rl-core-api 0.1.0

package/dist/features/users/domain/avatar.service.d.ts

@@ -0,0 +1,4 @@
+export declare class AvatarService {
+    processAndStore(userId: string, file?: Express.Multer.File): Promise<string>;
+    remove(userId: string): Promise<void>;
+}

package/dist/features/users/domain/avatar.service.js

@@ -0,0 +1,61 @@
+"use strict";
+var __decorate = (this && this.__decorate) || function (decorators, target, key, desc) {
+    var c = arguments.length, r = c < 3 ? target : desc === null ? desc = Object.getOwnPropertyDescriptor(target, key) : desc, d;
+    if (typeof Reflect === "object" && typeof Reflect.decorate === "function") r = Reflect.decorate(decorators, target, key, desc);
+    else for (var i = decorators.length - 1; i >= 0; i--) if (d = decorators[i]) r = (c < 3 ? d(r) : c > 3 ? d(target, key, r) : d(target, key)) || r;
+    return c > 3 && r && Object.defineProperty(target, key, r), r;
+};
+var __importDefault = (this && this.__importDefault) || function (mod) {
+    return (mod && mod.__esModule) ? mod : { "default": mod };
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.AvatarService = void 0;
+const common_1 = require("@nestjs/common");
+const fs_1 = require("fs");
+const path_1 = require("path");
+const sharp_1 = __importDefault(require("sharp"));
+const UPLOAD_DIR = (0, path_1.join)(process.cwd(), "uploads", "avatars");
+const ALLOWED = ["image/jpeg", "image/png", "image/webp"];
+const MAX_BYTES = 5 * 1024 * 1024;
+const MAGIC_BYTES_CHECK = {
+    "image/jpeg": (buf) => buf.length >= 3 && buf[0] === 0xff && buf[1] === 0xd8 && buf[2] === 0xff,
+    "image/png": (buf) => buf.length >= 8 &&
+        buf
+            .subarray(0, 8)
+            .equals(Buffer.from([0x89, 0x50, 0x4e, 0x47, 0x0d, 0x0a, 0x1a, 0x0a])),
+    "image/webp": (buf) => buf.length >= 12 &&
+        buf.subarray(0, 4).toString("ascii") === "RIFF" &&
+        buf.subarray(8, 12).toString("ascii") === "WEBP",
+};
+let AvatarService = class AvatarService {
+    async processAndStore(userId, file) {
+        if (!file) {
+            throw new common_1.BadRequestException("Arquivo de imagem é obrigatório");
+        }
+        if (!ALLOWED.includes(file.mimetype)) {
+            throw new common_1.BadRequestException("Formato inválido (use JPEG, PNG ou WebP)");
+        }
+        if (!MAGIC_BYTES_CHECK[file.mimetype]?.(file.buffer)) {
+            throw new common_1.BadRequestException("O conteúdo do arquivo não corresponde ao formato declarado");
+        }
+        if (file.size > MAX_BYTES) {
+            throw new common_1.BadRequestException("Imagem excede o limite de 5MB");
+        }
+        await fs_1.promises.mkdir(UPLOAD_DIR, { recursive: true });
+        const filename = `${userId}.webp`;
+        const fullPath = (0, path_1.join)(UPLOAD_DIR, filename);
+        await (0, sharp_1.default)(file.buffer)
+            .resize(256, 256, { fit: "cover" })
+            .webp({ quality: 85 })
+            .toFile(fullPath);
+        return `/uploads/avatars/${filename}?v=${Date.now()}`;
+    }
+    async remove(userId) {
+        const fullPath = (0, path_1.join)(UPLOAD_DIR, `${userId}.webp`);
+        await fs_1.promises.rm(fullPath, { force: true });
+    }
+};
+exports.AvatarService = AvatarService;
+exports.AvatarService = AvatarService = __decorate([
+    (0, common_1.Injectable)()
+], AvatarService);

package/dist/features/users/domain/index.d.ts

@@ -0,0 +1,2 @@
+export * from "./avatar.service";
+export * from "./users.service";

package/dist/features/users/domain/index.js

@@ -0,0 +1,18 @@
+"use strict";
+var __createBinding = (this && this.__createBinding) || (Object.create ? (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    var desc = Object.getOwnPropertyDescriptor(m, k);
+    if (!desc || ("get" in desc ? !m.__esModule : desc.writable || desc.configurable)) {
+      desc = { enumerable: true, get: function() { return m[k]; } };
+    }
+    Object.defineProperty(o, k2, desc);
+}) : (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    o[k2] = m[k];
+}));
+var __exportStar = (this && this.__exportStar) || function(m, exports) {
+    for (var p in m) if (p !== "default" && !Object.prototype.hasOwnProperty.call(exports, p)) __createBinding(exports, m, p);
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+__exportStar(require("./avatar.service"), exports);
+__exportStar(require("./users.service"), exports);

package/dist/features/users/domain/users.service.d.ts

@@ -0,0 +1,46 @@
+import { EventEmitter2 } from "@nestjs/event-emitter";
+import { EnvService } from "../../../core/config/env.service";
+import { MailerService } from "../../../core/mailer/mailer.service";
+import { Paginated, PaginationQuery } from "../../../core/utils/pagination.util";
+import { TokenService } from "../../auth/domain/token.service";
+import { RoleRepository } from "../../rbac/infra/repositories/role.repository";
+import { PasswordHistoryRepository } from "../infra/repositories/passwordHistory.repository";
+import { UserRepository } from "../infra/repositories/user.repository";
+import { User } from "../infra/schema/user.schema";
+import { CreateUserCommand } from "../presentation/commands/createUser.command";
+import { UpdateProfileCommand } from "../presentation/commands/updateProfile.command";
+import { UpdateUserCommand } from "../presentation/commands/updateUser.command";
+export declare class UsersService {
+    private readonly userRepo;
+    private readonly historyRepo;
+    private readonly roleRepo;
+    private readonly env;
+    private readonly mailer;
+    private readonly tokens;
+    private readonly events;
+    constructor(userRepo: UserRepository, historyRepo: PasswordHistoryRepository, roleRepo: RoleRepository, env: EnvService, mailer: MailerService, tokens: TokenService, events: EventEmitter2);
+    findByEmail(email: string): Promise<User | null>;
+    findById(id: string): Promise<User>;
+    list(query: PaginationQuery, actorPermissions?: string[]): Promise<Paginated<User>>;
+    create(dto: CreateUserCommand, actorPermissions?: string[]): Promise<User>;
+    sendFirstAccessLink(id: string): Promise<void>;
+    sendPasswordResetLink(id: string): Promise<void>;
+    private invalidateCurrentPassword;
+    private issueAndSendFirstAccess;
+    private findActiveForLink;
+    private requirePasswordChange;
+    update(id: string, dto: UpdateUserCommand, actorPermissions?: string[]): Promise<User>;
+    remove(id: string): Promise<void>;
+    setActive(id: string, isActive: boolean): Promise<User>;
+    updateProfile(userId: string, dto: UpdateProfileCommand): Promise<User>;
+    setAvatar(userId: string, avatarPath: string): Promise<User>;
+    removeAvatar(userId: string): Promise<User>;
+    adminResetTwoFactor(id: string): Promise<void>;
+    changePassword(userId: string, currentPassword: string, newPassword: string): Promise<void>;
+    assertPasswordNotReused(userId: string, newPassword: string): Promise<void>;
+    savePasswordToHistory(userId: string, passwordHash: string): Promise<void>;
+    resetPassword(userId: string, newPassword: string): Promise<void>;
+    registerFailedLogin(user: User): Promise<number>;
+    clearLock(user: User): Promise<void>;
+    save(user: User): Promise<User>;
+}

package/dist/features/users/domain/users.service.js

@@ -0,0 +1,291 @@
+"use strict";
+var __decorate = (this && this.__decorate) || function (decorators, target, key, desc) {
+    var c = arguments.length, r = c < 3 ? target : desc === null ? desc = Object.getOwnPropertyDescriptor(target, key) : desc, d;
+    if (typeof Reflect === "object" && typeof Reflect.decorate === "function") r = Reflect.decorate(decorators, target, key, desc);
+    else for (var i = decorators.length - 1; i >= 0; i--) if (d = decorators[i]) r = (c < 3 ? d(r) : c > 3 ? d(target, key, r) : d(target, key)) || r;
+    return c > 3 && r && Object.defineProperty(target, key, r), r;
+};
+var __metadata = (this && this.__metadata) || function (k, v) {
+    if (typeof Reflect === "object" && typeof Reflect.metadata === "function") return Reflect.metadata(k, v);
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.UsersService = void 0;
+const common_1 = require("@nestjs/common");
+const event_emitter_1 = require("@nestjs/event-emitter");
+const typeorm_1 = require("typeorm");
+const env_service_1 = require("../../../core/config/env.service");
+const appEvent_enum_1 = require("../../../core/events/appEvent.enum");
+const appErrorCode_enum_1 = require("../../../core/filters/appErrorCode.enum");
+const mailer_service_1 = require("../../../core/mailer/mailer.service");
+const codedError_util_1 = require("../../../core/utils/codedError.util");
+const hash_util_1 = require("../../../core/utils/hash.util");
+const pagination_util_1 = require("../../../core/utils/pagination.util");
+const token_service_1 = require("../../auth/domain/token.service");
+const role_repository_1 = require("../../rbac/infra/repositories/role.repository");
+const passwordHistory_repository_1 = require("../infra/repositories/passwordHistory.repository");
+const user_repository_1 = require("../infra/repositories/user.repository");
+const PASSWORD_HISTORY_LIMIT = 3;
+const PASSWORD_REUSED_MESSAGE = "Esta senha já foi utilizada. Escolha uma senha que você ainda não usou neste sistema";
+let UsersService = class UsersService {
+    constructor(userRepo, historyRepo, roleRepo, env, mailer, tokens, events) {
+        this.userRepo = userRepo;
+        this.historyRepo = historyRepo;
+        this.roleRepo = roleRepo;
+        this.env = env;
+        this.mailer = mailer;
+        this.tokens = tokens;
+        this.events = events;
+    }
+    findByEmail(email) {
+        return this.userRepo.findOne({ where: { email } });
+    }
+    async findById(id) {
+        const user = await this.userRepo.findOne({
+            where: { id },
+            relations: { roles: true },
+        });
+        if (!user) {
+            throw new common_1.NotFoundException("Usuário não encontrado");
+        }
+        return user;
+    }
+    async list(query, actorPermissions) {
+        const [items, total] = await this.userRepo.findPaginated(query, actorPermissions);
+        return new pagination_util_1.Paginated(items, total, query.page, query.limit);
+    }
+    async create(dto, actorPermissions) {
+        const exists = await this.userRepo.findOne({
+            where: { email: dto.email },
+            withDeleted: true,
+        });
+        if (exists) {
+            throw new common_1.ConflictException("Email já cadastrado");
+        }
+        if (dto.roleIds?.length && !actorPermissions?.includes("users:promote:any")) {
+            throw new common_1.ForbiddenException("Definir papéis na criação de um usuário é restrito a administradores");
+        }
+        const roles = dto.roleIds?.length
+            ? await this.roleRepo.findBy({ id: (0, typeorm_1.In)(dto.roleIds) })
+            : [];
+        const hashed = await (0, hash_util_1.hashPassword)((0, hash_util_1.randomToken)(48));
+        const user = this.userRepo.create({
+            name: dto.name,
+            lastName: dto.lastName,
+            phone: dto.phone,
+            email: dto.email,
+            password: hashed,
+            passwordChangedAt: new Date(),
+            mustChangePassword: true,
+            isActive: dto.isActive ?? true,
+            roles,
+        });
+        const saved = await this.userRepo.save(user);
+        await this.savePasswordToHistory(saved.id, hashed);
+        void this.issueAndSendFirstAccess(saved).catch(() => undefined);
+        return this.findById(saved.id);
+    }
+    async sendFirstAccessLink(id) {
+        const user = await this.findActiveForLink(id);
+        await this.issueAndSendFirstAccess(user);
+        await this.requirePasswordChange(user);
+    }
+    async sendPasswordResetLink(id) {
+        const user = await this.findActiveForLink(id);
+        const token = await this.tokens.issuePasswordReset(user.id);
+        await this.mailer.sendPasswordReset(user.email, token, user.name);
+        await this.invalidateCurrentPassword(user);
+        await this.requirePasswordChange(user);
+        await this.tokens.revokeAllRefresh(user.id);
+        this.events.emit(appEvent_enum_1.AppEvent.USER_PASSWORD_RESET_REQUESTED, {
+            userId: user.id,
+        });
+    }
+    async invalidateCurrentPassword(user) {
+        if (user.mustChangePassword) {
+            return;
+        }
+        await this.savePasswordToHistory(user.id, user.password);
+        user.password = await (0, hash_util_1.hashPassword)((0, hash_util_1.randomToken)(48));
+    }
+    async issueAndSendFirstAccess(user) {
+        const token = await this.tokens.issueFirstAccess(user.id);
+        await this.mailer.sendFirstAccess(user.email, token, user.name);
+    }
+    async findActiveForLink(id) {
+        const user = await this.findById(id);
+        if (!user.isActive) {
+            throw new common_1.BadRequestException("Usuário inativo — reative antes de enviar o link");
+        }
+        return user;
+    }
+    async requirePasswordChange(user) {
+        user.mustChangePassword = true;
+        user.failedLoginAttempts = 0;
+        await this.userRepo.save(user);
+    }
+    async update(id, dto, actorPermissions) {
+        const user = await this.findById(id);
+        if (dto.email && dto.email !== user.email) {
+            if (!actorPermissions?.includes("users:update-email:any")) {
+                throw new common_1.ForbiddenException("Alterar o email de um usuário é restrito a administradores");
+            }
+            const taken = await this.userRepo.findOne({
+                where: { email: dto.email },
+                withDeleted: true,
+            });
+            if (taken) {
+                throw new common_1.ConflictException("Email já cadastrado");
+            }
+        }
+        if (dto.isActive !== undefined &&
+            dto.isActive !== user.isActive &&
+            !actorPermissions?.includes("users:deactivate:any")) {
+            throw new common_1.ForbiddenException("Ativar/desativar um usuário é restrito a administradores");
+        }
+        if (dto.roleIds && !actorPermissions?.includes("users:promote:any")) {
+            throw new common_1.ForbiddenException("Alterar papéis de um usuário é restrito a administradores");
+        }
+        Object.assign(user, {
+            name: dto.name ?? user.name,
+            lastName: dto.lastName ?? user.lastName,
+            phone: dto.phone ?? user.phone,
+            email: dto.email ?? user.email,
+            isActive: dto.isActive ?? user.isActive,
+        });
+        if (dto.roleIds) {
+            user.roles = await this.roleRepo.findBy({ id: (0, typeorm_1.In)(dto.roleIds) });
+        }
+        await this.userRepo.save(user);
+        return this.findById(id);
+    }
+    async remove(id) {
+        const user = await this.findById(id);
+        await this.userRepo.softRemove(user);
+    }
+    async setActive(id, isActive) {
+        const user = await this.findById(id);
+        user.isActive = isActive;
+        await this.userRepo.save(user);
+        return user;
+    }
+    async updateProfile(userId, dto) {
+        const user = await this.findById(userId);
+        Object.assign(user, {
+            name: dto.name ?? user.name,
+            lastName: dto.lastName ?? user.lastName,
+            phone: dto.phone ?? user.phone,
+        });
+        await this.userRepo.save(user);
+        return this.findById(userId);
+    }
+    async setAvatar(userId, avatarPath) {
+        const user = await this.findById(userId);
+        user.avatar = avatarPath;
+        await this.userRepo.save(user);
+        return user;
+    }
+    async removeAvatar(userId) {
+        const user = await this.findById(userId);
+        user.avatar = null;
+        await this.userRepo.save(user);
+        return user;
+    }
+    async adminResetTwoFactor(id) {
+        const user = await this.findById(id);
+        user.twoFactorEnabled = false;
+        user.twoFactorSecret = null;
+        user.twoFactorConfirmedAt = null;
+        user.backupCodes = null;
+        await this.userRepo.save(user);
+        await this.tokens.revokeAllRefresh(id);
+        this.events.emit(appEvent_enum_1.AppEvent.USER_TWO_FACTOR_RESET, {
+            userId: id,
+        });
+    }
+    async changePassword(userId, currentPassword, newPassword) {
+        const user = await this.userRepo.findOne({ where: { id: userId } });
+        if (!user) {
+            throw new common_1.NotFoundException("Usuário não encontrado");
+        }
+        const ok = await (0, hash_util_1.verifyPassword)(user.password, currentPassword);
+        if (!ok) {
+            throw new common_1.BadRequestException("Senha atual incorreta");
+        }
+        await this.assertPasswordNotReused(userId, newPassword);
+        await this.savePasswordToHistory(userId, user.password);
+        user.password = await (0, hash_util_1.hashPassword)(newPassword);
+        user.passwordChangedAt = new Date();
+        user.mustChangePassword = false;
+        await this.userRepo.save(user);
+        await this.tokens.revokeAllRefresh(userId);
+    }
+    async assertPasswordNotReused(userId, newPassword) {
+        const history = await this.historyRepo.find({
+            where: { userId },
+            order: { createdAt: "DESC" },
+            take: PASSWORD_HISTORY_LIMIT,
+        });
+        for (const entry of history) {
+            if (await (0, hash_util_1.verifyPassword)(entry.passwordHash, newPassword)) {
+                throw (0, codedError_util_1.codedBadRequest)(PASSWORD_REUSED_MESSAGE, appErrorCode_enum_1.AppErrorCode.PASSWORD_REUSED);
+            }
+        }
+    }
+    async savePasswordToHistory(userId, passwordHash) {
+        await this.historyRepo.save(this.historyRepo.create({ userId, passwordHash }));
+        const all = await this.historyRepo.find({
+            where: { userId },
+            order: { createdAt: "DESC" },
+        });
+        const old = all.slice(PASSWORD_HISTORY_LIMIT);
+        if (old.length) {
+            await this.historyRepo.softRemove(old);
+        }
+    }
+    async resetPassword(userId, newPassword) {
+        const user = await this.userRepo.findOne({ where: { id: userId } });
+        if (!user) {
+            throw new common_1.NotFoundException("Usuário não encontrado");
+        }
+        await this.assertPasswordNotReused(userId, newPassword);
+        await this.savePasswordToHistory(userId, user.password);
+        user.password = await (0, hash_util_1.hashPassword)(newPassword);
+        user.passwordChangedAt = new Date();
+        user.mustChangePassword = false;
+        await this.userRepo.save(user);
+    }
+    async registerFailedLogin(user) {
+        const max = this.env.get("LOGIN_MAX_ATTEMPTS");
+        user.failedLoginAttempts = Math.min(user.failedLoginAttempts + 1, max);
+        await this.userRepo.save(user);
+        const remaining = user.remainingAttempts(max);
+        if (remaining === 0) {
+            this.events.emit(appEvent_enum_1.AppEvent.USER_LOCKED, {
+                userId: user.id,
+                userName: user.name,
+                userEmail: user.email,
+            });
+        }
+        return remaining;
+    }
+    async clearLock(user) {
+        if (user.failedLoginAttempts !== 0) {
+            user.failedLoginAttempts = 0;
+            await this.userRepo.save(user);
+        }
+    }
+    save(user) {
+        return this.userRepo.save(user);
+    }
+};
+exports.UsersService = UsersService;
+exports.UsersService = UsersService = __decorate([
+    (0, common_1.Injectable)(),
+    __metadata("design:paramtypes", [user_repository_1.UserRepository,
+        passwordHistory_repository_1.PasswordHistoryRepository,
+        role_repository_1.RoleRepository,
+        env_service_1.EnvService,
+        mailer_service_1.MailerService,
+        token_service_1.TokenService,
+        event_emitter_1.EventEmitter2])
+], UsersService);

package/dist/features/users/infra/index.d.ts

@@ -0,0 +1,4 @@
+export * from "./repositories/passwordHistory.repository";
+export * from "./repositories/user.repository";
+export * from "./schema/passwordHistory.schema";
+export * from "./schema/user.schema";

package/dist/features/users/infra/index.js

@@ -0,0 +1,20 @@
+"use strict";
+var __createBinding = (this && this.__createBinding) || (Object.create ? (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    var desc = Object.getOwnPropertyDescriptor(m, k);
+    if (!desc || ("get" in desc ? !m.__esModule : desc.writable || desc.configurable)) {
+      desc = { enumerable: true, get: function() { return m[k]; } };
+    }
+    Object.defineProperty(o, k2, desc);
+}) : (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    o[k2] = m[k];
+}));
+var __exportStar = (this && this.__exportStar) || function(m, exports) {
+    for (var p in m) if (p !== "default" && !Object.prototype.hasOwnProperty.call(exports, p)) __createBinding(exports, m, p);
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+__exportStar(require("./repositories/passwordHistory.repository"), exports);
+__exportStar(require("./repositories/user.repository"), exports);
+__exportStar(require("./schema/passwordHistory.schema"), exports);
+__exportStar(require("./schema/user.schema"), exports);

package/dist/features/users/infra/repositories/passwordHistory.repository.d.ts

@@ -0,0 +1,5 @@
+import { DataSource, Repository } from "typeorm";
+import { PasswordHistory } from "../schema/passwordHistory.schema";
+export declare class PasswordHistoryRepository extends Repository<PasswordHistory> {
+    constructor(dataSource: DataSource);
+}

package/dist/features/users/infra/repositories/passwordHistory.repository.js

@@ -0,0 +1,25 @@
+"use strict";
+var __decorate = (this && this.__decorate) || function (decorators, target, key, desc) {
+    var c = arguments.length, r = c < 3 ? target : desc === null ? desc = Object.getOwnPropertyDescriptor(target, key) : desc, d;
+    if (typeof Reflect === "object" && typeof Reflect.decorate === "function") r = Reflect.decorate(decorators, target, key, desc);
+    else for (var i = decorators.length - 1; i >= 0; i--) if (d = decorators[i]) r = (c < 3 ? d(r) : c > 3 ? d(target, key, r) : d(target, key)) || r;
+    return c > 3 && r && Object.defineProperty(target, key, r), r;
+};
+var __metadata = (this && this.__metadata) || function (k, v) {
+    if (typeof Reflect === "object" && typeof Reflect.metadata === "function") return Reflect.metadata(k, v);
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.PasswordHistoryRepository = void 0;
+const common_1 = require("@nestjs/common");
+const typeorm_1 = require("typeorm");
+const passwordHistory_schema_1 = require("../schema/passwordHistory.schema");
+let PasswordHistoryRepository = class PasswordHistoryRepository extends typeorm_1.Repository {
+    constructor(dataSource) {
+        super(passwordHistory_schema_1.PasswordHistory, dataSource.createEntityManager());
+    }
+};
+exports.PasswordHistoryRepository = PasswordHistoryRepository;
+exports.PasswordHistoryRepository = PasswordHistoryRepository = __decorate([
+    (0, common_1.Injectable)(),
+    __metadata("design:paramtypes", [typeorm_1.DataSource])
+], PasswordHistoryRepository);

package/dist/features/users/infra/repositories/user.repository.d.ts

@@ -0,0 +1,8 @@
+import { DataSource, Repository } from "typeorm";
+import { PaginationQuery } from "../../../../core/utils/pagination.util";
+import { User } from "../schema/user.schema";
+export declare class UserRepository extends Repository<User> {
+    constructor(dataSource: DataSource);
+    findPaginated(query: PaginationQuery, permissions?: string[]): Promise<[User[], number]>;
+    findWithPasswordExpiringIn(maxAgeDays: number, milestones: number[]): Promise<User[]>;
+}

package/dist/features/users/infra/repositories/user.repository.js

@@ -0,0 +1,56 @@
+"use strict";
+var __decorate = (this && this.__decorate) || function (decorators, target, key, desc) {
+    var c = arguments.length, r = c < 3 ? target : desc === null ? desc = Object.getOwnPropertyDescriptor(target, key) : desc, d;
+    if (typeof Reflect === "object" && typeof Reflect.decorate === "function") r = Reflect.decorate(decorators, target, key, desc);
+    else for (var i = decorators.length - 1; i >= 0; i--) if (d = decorators[i]) r = (c < 3 ? d(r) : c > 3 ? d(target, key, r) : d(target, key)) || r;
+    return c > 3 && r && Object.defineProperty(target, key, r), r;
+};
+var __metadata = (this && this.__metadata) || function (k, v) {
+    if (typeof Reflect === "object" && typeof Reflect.metadata === "function") return Reflect.metadata(k, v);
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.UserRepository = void 0;
+const common_1 = require("@nestjs/common");
+const typeorm_1 = require("typeorm");
+const paginateWithFilter_util_1 = require("../../../../core/query/paginateWithFilter.util");
+const user_schema_1 = require("../schema/user.schema");
+const users_filters_1 = require("../../presentation/filters/users.filters");
+const dayOffset = (days) => {
+    const date = new Date();
+    date.setHours(0, 0, 0, 0);
+    date.setDate(date.getDate() + days);
+    return date;
+};
+let UserRepository = class UserRepository extends typeorm_1.Repository {
+    constructor(dataSource) {
+        super(user_schema_1.User, dataSource.createEntityManager());
+    }
+    findPaginated(query, permissions) {
+        const qb = this.createQueryBuilder("user").leftJoinAndSelect("user.roles", "userRoles");
+        return (0, paginateWithFilter_util_1.paginateWithFilter)(qb, {
+            query,
+            catalog: users_filters_1.USERS_FILTER_CATALOG,
+            defaultSort: "createdAt",
+            permissions,
+            searchFields: users_filters_1.USERS_SEARCH_FIELDS,
+        });
+    }
+    async findWithPasswordExpiringIn(maxAgeDays, milestones) {
+        if (milestones.length === 0) {
+            return [];
+        }
+        const from = dayOffset(-(maxAgeDays - Math.min(...milestones)));
+        const to = dayOffset(-(maxAgeDays - Math.max(...milestones)) + 1);
+        return await this.find({
+            where: {
+                isActive: true,
+                passwordChangedAt: (0, typeorm_1.Between)(from, to),
+            },
+        });
+    }
+};
+exports.UserRepository = UserRepository;
+exports.UserRepository = UserRepository = __decorate([
+    (0, common_1.Injectable)(),
+    __metadata("design:paramtypes", [typeorm_1.DataSource])
+], UserRepository);

package/dist/features/users/infra/schema/passwordHistory.schema.d.ts

@@ -0,0 +1,5 @@
+import { BaseEntity } from "../../../../core/database/base.schema";
+export declare class PasswordHistory extends BaseEntity {
+    userId: string;
+    passwordHash: string;
+}

package/dist/features/users/infra/schema/passwordHistory.schema.js

@@ -0,0 +1,29 @@
+"use strict";
+var __decorate = (this && this.__decorate) || function (decorators, target, key, desc) {
+    var c = arguments.length, r = c < 3 ? target : desc === null ? desc = Object.getOwnPropertyDescriptor(target, key) : desc, d;
+    if (typeof Reflect === "object" && typeof Reflect.decorate === "function") r = Reflect.decorate(decorators, target, key, desc);
+    else for (var i = decorators.length - 1; i >= 0; i--) if (d = decorators[i]) r = (c < 3 ? d(r) : c > 3 ? d(target, key, r) : d(target, key)) || r;
+    return c > 3 && r && Object.defineProperty(target, key, r), r;
+};
+var __metadata = (this && this.__metadata) || function (k, v) {
+    if (typeof Reflect === "object" && typeof Reflect.metadata === "function") return Reflect.metadata(k, v);
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.PasswordHistory = void 0;
+const typeorm_1 = require("typeorm");
+const base_schema_1 = require("../../../../core/database/base.schema");
+let PasswordHistory = class PasswordHistory extends base_schema_1.BaseEntity {
+};
+exports.PasswordHistory = PasswordHistory;
+__decorate([
+    (0, typeorm_1.Column)({ name: "user_id", type: "char", length: 36 }),
+    __metadata("design:type", String)
+], PasswordHistory.prototype, "userId", void 0);
+__decorate([
+    (0, typeorm_1.Column)({ name: "password_hash", type: "varchar", length: 255 }),
+    __metadata("design:type", String)
+], PasswordHistory.prototype, "passwordHash", void 0);
+exports.PasswordHistory = PasswordHistory = __decorate([
+    (0, typeorm_1.Entity)("password_history"),
+    (0, typeorm_1.Index)(["userId"])
+], PasswordHistory);

package/dist/features/users/infra/schema/user.schema.d.ts

@@ -0,0 +1,28 @@
+import { BaseEntity } from "../../../../core/database/base.schema";
+import { Group } from "../../../rbac/infra/schema/group.schema";
+import { Permission } from "../../../rbac/infra/schema/permission.schema";
+import { Role } from "../../../rbac/infra/schema/role.schema";
+export declare class User extends BaseEntity {
+    name: string;
+    lastName?: string | null;
+    phone?: string | null;
+    avatar?: string | null;
+    email: string;
+    password: string;
+    passwordChangedAt?: Date | null;
+    mustChangePassword: boolean;
+    isActive: boolean;
+    twoFactorEnabled: boolean;
+    twoFactorSecret?: string | null;
+    twoFactorConfirmedAt?: Date | null;
+    backupCodes?: string[] | null;
+    failedLoginAttempts: number;
+    roles: Role[];
+    directPermissions: Permission[];
+    groups: Group[];
+    get fullName(): string;
+    isLocked(maxAttempts: number): boolean;
+    get locked(): boolean;
+    remainingAttempts(maxAttempts: number): number;
+    isPasswordExpired(maxAgeDays: number): boolean;
+}