@hed-hog/core 0.0.360 → 0.0.362

package/src/auth/auth.service.ts

@@ -6,6 +6,7 @@ import {
   forwardRef,
   Inject,
   Injectable,
+  Logger,
   NotFoundException,
   UnauthorizedException,
 } from '@nestjs/common';
@@ -21,6 +22,7 @@ import { LoginDTO } from './dto/login.dto';
 
 @Injectable()
 export class AuthService {
+  private readonly logger = new Logger(AuthService.name);
 
   constructor(
     @Inject(forwardRef(() => PrismaService))
@@ -46,7 +48,8 @@ export class AuthService {
     const payload = { sub: userId, sessionId: session.id };
     const accessToken = await this.token.createAccessToken(payload);
     await this.prisma.user.update({ where: { id: userId }, data: { last_login_at: new Date() } });
-    
+    this.logger.debug(`[AuthService] Session created userId=${userId} sessionId=${session.id}`);
+
     return {
       accessToken,
       refreshToken,
@@ -474,9 +477,12 @@ export class AuthService {
   async refreshAccessToken(locale: string, refreshToken: string, ipAddress: string, userAgent: string) {
 
     if (!refreshToken) {
+      this.logger.warn(`[AuthService] refreshAccessToken called without token ip=${ipAddress}`);
       throw new UnauthorizedException(getLocaleText('accessDenied', locale, 'Access denied.'));
     }
 
+    this.logger.debug(`[AuthService] refreshAccessToken ip=${ipAddress} ua=${userAgent?.slice(0, 40)}`);
+
     const { session, token } = await this.session.refresh(
       locale,
       refreshToken,
@@ -488,6 +494,8 @@ export class AuthService {
     const payload = { sub: user.id, sessionId: session.id };
     const accessToken = await this.token.createAccessToken(payload);
 
+    this.logger.debug(`[AuthService] refreshAccessToken success userId=${user.id} newSessionId=${session.id}`);
+
     return { accessToken, refreshToken: token, session };
 
   }
@@ -780,7 +788,8 @@ export class AuthService {
       throw new BadRequestException(getLocaleText('webauthnNotConfigured', locale, 'WebAuthn not configured.'));
     }
 
-    const rpID = new URL(process.env.FRONTEND_URL || 'http://localhost:3200').hostname;
+    const primaryOrigin = (process.env.CORS_ALLOWED_ORIGINS ?? '').split(/[\n,;]+/).map(u => u.trim()).filter(Boolean)[0] ?? 'http://localhost:3200';
+    const rpID = new URL(primaryOrigin).hostname;
 
     const allowCredentials = user.user_mfa
       .filter(mfa => mfa.user_mfa_webauthn && mfa.user_mfa_webauthn.length > 0)
@@ -834,8 +843,9 @@ export class AuthService {
     }
 
     const authenticator = challengeRecord.user_mfa.user_mfa_webauthn[0];
-    const rpID = new URL(process.env.FRONTEND_URL || 'http://localhost:3200').hostname;
-    const expectedOrigin = process.env.FRONTEND_URL || 'http://localhost:3200';
+    const primaryOrigin = (process.env.CORS_ALLOWED_ORIGINS ?? '').split(/[\n,;]+/).map(u => u.trim()).filter(Boolean)[0] ?? 'http://localhost:3200';
+    const rpID = new URL(primaryOrigin).hostname;
+    const expectedOrigin = primaryOrigin;
 
     const verification = await verifyAuthenticationResponse({
       response: assertionResponse,

package/src/auth/guards/auth.guard.ts

@@ -5,6 +5,7 @@ import {
   CanActivate,
   ExecutionContext,
   Injectable,
+  Logger,
   UnauthorizedException,
 } from '@nestjs/common';
 import { Reflector } from '@nestjs/core';
@@ -14,6 +15,8 @@ import { TokenService } from '../../token/token.service';
 
 @Injectable()
 export class AuthGuard implements CanActivate {
+  private readonly logger = new Logger(AuthGuard.name);
+
   constructor(
     private token: TokenService,
     private reflector: Reflector,
@@ -50,23 +53,26 @@ export class AuthGuard implements CanActivate {
       if (isPublic) {
         return true;
       } else if (withNoRole) {
+        this.logger.debug(`[AuthGuard] No token: ${request.method} ${request.url}`);
         // @NoRole() requires authentication but no specific role — token is mandatory
         throw new UnauthorizedException(
           getLocaleText('accessDenied', locale, 'Access denied.'),
         );
       } else if (withRole) {
+        this.logger.debug(`[AuthGuard] No token: ${request.method} ${request.url}`);
         // @Role() decorator requires authentication
         throw new UnauthorizedException(
           getLocaleText('accessDenied', locale, 'Access denied.'),
         );
       } else {
+        this.logger.debug(`[AuthGuard] No token: ${request.method} ${request.url}`);
         // No explicit decorator, default behavior (deny)
         throw new UnauthorizedException(
           getLocaleText('accessDenied', locale, 'Access denied.'),
         );
       }
     }
-    
+
     try {
       const payload = await this.token.verify(locale, token);
 
@@ -75,8 +81,9 @@ export class AuthGuard implements CanActivate {
       if (isPublic) {
         return true;
       } else {
-        // Return proper 401 status with clear message for JWT errors
-        const message = (error as any)?.message || (error as any)?.name || 'Unauthorized';
+        const errName = (error as any)?.name ?? 'UnknownError';
+        const message = (error as any)?.message || errName || 'Unauthorized';
+        this.logger.warn(`[AuthGuard] Token rejected ${request.method} ${request.url} error=${errName}: ${message}`);
         throw new UnauthorizedException(message);
       }
     }

package/src/file/file.module.ts

@@ -5,6 +5,7 @@ import { JwtModule } from '@nestjs/jwt';
 import { SettingModule } from '../setting/setting.module';
 import { FileController } from './file.controller';
 import { FileService } from './file.service';
+import { ImageOptimizationService } from './image-optimization.service';
 
 @Module({
   imports: [
@@ -15,8 +16,8 @@ import { FileService } from './file.service';
       JwtModule,
     ),
   ],
-  providers: [FileService],
-  exports: [FileService],
+  providers: [FileService, ImageOptimizationService],
+  exports: [FileService, ImageOptimizationService],
   controllers: [FileController],
 })
 export class FileModule { }

package/src/file/file.service.ts

@@ -1,26 +1,46 @@
+import {
+  GetBucketNotificationConfigurationCommand,
+  HeadBucketCommand,
+  HeadObjectCommand,
+  PutBucketNotificationConfigurationCommand,
+  S3Client,
+} from '@aws-sdk/client-s3';
+import {
+  AddPermissionCommand,
+  CreateFunctionCommand,
+  GetFunctionConfigurationCommand,
+  LambdaClient,
+  UpdateFunctionConfigurationCommand,
+} from '@aws-sdk/client-lambda';
+import {
+  AssumeRoleCommand,
+  GetSessionTokenCommand,
+  STSClient,
+} from '@aws-sdk/client-sts';
 import { getLocaleText } from '@hed-hog/api-locale';
 import { PaginationDTO, PaginationService } from '@hed-hog/api-pagination';
 import { PrismaService } from '@hed-hog/api-prisma';
 import {
-    BadRequestException,
-    forwardRef,
-    Inject,
-    Injectable,
-    Logger,
-    NotFoundException,
-    OnModuleInit
+  BadRequestException,
+  forwardRef,
+  Inject,
+  Injectable,
+  Logger,
+  NotFoundException,
+  OnModuleInit
 } from '@nestjs/common';
 import { JwtService } from '@nestjs/jwt';
 import { createWriteStream, promises as fs } from 'fs';
 import { basename, dirname } from 'path';
 import { pipeline } from 'stream/promises';
 import {
-    buildStorageConfigFromIntegration,
-    resolveFileProviderSlug,
-    resolveStorageEnumProvider,
+  buildStorageConfigFromIntegration,
+  resolveFileProviderSlug,
+  resolveStorageEnumProvider,
 } from '../integration-profile/integration-profile.utils';
 import { SettingService } from '../setting/setting.service';
 import { DeleteDTO } from './dto/delete.dto';
+import { ImageOptimizationService } from './image-optimization.service';
 import { AbstractProvider } from './provider/abstract.provider';
 import { ProviderFactory } from './provider/provider.factory';
 
@@ -65,6 +85,8 @@ export class FileService implements OnModuleInit {
     private readonly settingService: SettingService,
     @Inject(forwardRef(() => JwtService))
     private readonly jwtService: JwtService,
+    @Inject(forwardRef(() => ImageOptimizationService))
+    private readonly imageOptimizationService: ImageOptimizationService,
   ) { }
 
   async onModuleInit() {
@@ -391,21 +413,30 @@ export class FileService implements OnModuleInit {
       fileBuffer.originalname,
     );
 
+    const optimized = await this.imageOptimizationService.optimizeBuffer(
+      fileBuffer.buffer,
+      fileBuffer.mimetype,
+      normalizedFilename,
+    );
+
     const normalizedFile = {
       ...fileBuffer,
-      originalname: normalizedFilename,
+      buffer: optimized.buffer,
+      mimetype: optimized.mimetype,
+      originalname: optimized.originalname,
+      size: optimized.buffer.length,
     };
 
     const url = await provider.upload(destination, normalizedFile);
 
     const file = await this.prismaService.file.create({
       data: {
-        filename: normalizedFilename,
+        filename: optimized.originalname,
         path: url,
         provider_id: this.providerId,
         location: destination,
-        mimetype_id: await this.getMimeType(fileBuffer.mimetype),
-        size: fileBuffer.size,
+        mimetype_id: await this.getMimeType(optimized.mimetype),
+        size: optimized.buffer.length,
       },
     });
 
@@ -450,45 +481,35 @@ export class FileService implements OnModuleInit {
       throw new BadRequestException(`File too large: ${size} bytes`);
     }
 
-    const provider = await this.getProvider();
-    const providerWithPathUpload = provider as AbstractProvider & {
-      uploadFromPath?: (
-        destination: string,
-        filePath: string,
-        options?: { filename?: string; mimetype?: string },
-      ) => Promise<string>;
-    };
+    // Read buffer to allow image optimization regardless of provider support
+    const rawBuffer = await fs.readFile(filePath);
+    const optimized = await this.imageOptimizationService.optimizeBuffer(
+      rawBuffer,
+      mimetype,
+      originalname,
+    );
 
-    let url: string;
-    if (typeof providerWithPathUpload.uploadFromPath === 'function') {
-      url = await providerWithPathUpload.uploadFromPath(destination, filePath, {
-        filename: originalname,
-        mimetype,
-      });
-    } else {
-      // Fallback explícito para providers legados sem suporte nativo por path.
-      const buffer = await fs.readFile(filePath);
-      url = await provider.upload(destination, {
-        fieldname: 'file',
-        originalname,
-        encoding: metadata?.encoding ?? '7bit',
-        mimetype,
-        size,
-        destination: '',
-        filename: originalname,
-        path: filePath,
-        buffer,
-      });
-    }
+    const provider = await this.getProvider();
+    const url = await provider.upload(destination, {
+      fieldname: 'file',
+      originalname: optimized.originalname,
+      encoding: metadata?.encoding ?? '7bit',
+      mimetype: optimized.mimetype,
+      size: optimized.buffer.length,
+      destination: '',
+      filename: optimized.originalname,
+      path: filePath,
+      buffer: optimized.buffer,
+    });
 
     const file = await this.prismaService.file.create({
       data: {
-        filename: originalname,
+        filename: optimized.originalname,
         path: url,
         provider_id: this.providerId,
         location: destination,
-        mimetype_id: await this.getMimeType(mimetype),
-        size,
+        mimetype_id: await this.getMimeType(optimized.mimetype),
+        size: optimized.buffer.length,
       },
     });
 
@@ -666,6 +687,387 @@ export class FileService implements OnModuleInit {
     return url;
   }
 
+  async getTemporaryCredentials(params: {
+    accessKeyId: string;
+    secretAccessKey: string;
+    sessionToken?: string;
+    region: string;
+    roleArn?: string;
+    externalId?: string;
+    durationSeconds: number;
+    sessionName: string;
+  }): Promise<{
+    AccessKeyId: string;
+    SecretAccessKey: string;
+    SessionToken: string;
+    Expiration?: Date;
+  }> {
+    const stsClient = new STSClient({
+      region: params.region,
+      credentials: {
+        accessKeyId: params.accessKeyId,
+        secretAccessKey: params.secretAccessKey,
+        ...(params.sessionToken ? { sessionToken: params.sessionToken } : {}),
+      },
+    });
+
+    let creds: { AccessKeyId?: string; SecretAccessKey?: string; SessionToken?: string; Expiration?: Date } | undefined;
+
+    if (params.roleArn) {
+      const result = await stsClient.send(
+        new AssumeRoleCommand({
+          RoleArn: params.roleArn,
+          RoleSessionName: params.sessionName,
+          DurationSeconds: params.durationSeconds,
+          ...(params.externalId ? { ExternalId: params.externalId } : {}),
+        }),
+      );
+      creds = result.Credentials;
+    } else {
+      const result = await stsClient.send(
+        new GetSessionTokenCommand({ DurationSeconds: params.durationSeconds }),
+      );
+      creds = result.Credentials;
+    }
+
+    if (!creds?.AccessKeyId || !creds.SecretAccessKey || !creds.SessionToken) {
+      throw new BadRequestException('Could not generate temporary AWS credentials.');
+    }
+
+    return {
+      AccessKeyId: creds.AccessKeyId,
+      SecretAccessKey: creds.SecretAccessKey,
+      SessionToken: creds.SessionToken,
+      Expiration: creds.Expiration,
+    };
+  }
+
+  async headS3Object(params: {
+    accessKeyId: string;
+    secretAccessKey: string;
+    sessionToken?: string;
+    region: string;
+    bucket: string;
+    key: string;
+  }): Promise<{ ContentLength?: number; ETag?: string }> {
+    const s3 = new S3Client({
+      region: params.region,
+      credentials: {
+        accessKeyId: params.accessKeyId,
+        secretAccessKey: params.secretAccessKey,
+        ...(params.sessionToken ? { sessionToken: params.sessionToken } : {}),
+      },
+    });
+
+    const result = await s3.send(
+      new HeadObjectCommand({ Bucket: params.bucket, Key: params.key }),
+    );
+
+    return {
+      ContentLength: result.ContentLength,
+      ETag: result.ETag,
+    };
+  }
+
+  async headS3Bucket(params: {
+    accessKeyId: string;
+    secretAccessKey: string;
+    sessionToken?: string;
+    region: string;
+    bucket: string;
+  }): Promise<void> {
+    const s3 = new S3Client({
+      region: params.region,
+      credentials: {
+        accessKeyId: params.accessKeyId,
+        secretAccessKey: params.secretAccessKey,
+        ...(params.sessionToken ? { sessionToken: params.sessionToken } : {}),
+      },
+    });
+
+    await s3.send(new HeadBucketCommand({ Bucket: params.bucket }));
+  }
+
+  async getLambdaFunctionConfiguration(params: {
+    functionName: string;
+    region: string;
+    accessKeyId: string;
+    secretAccessKey: string;
+    sessionToken?: string;
+  }) {
+    const lambda = new LambdaClient({
+      region: params.region,
+      credentials: {
+        accessKeyId: params.accessKeyId,
+        secretAccessKey: params.secretAccessKey,
+        ...(params.sessionToken ? { sessionToken: params.sessionToken } : {}),
+      },
+    });
+
+    return lambda.send(
+      new GetFunctionConfigurationCommand({
+        FunctionName: params.functionName,
+      }),
+    );
+  }
+
+  async updateLambdaEnvironmentVariables(params: {
+    functionName: string;
+    region: string;
+    accessKeyId: string;
+    secretAccessKey: string;
+    sessionToken?: string;
+    environmentVariables: Record<string, string>;
+  }) {
+    const lambda = new LambdaClient({
+      region: params.region,
+      credentials: {
+        accessKeyId: params.accessKeyId,
+        secretAccessKey: params.secretAccessKey,
+        ...(params.sessionToken ? { sessionToken: params.sessionToken } : {}),
+      },
+    });
+
+    const current = await lambda.send(
+      new GetFunctionConfigurationCommand({
+        FunctionName: params.functionName,
+      }),
+    );
+
+    const merged = {
+      ...(current.Environment?.Variables ?? {}),
+      ...params.environmentVariables,
+    };
+
+    await lambda.send(
+      new UpdateFunctionConfigurationCommand({
+        FunctionName: params.functionName,
+        Environment: {
+          Variables: merged,
+        },
+      }),
+    );
+
+    return {
+      functionName: current.FunctionName ?? params.functionName,
+      functionArn: current.FunctionArn ?? null,
+    };
+  }
+
+  async createLambdaFunctionIfMissing(params: {
+    functionName: string;
+    region: string;
+    accessKeyId: string;
+    secretAccessKey: string;
+    sessionToken?: string;
+    roleArn: string;
+    packageType: 'Image' | 'Zip';
+    imageUri?: string;
+    zipFile?: Uint8Array;
+    s3Bucket?: string;
+    s3Key?: string;
+    s3ObjectVersion?: string;
+    handler?: string;
+    runtime?: string;
+    timeout?: number;
+    memorySize?: number;
+    environmentVariables?: Record<string, string>;
+  }) {
+    const lambda = new LambdaClient({
+      region: params.region,
+      credentials: {
+        accessKeyId: params.accessKeyId,
+        secretAccessKey: params.secretAccessKey,
+        ...(params.sessionToken ? { sessionToken: params.sessionToken } : {}),
+      },
+    });
+
+    try {
+      const existing = await lambda.send(
+        new GetFunctionConfigurationCommand({
+          FunctionName: params.functionName,
+        }),
+      );
+
+      return {
+        created: false,
+        functionName: existing.FunctionName ?? params.functionName,
+        functionArn: existing.FunctionArn ?? null,
+      };
+    } catch (error: any) {
+      if (String(error?.name ?? '') !== 'ResourceNotFoundException') {
+        throw error;
+      }
+    }
+
+    const baseInput = {
+      FunctionName: params.functionName,
+      Role: params.roleArn,
+      PackageType: params.packageType,
+      Timeout: params.timeout,
+      MemorySize: params.memorySize,
+      Environment: params.environmentVariables
+        ? {
+            Variables: params.environmentVariables,
+          }
+        : undefined,
+    } as const;
+
+    const created =
+      params.packageType === 'Image'
+        ? await lambda.send(
+            new CreateFunctionCommand({
+              ...baseInput,
+              Code: {
+                ImageUri: params.imageUri,
+              },
+            }),
+          )
+        : await lambda.send(
+            new CreateFunctionCommand({
+              ...baseInput,
+              Handler: params.handler,
+              Runtime: params.runtime as any,
+              Code: {
+                ...(params.zipFile
+                  ? {
+                      ZipFile: params.zipFile,
+                    }
+                  : {
+                      S3Bucket: params.s3Bucket,
+                      S3Key: params.s3Key,
+                      ...(params.s3ObjectVersion
+                        ? {
+                            S3ObjectVersion: params.s3ObjectVersion,
+                          }
+                        : {}),
+                    }),
+              },
+            }),
+          );
+
+    return {
+      created: true,
+      functionName: created.FunctionName ?? params.functionName,
+      functionArn: created.FunctionArn ?? null,
+    };
+  }
+
+  async allowS3InvokeLambda(params: {
+    functionName: string;
+    region: string;
+    accessKeyId: string;
+    secretAccessKey: string;
+    sessionToken?: string;
+    bucketName: string;
+    sourceAccount?: string;
+    statementId?: string;
+  }) {
+    const lambda = new LambdaClient({
+      region: params.region,
+      credentials: {
+        accessKeyId: params.accessKeyId,
+        secretAccessKey: params.secretAccessKey,
+        ...(params.sessionToken ? { sessionToken: params.sessionToken } : {}),
+      },
+    });
+
+    const statementId =
+      params.statementId ?? `lms-bulk-upload-${params.bucketName.replace(/[^a-zA-Z0-9-_]/g, '-')}`;
+
+    try {
+      await lambda.send(
+        new AddPermissionCommand({
+          FunctionName: params.functionName,
+          StatementId: statementId.slice(0, 100),
+          Action: 'lambda:InvokeFunction',
+          Principal: 's3.amazonaws.com',
+          SourceArn: `arn:aws:s3:::${params.bucketName}`,
+          ...(params.sourceAccount
+            ? {
+                SourceAccount: params.sourceAccount,
+              }
+            : {}),
+        }),
+      );
+    } catch (error: any) {
+      if (String(error?.name ?? '') === 'ResourceConflictException') {
+        return;
+      }
+
+      throw error;
+    }
+  }
+
+  async configureS3BucketLambdaNotification(params: {
+    bucketName: string;
+    lambdaArn: string;
+    region: string;
+    accessKeyId: string;
+    secretAccessKey: string;
+    sessionToken?: string;
+    configurationId?: string;
+    prefix?: string;
+  }) {
+    const s3 = new S3Client({
+      region: params.region,
+      credentials: {
+        accessKeyId: params.accessKeyId,
+        secretAccessKey: params.secretAccessKey,
+        ...(params.sessionToken ? { sessionToken: params.sessionToken } : {}),
+      },
+    });
+
+    const configurationId =
+      params.configurationId ?? 'lms-bulk-upload-object-created';
+
+    const existing = await s3.send(
+      new GetBucketNotificationConfigurationCommand({
+        Bucket: params.bucketName,
+      }),
+    );
+
+    const lambdaConfigurations = Array.isArray(existing?.LambdaFunctionConfigurations)
+      ? existing.LambdaFunctionConfigurations.filter((cfg: any) => cfg?.Id !== configurationId)
+      : [];
+
+    lambdaConfigurations.push({
+      Id: configurationId,
+      LambdaFunctionArn: params.lambdaArn,
+      Events: ['s3:ObjectCreated:*'],
+      ...(params.prefix
+        ? {
+            Filter: {
+              Key: {
+                FilterRules: [
+                  {
+                    Name: 'prefix',
+                    Value: params.prefix,
+                  },
+                ],
+              },
+            },
+          }
+        : {}),
+    });
+
+    await s3.send(
+      new PutBucketNotificationConfigurationCommand({
+        Bucket: params.bucketName,
+        NotificationConfiguration: {
+          TopicConfigurations: Array.isArray(existing?.TopicConfigurations)
+            ? existing.TopicConfigurations
+            : [],
+          QueueConfigurations: Array.isArray(existing?.QueueConfigurations)
+            ? existing.QueueConfigurations
+            : [],
+          EventBridgeConfiguration: existing?.EventBridgeConfiguration,
+          LambdaFunctionConfigurations: lambdaConfigurations,
+        },
+      }),
+    );
+  }
+
   createDownloadToken(filepath: string, expires = 3600) {
     if (!filepath) {
       throw new BadRequestException(`No file path provided`);