@hed-hog/core 0.0.384 → 0.0.386

package/src/authorize/dto/consent.dto.ts

@@ -0,0 +1,23 @@
+import { IsNotEmpty, IsString } from 'class-validator';
+
+export class ConsentDTO {
+  @IsString()
+  @IsNotEmpty()
+  client_id: string;
+
+  @IsString()
+  @IsNotEmpty()
+  redirect_uri: string;
+
+  @IsString()
+  @IsNotEmpty()
+  scope: string;
+
+  @IsString()
+  @IsNotEmpty()
+  code_challenge: string;
+
+  @IsString()
+  @IsNotEmpty()
+  code_challenge_method: string;
+}

package/src/authorize/dto/token.dto.ts

@@ -0,0 +1,23 @@
+import { IsIn, IsNotEmpty, IsString } from 'class-validator';
+
+export class TokenDTO {
+  @IsString()
+  @IsIn(['authorization_code'])
+  grant_type: string;
+
+  @IsString()
+  @IsNotEmpty()
+  code: string;
+
+  @IsString()
+  @IsNotEmpty()
+  code_verifier: string;
+
+  @IsString()
+  @IsNotEmpty()
+  client_id: string;
+
+  @IsString()
+  @IsNotEmpty()
+  redirect_uri: string;
+}

package/src/challenge/challenge.service.ts

@@ -239,6 +239,34 @@ export class ChallengeService {
     return challenge;
   }
 
+  /**
+   * Cria um challenge de convite de criação de conta vinculado a um
+   * `user_identifier` de email já existente e retorna o token em base64
+   * (mesmo formato consumido pelo fluxo de reset de senha). A validade usa a
+   * setting `account-invite-expiration-minutes` (padrão 7 dias).
+   */
+  async createAccountInviteChallenge(userIdentifierId: number): Promise<string> {
+    const settings = await this.setting.getSettingValues([
+      'account-invite-expiration-minutes',
+    ]);
+
+    const token = await this.token.createOpaqueToken(16);
+    const hash = this.security.hashWithPepper(token);
+
+    await this.prisma.user_identifier_challenge.create({
+      data: {
+        hash,
+        expires_at: new Date(
+          Date.now() +
+            (settings['account-invite-expiration-minutes'] || 10080) * 60000,
+        ),
+        user_identifier_id: userIdentifierId,
+      },
+    });
+
+    return Buffer.from(token).toString('base64');
+  }
+
   private resolveAppUrl(settings: Record<string, any>, app?: string): string {
     const appUrls: string[] = Array.isArray(settings['app-urls']) ? settings['app-urls'] : [];
 

package/src/core.module.ts

@@ -42,6 +42,7 @@ import { IsPinCodeWithSettingConstraint } from './validators/is-pin-code-with-se
 import { IsStrongPasswordWithSettingsConstraint } from './validators/is-strong-password-with-settings.validator';
 import { ValidatorServiceLocator } from './validators/service-locator';
 import { AiInstructionModule } from './ai-instruction/ai-instruction.module';
+import { AuthorizeModule } from './authorize/authorize.module';
 import { IntegrationProfileModule } from './integration-profile/integration-profile.module';
 import { WebhookIntegrationModule } from './webhook-integration/webhook-integration.module';
 
@@ -53,6 +54,7 @@ import { WebhookIntegrationModule } from './webhook-integration/webhook-integrat
     forwardRef(() => AiModule),
     forwardRef(() => InstallModule),
     forwardRef(() => AuthModule),
+    forwardRef(() => AuthorizeModule),
     forwardRef(() => DashboardModule),
     forwardRef(() => MailSendModule),
     forwardRef(() => MenuModule),

package/src/file/file.service.ts

@@ -1041,6 +1041,25 @@ export class FileService implements OnModuleInit {
     return (await this.getProvider()).tempURL(filepath, expires);
   }
 
+  /**
+   * URL temporária a partir do id do arquivo.
+   * Prefira este método a `tempURL(file.path)`: quando `path` é apenas o
+   * basename, a chave real no provider inclui o prefixo `location`, e passar
+   * `path` cru gera uma URL que resolve para NoSuchKey.
+   */
+  async tempURLById(fileId: number, expires = 3600) {
+    const file = await this.prismaService.file.findFirst({
+      where: { id: fileId },
+      select: { location: true, path: true },
+    });
+
+    if (!file) {
+      throw new NotFoundException(`Not found: ${fileId}`);
+    }
+
+    return this.tempURL(this.resolveProviderPath(file), expires);
+  }
+
   async tempOpenURL(filepath: string, expires = 3600) {
     const url = await this.tempURL(filepath, expires);
 

package/src/integration-profile/integration-profile.secrets.spec.ts

@@ -0,0 +1,114 @@
+import { describe, expect, it } from '@jest/globals';
+import { readFileSync } from 'node:fs';
+import { join } from 'node:path';
+import { INTEGRATION_SECRET_KEYS, getSensitiveConfigKeys } from './integration-profile.secrets';
+
+/**
+ * TRAVA DE SEGURANÇA: PROVIDER_FIELDS (admin) e INTEGRATION_SECRET_KEYS (aqui)
+ * são dois mapas hardcoded que precisam ficar em sincronia manual. Se um campo
+ * sensível do form não estiver no allowlist, ele é gravado NO BANCO EM TEXTO
+ * CLARO — sem erro, sem aviso.
+ *
+ * Esse sync já derrapou antes (o docblock do .secrets.ts apontava para um
+ * arquivo onde PROVIDER_FIELDS não existe mais). Este teste transforma o
+ * combinado em falha de CI.
+ *
+ * Lê o fonte do admin em vez de importá-lo: o arquivo é um componente React/TSX
+ * com imports de UI que não carregam sob o jest de backend.
+ */
+const SHEET_PATH = join(
+  __dirname,
+  '../../../../apps/admin/src/components/integration-profile/integration-profile-sheet.tsx',
+);
+
+/** Extrai { providerSlug: [chaves sensíveis] } do PROVIDER_FIELDS do admin. */
+function parseSensitiveFieldsFromAdmin(): Record<string, string[]> {
+  const source = readFileSync(SHEET_PATH, 'utf8');
+
+  const start = source.indexOf('const PROVIDER_FIELDS');
+  expect(start).toBeGreaterThan(-1);
+
+  // Vai até o fecho do objeto no nível zero: `\n};`
+  const end = source.indexOf('\n};', start);
+  expect(end).toBeGreaterThan(start);
+
+  const block = source.slice(start, end);
+  const result: Record<string, string[]> = {};
+
+  // Cada provider começa com `  slug: [` ou `  'slug': [` na indentação de 2.
+  const providerRegex = /\n {2}'?([a-z0-9_-]+)'?: \[/g;
+  const providers: Array<{ slug: string; from: number }> = [];
+  let match: RegExpExecArray | null;
+
+  while ((match = providerRegex.exec(block)) !== null) {
+    providers.push({ slug: match[1], from: match.index });
+  }
+
+  providers.forEach((provider, index) => {
+    const chunk = block.slice(
+      provider.from,
+      index + 1 < providers.length ? providers[index + 1].from : block.length,
+    );
+
+    const fields: string[] = [];
+    // Cada field é um objeto com key e type; casa os dois em qualquer ordem.
+    const fieldRegex = /key:\s*'([^']+)'[\s\S]*?type:\s*'([^']+)'/g;
+    let fieldMatch: RegExpExecArray | null;
+
+    while ((fieldMatch = fieldRegex.exec(chunk)) !== null) {
+      const [, key, type] = fieldMatch;
+      if (type === 'password' || type === 'file') {
+        fields.push(key);
+      }
+    }
+
+    result[provider.slug] = fields;
+  });
+
+  return result;
+}
+
+describe('INTEGRATION_SECRET_KEYS is in sync with the admin form', () => {
+  const adminSensitive = parseSensitiveFieldsFromAdmin();
+
+  it('parses the admin PROVIDER_FIELDS map', () => {
+    // Se o parser quebrar, o resto passaria vacuamente. Fixa um piso conhecido.
+    expect(Object.keys(adminSensitive).length).toBeGreaterThan(5);
+    expect(adminSensitive.smtp).toContain('password');
+  });
+
+  it.each(Object.entries(adminSensitive).filter(([, fields]) => fields.length))(
+    'provider "%s" has every password/file field in the allowlist',
+    (providerSlug, fields) => {
+      const allowlisted = getSensitiveConfigKeys(providerSlug);
+      const missing = (fields as string[]).filter((key) => !allowlisted.includes(key));
+
+      // Uma chave listada aqui seria gravada em texto claro no banco.
+      expect(missing).toEqual([]);
+    },
+  );
+
+  it('keeps the A1 certificate and its password encrypted', () => {
+    // O caso que mais dói: quem tem o PFX + a senha emite nota como a empresa.
+    expect(getSensitiveConfigKeys('nfse-national')).toEqual(
+      expect.arrayContaining(['certificate_pfx_base64', 'certificate_password']),
+    );
+  });
+
+  it('does not treat public keys as secrets', () => {
+    // site_key/public_key/access_key_id contêm "key" mas são públicos. Cifrá-los
+    // por heurística de nome quebraria integrações silenciosamente.
+    expect(getSensitiveConfigKeys('recaptcha')).not.toContain('site_key');
+    expect(getSensitiveConfigKeys('s3')).not.toContain('access_key_id');
+  });
+
+  it('returns an empty list for an unknown provider', () => {
+    expect(getSensitiveConfigKeys('does-not-exist')).toEqual([]);
+  });
+
+  it('has no duplicate keys per provider', () => {
+    for (const [slug, keys] of Object.entries(INTEGRATION_SECRET_KEYS)) {
+      expect(new Set(keys).size).toBe(keys.length);
+    }
+  });
+});

package/src/integration-profile/integration-profile.secrets.ts

@@ -4,8 +4,12 @@
  * SEGURANÇA-CRÍTICO: este mapa é a fonte única de verdade do que é cifrado em repouso
  * (integration-credential-crypto.service) e mascarado na exportação/UI. Qualquer chave
  * esquecida aqui NÃO será cifrada. Deve ser mantido em sincronia com os campos
- * `type: 'password'` do form do admin (PROVIDER_FIELDS em
- * apps/admin/src/app/(app)/(libraries)/core/integration/profiles/page.tsx).
+ * `type: 'password'` e `type: 'file'` do form do admin (PROVIDER_FIELDS em
+ * apps/admin/src/components/integration-profile/integration-profile-sheet.tsx).
+ *
+ * O sync é manual e já derrapou uma vez (este comentário apontava para um arquivo
+ * onde PROVIDER_FIELDS não existe mais). Por isso existe um teste que falha se um
+ * campo sensível do form não tiver entrada aqui: integration-profile.secrets.spec.ts.
  *
  * Não usar heurística por nome de chave: campos públicos como `site_key`, `public_key` e
  * `access_key_id` contêm "key" mas NÃO são segredos.
@@ -15,6 +19,7 @@ export const INTEGRATION_SECRET_KEYS: Record<string, string[]> = {
   smtp: ['password'],
   gmail: ['client_secret', 'refresh_token'],
   ses: ['secret_access_key'],
+  resend: ['api_token', 'webhook_secret'],
   // Mensageria
   'evolution-api': ['token'],
   'whatsapp-official': ['access_token'],
@@ -47,6 +52,10 @@ export const INTEGRATION_SECRET_KEYS: Record<string, string[]> = {
   // Infraestrutura (autoscaling)
   digitalocean: ['api_token'],
   kubernetes: ['token', 'ca_cert'],
+  // Fiscal
+  // O certificado A1 é a chave privada da empresa: quem tem o PFX + a senha
+  // emite nota em nome dela. Os dois DEVEM estar aqui.
+  'nfse-national': ['certificate_pfx_base64', 'certificate_password'],
 };
 
 /** Chaves sensíveis de um provider (vazio se desconhecido). */

package/src/integration-profile/integration-profile.service.ts

@@ -472,6 +472,25 @@ export class IntegrationProfileService {
       ) as Record<string, unknown>;
     }
 
+    // Resend não usa SMTP/from_email: valida credenciais/domínio próprios.
+    if (provider.slug === 'resend') {
+      const resendCfg = (effectiveConfig as Record<string, unknown> | null) ?? {};
+      const apiToken = String(resendCfg.api_token ?? '').trim();
+      const domain = String(resendCfg.domain ?? '').trim();
+
+      if (!apiToken) {
+        throw new BadRequestException('Resend API token is required.');
+      }
+      if (!domain) {
+        throw new BadRequestException('Resend sending domain is required.');
+      }
+
+      return {
+        success: true,
+        destination: domain,
+      };
+    }
+
     buildMailConfigFromIntegration(provider.slug, effectiveConfig);
 
     const destination = String(

package/src/integration-profile/integration-profile.utils.ts

@@ -38,11 +38,51 @@ export function buildMailConfigFromIntegration(
         secretAccessKey: String(cfg.secret_access_key ?? ''),
         from: String(cfg.from_email ?? ''),
       };
+    case 'resend':
+      // Resend usa a API HTTP própria (não nodemailer). Retornamos um marcador
+      // tipado para os consumidores ramificarem; o inbox usa
+      // `buildResendConfigFromIntegration` diretamente.
+      return {
+        global: true,
+        type: 'RESEND' as const,
+        apiToken: String(cfg.api_token ?? ''),
+        domain: String(cfg.domain ?? ''),
+        region: String(cfg.region ?? ''),
+        from: String(cfg.from_email ?? ''),
+      };
     default:
       throw new BadRequestException(`Unsupported mail provider: ${providerSlug}`);
   }
 }
 
+export type ResendIntegrationConfig = {
+  apiToken: string;
+  domain: string;
+  region?: string;
+  webhookSecret?: string;
+  providerDomainId?: string;
+  fromName?: string;
+};
+
+/** Maps an integration_profile config JSON to the Resend credentials/domain. */
+export function buildResendConfigFromIntegration(
+  config: unknown,
+): ResendIntegrationConfig {
+  const cfg = (config as Cfg) ?? {};
+  return {
+    apiToken: String(cfg.api_token ?? '').trim(),
+    domain: String(cfg.domain ?? '').trim(),
+    ...(cfg.region ? { region: String(cfg.region).trim() } : {}),
+    ...(cfg.webhook_secret
+      ? { webhookSecret: String(cfg.webhook_secret).trim() }
+      : {}),
+    ...(cfg.provider_domain_id
+      ? { providerDomainId: String(cfg.provider_domain_id).trim() }
+      : {}),
+    ...(cfg.from_name ? { fromName: String(cfg.from_name).trim() } : {}),
+  };
+}
+
 export function getFromAddress(config: unknown): string {
   const cfg = (config as Cfg) ?? {};
   const fromEmail = String(cfg.from_email ?? '');

package/src/mcp/decorators/allow-mcp-token.decorator.ts

@@ -1,7 +1,7 @@
-import { SetMetadata } from '@nestjs/common';
-
-export const ALLOW_MCP_TOKEN = 'allowMcpToken';
-
-export function AllowMcpToken() {
-  return SetMetadata(ALLOW_MCP_TOKEN, true);
-}
+import { SetMetadata } from '@nestjs/common';
+
+export const ALLOW_MCP_TOKEN = 'allowMcpToken';
+
+export function AllowMcpToken() {
+  return SetMetadata(ALLOW_MCP_TOKEN, true);
+}

package/src/oauth/interfaces/OAuthProvider.ts

@@ -1,5 +1,9 @@
 export interface OAuthProvider {
-  getAuthUrl(callbackPath: string): Promise<string>;
+  getAuthUrl(
+    callbackPath: string,
+    flow?: 'login' | 'register' | 'connect',
+    app?: string,
+  ): Promise<string>;
   getProfile(code: string, type?: string, redirectUri?: string): Promise<any>;
   getProviderType(): string;
 }

package/src/oauth/oauth.controller.ts

@@ -97,6 +97,95 @@ export class OAuthController {
     return res.redirect(redirectURL);
   }
 
+  /**
+   * Server-side bounce for Microsoft Entra ID. Entra's authorization `code` is ~2KB
+   * (forced `offline_access`), which trips front-end ingress buffers when forwarded
+   * in an app URL. So Entra's web `redirect_uri` points here: we exchange the code
+   * server-side and redirect the browser to the initiating app with only a short
+   * single-use `ref` (never the giant code).
+   */
+  @Public()
+  @Get('microsoft-entra-id/callback')
+  async microsoftEntraIdCallback(
+    @Query('code') code: string,
+    @Query('state') state: string,
+    @Headers('user-agent') userAgent: string,
+    @Ip() ipAddress: string,
+    @Res() res,
+  ) {
+    this.logOAuthRequest('callback-web-ref', 'microsoft-entra-id', {
+      ipAddress,
+      userAgent,
+      code,
+    });
+
+    const forward = await this.service.resolveWebForward(state);
+    const flow = (forward?.flow ?? 'login') as 'login' | 'register' | 'connect';
+    const { url: frontendURL = '' } = await this.settingService.getSettingValues(['url']);
+    const base = forward?.origin || frontendURL;
+
+    const ref = await this.service.beginWebRefCallback({
+      provider: 'microsoft-entra-id' as user_account_provider_52222e2ecb_enum,
+      code,
+      state,
+      flow,
+      appOrigin: forward?.origin ?? null,
+    });
+
+    return res.redirect(
+      `${base}/callback/microsoft-entra-id/${flow}?ref=${encodeURIComponent(ref)}`,
+    );
+  }
+
+  /** Redeems a login/register `ref` from the Entra server-side bounce (public). */
+  @Public()
+  @Get('microsoft-entra-id/redeem')
+  async microsoftEntraIdRedeem(
+    @Locale() locale: string,
+    @Ip() ipAddress: string,
+    @Headers('user-agent') userAgent: string,
+    @Headers('origin') origin: string,
+    @Headers('referer') referer: string,
+    @Query('ref') ref: string,
+    @Res({ passthrough: true }) res,
+  ) {
+    return this.service.redeemWebRef({
+      res,
+      ref,
+      provider: 'microsoft-entra-id' as user_account_provider_52222e2ecb_enum,
+      locale,
+      ipAddress,
+      userAgent,
+      requestOrigin: origin,
+      requestReferer: referer,
+    });
+  }
+
+  /** Redeems a connect `ref` (authenticated: connect binds to the current user). */
+  @Get('microsoft-entra-id/redeem/connect')
+  async microsoftEntraIdRedeemConnect(
+    @Locale() locale: string,
+    @Ip() ipAddress: string,
+    @Headers('user-agent') userAgent: string,
+    @Headers('origin') origin: string,
+    @Headers('referer') referer: string,
+    @User() { id },
+    @Query('ref') ref: string,
+    @Res({ passthrough: true }) res,
+  ) {
+    return this.service.redeemWebRef({
+      res,
+      ref,
+      provider: 'microsoft-entra-id' as user_account_provider_52222e2ecb_enum,
+      locale,
+      ipAddress,
+      userAgent,
+      userId: id,
+      requestOrigin: origin,
+      requestReferer: referer,
+    });
+  }
+
   @Public()
   @Get(':provider/login')
   async login(