@hed-hog/core 0.0.387 → 0.0.390

package/hedhog/data/menu.yaml

@@ -111,6 +111,22 @@
           slug: admin-mail
       - where:
           slug: integration-manager
+- menu_id:
+    where:
+      slug: /core/mail-management
+  url: /core/mail/layout
+  order: 2
+  icon: layout-template
+  name:
+    en: Base Layout
+    pt: Layout base
+  slug: /core/mail-layout
+  relations:
+    role:
+      - where:
+          slug: admin
+      - where:
+          slug: admin-mail
 - menu_id:
     where:
       slug: /core/mail-management
@@ -172,11 +188,29 @@
     role:
       - where:
           slug: admin
+
 - menu_id:
     where:
       slug: /core/management
-  url: /core/integrations-webhooks
+  url: /core/ai_instruction
   order: 9
+  icon: sparkles
+  name:
+    en: AI Prompts
+    pt: Prompts de IA
+  slug: /core/ai-instruction
+  relations:
+    role:
+      - where:
+          slug: admin
+      - where:
+          slug: admin-access
+
+- menu_id:
+    where:
+      slug: /core/management
+  url: /core/integrations-webhooks
+  order: 10
   icon: webhook
   name:
     en: Integrations and Webhooks
@@ -191,7 +225,7 @@
     where:
       slug: /core/management
   url: /core/setting-list
-  order: 10
+  order: 11
   icon: list
   name:
     en: Setting Lists
@@ -205,8 +239,23 @@
 - menu_id:
     where:
       slug: /core/management
-  url: /core/access-log
+  url: /core/pages
   order: 11
+  icon: layout-template
+  name:
+    en: Pages
+    pt: Páginas
+  slug: /core/pages
+  relations:
+    role:
+      - where:
+          slug: admin
+
+- menu_id:
+    where:
+      slug: /core/management
+  url: /core/access-log
+  order: 12
   icon: file-clock
   name:
     en: Access Logs
@@ -217,6 +266,21 @@
       - where:
           slug: admin
 
+- menu_id:
+    where:
+      slug: /core/management
+  url: /core/incidents
+  order: 13
+  icon: alert-triangle
+  name:
+    en: Incidents
+    pt: Incidentes
+  slug: /core/incidents
+  relations:
+    role:
+      - where:
+          slug: admin
+
 - url: /core/users
   order: 0
   icon: users

package/hedhog/data/route.yaml

@@ -1,3 +1,31 @@
+- url: /incident
+  method: GET
+  type: HTTP
+  relations:
+    role:
+      - where:
+          slug: admin
+- url: /incident/summary
+  method: GET
+  type: HTTP
+  relations:
+    role:
+      - where:
+          slug: admin
+- url: /incident/:id/resolve
+  method: PATCH
+  type: HTTP
+  relations:
+    role:
+      - where:
+          slug: admin
+- url: /incident/:id/reopen
+  method: PATCH
+  type: HTTP
+  relations:
+    role:
+      - where:
+          slug: admin
 - url: /access-log
   method: GET
   type: HTTP
@@ -12,6 +40,8 @@
     role:
       - where:
           slug: admin
+      - where:
+          slug: admin-mail
 - url: /user/:userId/verify-identifier/:identifierId
   method: POST
   type: HTTP
@@ -442,6 +472,15 @@
           slug: admin
       - where:
           slug: admin-user
+- url: /user/:userId/mail
+  method: GET
+  type: HTTP
+  relations:
+    role:
+      - where:
+          slug: admin
+      - where:
+          slug: admin-user
 - url: /user/:userId/menu
   method: GET
   type: HTTP
@@ -1160,6 +1199,8 @@
     role:
       - where:
           slug: admin
+      - where:
+          slug: admin-mail
 - url: /mail-sent
   method: GET
   type: HTTP
@@ -1202,6 +1243,8 @@
     role:
       - where:
           slug: admin
+      - where:
+          slug: admin-mail
 - url: /mail/:id/html
   method: GET
   type: HTTP
@@ -1209,6 +1252,8 @@
     role:
       - where:
           slug: admin
+      - where:
+          slug: admin-mail
 - url: /mail
   method: POST
   type: HTTP
@@ -1216,6 +1261,8 @@
     role:
       - where:
           slug: admin
+      - where:
+          slug: admin-mail
 - url: /mail/import
   method: POST
   type: HTTP
@@ -1223,6 +1270,8 @@
     role:
       - where:
           slug: admin
+      - where:
+          slug: admin-mail
 - url: /mail/:id
   method: PATCH
   type: HTTP
@@ -1230,6 +1279,8 @@
     role:
       - where:
           slug: admin
+      - where:
+          slug: admin-mail
 - url: /mail
   method: DELETE
   type: HTTP
@@ -1237,6 +1288,8 @@
     role:
       - where:
           slug: admin
+      - where:
+          slug: admin-mail
 - url: /mail/test
   method: POST
   type: HTTP
@@ -1244,6 +1297,44 @@
     role:
       - where:
           slug: admin
+      - where:
+          slug: admin-mail
+- url: /mail/preview
+  method: POST
+  type: HTTP
+  relations:
+    role:
+      - where:
+          slug: admin
+      - where:
+          slug: admin-mail
+- url: /mail-layout
+  method: GET
+  type: HTTP
+  relations:
+    role:
+      - where:
+          slug: admin
+      - where:
+          slug: admin-mail
+- url: /mail-layout/:id
+  method: GET
+  type: HTTP
+  relations:
+    role:
+      - where:
+          slug: admin
+      - where:
+          slug: admin-mail
+- url: /mail-layout/:id
+  method: PATCH
+  type: HTTP
+  relations:
+    role:
+      - where:
+          slug: admin
+      - where:
+          slug: admin-mail
 
 # ─── Integration Profile ──────────────────────────────────────────────────────
 
@@ -3149,6 +3240,36 @@
       - where:
           slug: admin-access
 
+- url: /ai-instruction/modules
+  method: GET
+  type: HTTP
+  relations:
+    role:
+      - where:
+          slug: admin
+      - where:
+          slug: admin-access
+
+- url: /ai-instruction/registry
+  method: GET
+  type: HTTP
+  relations:
+    role:
+      - where:
+          slug: admin
+      - where:
+          slug: admin-access
+
+- url: /ai-instruction/preview
+  method: POST
+  type: HTTP
+  relations:
+    role:
+      - where:
+          slug: admin
+      - where:
+          slug: admin-access
+
 - url: /ai-instruction/:id
   method: GET
   type: HTTP
@@ -3380,3 +3501,17 @@
   method: PUT
   type: HTTP
   relations: *core_user_roles
+- url: /profile/account
+  method: DELETE
+  type: HTTP
+  relations: *core_user_roles
+# Corpus de senhas vazadas. O filtro e consumido pelo cofre e pelos formularios
+# de senha, entao vale para qualquer usuario autenticado.
+- url: /leaked-password/filter
+  method: GET
+  type: HTTP
+  relations: *core_user_roles
+- url: /leaked-password/stats
+  method: GET
+  type: HTTP
+  relations: *core_user_roles

package/hedhog/data/setting_group.yaml

@@ -71,7 +71,21 @@
         description:
           en: 'Base URLs for specific apps, formatted as "app=https://example.com" (one per tag). Used in transactional email links (e.g. password reset) when the request comes from that app, falling back to System URL otherwise.'
           pt: 'URLs base de apps específicos, no formato "app=https://exemplo.com" (uma por tag). Usadas em links de e-mails transacionais (ex.: redefinição de senha) quando a solicitação vem desse app, usando a URL do Sistema como alternativa.'
-        value: '["training=http://localhost:3001","class=https://localhost:3002","partners=http://localhost:3003"]'
+        value: '["training=http://localhost:3001","class=https://localhost:3002","partners=http://localhost:3003","admin=http://localhost:3200"]'
+        user_override: false
+        subgroup_id:
+          where:
+            slug: general-system
+      - slug: app-names
+        type: array
+        component: input-tags
+        name:
+          en: App Names
+          pt: Nomes dos Aplicativos
+        description:
+          en: 'Display name for specific apps, formatted as "app=Name" (one per tag). Used as the brand name shown in transactional emails when the request comes from that app, falling back to System Name otherwise.'
+          pt: 'Nome de exibição de apps específicos, no formato "app=Nome" (uma por tag). Usado como o nome de marca exibido em e-mails transacionais quando a solicitação vem desse app, usando o Nome do Sistema como alternativa.'
+        value: '["training=Training","class=Class","partners=Partners","admin=Admin"]'
         user_override: false
         subgroup_id:
           where:
@@ -256,6 +270,42 @@
         subgroup_id:
           where:
             slug: mail-configuration
+      - slug: ai-default-provider
+        type: string
+        component: combobox
+        name:
+          en: Default AI Provider
+          pt: Provedor de IA Padrão
+        description:
+          en: Default AI provider used when a caller does not explicitly specify one
+          pt: Provedor de IA padrão usado quando quem chama não especifica um explicitamente
+        value: openai
+        user_override: false
+        relations:
+          setting_list:
+            - value: openai
+              order: 0
+            - value: gemini
+              order: 1
+            - value: deepseek
+              order: 2
+        subgroup_id:
+          where:
+            slug: ai-configuration
+      - slug: core-ai-prompts-link
+        type: string
+        component: link
+        name:
+          en: AI Prompts
+          pt: Prompts de IA
+        description:
+          en: View and edit the AI prompts used by the core module.
+          pt: Veja e edite os prompts de IA usados pelo modulo core.
+        value: /core/ai_instruction?module=core
+        user_override: false
+        subgroup_id:
+          where:
+            slug: ai-configuration
       - slug: ai-openai-profile-id
         type: string
         component: entity-picker
@@ -284,6 +334,20 @@
         subgroup_id:
           where:
             slug: ai-configuration
+      - slug: ai-deepseek-profile-id
+        type: string
+        component: entity-picker
+        name:
+          en: DeepSeek Profile
+          pt: Perfil DeepSeek
+        description:
+          en: Integration profile (type AI / DeepSeek) to use for DeepSeek features
+          pt: Perfil de integração (tipo IA / DeepSeek) a usar para recursos de DeepSeek
+        value: ''
+        user_override: false
+        subgroup_id:
+          where:
+            slug: ai-configuration
       - slug: mcp-enabled
         type: boolean
         component: switch
@@ -406,6 +470,34 @@
         subgroup_id:
           where:
             slug: password-policy
+      - slug: password-block-leaked
+        type: boolean
+        component: switch
+        name:
+          en: Block Leaked Passwords
+          pt: Bloquear Senhas Vazadas
+        description:
+          en: Reject passwords found in the known-breach corpus, and warn about vault secrets that use one
+          pt: Recusar senhas encontradas no corpus de vazamentos conhecidos e avisar sobre segredos do cofre que usam alguma
+        value: true
+        user_override: false
+        subgroup_id:
+          where:
+            slug: password-policy
+      - slug: password-max-age-days
+        type: number
+        component: input-number
+        name:
+          en: Password Maximum Age (days)
+          pt: Idade Máxima da Senha (dias)
+        description:
+          en: Days after which a stored password is flagged as outdated in the vaults. Use 0 to disable the check.
+          pt: Dias após os quais uma senha guardada é sinalizada como desatualizada nos cofres. Use 0 para desativar a verificação.
+        value: 180
+        user_override: false
+        subgroup_id:
+          where:
+            slug: password-policy
       - slug: email-host-whitelist
         type: array
         name:
@@ -992,6 +1084,52 @@
               order: 1
             - value: email
               order: 2
+            - value: User.Read
+              order: 3
+            - value: offline_access
+              order: 4
+            - value: Calendars.Read
+              order: 5
+            - value: OnlineMeetings.Read
+              order: 6
+            - value: Chat.Read
+              order: 7
+            - value: ChannelMessage.Read
+              order: 8
+            - value: Team.ReadBasic.All
+              order: 9
+            - value: Presence.Read
+              order: 10
+            - value: User.ReadBasic.All
+              order: 11
+        subgroup_id:
+          where:
+            slug: microsoft-entra-id
+      - slug: microsoft-graph-app-only-enabled
+        type: boolean
+        component: switch
+        name:
+          en: Enable tenant-wide (app-only) Microsoft Graph access
+          pt: Acesso Microsoft Graph da organização (app-only)
+        description:
+          en: Allow the Microsoft integration to read data across the whole tenant using application permissions (client credentials), in addition to per-user delegated access. Requires admin consent in Entra.
+          pt: Permite que a integração Microsoft leia dados de toda a organização usando permissões de aplicativo (client credentials), além do acesso delegado por usuário. Exige consentimento do administrador no Entra.
+        value: 'false'
+        user_override: false
+        subgroup_id:
+          where:
+            slug: microsoft-entra-id
+      - slug: microsoft-graph-chat-subscriptions-enabled
+        type: boolean
+        component: switch
+        name:
+          en: Subscribe to Teams chat/channel messages (protected API)
+          pt: Assinar mensagens de chat/canal do Teams (API protegida)
+        description:
+          en: Create org-wide change-notification subscriptions for Teams chat and channel messages. These are protected APIs that require an approved request to Microsoft and appropriate licensing; leave off until approved.
+          pt: Cria assinaturas de change notification para mensagens de chat e canal do Teams em toda a organização. São APIs protegidas que exigem pedido aprovado pela Microsoft e licenciamento adequado; deixe desligado até aprovar.
+        value: 'false'
+        user_override: false
         subgroup_id:
           where:
             slug: microsoft-entra-id

package/hedhog/frontend/app/account/components/mfa-setup-dialog.tsx.ejs

@@ -17,13 +17,25 @@ import {
 import { Label } from '@/components/ui/label';
 import { UserMfaTypeEnum } from '@hed-hog/api-types/UserMfaTypeEnum';
 import { useApp } from '@hed-hog/next-app-provider';
+import { Copy } from 'lucide-react';
 import { useTranslations } from 'next-intl';
 import { getMethodName } from '../lib/mfa-utils';
 
+/** Extrai o segredo base32 da URL otpauth:// para digitação manual (quando não dá pra escanear o QR code), formatado em blocos de 4 caracteres. */
+function getTotpManualEntryCode(otpauthUrl?: string): string | null {
+  if (!otpauthUrl) return null;
+  const match = otpauthUrl.match(/[?&]secret=([^&]+)/);
+  if (!match) return null;
+  return decodeURIComponent(match[1]!)
+    .replace(/(.{4})/g, '$1 ')
+    .trim();
+}
+
 interface MfaSetupDialogProps {
   open: boolean;
   selectedMethod: UserMfaTypeEnum | null;
   qrCode: string;
+  otpauthUrl?: string;
   verificationCode: string;
   name: string;
   onNameChange: (name: string) => void;
@@ -42,6 +54,7 @@ export function MfaSetupDialog({
   open,
   selectedMethod,
   qrCode,
+  otpauthUrl,
   verificationCode,
   name,
   onNameChange,
@@ -59,6 +72,7 @@ export function MfaSetupDialog({
   const { getSettingValue } = useApp();
   const pinCodeLength = getSettingValue('mfa-email-code-length') || 6;
   const methodName = getMethodName(String(selectedMethod));
+  const totpManualEntryCode = getTotpManualEntryCode(otpauthUrl);
 
   return (
     <Dialog open={open} onOpenChange={onOpenChange}>
@@ -78,6 +92,28 @@ export function MfaSetupDialog({
               <div className="bg-muted p-4 rounded-lg flex justify-center">
                 <img src={qrCode} alt="QR Code" />
               </div>
+              {totpManualEntryCode && (
+                <div className="flex flex-col items-center gap-2 text-center">
+                  <p className="text-xs text-muted-foreground">
+                    {t('manualCodeHint')}
+                  </p>
+                  <Button
+                    type="button"
+                    variant="outline"
+                    size="sm"
+                    className="font-mono tracking-wider"
+                    title={t('manualCodeCopy')}
+                    onClick={() =>
+                      navigator.clipboard?.writeText(
+                        totpManualEntryCode.replace(/\s+/g, '')
+                      )
+                    }
+                  >
+                    {totpManualEntryCode}
+                    <Copy className="size-3.5" />
+                  </Button>
+                </div>
+              )}
             </div>
           )}
           <div className="space-y-4">

package/hedhog/frontend/app/account/components/two-factor-auth.tsx.ejs

@@ -90,6 +90,7 @@ export function TwoFactorAuth() {
   const { mfaMethods, refetchMfaMethods } = useMfaMethods();
   const {
     qrCode,
+    otpauthUrl,
     verifyEmailMFA,
     verifyTOTPMFA,
     removeMfaUnified,
@@ -331,6 +332,7 @@ export function TwoFactorAuth() {
         open={showAddDialog}
         selectedMethod={selectedMethod}
         qrCode={qrCode}
+        otpauthUrl={otpauthUrl}
         verificationCode={verificationCode}
         onOpenChange={setShowAddDialog}
         name={name}

package/hedhog/frontend/app/account/hooks/use-mfa-setup.ts.ejs

@@ -9,6 +9,7 @@ export function useMfaSetup() {
   const [secret, setSecret] = useState('');
   const [codeHash, setCodeHash] = useState('');
   const [qrCode, setQrCode] = useState('');
+  const [otpauthUrl, setOtpauthUrl] = useState('');
   const [challengeId, setChallengeId] = useState<number | null>(null);
   const [resendLoading, setResendLoading] = useState(false);
   const [resendCooldown, setResendCooldown] = useState(0);
@@ -97,6 +98,7 @@ export function useMfaSetup() {
 
       setSecret(data.secret);
       setQrCode(data.qrCode);
+      setOtpauthUrl(data.otpauthUrl ?? '');
       showToastHandler('success', t('scanQrCode'));
     } catch (error) {
       console.error(error);
@@ -215,17 +217,17 @@ export function useMfaSetup() {
       const assertion = await startAuthentication({
         optionsJSON: optionsResponse.data,
       });
-      await request({
-        url: '/profile/webauthn/authenticate/verify',
-        method: 'POST',
-        data: {
-          assertionResponse: assertion,
-        },
-      });
 
+      // A asserção é verificada pelo próprio endpoint de remoção (o backend
+      // exige e confere `assertionResponse` antes de excluir a chave). Não
+      // chamar /authenticate/verify antes: o desafio só pode ser verificado
+      // uma vez, e chamá-lo aqui o consumiria antes da remoção poder usá-lo.
       await request({
         url: `/profile/webauthn/${methodId}/remove`,
         method: 'DELETE',
+        data: {
+          assertionResponse: assertion,
+        },
       });
       showToastHandler('success', t('securityKeyRemovedSuccess'));
     } catch (error: any) {
@@ -443,6 +445,7 @@ export function useMfaSetup() {
 
   return {
     qrCode,
+    otpauthUrl,
     userEmail,
     verifyEmailMFA,
     verifyTOTPMFA,

package/hedhog/frontend/app/ai_agent/page.tsx.ejs

@@ -70,7 +70,7 @@ import { z } from 'zod';
 type Agent = {
   id: number;
   slug: string;
-  provider: 'openai' | 'gemini';
+  provider: 'openai' | 'gemini' | 'deepseek';
   model: string | null;
   instructions: string | null;
   external_agent_id: string | null;
@@ -88,7 +88,7 @@ type PaginatedResponse<T> = {
 
 type FormValues = {
   slug: string;
-  provider: 'openai' | 'gemini';
+  provider: 'openai' | 'gemini' | 'deepseek';
   model?: string;
   instructions?: string;
 };
@@ -131,7 +131,7 @@ export default function AiAgentPage() {
   const t = useTranslations('core.AiAgentPage');
   const formSchema = z.object({
     slug: z.string().min(2, t('validationSlugMinLength')),
-    provider: z.enum(['openai', 'gemini']),
+    provider: z.enum(['openai', 'gemini', 'deepseek']),
     model: z.string().optional(),
     instructions: z.string().optional(),
   });
@@ -213,7 +213,7 @@ export default function AiAgentPage() {
       (watchedValues.slug ?? '').trim() ||
       (watchedValues.model ?? '').trim() ||
       (watchedValues.instructions ?? '').trim() ||
-      watchedValues.provider === 'gemini'
+      watchedValues.provider !== 'openai'
     ),
     enabled: isDialogOpen,
   });
@@ -544,6 +544,9 @@ export default function AiAgentPage() {
                           <SelectItem value="gemini">
                             {t('providerGemini')}
                           </SelectItem>
+                          <SelectItem value="deepseek">
+                            {t('providerDeepseek')}
+                          </SelectItem>
                         </SelectContent>
                       </Select>
                     </FormControl>