@hed-hog/core 0.0.385 → 0.0.387

package/hedhog/table/webhook_integration.yaml

@@ -1,43 +1,64 @@
-columns:
-  - type: pk
-  - type: slug
-  - name: name
-    type: varchar
-    length: 127
-  - name: description
-    type: text
-    isNullable: true
-  - name: public_uuid
-    type: varchar
-    length: 36
-  - name: status
-    type: enum
-    enum:
-      - active
-      - inactive
-    default: active
-  - name: require_token
-    type: boolean
-    default: false
-  - name: token_hash
-    type: varchar
-    length: 128
-    isNullable: true
-  - name: allowed_ips
-    type: json
-    isNullable: true
-  - name: body_schema
-    type: json
-    isNullable: true
-  - type: created_at
-  - type: updated_at
-indices:
-  - columns:
-      - slug
-    isUnique: true
-  - columns:
-      - public_uuid
-    isUnique: true
-  - columns:
-      - status
-
+columns:
+  - type: pk
+  - type: slug
+  - name: name
+    type: varchar
+    length: 127
+  - name: description
+    type: text
+    isNullable: true
+  - name: public_uuid
+    type: varchar
+    length: 36
+  - name: status
+    type: enum
+    enum:
+      - active
+      - inactive
+    default: active
+  - name: require_token
+    type: boolean
+    default: false
+  - name: token_hash
+    type: varchar
+    length: 128
+    isNullable: true
+  - name: allowed_ips
+    type: json
+    isNullable: true
+  - name: body_schema
+    type: json
+    isNullable: true
+  # Protocolo de entrada. Nulo = webhook clássico (token + actions). Preenchido,
+  # a chamada é delegada ao adaptador registrado por outro módulo no
+  # WebhookProtocolRegistry (ex.: 'meta-whatsapp'), que faz a própria autenticação.
+  - name: protocol
+    type: varchar
+    length: 63
+    isNullable: true
+  # Perfil que guarda as credenciais do protocolo (ex.: o app_secret que assina o
+  # HMAC). Nulo nos webhooks clássicos, que não têm provedor por trás.
+  - name: integration_profile_id
+    type: fk
+    isNullable: true
+    references:
+      table: integration_profile
+      column: id
+      onDelete: CASCADE
+      onUpdate: CASCADE
+  - type: created_at
+  - type: updated_at
+indices:
+  - columns:
+      - slug
+    isUnique: true
+  - columns:
+      - public_uuid
+    isUnique: true
+  - columns:
+      - status
+  - columns:
+      - protocol
+  - columns:
+      - integration_profile_id
+

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@hed-hog/core",
-  "version": "0.0.385",
+  "version": "0.0.387",
   "license": "MIT",
   "main": "dist/index.js",
   "types": "dist/index.d.ts",
@@ -42,11 +42,11 @@
     "ua-parser-js": "^2.0.10",
     "uuid": "^11.1.0",
     "@hed-hog/api-prisma": "0.0.6",
-    "@hed-hog/api-locale": "0.0.14",
     "@hed-hog/api-types": "0.0.1",
-    "@hed-hog/api": "0.0.8",
     "@hed-hog/api-mail": "0.0.9",
-    "@hed-hog/api-pagination": "0.0.7"
+    "@hed-hog/api-pagination": "0.0.7",
+    "@hed-hog/api-locale": "0.0.14",
+    "@hed-hog/api": "0.0.8"
   },
   "exports": {
     ".": {
@@ -77,13 +77,18 @@
     "hedhog"
   ],
   "devDependencies": {
+    "@jest/globals": "^29.7.0",
     "@types/cookie-parser": "^1.4.10",
     "@types/express": "^4.17.24",
     "@types/geoip-lite": "^1.4.4",
+    "@types/jest": "^29.5.14",
     "@types/multer": "^2.0.0",
     "@types/pako": "^2.0.4",
     "@types/ua-parser-js": "^0.7.39",
-    "rimraf": "^6.1.0"
+    "jest": "^29.7.0",
+    "rimraf": "^6.1.0",
+    "ts-jest": "^29.2.5",
+    "@hed-hog/jest-config": "0.0.0"
   },
   "scripts": {
     "_dev": "pnpm build --watch",

package/src/app-command/app-command.registry.ts

@@ -3,6 +3,8 @@ import { Injectable } from '@nestjs/common';
 export interface AppCommandContext extends Record<string, unknown> {
   webhookBody?: unknown;
   webhookHeaders?: Record<string, unknown>;
+  /** Raw pre-parse request body, needed for byte-exact HMAC signature verification (e.g. Stripe). Undefined on replayed/retried calls. */
+  webhookRawBody?: Buffer;
   remoteIp?: string | null;
   publicUuid?: string;
   integrationId?: number;

package/src/auth/auth.controller.ts

@@ -16,6 +16,7 @@ import {
   UseGuards
 } from '@nestjs/common';
 import { Throttle, ThrottlerGuard } from '@nestjs/throttler';
+import type { PublicKeyCredentialRequestOptionsJSON } from '@simplewebauthn/server';
 import { TokenService } from '../token/token.service';
 import { CreateWithEmailAndPasswordDTO } from '../user/dto/create-with-email-and-password.dto';
 import { UserService } from '../user/user.service';
@@ -28,6 +29,7 @@ import { LoginWithRecoveryCodeDTO } from './dto/login-with-recovery-code';
 import { LoginDTO } from './dto/login.dto';
 import { ResendMfaCodeDTO } from './dto/resend-mfa-code.dto';
 import { ResetDTO } from './dto/reset.dto';
+import { CompleteAccountDTO, VerifyAccountInviteDTO } from './dto/complete-account.dto';
 
 @Controller('auth')
 export class AuthController {
@@ -205,7 +207,7 @@ export class AuthController {
     @Locale() locale: string,
     @Body() { mfaToken }: { mfaToken: string },
     @Headers('origin') origin: string
-  ) {
+  ): Promise<PublicKeyCredentialRequestOptionsJSON> {
     return this.service.generateWebAuthnAuthenticationOptions(locale, mfaToken, origin);
   }
 
@@ -269,4 +271,24 @@ export class AuthController {
   ) {
     return this.service.forgotResetPassword(locale, password, code, ipAddress, userAgent);
   }
+
+  @Public()
+  @Post('complete-account/verify')
+  async verifyAccountInvite(
+    @Locale() locale: string,
+    @Body() { code }: VerifyAccountInviteDTO,
+  ) {
+    return this.service.verifyAccountInvite(locale, code);
+  }
+
+  @Public()
+  @Post('complete-account')
+  async completeAccount(
+    @Locale() locale: string,
+    @Body() { password, code, name }: CompleteAccountDTO,
+    @Ip() ipAddress: string,
+    @Headers('user-agent') userAgent: string,
+  ) {
+    return this.service.completeAccount(locale, { password, code, name }, ipAddress, userAgent);
+  }
 }

package/src/auth/auth.service.ts

@@ -1,6 +1,7 @@
 import { getLocaleText } from '@hed-hog/api-locale';
 import { PrismaService } from '@hed-hog/api-prisma';
 import { User } from '@hed-hog/api-types';
+import type { PublicKeyCredentialRequestOptionsJSON } from '@simplewebauthn/server';
 import {
   BadRequestException,
   forwardRef,
@@ -558,6 +559,139 @@ export class AuthService {
     return { accessToken, refreshToken, session }
   }
 
+  /**
+   * Garante que exista um usuário com o identificador de email informado e cria
+   * um challenge seguro de criação de conta (link de convite). Não envia email —
+   * o remetente (ex.: LMS enterprise) monta o link e dispara o template. Reutiliza
+   * um usuário existente por `userId` ou pelo identificador de email; caso não
+   * exista, cria um novo usuário apenas com o nome.
+   */
+  async prepareAccountInvite(
+    locale: string,
+    { email, name, userId }: { email: string; name?: string; userId?: number },
+  ) {
+    const normalizedEmail = email.toLowerCase().trim();
+
+    let targetUserId = userId;
+    if (!targetUserId) {
+      const existing = await this.user.findUserByEmail(locale, normalizedEmail);
+      targetUserId = existing?.id;
+    }
+    if (!targetUserId) {
+      const createdUser = await this.prisma.user.create({
+        data: { name: name?.trim() || normalizedEmail },
+      });
+      targetUserId = createdUser.id;
+    }
+
+    let identifier = await this.prisma.user_identifier.findFirst({
+      where: { user_id: targetUserId, type: 'email', value: normalizedEmail },
+    });
+    if (!identifier) {
+      identifier = await this.prisma.user_identifier.create({
+        data: {
+          user_id: targetUserId,
+          type: 'email',
+          value: normalizedEmail,
+          enabled: true,
+        },
+      });
+    } else if (!identifier.enabled) {
+      identifier = await this.prisma.user_identifier.update({
+        where: { id: identifier.id },
+        data: { enabled: true },
+      });
+    }
+
+    const passwordCount = await this.prisma.user_credential.count({
+      where: {
+        user_id: targetUserId,
+        type: 'password',
+        revoked_at: null,
+      },
+    });
+
+    const token = await this.challenge.createAccountInviteChallenge(identifier.id);
+
+    return { userId: targetUserId, token, hasPassword: passwordCount > 0 };
+  }
+
+  /**
+   * Valida (sem consumir) um token de convite de criação de conta e retorna os
+   * dados básicos para pré-preencher o formulário no app de treinamentos.
+   */
+  async verifyAccountInvite(locale: string, code: string) {
+    const challenge = await this.challenge.verifyCodePassword(locale, code);
+    return {
+      valid: true,
+      name: challenge.user_identifier.user?.name ?? null,
+      email: challenge.user_identifier.value,
+    };
+  }
+
+  /**
+   * Conclui a criação de conta a partir de um token de convite: cria/atualiza a
+   * credencial de senha, marca o identificador como verificado, atualiza o nome
+   * (se enviado), consome o challenge e autentica o usuário (auto-login).
+   */
+  async completeAccount(
+    locale: string,
+    { password, code, name }: { password: string; code: string; name?: string },
+    ipAddress: string,
+    userAgent: string,
+  ) {
+    const challenge = await this.challenge.verifyCodePassword(locale, code);
+    const userIdentifier = challenge.user_identifier;
+    const passwordHash = await this.security.hashArgon2(password);
+
+    const existingCredential = await this.prisma.user_credential.findFirst({
+      where: { user_id: userIdentifier.user_id, type: 'password' },
+    });
+
+    if (existingCredential) {
+      await this.prisma.user_credential.updateMany({
+        where: { user_id: userIdentifier.user_id, type: 'password' },
+        data: { hash: passwordHash, requires_reset: false, revoked_at: null },
+      });
+    } else {
+      await this.prisma.user_credential.create({
+        data: {
+          user_id: userIdentifier.user_id,
+          type: 'password',
+          hash: passwordHash,
+        },
+      });
+    }
+
+    await this.prisma.user_identifier.update({
+      where: { id: userIdentifier.id },
+      data: { verified_at: new Date(), enabled: true },
+    });
+
+    if (name?.trim()) {
+      await this.prisma.user.update({
+        where: { id: userIdentifier.user_id },
+        data: { name: name.trim() },
+      });
+    }
+
+    // Consome o challenge para impedir reuso do link (invites têm validade longa).
+    await this.prisma.user_identifier_challenge.updateMany({
+      where: { id: challenge.id },
+      data: { verified_at: new Date(), expires_at: new Date() },
+    });
+
+    const { accessToken, refreshToken, session } =
+      await this.getAuthenticationPayload(
+        locale,
+        userIdentifier.user_id,
+        ipAddress,
+        userAgent,
+      );
+    await this.user.registerUserActivity(userIdentifier.id, 'completeAccount');
+    return { accessToken, refreshToken, session };
+  }
+
   async verifyMfaCode(locale: string, mfaToken: string, code: string, ipAddress: string, userAgent: string, methodType?: 'totp' | 'email' | 'recovery', browserId?: string | null) {
     const payload = await this.token.verifyMfaChallengeToken(mfaToken);
     const user = await this.prisma.user.findUnique({
@@ -757,7 +891,7 @@ export class AuthService {
     };
   }
 
-  async generateWebAuthnAuthenticationOptions(locale: string, mfaToken: string, requestOrigin?: string) {
+  async generateWebAuthnAuthenticationOptions(locale: string, mfaToken: string, requestOrigin?: string): Promise<PublicKeyCredentialRequestOptionsJSON> {
     const { generateAuthenticationOptions } = await import('@simplewebauthn/server');
     const payload = await this.token.verifyMfaChallengeToken(mfaToken);
 

package/src/auth/dto/complete-account.dto.ts

@@ -0,0 +1,24 @@
+import { getLocaleText } from '@hed-hog/api-locale';
+import { IsNotEmpty, IsOptional, IsString, MinLength } from 'class-validator';
+
+export class CompleteAccountDTO {
+  @IsNotEmpty({
+    message: (args) => getLocaleText('reset.password.required', args.value),
+  })
+  @MinLength(8, {
+    message: (args) => getLocaleText('reset.password.minLength', args.value),
+  })
+  password: string;
+
+  @IsNotEmpty({ message: (args) => getLocaleText('reset.code.required', args.value) })
+  code: string;
+
+  @IsOptional()
+  @IsString()
+  name?: string;
+}
+
+export class VerifyAccountInviteDTO {
+  @IsNotEmpty({ message: (args) => getLocaleText('reset.code.required', args.value) })
+  code: string;
+}

package/src/authorize/authorize.controller.ts

@@ -0,0 +1,99 @@
+import { NoRole, Public, User } from '@hed-hog/api';
+import { Locale } from '@hed-hog/api-locale';
+import {
+  Body,
+  Controller,
+  Get,
+  Headers,
+  Inject,
+  Ip,
+  Post,
+  Query,
+  UseGuards,
+  forwardRef,
+} from '@nestjs/common';
+import { Throttle, ThrottlerGuard } from '@nestjs/throttler';
+import { AuthorizeService } from './authorize.service';
+import { AuthorizeInfoDTO } from './dto/authorize-info.dto';
+import { ConsentDTO } from './dto/consent.dto';
+import { TokenDTO } from './dto/token.dto';
+
+/**
+ * Endpoints do fluxo Authorization Code + PKCE.
+ *
+ * Note o que NÃO existe aqui: um `GET /auth/authorize` que redireciona. O
+ * redirect final é feito pelo browser, na página de consent do admin, depois do
+ * POST /auth/authorize/consent. Assim toda a validação fica no servidor e o
+ * `code` não passa pelo mecanismo de redirect do Nest (nem pelos seus logs).
+ */
+@Controller('auth')
+export class AuthorizeController {
+  constructor(
+    @Inject(forwardRef(() => AuthorizeService))
+    private readonly service: AuthorizeService,
+  ) {}
+
+  /**
+   * Metadados para a tela de consent. Público: a página precisa validar os
+   * parâmetros e mostrar de quem é o app ANTES de exigir login.
+   */
+  @Public()
+  @UseGuards(ThrottlerGuard)
+  @Throttle({ default: { limit: 30, ttl: 60000 } })
+  @Get('authorize/info')
+  async authorizeInfo(@Query() query: AuthorizeInfoDTO) {
+    return this.service.getAuthorizationInfo({
+      clientId: query.client_id,
+      redirectUri: query.redirect_uri,
+      scope: query.scope,
+      codeChallenge: query.code_challenge,
+      codeChallengeMethod: query.code_challenge_method,
+    });
+  }
+
+  /** O usuário logado aprova. O code sai vinculado a ele. */
+  @NoRole()
+  @UseGuards(ThrottlerGuard)
+  @Throttle({ default: { limit: 10, ttl: 60000 } })
+  @Post('authorize/consent')
+  async consent(@User() { id }, @Body() body: ConsentDTO) {
+    const code = await this.service.issueCode({
+      userId: id,
+      clientId: body.client_id,
+      redirectUri: body.redirect_uri,
+      scope: body.scope,
+      codeChallenge: body.code_challenge,
+      codeChallengeMethod: body.code_challenge_method,
+    });
+
+    return { code };
+  }
+
+  /**
+   * Troca o code por tokens. Público por definição (o cliente ainda não tem
+   * token) — quem autentica é a posse do code + do code_verifier.
+   *
+   * Sem @Res() e sem cookie `rt`: o refreshToken vai no body. Um Set-Cookie aqui
+   * seria ruído para um cliente não-browser e um vetor de CSRF a mais.
+   */
+  @Public()
+  @UseGuards(ThrottlerGuard)
+  @Throttle({ default: { limit: 20, ttl: 60000 } })
+  @Post('token')
+  async token(
+    @Body() body: TokenDTO,
+    @Locale() locale: string,
+    @Ip() ipAddress: string,
+    @Headers('user-agent') userAgent: string,
+  ) {
+    return this.service.exchangeCode({
+      code: body.code,
+      codeVerifier: body.code_verifier,
+      clientId: body.client_id,
+      redirectUri: body.redirect_uri,
+      locale,
+      ipAddress,
+      userAgent,
+    });
+  }
+}

package/src/authorize/authorize.module.ts

@@ -0,0 +1,23 @@
+import { PrismaModule } from '@hed-hog/api-prisma';
+import { Module, forwardRef } from '@nestjs/common';
+import { AuthModule } from '../auth/auth.module';
+import { SecurityModule } from '../security/security.module';
+import { AuthorizeController } from './authorize.controller';
+import { AuthorizeService } from './authorize.service';
+
+/**
+ * Separado de OAuthModule de propósito: lá o HedHog é *client* de IdPs externos
+ * (Google, Apple...). Aqui ele é o *provider*. Misturar os dois confundiria dois
+ * papéis opostos no mesmo arquivo.
+ */
+@Module({
+  imports: [
+    forwardRef(() => PrismaModule),
+    forwardRef(() => SecurityModule),
+    forwardRef(() => AuthModule),
+  ],
+  controllers: [AuthorizeController],
+  providers: [AuthorizeService],
+  exports: [AuthorizeService],
+})
+export class AuthorizeModule {}