@oondemand/oon-core-back 0.3.62 → 0.3.64

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@oondemand/oon-core-back",
-  "version": "0.3.62",
+  "version": "0.3.64",
   "repository": {
     "type": "git",
     "url": "git+https://github.com/oondemand/oon-platform.git",

package/src/api/core.routes.js

@@ -105,6 +105,156 @@ function runtimeSummary() {
   };
 }
 
+const DASHBOARD_FILTER_OPERATORS = Object.freeze({
+  eq: "$eq",
+  ne: "$ne",
+  in: "$in",
+  nin: "$nin",
+  gt: "$gt",
+  gte: "$gte",
+  lt: "$lt",
+  lte: "$lte",
+  exists: "$exists",
+});
+
+function dashboardError(message, statusCode = 422) {
+  const error = new Error(message);
+  error.statusCode = statusCode;
+  return error;
+}
+
+function dashboardField(entry, field, usage) {
+  const normalized = String(field || "").trim();
+  if (!normalized || normalized.startsWith("$") || normalized.includes(".")) {
+    throw dashboardError(`Campo inválido para ${usage}.`);
+  }
+  if (normalized !== "_id" && !entry.metaFields?.[normalized]) {
+    throw dashboardError(`Campo não declarado em ${entry.name}: ${normalized}.`);
+  }
+  return normalized;
+}
+
+function primitive(value) {
+  return value === null || ["string", "number", "boolean"].includes(typeof value);
+}
+
+function normalizeDashboardFilterValue(value) {
+  if (primitive(value)) return value;
+  if (!value || Array.isArray(value) || typeof value !== "object") {
+    throw dashboardError("Valor de filtro inválido.");
+  }
+  const output = {};
+  for (const [operator, operand] of Object.entries(value)) {
+    const mongoOperator = DASHBOARD_FILTER_OPERATORS[operator];
+    if (!mongoOperator) throw dashboardError(`Operador de filtro não permitido: ${operator}.`);
+    if (["in", "nin"].includes(operator)) {
+      if (!Array.isArray(operand) || !operand.every(primitive)) {
+        throw dashboardError(`${operator} exige uma lista de valores simples.`);
+      }
+    } else if (operator === "exists") {
+      if (typeof operand !== "boolean") throw dashboardError("exists exige true ou false.");
+    } else if (!primitive(operand)) {
+      throw dashboardError(`${operator} exige um valor simples.`);
+    }
+    output[mongoOperator] = operand;
+  }
+  return output;
+}
+
+function normalizeDashboardFilter(entry, raw = {}) {
+  if (!raw || Array.isArray(raw) || typeof raw !== "object") {
+    throw dashboardError("Filtros do Dashboard devem ser um objeto.");
+  }
+  const entries = Object.entries(raw);
+  if (entries.length > 20) throw dashboardError("O Dashboard aceita no máximo 20 filtros por indicador.");
+  return Object.fromEntries(entries.map(([field, value]) => [
+    dashboardField(entry, field, "filtro"),
+    normalizeDashboardFilterValue(value),
+  ]));
+}
+
+async function executeDashboardMetric(entry, query = {}) {
+  if (!entry?.mongooseModel) throw dashboardError("Model sem persistência para o Dashboard.");
+  const id = String(query.id || "").trim();
+  if (!id) throw dashboardError("Todo indicador do Dashboard deve possuir id.");
+  const kind = String(query.kind || "count");
+  if (!["count", "sum", "groupCount", "groupSum"].includes(kind)) {
+    throw dashboardError(`Agregação de Dashboard não permitida: ${kind}.`);
+  }
+  const filter = normalizeDashboardFilter(entry, query.filters || {});
+
+  if (kind === "count") {
+    return { id, kind, value: Number(await entry.mongooseModel.countDocuments(filter)) };
+  }
+
+  const field = ["sum", "groupSum"].includes(kind)
+    ? dashboardField(entry, query.field, "soma")
+    : undefined;
+  if (field) {
+    const fieldKind = entry.metaFields?.[field]?.kind;
+    if (!["number", "currency", "currencyConverted"].includes(fieldKind)) {
+      throw dashboardError(`O campo ${entry.name}.${field} não é numérico.`);
+    }
+  }
+
+  if (kind === "sum") {
+    const [row] = await entry.mongooseModel.aggregate([
+      { $match: filter },
+      { $group: { _id: null, value: { $sum: { $ifNull: [`$${field}`, 0] } } } },
+    ]);
+    return { id, kind, value: Number(row?.value || 0) };
+  }
+
+  const groupBy = dashboardField(entry, query.groupBy, "agrupamento");
+  const accumulator = kind === "groupSum"
+    ? { $sum: { $ifNull: [`$${field}`, 0] } }
+    : { $sum: 1 };
+  const rows = await entry.mongooseModel.aggregate([
+    { $match: filter },
+    { $group: { _id: `$${groupBy}`, value: accumulator } },
+    { $sort: { _id: 1 } },
+  ]);
+  return {
+    id,
+    kind,
+    groups: rows.map((row) => ({
+      key: row._id == null || row._id === "" ? "Sem status" : String(row._id),
+      value: Number(row.value || 0),
+    })),
+  };
+}
+
+function canReadDashboardModel(req, entry) {
+  const roles = entry.definition?.crud?.roles?.read || [];
+  if (!roles.length) return true;
+  const role = req.user?.tipo || req.user?.role;
+  return roles.includes(role);
+}
+
+router.post("/dashboard/query", async (req, res, next) => {
+  try {
+    const queries = req.body?.queries;
+    if (!Array.isArray(queries) || !queries.length) {
+      throw dashboardError("Informe ao menos um indicador do Dashboard.", 400);
+    }
+    if (queries.length > 40) throw dashboardError("O Dashboard aceita no máximo 40 indicadores.", 400);
+    const ids = queries.map((query) => String(query?.id || ""));
+    if (new Set(ids).size !== ids.length) throw dashboardError("Ids de indicadores não podem se repetir.", 400);
+
+    const results = await Promise.all(queries.map(async (query) => {
+      const entry = registry.getModel(query.model);
+      if (!entry) throw dashboardError(`Model não registrada: ${query.model || "não informada"}.`, 404);
+      if (!canReadDashboardModel(req, entry)) {
+        throw dashboardError(`Sem permissão de leitura para ${entry.name}.`, 403);
+      }
+      return executeDashboardMetric(entry, query);
+    }));
+    res.json({ results });
+  } catch (error) {
+    next(error);
+  }
+});
+
 router.get("/metadata", (_req, res) => {
   res.json({
     service: { name: ctx.config.serviceName, version: ctx.config.serviceVersion },
@@ -152,3 +302,5 @@ router.get("/features", (_req, res) => res.json({ results: registry.listFeatures
 
 module.exports = router;
 module.exports.runtimeSummary = runtimeSummary;
+module.exports.executeDashboardMetric = executeDashboardMetric;
+module.exports.normalizeDashboardFilter = normalizeDashboardFilter;

package/src/modules/integrations/sanitizer.js

@@ -2,7 +2,7 @@
 
 const SENSITIVE_KEY = /(authorization|cookie|password|passwd|secret|token|api[-_]?key|app[-_]?key|app[-_]?secret|private[-_]?key|credential|senha)/i;
 const DEFAULTS = {
-  maxDepth: 6,
+  maxDepth: 12,
   maxArrayItems: 20,
   maxObjectKeys: 100,
   maxStringLength: 4000,

package/src/modules/omie/client.js

@@ -106,6 +106,17 @@ function wait(ms) {
   return ms > 0 ? new Promise((resolve) => setTimeout(resolve, ms)) : Promise.resolve();
 }
 
+async function resolveCallParam(callDefinition, input = {}, context = {}) {
+  const declared = typeof callDefinition.param === "function"
+    ? await callDefinition.param({ input, context, cursor: context.cursor })
+    : callDefinition.param;
+  return resolveTemplate(declared ?? [{}], {
+    input,
+    context,
+    cursor: context.cursor,
+  });
+}
+
 function createOmieClient(options = {}) {
   const credentials = options.credentials || {};
   const appKey = String(credentials.appKey || "").trim();
@@ -148,11 +159,7 @@ function createOmieClient(options = {}) {
         code: "OMIE_CALL_MISSING",
       });
     }
-    const resolvedParam = resolveTemplate(callDefinition.param ?? [{}], {
-      input,
-      context,
-      cursor: context.cursor,
-    });
+    const resolvedParam = await resolveCallParam(callDefinition, input, context);
     const body = {
       call,
       app_key: appKey,
@@ -247,6 +254,7 @@ module.exports = {
   createOmieClient,
   getPath,
   normalizeEndpoint,
+  resolveCallParam,
   resolveTemplate,
   responseError,
 };