rl-core-api 0.1.0

package/dist/core/config/env.schema.js

@@ -0,0 +1,94 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.envSchema = void 0;
+exports.validateEnv = validateEnv;
+const zod_1 = require("zod");
+const booleanFromString = zod_1.z
+    .enum(["true", "false"])
+    .transform((v) => v === "true");
+exports.envSchema = zod_1.z
+    .object({
+    NODE_ENV: zod_1.z
+        .enum(["development", "test", "production"])
+        .default("development"),
+    PORT: zod_1.z.coerce.number().int().positive().default(3108),
+    API_PREFIX: zod_1.z.string().default("api"),
+    APP_URL: zod_1.z.string().url().default("http://localhost:4000"),
+    DB_HOST: zod_1.z.string().min(1),
+    DB_PORT: zod_1.z.coerce.number().int().positive().default(3306),
+    DB_NAME: zod_1.z.string().min(1),
+    DB_USER: zod_1.z.string().min(1),
+    DB_PASSWORD: zod_1.z.string().min(1),
+    DB_LOGGING: booleanFromString.default(false),
+    DB_SSL: booleanFromString.default(false),
+    TRUST_PROXY_HOPS: zod_1.z.coerce.number().int().nonnegative().default(1),
+    JWT_ACCESS_SECRET: zod_1.z.string().min(32),
+    JWT_PENDING_SECRET: zod_1.z.string().min(32),
+    JWT_ACCESS_EXPIRES: zod_1.z.string().default("4h"),
+    JWT_REFRESH_EXPIRES_MINUTES: zod_1.z.coerce
+        .number()
+        .int()
+        .positive()
+        .default(360),
+    TOTP_ENC_KEY: zod_1.z
+        .string()
+        .length(64, "TOTP_ENC_KEY deve ter 64 chars hex (32 bytes)"),
+    COOKIE_SECURE: booleanFromString.default(false),
+    COOKIE_DOMAIN: zod_1.z.string().default("localhost"),
+    TOTP_ISSUER: zod_1.z.string().default("Core App"),
+    TWO_FACTOR_EMAIL_CODE_EXPIRY: zod_1.z.coerce
+        .number()
+        .int()
+        .positive()
+        .default(10),
+    BACKUP_CODES_COUNT: zod_1.z.coerce.number().int().positive().default(10),
+    LOGIN_MAX_ATTEMPTS: zod_1.z.coerce.number().int().positive().default(10),
+    THROTTLE_TTL_SECONDS: zod_1.z.coerce.number().int().positive().default(60),
+    THROTTLE_LIMIT: zod_1.z.coerce.number().int().positive().default(100),
+    CORS_ORIGIN: zod_1.z.string().default("http://localhost:4000"),
+    LOG_LEVEL: zod_1.z.string().default("debug"),
+    EMAIL_HOST: zod_1.z.string().min(1),
+    EMAIL_PORT: zod_1.z.coerce.number().int().positive().default(587),
+    EMAIL_SECURE: booleanFromString.default(false),
+    EMAIL_USER: zod_1.z.string().min(1),
+    EMAIL_PASSWORD: zod_1.z.string().min(1),
+    EMAIL_FROM: zod_1.z.string().min(1),
+    EMAIL_FROM_NAME: zod_1.z.string().default("Core API"),
+    PASSWORD_RESET_TOKEN_EXPIRY: zod_1.z.coerce.number().int().positive().default(15),
+    FIRST_ACCESS_TOKEN_EXPIRY: zod_1.z.coerce
+        .number()
+        .int()
+        .positive()
+        .default(1440),
+    PASSWORD_MAX_AGE_DAYS: zod_1.z.coerce.number().int().positive().default(90),
+    TOKEN_CLEANUP_CRON: zod_1.z.string().default("0 */6 * * *"),
+    AUDIT_LOG_CLEANUP_CRON: zod_1.z.string().default("0 3 * * *"),
+    AUDIT_LOG_RETENTION_DAYS: zod_1.z.coerce.number().int().positive().default(30),
+    NOTIFICATION_RETENTION_DAYS: zod_1.z.coerce
+        .number()
+        .int()
+        .positive()
+        .default(90),
+    SEED_ADMIN_NAME: zod_1.z.string().default("Administrador"),
+    SEED_ADMIN_EMAIL: zod_1.z.string().email().default("admin@admin.com"),
+    SEED_ADMIN_PASSWORD: zod_1.z.string().min(1).default("admin@123"),
+})
+    .superRefine((env, ctx) => {
+    if (env.NODE_ENV === "production" && !env.COOKIE_SECURE) {
+        ctx.addIssue({
+            code: zod_1.z.ZodIssueCode.custom,
+            path: ["COOKIE_SECURE"],
+            message: "COOKIE_SECURE deve ser true quando NODE_ENV=production",
+        });
+    }
+});
+function validateEnv(config) {
+    const parsed = exports.envSchema.safeParse(config);
+    if (!parsed.success) {
+        const issues = parsed.error.issues
+            .map((i) => `  - ${i.path.join(".")}: ${i.message}`)
+            .join("\n");
+        throw new Error(`Variáveis de ambiente inválidas:\n${issues}`);
+    }
+    return parsed.data;
+}

package/dist/core/config/env.service.d.ts

@@ -0,0 +1,7 @@
+import { ConfigService } from "@nestjs/config";
+import { Env } from "./env.schema";
+export declare class EnvService {
+    private readonly config;
+    constructor(config: ConfigService<Env, true>);
+    get<K extends keyof Env>(key: K): Env[K];
+}

package/dist/core/config/env.service.js

@@ -0,0 +1,27 @@
+"use strict";
+var __decorate = (this && this.__decorate) || function (decorators, target, key, desc) {
+    var c = arguments.length, r = c < 3 ? target : desc === null ? desc = Object.getOwnPropertyDescriptor(target, key) : desc, d;
+    if (typeof Reflect === "object" && typeof Reflect.decorate === "function") r = Reflect.decorate(decorators, target, key, desc);
+    else for (var i = decorators.length - 1; i >= 0; i--) if (d = decorators[i]) r = (c < 3 ? d(r) : c > 3 ? d(target, key, r) : d(target, key)) || r;
+    return c > 3 && r && Object.defineProperty(target, key, r), r;
+};
+var __metadata = (this && this.__metadata) || function (k, v) {
+    if (typeof Reflect === "object" && typeof Reflect.metadata === "function") return Reflect.metadata(k, v);
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.EnvService = void 0;
+const common_1 = require("@nestjs/common");
+const config_1 = require("@nestjs/config");
+let EnvService = class EnvService {
+    constructor(config) {
+        this.config = config;
+    }
+    get(key) {
+        return this.config.get(key, { infer: true });
+    }
+};
+exports.EnvService = EnvService;
+exports.EnvService = EnvService = __decorate([
+    (0, common_1.Injectable)(),
+    __metadata("design:paramtypes", [config_1.ConfigService])
+], EnvService);

package/dist/core/context/auditContext.d.ts

@@ -0,0 +1,7 @@
+import { AsyncLocalStorage } from "node:async_hooks";
+export interface AuditContextStore {
+    userId?: string | null;
+    ipAddress?: string | null;
+    requestId?: string | null;
+}
+export declare const auditContext: AsyncLocalStorage<AuditContextStore>;

package/dist/core/context/auditContext.js

@@ -0,0 +1,5 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.auditContext = void 0;
+const node_async_hooks_1 = require("node:async_hooks");
+exports.auditContext = new node_async_hooks_1.AsyncLocalStorage();

package/dist/core/core.module.d.ts

@@ -0,0 +1,11 @@
+import { DynamicModule } from "@nestjs/common";
+import { EntitySchema } from "typeorm";
+import { EnvValidator } from "./config/config.module";
+export type EntityClass = (new () => object) | EntitySchema;
+export interface CoreModuleOptions {
+    entities: EntityClass[];
+    validateEnv?: EnvValidator;
+}
+export declare class CoreModule {
+    static forRoot(options: CoreModuleOptions): DynamicModule;
+}

package/dist/core/core.module.js

@@ -0,0 +1,73 @@
+"use strict";
+var __decorate = (this && this.__decorate) || function (decorators, target, key, desc) {
+    var c = arguments.length, r = c < 3 ? target : desc === null ? desc = Object.getOwnPropertyDescriptor(target, key) : desc, d;
+    if (typeof Reflect === "object" && typeof Reflect.decorate === "function") r = Reflect.decorate(decorators, target, key, desc);
+    else for (var i = decorators.length - 1; i >= 0; i--) if (d = decorators[i]) r = (c < 3 ? d(r) : c > 3 ? d(target, key, r) : d(target, key)) || r;
+    return c > 3 && r && Object.defineProperty(target, key, r), r;
+};
+var CoreModule_1;
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.CoreModule = void 0;
+const common_1 = require("@nestjs/common");
+const core_1 = require("@nestjs/core");
+const event_emitter_1 = require("@nestjs/event-emitter");
+const schedule_1 = require("@nestjs/schedule");
+const throttler_1 = require("@nestjs/throttler");
+const typeorm_1 = require("@nestjs/typeorm");
+const appThrottler_guard_1 = require("./auth/guards/appThrottler.guard");
+const allExceptions_filter_1 = require("./filters/allExceptions.filter");
+const csrf_guard_1 = require("./auth/guards/csrf.guard");
+const config_module_1 = require("./config/config.module");
+const env_service_1 = require("./config/env.service");
+const health_controller_1 = require("./health/health.controller");
+const mailer_module_1 = require("./mailer/mailer.module");
+let CoreModule = CoreModule_1 = class CoreModule {
+    static forRoot(options) {
+        return {
+            module: CoreModule_1,
+            imports: [
+                config_module_1.ConfigModule.forRoot({ validateEnv: options.validateEnv }),
+                mailer_module_1.MailerModule,
+                schedule_1.ScheduleModule.forRoot(),
+                event_emitter_1.EventEmitterModule.forRoot(),
+                typeorm_1.TypeOrmModule.forRootAsync({
+                    inject: [env_service_1.EnvService],
+                    useFactory: (env) => ({
+                        type: "mysql",
+                        host: env.get("DB_HOST"),
+                        port: env.get("DB_PORT"),
+                        username: env.get("DB_USER"),
+                        password: env.get("DB_PASSWORD"),
+                        database: env.get("DB_NAME"),
+                        entities: options.entities,
+                        synchronize: false,
+                        logging: env.get("DB_LOGGING"),
+                        charset: "utf8mb4",
+                        timezone: "Z",
+                        ssl: env.get("DB_SSL") ? { rejectUnauthorized: true } : undefined,
+                    }),
+                }),
+                throttler_1.ThrottlerModule.forRootAsync({
+                    inject: [env_service_1.EnvService],
+                    useFactory: (env) => [
+                        {
+                            ttl: env.get("THROTTLE_TTL_SECONDS") * 1000,
+                            limit: env.get("THROTTLE_LIMIT"),
+                        },
+                    ],
+                }),
+            ],
+            controllers: [health_controller_1.HealthController],
+            providers: [
+                { provide: core_1.APP_GUARD, useClass: appThrottler_guard_1.AppThrottlerGuard },
+                { provide: core_1.APP_GUARD, useClass: csrf_guard_1.CsrfGuard },
+                { provide: core_1.APP_FILTER, useClass: allExceptions_filter_1.AllExceptionsFilter },
+            ],
+            exports: [mailer_module_1.MailerModule],
+        };
+    }
+};
+exports.CoreModule = CoreModule;
+exports.CoreModule = CoreModule = CoreModule_1 = __decorate([
+    (0, common_1.Module)({})
+], CoreModule);

package/dist/core/database/base.schema.d.ts

@@ -0,0 +1,7 @@
+export declare abstract class BaseEntity {
+    id: string;
+    createdAt: Date;
+    updatedAt: Date;
+    deletedAt?: Date | null;
+    protected generateId(): void;
+}

package/dist/core/database/base.schema.js

@@ -0,0 +1,49 @@
+"use strict";
+var __decorate = (this && this.__decorate) || function (decorators, target, key, desc) {
+    var c = arguments.length, r = c < 3 ? target : desc === null ? desc = Object.getOwnPropertyDescriptor(target, key) : desc, d;
+    if (typeof Reflect === "object" && typeof Reflect.decorate === "function") r = Reflect.decorate(decorators, target, key, desc);
+    else for (var i = decorators.length - 1; i >= 0; i--) if (d = decorators[i]) r = (c < 3 ? d(r) : c > 3 ? d(target, key, r) : d(target, key)) || r;
+    return c > 3 && r && Object.defineProperty(target, key, r), r;
+};
+var __metadata = (this && this.__metadata) || function (k, v) {
+    if (typeof Reflect === "object" && typeof Reflect.metadata === "function") return Reflect.metadata(k, v);
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.BaseEntity = void 0;
+const swagger_1 = require("@nestjs/swagger");
+const typeorm_1 = require("typeorm");
+const uuid_1 = require("uuid");
+class BaseEntity {
+    generateId() {
+        if (!this.id) {
+            this.id = (0, uuid_1.v7)();
+        }
+    }
+}
+exports.BaseEntity = BaseEntity;
+__decorate([
+    (0, swagger_1.ApiProperty)({ format: "uuid" }),
+    (0, typeorm_1.PrimaryColumn)({ type: "char", length: 36 }),
+    __metadata("design:type", String)
+], BaseEntity.prototype, "id", void 0);
+__decorate([
+    (0, swagger_1.ApiProperty)(),
+    (0, typeorm_1.CreateDateColumn)({ name: "created_at" }),
+    __metadata("design:type", Date)
+], BaseEntity.prototype, "createdAt", void 0);
+__decorate([
+    (0, swagger_1.ApiProperty)(),
+    (0, typeorm_1.UpdateDateColumn)({ name: "updated_at" }),
+    __metadata("design:type", Date)
+], BaseEntity.prototype, "updatedAt", void 0);
+__decorate([
+    (0, swagger_1.ApiProperty)({ required: false, nullable: true }),
+    (0, typeorm_1.DeleteDateColumn)({ name: "deleted_at", nullable: true }),
+    __metadata("design:type", Object)
+], BaseEntity.prototype, "deletedAt", void 0);
+__decorate([
+    (0, typeorm_1.BeforeInsert)(),
+    __metadata("design:type", Function),
+    __metadata("design:paramtypes", []),
+    __metadata("design:returntype", void 0)
+], BaseEntity.prototype, "generateId", null);

package/dist/core/database/createDataSource.util.d.ts

@@ -0,0 +1,8 @@
+import { DataSource } from "typeorm";
+import { EntityClass } from "../core.module";
+import { MigrationClass } from "./migrations";
+export interface CoreDataSourceOptions {
+    entities: EntityClass[];
+    migrations: MigrationClass[];
+}
+export declare const createCoreDataSource: (options: CoreDataSourceOptions) => DataSource;

package/dist/core/database/createDataSource.util.js

@@ -0,0 +1,27 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.createCoreDataSource = void 0;
+const typeorm_1 = require("typeorm");
+function requireEnv(name) {
+    const value = process.env[name];
+    if (!value) {
+        throw new Error(`${name} é obrigatória para rodar migrations/seeds (sem valor padrão, por segurança).`);
+    }
+    return value;
+}
+const createCoreDataSource = (options) => new typeorm_1.DataSource({
+    type: "mysql",
+    host: requireEnv("DB_HOST"),
+    port: Number(process.env.DB_PORT ?? 3306),
+    username: requireEnv("DB_USER"),
+    password: requireEnv("DB_PASSWORD"),
+    database: requireEnv("DB_NAME"),
+    entities: options.entities,
+    migrations: options.migrations,
+    synchronize: false,
+    logging: process.env.DB_LOGGING === "true",
+    charset: "utf8mb4",
+    timezone: "Z",
+    ssl: process.env.DB_SSL === "true" ? { rejectUnauthorized: true } : undefined,
+});
+exports.createCoreDataSource = createCoreDataSource;

package/dist/core/database/migrations/1710000000000-InitialSchema.d.ts

@@ -0,0 +1,6 @@
+import { MigrationInterface, QueryRunner } from "typeorm";
+export declare class InitialSchema1710000000000 implements MigrationInterface {
+    name: string;
+    up(queryRunner: QueryRunner): Promise<void>;
+    down(queryRunner: QueryRunner): Promise<void>;
+}

package/dist/core/database/migrations/1710000000000-InitialSchema.js

@@ -0,0 +1,272 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.InitialSchema1710000000000 = void 0;
+class InitialSchema1710000000000 {
+    constructor() {
+        this.name = "InitialSchema1710000000000";
+    }
+    async up(queryRunner) {
+        const ts = `
+      created_at datetime(6) NOT NULL DEFAULT CURRENT_TIMESTAMP(6),
+      updated_at datetime(6) NOT NULL DEFAULT CURRENT_TIMESTAMP(6) ON UPDATE CURRENT_TIMESTAMP(6),
+      deleted_at datetime(6) NULL
+    `;
+        await queryRunner.query(`
+      CREATE TABLE users (
+        id char(36) NOT NULL,
+        name varchar(100) NOT NULL,
+        last_name varchar(100) NULL,
+        phone varchar(20) NULL,
+        avatar varchar(500) NULL,
+        email varchar(255) NOT NULL,
+        password varchar(255) NOT NULL,
+        is_active tinyint NOT NULL DEFAULT 1,
+        two_factor_enabled tinyint NOT NULL DEFAULT 0,
+        two_factor_secret varchar(255) NULL,
+        two_factor_confirmed_at datetime NULL,
+        backup_codes json NULL,
+        failed_login_attempts int NOT NULL DEFAULT 0,
+        locked_until datetime NULL,
+        password_changed_at datetime NULL,
+        must_change_password tinyint NOT NULL DEFAULT 0,
+        ${ts},
+        PRIMARY KEY (id),
+        UNIQUE KEY UQ_users_email (email)
+      ) ENGINE=InnoDB DEFAULT CHARSET=utf8mb4;
+    `);
+        await queryRunner.query(`
+      CREATE TABLE password_history (
+        id char(36) NOT NULL,
+        user_id char(36) NOT NULL,
+        password_hash varchar(255) NOT NULL,
+        ${ts},
+        PRIMARY KEY (id),
+        KEY IDX_password_history_user (user_id)
+      ) ENGINE=InnoDB DEFAULT CHARSET=utf8mb4;
+    `);
+        await queryRunner.query(`
+      CREATE TABLE auth_tokens (
+        id char(36) NOT NULL,
+        user_id char(36) NOT NULL,
+        token_hash varchar(255) NOT NULL,
+        type varchar(30) NOT NULL,
+        family char(36) NULL,
+        expires_at datetime NOT NULL,
+        used tinyint NOT NULL DEFAULT 0,
+        revoked tinyint NOT NULL DEFAULT 0,
+        ip_address varchar(45) NULL,
+        user_agent text NULL,
+        ${ts},
+        PRIMARY KEY (id),
+        KEY IDX_auth_tokens_hash_type (token_hash, type),
+        KEY IDX_auth_tokens_user_type (user_id, type),
+        KEY IDX_auth_tokens_family (family)
+      ) ENGINE=InnoDB DEFAULT CHARSET=utf8mb4;
+    `);
+        await queryRunner.query(`
+      CREATE TABLE resources (
+        id char(36) NOT NULL,
+        name varchar(100) NOT NULL,
+        description varchar(255) NULL,
+        is_active tinyint NOT NULL DEFAULT 1,
+        ${ts},
+        PRIMARY KEY (id),
+        UNIQUE KEY UQ_resources_name (name)
+      ) ENGINE=InnoDB DEFAULT CHARSET=utf8mb4;
+    `);
+        await queryRunner.query(`
+      CREATE TABLE actions (
+        id char(36) NOT NULL,
+        name varchar(100) NOT NULL,
+        description varchar(255) NULL,
+        is_active tinyint NOT NULL DEFAULT 1,
+        ${ts},
+        PRIMARY KEY (id),
+        UNIQUE KEY UQ_actions_name (name)
+      ) ENGINE=InnoDB DEFAULT CHARSET=utf8mb4;
+    `);
+        await queryRunner.query(`
+      CREATE TABLE scopes (
+        id char(36) NOT NULL,
+        name varchar(100) NOT NULL,
+        description varchar(255) NULL,
+        is_active tinyint NOT NULL DEFAULT 1,
+        ${ts},
+        PRIMARY KEY (id),
+        UNIQUE KEY UQ_scopes_name (name)
+      ) ENGINE=InnoDB DEFAULT CHARSET=utf8mb4;
+    `);
+        await queryRunner.query(`
+      CREATE TABLE permissions (
+        id char(36) NOT NULL,
+        code varchar(150) NOT NULL,
+        description varchar(255) NULL,
+        is_active tinyint NOT NULL DEFAULT 1,
+        resource_id char(36) NOT NULL,
+        action_id char(36) NOT NULL,
+        scope_id char(36) NOT NULL,
+        ${ts},
+        PRIMARY KEY (id),
+        UNIQUE KEY UQ_permissions_code (code),
+        KEY IDX_permissions_resource (resource_id),
+        KEY IDX_permissions_action (action_id),
+        KEY IDX_permissions_scope (scope_id),
+        CONSTRAINT FK_permissions_resource FOREIGN KEY (resource_id) REFERENCES resources (id),
+        CONSTRAINT FK_permissions_action FOREIGN KEY (action_id) REFERENCES actions (id),
+        CONSTRAINT FK_permissions_scope FOREIGN KEY (scope_id) REFERENCES scopes (id)
+      ) ENGINE=InnoDB DEFAULT CHARSET=utf8mb4;
+    `);
+        await queryRunner.query(`
+      CREATE TABLE roles (
+        id char(36) NOT NULL,
+        name varchar(100) NOT NULL,
+        description varchar(255) NULL,
+        is_active tinyint NOT NULL DEFAULT 1,
+        ${ts},
+        PRIMARY KEY (id),
+        UNIQUE KEY UQ_roles_name (name)
+      ) ENGINE=InnoDB DEFAULT CHARSET=utf8mb4;
+    `);
+        await queryRunner.query(`
+      CREATE TABLE \`groups\` (
+        id char(36) NOT NULL,
+        name varchar(100) NOT NULL,
+        description varchar(255) NULL,
+        type varchar(50) NOT NULL DEFAULT 'team',
+        parent_id char(36) NULL,
+        is_active tinyint NOT NULL DEFAULT 1,
+        ${ts},
+        PRIMARY KEY (id),
+        KEY IDX_groups_parent (parent_id),
+        CONSTRAINT FK_groups_parent FOREIGN KEY (parent_id) REFERENCES \`groups\` (id)
+      ) ENGINE=InnoDB DEFAULT CHARSET=utf8mb4;
+    `);
+        await queryRunner.query(`
+      CREATE TABLE role_permissions (
+        role_id char(36) NOT NULL,
+        permission_id char(36) NOT NULL,
+        PRIMARY KEY (role_id, permission_id),
+        KEY IDX_role_permissions_perm (permission_id),
+        CONSTRAINT FK_role_permissions_role FOREIGN KEY (role_id) REFERENCES roles (id) ON DELETE CASCADE,
+        CONSTRAINT FK_role_permissions_perm FOREIGN KEY (permission_id) REFERENCES permissions (id) ON DELETE CASCADE
+      ) ENGINE=InnoDB DEFAULT CHARSET=utf8mb4;
+    `);
+        await queryRunner.query(`
+      CREATE TABLE user_roles (
+        user_id char(36) NOT NULL,
+        role_id char(36) NOT NULL,
+        PRIMARY KEY (user_id, role_id),
+        KEY IDX_user_roles_role (role_id),
+        CONSTRAINT FK_user_roles_user FOREIGN KEY (user_id) REFERENCES users (id) ON DELETE CASCADE,
+        CONSTRAINT FK_user_roles_role FOREIGN KEY (role_id) REFERENCES roles (id) ON DELETE CASCADE
+      ) ENGINE=InnoDB DEFAULT CHARSET=utf8mb4;
+    `);
+        await queryRunner.query(`
+      CREATE TABLE user_permissions (
+        user_id char(36) NOT NULL,
+        permission_id char(36) NOT NULL,
+        PRIMARY KEY (user_id, permission_id),
+        KEY IDX_user_permissions_perm (permission_id),
+        CONSTRAINT FK_user_permissions_user FOREIGN KEY (user_id) REFERENCES users (id) ON DELETE CASCADE,
+        CONSTRAINT FK_user_permissions_perm FOREIGN KEY (permission_id) REFERENCES permissions (id) ON DELETE CASCADE
+      ) ENGINE=InnoDB DEFAULT CHARSET=utf8mb4;
+    `);
+        await queryRunner.query(`
+      CREATE TABLE user_groups (
+        user_id char(36) NOT NULL,
+        group_id char(36) NOT NULL,
+        PRIMARY KEY (user_id, group_id),
+        KEY IDX_user_groups_group (group_id),
+        CONSTRAINT FK_user_groups_user FOREIGN KEY (user_id) REFERENCES users (id) ON DELETE CASCADE,
+        CONSTRAINT FK_user_groups_group FOREIGN KEY (group_id) REFERENCES \`groups\` (id) ON DELETE CASCADE
+      ) ENGINE=InnoDB DEFAULT CHARSET=utf8mb4;
+    `);
+        await queryRunner.query(`
+      CREATE TABLE group_roles (
+        group_id char(36) NOT NULL,
+        role_id char(36) NOT NULL,
+        PRIMARY KEY (group_id, role_id),
+        KEY IDX_group_roles_role (role_id),
+        CONSTRAINT FK_group_roles_group FOREIGN KEY (group_id) REFERENCES \`groups\` (id) ON DELETE CASCADE,
+        CONSTRAINT FK_group_roles_role FOREIGN KEY (role_id) REFERENCES roles (id) ON DELETE CASCADE
+      ) ENGINE=InnoDB DEFAULT CHARSET=utf8mb4;
+    `);
+        await queryRunner.query(`
+      CREATE TABLE audit_changes (
+        id char(36) NOT NULL,
+        user_id char(36) NULL,
+        action varchar(100) NOT NULL,
+        entity varchar(100) NULL,
+        entity_id varchar(36) NULL,
+        method varchar(10) NULL,
+        path varchar(255) NULL,
+        ip_address varchar(45) NULL,
+        metadata json NULL,
+        status_code int NULL,
+        duration_ms int NULL,
+        request_id char(36) NULL,
+        ${ts},
+        PRIMARY KEY (id),
+        KEY IDX_audit_changes_user (user_id),
+        KEY IDX_audit_changes_entity (entity),
+        KEY IDX_audit_changes_request_id (request_id),
+        KEY IDX_audit_changes_status_code (status_code)
+      ) ENGINE=InnoDB DEFAULT CHARSET=utf8mb4;
+    `);
+        await queryRunner.query(`
+      CREATE TABLE error_logs (
+        id char(36) NOT NULL,
+        status_code int NULL,
+        message varchar(255) NOT NULL,
+        stack text NULL,
+        method varchar(10) NULL,
+        path varchar(255) NULL,
+        user_id char(36) NULL,
+        ip_address varchar(45) NULL,
+        type enum('VALIDATION','AUTH','NOT_FOUND','RATE_LIMIT','DATABASE','INTEGRATION','INTERNAL') NOT NULL DEFAULT 'INTERNAL',
+        request_id char(36) NULL,
+        ${ts},
+        PRIMARY KEY (id),
+        KEY IDX_error_logs_status (status_code),
+        KEY IDX_error_logs_type (type),
+        KEY IDX_error_logs_request_id (request_id)
+      ) ENGINE=InnoDB DEFAULT CHARSET=utf8mb4;
+    `);
+        await queryRunner.query(`
+      CREATE TABLE audit_data_changes (
+        id char(36) NOT NULL,
+        entity varchar(100) NOT NULL,
+        entity_id varchar(36) NULL,
+        action enum('CREATE','UPDATE','DELETE') NOT NULL,
+        old_data json NULL,
+        new_data json NULL,
+        user_id char(36) NULL,
+        ip_address varchar(45) NULL,
+        ${ts},
+        PRIMARY KEY (id),
+        KEY IDX_audit_data_changes_entity (entity, entity_id),
+        KEY IDX_audit_data_changes_user (user_id)
+      ) ENGINE=InnoDB DEFAULT CHARSET=utf8mb4;
+    `);
+    }
+    async down(queryRunner) {
+        await queryRunner.query("DROP TABLE IF EXISTS audit_data_changes;");
+        await queryRunner.query("DROP TABLE IF EXISTS error_logs;");
+        await queryRunner.query("DROP TABLE IF EXISTS audit_changes;");
+        await queryRunner.query("DROP TABLE IF EXISTS group_roles;");
+        await queryRunner.query("DROP TABLE IF EXISTS user_groups;");
+        await queryRunner.query("DROP TABLE IF EXISTS user_permissions;");
+        await queryRunner.query("DROP TABLE IF EXISTS user_roles;");
+        await queryRunner.query("DROP TABLE IF EXISTS role_permissions;");
+        await queryRunner.query("DROP TABLE IF EXISTS `groups`;");
+        await queryRunner.query("DROP TABLE IF EXISTS roles;");
+        await queryRunner.query("DROP TABLE IF EXISTS permissions;");
+        await queryRunner.query("DROP TABLE IF EXISTS scopes;");
+        await queryRunner.query("DROP TABLE IF EXISTS actions;");
+        await queryRunner.query("DROP TABLE IF EXISTS resources;");
+        await queryRunner.query("DROP TABLE IF EXISTS auth_tokens;");
+        await queryRunner.query("DROP TABLE IF EXISTS password_history;");
+        await queryRunner.query("DROP TABLE IF EXISTS users;");
+    }
+}
+exports.InitialSchema1710000000000 = InitialSchema1710000000000;

package/dist/core/database/migrations/1786060800000-FirstAccessTokenType.d.ts

@@ -0,0 +1,6 @@
+import { MigrationInterface, QueryRunner } from "typeorm";
+export declare class FirstAccessTokenType1786060800000 implements MigrationInterface {
+    name: string;
+    up(queryRunner: QueryRunner): Promise<void>;
+    down(queryRunner: QueryRunner): Promise<void>;
+}

package/dist/core/database/migrations/1786060800000-FirstAccessTokenType.js

@@ -0,0 +1,19 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.FirstAccessTokenType1786060800000 = void 0;
+class FirstAccessTokenType1786060800000 {
+    constructor() {
+        this.name = "FirstAccessTokenType1786060800000";
+    }
+    async up(queryRunner) {
+        await queryRunner.query(`
+      ALTER TABLE auth_tokens
+      MODIFY COLUMN type ENUM('password_reset','first_access','two_factor_email','refresh_token','totp_used') NOT NULL
+    `);
+    }
+    async down(queryRunner) {
+        await queryRunner.query(`DELETE FROM auth_tokens WHERE type = 'first_access'`);
+        await queryRunner.query(`ALTER TABLE auth_tokens MODIFY COLUMN type varchar(30) NOT NULL`);
+    }
+}
+exports.FirstAccessTokenType1786060800000 = FirstAccessTokenType1786060800000;

package/dist/core/database/migrations/1786147200000-PermanentAccountLock.d.ts

@@ -0,0 +1,6 @@
+import { MigrationInterface, QueryRunner } from "typeorm";
+export declare class PermanentAccountLock1786147200000 implements MigrationInterface {
+    name: string;
+    up(queryRunner: QueryRunner): Promise<void>;
+    down(queryRunner: QueryRunner): Promise<void>;
+}

package/dist/core/database/migrations/1786147200000-PermanentAccountLock.js

@@ -0,0 +1,15 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.PermanentAccountLock1786147200000 = void 0;
+class PermanentAccountLock1786147200000 {
+    constructor() {
+        this.name = "PermanentAccountLock1786147200000";
+    }
+    async up(queryRunner) {
+        await queryRunner.query(`ALTER TABLE users DROP COLUMN locked_until`);
+    }
+    async down(queryRunner) {
+        await queryRunner.query(`ALTER TABLE users ADD COLUMN locked_until datetime NULL`);
+    }
+}
+exports.PermanentAccountLock1786147200000 = PermanentAccountLock1786147200000;

package/dist/core/database/migrations/1786233600000-Notifications.d.ts

@@ -0,0 +1,6 @@
+import { MigrationInterface, QueryRunner } from "typeorm";
+export declare class Notifications1786233600000 implements MigrationInterface {
+    name: string;
+    up(queryRunner: QueryRunner): Promise<void>;
+    down(queryRunner: QueryRunner): Promise<void>;
+}