@hed-hog/core 0.0.370 → 0.0.373

package/package.json

@@ -1,12 +1,14 @@
 {
   "name": "@hed-hog/core",
-  "version": "0.0.370",
+  "version": "0.0.373",
+  "license": "MIT",
   "main": "dist/index.js",
   "types": "dist/index.d.ts",
   "dependencies": {
     "@aws-sdk/client-lambda": "3.1014.0",
     "@aws-sdk/client-s3": "^3.1014.0",
     "@aws-sdk/client-sts": "3.1014.0",
+    "@aws-sdk/lib-storage": "3.1014.0",
     "@aws-sdk/s3-request-presigner": "^3.1014.0",
     "@azure/storage-blob": "^12.27.0",
     "@google-cloud/storage": "^7.16.0",
@@ -19,6 +21,7 @@
     "@nestjs/jwt": "^11",
     "@nestjs/mapped-types": "*",
     "@nestjs/schedule": "^6.0.1",
+    "@nestjs/throttler": "^6.4.0",
     "@simplewebauthn/server": "^13.2.2",
     "argon2": "^0.44.0",
     "axios": "^1.9.0",
@@ -40,10 +43,10 @@
     "uuid": "^11.1.0",
     "@hed-hog/api": "0.0.8",
     "@hed-hog/api-locale": "0.0.14",
+    "@hed-hog/api-mail": "0.0.9",
     "@hed-hog/api-pagination": "0.0.7",
-    "@hed-hog/api-prisma": "0.0.6",
     "@hed-hog/api-types": "0.0.1",
-    "@hed-hog/api-mail": "0.0.9"
+    "@hed-hog/api-prisma": "0.0.6"
   },
   "exports": {
     ".": {
@@ -85,10 +88,12 @@
   "scripts": {
     "_dev": "pnpm build --watch",
     "lint": "eslint \"{src,apps,libs,test}/**/*.ts\"",
+    "test": "jest --config jest.config.ts --runInBand --passWithNoTests",
     "clean": "rimraf dist tsconfig.production.tsbuildinfo",
     "prebuild": "pnpm run clean && pnpm --dir ../.. exec ts-node ./scripts/build-dependencies.ts libraries/core",
-    "build": "tsc --project tsconfig.production.json && pnpm run copy:templates",
+    "build": "tsc --project tsconfig.production.json && pnpm run copy:templates && pnpm run copy:language",
     "copy:templates": "node -e \"require('fs').cpSync('src/file/templates', 'dist/file/templates', {recursive: true})\"",
+    "copy:language": "node -e \"const fs=require('fs');if(fs.existsSync('src/language'))fs.cpSync('src/language','dist/language',{recursive:true})\"",
     "patch": "pnpm exec ts-node ../../scripts/patch.ts libraries/core",
     "prod": "pnpm run patch && pnpm run build && pnpm publish --access public --no-git-checks"
   }

package/src/ai/ai.service.ts

@@ -62,7 +62,10 @@ export class AiService implements OnModuleInit {
         'ai-openai-profile-id',
         'ai-gemini-profile-id',
       ]);
-      if (!Number(s['ai-openai-profile-id']) && !Number(s['ai-gemini-profile-id'])) {
+      if (
+        !String(s['ai-openai-profile-id'] ?? '').trim() &&
+        !String(s['ai-gemini-profile-id'] ?? '').trim()
+      ) {
         this.logger.warn('No AI profiles configured. Set profiles in Settings → AI.');
       }
     } catch { /* settings not available yet */ }
@@ -442,21 +445,21 @@ export class AiService implements OnModuleInit {
   private async getAiApiKey(provider: AiProvider): Promise<string> {
     const slug = provider === 'openai' ? 'ai-openai-profile-id' : 'ai-gemini-profile-id';
     const settings = await this.settingService.getSettingValues([slug]);
-    const profileId = Number(settings[slug]);
+    const profileSlug = String(settings[slug] ?? '').trim();
 
-    if (!profileId) {
+    if (!profileSlug) {
       throw new BadRequestException(
         `No ${provider} AI profile configured. Set one in Settings → AI.`,
       );
     }
 
     const profile = await this.prismaService.integration_profile.findUnique({
-      where: { id: profileId },
+      where: { slug: profileSlug },
       include: { integration_provider: { select: { slug: true } } },
     });
 
     if (!profile) {
-      throw new BadRequestException(`AI profile ${profileId} not found.`);
+      throw new BadRequestException(`AI profile "${profileSlug}" not found.`);
     }
 
     const { apiKey } = buildAiConfigFromIntegration(
@@ -465,7 +468,7 @@ export class AiService implements OnModuleInit {
     );
 
     if (!apiKey) {
-      throw new BadRequestException(`AI profile ${profileId} has no API key configured.`);
+      throw new BadRequestException(`AI profile "${profileSlug}" has no API key configured.`);
     }
 
     return apiKey;

package/src/app-command/app-command.module.ts

@@ -0,0 +1,9 @@
+import { Global, Module } from '@nestjs/common';
+import { AppCommandRegistry } from './app-command.registry';
+
+@Global()
+@Module({
+  providers: [AppCommandRegistry],
+  exports: [AppCommandRegistry],
+})
+export class AppCommandModule {}

package/src/{webhook-integration/webhook-command.registry.ts → app-command/app-command.registry.ts}

@@ -1,6 +1,6 @@
 import { Injectable } from '@nestjs/common';
 
-export interface WebhookCommandContext extends Record<string, unknown> {
+export interface AppCommandContext extends Record<string, unknown> {
   webhookBody?: unknown;
   webhookHeaders?: Record<string, unknown>;
   remoteIp?: string | null;
@@ -8,37 +8,37 @@ export interface WebhookCommandContext extends Record<string, unknown> {
   integrationId?: number;
 }
 
-export interface WebhookCommand {
+export interface AppCommand {
   slug: string;
   name: string;
   description: string;
   inputSchema: Record<string, unknown>;
   handler: (
     params: Record<string, unknown>,
-    context?: WebhookCommandContext,
+    context?: AppCommandContext,
   ) => Promise<unknown>;
 }
 
 @Injectable()
-export class WebhookCommandRegistry {
-  private readonly commands = new Map<string, WebhookCommand>();
+export class AppCommandRegistry {
+  private readonly commands = new Map<string, AppCommand>();
 
-  register(command: WebhookCommand): void {
+  register(command: AppCommand): void {
     this.commands.set(command.slug, command);
   }
 
-  find(slug: string): WebhookCommand | undefined {
+  find(slug: string): AppCommand | undefined {
     return this.commands.get(slug);
   }
 
-  list(): WebhookCommand[] {
+  list(): AppCommand[] {
     return Array.from(this.commands.values());
   }
 
   async dispatch(
     slug: string,
     params: Record<string, unknown>,
-    context?: WebhookCommandContext,
+    context?: AppCommandContext,
   ): Promise<unknown> {
     const command = this.find(slug);
     if (!command) {

package/src/auth/auth.controller.ts

@@ -12,8 +12,10 @@ import {
   Post,
   Req,
   Res,
-  UnauthorizedException
+  UnauthorizedException,
+  UseGuards
 } from '@nestjs/common';
+import { Throttle, ThrottlerGuard } from '@nestjs/throttler';
 import { TokenService } from '../token/token.service';
 import { CreateWithEmailAndPasswordDTO } from '../user/dto/create-with-email-and-password.dto';
 import { UserService } from '../user/user.service';
@@ -87,7 +89,11 @@ export class AuthController {
     };
   }
 
+  // Rate-limit contra brute-force de credenciais: 10 tentativas/min por IP
+  // (ajustável; valor acomoda a suíte E2E de auth que faz vários logins seguidos).
   @Public()
+  @UseGuards(ThrottlerGuard)
+  @Throttle({ default: { limit: 10, ttl: 60_000 } })
   @Post('login')
   async login(
     @Locale() locale: string,
@@ -101,6 +107,8 @@ export class AuthController {
   }
 
   @Public()
+  @UseGuards(ThrottlerGuard)
+  @Throttle({ default: { limit: 10, ttl: 60_000 } })
   @Post('login-email-verification')
   async emailVerificationLogin(
     @Locale() locale: string,
@@ -132,6 +140,8 @@ export class AuthController {
   }
 
   @Public()
+  @UseGuards(ThrottlerGuard)
+  @Throttle({ default: { limit: 10, ttl: 60_000 } })
   @Post('login-code')
   async loginCode(
     @Locale() locale: string,
@@ -156,6 +166,8 @@ export class AuthController {
   }
 
   @Public()
+  @UseGuards(ThrottlerGuard)
+  @Throttle({ default: { limit: 10, ttl: 60_000 } })
   @Post('login-recovery-code')
   async loginRecoveryCode(
     @Locale() locale: string,
@@ -191,9 +203,10 @@ export class AuthController {
   @Post('webauthn/generate')
   async generateWebAuthnOptions(
     @Locale() locale: string,
-    @Body() { mfaToken }: { mfaToken: string }
+    @Body() { mfaToken }: { mfaToken: string },
+    @Headers('origin') origin: string
   ) {
-    return this.service.generateWebAuthnAuthenticationOptions(locale, mfaToken);
+    return this.service.generateWebAuthnAuthenticationOptions(locale, mfaToken, origin);
   }
 
   @Public()
@@ -203,6 +216,7 @@ export class AuthController {
     @Body() { mfaToken, assertionResponse }: { mfaToken: string; assertionResponse: any },
     @Ip() ipAddress: string,
     @Headers('user-agent') userAgent: string,
+    @Headers('origin') origin: string,
     @Res({ passthrough: true }) res,
   ) {
     const { accessToken, refreshToken, session, requiresPasswordReset } = await this.service.verifyWebAuthnAuthentication(
@@ -210,7 +224,9 @@ export class AuthController {
       mfaToken,
       assertionResponse,
       ipAddress,
-      userAgent
+      userAgent,
+      undefined,
+      origin,
     );
 
     await this.token.setRefreshTokenCookie(locale, res, refreshToken, session.expires_at);

package/src/auth/auth.service.ts

@@ -17,6 +17,7 @@ import { SessionService } from '../session/session.service';
 import { SettingService } from '../setting/setting.service';
 import { TokenService } from '../token/token.service';
 import { UserService } from '../user/user.service';
+import { resolveWebAuthnOrigin } from '../utils/webauthn-origin';
 import { ForgetDTO } from './dto/forget.dto';
 import { LoginDTO } from './dto/login.dto';
 
@@ -508,12 +509,12 @@ export class AuthService {
 
   }
 
-  async forgotPassword(locale: string, { email }: ForgetDTO) {
+  async forgotPassword(locale: string, { email, app }: ForgetDTO) {
     const user = await this.user.findUserByEmail(locale, email);
     if (user){
       await this.user.registerUserActivity(user?.id, "forgotPassword")
     }
-    await this.challenge.forgotEmail(locale, email);
+    await this.challenge.forgotEmail(locale, email, app);
     return { success: true };
   }
 
@@ -530,41 +531,17 @@ export class AuthService {
 
   async forgotResetPassword(locale: string, password: string, code: string, ipAddress: string, userAgent: string) {
     const challenge = await this.challenge.verifyCodePassword(locale, code);
+    const userIdentifier = challenge.user_identifier;
     const passwordHash = await this.security.hashArgon2(password);
 
     await this.prisma.user_credential.updateMany({
       where: {
         type: 'password',
-        user: {
-          user_mfa: {
-            some: {
-              user_mfa_challenge: {
-                some: { id: challenge.id }
-              }
-            }
-          }
-        }
+        user_id: userIdentifier.user_id,
       },
       data: { hash: passwordHash, requires_reset: false },
     });
 
-    const userIdentifier = await this.prisma.user_identifier.findFirst({
-      where: {
-        type: 'email',
-        user_id: challenge.user_mfa.user_id,
-        enabled: true
-      },
-      include: {
-        user: {
-          select: { name: true }
-        }
-      }
-    });
-
-    if (!userIdentifier) {
-      throw new BadRequestException(getLocaleText('userIdentifierNotFound', locale, 'User identifier not found.'));
-    }
-
     this.mail.sendTemplatedMail(
       locale,
       {
@@ -576,7 +553,7 @@ export class AuthService {
       }
     );
 
-    const { accessToken, refreshToken, session } = await this.getAuthenticationPayload(locale, challenge.user_mfa.user_id, ipAddress, userAgent);
+    const { accessToken, refreshToken, session } = await this.getAuthenticationPayload(locale, userIdentifier.user_id, ipAddress, userAgent);
     await this.user.registerUserActivity(userIdentifier.id, "resetPassword")
     return { accessToken, refreshToken, session }
   }
@@ -780,7 +757,7 @@ export class AuthService {
     };
   }
 
-  async generateWebAuthnAuthenticationOptions(locale: string, mfaToken: string) {
+  async generateWebAuthnAuthenticationOptions(locale: string, mfaToken: string, requestOrigin?: string) {
     const { generateAuthenticationOptions } = await import('@simplewebauthn/server');
     const payload = await this.token.verifyMfaChallengeToken(mfaToken);
 
@@ -798,8 +775,7 @@ export class AuthService {
       throw new BadRequestException(getLocaleText('webauthnNotConfigured', locale, 'WebAuthn not configured.'));
     }
 
-    const primaryOrigin = (process.env.CORS_ALLOWED_ORIGINS ?? '').split(/[\n,;]+/).map(u => u.trim()).filter(Boolean)[0] ?? 'http://localhost:3200';
-    const rpID = new URL(primaryOrigin).hostname;
+    const { rpID } = resolveWebAuthnOrigin(requestOrigin);
 
     const allowCredentials = user.user_mfa
       .filter(mfa => mfa.user_mfa_webauthn && mfa.user_mfa_webauthn.length > 0)
@@ -825,7 +801,7 @@ export class AuthService {
     return options;
   }
 
-  async verifyWebAuthnAuthentication(locale: string, mfaToken: string, assertionResponse: any, ipAddress: string, userAgent: string, browserId?: string | null) {
+  async verifyWebAuthnAuthentication(locale: string, mfaToken: string, assertionResponse: any, ipAddress: string, userAgent: string, browserId?: string | null, requestOrigin?: string) {
     const { verifyAuthenticationResponse } = await import('@simplewebauthn/server');
     const payload = await this.token.verifyMfaChallengeToken(mfaToken);
     const userId = payload.userId;
@@ -853,9 +829,7 @@ export class AuthService {
     }
 
     const authenticator = challengeRecord.user_mfa.user_mfa_webauthn[0];
-    const primaryOrigin = (process.env.CORS_ALLOWED_ORIGINS ?? '').split(/[\n,;]+/).map(u => u.trim()).filter(Boolean)[0] ?? 'http://localhost:3200';
-    const rpID = new URL(primaryOrigin).hostname;
-    const expectedOrigin = primaryOrigin;
+    const { rpID, expectedOrigin } = resolveWebAuthnOrigin(requestOrigin);
 
     const verification = await verifyAuthenticationResponse({
       response: assertionResponse,

package/src/auth/dto/forget.dto.ts

@@ -1,5 +1,5 @@
 import { getLocaleText } from '@hed-hog/api-locale';
-import { IsNotEmpty } from 'class-validator';
+import { IsNotEmpty, IsOptional, IsString } from 'class-validator';
 import { IsEmailWithSettings } from '../../validators/is-email-with-settings.validator';
 
 export class ForgetDTO {
@@ -12,4 +12,8 @@ export class ForgetDTO {
     return this._email;
   }
   private _email: string;
+
+  @IsOptional()
+  @IsString()
+  app?: string;
 }

package/src/auth/guards/auth.guard.ts

@@ -83,7 +83,10 @@ export class AuthGuard implements CanActivate {
       } else {
         const errName = (error as any)?.name ?? 'UnknownError';
         const message = (error as any)?.message || errName || 'Unauthorized';
-        this.logger.warn(`[AuthGuard] Token rejected ${request.method} ${request.url} error=${errName}: ${message}`);
+        // Token expirado é rotineiro (cliente renova); só alerta para rejeições genuínas.
+        if (!/expired/i.test(message)) {
+          this.logger.warn(`[AuthGuard] Token rejected ${request.method} ${request.url} error=${errName}: ${message}`);
+        }
         throw new UnauthorizedException(message);
       }
     }

package/src/challenge/challenge.service.ts

@@ -185,13 +185,12 @@ export class ChallengeService {
     return { codeHash };
   }
 
-  async forgotEmail(locale: string, email: string) {
-    const openChallengesCount = await this.prisma.user_mfa_challenge.count({
+  async forgotEmail(locale: string, email: string, app?: string) {
+    const openChallengesCount = await this.prisma.user_identifier_challenge.count({
       where: {
-        user_mfa: {
-          user_mfa_email: {
-            some: { email }
-          }
+        user_identifier: {
+          type: 'email',
+          value: email,
         },
         expires_at: { gt: new Date() }
       }
@@ -201,27 +200,26 @@ export class ChallengeService {
       throw new BadRequestException(getLocaleText('forgot.rateLimit', locale, 'Too many password reset requests. Please try again later.'));
     }
 
-    const userMfaEmail = await this.prisma.user_mfa_email.findFirst({
-      where: { email },
-      include: {
-        user_mfa: { include: { user: true } },
-      },
+    const userIdentifier = await this.prisma.user_identifier.findFirst({
+      where: { type: 'email', value: email, enabled: true },
+      include: { user: true },
     });
 
-    if (!userMfaEmail) throw new BadRequestException(getLocaleText('forgot.userNotFound', locale, 'User not found'));
+    if (!userIdentifier) throw new BadRequestException(getLocaleText('forgot.userNotFound', locale, 'User not found'));
 
     const settings = await this.setting.getSettingValues([
       'mfa-challenge-expiration-minutes',
-      'url'
+      'url',
+      'app-urls'
     ]);
 
     const token = await this.token.createOpaqueToken(16);
     const hash = this.security.hashWithPepper(token);
-    const challenge = await this.prisma.user_mfa_challenge.create({
+    const challenge = await this.prisma.user_identifier_challenge.create({
       data: {
         hash,
         expires_at: new Date(Date.now() + (settings['mfa-challenge-expiration-minutes'] || 15) * 60000),
-        user_mfa_id: userMfaEmail.user_mfa_id,
+        user_identifier_id: userIdentifier.id,
       },
     });
 
@@ -232,8 +230,8 @@ export class ChallengeService {
         email,
         slug: 'auth-forget-password',
         variables: {
-          link: `${settings['url']}/reset-password?token=${tokenBase64}`,
-          name: userMfaEmail.user_mfa.user.name,
+          link: `${this.resolveAppUrl(settings, app)}/reset-password?token=${tokenBase64}`,
+          name: userIdentifier.user.name,
         }
       }
     );
@@ -241,15 +239,28 @@ export class ChallengeService {
     return challenge;
   }
 
+  private resolveAppUrl(settings: Record<string, any>, app?: string): string {
+    const appUrls: string[] = Array.isArray(settings['app-urls']) ? settings['app-urls'] : [];
+
+    if (app) {
+      const entry = appUrls.find((item) => item.split('=')[0]?.trim() === app);
+      if (entry) {
+        return entry.slice(entry.indexOf('=') + 1).trim();
+      }
+    }
+
+    return settings['url'];
+  }
+
   async verifyCodePassword(locale: string, code: string) {
     const hash = this.security.hashWithPepper(code);
-    const challenge = await this.prisma.user_mfa_challenge.findFirst({
+    const challenge = await this.prisma.user_identifier_challenge.findFirst({
       where: {
         hash,
         expires_at: { gt: new Date() }
       },
       include: {
-        user_mfa: { include: { user: true } },
+        user_identifier: { include: { user: true } },
       },
     });
 

package/src/file/dto/upload.dto.ts

@@ -1,8 +1,32 @@
 import { getLocaleText } from '@hed-hog/api-locale';
-import { IsOptional, IsString } from 'class-validator';
+import { Type } from 'class-transformer';
+import { IsInt, IsOptional, IsString, Max, Min } from 'class-validator';
 
 export class UploadFileDTO {
   @IsString({ message: (args) => getLocaleText('validation.stringRequired', args.value) })
   @IsOptional()
   destination?: string;
+
+  // Optional informational tag for the kind of image being uploaded
+  // (e.g. "course-banner", "course-logo", "course-square").
+  @IsString()
+  @IsOptional()
+  imageType?: string;
+
+  // Target dimensions for a precise resize on upload. When provided, the image
+  // is resized to fit these bounds before compression/WebP conversion. Sent via
+  // multipart form fields, so they arrive as strings and are coerced to numbers.
+  @Type(() => Number)
+  @IsInt()
+  @Min(1)
+  @Max(8000)
+  @IsOptional()
+  maxWidth?: number;
+
+  @Type(() => Number)
+  @IsInt()
+  @Min(1)
+  @Max(8000)
+  @IsOptional()
+  maxHeight?: number;
 }

package/src/file/file.controller.ts

@@ -147,10 +147,32 @@ export class FileController {
     }
   }
 
+  @Public()
+  @Get('image/:id')
+  async openImage(
+    @Param('id', ParseIntPipe) id: number,
+    @Req() req: Request,
+    @Res() res: Response,
+    @Locale() locale: string,
+  ) {
+    try {
+      await this.fileService.serveImageById(
+        locale,
+        id,
+        req.headers['if-none-match'],
+        res,
+      );
+    } catch (error: any) {
+      const html = this.renderDownloadErrorHtml(locale, error);
+      res.status(400).set('Content-Type', 'text/html').send(html);
+    }
+  }
+
   @Public()
   @Get('open/:token')
   async open(
     @Param('token') token: string,
+    @Req() req: Request,
     @Res() res: Response,
     @Locale() locale: string,
   ) {
@@ -161,23 +183,12 @@ export class FileController {
       const isNumericId = Number.isInteger(numericId) && String(numericId) === token;
 
       if (isNumericId && numericId > 0) {
-        const { stream, filename, mimetype, size } =
-          await this.fileService.openById(locale, numericId);
-
-        const encodedFilename = encodeURIComponent(filename);
-
-        res.set({
-          'Content-Type': mimetype || 'application/octet-stream',
-          'Content-Disposition':
-            `inline; filename="${filename}"; ` +
-            `filename*=UTF-8''${encodedFilename}`,
-        });
-
-        if (typeof size === 'number') {
-          res.set('Content-Length', `${size}`);
-        }
-
-        stream.pipe(res);
+        await this.fileService.serveFileById(
+          locale,
+          numericId,
+          req.headers['if-none-match'],
+          res,
+        );
         return;
       }
 
@@ -215,7 +226,9 @@ export class FileController {
     @Body() body: UploadFileDTO,
   ) {
     const destination = body.destination || 'files';
-    return this.fileService.upload(destination, file);
+    const maxWidth = Number(body.maxWidth) || undefined;
+    const maxHeight = Number(body.maxHeight) || undefined;
+    return this.fileService.upload(destination, file, { maxWidth, maxHeight });
   }
 
   @Delete()