API: Usuarios¶

Visao Geral¶

CRUD de usuarios com controle de acesso por roles (Admin/SuperAdmin). Email e unico globalmente.

Endpoints¶

GET /api/users¶

Lista usuarios.

Permissao: Admin ou SuperAdmin

Response (200 OK):

[
  {
    "id": "550e8400-e29b-41d4-a716-446655440000",
    "name": "Maria Silva",
    "email": "maria@empresa.com",
    "role": "Admin",
    "isActive": true,
    "mustChangePassword": false,
    "lastLoginAt": "2026-02-01T00:10:00Z",
    "tenantId": "660e8400-e29b-41d4-a716-446655440001",
    "tenantName": "Empresa ABC"
  }
]

POST /api/users¶

Cria usuario.

Permissao: Admin ou SuperAdmin

Request:

{
  "name": "Joao Souza",
  "email": "joao@empresa.com",
  "password": "Senha123",
  "role": "User",
  "tenantId": "660e8400-e29b-41d4-a716-446655440001"
}

Response (201 Created):

{
  "id": "550e8400-e29b-41d4-a716-446655440000",
  "name": "Joao Souza",
  "email": "joao@empresa.com",
  "role": "User",
  "isActive": true,
  "mustChangePassword": true,
  "tenantId": "660e8400-e29b-41d4-a716-446655440001",
  "tenantName": "Empresa ABC"
}

PUT /api/users/{id}¶

Atualiza usuario (nome, email, role).

Permissao: Admin ou SuperAdmin

Request:

{
  "name": "Joao Souza",
  "email": "joao@empresa.com",
  "role": "Admin"
}

Response (200 OK):

{
  "id": "550e8400-e29b-41d4-a716-446655440000",
  "name": "Joao Souza",
  "email": "joao@empresa.com",
  "role": "Admin",
  "isActive": true,
  "mustChangePassword": false,
  "tenantId": "660e8400-e29b-41d4-a716-446655440001",
  "tenantName": "Empresa ABC"
}

PUT /api/users/{id}/status¶

Ativa ou desativa usuario.

Permissao: Admin ou SuperAdmin

Request:

{
  "isActive": false
}

Response (200 OK):

{
  "id": "550e8400-e29b-41d4-a716-446655440000",
  "isActive": false
}

POST /api/users/{id}/reset-password¶

Reseta senha de outro usuario e marca mustChangePassword=true.

Permissao: Admin ou SuperAdmin

Request:

{
  "newPassword": "NovaSenha123"
}

Response (204 No Content)

POST /api/users/me/password¶

Altera a propria senha.

Permissao: Usuario autenticado

Request:

{
  "currentPassword": "SenhaAtual123",
  "newPassword": "NovaSenha123"
}

Response (204 No Content)

Regras de Negocio¶

Email unico globalmente
Admin so gerencia usuarios do proprio tenant
SuperAdmin pode criar usuarios para qualquer tenant
Usuario nao pode desativar a si mesmo
Usuario nao pode rebaixar a si mesmo
Requisitos de senha: minimo 8 caracteres, 1 maiuscula, 1 minuscula, 1 numero
Desativar usuario invalida tokens/sessoes em novas requisicoes

Erros Comuns¶

Status	Codigo	Descricao
400	VALIDATION_FAILED	Dados invalidos
401	UNAUTHORIZED	Nao autenticado
403	FORBIDDEN	Sem permissao
404	USER_NOT_FOUND	Usuario inexistente
409	USER_CONFLICT	Email ja cadastrado