@hed-hog/core 0.0.384 → 0.0.386

package/hedhog/frontend/app/dashboard/dashboard-home-tabs.tsx.ejs

@@ -28,6 +28,13 @@ import {
   ContextMenuSeparator,
   ContextMenuTrigger,
 } from '@/components/ui/context-menu';
+import {
+  DropdownMenu,
+  DropdownMenuContent,
+  DropdownMenuItem,
+  DropdownMenuSeparator,
+  DropdownMenuTrigger,
+} from '@/components/ui/dropdown-menu';
 import { Input } from '@/components/ui/input';
 import { ScrollArea } from '@/components/ui/scroll-area';
 import {
@@ -51,6 +58,7 @@ import {
   Home,
   LayoutDashboard,
   Loader2,
+  MoreHorizontal,
   Palette,
   Pencil,
   Plus,
@@ -1032,42 +1040,130 @@ export function DashboardHomeTabs() {
                               {tabContent}
                             </div>
                           ) : (
-                            <TabsTrigger
-                              value={dashboard.slug}
-                              draggable={!isBusy}
-                              onDragStart={(event) =>
-                                handleTabDragStart(event, dashboard.slug)
-                              }
-                              onDragOver={handleTabDragOver}
-                              onDrop={(event) =>
-                                void handleTabDrop(event, dashboard.slug)
-                              }
-                              onDragEnd={handleTabDragEnd}
-                              className={cn(
-                                'dashboard-tab-trigger -mb-px mt-1 inline-flex h-9 shrink-0 cursor-pointer items-center justify-center gap-2 overflow-hidden rounded-b-none rounded-t-lg border-none px-3 py-2 shadow-none data-[state=active]:shadow-none',
-                                draggingDashboardSlug === dashboard.slug &&
-                                  'opacity-70'
-                              )}
-                              style={
-                                isActiveTab
-                                  ? {
-                                      backgroundColor: 'var(--background)',
-                                      color: 'var(--primary)',
+                            <div className="group relative mt-1 shrink-0">
+                              <TabsTrigger
+                                value={dashboard.slug}
+                                draggable={!isBusy}
+                                onDragStart={(event) =>
+                                  handleTabDragStart(event, dashboard.slug)
+                                }
+                                onDragOver={handleTabDragOver}
+                                onDrop={(event) =>
+                                  void handleTabDrop(event, dashboard.slug)
+                                }
+                                onDragEnd={handleTabDragEnd}
+                                className={cn(
+                                  'dashboard-tab-trigger -mb-px inline-flex h-9 shrink-0 cursor-pointer items-center justify-center gap-2 overflow-hidden rounded-b-none rounded-t-lg border-none pr-9 pl-3 py-2 shadow-none data-[state=active]:shadow-none',
+                                  draggingDashboardSlug === dashboard.slug &&
+                                    'opacity-70'
+                                )}
+                                style={
+                                  isActiveTab
+                                    ? {
+                                        backgroundColor: 'var(--background)',
+                                        color: 'var(--primary)',
+                                      }
+                                    : {
+                                        backgroundColor: 'transparent',
+                                        color: 'var(--muted-foreground)',
+                                      }
+                                }
+                                onDoubleClick={() =>
+                                  startRenameDashboard(dashboard)
+                                }
+                                onContextMenu={() =>
+                                  setActiveSlug(dashboard.slug)
+                                }
+                              >
+                                {tabContent}
+                              </TabsTrigger>
+                              <DropdownMenu>
+                                <DropdownMenuTrigger asChild>
+                                  <Button
+                                    type="button"
+                                    variant="ghost"
+                                    size="icon"
+                                    className={cn(
+                                      'absolute top-1/2 right-1 z-10 size-7 -translate-y-1/2 rounded-md text-muted-foreground hover:text-foreground',
+                                      isActiveTab
+                                        ? 'bg-background/80'
+                                        : 'bg-transparent hover:bg-background/60'
+                                    )}
+                                    onClick={(event) => {
+                                      event.stopPropagation();
+                                      setActiveSlug(dashboard.slug);
+                                    }}
+                                    onPointerDown={(event) =>
+                                      event.stopPropagation()
                                     }
-                                  : {
-                                      backgroundColor: 'transparent',
-                                      color: 'var(--muted-foreground)',
+                                    aria-label={t('tabActions')}
+                                    title={t('tabActions')}
+                                  >
+                                    <MoreHorizontal className="size-4" />
+                                  </Button>
+                                </DropdownMenuTrigger>
+                                <DropdownMenuContent
+                                  align="end"
+                                  className="w-56"
+                                  onCloseAutoFocus={(event) =>
+                                    event.preventDefault()
+                                  }
+                                >
+                                  <DropdownMenuItem
+                                    onSelect={() =>
+                                      openAddWidgetsForDashboard(dashboard)
                                     }
-                              }
-                              onDoubleClick={() =>
-                                startRenameDashboard(dashboard)
-                              }
-                              onContextMenu={() =>
-                                setActiveSlug(dashboard.slug)
-                              }
-                            >
-                              {tabContent}
-                            </TabsTrigger>
+                                  >
+                                    <Plus className="size-4" />
+                                    {t('addWidgets')}
+                                  </DropdownMenuItem>
+                                  {!dashboard.is_home ? (
+                                    <DropdownMenuItem
+                                      onSelect={() =>
+                                        void handleSetHomeDashboard(dashboard)
+                                      }
+                                    >
+                                      <Home className="size-4" />
+                                      {t('setAsHome')}
+                                    </DropdownMenuItem>
+                                  ) : null}
+                                  <DropdownMenuItem
+                                    onSelect={() =>
+                                      startRenameDashboard(dashboard)
+                                    }
+                                  >
+                                    <Pencil className="size-4" />
+                                    {t('rename')}
+                                  </DropdownMenuItem>
+                                  <DropdownMenuItem
+                                    onSelect={() =>
+                                      openIconForDashboard(dashboard)
+                                    }
+                                  >
+                                    <Palette className="size-4" />
+                                    {t('changeIcon')}
+                                  </DropdownMenuItem>
+                                  <DropdownMenuItem
+                                    onSelect={() =>
+                                      openShareForDashboard(dashboard)
+                                    }
+                                  >
+                                    <Share2 className="size-4" />
+                                    {t('share')}
+                                  </DropdownMenuItem>
+                                  <DropdownMenuSeparator />
+                                  <DropdownMenuItem
+                                    variant="destructive"
+                                    onSelect={() =>
+                                      openDeleteForDashboard(dashboard)
+                                    }
+                                  >
+                                    <Trash2 className="size-4" />
+                                    {t('delete')}
+                                  </DropdownMenuItem>
+                                </DropdownMenuContent>
+                              </DropdownMenu>
+                            </div>
                           )}
                         </ContextMenuTrigger>
                         <ContextMenuContent className="w-56">

package/hedhog/frontend/app/roles/page.tsx.ejs

@@ -6,7 +6,6 @@ import {
   PageHeader,
   PaginationFooter,
   SearchBar,
-  StatsCards,
 } from '@/components/entity-list';
 import { Alert, AlertDescription, AlertTitle } from '@/components/ui/alert';
 import {
@@ -36,6 +35,7 @@ import {
   FormMessage,
 } from '@/components/ui/form';
 import { Input } from '@/components/ui/input';
+import { KpiCardsGrid, type KpiCardItem } from '@/components/ui/kpi-cards-grid';
 import {
   Select,
   SelectContent,
@@ -594,17 +594,18 @@ export default function RolePage() {
         description={t('description')}
       />
 
-      <StatsCards
-        className="sm:grid-cols-1 md:grid-cols-1 lg:grid-cols-1"
-        stats={[
-          {
-            title: t('totalRoles'),
-            value: String(stats.totalRoles),
-            icon: <ShieldCheck className="h-5 w-5" />,
-            iconBgColor: 'bg-purple-50',
-            iconColor: 'text-purple-600',
-          },
-        ]}
+      <KpiCardsGrid
+        className="grid-cols-1 md:grid-cols-1 xl:grid-cols-1"
+        items={
+          [
+            {
+              key: 'totalRoles',
+              title: t('totalRoles'),
+              value: stats.totalRoles,
+              icon: ShieldCheck,
+            },
+          ] satisfies KpiCardItem[]
+        }
       />
 
       <SearchBar

package/hedhog/frontend/messages/en.json

@@ -1399,6 +1399,7 @@
     "shareDashboardError": "Could not share the dashboard.",
     "shareRemoved": "Sharing removed.",
     "revokeShareError": "Could not remove the sharing.",
+    "tabActions": "Tab actions",
     "addWidgets": "Add widgets",
     "setAsHome": "Set as home",
     "rename": "Rename",
@@ -2138,7 +2139,8 @@
     "breadcrumbDashboard": "Dashboard",
     "breadcrumbManagement": "Management",
     "breadcrumbCurrent": "MCP Chat",
-    "mcpDisabled": "MCP Server is disabled. Enable it in Settings → MCP."
+    "mcpDisabled": "MCP Server is disabled. Enable it in Settings → MCP.",
+    "resizePanel": "Resize panel"
   },
   "McpTokens": {
     "title": "MCP API Keys",
@@ -2424,6 +2426,7 @@
     "fieldAccessKeyId": "Access Key ID",
     "fieldSecretAccessKey": "Secret Access Key",
     "fieldRegion": "Region",
+    "fieldDomain": "Domain",
     "fieldToken": "Token",
     "fieldInstanceName": "Instance Name",
     "fieldPhoneNumberId": "Phone Number ID",
@@ -2480,6 +2483,36 @@
     "nodePoolPlaceholder": "Select a node pool",
     "nodePoolNoneFound": "No node pools found for this cluster.",
     "nodePoolLoadError": "Failed to load node pools. Check the API token and cluster ID.",
-    "nodePoolNeedCreds": "Fill in the API token and cluster ID first, then load the pools."
+    "nodePoolNeedCreds": "Fill in the API token and cluster ID first, then load the pools.",
+    "fieldEnvironment": "Environment",
+    "optionHomologation": "Homologation (testing)",
+    "optionProduction": "Production (real invoices)",
+    "fieldTaxId": "Issuer tax ID (CNPJ)",
+    "fieldLegalName": "Legal name",
+    "fieldTradeName": "Trade name",
+    "fieldMunicipalRegistration": "Municipal registration",
+    "fieldIbgeCityCode": "IBGE city code",
+    "fieldAddressStreet": "Street",
+    "fieldAddressNumber": "Number",
+    "fieldAddressComplement": "Complement",
+    "fieldAddressDistrict": "District",
+    "fieldAddressZip": "ZIP code",
+    "fieldAddressState": "State",
+    "fieldEmail": "Email",
+    "fieldPhone": "Phone",
+    "fieldTaxRegime": "Tax regime",
+    "optionSimplesNacional": "Simples Nacional",
+    "optionSimplesNacionalExcesso": "Simples Nacional (over the cap)",
+    "optionRegimeNormal": "Regular regime",
+    "optionMei": "MEI",
+    "fieldSpecialTaxRegime": "Special tax regime",
+    "fieldCulturalIncentive": "Cultural incentive",
+    "fieldCertificatePfx": "A1 certificate (.pfx/.p12)",
+    "fieldCertificatePassword": "Certificate password",
+    "fieldBaseUrl": "API base URL",
+    "fieldTimeoutMs": "Timeout (ms)",
+    "fieldMaxRetries": "Max retries",
+    "fileStored": "A file is stored and encrypted. Click to replace it.",
+    "fileSelected": "New file selected. It will be encrypted on save."
   }
 }

package/hedhog/frontend/messages/pt.json

@@ -1402,6 +1402,7 @@
     "shareDashboardError": "Não foi possível compartilhar o dashboard.",
     "shareRemoved": "Compartilhamento removido.",
     "revokeShareError": "Não foi possível remover o compartilhamento.",
+    "tabActions": "Ações da aba",
     "addWidgets": "Adicionar widgets",
     "setAsHome": "Definir como home",
     "rename": "Renomear",
@@ -2193,7 +2194,8 @@
     "breadcrumbDashboard": "Painel",
     "breadcrumbManagement": "Gerenciamento",
     "breadcrumbCurrent": "Chat MCP",
-    "mcpDisabled": "O Servidor MCP está desabilitado. Habilite-o em Configurações → MCP."
+    "mcpDisabled": "O Servidor MCP está desabilitado. Habilite-o em Configurações → MCP.",
+    "resizePanel": "Redimensionar painel"
   },
   "McpTokens": {
     "title": "Chaves de API MCP",
@@ -2479,6 +2481,7 @@
     "fieldAccessKeyId": "Access Key ID",
     "fieldSecretAccessKey": "Secret Access Key",
     "fieldRegion": "Região",
+    "fieldDomain": "Domínio",
     "fieldToken": "Token",
     "fieldInstanceName": "Nome da Instância",
     "fieldPhoneNumberId": "ID do Número de Telefone",
@@ -2535,6 +2538,36 @@
     "nodePoolPlaceholder": "Selecione um node pool",
     "nodePoolNoneFound": "Nenhum node pool encontrado para este cluster.",
     "nodePoolLoadError": "Falha ao carregar os node pools. Verifique o token da API e o ID do cluster.",
-    "nodePoolNeedCreds": "Preencha o token da API e o ID do cluster primeiro, depois carregue os pools."
+    "nodePoolNeedCreds": "Preencha o token da API e o ID do cluster primeiro, depois carregue os pools.",
+    "fieldEnvironment": "Ambiente",
+    "optionHomologation": "Homologação (testes)",
+    "optionProduction": "Produção (notas reais)",
+    "fieldTaxId": "CNPJ do emitente",
+    "fieldLegalName": "Razão social",
+    "fieldTradeName": "Nome fantasia",
+    "fieldMunicipalRegistration": "Inscrição municipal",
+    "fieldIbgeCityCode": "Código IBGE do município",
+    "fieldAddressStreet": "Logradouro",
+    "fieldAddressNumber": "Número",
+    "fieldAddressComplement": "Complemento",
+    "fieldAddressDistrict": "Bairro",
+    "fieldAddressZip": "CEP",
+    "fieldAddressState": "Estado",
+    "fieldEmail": "E-mail",
+    "fieldPhone": "Telefone",
+    "fieldTaxRegime": "Regime tributário",
+    "optionSimplesNacional": "Simples Nacional",
+    "optionSimplesNacionalExcesso": "Simples Nacional (excesso de sublimite)",
+    "optionRegimeNormal": "Regime normal",
+    "optionMei": "MEI",
+    "fieldSpecialTaxRegime": "Regime especial de tributação",
+    "fieldCulturalIncentive": "Incentivador cultural",
+    "fieldCertificatePfx": "Certificado A1 (.pfx/.p12)",
+    "fieldCertificatePassword": "Senha do certificado",
+    "fieldBaseUrl": "URL base da API",
+    "fieldTimeoutMs": "Timeout (ms)",
+    "fieldMaxRetries": "Máximo de tentativas",
+    "fileStored": "Arquivo armazenado e cifrado. Clique para substituir.",
+    "fileSelected": "Novo arquivo selecionado. Será cifrado ao salvar."
   }
 }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@hed-hog/core",
-  "version": "0.0.384",
+  "version": "0.0.386",
   "license": "MIT",
   "main": "dist/index.js",
   "types": "dist/index.d.ts",
@@ -41,11 +41,11 @@
     "speakeasy": "^2.0.0",
     "ua-parser-js": "^2.0.10",
     "uuid": "^11.1.0",
-    "@hed-hog/api-prisma": "0.0.6",
     "@hed-hog/api-mail": "0.0.9",
-    "@hed-hog/api-locale": "0.0.14",
-    "@hed-hog/api": "0.0.8",
     "@hed-hog/api-types": "0.0.1",
+    "@hed-hog/api-prisma": "0.0.6",
+    "@hed-hog/api": "0.0.8",
+    "@hed-hog/api-locale": "0.0.14",
     "@hed-hog/api-pagination": "0.0.7"
   },
   "exports": {
@@ -77,13 +77,18 @@
     "hedhog"
   ],
   "devDependencies": {
+    "@jest/globals": "^29.7.0",
     "@types/cookie-parser": "^1.4.10",
     "@types/express": "^4.17.24",
     "@types/geoip-lite": "^1.4.4",
+    "@types/jest": "^29.5.14",
     "@types/multer": "^2.0.0",
     "@types/pako": "^2.0.4",
     "@types/ua-parser-js": "^0.7.39",
-    "rimraf": "^6.1.0"
+    "jest": "^29.7.0",
+    "rimraf": "^6.1.0",
+    "ts-jest": "^29.2.5",
+    "@hed-hog/jest-config": "0.0.0"
   },
   "scripts": {
     "_dev": "pnpm build --watch",

package/src/app-command/app-command.registry.ts

@@ -3,6 +3,8 @@ import { Injectable } from '@nestjs/common';
 export interface AppCommandContext extends Record<string, unknown> {
   webhookBody?: unknown;
   webhookHeaders?: Record<string, unknown>;
+  /** Raw pre-parse request body, needed for byte-exact HMAC signature verification (e.g. Stripe). Undefined on replayed/retried calls. */
+  webhookRawBody?: Buffer;
   remoteIp?: string | null;
   publicUuid?: string;
   integrationId?: number;

package/src/auth/auth.controller.ts

@@ -28,6 +28,7 @@ import { LoginWithRecoveryCodeDTO } from './dto/login-with-recovery-code';
 import { LoginDTO } from './dto/login.dto';
 import { ResendMfaCodeDTO } from './dto/resend-mfa-code.dto';
 import { ResetDTO } from './dto/reset.dto';
+import { CompleteAccountDTO, VerifyAccountInviteDTO } from './dto/complete-account.dto';
 
 @Controller('auth')
 export class AuthController {
@@ -269,4 +270,24 @@ export class AuthController {
   ) {
     return this.service.forgotResetPassword(locale, password, code, ipAddress, userAgent);
   }
+
+  @Public()
+  @Post('complete-account/verify')
+  async verifyAccountInvite(
+    @Locale() locale: string,
+    @Body() { code }: VerifyAccountInviteDTO,
+  ) {
+    return this.service.verifyAccountInvite(locale, code);
+  }
+
+  @Public()
+  @Post('complete-account')
+  async completeAccount(
+    @Locale() locale: string,
+    @Body() { password, code, name }: CompleteAccountDTO,
+    @Ip() ipAddress: string,
+    @Headers('user-agent') userAgent: string,
+  ) {
+    return this.service.completeAccount(locale, { password, code, name }, ipAddress, userAgent);
+  }
 }

package/src/auth/auth.service.ts

@@ -558,6 +558,139 @@ export class AuthService {
     return { accessToken, refreshToken, session }
   }
 
+  /**
+   * Garante que exista um usuário com o identificador de email informado e cria
+   * um challenge seguro de criação de conta (link de convite). Não envia email —
+   * o remetente (ex.: LMS enterprise) monta o link e dispara o template. Reutiliza
+   * um usuário existente por `userId` ou pelo identificador de email; caso não
+   * exista, cria um novo usuário apenas com o nome.
+   */
+  async prepareAccountInvite(
+    locale: string,
+    { email, name, userId }: { email: string; name?: string; userId?: number },
+  ) {
+    const normalizedEmail = email.toLowerCase().trim();
+
+    let targetUserId = userId;
+    if (!targetUserId) {
+      const existing = await this.user.findUserByEmail(locale, normalizedEmail);
+      targetUserId = existing?.id;
+    }
+    if (!targetUserId) {
+      const createdUser = await this.prisma.user.create({
+        data: { name: name?.trim() || normalizedEmail },
+      });
+      targetUserId = createdUser.id;
+    }
+
+    let identifier = await this.prisma.user_identifier.findFirst({
+      where: { user_id: targetUserId, type: 'email', value: normalizedEmail },
+    });
+    if (!identifier) {
+      identifier = await this.prisma.user_identifier.create({
+        data: {
+          user_id: targetUserId,
+          type: 'email',
+          value: normalizedEmail,
+          enabled: true,
+        },
+      });
+    } else if (!identifier.enabled) {
+      identifier = await this.prisma.user_identifier.update({
+        where: { id: identifier.id },
+        data: { enabled: true },
+      });
+    }
+
+    const passwordCount = await this.prisma.user_credential.count({
+      where: {
+        user_id: targetUserId,
+        type: 'password',
+        revoked_at: null,
+      },
+    });
+
+    const token = await this.challenge.createAccountInviteChallenge(identifier.id);
+
+    return { userId: targetUserId, token, hasPassword: passwordCount > 0 };
+  }
+
+  /**
+   * Valida (sem consumir) um token de convite de criação de conta e retorna os
+   * dados básicos para pré-preencher o formulário no app de treinamentos.
+   */
+  async verifyAccountInvite(locale: string, code: string) {
+    const challenge = await this.challenge.verifyCodePassword(locale, code);
+    return {
+      valid: true,
+      name: challenge.user_identifier.user?.name ?? null,
+      email: challenge.user_identifier.value,
+    };
+  }
+
+  /**
+   * Conclui a criação de conta a partir de um token de convite: cria/atualiza a
+   * credencial de senha, marca o identificador como verificado, atualiza o nome
+   * (se enviado), consome o challenge e autentica o usuário (auto-login).
+   */
+  async completeAccount(
+    locale: string,
+    { password, code, name }: { password: string; code: string; name?: string },
+    ipAddress: string,
+    userAgent: string,
+  ) {
+    const challenge = await this.challenge.verifyCodePassword(locale, code);
+    const userIdentifier = challenge.user_identifier;
+    const passwordHash = await this.security.hashArgon2(password);
+
+    const existingCredential = await this.prisma.user_credential.findFirst({
+      where: { user_id: userIdentifier.user_id, type: 'password' },
+    });
+
+    if (existingCredential) {
+      await this.prisma.user_credential.updateMany({
+        where: { user_id: userIdentifier.user_id, type: 'password' },
+        data: { hash: passwordHash, requires_reset: false, revoked_at: null },
+      });
+    } else {
+      await this.prisma.user_credential.create({
+        data: {
+          user_id: userIdentifier.user_id,
+          type: 'password',
+          hash: passwordHash,
+        },
+      });
+    }
+
+    await this.prisma.user_identifier.update({
+      where: { id: userIdentifier.id },
+      data: { verified_at: new Date(), enabled: true },
+    });
+
+    if (name?.trim()) {
+      await this.prisma.user.update({
+        where: { id: userIdentifier.user_id },
+        data: { name: name.trim() },
+      });
+    }
+
+    // Consome o challenge para impedir reuso do link (invites têm validade longa).
+    await this.prisma.user_identifier_challenge.updateMany({
+      where: { id: challenge.id },
+      data: { verified_at: new Date(), expires_at: new Date() },
+    });
+
+    const { accessToken, refreshToken, session } =
+      await this.getAuthenticationPayload(
+        locale,
+        userIdentifier.user_id,
+        ipAddress,
+        userAgent,
+      );
+    await this.user.registerUserActivity(userIdentifier.id, 'completeAccount');
+    return { accessToken, refreshToken, session };
+  }
+
   async verifyMfaCode(locale: string, mfaToken: string, code: string, ipAddress: string, userAgent: string, methodType?: 'totp' | 'email' | 'recovery', browserId?: string | null) {
     const payload = await this.token.verifyMfaChallengeToken(mfaToken);
     const user = await this.prisma.user.findUnique({

package/src/auth/dto/complete-account.dto.ts

@@ -0,0 +1,24 @@
+import { getLocaleText } from '@hed-hog/api-locale';
+import { IsNotEmpty, IsOptional, IsString, MinLength } from 'class-validator';
+
+export class CompleteAccountDTO {
+  @IsNotEmpty({
+    message: (args) => getLocaleText('reset.password.required', args.value),
+  })
+  @MinLength(8, {
+    message: (args) => getLocaleText('reset.password.minLength', args.value),
+  })
+  password: string;
+
+  @IsNotEmpty({ message: (args) => getLocaleText('reset.code.required', args.value) })
+  code: string;
+
+  @IsOptional()
+  @IsString()
+  name?: string;
+}
+
+export class VerifyAccountInviteDTO {
+  @IsNotEmpty({ message: (args) => getLocaleText('reset.code.required', args.value) })
+  code: string;
+}