@hed-hog/core 0.0.387 → 0.0.390

package/src/presence/presence.service.spec.ts

@@ -0,0 +1,97 @@
+import { beforeEach, describe, expect, it, jest } from '@jest/globals';
+import { PresenceService } from './presence.service';
+
+const makeDeps = () => ({
+  prisma: { user_presence: { findMany: jest.fn(), upsert: jest.fn() } },
+  setting: { getSettingValues: jest.fn() },
+  realtime: { emitToChannel: jest.fn() },
+});
+
+const makeService = (deps = makeDeps()) => ({
+  service: new PresenceService(
+    deps.prisma as any,
+    deps.setting as any,
+    deps.realtime as any,
+  ),
+  deps,
+});
+
+const minutesAgo = (m: number) => new Date(Date.now() - m * 60 * 1000);
+const secondsAgo = (s: number) => new Date(Date.now() - s * 1000);
+
+describe('PresenceService.getStatuses', () => {
+  let deps: ReturnType<typeof makeDeps>;
+  let service: PresenceService;
+
+  beforeEach(() => {
+    const built = makeService();
+    deps = built.deps;
+    service = built.service;
+    // Teams enabled by default.
+    deps.setting.getSettingValues.mockResolvedValue({
+      'oauth-microsoft-entra-id-enabled': 'true',
+    } as any);
+  });
+
+  it('marks a user online from a recent app heartbeat', async () => {
+    deps.prisma.user_presence.findMany.mockResolvedValue([
+      { user_id: 1, last_heartbeat_at: secondsAgo(10), teams_availability: null, teams_updated_at: null },
+    ] as any);
+
+    const map = await service.getStatuses([1]);
+    expect(map[1]).toMatchObject({ online: true, appOnline: true, teamsOnline: false, source: 'app' });
+  });
+
+  it('marks a user online from a fresh Teams "Available" presence', async () => {
+    deps.prisma.user_presence.findMany.mockResolvedValue([
+      { user_id: 2, last_heartbeat_at: minutesAgo(30), teams_availability: 'Available', teams_updated_at: minutesAgo(1) },
+    ] as any);
+
+    const map = await service.getStatuses([2]);
+    expect(map[2]).toMatchObject({ online: true, appOnline: false, teamsOnline: true, source: 'teams' });
+    expect(map[2].teamsAvailability).toBe('Available');
+  });
+
+  it('reports source "both" when app + Teams are online', async () => {
+    deps.prisma.user_presence.findMany.mockResolvedValue([
+      { user_id: 3, last_heartbeat_at: secondsAgo(5), teams_availability: 'Busy', teams_updated_at: secondsAgo(30) },
+    ] as any);
+
+    const map = await service.getStatuses([3]);
+    expect(map[3]).toMatchObject({ online: true, source: 'both' });
+  });
+
+  it('ignores Teams presence when the integration is disabled', async () => {
+    deps.setting.getSettingValues.mockResolvedValue({ 'oauth-microsoft-entra-id-enabled': 'false' } as any);
+    deps.prisma.user_presence.findMany.mockResolvedValue([
+      { user_id: 4, last_heartbeat_at: minutesAgo(30), teams_availability: 'Available', teams_updated_at: minutesAgo(1) },
+    ] as any);
+
+    const map = await service.getStatuses([4]);
+    expect(map[4]).toMatchObject({ online: false, teamsOnline: false, source: 'offline' });
+    expect(map[4].teamsAvailability).toBeNull();
+  });
+
+  it('ignores a stale Teams presence and an Offline availability', async () => {
+    deps.prisma.user_presence.findMany.mockResolvedValue([
+      { user_id: 5, last_heartbeat_at: minutesAgo(30), teams_availability: 'Available', teams_updated_at: minutesAgo(90) },
+      { user_id: 6, last_heartbeat_at: minutesAgo(30), teams_availability: 'Offline', teams_updated_at: minutesAgo(1) },
+    ] as any);
+
+    const map = await service.getStatuses([5, 6]);
+    expect(map[5].online).toBe(false); // stale teams
+    expect(map[6].online).toBe(false); // offline availability
+  });
+
+  it('treats unknown users as offline', async () => {
+    deps.prisma.user_presence.findMany.mockResolvedValue([] as any);
+    const map = await service.getStatuses([7]);
+    expect(map[7]).toMatchObject({ online: false, source: 'offline' });
+  });
+
+  it('returns empty without querying for an empty id list', async () => {
+    const map = await service.getStatuses([]);
+    expect(map).toEqual({});
+    expect(deps.prisma.user_presence.findMany).not.toHaveBeenCalled();
+  });
+});

package/src/presence/presence.service.ts

@@ -0,0 +1,160 @@
+import { PrismaService } from '@hed-hog/api-prisma';
+import { forwardRef, Inject, Injectable } from '@nestjs/common';
+import { RealtimeService } from '../realtime/realtime.service';
+import { SettingService } from '../setting/setting.service';
+
+/** A heartbeat within this window counts the user as "online in the app". */
+const APP_WINDOW_MS = 60 * 1000;
+/** Ignore a Teams presence older than this (e.g. subscription lapsed). */
+const TEAMS_STALE_MS = 30 * 60 * 1000;
+/** Teams availabilities that do NOT count as present. */
+const TEAMS_OFFLINE = new Set(['Offline', 'PresenceUnknown', 'OutOfOffice']);
+
+export type PresenceSource = 'app' | 'teams' | 'both' | 'offline';
+
+export interface PresenceStatus {
+  userId: number;
+  /** Combined online = app heartbeat OR (Teams enabled AND Teams present). */
+  online: boolean;
+  appOnline: boolean;
+  teamsOnline: boolean;
+  /** Raw Teams availability (Available/Busy/Away/...), when known. */
+  teamsAvailability: string | null;
+  source: PresenceSource;
+}
+
+/**
+ * Unified user presence: the real-time app signal (a browser heartbeat) merged
+ * with Microsoft Teams presence. Teams only contributes when the Entra ID /
+ * Teams integration is enabled — so a user shows online if they're actively
+ * using this app OR are present in Teams.
+ *
+ * App presence is heartbeat-based (the browser pings while the tab is open), not
+ * activity-log-based, so it reflects "has the app open now", and it is shared
+ * across API instances via the `user_presence` table.
+ */
+@Injectable()
+export class PresenceService {
+  constructor(
+    @Inject(forwardRef(() => PrismaService))
+    private readonly prisma: PrismaService,
+    @Inject(forwardRef(() => SettingService))
+    private readonly setting: SettingService,
+    @Inject(forwardRef(() => RealtimeService))
+    private readonly realtime: RealtimeService,
+  ) {}
+
+  /** Channel clients subscribe to for a given user's presence. */
+  static presenceChannel(userId: number): string {
+    return `presence:${userId}`;
+  }
+
+  /** Computes and pushes the current presence of a user to its subscribers. */
+  async pushStatus(userId: number): Promise<void> {
+    if (!userId) return;
+    const statuses = await this.getStatuses([userId]);
+    this.realtime.emitToChannel(
+      PresenceService.presenceChannel(userId),
+      'presence:update',
+      statuses[userId],
+    );
+  }
+
+  /** Records an app heartbeat for the user (browser is open/active). */
+  async heartbeat(userId: number): Promise<void> {
+    if (!userId) return;
+    const now = new Date();
+    await this.prisma.user_presence.upsert({
+      where: { user_id: userId },
+      create: { user_id: userId, last_heartbeat_at: now },
+      update: { last_heartbeat_at: now },
+    });
+  }
+
+  /** Stores the latest Microsoft Teams presence (called by the Graph processor). */
+  async setTeamsPresence(
+    userId: number,
+    availability: string | null,
+    activity: string | null,
+  ): Promise<void> {
+    if (!userId) return;
+    const now = new Date();
+    await this.prisma.user_presence.upsert({
+      where: { user_id: userId },
+      create: {
+        user_id: userId,
+        teams_availability: availability,
+        teams_activity: activity,
+        teams_updated_at: now,
+      },
+      update: {
+        teams_availability: availability,
+        teams_activity: activity,
+        teams_updated_at: now,
+      },
+    });
+    // Teams presence changed → push to subscribers in real time.
+    await this.pushStatus(userId);
+  }
+
+  private async isTeamsEnabled(): Promise<boolean> {
+    const settings = await this.setting.getSettingValues([
+      'oauth-microsoft-entra-id-enabled',
+    ]);
+    const v = settings['oauth-microsoft-entra-id-enabled'];
+    return v === true || v === 'true';
+  }
+
+  /** Resolves the combined presence for a set of users. */
+  async getStatuses(
+    userIds: number[],
+  ): Promise<Record<number, PresenceStatus>> {
+    const ids = [...new Set(userIds.filter((id) => Number.isInteger(id) && id > 0))];
+    const result: Record<number, PresenceStatus> = {};
+    if (ids.length === 0) return result;
+
+    const [rows, teamsEnabled] = await Promise.all([
+      this.prisma.user_presence.findMany({ where: { user_id: { in: ids } } }),
+      this.isTeamsEnabled(),
+    ]);
+    const byUser = new Map(rows.map((r) => [r.user_id, r]));
+    const now = Date.now();
+
+    for (const userId of ids) {
+      const row = byUser.get(userId);
+      const appOnline =
+        !!row?.last_heartbeat_at &&
+        now - row.last_heartbeat_at.getTime() < APP_WINDOW_MS;
+
+      const teamsFresh =
+        !!row?.teams_updated_at &&
+        now - row.teams_updated_at.getTime() < TEAMS_STALE_MS;
+      const teamsOnline =
+        teamsEnabled &&
+        teamsFresh &&
+        !!row?.teams_availability &&
+        !TEAMS_OFFLINE.has(row.teams_availability);
+
+      const online = appOnline || teamsOnline;
+      const source: PresenceSource =
+        appOnline && teamsOnline
+          ? 'both'
+          : appOnline
+            ? 'app'
+            : teamsOnline
+              ? 'teams'
+              : 'offline';
+
+      result[userId] = {
+        userId,
+        online,
+        appOnline,
+        teamsOnline,
+        teamsAvailability:
+          teamsEnabled && teamsFresh ? (row?.teams_availability ?? null) : null,
+        source,
+      };
+    }
+    return result;
+  }
+}

package/src/profile/dto/delete-account.dto.ts

@@ -0,0 +1,11 @@
+import { IsOptional, IsString } from 'class-validator';
+
+export class DeleteAccountDto {
+  /**
+   * Senha atual. Obrigatória para contas que têm senha; contas criadas
+   * apenas por login social (OAuth) não possuem credencial e podem omitir.
+   */
+  @IsOptional()
+  @IsString()
+  password?: string;
+}

package/src/profile/events/profile-account-deleted.event.ts

@@ -0,0 +1,13 @@
+export const PROFILE_ACCOUNT_DELETED = 'profile.account.deleted';
+
+/**
+ * Emitido depois que o core anonimiza a identidade do usuário.
+ * Cada library reage removendo/anonimizando o que é dela (assinaturas,
+ * progresso, mensagens), sem que o core precise conhecê-las.
+ */
+export class ProfileAccountDeletedEvent {
+  constructor(
+    public readonly userId: number,
+    public readonly deletedAt: Date,
+  ) {}
+}

package/src/profile/profile.controller.ts

@@ -1,4 +1,4 @@
-import { NoRole, User } from '@hed-hog/api';
+import { NoRole, Session, User } from '@hed-hog/api';
 import { Locale } from '@hed-hog/api-locale';
 import { Body, Controller, Delete, Get, Headers, Ip, Param, ParseIntPipe, Post, Put, UploadedFile, UseInterceptors } from '@nestjs/common';
 import { FileInterceptor } from '@nestjs/platform-express';
@@ -8,6 +8,7 @@ import type {
 } from '@simplewebauthn/server';
 import { ChangeEmailDto } from './dto/change-email.dto';
 import { ChangePasswordDto } from './dto/change-password.dto';
+import { DeleteAccountDto } from './dto/delete-account.dto';
 import { EmailVerificationDto } from './dto/email-verification-confirm.dto';
 import { GenerateWebAuthnRegistrationOptionsDto } from './dto/generate-webauthn-registration-options.dto';
 import { RegenerateRecoveryCodesDto } from './dto/regenerate-recovery-codes.dto';
@@ -35,13 +36,13 @@ export class ProfileController {
   }
 
   @Post('mfa/check-verification')
-  async checkMfaBeforeAdd(@User() { id }, @Locale() locale: string) {
-    return this.profileService.checkMfaBeforeAdd(locale, id);
+  async checkMfaBeforeAdd(@User() { id }, @Locale() locale: string, @Headers('origin') origin: string) {
+    return this.profileService.checkMfaBeforeAdd(locale, id, origin);
   }
 
   @Post('mfa/check-verification-remove')
-  async checkMfaBeforeRemove(@User() { id }, @Locale() locale: string) {
-    return this.profileService.checkMfaBeforeRemove(locale, id);
+  async checkMfaBeforeRemove(@User() { id }, @Locale() locale: string, @Headers('origin') origin: string) {
+    return this.profileService.checkMfaBeforeRemove(locale, id, origin);
   }
 
   @Post('mfa/verify-before-add')
@@ -60,13 +61,13 @@ export class ProfileController {
   }
 
   @Post('totp/verify')
-  async verifyMfaTotp(@Locale() locale: string, @User() { id }, @Body() { token, secret, name }: VerifyMfaTotpDto) {
-    return this.profileService.verifyMfaTotp(locale, id, token, secret, name);
+  async verifyMfaTotp(@Locale() locale: string, @User() { id }, @Body() { token, secret, name }: VerifyMfaTotpDto, @Session() sessionId: number) {
+    return this.profileService.verifyMfaTotp(locale, id, token, secret, name, sessionId);
   }
 
   @Delete('totp/:mfaId/remove')
-  async removeMfaTotp(@Locale() locale: string, @User() { id }, @Param('mfaId', ParseIntPipe) mfaId: number, @Body() { token }: RemoveTotpMfaDto) {
-    return this.profileService.removeMfaTotp(locale, id, mfaId, token);
+  async removeMfaTotp(@Locale() locale: string, @User() { id }, @Param('mfaId', ParseIntPipe) mfaId: number, @Body() { token }: RemoveTotpMfaDto, @Session() sessionId: number) {
+    return this.profileService.removeMfaTotp(locale, id, mfaId, token, sessionId);
   }
 
   @Post('email/verify/confirm')
@@ -75,24 +76,24 @@ export class ProfileController {
   }
 
   @Post('email/verify')
-  sendEmailVerification(@User() {id}, @Body() data: SendEmailVerificationDto, @Locale() locale: string) {
-    return this.profileService.sendEmailVerification(locale, id, data);
+  sendEmailVerification(@User() {id}, @Body() data: SendEmailVerificationDto, @Locale() locale: string, @Headers('origin') origin: string) {
+    return this.profileService.sendEmailVerification(locale, id, data, origin);
   }
 
   @Post('mfa/email/verify')
-  sendEmailVerificationMfa(@User() {id}, @Body() data: SendEmailVerificationDto, @Locale() locale: string) {
-    return this.profileService.sendEmailVerificationMfa(locale, id, data);
+  sendEmailVerificationMfa(@User() {id}, @Body() data: SendEmailVerificationDto, @Locale() locale: string, @Headers('origin') origin: string) {
+    return this.profileService.sendEmailVerificationMfa(locale, id, data, origin);
   }
 
   @Post('mfa/email/verify/confirm')
-  sendEmailVerificationMfaConfirm(@User() {id}, @Body() data: EmailVerificationDto, @Locale() locale: string) {
-    
-    return this.profileService.confirmEmailVerificationMfa(locale, id, data);
+  sendEmailVerificationMfaConfirm(@User() {id}, @Body() data: EmailVerificationDto, @Locale() locale: string, @Session() sessionId: number) {
+
+    return this.profileService.confirmEmailVerificationMfa(locale, id, data, sessionId);
   }
   
   @Post('email/send-code-to-remove')
-  sendCodeToRemove(@User() {id}, @Locale() locale: string, @Body() { email }: SendEmailVerificationDto) {
-    return this.profileService.sendCodeToRemove(locale, id, email);
+  sendCodeToRemove(@User() {id}, @Locale() locale: string, @Body() { email }: SendEmailVerificationDto, @Headers('origin') origin: string) {
+    return this.profileService.sendCodeToRemove(locale, id, email, origin);
   }
 
   @Get('email')
@@ -101,8 +102,8 @@ export class ProfileController {
   }
 
   @Delete('email/:mfaId/remove')
-  async removeMfaEmail(@Locale() locale: string, @User() { id }, @Param('mfaId', ParseIntPipe) mfaId: number, @Body() { token, hash }: RemoveEmailMfaDto) {
-    return this.profileService.removeMfaEmail(locale, id, mfaId, token, hash);
+  async removeMfaEmail(@Locale() locale: string, @User() { id }, @Param('mfaId', ParseIntPipe) mfaId: number, @Body() { token, hash }: RemoveEmailMfaDto, @Session() sessionId: number) {
+    return this.profileService.removeMfaEmail(locale, id, mfaId, token, hash, sessionId);
   }
 
   @Get()
@@ -125,9 +126,10 @@ export class ProfileController {
     @User() { id },
     @Param('mfaId', ParseIntPipe) mfaId: number,
     @Body() { recoveryCode }: RemoveMfaWithRecoveryCodeDto,
-    @Locale() locale: string
+    @Locale() locale: string,
+    @Session() sessionId: number
   ) {
-    return this.profileService.removeMfaWithRecoveryCode(locale, id, mfaId, recoveryCode);
+    return this.profileService.removeMfaWithRecoveryCode(locale, id, mfaId, recoveryCode, sessionId);
   }
 
   @Delete('mfa/:mfaId/remove')
@@ -136,17 +138,19 @@ export class ProfileController {
     @Param('mfaId', ParseIntPipe) mfaId: number,
     @Body() data: RemoveMfaDto,
     @Locale() locale: string,
-    @Headers('origin') origin: string
+    @Headers('origin') origin: string,
+    @Session() sessionId: number
   ) {
-    return this.profileService.removeMfa(locale, id, mfaId, data, origin);
+    return this.profileService.removeMfa(locale, id, mfaId, data, origin, sessionId);
   }
 
   @Post('recovery-codes/send-verification')
   async sendRecoveryCodesVerification(
     @User() { id },
-    @Locale() locale: string
+    @Locale() locale: string,
+    @Headers('origin') origin: string
   ) {
-    return this.profileService.sendRecoveryCodesVerification(locale, id);
+    return this.profileService.sendRecoveryCodesVerification(locale, id, origin);
   }
 
   @Post('recovery-codes/regenerate')
@@ -201,25 +205,28 @@ export class ProfileController {
   async removeWebAuthnMfa(
     @User() { id },
     @Param('mfaId', ParseIntPipe) mfaId: number,
-    @Locale() locale: string
+    @Body() { assertionResponse }: VerifyWebAuthnDto,
+    @Locale() locale: string,
+    @Headers('origin') origin: string
   ) {
-    return this.profileService.removeWebAuthnMfa(locale, id, mfaId);
+    return this.profileService.removeWebAuthnMfa(locale, id, mfaId, assertionResponse, origin);
   }
 
   @Put('change-password')
   changePassword(
-    @User() {id}, 
-    @Body() body: ChangePasswordDto, 
+    @User() {id},
+    @Body() body: ChangePasswordDto,
     @Locale() locale: string,
     @Ip() ipAddress: string,
-    @Headers('user-agent') userAgent: string
+    @Headers('user-agent') userAgent: string,
+    @Headers('origin') origin: string
   ) {
-    return this.profileService.changePassword(locale, id, body, ipAddress, userAgent);
+    return this.profileService.changePassword(locale, id, body, ipAddress, userAgent, origin);
   }
 
   @Put('change-email')
-  changeEmail(@User() {id}, @Body() body: ChangeEmailDto, @Locale() locale: string) {
-    return this.profileService.changeEmail(locale, id, body);
+  changeEmail(@User() {id}, @Body() body: ChangeEmailDto, @Locale() locale: string, @Headers('origin') origin: string) {
+    return this.profileService.changeEmail(locale, id, body, origin);
   }
 
   @UseInterceptors(FileInterceptor('file'))
@@ -232,4 +239,9 @@ export class ProfileController {
   update(@Body() data: UpdateDto, @User() {id}) {
     return this.profileService.update(id, data);
   }
+
+  @Delete('account')
+  deleteAccount(@User() { id }, @Body() body: DeleteAccountDto, @Locale() locale: string) {
+    return this.profileService.deleteAccount(locale, id, body);
+  }
 }