@hed-hog/core 0.0.387 → 0.0.390

package/src/integration-profile/testers/oauth.testers.ts

@@ -0,0 +1,305 @@
+import * as jwt from 'jsonwebtoken';
+import {
+  describeHttpError,
+  fail,
+  pass,
+  probeJson,
+  requireFields,
+  str,
+} from './http-probe';
+import { IntegrationTester } from './integration-tester.types';
+
+/**
+ * Testadores dos providers de OAuth.
+ *
+ * Um login OAuth completo exige um usuário real no navegador, então não dá para
+ * reproduzi-lo aqui. O que dá para provar — e é o que erra na prática — são as
+ * credenciais do aplicativo: mandamos ao endpoint de token um código propositalmente
+ * inválido e lemos QUAL erro volta.
+ *
+ *   invalid_client  → client_id/client_secret errados  → REPROVA
+ *   invalid_grant   → credenciais aceitas, só o código é falso (era o esperado) → APROVA
+ *
+ * Onde o provider suporta `client_credentials` (Facebook, Microsoft), usamos isso:
+ * é uma prova direta, sem inferência.
+ */
+
+/** Código propositalmente inválido usado nas trocas de token. */
+const PROBE_CODE = 'hedhog-connection-test';
+
+const googleOAuthTester: IntegrationTester = {
+  providerSlug: 'google-oauth',
+  test: async (config, ctx) => {
+    const missing = requireFields(config, [
+      ['client_id', 'Client ID'],
+      ['client_secret', 'Client secret'],
+    ]);
+    if (missing) return missing;
+
+    const result = await probeJson(
+      'https://oauth2.googleapis.com/token',
+      {
+        method: 'POST',
+        headers: { 'Content-Type': 'application/x-www-form-urlencoded' },
+        body: new URLSearchParams({
+          client_id: str(config, 'client_id'),
+          client_secret: String(config.client_secret ?? ''),
+          code: PROBE_CODE,
+          grant_type: 'authorization_code',
+          redirect_uri: 'https://localhost/hedhog-connection-test',
+        }).toString(),
+      },
+      ctx.signal,
+    );
+
+    const code = String(result.body?.error ?? '');
+    if (code === 'invalid_client') return fail('Invalid Client ID or Client secret.');
+    if (code === 'invalid_grant' || result.ok) {
+      return pass('Google accepted the app credentials');
+    }
+    return fail(describeHttpError(result, 'Google rejected the credentials.'));
+  },
+};
+
+const facebookOAuthTester: IntegrationTester = {
+  providerSlug: 'facebook-oauth',
+  test: async (config, ctx) => {
+    const missing = requireFields(config, [
+      ['client_id', 'Client ID'],
+      ['client_secret', 'Client secret'],
+    ]);
+    if (missing) return missing;
+
+    // O Facebook emite um app token com client_credentials: prova direta.
+    const url = `https://graph.facebook.com/oauth/access_token?${new URLSearchParams({
+      client_id: str(config, 'client_id'),
+      client_secret: String(config.client_secret ?? ''),
+      grant_type: 'client_credentials',
+    })}`;
+
+    const result = await probeJson(url, {}, ctx.signal);
+
+    if (result.ok && result.body?.access_token) {
+      return pass(`Facebook app ${str(config, 'client_id')}`);
+    }
+    return fail(
+      describeHttpError(result, 'Invalid Facebook App ID or App Secret.'),
+    );
+  },
+};
+
+const githubOAuthTester: IntegrationTester = {
+  providerSlug: 'github-oauth',
+  test: async (config, ctx) => {
+    const missing = requireFields(config, [
+      ['client_id', 'Client ID'],
+      ['client_secret', 'Client secret'],
+    ]);
+    if (missing) return missing;
+
+    const result = await probeJson(
+      'https://github.com/login/oauth/access_token',
+      {
+        method: 'POST',
+        headers: {
+          'Content-Type': 'application/x-www-form-urlencoded',
+          // Sem isso o GitHub responde form-urlencoded.
+          Accept: 'application/json',
+        },
+        body: new URLSearchParams({
+          client_id: str(config, 'client_id'),
+          client_secret: String(config.client_secret ?? ''),
+          code: PROBE_CODE,
+        }).toString(),
+      },
+      ctx.signal,
+    );
+
+    const code = String(result.body?.error ?? '');
+    if (code === 'incorrect_client_credentials') {
+      return fail('Invalid Client ID or Client secret.');
+    }
+    if (code === 'bad_verification_code' || result.body?.access_token) {
+      return pass('GitHub accepted the app credentials');
+    }
+    return fail(describeHttpError(result, 'GitHub rejected the credentials.'));
+  },
+};
+
+/** Microsoft: `client_credentials` no tenant prova as três credenciais de uma vez. */
+function buildMicrosoftTester(providerSlug: string): IntegrationTester {
+  return {
+    providerSlug,
+    test: async (config, ctx) => {
+      const missing = requireFields(config, [
+        ['client_id', 'Client ID'],
+        ['client_secret', 'Client secret'],
+      ]);
+      if (missing) return missing;
+
+      const tenant = str(config, 'tenant_id') || 'common';
+      const result = await probeJson(
+        `https://login.microsoftonline.com/${encodeURIComponent(tenant)}/oauth2/v2.0/token`,
+        {
+          method: 'POST',
+          headers: { 'Content-Type': 'application/x-www-form-urlencoded' },
+          body: new URLSearchParams({
+            client_id: str(config, 'client_id'),
+            client_secret: String(config.client_secret ?? ''),
+            grant_type: 'client_credentials',
+            scope: 'https://graph.microsoft.com/.default',
+          }).toString(),
+        },
+        ctx.signal,
+      );
+
+      if (result.ok && result.body?.access_token) {
+        return pass(`Microsoft tenant ${tenant}`);
+      }
+
+      // Os códigos AADSTS dizem exatamente o que está errado; a mensagem crua da
+      // Microsoft vem com correlation id e URL de ajuda, ruído puro para a UI.
+      //
+      // Casar com fronteira de dígito é obrigatório: um `includes('AADSTS90002')`
+      // simples engoliria AADSTS900023, que significa outra coisa.
+      const description = String(result.body?.error_description ?? '');
+      const hasCode = (code: string) =>
+        new RegExp(`${code}(?!\\d)`).test(description);
+
+      if (hasCode('AADSTS7000215')) {
+        return fail('Invalid client secret.');
+      }
+      if (hasCode('AADSTS7000222')) {
+        return fail('The client secret has expired.');
+      }
+      if (hasCode('AADSTS700016')) {
+        return fail(`Application not found in tenant "${tenant}".`);
+      }
+      // `common` não aceita client_credentials: isso não reprova o app.
+      if (tenant === 'common' && hasCode('AADSTS900023')) {
+        return pass(
+          'Microsoft accepted the app credentials',
+          'Fill in the Tenant ID for a full validation.',
+        );
+      }
+      if (hasCode('AADSTS90002')) {
+        return fail(`Tenant "${tenant}" does not exist.`);
+      }
+      return fail(
+        describeHttpError(result, 'Microsoft rejected the credentials.').slice(0, 200),
+      );
+    },
+  };
+}
+
+const appleOAuthTester: IntegrationTester = {
+  providerSlug: 'apple-oauth',
+  test: async (config, ctx) => {
+    const missing = requireFields(config, [
+      ['client_id', 'Service ID'],
+      ['team_id', 'Team ID'],
+      ['key_id', 'Key ID'],
+      ['private_key', 'Private key (.p8)'],
+    ]);
+    if (missing) return missing;
+
+    // A Apple não tem client_secret estático: ele é um JWT ES256 assinado com a .p8.
+    // Se a chave não assina, o problema é local e nem precisamos ir à rede.
+    let clientSecret: string;
+    try {
+      const now = Math.floor(Date.now() / 1000);
+      clientSecret = jwt.sign(
+        {
+          iss: str(config, 'team_id'),
+          iat: now,
+          exp: now + 300,
+          aud: 'https://appleid.apple.com',
+          sub: str(config, 'client_id'),
+        },
+        String(config.private_key ?? ''),
+        { algorithm: 'ES256', keyid: str(config, 'key_id') },
+      );
+    } catch {
+      return fail(
+        'Could not sign with the private key. Check the .p8 contents, the Key ID and the Team ID.',
+      );
+    }
+
+    const result = await probeJson(
+      'https://appleid.apple.com/auth/token',
+      {
+        method: 'POST',
+        headers: { 'Content-Type': 'application/x-www-form-urlencoded' },
+        body: new URLSearchParams({
+          client_id: str(config, 'client_id'),
+          client_secret: clientSecret,
+          code: PROBE_CODE,
+          grant_type: 'authorization_code',
+        }).toString(),
+      },
+      ctx.signal,
+    );
+
+    const code = String(result.body?.error ?? '');
+    if (code === 'invalid_client') {
+      return fail(
+        'Apple rejected the credentials. Check the Service ID, Team ID, Key ID and the .p8 key.',
+      );
+    }
+    if (code === 'invalid_grant' || result.ok) {
+      return pass('Apple accepted the signed client secret');
+    }
+    return fail(describeHttpError(result, 'Apple rejected the credentials.'));
+  },
+};
+
+const linkedinOAuthTester: IntegrationTester = {
+  providerSlug: 'linkedin-oauth',
+  test: async (config, ctx) => {
+    const missing = requireFields(config, [
+      ['client_id', 'Client ID'],
+      ['client_secret', 'Client secret'],
+    ]);
+    if (missing) return missing;
+
+    const result = await probeJson(
+      'https://www.linkedin.com/oauth/v2/accessToken',
+      {
+        method: 'POST',
+        headers: { 'Content-Type': 'application/x-www-form-urlencoded' },
+        body: new URLSearchParams({
+          client_id: str(config, 'client_id'),
+          client_secret: String(config.client_secret ?? ''),
+          code: PROBE_CODE,
+          grant_type: 'authorization_code',
+          redirect_uri: 'https://localhost/hedhog-connection-test',
+        }).toString(),
+      },
+      ctx.signal,
+    );
+
+    const code = String(result.body?.error ?? '');
+    const description = String(result.body?.error_description ?? '');
+    if (code === 'invalid_client' || /client.*(id|secret)/i.test(description)) {
+      return fail('Invalid Client ID or Client secret.');
+    }
+    if (
+      result.ok ||
+      /authorization code/i.test(description) ||
+      code === 'invalid_request'
+    ) {
+      return pass('LinkedIn accepted the app credentials');
+    }
+    return fail(describeHttpError(result, 'LinkedIn rejected the credentials.'));
+  },
+};
+
+export const OAUTH_TESTERS: IntegrationTester[] = [
+  googleOAuthTester,
+  facebookOAuthTester,
+  githubOAuthTester,
+  buildMicrosoftTester('microsoft-oauth'),
+  buildMicrosoftTester('microsoft-entra-id-oauth'),
+  appleOAuthTester,
+  linkedinOAuthTester,
+];

package/src/integration-profile/testers/payment.testers.ts

@@ -0,0 +1,185 @@
+import * as jwt from 'jsonwebtoken';
+import {
+  describeHttpError,
+  fail,
+  pass,
+  probeJson,
+  requireFields,
+  str,
+} from './http-probe';
+import { IntegrationTester } from './integration-tester.types';
+
+/**
+ * Testadores dos gateways de pagamento.
+ *
+ * Todos usam leitura da conta — nunca criam cobrança, assinatura ou qualquer coisa
+ * que apareça no extrato do cliente.
+ */
+
+const stripeTester: IntegrationTester = {
+  providerSlug: 'stripe',
+  test: async (config, ctx) => {
+    const missing = requireFields(config, [['secret_key', 'Secret key']]);
+    if (missing) return missing;
+
+    const secretKey = String(config.secret_key ?? '');
+    const result = await probeJson(
+      'https://api.stripe.com/v1/balance',
+      {
+        headers: {
+          // Stripe usa Basic com a chave como usuário e senha vazia.
+          Authorization: `Basic ${Buffer.from(`${secretKey}:`).toString('base64')}`,
+        },
+      },
+      ctx.signal,
+    );
+
+    if (result.status === 401) return fail('Invalid Stripe secret key.');
+    if (!result.ok) {
+      return fail(describeHttpError(result, 'Stripe rejected the credentials.'));
+    }
+
+    // Chave de teste num perfil de produção é o erro clássico — e só aparece quando
+    // a primeira cobrança real não acontece.
+    const livemode = Boolean(result.body?.livemode);
+    const mode = str(config, 'mode').toLowerCase();
+    const label = `Stripe — ${livemode ? 'live' : 'test'} mode`;
+
+    if (mode === 'production' && !livemode) {
+      return pass(label, 'This profile is set to production but the key is a test key.');
+    }
+    if (mode === 'sandbox' && livemode) {
+      return pass(label, 'This profile is set to sandbox but the key is a live key.');
+    }
+    return pass(label);
+  },
+};
+
+const mercadoPagoTester: IntegrationTester = {
+  providerSlug: 'mercado_pago',
+  test: async (config, ctx) => {
+    const missing = requireFields(config, [['access_token', 'Access token']]);
+    if (missing) return missing;
+
+    const result = await probeJson(
+      'https://api.mercadopago.com/users/me',
+      { headers: { Authorization: `Bearer ${String(config.access_token ?? '')}` } },
+      ctx.signal,
+    );
+
+    if (result.status === 401 || result.status === 403) {
+      return fail('Invalid Mercado Pago access token.');
+    }
+    if (!result.ok) {
+      return fail(describeHttpError(result, 'Mercado Pago rejected the credentials.'));
+    }
+
+    const nickname = String(result.body?.nickname ?? '').trim();
+    const siteId = String(result.body?.site_id ?? '').trim();
+    return pass(
+      [nickname, siteId].filter(Boolean).join(' — ') || 'Mercado Pago account',
+    );
+  },
+};
+
+const googlePlayTester: IntegrationTester = {
+  providerSlug: 'google_play',
+  test: async (config, ctx) => {
+    const missing = requireFields(config, [['package_name', 'Package name']]);
+    if (missing) return missing;
+
+    // O serviço aceita o JSON completo OU client_email + private_key avulsos.
+    let clientEmail = str(config, 'client_email');
+    let privateKey = String(config.private_key ?? '');
+
+    const serviceAccountJson = String(config.service_account_json ?? '').trim();
+    if (serviceAccountJson) {
+      try {
+        const parsed = JSON.parse(serviceAccountJson);
+        clientEmail = String(parsed.client_email ?? clientEmail);
+        privateKey = String(parsed.private_key ?? privateKey);
+      } catch {
+        return fail('The service account JSON is not valid JSON.');
+      }
+    }
+
+    if (!clientEmail || !privateKey) {
+      return fail(
+        'Provide the service account JSON, or the client email and private key.',
+      );
+    }
+
+    // JWT bearer flow: a troca por access token já prova a chave da service account.
+    let assertion: string;
+    try {
+      const now = Math.floor(Date.now() / 1000);
+      assertion = jwt.sign(
+        {
+          iss: clientEmail,
+          scope: 'https://www.googleapis.com/auth/androidpublisher',
+          aud: 'https://oauth2.googleapis.com/token',
+          iat: now,
+          exp: now + 300,
+        },
+        privateKey.replace(/\\n/g, '\n'),
+        { algorithm: 'RS256' },
+      );
+    } catch {
+      return fail('Could not sign with the service account private key.');
+    }
+
+    const token = await probeJson(
+      'https://oauth2.googleapis.com/token',
+      {
+        method: 'POST',
+        headers: { 'Content-Type': 'application/x-www-form-urlencoded' },
+        body: new URLSearchParams({
+          grant_type: 'urn:ietf:params:oauth:grant-type:jwt-bearer',
+          assertion,
+        }).toString(),
+      },
+      ctx.signal,
+    );
+
+    if (!token.ok || !token.body?.access_token) {
+      const description = String(token.body?.error_description ?? '');
+      if (/invalid_grant|Invalid JWT/i.test(description)) {
+        return fail(
+          'Google rejected the service account. Check the client email and the private key.',
+        );
+      }
+      return fail(describeHttpError(token, 'Google rejected the service account.'));
+    }
+
+    const packageName = str(config, 'package_name');
+    const app = await probeJson(
+      `https://androidpublisher.googleapis.com/androidpublisher/v3/applications/${encodeURIComponent(
+        packageName,
+      )}/inappproducts?maxResults=1`,
+      { headers: { Authorization: `Bearer ${token.body.access_token}` } },
+      ctx.signal,
+    );
+
+    // Credencial válida; o vínculo com o app no Play Console é outra configuração,
+    // feita no console e não aqui.
+    if (app.status === 401 || app.status === 403) {
+      return pass(
+        `Service account ${clientEmail}`,
+        `The service account has no access to "${packageName}" in the Play Console yet.`,
+      );
+    }
+    if (app.status === 404) {
+      return pass(
+        `Service account ${clientEmail}`,
+        `The app "${packageName}" was not found in this account.`,
+      );
+    }
+    return pass(`${packageName} — ${clientEmail}`);
+  },
+};
+
+export const PAYMENT_TESTERS: IntegrationTester[] = [
+  stripeTester,
+  mercadoPagoTester,
+  googlePlayTester,
+];