rl-core-api 0.4.0 → 0.6.0

package/dist/core/auth/actor.interface.d.ts

@@ -0,0 +1,4 @@
+export interface Actor {
+    id: string;
+    permissions: string[];
+}

package/dist/core/auth/actor.interface.js

@@ -0,0 +1,2 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });

package/dist/core/auth/permissionScope.util.d.ts

@@ -0,0 +1,3 @@
+export declare const SCOPE_ANY = "any";
+export declare const SCOPE_TEAM = "team";
+export declare const anyOrTeam: (action: string) => [string, string];

package/dist/core/auth/permissionScope.util.js

@@ -0,0 +1,10 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.anyOrTeam = exports.SCOPE_TEAM = exports.SCOPE_ANY = void 0;
+exports.SCOPE_ANY = "any";
+exports.SCOPE_TEAM = "team";
+const anyOrTeam = (action) => [
+    `${action}:${exports.SCOPE_ANY}`,
+    `${action}:${exports.SCOPE_TEAM}`,
+];
+exports.anyOrTeam = anyOrTeam;

package/dist/core/config/env.schema.d.ts

@@ -28,6 +28,7 @@ export declare const envSchema: z.ZodObject<{
     JWT_ACCESS_SECRET: z.ZodString;
     JWT_PENDING_SECRET: z.ZodString;
     JWT_ACCESS_EXPIRES: z.ZodDefault<z.ZodString>;
+    JWT_PENDING_EXPIRES: z.ZodDefault<z.ZodString>;
     JWT_REFRESH_EXPIRES_MINUTES: z.ZodDefault<z.ZodCoercedNumber<unknown>>;
     TOTP_ENC_KEY: z.ZodString;
     COOKIE_SECURE: z.ZodDefault<z.ZodPipe<z.ZodEnum<{

package/dist/core/config/env.schema.js

@@ -31,6 +31,7 @@ exports.envSchema = zod_1.z
     JWT_ACCESS_SECRET: zod_1.z.string().min(32),
     JWT_PENDING_SECRET: zod_1.z.string().min(32),
     JWT_ACCESS_EXPIRES: zod_1.z.string().default("4h"),
+    JWT_PENDING_EXPIRES: zod_1.z.string().default("15m"),
     JWT_REFRESH_EXPIRES_MINUTES: zod_1.z.coerce
         .number()
         .int()

package/dist/core/context/auditContext.d.ts

@@ -5,3 +5,4 @@ export interface AuditContextStore {
     requestId?: string | null;
 }
 export declare const auditContext: AsyncLocalStorage<AuditContextStore>;
+export declare const setAuditUser: (userId: string) => void;

package/dist/core/context/auditContext.js

@@ -1,5 +1,12 @@
 "use strict";
 Object.defineProperty(exports, "__esModule", { value: true });
-exports.auditContext = void 0;
+exports.setAuditUser = exports.auditContext = void 0;
 const node_async_hooks_1 = require("node:async_hooks");
 exports.auditContext = new node_async_hooks_1.AsyncLocalStorage();
+const setAuditUser = (userId) => {
+    const store = exports.auditContext.getStore();
+    if (store) {
+        store.userId = userId;
+    }
+};
+exports.setAuditUser = setAuditUser;

package/dist/core/database/migrations/1787270400000-GroupManager.d.ts

@@ -0,0 +1,6 @@
+import { MigrationInterface, QueryRunner } from "typeorm";
+export declare class GroupManager1787270400000 implements MigrationInterface {
+    name: string;
+    up(queryRunner: QueryRunner): Promise<void>;
+    down(queryRunner: QueryRunner): Promise<void>;
+}

package/dist/core/database/migrations/1787270400000-GroupManager.js

@@ -0,0 +1,26 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.GroupManager1787270400000 = void 0;
+class GroupManager1787270400000 {
+    constructor() {
+        this.name = "GroupManager1787270400000";
+    }
+    async up(queryRunner) {
+        await queryRunner.query(`
+      ALTER TABLE \`groups\`
+        ADD COLUMN manager_id char(36) NULL AFTER parent_id,
+        ADD KEY IDX_groups_manager (manager_id),
+        ADD CONSTRAINT FK_groups_manager FOREIGN KEY (manager_id)
+          REFERENCES users (id) ON DELETE SET NULL;
+    `);
+    }
+    async down(queryRunner) {
+        await queryRunner.query(`
+      ALTER TABLE \`groups\`
+        DROP FOREIGN KEY FK_groups_manager,
+        DROP KEY IDX_groups_manager,
+        DROP COLUMN manager_id;
+    `);
+    }
+}
+exports.GroupManager1787270400000 = GroupManager1787270400000;

package/dist/core/database/migrations/index.js

@@ -2,4 +2,8 @@
 Object.defineProperty(exports, "__esModule", { value: true });
 exports.coreMigrations = void 0;
 const _1710000000000_InitialSchema_1 = require("./1710000000000-InitialSchema");
-exports.coreMigrations = [_1710000000000_InitialSchema_1.InitialSchema1710000000000];
+const _1787270400000_GroupManager_1 = require("./1787270400000-GroupManager");
+exports.coreMigrations = [
+    _1710000000000_InitialSchema_1.InitialSchema1710000000000,
+    _1787270400000_GroupManager_1.GroupManager1787270400000,
+];

package/dist/core/events/appEvent.enum.d.ts

@@ -18,6 +18,7 @@ export interface UserTwoFactorResetEvent {
 export interface UserRolesChangedEvent {
     userId: string;
     roleNames: string[];
+    previousRoleNames: string[];
 }
 export interface UserPasswordResetRequestedEvent {
     userId: string;

package/dist/core/filters/appErrorCode.enum.d.ts

@@ -3,7 +3,9 @@ export declare enum AppErrorCode {
     ACCOUNT_INACTIVE = "ACCOUNT_INACTIVE",
     INVALID_CREDENTIALS = "INVALID_CREDENTIALS",
     INVALID_TWO_FACTOR_CODE = "INVALID_TWO_FACTOR_CODE",
+    PENDING_TOKEN_EXPIRED = "PENDING_TOKEN_EXPIRED",
     PASSWORD_REUSED = "PASSWORD_REUSED",
     TOO_MANY_REQUESTS = "TOO_MANY_REQUESTS",
-    INVALID_FILTER = "INVALID_FILTER"
+    INVALID_FILTER = "INVALID_FILTER",
+    GROUP_REQUIRED = "GROUP_REQUIRED"
 }

package/dist/core/filters/appErrorCode.enum.js

@@ -7,7 +7,9 @@ var AppErrorCode;
     AppErrorCode["ACCOUNT_INACTIVE"] = "ACCOUNT_INACTIVE";
     AppErrorCode["INVALID_CREDENTIALS"] = "INVALID_CREDENTIALS";
     AppErrorCode["INVALID_TWO_FACTOR_CODE"] = "INVALID_TWO_FACTOR_CODE";
+    AppErrorCode["PENDING_TOKEN_EXPIRED"] = "PENDING_TOKEN_EXPIRED";
     AppErrorCode["PASSWORD_REUSED"] = "PASSWORD_REUSED";
     AppErrorCode["TOO_MANY_REQUESTS"] = "TOO_MANY_REQUESTS";
     AppErrorCode["INVALID_FILTER"] = "INVALID_FILTER";
+    AppErrorCode["GROUP_REQUIRED"] = "GROUP_REQUIRED";
 })(AppErrorCode || (exports.AppErrorCode = AppErrorCode = {}));

package/dist/core/websocket/baseGateway.d.ts

@@ -16,6 +16,7 @@ export declare abstract class BaseGateway implements OnGatewayConnection, OnGate
     constructor(wsAuth: WsAuthService, env: EnvService);
     handleConnection(socket: Socket): Promise<void>;
     handleDisconnect(socket: Socket): void;
+    requestSessionRefresh(userId: string): void;
     protected emitTo<T>(rooms: string[], event: string, data: T): void;
     private scheduleExpiry;
 }

package/dist/core/websocket/baseGateway.js

@@ -40,12 +40,19 @@ class BaseGateway {
         }
         socket.removeAllListeners();
     }
+    requestSessionRefresh(userId) {
+        this.emitTo([(0, socket_constants_1.userRoom)(userId)], socket_constants_1.SESSION_REFRESH_EVENT, { userId });
+    }
     emitTo(rooms, event, data) {
         const targets = rooms.filter((room) => room.length > 0);
         if (targets.length === 0) {
             this.logger.warn(`Evento ${event} descartado: sem sala de destino`);
             return;
         }
+        if (!this.server) {
+            this.logger.warn(`Evento ${event} descartado: servidor de socket não inicializado`);
+            return;
+        }
         this.server.to(targets).emit(event, (0, socketEvent_envelope_1.wrapSocketEvent)(event, data));
     }
     scheduleExpiry(socket, expiresAt) {

package/dist/features/audit/audit.module.js

@@ -29,6 +29,7 @@ exports.AuditModule = AuditModule = __decorate([
             domain_1.AuditService,
             { provide: core_1.APP_INTERCEPTOR, useClass: presentation_1.AuditInterceptor },
             presentation_1.HttpErrorListener,
+            presentation_1.UserRolesChangedListener,
             infra_1.AuditDataSubscriber,
         ],
         exports: [

package/dist/features/audit/domain/audit.service.d.ts

@@ -1,7 +1,7 @@
 import { Paginated, PaginationQuery } from "../../../core/utils/pagination.util";
 import { AuditDataChangeRepository } from "../infra/repositories/auditDataChange.repository";
 import { RequestLogRepository } from "../infra/repositories/requestLog.repository";
-import { AuditDataChange } from "../infra/schema/auditDataChange.schema";
+import { AuditDataAction, AuditDataChange } from "../infra/schema/auditDataChange.schema";
 import { RequestLog } from "../infra/schema/requestLog.schema";
 import { UserRepository } from "../../users/infra/repositories/user.repository";
 export type WithUserRef<T> = T & {
@@ -19,6 +19,13 @@ export declare class AuditService {
     private readonly logger;
     constructor(requestLogRepo: RequestLogRepository, dataChangeRepo: AuditDataChangeRepository, userRepo: UserRepository);
     recordRequest(data: Partial<RequestLog>): Promise<void>;
+    recordChange(data: {
+        entity: string;
+        entityId: string | null;
+        action: AuditDataAction;
+        oldData: Record<string, unknown> | null;
+        newData: Record<string, unknown> | null;
+    }): Promise<void>;
     listRequests(query: PaginationQuery): Promise<Paginated<WithUserRef<RequestLog>>>;
     listDataChanges(query: PaginationQuery): Promise<Paginated<AuditDataChangeWithUser>>;
     private enrichWithUser;

package/dist/features/audit/domain/audit.service.js

@@ -13,6 +13,7 @@ Object.defineProperty(exports, "__esModule", { value: true });
 exports.AuditService = void 0;
 const common_1 = require("@nestjs/common");
 const typeorm_1 = require("typeorm");
+const auditContext_1 = require("../../../core/context/auditContext");
 const pagination_util_1 = require("../../../core/utils/pagination.util");
 const auditDataChange_repository_1 = require("../infra/repositories/auditDataChange.repository");
 const requestLog_repository_1 = require("../infra/repositories/requestLog.repository");
@@ -32,6 +33,19 @@ let AuditService = AuditService_1 = class AuditService {
             this.logger.warn(`Falha ao gravar RequestLog: ${err.message}`);
         }
     }
+    async recordChange(data) {
+        try {
+            const ctx = auditContext_1.auditContext.getStore();
+            await this.dataChangeRepo.save(this.dataChangeRepo.create({
+                ...data,
+                userId: ctx?.userId ?? null,
+                ipAddress: ctx?.ipAddress ?? null,
+            }));
+        }
+        catch (err) {
+            this.logger.warn(`Falha ao gravar AuditDataChange (${data.entity}): ${err.message}`);
+        }
+    }
     async listRequests(query) {
         const [items, total] = await this.requestLogRepo.findPaginated(query);
         return new pagination_util_1.Paginated(await this.enrichWithUser(items), total, query.page, query.limit);
@@ -56,7 +70,10 @@ let AuditService = AuditService_1 = class AuditService {
             const user = item.userId ? usersById.get(item.userId) : undefined;
             return {
                 ...item,
-                user: user ? { id: user.id, name: user.name, email: user.email } : null,
+                user: user
+                    ?
+                        { id: user.id, name: user.fullName, email: user.email }
+                    : null,
             };
         });
     }

package/dist/features/audit/infra/auditData.subscriber.js

@@ -26,6 +26,7 @@ function entityIdOf(source) {
     return null;
 }
 const EXCLUDED_ENTITIES = new Set([requestLog_schema_1.RequestLog, auditDataChange_schema_1.AuditDataChange, authToken_schema_1.AuthToken, passwordHistory_schema_1.PasswordHistory].map((entity) => entity.name));
+const isJunction = (metadata) => metadata.isJunction;
 const BASE_FIELDS = new Set(["id", "createdAt", "updatedAt", "deletedAt"]);
 const SENSITIVE_FIELDS = {
     User: new Set(["password", "twoFactorSecret", "backupCodes"]),
@@ -47,7 +48,7 @@ let AuditDataSubscriber = AuditDataSubscriber_1 = class AuditDataSubscriber {
         dataSource.subscribers.push(this);
     }
     async afterInsert(event) {
-        if (EXCLUDED_ENTITIES.has(event.metadata.name)) {
+        if (isJunction(event.metadata) || EXCLUDED_ENTITIES.has(event.metadata.name)) {
             return;
         }
         await this.persist(event.metadata, event.manager, {
@@ -58,7 +59,7 @@ let AuditDataSubscriber = AuditDataSubscriber_1 = class AuditDataSubscriber {
         });
     }
     async afterUpdate(event) {
-        if (EXCLUDED_ENTITIES.has(event.metadata.name)) {
+        if (isJunction(event.metadata) || EXCLUDED_ENTITIES.has(event.metadata.name)) {
             return;
         }
         if (!event.updatedColumns.length) {
@@ -92,7 +93,7 @@ let AuditDataSubscriber = AuditDataSubscriber_1 = class AuditDataSubscriber {
         await this.recordRemoval(event);
     }
     async recordRemoval(event) {
-        if (EXCLUDED_ENTITIES.has(event.metadata.name)) {
+        if (isJunction(event.metadata) || EXCLUDED_ENTITIES.has(event.metadata.name)) {
             return;
         }
         await this.persist(event.metadata, event.manager, {

package/dist/features/audit/presentation/audit.interceptor.js

@@ -39,7 +39,9 @@ let AuditInterceptor = class AuditInterceptor {
         res.setHeader("X-Request-Id", requestId);
         req.requestId = requestId;
         const auditable = this.reflector.getAllAndOverride(auditable_decorator_1.AUDITABLE_KEY, [context.getHandler(), context.getClass()]);
-        const action = typeof auditable === "string" ? auditable : auditable ? `${method} ${req.path}` : null;
+        const action = auditable
+            ? (auditable.action ?? `${method} ${req.path}`)
+            : null;
         const logContext = { action, startedAt: start, userId: user?.id ?? null };
         (0, requestLog_context_1.setRequestLogContext)(req, logContext);
         res.once("finish", () => {
@@ -47,7 +49,11 @@ let AuditInterceptor = class AuditInterceptor {
             if (res.statusCode >= 400) {
                 return;
             }
-            if (!action && durationMs < this.env.get("AUDIT_SLOW_REQUEST_MS")) {
+            const slow = durationMs >= this.env.get("AUDIT_SLOW_REQUEST_MS");
+            if (!action && !slow) {
+                return;
+            }
+            if (action && !slow && !auditable.allowSystem && !logContext.userId) {
                 return;
             }
             void this.audit.recordRequest({

package/dist/features/audit/presentation/decorators/auditable.decorator.d.ts

@@ -1,3 +1,10 @@
 import { CustomDecorator } from "@nestjs/common";
 export declare const AUDITABLE_KEY = "auditable";
-export declare const Auditable: (action?: string) => CustomDecorator<string>;
+export interface AuditableOptions {
+    allowSystem?: boolean;
+}
+export interface AuditableMetadata {
+    action: string | null;
+    allowSystem: boolean;
+}
+export declare const Auditable: (action?: string, options?: AuditableOptions) => CustomDecorator<string>;

package/dist/features/audit/presentation/decorators/auditable.decorator.js

@@ -3,5 +3,8 @@ Object.defineProperty(exports, "__esModule", { value: true });
 exports.Auditable = exports.AUDITABLE_KEY = void 0;
 const common_1 = require("@nestjs/common");
 exports.AUDITABLE_KEY = "auditable";
-const Auditable = (action) => (0, common_1.SetMetadata)(exports.AUDITABLE_KEY, action ?? true);
+const Auditable = (action, options) => (0, common_1.SetMetadata)(exports.AUDITABLE_KEY, {
+    action: action ?? null,
+    allowSystem: options?.allowSystem ?? false,
+});
 exports.Auditable = Auditable;

package/dist/features/audit/presentation/index.d.ts

@@ -2,3 +2,4 @@ export * from "./audit.controller";
 export * from "./audit.interceptor";
 export * from "./decorators/auditable.decorator";
 export * from "./httpError.listener";
+export * from "./userRolesChanged.listener";

package/dist/features/audit/presentation/index.js

@@ -18,3 +18,4 @@ __exportStar(require("./audit.controller"), exports);
 __exportStar(require("./audit.interceptor"), exports);
 __exportStar(require("./decorators/auditable.decorator"), exports);
 __exportStar(require("./httpError.listener"), exports);
+__exportStar(require("./userRolesChanged.listener"), exports);

package/dist/features/audit/presentation/userRolesChanged.listener.d.ts

@@ -0,0 +1,7 @@
+import { UserRolesChangedEvent } from "../../../core/events/appEvent.enum";
+import { AuditService } from "../domain/audit.service";
+export declare class UserRolesChangedListener {
+    private readonly audit;
+    constructor(audit: AuditService);
+    onRolesChanged(event: UserRolesChangedEvent): Promise<void>;
+}

package/dist/features/audit/presentation/userRolesChanged.listener.js

@@ -0,0 +1,43 @@
+"use strict";
+var __decorate = (this && this.__decorate) || function (decorators, target, key, desc) {
+    var c = arguments.length, r = c < 3 ? target : desc === null ? desc = Object.getOwnPropertyDescriptor(target, key) : desc, d;
+    if (typeof Reflect === "object" && typeof Reflect.decorate === "function") r = Reflect.decorate(decorators, target, key, desc);
+    else for (var i = decorators.length - 1; i >= 0; i--) if (d = decorators[i]) r = (c < 3 ? d(r) : c > 3 ? d(target, key, r) : d(target, key)) || r;
+    return c > 3 && r && Object.defineProperty(target, key, r), r;
+};
+var __metadata = (this && this.__metadata) || function (k, v) {
+    if (typeof Reflect === "object" && typeof Reflect.metadata === "function") return Reflect.metadata(k, v);
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.UserRolesChangedListener = void 0;
+const common_1 = require("@nestjs/common");
+const event_emitter_1 = require("@nestjs/event-emitter");
+const appEvent_enum_1 = require("../../../core/events/appEvent.enum");
+const audit_service_1 = require("../domain/audit.service");
+const auditDataChange_schema_1 = require("../infra/schema/auditDataChange.schema");
+const asLabel = (names) => names.length ? [...names].sort().join(", ") : "—";
+let UserRolesChangedListener = class UserRolesChangedListener {
+    constructor(audit) {
+        this.audit = audit;
+    }
+    async onRolesChanged(event) {
+        await this.audit.recordChange({
+            entity: "User",
+            entityId: event.userId,
+            action: auditDataChange_schema_1.AuditDataAction.UPDATE,
+            oldData: { roles: asLabel(event.previousRoleNames) },
+            newData: { roles: asLabel(event.roleNames) },
+        });
+    }
+};
+exports.UserRolesChangedListener = UserRolesChangedListener;
+__decorate([
+    (0, event_emitter_1.OnEvent)(appEvent_enum_1.AppEvent.USER_ROLES_CHANGED),
+    __metadata("design:type", Function),
+    __metadata("design:paramtypes", [Object]),
+    __metadata("design:returntype", Promise)
+], UserRolesChangedListener.prototype, "onRolesChanged", null);
+exports.UserRolesChangedListener = UserRolesChangedListener = __decorate([
+    (0, common_1.Injectable)(),
+    __metadata("design:paramtypes", [audit_service_1.AuditService])
+], UserRolesChangedListener);

package/dist/features/auth/domain/auth.service.d.ts

@@ -14,6 +14,11 @@ interface RequestCtx {
     userAgent?: string;
 }
 export type LoginStatus = "SETUP_REQUIRED" | "TOTP_REQUIRED";
+export interface LoginChallenge {
+    status: LoginStatus;
+    pendingToken: string;
+    expiresInSeconds: number;
+}
 export type SessionUser = AuthenticatedUser;
 export interface LoginSession {
     accessToken: string;
@@ -42,10 +47,7 @@ export declare class AuthService {
     private readonly rbac;
     private dummyHash?;
     constructor(users: UsersService, tokens: TokenService, twoFactor: TwoFactorService, jwt: JwtService, env: EnvService, mailer: MailerService, rbac: RbacService);
-    login(dto: LoginCommand): Promise<{
-        status: LoginStatus;
-        pendingToken: string;
-    }>;
+    login(dto: LoginCommand): Promise<LoginChallenge>;
     setupTotp(pendingToken: string): Promise<TotpSetup>;
     requestEmailCode(pendingToken: string): Promise<{
         sent: boolean;
@@ -58,6 +60,7 @@ export declare class AuthService {
     inspectPasswordToken(token: string): Promise<PasswordTokenCheck>;
     resetPassword(token: string, newPassword: string): Promise<void>;
     private buildPendingToken;
+    private pendingExpiresIn;
     private decodePending;
     private signAccessToken;
     toSessionUser(user: User): Promise<SessionUser>;

package/dist/features/auth/domain/auth.service.js

@@ -13,6 +13,7 @@ exports.AuthService = void 0;
 const common_1 = require("@nestjs/common");
 const jwt_1 = require("@nestjs/jwt");
 const env_service_1 = require("../../../core/config/env.service");
+const auditContext_1 = require("../../../core/context/auditContext");
 const appErrorCode_enum_1 = require("../../../core/filters/appErrorCode.enum");
 const mailer_service_1 = require("../../../core/mailer/mailer.service");
 const codedError_util_1 = require("../../../core/utils/codedError.util");
@@ -30,7 +31,6 @@ function attemptsWarning(prefix, remaining) {
     const attempts = remaining === 1 ? "Resta 1 tentativa" : `Restam ${remaining} tentativas`;
     return `${prefix}. ${attempts} antes do bloqueio da conta`;
 }
-const PENDING_EXPIRES = "10m";
 let AuthService = class AuthService {
     constructor(users, tokens, twoFactor, jwt, env, mailer, rbac) {
         this.users = users;
@@ -69,6 +69,7 @@ let AuthService = class AuthService {
         return {
             status: user.twoFactorEnabled ? "TOTP_REQUIRED" : "SETUP_REQUIRED",
             pendingToken,
+            expiresInSeconds: this.pendingExpiresIn(pendingToken),
         };
     }
     async setupTotp(pendingToken) {
@@ -77,6 +78,12 @@ let AuthService = class AuthService {
             throw new common_1.BadRequestException("2FA já está configurado para esta conta");
         }
         const user = await this.users.findById(payload.sub);
+        const pendingSecret = !user.twoFactorEnabled
+            ? user.twoFactorSecret
+            : null;
+        if (pendingSecret) {
+            return this.twoFactor.rebuildSetup(user.email, pendingSecret);
+        }
         const setup = await this.twoFactor.generateSetup(user.email);
         user.twoFactorSecret = this.twoFactor.encrypt(setup.secret);
         await this.users.save(user);
@@ -208,6 +215,7 @@ let AuthService = class AuthService {
         if (!consumed) {
             throw invalidToken();
         }
+        (0, auditContext_1.setAuditUser)(consumed.userId);
         await this.users.resetPassword(consumed.userId, newPassword);
         await this.tokens.revokeAllRefresh(consumed.userId);
     }
@@ -220,9 +228,16 @@ let AuthService = class AuthService {
         };
         return this.jwt.signAsync(payload, {
             secret: this.env.get("JWT_PENDING_SECRET"),
-            expiresIn: PENDING_EXPIRES,
+            expiresIn: this.env.get("JWT_PENDING_EXPIRES"),
         });
     }
+    pendingExpiresIn(token) {
+        const decoded = this.jwt.decode(token);
+        if (!decoded?.exp) {
+            return 0;
+        }
+        return Math.max(0, decoded.exp - Math.floor(Date.now() / 1000));
+    }
     async decodePending(token) {
         try {
             const payload = await this.jwt.verifyAsync(token, {
@@ -233,8 +248,11 @@ let AuthService = class AuthService {
             }
             return payload;
         }
-        catch {
-            throw new common_1.UnauthorizedException("Token de verificação inválido ou expirado");
+        catch (err) {
+            if (err?.name === "TokenExpiredError") {
+                throw (0, codedError_util_1.codedUnauthorized)("A verificação expirou. Entre novamente para continuar", appErrorCode_enum_1.AppErrorCode.PENDING_TOKEN_EXPIRED);
+            }
+            throw new common_1.UnauthorizedException("Token de verificação inválido");
         }
     }
     signAccessToken(user) {

package/dist/features/auth/domain/twoFactor.service.d.ts

@@ -9,7 +9,9 @@ export declare class TwoFactorService {
     private readonly logger;
     constructor(env: EnvService);
     generateSetup(accountEmail: string): Promise<TotpSetup>;
+    private buildSetup;
     encrypt(secret: string): string;
+    rebuildSetup(accountEmail: string, storedSecret: string): Promise<TotpSetup>;
     verifyTotp(code: string, storedSecret: string): Promise<boolean>;
     generateBackupCodes(): Promise<{
         plain: string[];

package/dist/features/auth/domain/twoFactor.service.js

@@ -55,8 +55,10 @@ let TwoFactorService = TwoFactorService_1 = class TwoFactorService {
         this.env = env;
         this.logger = new common_1.Logger(TwoFactorService_1.name);
     }
-    async generateSetup(accountEmail) {
-        const secret = (0, otplib_1.generateSecret)();
+    generateSetup(accountEmail) {
+        return this.buildSetup(accountEmail, (0, otplib_1.generateSecret)());
+    }
+    async buildSetup(accountEmail, secret) {
         const issuer = this.env.brand().totpIssuer;
         const otpauthUrl = (0, otplib_1.generateURI)({ issuer, label: accountEmail, secret });
         const qrDataUrl = await QRCode.toDataURL(otpauthUrl);
@@ -65,6 +67,9 @@ let TwoFactorService = TwoFactorService_1 = class TwoFactorService {
     encrypt(secret) {
         return (0, crypto_util_1.encryptSecret)(secret);
     }
+    rebuildSetup(accountEmail, storedSecret) {
+        return this.buildSetup(accountEmail, (0, crypto_util_1.decryptSecret)(storedSecret));
+    }
     async verifyTotp(code, storedSecret) {
         if (!storedSecret) {
             return false;

package/dist/features/auth/presentation/auth.controller.d.ts

@@ -4,7 +4,7 @@ import { EnvService } from "../../../core/config/env.service";
 import { AuthService } from "../domain/auth.service";
 import { PasswordTokenCheck } from "../domain/auth.service";
 import { SessionUser } from "../domain/auth.service";
-import { LoginStatus } from "../domain/auth.service";
+import { LoginChallenge } from "../domain/auth.service";
 import { TotpSetup } from "../domain/twoFactor.service";
 import { LoginCommand } from "./commands/login.command";
 import { ForgotPasswordCommand, ResetPasswordCommand } from "./commands/password.command";
@@ -25,10 +25,7 @@ export declare class AuthController {
     private readonly auth;
     private readonly env;
     constructor(auth: AuthService, env: EnvService);
-    login(dto: LoginCommand): Promise<{
-        status: LoginStatus;
-        pendingToken: string;
-    }>;
+    login(dto: LoginCommand): Promise<LoginChallenge>;
     setupTotp(dto: PendingTokenCommand): Promise<TotpSetup>;
     requestEmailCode(dto: PendingTokenCommand): Promise<{
         sent: boolean;

package/dist/features/auth/presentation/auth.controller.js

@@ -123,6 +123,7 @@ __decorate([
 __decorate([
     (0, public_decorator_1.Public)(),
     (0, throttler_1.Throttle)({ default: { limit: 5, ttl: 60_000 } }),
+    (0, auditable_decorator_1.Auditable)("E-mail: código de verificação", { allowSystem: true }),
     (0, common_1.Post)("2fa/email"),
     (0, swagger_1.ApiOperation)({ summary: "Fallback: envia código 2FA por email" }),
     __param(0, (0, common_1.Body)()),
@@ -212,7 +213,7 @@ __decorate([
 __decorate([
     (0, public_decorator_1.Public)(),
     (0, throttler_1.Throttle)({ default: { limit: 5, ttl: 60_000 } }),
-    (0, auditable_decorator_1.Auditable)("Solicitação de redefinição de senha"),
+    (0, auditable_decorator_1.Auditable)("E-mail: redefinição de senha", { allowSystem: true }),
     (0, common_1.Post)("forgot-password"),
     (0, common_1.HttpCode)(200),
     (0, swagger_1.ApiOperation)({ summary: "Solicita email de redefinição de senha" }),

package/dist/features/notifications/notifications.module.js

@@ -40,6 +40,6 @@ exports.NotificationsModule = NotificationsModule = __decorate([
             notifications_publisher_1.NotificationsPublisher,
             domainEvents_listener_1.DomainEventsListener,
         ],
-        exports: [notifications_service_1.NotificationsService],
+        exports: [notifications_service_1.NotificationsService, notifications_publisher_1.NotificationsPublisher],
     })
 ], NotificationsModule);

package/dist/features/notifications/presentation/domainEvents.listener.d.ts

@@ -1,11 +1,14 @@
-import { SystemCleanupFailedEvent, UserLockedEvent, UserPasswordExpiringEvent, UserPasswordResetRequestedEvent, UserTwoFactorResetEvent } from "../../../core/events/appEvent.enum";
+import { SystemCleanupFailedEvent, UserLockedEvent, UserPasswordExpiringEvent, UserPasswordResetRequestedEvent, UserRolesChangedEvent, UserTwoFactorResetEvent } from "../../../core/events/appEvent.enum";
+import { NotificationsGateway } from "./notifications.gateway";
 import { NotificationsPublisher } from "./notifications.publisher";
 export declare class DomainEventsListener {
     private readonly publisher;
+    private readonly gateway;
     private readonly logger;
-    constructor(publisher: NotificationsPublisher);
+    constructor(publisher: NotificationsPublisher, gateway: NotificationsGateway);
     onUserLocked(event: UserLockedEvent): Promise<void>;
     onTwoFactorReset(event: UserTwoFactorResetEvent): Promise<void>;
+    onRolesChanged(event: UserRolesChangedEvent): Promise<void>;
     onPasswordResetRequested(event: UserPasswordResetRequestedEvent): Promise<void>;
     onPasswordExpiring(event: UserPasswordExpiringEvent): Promise<void>;
     onCleanupFailed(event: SystemCleanupFailedEvent): Promise<void>;