Allow admins to manage user passwords

backend/routes/usersRoutes.js

@@ -1,4 +1,5 @@
 const express = require('express');
+const bcrypt = require('bcryptjs');
 const crypto = require('crypto');
 const { requireRole } = require('../middleware/auth');
 const {
@@ -7,10 +8,12 @@ const {
   canManageUserStatus,
   canChangeUserEmail,
   canManageUserRoleOrTeam,
+  canManageUserPassword,
 } = require('../policies/accessPolicy');
 const { recordActivity } = require('../services/activityService');
 
 const USER_PUBLIC_FIELDS = 'id, tenant_id, team_id, name, email, slug, role, status, bio, avatar_url, created_at';
+const MIN_PASSWORD_LENGTH = 8;
 
 const createUsersRouter = ({ pool, upload, transporter, getBaseUrl }) => {
   const router = express.Router();
@@ -60,8 +63,9 @@ const createUsersRouter = ({ pool, upload, transporter, getBaseUrl }) => {
   });
 
   router.post('/users', requireRole(['admin', 'manager', 'super_admin']), async (req, res) => {
-    const { name, email, role, team_id, tenant_id } = req.body;
+    const { name, email, role, team_id, tenant_id, password } = req.body;
     const effectiveTenantId = req.user.role === 'super_admin' ? tenant_id : req.user.tenant_id;
+    const shouldSetPassword = typeof password === 'string' && password.length > 0;
 
     let finalRole = role || 'agent';
     let finalTeamId = team_id || null;
@@ -72,18 +76,32 @@ const createUsersRouter = ({ pool, upload, transporter, getBaseUrl }) => {
       finalTeamId = req.user.team_id;
     }
     try {
+      if (shouldSetPassword && !canManageUserPassword(req.user)) {
+        return res.status(403).json({ error: 'Apenas admins podem definir senha de usuários.' });
+      }
+      if (shouldSetPassword && password.length < MIN_PASSWORD_LENGTH) {
+        return res.status(400).json({ error: `A senha deve ter pelo menos ${MIN_PASSWORD_LENGTH} caracteres.` });
+      }
+      if (finalRole === 'super_admin' && req.user.role !== 'super_admin') {
+        return res.status(403).json({ error: 'Apenas super admins podem criar super admins.' });
+      }
+
       const [existing] = await pool.query('SELECT id FROM users WHERE email = ?', [email]);
       if (existing.length > 0) return res.status(400).json({ error: 'E-mail já cadastrado.' });
 
       const uid = `u_${crypto.randomUUID().split('-')[0]}`;
       const slug = `${name.toLowerCase().replace(/[^a-z0-9]+/g, '-')}-${crypto.randomBytes(4).toString('hex')}`;
-      const placeholderHash = 'pending_setup';
+      const passwordHash = shouldSetPassword ? await bcrypt.hash(password, 10) : 'pending_setup';
 
       await pool.query(
         'INSERT INTO users (id, tenant_id, team_id, name, email, password_hash, slug, role, status) VALUES (?, ?, ?, ?, ?, ?, ?, ?, ?)',
-        [uid, effectiveTenantId, finalTeamId, name, email, placeholderHash, slug, finalRole, 'active']
+        [uid, effectiveTenantId, finalTeamId, name, email, passwordHash, slug, finalRole, 'active']
       );
 
+      if (shouldSetPassword) {
+        return res.status(201).json({ id: uid, message: 'Membro criado com senha definida.' });
+      }
+
       const token = crypto.randomBytes(32).toString('hex');
       await pool.query(
         'INSERT INTO password_resets (email, token, expires_at) VALUES (?, ?, DATE_ADD(NOW(), INTERVAL 15 MINUTE))',
@@ -119,12 +137,22 @@ const createUsersRouter = ({ pool, upload, transporter, getBaseUrl }) => {
   });
 
   router.put('/users/:id', async (req, res) => {
-    const { name, bio, role, team_id, status, email } = req.body;
+    const { name, bio, role, team_id, status, email, password } = req.body;
+    const shouldUpdatePassword = typeof password === 'string' && password.length > 0;
     try {
       const [existing] = await pool.query('SELECT * FROM users WHERE id = ?', [req.params.id]);
       if (existing.length === 0) return res.status(404).json({ error: 'Not found' });
 
       if (!canUpdateUser(req.user, existing[0])) return res.status(403).json({ error: 'Acesso negado.' });
+      if (shouldUpdatePassword && !canManageUserPassword(req.user)) {
+        return res.status(403).json({ error: 'Apenas admins podem alterar senha de usuários.' });
+      }
+      if (shouldUpdatePassword && password.length < MIN_PASSWORD_LENGTH) {
+        return res.status(400).json({ error: `A senha deve ter pelo menos ${MIN_PASSWORD_LENGTH} caracteres.` });
+      }
+      if (role === 'super_admin' && req.user.role !== 'super_admin') {
+        return res.status(403).json({ error: 'Apenas super admins podem definir super admins.' });
+      }
 
       const finalRole = canManageUserRoleOrTeam(req.user) && role !== undefined ? role : existing[0].role;
       const finalTeamId = canManageUserRoleOrTeam(req.user) && team_id !== undefined ? team_id : existing[0].team_id;
@@ -141,6 +169,12 @@ const createUsersRouter = ({ pool, upload, transporter, getBaseUrl }) => {
         [name || existing[0].name, bio !== undefined ? bio : existing[0].bio, finalEmail, finalRole, finalTeamId || null, finalStatus, req.params.id]
       );
 
+      if (shouldUpdatePassword) {
+        const passwordHash = await bcrypt.hash(password, 10);
+        await pool.query('UPDATE users SET password_hash = ? WHERE id = ?', [passwordHash, req.params.id]);
+        await pool.query('DELETE FROM password_resets WHERE email = ?', [finalEmail]);
+      }
+
       if (finalTeamId && finalTeamId !== existing[0].team_id && existing[0].status === 'active') {
         const [team] = await pool.query('SELECT name FROM teams WHERE id = ?', [finalTeamId]);
         if (team.length > 0) {