@hed-hog/core 0.0.371 → 0.0.374

package/src/setting/setting.service.ts

@@ -484,13 +484,16 @@ export class SettingService implements OnModuleInit, OnModuleDestroy {
       'oauth-google-enabled',
       'oauth-microsoft-enabled',
       'oauth-microsoft-entra-id-enabled',
+      'oauth-apple-enabled',
+      'oauth-linkedin-enabled',
       'disable-authentication-with-email-and-password',
       'contact-allow-company-registration',
       'operations.comment-edit-window',
       'lms-video-conversion-enabled',
       'lms-video-frame-capture-interval-seconds',
       'lms-error-modal-enabled',
-      'url'
+      'url',
+      'app-urls'
     ];
     const setting = await this.getSettingValues(slugs);
     return { locales, setting };

package/src/task/task.service.spec.ts

@@ -0,0 +1,47 @@
+import { describe, it, expect, beforeEach, afterEach, jest } from '@jest/globals';
+import { TasksService } from './task.service';
+
+const makeDeps = () => {
+  const prismaService = { $executeRaw: jest.fn().mockResolvedValue(0) };
+  const settingService = { getSettingValues: jest.fn().mockResolvedValue({}) };
+  return { prismaService, settingService };
+};
+
+const makeService = (deps = makeDeps()) => ({
+  service: new TasksService(deps.prismaService as any, deps.settingService as any),
+  deps,
+});
+
+describe('TasksService', () => {
+  afterEach(() => jest.clearAllMocks());
+
+  describe('clear', () => {
+    it('executa todas as rotinas de limpeza', async () => {
+      const { service, deps } = makeService();
+      await service.clear();
+      // 8 rotinas, cada uma faz um $executeRaw
+      expect(deps.prismaService.$executeRaw).toHaveBeenCalledTimes(8);
+      expect(deps.settingService.getSettingValues).toHaveBeenCalled();
+    });
+  });
+
+  describe('clearExpiredMfaChallenges (default de batch limit)', () => {
+    it('usa 20000 quando setting ausente', async () => {
+      const { service, deps } = makeService();
+      deps.settingService.getSettingValues.mockResolvedValue({});
+      await (service as any).clearExpiredMfaChallenges();
+      const values = deps.prismaService.$executeRaw.mock.calls[0].slice(1);
+      expect(values).toContain(20000);
+    });
+
+    it('respeita cleanup-batch-limit configurado', async () => {
+      const { service, deps } = makeService();
+      deps.settingService.getSettingValues.mockResolvedValue({
+        'cleanup-batch-limit': 500,
+      });
+      await (service as any).clearExpiredMfaChallenges();
+      const values = deps.prismaService.$executeRaw.mock.calls[0].slice(1);
+      expect(values).toContain(500);
+    });
+  });
+});

package/src/token/token.service.spec.ts

@@ -0,0 +1,351 @@
+import {
+  describe,
+  it,
+  expect,
+  beforeEach,
+  afterEach,
+  jest,
+} from '@jest/globals';
+import {
+  ForbiddenException,
+  UnauthorizedException,
+} from '@nestjs/common';
+import { TokenService } from './token.service';
+
+const makeDeps = () => {
+  const jwt = {
+    signAsync: jest.fn(),
+    verifyAsync: jest.fn(),
+  };
+  const security = {
+    getJwtSecret: jest.fn().mockReturnValue('secret'),
+    randomOpaque: jest.fn().mockReturnValue('opaque-token'),
+  };
+  const setting = {
+    getSettingValues: jest.fn().mockResolvedValue({}),
+  };
+  const prisma = {
+    user_session: { findUnique: jest.fn() },
+  };
+  return { jwt, security, setting, prisma };
+};
+
+const makeService = (deps = makeDeps()) => ({
+  service: new TokenService(
+    deps.prisma as any,
+    deps.jwt as any,
+    deps.security as any,
+    deps.setting as any,
+  ),
+  deps,
+});
+
+describe('TokenService', () => {
+  const originalCookieDomain = process.env.COOKIE_DOMAIN;
+
+  afterEach(() => {
+    jest.clearAllMocks();
+    if (originalCookieDomain === undefined) {
+      delete process.env.COOKIE_DOMAIN;
+    } else {
+      process.env.COOKIE_DOMAIN = originalCookieDomain;
+    }
+  });
+
+  describe('normalizeCookieDomain', () => {
+    let service: TokenService;
+    beforeEach(() => {
+      service = makeService().service;
+    });
+    const call = (v?: string | null) =>
+      (service as any).normalizeCookieDomain(v);
+
+    it('retorna undefined para vazio/null/branco', () => {
+      expect(call(undefined)).toBeUndefined();
+      expect(call(null)).toBeUndefined();
+      expect(call('   ')).toBeUndefined();
+    });
+
+    it('remove protocolo, path e porta', () => {
+      expect(call('https://app.example.com:3200/login')).toBe(
+        'app.example.com',
+      );
+      expect(call('http://app.example.com')).toBe('app.example.com');
+    });
+
+    it('retorna undefined para localhost', () => {
+      expect(call('http://localhost:3200')).toBeUndefined();
+      expect(call('localhost')).toBeUndefined();
+    });
+
+    it('retorna undefined para IPv4', () => {
+      expect(call('http://127.0.0.1:3000')).toBeUndefined();
+      expect(call('192.168.0.10')).toBeUndefined();
+    });
+
+    it('retorna host válido para domínio real', () => {
+      expect(call('example.com')).toBe('example.com');
+    });
+  });
+
+  describe('getCookieDomain', () => {
+    it('prioriza COOKIE_DOMAIN do env', async () => {
+      process.env.COOKIE_DOMAIN = 'https://env.example.com/';
+      const { service, deps } = makeService();
+      await expect((service as any).getCookieDomain()).resolves.toBe(
+        'env.example.com',
+      );
+      expect(deps.setting.getSettingValues).not.toHaveBeenCalled();
+    });
+
+    it('cai para setting api-url quando env ausente/inválido', async () => {
+      delete process.env.COOKIE_DOMAIN;
+      const { service, deps } = makeService();
+      deps.setting.getSettingValues.mockResolvedValue({
+        'api-url': 'https://api.example.com',
+      });
+      await expect((service as any).getCookieDomain()).resolves.toBe(
+        'api.example.com',
+      );
+      expect(deps.setting.getSettingValues).toHaveBeenCalledWith(['api-url']);
+    });
+
+    it('retorna undefined quando env é localhost e setting vazio', async () => {
+      process.env.COOKIE_DOMAIN = 'localhost';
+      const { service, deps } = makeService();
+      deps.setting.getSettingValues.mockResolvedValue({ 'api-url': '' });
+      await expect((service as any).getCookieDomain()).resolves.toBeUndefined();
+    });
+  });
+
+  describe('setRefreshTokenCookie', () => {
+    it('usa sameSite lax sem secure/domain em localhost', async () => {
+      delete process.env.COOKIE_DOMAIN;
+      const { service, deps } = makeService();
+      deps.setting.getSettingValues.mockResolvedValue({});
+      const res = { cookie: jest.fn() };
+      const expires = new Date(Date.now() + 60000);
+
+      await service.setRefreshTokenCookie('en', res, 'tok', expires);
+
+      const [name, token, opts] = res.cookie.mock.calls[0];
+      expect(name).toBe('rt');
+      expect(token).toBe('tok');
+      expect(opts.sameSite).toBe('lax');
+      expect(opts.secure).toBeUndefined();
+      expect(opts.domain).toBeUndefined();
+      expect(opts.httpOnly).toBe(true);
+      expect(opts.maxAge).toBeGreaterThan(0);
+    });
+
+    it('usa sameSite none + secure + domain quando há domínio', async () => {
+      process.env.COOKIE_DOMAIN = 'app.example.com';
+      const { service } = makeService();
+      const res = { cookie: jest.fn() };
+      const expires = new Date(Date.now() + 60000);
+
+      await service.setRefreshTokenCookie('en', res, 'tok', expires);
+
+      const opts = res.cookie.mock.calls[0][2];
+      expect(opts.sameSite).toBe('none');
+      expect(opts.secure).toBe(true);
+      expect(opts.domain).toBe('app.example.com');
+    });
+  });
+
+  describe('removeRefreshTokenCookie', () => {
+    it('limpa cookie com opções de localhost', async () => {
+      delete process.env.COOKIE_DOMAIN;
+      const { service, deps } = makeService();
+      deps.setting.getSettingValues.mockResolvedValue({});
+      const res = { clearCookie: jest.fn() };
+
+      await service.removeRefreshTokenCookie(res);
+
+      const [name, opts] = res.clearCookie.mock.calls[0];
+      expect(name).toBe('rt');
+      expect(opts.sameSite).toBe('lax');
+      expect(opts.secure).toBeUndefined();
+    });
+
+    it('limpa cookie com domain em produção', async () => {
+      process.env.COOKIE_DOMAIN = 'app.example.com';
+      const { service } = makeService();
+      const res = { clearCookie: jest.fn() };
+
+      await service.removeRefreshTokenCookie(res);
+
+      const opts = res.clearCookie.mock.calls[0][1];
+      expect(opts.secure).toBe(true);
+      expect(opts.domain).toBe('app.example.com');
+    });
+  });
+
+  describe('verify', () => {
+    it('retorna payload sem sessionId', async () => {
+      const { service, deps } = makeService();
+      deps.jwt.verifyAsync.mockResolvedValue({ sub: 1 });
+      await expect(service.verify('en', 'tok')).resolves.toEqual({ sub: 1 });
+      expect(deps.prisma.user_session.findUnique).not.toHaveBeenCalled();
+    });
+
+    it('retorna payload quando sessão ativa', async () => {
+      const { service, deps } = makeService();
+      deps.jwt.verifyAsync.mockResolvedValue({ sub: 1, sessionId: 9 });
+      deps.prisma.user_session.findUnique.mockResolvedValue({
+        revoked_at: null,
+        expires_at: new Date(Date.now() + 100000),
+      });
+      await expect(service.verify('en', 'tok')).resolves.toMatchObject({
+        sessionId: 9,
+      });
+    });
+
+    it('lança UnauthorizedException quando sessão não existe', async () => {
+      const { service, deps } = makeService();
+      deps.jwt.verifyAsync.mockResolvedValue({ sub: 1, sessionId: 9 });
+      deps.prisma.user_session.findUnique.mockResolvedValue(null);
+      await expect(service.verify('en', 'tok')).rejects.toThrow(
+        UnauthorizedException,
+      );
+    });
+
+    it('lança UnauthorizedException quando sessão revogada', async () => {
+      const { service, deps } = makeService();
+      deps.jwt.verifyAsync.mockResolvedValue({ sub: 1, sessionId: 9 });
+      deps.prisma.user_session.findUnique.mockResolvedValue({
+        revoked_at: new Date(),
+        expires_at: new Date(Date.now() + 100000),
+      });
+      await expect(service.verify('en', 'tok')).rejects.toThrow(
+        UnauthorizedException,
+      );
+    });
+
+    it('lança UnauthorizedException quando sessão expirada', async () => {
+      const { service, deps } = makeService();
+      deps.jwt.verifyAsync.mockResolvedValue({ sub: 1, sessionId: 9 });
+      deps.prisma.user_session.findUnique.mockResolvedValue({
+        revoked_at: null,
+        expires_at: new Date(Date.now() - 1000),
+      });
+      await expect(service.verify('en', 'tok')).rejects.toThrow(
+        UnauthorizedException,
+      );
+    });
+
+    it('engole erro transitório de DB e retorna payload', async () => {
+      const { service, deps } = makeService();
+      deps.jwt.verifyAsync.mockResolvedValue({ sub: 1, sessionId: 9 });
+      deps.prisma.user_session.findUnique.mockRejectedValue(
+        new Error('connection reset'),
+      );
+      await expect(service.verify('en', 'tok')).resolves.toMatchObject({
+        sub: 1,
+      });
+    });
+
+    it('converte erro de JWT em UnauthorizedException', async () => {
+      const { service, deps } = makeService();
+      const jwtError: any = new Error('jwt malformed');
+      jwtError.name = 'JsonWebTokenError';
+      deps.jwt.verifyAsync.mockRejectedValue(jwtError);
+      await expect(service.verify('en', 'tok')).rejects.toThrow(
+        UnauthorizedException,
+      );
+    });
+
+    it('trata TokenExpiredError como 401', async () => {
+      const { service, deps } = makeService();
+      const jwtError: any = new Error('jwt expired');
+      jwtError.name = 'TokenExpiredError';
+      deps.jwt.verifyAsync.mockRejectedValue(jwtError);
+      await expect(service.verify('en', 'tok')).rejects.toThrow(
+        UnauthorizedException,
+      );
+    });
+  });
+
+  describe('token helpers', () => {
+    it('createAccessToken assina com o segredo', async () => {
+      const { service, deps } = makeService();
+      deps.jwt.signAsync.mockResolvedValue('signed');
+      await expect(service.createAccessToken({ sub: 1 })).resolves.toBe(
+        'signed',
+      );
+      expect(deps.jwt.signAsync).toHaveBeenCalledWith(
+        { sub: 1 },
+        { secret: 'secret' },
+      );
+    });
+
+    it('createOpaqueToken delega ao security', async () => {
+      const { service, deps } = makeService();
+      await expect(service.createOpaqueToken(32)).resolves.toBe('opaque-token');
+      expect(deps.security.randomOpaque).toHaveBeenCalledWith(32);
+    });
+
+    it('createMfaChallengeToken assina com expiração de 10m', async () => {
+      const { service, deps } = makeService();
+      deps.jwt.signAsync.mockResolvedValue('mfa-tok');
+      const payload = {
+        userId: 1,
+        ipAddress: '1.2.3.4',
+        userAgent: 'ua',
+        email: 'a@b.com',
+      };
+      await expect(service.createMfaChallengeToken(payload)).resolves.toBe(
+        'mfa-tok',
+      );
+      expect(deps.jwt.signAsync).toHaveBeenCalledWith(
+        payload,
+        expect.objectContaining({ secret: 'secret', expiresIn: '10m' }),
+      );
+    });
+
+    it('verifyMfaChallengeToken retorna campos do payload', async () => {
+      const { service, deps } = makeService();
+      deps.jwt.verifyAsync.mockResolvedValue({
+        userId: 5,
+        ipAddress: '9.9.9.9',
+        userAgent: 'ua',
+        email: 'x@y.com',
+        extra: 'ignored',
+      });
+      await expect(service.verifyMfaChallengeToken('tok')).resolves.toEqual({
+        userId: 5,
+        ipAddress: '9.9.9.9',
+        userAgent: 'ua',
+        email: 'x@y.com',
+      });
+    });
+
+    it('verifyMfaChallengeToken lança ForbiddenException em token inválido', async () => {
+      const { service, deps } = makeService();
+      deps.jwt.verifyAsync.mockRejectedValue(new Error('bad'));
+      await expect(service.verifyMfaChallengeToken('tok')).rejects.toThrow(
+        ForbiddenException,
+      );
+    });
+
+    it('decodeExpiredToken ignora expiração', async () => {
+      const { service, deps } = makeService();
+      deps.jwt.verifyAsync.mockResolvedValue({ sub: 7 });
+      await expect(service.decodeExpiredToken('tok')).resolves.toEqual({
+        sub: 7,
+      });
+      expect(deps.jwt.verifyAsync).toHaveBeenCalledWith(
+        'tok',
+        expect.objectContaining({ ignoreExpiration: true }),
+      );
+    });
+
+    it('decodeExpiredToken lança UnauthorizedException em token inválido', async () => {
+      const { service, deps } = makeService();
+      deps.jwt.verifyAsync.mockRejectedValue(new Error('bad'));
+      await expect(service.decodeExpiredToken('tok')).rejects.toThrow(
+        UnauthorizedException,
+      );
+    });
+  });
+});

package/src/user/user.service.spec.ts

@@ -0,0 +1,256 @@
+import { describe, it, expect, beforeEach, afterEach, jest } from '@jest/globals';
+import { BadRequestException, NotFoundException } from '@nestjs/common';
+import { UserService } from './user.service';
+
+const makeDeps = () => {
+  const prismaService = {
+    user: {
+      findUnique: jest.fn(),
+      findFirst: jest.fn(),
+      findMany: jest.fn(),
+      update: jest.fn(),
+      deleteMany: jest.fn(),
+    },
+    role: { findUnique: jest.fn(), findMany: jest.fn() },
+    role_user: { findFirst: jest.fn(), create: jest.fn(), delete: jest.fn(), findMany: jest.fn() },
+    user_credential: { updateMany: jest.fn(), create: jest.fn() },
+    user_activity: { create: jest.fn() },
+    user_change_log: { create: jest.fn() },
+    user_identifier: { findFirst: jest.fn() },
+    file: { delete: jest.fn() },
+    $transaction: jest.fn(),
+  };
+  const paginationService = { paginatePrismaModel: jest.fn() };
+  const security = { hashArgon2: jest.fn().mockResolvedValue('hashed') };
+  const challenge = { verifyEmail: jest.fn() };
+  const file = { upload: jest.fn(), delete: jest.fn(), getBuffer: jest.fn() };
+  const integrationApi = { publishEvent: jest.fn().mockResolvedValue(undefined) };
+  const settingService = { getSettingValues: jest.fn().mockResolvedValue({}) };
+  return {
+    prismaService,
+    paginationService,
+    security,
+    challenge,
+    file,
+    integrationApi,
+    settingService,
+  };
+};
+
+const makeService = (deps = makeDeps()) => ({
+  service: new UserService(
+    deps.prismaService as any,
+    deps.paginationService as any,
+    deps.security as any,
+    deps.challenge as any,
+    deps.file as any,
+    deps.integrationApi as any,
+    deps.settingService as any,
+  ),
+  deps,
+});
+
+describe('UserService', () => {
+  afterEach(() => jest.clearAllMocks());
+
+  describe('registerUserActivity', () => {
+    it('ignora ids inválidos', async () => {
+      const { service, deps } = makeService();
+      await expect(service.registerUserActivity(null, 'x')).resolves.toBeNull();
+      await expect(service.registerUserActivity(0, 'x')).resolves.toBeNull();
+      await expect(service.registerUserActivity(-1, 'x')).resolves.toBeNull();
+      await expect(service.registerUserActivity(1.5, 'x')).resolves.toBeNull();
+      expect(deps.prismaService.user_activity.create).not.toHaveBeenCalled();
+    });
+
+    it('registra atividade para id válido', async () => {
+      const { service, deps } = makeService();
+      deps.prismaService.user_activity.create.mockResolvedValue({ id: 1 });
+      await service.registerUserActivity(5, 'login');
+      expect(deps.prismaService.user_activity.create).toHaveBeenCalledWith({
+        data: { user_id: 5, action: 'login' },
+      });
+    });
+  });
+
+  describe('generateRandomPassword', () => {
+    const allChars =
+      'abcdefghijkmnopqrstuvwxyz' +
+      'ABCDEFGHJKLMNPQRSTUVWXYZ' +
+      '23456789' +
+      '@#$%&*!?-_+';
+
+    it('gera senha do tamanho padrão (16)', () => {
+      const { service } = makeService();
+      const pwd = (service as any).generateRandomPassword();
+      expect(pwd).toHaveLength(16);
+      for (const ch of pwd) expect(allChars).toContain(ch);
+    });
+
+    it('respeita tamanho customizado', () => {
+      const { service } = makeService();
+      expect((service as any).generateRandomPassword(24)).toHaveLength(24);
+    });
+  });
+
+  describe('mapRolesWithAssignment', () => {
+    it('marca atribuídas e resolve locale com fallback', () => {
+      const { service } = makeService();
+      const allRoles = [
+        {
+          id: 1,
+          slug: 'admin',
+          role_locale: [
+            { locale: { code: 'en' }, name: 'Admin', description: 'A' },
+            { locale: { code: 'pt' }, name: 'Adm', description: 'Ap' },
+          ],
+        },
+        {
+          id: 2,
+          slug: 'user',
+          role_locale: [{ locale: { code: 'fr' }, name: 'Utilisateur', description: 'U' }],
+        },
+      ];
+      const userRoles = [{ role_id: 1 }];
+      const result = (service as any).mapRolesWithAssignment('pt', allRoles, userRoles);
+      expect(result[0]).toMatchObject({ id: 1, name: 'Adm', isAssigned: true });
+      // role 2 não tem locale 'pt' -> fallback para o primeiro
+      expect(result[1]).toMatchObject({ id: 2, name: 'Utilisateur', isAssigned: false });
+    });
+  });
+
+  describe('findUserById', () => {
+    it('lança NotFound quando ausente', async () => {
+      const { service, deps } = makeService();
+      deps.prismaService.user.findUnique.mockResolvedValue(null);
+      await expect(service.findUserById('en', 9)).rejects.toThrow(
+        NotFoundException,
+      );
+    });
+  });
+
+  describe('findUserByEmail', () => {
+    it('normaliza email (minúsculas + trim)', async () => {
+      const { service, deps } = makeService();
+      deps.prismaService.user.findFirst.mockResolvedValue(null);
+      await service.findUserByEmail('en', '  User@Example.COM  ');
+      const where = deps.prismaService.user.findFirst.mock.calls[0][0].where;
+      expect(where.user_identifier.some.value).toBe('user@example.com');
+    });
+  });
+
+  describe('delete', () => {
+    it('lança BadRequest sem ids', async () => {
+      const { service } = makeService();
+      await expect(service.delete('en', { ids: [] } as any)).rejects.toThrow(
+        BadRequestException,
+      );
+    });
+
+    it('lança NotFound quando algum id não existe', async () => {
+      const { service, deps } = makeService();
+      deps.prismaService.user.findMany.mockResolvedValue([{ id: 1 }]);
+      await expect(service.delete('en', { ids: [1, 2] } as any)).rejects.toThrow(
+        NotFoundException,
+      );
+    });
+
+    it('remove usuários e publica evento', async () => {
+      const { service, deps } = makeService();
+      deps.prismaService.user.findMany.mockResolvedValue([{ id: 1 }, { id: 2 }]);
+      deps.prismaService.user.deleteMany.mockResolvedValue({ count: 2 });
+      const result = await service.delete('en', { ids: [1, 2] } as any);
+      expect(result).toEqual({ count: 2 });
+      expect(deps.integrationApi.publishEvent).toHaveBeenCalledWith(
+        expect.objectContaining({ eventName: 'core.user.deleted' }),
+      );
+    });
+  });
+
+  describe('update', () => {
+    it('registra mudança quando nome altera', async () => {
+      const { service, deps } = makeService();
+      deps.prismaService.user.findUnique.mockResolvedValue({ id: 1, name: 'Old' });
+      deps.prismaService.user.update.mockResolvedValue({ id: 1, name: 'New' });
+      deps.prismaService.user_change_log.create.mockResolvedValue({ id: 1 });
+      await service.update('en', 1, { name: 'New' } as any, 9);
+      expect(deps.prismaService.user_change_log.create).toHaveBeenCalled();
+    });
+
+    it('não registra mudança quando nome igual', async () => {
+      const { service, deps } = makeService();
+      deps.prismaService.user.findUnique.mockResolvedValue({ id: 1, name: 'Same' });
+      deps.prismaService.user.update.mockResolvedValue({ id: 1, name: 'Same' });
+      await service.update('en', 1, { name: 'Same' } as any);
+      expect(deps.prismaService.user_change_log.create).not.toHaveBeenCalled();
+    });
+  });
+
+  describe('resetPassword', () => {
+    it('cria credencial quando nenhuma existe (count 0)', async () => {
+      const { service, deps } = makeService();
+      deps.prismaService.user.findUnique.mockResolvedValue({ id: 1 });
+      deps.prismaService.user_credential.updateMany.mockResolvedValue({ count: 0 });
+      deps.prismaService.user_credential.create.mockResolvedValue({ id: 1 });
+      deps.prismaService.user_activity.create.mockResolvedValue({ id: 1 });
+      deps.prismaService.user_change_log.create.mockResolvedValue({ id: 1 });
+
+      const result = await service.resetPassword('en', 1, { password: 'MyPass1!' } as any);
+      expect(deps.prismaService.user_credential.create).toHaveBeenCalled();
+      expect(result).toEqual({ password: 'MyPass1!', requiresReset: true });
+    });
+
+    it('gera senha aleatória quando não informada', async () => {
+      const { service, deps } = makeService();
+      deps.prismaService.user.findUnique.mockResolvedValue({ id: 1 });
+      deps.prismaService.user_credential.updateMany.mockResolvedValue({ count: 1 });
+      deps.prismaService.user_activity.create.mockResolvedValue({ id: 1 });
+      deps.prismaService.user_change_log.create.mockResolvedValue({ id: 1 });
+
+      const result = await service.resetPassword('en', 1, {} as any);
+      expect(result.password).toHaveLength(16);
+      expect(result.requiresReset).toBe(true);
+    });
+  });
+
+  describe('recordUserChange', () => {
+    it('serializa before/after e trata undefined como null', async () => {
+      const { service, deps } = makeService();
+      deps.prismaService.user_change_log.create.mockResolvedValue({ id: 1 });
+      await (service as any).recordUserChange({
+        targetUserId: 1,
+        action: 'update',
+        beforeData: { a: 1 },
+      });
+      const data = deps.prismaService.user_change_log.create.mock.calls[0][0].data;
+      expect(data.before_data).toBe('{"a":1}');
+      expect(data.after_data).toBeNull();
+      expect(data.actor_user_id).toBeNull();
+    });
+
+    it('retorna null em erro do prisma', async () => {
+      const { service, deps } = makeService();
+      deps.prismaService.user_change_log.create.mockRejectedValue(new Error('x'));
+      await expect(
+        (service as any).recordUserChange({ targetUserId: 1, action: 'update' }),
+      ).resolves.toBeNull();
+    });
+  });
+
+  describe('listUserActivities', () => {
+    it('mapeia atividades com createdAt ISO', async () => {
+      const { service, deps } = makeService();
+      deps.prismaService.user.findUnique.mockResolvedValue({ id: 1 });
+      deps.paginationService.paginatePrismaModel.mockResolvedValue({
+        data: [{ id: 7, action: 'login', created_at: new Date('2026-01-01T00:00:00Z') }],
+        total: 1,
+      });
+      const result = await service.listUserActivities('en', 1, {});
+      expect(result.data[0]).toEqual({
+        id: '7',
+        action: 'login',
+        createdAt: '2026-01-01T00:00:00.000Z',
+      });
+    });
+  });
+});

package/src/utils/locale-context.spec.ts

@@ -0,0 +1,22 @@
+import { describe, it, expect } from '@jest/globals';
+import { getLocaleFromContext, localeStorage } from './locale-context';
+
+describe('locale-context', () => {
+  it('retorna "en" quando não há contexto', () => {
+    expect(getLocaleFromContext()).toBe('en');
+  });
+
+  it('retorna locale do storage dentro de run()', () => {
+    const result = localeStorage.run({ locale: 'pt' }, () =>
+      getLocaleFromContext(),
+    );
+    expect(result).toBe('pt');
+  });
+
+  it('cai para "en" quando locale do contexto é vazio', () => {
+    const result = localeStorage.run({ locale: '' }, () =>
+      getLocaleFromContext(),
+    );
+    expect(result).toBe('en');
+  });
+});