@hed-hog/core 0.0.386 → 0.0.390

package/dist/integration-profile/testers/storage.testers.js

@@ -0,0 +1,208 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.STORAGE_TESTERS = void 0;
+const client_s3_1 = require("@aws-sdk/client-s3");
+const storage_blob_1 = require("@azure/storage-blob");
+const storage_1 = require("@google-cloud/storage");
+const promises_1 = require("node:fs/promises");
+const http_probe_1 = require("./http-probe");
+/**
+ * Testadores dos providers de storage.
+ *
+ * Todos usam uma operação de LEITURA (HeadBucket, getMetadata, getProperties): provam
+ * credencial, existência do bucket/container e permissão sem escrever nada na conta
+ * do cliente.
+ */
+/** Traduz o erro dos SDKs S3 em algo que o operador consiga agir. */
+async function headS3Bucket(client, bucket, label, signal) {
+    var _a, _b, _c;
+    try {
+        await client.send(new client_s3_1.HeadBucketCommand({ Bucket: bucket }), {
+            abortSignal: signal,
+        });
+        return (0, http_probe_1.pass)(label);
+    }
+    catch (error) {
+        const err = error;
+        const status = (_a = err === null || err === void 0 ? void 0 : err.$metadata) === null || _a === void 0 ? void 0 : _a.httpStatusCode;
+        const name = String((_b = err === null || err === void 0 ? void 0 : err.name) !== null && _b !== void 0 ? _b : '');
+        if (name === 'InvalidAccessKeyId' || status === 401) {
+            return (0, http_probe_1.fail)('Invalid access key ID.');
+        }
+        if (name === 'SignatureDoesNotMatch') {
+            return (0, http_probe_1.fail)('Invalid secret access key.');
+        }
+        if (name === 'NotFound' || status === 404) {
+            return (0, http_probe_1.fail)(`Bucket "${bucket}" was not found.`);
+        }
+        if (name === 'Forbidden' || status === 403) {
+            return (0, http_probe_1.fail)(`These credentials have no permission to access the bucket "${bucket}".`);
+        }
+        if (name === 'PermanentRedirect' || status === 301) {
+            return (0, http_probe_1.fail)(`Bucket "${bucket}" lives in another region.`);
+        }
+        return (0, http_probe_1.fail)(String((_c = err === null || err === void 0 ? void 0 : err.message) !== null && _c !== void 0 ? _c : 'Could not reach the bucket.'));
+    }
+    finally {
+        client.destroy();
+    }
+}
+const localTester = {
+    providerSlug: 'local',
+    test: async (config) => {
+        var _a;
+        const basePath = (0, http_probe_1.str)(config, 'base_path') || 'storage';
+        try {
+            // Só checa permissão — escrever um arquivo de teste sujaria o storage do cliente.
+            await (0, promises_1.access)(basePath, promises_1.constants.R_OK | promises_1.constants.W_OK);
+            return (0, http_probe_1.pass)(basePath);
+        }
+        catch (error) {
+            const code = String((_a = error === null || error === void 0 ? void 0 : error.code) !== null && _a !== void 0 ? _a : '');
+            if (code === 'ENOENT') {
+                return (0, http_probe_1.fail)(`The directory "${basePath}" does not exist.`);
+            }
+            if (code === 'EACCES' || code === 'EPERM') {
+                return (0, http_probe_1.fail)(`No read/write permission on the directory "${basePath}".`);
+            }
+            return (0, http_probe_1.fail)(`Could not access the directory "${basePath}".`);
+        }
+    },
+};
+const s3Tester = {
+    providerSlug: 's3',
+    test: async (config, ctx) => {
+        var _a, _b;
+        const missing = (0, http_probe_1.requireFields)(config, [
+            ['access_key_id', 'Access key ID'],
+            ['secret_access_key', 'Secret access key'],
+            ['bucket', 'Bucket'],
+        ]);
+        if (missing)
+            return missing;
+        const region = (0, http_probe_1.str)(config, 'region') || 'us-east-1';
+        const bucket = (0, http_probe_1.str)(config, 'bucket');
+        const sessionToken = String((_a = config.session_token) !== null && _a !== void 0 ? _a : '').trim();
+        const client = new client_s3_1.S3Client({
+            region,
+            credentials: Object.assign({ accessKeyId: (0, http_probe_1.str)(config, 'access_key_id'), secretAccessKey: String((_b = config.secret_access_key) !== null && _b !== void 0 ? _b : '') }, (sessionToken ? { sessionToken } : {})),
+        });
+        return headS3Bucket(client, bucket, `${bucket} (${region})`, ctx.signal);
+    },
+};
+const s3CompatibleTester = {
+    providerSlug: 's3-compatible',
+    test: async (config, ctx) => {
+        var _a;
+        const missing = (0, http_probe_1.requireFields)(config, [
+            ['endpoint', 'Endpoint'],
+            ['access_key_id', 'Access key ID'],
+            ['secret_access_key', 'Secret access key'],
+            ['bucket', 'Bucket'],
+        ]);
+        if (missing)
+            return missing;
+        const endpoint = (0, http_probe_1.assertHttpUrl)((0, http_probe_1.str)(config, 'endpoint'), 'Endpoint');
+        const bucket = (0, http_probe_1.str)(config, 'bucket');
+        const region = (0, http_probe_1.str)(config, 'region') || 'us-east-1';
+        const client = new client_s3_1.S3Client({
+            region,
+            endpoint: endpoint.origin,
+            // Provedores compatíveis (MinIO, Ceph) raramente resolvem bucket por subdomínio.
+            forcePathStyle: true,
+            credentials: {
+                accessKeyId: (0, http_probe_1.str)(config, 'access_key_id'),
+                secretAccessKey: String((_a = config.secret_access_key) !== null && _a !== void 0 ? _a : ''),
+            },
+        });
+        return headS3Bucket(client, bucket, `${bucket} @ ${endpoint.host}`, ctx.signal);
+    },
+};
+const gcsTester = {
+    providerSlug: 'gcs',
+    test: async (config) => {
+        var _a, _b;
+        const missing = (0, http_probe_1.requireFields)(config, [
+            ['key_file_json', 'Service account JSON'],
+            ['bucket', 'Bucket'],
+        ]);
+        if (missing)
+            return missing;
+        let credentials;
+        try {
+            credentials = JSON.parse(String((_a = config.key_file_json) !== null && _a !== void 0 ? _a : ''));
+        }
+        catch (_c) {
+            return (0, http_probe_1.fail)('The service account JSON is not valid JSON.');
+        }
+        if (!(credentials === null || credentials === void 0 ? void 0 : credentials.client_email)) {
+            return (0, http_probe_1.fail)('The service account JSON has no "client_email".');
+        }
+        const bucket = (0, http_probe_1.str)(config, 'bucket');
+        try {
+            const storage = new storage_1.Storage({
+                projectId: credentials.project_id,
+                credentials: credentials,
+            });
+            const [metadata] = await storage.bucket(bucket).getMetadata();
+            return (0, http_probe_1.pass)(`${bucket}${(metadata === null || metadata === void 0 ? void 0 : metadata.location) ? ` (${metadata.location})` : ''}`);
+        }
+        catch (error) {
+            const err = error;
+            if ((err === null || err === void 0 ? void 0 : err.code) === 404)
+                return (0, http_probe_1.fail)(`Bucket "${bucket}" was not found.`);
+            if ((err === null || err === void 0 ? void 0 : err.code) === 403) {
+                return (0, http_probe_1.fail)(`The service account has no permission to access the bucket "${bucket}".`);
+            }
+            if ((err === null || err === void 0 ? void 0 : err.code) === 401)
+                return (0, http_probe_1.fail)('The service account key was rejected.');
+            return (0, http_probe_1.fail)(String((_b = err === null || err === void 0 ? void 0 : err.message) !== null && _b !== void 0 ? _b : 'Could not reach the bucket.'));
+        }
+    },
+};
+const azureBlobTester = {
+    providerSlug: 'azure-blob',
+    test: async (config) => {
+        var _a, _b;
+        const missing = (0, http_probe_1.requireFields)(config, [
+            ['account', 'Storage account'],
+            ['key', 'Access key'],
+            ['container', 'Container'],
+        ]);
+        if (missing)
+            return missing;
+        const account = (0, http_probe_1.str)(config, 'account');
+        const container = (0, http_probe_1.str)(config, 'container');
+        let credential;
+        try {
+            credential = new storage_blob_1.StorageSharedKeyCredential(account, String((_a = config.key) !== null && _a !== void 0 ? _a : ''));
+        }
+        catch (_c) {
+            // O SDK decodifica a chave em base64 na construção.
+            return (0, http_probe_1.fail)('The access key is not a valid Azure storage key.');
+        }
+        try {
+            const service = new storage_blob_1.BlobServiceClient(`https://${account}.blob.core.windows.net`, credential);
+            await service.getContainerClient(container).getProperties();
+            return (0, http_probe_1.pass)(`${account}/${container}`);
+        }
+        catch (error) {
+            const err = error;
+            if ((err === null || err === void 0 ? void 0 : err.statusCode) === 403 || (err === null || err === void 0 ? void 0 : err.code) === 'AuthenticationFailed') {
+                return (0, http_probe_1.fail)('The storage account or access key was rejected.');
+            }
+            if ((err === null || err === void 0 ? void 0 : err.statusCode) === 404 || (err === null || err === void 0 ? void 0 : err.code) === 'ContainerNotFound') {
+                return (0, http_probe_1.fail)(`Container "${container}" was not found.`);
+            }
+            return (0, http_probe_1.fail)(String((_b = err === null || err === void 0 ? void 0 : err.message) !== null && _b !== void 0 ? _b : 'Could not reach the container.'));
+        }
+    },
+};
+exports.STORAGE_TESTERS = [
+    localTester,
+    s3Tester,
+    s3CompatibleTester,
+    gcsTester,
+    azureBlobTester,
+];
+//# sourceMappingURL=storage.testers.js.map

package/dist/integration-profile/testers/storage.testers.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"storage.testers.js","sourceRoot":"","sources":["../../../src/integration-profile/testers/storage.testers.ts"],"names":[],"mappings":";;;AAAA,kDAAiE;AACjE,sDAAoF;AACpF,mDAAgD;AAChD,+CAAqD;AACrD,6CAA6E;AAG7E;;;;;;GAMG;AAEH,qEAAqE;AACrE,KAAK,UAAU,YAAY,CACzB,MAAgB,EAChB,MAAc,EACd,KAAa,EACb,MAAmB;;IAEnB,IAAI,CAAC;QACH,MAAM,MAAM,CAAC,IAAI,CAAC,IAAI,6BAAiB,CAAC,EAAE,MAAM,EAAE,MAAM,EAAE,CAAC,EAAE;YAC3D,WAAW,EAAE,MAAM;SACpB,CAAC,CAAC;QACH,OAAO,IAAA,iBAAI,EAAC,KAAK,CAAC,CAAC;IACrB,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,MAAM,GAAG,GAAG,KAIX,CAAC;QACF,MAAM,MAAM,GAAG,MAAA,GAAG,aAAH,GAAG,uBAAH,GAAG,CAAE,SAAS,0CAAE,cAAc,CAAC;QAC9C,MAAM,IAAI,GAAG,MAAM,CAAC,MAAA,GAAG,aAAH,GAAG,uBAAH,GAAG,CAAE,IAAI,mCAAI,EAAE,CAAC,CAAC;QAErC,IAAI,IAAI,KAAK,oBAAoB,IAAI,MAAM,KAAK,GAAG,EAAE,CAAC;YACpD,OAAO,IAAA,iBAAI,EAAC,wBAAwB,CAAC,CAAC;QACxC,CAAC;QACD,IAAI,IAAI,KAAK,uBAAuB,EAAE,CAAC;YACrC,OAAO,IAAA,iBAAI,EAAC,4BAA4B,CAAC,CAAC;QAC5C,CAAC;QACD,IAAI,IAAI,KAAK,UAAU,IAAI,MAAM,KAAK,GAAG,EAAE,CAAC;YAC1C,OAAO,IAAA,iBAAI,EAAC,WAAW,MAAM,kBAAkB,CAAC,CAAC;QACnD,CAAC;QACD,IAAI,IAAI,KAAK,WAAW,IAAI,MAAM,KAAK,GAAG,EAAE,CAAC;YAC3C,OAAO,IAAA,iBAAI,EACT,8DAA8D,MAAM,IAAI,CACzE,CAAC;QACJ,CAAC;QACD,IAAI,IAAI,KAAK,mBAAmB,IAAI,MAAM,KAAK,GAAG,EAAE,CAAC;YACnD,OAAO,IAAA,iBAAI,EAAC,WAAW,MAAM,4BAA4B,CAAC,CAAC;QAC7D,CAAC;QACD,OAAO,IAAA,iBAAI,EAAC,MAAM,CAAC,MAAA,GAAG,aAAH,GAAG,uBAAH,GAAG,CAAE,OAAO,mCAAI,6BAA6B,CAAC,CAAC,CAAC;IACrE,CAAC;YAAS,CAAC;QACT,MAAM,CAAC,OAAO,EAAE,CAAC;IACnB,CAAC;AACH,CAAC;AAED,MAAM,WAAW,GAAsB;IACrC,YAAY,EAAE,OAAO;IACrB,IAAI,EAAE,KAAK,EAAE,MAAM,EAAE,EAAE;;QACrB,MAAM,QAAQ,GAAG,IAAA,gBAAG,EAAC,MAAM,EAAE,WAAW,CAAC,IAAI,SAAS,CAAC;QACvD,IAAI,CAAC;YACH,kFAAkF;YAClF,MAAM,IAAA,iBAAM,EAAC,QAAQ,EAAE,oBAAS,CAAC,IAAI,GAAG,oBAAS,CAAC,IAAI,CAAC,CAAC;YACxD,OAAO,IAAA,iBAAI,EAAC,QAAQ,CAAC,CAAC;QACxB,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,MAAM,IAAI,GAAG,MAAM,CAAC,MAAC,KAA2B,aAA3B,KAAK,uBAAL,KAAK,CAAwB,IAAI,mCAAI,EAAE,CAAC,CAAC;YAC9D,IAAI,IAAI,KAAK,QAAQ,EAAE,CAAC;gBACtB,OAAO,IAAA,iBAAI,EAAC,kBAAkB,QAAQ,mBAAmB,CAAC,CAAC;YAC7D,CAAC;YACD,IAAI,IAAI,KAAK,QAAQ,IAAI,IAAI,KAAK,OAAO,EAAE,CAAC;gBAC1C,OAAO,IAAA,iBAAI,EAAC,8CAA8C,QAAQ,IAAI,CAAC,CAAC;YAC1E,CAAC;YACD,OAAO,IAAA,iBAAI,EAAC,mCAAmC,QAAQ,IAAI,CAAC,CAAC;QAC/D,CAAC;IACH,CAAC;CACF,CAAC;AAEF,MAAM,QAAQ,GAAsB;IAClC,YAAY,EAAE,IAAI;IAClB,IAAI,EAAE,KAAK,EAAE,MAAM,EAAE,GAAG,EAAE,EAAE;;QAC1B,MAAM,OAAO,GAAG,IAAA,0BAAa,EAAC,MAAM,EAAE;YACpC,CAAC,eAAe,EAAE,eAAe,CAAC;YAClC,CAAC,mBAAmB,EAAE,mBAAmB,CAAC;YAC1C,CAAC,QAAQ,EAAE,QAAQ,CAAC;SACrB,CAAC,CAAC;QACH,IAAI,OAAO;YAAE,OAAO,OAAO,CAAC;QAE5B,MAAM,MAAM,GAAG,IAAA,gBAAG,EAAC,MAAM,EAAE,QAAQ,CAAC,IAAI,WAAW,CAAC;QACpD,MAAM,MAAM,GAAG,IAAA,gBAAG,EAAC,MAAM,EAAE,QAAQ,CAAC,CAAC;QACrC,MAAM,YAAY,GAAG,MAAM,CAAC,MAAA,MAAM,CAAC,aAAa,mCAAI,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC;QAE/D,MAAM,MAAM,GAAG,IAAI,oBAAQ,CAAC;YAC1B,MAAM;YACN,WAAW,kBACT,WAAW,EAAE,IAAA,gBAAG,EAAC,MAAM,EAAE,eAAe,CAAC,EACzC,eAAe,EAAE,MAAM,CAAC,MAAA,MAAM,CAAC,iBAAiB,mCAAI,EAAE,CAAC,IACpD,CAAC,YAAY,CAAC,CAAC,CAAC,EAAE,YAAY,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,CAC1C;SACF,CAAC,CAAC;QAEH,OAAO,YAAY,CAAC,MAAM,EAAE,MAAM,EAAE,GAAG,MAAM,KAAK,MAAM,GAAG,EAAE,GAAG,CAAC,MAAM,CAAC,CAAC;IAC3E,CAAC;CACF,CAAC;AAEF,MAAM,kBAAkB,GAAsB;IAC5C,YAAY,EAAE,eAAe;IAC7B,IAAI,EAAE,KAAK,EAAE,MAAM,EAAE,GAAG,EAAE,EAAE;;QAC1B,MAAM,OAAO,GAAG,IAAA,0BAAa,EAAC,MAAM,EAAE;YACpC,CAAC,UAAU,EAAE,UAAU,CAAC;YACxB,CAAC,eAAe,EAAE,eAAe,CAAC;YAClC,CAAC,mBAAmB,EAAE,mBAAmB,CAAC;YAC1C,CAAC,QAAQ,EAAE,QAAQ,CAAC;SACrB,CAAC,CAAC;QACH,IAAI,OAAO;YAAE,OAAO,OAAO,CAAC;QAE5B,MAAM,QAAQ,GAAG,IAAA,0BAAa,EAAC,IAAA,gBAAG,EAAC,MAAM,EAAE,UAAU,CAAC,EAAE,UAAU,CAAC,CAAC;QACpE,MAAM,MAAM,GAAG,IAAA,gBAAG,EAAC,MAAM,EAAE,QAAQ,CAAC,CAAC;QACrC,MAAM,MAAM,GAAG,IAAA,gBAAG,EAAC,MAAM,EAAE,QAAQ,CAAC,IAAI,WAAW,CAAC;QAEpD,MAAM,MAAM,GAAG,IAAI,oBAAQ,CAAC;YAC1B,MAAM;YACN,QAAQ,EAAE,QAAQ,CAAC,MAAM;YACzB,iFAAiF;YACjF,cAAc,EAAE,IAAI;YACpB,WAAW,EAAE;gBACX,WAAW,EAAE,IAAA,gBAAG,EAAC,MAAM,EAAE,eAAe,CAAC;gBACzC,eAAe,EAAE,MAAM,CAAC,MAAA,MAAM,CAAC,iBAAiB,mCAAI,EAAE,CAAC;aACxD;SACF,CAAC,CAAC;QAEH,OAAO,YAAY,CAAC,MAAM,EAAE,MAAM,EAAE,GAAG,MAAM,MAAM,QAAQ,CAAC,IAAI,EAAE,EAAE,GAAG,CAAC,MAAM,CAAC,CAAC;IAClF,CAAC;CACF,CAAC;AAEF,MAAM,SAAS,GAAsB;IACnC,YAAY,EAAE,KAAK;IACnB,IAAI,EAAE,KAAK,EAAE,MAAM,EAAE,EAAE;;QACrB,MAAM,OAAO,GAAG,IAAA,0BAAa,EAAC,MAAM,EAAE;YACpC,CAAC,eAAe,EAAE,sBAAsB,CAAC;YACzC,CAAC,QAAQ,EAAE,QAAQ,CAAC;SACrB,CAAC,CAAC;QACH,IAAI,OAAO;YAAE,OAAO,OAAO,CAAC;QAE5B,IAAI,WAA2D,CAAC;QAChE,IAAI,CAAC;YACH,WAAW,GAAG,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,MAAA,MAAM,CAAC,aAAa,mCAAI,EAAE,CAAC,CAAC,CAAC;QAC/D,CAAC;QAAC,WAAM,CAAC;YACP,OAAO,IAAA,iBAAI,EAAC,6CAA6C,CAAC,CAAC;QAC7D,CAAC;QACD,IAAI,CAAC,CAAA,WAAW,aAAX,WAAW,uBAAX,WAAW,CAAE,YAAY,CAAA,EAAE,CAAC;YAC/B,OAAO,IAAA,iBAAI,EAAC,iDAAiD,CAAC,CAAC;QACjE,CAAC;QAED,MAAM,MAAM,GAAG,IAAA,gBAAG,EAAC,MAAM,EAAE,QAAQ,CAAC,CAAC;QACrC,IAAI,CAAC;YACH,MAAM,OAAO,GAAG,IAAI,iBAAO,CAAC;gBAC1B,SAAS,EAAE,WAAW,CAAC,UAAU;gBACjC,WAAW,EAAE,WAAqC;aACnD,CAAC,CAAC;YACH,MAAM,CAAC,QAAQ,CAAC,GAAG,MAAM,OAAO,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,WAAW,EAAE,CAAC;YAC9D,OAAO,IAAA,iBAAI,EAAC,GAAG,MAAM,GAAG,CAAA,QAAQ,aAAR,QAAQ,uBAAR,QAAQ,CAAE,QAAQ,EAAC,CAAC,CAAC,KAAK,QAAQ,CAAC,QAAQ,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;QACjF,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,MAAM,GAAG,GAAG,KAA4C,CAAC;YACzD,IAAI,CAAA,GAAG,aAAH,GAAG,uBAAH,GAAG,CAAE,IAAI,MAAK,GAAG;gBAAE,OAAO,IAAA,iBAAI,EAAC,WAAW,MAAM,kBAAkB,CAAC,CAAC;YACxE,IAAI,CAAA,GAAG,aAAH,GAAG,uBAAH,GAAG,CAAE,IAAI,MAAK,GAAG,EAAE,CAAC;gBACtB,OAAO,IAAA,iBAAI,EACT,+DAA+D,MAAM,IAAI,CAC1E,CAAC;YACJ,CAAC;YACD,IAAI,CAAA,GAAG,aAAH,GAAG,uBAAH,GAAG,CAAE,IAAI,MAAK,GAAG;gBAAE,OAAO,IAAA,iBAAI,EAAC,uCAAuC,CAAC,CAAC;YAC5E,OAAO,IAAA,iBAAI,EAAC,MAAM,CAAC,MAAA,GAAG,aAAH,GAAG,uBAAH,GAAG,CAAE,OAAO,mCAAI,6BAA6B,CAAC,CAAC,CAAC;QACrE,CAAC;IACH,CAAC;CACF,CAAC;AAEF,MAAM,eAAe,GAAsB;IACzC,YAAY,EAAE,YAAY;IAC1B,IAAI,EAAE,KAAK,EAAE,MAAM,EAAE,EAAE;;QACrB,MAAM,OAAO,GAAG,IAAA,0BAAa,EAAC,MAAM,EAAE;YACpC,CAAC,SAAS,EAAE,iBAAiB,CAAC;YAC9B,CAAC,KAAK,EAAE,YAAY,CAAC;YACrB,CAAC,WAAW,EAAE,WAAW,CAAC;SAC3B,CAAC,CAAC;QACH,IAAI,OAAO;YAAE,OAAO,OAAO,CAAC;QAE5B,MAAM,OAAO,GAAG,IAAA,gBAAG,EAAC,MAAM,EAAE,SAAS,CAAC,CAAC;QACvC,MAAM,SAAS,GAAG,IAAA,gBAAG,EAAC,MAAM,EAAE,WAAW,CAAC,CAAC;QAE3C,IAAI,UAAsC,CAAC;QAC3C,IAAI,CAAC;YACH,UAAU,GAAG,IAAI,yCAA0B,CAAC,OAAO,EAAE,MAAM,CAAC,MAAA,MAAM,CAAC,GAAG,mCAAI,EAAE,CAAC,CAAC,CAAC;QACjF,CAAC;QAAC,WAAM,CAAC;YACP,oDAAoD;YACpD,OAAO,IAAA,iBAAI,EAAC,kDAAkD,CAAC,CAAC;QAClE,CAAC;QAED,IAAI,CAAC;YACH,MAAM,OAAO,GAAG,IAAI,gCAAiB,CACnC,WAAW,OAAO,wBAAwB,EAC1C,UAAU,CACX,CAAC;YACF,MAAM,OAAO,CAAC,kBAAkB,CAAC,SAAS,CAAC,CAAC,aAAa,EAAE,CAAC;YAC5D,OAAO,IAAA,iBAAI,EAAC,GAAG,OAAO,IAAI,SAAS,EAAE,CAAC,CAAC;QACzC,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,MAAM,GAAG,GAAG,KAAiE,CAAC;YAC9E,IAAI,CAAA,GAAG,aAAH,GAAG,uBAAH,GAAG,CAAE,UAAU,MAAK,GAAG,IAAI,CAAA,GAAG,aAAH,GAAG,uBAAH,GAAG,CAAE,IAAI,MAAK,sBAAsB,EAAE,CAAC;gBACpE,OAAO,IAAA,iBAAI,EAAC,iDAAiD,CAAC,CAAC;YACjE,CAAC;YACD,IAAI,CAAA,GAAG,aAAH,GAAG,uBAAH,GAAG,CAAE,UAAU,MAAK,GAAG,IAAI,CAAA,GAAG,aAAH,GAAG,uBAAH,GAAG,CAAE,IAAI,MAAK,mBAAmB,EAAE,CAAC;gBACjE,OAAO,IAAA,iBAAI,EAAC,cAAc,SAAS,kBAAkB,CAAC,CAAC;YACzD,CAAC;YACD,OAAO,IAAA,iBAAI,EAAC,MAAM,CAAC,MAAA,GAAG,aAAH,GAAG,uBAAH,GAAG,CAAE,OAAO,mCAAI,gCAAgC,CAAC,CAAC,CAAC;QACxE,CAAC;IACH,CAAC;CACF,CAAC;AAEW,QAAA,eAAe,GAAwB;IAClD,WAAW;IACX,QAAQ;IACR,kBAAkB;IAClB,SAAS;IACT,eAAe;CAChB,CAAC"}

package/dist/language/en.json

@@ -26,7 +26,8 @@
   },
   "forgot": {
     "rateLimit": "Too many requests. Please try again later.",
-    "userNotFound": "User not found."
+    "userNotFound": "User not found.",
+    "noPassword": "This account does not have a password set. Please sign in using your organization's login provider (e.g. Microsoft)."
   },
   "challenge": {
     "invalidOrExpired": "The provided code is invalid or has expired."
@@ -70,7 +71,8 @@
     "minLowercase": "Password must contain at least {minLowercase} lowercase letter(s).",
     "minUppercase": "Password must contain at least {minUppercase} uppercase letter(s).",
     "minNumbers": "Password must contain at least {minNumbers} number(s).",
-    "minSymbols": "Password must contain at least {minSymbols} special character(s)."
+    "minSymbols": "Password must contain at least {minSymbols} special character(s).",
+    "leaked": "This password appears in known data breaches. Please choose another one."
   },
   "createUser": {
     "nameRequired": "Name is required."

package/dist/language/pt.json

@@ -26,7 +26,8 @@
   },
   "forgot": {
     "rateLimit": "Muitas solicitações. Por favor, tente novamente mais tarde.",
-    "userNotFound": "Usuário não encontrado."
+    "userNotFound": "Usuário não encontrado.",
+    "noPassword": "Esta conta não possui senha cadastrada. Faça login utilizando o provedor de acesso da sua organização (ex: Microsoft)."
   },
   "challenge": {
     "invalidOrExpired": "O código informado é inválido ou expirou."
@@ -70,7 +71,8 @@
     "minLowercase": "A senha deve conter pelo menos {minLowercase} letra(s) minúscula(s).",
     "minUppercase": "A senha deve conter pelo menos {minUppercase} letra(s) maiúscula(s).",
     "minNumbers": "A senha deve conter pelo menos {minNumbers} número(s).",
-    "minSymbols": "A senha deve conter pelo menos {minSymbols} caractere(s) especial(is)."
+    "minSymbols": "A senha deve conter pelo menos {minSymbols} caractere(s) especial(is).",
+    "leaked": "Esta senha aparece em vazamentos de dados conhecidos. Escolha outra."
   },
   "createUser": {
     "nameRequired": "Nome é obrigatório."

package/dist/leaked-password/leaked-password.controller.d.ts

@@ -0,0 +1,24 @@
+import type { Request, Response } from 'express';
+import { LeakedPasswordService } from './leaked-password.service';
+/**
+ * Entrega o bloom filter do corpus de senhas vazadas para o cliente testar as
+ * senhas do cofre localmente.
+ *
+ * É o desenho que mantém a criptografia ponta a ponta: em vez de o navegador
+ * perguntar "esta senha vazou?" (revelando a senha, ou pelo menos um prefixo do
+ * hash dela), ele baixa o filtro inteiro uma vez e responde sozinho.
+ *
+ * Autenticado de propósito: o conteúdo é público em essência, mas são MBs por
+ * download, e o `If-None-Match` faz o navegador revalidar de graça.
+ */
+export declare class LeakedPasswordController {
+    private readonly leakedPasswordService;
+    constructor(leakedPasswordService: LeakedPasswordService);
+    filter(req: Request, res: Response): Promise<void>;
+    /** Tamanho do corpus, para a tela de configuração mostrar o que está ativo. */
+    stats(): Promise<{
+        count: number;
+        lastUpdatedAt: Date;
+    }>;
+}
+//# sourceMappingURL=leaked-password.controller.d.ts.map

package/dist/leaked-password/leaked-password.controller.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"leaked-password.controller.d.ts","sourceRoot":"","sources":["../../src/leaked-password/leaked-password.controller.ts"],"names":[],"mappings":"AAEA,OAAO,KAAK,EAAE,OAAO,EAAE,QAAQ,EAAE,MAAM,SAAS,CAAC;AACjD,OAAO,EAAE,qBAAqB,EAAE,MAAM,2BAA2B,CAAC;AAElE;;;;;;;;;;GAUG;AACH,qBAEa,wBAAwB;IAGjC,OAAO,CAAC,QAAQ,CAAC,qBAAqB;gBAArB,qBAAqB,EAAE,qBAAqB;IAIzD,MAAM,CAAQ,GAAG,EAAE,OAAO,EAAS,GAAG,EAAE,QAAQ,GAAG,OAAO,CAAC,IAAI,CAAC;IAoBtE,+EAA+E;IAEzE,KAAK;;;;CAIZ"}

package/dist/leaked-password/leaked-password.controller.js

@@ -0,0 +1,78 @@
+"use strict";
+var __decorate = (this && this.__decorate) || function (decorators, target, key, desc) {
+    var c = arguments.length, r = c < 3 ? target : desc === null ? desc = Object.getOwnPropertyDescriptor(target, key) : desc, d;
+    if (typeof Reflect === "object" && typeof Reflect.decorate === "function") r = Reflect.decorate(decorators, target, key, desc);
+    else for (var i = decorators.length - 1; i >= 0; i--) if (d = decorators[i]) r = (c < 3 ? d(r) : c > 3 ? d(target, key, r) : d(target, key)) || r;
+    return c > 3 && r && Object.defineProperty(target, key, r), r;
+};
+var __metadata = (this && this.__metadata) || function (k, v) {
+    if (typeof Reflect === "object" && typeof Reflect.metadata === "function") return Reflect.metadata(k, v);
+};
+var __param = (this && this.__param) || function (paramIndex, decorator) {
+    return function (target, key) { decorator(target, key, paramIndex); }
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.LeakedPasswordController = void 0;
+const api_1 = require("@hed-hog/api");
+const common_1 = require("@nestjs/common");
+const leaked_password_service_1 = require("./leaked-password.service");
+/**
+ * Entrega o bloom filter do corpus de senhas vazadas para o cliente testar as
+ * senhas do cofre localmente.
+ *
+ * É o desenho que mantém a criptografia ponta a ponta: em vez de o navegador
+ * perguntar "esta senha vazou?" (revelando a senha, ou pelo menos um prefixo do
+ * hash dela), ele baixa o filtro inteiro uma vez e responde sozinho.
+ *
+ * Autenticado de propósito: o conteúdo é público em essência, mas são MBs por
+ * download, e o `If-None-Match` faz o navegador revalidar de graça.
+ */
+let LeakedPasswordController = class LeakedPasswordController {
+    constructor(leakedPasswordService) {
+        this.leakedPasswordService = leakedPasswordService;
+    }
+    async filter(req, res) {
+        const filter = await this.leakedPasswordService.getFilter();
+        if (req.headers['if-none-match'] === filter.etag) {
+            res.status(304).end();
+            return;
+        }
+        res.set({
+            'Content-Type': 'application/octet-stream',
+            'Content-Length': String(filter.bytes.length),
+            ETag: filter.etag,
+            // `must-revalidate` com ETag: o navegador reusa o filtro sem baixar de novo,
+            // mas nunca serve corpus velho depois de um import.
+            'Cache-Control': 'private, max-age=0, must-revalidate',
+            'X-Leaked-Password-Count': String(filter.count),
+        });
+        res.end(filter.bytes);
+    }
+    /** Tamanho do corpus, para a tela de configuração mostrar o que está ativo. */
+    async stats() {
+        const version = await this.leakedPasswordService.getCorpusVersion();
+        return { count: version.count, lastUpdatedAt: version.lastCreatedAt };
+    }
+};
+exports.LeakedPasswordController = LeakedPasswordController;
+__decorate([
+    (0, common_1.Get)('filter'),
+    __param(0, (0, common_1.Req)()),
+    __param(1, (0, common_1.Res)()),
+    __metadata("design:type", Function),
+    __metadata("design:paramtypes", [Object, Object]),
+    __metadata("design:returntype", Promise)
+], LeakedPasswordController.prototype, "filter", null);
+__decorate([
+    (0, common_1.Get)('stats'),
+    __metadata("design:type", Function),
+    __metadata("design:paramtypes", []),
+    __metadata("design:returntype", Promise)
+], LeakedPasswordController.prototype, "stats", null);
+exports.LeakedPasswordController = LeakedPasswordController = __decorate([
+    (0, api_1.Role)(),
+    (0, common_1.Controller)('leaked-password'),
+    __param(0, (0, common_1.Inject)((0, common_1.forwardRef)(() => leaked_password_service_1.LeakedPasswordService))),
+    __metadata("design:paramtypes", [leaked_password_service_1.LeakedPasswordService])
+], LeakedPasswordController);
+//# sourceMappingURL=leaked-password.controller.js.map

package/dist/leaked-password/leaked-password.controller.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"leaked-password.controller.js","sourceRoot":"","sources":["../../src/leaked-password/leaked-password.controller.ts"],"names":[],"mappings":";;;;;;;;;;;;;;;AAAA,sCAAoC;AACpC,2CAA+E;AAE/E,uEAAkE;AAElE;;;;;;;;;;GAUG;AAGI,IAAM,wBAAwB,GAA9B,MAAM,wBAAwB;IACnC,YAEmB,qBAA4C;QAA5C,0BAAqB,GAArB,qBAAqB,CAAuB;IAC5D,CAAC;IAGE,AAAN,KAAK,CAAC,MAAM,CAAQ,GAAY,EAAS,GAAa;QACpD,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,qBAAqB,CAAC,SAAS,EAAE,CAAC;QAE5D,IAAI,GAAG,CAAC,OAAO,CAAC,eAAe,CAAC,KAAK,MAAM,CAAC,IAAI,EAAE,CAAC;YACjD,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,GAAG,EAAE,CAAC;YACtB,OAAO;QACT,CAAC;QAED,GAAG,CAAC,GAAG,CAAC;YACN,cAAc,EAAE,0BAA0B;YAC1C,gBAAgB,EAAE,MAAM,CAAC,MAAM,CAAC,KAAK,CAAC,MAAM,CAAC;YAC7C,IAAI,EAAE,MAAM,CAAC,IAAI;YACjB,6EAA6E;YAC7E,oDAAoD;YACpD,eAAe,EAAE,qCAAqC;YACtD,yBAAyB,EAAE,MAAM,CAAC,MAAM,CAAC,KAAK,CAAC;SAChD,CAAC,CAAC;QACH,GAAG,CAAC,GAAG,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;IACxB,CAAC;IAED,+EAA+E;IAEzE,AAAN,KAAK,CAAC,KAAK;QACT,MAAM,OAAO,GAAG,MAAM,IAAI,CAAC,qBAAqB,CAAC,gBAAgB,EAAE,CAAC;QACpE,OAAO,EAAE,KAAK,EAAE,OAAO,CAAC,KAAK,EAAE,aAAa,EAAE,OAAO,CAAC,aAAa,EAAE,CAAC;IACxE,CAAC;CACF,CAAA;AAjCY,4DAAwB;AAO7B;IADL,IAAA,YAAG,EAAC,QAAQ,CAAC;IACA,WAAA,IAAA,YAAG,GAAE,CAAA;IAAgB,WAAA,IAAA,YAAG,GAAE,CAAA;;;;sDAkBvC;AAIK;IADL,IAAA,YAAG,EAAC,OAAO,CAAC;;;;qDAIZ;mCAhCU,wBAAwB;IAFpC,IAAA,UAAI,GAAE;IACN,IAAA,mBAAU,EAAC,iBAAiB,CAAC;IAGzB,WAAA,IAAA,eAAM,EAAC,IAAA,mBAAU,EAAC,GAAG,EAAE,CAAC,+CAAqB,CAAC,CAAC,CAAA;qCACR,+CAAqB;GAHpD,wBAAwB,CAiCpC"}

package/dist/leaked-password/leaked-password.module.d.ts

@@ -0,0 +1,8 @@
+/**
+ * `@Global()` porque o validador de política de senha alcança este serviço pelo
+ * service locator, de fora da árvore de injeção normal (mesmo caminho do
+ * SettingService).
+ */
+export declare class LeakedPasswordModule {
+}
+//# sourceMappingURL=leaked-password.module.d.ts.map

package/dist/leaked-password/leaked-password.module.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"leaked-password.module.d.ts","sourceRoot":"","sources":["../../src/leaked-password/leaked-password.module.ts"],"names":[],"mappings":"AAKA;;;;GAIG;AACH,qBAOa,oBAAoB;CAAG"}

package/dist/leaked-password/leaked-password.module.js

@@ -0,0 +1,31 @@
+"use strict";
+var __decorate = (this && this.__decorate) || function (decorators, target, key, desc) {
+    var c = arguments.length, r = c < 3 ? target : desc === null ? desc = Object.getOwnPropertyDescriptor(target, key) : desc, d;
+    if (typeof Reflect === "object" && typeof Reflect.decorate === "function") r = Reflect.decorate(decorators, target, key, desc);
+    else for (var i = decorators.length - 1; i >= 0; i--) if (d = decorators[i]) r = (c < 3 ? d(r) : c > 3 ? d(target, key, r) : d(target, key)) || r;
+    return c > 3 && r && Object.defineProperty(target, key, r), r;
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.LeakedPasswordModule = void 0;
+const api_prisma_1 = require("@hed-hog/api-prisma");
+const common_1 = require("@nestjs/common");
+const leaked_password_controller_1 = require("./leaked-password.controller");
+const leaked_password_service_1 = require("./leaked-password.service");
+/**
+ * `@Global()` porque o validador de política de senha alcança este serviço pelo
+ * service locator, de fora da árvore de injeção normal (mesmo caminho do
+ * SettingService).
+ */
+let LeakedPasswordModule = class LeakedPasswordModule {
+};
+exports.LeakedPasswordModule = LeakedPasswordModule;
+exports.LeakedPasswordModule = LeakedPasswordModule = __decorate([
+    (0, common_1.Global)(),
+    (0, common_1.Module)({
+        imports: [(0, common_1.forwardRef)(() => api_prisma_1.PrismaModule)],
+        controllers: [leaked_password_controller_1.LeakedPasswordController],
+        providers: [leaked_password_service_1.LeakedPasswordService],
+        exports: [leaked_password_service_1.LeakedPasswordService],
+    })
+], LeakedPasswordModule);
+//# sourceMappingURL=leaked-password.module.js.map

package/dist/leaked-password/leaked-password.module.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"leaked-password.module.js","sourceRoot":"","sources":["../../src/leaked-password/leaked-password.module.ts"],"names":[],"mappings":";;;;;;;;;AAAA,oDAAmD;AACnD,2CAA4D;AAC5D,6EAAwE;AACxE,uEAAkE;AAElE;;;;GAIG;AAQI,IAAM,oBAAoB,GAA1B,MAAM,oBAAoB;CAAG,CAAA;AAAvB,oDAAoB;+BAApB,oBAAoB;IAPhC,IAAA,eAAM,GAAE;IACR,IAAA,eAAM,EAAC;QACN,OAAO,EAAE,CAAC,IAAA,mBAAU,EAAC,GAAG,EAAE,CAAC,yBAAY,CAAC,CAAC;QACzC,WAAW,EAAE,CAAC,qDAAwB,CAAC;QACvC,SAAS,EAAE,CAAC,+CAAqB,CAAC;QAClC,OAAO,EAAE,CAAC,+CAAqB,CAAC;KACjC,CAAC;GACW,oBAAoB,CAAG"}

package/dist/leaked-password/leaked-password.service.d.ts

@@ -0,0 +1,64 @@
+import { PrismaService } from '@hed-hog/api-prisma';
+export type LeakedPasswordFilter = {
+    /**
+     * `Uint8Array` e não `Buffer` de propósito: o `Buffer` do @types/node atual é
+     * genérico em `ArrayBufferLike`, e o campo `Bytes` do Prisma exige
+     * `Uint8Array<ArrayBuffer>` — misturar os dois não compila.
+     */
+    bytes: Uint8Array<ArrayBuffer>;
+    etag: string;
+    /** Hashes representados no filtro. */
+    count: number;
+};
+export type CorpusVersion = {
+    count: number;
+    lastCreatedAt: Date | null;
+    /** Identidade compacta do corpus, base do ETag e da invalidação do cache. */
+    tag: string;
+};
+export type ImportEntry = {
+    /** SHA-1 em 20 bytes. */
+    hash: Uint8Array<ArrayBuffer>;
+    occurrences: number;
+};
+export type ImportResult = {
+    read: number;
+    inserted: number;
+    skipped: number;
+};
+export declare class LeakedPasswordService {
+    private readonly prismaService;
+    private readonly logger;
+    private cachedFilter;
+    private cachedFilterTag;
+    private cachedVersion;
+    private cachedVersionAt;
+    constructor(prismaService: PrismaService);
+    /** SHA-1 da senha, o formato em que os corpus públicos são distribuídos. */
+    private digest;
+    /**
+     * A senha aparece no corpus? Só para caminhos em que o servidor já recebe a
+     * senha em claro — nunca chame isto com senha de cofre.
+     */
+    isLeaked(password: string): Promise<boolean>;
+    /** Quantas vezes a senha aparece nos vazamentos; 0 quando não aparece. */
+    occurrencesOf(password: string): Promise<number>;
+    /** Versão do corpus, com cache curto para não pagar `count()` por request. */
+    getCorpusVersion(force?: boolean): Promise<CorpusVersion>;
+    /**
+     * Filtro serializado do corpus. Reconstrói só quando a versão muda; o
+     * `count` da versão define o tamanho do vetor de bits.
+     */
+    getFilter(): Promise<LeakedPasswordFilter>;
+    /**
+     * Varre o corpus paginando por id. Prisma não expõe cursor de verdade, e
+     * `skip` degrada em tabela grande — o cursor por id mantém custo constante.
+     */
+    private scanDigests;
+    /**
+     * Ingere hashes de um dump. `createMany` com `skipDuplicates` deixa o unique
+     * de `hash` resolver a repetição, então reimportar o mesmo arquivo é inócuo.
+     */
+    importEntries(entries: AsyncIterable<ImportEntry> | Iterable<ImportEntry>): Promise<ImportResult>;
+}
+//# sourceMappingURL=leaked-password.service.d.ts.map

package/dist/leaked-password/leaked-password.service.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"leaked-password.service.d.ts","sourceRoot":"","sources":["../../src/leaked-password/leaked-password.service.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,aAAa,EAAE,MAAM,qBAAqB,CAAC;AA6BpD,MAAM,MAAM,oBAAoB,GAAG;IACjC;;;;OAIG;IACH,KAAK,EAAE,UAAU,CAAC,WAAW,CAAC,CAAC;IAC/B,IAAI,EAAE,MAAM,CAAC;IACb,sCAAsC;IACtC,KAAK,EAAE,MAAM,CAAC;CACf,CAAC;AAEF,MAAM,MAAM,aAAa,GAAG;IAC1B,KAAK,EAAE,MAAM,CAAC;IACd,aAAa,EAAE,IAAI,GAAG,IAAI,CAAC;IAC3B,6EAA6E;IAC7E,GAAG,EAAE,MAAM,CAAC;CACb,CAAC;AAEF,MAAM,MAAM,WAAW,GAAG;IACxB,yBAAyB;IACzB,IAAI,EAAE,UAAU,CAAC,WAAW,CAAC,CAAC;IAC9B,WAAW,EAAE,MAAM,CAAC;CACrB,CAAC;AAEF,MAAM,MAAM,YAAY,GAAG;IACzB,IAAI,EAAE,MAAM,CAAC;IACb,QAAQ,EAAE,MAAM,CAAC;IACjB,OAAO,EAAE,MAAM,CAAC;CACjB,CAAC;AAEF,qBACa,qBAAqB;IAW9B,OAAO,CAAC,QAAQ,CAAC,aAAa;IAVhC,OAAO,CAAC,QAAQ,CAAC,MAAM,CAA0C;IAEjE,OAAO,CAAC,YAAY,CAAqC;IACzD,OAAO,CAAC,eAAe,CAAuB;IAE9C,OAAO,CAAC,aAAa,CAA8B;IACnD,OAAO,CAAC,eAAe,CAAK;gBAIT,aAAa,EAAE,aAAa;IAG/C,4EAA4E;IAC5E,OAAO,CAAC,MAAM;IAId;;;OAGG;IACG,QAAQ,CAAC,QAAQ,EAAE,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC;IAkBlD,0EAA0E;IACpE,aAAa,CAAC,QAAQ,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC;IAStD,8EAA8E;IACxE,gBAAgB,CAAC,KAAK,UAAQ,GAAG,OAAO,CAAC,aAAa,CAAC;IA8B7D;;;OAGG;IACG,SAAS,IAAI,OAAO,CAAC,oBAAoB,CAAC;IA6BhD;;;OAGG;YACW,WAAW;IAwBzB;;;OAGG;IACG,aAAa,CACjB,OAAO,EAAE,aAAa,CAAC,WAAW,CAAC,GAAG,QAAQ,CAAC,WAAW,CAAC,GAC1D,OAAO,CAAC,YAAY,CAAC;CA8BzB"}