@oondemand/oon-core-back 0.3.73 → 0.3.75

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@oondemand/oon-core-back",
-  "version": "0.3.73",
+  "version": "0.3.75",
   "repository": {
     "type": "git",
     "url": "git+https://github.com/oondemand/oon-platform.git",

package/src/api/access.routes.js

@@ -0,0 +1,353 @@
+"use strict";
+
+const express = require("express");
+const auth = require("../core/middlewares/auth");
+const { requirePermission } = require("../core/middlewares/permissions");
+const GenericError = require("../core/errors/GenericError");
+const { asyncHandler } = require("../core/utils/helpers");
+const {
+  policy,
+  publicPolicy,
+  roleByCode,
+  canAssignRole,
+} = require("../core/rbac/policy");
+const {
+  models,
+  appCode,
+  audit,
+  sanitizeSnapshot,
+  createInvitation,
+  findInvitationByToken,
+  recoverPendingInvitation,
+  assertNotLastAdmin,
+} = require("../core/rbac/storage");
+const { provisionInvitation } = require("../core/rbac/identityProvider");
+
+const router = express.Router();
+
+function requiredRbac() {
+  if (!policy().enabled) {
+    throw new GenericError("Esta Central ainda utiliza o modo de acesso legado.", {
+      statusCode: 409,
+      code: "RBAC_NOT_CONFIGURED",
+    });
+  }
+}
+
+function inviteUrl(req, token) {
+  const base = String(
+    process.env.PUBLIC_APP_URL || `${req.protocol || "http"}://${req.get("host") || req.headers.host}`,
+  ).replace(/\/$/, "");
+  return `${base}/accept-invite?token=${encodeURIComponent(token)}`;
+}
+
+function invitationView(invitation) {
+  return {
+    id: String(invitation._id),
+    email: invitation.email,
+    name: invitation.name,
+    roleCode: invitation.roleCode,
+    status: invitation.status,
+    expiresAt: invitation.expiresAt,
+    tokenFingerprint: invitation.tokenFingerprint,
+    createdAt: invitation.createdAt,
+    acceptedAt: invitation.acceptedAt,
+    revokedAt: invitation.revokedAt,
+  };
+}
+
+function accessView(access, invitation) {
+  return {
+    id: String(access._id),
+    identityId: access.identityId,
+    email: access.email,
+    name: access.name,
+    roleCode: access.roleCode,
+    status: access.status,
+    origin: access.origin,
+    mustChangePassword: Boolean(access.mustChangePassword),
+    invitedAt: access.invitedAt,
+    activatedAt: access.activatedAt,
+    disabledAt: access.disabledAt,
+    lastAccessAt: access.lastAccessAt,
+    invitation: invitation ? invitationView(invitation) : undefined,
+    createdAt: access.createdAt,
+    updatedAt: access.updatedAt,
+  };
+}
+
+function assertAssignable(actor, roleCode) {
+  const role = roleByCode(roleCode);
+  if (!role) {
+    throw new GenericError("Perfil inválido.", { statusCode: 422, code: "RBAC_ROLE_NOT_FOUND" });
+  }
+  if (!canAssignRole(actor.permissions, role)) {
+    throw new GenericError("Você não pode atribuir um perfil com privilégios superiores aos seus.", {
+      statusCode: 403,
+      code: "RBAC_PRIVILEGE_ESCALATION_DENIED",
+    });
+  }
+  return role;
+}
+
+router.get("/rbac", (_req, res) => {
+  res.json(publicPolicy());
+});
+
+router.get(
+  "/roles",
+  auth,
+  requirePermission("roles.read"),
+  asyncHandler(async (_req, res) => {
+    requiredRbac();
+    res.json({ results: publicPolicy().roles });
+  }),
+);
+
+router.get(
+  "/users",
+  auth,
+  requirePermission("users.read"),
+  asyncHandler(async (_req, res) => {
+    requiredRbac();
+    const { UserAccess, Invitation } = models();
+    const [accesses, pendingInvitations] = await Promise.all([
+      UserAccess.find({ appCode: appCode() }).sort({ name: 1, email: 1 }).lean(),
+      Invitation.find({ appCode: appCode(), status: "pending" }).sort({ createdAt: -1 }).lean(),
+    ]);
+    const invitationByAccess = new Map();
+    for (const invitation of pendingInvitations) {
+      const key = String(invitation.accessId);
+      if (!invitationByAccess.has(key)) invitationByAccess.set(key, invitation);
+    }
+    res.json({
+      results: accesses.map((access) => accessView(access, invitationByAccess.get(String(access._id)))),
+    });
+  }),
+);
+
+router.post(
+  "/users/invitations",
+  auth,
+  requirePermission("users.invite"),
+  asyncHandler(async (req, res) => {
+    requiredRbac();
+    const role = assertAssignable(req.usuario, req.body?.roleCode);
+    const result = await createInvitation({
+      email: req.body?.email,
+      name: req.body?.name,
+      roleCode: role.code,
+      actor: req.usuario,
+    });
+    res.status(201).json({
+      access: accessView(result.access, result.invitation),
+      invitation: invitationView(result.invitation),
+      inviteUrl: inviteUrl(req, result.token),
+    });
+  }),
+);
+
+router.get(
+  "/users/invitations/:id/link",
+  auth,
+  requirePermission("users.invite"),
+  asyncHandler(async (req, res) => {
+    requiredRbac();
+    const result = await recoverPendingInvitation(req.params.id);
+    if (!result?.invitation) {
+      throw new GenericError("Convite não encontrado.", { statusCode: 404 });
+    }
+    if (!result.token) {
+      throw new GenericError("O convite não está mais válido para cópia.", {
+        statusCode: 410,
+        code: "RBAC_INVITATION_INVALID",
+      });
+    }
+    await audit("invitation.link.copied", {
+      actor: req.usuario,
+      target: result.invitation.email,
+      context: { invitationId: String(result.invitation._id) },
+    });
+    res.set("Cache-Control", "no-store");
+    res.json({
+      invitation: invitationView(result.invitation),
+      inviteUrl: inviteUrl(req, result.token),
+    });
+  }),
+);
+
+router.post(
+  "/users/invitations/:id/regenerate",
+  auth,
+  requirePermission("users.invite"),
+  asyncHandler(async (req, res) => {
+    requiredRbac();
+    const { Invitation } = models();
+    const previous = await Invitation.findOne({ _id: req.params.id, appCode: appCode() });
+    if (!previous) throw new GenericError("Convite não encontrado.", { statusCode: 404 });
+    assertAssignable(req.usuario, previous.roleCode);
+    const result = await createInvitation({
+      email: previous.email,
+      name: previous.name,
+      roleCode: previous.roleCode,
+      actor: req.usuario,
+    });
+    await audit("invitation.regenerated", {
+      actor: req.usuario,
+      target: previous.email,
+      context: { previousInvitationId: String(previous._id), invitationId: String(result.invitation._id) },
+    });
+    res.json({
+      invitation: invitationView(result.invitation),
+      inviteUrl: inviteUrl(req, result.token),
+    });
+  }),
+);
+
+router.delete(
+  "/users/invitations/:id",
+  auth,
+  requirePermission("users.invite"),
+  asyncHandler(async (req, res) => {
+    requiredRbac();
+    const { Invitation, UserAccess } = models();
+    const invitation = await Invitation.findOne({ _id: req.params.id, appCode: appCode() });
+    if (!invitation) throw new GenericError("Convite não encontrado.", { statusCode: 404 });
+    if (invitation.status === "pending") {
+      invitation.status = "revoked";
+      invitation.revokedAt = new Date();
+      await invitation.save();
+      await UserAccess.updateOne(
+        { _id: invitation.accessId, appCode: appCode(), status: "invited" },
+        { $set: { status: "revoked", revokedAt: new Date() } },
+      );
+      await audit("invitation.revoked", { actor: req.usuario, target: invitation.email, after: invitation });
+    }
+    res.status(204).end();
+  }),
+);
+
+router.patch(
+  "/users/:id",
+  auth,
+  requirePermission(["users.update", "users.disable"]),
+  asyncHandler(async (req, res) => {
+    requiredRbac();
+    const { UserAccess } = models();
+    const access = await UserAccess.findOne({ _id: req.params.id, appCode: appCode() });
+    if (!access) throw new GenericError("Usuário não encontrado.", { statusCode: 404 });
+    const before = sanitizeSnapshot(access);
+
+    if (req.body?.roleCode && req.body.roleCode !== access.roleCode) {
+      if (!req.usuario.permissions?.includes("users.update") && !req.usuario.permissions?.includes("*")) {
+        throw new GenericError("Sem permissão para alterar o perfil.", { statusCode: 403 });
+      }
+      const role = assertAssignable(req.usuario, req.body.roleCode);
+      await assertNotLastAdmin(access, role.code);
+      access.roleCode = role.code;
+    }
+
+    if (req.body?.status && req.body.status !== access.status) {
+      if (!req.usuario.permissions?.includes("users.disable") && !req.usuario.permissions?.includes("*")) {
+        throw new GenericError("Sem permissão para alterar o status do acesso.", { statusCode: 403 });
+      }
+      if (!["active", "disabled", "revoked"].includes(req.body.status)) {
+        throw new GenericError("Status de acesso inválido.", { statusCode: 422 });
+      }
+      if (["disabled", "revoked"].includes(req.body.status)) await assertNotLastAdmin(access, null);
+      access.status = req.body.status;
+      access.disabledAt = req.body.status === "disabled" ? new Date() : undefined;
+      access.revokedAt = req.body.status === "revoked" ? new Date() : undefined;
+      if (req.body.status === "active") {
+        access.disabledAt = undefined;
+        access.revokedAt = undefined;
+        access.activatedAt = access.activatedAt || new Date();
+      }
+    }
+
+    await access.save();
+    await audit("user.access.updated", { actor: req.usuario, target: access, before, after: access });
+    res.json({ user: accessView(access) });
+  }),
+);
+
+router.get(
+  "/invitations/:token",
+  asyncHandler(async (req, res) => {
+    requiredRbac();
+    const invitation = await findInvitationByToken(req.params.token);
+    if (!invitation || invitation.status !== "pending") {
+      throw new GenericError("Convite inválido, expirado ou já utilizado.", {
+        statusCode: 410,
+        code: "RBAC_INVITATION_INVALID",
+      });
+    }
+    res.set("Cache-Control", "no-store");
+    res.json({
+      invitation: {
+        email: invitation.email,
+        name: invitation.name,
+        roleCode: invitation.roleCode,
+        roleName: roleByCode(invitation.roleCode)?.name,
+        expiresAt: invitation.expiresAt,
+      },
+    });
+  }),
+);
+
+router.post(
+  "/invitations/:token/accept",
+  asyncHandler(async (req, res) => {
+    requiredRbac();
+    const password = String(req.body?.password || "");
+    if (password.length < 8) {
+      throw new GenericError("A nova senha deve possuir pelo menos 8 caracteres.", { statusCode: 422 });
+    }
+
+    const invitation = await findInvitationByToken(req.params.token);
+    if (!invitation || invitation.status !== "pending") {
+      throw new GenericError("Convite inválido, expirado ou já utilizado.", {
+        statusCode: 410,
+        code: "RBAC_INVITATION_INVALID",
+      });
+    }
+
+    const { UserAccess } = models();
+    const access = await UserAccess.findOne({ _id: invitation.accessId, appCode: appCode() });
+    if (!access || access.status !== "invited") {
+      throw new GenericError("O acesso associado ao convite não está mais disponível.", { statusCode: 410 });
+    }
+
+    const identity = await provisionInvitation({ req, invitation, password });
+    const providerUser = identity?.usuario || identity?.user || identity;
+    access.identityId = String(providerUser?.id || providerUser?._id || access.identityId || "") || undefined;
+    access.name = providerUser?.nome || providerUser?.name || access.name;
+    access.status = "active";
+    access.mustChangePassword = false;
+    access.activatedAt = new Date();
+    access.disabledAt = undefined;
+    access.revokedAt = undefined;
+    await access.save();
+
+    invitation.status = "accepted";
+    invitation.acceptedAt = new Date();
+    await invitation.save();
+    await audit("invitation.accepted", {
+      actor: access.identityId || access.email,
+      target: access,
+      after: access,
+      context: { invitationId: String(invitation._id) },
+    });
+
+    res.set("Cache-Control", "no-store");
+    res.json({
+      message: "Convite aceito. A nova senha foi definida e o acesso está ativo.",
+      email: access.email,
+    });
+  }),
+);
+
+module.exports = router;
+module.exports.inviteUrl = inviteUrl;
+module.exports.accessView = accessView;
+module.exports.assertAssignable = assertAssignable;

package/src/api/auth.routes.js

@@ -5,6 +5,8 @@ const ctx = require("../core/context");
 const GenericError = require("../core/errors/GenericError");
 const { asyncHandler, sendResponse } = require("../core/utils/helpers");
 const { ensureInstance } = require("../core/utils/instanceActivation");
+const { findAccessForUser, audit } = require("../core/rbac/storage");
+const { changeFirstAccessPassword } = require("../core/rbac/identityProvider");
 const {
   LOGIN_PATH,
   getBaseUrl,
@@ -13,46 +15,29 @@ const {
 } = require("../core/utils/activationProvider");
 
 const DEV_ACTIVATION_PATH = "/integracao/dev-local/ativar-central";
-
-/**
- * Rotas de autenticação do Core. Em aplicações member, o login é delegado para
- * a Central de Ativações com o código do app carregado do ambiente do backend.
- */
 const router = express.Router();
 
 function readBasicAuthorization(req) {
   const authorization = String(req.headers.authorization || "");
   if (!authorization.startsWith("Basic ")) {
-    throw new GenericError("Credenciais de autenticação ausentes.", {
-      statusCode: 401,
-    });
+    throw new GenericError("Credenciais de autenticação ausentes.", { statusCode: 401 });
   }
   return authorization;
 }
 
 function readOptionalAppCode() {
   return String(
-    process.env.APP_CODE ||
-      process.env.APP_CODIGO ||
-      process.env.OON_APP_CODE ||
-      process.env.OON_APP_CODIGO ||
-      "",
-  )
-    .trim()
-    .toLowerCase();
+    process.env.APP_CODE || process.env.APP_CODIGO || process.env.OON_APP_CODE || process.env.OON_APP_CODIGO || "",
+  ).trim().toLowerCase();
 }
 
 function translateProviderError(error) {
   if (error instanceof GenericError) return error;
-
   const timedOut = error.code === "ECONNABORTED";
   const statusCode = timedOut ? 504 : error.response?.status || 502;
-  const message =
-    error.response?.data?.message ||
-    (timedOut
-      ? "A Central de Ativações não respondeu dentro do prazo."
-      : "Não foi possível autenticar o usuário na Central de Ativações.");
-
+  const message = error.response?.data?.message || (timedOut
+    ? "A Central de Ativações não respondeu dentro do prazo."
+    : "Não foi possível autenticar o usuário na Central de Ativações.");
   return new GenericError(message, { statusCode });
 }
 
@@ -62,7 +47,6 @@ async function authenticateRoot(req, res, authorization, instance) {
     const result = await authenticate({ authorization, req });
     const statusCode = result?.statusCode || 200;
     const data = result?.data || result;
-
     res.set("Cache-Control", "no-store");
     res.status(statusCode).json(data);
     return true;
@@ -74,13 +58,10 @@ router.post(
   "/autenticar",
   asyncHandler(async (req, res) => {
     const authorization = readBasicAuthorization(req);
-
     const instance = await ensureInstance();
     if (await authenticateRoot(req, res, authorization, instance)) return;
-
     const baseUrl = getBaseUrl(req);
     const appCode = getAppCode();
-
     try {
       const response = await axios.post(
         `${baseUrl}${LOGIN_PATH}`,
@@ -95,7 +76,6 @@ router.post(
           },
         },
       );
-
       res.set("Cache-Control", "no-store");
       res.status(response.status).json(response.data);
     } catch (error) {
@@ -110,7 +90,6 @@ router.post(
     const authorization = readBasicAuthorization(req);
     const baseUrl = getBaseUrl(req);
     const appCode = readOptionalAppCode();
-
     try {
       const response = await axios.post(
         `${baseUrl}${DEV_ACTIVATION_PATH}`,
@@ -129,13 +108,9 @@ router.post(
         {
           timeout: getTimeout(),
           maxRedirects: 0,
-          headers: {
-            Authorization: authorization,
-            "Content-Type": "application/json",
-          },
+          headers: { Authorization: authorization, "Content-Type": "application/json" },
         },
       );
-
       res.set("Cache-Control", "no-store");
       res.status(response.status).json(response.data);
     } catch (error) {
@@ -148,8 +123,38 @@ router.get(
   "/validar-token",
   auth,
   asyncHandler(async (req, res) => {
+    res.set("Cache-Control", "no-store");
     sendResponse({ res, statusCode: 200, usuario: req.usuario });
   }),
 );
 
+router.post(
+  "/first-access/password",
+  auth,
+  asyncHandler(async (req, res) => {
+    if (!req.usuario.mustChangePassword) {
+      throw new GenericError("O primeiro acesso já foi concluído.", {
+        statusCode: 409,
+        code: "FIRST_ACCESS_ALREADY_COMPLETED",
+      });
+    }
+    const password = String(req.body?.password || "");
+    if (password.length < 8) {
+      throw new GenericError("A nova senha deve possuir pelo menos 8 caracteres.", { statusCode: 422 });
+    }
+
+    await changeFirstAccessPassword({ req, user: req.usuario, password });
+    const access = await findAccessForUser(req.usuario);
+    if (access) {
+      access.mustChangePassword = false;
+      access.status = "active";
+      access.activatedAt = access.activatedAt || new Date();
+      await access.save();
+    }
+    await audit("user.first_access.completed", { actor: req.usuario, target: access || req.usuario });
+    res.set("Cache-Control", "no-store");
+    res.json({ message: "Nova senha definida. Primeiro acesso concluído." });
+  }),
+);
+
 module.exports = router;

package/src/boot/createApp.js

@@ -12,6 +12,7 @@ const { buildModelRouter } = require("../core/factories/modelRouter");
 const { buildIntegrationRouter, integrationsEnabled } = require("../modules/integrations");
 
 const coreRoutes = require("../api/core.routes");
+const accessRoutes = require("../api/access.routes");
 const statusRoutes = require("../api/status.routes");
 const authRoutes = require("../api/auth.routes");
 const activationRoutes = require("../api/activation.routes");
@@ -31,10 +32,9 @@ function createApp() {
   app.use("/ativacao", activationRoutes);
   app.use(activationGuard);
   app.use("/auth", authRoutes);
+  app.use("/core", accessRoutes);
   app.use("/core", coreRoutes);
 
-  // A engine é montada antes do log genérico: webhooks podem carregar tokens
-  // e payloads sensíveis. A própria engine persiste diagnóstico sanitizado.
   if (integrationsEnabled(ctx.config)) {
     const integrationRouter = buildIntegrationRouter();
     app.use("/integrations", integrationRouter);

package/src/core/define.js

@@ -5,6 +5,7 @@ const ctx = require("./context");
 const { asyncHandler } = require("./utils/helpers");
 const auth = require("./middlewares/auth");
 const { rbac } = require("./middlewares/rbac");
+const { requirePermission } = require("./middlewares/permissions");
 const { mutationAudit } = require("./middlewares/mutationAudit");
 
 function buildSchema(schemaDef, options = {}) {
@@ -123,7 +124,10 @@ function defineRoutes(basePath, builder) {
       handler = opts;
       opts = {};
     }
-    const chain = [auth, rbac(opts.roles || [])];
+    const chain = [auth];
+    const required = opts.permission || opts.permissions;
+    if (required) chain.push(requirePermission(required));
+    else chain.push(rbac(opts.roles || []));
     if (["post", "put", "patch", "delete"].includes(method) && opts.audit) {
       chain.push(mutationAudit(opts.audit));
     }

package/src/core/factories/modelRouter.js

@@ -2,16 +2,14 @@ const express = require("express");
 const { asyncHandler } = require("../utils/helpers");
 const auth = require("../middlewares/auth");
 const { rbac } = require("../middlewares/rbac");
+const { requirePermission } = require("../middlewares/permissions");
 const { mutationAudit } = require("../middlewares/mutationAudit");
 const { createCrudService } = require("./crudService");
 const { createCrudController } = require("./crudController");
 
 /**
- * Monta o router de CRUD de uma model. Todas as rotas são privadas
- * (auth obrigatório). Mutações passam por RBAC + mutationAudit.
- *
- * Endpoints (Seção 2.9): GET list, GET :id, POST, PUT :id, PATCH :id,
- * DELETE :id, POST /import, GET /export.
+ * Monta o router de CRUD de uma model. `crud.permissions` é o contrato
+ * canônico; `crud.roles` permanece como fallback para Centrais legadas.
  */
 function buildModelRouter(entry) {
   const router = express.Router();
@@ -20,43 +18,48 @@ function buildModelRouter(entry) {
 
   const crud = entry.definition.crud || {};
   const roles = crud.roles || {};
-  const readRoles = roles.read || [];
-  const writeRoles = roles.write || [];
+  const permissions = crud.permissions || {};
+  const readGuard = permissions.read
+    ? requirePermission(permissions.read)
+    : rbac(roles.read || []);
+  const writeGuard = permissions.write
+    ? requirePermission(permissions.write)
+    : rbac(roles.write || []);
   const entidade = entry.name;
 
   router.use(auth);
 
-  router.get("/", rbac(readRoles), asyncHandler(controller.list));
-  router.get("/export", rbac(readRoles), asyncHandler(controller.exportAll));
-  router.get("/:id", rbac(readRoles), asyncHandler(controller.getById));
+  router.get("/", readGuard, asyncHandler(controller.list));
+  router.get("/export", readGuard, asyncHandler(controller.exportAll));
+  router.get("/:id", readGuard, asyncHandler(controller.getById));
 
   router.post(
     "/import",
-    rbac(writeRoles),
+    writeGuard,
     mutationAudit({ entidade, acao: "adicionado" }),
     asyncHandler(controller.importMany)
   );
   router.post(
     "/",
-    rbac(writeRoles),
+    writeGuard,
     mutationAudit({ entidade, acao: "adicionado" }),
     asyncHandler(controller.create)
   );
   router.put(
     "/:id",
-    rbac(writeRoles),
+    writeGuard,
     mutationAudit({ entidade, acao: "alterado" }),
     asyncHandler(controller.update)
   );
   router.patch(
     "/:id",
-    rbac(writeRoles),
+    writeGuard,
     mutationAudit({ entidade, acao: "alterado" }),
     asyncHandler(controller.patch)
   );
   router.delete(
     "/:id",
-    rbac(writeRoles),
+    writeGuard,
     mutationAudit({ entidade, acao: "excluido" }),
     asyncHandler(controller.remove)
   );