rl-core-api 0.1.0

package/dist/features/audit/presentation/responses/log.response.js

@@ -0,0 +1,164 @@
+"use strict";
+var __decorate = (this && this.__decorate) || function (decorators, target, key, desc) {
+    var c = arguments.length, r = c < 3 ? target : desc === null ? desc = Object.getOwnPropertyDescriptor(target, key) : desc, d;
+    if (typeof Reflect === "object" && typeof Reflect.decorate === "function") r = Reflect.decorate(decorators, target, key, desc);
+    else for (var i = decorators.length - 1; i >= 0; i--) if (d = decorators[i]) r = (c < 3 ? d(r) : c > 3 ? d(target, key, r) : d(target, key)) || r;
+    return c > 3 && r && Object.defineProperty(target, key, r), r;
+};
+var __metadata = (this && this.__metadata) || function (k, v) {
+    if (typeof Reflect === "object" && typeof Reflect.metadata === "function") return Reflect.metadata(k, v);
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.PaginatedErrorLogsResponse = exports.ErrorLogResponse = exports.PaginatedRequestLogsResponse = exports.RequestLogResponse = void 0;
+const swagger_1 = require("@nestjs/swagger");
+const paginationMeta_response_1 = require("../../../../core/utils/paginationMeta.response");
+const errorLog_schema_1 = require("../../infra/schema/errorLog.schema");
+const auditDataChange_response_1 = require("./auditDataChange.response");
+class RequestLogResponse {
+}
+exports.RequestLogResponse = RequestLogResponse;
+__decorate([
+    (0, swagger_1.ApiProperty)({ format: "uuid" }),
+    __metadata("design:type", String)
+], RequestLogResponse.prototype, "id", void 0);
+__decorate([
+    (0, swagger_1.ApiProperty)({ example: "GET /api/v1/users" }),
+    __metadata("design:type", String)
+], RequestLogResponse.prototype, "action", void 0);
+__decorate([
+    (0, swagger_1.ApiProperty)({ type: String, required: false, nullable: true, example: "User" }),
+    __metadata("design:type", Object)
+], RequestLogResponse.prototype, "entity", void 0);
+__decorate([
+    (0, swagger_1.ApiProperty)({ type: String, required: false, nullable: true }),
+    __metadata("design:type", Object)
+], RequestLogResponse.prototype, "entityId", void 0);
+__decorate([
+    (0, swagger_1.ApiProperty)({ type: String, required: false, nullable: true, example: "GET" }),
+    __metadata("design:type", Object)
+], RequestLogResponse.prototype, "method", void 0);
+__decorate([
+    (0, swagger_1.ApiProperty)({ type: String, required: false, nullable: true }),
+    __metadata("design:type", Object)
+], RequestLogResponse.prototype, "path", void 0);
+__decorate([
+    (0, swagger_1.ApiProperty)({ type: Number, required: false, nullable: true, example: 200 }),
+    __metadata("design:type", Object)
+], RequestLogResponse.prototype, "statusCode", void 0);
+__decorate([
+    (0, swagger_1.ApiProperty)({ type: Number, required: false, nullable: true, example: 42 }),
+    __metadata("design:type", Object)
+], RequestLogResponse.prototype, "durationMs", void 0);
+__decorate([
+    (0, swagger_1.ApiProperty)({ type: String, required: false, nullable: true, example: "10.0.0.1" }),
+    __metadata("design:type", Object)
+], RequestLogResponse.prototype, "ipAddress", void 0);
+__decorate([
+    (0, swagger_1.ApiProperty)({ type: String, required: false, nullable: true, format: "uuid" }),
+    __metadata("design:type", Object)
+], RequestLogResponse.prototype, "requestId", void 0);
+__decorate([
+    (0, swagger_1.ApiProperty)({ type: Object, required: false, nullable: true }),
+    __metadata("design:type", Object)
+], RequestLogResponse.prototype, "metadata", void 0);
+__decorate([
+    (0, swagger_1.ApiProperty)({ type: String, required: false, nullable: true }),
+    __metadata("design:type", Object)
+], RequestLogResponse.prototype, "userId", void 0);
+__decorate([
+    (0, swagger_1.ApiProperty)({ type: auditDataChange_response_1.AuditUserRefResponse, required: false, nullable: true }),
+    __metadata("design:type", Object)
+], RequestLogResponse.prototype, "user", void 0);
+__decorate([
+    (0, swagger_1.ApiProperty)({ format: "date-time" }),
+    __metadata("design:type", Date)
+], RequestLogResponse.prototype, "createdAt", void 0);
+__decorate([
+    (0, swagger_1.ApiProperty)({ format: "date-time" }),
+    __metadata("design:type", Date)
+], RequestLogResponse.prototype, "updatedAt", void 0);
+__decorate([
+    (0, swagger_1.ApiProperty)({ type: String, format: "date-time", required: false, nullable: true }),
+    __metadata("design:type", Object)
+], RequestLogResponse.prototype, "deletedAt", void 0);
+class PaginatedRequestLogsResponse {
+}
+exports.PaginatedRequestLogsResponse = PaginatedRequestLogsResponse;
+__decorate([
+    (0, swagger_1.ApiProperty)({ type: [RequestLogResponse] }),
+    __metadata("design:type", Array)
+], PaginatedRequestLogsResponse.prototype, "items", void 0);
+__decorate([
+    (0, swagger_1.ApiProperty)({ type: paginationMeta_response_1.PaginationMetaResponse }),
+    __metadata("design:type", paginationMeta_response_1.PaginationMetaResponse)
+], PaginatedRequestLogsResponse.prototype, "meta", void 0);
+class ErrorLogResponse {
+}
+exports.ErrorLogResponse = ErrorLogResponse;
+__decorate([
+    (0, swagger_1.ApiProperty)({ format: "uuid" }),
+    __metadata("design:type", String)
+], ErrorLogResponse.prototype, "id", void 0);
+__decorate([
+    (0, swagger_1.ApiProperty)({ enum: errorLog_schema_1.ErrorType, enumName: "ErrorType" }),
+    __metadata("design:type", String)
+], ErrorLogResponse.prototype, "type", void 0);
+__decorate([
+    (0, swagger_1.ApiProperty)({ type: Number, required: false, nullable: true, example: 500 }),
+    __metadata("design:type", Object)
+], ErrorLogResponse.prototype, "statusCode", void 0);
+__decorate([
+    (0, swagger_1.ApiProperty)(),
+    __metadata("design:type", String)
+], ErrorLogResponse.prototype, "message", void 0);
+__decorate([
+    (0, swagger_1.ApiProperty)({ type: String, required: false, nullable: true }),
+    __metadata("design:type", Object)
+], ErrorLogResponse.prototype, "stack", void 0);
+__decorate([
+    (0, swagger_1.ApiProperty)({ type: String, required: false, nullable: true, example: "POST" }),
+    __metadata("design:type", Object)
+], ErrorLogResponse.prototype, "method", void 0);
+__decorate([
+    (0, swagger_1.ApiProperty)({ type: String, required: false, nullable: true }),
+    __metadata("design:type", Object)
+], ErrorLogResponse.prototype, "path", void 0);
+__decorate([
+    (0, swagger_1.ApiProperty)({ type: String, required: false, nullable: true, example: "10.0.0.1" }),
+    __metadata("design:type", Object)
+], ErrorLogResponse.prototype, "ipAddress", void 0);
+__decorate([
+    (0, swagger_1.ApiProperty)({ type: String, required: false, nullable: true, format: "uuid" }),
+    __metadata("design:type", Object)
+], ErrorLogResponse.prototype, "requestId", void 0);
+__decorate([
+    (0, swagger_1.ApiProperty)({ type: String, required: false, nullable: true }),
+    __metadata("design:type", Object)
+], ErrorLogResponse.prototype, "userId", void 0);
+__decorate([
+    (0, swagger_1.ApiProperty)({ type: auditDataChange_response_1.AuditUserRefResponse, required: false, nullable: true }),
+    __metadata("design:type", Object)
+], ErrorLogResponse.prototype, "user", void 0);
+__decorate([
+    (0, swagger_1.ApiProperty)({ format: "date-time" }),
+    __metadata("design:type", Date)
+], ErrorLogResponse.prototype, "createdAt", void 0);
+__decorate([
+    (0, swagger_1.ApiProperty)({ format: "date-time" }),
+    __metadata("design:type", Date)
+], ErrorLogResponse.prototype, "updatedAt", void 0);
+__decorate([
+    (0, swagger_1.ApiProperty)({ type: String, format: "date-time", required: false, nullable: true }),
+    __metadata("design:type", Object)
+], ErrorLogResponse.prototype, "deletedAt", void 0);
+class PaginatedErrorLogsResponse {
+}
+exports.PaginatedErrorLogsResponse = PaginatedErrorLogsResponse;
+__decorate([
+    (0, swagger_1.ApiProperty)({ type: [ErrorLogResponse] }),
+    __metadata("design:type", Array)
+], PaginatedErrorLogsResponse.prototype, "items", void 0);
+__decorate([
+    (0, swagger_1.ApiProperty)({ type: paginationMeta_response_1.PaginationMetaResponse }),
+    __metadata("design:type", paginationMeta_response_1.PaginationMetaResponse)
+], PaginatedErrorLogsResponse.prototype, "meta", void 0);

package/dist/features/auth/auth.module.d.ts

@@ -0,0 +1,2 @@
+export declare class AuthModule {
+}

package/dist/features/auth/auth.module.js

@@ -0,0 +1,55 @@
+"use strict";
+var __decorate = (this && this.__decorate) || function (decorators, target, key, desc) {
+    var c = arguments.length, r = c < 3 ? target : desc === null ? desc = Object.getOwnPropertyDescriptor(target, key) : desc, d;
+    if (typeof Reflect === "object" && typeof Reflect.decorate === "function") r = Reflect.decorate(decorators, target, key, desc);
+    else for (var i = decorators.length - 1; i >= 0; i--) if (d = decorators[i]) r = (c < 3 ? d(r) : c > 3 ? d(target, key, r) : d(target, key)) || r;
+    return c > 3 && r && Object.defineProperty(target, key, r), r;
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.AuthModule = void 0;
+const common_1 = require("@nestjs/common");
+const core_1 = require("@nestjs/core");
+const jwt_1 = require("@nestjs/jwt");
+const passport_1 = require("@nestjs/passport");
+const jwtAuth_guard_1 = require("../../core/auth/guards/jwtAuth.guard");
+const env_service_1 = require("../../core/config/env.service");
+const wsAuth_service_1 = require("../../core/websocket/wsAuth.service");
+const wsUserResolver_interface_1 = require("../../core/websocket/wsUserResolver.interface");
+const domain_1 = require("./domain");
+const presentation_1 = require("./presentation");
+const token_module_1 = require("./token.module");
+const rbac_module_1 = require("../rbac/rbac.module");
+const users_module_1 = require("../users/users.module");
+let AuthModule = class AuthModule {
+};
+exports.AuthModule = AuthModule;
+exports.AuthModule = AuthModule = __decorate([
+    (0, common_1.Module)({
+        imports: [
+            token_module_1.TokenModule,
+            passport_1.PassportModule,
+            jwt_1.JwtModule.registerAsync({
+                inject: [env_service_1.EnvService],
+                useFactory: (env) => ({
+                    secret: env.get("JWT_ACCESS_SECRET"),
+                    signOptions: {
+                        expiresIn: env.get("JWT_ACCESS_EXPIRES"),
+                    },
+                }),
+            }),
+            users_module_1.UsersModule,
+            rbac_module_1.RbacModule,
+        ],
+        controllers: [presentation_1.AuthController],
+        providers: [
+            domain_1.AuthService,
+            domain_1.TwoFactorService,
+            presentation_1.JwtStrategy,
+            { provide: core_1.APP_GUARD, useClass: jwtAuth_guard_1.JwtAuthGuard },
+            domain_1.WsUserResolverService,
+            { provide: wsUserResolver_interface_1.WS_USER_RESOLVER, useExisting: domain_1.WsUserResolverService },
+            wsAuth_service_1.WsAuthService,
+        ],
+        exports: [token_module_1.TokenModule, wsAuth_service_1.WsAuthService],
+    })
+], AuthModule);

package/dist/features/auth/domain/auth.service.d.ts

@@ -0,0 +1,66 @@
+import { JwtService } from "@nestjs/jwt";
+import { AuthenticatedUser } from "../../../core/auth/authenticatedUser.interface";
+import { EnvService } from "../../../core/config/env.service";
+import { MailerService } from "../../../core/mailer/mailer.service";
+import { PasswordTokenPurpose, PasswordTokenStatus, TokenService } from "./token.service";
+import { TotpSetup, TwoFactorService } from "./twoFactor.service";
+import { LoginCommand } from "../presentation/commands/login.command";
+import { VerifyTwoFactorCommand } from "../presentation/commands/twoFactor.command";
+import { RbacService } from "../../rbac/domain/rbac.service";
+import { UsersService } from "../../users/domain/users.service";
+import { User } from "../../users/infra/schema/user.schema";
+interface RequestCtx {
+    ipAddress?: string;
+    userAgent?: string;
+}
+export type LoginStatus = "SETUP_REQUIRED" | "TOTP_REQUIRED";
+export type SessionUser = AuthenticatedUser;
+export interface LoginSession {
+    accessToken: string;
+    refreshToken: string;
+    user: SessionUser;
+}
+export interface VerifiedSession extends LoginSession {
+    backupCodes?: string[];
+}
+export interface RefreshedTokens {
+    accessToken: string;
+    refreshToken: string;
+}
+export interface PasswordTokenCheck {
+    valid: boolean;
+    status: PasswordTokenStatus;
+    purpose?: PasswordTokenPurpose;
+}
+export declare class AuthService {
+    private readonly users;
+    private readonly tokens;
+    private readonly twoFactor;
+    private readonly jwt;
+    private readonly env;
+    private readonly mailer;
+    private readonly rbac;
+    private dummyHash?;
+    constructor(users: UsersService, tokens: TokenService, twoFactor: TwoFactorService, jwt: JwtService, env: EnvService, mailer: MailerService, rbac: RbacService);
+    login(dto: LoginCommand): Promise<{
+        status: LoginStatus;
+        pendingToken: string;
+    }>;
+    setupTotp(pendingToken: string): Promise<TotpSetup>;
+    requestEmailCode(pendingToken: string): Promise<{
+        sent: boolean;
+    }>;
+    verifyTwoFactor(dto: VerifyTwoFactorCommand, ctx: RequestCtx): Promise<VerifiedSession>;
+    regenerateBackupCodes(userId: string, code: string): Promise<string[]>;
+    refresh(rawToken: string | undefined, ctx: RequestCtx): Promise<RefreshedTokens>;
+    logout(rawRefreshToken?: string): Promise<void>;
+    forgotPassword(email: string): Promise<void>;
+    inspectPasswordToken(token: string): Promise<PasswordTokenCheck>;
+    resetPassword(token: string, newPassword: string): Promise<void>;
+    private buildPendingToken;
+    private decodePending;
+    private signAccessToken;
+    toSessionUser(user: User): Promise<SessionUser>;
+    private finalizeLogin;
+}
+export {};

package/dist/features/auth/domain/auth.service.js

@@ -0,0 +1,289 @@
+"use strict";
+var __decorate = (this && this.__decorate) || function (decorators, target, key, desc) {
+    var c = arguments.length, r = c < 3 ? target : desc === null ? desc = Object.getOwnPropertyDescriptor(target, key) : desc, d;
+    if (typeof Reflect === "object" && typeof Reflect.decorate === "function") r = Reflect.decorate(decorators, target, key, desc);
+    else for (var i = decorators.length - 1; i >= 0; i--) if (d = decorators[i]) r = (c < 3 ? d(r) : c > 3 ? d(target, key, r) : d(target, key)) || r;
+    return c > 3 && r && Object.defineProperty(target, key, r), r;
+};
+var __metadata = (this && this.__metadata) || function (k, v) {
+    if (typeof Reflect === "object" && typeof Reflect.metadata === "function") return Reflect.metadata(k, v);
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.AuthService = void 0;
+const common_1 = require("@nestjs/common");
+const jwt_1 = require("@nestjs/jwt");
+const env_service_1 = require("../../../core/config/env.service");
+const appErrorCode_enum_1 = require("../../../core/filters/appErrorCode.enum");
+const mailer_service_1 = require("../../../core/mailer/mailer.service");
+const codedError_util_1 = require("../../../core/utils/codedError.util");
+const hash_util_1 = require("../../../core/utils/hash.util");
+const token_service_1 = require("./token.service");
+const twoFactor_service_1 = require("./twoFactor.service");
+const rbac_service_1 = require("../../rbac/domain/rbac.service");
+const users_service_1 = require("../../users/domain/users.service");
+const BACKUP_FORMAT = /^[A-Za-z0-9]{4}-[A-Za-z0-9]{4}$/;
+const ACCOUNT_INACTIVE_MESSAGE = "Conta desativada. Entre em contato com o administrador do sistema";
+const ACCOUNT_LOCKED_MESSAGE = "Conta bloqueada por excesso de tentativas. Peça ao administrador o envio de um novo link para definir sua senha";
+const accountLocked = () => (0, codedError_util_1.codedUnauthorized)(ACCOUNT_LOCKED_MESSAGE, appErrorCode_enum_1.AppErrorCode.ACCOUNT_LOCKED);
+const accountInactive = () => (0, codedError_util_1.codedUnauthorized)(ACCOUNT_INACTIVE_MESSAGE, appErrorCode_enum_1.AppErrorCode.ACCOUNT_INACTIVE);
+function attemptsWarning(prefix, remaining) {
+    const attempts = remaining === 1 ? "Resta 1 tentativa" : `Restam ${remaining} tentativas`;
+    return `${prefix}. ${attempts} antes do bloqueio da conta`;
+}
+const PENDING_EXPIRES = "10m";
+let AuthService = class AuthService {
+    constructor(users, tokens, twoFactor, jwt, env, mailer, rbac) {
+        this.users = users;
+        this.tokens = tokens;
+        this.twoFactor = twoFactor;
+        this.jwt = jwt;
+        this.env = env;
+        this.mailer = mailer;
+        this.rbac = rbac;
+    }
+    async login(dto) {
+        const generic = (0, codedError_util_1.codedUnauthorized)("Credenciais inválidas", appErrorCode_enum_1.AppErrorCode.INVALID_CREDENTIALS);
+        const user = await this.users.findByEmail(dto.email);
+        if (!user) {
+            this.dummyHash ??= (0, hash_util_1.hashPassword)("dummy-password-for-timing-safety");
+            await (0, hash_util_1.verifyPassword)(await this.dummyHash, dto.password);
+            throw generic;
+        }
+        if (!user.isActive) {
+            throw accountInactive();
+        }
+        const maxAttempts = this.env.get("LOGIN_MAX_ATTEMPTS");
+        if (user.isLocked(maxAttempts)) {
+            throw accountLocked();
+        }
+        const ok = await (0, hash_util_1.verifyPassword)(user.password, dto.password);
+        if (!ok) {
+            const remaining = await this.users.registerFailedLogin(user);
+            if (remaining === 0) {
+                throw accountLocked();
+            }
+            throw (0, codedError_util_1.codedUnauthorized)(attemptsWarning("Credenciais inválidas", remaining), appErrorCode_enum_1.AppErrorCode.INVALID_CREDENTIALS);
+        }
+        await this.users.clearLock(user);
+        const pendingToken = await this.buildPendingToken(user);
+        return {
+            status: user.twoFactorEnabled ? "TOTP_REQUIRED" : "SETUP_REQUIRED",
+            pendingToken,
+        };
+    }
+    async setupTotp(pendingToken) {
+        const payload = await this.decodePending(pendingToken);
+        if (payload.enrolled) {
+            throw new common_1.BadRequestException("2FA já está configurado para esta conta");
+        }
+        const user = await this.users.findById(payload.sub);
+        const setup = await this.twoFactor.generateSetup(user.email);
+        user.twoFactorSecret = this.twoFactor.encrypt(setup.secret);
+        await this.users.save(user);
+        return setup;
+    }
+    async requestEmailCode(pendingToken) {
+        const payload = await this.decodePending(pendingToken);
+        if (!payload.enrolled) {
+            throw new common_1.BadRequestException("Configure o aplicativo autenticador antes de usar o email como fallback");
+        }
+        const user = await this.users.findById(payload.sub);
+        const code = await this.tokens.issueTwoFactorEmailCode(user.id);
+        await this.mailer.sendTwoFactorCode(user.email, code, user.name);
+        return { sent: true };
+    }
+    async verifyTwoFactor(dto, ctx) {
+        const payload = await this.decodePending(dto.pendingToken);
+        const user = await this.users.findById(payload.sub);
+        const maxAttempts = this.env.get("LOGIN_MAX_ATTEMPTS");
+        if (user.isLocked(maxAttempts)) {
+            throw accountLocked();
+        }
+        let valid = false;
+        let remainingBackup = null;
+        const isBackup = dto.method === "backup" || BACKUP_FORMAT.test(dto.code);
+        if (isBackup) {
+            if (user.backupCodes?.length) {
+                remainingBackup = await this.twoFactor.consumeBackupCode(dto.code.toUpperCase(), user.backupCodes);
+                valid = remainingBackup !== null;
+            }
+        }
+        else if (dto.method === "email") {
+            valid = await this.tokens.consumeTwoFactorEmailCode(user.id, dto.code);
+        }
+        else {
+            const alreadyUsed = await this.tokens.isTotpCodeUsed(user.id, dto.code);
+            valid =
+                !alreadyUsed &&
+                    (await this.twoFactor.verifyTotp(dto.code, user.twoFactorSecret ?? ""));
+            if (valid) {
+                await this.tokens.markTotpCodeUsed(user.id, dto.code);
+            }
+            else {
+                valid = await this.tokens.consumeTwoFactorEmailCode(user.id, dto.code);
+            }
+        }
+        if (!valid) {
+            const remaining = await this.users.registerFailedLogin(user);
+            if (remaining === 0) {
+                throw accountLocked();
+            }
+            throw (0, codedError_util_1.codedUnauthorized)(attemptsWarning("Código de verificação inválido", remaining), appErrorCode_enum_1.AppErrorCode.INVALID_TWO_FACTOR_CODE);
+        }
+        await this.users.clearLock(user);
+        let backupCodes;
+        if (!user.twoFactorEnabled) {
+            const generated = await this.twoFactor.generateBackupCodes();
+            user.twoFactorEnabled = true;
+            user.twoFactorConfirmedAt = new Date();
+            user.backupCodes = generated.hashed;
+            backupCodes = generated.plain;
+        }
+        else if (remainingBackup) {
+            user.backupCodes = remainingBackup;
+        }
+        await this.users.save(user);
+        const tokens = await this.finalizeLogin(user, ctx);
+        return { ...tokens, backupCodes };
+    }
+    async regenerateBackupCodes(userId, code) {
+        const user = await this.users.findById(userId);
+        if (!user.twoFactorEnabled || !user.twoFactorSecret) {
+            throw new common_1.BadRequestException("2FA não está configurado");
+        }
+        const alreadyUsed = await this.tokens.isTotpCodeUsed(userId, code);
+        const valid = !alreadyUsed &&
+            (await this.twoFactor.verifyTotp(code, user.twoFactorSecret));
+        if (!valid) {
+            throw new common_1.UnauthorizedException("Código TOTP inválido");
+        }
+        await this.tokens.markTotpCodeUsed(userId, code);
+        const generated = await this.twoFactor.generateBackupCodes();
+        user.backupCodes = generated.hashed;
+        await this.users.save(user);
+        return generated.plain;
+    }
+    async refresh(rawToken, ctx) {
+        if (!rawToken) {
+            throw new common_1.UnauthorizedException("Refresh token ausente");
+        }
+        const { userId, rawToken: newRefresh } = await this.tokens.rotateRefreshToken(rawToken, ctx);
+        const user = await this.users.findById(userId);
+        if (!user.isActive) {
+            throw accountInactive();
+        }
+        const accessToken = await this.signAccessToken(user);
+        return { accessToken, refreshToken: newRefresh };
+    }
+    async logout(rawRefreshToken) {
+        if (!rawRefreshToken) {
+            return;
+        }
+        await this.tokens.revokeByRawToken(rawRefreshToken);
+    }
+    async forgotPassword(email) {
+        const user = await this.users.findByEmail(email);
+        if (!user || !user.isActive) {
+            return;
+        }
+        const token = await this.tokens.issuePasswordReset(user.id);
+        await this.mailer.sendPasswordReset(user.email, token, user.name);
+    }
+    async inspectPasswordToken(token) {
+        const inspection = await this.tokens.inspectPasswordToken(token);
+        return {
+            valid: inspection.status === token_service_1.PasswordTokenStatus.VALID,
+            status: inspection.status,
+            purpose: inspection.purpose,
+        };
+    }
+    async resetPassword(token, newPassword) {
+        const invalidToken = () => new common_1.BadRequestException("Token de redefinição inválido ou expirado");
+        const inspection = await this.tokens.inspectPasswordToken(token);
+        if (inspection.status !== token_service_1.PasswordTokenStatus.VALID || !inspection.userId) {
+            throw invalidToken();
+        }
+        await this.users.assertPasswordNotReused(inspection.userId, newPassword);
+        const consumed = await this.tokens.consumePasswordToken(token);
+        if (!consumed) {
+            throw invalidToken();
+        }
+        await this.users.resetPassword(consumed.userId, newPassword);
+        await this.tokens.revokeAllRefresh(consumed.userId);
+    }
+    async buildPendingToken(user) {
+        const payload = {
+            sub: user.id,
+            email: user.email,
+            purpose: "2fa",
+            enrolled: user.twoFactorEnabled,
+        };
+        return this.jwt.signAsync(payload, {
+            secret: this.env.get("JWT_PENDING_SECRET"),
+            expiresIn: PENDING_EXPIRES,
+        });
+    }
+    async decodePending(token) {
+        try {
+            const payload = await this.jwt.verifyAsync(token, {
+                secret: this.env.get("JWT_PENDING_SECRET"),
+            });
+            if (payload.purpose !== "2fa") {
+                throw new Error("purpose inválido");
+            }
+            return payload;
+        }
+        catch {
+            throw new common_1.UnauthorizedException("Token de verificação inválido ou expirado");
+        }
+    }
+    signAccessToken(user) {
+        const payload = {
+            sub: user.id,
+            email: user.email,
+            purpose: "access",
+        };
+        return this.jwt.signAsync(payload, {
+            secret: this.env.get("JWT_ACCESS_SECRET"),
+            expiresIn: this.env.get("JWT_ACCESS_EXPIRES"),
+        });
+    }
+    async toSessionUser(user) {
+        const [permissions, roles] = await Promise.all([
+            this.rbac.getUserPermissionCodes(user.id),
+            this.rbac.getUserRoleNames(user.id),
+        ]);
+        return {
+            id: user.id,
+            email: user.email,
+            name: user.name,
+            lastName: user.lastName,
+            avatar: user.avatar,
+            roles,
+            permissions,
+            twoFactorEnabled: user.twoFactorEnabled,
+            passwordExpired: user.isPasswordExpired(this.env.get("PASSWORD_MAX_AGE_DAYS")),
+            mustChangePassword: user.mustChangePassword,
+        };
+    }
+    async finalizeLogin(user, ctx) {
+        const accessToken = await this.signAccessToken(user);
+        const { rawToken } = await this.tokens.issueRefreshToken(user.id, undefined, ctx);
+        return {
+            accessToken,
+            refreshToken: rawToken,
+            user: await this.toSessionUser(user),
+        };
+    }
+};
+exports.AuthService = AuthService;
+exports.AuthService = AuthService = __decorate([
+    (0, common_1.Injectable)(),
+    __metadata("design:paramtypes", [users_service_1.UsersService,
+        token_service_1.TokenService,
+        twoFactor_service_1.TwoFactorService,
+        jwt_1.JwtService,
+        env_service_1.EnvService,
+        mailer_service_1.MailerService,
+        rbac_service_1.RbacService])
+], AuthService);

package/dist/features/auth/domain/index.d.ts

@@ -0,0 +1,5 @@
+export * from "./auth.service";
+export * from "./jwtPayload.interface";
+export * from "./token.service";
+export * from "./twoFactor.service";
+export * from "./wsUserResolver.service";

package/dist/features/auth/domain/index.js

@@ -0,0 +1,21 @@
+"use strict";
+var __createBinding = (this && this.__createBinding) || (Object.create ? (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    var desc = Object.getOwnPropertyDescriptor(m, k);
+    if (!desc || ("get" in desc ? !m.__esModule : desc.writable || desc.configurable)) {
+      desc = { enumerable: true, get: function() { return m[k]; } };
+    }
+    Object.defineProperty(o, k2, desc);
+}) : (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    o[k2] = m[k];
+}));
+var __exportStar = (this && this.__exportStar) || function(m, exports) {
+    for (var p in m) if (p !== "default" && !Object.prototype.hasOwnProperty.call(exports, p)) __createBinding(exports, m, p);
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+__exportStar(require("./auth.service"), exports);
+__exportStar(require("./jwtPayload.interface"), exports);
+__exportStar(require("./token.service"), exports);
+__exportStar(require("./twoFactor.service"), exports);
+__exportStar(require("./wsUserResolver.service"), exports);

package/dist/features/auth/domain/jwtPayload.interface.d.ts

@@ -0,0 +1,11 @@
+export interface AccessTokenPayload {
+    sub: string;
+    email: string;
+    purpose: "access";
+}
+export interface PendingTokenPayload {
+    sub: string;
+    email: string;
+    purpose: "2fa";
+    enrolled: boolean;
+}

package/dist/features/auth/domain/jwtPayload.interface.js

@@ -0,0 +1,2 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });