@hed-hog/core 0.0.361 → 0.0.362

package/hedhog/frontend/app/users/user-sheet.tsx.ejs

@@ -29,6 +29,12 @@ import {
 } from '@/components/ui/form';
 import { FormActions } from '@/components/ui/form-actions';
 import { Input } from '@/components/ui/input';
+import {
+  formatIntegrationProviderName,
+  IntegrationLogo,
+  normalizeIntegrationProvider,
+  resolveOAuthProvider,
+} from '@/components/ui/integration-logo';
 import { ResizableSheetContent } from '@/components/ui/resizable-sheet-content';
 import {
   Sheet,
@@ -36,6 +42,7 @@ import {
   SheetHeader,
   SheetTitle,
 } from '@/components/ui/sheet';
+import { Tabs, TabsContent, TabsList, TabsTrigger } from '@/components/ui/tabs';
 import { useFormDraft } from '@/hooks/use-form-draft';
 import { formatDateTime } from '@/lib/format-date';
 import { getPhotoUrl } from '@/lib/get-photo-url';
@@ -44,7 +51,6 @@ import { User, UserMfa } from '@hed-hog/api-types';
 import { useApp, useQuery } from '@hed-hog/next-app-provider';
 import { zodResolver } from '@hookform/resolvers/zod';
 import { Avatar, AvatarFallback, AvatarImage } from '@radix-ui/react-avatar';
-import { Tabs, TabsContent, TabsList, TabsTrigger } from '@/components/ui/tabs';
 import { formatDistanceToNow } from 'date-fns';
 import { enUS, ptBR } from 'date-fns/locale';
 import {
@@ -103,10 +109,42 @@ type UserEditDraftPayload = {
 
 const USER_CREATE_DRAFT_STORAGE_KEY = 'core-user-create-draft';
 
-const accountProviders = [
-  { name: 'Google', icon: '/google.svg' },
-  { name: 'GitHub', icon: '/github.svg' },
-  { name: 'Facebook', icon: '/facebook.svg' },
+const OAUTH_PROVIDER_TOGGLE_MAP: Array<{
+  settingSlug: string;
+  provider: {
+    id: string;
+    slug: string;
+    name: string;
+  };
+}> = [
+  {
+    settingSlug: 'oauth-facebook-enabled',
+    provider: { id: 'facebook', slug: 'facebook-oauth', name: 'Facebook' },
+  },
+  {
+    settingSlug: 'oauth-github-enabled',
+    provider: { id: 'github', slug: 'github-oauth', name: 'GitHub' },
+  },
+  {
+    settingSlug: 'oauth-google-enabled',
+    provider: { id: 'google', slug: 'google-oauth', name: 'Google' },
+  },
+  {
+    settingSlug: 'oauth-microsoft-enabled',
+    provider: {
+      id: 'microsoft',
+      slug: 'microsoft-oauth',
+      name: 'Microsoft',
+    },
+  },
+  {
+    settingSlug: 'oauth-microsoft-entra-id-enabled',
+    provider: {
+      id: 'microsoft-entra-id',
+      slug: 'microsoft-entra-id-oauth',
+      name: 'Microsoft Entra ID',
+    },
+  },
 ];
 
 function generateRandomPassword(length = 16) {
@@ -368,6 +406,13 @@ function UserEditSheet({
   const userActivityT = useTranslations('core.UserActivity');
   const { request, currentLocaleCode, getSettingValue } = useApp();
   const minPasswordLength = Number(getSettingValue('password-min-length')) || 6;
+  const enabledOAuthProviders = useMemo(
+    () =>
+      OAUTH_PROVIDER_TOGGLE_MAP.filter(
+        ({ settingSlug }) => getSettingValue(settingSlug) === true
+      ).map(({ provider }) => provider),
+    [getSettingValue]
+  );
 
   const [activeTab, setActiveTab] = useState('overview');
   const prevUserIdRef = useRef<number | null>(null);
@@ -419,6 +464,41 @@ function UserEditSheet({
     defaultValues: { password: '' },
   });
 
+  const passwordCredential = useMemo(() => {
+    const credentials = (editingUser as any)?.user_credential;
+    if (!Array.isArray(credentials) || credentials.length === 0) return null;
+
+    return (
+      credentials.find(
+        (credential) =>
+          String(credential?.type ?? '').toLowerCase() === 'password'
+      ) ?? credentials[0]
+    );
+  }, [editingUser]);
+
+  const passwordLastChangedStatus = useMemo(() => {
+    const changedAt =
+      passwordCredential?.updated_at ?? passwordCredential?.created_at ?? null;
+    if (!changedAt) return null;
+
+    const changedDate = new Date(changedAt);
+    if (Number.isNaN(changedDate.getTime())) return null;
+
+    const locale = currentLocaleCode === 'en' ? enUS : ptBR;
+
+    return {
+      relativeLabel: formatDistanceToNow(changedDate, {
+        addSuffix: true,
+        locale,
+      }),
+      absoluteLabel: formatDateTime(
+        changedDate,
+        getSettingValue,
+        currentLocaleCode
+      ),
+    };
+  }, [currentLocaleCode, getSettingValue, passwordCredential]);
+
   const watchedEditValues = useWatch({ control: editForm.control });
 
   const editDraftStorageKey = `core-user-edit-draft-${userId}`;
@@ -655,36 +735,38 @@ function UserEditSheet({
         </SheetHeader>
 
         <Tabs value={activeTab} onValueChange={setActiveTab}>
-          <TabsList className="overflow-x-auto">
-            <TabsTrigger value="overview">
-              <UserCircle className="h-4 w-4" />
-              <span className="hidden md:inline">{t('tabOverview')}</span>
-            </TabsTrigger>
-            <TabsTrigger value="edit">
-              <Save className="h-4 w-4" />
-              <span className="hidden md:inline">{t('tabEdit')}</span>
-            </TabsTrigger>
-            <TabsTrigger value="credentials">
-              <Key className="h-4 w-4" />
-              <span className="hidden md:inline">{t('tabCredentials')}</span>
-            </TabsTrigger>
-            <TabsTrigger value="identifiers">
-              <Fingerprint className="h-4 w-4" />
-              <span className="hidden md:inline">{t('tabIdentifiers')}</span>
-            </TabsTrigger>
-            <TabsTrigger value="permissions">
-              <ShieldCheck className="h-4 w-4" />
-              <span className="hidden md:inline">{t('tabPermissions')}</span>
-            </TabsTrigger>
-            <TabsTrigger value="mfa">
-              <Shield className="h-4 w-4" />
-              <span className="hidden md:inline">{t('tabMfa')}</span>
-            </TabsTrigger>
-            <TabsTrigger value="sessions">
-              <Monitor className="h-4 w-4" />
-              <span className="hidden md:inline">{t('tabSessions')}</span>
-            </TabsTrigger>
-          </TabsList>
+          <div className="sticky top-0 z-20 bg-background/95 backdrop-blur supports-backdrop-filter:bg-background/80">
+            <TabsList className="flex-wrap overflow-visible px-2 py-1.5">
+              <TabsTrigger value="overview">
+                <UserCircle className="h-4 w-4" />
+                <span>{t('tabOverview')}</span>
+              </TabsTrigger>
+              <TabsTrigger value="edit">
+                <Save className="h-4 w-4" />
+                <span>{t('tabEdit')}</span>
+              </TabsTrigger>
+              <TabsTrigger value="credentials">
+                <Key className="h-4 w-4" />
+                <span>{t('tabCredentials')}</span>
+              </TabsTrigger>
+              <TabsTrigger value="identifiers">
+                <Fingerprint className="h-4 w-4" />
+                <span>{t('tabIdentifiers')}</span>
+              </TabsTrigger>
+              <TabsTrigger value="permissions">
+                <ShieldCheck className="h-4 w-4" />
+                <span>{t('tabPermissions')}</span>
+              </TabsTrigger>
+              <TabsTrigger value="mfa">
+                <Shield className="h-4 w-4" />
+                <span>{t('tabMfa')}</span>
+              </TabsTrigger>
+              <TabsTrigger value="sessions">
+                <Monitor className="h-4 w-4" />
+                <span>{t('tabSessions')}</span>
+              </TabsTrigger>
+            </TabsList>
+          </div>
 
           {/* Overview Tab */}
           <TabsContent value="overview" className="space-y-4 mt-4 p-4 pt-0">
@@ -1044,10 +1126,28 @@ function UserEditSheet({
                 <h4 className="text-sm font-semibold">
                   {t('passwordResetTitle')}
                 </h4>
-                <p className="text-xs text-muted-foreground mt-1">
+                <p className="mt-1 text-xs text-muted-foreground">
                   {t('passwordResetDescription')}
                 </p>
               </div>
+              {passwordLastChangedStatus ? (
+                <div className="rounded-md border border-border/60 bg-muted/30 px-3 py-2">
+                  <p className="text-xs font-medium text-foreground">
+                    {t('passwordLastChangedHumanized', {
+                      relativeLabel: passwordLastChangedStatus.relativeLabel,
+                    })}
+                  </p>
+                  <p className="mt-1 text-[11px] text-muted-foreground">
+                    {t('passwordLastChangedAbsolute', {
+                      absoluteLabel: passwordLastChangedStatus.absoluteLabel,
+                    })}
+                  </p>
+                </div>
+              ) : (
+                <p className="text-xs text-muted-foreground">
+                  {t('passwordLastChangedUnavailable')}
+                </p>
+              )}
               <p className="text-xs text-muted-foreground">
                 {t('passwordResetNotice')}
               </p>
@@ -1057,7 +1157,7 @@ function UserEditSheet({
                   onClick={openResetPasswordDialog}
                   className="w-full sm:w-fit"
                 >
-                  <RefreshCcw className="h-4 w-4 mr-2" />
+                  <RefreshCcw className="mr-2 h-4 w-4" />
                   {t('buttonResetPassword')}
                 </Button>
               </div>
@@ -1068,30 +1168,44 @@ function UserEditSheet({
                 {t('connectedAccountsTitle')}
               </h4>
               <div className="space-y-2">
-                {accountProviders.map((provider) => {
+                {enabledOAuthProviders.map((provider) => {
+                  const normalizedProviderId = resolveOAuthProvider(
+                    provider.id
+                  );
                   const isConnected = editingUser.user_account?.some(
                     (account) =>
-                      account.provider?.toLowerCase() ===
-                      provider.name.toLowerCase()
+                      resolveOAuthProvider(
+                        normalizeIntegrationProvider(
+                          String(account.provider ?? '')
+                        )
+                      ) === normalizedProviderId
                   );
+
                   return (
                     <div
-                      key={provider.name}
+                      key={provider.slug}
                       className={`flex items-center justify-between rounded-lg border p-3 ${isConnected ? '' : 'border-dashed'}`}
                     >
                       <div className="flex items-center gap-3">
                         <div className="rounded-md bg-slate-50 p-2">
-                          <img
-                            src={provider.icon}
-                            alt={`${provider.name} icon`}
-                            className={`h-5 w-5 ${isConnected ? 'opacity-100' : 'opacity-50'}`}
+                          <IntegrationLogo
+                            provider={provider.slug}
+                            size={20}
+                            decorative={false}
+                            title={provider.name}
+                            className={
+                              isConnected ? 'opacity-100' : 'opacity-50'
+                            }
                           />
                         </div>
                         <div>
                           <p
                             className={`text-sm font-medium ${isConnected ? '' : 'text-muted-foreground'}`}
                           >
-                            {provider.name}
+                            {formatIntegrationProviderName(
+                              provider.slug,
+                              provider.name
+                            )}
                           </p>
                           <p className="text-xs text-muted-foreground">
                             {isConnected ? t('connected') : t('notConnected')}
@@ -1101,28 +1215,39 @@ function UserEditSheet({
                     </div>
                   );
                 })}
+                {enabledOAuthProviders.length === 0 && (
+                  <div className="rounded-lg border border-dashed p-3 text-sm text-muted-foreground">
+                    {t('noConnectedAccounts')}
+                  </div>
+                )}
               </div>
             </div>
 
-            <AlertDialog
+            <Sheet
               open={isResetPasswordDialogOpen}
               onOpenChange={(open) => {
                 setIsResetPasswordDialogOpen(open);
                 if (!open) setResetFormError(null);
               }}
             >
-              <AlertDialogContent>
-                <AlertDialogHeader>
-                  <AlertDialogTitle>
-                    {t('passwordResetDialogTitle')}
-                  </AlertDialogTitle>
-                  <AlertDialogDescription>
+              <ResizableSheetContent
+                sheetId="core-users-reset-password-sheet"
+                defaultWidth={520}
+                minWidth={420}
+                maxWidth={760}
+                className="w-full sm:max-w-lg overflow-y-auto gap-0"
+              >
+                <SheetHeader>
+                  <SheetTitle>{t('passwordResetDialogTitle')}</SheetTitle>
+                  <SheetDescription>
                     {t('passwordResetDialogDescription')}
-                  </AlertDialogDescription>
-                </AlertDialogHeader>
+                  </SheetDescription>
+                </SheetHeader>
+
+                <div className="w-full border-t" />
 
                 <Form {...resetPasswordForm}>
-                  <form className="space-y-4">
+                  <form className="flex flex-col gap-4 p-4">
                     <FormField
                       control={resetPasswordForm.control}
                       name="password"
@@ -1159,6 +1284,7 @@ function UserEditSheet({
                               <Button
                                 type="button"
                                 variant="outline"
+                                className="w-full sm:w-fit"
                                 onClick={() => {
                                   resetPasswordForm.setValue(
                                     'password',
@@ -1186,27 +1312,33 @@ function UserEditSheet({
                         <AlertDescription>{resetFormError}</AlertDescription>
                       </Alert>
                     )}
+
+                    <div className="mt-auto flex flex-col gap-2 border-t pt-4 sm:flex-row sm:justify-end">
+                      <Button
+                        type="button"
+                        variant="outline"
+                        onClick={() => setIsResetPasswordDialogOpen(false)}
+                      >
+                        {t('cancel')}
+                      </Button>
+                      <Button
+                        type="button"
+                        disabled={isResettingPassword}
+                        onClick={async () => {
+                          const valid = await resetPasswordForm.trigger();
+                          if (!valid) return;
+                          await onResetPasswordSubmit();
+                        }}
+                      >
+                        {isResettingPassword
+                          ? t('passwordResetSubmitting')
+                          : t('passwordResetConfirm')}
+                      </Button>
+                    </div>
                   </form>
                 </Form>
-
-                <AlertDialogFooter>
-                  <AlertDialogCancel>{t('cancel')}</AlertDialogCancel>
-                  <AlertDialogAction
-                    disabled={isResettingPassword}
-                    onClick={async (event) => {
-                      event.preventDefault();
-                      const valid = await resetPasswordForm.trigger();
-                      if (!valid) return;
-                      await onResetPasswordSubmit();
-                    }}
-                  >
-                    {isResettingPassword
-                      ? t('passwordResetSubmitting')
-                      : t('passwordResetConfirm')}
-                  </AlertDialogAction>
-                </AlertDialogFooter>
-              </AlertDialogContent>
-            </AlertDialog>
+              </ResizableSheetContent>
+            </Sheet>
 
             <AlertDialog
               open={isResetResultDialogOpen}

package/hedhog/frontend/messages/en.json

@@ -338,6 +338,9 @@
     "errorBulkRemovingRoles": "Error removing all roles",
     "passwordResetTitle": "Password Reset",
     "passwordResetDescription": "Generate a new password for this user.",
+    "passwordLastChangedHumanized": "This password has not been changed {relativeLabel}.",
+    "passwordLastChangedAbsolute": "Last recorded update: {absoluteLabel}",
+    "passwordLastChangedUnavailable": "The system could not determine when this password was last updated.",
     "passwordResetNotice": "After this reset, the user must change the password on the next login.",
     "buttonResetPassword": "Reset Password",
     "passwordResetDialogTitle": "Reset User Password",
@@ -1230,6 +1233,7 @@
     "fileUrlPlaceholder": "File URL",
     "selectOption": "Select an option",
     "selectMailProfile": "Select a mail profile",
+    "mailProfileEmptyState": "No mail profiles found.",
     "selectWhatsAppProfile": "Select a WhatsApp profile",
     "selectStorageProfile": "Select a storage profile",
     "storageProfileEmptyState": "No storage profiles found.",
@@ -2226,7 +2230,10 @@
     "id": "ID",
     "actions": "Actions",
     "noUserAgent": "—",
-    "detailsDescription": "Full details of this access log entry"
+    "detailsDescription": "Full details of this access log entry",
+    "os": "Operating System",
+    "location": "Location",
+    "rawUserAgent": "User Agent"
   },
   "IntegrationProfilePage": {
     "breadcrumbHome": "Home",
@@ -2347,4 +2354,4 @@
     "showPassword": "Show value",
     "hidePassword": "Hide value"
   }
-}
+}

package/hedhog/frontend/messages/pt.json

@@ -338,6 +338,9 @@
     "errorBulkRemovingRoles": "Erro ao remover todos os cargos",
     "passwordResetTitle": "Redefinição de senha",
     "passwordResetDescription": "Gere uma nova senha para este usuário.",
+    "passwordLastChangedHumanized": "A senha não é alterada {relativeLabel}.",
+    "passwordLastChangedAbsolute": "Última atualização registrada: {absoluteLabel}",
+    "passwordLastChangedUnavailable": "Ainda não foi possível identificar quando esta senha foi atualizada pela última vez.",
     "passwordResetNotice": "Após essa redefinição, o usuário será obrigado a alterar a senha no próximo login.",
     "buttonResetPassword": "Redefinir senha",
     "passwordResetDialogTitle": "Redefinir senha do usuário",
@@ -1233,6 +1236,7 @@
     "fileUrlPlaceholder": "URL do arquivo",
     "selectOption": "Selecione uma opção",
     "selectMailProfile": "Selecione um perfil de email",
+    "mailProfileEmptyState": "Nenhum perfil de email encontrado.",
     "selectWhatsAppProfile": "Selecione um perfil de WhatsApp",
     "selectStorageProfile": "Selecione um perfil de armazenamento",
     "storageProfileEmptyState": "Nenhum perfil de armazenamento encontrado.",
@@ -2281,7 +2285,10 @@
     "id": "ID",
     "actions": "Ações",
     "noUserAgent": "—",
-    "detailsDescription": "Detalhes completos desta entrada de log de acesso"
+    "detailsDescription": "Detalhes completos desta entrada de log de acesso",
+    "os": "Sistema Operacional",
+    "location": "Localização",
+    "rawUserAgent": "User Agent"
   },
   "IntegrationProfilePage": {
     "breadcrumbHome": "Início",
@@ -2402,4 +2409,4 @@
     "showPassword": "Mostrar valor",
     "hidePassword": "Ocultar valor"
   }
-}
+}

package/package.json

@@ -1,14 +1,16 @@
 {
   "name": "@hed-hog/core",
-  "version": "0.0.361",
+  "version": "0.0.362",
   "main": "dist/index.js",
   "types": "dist/index.d.ts",
   "dependencies": {
+    "@aws-sdk/client-lambda": "3.1014.0",
     "@aws-sdk/client-s3": "^3.1014.0",
     "@aws-sdk/client-sts": "3.1014.0",
     "@aws-sdk/s3-request-presigner": "^3.1014.0",
     "@azure/storage-blob": "^12.27.0",
     "@google-cloud/storage": "^7.16.0",
+    "@modelcontextprotocol/sdk": "^1.12.0",
     "@nestjs/axios": "*",
     "@nestjs/common": "*",
     "@nestjs/config": "^4.0.2",
@@ -20,6 +22,7 @@
     "argon2": "^0.44.0",
     "axios": "^1.9.0",
     "cookie-parser": "^1.4.7",
+    "geoip-lite": "^2.0.2",
     "handlebars": "^4.7.8",
     "jsonwebtoken": "^9.0.2",
     "multer": "^2.0.1",
@@ -32,14 +35,14 @@
     "rxjs": "^7.8.2",
     "sharp": "^0.34.2",
     "speakeasy": "^2.0.0",
+    "ua-parser-js": "^2.0.10",
     "uuid": "^11.1.0",
-    "@modelcontextprotocol/sdk": "^1.12.0",
-    "@hed-hog/api-locale": "0.0.14",
-    "@hed-hog/api-mail": "0.0.9",
     "@hed-hog/api": "0.0.8",
+    "@hed-hog/api-locale": "0.0.14",
     "@hed-hog/api-prisma": "0.0.6",
-    "@hed-hog/api-pagination": "0.0.7",
-    "@hed-hog/api-types": "0.0.1"
+    "@hed-hog/api-mail": "0.0.9",
+    "@hed-hog/api-types": "0.0.1",
+    "@hed-hog/api-pagination": "0.0.7"
   },
   "exports": {
     ".": {
@@ -72,8 +75,10 @@
   "devDependencies": {
     "@types/cookie-parser": "^1.4.10",
     "@types/express": "^4.17.24",
+    "@types/geoip-lite": "^1.4.4",
     "@types/multer": "^2.0.0",
     "@types/pako": "^2.0.4",
+    "@types/ua-parser-js": "^0.7.39",
     "rimraf": "^6.1.0"
   },
   "scripts": {

package/src/access-log/access-log.service.ts

@@ -1,6 +1,8 @@
 import { PageOrderDirection, PaginationService } from '@hed-hog/api-pagination';
 import { Prisma, PrismaService } from '@hed-hog/api-prisma';
 import { forwardRef, Inject, Injectable, Logger } from '@nestjs/common';
+import * as geoip from 'geoip-lite';
+import { UAParser } from 'ua-parser-js';
 
 interface RecordHttpData {
   userId?: number;
@@ -100,7 +102,7 @@ export class AccessLogService {
       where.mcp_tool = { not: null };
     }
 
-    return this.pagination.paginate(this.prisma.access_log, {
+    const result = await this.pagination.paginate(this.prisma.access_log, {
       ...params,
       fields: params.fields ?? '',
     }, {
@@ -110,6 +112,22 @@ export class AccessLogService {
         user: { select: { id: true, name: true, photo_id: true } },
       },
     });
+
+    const data = (result.data as any[]).map((log) => {
+      const ua = log.user_agent ? new UAParser(log.user_agent).getResult() : null;
+      const geo = log.ip ? geoip.lookup(log.ip) : null;
+      return {
+        ...log,
+        browser_name: ua?.browser?.name ?? null,
+        browser_version: ua?.browser?.version ?? null,
+        os_name: ua?.os?.name ?? null,
+        os_version: ua?.os?.version ?? null,
+        country: geo?.country ?? null,
+        city: geo?.city ?? null,
+      };
+    });
+
+    return { ...result, data };
   }
 
   async clearOld(retentionDays: number, batchLimit: number): Promise<void> {

package/src/auth/auth.controller.ts

@@ -8,6 +8,7 @@ import {
   Headers,
   Inject,
   Ip,
+  Logger,
   Post,
   Req,
   Res,
@@ -28,6 +29,8 @@ import { ResetDTO } from './dto/reset.dto';
 
 @Controller('auth')
 export class AuthController {
+  private readonly logger = new Logger(AuthController.name);
+
   constructor(
     @Inject(forwardRef(() => AuthService))
     private readonly service: AuthService,
@@ -60,6 +63,8 @@ export class AuthController {
     @Headers('user-agent') userAgent: string,
     @Ip() ipAddress: string
   ) {
+    const tokenSource = req.cookies['rt'] ? 'cookie' : (refreshTokenFromBody ? 'body' : 'none');
+    this.logger.debug(`[AuthController] POST /auth/refresh tokenSource=${tokenSource} ip=${ipAddress}`);
     const currentRefreshToken = req.cookies['rt'] || refreshTokenFromBody;
     const { session, refreshToken, accessToken } = await this.service.refreshAccessToken(locale, currentRefreshToken, ipAddress, userAgent);
     await this.token.setRefreshTokenCookie(locale, res, refreshToken, session.expires_at);

package/src/auth/auth.service.ts

@@ -6,6 +6,7 @@ import {
   forwardRef,
   Inject,
   Injectable,
+  Logger,
   NotFoundException,
   UnauthorizedException,
 } from '@nestjs/common';
@@ -21,6 +22,7 @@ import { LoginDTO } from './dto/login.dto';
 
 @Injectable()
 export class AuthService {
+  private readonly logger = new Logger(AuthService.name);
 
   constructor(
     @Inject(forwardRef(() => PrismaService))
@@ -46,7 +48,8 @@ export class AuthService {
     const payload = { sub: userId, sessionId: session.id };
     const accessToken = await this.token.createAccessToken(payload);
     await this.prisma.user.update({ where: { id: userId }, data: { last_login_at: new Date() } });
-    
+    this.logger.debug(`[AuthService] Session created userId=${userId} sessionId=${session.id}`);
+
     return {
       accessToken,
       refreshToken,
@@ -474,9 +477,12 @@ export class AuthService {
   async refreshAccessToken(locale: string, refreshToken: string, ipAddress: string, userAgent: string) {
 
     if (!refreshToken) {
+      this.logger.warn(`[AuthService] refreshAccessToken called without token ip=${ipAddress}`);
       throw new UnauthorizedException(getLocaleText('accessDenied', locale, 'Access denied.'));
     }
 
+    this.logger.debug(`[AuthService] refreshAccessToken ip=${ipAddress} ua=${userAgent?.slice(0, 40)}`);
+
     const { session, token } = await this.session.refresh(
       locale,
       refreshToken,
@@ -488,6 +494,8 @@ export class AuthService {
     const payload = { sub: user.id, sessionId: session.id };
     const accessToken = await this.token.createAccessToken(payload);
 
+    this.logger.debug(`[AuthService] refreshAccessToken success userId=${user.id} newSessionId=${session.id}`);
+
     return { accessToken, refreshToken: token, session };
 
   }
@@ -780,7 +788,8 @@ export class AuthService {
       throw new BadRequestException(getLocaleText('webauthnNotConfigured', locale, 'WebAuthn not configured.'));
     }
 
-    const rpID = new URL(process.env.FRONTEND_URL || 'http://localhost:3200').hostname;
+    const primaryOrigin = (process.env.CORS_ALLOWED_ORIGINS ?? '').split(/[\n,;]+/).map(u => u.trim()).filter(Boolean)[0] ?? 'http://localhost:3200';
+    const rpID = new URL(primaryOrigin).hostname;
 
     const allowCredentials = user.user_mfa
       .filter(mfa => mfa.user_mfa_webauthn && mfa.user_mfa_webauthn.length > 0)
@@ -834,8 +843,9 @@ export class AuthService {
     }
 
     const authenticator = challengeRecord.user_mfa.user_mfa_webauthn[0];
-    const rpID = new URL(process.env.FRONTEND_URL || 'http://localhost:3200').hostname;
-    const expectedOrigin = process.env.FRONTEND_URL || 'http://localhost:3200';
+    const primaryOrigin = (process.env.CORS_ALLOWED_ORIGINS ?? '').split(/[\n,;]+/).map(u => u.trim()).filter(Boolean)[0] ?? 'http://localhost:3200';
+    const rpID = new URL(primaryOrigin).hostname;
+    const expectedOrigin = primaryOrigin;
 
     const verification = await verifyAuthenticationResponse({
       response: assertionResponse,