@hed-hog/core 0.0.387 → 0.0.390

package/src/integration-profile/integration-profile.service.ts

@@ -5,22 +5,26 @@ import {
   BadRequestException,
   Inject,
   Injectable,
+  Logger,
   NotFoundException,
   forwardRef,
 } from '@nestjs/common';
 import * as pako from 'pako';
-import {
-  buildMailConfigFromIntegration,
-  buildWhatsappOfficialConfigFromIntegration,
-} from './integration-profile.utils';
 import { CreateDTO } from './dto/create.dto';
 import {
   ConflictResolutionDTO,
   ImportProfileItemDTO,
 } from './dto/import-confirm.dto';
+import { TestDTO } from './dto/test.dto';
 import { UpdateDTO } from './dto/update.dto';
 import { IntegrationCredentialCryptoService } from './integration-credential-crypto.service';
 import { getSensitiveConfigKeys } from './integration-profile.secrets';
+import { sanitizeTesterError } from './testers/http-probe';
+import { IntegrationTesterRegistry } from './testers/integration-tester.registry';
+import {
+  INTEGRATION_TEST_TIMEOUT_MS,
+  IntegrationTestOutcome,
+} from './testers/integration-tester.types';
 
 type IntegrationProfileExportItem = {
   slug: string;
@@ -58,6 +62,8 @@ type InvalidImportItem = {
 
 @Injectable()
 export class IntegrationProfileService {
+  private readonly logger = new Logger(IntegrationProfileService.name);
+
   constructor(
     @Inject(forwardRef(() => PrismaService))
     private readonly prismaService: PrismaService,
@@ -65,6 +71,8 @@ export class IntegrationProfileService {
     private readonly paginationService: PaginationService,
     @Inject(forwardRef(() => IntegrationCredentialCryptoService))
     private readonly credentialCrypto: IntegrationCredentialCryptoService,
+    @Inject(forwardRef(() => IntegrationTesterRegistry))
+    private readonly testerRegistry: IntegrationTesterRegistry,
   ) {}
 
   async listTypes() {
@@ -433,7 +441,14 @@ export class IntegrationProfileService {
     });
   }
 
-  async test(data: CreateDTO) {
+  /**
+   * Testa as credenciais de um perfil contra o serviço real, sem salvar.
+   *
+   * Só despacha: quem sabe falar com cada provider é o `IntegrationTester` registrado
+   * no `IntegrationTesterRegistry`. Funciona tanto na edição (herda os segredos
+   * armazenados no lugar da máscara) quanto na criação de um perfil ainda inexistente.
+   */
+  async test(data: TestDTO) {
     await this.validateTypeAndProvider(data.type_id, data.provider_id);
 
     const provider = await this.prismaService.integration_provider.findUnique({
@@ -455,17 +470,21 @@ export class IntegrationProfileService {
     }
 
     const typeSlug = provider.integration_type.slug;
-    if (typeSlug !== 'email' && typeSlug !== 'whatsapp') {
+    const slug = data.slug.trim();
+
+    const tester = this.testerRegistry.find(provider.slug);
+    if (!tester) {
       throw new BadRequestException(
-        'Integration profile test is only available for email and whatsapp types.',
+        `Connection test is not available for provider "${provider.slug}".`,
       );
     }
 
     // "Deixe em branco para manter": ao testar na edição, herda os segredos já
     // armazenados (decifrados pelo middleware) para os campos vazios/mascarados.
+    // Resolve por id quando ele veio: o slug é editável e pode ter mudado no form.
     let effectiveConfig = (data.config as Record<string, unknown>) ?? null;
     const stored = await this.prismaService.integration_profile.findUnique({
-      where: { slug: data.slug.trim() },
+      where: data.profile_id ? { id: data.profile_id } : { slug },
       select: { config: true },
     });
     if (stored?.config) {
@@ -476,143 +495,120 @@ export class IntegrationProfileService {
       ) as Record<string, unknown>;
     }
 
-    if (typeSlug === 'whatsapp') {
-      return this.testWhatsappProfile(
-        provider.slug,
-        data.slug.trim(),
-        effectiveConfig,
-      );
-    }
-
-    // Resend não usa SMTP/from_email: valida credenciais/domínio próprios.
-    if (provider.slug === 'resend') {
-      const resendCfg = (effectiveConfig as Record<string, unknown> | null) ?? {};
-      const apiToken = String(resendCfg.api_token ?? '').trim();
-      const domain = String(resendCfg.domain ?? '').trim();
+    const config = effectiveConfig ?? {};
+    const secretValues = getSensitiveConfigKeys(provider.slug)
+      .map((key) => String(config[key] ?? ''))
+      .filter((value) => value.length > 0);
 
-      if (!apiToken) {
-        throw new BadRequestException('Resend API token is required.');
-      }
-      if (!domain) {
-        throw new BadRequestException('Resend sending domain is required.');
-      }
-
-      return {
-        success: true,
-        destination: domain,
+    const timeoutMs = tester.timeoutMs ?? INTEGRATION_TEST_TIMEOUT_MS;
+    let outcome: IntegrationTestOutcome;
+    try {
+      // Duplo guarda de tempo: o AbortSignal cobre quem o respeita (fetch/SDKs) e o
+      // race cobre quem não respeita (o transporter do nodemailer, por exemplo).
+      outcome = await Promise.race([
+        tester.test(config, {
+          signal: AbortSignal.timeout(timeoutMs),
+          typeSlug,
+          providerSlug: provider.slug,
+          secretValues,
+        }),
+        this.hardTimeout(timeoutMs + 2_000),
+      ]);
+    } catch (error) {
+      outcome = {
+        ok: false,
+        error: sanitizeTesterError(error, secretValues),
       };
     }
 
-    buildMailConfigFromIntegration(provider.slug, effectiveConfig);
-
-    const destination = String(
-      (effectiveConfig as Record<string, unknown> | null | undefined)?.from_email ??
-        '',
-    ).trim();
+    const persisted = await this.recordValidation(
+      provider.slug,
+      slug,
+      outcome,
+      data.profile_id,
+    );
 
-    if (!destination) {
-      throw new BadRequestException('Sender email is required.');
+    if (!outcome.ok) {
+      this.logger.warn(
+        `Integration test failed for provider "${provider.slug}" (profile "${slug}"): ${outcome.error}`,
+      );
+      throw new BadRequestException(outcome.error || 'Connection test failed.');
     }
 
     return {
+      // `success` e `destination` são o contrato legado consumido pela tela de
+      // e-mail (core/integrations-webhooks): mantidos com o mesmo significado.
       success: true,
-      destination,
+      destination: String(config.from_email ?? '').trim() || outcome.info || '',
+      ok: true,
+      provider: provider.slug,
+      ...(outcome.info ? { info: outcome.info } : {}),
+      ...(outcome.warning ? { warning: outcome.warning } : {}),
+      tested_at: new Date().toISOString(),
+      persisted,
     };
   }
 
+  /** Rejeita depois de `ms`, para o caso de um tester ignorar o AbortSignal. */
+  private hardTimeout(ms: number): Promise<never> {
+    return new Promise((_resolve, reject) => {
+      const timer = setTimeout(() => {
+        const error = new Error('Connection test timed out.');
+        error.name = 'TimeoutError';
+        reject(error);
+      }, ms);
+      // Não segura o processo vivo caso o teste termine antes.
+      timer.unref?.();
+    });
+  }
+
   /**
-   * Valida um perfil whatsapp-official contra a Graph API (lê o WABA com o token)
-   * e registra o resultado no config. Nunca devolve o token/secret na resposta.
+   * Grava metadados (não-secretos) da última validação no config do perfil.
+   *
+   * Devolve se gravou: no fluxo de criação não existe linha ainda, e a UI usa isso
+   * para avisar que o resultado não ficou registrado.
    */
-  private async testWhatsappProfile(
+  private async recordValidation(
     providerSlug: string,
     slug: string,
-    effectiveConfig: Record<string, unknown> | null,
-  ) {
-    if (providerSlug !== 'whatsapp-official') {
-      throw new BadRequestException(
-        `Integration profile test is not available for provider "${providerSlug}".`,
-      );
-    }
-
-    const cfg = buildWhatsappOfficialConfigFromIntegration(effectiveConfig);
-
-    if (!cfg.accessToken) {
-      throw new BadRequestException('WhatsApp access token is required.');
-    }
-    if (!cfg.wabaId) {
-      throw new BadRequestException('WhatsApp Business Account ID is required.');
-    }
-    if (!cfg.appSecret) {
-      throw new BadRequestException(
-        'Meta App Secret is required to validate webhook signatures.',
-      );
-    }
-    if (!cfg.verifyToken) {
-      throw new BadRequestException('Webhook verify token is required.');
-    }
-
-    const url = `https://graph.facebook.com/${cfg.graphApiVersion}/${encodeURIComponent(
-      cfg.wabaId,
-    )}?fields=id,name`;
-
-    let name = '';
-    let failure: string | null = null;
+    outcome: IntegrationTestOutcome,
+    profileId?: number,
+  ): Promise<boolean> {
     try {
-      const response = await fetch(url, {
-        headers: { Authorization: `Bearer ${cfg.accessToken}` },
+      const stored = await this.prismaService.integration_profile.findUnique({
+        where: profileId ? { id: profileId } : { slug },
+        select: { id: true, config: true },
       });
-      const body = (await response.json().catch(() => ({}))) as {
-        name?: string;
-        error?: { message?: string };
+      // Perfil ainda não salvo (teste no fluxo de criação): nada a registrar.
+      if (!stored) return false;
+
+      // Parte de `stored.config`, NUNCA do config recebido: o que o usuário digitou
+      // e ainda não salvou não pode ser persistido de carona num teste.
+      // `stored.config` vem decifrado pelo middleware; recifra-mos ao gravar.
+      const plain = {
+        ...((stored.config as Record<string, unknown>) ?? {}),
+        last_validated_at: new Date().toISOString(),
+        last_validation_status: outcome.ok ? 'ok' : 'error',
+        last_error: outcome.ok ? null : (outcome.error ?? null),
+        last_validation_info: outcome.ok ? (outcome.info ?? null) : null,
       };
-      if (!response.ok) {
-        // A mensagem da Meta não contém o token; ainda assim só propagamos o texto dela.
-        failure =
-          body?.error?.message ?? `Graph API returned HTTP ${response.status}.`;
-      } else {
-        name = String(body?.name ?? '');
-      }
-    } catch (error) {
-      failure = error instanceof Error ? error.message : 'Graph API is unreachable.';
-    }
 
-    await this.recordWhatsappValidation(providerSlug, slug, failure);
-
-    if (failure) {
-      throw new BadRequestException(`WhatsApp validation failed: ${failure}`);
+      await this.prismaService.integration_profile.update({
+        where: { id: stored.id },
+        data: {
+          config: this.credentialCrypto.encryptConfig(providerSlug, plain) as object,
+        },
+      });
+      return true;
+    } catch (error) {
+      // Falhar ao REGISTRAR não pode transformar um teste bem-sucedido em erro 500.
+      this.logger.error(
+        `Failed to record validation for profile "${slug}": ${
+          error instanceof Error ? error.message : String(error)
+        }`,
+      );
+      return false;
     }
-
-    return { success: true, destination: name || cfg.wabaId };
-  }
-
-  /** Grava metadados (não-secretos) da última validação no config do perfil. */
-  private async recordWhatsappValidation(
-    providerSlug: string,
-    slug: string,
-    failure: string | null,
-  ) {
-    const stored = await this.prismaService.integration_profile.findUnique({
-      where: { slug },
-      select: { id: true, config: true },
-    });
-    // Perfil ainda não salvo (teste no fluxo de criação): nada a registrar.
-    if (!stored) return;
-
-    // `stored.config` vem decifrado pelo middleware; recifra-mos ao gravar.
-    const plain = {
-      ...((stored.config as Record<string, unknown>) ?? {}),
-      last_validated_at: new Date().toISOString(),
-      last_validation_status: failure ? 'error' : 'ok',
-      last_error: failure ?? null,
-    };
-
-    await this.prismaService.integration_profile.update({
-      where: { id: stored.id },
-      data: {
-        config: this.credentialCrypto.encryptConfig(providerSlug, plain) as object,
-      },
-    });
   }
 
   async exportProfiles({

package/src/integration-profile/integration-profile.utils.spec.ts

@@ -325,6 +325,28 @@ describe('integration-profile.utils', () => {
       });
     });
 
+    it('mapeia deepseek com a base URL padrão', () => {
+      expect(
+        buildAiConfigFromIntegration('deepseek', {
+          api_key: 'd',
+          model: 'deepseek-reasoner',
+        }),
+      ).toEqual({
+        apiKey: 'd',
+        model: 'deepseek-reasoner',
+        baseUrl: 'https://api.deepseek.com',
+      });
+    });
+
+    it('respeita a base URL informada no perfil deepseek', () => {
+      expect(
+        buildAiConfigFromIntegration('deepseek', {
+          api_key: 'd',
+          base_url: 'https://proxy.interno/v1/',
+        }),
+      ).toEqual({ apiKey: 'd', baseUrl: 'https://proxy.interno/v1' });
+    });
+
     it('lança para provider desconhecido', () => {
       expect(() => buildAiConfigFromIntegration('llama', {})).toThrow(
         BadRequestException,

package/src/integration-profile/integration-profile.utils.ts

@@ -300,21 +300,58 @@ export function buildKubernetesConfigFromIntegration(
 
 // ─── AI utilities ─────────────────────────────────────────────────────────────
 
-/** Maps an integration_profile config JSON to the API key and optional org needed by AI providers. */
+/**
+ * Base URL da API do DeepSeek. A API é compatível com o formato OpenAI
+ * (`POST {base}/chat/completions`), então os consumidores reaproveitam o mesmo
+ * corpo de requisição trocando apenas a URL e a chave.
+ */
+export const DEEPSEEK_API_BASE_URL = 'https://api.deepseek.com';
+
+/** Modelo usado quando o perfil DeepSeek não define um (`deepseek-reasoner` é o de raciocínio). */
+export const DEEPSEEK_DEFAULT_MODEL = 'deepseek-chat';
+
+/** Maps an integration_profile config JSON to the API key and optional org/model/timeout needed by AI providers. */
 export function buildAiConfigFromIntegration(
   providerSlug: string,
   config: unknown,
-): { apiKey: string; organization?: string } {
+): {
+  apiKey: string;
+  organization?: string;
+  model?: string;
+  timeoutMs?: number;
+  /** Endpoint OpenAI-compatible do provider (hoje só o DeepSeek usa). */
+  baseUrl?: string;
+} {
   const cfg = (config as Cfg) ?? {};
+  const model = String(cfg.model ?? '').trim() || undefined;
+  const parsedTimeout = Number(cfg.timeout_ms);
+  const timeoutMs = Number.isFinite(parsedTimeout) && parsedTimeout > 0 ? parsedTimeout : undefined;
+
   switch (providerSlug.toLowerCase()) {
     case 'openai':
       return {
         apiKey: String(cfg.api_key ?? ''),
         ...(cfg.organization ? { organization: String(cfg.organization) } : {}),
+        ...(model ? { model } : {}),
+        ...(timeoutMs ? { timeoutMs } : {}),
+      };
+    case 'deepseek':
+      return {
+        apiKey: String(cfg.api_key ?? ''),
+        ...(model ? { model } : {}),
+        ...(timeoutMs ? { timeoutMs } : {}),
+        baseUrl:
+          String(cfg.base_url ?? '')
+            .trim()
+            .replace(/\/+$/, '') || DEEPSEEK_API_BASE_URL,
       };
     case 'gemini':
     case 'claude':
-      return { apiKey: String(cfg.api_key ?? '') };
+      return {
+        apiKey: String(cfg.api_key ?? ''),
+        ...(model ? { model } : {}),
+        ...(timeoutMs ? { timeoutMs } : {}),
+      };
     default:
       throw new BadRequestException(`Unsupported AI provider: ${providerSlug}`);
   }

package/src/integration-profile/testers/ai.testers.ts

@@ -0,0 +1,165 @@
+import {
+  describeHttpError,
+  fail,
+  pass,
+  probeJson,
+  requireFields,
+  str,
+} from './http-probe';
+import { IntegrationTester } from './integration-tester.types';
+
+/**
+ * Testadores dos providers de IA e geração de vídeo.
+ *
+ * Todos listam modelos: é a chamada autenticada mais barata de cada API (não consome
+ * token nem gera cobrança) e prova que a chave está ativa.
+ */
+
+const openAiTester: IntegrationTester = {
+  providerSlug: 'openai',
+  test: async (config, ctx) => {
+    const missing = requireFields(config, [['api_key', 'API key']]);
+    if (missing) return missing;
+
+    const organization = str(config, 'organization');
+    const headers: Record<string, string> = {
+      Authorization: `Bearer ${String(config.api_key ?? '')}`,
+      ...(organization ? { 'OpenAI-Organization': organization } : {}),
+    };
+
+    const result = await probeJson(
+      'https://api.openai.com/v1/models',
+      { headers },
+      ctx.signal,
+    );
+
+    if (result.status === 401) return fail('Invalid OpenAI API key.');
+    if (result.status === 403) {
+      return fail('This API key has no permission to list models.');
+    }
+    if (!result.ok) {
+      return fail(describeHttpError(result, 'OpenAI rejected the credentials.'));
+    }
+
+    const models: Array<{ id?: string }> = Array.isArray(result.body?.data)
+      ? result.body.data
+      : [];
+    const wanted = str(config, 'model');
+
+    // Modelo indisponível para a conta não invalida a chave — o operador só precisa
+    // saber antes de descobrir na primeira chamada real.
+    if (wanted && !models.some((model) => model.id === wanted)) {
+      return pass(
+        `OpenAI — ${models.length} model(s) available`,
+        `The model "${wanted}" is not available for this account.`,
+      );
+    }
+    return pass(
+      `OpenAI — ${models.length} model(s) available${wanted ? ` (${wanted} ok)` : ''}`,
+    );
+  },
+};
+
+const geminiTester: IntegrationTester = {
+  providerSlug: 'gemini',
+  test: async (config, ctx) => {
+    const missing = requireFields(config, [['api_key', 'API key']]);
+    if (missing) return missing;
+
+    const url = `https://generativelanguage.googleapis.com/v1beta/models?key=${encodeURIComponent(
+      String(config.api_key ?? ''),
+    )}`;
+    const result = await probeJson(url, {}, ctx.signal);
+
+    if (result.status === 400 || result.status === 401 || result.status === 403) {
+      return fail('Invalid Gemini API key.');
+    }
+    if (!result.ok) {
+      return fail(describeHttpError(result, 'Google rejected the credentials.'));
+    }
+
+    const models: unknown[] = Array.isArray(result.body?.models)
+      ? result.body.models
+      : [];
+    return pass(`Gemini — ${models.length} model(s) available`);
+  },
+};
+
+const claudeTester: IntegrationTester = {
+  providerSlug: 'claude',
+  test: async (config, ctx) => {
+    const missing = requireFields(config, [['api_key', 'API key']]);
+    if (missing) return missing;
+
+    const result = await probeJson(
+      'https://api.anthropic.com/v1/models',
+      {
+        headers: {
+          'x-api-key': String(config.api_key ?? ''),
+          'anthropic-version': '2023-06-01',
+        },
+      },
+      ctx.signal,
+    );
+
+    if (result.status === 401) return fail('Invalid Anthropic API key.');
+    if (!result.ok) {
+      return fail(describeHttpError(result, 'Anthropic rejected the credentials.'));
+    }
+
+    const models: unknown[] = Array.isArray(result.body?.data) ? result.body.data : [];
+    return pass(`Claude — ${models.length} model(s) available`);
+  },
+};
+
+const deepseekTester: IntegrationTester = {
+  providerSlug: 'deepseek',
+  test: async (config, ctx) => {
+    const missing = requireFields(config, [['api_key', 'API key']]);
+    if (missing) return missing;
+
+    const result = await probeJson(
+      'https://api.deepseek.com/models',
+      { headers: { Authorization: `Bearer ${String(config.api_key ?? '')}` } },
+      ctx.signal,
+    );
+
+    if (result.status === 401) return fail('Invalid DeepSeek API key.');
+    if (!result.ok) {
+      return fail(describeHttpError(result, 'DeepSeek rejected the credentials.'));
+    }
+
+    const models: unknown[] = Array.isArray(result.body?.data) ? result.body.data : [];
+    return pass(`DeepSeek — ${models.length} model(s) available`);
+  },
+};
+
+const lumaTester: IntegrationTester = {
+  providerSlug: 'luma',
+  test: async (config, ctx) => {
+    const missing = requireFields(config, [['api_key', 'API key']]);
+    if (missing) return missing;
+
+    const result = await probeJson(
+      'https://api.lumalabs.ai/dream-machine/v1/generations?limit=1',
+      { headers: { Authorization: `Bearer ${String(config.api_key ?? '')}` } },
+      ctx.signal,
+    );
+
+    if (result.status === 401 || result.status === 403) {
+      return fail('Invalid Luma API key.');
+    }
+    if (!result.ok) {
+      return fail(describeHttpError(result, 'Luma rejected the credentials.'));
+    }
+    return pass('Luma Dream Machine');
+  },
+};
+
+export const AI_TESTERS: IntegrationTester[] = [
+  openAiTester,
+  geminiTester,
+  claudeTester,
+  deepseekTester,
+  lumaTester,
+];

package/src/integration-profile/testers/captcha.testers.spec.ts

@@ -0,0 +1,92 @@
+import { afterEach, beforeEach, describe, expect, it, jest } from '@jest/globals';
+import { CAPTCHA_TESTERS } from './captcha.testers';
+import { IntegrationTestContext, IntegrationTester } from './integration-tester.types';
+
+const bySlug = (slug: string): IntegrationTester =>
+  CAPTCHA_TESTERS.find((tester) => tester.providerSlug === slug)!;
+
+const ctx = (): IntegrationTestContext => ({
+  signal: AbortSignal.timeout(5_000),
+  typeSlug: 'captcha',
+  providerSlug: 'test',
+  secretValues: [],
+});
+
+function siteverify(errorCodes: string[], success = false) {
+  return {
+    ok: true,
+    status: 200,
+    text: async () => JSON.stringify({ success, 'error-codes': errorCodes }),
+  } as unknown as Response;
+}
+
+let fetchMock: jest.Mock;
+
+beforeEach(() => {
+  fetchMock = jest.fn();
+  global.fetch = fetchMock as unknown as typeof fetch;
+});
+
+afterEach(() => {
+  jest.restoreAllMocks();
+});
+
+describe.each([
+  ['recaptcha', 'Invalid reCAPTCHA secret key.'],
+  ['cloudflare-turnstile', 'Invalid Turnstile secret key.'],
+])('%s tester', (slug, invalidSecretMessage) => {
+  const tester = bySlug(slug);
+
+  it('reprova quando o siteverify recusa o segredo', async () => {
+    fetchMock.mockResolvedValue(siteverify(['invalid-input-secret']));
+
+    const outcome = await tester.test(
+      { site_key: 'site', secret_key: 'wrong' },
+      ctx(),
+    );
+
+    expect(outcome).toEqual({ ok: false, error: invalidSecretMessage });
+  });
+
+  it('aprova quando o siteverify aceita o segredo e só reclama do token de teste', async () => {
+    fetchMock.mockResolvedValue(
+      siteverify(['missing-input-response', 'invalid-input-response']),
+    );
+
+    const outcome = await tester.test(
+      { site_key: 'site', secret_key: 'right' },
+      ctx(),
+    );
+
+    expect(outcome.ok).toBe(true);
+  });
+
+  it('reprova sem ir à rede quando falta o segredo', async () => {
+    const outcome = await tester.test({ site_key: 'site' }, ctx());
+
+    expect(outcome.ok).toBe(false);
+    expect(fetchMock).not.toHaveBeenCalled();
+  });
+});
+
+describe('altcha tester', () => {
+  const tester = bySlug('altcha');
+
+  it('valida a chave localmente e avisa que não há verificação remota', async () => {
+    const outcome = await tester.test(
+      { hmac_key: 'uma-chave-hmac-suficientemente-longa' },
+      ctx(),
+    );
+
+    expect(outcome.ok).toBe(true);
+    expect(outcome.warning).toContain('self-hosted');
+    expect(fetchMock).not.toHaveBeenCalled();
+  });
+
+  it('reprova uma chave curta demais', async () => {
+    const outcome = await tester.test({ hmac_key: 'curta' }, ctx());
+
+    expect(outcome.ok).toBe(false);
+    expect(outcome.error).toContain('too short');
+  });
+});