@hed-hog/core 0.0.373 → 0.0.374

package/hedhog/data/setting_group.yaml

@@ -981,6 +981,104 @@
         subgroup_id:
           where:
             slug: microsoft-entra-id
+      - slug: oauth-apple-profile-id
+        type: string
+        component: entity-picker
+        name:
+          en: Apple OAuth Profile
+          pt: Perfil OAuth Apple
+        description:
+          en: Integration profile (type OAuth / Apple) used for Sign in with Apple
+          pt: Perfil de integração (tipo OAuth / Apple) utilizado para autenticação com a Apple
+        value: ""
+        user_override: false
+        subgroup_id:
+          where:
+            slug: apple
+      - slug: oauth-apple-enabled
+        type: boolean
+        component: switch
+        name:
+          en: Enable Apple
+          pt: Habilitar Apple
+        description:
+          en: Enable or disable Sign in with Apple without removing the configured profile
+          pt: Habilitar ou desabilitar login com Apple sem remover o perfil configurado
+        value: 'false'
+        user_override: false
+        subgroup_id:
+          where:
+            slug: apple
+      - slug: oauth-apple-scopes
+        type: array
+        component: checkbox
+        name:
+          en: OAuth Scopes
+          pt: Escopos OAuth
+        description:
+          en: Permissions requested from the user during Sign in with Apple
+          pt: Permissões solicitadas ao usuário durante o fluxo de login com a Apple
+        value: '["name","email"]'
+        user_override: false
+        relations:
+          setting_list:
+            - value: name
+              order: 0
+            - value: email
+              order: 1
+        subgroup_id:
+          where:
+            slug: apple
+      - slug: oauth-linkedin-profile-id
+        type: string
+        component: entity-picker
+        name:
+          en: LinkedIn OAuth Profile
+          pt: Perfil OAuth LinkedIn
+        description:
+          en: Integration profile (type OAuth / LinkedIn) used for LinkedIn authentication
+          pt: Perfil de integração (tipo OAuth / LinkedIn) utilizado para autenticação com o LinkedIn
+        value: ""
+        user_override: false
+        subgroup_id:
+          where:
+            slug: linkedin
+      - slug: oauth-linkedin-enabled
+        type: boolean
+        component: switch
+        name:
+          en: Enable LinkedIn
+          pt: Habilitar LinkedIn
+        description:
+          en: Enable or disable LinkedIn OAuth without removing the configured profile
+          pt: Habilitar ou desabilitar OAuth do LinkedIn sem remover o perfil configurado
+        value: 'false'
+        user_override: false
+        subgroup_id:
+          where:
+            slug: linkedin
+      - slug: oauth-linkedin-scopes
+        type: array
+        component: checkbox
+        name:
+          en: OAuth Scopes
+          pt: Escopos OAuth
+        description:
+          en: Permissions requested from the user during LinkedIn OAuth flow
+          pt: Permissões solicitadas ao usuário durante o fluxo OAuth do LinkedIn
+        value: '["openid","profile","email"]'
+        user_override: false
+        relations:
+          setting_list:
+            - value: openid
+              order: 0
+            - value: profile
+              order: 1
+            - value: email
+              order: 2
+        subgroup_id:
+          where:
+            slug: linkedin
 - slug: appearance
   icon: palette
   name:

package/hedhog/data/setting_subgroup.yaml

@@ -182,6 +182,22 @@
     en: Microsoft Entra ID (Azure AD) OAuth Provider
     pt: Provedor OAuth Microsoft Entra ID (Azure AD)
 
+- slug: apple
+  name:
+    en: Apple
+    pt: Apple
+  description:
+    en: Apple OAuth Provider (Sign in with Apple)
+    pt: Provedor OAuth da Apple (Sign in with Apple)
+
+- slug: linkedin
+  name:
+    en: LinkedIn
+    pt: LinkedIn
+  description:
+    en: LinkedIn OAuth Provider
+    pt: Provedor OAuth do LinkedIn
+
 - slug: theme-selector
   name:
     en: Theme Selector

package/hedhog/frontend/app/configurations/[slug]/components/setting-field.tsx.ejs

@@ -109,6 +109,8 @@ const OAUTH_PROFILE_SLUG_TO_PROVIDER: Record<string, string> = {
   'oauth-github-profile-id': 'github-oauth',
   'oauth-microsoft-profile-id': 'microsoft-oauth',
   'oauth-microsoft-entra-id-profile-id': 'microsoft-entra-id-oauth',
+  'oauth-apple-profile-id': 'apple-oauth',
+  'oauth-linkedin-profile-id': 'linkedin-oauth',
 };
 // Settings cujo valor é o SLUG de um integration_profile. O picker continua sendo
 // selecionado/exibido pelo nome; apenas o valor persistido é o slug.

package/hedhog/frontend/app/dashboard/dashboard.css.ejs

@@ -12,27 +12,27 @@
 
 .dashboard-tabs-list .dashboard-tab-trigger.dashboard-tab-trigger-inactive {
   background: transparent !important;
-  color: hsl(var(--muted-foreground) / 0.6) !important;
+  color: color-mix(in oklab, var(--muted-foreground) 60%, transparent) !important;
 }
 
 .dashboard-tabs-list
   .dashboard-tab-trigger.dashboard-tab-trigger-inactive:hover {
-  background: hsl(var(--background) / 0.5) !important;
-  color: hsl(var(--foreground) / 0.8) !important;
+  background: color-mix(in oklab, var(--background) 50%, transparent) !important;
+  color: color-mix(in oklab, var(--foreground) 80%, transparent) !important;
 }
 
 .dashboard-tabs-list .dashboard-tab-trigger.dashboard-tab-trigger-active,
 .dashboard-tabs-list
   .dashboard-tab-trigger.dashboard-tab-trigger-active[data-state='active'] {
   z-index: 10;
-  background: hsl(var(--background)) !important;
-  color: hsl(var(--primary)) !important;
+  background: var(--background) !important;
+  color: var(--primary) !important;
   border: none !important;
   box-shadow: none !important;
 }
 
 .dashboard-tabs-list .dashboard-tab-trigger.dashboard-tab-trigger-active svg {
-  color: hsl(var(--primary)) !important;
+  color: var(--primary) !important;
 }
 
 .dashboard-grid.react-grid-layout {
@@ -66,8 +66,8 @@
   bottom: 3px;
   width: 6px;
   height: 6px;
-  border-right: 2px solid hsl(var(--muted-foreground));
-  border-bottom: 2px solid hsl(var(--muted-foreground));
+  border-right: 2px solid var(--muted-foreground);
+  border-bottom: 2px solid var(--muted-foreground);
   opacity: 0.45;
 }
 
@@ -125,16 +125,16 @@
 
 /* Placeholder styling */
 .dashboard-grid .react-grid-placeholder {
-  background: hsl(var(--primary) / 0.2);
+  background: color-mix(in oklab, var(--primary) 20%, transparent);
   opacity: 0.5;
   transition-duration: 100ms;
   z-index: 2;
   border-radius: 0.5rem;
-  border: 2px dashed hsl(var(--primary));
+  border: 2px dashed var(--primary);
 }
 
 .dashboard-grid .react-grid-item:hover {
-  outline: 1px solid hsl(var(--primary) / 0.12);
+  outline: 1px solid color-mix(in oklab, var(--primary) 12%, transparent);
   outline-offset: -1px;
 }
 

package/hedhog/frontend/app/integration/profiles/page.tsx.ejs

@@ -542,6 +542,48 @@ const PROVIDER_FIELDS: Record<string, FieldDef[]> = {
       required: true,
     },
   ],
+  'apple-oauth': [
+    {
+      key: 'client_id',
+      labelKey: 'fieldClientId',
+      type: 'text',
+      required: true,
+      placeholder: 'com.yourdomain.service',
+    },
+    {
+      key: 'team_id',
+      labelKey: 'fieldTeamId',
+      type: 'text',
+      required: true,
+    },
+    {
+      key: 'key_id',
+      labelKey: 'fieldKeyId',
+      type: 'text',
+      required: true,
+    },
+    {
+      key: 'private_key',
+      labelKey: 'fieldPrivateKey',
+      type: 'password',
+      required: true,
+      placeholder: '-----BEGIN PRIVATE KEY-----...',
+    },
+  ],
+  'linkedin-oauth': [
+    {
+      key: 'client_id',
+      labelKey: 'fieldClientId',
+      type: 'text',
+      required: true,
+    },
+    {
+      key: 'client_secret',
+      labelKey: 'fieldClientSecret',
+      type: 'password',
+      required: true,
+    },
+  ],
   stripe: [
     {
       key: 'publishable_key',

package/hedhog/frontend/app/menu/page.tsx.ejs

@@ -992,7 +992,7 @@ function MenuTreeWorkspace({
                 'group relative mr-1 flex cursor-pointer items-center gap-2 rounded-xl border px-2 py-1.5 transition-all duration-150 select-none active:scale-[0.99]',
                 isDraggingThis ? 'opacity-40' : 'opacity-100',
                 selectedId === node.id
-                  ? 'border-primary/70 bg-linear-to-r from-primary/10 via-primary/5 to-background shadow-[0_10px_24px_-18px_hsl(var(--primary))] ring-1 ring-primary/15'
+                  ? 'border-primary/70 bg-linear-to-r from-primary/10 via-primary/5 to-background shadow-[0_10px_24px_-18px_var(--primary)] ring-1 ring-primary/15'
                   : 'border-transparent hover:border-primary/30 hover:bg-muted/60 hover:shadow-sm',
                 isInside ? 'ring-2 ring-primary bg-primary/10' : ''
               )}

package/hedhog/frontend/app/users/user-sheet.tsx.ejs

@@ -147,6 +147,14 @@ const OAUTH_PROVIDER_TOGGLE_MAP: Array<{
       name: 'Microsoft Entra ID',
     },
   },
+  {
+    settingSlug: 'oauth-apple-enabled',
+    provider: { id: 'apple', slug: 'apple-oauth', name: 'Apple' },
+  },
+  {
+    settingSlug: 'oauth-linkedin-enabled',
+    provider: { id: 'linkedin', slug: 'linkedin-oauth', name: 'LinkedIn' },
+  },
 ];
 
 function generateRandomPassword(length = 16) {

package/hedhog/frontend/messages/en.json

@@ -870,6 +870,38 @@
       "loading": "Loading...",
       "errorOccurred": "An error occurred.",
       "alreadyProcessed": "This authentication callback has already been processed. Start the flow again."
+    },
+    "apple": {
+      "loginTitle": "Completing login...",
+      "loginDescription": "Please wait while we process your Apple authentication",
+      "loginSuccess": "Login successful!",
+      "registerTitle": "Completing registration...",
+      "registerDescription": "Please wait while we process your Apple authentication",
+      "registerSuccess": "Account created successfully!",
+      "connectTitle": "Completing account connection...",
+      "connectDescription": "Please wait while we process your Apple authentication",
+      "connectSuccess": "Account connected successfully!",
+      "errorTitle": "Unable to authenticate",
+      "buttonRetry": "Try again",
+      "loading": "Loading...",
+      "errorOccurred": "An error occurred.",
+      "alreadyProcessed": "This authentication callback has already been processed. Start the flow again."
+    },
+    "linkedin": {
+      "loginTitle": "Completing login...",
+      "loginDescription": "Please wait while we process your LinkedIn authentication",
+      "loginSuccess": "Login successful!",
+      "registerTitle": "Completing registration...",
+      "registerDescription": "Please wait while we process your LinkedIn authentication",
+      "registerSuccess": "Account created successfully!",
+      "connectTitle": "Completing account connection...",
+      "connectDescription": "Please wait while we process your LinkedIn authentication",
+      "connectSuccess": "Account connected successfully!",
+      "errorTitle": "Unable to authenticate",
+      "buttonRetry": "Try again",
+      "loading": "Loading...",
+      "errorOccurred": "An error occurred.",
+      "alreadyProcessed": "This authentication callback has already been processed. Start the flow again."
     }
   },
   "ConnectedAccounts": {
@@ -2408,6 +2440,9 @@
     "fieldOrganization": "Organization ID",
     "fieldRedirectUri": "Redirect URI",
     "fieldTenantId": "Tenant ID",
+    "fieldTeamId": "Team ID",
+    "fieldKeyId": "Key ID",
+    "fieldPrivateKey": "Private Key (.p8)",
     "fieldPublishableKey": "Publishable Key",
     "fieldSecretKey": "Secret Key",
     "fieldWebhookSecret": "Webhook Secret",

package/hedhog/frontend/messages/pt.json

@@ -870,6 +870,38 @@
       "loading": "Carregando...",
       "errorOccurred": "Ocorreu um erro.",
       "alreadyProcessed": "Esta autenticacao ja foi processada. Inicie o fluxo novamente."
+    },
+    "apple": {
+      "loginTitle": "Finalizando login...",
+      "loginDescription": "Aguarde enquanto processamos sua autenticação com a Apple",
+      "loginSuccess": "Login realizado com sucesso!",
+      "registerTitle": "Finalizando cadastro...",
+      "registerDescription": "Aguarde enquanto processamos sua autenticação com a Apple",
+      "registerSuccess": "Conta criada com sucesso!",
+      "connectTitle": "Finalizando conexão da conta...",
+      "connectDescription": "Aguarde enquanto processamos sua autenticação com a Apple",
+      "connectSuccess": "Conta conectada com sucesso!",
+      "errorTitle": "Não foi possível autenticar",
+      "buttonRetry": "Tentar novamente",
+      "loading": "Carregando...",
+      "errorOccurred": "Ocorreu um erro.",
+      "alreadyProcessed": "Esta autenticacao ja foi processada. Inicie o fluxo novamente."
+    },
+    "linkedin": {
+      "loginTitle": "Finalizando login...",
+      "loginDescription": "Aguarde enquanto processamos sua autenticação com o LinkedIn",
+      "loginSuccess": "Login realizado com sucesso!",
+      "registerTitle": "Finalizando cadastro...",
+      "registerDescription": "Aguarde enquanto processamos sua autenticação com o LinkedIn",
+      "registerSuccess": "Conta criada com sucesso!",
+      "connectTitle": "Finalizando conexão da conta...",
+      "connectDescription": "Aguarde enquanto processamos sua autenticação com o LinkedIn",
+      "connectSuccess": "Conta conectada com sucesso!",
+      "errorTitle": "Não foi possível autenticar",
+      "buttonRetry": "Tentar novamente",
+      "loading": "Carregando...",
+      "errorOccurred": "Ocorreu um erro.",
+      "alreadyProcessed": "Esta autenticacao ja foi processada. Inicie o fluxo novamente."
     }
   },
   "ConnectedAccounts": {
@@ -2463,6 +2495,9 @@
     "fieldOrganization": "ID da Organização",
     "fieldRedirectUri": "URI de Redirecionamento",
     "fieldTenantId": "Tenant ID",
+    "fieldTeamId": "Team ID",
+    "fieldKeyId": "Key ID",
+    "fieldPrivateKey": "Chave Privada (.p8)",
     "fieldPublishableKey": "Chave Publicável",
     "fieldSecretKey": "Chave Secreta",
     "fieldWebhookSecret": "Segredo do Webhook",

package/hedhog/table/user_account.yaml

@@ -15,6 +15,7 @@ columns:
       - apple
       - microsoft
       - microsoft-entra-id
+      - linkedin
   - name: provider_user_id
   - name: email
     isNullable: true

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@hed-hog/core",
-  "version": "0.0.373",
+  "version": "0.0.374",
   "license": "MIT",
   "main": "dist/index.js",
   "types": "dist/index.d.ts",
@@ -41,10 +41,10 @@
     "speakeasy": "^2.0.0",
     "ua-parser-js": "^2.0.10",
     "uuid": "^11.1.0",
-    "@hed-hog/api": "0.0.8",
     "@hed-hog/api-locale": "0.0.14",
-    "@hed-hog/api-mail": "0.0.9",
     "@hed-hog/api-pagination": "0.0.7",
+    "@hed-hog/api": "0.0.8",
+    "@hed-hog/api-mail": "0.0.9",
     "@hed-hog/api-types": "0.0.1",
     "@hed-hog/api-prisma": "0.0.6"
   },

package/src/access-log/access-log.service.spec.ts

@@ -0,0 +1,235 @@
+import { describe, it, expect, jest, beforeEach, afterEach } from '@jest/globals';
+
+jest.mock('@hed-hog/api-prisma', () => ({
+  __esModule: true,
+  PrismaService: class {},
+  Prisma: {
+    sql: (...args: any[]) => ({ __sql: args }),
+    raw: (v: string) => ({ __raw: v }),
+  },
+}));
+
+jest.mock('@hed-hog/api-pagination', () => ({
+  __esModule: true,
+  PaginationService: class {},
+}));
+
+jest.mock('geoip-lite', () => ({
+  __esModule: true,
+  lookup: jest.fn(),
+}));
+
+jest.mock('ua-parser-js', () => ({
+  __esModule: true,
+  UAParser: jest.fn(),
+}));
+
+import * as geoip from 'geoip-lite';
+import { UAParser } from 'ua-parser-js';
+import { AccessLogService } from './access-log.service';
+
+const mockLookup = geoip.lookup as unknown as jest.Mock;
+const mockUAParser = UAParser as unknown as jest.Mock;
+
+const makeService = () => {
+  const prisma = {
+    access_log: { create: jest.fn() },
+    $executeRaw: jest.fn(),
+  };
+  const pagination = {
+    paginate: jest.fn(),
+  };
+  const service = new AccessLogService(prisma as any, pagination as any);
+  return { service, prisma, pagination };
+};
+
+describe('AccessLogService', () => {
+  beforeEach(() => {
+    mockUAParser.mockImplementation(() => ({
+      getResult: () => ({
+        browser: { name: 'Chrome', version: '120' },
+        os: { name: 'Windows', version: '11' },
+      }),
+    }));
+    mockLookup.mockReturnValue({ country: 'BR', city: 'Sao Paulo' });
+  });
+
+  afterEach(() => {
+    jest.clearAllMocks();
+  });
+
+  describe('recordHttp', () => {
+    it('persiste o log HTTP com os campos mapeados', () => {
+      const { service, prisma } = makeService();
+      prisma.access_log.create.mockResolvedValue({});
+
+      service.recordHttp({
+        userId: 3,
+        ip: '1.2.3.4',
+        userAgent: 'UA',
+        method: 'GET',
+        path: '/api/x',
+      });
+
+      expect(prisma.access_log.create).toHaveBeenCalledWith({
+        data: {
+          user_id: 3,
+          ip: '1.2.3.4',
+          user_agent: 'UA',
+          method: 'GET',
+          path: '/api/x',
+        },
+      });
+    });
+
+    it('usa null para campos opcionais ausentes', () => {
+      const { service, prisma } = makeService();
+      prisma.access_log.create.mockResolvedValue({});
+
+      service.recordHttp({ method: 'POST', path: '/x' });
+
+      expect(prisma.access_log.create).toHaveBeenCalledWith({
+        data: { user_id: null, ip: null, user_agent: null, method: 'POST', path: '/x' },
+      });
+    });
+
+    it('não propaga erro de persistência (loga warn)', async () => {
+      const { service, prisma } = makeService();
+      prisma.access_log.create.mockRejectedValue(new Error('db down'));
+      const warnSpy = jest
+        .spyOn((service as any).logger, 'warn')
+        .mockImplementation(() => undefined);
+
+      expect(() => service.recordHttp({ method: 'GET', path: '/x' })).not.toThrow();
+      await new Promise((r) => process.nextTick(r));
+
+      expect(warnSpy).toHaveBeenCalled();
+    });
+  });
+
+  describe('recordMcp', () => {
+    it('persiste o log MCP com tool e prompt', () => {
+      const { service, prisma } = makeService();
+      prisma.access_log.create.mockResolvedValue({});
+
+      service.recordMcp({ userId: 9, mcpTool: 'search', mcpPrompt: 'q' });
+
+      expect(prisma.access_log.create).toHaveBeenCalledWith({
+        data: { user_id: 9, mcp_tool: 'search', mcp_prompt: 'q' },
+      });
+    });
+  });
+
+  describe('list', () => {
+    const paginateResult = (data: any[]) => ({ data, total: data.length, page: 1 });
+
+    it('sem filtros usa where vazio e mantém orderBy/include', async () => {
+      const { service, pagination } = makeService();
+      pagination.paginate.mockResolvedValue(paginateResult([]));
+
+      await service.list({});
+
+      const [, , opts] = pagination.paginate.mock.calls[0];
+      expect(opts.where).toEqual({});
+      expect(opts.orderBy).toEqual({ created_at: 'desc' });
+      expect(opts.include.user.select).toMatchObject({ id: true, name: true });
+    });
+
+    it('filtra por userId', async () => {
+      const { service, pagination } = makeService();
+      pagination.paginate.mockResolvedValue(paginateResult([]));
+
+      await service.list({ userId: 5 });
+
+      expect(pagination.paginate.mock.calls[0][2].where).toMatchObject({ user_id: 5 });
+    });
+
+    it('filtra por userSearch com contains insensitive', async () => {
+      const { service, pagination } = makeService();
+      pagination.paginate.mockResolvedValue(paginateResult([]));
+
+      await service.list({ userSearch: 'ana' });
+
+      expect(pagination.paginate.mock.calls[0][2].where.user).toEqual({
+        OR: [{ name: { contains: 'ana', mode: 'insensitive' } }],
+      });
+    });
+
+    it('monta o range de datas com fim de dia em createdAtTo', async () => {
+      const { service, pagination } = makeService();
+      pagination.paginate.mockResolvedValue(paginateResult([]));
+
+      await service.list({ createdAtFrom: '2026-01-01', createdAtTo: '2026-01-31' });
+
+      const where = pagination.paginate.mock.calls[0][2].where;
+      expect(where.created_at.gte).toEqual(new Date('2026-01-01'));
+      const lte: Date = where.created_at.lte;
+      expect(lte.getHours()).toBe(23);
+      expect(lte.getMinutes()).toBe(59);
+      expect(lte.getSeconds()).toBe(59);
+      expect(lte.getMilliseconds()).toBe(999);
+    });
+
+    it('type=http filtra method not null; type=mcp filtra mcp_tool not null', async () => {
+      const { service, pagination } = makeService();
+      pagination.paginate.mockResolvedValue(paginateResult([]));
+
+      await service.list({ type: 'http' });
+      expect(pagination.paginate.mock.calls[0][2].where).toMatchObject({
+        method: { not: null },
+      });
+
+      await service.list({ type: 'mcp' });
+      expect(pagination.paginate.mock.calls[1][2].where).toMatchObject({
+        mcp_tool: { not: null },
+      });
+    });
+
+    it('enriquece cada log com dados de user-agent e geoip', async () => {
+      const { service, pagination } = makeService();
+      pagination.paginate.mockResolvedValue(
+        paginateResult([{ id: 1, user_agent: 'UA', ip: '8.8.8.8' }]),
+      );
+
+      const result = await service.list({});
+
+      expect(result.data[0]).toMatchObject({
+        browser_name: 'Chrome',
+        browser_version: '120',
+        os_name: 'Windows',
+        os_version: '11',
+        country: 'BR',
+        city: 'Sao Paulo',
+      });
+    });
+
+    it('usa null quando não há user_agent nem ip', async () => {
+      const { service, pagination } = makeService();
+      pagination.paginate.mockResolvedValue(
+        paginateResult([{ id: 2, user_agent: null, ip: null }]),
+      );
+
+      const result = await service.list({});
+
+      expect(result.data[0]).toMatchObject({
+        browser_name: null,
+        os_name: null,
+        country: null,
+        city: null,
+      });
+      expect(mockUAParser).not.toHaveBeenCalled();
+      expect(mockLookup).not.toHaveBeenCalled();
+    });
+  });
+
+  describe('clearOld', () => {
+    it('executa o DELETE em lote via $executeRaw', async () => {
+      const { service, prisma } = makeService();
+      prisma.$executeRaw.mockResolvedValue(1);
+
+      await service.clearOld(30, 500);
+
+      expect(prisma.$executeRaw).toHaveBeenCalledTimes(1);
+    });
+  });
+});