rl-core-api 0.13.1 → 0.14.1

package/dist/core/filters/allExceptions.filter.d.ts

@@ -6,6 +6,6 @@ export declare class AllExceptionsFilter implements ExceptionFilter {
     private readonly env;
     private readonly logger;
     constructor(events: EventEmitter2, env: EnvService);
-    catch(exception: unknown, host: ArgumentsHost): void;
+    catch(rawException: unknown, host: ArgumentsHost): void;
     private publish;
 }

package/dist/core/filters/allExceptions.filter.js

@@ -16,13 +16,25 @@ const env_service_1 = require("../config/env.service");
 const requestLog_context_1 = require("../context/requestLog.context");
 const appEvent_enum_1 = require("../events/appEvent.enum");
 const ip_util_1 = require("../utils/ip.util");
+const asHttpException = (exception) => {
+    if (!(exception instanceof Error) ||
+        exception.name !== "MulterError") {
+        return exception;
+    }
+    const code = exception.code;
+    if (code === "LIMIT_FILE_SIZE") {
+        return new common_1.PayloadTooLargeException("Arquivo excede o tamanho permitido");
+    }
+    return new common_1.BadRequestException("Envio de arquivo inválido");
+};
 let AllExceptionsFilter = class AllExceptionsFilter {
     constructor(events, env) {
         this.events = events;
         this.env = env;
         this.logger = new common_1.Logger("Exception");
     }
-    catch(exception, host) {
+    catch(rawException, host) {
+        const exception = asHttpException(rawException);
         const ctx = host.switchToHttp();
         const response = ctx.getResponse();
         const request = ctx.getRequest();

package/dist/features/auth/domain/auth.service.js

@@ -103,6 +103,9 @@ let AuthService = class AuthService {
     async verifyTwoFactor(dto, ctx) {
         const payload = await this.decodePending(dto.pendingToken);
         const user = await this.users.findById(payload.sub);
+        if (!user.isActive) {
+            throw accountInactive();
+        }
         const maxAttempts = this.env.get("LOGIN_MAX_ATTEMPTS");
         if (user.isLocked(maxAttempts)) {
             throw accountLocked();

package/dist/features/notifications/domain/notifications.service.js

@@ -67,13 +67,7 @@ let NotificationsService = class NotificationsService {
     async cleanupOldRead(retentionDays) {
         const limit = new Date();
         limit.setDate(limit.getDate() - retentionDays);
-        const result = await this.notifications
-            .createQueryBuilder()
-            .softDelete()
-            .where("created_at < :limit", { limit })
-            .andWhere(`EXISTS (SELECT 1 FROM notification_reads r WHERE r.notification_id = id)`)
-            .execute();
-        return result.affected ?? 0;
+        return await this.notifications.softDeleteReadByAllBefore(limit);
     }
     visibilityOf(user) {
         return { userId: user.id, roleNames: user.roles ?? [] };

package/dist/features/notifications/infra/repositories/notification.repository.d.ts

@@ -10,5 +10,6 @@ export declare class NotificationRepository extends Repository<Notification> {
     countUnread(params: VisibilityParams): Promise<number>;
     isVisibleToUser(notificationId: string, params: VisibilityParams): Promise<boolean>;
     findUnreadIds(params: VisibilityParams): Promise<string[]>;
+    softDeleteReadByAllBefore(limit: Date): Promise<number>;
     private baseVisibleQuery;
 }

package/dist/features/notifications/infra/repositories/notification.repository.js

@@ -25,6 +25,28 @@ const VISIBLE_TO_USER = `EXISTS (
     )
 )`;
 const NO_ROLES = ["-"];
+const HAS_PENDING_READER = `EXISTS (
+  SELECT 1
+    FROM users u
+    JOIN notification_scopes s
+      ON s.notification_id = notifications.id
+     AND s.deleted_at IS NULL
+     AND (
+          (s.scope_type = :userScope AND s.scope_key = u.id)
+       OR (s.scope_type = :roleScope AND EXISTS (
+             SELECT 1
+               FROM user_roles ur
+               JOIN roles r ON r.id = ur.role_id AND r.deleted_at IS NULL
+              WHERE ur.user_id = u.id AND r.name = s.scope_key))
+       OR s.scope_type = :allScope
+     )
+   WHERE u.deleted_at IS NULL
+     AND u.is_active = 1
+     AND NOT EXISTS (
+       SELECT 1 FROM notification_reads nr
+        WHERE nr.notification_id = notifications.id AND nr.user_id = u.id
+     )
+)`;
 let NotificationRepository = class NotificationRepository extends typeorm_1.Repository {
     constructor(dataSource) {
         super(notification_schema_1.Notification, dataSource.createEntityManager());
@@ -54,6 +76,18 @@ let NotificationRepository = class NotificationRepository extends typeorm_1.Repo
             .getRawMany();
         return rows.map((row) => row.id);
     }
+    async softDeleteReadByAllBefore(limit) {
+        const result = await this.createQueryBuilder()
+            .softDelete()
+            .where("created_at < :limit", { limit })
+            .andWhere(`NOT ${HAS_PENDING_READER}`, {
+            userScope: scopeType_enum_1.ScopeType.USER,
+            roleScope: scopeType_enum_1.ScopeType.ROLE,
+            allScope: scopeType_enum_1.ScopeType.ALL,
+        })
+            .execute();
+        return result.affected ?? 0;
+    }
     baseVisibleQuery(params) {
         return this.createQueryBuilder("notification")
             .leftJoinAndSelect("notification.reads", "read", "read.user_id = :userId", { userId: params.userId })

package/dist/features/rbac/domain/rbac.service.d.ts

@@ -54,7 +54,7 @@ export declare class RbacService {
     deletePermission(id: string): Promise<void>;
     listRoles(): Promise<Role[]>;
     getRole(id: string): Promise<Role>;
-    createRole(dto: CreateRoleCommand): Promise<Role>;
+    createRole(dto: CreateRoleCommand, actorPermissions?: string[]): Promise<Role>;
     updateRole(id: string, dto: UpdateRoleCommand, actorPermissions?: string[]): Promise<Role>;
     private assertGrantableByActor;
     deleteRole(id: string): Promise<void>;
@@ -71,8 +71,10 @@ export declare class RbacService {
     listGroups(): Promise<Group[]>;
     listManagedGroups(managerId: string): Promise<Group[]>;
     getGroup(id: string): Promise<Group>;
-    createGroup(dto: CreateGroupCommand): Promise<Group>;
-    updateGroup(id: string, dto: UpdateGroupCommand): Promise<Group>;
+    createGroup(dto: CreateGroupCommand, actorPermissions?: string[]): Promise<Group>;
+    updateGroup(id: string, dto: UpdateGroupCommand, actorPermissions?: string[]): Promise<Group>;
+    private resolveGrantableRoles;
+    private assertParentIsValid;
     deleteGroup(id: string): Promise<void>;
     addUserToGroup(groupId: string, userId: string): Promise<void>;
     removeUserFromGroup(groupId: string, userId: string): Promise<void>;

package/dist/features/rbac/domain/rbac.service.js

@@ -21,6 +21,7 @@ const resource_repository_1 = require("../infra/repositories/resource.repository
 const role_repository_1 = require("../infra/repositories/role.repository");
 const scope_repository_1 = require("../infra/repositories/scope.repository");
 const user_repository_1 = require("../../users/infra/repositories/user.repository");
+const isEnabled = (row) => row.isActive !== false;
 let RbacService = class RbacService {
     constructor(resourceRepo, actionRepo, scopeRepo, permissionRepo, roleRepo, groupRepo, userRepo, events) {
         this.resourceRepo = resourceRepo;
@@ -45,9 +46,16 @@ let RbacService = class RbacService {
             return [];
         }
         const codes = new Set();
-        user.directPermissions?.forEach((p) => codes.add(p.code));
-        user.roles?.forEach((r) => r.permissions?.forEach((p) => codes.add(p.code)));
-        user.groups?.forEach((g) => g.roles?.forEach((r) => r.permissions?.forEach((p) => codes.add(p.code))));
+        const addFrom = (permissions) => {
+            permissions
+                ?.filter((p) => isEnabled(p))
+                .forEach((p) => codes.add(p.code));
+        };
+        addFrom(user.directPermissions);
+        user.roles?.filter(isEnabled).forEach((r) => addFrom(r.permissions));
+        user.groups
+            ?.filter(isEnabled)
+            .forEach((g) => g.roles?.filter(isEnabled).forEach((r) => addFrom(r.permissions)));
         return [...codes];
     }
     async getUserRoleNames(userId) {
@@ -276,7 +284,7 @@ let RbacService = class RbacService {
         }
         return role;
     }
-    async createRole(dto) {
+    async createRole(dto, actorPermissions) {
         const exists = await this.roleRepo.findOne({
             where: { name: dto.name },
             withDeleted: true,
@@ -287,6 +295,7 @@ let RbacService = class RbacService {
         const permissions = dto.permissionIds?.length
             ? await this.permissionRepo.findBy({ id: (0, typeorm_1.In)(dto.permissionIds) })
             : [];
+        this.assertGrantableByActor(permissions, actorPermissions);
         const role = this.roleRepo.create({
             name: dto.name,
             description: dto.description,
@@ -440,22 +449,25 @@ let RbacService = class RbacService {
         }
         return group;
     }
-    async createGroup(dto) {
-        const roles = dto.roleIds?.length
-            ? await this.roleRepo.findBy({ id: (0, typeorm_1.In)(dto.roleIds) })
-            : [];
+    async createGroup(dto, actorPermissions) {
+        const roles = await this.resolveGrantableRoles(dto.roleIds, actorPermissions);
+        await this.assertParentIsValid(null, dto.parentId ?? null);
         const group = this.groupRepo.create({
             name: dto.name,
             description: dto.description,
             type: dto.type ?? "team",
             parentId: dto.parentId ?? null,
             managerId: dto.managerId ?? null,
-            roles,
+            roles: roles ?? [],
         });
         return this.groupRepo.save(group);
     }
-    async updateGroup(id, dto) {
+    async updateGroup(id, dto, actorPermissions) {
         const group = await this.getGroup(id);
+        const roles = await this.resolveGrantableRoles(dto.roleIds, actorPermissions);
+        if (dto.parentId !== undefined) {
+            await this.assertParentIsValid(id, dto.parentId ?? null);
+        }
         if (dto.name !== undefined) {
             group.name = dto.name;
         }
@@ -474,11 +486,43 @@ let RbacService = class RbacService {
         if (dto.isActive !== undefined) {
             group.isActive = dto.isActive;
         }
-        if (dto.roleIds) {
-            group.roles = await this.roleRepo.findBy({ id: (0, typeorm_1.In)(dto.roleIds) });
+        if (roles) {
+            group.roles = roles;
         }
         return this.groupRepo.save(group);
     }
+    async resolveGrantableRoles(roleIds, actorPermissions) {
+        if (!roleIds) {
+            return undefined;
+        }
+        if (roleIds.length === 0) {
+            return [];
+        }
+        const roles = await this.roleRepo.find({
+            where: { id: (0, typeorm_1.In)(roleIds) },
+            relations: { permissions: true },
+        });
+        if (roles.length !== roleIds.length) {
+            throw new common_1.NotFoundException("Algum dos papéis informados não existe");
+        }
+        this.assertGrantableByActor(roles.flatMap((role) => role.permissions ?? []), actorPermissions);
+        return roles;
+    }
+    async assertParentIsValid(groupId, parentId) {
+        if (!parentId) {
+            return;
+        }
+        if (parentId === groupId) {
+            throw new common_1.BadRequestException("Um grupo não pode ser pai de si mesmo");
+        }
+        const ancestorIds = await this.groupRepo.findAncestorIds(parentId);
+        if (ancestorIds.length === 0) {
+            throw new common_1.NotFoundException("Grupo pai não encontrado");
+        }
+        if (groupId && ancestorIds.includes(groupId)) {
+            throw new common_1.BadRequestException("O grupo pai não pode estar abaixo do próprio grupo");
+        }
+    }
     async deleteGroup(id) {
         const group = await this.getGroup(id);
         await this.groupRepo.softRemove(group);

package/dist/features/rbac/infra/repositories/group.repository.d.ts

@@ -3,5 +3,6 @@ import { Group } from "../schema/group.schema";
 export declare class GroupRepository extends Repository<Group> {
     constructor(dataSource: DataSource);
     findManagedGroupIds(managerId: string): Promise<string[]>;
+    findAncestorIds(groupId: string): Promise<string[]>;
     findMemberIds(groupIds: string[]): Promise<string[]>;
 }

package/dist/features/rbac/infra/repositories/group.repository.js

@@ -32,6 +32,21 @@ let GroupRepository = class GroupRepository extends typeorm_1.Repository {
       `, [managerId]);
         return rows.map((row) => row.id);
     }
+    async findAncestorIds(groupId) {
+        const rows = await this.query(`
+      WITH RECURSIVE ancestors AS (
+        SELECT id, parent_id FROM \`groups\`
+         WHERE id = ? AND deleted_at IS NULL
+        UNION ALL
+        SELECT parent.id, parent.parent_id
+          FROM \`groups\` parent
+         INNER JOIN ancestors ON ancestors.parent_id = parent.id
+         WHERE parent.deleted_at IS NULL
+      )
+      SELECT id FROM ancestors
+      `, [groupId]);
+        return rows.map((row) => row.id);
+    }
     async findMemberIds(groupIds) {
         if (groupIds.length === 0) {
             return [];

package/dist/features/rbac/presentation/rbac.controller.d.ts

@@ -41,14 +41,14 @@ export declare class RbacController {
     groups(): Promise<Group[]>;
     managedGroups(actor: AuthenticatedUser): Promise<Group[]>;
     group(id: string): Promise<Group>;
-    createGroup(dto: CreateGroupCommand): Promise<Group>;
-    updateGroup(id: string, dto: UpdateGroupCommand): Promise<Group>;
+    createGroup(dto: CreateGroupCommand, actor: AuthenticatedUser): Promise<Group>;
+    updateGroup(id: string, dto: UpdateGroupCommand, actor: AuthenticatedUser): Promise<Group>;
     deleteGroup(id: string): Promise<void>;
     addUserToGroup(id: string, userId: string): Promise<void>;
     removeUserFromGroup(id: string, userId: string): Promise<void>;
     roles(): Promise<Role[]>;
     role(id: string): Promise<Role>;
-    createRole(dto: CreateRoleCommand): Promise<Role>;
+    createRole(dto: CreateRoleCommand, actor: AuthenticatedUser): Promise<Role>;
     updateRole(id: string, dto: UpdateRoleCommand, actor: AuthenticatedUser): Promise<Role>;
     deleteRole(id: string): Promise<void>;
     addPermissionToRole(id: string, permissionId: string, actor: AuthenticatedUser): Promise<Role>;

package/dist/features/rbac/presentation/rbac.controller.js

@@ -95,11 +95,11 @@ let RbacController = class RbacController {
     group(id) {
         return this.rbac.getGroup(id);
     }
-    createGroup(dto) {
-        return this.rbac.createGroup(dto);
+    createGroup(dto, actor) {
+        return this.rbac.createGroup(dto, actor.permissions);
     }
-    updateGroup(id, dto) {
-        return this.rbac.updateGroup(id, dto);
+    updateGroup(id, dto, actor) {
+        return this.rbac.updateGroup(id, dto, actor.permissions);
     }
     deleteGroup(id) {
         return this.rbac.deleteGroup(id);
@@ -116,8 +116,8 @@ let RbacController = class RbacController {
     role(id) {
         return this.rbac.getRole(id);
     }
-    createRole(dto) {
-        return this.rbac.createRole(dto);
+    createRole(dto, actor) {
+        return this.rbac.createRole(dto, actor.permissions);
     }
     updateRole(id, dto, actor) {
         return this.rbac.updateRole(id, dto, actor.permissions);
@@ -319,8 +319,9 @@ __decorate([
     (0, requirePermission_decorator_1.RequirePermission)("groups:create:any"),
     (0, swagger_1.ApiOkResponse)({ type: rbac_response_1.GroupResponse }),
     __param(0, (0, common_1.Body)()),
+    __param(1, (0, currentUser_decorator_1.CurrentUser)()),
     __metadata("design:type", Function),
-    __metadata("design:paramtypes", [createGroup_command_1.CreateGroupCommand]),
+    __metadata("design:paramtypes", [createGroup_command_1.CreateGroupCommand, Object]),
     __metadata("design:returntype", Promise)
 ], RbacController.prototype, "createGroup", null);
 __decorate([
@@ -329,8 +330,9 @@ __decorate([
     (0, swagger_1.ApiOkResponse)({ type: rbac_response_1.GroupResponse }),
     __param(0, (0, common_1.Param)("id", common_1.ParseUUIDPipe)),
     __param(1, (0, common_1.Body)()),
+    __param(2, (0, currentUser_decorator_1.CurrentUser)()),
     __metadata("design:type", Function),
-    __metadata("design:paramtypes", [String, updateGroup_command_1.UpdateGroupCommand]),
+    __metadata("design:paramtypes", [String, updateGroup_command_1.UpdateGroupCommand, Object]),
     __metadata("design:returntype", Promise)
 ], RbacController.prototype, "updateGroup", null);
 __decorate([
@@ -386,8 +388,9 @@ __decorate([
     (0, requirePermission_decorator_1.RequirePermission)("roles:create:any"),
     (0, swagger_1.ApiOkResponse)({ type: rbac_response_1.RoleResponse }),
     __param(0, (0, common_1.Body)()),
+    __param(1, (0, currentUser_decorator_1.CurrentUser)()),
     __metadata("design:type", Function),
-    __metadata("design:paramtypes", [createRole_command_1.CreateRoleCommand]),
+    __metadata("design:paramtypes", [createRole_command_1.CreateRoleCommand, Object]),
     __metadata("design:returntype", Promise)
 ], RbacController.prototype, "createRole", null);
 __decorate([

package/dist/features/users/domain/avatar.service.d.ts

@@ -1,3 +1,4 @@
+export declare const AVATAR_MAX_BYTES: number;
 export declare class AvatarService {
     processAndStore(userId: string, file?: Express.Multer.File): Promise<string>;
     remove(userId: string): Promise<void>;

package/dist/features/users/domain/avatar.service.js

@@ -9,14 +9,14 @@ var __importDefault = (this && this.__importDefault) || function (mod) {
     return (mod && mod.__esModule) ? mod : { "default": mod };
 };
 Object.defineProperty(exports, "__esModule", { value: true });
-exports.AvatarService = void 0;
+exports.AvatarService = exports.AVATAR_MAX_BYTES = void 0;
 const common_1 = require("@nestjs/common");
 const fs_1 = require("fs");
 const path_1 = require("path");
 const sharp_1 = __importDefault(require("sharp"));
 const UPLOAD_DIR = (0, path_1.join)(process.cwd(), "uploads", "avatars");
 const ALLOWED = ["image/jpeg", "image/png", "image/webp"];
-const MAX_BYTES = 5 * 1024 * 1024;
+exports.AVATAR_MAX_BYTES = 5 * 1024 * 1024;
 const MAGIC_BYTES_CHECK = {
     "image/jpeg": (buf) => buf.length >= 3 && buf[0] === 0xff && buf[1] === 0xd8 && buf[2] === 0xff,
     "image/png": (buf) => buf.length >= 8 &&
@@ -38,7 +38,7 @@ let AvatarService = class AvatarService {
         if (!MAGIC_BYTES_CHECK[file.mimetype]?.(file.buffer)) {
             throw new common_1.BadRequestException("O conteúdo do arquivo não corresponde ao formato declarado");
         }
-        if (file.size > MAX_BYTES) {
+        if (file.size > exports.AVATAR_MAX_BYTES) {
             throw new common_1.BadRequestException("Imagem excede o limite de 5MB");
         }
         await fs_1.promises.mkdir(UPLOAD_DIR, { recursive: true });

package/dist/features/users/presentation/users.controller.js

@@ -83,7 +83,7 @@ let UsersController = class UsersController {
     }
     async remove(id, current) {
         if (current.id === id) {
-            return;
+            throw new common_1.BadRequestException("Você não pode excluir a própria conta");
         }
         await this.users.remove(id);
     }
@@ -120,7 +120,10 @@ __decorate([
     (0, common_1.Post)("me/avatar"),
     (0, swagger_1.ApiConsumes)("multipart/form-data"),
     (0, swagger_1.ApiOkResponse)({ type: user_response_1.UserResponse }),
-    (0, common_1.UseInterceptors)((0, platform_express_1.FileInterceptor)("file", { storage: (0, multer_1.memoryStorage)() })),
+    (0, common_1.UseInterceptors)((0, platform_express_1.FileInterceptor)("file", {
+        storage: (0, multer_1.memoryStorage)(),
+        limits: { fileSize: avatar_service_1.AVATAR_MAX_BYTES, files: 1 },
+    })),
     __param(0, (0, currentUser_decorator_1.CurrentUser)("id")),
     __param(1, (0, common_1.UploadedFile)()),
     __metadata("design:type", Function),

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "rl-core-api",
-  "version": "0.13.1",
+  "version": "0.14.1",
   "description": "Core NestJS: autenticação com 2FA, RBAC, auditoria, notificações e listagens com filtro dinâmico",
   "author": "Rodrigo Liberti",
   "license": "MIT",