@hed-hog/core 0.0.386 → 0.0.390

package/src/profile/profile.service.ts

@@ -1,10 +1,12 @@
 import { getLocaleText } from '@hed-hog/api-locale';
-import { PrismaService, user } from '@hed-hog/api-prisma';
+import { PrismaService } from '@hed-hog/api-prisma';
 import { User } from '@hed-hog/api-types';
 import { BadRequestException, forwardRef, Inject, Injectable, NotFoundException } from '@nestjs/common';
 import { EventEmitter2 } from '@nestjs/event-emitter';
 import { JwtService } from '@nestjs/jwt';
 import type {
+    PublicKeyCredentialCreationOptionsJSON,
+    PublicKeyCredentialRequestOptionsJSON,
     VerifiedAuthenticationResponse,
     VerifiedRegistrationResponse,
 } from '@simplewebauthn/server';
@@ -25,10 +27,12 @@ import { UserService } from '../user/user.service';
 import { resolveWebAuthnOrigin } from '../utils/webauthn-origin';
 import { ChangeEmailDto } from './dto/change-email.dto';
 import { ChangePasswordDto } from './dto/change-password.dto';
+import { DeleteAccountDto } from './dto/delete-account.dto';
 import { EmailVerificationDto } from './dto/email-verification-confirm.dto';
 import { SendEmailVerificationDto } from './dto/send-email-verification.dto';
 import { SetPreferencesDto } from './dto/set-preferences.dto';
 import { UpdateDto } from './dto/update.dto';
+import { PROFILE_ACCOUNT_DELETED, ProfileAccountDeletedEvent } from './events/profile-account-deleted.event';
 import { PROFILE_AVATAR_UPDATED, ProfileAvatarUpdatedEvent } from './events/profile-avatar-updated.event';
 import { PROFILE_EMAIL_CHANGED, ProfileEmailChangedEvent } from './events/profile-email-changed.event';
 import { PROFILE_UPDATED, ProfileUpdatedEvent } from './events/profile-updated.event';
@@ -52,7 +56,7 @@ export class ProfileService {
     private readonly eventEmitter: EventEmitter2,
   ) {}
 
-  async changeEmail(locale: string, userId: number, { email, password, pin }: ChangeEmailDto) {
+  async changeEmail(locale: string, userId: number, { email, password, pin }: ChangeEmailDto, origin?: string) {
 
     const checkAlreadyExists = await this.prisma.user_identifier.findFirst({
         where: { type: 'email', value: email, enabled: true, verified_at: { not: null } },
@@ -125,7 +129,7 @@ export class ProfileService {
       });
 
       // Create verification challenge for the new email
-      await this.challenge.verifyEmail(locale, userId, email);
+      await this.challenge.verifyEmail(locale, userId, email, undefined, origin);
 
     });
 
@@ -148,7 +152,7 @@ export class ProfileService {
     return { success: true };
   }
 
-  async confirmEmailVerificationMfa(locale: string, userId: number, { pin, challengeId, name }: EmailVerificationDto) {
+  async confirmEmailVerificationMfa(locale: string, userId: number, { pin, challengeId, name }: EmailVerificationDto, sessionId: number | null) {
 
     const user = await this.prisma.user.findUnique({
       where: { id: userId },
@@ -221,9 +225,8 @@ export class ProfileService {
 
     });
 
-    const updatedUser = await this.prisma.user.findFirst({ where: { id: user.id }})
-    const codes = await this.createMfaRecoveryCodes(user.id);
-    const newToken = await this.getToken(updatedUser);
+    const codes = await this.createMfaRecoveryCodes(userId);
+    const newToken = await this.getToken(userId, sessionId);
     return { ...newToken, codes };
 
   }
@@ -300,16 +303,16 @@ export class ProfileService {
     return { success: true };
   }
 
-  async sendEmailVerificationMfa(locale: string, userId: number, { email }: SendEmailVerificationDto) {
-    return this.challenge.verifyMfaEmail(locale, userId, email);
+  async sendEmailVerificationMfa(locale: string, userId: number, { email }: SendEmailVerificationDto, origin?: string) {
+    return this.challenge.verifyMfaEmail(locale, userId, email, origin);
   }
 
-  async sendEmailVerification(locale: string, userId: number, { email }: SendEmailVerificationDto) {
-    return this.challenge.verifyEmail(locale, userId, email);    
+  async sendEmailVerification(locale: string, userId: number, { email }: SendEmailVerificationDto, origin?: string) {
+    return this.challenge.verifyEmail(locale, userId, email, undefined, origin);
   }
 
-  async sendCodeToRemove(locale, userId, email){
-    return this.challenge.verifyEmail(locale, userId, email)
+  async sendCodeToRemove(locale, userId, email, origin?: string){
+    return this.challenge.verifyEmail(locale, userId, email, undefined, origin)
   }
 
   async getEmailIdentifier(userId: number) {
@@ -357,6 +360,84 @@ export class ProfileService {
     return result;
   }
 
+  /**
+   * Exclusão de conta pelo próprio usuário (exigida pelas lojas de aplicativos).
+   *
+   * Anonimiza em vez de apagar: os dados pessoais somem e o acesso é revogado
+   * em definitivo, mas as linhas continuam existindo para não quebrar registros
+   * fiscais e integridade referencial. Os identificadores (e-mail, CPF...) são
+   * embaralhados, o que libera o e-mail original para uma conta nova no futuro.
+   */
+  async deleteAccount(locale: string, userId: number, { password }: DeleteAccountDto) {
+    const user = await this.prisma.user.findUnique({ where: { id: userId } });
+
+    if (!user) {
+      throw new NotFoundException(getLocaleText('userNotFound', locale, 'User not found.'));
+    }
+
+    if (user.deactivated_at) {
+      throw new BadRequestException(getLocaleText('accessDenied', locale, 'Access denied.'));
+    }
+
+    const credentials = await this.prisma.user_credential.findMany({
+      where: { user_id: userId, type: 'password' },
+    });
+
+    // Conta com senha exige a senha; conta só de login social não tem o que pedir.
+    if (credentials.length > 0) {
+      if (!password || !(await this.security.validatePassword(locale, credentials, password))) {
+        throw new BadRequestException(getLocaleText('accessDenied', locale, 'Access denied.'));
+      }
+    }
+
+    const deletedAt = new Date();
+    const suffix = `${userId}-${deletedAt.getTime()}`;
+
+    await this.prisma.$transaction(async (tx) => {
+      // Identificadores primeiro: libera e-mail/CPF para reuso e impede o login,
+      // que resolve o usuário justamente por essa tabela.
+      const identifiers = await tx.user_identifier.findMany({
+        where: { user_id: userId },
+        select: { id: true, type: true },
+      });
+
+      for (const identifier of identifiers) {
+        await tx.user_identifier.update({
+          where: { id: identifier.id },
+          data: {
+            value: `deleted-${identifier.type}-${suffix}`,
+            enabled: false,
+            verified_at: null,
+          },
+        });
+      }
+
+      // Credenciais, sessões e segundos fatores: nada aqui pode sobreviver,
+      // ou restaria um caminho de acesso à conta anonimizada.
+      await tx.user_identifier_challenge.deleteMany({ where: { user_identifier: { user_id: userId } } });
+      await tx.user_credential.deleteMany({ where: { user_id: userId } });
+      await tx.user_session.deleteMany({ where: { user_id: userId } });
+      await tx.user_mfa_challenge.deleteMany({ where: { user_mfa: { user_id: userId } } });
+      await tx.user_mfa.deleteMany({ where: { user_id: userId } });
+      await tx.user_recovery_code.deleteMany({ where: { user_id: userId } });
+      await tx.user_account.deleteMany({ where: { user_id: userId } });
+
+      await tx.user.update({
+        where: { id: userId },
+        data: {
+          name: 'Usuário removido',
+          photo_id: null,
+          deactivated_at: deletedAt,
+        },
+      });
+    });
+
+    // Cada library cuida dos seus próprios dados (assinatura, progresso, mensagens).
+    this.eventEmitter.emit(PROFILE_ACCOUNT_DELETED, new ProfileAccountDeletedEvent(userId, deletedAt));
+
+    return { success: true };
+  }
+
   async updateAvatar(locale: string, userId: number, file: MulterFile) {
     const result = await this.user.changeAvatar(locale, userId, file);
     this.eventEmitter.emit(PROFILE_AVATAR_UPDATED, new ProfileAvatarUpdatedEvent(userId, result?.id ?? null));
@@ -364,7 +445,7 @@ export class ProfileService {
     return result;
   }
 
-  async changePassword(locale:string, userId: number, {currentPassword, newPassword}: ChangePasswordDto, ipAddress?: string, userAgent?: string) {
+  async changePassword(locale:string, userId: number, {currentPassword, newPassword}: ChangePasswordDto, ipAddress?: string, userAgent?: string, origin?: string) {
     const credential =  await this.prisma.user_credential.findFirst({
       where: { user_id: userId, type: 'password' },
     });
@@ -405,6 +486,7 @@ export class ProfileService {
           ipAddress: ipAddress || 'Unknown',
           location: 'Unknown',
         },
+        app: await this.challenge.resolveAppKeyFromOrigin(origin),
       }).catch(error => {
         console.error('Failed to send password change notification:', error);
       });
@@ -446,11 +528,11 @@ export class ProfileService {
     return codes;
   }
 
-  async getToken(user: user) {
-    return { token: this.jwt.sign(user) };
+  async getToken(userId: number, sessionId: number | null) {
+    return { token: await this.token.createAccessToken({ sub: userId, sessionId }) };
   }
 
-  async verifyMfaTotp(locale: string, userId: number, token: string, secret: string, name?: string) {
+  async verifyMfaTotp(locale: string, userId: number, token: string, secret: string, name?: string, sessionId?: number | null) {
     const settings = await this.setting.getSettingValues([
       'mfa-issuer',
       'mfa-window',
@@ -512,9 +594,8 @@ export class ProfileService {
       });
     }
     
-    const updatedUser = await this.prisma.user.findFirst({ where: { id: user.id }})
-    const codes = await this.createMfaRecoveryCodes(updatedUser.id);
-    const newToken = await this.getToken(updatedUser);
+    const codes = await this.createMfaRecoveryCodes(userId);
+    const newToken = await this.getToken(userId, sessionId ?? null);
     return { ...newToken, codes };
   }
 
@@ -567,7 +648,7 @@ export class ProfileService {
     return { otpauthUrl: secret.otpauth_url, qrCode, secret: encodedSecret };
   }
 
-  async removeMfaTotp(locale: string, userId: number, mfaId: number, token: string) {
+  async removeMfaTotp(locale: string, userId: number, mfaId: number, token: string, sessionId: number | null) {
     try {
       const user = await this.prisma.user.findFirst({
         where: { id: userId },
@@ -604,26 +685,26 @@ export class ProfileService {
         });
       });
 
-      return this.getUserToken(userId)
+      return this.getUserToken(userId, sessionId)
     } catch (error: any) {
       throw new BadRequestException(`Invalid code: ${error?.message}`);
     }
   }
 
-  async removeMfaEmail(locale: string, userId: number, mfaId: number, token: string, providedHash: string) {
+  async removeMfaEmail(locale: string, userId: number, mfaId: number, token: string, providedHash: string, sessionId: number | null) {
     try {
       await this.challenge.verifyCode(locale, userId, token, providedHash)
       await this.prisma.user_mfa.deleteMany({
         where: { id: mfaId, user_id: userId, type: 'email' },
       });
 
-      return this.getUserToken(userId)
+      return this.getUserToken(userId, sessionId)
     } catch (error: any) {
       throw new BadRequestException(`Invalid code: ${error?.message}`);
     }
   }
 
-  async removeMfaWithRecoveryCode(locale: string, userId: number, mfaId: number, recoveryCode: string) {
+  async removeMfaWithRecoveryCode(locale: string, userId: number, mfaId: number, recoveryCode: string, sessionId: number | null) {
     try {
       const user = await this.prisma.user.findUnique({
         where: { id: userId },
@@ -657,13 +738,13 @@ export class ProfileService {
         where: { id: mfaId, user_id: userId },
       });
 
-      return this.getUserToken(userId);
+      return this.getUserToken(userId, sessionId);
     } catch (error: any) {
       throw new BadRequestException(`Invalid code: ${error?.message}`);
     }
   }
 
-  async removeMfa(locale: string, userId: number, mfaId: number, data: { token?: string; hash?: string; verificationType?: 'totp' | 'email' | 'recovery' | 'webauthn'; assertionResponse?: any }, requestOrigin?: string) {
+  async removeMfa(locale: string, userId: number, mfaId: number, data: { token?: string; hash?: string; verificationType?: 'totp' | 'email' | 'recovery' | 'webauthn'; assertionResponse?: any }, requestOrigin: string | undefined, sessionId: number | null) {
     try {
       const user = await this.prisma.user.findUnique({
         where: { id: userId },
@@ -784,13 +865,13 @@ export class ProfileService {
         where: { id: mfaId, user_id: userId },
       });
 
-      return this.getUserToken(userId);
+      return this.getUserToken(userId, sessionId);
     } catch (error: any) {
       throw new BadRequestException(`Failed to remove MFA: ${error?.message}`);
     }
   }
 
-  async checkMfaBeforeAdd(locale: string, userId: number) {
+  async checkMfaBeforeAdd(locale: string, userId: number, origin?: string) {
     try {
       const mfaMethods = await this.prisma.user_mfa.findMany({
         where: { 
@@ -820,7 +901,7 @@ export class ProfileService {
 
       if (emailMfas.length > 0) {
         const emails = emailMfas.map(mfa => mfa.user_mfa_email[0].email);
-        await this.challenge.sendMfaCodeToMultipleEmails(locale, userId, emails);
+        await this.challenge.sendMfaCodeToMultipleEmails(locale, userId, emails, origin);
         availableMethods.push('email');
       }
 
@@ -857,7 +938,7 @@ export class ProfileService {
     }
   }
 
-  async checkMfaBeforeRemove(locale: string, userId: number) {
+  async checkMfaBeforeRemove(locale: string, userId: number, origin?: string) {
     try {
       const mfaMethods = await this.prisma.user_mfa.findMany({
         where: { 
@@ -888,7 +969,7 @@ export class ProfileService {
 
       if (emailMfas.length > 0) {
         const emails = emailMfas.map(mfa => mfa.user_mfa_email[0].email);
-        await this.challenge.sendMfaCodeToMultipleEmails(locale, userId, emails);
+        await this.challenge.sendMfaCodeToMultipleEmails(locale, userId, emails, origin);
         availableMethods.push('email');
       }
 
@@ -1029,7 +1110,7 @@ export class ProfileService {
     }
   }
 
-  async sendRecoveryCodesVerification(locale: string, userId: number) {
+  async sendRecoveryCodesVerification(locale: string, userId: number, origin?: string) {
     try {
       const mfaMethods = await this.prisma.user_mfa.findMany({
         where: { 
@@ -1058,7 +1139,7 @@ export class ProfileService {
 
       if (emailMfas.length > 0) {
         const emails = emailMfas.map(mfa => mfa.user_mfa_email[0].email);
-        await this.challenge.sendMfaCodeToMultipleEmails(locale, userId, emails);
+        await this.challenge.sendMfaCodeToMultipleEmails(locale, userId, emails, origin);
         availableMethods.push('email');
       }
 
@@ -1221,7 +1302,7 @@ export class ProfileService {
     }
   }
 
-  async generateWebAuthnRegistrationOptions(locale: string, userId: number, name: string, requestOrigin?: string) {
+  async generateWebAuthnRegistrationOptions(locale: string, userId: number, name: string, requestOrigin?: string): Promise<PublicKeyCredentialCreationOptionsJSON> {
     try {
       const user = await this.prisma.user.findFirst({
         where: { id: userId },
@@ -1367,7 +1448,7 @@ export class ProfileService {
     }
   }
 
-  async generateWebAuthnAuthenticationOptions(locale: string, userId: number, requestOrigin?: string) {
+  async generateWebAuthnAuthenticationOptions(locale: string, userId: number, requestOrigin?: string): Promise<PublicKeyCredentialRequestOptionsJSON> {
     try {
       const user = await this.prisma.user.findFirst({
         where: { id: userId },
@@ -1474,7 +1555,13 @@ export class ProfileService {
     }
   }
 
-  async removeWebAuthnMfa(locale: string, userId: number, mfaId: number) {
+  async removeWebAuthnMfa(
+    locale: string,
+    userId: number,
+    mfaId: number,
+    assertionResponse: any,
+    requestOrigin?: string,
+  ) {
     try {
       const mfa = await this.prisma.user_mfa.findFirst({
         where: {
@@ -1490,6 +1577,22 @@ export class ProfileService {
         );
       }
 
+      // Reautenticacao obrigatoria: sem isso, um token de acesso vazado bastava
+      // para remover a chave de seguranca da conta sem provar posse dela.
+      if (!assertionResponse) {
+        throw new BadRequestException(
+          getLocaleText('assertionResponseRequired', locale, 'Assertion response is required for WebAuthn.')
+        );
+      }
+
+      try {
+        await this.verifyWebAuthnAuthentication(userId, assertionResponse, requestOrigin);
+      } catch (error) {
+        throw new BadRequestException(
+          getLocaleText('invalidWebAuthn', locale, 'WebAuthn verification failed.')
+        );
+      }
+
       await this.prisma.user_mfa.delete({
         where: { id: mfaId },
       });
@@ -1500,7 +1603,7 @@ export class ProfileService {
     }
   }
 
-  async generateWebAuthnAuthenticationOptionsForLogin(locale: string, mfaToken: string) {
+  async generateWebAuthnAuthenticationOptionsForLogin(locale: string, mfaToken: string): Promise<PublicKeyCredentialRequestOptionsJSON> {
     try {
       const decoded = this.jwt.decode(mfaToken) as any;
       if (!decoded || !decoded.userId) {
@@ -1630,8 +1733,7 @@ export class ProfileService {
     }
   }
 
-  async getUserToken(userId: number){
-    const updatedUser = await this.prisma.user.findFirst({ where: { id: userId }})
-    return this.getToken(updatedUser);
+  async getUserToken(userId: number, sessionId: number | null){
+    return this.getToken(userId, sessionId);
   }
 }

package/src/realtime/realtime.gateway.ts

@@ -0,0 +1,138 @@
+import { Logger } from '@nestjs/common';
+import { EventEmitter2 } from '@nestjs/event-emitter';
+import {
+  ConnectedSocket,
+  MessageBody,
+  OnGatewayConnection,
+  OnGatewayDisconnect,
+  OnGatewayInit,
+  SubscribeMessage,
+  WebSocketGateway,
+  WebSocketServer,
+} from '@nestjs/websockets';
+import type { Server, Socket } from 'socket.io';
+import { TokenService } from '../token/token.service';
+import { RealtimeService } from './realtime.service';
+
+/** Events other modules can listen to via `@OnEvent(...)`. */
+export const REALTIME_EVENTS = {
+  userConnected: 'realtime.user.connected',
+  userDisconnected: 'realtime.user.disconnected',
+} as const;
+
+function corsOrigin(): string[] | boolean {
+  const raw = String(process.env.CORS_ALLOWED_ORIGINS || '').trim();
+  if (!raw) return true; // permissive handshake — the JWT is the real gate
+  return raw
+    .split(',')
+    .map((s) => s.trim())
+    .filter(Boolean);
+}
+
+/**
+ * Single Socket.IO gateway (`/realtime`) on the same HTTP server/port. It only
+ * handles transport + auth + room membership; the reusable emit API lives in
+ * {@link RealtimeService}. Auth reuses {@link TokenService.verify} (same JWT as
+ * the HTTP `AuthGuard`); connection lifecycle is broadcast via EventEmitter2 so
+ * features (e.g. presence) react without this layer knowing about them.
+ */
+@WebSocketGateway({
+  namespace: '/realtime',
+  cors: { origin: corsOrigin(), credentials: true },
+})
+export class RealtimeGateway
+  implements OnGatewayInit, OnGatewayConnection, OnGatewayDisconnect
+{
+  private readonly logger = new Logger(RealtimeGateway.name);
+
+  @WebSocketServer()
+  server!: Server;
+
+  constructor(
+    private readonly realtime: RealtimeService,
+    private readonly token: TokenService,
+    private readonly events: EventEmitter2,
+  ) {}
+
+  afterInit(server: Server) {
+    this.realtime.setServer(server);
+    this.logger.log('Realtime gateway initialized on /realtime');
+  }
+
+  private extractToken(socket: Socket): string | undefined {
+    const authToken = (socket.handshake.auth as { token?: string } | undefined)?.token;
+    if (authToken) return authToken;
+    const header = socket.handshake.headers.authorization;
+    const [type, value] = String(header ?? '').split(' ');
+    return type === 'Bearer' ? value : undefined;
+  }
+
+  async handleConnection(socket: Socket) {
+    const token = this.extractToken(socket);
+    if (!token) {
+      socket.disconnect(true);
+      return;
+    }
+    try {
+      const payload = await this.token.verify('en', token);
+      const userId = Number(payload?.sub);
+      if (!Number.isInteger(userId) || userId <= 0) {
+        socket.disconnect(true);
+        return;
+      }
+      socket.data.userId = userId;
+      socket.join(`user:${userId}`);
+      const localCount = this.realtime.trackConnect(userId);
+      this.events.emit(REALTIME_EVENTS.userConnected, {
+        userId,
+        firstConnection: localCount === 1,
+      });
+    } catch {
+      socket.disconnect(true);
+    }
+  }
+
+  handleDisconnect(socket: Socket) {
+    const userId = socket.data?.userId as number | undefined;
+    if (!userId) return;
+    const remaining = this.realtime.trackDisconnect(userId);
+    this.events.emit(REALTIME_EVENTS.userDisconnected, {
+      userId,
+      remainingLocalSockets: remaining,
+    });
+  }
+
+  /** Joins the socket to the given channels (rooms `channel:{name}`). */
+  @SubscribeMessage('subscribe')
+  onSubscribe(
+    @ConnectedSocket() socket: Socket,
+    @MessageBody() body: { channels?: string[] },
+  ) {
+    const channels = Array.isArray(body?.channels) ? body.channels : [];
+    for (const ch of channels) {
+      if (this.isAllowed(socket, String(ch))) socket.join(`channel:${ch}`);
+    }
+    return { ok: true, subscribed: channels };
+  }
+
+  @SubscribeMessage('unsubscribe')
+  onUnsubscribe(
+    @ConnectedSocket() socket: Socket,
+    @MessageBody() body: { channels?: string[] },
+  ) {
+    const channels = Array.isArray(body?.channels) ? body.channels : [];
+    for (const ch of channels) socket.leave(`channel:${ch}`);
+    return { ok: true };
+  }
+
+  /**
+   * Channel-subscription authorization. `presence:{id}` is readable by any
+   * authenticated user (presence is coarse/non-sensitive). Modules adding
+   * sensitive channels should extend this with per-channel checks.
+   */
+  private isAllowed(_socket: Socket, channel: string): boolean {
+    if (channel.startsWith('presence:')) return true;
+    // Default-allow other channels for now; tighten per feature as needed.
+    return true;
+  }
+}

package/src/realtime/realtime.module.ts

@@ -0,0 +1,16 @@
+import { forwardRef, Module } from '@nestjs/common';
+import { TokenModule } from '../token/token.module';
+import { RealtimeGateway } from './realtime.gateway';
+import { RealtimeService } from './realtime.service';
+
+/**
+ * Generic real-time (WebSocket) layer for the whole app. Any module can inject
+ * {@link RealtimeService} to push events to users/channels, fanned out across
+ * instances via Redis. EventEmitter2 (global) delivers connection lifecycle.
+ */
+@Module({
+  imports: [forwardRef(() => TokenModule)],
+  providers: [RealtimeGateway, RealtimeService],
+  exports: [RealtimeService],
+})
+export class RealtimeModule {}

package/src/realtime/realtime.service.spec.ts

@@ -0,0 +1,50 @@
+import { beforeEach, describe, expect, it, jest } from '@jest/globals';
+import { RealtimeService } from './realtime.service';
+
+const makeServer = () => {
+  const emit = jest.fn();
+  const to = jest.fn(() => ({ emit }));
+  return { to, emit: emit as any, rootEmit: jest.fn(), server: { to, emit: jest.fn() } };
+};
+
+describe('RealtimeService', () => {
+  let service: RealtimeService;
+  let server: ReturnType<typeof makeServer>;
+
+  beforeEach(() => {
+    service = new RealtimeService();
+    server = makeServer();
+    service.setServer(server.server as any);
+  });
+
+  it('emits to the user room', () => {
+    service.emitToUser(7, 'presence:update', { online: true });
+    expect(server.to).toHaveBeenCalledWith('user:7');
+  });
+
+  it('emits to the channel room', () => {
+    service.emitToChannel('presence:7', 'presence:update', { online: true });
+    expect(server.to).toHaveBeenCalledWith('channel:presence:7');
+  });
+
+  it('broadcasts to everyone', () => {
+    service.broadcast('ping', {});
+    expect((server.server as any).emit).toHaveBeenCalledWith('ping', {});
+  });
+
+  it('does not throw when no server is bound yet', () => {
+    const bare = new RealtimeService();
+    expect(() => bare.emitToUser(1, 'x', {})).not.toThrow();
+  });
+
+  it('tracks local connections per user', () => {
+    expect(service.trackConnect(1)).toBe(1);
+    expect(service.trackConnect(1)).toBe(2);
+    expect(service.isLocallyConnected(1)).toBe(true);
+    expect(service.getLocallyConnectedUserIds()).toEqual([1]);
+    expect(service.trackDisconnect(1)).toBe(1);
+    expect(service.trackDisconnect(1)).toBe(0);
+    expect(service.isLocallyConnected(1)).toBe(false);
+    expect(service.getLocallyConnectedUserIds()).toEqual([]);
+  });
+});