@hed-hog/core 0.0.387 → 0.0.393

package/src/integration-profile/testers/oauth.testers.spec.ts

@@ -0,0 +1,220 @@
+import { afterEach, beforeEach, describe, expect, it, jest } from '@jest/globals';
+import { OAUTH_TESTERS } from './oauth.testers';
+import { IntegrationTestContext, IntegrationTester } from './integration-tester.types';
+
+const bySlug = (slug: string): IntegrationTester =>
+  OAUTH_TESTERS.find((tester) => tester.providerSlug === slug)!;
+
+const ctx = (): IntegrationTestContext => ({
+  signal: AbortSignal.timeout(5_000),
+  typeSlug: 'oauth',
+  providerSlug: 'test',
+  secretValues: [],
+});
+
+/** Resposta JSON crua, como `probeJson` a consome (via response.text()). */
+function jsonResponse(body: unknown, status = 200) {
+  return {
+    ok: status >= 200 && status < 300,
+    status,
+    text: async () => JSON.stringify(body),
+  } as unknown as Response;
+}
+
+let fetchMock: jest.Mock;
+
+beforeEach(() => {
+  fetchMock = jest.fn();
+  global.fetch = fetchMock as unknown as typeof fetch;
+});
+
+afterEach(() => {
+  jest.restoreAllMocks();
+});
+
+describe('google-oauth tester', () => {
+  const tester = bySlug('google-oauth');
+
+  it('aprova quando o Google recusa apenas o código de teste (invalid_grant)', async () => {
+    fetchMock.mockResolvedValue(jsonResponse({ error: 'invalid_grant' }, 400));
+
+    const outcome = await tester.test(
+      { client_id: 'id', client_secret: 'secret' },
+      ctx(),
+    );
+
+    expect(outcome.ok).toBe(true);
+  });
+
+  it('reprova quando o Google recusa as credenciais do app (invalid_client)', async () => {
+    fetchMock.mockResolvedValue(jsonResponse({ error: 'invalid_client' }, 401));
+
+    const outcome = await tester.test(
+      { client_id: 'id', client_secret: 'wrong' },
+      ctx(),
+    );
+
+    expect(outcome).toEqual({
+      ok: false,
+      error: 'Invalid Client ID or Client secret.',
+    });
+  });
+
+  it('reprova sem ir à rede quando falta uma credencial', async () => {
+    const outcome = await tester.test({ client_id: 'id' }, ctx());
+
+    expect(outcome.ok).toBe(false);
+    expect(outcome.error).toBe('Client secret is required.');
+    expect(fetchMock).not.toHaveBeenCalled();
+  });
+});
+
+describe('github-oauth tester', () => {
+  const tester = bySlug('github-oauth');
+
+  it('aprova em bad_verification_code e reprova em incorrect_client_credentials', async () => {
+    fetchMock.mockResolvedValueOnce(
+      jsonResponse({ error: 'bad_verification_code' }),
+    );
+    await expect(
+      tester.test({ client_id: 'a', client_secret: 'b' }, ctx()),
+    ).resolves.toMatchObject({ ok: true });
+
+    fetchMock.mockResolvedValueOnce(
+      jsonResponse({ error: 'incorrect_client_credentials' }),
+    );
+    await expect(
+      tester.test({ client_id: 'a', client_secret: 'b' }, ctx()),
+    ).resolves.toMatchObject({ ok: false });
+  });
+});
+
+describe('facebook-oauth tester', () => {
+  const tester = bySlug('facebook-oauth');
+
+  it('aprova quando recebe um app token real', async () => {
+    fetchMock.mockResolvedValue(jsonResponse({ access_token: 'app-token' }));
+
+    await expect(
+      tester.test({ client_id: 'a', client_secret: 'b' }, ctx()),
+    ).resolves.toMatchObject({ ok: true });
+  });
+
+  it('reprova quando a Meta rejeita', async () => {
+    fetchMock.mockResolvedValue(
+      jsonResponse({ error: { message: 'Invalid appsecret' } }, 400),
+    );
+
+    await expect(
+      tester.test({ client_id: 'a', client_secret: 'b' }, ctx()),
+    ).resolves.toMatchObject({ ok: false, error: 'Invalid appsecret' });
+  });
+});
+
+describe('microsoft-oauth tester', () => {
+  const tester = bySlug('microsoft-oauth');
+
+  it('aprova quando o client_credentials devolve token', async () => {
+    fetchMock.mockResolvedValue(jsonResponse({ access_token: 'token' }));
+
+    const outcome = await tester.test(
+      { client_id: 'a', client_secret: 'b', tenant_id: 'contoso' },
+      ctx(),
+    );
+
+    expect(outcome.ok).toBe(true);
+    expect(outcome.info).toContain('contoso');
+  });
+
+  it.each([
+    ['AADSTS7000215', 'Invalid client secret.'],
+    ['AADSTS700016', 'Application not found in tenant "contoso".'],
+    ['AADSTS90002', 'Tenant "contoso" does not exist.'],
+    ['AADSTS7000222', 'The client secret has expired.'],
+  ])('traduz %s numa mensagem acionável', async (code, expected) => {
+    fetchMock.mockResolvedValue(
+      jsonResponse(
+        {
+          error: 'invalid_client',
+          error_description: `${code}: long Microsoft blurb with correlation id and a help URL`,
+        },
+        401,
+      ),
+    );
+
+    const outcome = await tester.test(
+      { client_id: 'a', client_secret: 'b', tenant_id: 'contoso' },
+      ctx(),
+    );
+
+    expect(outcome).toEqual({ ok: false, error: expected });
+  });
+
+  it('sem tenant_id, não reprova o app quando o endpoint "common" recusa client_credentials', async () => {
+    fetchMock.mockResolvedValue(
+      jsonResponse(
+        { error_description: 'AADSTS900023: tenant common is not supported' },
+        400,
+      ),
+    );
+
+    const outcome = await tester.test({ client_id: 'a', client_secret: 'b' }, ctx());
+
+    expect(outcome.ok).toBe(true);
+    expect(outcome.warning).toContain('Tenant ID');
+  });
+
+  it('está registrado também para microsoft-entra-id-oauth', () => {
+    expect(bySlug('microsoft-entra-id-oauth')).toBeDefined();
+  });
+});
+
+describe('apple-oauth tester', () => {
+  const tester = bySlug('apple-oauth');
+
+  it('reprova sem ir à rede quando a chave .p8 não assina', async () => {
+    const outcome = await tester.test(
+      {
+        client_id: 'com.acme.service',
+        team_id: 'TEAM123',
+        key_id: 'KEY123',
+        private_key: 'não é uma chave EC válida',
+      },
+      ctx(),
+    );
+
+    expect(outcome.ok).toBe(false);
+    expect(outcome.error).toContain('Could not sign with the private key');
+    expect(fetchMock).not.toHaveBeenCalled();
+  });
+});
+
+describe('linkedin-oauth tester', () => {
+  const tester = bySlug('linkedin-oauth');
+
+  it('aprova quando o LinkedIn só reclama do código', async () => {
+    fetchMock.mockResolvedValue(
+      jsonResponse(
+        { error: 'invalid_request', error_description: 'Bad authorization code' },
+        400,
+      ),
+    );
+
+    await expect(
+      tester.test({ client_id: 'a', client_secret: 'b' }, ctx()),
+    ).resolves.toMatchObject({ ok: true });
+  });
+
+  it('reprova quando o LinkedIn reclama do client', async () => {
+    fetchMock.mockResolvedValue(
+      jsonResponse(
+        { error: 'invalid_client', error_description: 'Client authentication failed' },
+        401,
+      ),
+    );
+
+    await expect(
+      tester.test({ client_id: 'a', client_secret: 'b' }, ctx()),
+    ).resolves.toMatchObject({ ok: false });
+  });
+});

package/src/integration-profile/testers/oauth.testers.ts

@@ -0,0 +1,305 @@
+import * as jwt from 'jsonwebtoken';
+import {
+  describeHttpError,
+  fail,
+  pass,
+  probeJson,
+  requireFields,
+  str,
+} from './http-probe';
+import { IntegrationTester } from './integration-tester.types';
+
+/**
+ * Testadores dos providers de OAuth.
+ *
+ * Um login OAuth completo exige um usuário real no navegador, então não dá para
+ * reproduzi-lo aqui. O que dá para provar — e é o que erra na prática — são as
+ * credenciais do aplicativo: mandamos ao endpoint de token um código propositalmente
+ * inválido e lemos QUAL erro volta.
+ *
+ *   invalid_client  → client_id/client_secret errados  → REPROVA
+ *   invalid_grant   → credenciais aceitas, só o código é falso (era o esperado) → APROVA
+ *
+ * Onde o provider suporta `client_credentials` (Facebook, Microsoft), usamos isso:
+ * é uma prova direta, sem inferência.
+ */
+
+/** Código propositalmente inválido usado nas trocas de token. */
+const PROBE_CODE = 'hedhog-connection-test';
+
+const googleOAuthTester: IntegrationTester = {
+  providerSlug: 'google-oauth',
+  test: async (config, ctx) => {
+    const missing = requireFields(config, [
+      ['client_id', 'Client ID'],
+      ['client_secret', 'Client secret'],
+    ]);
+    if (missing) return missing;
+
+    const result = await probeJson(
+      'https://oauth2.googleapis.com/token',
+      {
+        method: 'POST',
+        headers: { 'Content-Type': 'application/x-www-form-urlencoded' },
+        body: new URLSearchParams({
+          client_id: str(config, 'client_id'),
+          client_secret: String(config.client_secret ?? ''),
+          code: PROBE_CODE,
+          grant_type: 'authorization_code',
+          redirect_uri: 'https://localhost/hedhog-connection-test',
+        }).toString(),
+      },
+      ctx.signal,
+    );
+
+    const code = String(result.body?.error ?? '');
+    if (code === 'invalid_client') return fail('Invalid Client ID or Client secret.');
+    if (code === 'invalid_grant' || result.ok) {
+      return pass('Google accepted the app credentials');
+    }
+    return fail(describeHttpError(result, 'Google rejected the credentials.'));
+  },
+};
+
+const facebookOAuthTester: IntegrationTester = {
+  providerSlug: 'facebook-oauth',
+  test: async (config, ctx) => {
+    const missing = requireFields(config, [
+      ['client_id', 'Client ID'],
+      ['client_secret', 'Client secret'],
+    ]);
+    if (missing) return missing;
+
+    // O Facebook emite um app token com client_credentials: prova direta.
+    const url = `https://graph.facebook.com/oauth/access_token?${new URLSearchParams({
+      client_id: str(config, 'client_id'),
+      client_secret: String(config.client_secret ?? ''),
+      grant_type: 'client_credentials',
+    })}`;
+
+    const result = await probeJson(url, {}, ctx.signal);
+
+    if (result.ok && result.body?.access_token) {
+      return pass(`Facebook app ${str(config, 'client_id')}`);
+    }
+    return fail(
+      describeHttpError(result, 'Invalid Facebook App ID or App Secret.'),
+    );
+  },
+};
+
+const githubOAuthTester: IntegrationTester = {
+  providerSlug: 'github-oauth',
+  test: async (config, ctx) => {
+    const missing = requireFields(config, [
+      ['client_id', 'Client ID'],
+      ['client_secret', 'Client secret'],
+    ]);
+    if (missing) return missing;
+
+    const result = await probeJson(
+      'https://github.com/login/oauth/access_token',
+      {
+        method: 'POST',
+        headers: {
+          'Content-Type': 'application/x-www-form-urlencoded',
+          // Sem isso o GitHub responde form-urlencoded.
+          Accept: 'application/json',
+        },
+        body: new URLSearchParams({
+          client_id: str(config, 'client_id'),
+          client_secret: String(config.client_secret ?? ''),
+          code: PROBE_CODE,
+        }).toString(),
+      },
+      ctx.signal,
+    );
+
+    const code = String(result.body?.error ?? '');
+    if (code === 'incorrect_client_credentials') {
+      return fail('Invalid Client ID or Client secret.');
+    }
+    if (code === 'bad_verification_code' || result.body?.access_token) {
+      return pass('GitHub accepted the app credentials');
+    }
+    return fail(describeHttpError(result, 'GitHub rejected the credentials.'));
+  },
+};
+
+/** Microsoft: `client_credentials` no tenant prova as três credenciais de uma vez. */
+function buildMicrosoftTester(providerSlug: string): IntegrationTester {
+  return {
+    providerSlug,
+    test: async (config, ctx) => {
+      const missing = requireFields(config, [
+        ['client_id', 'Client ID'],
+        ['client_secret', 'Client secret'],
+      ]);
+      if (missing) return missing;
+
+      const tenant = str(config, 'tenant_id') || 'common';
+      const result = await probeJson(
+        `https://login.microsoftonline.com/${encodeURIComponent(tenant)}/oauth2/v2.0/token`,
+        {
+          method: 'POST',
+          headers: { 'Content-Type': 'application/x-www-form-urlencoded' },
+          body: new URLSearchParams({
+            client_id: str(config, 'client_id'),
+            client_secret: String(config.client_secret ?? ''),
+            grant_type: 'client_credentials',
+            scope: 'https://graph.microsoft.com/.default',
+          }).toString(),
+        },
+        ctx.signal,
+      );
+
+      if (result.ok && result.body?.access_token) {
+        return pass(`Microsoft tenant ${tenant}`);
+      }
+
+      // Os códigos AADSTS dizem exatamente o que está errado; a mensagem crua da
+      // Microsoft vem com correlation id e URL de ajuda, ruído puro para a UI.
+      //
+      // Casar com fronteira de dígito é obrigatório: um `includes('AADSTS90002')`
+      // simples engoliria AADSTS900023, que significa outra coisa.
+      const description = String(result.body?.error_description ?? '');
+      const hasCode = (code: string) =>
+        new RegExp(`${code}(?!\\d)`).test(description);
+
+      if (hasCode('AADSTS7000215')) {
+        return fail('Invalid client secret.');
+      }
+      if (hasCode('AADSTS7000222')) {
+        return fail('The client secret has expired.');
+      }
+      if (hasCode('AADSTS700016')) {
+        return fail(`Application not found in tenant "${tenant}".`);
+      }
+      // `common` não aceita client_credentials: isso não reprova o app.
+      if (tenant === 'common' && hasCode('AADSTS900023')) {
+        return pass(
+          'Microsoft accepted the app credentials',
+          'Fill in the Tenant ID for a full validation.',
+        );
+      }
+      if (hasCode('AADSTS90002')) {
+        return fail(`Tenant "${tenant}" does not exist.`);
+      }
+      return fail(
+        describeHttpError(result, 'Microsoft rejected the credentials.').slice(0, 200),
+      );
+    },
+  };
+}
+
+const appleOAuthTester: IntegrationTester = {
+  providerSlug: 'apple-oauth',
+  test: async (config, ctx) => {
+    const missing = requireFields(config, [
+      ['client_id', 'Service ID'],
+      ['team_id', 'Team ID'],
+      ['key_id', 'Key ID'],
+      ['private_key', 'Private key (.p8)'],
+    ]);
+    if (missing) return missing;
+
+    // A Apple não tem client_secret estático: ele é um JWT ES256 assinado com a .p8.
+    // Se a chave não assina, o problema é local e nem precisamos ir à rede.
+    let clientSecret: string;
+    try {
+      const now = Math.floor(Date.now() / 1000);
+      clientSecret = jwt.sign(
+        {
+          iss: str(config, 'team_id'),
+          iat: now,
+          exp: now + 300,
+          aud: 'https://appleid.apple.com',
+          sub: str(config, 'client_id'),
+        },
+        String(config.private_key ?? ''),
+        { algorithm: 'ES256', keyid: str(config, 'key_id') },
+      );
+    } catch {
+      return fail(
+        'Could not sign with the private key. Check the .p8 contents, the Key ID and the Team ID.',
+      );
+    }
+
+    const result = await probeJson(
+      'https://appleid.apple.com/auth/token',
+      {
+        method: 'POST',
+        headers: { 'Content-Type': 'application/x-www-form-urlencoded' },
+        body: new URLSearchParams({
+          client_id: str(config, 'client_id'),
+          client_secret: clientSecret,
+          code: PROBE_CODE,
+          grant_type: 'authorization_code',
+        }).toString(),
+      },
+      ctx.signal,
+    );
+
+    const code = String(result.body?.error ?? '');
+    if (code === 'invalid_client') {
+      return fail(
+        'Apple rejected the credentials. Check the Service ID, Team ID, Key ID and the .p8 key.',
+      );
+    }
+    if (code === 'invalid_grant' || result.ok) {
+      return pass('Apple accepted the signed client secret');
+    }
+    return fail(describeHttpError(result, 'Apple rejected the credentials.'));
+  },
+};
+
+const linkedinOAuthTester: IntegrationTester = {
+  providerSlug: 'linkedin-oauth',
+  test: async (config, ctx) => {
+    const missing = requireFields(config, [
+      ['client_id', 'Client ID'],
+      ['client_secret', 'Client secret'],
+    ]);
+    if (missing) return missing;
+
+    const result = await probeJson(
+      'https://www.linkedin.com/oauth/v2/accessToken',
+      {
+        method: 'POST',
+        headers: { 'Content-Type': 'application/x-www-form-urlencoded' },
+        body: new URLSearchParams({
+          client_id: str(config, 'client_id'),
+          client_secret: String(config.client_secret ?? ''),
+          code: PROBE_CODE,
+          grant_type: 'authorization_code',
+          redirect_uri: 'https://localhost/hedhog-connection-test',
+        }).toString(),
+      },
+      ctx.signal,
+    );
+
+    const code = String(result.body?.error ?? '');
+    const description = String(result.body?.error_description ?? '');
+    if (code === 'invalid_client' || /client.*(id|secret)/i.test(description)) {
+      return fail('Invalid Client ID or Client secret.');
+    }
+    if (
+      result.ok ||
+      /authorization code/i.test(description) ||
+      code === 'invalid_request'
+    ) {
+      return pass('LinkedIn accepted the app credentials');
+    }
+    return fail(describeHttpError(result, 'LinkedIn rejected the credentials.'));
+  },
+};
+
+export const OAUTH_TESTERS: IntegrationTester[] = [
+  googleOAuthTester,
+  facebookOAuthTester,
+  githubOAuthTester,
+  buildMicrosoftTester('microsoft-oauth'),
+  buildMicrosoftTester('microsoft-entra-id-oauth'),
+  appleOAuthTester,
+  linkedinOAuthTester,
+];

package/src/integration-profile/testers/payment.testers.ts

@@ -0,0 +1,185 @@
+import * as jwt from 'jsonwebtoken';
+import {
+  describeHttpError,
+  fail,
+  pass,
+  probeJson,
+  requireFields,
+  str,
+} from './http-probe';
+import { IntegrationTester } from './integration-tester.types';
+
+/**
+ * Testadores dos gateways de pagamento.
+ *
+ * Todos usam leitura da conta — nunca criam cobrança, assinatura ou qualquer coisa
+ * que apareça no extrato do cliente.
+ */
+
+const stripeTester: IntegrationTester = {
+  providerSlug: 'stripe',
+  test: async (config, ctx) => {
+    const missing = requireFields(config, [['secret_key', 'Secret key']]);
+    if (missing) return missing;
+
+    const secretKey = String(config.secret_key ?? '');
+    const result = await probeJson(
+      'https://api.stripe.com/v1/balance',
+      {
+        headers: {
+          // Stripe usa Basic com a chave como usuário e senha vazia.
+          Authorization: `Basic ${Buffer.from(`${secretKey}:`).toString('base64')}`,
+        },
+      },
+      ctx.signal,
+    );
+
+    if (result.status === 401) return fail('Invalid Stripe secret key.');
+    if (!result.ok) {
+      return fail(describeHttpError(result, 'Stripe rejected the credentials.'));
+    }
+
+    // Chave de teste num perfil de produção é o erro clássico — e só aparece quando
+    // a primeira cobrança real não acontece.
+    const livemode = Boolean(result.body?.livemode);
+    const mode = str(config, 'mode').toLowerCase();
+    const label = `Stripe — ${livemode ? 'live' : 'test'} mode`;
+
+    if (mode === 'production' && !livemode) {
+      return pass(label, 'This profile is set to production but the key is a test key.');
+    }
+    if (mode === 'sandbox' && livemode) {
+      return pass(label, 'This profile is set to sandbox but the key is a live key.');
+    }
+    return pass(label);
+  },
+};
+
+const mercadoPagoTester: IntegrationTester = {
+  providerSlug: 'mercado_pago',
+  test: async (config, ctx) => {
+    const missing = requireFields(config, [['access_token', 'Access token']]);
+    if (missing) return missing;
+
+    const result = await probeJson(
+      'https://api.mercadopago.com/users/me',
+      { headers: { Authorization: `Bearer ${String(config.access_token ?? '')}` } },
+      ctx.signal,
+    );
+
+    if (result.status === 401 || result.status === 403) {
+      return fail('Invalid Mercado Pago access token.');
+    }
+    if (!result.ok) {
+      return fail(describeHttpError(result, 'Mercado Pago rejected the credentials.'));
+    }
+
+    const nickname = String(result.body?.nickname ?? '').trim();
+    const siteId = String(result.body?.site_id ?? '').trim();
+    return pass(
+      [nickname, siteId].filter(Boolean).join(' — ') || 'Mercado Pago account',
+    );
+  },
+};
+
+const googlePlayTester: IntegrationTester = {
+  providerSlug: 'google_play',
+  test: async (config, ctx) => {
+    const missing = requireFields(config, [['package_name', 'Package name']]);
+    if (missing) return missing;
+
+    // O serviço aceita o JSON completo OU client_email + private_key avulsos.
+    let clientEmail = str(config, 'client_email');
+    let privateKey = String(config.private_key ?? '');
+
+    const serviceAccountJson = String(config.service_account_json ?? '').trim();
+    if (serviceAccountJson) {
+      try {
+        const parsed = JSON.parse(serviceAccountJson);
+        clientEmail = String(parsed.client_email ?? clientEmail);
+        privateKey = String(parsed.private_key ?? privateKey);
+      } catch {
+        return fail('The service account JSON is not valid JSON.');
+      }
+    }
+
+    if (!clientEmail || !privateKey) {
+      return fail(
+        'Provide the service account JSON, or the client email and private key.',
+      );
+    }
+
+    // JWT bearer flow: a troca por access token já prova a chave da service account.
+    let assertion: string;
+    try {
+      const now = Math.floor(Date.now() / 1000);
+      assertion = jwt.sign(
+        {
+          iss: clientEmail,
+          scope: 'https://www.googleapis.com/auth/androidpublisher',
+          aud: 'https://oauth2.googleapis.com/token',
+          iat: now,
+          exp: now + 300,
+        },
+        privateKey.replace(/\\n/g, '\n'),
+        { algorithm: 'RS256' },
+      );
+    } catch {
+      return fail('Could not sign with the service account private key.');
+    }
+
+    const token = await probeJson(
+      'https://oauth2.googleapis.com/token',
+      {
+        method: 'POST',
+        headers: { 'Content-Type': 'application/x-www-form-urlencoded' },
+        body: new URLSearchParams({
+          grant_type: 'urn:ietf:params:oauth:grant-type:jwt-bearer',
+          assertion,
+        }).toString(),
+      },
+      ctx.signal,
+    );
+
+    if (!token.ok || !token.body?.access_token) {
+      const description = String(token.body?.error_description ?? '');
+      if (/invalid_grant|Invalid JWT/i.test(description)) {
+        return fail(
+          'Google rejected the service account. Check the client email and the private key.',
+        );
+      }
+      return fail(describeHttpError(token, 'Google rejected the service account.'));
+    }
+
+    const packageName = str(config, 'package_name');
+    const app = await probeJson(
+      `https://androidpublisher.googleapis.com/androidpublisher/v3/applications/${encodeURIComponent(
+        packageName,
+      )}/inappproducts?maxResults=1`,
+      { headers: { Authorization: `Bearer ${token.body.access_token}` } },
+      ctx.signal,
+    );
+
+    // Credencial válida; o vínculo com o app no Play Console é outra configuração,
+    // feita no console e não aqui.
+    if (app.status === 401 || app.status === 403) {
+      return pass(
+        `Service account ${clientEmail}`,
+        `The service account has no access to "${packageName}" in the Play Console yet.`,
+      );
+    }
+    if (app.status === 404) {
+      return pass(
+        `Service account ${clientEmail}`,
+        `The app "${packageName}" was not found in this account.`,
+      );
+    }
+    return pass(`${packageName} — ${clientEmail}`);
+  },
+};
+
+export const PAYMENT_TESTERS: IntegrationTester[] = [
+  stripeTester,
+  mercadoPagoTester,
+  googlePlayTester,
+];