B2BCall Bootstrap
a2898fa566
- packages/database: schema Prisma (users/sessions/roles/permissions/
user_roles/role_permissions/audit_logs/password_reset_tokens), migration
inicial e seed (permissoes+perfis+bootstrap super_admin com senha
aleatoria em FIRST_LOGIN.txt). Decisao de ORM (Prisma) documentada em
docs/ARCHITECTURE.md
- packages/shared: catalogo de permissoes (fonte unica usada por seed e API)
- apps/api: NestJS 11 + Fastify
- autenticacao: Argon2id, access JWT + refresh token opaco com rotacao,
cookies HttpOnly/SameSite=Lax, change/forgot/reset password
- rate limiting progressivo de login via Redis (bloqueio crescente por IP)
- RBAC reforcado no backend (PermissionsGuard), protecao contra
auto-elevacao de privilegio
- auditoria (audit_logs) nas acoes sensiveis, com redacao de segredos
- health checks reais (postgres+redis), swagger desabilitavel, logs
estruturados JSON com request_id de correlacao, filtro global de
excecoes sem vazar erro cru
- infrastructure/docker/api.Dockerfile: build multi-stage do monorepo pnpm
- docker-compose.yml: servico api na rede interna, sem porta publicada
Testado via containers reais: login, /me, refresh, change-password,
rate limit (7 tentativas -> 429), RBAC (nega/permite), bloqueio de
auto-elevacao (403), audit log populado, health checks, lint e testes
unitarios passando.
72 lines
1.7 KiB
TypeScript
72 lines
1.7 KiB
TypeScript
import {
|
|
Body,
|
|
Controller,
|
|
Delete,
|
|
Get,
|
|
Param,
|
|
ParseUUIDPipe,
|
|
Patch,
|
|
Post,
|
|
Req,
|
|
} from '@nestjs/common';
|
|
import type { FastifyRequest } from 'fastify';
|
|
import { RequirePermissions } from '../common/decorators/permissions.decorator';
|
|
import { CurrentUser } from '../common/decorators/current-user.decorator';
|
|
import type { AuthenticatedUser } from '../common/guards/auth.guard';
|
|
import { RolesService } from './roles.service';
|
|
import { CreateRoleDto } from './dto/create-role.dto';
|
|
import { UpdateRoleDto } from './dto/update-role.dto';
|
|
|
|
@Controller('roles')
|
|
@RequirePermissions('roles.manage')
|
|
export class RolesController {
|
|
constructor(private readonly rolesService: RolesService) {}
|
|
|
|
@Get('permissions')
|
|
listPermissionCatalog() {
|
|
return this.rolesService.listPermissionCatalog();
|
|
}
|
|
|
|
@Get()
|
|
list() {
|
|
return this.rolesService.list();
|
|
}
|
|
|
|
@Post()
|
|
create(
|
|
@Body() dto: CreateRoleDto,
|
|
@CurrentUser() actor: AuthenticatedUser,
|
|
@Req() request: FastifyRequest,
|
|
) {
|
|
return this.rolesService.create(dto, actor, {
|
|
ip: request.ip,
|
|
userAgent: request.headers['user-agent'],
|
|
});
|
|
}
|
|
|
|
@Patch(':id')
|
|
update(
|
|
@Param('id', ParseUUIDPipe) id: string,
|
|
@Body() dto: UpdateRoleDto,
|
|
@CurrentUser() actor: AuthenticatedUser,
|
|
@Req() request: FastifyRequest,
|
|
) {
|
|
return this.rolesService.update(id, dto, actor, {
|
|
ip: request.ip,
|
|
userAgent: request.headers['user-agent'],
|
|
});
|
|
}
|
|
|
|
@Delete(':id')
|
|
remove(
|
|
@Param('id', ParseUUIDPipe) id: string,
|
|
@CurrentUser() actor: AuthenticatedUser,
|
|
@Req() request: FastifyRequest,
|
|
) {
|
|
return this.rolesService.delete(id, actor, {
|
|
ip: request.ip,
|
|
userAgent: request.headers['user-agent'],
|
|
});
|
|
}
|
|
}
|