@hed-hog/core 0.0.368 → 0.0.371

package/src/integration-profile/integration-profile.service.ts

@@ -16,6 +16,8 @@ import {
   ImportProfileItemDTO,
 } from './dto/import-confirm.dto';
 import { UpdateDTO } from './dto/update.dto';
+import { IntegrationCredentialCryptoService } from './integration-credential-crypto.service';
+import { getSensitiveConfigKeys } from './integration-profile.secrets';
 
 type IntegrationProfileExportItem = {
   slug: string;
@@ -58,6 +60,8 @@ export class IntegrationProfileService {
     private readonly prismaService: PrismaService,
     @Inject(forwardRef(() => PaginationService))
     private readonly paginationService: PaginationService,
+    @Inject(forwardRef(() => IntegrationCredentialCryptoService))
+    private readonly credentialCrypto: IntegrationCredentialCryptoService,
   ) {}
 
   async listTypes() {
@@ -101,11 +105,13 @@ export class IntegrationProfileService {
     typeId?: number,
     typeSlug?: string,
     providerSlug?: string,
+    slug?: string,
   ) {
     const fields = ['slug', 'name'];
     const OR = this.prismaService.createInsensitiveSearch(fields, paginationParams);
     const normalizedTypeSlug = String(typeSlug ?? '').trim();
     const normalizedProviderSlug = String(providerSlug ?? '').trim();
+    const normalizedSlug = String(slug ?? '').trim();
 
     const result = await this.paginationService.paginate(
       this.prismaService.integration_profile,
@@ -120,6 +126,7 @@ export class IntegrationProfileService {
           ...(normalizedProviderSlug
             ? { integration_provider: { slug: normalizedProviderSlug } }
             : {}),
+          ...(normalizedSlug ? { slug: normalizedSlug } : {}),
         },
         include: {
           integration_type: {
@@ -166,6 +173,11 @@ export class IntegrationProfileService {
 
       result.data = items.map((p: any) => ({
         ...p,
+        // Não devolve segredos na listagem (middleware já decifrou; mascaramos).
+        config: this.credentialCrypto.maskConfig(
+          p.integration_provider?.slug ?? '',
+          p.config as Record<string, unknown>,
+        ),
         uses_count: countMap.get(p.id) ?? 0,
       }));
     }
@@ -173,6 +185,98 @@ export class IntegrationProfileService {
     return result;
   }
 
+  /**
+   * Resolve o config do perfil de integração ATIVO para um par tipo/provider — uso
+   * server-side por serviços que precisam das credenciais (ex.: InfraScaler do
+   * autoscaling). Opcionalmente fixa um slug específico (vindo de uma setting). É o ponto
+   * único de acesso às credenciais armazenadas no Perfil de Integração.
+   */
+  async getActiveProfileConfig(
+    typeSlug: string,
+    providerSlug: string,
+    options?: { profileSlug?: string; profileId?: number },
+  ): Promise<{ id: number; slug: string; config: Record<string, unknown> }> {
+    // O middleware do PrismaService decifra config nesta leitura (uso interno).
+    const profile = await this.prismaService.integration_profile.findFirst({
+      where: {
+        is_active: true,
+        integration_type: { slug: typeSlug },
+        integration_provider: { slug: providerSlug },
+        ...(options?.profileId ? { id: options.profileId } : {}),
+        ...(options?.profileSlug ? { slug: options.profileSlug } : {}),
+      },
+      orderBy: [{ updated_at: 'desc' }, { id: 'desc' }],
+      select: { id: true, slug: true, config: true },
+    });
+
+    if (!profile) {
+      const ref = options?.profileId
+        ? ` / id ${options.profileId}`
+        : options?.profileSlug
+          ? ` / slug "${options.profileSlug}"`
+          : '';
+      throw new NotFoundException(
+        `No active integration profile found for type "${typeSlug}" / provider "${providerSlug}"${ref}.`,
+      );
+    }
+
+    return {
+      id: profile.id,
+      slug: profile.slug,
+      config: (profile.config as Record<string, unknown>) ?? {},
+    };
+  }
+
+  /**
+   * Resolve um perfil ATIVO do tipo `infrastructure` (DigitalOcean, Kubernetes, …) por
+   * SLUG (vindo de uma setting) ou por ID (seleção direta na UI) — ou o mais recente se
+   * nada for dado. Retorna o slug do provider (para dispatch) e o config já decifrado
+   * pelo middleware. Uso interno do autoscaling.
+   */
+  async getActiveInfrastructureProfile(
+    options?: { profileSlug?: string; profileId?: number },
+  ): Promise<{
+    id: number;
+    slug: string;
+    providerSlug: string;
+    config: Record<string, unknown>;
+  }> {
+    const normalizedSlug = String(options?.profileSlug ?? '').trim();
+    const profile = await this.prismaService.integration_profile.findFirst({
+      where: {
+        is_active: true,
+        integration_type: { slug: 'infrastructure' },
+        ...(options?.profileId ? { id: options.profileId } : {}),
+        ...(normalizedSlug ? { slug: normalizedSlug } : {}),
+      },
+      orderBy: [{ updated_at: 'desc' }, { id: 'desc' }],
+      select: {
+        id: true,
+        slug: true,
+        config: true,
+        integration_provider: { select: { slug: true } },
+      },
+    });
+
+    if (!profile) {
+      const ref = options?.profileId
+        ? ` for id ${options.profileId}`
+        : normalizedSlug
+          ? ` for slug "${normalizedSlug}"`
+          : '';
+      throw new NotFoundException(
+        `No active infrastructure integration profile found${ref}.`,
+      );
+    }
+
+    return {
+      id: profile.id,
+      slug: profile.slug,
+      providerSlug: profile.integration_provider?.slug ?? '',
+      config: (profile.config as Record<string, unknown>) ?? {},
+    };
+  }
+
   async get(id: number) {
     const profile = await this.prismaService.integration_profile.findUnique({
       where: { id },
@@ -203,25 +307,71 @@ export class IntegrationProfileService {
       );
     }
 
-    return profile;
+    // Não devolve segredos ao cliente (middleware já decifrou; mascaramos para a UI).
+    return {
+      ...profile,
+      config: this.credentialCrypto.maskConfig(
+        profile.integration_provider?.slug ?? '',
+        profile.config as Record<string, unknown>,
+      ),
+    };
+  }
+
+  /**
+   * Igual a `get(id)`, porém resolvendo o perfil pelo SLUG (valor estável guardado em
+   * settings). Reusa `get()` para manter o mesmo include e o mascaramento de segredos.
+   */
+  async getBySlug(slug: string) {
+    const normalized = String(slug ?? '').trim();
+    if (!normalized) {
+      throw new NotFoundException('Integration profile slug is empty.');
+    }
+
+    const found = await this.prismaService.integration_profile.findUnique({
+      where: { slug: normalized },
+      select: { id: true },
+    });
+
+    if (!found) {
+      throw new NotFoundException(
+        `Integration profile with slug "${normalized}" not found.`,
+      );
+    }
+
+    return this.get(found.id);
   }
 
   async create(data: CreateDTO) {
     await this.ensureSlugIsAvailable(data.slug);
     await this.validateTypeAndProvider(data.type_id, data.provider_id);
 
+    const providerSlug = await this.getProviderSlug(data.provider_id);
+    const config = this.credentialCrypto.encryptConfig(
+      providerSlug,
+      (data.config as Record<string, unknown>) ?? null,
+    );
+
     return this.prismaService.integration_profile.create({
       data: {
         slug: data.slug.trim(),
         name: data.name.trim(),
         type_id: data.type_id,
         provider_id: data.provider_id,
-        config: (data.config as object) ?? null,
+        config: (config as object) ?? null,
         is_active: data.is_active ?? true,
       },
     });
   }
 
+  /** Resolve o slug do provider a partir do id (para saber as chaves sensíveis). */
+  private async getProviderSlug(providerId: number): Promise<string> {
+    const provider = await this.prismaService.integration_provider.findUnique({
+      where: { id: providerId },
+      select: { slug: true },
+    });
+    return provider?.slug ?? '';
+  }
+
   async update({ id, data }: { id: number; data: UpdateDTO }) {
     const existing = await this.prismaService.integration_profile.findUnique({
       where: { id },
@@ -241,6 +391,20 @@ export class IntegrationProfileService {
     const provider_id = data.provider_id ?? existing.provider_id;
     await this.validateTypeAndProvider(type_id, provider_id);
 
+    const providerSlug = await this.getProviderSlug(provider_id);
+    // `existing.config` já vem DECIFRADO pelo middleware. Em update parcial, mantemos os
+    // segredos enviados em branco ("deixe em branco para manter") e recifra-mos tudo.
+    const storedDecrypted = (existing.config as Record<string, unknown>) ?? null;
+    const finalPlain =
+      data.config !== undefined
+        ? this.credentialCrypto.mergeKeepingStoredSecrets(
+            providerSlug,
+            (data.config as Record<string, unknown>) ?? null,
+            storedDecrypted,
+          )
+        : storedDecrypted;
+    const config = this.credentialCrypto.encryptConfig(providerSlug, finalPlain);
+
     return this.prismaService.integration_profile.update({
       where: { id },
       data: {
@@ -248,10 +412,7 @@ export class IntegrationProfileService {
         name: data.name?.trim() ?? existing.name,
         type_id,
         provider_id,
-        config:
-          data.config !== undefined
-            ? ((data.config as object) ?? null)
-            : existing.config,
+        config: (config as object) ?? null,
         is_active: data.is_active ?? existing.is_active,
       },
     });
@@ -296,10 +457,25 @@ export class IntegrationProfileService {
       );
     }
 
-    buildMailConfigFromIntegration(provider.slug, data.config);
+    // "Deixe em branco para manter": ao testar na edição, herda os segredos já
+    // armazenados (decifrados pelo middleware) para os campos vazios/mascarados.
+    let effectiveConfig = (data.config as Record<string, unknown>) ?? null;
+    const stored = await this.prismaService.integration_profile.findUnique({
+      where: { slug: data.slug.trim() },
+      select: { config: true },
+    });
+    if (stored?.config) {
+      effectiveConfig = this.credentialCrypto.mergeKeepingStoredSecrets(
+        provider.slug,
+        effectiveConfig,
+        stored.config as Record<string, unknown>,
+      ) as Record<string, unknown>;
+    }
+
+    buildMailConfigFromIntegration(provider.slug, effectiveConfig);
 
     const destination = String(
-      (data.config as Record<string, unknown> | null | undefined)?.from_email ??
+      (effectiveConfig as Record<string, unknown> | null | undefined)?.from_email ??
         '',
     ).trim();
 
@@ -320,9 +496,36 @@ export class IntegrationProfileService {
     ids?: number[];
     includeSecrets?: boolean;
   }): Promise<Buffer> {
+    const items = await this.exportProfileItemsByIds(ids, includeSecrets);
+
+    const envelope: IntegrationProfileImportEnvelope = {
+      type: 'integration-profile',
+      version: 1,
+      generated_at: new Date().toISOString(),
+      include_secrets: includeSecrets,
+      // O envelope de integration-profile não carrega o id de origem.
+      data: items.map(({ id: _id, ...rest }) => rest),
+    };
+
+    const compressed = pako.gzip(JSON.stringify(envelope));
+    return Buffer.from(compressed);
+  }
+
+  /**
+   * Returns export-ready profile items (slug/name/type_slug/provider_slug/config/
+   * is_active) plus the source-environment `id`. Used by callers that must reference
+   * profiles by id — e.g. the agent workflow export, which remaps node
+   * `integrationProfileId` through id → slug → (destination) id. `config` is decrypted
+   * defensively and sanitized per `includeSecrets`.
+   */
+  async exportProfileItemsByIds(
+    ids: number[] | undefined,
+    includeSecrets: boolean,
+  ): Promise<(IntegrationProfileExportItem & { id: number })[]> {
     const rows = await this.prismaService.integration_profile.findMany({
       where: ids?.length ? { id: { in: ids } } : undefined,
       select: {
+        id: true,
         slug: true,
         name: true,
         config: true,
@@ -337,29 +540,72 @@ export class IntegrationProfileService {
       orderBy: [{ slug: 'asc' }],
     });
 
-    const payload: IntegrationProfileExportItem[] = rows.map((row) => ({
+    return rows.map((row) => ({
+      id: row.id,
       slug: row.slug,
       name: row.name,
       type_slug: row.integration_type.slug,
       provider_slug: row.integration_provider.slug,
       config: this.sanitizeConfigForExport(
         row.integration_provider.slug,
-        row.config as Record<string, unknown> | null,
+        // Decrypt defensivo: garante que o arquivo nunca leve um envelope preso à chave
+        // da origem (o middleware já decifra, isto é redundância de segurança).
+        this.credentialCrypto.decryptConfig(
+          row.config as Record<string, unknown> | null,
+        ) as Record<string, unknown> | null,
         includeSecrets,
       ),
       is_active: row.is_active,
     }));
+  }
 
-    const envelope: IntegrationProfileImportEnvelope = {
-      type: 'integration-profile',
-      version: 1,
-      generated_at: new Date().toISOString(),
-      include_secrets: includeSecrets,
-      data: payload,
-    };
+  /**
+   * Validates that each item's type_slug/provider_slug exist and that the provider
+   * belongs to the type. Returns a map of item slug → list of errors (empty = valid).
+   * Reused by external importers (e.g. the agent workflow import) to validate the
+   * credential profiles bundled inside a workflow file.
+   */
+  async validateImportItems(
+    items: { slug: string; type_slug: string; provider_slug: string }[],
+  ): Promise<Map<string, string[]>> {
+    const typeMap = new Map(
+      (
+        await this.prismaService.integration_type.findMany({
+          select: { id: true, slug: true },
+        })
+      ).map((row) => [row.slug.toLowerCase(), row]),
+    );
 
-    const compressed = pako.gzip(JSON.stringify(envelope));
-    return Buffer.from(compressed);
+    const providerMap = new Map(
+      (
+        await this.prismaService.integration_provider.findMany({
+          select: { id: true, slug: true, type_id: true },
+        })
+      ).map((row) => [row.slug.toLowerCase(), row]),
+    );
+
+    const out = new Map<string, string[]>();
+    for (const item of items) {
+      const errors: string[] = [];
+      const typeSlug = String(item.type_slug ?? '').trim().toLowerCase();
+      const providerSlug = String(item.provider_slug ?? '').trim().toLowerCase();
+
+      const type = typeMap.get(typeSlug);
+      const provider = providerMap.get(providerSlug);
+      if (!typeSlug) errors.push('Missing type_slug.');
+      else if (!type) errors.push(`Unknown type_slug "${typeSlug}".`);
+      if (!providerSlug) errors.push('Missing provider_slug.');
+      else if (!provider) errors.push(`Unknown provider_slug "${providerSlug}".`);
+      if (type && provider && provider.type_id !== type.id) {
+        errors.push(
+          `Provider "${providerSlug}" does not belong to type "${typeSlug}".`,
+        );
+      }
+
+      out.set(item.slug, errors);
+    }
+
+    return out;
   }
 
   async validateImportFile(file: MulterFile) {
@@ -509,6 +755,59 @@ export class IntegrationProfileService {
       throw new BadRequestException('No profiles provided for import.');
     }
 
+    const { counts } = await this.ensureProfilesBySlug(
+      profiles,
+      conflictResolutions,
+    );
+
+    return {
+      success: true,
+      total_received: profiles.length,
+      created: counts.created,
+      replaced: counts.replaced,
+      renamed: counts.renamed,
+      ignored: counts.ignored,
+      imported: counts.created + counts.replaced + counts.renamed,
+    };
+  }
+
+  /**
+   * Creates/updates integration profiles from import items, applying per-slug
+   * conflict resolutions, and returns a map from each item's (original) slug to the
+   * resulting profile id + applied action — plus aggregate counts. Re-encrypts config
+   * with the destination system key. Used by `confirmImport` (counts) and by the agent
+   * workflow import (which needs the resulting ids to remap node integrationProfileId).
+   *
+   * For `ignore` on a conflicting slug, the existing profile is left untouched but its
+   * id is still returned so callers can relink references to the local profile.
+   */
+  async ensureProfilesBySlug(
+    profiles: ImportProfileItemDTO[],
+    conflictResolutions?: ConflictResolutionDTO[],
+  ): Promise<{
+    results: Map<
+      string,
+      {
+        id: number;
+        slug: string;
+        action: 'created' | 'replaced' | 'renamed' | 'ignored';
+      }
+    >;
+    counts: { created: number; replaced: number; renamed: number; ignored: number };
+  }> {
+    const results = new Map<
+      string,
+      {
+        id: number;
+        slug: string;
+        action: 'created' | 'replaced' | 'renamed' | 'ignored';
+      }
+    >();
+
+    if (!profiles?.length) {
+      return { results, counts: { created: 0, replaced: 0, renamed: 0, ignored: 0 } };
+    }
+
     const resolutionMap = new Map<string, ConflictResolutionDTO['action']>(
       (conflictResolutions ?? []).map((resolution) => [
         resolution.slug,
@@ -596,18 +895,27 @@ export class IntegrationProfileService {
         name,
         type_id: type.id,
         provider_id: provider.id,
-        config: (item.config as object | null) ?? null,
+        // Import traz texto puro (do .hedhog); cifra com a chave do sistema de DESTINO.
+        config: (this.credentialCrypto.encryptConfig(
+          providerSlug,
+          (item.config as Record<string, unknown>) ?? null,
+        ) as object | null) ?? null,
         is_active: item.is_active ?? true,
       };
 
       if (!existing) {
-        await this.prismaService.integration_profile.create({ data });
+        const createdRow = await this.prismaService.integration_profile.create({
+          data,
+          select: { id: true },
+        });
+        results.set(slug, { id: createdRow.id, slug, action: 'created' });
         created += 1;
         continue;
       }
 
       const action = resolutionMap.get(slug) ?? 'ignore';
       if (action === 'ignore') {
+        results.set(slug, { id: existing.id, slug, action: 'ignored' });
         ignored += 1;
         continue;
       }
@@ -623,29 +931,24 @@ export class IntegrationProfileService {
             is_active: data.is_active,
           },
         });
+        results.set(slug, { id: existing.id, slug, action: 'replaced' });
         replaced += 1;
         continue;
       }
 
       const newSlug = await this.generateUniqueSlug(slug);
-      await this.prismaService.integration_profile.create({
+      const renamedRow = await this.prismaService.integration_profile.create({
         data: {
           ...data,
           slug: newSlug,
         },
+        select: { id: true },
       });
+      results.set(slug, { id: renamedRow.id, slug: newSlug, action: 'renamed' });
       renamed += 1;
     }
 
-    return {
-      success: true,
-      total_received: profiles.length,
-      created,
-      replaced,
-      renamed,
-      ignored,
-      imported: created + replaced + renamed,
-    };
+    return { results, counts: { created, replaced, renamed, ignored } };
   }
 
   private async ensureSlugIsAvailable(slug: string) {
@@ -731,7 +1034,7 @@ export class IntegrationProfileService {
   ): Record<string, unknown> | null {
     if (!config || includeSecrets) return config;
 
-    const hiddenKeys = this.getSensitiveConfigKeys(providerSlug);
+    const hiddenKeys = getSensitiveConfigKeys(providerSlug);
     if (hiddenKeys.length === 0) return config;
 
     const sanitized = { ...config };
@@ -742,28 +1045,6 @@ export class IntegrationProfileService {
     return sanitized;
   }
 
-  private getSensitiveConfigKeys(providerSlug: string): string[] {
-    const map: Record<string, string[]> = {
-      smtp: ['password'],
-      gmail: ['client_secret', 'refresh_token'],
-      ses: ['secret_access_key'],
-      'evolution-api': ['token'],
-      'whatsapp-official': ['access_token'],
-      s3: ['secret_access_key'],
-      gcs: ['key_file_json'],
-      'azure-blob': ['key'],
-      's3-compatible': ['secret_access_key'],
-      openai: ['api_key'],
-      gemini: ['api_key'],
-      claude: ['api_key'],
-      'google-oauth': ['client_secret'],
-      'github-oauth': ['client_secret'],
-      'microsoft-oauth': ['client_secret'],
-    };
-
-    return map[providerSlug.toLowerCase()] ?? [];
-  }
-
   private async generateUniqueSlug(baseSlug: string): Promise<string> {
     let candidate = `${baseSlug}-copy`;
     let suffix = 1;

package/src/integration-profile/integration-profile.utils.ts

@@ -150,6 +150,62 @@ export function buildOAuthConfigFromIntegration(
   };
 }
 
+// ─── Infrastructure utilities ──────────────────────────────────────────────────
+
+export type DigitalOceanConfig = {
+  apiToken: string;
+  clusterId: string;
+  region: string;
+  videoNodePoolId: string;
+  videoNodePoolName: string;
+};
+
+/** Maps an integration_profile config JSON to the DigitalOcean API credentials/targets. */
+export function buildDigitalOceanConfigFromIntegration(
+  providerSlug: string,
+  config: unknown,
+): DigitalOceanConfig {
+  if (providerSlug.toLowerCase() !== 'digitalocean') {
+    throw new BadRequestException(
+      `Unsupported infrastructure provider: ${providerSlug}`,
+    );
+  }
+  const cfg = (config as Cfg) ?? {};
+  return {
+    apiToken: String(cfg.api_token ?? ''),
+    clusterId: String(cfg.cluster_id ?? ''),
+    region: String(cfg.region ?? ''),
+    videoNodePoolId: String(cfg.video_node_pool_id ?? ''),
+    videoNodePoolName: String(cfg.video_node_pool_name ?? ''),
+  };
+}
+
+export type KubernetesConfig = {
+  apiServer: string;
+  token: string;
+  caCert: string;
+  namespace: string;
+};
+
+/** Maps an integration_profile config JSON to read-only Kubernetes API access (opcional). */
+export function buildKubernetesConfigFromIntegration(
+  providerSlug: string,
+  config: unknown,
+): KubernetesConfig {
+  if (providerSlug.toLowerCase() !== 'kubernetes') {
+    throw new BadRequestException(
+      `Unsupported infrastructure provider: ${providerSlug}`,
+    );
+  }
+  const cfg = (config as Cfg) ?? {};
+  return {
+    apiServer: String(cfg.api_server ?? ''),
+    token: String(cfg.token ?? ''),
+    caCert: String(cfg.ca_cert ?? ''),
+    namespace: String(cfg.namespace ?? 'hcode'),
+  };
+}
+
 // ─── AI utilities ─────────────────────────────────────────────────────────────
 
 /** Maps an integration_profile config JSON to the API key and optional org needed by AI providers. */

package/src/language/en.json

@@ -25,7 +25,11 @@
     "emailExists": "Email already in use."
   },
   "forgot": {
-    "rateLimit": "Too many requests. Please try again later."
+    "rateLimit": "Too many requests. Please try again later.",
+    "userNotFound": "User not found."
+  },
+  "challenge": {
+    "invalidOrExpired": "The provided code is invalid or has expired."
   },
   "reset": {
     "password": {

package/src/language/pt.json

@@ -25,7 +25,11 @@
     "emailExists": "E-mail já está em uso."
   },
   "forgot": {
-    "rateLimit": "Muitas solicitações. Por favor, tente novamente mais tarde."
+    "rateLimit": "Muitas solicitações. Por favor, tente novamente mais tarde.",
+    "userNotFound": "Usuário não encontrado."
+  },
+  "challenge": {
+    "invalidOrExpired": "O código informado é inválido ou expirou."
   },
   "reset": {
     "password": {