@hed-hog/core 0.0.371 → 0.0.374

package/src/auth/guards/auth.guard.spec.ts

@@ -0,0 +1,177 @@
+import { describe, it, expect, beforeEach, afterEach, jest } from '@jest/globals';
+import { UnauthorizedException } from '@nestjs/common';
+import { IS_PUBLIC_KEY, WITH_NO_ROLE, WITH_ROLE } from '@hed-hog/api';
+import { AuthGuard } from './auth.guard';
+
+const makeContext = (request: any) => ({
+  getHandler: () => 'handler',
+  getClass: () => 'class',
+  switchToHttp: () => ({ getRequest: () => request }),
+});
+
+const makeDeps = () => {
+  const token = { verify: jest.fn() };
+  const reflector = { getAllAndOverride: jest.fn() };
+  const prisma = { mcp_api_key: { findFirst: jest.fn(), update: jest.fn() } };
+  const security = { hashWithPepper: jest.fn().mockReturnValue('hash') };
+  return { token, reflector, prisma, security };
+};
+
+const makeService = (deps = makeDeps()) => ({
+  guard: new AuthGuard(
+    deps.token as any,
+    deps.reflector as any,
+    deps.prisma as any,
+    deps.security as any,
+  ),
+  deps,
+});
+
+const setMeta = (
+  reflector: any,
+  meta: { public?: boolean; withRole?: boolean; withNoRole?: boolean },
+) => {
+  reflector.getAllAndOverride.mockImplementation((key: any) => {
+    if (key === IS_PUBLIC_KEY) return meta.public;
+    if (key === WITH_ROLE) return meta.withRole;
+    if (key === WITH_NO_ROLE) return meta.withNoRole;
+    return undefined;
+  });
+};
+
+describe('AuthGuard', () => {
+  afterEach(() => jest.clearAllMocks());
+
+  describe('sem token', () => {
+    it('permite rota pública', async () => {
+      const { guard, deps } = makeService();
+      setMeta(deps.reflector, { public: true });
+      const ctx = makeContext({ headers: {} });
+      await expect(guard.canActivate(ctx as any)).resolves.toBe(true);
+    });
+
+    it('nega quando withRole exige autenticação', async () => {
+      const { guard, deps } = makeService();
+      setMeta(deps.reflector, { withRole: true });
+      const ctx = makeContext({ headers: {}, method: 'GET', url: '/x' });
+      await expect(guard.canActivate(ctx as any)).rejects.toThrow(
+        UnauthorizedException,
+      );
+    });
+
+    it('nega quando withNoRole exige autenticação', async () => {
+      const { guard, deps } = makeService();
+      setMeta(deps.reflector, { withNoRole: true });
+      const ctx = makeContext({ headers: {}, method: 'GET', url: '/x' });
+      await expect(guard.canActivate(ctx as any)).rejects.toThrow(
+        UnauthorizedException,
+      );
+    });
+
+    it('nega por padrão sem decorator', async () => {
+      const { guard, deps } = makeService();
+      setMeta(deps.reflector, {});
+      const ctx = makeContext({ headers: {}, method: 'GET', url: '/x' });
+      await expect(guard.canActivate(ctx as any)).rejects.toThrow(
+        UnauthorizedException,
+      );
+    });
+  });
+
+  describe('com token Bearer', () => {
+    it('anexa payload quando verify resolve', async () => {
+      const { guard, deps } = makeService();
+      setMeta(deps.reflector, {});
+      deps.token.verify.mockResolvedValue({ sub: 5 });
+      const request: any = { headers: { authorization: 'Bearer tok' } };
+      await expect(guard.canActivate(makeContext(request) as any)).resolves.toBe(
+        true,
+      );
+      expect(request.auth).toEqual({ sub: 5 });
+    });
+
+    it('permite quando verify falha mas rota é pública', async () => {
+      const { guard, deps } = makeService();
+      setMeta(deps.reflector, { public: true });
+      deps.token.verify.mockRejectedValue(new Error('bad'));
+      const request: any = { headers: { authorization: 'Bearer tok' } };
+      await expect(guard.canActivate(makeContext(request) as any)).resolves.toBe(
+        true,
+      );
+    });
+
+    it('nega quando verify falha e rota não é pública', async () => {
+      const { guard, deps } = makeService();
+      setMeta(deps.reflector, {});
+      deps.token.verify.mockRejectedValue(new Error('invalid token'));
+      const request: any = {
+        headers: { authorization: 'Bearer tok' },
+        method: 'GET',
+        url: '/x',
+      };
+      await expect(guard.canActivate(makeContext(request) as any)).rejects.toThrow(
+        UnauthorizedException,
+      );
+    });
+  });
+
+  describe('api key (hedhog_api_)', () => {
+    it('autentica com api key válida', async () => {
+      const { guard, deps } = makeService();
+      setMeta(deps.reflector, {});
+      deps.prisma.mcp_api_key.findFirst.mockResolvedValue({
+        id: 1,
+        user_id: 9,
+        expires_at: null,
+      });
+      deps.prisma.mcp_api_key.update.mockResolvedValue({});
+      const request: any = {
+        headers: { authorization: 'Bearer hedhog_api_secret' },
+      };
+      await expect(guard.canActivate(makeContext(request) as any)).resolves.toBe(
+        true,
+      );
+      expect(request.auth).toEqual({ sub: 9, sessionId: null });
+    });
+
+    it('nega api key inexistente', async () => {
+      const { guard, deps } = makeService();
+      setMeta(deps.reflector, {});
+      deps.prisma.mcp_api_key.findFirst.mockResolvedValue(null);
+      const request: any = {
+        headers: { authorization: 'Bearer hedhog_api_x' },
+      };
+      await expect(guard.canActivate(makeContext(request) as any)).rejects.toThrow(
+        'Invalid API key',
+      );
+    });
+
+    it('nega api key expirada', async () => {
+      const { guard, deps } = makeService();
+      setMeta(deps.reflector, {});
+      deps.prisma.mcp_api_key.findFirst.mockResolvedValue({
+        id: 1,
+        user_id: 9,
+        expires_at: new Date(Date.now() - 1000),
+      });
+      const request: any = {
+        headers: { authorization: 'Bearer hedhog_api_x' },
+      };
+      await expect(guard.canActivate(makeContext(request) as any)).rejects.toThrow(
+        'API key expired',
+      );
+    });
+
+    it('api key inválida em rota pública retorna true', async () => {
+      const { guard, deps } = makeService();
+      setMeta(deps.reflector, { public: true });
+      deps.prisma.mcp_api_key.findFirst.mockResolvedValue(null);
+      const request: any = {
+        headers: { authorization: 'Bearer hedhog_api_x' },
+      };
+      await expect(guard.canActivate(makeContext(request) as any)).resolves.toBe(
+        true,
+      );
+    });
+  });
+});

package/src/challenge/challenge.service.spec.ts

@@ -0,0 +1,334 @@
+import {
+  describe,
+  it,
+  expect,
+  beforeEach,
+  afterEach,
+  jest,
+} from '@jest/globals';
+import { BadRequestException, NotFoundException } from '@nestjs/common';
+import { ChallengeService } from './challenge.service';
+
+const makeDeps = () => {
+  const prisma = {
+    user: { findUnique: jest.fn() },
+    user_mfa: { create: jest.fn(), findFirst: jest.fn() },
+    user_mfa_challenge: {
+      create: jest.fn(),
+      findFirst: jest.fn(),
+      delete: jest.fn(),
+    },
+    user_identifier: { findFirst: jest.fn() },
+    user_identifier_challenge: {
+      count: jest.fn(),
+      create: jest.fn(),
+      findFirst: jest.fn(),
+    },
+  };
+  const security = {
+    hashWithPepper: jest.fn((v: string) => `hash(${v})`),
+  };
+  const setting = {
+    getSettingValues: jest.fn().mockResolvedValue({}),
+  };
+  const token = {
+    createOpaqueToken: jest.fn().mockResolvedValue('tok'),
+  };
+  const mail = {
+    sendTemplatedMail: jest.fn().mockResolvedValue(undefined),
+  };
+  return { prisma, security, setting, token, mail };
+};
+
+const makeService = (deps = makeDeps()) => ({
+  service: new ChallengeService(
+    deps.prisma as any,
+    deps.security as any,
+    deps.setting as any,
+    deps.token as any,
+    deps.mail as any,
+  ),
+  deps,
+});
+
+describe('ChallengeService', () => {
+  let getRandomValuesSpy: any;
+
+  beforeEach(() => {
+    // Estabiliza a geração de código: cada byte = 7 → dígito '7'.
+    getRandomValuesSpy = jest
+      .spyOn(globalThis.crypto, 'getRandomValues')
+      .mockImplementation((arr: any) => {
+        arr.fill(7);
+        return arr;
+      });
+    jest.useFakeTimers().setSystemTime(new Date('2026-01-15T12:00:00Z'));
+  });
+
+  afterEach(() => {
+    getRandomValuesSpy.mockRestore();
+    jest.useRealTimers();
+    jest.clearAllMocks();
+  });
+
+  describe('resolveAppUrl', () => {
+    const call = (settings: any, app?: string) =>
+      (makeService().service as any).resolveAppUrl(settings, app);
+
+    it('retorna a URL do app correspondente (key=value)', () => {
+      const settings = {
+        'app-urls': ['admin=https://admin.com', 'training = https://train.com'],
+        url: 'https://default.com',
+      };
+      expect(call(settings, 'admin')).toBe('https://admin.com');
+    });
+
+    it('faz trim de chave e valor', () => {
+      const settings = {
+        'app-urls': ['training = https://train.com'],
+        url: 'https://default.com',
+      };
+      expect(call(settings, 'training')).toBe('https://train.com');
+    });
+
+    it('cai para settings.url quando app não encontrado', () => {
+      const settings = {
+        'app-urls': ['admin=https://admin.com'],
+        url: 'https://default.com',
+      };
+      expect(call(settings, 'unknown')).toBe('https://default.com');
+    });
+
+    it('cai para settings.url quando app não informado', () => {
+      const settings = { 'app-urls': [], url: 'https://default.com' };
+      expect(call(settings)).toBe('https://default.com');
+    });
+
+    it('trata app-urls não-array como vazio', () => {
+      const settings = { 'app-urls': 'x', url: 'https://default.com' };
+      expect(call(settings, 'admin')).toBe('https://default.com');
+    });
+  });
+
+  describe('forgotEmail', () => {
+    it('lança BadRequest (rate limit) quando há 3+ challenges abertos', async () => {
+      const { service, deps } = makeService();
+      deps.prisma.user_identifier_challenge.count.mockResolvedValue(3);
+      await expect(
+        service.forgotEmail('en', 'a@b.com'),
+      ).rejects.toThrow(BadRequestException);
+      expect(deps.prisma.user_identifier.findFirst).not.toHaveBeenCalled();
+    });
+
+    it('lança BadRequest quando usuário não encontrado', async () => {
+      const { service, deps } = makeService();
+      deps.prisma.user_identifier_challenge.count.mockResolvedValue(0);
+      deps.prisma.user_identifier.findFirst.mockResolvedValue(null);
+      await expect(
+        service.forgotEmail('en', 'a@b.com'),
+      ).rejects.toThrow(BadRequestException);
+    });
+
+    it('cria challenge e envia email com link base64', async () => {
+      const { service, deps } = makeService();
+      deps.prisma.user_identifier_challenge.count.mockResolvedValue(0);
+      deps.prisma.user_identifier.findFirst.mockResolvedValue({
+        id: 10,
+        user: { name: 'Bob' },
+      });
+      deps.setting.getSettingValues.mockResolvedValue({
+        'mfa-challenge-expiration-minutes': 15,
+        url: 'https://app.com',
+        'app-urls': [],
+      });
+      deps.prisma.user_identifier_challenge.create.mockResolvedValue({ id: 1 });
+
+      const result = await service.forgotEmail('en', 'a@b.com');
+
+      expect(result).toEqual({ id: 1 });
+      const base64 = Buffer.from('tok').toString('base64');
+      expect(deps.mail.sendTemplatedMail).toHaveBeenCalledWith(
+        'en',
+        expect.objectContaining({
+          email: 'a@b.com',
+          slug: 'auth-forget-password',
+          variables: expect.objectContaining({
+            link: `https://app.com/reset-password?token=${base64}`,
+            name: 'Bob',
+          }),
+        }),
+      );
+    });
+  });
+
+  describe('verifyCodePassword', () => {
+    it('retorna challenge quando válido', async () => {
+      const { service, deps } = makeService();
+      const challenge = { id: 1, user_identifier: { user: { id: 2 } } };
+      deps.prisma.user_identifier_challenge.findFirst.mockResolvedValue(
+        challenge,
+      );
+      await expect(
+        service.verifyCodePassword('en', '123456'),
+      ).resolves.toBe(challenge);
+      expect(deps.security.hashWithPepper).toHaveBeenCalledWith('123456');
+    });
+
+    it('lança BadRequest quando challenge inválido/expirado', async () => {
+      const { service, deps } = makeService();
+      deps.prisma.user_identifier_challenge.findFirst.mockResolvedValue(null);
+      await expect(
+        service.verifyCodePassword('en', '000000'),
+      ).rejects.toThrow(BadRequestException);
+    });
+  });
+
+  describe('verifyMfaEmailCode', () => {
+    it('retorna false quando challenge não encontrado', async () => {
+      const { service, deps } = makeService();
+      deps.prisma.user_mfa_challenge.findFirst.mockResolvedValue(null);
+      await expect(
+        service.verifyMfaEmailCode('en', 1, '123456'),
+      ).resolves.toBe(false);
+      expect(deps.prisma.user_mfa_challenge.delete).not.toHaveBeenCalled();
+    });
+
+    it('deleta o challenge e retorna true quando válido', async () => {
+      const { service, deps } = makeService();
+      deps.prisma.user_mfa_challenge.findFirst.mockResolvedValue({ id: 9 });
+      deps.prisma.user_mfa_challenge.delete.mockResolvedValue({ id: 9 });
+      await expect(
+        service.verifyMfaEmailCode('en', 1, '123456'),
+      ).resolves.toBe(true);
+      expect(deps.prisma.user_mfa_challenge.delete).toHaveBeenCalledWith({
+        where: { id: 9 },
+      });
+    });
+  });
+
+  describe('verifyCode', () => {
+    it('lança BadRequest quando hash não bate com providedHash', async () => {
+      const { service } = makeService();
+      // hashWithPepper('123456') => 'hash(123456)' !== 'other'
+      await expect(
+        service.verifyCode('en', 1, '123456', 'other'),
+      ).rejects.toThrow(BadRequestException);
+    });
+
+    it('retorna success quando sem name/email e hash confere', async () => {
+      const { service } = makeService();
+      await expect(
+        service.verifyCode('en', 1, '123456', 'hash(123456)'),
+      ).resolves.toEqual({ success: true });
+    });
+
+    it('cria user_mfa quando name e email presentes', async () => {
+      const { service, deps } = makeService();
+      deps.prisma.user_mfa.create.mockResolvedValue({ id: 3, user_id: 1 });
+      await expect(
+        service.verifyCode('en', 1, '123456', 'hash(123456)', 'Nome', 'e@x.com'),
+      ).resolves.toMatchObject({ id: 3 });
+      expect(deps.prisma.user_mfa.create).toHaveBeenCalled();
+    });
+  });
+
+  describe('verifyMfaEmail', () => {
+    it('lança NotFound quando usuário não existe', async () => {
+      const { service, deps } = makeService();
+      deps.setting.getSettingValues.mockResolvedValue({});
+      deps.prisma.user.findUnique.mockResolvedValue(null);
+      await expect(
+        service.verifyMfaEmail('en', 1, 'a@b.com'),
+      ).rejects.toThrow(NotFoundException);
+    });
+
+    it('gera código, cria challenge e retorna challengeId', async () => {
+      const { service, deps } = makeService();
+      deps.setting.getSettingValues.mockResolvedValue({
+        'mfa-email-code-length': 6,
+        'mfa-challenge-expiration-minutes': 15,
+      });
+      deps.prisma.user.findUnique.mockResolvedValue({ name: 'Bob' });
+      deps.prisma.user_mfa.create.mockResolvedValue({
+        id: 3,
+        user_mfa_challenge: [{ id: 42 }],
+      });
+
+      const result = await service.verifyMfaEmail('en', 1, 'a@b.com');
+
+      expect(result).toEqual({ challengeId: 42 });
+      // código estabilizado: cada byte 7 -> '7' repetido 6x
+      expect(deps.mail.sendTemplatedMail).toHaveBeenCalledWith(
+        'en',
+        expect.objectContaining({
+          slug: 'auth-email-verification-code',
+          variables: expect.objectContaining({ code: '777777', name: 'Bob' }),
+        }),
+      );
+    });
+  });
+
+  describe('sendMfaCodeToMultipleEmails', () => {
+    it('retorna success sem enviar quando lista vazia', async () => {
+      const { service, deps } = makeService();
+      await expect(
+        service.sendMfaCodeToMultipleEmails('en', 1, []),
+      ).resolves.toEqual({ success: true });
+      expect(deps.prisma.user.findUnique).not.toHaveBeenCalled();
+    });
+
+    it('lança BadRequest quando usuário não existe', async () => {
+      const { service, deps } = makeService();
+      deps.prisma.user.findUnique.mockResolvedValue(null);
+      await expect(
+        service.sendMfaCodeToMultipleEmails('en', 1, ['a@b.com']),
+      ).rejects.toThrow(BadRequestException);
+    });
+
+    it('envia para cada email usando mfa existente', async () => {
+      const { service, deps } = makeService();
+      deps.prisma.user.findUnique.mockResolvedValue({ name: 'Bob' });
+      deps.setting.getSettingValues.mockResolvedValue({
+        'mfa-email-code-length': 6,
+        'mfa-challenge-expiration-minutes': 15,
+      });
+      deps.prisma.user_mfa.findFirst.mockResolvedValue({ id: 5 });
+      deps.prisma.user_mfa_challenge.create.mockResolvedValue({ id: 1 });
+
+      await service.sendMfaCodeToMultipleEmails('en', 1, ['a@b.com', 'c@d.com']);
+
+      expect(deps.mail.sendTemplatedMail).toHaveBeenCalledTimes(2);
+      const createArg = deps.prisma.user_mfa_challenge.create.mock.calls[0][0];
+      expect(createArg.data.user_mfa).toEqual({ connect: { id: 5 } });
+    });
+  });
+
+  describe('sendMfaCodeByEmail', () => {
+    it('lança BadRequest quando usuário não existe', async () => {
+      const { service, deps } = makeService();
+      deps.prisma.user.findUnique.mockResolvedValue(null);
+      await expect(
+        service.sendMfaCodeByEmail('en', 1, 'a@b.com'),
+      ).rejects.toThrow(BadRequestException);
+    });
+
+    it('cria user_mfa quando não existe (branch create)', async () => {
+      const { service, deps } = makeService();
+      deps.prisma.user.findUnique.mockResolvedValue({ name: 'Bob' });
+      deps.setting.getSettingValues.mockResolvedValue({
+        'mfa-email-code-length': 6,
+        'mfa-challenge-expiration-minutes': 15,
+      });
+      deps.prisma.user_mfa.findFirst.mockResolvedValue(null);
+      deps.prisma.user_mfa_challenge.create.mockResolvedValue({ id: 1 });
+
+      await service.sendMfaCodeByEmail('en', 1, 'a@b.com');
+
+      const createArg = deps.prisma.user_mfa_challenge.create.mock.calls[0][0];
+      expect(createArg.data.user_mfa.create).toMatchObject({
+        name: 'Bob',
+        type: 'email',
+      });
+    });
+  });
+});

package/src/dashboard/dashboard-core/dashboard-core.service.spec.ts

@@ -0,0 +1,193 @@
+import { describe, it, expect, beforeEach, afterEach, jest } from '@jest/globals';
+import { DashboardCoreService } from './dashboard-core.service';
+
+const makeService = (prisma: any = {}, setting: any = {}) =>
+  new DashboardCoreService(prisma as any, setting as any);
+
+describe('DashboardCoreService helpers puros', () => {
+  let service: DashboardCoreService;
+
+  beforeEach(() => {
+    service = makeService();
+  });
+
+  afterEach(() => {
+    jest.restoreAllMocks();
+  });
+
+  describe('calculateChange', () => {
+    it('retorna 0 quando previous e current são 0', () => {
+      expect(service.calculateChange(0, 0)).toBe(0);
+    });
+
+    it('retorna 100 quando previous é 0 e current > 0', () => {
+      expect(service.calculateChange(50, 0)).toBe(100);
+    });
+
+    it('calcula variação percentual com uma casa decimal', () => {
+      expect(service.calculateChange(150, 100)).toBe(50);
+      expect(service.calculateChange(110, 100)).toBe(10);
+      expect(service.calculateChange(133, 100)).toBe(33);
+    });
+
+    it('arredonda para uma casa decimal', () => {
+      // (1/3)*100 = 33.333... => 33.3
+      expect(service.calculateChange(4, 3)).toBe(33.3);
+    });
+
+    it('retorna valores negativos quando há queda', () => {
+      expect(service.calculateChange(50, 100)).toBe(-50);
+    });
+  });
+
+  describe('userHasRequiredRolesForDashboard', () => {
+    const call = (reqs: number[][], roles: number[]) =>
+      (service as any).userHasRequiredRolesForDashboard(reqs, roles);
+
+    it('retorna true quando não há requisitos de componente', () => {
+      expect(call([], [1, 2])).toBe(true);
+      expect(call([], [])).toBe(true);
+    });
+
+    it('sem roles do usuário, exige que todos os componentes não peçam roles', () => {
+      expect(call([[], []], [])).toBe(true);
+      expect(call([[], [5]], [])).toBe(false);
+    });
+
+    it('usuário com role satisfaz componente quando há interseção', () => {
+      expect(call([[5, 6]], [6])).toBe(true);
+    });
+
+    it('componente sem requisitos é sempre satisfeito', () => {
+      expect(call([[], [3]], [3])).toBe(true);
+    });
+
+    it('falha quando algum componente não tem interseção de roles', () => {
+      expect(call([[3], [99]], [3])).toBe(false);
+    });
+  });
+
+  describe('hasConfigValue', () => {
+    const call = (v: unknown) => (service as any).hasConfigValue(v);
+
+    it('array vazio é falso; array com item é verdadeiro', () => {
+      expect(call([])).toBe(false);
+      expect(call([1])).toBe(true);
+    });
+
+    it('string vazia/branca é falso; string com conteúdo é verdadeiro', () => {
+      expect(call('')).toBe(false);
+      expect(call('   ')).toBe(false);
+      expect(call('x')).toBe(true);
+    });
+
+    it('null/undefined são falsos; números/booleans são verdadeiros', () => {
+      expect(call(null)).toBe(false);
+      expect(call(undefined)).toBe(false);
+      expect(call(0)).toBe(true);
+      expect(call(false)).toBe(true);
+    });
+  });
+
+  describe('toNullableString', () => {
+    const call = (v: unknown) => (service as any).toNullableString(v);
+
+    it('retorna string trimada quando não vazia', () => {
+      expect(call('  hi  ')).toBe('hi');
+    });
+
+    it('retorna null para string vazia/branca', () => {
+      expect(call('   ')).toBeNull();
+    });
+
+    it('retorna null para null/undefined', () => {
+      expect(call(null)).toBeNull();
+      expect(call(undefined)).toBeNull();
+    });
+
+    it('converte não-strings via String()', () => {
+      expect(call(42)).toBe('42');
+      expect(call(true)).toBe('true');
+    });
+  });
+
+  describe('toNullableUppercaseString', () => {
+    const call = (v: unknown) => (service as any).toNullableUppercaseString(v);
+
+    it('faz uppercase de string válida', () => {
+      expect(call(' smtp ')).toBe('SMTP');
+    });
+
+    it('retorna null para vazio', () => {
+      expect(call('  ')).toBeNull();
+      expect(call(null)).toBeNull();
+    });
+  });
+
+  describe('normalizeProviderList', () => {
+    const call = (v: unknown) => (service as any).normalizeProviderList(v);
+
+    it('retorna [] quando não é array', () => {
+      expect(call(undefined)).toEqual([]);
+      expect(call('x')).toEqual([]);
+    });
+
+    it('faz lowercase de cada provider', () => {
+      expect(call(['Google', 'GITHUB'])).toEqual(['google', 'github']);
+    });
+  });
+
+  describe('getMissingSettingKeys', () => {
+    const call = (settings: Record<string, unknown>, keys: string[]) =>
+      (service as any).getMissingSettingKeys(settings, keys);
+
+    it('retorna apenas as chaves ausentes/vazias', () => {
+      const settings = { a: 'x', b: '', c: null, d: 'y' };
+      expect(call(settings, ['a', 'b', 'c', 'd'])).toEqual(['b', 'c']);
+    });
+
+    it('retorna [] quando todas presentes', () => {
+      expect(call({ a: '1', b: '2' }, ['a', 'b'])).toEqual([]);
+    });
+  });
+
+  describe('slugifyDashboardName', () => {
+    const call = (v: string) => (service as any).slugifyDashboardName(v);
+
+    it('remove diacríticos e normaliza para slug', () => {
+      expect(call('Relatório de Vendas')).toBe('relatorio-de-vendas');
+    });
+
+    it('remove hifens das bordas', () => {
+      expect(call('  --Hello World!!  ')).toBe('hello-world');
+    });
+
+    it('gera fallback quando resultado vazio', () => {
+      const result = call('!!!');
+      expect(result).toMatch(/^dashboard-\d+$/);
+    });
+  });
+
+  describe('buildUniqueDashboardSlug', () => {
+    it('retorna o baseSlug quando não há colisão', async () => {
+      const prisma = { dashboard: { findFirst: jest.fn().mockResolvedValue(null) } };
+      const svc = makeService(prisma);
+      await expect(
+        (svc as any).buildUniqueDashboardSlug('vendas'),
+      ).resolves.toBe('vendas');
+    });
+
+    it('adiciona sufixo incremental em colisões', async () => {
+      const findFirst = jest
+        .fn()
+        .mockResolvedValueOnce({ id: 1 }) // 'vendas' existe
+        .mockResolvedValueOnce({ id: 2 }) // 'vendas-2' existe
+        .mockResolvedValueOnce(null); // 'vendas-3' livre
+      const svc = makeService({ dashboard: { findFirst } });
+      await expect(
+        (svc as any).buildUniqueDashboardSlug('vendas'),
+      ).resolves.toBe('vendas-3');
+      expect(findFirst).toHaveBeenCalledTimes(3);
+    });
+  });
+});