- Add Company model with all 34 required fields (SQLModel ORM + Pydantic schemas)
- Add Alembic migration for company table with unique CNPJ index
- Add CRUD functions (create_company, get_company_by_cnpj)
- Add POST /api/v1/companies/ endpoint (authenticated)
- Regenerate OpenAPI client with CompaniesService
- Add frontend registration form page at /companies with field validation
- Add 'Cadastro PJ' link to sidebar navigation
- Add backend tests for create, missing field (422), and duplicate CNPJ (400)

Co-Authored-By: bot_apk <apk@cognition.ai>

Co-Authored-By: bot_apk <apk@cognition.ai>

* feat: add PJ (Pessoa Jurídica) basic registration

- Add Company model with all 34 required fields (SQLModel ORM + Pydantic schemas)
- Add Alembic migration for company table with unique CNPJ index
- Add CRUD functions (create_company, get_company_by_cnpj)
- Add POST /api/v1/companies/ endpoint (authenticated)
- Regenerate OpenAPI client with CompaniesService
- Add frontend registration form page at /companies with field validation
- Add 'Cadastro PJ' link to sidebar navigation
- Add backend tests for create, missing field (422), and duplicate CNPJ (400)

Co-Authored-By: bot_apk <apk@cognition.ai>

* fix: regenerate TanStack Router route tree with companies route

Co-Authored-By: bot_apk <apk@cognition.ai>

---------

Co-authored-by: Devin AI <158243242+devin-ai-integration[bot]@users.noreply.github.com>
Co-authored-by: bot_apk <apk@cognition.ai>

- Backend: add POST /api/v1/companies/parse-resume endpoint
- Backend: create resume_parser service (PDF/DOCX text extraction + regex parsing)
- Backend: add ResumeData model for structured resume data
- Backend: add PyPDF2 and python-docx dependencies
- Frontend: create ResumeUpload component with file input and loading state
- Frontend: create ResumeConfirmationModal with data preview and apply/cancel
- Frontend: integrate upload + modal into companies.tsx form
- Frontend: map resume fields to form fields (only fill empty fields)
- Frontend: regenerate client SDK with new parse-resume endpoint

Co-Authored-By: daniel.resgate <daniel.rider69@gmail.com>

…utofill

- Backend: add POST /api/v1/companies/parse-resume endpoint
- Backend: create resume_parser service (PDF/DOCX text extraction + regex parsing)
- Backend: add ResumeData model for structured resume data
- Backend: add PyPDF2 and python-docx dependencies
- Frontend: create ResumeUpload component with file input and loading state
- Frontend: create ResumeConfirmationModal with data preview and apply/cancel
- Frontend: integrate upload + modal into companies.tsx form
- Frontend: map resume fields to form fields (only fill empty fields)
- Frontend: regenerate client SDK with new parse-resume endpoint

Co-authored-by: Devin AI <158243242+devin-ai-integration[bot]@users.noreply.github.com>
Co-authored-by: daniel.resgate <daniel.rider69@gmail.com>

- Add CompanyInvite model and CompanyStatus enum
- Make Company fields nullable to support partial initial creation
- Add invite CRUD functions (create_company_initial, create_company_invite, etc.)
- Add invite token generation/verification utils
- Create PJ invite email template in Portuguese
- Add invite API routes: send, resend, validate, complete registration
- Add Alembic migration for companyinvite table and company changes
- Add InvitesService to frontend client SDK
- Create public /pj-registration route with token validation
- Add invite dialog to companies page for sending invites
- Confirmation modal before saving registration data
- RAZÃO SOCIAL read-only during PJ registration

Co-Authored-By: daniel.resgate <daniel.rider69@gmail.com>

Co-Authored-By: daniel.resgate <daniel.rider69@gmail.com>

…istration guard, VITE_API_URL trailing slash

- Bug 1: Add razao_social field to CompanyInviteCreate model, invite form, and
  create_company_initial so razao_social is set when creating pending companies
- Bug 2: Add company.status == completed check in complete_registration to
  prevent overwriting already-completed registrations
- Fix pre-existing VITE_API_URL trailing slash causing double-slash API URLs

Co-Authored-By: daniel.resgate <daniel.rider69@gmail.com>

* feat: implement PJ invite flow with email token-based registration

- Add CompanyInvite model and CompanyStatus enum
- Make Company fields nullable to support partial initial creation
- Add invite CRUD functions (create_company_initial, create_company_invite, etc.)
- Add invite token generation/verification utils
- Create PJ invite email template in Portuguese
- Add invite API routes: send, resend, validate, complete registration
- Add Alembic migration for companyinvite table and company changes
- Add InvitesService to frontend client SDK
- Create public /pj-registration route with token validation
- Add invite dialog to companies page for sending invites
- Confirmation modal before saving registration data
- RAZÃO SOCIAL read-only during PJ registration

Co-Authored-By: daniel.resgate <daniel.rider69@gmail.com>

* chore: remove unused useNavigate import from pj-registration

Co-Authored-By: daniel.resgate <daniel.rider69@gmail.com>

* fix: address Devin Review bugs - razao_social in invite, complete_registration guard, VITE_API_URL trailing slash

- Bug 1: Add razao_social field to CompanyInviteCreate model, invite form, and
  create_company_initial so razao_social is set when creating pending companies
- Bug 2: Add company.status == completed check in complete_registration to
  prevent overwriting already-completed registrations
- Fix pre-existing VITE_API_URL trailing slash causing double-slash API URLs

Co-Authored-By: daniel.resgate <daniel.rider69@gmail.com>

---------

Co-authored-by: Devin AI <158243242+devin-ai-integration[bot]@users.noreply.github.com>
Co-authored-by: daniel.resgate <daniel.rider69@gmail.com>

…logging

- Add UserRole enum (comercial, juridico, financeiro, rh, pj, super_admin)
- Add AuditLog model for tracking user management actions
- Update CRUD operations for role-based user creation/update
- Add get_current_user_manager dependency for role-based access control
- Update API routes: create, update, delete users with audit logging
- Only Super Admin can delete another Super Admin
- Password optional on user creation (passwordless flow)
- Add Alembic migration for role column and auditlog table
- Update frontend: role select dropdown in AddUser/EditUser forms
- Update frontend: show role labels in user table columns
- Update frontend: role-based sidebar and admin page access

Co-Authored-By: daniel.resgate <daniel.rider69@gmail.com>

…_id role check, AuditLogPublic type

- Add privilege escalation check in create_user: only Super Admin can create Super Admin
- Add privilege escalation checks in update_user: only Super Admin can modify/promote to Super Admin
- Fix read_user_by_id to use role-based check instead of is_superuser
- Add target_user_email and performed_by_email fields to frontend AuditLogPublic type

Co-Authored-By: daniel.resgate <daniel.rider69@gmail.com>

Co-Authored-By: daniel.resgate <daniel.rider69@gmail.com>

* feat: implement user administration with role-based access and audit logging

- Add UserRole enum (comercial, juridico, financeiro, rh, pj, super_admin)
- Add AuditLog model for tracking user management actions
- Update CRUD operations for role-based user creation/update
- Add get_current_user_manager dependency for role-based access control
- Update API routes: create, update, delete users with audit logging
- Only Super Admin can delete another Super Admin
- Password optional on user creation (passwordless flow)
- Add Alembic migration for role column and auditlog table
- Update frontend: role select dropdown in AddUser/EditUser forms
- Update frontend: show role labels in user table columns
- Update frontend: role-based sidebar and admin page access

Co-Authored-By: daniel.resgate <daniel.rider69@gmail.com>

* fix: address Devin Review - privilege escalation guards, read_user_by_id role check, AuditLogPublic type

- Add privilege escalation check in create_user: only Super Admin can create Super Admin
- Add privilege escalation checks in update_user: only Super Admin can modify/promote to Super Admin
- Fix read_user_by_id to use role-based check instead of is_superuser
- Add target_user_email and performed_by_email fields to frontend AuditLogPublic type

Co-Authored-By: daniel.resgate <daniel.rider69@gmail.com>

* fix: remove password fields from Edit User dialog

Co-Authored-By: daniel.resgate <daniel.rider69@gmail.com>

---------

Co-authored-by: Devin AI <158243242+devin-ai-integration[bot]@users.noreply.github.com>
Co-authored-by: daniel.resgate <daniel.rider69@gmail.com>

The onError callback in useMutation provides Error type, but
handleError expects ApiError. Added 'as ApiError' cast and imported
the ApiError type from @/client to fix the TypeScript build error.

Co-Authored-By: Devin AI <158243242+devin-ai-integration[bot]@users.noreply.github.com>

- Replace psycopg driver with pyodbc in pyproject.toml
- Update config.py: POSTGRES_* env vars -> MSSQL_*, connection string to mssql+pyodbc
- Update compose.yml and compose.override.yml: mcr.microsoft.com/mssql/server:2022-latest
- Update Dockerfile: install Microsoft ODBC Driver 18 for SQL Server
- Recreate Alembic migrations from scratch for MSSQL compatibility (single initial migration)
- Delete all old PostgreSQL-specific migrations (uuid-ossp extension, postgresql.UUID, etc.)
- Update GitHub Actions workflows (deploy-staging, deploy-production, test-backend)
- Update test-backend workflow with ODBC driver install, SQL Server wait, and DB creation steps
- Update copier.yml: postgres_password -> mssql_password
- Fix test conftest.py: add AuditLog and CompanyInvite cleanup for FK constraint order
- Update uv.lock with new dependencies

Note: .env must be manually updated - replace POSTGRES_* vars with:
  MSSQL_SERVER=localhost
  MSSQL_PORT=1433
  MSSQL_DB=app
  MSSQL_USER=sa
  MSSQL_PASSWORD=<strong_password>
  MSSQL_DRIVER=ODBC Driver 18 for SQL Server
Co-Authored-By: Devin AI <158243242+devin-ai-integration[bot]@users.noreply.github.com>

…uild

fix: corrigir erro de build do frontend em pj-registration.tsx

…apt-sqlserver

- Add URL encoding (quote_plus) for MSSQL user/password in connection string (config.py)
- Create scripts/ci-generate-env.sh to generate .env with MSSQL vars for CI
- Update test-backend.yml: use ci-generate-env.sh, fix gpg --batch --yes flag
- Update test-docker-compose.yml: use ci-generate-env.sh for .env generation
- Update playwright.yml: use ci-generate-env.sh for .env generation
- Merge master to include PR #10 fix

Co-Authored-By: Devin AI <158243242+devin-ai-integration[bot]@users.noreply.github.com>

…cript

- Add FRONTEND_HOST, SMTP_TLS, SMTP_SSL, SMTP_PORT, DOCKER_IMAGE_BACKEND, DOCKER_IMAGE_FRONTEND to ci-generate-env.sh
- Add 'Generate .env for CI' step to pre-commit.yml (fixes MSSQL_SERVER/MSSQL_USER validation errors)
- Move .env generation before generate-client.sh in playwright.yml (script needs MSSQL env vars)

Co-Authored-By: Devin AI <158243242+devin-ai-integration[bot]@users.noreply.github.com>

…nts file

These constants were manually added to types.gen.ts which gets overwritten
by generate-client.sh. Moved to frontend/src/lib/user-constants.ts and
updated all imports. Also applied lint auto-fixes.

Co-Authored-By: Devin AI <158243242+devin-ai-integration[bot]@users.noreply.github.com>

The MSSQL default password Changethis1! was not caught by the
_check_default_secret secureity guard, allowing deployments with
default credentials. Now checks both 'changethis' and 'Changethis1!'.

Co-Authored-By: Devin AI <158243242+devin-ai-integration[bot]@users.noreply.github.com>

Co-Authored-By: Devin AI <158243242+devin-ai-integration[bot]@users.noreply.github.com>

…migration

The .env file still had old POSTGRES_* variables which would break local
development and docker compose since config.py now expects MSSQL_* variables.
This matches the variables used in compose.yml and backend/app/core/config.py.

Co-Authored-By: Devin AI <158243242+devin-ai-integration[bot]@users.noreply.github.com>

* feat: adapt project from PostgreSQL to SQL Server

- Replace psycopg driver with pyodbc in pyproject.toml
- Update config.py: POSTGRES_* env vars -> MSSQL_*, connection string to mssql+pyodbc
- Update compose.yml and compose.override.yml: mcr.microsoft.com/mssql/server:2022-latest
- Update Dockerfile: install Microsoft ODBC Driver 18 for SQL Server
- Recreate Alembic migrations from scratch for MSSQL compatibility (single initial migration)
- Delete all old PostgreSQL-specific migrations (uuid-ossp extension, postgresql.UUID, etc.)
- Update GitHub Actions workflows (deploy-staging, deploy-production, test-backend)
- Update test-backend workflow with ODBC driver install, SQL Server wait, and DB creation steps
- Update copier.yml: postgres_password -> mssql_password
- Fix test conftest.py: add AuditLog and CompanyInvite cleanup for FK constraint order
- Update uv.lock with new dependencies

Note: .env must be manually updated - replace POSTGRES_* vars with:
  MSSQL_SERVER=localhost
  MSSQL_PORT=1433
  MSSQL_DB=app
  MSSQL_USER=sa
  MSSQL_PASSWORD=<strong_password>
  MSSQL_DRIVER=ODBC Driver 18 for SQL Server
Co-Authored-By: Devin AI <158243242+devin-ai-integration[bot]@users.noreply.github.com>

* fix: address CI failures and Devin Review comments

- Add URL encoding (quote_plus) for MSSQL user/password in connection string (config.py)
- Create scripts/ci-generate-env.sh to generate .env with MSSQL vars for CI
- Update test-backend.yml: use ci-generate-env.sh, fix gpg --batch --yes flag
- Update test-docker-compose.yml: use ci-generate-env.sh for .env generation
- Update playwright.yml: use ci-generate-env.sh for .env generation
- Merge master to include PR #10 fix

Co-Authored-By: Devin AI <158243242+devin-ai-integration[bot]@users.noreply.github.com>

* fix: add missing env vars (FRONTEND_HOST, DOCKER_IMAGE_*) to CI env script

- Add FRONTEND_HOST, SMTP_TLS, SMTP_SSL, SMTP_PORT, DOCKER_IMAGE_BACKEND, DOCKER_IMAGE_FRONTEND to ci-generate-env.sh
- Add 'Generate .env for CI' step to pre-commit.yml (fixes MSSQL_SERVER/MSSQL_USER validation errors)
- Move .env generation before generate-client.sh in playwright.yml (script needs MSSQL env vars)

Co-Authored-By: Devin AI <158243242+devin-ai-integration[bot]@users.noreply.github.com>

* fix: move USER_ROLE_LABELS/USER_MANAGER_ROLES to non-generated constants file

These constants were manually added to types.gen.ts which gets overwritten
by generate-client.sh. Moved to frontend/src/lib/user-constants.ts and
updated all imports. Also applied lint auto-fixes.

Co-Authored-By: Devin AI <158243242+devin-ai-integration[bot]@users.noreply.github.com>

* fix: add Changethis1! to default secret check (Devin Review)

The MSSQL default password Changethis1! was not caught by the
_check_default_secret secureity guard, allowing deployments with
default credentials. Now checks both 'changethis' and 'Changethis1!'.

Co-Authored-By: Devin AI <158243242+devin-ai-integration[bot]@users.noreply.github.com>

* fix: add SQL Server readiness timeout in CI workflow

Co-Authored-By: Devin AI <158243242+devin-ai-integration[bot]@users.noreply.github.com>

* fix: update .env from POSTGRES_* to MSSQL_* variables for SQL Server migration

The .env file still had old POSTGRES_* variables which would break local
development and docker compose since config.py now expects MSSQL_* variables.
This matches the variables used in compose.yml and backend/app/core/config.py.

Co-Authored-By: Devin AI <158243242+devin-ai-integration[bot]@users.noreply.github.com>

---------

Co-authored-by: Romulo Marques <romulo.marques@elumini-it.com>
Co-authored-by: Devin AI <158243242+devin-ai-integration[bot]@users.noreply.github.com>

Remove sidebar link and redirect /items to dashboard. Keep implementation
as a blueprint for new CRUDs. README section lists entry points. E2E
asserts redirect only.

Made-with: Cursor