@hed-hog/core 0.0.385 → 0.0.386

package/hedhog/frontend/messages/en.json

@@ -1399,6 +1399,7 @@
     "shareDashboardError": "Could not share the dashboard.",
     "shareRemoved": "Sharing removed.",
     "revokeShareError": "Could not remove the sharing.",
+    "tabActions": "Tab actions",
     "addWidgets": "Add widgets",
     "setAsHome": "Set as home",
     "rename": "Rename",
@@ -2425,6 +2426,7 @@
     "fieldAccessKeyId": "Access Key ID",
     "fieldSecretAccessKey": "Secret Access Key",
     "fieldRegion": "Region",
+    "fieldDomain": "Domain",
     "fieldToken": "Token",
     "fieldInstanceName": "Instance Name",
     "fieldPhoneNumberId": "Phone Number ID",
@@ -2481,6 +2483,36 @@
     "nodePoolPlaceholder": "Select a node pool",
     "nodePoolNoneFound": "No node pools found for this cluster.",
     "nodePoolLoadError": "Failed to load node pools. Check the API token and cluster ID.",
-    "nodePoolNeedCreds": "Fill in the API token and cluster ID first, then load the pools."
+    "nodePoolNeedCreds": "Fill in the API token and cluster ID first, then load the pools.",
+    "fieldEnvironment": "Environment",
+    "optionHomologation": "Homologation (testing)",
+    "optionProduction": "Production (real invoices)",
+    "fieldTaxId": "Issuer tax ID (CNPJ)",
+    "fieldLegalName": "Legal name",
+    "fieldTradeName": "Trade name",
+    "fieldMunicipalRegistration": "Municipal registration",
+    "fieldIbgeCityCode": "IBGE city code",
+    "fieldAddressStreet": "Street",
+    "fieldAddressNumber": "Number",
+    "fieldAddressComplement": "Complement",
+    "fieldAddressDistrict": "District",
+    "fieldAddressZip": "ZIP code",
+    "fieldAddressState": "State",
+    "fieldEmail": "Email",
+    "fieldPhone": "Phone",
+    "fieldTaxRegime": "Tax regime",
+    "optionSimplesNacional": "Simples Nacional",
+    "optionSimplesNacionalExcesso": "Simples Nacional (over the cap)",
+    "optionRegimeNormal": "Regular regime",
+    "optionMei": "MEI",
+    "fieldSpecialTaxRegime": "Special tax regime",
+    "fieldCulturalIncentive": "Cultural incentive",
+    "fieldCertificatePfx": "A1 certificate (.pfx/.p12)",
+    "fieldCertificatePassword": "Certificate password",
+    "fieldBaseUrl": "API base URL",
+    "fieldTimeoutMs": "Timeout (ms)",
+    "fieldMaxRetries": "Max retries",
+    "fileStored": "A file is stored and encrypted. Click to replace it.",
+    "fileSelected": "New file selected. It will be encrypted on save."
   }
 }

package/hedhog/frontend/messages/pt.json

@@ -1402,6 +1402,7 @@
     "shareDashboardError": "Não foi possível compartilhar o dashboard.",
     "shareRemoved": "Compartilhamento removido.",
     "revokeShareError": "Não foi possível remover o compartilhamento.",
+    "tabActions": "Ações da aba",
     "addWidgets": "Adicionar widgets",
     "setAsHome": "Definir como home",
     "rename": "Renomear",
@@ -2480,6 +2481,7 @@
     "fieldAccessKeyId": "Access Key ID",
     "fieldSecretAccessKey": "Secret Access Key",
     "fieldRegion": "Região",
+    "fieldDomain": "Domínio",
     "fieldToken": "Token",
     "fieldInstanceName": "Nome da Instância",
     "fieldPhoneNumberId": "ID do Número de Telefone",
@@ -2536,6 +2538,36 @@
     "nodePoolPlaceholder": "Selecione um node pool",
     "nodePoolNoneFound": "Nenhum node pool encontrado para este cluster.",
     "nodePoolLoadError": "Falha ao carregar os node pools. Verifique o token da API e o ID do cluster.",
-    "nodePoolNeedCreds": "Preencha o token da API e o ID do cluster primeiro, depois carregue os pools."
+    "nodePoolNeedCreds": "Preencha o token da API e o ID do cluster primeiro, depois carregue os pools.",
+    "fieldEnvironment": "Ambiente",
+    "optionHomologation": "Homologação (testes)",
+    "optionProduction": "Produção (notas reais)",
+    "fieldTaxId": "CNPJ do emitente",
+    "fieldLegalName": "Razão social",
+    "fieldTradeName": "Nome fantasia",
+    "fieldMunicipalRegistration": "Inscrição municipal",
+    "fieldIbgeCityCode": "Código IBGE do município",
+    "fieldAddressStreet": "Logradouro",
+    "fieldAddressNumber": "Número",
+    "fieldAddressComplement": "Complemento",
+    "fieldAddressDistrict": "Bairro",
+    "fieldAddressZip": "CEP",
+    "fieldAddressState": "Estado",
+    "fieldEmail": "E-mail",
+    "fieldPhone": "Telefone",
+    "fieldTaxRegime": "Regime tributário",
+    "optionSimplesNacional": "Simples Nacional",
+    "optionSimplesNacionalExcesso": "Simples Nacional (excesso de sublimite)",
+    "optionRegimeNormal": "Regime normal",
+    "optionMei": "MEI",
+    "fieldSpecialTaxRegime": "Regime especial de tributação",
+    "fieldCulturalIncentive": "Incentivador cultural",
+    "fieldCertificatePfx": "Certificado A1 (.pfx/.p12)",
+    "fieldCertificatePassword": "Senha do certificado",
+    "fieldBaseUrl": "URL base da API",
+    "fieldTimeoutMs": "Timeout (ms)",
+    "fieldMaxRetries": "Máximo de tentativas",
+    "fileStored": "Arquivo armazenado e cifrado. Clique para substituir.",
+    "fileSelected": "Novo arquivo selecionado. Será cifrado ao salvar."
   }
 }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@hed-hog/core",
-  "version": "0.0.385",
+  "version": "0.0.386",
   "license": "MIT",
   "main": "dist/index.js",
   "types": "dist/index.d.ts",
@@ -41,11 +41,11 @@
     "speakeasy": "^2.0.0",
     "ua-parser-js": "^2.0.10",
     "uuid": "^11.1.0",
-    "@hed-hog/api-prisma": "0.0.6",
-    "@hed-hog/api-locale": "0.0.14",
+    "@hed-hog/api-mail": "0.0.9",
     "@hed-hog/api-types": "0.0.1",
+    "@hed-hog/api-prisma": "0.0.6",
     "@hed-hog/api": "0.0.8",
-    "@hed-hog/api-mail": "0.0.9",
+    "@hed-hog/api-locale": "0.0.14",
     "@hed-hog/api-pagination": "0.0.7"
   },
   "exports": {
@@ -77,13 +77,18 @@
     "hedhog"
   ],
   "devDependencies": {
+    "@jest/globals": "^29.7.0",
     "@types/cookie-parser": "^1.4.10",
     "@types/express": "^4.17.24",
     "@types/geoip-lite": "^1.4.4",
+    "@types/jest": "^29.5.14",
     "@types/multer": "^2.0.0",
     "@types/pako": "^2.0.4",
     "@types/ua-parser-js": "^0.7.39",
-    "rimraf": "^6.1.0"
+    "jest": "^29.7.0",
+    "rimraf": "^6.1.0",
+    "ts-jest": "^29.2.5",
+    "@hed-hog/jest-config": "0.0.0"
   },
   "scripts": {
     "_dev": "pnpm build --watch",

package/src/app-command/app-command.registry.ts

@@ -3,6 +3,8 @@ import { Injectable } from '@nestjs/common';
 export interface AppCommandContext extends Record<string, unknown> {
   webhookBody?: unknown;
   webhookHeaders?: Record<string, unknown>;
+  /** Raw pre-parse request body, needed for byte-exact HMAC signature verification (e.g. Stripe). Undefined on replayed/retried calls. */
+  webhookRawBody?: Buffer;
   remoteIp?: string | null;
   publicUuid?: string;
   integrationId?: number;

package/src/auth/auth.controller.ts

@@ -28,6 +28,7 @@ import { LoginWithRecoveryCodeDTO } from './dto/login-with-recovery-code';
 import { LoginDTO } from './dto/login.dto';
 import { ResendMfaCodeDTO } from './dto/resend-mfa-code.dto';
 import { ResetDTO } from './dto/reset.dto';
+import { CompleteAccountDTO, VerifyAccountInviteDTO } from './dto/complete-account.dto';
 
 @Controller('auth')
 export class AuthController {
@@ -269,4 +270,24 @@ export class AuthController {
   ) {
     return this.service.forgotResetPassword(locale, password, code, ipAddress, userAgent);
   }
+
+  @Public()
+  @Post('complete-account/verify')
+  async verifyAccountInvite(
+    @Locale() locale: string,
+    @Body() { code }: VerifyAccountInviteDTO,
+  ) {
+    return this.service.verifyAccountInvite(locale, code);
+  }
+
+  @Public()
+  @Post('complete-account')
+  async completeAccount(
+    @Locale() locale: string,
+    @Body() { password, code, name }: CompleteAccountDTO,
+    @Ip() ipAddress: string,
+    @Headers('user-agent') userAgent: string,
+  ) {
+    return this.service.completeAccount(locale, { password, code, name }, ipAddress, userAgent);
+  }
 }

package/src/auth/auth.service.ts

@@ -558,6 +558,139 @@ export class AuthService {
     return { accessToken, refreshToken, session }
   }
 
+  /**
+   * Garante que exista um usuário com o identificador de email informado e cria
+   * um challenge seguro de criação de conta (link de convite). Não envia email —
+   * o remetente (ex.: LMS enterprise) monta o link e dispara o template. Reutiliza
+   * um usuário existente por `userId` ou pelo identificador de email; caso não
+   * exista, cria um novo usuário apenas com o nome.
+   */
+  async prepareAccountInvite(
+    locale: string,
+    { email, name, userId }: { email: string; name?: string; userId?: number },
+  ) {
+    const normalizedEmail = email.toLowerCase().trim();
+
+    let targetUserId = userId;
+    if (!targetUserId) {
+      const existing = await this.user.findUserByEmail(locale, normalizedEmail);
+      targetUserId = existing?.id;
+    }
+    if (!targetUserId) {
+      const createdUser = await this.prisma.user.create({
+        data: { name: name?.trim() || normalizedEmail },
+      });
+      targetUserId = createdUser.id;
+    }
+
+    let identifier = await this.prisma.user_identifier.findFirst({
+      where: { user_id: targetUserId, type: 'email', value: normalizedEmail },
+    });
+    if (!identifier) {
+      identifier = await this.prisma.user_identifier.create({
+        data: {
+          user_id: targetUserId,
+          type: 'email',
+          value: normalizedEmail,
+          enabled: true,
+        },
+      });
+    } else if (!identifier.enabled) {
+      identifier = await this.prisma.user_identifier.update({
+        where: { id: identifier.id },
+        data: { enabled: true },
+      });
+    }
+
+    const passwordCount = await this.prisma.user_credential.count({
+      where: {
+        user_id: targetUserId,
+        type: 'password',
+        revoked_at: null,
+      },
+    });
+
+    const token = await this.challenge.createAccountInviteChallenge(identifier.id);
+
+    return { userId: targetUserId, token, hasPassword: passwordCount > 0 };
+  }
+
+  /**
+   * Valida (sem consumir) um token de convite de criação de conta e retorna os
+   * dados básicos para pré-preencher o formulário no app de treinamentos.
+   */
+  async verifyAccountInvite(locale: string, code: string) {
+    const challenge = await this.challenge.verifyCodePassword(locale, code);
+    return {
+      valid: true,
+      name: challenge.user_identifier.user?.name ?? null,
+      email: challenge.user_identifier.value,
+    };
+  }
+
+  /**
+   * Conclui a criação de conta a partir de um token de convite: cria/atualiza a
+   * credencial de senha, marca o identificador como verificado, atualiza o nome
+   * (se enviado), consome o challenge e autentica o usuário (auto-login).
+   */
+  async completeAccount(
+    locale: string,
+    { password, code, name }: { password: string; code: string; name?: string },
+    ipAddress: string,
+    userAgent: string,
+  ) {
+    const challenge = await this.challenge.verifyCodePassword(locale, code);
+    const userIdentifier = challenge.user_identifier;
+    const passwordHash = await this.security.hashArgon2(password);
+
+    const existingCredential = await this.prisma.user_credential.findFirst({
+      where: { user_id: userIdentifier.user_id, type: 'password' },
+    });
+
+    if (existingCredential) {
+      await this.prisma.user_credential.updateMany({
+        where: { user_id: userIdentifier.user_id, type: 'password' },
+        data: { hash: passwordHash, requires_reset: false, revoked_at: null },
+      });
+    } else {
+      await this.prisma.user_credential.create({
+        data: {
+          user_id: userIdentifier.user_id,
+          type: 'password',
+          hash: passwordHash,
+        },
+      });
+    }
+
+    await this.prisma.user_identifier.update({
+      where: { id: userIdentifier.id },
+      data: { verified_at: new Date(), enabled: true },
+    });
+
+    if (name?.trim()) {
+      await this.prisma.user.update({
+        where: { id: userIdentifier.user_id },
+        data: { name: name.trim() },
+      });
+    }
+
+    // Consome o challenge para impedir reuso do link (invites têm validade longa).
+    await this.prisma.user_identifier_challenge.updateMany({
+      where: { id: challenge.id },
+      data: { verified_at: new Date(), expires_at: new Date() },
+    });
+
+    const { accessToken, refreshToken, session } =
+      await this.getAuthenticationPayload(
+        locale,
+        userIdentifier.user_id,
+        ipAddress,
+        userAgent,
+      );
+    await this.user.registerUserActivity(userIdentifier.id, 'completeAccount');
+    return { accessToken, refreshToken, session };
+  }
+
   async verifyMfaCode(locale: string, mfaToken: string, code: string, ipAddress: string, userAgent: string, methodType?: 'totp' | 'email' | 'recovery', browserId?: string | null) {
     const payload = await this.token.verifyMfaChallengeToken(mfaToken);
     const user = await this.prisma.user.findUnique({

package/src/auth/dto/complete-account.dto.ts

@@ -0,0 +1,24 @@
+import { getLocaleText } from '@hed-hog/api-locale';
+import { IsNotEmpty, IsOptional, IsString, MinLength } from 'class-validator';
+
+export class CompleteAccountDTO {
+  @IsNotEmpty({
+    message: (args) => getLocaleText('reset.password.required', args.value),
+  })
+  @MinLength(8, {
+    message: (args) => getLocaleText('reset.password.minLength', args.value),
+  })
+  password: string;
+
+  @IsNotEmpty({ message: (args) => getLocaleText('reset.code.required', args.value) })
+  code: string;
+
+  @IsOptional()
+  @IsString()
+  name?: string;
+}
+
+export class VerifyAccountInviteDTO {
+  @IsNotEmpty({ message: (args) => getLocaleText('reset.code.required', args.value) })
+  code: string;
+}

package/src/authorize/authorize.controller.ts

@@ -0,0 +1,99 @@
+import { NoRole, Public, User } from '@hed-hog/api';
+import { Locale } from '@hed-hog/api-locale';
+import {
+  Body,
+  Controller,
+  Get,
+  Headers,
+  Inject,
+  Ip,
+  Post,
+  Query,
+  UseGuards,
+  forwardRef,
+} from '@nestjs/common';
+import { Throttle, ThrottlerGuard } from '@nestjs/throttler';
+import { AuthorizeService } from './authorize.service';
+import { AuthorizeInfoDTO } from './dto/authorize-info.dto';
+import { ConsentDTO } from './dto/consent.dto';
+import { TokenDTO } from './dto/token.dto';
+
+/**
+ * Endpoints do fluxo Authorization Code + PKCE.
+ *
+ * Note o que NÃO existe aqui: um `GET /auth/authorize` que redireciona. O
+ * redirect final é feito pelo browser, na página de consent do admin, depois do
+ * POST /auth/authorize/consent. Assim toda a validação fica no servidor e o
+ * `code` não passa pelo mecanismo de redirect do Nest (nem pelos seus logs).
+ */
+@Controller('auth')
+export class AuthorizeController {
+  constructor(
+    @Inject(forwardRef(() => AuthorizeService))
+    private readonly service: AuthorizeService,
+  ) {}
+
+  /**
+   * Metadados para a tela de consent. Público: a página precisa validar os
+   * parâmetros e mostrar de quem é o app ANTES de exigir login.
+   */
+  @Public()
+  @UseGuards(ThrottlerGuard)
+  @Throttle({ default: { limit: 30, ttl: 60000 } })
+  @Get('authorize/info')
+  async authorizeInfo(@Query() query: AuthorizeInfoDTO) {
+    return this.service.getAuthorizationInfo({
+      clientId: query.client_id,
+      redirectUri: query.redirect_uri,
+      scope: query.scope,
+      codeChallenge: query.code_challenge,
+      codeChallengeMethod: query.code_challenge_method,
+    });
+  }
+
+  /** O usuário logado aprova. O code sai vinculado a ele. */
+  @NoRole()
+  @UseGuards(ThrottlerGuard)
+  @Throttle({ default: { limit: 10, ttl: 60000 } })
+  @Post('authorize/consent')
+  async consent(@User() { id }, @Body() body: ConsentDTO) {
+    const code = await this.service.issueCode({
+      userId: id,
+      clientId: body.client_id,
+      redirectUri: body.redirect_uri,
+      scope: body.scope,
+      codeChallenge: body.code_challenge,
+      codeChallengeMethod: body.code_challenge_method,
+    });
+
+    return { code };
+  }
+
+  /**
+   * Troca o code por tokens. Público por definição (o cliente ainda não tem
+   * token) — quem autentica é a posse do code + do code_verifier.
+   *
+   * Sem @Res() e sem cookie `rt`: o refreshToken vai no body. Um Set-Cookie aqui
+   * seria ruído para um cliente não-browser e um vetor de CSRF a mais.
+   */
+  @Public()
+  @UseGuards(ThrottlerGuard)
+  @Throttle({ default: { limit: 20, ttl: 60000 } })
+  @Post('token')
+  async token(
+    @Body() body: TokenDTO,
+    @Locale() locale: string,
+    @Ip() ipAddress: string,
+    @Headers('user-agent') userAgent: string,
+  ) {
+    return this.service.exchangeCode({
+      code: body.code,
+      codeVerifier: body.code_verifier,
+      clientId: body.client_id,
+      redirectUri: body.redirect_uri,
+      locale,
+      ipAddress,
+      userAgent,
+    });
+  }
+}

package/src/authorize/authorize.module.ts

@@ -0,0 +1,23 @@
+import { PrismaModule } from '@hed-hog/api-prisma';
+import { Module, forwardRef } from '@nestjs/common';
+import { AuthModule } from '../auth/auth.module';
+import { SecurityModule } from '../security/security.module';
+import { AuthorizeController } from './authorize.controller';
+import { AuthorizeService } from './authorize.service';
+
+/**
+ * Separado de OAuthModule de propósito: lá o HedHog é *client* de IdPs externos
+ * (Google, Apple...). Aqui ele é o *provider*. Misturar os dois confundiria dois
+ * papéis opostos no mesmo arquivo.
+ */
+@Module({
+  imports: [
+    forwardRef(() => PrismaModule),
+    forwardRef(() => SecurityModule),
+    forwardRef(() => AuthModule),
+  ],
+  controllers: [AuthorizeController],
+  providers: [AuthorizeService],
+  exports: [AuthorizeService],
+})
+export class AuthorizeModule {}