rl-core-api 0.3.0 → 0.5.0

package/dist/features/rbac/rbac.module.js

@@ -10,6 +10,7 @@ exports.RbacModule = void 0;
 const common_1 = require("@nestjs/common");
 const typeorm_1 = require("@nestjs/typeorm");
 const domain_1 = require("./domain");
+const teamScope_service_1 = require("./domain/teamScope.service");
 const infra_1 = require("./infra");
 const presentation_1 = require("./presentation");
 const user_repository_1 = require("../users/infra/repositories/user.repository");
@@ -40,6 +41,7 @@ exports.RbacModule = RbacModule = __decorate([
             infra_1.GroupRepository,
             user_repository_1.UserRepository,
             domain_1.RbacService,
+            teamScope_service_1.TeamScopeService,
         ],
         exports: [
             infra_1.ResourceRepository,
@@ -50,6 +52,7 @@ exports.RbacModule = RbacModule = __decorate([
             infra_1.GroupRepository,
             user_repository_1.UserRepository,
             domain_1.RbacService,
+            teamScope_service_1.TeamScopeService,
         ],
     })
 ], RbacModule);

package/dist/features/users/domain/users.service.d.ts

@@ -1,8 +1,11 @@
 import { EventEmitter2 } from "@nestjs/event-emitter";
+import { Actor } from "../../../core/auth/actor.interface";
 import { EnvService } from "../../../core/config/env.service";
 import { MailerService } from "../../../core/mailer/mailer.service";
 import { Paginated, PaginationQuery } from "../../../core/utils/pagination.util";
 import { TokenService } from "../../auth/domain/token.service";
+import { TeamScopeService } from "../../rbac/domain/teamScope.service";
+import { GroupRepository } from "../../rbac/infra/repositories/group.repository";
 import { RoleRepository } from "../../rbac/infra/repositories/role.repository";
 import { PasswordHistoryRepository } from "../infra/repositories/passwordHistory.repository";
 import { UserRepository } from "../infra/repositories/user.repository";
@@ -14,28 +17,33 @@ export declare class UsersService {
     private readonly userRepo;
     private readonly historyRepo;
     private readonly roleRepo;
+    private readonly groupRepo;
+    private readonly teamScope;
     private readonly env;
     private readonly mailer;
     private readonly tokens;
     private readonly events;
-    constructor(userRepo: UserRepository, historyRepo: PasswordHistoryRepository, roleRepo: RoleRepository, env: EnvService, mailer: MailerService, tokens: TokenService, events: EventEmitter2);
+    constructor(userRepo: UserRepository, historyRepo: PasswordHistoryRepository, roleRepo: RoleRepository, groupRepo: GroupRepository, teamScope: TeamScopeService, env: EnvService, mailer: MailerService, tokens: TokenService, events: EventEmitter2);
     findByEmail(email: string): Promise<User | null>;
     findById(id: string): Promise<User>;
-    list(query: PaginationQuery, actorPermissions?: string[]): Promise<Paginated<User>>;
-    create(dto: CreateUserCommand, actorPermissions?: string[]): Promise<User>;
-    sendFirstAccessLink(id: string): Promise<void>;
-    sendPasswordResetLink(id: string): Promise<void>;
+    findByIdForActor(id: string, actor: Actor): Promise<User>;
+    list(query: PaginationQuery, actor: Actor): Promise<Paginated<User>>;
+    create(dto: CreateUserCommand, actor: Actor): Promise<User>;
+    private resolveGroupsForCreate;
+    sendFirstAccessLink(id: string, actor: Actor): Promise<void>;
+    sendPasswordResetLink(id: string, actor: Actor): Promise<void>;
     private invalidateCurrentPassword;
     private issueAndSendFirstAccess;
     private findActiveForLink;
     private requirePasswordChange;
-    update(id: string, dto: UpdateUserCommand, actorPermissions?: string[]): Promise<User>;
+    update(id: string, dto: UpdateUserCommand, actor: Actor): Promise<User>;
+    private emitIfRolesChanged;
     remove(id: string): Promise<void>;
-    setActive(id: string, isActive: boolean): Promise<User>;
+    setActive(id: string, isActive: boolean, actor: Actor): Promise<User>;
     updateProfile(userId: string, dto: UpdateProfileCommand): Promise<User>;
     setAvatar(userId: string, avatarPath: string): Promise<User>;
     removeAvatar(userId: string): Promise<User>;
-    adminResetTwoFactor(id: string): Promise<void>;
+    adminResetTwoFactor(id: string, actor: Actor): Promise<void>;
     changePassword(userId: string, currentPassword: string, newPassword: string): Promise<void>;
     assertPasswordNotReused(userId: string, newPassword: string): Promise<void>;
     savePasswordToHistory(userId: string, passwordHash: string): Promise<void>;

package/dist/features/users/domain/users.service.js

@@ -13,6 +13,7 @@ exports.UsersService = void 0;
 const common_1 = require("@nestjs/common");
 const event_emitter_1 = require("@nestjs/event-emitter");
 const typeorm_1 = require("typeorm");
+const permissionScope_util_1 = require("../../../core/auth/permissionScope.util");
 const env_service_1 = require("../../../core/config/env.service");
 const appEvent_enum_1 = require("../../../core/events/appEvent.enum");
 const appErrorCode_enum_1 = require("../../../core/filters/appErrorCode.enum");
@@ -21,16 +22,20 @@ const codedError_util_1 = require("../../../core/utils/codedError.util");
 const hash_util_1 = require("../../../core/utils/hash.util");
 const pagination_util_1 = require("../../../core/utils/pagination.util");
 const token_service_1 = require("../../auth/domain/token.service");
+const teamScope_service_1 = require("../../rbac/domain/teamScope.service");
+const group_repository_1 = require("../../rbac/infra/repositories/group.repository");
 const role_repository_1 = require("../../rbac/infra/repositories/role.repository");
 const passwordHistory_repository_1 = require("../infra/repositories/passwordHistory.repository");
 const user_repository_1 = require("../infra/repositories/user.repository");
 const PASSWORD_HISTORY_LIMIT = 3;
 const PASSWORD_REUSED_MESSAGE = "Esta senha já foi utilizada. Escolha uma senha que você ainda não usou neste sistema";
 let UsersService = class UsersService {
-    constructor(userRepo, historyRepo, roleRepo, env, mailer, tokens, events) {
+    constructor(userRepo, historyRepo, roleRepo, groupRepo, teamScope, env, mailer, tokens, events) {
         this.userRepo = userRepo;
         this.historyRepo = historyRepo;
         this.roleRepo = roleRepo;
+        this.groupRepo = groupRepo;
+        this.teamScope = teamScope;
         this.env = env;
         this.mailer = mailer;
         this.tokens = tokens;
@@ -49,11 +54,16 @@ let UsersService = class UsersService {
         }
         return user;
     }
-    async list(query, actorPermissions) {
-        const [items, total] = await this.userRepo.findPaginated(query, actorPermissions);
+    async findByIdForActor(id, actor) {
+        await this.teamScope.assertCanAct(actor, id, "users:read");
+        return this.findById(id);
+    }
+    async list(query, actor) {
+        const reachable = await this.teamScope.reachableUserIds(actor, "users:read");
+        const [items, total] = await this.userRepo.findPaginated(query, actor.permissions, reachable);
         return new pagination_util_1.Paginated(items, total, query.page, query.limit);
     }
-    async create(dto, actorPermissions) {
+    async create(dto, actor) {
         const exists = await this.userRepo.findOne({
             where: { email: dto.email },
             withDeleted: true,
@@ -61,12 +71,13 @@ let UsersService = class UsersService {
         if (exists) {
             throw new common_1.ConflictException("Email já cadastrado");
         }
-        if (dto.roleIds?.length && !actorPermissions?.includes("users:promote:any")) {
+        if (dto.roleIds?.length && !actor.permissions.includes("users:promote:any")) {
             throw new common_1.ForbiddenException("Definir papéis na criação de um usuário é restrito a administradores");
         }
         const roles = dto.roleIds?.length
             ? await this.roleRepo.findBy({ id: (0, typeorm_1.In)(dto.roleIds) })
             : [];
+        const groups = await this.resolveGroupsForCreate(dto, actor);
         const hashed = await (0, hash_util_1.hashPassword)((0, hash_util_1.randomToken)(48));
         const user = this.userRepo.create({
             name: dto.name,
@@ -78,18 +89,41 @@ let UsersService = class UsersService {
             mustChangePassword: true,
             isActive: dto.isActive ?? true,
             roles,
+            groups,
         });
         const saved = await this.userRepo.save(user);
         await this.savePasswordToHistory(saved.id, hashed);
         void this.issueAndSendFirstAccess(saved).catch(() => undefined);
         return this.findById(saved.id);
     }
-    async sendFirstAccessLink(id) {
+    async resolveGroupsForCreate(dto, actor) {
+        const isAdmin = actor.permissions.includes("users:create:any");
+        if (dto.groupIds?.length) {
+            if (!isAdmin) {
+                await this.teamScope.assertOwnsGroups(actor, dto.groupIds);
+            }
+            return this.groupRepo.findBy({ id: (0, typeorm_1.In)(dto.groupIds) });
+        }
+        if (isAdmin) {
+            return [];
+        }
+        const managed = await this.teamScope.managedGroupIds(actor.id);
+        if (managed.length === 0) {
+            throw new common_1.ForbiddenException("Você não gerencia nenhum grupo — peça a um administrador para criar o usuário");
+        }
+        if (managed.length > 1) {
+            throw (0, codedError_util_1.codedBadRequest)("Informe em qual dos seus grupos o usuário entra", appErrorCode_enum_1.AppErrorCode.GROUP_REQUIRED);
+        }
+        return this.groupRepo.findBy({ id: (0, typeorm_1.In)(managed) });
+    }
+    async sendFirstAccessLink(id, actor) {
+        await this.teamScope.assertCanAct(actor, id, "users:invite");
         const user = await this.findActiveForLink(id);
         await this.issueAndSendFirstAccess(user);
         await this.requirePasswordChange(user);
     }
-    async sendPasswordResetLink(id) {
+    async sendPasswordResetLink(id, actor) {
+        await this.teamScope.assertCanAct(actor, id, "users:reset-password");
         const user = await this.findActiveForLink(id);
         const token = await this.tokens.issuePasswordReset(user.id);
         await this.mailer.sendPasswordReset(user.email, token, user.name);
@@ -123,7 +157,9 @@ let UsersService = class UsersService {
         user.failedLoginAttempts = 0;
         await this.userRepo.save(user);
     }
-    async update(id, dto, actorPermissions) {
+    async update(id, dto, actor) {
+        await this.teamScope.assertCanAct(actor, id, "users:update");
+        const actorPermissions = actor.permissions;
         const user = await this.findById(id);
         if (dto.email && dto.email !== user.email) {
             if (!actorPermissions?.includes("users:update-email:any")) {
@@ -137,12 +173,13 @@ let UsersService = class UsersService {
                 throw new common_1.ConflictException("Email já cadastrado");
             }
         }
+        const canDeactivate = (0, permissionScope_util_1.anyOrTeam)("users:deactivate").some((code) => actorPermissions.includes(code));
         if (dto.isActive !== undefined &&
             dto.isActive !== user.isActive &&
-            !actorPermissions?.includes("users:deactivate:any")) {
-            throw new common_1.ForbiddenException("Ativar/desativar um usuário é restrito a administradores");
+            !canDeactivate) {
+            throw new common_1.ForbiddenException("Ativar/desativar um usuário exige permissão específica");
         }
-        if (dto.roleIds && !actorPermissions?.includes("users:promote:any")) {
+        if (dto.roleIds && !actorPermissions.includes("users:promote:any")) {
             throw new common_1.ForbiddenException("Alterar papéis de um usuário é restrito a administradores");
         }
         Object.assign(user, {
@@ -152,17 +189,35 @@ let UsersService = class UsersService {
             email: dto.email ?? user.email,
             isActive: dto.isActive ?? user.isActive,
         });
+        const previousRoles = [...(user.roles ?? [])];
         if (dto.roleIds) {
             user.roles = await this.roleRepo.findBy({ id: (0, typeorm_1.In)(dto.roleIds) });
         }
         await this.userRepo.save(user);
-        return this.findById(id);
+        const updated = await this.findById(id);
+        this.emitIfRolesChanged(previousRoles, updated);
+        return updated;
+    }
+    emitIfRolesChanged(previousRoles, user) {
+        const roles = user.roles ?? [];
+        const previousIds = new Set(previousRoles.map((role) => role.id));
+        const unchanged = roles.length === previousIds.size &&
+            roles.every((role) => previousIds.has(role.id));
+        if (unchanged) {
+            return;
+        }
+        this.events.emit(appEvent_enum_1.AppEvent.USER_ROLES_CHANGED, {
+            userId: user.id,
+            roleNames: roles.map((role) => role.name),
+            previousRoleNames: previousRoles.map((role) => role.name),
+        });
     }
     async remove(id) {
         const user = await this.findById(id);
         await this.userRepo.softRemove(user);
     }
-    async setActive(id, isActive) {
+    async setActive(id, isActive, actor) {
+        await this.teamScope.assertCanAct(actor, id, "users:deactivate");
         const user = await this.findById(id);
         user.isActive = isActive;
         await this.userRepo.save(user);
@@ -190,7 +245,8 @@ let UsersService = class UsersService {
         await this.userRepo.save(user);
         return user;
     }
-    async adminResetTwoFactor(id) {
+    async adminResetTwoFactor(id, actor) {
+        await this.teamScope.assertCanAct(actor, id, "users:reset-password");
         const user = await this.findById(id);
         user.twoFactorEnabled = false;
         user.twoFactorSecret = null;
@@ -284,6 +340,8 @@ exports.UsersService = UsersService = __decorate([
     __metadata("design:paramtypes", [user_repository_1.UserRepository,
         passwordHistory_repository_1.PasswordHistoryRepository,
         role_repository_1.RoleRepository,
+        group_repository_1.GroupRepository,
+        teamScope_service_1.TeamScopeService,
         env_service_1.EnvService,
         mailer_service_1.MailerService,
         token_service_1.TokenService,

package/dist/features/users/infra/repositories/user.repository.d.ts

@@ -3,6 +3,6 @@ import { PaginationQuery } from "../../../../core/utils/pagination.util";
 import { User } from "../schema/user.schema";
 export declare class UserRepository extends Repository<User> {
     constructor(dataSource: DataSource);
-    findPaginated(query: PaginationQuery, permissions?: string[]): Promise<[User[], number]>;
+    findPaginated(query: PaginationQuery, permissions?: string[], reachableIds?: string[] | null): Promise<[User[], number]>;
     findWithPasswordExpiringIn(maxAgeDays: number, milestones: number[]): Promise<User[]>;
 }

package/dist/features/users/infra/repositories/user.repository.js

@@ -25,8 +25,16 @@ let UserRepository = class UserRepository extends typeorm_1.Repository {
     constructor(dataSource) {
         super(user_schema_1.User, dataSource.createEntityManager());
     }
-    findPaginated(query, permissions) {
+    findPaginated(query, permissions, reachableIds) {
         const qb = this.createQueryBuilder("user").leftJoinAndSelect("user.roles", "userRoles");
+        if (reachableIds) {
+            if (reachableIds.length === 0) {
+                qb.andWhere("1 = 0");
+            }
+            else {
+                qb.andWhere("user.id IN (:...reachableIds)", { reachableIds });
+            }
+        }
         return (0, paginateWithFilter_util_1.paginateWithFilter)(qb, {
             query,
             catalog: users_filters_1.USERS_FILTER_CATALOG,

package/dist/features/users/presentation/commands/createUser.command.d.ts

@@ -5,4 +5,5 @@ export declare class CreateUserCommand {
     email: string;
     isActive?: boolean;
     roleIds?: string[];
+    groupIds?: string[];
 }

package/dist/features/users/presentation/commands/createUser.command.js

@@ -54,3 +54,11 @@ __decorate([
     (0, class_validator_1.IsUUID)("all", { each: true }),
     __metadata("design:type", Array)
 ], CreateUserCommand.prototype, "roleIds", void 0);
+__decorate([
+    (0, swagger_1.ApiProperty)({ required: false, type: [String], format: "uuid" }),
+    (0, class_validator_1.IsOptional)(),
+    (0, class_validator_1.IsArray)(),
+    (0, class_validator_1.ArrayUnique)(),
+    (0, class_validator_1.IsUUID)("all", { each: true }),
+    __metadata("design:type", Array)
+], CreateUserCommand.prototype, "groupIds", void 0);

package/dist/features/users/presentation/filters/users.filters.js

@@ -50,6 +50,14 @@ exports.USERS_FILTER_CATALOG = [
         type: filterFieldType_enum_1.FilterFieldType.DateTime,
         sortable: true,
     },
+    {
+        field: "groupName",
+        column: "name",
+        label: "Grupo",
+        type: filterFieldType_enum_1.FilterFieldType.Select,
+        optionsUrl: "/rbac/groups",
+        relation: { property: "groups", alias: "groups", kind: "toMany" },
+    },
     {
         field: "roleName",
         column: "name",

package/dist/features/users/presentation/users.controller.d.ts

@@ -19,12 +19,12 @@ export declare class UsersController {
     deleteAvatar(userId: string): Promise<void>;
     list(query: PaginationQuery, actor: AuthenticatedUser): Promise<Paginated<User>>;
     filterSchema(actor: AuthenticatedUser): FilterFieldResponse[];
-    findOne(id: string): Promise<User>;
+    findOne(id: string, actor: AuthenticatedUser): Promise<User>;
     create(dto: CreateUserCommand, actor: AuthenticatedUser): Promise<User>;
     update(id: string, dto: UpdateUserCommand, actor: AuthenticatedUser): Promise<User>;
-    setActive(id: string, state: string): Promise<User>;
-    sendPasswordResetLink(id: string): Promise<void>;
-    sendFirstAccessLink(id: string): Promise<void>;
-    adminResetTwoFactor(id: string): Promise<void>;
+    setActive(id: string, state: string, actor: AuthenticatedUser): Promise<User>;
+    sendPasswordResetLink(id: string, actor: AuthenticatedUser): Promise<void>;
+    sendFirstAccessLink(id: string, actor: AuthenticatedUser): Promise<void>;
+    adminResetTwoFactor(id: string, actor: AuthenticatedUser): Promise<void>;
     remove(id: string, current: AuthenticatedUser): Promise<void>;
 }

package/dist/features/users/presentation/users.controller.js

@@ -20,8 +20,10 @@ const multer_1 = require("multer");
 const currentUser_decorator_1 = require("../../../core/auth/decorators/currentUser.decorator");
 const requirePermission_decorator_1 = require("../../../core/auth/decorators/requirePermission.decorator");
 const permissions_guard_1 = require("../../../core/auth/guards/permissions.guard");
+const permissionScope_util_1 = require("../../../core/auth/permissionScope.util");
 const filterSchema_response_1 = require("../../../core/query/filterSchema.response");
 const pagination_util_1 = require("../../../core/utils/pagination.util");
+const auditable_decorator_1 = require("../../audit/presentation/decorators/auditable.decorator");
 const avatar_service_1 = require("../domain/avatar.service");
 const users_service_1 = require("../domain/users.service");
 const changePassword_command_1 = require("./commands/changePassword.command");
@@ -53,31 +55,31 @@ let UsersController = class UsersController {
         await this.users.removeAvatar(userId);
     }
     list(query, actor) {
-        return this.users.list(query, actor.permissions);
+        return this.users.list(query, actor);
     }
     filterSchema(actor) {
         return (0, filterSchema_response_1.toFilterSchema)(users_filters_1.USERS_FILTER_CATALOG, actor.permissions);
     }
-    findOne(id) {
-        return this.users.findById(id);
+    findOne(id, actor) {
+        return this.users.findByIdForActor(id, actor);
     }
     create(dto, actor) {
-        return this.users.create(dto, actor.permissions);
+        return this.users.create(dto, actor);
     }
     update(id, dto, actor) {
-        return this.users.update(id, dto, actor.permissions);
+        return this.users.update(id, dto, actor);
     }
-    setActive(id, state) {
-        return this.users.setActive(id, state === "true");
+    setActive(id, state, actor) {
+        return this.users.setActive(id, state === "true", actor);
     }
-    async sendPasswordResetLink(id) {
-        await this.users.sendPasswordResetLink(id);
+    async sendPasswordResetLink(id, actor) {
+        await this.users.sendPasswordResetLink(id, actor);
     }
-    async sendFirstAccessLink(id) {
-        await this.users.sendFirstAccessLink(id);
+    async sendFirstAccessLink(id, actor) {
+        await this.users.sendFirstAccessLink(id, actor);
     }
-    async adminResetTwoFactor(id) {
-        await this.users.adminResetTwoFactor(id);
+    async adminResetTwoFactor(id, actor) {
+        await this.users.adminResetTwoFactor(id, actor);
     }
     async remove(id, current) {
         if (current.id === id) {
@@ -105,6 +107,7 @@ __decorate([
     __metadata("design:returntype", Promise)
 ], UsersController.prototype, "updateMe", null);
 __decorate([
+    (0, auditable_decorator_1.Auditable)("Troca da própria senha"),
     (0, common_1.Patch)("me/password"),
     (0, common_1.HttpCode)(204),
     __param(0, (0, currentUser_decorator_1.CurrentUser)("id")),
@@ -135,7 +138,7 @@ __decorate([
 __decorate([
     (0, common_1.Get)(),
     (0, common_1.UseGuards)(permissions_guard_1.PermissionsGuard),
-    (0, requirePermission_decorator_1.RequirePermission)("users:read:any"),
+    (0, requirePermission_decorator_1.RequireAnyPermission)(...(0, permissionScope_util_1.anyOrTeam)("users:read")),
     (0, swagger_1.ApiOkResponse)({ type: user_response_1.PaginatedUsersResponse }),
     __param(0, (0, common_1.Query)()),
     __param(1, (0, currentUser_decorator_1.CurrentUser)()),
@@ -146,7 +149,7 @@ __decorate([
 __decorate([
     (0, common_1.Get)("filter-schema"),
     (0, common_1.UseGuards)(permissions_guard_1.PermissionsGuard),
-    (0, requirePermission_decorator_1.RequirePermission)("users:read:any"),
+    (0, requirePermission_decorator_1.RequireAnyPermission)(...(0, permissionScope_util_1.anyOrTeam)("users:read")),
     (0, swagger_1.ApiOkResponse)({ type: filterSchema_response_1.FilterFieldResponse, isArray: true }),
     __param(0, (0, currentUser_decorator_1.CurrentUser)()),
     __metadata("design:type", Function),
@@ -156,17 +159,18 @@ __decorate([
 __decorate([
     (0, common_1.Get)(":id"),
     (0, common_1.UseGuards)(permissions_guard_1.PermissionsGuard),
-    (0, requirePermission_decorator_1.RequirePermission)("users:read:any"),
+    (0, requirePermission_decorator_1.RequireAnyPermission)(...(0, permissionScope_util_1.anyOrTeam)("users:read")),
     (0, swagger_1.ApiOkResponse)({ type: user_response_1.UserResponse }),
     __param(0, (0, common_1.Param)("id", common_1.ParseUUIDPipe)),
+    __param(1, (0, currentUser_decorator_1.CurrentUser)()),
     __metadata("design:type", Function),
-    __metadata("design:paramtypes", [String]),
+    __metadata("design:paramtypes", [String, Object]),
     __metadata("design:returntype", Promise)
 ], UsersController.prototype, "findOne", null);
 __decorate([
     (0, common_1.Post)(),
     (0, common_1.UseGuards)(permissions_guard_1.PermissionsGuard),
-    (0, requirePermission_decorator_1.RequirePermission)("users:create:any"),
+    (0, requirePermission_decorator_1.RequireAnyPermission)(...(0, permissionScope_util_1.anyOrTeam)("users:create")),
     (0, swagger_1.ApiOkResponse)({ type: user_response_1.UserResponse }),
     __param(0, (0, common_1.Body)()),
     __param(1, (0, currentUser_decorator_1.CurrentUser)()),
@@ -177,7 +181,7 @@ __decorate([
 __decorate([
     (0, common_1.Patch)(":id"),
     (0, common_1.UseGuards)(permissions_guard_1.PermissionsGuard),
-    (0, requirePermission_decorator_1.RequirePermission)("users:update:any"),
+    (0, requirePermission_decorator_1.RequireAnyPermission)(...(0, permissionScope_util_1.anyOrTeam)("users:update")),
     (0, swagger_1.ApiOkResponse)({ type: user_response_1.UserResponse }),
     __param(0, (0, common_1.Param)("id", common_1.ParseUUIDPipe)),
     __param(1, (0, common_1.Body)()),
@@ -189,42 +193,49 @@ __decorate([
 __decorate([
     (0, common_1.Patch)(":id/active/:state"),
     (0, common_1.UseGuards)(permissions_guard_1.PermissionsGuard),
-    (0, requirePermission_decorator_1.RequirePermission)("users:deactivate:any"),
+    (0, requirePermission_decorator_1.RequireAnyPermission)(...(0, permissionScope_util_1.anyOrTeam)("users:deactivate")),
     (0, swagger_1.ApiOkResponse)({ type: user_response_1.UserResponse }),
     __param(0, (0, common_1.Param)("id", common_1.ParseUUIDPipe)),
     __param(1, (0, common_1.Param)("state")),
+    __param(2, (0, currentUser_decorator_1.CurrentUser)()),
     __metadata("design:type", Function),
-    __metadata("design:paramtypes", [String, String]),
+    __metadata("design:paramtypes", [String, String, Object]),
     __metadata("design:returntype", Promise)
 ], UsersController.prototype, "setActive", null);
 __decorate([
+    (0, auditable_decorator_1.Auditable)("Redefinição de senha por administrador"),
     (0, common_1.Post)(":id/reset-password"),
     (0, common_1.HttpCode)(204),
     (0, common_1.UseGuards)(permissions_guard_1.PermissionsGuard),
-    (0, requirePermission_decorator_1.RequirePermission)("users:reset-password:any"),
+    (0, requirePermission_decorator_1.RequireAnyPermission)(...(0, permissionScope_util_1.anyOrTeam)("users:reset-password")),
     __param(0, (0, common_1.Param)("id", common_1.ParseUUIDPipe)),
+    __param(1, (0, currentUser_decorator_1.CurrentUser)()),
     __metadata("design:type", Function),
-    __metadata("design:paramtypes", [String]),
+    __metadata("design:paramtypes", [String, Object]),
     __metadata("design:returntype", Promise)
 ], UsersController.prototype, "sendPasswordResetLink", null);
 __decorate([
+    (0, auditable_decorator_1.Auditable)("Envio de link de primeiro acesso"),
     (0, common_1.Post)(":id/first-access-link"),
     (0, common_1.HttpCode)(204),
     (0, common_1.UseGuards)(permissions_guard_1.PermissionsGuard),
-    (0, requirePermission_decorator_1.RequirePermission)("users:invite:any"),
+    (0, requirePermission_decorator_1.RequireAnyPermission)(...(0, permissionScope_util_1.anyOrTeam)("users:invite")),
     __param(0, (0, common_1.Param)("id", common_1.ParseUUIDPipe)),
+    __param(1, (0, currentUser_decorator_1.CurrentUser)()),
     __metadata("design:type", Function),
-    __metadata("design:paramtypes", [String]),
+    __metadata("design:paramtypes", [String, Object]),
     __metadata("design:returntype", Promise)
 ], UsersController.prototype, "sendFirstAccessLink", null);
 __decorate([
+    (0, auditable_decorator_1.Auditable)("Reset de 2FA por administrador"),
     (0, common_1.Post)(":id/reset-2fa"),
     (0, common_1.HttpCode)(204),
     (0, common_1.UseGuards)(permissions_guard_1.PermissionsGuard),
-    (0, requirePermission_decorator_1.RequirePermission)("users:update:any"),
+    (0, requirePermission_decorator_1.RequireAnyPermission)(...(0, permissionScope_util_1.anyOrTeam)("users:reset-password")),
     __param(0, (0, common_1.Param)("id", common_1.ParseUUIDPipe)),
+    __param(1, (0, currentUser_decorator_1.CurrentUser)()),
     __metadata("design:type", Function),
-    __metadata("design:paramtypes", [String]),
+    __metadata("design:paramtypes", [String, Object]),
     __metadata("design:returntype", Promise)
 ], UsersController.prototype, "adminResetTwoFactor", null);
 __decorate([

package/dist/features/users/users.module.js

@@ -12,6 +12,7 @@ const typeorm_1 = require("@nestjs/typeorm");
 const token_module_1 = require("../auth/token.module");
 const role_repository_1 = require("../rbac/infra/repositories/role.repository");
 const role_schema_1 = require("../rbac/infra/schema/role.schema");
+const rbac_module_1 = require("../rbac/rbac.module");
 const domain_1 = require("./domain");
 const infra_1 = require("./infra");
 const presentation_1 = require("./presentation");
@@ -23,6 +24,7 @@ exports.UsersModule = UsersModule = __decorate([
         imports: [
             typeorm_1.TypeOrmModule.forFeature([infra_1.User, infra_1.PasswordHistory, role_schema_1.Role]),
             token_module_1.TokenModule,
+            rbac_module_1.RbacModule,
         ],
         controllers: [presentation_1.UsersController],
         providers: [

package/dist/index.d.ts

@@ -8,6 +8,7 @@ export { AppBrand } from "./core/config/appBrand.interface";
 export { ConfigModule, ConfigModuleOptions, EnvValidator, } from "./core/config/config.module";
 export { Env, envSchema, validateEnv } from "./core/config/env.schema";
 export { EnvService } from "./core/config/env.service";
+export { Actor } from "./core/auth/actor.interface";
 export { AuthenticatedUser, RequestWithUser, } from "./core/auth/authenticatedUser.interface";
 export { ACCESS_COOKIE, clearAuthCookies, REFRESH_COOKIE, setAuthCookies, } from "./core/auth/cookie.util";
 export { CurrentUser } from "./core/auth/decorators/currentUser.decorator";
@@ -17,6 +18,7 @@ export { AppThrottlerGuard } from "./core/auth/guards/appThrottler.guard";
 export { CsrfGuard } from "./core/auth/guards/csrf.guard";
 export { JwtAuthGuard } from "./core/auth/guards/jwtAuth.guard";
 export { PermissionsGuard } from "./core/auth/guards/permissions.guard";
+export { anyOrTeam, SCOPE_ANY, SCOPE_TEAM, } from "./core/auth/permissionScope.util";
 export { applyFilter, FilterSql } from "./core/query/applyFilter.util";
 export { DEFAULT_OPERATORS, FILTER_MAX_DEPTH, FILTER_MAX_IN_ITEMS, FILTER_MAX_LENGTH, FILTER_MAX_NODES, } from "./core/query/filter.constants";
 export { FilterCatalog, FilterCondition, FilterFieldDefinition, FilterGroup, FilterNode, FilterOption, FilterRelation, } from "./core/query/filterField.interface";
@@ -31,9 +33,8 @@ export { PaginationMetaResponse } from "./core/utils/paginationMeta.response";
 export { BaseEntity } from "./core/database/base.schema";
 export { seedAdmin } from "./core/database/seeds/seedAdmin";
 export { seedPermissions } from "./core/database/seeds/seedPermissions";
-export { AuditChange } from "./features/audit/infra/schema/auditChange.schema";
 export { AuditDataChange } from "./features/audit/infra/schema/auditDataChange.schema";
-export { ErrorLog } from "./features/audit/infra/schema/errorLog.schema";
+export { RequestLog } from "./features/audit/infra/schema/requestLog.schema";
 export { AuthToken } from "./features/auth/infra/schema/authToken.schema";
 export { Notification } from "./features/notifications/infra/schema/notification.schema";
 export { NotificationRead } from "./features/notifications/infra/schema/notificationRead.schema";
@@ -47,9 +48,12 @@ export { Scope } from "./features/rbac/infra/schema/scope.schema";
 export { PasswordHistory } from "./features/users/infra/schema/passwordHistory.schema";
 export { User } from "./features/users/infra/schema/user.schema";
 export { auditContext, AuditContextStore } from "./core/context/auditContext";
-export { AppEvent, SystemCleanupFailedEvent, UserLockedEvent, UserPasswordExpiringEvent, UserPasswordResetRequestedEvent, UserRolesChangedEvent, UserTwoFactorResetEvent, } from "./core/events/appEvent.enum";
+export { AppEvent, HttpErrorEvent, SystemCleanupFailedEvent, UserLockedEvent, UserPasswordExpiringEvent, UserPasswordResetRequestedEvent, UserRolesChangedEvent, UserTwoFactorResetEvent, } from "./core/events/appEvent.enum";
 export { AppErrorCode } from "./core/filters/appErrorCode.enum";
 export { codedBadRequest, codedTooManyRequests, codedUnauthorized, } from "./core/utils/codedError.util";
+export { ErrorType } from "./features/audit/domain/enums/errorType.enum";
+export { RequestOutcome } from "./features/audit/domain/enums/requestOutcome.enum";
+export { Auditable } from "./features/audit/presentation/decorators/auditable.decorator";
 export { BaseGateway, SocketData } from "./core/websocket/baseGateway";
 export { NOTIFICATIONS_NAMESPACE, roleRoom, SESSION_REFRESH_EVENT, userRoom, } from "./core/websocket/socket.constants";
 export { SOCKET_EVENT_VERSION, SocketEvent, wrapSocketEvent, } from "./core/websocket/socketEvent.envelope";