@seedgrid/fe-security 2026.7.0 → 2026.7.2

package/README.md

@@ -0,0 +1,113 @@
+# @seedgrid/fe-security
+
+[![npm version](https://img.shields.io/npm/v/%40seedgrid%2Ffe-security)](https://www.npmjs.com/package/@seedgrid/fe-security)
+[![npm downloads](https://img.shields.io/npm/dm/%40seedgrid%2Ffe-security)](https://www.npmjs.com/package/@seedgrid/fe-security)
+[![TypeScript](https://img.shields.io/badge/types-TypeScript-blue)](https://www.typescriptlang.org/)
+
+Módulo de segurança do front SeedGrid: autenticação com sessão server-side (Next.js), 2FA, gestão de usuários, roles, permissões e empresas. É o módulo-base dos demais módulos front (`fe-apikeys`, `fe-audit`, `fe-backup`, `fe-billing-*`, `fe-login-tenancy`, `fe-self-enter`, `fe-subdomain-tenancy` declaram `requires: ["security"]`).
+
+## Sumário
+
+- [O que este pacote contém](#o-que-este-pacote-contém)
+- [Telas entregues pelo scaffold](#telas-entregues-pelo-scaffold)
+- [Instalação](#instalação)
+- [Uso rápido](#uso-rápido)
+- [Permissões](#permissões)
+- [Backend correspondente](#backend-correspondente)
+- [Suporte](#suporte)
+
+## O que este pacote contém
+
+O pacote tem três camadas:
+
+**Lib client-safe** (`@seedgrid/fe-security`) — sem imports de `next/*`, pode entrar em bundle client:
+
+- `SecurityPaths` — contrato único dos paths REST (auth, 2FA, users, roles, permissions, companies, me, self-enter), espelho do `RestControllerPath.java` da extensão backend.
+- Helpers de permissão: `normalizePermission`, `hasPermission`, `hasAnyPermission`, `hasAllPermissions`, `buildCrudPermissions`, `createPermissionSet`.
+- DTOs de usuários, roles, permissões, empresas e sessão (`session-contract`, `session-result`, `server-contract`).
+- `securityMessages` — bundle i18n (en, pt-BR, es, fr, pt-PT).
+
+**Componentes client** (`@seedgrid/fe-security/client`):
+
+- `PermissionProvider` — contexto de permissões do usuário logado.
+- `PickListField`, `StatusBadge` — componentes usados nas telas de CRUD.
+
+**Motor server-side** (`@seedgrid/fe-security/server`) — SERVER-ONLY:
+
+- `createSecurityServer` — motor de sessão (login, refresh de token, logout, 2FA) com cookie httpOnly; é a fundação sobre a qual os outros módulos compõem os seus engines.
+- Helpers de rota: `toRouteResponse`, respostas Problem+JSON (`toProblem`, `problemResponse`) e helpers de server action.
+
+## Telas entregues pelo scaffold
+
+O diretório `scaffold/` é copiado para dentro do app gerado pelo SeedGrid CLI (o app é dono do código e pode editar à vontade):
+
+| Tela | Rota | O que faz |
+| --- | --- | --- |
+| Login | `/auth/login` | Autenticação com e-mail/senha; redireciona pro 2FA quando exigido |
+| Verificação 2FA | `/auth/2fa/verify` | Confirma o código do segundo fator (com reenvio) |
+| Esqueci a senha | `/auth/forgot-password` (+ `confirm`, `success`) | Fluxo completo de recuperação de senha |
+| Boas-vindas | `/auth/welcome` | Primeira entrada / confirmação de e-mail |
+| Usuários | `/security/users` (lista, novo, edição) | CRUD de usuários com avatar, membership por empresa |
+| Roles | `/security/roles` (lista, novo, edição) | CRUD de roles com atribuição de permissões |
+| Empresas | `/security/companies` (lista, novo, edição) | CRUD de empresas (guardado por `CompanyManagementGuard`) |
+| Perfil | `/security/profile` | Dados do próprio usuário |
+| Configuração 2FA | `/security/2fa` | Habilitar/desabilitar segundo fator (TOTP) |
+| Trocar senha | `/users/change-password` | Troca de senha do usuário logado |
+
+O scaffold também traz o `AuthProvider`, `RouteGuard` (proteção de rotas), `AppShell` com menu por permissão (`useSecurityAppShellSections`), dashboard de segurança e as rotas-proxy de API (`/api/security/session/*`, avatar de usuário).
+
+## Instalação
+
+```bash
+pnpm add @seedgrid/fe-security @seedgrid/fe-core @seedgrid/fe-components
+```
+
+A forma recomendada de consumir o módulo é via **SeedGrid CLI**, que copia o scaffold, registra navegação/i18n e configura o `module.json` automaticamente.
+
+## Uso rápido
+
+```ts
+// src/modules/security/server/server-api.ts (server-only)
+import { createSecurityServer } from "@seedgrid/fe-security/server";
+
+export const session = createSecurityServer({
+  apiBaseUrl: process.env.SEEDGRID_API_BASE_URL!,
+  cookies: { /* nomes dos cookies de sessão do app */ },
+  serviceToken: process.env.SEEDGRID_REPORT_API_TOKEN, // fallback server-to-server
+});
+```
+
+```ts
+// Qualquer módulo dependente compõe sobre a mesma sessão:
+import { createApiKeysServer } from "@seedgrid/fe-apikeys/server";
+export const apiKeys = createApiKeysServer(session);
+```
+
+```tsx
+// Client: checagem de permissão
+import { hasPermission, buildCrudPermissions } from "@seedgrid/fe-security";
+
+const USER_PERMISSIONS = buildCrudPermissions("USER"); // USER_READ, USER_CREATE, ...
+if (hasPermission(userPermissions, USER_PERMISSIONS.read)) {
+  // renderiza a lista de usuários
+}
+```
+
+## Permissões
+
+As telas de CRUD seguem a convenção `RECURSO_AÇÃO`: `USER_*`, `ROLE_*`, `COMPANY_*` (`READ`/`CREATE`/`UPDATE`/`DELETE`). O menu do `AppShell` esconde seções que o usuário não pode acessar e o `RouteGuard` bloqueia acesso direto por URL.
+
+## Backend correspondente
+
+Este módulo conversa com a extensão Quarkus `seedgrid-quarkus-ext-security`. Os paths de `SecurityPaths` são espelho 1:1 do `RestControllerPath.java` — mudou um path no backend, atualize aqui também.
+
+Variável de ambiente exigida pelo scaffold: `SEEDGRID_REPORT_API_TOKEN`.
+
+## Suporte
+
+- Issues: https://github.com/SeedGrid/seedgrid-fe-components/issues
+- Repositório: https://github.com/SeedGrid/seedgrid-fe-components
+
+## Licença
+
+MIT

package/dist/client/index.d.ts

@@ -0,0 +1,4 @@
+export { PermissionProvider, usePermissions, type PermissionContextValue, type PermissionProviderProps, } from "./permission-provider";
+export { StatusBadge } from "./status-badge";
+export { PickListField } from "./pick-list-field";
+//# sourceMappingURL=index.d.ts.map

package/dist/client/index.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/client/index.ts"],"names":[],"mappings":"AAGA,OAAO,EACL,kBAAkB,EAClB,cAAc,EACd,KAAK,sBAAsB,EAC3B,KAAK,uBAAuB,GAC7B,MAAM,uBAAuB,CAAC;AAC/B,OAAO,EAAE,WAAW,EAAE,MAAM,gBAAgB,CAAC;AAC7C,OAAO,EAAE,aAAa,EAAE,MAAM,mBAAmB,CAAC"}

package/dist/client/index.js

@@ -0,0 +1,5 @@
+// Barrel CLIENT (@seedgrid/fe-security/client). React + next/navigation (hooks client).
+// Não importe daqui em código server-only.
+export { PermissionProvider, usePermissions, } from "./permission-provider";
+export { StatusBadge } from "./status-badge";
+export { PickListField } from "./pick-list-field";

package/dist/client/permission-provider.d.ts

@@ -0,0 +1,18 @@
+import { type ReactNode } from "react";
+import type { MePermissions } from "../session-contract";
+export interface PermissionContextValue {
+    loading: boolean;
+    me: MePermissions | null;
+    hasRole: (role: string) => boolean;
+    hasPermission: (permission: string) => boolean;
+}
+export interface PermissionProviderProps {
+    children: ReactNode;
+    /** Endpoint que devolve MePermissions. Default: "/api/auth/me". */
+    meUrl?: string;
+    /** Role que implica TODAS as permissões (superuser). Default: "ADMIN". */
+    adminRole?: string;
+}
+export declare function PermissionProvider({ children, meUrl, adminRole, }: PermissionProviderProps): import("react/jsx-runtime").JSX.Element;
+export declare function usePermissions(): PermissionContextValue;
+//# sourceMappingURL=permission-provider.d.ts.map

package/dist/client/permission-provider.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"permission-provider.d.ts","sourceRoot":"","sources":["../../src/client/permission-provider.tsx"],"names":[],"mappings":"AAOA,OAAO,EAOL,KAAK,SAAS,EACf,MAAM,OAAO,CAAC;AAEf,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,qBAAqB,CAAC;AAEzD,MAAM,WAAW,sBAAsB;IACrC,OAAO,EAAE,OAAO,CAAC;IACjB,EAAE,EAAE,aAAa,GAAG,IAAI,CAAC;IACzB,OAAO,EAAE,CAAC,IAAI,EAAE,MAAM,KAAK,OAAO,CAAC;IACnC,aAAa,EAAE,CAAC,UAAU,EAAE,MAAM,KAAK,OAAO,CAAC;CAChD;AASD,MAAM,WAAW,uBAAuB;IACtC,QAAQ,EAAE,SAAS,CAAC;IACpB,mEAAmE;IACnE,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,0EAA0E;IAC1E,SAAS,CAAC,EAAE,MAAM,CAAC;CACpB;AAED,wBAAgB,kBAAkB,CAAC,EACjC,QAAQ,EACR,KAAsB,EACtB,SAAmB,GACpB,EAAE,uBAAuB,2CAmDzB;AAED,wBAAgB,cAAc,IAAI,sBAAsB,CAEvD"}

package/dist/client/permission-provider.js

@@ -0,0 +1,57 @@
+"use client";
+import { jsx as _jsx } from "react/jsx-runtime";
+// Contexto de permissões do usuário corrente (portado do admin-web AdminAccessProvider).
+// Client-safe: usa next/navigation (hook client) e react. Endpoint e role-superuser são
+// parametrizáveis — o "ADMIN implica tudo" e o "/api/auth/me" eram hardcode do admin.
+import { usePathname } from "next/navigation";
+import { createContext, useCallback, useContext, useEffect, useMemo, useState, } from "react";
+const PermissionContext = createContext({
+    loading: true,
+    me: null,
+    hasRole: () => false,
+    hasPermission: () => false,
+});
+export function PermissionProvider({ children, meUrl = "/api/auth/me", adminRole = "ADMIN", }) {
+    const pathname = usePathname();
+    const [loading, setLoading] = useState(true);
+    const [me, setMe] = useState(null);
+    const loadPermissions = useCallback(async (signal) => {
+        try {
+            const response = await fetch(meUrl, { cache: "no-store", signal });
+            if (!response.ok) {
+                setMe(null);
+                return;
+            }
+            setMe((await response.json()));
+        }
+        catch {
+            // Aborts são ignorados; demais erros deixam me = null.
+        }
+        finally {
+            setLoading(false);
+        }
+    }, [meUrl]);
+    // Rebusca o `me` a CADA navegação — a sessão pode ter trocado de usuário (logout +
+    // login com outra conta). O cookie é httpOnly (não observável no client), então a
+    // navegação é o sinal de "sessão pode ter mudado". Refetch em background (não mexe em
+    // `loading` após a 1ª carga), então não pisca a UI.
+    useEffect(() => {
+        const controller = new AbortController();
+        void loadPermissions(controller.signal);
+        return () => controller.abort();
+    }, [pathname, loadPermissions]);
+    const value = useMemo(() => {
+        const roles = new Set(me?.roles ?? []);
+        const permissions = new Set(me?.permissions ?? []);
+        return {
+            loading,
+            me,
+            hasRole: (role) => roles.has(role),
+            hasPermission: (permission) => roles.has(adminRole) || permissions.has(permission),
+        };
+    }, [loading, me, adminRole]);
+    return (_jsx(PermissionContext.Provider, { value: value, children: children }));
+}
+export function usePermissions() {
+    return useContext(PermissionContext);
+}

package/dist/client/pick-list-field.d.ts

@@ -0,0 +1,15 @@
+import type { PickListOption } from "../dtos";
+type PickListFieldProps = {
+    id: string;
+    title: string;
+    sourceHeader: string;
+    targetHeader: string;
+    options: PickListOption[];
+    selectedValues: Array<string | number>;
+    onChange: (values: Array<string | number>) => void;
+    emptyMessage: string;
+    readOnly?: boolean;
+};
+export declare function PickListField({ id, title, sourceHeader, targetHeader, options, selectedValues, onChange, emptyMessage, readOnly, }: PickListFieldProps): import("react/jsx-runtime").JSX.Element;
+export {};
+//# sourceMappingURL=pick-list-field.d.ts.map

package/dist/client/pick-list-field.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"pick-list-field.d.ts","sourceRoot":"","sources":["../../src/client/pick-list-field.tsx"],"names":[],"mappings":"AAMA,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,SAAS,CAAC;AAM9C,KAAK,kBAAkB,GAAG;IACxB,EAAE,EAAE,MAAM,CAAC;IACX,KAAK,EAAE,MAAM,CAAC;IACd,YAAY,EAAE,MAAM,CAAC;IACrB,YAAY,EAAE,MAAM,CAAC;IACrB,OAAO,EAAE,cAAc,EAAE,CAAC;IAC1B,cAAc,EAAE,KAAK,CAAC,MAAM,GAAG,MAAM,CAAC,CAAC;IACvC,QAAQ,EAAE,CAAC,MAAM,EAAE,KAAK,CAAC,MAAM,GAAG,MAAM,CAAC,KAAK,IAAI,CAAC;IACnD,YAAY,EAAE,MAAM,CAAC;IACrB,QAAQ,CAAC,EAAE,OAAO,CAAC;CACpB,CAAC;AAEF,wBAAgB,aAAa,CAAC,EAC5B,EAAE,EACF,KAAK,EACL,YAAY,EACZ,YAAY,EACZ,OAAO,EACP,cAAc,EACd,QAAQ,EACR,YAAY,EACZ,QAAgB,GACjB,EAAE,kBAAkB,2CAyCpB"}

package/dist/client/pick-list-field.js

@@ -0,0 +1,30 @@
+"use client";
+import { jsx as _jsx } from "react/jsx-runtime";
+import { useMemo } from "react";
+import { SgPickList } from "@seedgrid/fe-components";
+const groupBoxProps = {
+    className: "w-full",
+};
+export function PickListField({ id, title, sourceHeader, targetHeader, options, selectedValues, onChange, emptyMessage, readOnly = false, }) {
+    const sourceItems = useMemo(() => options
+        .filter((option) => !selectedValues.some((value) => isSameValue(value, option.value)))
+        .map(toItem), [options, selectedValues]);
+    const targetItems = useMemo(() => selectedValues
+        .map((selectedValue) => options.find((option) => isSameValue(selectedValue, option.value)))
+        .filter((option) => Boolean(option))
+        .map(toItem), [options, selectedValues]);
+    return (_jsx(SgPickList, { id: id, title: title, source: sourceItems, target: targetItems, sourceHeader: sourceHeader, targetHeader: targetHeader, showSourceFilter: true, showTargetFilter: true, emptyMessage: emptyMessage, readOnly: readOnly, disabled: readOnly, onChange: (event) => {
+            onChange(event.target.map((item) => item.value));
+        }, groupBoxProps: groupBoxProps }));
+}
+function toItem(option) {
+    return {
+        label: option.label,
+        value: option.value,
+        disabled: option.disabled,
+        data: option.data,
+    };
+}
+function isSameValue(left, right) {
+    return String(left) === String(right);
+}

package/dist/client/status-badge.d.ts

@@ -0,0 +1,6 @@
+export declare function StatusBadge({ active, activeLabel, inactiveLabel, }: {
+    active: boolean;
+    activeLabel: string;
+    inactiveLabel: string;
+}): import("react/jsx-runtime").JSX.Element;
+//# sourceMappingURL=status-badge.d.ts.map

package/dist/client/status-badge.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"status-badge.d.ts","sourceRoot":"","sources":["../../src/client/status-badge.tsx"],"names":[],"mappings":"AAIA,wBAAgB,WAAW,CAAC,EAC1B,MAAM,EACN,WAAW,EACX,aAAa,GACd,EAAE;IACD,MAAM,EAAE,OAAO,CAAC;IAChB,WAAW,EAAE,MAAM,CAAC;IACpB,aAAa,EAAE,MAAM,CAAC;CACvB,2CASA"}

package/dist/client/status-badge.js

@@ -0,0 +1,6 @@
+"use client";
+import { jsx as _jsx } from "react/jsx-runtime";
+import { SgBadge } from "@seedgrid/fe-components";
+export function StatusBadge({ active, activeLabel, inactiveLabel, }) {
+    return (_jsx(SgBadge, { value: active ? activeLabel : inactiveLabel, severity: active ? "success" : "neutral", badgeStyle: "solid", rounded: true }));
+}

package/dist/config.d.ts

@@ -0,0 +1,34 @@
+/** Nomes dos cookies httpOnly que guardam a sessão. */
+export interface SecuritySessionCookieNames {
+    /** Access token. Ex.: "sg_admin_token". */
+    token: string;
+    /** Refresh token. Ex.: "sg_admin_refresh_token". */
+    refresh: string;
+    /** Flag de troca de senha obrigatória. Ex.: "sg_admin_password_change_required". */
+    passwordChangeRequired: string;
+}
+export interface SecurityServerConfig {
+    /** Base URL do report-api (ex.: "http://localhost:8080"). O app lê do env e passa aqui. */
+    apiBaseUrl: string;
+    /** Nomes dos cookies de sessão. */
+    cookies: SecuritySessionCookieNames;
+    /**
+     * Flag `secure` dos cookies. Default: `process.env.NODE_ENV === "production"`.
+     * Passe explicitamente para não depender do NODE_ENV.
+     */
+    secureCookies?: boolean;
+    /**
+     * Service token (server-to-server) usado como Authorization APENAS quando não há
+     * sessão de usuário no cookie. Corresponde ao antigo SEEDGRID_REPORT_API_TOKEN.
+     */
+    serviceToken?: string;
+    /**
+     * PONTO DE PLUG DA TENANCY. Headers extras resolvidos por request e mesclados em
+     * toda chamada ao report-api:
+     * - account-tenancy injeta `X-Company-Id` (empresa escopada);
+     * - multi-tenancy injeta o header de tenant resolvido por host/subdomínio;
+     * - security-core (sem tenancy) omite.
+     */
+    resolveTenancyHeaders?: () => Promise<HeadersInit> | HeadersInit;
+}
+//# sourceMappingURL=config.d.ts.map

package/dist/config.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"config.d.ts","sourceRoot":"","sources":["../src/config.ts"],"names":[],"mappings":"AAIA,uDAAuD;AACvD,MAAM,WAAW,0BAA0B;IACzC,2CAA2C;IAC3C,KAAK,EAAE,MAAM,CAAC;IACd,oDAAoD;IACpD,OAAO,EAAE,MAAM,CAAC;IAChB,oFAAoF;IACpF,sBAAsB,EAAE,MAAM,CAAC;CAChC;AAED,MAAM,WAAW,oBAAoB;IACnC,2FAA2F;IAC3F,UAAU,EAAE,MAAM,CAAC;IAEnB,mCAAmC;IACnC,OAAO,EAAE,0BAA0B,CAAC;IAEpC;;;OAGG;IACH,aAAa,CAAC,EAAE,OAAO,CAAC;IAExB;;;OAGG;IACH,YAAY,CAAC,EAAE,MAAM,CAAC;IAEtB;;;;;;OAMG;IACH,qBAAqB,CAAC,EAAE,MAAM,OAAO,CAAC,WAAW,CAAC,GAAG,WAAW,CAAC;CAClE"}

package/dist/config.js

@@ -0,0 +1,4 @@
+// Config injetável do motor de sessão server-side. Tudo que era hardcode do admin-web
+// (nomes de cookie, base URL, service-token, X-Company-Id) entra por aqui. A lib NÃO
+// lê process.env: o APP lê o env que quiser e passa os valores no config.
+export {};

package/dist/dtos.d.ts

@@ -0,0 +1,88 @@
+/** Página genérica do backend (list endpoints). */
+export interface PaginatedResult<T> {
+    items: T[];
+    totalRecords: number;
+    page: number;
+    size: number;
+    sortField: string;
+    sortOrder: "asc" | "desc";
+    query: string;
+}
+export interface PermissionOption {
+    publicId: string;
+    name: string;
+    description: string;
+}
+/** Resumo de role usado dentro de UserEntry. */
+export interface RoleSummary {
+    publicId: string;
+    name: string;
+}
+export interface RoleEntry {
+    id: number;
+    publicId: string;
+    name: string;
+    description: string;
+    active: boolean;
+    forIntegration: boolean;
+    createdAt: string;
+    updatedAt: string;
+    permissionsCount: number;
+    permissions: PermissionOption[];
+}
+export interface UserEntry {
+    id: number;
+    publicId: string;
+    email: string;
+    name: string;
+    whatsApp: string;
+    active: boolean;
+    root: boolean;
+    changePasswordRequired: boolean;
+    passwordExpiresAt: string | null;
+    twoFactorEnabled: boolean;
+    emailConfirmed: boolean;
+    companiesCount: number;
+    createdAt: string;
+    updatedAt: string;
+    roles: RoleSummary[];
+}
+export type TwoFactorMethod = "TOTP" | "EMAIL" | "WHATSAPP";
+export interface TwoFactorStatus {
+    enabled: boolean;
+    primaryMethod: TwoFactorMethod | null;
+    availableMethods: TwoFactorMethod[];
+    hasBackupCodes: boolean;
+    unusedBackupCodesCount: number;
+}
+/**
+ * Resposta de /2f/enable, /2f/totp/confirm e /2f/setup/confirm. Campos variam por
+ * etapa: enable TOTP traz qrCode/secret; confirm traz backupCodes; EMAIL/WHATSAPP
+ * enable traz apenas metadata de confirmação.
+ */
+export interface TwoFactorEnableResponse {
+    status: string;
+    method?: TwoFactorMethod;
+    primaryMethod?: TwoFactorMethod;
+    secret?: string;
+    otpauthUrl?: string;
+    qrCode?: {
+        format: string;
+        width: number;
+        height: number;
+        base64: string;
+    } | null;
+    backupCodes?: string[];
+    metadata?: {
+        email?: string;
+        whatsApp?: string;
+        [key: string]: unknown;
+    };
+}
+export interface PickListOption {
+    label: string;
+    value: string | number;
+    disabled?: boolean;
+    data?: unknown;
+}
+//# sourceMappingURL=dtos.d.ts.map

package/dist/dtos.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"dtos.d.ts","sourceRoot":"","sources":["../src/dtos.ts"],"names":[],"mappings":"AAGA,mDAAmD;AACnD,MAAM,WAAW,eAAe,CAAC,CAAC;IAChC,KAAK,EAAE,CAAC,EAAE,CAAC;IACX,YAAY,EAAE,MAAM,CAAC;IACrB,IAAI,EAAE,MAAM,CAAC;IACb,IAAI,EAAE,MAAM,CAAC;IACb,SAAS,EAAE,MAAM,CAAC;IAClB,SAAS,EAAE,KAAK,GAAG,MAAM,CAAC;IAC1B,KAAK,EAAE,MAAM,CAAC;CACf;AAED,MAAM,WAAW,gBAAgB;IAC/B,QAAQ,EAAE,MAAM,CAAC;IACjB,IAAI,EAAE,MAAM,CAAC;IACb,WAAW,EAAE,MAAM,CAAC;CACrB;AAED,gDAAgD;AAChD,MAAM,WAAW,WAAW;IAC1B,QAAQ,EAAE,MAAM,CAAC;IACjB,IAAI,EAAE,MAAM,CAAC;CACd;AAED,MAAM,WAAW,SAAS;IACxB,EAAE,EAAE,MAAM,CAAC;IACX,QAAQ,EAAE,MAAM,CAAC;IACjB,IAAI,EAAE,MAAM,CAAC;IACb,WAAW,EAAE,MAAM,CAAC;IACpB,MAAM,EAAE,OAAO,CAAC;IAChB,cAAc,EAAE,OAAO,CAAC;IACxB,SAAS,EAAE,MAAM,CAAC;IAClB,SAAS,EAAE,MAAM,CAAC;IAClB,gBAAgB,EAAE,MAAM,CAAC;IACzB,WAAW,EAAE,gBAAgB,EAAE,CAAC;CACjC;AAED,MAAM,WAAW,SAAS;IACxB,EAAE,EAAE,MAAM,CAAC;IACX,QAAQ,EAAE,MAAM,CAAC;IACjB,KAAK,EAAE,MAAM,CAAC;IACd,IAAI,EAAE,MAAM,CAAC;IACb,QAAQ,EAAE,MAAM,CAAC;IACjB,MAAM,EAAE,OAAO,CAAC;IAChB,IAAI,EAAE,OAAO,CAAC;IACd,sBAAsB,EAAE,OAAO,CAAC;IAChC,iBAAiB,EAAE,MAAM,GAAG,IAAI,CAAC;IACjC,gBAAgB,EAAE,OAAO,CAAC;IAC1B,cAAc,EAAE,OAAO,CAAC;IACxB,cAAc,EAAE,MAAM,CAAC;IACvB,SAAS,EAAE,MAAM,CAAC;IAClB,SAAS,EAAE,MAAM,CAAC;IAClB,KAAK,EAAE,WAAW,EAAE,CAAC;CACtB;AAID,MAAM,MAAM,eAAe,GAAG,MAAM,GAAG,OAAO,GAAG,UAAU,CAAC;AAE5D,MAAM,WAAW,eAAe;IAC9B,OAAO,EAAE,OAAO,CAAC;IACjB,aAAa,EAAE,eAAe,GAAG,IAAI,CAAC;IACtC,gBAAgB,EAAE,eAAe,EAAE,CAAC;IACpC,cAAc,EAAE,OAAO,CAAC;IACxB,sBAAsB,EAAE,MAAM,CAAC;CAChC;AAED;;;;GAIG;AACH,MAAM,WAAW,uBAAuB;IACtC,MAAM,EAAE,MAAM,CAAC;IACf,MAAM,CAAC,EAAE,eAAe,CAAC;IACzB,aAAa,CAAC,EAAE,eAAe,CAAC;IAChC,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,MAAM,CAAC,EAAE;QACP,MAAM,EAAE,MAAM,CAAC;QACf,KAAK,EAAE,MAAM,CAAC;QACd,MAAM,EAAE,MAAM,CAAC;QACf,MAAM,EAAE,MAAM,CAAC;KAChB,GAAG,IAAI,CAAC;IACT,WAAW,CAAC,EAAE,MAAM,EAAE,CAAC;IACvB,QAAQ,CAAC,EAAE;QACT,KAAK,CAAC,EAAE,MAAM,CAAC;QACf,QAAQ,CAAC,EAAE,MAAM,CAAC;QAClB,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC;KACxB,CAAC;CACH;AAED,MAAM,WAAW,cAAc;IAC7B,KAAK,EAAE,MAAM,CAAC;IACd,KAAK,EAAE,MAAM,GAAG,MAAM,CAAC;IACvB,QAAQ,CAAC,EAAE,OAAO,CAAC;IACnB,IAAI,CAAC,EAAE,OAAO,CAAC;CAChB"}

package/dist/dtos.js

@@ -0,0 +1,3 @@
+// DTOs do SeedGrid Security (espelham o report-api). Separados dos DTOs de domínio do
+// admin — aqui só entra o que é security-core. Client-safe (tipos puros).
+export {};

package/dist/index.d.ts

@@ -1,2 +1,10 @@
 export * from "./paths";
+export * from "./config";
+export * from "./session-contract";
+export * from "./session-result";
+export * from "./server-contract";
+export * from "./dtos";
+export * from "./menu";
+export * from "./permissions";
+export { securityMessages } from "./messages";
 //# sourceMappingURL=index.d.ts.map

package/dist/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA,cAAc,SAAS,CAAC"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAGA,cAAc,SAAS,CAAC;AACxB,cAAc,UAAU,CAAC;AACzB,cAAc,oBAAoB,CAAC;AACnC,cAAc,kBAAkB,CAAC;AACjC,cAAc,mBAAmB,CAAC;AAClC,cAAc,QAAQ,CAAC;AACvB,cAAc,QAAQ,CAAC;AACvB,cAAc,eAAe,CAAC;AAC9B,OAAO,EAAE,gBAAgB,EAAE,MAAM,YAAY,CAAC"}

package/dist/index.js

@@ -1 +1,11 @@
+// Barrel client-safe (@seedgrid/fe-security). Sem imports de next/* — pode entrar em
+// bundle client. O motor de sessão server-side fica em "@seedgrid/fe-security/server".
 export * from "./paths";
+export * from "./config";
+export * from "./session-contract";
+export * from "./session-result";
+export * from "./server-contract";
+export * from "./dtos";
+export * from "./menu";
+export * from "./permissions";
+export { securityMessages } from "./messages";

package/dist/menu.d.ts

@@ -0,0 +1,19 @@
+export interface NavItem {
+    href: string;
+    label: string;
+    children?: NavItem[];
+    /**
+     * Permissão de READ exigida para ver o item. Regras (canShowItem):
+     * - grupo (com children): aparece se tiver >=1 filho visível;
+     * - leaf com `permission`: exige hasPermission(permission);
+     * - leaf SEM `permission` (feature de plataforma sem perm dedicada): só adminRole;
+     * - home "/" é sempre pública.
+     */
+    permission?: string;
+}
+/** Href efetivo de um item: o do 1º filho (se grupo) ou o próprio. */
+export declare function resolveNavHref(item: NavItem): string;
+export declare function canShowItem(item: NavItem, hasPermission: (permission: string) => boolean, hasRole: (role: string) => boolean, adminRole?: string): boolean;
+/** Filtra recursivamente a árvore, dropando grupos que ficaram sem filhos visíveis. */
+export declare function filterNavItems(items: NavItem[], hasPermission: (permission: string) => boolean, hasRole: (role: string) => boolean, adminRole?: string): NavItem[];
+//# sourceMappingURL=menu.d.ts.map

package/dist/menu.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"menu.d.ts","sourceRoot":"","sources":["../src/menu.ts"],"names":[],"mappings":"AAIA,MAAM,WAAW,OAAO;IACtB,IAAI,EAAE,MAAM,CAAC;IACb,KAAK,EAAE,MAAM,CAAC;IACd,QAAQ,CAAC,EAAE,OAAO,EAAE,CAAC;IACrB;;;;;;OAMG;IACH,UAAU,CAAC,EAAE,MAAM,CAAC;CACrB;AAED,sEAAsE;AACtE,wBAAgB,cAAc,CAAC,IAAI,EAAE,OAAO,GAAG,MAAM,CAEpD;AAED,wBAAgB,WAAW,CACzB,IAAI,EAAE,OAAO,EACb,aAAa,EAAE,CAAC,UAAU,EAAE,MAAM,KAAK,OAAO,EAC9C,OAAO,EAAE,CAAC,IAAI,EAAE,MAAM,KAAK,OAAO,EAClC,SAAS,SAAU,GAClB,OAAO,CAiBT;AAED,uFAAuF;AACvF,wBAAgB,cAAc,CAC5B,KAAK,EAAE,OAAO,EAAE,EAChB,aAAa,EAAE,CAAC,UAAU,EAAE,MAAM,KAAK,OAAO,EAC9C,OAAO,EAAE,CAAC,IAAI,EAAE,MAAM,KAAK,OAAO,EAClC,SAAS,SAAU,GAClB,OAAO,EAAE,CAiBX"}

package/dist/menu.js

@@ -0,0 +1,41 @@
+// Algoritmo de menu-por-permissão (portado do admin-web Shell.tsx). Funções PURAS —
+// sem React, client-safe. A app fornece a árvore `NavItem[]` (conteúdo específico dela)
+// e as funções hasPermission/hasRole (do usePermissions); estas funções filtram.
+/** Href efetivo de um item: o do 1º filho (se grupo) ou o próprio. */
+export function resolveNavHref(item) {
+    return item.children?.[0]?.href ?? item.href;
+}
+export function canShowItem(item, hasPermission, hasRole, adminRole = "ADMIN") {
+    // Grupo: aparece se tiver >=1 filho visível — quem decide são os filhos (o
+    // filterNavItems dropa o grupo se sobrar 0). NÃO gateie o grupo pelo próprio href,
+    // senão some um grupo cujo filho o usuário PODE ver.
+    if (item.children?.length) {
+        return true;
+    }
+    // Home sempre pública.
+    if (item.href === "/") {
+        return true;
+    }
+    // Leaf com permissão declarada: exige a permissão de read.
+    if (item.permission) {
+        return hasPermission(item.permission);
+    }
+    // Leaf de plataforma sem permissão dedicada no backend: só adminRole.
+    return hasRole(adminRole);
+}
+/** Filtra recursivamente a árvore, dropando grupos que ficaram sem filhos visíveis. */
+export function filterNavItems(items, hasPermission, hasRole, adminRole = "ADMIN") {
+    return items.flatMap((item) => {
+        if (!canShowItem(item, hasPermission, hasRole, adminRole)) {
+            return [];
+        }
+        if (!item.children?.length) {
+            return [item];
+        }
+        const children = filterNavItems(item.children, hasPermission, hasRole, adminRole);
+        if (children.length === 0) {
+            return [];
+        }
+        return [{ ...item, children }];
+    });
+}