Overview

Fact: an employee now exists in CNA One. The payload is a snapshot of the employee and of the person it points at, enough for CNA AuthCNA AuthService•v1.0.0Authentication and identity provider for the CNA platform (accounts, tokens, OTP/2FA, per-application access grants). Co...SubscribesGrantApplicationAccess, RevokeApplicationAccess +2Ownercna-platformMapRepoView docs to provision identity without calling back.

When it is published. CNA OneCNA OneService•v1.0.0Franchise operating system (franchises and employees, pricing, products and learning books, school operations). Publishe...PublishesGrantApplicationAccess, EmployeeCreated +6SubscribesInviteUser, FranchiseCreated +9Ownercna-platformMapRepoView docs publishes it after the write completes, not inside afterCommit:

• createEmployee, when a franchise manager creates an employee: after e-mail validation, findOrCreatePerson and the transaction that saves the employee and its inactive staff link.
• syncFranchisePartners, while handling a FranchiseCreated from Nexus: one message per partner that did not yet exist as an employee (partners that already existed get EmployeeUpdated instead).

It is deliberately not published for the employee created by InviteUser: that flow provisions the login through GrantApplicationAccess instead.

What the consumer does. cna-auth (accountConsumer, handler syncEmployeeEvent, shared with EmployeeUpdated):

1. Rejects the message when person.type is not CPF (logged, reported to Sentry, dropped).
2. Finds or creates the Account by person.document, setting name (name and surname joined), employeeId (the payload id) and personId. A new account gets an OTP authentication method when it has none.
3. Finds the User in that account by employeeId, falling back to email; creates it when missing and sends the first-access e-mail for application cna-one. Existing users are updated: name, email, employeeId, and blockedAt set when isActive is false, cleared when true.

Failures are logged and reported to Sentry, never rethrown; the offset is committed either way.

Kafka

Payload schema

Source of truth

export type EmployeePayload = {
  id: string;
  email: string;
  isActive: boolean;
  person: {
    id: string;
    name: string;
    surname: string;
    birthdate?: string | null;
    document: string;
    type: string;
    email?: string | null;
    phone?: string | null;
  };
};

class EmployeeCreated extends Event<EmployeePayload> {
  public static owner = "ONE";
  public static aggregateRoot = "Employee";
  public static routingKey = "id";
}

Known drift

• cna-auth api/app/events/one/employee/EmployeeCreated.ts names the type EmployeeEventPayload, extracts the nested object as EmployeePersonData, and types birthdate as Date | null. On the wire it is the YYYY-MM-DD string TypeORM returns for a date column.
• cna-auth’s handler passes the literal cna-one as the application of the first-access e-mail although its docstring says it uses metadata.owner.