@hed-hog/core 0.0.386 → 0.0.390

package/src/index.ts

@@ -5,6 +5,10 @@ export * from './core.module';
 export * from './auth/auth.service';
 export * from './auth/guards/auth.guard';
 
+// Captcha Module (shared by every public form: campaign signup, sac tickets, ...)
+export * from './captcha/captcha.module';
+export * from './captcha/captcha.service';
+
 // Menu Module
 export * from './menu/menu.service';
 
@@ -19,6 +23,13 @@ export * from './screen/screen.service';
 export * from './user/constants/user.constants';
 export * from './user/user.service';
 
+export * from './incident/incident.module';
+export * from './incident/incident.service';
+export * from './leaked-password/leaked-password.module';
+export * from './leaked-password/leaked-password.service';
+
+export * from './mail-layout/mail-layout.module';
+export * from './mail-layout/mail-layout.service';
 export * from './mail/mail.module';
 export * from './mail/mail.service';
 
@@ -27,6 +38,11 @@ export * from './integration-profile/integration-profile.service';
 export * from './integration-profile/integration-profile.utils';
 export * from './integration-profile/integration-profile.secrets';
 export * from './integration-profile/integration-credential-crypto.service';
+export * from './integration-profile/testers/integration-tester.types';
+export * from './integration-profile/testers/integration-tester.registry';
+
+export * from './whatsapp-sender/whatsapp-sender.module';
+export * from './whatsapp-sender/whatsapp-sender.service';
 
 export * from './file/file.module';
 export * from './file/file.service';
@@ -39,12 +55,21 @@ export * from './setting/setting.service';
 export * from './ai/ai.module';
 export * from './ai/ai.service';
 
+export * from './ai-instruction/ai-instruction.module';
+export * from './ai-instruction/ai-instruction.service';
+export * from './ai-instruction/ai-prompt-builder.service';
+export * from './ai-instruction/ai-prompt-registry';
+export * from './ai-instruction/ai-prompt-resolver.service';
+export * from './ai-instruction/ai-prompt-template.util';
+export * from './ai-instruction/types/ai-instruction.types';
+
 export * from './app-command/app-command.module';
 export * from './app-command/app-command.registry';
 export * from './webhook-integration/event-webhook.service';
 export * from './webhook-integration/integration-event-catalog.service';
 export * from './webhook-integration/webhook-integration.module';
 export * from './webhook-integration/webhook-integration.service';
+export * from './webhook-integration/webhook-protocol.registry';
 
 // Integration Module
 export * from './integration/integration.module';
@@ -73,6 +98,10 @@ export * from './mcp/mcp-registry.service';
 export * from './mcp/mcp.module';
 export * from './mcp/types/mcp-context.type';
 
+// OAuth Module
+export * from './oauth/oauth.module';
+export * from './oauth/oauth-token-broker.service';
+
 // Utilities
 export * from './utils/locale-context';
 
@@ -82,3 +111,12 @@ export * from './notification/dto/create-notification.dto';
 export * from './notification/notification.module';
 export * from './notification/notification.service';
 
+// Realtime Module (generic WebSocket layer)
+export * from './realtime/realtime.module';
+export * from './realtime/realtime.service';
+export * from './realtime/realtime.gateway';
+
+// Presence Module
+export * from './presence/presence.module';
+export * from './presence/presence.service';
+

package/src/integration-profile/dto/test.dto.ts

@@ -0,0 +1,19 @@
+import { Type } from 'class-transformer';
+import { IsInt, IsOptional, Min } from 'class-validator';
+import { CreateDTO } from './create.dto';
+
+export class TestDTO extends CreateDTO {
+  /**
+   * Perfil ao qual estas credenciais pertencem, quando o teste parte da edição.
+   *
+   * Sem ele o perfil armazenado só pode ser encontrado pelo `slug` — e o slug é
+   * editável: quem renomeia o perfil e testa antes de salvar não casa com nenhuma
+   * linha, então os segredos mascarados não são herdados e o teste roda com
+   * "********" no lugar da senha. Opcional para não quebrar quem já chama a rota.
+   */
+  @IsOptional()
+  @IsInt()
+  @Min(1)
+  @Type(() => Number)
+  profile_id?: number;
+}

package/src/integration-profile/integration-profile.controller.ts

@@ -14,14 +14,17 @@ import {
   Query,
   Res,
   UploadedFile,
+  UseGuards,
   UseInterceptors,
   forwardRef,
 } from '@nestjs/common';
 import { FileInterceptor } from '@nestjs/platform-express';
+import { Throttle, ThrottlerGuard } from '@nestjs/throttler';
 import { Response } from 'express';
 import { CreateDTO } from './dto/create.dto';
 import { ExportDTO } from './dto/export.dto';
 import { ImportConfirmDTO } from './dto/import-confirm.dto';
+import { TestDTO } from './dto/test.dto';
 import { UpdateDTO } from './dto/update.dto';
 import { IntegrationProfileService } from './integration-profile.service';
 
@@ -99,8 +102,14 @@ export class IntegrationProfileController {
     return this.integrationProfileService.create(data);
   }
 
+  /**
+   * Dispara chamadas HTTP de saída para o endereço do provider, então tem taxa
+   * limitada — o ThrottlerGuard não é global neste projeto.
+   */
+  @UseGuards(ThrottlerGuard)
+  @Throttle({ default: { limit: 10, ttl: 60_000 } })
   @Post('test')
-  async test(@Body() data: CreateDTO) {
+  async test(@Body() data: TestDTO) {
     return this.integrationProfileService.test(data);
   }
 

package/src/integration-profile/integration-profile.module.spec.ts

@@ -0,0 +1,51 @@
+import { describe, expect, it } from '@jest/globals';
+import { IntegrationProfileModule } from './integration-profile.module';
+import { IntegrationProfileService } from './integration-profile.service';
+import { IntegrationCredentialCryptoService } from './integration-credential-crypto.service';
+import { BUILTIN_INTEGRATION_TESTERS } from './testers';
+import { IntegrationTesterRegistry } from './testers/integration-tester.registry';
+
+/**
+ * O `IntegrationTesterRegistry` é injetado no service e consumido de fora (a library
+ * fiscal registra o tester do nfse-national). Esquecer de declará-lo em `providers`
+ * ou `exports` só falharia no boot da API — este teste antecipa isso.
+ */
+describe('IntegrationProfileModule', () => {
+  const providers = Reflect.getMetadata('providers', IntegrationProfileModule) ?? [];
+  const exports = Reflect.getMetadata('exports', IntegrationProfileModule) ?? [];
+
+  it('declara e exporta tudo que o service e as libraries externas precisam', () => {
+    for (const dependency of [
+      IntegrationProfileService,
+      IntegrationCredentialCryptoService,
+      IntegrationTesterRegistry,
+    ]) {
+      expect(providers).toContain(dependency);
+      expect(exports).toContain(dependency);
+    }
+  });
+
+  it('registra todos os testers embutidos no boot', () => {
+    const registry = new IntegrationTesterRegistry();
+    const module = new IntegrationProfileModule(registry);
+
+    module.onModuleInit();
+
+    expect(registry.list()).toEqual(
+      [...BUILTIN_INTEGRATION_TESTERS.map((t) => t.providerSlug)].sort(),
+    );
+    // Amostra de cada tipo, para o teste falhar se um grupo inteiro sumir do index.
+    for (const slug of [
+      'smtp',
+      'whatsapp-official',
+      's3',
+      'openai',
+      'google-oauth',
+      'stripe',
+      'recaptcha',
+      'digitalocean',
+    ]) {
+      expect(registry.has(slug)).toBe(true);
+    }
+  });
+});

package/src/integration-profile/integration-profile.module.ts

@@ -1,10 +1,12 @@
 import { PaginationModule } from '@hed-hog/api-pagination';
 import { PrismaModule } from '@hed-hog/api-prisma';
-import { forwardRef, Module } from '@nestjs/common';
+import { forwardRef, Module, OnModuleInit } from '@nestjs/common';
 import { SecurityModule } from '../security/security.module';
 import { IntegrationCredentialCryptoService } from './integration-credential-crypto.service';
 import { IntegrationProfileController } from './integration-profile.controller';
 import { IntegrationProfileService } from './integration-profile.service';
+import { BUILTIN_INTEGRATION_TESTERS } from './testers';
+import { IntegrationTesterRegistry } from './testers/integration-tester.registry';
 
 @Module({
   imports: [
@@ -13,7 +15,24 @@ import { IntegrationProfileService } from './integration-profile.service';
     forwardRef(() => SecurityModule),
   ],
   controllers: [IntegrationProfileController],
-  providers: [IntegrationProfileService, IntegrationCredentialCryptoService],
-  exports: [IntegrationProfileService, IntegrationCredentialCryptoService],
+  providers: [
+    IntegrationProfileService,
+    IntegrationCredentialCryptoService,
+    IntegrationTesterRegistry,
+  ],
+  exports: [
+    IntegrationProfileService,
+    IntegrationCredentialCryptoService,
+    IntegrationTesterRegistry,
+  ],
 })
-export class IntegrationProfileModule {}
+export class IntegrationProfileModule implements OnModuleInit {
+  constructor(private readonly testerRegistry: IntegrationTesterRegistry) {}
+
+  onModuleInit() {
+    // Libraries externas (fiscal) registram os seus depois, no boot dos próprios módulos.
+    for (const tester of BUILTIN_INTEGRATION_TESTERS) {
+      this.testerRegistry.register(tester);
+    }
+  }
+}

package/src/integration-profile/integration-profile.secrets.ts

@@ -22,9 +22,13 @@ export const INTEGRATION_SECRET_KEYS: Record<string, string[]> = {
   resend: ['api_token', 'webhook_secret'],
   // Mensageria
   'evolution-api': ['token'],
-  'whatsapp-official': ['access_token'],
+  // app_secret assina o HMAC do webhook (X-Hub-Signature-256) e verify_token é
+  // comparado no handshake da Meta: quem tem qualquer um dos dois forja eventos.
+  'whatsapp-official': ['access_token', 'app_secret', 'verify_token'],
   // Storage
-  s3: ['secret_access_key'],
+  // session_token acompanha credenciais temporárias (STS) usadas pelo upload em
+  // massa do LMS: vale como credencial completa enquanto não expira.
+  s3: ['secret_access_key', 'session_token'],
   gcs: ['key_file_json'],
   'azure-blob': ['key'],
   's3-compatible': ['secret_access_key'],
@@ -32,6 +36,9 @@ export const INTEGRATION_SECRET_KEYS: Record<string, string[]> = {
   openai: ['api_key'],
   gemini: ['api_key'],
   claude: ['api_key'],
+  deepseek: ['api_key'],
+  // Geração de vídeo
+  luma: ['api_key'],
   // OAuth
   'google-oauth': ['client_secret'],
   'github-oauth': ['client_secret'],
@@ -45,6 +52,9 @@ export const INTEGRATION_SECRET_KEYS: Record<string, string[]> = {
   // Pagamento
   stripe: ['secret_key', 'webhook_secret'],
   mercado_pago: ['access_token', 'webhook_secret'],
+  // A service account do Google Play assina o JWT trocado por access token: tanto
+  // o JSON inteiro quanto a private_key avulsa dão acesso à API do app.
+  google_play: ['service_account_json', 'private_key'],
   // Captcha
   recaptcha: ['secret_key'],
   'cloudflare-turnstile': ['secret_key'],

package/src/integration-profile/integration-profile.service.spec.ts

@@ -0,0 +1,279 @@
+import { beforeEach, describe, expect, it, jest } from '@jest/globals';
+import { BadRequestException } from '@nestjs/common';
+import { IntegrationProfileService } from './integration-profile.service';
+import { IntegrationCredentialCryptoService } from './integration-credential-crypto.service';
+import { IntegrationTesterRegistry } from './testers/integration-tester.registry';
+import { IntegrationTester } from './testers/integration-tester.types';
+
+/**
+ * Cobre o despacho de `POST /integration-profile/test`: o que o tester recebe, o que
+ * é gravado no perfil e o que volta para a UI. As garantias aqui são de segurança e
+ * de integridade de dados, não de comportamento de um provider específico.
+ */
+
+const SMTP_PROVIDER = {
+  slug: 'smtp',
+  integration_type: { slug: 'email' },
+};
+
+function makeService({
+  tester,
+  storedConfig = null,
+  provider = SMTP_PROVIDER,
+}: {
+  tester?: IntegrationTester;
+  storedConfig?: Record<string, unknown> | null;
+  provider?: unknown;
+} = {}) {
+  const stored = storedConfig ? { id: 42, config: storedConfig } : null;
+
+  const prismaService = {
+    integration_type: { findUnique: jest.fn<any>().mockResolvedValue({ id: 1 }) },
+    integration_provider: {
+      findUnique: jest.fn<any>().mockResolvedValue(provider),
+    },
+    integration_profile: {
+      findUnique: jest.fn<any>().mockResolvedValue(stored),
+      update: jest.fn<any>().mockResolvedValue({}),
+    },
+  };
+
+  // O crypto real: `mergeKeepingStoredSecrets` e `encryptConfig` fazem parte do que
+  // está sendo verificado, então mocká-los esconderia justamente as regressões.
+  const credentialCrypto = new IntegrationCredentialCryptoService({
+    encrypt: (value: string) => `cipher(${value})`,
+    decrypt: (value: string) => value,
+  } as any);
+
+  const registry = new IntegrationTesterRegistry();
+  if (tester) registry.register(tester);
+
+  const service = new IntegrationProfileService(
+    prismaService as any,
+    {} as any,
+    credentialCrypto,
+    registry,
+  );
+  // `validateTypeAndProvider` só confirma a existência das FKs; não é o alvo aqui.
+  jest
+    .spyOn(service as any, 'validateTypeAndProvider')
+    .mockResolvedValue(undefined as never);
+
+  return { service, prismaService, registry };
+}
+
+const baseInput = {
+  slug: 'meu-smtp',
+  name: 'Meu SMTP',
+  type_id: 1,
+  provider_id: 10,
+  config: { host: 'smtp.acme.com', from_email: 'envio@acme.com' },
+};
+
+describe('IntegrationProfileService.test', () => {
+  beforeEach(() => {
+    jest.clearAllMocks();
+  });
+
+  it('recusa providers sem tester registrado', async () => {
+    const { service } = makeService();
+
+    await expect(service.test({ ...baseInput } as any)).rejects.toThrow(
+      'Connection test is not available for provider "smtp".',
+    );
+  });
+
+  it('entrega ao tester o segredo armazenado no lugar da máscara', async () => {
+    const seen: Array<Record<string, unknown>> = [];
+    const tester: IntegrationTester = {
+      providerSlug: 'smtp',
+      test: async (config) => {
+        seen.push(config);
+        return { ok: true, info: 'smtp.acme.com:587' };
+      },
+    };
+    const { service } = makeService({
+      tester,
+      storedConfig: { password: 'senha-real-armazenada' },
+    });
+
+    await service.test({
+      ...baseInput,
+      config: { ...baseInput.config, password: '********' },
+    } as any);
+
+    expect(seen[0].password).toBe('senha-real-armazenada');
+  });
+
+  it('resolve o perfil por profile_id quando ele vem, para o slug renomeado não perder os segredos', async () => {
+    const tester: IntegrationTester = {
+      providerSlug: 'smtp',
+      test: async () => ({ ok: true }),
+    };
+    const { service, prismaService } = makeService({
+      tester,
+      storedConfig: { password: 'stored' },
+    });
+
+    await service.test({ ...baseInput, slug: 'novo-slug', profile_id: 42 } as any);
+
+    expect(prismaService.integration_profile.findUnique).toHaveBeenCalledWith(
+      expect.objectContaining({ where: { id: 42 } }),
+    );
+  });
+
+  it('grava o resultado sobre o config ARMAZENADO, nunca sobre o que veio no formulário', async () => {
+    const tester: IntegrationTester = {
+      providerSlug: 'smtp',
+      test: async () => ({ ok: true, info: 'smtp.acme.com:587' }),
+    };
+    const { service, prismaService } = makeService({
+      tester,
+      storedConfig: { host: 'smtp.antigo.com', password: 'stored' },
+    });
+
+    await service.test({
+      ...baseInput,
+      config: { host: 'smtp.ainda-nao-salvo.com', from_email: 'x@y.com' },
+    } as any);
+
+    const written = prismaService.integration_profile.update.mock
+      .calls[0][0] as any;
+    // O host digitado e não salvo não pode entrar no banco de carona no teste.
+    expect(written.data.config.host).toBe('smtp.antigo.com');
+    expect(written.data.config).not.toHaveProperty('from_email');
+    expect(written.data.config.last_validation_status).toBe('ok');
+    expect(written.data.config.last_validation_info).toBe('smtp.acme.com:587');
+    expect(written.data.config.last_error).toBeNull();
+    expect(written.data.config.last_validated_at).toEqual(expect.any(String));
+    // O segredo é recifrado (com envelope) ao gravar.
+    expect(written.data.config.password).toBe('enc.v1.cipher(stored)');
+  });
+
+  it('registra a falha e devolve 400 com a mensagem do tester', async () => {
+    const tester: IntegrationTester = {
+      providerSlug: 'smtp',
+      test: async () => ({ ok: false, error: 'SMTP authentication failed.' }),
+    };
+    const { service, prismaService } = makeService({
+      tester,
+      storedConfig: { password: 'stored' },
+    });
+
+    await expect(service.test({ ...baseInput } as any)).rejects.toThrow(
+      BadRequestException,
+    );
+
+    const written = prismaService.integration_profile.update.mock
+      .calls[0][0] as any;
+    expect(written.data.config.last_validation_status).toBe('error');
+    expect(written.data.config.last_error).toBe('SMTP authentication failed.');
+  });
+
+  it('não grava nada quando o perfil ainda não existe, e avisa na resposta', async () => {
+    const tester: IntegrationTester = {
+      providerSlug: 'smtp',
+      test: async () => ({ ok: true, info: 'ok' }),
+    };
+    const { service, prismaService } = makeService({ tester });
+
+    const result = await service.test({ ...baseInput } as any);
+
+    expect(prismaService.integration_profile.update).not.toHaveBeenCalled();
+    expect(result.persisted).toBe(false);
+  });
+
+  it('uma falha ao gravar não transforma um teste bem-sucedido em erro', async () => {
+    const tester: IntegrationTester = {
+      providerSlug: 'smtp',
+      test: async () => ({ ok: true, info: 'ok' }),
+    };
+    const { service, prismaService } = makeService({
+      tester,
+      storedConfig: { password: 'stored' },
+    });
+    prismaService.integration_profile.update.mockRejectedValue(
+      new Error('deadlock') as never,
+    );
+
+    const result = await service.test({ ...baseInput } as any);
+
+    expect(result.ok).toBe(true);
+    expect(result.persisted).toBe(false);
+  });
+
+  it('não vaza segredo quando o tester lança com a credencial na mensagem', async () => {
+    const tester: IntegrationTester = {
+      providerSlug: 'smtp',
+      test: async () => {
+        throw new Error('Provider echoed back senha-super-secreta-123');
+      },
+    };
+    const { service } = makeService({ tester });
+
+    const failure = await service
+      .test({
+        ...baseInput,
+        config: { ...baseInput.config, password: 'senha-super-secreta-123' },
+      } as any)
+      .catch((error) => error as BadRequestException);
+
+    expect(failure).toBeInstanceOf(BadRequestException);
+    expect(failure.message).not.toContain('senha-super-secreta-123');
+    expect(failure.message).toContain('***');
+  });
+
+  it('devolve o contrato legado (success/destination) junto dos campos novos', async () => {
+    const tester: IntegrationTester = {
+      providerSlug: 'smtp',
+      test: async () => ({ ok: true, info: 'smtp.acme.com:587', warning: 'heads up' }),
+    };
+    const { service } = makeService({ tester });
+
+    const result = await service.test({ ...baseInput } as any);
+
+    expect(result).toMatchObject({
+      success: true,
+      // A tela de e-mail depende de `destination` ser o remetente.
+      destination: 'envio@acme.com',
+      ok: true,
+      provider: 'smtp',
+      info: 'smtp.acme.com:587',
+      warning: 'heads up',
+      persisted: false,
+    });
+    expect(result.tested_at).toEqual(expect.any(String));
+  });
+
+  it('usa a evidência do tester como destination quando o tipo não é e-mail', async () => {
+    const tester: IntegrationTester = {
+      providerSlug: 's3',
+      test: async () => ({ ok: true, info: 'meu-bucket (us-east-1)' }),
+    };
+    const { service } = makeService({
+      tester,
+      provider: { slug: 's3', integration_type: { slug: 'storage' } },
+    });
+
+    const result = await service.test({
+      ...baseInput,
+      config: { bucket: 'meu-bucket' },
+    } as any);
+
+    expect(result.destination).toBe('meu-bucket (us-east-1)');
+  });
+
+  it('interrompe um tester que ignora o AbortSignal, em vez de segurar a requisição', async () => {
+    const tester: IntegrationTester = {
+      providerSlug: 'smtp',
+      timeoutMs: 10,
+      // Nunca resolve: é o transporter do nodemailer segurando o socket.
+      test: () => new Promise(() => {}),
+    };
+    const { service } = makeService({ tester });
+
+    await expect(service.test({ ...baseInput } as any)).rejects.toThrow(
+      /Timed out/,
+    );
+  });
+});