rl-core-api 0.3.0 → 0.5.0

package/dist/features/audit/presentation/responses/log.response.js

@@ -9,10 +9,11 @@ var __metadata = (this && this.__metadata) || function (k, v) {
     if (typeof Reflect === "object" && typeof Reflect.metadata === "function") return Reflect.metadata(k, v);
 };
 Object.defineProperty(exports, "__esModule", { value: true });
-exports.PaginatedErrorLogsResponse = exports.ErrorLogResponse = exports.PaginatedRequestLogsResponse = exports.RequestLogResponse = void 0;
+exports.PaginatedRequestLogsResponse = exports.RequestLogResponse = void 0;
 const swagger_1 = require("@nestjs/swagger");
 const paginationMeta_response_1 = require("../../../../core/utils/paginationMeta.response");
-const errorLog_schema_1 = require("../../infra/schema/errorLog.schema");
+const errorType_enum_1 = require("../../domain/enums/errorType.enum");
+const requestOutcome_enum_1 = require("../../domain/enums/requestOutcome.enum");
 const auditDataChange_response_1 = require("./auditDataChange.response");
 class RequestLogResponse {
 }
@@ -22,25 +23,45 @@ __decorate([
     __metadata("design:type", String)
 ], RequestLogResponse.prototype, "id", void 0);
 __decorate([
-    (0, swagger_1.ApiProperty)({ example: "GET /api/v1/users" }),
-    __metadata("design:type", String)
-], RequestLogResponse.prototype, "action", void 0);
-__decorate([
-    (0, swagger_1.ApiProperty)({ type: String, required: false, nullable: true, example: "User" }),
+    (0, swagger_1.ApiProperty)({
+        enum: requestOutcome_enum_1.RequestOutcome,
+        enumName: "RequestOutcome",
+        description: "0 = sucesso, 1 = erro, 2 = abortada",
+        example: requestOutcome_enum_1.RequestOutcome.SUCCESS,
+    }),
+    __metadata("design:type", Number)
+], RequestLogResponse.prototype, "outcome", void 0);
+__decorate([
+    (0, swagger_1.ApiProperty)({
+        type: String,
+        required: false,
+        nullable: true,
+        example: "Login",
+    }),
     __metadata("design:type", Object)
-], RequestLogResponse.prototype, "entity", void 0);
-__decorate([
-    (0, swagger_1.ApiProperty)({ type: String, required: false, nullable: true }),
-    __metadata("design:type", Object)
-], RequestLogResponse.prototype, "entityId", void 0);
+], RequestLogResponse.prototype, "action", void 0);
 __decorate([
-    (0, swagger_1.ApiProperty)({ type: String, required: false, nullable: true, example: "GET" }),
+    (0, swagger_1.ApiProperty)({ type: String, required: false, nullable: true, example: "POST" }),
     __metadata("design:type", Object)
 ], RequestLogResponse.prototype, "method", void 0);
 __decorate([
-    (0, swagger_1.ApiProperty)({ type: String, required: false, nullable: true }),
+    (0, swagger_1.ApiProperty)({
+        type: String,
+        required: false,
+        nullable: true,
+        example: "/api/v1/users/9f3c…",
+    }),
     __metadata("design:type", Object)
 ], RequestLogResponse.prototype, "path", void 0);
+__decorate([
+    (0, swagger_1.ApiProperty)({
+        type: String,
+        required: false,
+        nullable: true,
+        example: "/users/:id",
+    }),
+    __metadata("design:type", Object)
+], RequestLogResponse.prototype, "route", void 0);
 __decorate([
     (0, swagger_1.ApiProperty)({ type: Number, required: false, nullable: true, example: 200 }),
     __metadata("design:type", Object)
@@ -49,18 +70,6 @@ __decorate([
     (0, swagger_1.ApiProperty)({ type: Number, required: false, nullable: true, example: 42 }),
     __metadata("design:type", Object)
 ], RequestLogResponse.prototype, "durationMs", void 0);
-__decorate([
-    (0, swagger_1.ApiProperty)({ type: String, required: false, nullable: true, example: "10.0.0.1" }),
-    __metadata("design:type", Object)
-], RequestLogResponse.prototype, "ipAddress", void 0);
-__decorate([
-    (0, swagger_1.ApiProperty)({ type: String, required: false, nullable: true, format: "uuid" }),
-    __metadata("design:type", Object)
-], RequestLogResponse.prototype, "requestId", void 0);
-__decorate([
-    (0, swagger_1.ApiProperty)({ type: Object, required: false, nullable: true }),
-    __metadata("design:type", Object)
-], RequestLogResponse.prototype, "metadata", void 0);
 __decorate([
     (0, swagger_1.ApiProperty)({ type: String, required: false, nullable: true }),
     __metadata("design:type", Object)
@@ -70,95 +79,64 @@ __decorate([
     __metadata("design:type", Object)
 ], RequestLogResponse.prototype, "user", void 0);
 __decorate([
-    (0, swagger_1.ApiProperty)({ format: "date-time" }),
-    __metadata("design:type", Date)
-], RequestLogResponse.prototype, "createdAt", void 0);
-__decorate([
-    (0, swagger_1.ApiProperty)({ format: "date-time" }),
-    __metadata("design:type", Date)
-], RequestLogResponse.prototype, "updatedAt", void 0);
-__decorate([
-    (0, swagger_1.ApiProperty)({ type: String, format: "date-time", required: false, nullable: true }),
-    __metadata("design:type", Object)
-], RequestLogResponse.prototype, "deletedAt", void 0);
-class PaginatedRequestLogsResponse {
-}
-exports.PaginatedRequestLogsResponse = PaginatedRequestLogsResponse;
-__decorate([
-    (0, swagger_1.ApiProperty)({ type: [RequestLogResponse] }),
-    __metadata("design:type", Array)
-], PaginatedRequestLogsResponse.prototype, "items", void 0);
-__decorate([
-    (0, swagger_1.ApiProperty)({ type: paginationMeta_response_1.PaginationMetaResponse }),
-    __metadata("design:type", paginationMeta_response_1.PaginationMetaResponse)
-], PaginatedRequestLogsResponse.prototype, "meta", void 0);
-class ErrorLogResponse {
-}
-exports.ErrorLogResponse = ErrorLogResponse;
-__decorate([
-    (0, swagger_1.ApiProperty)({ format: "uuid" }),
-    __metadata("design:type", String)
-], ErrorLogResponse.prototype, "id", void 0);
-__decorate([
-    (0, swagger_1.ApiProperty)({ enum: errorLog_schema_1.ErrorType, enumName: "ErrorType" }),
-    __metadata("design:type", String)
-], ErrorLogResponse.prototype, "type", void 0);
-__decorate([
-    (0, swagger_1.ApiProperty)({ type: Number, required: false, nullable: true, example: 500 }),
+    (0, swagger_1.ApiProperty)({
+        type: String,
+        required: false,
+        nullable: true,
+        description: "HMAC do IP — não é reversível ao endereço original",
+    }),
     __metadata("design:type", Object)
-], ErrorLogResponse.prototype, "statusCode", void 0);
-__decorate([
-    (0, swagger_1.ApiProperty)(),
-    __metadata("design:type", String)
-], ErrorLogResponse.prototype, "message", void 0);
+], RequestLogResponse.prototype, "ipHash", void 0);
 __decorate([
     (0, swagger_1.ApiProperty)({ type: String, required: false, nullable: true }),
     __metadata("design:type", Object)
-], ErrorLogResponse.prototype, "stack", void 0);
-__decorate([
-    (0, swagger_1.ApiProperty)({ type: String, required: false, nullable: true, example: "POST" }),
-    __metadata("design:type", Object)
-], ErrorLogResponse.prototype, "method", void 0);
+], RequestLogResponse.prototype, "userAgent", void 0);
 __decorate([
-    (0, swagger_1.ApiProperty)({ type: String, required: false, nullable: true }),
+    (0, swagger_1.ApiProperty)({ type: String, required: false, nullable: true, format: "uuid" }),
     __metadata("design:type", Object)
-], ErrorLogResponse.prototype, "path", void 0);
+], RequestLogResponse.prototype, "requestId", void 0);
 __decorate([
-    (0, swagger_1.ApiProperty)({ type: String, required: false, nullable: true, example: "10.0.0.1" }),
+    (0, swagger_1.ApiProperty)({
+        enum: errorType_enum_1.ErrorType,
+        enumName: "ErrorType",
+        required: false,
+        nullable: true,
+        description: "0 = validação, 1 = autenticação, 2 = não encontrado, 3 = limite, 4 = banco, 5 = integração, 6 = interno",
+    }),
     __metadata("design:type", Object)
-], ErrorLogResponse.prototype, "ipAddress", void 0);
+], RequestLogResponse.prototype, "errorType", void 0);
 __decorate([
-    (0, swagger_1.ApiProperty)({ type: String, required: false, nullable: true, format: "uuid" }),
+    (0, swagger_1.ApiProperty)({ type: String, required: false, nullable: true }),
     __metadata("design:type", Object)
-], ErrorLogResponse.prototype, "requestId", void 0);
+], RequestLogResponse.prototype, "errorCode", void 0);
 __decorate([
     (0, swagger_1.ApiProperty)({ type: String, required: false, nullable: true }),
     __metadata("design:type", Object)
-], ErrorLogResponse.prototype, "userId", void 0);
+], RequestLogResponse.prototype, "errorMessage", void 0);
 __decorate([
-    (0, swagger_1.ApiProperty)({ type: auditDataChange_response_1.AuditUserRefResponse, required: false, nullable: true }),
+    (0, swagger_1.ApiProperty)({ type: String, required: false, nullable: true }),
     __metadata("design:type", Object)
-], ErrorLogResponse.prototype, "user", void 0);
+], RequestLogResponse.prototype, "errorStack", void 0);
 __decorate([
     (0, swagger_1.ApiProperty)({ format: "date-time" }),
     __metadata("design:type", Date)
-], ErrorLogResponse.prototype, "createdAt", void 0);
+], RequestLogResponse.prototype, "createdAt", void 0);
 __decorate([
     (0, swagger_1.ApiProperty)({ format: "date-time" }),
     __metadata("design:type", Date)
-], ErrorLogResponse.prototype, "updatedAt", void 0);
+], RequestLogResponse.prototype, "updatedAt", void 0);
 __decorate([
     (0, swagger_1.ApiProperty)({ type: String, format: "date-time", required: false, nullable: true }),
     __metadata("design:type", Object)
-], ErrorLogResponse.prototype, "deletedAt", void 0);
-class PaginatedErrorLogsResponse {
+], RequestLogResponse.prototype, "deletedAt", void 0);
+class PaginatedRequestLogsResponse {
 }
-exports.PaginatedErrorLogsResponse = PaginatedErrorLogsResponse;
+exports.PaginatedRequestLogsResponse = PaginatedRequestLogsResponse;
 __decorate([
-    (0, swagger_1.ApiProperty)({ type: [ErrorLogResponse] }),
+    (0, swagger_1.ApiProperty)({ type: [RequestLogResponse] }),
     __metadata("design:type", Array)
-], PaginatedErrorLogsResponse.prototype, "items", void 0);
+], PaginatedRequestLogsResponse.prototype, "items", void 0);
 __decorate([
     (0, swagger_1.ApiProperty)({ type: paginationMeta_response_1.PaginationMetaResponse }),
     __metadata("design:type", paginationMeta_response_1.PaginationMetaResponse)
-], PaginatedErrorLogsResponse.prototype, "meta", void 0);
+], PaginatedRequestLogsResponse.prototype, "meta", void 0);

package/dist/features/audit/presentation/userRolesChanged.listener.d.ts

@@ -0,0 +1,7 @@
+import { UserRolesChangedEvent } from "../../../core/events/appEvent.enum";
+import { AuditService } from "../domain/audit.service";
+export declare class UserRolesChangedListener {
+    private readonly audit;
+    constructor(audit: AuditService);
+    onRolesChanged(event: UserRolesChangedEvent): Promise<void>;
+}

package/dist/features/audit/presentation/userRolesChanged.listener.js

@@ -0,0 +1,43 @@
+"use strict";
+var __decorate = (this && this.__decorate) || function (decorators, target, key, desc) {
+    var c = arguments.length, r = c < 3 ? target : desc === null ? desc = Object.getOwnPropertyDescriptor(target, key) : desc, d;
+    if (typeof Reflect === "object" && typeof Reflect.decorate === "function") r = Reflect.decorate(decorators, target, key, desc);
+    else for (var i = decorators.length - 1; i >= 0; i--) if (d = decorators[i]) r = (c < 3 ? d(r) : c > 3 ? d(target, key, r) : d(target, key)) || r;
+    return c > 3 && r && Object.defineProperty(target, key, r), r;
+};
+var __metadata = (this && this.__metadata) || function (k, v) {
+    if (typeof Reflect === "object" && typeof Reflect.metadata === "function") return Reflect.metadata(k, v);
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.UserRolesChangedListener = void 0;
+const common_1 = require("@nestjs/common");
+const event_emitter_1 = require("@nestjs/event-emitter");
+const appEvent_enum_1 = require("../../../core/events/appEvent.enum");
+const audit_service_1 = require("../domain/audit.service");
+const auditDataChange_schema_1 = require("../infra/schema/auditDataChange.schema");
+const asLabel = (names) => names.length ? [...names].sort().join(", ") : "—";
+let UserRolesChangedListener = class UserRolesChangedListener {
+    constructor(audit) {
+        this.audit = audit;
+    }
+    async onRolesChanged(event) {
+        await this.audit.recordChange({
+            entity: "User",
+            entityId: event.userId,
+            action: auditDataChange_schema_1.AuditDataAction.UPDATE,
+            oldData: { roles: asLabel(event.previousRoleNames) },
+            newData: { roles: asLabel(event.roleNames) },
+        });
+    }
+};
+exports.UserRolesChangedListener = UserRolesChangedListener;
+__decorate([
+    (0, event_emitter_1.OnEvent)(appEvent_enum_1.AppEvent.USER_ROLES_CHANGED),
+    __metadata("design:type", Function),
+    __metadata("design:paramtypes", [Object]),
+    __metadata("design:returntype", Promise)
+], UserRolesChangedListener.prototype, "onRolesChanged", null);
+exports.UserRolesChangedListener = UserRolesChangedListener = __decorate([
+    (0, common_1.Injectable)(),
+    __metadata("design:paramtypes", [audit_service_1.AuditService])
+], UserRolesChangedListener);

package/dist/features/auth/domain/auth.service.d.ts

@@ -14,6 +14,11 @@ interface RequestCtx {
     userAgent?: string;
 }
 export type LoginStatus = "SETUP_REQUIRED" | "TOTP_REQUIRED";
+export interface LoginChallenge {
+    status: LoginStatus;
+    pendingToken: string;
+    expiresInSeconds: number;
+}
 export type SessionUser = AuthenticatedUser;
 export interface LoginSession {
     accessToken: string;
@@ -42,10 +47,7 @@ export declare class AuthService {
     private readonly rbac;
     private dummyHash?;
     constructor(users: UsersService, tokens: TokenService, twoFactor: TwoFactorService, jwt: JwtService, env: EnvService, mailer: MailerService, rbac: RbacService);
-    login(dto: LoginCommand): Promise<{
-        status: LoginStatus;
-        pendingToken: string;
-    }>;
+    login(dto: LoginCommand): Promise<LoginChallenge>;
     setupTotp(pendingToken: string): Promise<TotpSetup>;
     requestEmailCode(pendingToken: string): Promise<{
         sent: boolean;
@@ -58,6 +60,7 @@ export declare class AuthService {
     inspectPasswordToken(token: string): Promise<PasswordTokenCheck>;
     resetPassword(token: string, newPassword: string): Promise<void>;
     private buildPendingToken;
+    private pendingExpiresIn;
     private decodePending;
     private signAccessToken;
     toSessionUser(user: User): Promise<SessionUser>;

package/dist/features/auth/domain/auth.service.js

@@ -13,6 +13,7 @@ exports.AuthService = void 0;
 const common_1 = require("@nestjs/common");
 const jwt_1 = require("@nestjs/jwt");
 const env_service_1 = require("../../../core/config/env.service");
+const auditContext_1 = require("../../../core/context/auditContext");
 const appErrorCode_enum_1 = require("../../../core/filters/appErrorCode.enum");
 const mailer_service_1 = require("../../../core/mailer/mailer.service");
 const codedError_util_1 = require("../../../core/utils/codedError.util");
@@ -30,7 +31,6 @@ function attemptsWarning(prefix, remaining) {
     const attempts = remaining === 1 ? "Resta 1 tentativa" : `Restam ${remaining} tentativas`;
     return `${prefix}. ${attempts} antes do bloqueio da conta`;
 }
-const PENDING_EXPIRES = "10m";
 let AuthService = class AuthService {
     constructor(users, tokens, twoFactor, jwt, env, mailer, rbac) {
         this.users = users;
@@ -69,6 +69,7 @@ let AuthService = class AuthService {
         return {
             status: user.twoFactorEnabled ? "TOTP_REQUIRED" : "SETUP_REQUIRED",
             pendingToken,
+            expiresInSeconds: this.pendingExpiresIn(pendingToken),
         };
     }
     async setupTotp(pendingToken) {
@@ -77,6 +78,12 @@ let AuthService = class AuthService {
             throw new common_1.BadRequestException("2FA já está configurado para esta conta");
         }
         const user = await this.users.findById(payload.sub);
+        const pendingSecret = !user.twoFactorEnabled
+            ? user.twoFactorSecret
+            : null;
+        if (pendingSecret) {
+            return this.twoFactor.rebuildSetup(user.email, pendingSecret);
+        }
         const setup = await this.twoFactor.generateSetup(user.email);
         user.twoFactorSecret = this.twoFactor.encrypt(setup.secret);
         await this.users.save(user);
@@ -208,6 +215,7 @@ let AuthService = class AuthService {
         if (!consumed) {
             throw invalidToken();
         }
+        (0, auditContext_1.setAuditUser)(consumed.userId);
         await this.users.resetPassword(consumed.userId, newPassword);
         await this.tokens.revokeAllRefresh(consumed.userId);
     }
@@ -220,9 +228,16 @@ let AuthService = class AuthService {
         };
         return this.jwt.signAsync(payload, {
             secret: this.env.get("JWT_PENDING_SECRET"),
-            expiresIn: PENDING_EXPIRES,
+            expiresIn: this.env.get("JWT_PENDING_EXPIRES"),
         });
     }
+    pendingExpiresIn(token) {
+        const decoded = this.jwt.decode(token);
+        if (!decoded?.exp) {
+            return 0;
+        }
+        return Math.max(0, decoded.exp - Math.floor(Date.now() / 1000));
+    }
     async decodePending(token) {
         try {
             const payload = await this.jwt.verifyAsync(token, {
@@ -233,8 +248,11 @@ let AuthService = class AuthService {
             }
             return payload;
         }
-        catch {
-            throw new common_1.UnauthorizedException("Token de verificação inválido ou expirado");
+        catch (err) {
+            if (err?.name === "TokenExpiredError") {
+                throw (0, codedError_util_1.codedUnauthorized)("A verificação expirou. Entre novamente para continuar", appErrorCode_enum_1.AppErrorCode.PENDING_TOKEN_EXPIRED);
+            }
+            throw new common_1.UnauthorizedException("Token de verificação inválido");
         }
     }
     signAccessToken(user) {

package/dist/features/auth/domain/twoFactor.service.d.ts

@@ -9,7 +9,9 @@ export declare class TwoFactorService {
     private readonly logger;
     constructor(env: EnvService);
     generateSetup(accountEmail: string): Promise<TotpSetup>;
+    private buildSetup;
     encrypt(secret: string): string;
+    rebuildSetup(accountEmail: string, storedSecret: string): Promise<TotpSetup>;
     verifyTotp(code: string, storedSecret: string): Promise<boolean>;
     generateBackupCodes(): Promise<{
         plain: string[];

package/dist/features/auth/domain/twoFactor.service.js

@@ -55,8 +55,10 @@ let TwoFactorService = TwoFactorService_1 = class TwoFactorService {
         this.env = env;
         this.logger = new common_1.Logger(TwoFactorService_1.name);
     }
-    async generateSetup(accountEmail) {
-        const secret = (0, otplib_1.generateSecret)();
+    generateSetup(accountEmail) {
+        return this.buildSetup(accountEmail, (0, otplib_1.generateSecret)());
+    }
+    async buildSetup(accountEmail, secret) {
         const issuer = this.env.brand().totpIssuer;
         const otpauthUrl = (0, otplib_1.generateURI)({ issuer, label: accountEmail, secret });
         const qrDataUrl = await QRCode.toDataURL(otpauthUrl);
@@ -65,6 +67,9 @@ let TwoFactorService = TwoFactorService_1 = class TwoFactorService {
     encrypt(secret) {
         return (0, crypto_util_1.encryptSecret)(secret);
     }
+    rebuildSetup(accountEmail, storedSecret) {
+        return this.buildSetup(accountEmail, (0, crypto_util_1.decryptSecret)(storedSecret));
+    }
     async verifyTotp(code, storedSecret) {
         if (!storedSecret) {
             return false;

package/dist/features/auth/infra/schema/authToken.schema.d.ts

@@ -1,10 +1,10 @@
 import { BaseEntity } from "../../../../core/database/base.schema";
 export declare enum TokenType {
-    PASSWORD_RESET = "password_reset",
-    FIRST_ACCESS = "first_access",
-    TWO_FACTOR_EMAIL = "two_factor_email",
-    REFRESH_TOKEN = "refresh_token",
-    TOTP_USED = "totp_used"
+    PASSWORD_RESET = 0,
+    FIRST_ACCESS = 1,
+    TWO_FACTOR_EMAIL = 2,
+    REFRESH_TOKEN = 3,
+    TOTP_USED = 4
 }
 export declare class AuthToken extends BaseEntity {
     userId: string;

package/dist/features/auth/infra/schema/authToken.schema.js

@@ -14,11 +14,11 @@ const typeorm_1 = require("typeorm");
 const base_schema_1 = require("../../../../core/database/base.schema");
 var TokenType;
 (function (TokenType) {
-    TokenType["PASSWORD_RESET"] = "password_reset";
-    TokenType["FIRST_ACCESS"] = "first_access";
-    TokenType["TWO_FACTOR_EMAIL"] = "two_factor_email";
-    TokenType["REFRESH_TOKEN"] = "refresh_token";
-    TokenType["TOTP_USED"] = "totp_used";
+    TokenType[TokenType["PASSWORD_RESET"] = 0] = "PASSWORD_RESET";
+    TokenType[TokenType["FIRST_ACCESS"] = 1] = "FIRST_ACCESS";
+    TokenType[TokenType["TWO_FACTOR_EMAIL"] = 2] = "TWO_FACTOR_EMAIL";
+    TokenType[TokenType["REFRESH_TOKEN"] = 3] = "REFRESH_TOKEN";
+    TokenType[TokenType["TOTP_USED"] = 4] = "TOTP_USED";
 })(TokenType || (exports.TokenType = TokenType = {}));
 let AuthToken = class AuthToken extends base_schema_1.BaseEntity {
     isExpired() {
@@ -38,8 +38,8 @@ __decorate([
     __metadata("design:type", String)
 ], AuthToken.prototype, "tokenHash", void 0);
 __decorate([
-    (0, typeorm_1.Column)({ type: "enum", enum: TokenType }),
-    __metadata("design:type", String)
+    (0, typeorm_1.Column)({ type: "tinyint", unsigned: true }),
+    __metadata("design:type", Number)
 ], AuthToken.prototype, "type", void 0);
 __decorate([
     (0, typeorm_1.Column)({ name: "family", type: "char", length: 36, nullable: true }),

package/dist/features/auth/presentation/auth.controller.d.ts

@@ -4,7 +4,7 @@ import { EnvService } from "../../../core/config/env.service";
 import { AuthService } from "../domain/auth.service";
 import { PasswordTokenCheck } from "../domain/auth.service";
 import { SessionUser } from "../domain/auth.service";
-import { LoginStatus } from "../domain/auth.service";
+import { LoginChallenge } from "../domain/auth.service";
 import { TotpSetup } from "../domain/twoFactor.service";
 import { LoginCommand } from "./commands/login.command";
 import { ForgotPasswordCommand, ResetPasswordCommand } from "./commands/password.command";
@@ -25,10 +25,7 @@ export declare class AuthController {
     private readonly auth;
     private readonly env;
     constructor(auth: AuthService, env: EnvService);
-    login(dto: LoginCommand): Promise<{
-        status: LoginStatus;
-        pendingToken: string;
-    }>;
+    login(dto: LoginCommand): Promise<LoginChallenge>;
     setupTotp(dto: PendingTokenCommand): Promise<TotpSetup>;
     requestEmailCode(dto: PendingTokenCommand): Promise<{
         sent: boolean;

package/dist/features/auth/presentation/auth.controller.js

@@ -21,7 +21,9 @@ const currentUser_decorator_1 = require("../../../core/auth/decorators/currentUs
 const public_decorator_1 = require("../../../core/auth/decorators/public.decorator");
 const jwtAuth_guard_1 = require("../../../core/auth/guards/jwtAuth.guard");
 const env_service_1 = require("../../../core/config/env.service");
+const requestLog_context_1 = require("../../../core/context/requestLog.context");
 const ip_util_1 = require("../../../core/utils/ip.util");
+const auditable_decorator_1 = require("../../audit/presentation/decorators/auditable.decorator");
 const auth_service_1 = require("../domain/auth.service");
 const clientType_enum_1 = require("./commands/clientType.enum");
 const login_command_1 = require("./commands/login.command");
@@ -51,6 +53,7 @@ let AuthController = class AuthController {
     }
     async verify(dto, req, res) {
         const { accessToken, refreshToken, user, backupCodes } = await this.auth.verifyTwoFactor(dto, ctxFrom(req));
+        (0, requestLog_context_1.setRequestLogUser)(req, user.id);
         if (dto.client === clientType_enum_1.ClientType.MOBILE) {
             return { user, backupCodes, accessToken, refreshToken };
         }
@@ -99,6 +102,7 @@ exports.AuthController = AuthController;
 __decorate([
     (0, public_decorator_1.Public)(),
     (0, throttler_1.Throttle)({ default: { limit: 10, ttl: 60_000 } }),
+    (0, auditable_decorator_1.Auditable)("Login"),
     (0, common_1.Post)("login"),
     (0, swagger_1.ApiOperation)({ summary: "Login (passo 1): valida email+senha e exige 2FA" }),
     __param(0, (0, common_1.Body)()),
@@ -108,6 +112,7 @@ __decorate([
 ], AuthController.prototype, "login", null);
 __decorate([
     (0, public_decorator_1.Public)(),
+    (0, auditable_decorator_1.Auditable)("Configuração de 2FA"),
     (0, common_1.Post)("2fa/setup"),
     (0, swagger_1.ApiOperation)({ summary: "Gera segredo/QR TOTP no primeiro acesso" }),
     __param(0, (0, common_1.Body)()),
@@ -118,6 +123,7 @@ __decorate([
 __decorate([
     (0, public_decorator_1.Public)(),
     (0, throttler_1.Throttle)({ default: { limit: 5, ttl: 60_000 } }),
+    (0, auditable_decorator_1.Auditable)("E-mail: código de verificação", { allowSystem: true }),
     (0, common_1.Post)("2fa/email"),
     (0, swagger_1.ApiOperation)({ summary: "Fallback: envia código 2FA por email" }),
     __param(0, (0, common_1.Body)()),
@@ -128,6 +134,7 @@ __decorate([
 __decorate([
     (0, public_decorator_1.Public)(),
     (0, throttler_1.Throttle)({ default: { limit: 10, ttl: 60_000 } }),
+    (0, auditable_decorator_1.Auditable)("Verificação de 2FA"),
     (0, common_1.Post)("2fa/verify"),
     (0, swagger_1.ApiOperation)({
         summary: "Login (passo 2): valida código 2FA e emite tokens",
@@ -153,6 +160,7 @@ __decorate([
 ], AuthController.prototype, "refresh", null);
 __decorate([
     (0, public_decorator_1.Public)(),
+    (0, auditable_decorator_1.Auditable)("Logout"),
     (0, common_1.Post)("logout"),
     (0, common_1.HttpCode)(200),
     (0, swagger_1.ApiOperation)({
@@ -191,6 +199,7 @@ __decorate([
 __decorate([
     (0, common_1.UseGuards)(jwtAuth_guard_1.JwtAuthGuard),
     (0, swagger_1.ApiBearerAuth)(),
+    (0, auditable_decorator_1.Auditable)("Regeneração de códigos de backup"),
     (0, common_1.Post)("2fa/backup/regenerate"),
     (0, swagger_1.ApiOperation)({
         summary: "Regenera os códigos de backup (confirma com código TOTP)",
@@ -204,6 +213,7 @@ __decorate([
 __decorate([
     (0, public_decorator_1.Public)(),
     (0, throttler_1.Throttle)({ default: { limit: 5, ttl: 60_000 } }),
+    (0, auditable_decorator_1.Auditable)("E-mail: redefinição de senha", { allowSystem: true }),
     (0, common_1.Post)("forgot-password"),
     (0, common_1.HttpCode)(200),
     (0, swagger_1.ApiOperation)({ summary: "Solicita email de redefinição de senha" }),
@@ -226,6 +236,7 @@ __decorate([
 ], AuthController.prototype, "inspectPasswordToken", null);
 __decorate([
     (0, public_decorator_1.Public)(),
+    (0, auditable_decorator_1.Auditable)("Redefinição de senha"),
     (0, common_1.Post)("reset-password"),
     (0, common_1.HttpCode)(200),
     (0, swagger_1.ApiOperation)({ summary: "Redefine a senha usando o token do email" }),

package/dist/features/maintenance/domain/cleanup.service.d.ts

@@ -1,20 +1,17 @@
 import { EventEmitter2 } from "@nestjs/event-emitter";
 import { EnvService } from "../../../core/config/env.service";
-import { AuditService } from "../../audit/domain/audit.service";
 import { TokenService } from "../../auth/domain/token.service";
 import { NotificationsService } from "../../notifications/domain/notifications.service";
 import { UserRepository } from "../../users/infra/repositories/user.repository";
 export declare class CleanupService {
     private readonly tokens;
-    private readonly audit;
     private readonly env;
     private readonly notifications;
     private readonly users;
     private readonly events;
     private readonly logger;
-    constructor(tokens: TokenService, audit: AuditService, env: EnvService, notifications: NotificationsService, users: UserRepository, events: EventEmitter2);
+    constructor(tokens: TokenService, env: EnvService, notifications: NotificationsService, users: UserRepository, events: EventEmitter2);
     handleTokenCleanup(): Promise<void>;
-    handleAuditLogCleanup(): Promise<void>;
     handleNotificationCleanup(): Promise<void>;
     handlePasswordExpiryWarning(): Promise<void>;
     private daysUntilExpiry;

package/dist/features/maintenance/domain/cleanup.service.js

@@ -16,15 +16,13 @@ const event_emitter_1 = require("@nestjs/event-emitter");
 const schedule_1 = require("@nestjs/schedule");
 const env_service_1 = require("../../../core/config/env.service");
 const appEvent_enum_1 = require("../../../core/events/appEvent.enum");
-const audit_service_1 = require("../../audit/domain/audit.service");
 const token_service_1 = require("../../auth/domain/token.service");
 const notifications_service_1 = require("../../notifications/domain/notifications.service");
 const user_repository_1 = require("../../users/infra/repositories/user.repository");
 const PASSWORD_WARNING_MILESTONES = [7, 3, 1];
 let CleanupService = CleanupService_1 = class CleanupService {
-    constructor(tokens, audit, env, notifications, users, events) {
+    constructor(tokens, env, notifications, users, events) {
         this.tokens = tokens;
-        this.audit = audit;
         this.env = env;
         this.notifications = notifications;
         this.users = users;
@@ -39,20 +37,6 @@ let CleanupService = CleanupService_1 = class CleanupService {
             }
         });
     }
-    async handleAuditLogCleanup() {
-        await this.run("Limpeza de logs operacionais", async () => {
-            const retentionDays = this.env.get("AUDIT_LOG_RETENTION_DAYS");
-            const { changes, errors } = await this.audit.cleanupOldLogs(retentionDays);
-            if (changes > 0 || errors > 0) {
-                this.logger.log(`Logs operacionais removidos (> ${retentionDays}d): ${changes} requisições, ${errors} erros`);
-            }
-            const dataRetentionDays = this.env.get("AUDIT_DATA_RETENTION_DAYS");
-            const dataChanges = await this.audit.cleanupOldDataChanges(dataRetentionDays);
-            if (dataChanges > 0) {
-                this.logger.log(`Trilha de dados removida (> ${dataRetentionDays}d): ${dataChanges} registros`);
-            }
-        });
-    }
     async handleNotificationCleanup() {
         await this.run("Limpeza de notificações", async () => {
             const retentionDays = this.env.get("NOTIFICATION_RETENTION_DAYS");
@@ -112,14 +96,6 @@ __decorate([
     __metadata("design:paramtypes", []),
     __metadata("design:returntype", Promise)
 ], CleanupService.prototype, "handleTokenCleanup", null);
-__decorate([
-    (0, schedule_1.Cron)(process.env.AUDIT_LOG_CLEANUP_CRON ?? "0 3 * * *", {
-        name: "audit-log-cleanup",
-    }),
-    __metadata("design:type", Function),
-    __metadata("design:paramtypes", []),
-    __metadata("design:returntype", Promise)
-], CleanupService.prototype, "handleAuditLogCleanup", null);
 __decorate([
     (0, schedule_1.Cron)(process.env.NOTIFICATION_CLEANUP_CRON ?? "0 4 * * *", {
         name: "notification-cleanup",
@@ -139,7 +115,6 @@ __decorate([
 exports.CleanupService = CleanupService = CleanupService_1 = __decorate([
     (0, common_1.Injectable)(),
     __metadata("design:paramtypes", [token_service_1.TokenService,
-        audit_service_1.AuditService,
         env_service_1.EnvService,
         notifications_service_1.NotificationsService,
         user_repository_1.UserRepository,