feat: add company management and manager role support

Co-authored-by: factory-droid[bot] <138933559+factory-droid[bot]@users.noreply.github.com>

web/convex/rbac.ts

@@ -5,6 +5,7 @@ import type { MutationCtx, QueryCtx } from "./_generated/server"
 
 const STAFF_ROLES = new Set(["ADMIN", "MANAGER", "AGENT", "COLLABORATOR"])
 const CUSTOMER_ROLE = "CUSTOMER"
+const MANAGER_ROLE = "MANAGER"
 
 type Ctx = QueryCtx | MutationCtx
 
@@ -51,3 +52,30 @@ export async function requireCustomer(ctx: Ctx, userId: Id<"users">, tenantId?:
   }
   return result
 }
+
+export async function requireCompanyManager(ctx: Ctx, userId: Id<"users">, tenantId?: string) {
+  const result = await requireUser(ctx, userId, tenantId)
+  if (result.role !== MANAGER_ROLE) {
+    throw new ConvexError("Apenas gestores da empresa podem executar esta ação")
+  }
+  if (!result.user.companyId) {
+    throw new ConvexError("Gestor não possui empresa vinculada")
+  }
+  return result
+}
+
+export async function requireCompanyAssociation(
+  ctx: Ctx,
+  userId: Id<"users">,
+  companyId: Id<"companies">,
+  tenantId?: string,
+) {
+  const result = await requireUser(ctx, userId, tenantId)
+  if (!result.user.companyId) {
+    throw new ConvexError("Usuário não possui empresa vinculada")
+  }
+  if (result.user.companyId !== companyId) {
+    throw new ConvexError("Usuário não pertence a esta empresa")
+  }
+  return result
+}