feat: adicionar painel admin e fortalecer controle de acesso (#164)

- adiciona workspace front_admin com dashboard, usuarios, scrapers,
observabilidade, auditoria e permissoes
- integra o front_admin ao monorepo, scripts npm, Docker Compose e build
multi-stage
- cria endpoints administrativos para usuarios, observabilidade e regras
de permissoes
- adiciona persistencia de regras RBAC e atualiza matriz de permissoes
- isola keywords por usuario e propaga userId nos eventos de
sincronizacao
- adiciona rate limit nas rotas de login e cadastro
- atualiza migrations, testes, env examples e configuracoes de
build/teste
- protege builds Docker contra inclusao de envs e artefatos locais

Author: Benevanio

.cspell/custom-dictionary-workspace.txt

@@ -3,8 +3,12 @@ node_modules
 **/node_modules
 
 # Build outputs
+dist
+**/dist
 frontend/dist
 backend/output
+coverage
+**/coverage
 
 # Go
 scraper-go/vendor
@@ -17,5 +21,8 @@ electron
 
 # Misc
 .git
-coverage
-**/*.log
+.env
+.env.*
+**/.env
+**/.env.*
+**/*.log

.dockerignore

@@ -2,8 +2,23 @@
 NODE_ENV=development
 PORT=3001
 
-# Base URLs
-APP_URL=http://localhost:3001
+# Base URL da aplicação
+# Ex: APP_URL=http://localhost:3001/api
+APP_URL=
+
+# Sessão
+# Use uma string longa e secreta em produção
+SESSION_SECRET=
+
+# CORS / frontend access (separar por vírgula)
+CORS_ALLOWED_ORIGINS=
+
+# Rate limit de autenticação
+AUTH_RATE_LIMIT_IP_MAX=20
+AUTH_RATE_LIMIT_ACCOUNT_MAX=5
+AUTH_RATE_LIMIT_WINDOW_SECONDS=900
+
+# URL do frontend (usada para redirect pos-OAuth)
 FRONTEND_URL=http://localhost:5173
 
 # Session
@@ -54,3 +69,6 @@ GITHUB_CLIENT_SECRET=
 GO_SCRAPER_URL=http://localhost:8081
 SCRAPER_URL=http://localhost:8081
 PROMETHEUS_URL=http://localhost:9090
+
+SCRAPER_URL=http://scraper-go:8081
+PROMETHEUS_URL=http://prometheus:9090

backend/.env.example

@@ -12,10 +12,10 @@ post {
 
 body:json {
   {
-    "email":"hudsontavares@gmail.com",
+    "email":"hudson60@gmail.com",
     "password": "tavares10", 
     "name": "Hudson Tavares", 
-    "role":"ADMIN"
+    "role":"banana"
   }
 }
 

backend/bruno/Auth/Register.bru

@@ -0,0 +1,5 @@
+DELETE FROM "keywords";--> statement-breakpoint
+DROP INDEX IF EXISTS "keywords_keyword_unique";--> statement-breakpoint
+ALTER TABLE "keywords" ADD COLUMN "user_id" uuid NOT NULL;--> statement-breakpoint
+ALTER TABLE "keywords" ADD CONSTRAINT "keywords_user_id_users_id_fk" FOREIGN KEY ("user_id") REFERENCES "public"."users"("id") ON DELETE cascade ON UPDATE no action;--> statement-breakpoint
+CREATE UNIQUE INDEX "keywords_user_keyword_unique" ON "keywords" USING btree ("user_id","keyword");

backend/drizzle/0005_heavy_la_nuit.sql

@@ -0,0 +1,8 @@
+CREATE TABLE "permission_rules" (
+	"resource" varchar(50) NOT NULL,
+	"action" varchar(50) NOT NULL,
+	"min_role" "user_role" NOT NULL,
+	"reason" text,
+	"updated_at" timestamp DEFAULT now() NOT NULL,
+	CONSTRAINT "permission_rules_resource_action_pk" PRIMARY KEY("resource","action")
+);

backend/drizzle/0005_keywords_tenant_isolation.sql

@@ -40,8 +40,22 @@
     {
       "idx": 5,
       "version": "7",
-      "when": 1782974700000,
-      "tag": "0005_sudden_robbie_robertson",
+      "when": 1783533600000,
+      "tag": "0005_keywords_tenant_isolation",
+      "breakpoints": true
+    },
+    {
+      "idx": 6,
+      "version": "7",
+      "when": 1783620000000,
+      "tag": "0006_audit_logs",
+      "breakpoints": true
+    },
+    {
+      "idx": 7,
+      "version": "7",
+      "when": 1783623600000,
+      "tag": "0007_permission_rules",
       "breakpoints": true
     }
   ]