feat: implement authentication and RBAC
- packages/auth: Argon2id password hashing, JWT access tokens (jose), opaque refresh tokens with rotation, generic error messages (no user-enumeration via timing or message differences) - roles/permissions/role_permissions/user_roles/sessions/audit_logs schema (agente.md secoes 142-150); RBAC scope PLATFORM vs TENANT - withUserContext(): narrow RLS exception so a user can discover their own tenant_memberships before a tenant is chosen (login flow) - userHasPermission()/isPlatformUser(): explicit service-layer RBAC checks (roles/permissions tables are not RLS-protected — documented why in docs/AUTHENTICATION.md) - seed: permission catalog, 4 system roles, initial Platform Super Admin (password written once to FIRST_LOGIN.txt, 600, outside Git) - automated end-to-end test: login, RBAC check, refresh rotation, logout
This commit is contained in:
@@ -0,0 +1,139 @@
|
||||
-- CreateEnum
|
||||
CREATE TYPE "role_scope" AS ENUM ('PLATFORM', 'TENANT');
|
||||
|
||||
-- AlterTable
|
||||
ALTER TABLE "users" ADD COLUMN "must_change_password" BOOLEAN NOT NULL DEFAULT false;
|
||||
|
||||
-- CreateTable
|
||||
CREATE TABLE "roles" (
|
||||
"id" UUID NOT NULL,
|
||||
"key" TEXT NOT NULL,
|
||||
"name" TEXT NOT NULL,
|
||||
"scope" "role_scope" NOT NULL,
|
||||
"is_system" BOOLEAN NOT NULL DEFAULT false,
|
||||
"created_at" TIMESTAMP(3) NOT NULL DEFAULT CURRENT_TIMESTAMP,
|
||||
"updated_at" TIMESTAMP(3) NOT NULL,
|
||||
|
||||
CONSTRAINT "roles_pkey" PRIMARY KEY ("id")
|
||||
);
|
||||
|
||||
-- CreateTable
|
||||
CREATE TABLE "permissions" (
|
||||
"id" UUID NOT NULL,
|
||||
"key" TEXT NOT NULL,
|
||||
"description" TEXT,
|
||||
|
||||
CONSTRAINT "permissions_pkey" PRIMARY KEY ("id")
|
||||
);
|
||||
|
||||
-- CreateTable
|
||||
CREATE TABLE "role_permissions" (
|
||||
"role_id" UUID NOT NULL,
|
||||
"permission_id" UUID NOT NULL,
|
||||
|
||||
CONSTRAINT "role_permissions_pkey" PRIMARY KEY ("role_id","permission_id")
|
||||
);
|
||||
|
||||
-- CreateTable
|
||||
CREATE TABLE "user_roles" (
|
||||
"id" UUID NOT NULL,
|
||||
"user_id" UUID NOT NULL,
|
||||
"role_id" UUID NOT NULL,
|
||||
"tenant_id" UUID,
|
||||
"created_at" TIMESTAMP(3) NOT NULL DEFAULT CURRENT_TIMESTAMP,
|
||||
|
||||
CONSTRAINT "user_roles_pkey" PRIMARY KEY ("id")
|
||||
);
|
||||
|
||||
-- CreateTable
|
||||
CREATE TABLE "sessions" (
|
||||
"id" UUID NOT NULL,
|
||||
"user_id" UUID NOT NULL,
|
||||
"refresh_token_hash" TEXT NOT NULL,
|
||||
"active_tenant_id" UUID,
|
||||
"user_agent" TEXT,
|
||||
"ip_address" TEXT,
|
||||
"created_at" TIMESTAMP(3) NOT NULL DEFAULT CURRENT_TIMESTAMP,
|
||||
"expires_at" TIMESTAMP(3) NOT NULL,
|
||||
"revoked_at" TIMESTAMP(3),
|
||||
|
||||
CONSTRAINT "sessions_pkey" PRIMARY KEY ("id")
|
||||
);
|
||||
|
||||
-- CreateTable
|
||||
CREATE TABLE "audit_logs" (
|
||||
"id" UUID NOT NULL,
|
||||
"tenant_id" UUID,
|
||||
"user_id" UUID,
|
||||
"action" TEXT NOT NULL,
|
||||
"entity_type" TEXT,
|
||||
"entity_id" TEXT,
|
||||
"before" JSONB,
|
||||
"after" JSONB,
|
||||
"ip_address" TEXT,
|
||||
"user_agent" TEXT,
|
||||
"created_at" TIMESTAMP(3) NOT NULL DEFAULT CURRENT_TIMESTAMP,
|
||||
|
||||
CONSTRAINT "audit_logs_pkey" PRIMARY KEY ("id")
|
||||
);
|
||||
|
||||
-- CreateIndex
|
||||
CREATE UNIQUE INDEX "roles_key_key" ON "roles"("key");
|
||||
|
||||
-- CreateIndex
|
||||
CREATE UNIQUE INDEX "permissions_key_key" ON "permissions"("key");
|
||||
|
||||
-- CreateIndex
|
||||
CREATE UNIQUE INDEX "user_roles_user_id_role_id_tenant_id_key" ON "user_roles"("user_id", "role_id", "tenant_id");
|
||||
|
||||
-- CreateIndex
|
||||
CREATE UNIQUE INDEX "sessions_refresh_token_hash_key" ON "sessions"("refresh_token_hash");
|
||||
|
||||
-- CreateIndex
|
||||
CREATE INDEX "sessions_user_id_idx" ON "sessions"("user_id");
|
||||
|
||||
-- CreateIndex
|
||||
CREATE INDEX "audit_logs_tenant_id_created_at_idx" ON "audit_logs"("tenant_id", "created_at");
|
||||
|
||||
-- CreateIndex
|
||||
CREATE INDEX "audit_logs_user_id_idx" ON "audit_logs"("user_id");
|
||||
|
||||
-- AddForeignKey
|
||||
ALTER TABLE "role_permissions" ADD CONSTRAINT "role_permissions_role_id_fkey" FOREIGN KEY ("role_id") REFERENCES "roles"("id") ON DELETE CASCADE ON UPDATE CASCADE;
|
||||
|
||||
-- AddForeignKey
|
||||
ALTER TABLE "role_permissions" ADD CONSTRAINT "role_permissions_permission_id_fkey" FOREIGN KEY ("permission_id") REFERENCES "permissions"("id") ON DELETE CASCADE ON UPDATE CASCADE;
|
||||
|
||||
-- AddForeignKey
|
||||
ALTER TABLE "user_roles" ADD CONSTRAINT "user_roles_user_id_fkey" FOREIGN KEY ("user_id") REFERENCES "users"("id") ON DELETE CASCADE ON UPDATE CASCADE;
|
||||
|
||||
-- AddForeignKey
|
||||
ALTER TABLE "user_roles" ADD CONSTRAINT "user_roles_role_id_fkey" FOREIGN KEY ("role_id") REFERENCES "roles"("id") ON DELETE CASCADE ON UPDATE CASCADE;
|
||||
|
||||
-- AddForeignKey
|
||||
ALTER TABLE "user_roles" ADD CONSTRAINT "user_roles_tenant_id_fkey" FOREIGN KEY ("tenant_id") REFERENCES "tenants"("id") ON DELETE CASCADE ON UPDATE CASCADE;
|
||||
|
||||
-- AddForeignKey
|
||||
ALTER TABLE "sessions" ADD CONSTRAINT "sessions_user_id_fkey" FOREIGN KEY ("user_id") REFERENCES "users"("id") ON DELETE CASCADE ON UPDATE CASCADE;
|
||||
|
||||
-- The login flow needs to discover which tenants a user belongs to BEFORE a
|
||||
-- tenant has been chosen (chicken-and-egg: RLS normally requires
|
||||
-- app.current_tenant_id to already be set). Extend the tenant_isolation
|
||||
-- policy so a session can also see its OWN memberships via
|
||||
-- app.current_user_id, without ever exposing other users' memberships or
|
||||
-- other tenants' data. See docs/AUTHENTICATION.md.
|
||||
DROP POLICY "tenant_isolation" ON "tenant_memberships";
|
||||
|
||||
CREATE POLICY "tenant_isolation" ON "tenant_memberships"
|
||||
USING (
|
||||
tenant_id = NULLIF(current_setting('app.current_tenant_id', true), '')::uuid
|
||||
OR user_id = NULLIF(current_setting('app.current_user_id', true), '')::uuid
|
||||
);
|
||||
|
||||
-- roles / permissions / role_permissions / user_roles / sessions / audit_logs
|
||||
-- are intentionally NOT protected by RLS. Unlike tenant business data
|
||||
-- (extensions, agents, campaigns, calls, ...), these are auth-internal
|
||||
-- tables touched only by the trusted packages/auth service layer, which
|
||||
-- applies its own explicit WHERE clauses and RBAC checks (defense-in-depth
|
||||
-- per agente.md secao 32: RBAC + object authorization + tenant repositories
|
||||
-- + RLS are complementary layers, not all mandatory for every table).
|
||||
@@ -33,6 +33,7 @@ model Tenant {
|
||||
deletedAt DateTime? @map("deleted_at")
|
||||
|
||||
memberships TenantMembership[]
|
||||
userRoles UserRole[]
|
||||
|
||||
@@map("tenants")
|
||||
}
|
||||
@@ -47,20 +48,124 @@ enum UserStatus {
|
||||
// Identidade global do usuário. NUNCA carrega tenant_id diretamente — o tenant
|
||||
// é sempre resolvido via TenantMembership (agente.md secao 31).
|
||||
model User {
|
||||
id String @id @default(uuid()) @db.Uuid
|
||||
email String @unique
|
||||
passwordHash String @map("password_hash")
|
||||
name String
|
||||
status UserStatus @default(ACTIVE)
|
||||
createdAt DateTime @default(now()) @map("created_at")
|
||||
updatedAt DateTime @updatedAt @map("updated_at")
|
||||
deletedAt DateTime? @map("deleted_at")
|
||||
id String @id @default(uuid()) @db.Uuid
|
||||
email String @unique
|
||||
passwordHash String @map("password_hash")
|
||||
name String
|
||||
status UserStatus @default(ACTIVE)
|
||||
mustChangePassword Boolean @default(false) @map("must_change_password")
|
||||
createdAt DateTime @default(now()) @map("created_at")
|
||||
updatedAt DateTime @updatedAt @map("updated_at")
|
||||
deletedAt DateTime? @map("deleted_at")
|
||||
|
||||
memberships TenantMembership[]
|
||||
userRoles UserRole[]
|
||||
sessions Session[]
|
||||
|
||||
@@map("users")
|
||||
}
|
||||
|
||||
enum RoleScope {
|
||||
PLATFORM
|
||||
TENANT
|
||||
|
||||
@@map("role_scope")
|
||||
}
|
||||
|
||||
// Definições de role. Roles de sistema (isSystem=true) são criadas pelo seed
|
||||
// (agente.md secao 142) e não podem ser removidas via API.
|
||||
model Role {
|
||||
id String @id @default(uuid()) @db.Uuid
|
||||
key String @unique
|
||||
name String
|
||||
scope RoleScope
|
||||
isSystem Boolean @default(false) @map("is_system")
|
||||
createdAt DateTime @default(now()) @map("created_at")
|
||||
updatedAt DateTime @updatedAt @map("updated_at")
|
||||
|
||||
rolePermissions RolePermission[]
|
||||
userRoles UserRole[]
|
||||
|
||||
@@map("roles")
|
||||
}
|
||||
|
||||
model Permission {
|
||||
id String @id @default(uuid()) @db.Uuid
|
||||
key String @unique
|
||||
description String?
|
||||
|
||||
rolePermissions RolePermission[]
|
||||
|
||||
@@map("permissions")
|
||||
}
|
||||
|
||||
model RolePermission {
|
||||
roleId String @map("role_id") @db.Uuid
|
||||
permissionId String @map("permission_id") @db.Uuid
|
||||
|
||||
role Role @relation(fields: [roleId], references: [id], onDelete: Cascade)
|
||||
permission Permission @relation(fields: [permissionId], references: [id], onDelete: Cascade)
|
||||
|
||||
@@id([roleId, permissionId])
|
||||
@@map("role_permissions")
|
||||
}
|
||||
|
||||
// tenantId é obrigatório quando role.scope == TENANT e deve ser nulo quando
|
||||
// role.scope == PLATFORM (invariante aplicado em packages/auth, não no banco —
|
||||
// ver docs/AUTHENTICATION.md).
|
||||
model UserRole {
|
||||
id String @id @default(uuid()) @db.Uuid
|
||||
userId String @map("user_id") @db.Uuid
|
||||
roleId String @map("role_id") @db.Uuid
|
||||
tenantId String? @map("tenant_id") @db.Uuid
|
||||
createdAt DateTime @default(now()) @map("created_at")
|
||||
|
||||
user User @relation(fields: [userId], references: [id], onDelete: Cascade)
|
||||
role Role @relation(fields: [roleId], references: [id], onDelete: Cascade)
|
||||
tenant Tenant? @relation(fields: [tenantId], references: [id], onDelete: Cascade)
|
||||
|
||||
@@unique([userId, roleId, tenantId])
|
||||
@@map("user_roles")
|
||||
}
|
||||
|
||||
// Refresh-token de longa duração (rotacionado a cada uso). Nunca guardamos o
|
||||
// token em texto puro — só o hash (SHA-256) usado para lookup/comparação.
|
||||
model Session {
|
||||
id String @id @default(uuid()) @db.Uuid
|
||||
userId String @map("user_id") @db.Uuid
|
||||
refreshTokenHash String @unique @map("refresh_token_hash")
|
||||
activeTenantId String? @map("active_tenant_id") @db.Uuid
|
||||
userAgent String? @map("user_agent")
|
||||
ipAddress String? @map("ip_address")
|
||||
createdAt DateTime @default(now()) @map("created_at")
|
||||
expiresAt DateTime @map("expires_at")
|
||||
revokedAt DateTime? @map("revoked_at")
|
||||
|
||||
user User @relation(fields: [userId], references: [id], onDelete: Cascade)
|
||||
|
||||
@@index([userId])
|
||||
@@map("sessions")
|
||||
}
|
||||
|
||||
// tenantId nulo = evento de escopo plataforma (agente.md secao 150).
|
||||
model AuditLog {
|
||||
id String @id @default(uuid()) @db.Uuid
|
||||
tenantId String? @map("tenant_id") @db.Uuid
|
||||
userId String? @map("user_id") @db.Uuid
|
||||
action String
|
||||
entityType String? @map("entity_type")
|
||||
entityId String? @map("entity_id")
|
||||
before Json?
|
||||
after Json?
|
||||
ipAddress String? @map("ip_address")
|
||||
userAgent String? @map("user_agent")
|
||||
createdAt DateTime @default(now()) @map("created_at")
|
||||
|
||||
@@index([tenantId, createdAt])
|
||||
@@index([userId])
|
||||
@@map("audit_logs")
|
||||
}
|
||||
|
||||
// Tabela tenant-scoped protegida por Row Level Security (ver migration
|
||||
// 'tenant_isolation' e docs/TENANT_ISOLATION.md).
|
||||
model TenantMembership {
|
||||
|
||||
Reference in New Issue
Block a user