@oondemand/oon-core-back 0.4.1 → 0.4.2

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@oondemand/oon-core-back",
-  "version": "0.4.1",
+  "version": "0.4.2",
   "repository": {
     "type": "git",
     "url": "git+https://github.com/oondemand/oon-platform.git",

package/src/api/activation.routes.js

@@ -18,6 +18,7 @@ const {
   validateRootCredentials,
   encrypt,
   instanceHeaders,
+  operationalIdentity,
   validateParams,
   providerPost,
   providerPayload,
@@ -83,13 +84,11 @@ function safeContext(data) {
 
 function requireRootBootstrapResult(result) {
   const usuarioId = result?.usuario?.id || result?.usuario?._id;
-  const tenantId = result?.tenant?.id || result?.tenant?._id;
   const appId = result?.app?.id || result?.app?._id;
-  const licencaId = result?.licenca?.id || result?.licenca?._id;
 
-  if (!usuarioId || !tenantId || !appId || !licencaId) {
+  if (!usuarioId || !appId) {
     throw new GenericError(
-      "O bootstrap root não retornou a estrutura mínima do ecossistema.",
+      "O bootstrap root não retornou Usuario e App de sistema.",
       { statusCode: 500 },
     );
   }
@@ -106,9 +105,8 @@ function requireRootBootstrapResult(result) {
 
   return {
     usuarioId: String(usuarioId),
-    tenantId: String(tenantId),
     appId: String(appId),
-    licencaId: String(licencaId),
+    systemAccessId: idOf(result?.systemAccess) ? String(idOf(result.systemAccess)) : undefined,
   };
 }
 
@@ -141,11 +139,17 @@ function idOf(value) {
   return value?.id || value?._id || value;
 }
 
-function summarizeDevInstance(data, appCode) {
+function summarizeOperationalIdentity(data, appCode, { allowSynthetic = false } = {}) {
   const appId = idOf(data?.app);
+  const deploymentId = idOf(data?.deployment);
+  const instanceId = idOf(data?.instancia || data?.instance);
   return {
-    instanceId: `dev-local:${appId || appCode}`,
-    instanceCode: "dev-local",
+    instanceId: instanceId ? String(instanceId) : (allowSynthetic ? `dev-local:${appId || appCode}` : undefined),
+    instanceCode: data?.instancia?.codigo || data?.instance?.codigo || (allowSynthetic ? "dev-local" : undefined),
+    deploymentId: deploymentId ? String(deploymentId) : undefined,
+    bindingId: idOf(data?.binding) ? String(idOf(data.binding)) : undefined,
+    entitlementId: idOf(data?.entitlement) ? String(idOf(data.entitlement)) : undefined,
+    credentialType: deploymentId ? "deployment" : "instance",
     appId: appId ? String(appId) : undefined,
     tenantId: idOf(data?.tenant) ? String(idOf(data.tenant)) : undefined,
     licencaId: idOf(data?.licenca) ? String(idOf(data.licenca)) : undefined,
@@ -171,7 +175,7 @@ router.get(
     const canActivateMember =
       instance.ecosystemRole === "member" &&
       ["nao_ativada", "erro"].includes(instance.status) &&
-      !instance.instanceId;
+      !operationalIdentity(instance);
 
     sendResponse({
       res,
@@ -182,7 +186,7 @@ router.get(
       podeAtivar: canActivateRoot || canActivateMember,
       podeTentarNovamente:
         instance.ecosystemRole === "member" &&
-        Boolean(instance.instanceId) &&
+        Boolean(operationalIdentity(instance)) &&
         ["configurando", "erro"].includes(instance.status),
       motivoSuspensao: instance.motivoSuspensao,
       motivoRevogacao: instance.motivoRevogacao,
@@ -284,14 +288,14 @@ router.post(
         instanceCode: result.instanceCode || "root",
         appCode: getAppCode(),
         appId: ids.appId,
-        tenantId: ids.tenantId,
-        licencaId: ids.licencaId,
+        tenantId: undefined,
+        licencaId: undefined,
         ambiente: ambiente(),
         nomeInstancia: ctx.config.name || ctx.config.slug || getAppCode(),
         publicUrl: publicUrl(req),
-        tenant: result.tenant,
         app: result.app,
-        licenca: result.licenca,
+        tenant: undefined,
+        licenca: undefined,
         parametrosGlobais: {},
         parametrosAplicacao: {},
         configurationVersion: config.configurationVersion,
@@ -389,6 +393,13 @@ router.post(
           branch: req.body?.branch,
           nomeUsuario: req.body?.nomeUsuario,
           nomeTenant: req.body?.nomeTenant,
+          ecosystemRole: ctx.config.ecosystem?.role,
+          tenancyModel: ctx.config.tenancyModel || ctx.config.ecosystem?.tenancyModel,
+          availability: ctx.config.availability || ctx.config.ecosystem?.availability,
+          accessMode: ctx.config.accessMode || ctx.config.ecosystem?.accessMode,
+          authorizationMode:
+            ctx.config.authorizationMode || ctx.config.ecosystem?.authorizationMode,
+          deploymentMode: ctx.config.deploymentMode || ctx.config.ecosystem?.deploymentMode,
         },
         { Authorization: authorization },
       );
@@ -399,7 +410,8 @@ router.post(
       const resolvedAppCode = String(
         data.app?.codigo || data.appCode || appCode,
       ).toLowerCase();
-      const ids = summarizeDevInstance(data, resolvedAppCode);
+      const ids = summarizeOperationalIdentity(data, resolvedAppCode, { allowSynthetic: true });
+      const operationalToken = data?.credencial?.token || data?.deploymentCredential?.token;
       const now = new Date();
 
       Object.assign(instance, {
@@ -407,6 +419,10 @@ router.post(
         ecosystemRole: "member",
         instanceId: ids.instanceId,
         instanceCode: ids.instanceCode,
+        deploymentId: ids.deploymentId,
+        bindingId: ids.bindingId,
+        entitlementId: ids.entitlementId,
+        credentialType: ids.credentialType,
         appCode: resolvedAppCode,
         appId: ids.appId,
         tenantId: ids.tenantId,
@@ -417,13 +433,22 @@ router.post(
         publicUrl: urlPublica,
         coreVersion: process.env.npm_package_version || "0.0.0",
         appVersion: process.env.SERVICE_VERSION || "0.1.0",
-        credentialEncrypted: undefined,
-        credentialIv: undefined,
-        credentialAuthTag: undefined,
-        credentialVersion: undefined,
+        ...(operationalToken ? encrypt(operationalToken) : {
+          credentialEncrypted: undefined,
+          credentialIv: undefined,
+          credentialAuthTag: undefined,
+        }),
+        credentialVersion:
+          data?.credencial?.versao ||
+          data?.credencial?.version ||
+          data?.deploymentCredential?.versao ||
+          data?.deploymentCredential?.version,
         tenant: data.tenant,
         app: data.app,
         licenca: data.licenca,
+        deployment: data.deployment,
+        binding: data.binding,
+        entitlement: data.entitlement,
         parametrosGlobais: {
           ...globalDefaults,
           nomeInstancia: nomeCentral,
@@ -455,6 +480,7 @@ router.post(
         sucesso: true,
         status: "ativa",
         instanceId: instance.instanceId,
+        deploymentId: instance.deploymentId,
       });
     } catch (error) {
       instance.status = "erro";
@@ -550,7 +576,7 @@ router.post(
     const instance = await ensureInstance();
 
     if (
-      instance.instanceId &&
+      operationalIdentity(instance) &&
       ["configurando", "erro"].includes(instance.status)
     ) {
       return res.redirect(307, "/ativacao/tentar-novamente");
@@ -589,8 +615,9 @@ router.post(
     );
     assertApp(activated.data);
 
-    const token = activated.data?.credencial?.token;
-    if (!activated.data?.instancia?.id || !token) {
+    const token = activated.data?.credencial?.token || activated.data?.deploymentCredential?.token;
+    const ids = summarizeOperationalIdentity(activated.data, getAppCode());
+    if (!(ids.deploymentId || ids.instanceId) || !token) {
       throw new GenericError("Resposta de ativação inválida.", {
         statusCode: 502,
       });
@@ -598,9 +625,17 @@ router.post(
 
     Object.assign(instance, encrypt(token), {
       status: "configurando",
-      instanceId: activated.data.instancia.id,
-      instanceCode: activated.data.instancia.codigo,
-      credentialVersion: activated.data.credencial.versao,
+      instanceId: ids.instanceId,
+      instanceCode: ids.instanceCode,
+      deploymentId: ids.deploymentId,
+      bindingId: ids.bindingId,
+      entitlementId: ids.entitlementId,
+      credentialType: ids.credentialType,
+      credentialVersion:
+        activated.data.credencial?.versao ||
+        activated.data.credencial?.version ||
+        activated.data.deploymentCredential?.versao ||
+        activated.data.deploymentCredential?.version,
       appCode: getAppCode(),
       appId: activated.data.app?.id || preview.data?.app?.id,
       tenantId: activated.data.tenant?.id || preview.data?.tenant?.id,
@@ -611,6 +646,9 @@ router.post(
       tenant: activated.data.tenant || preview.data?.tenant,
       app: activated.data.app || preview.data?.app,
       licenca: activated.data.licenca || preview.data?.licenca,
+      deployment: activated.data.deployment || preview.data?.deployment,
+      binding: activated.data.binding || preview.data?.binding,
+      entitlement: activated.data.entitlement || preview.data?.entitlement,
       parametrosGlobais,
       parametrosAplicacao,
       configurationVersion: config.configurationVersion,
@@ -629,6 +667,7 @@ router.post(
       sucesso: true,
       status: "ativa",
       instanceId: instance.instanceId,
+      deploymentId: instance.deploymentId,
     });
   }),
 );
@@ -687,7 +726,7 @@ router.post(
     const config = activationConfig();
 
     if (
-      !instance.instanceId ||
+      !operationalIdentity(instance) ||
       !["configurando", "erro"].includes(instance.status)
     ) {
       throw new GenericError(

package/src/api/auth.routes.js

@@ -15,6 +15,7 @@ const {
 } = require("../core/utils/activationProvider");
 
 const DEV_ACTIVATION_PATH = "/integracao/dev-local/ativar-central";
+const TENANT_HEADER = "x-oon-tenant-id";
 const router = express.Router();
 
 function readBasicAuthorization(req) {
@@ -41,6 +42,15 @@ function translateProviderError(error) {
   return new GenericError(message, { statusCode });
 }
 
+function tenantForLogin(req, instance) {
+  const tenancyModel =
+    ctx.config.tenancyModel || ctx.config.ecosystem?.tenancyModel;
+  if (tenancyModel === "multi_tenant") {
+    return req.headers[TENANT_HEADER] || instance.tenantId;
+  }
+  return instance.tenantId;
+}
+
 async function authenticateRoot(req, res, authorization, instance) {
   const authenticate = ctx.config.auth?.authenticate;
   if (instance.ecosystemRole === "root" && typeof authenticate === "function") {
@@ -62,6 +72,7 @@ router.post(
     if (await authenticateRoot(req, res, authorization, instance)) return;
     const baseUrl = getBaseUrl(req);
     const appCode = getAppCode();
+    const tenantId = tenantForLogin(req, instance);
     try {
       const response = await axios.post(
         `${baseUrl}${LOGIN_PATH}`,
@@ -73,6 +84,7 @@ router.post(
             Authorization: authorization,
             "Content-Type": "application/json",
             "x-app-code": appCode,
+            ...(tenantId ? { [TENANT_HEADER]: tenantId } : {}),
           },
         },
       );
@@ -104,6 +116,13 @@ router.post(
           branch: req.body?.branch,
           nomeUsuario: req.body?.nomeUsuario,
           nomeTenant: req.body?.nomeTenant,
+          ecosystemRole: ctx.config.ecosystem?.role,
+          tenancyModel: ctx.config.tenancyModel || ctx.config.ecosystem?.tenancyModel,
+          availability: ctx.config.availability || ctx.config.ecosystem?.availability,
+          accessMode: ctx.config.accessMode || ctx.config.ecosystem?.accessMode,
+          authorizationMode:
+            ctx.config.authorizationMode || ctx.config.ecosystem?.authorizationMode,
+          deploymentMode: ctx.config.deploymentMode || ctx.config.ecosystem?.deploymentMode,
         },
         {
           timeout: getTimeout(),

package/src/core/models/InstanciaEcossistema.js

@@ -10,6 +10,10 @@ const schema = new mongoose.Schema(
     ecosystemRole: { type: String, enum: roles, default: "member", index: true },
     instanceId: { type: String, index: true },
     instanceCode: String,
+    deploymentId: { type: String, index: true },
+    bindingId: String,
+    entitlementId: String,
+    credentialType: { type: String, enum: ["instance", "deployment"] },
     appCode: { type: String, index: true },
     appId: String,
     tenantId: String,
@@ -30,6 +34,9 @@ const schema = new mongoose.Schema(
     parametrosAplicacao: { type: mongoose.Schema.Types.Mixed, default: {} },
     tenant: { type: mongoose.Schema.Types.Mixed, default: {} },
     app: { type: mongoose.Schema.Types.Mixed, default: {} },
+    deployment: { type: mongoose.Schema.Types.Mixed, default: {} },
+    binding: { type: mongoose.Schema.Types.Mixed, default: {} },
+    entitlement: { type: mongoose.Schema.Types.Mixed, default: {} },
     licenca: { type: mongoose.Schema.Types.Mixed, default: {} },
     ativadaEm: Date,
     concluidaEm: Date,

package/src/core/rbac/identityProvider.js

@@ -5,6 +5,7 @@ const GenericError = require("../errors/GenericError");
 const {
   ensureInstance,
   instanceHeaders,
+  operationalIdentity,
   providerPost,
 } = require("../utils/instanceActivation");
 
@@ -15,10 +16,10 @@ const IDENTITY_PATHS = Object.freeze({
 
 async function defaultProviderCall(req, path, payload) {
   const instance = await ensureInstance();
-  if (!instance?.instanceId || !instance?.credentialEncrypted) {
-    throw new GenericError("A instância precisa estar ativa para gerenciar identidades.", {
+  if (!operationalIdentity(instance) || !instance?.credentialEncrypted) {
+    throw new GenericError("O deployment precisa estar ativo para gerenciar identidades.", {
       statusCode: 423,
-      code: "RBAC_INSTANCE_CREDENTIAL_REQUIRED",
+      code: "RBAC_OPERATIONAL_CREDENTIAL_REQUIRED",
     });
   }
 
@@ -43,6 +44,7 @@ async function provisionInvitation({ req, invitation, password }) {
   return defaultProviderCall(req, IDENTITY_PATHS.provisionInvitation, {
     email: invitation.email,
     nome: invitation.name,
+    roleCode: invitation.roleCode,
     password,
     invitationFingerprint: invitation.tokenFingerprint,
   });

package/src/core/utils/instanceActivation.js

@@ -217,6 +217,10 @@ async function domainHasActiveRootApp() {
 function clearInstanceIdentity(instance) {
   instance.instanceId = undefined;
   instance.instanceCode = undefined;
+  instance.deploymentId = undefined;
+  instance.bindingId = undefined;
+  instance.entitlementId = undefined;
+  instance.credentialType = undefined;
   instance.appId = undefined;
   instance.tenantId = undefined;
   instance.licencaId = undefined;
@@ -393,6 +397,14 @@ function decrypt(instance) {
 }
 
 function instanceHeaders(instance) {
+  if (instance.deploymentId) {
+    return {
+      "x-oon-deployment-id": instance.deploymentId,
+      "x-oon-deployment-token": decrypt(instance),
+      "x-app-code": getAppCode(),
+      ...(instance.tenantId ? { "x-oon-tenant-id": instance.tenantId } : {}),
+    };
+  }
   return {
     "x-oon-instance-id": instance.instanceId,
     "x-oon-instance-token": decrypt(instance),
@@ -400,6 +412,10 @@ function instanceHeaders(instance) {
   };
 }
 
+function operationalIdentity(instance) {
+  return instance?.deploymentId || instance?.instanceId;
+}
+
 function validateUrl(value) {
   const url = new URL(value);
   if (!["http:", "https:"].includes(url.protocol)) throw new Error();
@@ -468,6 +484,11 @@ function providerPayload(req, codigoAtivacao, extra = {}) {
     coreVersion: version(),
     appVersion: version(),
     fingerprint: fingerprint(),
+    tenancyModel: ctx.config.tenancyModel || ctx.config.ecosystem?.tenancyModel,
+    availability: ctx.config.availability || ctx.config.ecosystem?.availability,
+    accessMode: ctx.config.accessMode || ctx.config.ecosystem?.accessMode,
+    authorizationMode: ctx.config.authorizationMode || ctx.config.ecosystem?.authorizationMode,
+    deploymentMode: ctx.config.deploymentMode || ctx.config.ecosystem?.deploymentMode,
     ...extra,
   };
 }
@@ -491,6 +512,7 @@ module.exports = {
   encrypt,
   decrypt,
   instanceHeaders,
+  operationalIdentity,
   validateParams,
   providerPost,
   providerPayload,

package/src/manifest/appManifest.js

@@ -14,6 +14,9 @@ const SUPPORTED_MODULES = Object.freeze([
 ]);
 const SUPPORTED_TENANCY_MODELS = Object.freeze(["none", "single_tenant", "multi_tenant"]);
 const SUPPORTED_AVAILABILITIES = Object.freeze(["system", "common", "licensed"]);
+const SUPPORTED_ACCESS_MODES = Object.freeze(["tenant_members", "explicit_users"]);
+const SUPPORTED_AUTHORIZATION_MODES = Object.freeze(["none", "rbac"]);
+// Compatibilidade de leitura para manifestos anteriores à separação das duas dimensões.
 const SUPPORTED_ACCESS_POLICIES = Object.freeze(["tenant_members", "explicit_users", "rbac"]);
 const SUPPORTED_DEPLOYMENT_MODES = Object.freeze(["singleton", "shared", "dedicated", "hybrid"]);
 const APP_KIND_ROLE = Object.freeze({
@@ -25,19 +28,22 @@ const APP_KIND_DIMENSIONS = Object.freeze({
   "root-central": Object.freeze({
     tenancyModel: "none",
     availability: "system",
-    accessPolicy: "rbac",
+    accessMode: "explicit_users",
+    authorizationMode: "rbac",
     deploymentMode: "singleton",
   }),
   "member-central": Object.freeze({
     tenancyModel: "single_tenant",
     availability: "licensed",
-    accessPolicy: "rbac",
+    accessMode: "explicit_users",
+    authorizationMode: "rbac",
     deploymentMode: "dedicated",
   }),
   "portal-cockpit": Object.freeze({
     tenancyModel: "multi_tenant",
     availability: "common",
-    accessPolicy: "tenant_members",
+    accessMode: "tenant_members",
+    authorizationMode: "none",
     deploymentMode: "shared",
   }),
 });
@@ -136,12 +142,22 @@ function validateDimension(value, field, supported, issues) {
   }
 }
 
+function legacyAccessDimensions(accessPolicy) {
+  return {
+    tenant_members: { accessMode: "tenant_members", authorizationMode: "none" },
+    explicit_users: { accessMode: "explicit_users", authorizationMode: "none" },
+    rbac: { accessMode: "explicit_users", authorizationMode: "rbac" },
+  }[accessPolicy];
+}
+
 function dimensionsFor(manifest) {
   const defaults = APP_KIND_DIMENSIONS[manifest.appKind] || APP_KIND_DIMENSIONS["member-central"];
+  const legacy = legacyAccessDimensions(manifest.accessPolicy) || {};
   return {
     tenancyModel: manifest.tenancyModel || defaults.tenancyModel,
     availability: manifest.availability || defaults.availability,
-    accessPolicy: manifest.accessPolicy || defaults.accessPolicy,
+    accessMode: manifest.accessMode || legacy.accessMode || defaults.accessMode,
+    authorizationMode: manifest.authorizationMode || legacy.authorizationMode || defaults.authorizationMode,
     deploymentMode: manifest.deploymentMode || defaults.deploymentMode,
   };
 }
@@ -153,7 +169,7 @@ function validateAppManifest(input, { coreVersion = corePackage.version } = {})
   }
   const allowedTopLevel = new Set([
     "$schema", "schemaVersion", "id", "name", "slug", "appKind",
-    "tenancyModel", "availability", "accessPolicy", "deploymentMode",
+    "tenancyModel", "availability", "accessMode", "authorizationMode", "accessPolicy", "deploymentMode",
     "modules", "capabilities", "compatibility", "activation", "rbac",
   ]);
   for (const key of Object.keys(input)) {
@@ -174,8 +190,30 @@ function validateAppManifest(input, { coreVersion = corePackage.version } = {})
   }
   validateDimension(input.tenancyModel, "tenancyModel", SUPPORTED_TENANCY_MODELS, issues);
   validateDimension(input.availability, "availability", SUPPORTED_AVAILABILITIES, issues);
+  validateDimension(input.accessMode, "accessMode", SUPPORTED_ACCESS_MODES, issues);
+  validateDimension(input.authorizationMode, "authorizationMode", SUPPORTED_AUTHORIZATION_MODES, issues);
   validateDimension(input.accessPolicy, "accessPolicy", SUPPORTED_ACCESS_POLICIES, issues);
   validateDimension(input.deploymentMode, "deploymentMode", SUPPORTED_DEPLOYMENT_MODES, issues);
+  if (input.accessPolicy !== undefined && (input.accessMode !== undefined || input.authorizationMode !== undefined)) {
+    addIssue(issues, "accessPolicy", "é legado e não pode ser combinado com accessMode/authorizationMode.");
+  }
+  const dimensions = dimensionsFor(input);
+  const role = APP_KIND_ROLE[input.appKind];
+  if (role === "root" && (
+    dimensions.tenancyModel !== "none" ||
+    dimensions.availability !== "system" ||
+    dimensions.accessMode !== "explicit_users" ||
+    dimensions.authorizationMode !== "rbac" ||
+    dimensions.deploymentMode !== "singleton"
+  )) {
+    addIssue(issues, "appKind", "root-central exige none/system/explicit_users/rbac/singleton.");
+  }
+  if (role === "member" && dimensions.availability === "system") {
+    addIssue(issues, "availability", "Apps member não podem usar availability=system.");
+  }
+  if (dimensions.tenancyModel === "none" && dimensions.accessMode === "tenant_members") {
+    addIssue(issues, "accessMode", "tenant_members exige uma aplicação tenant-aware.");
+  }
   if (!isPlainObject(input.modules)) {
     addIssue(issues, "modules", "deve ser um objeto.");
   } else {
@@ -218,6 +256,7 @@ function appManifestToConfig(manifest, manifestPath) {
     slug: manifest.slug,
     appCode: manifest.id,
     appKind: manifest.appKind,
+    ...dimensions,
     ecosystem: {
       role: APP_KIND_ROLE[manifest.appKind],
       ...dimensions,
@@ -260,12 +299,15 @@ module.exports = {
   SUPPORTED_MODULES,
   SUPPORTED_TENANCY_MODELS,
   SUPPORTED_AVAILABILITIES,
+  SUPPORTED_ACCESS_MODES,
+  SUPPORTED_AUTHORIZATION_MODES,
   SUPPORTED_ACCESS_POLICIES,
   SUPPORTED_DEPLOYMENT_MODES,
   APP_KIND_DIMENSIONS,
   AppManifestError,
   parseVersion,
   compareVersions,
+  legacyAccessDimensions,
   dimensionsFor,
   validateAppManifest,
   resolveAppManifestPath,