@hed-hog/core 0.0.370 → 0.0.371

package/src/file/provider/s3.provider.ts

@@ -7,6 +7,7 @@ import {
     S3,
     S3Client,
 } from '@aws-sdk/client-s3';
+import { Upload } from '@aws-sdk/lib-storage';
 import { getSignedUrl } from '@aws-sdk/s3-request-presigner';
 import { BadRequestException } from '@nestjs/common';
 import { createReadStream } from 'fs';
@@ -157,18 +158,26 @@ export class S3Provider extends AbstractProvider {
     filePath: string,
     options?: { filename?: string; mimetype?: string },
   ): Promise<any> {
-    const s3 = await this.getClient();
+    const client = await this.getS3Client();
     const originalName = options?.filename ?? basename(filePath);
     const storedFilename = this.getFilename(originalName);
     const key = [destination, storedFilename].join('/');
-    const command = new PutObjectCommand({
-      Bucket: this.setting['storage-s3-bucket'],
-      Key: key,
-      Body: createReadStream(filePath),
-      ContentType: options?.mimetype,
+
+    // Multipart streaming upload: nunca buffeia o arquivo em memória e suporta
+    // objetos acima do limite de 5GB do PutObject único (ex.: pacotes SCORM grandes).
+    const upload = new Upload({
+      client,
+      params: {
+        Bucket: this.setting['storage-s3-bucket'],
+        Key: key,
+        Body: createReadStream(filePath),
+        ContentType: options?.mimetype,
+      },
+      queueSize: 4,
+      partSize: 16 * 1024 * 1024,
     });
 
-    await s3.send(command);
+    await upload.done();
     return storedFilename;
   }
 

package/src/file/provider/spaces.provider.ts

@@ -7,6 +7,7 @@ import {
     S3,
     S3Client,
 } from '@aws-sdk/client-s3';
+import { Upload } from '@aws-sdk/lib-storage';
 import { getSignedUrl } from '@aws-sdk/s3-request-presigner';
 import { BadRequestException } from '@nestjs/common';
 import { createReadStream } from 'fs';
@@ -181,19 +182,28 @@ export class SpacesProvider extends AbstractProvider {
     filePath: string,
     options?: { filename?: string; mimetype?: string },
   ): Promise<any> {
-    const s3 = await this.getClient();
+    const client = await this.getS3Client();
     const originalName = options?.filename ?? basename(filePath);
     const storedFilename = this.getFilename(originalName);
     const key = [destination, storedFilename].join('/');
-    await s3.send(
-      new PutObjectCommand({
+
+    // Upload por streaming do disco: o lib-storage envia um PutObject único abaixo
+    // do partSize e só ativa multipart acima dele, suportando objetos acima do
+    // limite de 5GB do PutObject (ex.: pacotes SCORM grandes) sem buffeiar na RAM.
+    const upload = new Upload({
+      client,
+      params: {
         Bucket: this.setting['storage-spaces-bucket'],
         Key: key,
         Body: createReadStream(filePath),
         ContentType: options?.mimetype,
         ACL: 'public-read',
-      }),
-    );
+      },
+      queueSize: 4,
+      partSize: 16 * 1024 * 1024,
+    });
+
+    await upload.done();
     return storedFilename;
   }
 

package/src/index.ts

@@ -25,6 +25,8 @@ export * from './mail/mail.service';
 export * from './integration-profile/integration-profile.module';
 export * from './integration-profile/integration-profile.service';
 export * from './integration-profile/integration-profile.utils';
+export * from './integration-profile/integration-profile.secrets';
+export * from './integration-profile/integration-credential-crypto.service';
 
 export * from './file/file.module';
 export * from './file/file.service';
@@ -37,9 +39,10 @@ export * from './setting/setting.service';
 export * from './ai/ai.module';
 export * from './ai/ai.service';
 
+export * from './app-command/app-command.module';
+export * from './app-command/app-command.registry';
 export * from './webhook-integration/event-webhook.service';
 export * from './webhook-integration/integration-event-catalog.service';
-export * from './webhook-integration/webhook-command.registry';
 export * from './webhook-integration/webhook-integration.module';
 export * from './webhook-integration/webhook-integration.service';
 

package/src/integration/services/event-subscriber.registry.ts

@@ -80,6 +80,21 @@ export class EventSubscriberRegistry {
     return count;
   }
 
+  /**
+   * Remove all handlers whose consumerName starts with the given prefix.
+   * Used to clean up subscriptions for a specific agent before re-registering.
+   */
+  removeByConsumerPrefix(prefix: string): void {
+    for (const [eventName, handlers] of this.subscribers.entries()) {
+      const filtered = handlers.filter((h) => !h.consumerName.startsWith(prefix));
+      if (filtered.length === 0) {
+        this.subscribers.delete(eventName);
+      } else {
+        this.subscribers.set(eventName, filtered);
+      }
+    }
+  }
+
   /**
    * Clear all handlers (useful for testing)
    */

package/src/integration/services/outbox.processor.ts

@@ -27,8 +27,8 @@ export class OutboxProcessor {
     const batchSize = options?.batchSizeOverride ?? settings.batchSize;
     const leaseMs = settings.processingLeaseMs;
 
-    // Find pending events
-    const events = await this.outboxService.findPending(batchSize, leaseMs);
+    // Atomically claim pending events — prevents duplicate processing across replicas
+    const events = await this.outboxService.findPendingAndLock(batchSize, leaseMs);
 
     if (events.length === 0) {
       return 0;
@@ -42,9 +42,6 @@ export class OutboxProcessor {
 
     for (const event of events) {
       try {
-        // Mark as processing with lease
-        await this.outboxService.markProcessing(event.id, leaseMs);
-
         // Get handlers for this event
         const handlers = this.registry.getHandlers(event.eventName);
 

package/src/integration/services/outbox.service.ts

@@ -102,30 +102,48 @@ export class OutboxService {
   }
 
   /**
-   * Find pending events available for processing, ordered by creation time
+   * Atomically claim a batch of pending events using SELECT FOR UPDATE SKIP LOCKED.
+   * Prevents duplicate processing across multiple API replicas: each replica gets
+   * its own non-overlapping set of rows with no blocking between them.
    */
-  async findPending(
+  async findPendingAndLock(
     limit: number,
     leaseMs: number,
   ): Promise<OutboxEvent[]> {
     const now = new Date();
     const leaseThreshold = new Date(now.getTime() - leaseMs);
-
-    const records = await this.prisma.outbox_event.findMany({
-      where: {
-        OR: [
-          { status: OutboxEventStatus.PENDING },
-          {
-            status: OutboxEventStatus.PROCESSING,
-            available_at: { lte: leaseThreshold },
-          },
-        ],
-      },
-      orderBy: { created_at: 'asc' },
-      take: limit,
+    const leaseUntil = new Date(now.getTime() + leaseMs);
+
+    return this.prisma.$transaction(async (tx) => {
+      const rows = await tx.$queryRaw<OutboxEventRecord[]>`
+        SELECT * FROM outbox_event
+        WHERE status = 'pending'::"outbox_event_status_e5d55ba10d_enum"
+           OR (status = 'processing'::"outbox_event_status_e5d55ba10d_enum"
+               AND available_at <= ${leaseThreshold})
+        ORDER BY created_at ASC
+        LIMIT ${limit}
+        FOR UPDATE SKIP LOCKED
+      `;
+
+      if (rows.length === 0) return [];
+
+      const ids = rows.map((r) => r.id);
+      await tx.$executeRaw`
+        UPDATE outbox_event
+        SET status = 'processing'::"outbox_event_status_e5d55ba10d_enum",
+            available_at = ${leaseUntil},
+            updated_at = now()
+        WHERE id = ANY(${ids}::int[])
+      `;
+
+      return rows.map((r) =>
+        this.toDomainEvent({
+          ...r,
+          status: OutboxEventStatus.PROCESSING,
+          available_at: leaseUntil,
+        }),
+      );
     });
-
-    return records.map((record) => this.toDomainEvent(record as OutboxEventRecord));
   }
 
   /**

package/src/integration-profile/integration-credential-crypto.service.ts

@@ -0,0 +1,146 @@
+import { registerIntegrationConfigTransformer } from '@hed-hog/api-prisma';
+import {
+  Inject,
+  Injectable,
+  Logger,
+  OnModuleInit,
+  forwardRef,
+} from '@nestjs/common';
+import { SecurityService } from '../security/security.service';
+import { getSensitiveConfigKeys } from './integration-profile.secrets';
+
+/** Prefixo de envelope dos segredos cifrados em repouso. */
+export const ENC_ENVELOPE_PREFIX = 'enc.v1.';
+
+/** Placeholder devolvido à UI no lugar de um segredo armazenado. */
+export const SECRET_MASK = '********';
+
+type Config = Record<string, unknown> | null | undefined;
+
+/**
+ * Cifra/decifra os segredos dos Perfis de Integração em repouso.
+ *
+ * - Escrita: `encryptConfig` cifra (envelope `enc.v1.`) as chaves sensíveis do provider.
+ * - Leitura: um middleware Prisma `$use` (registrado em onModuleInit) decifra
+ *   `integration_profile.config` de forma transparente em toda leitura/resultado, então os
+ *   ~25 consumidores que leem o perfil direto via Prisma não mudam.
+ * - UI: `maskConfig` esconde segredos; `mergeKeepingStoredSecrets` implementa
+ *   "deixe em branco para manter".
+ *
+ * Valores legados sem o prefixo passam intactos (sem janela de quebra antes do backfill).
+ */
+@Injectable()
+export class IntegrationCredentialCryptoService implements OnModuleInit {
+  private readonly logger = new Logger(IntegrationCredentialCryptoService.name);
+
+  constructor(
+    @Inject(forwardRef(() => SecurityService))
+    private readonly securityService: SecurityService,
+  ) {}
+
+  onModuleInit() {
+    // Registra a decifra transparente de integration_profile.config (query extension
+    // no PrismaService). A partir daqui, toda leitura do perfil devolve config decifrado.
+    registerIntegrationConfigTransformer((config) => this.decryptConfig(config));
+    this.logger.log(
+      'Integration credential decryption registered (integration_profile.config).',
+    );
+  }
+
+  private isEnveloped(value: unknown): value is string {
+    return typeof value === 'string' && value.startsWith(ENC_ENVELOPE_PREFIX);
+  }
+
+  /** Cifra um valor único com envelope (idempotente). */
+  encryptValue(value: string): string {
+    if (this.isEnveloped(value)) return value;
+    return ENC_ENVELOPE_PREFIX + this.securityService.encrypt(value);
+  }
+
+  /** Decifra um valor com envelope; valores sem envelope passam intactos. */
+  decryptValue(value: unknown): unknown {
+    if (!this.isEnveloped(value)) return value;
+    try {
+      return this.securityService.decrypt(value.slice(ENC_ENVELOPE_PREFIX.length));
+    } catch (err) {
+      // Não derruba a query: loga e devolve como veio (ex.: ENCRYPTION_SECRET trocado).
+      this.logger.error(
+        `Failed to decrypt integration secret: ${err instanceof Error ? err.message : String(err)}`,
+      );
+      return value;
+    }
+  }
+
+  /** Cifra as chaves sensíveis do provider no config (idempotente, ignora vazios). */
+  encryptConfig(providerSlug: string, config: Config): Config {
+    if (!config) return config;
+    const keys = getSensitiveConfigKeys(providerSlug);
+    if (keys.length === 0) return config;
+    const out: Record<string, unknown> = { ...config };
+    for (const key of keys) {
+      const value = out[key];
+      if (typeof value === 'string' && value.length > 0) {
+        out[key] = this.encryptValue(value);
+      }
+    }
+    return out;
+  }
+
+  /** Decifra qualquer valor com envelope no config (não precisa do provider slug). */
+  decryptConfig(config: Config): Config {
+    if (!config) return config;
+    let changed = false;
+    const out: Record<string, unknown> = { ...config };
+    for (const [key, value] of Object.entries(out)) {
+      if (this.isEnveloped(value)) {
+        out[key] = this.decryptValue(value);
+        changed = true;
+      }
+    }
+    return changed ? out : config;
+  }
+
+  /** Mascara os segredos do provider para resposta à UI (não envia o valor real). */
+  maskConfig(
+    providerSlug: string,
+    config: Config,
+    placeholder = SECRET_MASK,
+  ): Config {
+    if (!config) return config;
+    const keys = getSensitiveConfigKeys(providerSlug);
+    if (keys.length === 0) return config;
+    const out: Record<string, unknown> = { ...config };
+    for (const key of keys) {
+      const value = out[key];
+      if (typeof value === 'string' && value.length > 0) {
+        out[key] = placeholder;
+      }
+    }
+    return out;
+  }
+
+  /**
+   * "Deixe em branco para manter": para cada chave sensível, se o valor recebido está
+   * vazio ou é o placeholder de máscara, herda o valor já armazenado (decifrado).
+   */
+  mergeKeepingStoredSecrets(
+    providerSlug: string,
+    incoming: Config,
+    storedDecrypted: Config,
+  ): Config {
+    const merged: Record<string, unknown> = { ...(incoming ?? {}) };
+    const stored = storedDecrypted ?? {};
+    for (const key of getSensitiveConfigKeys(providerSlug)) {
+      const value = merged[key];
+      const isBlank =
+        value === undefined ||
+        value === null ||
+        value === '' ||
+        value === SECRET_MASK;
+      if (isBlank && typeof stored[key] === 'string') {
+        merged[key] = stored[key];
+      }
+    }
+    return merged;
+  }
+}

package/src/integration-profile/integration-profile.controller.ts

@@ -55,12 +55,14 @@ export class IntegrationProfileController {
     @Query('typeId') typeId?: string,
     @Query('typeSlug') typeSlug?: string,
     @Query('providerSlug') providerSlug?: string,
+    @Query('slug') slug?: string,
   ) {
     return this.integrationProfileService.list(
       paginationParams,
       typeId ? parseInt(typeId, 10) : undefined,
       typeSlug,
       providerSlug,
+      slug,
     );
   }
 

package/src/integration-profile/integration-profile.module.ts

@@ -1,6 +1,8 @@
 import { PaginationModule } from '@hed-hog/api-pagination';
 import { PrismaModule } from '@hed-hog/api-prisma';
 import { forwardRef, Module } from '@nestjs/common';
+import { SecurityModule } from '../security/security.module';
+import { IntegrationCredentialCryptoService } from './integration-credential-crypto.service';
 import { IntegrationProfileController } from './integration-profile.controller';
 import { IntegrationProfileService } from './integration-profile.service';
 
@@ -8,9 +10,10 @@ import { IntegrationProfileService } from './integration-profile.service';
   imports: [
     forwardRef(() => PrismaModule),
     forwardRef(() => PaginationModule),
+    forwardRef(() => SecurityModule),
   ],
   controllers: [IntegrationProfileController],
-  providers: [IntegrationProfileService],
-  exports: [IntegrationProfileService],
+  providers: [IntegrationProfileService, IntegrationCredentialCryptoService],
+  exports: [IntegrationProfileService, IntegrationCredentialCryptoService],
 })
 export class IntegrationProfileModule {}

package/src/integration-profile/integration-profile.secrets.ts

@@ -0,0 +1,51 @@
+/**
+ * Mapa AUTORITATIVO das chaves sensíveis (segredos) por provider de integração.
+ *
+ * SEGURANÇA-CRÍTICO: este mapa é a fonte única de verdade do que é cifrado em repouso
+ * (integration-credential-crypto.service) e mascarado na exportação/UI. Qualquer chave
+ * esquecida aqui NÃO será cifrada. Deve ser mantido em sincronia com os campos
+ * `type: 'password'` do form do admin (PROVIDER_FIELDS em
+ * apps/admin/src/app/(app)/(libraries)/core/integration/profiles/page.tsx).
+ *
+ * Não usar heurística por nome de chave: campos públicos como `site_key`, `public_key` e
+ * `access_key_id` contêm "key" mas NÃO são segredos.
+ */
+export const INTEGRATION_SECRET_KEYS: Record<string, string[]> = {
+  // Email
+  smtp: ['password'],
+  gmail: ['client_secret', 'refresh_token'],
+  ses: ['secret_access_key'],
+  // Mensageria
+  'evolution-api': ['token'],
+  'whatsapp-official': ['access_token'],
+  // Storage
+  s3: ['secret_access_key'],
+  gcs: ['key_file_json'],
+  'azure-blob': ['key'],
+  's3-compatible': ['secret_access_key'],
+  // IA
+  openai: ['api_key'],
+  gemini: ['api_key'],
+  claude: ['api_key'],
+  // OAuth
+  'google-oauth': ['client_secret'],
+  'github-oauth': ['client_secret'],
+  'microsoft-oauth': ['client_secret'],
+  'facebook-oauth': ['client_secret'],
+  'microsoft-entra-id-oauth': ['client_secret'],
+  // Pagamento
+  stripe: ['secret_key', 'webhook_secret'],
+  mercado_pago: ['access_token', 'webhook_secret'],
+  // Captcha
+  recaptcha: ['secret_key'],
+  'cloudflare-turnstile': ['secret_key'],
+  altcha: ['hmac_key'],
+  // Infraestrutura (autoscaling)
+  digitalocean: ['api_token'],
+  kubernetes: ['token', 'ca_cert'],
+};
+
+/** Chaves sensíveis de um provider (vazio se desconhecido). */
+export function getSensitiveConfigKeys(providerSlug: string): string[] {
+  return INTEGRATION_SECRET_KEYS[providerSlug.toLowerCase()] ?? [];
+}