@hed-hog/core 0.0.303 → 0.0.305

package/src/index.ts

@@ -19,13 +19,13 @@ export * from './screen/screen.service';
 export * from './user/constants/user.constants';
 export * from './user/user.service';
 
-export * from './mail/mail.module';
-export * from './mail/mail.service';
-
-export * from './file/file.module';
-export * from './file/file.service';
-export * from './setting/setting.module';
-export * from './setting/setting.service';
+export * from './mail/mail.module';
+export * from './mail/mail.service';
+
+export * from './file/file.module';
+export * from './file/file.service';
+export * from './setting/setting.module';
+export * from './setting/setting.service';
 
 export * from './ai/ai.module';
 export * from './ai/ai.service';
@@ -50,3 +50,6 @@ export * from './validators/is-email-with-settings.validator';
 export * from './validators/is-pin-code-with-setting.validator';
 export * from './validators/is-strong-password-with-settings.validator';
 
+// Utilities
+export * from './utils/locale-context';
+

package/src/mail-sent/dto/query-mail-sent-list.dto.ts

@@ -0,0 +1,30 @@
+import { PaginationDTO } from '@hed-hog/api-pagination';
+import { Transform } from 'class-transformer';
+import { IsIn, IsOptional, IsString } from 'class-validator';
+
+export class QueryMailSentListDTO extends PaginationDTO {
+  @IsOptional()
+  @Transform(({ value }) => String(value ?? '').trim().toLowerCase())
+  @IsIn(['all', 'received', 'read', 'error'])
+  status?: 'all' | 'received' | 'read' | 'error';
+
+  @IsOptional()
+  @Transform(({ value }) => String(value ?? '').trim().toLowerCase())
+  @IsString()
+  hasError?: string;
+
+  @IsOptional()
+  @Transform(({ value }) => String(value ?? '').trim())
+  @IsString()
+  recipientEmail?: string;
+
+  @IsOptional()
+  @Transform(({ value }) => String(value ?? '').trim())
+  @IsString()
+  createdAtFrom?: string;
+
+  @IsOptional()
+  @Transform(({ value }) => String(value ?? '').trim())
+  @IsString()
+  createdAtTo?: string;
+}

package/src/mail-sent/mail-sent.controller.ts

@@ -11,9 +11,11 @@ import {
   ParseIntPipe,
   Patch,
   Post,
+  Query,
   forwardRef,
 } from '@nestjs/common';
 import { CreateDTO } from './dto/create.dto';
+import { QueryMailSentListDTO } from './dto/query-mail-sent-list.dto';
 import { UpdateDTO } from './dto/update.dto';
 import { MailSentService } from './mail-sent.service';
 
@@ -26,8 +28,18 @@ export class MailSentController {
   ) {}
 
   @Get()
-  async list(@Pagination() paginationParams) {
-    return this.mailSentService.list(paginationParams);
+  async list(
+    @Pagination() paginationParams,
+    @Query() query: QueryMailSentListDTO,
+  ) {
+    return this.mailSentService.list({
+      ...paginationParams,
+      status: query.status,
+      hasError: query.hasError,
+      recipientEmail: query.recipientEmail,
+      createdAtFrom: query.createdAtFrom,
+      createdAtTo: query.createdAtTo,
+    });
   }
 
   @Get(':id')

package/src/mail-sent/mail-sent.service.ts

@@ -1,6 +1,6 @@
 import { DeleteDTO } from '@hed-hog/api';
 import { getLocaleText } from '@hed-hog/api-locale';
-import { PaginationDTO, PaginationService } from '@hed-hog/api-pagination';
+import { PaginationService } from '@hed-hog/api-pagination';
 import { PrismaService } from '@hed-hog/api-prisma';
 import {
   BadRequestException,
@@ -10,8 +10,28 @@ import {
   forwardRef,
 } from '@nestjs/common';
 import { CreateDTO } from './dto/create.dto';
+import { QueryMailSentListDTO } from './dto/query-mail-sent-list.dto';
 import { UpdateDTO } from './dto/update.dto';
 
+type MailSentUserStatus = 'received' | 'read' | 'error';
+
+type MailSentUserLog = {
+  id: number;
+  recipient_email: string;
+  status: MailSentUserStatus;
+  read_at: Date | null;
+  error_code: string | null;
+  error_message: string | null;
+  user_id: number;
+  user_identifier_id: number | null;
+  created_at: Date;
+  updated_at: Date;
+};
+
+type MailSentWithUsers = {
+  mail_sent_user?: MailSentUserLog[];
+};
+
 @Injectable()
 export class MailSentService {
   constructor(
@@ -21,26 +41,161 @@ export class MailSentService {
     private readonly paginationService: PaginationService,
   ) { }
 
-  async list(paginationParams: PaginationDTO) {
+  async list(paginationParams: QueryMailSentListDTO) {
     const fields = ['subject', 'from', 'to', 'cc', 'bcc', 'body'];
     const OR: any[] = this.prismaService.createInsensitiveSearch(
       fields,
       paginationParams,
     );
 
+    const AND: any[] = [];
+
+    if (
+      paginationParams.status &&
+      paginationParams.status !== 'all' &&
+      ['received', 'read', 'error'].includes(paginationParams.status)
+    ) {
+      AND.push({
+        mail_sent_user: {
+          some: {
+            status: paginationParams.status,
+          },
+        },
+      });
+    }
+
+    const recipientEmail = paginationParams.recipientEmail?.trim();
+    if (recipientEmail) {
+      AND.push({
+        mail_sent_user: {
+          some: {
+            recipient_email: {
+              contains: recipientEmail,
+              mode: 'insensitive',
+            },
+          },
+        },
+      });
+    }
+
+    const hasErrorRaw = paginationParams.hasError?.trim().toLowerCase();
+    if (hasErrorRaw === 'true' || hasErrorRaw === '1') {
+      AND.push({
+        mail_sent_user: {
+          some: {
+            status: 'error',
+          },
+        },
+      });
+    }
+
+    if (hasErrorRaw === 'false' || hasErrorRaw === '0') {
+      AND.push({
+        mail_sent_user: {
+          none: {
+            status: 'error',
+          },
+        },
+      });
+    }
+
+    const createdAt: { gte?: Date; lte?: Date } = {};
+    const createdAtFrom = paginationParams.createdAtFrom?.trim();
+    const createdAtTo = paginationParams.createdAtTo?.trim();
+
+    if (createdAtFrom) {
+      const parsedFrom = new Date(createdAtFrom);
+      if (!isNaN(parsedFrom.getTime())) {
+        createdAt.gte = parsedFrom;
+      }
+    }
+
+    if (createdAtTo) {
+      const parsedTo = new Date(createdAtTo);
+      if (!isNaN(parsedTo.getTime())) {
+        parsedTo.setHours(23, 59, 59, 999);
+        createdAt.lte = parsedTo;
+      }
+    }
+
     if (paginationParams.search && !isNaN(+paginationParams.search)) {
       OR.push({ id: { equals: +paginationParams.search } });
     }
 
-    return this.paginationService.paginate(
+    const result = await this.paginationService.paginate(
       this.prismaService.mail_sent,
       paginationParams,
       {
         where: {
-          OR,
+          ...(OR.length > 0 ? { OR } : {}),
+          ...(AND.length > 0 ? { AND } : {}),
+          ...(Object.keys(createdAt).length > 0 ? { created_at: createdAt } : {}),
+        },
+        include: {
+          mail_sent_user: {
+            select: {
+              id: true,
+              recipient_email: true,
+              status: true,
+              read_at: true,
+              error_code: true,
+              error_message: true,
+              user_id: true,
+              user_identifier_id: true,
+              created_at: true,
+              updated_at: true,
+            },
+          },
         },
       },
     );
+
+    const data = (result.data as MailSentWithUsers[]).map((item) => {
+      const recipientLogs = item.mail_sent_user ?? [];
+      const summary = recipientLogs.reduce(
+        (acc, recipient) => {
+          if (recipient.status === 'received') {
+            acc.receivedCount += 1;
+          }
+
+          if (recipient.status === 'read') {
+            acc.readCount += 1;
+            if (
+              recipient.read_at &&
+              (!acc.lastReadAt || recipient.read_at > acc.lastReadAt)
+            ) {
+              acc.lastReadAt = recipient.read_at;
+            }
+          }
+
+          if (recipient.status === 'error') {
+            acc.errorCount += 1;
+          }
+
+          return acc;
+        },
+        {
+          totalRecipients: recipientLogs.length,
+          receivedCount: 0,
+          readCount: 0,
+          errorCount: 0,
+          hasError: false,
+          lastReadAt: null as Date | null,
+        },
+      );
+
+      summary.hasError = summary.errorCount > 0;
+
+      return {
+        ...item,
+        deliverySummary: summary,
+      };
+    });
+
+    return {
+      ...result,
+      data,
+    };
   }
 
   async get(locale:string, id: number) {

package/src/oauth/oauth-callback-coordinator.service.ts

@@ -0,0 +1,158 @@
+import { Prisma, PrismaService } from '@hed-hog/api-prisma';
+import { Injectable, Logger } from '@nestjs/common';
+import { createHash } from 'crypto';
+import {
+    OAuthCallbackAlreadyProcessedError,
+    OAuthCallbackInProgressError,
+    OAuthProviderException,
+} from './oauth.errors';
+
+@Injectable()
+export class OAuthCallbackCoordinatorService {
+  private readonly logger = new Logger(OAuthCallbackCoordinatorService.name);
+  private readonly completedCallbacks = new Map<string, number>();
+  private readonly completedTtlMs = 10 * 60 * 1000;
+
+  constructor(private readonly prisma: PrismaService) {}
+
+  async execute<T>(callbackKey: string, callback: () => Promise<T>): Promise<T> {
+    this.pruneCompletedCallbacks();
+
+    if (this.isCompleted(callbackKey)) {
+      throw new OAuthCallbackAlreadyProcessedError();
+    }
+
+    try {
+      if (this.prisma.isPostgres()) {
+        return await this.executeWithPostgresLock(callbackKey, callback);
+      }
+
+      if (this.prisma.isMysql()) {
+        return await this.executeWithMysqlLock(callbackKey, callback);
+      }
+
+      this.logger.warn(
+        `OAuth callback coordination is running without distributed lock support for provider ${this.prisma.getProvider()}.`,
+      );
+
+      const result = await callback();
+      this.markCompleted(callbackKey);
+      return result;
+    } catch (error) {
+      if (this.shouldMarkCompleted(error)) {
+        this.markCompleted(callbackKey);
+      }
+
+      throw error;
+    }
+  }
+
+  private async executeWithPostgresLock<T>(
+    callbackKey: string,
+    callback: () => Promise<T>,
+  ): Promise<T> {
+    const lockKey = this.toSignedBigInt(callbackKey);
+
+    return this.prisma.$transaction(
+      async (tx) => {
+        const rows = await tx.$queryRaw<Array<{ locked: boolean }>>`
+          SELECT pg_try_advisory_xact_lock(${lockKey}) AS locked
+        `;
+
+        if (!rows[0]?.locked) {
+          throw new OAuthCallbackInProgressError();
+        }
+
+        const result = await callback();
+        this.markCompleted(callbackKey);
+        return result;
+      },
+      {
+        maxWait: 5_000,
+        timeout: 60_000,
+      },
+    );
+  }
+
+  private async executeWithMysqlLock<T>(
+    callbackKey: string,
+    callback: () => Promise<T>,
+  ): Promise<T> {
+    const lockName = this.toMysqlLockName(callbackKey);
+
+    return this.prisma.$transaction(
+      async (tx) => {
+        const rows = await tx.$queryRaw<Array<{ locked: 0 | 1 | null }>>(Prisma.sql`
+          SELECT GET_LOCK(${lockName}, 0) AS locked
+        `);
+
+        if (rows[0]?.locked !== 1) {
+          throw new OAuthCallbackInProgressError();
+        }
+
+        try {
+          const result = await callback();
+          this.markCompleted(callbackKey);
+          return result;
+        } finally {
+          await tx.$queryRaw(Prisma.sql`
+            SELECT RELEASE_LOCK(${lockName}) AS released
+          `);
+        }
+      },
+      {
+        maxWait: 5_000,
+        timeout: 60_000,
+      },
+    );
+  }
+
+  private shouldMarkCompleted(error: unknown) {
+    return (
+      error instanceof OAuthCallbackAlreadyProcessedError ||
+      (error instanceof OAuthProviderException &&
+        error.reason === 'callback_consumed')
+    );
+  }
+
+  private isCompleted(callbackKey: string) {
+    const expiresAt = this.completedCallbacks.get(callbackKey);
+    if (!expiresAt) {
+      return false;
+    }
+
+    if (expiresAt <= Date.now()) {
+      this.completedCallbacks.delete(callbackKey);
+      return false;
+    }
+
+    return true;
+  }
+
+  private markCompleted(callbackKey: string) {
+    this.completedCallbacks.set(callbackKey, Date.now() + this.completedTtlMs);
+  }
+
+  private pruneCompletedCallbacks() {
+    const now = Date.now();
+    for (const [callbackKey, expiresAt] of this.completedCallbacks.entries()) {
+      if (expiresAt <= now) {
+        this.completedCallbacks.delete(callbackKey);
+      }
+    }
+  }
+
+  private toSignedBigInt(callbackKey: string) {
+    const hex = createHash('sha256').update(callbackKey).digest('hex').slice(0, 16);
+    const unsigned = BigInt(`0x${hex}`);
+    const signedBoundary = BigInt(1) << BigInt(63);
+    return unsigned >= signedBoundary
+      ? unsigned - (BigInt(1) << BigInt(64))
+      : unsigned;
+  }
+
+  private toMysqlLockName(callbackKey: string) {
+    const suffix = createHash('sha256').update(callbackKey).digest('hex').slice(0, 48);
+    return `oauth:${suffix}`;
+  }
+}

package/src/oauth/oauth.controller.ts

@@ -9,6 +9,7 @@ import {
     Get,
     Headers,
     Ip,
+    Logger,
     Param,
     Query,
     Res,
@@ -18,8 +19,42 @@ import { OAuthService } from './oauth.service';
 
 @Controller('oauth')
 export class OAuthController {
+  private readonly logger = new Logger(OAuthController.name);
+
   constructor(private readonly service: OAuthService, private readonly settingService: SettingService) {}
 
+  private logOAuthRequest(
+    action: string,
+    provider: string,
+    {
+      locale,
+      origin,
+      referer,
+      host,
+      ipAddress,
+      userAgent,
+      code,
+    }: {
+      locale?: string;
+      origin?: string;
+      referer?: string;
+      host?: string;
+      ipAddress?: string;
+      userAgent?: string;
+      code?: string;
+    },
+  ) {
+    const summarizedUserAgent = userAgent
+      ? userAgent.length > 120
+        ? `${userAgent.slice(0, 117)}...`
+        : userAgent
+      : 'n/a';
+
+    this.logger.log(
+      `OAuth ${action}: provider=${provider} locale=${locale ?? 'n/a'} origin=${origin ?? 'n/a'} referer=${referer ?? 'n/a'} host=${host ?? 'n/a'} ip=${ipAddress ?? 'n/a'} hasCode=${code ? 'yes' : 'no'} codeLength=${code?.length ?? 0} userAgent="${summarizedUserAgent}"`,
+    );
+  }
+
   @Public()
   @Get('github/callback')
   async githubCallback(
@@ -35,7 +70,15 @@ export class OAuthController {
 
   @Public()
   @Get(':provider/login')
-  async login(@Param('provider') provider: string, @Res() res) {
+  async login(
+    @Headers('origin') origin: string,
+    @Headers('referer') referer: string,
+    @Headers('host') host: string,
+    @Param('provider') provider: string,
+    @Res() res,
+  ) {
+    this.logOAuthRequest('login-init', provider, { origin, referer, host });
+
     const url = await this.service.getAuthUrl(
       provider as user_account_provider_52222e2ecb_enum,
       `/callback/${provider}/login`,
@@ -72,10 +115,24 @@ export class OAuthController {
     @Locale() locale: string,
     @Ip() ipAddress: string,
     @Headers('user-agent') userAgent: string,
+    @Headers('origin') origin: string,
+    @Headers('referer') referer: string,
+    @Headers('host') host: string,
+    @Headers('x-forwarded-host') forwardedHost: string,
     @Param('provider') provider: string,
     @Query('code') code: string,
     @Res({ passthrough: true }) res,
   ) {
+    this.logOAuthRequest('callback-login', provider, {
+      locale,
+      origin,
+      referer,
+      host: forwardedHost || host,
+      ipAddress,
+      userAgent,
+      code,
+    });
+
     return this.service.handleCallback({ res, locale, ipAddress, userAgent, provider: provider as user_account_provider_52222e2ecb_enum, code, type: 'login' });
   }
 

package/src/oauth/oauth.errors.ts

@@ -0,0 +1,32 @@
+export type OAuthProviderFailureReason =
+  | 'callback_consumed'
+  | 'invalid_callback'
+  | 'upstream_failure';
+
+export class OAuthProviderException extends Error {
+  constructor(
+    public readonly provider: string,
+    public readonly reason: OAuthProviderFailureReason,
+    message: string,
+    public readonly status?: number,
+    public readonly providerError?: string,
+    public readonly providerErrorCode?: string,
+  ) {
+    super(message);
+    this.name = 'OAuthProviderException';
+  }
+}
+
+export class OAuthCallbackAlreadyProcessedError extends Error {
+  constructor() {
+    super('OAuth callback already processed.');
+    this.name = 'OAuthCallbackAlreadyProcessedError';
+  }
+}
+
+export class OAuthCallbackInProgressError extends Error {
+  constructor() {
+    super('OAuth callback is already in progress.');
+    this.name = 'OAuthCallbackInProgressError';
+  }
+}

package/src/oauth/oauth.module.ts

@@ -9,6 +9,7 @@ import { MailModule } from '../mail/mail.module';
 import { SecurityModule } from '../security/security.module';
 import { TokenModule } from '../token/token.module';
 import { UserModule } from '../user/user.module';
+import { OAuthCallbackCoordinatorService } from './oauth-callback-coordinator.service';
 import { OAuthController } from './oauth.controller';
 import { OAuthService } from './oauth.service';
 import { FacebookProvider } from './providers/facebook.provider';
@@ -31,7 +32,15 @@ import { MicrosoftProvider } from './providers/microsoft.provider';
     forwardRef(() => UserModule),
   ],
   controllers: [OAuthController],
-  providers: [OAuthService, GoogleProvider, FacebookProvider, GithubProvider, MicrosoftProvider, MicrosoftEntraIdProvider],
+  providers: [
+    OAuthCallbackCoordinatorService,
+    OAuthService,
+    GoogleProvider,
+    FacebookProvider,
+    GithubProvider,
+    MicrosoftProvider,
+    MicrosoftEntraIdProvider,
+  ],
   exports: [OAuthService],
 })
 export class OAuthModule {}