rl-core-api 0.3.0 → 0.5.0

package/dist/features/maintenance/maintenance.module.js

@@ -8,7 +8,6 @@ var __decorate = (this && this.__decorate) || function (decorators, target, key,
 Object.defineProperty(exports, "__esModule", { value: true });
 exports.MaintenanceModule = void 0;
 const common_1 = require("@nestjs/common");
-const audit_module_1 = require("../audit/audit.module");
 const auth_module_1 = require("../auth/auth.module");
 const cleanup_service_1 = require("./domain/cleanup.service");
 const notifications_module_1 = require("../notifications/notifications.module");
@@ -18,7 +17,7 @@ let MaintenanceModule = class MaintenanceModule {
 exports.MaintenanceModule = MaintenanceModule;
 exports.MaintenanceModule = MaintenanceModule = __decorate([
     (0, common_1.Module)({
-        imports: [auth_module_1.AuthModule, audit_module_1.AuditModule, notifications_module_1.NotificationsModule, users_module_1.UsersModule],
+        imports: [auth_module_1.AuthModule, notifications_module_1.NotificationsModule, users_module_1.UsersModule],
         providers: [cleanup_service_1.CleanupService],
     })
 ], MaintenanceModule);

package/dist/features/notifications/domain/enums/channelType.enum.d.ts

@@ -1,7 +1,7 @@
 export declare enum ChannelType {
-    IN_APP = "IN_APP",
-    EMAIL = "EMAIL",
-    PUSH = "PUSH",
-    SMS = "SMS",
-    WHATSAPP = "WHATSAPP"
+    IN_APP = 0,
+    EMAIL = 1,
+    PUSH = 2,
+    SMS = 3,
+    WHATSAPP = 4
 }

package/dist/features/notifications/domain/enums/channelType.enum.js

@@ -3,9 +3,9 @@ Object.defineProperty(exports, "__esModule", { value: true });
 exports.ChannelType = void 0;
 var ChannelType;
 (function (ChannelType) {
-    ChannelType["IN_APP"] = "IN_APP";
-    ChannelType["EMAIL"] = "EMAIL";
-    ChannelType["PUSH"] = "PUSH";
-    ChannelType["SMS"] = "SMS";
-    ChannelType["WHATSAPP"] = "WHATSAPP";
+    ChannelType[ChannelType["IN_APP"] = 0] = "IN_APP";
+    ChannelType[ChannelType["EMAIL"] = 1] = "EMAIL";
+    ChannelType[ChannelType["PUSH"] = 2] = "PUSH";
+    ChannelType[ChannelType["SMS"] = 3] = "SMS";
+    ChannelType[ChannelType["WHATSAPP"] = 4] = "WHATSAPP";
 })(ChannelType || (exports.ChannelType = ChannelType = {}));

package/dist/features/notifications/domain/enums/deliveryStatus.enum.d.ts

@@ -1,8 +1,8 @@
 export declare enum DeliveryStatus {
-    PENDING = "PENDING",
-    QUEUED = "QUEUED",
-    SENT = "SENT",
-    DELIVERED = "DELIVERED",
-    FAILED = "FAILED",
-    CANCELLED = "CANCELLED"
+    PENDING = 0,
+    QUEUED = 1,
+    SENT = 2,
+    DELIVERED = 3,
+    FAILED = 4,
+    CANCELLED = 5
 }

package/dist/features/notifications/domain/enums/deliveryStatus.enum.js

@@ -3,10 +3,10 @@ Object.defineProperty(exports, "__esModule", { value: true });
 exports.DeliveryStatus = void 0;
 var DeliveryStatus;
 (function (DeliveryStatus) {
-    DeliveryStatus["PENDING"] = "PENDING";
-    DeliveryStatus["QUEUED"] = "QUEUED";
-    DeliveryStatus["SENT"] = "SENT";
-    DeliveryStatus["DELIVERED"] = "DELIVERED";
-    DeliveryStatus["FAILED"] = "FAILED";
-    DeliveryStatus["CANCELLED"] = "CANCELLED";
+    DeliveryStatus[DeliveryStatus["PENDING"] = 0] = "PENDING";
+    DeliveryStatus[DeliveryStatus["QUEUED"] = 1] = "QUEUED";
+    DeliveryStatus[DeliveryStatus["SENT"] = 2] = "SENT";
+    DeliveryStatus[DeliveryStatus["DELIVERED"] = 3] = "DELIVERED";
+    DeliveryStatus[DeliveryStatus["FAILED"] = 4] = "FAILED";
+    DeliveryStatus[DeliveryStatus["CANCELLED"] = 5] = "CANCELLED";
 })(DeliveryStatus || (exports.DeliveryStatus = DeliveryStatus = {}));

package/dist/features/notifications/domain/enums/notificationType.enum.d.ts

@@ -1,6 +1,6 @@
 export declare enum NotificationType {
-    INFO = "INFO",
-    SUCCESS = "SUCCESS",
-    WARNING = "WARNING",
-    ERROR = "ERROR"
+    INFO = 0,
+    SUCCESS = 1,
+    WARNING = 2,
+    ERROR = 3
 }

package/dist/features/notifications/domain/enums/notificationType.enum.js

@@ -3,8 +3,8 @@ Object.defineProperty(exports, "__esModule", { value: true });
 exports.NotificationType = void 0;
 var NotificationType;
 (function (NotificationType) {
-    NotificationType["INFO"] = "INFO";
-    NotificationType["SUCCESS"] = "SUCCESS";
-    NotificationType["WARNING"] = "WARNING";
-    NotificationType["ERROR"] = "ERROR";
+    NotificationType[NotificationType["INFO"] = 0] = "INFO";
+    NotificationType[NotificationType["SUCCESS"] = 1] = "SUCCESS";
+    NotificationType[NotificationType["WARNING"] = 2] = "WARNING";
+    NotificationType[NotificationType["ERROR"] = 3] = "ERROR";
 })(NotificationType || (exports.NotificationType = NotificationType = {}));

package/dist/features/notifications/domain/enums/scopeType.enum.d.ts

@@ -1,5 +1,5 @@
 export declare enum ScopeType {
-    USER = "USER",
-    ROLE = "ROLE",
-    ALL = "ALL"
+    USER = 0,
+    ROLE = 1,
+    ALL = 2
 }

package/dist/features/notifications/domain/enums/scopeType.enum.js

@@ -3,7 +3,7 @@ Object.defineProperty(exports, "__esModule", { value: true });
 exports.ScopeType = void 0;
 var ScopeType;
 (function (ScopeType) {
-    ScopeType["USER"] = "USER";
-    ScopeType["ROLE"] = "ROLE";
-    ScopeType["ALL"] = "ALL";
+    ScopeType[ScopeType["USER"] = 0] = "USER";
+    ScopeType[ScopeType["ROLE"] = 1] = "ROLE";
+    ScopeType[ScopeType["ALL"] = 2] = "ALL";
 })(ScopeType || (exports.ScopeType = ScopeType = {}));

package/dist/features/notifications/infra/schema/notification.schema.js

@@ -31,8 +31,8 @@ __decorate([
     __metadata("design:type", Object)
 ], Notification.prototype, "payload", void 0);
 __decorate([
-    (0, typeorm_1.Column)({ type: "enum", enum: notificationType_enum_1.NotificationType }),
-    __metadata("design:type", String)
+    (0, typeorm_1.Column)({ type: "tinyint", unsigned: true }),
+    __metadata("design:type", Number)
 ], Notification.prototype, "type", void 0);
 __decorate([
     (0, typeorm_1.Column)({ name: "created_by", type: "char", length: 36, nullable: true }),

package/dist/features/notifications/infra/schema/notificationScope.schema.js

@@ -22,8 +22,8 @@ __decorate([
     __metadata("design:type", String)
 ], NotificationScope.prototype, "notificationId", void 0);
 __decorate([
-    (0, typeorm_1.Column)({ name: "scope_type", type: "enum", enum: scopeType_enum_1.ScopeType }),
-    __metadata("design:type", String)
+    (0, typeorm_1.Column)({ name: "scope_type", type: "tinyint", unsigned: true }),
+    __metadata("design:type", Number)
 ], NotificationScope.prototype, "scopeType", void 0);
 __decorate([
     (0, typeorm_1.Column)({ name: "scope_key", type: "varchar", length: 100, nullable: true }),

package/dist/features/notifications/presentation/commands/createNotification.command.js

@@ -21,7 +21,7 @@ exports.NotificationTargetCommand = NotificationTargetCommand;
 __decorate([
     (0, swagger_1.ApiProperty)({ enum: scopeType_enum_1.ScopeType, enumName: "ScopeType" }),
     (0, class_validator_1.IsEnum)(scopeType_enum_1.ScopeType),
-    __metadata("design:type", String)
+    __metadata("design:type", Number)
 ], NotificationTargetCommand.prototype, "type", void 0);
 __decorate([
     (0, swagger_1.ApiProperty)({
@@ -50,7 +50,7 @@ __decorate([
 __decorate([
     (0, swagger_1.ApiProperty)({ enum: notificationType_enum_1.NotificationType, enumName: "NotificationType" }),
     (0, class_validator_1.IsEnum)(notificationType_enum_1.NotificationType),
-    __metadata("design:type", String)
+    __metadata("design:type", Number)
 ], CreateNotificationCommand.prototype, "type", void 0);
 __decorate([
     (0, swagger_1.ApiProperty)({ type: [NotificationTargetCommand] }),

package/dist/features/notifications/presentation/domainEvents.listener.d.ts

@@ -1,11 +1,14 @@
-import { SystemCleanupFailedEvent, UserLockedEvent, UserPasswordExpiringEvent, UserPasswordResetRequestedEvent, UserTwoFactorResetEvent } from "../../../core/events/appEvent.enum";
+import { SystemCleanupFailedEvent, UserLockedEvent, UserPasswordExpiringEvent, UserPasswordResetRequestedEvent, UserRolesChangedEvent, UserTwoFactorResetEvent } from "../../../core/events/appEvent.enum";
+import { NotificationsGateway } from "./notifications.gateway";
 import { NotificationsPublisher } from "./notifications.publisher";
 export declare class DomainEventsListener {
     private readonly publisher;
+    private readonly gateway;
     private readonly logger;
-    constructor(publisher: NotificationsPublisher);
+    constructor(publisher: NotificationsPublisher, gateway: NotificationsGateway);
     onUserLocked(event: UserLockedEvent): Promise<void>;
     onTwoFactorReset(event: UserTwoFactorResetEvent): Promise<void>;
+    onRolesChanged(event: UserRolesChangedEvent): Promise<void>;
     onPasswordResetRequested(event: UserPasswordResetRequestedEvent): Promise<void>;
     onPasswordExpiring(event: UserPasswordExpiringEvent): Promise<void>;
     onCleanupFailed(event: SystemCleanupFailedEvent): Promise<void>;

package/dist/features/notifications/presentation/domainEvents.listener.js

@@ -16,11 +16,13 @@ const event_emitter_1 = require("@nestjs/event-emitter");
 const appEvent_enum_1 = require("../../../core/events/appEvent.enum");
 const notificationType_enum_1 = require("../domain/enums/notificationType.enum");
 const scopeType_enum_1 = require("../domain/enums/scopeType.enum");
+const notifications_gateway_1 = require("./notifications.gateway");
 const notifications_publisher_1 = require("./notifications.publisher");
 const ADMIN_ROLE = "Super Admin";
 let DomainEventsListener = DomainEventsListener_1 = class DomainEventsListener {
-    constructor(publisher) {
+    constructor(publisher, gateway) {
         this.publisher = publisher;
+        this.gateway = gateway;
         this.logger = new common_1.Logger(DomainEventsListener_1.name);
     }
     async onUserLocked(event) {
@@ -48,6 +50,19 @@ let DomainEventsListener = DomainEventsListener_1 = class DomainEventsListener {
             targets: [{ type: scopeType_enum_1.ScopeType.USER, key: event.userId }],
         }));
     }
+    async onRolesChanged(event) {
+        await this.safePublish(appEvent_enum_1.AppEvent.USER_ROLES_CHANGED, async () => {
+            await this.publisher.publishAndPush({
+                title: "Suas permissões foram atualizadas",
+                body: event.roleNames.length
+                    ? `Um administrador alterou seus papéis de acesso. Agora você é: ${event.roleNames.join(", ")}.`
+                    : "Um administrador removeu seus papéis de acesso. Parte do sistema deixa de aparecer para você.",
+                type: notificationType_enum_1.NotificationType.INFO,
+                targets: [{ type: scopeType_enum_1.ScopeType.USER, key: event.userId }],
+            });
+            this.gateway.requestSessionRefresh(event.userId);
+        });
+    }
     async onPasswordResetRequested(event) {
         await this.safePublish(appEvent_enum_1.AppEvent.USER_PASSWORD_RESET_REQUESTED, () => this.publisher.publishAndPush({
             title: "Redefinição de senha solicitada",
@@ -97,6 +112,12 @@ __decorate([
     __metadata("design:paramtypes", [Object]),
     __metadata("design:returntype", Promise)
 ], DomainEventsListener.prototype, "onTwoFactorReset", null);
+__decorate([
+    (0, event_emitter_1.OnEvent)(appEvent_enum_1.AppEvent.USER_ROLES_CHANGED),
+    __metadata("design:type", Function),
+    __metadata("design:paramtypes", [Object]),
+    __metadata("design:returntype", Promise)
+], DomainEventsListener.prototype, "onRolesChanged", null);
 __decorate([
     (0, event_emitter_1.OnEvent)(appEvent_enum_1.AppEvent.USER_PASSWORD_RESET_REQUESTED),
     __metadata("design:type", Function),
@@ -117,5 +138,6 @@ __decorate([
 ], DomainEventsListener.prototype, "onCleanupFailed", null);
 exports.DomainEventsListener = DomainEventsListener = DomainEventsListener_1 = __decorate([
     (0, common_1.Injectable)(),
-    __metadata("design:paramtypes", [notifications_publisher_1.NotificationsPublisher])
+    __metadata("design:paramtypes", [notifications_publisher_1.NotificationsPublisher,
+        notifications_gateway_1.NotificationsGateway])
 ], DomainEventsListener);

package/dist/features/notifications/presentation/responses/notification.response.js

@@ -32,7 +32,7 @@ __decorate([
 ], UserNotificationResponse.prototype, "body", void 0);
 __decorate([
     (0, swagger_1.ApiProperty)({ enum: notificationType_enum_1.NotificationType, enumName: "NotificationType" }),
-    __metadata("design:type", String)
+    __metadata("design:type", Number)
 ], UserNotificationResponse.prototype, "type", void 0);
 __decorate([
     (0, swagger_1.ApiProperty)({

package/dist/features/rbac/domain/rbac.catalog.js

@@ -62,6 +62,30 @@ exports.PERMISSIONS = [
         code: "users:invite:any",
         description: "Enviar link de primeiro acesso a qualquer usuário",
     },
+    {
+        code: "users:read:team",
+        description: "Ler usuários da própria equipe",
+    },
+    {
+        code: "users:create:team",
+        description: "Criar usuário dentro da própria equipe",
+    },
+    {
+        code: "users:update:team",
+        description: "Atualizar usuários da própria equipe",
+    },
+    {
+        code: "users:invite:team",
+        description: "Enviar link de primeiro acesso a usuários da própria equipe",
+    },
+    {
+        code: "users:reset-password:team",
+        description: "Resetar senha e 2FA de usuários da própria equipe",
+    },
+    {
+        code: "users:deactivate:team",
+        description: "Ativar/desativar usuários da própria equipe",
+    },
     { code: "roles:create:any", description: "Criar papéis" },
     { code: "roles:read:any", description: "Ler papéis" },
     { code: "roles:update:any", description: "Atualizar papéis" },
@@ -132,9 +156,14 @@ exports.ROLES = [
     },
     {
         name: "Manager",
-        description: "Gestor de departamento",
+        description: "Gestor de equipe — administra quem está na árvore dele",
         permissions: [
-            "users:read:any",
+            "users:read:team",
+            "users:create:team",
+            "users:update:team",
+            "users:invite:team",
+            "users:reset-password:team",
+            "users:deactivate:team",
             "reports:read:department",
             "reports:read:any",
             "audit:read:any",

package/dist/features/rbac/domain/rbac.service.d.ts

@@ -59,6 +59,7 @@ export declare class RbacService {
     addPermissionToRole(roleId: string, permissionId: string, actorPermissions?: string[]): Promise<Role>;
     removePermissionFromRole(roleId: string, permissionId: string): Promise<Role>;
     listGroups(): Promise<Group[]>;
+    listManagedGroups(managerId: string): Promise<Group[]>;
     getGroup(id: string): Promise<Group>;
     createGroup(dto: CreateGroupCommand): Promise<Group>;
     updateGroup(id: string, dto: UpdateGroupCommand): Promise<Group>;

package/dist/features/rbac/domain/rbac.service.js

@@ -348,6 +348,16 @@ let RbacService = class RbacService {
             order: { name: "ASC" },
         });
     }
+    async listManagedGroups(managerId) {
+        const ids = await this.groupRepo.findManagedGroupIds(managerId);
+        if (ids.length === 0) {
+            return [];
+        }
+        return this.groupRepo.find({
+            where: { id: (0, typeorm_1.In)(ids) },
+            order: { name: "ASC" },
+        });
+    }
     async getGroup(id) {
         const group = await this.groupRepo.findOne({
             where: { id },
@@ -367,6 +377,7 @@ let RbacService = class RbacService {
             description: dto.description,
             type: dto.type ?? "team",
             parentId: dto.parentId ?? null,
+            managerId: dto.managerId ?? null,
             roles,
         });
         return this.groupRepo.save(group);
@@ -385,6 +396,9 @@ let RbacService = class RbacService {
         if (dto.parentId !== undefined) {
             group.parentId = dto.parentId;
         }
+        if (dto.managerId !== undefined) {
+            group.managerId = dto.managerId;
+        }
         if (dto.isActive !== undefined) {
             group.isActive = dto.isActive;
         }

package/dist/features/rbac/domain/teamScope.service.d.ts

@@ -0,0 +1,15 @@
+import { Actor } from "../../../core/auth/actor.interface";
+import { RbacService } from "./rbac.service";
+import { GroupRepository } from "../infra/repositories/group.repository";
+export declare class TeamScopeService {
+    private readonly groupRepo;
+    private readonly rbac;
+    constructor(groupRepo: GroupRepository, rbac: RbacService);
+    reachableUserIds(actor: Actor, action: string): Promise<string[] | null>;
+    managedGroupIds(managerId: string): Promise<string[]>;
+    private reachOf;
+    assertCanAct(actor: Actor, targetUserId: string, action: string): Promise<void>;
+    private assertActorOutranks;
+    assertOwnsGroups(actor: Actor, groupIds: string[]): Promise<void>;
+    private has;
+}

package/dist/features/rbac/domain/teamScope.service.js

@@ -0,0 +1,74 @@
+"use strict";
+var __decorate = (this && this.__decorate) || function (decorators, target, key, desc) {
+    var c = arguments.length, r = c < 3 ? target : desc === null ? desc = Object.getOwnPropertyDescriptor(target, key) : desc, d;
+    if (typeof Reflect === "object" && typeof Reflect.decorate === "function") r = Reflect.decorate(decorators, target, key, desc);
+    else for (var i = decorators.length - 1; i >= 0; i--) if (d = decorators[i]) r = (c < 3 ? d(r) : c > 3 ? d(target, key, r) : d(target, key)) || r;
+    return c > 3 && r && Object.defineProperty(target, key, r), r;
+};
+var __metadata = (this && this.__metadata) || function (k, v) {
+    if (typeof Reflect === "object" && typeof Reflect.metadata === "function") return Reflect.metadata(k, v);
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.TeamScopeService = void 0;
+const common_1 = require("@nestjs/common");
+const permissionScope_util_1 = require("../../../core/auth/permissionScope.util");
+const rbac_service_1 = require("./rbac.service");
+const group_repository_1 = require("../infra/repositories/group.repository");
+let TeamScopeService = class TeamScopeService {
+    constructor(groupRepo, rbac) {
+        this.groupRepo = groupRepo;
+        this.rbac = rbac;
+    }
+    async reachableUserIds(actor, action) {
+        if (this.has(actor, action, permissionScope_util_1.SCOPE_ANY)) {
+            return null;
+        }
+        if (!this.has(actor, action, permissionScope_util_1.SCOPE_TEAM)) {
+            return [];
+        }
+        const reach = await this.reachOf(actor.id);
+        return reach.userIds;
+    }
+    async managedGroupIds(managerId) {
+        return this.groupRepo.findManagedGroupIds(managerId);
+    }
+    async reachOf(managerId) {
+        const groupIds = await this.groupRepo.findManagedGroupIds(managerId);
+        const userIds = await this.groupRepo.findMemberIds(groupIds);
+        return { groupIds, userIds };
+    }
+    async assertCanAct(actor, targetUserId, action) {
+        const reach = await this.reachableUserIds(actor, action);
+        if (reach === null) {
+            return;
+        }
+        if (!reach.includes(targetUserId)) {
+            throw new common_1.ForbiddenException("Este usuário não faz parte da sua equipe");
+        }
+        await this.assertActorOutranks(actor, targetUserId);
+    }
+    async assertActorOutranks(actor, targetUserId) {
+        const targetPermissions = await this.rbac.getUserPermissionCodes(targetUserId);
+        const granted = new Set(actor.permissions);
+        const excess = targetPermissions.filter((code) => !granted.has(code));
+        if (excess.length > 0) {
+            throw new common_1.ForbiddenException("Este usuário tem permissões que você não possui — só um administrador pode administrá-lo");
+        }
+    }
+    async assertOwnsGroups(actor, groupIds) {
+        const managed = new Set(await this.managedGroupIds(actor.id));
+        const foreign = groupIds.filter((id) => !managed.has(id));
+        if (foreign.length > 0) {
+            throw new common_1.ForbiddenException("Você só pode incluir usuários em grupos que gerencia");
+        }
+    }
+    has(actor, action, scope) {
+        return actor.permissions.includes(`${action}:${scope}`);
+    }
+};
+exports.TeamScopeService = TeamScopeService;
+exports.TeamScopeService = TeamScopeService = __decorate([
+    (0, common_1.Injectable)(),
+    __metadata("design:paramtypes", [group_repository_1.GroupRepository,
+        rbac_service_1.RbacService])
+], TeamScopeService);

package/dist/features/rbac/infra/repositories/group.repository.d.ts

@@ -2,4 +2,6 @@ import { DataSource, Repository } from "typeorm";
 import { Group } from "../schema/group.schema";
 export declare class GroupRepository extends Repository<Group> {
     constructor(dataSource: DataSource);
+    findManagedGroupIds(managerId: string): Promise<string[]>;
+    findMemberIds(groupIds: string[]): Promise<string[]>;
 }

package/dist/features/rbac/infra/repositories/group.repository.js

@@ -17,6 +17,32 @@ let GroupRepository = class GroupRepository extends typeorm_1.Repository {
     constructor(dataSource) {
         super(group_schema_1.Group, dataSource.createEntityManager());
     }
+    async findManagedGroupIds(managerId) {
+        const rows = await this.query(`
+      WITH RECURSIVE team AS (
+        SELECT id FROM \`groups\`
+         WHERE manager_id = ? AND is_active = 1 AND deleted_at IS NULL
+        UNION ALL
+        SELECT child.id
+          FROM \`groups\` child
+         INNER JOIN team ON child.parent_id = team.id
+         WHERE child.is_active = 1 AND child.deleted_at IS NULL
+      )
+      SELECT id FROM team
+      `, [managerId]);
+        return rows.map((row) => row.id);
+    }
+    async findMemberIds(groupIds) {
+        if (groupIds.length === 0) {
+            return [];
+        }
+        const rows = await this.query(`
+      SELECT DISTINCT ug.user_id AS id
+        FROM user_groups ug
+       WHERE ug.group_id IN (?)
+      `, [groupIds]);
+        return rows.map((row) => row.id);
+    }
 };
 exports.GroupRepository = GroupRepository;
 exports.GroupRepository = GroupRepository = __decorate([

package/dist/features/rbac/infra/schema/group.schema.d.ts

@@ -7,6 +7,7 @@ export declare class Group extends BaseEntity {
     type: GroupType;
     parentId?: string | null;
     parent?: Group | null;
+    managerId?: string | null;
     isActive: boolean;
     roles: Role[];
 }

package/dist/features/rbac/infra/schema/group.schema.js

@@ -41,6 +41,11 @@ __decorate([
     (0, typeorm_1.JoinColumn)({ name: "parent_id" }),
     __metadata("design:type", Object)
 ], Group.prototype, "parent", void 0);
+__decorate([
+    (0, swagger_1.ApiProperty)({ required: false, nullable: true }),
+    (0, typeorm_1.Column)({ name: "manager_id", type: "char", length: 36, nullable: true }),
+    __metadata("design:type", Object)
+], Group.prototype, "managerId", void 0);
 __decorate([
     (0, swagger_1.ApiProperty)(),
     (0, typeorm_1.Column)({ name: "is_active", type: "boolean", default: true }),

package/dist/features/rbac/presentation/commands/createGroup.command.d.ts

@@ -3,5 +3,6 @@ export declare class CreateGroupCommand {
     description?: string;
     type?: "company" | "department" | "team";
     parentId?: string;
+    managerId?: string | null;
     roleIds?: string[];
 }

package/dist/features/rbac/presentation/commands/createGroup.command.js

@@ -44,6 +44,13 @@ __decorate([
     (0, class_validator_1.IsUUID)(),
     __metadata("design:type", String)
 ], CreateGroupCommand.prototype, "parentId", void 0);
+__decorate([
+    (0, swagger_1.ApiProperty)({ type: String, required: false, format: "uuid", nullable: true }),
+    (0, class_validator_1.IsOptional)(),
+    (0, class_validator_1.ValidateIf)((_, value) => value !== null),
+    (0, class_validator_1.IsUUID)(),
+    __metadata("design:type", Object)
+], CreateGroupCommand.prototype, "managerId", void 0);
 __decorate([
     (0, swagger_1.ApiProperty)({ required: false, type: [String], format: "uuid" }),
     (0, class_validator_1.IsOptional)(),

package/dist/features/rbac/presentation/rbac.controller.d.ts

@@ -38,6 +38,7 @@ export declare class RbacController {
     updatePermission(id: string, dto: UpdatePermissionCommand): Promise<Permission>;
     deletePermission(id: string): Promise<void>;
     groups(): Promise<Group[]>;
+    managedGroups(actor: AuthenticatedUser): Promise<Group[]>;
     group(id: string): Promise<Group>;
     createGroup(dto: CreateGroupCommand): Promise<Group>;
     updateGroup(id: string, dto: UpdateGroupCommand): Promise<Group>;

package/dist/features/rbac/presentation/rbac.controller.js

@@ -18,6 +18,7 @@ const swagger_1 = require("@nestjs/swagger");
 const currentUser_decorator_1 = require("../../../core/auth/decorators/currentUser.decorator");
 const requirePermission_decorator_1 = require("../../../core/auth/decorators/requirePermission.decorator");
 const permissions_guard_1 = require("../../../core/auth/guards/permissions.guard");
+const auditable_decorator_1 = require("../../audit/presentation/decorators/auditable.decorator");
 const rbac_service_1 = require("../domain/rbac.service");
 const createAction_command_1 = require("./commands/createAction.command");
 const createGroup_command_1 = require("./commands/createGroup.command");
@@ -87,6 +88,9 @@ let RbacController = class RbacController {
     groups() {
         return this.rbac.listGroups();
     }
+    managedGroups(actor) {
+        return this.rbac.listManagedGroups(actor.id);
+    }
     group(id) {
         return this.rbac.getGroup(id);
     }
@@ -280,6 +284,14 @@ __decorate([
     __metadata("design:paramtypes", []),
     __metadata("design:returntype", Promise)
 ], RbacController.prototype, "groups", null);
+__decorate([
+    (0, common_1.Get)("groups/managed"),
+    (0, swagger_1.ApiOkResponse)({ type: rbac_response_1.GroupResponse, isArray: true }),
+    __param(0, (0, currentUser_decorator_1.CurrentUser)()),
+    __metadata("design:type", Function),
+    __metadata("design:paramtypes", [Object]),
+    __metadata("design:returntype", Promise)
+], RbacController.prototype, "managedGroups", null);
 __decorate([
     (0, common_1.Get)("groups/:id"),
     (0, requirePermission_decorator_1.RequirePermission)("groups:read:any"),
@@ -318,6 +330,7 @@ __decorate([
     __metadata("design:returntype", Promise)
 ], RbacController.prototype, "deleteGroup", null);
 __decorate([
+    (0, auditable_decorator_1.Auditable)("Usuário adicionado ao grupo"),
     (0, common_1.Post)("groups/:id/users/:userId"),
     (0, common_1.HttpCode)(204),
     (0, requirePermission_decorator_1.RequirePermission)("groups:update:any"),
@@ -328,6 +341,7 @@ __decorate([
     __metadata("design:returntype", Promise)
 ], RbacController.prototype, "addUserToGroup", null);
 __decorate([
+    (0, auditable_decorator_1.Auditable)("Usuário removido do grupo"),
     (0, common_1.Delete)("groups/:id/users/:userId"),
     (0, common_1.HttpCode)(204),
     (0, requirePermission_decorator_1.RequirePermission)("groups:update:any"),
@@ -384,6 +398,7 @@ __decorate([
     __metadata("design:returntype", Promise)
 ], RbacController.prototype, "deleteRole", null);
 __decorate([
+    (0, auditable_decorator_1.Auditable)("Permissão concedida ao papel"),
     (0, common_1.Post)("roles/:id/permissions/:permissionId"),
     (0, requirePermission_decorator_1.RequirePermission)("roles:update:any"),
     (0, swagger_1.ApiOkResponse)({ type: rbac_response_1.RoleResponse }),
@@ -395,6 +410,7 @@ __decorate([
     __metadata("design:returntype", Promise)
 ], RbacController.prototype, "addPermissionToRole", null);
 __decorate([
+    (0, auditable_decorator_1.Auditable)("Permissão removida do papel"),
     (0, common_1.Delete)("roles/:id/permissions/:permissionId"),
     (0, requirePermission_decorator_1.RequirePermission)("roles:update:any"),
     (0, swagger_1.ApiOkResponse)({ type: rbac_response_1.RoleResponse }),

package/dist/features/rbac/presentation/responses/rbac.response.d.ts

@@ -41,6 +41,7 @@ export declare class GroupResponse extends RbacTimestampsResponse {
     description?: string | null;
     type: string;
     parentId?: string | null;
+    managerId?: string | null;
     isActive: boolean;
     roles?: RoleResponse[];
 }

package/dist/features/rbac/presentation/responses/rbac.response.js

@@ -151,6 +151,10 @@ __decorate([
     (0, swagger_1.ApiProperty)({ type: String, required: false, nullable: true, format: "uuid" }),
     __metadata("design:type", Object)
 ], GroupResponse.prototype, "parentId", void 0);
+__decorate([
+    (0, swagger_1.ApiProperty)({ type: String, required: false, nullable: true, format: "uuid" }),
+    __metadata("design:type", Object)
+], GroupResponse.prototype, "managerId", void 0);
 __decorate([
     (0, swagger_1.ApiProperty)(),
     __metadata("design:type", Boolean)