@hed-hog/core 0.0.386 → 0.0.390

package/src/integration-profile/integration-profile.service.ts

@@ -5,19 +5,26 @@ import {
   BadRequestException,
   Inject,
   Injectable,
+  Logger,
   NotFoundException,
   forwardRef,
 } from '@nestjs/common';
 import * as pako from 'pako';
-import { buildMailConfigFromIntegration } from './integration-profile.utils';
 import { CreateDTO } from './dto/create.dto';
 import {
   ConflictResolutionDTO,
   ImportProfileItemDTO,
 } from './dto/import-confirm.dto';
+import { TestDTO } from './dto/test.dto';
 import { UpdateDTO } from './dto/update.dto';
 import { IntegrationCredentialCryptoService } from './integration-credential-crypto.service';
 import { getSensitiveConfigKeys } from './integration-profile.secrets';
+import { sanitizeTesterError } from './testers/http-probe';
+import { IntegrationTesterRegistry } from './testers/integration-tester.registry';
+import {
+  INTEGRATION_TEST_TIMEOUT_MS,
+  IntegrationTestOutcome,
+} from './testers/integration-tester.types';
 
 type IntegrationProfileExportItem = {
   slug: string;
@@ -55,6 +62,8 @@ type InvalidImportItem = {
 
 @Injectable()
 export class IntegrationProfileService {
+  private readonly logger = new Logger(IntegrationProfileService.name);
+
   constructor(
     @Inject(forwardRef(() => PrismaService))
     private readonly prismaService: PrismaService,
@@ -62,6 +71,8 @@ export class IntegrationProfileService {
     private readonly paginationService: PaginationService,
     @Inject(forwardRef(() => IntegrationCredentialCryptoService))
     private readonly credentialCrypto: IntegrationCredentialCryptoService,
+    @Inject(forwardRef(() => IntegrationTesterRegistry))
+    private readonly testerRegistry: IntegrationTesterRegistry,
   ) {}
 
   async listTypes() {
@@ -430,7 +441,14 @@ export class IntegrationProfileService {
     });
   }
 
-  async test(data: CreateDTO) {
+  /**
+   * Testa as credenciais de um perfil contra o serviço real, sem salvar.
+   *
+   * Só despacha: quem sabe falar com cada provider é o `IntegrationTester` registrado
+   * no `IntegrationTesterRegistry`. Funciona tanto na edição (herda os segredos
+   * armazenados no lugar da máscara) quanto na criação de um perfil ainda inexistente.
+   */
+  async test(data: TestDTO) {
     await this.validateTypeAndProvider(data.type_id, data.provider_id);
 
     const provider = await this.prismaService.integration_provider.findUnique({
@@ -451,17 +469,22 @@ export class IntegrationProfileService {
       );
     }
 
-    if (provider.integration_type.slug !== 'email') {
+    const typeSlug = provider.integration_type.slug;
+    const slug = data.slug.trim();
+
+    const tester = this.testerRegistry.find(provider.slug);
+    if (!tester) {
       throw new BadRequestException(
-        'Integration profile test is only available for email type.',
+        `Connection test is not available for provider "${provider.slug}".`,
       );
     }
 
     // "Deixe em branco para manter": ao testar na edição, herda os segredos já
     // armazenados (decifrados pelo middleware) para os campos vazios/mascarados.
+    // Resolve por id quando ele veio: o slug é editável e pode ter mudado no form.
     let effectiveConfig = (data.config as Record<string, unknown>) ?? null;
     const stored = await this.prismaService.integration_profile.findUnique({
-      where: { slug: data.slug.trim() },
+      where: data.profile_id ? { id: data.profile_id } : { slug },
       select: { config: true },
     });
     if (stored?.config) {
@@ -472,42 +495,122 @@ export class IntegrationProfileService {
       ) as Record<string, unknown>;
     }
 
-    // Resend não usa SMTP/from_email: valida credenciais/domínio próprios.
-    if (provider.slug === 'resend') {
-      const resendCfg = (effectiveConfig as Record<string, unknown> | null) ?? {};
-      const apiToken = String(resendCfg.api_token ?? '').trim();
-      const domain = String(resendCfg.domain ?? '').trim();
-
-      if (!apiToken) {
-        throw new BadRequestException('Resend API token is required.');
-      }
-      if (!domain) {
-        throw new BadRequestException('Resend sending domain is required.');
-      }
+    const config = effectiveConfig ?? {};
+    const secretValues = getSensitiveConfigKeys(provider.slug)
+      .map((key) => String(config[key] ?? ''))
+      .filter((value) => value.length > 0);
 
-      return {
-        success: true,
-        destination: domain,
+    const timeoutMs = tester.timeoutMs ?? INTEGRATION_TEST_TIMEOUT_MS;
+    let outcome: IntegrationTestOutcome;
+    try {
+      // Duplo guarda de tempo: o AbortSignal cobre quem o respeita (fetch/SDKs) e o
+      // race cobre quem não respeita (o transporter do nodemailer, por exemplo).
+      outcome = await Promise.race([
+        tester.test(config, {
+          signal: AbortSignal.timeout(timeoutMs),
+          typeSlug,
+          providerSlug: provider.slug,
+          secretValues,
+        }),
+        this.hardTimeout(timeoutMs + 2_000),
+      ]);
+    } catch (error) {
+      outcome = {
+        ok: false,
+        error: sanitizeTesterError(error, secretValues),
       };
     }
 
-    buildMailConfigFromIntegration(provider.slug, effectiveConfig);
-
-    const destination = String(
-      (effectiveConfig as Record<string, unknown> | null | undefined)?.from_email ??
-        '',
-    ).trim();
+    const persisted = await this.recordValidation(
+      provider.slug,
+      slug,
+      outcome,
+      data.profile_id,
+    );
 
-    if (!destination) {
-      throw new BadRequestException('Sender email is required.');
+    if (!outcome.ok) {
+      this.logger.warn(
+        `Integration test failed for provider "${provider.slug}" (profile "${slug}"): ${outcome.error}`,
+      );
+      throw new BadRequestException(outcome.error || 'Connection test failed.');
     }
 
     return {
+      // `success` e `destination` são o contrato legado consumido pela tela de
+      // e-mail (core/integrations-webhooks): mantidos com o mesmo significado.
       success: true,
-      destination,
+      destination: String(config.from_email ?? '').trim() || outcome.info || '',
+      ok: true,
+      provider: provider.slug,
+      ...(outcome.info ? { info: outcome.info } : {}),
+      ...(outcome.warning ? { warning: outcome.warning } : {}),
+      tested_at: new Date().toISOString(),
+      persisted,
     };
   }
 
+  /** Rejeita depois de `ms`, para o caso de um tester ignorar o AbortSignal. */
+  private hardTimeout(ms: number): Promise<never> {
+    return new Promise((_resolve, reject) => {
+      const timer = setTimeout(() => {
+        const error = new Error('Connection test timed out.');
+        error.name = 'TimeoutError';
+        reject(error);
+      }, ms);
+      // Não segura o processo vivo caso o teste termine antes.
+      timer.unref?.();
+    });
+  }
+
+  /**
+   * Grava metadados (não-secretos) da última validação no config do perfil.
+   *
+   * Devolve se gravou: no fluxo de criação não existe linha ainda, e a UI usa isso
+   * para avisar que o resultado não ficou registrado.
+   */
+  private async recordValidation(
+    providerSlug: string,
+    slug: string,
+    outcome: IntegrationTestOutcome,
+    profileId?: number,
+  ): Promise<boolean> {
+    try {
+      const stored = await this.prismaService.integration_profile.findUnique({
+        where: profileId ? { id: profileId } : { slug },
+        select: { id: true, config: true },
+      });
+      // Perfil ainda não salvo (teste no fluxo de criação): nada a registrar.
+      if (!stored) return false;
+
+      // Parte de `stored.config`, NUNCA do config recebido: o que o usuário digitou
+      // e ainda não salvou não pode ser persistido de carona num teste.
+      // `stored.config` vem decifrado pelo middleware; recifra-mos ao gravar.
+      const plain = {
+        ...((stored.config as Record<string, unknown>) ?? {}),
+        last_validated_at: new Date().toISOString(),
+        last_validation_status: outcome.ok ? 'ok' : 'error',
+        last_error: outcome.ok ? null : (outcome.error ?? null),
+        last_validation_info: outcome.ok ? (outcome.info ?? null) : null,
+      };
+
+      await this.prismaService.integration_profile.update({
+        where: { id: stored.id },
+        data: {
+          config: this.credentialCrypto.encryptConfig(providerSlug, plain) as object,
+        },
+      });
+      return true;
+    } catch (error) {
+      // Falhar ao REGISTRAR não pode transformar um teste bem-sucedido em erro 500.
+      this.logger.error(
+        `Failed to record validation for profile "${slug}": ${
+          error instanceof Error ? error.message : String(error)
+        }`,
+      );
+      return false;
+    }
+  }
+
   async exportProfiles({
     ids,
     includeSecrets = false,

package/src/integration-profile/integration-profile.utils.spec.ts

@@ -12,6 +12,8 @@ import {
   buildDigitalOceanConfigFromIntegration,
   buildKubernetesConfigFromIntegration,
   buildAiConfigFromIntegration,
+  buildWhatsappOfficialConfigFromIntegration,
+  DEFAULT_GRAPH_API_VERSION,
 } from './integration-profile.utils';
 
 describe('integration-profile.utils', () => {
@@ -323,10 +325,105 @@ describe('integration-profile.utils', () => {
       });
     });
 
+    it('mapeia deepseek com a base URL padrão', () => {
+      expect(
+        buildAiConfigFromIntegration('deepseek', {
+          api_key: 'd',
+          model: 'deepseek-reasoner',
+        }),
+      ).toEqual({
+        apiKey: 'd',
+        model: 'deepseek-reasoner',
+        baseUrl: 'https://api.deepseek.com',
+      });
+    });
+
+    it('respeita a base URL informada no perfil deepseek', () => {
+      expect(
+        buildAiConfigFromIntegration('deepseek', {
+          api_key: 'd',
+          base_url: 'https://proxy.interno/v1/',
+        }),
+      ).toEqual({ apiKey: 'd', baseUrl: 'https://proxy.interno/v1' });
+    });
+
     it('lança para provider desconhecido', () => {
       expect(() => buildAiConfigFromIntegration('llama', {})).toThrow(
         BadRequestException,
       );
     });
   });
+
+  describe('buildWhatsappOfficialConfigFromIntegration', () => {
+    const fullConfig = {
+      app_id: '123456',
+      app_secret: 'secret',
+      business_id: 'BIZ',
+      waba_id: 'WABA',
+      access_token: 'token',
+      graph_api_version: 'v22.0',
+      verify_token: 'verify',
+      environment: 'test',
+    };
+
+    it('mapeia todos os campos do perfil', () => {
+      expect(buildWhatsappOfficialConfigFromIntegration(fullConfig)).toEqual({
+        appId: '123456',
+        appSecret: 'secret',
+        businessId: 'BIZ',
+        wabaId: 'WABA',
+        accessToken: 'token',
+        graphApiVersion: 'v22.0',
+        verifyToken: 'verify',
+        environment: 'test',
+      });
+    });
+
+    it('assume a versão default da Graph API quando ausente ou vazia', () => {
+      expect(
+        buildWhatsappOfficialConfigFromIntegration({ ...fullConfig, graph_api_version: '' })
+          .graphApiVersion,
+      ).toBe(DEFAULT_GRAPH_API_VERSION);
+      expect(
+        buildWhatsappOfficialConfigFromIntegration({}).graphApiVersion,
+      ).toBe(DEFAULT_GRAPH_API_VERSION);
+    });
+
+    it('assume production quando o ambiente não é "test"', () => {
+      // Default seguro: um ambiente inválido não deve virar sandbox silenciosamente.
+      expect(
+        buildWhatsappOfficialConfigFromIntegration({ environment: 'qualquer' })
+          .environment,
+      ).toBe('production');
+      expect(
+        buildWhatsappOfficialConfigFromIntegration({}).environment,
+      ).toBe('production');
+    });
+
+    it('omite business_id quando não informado (é opcional)', () => {
+      const result = buildWhatsappOfficialConfigFromIntegration({});
+      expect(result.businessId).toBeUndefined();
+    });
+
+    it('não quebra com config nulo e devolve campos vazios', () => {
+      expect(buildWhatsappOfficialConfigFromIntegration(null)).toMatchObject({
+        appId: '',
+        appSecret: '',
+        wabaId: '',
+        accessToken: '',
+        verifyToken: '',
+      });
+    });
+
+    it('remove espaços em volta dos segredos (copiar/colar do painel da Meta)', () => {
+      const result = buildWhatsappOfficialConfigFromIntegration({
+        access_token: '  token  ',
+        app_secret: ' secret ',
+        verify_token: ' verify ',
+      });
+      expect(result.accessToken).toBe('token');
+      expect(result.appSecret).toBe('secret');
+      expect(result.verifyToken).toBe('verify');
+    });
+  });
 });

package/src/integration-profile/integration-profile.utils.ts

@@ -98,6 +98,45 @@ export function getReplyToAddress(config: unknown): string | undefined {
   return replyToName ? `${replyToName} <${replyToEmail}>` : replyToEmail;
 }
 
+// ─── Messaging utilities ──────────────────────────────────────────────────────
+
+export const DEFAULT_GRAPH_API_VERSION = 'v21.0';
+
+export type WhatsappOfficialConfig = {
+  appId: string;
+  appSecret: string;
+  businessId?: string;
+  wabaId: string;
+  accessToken: string;
+  graphApiVersion: string;
+  verifyToken: string;
+  environment: 'test' | 'production';
+};
+
+/**
+ * Maps an integration_profile config JSON to the Meta WhatsApp Cloud API credentials.
+ *
+ * Os números não vêm daqui: um WABA pode ter vários e cada um tem estado próprio,
+ * então eles vivem na tabela whatsapp_phone_number (library whatsapp).
+ */
+export function buildWhatsappOfficialConfigFromIntegration(
+  config: unknown,
+): WhatsappOfficialConfig {
+  const cfg = (config as Cfg) ?? {};
+  const environment = String(cfg.environment ?? 'production').trim();
+  return {
+    appId: String(cfg.app_id ?? '').trim(),
+    appSecret: String(cfg.app_secret ?? '').trim(),
+    ...(cfg.business_id ? { businessId: String(cfg.business_id).trim() } : {}),
+    wabaId: String(cfg.waba_id ?? '').trim(),
+    accessToken: String(cfg.access_token ?? '').trim(),
+    graphApiVersion:
+      String(cfg.graph_api_version ?? '').trim() || DEFAULT_GRAPH_API_VERSION,
+    verifyToken: String(cfg.verify_token ?? '').trim(),
+    environment: environment === 'test' ? 'test' : 'production',
+  };
+}
+
 // ─── Storage utilities ────────────────────────────────────────────────────────
 
 /**
@@ -261,21 +300,58 @@ export function buildKubernetesConfigFromIntegration(
 
 // ─── AI utilities ─────────────────────────────────────────────────────────────
 
-/** Maps an integration_profile config JSON to the API key and optional org needed by AI providers. */
+/**
+ * Base URL da API do DeepSeek. A API é compatível com o formato OpenAI
+ * (`POST {base}/chat/completions`), então os consumidores reaproveitam o mesmo
+ * corpo de requisição trocando apenas a URL e a chave.
+ */
+export const DEEPSEEK_API_BASE_URL = 'https://api.deepseek.com';
+
+/** Modelo usado quando o perfil DeepSeek não define um (`deepseek-reasoner` é o de raciocínio). */
+export const DEEPSEEK_DEFAULT_MODEL = 'deepseek-chat';
+
+/** Maps an integration_profile config JSON to the API key and optional org/model/timeout needed by AI providers. */
 export function buildAiConfigFromIntegration(
   providerSlug: string,
   config: unknown,
-): { apiKey: string; organization?: string } {
+): {
+  apiKey: string;
+  organization?: string;
+  model?: string;
+  timeoutMs?: number;
+  /** Endpoint OpenAI-compatible do provider (hoje só o DeepSeek usa). */
+  baseUrl?: string;
+} {
   const cfg = (config as Cfg) ?? {};
+  const model = String(cfg.model ?? '').trim() || undefined;
+  const parsedTimeout = Number(cfg.timeout_ms);
+  const timeoutMs = Number.isFinite(parsedTimeout) && parsedTimeout > 0 ? parsedTimeout : undefined;
+
   switch (providerSlug.toLowerCase()) {
     case 'openai':
       return {
         apiKey: String(cfg.api_key ?? ''),
         ...(cfg.organization ? { organization: String(cfg.organization) } : {}),
+        ...(model ? { model } : {}),
+        ...(timeoutMs ? { timeoutMs } : {}),
+      };
+    case 'deepseek':
+      return {
+        apiKey: String(cfg.api_key ?? ''),
+        ...(model ? { model } : {}),
+        ...(timeoutMs ? { timeoutMs } : {}),
+        baseUrl:
+          String(cfg.base_url ?? '')
+            .trim()
+            .replace(/\/+$/, '') || DEEPSEEK_API_BASE_URL,
       };
     case 'gemini':
     case 'claude':
-      return { apiKey: String(cfg.api_key ?? '') };
+      return {
+        apiKey: String(cfg.api_key ?? ''),
+        ...(model ? { model } : {}),
+        ...(timeoutMs ? { timeoutMs } : {}),
+      };
     default:
       throw new BadRequestException(`Unsupported AI provider: ${providerSlug}`);
   }

package/src/integration-profile/testers/ai.testers.ts

@@ -0,0 +1,165 @@
+import {
+  describeHttpError,
+  fail,
+  pass,
+  probeJson,
+  requireFields,
+  str,
+} from './http-probe';
+import { IntegrationTester } from './integration-tester.types';
+
+/**
+ * Testadores dos providers de IA e geração de vídeo.
+ *
+ * Todos listam modelos: é a chamada autenticada mais barata de cada API (não consome
+ * token nem gera cobrança) e prova que a chave está ativa.
+ */
+
+const openAiTester: IntegrationTester = {
+  providerSlug: 'openai',
+  test: async (config, ctx) => {
+    const missing = requireFields(config, [['api_key', 'API key']]);
+    if (missing) return missing;
+
+    const organization = str(config, 'organization');
+    const headers: Record<string, string> = {
+      Authorization: `Bearer ${String(config.api_key ?? '')}`,
+      ...(organization ? { 'OpenAI-Organization': organization } : {}),
+    };
+
+    const result = await probeJson(
+      'https://api.openai.com/v1/models',
+      { headers },
+      ctx.signal,
+    );
+
+    if (result.status === 401) return fail('Invalid OpenAI API key.');
+    if (result.status === 403) {
+      return fail('This API key has no permission to list models.');
+    }
+    if (!result.ok) {
+      return fail(describeHttpError(result, 'OpenAI rejected the credentials.'));
+    }
+
+    const models: Array<{ id?: string }> = Array.isArray(result.body?.data)
+      ? result.body.data
+      : [];
+    const wanted = str(config, 'model');
+
+    // Modelo indisponível para a conta não invalida a chave — o operador só precisa
+    // saber antes de descobrir na primeira chamada real.
+    if (wanted && !models.some((model) => model.id === wanted)) {
+      return pass(
+        `OpenAI — ${models.length} model(s) available`,
+        `The model "${wanted}" is not available for this account.`,
+      );
+    }
+    return pass(
+      `OpenAI — ${models.length} model(s) available${wanted ? ` (${wanted} ok)` : ''}`,
+    );
+  },
+};
+
+const geminiTester: IntegrationTester = {
+  providerSlug: 'gemini',
+  test: async (config, ctx) => {
+    const missing = requireFields(config, [['api_key', 'API key']]);
+    if (missing) return missing;
+
+    const url = `https://generativelanguage.googleapis.com/v1beta/models?key=${encodeURIComponent(
+      String(config.api_key ?? ''),
+    )}`;
+    const result = await probeJson(url, {}, ctx.signal);
+
+    if (result.status === 400 || result.status === 401 || result.status === 403) {
+      return fail('Invalid Gemini API key.');
+    }
+    if (!result.ok) {
+      return fail(describeHttpError(result, 'Google rejected the credentials.'));
+    }
+
+    const models: unknown[] = Array.isArray(result.body?.models)
+      ? result.body.models
+      : [];
+    return pass(`Gemini — ${models.length} model(s) available`);
+  },
+};
+
+const claudeTester: IntegrationTester = {
+  providerSlug: 'claude',
+  test: async (config, ctx) => {
+    const missing = requireFields(config, [['api_key', 'API key']]);
+    if (missing) return missing;
+
+    const result = await probeJson(
+      'https://api.anthropic.com/v1/models',
+      {
+        headers: {
+          'x-api-key': String(config.api_key ?? ''),
+          'anthropic-version': '2023-06-01',
+        },
+      },
+      ctx.signal,
+    );
+
+    if (result.status === 401) return fail('Invalid Anthropic API key.');
+    if (!result.ok) {
+      return fail(describeHttpError(result, 'Anthropic rejected the credentials.'));
+    }
+
+    const models: unknown[] = Array.isArray(result.body?.data) ? result.body.data : [];
+    return pass(`Claude — ${models.length} model(s) available`);
+  },
+};
+
+const deepseekTester: IntegrationTester = {
+  providerSlug: 'deepseek',
+  test: async (config, ctx) => {
+    const missing = requireFields(config, [['api_key', 'API key']]);
+    if (missing) return missing;
+
+    const result = await probeJson(
+      'https://api.deepseek.com/models',
+      { headers: { Authorization: `Bearer ${String(config.api_key ?? '')}` } },
+      ctx.signal,
+    );
+
+    if (result.status === 401) return fail('Invalid DeepSeek API key.');
+    if (!result.ok) {
+      return fail(describeHttpError(result, 'DeepSeek rejected the credentials.'));
+    }
+
+    const models: unknown[] = Array.isArray(result.body?.data) ? result.body.data : [];
+    return pass(`DeepSeek — ${models.length} model(s) available`);
+  },
+};
+
+const lumaTester: IntegrationTester = {
+  providerSlug: 'luma',
+  test: async (config, ctx) => {
+    const missing = requireFields(config, [['api_key', 'API key']]);
+    if (missing) return missing;
+
+    const result = await probeJson(
+      'https://api.lumalabs.ai/dream-machine/v1/generations?limit=1',
+      { headers: { Authorization: `Bearer ${String(config.api_key ?? '')}` } },
+      ctx.signal,
+    );
+
+    if (result.status === 401 || result.status === 403) {
+      return fail('Invalid Luma API key.');
+    }
+    if (!result.ok) {
+      return fail(describeHttpError(result, 'Luma rejected the credentials.'));
+    }
+    return pass('Luma Dream Machine');
+  },
+};
+
+export const AI_TESTERS: IntegrationTester[] = [
+  openAiTester,
+  geminiTester,
+  claudeTester,
+  deepseekTester,
+  lumaTester,
+];