rl-core-api 0.6.0 → 0.8.0

package/dist/core/queue/queueAdmin.response.js

@@ -0,0 +1,87 @@
+"use strict";
+var __decorate = (this && this.__decorate) || function (decorators, target, key, desc) {
+    var c = arguments.length, r = c < 3 ? target : desc === null ? desc = Object.getOwnPropertyDescriptor(target, key) : desc, d;
+    if (typeof Reflect === "object" && typeof Reflect.decorate === "function") r = Reflect.decorate(decorators, target, key, desc);
+    else for (var i = decorators.length - 1; i >= 0; i--) if (d = decorators[i]) r = (c < 3 ? d(r) : c > 3 ? d(target, key, r) : d(target, key)) || r;
+    return c > 3 && r && Object.defineProperty(target, key, r), r;
+};
+var __metadata = (this && this.__metadata) || function (k, v) {
+    if (typeof Reflect === "object" && typeof Reflect.metadata === "function") return Reflect.metadata(k, v);
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.PaginatedQueueJobsResponse = exports.QueueJobResponse = exports.QueueCountsResponse = void 0;
+const swagger_1 = require("@nestjs/swagger");
+const paginationMeta_response_1 = require("../utils/paginationMeta.response");
+class QueueCountsResponse {
+}
+exports.QueueCountsResponse = QueueCountsResponse;
+__decorate([
+    (0, swagger_1.ApiProperty)({ example: 3 }),
+    __metadata("design:type", Number)
+], QueueCountsResponse.prototype, "waiting", void 0);
+__decorate([
+    (0, swagger_1.ApiProperty)({ example: 1 }),
+    __metadata("design:type", Number)
+], QueueCountsResponse.prototype, "active", void 0);
+__decorate([
+    (0, swagger_1.ApiProperty)({ example: 128 }),
+    __metadata("design:type", Number)
+], QueueCountsResponse.prototype, "completed", void 0);
+__decorate([
+    (0, swagger_1.ApiProperty)({ example: 2 }),
+    __metadata("design:type", Number)
+], QueueCountsResponse.prototype, "failed", void 0);
+__decorate([
+    (0, swagger_1.ApiProperty)({ example: 0 }),
+    __metadata("design:type", Number)
+], QueueCountsResponse.prototype, "delayed", void 0);
+class QueueJobResponse {
+}
+exports.QueueJobResponse = QueueJobResponse;
+__decorate([
+    (0, swagger_1.ApiProperty)({ example: "42" }),
+    __metadata("design:type", String)
+], QueueJobResponse.prototype, "id", void 0);
+__decorate([
+    (0, swagger_1.ApiProperty)({ example: "funkos:import" }),
+    __metadata("design:type", String)
+], QueueJobResponse.prototype, "name", void 0);
+__decorate([
+    (0, swagger_1.ApiProperty)({ example: "failed" }),
+    __metadata("design:type", String)
+], QueueJobResponse.prototype, "state", void 0);
+__decorate([
+    (0, swagger_1.ApiProperty)({ type: String, format: "uuid", nullable: true }),
+    __metadata("design:type", Object)
+], QueueJobResponse.prototype, "ownerId", void 0);
+__decorate([
+    (0, swagger_1.ApiProperty)({ example: 2 }),
+    __metadata("design:type", Number)
+], QueueJobResponse.prototype, "attemptsMade", void 0);
+__decorate([
+    (0, swagger_1.ApiProperty)({ type: Number, nullable: true, example: 69 }),
+    __metadata("design:type", Object)
+], QueueJobResponse.prototype, "percent", void 0);
+__decorate([
+    (0, swagger_1.ApiProperty)({ type: String, nullable: true }),
+    __metadata("design:type", Object)
+], QueueJobResponse.prototype, "failedReason", void 0);
+__decorate([
+    (0, swagger_1.ApiProperty)({ format: "date-time" }),
+    __metadata("design:type", String)
+], QueueJobResponse.prototype, "createdAt", void 0);
+__decorate([
+    (0, swagger_1.ApiProperty)({ type: String, format: "date-time", nullable: true }),
+    __metadata("design:type", Object)
+], QueueJobResponse.prototype, "finishedAt", void 0);
+class PaginatedQueueJobsResponse {
+}
+exports.PaginatedQueueJobsResponse = PaginatedQueueJobsResponse;
+__decorate([
+    (0, swagger_1.ApiProperty)({ type: QueueJobResponse, isArray: true }),
+    __metadata("design:type", Array)
+], PaginatedQueueJobsResponse.prototype, "items", void 0);
+__decorate([
+    (0, swagger_1.ApiProperty)({ type: paginationMeta_response_1.PaginationMetaResponse }),
+    __metadata("design:type", paginationMeta_response_1.PaginationMetaResponse)
+], PaginatedQueueJobsResponse.prototype, "meta", void 0);

package/dist/core/queue/queueAdmin.service.d.ts

@@ -0,0 +1,15 @@
+import { QueueCounts, QueueJobSummary } from "./job.interface";
+import { JobProducer } from "./job.producer";
+import { Paginated } from "../utils/pagination.util";
+export declare const LISTABLE_STATES: readonly ["waiting", "active", "completed", "failed", "delayed"];
+export type ListableState = (typeof LISTABLE_STATES)[number];
+export declare class QueueAdminService {
+    private readonly producer;
+    constructor(producer: JobProducer);
+    counts(): Promise<QueueCounts>;
+    list(state: ListableState, page: number, limit: number): Promise<Paginated<QueueJobSummary>>;
+    retry(jobId: string): Promise<void>;
+    remove(jobId: string): Promise<void>;
+    private findJob;
+    private toSummary;
+}

package/dist/core/queue/queueAdmin.service.js

@@ -0,0 +1,85 @@
+"use strict";
+var __decorate = (this && this.__decorate) || function (decorators, target, key, desc) {
+    var c = arguments.length, r = c < 3 ? target : desc === null ? desc = Object.getOwnPropertyDescriptor(target, key) : desc, d;
+    if (typeof Reflect === "object" && typeof Reflect.decorate === "function") r = Reflect.decorate(decorators, target, key, desc);
+    else for (var i = decorators.length - 1; i >= 0; i--) if (d = decorators[i]) r = (c < 3 ? d(r) : c > 3 ? d(target, key, r) : d(target, key)) || r;
+    return c > 3 && r && Object.defineProperty(target, key, r), r;
+};
+var __metadata = (this && this.__metadata) || function (k, v) {
+    if (typeof Reflect === "object" && typeof Reflect.metadata === "function") return Reflect.metadata(k, v);
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.QueueAdminService = exports.LISTABLE_STATES = void 0;
+const common_1 = require("@nestjs/common");
+const job_producer_1 = require("./job.producer");
+const pagination_util_1 = require("../utils/pagination.util");
+exports.LISTABLE_STATES = [
+    "waiting",
+    "active",
+    "completed",
+    "failed",
+    "delayed",
+];
+let QueueAdminService = class QueueAdminService {
+    constructor(producer) {
+        this.producer = producer;
+    }
+    async counts() {
+        const queue = this.producer.requireQueue();
+        const counts = await queue.getJobCounts(...exports.LISTABLE_STATES);
+        return {
+            waiting: counts.waiting ?? 0,
+            active: counts.active ?? 0,
+            completed: counts.completed ?? 0,
+            failed: counts.failed ?? 0,
+            delayed: counts.delayed ?? 0,
+        };
+    }
+    async list(state, page, limit) {
+        const queue = this.producer.requireQueue();
+        const start = (page - 1) * limit;
+        const [jobs, counts] = await Promise.all([
+            queue.getJobs([state], start, start + limit - 1),
+            queue.getJobCounts(state),
+        ]);
+        const items = jobs.filter(Boolean).map((job) => this.toSummary(job, state));
+        return new pagination_util_1.Paginated(items, counts[state] ?? 0, page, limit);
+    }
+    async retry(jobId) {
+        const job = await this.findJob(jobId);
+        await job.retry();
+    }
+    async remove(jobId) {
+        const job = await this.findJob(jobId);
+        await job.remove();
+    }
+    async findJob(jobId) {
+        const queue = this.producer.requireQueue();
+        const job = await queue.getJob(jobId);
+        if (!job) {
+            throw new common_1.NotFoundException("Job não encontrado");
+        }
+        return job;
+    }
+    toSummary(job, state) {
+        const progress = job.progress;
+        return {
+            id: String(job.id),
+            name: job.name,
+            state,
+            ownerId: job.data?.ownerId ?? null,
+            attemptsMade: job.attemptsMade,
+            percent: typeof progress === "object" && progress !== null
+                ? (progress.percent ?? null)
+                : null,
+            failedReason: job.failedReason ?? null,
+            createdAt: new Date(job.timestamp).toISOString(),
+            finishedAt: job.finishedOn ? new Date(job.finishedOn).toISOString() : null,
+        };
+    }
+};
+exports.QueueAdminService = QueueAdminService;
+exports.QueueAdminService = QueueAdminService = __decorate([
+    (0, common_1.Injectable)(),
+    __metadata("design:paramtypes", [job_producer_1.JobProducer])
+], QueueAdminService);

package/dist/core/queue/redisConnection.d.ts

@@ -0,0 +1,2 @@
+import { RedisOptions } from "ioredis";
+export declare const buildRedisOptions: () => RedisOptions;

package/dist/core/queue/redisConnection.js

@@ -0,0 +1,11 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.buildRedisOptions = void 0;
+const buildRedisOptions = () => ({
+    host: process.env.REDIS_HOST,
+    port: Number(process.env.REDIS_PORT) || 6379,
+    password: process.env.REDIS_PASSWORD || undefined,
+    maxRetriesPerRequest: null,
+    enableReadyCheck: false,
+});
+exports.buildRedisOptions = buildRedisOptions;

package/dist/core/websocket/baseGateway.d.ts

@@ -17,6 +17,7 @@ export declare abstract class BaseGateway implements OnGatewayConnection, OnGate
     handleConnection(socket: Socket): Promise<void>;
     handleDisconnect(socket: Socket): void;
     requestSessionRefresh(userId: string): void;
+    emitToUser<T>(userId: string, event: string, data: T): void;
     protected emitTo<T>(rooms: string[], event: string, data: T): void;
     private scheduleExpiry;
 }

package/dist/core/websocket/baseGateway.js

@@ -43,6 +43,9 @@ class BaseGateway {
     requestSessionRefresh(userId) {
         this.emitTo([(0, socket_constants_1.userRoom)(userId)], socket_constants_1.SESSION_REFRESH_EVENT, { userId });
     }
+    emitToUser(userId, event, data) {
+        this.emitTo([(0, socket_constants_1.userRoom)(userId)], event, data);
+    }
     emitTo(rooms, event, data) {
         const targets = rooms.filter((room) => room.length > 0);
         if (targets.length === 0) {

package/dist/features/audit/audit.module.js

@@ -29,6 +29,7 @@ exports.AuditModule = AuditModule = __decorate([
             domain_1.AuditService,
             { provide: core_1.APP_INTERCEPTOR, useClass: presentation_1.AuditInterceptor },
             presentation_1.HttpErrorListener,
+            presentation_1.UserPermissionsChangedListener,
             presentation_1.UserRolesChangedListener,
             infra_1.AuditDataSubscriber,
         ],

package/dist/features/audit/presentation/index.d.ts

@@ -2,4 +2,5 @@ export * from "./audit.controller";
 export * from "./audit.interceptor";
 export * from "./decorators/auditable.decorator";
 export * from "./httpError.listener";
+export * from "./userPermissionsChanged.listener";
 export * from "./userRolesChanged.listener";

package/dist/features/audit/presentation/index.js

@@ -18,4 +18,5 @@ __exportStar(require("./audit.controller"), exports);
 __exportStar(require("./audit.interceptor"), exports);
 __exportStar(require("./decorators/auditable.decorator"), exports);
 __exportStar(require("./httpError.listener"), exports);
+__exportStar(require("./userPermissionsChanged.listener"), exports);
 __exportStar(require("./userRolesChanged.listener"), exports);

package/dist/features/audit/presentation/userPermissionsChanged.listener.d.ts

@@ -0,0 +1,7 @@
+import { UserPermissionsChangedEvent } from "../../../core/events/appEvent.enum";
+import { AuditService } from "../domain/audit.service";
+export declare class UserPermissionsChangedListener {
+    private readonly audit;
+    constructor(audit: AuditService);
+    onPermissionsChanged(event: UserPermissionsChangedEvent): Promise<void>;
+}

package/dist/features/audit/presentation/userPermissionsChanged.listener.js

@@ -0,0 +1,43 @@
+"use strict";
+var __decorate = (this && this.__decorate) || function (decorators, target, key, desc) {
+    var c = arguments.length, r = c < 3 ? target : desc === null ? desc = Object.getOwnPropertyDescriptor(target, key) : desc, d;
+    if (typeof Reflect === "object" && typeof Reflect.decorate === "function") r = Reflect.decorate(decorators, target, key, desc);
+    else for (var i = decorators.length - 1; i >= 0; i--) if (d = decorators[i]) r = (c < 3 ? d(r) : c > 3 ? d(target, key, r) : d(target, key)) || r;
+    return c > 3 && r && Object.defineProperty(target, key, r), r;
+};
+var __metadata = (this && this.__metadata) || function (k, v) {
+    if (typeof Reflect === "object" && typeof Reflect.metadata === "function") return Reflect.metadata(k, v);
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.UserPermissionsChangedListener = void 0;
+const common_1 = require("@nestjs/common");
+const event_emitter_1 = require("@nestjs/event-emitter");
+const appEvent_enum_1 = require("../../../core/events/appEvent.enum");
+const audit_service_1 = require("../domain/audit.service");
+const auditDataChange_schema_1 = require("../infra/schema/auditDataChange.schema");
+const asLabel = (codes) => codes.length ? [...codes].sort().join(", ") : "—";
+let UserPermissionsChangedListener = class UserPermissionsChangedListener {
+    constructor(audit) {
+        this.audit = audit;
+    }
+    async onPermissionsChanged(event) {
+        await this.audit.recordChange({
+            entity: "User",
+            entityId: event.userId,
+            action: auditDataChange_schema_1.AuditDataAction.UPDATE,
+            oldData: { directPermissions: asLabel(event.previousCodes) },
+            newData: { directPermissions: asLabel(event.codes) },
+        });
+    }
+};
+exports.UserPermissionsChangedListener = UserPermissionsChangedListener;
+__decorate([
+    (0, event_emitter_1.OnEvent)(appEvent_enum_1.AppEvent.USER_PERMISSIONS_CHANGED),
+    __metadata("design:type", Function),
+    __metadata("design:paramtypes", [Object]),
+    __metadata("design:returntype", Promise)
+], UserPermissionsChangedListener.prototype, "onPermissionsChanged", null);
+exports.UserPermissionsChangedListener = UserPermissionsChangedListener = __decorate([
+    (0, common_1.Injectable)(),
+    __metadata("design:paramtypes", [audit_service_1.AuditService])
+], UserPermissionsChangedListener);

package/dist/features/notifications/notifications.module.js

@@ -40,6 +40,6 @@ exports.NotificationsModule = NotificationsModule = __decorate([
             notifications_publisher_1.NotificationsPublisher,
             domainEvents_listener_1.DomainEventsListener,
         ],
-        exports: [notifications_service_1.NotificationsService, notifications_publisher_1.NotificationsPublisher],
+        exports: [notifications_service_1.NotificationsService, notifications_publisher_1.NotificationsPublisher, notifications_gateway_1.NotificationsGateway],
     })
 ], NotificationsModule);

package/dist/features/notifications/presentation/domainEvents.listener.d.ts

@@ -1,4 +1,4 @@
-import { SystemCleanupFailedEvent, UserLockedEvent, UserPasswordExpiringEvent, UserPasswordResetRequestedEvent, UserRolesChangedEvent, UserTwoFactorResetEvent } from "../../../core/events/appEvent.enum";
+import { SystemCleanupFailedEvent, UserLockedEvent, UserPasswordExpiringEvent, UserPasswordResetRequestedEvent, UserPermissionsChangedEvent, UserRolesChangedEvent, UserTwoFactorResetEvent } from "../../../core/events/appEvent.enum";
 import { NotificationsGateway } from "./notifications.gateway";
 import { NotificationsPublisher } from "./notifications.publisher";
 export declare class DomainEventsListener {
@@ -9,6 +9,7 @@ export declare class DomainEventsListener {
     onUserLocked(event: UserLockedEvent): Promise<void>;
     onTwoFactorReset(event: UserTwoFactorResetEvent): Promise<void>;
     onRolesChanged(event: UserRolesChangedEvent): Promise<void>;
+    onPermissionsChanged(event: UserPermissionsChangedEvent): Promise<void>;
     onPasswordResetRequested(event: UserPasswordResetRequestedEvent): Promise<void>;
     onPasswordExpiring(event: UserPasswordExpiringEvent): Promise<void>;
     onCleanupFailed(event: SystemCleanupFailedEvent): Promise<void>;

package/dist/features/notifications/presentation/domainEvents.listener.js

@@ -63,6 +63,19 @@ let DomainEventsListener = DomainEventsListener_1 = class DomainEventsListener {
             this.gateway.requestSessionRefresh(event.userId);
         });
     }
+    async onPermissionsChanged(event) {
+        await this.safePublish(appEvent_enum_1.AppEvent.USER_PERMISSIONS_CHANGED, async () => {
+            await this.publisher.publishAndPush({
+                title: "Seus acessos foram ajustados",
+                body: event.codes.length
+                    ? "Um administrador ajustou permissões específicas da sua conta. Parte do sistema pode aparecer diferente para você."
+                    : "Um administrador removeu as permissões específicas da sua conta. Seu acesso volta a ser o dos seus papéis.",
+                type: notificationType_enum_1.NotificationType.INFO,
+                targets: [{ type: scopeType_enum_1.ScopeType.USER, key: event.userId }],
+            });
+            this.gateway.requestSessionRefresh(event.userId);
+        });
+    }
     async onPasswordResetRequested(event) {
         await this.safePublish(appEvent_enum_1.AppEvent.USER_PASSWORD_RESET_REQUESTED, () => this.publisher.publishAndPush({
             title: "Redefinição de senha solicitada",
@@ -118,6 +131,12 @@ __decorate([
     __metadata("design:paramtypes", [Object]),
     __metadata("design:returntype", Promise)
 ], DomainEventsListener.prototype, "onRolesChanged", null);
+__decorate([
+    (0, event_emitter_1.OnEvent)(appEvent_enum_1.AppEvent.USER_PERMISSIONS_CHANGED),
+    __metadata("design:type", Function),
+    __metadata("design:paramtypes", [Object]),
+    __metadata("design:returntype", Promise)
+], DomainEventsListener.prototype, "onPermissionsChanged", null);
 __decorate([
     (0, event_emitter_1.OnEvent)(appEvent_enum_1.AppEvent.USER_PASSWORD_RESET_REQUESTED),
     __metadata("design:type", Function),

package/dist/features/rbac/domain/rbac.catalog.js

@@ -8,31 +8,31 @@ exports.RESOURCES = [
     { name: "groups", description: "Gestão de grupos" },
     { name: "audit", description: "Logs e auditoria" },
     { name: "notifications", description: "Notificações" },
-    { name: "reports", description: "Relatórios" },
-    { name: "resources", description: "Catálogo RBAC — resources" },
-    { name: "actions", description: "Catálogo RBAC — actions" },
-    { name: "scopes", description: "Catálogo RBAC — scopes" },
+    { name: "resources", description: "Controle de acesso — áreas" },
+    { name: "actions", description: "Controle de acesso — ações" },
+    { name: "scopes", description: "Controle de acesso — alcances" },
+    { name: "queues", description: "Fila de processamento em segundo plano" },
 ];
 exports.ACTIONS = [
     { name: "create", description: "Criar" },
     { name: "read", description: "Ler/visualizar" },
     { name: "update", description: "Atualizar" },
     { name: "delete", description: "Remover" },
-    { name: "export", description: "Exportar" },
     { name: "promote", description: "Alterar papel/promover" },
+    { name: "grant", description: "Conceder permissão avulsa, fora de papel" },
+    { name: "manage", description: "Operar (reprocessar, remover)" },
     { name: "deactivate", description: "Ativar/desativar" },
     { name: "reset-password", description: "Resetar senha de usuário" },
     { name: "invite", description: "Enviar link de primeiro acesso" },
     { name: "update-email", description: "Alterar email de usuário" },
     {
         name: "read-trail",
-        description: "Ler trilha de auditoria de dados (old/new data)",
+        description: "Ler trilha de auditoria (tela Auditoria)",
     },
 ];
 exports.SCOPES = [
     { name: "own", description: "Apenas recursos próprios" },
     { name: "team", description: "Recursos da equipe" },
-    { name: "department", description: "Recursos do departamento" },
     { name: "any", description: "Todos os recursos" },
 ];
 exports.PERMISSIONS = [
@@ -54,6 +54,10 @@ exports.PERMISSIONS = [
         code: "users:deactivate:any",
         description: "Ativar/desativar qualquer usuário",
     },
+    {
+        code: "users:grant:any",
+        description: "Conceder permissão diretamente a um usuário, fora de papel — restrito a administradores",
+    },
     {
         code: "users:reset-password:any",
         description: "Resetar senha de qualquer usuário",
@@ -103,12 +107,6 @@ exports.PERMISSIONS = [
         code: "audit:read-trail:any",
         description: "Ler trilha de auditoria de dados (old/new data) — restrito a administradores",
     },
-    { code: "reports:read:any", description: "Ler todos os relatórios" },
-    {
-        code: "reports:read:department",
-        description: "Ler relatórios do departamento",
-    },
-    { code: "reports:export:any", description: "Exportar todos os relatórios" },
     {
         code: "notifications:read:own",
         description: "Ler e marcar como lidas as próprias notificações",
@@ -147,6 +145,14 @@ exports.PERMISSIONS = [
         description: "Atualizar scopes do catálogo RBAC",
     },
     { code: "scopes:delete:any", description: "Remover scopes do catálogo RBAC" },
+    {
+        code: "queues:read:any",
+        description: "Ver a fila de processamento e os jobs de qualquer usuário",
+    },
+    {
+        code: "queues:manage:any",
+        description: "Reprocessar e remover jobs da fila",
+    },
 ];
 exports.ROLES = [
     {
@@ -164,8 +170,6 @@ exports.ROLES = [
             "users:invite:team",
             "users:reset-password:team",
             "users:deactivate:team",
-            "reports:read:department",
-            "reports:read:any",
             "audit:read:any",
             "notifications:read:own",
         ],
@@ -175,7 +179,6 @@ exports.ROLES = [
         description: "Somente leitura",
         permissions: [
             "users:read:own",
-            "reports:read:department",
             "notifications:read:own",
         ],
     },

package/dist/features/rbac/domain/rbac.service.d.ts

@@ -1,3 +1,4 @@
+import { EventEmitter2 } from "@nestjs/event-emitter";
 import { ActionRepository } from "../infra/repositories/action.repository";
 import { GroupRepository } from "../infra/repositories/group.repository";
 import { PermissionRepository } from "../infra/repositories/permission.repository";
@@ -31,7 +32,8 @@ export declare class RbacService {
     private readonly roleRepo;
     private readonly groupRepo;
     private readonly userRepo;
-    constructor(resourceRepo: ResourceRepository, actionRepo: ActionRepository, scopeRepo: ScopeRepository, permissionRepo: PermissionRepository, roleRepo: RoleRepository, groupRepo: GroupRepository, userRepo: UserRepository);
+    private readonly events;
+    constructor(resourceRepo: ResourceRepository, actionRepo: ActionRepository, scopeRepo: ScopeRepository, permissionRepo: PermissionRepository, roleRepo: RoleRepository, groupRepo: GroupRepository, userRepo: UserRepository, events: EventEmitter2);
     getUserPermissionCodes(userId: string): Promise<string[]>;
     getUserRoleNames(userId: string): Promise<string[]>;
     listResources(): Promise<Resource[]>;
@@ -58,6 +60,14 @@ export declare class RbacService {
     deleteRole(id: string): Promise<void>;
     addPermissionToRole(roleId: string, permissionId: string, actorPermissions?: string[]): Promise<Role>;
     removePermissionFromRole(roleId: string, permissionId: string): Promise<Role>;
+    listUserDirectPermissions(userId: string): Promise<Permission[]>;
+    setUserDirectPermissions(userId: string, permissionIds: string[], actorPermissions?: string[]): Promise<Permission[]>;
+    grantDirectPermission(userId: string, permissionId: string, actorPermissions?: string[]): Promise<Permission[]>;
+    revokeDirectPermission(userId: string, permissionId: string): Promise<Permission[]>;
+    private findUserWithDirectPermissions;
+    private replaceDirectPermissions;
+    private sameCodes;
+    private sortedByCode;
     listGroups(): Promise<Group[]>;
     listManagedGroups(managerId: string): Promise<Group[]>;
     getGroup(id: string): Promise<Group>;

package/dist/features/rbac/domain/rbac.service.js

@@ -11,7 +11,9 @@ var __metadata = (this && this.__metadata) || function (k, v) {
 Object.defineProperty(exports, "__esModule", { value: true });
 exports.RbacService = void 0;
 const common_1 = require("@nestjs/common");
+const event_emitter_1 = require("@nestjs/event-emitter");
 const typeorm_1 = require("typeorm");
+const appEvent_enum_1 = require("../../../core/events/appEvent.enum");
 const action_repository_1 = require("../infra/repositories/action.repository");
 const group_repository_1 = require("../infra/repositories/group.repository");
 const permission_repository_1 = require("../infra/repositories/permission.repository");
@@ -20,7 +22,7 @@ const role_repository_1 = require("../infra/repositories/role.repository");
 const scope_repository_1 = require("../infra/repositories/scope.repository");
 const user_repository_1 = require("../../users/infra/repositories/user.repository");
 let RbacService = class RbacService {
-    constructor(resourceRepo, actionRepo, scopeRepo, permissionRepo, roleRepo, groupRepo, userRepo) {
+    constructor(resourceRepo, actionRepo, scopeRepo, permissionRepo, roleRepo, groupRepo, userRepo, events) {
         this.resourceRepo = resourceRepo;
         this.actionRepo = actionRepo;
         this.scopeRepo = scopeRepo;
@@ -28,6 +30,7 @@ let RbacService = class RbacService {
         this.roleRepo = roleRepo;
         this.groupRepo = groupRepo;
         this.userRepo = userRepo;
+        this.events = events;
     }
     async getUserPermissionCodes(userId) {
         const user = await this.userRepo.findOne({
@@ -184,7 +187,10 @@ let RbacService = class RbacService {
         await this.scopeRepo.softRemove(scope);
     }
     listPermissions() {
-        return this.permissionRepo.find({ order: { code: "ASC" } });
+        return this.permissionRepo.find({
+            order: { code: "ASC" },
+            relations: { resource: true, action: true, scope: true },
+        });
     }
     async createPermission(dto) {
         const exists = await this.permissionRepo.findOne({
@@ -342,6 +348,72 @@ let RbacService = class RbacService {
         await this.roleRepo.save(role);
         return this.getRole(roleId);
     }
+    async listUserDirectPermissions(userId) {
+        const user = await this.findUserWithDirectPermissions(userId);
+        return this.sortedByCode(user.directPermissions ?? []);
+    }
+    async setUserDirectPermissions(userId, permissionIds, actorPermissions) {
+        const user = await this.findUserWithDirectPermissions(userId);
+        const permissions = permissionIds.length
+            ? await this.permissionRepo.findBy({ id: (0, typeorm_1.In)(permissionIds) })
+            : [];
+        if (permissions.length !== permissionIds.length) {
+            throw new common_1.NotFoundException("Alguma das permissões informadas não existe");
+        }
+        this.assertGrantableByActor(permissions, actorPermissions);
+        return this.replaceDirectPermissions(user, permissions);
+    }
+    async grantDirectPermission(userId, permissionId, actorPermissions) {
+        const user = await this.findUserWithDirectPermissions(userId);
+        const permission = await this.permissionRepo.findOneBy({
+            id: permissionId,
+        });
+        if (!permission) {
+            throw new common_1.NotFoundException("Permissão não encontrada");
+        }
+        this.assertGrantableByActor([permission], actorPermissions);
+        const current = user.directPermissions ?? [];
+        if (current.some((p) => p.id === permissionId)) {
+            return this.sortedByCode(current);
+        }
+        return this.replaceDirectPermissions(user, [...current, permission]);
+    }
+    async revokeDirectPermission(userId, permissionId) {
+        const user = await this.findUserWithDirectPermissions(userId);
+        const current = user.directPermissions ?? [];
+        return this.replaceDirectPermissions(user, current.filter((p) => p.id !== permissionId));
+    }
+    async findUserWithDirectPermissions(userId) {
+        const user = await this.userRepo.findOne({
+            where: { id: userId },
+            relations: { directPermissions: true },
+        });
+        if (!user) {
+            throw new common_1.NotFoundException("Usuário não encontrado");
+        }
+        return user;
+    }
+    async replaceDirectPermissions(user, permissions) {
+        const previousCodes = (user.directPermissions ?? []).map((p) => p.code);
+        const codes = permissions.map((p) => p.code);
+        user.directPermissions = permissions;
+        await this.userRepo.save(user);
+        if (!this.sameCodes(previousCodes, codes)) {
+            this.events.emit(appEvent_enum_1.AppEvent.USER_PERMISSIONS_CHANGED, {
+                userId: user.id,
+                codes,
+                previousCodes,
+            });
+        }
+        return this.sortedByCode(permissions);
+    }
+    sameCodes(a, b) {
+        const before = new Set(a);
+        return a.length === b.length && b.every((code) => before.has(code));
+    }
+    sortedByCode(permissions) {
+        return [...permissions].sort((a, b) => a.code.localeCompare(b.code));
+    }
     listGroups() {
         return this.groupRepo.find({
             relations: { roles: true },
@@ -446,5 +518,6 @@ exports.RbacService = RbacService = __decorate([
         permission_repository_1.PermissionRepository,
         role_repository_1.RoleRepository,
         group_repository_1.GroupRepository,
-        user_repository_1.UserRepository])
+        user_repository_1.UserRepository,
+        event_emitter_1.EventEmitter2])
 ], RbacService);

package/dist/features/rbac/domain/teamScope.service.d.ts

@@ -6,6 +6,7 @@ export declare class TeamScopeService {
     private readonly rbac;
     constructor(groupRepo: GroupRepository, rbac: RbacService);
     reachableUserIds(actor: Actor, action: string): Promise<string[] | null>;
+    private withSelf;
     managedGroupIds(managerId: string): Promise<string[]>;
     private reachOf;
     assertCanAct(actor: Actor, targetUserId: string, action: string): Promise<void>;

package/dist/features/rbac/domain/teamScope.service.js

@@ -23,11 +23,17 @@ let TeamScopeService = class TeamScopeService {
         if (this.has(actor, action, permissionScope_util_1.SCOPE_ANY)) {
             return null;
         }
-        if (!this.has(actor, action, permissionScope_util_1.SCOPE_TEAM)) {
-            return [];
+        if (this.has(actor, action, permissionScope_util_1.SCOPE_TEAM)) {
+            const reach = await this.reachOf(actor.id);
+            return this.withSelf(reach.userIds, actor.id);
         }
-        const reach = await this.reachOf(actor.id);
-        return reach.userIds;
+        if (this.has(actor, action, permissionScope_util_1.SCOPE_OWN)) {
+            return [actor.id];
+        }
+        return [];
+    }
+    withSelf(userIds, actorId) {
+        return userIds.includes(actorId) ? userIds : [...userIds, actorId];
     }
     async managedGroupIds(managerId) {
         return this.groupRepo.findManagedGroupIds(managerId);

package/dist/features/rbac/infra/schema/scope.schema.js

@@ -17,7 +17,7 @@ let Scope = class Scope extends base_schema_1.BaseEntity {
 };
 exports.Scope = Scope;
 __decorate([
-    (0, swagger_1.ApiProperty)({ description: "own | team | department | any" }),
+    (0, swagger_1.ApiProperty)({ description: "own | team | any" }),
     (0, typeorm_1.Column)({ type: "varchar", length: 100, unique: true }),
     __metadata("design:type", String)
 ], Scope.prototype, "name", void 0);