@hed-hog/core 0.0.387 → 0.0.390

package/src/captcha/captcha.service.spec.ts

@@ -0,0 +1,210 @@
+import { BadRequestException } from '@nestjs/common';
+import { createHash, createHmac } from 'crypto';
+import { CaptchaService } from './captcha.service';
+
+describe('CaptchaService', () => {
+  let prisma: any;
+  let service: CaptchaService;
+  const originalFetch = global.fetch;
+
+  beforeEach(() => {
+    prisma = { integration_profile: { findFirst: jest.fn() } };
+    service = new CaptchaService(prisma);
+    global.fetch = jest.fn() as never;
+  });
+
+  afterEach(() => {
+    global.fetch = originalFetch;
+    jest.restoreAllMocks();
+  });
+
+  function mockFetch(success: boolean) {
+    (global.fetch as jest.Mock).mockResolvedValue({
+      json: async () => ({ success }),
+    });
+  }
+
+  describe('verify', () => {
+    it('rejects an empty token before calling the provider', async () => {
+      await expect(service.verify('', 'recaptcha', {})).rejects.toBeInstanceOf(
+        BadRequestException,
+      );
+      expect(global.fetch).not.toHaveBeenCalled();
+    });
+
+    it('rejects an unsupported provider', async () => {
+      await expect(
+        service.verify('token', 'hcaptcha', {}),
+      ).rejects.toThrow('Unsupported CAPTCHA provider: hcaptcha.');
+    });
+
+    describe('recaptcha', () => {
+      it('accepts a token the provider confirms', async () => {
+        mockFetch(true);
+        await expect(
+          service.verify('token', 'recaptcha', { secret_key: 'secret' }),
+        ).resolves.toBeUndefined();
+
+        const [url, init] = (global.fetch as jest.Mock).mock.calls[0];
+        expect(url).toBe('https://www.google.com/recaptcha/api/siteverify');
+        expect(init.method).toBe('POST');
+        expect(String(init.body)).toContain('secret=secret');
+        expect(String(init.body)).toContain('response=token');
+      });
+
+      it('rejects a token the provider refuses', async () => {
+        mockFetch(false);
+        await expect(
+          service.verify('token', 'recaptcha', { secret_key: 'secret' }),
+        ).rejects.toThrow('CAPTCHA validation failed.');
+      });
+    });
+
+    describe('cloudflare-turnstile', () => {
+      it('calls the turnstile endpoint', async () => {
+        mockFetch(true);
+        await service.verify('token', 'cloudflare-turnstile', {
+          secret_key: 'secret',
+        });
+
+        expect((global.fetch as jest.Mock).mock.calls[0][0]).toBe(
+          'https://challenges.cloudflare.com/turnstile/v0/siteverify',
+        );
+      });
+
+      it('rejects a refused token', async () => {
+        mockFetch(false);
+        await expect(
+          service.verify('token', 'cloudflare-turnstile', { secret_key: 's' }),
+        ).rejects.toThrow('CAPTCHA validation failed.');
+      });
+    });
+
+    describe('altcha', () => {
+      const hmacKey = 'hmac-key';
+
+      function buildToken(overrides: Partial<Record<string, unknown>> = {}) {
+        const salt = 'salt';
+        const number = 12345;
+        const challenge = createHash('sha256')
+          .update(salt + String(number))
+          .digest('hex');
+        const signature = createHmac('sha256', hmacKey)
+          .update(challenge)
+          .digest('hex');
+
+        const payload = {
+          algorithm: 'SHA-256',
+          challenge,
+          number,
+          salt,
+          signature,
+          ...overrides,
+        };
+        return Buffer.from(JSON.stringify(payload)).toString('base64');
+      }
+
+      it('accepts a correctly solved challenge', async () => {
+        await expect(
+          service.verify(buildToken(), 'altcha', { hmac_key: hmacKey }),
+        ).resolves.toBeUndefined();
+        // Altcha e verificado localmente: nenhuma chamada de rede.
+        expect(global.fetch).not.toHaveBeenCalled();
+      });
+
+      it('rejects a malformed token', async () => {
+        await expect(
+          service.verify('not-base64-json', 'altcha', { hmac_key: hmacKey }),
+        ).rejects.toThrow('Invalid CAPTCHA token format.');
+      });
+
+      it('rejects when the proof of work does not match the challenge', async () => {
+        await expect(
+          service.verify(buildToken({ number: 999 }), 'altcha', {
+            hmac_key: hmacKey,
+          }),
+        ).rejects.toThrow('CAPTCHA validation failed.');
+      });
+
+      it('rejects a challenge we did not sign', async () => {
+        await expect(
+          service.verify(buildToken(), 'altcha', { hmac_key: 'other-key' }),
+        ).rejects.toThrow('CAPTCHA validation failed.');
+      });
+    });
+  });
+
+  describe('verifyForProfile', () => {
+    it('resolves the provider from the integration profile', async () => {
+      prisma.integration_profile.findFirst.mockResolvedValue({
+        config: { secret_key: 'secret' },
+        integration_provider: { slug: 'recaptcha' },
+      });
+      mockFetch(true);
+
+      await expect(service.verifyForProfile(7, 'token')).resolves.toBeUndefined();
+      expect(prisma.integration_profile.findFirst).toHaveBeenCalledWith(
+        expect.objectContaining({ where: { id: 7 } }),
+      );
+    });
+
+    it('refuses when no profile id is configured', async () => {
+      await expect(service.verifyForProfile(null, 'token')).rejects.toThrow(
+        'CAPTCHA is enabled but no integration profile is configured.',
+      );
+    });
+
+    it('refuses when the profile does not exist', async () => {
+      prisma.integration_profile.findFirst.mockResolvedValue(null);
+      await expect(service.verifyForProfile(7, 'token')).rejects.toThrow(
+        'CAPTCHA integration profile not found.',
+      );
+    });
+  });
+
+  describe('getPublicConfig', () => {
+    it('returns the provider and site key', async () => {
+      prisma.integration_profile.findFirst.mockResolvedValue({
+        config: { site_key: 'public-key', secret_key: 'secret' },
+        integration_provider: { slug: 'cloudflare-turnstile' },
+      });
+
+      const config = await service.getPublicConfig(7);
+
+      expect(config).toEqual({
+        enabled: true,
+        provider_slug: 'cloudflare-turnstile',
+        site_key: 'public-key',
+      });
+      // O segredo nunca sai do servidor.
+      expect(JSON.stringify(config)).not.toContain('secret');
+    });
+
+    it('reports disabled when there is no profile', async () => {
+      await expect(service.getPublicConfig(null)).resolves.toEqual({
+        enabled: false,
+        provider_slug: null,
+        site_key: null,
+      });
+    });
+
+    it('reports disabled when the caller says the feature is off', async () => {
+      await expect(service.getPublicConfig(7, false)).resolves.toEqual({
+        enabled: false,
+        provider_slug: null,
+        site_key: null,
+      });
+      expect(prisma.integration_profile.findFirst).not.toHaveBeenCalled();
+    });
+  });
+
+  describe('extractSiteKey', () => {
+    it('accepts the naming variants providers use', () => {
+      expect(CaptchaService.extractSiteKey({ site_key: 'a' })).toBe('a');
+      expect(CaptchaService.extractSiteKey({ sitekey: 'b' })).toBe('b');
+      expect(CaptchaService.extractSiteKey({ public_key: 'c' })).toBe('c');
+      expect(CaptchaService.extractSiteKey({ secret_key: 'x' })).toBeNull();
+      expect(CaptchaService.extractSiteKey(null)).toBeNull();
+    });
+  });
+});

package/src/captcha/captcha.service.ts

@@ -0,0 +1,191 @@
+import { PrismaService } from '@hed-hog/api-prisma';
+import {
+  BadRequestException,
+  Inject,
+  Injectable,
+  forwardRef,
+} from '@nestjs/common';
+import { createHash, createHmac } from 'crypto';
+
+export const CAPTCHA_PROVIDERS = [
+  'recaptcha',
+  'cloudflare-turnstile',
+  'altcha',
+] as const;
+
+export type CaptchaProviderSlug = (typeof CAPTCHA_PROVIDERS)[number];
+
+export interface CaptchaPublicConfig {
+  enabled: boolean;
+  provider_slug: string | null;
+  site_key: string | null;
+}
+
+interface AltchaPayload {
+  algorithm: string;
+  challenge: string;
+  number: number;
+  salt: string;
+  signature: string;
+}
+
+/**
+ * Server-side CAPTCHA verification shared by every public form in the platform.
+ *
+ * Credentials live in an `integration_profile`, so a form only stores the profile
+ * id and never the secret itself.
+ */
+@Injectable()
+export class CaptchaService {
+  constructor(
+    @Inject(forwardRef(() => PrismaService))
+    private readonly prisma: PrismaService,
+  ) {}
+
+  /**
+   * Verifies a token against the provider configured in an integration profile.
+   * Throws `BadRequestException` when the challenge does not check out.
+   */
+  async verifyForProfile(
+    integrationProfileId: number | null | undefined,
+    token: string | null | undefined,
+  ): Promise<void> {
+    if (!integrationProfileId) {
+      throw new BadRequestException(
+        'CAPTCHA is enabled but no integration profile is configured.',
+      );
+    }
+
+    const profile = await (this.prisma as any).integration_profile.findFirst({
+      where: { id: integrationProfileId },
+      select: {
+        config: true,
+        integration_provider: { select: { slug: true } },
+      },
+    });
+
+    if (!profile) {
+      throw new BadRequestException('CAPTCHA integration profile not found.');
+    }
+
+    await this.verify(
+      token ?? '',
+      profile.integration_provider?.slug as string,
+      (profile.config ?? {}) as Record<string, string>,
+    );
+  }
+
+  /** Verifies a token against an explicit provider and its credentials. */
+  async verify(
+    token: string,
+    providerSlug: string,
+    config: Record<string, string>,
+  ): Promise<void> {
+    if (!token) {
+      throw new BadRequestException('CAPTCHA token is required.');
+    }
+
+    switch (providerSlug) {
+      case 'recaptcha':
+        await this.verifyRemote(
+          'https://www.google.com/recaptcha/api/siteverify',
+          config.secret_key,
+          token,
+        );
+        break;
+
+      case 'cloudflare-turnstile':
+        await this.verifyRemote(
+          'https://challenges.cloudflare.com/turnstile/v0/siteverify',
+          config.secret_key,
+          token,
+        );
+        break;
+
+      case 'altcha':
+        this.verifyAltcha(token, config);
+        break;
+
+      default:
+        throw new BadRequestException(
+          `Unsupported CAPTCHA provider: ${providerSlug}.`,
+        );
+    }
+  }
+
+  /**
+   * Public settings a front end needs to mount the widget. Only the site key is
+   * returned - the secret never leaves the server.
+   */
+  async getPublicConfig(
+    integrationProfileId: number | null | undefined,
+    enabled = true,
+  ): Promise<CaptchaPublicConfig> {
+    if (!enabled || !integrationProfileId) {
+      return { enabled: false, provider_slug: null, site_key: null };
+    }
+
+    const profile = await (this.prisma as any).integration_profile.findFirst({
+      where: { id: integrationProfileId },
+      select: {
+        config: true,
+        integration_provider: { select: { slug: true } },
+      },
+    });
+
+    return {
+      enabled: true,
+      provider_slug: profile?.integration_provider?.slug ?? null,
+      site_key: CaptchaService.extractSiteKey(profile?.config ?? null),
+    };
+  }
+
+  static extractSiteKey(
+    config: Record<string, unknown> | null,
+  ): string | null {
+    if (!config) return null;
+    const value = config.site_key ?? config.sitekey ?? config.public_key;
+    return value ? String(value) : null;
+  }
+
+  private async verifyRemote(
+    url: string,
+    secret: string,
+    token: string,
+  ): Promise<void> {
+    const body = new URLSearchParams({ secret, response: token });
+    const response = await fetch(url, { method: 'POST', body });
+    const json = (await response.json()) as { success: boolean };
+
+    if (!json.success) {
+      throw new BadRequestException('CAPTCHA validation failed.');
+    }
+  }
+
+  /**
+   * Altcha is verified locally: the client solves a proof-of-work, and the HMAC
+   * proves the challenge was issued by us.
+   */
+  private verifyAltcha(token: string, config: Record<string, string>): void {
+    let payload: AltchaPayload;
+    try {
+      payload = JSON.parse(Buffer.from(token, 'base64').toString('utf8'));
+    } catch {
+      throw new BadRequestException('Invalid CAPTCHA token format.');
+    }
+
+    const hash = createHash('sha256')
+      .update(payload.salt + String(payload.number))
+      .digest('hex');
+    if (hash !== payload.challenge) {
+      throw new BadRequestException('CAPTCHA validation failed.');
+    }
+
+    const hmac = createHmac('sha256', config.hmac_key)
+      .update(payload.challenge)
+      .digest('hex');
+    if (hmac !== payload.signature) {
+      throw new BadRequestException('CAPTCHA validation failed.');
+    }
+  }
+}

package/src/challenge/challenge.service.spec.ts

@@ -129,12 +129,15 @@ describe('ChallengeService', () => {
       ).rejects.toThrow(BadRequestException);
     });
 
-    it('cria challenge e envia email com link base64', async () => {
+    it('cria challenge e envia email com link contendo o token original (sem recodificação)', async () => {
       const { service, deps } = makeService();
       deps.prisma.user_identifier_challenge.count.mockResolvedValue(0);
       deps.prisma.user_identifier.findFirst.mockResolvedValue({
         id: 10,
-        user: { name: 'Bob' },
+        user: {
+          name: 'Bob',
+          user_credential: [{ type: 'password', revoked_at: null }],
+        },
       });
       deps.setting.getSettingValues.mockResolvedValue({
         'mfa-challenge-expiration-minutes': 15,
@@ -146,19 +149,51 @@ describe('ChallengeService', () => {
       const result = await service.forgotEmail('en', 'a@b.com');
 
       expect(result).toEqual({ id: 1 });
-      const base64 = Buffer.from('tok').toString('base64');
       expect(deps.mail.sendTemplatedMail).toHaveBeenCalledWith(
         'en',
         expect.objectContaining({
           email: 'a@b.com',
           slug: 'auth-forget-password',
           variables: expect.objectContaining({
-            link: `https://app.com/reset-password?token=${base64}`,
+            link: `https://app.com/reset-password?token=${encodeURIComponent('tok')}`,
             name: 'Bob',
           }),
         }),
       );
     });
+
+    it('lança BadRequest quando usuário não possui senha cadastrada (ex: login via SSO)', async () => {
+      const { service, deps } = makeService();
+      deps.prisma.user_identifier_challenge.count.mockResolvedValue(0);
+      deps.prisma.user_identifier.findFirst.mockResolvedValue({
+        id: 10,
+        user: { name: 'Bob', user_credential: [] },
+      });
+
+      await expect(
+        service.forgotEmail('en', 'a@b.com'),
+      ).rejects.toThrow(BadRequestException);
+      expect(deps.prisma.user_identifier_challenge.create).not.toHaveBeenCalled();
+      expect(deps.mail.sendTemplatedMail).not.toHaveBeenCalled();
+    });
+
+    it('lança BadRequest quando a única credencial de senha está revogada', async () => {
+      const { service, deps } = makeService();
+      deps.prisma.user_identifier_challenge.count.mockResolvedValue(0);
+      deps.prisma.user_identifier.findFirst.mockResolvedValue({
+        id: 10,
+        user: {
+          name: 'Bob',
+          user_credential: [
+            { type: 'password', revoked_at: new Date('2026-01-01T00:00:00Z') },
+          ],
+        },
+      });
+
+      await expect(
+        service.forgotEmail('en', 'a@b.com'),
+      ).rejects.toThrow(BadRequestException);
+    });
   });
 
   describe('verifyCodePassword', () => {

package/src/challenge/challenge.service.ts

@@ -5,6 +5,7 @@ import { MailService } from "../mail/mail.service";
 import { SecurityService } from "../security/security.service";
 import { SettingService } from "../setting/setting.service";
 import { TokenService } from "../token/token.service";
+import { hasPasswordCredential } from "../user/user-credential.util";
 
 @Injectable()
 export class ChallengeService {
@@ -21,7 +22,50 @@ export class ChallengeService {
     private readonly mail: MailService,
   ) { }
 
-  async verifyMfaEmail(locale: string, userId: number, email: string) {
+  /**
+   * Resolve a chave do app (ex.: "class") a partir do header Origin da
+   * requisicao, cruzando contra a setting `app-urls` (o mesmo mapeamento ja
+   * usado para montar links de e-mail por app). Usada para decidir a marca
+   * (`app-names`) em fluxos onde o frontend nao manda `app` explicitamente no
+   * corpo — o Origin ja chega sozinho em toda chamada cross-origin do browser.
+   */
+  async resolveAppKeyFromOrigin(origin?: string): Promise<string | undefined> {
+    if (!origin) {
+      return undefined;
+    }
+
+    let originHost: string;
+    try {
+      originHost = new URL(origin).hostname;
+    } catch {
+      return undefined;
+    }
+
+    const settings = await this.setting.getSettingValues(['app-urls']);
+    const appUrls: string[] = Array.isArray(settings['app-urls']) ? settings['app-urls'] : [];
+
+    for (const entry of appUrls) {
+      const separatorIndex = entry.indexOf('=');
+      if (separatorIndex === -1) {
+        continue;
+      }
+
+      const key = entry.slice(0, separatorIndex).trim();
+      const url = entry.slice(separatorIndex + 1).trim();
+
+      try {
+        if (new URL(url).hostname === originHost) {
+          return key;
+        }
+      } catch {
+        continue;
+      }
+    }
+
+    return undefined;
+  }
+
+  async verifyMfaEmail(locale: string, userId: number, email: string, origin?: string) {
     const settings = await this.setting.getSettingValues([
       'mfa-email-code-length',
       'mfa-challenge-expiration-minutes'
@@ -75,7 +119,8 @@ export class ChallengeService {
         variables: {
           code,
           name: user.name,
-        }
+        },
+        app: await this.resolveAppKeyFromOrigin(origin),
       }
     );
 
@@ -84,7 +129,7 @@ export class ChallengeService {
     return { challengeId };
   }
 
-  async verifyEmail(locale: string, userId: number, email: string) {
+  async verifyEmail(locale: string, userId: number, email: string, app?: string, origin?: string) {
 
     const identifier = await this.prisma.user_identifier.findFirst({
       where: {
@@ -139,7 +184,8 @@ export class ChallengeService {
         variables: {
           code,
           name: user.name,
-        }
+        },
+        app: app || await this.resolveAppKeyFromOrigin(origin),
       }
     );
 
@@ -202,11 +248,15 @@ export class ChallengeService {
 
     const userIdentifier = await this.prisma.user_identifier.findFirst({
       where: { type: 'email', value: email, enabled: true },
-      include: { user: true },
+      include: { user: { include: { user_credential: true } } },
     });
 
     if (!userIdentifier) throw new BadRequestException(getLocaleText('forgot.userNotFound', locale, 'User not found'));
 
+    if (!hasPasswordCredential(userIdentifier.user)) {
+      throw new BadRequestException(getLocaleText('forgot.noPassword', locale, 'This account does not have a password set. Sign in using your organization\'s login method instead.'));
+    }
+
     const settings = await this.setting.getSettingValues([
       'mfa-challenge-expiration-minutes',
       'url',
@@ -223,16 +273,16 @@ export class ChallengeService {
       },
     });
 
-    const tokenBase64 = Buffer.from(token).toString('base64');
     this.mail.sendTemplatedMail(
       locale,
       {
         email,
         slug: 'auth-forget-password',
         variables: {
-          link: `${this.resolveAppUrl(settings, app)}/reset-password?token=${tokenBase64}`,
+          link: `${this.resolveAppUrl(settings, app)}/reset-password?token=${encodeURIComponent(token)}`,
           name: userIdentifier.user.name,
-        }
+        },
+        app,
       }
     );
 
@@ -241,9 +291,10 @@ export class ChallengeService {
 
   /**
    * Cria um challenge de convite de criação de conta vinculado a um
-   * `user_identifier` de email já existente e retorna o token em base64
-   * (mesmo formato consumido pelo fluxo de reset de senha). A validade usa a
-   * setting `account-invite-expiration-minutes` (padrão 7 dias).
+   * `user_identifier` de email já existente e retorna o token opaco (mesmo
+   * formato consumido pelo fluxo de reset de senha) — quem monta o link a
+   * partir dele deve aplicar `encodeURIComponent`. A validade usa a setting
+   * `account-invite-expiration-minutes` (padrão 7 dias).
    */
   async createAccountInviteChallenge(userIdentifierId: number): Promise<string> {
     const settings = await this.setting.getSettingValues([
@@ -264,7 +315,7 @@ export class ChallengeService {
       },
     });
 
-    return Buffer.from(token).toString('base64');
+    return token;
   }
 
   private resolveAppUrl(settings: Record<string, any>, app?: string): string {
@@ -338,7 +389,7 @@ export class ChallengeService {
     return { success: true }
   }
 
-  async sendMfaCodeByEmail(locale: string, userId: number, email: string) {
+  async sendMfaCodeByEmail(locale: string, userId: number, email: string, origin?: string) {
     const user = await this.prisma.user.findUnique({
       where: { id: userId },
       select: { name: true }
@@ -382,7 +433,8 @@ export class ChallengeService {
         variables: {
           code,
           name: user.name,
-        }
+        },
+        app: await this.resolveAppKeyFromOrigin(origin),
       }
     );
 
@@ -413,7 +465,7 @@ export class ChallengeService {
     return true;
   }
 
-  async sendMfaCodeToMultipleEmails(locale: string, userId: number, emails: string[]) {
+  async sendMfaCodeToMultipleEmails(locale: string, userId: number, emails: string[], origin?: string) {
 
     if (!emails || emails.length === 0) {
       return { success: true };
@@ -455,8 +507,10 @@ export class ChallengeService {
       }
     });
 
+    const app = await this.resolveAppKeyFromOrigin(origin);
+
     for (const email of emails) {
-      
+
       this.mail.sendTemplatedMail(
         locale,
         {
@@ -465,7 +519,8 @@ export class ChallengeService {
           variables: {
             code,
             name: user.name,
-          }
+          },
+          app,
         }
       );
     }