@oondemand/oon-core-back 0.3.74 → 0.3.76

package/src/manifest/appManifest.js

@@ -4,22 +4,13 @@ const fs = require("node:fs");
 const path = require("node:path");
 const ctx = require("../core/context");
 const corePackage = require("../../package.json");
+const { validateRbac } = require("./rbacManifest");
 
 const APP_MANIFEST_FILENAME = "central.app.json";
 const APP_MANIFEST_SCHEMA_VERSION = 1;
-const SUPPORTED_APP_KINDS = Object.freeze([
-  "root-central",
-  "member-central",
-  "portal-cockpit",
-]);
+const SUPPORTED_APP_KINDS = Object.freeze(["root-central", "member-central", "portal-cockpit"]);
 const SUPPORTED_MODULES = Object.freeze([
-  "collections",
-  "documents",
-  "pipelines",
-  "integrations",
-  "omie",
-  "assistants",
-  "currencies",
+  "collections", "documents", "pipelines", "integrations", "omie", "assistants", "currencies",
 ]);
 const APP_KIND_ROLE = Object.freeze({
   "root-central": "root",
@@ -41,22 +32,17 @@ class AppManifestError extends Error {
 function isPlainObject(value) {
   return Boolean(value) && typeof value === "object" && !Array.isArray(value);
 }
-
 function hasOwn(object, key) {
   return Object.prototype.hasOwnProperty.call(object, key);
 }
-
 function addIssue(issues, fieldPath, message) {
   issues.push({ path: fieldPath, message });
 }
-
 function parseVersion(value) {
   if (typeof value !== "string") return null;
   const match = value.trim().match(/^(\d+)\.(\d+)\.(\d+)(?:[-+][0-9A-Za-z.-]+)?$/);
-  if (!match) return null;
-  return match.slice(1, 4).map(Number);
+  return match ? match.slice(1, 4).map(Number) : null;
 }
-
 function compareVersions(left, right) {
   for (let index = 0; index < 3; index += 1) {
     if (left[index] !== right[index]) return left[index] < right[index] ? -1 : 1;
@@ -73,50 +59,28 @@ function validateCompatibility(compatibility, issues, coreVersion) {
     addIssue(issues, "compatibility.core", "deve ser um objeto.");
     return;
   }
-
   const allowedKeys = new Set(["minVersion", "maxVersionExclusive"]);
   for (const key of Object.keys(compatibility.core)) {
     if (!allowedKeys.has(key)) addIssue(issues, `compatibility.core.${key}`, "propriedade não suportada.");
   }
-
   const minVersion = parseVersion(compatibility.core.minVersion);
   const maxVersion = hasOwn(compatibility.core, "maxVersionExclusive")
     ? parseVersion(compatibility.core.maxVersionExclusive)
     : null;
-
-  if (!minVersion) {
-    addIssue(issues, "compatibility.core.minVersion", "deve usar versão semântica, por exemplo 0.3.45.");
-  }
+  if (!minVersion) addIssue(issues, "compatibility.core.minVersion", "deve usar versão semântica, por exemplo 0.3.45.");
   if (hasOwn(compatibility.core, "maxVersionExclusive") && !maxVersion) {
-    addIssue(
-      issues,
-      "compatibility.core.maxVersionExclusive",
-      "deve usar versão semântica, por exemplo 0.4.0.",
-    );
+    addIssue(issues, "compatibility.core.maxVersionExclusive", "deve usar versão semântica, por exemplo 0.4.0.");
   }
   if (minVersion && maxVersion && compareVersions(minVersion, maxVersion) >= 0) {
-    addIssue(
-      issues,
-      "compatibility.core",
-      "minVersion deve ser menor que maxVersionExclusive.",
-    );
+    addIssue(issues, "compatibility.core", "minVersion deve ser menor que maxVersionExclusive.");
   }
-
   const installedVersion = parseVersion(coreVersion);
   if (!installedVersion || !minVersion) return;
   if (compareVersions(installedVersion, minVersion) < 0) {
-    addIssue(
-      issues,
-      "compatibility.core.minVersion",
-      `requer OonCore ${compatibility.core.minVersion} ou superior; instalado ${coreVersion}.`,
-    );
+    addIssue(issues, "compatibility.core.minVersion", `requer OonCore ${compatibility.core.minVersion} ou superior; instalado ${coreVersion}.`);
   }
   if (maxVersion && compareVersions(installedVersion, maxVersion) >= 0) {
-    addIssue(
-      issues,
-      "compatibility.core.maxVersionExclusive",
-      `requer OonCore anterior a ${compatibility.core.maxVersionExclusive}; instalado ${coreVersion}.`,
-    );
+    addIssue(issues, "compatibility.core.maxVersionExclusive", `requer OonCore anterior a ${compatibility.core.maxVersionExclusive}; instalado ${coreVersion}.`);
   }
 }
 
@@ -133,10 +97,7 @@ function validateActivation(activation, issues) {
   if (hasOwn(activation, "enabled") && typeof activation.enabled !== "boolean") {
     addIssue(issues, "activation.enabled", "deve ser booleano.");
   }
-  if (
-    hasOwn(activation, "configurationVersion")
-    && (!Number.isInteger(activation.configurationVersion) || activation.configurationVersion < 1)
-  ) {
+  if (hasOwn(activation, "configurationVersion") && (!Number.isInteger(activation.configurationVersion) || activation.configurationVersion < 1)) {
     addIssue(issues, "activation.configurationVersion", "deve ser inteiro maior ou igual a 1.");
   }
   if (hasOwn(activation, "fields") && !Array.isArray(activation.fields)) {
@@ -147,84 +108,50 @@ function validateActivation(activation, issues) {
 function validateAppManifest(input, { coreVersion = corePackage.version } = {}) {
   const issues = [];
   if (!isPlainObject(input)) {
-    throw new AppManifestError("central.app.json inválido.", [
-      { path: "$", message: "deve conter um objeto JSON." },
-    ]);
+    throw new AppManifestError("central.app.json inválido.", [{ path: "$", message: "deve conter um objeto JSON." }]);
   }
-
   const allowedTopLevel = new Set([
-    "$schema",
-    "schemaVersion",
-    "id",
-    "name",
-    "slug",
-    "appKind",
-    "modules",
-    "capabilities",
-    "compatibility",
-    "activation",
+    "$schema", "schemaVersion", "id", "name", "slug", "appKind", "modules", "capabilities",
+    "compatibility", "activation", "rbac",
   ]);
   for (const key of Object.keys(input)) {
     if (!allowedTopLevel.has(key)) addIssue(issues, key, "propriedade não suportada.");
   }
-
   if (input.schemaVersion !== APP_MANIFEST_SCHEMA_VERSION) {
-    addIssue(
-      issues,
-      "schemaVersion",
-      `versão não suportada. Use ${APP_MANIFEST_SCHEMA_VERSION}.`,
-    );
+    addIssue(issues, "schemaVersion", `versão não suportada. Use ${APP_MANIFEST_SCHEMA_VERSION}.`);
   }
   if (typeof input.id !== "string" || !/^[a-z0-9][a-z0-9._-]*$/.test(input.id)) {
     addIssue(issues, "id", "deve usar letras minúsculas, números, ponto, hífen ou sublinhado.");
   }
-  if (typeof input.name !== "string" || !input.name.trim()) {
-    addIssue(issues, "name", "é obrigatório e deve ser texto não vazio.");
-  }
+  if (typeof input.name !== "string" || !input.name.trim()) addIssue(issues, "name", "é obrigatório e deve ser texto não vazio.");
   if (typeof input.slug !== "string" || !/^[a-z0-9]+(?:-[a-z0-9]+)*$/.test(input.slug)) {
     addIssue(issues, "slug", "deve usar slug em letras minúsculas separado por hífen.");
   }
   if (!SUPPORTED_APP_KINDS.includes(input.appKind)) {
     addIssue(issues, "appKind", `deve ser um de: ${SUPPORTED_APP_KINDS.join(", ")}.`);
   }
-
   if (!isPlainObject(input.modules)) {
     addIssue(issues, "modules", "deve ser um objeto.");
   } else {
     for (const key of Object.keys(input.modules)) {
-      if (!SUPPORTED_MODULES.includes(key)) {
-        addIssue(issues, `modules.${key}`, `módulo não suportado. Use: ${SUPPORTED_MODULES.join(", ")}.`);
-      } else if (typeof input.modules[key] !== "boolean") {
-        addIssue(issues, `modules.${key}`, "deve ser booleano.");
-      }
+      if (!SUPPORTED_MODULES.includes(key)) addIssue(issues, `modules.${key}`, `módulo não suportado. Use: ${SUPPORTED_MODULES.join(", ")}.`);
+      else if (typeof input.modules[key] !== "boolean") addIssue(issues, `modules.${key}`, "deve ser booleano.");
     }
   }
-
   if (!Array.isArray(input.capabilities)) {
     addIssue(issues, "capabilities", "deve ser uma lista.");
   } else {
     const seen = new Set();
     input.capabilities.forEach((capability, index) => {
-      if (
-        typeof capability !== "string"
-        || !/^[a-z][a-z0-9]*(?:[._:-][a-z0-9][a-z0-9-]*)+$/.test(capability)
-      ) {
-        addIssue(
-          issues,
-          `capabilities[${index}]`,
-          "deve ser um identificador namespaced, por exemplo core.collections.",
-        );
-      } else if (seen.has(capability)) {
-        addIssue(issues, `capabilities[${index}]`, `capability duplicada: ${capability}.`);
-      } else {
-        seen.add(capability);
-      }
+      if (typeof capability !== "string" || !/^[a-z][a-z0-9]*(?:[._:-][a-z0-9][a-z0-9-]*)+$/.test(capability)) {
+        addIssue(issues, `capabilities[${index}]`, "deve ser um identificador namespaced, por exemplo core.collections.");
+      } else if (seen.has(capability)) addIssue(issues, `capabilities[${index}]`, `capability duplicada: ${capability}.`);
+      else seen.add(capability);
     });
   }
-
   validateCompatibility(input.compatibility, issues, coreVersion);
   validateActivation(input.activation, issues);
-
+  validateRbac(input.rbac, issues);
   if (issues.length) throw new AppManifestError("central.app.json inválido.", issues);
   return JSON.parse(JSON.stringify(input));
 }
@@ -233,9 +160,7 @@ function resolveAppManifestPath(cwd = process.cwd()) {
   const absolute = path.resolve(cwd);
   const candidates = [path.join(absolute, APP_MANIFEST_FILENAME)];
   const parent = path.dirname(absolute);
-  if (["backend", "frontend"].includes(path.basename(absolute))) {
-    candidates.push(path.join(parent, APP_MANIFEST_FILENAME));
-  }
+  if (["backend", "frontend"].includes(path.basename(absolute))) candidates.push(path.join(parent, APP_MANIFEST_FILENAME));
   return candidates.find((candidate) => fs.existsSync(candidate)) || candidates[0];
 }
 
@@ -254,6 +179,7 @@ function appManifestToConfig(manifest, manifestPath) {
     },
     modules: { ...manifest.modules },
     capabilities: [...manifest.capabilities],
+    rbac: manifest.rbac ? JSON.parse(JSON.stringify(manifest.rbac)) : undefined,
     appManifest: manifest,
     appManifestPath: manifestPath,
   };
@@ -266,17 +192,13 @@ function registerAppManifest(input, options = {}) {
 }
 
 function loadAppManifest(cwdOrFile = process.cwd(), options = {}) {
-  const manifestPath = cwdOrFile.endsWith?.(".json")
-    ? path.resolve(cwdOrFile)
-    : resolveAppManifestPath(cwdOrFile);
+  const manifestPath = cwdOrFile.endsWith?.(".json") ? path.resolve(cwdOrFile) : resolveAppManifestPath(cwdOrFile);
   let input;
   try {
     input = JSON.parse(fs.readFileSync(manifestPath, "utf8"));
   } catch (error) {
     if (error.code === "ENOENT") throw error;
-    throw new AppManifestError("Não foi possível ler central.app.json.", [
-      { path: "$", message: error.message },
-    ], { cause: error });
+    throw new AppManifestError("Não foi possível ler central.app.json.", [{ path: "$", message: error.message }], { cause: error });
   }
   return registerAppManifest(input, { ...options, manifestPath });
 }

package/src/manifest/rbacManifest.js

@@ -0,0 +1,89 @@
+"use strict";
+
+const {
+  CORE_PERMISSIONS,
+  isPermission,
+  isRoleCode,
+} = require("../core/rbac/policy");
+
+function isPlainObject(value) {
+  return Boolean(value) && typeof value === "object" && !Array.isArray(value);
+}
+
+function validateRbac(rbac, issues) {
+  if (rbac === undefined) return;
+  if (!isPlainObject(rbac)) {
+    issues.push({ path: "rbac", message: "deve ser um objeto." });
+    return;
+  }
+
+  const allowedKeys = new Set(["roles", "permissions", "invitationTtlHours"]);
+  for (const key of Object.keys(rbac)) {
+    if (!allowedKeys.has(key)) issues.push({ path: `rbac.${key}`, message: "propriedade não suportada." });
+  }
+
+  const customPermissions = Array.isArray(rbac.permissions) ? rbac.permissions : [];
+  if (rbac.permissions !== undefined && !Array.isArray(rbac.permissions)) {
+    issues.push({ path: "rbac.permissions", message: "deve ser uma lista." });
+  }
+  const seenPermissions = new Set();
+  customPermissions.forEach((permission, index) => {
+    if (!isPermission(permission) || permission === "*") {
+      issues.push({ path: `rbac.permissions[${index}]`, message: "deve usar o formato recurso.acao." });
+    } else if (seenPermissions.has(permission)) {
+      issues.push({ path: `rbac.permissions[${index}]`, message: `permissão duplicada: ${permission}.` });
+    }
+    seenPermissions.add(permission);
+  });
+
+  if (!Array.isArray(rbac.roles) || !rbac.roles.length) {
+    issues.push({ path: "rbac.roles", message: "deve conter ao menos um perfil." });
+    return;
+  }
+
+  const catalog = new Set([...CORE_PERMISSIONS, ...customPermissions]);
+  const seenRoles = new Set();
+  let adminCount = 0;
+  rbac.roles.forEach((role, index) => {
+    const base = `rbac.roles[${index}]`;
+    if (!isPlainObject(role)) {
+      issues.push({ path: base, message: "deve ser um objeto." });
+      return;
+    }
+    const allowedRoleKeys = new Set(["code", "name", "description", "permissions", "admin"]);
+    for (const key of Object.keys(role)) {
+      if (!allowedRoleKeys.has(key)) issues.push({ path: `${base}.${key}`, message: "propriedade não suportada." });
+    }
+    if (!isRoleCode(role.code)) issues.push({ path: `${base}.code`, message: "deve ser um código estável em minúsculas." });
+    if (seenRoles.has(role.code)) issues.push({ path: `${base}.code`, message: `perfil duplicado: ${role.code}.` });
+    seenRoles.add(role.code);
+    if (typeof role.name !== "string" || !role.name.trim()) issues.push({ path: `${base}.name`, message: "é obrigatório." });
+    if (role.admin !== undefined && typeof role.admin !== "boolean") issues.push({ path: `${base}.admin`, message: "deve ser booleano." });
+    if (!Array.isArray(role.permissions)) {
+      issues.push({ path: `${base}.permissions`, message: "deve ser uma lista." });
+      return;
+    }
+    const seenRolePermissions = new Set();
+    role.permissions.forEach((permission, permissionIndex) => {
+      const path = `${base}.permissions[${permissionIndex}]`;
+      if (!isPermission(permission)) issues.push({ path, message: "permissão inválida." });
+      else if (permission !== "*" && !catalog.has(permission)) issues.push({ path, message: `permissão não declarada: ${permission}.` });
+      if (seenRolePermissions.has(permission)) issues.push({ path, message: `permissão duplicada: ${permission}.` });
+      seenRolePermissions.add(permission);
+    });
+    if (role.permissions.includes("*") && role.admin !== true) {
+      issues.push({ path: `${base}.admin`, message: "deve ser true quando o perfil usa wildcard (*)." });
+    }
+    if (role.admin === true || role.permissions.includes("*")) adminCount += 1;
+  });
+
+  if (!adminCount) issues.push({ path: "rbac.roles", message: "deve existir ao menos um perfil administrativo." });
+
+  if (rbac.invitationTtlHours !== undefined) {
+    if (!Number.isInteger(rbac.invitationTtlHours) || rbac.invitationTtlHours < 1 || rbac.invitationTtlHours > 720) {
+      issues.push({ path: "rbac.invitationTtlHours", message: "deve ser inteiro entre 1 e 720 horas." });
+    }
+  }
+}
+
+module.exports = { validateRbac };