rl-core-api 0.3.0 → 0.5.0

package/README.md

@@ -58,7 +58,7 @@ migrations do core vêm no pacote — você nunca copia nem reescreve nenhuma.
 |---|---|
 | **Auth** | login, refresh por cookie httpOnly, 2FA obrigatório (TOTP + fallback por e-mail + códigos de backup), primeiro acesso, reset de senha, bloqueio por tentativas, expiração de senha |
 | **RBAC** | resources, actions, scopes, permissions, roles e groups, com guard por `resource:action:scope` |
-| **Auditoria** | trilha de alterações de dados, log de requisições e log de erros, com retenção configurável |
+| **Auditoria** | trilha de alterações de dados, log de requisições e log de erros, mantidos indefinidamente (sem retenção automática) |
 | **Notificações** | WebSocket com handshake por cookie ou Bearer, escopo resolvido na leitura |
 | **Listagens** | paginação, ordenação e filtro dinâmico com catálogo por listagem (`$AND`/`$OR` aninhados, 17 operadores) |
 | **Infra** | config validada com Zod, mailer, agendador, rate-limit, CSRF, filtro global de exceções, logger Winston |

package/dist/core/auth/actor.interface.d.ts

@@ -0,0 +1,4 @@
+export interface Actor {
+    id: string;
+    permissions: string[];
+}

package/dist/core/auth/actor.interface.js

@@ -0,0 +1,2 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });

package/dist/core/auth/permissionScope.util.d.ts

@@ -0,0 +1,3 @@
+export declare const SCOPE_ANY = "any";
+export declare const SCOPE_TEAM = "team";
+export declare const anyOrTeam: (action: string) => [string, string];

package/dist/core/auth/permissionScope.util.js

@@ -0,0 +1,10 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.anyOrTeam = exports.SCOPE_TEAM = exports.SCOPE_ANY = void 0;
+exports.SCOPE_ANY = "any";
+exports.SCOPE_TEAM = "team";
+const anyOrTeam = (action) => [
+    `${action}:${exports.SCOPE_ANY}`,
+    `${action}:${exports.SCOPE_TEAM}`,
+];
+exports.anyOrTeam = anyOrTeam;

package/dist/core/config/env.schema.d.ts

@@ -28,6 +28,7 @@ export declare const envSchema: z.ZodObject<{
     JWT_ACCESS_SECRET: z.ZodString;
     JWT_PENDING_SECRET: z.ZodString;
     JWT_ACCESS_EXPIRES: z.ZodDefault<z.ZodString>;
+    JWT_PENDING_EXPIRES: z.ZodDefault<z.ZodString>;
     JWT_REFRESH_EXPIRES_MINUTES: z.ZodDefault<z.ZodCoercedNumber<unknown>>;
     TOTP_ENC_KEY: z.ZodString;
     COOKIE_SECURE: z.ZodDefault<z.ZodPipe<z.ZodEnum<{
@@ -57,9 +58,8 @@ export declare const envSchema: z.ZodObject<{
     FIRST_ACCESS_TOKEN_EXPIRY: z.ZodDefault<z.ZodCoercedNumber<unknown>>;
     PASSWORD_MAX_AGE_DAYS: z.ZodDefault<z.ZodCoercedNumber<unknown>>;
     TOKEN_CLEANUP_CRON: z.ZodDefault<z.ZodString>;
-    AUDIT_LOG_CLEANUP_CRON: z.ZodDefault<z.ZodString>;
-    AUDIT_LOG_RETENTION_DAYS: z.ZodDefault<z.ZodCoercedNumber<unknown>>;
-    AUDIT_DATA_RETENTION_DAYS: z.ZodDefault<z.ZodCoercedNumber<unknown>>;
+    AUDIT_SLOW_REQUEST_MS: z.ZodDefault<z.ZodCoercedNumber<unknown>>;
+    AUDIT_IP_SALT: z.ZodOptional<z.ZodString>;
     NOTIFICATION_RETENTION_DAYS: z.ZodDefault<z.ZodCoercedNumber<unknown>>;
     SEED_ADMIN_NAME: z.ZodDefault<z.ZodString>;
     SEED_ADMIN_EMAIL: z.ZodDefault<z.ZodString>;

package/dist/core/config/env.schema.js

@@ -31,6 +31,7 @@ exports.envSchema = zod_1.z
     JWT_ACCESS_SECRET: zod_1.z.string().min(32),
     JWT_PENDING_SECRET: zod_1.z.string().min(32),
     JWT_ACCESS_EXPIRES: zod_1.z.string().default("4h"),
+    JWT_PENDING_EXPIRES: zod_1.z.string().default("15m"),
     JWT_REFRESH_EXPIRES_MINUTES: zod_1.z.coerce
         .number()
         .int()
@@ -68,9 +69,8 @@ exports.envSchema = zod_1.z
         .default(1440),
     PASSWORD_MAX_AGE_DAYS: zod_1.z.coerce.number().int().positive().default(90),
     TOKEN_CLEANUP_CRON: zod_1.z.string().default("0 */6 * * *"),
-    AUDIT_LOG_CLEANUP_CRON: zod_1.z.string().default("0 3 * * *"),
-    AUDIT_LOG_RETENTION_DAYS: zod_1.z.coerce.number().int().positive().default(15),
-    AUDIT_DATA_RETENTION_DAYS: zod_1.z.coerce.number().int().positive().default(30),
+    AUDIT_SLOW_REQUEST_MS: zod_1.z.coerce.number().int().positive().default(1000),
+    AUDIT_IP_SALT: zod_1.z.string().optional(),
     NOTIFICATION_RETENTION_DAYS: zod_1.z.coerce
         .number()
         .int()

package/dist/core/config/env.service.d.ts

@@ -5,5 +5,6 @@ export declare class EnvService {
     private readonly config;
     constructor(config: ConfigService<Env, true>);
     get<K extends keyof Env>(key: K): Env[K];
+    auditIpSalt(): string;
     brand(): AppBrand;
 }

package/dist/core/config/env.service.js

@@ -19,6 +19,9 @@ let EnvService = class EnvService {
     get(key) {
         return this.config.get(key, { infer: true });
     }
+    auditIpSalt() {
+        return this.get("AUDIT_IP_SALT") ?? this.get("JWT_ACCESS_SECRET");
+    }
     brand() {
         const name = this.get("APP_NAME");
         return {

package/dist/core/context/auditContext.d.ts

@@ -5,3 +5,4 @@ export interface AuditContextStore {
     requestId?: string | null;
 }
 export declare const auditContext: AsyncLocalStorage<AuditContextStore>;
+export declare const setAuditUser: (userId: string) => void;

package/dist/core/context/auditContext.js

@@ -1,5 +1,12 @@
 "use strict";
 Object.defineProperty(exports, "__esModule", { value: true });
-exports.auditContext = void 0;
+exports.setAuditUser = exports.auditContext = void 0;
 const node_async_hooks_1 = require("node:async_hooks");
 exports.auditContext = new node_async_hooks_1.AsyncLocalStorage();
+const setAuditUser = (userId) => {
+    const store = exports.auditContext.getStore();
+    if (store) {
+        store.userId = userId;
+    }
+};
+exports.setAuditUser = setAuditUser;

package/dist/core/context/requestLog.context.d.ts

@@ -0,0 +1,10 @@
+import { Request } from "express";
+export interface RequestLogContext {
+    action: string | null;
+    startedAt: number;
+    userId: string | null;
+}
+export declare const routePathOf: (request: Request) => string | null;
+export declare const setRequestLogContext: (request: Request, context: RequestLogContext) => void;
+export declare const getRequestLogContext: (request: Request) => RequestLogContext | null;
+export declare const setRequestLogUser: (request: Request, userId: string | null) => void;

package/dist/core/context/requestLog.context.js

@@ -0,0 +1,26 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.setRequestLogUser = exports.getRequestLogContext = exports.setRequestLogContext = exports.routePathOf = void 0;
+const KEY = "__requestLogContext";
+const routePathOf = (request) => {
+    const route = request.route;
+    if (route && typeof route === "object" && "path" in route) {
+        const path = route.path;
+        return typeof path === "string" ? path : null;
+    }
+    return null;
+};
+exports.routePathOf = routePathOf;
+const setRequestLogContext = (request, context) => {
+    request[KEY] = context;
+};
+exports.setRequestLogContext = setRequestLogContext;
+const getRequestLogContext = (request) => request[KEY] ?? null;
+exports.getRequestLogContext = getRequestLogContext;
+const setRequestLogUser = (request, userId) => {
+    const context = (0, exports.getRequestLogContext)(request);
+    if (context) {
+        context.userId = userId;
+    }
+};
+exports.setRequestLogUser = setRequestLogUser;

package/dist/core/database/migrations/1710000000000-InitialSchema.js

@@ -26,7 +26,6 @@ class InitialSchema1710000000000 {
         two_factor_confirmed_at datetime NULL,
         backup_codes json NULL,
         failed_login_attempts int NOT NULL DEFAULT 0,
-        locked_until datetime NULL,
         password_changed_at datetime NULL,
         must_change_password tinyint NOT NULL DEFAULT 0,
         ${ts},
@@ -49,7 +48,7 @@ class InitialSchema1710000000000 {
         id char(36) NOT NULL,
         user_id char(36) NOT NULL,
         token_hash varchar(255) NOT NULL,
-        type varchar(30) NOT NULL,
+        type tinyint unsigned NOT NULL,
         family char(36) NULL,
         expires_at datetime NOT NULL,
         used tinyint NOT NULL DEFAULT 0,
@@ -192,44 +191,31 @@ class InitialSchema1710000000000 {
       ) ENGINE=InnoDB DEFAULT CHARSET=utf8mb4;
     `);
         await queryRunner.query(`
-      CREATE TABLE audit_changes (
+      CREATE TABLE request_logs (
         id char(36) NOT NULL,
-        user_id char(36) NULL,
-        action varchar(100) NOT NULL,
-        entity varchar(100) NULL,
-        entity_id varchar(36) NULL,
+        outcome tinyint unsigned NOT NULL,
+        action varchar(100) NULL,
         method varchar(10) NULL,
         path varchar(255) NULL,
-        ip_address varchar(45) NULL,
-        metadata json NULL,
+        route varchar(255) NULL,
         status_code int NULL,
         duration_ms int NULL,
-        request_id char(36) NULL,
-        ${ts},
-        PRIMARY KEY (id),
-        KEY IDX_audit_changes_user (user_id),
-        KEY IDX_audit_changes_entity (entity),
-        KEY IDX_audit_changes_request_id (request_id),
-        KEY IDX_audit_changes_status_code (status_code)
-      ) ENGINE=InnoDB DEFAULT CHARSET=utf8mb4;
-    `);
-        await queryRunner.query(`
-      CREATE TABLE error_logs (
-        id char(36) NOT NULL,
-        status_code int NULL,
-        message varchar(255) NOT NULL,
-        stack text NULL,
-        method varchar(10) NULL,
-        path varchar(255) NULL,
         user_id char(36) NULL,
-        ip_address varchar(45) NULL,
-        type enum('VALIDATION','AUTH','NOT_FOUND','RATE_LIMIT','DATABASE','INTEGRATION','INTERNAL') NOT NULL DEFAULT 'INTERNAL',
+        ip_hash char(64) NULL,
+        user_agent varchar(255) NULL,
         request_id char(36) NULL,
+        error_type tinyint unsigned NULL,
+        error_code varchar(100) NULL,
+        error_message varchar(255) NULL,
+        error_stack text NULL,
         ${ts},
         PRIMARY KEY (id),
-        KEY IDX_error_logs_status (status_code),
-        KEY IDX_error_logs_type (type),
-        KEY IDX_error_logs_request_id (request_id)
+        KEY IDX_request_logs_created_at (created_at),
+        KEY IDX_request_logs_outcome (outcome, created_at),
+        KEY IDX_request_logs_status (status_code, created_at),
+        KEY IDX_request_logs_user (user_id, created_at),
+        KEY IDX_request_logs_route (route, created_at),
+        KEY IDX_request_logs_request_id (request_id)
       ) ENGINE=InnoDB DEFAULT CHARSET=utf8mb4;
     `);
         await queryRunner.query(`
@@ -237,22 +223,63 @@ class InitialSchema1710000000000 {
         id char(36) NOT NULL,
         entity varchar(100) NOT NULL,
         entity_id varchar(36) NULL,
-        action enum('CREATE','UPDATE','DELETE') NOT NULL,
+        action tinyint unsigned NOT NULL,
         old_data json NULL,
         new_data json NULL,
         user_id char(36) NULL,
         ip_address varchar(45) NULL,
         ${ts},
         PRIMARY KEY (id),
-        KEY IDX_audit_data_changes_entity (entity, entity_id),
-        KEY IDX_audit_data_changes_user (user_id)
+        KEY IDX_audit_data_changes_created_at (created_at),
+        KEY IDX_audit_data_changes_entity (entity, entity_id, created_at),
+        KEY IDX_audit_data_changes_user (user_id, created_at)
+      ) ENGINE=InnoDB DEFAULT CHARSET=utf8mb4;
+    `);
+        await queryRunner.query(`
+      CREATE TABLE notifications (
+        id char(36) NOT NULL,
+        title varchar(255) NOT NULL,
+        body text NOT NULL,
+        payload json NULL,
+        type tinyint unsigned NOT NULL,
+        created_by char(36) NULL,
+        ${ts},
+        PRIMARY KEY (id),
+        KEY IDX_notifications_created_at (created_at)
+      ) ENGINE=InnoDB DEFAULT CHARSET=utf8mb4;
+    `);
+        await queryRunner.query(`
+      CREATE TABLE notification_scopes (
+        id char(36) NOT NULL,
+        notification_id char(36) NOT NULL,
+        scope_type tinyint unsigned NOT NULL,
+        scope_key varchar(100) NULL,
+        ${ts},
+        PRIMARY KEY (id),
+        KEY IDX_notification_scopes_notification (notification_id),
+        KEY IDX_notification_scopes_target (scope_type, scope_key),
+        CONSTRAINT FK_notification_scopes_notification
+          FOREIGN KEY (notification_id) REFERENCES notifications (id) ON DELETE CASCADE
+      ) ENGINE=InnoDB DEFAULT CHARSET=utf8mb4;
+    `);
+        await queryRunner.query(`
+      CREATE TABLE notification_reads (
+        notification_id char(36) NOT NULL,
+        user_id char(36) NOT NULL,
+        read_at datetime NOT NULL,
+        PRIMARY KEY (notification_id, user_id),
+        KEY IDX_notification_reads_user (user_id),
+        CONSTRAINT FK_notification_reads_notification
+          FOREIGN KEY (notification_id) REFERENCES notifications (id) ON DELETE CASCADE
       ) ENGINE=InnoDB DEFAULT CHARSET=utf8mb4;
     `);
     }
     async down(queryRunner) {
+        await queryRunner.query("DROP TABLE IF EXISTS notification_reads;");
+        await queryRunner.query("DROP TABLE IF EXISTS notification_scopes;");
+        await queryRunner.query("DROP TABLE IF EXISTS notifications;");
         await queryRunner.query("DROP TABLE IF EXISTS audit_data_changes;");
-        await queryRunner.query("DROP TABLE IF EXISTS error_logs;");
-        await queryRunner.query("DROP TABLE IF EXISTS audit_changes;");
+        await queryRunner.query("DROP TABLE IF EXISTS request_logs;");
         await queryRunner.query("DROP TABLE IF EXISTS group_roles;");
         await queryRunner.query("DROP TABLE IF EXISTS user_groups;");
         await queryRunner.query("DROP TABLE IF EXISTS user_permissions;");

package/dist/core/database/migrations/{1786233600000-Notifications.d.ts → 1787270400000-GroupManager.d.ts}

@@ -1,5 +1,5 @@
 import { MigrationInterface, QueryRunner } from "typeorm";
-export declare class Notifications1786233600000 implements MigrationInterface {
+export declare class GroupManager1787270400000 implements MigrationInterface {
     name: string;
     up(queryRunner: QueryRunner): Promise<void>;
     down(queryRunner: QueryRunner): Promise<void>;

package/dist/core/database/migrations/1787270400000-GroupManager.js

@@ -0,0 +1,26 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.GroupManager1787270400000 = void 0;
+class GroupManager1787270400000 {
+    constructor() {
+        this.name = "GroupManager1787270400000";
+    }
+    async up(queryRunner) {
+        await queryRunner.query(`
+      ALTER TABLE \`groups\`
+        ADD COLUMN manager_id char(36) NULL AFTER parent_id,
+        ADD KEY IDX_groups_manager (manager_id),
+        ADD CONSTRAINT FK_groups_manager FOREIGN KEY (manager_id)
+          REFERENCES users (id) ON DELETE SET NULL;
+    `);
+    }
+    async down(queryRunner) {
+        await queryRunner.query(`
+      ALTER TABLE \`groups\`
+        DROP FOREIGN KEY FK_groups_manager,
+        DROP KEY IDX_groups_manager,
+        DROP COLUMN manager_id;
+    `);
+    }
+}
+exports.GroupManager1787270400000 = GroupManager1787270400000;

package/dist/core/database/migrations/index.js

@@ -2,12 +2,8 @@
 Object.defineProperty(exports, "__esModule", { value: true });
 exports.coreMigrations = void 0;
 const _1710000000000_InitialSchema_1 = require("./1710000000000-InitialSchema");
-const _1786060800000_FirstAccessTokenType_1 = require("./1786060800000-FirstAccessTokenType");
-const _1786147200000_PermanentAccountLock_1 = require("./1786147200000-PermanentAccountLock");
-const _1786233600000_Notifications_1 = require("./1786233600000-Notifications");
+const _1787270400000_GroupManager_1 = require("./1787270400000-GroupManager");
 exports.coreMigrations = [
     _1710000000000_InitialSchema_1.InitialSchema1710000000000,
-    _1786060800000_FirstAccessTokenType_1.FirstAccessTokenType1786060800000,
-    _1786147200000_PermanentAccountLock_1.PermanentAccountLock1786147200000,
-    _1786233600000_Notifications_1.Notifications1786233600000,
+    _1787270400000_GroupManager_1.GroupManager1787270400000,
 ];

package/dist/core/events/appEvent.enum.d.ts

@@ -4,7 +4,8 @@ export declare enum AppEvent {
     USER_ROLES_CHANGED = "user.roles-changed",
     USER_PASSWORD_RESET_REQUESTED = "user.password-reset-requested",
     USER_PASSWORD_EXPIRING = "user.password-expiring",
-    SYSTEM_CLEANUP_FAILED = "system.cleanup-failed"
+    SYSTEM_CLEANUP_FAILED = "system.cleanup-failed",
+    HTTP_ERROR = "http.error"
 }
 export interface UserLockedEvent {
     userId: string;
@@ -17,6 +18,7 @@ export interface UserTwoFactorResetEvent {
 export interface UserRolesChangedEvent {
     userId: string;
     roleNames: string[];
+    previousRoleNames: string[];
 }
 export interface UserPasswordResetRequestedEvent {
     userId: string;
@@ -29,3 +31,19 @@ export interface SystemCleanupFailedEvent {
     routine: string;
     reason: string;
 }
+export interface HttpErrorEvent {
+    statusCode: number;
+    errorCode: string | null;
+    errorName: string | null;
+    message: string;
+    stack?: string | null;
+    method: string;
+    path: string;
+    route?: string | null;
+    action?: string | null;
+    durationMs?: number | null;
+    userId?: string | null;
+    ipHash?: string | null;
+    userAgent?: string | null;
+    requestId?: string | null;
+}

package/dist/core/events/appEvent.enum.js

@@ -9,4 +9,5 @@ var AppEvent;
     AppEvent["USER_PASSWORD_RESET_REQUESTED"] = "user.password-reset-requested";
     AppEvent["USER_PASSWORD_EXPIRING"] = "user.password-expiring";
     AppEvent["SYSTEM_CLEANUP_FAILED"] = "system.cleanup-failed";
+    AppEvent["HTTP_ERROR"] = "http.error";
 })(AppEvent || (exports.AppEvent = AppEvent = {}));

package/dist/core/filters/allExceptions.filter.d.ts

@@ -1,5 +1,11 @@
 import { ArgumentsHost, ExceptionFilter } from "@nestjs/common";
+import { EventEmitter2 } from "@nestjs/event-emitter";
+import { EnvService } from "../config/env.service";
 export declare class AllExceptionsFilter implements ExceptionFilter {
+    private readonly events;
+    private readonly env;
     private readonly logger;
+    constructor(events: EventEmitter2, env: EnvService);
     catch(exception: unknown, host: ArgumentsHost): void;
+    private publish;
 }

package/dist/core/filters/allExceptions.filter.js

@@ -5,11 +5,21 @@ var __decorate = (this && this.__decorate) || function (decorators, target, key,
     else for (var i = decorators.length - 1; i >= 0; i--) if (d = decorators[i]) r = (c < 3 ? d(r) : c > 3 ? d(target, key, r) : d(target, key)) || r;
     return c > 3 && r && Object.defineProperty(target, key, r), r;
 };
+var __metadata = (this && this.__metadata) || function (k, v) {
+    if (typeof Reflect === "object" && typeof Reflect.metadata === "function") return Reflect.metadata(k, v);
+};
 Object.defineProperty(exports, "__esModule", { value: true });
 exports.AllExceptionsFilter = void 0;
 const common_1 = require("@nestjs/common");
+const event_emitter_1 = require("@nestjs/event-emitter");
+const env_service_1 = require("../config/env.service");
+const requestLog_context_1 = require("../context/requestLog.context");
+const appEvent_enum_1 = require("../events/appEvent.enum");
+const ip_util_1 = require("../utils/ip.util");
 let AllExceptionsFilter = class AllExceptionsFilter {
-    constructor() {
+    constructor(events, env) {
+        this.events = events;
+        this.env = env;
         this.logger = new common_1.Logger("Exception");
     }
     catch(exception, host) {
@@ -44,6 +54,12 @@ let AllExceptionsFilter = class AllExceptionsFilter {
                 this.logger.error(`[${requestId}] ${exception.message}`, exception.stack);
             }
         }
+        this.publish(exception, request, {
+            statusCode: status,
+            errorCode,
+            message,
+            requestId,
+        });
         response.status(status).json({
             statusCode: status,
             message,
@@ -54,8 +70,37 @@ let AllExceptionsFilter = class AllExceptionsFilter {
             requestId,
         });
     }
+    publish(exception, request, data) {
+        try {
+            const user = request.user;
+            const logContext = (0, requestLog_context_1.getRequestLogContext)(request);
+            this.events.emit(appEvent_enum_1.AppEvent.HTTP_ERROR, {
+                statusCode: data.statusCode,
+                errorCode: data.errorCode,
+                errorName: exception?.name ?? null,
+                message: typeof data.message === "string"
+                    ? data.message
+                    : JSON.stringify(data.message),
+                stack: exception instanceof Error ? exception.stack : null,
+                method: request.method,
+                path: request.path,
+                route: (0, requestLog_context_1.routePathOf)(request),
+                action: logContext?.action ?? null,
+                durationMs: logContext ? Date.now() - logContext.startedAt : null,
+                userId: logContext?.userId ?? user?.id ?? null,
+                ipHash: (0, ip_util_1.hashIp)((0, ip_util_1.normalizeIp)(request.ip), this.env.auditIpSalt()) ?? null,
+                userAgent: request.headers["user-agent"] ?? null,
+                requestId: data.requestId,
+            });
+        }
+        catch (err) {
+            this.logger.warn(`Falha ao publicar ${appEvent_enum_1.AppEvent.HTTP_ERROR}: ${err.message}`);
+        }
+    }
 };
 exports.AllExceptionsFilter = AllExceptionsFilter;
 exports.AllExceptionsFilter = AllExceptionsFilter = __decorate([
-    (0, common_1.Catch)()
+    (0, common_1.Catch)(),
+    __metadata("design:paramtypes", [event_emitter_1.EventEmitter2,
+        env_service_1.EnvService])
 ], AllExceptionsFilter);

package/dist/core/filters/appErrorCode.enum.d.ts

@@ -3,7 +3,9 @@ export declare enum AppErrorCode {
     ACCOUNT_INACTIVE = "ACCOUNT_INACTIVE",
     INVALID_CREDENTIALS = "INVALID_CREDENTIALS",
     INVALID_TWO_FACTOR_CODE = "INVALID_TWO_FACTOR_CODE",
+    PENDING_TOKEN_EXPIRED = "PENDING_TOKEN_EXPIRED",
     PASSWORD_REUSED = "PASSWORD_REUSED",
     TOO_MANY_REQUESTS = "TOO_MANY_REQUESTS",
-    INVALID_FILTER = "INVALID_FILTER"
+    INVALID_FILTER = "INVALID_FILTER",
+    GROUP_REQUIRED = "GROUP_REQUIRED"
 }

package/dist/core/filters/appErrorCode.enum.js

@@ -7,7 +7,9 @@ var AppErrorCode;
     AppErrorCode["ACCOUNT_INACTIVE"] = "ACCOUNT_INACTIVE";
     AppErrorCode["INVALID_CREDENTIALS"] = "INVALID_CREDENTIALS";
     AppErrorCode["INVALID_TWO_FACTOR_CODE"] = "INVALID_TWO_FACTOR_CODE";
+    AppErrorCode["PENDING_TOKEN_EXPIRED"] = "PENDING_TOKEN_EXPIRED";
     AppErrorCode["PASSWORD_REUSED"] = "PASSWORD_REUSED";
     AppErrorCode["TOO_MANY_REQUESTS"] = "TOO_MANY_REQUESTS";
     AppErrorCode["INVALID_FILTER"] = "INVALID_FILTER";
+    AppErrorCode["GROUP_REQUIRED"] = "GROUP_REQUIRED";
 })(AppErrorCode || (exports.AppErrorCode = AppErrorCode = {}));

package/dist/core/query/parseFilter.util.js

@@ -8,6 +8,7 @@ const filterOperator_enum_1 = require("./filterOperator.enum");
 const codedError_util_1 = require("../utils/codedError.util");
 const UUID_PATTERN = /^[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}$/i;
 const DATE_ONLY = /^\d{4}-\d{2}-\d{2}$/;
+const NUMERIC_ENUM_VALUE = /^\d+$/;
 const NULLABILITY_OPERATORS = [
     filterOperator_enum_1.FilterOperator.Is,
     filterOperator_enum_1.FilterOperator.Not,
@@ -197,14 +198,15 @@ const coerceScalar = (definition, value, upperBound = false) => {
             return date;
         }
         case filterFieldType_enum_1.FilterFieldType.Enum: {
-            if (typeof value !== "string") {
+            if (typeof value !== "string" && typeof value !== "number") {
                 throw invalid(`"${field}" espera um dos valores da lista`);
             }
+            const raw = String(value);
             const options = definition.options ?? [];
-            if (!options.some((option) => option.value === value)) {
-                throw invalid(`"${value}" não é um valor válido para "${field}"`);
+            if (!options.some((option) => option.value === raw)) {
+                throw invalid(`"${raw}" não é um valor válido para "${field}"`);
             }
-            return value;
+            return NUMERIC_ENUM_VALUE.test(raw) ? Number(raw) : raw;
         }
         case filterFieldType_enum_1.FilterFieldType.Select:
             if (typeof value !== "string" || value === "") {

package/dist/core/utils/ip.util.d.ts

@@ -1 +1,2 @@
+export declare function hashIp(ip: string | undefined, secret: string): string | undefined;
 export declare function normalizeIp(ip: string | undefined): string | undefined;

package/dist/core/utils/ip.util.js

@@ -1,6 +1,14 @@
 "use strict";
 Object.defineProperty(exports, "__esModule", { value: true });
+exports.hashIp = hashIp;
 exports.normalizeIp = normalizeIp;
+const node_crypto_1 = require("node:crypto");
+function hashIp(ip, secret) {
+    if (!ip) {
+        return ip;
+    }
+    return (0, node_crypto_1.createHmac)("sha256", secret).update(ip).digest("hex");
+}
 function normalizeIp(ip) {
     if (!ip) {
         return ip;

package/dist/core/websocket/baseGateway.d.ts

@@ -16,6 +16,7 @@ export declare abstract class BaseGateway implements OnGatewayConnection, OnGate
     constructor(wsAuth: WsAuthService, env: EnvService);
     handleConnection(socket: Socket): Promise<void>;
     handleDisconnect(socket: Socket): void;
+    requestSessionRefresh(userId: string): void;
     protected emitTo<T>(rooms: string[], event: string, data: T): void;
     private scheduleExpiry;
 }

package/dist/core/websocket/baseGateway.js

@@ -40,6 +40,9 @@ class BaseGateway {
         }
         socket.removeAllListeners();
     }
+    requestSessionRefresh(userId) {
+        this.emitTo([(0, socket_constants_1.userRoom)(userId)], socket_constants_1.SESSION_REFRESH_EVENT, { userId });
+    }
     emitTo(rooms, event, data) {
         const targets = rooms.filter((room) => room.length > 0);
         if (targets.length === 0) {

package/dist/coreEntities.d.ts

@@ -1,6 +1,5 @@
-import { AuditChange } from "./features/audit/infra/schema/auditChange.schema";
 import { AuditDataChange } from "./features/audit/infra/schema/auditDataChange.schema";
-import { ErrorLog } from "./features/audit/infra/schema/errorLog.schema";
+import { RequestLog } from "./features/audit/infra/schema/requestLog.schema";
 import { AuthToken } from "./features/auth/infra/schema/authToken.schema";
 import { Notification } from "./features/notifications/infra/schema/notification.schema";
 import { NotificationRead } from "./features/notifications/infra/schema/notificationRead.schema";
@@ -9,4 +8,4 @@ import { Action } from "./features/rbac/infra/schema/action.schema";
 import { Permission } from "./features/rbac/infra/schema/permission.schema";
 import { PasswordHistory } from "./features/users/infra/schema/passwordHistory.schema";
 import { User } from "./features/users/infra/schema/user.schema";
-export declare const coreEntities: (typeof AuditChange | typeof AuditDataChange | typeof ErrorLog | typeof AuthToken | typeof NotificationRead | typeof Notification | typeof NotificationScope | typeof Action | typeof Permission | typeof PasswordHistory | typeof User)[];
+export declare const coreEntities: (typeof AuditDataChange | typeof RequestLog | typeof AuthToken | typeof NotificationRead | typeof Notification | typeof NotificationScope | typeof Action | typeof Permission | typeof PasswordHistory | typeof User)[];

package/dist/coreEntities.js

@@ -1,9 +1,8 @@
 "use strict";
 Object.defineProperty(exports, "__esModule", { value: true });
 exports.coreEntities = void 0;
-const auditChange_schema_1 = require("./features/audit/infra/schema/auditChange.schema");
 const auditDataChange_schema_1 = require("./features/audit/infra/schema/auditDataChange.schema");
-const errorLog_schema_1 = require("./features/audit/infra/schema/errorLog.schema");
+const requestLog_schema_1 = require("./features/audit/infra/schema/requestLog.schema");
 const authToken_schema_1 = require("./features/auth/infra/schema/authToken.schema");
 const notification_schema_1 = require("./features/notifications/infra/schema/notification.schema");
 const notificationRead_schema_1 = require("./features/notifications/infra/schema/notificationRead.schema");
@@ -26,8 +25,7 @@ exports.coreEntities = [
     permission_schema_1.Permission,
     role_schema_1.Role,
     group_schema_1.Group,
-    auditChange_schema_1.AuditChange,
-    errorLog_schema_1.ErrorLog,
+    requestLog_schema_1.RequestLog,
     auditDataChange_schema_1.AuditDataChange,
     notification_schema_1.Notification,
     notificationScope_schema_1.NotificationScope,

package/dist/features/audit/audit.module.js

@@ -20,22 +20,20 @@ let AuditModule = class AuditModule {
 exports.AuditModule = AuditModule;
 exports.AuditModule = AuditModule = __decorate([
     (0, common_1.Module)({
-        imports: [
-            typeorm_1.TypeOrmModule.forFeature([infra_1.AuditChange, infra_1.ErrorLog, infra_1.AuditDataChange, user_schema_1.User]),
-        ],
+        imports: [typeorm_1.TypeOrmModule.forFeature([infra_1.RequestLog, infra_1.AuditDataChange, user_schema_1.User])],
         controllers: [presentation_1.AuditController],
         providers: [
-            infra_1.AuditChangeRepository,
-            infra_1.ErrorLogRepository,
+            infra_1.RequestLogRepository,
             infra_1.AuditDataChangeRepository,
             user_repository_1.UserRepository,
             domain_1.AuditService,
             { provide: core_1.APP_INTERCEPTOR, useClass: presentation_1.AuditInterceptor },
+            presentation_1.HttpErrorListener,
+            presentation_1.UserRolesChangedListener,
             infra_1.AuditDataSubscriber,
         ],
         exports: [
-            infra_1.AuditChangeRepository,
-            infra_1.ErrorLogRepository,
+            infra_1.RequestLogRepository,
             infra_1.AuditDataChangeRepository,
             user_repository_1.UserRepository,
             domain_1.AuditService,