@hed-hog/core 0.0.387 → 0.0.393

package/src/profile/profile.controller.ts

@@ -1,4 +1,4 @@
-import { NoRole, User } from '@hed-hog/api';
+import { NoRole, Session, User } from '@hed-hog/api';
 import { Locale } from '@hed-hog/api-locale';
 import { Body, Controller, Delete, Get, Headers, Ip, Param, ParseIntPipe, Post, Put, UploadedFile, UseInterceptors } from '@nestjs/common';
 import { FileInterceptor } from '@nestjs/platform-express';
@@ -8,6 +8,7 @@ import type {
 } from '@simplewebauthn/server';
 import { ChangeEmailDto } from './dto/change-email.dto';
 import { ChangePasswordDto } from './dto/change-password.dto';
+import { DeleteAccountDto } from './dto/delete-account.dto';
 import { EmailVerificationDto } from './dto/email-verification-confirm.dto';
 import { GenerateWebAuthnRegistrationOptionsDto } from './dto/generate-webauthn-registration-options.dto';
 import { RegenerateRecoveryCodesDto } from './dto/regenerate-recovery-codes.dto';
@@ -35,13 +36,13 @@ export class ProfileController {
   }
 
   @Post('mfa/check-verification')
-  async checkMfaBeforeAdd(@User() { id }, @Locale() locale: string) {
-    return this.profileService.checkMfaBeforeAdd(locale, id);
+  async checkMfaBeforeAdd(@User() { id }, @Locale() locale: string, @Headers('origin') origin: string) {
+    return this.profileService.checkMfaBeforeAdd(locale, id, origin);
   }
 
   @Post('mfa/check-verification-remove')
-  async checkMfaBeforeRemove(@User() { id }, @Locale() locale: string) {
-    return this.profileService.checkMfaBeforeRemove(locale, id);
+  async checkMfaBeforeRemove(@User() { id }, @Locale() locale: string, @Headers('origin') origin: string) {
+    return this.profileService.checkMfaBeforeRemove(locale, id, origin);
   }
 
   @Post('mfa/verify-before-add')
@@ -60,13 +61,13 @@ export class ProfileController {
   }
 
   @Post('totp/verify')
-  async verifyMfaTotp(@Locale() locale: string, @User() { id }, @Body() { token, secret, name }: VerifyMfaTotpDto) {
-    return this.profileService.verifyMfaTotp(locale, id, token, secret, name);
+  async verifyMfaTotp(@Locale() locale: string, @User() { id }, @Body() { token, secret, name }: VerifyMfaTotpDto, @Session() sessionId: number) {
+    return this.profileService.verifyMfaTotp(locale, id, token, secret, name, sessionId);
   }
 
   @Delete('totp/:mfaId/remove')
-  async removeMfaTotp(@Locale() locale: string, @User() { id }, @Param('mfaId', ParseIntPipe) mfaId: number, @Body() { token }: RemoveTotpMfaDto) {
-    return this.profileService.removeMfaTotp(locale, id, mfaId, token);
+  async removeMfaTotp(@Locale() locale: string, @User() { id }, @Param('mfaId', ParseIntPipe) mfaId: number, @Body() { token }: RemoveTotpMfaDto, @Session() sessionId: number) {
+    return this.profileService.removeMfaTotp(locale, id, mfaId, token, sessionId);
   }
 
   @Post('email/verify/confirm')
@@ -75,24 +76,24 @@ export class ProfileController {
   }
 
   @Post('email/verify')
-  sendEmailVerification(@User() {id}, @Body() data: SendEmailVerificationDto, @Locale() locale: string) {
-    return this.profileService.sendEmailVerification(locale, id, data);
+  sendEmailVerification(@User() {id}, @Body() data: SendEmailVerificationDto, @Locale() locale: string, @Headers('origin') origin: string) {
+    return this.profileService.sendEmailVerification(locale, id, data, origin);
   }
 
   @Post('mfa/email/verify')
-  sendEmailVerificationMfa(@User() {id}, @Body() data: SendEmailVerificationDto, @Locale() locale: string) {
-    return this.profileService.sendEmailVerificationMfa(locale, id, data);
+  sendEmailVerificationMfa(@User() {id}, @Body() data: SendEmailVerificationDto, @Locale() locale: string, @Headers('origin') origin: string) {
+    return this.profileService.sendEmailVerificationMfa(locale, id, data, origin);
   }
 
   @Post('mfa/email/verify/confirm')
-  sendEmailVerificationMfaConfirm(@User() {id}, @Body() data: EmailVerificationDto, @Locale() locale: string) {
-    
-    return this.profileService.confirmEmailVerificationMfa(locale, id, data);
+  sendEmailVerificationMfaConfirm(@User() {id}, @Body() data: EmailVerificationDto, @Locale() locale: string, @Session() sessionId: number) {
+
+    return this.profileService.confirmEmailVerificationMfa(locale, id, data, sessionId);
   }
   
   @Post('email/send-code-to-remove')
-  sendCodeToRemove(@User() {id}, @Locale() locale: string, @Body() { email }: SendEmailVerificationDto) {
-    return this.profileService.sendCodeToRemove(locale, id, email);
+  sendCodeToRemove(@User() {id}, @Locale() locale: string, @Body() { email }: SendEmailVerificationDto, @Headers('origin') origin: string) {
+    return this.profileService.sendCodeToRemove(locale, id, email, origin);
   }
 
   @Get('email')
@@ -101,8 +102,8 @@ export class ProfileController {
   }
 
   @Delete('email/:mfaId/remove')
-  async removeMfaEmail(@Locale() locale: string, @User() { id }, @Param('mfaId', ParseIntPipe) mfaId: number, @Body() { token, hash }: RemoveEmailMfaDto) {
-    return this.profileService.removeMfaEmail(locale, id, mfaId, token, hash);
+  async removeMfaEmail(@Locale() locale: string, @User() { id }, @Param('mfaId', ParseIntPipe) mfaId: number, @Body() { token, hash }: RemoveEmailMfaDto, @Session() sessionId: number) {
+    return this.profileService.removeMfaEmail(locale, id, mfaId, token, hash, sessionId);
   }
 
   @Get()
@@ -125,9 +126,10 @@ export class ProfileController {
     @User() { id },
     @Param('mfaId', ParseIntPipe) mfaId: number,
     @Body() { recoveryCode }: RemoveMfaWithRecoveryCodeDto,
-    @Locale() locale: string
+    @Locale() locale: string,
+    @Session() sessionId: number
   ) {
-    return this.profileService.removeMfaWithRecoveryCode(locale, id, mfaId, recoveryCode);
+    return this.profileService.removeMfaWithRecoveryCode(locale, id, mfaId, recoveryCode, sessionId);
   }
 
   @Delete('mfa/:mfaId/remove')
@@ -136,17 +138,19 @@ export class ProfileController {
     @Param('mfaId', ParseIntPipe) mfaId: number,
     @Body() data: RemoveMfaDto,
     @Locale() locale: string,
-    @Headers('origin') origin: string
+    @Headers('origin') origin: string,
+    @Session() sessionId: number
   ) {
-    return this.profileService.removeMfa(locale, id, mfaId, data, origin);
+    return this.profileService.removeMfa(locale, id, mfaId, data, origin, sessionId);
   }
 
   @Post('recovery-codes/send-verification')
   async sendRecoveryCodesVerification(
     @User() { id },
-    @Locale() locale: string
+    @Locale() locale: string,
+    @Headers('origin') origin: string
   ) {
-    return this.profileService.sendRecoveryCodesVerification(locale, id);
+    return this.profileService.sendRecoveryCodesVerification(locale, id, origin);
   }
 
   @Post('recovery-codes/regenerate')
@@ -201,25 +205,28 @@ export class ProfileController {
   async removeWebAuthnMfa(
     @User() { id },
     @Param('mfaId', ParseIntPipe) mfaId: number,
-    @Locale() locale: string
+    @Body() { assertionResponse }: VerifyWebAuthnDto,
+    @Locale() locale: string,
+    @Headers('origin') origin: string
   ) {
-    return this.profileService.removeWebAuthnMfa(locale, id, mfaId);
+    return this.profileService.removeWebAuthnMfa(locale, id, mfaId, assertionResponse, origin);
   }
 
   @Put('change-password')
   changePassword(
-    @User() {id}, 
-    @Body() body: ChangePasswordDto, 
+    @User() {id},
+    @Body() body: ChangePasswordDto,
     @Locale() locale: string,
     @Ip() ipAddress: string,
-    @Headers('user-agent') userAgent: string
+    @Headers('user-agent') userAgent: string,
+    @Headers('origin') origin: string
   ) {
-    return this.profileService.changePassword(locale, id, body, ipAddress, userAgent);
+    return this.profileService.changePassword(locale, id, body, ipAddress, userAgent, origin);
   }
 
   @Put('change-email')
-  changeEmail(@User() {id}, @Body() body: ChangeEmailDto, @Locale() locale: string) {
-    return this.profileService.changeEmail(locale, id, body);
+  changeEmail(@User() {id}, @Body() body: ChangeEmailDto, @Locale() locale: string, @Headers('origin') origin: string) {
+    return this.profileService.changeEmail(locale, id, body, origin);
   }
 
   @UseInterceptors(FileInterceptor('file'))
@@ -232,4 +239,9 @@ export class ProfileController {
   update(@Body() data: UpdateDto, @User() {id}) {
     return this.profileService.update(id, data);
   }
+
+  @Delete('account')
+  deleteAccount(@User() { id }, @Body() body: DeleteAccountDto, @Locale() locale: string) {
+    return this.profileService.deleteAccount(locale, id, body);
+  }
 }

package/src/profile/profile.service.ts

@@ -1,5 +1,5 @@
 import { getLocaleText } from '@hed-hog/api-locale';
-import { PrismaService, user } from '@hed-hog/api-prisma';
+import { PrismaService } from '@hed-hog/api-prisma';
 import { User } from '@hed-hog/api-types';
 import { BadRequestException, forwardRef, Inject, Injectable, NotFoundException } from '@nestjs/common';
 import { EventEmitter2 } from '@nestjs/event-emitter';
@@ -24,13 +24,16 @@ import { SecurityService } from '../security/security.service';
 import { SettingService } from '../setting/setting.service';
 import { TokenService } from '../token/token.service';
 import { UserService } from '../user/user.service';
+import { buildSecurityEventVars } from '../utils/security-event-vars';
 import { resolveWebAuthnOrigin } from '../utils/webauthn-origin';
 import { ChangeEmailDto } from './dto/change-email.dto';
 import { ChangePasswordDto } from './dto/change-password.dto';
+import { DeleteAccountDto } from './dto/delete-account.dto';
 import { EmailVerificationDto } from './dto/email-verification-confirm.dto';
 import { SendEmailVerificationDto } from './dto/send-email-verification.dto';
 import { SetPreferencesDto } from './dto/set-preferences.dto';
 import { UpdateDto } from './dto/update.dto';
+import { PROFILE_ACCOUNT_DELETED, ProfileAccountDeletedEvent } from './events/profile-account-deleted.event';
 import { PROFILE_AVATAR_UPDATED, ProfileAvatarUpdatedEvent } from './events/profile-avatar-updated.event';
 import { PROFILE_EMAIL_CHANGED, ProfileEmailChangedEvent } from './events/profile-email-changed.event';
 import { PROFILE_UPDATED, ProfileUpdatedEvent } from './events/profile-updated.event';
@@ -54,7 +57,7 @@ export class ProfileService {
     private readonly eventEmitter: EventEmitter2,
   ) {}
 
-  async changeEmail(locale: string, userId: number, { email, password, pin }: ChangeEmailDto) {
+  async changeEmail(locale: string, userId: number, { email, password, pin }: ChangeEmailDto, origin?: string) {
 
     const checkAlreadyExists = await this.prisma.user_identifier.findFirst({
         where: { type: 'email', value: email, enabled: true, verified_at: { not: null } },
@@ -127,7 +130,7 @@ export class ProfileService {
       });
 
       // Create verification challenge for the new email
-      await this.challenge.verifyEmail(locale, userId, email);
+      await this.challenge.verifyEmail(locale, userId, email, undefined, origin);
 
     });
 
@@ -150,7 +153,7 @@ export class ProfileService {
     return { success: true };
   }
 
-  async confirmEmailVerificationMfa(locale: string, userId: number, { pin, challengeId, name }: EmailVerificationDto) {
+  async confirmEmailVerificationMfa(locale: string, userId: number, { pin, challengeId, name }: EmailVerificationDto, sessionId: number | null) {
 
     const user = await this.prisma.user.findUnique({
       where: { id: userId },
@@ -223,9 +226,8 @@ export class ProfileService {
 
     });
 
-    const updatedUser = await this.prisma.user.findFirst({ where: { id: user.id }})
-    const codes = await this.createMfaRecoveryCodes(user.id);
-    const newToken = await this.getToken(updatedUser);
+    const codes = await this.createMfaRecoveryCodes(userId);
+    const newToken = await this.getToken(userId, sessionId);
     return { ...newToken, codes };
 
   }
@@ -302,16 +304,16 @@ export class ProfileService {
     return { success: true };
   }
 
-  async sendEmailVerificationMfa(locale: string, userId: number, { email }: SendEmailVerificationDto) {
-    return this.challenge.verifyMfaEmail(locale, userId, email);
+  async sendEmailVerificationMfa(locale: string, userId: number, { email }: SendEmailVerificationDto, origin?: string) {
+    return this.challenge.verifyMfaEmail(locale, userId, email, origin);
   }
 
-  async sendEmailVerification(locale: string, userId: number, { email }: SendEmailVerificationDto) {
-    return this.challenge.verifyEmail(locale, userId, email);    
+  async sendEmailVerification(locale: string, userId: number, { email }: SendEmailVerificationDto, origin?: string) {
+    return this.challenge.verifyEmail(locale, userId, email, undefined, origin);
   }
 
-  async sendCodeToRemove(locale, userId, email){
-    return this.challenge.verifyEmail(locale, userId, email)
+  async sendCodeToRemove(locale, userId, email, origin?: string){
+    return this.challenge.verifyEmail(locale, userId, email, undefined, origin)
   }
 
   async getEmailIdentifier(userId: number) {
@@ -321,9 +323,18 @@ export class ProfileService {
   }
 
   async getProfile(userId: number) {
-    return this.prisma.user.findUnique({
-      where: { id: userId },
-    });
+    const [user, passwordCredentials] = await Promise.all([
+      this.prisma.user.findUnique({ where: { id: userId } }),
+      this.prisma.user_credential.count({ where: { user_id: userId, type: 'password' } }),
+    ]);
+
+    if (!user) return user;
+
+    // Quem entrou só por login social não tem senha para digitar. Sem este
+    // campo o cliente não tem como saber disso e acaba exigindo a senha em
+    // telas onde `deleteAccount`/`changePassword` já a dispensam — o que deixa
+    // essas contas sem caminho para excluir a própria conta.
+    return { ...user, hasPassword: passwordCredentials > 0 };
   }
 
   async getMFAMethods(userId: number) {
@@ -359,6 +370,84 @@ export class ProfileService {
     return result;
   }
 
+  /**
+   * Exclusão de conta pelo próprio usuário (exigida pelas lojas de aplicativos).
+   *
+   * Anonimiza em vez de apagar: os dados pessoais somem e o acesso é revogado
+   * em definitivo, mas as linhas continuam existindo para não quebrar registros
+   * fiscais e integridade referencial. Os identificadores (e-mail, CPF...) são
+   * embaralhados, o que libera o e-mail original para uma conta nova no futuro.
+   */
+  async deleteAccount(locale: string, userId: number, { password }: DeleteAccountDto) {
+    const user = await this.prisma.user.findUnique({ where: { id: userId } });
+
+    if (!user) {
+      throw new NotFoundException(getLocaleText('userNotFound', locale, 'User not found.'));
+    }
+
+    if (user.deactivated_at) {
+      throw new BadRequestException(getLocaleText('accessDenied', locale, 'Access denied.'));
+    }
+
+    const credentials = await this.prisma.user_credential.findMany({
+      where: { user_id: userId, type: 'password' },
+    });
+
+    // Conta com senha exige a senha; conta só de login social não tem o que pedir.
+    if (credentials.length > 0) {
+      if (!password || !(await this.security.validatePassword(locale, credentials, password))) {
+        throw new BadRequestException(getLocaleText('accessDenied', locale, 'Access denied.'));
+      }
+    }
+
+    const deletedAt = new Date();
+    const suffix = `${userId}-${deletedAt.getTime()}`;
+
+    await this.prisma.$transaction(async (tx) => {
+      // Identificadores primeiro: libera e-mail/CPF para reuso e impede o login,
+      // que resolve o usuário justamente por essa tabela.
+      const identifiers = await tx.user_identifier.findMany({
+        where: { user_id: userId },
+        select: { id: true, type: true },
+      });
+
+      for (const identifier of identifiers) {
+        await tx.user_identifier.update({
+          where: { id: identifier.id },
+          data: {
+            value: `deleted-${identifier.type}-${suffix}`,
+            enabled: false,
+            verified_at: null,
+          },
+        });
+      }
+
+      // Credenciais, sessões e segundos fatores: nada aqui pode sobreviver,
+      // ou restaria um caminho de acesso à conta anonimizada.
+      await tx.user_identifier_challenge.deleteMany({ where: { user_identifier: { user_id: userId } } });
+      await tx.user_credential.deleteMany({ where: { user_id: userId } });
+      await tx.user_session.deleteMany({ where: { user_id: userId } });
+      await tx.user_mfa_challenge.deleteMany({ where: { user_mfa: { user_id: userId } } });
+      await tx.user_mfa.deleteMany({ where: { user_id: userId } });
+      await tx.user_recovery_code.deleteMany({ where: { user_id: userId } });
+      await tx.user_account.deleteMany({ where: { user_id: userId } });
+
+      await tx.user.update({
+        where: { id: userId },
+        data: {
+          name: 'Usuário removido',
+          photo_id: null,
+          deactivated_at: deletedAt,
+        },
+      });
+    });
+
+    // Cada library cuida dos seus próprios dados (assinatura, progresso, mensagens).
+    this.eventEmitter.emit(PROFILE_ACCOUNT_DELETED, new ProfileAccountDeletedEvent(userId, deletedAt));
+
+    return { success: true };
+  }
+
   async updateAvatar(locale: string, userId: number, file: MulterFile) {
     const result = await this.user.changeAvatar(locale, userId, file);
     this.eventEmitter.emit(PROFILE_AVATAR_UPDATED, new ProfileAvatarUpdatedEvent(userId, result?.id ?? null));
@@ -366,7 +455,7 @@ export class ProfileService {
     return result;
   }
 
-  async changePassword(locale:string, userId: number, {currentPassword, newPassword}: ChangePasswordDto, ipAddress?: string, userAgent?: string) {
+  async changePassword(locale:string, userId: number, {currentPassword, newPassword}: ChangePasswordDto, ipAddress?: string, userAgent?: string, origin?: string) {
     const credential =  await this.prisma.user_credential.findFirst({
       where: { user_id: userId, type: 'password' },
     });
@@ -398,15 +487,24 @@ export class ProfileService {
     });
 
     if (user?.user_identifier?.[0]?.value) {
-      this.mail.sendTemplatedMail(locale, {
-        email: user.user_identifier[0].value,
+      const recipientEmail = user.user_identifier[0].value;
+      // Data e pais sao formatados aqui, entao o idioma tem que ser o mesmo que
+      // o corpo do e-mail vai usar - resolvido antes, nao dentro do envio.
+      const recipientLocale = await this.mail.resolveRecipientLocale(
+        recipientEmail,
+        locale,
+        userId,
+      );
+
+      this.mail.sendTemplatedMail(recipientLocale, {
+        email: recipientEmail,
         slug: 'auth-change-password-notification',
+        userId,
         variables: {
           name: user.name,
-          userAgent: userAgent || 'Unknown',
-          ipAddress: ipAddress || 'Unknown',
-          location: 'Unknown',
+          ...buildSecurityEventVars({ ipAddress, userAgent, locale: recipientLocale }),
         },
+        app: await this.challenge.resolveAppKeyFromOrigin(origin),
       }).catch(error => {
         console.error('Failed to send password change notification:', error);
       });
@@ -448,11 +546,11 @@ export class ProfileService {
     return codes;
   }
 
-  async getToken(user: user) {
-    return { token: this.jwt.sign(user) };
+  async getToken(userId: number, sessionId: number | null) {
+    return { token: await this.token.createAccessToken({ sub: userId, sessionId }) };
   }
 
-  async verifyMfaTotp(locale: string, userId: number, token: string, secret: string, name?: string) {
+  async verifyMfaTotp(locale: string, userId: number, token: string, secret: string, name?: string, sessionId?: number | null) {
     const settings = await this.setting.getSettingValues([
       'mfa-issuer',
       'mfa-window',
@@ -514,9 +612,8 @@ export class ProfileService {
       });
     }
     
-    const updatedUser = await this.prisma.user.findFirst({ where: { id: user.id }})
-    const codes = await this.createMfaRecoveryCodes(updatedUser.id);
-    const newToken = await this.getToken(updatedUser);
+    const codes = await this.createMfaRecoveryCodes(userId);
+    const newToken = await this.getToken(userId, sessionId ?? null);
     return { ...newToken, codes };
   }
 
@@ -569,7 +666,7 @@ export class ProfileService {
     return { otpauthUrl: secret.otpauth_url, qrCode, secret: encodedSecret };
   }
 
-  async removeMfaTotp(locale: string, userId: number, mfaId: number, token: string) {
+  async removeMfaTotp(locale: string, userId: number, mfaId: number, token: string, sessionId: number | null) {
     try {
       const user = await this.prisma.user.findFirst({
         where: { id: userId },
@@ -606,26 +703,26 @@ export class ProfileService {
         });
       });
 
-      return this.getUserToken(userId)
+      return this.getUserToken(userId, sessionId)
     } catch (error: any) {
       throw new BadRequestException(`Invalid code: ${error?.message}`);
     }
   }
 
-  async removeMfaEmail(locale: string, userId: number, mfaId: number, token: string, providedHash: string) {
+  async removeMfaEmail(locale: string, userId: number, mfaId: number, token: string, providedHash: string, sessionId: number | null) {
     try {
       await this.challenge.verifyCode(locale, userId, token, providedHash)
       await this.prisma.user_mfa.deleteMany({
         where: { id: mfaId, user_id: userId, type: 'email' },
       });
 
-      return this.getUserToken(userId)
+      return this.getUserToken(userId, sessionId)
     } catch (error: any) {
       throw new BadRequestException(`Invalid code: ${error?.message}`);
     }
   }
 
-  async removeMfaWithRecoveryCode(locale: string, userId: number, mfaId: number, recoveryCode: string) {
+  async removeMfaWithRecoveryCode(locale: string, userId: number, mfaId: number, recoveryCode: string, sessionId: number | null) {
     try {
       const user = await this.prisma.user.findUnique({
         where: { id: userId },
@@ -659,13 +756,13 @@ export class ProfileService {
         where: { id: mfaId, user_id: userId },
       });
 
-      return this.getUserToken(userId);
+      return this.getUserToken(userId, sessionId);
     } catch (error: any) {
       throw new BadRequestException(`Invalid code: ${error?.message}`);
     }
   }
 
-  async removeMfa(locale: string, userId: number, mfaId: number, data: { token?: string; hash?: string; verificationType?: 'totp' | 'email' | 'recovery' | 'webauthn'; assertionResponse?: any }, requestOrigin?: string) {
+  async removeMfa(locale: string, userId: number, mfaId: number, data: { token?: string; hash?: string; verificationType?: 'totp' | 'email' | 'recovery' | 'webauthn'; assertionResponse?: any }, requestOrigin: string | undefined, sessionId: number | null) {
     try {
       const user = await this.prisma.user.findUnique({
         where: { id: userId },
@@ -786,13 +883,13 @@ export class ProfileService {
         where: { id: mfaId, user_id: userId },
       });
 
-      return this.getUserToken(userId);
+      return this.getUserToken(userId, sessionId);
     } catch (error: any) {
       throw new BadRequestException(`Failed to remove MFA: ${error?.message}`);
     }
   }
 
-  async checkMfaBeforeAdd(locale: string, userId: number) {
+  async checkMfaBeforeAdd(locale: string, userId: number, origin?: string) {
     try {
       const mfaMethods = await this.prisma.user_mfa.findMany({
         where: { 
@@ -822,7 +919,7 @@ export class ProfileService {
 
       if (emailMfas.length > 0) {
         const emails = emailMfas.map(mfa => mfa.user_mfa_email[0].email);
-        await this.challenge.sendMfaCodeToMultipleEmails(locale, userId, emails);
+        await this.challenge.sendMfaCodeToMultipleEmails(locale, userId, emails, origin);
         availableMethods.push('email');
       }
 
@@ -859,7 +956,7 @@ export class ProfileService {
     }
   }
 
-  async checkMfaBeforeRemove(locale: string, userId: number) {
+  async checkMfaBeforeRemove(locale: string, userId: number, origin?: string) {
     try {
       const mfaMethods = await this.prisma.user_mfa.findMany({
         where: { 
@@ -890,7 +987,7 @@ export class ProfileService {
 
       if (emailMfas.length > 0) {
         const emails = emailMfas.map(mfa => mfa.user_mfa_email[0].email);
-        await this.challenge.sendMfaCodeToMultipleEmails(locale, userId, emails);
+        await this.challenge.sendMfaCodeToMultipleEmails(locale, userId, emails, origin);
         availableMethods.push('email');
       }
 
@@ -1031,7 +1128,7 @@ export class ProfileService {
     }
   }
 
-  async sendRecoveryCodesVerification(locale: string, userId: number) {
+  async sendRecoveryCodesVerification(locale: string, userId: number, origin?: string) {
     try {
       const mfaMethods = await this.prisma.user_mfa.findMany({
         where: { 
@@ -1060,7 +1157,7 @@ export class ProfileService {
 
       if (emailMfas.length > 0) {
         const emails = emailMfas.map(mfa => mfa.user_mfa_email[0].email);
-        await this.challenge.sendMfaCodeToMultipleEmails(locale, userId, emails);
+        await this.challenge.sendMfaCodeToMultipleEmails(locale, userId, emails, origin);
         availableMethods.push('email');
       }
 
@@ -1476,7 +1573,13 @@ export class ProfileService {
     }
   }
 
-  async removeWebAuthnMfa(locale: string, userId: number, mfaId: number) {
+  async removeWebAuthnMfa(
+    locale: string,
+    userId: number,
+    mfaId: number,
+    assertionResponse: any,
+    requestOrigin?: string,
+  ) {
     try {
       const mfa = await this.prisma.user_mfa.findFirst({
         where: {
@@ -1492,6 +1595,22 @@ export class ProfileService {
         );
       }
 
+      // Reautenticacao obrigatoria: sem isso, um token de acesso vazado bastava
+      // para remover a chave de seguranca da conta sem provar posse dela.
+      if (!assertionResponse) {
+        throw new BadRequestException(
+          getLocaleText('assertionResponseRequired', locale, 'Assertion response is required for WebAuthn.')
+        );
+      }
+
+      try {
+        await this.verifyWebAuthnAuthentication(userId, assertionResponse, requestOrigin);
+      } catch (error) {
+        throw new BadRequestException(
+          getLocaleText('invalidWebAuthn', locale, 'WebAuthn verification failed.')
+        );
+      }
+
       await this.prisma.user_mfa.delete({
         where: { id: mfaId },
       });
@@ -1632,8 +1751,7 @@ export class ProfileService {
     }
   }
 
-  async getUserToken(userId: number){
-    const updatedUser = await this.prisma.user.findFirst({ where: { id: userId }})
-    return this.getToken(updatedUser);
+  async getUserToken(userId: number, sessionId: number | null){
+    return this.getToken(userId, sessionId);
   }
 }