@hed-hog/core 0.0.370 → 0.0.371

package/src/profile/profile.service.ts

@@ -22,6 +22,7 @@ import { SecurityService } from '../security/security.service';
 import { SettingService } from '../setting/setting.service';
 import { TokenService } from '../token/token.service';
 import { UserService } from '../user/user.service';
+import { resolveWebAuthnOrigin } from '../utils/webauthn-origin';
 import { ChangeEmailDto } from './dto/change-email.dto';
 import { ChangePasswordDto } from './dto/change-password.dto';
 import { EmailVerificationDto } from './dto/email-verification-confirm.dto';
@@ -294,6 +295,8 @@ export class ProfileService {
       this.eventEmitter.emit(PROFILE_EMAIL_CHANGED, new ProfileEmailChangedEvent(userId, confirmedIdentifier.value));
     }
 
+    await this.user.registerUserActivity(userId, 'changeEmail');
+
     return { success: true };
   }
 
@@ -349,6 +352,7 @@ export class ProfileService {
     });
     if (name) {
       this.eventEmitter.emit(PROFILE_UPDATED, new ProfileUpdatedEvent(userid, name));
+      await this.user.registerUserActivity(userid, 'updateProfile');
     }
     return result;
   }
@@ -356,6 +360,7 @@ export class ProfileService {
   async updateAvatar(locale: string, userId: number, file: MulterFile) {
     const result = await this.user.changeAvatar(locale, userId, file);
     this.eventEmitter.emit(PROFILE_AVATAR_UPDATED, new ProfileAvatarUpdatedEvent(userId, result?.id ?? null));
+    await this.user.registerUserActivity(userId, 'avatar_changed');
     return result;
   }
 
@@ -405,6 +410,8 @@ export class ProfileService {
       });
     }
 
+    await this.user.registerUserActivity(userId, 'changePassword');
+
     return { success: true };
   }
 
@@ -656,7 +663,7 @@ export class ProfileService {
     }
   }
 
-  async removeMfa(locale: string, userId: number, mfaId: number, data: { token?: string; hash?: string; verificationType?: 'totp' | 'email' | 'recovery' | 'webauthn'; assertionResponse?: any }) {
+  async removeMfa(locale: string, userId: number, mfaId: number, data: { token?: string; hash?: string; verificationType?: 'totp' | 'email' | 'recovery' | 'webauthn'; assertionResponse?: any }, requestOrigin?: string) {
     try {
       const user = await this.prisma.user.findUnique({
         where: { id: userId },
@@ -700,7 +707,7 @@ export class ProfileService {
         }
 
         try {
-          await this.verifyWebAuthnAuthentication(userId, data.assertionResponse);
+          await this.verifyWebAuthnAuthentication(userId, data.assertionResponse, requestOrigin);
         } catch (error) {
           throw new BadRequestException(
             getLocaleText('invalidWebAuthn', locale, 'WebAuthn verification failed.')
@@ -899,7 +906,8 @@ export class ProfileService {
   async verifyBeforeAddMfa(
     locale: string,
     userId: number,
-    data: { verificationCode?: string; hash?: string; verificationType: 'totp' | 'email' | 'recovery' | 'webauthn'; assertionResponse?: any }
+    data: { verificationCode?: string; hash?: string; verificationType: 'totp' | 'email' | 'recovery' | 'webauthn'; assertionResponse?: any },
+    requestOrigin?: string
   ) {
     try {
       const user = await this.prisma.user.findUnique({
@@ -935,7 +943,7 @@ export class ProfileService {
         }
 
         try {
-          await this.verifyWebAuthnAuthentication(userId, data.assertionResponse);
+          await this.verifyWebAuthnAuthentication(userId, data.assertionResponse, requestOrigin);
         } catch (error) {
           throw new BadRequestException(
             getLocaleText('invalidWebAuthn', locale, 'WebAuthn verification failed.')
@@ -1087,7 +1095,7 @@ export class ProfileService {
     }
   }
 
-  async regenerateRecoveryCodes(locale: string, userId: number, data: { verificationCode?: string; hash?: string; verificationType?: 'totp' | 'email' | 'recovery' | 'webauthn'; assertionResponse?: any }) {
+  async regenerateRecoveryCodes(locale: string, userId: number, data: { verificationCode?: string; hash?: string; verificationType?: 'totp' | 'email' | 'recovery' | 'webauthn'; assertionResponse?: any }, requestOrigin?: string) {
     try {
       const user = await this.prisma.user.findUnique({
         where: { id: userId },
@@ -1125,7 +1133,7 @@ export class ProfileService {
           }
 
           try {
-            await this.verifyWebAuthnAuthentication(userId, data.assertionResponse);
+            await this.verifyWebAuthnAuthentication(userId, data.assertionResponse, requestOrigin);
           } catch (error) {
             throw new BadRequestException(
               getLocaleText('invalidWebAuthn', locale, 'WebAuthn verification failed.')
@@ -1213,7 +1221,7 @@ export class ProfileService {
     }
   }
 
-  async generateWebAuthnRegistrationOptions(locale: string, userId: number, name: string) {
+  async generateWebAuthnRegistrationOptions(locale: string, userId: number, name: string, requestOrigin?: string) {
     try {
       const user = await this.prisma.user.findFirst({
         where: { id: userId },
@@ -1244,8 +1252,7 @@ export class ProfileService {
       ]);
 
       const rpName = settings['system-name'] || 'HedHog';
-      const primaryOrigin = (process.env.CORS_ALLOWED_ORIGINS ?? '').split(/[\n,;]+/).map(u => u.trim()).filter(Boolean)[0] ?? 'http://localhost:3200';
-      const rpID = new URL(primaryOrigin).hostname;
+      const { rpID } = resolveWebAuthnOrigin(requestOrigin);
       const userEmail = user.user_identifier.find(ui => ui.type === 'email')?.value || `user${userId}@example.com`;
       const existingAuthenticators = user.user_mfa
         .filter(mfa => mfa.user_mfa_webauthn && mfa.user_mfa_webauthn.length > 0)
@@ -1295,7 +1302,8 @@ export class ProfileService {
     locale: string,
     userId: number,
     name: string,
-    attestationResponse: any
+    attestationResponse: any,
+    requestOrigin?: string
   ) {
     try {
       const challengeRecord = await this.prisma.user_mfa_challenge.findFirst({
@@ -1317,9 +1325,7 @@ export class ProfileService {
         );
       }
 
-      const primaryOrigin = (process.env.CORS_ALLOWED_ORIGINS ?? '').split(/[\n,;]+/).map(u => u.trim()).filter(Boolean)[0] ?? 'http://localhost:3200';
-      const rpID = new URL(primaryOrigin).hostname;
-      const expectedOrigin = primaryOrigin;
+      const { rpID, expectedOrigin } = resolveWebAuthnOrigin(requestOrigin);
       const verification: VerifiedRegistrationResponse = await verifyRegistrationResponse({
         response: attestationResponse,
         expectedChallenge: challengeRecord.hash,
@@ -1361,7 +1367,7 @@ export class ProfileService {
     }
   }
 
-  async generateWebAuthnAuthenticationOptions(locale: string, userId: number) {
+  async generateWebAuthnAuthenticationOptions(locale: string, userId: number, requestOrigin?: string) {
     try {
       const user = await this.prisma.user.findFirst({
         where: { id: userId },
@@ -1379,8 +1385,7 @@ export class ProfileService {
         );
       }
 
-      const primaryOrigin = (process.env.CORS_ALLOWED_ORIGINS ?? '').split(/[\n,;]+/).map(u => u.trim()).filter(Boolean)[0] ?? 'http://localhost:3200';
-      const rpID = new URL(primaryOrigin).hostname;
+      const { rpID } = resolveWebAuthnOrigin(requestOrigin);
       const allowCredentials = user.user_mfa
         .filter(mfa => mfa.user_mfa_webauthn && mfa.user_mfa_webauthn.length > 0)
         .map(mfa => ({
@@ -1408,7 +1413,7 @@ export class ProfileService {
     }
   }
 
-  async verifyWebAuthnAuthentication(userId: number, assertionResponse: any) {
+  async verifyWebAuthnAuthentication(userId: number, assertionResponse: any, requestOrigin?: string) {
     try {
       const challengeRecord = await this.prisma.user_mfa_challenge.findFirst({
         where: {
@@ -1433,9 +1438,7 @@ export class ProfileService {
       }
 
       const authenticator = challengeRecord.user_mfa.user_mfa_webauthn[0];
-      const primaryOrigin = (process.env.CORS_ALLOWED_ORIGINS ?? '').split(/[\n,;]+/).map(u => u.trim()).filter(Boolean)[0] ?? 'http://localhost:3200';
-      const rpID = new URL(primaryOrigin).hostname;
-      const expectedOrigin = primaryOrigin;
+      const { rpID, expectedOrigin } = resolveWebAuthnOrigin(requestOrigin);
       const verification: VerifiedAuthenticationResponse = await verifyAuthenticationResponse({
         response: assertionResponse,
         expectedChallenge: challengeRecord.hash,

package/src/security/security.service.spec.ts

@@ -0,0 +1,222 @@
+import { BadRequestException } from '@nestjs/common';
+import { describe, it, expect, jest, beforeEach, afterEach } from '@jest/globals';
+
+jest.mock('@hed-hog/api-locale', () => ({
+  getLocaleText: (_key: string, _locale: string, fallback: string) => fallback,
+}));
+
+jest.mock('argon2', () => ({
+  __esModule: true,
+  hash: jest.fn(),
+  verify: jest.fn(),
+}));
+
+import * as argon2 from 'argon2';
+import { SecurityService } from './security.service';
+
+const makeService = (env: Record<string, string | undefined> = {}) => {
+  const configService = {
+    get: jest.fn((key: string) => env[key]),
+  };
+  const service = new SecurityService(configService as any);
+  return { service, configService };
+};
+
+describe('SecurityService', () => {
+  afterEach(() => {
+    jest.clearAllMocks();
+  });
+
+  describe('getValueWithPepper', () => {
+    it('uses the explicit pepper when provided', () => {
+      const { service, configService } = makeService();
+      expect(service.getValueWithPepper('value', 'PEP')).toBe('valuePEP');
+      expect(configService.get).not.toHaveBeenCalled();
+    });
+
+    it('falls back to the configured PEPPER', () => {
+      const { service } = makeService({ PEPPER: 'secret-pepper' });
+      expect(service.getValueWithPepper('value')).toBe('valuesecret-pepper');
+    });
+  });
+
+  describe('getJwtSecret', () => {
+    it('reads JWT_SECRET from config', () => {
+      const { service } = makeService({ JWT_SECRET: 'jwt-secret' });
+      expect(service.getJwtSecret()).toBe('jwt-secret');
+    });
+  });
+
+  describe('hashSha256', () => {
+    it('is deterministic and emits url-safe base64 without padding', () => {
+      const { service } = makeService();
+      const a = service.hashSha256('hello');
+      const b = service.hashSha256('hello');
+      const c = service.hashSha256('world');
+      expect(a).toBe(b);
+      expect(a).not.toBe(c);
+      expect(a).toMatch(/^[A-Za-z0-9_-]+$/);
+    });
+  });
+
+  describe('hashWithPepper', () => {
+    it('peppers the value before hashing', () => {
+      const { service } = makeService({ PEPPER: 'p' });
+      const expected = service.hashSha256('valuep');
+      expect(service.hashWithPepper('value')).toBe(expected);
+    });
+  });
+
+  describe('signHmacSha256 / verifyHmacSha256', () => {
+    it('verifies a signature produced with the default JWT secret', () => {
+      const { service } = makeService({ JWT_SECRET: 'jwt-secret' });
+      const sig = service.signHmacSha256('payload');
+      expect(service.verifyHmacSha256('payload', sig)).toBe(true);
+    });
+
+    it('rejects a tampered signature', () => {
+      const { service } = makeService({ JWT_SECRET: 'jwt-secret' });
+      const sig = service.signHmacSha256('payload');
+      expect(service.verifyHmacSha256('other-payload', sig)).toBe(false);
+    });
+
+    it('rejects an empty signature without throwing', () => {
+      const { service } = makeService({ JWT_SECRET: 'jwt-secret' });
+      expect(service.verifyHmacSha256('payload', '')).toBe(false);
+    });
+
+    it('honors an explicit signing secret', () => {
+      const { service } = makeService({ JWT_SECRET: 'jwt-secret' });
+      const sig = service.signHmacSha256('payload', 'other-secret');
+      expect(service.verifyHmacSha256('payload', sig, 'other-secret')).toBe(true);
+      // wrong secret -> mismatch
+      expect(service.verifyHmacSha256('payload', sig)).toBe(false);
+    });
+
+    it('returns false on a length mismatch instead of throwing', () => {
+      const { service } = makeService({ JWT_SECRET: 'jwt-secret' });
+      expect(service.verifyHmacSha256('payload', 'short')).toBe(false);
+    });
+  });
+
+  describe('encrypt / decrypt', () => {
+    it('round-trips using an explicit secret', () => {
+      const { service } = makeService();
+      const cipher = service.encrypt('super secret', 'the-key');
+      expect(cipher.split(':')).toHaveLength(4);
+      expect(service.decrypt(cipher, 'the-key')).toBe('super secret');
+    });
+
+    it('round-trips using the configured ENCRYPTION_SECRET', () => {
+      const { service } = makeService({ ENCRYPTION_SECRET: 'env-key' });
+      const cipher = service.encrypt('payload');
+      expect(service.decrypt(cipher)).toBe('payload');
+    });
+
+    it('throws when no encryption secret is configured', () => {
+      const { service } = makeService();
+      expect(() => service.encrypt('payload')).toThrow(
+        'ENCRYPTION_SECRET is not configured.',
+      );
+    });
+
+    it('throws on a malformed ciphertext', () => {
+      const { service } = makeService();
+      expect(() => service.decrypt('not-valid', 'the-key')).toThrow(
+        /Failed to decrypt value/,
+      );
+    });
+
+    it('throws when decrypting with the wrong secret', () => {
+      const { service } = makeService();
+      const cipher = service.encrypt('payload', 'right-key');
+      expect(() => service.decrypt(cipher, 'wrong-key')).toThrow(
+        /Failed to decrypt value/,
+      );
+    });
+  });
+
+  describe('validatePassword', () => {
+    it('returns true when one of the credentials verifies', async () => {
+      const { service } = makeService({ PEPPER: 'p' });
+      (argon2.verify as jest.Mock)
+        .mockResolvedValueOnce(false as never)
+        .mockResolvedValueOnce(true as never);
+
+      const result = await service.validatePassword(
+        'en',
+        [{ hash: 'h1' }, { hash: 'h2' }],
+        'pw',
+      );
+
+      expect(result).toBe(true);
+      expect(argon2.verify).toHaveBeenCalledWith('h1', 'pwp');
+    });
+
+    it('returns false when no credential verifies', async () => {
+      const { service } = makeService();
+      (argon2.verify as jest.Mock).mockResolvedValue(false as never);
+
+      const result = await service.validatePassword('en', [{ hash: 'h1' }], 'pw');
+
+      expect(result).toBe(false);
+    });
+
+    it('throws BadRequestException when verification errors', async () => {
+      const { service } = makeService();
+      (argon2.verify as jest.Mock).mockRejectedValue(new Error('boom') as never);
+
+      await expect(
+        service.validatePassword('en', [{ hash: 'h1' }], 'pw'),
+      ).rejects.toThrow(BadRequestException);
+    });
+  });
+
+  describe('verifyArgon2', () => {
+    it('returns true when argon2 verifies', async () => {
+      const { service } = makeService();
+      (argon2.verify as jest.Mock).mockResolvedValue(true as never);
+      await expect(service.verifyArgon2('v', 'hash')).resolves.toBe(true);
+    });
+
+    it('returns false when argon2 throws', async () => {
+      const { service } = makeService();
+      (argon2.verify as jest.Mock).mockRejectedValue(new Error('bad') as never);
+      await expect(service.verifyArgon2('v', 'hash')).resolves.toBe(false);
+    });
+  });
+
+  describe('hashArgon2', () => {
+    it('hashes the peppered value', async () => {
+      const { service } = makeService({ PEPPER: 'p' });
+      (argon2.hash as jest.Mock).mockResolvedValue('hashed' as never);
+      const result = await service.hashArgon2('value');
+      expect(result).toBe('hashed');
+      expect(argon2.hash).toHaveBeenCalledWith('valuep');
+    });
+  });
+
+  describe('generateCode', () => {
+    it('produces a numeric code of the requested length', () => {
+      const { service } = makeService();
+      const code = service.generateCode(8);
+      expect(code).toHaveLength(8);
+      expect(code).toMatch(/^[0-9]+$/);
+    });
+
+    it('defaults to length 6 when given a falsy length', () => {
+      const { service } = makeService();
+      expect(service.generateCode(0)).toHaveLength(6);
+    });
+  });
+
+  describe('randomOpaque', () => {
+    it('produces distinct url-safe tokens', () => {
+      const { service } = makeService();
+      const a = service.randomOpaque();
+      const b = service.randomOpaque();
+      expect(a).not.toBe(b);
+      expect(a).toMatch(/^[A-Za-z0-9_-]+$/);
+    });
+  });
+});

package/src/setting/setting.service.ts

@@ -116,10 +116,22 @@ export class SettingService implements OnModuleInit, OnModuleDestroy {
       this.lastRedisPublisherErrorLogAt = now;
     }
 
-    const message = error instanceof Error ? error.message : String(error);
+    const message = this.extractRedisErrorMessage(error);
     this.logger.warn(`Redis settings ${kind} error: ${message}`);
   }
 
+  private extractRedisErrorMessage(error: unknown): string {
+    if (error instanceof AggregateError && error.errors?.length) {
+      return error.errors
+        .map((e) => (e instanceof Error ? e.message || e.toString() : String(e)))
+        .join('; ');
+    }
+    if (error instanceof Error) {
+      return error.message || error.toString();
+    }
+    return String(error);
+  }
+
   private async initializeRedisSync() {
     if (!this.redisUrl) {
       this.logger.log(
@@ -160,7 +172,7 @@ export class SettingService implements OnModuleInit, OnModuleDestroy {
       );
     } catch (error) {
       this.logger.warn(
-        `Failed to initialize Redis settings sync: ${error instanceof Error ? error.message : String(error)}`,
+        `Failed to initialize Redis settings sync: ${this.extractRedisErrorMessage(error)}`,
       );
 
       await Promise.allSettled([
@@ -477,6 +489,7 @@ export class SettingService implements OnModuleInit, OnModuleDestroy {
       'operations.comment-edit-window',
       'lms-video-conversion-enabled',
       'lms-video-frame-capture-interval-seconds',
+      'lms-error-modal-enabled',
       'url'
     ];
     const setting = await this.getSettingValues(slugs);

package/src/token/token.service.ts

@@ -68,7 +68,8 @@ export class TokenService {
     } catch (error) {
       const errName = (error as any)?.name ?? 'UnknownError';
       const errMsg = (error as any)?.message ?? '';
-      if (!(error instanceof UnauthorizedException)) {
+      // Token expirado é um evento rotineiro (cliente renova automaticamente); não polui o log.
+      if (!(error instanceof UnauthorizedException) && errName !== 'TokenExpiredError') {
         this.logger.debug(`[TokenVerify] JWT error=${errName}: ${errMsg}`);
       }
       // Return 401 for JWT errors (expired, invalid, etc.)

package/src/user/user.controller.ts

@@ -1,22 +1,22 @@
-import { Public, Role, User } from '@hed-hog/api';
+import { NoRole, Public, Role, User } from '@hed-hog/api';
 import { Locale } from '@hed-hog/api-locale';
 import { Pagination } from '@hed-hog/api-pagination';
 import {
-    BadRequestException,
-    Body,
-    Controller,
-    Delete,
-    Get,
-    Inject,
-    Param,
-    ParseIntPipe,
-    Patch,
-    Post,
-    Req,
-    Res,
-    UploadedFile,
-    UseInterceptors,
-    forwardRef,
+  BadRequestException,
+  Body,
+  Controller,
+  Delete,
+  Get,
+  Inject,
+  Param,
+  ParseIntPipe,
+  Patch,
+  Post,
+  Req,
+  Res,
+  UploadedFile,
+  UseInterceptors,
+  forwardRef,
 } from '@nestjs/common';
 import { FileInterceptor } from '@nestjs/platform-express';
 import { Request } from 'express';
@@ -135,6 +135,16 @@ export class UserController {
     return this.userService.getUserRoutes(locale, userId);
   }
 
+  @NoRole()
+  @Get('me/activity')
+  async listMyActivities(
+    @User() { id }: { id: number },
+    @Pagination() paginationParams,
+    @Locale() locale: string,
+  ) {
+    return this.userService.listUserActivities(locale, id, paginationParams);
+  }
+
   @Get(':userId/log')
   async listLogs(
     @Param('userId', ParseIntPipe) userId: number,

package/src/user/user.service.ts

@@ -749,6 +749,31 @@ export class UserService {
     };
   }
 
+  async listUserActivities(locale: string, userId: number, paginationParams) {
+    await this.validateUserExists(locale, userId);
+
+    const paginated = await this.paginationService.paginatePrismaModel(
+      this.prismaService.user_activity,
+      {
+        page: paginationParams?.page,
+        pageSize: paginationParams?.pageSize,
+        sortField: paginationParams?.sortField || 'created_at',
+        sortOrder: paginationParams?.sortOrder || 'desc',
+        validSortFields: ['id', 'created_at', 'action'],
+        where: { user_id: userId },
+      },
+    );
+
+    return {
+      ...paginated,
+      data: (paginated.data || []).map((activity: any) => ({
+        id: String(activity.id),
+        action: activity.action,
+        createdAt: activity.created_at?.toISOString?.() || null,
+      })),
+    };
+  }
+
   // ==========================================
   // Private Helper Methods
   // ==========================================

package/src/utils/webauthn-origin.ts

@@ -0,0 +1,38 @@
+function normalizeOrigin(value?: string | null): string | null {
+  const trimmed = String(value ?? '').trim().replace(/\/+$/, '');
+  if (!trimmed) return null;
+
+  try {
+    return new URL(trimmed).origin;
+  } catch {
+    return null;
+  }
+}
+
+function getAllowedOrigins(): string[] {
+  return (process.env.CORS_ALLOWED_ORIGINS ?? '')
+    .split(/[\n,;]+/)
+    .map((url) => normalizeOrigin(url))
+    .filter((url): url is string => Boolean(url));
+}
+
+/**
+ * WebAuthn binds a credential to the exact origin (scheme + host + port) used
+ * during registration/authentication. With multiple frontends (e.g. admin on
+ * :3200, training on :3001) sharing the same backend, the relying party origin
+ * must follow the requesting browser, not a single hardcoded CORS entry.
+ */
+export function resolveWebAuthnOrigin(requestOrigin?: string | null): {
+  rpID: string;
+  expectedOrigin: string;
+} {
+  const allowedOrigins = getAllowedOrigins();
+  const normalizedRequestOrigin = normalizeOrigin(requestOrigin);
+
+  const expectedOrigin =
+    (normalizedRequestOrigin && allowedOrigins.includes(normalizedRequestOrigin)
+      ? normalizedRequestOrigin
+      : allowedOrigins[0]) ?? 'http://localhost:3200';
+
+  return { rpID: new URL(expectedOrigin).hostname, expectedOrigin };
+}

package/src/webhook-integration/webhook-integration.controller.ts

@@ -129,6 +129,14 @@ export class WebhookIntegrationController {
   ) {
     return this.service.streamLogs(id, res);
   }
+
+  @Post(':id/log/:logId/retry')
+  retryLog(
+    @Param('id', ParseIntPipe) id: number,
+    @Param('logId', ParseIntPipe) logId: number,
+  ) {
+    return this.service.retryCall(id, logId);
+  }
 }
 
 @Public()
@@ -145,5 +153,20 @@ export class PublicWebhookController {
   ) {
     return this.service.executePublic(uuid, body, headers, req);
   }
+
+  /**
+   * GET variant so a webhook can be triggered by a plain clickable link (e.g.
+   * approve/reject links sent by email/WhatsApp). Query params are used as the
+   * payload for action templates (`{{body.decision}}` ← `?decision=approve`).
+   */
+  @Get(':uuid')
+  executeGet(
+    @Param('uuid') uuid: string,
+    @Query() query: any,
+    @Headers() headers: any,
+    @Req() req: Request,
+  ) {
+    return this.service.executePublic(uuid, query ?? {}, headers, req);
+  }
 }
 

package/src/webhook-integration/webhook-integration.module.ts

@@ -3,6 +3,7 @@ import { PaginationModule } from '@hed-hog/api-pagination';
 import { PrismaModule } from '@hed-hog/api-prisma';
 import { HttpModule } from '@nestjs/axios';
 import { Module, forwardRef } from '@nestjs/common';
+import { AppCommandModule } from '../app-command/app-command.module';
 import { IntegrationModule } from '../integration/integration.module';
 import { MailModule } from '../mail/mail.module';
 import { McpModule } from '../mcp/mcp.module';
@@ -10,7 +11,6 @@ import { EventWebhookController } from './event-webhook.controller';
 import { EventWebhookService } from './event-webhook.service';
 import { IntegrationEventCatalogController } from './integration-event-catalog.controller';
 import { IntegrationEventCatalogService } from './integration-event-catalog.service';
-import { WebhookCommandRegistry } from './webhook-command.registry';
 import {
   PublicWebhookController,
   WebhookIntegrationController,
@@ -26,6 +26,7 @@ import { WebhookIntegrationService } from './webhook-integration.service';
     forwardRef(() => MailModule),
     forwardRef(() => MailMainModule),
     forwardRef(() => McpModule),
+    AppCommandModule,
   ],
   controllers: [
     IntegrationEventCatalogController,
@@ -35,13 +36,12 @@ import { WebhookIntegrationService } from './webhook-integration.service';
   ],
   providers: [
     IntegrationEventCatalogService,
-    WebhookCommandRegistry,
     WebhookIntegrationService,
     EventWebhookService,
   ],
   exports: [
     IntegrationEventCatalogService,
-    WebhookCommandRegistry,
+    AppCommandModule,
     WebhookIntegrationService,
     EventWebhookService,
   ],