@oondemand/oon-core-back 0.3.74 → 0.3.76

package/src/core/middlewares/auth.js

@@ -7,10 +7,17 @@ const {
   getAppCode,
   getTimeout,
 } = require("../utils/activationProvider");
+const { resolveUserAccess } = require("../rbac/storage");
+const {
+  TENANT_HEADER,
+  readRequestedTenantId,
+  createAccessContext,
+} = require("../tenancy");
 
 async function defaultVerifyToken(token, { req } = {}) {
   const baseUrl = getBaseUrl(req);
   const appCode = getAppCode();
+  const requestedTenantId = readRequestedTenantId(req);
 
   let response;
   try {
@@ -20,6 +27,7 @@ async function defaultVerifyToken(token, { req } = {}) {
       headers: {
         Authorization: `Bearer ${token}`,
         "x-app-code": appCode,
+        ...(requestedTenantId ? { [TENANT_HEADER]: requestedTenantId } : {}),
       },
     });
   } catch (error) {
@@ -27,6 +35,7 @@ async function defaultVerifyToken(token, { req } = {}) {
       error.response?.data?.message || error.message || "Token inválido ou erro na autenticação.",
     );
     err.statusCode = error.response?.status || error.statusCode || 401;
+    err.code = error.response?.data?.code || error.code;
     throw err;
   }
 
@@ -40,6 +49,12 @@ async function defaultVerifyToken(token, { req } = {}) {
   const tipoAcesso = data.aplicativo?.tipoAcesso || data.tipoAcesso || data.tipo || data.perfil;
   return {
     ...data,
+    acesso: response.data.acesso || data.acesso,
+    tenant: response.data.tenant || data.tenant,
+    tenancyModel:
+      response.data.acesso?.app?.tenancyModel ||
+      data.aplicativo?.tenancyModel ||
+      data.tenancyModel,
     tipo: tipoAcesso === "master" ? "admin" : tipoAcesso,
     perfil: data.perfil || tipoAcesso,
     nome: data.nome,
@@ -47,18 +62,25 @@ async function defaultVerifyToken(token, { req } = {}) {
   };
 }
 
-function localDevelopmentVerifyToken(token) {
+function localDevelopmentVerifyToken(token, { req } = {}) {
   const expected = String(process.env.DEV_TOKEN || "");
   if (process.env.NODE_ENV !== "development" || !expected || token !== expected) {
     const error = new Error("Token local de desenvolvimento inválido.");
     error.statusCode = 401;
     throw error;
   }
+  const requestedTenantId = readRequestedTenantId(req);
   return {
+    id: process.env.DEV_USER_ID || "dev-local",
+    usuarioId: process.env.DEV_USER_ID || "dev-local",
     tipo: process.env.DEV_USER_ROLE || "admin",
     perfil: process.env.DEV_USER_ROLE || "admin",
+    roleCode: process.env.DEV_USER_ROLE || "admin",
     nome: process.env.DEV_USER_NAME || "Dev Local",
     email: process.env.DEV_USER_EMAIL || "dev@local",
+    tenantId: requestedTenantId || process.env.DEV_TENANT_ID,
+    appCode: process.env.APP_CODE,
+    tenancyModel: process.env.DEV_TENANCY_MODEL || ctx.config.tenancyModel || "single_tenant",
     capabilities: ctx.config.capabilities || [],
   };
 }
@@ -71,6 +93,24 @@ function resolveVerifyToken() {
   return defaultVerifyToken;
 }
 
+function isFirstAccessRoute(req) {
+  const path = String(req.originalUrl || req.url || "").split("?")[0];
+  return path.endsWith("/auth/validar-token") || path.endsWith("/auth/first-access/password");
+}
+
+async function applyEffectiveAccess(usuario) {
+  const access = await resolveUserAccess(usuario);
+  return {
+    ...usuario,
+    roleCode: access.roleCode,
+    permissions: access.permissions,
+    accessStatus: access.status,
+    mustChangePassword: access.mustChangePassword,
+    firstAccessPending: access.mustChangePassword,
+    rbacMode: access.mode,
+  };
+}
+
 const authMiddleware = async (req, res, next) => {
   const token = req.headers.authorization?.split(" ")[1];
   if (!token) {
@@ -82,19 +122,45 @@ const authMiddleware = async (req, res, next) => {
   }
 
   try {
-    const usuario = await resolveVerifyToken()(token, { req });
-    if (!usuario) {
+    const requestedTenantId = readRequestedTenantId(req);
+    const providerUser = await resolveVerifyToken()(token, { req, requestedTenantId });
+    if (!providerUser) {
       const error = new Error("Usuário não resolvido.");
       error.statusCode = 401;
       throw error;
     }
-    req.usuario = usuario;
+    const usuario = await applyEffectiveAccess(providerUser);
+    const accessContext = createAccessContext(usuario, {
+      requestedTenantId,
+      tenancyModel: ctx.config.tenancyModel || ctx.config.app?.tenancyModel,
+      appCode: getAppCode(),
+    });
+
+    req.usuario = {
+      ...usuario,
+      tenantId: accessContext.tenantId,
+      appCode: accessContext.appCode || usuario.appCode,
+    };
+    // Contexto imutável e validado. Controllers e rotas customizadas devem
+    // consumir req.accessContext em vez de tenantId vindo de query/body.
+    req.accessContext = accessContext;
+
+    if (usuario.mustChangePassword && !isFirstAccessRoute(req)) {
+      return Helpers.sendErrorResponse({
+        res,
+        message: "Conclua a definição da nova senha antes de acessar a Central.",
+        statusCode: 403,
+        code: "FIRST_ACCESS_REQUIRED",
+      });
+    }
+
     next();
   } catch (error) {
     return Helpers.sendErrorResponse({
       res,
       message: error.message || "Token inválido ou erro na autenticação.",
       statusCode: error.statusCode || error.response?.status || 401,
+      code: error.code,
     });
   }
 };
@@ -103,3 +169,5 @@ module.exports = authMiddleware;
 module.exports.defaultVerifyToken = defaultVerifyToken;
 module.exports.localDevelopmentVerifyToken = localDevelopmentVerifyToken;
 module.exports.resolveVerifyToken = resolveVerifyToken;
+module.exports.applyEffectiveAccess = applyEffectiveAccess;
+module.exports.isFirstAccessRoute = isFirstAccessRoute;

package/src/core/middlewares/permissions.js

@@ -0,0 +1,37 @@
+"use strict";
+
+const Helpers = require("../utils/helpers");
+const { granted } = require("../rbac/policy");
+const { audit } = require("../rbac/storage");
+
+function requirePermission(permission) {
+  return async (req, res, next) => {
+    if (!req.usuario) {
+      return Helpers.sendErrorResponse({
+        res,
+        statusCode: 401,
+        message: "Acesso não autorizado.",
+      });
+    }
+
+    if (granted(req.usuario.permissions, permission)) return next();
+
+    await audit("permission.denied", {
+      actor: req.usuario,
+      target: permission,
+      context: {
+        method: req.method,
+        path: req.originalUrl || req.url,
+        requestId: req.id || req.headers["x-request-id"],
+      },
+    }).catch(() => undefined);
+
+    return Helpers.sendErrorResponse({
+      res,
+      statusCode: 403,
+      message: "Acesso negado para esta operação.",
+    });
+  };
+}
+
+module.exports = { requirePermission };

package/src/core/middlewares/rbac.js

@@ -1,22 +1,50 @@
 const Helpers = require("../utils/helpers");
 
-/**
- * RBAC simples baseado em `req.usuario.tipo`. `roles` vazio => qualquer
- * usuário autenticado. `admin` sempre passa.
- *
- * @param {string[]} roles papéis permitidos
- */
+const ROLE_ALIASES = Object.freeze({
+  admin: ["admin", "administrador", "master"],
+  administrador: ["admin", "administrador", "master"],
+  master: ["admin", "administrador", "master"],
+  operator: ["operator", "operador"],
+  operador: ["operator", "operador"],
+  manager: ["manager", "gestor"],
+  gestor: ["manager", "gestor"],
+  developer: ["developer", "desenvolvedor", "dev"],
+  desenvolvedor: ["developer", "desenvolvedor", "dev"],
+  dev: ["developer", "desenvolvedor", "dev"],
+  viewer: ["viewer", "leitura", "consulta", "read"],
+  leitura: ["viewer", "leitura", "consulta", "read"],
+  consulta: ["viewer", "leitura", "consulta", "read"],
+  read: ["viewer", "leitura", "consulta", "read"],
+});
+
+function normalize(value) {
+  return String(value || "").trim().toLowerCase();
+}
+
+function effectiveRoles(usuario) {
+  const raw = [usuario?.roleCode, usuario?.tipo, usuario?.perfil]
+    .map(normalize)
+    .filter(Boolean);
+  return [...new Set(raw.flatMap((role) => ROLE_ALIASES[role] || [role]))];
+}
+
 function rbac(roles = []) {
   return (req, res, next) => {
     if (!roles.length) return next();
-    const tipo = req.usuario?.tipo;
-    if (tipo === "admin" || roles.includes(tipo)) return next();
+    const allowed = roles.map(normalize);
+    const current = effectiveRoles(req.usuario);
+
+    // Wildcard é uma permissão efetiva resolvida pelo backend, não um bypass
+    // implícito baseado somente no nome do papel.
+    if (req.usuario?.permissions?.includes("*")) return next();
+    if (current.some((role) => allowed.includes(role))) return next();
+
     return Helpers.sendErrorResponse({
       res,
-      statusCode: 403,
       message: "Acesso negado para o seu perfil.",
+      statusCode: 403,
     });
   };
 }
 
-module.exports = { rbac };
+module.exports = { rbac, effectiveRoles };

package/src/core/rbac/identityProvider.js

@@ -0,0 +1,66 @@
+"use strict";
+
+const ctx = require("../context");
+const GenericError = require("../errors/GenericError");
+const {
+  ensureInstance,
+  instanceHeaders,
+  providerPost,
+} = require("../utils/instanceActivation");
+
+const IDENTITY_PATHS = Object.freeze({
+  provisionInvitation: "/integracao/autenticacao-aplicativos/convites/provisionar",
+  changeFirstAccessPassword: "/integracao/autenticacao-aplicativos/primeiro-acesso/senha",
+});
+
+async function defaultProviderCall(req, path, payload) {
+  const instance = await ensureInstance();
+  if (!instance?.instanceId || !instance?.credentialEncrypted) {
+    throw new GenericError("A instância precisa estar ativa para gerenciar identidades.", {
+      statusCode: 423,
+      code: "RBAC_INSTANCE_CREDENTIAL_REQUIRED",
+    });
+  }
+
+  try {
+    const headers = instanceHeaders(instance);
+    if (req?.headers?.authorization) headers.Authorization = req.headers.authorization;
+    const response = await providerPost(req, path, payload, headers);
+    return response.data;
+  } catch (error) {
+    const statusCode = error.response?.status || error.statusCode || 502;
+    const message = error.response?.data?.message || error.message || "Falha ao atualizar a identidade no provedor.";
+    throw new GenericError(message, {
+      statusCode,
+      code: error.response?.data?.code || error.code || "RBAC_IDENTITY_PROVIDER_ERROR",
+    });
+  }
+}
+
+async function provisionInvitation({ req, invitation, password }) {
+  const hook = ctx.config.auth?.provisionInvitation;
+  if (typeof hook === "function") return hook({ req, invitation, password });
+  return defaultProviderCall(req, IDENTITY_PATHS.provisionInvitation, {
+    email: invitation.email,
+    nome: invitation.name,
+    password,
+    invitationFingerprint: invitation.tokenFingerprint,
+  });
+}
+
+async function changeFirstAccessPassword({ req, user, password }) {
+  const hook = ctx.config.auth?.changeFirstAccessPassword;
+  if (typeof hook === "function") return hook({ req, user, password });
+  return defaultProviderCall(req, IDENTITY_PATHS.changeFirstAccessPassword, {
+    identityId: user?.id || user?._id || user?.usuarioId,
+    email: user?.email,
+    password,
+  });
+}
+
+module.exports = {
+  IDENTITY_PATHS,
+  defaultProviderCall,
+  provisionInvitation,
+  changeFirstAccessPassword,
+};

package/src/core/rbac/policy.js

@@ -0,0 +1,168 @@
+"use strict";
+
+const ctx = require("../context");
+
+const CORE_PERMISSIONS = Object.freeze([
+  "users.read",
+  "users.invite",
+  "users.update",
+  "users.disable",
+  "roles.read",
+]);
+
+const PERMISSION_PATTERN = /^[a-z][a-z0-9-]*(?:\.[a-z][a-z0-9-]*)+$/;
+const ROLE_PATTERN = /^[a-z][a-z0-9_-]*$/;
+
+function normalizeText(value) {
+  return String(value || "")
+    .normalize("NFD")
+    .replace(/[\u0300-\u036f]/g, "")
+    .trim()
+    .toLowerCase();
+}
+
+function isPermission(value) {
+  return value === "*" || PERMISSION_PATTERN.test(String(value || ""));
+}
+
+function isRoleCode(value) {
+  return ROLE_PATTERN.test(String(value || ""));
+}
+
+function unique(values = []) {
+  return [...new Set(values.filter(Boolean).map(String))];
+}
+
+function policy(config = ctx.config) {
+  const raw = config?.rbac;
+  const roles = Array.isArray(raw?.roles) ? raw.roles : [];
+  const customPermissions = Array.isArray(raw?.permissions) ? raw.permissions : [];
+  return {
+    enabled: roles.length > 0,
+    roles,
+    permissions: unique([...CORE_PERMISSIONS, ...customPermissions]),
+    invitationTtlHours: Number(raw?.invitationTtlHours) || 72,
+  };
+}
+
+function roleByCode(code, config = ctx.config) {
+  const requested = normalizeText(code);
+  if (!requested) return null;
+  return policy(config).roles.find((role) => normalizeText(role.code) === requested) || null;
+}
+
+function adminRoles(config = ctx.config) {
+  return policy(config).roles.filter((role) => role.admin === true || role.permissions?.includes("*"));
+}
+
+function rolePermissions(role) {
+  return unique(role?.permissions || []);
+}
+
+function granted(permissions, required) {
+  if (!required) return true;
+  const available = unique(permissions || []);
+  if (available.includes("*")) return true;
+  const requested = Array.isArray(required) ? required : [required];
+  if (!requested.length) return true;
+  return requested.some((permission) => available.includes(permission));
+}
+
+function legacyPermissions(user) {
+  const tipo = normalizeText(user?.tipo);
+  const perfil = normalizeText(user?.perfil);
+  if ([tipo, perfil].some((value) => ["admin", "master", "administrador"].includes(value))) {
+    return ["*"];
+  }
+
+  const values = [
+    ...(Array.isArray(user?.permissions) ? user.permissions : []),
+    ...(Array.isArray(user?.capabilities) ? user.capabilities : []),
+    ...(Array.isArray(user?.permissoes?.capabilities) ? user.permissoes.capabilities : []),
+    ...(Array.isArray(user?.aplicativo?.capabilities) ? user.aplicativo.capabilities : []),
+    ...(Array.isArray(user?.aplicativo?.permissoes?.capabilities)
+      ? user.aplicativo.permissoes.capabilities
+      : []),
+  ];
+  return unique(values.filter(isPermission));
+}
+
+function legacyRoleCandidates(user) {
+  const raw = unique([user?.roleCode, user?.perfil, user?.tipo]).map(normalizeText);
+  const aliases = {
+    administrador: "admin",
+    master: "admin",
+    operador: "operator",
+    gestor: "manager",
+    leitura: "viewer",
+    consulta: "viewer",
+    desenvolvedor: "developer",
+  };
+  return unique(raw.flatMap((value) => [value, aliases[value]]));
+}
+
+function matchingRoleForLegacyUser(user, config = ctx.config) {
+  const currentPolicy = policy(config);
+  const candidates = legacyRoleCandidates(user);
+  const direct = currentPolicy.roles.find((role) => {
+    const code = normalizeText(role.code);
+    const name = normalizeText(role.name);
+    return candidates.includes(code) || candidates.includes(name);
+  });
+  if (direct) return direct;
+
+  if (legacyPermissions(user).includes("*")) {
+    return adminRoles(config)[0] || null;
+  }
+
+  const nonAdmin = currentPolicy.roles.filter((role) => !role.admin && !role.permissions?.includes("*"));
+  return nonAdmin.length === 1 ? nonAdmin[0] : null;
+}
+
+function canAssignRole(actorPermissions, targetRole) {
+  const actor = unique(actorPermissions || []);
+  if (actor.includes("*")) return true;
+  const target = rolePermissions(targetRole);
+  if (target.includes("*")) return false;
+  return target.every((permission) => actor.includes(permission));
+}
+
+function publicPolicy(config = ctx.config) {
+  const currentPolicy = policy(config);
+  return {
+    central: {
+      appCode: String(config.appCode || config.slug || "central"),
+      name: String(config.name || config.slug || "Central Oon"),
+    },
+    enabled: currentPolicy.enabled,
+    permissions: currentPolicy.permissions,
+    roles: currentPolicy.roles.map((role) => ({
+      code: role.code,
+      name: role.name,
+      description: role.description,
+      admin: Boolean(role.admin),
+      permissions: rolePermissions(role),
+    })),
+    invitationTtlHours: currentPolicy.invitationTtlHours,
+  };
+}
+
+module.exports = {
+  CORE_PERMISSIONS,
+  PERMISSION_PATTERN,
+  ROLE_PATTERN,
+  normalizeText,
+  isPermission,
+  isRoleCode,
+  unique,
+  policy,
+  roleByCode,
+  adminRoles,
+  rolePermissions,
+  granted,
+  legacyPermissions,
+  legacyRoleCandidates,
+  matchingRoleForLegacyUser,
+  canAssignRole,
+  publicPolicy,
+};