rl-core-api 0.4.0 → 0.5.0

package/dist/features/users/infra/repositories/user.repository.d.ts

@@ -3,6 +3,6 @@ import { PaginationQuery } from "../../../../core/utils/pagination.util";
 import { User } from "../schema/user.schema";
 export declare class UserRepository extends Repository<User> {
     constructor(dataSource: DataSource);
-    findPaginated(query: PaginationQuery, permissions?: string[]): Promise<[User[], number]>;
+    findPaginated(query: PaginationQuery, permissions?: string[], reachableIds?: string[] | null): Promise<[User[], number]>;
     findWithPasswordExpiringIn(maxAgeDays: number, milestones: number[]): Promise<User[]>;
 }

package/dist/features/users/infra/repositories/user.repository.js

@@ -25,8 +25,16 @@ let UserRepository = class UserRepository extends typeorm_1.Repository {
     constructor(dataSource) {
         super(user_schema_1.User, dataSource.createEntityManager());
     }
-    findPaginated(query, permissions) {
+    findPaginated(query, permissions, reachableIds) {
         const qb = this.createQueryBuilder("user").leftJoinAndSelect("user.roles", "userRoles");
+        if (reachableIds) {
+            if (reachableIds.length === 0) {
+                qb.andWhere("1 = 0");
+            }
+            else {
+                qb.andWhere("user.id IN (:...reachableIds)", { reachableIds });
+            }
+        }
         return (0, paginateWithFilter_util_1.paginateWithFilter)(qb, {
             query,
             catalog: users_filters_1.USERS_FILTER_CATALOG,

package/dist/features/users/presentation/commands/createUser.command.d.ts

@@ -5,4 +5,5 @@ export declare class CreateUserCommand {
     email: string;
     isActive?: boolean;
     roleIds?: string[];
+    groupIds?: string[];
 }

package/dist/features/users/presentation/commands/createUser.command.js

@@ -54,3 +54,11 @@ __decorate([
     (0, class_validator_1.IsUUID)("all", { each: true }),
     __metadata("design:type", Array)
 ], CreateUserCommand.prototype, "roleIds", void 0);
+__decorate([
+    (0, swagger_1.ApiProperty)({ required: false, type: [String], format: "uuid" }),
+    (0, class_validator_1.IsOptional)(),
+    (0, class_validator_1.IsArray)(),
+    (0, class_validator_1.ArrayUnique)(),
+    (0, class_validator_1.IsUUID)("all", { each: true }),
+    __metadata("design:type", Array)
+], CreateUserCommand.prototype, "groupIds", void 0);

package/dist/features/users/presentation/filters/users.filters.js

@@ -50,6 +50,14 @@ exports.USERS_FILTER_CATALOG = [
         type: filterFieldType_enum_1.FilterFieldType.DateTime,
         sortable: true,
     },
+    {
+        field: "groupName",
+        column: "name",
+        label: "Grupo",
+        type: filterFieldType_enum_1.FilterFieldType.Select,
+        optionsUrl: "/rbac/groups",
+        relation: { property: "groups", alias: "groups", kind: "toMany" },
+    },
     {
         field: "roleName",
         column: "name",

package/dist/features/users/presentation/users.controller.d.ts

@@ -19,12 +19,12 @@ export declare class UsersController {
     deleteAvatar(userId: string): Promise<void>;
     list(query: PaginationQuery, actor: AuthenticatedUser): Promise<Paginated<User>>;
     filterSchema(actor: AuthenticatedUser): FilterFieldResponse[];
-    findOne(id: string): Promise<User>;
+    findOne(id: string, actor: AuthenticatedUser): Promise<User>;
     create(dto: CreateUserCommand, actor: AuthenticatedUser): Promise<User>;
     update(id: string, dto: UpdateUserCommand, actor: AuthenticatedUser): Promise<User>;
-    setActive(id: string, state: string): Promise<User>;
-    sendPasswordResetLink(id: string): Promise<void>;
-    sendFirstAccessLink(id: string): Promise<void>;
-    adminResetTwoFactor(id: string): Promise<void>;
+    setActive(id: string, state: string, actor: AuthenticatedUser): Promise<User>;
+    sendPasswordResetLink(id: string, actor: AuthenticatedUser): Promise<void>;
+    sendFirstAccessLink(id: string, actor: AuthenticatedUser): Promise<void>;
+    adminResetTwoFactor(id: string, actor: AuthenticatedUser): Promise<void>;
     remove(id: string, current: AuthenticatedUser): Promise<void>;
 }

package/dist/features/users/presentation/users.controller.js

@@ -20,6 +20,7 @@ const multer_1 = require("multer");
 const currentUser_decorator_1 = require("../../../core/auth/decorators/currentUser.decorator");
 const requirePermission_decorator_1 = require("../../../core/auth/decorators/requirePermission.decorator");
 const permissions_guard_1 = require("../../../core/auth/guards/permissions.guard");
+const permissionScope_util_1 = require("../../../core/auth/permissionScope.util");
 const filterSchema_response_1 = require("../../../core/query/filterSchema.response");
 const pagination_util_1 = require("../../../core/utils/pagination.util");
 const auditable_decorator_1 = require("../../audit/presentation/decorators/auditable.decorator");
@@ -54,31 +55,31 @@ let UsersController = class UsersController {
         await this.users.removeAvatar(userId);
     }
     list(query, actor) {
-        return this.users.list(query, actor.permissions);
+        return this.users.list(query, actor);
     }
     filterSchema(actor) {
         return (0, filterSchema_response_1.toFilterSchema)(users_filters_1.USERS_FILTER_CATALOG, actor.permissions);
     }
-    findOne(id) {
-        return this.users.findById(id);
+    findOne(id, actor) {
+        return this.users.findByIdForActor(id, actor);
     }
     create(dto, actor) {
-        return this.users.create(dto, actor.permissions);
+        return this.users.create(dto, actor);
     }
     update(id, dto, actor) {
-        return this.users.update(id, dto, actor.permissions);
+        return this.users.update(id, dto, actor);
     }
-    setActive(id, state) {
-        return this.users.setActive(id, state === "true");
+    setActive(id, state, actor) {
+        return this.users.setActive(id, state === "true", actor);
     }
-    async sendPasswordResetLink(id) {
-        await this.users.sendPasswordResetLink(id);
+    async sendPasswordResetLink(id, actor) {
+        await this.users.sendPasswordResetLink(id, actor);
     }
-    async sendFirstAccessLink(id) {
-        await this.users.sendFirstAccessLink(id);
+    async sendFirstAccessLink(id, actor) {
+        await this.users.sendFirstAccessLink(id, actor);
     }
-    async adminResetTwoFactor(id) {
-        await this.users.adminResetTwoFactor(id);
+    async adminResetTwoFactor(id, actor) {
+        await this.users.adminResetTwoFactor(id, actor);
     }
     async remove(id, current) {
         if (current.id === id) {
@@ -137,7 +138,7 @@ __decorate([
 __decorate([
     (0, common_1.Get)(),
     (0, common_1.UseGuards)(permissions_guard_1.PermissionsGuard),
-    (0, requirePermission_decorator_1.RequirePermission)("users:read:any"),
+    (0, requirePermission_decorator_1.RequireAnyPermission)(...(0, permissionScope_util_1.anyOrTeam)("users:read")),
     (0, swagger_1.ApiOkResponse)({ type: user_response_1.PaginatedUsersResponse }),
     __param(0, (0, common_1.Query)()),
     __param(1, (0, currentUser_decorator_1.CurrentUser)()),
@@ -148,7 +149,7 @@ __decorate([
 __decorate([
     (0, common_1.Get)("filter-schema"),
     (0, common_1.UseGuards)(permissions_guard_1.PermissionsGuard),
-    (0, requirePermission_decorator_1.RequirePermission)("users:read:any"),
+    (0, requirePermission_decorator_1.RequireAnyPermission)(...(0, permissionScope_util_1.anyOrTeam)("users:read")),
     (0, swagger_1.ApiOkResponse)({ type: filterSchema_response_1.FilterFieldResponse, isArray: true }),
     __param(0, (0, currentUser_decorator_1.CurrentUser)()),
     __metadata("design:type", Function),
@@ -158,17 +159,18 @@ __decorate([
 __decorate([
     (0, common_1.Get)(":id"),
     (0, common_1.UseGuards)(permissions_guard_1.PermissionsGuard),
-    (0, requirePermission_decorator_1.RequirePermission)("users:read:any"),
+    (0, requirePermission_decorator_1.RequireAnyPermission)(...(0, permissionScope_util_1.anyOrTeam)("users:read")),
     (0, swagger_1.ApiOkResponse)({ type: user_response_1.UserResponse }),
     __param(0, (0, common_1.Param)("id", common_1.ParseUUIDPipe)),
+    __param(1, (0, currentUser_decorator_1.CurrentUser)()),
     __metadata("design:type", Function),
-    __metadata("design:paramtypes", [String]),
+    __metadata("design:paramtypes", [String, Object]),
     __metadata("design:returntype", Promise)
 ], UsersController.prototype, "findOne", null);
 __decorate([
     (0, common_1.Post)(),
     (0, common_1.UseGuards)(permissions_guard_1.PermissionsGuard),
-    (0, requirePermission_decorator_1.RequirePermission)("users:create:any"),
+    (0, requirePermission_decorator_1.RequireAnyPermission)(...(0, permissionScope_util_1.anyOrTeam)("users:create")),
     (0, swagger_1.ApiOkResponse)({ type: user_response_1.UserResponse }),
     __param(0, (0, common_1.Body)()),
     __param(1, (0, currentUser_decorator_1.CurrentUser)()),
@@ -179,7 +181,7 @@ __decorate([
 __decorate([
     (0, common_1.Patch)(":id"),
     (0, common_1.UseGuards)(permissions_guard_1.PermissionsGuard),
-    (0, requirePermission_decorator_1.RequirePermission)("users:update:any"),
+    (0, requirePermission_decorator_1.RequireAnyPermission)(...(0, permissionScope_util_1.anyOrTeam)("users:update")),
     (0, swagger_1.ApiOkResponse)({ type: user_response_1.UserResponse }),
     __param(0, (0, common_1.Param)("id", common_1.ParseUUIDPipe)),
     __param(1, (0, common_1.Body)()),
@@ -191,12 +193,13 @@ __decorate([
 __decorate([
     (0, common_1.Patch)(":id/active/:state"),
     (0, common_1.UseGuards)(permissions_guard_1.PermissionsGuard),
-    (0, requirePermission_decorator_1.RequirePermission)("users:deactivate:any"),
+    (0, requirePermission_decorator_1.RequireAnyPermission)(...(0, permissionScope_util_1.anyOrTeam)("users:deactivate")),
     (0, swagger_1.ApiOkResponse)({ type: user_response_1.UserResponse }),
     __param(0, (0, common_1.Param)("id", common_1.ParseUUIDPipe)),
     __param(1, (0, common_1.Param)("state")),
+    __param(2, (0, currentUser_decorator_1.CurrentUser)()),
     __metadata("design:type", Function),
-    __metadata("design:paramtypes", [String, String]),
+    __metadata("design:paramtypes", [String, String, Object]),
     __metadata("design:returntype", Promise)
 ], UsersController.prototype, "setActive", null);
 __decorate([
@@ -204,10 +207,11 @@ __decorate([
     (0, common_1.Post)(":id/reset-password"),
     (0, common_1.HttpCode)(204),
     (0, common_1.UseGuards)(permissions_guard_1.PermissionsGuard),
-    (0, requirePermission_decorator_1.RequirePermission)("users:reset-password:any"),
+    (0, requirePermission_decorator_1.RequireAnyPermission)(...(0, permissionScope_util_1.anyOrTeam)("users:reset-password")),
     __param(0, (0, common_1.Param)("id", common_1.ParseUUIDPipe)),
+    __param(1, (0, currentUser_decorator_1.CurrentUser)()),
     __metadata("design:type", Function),
-    __metadata("design:paramtypes", [String]),
+    __metadata("design:paramtypes", [String, Object]),
     __metadata("design:returntype", Promise)
 ], UsersController.prototype, "sendPasswordResetLink", null);
 __decorate([
@@ -215,10 +219,11 @@ __decorate([
     (0, common_1.Post)(":id/first-access-link"),
     (0, common_1.HttpCode)(204),
     (0, common_1.UseGuards)(permissions_guard_1.PermissionsGuard),
-    (0, requirePermission_decorator_1.RequirePermission)("users:invite:any"),
+    (0, requirePermission_decorator_1.RequireAnyPermission)(...(0, permissionScope_util_1.anyOrTeam)("users:invite")),
     __param(0, (0, common_1.Param)("id", common_1.ParseUUIDPipe)),
+    __param(1, (0, currentUser_decorator_1.CurrentUser)()),
     __metadata("design:type", Function),
-    __metadata("design:paramtypes", [String]),
+    __metadata("design:paramtypes", [String, Object]),
     __metadata("design:returntype", Promise)
 ], UsersController.prototype, "sendFirstAccessLink", null);
 __decorate([
@@ -226,10 +231,11 @@ __decorate([
     (0, common_1.Post)(":id/reset-2fa"),
     (0, common_1.HttpCode)(204),
     (0, common_1.UseGuards)(permissions_guard_1.PermissionsGuard),
-    (0, requirePermission_decorator_1.RequirePermission)("users:update:any"),
+    (0, requirePermission_decorator_1.RequireAnyPermission)(...(0, permissionScope_util_1.anyOrTeam)("users:reset-password")),
     __param(0, (0, common_1.Param)("id", common_1.ParseUUIDPipe)),
+    __param(1, (0, currentUser_decorator_1.CurrentUser)()),
     __metadata("design:type", Function),
-    __metadata("design:paramtypes", [String]),
+    __metadata("design:paramtypes", [String, Object]),
     __metadata("design:returntype", Promise)
 ], UsersController.prototype, "adminResetTwoFactor", null);
 __decorate([

package/dist/features/users/users.module.js

@@ -12,6 +12,7 @@ const typeorm_1 = require("@nestjs/typeorm");
 const token_module_1 = require("../auth/token.module");
 const role_repository_1 = require("../rbac/infra/repositories/role.repository");
 const role_schema_1 = require("../rbac/infra/schema/role.schema");
+const rbac_module_1 = require("../rbac/rbac.module");
 const domain_1 = require("./domain");
 const infra_1 = require("./infra");
 const presentation_1 = require("./presentation");
@@ -23,6 +24,7 @@ exports.UsersModule = UsersModule = __decorate([
         imports: [
             typeorm_1.TypeOrmModule.forFeature([infra_1.User, infra_1.PasswordHistory, role_schema_1.Role]),
             token_module_1.TokenModule,
+            rbac_module_1.RbacModule,
         ],
         controllers: [presentation_1.UsersController],
         providers: [

package/dist/index.d.ts

@@ -8,6 +8,7 @@ export { AppBrand } from "./core/config/appBrand.interface";
 export { ConfigModule, ConfigModuleOptions, EnvValidator, } from "./core/config/config.module";
 export { Env, envSchema, validateEnv } from "./core/config/env.schema";
 export { EnvService } from "./core/config/env.service";
+export { Actor } from "./core/auth/actor.interface";
 export { AuthenticatedUser, RequestWithUser, } from "./core/auth/authenticatedUser.interface";
 export { ACCESS_COOKIE, clearAuthCookies, REFRESH_COOKIE, setAuthCookies, } from "./core/auth/cookie.util";
 export { CurrentUser } from "./core/auth/decorators/currentUser.decorator";
@@ -17,6 +18,7 @@ export { AppThrottlerGuard } from "./core/auth/guards/appThrottler.guard";
 export { CsrfGuard } from "./core/auth/guards/csrf.guard";
 export { JwtAuthGuard } from "./core/auth/guards/jwtAuth.guard";
 export { PermissionsGuard } from "./core/auth/guards/permissions.guard";
+export { anyOrTeam, SCOPE_ANY, SCOPE_TEAM, } from "./core/auth/permissionScope.util";
 export { applyFilter, FilterSql } from "./core/query/applyFilter.util";
 export { DEFAULT_OPERATORS, FILTER_MAX_DEPTH, FILTER_MAX_IN_ITEMS, FILTER_MAX_LENGTH, FILTER_MAX_NODES, } from "./core/query/filter.constants";
 export { FilterCatalog, FilterCondition, FilterFieldDefinition, FilterGroup, FilterNode, FilterOption, FilterRelation, } from "./core/query/filterField.interface";

package/dist/index.js

@@ -1,7 +1,7 @@
 "use strict";
 Object.defineProperty(exports, "__esModule", { value: true });
-exports.AuthToken = exports.RequestLog = exports.AuditDataChange = exports.seedPermissions = exports.seedAdmin = exports.BaseEntity = exports.PaginationMetaResponse = exports.resolveOrder = exports.PaginationQuery = exports.Paginated = exports.parseFilter = exports.paginateWithFilter = exports.resolveCatalogOrder = exports.toFilterSchema = exports.FilterOptionResponse = exports.FilterFieldResponse = exports.FilterOperator = exports.FilterCombinator = exports.FilterFieldType = exports.FILTER_MAX_NODES = exports.FILTER_MAX_LENGTH = exports.FILTER_MAX_IN_ITEMS = exports.FILTER_MAX_DEPTH = exports.DEFAULT_OPERATORS = exports.applyFilter = exports.PermissionsGuard = exports.JwtAuthGuard = exports.CsrfGuard = exports.AppThrottlerGuard = exports.RequirePermission = exports.RequireAnyPermission = exports.PERMISSIONS_KEY = exports.ANY_PERMISSIONS_KEY = exports.Public = exports.IS_PUBLIC_KEY = exports.CurrentUser = exports.setAuthCookies = exports.REFRESH_COOKIE = exports.clearAuthCookies = exports.ACCESS_COOKIE = exports.EnvService = exports.validateEnv = exports.envSchema = exports.ConfigModule = exports.RlCoreModule = exports.coreEntities = exports.coreMigrations = exports.createCoreDataSource = exports.CoreModule = exports.bootstrapCore = void 0;
-exports.normalizeIp = exports.sha256 = exports.randomToken = exports.numericCode = exports.backupCode = exports.encryptSecret = exports.decryptSecret = exports.MailerService = exports.createAppLogger = exports.WS_USER_RESOLVER = exports.WsAuthService = exports.wrapSocketEvent = exports.SOCKET_EVENT_VERSION = exports.userRoom = exports.SESSION_REFRESH_EVENT = exports.roleRoom = exports.NOTIFICATIONS_NAMESPACE = exports.BaseGateway = exports.Auditable = exports.RequestOutcome = exports.ErrorType = exports.codedUnauthorized = exports.codedTooManyRequests = exports.codedBadRequest = exports.AppErrorCode = exports.AppEvent = exports.auditContext = exports.User = exports.PasswordHistory = exports.Scope = exports.Role = exports.Resource = exports.Permission = exports.Group = exports.Action = exports.NotificationScope = exports.NotificationRead = exports.Notification = void 0;
+exports.seedPermissions = exports.seedAdmin = exports.BaseEntity = exports.PaginationMetaResponse = exports.resolveOrder = exports.PaginationQuery = exports.Paginated = exports.parseFilter = exports.paginateWithFilter = exports.resolveCatalogOrder = exports.toFilterSchema = exports.FilterOptionResponse = exports.FilterFieldResponse = exports.FilterOperator = exports.FilterCombinator = exports.FilterFieldType = exports.FILTER_MAX_NODES = exports.FILTER_MAX_LENGTH = exports.FILTER_MAX_IN_ITEMS = exports.FILTER_MAX_DEPTH = exports.DEFAULT_OPERATORS = exports.applyFilter = exports.SCOPE_TEAM = exports.SCOPE_ANY = exports.anyOrTeam = exports.PermissionsGuard = exports.JwtAuthGuard = exports.CsrfGuard = exports.AppThrottlerGuard = exports.RequirePermission = exports.RequireAnyPermission = exports.PERMISSIONS_KEY = exports.ANY_PERMISSIONS_KEY = exports.Public = exports.IS_PUBLIC_KEY = exports.CurrentUser = exports.setAuthCookies = exports.REFRESH_COOKIE = exports.clearAuthCookies = exports.ACCESS_COOKIE = exports.EnvService = exports.validateEnv = exports.envSchema = exports.ConfigModule = exports.RlCoreModule = exports.coreEntities = exports.coreMigrations = exports.createCoreDataSource = exports.CoreModule = exports.bootstrapCore = void 0;
+exports.normalizeIp = exports.sha256 = exports.randomToken = exports.numericCode = exports.backupCode = exports.encryptSecret = exports.decryptSecret = exports.MailerService = exports.createAppLogger = exports.WS_USER_RESOLVER = exports.WsAuthService = exports.wrapSocketEvent = exports.SOCKET_EVENT_VERSION = exports.userRoom = exports.SESSION_REFRESH_EVENT = exports.roleRoom = exports.NOTIFICATIONS_NAMESPACE = exports.BaseGateway = exports.Auditable = exports.RequestOutcome = exports.ErrorType = exports.codedUnauthorized = exports.codedTooManyRequests = exports.codedBadRequest = exports.AppErrorCode = exports.AppEvent = exports.auditContext = exports.User = exports.PasswordHistory = exports.Scope = exports.Role = exports.Resource = exports.Permission = exports.Group = exports.Action = exports.NotificationScope = exports.NotificationRead = exports.Notification = exports.AuthToken = exports.RequestLog = exports.AuditDataChange = void 0;
 var bootstrapCore_util_1 = require("./core/bootstrap/bootstrapCore.util");
 Object.defineProperty(exports, "bootstrapCore", { enumerable: true, get: function () { return bootstrapCore_util_1.bootstrapCore; } });
 var core_module_1 = require("./core/core.module");
@@ -44,6 +44,10 @@ var jwtAuth_guard_1 = require("./core/auth/guards/jwtAuth.guard");
 Object.defineProperty(exports, "JwtAuthGuard", { enumerable: true, get: function () { return jwtAuth_guard_1.JwtAuthGuard; } });
 var permissions_guard_1 = require("./core/auth/guards/permissions.guard");
 Object.defineProperty(exports, "PermissionsGuard", { enumerable: true, get: function () { return permissions_guard_1.PermissionsGuard; } });
+var permissionScope_util_1 = require("./core/auth/permissionScope.util");
+Object.defineProperty(exports, "anyOrTeam", { enumerable: true, get: function () { return permissionScope_util_1.anyOrTeam; } });
+Object.defineProperty(exports, "SCOPE_ANY", { enumerable: true, get: function () { return permissionScope_util_1.SCOPE_ANY; } });
+Object.defineProperty(exports, "SCOPE_TEAM", { enumerable: true, get: function () { return permissionScope_util_1.SCOPE_TEAM; } });
 var applyFilter_util_1 = require("./core/query/applyFilter.util");
 Object.defineProperty(exports, "applyFilter", { enumerable: true, get: function () { return applyFilter_util_1.applyFilter; } });
 var filter_constants_1 = require("./core/query/filter.constants");

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "rl-core-api",
-  "version": "0.4.0",
+  "version": "0.5.0",
   "description": "Core NestJS: autenticação com 2FA, RBAC, auditoria, notificações e listagens com filtro dinâmico",
   "author": "Rodrigo Liberti",
   "license": "MIT",