Matheus (Handix)
8d81cf506b
- Auth (apps/api/src/auth/): Argon2id com parâmetros versionados
(ADR-0005), access token JWT de 15min, refresh token opaco de 256 bits
com rotação e detecção de replay (reuso de token já rotacionado revoga
toda a cadeia de sessões do usuário). Endpoints /api/v1/auth/
{login,refresh,logout,me}.
- Permissões resource+action+scope (ADR-0004) via PermissionGuard,
resolvidas do banco a cada request (nunca cacheadas no JWT) — mudança
de papel tem efeito imediato. super_admin com bypass hardcoded,
espelhando a trava já existente no banco.
- Companies (migration + CRUD): leitura aberta a qualquer autenticado,
escrita restrita a companies:manage; validação de CNPJ via
packages/domain-shared (dígito verificador).
- SeedService: cria o primeiro super_admin a partir de
EDEN_SUPERADMIN_EMAIL/PASSWORD só quando `users` está vazia.
- OpenAPI/Swagger em /api/docs; ValidationPipe global com
whitelist+forbidNonWhitelisted (proteção contra mass-assignment).
- packages/database: repositórios (roles/users/sessions/audit/companies)
reutilizáveis por api e worker.
Validado manualmente contra a stack real (não só typecheck): login com
senha errada → 401 genérico; refresh rotaciona e invalida o token
anterior; reuso do token antigo → replay detectado, cadeia revogada;
logout idempotente; audit log com a sequência completa de eventos;
CNPJ inválido rejeitado; mass-assignment rejeitado.
Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>
103 lines
3.5 KiB
TypeScript
103 lines
3.5 KiB
TypeScript
import { BadRequestException, Injectable, NotFoundException } from "@nestjs/common";
|
|
import { companiesRepo, auditRepo, type Company } from "@eden/database";
|
|
import { onlyDigits, isValidCNPJ } from "@eden/domain-shared";
|
|
import type { CreateCompanyDto } from "./dto/create-company.dto.js";
|
|
import type { UpdateCompanyDto } from "./dto/update-company.dto.js";
|
|
|
|
@Injectable()
|
|
export class CompaniesService {
|
|
list(includeInactive: boolean): Promise<Company[]> {
|
|
return companiesRepo.listCompanies(includeInactive);
|
|
}
|
|
|
|
async get(id: string): Promise<Company> {
|
|
const company = await companiesRepo.getCompanyById(id);
|
|
if (!company) throw new NotFoundException("Empresa não encontrada");
|
|
return company;
|
|
}
|
|
|
|
async create(dto: CreateCompanyDto, actorId: string): Promise<Company> {
|
|
this.assertValidCnpjIfPresent(dto.cnpj);
|
|
const company = await companiesRepo.createCompany({
|
|
companyName: dto.companyName,
|
|
tradeName: dto.tradeName,
|
|
cnpj: dto.cnpj ? onlyDigits(dto.cnpj) : undefined,
|
|
stateRegistration: dto.stateRegistration,
|
|
municipalRegistration: dto.municipalRegistration,
|
|
addressZip: dto.addressZip,
|
|
addressStreet: dto.addressStreet,
|
|
addressNumber: dto.addressNumber,
|
|
addressComplement: dto.addressComplement,
|
|
addressNeighborhood: dto.addressNeighborhood,
|
|
addressCity: dto.addressCity,
|
|
addressState: dto.addressState,
|
|
addressCountry: dto.addressCountry,
|
|
phone: dto.phone,
|
|
email: dto.email,
|
|
website: dto.website,
|
|
legalRepName: dto.legalRepName,
|
|
legalRepCpf: dto.legalRepCpf ? onlyDigits(dto.legalRepCpf) : undefined,
|
|
legalRepRole: dto.legalRepRole,
|
|
legalRepEmail: dto.legalRepEmail,
|
|
createdBy: actorId,
|
|
});
|
|
|
|
await auditRepo.appendAuditEvent({
|
|
actorType: "user",
|
|
actorId,
|
|
action: "company.created",
|
|
resourceType: "company",
|
|
resourceId: company.id,
|
|
});
|
|
|
|
return company;
|
|
}
|
|
|
|
async update(id: string, dto: UpdateCompanyDto, actorId: string): Promise<Company> {
|
|
await this.get(id); // 404 if missing
|
|
this.assertValidCnpjIfPresent(dto.cnpj);
|
|
|
|
const company = await companiesRepo.updateCompany(id, {
|
|
companyName: dto.companyName,
|
|
tradeName: dto.tradeName,
|
|
cnpj: dto.cnpj ? onlyDigits(dto.cnpj) : undefined,
|
|
stateRegistration: dto.stateRegistration,
|
|
municipalRegistration: dto.municipalRegistration,
|
|
addressZip: dto.addressZip,
|
|
addressStreet: dto.addressStreet,
|
|
addressNumber: dto.addressNumber,
|
|
addressComplement: dto.addressComplement,
|
|
addressNeighborhood: dto.addressNeighborhood,
|
|
addressCity: dto.addressCity,
|
|
addressState: dto.addressState,
|
|
addressCountry: dto.addressCountry,
|
|
phone: dto.phone,
|
|
email: dto.email,
|
|
website: dto.website,
|
|
legalRepName: dto.legalRepName,
|
|
legalRepCpf: dto.legalRepCpf ? onlyDigits(dto.legalRepCpf) : undefined,
|
|
legalRepRole: dto.legalRepRole,
|
|
legalRepEmail: dto.legalRepEmail,
|
|
isActive: dto.isActive,
|
|
});
|
|
if (!company) throw new NotFoundException("Empresa não encontrada");
|
|
|
|
await auditRepo.appendAuditEvent({
|
|
actorType: "user",
|
|
actorId,
|
|
action: "company.updated",
|
|
resourceType: "company",
|
|
resourceId: id,
|
|
metadata: { fields: Object.keys(dto) },
|
|
});
|
|
|
|
return company;
|
|
}
|
|
|
|
private assertValidCnpjIfPresent(cnpj: string | undefined): void {
|
|
if (cnpj && !isValidCNPJ(cnpj)) {
|
|
throw new BadRequestException("CNPJ inválido");
|
|
}
|
|
}
|
|
}
|