@oondemand/oon-core-back 0.3.74 → 0.3.76

package/src/core/rbac/storage.js

@@ -0,0 +1,387 @@
+"use strict";
+
+const crypto = require("node:crypto");
+const mongoose = require("mongoose");
+const ctx = require("../context");
+const GenericError = require("../errors/GenericError");
+const { encrypt, decrypt } = require("../utils/instanceActivation");
+const {
+  policy,
+  roleByCode,
+  rolePermissions,
+  legacyPermissions,
+  matchingRoleForLegacyUser,
+} = require("./policy");
+
+const ACCESS_STATUSES = ["invited", "active", "disabled", "revoked"];
+const INVITATION_STATUSES = ["pending", "accepted", "revoked", "expired"];
+
+function models() {
+  const accessSchema = new mongoose.Schema({
+    appCode: { type: String, required: true, index: true },
+    identityId: { type: String, index: true },
+    email: { type: String, required: true, lowercase: true, trim: true },
+    name: String,
+    roleCode: { type: String, required: true },
+    status: { type: String, enum: ACCESS_STATUSES, default: "invited", index: true },
+    origin: { type: String, default: "rbac" },
+    grantedBy: String,
+    mustChangePassword: { type: Boolean, default: false },
+    invitedAt: Date,
+    activatedAt: Date,
+    disabledAt: Date,
+    revokedAt: Date,
+    lastAccessAt: Date,
+  }, { timestamps: true, collection: "oon_core_user_access" });
+  accessSchema.index({ appCode: 1, email: 1 }, { unique: true });
+  accessSchema.index(
+    { appCode: 1, identityId: 1 },
+    { unique: true, partialFilterExpression: { identityId: { $type: "string" } } },
+  );
+
+  const invitationSchema = new mongoose.Schema({
+    appCode: { type: String, required: true, index: true },
+    accessId: { type: mongoose.Schema.Types.ObjectId, ref: "OonCoreUserAccess", required: true },
+    email: { type: String, required: true, lowercase: true, trim: true },
+    name: String,
+    roleCode: { type: String, required: true },
+    tokenHash: { type: String, required: true, unique: true, select: false },
+    tokenFingerprint: { type: String, required: true },
+    tokenEncrypted: { type: String, select: false },
+    tokenIv: { type: String, select: false },
+    tokenAuthTag: { type: String, select: false },
+    status: { type: String, enum: INVITATION_STATUSES, default: "pending", index: true },
+    expiresAt: { type: Date, required: true, index: true },
+    createdBy: String,
+    acceptedAt: Date,
+    revokedAt: Date,
+  }, { timestamps: true, collection: "oon_core_invitations" });
+  invitationSchema.index({ appCode: 1, email: 1, status: 1 });
+
+  const auditSchema = new mongoose.Schema({
+    appCode: { type: String, required: true, index: true },
+    event: { type: String, required: true, index: true },
+    actor: String,
+    target: String,
+    before: mongoose.Schema.Types.Mixed,
+    after: mongoose.Schema.Types.Mixed,
+    context: mongoose.Schema.Types.Mixed,
+    at: { type: Date, default: Date.now, index: true },
+  }, { timestamps: false, collection: "oon_core_access_audit" });
+
+  return {
+    UserAccess: mongoose.models.OonCoreUserAccess || mongoose.model("OonCoreUserAccess", accessSchema),
+    Invitation: mongoose.models.OonCoreInvitation || mongoose.model("OonCoreInvitation", invitationSchema),
+    Audit: mongoose.models.OonCoreAccessAudit || mongoose.model("OonCoreAccessAudit", auditSchema),
+  };
+}
+
+function appCode() {
+  return String(ctx.config.appCode || ctx.config.slug || "central").trim().toLowerCase();
+}
+
+function normalizeEmail(value) {
+  return String(value || "").trim().toLowerCase();
+}
+
+function identityKey(user) {
+  return String(user?.id || user?._id || user?.usuarioId || "").trim();
+}
+
+function actorKey(user) {
+  return identityKey(user) || normalizeEmail(user?.email) || "system";
+}
+
+function sanitizeSnapshot(value) {
+  if (!value) return value;
+  const plain = typeof value.toObject === "function" ? value.toObject() : { ...value };
+  delete plain.tokenHash;
+  delete plain.tokenEncrypted;
+  delete plain.tokenIv;
+  delete plain.tokenAuthTag;
+  delete plain.senha;
+  delete plain.password;
+  return plain;
+}
+
+async function audit(event, { actor, target, before, after, context } = {}) {
+  if (mongoose.connection.readyState !== 1) return null;
+  const { Audit } = models();
+  return Audit.create({
+    appCode: appCode(),
+    event,
+    actor: typeof actor === "string" ? actor : actorKey(actor),
+    target: typeof target === "string" ? target : target && (identityKey(target) || normalizeEmail(target.email)),
+    before: sanitizeSnapshot(before),
+    after: sanitizeSnapshot(after),
+    context,
+    at: new Date(),
+  });
+}
+
+function accessError(message, code = "RBAC_ACCESS_DENIED", statusCode = 403) {
+  return new GenericError(message, { statusCode, code });
+}
+
+async function findAccessForUser(user) {
+  if (mongoose.connection.readyState !== 1) return null;
+  const { UserAccess } = models();
+  const conditions = [];
+  const id = identityKey(user);
+  const email = normalizeEmail(user?.email);
+  if (id) conditions.push({ identityId: id });
+  if (email) conditions.push({ email });
+  if (!conditions.length) return null;
+  return UserAccess.findOne({ appCode: appCode(), $or: conditions });
+}
+
+async function migrateLegacyAccess(user) {
+  const currentPolicy = policy();
+  if (!currentPolicy.enabled || mongoose.connection.readyState !== 1) return null;
+  const role = matchingRoleForLegacyUser(user);
+  if (!role) return null;
+
+  const { UserAccess } = models();
+  const email = normalizeEmail(user?.email);
+  if (!email) return null;
+  const identityId = identityKey(user) || undefined;
+  const existing = await UserAccess.findOne({ appCode: appCode(), email });
+  if (existing) return existing;
+
+  const created = await UserAccess.create({
+    appCode: appCode(),
+    identityId,
+    email,
+    name: user?.nome || user?.name,
+    roleCode: role.code,
+    status: "active",
+    origin: "legacy-migration",
+    grantedBy: "system:migration",
+    mustChangePassword: false,
+    activatedAt: new Date(),
+    lastAccessAt: new Date(),
+  });
+  await audit("user.migrated", { actor: "system:migration", target: created, after: created });
+  return created;
+}
+
+async function resolveUserAccess(user, { touch = true } = {}) {
+  const currentPolicy = policy();
+  if (!currentPolicy.enabled) {
+    return {
+      mode: "legacy",
+      status: "active",
+      roleCode: user?.perfil || user?.tipo || "user",
+      permissions: legacyPermissions(user),
+      mustChangePassword: Boolean(user?.mustChangePassword || user?.firstAccessPending),
+    };
+  }
+
+  let access = await findAccessForUser(user);
+  if (!access) access = await migrateLegacyAccess(user);
+  if (!access) {
+    throw accessError("Usuário autenticado sem perfil local nesta Central.", "RBAC_LOCAL_ACCESS_REQUIRED");
+  }
+  if (["disabled", "revoked"].includes(access.status)) {
+    throw accessError("Acesso do usuário está desabilitado nesta Central.", "RBAC_USER_DISABLED");
+  }
+  if (access.status === "invited") {
+    throw accessError("Convite ainda não foi concluído.", "RBAC_INVITATION_PENDING");
+  }
+
+  const role = roleByCode(access.roleCode);
+  if (!role) {
+    throw accessError("O perfil associado ao usuário não existe mais na política da Central.", "RBAC_ROLE_NOT_FOUND");
+  }
+
+  const id = identityKey(user);
+  let changed = false;
+  if (id && access.identityId !== id) {
+    access.identityId = id;
+    changed = true;
+  }
+  if (user?.nome && access.name !== user.nome) {
+    access.name = user.nome;
+    changed = true;
+  }
+  if (touch && (!access.lastAccessAt || Date.now() - access.lastAccessAt.getTime() > 5 * 60 * 1000)) {
+    access.lastAccessAt = new Date();
+    changed = true;
+  }
+  if (changed) await access.save();
+
+  return {
+    mode: "rbac",
+    access,
+    status: access.status,
+    roleCode: access.roleCode,
+    role,
+    permissions: rolePermissions(role),
+    mustChangePassword: Boolean(access.mustChangePassword),
+  };
+}
+
+function hashToken(token) {
+  return crypto.createHash("sha256").update(String(token)).digest("hex");
+}
+
+function tokenFingerprint(token) {
+  return hashToken(token).slice(0, 12);
+}
+
+function protectInvitationToken(token) {
+  const protectedToken = encrypt(String(token));
+  return {
+    tokenEncrypted: protectedToken.credentialEncrypted,
+    tokenIv: protectedToken.credentialIv,
+    tokenAuthTag: protectedToken.credentialAuthTag,
+  };
+}
+
+function recoverInvitationToken(invitation) {
+  if (!invitation?.tokenEncrypted || !invitation?.tokenIv || !invitation?.tokenAuthTag) {
+    return null;
+  }
+  return decrypt({
+    credentialEncrypted: invitation.tokenEncrypted,
+    credentialIv: invitation.tokenIv,
+    credentialAuthTag: invitation.tokenAuthTag,
+  });
+}
+
+function invitationExpiry() {
+  return new Date(Date.now() + policy().invitationTtlHours * 60 * 60 * 1000);
+}
+
+async function revokePendingInvitations(email, actor) {
+  const { Invitation } = models();
+  const pending = await Invitation.find({ appCode: appCode(), email: normalizeEmail(email), status: "pending" });
+  for (const invitation of pending) {
+    invitation.status = "revoked";
+    invitation.revokedAt = new Date();
+    await invitation.save();
+    await audit("invitation.revoked", { actor, target: invitation.email, before: invitation });
+  }
+}
+
+async function createInvitation({ email, name, roleCode, actor }) {
+  if (mongoose.connection.readyState !== 1) {
+    throw new GenericError("Banco de dados indisponível para criar convites.", { statusCode: 503 });
+  }
+  const role = roleByCode(roleCode);
+  if (!role) throw new GenericError("Perfil inválido.", { statusCode: 422, code: "RBAC_ROLE_NOT_FOUND" });
+  const normalizedEmail = normalizeEmail(email);
+  if (!/^\S+@\S+\.\S+$/.test(normalizedEmail)) {
+    throw new GenericError("Informe um e-mail válido.", { statusCode: 422 });
+  }
+
+  const { UserAccess, Invitation } = models();
+  await revokePendingInvitations(normalizedEmail, actor);
+  let access = await UserAccess.findOne({ appCode: appCode(), email: normalizedEmail });
+  const before = sanitizeSnapshot(access);
+  if (!access) {
+    access = new UserAccess({ appCode: appCode(), email: normalizedEmail });
+  }
+  access.name = name || access.name;
+  access.roleCode = role.code;
+  access.status = "invited";
+  access.origin = "invitation";
+  access.grantedBy = actorKey(actor);
+  access.mustChangePassword = true;
+  access.invitedAt = new Date();
+  access.disabledAt = undefined;
+  access.revokedAt = undefined;
+  await access.save();
+
+  const token = crypto.randomBytes(32).toString("base64url");
+  const invitation = await Invitation.create({
+    appCode: appCode(),
+    accessId: access._id,
+    email: normalizedEmail,
+    name: access.name,
+    roleCode: role.code,
+    tokenHash: hashToken(token),
+    tokenFingerprint: tokenFingerprint(token),
+    ...protectInvitationToken(token),
+    expiresAt: invitationExpiry(),
+    status: "pending",
+    createdBy: actorKey(actor),
+  });
+  await audit("invitation.created", { actor, target: normalizedEmail, before, after: access, context: { invitationId: String(invitation._id) } });
+  return { access, invitation, token };
+}
+
+async function findInvitationByToken(token) {
+  if (mongoose.connection.readyState !== 1) return null;
+  const { Invitation } = models();
+  const invitation = await Invitation.findOne({ appCode: appCode(), tokenHash: hashToken(token) }).select("+tokenHash");
+  if (!invitation) return null;
+  if (invitation.status === "pending" && invitation.expiresAt.getTime() <= Date.now()) {
+    invitation.status = "expired";
+    await invitation.save();
+    await audit("invitation.expired", { actor: "system", target: invitation.email, context: { invitationId: String(invitation._id) } });
+  }
+  return invitation;
+}
+
+async function recoverPendingInvitation(id) {
+  if (mongoose.connection.readyState !== 1) return null;
+  const { Invitation } = models();
+  const invitation = await Invitation.findOne({ _id: id, appCode: appCode() })
+    .select("+tokenEncrypted +tokenIv +tokenAuthTag");
+  if (!invitation) return null;
+  if (invitation.status === "pending" && invitation.expiresAt.getTime() <= Date.now()) {
+    invitation.status = "expired";
+    await invitation.save();
+    return { invitation, token: null };
+  }
+  if (invitation.status !== "pending") return { invitation, token: null };
+  return { invitation, token: recoverInvitationToken(invitation) };
+}
+
+async function activeAdminCount() {
+  const adminCodes = policy().roles
+    .filter((role) => role.admin === true || role.permissions?.includes("*"))
+    .map((role) => role.code);
+  if (!adminCodes.length || mongoose.connection.readyState !== 1) return 0;
+  const { UserAccess } = models();
+  return UserAccess.countDocuments({ appCode: appCode(), status: "active", roleCode: { $in: adminCodes } });
+}
+
+async function assertNotLastAdmin(access, nextRoleCode) {
+  const currentRole = roleByCode(access.roleCode);
+  const nextRole = nextRoleCode ? roleByCode(nextRoleCode) : null;
+  const currentAdmin = Boolean(currentRole?.admin || currentRole?.permissions?.includes("*"));
+  const nextAdmin = Boolean(nextRole?.admin || nextRole?.permissions?.includes("*"));
+  if (currentAdmin && !nextAdmin && (await activeAdminCount()) <= 1) {
+    throw new GenericError("Não é possível remover ou desabilitar o último administrador da Central.", {
+      statusCode: 409,
+      code: "RBAC_LAST_ADMIN_PROTECTED",
+    });
+  }
+}
+
+module.exports = {
+  ACCESS_STATUSES,
+  INVITATION_STATUSES,
+  models,
+  appCode,
+  normalizeEmail,
+  identityKey,
+  actorKey,
+  sanitizeSnapshot,
+  audit,
+  findAccessForUser,
+  migrateLegacyAccess,
+  resolveUserAccess,
+  hashToken,
+  tokenFingerprint,
+  protectInvitationToken,
+  recoverInvitationToken,
+  createInvitation,
+  revokePendingInvitations,
+  findInvitationByToken,
+  recoverPendingInvitation,
+  activeAdminCount,
+  assertNotLastAdmin,
+};

package/src/core/tenancy.js

@@ -0,0 +1,200 @@
+const GenericError = require("./errors/GenericError");
+
+const TENANT_HEADER = "x-oon-tenant-id";
+const TENANCY_MODELS = Object.freeze(["none", "single_tenant", "multi_tenant"]);
+const DATA_SCOPES = Object.freeze(["legacy", "system", "tenant", "user"]);
+
+function stringId(value) {
+  if (value === undefined || value === null || value === "") return undefined;
+  if (typeof value === "object") {
+    if (value.id !== undefined) return stringId(value.id);
+    if (value._id !== undefined) return stringId(value._id);
+  }
+  return String(value);
+}
+
+function forbidden(code, message) {
+  return new GenericError(message, { statusCode: 403, code });
+}
+
+function readRequestedTenantId(req) {
+  return stringId(req?.headers?.[TENANT_HEADER]);
+}
+
+function inferVerifiedTenantId(usuario) {
+  return stringId(
+    usuario?.tenantId ||
+      usuario?.tenant?.id ||
+      usuario?.tenant?._id ||
+      usuario?.acesso?.tenant?.id ||
+      usuario?.acesso?.tenant?._id ||
+      usuario?.licenca?.tenantId ||
+      usuario?.aplicativo?.tenantId,
+  );
+}
+
+function inferTenancyModel(usuario, fallback = "single_tenant") {
+  const value =
+    usuario?.tenancyModel ||
+    usuario?.app?.tenancyModel ||
+    usuario?.aplicativo?.tenancyModel ||
+    usuario?.acesso?.app?.tenancyModel ||
+    fallback;
+  return TENANCY_MODELS.includes(value) ? value : fallback;
+}
+
+function inferPermissions(usuario) {
+  const raw = usuario?.permissions || usuario?.permissoes || [];
+  if (Array.isArray(raw)) return [...new Set(raw.map(String))];
+  return [];
+}
+
+function createAccessContext(usuario, options = {}) {
+  const requestedTenantId = stringId(options.requestedTenantId);
+  const verifiedTenantId = inferVerifiedTenantId(usuario);
+  const tenancyModel = inferTenancyModel(usuario, options.tenancyModel || "single_tenant");
+
+  // O header seleciona um tenant, mas nunca é autoridade. A autoridade é o
+  // tenant devolvido pelo provedor de identidade/Control Plane após validar o
+  // vínculo do usuário com o app e o tenant solicitado.
+  if (requestedTenantId && verifiedTenantId && requestedTenantId !== verifiedTenantId) {
+    throw forbidden(
+      "TENANT_CONTEXT_MISMATCH",
+      "O tenant solicitado não corresponde ao contexto autorizado.",
+    );
+  }
+
+  if (tenancyModel === "multi_tenant" && !verifiedTenantId) {
+    throw forbidden(
+      "TENANT_CONTEXT_REQUIRED",
+      "Selecione um tenant autorizado para acessar este aplicativo.",
+    );
+  }
+
+  if (tenancyModel === "none" && requestedTenantId) {
+    throw forbidden(
+      "TENANT_CONTEXT_NOT_ALLOWED",
+      "Este aplicativo não aceita contexto de tenant.",
+    );
+  }
+
+  const roleCode = String(
+    usuario?.roleCode || usuario?.perfil || usuario?.tipo || "",
+  ).trim() || undefined;
+
+  return Object.freeze({
+    userId: stringId(usuario?.usuarioId || usuario?.id || usuario?._id || usuario?.sub),
+    tenantId: tenancyModel === "none" ? undefined : verifiedTenantId,
+    appCode: String(
+      usuario?.appCode ||
+        usuario?.app?.codigo ||
+        usuario?.aplicativo?.codigo ||
+        usuario?.acesso?.app?.codigo ||
+        options.appCode ||
+        "",
+    ).trim().toLowerCase() || undefined,
+    roleCode,
+    permissions: Object.freeze(inferPermissions(usuario)),
+    tenancyModel,
+  });
+}
+
+function dataScope(entryOrDefinition) {
+  const definition = entryOrDefinition?.definition || entryOrDefinition || {};
+  const value = definition.scope || definition.tenancy?.scope || "legacy";
+  return DATA_SCOPES.includes(value) ? value : "legacy";
+}
+
+function tenantField(entryOrDefinition) {
+  const definition = entryOrDefinition?.definition || entryOrDefinition || {};
+  return definition.tenancy?.tenantField || "tenantId";
+}
+
+function userField(entryOrDefinition) {
+  const definition = entryOrDefinition?.definition || entryOrDefinition || {};
+  return definition.tenancy?.userField || "usuarioId";
+}
+
+function requireContextValue(value, code, message) {
+  if (!value) throw forbidden(code, message);
+  return value;
+}
+
+function scopeFilter(entryOrDefinition, accessContext) {
+  const scope = dataScope(entryOrDefinition);
+  if (scope === "legacy" || scope === "system") return {};
+
+  const tenantId = requireContextValue(
+    accessContext?.tenantId,
+    "TENANT_CONTEXT_REQUIRED",
+    "Contexto de tenant obrigatório para este recurso.",
+  );
+  const filter = { [tenantField(entryOrDefinition)]: tenantId };
+
+  if (scope === "user") {
+    filter[userField(entryOrDefinition)] = requireContextValue(
+      accessContext?.userId,
+      "USER_CONTEXT_REQUIRED",
+      "Contexto de usuário obrigatório para este recurso.",
+    );
+  }
+
+  return filter;
+}
+
+function mergeScopedFilter(entryOrDefinition, filter = {}, accessContext) {
+  const clean = { ...(filter || {}) };
+  const enforced = scopeFilter(entryOrDefinition, accessContext);
+
+  // Remove tentativas de substituir escopo via query/body. O valor confiável
+  // sempre vence e é derivado de req.accessContext.
+  for (const [key, value] of Object.entries(enforced)) {
+    clean[key] = value;
+  }
+  return clean;
+}
+
+function scopeMutation(entryOrDefinition, data = {}, accessContext) {
+  const result = data && typeof data === "object" && !Array.isArray(data)
+    ? { ...data }
+    : data;
+  if (!result || typeof result !== "object" || Array.isArray(result)) return result;
+
+  const scope = dataScope(entryOrDefinition);
+  if (scope === "legacy" || scope === "system") return result;
+
+  const enforced = scopeFilter(entryOrDefinition, accessContext);
+  Object.assign(result, enforced);
+  return result;
+}
+
+function scopedIdFilter(entryOrDefinition, id, accessContext) {
+  return mergeScopedFilter(entryOrDefinition, { _id: id }, accessContext);
+}
+
+function assertScopedEntry(entryOrDefinition) {
+  const scope = dataScope(entryOrDefinition);
+  if (scope === "legacy") return;
+  if (!DATA_SCOPES.includes(scope)) {
+    throw new Error(`Escopo de dados inválido: ${scope}`);
+  }
+}
+
+module.exports = {
+  TENANT_HEADER,
+  TENANCY_MODELS,
+  DATA_SCOPES,
+  stringId,
+  readRequestedTenantId,
+  inferVerifiedTenantId,
+  inferTenancyModel,
+  createAccessContext,
+  dataScope,
+  tenantField,
+  userField,
+  scopeFilter,
+  mergeScopedFilter,
+  scopeMutation,
+  scopedIdFilter,
+  assertScopedEntry,
+};

package/src/index.js

@@ -6,7 +6,10 @@ const { activate } = require("./boot/activation");
 const define = require("./core/define");
 const fields = require("./core/fields");
 const registry = require("./core/registry");
+const tenancy = require("./core/tenancy");
 const GenericError = require("./core/errors/GenericError");
+const { requirePermission } = require("./core/middlewares/permissions");
+const rbacPolicy = require("./core/rbac/policy");
 const omieModule = require("./modules/omie");
 const integrations = require("./modules/integrations");
 const appManifest = require("./manifest/appManifest");
@@ -30,6 +33,22 @@ module.exports = {
   defineValidation: define.defineValidation,
   defineTrigger: define.defineTrigger,
 
+  requirePermission,
+  CORE_PERMISSIONS: rbacPolicy.CORE_PERMISSIONS,
+  rbacPolicy: rbacPolicy.policy,
+  roleByCode: rbacPolicy.roleByCode,
+  permissionGranted: rbacPolicy.granted,
+
+  TENANT_HEADER: tenancy.TENANT_HEADER,
+  TENANCY_MODELS: tenancy.TENANCY_MODELS,
+  DATA_SCOPES: tenancy.DATA_SCOPES,
+  createAccessContext: tenancy.createAccessContext,
+  readRequestedTenantId: tenancy.readRequestedTenantId,
+  scopeFilter: tenancy.scopeFilter,
+  mergeScopedFilter: tenancy.mergeScopedFilter,
+  scopeMutation: tenancy.scopeMutation,
+  scopedIdFilter: tenancy.scopedIdFilter,
+
   APP_MANIFEST_FILENAME: appManifest.APP_MANIFEST_FILENAME,
   APP_MANIFEST_SCHEMA_VERSION: appManifest.APP_MANIFEST_SCHEMA_VERSION,
   SUPPORTED_APP_KINDS: appManifest.SUPPORTED_APP_KINDS,