umpordez 0.0.2 → 1.0.0

package/template/server/apps/api/routes/account.ts

@@ -0,0 +1,98 @@
+import type { Express, Request, Response } from 'express';
+import express from 'express';
+import { z } from 'zod';
+import trySetUserByTokenMiddleware from '#shared/middlewares/try-set-user-by-token.js';
+import demandUserMiddleware from '#shared/middlewares/demand-user.js';
+import demandAccountAccessMiddleware from '#shared/middlewares/demand-account-access.js';
+import { buildHandler } from '#shared/utils.js';
+
+const router = express.Router();
+
+const updateSettingsSchema = z.object({
+    name: z.string().min(1, 'Nome é obrigatório'),
+    settings: z.record(z.unknown()).optional()
+});
+
+const addMemberSchema = z.object({
+    email: z.string().email('Email inválido'),
+    role: z.enum(['owner', 'manager', 'user']).default('user'),
+    name: z.string().min(1).optional(),
+    password: z.string().min(6).optional()
+});
+
+const updateMemberRoleSchema = z.object({
+    role: z.enum(['owner', 'manager', 'user'])
+});
+
+async function handleGetDashboard(req: Request, res: Response): Promise<void> {
+    const dashboard = await req.context.account.getAccountDashboard(
+        req.accountId!
+    );
+
+    res.json({
+        ok: true,
+        accountId: req.accountId,
+        ...dashboard
+    });
+}
+
+async function handleGetSettings(req: Request, res: Response): Promise<void> {
+    const account = await req.context.account.findById(req.accountId!);
+    res.json({ ok: true, account });
+}
+
+async function handleUpdateSettings(req: Request, res: Response): Promise<void> {
+    const data = updateSettingsSchema.parse(req.body);
+    const account = await req.context.account.update(req.accountId!, data);
+    res.json({ ok: true, account });
+}
+
+async function handleDeleteAccount(req: Request, res: Response): Promise<void> {
+    await req.context.account.delete(req.accountId!, req.user!.id, req.accountRole!);
+    res.json({ ok: true });
+}
+
+async function handleListMembers(req: Request, res: Response): Promise<void> {
+    const page = parseInt(req.query.page as string) || 1;
+    const limit = parseInt(req.query.limit as string) || 20;
+    const search = (req.query.search as string) || '';
+
+    const result = await req.context.account.listMembers(req.accountId!, { page, limit, search });
+    res.json({ ok: true, ...result });
+}
+
+async function handleAddMember(req: Request, res: Response): Promise<void> {
+    const data = addMemberSchema.parse(req.body);
+    const member = await req.context.account.addMember(req.accountId!, data);
+    res.json({ ok: true, member });
+}
+
+async function handleUpdateMemberRole(req: Request, res: Response): Promise<void> {
+    const { role } = updateMemberRoleSchema.parse(req.body);
+    await req.context.account.updateMemberRole(req.accountId!, req.params.userId, role);
+    res.json({ ok: true });
+}
+
+async function handleRemoveMember(req: Request, res: Response): Promise<void> {
+    await req.context.account.removeMember(req.accountId!, req.params.userId);
+    res.json({ ok: true });
+}
+
+router.get('/dashboard', buildHandler(handleGetDashboard));
+router.get('/settings', buildHandler(handleGetSettings));
+router.post('/settings', buildHandler(handleUpdateSettings));
+router.delete('/delete', buildHandler(handleDeleteAccount));
+router.get('/members', buildHandler(handleListMembers));
+router.post('/members', buildHandler(handleAddMember));
+router.post('/members/:userId', buildHandler(handleUpdateMemberRole));
+router.delete('/members/:userId', buildHandler(handleRemoveMember));
+
+export default function makeEndpoint(app: Express): void {
+    app.use(
+        '/api/account/:accountId',
+        trySetUserByTokenMiddleware,
+        demandUserMiddleware,
+        demandAccountAccessMiddleware,
+        router
+    );
+}

package/template/server/apps/api/routes/admin.ts

@@ -0,0 +1,80 @@
+import type { Express, Request, Response } from 'express';
+import express from 'express';
+import { z } from 'zod';
+import trySetUserByTokenMiddleware from '#shared/middlewares/try-set-user-by-token.js';
+import demandUserMiddleware from '#shared/middlewares/demand-user.js';
+import demandAdminUserMiddleware from '#shared/middlewares/demand-admin-user.js';
+import { buildHandler } from '#shared/utils.js';
+
+const router = express.Router();
+
+const createUserSchema = z.object({
+    name: z.string().min(1, 'Nome é obrigatório'),
+    email: z.string().email('Email inválido'),
+    password: z.string().min(6, 'Senha deve ter no mínimo 6 caracteres'),
+    role: z.enum(['admin', 'user']).default('user')
+});
+
+const updateUserSchema = z.object({
+    name: z.string().min(1, 'Nome é obrigatório'),
+    email: z.string().email('Email inválido'),
+    role: z.enum(['admin', 'user']).optional(),
+    password: z.string().min(6, 'Senha deve ter no mínimo 6 caracteres').optional()
+});
+
+async function handleGetDashboard(req: Request, res: Response): Promise<void> {
+    const data = await req.context.account.getDashboardStats();
+    res.json({ ok: true, ...data });
+}
+
+async function handleGetAccounts(req: Request, res: Response): Promise<void> {
+    const page = parseInt(req.query.page as string) || 1;
+    const limit = parseInt(req.query.limit as string) || 20;
+    const search = (req.query.search as string) || '';
+
+    const result = await req.context.account.list({ page, limit, search });
+    res.json({ ok: true, ...result });
+}
+
+async function handleGetUsers(req: Request, res: Response): Promise<void> {
+    const page = parseInt(req.query.page as string) || 1;
+    const limit = parseInt(req.query.limit as string) || 20;
+    const search = (req.query.search as string) || '';
+
+    const result = await req.context.user.list({ page, limit, search });
+    res.json({ ok: true, ...result });
+}
+
+async function handleCreateUser(req: Request, res: Response): Promise<void> {
+    const data = createUserSchema.parse(req.body);
+    const user = await req.context.user.create(data);
+    res.json({ ok: true, user });
+}
+
+async function handleUpdateUser(req: Request, res: Response): Promise<void> {
+    const data = updateUserSchema.parse(req.body);
+    const user = await req.context.user.adminUpdate(req.params.id, data);
+    res.json({ ok: true, user });
+}
+
+async function handleDeleteUser(req: Request, res: Response): Promise<void> {
+    await req.context.user.delete(req.params.id, req.user!.id);
+    res.json({ ok: true });
+}
+
+router.get('/dashboard', buildHandler(handleGetDashboard));
+router.get('/accounts', buildHandler(handleGetAccounts));
+router.get('/users', buildHandler(handleGetUsers));
+router.post('/users', buildHandler(handleCreateUser));
+router.post('/users/:id', buildHandler(handleUpdateUser));
+router.delete('/users/:id', buildHandler(handleDeleteUser));
+
+export default function makeEndpoint(app: Express): void {
+    app.use(
+        '/api/admin',
+        trySetUserByTokenMiddleware,
+        demandUserMiddleware,
+        demandAdminUserMiddleware,
+        router
+    );
+}

package/template/server/apps/api/routes/auth.ts

@@ -0,0 +1,222 @@
+import type { Express, Request, Response } from 'express';
+import express from 'express';
+import { z } from 'zod';
+import trySetUserByTokenMiddleware from '#shared/middlewares/try-set-user-by-token.js';
+import demandUserMiddleware from '#shared/middlewares/demand-user.js';
+import { buildHandler } from '#shared/utils.js';
+import { ForbiddenError } from '#core/errors.js';
+import { createS3Upload, generateSignedUrl, deleteFromS3 } from '#core/s3.js';
+import logger from '#core/logger.js';
+
+const router = express.Router();
+
+const COOKIE_OPTIONS = {
+    httpOnly: true,
+    secure: process.env.NODE_ENV === 'production',
+    sameSite: (process.env.NODE_ENV === 'production' ? 'strict' : 'lax') as 'strict' | 'lax',
+    maxAge: 30 * 24 * 60 * 60 * 1000,
+    path: '/'
+};
+
+function setAuthCookie(res: Response, token: string): void {
+    res.cookie('auth_token', token, COOKIE_OPTIONS);
+}
+
+function clearAuthCookie(res: Response): void {
+    res.clearCookie('auth_token', { path: '/' });
+}
+
+const loginSchema = z.object({
+    email: z.string().email('Email inválido'),
+    password: z.string().min(1, 'Senha é obrigatória')
+});
+
+const signupSchema = z.object({
+    email: z.string().email('Email inválido'),
+    password: z.string().min(6, 'Senha deve ter no mínimo 6 caracteres'),
+    name: z.string().min(1, 'Nome é obrigatório'),
+    account_name: z.string().optional()
+});
+
+const forgotPasswordSchema = z.object({
+    email: z.string().email('Email inválido')
+});
+
+const resetPasswordSchema = z.object({
+    password: z.string().min(6, 'Senha deve ter no mínimo 6 caracteres')
+});
+
+const updateProfileSchema = z.object({
+    name: z.string().min(1, 'Nome é obrigatório'),
+    email: z.string().email('Email inválido')
+});
+
+const changePasswordSchema = z.object({
+    current_password: z.string().min(1, 'Senha atual é obrigatória'),
+    new_password: z.string().min(6, 'Nova senha deve ter no mínimo 6 caracteres')
+});
+
+const avatarUpload = createS3Upload({
+    folder: 'avatars',
+    allowedMimeTypes: ['image/jpeg', 'image/png', 'image/jpg', 'image/webp'],
+    maxFileSize: 2 * 1024 * 1024, // 2MB
+});
+
+async function resolveAvatarUrl(avatarKey: string | null): Promise<string | null> {
+    if (!avatarKey) return null;
+    return generateSignedUrl(avatarKey, 3600);
+}
+
+async function userWithAvatar(user: any) {
+    return {
+        id: user.id,
+        email: user.email,
+        name: user.name,
+        role: user.role,
+        avatar_url: await resolveAvatarUrl(user.avatar_key)
+    };
+}
+
+async function handleLogin(req: Request, res: Response): Promise<void> {
+    const { email, password } = loginSchema.parse(req.body);
+    const result = await req.context.auth.login(email, password);
+
+    setAuthCookie(res, result.token);
+    const fullUser = await req.context.user.findById(result.user.id);
+    res.json({ ok: true, user: await userWithAvatar(fullUser) });
+}
+
+async function handleSignup(req: Request, res: Response): Promise<void> {
+    const { email, password, name, account_name } = signupSchema.parse(req.body);
+    const result = await req.context.auth.signup({
+        email, password, name, accountName: account_name
+    });
+
+    if (result.existingUser) {
+        res.json({
+            ok: true,
+            existingUser: true,
+            message: 'Uma nova conta foi criada. Como seu email já estava cadastrado, faça login para acessá-la.'
+        });
+        return;
+    }
+
+    setAuthCookie(res, result.token);
+    res.json({ ok: true, user: result.user, account: result.account });
+}
+
+async function handleLogout(_req: Request, res: Response): Promise<void> {
+    clearAuthCookie(res);
+    res.json({ ok: true });
+}
+
+async function handleForgotPassword(req: Request, res: Response): Promise<void> {
+    const { email } = forgotPasswordSchema.parse(req.body);
+    await req.context.auth.forgotPassword(email);
+    res.json({ ok: true, message: 'Se o email existir, você receberá um link de recuperação' });
+}
+
+async function handleValidateResetToken(req: Request, res: Response): Promise<void> {
+    const valid = await req.context.auth.validateResetToken(req.params.token);
+    res.json({ ok: valid });
+}
+
+async function handleResetPassword(req: Request, res: Response): Promise<void> {
+    const { password } = resetPasswordSchema.parse(req.body);
+    await req.context.auth.resetPassword(req.params.token, password);
+    res.json({ ok: true, message: 'Senha alterada com sucesso' });
+}
+
+async function handleAuth(req: Request, res: Response): Promise<void> {
+    const rawUser = req.user!;
+    const fullUser = await req.context.user.findById(rawUser.id);
+    const user = await userWithAvatar(fullUser);
+    const accountId = req.query.account as string | undefined;
+
+    if (!accountId) {
+        res.json({ ok: true, user });
+        return;
+    }
+
+    const userAccount = await req.context.user.getAccount(
+        rawUser.id, accountId, rawUser.role
+    );
+
+    if (!userAccount) {
+        throw new ForbiddenError('Acesso negado a esta conta');
+    }
+
+    res.json({ ok: true, user, account: userAccount.account, role: userAccount.role });
+}
+
+async function handleGetAccounts(req: Request, res: Response): Promise<void> {
+    const accounts = await req.context.user.getAccounts(req.user!.id);
+    res.json({ ok: true, accounts });
+}
+
+async function handleUpdateProfile(req: Request, res: Response): Promise<void> {
+    const { name, email } = updateProfileSchema.parse(req.body);
+    const user = await req.context.user.updateProfile(req.user!.id, { name, email });
+    res.json({ ok: true, user });
+}
+
+async function handleChangePassword(req: Request, res: Response): Promise<void> {
+    const { current_password, new_password } = changePasswordSchema.parse(req.body);
+    await req.context.auth.changePassword(req.user!.id, current_password, new_password);
+    res.json({ ok: true, message: 'Senha alterada com sucesso' });
+}
+
+async function handleUploadAvatar(req: Request, res: Response): Promise<void> {
+    const file = req.file as Express.MulterS3.File | undefined;
+
+    if (!file) {
+        res.status(400).json({ ok: false, message: 'Nenhuma imagem enviada' });
+        return;
+    }
+
+    // Delete old avatar from S3 if exists
+    const currentUser = await req.context.user.findById(req.user!.id);
+    if (currentUser.avatar_key) {
+        try {
+            await deleteFromS3(currentUser.avatar_key);
+        } catch (err) {
+            logger.error('{auth} failed to delete old avatar', err);
+        }
+    }
+
+    const user = await req.context.user.updateAvatar(req.user!.id, file.key);
+    res.json({ ok: true, user: await userWithAvatar(user) });
+}
+
+async function handleDeleteAvatar(req: Request, res: Response): Promise<void> {
+    const currentUser = await req.context.user.findById(req.user!.id);
+
+    if (currentUser.avatar_key) {
+        try {
+            await deleteFromS3(currentUser.avatar_key);
+        } catch (err) {
+            logger.error('{auth} failed to delete avatar', err);
+        }
+    }
+
+    const user = await req.context.user.updateAvatar(req.user!.id, null);
+    res.json({ ok: true, user: await userWithAvatar(user) });
+}
+
+router.post('/login', buildHandler(handleLogin));
+router.post('/signup', buildHandler(handleSignup));
+router.post('/logout', buildHandler(handleLogout));
+router.post('/forgot-password', buildHandler(handleForgotPassword));
+router.get('/reset-password/:token', buildHandler(handleValidateResetToken));
+router.post('/reset-password/:token', buildHandler(handleResetPassword));
+
+router.get('/auth', trySetUserByTokenMiddleware, demandUserMiddleware, buildHandler(handleAuth));
+router.get('/user/accounts', trySetUserByTokenMiddleware, demandUserMiddleware, buildHandler(handleGetAccounts));
+router.post('/user/update-profile', trySetUserByTokenMiddleware, demandUserMiddleware, buildHandler(handleUpdateProfile));
+router.post('/user/change-password', trySetUserByTokenMiddleware, demandUserMiddleware, buildHandler(handleChangePassword));
+router.post('/user/avatar', trySetUserByTokenMiddleware, demandUserMiddleware, avatarUpload.single('avatar'), buildHandler(handleUploadAvatar));
+router.delete('/user/avatar', trySetUserByTokenMiddleware, demandUserMiddleware, buildHandler(handleDeleteAvatar));
+
+export default function makeEndpoint(app: Express): void {
+    app.use('/api', router);
+}

package/template/server/apps/api/routes/files.ts

@@ -0,0 +1,89 @@
+import type { Express, Request, Response } from 'express';
+import express from 'express';
+import trySetUserByTokenMiddleware from '#shared/middlewares/try-set-user-by-token.js';
+import demandUserMiddleware from '#shared/middlewares/demand-user.js';
+import { buildHandler } from '#shared/utils.js';
+import { createS3Upload, generateSignedUrl, extractS3Key, downloadFromS3 } from '#core/s3.js';
+import { ValidationError, NotFoundError } from '#core/errors.js';
+
+const router = express.Router();
+
+const upload = createS3Upload({
+    folder: 'uploads',
+    allowedMimeTypes: [
+        'application/pdf',
+        'image/jpeg',
+        'image/png',
+        'image/jpg',
+        'application/msword',
+        'application/vnd.openxmlformats-officedocument.wordprocessingml.document',
+        'application/vnd.ms-excel',
+        'application/vnd.openxmlformats-officedocument.spreadsheetml.sheet'
+    ],
+    maxFileSize: 10 * 1024 * 1024, // 10MB
+});
+
+async function handleUpload(req: Request, res: Response): Promise<void> {
+    const file = req.file as Express.MulterS3.File | undefined;
+
+    if (!file) {
+        throw new ValidationError('Nenhum arquivo enviado');
+    }
+
+    res.json({
+        ok: true,
+        file: {
+            url: file.location,
+            key: file.key,
+            originalName: file.originalname,
+            size: file.size,
+            mimetype: file.mimetype
+        }
+    });
+}
+
+async function handleGetSignedUrl(req: Request, res: Response): Promise<void> {
+    const { url } = req.query;
+
+    if (!url || typeof url !== 'string') {
+        throw new ValidationError('URL é obrigatória');
+    }
+
+    const key = extractS3Key(url);
+
+    if (!key) {
+        throw new ValidationError('URL S3 inválida');
+    }
+
+    const signedUrl = await generateSignedUrl(key, 3600);
+    res.json({ ok: true, signedUrl });
+}
+
+async function handleDownload(req: Request, res: Response): Promise<void> {
+    const { key } = req.params;
+
+    if (!key) {
+        throw new ValidationError('Chave do arquivo é obrigatória');
+    }
+
+    try {
+        const buffer = await downloadFromS3(key);
+        res.setHeader('Content-Disposition', `attachment; filename="${key.split('/').pop()}"`);
+        res.send(buffer);
+    } catch {
+        throw new NotFoundError('Arquivo não encontrado');
+    }
+}
+
+router.post('/upload', upload.single('file'), buildHandler(handleUpload));
+router.get('/signed-url', buildHandler(handleGetSignedUrl));
+router.get('/download/:key(*)', buildHandler(handleDownload));
+
+export default function makeEndpoint(app: Express): void {
+    app.use(
+        '/api/files',
+        trySetUserByTokenMiddleware,
+        demandUserMiddleware,
+        router
+    );
+}

package/template/server/apps/api/routes/index.ts

@@ -0,0 +1,19 @@
+import type { Express } from 'express';
+import makeAuthRoute from './auth.js';
+import makeUserRoute from './user.js';
+import makeAccountRoute from './account.js';
+import makeAdminRoute from './admin.js';
+import makeFilesRoute from './files.js';
+
+export default function makeRoutes(app: Express): void {
+    makeAuthRoute(app);
+    makeUserRoute(app);
+    makeAccountRoute(app);
+    makeAdminRoute(app);
+    makeFilesRoute(app);
+
+    // Add new route modules here as the project grows:
+    // makeCompanyRoute(app);
+    // makeEmployeeRoute(app);
+    // makeDocumentRoute(app);
+}

package/template/server/apps/api/routes/user.ts

@@ -0,0 +1,17 @@
+import type { Express } from 'express';
+import express from 'express';
+import trySetUserByTokenMiddleware from '#shared/middlewares/try-set-user-by-token.js';
+import demandUserMiddleware from '#shared/middlewares/demand-user.js';
+
+const router = express.Router();
+
+// Add user-scoped routes here (profile, notifications, preferences, etc.)
+
+export default function makeEndpoint(app: Express): void {
+    app.use(
+        '/api/user',
+        trySetUserByTokenMiddleware,
+        demandUserMiddleware,
+        router
+    );
+}

package/template/server/apps/shared/middlewares/demand-account-access.ts

@@ -0,0 +1,52 @@
+import type { Request, Response, NextFunction } from 'express';
+
+export default async function demandAccountAccess(
+    req: Request,
+    res: Response,
+    next: NextFunction
+): Promise<void> {
+    if (!req.user) {
+        res.status(401).json({
+            ok: false,
+            message: 'Authentication required'
+        });
+        return;
+    }
+
+    const accountId = req.params.accountId || (req.query.accountId as string);
+
+    if (!accountId) {
+        res.status(400).json({
+            ok: false,
+            message: 'Account ID is required'
+        });
+        return;
+    }
+
+    // Admin users have access to all accounts
+    if (req.user.role === 'admin') {
+        req.accountId = accountId;
+        req.accountRole = 'admin';
+        next();
+        return;
+    }
+
+    // Check user has access to this account
+    const userAccount = await req.context.user.getAccount(
+        req.user.id,
+        accountId,
+        req.user.role
+    );
+
+    if (!userAccount) {
+        res.status(403).json({
+            ok: false,
+            message: 'Access to this account is forbidden'
+        });
+        return;
+    }
+
+    req.accountId = accountId;
+    req.accountRole = userAccount.role;
+    next();
+}

package/template/server/apps/shared/middlewares/demand-admin-user.ts

@@ -0,0 +1,25 @@
+import type { Request, Response, NextFunction } from 'express';
+
+export default function demandAdminUser(
+    req: Request,
+    res: Response,
+    next: NextFunction
+): void {
+    if (!req.user) {
+        res.status(401).json({
+            ok: false,
+            message: 'Authentication required'
+        });
+        return;
+    }
+
+    if (req.user.role !== 'admin') {
+        res.status(403).json({
+            ok: false,
+            message: 'Admin access required'
+        });
+        return;
+    }
+
+    next();
+}

package/template/server/apps/shared/middlewares/demand-user.ts

@@ -0,0 +1,17 @@
+import type { Request, Response, NextFunction } from 'express';
+
+export default function demandUser(
+    req: Request,
+    res: Response,
+    next: NextFunction
+): void {
+    if (!req.user) {
+        res.status(401).json({
+            ok: false,
+            message: 'Authentication required'
+        });
+        return;
+    }
+
+    next();
+}

package/template/server/apps/shared/middlewares/error-handler.ts

@@ -0,0 +1,28 @@
+import type { Request, Response, NextFunction } from 'express';
+import { AppError } from '#core/errors.js';
+import logger from '#core/logger.js';
+
+export default function errorHandler(
+    err: Error,
+    req: Request,
+    res: Response,
+    _next: NextFunction
+): void {
+    logger.error(err.message, {
+        stack: err.stack,
+        method: req.method,
+        path: req.originalUrl,
+        ip: req.ip,
+        userId: req.user?.id
+    });
+
+    const statusCode = err instanceof AppError ? err.statusCode : 500;
+    const message = statusCode === 500
+        ? 'Erro interno do servidor'
+        : err.message;
+
+    res.status(statusCode).json({
+        ok: false,
+        message
+    });
+}