@seedgrid/fe-security 2026.7.0 → 2026.7.2

package/scaffold/src/modules/security/services/session-storage.ts

@@ -0,0 +1,80 @@
+import { securityConfig } from "../config";
+import type {
+  AuthenticatedSession,
+  PendingTwoFactorSession,
+} from "../types";
+
+function readStorageValue<T>(key: string): T | null {
+  if (typeof window === "undefined") {
+    return null;
+  }
+
+  try {
+    const rawValue = window.localStorage.getItem(key);
+
+    if (!rawValue) {
+      return null;
+    }
+
+    return JSON.parse(rawValue) as T;
+  } catch {
+    return null;
+  }
+}
+
+function writeStorageValue<T>(key: string, value: T) {
+  if (typeof window === "undefined") {
+    return;
+  }
+
+  window.localStorage.setItem(key, JSON.stringify(value));
+}
+
+function removeStorageValue(key: string) {
+  if (typeof window === "undefined") {
+    return;
+  }
+
+  window.localStorage.removeItem(key);
+}
+
+export function readStoredSession() {
+  return readStorageValue<AuthenticatedSession>(securityConfig.storage.sessionKey);
+}
+
+export function writeStoredSession(session: AuthenticatedSession) {
+  writeStorageValue(securityConfig.storage.sessionKey, session);
+}
+
+export function clearStoredSession() {
+  removeStorageValue(securityConfig.storage.sessionKey);
+}
+
+export function readPendingTwoFactorSession() {
+  const session = readStorageValue<PendingTwoFactorSession>(
+    securityConfig.storage.pendingTwoFactorKey
+  );
+
+  if (!session) {
+    return null;
+  }
+
+  if (!session.tempToken && session.twoFactorToken) {
+    return {
+      ...session,
+      tempToken: session.twoFactorToken,
+    };
+  }
+
+  return session;
+}
+
+export function writePendingTwoFactorSession(
+  session: PendingTwoFactorSession
+) {
+  writeStorageValue(securityConfig.storage.pendingTwoFactorKey, session);
+}
+
+export function clearPendingTwoFactorSession() {
+  removeStorageValue(securityConfig.storage.pendingTwoFactorKey);
+}

package/scaffold/src/modules/security/types.ts

@@ -0,0 +1,295 @@
+export type PermissionValue = string;
+
+export type SortOrder = 1 | -1 | 0;
+
+export type SortState = {
+  sortField: string | null;
+  sortOrder: SortOrder;
+};
+
+export type PagedResult<T> = {
+  items: T[];
+  total: number;
+  page: number;
+  size: number;
+  fallback?: boolean;
+};
+
+export type PermissionEnvelope = {
+  permissions: PermissionValue[];
+  roles: string[];
+  login?: string;
+  publicId?: string;
+  name?: string;
+};
+
+export type AuthTokens = {
+  accessToken: string;
+  refreshToken?: string | null;
+  tokenType: string;
+  expiresIn?: number | null;
+  expiresAt?: number | null;
+  allowedCompanies: number[];
+  publicId?: string;
+  name?: string;
+  changePasswordRequired?: boolean;
+};
+
+export type AuthenticatedSession = AuthTokens &
+  PermissionEnvelope & {
+    login?: string;
+  };
+
+export type LoginCredentials = {
+  login: string;
+  password: string;
+};
+
+export type PendingTwoFactorSession = {
+  login: string;
+  tempToken: string;
+  twoFactorToken?: string;
+  method?: string | null;
+};
+
+export type ForgotPasswordPayload = {
+  email: string;
+  newPassword: string;
+};
+
+export type ChangePasswordPayload = {
+  currentPassword: string;
+  newPassword: string;
+  confirmNewPassword: string;
+};
+
+export type PermissionSummary = {
+  id?: number;
+  publicId: string;
+  name: string;
+  description?: string | null;
+  createdAt?: string | null;
+  updatedAt?: string | null;
+};
+
+export type RoleSummary = {
+  id?: number;
+  publicId: string;
+  name: string;
+  description?: string | null;
+  forIntegration?: boolean;
+  permissions?: PermissionSummary[] | null;
+  createdAt?: string | null;
+  updatedAt?: string | null;
+};
+
+export type RoleMutationPayload = {
+  name: string;
+  description?: string;
+  forIntegration?: boolean;
+  permissionIds: Array<string | number>;
+};
+
+export type CompanySummary = {
+  id?: number;
+  publicId: string;
+  cnpj?: string | null;
+  corporateName?: string | null;
+  tradeName?: string | null;
+  active?: boolean;
+  addrStreet?: string | null;
+  addrNumber?: string | null;
+  addrComplement?: string | null;
+  addrPostalCode?: string | null;
+  addrCity?: string | null;
+  addrState?: string | null;
+  addrDistrict?: string | null;
+  addrPhone?: string | null;
+  repFirstName?: string | null;
+  repLastName?: string | null;
+  repCpf?: string | null;
+  repPhone?: string | null;
+  repWhatsapp?: string | null;
+  repEmail?: string | null;
+  createdAt?: string | null;
+  updatedAt?: string | null;
+};
+
+export type UserSummary = {
+  id?: number;
+  publicId: string;
+  email: string;
+  name?: string | null;
+  whatsApp?: string | null;
+  avatarStorageKey?: string | null;
+  roles?: RoleSummary[];
+  companies?: CompanySummary[];
+  companyIds?: Array<number | string>;
+  companyPublicIds?: string[];
+  root?: boolean;
+  active?: boolean;
+  changePasswordRequired?: boolean;
+  passwordExpiresAt?: string | null;
+  emailConfirmedAt?: string | null;
+  twoFactorEnabled?: boolean;
+  twoFactorPrimaryMethod?: string | null;
+  twoFactorEnabledAt?: string | null;
+  twoFactorLastUsedAt?: string | null;
+  twoFactorHasBackupCodes?: boolean;
+  createdAt?: string | null;
+  updatedAt?: string | null;
+};
+
+export type UserMutationPayload = {
+  email: string;
+  name?: string;
+  password?: string;
+  whatsApp?: string;
+  roleIds: number[];
+  companyIds: number[];
+  active: boolean;
+  changePasswordRequired: boolean;
+};
+
+export type CompanyMutationPayload = {
+  cnpj?: string;
+  corporateName: string;
+  tradeName: string;
+  active: boolean;
+  addrStreet?: string;
+  addrNumber?: string;
+  addrComplement?: string;
+  addrPostalCode?: string;
+  addrCity?: string;
+  addrState?: string;
+  addrDistrict?: string;
+  addrPhone?: string;
+  repFirstName?: string;
+  repLastName?: string;
+  repCpf?: string;
+  repPhone?: string;
+  repWhatsapp?: string;
+  repEmail?: string;
+};
+
+export type TwoFactorMethod = "EMAIL" | "TOTP" | "BACKUP_CODE" | string;
+
+export type TwoFactorStatus = {
+  enabled: boolean;
+  primaryMethod?: TwoFactorMethod | null;
+  availableMethods: TwoFactorMethod[];
+  hasBackupCodes?: boolean;
+  unusedBackupCodesCount?: number;
+};
+
+export type TwoFactorEnableResponse = {
+  status?: string;
+  method?: TwoFactorMethod | null;
+  primaryMethod?: TwoFactorMethod | null;
+  backupCodes?: string[];
+  secret?: string | null;
+  otpauthUrl?: string | null;
+  qrCode?: {
+    format?: string | null;
+    width?: number | null;
+    height?: number | null;
+    base64?: string | null;
+  } | null;
+};
+
+export type DisableTwoFactorPayload = {
+  twoFactorCode?: string;
+  password?: string;
+  backupCode?: string;
+};
+
+export type EntryRequest = {
+  id: number | string;
+  name?: string | null;
+  email?: string | null;
+  whatsApp?: string | null;
+  message?: string | null;
+  status?: string | null;
+  requestedAt?: string | null;
+  expiresAt?: string | null;
+  approvedBy?: string | null;
+  rejectedBy?: string | null;
+  createdAt?: string | null;
+  approvedAt?: string | null;
+  rejectedAt?: string | null;
+  confirmedAt?: string | null;
+};
+
+export type SelfEnterRequestPayload = {
+  name: string;
+  email: string;
+  password: string;
+};
+
+export type SelfEnterRequestEmailConfirmationPayload = {
+  code: string;
+};
+
+export type SelfEnterInvitation = {
+  id?: number | string;
+  email: string;
+  name?: string | null;
+  status?: string | null;
+  expiresAt?: string | null;
+  confirmedAt?: string | null;
+  consumedAt?: string | null;
+  requestedAt?: string | null;
+  createdAt?: string | null;
+};
+
+export type SelfEnterInvitationCompletionPayload = {
+  name: string;
+  email: string;
+  password: string;
+};
+
+export type SelfEnterInvitationCreatePayload = {
+  email: string;
+  name?: string;
+};
+
+export type SelfEnterInvitationAdminError =
+  | "duplicate_email"
+  | "unknown";
+
+export type ApiKeyListItem = {
+  publicId: string;
+  name: string;
+  roleName?: string | null;
+  active?: boolean;
+  prefix?: string | null;
+  masked?: string | null;
+  expiresAt?: string | null;
+  revokedAt?: string | null;
+  lastUsedAt?: string | null;
+  createdAt?: string | null;
+};
+
+export type ApiKeyCreatePayload = {
+  roleName: string;
+  name: string;
+  expiresDays?: number | null;
+};
+
+export type ApiKeyCreateResponse = {
+  publicId: string;
+  name: string;
+  key?: string | null;
+  roleName?: string | null;
+  expiresAt?: string | null;
+  createdAt?: string | null;
+};
+
+export type PickListOption = {
+  label: string;
+  value: string | number;
+  disabled?: boolean;
+  data?: unknown;
+};
+
+export type FormMode = "create" | "edit" | "view";

package/scaffold/src/modules/security/useSecurityAppShellSections.tsx.hbs

@@ -0,0 +1,180 @@
+"use client";
+
+import { Building2, KeySquare, Mail, Shield, ShieldCheck, UserCog, Users } from "lucide-react";
+
+import type {
+  AppShellNavItem,
+  AppShellSection,
+} from "@/components/layout/app-shell-navigation";
+import { useI18n } from "@/i18n";
+
+import { securityConfig } from "./config";
+import { useCompanyManagementEnabledForCurrentHost } from "./host-access";
+import { useCrudPermission, usePermission } from "./hooks/usePermission";
+
+export function useSecurityAppShellSections(): AppShellSection[] {
+  const { t } = useI18n();
+  const companiesEnabled = useCompanyManagementEnabledForCurrentHost();
+  const userPermissions = useCrudPermission("USER");
+  const companyPermissions = useCrudPermission("COMPANY");
+  const rolePermissions = useCrudPermission("ROLE");
+{{#if security_api_keys_enabled}}
+  const canReadApiKeys = usePermission("APIKEY_READ");
+  const canCreateApiKeys = usePermission("APIKEY_CREATE");
+  const canRevokeApiKeys = usePermission("APIKEY_REVOKE");
+{{/if}}
+{{#if security_self_enter_enabled}}
+  const canApproveSelfEnter = usePermission("SELFENTER_APPROVE");
+  const canRejectSelfEnter = usePermission("SELFENTER_REJECT");
+  const canInviteSelfEnter = usePermission("SELFENTER_INVITE");
+{{/if}}
+
+  const accessItems: AppShellNavItem[] = [];
+{{#if security_self_enter_enabled}}
+  const selfEnterItems: AppShellNavItem[] = [];
+{{/if}}
+
+  if (userPermissions.canRead) {
+    accessItems.push({
+      id: "users",
+      label: t("security.users.list.title"),
+      href: securityConfig.routes.users,
+      badge: userPermissions.isReadOnly ? t("security.common.readonly") : undefined,
+      order: 10,
+    });
+  }
+
+  if (companiesEnabled && companyPermissions.canRead) {
+    accessItems.push({
+      id: "companies",
+      label: t("security.companies.list.title"),
+      href: securityConfig.routes.companies,
+      badge: companyPermissions.isReadOnly ? t("security.common.readonly") : undefined,
+      order: 20,
+    });
+  }
+
+  if (rolePermissions.canRead) {
+    accessItems.push({
+      id: "roles",
+      label: t("security.roles.list.title"),
+      href: securityConfig.routes.roles,
+      badge: rolePermissions.isReadOnly ? t("security.common.readonly") : undefined,
+      order: 30,
+    });
+  }
+
+{{#if security_api_keys_enabled}}
+  if (canReadApiKeys) {
+    accessItems.push({
+      id: "api-keys",
+      label: t("security.api_keys.title"),
+      href: securityConfig.routes.apiKeys,
+      badge:
+        !canCreateApiKeys && !canRevokeApiKeys
+          ? t("security.common.readonly")
+          : undefined,
+      order: 40,
+    });
+  }
+{{/if}}
+
+{{#if security_self_enter_enabled}}
+  if (canApproveSelfEnter || canRejectSelfEnter) {
+    selfEnterItems.push({
+      id: "self-enter-approval",
+      label: t("security.self_enter.approval.title"),
+      href: securityConfig.routes.selfEnterApproval,
+      badge:
+        !canApproveSelfEnter || !canRejectSelfEnter
+          ? t("security.common.readonly")
+          : undefined,
+      order: 50,
+    });
+  }
+
+  if (canInviteSelfEnter) {
+    selfEnterItems.push({
+      id: "self-enter-invitations",
+      label: t("security.self_enter.invitation_admin.nav_title"),
+      href: securityConfig.routes.selfEnterInvitations,
+      order: 60,
+    });
+  }
+{{/if}}
+
+  const sections: AppShellSection[] = [];
+
+  if (
+    accessItems.length
+{{#if security_self_enter_enabled}}
+      || selfEnterItems.length
+{{/if}}
+  ) {
+    sections.push({
+      id: "application",
+      label: t("security.dashboard.menu.group.access"),
+      order: 20,
+      items: [
+        {
+          id: "access-management",
+          label: t("security.dashboard.menu.group.access"),
+          icon: <Shield size={18} />,
+          order: 10,
+          children: accessItems.map((item) => {
+            if (item.id === "users") {
+              return { ...item, icon: <Users size={16} /> };
+            }
+
+            if (item.id === "companies") {
+              return { ...item, icon: <Building2 size={16} /> };
+            }
+
+            if (item.id === "roles") {
+              return { ...item, icon: <ShieldCheck size={16} /> };
+            }
+
+{{#if security_api_keys_enabled}}
+            if (item.id === "api-keys") {
+              return { ...item, icon: <KeySquare size={16} /> };
+            }
+{{/if}}
+
+{{#if security_self_enter_enabled}}
+            if (item.id === "self-enter-approval") {
+              return { ...item, icon: <UserCog size={16} /> };
+            }
+{{/if}}
+
+            return item;
+          }),
+        },
+{{#if security_self_enter_enabled}}
+        ...(selfEnterItems.length
+          ? [
+              {
+                id: "self-enter",
+                label: t("security.self_enter.menu.title"),
+                icon: <UserCog size={18} />,
+                order: 20,
+                children: selfEnterItems.map((item) => {
+                  if (item.id === "self-enter-approval") {
+                    return { ...item, icon: <ShieldCheck size={16} /> };
+                  }
+
+                  if (item.id === "self-enter-invitations") {
+                    return { ...item, icon: <Mail size={16} /> };
+                  }
+
+                  return item;
+                }),
+              },
+            ]
+          : []),
+{{/if}}
+      ],
+    });
+  }
+
+  return sections;
+}