Implementa camada de Autorização

.github/workflows/linting.yaml

@@ -12,7 +12,7 @@ jobs:
 
       - uses: actions/setup-node@v4
         with:
-          node-version: "20"
+          node-version-file: "package.json"
           cache: "npm"
 
       - run: npm ci
@@ -28,7 +28,7 @@ jobs:
 
       - uses: actions/setup-node@v4
         with:
-          node-version: "20"
+          node-version-file: "package.json"
 
       - run: npm ci
 
@@ -45,7 +45,7 @@ jobs:
 
       - uses: actions/setup-node@v4
         with:
-          node-version: "20"
+          node-version-file: "package.json"
           cache: "npm"
 
       - run: npm ci

.github/workflows/test.yaml

@@ -11,7 +11,7 @@ jobs:
 
       - uses: actions/setup-node@v4
         with:
-          node-version: "24.14.0"
+          node-version-file: "package.json"
 
       - run: npm ci
 

.nvmrc

@@ -1 +1 @@
-lts/hydrogen
+24

infra/authorization.js

@@ -0,0 +1,163 @@
+import { InternalServerError } from "./errors";
+
+const avalableFeatures = [
+  // USER
+  "create:user",
+  "read:user",
+  "read:user:self",
+  "update:user",
+  "update:user:others",
+
+  // SESSIONS
+  "create:session",
+  "read:session",
+
+  // ACTIVATION_TOKEN
+  "read:activation_token",
+
+  // MIGRATIONS
+  "create:migration",
+  "read:migration",
+
+  // STATUS
+  "read:status",
+  "read:status:version",
+];
+
+function can(user, feature, resource) {
+  validateUser(user);
+  validateFeature(feature);
+
+  let authorized = false;
+
+  if (user.features.includes(feature)) {
+    authorized = true;
+  }
+
+  if (feature === "update:user" && resource) {
+    authorized = false;
+
+    if (user.id === resource.id || can(user, "update:user:others")) {
+      authorized = true;
+    }
+  }
+
+  return authorized;
+}
+
+function filterOutput(user, feature, insecureValues) {
+  validateUser(user);
+  validateFeature(feature);
+  validateResource(insecureValues);
+
+  if (feature === "read:user") {
+    return {
+      id: insecureValues.id,
+      username: insecureValues.username,
+      features: insecureValues.features,
+      created_at: insecureValues.created_at,
+      update_at: insecureValues.update_at,
+    };
+  }
+
+  if (feature === "read:user:self") {
+    if (user.id === insecureValues.id) {
+      return {
+        id: insecureValues.id,
+        username: insecureValues.username,
+        email: insecureValues.email,
+        features: insecureValues.features,
+        created_at: insecureValues.created_at,
+        update_at: insecureValues.update_at,
+      };
+    }
+  }
+
+  if (feature === "read:session") {
+    if (user.id === insecureValues.user_id) {
+      return {
+        id: insecureValues.id,
+        token: insecureValues.token,
+        user_id: insecureValues.user_id,
+        username: insecureValues.username,
+        expires_at: insecureValues.expires_at,
+        created_at: insecureValues.created_at,
+        updated_at: insecureValues.updated_at,
+      };
+    }
+  }
+
+  if (feature === "read:activation_token") {
+    return {
+      id: insecureValues.id,
+      user_id: insecureValues.user_id,
+      created_at: insecureValues.created_at,
+      update_at: insecureValues.update_at,
+      expires_at: insecureValues.expires_at,
+      used_at: insecureValues.used_at,
+    };
+  }
+
+  if (feature === "read:migration") {
+    return insecureValues.map((migration) => {
+      return {
+        path: migration.path,
+        name: migration.name,
+        timestamp: migration.timestamp,
+      };
+    });
+  }
+
+  if (feature === "read:status") {
+    const output = {
+      updated_at: insecureValues.updated_at,
+      dependencies: {
+        database: {
+          max_connections: insecureValues.dependencies.database.max_connections,
+          open_connections:
+            insecureValues.dependencies.database.open_connections,
+        },
+      },
+    };
+
+    if (user.features.includes("read:status:version")) {
+      output.dependencies.database.version =
+        insecureValues.dependencies.database.version;
+    }
+
+    return output;
+  }
+}
+
+function validateUser(user) {
+  if (!user || !user.features) {
+    throw new InternalServerError({
+      cause: "É necessario fornecer `user` no model `authorization`.",
+    });
+  }
+}
+
+function validateFeature(feature) {
+  if (!feature || !avalableFeatures.includes(feature)) {
+    throw new InternalServerError({
+      cause:
+        "É necessario fornecer `feature` conhecida no model `authorization`.",
+    });
+  }
+}
+
+function validateResource(resource) {
+  if (!resource) {
+    throw new InternalServerError({
+      cause:
+        "É necessario fornecer `resource`em  `authorization.filterOutput()`.",
+    });
+  }
+}
+
+const authorization = {
+  can,
+  filterOutput,
+};
+
+export default authorization;

infra/controller.js

@@ -1,11 +1,15 @@
-import * as cookie from "cookie";
+import * as cookies from "cookie";
 import session from "models/session";
+import user from "models/user";
+import authorization from "./authorization";
+
 import {
   InternalServerError,
   MethodNotAllowedError,
   ValidationError,
   NotFoundError,
   UnauthorizedError,
+  ForbiddenError,
 } from "infra/errors";
 
 function onNoMatchHandler(request, response) {
@@ -14,7 +18,11 @@ function onNoMatchHandler(request, response) {
 }
 
 function onErrorHandler(error, request, response) {
-  if (error instanceof ValidationError || error instanceof NotFoundError) {
+  if (
+    error instanceof ValidationError ||
+    error instanceof NotFoundError ||
+    error instanceof ForbiddenError
+  ) {
     return response.status(error.statusCode).json(error);
   }
 
@@ -33,7 +41,7 @@ function onErrorHandler(error, request, response) {
 }
 
 async function setSessionCookie(sessionToken, response) {
-  const setCookie = cookie.serialize("session_id", sessionToken, {
+  const setCookie = cookies.serialize("session_id", sessionToken, {
     path: "/",
     maxAge: session.EXPIRATION_IN_MILLISECONDS / 1000,
     secure: process.env.NODE_ENV === "production",
@@ -44,7 +52,7 @@ async function setSessionCookie(sessionToken, response) {
 }
 
 async function clearSessionCookie(response) {
-  const setCookie = cookie.serialize("session_id", "invalid", {
+  const setCookie = cookies.serialize("session_id", "invalid", {
     path: "/",
     maxAge: -1,
     secure: process.env.NODE_ENV === "production",
@@ -54,13 +62,69 @@ async function clearSessionCookie(response) {
   response.setHeader("Set-Cookie", setCookie);
 }
 
+async function injectAnonymousOrUser(request, response, next) {
+  if (request.cookies?.session_id) {
+    await injectAutenticatedUser(request);
+    return next();
+  }
+
+  injectAnonymousUser(request);
+  return next();
+}
+
+async function injectAutenticatedUser(request) {
+  const sessionToken = request.cookies.session_id;
+
+  const sessionObject = await session.findOneValidByToken(sessionToken);
+  const userObject = await user.findOneById(sessionObject.user_id);
+
+  request.context = {
+    ...request.context,
+    user: userObject,
+  };
+}
+
+async function injectAnonymousUser(request) {
+  const anonymousUserObject = {
+    features: [
+      "read:activation_token",
+      "read:status",
+      "create:session",
+      "create:user",
+    ],
+  };
+
+  request.context = {
+    ...request.context,
+    user: anonymousUserObject,
+  };
+}
+
+function canRequest(feature) {
+  return function canRequestMiddleware(request, response, next) {
+    const userTryingToRequest = request.context.user;
+
+    if (authorization.can(userTryingToRequest, feature)) {
+      return next();
+    }
+
+    throw new ForbiddenError({
+      message: "Você não possui permissão para executar esta ação.",
+      action: `Verifique se o seu usuário possui a feature "${feature}"`,
+    });
+  };
+}
+
 const controller = {
   errorHandlers: {
     onNoMatch: onNoMatchHandler,
     onError: onErrorHandler,
   },
   setSessionCookie,
   clearSessionCookie,
+  injectAnonymousOrUser,
+  injectAutenticatedUser,
+  canRequest,
 };
 
 export default controller;

infra/email.js

@@ -1,4 +1,5 @@
 import nodemailer from "nodemailer";
+import { ServiceError } from "./errors";
 
 const transporter = nodemailer.createTransport({
   host: process.env.EMAIL_SMTP_HOST,
@@ -11,7 +12,16 @@ const transporter = nodemailer.createTransport({
 });
 
 async function send(mailOptions) {
-  await transporter.sendMail(mailOptions);
+  try {
+    await transporter.sendMail(mailOptions);
+  } catch (error) {
+    throw new ServiceError({
+      message: "Não foi possivel enviar o email.",
+      action: "Verifique se o serviço de email está disponivel.",
+      cause: error,
+      context: mailOptions,
+    });
+  }
 }
 
 const email = {

infra/errors.js

@@ -19,13 +19,14 @@ export class InternalServerError extends Error {
 }
 
 export class ServiceError extends Error {
-  constructor({ cause, message }) {
+  constructor({ cause, message, action, context }) {
     super(message || "Serviço indisponível no momento.", {
       cause,
     });
     this.name = "InternalServerError";
-    this.action = "Entre em contato com o suporte";
+    this.action = action || "Entre em contato com o suporte";
     this.statusCode = 503;
+    this.context = context;
   }
 
   toJSON() {
@@ -34,6 +35,7 @@ export class ServiceError extends Error {
       message: this.message,
       action: this.action,
       statusCode: this.statusCode,
+      context: this.context,
     };
   }
 }
@@ -102,6 +104,28 @@ export class UnauthorizedError extends Error {
   }
 }
 
+export class ForbiddenError extends Error {
+  constructor({ cause, message, action }) {
+    super(message || "Acesso negado.", {
+      cause,
+    });
+
+    this.name = "ForbiddenError";
+    this.action =
+      action || "Verifique as features necessárias antes de continuar.";
+    this.statusCode = 403;
+  }
+
+  toJSON() {
+    return {
+      name: this.name,
+      message: this.message,
+      action: this.action,
+      statusCode: this.statusCode,
+    };
+  }
+}
+
 export class MethodNotAllowedError extends Error {
   constructor() {
     super("Metodo não permitido para este endpoint.");