feat(f6.2): add per-act representative signing and user smtp

api-v3/src/administration/users/users.service.ts

@@ -29,6 +29,7 @@ import type { CreateUserDto } from './dto/create-user.dto';
 import type { ListUsersQueryDto } from './dto/list-users-query.dto';
 import type { ReplaceUserRolesDto } from './dto/replace-user-roles.dto';
 import type { ResetUserPasswordDto } from './dto/reset-user-password.dto';
+import type { UpdateSelfProfileDto } from './dto/update-self-profile.dto';
 import type { UpdateUserDto } from './dto/update-user.dto';
 
 export interface UserRoleView {
@@ -56,6 +57,7 @@ export interface AdministrativeUserView {
   createdAt: Date;
   updatedAt: Date;
   roles: UserRoleView[];
+  smtpMode: 'SYSTEM' | 'CUSTOM';
 }
 
 interface UserViewRow extends AdministrativeUserView {
@@ -76,10 +78,10 @@ function roleSelectionInvalid(): BadRequestException {
   });
 }
 
-function inspectorEmailRequired(): BadRequestException {
+function userEmailRequired(): BadRequestException {
   return new BadRequestException({
-    code: 'INSPECTOR_EMAIL_REQUIRED',
-    message: 'Los usuarios con rol Inspector deben tener un email válido para recibir la documentación de sus inspecciones',
+    code: 'USER_EMAIL_REQUIRED',
+    message: 'Cada usuario de Hidrocarburos debe tener un email válido',
   });
 }
 
@@ -144,6 +146,7 @@ export class UsersService {
           user_account.password_changed_at AS "passwordChangedAt",
           user_account.created_at AS "createdAt",
           user_account.updated_at AS "updatedAt",
+          COALESCE((SELECT mode FROM user_smtp_settings WHERE user_id=user_account.id),'SYSTEM') AS "smtpMode",
           COALESCE(
             JSONB_AGG(
               JSONB_BUILD_OBJECT(
@@ -185,6 +188,24 @@ export class UsersService {
     );
   }
 
+  async getSelfProfile(userId: string): Promise<AdministrativeUserView> {
+    return this.getById(userId);
+  }
+
+  async updateSelfProfile(
+    dto: UpdateSelfProfileDto,
+    principal: AuthPrincipal,
+    request: RequestWithContext,
+  ): Promise<AdministrativeUserView> {
+    if (!dto.email?.trim()) throw userEmailRequired();
+    return this.update(
+      principal.userId,
+      { email: dto.email, phone: dto.phone, jobTitle: dto.jobTitle },
+      principal,
+      request,
+    );
+  }
+
   async create(
     dto: CreateUserDto,
     principal: AuthPrincipal,
@@ -195,10 +216,10 @@ export class UsersService {
     try {
       return await this.dataSource.transaction(async (manager) => {
         const roles = await this.resolveRoles(manager, dto.roleIds);
-        this.assertInspectorHasEmail(roles, dto.email ?? null);
+        if (!dto.email?.trim()) throw userEmailRequired();
         const user = manager.getRepository(User).create({
           username: dto.username.trim().toLowerCase(),
-          email: dto.email?.trim().toLowerCase() || null,
+          email: dto.email.trim().toLowerCase(),
           dni: dto.dni ?? null,
           phone: dto.phone ?? null,
           jobTitle: dto.jobTitle ?? null,
@@ -268,15 +289,13 @@ export class UsersService {
       return await this.dataSource.transaction(async (manager) => {
         const user = await this.lockUser(manager, id);
         const before = await this.loadUserView(manager, id);
-        if (dto.email !== undefined && !dto.email && before.roles.some((role) => role.code === 'inspector')) {
-          throw inspectorEmailRequired();
-        }
+        if (dto.email !== undefined && !dto.email) throw userEmailRequired();
 
         if (dto.username !== undefined) {
           user.username = dto.username.trim().toLowerCase();
         }
         if (dto.email !== undefined) {
-          user.email = dto.email?.trim().toLowerCase() || null;
+          user.email = dto.email!.trim().toLowerCase();
         }
         if (dto.dni !== undefined) user.dni = dto.dni ?? null;
         if (dto.phone !== undefined) user.phone = dto.phone ?? null;
@@ -286,6 +305,13 @@ export class UsersService {
         if (dto.lastName !== undefined) user.lastName = dto.lastName.trim();
         user.updatedBy = principal.userId;
         await manager.getRepository(User).save(user);
+        if (dto.email !== undefined && user.email) {
+          await manager.query(`
+            UPDATE user_smtp_settings
+            SET from_email=$2,reply_to=$2,updated_by=$1,updated_at=CURRENT_TIMESTAMP
+            WHERE user_id=$1 AND mode='CUSTOM'
+          `, [id, user.email]);
+        }
 
         const updated = await this.loadUserView(manager, id);
         await this.audit.record(
@@ -414,7 +440,6 @@ export class UsersService {
       await this.lockUser(manager, id);
       const roles = await this.resolveRoles(manager, dto.roleIds);
       const before = await this.loadUserView(manager, id);
-      this.assertInspectorHasEmail(roles, before.email);
       const beforeIds = before.roles.map((role) => role.id).sort();
       const afterIds = roles.map((role) => role.id).sort();
       if (beforeIds.join(',') === afterIds.join(',')) return before;
@@ -453,12 +478,6 @@ export class UsersService {
     return roles;
   }
 
-  private assertInspectorHasEmail(roles: Role[], email: string | null | undefined): void {
-    if (roles.some((role) => role.code === 'inspector') && !email?.trim()) {
-      throw inspectorEmailRequired();
-    }
-  }
-
   private async insertUserRoles(
     manager: EntityManager,
     userId: string,
@@ -511,6 +530,7 @@ export class UsersService {
           user_account.password_changed_at AS "passwordChangedAt",
           user_account.created_at AS "createdAt",
           user_account.updated_at AS "updatedAt",
+          COALESCE((SELECT mode FROM user_smtp_settings WHERE user_id=user_account.id),'SYSTEM') AS "smtpMode",
           COALESCE(
             JSONB_AGG(
               JSONB_BUILD_OBJECT(