@hed-hog/core 0.0.368 → 0.0.371

package/src/security/security.service.spec.ts

@@ -0,0 +1,222 @@
+import { BadRequestException } from '@nestjs/common';
+import { describe, it, expect, jest, beforeEach, afterEach } from '@jest/globals';
+
+jest.mock('@hed-hog/api-locale', () => ({
+  getLocaleText: (_key: string, _locale: string, fallback: string) => fallback,
+}));
+
+jest.mock('argon2', () => ({
+  __esModule: true,
+  hash: jest.fn(),
+  verify: jest.fn(),
+}));
+
+import * as argon2 from 'argon2';
+import { SecurityService } from './security.service';
+
+const makeService = (env: Record<string, string | undefined> = {}) => {
+  const configService = {
+    get: jest.fn((key: string) => env[key]),
+  };
+  const service = new SecurityService(configService as any);
+  return { service, configService };
+};
+
+describe('SecurityService', () => {
+  afterEach(() => {
+    jest.clearAllMocks();
+  });
+
+  describe('getValueWithPepper', () => {
+    it('uses the explicit pepper when provided', () => {
+      const { service, configService } = makeService();
+      expect(service.getValueWithPepper('value', 'PEP')).toBe('valuePEP');
+      expect(configService.get).not.toHaveBeenCalled();
+    });
+
+    it('falls back to the configured PEPPER', () => {
+      const { service } = makeService({ PEPPER: 'secret-pepper' });
+      expect(service.getValueWithPepper('value')).toBe('valuesecret-pepper');
+    });
+  });
+
+  describe('getJwtSecret', () => {
+    it('reads JWT_SECRET from config', () => {
+      const { service } = makeService({ JWT_SECRET: 'jwt-secret' });
+      expect(service.getJwtSecret()).toBe('jwt-secret');
+    });
+  });
+
+  describe('hashSha256', () => {
+    it('is deterministic and emits url-safe base64 without padding', () => {
+      const { service } = makeService();
+      const a = service.hashSha256('hello');
+      const b = service.hashSha256('hello');
+      const c = service.hashSha256('world');
+      expect(a).toBe(b);
+      expect(a).not.toBe(c);
+      expect(a).toMatch(/^[A-Za-z0-9_-]+$/);
+    });
+  });
+
+  describe('hashWithPepper', () => {
+    it('peppers the value before hashing', () => {
+      const { service } = makeService({ PEPPER: 'p' });
+      const expected = service.hashSha256('valuep');
+      expect(service.hashWithPepper('value')).toBe(expected);
+    });
+  });
+
+  describe('signHmacSha256 / verifyHmacSha256', () => {
+    it('verifies a signature produced with the default JWT secret', () => {
+      const { service } = makeService({ JWT_SECRET: 'jwt-secret' });
+      const sig = service.signHmacSha256('payload');
+      expect(service.verifyHmacSha256('payload', sig)).toBe(true);
+    });
+
+    it('rejects a tampered signature', () => {
+      const { service } = makeService({ JWT_SECRET: 'jwt-secret' });
+      const sig = service.signHmacSha256('payload');
+      expect(service.verifyHmacSha256('other-payload', sig)).toBe(false);
+    });
+
+    it('rejects an empty signature without throwing', () => {
+      const { service } = makeService({ JWT_SECRET: 'jwt-secret' });
+      expect(service.verifyHmacSha256('payload', '')).toBe(false);
+    });
+
+    it('honors an explicit signing secret', () => {
+      const { service } = makeService({ JWT_SECRET: 'jwt-secret' });
+      const sig = service.signHmacSha256('payload', 'other-secret');
+      expect(service.verifyHmacSha256('payload', sig, 'other-secret')).toBe(true);
+      // wrong secret -> mismatch
+      expect(service.verifyHmacSha256('payload', sig)).toBe(false);
+    });
+
+    it('returns false on a length mismatch instead of throwing', () => {
+      const { service } = makeService({ JWT_SECRET: 'jwt-secret' });
+      expect(service.verifyHmacSha256('payload', 'short')).toBe(false);
+    });
+  });
+
+  describe('encrypt / decrypt', () => {
+    it('round-trips using an explicit secret', () => {
+      const { service } = makeService();
+      const cipher = service.encrypt('super secret', 'the-key');
+      expect(cipher.split(':')).toHaveLength(4);
+      expect(service.decrypt(cipher, 'the-key')).toBe('super secret');
+    });
+
+    it('round-trips using the configured ENCRYPTION_SECRET', () => {
+      const { service } = makeService({ ENCRYPTION_SECRET: 'env-key' });
+      const cipher = service.encrypt('payload');
+      expect(service.decrypt(cipher)).toBe('payload');
+    });
+
+    it('throws when no encryption secret is configured', () => {
+      const { service } = makeService();
+      expect(() => service.encrypt('payload')).toThrow(
+        'ENCRYPTION_SECRET is not configured.',
+      );
+    });
+
+    it('throws on a malformed ciphertext', () => {
+      const { service } = makeService();
+      expect(() => service.decrypt('not-valid', 'the-key')).toThrow(
+        /Failed to decrypt value/,
+      );
+    });
+
+    it('throws when decrypting with the wrong secret', () => {
+      const { service } = makeService();
+      const cipher = service.encrypt('payload', 'right-key');
+      expect(() => service.decrypt(cipher, 'wrong-key')).toThrow(
+        /Failed to decrypt value/,
+      );
+    });
+  });
+
+  describe('validatePassword', () => {
+    it('returns true when one of the credentials verifies', async () => {
+      const { service } = makeService({ PEPPER: 'p' });
+      (argon2.verify as jest.Mock)
+        .mockResolvedValueOnce(false as never)
+        .mockResolvedValueOnce(true as never);
+
+      const result = await service.validatePassword(
+        'en',
+        [{ hash: 'h1' }, { hash: 'h2' }],
+        'pw',
+      );
+
+      expect(result).toBe(true);
+      expect(argon2.verify).toHaveBeenCalledWith('h1', 'pwp');
+    });
+
+    it('returns false when no credential verifies', async () => {
+      const { service } = makeService();
+      (argon2.verify as jest.Mock).mockResolvedValue(false as never);
+
+      const result = await service.validatePassword('en', [{ hash: 'h1' }], 'pw');
+
+      expect(result).toBe(false);
+    });
+
+    it('throws BadRequestException when verification errors', async () => {
+      const { service } = makeService();
+      (argon2.verify as jest.Mock).mockRejectedValue(new Error('boom') as never);
+
+      await expect(
+        service.validatePassword('en', [{ hash: 'h1' }], 'pw'),
+      ).rejects.toThrow(BadRequestException);
+    });
+  });
+
+  describe('verifyArgon2', () => {
+    it('returns true when argon2 verifies', async () => {
+      const { service } = makeService();
+      (argon2.verify as jest.Mock).mockResolvedValue(true as never);
+      await expect(service.verifyArgon2('v', 'hash')).resolves.toBe(true);
+    });
+
+    it('returns false when argon2 throws', async () => {
+      const { service } = makeService();
+      (argon2.verify as jest.Mock).mockRejectedValue(new Error('bad') as never);
+      await expect(service.verifyArgon2('v', 'hash')).resolves.toBe(false);
+    });
+  });
+
+  describe('hashArgon2', () => {
+    it('hashes the peppered value', async () => {
+      const { service } = makeService({ PEPPER: 'p' });
+      (argon2.hash as jest.Mock).mockResolvedValue('hashed' as never);
+      const result = await service.hashArgon2('value');
+      expect(result).toBe('hashed');
+      expect(argon2.hash).toHaveBeenCalledWith('valuep');
+    });
+  });
+
+  describe('generateCode', () => {
+    it('produces a numeric code of the requested length', () => {
+      const { service } = makeService();
+      const code = service.generateCode(8);
+      expect(code).toHaveLength(8);
+      expect(code).toMatch(/^[0-9]+$/);
+    });
+
+    it('defaults to length 6 when given a falsy length', () => {
+      const { service } = makeService();
+      expect(service.generateCode(0)).toHaveLength(6);
+    });
+  });
+
+  describe('randomOpaque', () => {
+    it('produces distinct url-safe tokens', () => {
+      const { service } = makeService();
+      const a = service.randomOpaque();
+      const b = service.randomOpaque();
+      expect(a).not.toBe(b);
+      expect(a).toMatch(/^[A-Za-z0-9_-]+$/);
+    });
+  });
+});

package/src/setting/setting.service.ts

@@ -116,10 +116,22 @@ export class SettingService implements OnModuleInit, OnModuleDestroy {
       this.lastRedisPublisherErrorLogAt = now;
     }
 
-    const message = error instanceof Error ? error.message : String(error);
+    const message = this.extractRedisErrorMessage(error);
     this.logger.warn(`Redis settings ${kind} error: ${message}`);
   }
 
+  private extractRedisErrorMessage(error: unknown): string {
+    if (error instanceof AggregateError && error.errors?.length) {
+      return error.errors
+        .map((e) => (e instanceof Error ? e.message || e.toString() : String(e)))
+        .join('; ');
+    }
+    if (error instanceof Error) {
+      return error.message || error.toString();
+    }
+    return String(error);
+  }
+
   private async initializeRedisSync() {
     if (!this.redisUrl) {
       this.logger.log(
@@ -160,7 +172,7 @@ export class SettingService implements OnModuleInit, OnModuleDestroy {
       );
     } catch (error) {
       this.logger.warn(
-        `Failed to initialize Redis settings sync: ${error instanceof Error ? error.message : String(error)}`,
+        `Failed to initialize Redis settings sync: ${this.extractRedisErrorMessage(error)}`,
       );
 
       await Promise.allSettled([
@@ -477,6 +489,7 @@ export class SettingService implements OnModuleInit, OnModuleDestroy {
       'operations.comment-edit-window',
       'lms-video-conversion-enabled',
       'lms-video-frame-capture-interval-seconds',
+      'lms-error-modal-enabled',
       'url'
     ];
     const setting = await this.getSettingValues(slugs);

package/src/token/token.service.ts

@@ -68,7 +68,8 @@ export class TokenService {
     } catch (error) {
       const errName = (error as any)?.name ?? 'UnknownError';
       const errMsg = (error as any)?.message ?? '';
-      if (!(error instanceof UnauthorizedException)) {
+      // Token expirado é um evento rotineiro (cliente renova automaticamente); não polui o log.
+      if (!(error instanceof UnauthorizedException) && errName !== 'TokenExpiredError') {
         this.logger.debug(`[TokenVerify] JWT error=${errName}: ${errMsg}`);
       }
       // Return 401 for JWT errors (expired, invalid, etc.)

package/src/user/user.controller.ts

@@ -1,22 +1,22 @@
-import { Public, Role, User } from '@hed-hog/api';
+import { NoRole, Public, Role, User } from '@hed-hog/api';
 import { Locale } from '@hed-hog/api-locale';
 import { Pagination } from '@hed-hog/api-pagination';
 import {
-    BadRequestException,
-    Body,
-    Controller,
-    Delete,
-    Get,
-    Inject,
-    Param,
-    ParseIntPipe,
-    Patch,
-    Post,
-    Req,
-    Res,
-    UploadedFile,
-    UseInterceptors,
-    forwardRef,
+  BadRequestException,
+  Body,
+  Controller,
+  Delete,
+  Get,
+  Inject,
+  Param,
+  ParseIntPipe,
+  Patch,
+  Post,
+  Req,
+  Res,
+  UploadedFile,
+  UseInterceptors,
+  forwardRef,
 } from '@nestjs/common';
 import { FileInterceptor } from '@nestjs/platform-express';
 import { Request } from 'express';
@@ -135,6 +135,16 @@ export class UserController {
     return this.userService.getUserRoutes(locale, userId);
   }
 
+  @NoRole()
+  @Get('me/activity')
+  async listMyActivities(
+    @User() { id }: { id: number },
+    @Pagination() paginationParams,
+    @Locale() locale: string,
+  ) {
+    return this.userService.listUserActivities(locale, id, paginationParams);
+  }
+
   @Get(':userId/log')
   async listLogs(
     @Param('userId', ParseIntPipe) userId: number,

package/src/user/user.service.ts

@@ -749,6 +749,31 @@ export class UserService {
     };
   }
 
+  async listUserActivities(locale: string, userId: number, paginationParams) {
+    await this.validateUserExists(locale, userId);
+
+    const paginated = await this.paginationService.paginatePrismaModel(
+      this.prismaService.user_activity,
+      {
+        page: paginationParams?.page,
+        pageSize: paginationParams?.pageSize,
+        sortField: paginationParams?.sortField || 'created_at',
+        sortOrder: paginationParams?.sortOrder || 'desc',
+        validSortFields: ['id', 'created_at', 'action'],
+        where: { user_id: userId },
+      },
+    );
+
+    return {
+      ...paginated,
+      data: (paginated.data || []).map((activity: any) => ({
+        id: String(activity.id),
+        action: activity.action,
+        createdAt: activity.created_at?.toISOString?.() || null,
+      })),
+    };
+  }
+
   // ==========================================
   // Private Helper Methods
   // ==========================================

package/src/utils/webauthn-origin.ts

@@ -0,0 +1,38 @@
+function normalizeOrigin(value?: string | null): string | null {
+  const trimmed = String(value ?? '').trim().replace(/\/+$/, '');
+  if (!trimmed) return null;
+
+  try {
+    return new URL(trimmed).origin;
+  } catch {
+    return null;
+  }
+}
+
+function getAllowedOrigins(): string[] {
+  return (process.env.CORS_ALLOWED_ORIGINS ?? '')
+    .split(/[\n,;]+/)
+    .map((url) => normalizeOrigin(url))
+    .filter((url): url is string => Boolean(url));
+}
+
+/**
+ * WebAuthn binds a credential to the exact origin (scheme + host + port) used
+ * during registration/authentication. With multiple frontends (e.g. admin on
+ * :3200, training on :3001) sharing the same backend, the relying party origin
+ * must follow the requesting browser, not a single hardcoded CORS entry.
+ */
+export function resolveWebAuthnOrigin(requestOrigin?: string | null): {
+  rpID: string;
+  expectedOrigin: string;
+} {
+  const allowedOrigins = getAllowedOrigins();
+  const normalizedRequestOrigin = normalizeOrigin(requestOrigin);
+
+  const expectedOrigin =
+    (normalizedRequestOrigin && allowedOrigins.includes(normalizedRequestOrigin)
+      ? normalizedRequestOrigin
+      : allowedOrigins[0]) ?? 'http://localhost:3200';
+
+  return { rpID: new URL(expectedOrigin).hostname, expectedOrigin };
+}

package/src/webhook-integration/integration-event-catalog.controller.ts

@@ -1,50 +1,50 @@
-import { DeleteDTO, Role } from '@hed-hog/api';
-import { Pagination } from '@hed-hog/api-pagination';
-import {
-  Body,
-  Controller,
-  Delete,
-  Get,
-  Param,
-  ParseIntPipe,
-  Patch,
-  Post,
-} from '@nestjs/common';
-import { IntegrationEventCatalogService } from './integration-event-catalog.service';
-
-@Role()
-@Controller('integration-event-catalog')
-export class IntegrationEventCatalogController {
-  constructor(private readonly service: IntegrationEventCatalogService) {}
-
-  @Get()
-  list(@Pagination() paginationParams) {
-    return this.service.list(paginationParams);
-  }
-
-  @Get('options')
-  options() {
-    return this.service.options();
-  }
-
-  @Get(':id')
-  get(@Param('id', ParseIntPipe) id: number) {
-    return this.service.get(id);
-  }
-
-  @Post()
-  create(@Body() data: any) {
-    return this.service.create(data);
-  }
-
-  @Patch(':id')
-  update(@Param('id', ParseIntPipe) id: number, @Body() data: any) {
-    return this.service.update(id, data);
-  }
-
-  @Delete()
-  delete(@Body() data: DeleteDTO) {
-    return this.service.delete(data);
-  }
-}
-
+import { DeleteDTO, Role } from '@hed-hog/api';
+import { Pagination } from '@hed-hog/api-pagination';
+import {
+  Body,
+  Controller,
+  Delete,
+  Get,
+  Param,
+  ParseIntPipe,
+  Patch,
+  Post,
+} from '@nestjs/common';
+import { IntegrationEventCatalogService } from './integration-event-catalog.service';
+
+@Role()
+@Controller('integration-event-catalog')
+export class IntegrationEventCatalogController {
+  constructor(private readonly service: IntegrationEventCatalogService) {}
+
+  @Get()
+  list(@Pagination() paginationParams) {
+    return this.service.list(paginationParams);
+  }
+
+  @Get('options')
+  options() {
+    return this.service.options();
+  }
+
+  @Get(':id')
+  get(@Param('id', ParseIntPipe) id: number) {
+    return this.service.get(id);
+  }
+
+  @Post()
+  create(@Body() data: any) {
+    return this.service.create(data);
+  }
+
+  @Patch(':id')
+  update(@Param('id', ParseIntPipe) id: number, @Body() data: any) {
+    return this.service.update(id, data);
+  }
+
+  @Delete()
+  delete(@Body() data: DeleteDTO) {
+    return this.service.delete(data);
+  }
+}
+