@hed-hog/core 0.0.371 → 0.0.374

package/src/integration-profile/integration-credential-crypto.service.spec.ts

@@ -0,0 +1,289 @@
+import { describe, it, expect, jest, beforeEach, afterEach } from '@jest/globals';
+
+const registerIntegrationConfigTransformer = jest.fn();
+
+jest.mock('@hed-hog/api-prisma', () => ({
+  registerIntegrationConfigTransformer: (...args: any[]) =>
+    registerIntegrationConfigTransformer(...args),
+}));
+
+import {
+  IntegrationCredentialCryptoService,
+  ENC_ENVELOPE_PREFIX,
+  SECRET_MASK,
+} from './integration-credential-crypto.service';
+
+// Cifra reversível determinística (hex) usada como stub do SecurityService.
+const makeSecurity = () => ({
+  encrypt: jest.fn((value: string) => Buffer.from(value, 'utf8').toString('hex')),
+  decrypt: jest.fn((value: string) => Buffer.from(value, 'hex').toString('utf8')),
+});
+
+const makeService = (security = makeSecurity()) => {
+  const service = new IntegrationCredentialCryptoService(security as any);
+  return { service, security };
+};
+
+describe('IntegrationCredentialCryptoService', () => {
+  afterEach(() => {
+    jest.clearAllMocks();
+  });
+
+  describe('onModuleInit', () => {
+    it('registra o transformer de decifra transparente', () => {
+      const { service } = makeService();
+      service.onModuleInit();
+      expect(registerIntegrationConfigTransformer).toHaveBeenCalledTimes(1);
+      expect(registerIntegrationConfigTransformer).toHaveBeenCalledWith(
+        expect.any(Function),
+      );
+    });
+
+    it('o transformer registrado delega para decryptConfig', () => {
+      const { service } = makeService();
+      const spy = jest
+        .spyOn(service, 'decryptConfig')
+        .mockReturnValue({ ok: true } as any);
+      service.onModuleInit();
+      const transformer = registerIntegrationConfigTransformer.mock
+        .calls[0][0] as (c: any) => any;
+      const out = transformer({ some: 'config' });
+      expect(spy).toHaveBeenCalledWith({ some: 'config' });
+      expect(out).toEqual({ ok: true });
+    });
+  });
+
+  describe('isEnveloped', () => {
+    it('true apenas para strings com o prefixo do envelope', () => {
+      const { service } = makeService();
+      const isEnveloped = (v: unknown) => (service as any).isEnveloped(v);
+      expect(isEnveloped(`${ENC_ENVELOPE_PREFIX}abc`)).toBe(true);
+      expect(isEnveloped('abc')).toBe(false);
+      expect(isEnveloped(123)).toBe(false);
+      expect(isEnveloped(null)).toBe(false);
+      expect(isEnveloped(undefined)).toBe(false);
+      expect(isEnveloped({})).toBe(false);
+    });
+  });
+
+  describe('encryptValue', () => {
+    it('cifra um valor simples com o envelope', () => {
+      const { service, security } = makeService();
+      const out = service.encryptValue('hello');
+      expect(out.startsWith(ENC_ENVELOPE_PREFIX)).toBe(true);
+      expect(security.encrypt).toHaveBeenCalledWith('hello');
+      expect(out).toBe(ENC_ENVELOPE_PREFIX + Buffer.from('hello').toString('hex'));
+    });
+
+    it('é idempotente: não recifra um valor já com envelope', () => {
+      const { service, security } = makeService();
+      const already = `${ENC_ENVELOPE_PREFIX}deadbeef`;
+      expect(service.encryptValue(already)).toBe(already);
+      expect(security.encrypt).not.toHaveBeenCalled();
+    });
+  });
+
+  describe('decryptValue', () => {
+    it('decifra um valor com envelope', () => {
+      const { service, security } = makeService();
+      const enveloped = ENC_ENVELOPE_PREFIX + Buffer.from('secret').toString('hex');
+      expect(service.decryptValue(enveloped)).toBe('secret');
+      expect(security.decrypt).toHaveBeenCalledWith(
+        Buffer.from('secret').toString('hex'),
+      );
+    });
+
+    it('passa valores sem envelope intactos (legado)', () => {
+      const { service, security } = makeService();
+      expect(service.decryptValue('plain-legacy')).toBe('plain-legacy');
+      expect(service.decryptValue(42)).toBe(42);
+      expect(service.decryptValue(null)).toBe(null);
+      expect(security.decrypt).not.toHaveBeenCalled();
+    });
+
+    it('em erro de decifra loga e devolve o valor como veio (não derruba a query)', () => {
+      const security = makeSecurity();
+      security.decrypt.mockImplementation(() => {
+        throw new Error('ENCRYPTION_SECRET trocado');
+      });
+      const { service } = makeService(security);
+      const enveloped = `${ENC_ENVELOPE_PREFIX}whatever`;
+      const errSpy = jest
+        .spyOn((service as any).logger, 'error')
+        .mockImplementation(() => undefined);
+      expect(service.decryptValue(enveloped)).toBe(enveloped);
+      expect(errSpy).toHaveBeenCalled();
+    });
+  });
+
+  describe('round-trip', () => {
+    it('encryptValue -> decryptValue devolve o valor original', () => {
+      const { service } = makeService();
+      const original = 'sk-live-1234567890';
+      expect(service.decryptValue(service.encryptValue(original))).toBe(original);
+    });
+  });
+
+  describe('encryptConfig', () => {
+    it('cifra apenas as chaves sensíveis do provider', () => {
+      const { service } = makeService();
+      const out = service.encryptConfig('stripe', {
+        secret_key: 'sk_test',
+        webhook_secret: 'whsec',
+        public_key: 'pk_test',
+      }) as Record<string, string>;
+      expect(out.secret_key.startsWith(ENC_ENVELOPE_PREFIX)).toBe(true);
+      expect(out.webhook_secret.startsWith(ENC_ENVELOPE_PREFIX)).toBe(true);
+      // Campo público não é tocado.
+      expect(out.public_key).toBe('pk_test');
+    });
+
+    it('ignora valores vazios e não-string', () => {
+      const { service } = makeService();
+      const out = service.encryptConfig('smtp', {
+        password: '',
+      }) as Record<string, string>;
+      expect(out.password).toBe('');
+    });
+
+    it('provider desconhecido retorna o config inalterado (mesma referência)', () => {
+      const { service } = makeService();
+      const config = { api_key: 'abc' };
+      expect(service.encryptConfig('does-not-exist', config)).toBe(config);
+    });
+
+    it('é case-insensitive no slug do provider', () => {
+      const { service } = makeService();
+      const out = service.encryptConfig('OpenAI', {
+        api_key: 'sk-abc',
+      }) as Record<string, string>;
+      expect(out.api_key.startsWith(ENC_ENVELOPE_PREFIX)).toBe(true);
+    });
+
+    it('config null/undefined passa intacto', () => {
+      const { service } = makeService();
+      expect(service.encryptConfig('stripe', null)).toBeNull();
+      expect(service.encryptConfig('stripe', undefined)).toBeUndefined();
+    });
+
+    it('é idempotente sobre valores já cifrados', () => {
+      const { service } = makeService();
+      const once = service.encryptConfig('openai', { api_key: 'sk-abc' }) as any;
+      const twice = service.encryptConfig('openai', once) as any;
+      expect(twice.api_key).toBe(once.api_key);
+    });
+  });
+
+  describe('decryptConfig', () => {
+    it('decifra as chaves com envelope e devolve novo objeto', () => {
+      const { service } = makeService();
+      const encrypted = service.encryptConfig('openai', {
+        api_key: 'sk-secret',
+        base_url: 'https://api',
+      }) as any;
+      const decrypted = service.decryptConfig(encrypted) as Record<string, string>;
+      expect(decrypted.api_key).toBe('sk-secret');
+      expect(decrypted.base_url).toBe('https://api');
+      expect(decrypted).not.toBe(encrypted);
+    });
+
+    it('retorna a mesma referência quando nada mudou', () => {
+      const { service } = makeService();
+      const config = { public: 'value', other: 1 };
+      expect(service.decryptConfig(config)).toBe(config);
+    });
+
+    it('config null passa intacto', () => {
+      const { service } = makeService();
+      expect(service.decryptConfig(null)).toBeNull();
+    });
+  });
+
+  describe('maskConfig', () => {
+    it('mascara os segredos do provider com o placeholder padrão', () => {
+      const { service } = makeService();
+      const out = service.maskConfig('stripe', {
+        secret_key: 'sk_test',
+        public_key: 'pk_test',
+      }) as Record<string, string>;
+      expect(out.secret_key).toBe(SECRET_MASK);
+      expect(out.public_key).toBe('pk_test');
+    });
+
+    it('aceita placeholder customizado e ignora vazios', () => {
+      const { service } = makeService();
+      const out = service.maskConfig(
+        'stripe',
+        { secret_key: 'sk', webhook_secret: '' },
+        'REDACTED',
+      ) as Record<string, string>;
+      expect(out.secret_key).toBe('REDACTED');
+      expect(out.webhook_secret).toBe('');
+    });
+
+    it('provider sem segredos retorna o config inalterado', () => {
+      const { service } = makeService();
+      const config = { foo: 'bar' };
+      expect(service.maskConfig('unknown', config)).toBe(config);
+    });
+
+    it('config null passa intacto', () => {
+      const { service } = makeService();
+      expect(service.maskConfig('stripe', null)).toBeNull();
+    });
+  });
+
+  describe('mergeKeepingStoredSecrets', () => {
+    it('herda o segredo armazenado quando o recebido é o placeholder de máscara', () => {
+      const { service } = makeService();
+      const merged = service.mergeKeepingStoredSecrets(
+        'stripe',
+        { secret_key: SECRET_MASK, webhook_secret: SECRET_MASK },
+        { secret_key: 'stored_sk', webhook_secret: 'stored_whsec' },
+      ) as Record<string, string>;
+      expect(merged.secret_key).toBe('stored_sk');
+      expect(merged.webhook_secret).toBe('stored_whsec');
+    });
+
+    it('herda quando o recebido está vazio/undefined/null', () => {
+      const { service } = makeService();
+      const merged = service.mergeKeepingStoredSecrets(
+        'mercado_pago',
+        { access_token: '', webhook_secret: undefined },
+        { access_token: 'stored_at', webhook_secret: 'stored_ws' },
+      ) as Record<string, string>;
+      expect(merged.access_token).toBe('stored_at');
+      expect(merged.webhook_secret).toBe('stored_ws');
+    });
+
+    it('mantém o valor recebido quando o usuário informou um novo segredo', () => {
+      const { service } = makeService();
+      const merged = service.mergeKeepingStoredSecrets(
+        'openai',
+        { api_key: 'new-key' },
+        { api_key: 'old-key' },
+      ) as Record<string, string>;
+      expect(merged.api_key).toBe('new-key');
+    });
+
+    it('não herda quando não há valor armazenado (mantém blank)', () => {
+      const { service } = makeService();
+      const merged = service.mergeKeepingStoredSecrets(
+        'openai',
+        { api_key: SECRET_MASK },
+        {},
+      ) as Record<string, string>;
+      expect(merged.api_key).toBe(SECRET_MASK);
+    });
+
+    it('lida com incoming/stored ausentes sem quebrar', () => {
+      const { service } = makeService();
+      const merged = service.mergeKeepingStoredSecrets(
+        'openai',
+        null,
+        null,
+      ) as Record<string, string>;
+      expect(merged).toEqual({});
+    });
+  });
+});

package/src/integration-profile/integration-profile.secrets.ts

@@ -33,6 +33,10 @@ export const INTEGRATION_SECRET_KEYS: Record<string, string[]> = {
   'microsoft-oauth': ['client_secret'],
   'facebook-oauth': ['client_secret'],
   'microsoft-entra-id-oauth': ['client_secret'],
+  // Apple has no static client_secret — the private_key signs a short-lived JWT
+  // client_secret at request time (see AppleProvider), so private_key is the secret.
+  'apple-oauth': ['private_key'],
+  'linkedin-oauth': ['client_secret'],
   // Pagamento
   stripe: ['secret_key', 'webhook_secret'],
   mercado_pago: ['access_token', 'webhook_secret'],

package/src/integration-profile/integration-profile.utils.spec.ts

@@ -0,0 +1,332 @@
+import { describe, it, expect } from '@jest/globals';
+import { BadRequestException } from '@nestjs/common';
+import { EnumProvider } from '../file/provider/provider.enum';
+import {
+  buildMailConfigFromIntegration,
+  getFromAddress,
+  getReplyToAddress,
+  buildStorageConfigFromIntegration,
+  resolveStorageEnumProvider,
+  resolveFileProviderSlug,
+  buildOAuthConfigFromIntegration,
+  buildDigitalOceanConfigFromIntegration,
+  buildKubernetesConfigFromIntegration,
+  buildAiConfigFromIntegration,
+} from './integration-profile.utils';
+
+describe('integration-profile.utils', () => {
+  describe('buildMailConfigFromIntegration', () => {
+    it('mapeia smtp com valores fornecidos', () => {
+      const result = buildMailConfigFromIntegration('smtp', {
+        host: 'mail.example.com',
+        port: 465,
+        secure: true,
+        username: 'user',
+        password: 'pass',
+      });
+
+      expect(result).toEqual({
+        global: true,
+        type: 'SMTP',
+        host: 'mail.example.com',
+        port: 465,
+        secure: true,
+        username: 'user',
+        password: 'pass',
+      });
+    });
+
+    it('aplica defaults de smtp quando config vazia', () => {
+      const result = buildMailConfigFromIntegration('SMTP', {});
+      expect(result).toMatchObject({
+        type: 'SMTP',
+        host: '',
+        port: 587,
+        secure: false,
+        username: '',
+        password: '',
+      });
+    });
+
+    it('trata config null aplicando defaults', () => {
+      const result = buildMailConfigFromIntegration('smtp', null);
+      expect(result.host).toBe('');
+      expect(result.port).toBe(587);
+    });
+
+    it('mapeia gmail', () => {
+      const result = buildMailConfigFromIntegration('gmail', {
+        client_id: 'cid',
+        client_secret: 'secret',
+        refresh_token: 'rt',
+        from_email: 'a@b.com',
+      });
+      expect(result).toEqual({
+        global: true,
+        type: 'GMAIL',
+        clientId: 'cid',
+        clientSecret: 'secret',
+        refreshToken: 'rt',
+        from: 'a@b.com',
+      });
+    });
+
+    it('mapeia ses', () => {
+      const result = buildMailConfigFromIntegration('ses', {
+        region: 'us-east-1',
+        access_key_id: 'ak',
+        secret_access_key: 'sk',
+        from_email: 'a@b.com',
+      });
+      expect(result).toEqual({
+        global: true,
+        type: 'SES',
+        region: 'us-east-1',
+        accessKeyId: 'ak',
+        secretAccessKey: 'sk',
+        from: 'a@b.com',
+      });
+    });
+
+    it('lança BadRequestException para provider desconhecido', () => {
+      expect(() => buildMailConfigFromIntegration('mailgun', {})).toThrow(
+        BadRequestException,
+      );
+    });
+  });
+
+  describe('getFromAddress', () => {
+    it('formata com nome e email', () => {
+      expect(
+        getFromAddress({ from_email: 'a@b.com', from_name: 'Alice' }),
+      ).toBe('Alice <a@b.com>');
+    });
+
+    it('retorna apenas email quando sem nome', () => {
+      expect(getFromAddress({ from_email: 'a@b.com' })).toBe('a@b.com');
+    });
+
+    it('trata config null', () => {
+      expect(getFromAddress(null)).toBe('');
+    });
+  });
+
+  describe('getReplyToAddress', () => {
+    it('retorna undefined quando reply-to vazio', () => {
+      expect(getReplyToAddress({})).toBeUndefined();
+      expect(getReplyToAddress({ reply_to_email: '   ' })).toBeUndefined();
+    });
+
+    it('formata com nome', () => {
+      expect(
+        getReplyToAddress({ reply_to_email: 'r@b.com', reply_to_name: 'Bob' }),
+      ).toBe('Bob <r@b.com>');
+    });
+
+    it('retorna apenas email quando sem nome', () => {
+      expect(getReplyToAddress({ reply_to_email: 'r@b.com' })).toBe('r@b.com');
+    });
+  });
+
+  describe('buildStorageConfigFromIntegration', () => {
+    it('mapeia local com default de path', () => {
+      expect(buildStorageConfigFromIntegration('local', {})).toEqual({
+        'storage-local-path': 'storage',
+      });
+      expect(
+        buildStorageConfigFromIntegration('local', { base_path: 'files' }),
+      ).toEqual({ 'storage-local-path': 'files' });
+    });
+
+    it('mapeia s3 com defaults', () => {
+      expect(buildStorageConfigFromIntegration('s3', {})).toEqual({
+        'storage-s3-key': '',
+        'storage-s3-secret': '',
+        'storage-s3-region': 'us-east-1',
+        'storage-s3-bucket': '',
+      });
+    });
+
+    it('mapeia gcs', () => {
+      expect(
+        buildStorageConfigFromIntegration('gcs', {
+          key_file_json: '{}',
+          bucket: 'b',
+        }),
+      ).toEqual({
+        'storage-gcs-keyfile': '{}',
+        'storage-gcs-bucket': 'b',
+      });
+    });
+
+    it('mapeia azure-blob', () => {
+      expect(
+        buildStorageConfigFromIntegration('azure-blob', {
+          account: 'acc',
+          key: 'k',
+          container: 'c',
+        }),
+      ).toEqual({
+        'storage-abs-account': 'acc',
+        'storage-abs-key': 'k',
+        'storage-abs-container': 'c',
+      });
+    });
+
+    it('mapeia s3-compatible', () => {
+      expect(
+        buildStorageConfigFromIntegration('s3-compatible', {
+          access_key_id: 'ak',
+          secret_access_key: 'sk',
+          region: 'nyc3',
+          bucket: 'b',
+          endpoint: 'cdn.example.com',
+        }),
+      ).toEqual({
+        'storage-spaces-key': 'ak',
+        'storage-spaces-secret': 'sk',
+        'storage-spaces-region': 'nyc3',
+        'storage-spaces-bucket': 'b',
+        'storage-spaces-cdn': 'cdn.example.com',
+      });
+    });
+
+    it('lança para provider desconhecido', () => {
+      expect(() =>
+        buildStorageConfigFromIntegration('dropbox', {}),
+      ).toThrow(BadRequestException);
+    });
+  });
+
+  describe('resolveStorageEnumProvider', () => {
+    it('mapeia cada slug conhecido', () => {
+      expect(resolveStorageEnumProvider('local')).toBe(EnumProvider.LOCAL);
+      expect(resolveStorageEnumProvider('S3')).toBe(EnumProvider.S3);
+      expect(resolveStorageEnumProvider('gcs')).toBe(EnumProvider.GCS);
+      expect(resolveStorageEnumProvider('azure-blob')).toBe(EnumProvider.AZURE);
+      expect(resolveStorageEnumProvider('s3-compatible')).toBe(
+        EnumProvider.SPACES,
+      );
+    });
+
+    it('lança para slug desconhecido', () => {
+      expect(() => resolveStorageEnumProvider('foo')).toThrow(
+        BadRequestException,
+      );
+    });
+  });
+
+  describe('resolveFileProviderSlug', () => {
+    it('normaliza slugs especiais', () => {
+      expect(resolveFileProviderSlug('azure-blob')).toBe('abs');
+      expect(resolveFileProviderSlug('s3-compatible')).toBe('spaces');
+    });
+
+    it('faz lowercase para outros slugs', () => {
+      expect(resolveFileProviderSlug('S3')).toBe('s3');
+      expect(resolveFileProviderSlug('Local')).toBe('local');
+    });
+  });
+
+  describe('buildOAuthConfigFromIntegration', () => {
+    it('inclui tenantId quando fornecido', () => {
+      expect(
+        buildOAuthConfigFromIntegration('microsoft', {
+          client_id: 'cid',
+          client_secret: 'sec',
+          tenant_id: 'tid',
+        }),
+      ).toEqual({ clientId: 'cid', clientSecret: 'sec', tenantId: 'tid' });
+    });
+
+    it('omite tenantId quando ausente', () => {
+      expect(
+        buildOAuthConfigFromIntegration('google', {
+          client_id: 'cid',
+          client_secret: 'sec',
+        }),
+      ).toEqual({ clientId: 'cid', clientSecret: 'sec' });
+    });
+  });
+
+  describe('buildDigitalOceanConfigFromIntegration', () => {
+    it('mapeia digitalocean', () => {
+      expect(
+        buildDigitalOceanConfigFromIntegration('digitalocean', {
+          api_token: 't',
+          cluster_id: 'c',
+          region: 'nyc',
+          video_node_pool_id: 'p',
+          video_node_pool_name: 'pool',
+        }),
+      ).toEqual({
+        apiToken: 't',
+        clusterId: 'c',
+        region: 'nyc',
+        videoNodePoolId: 'p',
+        videoNodePoolName: 'pool',
+      });
+    });
+
+    it('lança para provider desconhecido', () => {
+      expect(() =>
+        buildDigitalOceanConfigFromIntegration('aws', {}),
+      ).toThrow(BadRequestException);
+    });
+  });
+
+  describe('buildKubernetesConfigFromIntegration', () => {
+    it('mapeia kubernetes com default de namespace', () => {
+      expect(
+        buildKubernetesConfigFromIntegration('kubernetes', {
+          api_server: 'https://k8s',
+          token: 'tok',
+          ca_cert: 'cert',
+        }),
+      ).toEqual({
+        apiServer: 'https://k8s',
+        token: 'tok',
+        caCert: 'cert',
+        namespace: 'hcode',
+      });
+    });
+
+    it('lança para provider desconhecido', () => {
+      expect(() =>
+        buildKubernetesConfigFromIntegration('nomad', {}),
+      ).toThrow(BadRequestException);
+    });
+  });
+
+  describe('buildAiConfigFromIntegration', () => {
+    it('mapeia openai com organization', () => {
+      expect(
+        buildAiConfigFromIntegration('openai', {
+          api_key: 'k',
+          organization: 'org',
+        }),
+      ).toEqual({ apiKey: 'k', organization: 'org' });
+    });
+
+    it('mapeia openai sem organization', () => {
+      expect(buildAiConfigFromIntegration('openai', { api_key: 'k' })).toEqual({
+        apiKey: 'k',
+      });
+    });
+
+    it('mapeia gemini e claude apenas com apiKey', () => {
+      expect(buildAiConfigFromIntegration('gemini', { api_key: 'g' })).toEqual({
+        apiKey: 'g',
+      });
+      expect(buildAiConfigFromIntegration('claude', { api_key: 'c' })).toEqual({
+        apiKey: 'c',
+      });
+    });
+
+    it('lança para provider desconhecido', () => {
+      expect(() => buildAiConfigFromIntegration('llama', {})).toThrow(
+        BadRequestException,
+      );
+    });
+  });
+});

package/src/integration-profile/integration-profile.utils.ts

@@ -141,12 +141,25 @@ export function resolveFileProviderSlug(providerSlug: string): string {
 export function buildOAuthConfigFromIntegration(
   _providerSlug: string,
   config: unknown,
-): { clientId: string; clientSecret: string; tenantId?: string } {
+): {
+  clientId: string;
+  clientSecret: string;
+  tenantId?: string;
+  /** Apple Developer Team ID (Sign in with Apple). */
+  teamId?: string;
+  /** Key ID of the .p8 private key registered for Sign in with Apple. */
+  keyId?: string;
+  /** EC private key (PEM, .p8 contents) used to sign Apple's client_secret JWT. */
+  privateKey?: string;
+} {
   const cfg = (config as Cfg) ?? {};
   return {
     clientId: String(cfg.client_id ?? ''),
     clientSecret: String(cfg.client_secret ?? ''),
     ...(cfg.tenant_id ? { tenantId: String(cfg.tenant_id) } : {}),
+    ...(cfg.team_id ? { teamId: String(cfg.team_id) } : {}),
+    ...(cfg.key_id ? { keyId: String(cfg.key_id) } : {}),
+    ...(cfg.private_key ? { privateKey: String(cfg.private_key) } : {}),
   };
 }