@oondemand/oon-core-back 0.2.0 → 0.3.0

package/src/api/auth.routes.js

@@ -1,20 +1,119 @@
 const express = require("express");
+const axios = require("axios");
+const ctx = require("../core/context");
 const auth = require("../core/middlewares/auth");
+const GenericError = require("../core/errors/GenericError");
+const {
+  LOGIN_PATH,
+  getBaseUrl,
+  getAppCode,
+  getTimeout,
+} = require("../core/utils/activationProvider");
+const {
+  ensureInstance,
+  instanceHeaders,
+} = require("../core/utils/instanceActivation");
 const { asyncHandler, sendResponse } = require("../core/utils/helpers");
 
-/**
- * Rotas de autenticação do Core. O login propriamente dito é delegado ao
- * provedor configurado (Meus Apps por padrão); aqui validamos o token e
- * devolvemos o usuário resolvido.
- */
 const router = express.Router();
 
+function readBasicAuthorization(req) {
+  const authorization = String(req.headers.authorization || "");
+  if (!authorization.startsWith("Basic ")) {
+    throw new GenericError("Credenciais de autenticação ausentes.", {
+      statusCode: 401,
+    });
+  }
+  return authorization;
+}
+
+function resolveInstanceHeaders(instance) {
+  if (instance.ecosystemRole !== "member") return {};
+
+  if (!instance.instanceId) {
+    if (process.env.NODE_TEST_CONTEXT) return {};
+
+    throw new GenericError(
+      "Instância member ativa sem identidade do ecossistema.",
+      { statusCode: 423 },
+    );
+  }
+
+  return instanceHeaders(instance);
+}
+
+function translateProviderError(error) {
+  if (error instanceof GenericError) return error;
+  const timedOut = error.code === "ECONNABORTED";
+  const statusCode = timedOut ? 504 : error.response?.status || 502;
+  const message =
+    error.response?.data?.message ||
+    (timedOut
+      ? "A Central de Ativações não respondeu dentro do prazo."
+      : "Não foi possível autenticar o usuário na Central de Ativações.");
+  return new GenericError(message, { statusCode });
+}
+
+async function authenticateRoot(req, res, authorization) {
+  const authenticate = ctx.config.auth?.authenticate;
+  if (typeof authenticate !== "function") {
+    throw new GenericError(
+      "A aplicação root não configurou a autenticação local.",
+      { statusCode: 500 },
+    );
+  }
+
+  const result = await authenticate({ authorization, req });
+  const statusCode = result?.statusCode || 200;
+  const data = result?.data || result;
+
+  res.set("Cache-Control", "no-store");
+  res.status(statusCode).json(data);
+}
+
+router.post(
+  "/autenticar",
+  asyncHandler(async (req, res) => {
+    const authorization = readBasicAuthorization(req);
+    const instance = await ensureInstance();
+
+    if (instance.ecosystemRole === "root") {
+      return authenticateRoot(req, res, authorization);
+    }
+
+    const baseUrl = getBaseUrl(req);
+    const appCode = getAppCode();
+
+    try {
+      const response = await axios.post(
+        `${baseUrl}${LOGIN_PATH}`,
+        {},
+        {
+          timeout: getTimeout(),
+          maxRedirects: 0,
+          headers: {
+            Authorization: authorization,
+            "Content-Type": "application/json",
+            "x-app-code": appCode,
+            ...resolveInstanceHeaders(instance),
+          },
+        },
+      );
+
+      res.set("Cache-Control", "no-store");
+      res.status(response.status).json(response.data);
+    } catch (error) {
+      throw translateProviderError(error);
+    }
+  }),
+);
+
 router.get(
   "/validar-token",
   auth,
   asyncHandler(async (req, res) => {
     sendResponse({ res, statusCode: 200, usuario: req.usuario });
-  })
+  }),
 );
 
 module.exports = router;

package/src/boot/createApp.js

@@ -13,6 +13,8 @@ const { buildModelRouter } = require("../core/factories/modelRouter");
 const coreRoutes = require("../api/core.routes");
 const statusRoutes = require("../api/status.routes");
 const authRoutes = require("../api/auth.routes");
+const activationRoutes = require("../api/activation.routes");
+const activationGuard = require("../core/middlewares/activationGuard");
 
 /**
  * Cria a app Express do Core: middlewares transversais, rotas públicas,
@@ -31,6 +33,8 @@ function createApp() {
 
   // Públicas.
   app.use("/", statusRoutes);
+  app.use("/ativacao", activationRoutes);
+  app.use(activationGuard);
   app.use("/auth", authRoutes);
   app.use("/core", coreRoutes);
 

package/src/core/fields.js

@@ -7,7 +7,10 @@
  */
 const mongoose = require("mongoose");
 
-const withMeta = (mongooseDef, meta) => ({ ...mongooseDef, __meta: meta });
+const withMeta = (mongooseDef, meta) => ({
+  ...mongooseDef,
+  __meta: { required: !!mongooseDef.required, ...meta },
+});
 
 const string = (opts = {}) =>
   withMeta(

package/src/core/middlewares/activationGuard.js

@@ -0,0 +1,43 @@
+const { ensureInstance } = require("../utils/instanceActivation");
+const Helpers = require("../utils/helpers");
+
+const allowed = [
+  /^\/ativacao(\/|$)/,
+  /^\/health$/,
+  /^\/version$/,
+  /^\/favicon\.ico$/,
+];
+
+module.exports = async function activationGuard(req, res, next) {
+  try {
+    if (allowed.some((pattern) => pattern.test(req.path))) return next();
+
+    const instance = await ensureInstance();
+    if (instance.status === "ativa") return next();
+
+    const code =
+      instance.status === "suspensa"
+        ? "INSTANCE_SUSPENDED"
+        : instance.status === "revogada"
+          ? "INSTANCE_REVOKED"
+          : "INSTANCE_NOT_ACTIVE";
+
+    const message =
+      instance.status === "suspensa"
+        ? instance.motivoSuspensao || "Esta Central está suspensa."
+        : instance.status === "revogada"
+          ? "Esta Central foi revogada."
+          : instance.ecosystemRole === "root"
+            ? "O aplicativo root ainda não foi ativado."
+            : "Esta Central ainda não foi ativada.";
+
+    return Helpers.sendErrorResponse({
+      res,
+      statusCode: 423,
+      message,
+      code,
+    });
+  } catch (error) {
+    return next(error);
+  }
+};

package/src/core/middlewares/auth.js

@@ -1,39 +1,84 @@
 const axios = require("axios");
-const Sistema = require("../models/Sistema");
 const Helpers = require("../utils/helpers");
 const ctx = require("../context");
+const {
+  PERMISSION_PATH,
+  getBaseUrl,
+  getAppCode,
+  getTimeout,
+} = require("../utils/activationProvider");
+const {
+  ensureInstance,
+  instanceHeaders,
+} = require("../utils/instanceActivation");
 
-/**
- * Verificador padrão: delega ao Meus Apps (comportamento histórico do CST).
- * Pode ser sobrescrito via `central.config.js -> auth.verifyToken`.
- */
-async function defaultVerifyToken(token) {
-  const sistema = await Sistema.findOne().catch(() => null);
-  const baseUrl = process.env.MEUS_APPS_BACKEND_URL;
-  if (!baseUrl) {
-    const err = new Error("MEUS_APPS_BACKEND_URL não configurada.");
-    err.statusCode = 401;
-    throw err;
+function resolveInstanceHeaders(instance) {
+  if (instance.ecosystemRole !== "member") return {};
+
+  if (!instance.instanceId) {
+    if (process.env.NODE_TEST_CONTEXT) return {};
+
+    const error = new Error(
+      "Instância member ativa sem identidade do ecossistema.",
+    );
+    error.statusCode = 423;
+    throw error;
   }
 
-  const response = await axios.get(
-    `${baseUrl}/auth/autenticar-aplicativo/`,
-    { headers: { Authorization: `Bearer ${token}`, origin: sistema?.appKey } }
-  );
-
-  const data = response.data.usuario;
-  return {
-    tipo:
-      data.aplicativo.tipoAcesso === "master" ? "admin" : data.aplicativo.tipoAcesso,
-    nome: data.nome,
-    email: data.email,
-  };
+  return instanceHeaders(instance);
+}
+
+async function defaultVerifyToken(token, context = {}) {
+  const baseUrl = getBaseUrl(context.req);
+  const appCode = getAppCode();
+  const instance = await ensureInstance();
+
+  try {
+    const headers = {
+      "x-app-code": appCode,
+      Authorization: `Bearer ${token}`,
+      ...resolveInstanceHeaders(instance),
+    };
+
+    const response = await axios.get(`${baseUrl}${PERMISSION_PATH}`, {
+      headers,
+      timeout: getTimeout(),
+      maxRedirects: 0,
+    });
+
+    const data = response.data?.usuario;
+    if (!data) {
+      const error = new Error(
+        "Usuário não retornado pela Central de Ativações.",
+      );
+      error.statusCode = 502;
+      throw error;
+    }
+
+    return {
+      ...data,
+      tipo:
+        data.tipo === "master" || data.perfil === "administrador"
+          ? "admin"
+          : data.tipo || data.perfil,
+    };
+  } catch (error) {
+    if (error.statusCode) throw error;
+
+    const timedOut = error.code === "ECONNABORTED";
+    const translated = new Error(
+      error.response?.data?.message ||
+        (timedOut
+          ? "A Central de Ativações não respondeu dentro do prazo."
+          : "Não foi possível validar a permissão do aplicativo."),
+    );
+    translated.statusCode = timedOut
+      ? 504
+      : error.response?.status || 502;
+    throw translated;
+  }
 }
 
-/**
- * Middleware de autenticação. Sem token => 401 (invariante de segurança).
- * Resolve `req.usuario` e segue.
- */
 const authMiddleware = async (req, res, next) => {
   const token = req.headers.authorization?.split(" ")[1];
 
@@ -49,15 +94,24 @@ const authMiddleware = async (req, res, next) => {
 
   try {
     const usuario = await verify(token, { req });
-    if (!usuario) throw new Error("Usuário não resolvido.");
+    if (!usuario) {
+      const error = new Error("Usuário não resolvido.");
+      error.statusCode = 401;
+      throw error;
+    }
     req.usuario = usuario;
     next();
   } catch (error) {
-    return Helpers.sendErrorResponse({
-      res,
-      message: "Token inválido ou erro na autenticação.",
-      statusCode: error.statusCode || 401,
-    });
+    const statusCode = error.statusCode || error.response?.status || 502;
+    const message =
+      statusCode === 403
+        ? "Usuário sem permissão para acessar este aplicativo."
+        : statusCode === 401
+          ? "Token inválido ou expirado."
+          : error.message ||
+            "Erro ao validar autenticação e permissão do aplicativo.";
+
+    return Helpers.sendErrorResponse({ res, message, statusCode });
   }
 };
 

package/src/core/models/InstanciaEcossistema.js

@@ -0,0 +1,60 @@
+const mongoose = require("mongoose");
+
+const statuses = ["nao_ativada", "validando", "configurando", "ativa", "suspensa", "revogada", "erro"];
+const roles = ["root", "member"];
+
+const schema = new mongoose.Schema(
+  {
+    singletonKey: { type: String, default: "default", immutable: true },
+    status: { type: String, enum: statuses, default: "nao_ativada", index: true },
+    ecosystemRole: { type: String, enum: roles, default: "member", index: true },
+    instanceId: { type: String, index: true },
+    instanceCode: String,
+    appCode: { type: String, index: true },
+    appId: String,
+    tenantId: String,
+    licencaId: String,
+    ambiente: { type: String, enum: ["desenvolvimento", "homologacao", "producao"] },
+    nomeInstancia: String,
+    ecosystemUrl: String,
+    publicUrl: String,
+    coreVersion: String,
+    appVersion: String,
+    fingerprint: String,
+    credentialEncrypted: { type: String, select: false },
+    credentialIv: { type: String, select: false },
+    credentialAuthTag: { type: String, select: false },
+    credentialVersion: Number,
+    configurationVersion: Number,
+    parametrosGlobais: { type: mongoose.Schema.Types.Mixed, default: {} },
+    parametrosAplicacao: { type: mongoose.Schema.Types.Mixed, default: {} },
+    tenant: { type: mongoose.Schema.Types.Mixed, default: {} },
+    app: { type: mongoose.Schema.Types.Mixed, default: {} },
+    licenca: { type: mongoose.Schema.Types.Mixed, default: {} },
+    ativadaEm: Date,
+    concluidaEm: Date,
+    ultimaValidacaoEm: Date,
+    ultimoHeartbeatEm: Date,
+    ultimoErro: String,
+    motivoSuspensao: String,
+    motivoRevogacao: String,
+  },
+  {
+    timestamps: true,
+    collection: "oon_instancia_ecossistema",
+    toJSON: {
+      transform(_doc, ret) {
+        delete ret.credentialEncrypted;
+        delete ret.credentialIv;
+        delete ret.credentialAuthTag;
+        return ret;
+      },
+    },
+  },
+);
+
+schema.index({ singletonKey: 1 }, { unique: true });
+
+module.exports = mongoose.models.InstanciaEcossistema || mongoose.model("InstanciaEcossistema", schema);
+module.exports.STATUSES = statuses;
+module.exports.ROLES = roles;

package/src/core/utils/activationProvider.js

@@ -0,0 +1,54 @@
+const GenericError = require("../errors/GenericError");
+
+const LOGIN_PATH = "/integracao/autenticacao-aplicativos/autenticar";
+const PERMISSION_PATH = "/integracao/autenticacao-aplicativos/verificar-permissao";
+
+function getBaseUrl(req) {
+  const value = process.env.CENTRAL_ATIVACAO_URL || process.env.MEUS_APPS_BACKEND_URL;
+  if (!value) {
+    throw new GenericError("CENTRAL_ATIVACAO_URL não configurada.", { statusCode: 500 });
+  }
+
+  let parsed;
+  try {
+    parsed = new URL(value);
+  } catch {
+    throw new GenericError("CENTRAL_ATIVACAO_URL inválida.", { statusCode: 500 });
+  }
+
+  const currentHost = String(
+    req?.headers?.["x-forwarded-host"] || req?.headers?.host || "",
+  )
+    .split(",")[0]
+    .trim()
+    .toLowerCase();
+
+  if (
+    currentHost &&
+    parsed.host.toLowerCase() === currentHost &&
+    process.env.AUTH_ALLOW_SAME_HOST !== "true"
+  ) {
+    throw new GenericError(
+      "CENTRAL_ATIVACAO_URL aponta para o próprio Core. Configure o endereço da Central de Ativações.",
+      { statusCode: 500 },
+    );
+  }
+
+  return parsed.toString().replace(/\/$/, "");
+}
+
+function getAppCode() {
+  const value = String(process.env.APP_CODE || process.env.APP_CODIGO || process.env.APP_KEY || "")
+    .trim()
+    .toLowerCase();
+  if (value) return value;
+  if (process.env.NODE_TEST_CONTEXT) return "oon-core-test";
+  throw new GenericError("APP_CODE não configurada no backend.", { statusCode: 500 });
+}
+
+function getTimeout() {
+  const value = Number(process.env.AUTH_PROVIDER_TIMEOUT_MS);
+  return Number.isFinite(value) && value > 0 ? value : 10000;
+}
+
+module.exports = { LOGIN_PATH, PERMISSION_PATH, getBaseUrl, getAppCode, getTimeout };

package/src/core/utils/helpers.js

@@ -2,10 +2,10 @@ exports.sendResponse = ({ res, statusCode = 200, message = "OK", ...rest }) => {
   res.status(statusCode).send({ message, ...rest });
 };
 
-exports.sendErrorResponse = ({ res, statusCode = 500, message, error }) => {
+exports.sendErrorResponse = ({ res, statusCode = 500, message, error, code }) => {
   res.status(statusCode).json({
     message,
-    ...(error ? { error } : {}),
+    error: error || (code ? { code, message } : undefined),
   });
 };