@oondemand/oon-core-back 0.7.6 → 0.7.9

package/README.md

@@ -97,3 +97,39 @@ O Core omite todo o corpo de entrada e resposta no `requestLog` para esse métod
 ## Segredos V1 (0.7.6)
 
 `capabilities.secrets.put/status/use/remove` armazena objetos cifrados para Apps single_tenant dedicados. Declare `core.secrets` e `capabilitySettings["core.secrets"]={enabled:true}`. Rotas exigem permissão e sensitiveBody; use `req.accessContext`. Chave provisionada fora do banco, preservada em republicações. Veja o guia distribuído `SECRETS.md` para assinaturas, limites e recadastro explícito.
+
+
+### Aceite de convite (C2, SDK 0.7.7)
+
+`PUBLIC_APP_URL` deve conter a origem pública HTTPS do aplicativo, sem credenciais,
+query, fragmento ou subcaminho. HTTP é permitido apenas em loopback fora de produção.
+A configuração é validada antes de emitir/rotacionar o convite; o header Host não
+é usado como destino. Novos links usam `/accept-invite#token=...`.
+
+O frontend consulta `POST /core/invitations/inspect` com `{ token }`. Somente um
+convite pendente válido permite consultar a existência da identidade. O aceite
+usa `POST /core/invitations/accept` com `{ token, intent, password? }`:
+`authenticate` verifica a senha atual; `register` cria uma identidade com senha
+nova; `session` exige uma sessão válida do destinatário. Nenhum desses caminhos
+redefine a senha de uma identidade existente. Recuperação de senha continua no
+login da plataforma. O retorno após aceite é local e fixo, sem aceitar redirect
+arbitrário. Os endpoints antigos continuam disponíveis até o cutover coordenado.
+
+Provedores locais devem fornecer `auth.inspectInvitation({ req, invitation })`,
+retornando `{ accountExists: boolean, sessionUser?: { id, email } | null }`, além de
+`auth.provisionInvitation`. A sessão opcional deve ser validada como identidade
+(assinatura, expiração, versão de credencial e escopo), sem exigir o acesso que
+o convite ainda concederá. Uma sessão inválida retorna `sessionUser: null`.
+O provisionamento recebe também `intent` e deve verificar a prova correspondente,
+retornando `usuario` com `id` e `email` do destinatário. Sem hook de inspeção,
+um provedor local falha fechado e nunca delega identidades administrativas ao
+provedor de aplicativos.
+
+Publicar primeiro o suporte da Central (consulta e prova de identidade), depois
+lançar front/back do SDK juntos e atualizar consumidores. O bloqueio de integração
+comercial permanece até C3a/C3b; C2 não executa cutover nem reenvia convites.
+
+
+## Contenção MongoDB
+
+O backend governa o pool e os timeouts dos métodos Mongoose cobertos. Veja a [política distribuída](../create-central-oon/docs/DATABASE_CONTAINMENT.md) e as [evidências/gates de adoção](../../docs/database-containment-validation.md). A release precisa ser adotada e republicada por cada consumidor; não fornece isolamento físico nem limite global do cluster.

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@oondemand/oon-core-back",
-  "version": "0.7.6",
+  "version": "0.7.9",
   "repository": {
     "type": "git",
     "url": "git+https://github.com/oondemand/oon-platform.git",

package/src/api/access.routes.js

@@ -22,9 +22,10 @@ const {
   recoverPendingInvitation,
   assertNotLastAdmin,
 } = require("../core/rbac/storage");
-const { provisionInvitation } = require("../core/rbac/identityProvider");
+const { provisionInvitation, inspectInvitation } = require("../core/rbac/identityProvider");
 
 const router = express.Router();
+router.use(require("../core/rbac/centralInvitations").createRouter({ inviteUrl }));
 
 function requiredRbac() {
   if (!policy().enabled) {
@@ -36,10 +37,16 @@ function requiredRbac() {
 }
 
 function inviteUrl(req, token) {
-  const base = String(
-    process.env.PUBLIC_APP_URL || `${req.protocol || "http"}://${req.get("host") || req.headers.host}`,
-  ).replace(/\/$/, "");
-  return `${base}/accept-invite?token=${encodeURIComponent(token)}`;
+  let base;
+  try {
+    base = new URL(String(process.env.PUBLIC_APP_URL || ""));
+    const local = ["localhost", "127.0.0.1", "[::1]"].includes(base.hostname);
+    if ((base.protocol !== "https:" && !(base.protocol === "http:" && local && process.env.NODE_ENV !== "production"))
+      || base.username || base.password || base.search || base.hash || base.pathname !== "/") throw new Error();
+  } catch {
+    throw new GenericError("Configure PUBLIC_APP_URL com a origem HTTPS pública deste aplicativo.", { statusCode: 503, code: "INVITATION_PUBLIC_URL_INVALID" });
+  }
+  return `${base.origin}/accept-invite#token=${encodeURIComponent(token)}`;
 }
 
 function invitationView(invitation) {
@@ -139,6 +146,7 @@ router.post(
   asyncHandler(async (req, res) => {
     requiredRbac();
     const role = assertAssignable(req.usuario, req.body?.roleCode);
+    inviteUrl(req, ""); // Validate configuration before creating or rotating a token.
     const result = await createInvitation({
       email: req.body?.email,
       name: req.body?.name,
@@ -192,6 +200,7 @@ router.post(
     const previous = await Invitation.findOne({ _id: req.params.id, appCode: appCode() });
     if (!previous) throw new GenericError("Convite não encontrado.", { statusCode: 404 });
     assertAssignable(req.usuario, previous.roleCode);
+    inviteUrl(req, ""); // Validate configuration before creating or rotating a token.
     const result = await createInvitation({
       email: previous.email,
       name: previous.name,
@@ -277,11 +286,9 @@ router.patch(
   }),
 );
 
-router.get(
-  "/invitations/:token",
-  asyncHandler(async (req, res) => {
+const inspectHandler = asyncHandler(async (req, res) => {
     requiredRbac();
-    const invitation = await findInvitationByToken(req.params.token);
+    const invitation = await findInvitationByToken(req.params.token || req.body?.token);
     if (!invitation || invitation.status !== "pending") {
       throw new GenericError("Convite inválido, expirado ou já utilizado.", {
         statusCode: 410,
@@ -289,8 +296,12 @@ router.get(
       });
     }
     res.set("Cache-Control", "no-store");
+    const identity = await inspectInvitation({ req, invitation });
+    if (typeof identity?.accountExists !== "boolean") throw new GenericError("Resposta inválida do provedor de identidade.", { statusCode: 502 });
     res.json({
       invitation: {
+        accountExists: identity.accountExists,
+        sessionUser: identity.sessionUser || null,
         email: invitation.email,
         name: invitation.name,
         roleCode: invitation.roleCode,
@@ -298,19 +309,23 @@ router.get(
         expiresAt: invitation.expiresAt,
       },
     });
-  }),
-);
+  });
+router.get("/invitations/:token", inspectHandler);
+router.post("/invitations/inspect", inspectHandler);
 
-router.post(
-  "/invitations/:token/accept",
-  asyncHandler(async (req, res) => {
+const acceptHandler = asyncHandler(async (req, res) => {
     requiredRbac();
     const password = String(req.body?.password || "");
-    if (password.length < 8) {
-      throw new GenericError("A nova senha deve possuir pelo menos 8 caracteres.", { statusCode: 422 });
+    const intent = req.body?.intent;
+    if (intent !== undefined && !["register", "authenticate", "session"].includes(intent)) {
+      throw new GenericError("Forma de autenticação inválida.", { statusCode: 422 });
+    }
+    if ((intent === "register" || intent === undefined) && password.length < 8) {
+      throw new GenericError("A senha de cadastro deve possuir pelo menos 8 caracteres.", { statusCode: 422 });
     }
+    if (intent !== "session" && !password) throw new GenericError("Informe a senha.", { statusCode: 422 });
 
-    const invitation = await findInvitationByToken(req.params.token);
+    const invitation = await findInvitationByToken(req.params.token || req.body?.token);
     if (!invitation || invitation.status !== "pending") {
       throw new GenericError("Convite inválido, expirado ou já utilizado.", {
         statusCode: 410,
@@ -324,8 +339,12 @@ router.post(
       throw new GenericError("O acesso associado ao convite não está mais disponível.", { statusCode: 410 });
     }
 
-    const identity = await provisionInvitation({ req, invitation, password });
+    const identity = await provisionInvitation({ req, invitation, password, intent });
     const providerUser = identity?.usuario || identity?.user || identity;
+    if (!providerUser?.email || String(providerUser.email).trim().toLowerCase() !== invitation.email.toLowerCase()
+      || !(providerUser.id || providerUser._id)) {
+      throw new GenericError("Identidade retornada não corresponde ao convite.", { statusCode: 502, code: "INVITATION_IDENTITY_MISMATCH" });
+    }
     access.identityId = String(providerUser?.id || providerUser?._id || access.identityId || "") || undefined;
     access.name = providerUser?.nome || providerUser?.name || access.name;
     access.status = "active";
@@ -347,11 +366,12 @@ router.post(
 
     res.set("Cache-Control", "no-store");
     res.json({
-      message: "Convite aceito. A nova senha foi definida e o acesso está ativo.",
+      message: "Convite aceito. O acesso está ativo.",
       email: access.email,
     });
-  }),
-);
+  });
+router.post("/invitations/:token/accept", acceptHandler);
+router.post("/invitations/accept", acceptHandler);
 
 module.exports = router;
 module.exports.inviteUrl = inviteUrl;

package/src/api/status.routes.js

@@ -1,7 +1,7 @@
 "use strict";
 
 const express = require("express");
-const mongoose = require("mongoose");
+const mongoose = require("../core/database/mongoose");
 const ctx = require("../core/context");
 const { runtimeSummary } = require("./core.routes");
 const { isLocalRuntime, localRuntimeSummary } = require("../core/runtime/localDevelopment");
@@ -79,3 +79,4 @@ module.exports = router;
 module.exports.databaseState = databaseState;
 module.exports.readinessSummary = readinessSummary;
 module.exports.versionSummary = versionSummary;
+

package/src/boot/database.js

@@ -1,5 +1,8 @@
-const mongoose = require("mongoose");
+const mongoose = require("../core/database/mongoose");
 const registry = require("../core/registry");
+const ctx = require("../core/context");
+const { DEFAULTS, poolOptions } = require("../core/database/policy");
+const { attachPoolMetrics } = require("../core/database/metrics");
 
 function buildMongoUri() {
   const cfg = {
@@ -20,7 +23,8 @@ function buildMongoUri() {
 }
 
 function connectionOptions() {
-  if (process.env.MONGO_URI) return {};
+  const pool = poolOptions();
+  if (process.env.MONGO_URI) return pool;
 
   const hasUser = Boolean(process.env.DB_USER);
   const hasPassword = Boolean(process.env.DB_PASSWORD);
@@ -30,8 +34,8 @@ function connectionOptions() {
   }
 
   return hasUser
-    ? { user: process.env.DB_USER, pass: process.env.DB_PASSWORD }
-    : {};
+    ? { ...pool, user: process.env.DB_USER, pass: process.env.DB_PASSWORD }
+    : pool;
 }
 
 function databaseLabel(uri) {
@@ -71,7 +75,21 @@ async function syncDeclaredIndexes(entries = registry.listModels()) {
 
 async function connectDB() {
   const uri = buildMongoUri();
-  await mongoose.connect(uri, connectionOptions());
+  const options = connectionOptions();
+  // Explicit driver options override conflicting URI pool options; tested with the real driver.
+  const connecting = mongoose.connect(uri, options);
+  const client = mongoose.connection.getClient();
+  const metrics = client && attachPoolMetrics(client, mongoose.connection, {
+    app: ctx.config.appCode || ctx.config.slug || process.env.APP_CODE,
+    environment: process.env.APP_ENVIRONMENT || process.env.NODE_ENV,
+  });
+  try {
+    await connecting;
+  } catch (error) {
+    metrics?.dispose();
+    throw error;
+  }
+  console.log("[OonCore] database policy", JSON.stringify({ ...DEFAULTS, uncoveredModels: Object.values(mongoose.models).filter(model => !model.schema[Symbol.for("oon.database.policy.schema.v1")]).length }));
   await syncDeclaredIndexes();
   console.log(`Conectado ao MongoDB (${databaseLabel(uri)})`);
   return mongoose.connection;
@@ -85,3 +103,4 @@ module.exports = {
   shouldSyncDeclaredIndexes,
   syncDeclaredIndexes,
 };
+

package/src/capabilities/secrets/index.js

@@ -1,6 +1,6 @@
 "use strict";
 const crypto = require("node:crypto");
-const mongoose = require("mongoose");
+const mongoose = require("../../core/database/mongoose");
 const ctx = require("../../core/context");
 const GenericError = require("../../core/errors/GenericError");
 const MAX_BYTES = 16384;
@@ -111,3 +111,4 @@ async function remove({ name, context, correlationId } = {}) {
   return safe(async () => { const s = resolveScope(context, name); await audit("remove", s, context, correlationId); await models().Secret.deleteOne({ _id: id(s) }); return { state: "absent" }; });
 }
 module.exports = Object.freeze({ put, status, use, remove });
+

package/src/capabilities/transactionalEmail/models.js

@@ -1,6 +1,6 @@
 "use strict";
 
-const mongoose = require("mongoose");
+const mongoose = require("../../core/database/mongoose");
 
 const envelope = { keyId: String, version: Number, algorithm: String, iv: String, authTag: String, ciphertext: String };
 const common = { scopeKey: { type: String, required: true, index: true } };
@@ -19,3 +19,4 @@ function getModels() {
 }
 async function syncIndexes() { const models = getModels(); return Promise.all(Object.values(models).map((entry) => entry.syncIndexes())); }
 module.exports = { getModels, syncIndexes };
+

package/src/core/database/errors.js

@@ -0,0 +1,15 @@
+"use strict";
+
+function databaseError(error) {
+  if (error?.name === "MongoWaitQueueTimeoutError") return {
+    code: "DATABASE_POOL_BUSY", statusCode: 503,
+    message: "O banco está ocupado. Aguarde antes de tentar novamente.",
+  };
+  if (error?.code === 50 && error?.name === "MongoServerError") return {
+    code: "DATABASE_OPERATION_TIMEOUT", statusCode: 504,
+    message: "A operação excedeu o tempo permitido. Consulte o estado antes de repetir uma alteração.",
+  };
+  return null;
+}
+
+module.exports = { databaseError };

package/src/core/database/metrics.js

@@ -0,0 +1,66 @@
+"use strict";
+
+const monitors = new WeakMap();
+const connections = new WeakMap();
+
+function observeOperationError(connection, error) {
+  if (error?.name === "MongoServerError" && error.code === 50) {
+    const monitor = connections.get(connection);
+    if (monitor) monitor.operationTimeout();
+  }
+}
+
+function safeLabel(value) {
+  return typeof value === "string" && /^[a-zA-Z0-9_.-]{1,80}$/.test(value) ? value : "unknown";
+}
+
+function attachPoolMetrics(client, connection, { app, environment, emit = record => console.log("[OonCore] database", JSON.stringify(record)), intervalMS = 60000 } = {}) {
+  if (monitors.has(client)) return monitors.get(client);
+  const inUse = new Set();
+  let waiting = 0;
+  let counters;
+  const reset = () => { counters = { checkouts: 0, checkoutFailures: 0, checkoutTimeouts: 0, mongooseOperationTimeouts: 0, waitTotalMS: 0, waitMaxMS: 0, peakWaiting: waiting, peakInUse: inUse.size }; };
+  reset();
+  const key = event => `${event.address}/${event.connectionId}`;
+  const duration = event => {
+    const ms = Number.isFinite(event.durationMS) && event.durationMS >= 0 ? event.durationMS : 0;
+    counters.waitTotalMS += ms;
+    counters.waitMaxMS = Math.max(counters.waitMaxMS, ms);
+  };
+  const listeners = {
+    connectionCheckOutStarted() { waiting++; counters.peakWaiting = Math.max(counters.peakWaiting, waiting); },
+    connectionCheckedOut(event) { waiting = Math.max(0, waiting - 1); inUse.add(key(event)); counters.checkouts++; counters.peakInUse = Math.max(counters.peakInUse, inUse.size); duration(event); },
+    connectionCheckOutFailed(event) { waiting = Math.max(0, waiting - 1); counters.checkoutFailures++; if (event.reason === "timeout") counters.checkoutTimeouts++; duration(event); },
+    connectionCheckedIn(event) { inUse.delete(key(event)); },
+    connectionClosed(event) { inUse.delete(key(event)); },
+  };
+  for (const [event, listener] of Object.entries(listeners)) client.on(event, listener);
+  const snapshot = () => ({ app: safeLabel(app), environment: safeLabel(environment), pid: process.pid, intervalMS, inUse: inUse.size, waiting, ...counters });
+  const flush = () => {
+    if (counters.checkouts || counters.checkoutFailures || counters.mongooseOperationTimeouts || inUse.size || waiting) {
+      try { emit(snapshot()); } catch { /* Telemetry must never fail a database operation. */ }
+    }
+    reset();
+  };
+  const timer = setInterval(flush, intervalMS);
+  timer.unref();
+  let disposed = false;
+  const dispose = () => {
+    if (disposed) return;
+    disposed = true;
+    clearInterval(timer);
+    flush();
+    for (const [event, listener] of Object.entries(listeners)) client.removeListener(event, listener);
+    connection.removeListener("close", dispose);
+    monitors.delete(client);
+    if (connections.get(connection) === monitor) connections.delete(connection);
+    inUse.clear(); waiting = 0;
+  };
+  const monitor = { snapshot, flush, dispose, operationTimeout() { counters.mongooseOperationTimeouts++; } };
+  monitors.set(client, monitor);
+  connections.set(connection, monitor);
+  connection.once("close", dispose);
+  return monitor;
+}
+
+module.exports = { attachPoolMetrics, observeOperationError };

package/src/core/database/mongoose.js

@@ -0,0 +1,40 @@
+"use strict";
+
+const mongoose = require("mongoose");
+const { boundedMaxTimeMS } = require("./policy");
+const { observeOperationError } = require("./metrics");
+const INSTALLED = Symbol.for("oon.database.policy.installed.v1");
+const COVERED = Symbol.for("oon.database.policy.schema.v1");
+const QUERY_METHODS = Object.freeze([
+  "find", "findOne", "countDocuments", "estimatedDocumentCount", "distinct",
+  "findOneAndUpdate", "findOneAndReplace", "findOneAndDelete",
+  "updateOne", "updateMany", "replaceOne", "deleteOne", "deleteMany",
+]);
+
+function install(instance) {
+  if (instance[INSTALLED]) return;
+  instance[INSTALLED] = true;
+  instance.plugin(function databasePolicy(schema) {
+    if (schema[COVERED]) return;
+    schema[COVERED] = true;
+    for (const method of QUERY_METHODS) {
+      schema.pre(method, { query: true, document: false }, function applyQueryBudget() {
+        if (this.model.db === instance.connection) this.setOptions({ maxTimeMS: boundedMaxTimeMS(this.getOptions().maxTimeMS) });
+      });
+      schema.post(method, { query: true, document: false }, function observeQueryError(error, result, next) {
+        observeOperationError(this.model.db, error);
+        next(error);
+      });
+    }
+    schema.pre("aggregate", function applyAggregateBudget() {
+      if (this.model().db === instance.connection) this.option({ maxTimeMS: boundedMaxTimeMS(this.options.maxTimeMS) });
+    });
+    schema.post("aggregate", function observeAggregateError(error, result, next) {
+      observeOperationError(this.model().db, error);
+      next(error);
+    });
+  });
+}
+
+install(mongoose);
+module.exports = mongoose;

package/src/core/database/policy.js

@@ -0,0 +1,41 @@
+"use strict";
+
+// Versioned Core policy, deliberately not an app manifest/env extension point.
+// Initial calibration profile: not a claim of safe shared-cluster capacity.
+const DEFAULTS = Object.freeze({
+  maxPoolSize: 4,
+  minPoolSize: 0,
+  maxConnecting: 2,
+  waitQueueTimeoutMS: 2000,
+  maxTimeMS: 5000,
+});
+
+function configurationError() {
+  const error = new Error("Política de contenção MongoDB inválida.");
+  error.code = "DATABASE_POLICY_INVALID";
+  return error;
+}
+
+function validatePolicy(input = DEFAULTS) {
+  if (!input || typeof input !== "object" || Array.isArray(input)) throw configurationError();
+  const policy = { ...DEFAULTS, ...input };
+  if (Object.keys(policy).some(key => !Object.hasOwn(DEFAULTS, key))) throw configurationError();
+  for (const [key, value] of Object.entries(policy)) {
+    if (!Number.isSafeInteger(value) || value < (key === "minPoolSize" ? 0 : 1)) throw configurationError();
+  }
+  if (policy.minPoolSize > policy.maxPoolSize || policy.maxConnecting > policy.maxPoolSize) throw configurationError();
+  return Object.freeze(policy);
+}
+
+function poolOptions(policy = DEFAULTS) {
+  const { maxTimeMS, ...pool } = validatePolicy(policy);
+  return pool;
+}
+
+function boundedMaxTimeMS(value, ceiling = DEFAULTS.maxTimeMS) {
+  if (value === undefined || value === 0) return ceiling;
+  if (!Number.isSafeInteger(value) || value < 0) throw configurationError();
+  return Math.min(value, ceiling);
+}
+
+module.exports = { DEFAULTS, validatePolicy, poolOptions, boundedMaxTimeMS };

package/src/core/define.js

@@ -1,4 +1,4 @@
-const mongoose = require("mongoose");
+const mongoose = require("./database/mongoose");
 const express = require("express");
 const registry = require("./registry");
 const ctx = require("./context");
@@ -212,3 +212,4 @@ module.exports = {
   definePipeline,
   defineRoutes,
 };
+

package/src/core/fields.js

@@ -5,7 +5,7 @@
  * `__meta` é consumido pelo registry para gerar metadata/OpenAPI para o
  * front, sem vazar para o schema Mongoose final.
  */
-const mongoose = require("mongoose");
+const mongoose = require("./database/mongoose");
 
 const withMeta = (mongooseDef, meta) => ({
   ...mongooseDef,
@@ -93,3 +93,4 @@ module.exports = {
   currencyCode,
   currencyConverted,
 };
+

package/src/core/middlewares/auth.js

@@ -137,6 +137,14 @@ async function applyEffectiveAccess(usuario) {
       rbacMode: "app-commercial", commercialAccess: { ...authority,
         roleComplete: !local.includes("*") && local.every(p => permissions.includes(p)) } };
   }
+  if (usuario?.canonicalAccess && typeof ctx.config.auth?.verifyToken !== "function") {
+    const source = usuario.canonicalAccess;
+    const role = roleByCode(source.roleCode);
+    if (!source.grantId || source.tenantId !== usuario.tenantId || !role) {
+      throw Object.assign(Error("Concessão central inválida."), { statusCode: 403, code: "CENTRAL_ACCESS_INVALID" });
+    }
+    return { ...usuario, roleCode: role.code, permissions: rolePermissions(role), accessStatus: "active", mustChangePassword: false, rbacMode: "central-invitation" };
+  }
   const access = await resolveUserAccess(usuario);
   return {
     ...usuario,

package/src/core/middlewares/error.js

@@ -1,3 +1,4 @@
+const { databaseError } = require("../database/errors");
 const helpers = require("../utils/helpers");
 const GenericError = require("../errors/GenericError");
 
@@ -74,6 +75,16 @@ const errorMiddleware = (error, req, res, next) => {
     });
   }
 
+  const databaseFailure = databaseError(error);
+  if (databaseFailure) {
+    const { statusCode, ...details } = databaseFailure;
+    return helpers.sendErrorResponse({
+      res, statusCode,
+      error: { ...details, ...(requestId ? { requestId } : {}) },
+      message: details.message,
+    });
+  }
+
   if (error?.code === 11000 || error?.name === "MongoServerError" && error?.code === 11000) {
     const details = duplicateKeyDetails(error, requestId);
     return helpers.sendErrorResponse({
@@ -135,3 +146,4 @@ const errorMiddleware = (error, req, res, next) => {
 module.exports = errorMiddleware;
 module.exports.firstDuplicateField = firstDuplicateField;
 module.exports.duplicateKeyDetails = duplicateKeyDetails;
+

package/src/core/middlewares/requestLog.js

@@ -8,10 +8,11 @@ const registry = require("../registry");
 const requestLog = async (req, res, next) => {
   if (req.method === "GET") return next();
 
-  const sensitiveBody = await registry.isSensitiveRequest(req.method, req.url || req.originalUrl);
+  const invitationRequest = /\/(?:core\/invitations|convites)\//.test(String(req.originalUrl || req.url));
+  const sensitiveBody = invitationRequest || await registry.isSensitiveRequest(req.method, req.url || req.originalUrl);
   const log = new Log({
     usuario: req.usuario || null,
-    endpoint: req.originalUrl,
+    endpoint: invitationRequest ? String(req.originalUrl).replace(/(\/core\/invitations\/)[^/?]+/, "$1[redacted]").split("?")[0] : req.originalUrl,
     metodo: req.method,
     ip: req.ip || req.headers["x-forwarded-for"] || req.connection?.remoteAddress,
     correlationId: req.correlationId,

package/src/core/models/ControleAlteracao.js

@@ -1,4 +1,4 @@
-const mongoose = require("mongoose");
+const mongoose = require("../database/mongoose");
 
 /**
  * Trilha de auditoria de mutações. Diferente da versão do CST, no Core
@@ -26,3 +26,4 @@ const ControleAlteracao =
 module.exports = ControleAlteracao;
 module.exports.ACOES_PADRAO = ACOES_PADRAO;
 module.exports.ORIGENS_PADRAO = ORIGENS_PADRAO;
+

package/src/core/models/InstanciaEcossistema.js

@@ -1,4 +1,4 @@
-const mongoose = require("mongoose");
+const mongoose = require("../database/mongoose");
 
 const statuses = ["nao_ativada", "validando", "configurando", "ativa", "suspensa", "revogada", "erro"];
 const roles = ["root", "member"];
@@ -65,3 +65,4 @@ schema.index({ singletonKey: 1 }, { unique: true });
 module.exports = mongoose.models.InstanciaEcossistema || mongoose.model("InstanciaEcossistema", schema);
 module.exports.STATUSES = statuses;
 module.exports.ROLES = roles;
+

package/src/core/models/Log.js

@@ -1,4 +1,4 @@
-const mongoose = require("mongoose");
+const mongoose = require("../database/mongoose");
 
 /**
  * Log de requisições mutantes. Model interna do Core — registrada
@@ -20,3 +20,4 @@ const logSchema = new mongoose.Schema(
 
 module.exports =
   mongoose.models.Log || mongoose.model("Log", logSchema);
+

package/src/core/models/Sistema.js

@@ -1,4 +1,4 @@
-const mongoose = require("mongoose");
+const mongoose = require("../database/mongoose");
 
 /**
  * Configuração singleton da Central. Credenciais funcionais pertencem às
@@ -17,3 +17,4 @@ const sistemaSchema = new mongoose.Schema(
 
 module.exports =
   mongoose.models.Sistema || mongoose.model("Sistema", sistemaSchema);
+

package/src/core/rbac/centralInvitations.js

@@ -0,0 +1,70 @@
+"use strict";
+const express = require("express");
+const ctx = require("../context");
+const auth = require("../middlewares/auth");
+const { asyncHandler } = require("../utils/helpers");
+const GenericError = require("../errors/GenericError");
+const { defaultProviderCall } = require("./identityProvider");
+const { models, appCode, audit } = require("./storage");
+const base = "/integracao/autenticacao-aplicativos/convites/v1";
+function enabled() { return process.env.OON_CENTRAL_INVITATIONS_ENABLED === "true" && typeof ctx.config.auth?.provisionInvitation !== "function" && typeof ctx.config.auth?.verifyToken !== "function" && process.env.OON_RUNTIME_MODE !== "local"; }
+async function cutover() {
+  // No import or token recovery. Idempotent state transition touches only old pending invitations.
+  const { Invitation } = models();
+  const session = await Invitation.db.startSession();
+  try { await session.withTransaction(async () => {
+    const rows = await Invitation.find({ appCode: appCode(), status: "pending" }).session(session);
+    for (const row of rows) {
+      const changed = await Invitation.updateOne({ _id: row._id, status: "pending" }, { $set: { status: "revoked", revokedAt: new Date() } }, { session });
+      if (changed.modifiedCount) await audit("invitation.cutover.v1", { actor: "system:cutover", target: row.email, context: { invitationId: String(row._id), cutoverId: "central-invitations-v1" }, session });
+    }
+  }); } finally { await session.endSession(); }
+}
+function createRouter({ inviteUrl }) {
+  const router = express.Router();
+  router.use((req, _res, next) => enabled() ? next() : next("router"));
+  const call = (req, payload) => defaultProviderCall(req, `${base}/command`, payload);
+  const management = handler => [auth, asyncHandler(async (req, res) => { await call(req, { command: "list" }); await cutover(); res.set("Cache-Control", "no-store"); await handler(req, res); })];
+  function identifier(value) {
+    const match = /^central:([a-f\d]{24})$/i.exec(String(value));
+    if (!match) throw new GenericError("Convite anterior ao corte. Solicite um novo convite.", { statusCode: 410, code: "INVITATION_LEGACY_DISABLED" });
+    return match[1];
+  }
+  function invitation(row) { return { ...row, id: `central:${row.id}` }; }
+  const access = row => ({ id: `central:${row.id}`, email: row.email, name: row.name, roleCode: row.roleCode, status: row.status === "accepted" ? "active" : row.status === "pending" ? "invited" : "revoked", origin: "central", invitation: invitation(row) });
+  async function withLink(req, result) {
+    if (result.invitation.status && result.invitation.status !== "pending") return { invitation: invitation(result.invitation), access: access(result.invitation) };
+    const copied = await call(req, { command: "copy", id: result.invitation.id });
+    return { invitation: invitation(copied.invitation), access: access(copied.invitation), inviteUrl: inviteUrl(req, copied.token) };
+  }
+  router.get("/users", ...management(async (req, res) => {
+    const result = await call(req, { command: "list" });
+    const canonical = result.invitations.map(access);
+    const identities = new Set(canonical.map(row => row.email));
+    const local = req.usuario?.commercialAccess ? [] : await models().UserAccess.find({ appCode: appCode(), status: { $ne: "invited" } }).lean();
+    res.json({ results: [...canonical, ...local.filter(row => !identities.has(row.email)).map(row => ({ id: String(row._id), email: row.email, name: row.name, roleCode: row.roleCode, status: row.status, origin: "local" }))] });
+  }));
+  router.post("/users/invitations", ...management(async (req, res) => {
+    inviteUrl(req, "");
+    const result = await call(req, { command: "create", email: req.body?.email, roleCode: req.body?.roleCode, version: 0 });
+    res.status(201).json(await withLink(req, result));
+  }));
+  router.get("/users/invitations/:id/link", ...management(async (req, res) => res.json(await withLink(req, { invitation: { id: identifier(req.params.id) } }))));
+  router.post("/users/invitations/:id/regenerate", ...management(async (req, res) => {
+    inviteUrl(req, "");
+    res.json(await withLink(req, await call(req, { command: "reissue", id: identifier(req.params.id), version: req.body?.version })));
+  }));
+  router.delete("/users/invitations/:id", ...management(async (req, res) => res.json(await call(req, { command: "revoke", id: identifier(req.params.id), version: req.body?.version }))));
+  router.patch("/users/:id", auth, asyncHandler(async (req, _res, next) => { if (!String(req.params.id).startsWith("central:")) return next("router"); throw new GenericError("Gerencie a concessão na Central; esta lista é uma projeção de leitura.", { statusCode: 409, code: "CENTRAL_ACCESS_COMMAND_REQUIRED" }); }));
+  for (const action of ["inspect", "accept", "decline"]) router.post(`/invitations/${action}`, asyncHandler(async (req, res) => {
+    if (!String(req.body?.token || "").startsWith("c3.")) throw new GenericError("Convite anterior ao corte. Solicite um novo convite.", { statusCode: 410, code: "INVITATION_LEGACY_DISABLED" });
+    res.set("Cache-Control", "no-store");
+    if (action === "inspect") return res.json(await defaultProviderCall(req, `${base}/inspect`, { token: req.body.token }));
+    const result = await call(req, { command: action, token: req.body.token, version: req.body.version, intent: req.body.intent, password: req.body.password, registration: req.body.registration });
+    res.json({ ...result, message: "Convite processado pela Central." });
+  }));
+  router.all("/invitations/:token/accept", (_req, res) => res.status(410).json({ code: "INVITATION_LEGACY_DISABLED", message: "Solicite um novo convite." }));
+  router.get("/invitations/:token", (_req, res) => res.status(410).json({ code: "INVITATION_LEGACY_DISABLED", message: "Solicite um novo convite." }));
+  return router;
+}
+module.exports = { enabled, cutover, createRouter };

package/src/core/rbac/identityProvider.js

@@ -10,6 +10,7 @@ const {
 } = require("../utils/instanceActivation");
 
 const IDENTITY_PATHS = Object.freeze({
+  inspectInvitation: "/integracao/autenticacao-aplicativos/convites/inspecionar",
   provisionInvitation: "/integracao/autenticacao-aplicativos/convites/provisionar",
   changeFirstAccessPassword: "/integracao/autenticacao-aplicativos/primeiro-acesso/senha",
 });
@@ -25,6 +26,9 @@ async function defaultProviderCall(req, path, payload) {
 
   try {
     const headers = instanceHeaders(instance);
+    for (const key of ["idempotency-key", "x-correlation-id", "x-oon-tenant-id"]) {
+      if (req?.headers?.[key]) headers[key] = req.headers[key];
+    }
     if (req?.headers?.authorization) headers.Authorization = req.headers.authorization;
     const response = await providerPost(req, path, payload, headers);
     return response.data;
@@ -38,14 +42,24 @@ async function defaultProviderCall(req, path, payload) {
   }
 }
 
-async function provisionInvitation({ req, invitation, password }) {
+async function inspectInvitation({ req, invitation }) {
+  const hook = ctx.config.auth?.inspectInvitation;
+  if (typeof hook === "function") return hook({ req, invitation });
+  if (typeof ctx.config.auth?.provisionInvitation === "function") {
+    throw new GenericError("O provedor local precisa disponibilizar a consulta de convite.", { statusCode: 503, code: "INVITATION_INSPECTION_REQUIRED" });
+  }
+  return defaultProviderCall(req, IDENTITY_PATHS.inspectInvitation, { email: invitation.email });
+}
+
+async function provisionInvitation({ req, invitation, password, intent }) {
   const hook = ctx.config.auth?.provisionInvitation;
-  if (typeof hook === "function") return hook({ req, invitation, password });
+  if (typeof hook === "function") return hook({ req, invitation, password, intent });
   return defaultProviderCall(req, IDENTITY_PATHS.provisionInvitation, {
     email: invitation.email,
     nome: invitation.name,
     roleCode: invitation.roleCode,
     password,
+    intent,
     invitationFingerprint: invitation.tokenFingerprint,
   });
 }
@@ -63,6 +77,7 @@ async function changeFirstAccessPassword({ req, user, password }) {
 module.exports = {
   IDENTITY_PATHS,
   defaultProviderCall,
+  inspectInvitation,
   provisionInvitation,
   changeFirstAccessPassword,
 };

package/src/core/rbac/storage.js

@@ -1,7 +1,7 @@
 "use strict";
 
 const crypto = require("node:crypto");
-const mongoose = require("mongoose");
+const mongoose = require("../database/mongoose");
 const ctx = require("../context");
 const GenericError = require("../errors/GenericError");
 const { encrypt, decrypt } = require("../utils/instanceActivation");
@@ -105,10 +105,10 @@ function sanitizeSnapshot(value) {
   return plain;
 }
 
-async function audit(event, { actor, target, before, after, context } = {}) {
+async function audit(event, { actor, target, before, after, context, session } = {}) {
   if (mongoose.connection.readyState !== 1) return null;
   const { Audit } = models();
-  return Audit.create({
+  const data = {
     appCode: appCode(),
     event,
     actor: typeof actor === "string" ? actor : actorKey(actor),
@@ -117,7 +117,8 @@ async function audit(event, { actor, target, before, after, context } = {}) {
     after: sanitizeSnapshot(after),
     context,
     at: new Date(),
-  });
+  };
+  return session ? (await Audit.create([data], { session }))[0] : Audit.create(data);
 }
 
 function accessError(message, code = "RBAC_ACCESS_DENIED", statusCode = 403) {
@@ -404,3 +405,4 @@ module.exports = {
   activeAdminCount,
   assertNotLastAdmin,
 };
+

package/src/core/runtime/localDevelopment.js

@@ -1,7 +1,7 @@
 "use strict";
 
 const crypto = require("node:crypto");
-const mongoose = require("mongoose");
+const mongoose = require("../database/mongoose");
 const ctx = require("../context");
 const GenericError = require("../errors/GenericError");
 const { policy, roleByCode, rolePermissions } = require("../rbac/policy");
@@ -338,3 +338,4 @@ module.exports = {
   clearCookie, assertLocalRequest, localRequestBoundary, localRuntimeSummary,
   resetLocalDevelopmentForTests,
 };
+

package/src/core/utils/instanceActivation.js

@@ -1,5 +1,5 @@
 const crypto = require("node:crypto");
-const mongoose = require("mongoose");
+const mongoose = require("../database/mongoose");
 const axios = require("axios");
 const ctx = require("../context");
 const GenericError = require("../errors/GenericError");
@@ -641,3 +641,4 @@ module.exports = {
   event,
 };
 
+

package/src/index.js

@@ -1,4 +1,5 @@
 require("dotenv").config();
+require("./core/database/mongoose"); // Before any Core or consumer model compilation.
 
 const { start } = require("./boot/startServer");
 const { createApp } = require("./boot/createApp");
@@ -82,3 +83,4 @@ module.exports = {
   TransactionalEmailError: capabilities.TransactionalEmailError,
   GenericError, registry,
 };
+

package/src/manifest/processRuntime.js

@@ -1,6 +1,6 @@
 "use strict";
 
-const mongoose = require("mongoose");
+const mongoose = require("../core/database/mongoose");
 const registry = require("../core/registry");
 const {
   DomainRuleError,
@@ -588,4 +588,4 @@ module.exports = {
   recalculateTarget,
   drainProcessJobs,
   toPlainRecord,
-};
+};

package/src/modules/assistants/index.js

@@ -1,4 +1,4 @@
-const mongoose = require("mongoose");
+const mongoose = require("../../core/database/mongoose");
 
 /**
  * Módulo Assistentes IA (Seção 13) — catálogo de assistentes, prompts e
@@ -31,3 +31,4 @@ function mascarar(texto, segredos = []) {
 }
 
 module.exports = { Assistente, mascarar };
+

package/src/modules/currencies/index.js

@@ -1,4 +1,4 @@
-const mongoose = require("mongoose");
+const mongoose = require("../../core/database/mongoose");
 
 /**
  * Módulo Multi-moedas (Seção 14) — cadastro/cotação/conversão. As models
@@ -29,3 +29,4 @@ async function converter({ valor, de = "BRL", para = "BRL" }) {
 }
 
 module.exports = { Moeda, converter };
+