@hed-hog/core 0.0.370 → 0.0.371

package/src/mail/mail.controller.ts

@@ -1,5 +1,6 @@
 import { DeleteDTO, Role } from '@hed-hog/api';
 import { Locale } from '@hed-hog/api-locale';
+import { renderMailTemplate } from '@hed-hog/api-mail';
 import { Pagination } from '@hed-hog/api-pagination';
 import {
     Body,
@@ -56,35 +57,10 @@ export class MailController {
   ) {
     const locale = queryLocale || decoratorLocale;
     const mail = await this.mailService.get(locale, id);
-    
-    const html = `<!DOCTYPE html>
-<html>
-  <head>
-    <meta charset="UTF-8">
-    <meta name="viewport" content="width=device-width, initial-scale=1.0">
-    <title>${mail.subject}</title>
-    <style>
-      body {
-        font-family: -apple-system, BlinkMacSystemFont, 'Segoe UI', Roboto, 'Helvetica Neue', Arial, sans-serif;
-        line-height: 1.6;
-        color: #333;
-        max-width: 600px;
-        margin: 0 auto;
-        padding: 20px;
-      }
-      a {
-        color: #0066cc;
-        text-decoration: none;
-      }
-      a:hover {
-        text-decoration: underline;
-      }
-    </style>
-  </head>
-  <body>
-    ${mail.body}
-  </body>
-</html>`;
+    const html = renderMailTemplate({
+      subject: mail.subject,
+      body: mail.body,
+    });
 
     res.setHeader('Content-Disposition', `attachment; filename="${mail.slug}-${locale}.html"`);
     res.send(html);

package/src/mail/mail.module.ts

@@ -28,16 +28,16 @@ import { MailService } from './mail.service';
             profileSettings.map((item) => [item.slug, item.value]),
           );
 
-          const profileId = Number(
-            profileSettingsMap.get('mail-integration-profile-id'),
-          );
+          const profileSlug = String(
+            profileSettingsMap.get('mail-integration-profile-id') ?? '',
+          ).trim();
 
-          if (!profileId || profileId <= 0) {
+          if (!profileSlug) {
             return { global: true, type: 'SMTP', host: 'localhost', port: 1025, secure: false, username: '', password: '' } as MailModuleOptions;
           }
 
           const profile = await (prisma as any).integration_profile.findUnique({
-            where: { id: profileId },
+            where: { slug: profileSlug },
             include: {
               integration_provider: { select: { slug: true } },
               integration_type: { select: { slug: true } },

package/src/mail/mail.service.ts

@@ -76,20 +76,22 @@ export class MailService implements OnModuleInit {
       const settings = await this.setting.getSettingValues([
         this.integrationProfileSettingSlug,
       ]);
-      const profileId = settings[this.integrationProfileSettingSlug];
+      const profileSlug = String(
+        settings[this.integrationProfileSettingSlug] ?? '',
+      ).trim();
 
-      if (!profileId || Number(profileId) <= 0) {
+      if (!profileSlug) {
         await this.setting.setValue('configured-mail', 'false');
         return;
       }
 
-      const { from, config } = await this.reloadConfig();
+      const { from } = await this.reloadConfig();
 
       await this.mailMainService.send({
         to: from,
         from,
         subject: '[HedHog] Mail configuration validation',
-        body: `This is an automatic validation email for the configured profile (id: ${profileId}).`,
+        body: `This is an automatic validation email for the configured profile (slug: ${profileSlug}).`,
       });
 
       await this.setting.setValue('configured-mail', 'true');
@@ -103,27 +105,29 @@ export class MailService implements OnModuleInit {
 
   /**
    * Reload mail configuration from database and update MailMainService.
-   * When profileId is provided, that profile is used directly.
+   * When profileSlug is provided, that profile is used directly.
     * Otherwise the global integration profile setting is read.
    * Returns the active from address and the built config object.
    */
-  async reloadConfig(profileId?: number): Promise<{ success: boolean; provider: string; from: string; config: any }> {
+  async reloadConfig(profileSlug?: string): Promise<{ success: boolean; provider: string; from: string; config: any }> {
     try {
-      let resolvedProfileId = profileId;
+      let resolvedProfileSlug = String(profileSlug ?? '').trim();
 
-      if (!resolvedProfileId) {
+      if (!resolvedProfileSlug) {
         const settings = await this.setting.getSettingValues([
           this.integrationProfileSettingSlug,
         ]);
-        resolvedProfileId = Number(settings[this.integrationProfileSettingSlug]);
+        resolvedProfileSlug = String(
+          settings[this.integrationProfileSettingSlug] ?? '',
+        ).trim();
       }
 
-      if (!resolvedProfileId || resolvedProfileId <= 0) {
+      if (!resolvedProfileSlug) {
         throw new BadRequestException('No mail profile configured. Set a mail profile in the Mail settings.');
       }
 
       const profile = await this.prismaService.integration_profile.findUnique({
-        where: { id: resolvedProfileId },
+        where: { slug: resolvedProfileSlug },
         include: {
           integration_provider: { select: { slug: true } },
           integration_type: { select: { slug: true } },
@@ -131,12 +135,12 @@ export class MailService implements OnModuleInit {
       });
 
       if (!profile) {
-        throw new NotFoundException(`Mail profile with id ${profileId} not found.`);
+        throw new NotFoundException(`Mail profile with slug "${resolvedProfileSlug}" not found.`);
       }
 
       if (profile.integration_type?.slug !== 'email') {
         throw new BadRequestException(
-          `Integration profile ${resolvedProfileId} is not an email profile.`,
+          `Integration profile "${resolvedProfileSlug}" is not an email profile.`,
         );
       }
 
@@ -155,6 +159,26 @@ export class MailService implements OnModuleInit {
     }
   }
 
+  /**
+   * Sends an ad-hoc HTML email using the configured (or given) mail profile,
+   * without requiring a stored template. Used by other modules (e.g. agent
+   * human-approval notifications).
+   */
+  async sendRawMail({
+    to,
+    subject,
+    html,
+    profileSlug,
+  }: {
+    to: string;
+    subject: string;
+    html: string;
+    profileSlug?: string;
+  }) {
+    const { from } = await this.reloadConfig(profileSlug);
+    return this.mailMainService.send({ to, from, subject, body: html } as any);
+  }
+
 
   async list(locale: string, paginationParams: PaginationDTO) {
     const result = await this.localeService.listModelWithLocale(

package/src/mcp-chat/mcp-chat.service.ts

@@ -860,28 +860,28 @@ export class McpChatService {
 
   private async getProviderKey(): Promise<{ provider: 'openai' | 'gemini'; apiKey: string }> {
     const settings = await this.setting.getSettingValues(['mcp-ai-profile-id']);
-    const profileId = Number(settings['mcp-ai-profile-id']);
+    const profileSlug = String(settings['mcp-ai-profile-id'] ?? '').trim();
 
-    if (!profileId) {
+    if (!profileSlug) {
       throw new BadRequestException(
         'No MCP AI profile configured. Select one in Settings → MCP.',
       );
     }
 
     const profile = await this.prisma.integration_profile.findUnique({
-      where: { id: profileId },
+      where: { slug: profileSlug },
       include: { integration_provider: { select: { slug: true } } },
     });
 
     if (!profile) {
-      throw new BadRequestException(`MCP AI profile ${profileId} not found.`);
+      throw new BadRequestException(`MCP AI profile "${profileSlug}" not found.`);
     }
 
     const providerSlug = profile.integration_provider.slug;
     const { apiKey } = buildAiConfigFromIntegration(providerSlug, profile.config);
 
     if (!apiKey) {
-      throw new BadRequestException(`MCP AI profile ${profileId} has no API key configured.`);
+      throw new BadRequestException(`MCP AI profile "${profileSlug}" has no API key configured.`);
     }
 
     return { provider: providerSlug === 'gemini' ? 'gemini' : 'openai', apiKey };

package/src/oauth/oauth-callback-coordinator.service.spec.ts

@@ -0,0 +1,159 @@
+import { describe, it, expect, afterEach } from '@jest/globals';
+import { OAuthCallbackCoordinatorService } from './oauth-callback-coordinator.service';
+import {
+  OAuthCallbackAlreadyProcessedError,
+  OAuthCallbackInProgressError,
+  OAuthProviderException,
+} from './oauth.errors';
+
+const makeService = (prisma: any) => new OAuthCallbackCoordinatorService(prisma as any);
+
+const noLockPrisma = (overrides: any = {}) => ({
+  isPostgres: jest.fn().mockReturnValue(false),
+  isMysql: jest.fn().mockReturnValue(false),
+  getProvider: jest.fn().mockReturnValue('sqlite'),
+  ...overrides,
+});
+
+describe('OAuthCallbackCoordinatorService', () => {
+  afterEach(() => {
+    jest.clearAllMocks();
+    jest.useRealTimers();
+  });
+
+  describe('execute (no distributed lock provider)', () => {
+    it('runs the callback and marks the key completed', async () => {
+      const service = makeService(noLockPrisma());
+      const callback = jest.fn().mockResolvedValue('ok');
+
+      await expect(service.execute('key-a', callback)).resolves.toBe('ok');
+      expect(callback).toHaveBeenCalledTimes(1);
+      expect((service as any).isCompleted('key-a')).toBe(true);
+    });
+
+    it('rejects a second call with the same key as already processed', async () => {
+      const service = makeService(noLockPrisma());
+      await service.execute('key-b', jest.fn().mockResolvedValue(1));
+
+      await expect(
+        service.execute('key-b', jest.fn().mockResolvedValue(2)),
+      ).rejects.toThrow(OAuthCallbackAlreadyProcessedError);
+    });
+
+    it('does not mark completed when the callback throws a generic error', async () => {
+      const service = makeService(noLockPrisma());
+      await expect(
+        service.execute('key-c', jest.fn().mockRejectedValue(new Error('boom'))),
+      ).rejects.toThrow('boom');
+      expect((service as any).isCompleted('key-c')).toBe(false);
+    });
+
+    it('marks completed when the callback throws a callback_consumed provider error', async () => {
+      const service = makeService(noLockPrisma());
+      const err = new OAuthProviderException('google', 'callback_consumed', 'consumed');
+      await expect(service.execute('key-d', jest.fn().mockRejectedValue(err))).rejects.toBe(err);
+      expect((service as any).isCompleted('key-d')).toBe(true);
+    });
+  });
+
+  describe('execute (postgres advisory lock)', () => {
+    it('acquires the advisory lock and runs the callback', async () => {
+      const tx = { $queryRaw: jest.fn().mockResolvedValue([{ locked: true }]) };
+      const prisma = {
+        isPostgres: jest.fn().mockReturnValue(true),
+        isMysql: jest.fn().mockReturnValue(false),
+        getProvider: jest.fn().mockReturnValue('postgresql'),
+        $transaction: jest.fn(async (cb: any) => cb(tx)),
+      };
+      const service = makeService(prisma);
+      const callback = jest.fn().mockResolvedValue('done');
+
+      await expect(service.execute('pg-key', callback)).resolves.toBe('done');
+      expect(callback).toHaveBeenCalledTimes(1);
+      expect((service as any).isCompleted('pg-key')).toBe(true);
+    });
+
+    it('throws InProgress and does not run the callback when the lock is held', async () => {
+      const tx = { $queryRaw: jest.fn().mockResolvedValue([{ locked: false }]) };
+      const prisma = {
+        isPostgres: jest.fn().mockReturnValue(true),
+        isMysql: jest.fn().mockReturnValue(false),
+        getProvider: jest.fn().mockReturnValue('postgresql'),
+        $transaction: jest.fn(async (cb: any) => cb(tx)),
+      };
+      const service = makeService(prisma);
+      const callback = jest.fn();
+
+      await expect(service.execute('pg-busy', callback)).rejects.toThrow(OAuthCallbackInProgressError);
+      expect(callback).not.toHaveBeenCalled();
+      expect((service as any).isCompleted('pg-busy')).toBe(false);
+    });
+  });
+
+  describe('completed-callback bookkeeping', () => {
+    it('expires completed entries after the TTL window', () => {
+      jest.useFakeTimers();
+      jest.setSystemTime(new Date('2026-01-01T00:00:00.000Z'));
+      const service = makeService(noLockPrisma());
+
+      (service as any).markCompleted('ttl-key');
+      expect((service as any).isCompleted('ttl-key')).toBe(true);
+
+      // Advance beyond the 10 minute TTL.
+      jest.setSystemTime(new Date('2026-01-01T00:11:00.000Z'));
+      expect((service as any).isCompleted('ttl-key')).toBe(false);
+    });
+
+    it('prunes expired entries from the internal map', () => {
+      jest.useFakeTimers();
+      jest.setSystemTime(new Date('2026-01-01T00:00:00.000Z'));
+      const service = makeService(noLockPrisma());
+      (service as any).markCompleted('old');
+
+      jest.setSystemTime(new Date('2026-01-01T00:11:00.000Z'));
+      (service as any).markCompleted('fresh');
+      (service as any).pruneCompletedCallbacks();
+
+      expect((service as any).completedCallbacks.has('old')).toBe(false);
+      expect((service as any).completedCallbacks.has('fresh')).toBe(true);
+    });
+  });
+
+  describe('shouldMarkCompleted', () => {
+    it('is true for already-processed and callback_consumed errors only', () => {
+      const service = makeService(noLockPrisma());
+      expect((service as any).shouldMarkCompleted(new OAuthCallbackAlreadyProcessedError())).toBe(true);
+      expect(
+        (service as any).shouldMarkCompleted(
+          new OAuthProviderException('g', 'callback_consumed', 'x'),
+        ),
+      ).toBe(true);
+      expect(
+        (service as any).shouldMarkCompleted(
+          new OAuthProviderException('g', 'upstream_failure', 'x'),
+        ),
+      ).toBe(false);
+      expect((service as any).shouldMarkCompleted(new Error('other'))).toBe(false);
+    });
+  });
+
+  describe('lock key derivation', () => {
+    it('derives a deterministic signed bigint within int64 bounds', () => {
+      const service = makeService(noLockPrisma());
+      const a = (service as any).toSignedBigInt('same');
+      const b = (service as any).toSignedBigInt('same');
+      expect(a).toBe(b);
+      expect(typeof a).toBe('bigint');
+      expect(a >= -(BigInt(1) << BigInt(63))).toBe(true);
+      expect(a < BigInt(1) << BigInt(63)).toBe(true);
+      expect((service as any).toSignedBigInt('other')).not.toBe(a);
+    });
+
+    it('derives a prefixed 48-char mysql lock name', () => {
+      const service = makeService(noLockPrisma());
+      const name = (service as any).toMysqlLockName('key');
+      expect(name.startsWith('oauth:')).toBe(true);
+      expect(name.slice('oauth:'.length)).toHaveLength(48);
+    });
+  });
+});

package/src/oauth/providers/facebook.provider.ts

@@ -26,11 +26,11 @@ export class FacebookProvider extends BaseOAuthProvider {
       'oauth-facebook-profile-id',
       'url',
     ]);
-    const profileId = Number(settings['oauth-facebook-profile-id']);
-    if (!profileId) throw new BadRequestException('Facebook OAuth profile not configured.');
+    const profileSlug = String(settings['oauth-facebook-profile-id'] ?? '').trim();
+    if (!profileSlug) throw new BadRequestException('Facebook OAuth profile not configured.');
 
     const profile = await this.prisma.integration_profile.findUnique({
-      where: { id: profileId },
+      where: { slug: profileSlug },
       include: { integration_provider: { select: { slug: true } } },
     });
     if (!profile) throw new BadRequestException('Facebook OAuth profile not found.');

package/src/oauth/providers/github.provider.ts

@@ -30,11 +30,11 @@ export class GithubProvider extends BaseOAuthProvider {
       'oauth-github-profile-id',
       'api-url',
     ]);
-    const profileId = Number(settings['oauth-github-profile-id']);
-    if (!profileId) throw new BadRequestException('GitHub OAuth profile not configured.');
+    const profileSlug = String(settings['oauth-github-profile-id'] ?? '').trim();
+    if (!profileSlug) throw new BadRequestException('GitHub OAuth profile not configured.');
 
     const profile = await this.prisma.integration_profile.findUnique({
-      where: { id: profileId },
+      where: { slug: profileSlug },
       include: { integration_provider: { select: { slug: true } } },
     });
     if (!profile) throw new BadRequestException('GitHub OAuth profile not found.');

package/src/oauth/providers/google.provider.ts

@@ -26,11 +26,11 @@ export class GoogleProvider extends BaseOAuthProvider {
       'oauth-google-profile-id',
       'url',
     ]);
-    const profileId = Number(settings['oauth-google-profile-id']);
-    if (!profileId) throw new BadRequestException('Google OAuth profile not configured.');
+    const profileSlug = String(settings['oauth-google-profile-id'] ?? '').trim();
+    if (!profileSlug) throw new BadRequestException('Google OAuth profile not configured.');
 
     const profile = await this.prisma.integration_profile.findUnique({
-      where: { id: profileId },
+      where: { slug: profileSlug },
       include: { integration_provider: { select: { slug: true } } },
     });
     if (!profile) throw new BadRequestException('Google OAuth profile not found.');

package/src/oauth/providers/microsoft-entra-id.provider.ts

@@ -40,11 +40,11 @@ export class MicrosoftEntraIdProvider extends BaseOAuthProvider {
       'oauth-microsoft-entra-id-profile-id',
       'url',
     ]);
-    const profileId = Number(settings['oauth-microsoft-entra-id-profile-id']);
-    if (!profileId) throw new BadRequestException('Microsoft Entra ID OAuth profile not configured.');
+    const profileSlug = String(settings['oauth-microsoft-entra-id-profile-id'] ?? '').trim();
+    if (!profileSlug) throw new BadRequestException('Microsoft Entra ID OAuth profile not configured.');
 
     const profile = await this.prisma.integration_profile.findUnique({
-      where: { id: profileId },
+      where: { slug: profileSlug },
       include: { integration_provider: { select: { slug: true } } },
     });
     if (!profile) throw new BadRequestException('Microsoft Entra ID OAuth profile not found.');

package/src/oauth/providers/microsoft.provider.ts

@@ -26,11 +26,11 @@ export class MicrosoftProvider extends BaseOAuthProvider {
       'oauth-microsoft-profile-id',
       'url',
     ]);
-    const profileId = Number(settings['oauth-microsoft-profile-id']);
-    if (!profileId) throw new BadRequestException('Microsoft OAuth profile not configured.');
+    const profileSlug = String(settings['oauth-microsoft-profile-id'] ?? '').trim();
+    if (!profileSlug) throw new BadRequestException('Microsoft OAuth profile not configured.');
 
     const profile = await this.prisma.integration_profile.findUnique({
-      where: { id: profileId },
+      where: { slug: profileSlug },
       include: { integration_provider: { select: { slug: true } } },
     });
     if (!profile) throw new BadRequestException('Microsoft OAuth profile not found.');

package/src/pdf/pdf.service.ts

@@ -15,6 +15,10 @@ export interface PdfGenerateOptions {
   margin?: { top?: string; right?: string; bottom?: string; left?: string };
   printBackground?: boolean;
   landscape?: boolean;
+  /** Explicit CSS page size (e.g. '1600px'). Takes precedence over `format`/`landscape` when set. */
+  width?: string;
+  /** Explicit CSS page size (e.g. '1131px'). Takes precedence over `format`/`landscape` when set. */
+  height?: string;
 }
 
 // ─────────────────────────────────────────────────────────────────────────────
@@ -161,12 +165,21 @@ export class PdfService {
       await page.setViewportSize({ width: 794, height: 1123 });
       await page.setContent(html, { waitUntil: 'networkidle' });
 
-      const pdfBuffer = await page.pdf({
-        format: options.format ?? 'A4',
-        printBackground: options.printBackground ?? true,
-        landscape: options.landscape ?? false,
-        margin: options.margin ?? { top: '0', right: '0', bottom: '0', left: '0' },
-      });
+      const pdfBuffer = await page.pdf(
+        options.width && options.height
+          ? {
+              width: options.width,
+              height: options.height,
+              printBackground: options.printBackground ?? true,
+              margin: options.margin ?? { top: '0', right: '0', bottom: '0', left: '0' },
+            }
+          : {
+              format: options.format ?? 'A4',
+              printBackground: options.printBackground ?? true,
+              landscape: options.landscape ?? false,
+              margin: options.margin ?? { top: '0', right: '0', bottom: '0', left: '0' },
+            },
+      );
 
       return Buffer.from(pdfBuffer);
     } catch (error) {

package/src/profile/profile.controller.ts

@@ -44,9 +44,10 @@ export class ProfileController {
   async verifyBeforeAddMfa(
     @User() { id },
     @Body() data: VerifyBeforeAddMfaDto,
-    @Locale() locale: string
+    @Locale() locale: string,
+    @Headers('origin') origin: string
   ) {
-    return this.profileService.verifyBeforeAddMfa(locale, id, data);
+    return this.profileService.verifyBeforeAddMfa(locale, id, data, origin);
   }
 
   @Post('totp/generate')
@@ -130,9 +131,10 @@ export class ProfileController {
     @User() { id },
     @Param('mfaId', ParseIntPipe) mfaId: number,
     @Body() data: RemoveMfaDto,
-    @Locale() locale: string
+    @Locale() locale: string,
+    @Headers('origin') origin: string
   ) {
-    return this.profileService.removeMfa(locale, id, mfaId, data);
+    return this.profileService.removeMfa(locale, id, mfaId, data, origin);
   }
 
   @Post('recovery-codes/send-verification')
@@ -147,43 +149,48 @@ export class ProfileController {
   async regenerateRecoveryCodes(
     @User() { id },
     @Body() data: RegenerateRecoveryCodesDto,
-    @Locale() locale: string
+    @Locale() locale: string,
+    @Headers('origin') origin: string
   ) {
-    return this.profileService.regenerateRecoveryCodes(locale, id, data);
+    return this.profileService.regenerateRecoveryCodes(locale, id, data, origin);
   }
 
   @Post('webauthn/generate')
   async generateWebAuthnRegistrationOptions(
     @User() { id },
     @Body() { name }: GenerateWebAuthnRegistrationOptionsDto,
-    @Locale() locale: string
+    @Locale() locale: string,
+    @Headers('origin') origin: string
   ) {
-    return this.profileService.generateWebAuthnRegistrationOptions(locale, id, name);
+    return this.profileService.generateWebAuthnRegistrationOptions(locale, id, name, origin);
   }
 
   @Post('webauthn/verify')
   async verifyWebAuthnRegistration(
     @User() { id },
     @Body() { name, attestationResponse }: VerifyWebAuthnRegistrationDto,
-    @Locale() locale: string
+    @Locale() locale: string,
+    @Headers('origin') origin: string
   ) {
-    return this.profileService.verifyWebAuthnRegistration(locale, id, name, attestationResponse);
+    return this.profileService.verifyWebAuthnRegistration(locale, id, name, attestationResponse, origin);
   }
 
   @Post('webauthn/authenticate/generate')
   async generateWebAuthnAuthenticationOptions(
     @User() { id },
-    @Locale() locale: string
+    @Locale() locale: string,
+    @Headers('origin') origin: string
   ) {
-    return this.profileService.generateWebAuthnAuthenticationOptions(locale, id);
+    return this.profileService.generateWebAuthnAuthenticationOptions(locale, id, origin);
   }
 
   @Post('webauthn/authenticate/verify')
   async verifyWebAuthnAuthentication(
     @User() { id },
-    @Body() { assertionResponse }: VerifyWebAuthnDto
+    @Body() { assertionResponse }: VerifyWebAuthnDto,
+    @Headers('origin') origin: string
   ) {
-    return this.profileService.verifyWebAuthnAuthentication(id, assertionResponse);
+    return this.profileService.verifyWebAuthnAuthentication(id, assertionResponse, origin);
   }
 
   @Delete('webauthn/:mfaId/remove')