@hed-hog/core 0.0.387 → 0.0.390

package/src/ai-instruction/dto/create-ai-instruction.dto.ts

@@ -1,12 +1,26 @@
-import { IsBoolean, IsEnum, IsObject, IsOptional, IsString, MaxLength } from 'class-validator';
-import { AiInstructionLayer } from '../types/ai-instruction.types';
+import {
+  IsBoolean,
+  IsIn,
+  IsInt,
+  IsNumber,
+  IsObject,
+  IsOptional,
+  IsString,
+  Max,
+  MaxLength,
+  Min,
+} from 'class-validator';
+import {
+  AI_INSTRUCTION_LAYERS,
+  AiInstructionLayer,
+} from '../types/ai-instruction.types';
 
 export class CreateAiInstructionDTO {
   @IsString()
   @MaxLength(255)
   slug: string;
 
-  @IsEnum(['system', 'product', 'module', 'agent', 'tool', 'output'])
+  @IsIn(AI_INSTRUCTION_LAYERS)
   layer: AiInstructionLayer;
 
   @IsString()
@@ -33,4 +47,26 @@ export class CreateAiInstructionDTO {
   @IsOptional()
   @IsBoolean()
   is_active?: boolean;
+
+  @IsOptional()
+  @IsString()
+  @MaxLength(100)
+  model?: string | null;
+
+  @IsOptional()
+  @IsNumber()
+  @Min(0)
+  @Max(2)
+  temperature?: number | null;
+
+  @IsOptional()
+  @IsInt()
+  @Min(1)
+  @Max(200000)
+  max_tokens?: number | null;
+
+  /** Save even when required variables are missing from the content. */
+  @IsOptional()
+  @IsBoolean()
+  allow_missing_variables?: boolean;
 }

package/src/ai-instruction/dto/preview-ai-instruction.dto.ts

@@ -0,0 +1,26 @@
+import { IsObject, IsOptional, IsString, MaxLength } from 'class-validator';
+
+/**
+ * Stateless render of a draft. The admin sends the content currently in the
+ * textarea — unsaved — so the editor can see the interpolated result before
+ * committing to it.
+ */
+export class PreviewAiInstructionDTO {
+  @IsString()
+  content: string;
+
+  /** Only used to look up the registry definition (guard phrases, variables). */
+  @IsOptional()
+  @IsString()
+  @MaxLength(255)
+  slug?: string;
+
+  /** Fallback when the slug is not registered in code. */
+  @IsOptional()
+  @IsObject()
+  variables_schema?: Record<string, any>;
+
+  @IsOptional()
+  @IsObject()
+  variables?: Record<string, string | number | boolean>;
+}

package/src/ai-instruction/dto/update-ai-instruction.dto.ts

@@ -1,5 +1,19 @@
-import { IsBoolean, IsObject, IsOptional, IsString, MaxLength } from 'class-validator';
+import {
+  IsBoolean,
+  IsInt,
+  IsNumber,
+  IsObject,
+  IsOptional,
+  IsString,
+  Max,
+  MaxLength,
+  Min,
+} from 'class-validator';
 
+/**
+ * `slug` and `layer` are intentionally absent — they are immutable after
+ * creation, since the calling code resolves prompts by slug.
+ */
 export class UpdateAiInstructionDTO {
   @IsOptional()
   @IsString()
@@ -32,4 +46,31 @@ export class UpdateAiInstructionDTO {
   @IsString()
   @MaxLength(500)
   change_note?: string;
+
+  @IsOptional()
+  @IsString()
+  @MaxLength(100)
+  model?: string | null;
+
+  @IsOptional()
+  @IsNumber()
+  @Min(0)
+  @Max(2)
+  temperature?: number | null;
+
+  @IsOptional()
+  @IsInt()
+  @Min(1)
+  @Max(200000)
+  max_tokens?: number | null;
+
+  /** Save even when required variables are missing from the content. */
+  @IsOptional()
+  @IsBoolean()
+  allow_missing_variables?: boolean;
+
+  /** Required to edit a record flagged `is_locked` (security-sensitive prompt). */
+  @IsOptional()
+  @IsBoolean()
+  acknowledge_security_review?: boolean;
 }

package/src/ai-instruction/types/ai-instruction.types.ts

@@ -4,7 +4,18 @@ export type AiInstructionLayer =
   | 'module'
   | 'agent'
   | 'tool'
-  | 'output';
+  | 'output'
+  | 'task';
+
+export const AI_INSTRUCTION_LAYERS: AiInstructionLayer[] = [
+  'system',
+  'product',
+  'module',
+  'agent',
+  'tool',
+  'output',
+  'task',
+];
 
 export type AiInstructionRecord = {
   id: number;
@@ -17,10 +28,22 @@ export type AiInstructionRecord = {
   module_slug: string | null;
   is_active: boolean;
   version: number;
+  /** NULL means "keep whatever the calling code already uses". */
+  model: string | null;
+  temperature: number | null;
+  max_tokens: number | null;
+  /** Editing requires an explicit acknowledgement (security-sensitive prompt). */
+  is_locked: boolean;
   created_at: Date;
   updated_at: Date;
 };
 
+export type AiInstructionListFilters = {
+  layer?: AiInstructionLayer;
+  module_slug?: string;
+  is_active?: boolean;
+};
+
 export type AiExecutionTrigger = 'manual' | 'webhook' | 'schedule' | 'tool' | 'api';
 export type AiExecutionStatus = 'running' | 'completed' | 'failed' | 'cancelled';
 export type AiExecutionStepType = 'prompt' | 'tool_call' | 'tool_result' | 'output' | 'error';

package/src/auth/auth.controller.ts

@@ -103,9 +103,10 @@ export class AuthController {
     @Ip() ipAddress: string,
     @Headers('user-agent') userAgent: string,
     @Headers('x-browser-id') browserId: string,
+    @Headers('origin') origin: string,
     @Res({ passthrough: true }) res,
   ) {
-    return this.service.loginWithEmailAndPassword(res, locale, ipAddress, userAgent, data, browserId || null);
+    return this.service.loginWithEmailAndPassword(res, locale, ipAddress, userAgent, data, browserId || null, origin);
   }
 
   @Public()
@@ -118,18 +119,22 @@ export class AuthController {
     @Ip() ipAddress: string,
     @Headers('user-agent') userAgent: string,
     @Headers('x-browser-id') browserId: string,
+    @Headers('origin') origin: string,
     @Res({ passthrough: true }) res,
   ) {
-    return this.service.emailVerificationLogin(locale, token, code, ipAddress, userAgent, res, browserId || null);
+    return this.service.emailVerificationLogin(locale, token, code, ipAddress, userAgent, res, browserId || null, origin);
   }
 
   @Public()
+  @UseGuards(ThrottlerGuard)
+  @Throttle({ default: { limit: 10, ttl: 60_000 } })
   @Post('login-email-verification-resend')
   async emailVerificationLoginResend(
     @Locale() locale: string,
     @Body() {token}: LoginEmailVerificationResendDTO,
+    @Headers('origin') origin: string,
   ) {
-    return this.service.emailVerificationLoginResend(locale, token);
+    return this.service.emailVerificationLoginResend(locale, token, origin);
   }
 
   @Public()
@@ -151,6 +156,7 @@ export class AuthController {
     @Ip() ipAddress: string,
     @Headers('user-agent') userAgent: string,
     @Headers('x-browser-id') browserId: string,
+    @Headers('origin') origin: string,
     @Res({ passthrough: true }) res,
   ) {
     const { accessToken, refreshToken, session, requiresPasswordReset } = await this.service.verifyMfaCode(
@@ -161,6 +167,7 @@ export class AuthController {
       userAgent,
       methodType,
       browserId || null,
+      origin,
     );
 
     await this.token.setRefreshTokenCookie(locale, res, refreshToken, session.expires_at);
@@ -193,15 +200,20 @@ export class AuthController {
   }
 
   @Public()
+  @UseGuards(ThrottlerGuard)
+  @Throttle({ default: { limit: 10, ttl: 60_000 } })
   @Post('resend-mfa-code')
   async resendMfaCode(
     @Locale() locale: string,
     @Body() { token }: ResendMfaCodeDTO,
+    @Headers('origin') origin: string,
   ) {
-    return this.service.resendMfaCode(locale, token);
+    return this.service.resendMfaCode(locale, token, origin);
   }
 
   @Public()
+  @UseGuards(ThrottlerGuard)
+  @Throttle({ default: { limit: 10, ttl: 60_000 } })
   @Post('webauthn/generate')
   async generateWebAuthnOptions(
     @Locale() locale: string,
@@ -212,6 +224,8 @@ export class AuthController {
   }
 
   @Public()
+  @UseGuards(ThrottlerGuard)
+  @Throttle({ default: { limit: 10, ttl: 60_000 } })
   @Post('webauthn/verify')
   async verifyWebAuthn(
     @Locale() locale: string,
@@ -268,8 +282,9 @@ export class AuthController {
     @Body() { password, code }: ResetDTO,
     @Ip() ipAddress: string,
     @Headers('user-agent') userAgent: string,
+    @Headers('origin') origin: string,
   ) {
-    return this.service.forgotResetPassword(locale, password, code, ipAddress, userAgent);
+    return this.service.forgotResetPassword(locale, password, code, ipAddress, userAgent, origin);
   }
 
   @Public()
@@ -291,4 +306,15 @@ export class AuthController {
   ) {
     return this.service.completeAccount(locale, { password, code, name }, ipAddress, userAgent);
   }
+
+  @Public()
+  @Post('complete-account/authorize')
+  async authorizeAccountInvite(
+    @Locale() locale: string,
+    @Body() { code }: VerifyAccountInviteDTO,
+    @Ip() ipAddress: string,
+    @Headers('user-agent') userAgent: string,
+  ) {
+    return this.service.authorizeAccountInvite(locale, code, ipAddress, userAgent);
+  }
 }

package/src/auth/auth.service.spec.ts

@@ -62,6 +62,7 @@ const makeDeps = () => {
     forgotEmail: jest.fn(),
     verifyCodePassword: jest.fn(),
     verifyMfaEmailCode: jest.fn(),
+    resolveAppKeyFromOrigin: jest.fn().mockResolvedValue(undefined),
   };
   return { prisma, mail, setting, security, token, session, user, challenge };
 };
@@ -203,6 +204,7 @@ describe('AuthService', () => {
         'pt-BR',
         1,
         ['mfa@b.com'],
+        undefined,
       );
       expect(result).toEqual({
         requiresMfa: true,
@@ -655,7 +657,7 @@ describe('AuthService', () => {
 
       const result = await service.resendMfaCode('pt-BR', 'mfa-token');
 
-      expect(deps.challenge.sendMfaCodeByEmail).toHaveBeenCalledWith('pt-BR', 1, 'a@b.com');
+      expect(deps.challenge.sendMfaCodeByEmail).toHaveBeenCalledWith('pt-BR', 1, 'a@b.com', undefined);
       expect(result).toEqual({ success: true, hasEmailMfa: true });
     });
   });

package/src/auth/auth.service.ts

@@ -17,6 +17,7 @@ import { SecurityService } from '../security/security.service';
 import { SessionService } from '../session/session.service';
 import { SettingService } from '../setting/setting.service';
 import { TokenService } from '../token/token.service';
+import { hasPendingPasswordReset } from '../user/user-credential.util';
 import { UserService } from '../user/user.service';
 import { resolveWebAuthnOrigin } from '../utils/webauthn-origin';
 import { ForgetDTO } from './dto/forget.dto';
@@ -66,14 +67,7 @@ export class AuthService {
   }
 
   private hasPendingPasswordReset(user: User | any) {
-    return Boolean(
-      user?.user_credential?.some(
-        (credential) =>
-          credential.type === 'password' &&
-          credential.requires_reset === true &&
-          !credential.revoked_at,
-      ),
-    );
+    return hasPendingPasswordReset(user);
   }
 
   private async getRequiresPasswordResetByUserId(userId: number) {
@@ -90,7 +84,7 @@ export class AuthService {
     return Boolean(credential?.id);
   }
 
-  async requiresMfaForLogin(locale: string, email: string, user: any) {
+  async requiresMfaForLogin(locale: string, email: string, user: any, origin?: string) {
 
     const settings = await this.setting.getSettingValues([
       'require-mfa',
@@ -160,7 +154,8 @@ export class AuthService {
         variables: {
           code,
           name: user.name,
-        }
+        },
+        app: await this.challenge.resolveAppKeyFromOrigin(origin),
       }
     );
 
@@ -173,7 +168,7 @@ export class AuthService {
     }
   }
 
-  async requiresEmailVerificationForLogin(locale: string, email: string, user: any) {
+  async requiresEmailVerificationForLogin(locale: string, email: string, user: any, origin?: string) {
 
     const settings = await this.setting.getSettingValues([
       'require-mfa',
@@ -217,7 +212,8 @@ export class AuthService {
         variables: {
           code,
           name: user.name,
-        }
+        },
+        app: await this.challenge.resolveAppKeyFromOrigin(origin),
       }
     );
 
@@ -231,7 +227,7 @@ export class AuthService {
 
   }
 
-  async emailVerificationLoginResend(locale: string, token: string) {
+  async emailVerificationLoginResend(locale: string, token: string, origin?: string) {
 
     try {
       const payload = await this.token.verify(locale, token);
@@ -253,25 +249,25 @@ export class AuthService {
 
       const user = await this.user.findUserById(locale, challenge.user_identifier.user_id);
 
-      return await this.requiresEmailVerificationForLogin(locale, payload.email, user);
+      return await this.requiresEmailVerificationForLogin(locale, payload.email, user, origin);
 
     } catch (error: any) {
       if (error.message?.includes('jwt expired') || error.name === 'TokenExpiredError') {
-        
+
         const expiredPayload = await this.token.decodeExpiredToken(token);
         const newToken = await this.token.createAccessToken({
             challengeIdentifierId: expiredPayload.challengeIdentifierId,
             email: expiredPayload.email
           });
 
-        return this.emailVerificationLoginResend(locale, newToken);
+        return this.emailVerificationLoginResend(locale, newToken, origin);
       }
-      
+
       throw error;
     }
   }
 
-  async emailVerificationLogin(locale: string, token: string, code: string, ipAddress: string, userAgent: string, res: any, browserId?: string | null) {
+  async emailVerificationLogin(locale: string, token: string, code: string, ipAddress: string, userAgent: string, res: any, browserId?: string | null, origin?: string) {
 
     try {
       const payload = await this.token.verify(locale, token);
@@ -324,14 +320,25 @@ export class AuthService {
 
       const user = await this.user.findUserById(locale, challenge.user_identifier.user_id);
 
-      return this.login(locale, user as unknown as User, ipAddress, userAgent, res, browserId);
+      return this.login(locale, user as unknown as User, ipAddress, userAgent, res, browserId, origin);
 
     } catch (error) {
         throw error;
     }
   }
 
-  private async login(locale: string, user: User, ipAddress: string, userAgent: string, res: any, browserId?: string | null) {
+  private async login(locale: string, user: User, ipAddress: string, userAgent: string, res: any, browserId?: string | null, origin?: string) {
+
+    // Conta excluída pelo próprio usuário: os identificadores já foram
+    // anonimizados, mas a checagem fecha qualquer caminho remanescente.
+    const account = await this.prisma.user.findUnique({
+      where: { id: user.id },
+      select: { deactivated_at: true },
+    });
+
+    if (account?.deactivated_at) {
+      throw new BadRequestException(getLocaleText('accessDenied', locale, 'Access denied.'));
+    }
 
     const emails = await this.prisma.user_identifier.findMany({
       where: {
@@ -353,6 +360,8 @@ export class AuthService {
       browserId,
     );
 
+    const app = await this.challenge.resolveAppKeyFromOrigin(origin);
+
     for (const emailObj of emails) {
 
         this.mail.sendTemplatedMail(
@@ -365,7 +374,8 @@ export class AuthService {
               ipAddress,
               userAgent,
               location: 'Unknown',
-            }
+            },
+            app,
           }
         );
 
@@ -391,6 +401,7 @@ export class AuthService {
     userAgent: string,
     { email, password }: LoginDTO,
     browserId?: string | null,
+    origin?: string,
   ) {
 
     const user = await this.user.findUserByEmail(locale, email);
@@ -428,11 +439,11 @@ export class AuthService {
 
       if (emailMfas.length > 0) {
         const emails = emailMfas.map(mfa => mfa.user_mfa_email[0].email);
-        await this.challenge.sendMfaCodeToMultipleEmails(locale, user.id, emails);
+        await this.challenge.sendMfaCodeToMultipleEmails(locale, user.id, emails, origin);
       }
 
-      return { 
-        requiresMfa: true, 
+      return {
+        requiresMfa: true,
         mfaToken,
         mfaMethods: mfaMethods.map(m => ({ type: m.type, id: m.id }))
       };
@@ -447,15 +458,15 @@ export class AuthService {
 
     if (settings['require-mfa'] === true && mfaMethods.length === 0) {
 
-      return this.requiresMfaForLogin(locale, email, user);
+      return this.requiresMfaForLogin(locale, email, user, origin);
 
     } else if (settings['require-email-verification'] === true && identifier?.verified_at === null) {
 
-      return this.requiresEmailVerificationForLogin(locale, email, user);
+      return this.requiresEmailVerificationForLogin(locale, email, user, origin);
 
     }
 
-    return this.login(locale, user as unknown as User, ipAddress, userAgent, res, browserId);
+    return this.login(locale, user as unknown as User, ipAddress, userAgent, res, browserId, origin);
   }
 
   async verifyRoles(_locale: string, userId: number) {
@@ -530,7 +541,7 @@ export class AuthService {
     return { success: true };
   }
 
-  async forgotResetPassword(locale: string, password: string, code: string, ipAddress: string, userAgent: string) {
+  async forgotResetPassword(locale: string, password: string, code: string, ipAddress: string, userAgent: string, origin?: string) {
     const challenge = await this.challenge.verifyCodePassword(locale, code);
     const userIdentifier = challenge.user_identifier;
     const passwordHash = await this.security.hashArgon2(password);
@@ -550,12 +561,13 @@ export class AuthService {
         slug: 'auth-forget-password-confirmation',
         variables: {
           name: userIdentifier.user.name,
-        }
+        },
+        app: await this.challenge.resolveAppKeyFromOrigin(origin),
       }
     );
 
     const { accessToken, refreshToken, session } = await this.getAuthenticationPayload(locale, userIdentifier.user_id, ipAddress, userAgent);
-    await this.user.registerUserActivity(userIdentifier.id, "resetPassword")
+    await this.user.registerUserActivity(userIdentifier.user_id, "resetPassword")
     return { accessToken, refreshToken, session }
   }
 
@@ -619,16 +631,67 @@ export class AuthService {
   /**
    * Valida (sem consumir) um token de convite de criação de conta e retorna os
    * dados básicos para pré-preencher o formulário no app de treinamentos.
+   * `hasAccount` diz se esse usuário já tem um jeito de entrar (senha ativa ou
+   * provedor externo vinculado) — usado pelo app para decidir entre mostrar o
+   * formulário de criação de conta ou uma tela de autorização de acesso.
    */
   async verifyAccountInvite(locale: string, code: string) {
     const challenge = await this.challenge.verifyCodePassword(locale, code);
+    const userId = challenge.user_identifier.user_id;
+
+    const [passwordCount, oauthCount] = await Promise.all([
+      this.prisma.user_credential.count({
+        where: { user_id: userId, type: 'password', revoked_at: null },
+      }),
+      this.prisma.user_account.count({ where: { user_id: userId } }),
+    ]);
+
     return {
       valid: true,
       name: challenge.user_identifier.user?.name ?? null,
       email: challenge.user_identifier.value,
+      hasAccount: passwordCount > 0 || oauthCount > 0,
     };
   }
 
+  /**
+   * Conclui um convite de acesso para quem já tem conta (senha ou provedor
+   * externo): não define senha nenhuma, só prova controle do e-mail (mesmo
+   * nível de confiança do link de reset de senha) e autentica o usuário.
+   */
+  async authorizeAccountInvite(
+    locale: string,
+    code: string,
+    ipAddress: string,
+    userAgent: string,
+  ) {
+    const challenge = await this.challenge.verifyCodePassword(locale, code);
+    const userIdentifier = challenge.user_identifier;
+
+    if (!userIdentifier.verified_at || !userIdentifier.enabled) {
+      await this.prisma.user_identifier.update({
+        where: { id: userIdentifier.id },
+        data: { verified_at: userIdentifier.verified_at ?? new Date(), enabled: true },
+      });
+    }
+
+    // Consome o challenge para impedir reuso do link.
+    await this.prisma.user_identifier_challenge.updateMany({
+      where: { id: challenge.id },
+      data: { verified_at: new Date(), expires_at: new Date() },
+    });
+
+    const { accessToken, refreshToken, session } =
+      await this.getAuthenticationPayload(
+        locale,
+        userIdentifier.user_id,
+        ipAddress,
+        userAgent,
+      );
+    await this.user.registerUserActivity(userIdentifier.user_id, 'authorizeAccountInvite');
+    return { accessToken, refreshToken, session };
+  }
+
   /**
    * Conclui a criação de conta a partir de um token de convite: cria/atualiza a
    * credencial de senha, marca o identificador como verificado, atualiza o nome
@@ -688,11 +751,11 @@ export class AuthService {
         ipAddress,
         userAgent,
       );
-    await this.user.registerUserActivity(userIdentifier.id, 'completeAccount');
+    await this.user.registerUserActivity(userIdentifier.user_id, 'completeAccount');
     return { accessToken, refreshToken, session };
   }
 
-  async verifyMfaCode(locale: string, mfaToken: string, code: string, ipAddress: string, userAgent: string, methodType?: 'totp' | 'email' | 'recovery', browserId?: string | null) {
+  async verifyMfaCode(locale: string, mfaToken: string, code: string, ipAddress: string, userAgent: string, methodType?: 'totp' | 'email' | 'recovery', browserId?: string | null, origin?: string) {
     const payload = await this.token.verifyMfaChallengeToken(mfaToken);
     const user = await this.prisma.user.findUnique({
       where: { id: payload.userId },
@@ -806,7 +869,8 @@ export class AuthService {
           ipAddress,
           userAgent,
           location: 'Unknown',
-        }
+        },
+        app: await this.challenge.resolveAppKeyFromOrigin(origin),
       }
     );
 
@@ -860,7 +924,7 @@ export class AuthService {
     return { accessToken, refreshToken, session, requiresPasswordReset };
   }
 
-  async resendMfaCode(locale: string, mfaToken: string) {
+  async resendMfaCode(locale: string, mfaToken: string, origin?: string) {
     const payload = await this.token.verifyMfaChallengeToken(mfaToken);
     
     const mfaMethods = await this.prisma.user_mfa.findMany({
@@ -883,7 +947,7 @@ export class AuthService {
       throw new BadRequestException(getLocaleText('noEmailMfaFound', locale, 'No email MFA method found for this user.'));
     }
 
-    await this.challenge.sendMfaCodeByEmail(locale, payload.userId, emailMfa.user_mfa_email[0].email);
+    await this.challenge.sendMfaCodeByEmail(locale, payload.userId, emailMfa.user_mfa_email[0].email, origin);
     
     return { 
       success: true,
@@ -1013,7 +1077,8 @@ export class AuthService {
           ipAddress,
           userAgent,
           location: 'Unknown',
-        }
+        },
+        app: await this.challenge.resolveAppKeyFromOrigin(requestOrigin),
       }
     );
 

package/src/captcha/captcha.module.ts

@@ -0,0 +1,10 @@
+import { PrismaModule } from '@hed-hog/api-prisma';
+import { Module, forwardRef } from '@nestjs/common';
+import { CaptchaService } from './captcha.service';
+
+@Module({
+  imports: [forwardRef(() => PrismaModule)],
+  providers: [CaptchaService],
+  exports: [CaptchaService],
+})
+export class CaptchaModule {}