@hed-hog/core 0.0.364 → 0.0.365

package/src/session/session.service.ts

@@ -40,7 +40,7 @@ export class SessionService {
     private readonly paginationService: PaginationService,
   ) { }
 
-  async create(locale: string, userId: number, ipAddress: string, userAgent: string) {
+  async create(locale: string, userId: number, ipAddress: string, userAgent: string, browserId?: string | null) {
     if (!userId) {
       throw new BadRequestException(getLocaleText('session.userIdRequired', locale, 'User ID is required to create a session.'));
     }
@@ -60,9 +60,9 @@ export class SessionService {
     const token = await this.token.createOpaqueToken();
     const hash = this.security.hashWithPepper(token)
     const maxSessions = Number(settings['max-concurrent-sessions']) || 0;
-    
+
     if (maxSessions > 0) {
-      await this.enforceSessionLimit(userId, maxSessions);
+      await this.enforceSessionLimit(userId, maxSessions, false, browserId);
     }
 
     const session = await this.prisma.user_session.create({
@@ -71,40 +71,49 @@ export class SessionService {
         ip_address: ipAddress,
         user_agent: userAgent,
         expires_at: new Date(Date.now() + ((settings['refresh-token-expiration-minutes'] || 43200) * 60 * 1000)),
-        hash
+        hash,
+        browser_id: browserId ?? null,
       },
     });
 
     return { token, session };
   }
 
-  async refresh(locale: string, refreshToken: string, ipAddress: string, userAgent: string) {
+  async refresh(locale: string, refreshToken: string, ipAddress: string, userAgent: string, browserId?: string | null) {
     if (!refreshToken) {
       throw new UnauthorizedException(getLocaleText('accessDenied', locale, 'Access denied.'));
     }
 
     const hash = this.security.hashWithPepper(refreshToken);
-    const session = await this.prisma.user_session.findFirst({
-      where: {
-        hash,
-        revoked_at: null,
-        expires_at: {
-          gt: new Date(),
-        },
-      },
-      select: {
-        id: true,
-        user_id: true,
-        ip_address: true,
-        user_agent: true,
-      },
+
+    const rawSession = await this.prisma.user_session.findFirst({
+      where: { hash },
+      select: { id: true, user_id: true, ip_address: true, user_agent: true, revoked_at: true, expires_at: true, browser_id: true },
     });
 
-    if (!session) {
-      this.logger.warn(`[SessionRefresh] Refresh rejected: session not found or expired for token hash prefix ${hash.slice(0, 8)}`);
+    if (!rawSession) {
+      this.logger.warn(`[SessionRefresh] Refresh rejected: hash prefix ${hash.slice(0, 8)} not found in DB`);
+      throw new UnauthorizedException(getLocaleText('accessDenied', locale, 'Access denied.'));
+    }
+
+    if (rawSession.revoked_at !== null) {
+      this.logger.warn(`[SessionRefresh] Refresh rejected: sessionId=${rawSession.id} userId=${rawSession.user_id} revoked_at=${rawSession.revoked_at.toISOString()} hash prefix ${hash.slice(0, 8)}`);
       throw new UnauthorizedException(getLocaleText('accessDenied', locale, 'Access denied.'));
     }
 
+    if (rawSession.expires_at <= new Date()) {
+      this.logger.warn(`[SessionRefresh] Refresh rejected: sessionId=${rawSession.id} userId=${rawSession.user_id} expired expires_at=${rawSession.expires_at.toISOString()} hash prefix ${hash.slice(0, 8)}`);
+      throw new UnauthorizedException(getLocaleText('accessDenied', locale, 'Access denied.'));
+    }
+
+    const session = {
+      id: rawSession.id,
+      user_id: rawSession.user_id,
+      ip_address: rawSession.ip_address,
+      user_agent: rawSession.user_agent,
+      browser_id: rawSession.browser_id,
+    };
+
     const settings = await this.setting.getSettingValues([
       'refresh-token-expiration-minutes',
       'max-concurrent-sessions',
@@ -112,7 +121,7 @@ export class SessionService {
 
     const maxSessions = Number(settings['max-concurrent-sessions']) || 0;
     if (maxSessions > 0) {
-      await this.enforceSessionLimit(session.user_id, maxSessions, true);
+      await this.enforceSessionLimit(session.user_id, maxSessions, true, browserId);
     }
 
     const nextRefreshToken = await this.token.createOpaqueToken();
@@ -142,6 +151,7 @@ export class SessionService {
           user_agent: nextUserAgent,
           expires_at: expiresAt,
           hash: nextHash,
+          browser_id: session.browser_id ?? browserId ?? null,
         },
       });
 
@@ -367,51 +377,59 @@ export class SessionService {
 
   /**
    * Enforce maximum concurrent sessions limit for a user.
-   * If the limit is reached, expires the oldest sessions to make room for new ones.
+   * Sessions from the same browser (same browser_id) count as a single slot.
+   * Sessions without a browser_id each count as their own slot (legacy/unknown clients).
    *
    * @param userId - The user ID to check
-   * @param maxSessions - Maximum number of concurrent sessions allowed
+   * @param maxSessions - Maximum number of concurrent browser slots allowed
    * @param isRotation - When true, the calling flow is replacing an existing session (refresh),
    *   not adding a new one, so no extra slot needs to be freed.
+   * @param currentBrowserId - The browser_id of the session being created/refreshed.
    */
-  private async enforceSessionLimit(userId: number, maxSessions: number, isRotation = false): Promise<void> {
+  private async enforceSessionLimit(userId: number, maxSessions: number, isRotation = false, currentBrowserId?: string | null): Promise<void> {
     const activeSessions = await this.prisma.user_session.findMany({
       where: {
         user_id: userId,
         revoked_at: null,
-        expires_at: {
-          gt: new Date()
-        }
-      },
-      orderBy: {
-        created_at: 'asc'
+        expires_at: { gt: new Date() }
       },
-      select: {
-        id: true
-      }
+      orderBy: { created_at: 'asc' },
+      select: { id: true, browser_id: true }
     });
 
-    // During a rotation the current session is replaced (not added), so the net change is 0.
-    // During creation a new session is added, so we need one extra free slot (+1).
-    const slotsNeeded = isRotation ? 0 : 1;
-    const sessionsToExpire = activeSessions.length - maxSessions + slotsNeeded;
-    this.logger.debug(`[SessionLimit] userId=${userId} activeSessions=${activeSessions.length} maxSessions=${maxSessions} isRotation=${isRotation} toExpire=${sessionsToExpire}`);
-    if (sessionsToExpire > 0) {
-      const sessionIdsToExpire = activeSessions
-        .slice(0, sessionsToExpire)
-        .map(s => s.id);
+    // Group sessions into browser slots. Sessions sharing a browser_id = 1 slot.
+    // Sessions with null browser_id each count as their own slot (legacy clients).
+    // Map insertion order is preserved, and since activeSessions is ordered created_at asc,
+    // the oldest slot is always first.
+    type Slot = { ids: number[] };
+    const slotMap = new Map<string, Slot>();
+    for (const s of activeSessions) {
+      const key = s.browser_id ?? `__null_${s.id}`;
+      if (!slotMap.has(key)) slotMap.set(key, { ids: [] });
+      slotMap.get(key)!.ids.push(s.id);
+    }
+
+    const slots = Array.from(slotMap.values());
+    const currentSlotCount = slots.length;
 
-      this.logger.warn(`[SessionLimit] Expiring ${sessionsToExpire} oldest session(s) for userId=${userId}: [${sessionIdsToExpire.join(',')}]`);
+    // A new browser slot is created only when:
+    // - it's not a rotation (rotation keeps the same slot), AND
+    // - the current browser doesn't already have an active slot
+    const currentBrowserHasSlot = Boolean(currentBrowserId && slotMap.has(currentBrowserId));
+    const isNewSlot = !isRotation && !currentBrowserHasSlot;
 
+    const slotsToRevoke = currentSlotCount - maxSessions + (isNewSlot ? 1 : 0);
+    this.logger.debug(`[SessionLimit] userId=${userId} slots=${currentSlotCount} maxSessions=${maxSessions} isRotation=${isRotation} browserId=${currentBrowserId ?? 'null'} newSlot=${isNewSlot} toRevoke=${Math.max(0, slotsToRevoke)}`);
+
+    if (slotsToRevoke > 0) {
+      const sessionIdsToRevoke: number[] = [];
+      for (let i = 0; i < slotsToRevoke; i++) {
+        sessionIdsToRevoke.push(...slots[i].ids);
+      }
+      this.logger.warn(`[SessionLimit] Revoking ${slotsToRevoke} oldest browser slot(s) for userId=${userId}: sessions [${sessionIdsToRevoke.join(',')}]`);
       await this.prisma.user_session.updateMany({
-        where: {
-          id: {
-            in: sessionIdsToExpire
-          }
-        },
-        data: {
-          expires_at: new Date()
-        }
+        where: { id: { in: sessionIdsToRevoke } },
+        data: { revoked_at: new Date() }
       });
     }
   }

package/src/setting/setting.service.ts

@@ -3,14 +3,14 @@ import { getLocaleText, LocaleService } from '@hed-hog/api-locale';
 import { PaginationDTO, PaginationService } from '@hed-hog/api-pagination';
 import { PrismaService, setting_type_0f055cd5ea_enum } from '@hed-hog/api-prisma';
 import {
-    BadRequestException,
-    forwardRef,
-    Inject,
-    Injectable,
-    Logger,
-    NotFoundException,
-    OnModuleDestroy,
-    OnModuleInit,
+  BadRequestException,
+  forwardRef,
+  Inject,
+  Injectable,
+  Logger,
+  NotFoundException,
+  OnModuleDestroy,
+  OnModuleInit,
 } from '@nestjs/common';
 import { randomUUID } from 'node:crypto';
 import * as pako from 'pako';
@@ -422,6 +422,7 @@ export class SettingService implements OnModuleInit, OnModuleDestroy {
   async getSystemSettings(): Promise<any> {
     const locales = await this.localeService.getEnables();
     const slugs = [
+      'language',
       'system-name',
       'system-slogan',
       'icon-url',
@@ -476,6 +477,7 @@ export class SettingService implements OnModuleInit, OnModuleDestroy {
       'operations.comment-edit-window',
       'lms-video-conversion-enabled',
       'lms-video-frame-capture-interval-seconds',
+      'url'
     ];
     const setting = await this.getSettingValues(slugs);
     return { locales, setting };

package/src/task/task.service.ts

@@ -128,20 +128,17 @@ export class TasksService {
   }
 
   /**
-   * Limpa challenges de verificação de identificadores de usuário (email, telefone, etc.)
-   * que expiraram e não foram verificados, removendo também os identificadores órfãos.
-   *
-   * Remove em cascata:
-   * 1. user_identifier_challenge: challenges expirados não verificados
-   * 2. user_identifier: identificadores que nunca foram verificados e perderam seus challenges
+  * Limpa challenges de verificação de identificadores de usuário (email, telefone, etc.)
+  * que expiraram e não foram verificados.
+  *
+  * Remove em cascata:
+  * 1. user_identifier_challenge: challenges expirados não verificados
    *
    * Por quê: Quando um usuário tenta adicionar um novo email/telefone, é gerado um challenge
    * para verificação. Se o usuário não verifica dentro do prazo, tanto o challenge quanto
-   * o identificador não verificado devem ser removidos para evitar:
-   * - Acúmulo de dados órfãos (identificadores que nunca serão usados)
-   * - Bloqueio indevido de emails/telefones (um email não verificado não deve impedir
-   *   outro usuário de cadastrá-lo)
-   * - Confusão na interface (mostrar identificadores pendentes indefinidamente)
+  * o challenge devem ser removidos para evitar:
+  * - Acúmulo de challenges órfãos
+  * - Confusão na interface (mostrar verificações pendentes indefinidamente)
    *
    * Limite: 20.000 registros por execução para evitar lock prolongado das tabelas.
    */
@@ -166,14 +163,11 @@ export class TasksService {
           AND c.verified_at IS NULL
         RETURNING c.user_identifier_id
       )
-      DELETE FROM user_identifier ui
-      USING deleted_challenges
-      WHERE ui.id = deleted_challenges.user_identifier_id
-        AND ui.verified_at IS NULL
+      SELECT 1
     `;
 
     this.logger.verbose(
-      `Expired user identifier challenges and unverified identifiers cleaned up in ${Date.now() - startAt}ms`,
+      `Expired user identifier challenges cleaned up in ${Date.now() - startAt}ms`,
     );
   }
 

package/src/webhook-integration/webhook-command.registry.ts

@@ -1,5 +1,13 @@
 import { Injectable } from '@nestjs/common';
 
+export interface WebhookCommandContext extends Record<string, unknown> {
+  webhookBody?: unknown;
+  webhookHeaders?: Record<string, unknown>;
+  remoteIp?: string | null;
+  publicUuid?: string;
+  integrationId?: number;
+}
+
 export interface WebhookCommand {
   slug: string;
   name: string;
@@ -7,7 +15,7 @@ export interface WebhookCommand {
   inputSchema: Record<string, unknown>;
   handler: (
     params: Record<string, unknown>,
-    context?: Record<string, unknown>,
+    context?: WebhookCommandContext,
   ) => Promise<unknown>;
 }
 
@@ -30,7 +38,7 @@ export class WebhookCommandRegistry {
   async dispatch(
     slug: string,
     params: Record<string, unknown>,
-    context?: Record<string, unknown>,
+    context?: WebhookCommandContext,
   ): Promise<unknown> {
     const command = this.find(slug);
     if (!command) {

package/src/webhook-integration/webhook-integration.service.ts

@@ -581,7 +581,12 @@ export class WebhookIntegrationService {
         const actionStartedAt = Date.now();
 
         try {
-          const result = await this.executeAction(action, body);
+          const result = await this.executeAction(action, body, {
+            webhookHeaders: normalizeJsonObject(headers) || {},
+            remoteIp,
+            publicUuid: uuid,
+            integrationId: integration.id,
+          });
           const durationMs = Date.now() - actionStartedAt;
 
           actionResults.push({
@@ -695,7 +700,16 @@ export class WebhookIntegrationService {
     }
   }
 
-  private async executeAction(action: any, body: any) {
+  private async executeAction(
+    action: any,
+    body: any,
+    context?: {
+      webhookHeaders?: Record<string, unknown>;
+      remoteIp?: string | null;
+      publicUuid?: string;
+      integrationId?: number;
+    },
+  ) {
     if (action.type === 'email') {
       return this.executeEmailAction(action, body);
     }
@@ -713,7 +727,7 @@ export class WebhookIntegrationService {
     }
 
     if (action.type === 'app_command') {
-      return this.executeAppCommandAction(action, body);
+      return this.executeAppCommandAction(action, body, context);
     }
 
     throw new BadRequestException(`Unsupported action type: ${action.type}`);
@@ -1013,7 +1027,16 @@ export class WebhookIntegrationService {
     };
   }
 
-  private async executeAppCommandAction(action: any, body: any) {
+  private async executeAppCommandAction(
+    action: any,
+    body: any,
+    context?: {
+      webhookHeaders?: Record<string, unknown>;
+      remoteIp?: string | null;
+      publicUuid?: string;
+      integrationId?: number;
+    },
+  ) {
     this.validateActionConfiguration(action);
 
     const slug = String(action.app_command_slug || '').trim();
@@ -1042,6 +1065,10 @@ export class WebhookIntegrationService {
     try {
       result = await this.commandRegistry.dispatch(slug, renderedParams, {
         webhookBody: body,
+        webhookHeaders: context?.webhookHeaders,
+        remoteIp: context?.remoteIp,
+        publicUuid: context?.publicUuid,
+        integrationId: context?.integrationId,
       });
     } catch (error) {
       this.attachErrorRequestPayload(error, requestPayload);