@hed-hog/core 0.0.385 → 0.0.387

package/src/index.ts

@@ -45,6 +45,7 @@ export * from './webhook-integration/event-webhook.service';
 export * from './webhook-integration/integration-event-catalog.service';
 export * from './webhook-integration/webhook-integration.module';
 export * from './webhook-integration/webhook-integration.service';
+export * from './webhook-integration/webhook-protocol.registry';
 
 // Integration Module
 export * from './integration/integration.module';

package/src/integration-profile/integration-profile.secrets.spec.ts

@@ -0,0 +1,114 @@
+import { describe, expect, it } from '@jest/globals';
+import { readFileSync } from 'node:fs';
+import { join } from 'node:path';
+import { INTEGRATION_SECRET_KEYS, getSensitiveConfigKeys } from './integration-profile.secrets';
+
+/**
+ * TRAVA DE SEGURANÇA: PROVIDER_FIELDS (admin) e INTEGRATION_SECRET_KEYS (aqui)
+ * são dois mapas hardcoded que precisam ficar em sincronia manual. Se um campo
+ * sensível do form não estiver no allowlist, ele é gravado NO BANCO EM TEXTO
+ * CLARO — sem erro, sem aviso.
+ *
+ * Esse sync já derrapou antes (o docblock do .secrets.ts apontava para um
+ * arquivo onde PROVIDER_FIELDS não existe mais). Este teste transforma o
+ * combinado em falha de CI.
+ *
+ * Lê o fonte do admin em vez de importá-lo: o arquivo é um componente React/TSX
+ * com imports de UI que não carregam sob o jest de backend.
+ */
+const SHEET_PATH = join(
+  __dirname,
+  '../../../../apps/admin/src/components/integration-profile/integration-profile-sheet.tsx',
+);
+
+/** Extrai { providerSlug: [chaves sensíveis] } do PROVIDER_FIELDS do admin. */
+function parseSensitiveFieldsFromAdmin(): Record<string, string[]> {
+  const source = readFileSync(SHEET_PATH, 'utf8');
+
+  const start = source.indexOf('const PROVIDER_FIELDS');
+  expect(start).toBeGreaterThan(-1);
+
+  // Vai até o fecho do objeto no nível zero: `\n};`
+  const end = source.indexOf('\n};', start);
+  expect(end).toBeGreaterThan(start);
+
+  const block = source.slice(start, end);
+  const result: Record<string, string[]> = {};
+
+  // Cada provider começa com `  slug: [` ou `  'slug': [` na indentação de 2.
+  const providerRegex = /\n {2}'?([a-z0-9_-]+)'?: \[/g;
+  const providers: Array<{ slug: string; from: number }> = [];
+  let match: RegExpExecArray | null;
+
+  while ((match = providerRegex.exec(block)) !== null) {
+    providers.push({ slug: match[1], from: match.index });
+  }
+
+  providers.forEach((provider, index) => {
+    const chunk = block.slice(
+      provider.from,
+      index + 1 < providers.length ? providers[index + 1].from : block.length,
+    );
+
+    const fields: string[] = [];
+    // Cada field é um objeto com key e type; casa os dois em qualquer ordem.
+    const fieldRegex = /key:\s*'([^']+)'[\s\S]*?type:\s*'([^']+)'/g;
+    let fieldMatch: RegExpExecArray | null;
+
+    while ((fieldMatch = fieldRegex.exec(chunk)) !== null) {
+      const [, key, type] = fieldMatch;
+      if (type === 'password' || type === 'file') {
+        fields.push(key);
+      }
+    }
+
+    result[provider.slug] = fields;
+  });
+
+  return result;
+}
+
+describe('INTEGRATION_SECRET_KEYS is in sync with the admin form', () => {
+  const adminSensitive = parseSensitiveFieldsFromAdmin();
+
+  it('parses the admin PROVIDER_FIELDS map', () => {
+    // Se o parser quebrar, o resto passaria vacuamente. Fixa um piso conhecido.
+    expect(Object.keys(adminSensitive).length).toBeGreaterThan(5);
+    expect(adminSensitive.smtp).toContain('password');
+  });
+
+  it.each(Object.entries(adminSensitive).filter(([, fields]) => fields.length))(
+    'provider "%s" has every password/file field in the allowlist',
+    (providerSlug, fields) => {
+      const allowlisted = getSensitiveConfigKeys(providerSlug);
+      const missing = (fields as string[]).filter((key) => !allowlisted.includes(key));
+
+      // Uma chave listada aqui seria gravada em texto claro no banco.
+      expect(missing).toEqual([]);
+    },
+  );
+
+  it('keeps the A1 certificate and its password encrypted', () => {
+    // O caso que mais dói: quem tem o PFX + a senha emite nota como a empresa.
+    expect(getSensitiveConfigKeys('nfse-national')).toEqual(
+      expect.arrayContaining(['certificate_pfx_base64', 'certificate_password']),
+    );
+  });
+
+  it('does not treat public keys as secrets', () => {
+    // site_key/public_key/access_key_id contêm "key" mas são públicos. Cifrá-los
+    // por heurística de nome quebraria integrações silenciosamente.
+    expect(getSensitiveConfigKeys('recaptcha')).not.toContain('site_key');
+    expect(getSensitiveConfigKeys('s3')).not.toContain('access_key_id');
+  });
+
+  it('returns an empty list for an unknown provider', () => {
+    expect(getSensitiveConfigKeys('does-not-exist')).toEqual([]);
+  });
+
+  it('has no duplicate keys per provider', () => {
+    for (const [slug, keys] of Object.entries(INTEGRATION_SECRET_KEYS)) {
+      expect(new Set(keys).size).toBe(keys.length);
+    }
+  });
+});

package/src/integration-profile/integration-profile.secrets.ts

@@ -4,8 +4,12 @@
  * SEGURANÇA-CRÍTICO: este mapa é a fonte única de verdade do que é cifrado em repouso
  * (integration-credential-crypto.service) e mascarado na exportação/UI. Qualquer chave
  * esquecida aqui NÃO será cifrada. Deve ser mantido em sincronia com os campos
- * `type: 'password'` do form do admin (PROVIDER_FIELDS em
- * apps/admin/src/app/(app)/(libraries)/core/integration/profiles/page.tsx).
+ * `type: 'password'` e `type: 'file'` do form do admin (PROVIDER_FIELDS em
+ * apps/admin/src/components/integration-profile/integration-profile-sheet.tsx).
+ *
+ * O sync é manual e já derrapou uma vez (este comentário apontava para um arquivo
+ * onde PROVIDER_FIELDS não existe mais). Por isso existe um teste que falha se um
+ * campo sensível do form não tiver entrada aqui: integration-profile.secrets.spec.ts.
  *
  * Não usar heurística por nome de chave: campos públicos como `site_key`, `public_key` e
  * `access_key_id` contêm "key" mas NÃO são segredos.
@@ -15,9 +19,12 @@ export const INTEGRATION_SECRET_KEYS: Record<string, string[]> = {
   smtp: ['password'],
   gmail: ['client_secret', 'refresh_token'],
   ses: ['secret_access_key'],
+  resend: ['api_token', 'webhook_secret'],
   // Mensageria
   'evolution-api': ['token'],
-  'whatsapp-official': ['access_token'],
+  // app_secret assina o HMAC do webhook (X-Hub-Signature-256) e verify_token é
+  // comparado no handshake da Meta: quem tem qualquer um dos dois forja eventos.
+  'whatsapp-official': ['access_token', 'app_secret', 'verify_token'],
   // Storage
   s3: ['secret_access_key'],
   gcs: ['key_file_json'],
@@ -47,6 +54,10 @@ export const INTEGRATION_SECRET_KEYS: Record<string, string[]> = {
   // Infraestrutura (autoscaling)
   digitalocean: ['api_token'],
   kubernetes: ['token', 'ca_cert'],
+  // Fiscal
+  // O certificado A1 é a chave privada da empresa: quem tem o PFX + a senha
+  // emite nota em nome dela. Os dois DEVEM estar aqui.
+  'nfse-national': ['certificate_pfx_base64', 'certificate_password'],
 };
 
 /** Chaves sensíveis de um provider (vazio se desconhecido). */

package/src/integration-profile/integration-profile.service.ts

@@ -9,7 +9,10 @@ import {
   forwardRef,
 } from '@nestjs/common';
 import * as pako from 'pako';
-import { buildMailConfigFromIntegration } from './integration-profile.utils';
+import {
+  buildMailConfigFromIntegration,
+  buildWhatsappOfficialConfigFromIntegration,
+} from './integration-profile.utils';
 import { CreateDTO } from './dto/create.dto';
 import {
   ConflictResolutionDTO,
@@ -451,9 +454,10 @@ export class IntegrationProfileService {
       );
     }
 
-    if (provider.integration_type.slug !== 'email') {
+    const typeSlug = provider.integration_type.slug;
+    if (typeSlug !== 'email' && typeSlug !== 'whatsapp') {
       throw new BadRequestException(
-        'Integration profile test is only available for email type.',
+        'Integration profile test is only available for email and whatsapp types.',
       );
     }
 
@@ -472,6 +476,33 @@ export class IntegrationProfileService {
       ) as Record<string, unknown>;
     }
 
+    if (typeSlug === 'whatsapp') {
+      return this.testWhatsappProfile(
+        provider.slug,
+        data.slug.trim(),
+        effectiveConfig,
+      );
+    }
+
+    // Resend não usa SMTP/from_email: valida credenciais/domínio próprios.
+    if (provider.slug === 'resend') {
+      const resendCfg = (effectiveConfig as Record<string, unknown> | null) ?? {};
+      const apiToken = String(resendCfg.api_token ?? '').trim();
+      const domain = String(resendCfg.domain ?? '').trim();
+
+      if (!apiToken) {
+        throw new BadRequestException('Resend API token is required.');
+      }
+      if (!domain) {
+        throw new BadRequestException('Resend sending domain is required.');
+      }
+
+      return {
+        success: true,
+        destination: domain,
+      };
+    }
+
     buildMailConfigFromIntegration(provider.slug, effectiveConfig);
 
     const destination = String(
@@ -489,6 +520,101 @@ export class IntegrationProfileService {
     };
   }
 
+  /**
+   * Valida um perfil whatsapp-official contra a Graph API (lê o WABA com o token)
+   * e registra o resultado no config. Nunca devolve o token/secret na resposta.
+   */
+  private async testWhatsappProfile(
+    providerSlug: string,
+    slug: string,
+    effectiveConfig: Record<string, unknown> | null,
+  ) {
+    if (providerSlug !== 'whatsapp-official') {
+      throw new BadRequestException(
+        `Integration profile test is not available for provider "${providerSlug}".`,
+      );
+    }
+
+    const cfg = buildWhatsappOfficialConfigFromIntegration(effectiveConfig);
+
+    if (!cfg.accessToken) {
+      throw new BadRequestException('WhatsApp access token is required.');
+    }
+    if (!cfg.wabaId) {
+      throw new BadRequestException('WhatsApp Business Account ID is required.');
+    }
+    if (!cfg.appSecret) {
+      throw new BadRequestException(
+        'Meta App Secret is required to validate webhook signatures.',
+      );
+    }
+    if (!cfg.verifyToken) {
+      throw new BadRequestException('Webhook verify token is required.');
+    }
+
+    const url = `https://graph.facebook.com/${cfg.graphApiVersion}/${encodeURIComponent(
+      cfg.wabaId,
+    )}?fields=id,name`;
+
+    let name = '';
+    let failure: string | null = null;
+    try {
+      const response = await fetch(url, {
+        headers: { Authorization: `Bearer ${cfg.accessToken}` },
+      });
+      const body = (await response.json().catch(() => ({}))) as {
+        name?: string;
+        error?: { message?: string };
+      };
+      if (!response.ok) {
+        // A mensagem da Meta não contém o token; ainda assim só propagamos o texto dela.
+        failure =
+          body?.error?.message ?? `Graph API returned HTTP ${response.status}.`;
+      } else {
+        name = String(body?.name ?? '');
+      }
+    } catch (error) {
+      failure = error instanceof Error ? error.message : 'Graph API is unreachable.';
+    }
+
+    await this.recordWhatsappValidation(providerSlug, slug, failure);
+
+    if (failure) {
+      throw new BadRequestException(`WhatsApp validation failed: ${failure}`);
+    }
+
+    return { success: true, destination: name || cfg.wabaId };
+  }
+
+  /** Grava metadados (não-secretos) da última validação no config do perfil. */
+  private async recordWhatsappValidation(
+    providerSlug: string,
+    slug: string,
+    failure: string | null,
+  ) {
+    const stored = await this.prismaService.integration_profile.findUnique({
+      where: { slug },
+      select: { id: true, config: true },
+    });
+    // Perfil ainda não salvo (teste no fluxo de criação): nada a registrar.
+    if (!stored) return;
+
+    // `stored.config` vem decifrado pelo middleware; recifra-mos ao gravar.
+    const plain = {
+      ...((stored.config as Record<string, unknown>) ?? {}),
+      last_validated_at: new Date().toISOString(),
+      last_validation_status: failure ? 'error' : 'ok',
+      last_error: failure ?? null,
+    };
+
+    await this.prismaService.integration_profile.update({
+      where: { id: stored.id },
+      data: {
+        config: this.credentialCrypto.encryptConfig(providerSlug, plain) as object,
+      },
+    });
+  }
+
   async exportProfiles({
     ids,
     includeSecrets = false,

package/src/integration-profile/integration-profile.utils.spec.ts

@@ -12,6 +12,8 @@ import {
   buildDigitalOceanConfigFromIntegration,
   buildKubernetesConfigFromIntegration,
   buildAiConfigFromIntegration,
+  buildWhatsappOfficialConfigFromIntegration,
+  DEFAULT_GRAPH_API_VERSION,
 } from './integration-profile.utils';
 
 describe('integration-profile.utils', () => {
@@ -329,4 +331,77 @@ describe('integration-profile.utils', () => {
       );
     });
   });
+
+  describe('buildWhatsappOfficialConfigFromIntegration', () => {
+    const fullConfig = {
+      app_id: '123456',
+      app_secret: 'secret',
+      business_id: 'BIZ',
+      waba_id: 'WABA',
+      access_token: 'token',
+      graph_api_version: 'v22.0',
+      verify_token: 'verify',
+      environment: 'test',
+    };
+
+    it('mapeia todos os campos do perfil', () => {
+      expect(buildWhatsappOfficialConfigFromIntegration(fullConfig)).toEqual({
+        appId: '123456',
+        appSecret: 'secret',
+        businessId: 'BIZ',
+        wabaId: 'WABA',
+        accessToken: 'token',
+        graphApiVersion: 'v22.0',
+        verifyToken: 'verify',
+        environment: 'test',
+      });
+    });
+
+    it('assume a versão default da Graph API quando ausente ou vazia', () => {
+      expect(
+        buildWhatsappOfficialConfigFromIntegration({ ...fullConfig, graph_api_version: '' })
+          .graphApiVersion,
+      ).toBe(DEFAULT_GRAPH_API_VERSION);
+      expect(
+        buildWhatsappOfficialConfigFromIntegration({}).graphApiVersion,
+      ).toBe(DEFAULT_GRAPH_API_VERSION);
+    });
+
+    it('assume production quando o ambiente não é "test"', () => {
+      // Default seguro: um ambiente inválido não deve virar sandbox silenciosamente.
+      expect(
+        buildWhatsappOfficialConfigFromIntegration({ environment: 'qualquer' })
+          .environment,
+      ).toBe('production');
+      expect(
+        buildWhatsappOfficialConfigFromIntegration({}).environment,
+      ).toBe('production');
+    });
+
+    it('omite business_id quando não informado (é opcional)', () => {
+      const result = buildWhatsappOfficialConfigFromIntegration({});
+      expect(result.businessId).toBeUndefined();
+    });
+
+    it('não quebra com config nulo e devolve campos vazios', () => {
+      expect(buildWhatsappOfficialConfigFromIntegration(null)).toMatchObject({
+        appId: '',
+        appSecret: '',
+        wabaId: '',
+        accessToken: '',
+        verifyToken: '',
+      });
+    });
+
+    it('remove espaços em volta dos segredos (copiar/colar do painel da Meta)', () => {
+      const result = buildWhatsappOfficialConfigFromIntegration({
+        access_token: '  token  ',
+        app_secret: ' secret ',
+        verify_token: ' verify ',
+      });
+      expect(result.accessToken).toBe('token');
+      expect(result.appSecret).toBe('secret');
+      expect(result.verifyToken).toBe('verify');
+    });
+  });
 });

package/src/integration-profile/integration-profile.utils.ts

@@ -38,11 +38,51 @@ export function buildMailConfigFromIntegration(
         secretAccessKey: String(cfg.secret_access_key ?? ''),
         from: String(cfg.from_email ?? ''),
       };
+    case 'resend':
+      // Resend usa a API HTTP própria (não nodemailer). Retornamos um marcador
+      // tipado para os consumidores ramificarem; o inbox usa
+      // `buildResendConfigFromIntegration` diretamente.
+      return {
+        global: true,
+        type: 'RESEND' as const,
+        apiToken: String(cfg.api_token ?? ''),
+        domain: String(cfg.domain ?? ''),
+        region: String(cfg.region ?? ''),
+        from: String(cfg.from_email ?? ''),
+      };
     default:
       throw new BadRequestException(`Unsupported mail provider: ${providerSlug}`);
   }
 }
 
+export type ResendIntegrationConfig = {
+  apiToken: string;
+  domain: string;
+  region?: string;
+  webhookSecret?: string;
+  providerDomainId?: string;
+  fromName?: string;
+};
+
+/** Maps an integration_profile config JSON to the Resend credentials/domain. */
+export function buildResendConfigFromIntegration(
+  config: unknown,
+): ResendIntegrationConfig {
+  const cfg = (config as Cfg) ?? {};
+  return {
+    apiToken: String(cfg.api_token ?? '').trim(),
+    domain: String(cfg.domain ?? '').trim(),
+    ...(cfg.region ? { region: String(cfg.region).trim() } : {}),
+    ...(cfg.webhook_secret
+      ? { webhookSecret: String(cfg.webhook_secret).trim() }
+      : {}),
+    ...(cfg.provider_domain_id
+      ? { providerDomainId: String(cfg.provider_domain_id).trim() }
+      : {}),
+    ...(cfg.from_name ? { fromName: String(cfg.from_name).trim() } : {}),
+  };
+}
+
 export function getFromAddress(config: unknown): string {
   const cfg = (config as Cfg) ?? {};
   const fromEmail = String(cfg.from_email ?? '');
@@ -58,6 +98,45 @@ export function getReplyToAddress(config: unknown): string | undefined {
   return replyToName ? `${replyToName} <${replyToEmail}>` : replyToEmail;
 }
 
+// ─── Messaging utilities ──────────────────────────────────────────────────────
+
+export const DEFAULT_GRAPH_API_VERSION = 'v21.0';
+
+export type WhatsappOfficialConfig = {
+  appId: string;
+  appSecret: string;
+  businessId?: string;
+  wabaId: string;
+  accessToken: string;
+  graphApiVersion: string;
+  verifyToken: string;
+  environment: 'test' | 'production';
+};
+
+/**
+ * Maps an integration_profile config JSON to the Meta WhatsApp Cloud API credentials.
+ *
+ * Os números não vêm daqui: um WABA pode ter vários e cada um tem estado próprio,
+ * então eles vivem na tabela whatsapp_phone_number (library whatsapp).
+ */
+export function buildWhatsappOfficialConfigFromIntegration(
+  config: unknown,
+): WhatsappOfficialConfig {
+  const cfg = (config as Cfg) ?? {};
+  const environment = String(cfg.environment ?? 'production').trim();
+  return {
+    appId: String(cfg.app_id ?? '').trim(),
+    appSecret: String(cfg.app_secret ?? '').trim(),
+    ...(cfg.business_id ? { businessId: String(cfg.business_id).trim() } : {}),
+    wabaId: String(cfg.waba_id ?? '').trim(),
+    accessToken: String(cfg.access_token ?? '').trim(),
+    graphApiVersion:
+      String(cfg.graph_api_version ?? '').trim() || DEFAULT_GRAPH_API_VERSION,
+    verifyToken: String(cfg.verify_token ?? '').trim(),
+    environment: environment === 'test' ? 'test' : 'production',
+  };
+}
+
 // ─── Storage utilities ────────────────────────────────────────────────────────
 
 /**

package/src/oauth/interfaces/OAuthProvider.ts

@@ -1,5 +1,9 @@
 export interface OAuthProvider {
-  getAuthUrl(callbackPath: string): Promise<string>;
+  getAuthUrl(
+    callbackPath: string,
+    flow?: 'login' | 'register' | 'connect',
+    app?: string,
+  ): Promise<string>;
   getProfile(code: string, type?: string, redirectUri?: string): Promise<any>;
   getProviderType(): string;
 }

package/src/oauth/oauth.controller.ts

@@ -97,6 +97,95 @@ export class OAuthController {
     return res.redirect(redirectURL);
   }
 
+  /**
+   * Server-side bounce for Microsoft Entra ID. Entra's authorization `code` is ~2KB
+   * (forced `offline_access`), which trips front-end ingress buffers when forwarded
+   * in an app URL. So Entra's web `redirect_uri` points here: we exchange the code
+   * server-side and redirect the browser to the initiating app with only a short
+   * single-use `ref` (never the giant code).
+   */
+  @Public()
+  @Get('microsoft-entra-id/callback')
+  async microsoftEntraIdCallback(
+    @Query('code') code: string,
+    @Query('state') state: string,
+    @Headers('user-agent') userAgent: string,
+    @Ip() ipAddress: string,
+    @Res() res,
+  ) {
+    this.logOAuthRequest('callback-web-ref', 'microsoft-entra-id', {
+      ipAddress,
+      userAgent,
+      code,
+    });
+
+    const forward = await this.service.resolveWebForward(state);
+    const flow = (forward?.flow ?? 'login') as 'login' | 'register' | 'connect';
+    const { url: frontendURL = '' } = await this.settingService.getSettingValues(['url']);
+    const base = forward?.origin || frontendURL;
+
+    const ref = await this.service.beginWebRefCallback({
+      provider: 'microsoft-entra-id' as user_account_provider_52222e2ecb_enum,
+      code,
+      state,
+      flow,
+      appOrigin: forward?.origin ?? null,
+    });
+
+    return res.redirect(
+      `${base}/callback/microsoft-entra-id/${flow}?ref=${encodeURIComponent(ref)}`,
+    );
+  }
+
+  /** Redeems a login/register `ref` from the Entra server-side bounce (public). */
+  @Public()
+  @Get('microsoft-entra-id/redeem')
+  async microsoftEntraIdRedeem(
+    @Locale() locale: string,
+    @Ip() ipAddress: string,
+    @Headers('user-agent') userAgent: string,
+    @Headers('origin') origin: string,
+    @Headers('referer') referer: string,
+    @Query('ref') ref: string,
+    @Res({ passthrough: true }) res,
+  ) {
+    return this.service.redeemWebRef({
+      res,
+      ref,
+      provider: 'microsoft-entra-id' as user_account_provider_52222e2ecb_enum,
+      locale,
+      ipAddress,
+      userAgent,
+      requestOrigin: origin,
+      requestReferer: referer,
+    });
+  }
+
+  /** Redeems a connect `ref` (authenticated: connect binds to the current user). */
+  @Get('microsoft-entra-id/redeem/connect')
+  async microsoftEntraIdRedeemConnect(
+    @Locale() locale: string,
+    @Ip() ipAddress: string,
+    @Headers('user-agent') userAgent: string,
+    @Headers('origin') origin: string,
+    @Headers('referer') referer: string,
+    @User() { id },
+    @Query('ref') ref: string,
+    @Res({ passthrough: true }) res,
+  ) {
+    return this.service.redeemWebRef({
+      res,
+      ref,
+      provider: 'microsoft-entra-id' as user_account_provider_52222e2ecb_enum,
+      locale,
+      ipAddress,
+      userAgent,
+      userId: id,
+      requestOrigin: origin,
+      requestReferer: referer,
+    });
+  }
+
   @Public()
   @Get(':provider/login')
   async login(