umpordez 0.0.2 → 1.0.0

package/template/server/core/logger.ts

@@ -0,0 +1,60 @@
+import util from 'util';
+
+const isTTYout = Boolean(process.stdout.isTTY);
+const isTTYerr = Boolean(process.stderr.isTTY);
+
+const colors = {
+    green: isTTYout ? '\x1b[32m' : '',
+    yellow: isTTYout ? '\x1b[33m' : '',
+    red: isTTYerr ? '\x1b[31m' : '',
+    cyan: isTTYout ? '\x1b[36m' : '',
+    reset: (isTTYout || isTTYerr) ? '\x1b[0m' : ''
+};
+
+function ts(): string {
+    return new Date().toISOString();
+}
+
+function fmt(data?: Record<string, unknown>): string {
+    if (!data) return '';
+    return ' ' + util.inspect(data, { depth: 4, colors: isTTYout });
+}
+
+const logger = {
+    info(message: string, data?: Record<string, unknown>): void {
+        console.log(
+            `${ts()} ~ ${colors.green}{info}${colors.reset} ${message}${fmt(data)}`
+        );
+    },
+
+    warn(message: string, data?: Record<string, unknown>): void {
+        console.warn(
+            `${ts()} ~ ${colors.yellow}{warn}${colors.reset} ${message}${fmt(data)}`
+        );
+    },
+
+    error(message: string | Error, data?: Record<string, unknown>): void {
+        if (message instanceof Error) {
+            console.error(
+                `${ts()} ~ ${colors.red}!error!${colors.reset} ${message.message}${fmt(data)}`
+            );
+            if (message.stack) {
+                console.error(message.stack);
+            }
+            return;
+        }
+        console.error(
+            `${ts()} ~ ${colors.red}!error!${colors.reset} ${message}${fmt(data)}`
+        );
+    },
+
+    debug(message: string, data?: Record<string, unknown>): void {
+        if (process.env.DEBUG) {
+            console.debug(
+                `${ts()} ~ ${colors.cyan}{debug}${colors.reset} ${message}${fmt(data)}`
+            );
+        }
+    }
+};
+
+export default logger;

package/template/server/core/models/account.ts

@@ -0,0 +1,319 @@
+import BaseModel from './base.js';
+import logger from '#core/logger.js';
+import { NotFoundError, ForbiddenError, ConflictError, ValidationError } from '#core/errors.js';
+
+interface PaginatedResult<T> {
+    rows: T[];
+    total: number;
+    page: number;
+    limit: number;
+    totalPages: number;
+}
+
+class AccountModel extends BaseModel {
+    async list(options: {
+        page?: number;
+        limit?: number;
+        search?: string;
+    } = {}): Promise<PaginatedResult<{
+        id: string;
+        name: string;
+        status: string;
+        utc_created_on: string;
+    }>> {
+        const page = Math.max(1, options.page || 1);
+        const limit = Math.min(100, Math.max(1, options.limit || 20));
+        const offset = (page - 1) * limit;
+        const search = options.search?.trim();
+
+        const baseQuery = this.knex('accounts');
+        if (search) {
+            baseQuery.whereILike('name', `%${search}%`);
+        }
+
+        const [{ count }] = await baseQuery.clone().count('id as count');
+        const total = parseInt(String(count), 10);
+
+        const rows = await baseQuery.clone()
+            .select('id', 'name', 'status', 'utc_created_on')
+            .orderBy('utc_created_on', 'desc')
+            .limit(limit)
+            .offset(offset);
+
+        return {
+            rows,
+            total,
+            page,
+            limit,
+            totalPages: Math.ceil(total / limit)
+        };
+    }
+
+    async listPublic() {
+        return this.knex('accounts')
+            .select('id', 'name')
+            .where({ status: 'active' })
+            .limit(10);
+    }
+
+    async findById(id: string) {
+        const account = await this.knex('accounts')
+            .where({ id })
+            .first();
+
+        if (!account) {
+            throw new NotFoundError('Conta não encontrada');
+        }
+
+        return {
+            id: account.id,
+            name: account.name,
+            status: account.status,
+            settings: typeof account.settings === 'string'
+                ? JSON.parse(account.settings || '{}')
+                : (account.settings || {})
+        };
+    }
+
+    async update(id: string, data: { name?: string; settings?: Record<string, unknown> }) {
+        await this.findById(id);
+
+        const updateData: Record<string, unknown> = {};
+        if (data.name) updateData.name = data.name;
+        if (data.settings) updateData.settings = JSON.stringify(data.settings);
+
+        if (Object.keys(updateData).length > 0) {
+            await this.knex('accounts').where({ id }).update(updateData);
+        }
+
+        logger.info(`{account} updated account_id=${id}`);
+
+        return this.findById(id);
+    }
+
+    async delete(id: string, userId: string, userRole: string) {
+        if (userRole !== 'owner' && userRole !== 'admin') {
+            throw new ForbiddenError('Apenas proprietários podem excluir contas');
+        }
+
+        await this.findById(id);
+
+        // Delete related data first
+        await this.knex('user_in_accounts').where({ account_id: id }).delete();
+        await this.knex('accounts').where({ id }).delete();
+
+        logger.info(`{account} deleted account_id=${id} by user_id=${userId}`);
+    }
+
+    async listMembers(accountId: string, options: {
+        page?: number;
+        limit?: number;
+        search?: string;
+    } = {}): Promise<PaginatedResult<{
+        id: string;
+        name: string;
+        email: string;
+        role: string;
+        utc_created_on: string;
+    }>> {
+        await this.findById(accountId);
+
+        const page = Math.max(1, options.page || 1);
+        const limit = Math.min(100, Math.max(1, options.limit || 20));
+        const offset = (page - 1) * limit;
+        const search = options.search?.trim();
+
+        const baseQuery = this.knex('user_in_accounts as ua')
+            .join('users as u', 'u.id', 'ua.user_id')
+            .where('ua.account_id', accountId);
+
+        if (search) {
+            baseQuery.where(function () {
+                this.whereILike('u.name', `%${search}%`)
+                    .orWhereILike('u.email', `%${search}%`);
+            });
+        }
+
+        const [{ count }] = await baseQuery.clone().count('ua.user_id as count');
+        const total = parseInt(String(count), 10);
+
+        const rows = await baseQuery.clone()
+            .select(
+                'u.id',
+                'u.name',
+                'u.email',
+                'ua.role',
+                'ua.utc_created_on'
+            )
+            .orderBy('ua.utc_created_on', 'asc')
+            .limit(limit)
+            .offset(offset);
+
+        return {
+            rows,
+            total,
+            page,
+            limit,
+            totalPages: Math.ceil(total / limit)
+        };
+    }
+
+    async addMember(
+        accountId: string,
+        data: { email: string; role: string; name?: string; password?: string }
+    ) {
+        await this.findById(accountId);
+
+        const email = data.email.toLowerCase().trim();
+        let user = await this.knex('users').where({ email }).first();
+
+        if (!user) {
+            if (!data.password || data.password.length < 6) {
+                throw new ValidationError(
+                    'Senha é obrigatória (mínimo 6 caracteres) para novos usuários'
+                );
+            }
+            if (!data.name) {
+                throw new ValidationError('Nome é obrigatório para novos usuários');
+            }
+
+            user = await this.context.user.create({
+                email,
+                password: data.password,
+                name: data.name,
+                role: 'user',
+                skipAccountCreation: true
+            });
+        }
+
+        const existing = await this.knex('user_in_accounts')
+            .where({ user_id: user.id, account_id: accountId })
+            .first();
+
+        if (existing) {
+            throw new ConflictError('Este usuário já faz parte desta conta');
+        }
+
+        await this.knex('user_in_accounts').insert({
+            user_id: user.id,
+            account_id: accountId,
+            role: data.role || 'user'
+        });
+
+        logger.info(`{account} added member user_id=${user.id} to account_id=${accountId} role=${data.role}`);
+
+        return {
+            id: user.id,
+            name: user.name,
+            email: user.email,
+            role: data.role || 'user'
+        };
+    }
+
+    async updateMemberRole(accountId: string, userId: string, role: string) {
+        const member = await this.knex('user_in_accounts')
+            .where({ user_id: userId, account_id: accountId })
+            .first();
+
+        if (!member) {
+            throw new NotFoundError('Membro não encontrado nesta conta');
+        }
+
+        await this.knex('user_in_accounts')
+            .where({ user_id: userId, account_id: accountId })
+            .update({ role });
+
+        logger.info(`{account} updated member role user_id=${userId} account_id=${accountId} role=${role}`);
+    }
+
+    async removeMember(accountId: string, userId: string) {
+        const member = await this.knex('user_in_accounts')
+            .where({ user_id: userId, account_id: accountId })
+            .first();
+
+        if (!member) {
+            throw new NotFoundError('Membro não encontrado nesta conta');
+        }
+
+        if (member.role === 'owner') {
+            throw new ForbiddenError('Não é possível remover o proprietário da conta');
+        }
+
+        await this.knex('user_in_accounts')
+            .where({ user_id: userId, account_id: accountId })
+            .delete();
+
+        logger.info(`{account} removed member user_id=${userId} from account_id=${accountId}`);
+    }
+
+    async getAccountDashboard(accountId: string) {
+        const [membersCount] = await this.knex('user_in_accounts')
+            .where({ account_id: accountId })
+            .count('user_id as count');
+
+        const membersByDay = await this.knex.raw(`
+            SELECT
+                d::date as date,
+                COUNT(ua.user_id)::int as count
+            FROM generate_series(
+                CURRENT_DATE - INTERVAL '13 days',
+                CURRENT_DATE,
+                '1 day'
+            ) d
+            LEFT JOIN user_in_accounts ua
+                ON ua.utc_created_on::date = d::date
+                AND ua.account_id = ?
+            GROUP BY d::date
+            ORDER BY d::date ASC
+        `, [accountId]);
+
+        return {
+            stats: {
+                members: parseInt(String(membersCount.count), 10)
+            },
+            membersByDay: membersByDay.rows
+        };
+    }
+
+    async getDashboardStats() {
+        const [usersCount] = await this.knex('users').count('id as count');
+        const [accountsCount] = await this.knex('accounts').count('id as count');
+
+        const recentUsers = await this.knex('users')
+            .select('id', 'name', 'email', 'role', 'utc_created_on')
+            .orderBy('utc_created_on', 'desc')
+            .limit(5);
+
+        const recentAccounts = await this.knex('accounts')
+            .select('id', 'name', 'status', 'utc_created_on')
+            .orderBy('utc_created_on', 'desc')
+            .limit(5);
+
+        // Users created per day (last 14 days)
+        const usersByDay = await this.knex.raw(`
+            SELECT
+                d::date as date,
+                COUNT(u.id)::int as count
+            FROM generate_series(
+                CURRENT_DATE - INTERVAL '13 days',
+                CURRENT_DATE,
+                '1 day'
+            ) d
+            LEFT JOIN users u ON u.utc_created_on::date = d::date
+            GROUP BY d::date
+            ORDER BY d::date ASC
+        `);
+
+        return {
+            stats: {
+                users: parseInt(String(usersCount.count), 10),
+                accounts: parseInt(String(accountsCount.count), 10)
+            },
+            recentUsers,
+            recentAccounts,
+            usersByDay: usersByDay.rows
+        };
+    }
+}
+
+export default AccountModel;

package/template/server/core/models/auth.ts

@@ -0,0 +1,317 @@
+import bcrypt from 'bcrypt';
+import crypto from 'crypto';
+import jwt from 'jsonwebtoken';
+import BaseModel from './base.js';
+import { sendEmail, isEmailConfigured } from '#core/email.js';
+import logger from '#core/logger.js';
+import {
+    ValidationError,
+    UnauthorizedError,
+    NotFoundError
+} from '#core/errors.js';
+
+export interface User {
+    id: string;
+    email: string;
+    name: string;
+    role: string;
+    utc_created_on: string;
+}
+
+export interface LoginResult {
+    user: User;
+    token: string;
+}
+
+export interface SignupResult {
+    user: User;
+    account: { id: string; name: string; status: string };
+    token: string;
+    existingUser?: false;
+}
+
+export interface SignupExistingUserResult {
+    existingUser: true;
+    account: { id: string; name: string; status: string };
+}
+
+class AuthModel extends BaseModel {
+    generateToken(userId: string): string {
+        return jwt.sign(
+            { user_id: userId },
+            process.env.JWT_TOKEN_SECRET as string,
+            { expiresIn: '30d' }
+        );
+    }
+
+    verifyToken(token: string): { user_id: string } {
+        return jwt.verify(
+            token,
+            process.env.JWT_TOKEN_SECRET as string
+        ) as { user_id: string };
+    }
+
+    async login(email: string, password: string): Promise<LoginResult> {
+        if (!email || !password) {
+            throw new ValidationError('Email e senha são obrigatórios');
+        }
+
+        const user = await this.knex('users')
+            .where({ email: email.toLowerCase().trim() })
+            .first();
+
+        if (!user) {
+            throw new UnauthorizedError('Email ou senha incorretos');
+        }
+
+        const isValid = await bcrypt.compare(password, user.password_hash);
+        if (!isValid) {
+            throw new UnauthorizedError('Email ou senha incorretos');
+        }
+
+        const token = this.generateToken(user.id);
+
+        logger.info(`{auth} login for ${user.email}`);
+
+        return {
+            user: {
+                id: user.id,
+                email: user.email,
+                name: user.name,
+                role: user.role,
+                utc_created_on: user.utc_created_on
+            },
+            token
+        };
+    }
+
+    async signup(data: {
+        email: string;
+        password: string;
+        name: string;
+        accountName?: string;
+    }): Promise<SignupResult | SignupExistingUserResult> {
+        if (!data.email || !data.password) {
+            throw new ValidationError('Email e senha são obrigatórios');
+        }
+        if (!data.name) {
+            throw new ValidationError('Nome é obrigatório');
+        }
+        if (data.password.length < 6) {
+            throw new ValidationError(
+                'A senha deve ter pelo menos 6 caracteres'
+            );
+        }
+
+        const email = data.email.toLowerCase().trim();
+        const existingUser = await this.knex('users').where({ email }).first();
+
+        if (existingUser) {
+            const [account] = await this.knex('accounts')
+                .insert({
+                    name: data.accountName || data.name,
+                    status: 'active',
+                    settings: JSON.stringify({})
+                })
+                .returning('*');
+
+            await this.knex('user_in_accounts').insert({
+                user_id: existingUser.id,
+                account_id: account.id,
+                role: 'owner'
+            });
+
+            logger.info(`{auth} signup existing user=${email}, new account=${account.name}`);
+
+            return {
+                existingUser: true,
+                account: {
+                    id: account.id,
+                    name: account.name,
+                    status: account.status
+                }
+            };
+        }
+
+        const user = await this.context.user.create({
+            email: data.email,
+            password: data.password,
+            name: data.name,
+            role: 'user',
+            accountName: data.accountName
+        });
+
+        const account = await this.knex('user_in_accounts as ua')
+            .join('accounts as a', 'a.id', 'ua.account_id')
+            .where('ua.user_id', user.id)
+            .select('a.id', 'a.name', 'a.status')
+            .first();
+
+        const token = this.generateToken(user.id);
+
+        logger.info(`{auth} signup for ${user.email}, account=${account.name}`);
+
+        if (isEmailConfigured()) {
+            try {
+                await sendEmail(user.email, 'Bem-vindo!', 'accountWelcome', {
+                    user: { name: user.name || user.email }
+                });
+            } catch (emailError) {
+                logger.error('Failed to send welcome email', {
+                    error: emailError instanceof Error
+                        ? emailError.message
+                        : String(emailError)
+                });
+            }
+        }
+
+        return {
+            user,
+            account: {
+                id: account.id,
+                name: account.name,
+                status: account.status
+            },
+            token
+        };
+    }
+
+    async forgotPassword(email: string): Promise<void> {
+        if (!email) {
+            throw new ValidationError('Email é obrigatório');
+        }
+
+        const user = await this.knex('users')
+            .select('id', 'email', 'name')
+            .where({ email: email.toLowerCase().trim() })
+            .first();
+
+        if (!user) {
+            logger.info(`{auth} forgot-password for unknown email: ${email}`);
+            return;
+        }
+
+        const token = crypto.randomBytes(32).toString('hex');
+        const expiresAt = new Date(Date.now() + 60 * 60 * 1000);
+
+        await this.knex('password_reset_tokens')
+            .where({ user_id: user.id, used: false })
+            .update({ used: true });
+
+        await this.knex('password_reset_tokens').insert({
+            user_id: user.id,
+            token,
+            expires_at: expiresAt
+        });
+
+        const baseUiUrl = process.env.BASE_UI_URL || 'http://localhost:{{ADMIN_UI_PORT}}';
+        const recoverPasswordUrl = `${baseUiUrl}/recover/${token}`;
+
+        if (!isEmailConfigured()) {
+            logger.warn(
+                '{auth} email not configured, skipping forgot-password email',
+                { recoverPasswordUrl }
+            );
+            return;
+        }
+
+        logger.info(`{auth} sending forgot-password email to ${user.email}`);
+
+        await sendEmail(user.email, 'Recupere sua senha', 'forgetPassword', {
+            user: { name: user.name || user.email },
+            recoverPasswordUrl
+        });
+    }
+
+    async validateResetToken(token: string): Promise<boolean> {
+        const resetToken = await this.knex('password_reset_tokens')
+            .where({ token, used: false })
+            .where('expires_at', '>', new Date())
+            .first();
+
+        return !!resetToken;
+    }
+
+    async resetPassword(token: string, password: string): Promise<void> {
+        if (!token || !password || password.length < 6) {
+            throw new ValidationError(
+                'Token e senha válida são obrigatórios'
+            );
+        }
+
+        const resetToken = await this.knex('password_reset_tokens')
+            .where({ token, used: false })
+            .where('expires_at', '>', new Date())
+            .first();
+
+        if (!resetToken) {
+            throw new NotFoundError('Token inválido ou expirado');
+        }
+
+        const passwordHash = await bcrypt.hash(password, 10);
+
+        await this.knex('users')
+            .where({ id: resetToken.user_id })
+            .update({ password_hash: passwordHash });
+
+        await this.knex('password_reset_tokens')
+            .where({ id: resetToken.id })
+            .update({ used: true });
+
+        logger.info(`{auth} password reset for user_id=${resetToken.user_id}`);
+    }
+
+    async changePassword(
+        userId: string,
+        currentPassword: string,
+        newPassword: string
+    ): Promise<void> {
+        if (!currentPassword || !newPassword) {
+            throw new ValidationError(
+                'Senha atual e nova senha são obrigatórias'
+            );
+        }
+        if (newPassword.length < 6) {
+            throw new ValidationError(
+                'A nova senha deve ter pelo menos 6 caracteres'
+            );
+        }
+
+        const user = await this.knex('users')
+            .select('id', 'password_hash')
+            .where({ id: userId })
+            .first();
+
+        if (!user?.password_hash) {
+            throw new NotFoundError('Usuário não encontrado');
+        }
+
+        const isValid = await bcrypt.compare(currentPassword, user.password_hash);
+        if (!isValid) {
+            throw new ValidationError('Senha atual incorreta');
+        }
+
+        const newHash = await bcrypt.hash(newPassword, 10);
+        await this.knex('users')
+            .where({ id: userId })
+            .update({ password_hash: newHash });
+
+        logger.info(`{auth} password changed for user_id=${userId}`);
+    }
+
+    async getUserByToken(token: string): Promise<User | null> {
+        try {
+            const decoded = this.verifyToken(token);
+            const user = await this.knex('users')
+                .select('id', 'email', 'name', 'role', 'utc_created_on')
+                .where({ id: decoded.user_id })
+                .first();
+
+            return user || null;
+        } catch {
+            return null;
+        }
+    }
+}
+
+export default AuthModel;

package/template/server/core/models/base.ts

@@ -0,0 +1,19 @@
+import type { Knex } from 'knex';
+import Db from '#core/db.js';
+import type Context from '#core/context.js';
+
+const db = new Db();
+
+class BaseModel {
+    knex: Knex;
+    db: Db;
+    context: Context;
+
+    constructor(context: Context) {
+        this.context = context;
+        this.db = db;
+        this.knex = db.knex;
+    }
+}
+
+export default BaseModel;