@hed-hog/core 0.0.386 → 0.0.390

package/src/user/user.service.spec.ts

@@ -10,6 +10,7 @@ const makeDeps = () => {
       findMany: jest.fn(),
       update: jest.fn(),
       deleteMany: jest.fn(),
+      count: jest.fn(),
     },
     role: { findUnique: jest.fn(), findMany: jest.fn() },
     role_user: { findFirst: jest.fn(), create: jest.fn(), delete: jest.fn(), findMany: jest.fn() },
@@ -237,6 +238,158 @@ describe('UserService', () => {
     });
   });
 
+  describe('list', () => {
+    const makeListService = () => {
+      const { service, deps } = makeService();
+      deps.prismaService.$transaction.mockResolvedValue([0, 0, 0]);
+      deps.paginationService.paginatePrismaModel.mockResolvedValue({
+        total: 0,
+        data: [],
+      });
+      return { service, deps };
+    };
+
+    const whereOf = (deps: ReturnType<typeof makeDeps>) =>
+      (deps.paginationService.paginatePrismaModel.mock.calls[0][1] as any).where;
+
+    it('não filtra quando o filtro é ausente ou desconhecido', async () => {
+      const { service, deps } = makeListService();
+      await service.list({});
+      expect(whereOf(deps)).toEqual({});
+
+      deps.paginationService.paginatePrismaModel.mockClear();
+      await service.list({}, 'inexistente');
+      expect(whereOf(deps)).toEqual({});
+    });
+
+    it('filtra bloqueados por suspended_until futuro', async () => {
+      const { service, deps } = makeListService();
+      await service.list({}, 'blocked');
+      expect(whereOf(deps).suspended_until.gt).toBeInstanceOf(Date);
+    });
+
+    it('filtra novos pelos últimos 7 dias', async () => {
+      const { service, deps } = makeListService();
+      await service.list({}, 'new');
+      const gte = whereOf(deps).created_at.gte as Date;
+      const diffInDays = (Date.now() - gte.getTime()) / (24 * 60 * 60 * 1000);
+      expect(Math.round(diffInDays)).toBe(7);
+    });
+
+    it('filtra por credencial de senha com reset pendente', async () => {
+      const { service, deps } = makeListService();
+      await service.list({}, 'password-reset');
+      expect(whereOf(deps)).toEqual({
+        user_credential: {
+          some: { type: 'password', requires_reset: true, revoked_at: null },
+        },
+      });
+    });
+
+    it('busca por nome e por qualquer identificador do usuário', async () => {
+      const { service, deps } = makeListService();
+      await service.list({ search: 'joao@hedhog.com' });
+
+      expect(whereOf(deps)).toEqual({
+        OR: [
+          { name: { contains: 'joao@hedhog.com', mode: 'insensitive' } },
+          {
+            user_identifier: {
+              some: {
+                value: { contains: 'joao@hedhog.com', mode: 'insensitive' },
+              },
+            },
+          },
+        ],
+      });
+    });
+
+    it('ignora busca vazia ou só com espaços', async () => {
+      const { service, deps } = makeListService();
+      await service.list({ search: '   ' });
+      expect(whereOf(deps)).toEqual({});
+
+      deps.paginationService.paginatePrismaModel.mockClear();
+      await service.list({ search: '' });
+      expect(whereOf(deps)).toEqual({});
+    });
+
+    it('combina busca e filtro com AND', async () => {
+      const { service, deps } = makeListService();
+      await service.list({ search: 'joao' }, 'blocked');
+
+      const where = whereOf(deps);
+      expect(where.OR).toBeUndefined();
+      expect(where.AND).toHaveLength(2);
+      expect(where.AND[0].suspended_until.gt).toBeInstanceOf(Date);
+      expect(where.AND[1].OR).toHaveLength(2);
+    });
+
+    it('não delega a busca ao searchFields da paginação', async () => {
+      const { service, deps } = makeListService();
+      await service.list({ search: 'joao' });
+
+      const options = deps.paginationService.paginatePrismaModel.mock
+        .calls[0][1] as any;
+      expect(options.searchFields).toBeUndefined();
+    });
+
+    it('deriva requires_password_reset e last_login_at', async () => {
+      const { service, deps } = makeListService();
+      const lastLogin = new Date('2026-07-01T10:00:00Z');
+      deps.paginationService.paginatePrismaModel.mockResolvedValue({
+        total: 3,
+        data: [
+          {
+            id: 1,
+            user_credential: [
+              { type: 'password', requires_reset: true, revoked_at: null },
+            ],
+            user_activity: [{ action: 'login', created_at: lastLogin }],
+          },
+          {
+            id: 2,
+            user_credential: [
+              { type: 'password', requires_reset: true, revoked_at: new Date() },
+            ],
+            user_activity: [],
+          },
+          { id: 3, user_credential: [], user_activity: [] },
+        ],
+      });
+
+      const { paginate } = await service.list({});
+
+      expect(paginate.total).toBe(3);
+      expect(paginate.data.map((u: any) => u.requires_password_reset)).toEqual([
+        true,
+        false,
+        false,
+      ]);
+      expect(paginate.data.map((u: any) => u.last_login_at)).toEqual([
+        lastLogin,
+        null,
+        null,
+      ]);
+    });
+
+    it('traz apenas o último login e credenciais sem hash', async () => {
+      const { service, deps } = makeListService();
+      await service.list({});
+      const { include } = deps.paginationService.paginatePrismaModel.mock
+        .calls[0][1] as any;
+
+      expect(include.user_activity).toEqual({
+        where: { action: 'login' },
+        orderBy: { created_at: 'desc' },
+        take: 1,
+      });
+      expect(include.user_credential.select.hash).toBeUndefined();
+      expect(include.user_credential.select.requires_reset).toBe(true);
+      expect(include.user_session.select.hash).toBeUndefined();
+    });
+  });
+
   describe('listUserActivities', () => {
     it('mapeia atividades com createdAt ISO', async () => {
       const { service, deps } = makeService();

package/src/user/user.service.ts

@@ -6,6 +6,7 @@ import {
     BadRequestException,
     Inject,
     Injectable,
+    Logger,
     NotFoundException,
     forwardRef,
 } from '@nestjs/common';
@@ -20,6 +21,10 @@ import { USER_AVATAR_UPLOAD_DESTINATION } from './constants/user.constants';
 import { CreateWithEmailAndPasswordDTO } from './dto/create-with-email-and-password.dto';
 import { ResetPasswordDTO } from './dto/reset-password.dto';
 import { UpdateDTO } from './dto/update.dto';
+import {
+  PENDING_PASSWORD_RESET_WHERE,
+  hasPendingPasswordReset,
+} from './user-credential.util';
 
 // Constants
 const IDENTIFIER_TYPE = {
@@ -54,8 +59,6 @@ const USER_SORT_FIELDS = [
   'updated_at',
 ] as const;
 
-const USER_SEARCH_FIELDS = ['name'] as const;
-
 type UserChangeLog = user_change_log;
 type UserChangeLogActor = Prisma.userGetPayload<{
   select: {
@@ -70,6 +73,8 @@ type UserChangeLogActor = Prisma.userGetPayload<{
 
 @Injectable()
 export class UserService {
+  private readonly logger = new Logger(UserService.name);
+
   constructor(
     @Inject(forwardRef(() => PrismaService))
     private readonly prismaService: PrismaService,
@@ -154,20 +159,30 @@ export class UserService {
   // CRUD Operations
   // ==========================================
 
-  async list(paginationParams) {
+  async list(paginationParams, filter?: string) {
     const paginate = await this.paginationService.paginatePrismaModel(
       this.prismaService.user,
       {
         ...paginationParams,
         validSortFields: USER_SORT_FIELDS,
-        searchFields: USER_SEARCH_FIELDS,
+        where: this.buildUserListWhere(filter, paginationParams?.search),
         include: this.getUserIncludeClause(),
       }
     );
 
     const stats = await this.getUserStatistics();
 
-    return { paginate, stats };
+    return {
+      paginate: {
+        ...paginate,
+        data: (paginate?.data ?? []).map((user: any) => ({
+          ...user,
+          requires_password_reset: hasPendingPasswordReset(user),
+          last_login_at: user?.user_activity?.[0]?.created_at ?? null,
+        })),
+      },
+      stats,
+    };
   }
 
   async get(locale: string, userId: number) {
@@ -176,7 +191,7 @@ export class UserService {
 
   async createWithEmailAndPassword(
     locale: string,
-    { email, name, password }: CreateWithEmailAndPasswordDTO,
+    { email, name, password, app }: CreateWithEmailAndPasswordDTO,
   ) {
     await this.validateEmailAvailable(locale, email);
 
@@ -185,7 +200,7 @@ export class UserService {
     const user = await this.prismaService.$transaction(async (tx) => {
       const role = await this.getDefaultUserRole(locale, tx);
 
-      const user = await tx.user.create({
+      const created = await tx.user.create({
         data: {
           name,
           user_identifier: {
@@ -209,10 +224,25 @@ export class UserService {
         },
       });
 
-      return user;
+      return created;
+    }).catch((error: any) => {
+      if (error?.code === 'P2002') {
+        throw new BadRequestException(
+          getLocaleText('signup.emailExists', locale, 'Email already in use.')
+        );
+      }
+
+      throw error;
     });
 
-    const challenge = await this.challenge.verifyEmail(locale, user.id, email);
+    try {
+      await this.challenge.verifyEmail(locale, user.id, email, app);
+    } catch (error: any) {
+      this.logger.warn(
+        `Signup confirmation email failed for user ${user.id}: ${error?.message ?? error}`
+      );
+    }
+
     await this.registerUserActivity(user.id, 'register');
 
     await this.integrationApi.publishEvent({
@@ -223,7 +253,7 @@ export class UserService {
       payload: { id: user.id, name: user.name, email },
     }).catch(() => null);
 
-    return { user, challenge };
+    return { user, hasChallenge: true };
   }
 
   async update(
@@ -424,7 +454,10 @@ export class UserService {
       include: {
         user_identifier: true,
         user_credential: true,
-        user_activity: true,
+        user_activity: {
+          orderBy: { created_at: 'desc' },
+          take: 20,
+        },
         user_session: true,
         user_account: true,
          role_user: {
@@ -749,6 +782,139 @@ export class UserService {
     };
   }
 
+  // ==========================================
+  // Sent Mails (delivery history per user)
+  // ==========================================
+
+  async listUserMails(
+    locale: string,
+    userId: number,
+    params: {
+      page?: number;
+      pageSize?: number;
+      search?: string;
+      sortField?: string;
+      sortOrder?: 'asc' | 'desc';
+      status?: 'all' | 'received' | 'read' | 'error';
+    },
+  ) {
+    await this.validateUserExists(locale, userId);
+
+    const identifiers = await this.prismaService.user_identifier.findMany({
+      where: { user_id: userId, type: IDENTIFIER_TYPE.EMAIL },
+      select: { value: true },
+    });
+
+    const emails = [
+      ...new Set(
+        identifiers
+          .map((identifier) => identifier.value?.trim().toLowerCase())
+          .filter((value): value is string => Boolean(value)),
+      ),
+    ];
+
+    // Tracked deliveries plus a fallback over the raw recipient fields, so
+    // mails sent before the tracking table existed still show up here.
+    const OR: any[] = [{ mail_sent_user: { some: { user_id: userId } } }];
+
+    for (const email of emails) {
+      OR.push({ to: { contains: email, mode: 'insensitive' } });
+      OR.push({ cc: { contains: email, mode: 'insensitive' } });
+      OR.push({ bcc: { contains: email, mode: 'insensitive' } });
+    }
+
+    const AND: any[] = [];
+
+    const status = params?.status;
+    if (status && status !== 'all') {
+      AND.push({ mail_sent_user: { some: { user_id: userId, status } } });
+    }
+
+    const search = params?.search?.trim();
+    if (search) {
+      AND.push({ subject: { contains: search, mode: 'insensitive' } });
+    }
+
+    const paginated = await this.paginationService.paginatePrismaModel(
+      this.prismaService.mail_sent,
+      {
+        page: params?.page,
+        pageSize: params?.pageSize,
+        sortField: params?.sortField || 'created_at',
+        sortOrder: params?.sortOrder || 'desc',
+        validSortFields: ['id', 'created_at', 'subject'],
+        where: {
+          OR,
+          ...(AND.length > 0 ? { AND } : {}),
+        },
+        include: {
+          mail: { select: { id: true, slug: true } },
+          mail_sent_user: {
+            where: { user_id: userId },
+            select: {
+              id: true,
+              recipient_email: true,
+              status: true,
+              read_at: true,
+              error_code: true,
+              error_message: true,
+            },
+          },
+        },
+      },
+    );
+
+    // `total` conta o mesmo universo da lista (rastreados + fallback), para o
+    // KPI não divergir da quantidade de itens exibidos. Os demais contadores só
+    // existem para envios rastreados.
+    const [totalMails, grouped] = await Promise.all([
+      this.prismaService.mail_sent.count({ where: { OR } }),
+      this.prismaService.mail_sent_user.groupBy({
+        by: ['status'],
+        where: { user_id: userId },
+        _count: { _all: true },
+      }),
+    ]);
+
+    const stats = grouped.reduce(
+      (acc, group) => {
+        const count = group._count?._all ?? 0;
+        if (group.status === 'received') acc.received += count;
+        if (group.status === 'read') acc.read += count;
+        if (group.status === 'error') acc.error += count;
+        return acc;
+      },
+      { total: totalMails, received: 0, read: 0, error: 0 },
+    );
+
+    return {
+      ...paginated,
+      stats,
+      data: (paginated.data || []).map((mailSent: any) => {
+        const tracking = mailSent.mail_sent_user?.[0] ?? null;
+
+        return {
+          id: mailSent.id,
+          mailId: mailSent.mail_id,
+          mailSlug: mailSent.mail?.slug ?? null,
+          subject: mailSent.subject,
+          from: mailSent.from,
+          to: mailSent.to,
+          cc: mailSent.cc,
+          bcc: mailSent.bcc,
+          body: mailSent.body,
+          createdAt: mailSent.created_at?.toISOString?.() || null,
+          tracked: Boolean(tracking),
+          recipientEmail: tracking?.recipient_email ?? null,
+          status: tracking?.status ?? null,
+          readAt: tracking?.read_at?.toISOString?.() || null,
+          errorCode: tracking?.error_code ?? null,
+          errorMessage: tracking?.error_message ?? null,
+        };
+      }),
+    };
+  }
+
   async listUserActivities(locale: string, userId: number, paginationParams) {
     await this.validateUserExists(locale, userId);
 
@@ -859,10 +1025,74 @@ export class UserService {
     return passwordChars.slice(0, length).join('');
   }
 
+  private buildUserFilterWhere(filter?: string) {
+    switch (filter) {
+      case 'new':
+        return {
+          created_at: {
+            gte: new Date(Date.now() - NEW_USERS_PERIOD_DAYS * DAYS_IN_MS),
+          },
+        };
+      case 'blocked':
+        return { suspended_until: { gt: new Date() } };
+      case 'password-reset':
+        return { user_credential: PENDING_PASSWORD_RESET_WHERE };
+      default:
+        return {};
+    }
+  }
+
+  // O e-mail não é coluna de `user`: mora em `user_identifier`, junto de
+  // username, telefone e cpf. Por isso a busca é montada aqui, e não via
+  // `searchFields` da paginação, que só sabe filtrar colunas escalares.
+  private buildUserSearchWhere(search?: string) {
+    const term = typeof search === 'string' ? search.trim() : '';
+
+    if (!term) {
+      return null;
+    }
+
+    return {
+      OR: [
+        { name: { contains: term, mode: 'insensitive' as const } },
+        {
+          user_identifier: {
+            some: { value: { contains: term, mode: 'insensitive' as const } },
+          },
+        },
+      ],
+    };
+  }
+
+  private buildUserListWhere(filter?: string, search?: string) {
+    const filterWhere = this.buildUserFilterWhere(filter);
+    const searchWhere = this.buildUserSearchWhere(search);
+
+    if (!searchWhere) {
+      return filterWhere;
+    }
+
+    if (!Object.keys(filterWhere).length) {
+      return searchWhere;
+    }
+
+    return { AND: [filterWhere, searchWhere] };
+  }
+
   private getUserIncludeClause() {
     return {
       user_account: true,
-      user_credential: true,
+      user_credential: {
+        select: {
+          id: true,
+          type: true,
+          requires_reset: true,
+          revoked_at: true,
+          expires_at: true,
+          created_at: true,
+          updated_at: true,
+        },
+      },
       user_identifier: {
         where: { enabled: true },
       },
@@ -870,9 +1100,22 @@ export class UserService {
         where: { verified_at: { not: null } },
       },
       user_activity: {
+        where: { action: 'login' },
         orderBy: { created_at: 'desc' },
+        take: 1,
       },
       user_session: {
+        select: {
+          id: true,
+          user_id: true,
+          ip_address: true,
+          user_agent: true,
+          browser_id: true,
+          revoked_at: true,
+          expires_at: true,
+          created_at: true,
+          updated_at: true,
+        },
         where: {
           revoked_at: null,
           expires_at: { gt: new Date() },

package/src/validators/is-strong-password-with-settings.validator.ts

@@ -68,6 +68,18 @@ export class IsStrongPasswordWithSettingsConstraint
       return false;
     }
 
+    // Senha vazada por ultimo: e a checagem mais cara (bate no banco) e nao faz
+    // sentido pagar por ela se a senha ja falhou na politica. Aqui a senha em
+    // claro passa pelo servidor de qualquer forma; a do cofre nunca passa, e por
+    // isso o cofre usa o bloom filter no cliente em vez deste caminho.
+    if (this.settings.setting['password-block-leaked'] !== false) {
+      const leakedService = ValidatorServiceLocator.getLeakedPasswordService();
+      if (leakedService && (await leakedService.isLeaked(password))) {
+        this.failedRule = 'password.leaked';
+        return false;
+      }
+    }
+
     return true;
     } catch (error) {
       console.warn('[IsStrongPasswordWithSettingsConstraint] Error getting SettingService:', error);

package/src/validators/service-locator.ts

@@ -1,3 +1,4 @@
+import { LeakedPasswordService } from '../leaked-password/leaked-password.service';
 import { SettingService } from '../setting/setting.service';
 
 /**
@@ -6,6 +7,7 @@ import { SettingService } from '../setting/setting.service';
  */
 export class ValidatorServiceLocator {
   private static settingService: SettingService;
+  private static leakedPasswordService: LeakedPasswordService;
 
   static setSettingService(service: SettingService): void {
     this.settingService = service;
@@ -17,4 +19,17 @@ export class ValidatorServiceLocator {
     }
     return this.settingService;
   }
+
+  static setLeakedPasswordService(service: LeakedPasswordService): void {
+    this.leakedPasswordService = service;
+  }
+
+  /**
+   * Diferente do SettingService, devolve null em vez de lançar: a checagem de
+   * senha vazada é uma camada extra, e um bootstrap sem ela deve deixar a
+   * validação de política seguir funcionando.
+   */
+  static getLeakedPasswordService(): LeakedPasswordService | null {
+    return this.leakedPasswordService ?? null;
+  }
 }

package/src/webhook-integration/webhook-integration.controller.ts

@@ -15,6 +15,7 @@ import {
   Res,
 } from '@nestjs/common';
 import { Request, Response } from 'express';
+import { WebhookProtocolResponse } from './webhook-protocol.registry';
 import { WebhookIntegrationService } from './webhook-integration.service';
 import {
   CreateWebhookActionDTO,
@@ -145,12 +146,24 @@ export class PublicWebhookController {
   constructor(private readonly service: WebhookIntegrationService) {}
 
   @Post(':uuid')
-  execute(
+  async execute(
     @Param('uuid') uuid: string,
     @Body() body: any,
+    @Query() query: any,
     @Headers() headers: any,
     @Req() req: Request,
+    @Res({ passthrough: true }) res: Response,
   ) {
+    const handled = await this.service.executeProtocol(
+      uuid,
+      'POST',
+      body,
+      query,
+      headers,
+      req,
+    );
+    if (handled) return sendProtocolResponse(res, handled);
+
     return this.service.executePublic(uuid, body, headers, req);
   }
 
@@ -158,15 +171,40 @@ export class PublicWebhookController {
    * GET variant so a webhook can be triggered by a plain clickable link (e.g.
    * approve/reject links sent by email/WhatsApp). Query params are used as the
    * payload for action templates (`{{body.decision}}` ← `?decision=approve`).
+   *
+   * Webhooks with a protocol take a different path: for them a GET is the
+   * provider's verification handshake, not a trigger — it must not run actions.
    */
   @Get(':uuid')
-  executeGet(
+  async executeGet(
     @Param('uuid') uuid: string,
     @Query() query: any,
     @Headers() headers: any,
     @Req() req: Request,
+    @Res({ passthrough: true }) res: Response,
   ) {
+    const handled = await this.service.executeProtocol(
+      uuid,
+      'GET',
+      query ?? {},
+      query,
+      headers,
+      req,
+    );
+    if (handled) return sendProtocolResponse(res, handled);
+
     return this.service.executePublic(uuid, query ?? {}, headers, req);
   }
 }
 
+/**
+ * Aplica status/content-type que o adaptador pediu. Devolver a string crua importa:
+ * provedores como a Meta comparam o corpo da resposta literalmente, então um
+ * envelope JSON reprovaria a verificação.
+ */
+function sendProtocolResponse(res: Response, result: WebhookProtocolResponse) {
+  res.status(result.status);
+  if (result.contentType) res.type(result.contentType);
+  return result.body;
+}
+

package/src/webhook-integration/webhook-integration.module.ts

@@ -16,6 +16,7 @@ import {
   WebhookIntegrationController,
 } from './webhook-integration.controller';
 import { WebhookIntegrationService } from './webhook-integration.service';
+import { WebhookProtocolRegistry } from './webhook-protocol.registry';
 
 @Module({
   imports: [
@@ -38,12 +39,16 @@ import { WebhookIntegrationService } from './webhook-integration.service';
     IntegrationEventCatalogService,
     WebhookIntegrationService,
     EventWebhookService,
+    WebhookProtocolRegistry,
   ],
   exports: [
     IntegrationEventCatalogService,
     AppCommandModule,
     WebhookIntegrationService,
     EventWebhookService,
+    // Exportado para que outros módulos registrem protocolos de entrada
+    // (ex.: a library whatsapp registra o protocolo da Meta).
+    WebhookProtocolRegistry,
   ],
 })
 export class WebhookIntegrationModule {}