM,GAAG,MAAM,WAAW,CAAC,OAAO,CAAC,EAAE,CAAC,CAAC;IAC7C,IAAI,CAAC,MAAM;QAAE,OAAO,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,gBAAgB,EAAE,EAAE,GAAG,CAAC,CAAC;IAE7D,MAAM,QAAQ,GAAG,MAAM,UAAU,CAAC,CAAC,CAAC,CAAC;IACrC,MAAM,KAAK,GAAG,MAAM,WAAW,CAAC,QAAQ,CAAC,MAAM,CAAC,EAAE,EAAE,QAAQ,CAAC,CAAC;IAC9D,OAAO,CAAC,CAAC,IAAI,CAAC;QACZ,GAAG,YAAY,CAAC,MAA4C,CAAC;QAC7D,KAAK;KACN,CAAC,CAAC;AACL,CAAC,CAAC,CAAC;AAEH,MAAM,CAAC,GAAG,CAAC,MAAM,EAAE,iBAAiB,CAAC,QAAQ,EAAE,MAAM,CAAC,EAAE,KAAK,EAAE,CAAC,EAAE,EAAE;IAClE,IAAI,CAAC;QACH,MAAM,EAAE,GAAG,CAAC,CAAC,GAAG,CAAC,KAAK,CAAC,IAAI,CAAW,CAAC;QACvC,MAAM,IAAI,GAAG,MAAM,CAAC,CAAC,GAAG,CAAC,IAAI,EAAE,CAAC;QAEhC,MAAM,MAAM,GAAG,MAAM,WAAW,CAAC,MAAM,CAAC,EAAE,EAAE;YAC1C,IAAI,EAAE,IAAI,CAAC,IAAI;YACf,KAAK,EAAE,IAAI,CAAC,KAAK;YACjB,MAAM,EAAE,IAAI,CAAC,MAAM;YACnB,MAAM,EAAE,IAAI,CAAC,MAAM;SACpB,CAAC,CAAC;QACH,IAAI,CAAC,MAAM;YAAE,OAAO,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,gBAAgB,EAAE,EAAE,GAAG,CAAC,CAAC;QAC7D,OAAO,CAAC,CAAC,IAAI,CAAC,YAAY,CAAC,MAA4C,CAAC,CAAC,CAAC;IAC5E,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,MAAM,OAAO,GAAG,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,uBAAuB,CAAC;QACjF,OAAO,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,OAAO,EAAE,EAAE,GAAG,CAAC,CAAC;IACzC,CAAC;AACH,CAAC,CAAC,CAAC;AAEH,MAAM,CAAC,GAAG,CAAC,eAAe,EAAE,iBAAiB,CAAC,QAAQ,EAAE,MAAM,CAAC,EAAE,KAAK,EAAE,CAAC,EAAE,EAAE;IAC3E,IAAI,CAAC;QACH,MAAM,EAAE,GAAG,CAAC,CAAC,GAAG,CAAC,KAAK,CAAC,IAAI,CAAW,CAAC;QACvC,MAAM,IAAI,GAAG,MAAM,CAAC,CAAC,GAAG,CAAC,IAAI,EAAE,CAAC;QAEhC,IAAI,OAAO,IAAI,CAAC,QAAQ,KAAK,QAAQ,IAAI,IAAI,CAAC,QAAQ,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;YAClE,OAAO,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,wCAAwC,EAAE,EAAE,GAAG,CAAC,CAAC;QAC1E,CAAC;QAED,MAAM,YAAY,GAAG,MAAM,YAAY,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC;QACvD,MAAM,OAAO,GAAG,MAAM,WAAW,CAAC,cAAc,CAAC,EAAE,EAAE,YAAY,CAAC,CAAC;QACnE,IAAI,CAAC,OAAO;YAAE,OAAO,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,gBAAgB,EAAE,EAAE,GAAG,CAAC,CAAC;QAC9D,OAAO,CAAC,CAAC,IAAI,CAAC,EAAE,OAAO,EAAE,IAAI,EAAE,CAAC,CAAC;IACnC,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,MAAM,OAAO,GAAG,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,2BAA2B,CAAC;QACrF,OAAO,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,OAAO,EAAE,EAAE,GAAG,CAAC,CAAC;IACzC,CAAC;AACH,CAAC,CAAC,CAAC;AAEH,6DAA6D;AAC7D,MAAM,CAAC,IAAI,CAAC,YAAY,EAAE,iBAAiB,CAAC,QAAQ,EAAE,MAAM,CAAC,EAAE,KAAK,EAAE,CAAC,EAAE,EAAE;IACzE,IAAI,CAAC;QACH,MAAM,EAAE,GAAG,CAAC,CAAC,GAAG,CAAC,KAAK,CAAC,IAAI,CAAW,CAAC;QACvC,MAAM,IAAI,GAAG,MAAM,CAAC,CAAC,GAAG,CAAC,IAAI,EAAE,CAAC;QAEhC,IAAI,OAAO,IAAI,CAAC,MAAM,KAAK,QAAQ,IAAI,CAAC,IAAI,CAAC,MAAM,EAAE,CAAC;YACpD,OAAO,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,gBAAgB,EAAE,EAAE,GAAG,CAAC,CAAC;QAClD,CAAC;QAED,MAAM,IAAI,GAAG,MAAM,WAAW,CAAC,OAAO,CAAC,EAAE,CAAC,CAAC;QAC3C,IAAI,CAAC,IAAI;YAAE,OAAO,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,gBAAgB,EAAE,EAAE,GAAG,CAAC,CAAC;QAE3D,MAAM,QAAQ,GAAG,MAAM,UAAU,CAAC,CAAC,CAAC,CAAC;QACrC,MAAM,UAAU,GAAG,MAAM,WAAW,CAAC,WAAW,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;QAC9D,IAAI,CAAC,UAAU;YAAE,OAAO,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,gBAAgB,EAAE,EAAE,GAAG,CAAC,CAAC;QAEjE,MAAM,WAAW,CAAC,WAAW,CAAC,IAAI,CAAC,EAAE,EAAE,QAAQ,EAAE,IAAI,CAAC,MAAM,CAAC,CAAC;QAC9D,MAAM,KAAK,GAAG,MAAM,WAAW,CAAC,QAAQ,CAAC,IAAI,CAAC,EAAE,EAAE,QAAQ,CAAC,CAAC;QAC5D,OAAO,CAAC,CAAC,IAAI,CAAC,EAAE,OAAO,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,CAAC;IAC1C,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,MAAM,OAAO,GAAG,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,uBAAuB,CAAC;QACjF,OAAO,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,OAAO,EAAE,EAAE,GAAG,CAAC,CAAC;IACzC,CAAC;AACH,CAAC,CAAC,CAAC;AAEH,MAAM,CAAC,MAAM,CAAC,oBAAoB,EAAE,iBAAiB,CAAC,QAAQ,EAAE,MAAM,CAAC,EAAE,KAAK,EAAE,CAAC,EAAE,EAAE;IACnF,MAAM,EAAE,GAAG,CAAC,CAAC,GAAG,CAAC,KAAK,CAAC,IAAI,CAAW,CAAC;IACvC,MAAM,MAAM,GAAG,CAAC,CAAC,GAAG,CAAC,KAAK,CAAC,QAAQ,CAAW,CAAC;IAE/C,MAAM,IAAI,GAAG,MAAM,WAAW,CAAC,OAAO,CAAC,EAAE,CAAC,CAAC;IAC3C,IAAI,CAAC,IAAI;QAAE,OAAO,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,gBAAgB,EAAE,EAAE,GAAG,CAAC,CAAC;IAE3D,MAAM,QAAQ,GAAG,MAAM,UAAU,CAAC,CAAC,CAAC,CAAC;IACrC,MAAM,WAAW,CAAC,gBAAgB,CAAC,IAAI,CAAC,EAAE,EAAE,QAAQ,EAAE,MAAM,CAAC,CAAC;IAC9D,MAAM,KAAK,GAAG,MAAM,WAAW,CAAC,QAAQ,CAAC,IAAI,CAAC,EAAE,EAAE,QAAQ,CAAC,CAAC;IAC5D,OAAO,CAAC,CAAC,IAAI,CAAC,EAAE,OAAO,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,CAAC;AAC1C,CAAC,CAAC,CAAC;AAEH,MAAM,CAAC,MAAM,CAAC,MAAM,EAAE,iBAAiB,CAAC,QAAQ,EAAE,MAAM,CAAC,EAAE,KAAK,EAAE,CAAC,EAAE,EAAE;IACrE,MAAM,EAAE,GAAG,CAAC,CAAC,GAAG,CAAC,KAAK,CAAC,IAAI,CAAW,CAAC;IACvC,MAAM,OAAO,GAAG,MAAM,WAAW,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC;IAC7C,IAAI,CAAC,OAAO;QAAE,OAAO,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,gBAAgB,EAAE,EAAE,GAAG,CAAC,CAAC;IAC9D,OAAO,CAAC,CAAC,IAAI,CAAC,EAAE,OAAO,EAAE,IAAI,EAAE,CAAC,CAAC;AACnC,CAAC,CAAC,CAAC;AAEH,eAAe,MAAM,CAAC"}
@@ -1,4 +1,4 @@
1
1
  import { Hono } from 'hono';
2
- declare const router: Hono<import("hono").Env, import("hono/types").BlankSchema, "/">;
2
+ declare const router: Hono<import("hono/types").BlankEnv, import("hono/types").BlankSchema, "/">;
3
3
  export default router;
4
4
  //# sourceMappingURL=index.d.ts.map
@@ -1 +1 @@
1
- {"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../../src/routes/webhooks/index.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,IAAI,EAAE,MAAM,MAAM,CAAC;AAK5B,QAAA,MAAM,MAAM,iEAAa,CAAC;AAgC1B,eAAe,MAAM,CAAC"}
1
+ {"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../../src/routes/webhooks/index.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,IAAI,EAAE,MAAM,MAAM,CAAC;AAK5B,QAAA,MAAM,MAAM,4EAAa,CAAC;AAgC1B,eAAe,MAAM,CAAC"}
@@ -10,7 +10,7 @@ router.post('/', requirePermission('create', 'webhook'), async (c) => {
10
10
  const sql = getConnection();
11
11
  const result = await sql.unsafe(`INSERT INTO webhooks (id, tenant_id, url, events, secret, active)
12
12
  VALUES ($1, $2, $3, $4::jsonb, $5, true)
13
- RETURNING *`, [randomUUID(), c.get('tenantId'), body.url, JSON.stringify(body.events ?? []), body.secret]);
13
+ RETURNING *`, [randomUUID(), c.get('tenantId'), body.url, body.events ?? [], body.secret]);
14
14
  return c.json(result[0], 201);
15
15
  }
16
16
  catch (error) {
@@ -1 +1 @@
1
- {"version":3,"file":"index.js","sourceRoot":"","sources":["../../../src/routes/webhooks/index.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,IAAI,EAAE,MAAM,MAAM,CAAC;AAC5B,OAAO,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AACzC,OAAO,EAAE,aAAa,EAAE,MAAM,uBAAuB,CAAC;AACtD,OAAO,EAAE,cAAc,EAAE,iBAAiB,EAAE,MAAM,0BAA0B,CAAC;AAE7E,MAAM,MAAM,GAAG,IAAI,IAAI,EAAE,CAAC;AAE1B,MAAM,CAAC,GAAG,CAAC,GAAG,EAAE,cAAc,CAAC,CAAC;AAEhC,MAAM,CAAC,IAAI,CAAC,GAAG,EAAE,iBAAiB,CAAC,QAAQ,EAAE,SAAS,CAAC,EAAE,KAAK,EAAE,CAAC,EAAE,EAAE;IACnE,IAAI,CAAC;QACH,MAAM,IAAI,GAAG,MAAM,CAAC,CAAC,GAAG,CAAC,IAAI,EAAE,CAAC;QAChC,MAAM,GAAG,GAAG,aAAa,EAAE,CAAC;QAE5B,MAAM,MAAM,GAAG,MAAM,GAAG,CAAC,MAAM,CAC7B;;mBAEa,EACb,CAAC,UAAU,EAAE,EAAE,CAAC,CAAC,GAAG,CAAC,UAAmB,CAAW,EAAE,IAAI,CAAC,GAAG,EAAE,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,MAAM,IAAI,EAAE,CAAC,EAAE,IAAI,CAAC,MAAM,CAAC,CAC/G,CAAC;QAEF,OAAO,CAAC,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,GAAG,CAAC,CAAC;IAChC,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,MAAM,OAAO,GAAG,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,0BAA0B,CAAC;QACpF,OAAO,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,OAAO,EAAE,EAAE,GAAG,CAAC,CAAC;IACzC,CAAC;AACH,CAAC,CAAC,CAAC;AAEH,MAAM,CAAC,MAAM,CAAC,MAAM,EAAE,iBAAiB,CAAC,QAAQ,EAAE,SAAS,CAAC,EAAE,KAAK,EAAE,CAAC,EAAE,EAAE;IACxE,MAAM,EAAE,GAAG,CAAC,CAAC,GAAG,CAAC,KAAK,CAAC,IAAI,CAAW,CAAC;IACvC,MAAM,GAAG,GAAG,aAAa,EAAE,CAAC;IAC5B,MAAM,MAAM,GAAG,MAAM,GAAG,CAAC,MAAM,CAAC,iDAAiD,EAAE,CAAC,EAAE,CAAC,CAAC,CAAC;IAEzF,IAAI,MAAM,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,mBAAmB,EAAE,EAAE,GAAG,CAAC,CAAC;IAC5E,OAAO,CAAC,CAAC,IAAI,CAAC,EAAE,OAAO,EAAE,IAAI,EAAE,CAAC,CAAC;AACnC,CAAC,CAAC,CAAC;AAEH,eAAe,MAAM,CAAC"}
1
+ {"version":3,"file":"index.js","sourceRoot":"","sources":["../../../src/routes/webhooks/index.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,IAAI,EAAE,MAAM,MAAM,CAAC;AAC5B,OAAO,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AACzC,OAAO,EAAE,aAAa,EAAE,MAAM,uBAAuB,CAAC;AACtD,OAAO,EAAE,cAAc,EAAE,iBAAiB,EAAE,MAAM,0BAA0B,CAAC;AAE7E,MAAM,MAAM,GAAG,IAAI,IAAI,EAAE,CAAC;AAE1B,MAAM,CAAC,GAAG,CAAC,GAAG,EAAE,cAAc,CAAC,CAAC;AAEhC,MAAM,CAAC,IAAI,CAAC,GAAG,EAAE,iBAAiB,CAAC,QAAQ,EAAE,SAAS,CAAC,EAAE,KAAK,EAAE,CAAC,EAAE,EAAE;IACnE,IAAI,CAAC;QACH,MAAM,IAAI,GAAG,MAAM,CAAC,CAAC,GAAG,CAAC,IAAI,EAAE,CAAC;QAChC,MAAM,GAAG,GAAG,aAAa,EAAE,CAAC;QAE5B,MAAM,MAAM,GAAG,MAAM,GAAG,CAAC,MAAM,CAC7B;;mBAEa,EACb,CAAC,UAAU,EAAE,EAAE,CAAC,CAAC,GAAG,CAAC,UAAmB,CAAW,EAAE,IAAI,CAAC,GAAG,EAAE,IAAI,CAAC,MAAM,IAAI,EAAE,EAAE,IAAI,CAAC,MAAM,CAAC,CAC/F,CAAC;QAEF,OAAO,CAAC,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,GAAG,CAAC,CAAC;IAChC,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,MAAM,OAAO,GAAG,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,0BAA0B,CAAC;QACpF,OAAO,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,OAAO,EAAE,EAAE,GAAG,CAAC,CAAC;IACzC,CAAC;AACH,CAAC,CAAC,CAAC;AAEH,MAAM,CAAC,MAAM,CAAC,MAAM,EAAE,iBAAiB,CAAC,QAAQ,EAAE,SAAS,CAAC,EAAE,KAAK,EAAE,CAAC,EAAE,EAAE;IACxE,MAAM,EAAE,GAAG,CAAC,CAAC,GAAG,CAAC,KAAK,CAAC,IAAI,CAAW,CAAC;IACvC,MAAM,GAAG,GAAG,aAAa,EAAE,CAAC;IAC5B,MAAM,MAAM,GAAG,MAAM,GAAG,CAAC,MAAM,CAAC,iDAAiD,EAAE,CAAC,EAAE,CAAC,CAAC,CAAC;IAEzF,IAAI,MAAM,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,mBAAmB,EAAE,EAAE,GAAG,CAAC,CAAC;IAC5E,OAAO,CAAC,CAAC,IAAI,CAAC,EAAE,OAAO,EAAE,IAAI,EAAE,CAAC,CAAC;AACnC,CAAC,CAAC,CAAC;AAEH,eAAe,MAAM,CAAC"}
@@ -0,0 +1,17 @@
1
+ export declare const MAX_UPLOAD_BYTES: number;
2
+ /** Raiz dos uploads — lê o env a cada chamada (testes trocam UPLOAD_DIR). */
3
+ export declare function getUploadDir(): string;
4
+ /** Extensão saneada (minúsculas, alfanumérica) — fallback "bin". */
5
+ export declare function safeExtension(filename: string): string;
6
+ export declare function mimeFor(filename: string): string;
7
+ export declare function isSafeSegment(value: string): boolean;
8
+ export declare function isSafeStoredPath(relPath: string): boolean;
9
+ /** Grava o arquivo em <uploadDir>/<tenant>/<uuid>.<ext>. */
10
+ export declare function saveUpload(tenantId: string, originalFilename: string, data: Uint8Array): Promise<{
11
+ path: string;
12
+ size: number;
13
+ }>;
14
+ export declare function readUpload(relPath: string): Promise<Buffer | null>;
15
+ /** Remove o arquivo (best-effort — só é chamado após o row já existir). */
16
+ export declare function removeUpload(relPath: string): Promise<void>;
17
+ //# sourceMappingURL=storage.d.ts.map
@@ -0,0 +1 @@
1
+ {"version":3,"file":"storage.d.ts","sourceRoot":"","sources":["../src/storage.ts"],"names":[],"mappings":"AAYA,eAAO,MAAM,gBAAgB,QAAmB,CAAC;AAkCjD,6EAA6E;AAC7E,wBAAgB,YAAY,IAAI,MAAM,CAGrC;AAED,oEAAoE;AACpE,wBAAgB,aAAa,CAAC,QAAQ,EAAE,MAAM,GAAG,MAAM,CAGtD;AAED,wBAAgB,OAAO,CAAC,QAAQ,EAAE,MAAM,GAAG,MAAM,CAGhD;AAED,wBAAgB,aAAa,CAAC,KAAK,EAAE,MAAM,GAAG,OAAO,CAEpD;AAED,wBAAgB,gBAAgB,CAAC,OAAO,EAAE,MAAM,GAAG,OAAO,CAGzD;AAED,4DAA4D;AAC5D,wBAAsB,UAAU,CAC9B,QAAQ,EAAE,MAAM,EAChB,gBAAgB,EAAE,MAAM,EACxB,IAAI,EAAE,UAAU,GACf,OAAO,CAAC;IAAE,IAAI,EAAE,MAAM,CAAC;IAAC,IAAI,EAAE,MAAM,CAAA;CAAE,CAAC,CAWzC;AAED,wBAAsB,UAAU,CAAC,OAAO,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,GAAG,IAAI,CAAC,CAOxE;AAED,2EAA2E;AAC3E,wBAAsB,YAAY,CAAC,OAAO,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAOjE"}
@@ -0,0 +1,95 @@
1
+ // @oktis-works/api - Storage local de uploads (zero-config)
2
+ //
3
+ // `UPLOAD_DIR` (default: "uploads" relativo ao cwd do processo) — no scaffold
4
+ // fica dentro do projeto, então sobrevive a restarts sem volume extra.
5
+ // Layout: <uploadDir>/<tenant>/<uuid>.<ext> — o nome aleatório + saneamento
6
+ // dos segmentos impede path traversal; o site público busca o arquivo em
7
+ // GET /api/v1/media/file/:tenant/:filename (sem token).
8
+ import { randomUUID } from 'node:crypto';
9
+ import { mkdir, readFile, unlink, writeFile } from 'node:fs/promises';
10
+ import { extname, isAbsolute, join, resolve } from 'node:path';
11
+ export const MAX_UPLOAD_BYTES = 25 * 1024 * 1024; // 25MB
12
+ const SEGMENT_RE = /^[A-Za-z0-9_-]{1,64}$/;
13
+ const FILENAME_RE = /^[A-Za-z0-9_-]{1,64}\.[a-z0-9]{1,10}$/;
14
+ const EXT_MIME = {
15
+ avif: 'image/avif',
16
+ bmp: 'image/bmp',
17
+ css: 'text/css',
18
+ gif: 'image/gif',
19
+ html: 'text/html',
20
+ ico: 'image/x-icon',
21
+ jpeg: 'image/jpeg',
22
+ jpg: 'image/jpeg',
23
+ js: 'text/javascript',
24
+ json: 'application/json',
25
+ md: 'text/markdown',
26
+ mp3: 'audio/mpeg',
27
+ mp4: 'video/mp4',
28
+ ogg: 'audio/ogg',
29
+ pdf: 'application/pdf',
30
+ png: 'image/png',
31
+ svg: 'image/svg+xml',
32
+ txt: 'text/plain',
33
+ ttf: 'font/ttf',
34
+ wav: 'audio/wav',
35
+ webm: 'video/webm',
36
+ webp: 'image/webp',
37
+ woff: 'font/woff',
38
+ woff2: 'font/woff2',
39
+ xml: 'application/xml',
40
+ zip: 'application/zip',
41
+ };
42
+ /** Raiz dos uploads — lê o env a cada chamada (testes trocam UPLOAD_DIR). */
43
+ export function getUploadDir() {
44
+ const dir = process.env['UPLOAD_DIR'] ?? 'uploads';
45
+ return isAbsolute(dir) ? dir : resolve(process.cwd(), dir);
46
+ }
47
+ /** Extensão saneada (minúsculas, alfanumérica) — fallback "bin". */
48
+ export function safeExtension(filename) {
49
+ const ext = extname(filename).replace(/^\./, '').toLowerCase();
50
+ return /^[a-z0-9]{1,10}$/.test(ext) ? ext : 'bin';
51
+ }
52
+ export function mimeFor(filename) {
53
+ const ext = safeExtension(filename);
54
+ return EXT_MIME[ext] ?? 'application/octet-stream';
55
+ }
56
+ export function isSafeSegment(value) {
57
+ return SEGMENT_RE.test(value);
58
+ }
59
+ export function isSafeStoredPath(relPath) {
60
+ const [tenant, filename, ...rest] = relPath.split('/');
61
+ return rest.length === 0 && !!tenant && !!filename && SEGMENT_RE.test(tenant) && FILENAME_RE.test(filename);
62
+ }
63
+ /** Grava o arquivo em <uploadDir>/<tenant>/<uuid>.<ext>. */
64
+ export async function saveUpload(tenantId, originalFilename, data) {
65
+ if (!SEGMENT_RE.test(tenantId)) {
66
+ throw new Error('Invalid tenant for upload');
67
+ }
68
+ const filename = `${randomUUID()}.${safeExtension(originalFilename)}`;
69
+ const dir = join(getUploadDir(), tenantId);
70
+ await mkdir(dir, { recursive: true });
71
+ await writeFile(join(dir, filename), data);
72
+ return { path: `${tenantId}/${filename}`, size: data.byteLength };
73
+ }
74
+ export async function readUpload(relPath) {
75
+ if (!isSafeStoredPath(relPath))
76
+ return null;
77
+ try {
78
+ return await readFile(join(getUploadDir(), relPath));
79
+ }
80
+ catch {
81
+ return null;
82
+ }
83
+ }
84
+ /** Remove o arquivo (best-effort — só é chamado após o row já existir). */
85
+ export async function removeUpload(relPath) {
86
+ if (!isSafeStoredPath(relPath))
87
+ return;
88
+ try {
89
+ await unlink(join(getUploadDir(), relPath));
90
+ }
91
+ catch {
92
+ // arquivo já inexistente — segue
93
+ }
94
+ }
95
+ //# sourceMappingURL=storage.js.map
@@ -0,0 +1 @@
1
+ {"version":3,"file":"storage.js","sourceRoot":"","sources":["../src/storage.ts"],"names":[],"mappings":"AAAA,4DAA4D;AAC5D,EAAE;AACF,8EAA8E;AAC9E,uEAAuE;AACvE,4EAA4E;AAC5E,yEAAyE;AACzE,wDAAwD;AAExD,OAAO,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AACzC,OAAO,EAAE,KAAK,EAAE,QAAQ,EAAE,MAAM,EAAE,SAAS,EAAE,MAAM,kBAAkB,CAAC;AACtE,OAAO,EAAE,OAAO,EAAE,UAAU,EAAE,IAAI,EAAE,OAAO,EAAE,MAAM,WAAW,CAAC;AAE/D,MAAM,CAAC,MAAM,gBAAgB,GAAG,EAAE,GAAG,IAAI,GAAG,IAAI,CAAC,CAAC,OAAO;AAEzD,MAAM,UAAU,GAAG,uBAAuB,CAAC;AAC3C,MAAM,WAAW,GAAG,uCAAuC,CAAC;AAE5D,MAAM,QAAQ,GAA2B;IACvC,IAAI,EAAE,YAAY;IAClB,GAAG,EAAE,WAAW;IAChB,GAAG,EAAE,UAAU;IACf,GAAG,EAAE,WAAW;IAChB,IAAI,EAAE,WAAW;IACjB,GAAG,EAAE,cAAc;IACnB,IAAI,EAAE,YAAY;IAClB,GAAG,EAAE,YAAY;IACjB,EAAE,EAAE,iBAAiB;IACrB,IAAI,EAAE,kBAAkB;IACxB,EAAE,EAAE,eAAe;IACnB,GAAG,EAAE,YAAY;IACjB,GAAG,EAAE,WAAW;IAChB,GAAG,EAAE,WAAW;IAChB,GAAG,EAAE,iBAAiB;IACtB,GAAG,EAAE,WAAW;IAChB,GAAG,EAAE,eAAe;IACpB,GAAG,EAAE,YAAY;IACjB,GAAG,EAAE,UAAU;IACf,GAAG,EAAE,WAAW;IAChB,IAAI,EAAE,YAAY;IAClB,IAAI,EAAE,YAAY;IAClB,IAAI,EAAE,WAAW;IACjB,KAAK,EAAE,YAAY;IACnB,GAAG,EAAE,iBAAiB;IACtB,GAAG,EAAE,iBAAiB;CACvB,CAAC;AAEF,6EAA6E;AAC7E,MAAM,UAAU,YAAY;IAC1B,MAAM,GAAG,GAAG,OAAO,CAAC,GAAG,CAAC,YAAY,CAAC,IAAI,SAAS,CAAC;IACnD,OAAO,UAAU,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,OAAO,CAAC,OAAO,CAAC,GAAG,EAAE,EAAE,GAAG,CAAC,CAAC;AAC7D,CAAC;AAED,oEAAoE;AACpE,MAAM,UAAU,aAAa,CAAC,QAAgB;IAC5C,MAAM,GAAG,GAAG,OAAO,CAAC,QAAQ,CAAC,CAAC,OAAO,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC,WAAW,EAAE,CAAC;IAC/D,OAAO,kBAAkB,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,KAAK,CAAC;AACpD,CAAC;AAED,MAAM,UAAU,OAAO,CAAC,QAAgB;IACtC,MAAM,GAAG,GAAG,aAAa,CAAC,QAAQ,CAAC,CAAC;IACpC,OAAO,QAAQ,CAAC,GAAG,CAAC,IAAI,0BAA0B,CAAC;AACrD,CAAC;AAED,MAAM,UAAU,aAAa,CAAC,KAAa;IACzC,OAAO,UAAU,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;AAChC,CAAC;AAED,MAAM,UAAU,gBAAgB,CAAC,OAAe;IAC9C,MAAM,CAAC,MAAM,EAAE,QAAQ,EAAE,GAAG,IAAI,CAAC,GAAG,OAAO,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;IACvD,OAAO,IAAI,CAAC,MAAM,KAAK,CAAC,IAAI,CAAC,CAAC,MAAM,IAAI,CAAC,CAAC,QAAQ,IAAI,UAAU,CAAC,IAAI,CAAC,MAAM,CAAC,IAAI,WAAW,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC;AAC9G,CAAC;AAED,4DAA4D;AAC5D,MAAM,CAAC,KAAK,UAAU,UAAU,CAC9B,QAAgB,EAChB,gBAAwB,EACxB,IAAgB;IAEhB,IAAI,CAAC,UAAU,CAAC,IAAI,CAAC,QAAQ,CAAC,EAAE,CAAC;QAC/B,MAAM,IAAI,KAAK,CAAC,2BAA2B,CAAC,CAAC;IAC/C,CAAC;IAED,MAAM,QAAQ,GAAG,GAAG,UAAU,EAAE,IAAI,aAAa,CAAC,gBAAgB,CAAC,EAAE,CAAC;IACtE,MAAM,GAAG,GAAG,IAAI,CAAC,YAAY,EAAE,EAAE,QAAQ,CAAC,CAAC;IAC3C,MAAM,KAAK,CAAC,GAAG,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;IACtC,MAAM,SAAS,CAAC,IAAI,CAAC,GAAG,EAAE,QAAQ,CAAC,EAAE,IAAI,CAAC,CAAC;IAE3C,OAAO,EAAE,IAAI,EAAE,GAAG,QAAQ,IAAI,QAAQ,EAAE,EAAE,IAAI,EAAE,IAAI,CAAC,UAAU,EAAE,CAAC;AACpE,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,UAAU,CAAC,OAAe;IAC9C,IAAI,CAAC,gBAAgB,CAAC,OAAO,CAAC;QAAE,OAAO,IAAI,CAAC;IAC5C,IAAI,CAAC;QACH,OAAO,MAAM,QAAQ,CAAC,IAAI,CAAC,YAAY,EAAE,EAAE,OAAO,CAAC,CAAC,CAAC;IACvD,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,IAAI,CAAC;IACd,CAAC;AACH,CAAC;AAED,2EAA2E;AAC3E,MAAM,CAAC,KAAK,UAAU,YAAY,CAAC,OAAe;IAChD,IAAI,CAAC,gBAAgB,CAAC,OAAO,CAAC;QAAE,OAAO;IACvC,IAAI,CAAC;QACH,MAAM,MAAM,CAAC,IAAI,CAAC,YAAY,EAAE,EAAE,OAAO,CAAC,CAAC,CAAC;IAC9C,CAAC;IAAC,MAAM,CAAC;QACP,iCAAiC;IACnC,CAAC;AACH,CAAC"}
@@ -0,0 +1,6 @@
1
+ import { setCookie, getCookie } from 'hono/cookie';
2
+ /** Gera novo token CSRF e seta cookie legível pelo JS (double-submit) */
3
+ export declare function setCsrfCookie(c: Parameters<typeof setCookie>[0]): string;
4
+ /** Lê token CSRF do cookie */
5
+ export declare function getCsrfToken(c: Parameters<typeof getCookie>[0]): string | undefined;
6
+ //# sourceMappingURL=csrf.d.ts.map
@@ -0,0 +1 @@
1
+ {"version":3,"file":"csrf.d.ts","sourceRoot":"","sources":["../../src/utils/csrf.ts"],"names":[],"mappings":"AAGA,OAAO,EAAE,SAAS,EAAE,SAAS,EAAE,MAAM,aAAa,CAAC;AAmBnD,yEAAyE;AACzE,wBAAgB,aAAa,CAAC,CAAC,EAAE,UAAU,CAAC,OAAO,SAAS,CAAC,CAAC,CAAC,CAAC,GAAG,MAAM,CAIxE;AAED,8BAA8B;AAC9B,wBAAgB,YAAY,CAAC,CAAC,EAAE,UAAU,CAAC,OAAO,SAAS,CAAC,CAAC,CAAC,CAAC,GAAG,MAAM,GAAG,SAAS,CAEnF"}
@@ -0,0 +1,29 @@
1
+ // @oktis-works/api - CSRF Utilities (double-submit cookie via hono/cookie)
2
+ import { randomUUID } from 'node:crypto';
3
+ import { setCookie, getCookie } from 'hono/cookie';
4
+ import { loadConfig } from '@oktis-works/config';
5
+ const config = loadConfig();
6
+ const { cookie: cookieCfg, csrf: csrfCfg } = config.auth;
7
+ // None requer Secure (auto em produção); localhost HTTP aceita None sem Secure
8
+ const isProd = config.app.nodeEnv === 'production';
9
+ const CSRF_COOKIE_OPTS = {
10
+ // httpOnly=FALSE é ESSENCIAL: double-submit exige que o JS leia o cookie e
11
+ // devolva no header X-CSRF-Token. O valor CSRF não é sensível — o token de
12
+ // SESSÃO (access_token) é que fica HttpOnly.
13
+ httpOnly: false,
14
+ secure: cookieCfg.secure ?? isProd,
15
+ sameSite: cookieCfg.sameSite,
16
+ path: '/',
17
+ maxAge: 60 * 60 * 24, // 24h
18
+ };
19
+ /** Gera novo token CSRF e seta cookie legível pelo JS (double-submit) */
20
+ export function setCsrfCookie(c) {
21
+ const token = randomUUID();
22
+ setCookie(c, csrfCfg.cookieName, token, CSRF_COOKIE_OPTS);
23
+ return token;
24
+ }
25
+ /** Lê token CSRF do cookie */
26
+ export function getCsrfToken(c) {
27
+ return getCookie(c, csrfCfg.cookieName);
28
+ }
29
+ //# sourceMappingURL=csrf.js.map
@@ -0,0 +1 @@
1
+ {"version":3,"file":"csrf.js","sourceRoot":"","sources":["../../src/utils/csrf.ts"],"names":[],"mappings":"AAAA,2EAA2E;AAE3E,OAAO,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AACzC,OAAO,EAAE,SAAS,EAAE,SAAS,EAAE,MAAM,aAAa,CAAC;AACnD,OAAO,EAAE,UAAU,EAAE,MAAM,qBAAqB,CAAC;AAEjD,MAAM,MAAM,GAAG,UAAU,EAAE,CAAC;AAC5B,MAAM,EAAE,MAAM,EAAE,SAAS,EAAE,IAAI,EAAE,OAAO,EAAE,GAAG,MAAM,CAAC,IAAI,CAAC;AAEzD,+EAA+E;AAC/E,MAAM,MAAM,GAAG,MAAM,CAAC,GAAG,CAAC,OAAO,KAAK,YAAY,CAAC;AACnD,MAAM,gBAAgB,GAAG;IACvB,2EAA2E;IAC3E,2EAA2E;IAC3E,6CAA6C;IAC7C,QAAQ,EAAE,KAAK;IACf,MAAM,EAAE,SAAS,CAAC,MAAM,IAAI,MAAM;IAClC,QAAQ,EAAE,SAAS,CAAC,QAAQ;IAC5B,IAAI,EAAE,GAAG;IACT,MAAM,EAAE,EAAE,GAAG,EAAE,GAAG,EAAE,EAAE,MAAM;CAC7B,CAAC;AAEF,yEAAyE;AACzE,MAAM,UAAU,aAAa,CAAC,CAAkC;IAC9D,MAAM,KAAK,GAAG,UAAU,EAAE,CAAC;IAC3B,SAAS,CAAC,CAAC,EAAE,OAAO,CAAC,UAAU,EAAE,KAAK,EAAE,gBAAgB,CAAC,CAAC;IAC1D,OAAO,KAAK,CAAC;AACf,CAAC;AAED,8BAA8B;AAC9B,MAAM,UAAU,YAAY,CAAC,CAAkC;IAC7D,OAAO,SAAS,CAAC,CAAC,EAAE,OAAO,CAAC,UAAU,CAAC,CAAC;AAC1C,CAAC"}
package/package.json CHANGED
@@ -1,6 +1,6 @@
1
1
  {
2
2
  "name": "@oktis-works/api",
3
- "version": "0.1.4",
3
+ "version": "0.1.7",
4
4
  "type": "module",
5
5
  "main": "./dist/index.js",
6
6
  "types": "./dist/index.d.ts",
@@ -18,14 +18,14 @@
18
18
  "clean": "rm -rf dist tsconfig.tsbuildinfo"
19
19
  },
20
20
  "dependencies": {
21
- "@oktis-works/core": "^0.1.11",
22
- "@oktis-works/auth": "^0.1.11",
23
- "@oktis-works/config": "^0.1.11",
24
- "@oktis-works/database": "^0.1.11",
25
- "@oktis-works/types": "^0.1.11",
26
- "hono": "4.0.0",
21
+ "@oktis-works/core": "^0.1.14",
22
+ "@oktis-works/auth": "^0.1.14",
23
+ "@oktis-works/config": "^0.1.14",
24
+ "@oktis-works/database": "^0.1.14",
25
+ "@oktis-works/types": "^0.1.14",
26
+ "hono": "4.13.12",
27
27
  "@hono/node-server": "1.8.0",
28
- "@oktis-works/validation": "^0.1.11"
28
+ "@oktis-works/validation": "^0.1.14"
29
29
  },
30
30
  "devDependencies": {
31
31
  "typescript": "5.7.3",
@@ -1,2 +0,0 @@
1
- export {};
2
- //# sourceMappingURL=csrf.test.d.ts.map
@@ -1 +0,0 @@
1
- {"version":3,"file":"csrf.test.d.ts","sourceRoot":"","sources":["../../src/middleware/csrf.test.ts"],"names":[],"mappings":""}