Module 5 - Sécurité et gestion des utilisateurs

// Service de gestion du cycle de vie utilisateur
class UserLifecycleService {
  constructor(db, auditLogger) {
    this.db = db;
    this.audit = auditLogger;
  }

  async createUser(userData, createdBy) {
    const transaction = await this.db.transaction();
    try {
      // 1. Validation des données
      this.validateUserData(userData);
      
      // 2. Vérification des doublons
      await this.checkDuplicates(userData.email);
      
      // 3. Génération du mot de passe temporaire
      const tempPassword = this.generateSecurePassword();
      const hashedPassword = await bcrypt.hash(tempPassword, 12);
      
      // 4. Création de l'utilisateur
      const user = await this.db.users.create({
        ...userData,
        password_hash: hashedPassword,
        must_change_password: true,
        created_by: createdBy,
        status: 'pending'
      }, { transaction });
      
      // 5. Envoi de l'email d'activation
      await this.sendActivationEmail(user, tempPassword);
      
      // 6. Audit log
      await this.audit.log({
        action: 'USER_CREATED',
        userId: createdBy,
        targetUserId: user.id,
        details: { email: user.email, department: user.department }
      });
      
      await transaction.commit();
      return user;
    } catch (error) {
      await transaction.rollback();
      throw error;
    }
  }

  async suspendUser(userId, reason, suspendedBy, duration = null) {
    const user = await this.db.users.findByPk(userId);
    if (!user) throw new Error('User not found');

    const suspendUntil = duration ? 
      new Date(Date.now() + duration * 24 * 60 * 60 * 1000) : null;

    await this.db.users.update(
      { 
        status: 'suspended',
        suspended_until: suspendUntil,
        suspended_reason: reason
      },
      { where: { id: userId } }
    );

    // Invalider toutes les sessions actives
    await this.invalidateUserSessions(userId);

    // Audit
    await this.audit.log({
      action: 'USER_SUSPENDED',
      userId: suspendedBy,
      targetUserId: userId,
      details: { reason, duration }
    });

    // Notification
    await this.notifyUserSuspension(user, reason, suspendUntil);
  }

  async archiveUser(userId, archivedBy, reason) {
    const transaction = await this.db.transaction();
    try {
      // 1. Vérifier que l'utilisateur existe
      const user = await this.db.users.findByPk(userId);
      if (!user) throw new Error('User not found');

      // 2. Créer une archive
      await this.db.user_archives.create({
        original_user_id: userId,
        user_data: user.toJSON(),
        archived_by: archivedBy,
        reason: reason
      }, { transaction });

      // 3. Anonymiser les données sensibles
      await this.db.users.update({
        status: 'archived',
        email: `archived_${userId}@internal.local`,
        display_name: 'Utilisateur archivé',
        first_name: null,
        last_name: null,
        phone: null,
        is_active: false
      }, { where: { id: userId }, transaction });

      // 4. Audit
      await this.audit.log({
        action: 'USER_ARCHIVED',
        userId: archivedBy,
        targetUserId: userId,
        details: { reason }
      });

      await transaction.commit();
    } catch (error) {
      await transaction.rollback();
      throw error;
    }
  }
}

-- Table des groupes avec hiérarchie
CREATE TABLE groups (
    id SERIAL PRIMARY KEY,
    name VARCHAR(100) NOT NULL,
    description TEXT,
    parent_group_id INTEGER REFERENCES groups(id),
    
    -- Métadonnées
    color VARCHAR(7) DEFAULT '#007bff',
    icon VARCHAR(50) DEFAULT 'users',
    sort_order INTEGER DEFAULT 0,
    
    -- Paramètres
    is_system BOOLEAN DEFAULT false,
    auto_join BOOLEAN DEFAULT false,
    requires_approval BOOLEAN DEFAULT true,
    max_members INTEGER DEFAULT NULL,
    
    -- Hiérarchie (Materialized Path)
    path LTREE,
    level INTEGER DEFAULT 0,
    
    -- Audit
    created_at TIMESTAMP DEFAULT CURRENT_TIMESTAMP,
    created_by INTEGER REFERENCES users(id),
    updated_at TIMESTAMP DEFAULT CURRENT_TIMESTAMP
);

-- Table d'appartenance avec rôles dans le groupe
CREATE TABLE user_groups (
    id SERIAL PRIMARY KEY,
    user_id INTEGER REFERENCES users(id) ON DELETE CASCADE,
    group_id INTEGER REFERENCES groups(id) ON DELETE CASCADE,
    
    -- Rôle dans le groupe
    role VARCHAR(50) DEFAULT 'member', -- member, admin, owner
    
    -- Statut
    status VARCHAR(20) DEFAULT 'active', -- active, pending, suspended
    
    -- Métadonnées
    joined_at TIMESTAMP DEFAULT CURRENT_TIMESTAMP,
    invited_by INTEGER REFERENCES users(id),
    expires_at TIMESTAMP NULL,
    
    UNIQUE(user_id, group_id)
);

-- Index pour les requêtes hiérarchiques
CREATE INDEX idx_groups_path ON groups USING GIST (path);
CREATE INDEX idx_groups_parent ON groups(parent_group_id);
CREATE INDEX idx_user_groups_user ON user_groups(user_id);
CREATE INDEX idx_user_groups_group ON user_groups(group_id);

// Service de gestion des groupes
class GroupService {
  constructor(db) {
    this.db = db;
  }

  async createGroup(groupData, parentGroupId = null) {
    const transaction = await this.db.transaction();
    try {
      let path = '';
      let level = 0;
      
      if (parentGroupId) {
        const parent = await this.db.groups.findByPk(parentGroupId);
        if (!parent) throw new Error('Parent group not found');
        
        path = `${parent.path}.${parentGroupId}`;
        level = parent.level + 1;
      } else {
        path = 'root';
      }

      const group = await this.db.groups.create({
        ...groupData,
        parent_group_id: parentGroupId,
        path: path,
        level: level
      }, { transaction });

      await transaction.commit();
      return group;
    } catch (error) {
      await transaction.rollback();
      throw error;
    }
  }

  async getGroupHierarchy(groupId) {
    // Récupérer tous les groupes enfants
    const children = await this.db.groups.findAll({
      where: {
        path: { [Op.like]: `%.${groupId}.%` }
      },
      order: [['level', 'ASC'], ['name', 'ASC']]
    });

    // Récupérer tous les groupes parents
    const group = await this.db.groups.findByPk(groupId);
    const parentIds = group.path.split('.').filter(id => id !== 'root');
    const parents = await this.db.groups.findAll({
      where: { id: { [Op.in]: parentIds } }
    });

    return { group, parents, children };
  }

  async getUserEffectiveGroups(userId) {
    // Groupes directs
    const directGroups = await this.db.query(`
      SELECT g.*, ug.role, ug.joined_at
      FROM groups g
      JOIN user_groups ug ON g.id = ug.group_id
      WHERE ug.user_id = :userId AND ug.status = 'active'
    `, {
      replacements: { userId },
      type: QueryTypes.SELECT
    });

    // Groupes hérités (parents des groupes directs)
    const inheritedGroups = await this.db.query(`
      WITH user_group_paths AS (
        SELECT g.path
        FROM groups g
        JOIN user_groups ug ON g.id = ug.group_id
        WHERE ug.user_id = :userId AND ug.status = 'active'
      )
      SELECT DISTINCT g.*
      FROM groups g, user_group_paths ugp
      WHERE g.path @> ugp.path::ltree AND g.path != ugp.path
    `, {
      replacements: { userId },
      type: QueryTypes.SELECT
    });

    return { direct: directGroups, inherited: inheritedGroups };
  }

  async addUserToGroup(userId, groupId, role = 'member', invitedBy = null) {
    // Vérifier la capacité du groupe
    const group = await this.db.groups.findByPk(groupId);
    if (group.max_members) {
      const currentCount = await this.db.user_groups.count({
        where: { group_id: groupId, status: 'active' }
      });
      if (currentCount >= group.max_members) {
        throw new Error('Group is at maximum capacity');
      }
    }

    // Vérifier si l'utilisateur n'est pas déjà membre
    const existing = await this.db.user_groups.findOne({
      where: { user_id: userId, group_id: groupId }
    });

    if (existing) {
      if (existing.status === 'active') {
        throw new Error('User is already a member');
      } else {
        // Réactiver l'appartenance
        await existing.update({
          status: 'active',
          role: role,
          invited_by: invitedBy
        });
        return existing;
      }
    }

    // Créer la nouvelle appartenance
    const status = group.requires_approval && !invitedBy ? 'pending' : 'active';
    
    return await this.db.user_groups.create({
      user_id: userId,
      group_id: groupId,
      role: role,
      status: status,
      invited_by: invitedBy
    });
  }
}

# Configuration des profils utilisateur
profiles:
  # Champs personnalisés
  customFields:
    - name: "employee_id"
      type: "string"
      required: true
      validation: "^EMP[0-9]{6}$"
      
    - name: "security_clearance"
      type: "enum"
      options: ["PUBLIC", "INTERNAL", "CONFIDENTIAL", "SECRET"]
      default: "PUBLIC"
      
    - name: "cost_center"
      type: "string"
      required: false
      
    - name: "hire_date"
      type: "date"
      required: false
      
    - name: "certifications"
      type: "array"
      itemType: "string"
      
    - name: "skills"
      type: "tags"
      maxItems: 10
      
    - name: "avatar_url"
      type: "url"
      validation: "^https://.*\\.(jpg|jpeg|png|gif)$"
      
  # Préférences utilisateur
  preferences:
    notification_types:
      - page_comment
      - page_update
      - group_invitation
      - system_maintenance
      
    notification_methods:
      - email
      - push
      - in_app
      
    ui_preferences:
      - theme
      - language
      - timezone
      - date_format
      
  # Visibilité des champs
  visibility:
    public: ["display_name", "title", "department"]
    internal: ["phone", "office_location", "manager"]
    private: ["employee_id", "hire_date"]