@oondemand/oon-core-back 0.3.73 → 0.3.75

package/src/core/rbac/storage.js

@@ -0,0 +1,387 @@
+"use strict";
+
+const crypto = require("node:crypto");
+const mongoose = require("mongoose");
+const ctx = require("../context");
+const GenericError = require("../errors/GenericError");
+const { encrypt, decrypt } = require("../utils/instanceActivation");
+const {
+  policy,
+  roleByCode,
+  rolePermissions,
+  legacyPermissions,
+  matchingRoleForLegacyUser,
+} = require("./policy");
+
+const ACCESS_STATUSES = ["invited", "active", "disabled", "revoked"];
+const INVITATION_STATUSES = ["pending", "accepted", "revoked", "expired"];
+
+function models() {
+  const accessSchema = new mongoose.Schema({
+    appCode: { type: String, required: true, index: true },
+    identityId: { type: String, index: true },
+    email: { type: String, required: true, lowercase: true, trim: true },
+    name: String,
+    roleCode: { type: String, required: true },
+    status: { type: String, enum: ACCESS_STATUSES, default: "invited", index: true },
+    origin: { type: String, default: "rbac" },
+    grantedBy: String,
+    mustChangePassword: { type: Boolean, default: false },
+    invitedAt: Date,
+    activatedAt: Date,
+    disabledAt: Date,
+    revokedAt: Date,
+    lastAccessAt: Date,
+  }, { timestamps: true, collection: "oon_core_user_access" });
+  accessSchema.index({ appCode: 1, email: 1 }, { unique: true });
+  accessSchema.index(
+    { appCode: 1, identityId: 1 },
+    { unique: true, partialFilterExpression: { identityId: { $type: "string" } } },
+  );
+
+  const invitationSchema = new mongoose.Schema({
+    appCode: { type: String, required: true, index: true },
+    accessId: { type: mongoose.Schema.Types.ObjectId, ref: "OonCoreUserAccess", required: true },
+    email: { type: String, required: true, lowercase: true, trim: true },
+    name: String,
+    roleCode: { type: String, required: true },
+    tokenHash: { type: String, required: true, unique: true, select: false },
+    tokenFingerprint: { type: String, required: true },
+    tokenEncrypted: { type: String, select: false },
+    tokenIv: { type: String, select: false },
+    tokenAuthTag: { type: String, select: false },
+    status: { type: String, enum: INVITATION_STATUSES, default: "pending", index: true },
+    expiresAt: { type: Date, required: true, index: true },
+    createdBy: String,
+    acceptedAt: Date,
+    revokedAt: Date,
+  }, { timestamps: true, collection: "oon_core_invitations" });
+  invitationSchema.index({ appCode: 1, email: 1, status: 1 });
+
+  const auditSchema = new mongoose.Schema({
+    appCode: { type: String, required: true, index: true },
+    event: { type: String, required: true, index: true },
+    actor: String,
+    target: String,
+    before: mongoose.Schema.Types.Mixed,
+    after: mongoose.Schema.Types.Mixed,
+    context: mongoose.Schema.Types.Mixed,
+    at: { type: Date, default: Date.now, index: true },
+  }, { timestamps: false, collection: "oon_core_access_audit" });
+
+  return {
+    UserAccess: mongoose.models.OonCoreUserAccess || mongoose.model("OonCoreUserAccess", accessSchema),
+    Invitation: mongoose.models.OonCoreInvitation || mongoose.model("OonCoreInvitation", invitationSchema),
+    Audit: mongoose.models.OonCoreAccessAudit || mongoose.model("OonCoreAccessAudit", auditSchema),
+  };
+}
+
+function appCode() {
+  return String(ctx.config.appCode || ctx.config.slug || "central").trim().toLowerCase();
+}
+
+function normalizeEmail(value) {
+  return String(value || "").trim().toLowerCase();
+}
+
+function identityKey(user) {
+  return String(user?.id || user?._id || user?.usuarioId || "").trim();
+}
+
+function actorKey(user) {
+  return identityKey(user) || normalizeEmail(user?.email) || "system";
+}
+
+function sanitizeSnapshot(value) {
+  if (!value) return value;
+  const plain = typeof value.toObject === "function" ? value.toObject() : { ...value };
+  delete plain.tokenHash;
+  delete plain.tokenEncrypted;
+  delete plain.tokenIv;
+  delete plain.tokenAuthTag;
+  delete plain.senha;
+  delete plain.password;
+  return plain;
+}
+
+async function audit(event, { actor, target, before, after, context } = {}) {
+  if (mongoose.connection.readyState !== 1) return null;
+  const { Audit } = models();
+  return Audit.create({
+    appCode: appCode(),
+    event,
+    actor: typeof actor === "string" ? actor : actorKey(actor),
+    target: typeof target === "string" ? target : target && (identityKey(target) || normalizeEmail(target.email)),
+    before: sanitizeSnapshot(before),
+    after: sanitizeSnapshot(after),
+    context,
+    at: new Date(),
+  });
+}
+
+function accessError(message, code = "RBAC_ACCESS_DENIED", statusCode = 403) {
+  return new GenericError(message, { statusCode, code });
+}
+
+async function findAccessForUser(user) {
+  if (mongoose.connection.readyState !== 1) return null;
+  const { UserAccess } = models();
+  const conditions = [];
+  const id = identityKey(user);
+  const email = normalizeEmail(user?.email);
+  if (id) conditions.push({ identityId: id });
+  if (email) conditions.push({ email });
+  if (!conditions.length) return null;
+  return UserAccess.findOne({ appCode: appCode(), $or: conditions });
+}
+
+async function migrateLegacyAccess(user) {
+  const currentPolicy = policy();
+  if (!currentPolicy.enabled || mongoose.connection.readyState !== 1) return null;
+  const role = matchingRoleForLegacyUser(user);
+  if (!role) return null;
+
+  const { UserAccess } = models();
+  const email = normalizeEmail(user?.email);
+  if (!email) return null;
+  const identityId = identityKey(user) || undefined;
+  const existing = await UserAccess.findOne({ appCode: appCode(), email });
+  if (existing) return existing;
+
+  const created = await UserAccess.create({
+    appCode: appCode(),
+    identityId,
+    email,
+    name: user?.nome || user?.name,
+    roleCode: role.code,
+    status: "active",
+    origin: "legacy-migration",
+    grantedBy: "system:migration",
+    mustChangePassword: false,
+    activatedAt: new Date(),
+    lastAccessAt: new Date(),
+  });
+  await audit("user.migrated", { actor: "system:migration", target: created, after: created });
+  return created;
+}
+
+async function resolveUserAccess(user, { touch = true } = {}) {
+  const currentPolicy = policy();
+  if (!currentPolicy.enabled) {
+    return {
+      mode: "legacy",
+      status: "active",
+      roleCode: user?.perfil || user?.tipo || "user",
+      permissions: legacyPermissions(user),
+      mustChangePassword: Boolean(user?.mustChangePassword || user?.firstAccessPending),
+    };
+  }
+
+  let access = await findAccessForUser(user);
+  if (!access) access = await migrateLegacyAccess(user);
+  if (!access) {
+    throw accessError("Usuário autenticado sem perfil local nesta Central.", "RBAC_LOCAL_ACCESS_REQUIRED");
+  }
+  if (["disabled", "revoked"].includes(access.status)) {
+    throw accessError("Acesso do usuário está desabilitado nesta Central.", "RBAC_USER_DISABLED");
+  }
+  if (access.status === "invited") {
+    throw accessError("Convite ainda não foi concluído.", "RBAC_INVITATION_PENDING");
+  }
+
+  const role = roleByCode(access.roleCode);
+  if (!role) {
+    throw accessError("O perfil associado ao usuário não existe mais na política da Central.", "RBAC_ROLE_NOT_FOUND");
+  }
+
+  const id = identityKey(user);
+  let changed = false;
+  if (id && access.identityId !== id) {
+    access.identityId = id;
+    changed = true;
+  }
+  if (user?.nome && access.name !== user.nome) {
+    access.name = user.nome;
+    changed = true;
+  }
+  if (touch && (!access.lastAccessAt || Date.now() - access.lastAccessAt.getTime() > 5 * 60 * 1000)) {
+    access.lastAccessAt = new Date();
+    changed = true;
+  }
+  if (changed) await access.save();
+
+  return {
+    mode: "rbac",
+    access,
+    status: access.status,
+    roleCode: access.roleCode,
+    role,
+    permissions: rolePermissions(role),
+    mustChangePassword: Boolean(access.mustChangePassword),
+  };
+}
+
+function hashToken(token) {
+  return crypto.createHash("sha256").update(String(token)).digest("hex");
+}
+
+function tokenFingerprint(token) {
+  return hashToken(token).slice(0, 12);
+}
+
+function protectInvitationToken(token) {
+  const protectedToken = encrypt(String(token));
+  return {
+    tokenEncrypted: protectedToken.credentialEncrypted,
+    tokenIv: protectedToken.credentialIv,
+    tokenAuthTag: protectedToken.credentialAuthTag,
+  };
+}
+
+function recoverInvitationToken(invitation) {
+  if (!invitation?.tokenEncrypted || !invitation?.tokenIv || !invitation?.tokenAuthTag) {
+    return null;
+  }
+  return decrypt({
+    credentialEncrypted: invitation.tokenEncrypted,
+    credentialIv: invitation.tokenIv,
+    credentialAuthTag: invitation.tokenAuthTag,
+  });
+}
+
+function invitationExpiry() {
+  return new Date(Date.now() + policy().invitationTtlHours * 60 * 60 * 1000);
+}
+
+async function revokePendingInvitations(email, actor) {
+  const { Invitation } = models();
+  const pending = await Invitation.find({ appCode: appCode(), email: normalizeEmail(email), status: "pending" });
+  for (const invitation of pending) {
+    invitation.status = "revoked";
+    invitation.revokedAt = new Date();
+    await invitation.save();
+    await audit("invitation.revoked", { actor, target: invitation.email, before: invitation });
+  }
+}
+
+async function createInvitation({ email, name, roleCode, actor }) {
+  if (mongoose.connection.readyState !== 1) {
+    throw new GenericError("Banco de dados indisponível para criar convites.", { statusCode: 503 });
+  }
+  const role = roleByCode(roleCode);
+  if (!role) throw new GenericError("Perfil inválido.", { statusCode: 422, code: "RBAC_ROLE_NOT_FOUND" });
+  const normalizedEmail = normalizeEmail(email);
+  if (!/^\S+@\S+\.\S+$/.test(normalizedEmail)) {
+    throw new GenericError("Informe um e-mail válido.", { statusCode: 422 });
+  }
+
+  const { UserAccess, Invitation } = models();
+  await revokePendingInvitations(normalizedEmail, actor);
+  let access = await UserAccess.findOne({ appCode: appCode(), email: normalizedEmail });
+  const before = sanitizeSnapshot(access);
+  if (!access) {
+    access = new UserAccess({ appCode: appCode(), email: normalizedEmail });
+  }
+  access.name = name || access.name;
+  access.roleCode = role.code;
+  access.status = "invited";
+  access.origin = "invitation";
+  access.grantedBy = actorKey(actor);
+  access.mustChangePassword = true;
+  access.invitedAt = new Date();
+  access.disabledAt = undefined;
+  access.revokedAt = undefined;
+  await access.save();
+
+  const token = crypto.randomBytes(32).toString("base64url");
+  const invitation = await Invitation.create({
+    appCode: appCode(),
+    accessId: access._id,
+    email: normalizedEmail,
+    name: access.name,
+    roleCode: role.code,
+    tokenHash: hashToken(token),
+    tokenFingerprint: tokenFingerprint(token),
+    ...protectInvitationToken(token),
+    expiresAt: invitationExpiry(),
+    status: "pending",
+    createdBy: actorKey(actor),
+  });
+  await audit("invitation.created", { actor, target: normalizedEmail, before, after: access, context: { invitationId: String(invitation._id) } });
+  return { access, invitation, token };
+}
+
+async function findInvitationByToken(token) {
+  if (mongoose.connection.readyState !== 1) return null;
+  const { Invitation } = models();
+  const invitation = await Invitation.findOne({ appCode: appCode(), tokenHash: hashToken(token) }).select("+tokenHash");
+  if (!invitation) return null;
+  if (invitation.status === "pending" && invitation.expiresAt.getTime() <= Date.now()) {
+    invitation.status = "expired";
+    await invitation.save();
+    await audit("invitation.expired", { actor: "system", target: invitation.email, context: { invitationId: String(invitation._id) } });
+  }
+  return invitation;
+}
+
+async function recoverPendingInvitation(id) {
+  if (mongoose.connection.readyState !== 1) return null;
+  const { Invitation } = models();
+  const invitation = await Invitation.findOne({ _id: id, appCode: appCode() })
+    .select("+tokenEncrypted +tokenIv +tokenAuthTag");
+  if (!invitation) return null;
+  if (invitation.status === "pending" && invitation.expiresAt.getTime() <= Date.now()) {
+    invitation.status = "expired";
+    await invitation.save();
+    return { invitation, token: null };
+  }
+  if (invitation.status !== "pending") return { invitation, token: null };
+  return { invitation, token: recoverInvitationToken(invitation) };
+}
+
+async function activeAdminCount() {
+  const adminCodes = policy().roles
+    .filter((role) => role.admin === true || role.permissions?.includes("*"))
+    .map((role) => role.code);
+  if (!adminCodes.length || mongoose.connection.readyState !== 1) return 0;
+  const { UserAccess } = models();
+  return UserAccess.countDocuments({ appCode: appCode(), status: "active", roleCode: { $in: adminCodes } });
+}
+
+async function assertNotLastAdmin(access, nextRoleCode) {
+  const currentRole = roleByCode(access.roleCode);
+  const nextRole = nextRoleCode ? roleByCode(nextRoleCode) : null;
+  const currentAdmin = Boolean(currentRole?.admin || currentRole?.permissions?.includes("*"));
+  const nextAdmin = Boolean(nextRole?.admin || nextRole?.permissions?.includes("*"));
+  if (currentAdmin && !nextAdmin && (await activeAdminCount()) <= 1) {
+    throw new GenericError("Não é possível remover ou desabilitar o último administrador da Central.", {
+      statusCode: 409,
+      code: "RBAC_LAST_ADMIN_PROTECTED",
+    });
+  }
+}
+
+module.exports = {
+  ACCESS_STATUSES,
+  INVITATION_STATUSES,
+  models,
+  appCode,
+  normalizeEmail,
+  identityKey,
+  actorKey,
+  sanitizeSnapshot,
+  audit,
+  findAccessForUser,
+  migrateLegacyAccess,
+  resolveUserAccess,
+  hashToken,
+  tokenFingerprint,
+  protectInvitationToken,
+  recoverInvitationToken,
+  createInvitation,
+  revokePendingInvitations,
+  findInvitationByToken,
+  recoverPendingInvitation,
+  activeAdminCount,
+  assertNotLastAdmin,
+};

package/src/index.js

@@ -7,6 +7,8 @@ const define = require("./core/define");
 const fields = require("./core/fields");
 const registry = require("./core/registry");
 const GenericError = require("./core/errors/GenericError");
+const { requirePermission } = require("./core/middlewares/permissions");
+const rbacPolicy = require("./core/rbac/policy");
 const omieModule = require("./modules/omie");
 const integrations = require("./modules/integrations");
 const appManifest = require("./manifest/appManifest");
@@ -30,6 +32,12 @@ module.exports = {
   defineValidation: define.defineValidation,
   defineTrigger: define.defineTrigger,
 
+  requirePermission,
+  CORE_PERMISSIONS: rbacPolicy.CORE_PERMISSIONS,
+  rbacPolicy: rbacPolicy.policy,
+  roleByCode: rbacPolicy.roleByCode,
+  permissionGranted: rbacPolicy.granted,
+
   APP_MANIFEST_FILENAME: appManifest.APP_MANIFEST_FILENAME,
   APP_MANIFEST_SCHEMA_VERSION: appManifest.APP_MANIFEST_SCHEMA_VERSION,
   SUPPORTED_APP_KINDS: appManifest.SUPPORTED_APP_KINDS,

package/src/manifest/appManifest.js

@@ -4,22 +4,13 @@ const fs = require("node:fs");
 const path = require("node:path");
 const ctx = require("../core/context");
 const corePackage = require("../../package.json");
+const { validateRbac } = require("./rbacManifest");
 
 const APP_MANIFEST_FILENAME = "central.app.json";
 const APP_MANIFEST_SCHEMA_VERSION = 1;
-const SUPPORTED_APP_KINDS = Object.freeze([
-  "root-central",
-  "member-central",
-  "portal-cockpit",
-]);
+const SUPPORTED_APP_KINDS = Object.freeze(["root-central", "member-central", "portal-cockpit"]);
 const SUPPORTED_MODULES = Object.freeze([
-  "collections",
-  "documents",
-  "pipelines",
-  "integrations",
-  "omie",
-  "assistants",
-  "currencies",
+  "collections", "documents", "pipelines", "integrations", "omie", "assistants", "currencies",
 ]);
 const APP_KIND_ROLE = Object.freeze({
   "root-central": "root",
@@ -41,22 +32,17 @@ class AppManifestError extends Error {
 function isPlainObject(value) {
   return Boolean(value) && typeof value === "object" && !Array.isArray(value);
 }
-
 function hasOwn(object, key) {
   return Object.prototype.hasOwnProperty.call(object, key);
 }
-
 function addIssue(issues, fieldPath, message) {
   issues.push({ path: fieldPath, message });
 }
-
 function parseVersion(value) {
   if (typeof value !== "string") return null;
   const match = value.trim().match(/^(\d+)\.(\d+)\.(\d+)(?:[-+][0-9A-Za-z.-]+)?$/);
-  if (!match) return null;
-  return match.slice(1, 4).map(Number);
+  return match ? match.slice(1, 4).map(Number) : null;
 }
-
 function compareVersions(left, right) {
   for (let index = 0; index < 3; index += 1) {
     if (left[index] !== right[index]) return left[index] < right[index] ? -1 : 1;
@@ -73,50 +59,28 @@ function validateCompatibility(compatibility, issues, coreVersion) {
     addIssue(issues, "compatibility.core", "deve ser um objeto.");
     return;
   }
-
   const allowedKeys = new Set(["minVersion", "maxVersionExclusive"]);
   for (const key of Object.keys(compatibility.core)) {
     if (!allowedKeys.has(key)) addIssue(issues, `compatibility.core.${key}`, "propriedade não suportada.");
   }
-
   const minVersion = parseVersion(compatibility.core.minVersion);
   const maxVersion = hasOwn(compatibility.core, "maxVersionExclusive")
     ? parseVersion(compatibility.core.maxVersionExclusive)
     : null;
-
-  if (!minVersion) {
-    addIssue(issues, "compatibility.core.minVersion", "deve usar versão semântica, por exemplo 0.3.45.");
-  }
+  if (!minVersion) addIssue(issues, "compatibility.core.minVersion", "deve usar versão semântica, por exemplo 0.3.45.");
   if (hasOwn(compatibility.core, "maxVersionExclusive") && !maxVersion) {
-    addIssue(
-      issues,
-      "compatibility.core.maxVersionExclusive",
-      "deve usar versão semântica, por exemplo 0.4.0.",
-    );
+    addIssue(issues, "compatibility.core.maxVersionExclusive", "deve usar versão semântica, por exemplo 0.4.0.");
   }
   if (minVersion && maxVersion && compareVersions(minVersion, maxVersion) >= 0) {
-    addIssue(
-      issues,
-      "compatibility.core",
-      "minVersion deve ser menor que maxVersionExclusive.",
-    );
+    addIssue(issues, "compatibility.core", "minVersion deve ser menor que maxVersionExclusive.");
   }
-
   const installedVersion = parseVersion(coreVersion);
   if (!installedVersion || !minVersion) return;
   if (compareVersions(installedVersion, minVersion) < 0) {
-    addIssue(
-      issues,
-      "compatibility.core.minVersion",
-      `requer OonCore ${compatibility.core.minVersion} ou superior; instalado ${coreVersion}.`,
-    );
+    addIssue(issues, "compatibility.core.minVersion", `requer OonCore ${compatibility.core.minVersion} ou superior; instalado ${coreVersion}.`);
   }
   if (maxVersion && compareVersions(installedVersion, maxVersion) >= 0) {
-    addIssue(
-      issues,
-      "compatibility.core.maxVersionExclusive",
-      `requer OonCore anterior a ${compatibility.core.maxVersionExclusive}; instalado ${coreVersion}.`,
-    );
+    addIssue(issues, "compatibility.core.maxVersionExclusive", `requer OonCore anterior a ${compatibility.core.maxVersionExclusive}; instalado ${coreVersion}.`);
   }
 }
 
@@ -133,10 +97,7 @@ function validateActivation(activation, issues) {
   if (hasOwn(activation, "enabled") && typeof activation.enabled !== "boolean") {
     addIssue(issues, "activation.enabled", "deve ser booleano.");
   }
-  if (
-    hasOwn(activation, "configurationVersion")
-    && (!Number.isInteger(activation.configurationVersion) || activation.configurationVersion < 1)
-  ) {
+  if (hasOwn(activation, "configurationVersion") && (!Number.isInteger(activation.configurationVersion) || activation.configurationVersion < 1)) {
     addIssue(issues, "activation.configurationVersion", "deve ser inteiro maior ou igual a 1.");
   }
   if (hasOwn(activation, "fields") && !Array.isArray(activation.fields)) {
@@ -147,84 +108,50 @@ function validateActivation(activation, issues) {
 function validateAppManifest(input, { coreVersion = corePackage.version } = {}) {
   const issues = [];
   if (!isPlainObject(input)) {
-    throw new AppManifestError("central.app.json inválido.", [
-      { path: "$", message: "deve conter um objeto JSON." },
-    ]);
+    throw new AppManifestError("central.app.json inválido.", [{ path: "$", message: "deve conter um objeto JSON." }]);
   }
-
   const allowedTopLevel = new Set([
-    "$schema",
-    "schemaVersion",
-    "id",
-    "name",
-    "slug",
-    "appKind",
-    "modules",
-    "capabilities",
-    "compatibility",
-    "activation",
+    "$schema", "schemaVersion", "id", "name", "slug", "appKind", "modules", "capabilities",
+    "compatibility", "activation", "rbac",
   ]);
   for (const key of Object.keys(input)) {
     if (!allowedTopLevel.has(key)) addIssue(issues, key, "propriedade não suportada.");
   }
-
   if (input.schemaVersion !== APP_MANIFEST_SCHEMA_VERSION) {
-    addIssue(
-      issues,
-      "schemaVersion",
-      `versão não suportada. Use ${APP_MANIFEST_SCHEMA_VERSION}.`,
-    );
+    addIssue(issues, "schemaVersion", `versão não suportada. Use ${APP_MANIFEST_SCHEMA_VERSION}.`);
   }
   if (typeof input.id !== "string" || !/^[a-z0-9][a-z0-9._-]*$/.test(input.id)) {
     addIssue(issues, "id", "deve usar letras minúsculas, números, ponto, hífen ou sublinhado.");
   }
-  if (typeof input.name !== "string" || !input.name.trim()) {
-    addIssue(issues, "name", "é obrigatório e deve ser texto não vazio.");
-  }
+  if (typeof input.name !== "string" || !input.name.trim()) addIssue(issues, "name", "é obrigatório e deve ser texto não vazio.");
   if (typeof input.slug !== "string" || !/^[a-z0-9]+(?:-[a-z0-9]+)*$/.test(input.slug)) {
     addIssue(issues, "slug", "deve usar slug em letras minúsculas separado por hífen.");
   }
   if (!SUPPORTED_APP_KINDS.includes(input.appKind)) {
     addIssue(issues, "appKind", `deve ser um de: ${SUPPORTED_APP_KINDS.join(", ")}.`);
   }
-
   if (!isPlainObject(input.modules)) {
     addIssue(issues, "modules", "deve ser um objeto.");
   } else {
     for (const key of Object.keys(input.modules)) {
-      if (!SUPPORTED_MODULES.includes(key)) {
-        addIssue(issues, `modules.${key}`, `módulo não suportado. Use: ${SUPPORTED_MODULES.join(", ")}.`);
-      } else if (typeof input.modules[key] !== "boolean") {
-        addIssue(issues, `modules.${key}`, "deve ser booleano.");
-      }
+      if (!SUPPORTED_MODULES.includes(key)) addIssue(issues, `modules.${key}`, `módulo não suportado. Use: ${SUPPORTED_MODULES.join(", ")}.`);
+      else if (typeof input.modules[key] !== "boolean") addIssue(issues, `modules.${key}`, "deve ser booleano.");
     }
   }
-
   if (!Array.isArray(input.capabilities)) {
     addIssue(issues, "capabilities", "deve ser uma lista.");
   } else {
     const seen = new Set();
     input.capabilities.forEach((capability, index) => {
-      if (
-        typeof capability !== "string"
-        || !/^[a-z][a-z0-9]*(?:[._:-][a-z0-9][a-z0-9-]*)+$/.test(capability)
-      ) {
-        addIssue(
-          issues,
-          `capabilities[${index}]`,
-          "deve ser um identificador namespaced, por exemplo core.collections.",
-        );
-      } else if (seen.has(capability)) {
-        addIssue(issues, `capabilities[${index}]`, `capability duplicada: ${capability}.`);
-      } else {
-        seen.add(capability);
-      }
+      if (typeof capability !== "string" || !/^[a-z][a-z0-9]*(?:[._:-][a-z0-9][a-z0-9-]*)+$/.test(capability)) {
+        addIssue(issues, `capabilities[${index}]`, "deve ser um identificador namespaced, por exemplo core.collections.");
+      } else if (seen.has(capability)) addIssue(issues, `capabilities[${index}]`, `capability duplicada: ${capability}.`);
+      else seen.add(capability);
     });
   }
-
   validateCompatibility(input.compatibility, issues, coreVersion);
   validateActivation(input.activation, issues);
-
+  validateRbac(input.rbac, issues);
   if (issues.length) throw new AppManifestError("central.app.json inválido.", issues);
   return JSON.parse(JSON.stringify(input));
 }
@@ -233,9 +160,7 @@ function resolveAppManifestPath(cwd = process.cwd()) {
   const absolute = path.resolve(cwd);
   const candidates = [path.join(absolute, APP_MANIFEST_FILENAME)];
   const parent = path.dirname(absolute);
-  if (["backend", "frontend"].includes(path.basename(absolute))) {
-    candidates.push(path.join(parent, APP_MANIFEST_FILENAME));
-  }
+  if (["backend", "frontend"].includes(path.basename(absolute))) candidates.push(path.join(parent, APP_MANIFEST_FILENAME));
   return candidates.find((candidate) => fs.existsSync(candidate)) || candidates[0];
 }
 
@@ -254,6 +179,7 @@ function appManifestToConfig(manifest, manifestPath) {
     },
     modules: { ...manifest.modules },
     capabilities: [...manifest.capabilities],
+    rbac: manifest.rbac ? JSON.parse(JSON.stringify(manifest.rbac)) : undefined,
     appManifest: manifest,
     appManifestPath: manifestPath,
   };
@@ -266,17 +192,13 @@ function registerAppManifest(input, options = {}) {
 }
 
 function loadAppManifest(cwdOrFile = process.cwd(), options = {}) {
-  const manifestPath = cwdOrFile.endsWith?.(".json")
-    ? path.resolve(cwdOrFile)
-    : resolveAppManifestPath(cwdOrFile);
+  const manifestPath = cwdOrFile.endsWith?.(".json") ? path.resolve(cwdOrFile) : resolveAppManifestPath(cwdOrFile);
   let input;
   try {
     input = JSON.parse(fs.readFileSync(manifestPath, "utf8"));
   } catch (error) {
     if (error.code === "ENOENT") throw error;
-    throw new AppManifestError("Não foi possível ler central.app.json.", [
-      { path: "$", message: error.message },
-    ], { cause: error });
+    throw new AppManifestError("Não foi possível ler central.app.json.", [{ path: "$", message: error.message }], { cause: error });
   }
   return registerAppManifest(input, { ...options, manifestPath });
 }