@oondemand/oon-core-back 0.1.0

package/src/core/middlewares/mutationAudit.js

@@ -0,0 +1,40 @@
+const ControleAlteracao = require("../models/ControleAlteracao");
+
+/**
+ * Trilha de auditoria de mutações. Em respostas de sucesso (status < 400)
+ * grava um registro em ControleAlteracao com o usuário, a entidade e o
+ * registro afetado. Usado pelas factories de CRUD e por `defineRoutes`.
+ *
+ * @param {{ entidade: string, acao: string }} opts
+ */
+function mutationAudit({ entidade, acao }) {
+  return (req, res, next) => {
+    const origem = req.headers["x-origem"] || "api";
+
+    const originalJson = res.json.bind(res);
+    let responseBody;
+    res.json = (body) => {
+      responseBody = body;
+      return originalJson(body);
+    };
+
+    res.on("finish", () => {
+      if (res.statusCode >= 400) return;
+      const { message, ...rest } = responseBody || {};
+      const registro = rest[Object.keys(rest)[0]];
+
+      ControleAlteracao.create({
+        entidade,
+        acao,
+        origem,
+        usuario: { nome: req?.usuario?.nome, email: req?.usuario?.email },
+        idRegistro: registro?._id,
+        dadosAtualizados: registro,
+      }).catch((e) => console.log("ERRO AO REGISTRAR AÇÃO", e?.message));
+    });
+
+    next();
+  };
+}
+
+module.exports = { mutationAudit };

package/src/core/middlewares/rbac.js

@@ -0,0 +1,22 @@
+const Helpers = require("../utils/helpers");
+
+/**
+ * RBAC simples baseado em `req.usuario.tipo`. `roles` vazio => qualquer
+ * usuário autenticado. `admin` sempre passa.
+ *
+ * @param {string[]} roles papéis permitidos
+ */
+function rbac(roles = []) {
+  return (req, res, next) => {
+    if (!roles.length) return next();
+    const tipo = req.usuario?.tipo;
+    if (tipo === "admin" || roles.includes(tipo)) return next();
+    return Helpers.sendErrorResponse({
+      res,
+      statusCode: 403,
+      message: "Acesso negado para o seu perfil.",
+    });
+  };
+}
+
+module.exports = { rbac };

package/src/core/middlewares/requestLog.js

@@ -0,0 +1,28 @@
+const Log = require("../models/Log");
+
+/**
+ * Registra requisições mutantes (não-GET) na model interna Log.
+ * Captura status e corpo da resposta no `finish`.
+ */
+const requestLog = async (req, res, next) => {
+  if (req.method === "GET") return next();
+
+  const log = new Log({
+    usuario: req.usuario || null,
+    endpoint: req.originalUrl,
+    metodo: req.method,
+    ip: req.ip || req.headers["x-forwarded-for"] || req.connection?.remoteAddress,
+    correlationId: req.correlationId,
+    dadosRequisicao: req.body,
+  });
+
+  res.on("finish", () => {
+    log.statusResposta = res.statusCode;
+    log.dadosResposta = res.locals.body || null;
+    log.save().catch(() => {});
+  });
+
+  next();
+};
+
+module.exports = requestLog;

package/src/core/models/ControleAlteracao.js

@@ -0,0 +1,28 @@
+const mongoose = require("mongoose");
+
+/**
+ * Trilha de auditoria de mutações. Diferente da versão do CST, no Core
+ * `entidade` é uma string livre (o registry conhece o nome da model em
+ * runtime) e `acao`/`origem` aceitam os valores padrão sem enum rígido,
+ * porque o Core não pode enumerar o domínio do cliente.
+ */
+const ACOES_PADRAO = ["adicionado", "alterado", "excluido"];
+const ORIGENS_PADRAO = ["form", "datagrid", "importacao", "api"];
+
+const controleAlteracaoSchema = new mongoose.Schema({
+  dataHora: { type: Date, default: Date.now, required: true },
+  usuario: { nome: String, email: String },
+  entidade: { type: String, required: true },
+  acao: { type: String, required: true },
+  origem: { type: String, default: "api" },
+  idRegistro: { type: String },
+  dadosAtualizados: { type: Object },
+});
+
+const ControleAlteracao =
+  mongoose.models.ControleAlteracao ||
+  mongoose.model("ControleAlteracao", controleAlteracaoSchema);
+
+module.exports = ControleAlteracao;
+module.exports.ACOES_PADRAO = ACOES_PADRAO;
+module.exports.ORIGENS_PADRAO = ORIGENS_PADRAO;

package/src/core/models/Log.js

@@ -0,0 +1,22 @@
+const mongoose = require("mongoose");
+
+/**
+ * Log de requisições mutantes. Model interna do Core — registrada
+ * automaticamente pelo requestLog middleware. Não é domínio do cliente.
+ */
+const logSchema = new mongoose.Schema(
+  {
+    usuario: { type: Object, required: false },
+    endpoint: { type: String, required: true },
+    metodo: { type: String, required: true },
+    ip: { type: String },
+    correlationId: { type: String },
+    dadosRequisicao: { type: Object },
+    dadosResposta: { type: Object },
+    statusResposta: { type: Number },
+  },
+  { timestamps: true }
+);
+
+module.exports =
+  mongoose.models.Log || mongoose.model("Log", logSchema);

package/src/core/models/Sistema.js

@@ -0,0 +1,27 @@
+const mongoose = require("mongoose");
+
+/**
+ * Configuração singleton da Central (chaves de integração, remetente, etc.).
+ * Model interna do Core. O cliente estende via `central.config.js`.
+ */
+const omieSchema = new mongoose.Schema(
+  {
+    id_conta_corrente: { type: Number },
+    codigo_categoria: { type: String },
+  },
+  { _id: false }
+);
+
+const sistemaSchema = new mongoose.Schema(
+  {
+    omie: omieSchema,
+    openIaKey: String,
+    appKey: String,
+    sendgrid_api_key: { type: String },
+    remetente: { type: { nome: String, email: String } },
+  },
+  { timestamps: true }
+);
+
+module.exports =
+  mongoose.models.Sistema || mongoose.model("Sistema", sistemaSchema);

package/src/core/registry.js

@@ -0,0 +1,117 @@
+/**
+ * Model Registry — coração técnico do Core (Seção 17).
+ *
+ * Tudo que o dev declara via `define*` é registrado aqui. A partir do
+ * registry, o Core deriva: schemas Mongoose, CRUD, RBAC, OpenAPI/metadata,
+ * rotas /core/* e os hooks dos módulos opinativos.
+ *
+ * É um singleton de processo. `reset()` existe para testes.
+ */
+const store = {
+  models: new Map(), // name -> { name, mongooseModel, definition }
+  validations: new Map(), // modelName -> validateFn
+  triggers: new Map(), // modelName -> { before, after }
+  routes: [], // [{ basePath, build }]
+  collections: new Map(),
+  documents: new Map(),
+  pipelines: new Map(),
+  omieMappings: new Map(),
+  integrations: new Map(),
+  menus: [],
+  features: new Map(),
+};
+
+function registerModel(entry) {
+  if (store.models.has(entry.name)) {
+    throw new Error(`Model "${entry.name}" já registrada no Core.`);
+  }
+  store.models.set(entry.name, entry);
+  return entry;
+}
+
+function getModel(name) {
+  return store.models.get(name);
+}
+
+function listModels() {
+  return [...store.models.values()];
+}
+
+function registerValidation(modelName, fn) {
+  store.validations.set(modelName, fn);
+}
+
+function getValidation(modelName) {
+  return store.validations.get(modelName);
+}
+
+function registerTrigger(modelName, hooks) {
+  const current = store.triggers.get(modelName) || { before: [], after: [] };
+  if (hooks.before) current.before.push(hooks.before);
+  if (hooks.after) current.after.push(hooks.after);
+  store.triggers.set(modelName, current);
+}
+
+function getTriggers(modelName) {
+  return store.triggers.get(modelName) || { before: [], after: [] };
+}
+
+function registerRoutes(entry) {
+  store.routes.push(entry);
+}
+
+function listRoutes() {
+  return store.routes;
+}
+
+const simpleRegister = (mapName) => (key, value) => {
+  store[mapName].set(key, value);
+  return value;
+};
+const simpleList = (mapName) => () => [...store[mapName].values()];
+
+function registerMenu(item) {
+  store.menus.push(item);
+}
+
+function reset() {
+  store.models.clear();
+  store.validations.clear();
+  store.triggers.clear();
+  store.routes.length = 0;
+  store.collections.clear();
+  store.documents.clear();
+  store.pipelines.clear();
+  store.omieMappings.clear();
+  store.integrations.clear();
+  store.menus.length = 0;
+  store.features.clear();
+}
+
+module.exports = {
+  store,
+  registerModel,
+  getModel,
+  listModels,
+  registerValidation,
+  getValidation,
+  registerTrigger,
+  getTriggers,
+  registerRoutes,
+  listRoutes,
+  registerCollection: simpleRegister("collections"),
+  listCollections: simpleList("collections"),
+  registerDocument: simpleRegister("documents"),
+  listDocuments: simpleList("documents"),
+  registerPipeline: simpleRegister("pipelines"),
+  listPipelines: simpleList("pipelines"),
+  registerOmieMapping: simpleRegister("omieMappings"),
+  listOmieMappings: simpleList("omieMappings"),
+  registerIntegration: simpleRegister("integrations"),
+  listIntegrations: simpleList("integrations"),
+  registerFeature: simpleRegister("features"),
+  listFeatures: simpleList("features"),
+  registerMenu,
+  listMenus: () => store.menus,
+  reset,
+};

package/src/core/utils/helpers.js

@@ -0,0 +1,44 @@
+exports.sendResponse = ({ res, statusCode = 200, message = "OK", ...rest }) => {
+  res.status(statusCode).send({ message, ...rest });
+};
+
+exports.sendErrorResponse = ({ res, statusCode = 500, message, error }) => {
+  res.status(statusCode).json({
+    message,
+    ...(error ? { error } : {}),
+  });
+};
+
+exports.sendPaginatedResponse = ({
+  res,
+  statusCode = 200,
+  message = "OK",
+  results,
+  pagination: { currentPage, totalPages, totalItems, itemsPerPage },
+}) => {
+  res.status(statusCode).json({
+    message,
+    results,
+    pagination: { currentPage, totalPages, totalItems, itemsPerPage },
+  });
+};
+
+exports.asyncHandler = (callback) => {
+  return (req, res, next) => {
+    Promise.resolve(callback(req, res, next)).catch((error) => {
+      // Erros de domínio (4xx) são esperados; só logamos os inesperados.
+      const status = error?.statusCode || 500;
+      if (status >= 500) console.log("🆘 [ERROR]:", error?.message || error);
+      next(error);
+    });
+  };
+};
+
+exports.attempt = async (callback) => {
+  try {
+    const result = await callback();
+    return [result, null];
+  } catch (err) {
+    return [null, err];
+  }
+};

package/src/deploy/render.js

@@ -0,0 +1,88 @@
+const fs = require("node:fs");
+const path = require("node:path");
+
+const TEMPLATES_DIR = path.join(__dirname, "templates");
+
+/**
+ * Defaults dos manifests. São sobrescritos pelo `central.manifest.json`
+ * do consumidor. O dev não escreve YAML — só ajusta esses valores.
+ */
+const DEFAULTS = {
+  SERVICE_NAME: "central-oon",
+  NAMESPACE: "default",
+  IMAGE: "ghcr.io/oondemand/central-oon",
+  IMAGE_TAG: "latest",
+  PORT: "4000",
+  REPLICAS: "1",
+  NODE_ENV: "production",
+  MEM_REQUEST: "128Mi",
+  MEM_LIMIT: "256Mi",
+  CPU_REQUEST: "0.1",
+  CPU_LIMIT: "0.2",
+  HPA_MIN: "1",
+  HPA_MAX: "3",
+  HPA_CPU_TARGET: "70",
+  HOST: "central.example.com",
+  DB_SERVER: "",
+  DB_NAME: "",
+  DB_AUTH_SOURCE: "",
+  DB_REPLICA_SET: "",
+  DB_TSL: "",
+  DB_USER: "",
+  DB_PASSWORD: "",
+  JWT_SECRET: "",
+  OMIE_APP_KEY: "",
+  OMIE_APP_SECRET: "",
+  MEUS_APPS_BACKEND_URL: "",
+};
+
+const K8S_TEMPLATES = [
+  "configmap.yaml",
+  "secret.yaml",
+  "deployment.yaml",
+  "service.yaml",
+  "ingress.yaml",
+  "hpa.yaml",
+  "certificate.yaml",
+];
+
+function interpolate(content, vars) {
+  return content.replace(/\$\{(\w+)\}/g, (_, key) =>
+    vars[key] !== undefined ? String(vars[key]) : ""
+  );
+}
+
+function loadManifest(cwd = process.cwd()) {
+  const file = path.join(cwd, "central.manifest.json");
+  const user = fs.existsSync(file) ? JSON.parse(fs.readFileSync(file, "utf8")) : {};
+  return { ...DEFAULTS, ...user };
+}
+
+/**
+ * Renderiza os manifests k8s para `outDir` (default: ./k8s) a partir do
+ * central.manifest.json. Retorna a lista de arquivos gerados.
+ */
+function renderK8s({ cwd = process.cwd(), outDir } = {}) {
+  const vars = loadManifest(cwd);
+  const target = outDir || path.join(cwd, "k8s");
+  fs.mkdirSync(target, { recursive: true });
+
+  const written = [];
+  for (const tpl of K8S_TEMPLATES) {
+    const raw = fs.readFileSync(path.join(TEMPLATES_DIR, tpl), "utf8");
+    const out = interpolate(raw, vars);
+    const dest = path.join(target, tpl);
+    fs.writeFileSync(dest, out);
+    written.push(dest);
+  }
+  return written;
+}
+
+function renderDockerfile({ cwd = process.cwd() } = {}) {
+  const raw = fs.readFileSync(path.join(TEMPLATES_DIR, "Dockerfile"), "utf8");
+  const dest = path.join(cwd, "Dockerfile");
+  fs.writeFileSync(dest, raw);
+  return dest;
+}
+
+module.exports = { renderK8s, renderDockerfile, loadManifest, DEFAULTS, TEMPLATES_DIR };

package/src/deploy/templates/Dockerfile

@@ -0,0 +1,19 @@
+# Dockerfile padrão de uma Central Oon (gerado pelo oonCore-back).
+# Estágio 1: dependências de produção
+FROM node:18 AS builder
+WORKDIR /app
+COPY package*.json ./
+RUN npm install --production
+COPY src ./src
+COPY central.config.js ./central.config.js
+
+# Estágio 2: runtime
+FROM node:18-alpine
+ARG SERVICE_VERSION
+ENV SERVICE_VERSION=${SERVICE_VERSION}
+WORKDIR /app
+COPY --from=builder /app .
+RUN mkdir -p uploads
+EXPOSE 4000
+# Sobe a Central via CLI do Core.
+CMD ["npx", "oonCore-back", "start"]

package/src/deploy/templates/certificate.yaml

@@ -0,0 +1,12 @@
+apiVersion: cert-manager.io/v1
+kind: Certificate
+metadata:
+  name: ${SERVICE_NAME}-cert
+  namespace: ${NAMESPACE}
+spec:
+  secretName: ${SERVICE_NAME}-tls
+  issuerRef:
+    name: letsencrypt-prod
+    kind: ClusterIssuer
+  dnsNames:
+    - ${HOST}

package/src/deploy/templates/configmap.yaml

@@ -0,0 +1,16 @@
+apiVersion: v1
+kind: ConfigMap
+metadata:
+  name: ${SERVICE_NAME}-config
+  namespace: ${NAMESPACE}
+data:
+  NODE_ENV: "${NODE_ENV}"
+  SERVICE_NAME: "${SERVICE_NAME}"
+  SERVICE_VERSION: "${IMAGE_TAG}"
+  PORT: "${PORT}"
+  DB_SERVER: "${DB_SERVER}"
+  DB_NAME: "${DB_NAME}"
+  DB_AUTH_SOURCE: "${DB_AUTH_SOURCE}"
+  DB_REPLICA_SET: "${DB_REPLICA_SET}"
+  DB_TSL: "${DB_TSL}"
+  MEUS_APPS_BACKEND_URL: "${MEUS_APPS_BACKEND_URL}"

package/src/deploy/templates/deployment.yaml

@@ -0,0 +1,32 @@
+apiVersion: apps/v1
+kind: Deployment
+metadata:
+  name: ${SERVICE_NAME}
+  namespace: ${NAMESPACE}
+spec:
+  replicas: ${REPLICAS}
+  selector:
+    matchLabels:
+      app: ${SERVICE_NAME}
+  template:
+    metadata:
+      labels:
+        app: ${SERVICE_NAME}
+    spec:
+      containers:
+        - name: ${SERVICE_NAME}-container
+          image: ${IMAGE}:${IMAGE_TAG}
+          ports:
+            - containerPort: ${PORT}
+          resources:
+            requests:
+              memory: "${MEM_REQUEST}"
+              cpu: "${CPU_REQUEST}"
+            limits:
+              memory: "${MEM_LIMIT}"
+              cpu: "${CPU_LIMIT}"
+          envFrom:
+            - configMapRef:
+                name: ${SERVICE_NAME}-config
+            - secretRef:
+                name: ${SERVICE_NAME}-secret

package/src/deploy/templates/hpa.yaml

@@ -0,0 +1,19 @@
+apiVersion: autoscaling/v2
+kind: HorizontalPodAutoscaler
+metadata:
+  name: ${SERVICE_NAME}-hpa
+  namespace: ${NAMESPACE}
+spec:
+  scaleTargetRef:
+    apiVersion: apps/v1
+    kind: Deployment
+    name: ${SERVICE_NAME}
+  minReplicas: ${HPA_MIN}
+  maxReplicas: ${HPA_MAX}
+  metrics:
+    - type: Resource
+      resource:
+        name: cpu
+        target:
+          type: Utilization
+          averageUtilization: ${HPA_CPU_TARGET}

package/src/deploy/templates/ingress.yaml

@@ -0,0 +1,24 @@
+apiVersion: networking.k8s.io/v1
+kind: Ingress
+metadata:
+  name: ${SERVICE_NAME}-ingress
+  namespace: ${NAMESPACE}
+  annotations:
+    kubernetes.io/ingress.class: "nginx"
+    cert-manager.io/cluster-issuer: "letsencrypt-prod"
+spec:
+  tls:
+    - hosts:
+        - ${HOST}
+      secretName: ${SERVICE_NAME}-tls
+  rules:
+    - host: ${HOST}
+      http:
+        paths:
+          - path: /
+            pathType: Prefix
+            backend:
+              service:
+                name: ${SERVICE_NAME}-service
+                port:
+                  number: 80

package/src/deploy/templates/secret.yaml

@@ -0,0 +1,12 @@
+apiVersion: v1
+kind: Secret
+metadata:
+  name: ${SERVICE_NAME}-secret
+  namespace: ${NAMESPACE}
+type: Opaque
+stringData:
+  DB_USER: "${DB_USER}"
+  DB_PASSWORD: "${DB_PASSWORD}"
+  JWT_SECRET: "${JWT_SECRET}"
+  OMIE_APP_KEY: "${OMIE_APP_KEY}"
+  OMIE_APP_SECRET: "${OMIE_APP_SECRET}"

package/src/deploy/templates/service.yaml

@@ -0,0 +1,14 @@
+apiVersion: v1
+kind: Service
+metadata:
+  name: ${SERVICE_NAME}-service
+  namespace: ${NAMESPACE}
+spec:
+  type: ClusterIP
+  selector:
+    app: ${SERVICE_NAME}
+  ports:
+    - name: http
+      protocol: TCP
+      port: 80
+      targetPort: ${PORT}

package/src/index.js

@@ -0,0 +1,43 @@
+require("dotenv").config();
+
+/**
+ * API pública do @oondemand/oon-core-back (Seção 2.4).
+ *
+ * O consumidor escreve apenas models/validations/triggers/hooks/mappings/
+ * pipelines/documents/integrations/routes e sobe com `start()` ou
+ * `oonCore-back start`.
+ */
+const { start } = require("./boot/startServer");
+const { createApp } = require("./boot/createApp");
+const { activate } = require("./boot/activation");
+const define = require("./core/define");
+const fields = require("./core/fields");
+const registry = require("./core/registry");
+const GenericError = require("./core/errors/GenericError");
+const { omie } = require("./modules/omie");
+
+module.exports = {
+  // boot
+  start,
+  createApp,
+  activate,
+
+  // declaração de domínio
+  defineCentral: define.defineCentral,
+  defineModel: define.defineModel,
+  defineCollection: define.defineCollection,
+  defineDocument: define.defineDocument,
+  definePipeline: define.definePipeline,
+  defineOmieMapping: define.defineOmieMapping,
+  defineRoutes: define.defineRoutes,
+  defineValidation: define.defineValidation,
+  defineTrigger: define.defineTrigger,
+
+  // helpers
+  fields,
+  omie,
+  GenericError,
+
+  // avançado / introspecção
+  registry,
+};

package/src/modules/assistants/index.js

@@ -0,0 +1,33 @@
+const mongoose = require("mongoose");
+
+/**
+ * Módulo Assistentes IA (Seção 13) — catálogo de assistentes, prompts e
+ * provedores. O dev só declara `ai: { ... }` na model/pipeline; o
+ * mascaramento e os guardrails ficam no Core.
+ */
+const assistenteSchema = new mongoose.Schema(
+  {
+    nome: { type: String, required: true },
+    provedor: { type: String, default: "anthropic" },
+    modelo: { type: String, default: "claude-haiku-4-5-20251001" },
+    prompt: String,
+    ativo: { type: Boolean, default: true },
+  },
+  { timestamps: true }
+);
+
+const Assistente =
+  mongoose.models.Assistente || mongoose.model("Assistente", assistenteSchema);
+
+/**
+ * Mascara campos sensíveis antes de enviar a um provedor de IA.
+ */
+function mascarar(texto, segredos = []) {
+  let out = String(texto || "");
+  for (const s of segredos) {
+    if (s) out = out.split(s).join("«redacted»");
+  }
+  return out;
+}
+
+module.exports = { Assistente, mascarar };

package/src/modules/currencies/index.js

@@ -0,0 +1,31 @@
+const mongoose = require("mongoose");
+
+/**
+ * Módulo Multi-moedas (Seção 14) — cadastro/cotação/conversão. As models
+ * usam os helpers `fields.currency*`. Aqui ficam a model interna de Moeda
+ * e o serviço de conversão padrão.
+ */
+const moedaSchema = new mongoose.Schema(
+  {
+    codigo: { type: String, uppercase: true, minlength: 3, maxlength: 3, unique: true },
+    nome: String,
+    cotacao: { type: Number, default: 1 },
+    ativa: { type: Boolean, default: true },
+  },
+  { timestamps: true }
+);
+
+const Moeda = mongoose.models.Moeda || mongoose.model("Moeda", moedaSchema);
+
+async function converter({ valor, de = "BRL", para = "BRL" }) {
+  if (de === para) return valor;
+  const [origem, destino] = await Promise.all([
+    Moeda.findOne({ codigo: de }),
+    Moeda.findOne({ codigo: para }),
+  ]);
+  const cotacaoDe = origem?.cotacao || 1;
+  const cotacaoPara = destino?.cotacao || 1;
+  return (valor * cotacaoDe) / cotacaoPara;
+}
+
+module.exports = { Moeda, converter };