rl-core-api 0.4.0 → 0.5.0

package/dist/features/notifications/presentation/domainEvents.listener.js

@@ -16,11 +16,13 @@ const event_emitter_1 = require("@nestjs/event-emitter");
 const appEvent_enum_1 = require("../../../core/events/appEvent.enum");
 const notificationType_enum_1 = require("../domain/enums/notificationType.enum");
 const scopeType_enum_1 = require("../domain/enums/scopeType.enum");
+const notifications_gateway_1 = require("./notifications.gateway");
 const notifications_publisher_1 = require("./notifications.publisher");
 const ADMIN_ROLE = "Super Admin";
 let DomainEventsListener = DomainEventsListener_1 = class DomainEventsListener {
-    constructor(publisher) {
+    constructor(publisher, gateway) {
         this.publisher = publisher;
+        this.gateway = gateway;
         this.logger = new common_1.Logger(DomainEventsListener_1.name);
     }
     async onUserLocked(event) {
@@ -48,6 +50,19 @@ let DomainEventsListener = DomainEventsListener_1 = class DomainEventsListener {
             targets: [{ type: scopeType_enum_1.ScopeType.USER, key: event.userId }],
         }));
     }
+    async onRolesChanged(event) {
+        await this.safePublish(appEvent_enum_1.AppEvent.USER_ROLES_CHANGED, async () => {
+            await this.publisher.publishAndPush({
+                title: "Suas permissões foram atualizadas",
+                body: event.roleNames.length
+                    ? `Um administrador alterou seus papéis de acesso. Agora você é: ${event.roleNames.join(", ")}.`
+                    : "Um administrador removeu seus papéis de acesso. Parte do sistema deixa de aparecer para você.",
+                type: notificationType_enum_1.NotificationType.INFO,
+                targets: [{ type: scopeType_enum_1.ScopeType.USER, key: event.userId }],
+            });
+            this.gateway.requestSessionRefresh(event.userId);
+        });
+    }
     async onPasswordResetRequested(event) {
         await this.safePublish(appEvent_enum_1.AppEvent.USER_PASSWORD_RESET_REQUESTED, () => this.publisher.publishAndPush({
             title: "Redefinição de senha solicitada",
@@ -97,6 +112,12 @@ __decorate([
     __metadata("design:paramtypes", [Object]),
     __metadata("design:returntype", Promise)
 ], DomainEventsListener.prototype, "onTwoFactorReset", null);
+__decorate([
+    (0, event_emitter_1.OnEvent)(appEvent_enum_1.AppEvent.USER_ROLES_CHANGED),
+    __metadata("design:type", Function),
+    __metadata("design:paramtypes", [Object]),
+    __metadata("design:returntype", Promise)
+], DomainEventsListener.prototype, "onRolesChanged", null);
 __decorate([
     (0, event_emitter_1.OnEvent)(appEvent_enum_1.AppEvent.USER_PASSWORD_RESET_REQUESTED),
     __metadata("design:type", Function),
@@ -117,5 +138,6 @@ __decorate([
 ], DomainEventsListener.prototype, "onCleanupFailed", null);
 exports.DomainEventsListener = DomainEventsListener = DomainEventsListener_1 = __decorate([
     (0, common_1.Injectable)(),
-    __metadata("design:paramtypes", [notifications_publisher_1.NotificationsPublisher])
+    __metadata("design:paramtypes", [notifications_publisher_1.NotificationsPublisher,
+        notifications_gateway_1.NotificationsGateway])
 ], DomainEventsListener);

package/dist/features/rbac/domain/rbac.catalog.js

@@ -62,6 +62,30 @@ exports.PERMISSIONS = [
         code: "users:invite:any",
         description: "Enviar link de primeiro acesso a qualquer usuário",
     },
+    {
+        code: "users:read:team",
+        description: "Ler usuários da própria equipe",
+    },
+    {
+        code: "users:create:team",
+        description: "Criar usuário dentro da própria equipe",
+    },
+    {
+        code: "users:update:team",
+        description: "Atualizar usuários da própria equipe",
+    },
+    {
+        code: "users:invite:team",
+        description: "Enviar link de primeiro acesso a usuários da própria equipe",
+    },
+    {
+        code: "users:reset-password:team",
+        description: "Resetar senha e 2FA de usuários da própria equipe",
+    },
+    {
+        code: "users:deactivate:team",
+        description: "Ativar/desativar usuários da própria equipe",
+    },
     { code: "roles:create:any", description: "Criar papéis" },
     { code: "roles:read:any", description: "Ler papéis" },
     { code: "roles:update:any", description: "Atualizar papéis" },
@@ -132,9 +156,14 @@ exports.ROLES = [
     },
     {
         name: "Manager",
-        description: "Gestor de departamento",
+        description: "Gestor de equipe — administra quem está na árvore dele",
         permissions: [
-            "users:read:any",
+            "users:read:team",
+            "users:create:team",
+            "users:update:team",
+            "users:invite:team",
+            "users:reset-password:team",
+            "users:deactivate:team",
             "reports:read:department",
             "reports:read:any",
             "audit:read:any",

package/dist/features/rbac/domain/rbac.service.d.ts

@@ -59,6 +59,7 @@ export declare class RbacService {
     addPermissionToRole(roleId: string, permissionId: string, actorPermissions?: string[]): Promise<Role>;
     removePermissionFromRole(roleId: string, permissionId: string): Promise<Role>;
     listGroups(): Promise<Group[]>;
+    listManagedGroups(managerId: string): Promise<Group[]>;
     getGroup(id: string): Promise<Group>;
     createGroup(dto: CreateGroupCommand): Promise<Group>;
     updateGroup(id: string, dto: UpdateGroupCommand): Promise<Group>;

package/dist/features/rbac/domain/rbac.service.js

@@ -348,6 +348,16 @@ let RbacService = class RbacService {
             order: { name: "ASC" },
         });
     }
+    async listManagedGroups(managerId) {
+        const ids = await this.groupRepo.findManagedGroupIds(managerId);
+        if (ids.length === 0) {
+            return [];
+        }
+        return this.groupRepo.find({
+            where: { id: (0, typeorm_1.In)(ids) },
+            order: { name: "ASC" },
+        });
+    }
     async getGroup(id) {
         const group = await this.groupRepo.findOne({
             where: { id },
@@ -367,6 +377,7 @@ let RbacService = class RbacService {
             description: dto.description,
             type: dto.type ?? "team",
             parentId: dto.parentId ?? null,
+            managerId: dto.managerId ?? null,
             roles,
         });
         return this.groupRepo.save(group);
@@ -385,6 +396,9 @@ let RbacService = class RbacService {
         if (dto.parentId !== undefined) {
             group.parentId = dto.parentId;
         }
+        if (dto.managerId !== undefined) {
+            group.managerId = dto.managerId;
+        }
         if (dto.isActive !== undefined) {
             group.isActive = dto.isActive;
         }

package/dist/features/rbac/domain/teamScope.service.d.ts

@@ -0,0 +1,15 @@
+import { Actor } from "../../../core/auth/actor.interface";
+import { RbacService } from "./rbac.service";
+import { GroupRepository } from "../infra/repositories/group.repository";
+export declare class TeamScopeService {
+    private readonly groupRepo;
+    private readonly rbac;
+    constructor(groupRepo: GroupRepository, rbac: RbacService);
+    reachableUserIds(actor: Actor, action: string): Promise<string[] | null>;
+    managedGroupIds(managerId: string): Promise<string[]>;
+    private reachOf;
+    assertCanAct(actor: Actor, targetUserId: string, action: string): Promise<void>;
+    private assertActorOutranks;
+    assertOwnsGroups(actor: Actor, groupIds: string[]): Promise<void>;
+    private has;
+}

package/dist/features/rbac/domain/teamScope.service.js

@@ -0,0 +1,74 @@
+"use strict";
+var __decorate = (this && this.__decorate) || function (decorators, target, key, desc) {
+    var c = arguments.length, r = c < 3 ? target : desc === null ? desc = Object.getOwnPropertyDescriptor(target, key) : desc, d;
+    if (typeof Reflect === "object" && typeof Reflect.decorate === "function") r = Reflect.decorate(decorators, target, key, desc);
+    else for (var i = decorators.length - 1; i >= 0; i--) if (d = decorators[i]) r = (c < 3 ? d(r) : c > 3 ? d(target, key, r) : d(target, key)) || r;
+    return c > 3 && r && Object.defineProperty(target, key, r), r;
+};
+var __metadata = (this && this.__metadata) || function (k, v) {
+    if (typeof Reflect === "object" && typeof Reflect.metadata === "function") return Reflect.metadata(k, v);
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.TeamScopeService = void 0;
+const common_1 = require("@nestjs/common");
+const permissionScope_util_1 = require("../../../core/auth/permissionScope.util");
+const rbac_service_1 = require("./rbac.service");
+const group_repository_1 = require("../infra/repositories/group.repository");
+let TeamScopeService = class TeamScopeService {
+    constructor(groupRepo, rbac) {
+        this.groupRepo = groupRepo;
+        this.rbac = rbac;
+    }
+    async reachableUserIds(actor, action) {
+        if (this.has(actor, action, permissionScope_util_1.SCOPE_ANY)) {
+            return null;
+        }
+        if (!this.has(actor, action, permissionScope_util_1.SCOPE_TEAM)) {
+            return [];
+        }
+        const reach = await this.reachOf(actor.id);
+        return reach.userIds;
+    }
+    async managedGroupIds(managerId) {
+        return this.groupRepo.findManagedGroupIds(managerId);
+    }
+    async reachOf(managerId) {
+        const groupIds = await this.groupRepo.findManagedGroupIds(managerId);
+        const userIds = await this.groupRepo.findMemberIds(groupIds);
+        return { groupIds, userIds };
+    }
+    async assertCanAct(actor, targetUserId, action) {
+        const reach = await this.reachableUserIds(actor, action);
+        if (reach === null) {
+            return;
+        }
+        if (!reach.includes(targetUserId)) {
+            throw new common_1.ForbiddenException("Este usuário não faz parte da sua equipe");
+        }
+        await this.assertActorOutranks(actor, targetUserId);
+    }
+    async assertActorOutranks(actor, targetUserId) {
+        const targetPermissions = await this.rbac.getUserPermissionCodes(targetUserId);
+        const granted = new Set(actor.permissions);
+        const excess = targetPermissions.filter((code) => !granted.has(code));
+        if (excess.length > 0) {
+            throw new common_1.ForbiddenException("Este usuário tem permissões que você não possui — só um administrador pode administrá-lo");
+        }
+    }
+    async assertOwnsGroups(actor, groupIds) {
+        const managed = new Set(await this.managedGroupIds(actor.id));
+        const foreign = groupIds.filter((id) => !managed.has(id));
+        if (foreign.length > 0) {
+            throw new common_1.ForbiddenException("Você só pode incluir usuários em grupos que gerencia");
+        }
+    }
+    has(actor, action, scope) {
+        return actor.permissions.includes(`${action}:${scope}`);
+    }
+};
+exports.TeamScopeService = TeamScopeService;
+exports.TeamScopeService = TeamScopeService = __decorate([
+    (0, common_1.Injectable)(),
+    __metadata("design:paramtypes", [group_repository_1.GroupRepository,
+        rbac_service_1.RbacService])
+], TeamScopeService);

package/dist/features/rbac/infra/repositories/group.repository.d.ts

@@ -2,4 +2,6 @@ import { DataSource, Repository } from "typeorm";
 import { Group } from "../schema/group.schema";
 export declare class GroupRepository extends Repository<Group> {
     constructor(dataSource: DataSource);
+    findManagedGroupIds(managerId: string): Promise<string[]>;
+    findMemberIds(groupIds: string[]): Promise<string[]>;
 }

package/dist/features/rbac/infra/repositories/group.repository.js

@@ -17,6 +17,32 @@ let GroupRepository = class GroupRepository extends typeorm_1.Repository {
     constructor(dataSource) {
         super(group_schema_1.Group, dataSource.createEntityManager());
     }
+    async findManagedGroupIds(managerId) {
+        const rows = await this.query(`
+      WITH RECURSIVE team AS (
+        SELECT id FROM \`groups\`
+         WHERE manager_id = ? AND is_active = 1 AND deleted_at IS NULL
+        UNION ALL
+        SELECT child.id
+          FROM \`groups\` child
+         INNER JOIN team ON child.parent_id = team.id
+         WHERE child.is_active = 1 AND child.deleted_at IS NULL
+      )
+      SELECT id FROM team
+      `, [managerId]);
+        return rows.map((row) => row.id);
+    }
+    async findMemberIds(groupIds) {
+        if (groupIds.length === 0) {
+            return [];
+        }
+        const rows = await this.query(`
+      SELECT DISTINCT ug.user_id AS id
+        FROM user_groups ug
+       WHERE ug.group_id IN (?)
+      `, [groupIds]);
+        return rows.map((row) => row.id);
+    }
 };
 exports.GroupRepository = GroupRepository;
 exports.GroupRepository = GroupRepository = __decorate([

package/dist/features/rbac/infra/schema/group.schema.d.ts

@@ -7,6 +7,7 @@ export declare class Group extends BaseEntity {
     type: GroupType;
     parentId?: string | null;
     parent?: Group | null;
+    managerId?: string | null;
     isActive: boolean;
     roles: Role[];
 }

package/dist/features/rbac/infra/schema/group.schema.js

@@ -41,6 +41,11 @@ __decorate([
     (0, typeorm_1.JoinColumn)({ name: "parent_id" }),
     __metadata("design:type", Object)
 ], Group.prototype, "parent", void 0);
+__decorate([
+    (0, swagger_1.ApiProperty)({ required: false, nullable: true }),
+    (0, typeorm_1.Column)({ name: "manager_id", type: "char", length: 36, nullable: true }),
+    __metadata("design:type", Object)
+], Group.prototype, "managerId", void 0);
 __decorate([
     (0, swagger_1.ApiProperty)(),
     (0, typeorm_1.Column)({ name: "is_active", type: "boolean", default: true }),

package/dist/features/rbac/presentation/commands/createGroup.command.d.ts

@@ -3,5 +3,6 @@ export declare class CreateGroupCommand {
     description?: string;
     type?: "company" | "department" | "team";
     parentId?: string;
+    managerId?: string | null;
     roleIds?: string[];
 }

package/dist/features/rbac/presentation/commands/createGroup.command.js

@@ -44,6 +44,13 @@ __decorate([
     (0, class_validator_1.IsUUID)(),
     __metadata("design:type", String)
 ], CreateGroupCommand.prototype, "parentId", void 0);
+__decorate([
+    (0, swagger_1.ApiProperty)({ type: String, required: false, format: "uuid", nullable: true }),
+    (0, class_validator_1.IsOptional)(),
+    (0, class_validator_1.ValidateIf)((_, value) => value !== null),
+    (0, class_validator_1.IsUUID)(),
+    __metadata("design:type", Object)
+], CreateGroupCommand.prototype, "managerId", void 0);
 __decorate([
     (0, swagger_1.ApiProperty)({ required: false, type: [String], format: "uuid" }),
     (0, class_validator_1.IsOptional)(),

package/dist/features/rbac/presentation/rbac.controller.d.ts

@@ -38,6 +38,7 @@ export declare class RbacController {
     updatePermission(id: string, dto: UpdatePermissionCommand): Promise<Permission>;
     deletePermission(id: string): Promise<void>;
     groups(): Promise<Group[]>;
+    managedGroups(actor: AuthenticatedUser): Promise<Group[]>;
     group(id: string): Promise<Group>;
     createGroup(dto: CreateGroupCommand): Promise<Group>;
     updateGroup(id: string, dto: UpdateGroupCommand): Promise<Group>;

package/dist/features/rbac/presentation/rbac.controller.js

@@ -88,6 +88,9 @@ let RbacController = class RbacController {
     groups() {
         return this.rbac.listGroups();
     }
+    managedGroups(actor) {
+        return this.rbac.listManagedGroups(actor.id);
+    }
     group(id) {
         return this.rbac.getGroup(id);
     }
@@ -281,6 +284,14 @@ __decorate([
     __metadata("design:paramtypes", []),
     __metadata("design:returntype", Promise)
 ], RbacController.prototype, "groups", null);
+__decorate([
+    (0, common_1.Get)("groups/managed"),
+    (0, swagger_1.ApiOkResponse)({ type: rbac_response_1.GroupResponse, isArray: true }),
+    __param(0, (0, currentUser_decorator_1.CurrentUser)()),
+    __metadata("design:type", Function),
+    __metadata("design:paramtypes", [Object]),
+    __metadata("design:returntype", Promise)
+], RbacController.prototype, "managedGroups", null);
 __decorate([
     (0, common_1.Get)("groups/:id"),
     (0, requirePermission_decorator_1.RequirePermission)("groups:read:any"),

package/dist/features/rbac/presentation/responses/rbac.response.d.ts

@@ -41,6 +41,7 @@ export declare class GroupResponse extends RbacTimestampsResponse {
     description?: string | null;
     type: string;
     parentId?: string | null;
+    managerId?: string | null;
     isActive: boolean;
     roles?: RoleResponse[];
 }

package/dist/features/rbac/presentation/responses/rbac.response.js

@@ -151,6 +151,10 @@ __decorate([
     (0, swagger_1.ApiProperty)({ type: String, required: false, nullable: true, format: "uuid" }),
     __metadata("design:type", Object)
 ], GroupResponse.prototype, "parentId", void 0);
+__decorate([
+    (0, swagger_1.ApiProperty)({ type: String, required: false, nullable: true, format: "uuid" }),
+    __metadata("design:type", Object)
+], GroupResponse.prototype, "managerId", void 0);
 __decorate([
     (0, swagger_1.ApiProperty)(),
     __metadata("design:type", Boolean)

package/dist/features/rbac/rbac.module.js

@@ -10,6 +10,7 @@ exports.RbacModule = void 0;
 const common_1 = require("@nestjs/common");
 const typeorm_1 = require("@nestjs/typeorm");
 const domain_1 = require("./domain");
+const teamScope_service_1 = require("./domain/teamScope.service");
 const infra_1 = require("./infra");
 const presentation_1 = require("./presentation");
 const user_repository_1 = require("../users/infra/repositories/user.repository");
@@ -40,6 +41,7 @@ exports.RbacModule = RbacModule = __decorate([
             infra_1.GroupRepository,
             user_repository_1.UserRepository,
             domain_1.RbacService,
+            teamScope_service_1.TeamScopeService,
         ],
         exports: [
             infra_1.ResourceRepository,
@@ -50,6 +52,7 @@ exports.RbacModule = RbacModule = __decorate([
             infra_1.GroupRepository,
             user_repository_1.UserRepository,
             domain_1.RbacService,
+            teamScope_service_1.TeamScopeService,
         ],
     })
 ], RbacModule);

package/dist/features/users/domain/users.service.d.ts

@@ -1,8 +1,11 @@
 import { EventEmitter2 } from "@nestjs/event-emitter";
+import { Actor } from "../../../core/auth/actor.interface";
 import { EnvService } from "../../../core/config/env.service";
 import { MailerService } from "../../../core/mailer/mailer.service";
 import { Paginated, PaginationQuery } from "../../../core/utils/pagination.util";
 import { TokenService } from "../../auth/domain/token.service";
+import { TeamScopeService } from "../../rbac/domain/teamScope.service";
+import { GroupRepository } from "../../rbac/infra/repositories/group.repository";
 import { RoleRepository } from "../../rbac/infra/repositories/role.repository";
 import { PasswordHistoryRepository } from "../infra/repositories/passwordHistory.repository";
 import { UserRepository } from "../infra/repositories/user.repository";
@@ -14,28 +17,33 @@ export declare class UsersService {
     private readonly userRepo;
     private readonly historyRepo;
     private readonly roleRepo;
+    private readonly groupRepo;
+    private readonly teamScope;
     private readonly env;
     private readonly mailer;
     private readonly tokens;
     private readonly events;
-    constructor(userRepo: UserRepository, historyRepo: PasswordHistoryRepository, roleRepo: RoleRepository, env: EnvService, mailer: MailerService, tokens: TokenService, events: EventEmitter2);
+    constructor(userRepo: UserRepository, historyRepo: PasswordHistoryRepository, roleRepo: RoleRepository, groupRepo: GroupRepository, teamScope: TeamScopeService, env: EnvService, mailer: MailerService, tokens: TokenService, events: EventEmitter2);
     findByEmail(email: string): Promise<User | null>;
     findById(id: string): Promise<User>;
-    list(query: PaginationQuery, actorPermissions?: string[]): Promise<Paginated<User>>;
-    create(dto: CreateUserCommand, actorPermissions?: string[]): Promise<User>;
-    sendFirstAccessLink(id: string): Promise<void>;
-    sendPasswordResetLink(id: string): Promise<void>;
+    findByIdForActor(id: string, actor: Actor): Promise<User>;
+    list(query: PaginationQuery, actor: Actor): Promise<Paginated<User>>;
+    create(dto: CreateUserCommand, actor: Actor): Promise<User>;
+    private resolveGroupsForCreate;
+    sendFirstAccessLink(id: string, actor: Actor): Promise<void>;
+    sendPasswordResetLink(id: string, actor: Actor): Promise<void>;
     private invalidateCurrentPassword;
     private issueAndSendFirstAccess;
     private findActiveForLink;
     private requirePasswordChange;
-    update(id: string, dto: UpdateUserCommand, actorPermissions?: string[]): Promise<User>;
+    update(id: string, dto: UpdateUserCommand, actor: Actor): Promise<User>;
+    private emitIfRolesChanged;
     remove(id: string): Promise<void>;
-    setActive(id: string, isActive: boolean): Promise<User>;
+    setActive(id: string, isActive: boolean, actor: Actor): Promise<User>;
     updateProfile(userId: string, dto: UpdateProfileCommand): Promise<User>;
     setAvatar(userId: string, avatarPath: string): Promise<User>;
     removeAvatar(userId: string): Promise<User>;
-    adminResetTwoFactor(id: string): Promise<void>;
+    adminResetTwoFactor(id: string, actor: Actor): Promise<void>;
     changePassword(userId: string, currentPassword: string, newPassword: string): Promise<void>;
     assertPasswordNotReused(userId: string, newPassword: string): Promise<void>;
     savePasswordToHistory(userId: string, passwordHash: string): Promise<void>;

package/dist/features/users/domain/users.service.js

@@ -13,6 +13,7 @@ exports.UsersService = void 0;
 const common_1 = require("@nestjs/common");
 const event_emitter_1 = require("@nestjs/event-emitter");
 const typeorm_1 = require("typeorm");
+const permissionScope_util_1 = require("../../../core/auth/permissionScope.util");
 const env_service_1 = require("../../../core/config/env.service");
 const appEvent_enum_1 = require("../../../core/events/appEvent.enum");
 const appErrorCode_enum_1 = require("../../../core/filters/appErrorCode.enum");
@@ -21,16 +22,20 @@ const codedError_util_1 = require("../../../core/utils/codedError.util");
 const hash_util_1 = require("../../../core/utils/hash.util");
 const pagination_util_1 = require("../../../core/utils/pagination.util");
 const token_service_1 = require("../../auth/domain/token.service");
+const teamScope_service_1 = require("../../rbac/domain/teamScope.service");
+const group_repository_1 = require("../../rbac/infra/repositories/group.repository");
 const role_repository_1 = require("../../rbac/infra/repositories/role.repository");
 const passwordHistory_repository_1 = require("../infra/repositories/passwordHistory.repository");
 const user_repository_1 = require("../infra/repositories/user.repository");
 const PASSWORD_HISTORY_LIMIT = 3;
 const PASSWORD_REUSED_MESSAGE = "Esta senha já foi utilizada. Escolha uma senha que você ainda não usou neste sistema";
 let UsersService = class UsersService {
-    constructor(userRepo, historyRepo, roleRepo, env, mailer, tokens, events) {
+    constructor(userRepo, historyRepo, roleRepo, groupRepo, teamScope, env, mailer, tokens, events) {
         this.userRepo = userRepo;
         this.historyRepo = historyRepo;
         this.roleRepo = roleRepo;
+        this.groupRepo = groupRepo;
+        this.teamScope = teamScope;
         this.env = env;
         this.mailer = mailer;
         this.tokens = tokens;
@@ -49,11 +54,16 @@ let UsersService = class UsersService {
         }
         return user;
     }
-    async list(query, actorPermissions) {
-        const [items, total] = await this.userRepo.findPaginated(query, actorPermissions);
+    async findByIdForActor(id, actor) {
+        await this.teamScope.assertCanAct(actor, id, "users:read");
+        return this.findById(id);
+    }
+    async list(query, actor) {
+        const reachable = await this.teamScope.reachableUserIds(actor, "users:read");
+        const [items, total] = await this.userRepo.findPaginated(query, actor.permissions, reachable);
         return new pagination_util_1.Paginated(items, total, query.page, query.limit);
     }
-    async create(dto, actorPermissions) {
+    async create(dto, actor) {
         const exists = await this.userRepo.findOne({
             where: { email: dto.email },
             withDeleted: true,
@@ -61,12 +71,13 @@ let UsersService = class UsersService {
         if (exists) {
             throw new common_1.ConflictException("Email já cadastrado");
         }
-        if (dto.roleIds?.length && !actorPermissions?.includes("users:promote:any")) {
+        if (dto.roleIds?.length && !actor.permissions.includes("users:promote:any")) {
             throw new common_1.ForbiddenException("Definir papéis na criação de um usuário é restrito a administradores");
         }
         const roles = dto.roleIds?.length
             ? await this.roleRepo.findBy({ id: (0, typeorm_1.In)(dto.roleIds) })
             : [];
+        const groups = await this.resolveGroupsForCreate(dto, actor);
         const hashed = await (0, hash_util_1.hashPassword)((0, hash_util_1.randomToken)(48));
         const user = this.userRepo.create({
             name: dto.name,
@@ -78,18 +89,41 @@ let UsersService = class UsersService {
             mustChangePassword: true,
             isActive: dto.isActive ?? true,
             roles,
+            groups,
         });
         const saved = await this.userRepo.save(user);
         await this.savePasswordToHistory(saved.id, hashed);
         void this.issueAndSendFirstAccess(saved).catch(() => undefined);
         return this.findById(saved.id);
     }
-    async sendFirstAccessLink(id) {
+    async resolveGroupsForCreate(dto, actor) {
+        const isAdmin = actor.permissions.includes("users:create:any");
+        if (dto.groupIds?.length) {
+            if (!isAdmin) {
+                await this.teamScope.assertOwnsGroups(actor, dto.groupIds);
+            }
+            return this.groupRepo.findBy({ id: (0, typeorm_1.In)(dto.groupIds) });
+        }
+        if (isAdmin) {
+            return [];
+        }
+        const managed = await this.teamScope.managedGroupIds(actor.id);
+        if (managed.length === 0) {
+            throw new common_1.ForbiddenException("Você não gerencia nenhum grupo — peça a um administrador para criar o usuário");
+        }
+        if (managed.length > 1) {
+            throw (0, codedError_util_1.codedBadRequest)("Informe em qual dos seus grupos o usuário entra", appErrorCode_enum_1.AppErrorCode.GROUP_REQUIRED);
+        }
+        return this.groupRepo.findBy({ id: (0, typeorm_1.In)(managed) });
+    }
+    async sendFirstAccessLink(id, actor) {
+        await this.teamScope.assertCanAct(actor, id, "users:invite");
         const user = await this.findActiveForLink(id);
         await this.issueAndSendFirstAccess(user);
         await this.requirePasswordChange(user);
     }
-    async sendPasswordResetLink(id) {
+    async sendPasswordResetLink(id, actor) {
+        await this.teamScope.assertCanAct(actor, id, "users:reset-password");
         const user = await this.findActiveForLink(id);
         const token = await this.tokens.issuePasswordReset(user.id);
         await this.mailer.sendPasswordReset(user.email, token, user.name);
@@ -123,7 +157,9 @@ let UsersService = class UsersService {
         user.failedLoginAttempts = 0;
         await this.userRepo.save(user);
     }
-    async update(id, dto, actorPermissions) {
+    async update(id, dto, actor) {
+        await this.teamScope.assertCanAct(actor, id, "users:update");
+        const actorPermissions = actor.permissions;
         const user = await this.findById(id);
         if (dto.email && dto.email !== user.email) {
             if (!actorPermissions?.includes("users:update-email:any")) {
@@ -137,12 +173,13 @@ let UsersService = class UsersService {
                 throw new common_1.ConflictException("Email já cadastrado");
             }
         }
+        const canDeactivate = (0, permissionScope_util_1.anyOrTeam)("users:deactivate").some((code) => actorPermissions.includes(code));
         if (dto.isActive !== undefined &&
             dto.isActive !== user.isActive &&
-            !actorPermissions?.includes("users:deactivate:any")) {
-            throw new common_1.ForbiddenException("Ativar/desativar um usuário é restrito a administradores");
+            !canDeactivate) {
+            throw new common_1.ForbiddenException("Ativar/desativar um usuário exige permissão específica");
         }
-        if (dto.roleIds && !actorPermissions?.includes("users:promote:any")) {
+        if (dto.roleIds && !actorPermissions.includes("users:promote:any")) {
             throw new common_1.ForbiddenException("Alterar papéis de um usuário é restrito a administradores");
         }
         Object.assign(user, {
@@ -152,17 +189,35 @@ let UsersService = class UsersService {
             email: dto.email ?? user.email,
             isActive: dto.isActive ?? user.isActive,
         });
+        const previousRoles = [...(user.roles ?? [])];
         if (dto.roleIds) {
             user.roles = await this.roleRepo.findBy({ id: (0, typeorm_1.In)(dto.roleIds) });
         }
         await this.userRepo.save(user);
-        return this.findById(id);
+        const updated = await this.findById(id);
+        this.emitIfRolesChanged(previousRoles, updated);
+        return updated;
+    }
+    emitIfRolesChanged(previousRoles, user) {
+        const roles = user.roles ?? [];
+        const previousIds = new Set(previousRoles.map((role) => role.id));
+        const unchanged = roles.length === previousIds.size &&
+            roles.every((role) => previousIds.has(role.id));
+        if (unchanged) {
+            return;
+        }
+        this.events.emit(appEvent_enum_1.AppEvent.USER_ROLES_CHANGED, {
+            userId: user.id,
+            roleNames: roles.map((role) => role.name),
+            previousRoleNames: previousRoles.map((role) => role.name),
+        });
     }
     async remove(id) {
         const user = await this.findById(id);
         await this.userRepo.softRemove(user);
     }
-    async setActive(id, isActive) {
+    async setActive(id, isActive, actor) {
+        await this.teamScope.assertCanAct(actor, id, "users:deactivate");
         const user = await this.findById(id);
         user.isActive = isActive;
         await this.userRepo.save(user);
@@ -190,7 +245,8 @@ let UsersService = class UsersService {
         await this.userRepo.save(user);
         return user;
     }
-    async adminResetTwoFactor(id) {
+    async adminResetTwoFactor(id, actor) {
+        await this.teamScope.assertCanAct(actor, id, "users:reset-password");
         const user = await this.findById(id);
         user.twoFactorEnabled = false;
         user.twoFactorSecret = null;
@@ -284,6 +340,8 @@ exports.UsersService = UsersService = __decorate([
     __metadata("design:paramtypes", [user_repository_1.UserRepository,
         passwordHistory_repository_1.PasswordHistoryRepository,
         role_repository_1.RoleRepository,
+        group_repository_1.GroupRepository,
+        teamScope_service_1.TeamScopeService,
         env_service_1.EnvService,
         mailer_service_1.MailerService,
         token_service_1.TokenService,