kybernus 3.0.1 → 3.2.0

package/templates/ecommerce/apps/api/src/modules/profile/__tests__/profile.service.unit.test.ts

@@ -0,0 +1,187 @@
+import { hash } from 'bcryptjs';
+import { ProfileService } from '../profile.service';
+import { IUserRepository } from '../../auth/user.repository';
+import { UserEntity } from '../../auth/user.entity';
+
+// ── Helpers ──────────────────────────────────────────────────────────────────
+const makeUser = async (overrides: Partial<{ name: string; email: string; passwordHash: string }> = {}) => {
+  const passwordHash = overrides.passwordHash ?? (await hash('senha1234', 10));
+  return UserEntity.create({
+    name: overrides.name ?? 'Test User',
+    email: overrides.email ?? 'test@email.com',
+    passwordHash,
+  });
+};
+
+// ── Mocks ────────────────────────────────────────────────────────────────────
+const makeUserRepository = (): jest.Mocked<IUserRepository> => ({
+  findByEmail: jest.fn(),
+  findById: jest.fn(),
+  create: jest.fn(),
+  update: jest.fn(),
+  delete: jest.fn(),
+  findAll: jest.fn(),
+});
+
+// ── Tests ────────────────────────────────────────────────────────────────────
+describe('ProfileService — Unit', () => {
+  let profileService: ProfileService;
+  let userRepository: jest.Mocked<IUserRepository>;
+
+  beforeEach(() => {
+    userRepository = makeUserRepository();
+    profileService = new ProfileService(userRepository);
+  });
+
+  // ── getProfile ────────────────────────────────────────────────────────────
+  describe('getProfile()', () => {
+    it('200: deve retornar perfil público do usuário', async () => {
+      const user = await makeUser();
+      userRepository.findById.mockResolvedValue(user);
+
+      const profile = await profileService.getProfile(user.id);
+
+      expect(profile.id).toBe(user.id);
+      expect(profile.email).toBe(user.email);
+      expect(profile).not.toHaveProperty('passwordHash');
+    });
+
+    it('404: deve lançar erro quando usuário não existe', async () => {
+      userRepository.findById.mockResolvedValue(null);
+
+      await expect(profileService.getProfile('non-existent-id')).rejects.toMatchObject({
+        statusCode: 404,
+      });
+    });
+  });
+
+  // ── updateProfile ─────────────────────────────────────────────────────────
+  describe('updateProfile()', () => {
+    it('deve atualizar nome do usuário', async () => {
+      const user = await makeUser();
+      userRepository.findById.mockResolvedValue(user);
+      userRepository.update.mockImplementation(async (u) => u);
+
+      const result = await profileService.updateProfile(user.id, { name: 'Novo Nome' });
+
+      expect(result.name).toBe('Novo Nome');
+      expect(userRepository.update).toHaveBeenCalledTimes(1);
+    });
+
+    it('deve atualizar email do usuário quando não está em uso', async () => {
+      const user = await makeUser();
+      userRepository.findById.mockResolvedValue(user);
+      userRepository.findByEmail.mockResolvedValue(null);
+      userRepository.update.mockImplementation(async (u) => u);
+
+      const result = await profileService.updateProfile(user.id, { email: 'novo@email.com' });
+
+      expect(result.email).toBe('novo@email.com');
+    });
+
+    it('409: deve lançar erro quando email já está em uso por outro usuário', async () => {
+      const user = await makeUser({ email: 'original@email.com' });
+      const other = await makeUser({ email: 'taken@email.com' });
+      userRepository.findById.mockResolvedValue(user);
+      userRepository.findByEmail.mockResolvedValue(other);
+
+      await expect(
+        profileService.updateProfile(user.id, { email: 'taken@email.com' }),
+      ).rejects.toMatchObject({ statusCode: 409 });
+    });
+
+    it('não deve chamar findByEmail quando o email não mudou', async () => {
+      const user = await makeUser({ email: 'same@email.com' });
+      userRepository.findById.mockResolvedValue(user);
+      userRepository.update.mockImplementation(async (u) => u);
+
+      await profileService.updateProfile(user.id, { email: 'same@email.com' });
+
+      expect(userRepository.findByEmail).not.toHaveBeenCalled();
+    });
+
+    it('404: deve lançar erro quando usuário não existe', async () => {
+      userRepository.findById.mockResolvedValue(null);
+
+      await expect(
+        profileService.updateProfile('ghost', { name: 'New Name' }),
+      ).rejects.toMatchObject({ statusCode: 404 });
+    });
+  });
+
+  // ── changePassword ────────────────────────────────────────────────────────
+  describe('changePassword()', () => {
+    it('204: deve trocar a senha com sucesso', async () => {
+      const user = await makeUser(); // passwordHash = bcrypt('senha1234')
+      userRepository.findById.mockResolvedValue(user);
+      userRepository.update.mockImplementation(async (u) => u);
+
+      await expect(
+        profileService.changePassword(user.id, {
+          currentPassword: 'senha1234',
+          newPassword: 'novasenha5678',
+        }),
+      ).resolves.toBeUndefined();
+
+      expect(userRepository.update).toHaveBeenCalledTimes(1);
+      const saved = userRepository.update.mock.calls[0]![0];
+      expect(saved.passwordHash).not.toBe(user.passwordHash);
+    });
+
+    it('401: deve lançar erro com senha atual incorreta', async () => {
+      const user = await makeUser();
+      userRepository.findById.mockResolvedValue(user);
+
+      await expect(
+        profileService.changePassword(user.id, {
+          currentPassword: 'wrong-password',
+          newPassword: 'novasenha5678',
+        }),
+      ).rejects.toMatchObject({ statusCode: 401 });
+    });
+
+    it('400: deve lançar erro quando nova senha é muito curta', async () => {
+      const user = await makeUser();
+      userRepository.findById.mockResolvedValue(user);
+
+      await expect(
+        profileService.changePassword(user.id, {
+          currentPassword: 'senha1234',
+          newPassword: '123',
+        }),
+      ).rejects.toMatchObject({ statusCode: 400 });
+    });
+  });
+
+  // ── deleteAccount ─────────────────────────────────────────────────────────
+  describe('deleteAccount()', () => {
+    it('204: deve deletar a conta com a senha correta', async () => {
+      const user = await makeUser();
+      userRepository.findById.mockResolvedValue(user);
+      userRepository.delete.mockResolvedValue(undefined);
+
+      await expect(profileService.deleteAccount(user.id, 'senha1234')).resolves.toBeUndefined();
+
+      expect(userRepository.delete).toHaveBeenCalledWith(user.id);
+    });
+
+    it('401: deve lançar erro com senha incorreta', async () => {
+      const user = await makeUser();
+      userRepository.findById.mockResolvedValue(user);
+
+      await expect(
+        profileService.deleteAccount(user.id, 'wrong-password'),
+      ).rejects.toMatchObject({ statusCode: 401 });
+
+      expect(userRepository.delete).not.toHaveBeenCalled();
+    });
+
+    it('404: deve lançar erro quando usuário não existe', async () => {
+      userRepository.findById.mockResolvedValue(null);
+
+      await expect(
+        profileService.deleteAccount('ghost', 'senha1234'),
+      ).rejects.toMatchObject({ statusCode: 404 });
+    });
+  });
+});

package/templates/ecommerce/apps/api/src/modules/profile/profile.controller.ts

@@ -0,0 +1,92 @@
+import { Request, Response, NextFunction } from 'express';
+import { z } from 'zod';
+import { profileService } from './profile.registry';
+import { tokenService } from '../auth/auth.registry';
+
+const REFRESH_COOKIE = 'refreshToken';
+
+export async function getProfile(req: Request, res: Response, next: NextFunction): Promise<void> {
+  try {
+    const profile = await profileService.getProfile(req.user!.id);
+    res.status(200).json(profile);
+  } catch (err) {
+    next(err);
+  }
+}
+
+export async function updateProfile(req: Request, res: Response, next: NextFunction): Promise<void> {
+  const parsed = z
+    .object({
+      name: z.string().min(2, 'Nome deve ter pelo menos 2 caracteres').optional(),
+      email: z.string().email('Email inválido').optional(),
+    })
+    .refine((d) => d.name !== undefined || d.email !== undefined, {
+      message: 'Ao menos um campo (name ou email) deve ser informado',
+    })
+    .safeParse(req.body);
+
+  if (!parsed.success) {
+    res.status(400).json({ errors: parsed.error.flatten().fieldErrors, message: parsed.error.errors[0]?.message });
+    return;
+  }
+
+  try {
+    const profile = await profileService.updateProfile(req.user!.id, parsed.data);
+    res.status(200).json(profile);
+  } catch (err) {
+    next(err);
+  }
+}
+
+export async function changePassword(req: Request, res: Response, next: NextFunction): Promise<void> {
+  const parsed = z
+    .object({
+      currentPassword: z.string().min(1, 'Senha atual é obrigatória'),
+      newPassword: z.string().min(8, 'Nova senha deve ter pelo menos 8 caracteres'),
+    })
+    .safeParse(req.body);
+
+  if (!parsed.success) {
+    res.status(400).json({ errors: parsed.error.flatten().fieldErrors });
+    return;
+  }
+
+  try {
+    await profileService.changePassword(req.user!.id, parsed.data);
+    res.status(204).send();
+  } catch (err) {
+    next(err);
+  }
+}
+
+export async function deleteAccount(req: Request, res: Response, next: NextFunction): Promise<void> {
+  const parsed = z
+    .object({
+      password: z.string().min(1, 'Senha é obrigatória para confirmar exclusão'),
+    })
+    .safeParse(req.body);
+
+  if (!parsed.success) {
+    res.status(400).json({ errors: parsed.error.flatten().fieldErrors });
+    return;
+  }
+
+  try {
+    await profileService.deleteAccount(req.user!.id, parsed.data.password);
+
+    // Best-effort: invalidate the refresh token cookie if present
+    const refreshToken = (req.cookies as Record<string, string | undefined>)[REFRESH_COOKIE];
+    if (refreshToken) {
+      try {
+        await tokenService.invalidateRefreshToken(refreshToken);
+      } catch {
+        // ignore — token may already be expired
+      }
+    }
+
+    res.clearCookie(REFRESH_COOKIE);
+    res.status(204).send();
+  } catch (err) {
+    next(err);
+  }
+}

package/templates/ecommerce/apps/api/src/modules/profile/profile.registry.ts

@@ -0,0 +1 @@
+export * from '../../infrastructure/config/registry/profile.registry';

package/templates/ecommerce/apps/api/src/modules/profile/profile.routes.ts

@@ -0,0 +1,14 @@
+import { Router } from 'express';
+import { authenticate } from '../../shared/middlewares/authenticate';
+import * as profileController from './profile.controller';
+
+const router = Router();
+
+router.use(authenticate);
+
+router.get('/', profileController.getProfile);
+router.patch('/', profileController.updateProfile);
+router.patch('/password', profileController.changePassword);
+router.delete('/', profileController.deleteAccount);
+
+export default router;

package/templates/ecommerce/apps/api/src/modules/profile/profile.service.ts

@@ -0,0 +1 @@
+export * from '../../application/profile/profile.service';

package/templates/ecommerce/apps/api/src/presentation/middlewares/authenticate.ts

@@ -0,0 +1,37 @@
+import { Request, Response, NextFunction } from 'express';
+import { tokenService } from '../../infrastructure/config/registry/auth.registry';
+import { AppError } from '../../domain/shared/AppError';
+
+/**
+ * Extends Express Request so downstream handlers can access the
+ * authenticated user payload injected by this middleware.
+ */
+declare global {
+  // eslint-disable-next-line @typescript-eslint/no-namespace
+  namespace Express {
+    interface Request {
+      user?: {
+        id: string;
+        email: string;
+        role: string;
+      };
+    }
+  }
+}
+
+export function authenticate(req: Request, _res: Response, next: NextFunction): void {
+  const authHeader = req.headers['authorization'];
+  if (!authHeader || !authHeader.startsWith('Bearer ')) {
+    return next(new AppError('Token de autenticação não fornecido', 401));
+  }
+
+  const token = authHeader.slice(7); // Remove "Bearer "
+
+  try {
+    const payload = tokenService.verifyAccessToken(token);
+    req.user = { id: payload.sub, email: payload.email, role: payload.role ?? 'CUSTOMER' };
+    next();
+  } catch (err) {
+    next(err instanceof AppError ? err : new AppError('Token inválido ou expirado', 401));
+  }
+}

package/templates/ecommerce/apps/api/src/presentation/middlewares/authorize.ts

@@ -0,0 +1,23 @@
+import { Request, Response, NextFunction } from 'express';
+import { AppError } from '../../domain/shared/AppError';
+
+/**
+ * Factory middleware that restricts access to specific roles.
+ * Must be used AFTER the `authenticate` middleware in the chain.
+ *
+ * @example
+ * router.get('/admin-test', authenticate, authorize('ADMIN'), handler);
+ */
+export function authorize(...roles: string[]) {
+  return (req: Request, _res: Response, next: NextFunction): void => {
+    if (!req.user) {
+      return next(new AppError('Token de autenticação não fornecido', 401));
+    }
+
+    if (!roles.includes(req.user.role)) {
+      return next(new AppError('Acesso negado: permissão insuficiente', 403));
+    }
+
+    next();
+  };
+}

package/templates/ecommerce/apps/api/src/presentation/middlewares/errorHandler.ts

@@ -0,0 +1,48 @@
+import { Request, Response, NextFunction } from 'express';
+import { ZodError } from 'zod';
+import multer from 'multer';
+import { AppError } from '../../domain/shared/AppError';
+
+export function errorHandler(
+  err: Error,
+  _req: Request,
+  res: Response,
+  // Express requires 4-arg signature to recognise error middleware
+  // eslint-disable-next-line @typescript-eslint/no-unused-vars
+  _next: NextFunction,
+): void {
+  // Zod validation errors — always 400
+  if (err instanceof ZodError) {
+    const messages = err.errors.map((e) => `${e.path.join('.')}: ${e.message}`).join('; ');
+    res.status(400).json({ error: messages });
+    return;
+  }
+
+  // Multer file size exceeded
+  if (err instanceof multer.MulterError && err.code === 'LIMIT_FILE_SIZE') {
+    res.status(400).json({ error: 'Arquivo excede o tamanho máximo de 5 MB' });
+    return;
+  }
+
+  // Operational errors (AppError) — safe to expose message to client
+  if (err instanceof AppError) {
+    res.status(err.statusCode).json({ error: err.message });
+    return;
+  }
+
+  // Duck-typed errors with statusCode (e.g. from third-party libs or test stubs)
+  const duckStatusCode = (err as unknown as Record<string, unknown>)['statusCode'];
+  if (typeof duckStatusCode === 'number' && duckStatusCode >= 400 && duckStatusCode < 600) {
+    res.status(duckStatusCode).json({ error: err.message });
+    return;
+  }
+
+  // Unexpected / programmer errors — never leak internals in production
+  const isProduction = process.env['NODE_ENV'] === 'production';
+
+  if (isProduction) {
+    res.status(500).json({ error: 'Internal Server Error' });
+  } else {
+    res.status(500).json({ error: err.message, stack: err.stack });
+  }
+}

package/templates/ecommerce/apps/api/src/presentation/modules/admin/admin.controller.ts

@@ -0,0 +1,116 @@
+import { Request, Response, NextFunction } from 'express';
+import { z } from 'zod';
+import type { DashboardService } from '../../../application/admin/dashboard.service';
+import type { AdminUserService } from '../../../application/admin/admin-user.service';
+import { createCouponSchema, CouponAdminService } from '../../../application/cart/coupon.service';
+
+// ── Zod schemas ───────────────────────────────────────────────────────────────
+const periodSchema = z.object({
+  period: z.enum(['today', 'week', 'month', 'custom']).optional(),
+  from: z.string().optional(),
+  to: z.string().optional(),
+  limit: z.coerce.number().int().min(1).max(100).optional(),
+});
+
+const userListSchema = z.object({
+  role: z.enum(['ADMIN', 'CUSTOMER']).optional(),
+  cursor: z.string().optional(),
+  limit: z.coerce.number().int().min(1).max(100).optional(),
+});
+
+const updateRoleSchema = z.object({
+  role: z.enum(['ADMIN', 'CUSTOMER']),
+});
+
+// ── AdminController ───────────────────────────────────────────────────────────
+export class AdminController {
+  constructor(
+    private readonly dashboardService: DashboardService,
+    private readonly adminUserService: AdminUserService,
+    private readonly couponAdminService: CouponAdminService,
+  ) {}
+
+  getStats = async (req: Request, res: Response, next: NextFunction): Promise<void> => {
+    try {
+      const query = periodSchema.parse(req.query);
+      const stats = await this.dashboardService.getStats(query);
+      res.json(stats);
+    } catch (err) {
+      next(err);
+    }
+  };
+
+  getTopProducts = async (
+    req: Request,
+    res: Response,
+    next: NextFunction,
+  ): Promise<void> => {
+    try {
+      const query = periodSchema.parse(req.query);
+      const products = await this.dashboardService.getTopProducts(query);
+      res.json({ items: products });
+    } catch (err) {
+      next(err);
+    }
+  };
+
+  listUsers = async (req: Request, res: Response, next: NextFunction): Promise<void> => {
+    try {
+      const query = userListSchema.parse(req.query);
+      const result = await this.adminUserService.listUsers(query);
+      res.json({
+        items: result.items.map((u) => u.toPublic()),
+        nextCursor: result.nextCursor,
+      });
+    } catch (err) {
+      next(err);
+    }
+  };
+
+  updateUserRole = async (
+    req: Request,
+    res: Response,
+    next: NextFunction,
+  ): Promise<void> => {
+    try {
+      const { id } = req.params;
+      const { role } = updateRoleSchema.parse(req.body);
+      const requesterId = (req.user as { id: string }).id;
+      await this.adminUserService.updateUserRole(id, role, requesterId);
+      res.json({ message: 'Role atualizado com sucesso' });
+    } catch (err) {
+      next(err);
+    }
+  };
+
+  // ── Coupon handlers ───────────────────────────────────────────────────────
+
+  createCoupon = async (req: Request, res: Response, next: NextFunction): Promise<void> => {
+    try {
+      const dto = createCouponSchema.parse(req.body);
+      const coupon = await this.couponAdminService.create(dto);
+      res.status(201).json(coupon.toRecord());
+    } catch (err) {
+      next(err);
+    }
+  };
+
+  listCoupons = async (_req: Request, res: Response, next: NextFunction): Promise<void> => {
+    try {
+      const coupons = await this.couponAdminService.list();
+      res.json({ items: coupons.map((c) => c.toRecord()) });
+    } catch (err) {
+      next(err);
+    }
+  };
+
+  deleteCoupon = async (req: Request, res: Response, next: NextFunction): Promise<void> => {
+    try {
+      const { id } = req.params;
+      await this.couponAdminService.delete(id);
+      res.status(204).send();
+    } catch (err) {
+      next(err);
+    }
+  };
+}

package/templates/ecommerce/apps/api/src/presentation/modules/admin/admin.routes.ts

@@ -0,0 +1,21 @@
+import { Router } from 'express';
+import { authenticate } from '../../middlewares/authenticate';
+import { authorize } from '../../middlewares/authorize';
+import { validateUuidParam } from '../../validators/uuidParam';
+import { adminController } from '../../../infrastructure/config/registry/admin.registry';
+
+const adminRoutes = Router();
+
+adminRoutes.use(authenticate, authorize('ADMIN'));
+
+adminRoutes.get('/dashboard/stats', adminController.getStats);
+adminRoutes.get('/dashboard/top-products', adminController.getTopProducts);
+adminRoutes.get('/users', adminController.listUsers);
+adminRoutes.patch('/users/:id', validateUuidParam(), adminController.updateUserRole);
+
+// Coupon management (Phase 13)
+adminRoutes.post('/coupons', adminController.createCoupon);
+adminRoutes.get('/coupons', adminController.listCoupons);
+adminRoutes.delete('/coupons/:id', validateUuidParam(), adminController.deleteCoupon);
+
+export { adminRoutes };