@hed-hog/core 0.0.387 → 0.0.393

package/dist/auth/auth.service.js

@@ -56,10 +56,13 @@ const security_service_1 = require("../security/security.service");
 const session_service_1 = require("../session/session.service");
 const setting_service_1 = require("../setting/setting.service");
 const token_service_1 = require("../token/token.service");
+const user_device_service_1 = require("../user-device/user-device.service");
+const user_credential_util_1 = require("../user/user-credential.util");
 const user_service_1 = require("../user/user.service");
+const security_event_vars_1 = require("../utils/security-event-vars");
 const webauthn_origin_1 = require("../utils/webauthn-origin");
 let AuthService = AuthService_1 = class AuthService {
-    constructor(prisma, mail, setting, security, token, session, user, challenge) {
+    constructor(prisma, mail, setting, security, token, session, user, challenge, userDevice) {
         this.prisma = prisma;
         this.mail = mail;
         this.setting = setting;
@@ -68,6 +71,7 @@ let AuthService = AuthService_1 = class AuthService {
         this.session = session;
         this.user = user;
         this.challenge = challenge;
+        this.userDevice = userDevice;
         this.logger = new common_1.Logger(AuthService_1.name);
     }
     async getAuthenticationPayload(locale, userId, ipAddress, userAgent, browserId) {
@@ -75,6 +79,15 @@ let AuthService = AuthService_1 = class AuthService {
         const payload = { sub: userId, sessionId: session.id };
         const accessToken = await this.token.createAccessToken(payload);
         await this.prisma.user.update({ where: { id: userId }, data: { last_login_at: new Date() } });
+        // Unico ponto por onde todo caminho de autenticacao passa (senha, MFA,
+        // WebAuthn, recovery code, OAuth, pairing), entao e aqui que o dispositivo
+        // e aprendido. Quem checa `isNewDevice` faz isso antes de chegar aqui.
+        await this.userDevice.remember(userId, { userAgent, browserId, ipAddress });
+        // O idioma e aprendido junto com o dispositivo, e pelo mesmo motivo: e o
+        // unico momento em que o cliente se apresenta. Fica antes do alerta de
+        // dispositivo desconhecido (disparado por quem chamou este metodo), entao o
+        // proprio e-mail do primeiro login ja sai traduzido.
+        await this.persistDetectedLanguage(locale, userId);
         this.logger.debug(`[AuthService] Session created userId=${userId} sessionId=${session.id}`);
         return {
             accessToken,
@@ -82,15 +95,56 @@ let AuthService = AuthService_1 = class AuthService {
             session,
         };
     }
-    async issueDesktopToken(locale, userId, ipAddress, userAgent) {
+    /**
+     * Adota o idioma do cliente como preferencia do usuario - uma unica vez.
+     *
+     * Escrita write-once de proposito: sobrescrever a cada login faria um acesso
+     * de aparelho emprestado, ou de um navegador em outro idioma, apagar a
+     * escolha que o usuario fez na tela de preferencias.
+     *
+     * Nunca lanca. Idioma e acabamento; login que falha por causa dele seria uma
+     * troca pessima.
+     */
+    async persistDetectedLanguage(locale, userId) {
+        try {
+            // `detected` distingue a escolha do cliente do default do middleware.
+            // Sem isso, todo cliente que nao manda `Accept-Language` congelaria `en`.
+            if (!(0, api_locale_1.isLocaleDetectedFromContext)()) {
+                return;
+            }
+            const code = (0, api_locale_1.normalizeLocaleCode)((0, api_locale_1.getLocaleFromContext)());
+            if (!code) {
+                return;
+            }
+            // `setSettingUserValue` valida que a setting aceita override, mas nao o
+            // valor. Sem esta checagem um navegador em `de-DE` gravaria `de`, e todo
+            // e-mail seguinte procuraria um template inexistente.
+            const allowed = await this.setting.getSettingListValues('language');
+            if (allowed.length && !allowed.includes(code)) {
+                return;
+            }
+            if (await this.setting.getUserSettingValue(userId, 'language')) {
+                return;
+            }
+            await this.setting.setSettingUserValue(locale, userId, 'language', code);
+        }
+        catch (error) {
+            this.logger.warn(`[AuthService] Could not persist detected language for userId=${userId}: ${error}`);
+        }
+    }
+    async issueDesktopToken(locale, userId, ipAddress, userAgent, isImpersonating = false) {
+        // Aqui o `userId` vem de @User(), que numa simulacao e o ALVO — sem esta
+        // guarda, o operador cunharia para ele uma sessao completa, RENOVAVEL e de
+        // 30 dias, furando o teto da simulacao e saindo da trilha de auditoria. O
+        // RoleGuard ja bloqueia a rota; isto e a segunda barreira.
+        if (isImpersonating) {
+            throw new common_1.ForbiddenException((0, api_locale_1.getLocaleText)('impersonation.restrictedRoute', locale, 'This action is not available during an access simulation.'));
+        }
         const { accessToken, refreshToken } = await this.getAuthenticationPayload(locale, userId, ipAddress, userAgent);
         return { accessToken, refreshToken };
     }
     hasPendingPasswordReset(user) {
-        var _a;
-        return Boolean((_a = user === null || user === void 0 ? void 0 : user.user_credential) === null || _a === void 0 ? void 0 : _a.some((credential) => credential.type === 'password' &&
-            credential.requires_reset === true &&
-            !credential.revoked_at));
+        return (0, user_credential_util_1.hasPendingPasswordReset)(user);
     }
     async getRequiresPasswordResetByUserId(userId) {
         const credential = await this.prisma.user_credential.findFirst({
@@ -104,7 +158,7 @@ let AuthService = AuthService_1 = class AuthService {
         });
         return Boolean(credential === null || credential === void 0 ? void 0 : credential.id);
     }
-    async requiresMfaForLogin(locale, email, user) {
+    async requiresMfaForLogin(locale, email, user, origin) {
         const settings = await this.setting.getSettingValues([
             'require-mfa',
             'require-email-verification',
@@ -164,7 +218,8 @@ let AuthService = AuthService_1 = class AuthService {
             variables: {
                 code,
                 name: user.name,
-            }
+            },
+            app: await this.challenge.resolveAppKeyFromOrigin(origin),
         });
         return {
             requiresMfa: true,
@@ -174,7 +229,7 @@ let AuthService = AuthService_1 = class AuthService {
             })
         };
     }
-    async requiresEmailVerificationForLogin(locale, email, user) {
+    async requiresEmailVerificationForLogin(locale, email, user, origin) {
         const settings = await this.setting.getSettingValues([
             'require-mfa',
             'require-email-verification',
@@ -210,7 +265,8 @@ let AuthService = AuthService_1 = class AuthService {
             variables: {
                 code,
                 name: user.name,
-            }
+            },
+            app: await this.challenge.resolveAppKeyFromOrigin(origin),
         });
         return {
             requiresEmailVerification: true,
@@ -220,7 +276,7 @@ let AuthService = AuthService_1 = class AuthService {
             })
         };
     }
-    async emailVerificationLoginResend(locale, token) {
+    async emailVerificationLoginResend(locale, token, origin) {
         var _a;
         try {
             const payload = await this.token.verify(locale, token);
@@ -238,7 +294,7 @@ let AuthService = AuthService_1 = class AuthService {
                 throw new common_1.NotFoundException((0, api_locale_1.getLocaleText)('challengeNotFound', locale, 'Challenge not found.'));
             }
             const user = await this.user.findUserById(locale, challenge.user_identifier.user_id);
-            return await this.requiresEmailVerificationForLogin(locale, payload.email, user);
+            return await this.requiresEmailVerificationForLogin(locale, payload.email, user, origin);
         }
         catch (error) {
             if (((_a = error.message) === null || _a === void 0 ? void 0 : _a.includes('jwt expired')) || error.name === 'TokenExpiredError') {
@@ -247,12 +303,12 @@ let AuthService = AuthService_1 = class AuthService {
                     challengeIdentifierId: expiredPayload.challengeIdentifierId,
                     email: expiredPayload.email
                 });
-                return this.emailVerificationLoginResend(locale, newToken);
+                return this.emailVerificationLoginResend(locale, newToken, origin);
             }
             throw error;
         }
     }
-    async emailVerificationLogin(locale, token, code, ipAddress, userAgent, res, browserId) {
+    async emailVerificationLogin(locale, token, code, ipAddress, userAgent, res, browserId, origin) {
         try {
             const payload = await this.token.verify(locale, token);
             const challenge = await this.prisma.user_identifier_challenge.findUnique({
@@ -262,7 +318,10 @@ let AuthService = AuthService_1 = class AuthService {
                     user_identifier_id: true,
                     user_identifier: {
                         select: {
-                            user_id: true
+                            user_id: true,
+                            // Destinatario do alerta de dispositivo novo: o endereco que o
+                            // usuario de fato verificou para entrar.
+                            value: true
                         }
                     }
                 }
@@ -294,13 +353,50 @@ let AuthService = AuthService_1 = class AuthService {
                 });
             });
             const user = await this.user.findUserById(locale, challenge.user_identifier.user_id);
-            return this.login(locale, user, ipAddress, userAgent, res, browserId);
+            return this.login(locale, user, ipAddress, userAgent, res, browserId, origin, challenge.user_identifier.value);
         }
         catch (error) {
             throw error;
         }
     }
-    async login(locale, user, ipAddress, userAgent, res, browserId) {
+    /**
+     * Dispara o alerta de acesso de dispositivo desconhecido.
+     *
+     * O `await` aqui cobre so a resolucao do app (leitura de setting memoizada);
+     * o envio em si continua sem await de proposito, para nao somar a latencia do
+     * SMTP ao tempo de resposta do login.
+     */
+    async sendNewDeviceLoginMail(locale, user, email, ipAddress, userAgent, origin) {
+        var _a;
+        // Tokens de desafio emitidos antes de o `email` passar a ser gravado no
+        // payload chegam aqui sem destinatario; alertar ninguem e melhor do que
+        // deixar o envio explodir dentro do fluxo de login.
+        if (!email) {
+            return;
+        }
+        const app = await this.challenge.resolveAppKeyFromOrigin(origin);
+        // As variaveis sao formatadas aqui (data e nome do pais saem do `Intl`),
+        // entao o idioma do destinatario tem que ser resolvido ANTES do envio -
+        // senao o corpo sai em portugues com a data em ingles.
+        const recipientLocale = await this.mail.resolveRecipientLocale(email, locale);
+        this.mail.sendTemplatedMail(recipientLocale, {
+            email,
+            slug: 'auth-login-new-device',
+            variables: Object.assign({ name: (_a = user === null || user === void 0 ? void 0 : user.name) !== null && _a !== void 0 ? _a : '' }, (0, security_event_vars_1.buildSecurityEventVars)({ ipAddress, userAgent, locale: recipientLocale })),
+            app,
+        });
+    }
+    async login(locale, user, ipAddress, userAgent, res, browserId, origin, loginEmail) {
+        var _a, _b;
+        // Conta excluída pelo próprio usuário: os identificadores já foram
+        // anonimizados, mas a checagem fecha qualquer caminho remanescente.
+        const account = await this.prisma.user.findUnique({
+            where: { id: user.id },
+            select: { deactivated_at: true },
+        });
+        if (account === null || account === void 0 ? void 0 : account.deactivated_at) {
+            throw new common_1.BadRequestException((0, api_locale_1.getLocaleText)('accessDenied', locale, 'Access denied.'));
+        }
         const emails = await this.prisma.user_identifier.findMany({
             where: {
                 user_id: user.id,
@@ -311,18 +407,14 @@ let AuthService = AuthService_1 = class AuthService {
         if (!emails || emails.length === 0) {
             throw new common_1.BadRequestException((0, api_locale_1.getLocaleText)('accessDenied', locale, 'Access denied.'));
         }
+        const newDevice = await this.userDevice.isNewDevice(user.id, userAgent, browserId);
         const { accessToken, refreshToken, session } = await this.getAuthenticationPayload(locale, user.id, ipAddress, userAgent, browserId);
-        for (const emailObj of emails) {
-            this.mail.sendTemplatedMail(locale, {
-                email: emailObj.value,
-                slug: 'auth-login-new-device',
-                variables: {
-                    name: user.name,
-                    ipAddress,
-                    userAgent,
-                    location: 'Unknown',
-                }
-            });
+        if (newDevice) {
+            // So o endereco usado para entrar. Avisar todos os identificadores
+            // contava, para um e-mail secundario, que o principal tinha sido usado.
+            const wanted = (loginEmail !== null && loginEmail !== void 0 ? loginEmail : '').trim().toLowerCase();
+            const recipient = (_b = (_a = emails.find((e) => { var _a; return ((_a = e.value) === null || _a === void 0 ? void 0 : _a.toLowerCase()) === wanted; })) === null || _a === void 0 ? void 0 : _a.value) !== null && _b !== void 0 ? _b : emails[0].value;
+            await this.sendNewDeviceLoginMail(locale, user, recipient, ipAddress, userAgent, origin);
         }
         await this.user.registerUserActivity(user.id, "login");
         await this.token.setRefreshTokenCookie(locale, res, refreshToken, session.expires_at);
@@ -332,7 +424,7 @@ let AuthService = AuthService_1 = class AuthService {
         }
         return { accessToken, requiresPasswordReset };
     }
-    async loginWithEmailAndPassword(res, locale, ipAddress, userAgent, { email, password }, browserId) {
+    async loginWithEmailAndPassword(res, locale, ipAddress, userAgent, { email, password }, browserId, origin) {
         var _a, _b;
         const user = await this.user.findUserByEmail(locale, email);
         if (!user)
@@ -362,7 +454,7 @@ let AuthService = AuthService_1 = class AuthService {
             const emailMfas = mfaMethods.filter(m => m.type === 'email' && m.user_mfa_email && m.user_mfa_email.length > 0);
             if (emailMfas.length > 0) {
                 const emails = emailMfas.map(mfa => mfa.user_mfa_email[0].email);
-                await this.challenge.sendMfaCodeToMultipleEmails(locale, user.id, emails);
+                await this.challenge.sendMfaCodeToMultipleEmails(locale, user.id, emails, origin);
             }
             return {
                 requiresMfa: true,
@@ -377,12 +469,38 @@ let AuthService = AuthService_1 = class AuthService {
             'mfa-challenge-expiration-minutes'
         ]);
         if (settings['require-mfa'] === true && mfaMethods.length === 0) {
-            return this.requiresMfaForLogin(locale, email, user);
+            return this.requiresMfaForLogin(locale, email, user, origin);
         }
         else if (settings['require-email-verification'] === true && (identifier === null || identifier === void 0 ? void 0 : identifier.verified_at) === null) {
-            return this.requiresEmailVerificationForLogin(locale, email, user);
+            return this.requiresEmailVerificationForLogin(locale, email, user, origin);
+        }
+        return this.login(locale, user, ipAddress, userAgent, res, browserId, origin, email);
+    }
+    /**
+     * Cadastro por e-mail e senha.
+     *
+     * Com `require-email-verification` desligada (o default), a conta já nasce
+     * utilizável e o e-mail de confirmação é apenas informativo — devolver a
+     * pessoa para a tela de login só a obrigaria a digitar de novo o que acabou
+     * de digitar, então o cadastro já termina com a sessão emitida.
+     *
+     * Com a setting ligada, `loginWithEmailAndPassword` barraria o acesso logo em
+     * seguida; nesse caso não emitimos sessão e devolvemos `hasChallenge` para o
+     * app mandar a pessoa confirmar o endereço antes.
+     */
+    async signupWithEmailAndPassword(res, locale, ipAddress, userAgent, data, browserId, origin) {
+        const { user } = await this.user.createWithEmailAndPassword(locale, data);
+        const settings = await this.setting.getSettingValues([
+            'require-email-verification',
+        ]);
+        if (settings['require-email-verification'] === true) {
+            return { user, hasChallenge: true };
         }
-        return this.login(locale, user, ipAddress, userAgent, res, browserId);
+        // `isNewDevice` retorna false quando o usuário ainda não tem dispositivo
+        // nenhum, então o auto-login não dispara o alerta de "novo acesso" — que
+        // logo após o cadastro pareceria um aviso de invasão.
+        const session = await this.login(locale, user, ipAddress, userAgent, res, browserId, origin, data.email);
+        return Object.assign({ user, hasChallenge: false }, session);
     }
     async verifyRoles(_locale, userId) {
         return this.prisma.role.findMany({
@@ -398,11 +516,39 @@ let AuthService = AuthService_1 = class AuthService {
             }
         });
     }
-    async verifyUser(locale, userId) {
+    async verifyUser(locale, userId, sessionId) {
         const user = await this.user.findUserById(locale, userId);
         const requiresPasswordReset = this.hasPendingPasswordReset(user);
         delete user.user_credential;
-        return Object.assign(Object.assign({}, user), { requires_password_reset: requiresPasswordReset });
+        return Object.assign(Object.assign({}, user), { requires_password_reset: requiresPasswordReset, 
+            // Fonte de verdade do banner de simulacao no cliente: a sessionStorage do
+            // navegador e so cache e e gravavel por quem estiver na aba.
+            impersonation: await this.describeImpersonation(sessionId) });
+    }
+    async describeImpersonation(sessionId) {
+        if (!sessionId) {
+            return null;
+        }
+        const session = await this.prisma.user_session.findUnique({
+            where: { id: sessionId },
+            select: {
+                impersonator_user_id: true,
+                impersonation_reason: true,
+                expires_at: true,
+            },
+        });
+        if (!(session === null || session === void 0 ? void 0 : session.impersonator_user_id)) {
+            return null;
+        }
+        const operator = await this.prisma.user.findUnique({
+            where: { id: session.impersonator_user_id },
+            select: { id: true, name: true },
+        });
+        return {
+            by: operator !== null && operator !== void 0 ? operator : { id: session.impersonator_user_id, name: '' },
+            reason: session.impersonation_reason,
+            expires_at: session.expires_at.toISOString(),
+        };
     }
     async refreshAccessToken(locale, refreshToken, ipAddress, userAgent, browserId) {
         if (!refreshToken) {
@@ -426,15 +572,23 @@ let AuthService = AuthService_1 = class AuthService {
         return { success: true };
     }
     async logout(res, req, refreshToken) {
-        var _a, _b, _c;
+        var _a, _b, _c, _d;
+        // Numa sessao simulada o cookie `rt` da mesma origem e o do OPERADOR: limpar
+        // e revogar por hash aqui derrubaria a sessao real dele. O RoleGuard ja
+        // bloqueia esta rota durante uma simulacao (impersonation-restrictions.ts);
+        // isto e a segunda barreira, no caso de a rota ser alcancada por outro
+        // caminho. Sair de uma simulacao e POST /impersonation/stop.
+        if (((_a = req === null || req === void 0 ? void 0 : req.auth) === null || _a === void 0 ? void 0 : _a.imp) === true) {
+            throw new common_1.ForbiddenException('This action is not available during an access simulation.');
+        }
         const result = await this.session.deleteRefreshTokenCookie(res, refreshToken);
-        const logoutUserId = (_c = (_b = (_a = req.auth) === null || _a === void 0 ? void 0 : _a.sub) !== null && _b !== void 0 ? _b : result === null || result === void 0 ? void 0 : result.userId) !== null && _c !== void 0 ? _c : null;
+        const logoutUserId = (_d = (_c = (_b = req.auth) === null || _b === void 0 ? void 0 : _b.sub) !== null && _c !== void 0 ? _c : result === null || result === void 0 ? void 0 : result.userId) !== null && _d !== void 0 ? _d : null;
         if (logoutUserId) {
             await this.user.registerUserActivity(logoutUserId, 'logout');
         }
         return { success: true };
     }
-    async forgotResetPassword(locale, password, code, ipAddress, userAgent) {
+    async forgotResetPassword(locale, password, code, ipAddress, userAgent, origin) {
         const challenge = await this.challenge.verifyCodePassword(locale, code);
         const userIdentifier = challenge.user_identifier;
         const passwordHash = await this.security.hashArgon2(password);
@@ -450,10 +604,11 @@ let AuthService = AuthService_1 = class AuthService {
             slug: 'auth-forget-password-confirmation',
             variables: {
                 name: userIdentifier.user.name,
-            }
+            },
+            app: await this.challenge.resolveAppKeyFromOrigin(origin),
         });
         const { accessToken, refreshToken, session } = await this.getAuthenticationPayload(locale, userIdentifier.user_id, ipAddress, userAgent);
-        await this.user.registerUserActivity(userIdentifier.id, "resetPassword");
+        await this.user.registerUserActivity(userIdentifier.user_id, "resetPassword");
         return { accessToken, refreshToken, session };
     }
     /**
@@ -505,19 +660,115 @@ let AuthService = AuthService_1 = class AuthService {
         const token = await this.challenge.createAccountInviteChallenge(identifier.id);
         return { userId: targetUserId, token, hasPassword: passwordCount > 0 };
     }
+    /**
+     * Confirma o e-mail a partir do link enviado no cadastro. Não emite sessão: o
+     * link só prova o controle da caixa, quem quiser entrar passa pelo login.
+     *
+     * Idempotente de propósito — clientes de e-mail fazem pré-fetch do link e o
+     * usuário costuma clicar de novo depois, e nesses casos ver "link inválido"
+     * assusta mais do que ajuda.
+     */
+    async confirmEmail(locale, token) {
+        var _a, _b, _c, _d;
+        const { userIdentifierId } = await this.token.verifyEmailConfirmationToken(locale, token);
+        const identifier = await this.prisma.user_identifier.findUnique({
+            where: { id: userIdentifierId },
+            include: { user: { select: { id: true, name: true } } },
+        });
+        if (!identifier) {
+            throw new common_1.BadRequestException((0, api_locale_1.getLocaleText)('confirmEmail.invalidOrExpired', locale, 'This confirmation link is invalid or has expired.'));
+        }
+        if (identifier.verified_at) {
+            return {
+                confirmed: true,
+                alreadyConfirmed: true,
+                email: identifier.value,
+                name: (_b = (_a = identifier.user) === null || _a === void 0 ? void 0 : _a.name) !== null && _b !== void 0 ? _b : null,
+            };
+        }
+        await this.prisma.user_identifier.update({
+            where: { id: identifier.id },
+            data: { verified_at: new Date(), enabled: true },
+        });
+        await this.user.registerUserActivity(identifier.user_id, 'confirmEmail');
+        return {
+            confirmed: true,
+            alreadyConfirmed: false,
+            email: identifier.value,
+            name: (_d = (_c = identifier.user) === null || _c === void 0 ? void 0 : _c.name) !== null && _d !== void 0 ? _d : null,
+        };
+    }
+    /**
+     * Reenvia o link de confirmação do cadastro.
+     *
+     * Responde `{ sent: true }` mesmo quando o e-mail não existe ou já está
+     * confirmado: qualquer diferença na resposta transformaria a rota num
+     * oráculo para descobrir quais endereços têm conta.
+     */
+    async resendEmailConfirmation(locale, email, app, origin) {
+        var _a;
+        try {
+            const user = await this.user.findUserByEmail(locale, email);
+            if (user) {
+                await this.challenge.sendEmailConfirmationLink(locale, user.id, email, app, origin);
+            }
+        }
+        catch (error) {
+            // `sendEmailConfirmationLink` lança NotFound quando o endereço já está
+            // verificado — e uma falha de envio não pode virar erro para o cliente,
+            // sob pena de vazar a existência da conta.
+            this.logger.warn('Resend of signup confirmation email failed: ' + ((_a = error === null || error === void 0 ? void 0 : error.message) !== null && _a !== void 0 ? _a : error));
+        }
+        return { sent: true };
+    }
     /**
      * Valida (sem consumir) um token de convite de criação de conta e retorna os
      * dados básicos para pré-preencher o formulário no app de treinamentos.
+     * `hasAccount` diz se esse usuário já tem um jeito de entrar (senha ativa ou
+     * provedor externo vinculado) — usado pelo app para decidir entre mostrar o
+     * formulário de criação de conta ou uma tela de autorização de acesso.
      */
     async verifyAccountInvite(locale, code) {
         var _a, _b;
         const challenge = await this.challenge.verifyCodePassword(locale, code);
+        const userId = challenge.user_identifier.user_id;
+        const [passwordCount, oauthCount] = await Promise.all([
+            this.prisma.user_credential.count({
+                where: { user_id: userId, type: 'password', revoked_at: null },
+            }),
+            this.prisma.user_account.count({ where: { user_id: userId } }),
+        ]);
         return {
             valid: true,
             name: (_b = (_a = challenge.user_identifier.user) === null || _a === void 0 ? void 0 : _a.name) !== null && _b !== void 0 ? _b : null,
             email: challenge.user_identifier.value,
+            hasAccount: passwordCount > 0 || oauthCount > 0,
         };
     }
+    /**
+     * Conclui um convite de acesso para quem já tem conta (senha ou provedor
+     * externo): não define senha nenhuma, só prova controle do e-mail (mesmo
+     * nível de confiança do link de reset de senha) e autentica o usuário.
+     */
+    async authorizeAccountInvite(locale, code, ipAddress, userAgent) {
+        var _a;
+        const challenge = await this.challenge.verifyCodePassword(locale, code);
+        const userIdentifier = challenge.user_identifier;
+        if (!userIdentifier.verified_at || !userIdentifier.enabled) {
+            await this.prisma.user_identifier.update({
+                where: { id: userIdentifier.id },
+                data: { verified_at: (_a = userIdentifier.verified_at) !== null && _a !== void 0 ? _a : new Date(), enabled: true },
+            });
+        }
+        // Consome o challenge para impedir reuso do link.
+        await this.prisma.user_identifier_challenge.updateMany({
+            where: { id: challenge.id },
+            data: { verified_at: new Date(), expires_at: new Date() },
+        });
+        const { accessToken, refreshToken, session } = await this.getAuthenticationPayload(locale, userIdentifier.user_id, ipAddress, userAgent);
+        await this.user.registerUserActivity(userIdentifier.user_id, 'authorizeAccountInvite');
+        return { accessToken, refreshToken, session };
+    }
     /**
      * Conclui a criação de conta a partir de um token de convite: cria/atualiza a
      * credencial de senha, marca o identificador como verificado, atualiza o nome
@@ -561,10 +812,10 @@ let AuthService = AuthService_1 = class AuthService {
             data: { verified_at: new Date(), expires_at: new Date() },
         });
         const { accessToken, refreshToken, session } = await this.getAuthenticationPayload(locale, userIdentifier.user_id, ipAddress, userAgent);
-        await this.user.registerUserActivity(userIdentifier.id, 'completeAccount');
+        await this.user.registerUserActivity(userIdentifier.user_id, 'completeAccount');
         return { accessToken, refreshToken, session };
     }
-    async verifyMfaCode(locale, mfaToken, code, ipAddress, userAgent, methodType, browserId) {
+    async verifyMfaCode(locale, mfaToken, code, ipAddress, userAgent, methodType, browserId, origin) {
         var _a, _b, _c, _d;
         const payload = await this.token.verifyMfaChallengeToken(mfaToken);
         const user = await this.prisma.user.findUnique({
@@ -653,22 +904,16 @@ let AuthService = AuthService_1 = class AuthService {
         if (!isValid) {
             throw new common_1.BadRequestException((0, api_locale_1.getLocaleText)('invalidMfaCode', locale, 'Invalid MFA code.'));
         }
+        const newDevice = await this.userDevice.isNewDevice(user.id, userAgent, browserId);
         const { accessToken, refreshToken, session } = await this.getAuthenticationPayload(locale, user.id, ipAddress, userAgent, browserId);
-        this.mail.sendTemplatedMail(locale, {
-            email: payload.email,
-            slug: 'auth-login-new-device',
-            variables: {
-                name: user.name,
-                ipAddress,
-                userAgent,
-                location: 'Unknown',
-            }
-        });
+        if (newDevice) {
+            await this.sendNewDeviceLoginMail(locale, user, payload.email, ipAddress, userAgent, origin);
+        }
         await this.user.registerUserActivity(user.id, "login");
         const requiresPasswordReset = await this.getRequiresPasswordResetByUserId(user.id);
         return { accessToken, refreshToken, session, requiresPasswordReset };
     }
-    async verifyMfaRecoveryCode(locale, mfaToken, recoveryCode, ipAddress, userAgent, browserId) {
+    async verifyMfaRecoveryCode(locale, mfaToken, recoveryCode, ipAddress, userAgent, browserId, origin) {
         const payload = await this.token.verifyMfaChallengeToken(mfaToken);
         const user = await this.prisma.user.findUnique({
             where: { id: payload.userId },
@@ -692,12 +937,18 @@ let AuthService = AuthService_1 = class AuthService {
         if (!isValid) {
             throw new common_1.BadRequestException((0, api_locale_1.getLocaleText)('invalidRecoveryCode', locale, 'Invalid recovery code.'));
         }
+        const newDevice = await this.userDevice.isNewDevice(user.id, userAgent, browserId);
         const { accessToken, refreshToken, session } = await this.getAuthenticationPayload(locale, user.id, ipAddress, userAgent, browserId);
+        // Entrar por codigo de recuperacao e o caminho mais sensivel dos tres, e era
+        // justamente o unico que nao avisava ninguem.
+        if (newDevice) {
+            await this.sendNewDeviceLoginMail(locale, user, payload.email, ipAddress, userAgent, origin);
+        }
         await this.user.registerUserActivity(user.id, "login");
         const requiresPasswordReset = await this.getRequiresPasswordResetByUserId(user.id);
         return { accessToken, refreshToken, session, requiresPasswordReset };
     }
-    async resendMfaCode(locale, mfaToken) {
+    async resendMfaCode(locale, mfaToken, origin) {
         const payload = await this.token.verifyMfaChallengeToken(mfaToken);
         const mfaMethods = await this.prisma.user_mfa.findMany({
             where: {
@@ -716,7 +967,7 @@ let AuthService = AuthService_1 = class AuthService {
         if (!emailMfa.user_mfa_email || emailMfa.user_mfa_email.length === 0) {
             throw new common_1.BadRequestException((0, api_locale_1.getLocaleText)('noEmailMfaFound', locale, 'No email MFA method found for this user.'));
         }
-        await this.challenge.sendMfaCodeByEmail(locale, payload.userId, emailMfa.user_mfa_email[0].email);
+        await this.challenge.sendMfaCodeByEmail(locale, payload.userId, emailMfa.user_mfa_email[0].email, origin);
         return {
             success: true,
             hasEmailMfa: true
@@ -809,18 +1060,12 @@ let AuthService = AuthService_1 = class AuthService {
             where: { id: challengeRecord.id },
             data: { verified_at: new Date() }
         });
+        const newDevice = await this.userDevice.isNewDevice(userId, userAgent, browserId);
         const { accessToken, refreshToken, session } = await this.getAuthenticationPayload(locale, userId, ipAddress, userAgent, browserId);
-        const user = await this.prisma.user.findFirst({ where: { id: userId } });
-        this.mail.sendTemplatedMail(locale, {
-            email: payload.email,
-            slug: 'auth-login-new-device',
-            variables: {
-                name: user.name,
-                ipAddress,
-                userAgent,
-                location: 'Unknown',
-            }
-        });
+        if (newDevice) {
+            const user = await this.prisma.user.findFirst({ where: { id: userId } });
+            await this.sendNewDeviceLoginMail(locale, user, payload.email, ipAddress, userAgent, requestOrigin);
+        }
         await this.user.registerUserActivity(userId, 'login');
         const requiresPasswordReset = await this.getRequiresPasswordResetByUserId(userId);
         return { accessToken, refreshToken, session, requiresPasswordReset };
@@ -837,6 +1082,7 @@ exports.AuthService = AuthService = AuthService_1 = __decorate([
     __param(5, (0, common_1.Inject)((0, common_1.forwardRef)(() => session_service_1.SessionService))),
     __param(6, (0, common_1.Inject)((0, common_1.forwardRef)(() => user_service_1.UserService))),
     __param(7, (0, common_1.Inject)((0, common_1.forwardRef)(() => challenge_service_1.ChallengeService))),
+    __param(8, (0, common_1.Inject)((0, common_1.forwardRef)(() => user_device_service_1.UserDeviceService))),
     __metadata("design:paramtypes", [api_prisma_1.PrismaService,
         mail_service_1.MailService,
         setting_service_1.SettingService,
@@ -844,6 +1090,7 @@ exports.AuthService = AuthService = AuthService_1 = __decorate([
         token_service_1.TokenService,
         session_service_1.SessionService,
         user_service_1.UserService,
-        challenge_service_1.ChallengeService])
+        challenge_service_1.ChallengeService,
+        user_device_service_1.UserDeviceService])
 ], AuthService);
 //# sourceMappingURL=auth.service.js.map