@oondemand/oon-core-back 0.2.0 → 0.3.3

package/src/api/auth.routes.js

@@ -1,20 +1,155 @@
 const express = require("express");
+const axios = require("axios");
 const auth = require("../core/middlewares/auth");
+const ctx = require("../core/context");
+const GenericError = require("../core/errors/GenericError");
 const { asyncHandler, sendResponse } = require("../core/utils/helpers");
+const {
+  LOGIN_PATH,
+  getBaseUrl,
+  getAppCode,
+  getTimeout,
+} = require("../core/utils/activationProvider");
+
+const DEV_ACTIVATION_PATH = "/integracao/dev-local/ativar-central";
 
 /**
- * Rotas de autenticação do Core. O login propriamente dito é delegado ao
- * provedor configurado (Meus Apps por padrão); aqui validamos o token e
- * devolvemos o usuário resolvido.
+ * Rotas de autenticação do Core. Em aplicações member, o login é delegado para
+ * a Central de Ativações com o código do app carregado do ambiente do backend.
  */
 const router = express.Router();
 
+function readBasicAuthorization(req) {
+  const authorization = String(req.headers.authorization || "");
+  if (!authorization.startsWith("Basic ")) {
+    throw new GenericError("Credenciais de autenticação ausentes.", {
+      statusCode: 401,
+    });
+  }
+  return authorization;
+}
+
+function readOptionalAppCode() {
+  return String(
+    process.env.APP_CODE ||
+      process.env.APP_CODIGO ||
+      process.env.OON_APP_CODE ||
+      process.env.OON_APP_CODIGO ||
+      "",
+  )
+    .trim()
+    .toLowerCase();
+}
+
+function translateProviderError(error) {
+  if (error instanceof GenericError) return error;
+
+  const timedOut = error.code === "ECONNABORTED";
+  const statusCode = timedOut ? 504 : error.response?.status || 502;
+  const message =
+    error.response?.data?.message ||
+    (timedOut
+      ? "A Central de Ativações não respondeu dentro do prazo."
+      : "Não foi possível autenticar o usuário na Central de Ativações.");
+
+  return new GenericError(message, { statusCode });
+}
+
+async function authenticateLocal(req, res, authorization) {
+  const authenticate = ctx.config.auth?.authenticate;
+  if (typeof authenticate !== "function") return false;
+
+  const result = await authenticate({ authorization, req });
+  const statusCode = result?.statusCode || 200;
+  const data = result?.data || result;
+
+  res.set("Cache-Control", "no-store");
+  res.status(statusCode).json(data);
+  return true;
+}
+
+router.post(
+  "/autenticar",
+  asyncHandler(async (req, res) => {
+    const authorization = readBasicAuthorization(req);
+
+    if (await authenticateLocal(req, res, authorization)) return;
+
+    const baseUrl = getBaseUrl(req);
+    const appCode = getAppCode();
+
+    try {
+      const response = await axios.post(
+        `${baseUrl}${LOGIN_PATH}`,
+        {
+          codigoApp: appCode,
+          codigo: appCode,
+        },
+        {
+          timeout: getTimeout(),
+          maxRedirects: 0,
+          headers: {
+            Authorization: authorization,
+            "Content-Type": "application/json",
+            "x-app-code": appCode,
+          },
+        },
+      );
+
+      res.set("Cache-Control", "no-store");
+      res.status(response.status).json(response.data);
+    } catch (error) {
+      throw translateProviderError(error);
+    }
+  }),
+);
+
+router.post(
+  "/ativar-dev-local",
+  asyncHandler(async (req, res) => {
+    const authorization = readBasicAuthorization(req);
+    const baseUrl = getBaseUrl(req);
+    const appCode = readOptionalAppCode();
+
+    try {
+      const response = await axios.post(
+        `${baseUrl}${DEV_ACTIVATION_PATH}`,
+        {
+          appCode: appCode || req.body?.appCode || req.body?.codigoApp,
+          nomeCentral: req.body?.nomeCentral || ctx.config.name,
+          appName: req.body?.appName || ctx.config.name,
+          appSlug: req.body?.appSlug || ctx.config.slug,
+          ambiente: req.body?.ambiente || process.env.NODE_ENV || "development",
+          urlPublica: req.body?.urlPublica,
+          repositorio: req.body?.repositorio,
+          branch: req.body?.branch,
+          nomeUsuario: req.body?.nomeUsuario,
+          nomeTenant: req.body?.nomeTenant,
+        },
+        {
+          timeout: getTimeout(),
+          maxRedirects: 0,
+          headers: {
+            Authorization: authorization,
+            "Content-Type": "application/json",
+          },
+        },
+      );
+
+      res.set("Cache-Control", "no-store");
+      res.status(response.status).json(response.data);
+    } catch (error) {
+      throw translateProviderError(error);
+    }
+  }),
+);
+
 router.get(
   "/validar-token",
   auth,
   asyncHandler(async (req, res) => {
     sendResponse({ res, statusCode: 200, usuario: req.usuario });
-  })
+  }),
 );
 
 module.exports = router;

package/src/boot/createApp.js

@@ -13,6 +13,8 @@ const { buildModelRouter } = require("../core/factories/modelRouter");
 const coreRoutes = require("../api/core.routes");
 const statusRoutes = require("../api/status.routes");
 const authRoutes = require("../api/auth.routes");
+const activationRoutes = require("../api/activation.routes");
+const activationGuard = require("../core/middlewares/activationGuard");
 
 /**
  * Cria a app Express do Core: middlewares transversais, rotas públicas,
@@ -31,6 +33,8 @@ function createApp() {
 
   // Públicas.
   app.use("/", statusRoutes);
+  app.use("/ativacao", activationRoutes);
+  app.use(activationGuard);
   app.use("/auth", authRoutes);
   app.use("/core", coreRoutes);
 

package/src/core/fields.js

@@ -7,7 +7,10 @@
  */
 const mongoose = require("mongoose");
 
-const withMeta = (mongooseDef, meta) => ({ ...mongooseDef, __meta: meta });
+const withMeta = (mongooseDef, meta) => ({
+  ...mongooseDef,
+  __meta: { required: !!mongooseDef.required, ...meta },
+});
 
 const string = (opts = {}) =>
   withMeta(

package/src/core/middlewares/activationGuard.js

@@ -0,0 +1,43 @@
+const { ensureInstance } = require("../utils/instanceActivation");
+const Helpers = require("../utils/helpers");
+
+const allowed = [
+  /^\/ativacao(\/|$)/,
+  /^\/health$/,
+  /^\/version$/,
+  /^\/favicon\.ico$/,
+];
+
+module.exports = async function activationGuard(req, res, next) {
+  try {
+    if (allowed.some((pattern) => pattern.test(req.path))) return next();
+
+    const instance = await ensureInstance();
+    if (instance.status === "ativa") return next();
+
+    const code =
+      instance.status === "suspensa"
+        ? "INSTANCE_SUSPENDED"
+        : instance.status === "revogada"
+          ? "INSTANCE_REVOKED"
+          : "INSTANCE_NOT_ACTIVE";
+
+    const message =
+      instance.status === "suspensa"
+        ? instance.motivoSuspensao || "Esta Central está suspensa."
+        : instance.status === "revogada"
+          ? "Esta Central foi revogada."
+          : instance.ecosystemRole === "root"
+            ? "O aplicativo root ainda não foi ativado."
+            : "Esta Central ainda não foi ativada.";
+
+    return Helpers.sendErrorResponse({
+      res,
+      statusCode: 423,
+      message,
+      code,
+    });
+  } catch (error) {
+    return next(error);
+  }
+};

package/src/core/middlewares/auth.js

@@ -1,39 +1,50 @@
 const axios = require("axios");
-const Sistema = require("../models/Sistema");
 const Helpers = require("../utils/helpers");
 const ctx = require("../context");
+const {
+  PERMISSION_PATH,
+  getBaseUrl,
+  getAppCode,
+  getTimeout,
+} = require("../utils/activationProvider");
 
 /**
- * Verificador padrão: delega ao Meus Apps (comportamento histórico do CST).
+ * Verificador padrão: delega para a Central de Ativações e valida o token no
+ * contexto do app configurado no backend por APP_CODE/APP_CODIGO.
  * Pode ser sobrescrito via `central.config.js -> auth.verifyToken`.
  */
-async function defaultVerifyToken(token) {
-  const sistema = await Sistema.findOne().catch(() => null);
-  const baseUrl = process.env.MEUS_APPS_BACKEND_URL;
-  if (!baseUrl) {
-    const err = new Error("MEUS_APPS_BACKEND_URL não configurada.");
+async function defaultVerifyToken(token, { req } = {}) {
+  const baseUrl = getBaseUrl(req);
+  const appCode = getAppCode();
+
+  const response = await axios.get(`${baseUrl}${PERMISSION_PATH}`, {
+    timeout: getTimeout(),
+    maxRedirects: 0,
+    headers: {
+      Authorization: `Bearer ${token}`,
+      "x-app-code": appCode,
+    },
+  });
+
+  const data = response.data.usuario;
+  if (!data) {
+    const err = new Error("Usuário não retornado pela Central de Ativações.");
     err.statusCode = 401;
     throw err;
   }
 
-  const response = await axios.get(
-    `${baseUrl}/auth/autenticar-aplicativo/`,
-    { headers: { Authorization: `Bearer ${token}`, origin: sistema?.appKey } }
-  );
+  const tipoAcesso =
+    data.aplicativo?.tipoAcesso || data.tipoAcesso || data.perfil || data.tipo;
 
-  const data = response.data.usuario;
   return {
-    tipo:
-      data.aplicativo.tipoAcesso === "master" ? "admin" : data.aplicativo.tipoAcesso,
+    ...data,
+    tipo: tipoAcesso === "master" ? "admin" : tipoAcesso,
+    perfil: data.perfil || tipoAcesso,
     nome: data.nome,
     email: data.email,
   };
 }
 
-/**
- * Middleware de autenticação. Sem token => 401 (invariante de segurança).
- * Resolve `req.usuario` e segue.
- */
 const authMiddleware = async (req, res, next) => {
   const token = req.headers.authorization?.split(" ")[1];
 
@@ -49,14 +60,18 @@ const authMiddleware = async (req, res, next) => {
 
   try {
     const usuario = await verify(token, { req });
-    if (!usuario) throw new Error("Usuário não resolvido.");
+    if (!usuario) {
+      const error = new Error("Usuário não resolvido.");
+      error.statusCode = 401;
+      throw error;
+    }
     req.usuario = usuario;
     next();
   } catch (error) {
     return Helpers.sendErrorResponse({
       res,
-      message: "Token inválido ou erro na autenticação.",
-      statusCode: error.statusCode || 401,
+      message: error.message || "Token inválido ou erro na autenticação.",
+      statusCode: error.statusCode || error.response?.status || 401,
     });
   }
 };

package/src/core/models/InstanciaEcossistema.js

@@ -0,0 +1,60 @@
+const mongoose = require("mongoose");
+
+const statuses = ["nao_ativada", "validando", "configurando", "ativa", "suspensa", "revogada", "erro"];
+const roles = ["root", "member"];
+
+const schema = new mongoose.Schema(
+  {
+    singletonKey: { type: String, default: "default", immutable: true },
+    status: { type: String, enum: statuses, default: "nao_ativada", index: true },
+    ecosystemRole: { type: String, enum: roles, default: "member", index: true },
+    instanceId: { type: String, index: true },
+    instanceCode: String,
+    appCode: { type: String, index: true },
+    appId: String,
+    tenantId: String,
+    licencaId: String,
+    ambiente: { type: String, enum: ["desenvolvimento", "homologacao", "producao"] },
+    nomeInstancia: String,
+    ecosystemUrl: String,
+    publicUrl: String,
+    coreVersion: String,
+    appVersion: String,
+    fingerprint: String,
+    credentialEncrypted: { type: String, select: false },
+    credentialIv: { type: String, select: false },
+    credentialAuthTag: { type: String, select: false },
+    credentialVersion: Number,
+    configurationVersion: Number,
+    parametrosGlobais: { type: mongoose.Schema.Types.Mixed, default: {} },
+    parametrosAplicacao: { type: mongoose.Schema.Types.Mixed, default: {} },
+    tenant: { type: mongoose.Schema.Types.Mixed, default: {} },
+    app: { type: mongoose.Schema.Types.Mixed, default: {} },
+    licenca: { type: mongoose.Schema.Types.Mixed, default: {} },
+    ativadaEm: Date,
+    concluidaEm: Date,
+    ultimaValidacaoEm: Date,
+    ultimoHeartbeatEm: Date,
+    ultimoErro: String,
+    motivoSuspensao: String,
+    motivoRevogacao: String,
+  },
+  {
+    timestamps: true,
+    collection: "oon_instancia_ecossistema",
+    toJSON: {
+      transform(_doc, ret) {
+        delete ret.credentialEncrypted;
+        delete ret.credentialIv;
+        delete ret.credentialAuthTag;
+        return ret;
+      },
+    },
+  },
+);
+
+schema.index({ singletonKey: 1 }, { unique: true });
+
+module.exports = mongoose.models.InstanciaEcossistema || mongoose.model("InstanciaEcossistema", schema);
+module.exports.STATUSES = statuses;
+module.exports.ROLES = roles;

package/src/core/utils/activationProvider.js

@@ -0,0 +1,74 @@
+const GenericError = require("../errors/GenericError");
+
+const LOGIN_PATH = "/integracao/autenticacao-aplicativos/autenticar";
+const PERMISSION_PATH = "/integracao/autenticacao-aplicativos/verificar-permissao";
+
+function getBaseUrl(req) {
+  const value = process.env.CENTRAL_ATIVACAO_URL || process.env.MEUS_APPS_BACKEND_URL;
+  if (!value) {
+    throw new GenericError("CENTRAL_ATIVACAO_URL não configurada.", {
+      statusCode: 500,
+    });
+  }
+
+  let parsed;
+  try {
+    parsed = new URL(value);
+  } catch {
+    throw new GenericError("CENTRAL_ATIVACAO_URL inválida.", {
+      statusCode: 500,
+    });
+  }
+
+  const currentHost = String(
+    req?.headers?.["x-forwarded-host"] || req?.headers?.host || "",
+  )
+    .split(",")[0]
+    .trim()
+    .toLowerCase();
+
+  if (
+    currentHost &&
+    parsed.host.toLowerCase() === currentHost &&
+    process.env.AUTH_ALLOW_SAME_HOST !== "true"
+  ) {
+    throw new GenericError(
+      "CENTRAL_ATIVACAO_URL aponta para o próprio Core. Configure o endereço da Central de Ativações.",
+      { statusCode: 500 },
+    );
+  }
+
+  return parsed.toString().replace(/\/$/, "");
+}
+
+function getAppCode() {
+  const value = String(
+    process.env.APP_CODE ||
+      process.env.APP_CODIGO ||
+      process.env.OON_APP_CODE ||
+      process.env.OON_APP_CODIGO ||
+      "",
+  )
+    .trim()
+    .toLowerCase();
+
+  if (value) return value;
+  if (process.env.NODE_TEST_CONTEXT) return "oon-core-test";
+
+  throw new GenericError("APP_CODE não configurada no backend.", {
+    statusCode: 500,
+  });
+}
+
+function getTimeout() {
+  const value = Number(process.env.AUTH_PROVIDER_TIMEOUT_MS);
+  return Number.isFinite(value) && value > 0 ? value : 10000;
+}
+
+module.exports = {
+  LOGIN_PATH,
+  PERMISSION_PATH,
+  getBaseUrl,
+  getAppCode,
+  getTimeout,
+};

package/src/core/utils/helpers.js

@@ -2,10 +2,10 @@ exports.sendResponse = ({ res, statusCode = 200, message = "OK", ...rest }) => {
   res.status(statusCode).send({ message, ...rest });
 };
 
-exports.sendErrorResponse = ({ res, statusCode = 500, message, error }) => {
+exports.sendErrorResponse = ({ res, statusCode = 500, message, error, code }) => {
   res.status(statusCode).json({
     message,
-    ...(error ? { error } : {}),
+    error: error || (code ? { code, message } : undefined),
   });
 };