rl-core-api 0.18.10 → 0.19.0

package/dist/core/auth/decorators/allowPendingPassword.decorator.d.ts

@@ -0,0 +1,3 @@
+import { CustomDecorator } from "@nestjs/common";
+export declare const ALLOW_PENDING_PASSWORD_KEY = "allowPendingPassword";
+export declare const AllowPendingPassword: () => CustomDecorator<string>;

package/dist/core/auth/decorators/allowPendingPassword.decorator.js

@@ -0,0 +1,7 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.AllowPendingPassword = exports.ALLOW_PENDING_PASSWORD_KEY = void 0;
+const common_1 = require("@nestjs/common");
+exports.ALLOW_PENDING_PASSWORD_KEY = "allowPendingPassword";
+const AllowPendingPassword = () => (0, common_1.SetMetadata)(exports.ALLOW_PENDING_PASSWORD_KEY, true);
+exports.AllowPendingPassword = AllowPendingPassword;

package/dist/core/auth/guards/passwordPolicy.guard.d.ts

@@ -0,0 +1,8 @@
+import { CanActivate, ExecutionContext } from "@nestjs/common";
+import { Reflector } from "@nestjs/core";
+export declare const PASSWORD_CHANGE_REQUIRED_MESSAGE = "Troque sua senha para continuar";
+export declare class PasswordPolicyGuard implements CanActivate {
+    private readonly reflector;
+    constructor(reflector: Reflector);
+    canActivate(context: ExecutionContext): boolean;
+}

package/dist/core/auth/guards/passwordPolicy.guard.js

@@ -0,0 +1,39 @@
+"use strict";
+var __decorate = (this && this.__decorate) || function (decorators, target, key, desc) {
+    var c = arguments.length, r = c < 3 ? target : desc === null ? desc = Object.getOwnPropertyDescriptor(target, key) : desc, d;
+    if (typeof Reflect === "object" && typeof Reflect.decorate === "function") r = Reflect.decorate(decorators, target, key, desc);
+    else for (var i = decorators.length - 1; i >= 0; i--) if (d = decorators[i]) r = (c < 3 ? d(r) : c > 3 ? d(target, key, r) : d(target, key)) || r;
+    return c > 3 && r && Object.defineProperty(target, key, r), r;
+};
+var __metadata = (this && this.__metadata) || function (k, v) {
+    if (typeof Reflect === "object" && typeof Reflect.metadata === "function") return Reflect.metadata(k, v);
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.PasswordPolicyGuard = exports.PASSWORD_CHANGE_REQUIRED_MESSAGE = void 0;
+const common_1 = require("@nestjs/common");
+const core_1 = require("@nestjs/core");
+const allowPendingPassword_decorator_1 = require("../decorators/allowPendingPassword.decorator");
+const appErrorCode_enum_1 = require("../../filters/appErrorCode.enum");
+const codedError_util_1 = require("../../utils/codedError.util");
+exports.PASSWORD_CHANGE_REQUIRED_MESSAGE = "Troque sua senha para continuar";
+let PasswordPolicyGuard = class PasswordPolicyGuard {
+    constructor(reflector) {
+        this.reflector = reflector;
+    }
+    canActivate(context) {
+        const user = context.switchToHttp().getRequest().user;
+        if (!user || (!user.mustChangePassword && !user.passwordExpired)) {
+            return true;
+        }
+        const allowed = this.reflector.getAllAndOverride(allowPendingPassword_decorator_1.ALLOW_PENDING_PASSWORD_KEY, [context.getHandler(), context.getClass()]);
+        if (allowed) {
+            return true;
+        }
+        throw (0, codedError_util_1.codedForbidden)(exports.PASSWORD_CHANGE_REQUIRED_MESSAGE, appErrorCode_enum_1.AppErrorCode.PASSWORD_CHANGE_REQUIRED);
+    }
+};
+exports.PasswordPolicyGuard = PasswordPolicyGuard;
+exports.PasswordPolicyGuard = PasswordPolicyGuard = __decorate([
+    (0, common_1.Injectable)(),
+    __metadata("design:paramtypes", [core_1.Reflector])
+], PasswordPolicyGuard);

package/dist/core/config/env.schema.d.ts

@@ -81,8 +81,8 @@ export declare const envSchema: z.ZodObject<{
     AUDIT_IP_SALT: z.ZodOptional<z.ZodString>;
     NOTIFICATION_RETENTION_DAYS: z.ZodDefault<z.ZodCoercedNumber<unknown>>;
     SEED_ADMIN_NAME: z.ZodDefault<z.ZodString>;
-    SEED_ADMIN_EMAIL: z.ZodDefault<z.ZodString>;
-    SEED_ADMIN_PASSWORD: z.ZodDefault<z.ZodString>;
+    SEED_ADMIN_EMAIL: z.ZodOptional<z.ZodString>;
+    SEED_ADMIN_PASSWORD: z.ZodOptional<z.ZodString>;
 }, z.core.$strip>;
 export type Env = z.infer<typeof envSchema>;
 export declare function validateEnv(config: Record<string, unknown>): Env;

package/dist/core/config/env.schema.js

@@ -6,6 +6,19 @@ const zod_1 = require("zod");
 const booleanFromString = zod_1.z
     .enum(["true", "false"])
     .transform((v) => v === "true");
+const PLACEHOLDER_SECRETS = new Set([
+    "changeme",
+    "change-me",
+    "admin",
+    "admin@123",
+    "admin123",
+    "password",
+    "senha",
+    "secret",
+    "redis",
+    "root",
+    "123456",
+]);
 exports.envSchema = zod_1.z
     .object({
     NODE_ENV: zod_1.z
@@ -98,8 +111,8 @@ exports.envSchema = zod_1.z
         .positive()
         .default(90),
     SEED_ADMIN_NAME: zod_1.z.string().default("Administrador"),
-    SEED_ADMIN_EMAIL: zod_1.z.string().email().default("admin@admin.com"),
-    SEED_ADMIN_PASSWORD: zod_1.z.string().min(1).default("admin@123"),
+    SEED_ADMIN_EMAIL: zod_1.z.string().email().optional(),
+    SEED_ADMIN_PASSWORD: zod_1.z.string().min(1).optional(),
 })
     .superRefine((env, ctx) => {
     if (env.NODE_ENV === "production" && !env.COOKIE_SECURE) {
@@ -109,9 +122,26 @@ exports.envSchema = zod_1.z
             message: "COOKIE_SECURE deve ser true quando NODE_ENV=production",
         });
     }
+    if (env.NODE_ENV === "production") {
+        for (const [key, value] of Object.entries({
+            DB_PASSWORD: env.DB_PASSWORD,
+            REDIS_PASSWORD: env.REDIS_PASSWORD,
+            SEED_ADMIN_PASSWORD: env.SEED_ADMIN_PASSWORD,
+            EMAIL_PASSWORD: env.EMAIL_PASSWORD,
+        })) {
+            if (value && PLACEHOLDER_SECRETS.has(value.toLowerCase())) {
+                ctx.addIssue({
+                    code: zod_1.z.ZodIssueCode.custom,
+                    path: [key],
+                    message: `${key} está com valor de exemplo — defina um segredo real em produção`,
+                });
+            }
+        }
+    }
 });
 function validateEnv(config) {
-    const parsed = exports.envSchema.safeParse(config);
+    const declared = Object.fromEntries(Object.entries(config).filter(([, value]) => value !== ""));
+    const parsed = exports.envSchema.safeParse(declared);
     if (!parsed.success) {
         const issues = parsed.error.issues
             .map((i) => `  - ${i.path.join(".")}: ${i.message}`)

package/dist/core/context/requestLog.context.d.ts

@@ -5,6 +5,7 @@ export interface RequestLogContext {
     userId: string | null;
 }
 export declare const routePathOf: (request: Request) => string | null;
+export declare const redactPath: (path: string) => string;
 export declare const setRequestLogContext: (request: Request, context: RequestLogContext) => void;
 export declare const getRequestLogContext: (request: Request) => RequestLogContext | null;
 export declare const setRequestLogUser: (request: Request, userId: string | null) => void;

package/dist/core/context/requestLog.context.js

@@ -1,6 +1,6 @@
 "use strict";
 Object.defineProperty(exports, "__esModule", { value: true });
-exports.setRequestLogUser = exports.getRequestLogContext = exports.setRequestLogContext = exports.routePathOf = void 0;
+exports.setRequestLogUser = exports.getRequestLogContext = exports.setRequestLogContext = exports.redactPath = exports.routePathOf = void 0;
 const KEY = "__requestLogContext";
 const routePathOf = (request) => {
     const route = request.route;
@@ -11,6 +11,12 @@ const routePathOf = (request) => {
     return null;
 };
 exports.routePathOf = routePathOf;
+const SECRET_SEGMENT = /^(?:[a-f0-9]{40,}|[\w-]+\.[\w-]+\.[\w-]+)$/i;
+const redactPath = (path) => path
+    .split("/")
+    .map((segment) => (SECRET_SEGMENT.test(segment) ? "[redacted]" : segment))
+    .join("/");
+exports.redactPath = redactPath;
 const setRequestLogContext = (request, context) => {
     request[KEY] = context;
 };

package/dist/core/database/migrations/1789603200000-AuthTokenClient.d.ts

@@ -0,0 +1,6 @@
+import { MigrationInterface, QueryRunner } from "typeorm";
+export declare class AuthTokenClient1789603200000 implements MigrationInterface {
+    name: string;
+    up(queryRunner: QueryRunner): Promise<void>;
+    down(queryRunner: QueryRunner): Promise<void>;
+}

package/dist/core/database/migrations/1789603200000-AuthTokenClient.js

@@ -0,0 +1,16 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.AuthTokenClient1789603200000 = void 0;
+class AuthTokenClient1789603200000 {
+    constructor() {
+        this.name = "AuthTokenClient1789603200000";
+    }
+    async up(queryRunner) {
+        await queryRunner.query(`ALTER TABLE auth_tokens
+         ADD COLUMN client tinyint unsigned NULL COMMENT '0=web, 1=mobile' AFTER family`);
+    }
+    async down(queryRunner) {
+        await queryRunner.query(`ALTER TABLE auth_tokens DROP COLUMN client`);
+    }
+}
+exports.AuthTokenClient1789603200000 = AuthTokenClient1789603200000;

package/dist/core/database/migrations/index.js

@@ -2,8 +2,10 @@
 Object.defineProperty(exports, "__esModule", { value: true });
 exports.coreMigrations = void 0;
 const _1789171200000_NotificationDismissal_1 = require("./1789171200000-NotificationDismissal");
+const _1789603200000_AuthTokenClient_1 = require("./1789603200000-AuthTokenClient");
 const _1710000000000_InitialSchema_1 = require("./1710000000000-InitialSchema");
 exports.coreMigrations = [
     _1710000000000_InitialSchema_1.InitialSchema1710000000000,
     _1789171200000_NotificationDismissal_1.NotificationDismissal1789171200000,
+    _1789603200000_AuthTokenClient_1.AuthTokenClient1789603200000,
 ];

package/dist/core/export/export.controller.js

@@ -17,7 +17,6 @@ const common_1 = require("@nestjs/common");
 const swagger_1 = require("@nestjs/swagger");
 const fs_1 = require("fs");
 const currentUser_decorator_1 = require("../auth/decorators/currentUser.decorator");
-const permissions_guard_1 = require("../auth/guards/permissions.guard");
 const export_service_1 = require("./export.service");
 const exportAccepted_response_1 = require("./exportAccepted.response");
 const exportExtension_enum_1 = require("./exportExtension.enum");
@@ -101,7 +100,6 @@ __decorate([
 exports.ExportController = ExportController = __decorate([
     (0, swagger_1.ApiTags)("Exports"),
     (0, swagger_1.ApiBearerAuth)(),
-    (0, common_1.UseGuards)(permissions_guard_1.PermissionsGuard),
     (0, common_1.Controller)({ path: "exports", version: "1" }),
     __metadata("design:paramtypes", [export_service_1.ExportService,
         exportStorage_service_1.ExportStorageService])

package/dist/core/filters/appErrorCode.enum.d.ts

@@ -7,5 +7,6 @@ export declare enum AppErrorCode {
     PASSWORD_REUSED = "PASSWORD_REUSED",
     TOO_MANY_REQUESTS = "TOO_MANY_REQUESTS",
     INVALID_FILTER = "INVALID_FILTER",
-    GROUP_REQUIRED = "GROUP_REQUIRED"
+    GROUP_REQUIRED = "GROUP_REQUIRED",
+    PASSWORD_CHANGE_REQUIRED = "PASSWORD_CHANGE_REQUIRED"
 }

package/dist/core/filters/appErrorCode.enum.js

@@ -12,4 +12,5 @@ var AppErrorCode;
     AppErrorCode["TOO_MANY_REQUESTS"] = "TOO_MANY_REQUESTS";
     AppErrorCode["INVALID_FILTER"] = "INVALID_FILTER";
     AppErrorCode["GROUP_REQUIRED"] = "GROUP_REQUIRED";
+    AppErrorCode["PASSWORD_CHANGE_REQUIRED"] = "PASSWORD_CHANGE_REQUIRED";
 })(AppErrorCode || (exports.AppErrorCode = AppErrorCode = {}));

package/dist/core/images/imageFetch.service.js

@@ -29,23 +29,87 @@ const isBlockedIPv4 = (address) => {
         (a === 198 && (b === 18 || b === 19)) ||
         a >= 224);
 };
+const expandIPv6 = (address) => {
+    let value = address.toLowerCase().replace(/^\[|\]$/g, "");
+    const zone = value.indexOf("%");
+    if (zone >= 0) {
+        value = value.slice(0, zone);
+    }
+    const dotted = /(\d+)\.(\d+)\.(\d+)\.(\d+)$/.exec(value);
+    if (dotted) {
+        const octets = dotted.slice(1, 5).map(Number);
+        if (octets.some((octet) => octet > 255)) {
+            return null;
+        }
+        const high = ((octets[0] << 8) | octets[1]).toString(16);
+        const low = ((octets[2] << 8) | octets[3]).toString(16);
+        value = `${value.slice(0, dotted.index)}${high}:${low}`;
+    }
+    const halves = value.split("::");
+    if (halves.length > 2) {
+        return null;
+    }
+    const parse = (part) => part === "" ? [] : part.split(":").map((group) => parseInt(group, 16));
+    const head = parse(halves[0]);
+    const tail = halves.length === 2 ? parse(halves[1]) : [];
+    const missing = 8 - head.length - tail.length;
+    if (missing < 0 || (halves.length === 1 && missing !== 0)) {
+        return null;
+    }
+    const groups = [...head, ...new Array(missing).fill(0), ...tail];
+    if (groups.some((group) => Number.isNaN(group) || group < 0 || group > 0xffff)) {
+        return null;
+    }
+    return groups;
+};
+const embeddedIPv4 = (groups, offset) => [
+    groups[offset] >> 8,
+    groups[offset] & 0xff,
+    groups[offset + 1] >> 8,
+    groups[offset + 1] & 0xff,
+].join(".");
 const isBlockedIPv6 = (address) => {
-    const value = address.toLowerCase().replace(/^\[|\]$/g, "");
-    const mapped = /^::ffff:(?<v4>\d+\.\d+\.\d+\.\d+)$/.exec(value);
-    if (mapped?.groups) {
-        return isBlockedIPv4(mapped.groups.v4);
-    }
-    return (value === "::" ||
-        value === "::1" ||
-        value.startsWith("fe8") ||
-        value.startsWith("fe9") ||
-        value.startsWith("fea") ||
-        value.startsWith("feb") ||
-        value.startsWith("fc") ||
-        value.startsWith("fd") ||
-        value.startsWith("ff"));
+    const groups = expandIPv6(address);
+    if (!groups) {
+        return true;
+    }
+    const [g0, g1, g2, g3, g4, g5] = groups;
+    const prefixZero = g0 === 0 && g1 === 0 && g2 === 0 && g3 === 0 && g4 === 0;
+    if (prefixZero && (g5 === 0xffff || g5 === 0)) {
+        return groups[6] === 0 && groups[7] <= 1
+            ? true
+            : isBlockedIPv4(embeddedIPv4(groups, 6));
+    }
+    if (g0 === 0 && g1 === 0 && g2 === 0 && g3 === 0 && g4 === 0xffff && g5 === 0) {
+        return isBlockedIPv4(embeddedIPv4(groups, 6));
+    }
+    if (g0 === 0x64 && g1 === 0xff9b && g2 === 0 && g3 === 0 && g4 === 0 && g5 === 0) {
+        return isBlockedIPv4(embeddedIPv4(groups, 6));
+    }
+    if (g0 === 0x64 && g1 === 0xff9b && g2 === 1) {
+        return true;
+    }
+    if (g0 === 0x2002) {
+        return isBlockedIPv4(embeddedIPv4(groups, 1));
+    }
+    return ((g0 & 0xffc0) === 0xfe80 ||
+        (g0 & 0xffc0) === 0xfec0 ||
+        (g0 & 0xfe00) === 0xfc00 ||
+        (g0 & 0xff00) === 0xff00 ||
+        (g0 === 0x2001 && g1 === 0xdb8) ||
+        (g0 === 0x2001 && g1 === 0));
+};
+const isBlockedAddress = (address) => {
+    const literal = address.replace(/^\[|\]$/g, "");
+    const version = (0, net_1.isIP)(literal.replace(/%.*$/, ""));
+    if (version === 4) {
+        return isBlockedIPv4(literal);
+    }
+    if (version === 6) {
+        return isBlockedIPv6(literal);
+    }
+    return true;
 };
-const isBlockedAddress = (address) => (0, net_1.isIP)(address) === 6 ? isBlockedIPv6(address) : isBlockedIPv4(address);
 exports.isBlockedAddress = isBlockedAddress;
 const lookupAll = (hostname) => new Promise((resolve, reject) => {
     (0, dns_1.lookup)(hostname, { all: true }, (error, addresses) => {

package/dist/core/images/images.controller.js

@@ -18,7 +18,6 @@ const platform_express_1 = require("@nestjs/platform-express");
 const swagger_1 = require("@nestjs/swagger");
 const multer_1 = require("multer");
 const currentUser_decorator_1 = require("../auth/decorators/currentUser.decorator");
-const permissions_guard_1 = require("../auth/guards/permissions.guard");
 const images_service_1 = require("./images.service");
 const imageAccepted_response_1 = require("./responses/imageAccepted.response");
 const imageProfile_response_1 = require("./responses/imageProfile.response");
@@ -127,7 +126,6 @@ __decorate([
 exports.ImagesController = ImagesController = __decorate([
     (0, swagger_1.ApiTags)("Images"),
     (0, swagger_1.ApiBearerAuth)(),
-    (0, common_1.UseGuards)(permissions_guard_1.PermissionsGuard),
     (0, common_1.Controller)({ path: "images", version: "1" }),
     __metadata("design:paramtypes", [images_service_1.ImagesService])
 ], ImagesController);

package/dist/core/images/images.service.d.ts

@@ -27,6 +27,7 @@ export declare class ImagesService {
     discard(path: string | null | undefined): Promise<void>;
     promote(path: string | null | undefined): Promise<string | null>;
     private authorize;
+    private authorizeRoute;
     private enqueue;
     private processNow;
     private tooLarge;

package/dist/core/images/images.service.js

@@ -33,7 +33,7 @@ let ImagesService = class ImagesService {
         return this.registry.require(name);
     }
     async fromFile(user, profileName, file) {
-        const profile = this.authorize(user, profileName);
+        const profile = this.authorizeRoute(user, profileName);
         if (!file?.buffer?.length) {
             throw new common_1.BadRequestException("Nenhum arquivo recebido");
         }
@@ -66,7 +66,7 @@ let ImagesService = class ImagesService {
         return path ?? summary.path;
     }
     async fromUrl(user, profileName, url) {
-        const profile = this.authorize(user, profileName);
+        const profile = this.authorizeRoute(user, profileName);
         await this.fetcher.assertAllowed(url);
         if (!this.producer.isAvailable(queue_constants_1.IMAGES_QUEUE)) {
             const downloaded = await this.fetcher.download(url, profile.maxBytes);
@@ -83,11 +83,14 @@ let ImagesService = class ImagesService {
         return await this.producer.status(jobId, ownerId, queue_constants_1.IMAGES_QUEUE);
     }
     async remove(user, profileName, path) {
-        const profile = this.authorize(user, profileName);
+        const profile = this.authorizeRoute(user, profileName);
         const ref = this.storage.parsePublicPath(path);
         if (!ref || ref.folder !== profile.folder) {
             throw new common_1.BadRequestException("Caminho de imagem inválido");
         }
+        if (!ref.pending) {
+            throw new common_1.BadRequestException("Só uma imagem ainda não confirmada pode ser apagada por aqui — a definitiva sai junto com o registro");
+        }
         await this.storage.remove(path);
     }
     async discard(path) {
@@ -103,6 +106,13 @@ let ImagesService = class ImagesService {
         }
         return profile;
     }
+    authorizeRoute(user, profileName) {
+        const profile = this.authorize(user, profileName);
+        if (!profile.permission) {
+            throw new common_1.ForbiddenException("Este perfil de imagem só é acessível pela rota da própria funcionalidade");
+        }
+        return profile;
+    }
     async enqueue(ownerId, profile, payload) {
         const ref = await this.producer.enqueue(profile.name, payload, {
             ownerId,

package/dist/core/queue/queueAdmin.controller.js

@@ -16,7 +16,6 @@ exports.QueueAdminController = void 0;
 const common_1 = require("@nestjs/common");
 const swagger_1 = require("@nestjs/swagger");
 const requirePermission_decorator_1 = require("../auth/decorators/requirePermission.decorator");
-const permissions_guard_1 = require("../auth/guards/permissions.guard");
 const queue_constants_1 = require("./queue.constants");
 const queueAdmin_response_1 = require("./queueAdmin.response");
 const queueAdmin_service_1 = require("./queueAdmin.service");
@@ -93,7 +92,6 @@ __decorate([
 exports.QueueAdminController = QueueAdminController = __decorate([
     (0, swagger_1.ApiTags)("Queues"),
     (0, swagger_1.ApiBearerAuth)(),
-    (0, common_1.UseGuards)(permissions_guard_1.PermissionsGuard),
     (0, common_1.Controller)({ path: "queues", version: "1" }),
     __metadata("design:paramtypes", [queueAdmin_service_1.QueueAdminService])
 ], QueueAdminController);

package/dist/core/utils/codedError.util.d.ts

@@ -1,5 +1,6 @@
-import { BadRequestException, HttpException, UnauthorizedException } from "@nestjs/common";
+import { BadRequestException, ForbiddenException, HttpException, UnauthorizedException } from "@nestjs/common";
 import { AppErrorCode } from "../filters/appErrorCode.enum";
 export declare function codedUnauthorized(message: string, errorCode: AppErrorCode): UnauthorizedException;
 export declare function codedBadRequest(message: string, errorCode: AppErrorCode): BadRequestException;
+export declare function codedForbidden(message: string, errorCode: AppErrorCode): ForbiddenException;
 export declare function codedTooManyRequests(message: string, errorCode: AppErrorCode): HttpException;

package/dist/core/utils/codedError.util.js

@@ -2,6 +2,7 @@
 Object.defineProperty(exports, "__esModule", { value: true });
 exports.codedUnauthorized = codedUnauthorized;
 exports.codedBadRequest = codedBadRequest;
+exports.codedForbidden = codedForbidden;
 exports.codedTooManyRequests = codedTooManyRequests;
 const common_1 = require("@nestjs/common");
 function codedUnauthorized(message, errorCode) {
@@ -18,6 +19,13 @@ function codedBadRequest(message, errorCode) {
         errorCode,
     });
 }
+function codedForbidden(message, errorCode) {
+    return new common_1.ForbiddenException({
+        message,
+        error: "Forbidden",
+        errorCode,
+    });
+}
 function codedTooManyRequests(message, errorCode) {
     return new common_1.HttpException({ message, error: "Too Many Requests", errorCode }, common_1.HttpStatus.TOO_MANY_REQUESTS);
 }

package/dist/features/audit/audit.module.js

@@ -13,6 +13,7 @@ const typeorm_1 = require("@nestjs/typeorm");
 const domain_1 = require("./domain");
 const infra_1 = require("./infra");
 const presentation_1 = require("./presentation");
+const rbac_module_1 = require("../rbac/rbac.module");
 const user_repository_1 = require("../users/infra/repositories/user.repository");
 const user_schema_1 = require("../users/infra/schema/user.schema");
 let AuditModule = class AuditModule {
@@ -20,7 +21,10 @@ let AuditModule = class AuditModule {
 exports.AuditModule = AuditModule;
 exports.AuditModule = AuditModule = __decorate([
     (0, common_1.Module)({
-        imports: [typeorm_1.TypeOrmModule.forFeature([infra_1.RequestLog, infra_1.AuditDataChange, user_schema_1.User])],
+        imports: [
+            typeorm_1.TypeOrmModule.forFeature([infra_1.RequestLog, infra_1.AuditDataChange, user_schema_1.User]),
+            rbac_module_1.RbacModule,
+        ],
         controllers: [presentation_1.AuditController],
         providers: [
             infra_1.RequestLogRepository,

package/dist/features/audit/domain/audit.service.d.ts

@@ -1,8 +1,10 @@
+import { Actor } from "../../../core/auth/actor.interface";
 import { Paginated, PaginationQuery } from "../../../core/utils/pagination.util";
 import { AuditDataChangeRepository } from "../infra/repositories/auditDataChange.repository";
 import { RequestLogRepository } from "../infra/repositories/requestLog.repository";
 import { AuditDataAction, AuditDataChange } from "../infra/schema/auditDataChange.schema";
 import { RequestLog } from "../infra/schema/requestLog.schema";
+import { TeamScopeService } from "../../rbac/domain/teamScope.service";
 import { UserRepository } from "../../users/infra/repositories/user.repository";
 export type WithUserRef<T> = T & {
     user?: {
@@ -16,8 +18,9 @@ export declare class AuditService {
     private readonly requestLogRepo;
     private readonly dataChangeRepo;
     private readonly userRepo;
+    private readonly teamScope;
     private readonly logger;
-    constructor(requestLogRepo: RequestLogRepository, dataChangeRepo: AuditDataChangeRepository, userRepo: UserRepository);
+    constructor(requestLogRepo: RequestLogRepository, dataChangeRepo: AuditDataChangeRepository, userRepo: UserRepository, teamScope: TeamScopeService);
     recordRequest(data: Partial<RequestLog>): Promise<void>;
     recordChange(data: {
         entity: string;
@@ -26,7 +29,7 @@ export declare class AuditService {
         oldData: Record<string, unknown> | null;
         newData: Record<string, unknown> | null;
     }): Promise<void>;
-    listRequests(query: PaginationQuery): Promise<Paginated<WithUserRef<RequestLog>>>;
+    listRequests(query: PaginationQuery, actor: Actor): Promise<Paginated<WithUserRef<RequestLog>>>;
     listDataChanges(query: PaginationQuery): Promise<Paginated<AuditDataChangeWithUser>>;
     private enrichWithUser;
 }

package/dist/features/audit/domain/audit.service.js

@@ -17,12 +17,14 @@ const auditContext_1 = require("../../../core/context/auditContext");
 const pagination_util_1 = require("../../../core/utils/pagination.util");
 const auditDataChange_repository_1 = require("../infra/repositories/auditDataChange.repository");
 const requestLog_repository_1 = require("../infra/repositories/requestLog.repository");
+const teamScope_service_1 = require("../../rbac/domain/teamScope.service");
 const user_repository_1 = require("../../users/infra/repositories/user.repository");
 let AuditService = AuditService_1 = class AuditService {
-    constructor(requestLogRepo, dataChangeRepo, userRepo) {
+    constructor(requestLogRepo, dataChangeRepo, userRepo, teamScope) {
         this.requestLogRepo = requestLogRepo;
         this.dataChangeRepo = dataChangeRepo;
         this.userRepo = userRepo;
+        this.teamScope = teamScope;
         this.logger = new common_1.Logger(AuditService_1.name);
     }
     async recordRequest(data) {
@@ -46,8 +48,9 @@ let AuditService = AuditService_1 = class AuditService {
             this.logger.warn(`Falha ao gravar AuditDataChange (${data.entity}): ${err.message}`);
         }
     }
-    async listRequests(query) {
-        const [items, total] = await this.requestLogRepo.findPaginated(query);
+    async listRequests(query, actor) {
+        const reachable = await this.teamScope.reachableUserIds(actor, "audit:read");
+        const [items, total] = await this.requestLogRepo.findPaginated(query, reachable);
         return new pagination_util_1.Paginated(await this.enrichWithUser(items), total, query.page, query.limit);
     }
     async listDataChanges(query) {
@@ -83,5 +86,6 @@ exports.AuditService = AuditService = AuditService_1 = __decorate([
     (0, common_1.Injectable)(),
     __metadata("design:paramtypes", [requestLog_repository_1.RequestLogRepository,
         auditDataChange_repository_1.AuditDataChangeRepository,
-        user_repository_1.UserRepository])
+        user_repository_1.UserRepository,
+        teamScope_service_1.TeamScopeService])
 ], AuditService);

package/dist/features/audit/infra/repositories/requestLog.repository.d.ts

@@ -3,5 +3,5 @@ import { PaginationQuery } from "../../../../core/utils/pagination.util";
 import { RequestLog } from "../schema/requestLog.schema";
 export declare class RequestLogRepository extends Repository<RequestLog> {
     constructor(dataSource: DataSource);
-    findPaginated(query: PaginationQuery): Promise<[RequestLog[], number]>;
+    findPaginated(query: PaginationQuery, reachableIds?: string[] | null): Promise<[RequestLog[], number]>;
 }

package/dist/features/audit/infra/repositories/requestLog.repository.js

@@ -19,8 +19,17 @@ let RequestLogRepository = class RequestLogRepository extends typeorm_1.Reposito
     constructor(dataSource) {
         super(requestLog_schema_1.RequestLog, dataSource.createEntityManager());
     }
-    findPaginated(query) {
-        return (0, paginateWithFilter_util_1.paginateWithFilter)(this.createQueryBuilder("requestLog").leftJoin("users", "logUser", "logUser.id = requestLog.user_id"), {
+    findPaginated(query, reachableIds) {
+        const qb = this.createQueryBuilder("requestLog").leftJoin("users", "logUser", "logUser.id = requestLog.user_id");
+        if (reachableIds) {
+            if (reachableIds.length === 0) {
+                qb.andWhere("1 = 0");
+            }
+            else {
+                qb.andWhere("requestLog.user_id IN (:...reachableIds)", { reachableIds });
+            }
+        }
+        return (0, paginateWithFilter_util_1.paginateWithFilter)(qb, {
             query,
             catalog: audit_filters_1.REQUEST_LOGS_FILTER_CATALOG,
             defaultSort: "createdAt",

package/dist/features/audit/presentation/audit.controller.d.ts

@@ -1,3 +1,4 @@
+import { AuthenticatedUser } from "../../../core/auth/authenticatedUser.interface";
 import { FilterFieldResponse } from "../../../core/query/filterSchema.response";
 import { Paginated, PaginationQuery } from "../../../core/utils/pagination.util";
 import { AuditDataChangeWithUser, AuditService, WithUserRef } from "../domain/audit.service";
@@ -5,7 +6,7 @@ import { RequestLog } from "../infra/schema/requestLog.schema";
 export declare class AuditController {
     private readonly audit;
     constructor(audit: AuditService);
-    requests(query: PaginationQuery): Promise<Paginated<WithUserRef<RequestLog>>>;
+    requests(query: PaginationQuery, actor: AuthenticatedUser): Promise<Paginated<WithUserRef<RequestLog>>>;
     requestsFilterSchema(): FilterFieldResponse[];
     dataChanges(query: PaginationQuery): Promise<Paginated<AuditDataChangeWithUser>>;
     dataChangesFilterSchema(): FilterFieldResponse[];