@hed-hog/core 0.0.387 → 0.0.390

package/src/core.module.ts

@@ -19,6 +19,10 @@ import { InstallModule } from './install/install.module';
 import { IntegrationModule } from './integration/integration.module';
 import { LocaleModule as CoreLocaleModule } from './locale/locale.module';
 import { MailSentModule } from './mail-sent/mail-sent.module';
+import { IncidentModule } from './incident/incident.module';
+import { LeakedPasswordModule } from './leaked-password/leaked-password.module';
+import { LeakedPasswordService } from './leaked-password/leaked-password.service';
+import { MailLayoutModule } from './mail-layout/mail-layout.module';
 import { MailModule } from './mail/mail.module';
 import { McpChatModule } from './mcp-chat/mcp-chat.module';
 import { McpModule } from './mcp/mcp.module';
@@ -26,11 +30,14 @@ import { MenuModule } from './menu/menu.module';
 import { LocaleInjectionMiddleware } from './middlewares/locale-injection.middleware';
 import { NotificationModule } from './notification/notification.module';
 import { OAuthModule } from './oauth/oauth.module';
+import { PresenceModule } from './presence/presence.module';
+import { RealtimeModule } from './realtime/realtime.module';
 import { PdfModule } from './pdf/pdf.module';
 import { ProfileModule } from './profile/profile.module';
 import { RoleModule } from './role/role.module';
 import { RouteModule } from './route/route.module';
 import { ScreenModule } from './screen/screen.module';
+import { CaptchaModule } from './captcha/captcha.module';
 import { SecurityModule } from './security/security.module';
 import { SessionModule } from './session/session.module';
 import { SettingModule } from './setting/setting.module';
@@ -45,6 +52,7 @@ import { AiInstructionModule } from './ai-instruction/ai-instruction.module';
 import { AuthorizeModule } from './authorize/authorize.module';
 import { IntegrationProfileModule } from './integration-profile/integration-profile.module';
 import { WebhookIntegrationModule } from './webhook-integration/webhook-integration.module';
+import { WhatsappSenderModule } from './whatsapp-sender/whatsapp-sender.module';
 
 @Global()
 @Module({
@@ -68,12 +76,17 @@ import { WebhookIntegrationModule } from './webhook-integration/webhook-integrat
     forwardRef(() => UserModule),
     forwardRef(() => SystemModule),
     forwardRef(() => SettingModule),
+    forwardRef(() => IncidentModule),
+    forwardRef(() => LeakedPasswordModule),
     forwardRef(() => MailModule),
+    forwardRef(() => MailLayoutModule),
     forwardRef(() => IntegrationProfileModule),
+    forwardRef(() => WhatsappSenderModule),
     forwardRef(() => MailSentModule),
     forwardRef(() => FileModule),
     forwardRef(() => TaskModule),
     forwardRef(() => SecurityModule),
+    forwardRef(() => CaptchaModule),
     forwardRef(() => ProfileModule),
     forwardRef(() => SessionModule),
     forwardRef(() => OAuthModule),
@@ -85,12 +98,18 @@ import { WebhookIntegrationModule } from './webhook-integration/webhook-integrat
     forwardRef(() => PdfModule),
     forwardRef(() => NotificationModule),
     forwardRef(() => AccessLogModule),
+    forwardRef(() => RealtimeModule),
+    forwardRef(() => PresenceModule),
   ],
   exports: [
     UserModule,
     AuthModule,
+    IncidentModule,
+    LeakedPasswordModule,
     MailModule,
+    MailLayoutModule,
     IntegrationProfileModule,
+    WhatsappSenderModule,
     RouteModule,
     RoleModule,
     MenuModule,
@@ -104,12 +123,16 @@ import { WebhookIntegrationModule } from './webhook-integration/webhook-integrat
     AiInstructionModule,
     IntegrationModule,
     WebhookIntegrationModule,
+    OAuthModule,
     IsStrongPasswordWithSettingsConstraint,
     IsEmailWithSettingsConstraint,
     IsPinCodeWithSettingConstraint,
     PdfModule,
     NotificationModule,
     AccessLogModule,
+    RealtimeModule,
+    PresenceModule,
+    CaptchaModule,
   ],
   providers: [
     Reflector,
@@ -135,12 +158,15 @@ import { WebhookIntegrationModule } from './webhook-integration/webhook-integrat
 export class CoreModule implements NestModule, OnModuleInit {
   constructor(
     @Inject(forwardRef(() => SettingService))
-    private readonly settingService: SettingService
+    private readonly settingService: SettingService,
+    @Inject(forwardRef(() => LeakedPasswordService))
+    private readonly leakedPasswordService: LeakedPasswordService
   ) {}
 
   onModuleInit() {
     // Initialize the service locator for validators
     ValidatorServiceLocator.setSettingService(this.settingService);
+    ValidatorServiceLocator.setLeakedPasswordService(this.leakedPasswordService);
   }
 
   configure(consumer: MiddlewareConsumer) {

package/src/file/file.service.spec.ts

@@ -0,0 +1,105 @@
+import { afterEach, beforeEach, describe, expect, it, jest } from '@jest/globals';
+import { FileService } from './file.service';
+import { ProviderFactory } from './provider/provider.factory';
+
+/**
+ * Resolver o provider custava 3 queries + a reconstrução do client de storage por arquivo.
+ * Em upload em massa (segmentos HLS em lotes paralelos, frames, pacotes SCORM) isso virava
+ * milhares de round-trips simultâneos e estourava o pool de conexões no meio da conversão.
+ */
+describe('FileService.getProvider', () => {
+  let deps: any;
+  let service: FileService;
+  let createSpy: jest.SpiedFunction<typeof ProviderFactory.create>;
+
+  beforeEach(() => {
+    deps = {
+      prisma: {
+        integration_profile: {
+          findUnique: jest.fn().mockResolvedValue({
+            slug: 'spaces',
+            config: {},
+            integration_type: { slug: 'storage' },
+            integration_provider: { slug: 's3-compatible' },
+          } as never),
+        },
+        file_provider: {
+          findFirst: jest.fn().mockResolvedValue({ id: 7 } as never),
+        },
+      },
+      pagination: {},
+      setting: {
+        getSettingValues: jest
+          .fn()
+          .mockResolvedValue({ 'file-storage-profile-id': 'spaces' } as never),
+      },
+      jwt: {},
+      imageOptimization: {},
+    };
+
+    createSpy = jest
+      .spyOn(ProviderFactory, 'create')
+      .mockResolvedValue({ name: 'spaces-provider' } as never);
+
+    service = new FileService(
+      deps.prisma,
+      deps.pagination,
+      deps.setting,
+      deps.jwt,
+      deps.imageOptimization,
+    );
+  });
+
+  afterEach(() => jest.restoreAllMocks());
+
+  it('resolve uma vez e reaproveita dentro da janela de cache', async () => {
+    const first = await service.getProvider();
+    const second = await service.getProvider();
+
+    expect(second).toBe(first);
+    expect(createSpy).toHaveBeenCalledTimes(1);
+    expect(deps.prisma.integration_profile.findUnique).toHaveBeenCalledTimes(1);
+    expect(deps.prisma.file_provider.findFirst).toHaveBeenCalledTimes(1);
+  });
+
+  it('mantém o providerId ao servir do cache (usado no registro do arquivo)', async () => {
+    await service.getProvider();
+    (service as any).providerId = undefined;
+
+    await service.getProvider();
+
+    expect((service as any).providerId).toBe(7);
+  });
+
+  it('deduplica resoluções simultâneas (lote de uploads paralelos)', async () => {
+    const results = await Promise.all(
+      Array.from({ length: 20 }, () => service.getProvider()),
+    );
+
+    expect(createSpy).toHaveBeenCalledTimes(1);
+    expect(new Set(results).size).toBe(1);
+  });
+
+  it('não guarda resolução com erro e volta a tentar na chamada seguinte', async () => {
+    deps.setting.getSettingValues.mockResolvedValueOnce({
+      'file-storage-profile-id': '',
+    } as never);
+
+    await expect(service.getProvider()).rejects.toThrow(
+      'No file storage profile configured',
+    );
+
+    await expect(service.getProvider()).resolves.toEqual({
+      name: 'spaces-provider',
+    });
+  });
+
+  it('reresolve depois que a janela de cache expira', async () => {
+    await service.getProvider();
+    (service as any).cachedProvider.expiresAt = Date.now() - 1;
+
+    await service.getProvider();
+
+    expect(createSpy).toHaveBeenCalledTimes(2);
+  });
+});

package/src/file/file.service.ts

@@ -45,11 +45,31 @@ import { ImageOptimizationService } from './image-optimization.service';
 import { AbstractProvider } from './provider/abstract.provider';
 import { ProviderFactory } from './provider/provider.factory';
 
+type ResolvedProvider = {
+  provider: AbstractProvider;
+  providerId: number;
+  expiresAt: number;
+};
+
+/**
+ * Resolver o provider custa 3 queries (setting + integration_profile, que ainda decifra o
+ * config, + file_provider) e reconstrói o client de storage a cada arquivo. Em upload em
+ * massa — segmentos HLS, frames, pacotes SCORM — isso vira milhares de round-trips em
+ * rajadas paralelas e é o que estoura o pool de conexões durante a conversão de vídeo.
+ * A janela curta mantém a troca de perfil de storage praticamente imediata.
+ */
+const PROVIDER_CACHE_TTL_MS = Math.max(
+  0,
+  Number(process.env.FILE_PROVIDER_CACHE_TTL_MS ?? 30_000),
+);
+
 @Injectable()
 export class FileService implements OnModuleInit {
   private readonly logger = new Logger(FileService.name);
   private providerId: number | undefined;
   private mimetypes: Record<string, number> = {};
+  private cachedProvider: ResolvedProvider | null = null;
+  private providerResolution: Promise<AbstractProvider> | null = null;
 
   private resolveProviderPath(file: { location: string; path: string }): string {
     // Supports legacy basename-only values while prioritizing full provider keys.
@@ -103,6 +123,26 @@ export class FileService implements OnModuleInit {
   }
 
   async getProvider(): Promise<AbstractProvider> {
+    const cached = this.cachedProvider;
+    if (cached && cached.expiresAt > Date.now()) {
+      this.providerId = cached.providerId;
+      return cached.provider;
+    }
+
+    // Uploads paralelos (lotes de segmentos HLS) chegam aqui juntos; sem esta deduplicação
+    // cada um dispara o mesmo conjunto de queries em vez de aproveitar a primeira resolução.
+    if (this.providerResolution) {
+      return this.providerResolution;
+    }
+
+    this.providerResolution = this.resolveProvider().finally(() => {
+      this.providerResolution = null;
+    });
+
+    return this.providerResolution;
+  }
+
+  private async resolveProvider(): Promise<AbstractProvider> {
     const settings = await this.settingService.getSettingValues(['file-storage-profile-id']);
     const profileSlug = String(settings['file-storage-profile-id'] ?? '').trim();
 
@@ -143,7 +183,17 @@ export class FileService implements OnModuleInit {
     }
 
     this.providerId = providerData.id;
-    return await ProviderFactory.create(enumProvider, config, this.jwtService);
+    const provider = await ProviderFactory.create(enumProvider, config, this.jwtService);
+
+    if (PROVIDER_CACHE_TTL_MS > 0) {
+      this.cachedProvider = {
+        provider,
+        providerId: providerData.id,
+        expiresAt: Date.now() + PROVIDER_CACHE_TTL_MS,
+      };
+    }
+
+    return provider;
   }
 
   async getMimeType(mimetype: string) {
@@ -430,6 +480,10 @@ export class FileService implements OnModuleInit {
     destination: string,
     fileBuffer: MulterFile,
     resize?: { maxWidth?: number; maxHeight?: number },
+    // Escape hatch para chamadores INTERNOS que já validaram por conta própria —
+    // o mesmo par de flags que `uploadFromPath` sempre teve. O FileController não
+    // repassa este argumento, então não há como acioná-lo por HTTP.
+    options?: { skipMimeValidation?: boolean; skipSizeValidation?: boolean },
   ) {
 
     if (!fileBuffer) {
@@ -442,13 +496,16 @@ export class FileService implements OnModuleInit {
 
     const provider = await this.getProvider();
 
-    if (!(await this.acceptMimetypes(fileBuffer.mimetype))) {
+    if (
+      !options?.skipMimeValidation &&
+      !(await this.acceptMimetypes(fileBuffer.mimetype))
+    ) {
       throw new BadRequestException(
         `Invalid file type: ${fileBuffer.mimetype}`,
       );
     }
 
-    if (!(await this.maxFileSize(fileBuffer.size))) {
+    if (!options?.skipSizeValidation && !(await this.maxFileSize(fileBuffer.size))) {
       throw new BadRequestException(`File too large: ${fileBuffer.size} bytes`);
     }
 

package/src/incident/incident-notifier.service.spec.ts

@@ -0,0 +1,205 @@
+import { afterAll, beforeEach, describe, expect, it, jest } from '@jest/globals';
+import {
+  INCIDENT_NOTIFY_SOURCE,
+  IncidentNotifierService,
+  type NotifiableIncident,
+} from './incident-notifier.service';
+
+const incident = (overrides: Partial<NotifiableIncident> = {}): NotifiableIncident => ({
+  id: 1,
+  source: 'core.mail',
+  code: 'mail_send_failed',
+  severity: 'critical',
+  message: 'SMTP timeout',
+  occurrences: 1,
+  context: { slug: 'auth-login-new-device' },
+  notifiedAt: null,
+  reason: 'created',
+  ...overrides,
+});
+
+const baseSettings = {
+  'incident.notify-enabled': 'true',
+  'incident.notify-min-severity': 'critical',
+  'incident.notify-cooldown-minutes': '60',
+  'incident.notify-email-to': 'ops@hcode.com.br',
+  'incident.notify-whatsapp-profile': '',
+  'incident.notify-whatsapp-phone-number-id': '',
+  'incident.notify-whatsapp-to': '',
+  'incident.notify-whatsapp-template': '',
+  'incident.notify-whatsapp-template-language': 'pt_BR',
+};
+
+const makeDeps = (settings: Record<string, unknown> = {}) => ({
+  prisma: {
+    system_incident: { update: jest.fn(async () => ({})) },
+    integration_profile: {
+      findUnique: jest.fn(async () => ({
+        config: { access_token: 'token', graph_api_version: 'v21.0' },
+      })),
+    },
+  },
+  setting: { getSettingValues: jest.fn(async () => ({ ...baseSettings, ...settings })) },
+  mail: { sendRawMail: jest.fn(async () => undefined) },
+});
+
+const makeService = (deps: any) =>
+  new IncidentNotifierService(deps.prisma as any, deps.setting as any, deps.mail as any);
+
+describe('IncidentNotifierService.notify', () => {
+  const fetchOriginal = global.fetch;
+
+  beforeEach(() => {
+    jest.clearAllMocks();
+    global.fetch = jest.fn(async () => ({ ok: true, json: async () => ({}) })) as any;
+  });
+
+  afterAll(() => {
+    global.fetch = fetchOriginal;
+  });
+
+  describe('guardas', () => {
+    it('NUNCA avisa sobre falha do próprio aviso — seria laço infinito', async () => {
+      const deps = makeDeps();
+      await makeService(deps).notify(incident({ source: INCIDENT_NOTIFY_SOURCE }));
+
+      expect(deps.setting.getSettingValues).not.toHaveBeenCalled();
+      expect(deps.mail.sendRawMail).not.toHaveBeenCalled();
+    });
+
+    it('respeita o kill switch', async () => {
+      const deps = makeDeps({ 'incident.notify-enabled': 'false' });
+      await makeService(deps).notify(incident());
+
+      expect(deps.mail.sendRawMail).not.toHaveBeenCalled();
+    });
+
+    it('ignora severidade abaixo do mínimo', async () => {
+      const deps = makeDeps({ 'incident.notify-min-severity': 'critical' });
+      await makeService(deps).notify(incident({ severity: 'warning' }));
+
+      expect(deps.mail.sendRawMail).not.toHaveBeenCalled();
+    });
+
+    it('avisa quando a severidade está acima do mínimo', async () => {
+      const deps = makeDeps({ 'incident.notify-min-severity': 'warning' });
+      await makeService(deps).notify(incident({ severity: 'error' }));
+
+      expect(deps.mail.sendRawMail).toHaveBeenCalled();
+    });
+
+    it('nunca lança, mesmo com o e-mail fora do ar', async () => {
+      const deps = makeDeps();
+      deps.mail.sendRawMail = jest.fn(async () => {
+        throw new Error('SMTP caiu');
+      });
+
+      await expect(makeService(deps).notify(incident())).resolves.toBeUndefined();
+    });
+  });
+
+  describe('cooldown', () => {
+    it('segura aviso repetido dentro da janela', async () => {
+      const deps = makeDeps();
+      const agora = new Date();
+      await makeService(deps).notify(incident({ notifiedAt: agora }));
+
+      expect(deps.mail.sendRawMail).not.toHaveBeenCalled();
+    });
+
+    it('volta a avisar depois da janela', async () => {
+      const deps = makeDeps({ 'incident.notify-cooldown-minutes': '30' });
+      const antigo = new Date(Date.now() - 60 * 60_000);
+      await makeService(deps).notify(incident({ notifiedAt: antigo }));
+
+      expect(deps.mail.sendRawMail).toHaveBeenCalled();
+    });
+
+    it('reabertura ignora o cooldown — foi dado como resolvido e voltou', async () => {
+      const deps = makeDeps();
+      await makeService(deps).notify(incident({ notifiedAt: new Date(), reason: 'reopened' }));
+
+      expect(deps.mail.sendRawMail).toHaveBeenCalled();
+    });
+  });
+
+  describe('e-mail', () => {
+    it('envia para cada destinatário e marca notified_at', async () => {
+      const deps = makeDeps({ 'incident.notify-email-to': 'a@x.com, b@x.com' });
+      await makeService(deps).notify(incident());
+
+      expect(deps.mail.sendRawMail).toHaveBeenCalledTimes(2);
+      const [args] = deps.mail.sendRawMail.mock.calls[0] as [any];
+      expect(args.subject).toContain('CRITICAL');
+      expect(args.subject).toContain('core.mail');
+      expect(deps.prisma.system_incident.update).toHaveBeenCalled();
+    });
+
+    it('não marca notified_at quando nenhum canal está configurado', async () => {
+      const deps = makeDeps({ 'incident.notify-email-to': '' });
+      await makeService(deps).notify(incident());
+
+      expect(deps.prisma.system_incident.update).not.toHaveBeenCalled();
+    });
+  });
+
+  describe('whatsapp', () => {
+    const whatsappSettings = {
+      'incident.notify-email-to': '',
+      'incident.notify-whatsapp-profile': 'meta-oficial',
+      'incident.notify-whatsapp-phone-number-id': '123456',
+      'incident.notify-whatsapp-to': '+55 (11) 99999-9999',
+    };
+
+    it('envia template aprovado quando configurado', async () => {
+      const deps = makeDeps({
+        ...whatsappSettings,
+        'incident.notify-whatsapp-template': 'alerta_incidente',
+      });
+      await makeService(deps).notify(incident());
+
+      const [url, options] = (global.fetch as any).mock.calls[0];
+      expect(url).toContain('/123456/messages');
+      const body = JSON.parse(options.body);
+      expect(body.type).toBe('template');
+      expect(body.template.name).toBe('alerta_incidente');
+      // Numero normalizado para digitos E.164.
+      expect(body.to).toBe('5511999999999');
+    });
+
+    it('cai para texto livre sem template — só entrega na janela de 24h', async () => {
+      const deps = makeDeps(whatsappSettings);
+      await makeService(deps).notify(incident());
+
+      const [, options] = (global.fetch as any).mock.calls[0];
+      expect(JSON.parse(options.body).type).toBe('text');
+    });
+
+    it('não marca notified_at quando a Meta recusa', async () => {
+      const deps = makeDeps(whatsappSettings);
+      global.fetch = jest.fn(async () => ({
+        ok: false,
+        status: 400,
+        json: async () => ({ error: { message: 'fora da janela' } }),
+      })) as any;
+
+      await makeService(deps).notify(incident());
+      expect(deps.prisma.system_incident.update).not.toHaveBeenCalled();
+    });
+
+    it('não tenta enviar sem perfil de integração', async () => {
+      const deps = makeDeps({ ...whatsappSettings, 'incident.notify-whatsapp-profile': '' });
+      await makeService(deps).notify(incident());
+
+      expect(global.fetch).not.toHaveBeenCalled();
+    });
+
+    it('não tenta enviar quando o perfil não existe', async () => {
+      const deps = makeDeps(whatsappSettings);
+      deps.prisma.integration_profile.findUnique = jest.fn(async () => null);
+
+      await makeService(deps).notify(incident());
+      expect(global.fetch).not.toHaveBeenCalled();
+    });
+  });
+});