@hed-hog/core 0.0.387 → 0.0.393

package/dist/impersonation/impersonation.controller.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"impersonation.controller.js","sourceRoot":"","sources":["../../src/impersonation/impersonation.controller.ts"],"names":[],"mappings":";;;;;;;;;;;;;;;AAAA,sCAA+F;AAC/F,oDAA6C;AAC7C,4DAAqD;AACrD,2CAWwB;AACxB,iDAA6D;AAC7D,6EAAwE;AAExE,mEAA+D;AAE/D;;;;;;GAMG;AAGI,IAAM,uBAAuB,GAA7B,MAAM,uBAAuB;IAClC,YAEmB,OAA6B;QAA7B,YAAO,GAAP,OAAO,CAAsB;IAC7C,CAAC;IAKE,AAAN,KAAK,CAAC,KAAK,CACC,MAAc,EAChB,QAAQ,EACC,aAAmC,EAC5C,IAAsD,EACxD,SAAiB,EACA,SAAiB;QAExC,OAAO,IAAI,CAAC,OAAO,CAAC,KAAK,CAAC;YACxB,MAAM;YACN,cAAc,EAAE,QAAQ,CAAC,EAAE;YAC3B,YAAY,EAAE,MAAM,CAAC,IAAI,CAAC,YAAY,CAAC;YACvC,GAAG,EAAE,IAAI,CAAC,GAAG;YACb,MAAM,EAAE,IAAI,CAAC,MAAM;YACnB,eAAe,EAAE,aAAa,CAAC,MAAM;YACrC,SAAS;YACT,SAAS;SACV,CAAC,CAAC;IACL,CAAC;IAMK,AAAN,KAAK,CAAC,MAAM,CACA,MAAc,EAChB,EAAE,IAAI,EAA0B,EAClC,SAAiB,EACA,SAAiB;QAExC,OAAO,IAAI,CAAC,OAAO,CAAC,MAAM,CAAC,EAAE,MAAM,EAAE,IAAI,EAAE,SAAS,EAAE,SAAS,EAAE,CAAC,CAAC;IACrE,CAAC;IAIK,AAAN,KAAK,CAAC,IAAI,CACA,MAAM,EACG,aAAmC,EAC9C,SAAiB;QAEvB,OAAO,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC;YACvB,SAAS,EAAE,aAAa,CAAC,SAAS;YAClC,YAAY,EAAE,MAAM,CAAC,EAAE;YACvB,cAAc,EAAE,aAAa,CAAC,cAAc;YAC5C,SAAS;SACV,CAAC,CAAC;IACL,CAAC;IAIK,AAAN,KAAK,CAAC,OAAO,CAAkB,aAAmC;QAChE,OAAO,IAAI,CAAC,OAAO,CAAC,cAAc,CAChC,aAAa,CAAC,MAAM,CAAC,CAAC,CAAC,aAAa,CAAC,SAAS,CAAC,CAAC,CAAC,IAAI,CACtD,CAAC;IACJ,CAAC;IAGK,AAAN,KAAK,CAAC,IAAI;QACR,OAAO,EAAE,IAAI,EAAE,MAAM,IAAI,CAAC,OAAO,CAAC,kBAAkB,EAAE,EAAE,CAAC;IAC3D,CAAC;IAGK,AAAN,KAAK,CAAC,OAAO,CACG,gBAAgB,EACP,YAAqB;QAE5C,OAAO,IAAI,CAAC,OAAO,CAAC,OAAO,CAAC,gBAAgB,EAAE;YAC5C,YAAY,EAAE,YAAY,CAAC,CAAC,CAAC,MAAM,CAAC,YAAY,CAAC,CAAC,CAAC,CAAC,SAAS;SAC9D,CAAC,CAAC;IACL,CAAC;CACF,CAAA;AA/EY,0DAAuB;AAS5B;IAHL,IAAA,kBAAS,EAAC,0BAAc,CAAC;IACzB,IAAA,oBAAQ,EAAC,EAAE,OAAO,EAAE,EAAE,KAAK,EAAE,EAAE,EAAE,GAAG,EAAE,KAAM,EAAE,EAAE,CAAC;IACjD,IAAA,aAAI,EAAC,OAAO,CAAC;IAEX,WAAA,IAAA,mBAAM,GAAE,CAAA;IACR,WAAA,IAAA,UAAI,GAAE,CAAA;IACN,WAAA,IAAA,mBAAa,GAAE,CAAA;IACf,WAAA,IAAA,aAAI,GAAE,CAAA;IACN,WAAA,IAAA,WAAE,GAAE,CAAA;IACJ,WAAA,IAAA,gBAAO,EAAC,YAAY,CAAC,CAAA;;;;oDAYvB;AAMK;IAJL,IAAA,YAAM,GAAE;IACR,IAAA,kBAAS,EAAC,0BAAc,CAAC;IACzB,IAAA,oBAAQ,EAAC,EAAE,OAAO,EAAE,EAAE,KAAK,EAAE,EAAE,EAAE,GAAG,EAAE,KAAM,EAAE,EAAE,CAAC;IACjD,IAAA,aAAI,EAAC,QAAQ,CAAC;IAEZ,WAAA,IAAA,mBAAM,GAAE,CAAA;IACR,WAAA,IAAA,aAAI,GAAE,CAAA;IACN,WAAA,IAAA,WAAE,GAAE,CAAA;IACJ,WAAA,IAAA,gBAAO,EAAC,YAAY,CAAC,CAAA;;6CAFJ,iDAAsB;;qDAKzC;AAIK;IAFL,IAAA,YAAM,GAAE;IACR,IAAA,aAAI,EAAC,MAAM,CAAC;IAEV,WAAA,IAAA,UAAI,GAAE,CAAA;IACN,WAAA,IAAA,mBAAa,GAAE,CAAA;IACf,WAAA,IAAA,WAAE,GAAE,CAAA;;;;mDAQN;AAIK;IAFL,IAAA,YAAM,GAAE;IACR,IAAA,YAAG,EAAC,SAAS,CAAC;IACA,WAAA,IAAA,mBAAa,GAAE,CAAA;;;;sDAI7B;AAGK;IADL,IAAA,YAAG,EAAC,MAAM,CAAC;;;;mDAGX;AAGK;IADL,IAAA,YAAG,EAAC,SAAS,CAAC;IAEZ,WAAA,IAAA,2BAAU,GAAE,CAAA;IACZ,WAAA,IAAA,cAAK,EAAC,cAAc,CAAC,CAAA;;;;sDAKvB;kCA9EU,uBAAuB;IAFnC,IAAA,UAAI,GAAE;IACN,IAAA,mBAAU,EAAC,eAAe,CAAC;IAGvB,WAAA,IAAA,eAAM,EAAC,IAAA,mBAAU,EAAC,GAAG,EAAE,CAAC,4CAAoB,CAAC,CAAC,CAAA;qCACrB,4CAAoB;GAHrC,uBAAuB,CA+EnC"}

package/dist/impersonation/impersonation.module.d.ts

@@ -0,0 +1,8 @@
+/**
+ * Modulo proprio, e nao mais um endpoint no AuthModule, porque a simulacao tem
+ * um ciclo de vida completo (emitir → resgatar → encerrar → auditar) e uma
+ * denylist de rotas que o RoleGuard consulta.
+ */
+export declare class ImpersonationModule {
+}
+//# sourceMappingURL=impersonation.module.d.ts.map

package/dist/impersonation/impersonation.module.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"impersonation.module.d.ts","sourceRoot":"","sources":["../../src/impersonation/impersonation.module.ts"],"names":[],"mappings":"AAWA;;;;GAIG;AACH,qBAca,mBAAmB;CAAG"}

package/dist/impersonation/impersonation.module.js

@@ -0,0 +1,44 @@
+"use strict";
+var __decorate = (this && this.__decorate) || function (decorators, target, key, desc) {
+    var c = arguments.length, r = c < 3 ? target : desc === null ? desc = Object.getOwnPropertyDescriptor(target, key) : desc, d;
+    if (typeof Reflect === "object" && typeof Reflect.decorate === "function") r = Reflect.decorate(decorators, target, key, desc);
+    else for (var i = decorators.length - 1; i >= 0; i--) if (d = decorators[i]) r = (c < 3 ? d(r) : c > 3 ? d(target, key, r) : d(target, key)) || r;
+    return c > 3 && r && Object.defineProperty(target, key, r), r;
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.ImpersonationModule = void 0;
+const api_pagination_1 = require("@hed-hog/api-pagination");
+const api_prisma_1 = require("@hed-hog/api-prisma");
+const common_1 = require("@nestjs/common");
+const security_module_1 = require("../security/security.module");
+const session_module_1 = require("../session/session.module");
+const setting_module_1 = require("../setting/setting.module");
+const token_module_1 = require("../token/token.module");
+const user_module_1 = require("../user/user.module");
+const impersonation_controller_1 = require("./impersonation.controller");
+const impersonation_service_1 = require("./impersonation.service");
+/**
+ * Modulo proprio, e nao mais um endpoint no AuthModule, porque a simulacao tem
+ * um ciclo de vida completo (emitir → resgatar → encerrar → auditar) e uma
+ * denylist de rotas que o RoleGuard consulta.
+ */
+let ImpersonationModule = class ImpersonationModule {
+};
+exports.ImpersonationModule = ImpersonationModule;
+exports.ImpersonationModule = ImpersonationModule = __decorate([
+    (0, common_1.Module)({
+        imports: [
+            (0, common_1.forwardRef)(() => api_prisma_1.PrismaModule),
+            (0, common_1.forwardRef)(() => security_module_1.SecurityModule),
+            (0, common_1.forwardRef)(() => setting_module_1.SettingModule),
+            (0, common_1.forwardRef)(() => token_module_1.TokenModule),
+            (0, common_1.forwardRef)(() => session_module_1.SessionModule),
+            (0, common_1.forwardRef)(() => user_module_1.UserModule),
+            (0, common_1.forwardRef)(() => api_pagination_1.PaginationModule),
+        ],
+        controllers: [impersonation_controller_1.ImpersonationController],
+        providers: [impersonation_service_1.ImpersonationService],
+        exports: [impersonation_service_1.ImpersonationService],
+    })
+], ImpersonationModule);
+//# sourceMappingURL=impersonation.module.js.map

package/dist/impersonation/impersonation.module.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"impersonation.module.js","sourceRoot":"","sources":["../../src/impersonation/impersonation.module.ts"],"names":[],"mappings":";;;;;;;;;AAAA,4DAA2D;AAC3D,oDAAmD;AACnD,2CAAoD;AACpD,iEAA6D;AAC7D,8DAA0D;AAC1D,8DAA0D;AAC1D,wDAAoD;AACpD,qDAAiD;AACjD,yEAAqE;AACrE,mEAA+D;AAE/D;;;;GAIG;AAeI,IAAM,mBAAmB,GAAzB,MAAM,mBAAmB;CAAG,CAAA;AAAtB,kDAAmB;8BAAnB,mBAAmB;IAd/B,IAAA,eAAM,EAAC;QACN,OAAO,EAAE;YACP,IAAA,mBAAU,EAAC,GAAG,EAAE,CAAC,yBAAY,CAAC;YAC9B,IAAA,mBAAU,EAAC,GAAG,EAAE,CAAC,gCAAc,CAAC;YAChC,IAAA,mBAAU,EAAC,GAAG,EAAE,CAAC,8BAAa,CAAC;YAC/B,IAAA,mBAAU,EAAC,GAAG,EAAE,CAAC,0BAAW,CAAC;YAC7B,IAAA,mBAAU,EAAC,GAAG,EAAE,CAAC,8BAAa,CAAC;YAC/B,IAAA,mBAAU,EAAC,GAAG,EAAE,CAAC,wBAAU,CAAC;YAC5B,IAAA,mBAAU,EAAC,GAAG,EAAE,CAAC,iCAAgB,CAAC;SACnC;QACD,WAAW,EAAE,CAAC,kDAAuB,CAAC;QACtC,SAAS,EAAE,CAAC,4CAAoB,CAAC;QACjC,OAAO,EAAE,CAAC,4CAAoB,CAAC;KAChC,CAAC;GACW,mBAAmB,CAAG"}

package/dist/impersonation/impersonation.service.d.ts

@@ -0,0 +1,164 @@
+import { PrismaService } from '@hed-hog/api-prisma';
+import { PaginationDTO, PaginationService } from '@hed-hog/api-pagination';
+import { SecurityService } from '../security/security.service';
+import { SessionService } from '../session/session.service';
+import { SettingService } from '../setting/setting.service';
+import { TokenService } from '../token/token.service';
+import { UserService } from '../user/user.service';
+type StartParams = {
+    locale: string;
+    operatorUserId: number;
+    targetUserId: number;
+    app: string;
+    reason?: string | null;
+    isImpersonating: boolean;
+    ipAddress: string;
+    userAgent: string;
+};
+type RedeemParams = {
+    locale: string;
+    code: string;
+    ipAddress: string;
+    userAgent: string;
+};
+/**
+ * Simulacao de acesso: um operador ve o sistema como outro usuario, por uma
+ * janela curta, com tudo marcado como simulado.
+ *
+ * DESENHO EM DUAS ETAPAS. `start` nao devolve token nenhum — devolve um codigo
+ * de uso unico com TTL de 60s, que viaja no FRAGMENT da URL da aba nova
+ * (fragment nao chega ao servidor, entao nao entra em log de acesso nem em
+ * Referer). Quem cria a sessao e o `redeem`, na aba de destino. Assim a sessao
+ * do operador nunca e tocada: nenhum cookie `rt` e emitido, nenhum
+ * `localStorage` compartilhado e sobrescrito.
+ *
+ * A SESSAO E NAO RENOVAVEL POR CONSTRUCAO. `SessionService.createImpersonation`
+ * gera o token opaco e o descarta, entao nao existe refresh token para ela em
+ * lugar nenhum — e nao apenas "e proibido renovar".
+ */
+export declare class ImpersonationService {
+    private readonly prisma;
+    private readonly security;
+    private readonly setting;
+    private readonly token;
+    private readonly session;
+    private readonly user;
+    private readonly pagination;
+    private readonly logger;
+    /** Curto: o codigo so precisa sobreviver ao carregamento da aba nova. */
+    private readonly codeTtlMs;
+    /** Caminho da tela de resgate, igual nos tres apps. */
+    static readonly REDEEM_PATH = "/simulacao";
+    /**
+     * Simular quem ja e administrador nao ajuda em nada no suporte e transformaria
+     * o papel `admin-impersonation` num atalho para virar `admin`.
+     */
+    private static readonly BLOCKED_TARGET_ROLES;
+    /**
+     * Apps com tela de resgate. `training` tem autenticacao propria e nao usa o
+     * @hed-hog/next-app-provider, entao ficou fora desta fase.
+     */
+    private static readonly REDEEMABLE_APPS;
+    constructor(prisma: PrismaService, security: SecurityService, setting: SettingService, token: TokenService, session: SessionService, user: UserService, pagination: PaginationService);
+    start(params: StartParams): Promise<{
+        url: string;
+        expiresAt: string;
+    }>;
+    redeem(params: RedeemParams): Promise<{
+        accessToken: string;
+        expiresAt: string;
+        sessionId: number;
+        app: string;
+        operator: {
+            id: number;
+            name: string;
+        };
+        target: {
+            id: number;
+            name: string;
+        };
+    }>;
+    /**
+     * Chamado pela propria sessao simulada, entao todos os identificadores vem do
+     * `request.auth` — nao ha parametro que permita encerrar sessao alheia.
+     */
+    stop(params: {
+        sessionId: number | null;
+        targetUserId: number;
+        operatorUserId: number | null;
+        ipAddress?: string;
+    }): Promise<{
+        ended: boolean;
+    }>;
+    /**
+     * Fonte de verdade do banner. A `sessionStorage` do cliente e so cache — e
+     * gravavel pelo proprio navegador, entao nao serve para decidir nada.
+     */
+    currentSession(sessionId: number | null): Promise<{
+        active: false;
+        operator?: undefined;
+        target?: undefined;
+        reason?: undefined;
+        expiresAt?: undefined;
+    } | {
+        active: true;
+        operator: {
+            id: number;
+            name: string;
+        };
+        target: {
+            id: number;
+            name: string;
+        };
+        reason: string;
+        expiresAt: string;
+    }>;
+    /** Apps que o operador pode escolher como destino. */
+    listRedeemableApps(): Promise<{
+        key: string;
+        url: string;
+    }[]>;
+    history(paginationParams: PaginationDTO, filters: {
+        targetUserId?: number;
+    }): Promise<{
+        data: {
+            id: any;
+            app: any;
+            reason: any;
+            sessionId: any;
+            operator: {
+                id: number;
+                name: string;
+            };
+            target: {
+                id: number;
+                name: string;
+            };
+            issuedIp: any;
+            redeemedIp: any;
+            consumedAt: any;
+            endedAt: any;
+            expiresAt: any;
+            createdAt: any;
+        }[];
+        total: any;
+        lastPage: number;
+        page: number;
+        pageSize: number;
+    }>;
+    /**
+     * Concessoes nao resgatadas viram lixo em 60s. As consumidas ficam: sao a
+     * trilha de auditoria.
+     */
+    purgeExpired(): Promise<void>;
+    private assertTargetIsEligible;
+    private resolveAppOrigin;
+    /**
+     * `app-urls` e uma lista de `chave=url`. Mesmo formato lido por
+     * `ChallengeService.resolveAppKeyFromOrigin` e `OAuthService`.
+     */
+    private parseAppUrls;
+    private getUserPair;
+}
+export {};
+//# sourceMappingURL=impersonation.service.d.ts.map

package/dist/impersonation/impersonation.service.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"impersonation.service.d.ts","sourceRoot":"","sources":["../../src/impersonation/impersonation.service.ts"],"names":[],"mappings":"AAGA,OAAO,EAAU,aAAa,EAAE,MAAM,qBAAqB,CAAC;AAE5D,OAAO,EAAE,aAAa,EAAE,iBAAiB,EAAE,MAAM,yBAAyB,CAAC;AAW3E,OAAO,EAAE,eAAe,EAAE,MAAM,8BAA8B,CAAC;AAC/D,OAAO,EAAE,cAAc,EAAE,MAAM,4BAA4B,CAAC;AAC5D,OAAO,EAAE,cAAc,EAAE,MAAM,4BAA4B,CAAC;AAC5D,OAAO,EAAE,YAAY,EAAE,MAAM,wBAAwB,CAAC;AACtD,OAAO,EAAE,WAAW,EAAE,MAAM,sBAAsB,CAAC;AAEnD,KAAK,WAAW,GAAG;IACjB,MAAM,EAAE,MAAM,CAAC;IACf,cAAc,EAAE,MAAM,CAAC;IACvB,YAAY,EAAE,MAAM,CAAC;IACrB,GAAG,EAAE,MAAM,CAAC;IACZ,MAAM,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IACvB,eAAe,EAAE,OAAO,CAAC;IACzB,SAAS,EAAE,MAAM,CAAC;IAClB,SAAS,EAAE,MAAM,CAAC;CACnB,CAAC;AAEF,KAAK,YAAY,GAAG;IAClB,MAAM,EAAE,MAAM,CAAC;IACf,IAAI,EAAE,MAAM,CAAC;IACb,SAAS,EAAE,MAAM,CAAC;IAClB,SAAS,EAAE,MAAM,CAAC;CACnB,CAAC;AAUF;;;;;;;;;;;;;;GAcG;AACH,qBACa,oBAAoB;IAuB7B,OAAO,CAAC,QAAQ,CAAC,MAAM;IAEvB,OAAO,CAAC,QAAQ,CAAC,QAAQ;IAEzB,OAAO,CAAC,QAAQ,CAAC,OAAO;IAExB,OAAO,CAAC,QAAQ,CAAC,KAAK;IAEtB,OAAO,CAAC,QAAQ,CAAC,OAAO;IAExB,OAAO,CAAC,QAAQ,CAAC,IAAI;IAErB,OAAO,CAAC,QAAQ,CAAC,UAAU;IAlC7B,OAAO,CAAC,QAAQ,CAAC,MAAM,CAAyC;IAEhE,yEAAyE;IACzE,OAAO,CAAC,QAAQ,CAAC,SAAS,CAAU;IAEpC,uDAAuD;IACvD,MAAM,CAAC,QAAQ,CAAC,WAAW,gBAAgB;IAE3C;;;OAGG;IACH,OAAO,CAAC,MAAM,CAAC,QAAQ,CAAC,oBAAoB,CAAoC;IAEhF;;;OAGG;IACH,OAAO,CAAC,MAAM,CAAC,QAAQ,CAAC,eAAe,CAAkC;gBAItD,MAAM,EAAE,aAAa,EAErB,QAAQ,EAAE,eAAe,EAEzB,OAAO,EAAE,cAAc,EAEvB,KAAK,EAAE,YAAY,EAEnB,OAAO,EAAE,cAAc,EAEvB,IAAI,EAAE,WAAW,EAEjB,UAAU,EAAE,iBAAiB;IAO1C,KAAK,CAAC,MAAM,EAAE,WAAW;;;;IAyEzB,MAAM,CAAC,MAAM,EAAE,YAAY;;;;;;;;;;;;;;IA4GjC;;;OAGG;IACG,IAAI,CAAC,MAAM,EAAE;QACjB,SAAS,EAAE,MAAM,GAAG,IAAI,CAAC;QACzB,YAAY,EAAE,MAAM,CAAC;QACrB,cAAc,EAAE,MAAM,GAAG,IAAI,CAAC;QAC9B,SAAS,CAAC,EAAE,MAAM,CAAC;KACpB;;;IAoDD;;;OAGG;IACG,cAAc,CAAC,SAAS,EAAE,MAAM,GAAG,IAAI;;;;;;;;;;;;;;;;;;;IAkC7C,sDAAsD;IAChD,kBAAkB;;;;IASlB,OAAO,CAAC,gBAAgB,EAAE,aAAa,EAAE,OAAO,EAAE;QAAE,YAAY,CAAC,EAAE,MAAM,CAAA;KAAE;;;;;;;;;;;;;;;;;;;;;;;;;;IAwDjF;;;OAGG;IAEG,YAAY;YAiBJ,sBAAsB;YA2CtB,gBAAgB;IA2B9B;;;OAGG;IACH,OAAO,CAAC,YAAY;YAgBN,WAAW;CAY1B"}

package/dist/impersonation/impersonation.service.js

@@ -0,0 +1,408 @@
+"use strict";
+var __decorate = (this && this.__decorate) || function (decorators, target, key, desc) {
+    var c = arguments.length, r = c < 3 ? target : desc === null ? desc = Object.getOwnPropertyDescriptor(target, key) : desc, d;
+    if (typeof Reflect === "object" && typeof Reflect.decorate === "function") r = Reflect.decorate(decorators, target, key, desc);
+    else for (var i = decorators.length - 1; i >= 0; i--) if (d = decorators[i]) r = (c < 3 ? d(r) : c > 3 ? d(target, key, r) : d(target, key)) || r;
+    return c > 3 && r && Object.defineProperty(target, key, r), r;
+};
+var __metadata = (this && this.__metadata) || function (k, v) {
+    if (typeof Reflect === "object" && typeof Reflect.metadata === "function") return Reflect.metadata(k, v);
+};
+var __param = (this && this.__param) || function (paramIndex, decorator) {
+    return function (target, key) { decorator(target, key, paramIndex); }
+};
+var ImpersonationService_1;
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.ImpersonationService = void 0;
+// `Prisma` vem de @hed-hog/api-prisma, nao de '@prisma/client': o tsconfig do
+// monorepo mapeia '@prisma/client' para o client gerado, que nao expoe
+// `Prisma.sql`. E a convencao do repo inteiro.
+const api_prisma_1 = require("@hed-hog/api-prisma");
+const api_locale_1 = require("@hed-hog/api-locale");
+const api_pagination_1 = require("@hed-hog/api-pagination");
+const common_1 = require("@nestjs/common");
+const schedule_1 = require("@nestjs/schedule");
+const security_service_1 = require("../security/security.service");
+const session_service_1 = require("../session/session.service");
+const setting_service_1 = require("../setting/setting.service");
+const token_service_1 = require("../token/token.service");
+const user_service_1 = require("../user/user.service");
+/**
+ * Simulacao de acesso: um operador ve o sistema como outro usuario, por uma
+ * janela curta, com tudo marcado como simulado.
+ *
+ * DESENHO EM DUAS ETAPAS. `start` nao devolve token nenhum — devolve um codigo
+ * de uso unico com TTL de 60s, que viaja no FRAGMENT da URL da aba nova
+ * (fragment nao chega ao servidor, entao nao entra em log de acesso nem em
+ * Referer). Quem cria a sessao e o `redeem`, na aba de destino. Assim a sessao
+ * do operador nunca e tocada: nenhum cookie `rt` e emitido, nenhum
+ * `localStorage` compartilhado e sobrescrito.
+ *
+ * A SESSAO E NAO RENOVAVEL POR CONSTRUCAO. `SessionService.createImpersonation`
+ * gera o token opaco e o descarta, entao nao existe refresh token para ela em
+ * lugar nenhum — e nao apenas "e proibido renovar".
+ */
+let ImpersonationService = ImpersonationService_1 = class ImpersonationService {
+    constructor(prisma, security, setting, token, session, user, pagination) {
+        this.prisma = prisma;
+        this.security = security;
+        this.setting = setting;
+        this.token = token;
+        this.session = session;
+        this.user = user;
+        this.pagination = pagination;
+        this.logger = new common_1.Logger(ImpersonationService_1.name);
+        /** Curto: o codigo so precisa sobreviver ao carregamento da aba nova. */
+        this.codeTtlMs = 60000;
+    }
+    // ==========================================
+    // Etapa 1 — emissao do codigo
+    // ==========================================
+    async start(params) {
+        var _a;
+        const { locale, operatorUserId, targetUserId } = params;
+        if (params.isImpersonating) {
+            throw new common_1.ForbiddenException((0, api_locale_1.getLocaleText)('impersonation.nested', locale, 'You cannot start an access simulation from inside another one.'));
+        }
+        if (operatorUserId === targetUserId) {
+            throw new common_1.BadRequestException((0, api_locale_1.getLocaleText)('impersonation.self', locale, 'You cannot simulate your own access.'));
+        }
+        await this.assertTargetIsEligible(locale, targetUserId);
+        const origin = await this.resolveAppOrigin(locale, params.app);
+        const code = this.security.randomOpaque(32);
+        const codeHash = this.security.hashSha256(code);
+        const reason = ((_a = params.reason) === null || _a === void 0 ? void 0 : _a.trim()) ? params.reason.trim().slice(0, 255) : null;
+        const expiresAt = new Date(Date.now() + this.codeTtlMs);
+        const grant = await this.prisma.impersonation_grant.create({
+            data: {
+                code_hash: codeHash,
+                impersonator_user_id: operatorUserId,
+                target_user_id: targetUserId,
+                app: params.app,
+                reason,
+                issued_ip: params.ipAddress || null,
+                issued_user_agent: params.userAgent || null,
+                expires_at: expiresAt,
+            },
+            select: { id: true },
+        });
+        // A TENTATIVA ja vira auditoria, mesmo que o codigo nunca seja resgatado —
+        // pedir acesso a conta de alguem e o evento relevante, nao so consumi-lo.
+        await this.user.recordUserChange({
+            targetUserId,
+            actorUserId: operatorUserId,
+            action: 'impersonation_requested',
+            summary: `app=${params.app} grant=#${grant.id}${reason ? ` reason=${reason}` : ''}`,
+            ipAddress: params.ipAddress || null,
+        });
+        this.logger.log(`[Impersonation] grant=#${grant.id} operator=${operatorUserId} target=${targetUserId} app=${params.app} ip=${params.ipAddress}`);
+        return {
+            // O codigo vai no fragment: nunca chega ao servidor de destino, nao entra
+            // em access_log nem em Referer, e a tela de resgate o apaga com
+            // history.replaceState logo apos ler.
+            url: `${origin}${ImpersonationService_1.REDEEM_PATH}#code=${code}`,
+            expiresAt: expiresAt.toISOString(),
+        };
+    }
+    // ==========================================
+    // Etapa 2 — resgate na aba de destino
+    // ==========================================
+    async redeem(params) {
+        var _a;
+        const { locale } = params;
+        const codeHash = this.security.hashSha256((_a = params.code) !== null && _a !== void 0 ? _a : '');
+        // Consumo atomico: dois requests com o mesmo codigo — o caso de replay — so
+        // podem ter um vencedor, decidido pelo banco.
+        const rows = await this.prisma.$queryRaw(api_prisma_1.Prisma.sql `
+        UPDATE impersonation_grant
+        SET consumed_at = NOW(),
+            redeemed_ip = ${params.ipAddress || null},
+            redeemed_user_agent = ${params.userAgent || null}
+        WHERE code_hash = ${codeHash}
+          AND expires_at > NOW()
+          AND consumed_at IS NULL
+        RETURNING id, impersonator_user_id, target_user_id, app, reason
+      `);
+        const grant = rows[0];
+        if (!grant) {
+            // Uma mensagem so para todos os modos de falha (inexistente, expirado, ja
+            // usado): distingui-los entregaria um oraculo a quem tem so o codigo.
+            throw new common_1.BadRequestException((0, api_locale_1.getLocaleText)('impersonation.invalidCode', locale, 'Invalid, expired or already used simulation code.'));
+        }
+        // Revalida: o alvo pode ter virado admin ou sido desativado dentro dos 60s.
+        await this.assertTargetIsEligible(locale, grant.target_user_id);
+        const settings = await this.setting.getSettingValues(['impersonation-session-minutes']);
+        const minutes = Number(settings['impersonation-session-minutes']) || 30;
+        const session = await this.session.createImpersonation(locale, grant.target_user_id, grant.impersonator_user_id, params.ipAddress, params.userAgent, minutes, grant.reason);
+        // `expiresIn` por chamada: o token precisa morrer junto com a sessao, nao
+        // aos 15 minutos globais do JwtModule (e nao ha refresh para renova-lo).
+        const accessToken = await this.token.createAccessToken({
+            sub: grant.target_user_id,
+            sessionId: session.id,
+            act: grant.impersonator_user_id,
+            imp: true,
+        }, { expiresIn: minutes * 60 });
+        await this.prisma.impersonation_grant.update({
+            where: { id: grant.id },
+            data: { session_id: session.id },
+        });
+        const [operator, target] = await this.getUserPair(grant.impersonator_user_id, grant.target_user_id);
+        await Promise.all([
+            this.user.registerUserActivity(grant.target_user_id, 'impersonationStarted', grant.impersonator_user_id),
+            this.user.registerUserActivity(grant.impersonator_user_id, 'impersonationPerformed', grant.target_user_id),
+            this.user.recordUserChange({
+                targetUserId: grant.target_user_id,
+                actorUserId: grant.impersonator_user_id,
+                action: 'impersonation_started',
+                summary: `app=${grant.app} session=#${session.id} expires=${session.expires_at.toISOString()}${grant.reason ? ` reason=${grant.reason}` : ''}`,
+                ipAddress: params.ipAddress || null,
+            }),
+        ]);
+        this.logger.log(`[Impersonation] redeemed grant=#${grant.id} session=#${session.id} operator=${grant.impersonator_user_id} target=${grant.target_user_id} minutes=${minutes}`);
+        return {
+            accessToken,
+            expiresAt: session.expires_at.toISOString(),
+            sessionId: session.id,
+            app: grant.app,
+            operator,
+            target,
+        };
+    }
+    // ==========================================
+    // Encerrar
+    // ==========================================
+    /**
+     * Chamado pela propria sessao simulada, entao todos os identificadores vem do
+     * `request.auth` — nao ha parametro que permita encerrar sessao alheia.
+     */
+    async stop(params) {
+        if (!params.sessionId || !params.operatorUserId) {
+            return { ended: false };
+        }
+        const revoked = await this.prisma.user_session.updateMany({
+            where: {
+                id: params.sessionId,
+                revoked_at: null,
+                impersonator_user_id: { not: null },
+            },
+            data: { revoked_at: new Date() },
+        });
+        await this.prisma.impersonation_grant.updateMany({
+            where: { session_id: params.sessionId, ended_at: null },
+            data: { ended_at: new Date() },
+        });
+        if (revoked.count > 0) {
+            await Promise.all([
+                this.user.registerUserActivity(params.targetUserId, 'impersonationEnded', params.operatorUserId),
+                this.user.registerUserActivity(params.operatorUserId, 'impersonationPerformedEnded', params.targetUserId),
+                this.user.recordUserChange({
+                    targetUserId: params.targetUserId,
+                    actorUserId: params.operatorUserId,
+                    action: 'impersonation_ended',
+                    summary: `session=#${params.sessionId}`,
+                    ipAddress: params.ipAddress || null,
+                }),
+            ]);
+        }
+        this.logger.log(`[Impersonation] stopped session=#${params.sessionId} operator=${params.operatorUserId} target=${params.targetUserId} revoked=${revoked.count}`);
+        return { ended: revoked.count > 0 };
+    }
+    // ==========================================
+    // Leitura
+    // ==========================================
+    /**
+     * Fonte de verdade do banner. A `sessionStorage` do cliente e so cache — e
+     * gravavel pelo proprio navegador, entao nao serve para decidir nada.
+     */
+    async currentSession(sessionId) {
+        if (!sessionId) {
+            return { active: false };
+        }
+        const session = await this.prisma.user_session.findUnique({
+            where: { id: sessionId },
+            select: {
+                user_id: true,
+                impersonator_user_id: true,
+                impersonation_reason: true,
+                expires_at: true,
+                revoked_at: true,
+            },
+        });
+        if (!(session === null || session === void 0 ? void 0 : session.impersonator_user_id) || session.revoked_at) {
+            return { active: false };
+        }
+        const [operator, target] = await this.getUserPair(session.impersonator_user_id, session.user_id);
+        return {
+            active: true,
+            operator,
+            target,
+            reason: session.impersonation_reason,
+            expiresAt: session.expires_at.toISOString(),
+        };
+    }
+    /** Apps que o operador pode escolher como destino. */
+    async listRedeemableApps() {
+        const settings = await this.setting.getSettingValues(['app-urls']);
+        const entries = this.parseAppUrls(settings['app-urls']);
+        return ImpersonationService_1.REDEEMABLE_APPS.filter((key) => entries.has(key)).map((key) => ({ key, url: entries.get(key) }));
+    }
+    async history(paginationParams, filters) {
+        const where = {};
+        if (filters.targetUserId) {
+            where.target_user_id = filters.targetUserId;
+        }
+        const paginated = await this.pagination.paginatePrismaModel(this.prisma.impersonation_grant, Object.assign(Object.assign({}, paginationParams), { sortField: (paginationParams === null || paginationParams === void 0 ? void 0 : paginationParams.sortField) || 'created_at', sortOrder: (paginationParams === null || paginationParams === void 0 ? void 0 : paginationParams.sortOrder) || 'desc', validSortFields: ['id', 'created_at', 'consumed_at', 'ended_at'], where }));
+        const rows = (paginated.data || []);
+        const ids = [
+            ...new Set(rows.flatMap((row) => [row.impersonator_user_id, row.target_user_id])),
+        ].filter((id) => typeof id === 'number');
+        const users = ids.length
+            ? await this.prisma.user.findMany({
+                where: { id: { in: ids } },
+                select: { id: true, name: true },
+            })
+            : [];
+        const byId = new Map(users.map((user) => [user.id, user]));
+        return Object.assign(Object.assign({}, paginated), { data: rows.map((row) => {
+                var _a, _b, _c, _d, _e, _f, _g, _h, _j, _k, _l, _m, _o, _p;
+                return ({
+                    // `code_hash` nunca sai daqui.
+                    id: row.id,
+                    app: row.app,
+                    reason: row.reason,
+                    sessionId: row.session_id,
+                    operator: (_a = byId.get(row.impersonator_user_id)) !== null && _a !== void 0 ? _a : null,
+                    target: (_b = byId.get(row.target_user_id)) !== null && _b !== void 0 ? _b : null,
+                    issuedIp: row.issued_ip,
+                    redeemedIp: row.redeemed_ip,
+                    consumedAt: (_e = (_d = (_c = row.consumed_at) === null || _c === void 0 ? void 0 : _c.toISOString) === null || _d === void 0 ? void 0 : _d.call(_c)) !== null && _e !== void 0 ? _e : null,
+                    endedAt: (_h = (_g = (_f = row.ended_at) === null || _f === void 0 ? void 0 : _f.toISOString) === null || _g === void 0 ? void 0 : _g.call(_f)) !== null && _h !== void 0 ? _h : null,
+                    expiresAt: (_l = (_k = (_j = row.expires_at) === null || _j === void 0 ? void 0 : _j.toISOString) === null || _k === void 0 ? void 0 : _k.call(_j)) !== null && _l !== void 0 ? _l : null,
+                    createdAt: (_p = (_o = (_m = row.created_at) === null || _m === void 0 ? void 0 : _m.toISOString) === null || _o === void 0 ? void 0 : _o.call(_m)) !== null && _p !== void 0 ? _p : null,
+                });
+            }) });
+    }
+    // ==========================================
+    // Manutencao
+    // ==========================================
+    /**
+     * Concessoes nao resgatadas viram lixo em 60s. As consumidas ficam: sao a
+     * trilha de auditoria.
+     */
+    async purgeExpired() {
+        const { count } = await this.prisma.impersonation_grant.deleteMany({
+            where: {
+                consumed_at: null,
+                expires_at: { lt: new Date(Date.now() - 24 * 60 * 60 * 1000) },
+            },
+        });
+        if (count > 0) {
+            this.logger.log(`[Impersonation] purged ${count} unredeemed grant(s)`);
+        }
+    }
+    // ==========================================
+    // Helpers
+    // ==========================================
+    async assertTargetIsEligible(locale, targetUserId) {
+        const target = await this.prisma.user.findUnique({
+            where: { id: targetUserId },
+            select: {
+                id: true,
+                deactivated_at: true,
+                role_user: { select: { role: { select: { slug: true } } } },
+            },
+        });
+        if (!target) {
+            throw new common_1.NotFoundException((0, api_locale_1.getLocaleText)('userNotFound', locale, 'User not found'));
+        }
+        // Conta excluida pelo proprio usuario: os identificadores ja foram
+        // anonimizados, entao nao ha o que simular.
+        if (target.deactivated_at) {
+            throw new common_1.BadRequestException((0, api_locale_1.getLocaleText)('impersonation.deactivatedTarget', locale, 'This account has been deactivated and cannot be simulated.'));
+        }
+        // Conta suspensa CONTINUA simulavel de proposito: "o usuario nao consegue
+        // entrar" e justamente o chamado de suporte mais comum.
+        const slugs = target.role_user.map((link) => { var _a; return (_a = link.role) === null || _a === void 0 ? void 0 : _a.slug; }).filter(Boolean);
+        if (slugs.some((slug) => ImpersonationService_1.BLOCKED_TARGET_ROLES.includes(slug))) {
+            throw new common_1.ForbiddenException((0, api_locale_1.getLocaleText)('impersonation.privilegedTarget', locale, 'Administrators cannot be simulated.'));
+        }
+    }
+    async resolveAppOrigin(locale, app) {
+        if (!ImpersonationService_1.REDEEMABLE_APPS.includes(app)) {
+            throw new common_1.BadRequestException((0, api_locale_1.getLocaleText)('impersonation.unknownApp', locale, 'This application does not support access simulation.'));
+        }
+        const settings = await this.setting.getSettingValues(['app-urls']);
+        const origin = this.parseAppUrls(settings['app-urls']).get(app);
+        if (!origin) {
+            throw new common_1.BadRequestException((0, api_locale_1.getLocaleText)('impersonation.appNotConfigured', locale, 'This application has no URL configured in the app-urls setting.'));
+        }
+        return origin;
+    }
+    /**
+     * `app-urls` e uma lista de `chave=url`. Mesmo formato lido por
+     * `ChallengeService.resolveAppKeyFromOrigin` e `OAuthService`.
+     */
+    parseAppUrls(value) {
+        const entries = new Map();
+        const list = Array.isArray(value) ? value : [];
+        for (const entry of list) {
+            const separatorIndex = entry.indexOf('=');
+            if (separatorIndex === -1)
+                continue;
+            const key = entry.slice(0, separatorIndex).trim();
+            const url = entry.slice(separatorIndex + 1).trim().replace(/\/+$/, '');
+            if (key && url)
+                entries.set(key, url);
+        }
+        return entries;
+    }
+    async getUserPair(operatorId, targetId) {
+        var _a, _b;
+        const users = await this.prisma.user.findMany({
+            where: { id: { in: [operatorId, targetId] } },
+            select: { id: true, name: true },
+        });
+        const byId = new Map(users.map((user) => [user.id, user]));
+        return [
+            (_a = byId.get(operatorId)) !== null && _a !== void 0 ? _a : { id: operatorId, name: '' },
+            (_b = byId.get(targetId)) !== null && _b !== void 0 ? _b : { id: targetId, name: '' },
+        ];
+    }
+};
+exports.ImpersonationService = ImpersonationService;
+/** Caminho da tela de resgate, igual nos tres apps. */
+ImpersonationService.REDEEM_PATH = '/simulacao';
+/**
+ * Simular quem ja e administrador nao ajuda em nada no suporte e transformaria
+ * o papel `admin-impersonation` num atalho para virar `admin`.
+ */
+ImpersonationService.BLOCKED_TARGET_ROLES = ['admin', 'admin-impersonation'];
+/**
+ * Apps com tela de resgate. `training` tem autenticacao propria e nao usa o
+ * @hed-hog/next-app-provider, entao ficou fora desta fase.
+ */
+ImpersonationService.REDEEMABLE_APPS = ['admin', 'class', 'partners'];
+__decorate([
+    (0, schedule_1.Cron)(schedule_1.CronExpression.EVERY_DAY_AT_4AM),
+    __metadata("design:type", Function),
+    __metadata("design:paramtypes", []),
+    __metadata("design:returntype", Promise)
+], ImpersonationService.prototype, "purgeExpired", null);
+exports.ImpersonationService = ImpersonationService = ImpersonationService_1 = __decorate([
+    (0, common_1.Injectable)(),
+    __param(0, (0, common_1.Inject)((0, common_1.forwardRef)(() => api_prisma_1.PrismaService))),
+    __param(1, (0, common_1.Inject)((0, common_1.forwardRef)(() => security_service_1.SecurityService))),
+    __param(2, (0, common_1.Inject)((0, common_1.forwardRef)(() => setting_service_1.SettingService))),
+    __param(3, (0, common_1.Inject)((0, common_1.forwardRef)(() => token_service_1.TokenService))),
+    __param(4, (0, common_1.Inject)((0, common_1.forwardRef)(() => session_service_1.SessionService))),
+    __param(5, (0, common_1.Inject)((0, common_1.forwardRef)(() => user_service_1.UserService))),
+    __param(6, (0, common_1.Inject)((0, common_1.forwardRef)(() => api_pagination_1.PaginationService))),
+    __metadata("design:paramtypes", [api_prisma_1.PrismaService,
+        security_service_1.SecurityService,
+        setting_service_1.SettingService,
+        token_service_1.TokenService,
+        session_service_1.SessionService,
+        user_service_1.UserService,
+        api_pagination_1.PaginationService])
+], ImpersonationService);
+//# sourceMappingURL=impersonation.service.js.map