rl-core-api 0.18.10 → 0.19.1

package/dist/features/audit/presentation/audit.controller.js

@@ -15,8 +15,9 @@ Object.defineProperty(exports, "__esModule", { value: true });
 exports.AuditController = void 0;
 const common_1 = require("@nestjs/common");
 const swagger_1 = require("@nestjs/swagger");
+const currentUser_decorator_1 = require("../../../core/auth/decorators/currentUser.decorator");
 const requirePermission_decorator_1 = require("../../../core/auth/decorators/requirePermission.decorator");
-const permissions_guard_1 = require("../../../core/auth/guards/permissions.guard");
+const permissionScope_util_1 = require("../../../core/auth/permissionScope.util");
 const filterSchema_response_1 = require("../../../core/query/filterSchema.response");
 const pagination_util_1 = require("../../../core/utils/pagination.util");
 const audit_service_1 = require("../domain/audit.service");
@@ -27,8 +28,8 @@ let AuditController = class AuditController {
     constructor(audit) {
         this.audit = audit;
     }
-    requests(query) {
-        return this.audit.listRequests(query);
+    requests(query, actor) {
+        return this.audit.listRequests(query, actor);
     }
     requestsFilterSchema() {
         return (0, filterSchema_response_1.toFilterSchema)(audit_filters_1.REQUEST_LOGS_FILTER_CATALOG);
@@ -43,16 +44,17 @@ let AuditController = class AuditController {
 exports.AuditController = AuditController;
 __decorate([
     (0, common_1.Get)("requests"),
-    (0, requirePermission_decorator_1.RequirePermission)("audit:read:any"),
+    (0, requirePermission_decorator_1.RequireAnyPermission)(...(0, permissionScope_util_1.anyOrTeam)("audit:read")),
     (0, swagger_1.ApiOkResponse)({ type: log_response_1.PaginatedRequestLogsResponse }),
     __param(0, (0, common_1.Query)()),
+    __param(1, (0, currentUser_decorator_1.CurrentUser)()),
     __metadata("design:type", Function),
-    __metadata("design:paramtypes", [pagination_util_1.PaginationQuery]),
+    __metadata("design:paramtypes", [pagination_util_1.PaginationQuery, Object]),
     __metadata("design:returntype", Promise)
 ], AuditController.prototype, "requests", null);
 __decorate([
     (0, common_1.Get)("requests/filter-schema"),
-    (0, requirePermission_decorator_1.RequirePermission)("audit:read:any"),
+    (0, requirePermission_decorator_1.RequireAnyPermission)(...(0, permissionScope_util_1.anyOrTeam)("audit:read")),
     (0, swagger_1.ApiOkResponse)({ type: filterSchema_response_1.FilterFieldResponse, isArray: true }),
     __metadata("design:type", Function),
     __metadata("design:paramtypes", []),
@@ -78,7 +80,6 @@ __decorate([
 exports.AuditController = AuditController = __decorate([
     (0, swagger_1.ApiTags)("Audit"),
     (0, swagger_1.ApiBearerAuth)(),
-    (0, common_1.UseGuards)(permissions_guard_1.PermissionsGuard),
     (0, common_1.Controller)({ path: "audit", version: "1" }),
     __metadata("design:paramtypes", [audit_service_1.AuditService])
 ], AuditController);

package/dist/features/audit/presentation/audit.interceptor.js

@@ -60,7 +60,7 @@ let AuditInterceptor = class AuditInterceptor {
                 outcome: requestOutcome_enum_1.RequestOutcome.SUCCESS,
                 action,
                 method,
-                path: req.path,
+                path: (0, requestLog_context_1.redactPath)(req.path),
                 route: (0, requestLog_context_1.routePathOf)(req),
                 statusCode: res.statusCode,
                 durationMs,
@@ -78,7 +78,7 @@ let AuditInterceptor = class AuditInterceptor {
                 outcome: requestOutcome_enum_1.RequestOutcome.ABORTED,
                 action,
                 method,
-                path: req.path,
+                path: (0, requestLog_context_1.redactPath)(req.path),
                 route: (0, requestLog_context_1.routePathOf)(req),
                 durationMs: Date.now() - start,
                 userId: logContext.userId,

package/dist/features/auth/auth.module.js

@@ -12,6 +12,8 @@ const core_1 = require("@nestjs/core");
 const jwt_1 = require("@nestjs/jwt");
 const passport_1 = require("@nestjs/passport");
 const jwtAuth_guard_1 = require("../../core/auth/guards/jwtAuth.guard");
+const passwordPolicy_guard_1 = require("../../core/auth/guards/passwordPolicy.guard");
+const permissions_guard_1 = require("../../core/auth/guards/permissions.guard");
 const env_service_1 = require("../../core/config/env.service");
 const wsAuth_service_1 = require("../../core/websocket/wsAuth.service");
 const wsUserResolver_interface_1 = require("../../core/websocket/wsUserResolver.interface");
@@ -46,6 +48,8 @@ exports.AuthModule = AuthModule = __decorate([
             domain_1.TwoFactorService,
             presentation_1.JwtStrategy,
             { provide: core_1.APP_GUARD, useClass: jwtAuth_guard_1.JwtAuthGuard },
+            { provide: core_1.APP_GUARD, useClass: permissions_guard_1.PermissionsGuard },
+            { provide: core_1.APP_GUARD, useClass: passwordPolicy_guard_1.PasswordPolicyGuard },
             domain_1.WsUserResolverService,
             { provide: wsUserResolver_interface_1.WS_USER_RESOLVER, useExisting: domain_1.WsUserResolverService },
             wsAuth_service_1.WsAuthService,

package/dist/features/auth/domain/auth.service.d.ts

@@ -4,7 +4,6 @@ import { EnvService } from "../../../core/config/env.service";
 import { MailerService } from "../../../core/mailer/mailer.service";
 import { PasswordTokenPurpose, PasswordTokenStatus, TokenService } from "./token.service";
 import { TotpSetup, TwoFactorService } from "./twoFactor.service";
-import { ClientType } from "../presentation/commands/clientType.enum";
 import { LoginCommand } from "../presentation/commands/login.command";
 import { VerifyTwoFactorCommand } from "../presentation/commands/twoFactor.command";
 import { RbacService } from "../../rbac/domain/rbac.service";
@@ -67,7 +66,7 @@ export declare class AuthService {
     }>;
     verifyTwoFactor(dto: VerifyTwoFactorCommand, ctx: RequestCtx): Promise<VerifiedSession>;
     regenerateBackupCodes(userId: string, code: string): Promise<string[]>;
-    refresh(rawToken: string | undefined, ctx: RequestCtx, client?: ClientType): Promise<RefreshedTokens>;
+    refresh(rawToken: string | undefined, ctx: RequestCtx): Promise<RefreshedTokens>;
     loginWithDevice(rawToken: string | undefined, ctx: RequestCtx): Promise<DeviceSession>;
     listTrustedDevices(userId: string): Promise<TrustedDevice[]>;
     forgetTrustedDevice(userId: string, family: string): Promise<void>;

package/dist/features/auth/domain/auth.service.js

@@ -178,11 +178,11 @@ let AuthService = class AuthService {
         await this.users.save(user);
         return generated.plain;
     }
-    async refresh(rawToken, ctx, client = clientType_enum_1.ClientType.WEB) {
+    async refresh(rawToken, ctx) {
         if (!rawToken) {
             throw new common_1.UnauthorizedException("Refresh token ausente");
         }
-        const { userId, rawToken: newRefresh } = await this.tokens.rotateRefreshToken(rawToken, ctx, client);
+        const { userId, rawToken: newRefresh } = await this.tokens.rotateRefreshToken(rawToken, ctx);
         const user = await this.users.findById(userId);
         if (!user.isActive) {
             throw accountInactive();

package/dist/features/auth/domain/enums/tokenClient.enum.d.ts

@@ -0,0 +1,7 @@
+import { ClientType } from "../../presentation/commands/clientType.enum";
+export declare enum TokenClient {
+    WEB = 0,
+    MOBILE = 1
+}
+export declare const toTokenClient: (client: ClientType) => TokenClient;
+export declare const toClientType: (client: TokenClient) => ClientType;

package/dist/features/auth/domain/enums/tokenClient.enum.js

@@ -0,0 +1,13 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.toClientType = exports.toTokenClient = exports.TokenClient = void 0;
+const clientType_enum_1 = require("../../presentation/commands/clientType.enum");
+var TokenClient;
+(function (TokenClient) {
+    TokenClient[TokenClient["WEB"] = 0] = "WEB";
+    TokenClient[TokenClient["MOBILE"] = 1] = "MOBILE";
+})(TokenClient || (exports.TokenClient = TokenClient = {}));
+const toTokenClient = (client) => client === clientType_enum_1.ClientType.MOBILE ? TokenClient.MOBILE : TokenClient.WEB;
+exports.toTokenClient = toTokenClient;
+const toClientType = (client) => client === TokenClient.MOBILE ? clientType_enum_1.ClientType.MOBILE : clientType_enum_1.ClientType.WEB;
+exports.toClientType = toClientType;

package/dist/features/auth/domain/token.service.d.ts

@@ -41,7 +41,7 @@ export declare class TokenService {
     rotateRefreshToken(rawToken: string, ctx?: {
         ipAddress?: string;
         userAgent?: string;
-    }, client?: ClientType): Promise<RotationResult>;
+    }): Promise<RotationResult>;
     issueDeviceToken(userId: string, ctx?: {
         ipAddress?: string;
         userAgent?: string;

package/dist/features/auth/domain/token.service.js

@@ -16,6 +16,7 @@ const typeorm_1 = require("typeorm");
 const uuid_1 = require("uuid");
 const env_service_1 = require("../../../core/config/env.service");
 const hash_util_1 = require("../../../core/utils/hash.util");
+const tokenClient_enum_1 = require("./enums/tokenClient.enum");
 const authToken_repository_1 = require("../infra/repositories/authToken.repository");
 const authToken_schema_1 = require("../infra/schema/authToken.schema");
 const clientType_enum_1 = require("../presentation/commands/clientType.enum");
@@ -42,6 +43,7 @@ let TokenService = TokenService_1 = class TokenService {
             tokenHash: (0, hash_util_1.sha256)(params.rawToken),
             type: params.type,
             family: params.family ?? null,
+            client: params.client ? (0, tokenClient_enum_1.toTokenClient)(params.client) : null,
             expiresAt: params.expiresAt,
             ipAddress: params.ipAddress,
             userAgent: params.userAgent,
@@ -63,13 +65,14 @@ let TokenService = TokenService_1 = class TokenService {
             rawToken,
             type: authToken_schema_1.TokenType.REFRESH_TOKEN,
             family: fam,
+            client,
             expiresAt: this.minutesFromNow(this.refreshMinutes(client)),
             ipAddress: ctx?.ipAddress,
             userAgent: ctx?.userAgent,
         });
         return { rawToken, family: fam };
     }
-    async rotateRefreshToken(rawToken, ctx, client = clientType_enum_1.ClientType.WEB) {
+    async rotateRefreshToken(rawToken, ctx) {
         const tokenHash = (0, hash_util_1.sha256)(rawToken);
         const stored = await this.repo.findOne({
             where: { tokenHash, type: authToken_schema_1.TokenType.REFRESH_TOKEN },
@@ -89,6 +92,9 @@ let TokenService = TokenService_1 = class TokenService {
         }
         stored.used = true;
         await this.repo.save(stored);
+        const client = stored.client === null || stored.client === undefined
+            ? clientType_enum_1.ClientType.WEB
+            : (0, tokenClient_enum_1.toClientType)(stored.client);
         const { rawToken: newRaw, family } = await this.issueRefreshToken(stored.userId, stored.family ?? undefined, ctx, client);
         return { userId: stored.userId, rawToken: newRaw, family };
     }

package/dist/features/auth/infra/schema/authToken.schema.d.ts

@@ -1,4 +1,5 @@
 import { BaseEntity } from "../../../../core/database/base.schema";
+import { TokenClient } from "../../domain/enums/tokenClient.enum";
 export declare enum TokenType {
     PASSWORD_RESET = 0,
     FIRST_ACCESS = 1,
@@ -12,6 +13,7 @@ export declare class AuthToken extends BaseEntity {
     tokenHash: string;
     type: TokenType;
     family?: string | null;
+    client?: TokenClient | null;
     expiresAt: Date;
     used: boolean;
     revoked: boolean;

package/dist/features/auth/infra/schema/authToken.schema.js

@@ -46,6 +46,10 @@ __decorate([
     (0, typeorm_1.Column)({ name: "family", type: "char", length: 36, nullable: true }),
     __metadata("design:type", Object)
 ], AuthToken.prototype, "family", void 0);
+__decorate([
+    (0, typeorm_1.Column)({ type: "tinyint", unsigned: true, nullable: true }),
+    __metadata("design:type", Object)
+], AuthToken.prototype, "client", void 0);
 __decorate([
     (0, typeorm_1.Column)({ name: "expires_at", type: "datetime" }),
     __metadata("design:type", Date)

package/dist/features/auth/presentation/auth.controller.d.ts

@@ -9,7 +9,7 @@ import { DeviceSession, TrustedDevice } from "../domain/auth.service";
 import { TotpSetup } from "../domain/twoFactor.service";
 import { DeviceLoginCommand } from "./commands/deviceLogin.command";
 import { LoginCommand } from "./commands/login.command";
-import { ForgotPasswordCommand, ResetPasswordCommand } from "./commands/password.command";
+import { ForgotPasswordCommand, InspectPasswordTokenCommand, ResetPasswordCommand } from "./commands/password.command";
 import { LogoutCommand, RefreshTokenCommand } from "./commands/refreshToken.command";
 import { PendingTokenCommand, RegenerateBackupCommand, VerifyTwoFactorCommand } from "./commands/twoFactor.command";
 export interface VerifyResponse {
@@ -54,7 +54,7 @@ export declare class AuthController {
     forgotPassword(dto: ForgotPasswordCommand): Promise<{
         ok: boolean;
     }>;
-    inspectPasswordToken(token: string): Promise<PasswordTokenCheck>;
+    inspectPasswordToken(dto: InspectPasswordTokenCommand): Promise<PasswordTokenCheck>;
     resetPassword(dto: ResetPasswordCommand): Promise<{
         ok: boolean;
     }>;

package/dist/features/auth/presentation/auth.controller.js

@@ -17,6 +17,7 @@ const common_1 = require("@nestjs/common");
 const swagger_1 = require("@nestjs/swagger");
 const throttler_1 = require("@nestjs/throttler");
 const cookie_util_1 = require("../../../core/auth/cookie.util");
+const allowPendingPassword_decorator_1 = require("../../../core/auth/decorators/allowPendingPassword.decorator");
 const currentUser_decorator_1 = require("../../../core/auth/decorators/currentUser.decorator");
 const public_decorator_1 = require("../../../core/auth/decorators/public.decorator");
 const jwtAuth_guard_1 = require("../../../core/auth/guards/jwtAuth.guard");
@@ -64,8 +65,7 @@ let AuthController = class AuthController {
     async refresh(dto, req, res) {
         const cookies = req.cookies;
         const raw = dto.refreshToken ?? cookies?.[cookie_util_1.REFRESH_COOKIE];
-        const client = dto.refreshToken ? clientType_enum_1.ClientType.MOBILE : clientType_enum_1.ClientType.WEB;
-        const tokens = await this.auth.refresh(raw, ctxFrom(req), client);
+        const tokens = await this.auth.refresh(raw, ctxFrom(req));
         if (dto.refreshToken) {
             return { ok: true, ...tokens };
         }
@@ -104,8 +104,8 @@ let AuthController = class AuthController {
         await this.auth.forgotPassword(dto.email);
         return { ok: true };
     }
-    inspectPasswordToken(token) {
-        return this.auth.inspectPasswordToken(token);
+    inspectPasswordToken(dto) {
+        return this.auth.inspectPasswordToken(dto.token);
     }
     async resetPassword(dto) {
         await this.auth.resetPassword(dto.token, dto.newPassword);
@@ -231,6 +231,7 @@ __decorate([
 __decorate([
     (0, common_1.UseGuards)(jwtAuth_guard_1.JwtAuthGuard),
     (0, swagger_1.ApiBearerAuth)(),
+    (0, allowPendingPassword_decorator_1.AllowPendingPassword)(),
     (0, common_1.Get)("profile"),
     (0, swagger_1.ApiOperation)({ summary: "Dados do usuário autenticado + permissões" }),
     (0, swagger_1.ApiOkResponse)({ type: sessionUser_response_1.SessionUserResponse }),
@@ -242,6 +243,7 @@ __decorate([
 __decorate([
     (0, common_1.UseGuards)(jwtAuth_guard_1.JwtAuthGuard),
     (0, swagger_1.ApiBearerAuth)(),
+    (0, allowPendingPassword_decorator_1.AllowPendingPassword)(),
     (0, common_1.Get)("my-permissions"),
     (0, swagger_1.ApiOperation)({
         summary: "Lista os códigos de permissão e papéis do usuário",
@@ -280,13 +282,14 @@ __decorate([
 __decorate([
     (0, public_decorator_1.Public)(),
     (0, throttler_1.Throttle)({ default: { limit: 20, ttl: 60_000 } }),
-    (0, common_1.Get)("password-token/:token"),
+    (0, common_1.Post)("password-token/inspect"),
+    (0, common_1.HttpCode)(200),
     (0, swagger_1.ApiOperation)({
         summary: "Verifica a validade do link de senha sem consumi-lo",
     }),
-    __param(0, (0, common_1.Param)("token")),
+    __param(0, (0, common_1.Body)()),
     __metadata("design:type", Function),
-    __metadata("design:paramtypes", [String]),
+    __metadata("design:paramtypes", [password_command_1.InspectPasswordTokenCommand]),
     __metadata("design:returntype", Promise)
 ], AuthController.prototype, "inspectPasswordToken", null);
 __decorate([

package/dist/features/auth/presentation/commands/password.command.d.ts

@@ -1,6 +1,9 @@
 export declare class ForgotPasswordCommand {
     email: string;
 }
+export declare class InspectPasswordTokenCommand {
+    token: string;
+}
 export declare class ResetPasswordCommand {
     token: string;
     newPassword: string;

package/dist/features/auth/presentation/commands/password.command.js

@@ -9,7 +9,7 @@ var __metadata = (this && this.__metadata) || function (k, v) {
     if (typeof Reflect === "object" && typeof Reflect.metadata === "function") return Reflect.metadata(k, v);
 };
 Object.defineProperty(exports, "__esModule", { value: true });
-exports.ResetPasswordCommand = exports.ForgotPasswordCommand = void 0;
+exports.ResetPasswordCommand = exports.InspectPasswordTokenCommand = exports.ForgotPasswordCommand = void 0;
 const swagger_1 = require("@nestjs/swagger");
 const class_validator_1 = require("class-validator");
 const password_constants_1 = require("../../../../core/utils/password.constants");
@@ -21,6 +21,14 @@ __decorate([
     (0, class_validator_1.IsEmail)(),
     __metadata("design:type", String)
 ], ForgotPasswordCommand.prototype, "email", void 0);
+class InspectPasswordTokenCommand {
+}
+exports.InspectPasswordTokenCommand = InspectPasswordTokenCommand;
+__decorate([
+    (0, swagger_1.ApiProperty)(),
+    (0, class_validator_1.IsString)(),
+    __metadata("design:type", String)
+], InspectPasswordTokenCommand.prototype, "token", void 0);
 class ResetPasswordCommand {
 }
 exports.ResetPasswordCommand = ResetPasswordCommand;

package/dist/features/notifications/presentation/notifications.controller.js

@@ -17,7 +17,6 @@ const common_1 = require("@nestjs/common");
 const swagger_1 = require("@nestjs/swagger");
 const currentUser_decorator_1 = require("../../../core/auth/decorators/currentUser.decorator");
 const requirePermission_decorator_1 = require("../../../core/auth/decorators/requirePermission.decorator");
-const permissions_guard_1 = require("../../../core/auth/guards/permissions.guard");
 const pagination_util_1 = require("../../../core/utils/pagination.util");
 const notifications_service_1 = require("../domain/notifications.service");
 const createNotification_command_1 = require("./commands/createNotification.command");
@@ -124,7 +123,6 @@ __decorate([
 exports.NotificationsController = NotificationsController = __decorate([
     (0, swagger_1.ApiTags)("Notifications"),
     (0, swagger_1.ApiBearerAuth)(),
-    (0, common_1.UseGuards)(permissions_guard_1.PermissionsGuard),
     (0, common_1.Controller)({ path: "notifications", version: "1" }),
     __metadata("design:paramtypes", [notifications_service_1.NotificationsService,
         notifications_publisher_1.NotificationsPublisher])

package/dist/features/rbac/domain/rbac.catalog.js

@@ -103,6 +103,10 @@ exports.PERMISSIONS = [
     { code: "groups:update:any", description: "Atualizar grupos" },
     { code: "groups:delete:any", description: "Remover grupos" },
     { code: "audit:read:any", description: "Ler logs de auditoria" },
+    {
+        code: "audit:read:team",
+        description: "Ler logs de auditoria das pessoas da própria equipe",
+    },
     {
         code: "audit:read-trail:any",
         description: "Ler trilha de auditoria de dados (old/new data) — restrito a administradores",
@@ -170,7 +174,7 @@ exports.ROLES = [
             "users:invite:team",
             "users:reset-password:team",
             "users:deactivate:team",
-            "audit:read:any",
+            "audit:read:team",
             "notifications:read:own",
         ],
     },

package/dist/features/rbac/domain/rbac.service.d.ts

@@ -74,8 +74,10 @@ export declare class RbacService {
     createGroup(dto: CreateGroupCommand, actorPermissions?: string[]): Promise<Group>;
     updateGroup(id: string, dto: UpdateGroupCommand, actorPermissions?: string[]): Promise<Group>;
     private resolveGrantableRoles;
+    assertGroupsGrantable(groupIds: string[], actorPermissions?: string[]): Promise<void>;
+    private assertCanAssignManager;
     private assertParentIsValid;
     deleteGroup(id: string): Promise<void>;
-    addUserToGroup(groupId: string, userId: string): Promise<void>;
+    addUserToGroup(groupId: string, userId: string, actorPermissions?: string[]): Promise<void>;
     removeUserFromGroup(groupId: string, userId: string): Promise<void>;
 }

package/dist/features/rbac/domain/rbac.service.js

@@ -452,6 +452,9 @@ let RbacService = class RbacService {
     async createGroup(dto, actorPermissions) {
         const roles = await this.resolveGrantableRoles(dto.roleIds, actorPermissions);
         await this.assertParentIsValid(null, dto.parentId ?? null);
+        if (dto.managerId) {
+            this.assertCanAssignManager(actorPermissions);
+        }
         const group = this.groupRepo.create({
             name: dto.name,
             description: dto.description,
@@ -468,6 +471,9 @@ let RbacService = class RbacService {
         if (dto.parentId !== undefined) {
             await this.assertParentIsValid(id, dto.parentId ?? null);
         }
+        if (dto.managerId !== undefined && dto.managerId !== group.managerId) {
+            this.assertCanAssignManager(actorPermissions);
+        }
         if (dto.name !== undefined) {
             group.name = dto.name;
         }
@@ -508,6 +514,21 @@ let RbacService = class RbacService {
         this.assertGrantableByActor(roles.flatMap((role) => role.permissions ?? []), actorPermissions);
         return roles;
     }
+    async assertGroupsGrantable(groupIds, actorPermissions) {
+        if (groupIds.length === 0) {
+            return;
+        }
+        const groups = await this.groupRepo.find({
+            where: { id: (0, typeorm_1.In)(groupIds) },
+            relations: { roles: { permissions: true } },
+        });
+        this.assertGrantableByActor(groups.flatMap((group) => (group.roles ?? []).flatMap((role) => role.permissions ?? [])), actorPermissions);
+    }
+    assertCanAssignManager(actorPermissions) {
+        if (!(actorPermissions ?? []).includes("users:promote:any")) {
+            throw new common_1.ForbiddenException("Definir o gerente de um grupo é restrito a administradores");
+        }
+    }
     async assertParentIsValid(groupId, parentId) {
         if (!parentId) {
             return;
@@ -527,8 +548,15 @@ let RbacService = class RbacService {
         const group = await this.getGroup(id);
         await this.groupRepo.softRemove(group);
     }
-    async addUserToGroup(groupId, userId) {
-        const group = await this.getGroup(groupId);
+    async addUserToGroup(groupId, userId, actorPermissions) {
+        const group = await this.groupRepo.findOne({
+            where: { id: groupId },
+            relations: { roles: { permissions: true } },
+        });
+        if (!group) {
+            throw new common_1.NotFoundException("Grupo não encontrado");
+        }
+        this.assertGrantableByActor((group.roles ?? []).flatMap((role) => role.permissions ?? []), actorPermissions);
         const user = await this.userRepo.findOne({
             where: { id: userId },
             relations: { groups: true },

package/dist/features/rbac/presentation/rbac.controller.d.ts

@@ -44,7 +44,7 @@ export declare class RbacController {
     createGroup(dto: CreateGroupCommand, actor: AuthenticatedUser): Promise<Group>;
     updateGroup(id: string, dto: UpdateGroupCommand, actor: AuthenticatedUser): Promise<Group>;
     deleteGroup(id: string): Promise<void>;
-    addUserToGroup(id: string, userId: string): Promise<void>;
+    addUserToGroup(id: string, userId: string, actor: AuthenticatedUser): Promise<void>;
     removeUserFromGroup(id: string, userId: string): Promise<void>;
     roles(): Promise<Role[]>;
     role(id: string): Promise<Role>;

package/dist/features/rbac/presentation/rbac.controller.js

@@ -17,7 +17,6 @@ const common_1 = require("@nestjs/common");
 const swagger_1 = require("@nestjs/swagger");
 const currentUser_decorator_1 = require("../../../core/auth/decorators/currentUser.decorator");
 const requirePermission_decorator_1 = require("../../../core/auth/decorators/requirePermission.decorator");
-const permissions_guard_1 = require("../../../core/auth/guards/permissions.guard");
 const auditable_decorator_1 = require("../../audit/presentation/decorators/auditable.decorator");
 const rbac_service_1 = require("../domain/rbac.service");
 const createAction_command_1 = require("./commands/createAction.command");
@@ -104,8 +103,8 @@ let RbacController = class RbacController {
     deleteGroup(id) {
         return this.rbac.deleteGroup(id);
     }
-    addUserToGroup(id, userId) {
-        return this.rbac.addUserToGroup(id, userId);
+    addUserToGroup(id, userId, actor) {
+        return this.rbac.addUserToGroup(id, userId, actor.permissions);
     }
     removeUserFromGroup(id, userId) {
         return this.rbac.removeUserFromGroup(id, userId);
@@ -351,8 +350,9 @@ __decorate([
     (0, requirePermission_decorator_1.RequirePermission)("groups:update:any"),
     __param(0, (0, common_1.Param)("id", common_1.ParseUUIDPipe)),
     __param(1, (0, common_1.Param)("userId", common_1.ParseUUIDPipe)),
+    __param(2, (0, currentUser_decorator_1.CurrentUser)()),
     __metadata("design:type", Function),
-    __metadata("design:paramtypes", [String, String]),
+    __metadata("design:paramtypes", [String, String, Object]),
     __metadata("design:returntype", Promise)
 ], RbacController.prototype, "addUserToGroup", null);
 __decorate([
@@ -483,7 +483,6 @@ __decorate([
 exports.RbacController = RbacController = __decorate([
     (0, swagger_1.ApiTags)("RBAC"),
     (0, swagger_1.ApiBearerAuth)(),
-    (0, common_1.UseGuards)(permissions_guard_1.PermissionsGuard),
     (0, common_1.Controller)({ path: "rbac", version: "1" }),
     __metadata("design:paramtypes", [rbac_service_1.RbacService])
 ], RbacController);

package/dist/features/users/domain/users.service.d.ts

@@ -4,6 +4,7 @@ import { EnvService } from "../../../core/config/env.service";
 import { MailerService } from "../../../core/mailer/mailer.service";
 import { Paginated, PaginationQuery } from "../../../core/utils/pagination.util";
 import { TokenService } from "../../auth/domain/token.service";
+import { RbacService } from "../../rbac/domain/rbac.service";
 import { TeamScopeService } from "../../rbac/domain/teamScope.service";
 import { GroupRepository } from "../../rbac/infra/repositories/group.repository";
 import { RoleRepository } from "../../rbac/infra/repositories/role.repository";
@@ -19,11 +20,12 @@ export declare class UsersService {
     private readonly roleRepo;
     private readonly groupRepo;
     private readonly teamScope;
+    private readonly rbac;
     private readonly env;
     private readonly mailer;
     private readonly tokens;
     private readonly events;
-    constructor(userRepo: UserRepository, historyRepo: PasswordHistoryRepository, roleRepo: RoleRepository, groupRepo: GroupRepository, teamScope: TeamScopeService, env: EnvService, mailer: MailerService, tokens: TokenService, events: EventEmitter2);
+    constructor(userRepo: UserRepository, historyRepo: PasswordHistoryRepository, roleRepo: RoleRepository, groupRepo: GroupRepository, teamScope: TeamScopeService, rbac: RbacService, env: EnvService, mailer: MailerService, tokens: TokenService, events: EventEmitter2);
     findByEmail(email: string): Promise<User | null>;
     findById(id: string): Promise<User>;
     findByIdForActor(id: string, actor: Actor): Promise<User>;

package/dist/features/users/domain/users.service.js

@@ -22,6 +22,7 @@ const codedError_util_1 = require("../../../core/utils/codedError.util");
 const hash_util_1 = require("../../../core/utils/hash.util");
 const pagination_util_1 = require("../../../core/utils/pagination.util");
 const token_service_1 = require("../../auth/domain/token.service");
+const rbac_service_1 = require("../../rbac/domain/rbac.service");
 const teamScope_service_1 = require("../../rbac/domain/teamScope.service");
 const group_repository_1 = require("../../rbac/infra/repositories/group.repository");
 const role_repository_1 = require("../../rbac/infra/repositories/role.repository");
@@ -30,12 +31,13 @@ const user_repository_1 = require("../infra/repositories/user.repository");
 const PASSWORD_HISTORY_LIMIT = 3;
 const PASSWORD_REUSED_MESSAGE = "Esta senha já foi utilizada. Escolha uma senha que você ainda não usou neste sistema";
 let UsersService = class UsersService {
-    constructor(userRepo, historyRepo, roleRepo, groupRepo, teamScope, env, mailer, tokens, events) {
+    constructor(userRepo, historyRepo, roleRepo, groupRepo, teamScope, rbac, env, mailer, tokens, events) {
         this.userRepo = userRepo;
         this.historyRepo = historyRepo;
         this.roleRepo = roleRepo;
         this.groupRepo = groupRepo;
         this.teamScope = teamScope;
+        this.rbac = rbac;
         this.env = env;
         this.mailer = mailer;
         this.tokens = tokens;
@@ -102,6 +104,7 @@ let UsersService = class UsersService {
             if (!isAdmin) {
                 await this.teamScope.assertOwnsGroups(actor, dto.groupIds);
             }
+            await this.rbac.assertGroupsGrantable(dto.groupIds, actor.permissions);
             return this.groupRepo.findBy({ id: (0, typeorm_1.In)(dto.groupIds) });
         }
         if (isAdmin) {
@@ -342,6 +345,7 @@ exports.UsersService = UsersService = __decorate([
         role_repository_1.RoleRepository,
         group_repository_1.GroupRepository,
         teamScope_service_1.TeamScopeService,
+        rbac_service_1.RbacService,
         env_service_1.EnvService,
         mailer_service_1.MailerService,
         token_service_1.TokenService,