@hed-hog/core 0.0.387 → 0.0.393

package/dist/integration-profile/testers/payment.testers.js

@@ -0,0 +1,169 @@
+"use strict";
+var __createBinding = (this && this.__createBinding) || (Object.create ? (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    var desc = Object.getOwnPropertyDescriptor(m, k);
+    if (!desc || ("get" in desc ? !m.__esModule : desc.writable || desc.configurable)) {
+      desc = { enumerable: true, get: function() { return m[k]; } };
+    }
+    Object.defineProperty(o, k2, desc);
+}) : (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    o[k2] = m[k];
+}));
+var __setModuleDefault = (this && this.__setModuleDefault) || (Object.create ? (function(o, v) {
+    Object.defineProperty(o, "default", { enumerable: true, value: v });
+}) : function(o, v) {
+    o["default"] = v;
+});
+var __importStar = (this && this.__importStar) || (function () {
+    var ownKeys = function(o) {
+        ownKeys = Object.getOwnPropertyNames || function (o) {
+            var ar = [];
+            for (var k in o) if (Object.prototype.hasOwnProperty.call(o, k)) ar[ar.length] = k;
+            return ar;
+        };
+        return ownKeys(o);
+    };
+    return function (mod) {
+        if (mod && mod.__esModule) return mod;
+        var result = {};
+        if (mod != null) for (var k = ownKeys(mod), i = 0; i < k.length; i++) if (k[i] !== "default") __createBinding(result, mod, k[i]);
+        __setModuleDefault(result, mod);
+        return result;
+    };
+})();
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.PAYMENT_TESTERS = void 0;
+const jwt = __importStar(require("jsonwebtoken"));
+const http_probe_1 = require("./http-probe");
+/**
+ * Testadores dos gateways de pagamento.
+ *
+ * Todos usam leitura da conta — nunca criam cobrança, assinatura ou qualquer coisa
+ * que apareça no extrato do cliente.
+ */
+const stripeTester = {
+    providerSlug: 'stripe',
+    test: async (config, ctx) => {
+        var _a, _b;
+        const missing = (0, http_probe_1.requireFields)(config, [['secret_key', 'Secret key']]);
+        if (missing)
+            return missing;
+        const secretKey = String((_a = config.secret_key) !== null && _a !== void 0 ? _a : '');
+        const result = await (0, http_probe_1.probeJson)('https://api.stripe.com/v1/balance', {
+            headers: {
+                // Stripe usa Basic com a chave como usuário e senha vazia.
+                Authorization: `Basic ${Buffer.from(`${secretKey}:`).toString('base64')}`,
+            },
+        }, ctx.signal);
+        if (result.status === 401)
+            return (0, http_probe_1.fail)('Invalid Stripe secret key.');
+        if (!result.ok) {
+            return (0, http_probe_1.fail)((0, http_probe_1.describeHttpError)(result, 'Stripe rejected the credentials.'));
+        }
+        // Chave de teste num perfil de produção é o erro clássico — e só aparece quando
+        // a primeira cobrança real não acontece.
+        const livemode = Boolean((_b = result.body) === null || _b === void 0 ? void 0 : _b.livemode);
+        const mode = (0, http_probe_1.str)(config, 'mode').toLowerCase();
+        const label = `Stripe — ${livemode ? 'live' : 'test'} mode`;
+        if (mode === 'production' && !livemode) {
+            return (0, http_probe_1.pass)(label, 'This profile is set to production but the key is a test key.');
+        }
+        if (mode === 'sandbox' && livemode) {
+            return (0, http_probe_1.pass)(label, 'This profile is set to sandbox but the key is a live key.');
+        }
+        return (0, http_probe_1.pass)(label);
+    },
+};
+const mercadoPagoTester = {
+    providerSlug: 'mercado_pago',
+    test: async (config, ctx) => {
+        var _a, _b, _c, _d, _e;
+        const missing = (0, http_probe_1.requireFields)(config, [['access_token', 'Access token']]);
+        if (missing)
+            return missing;
+        const result = await (0, http_probe_1.probeJson)('https://api.mercadopago.com/users/me', { headers: { Authorization: `Bearer ${String((_a = config.access_token) !== null && _a !== void 0 ? _a : '')}` } }, ctx.signal);
+        if (result.status === 401 || result.status === 403) {
+            return (0, http_probe_1.fail)('Invalid Mercado Pago access token.');
+        }
+        if (!result.ok) {
+            return (0, http_probe_1.fail)((0, http_probe_1.describeHttpError)(result, 'Mercado Pago rejected the credentials.'));
+        }
+        const nickname = String((_c = (_b = result.body) === null || _b === void 0 ? void 0 : _b.nickname) !== null && _c !== void 0 ? _c : '').trim();
+        const siteId = String((_e = (_d = result.body) === null || _d === void 0 ? void 0 : _d.site_id) !== null && _e !== void 0 ? _e : '').trim();
+        return (0, http_probe_1.pass)([nickname, siteId].filter(Boolean).join(' — ') || 'Mercado Pago account');
+    },
+};
+const googlePlayTester = {
+    providerSlug: 'google_play',
+    test: async (config, ctx) => {
+        var _a, _b, _c, _d, _e, _f, _g;
+        const missing = (0, http_probe_1.requireFields)(config, [['package_name', 'Package name']]);
+        if (missing)
+            return missing;
+        // O serviço aceita o JSON completo OU client_email + private_key avulsos.
+        let clientEmail = (0, http_probe_1.str)(config, 'client_email');
+        let privateKey = String((_a = config.private_key) !== null && _a !== void 0 ? _a : '');
+        const serviceAccountJson = String((_b = config.service_account_json) !== null && _b !== void 0 ? _b : '').trim();
+        if (serviceAccountJson) {
+            try {
+                const parsed = JSON.parse(serviceAccountJson);
+                clientEmail = String((_c = parsed.client_email) !== null && _c !== void 0 ? _c : clientEmail);
+                privateKey = String((_d = parsed.private_key) !== null && _d !== void 0 ? _d : privateKey);
+            }
+            catch (_h) {
+                return (0, http_probe_1.fail)('The service account JSON is not valid JSON.');
+            }
+        }
+        if (!clientEmail || !privateKey) {
+            return (0, http_probe_1.fail)('Provide the service account JSON, or the client email and private key.');
+        }
+        // JWT bearer flow: a troca por access token já prova a chave da service account.
+        let assertion;
+        try {
+            const now = Math.floor(Date.now() / 1000);
+            assertion = jwt.sign({
+                iss: clientEmail,
+                scope: 'https://www.googleapis.com/auth/androidpublisher',
+                aud: 'https://oauth2.googleapis.com/token',
+                iat: now,
+                exp: now + 300,
+            }, privateKey.replace(/\\n/g, '\n'), { algorithm: 'RS256' });
+        }
+        catch (_j) {
+            return (0, http_probe_1.fail)('Could not sign with the service account private key.');
+        }
+        const token = await (0, http_probe_1.probeJson)('https://oauth2.googleapis.com/token', {
+            method: 'POST',
+            headers: { 'Content-Type': 'application/x-www-form-urlencoded' },
+            body: new URLSearchParams({
+                grant_type: 'urn:ietf:params:oauth:grant-type:jwt-bearer',
+                assertion,
+            }).toString(),
+        }, ctx.signal);
+        if (!token.ok || !((_e = token.body) === null || _e === void 0 ? void 0 : _e.access_token)) {
+            const description = String((_g = (_f = token.body) === null || _f === void 0 ? void 0 : _f.error_description) !== null && _g !== void 0 ? _g : '');
+            if (/invalid_grant|Invalid JWT/i.test(description)) {
+                return (0, http_probe_1.fail)('Google rejected the service account. Check the client email and the private key.');
+            }
+            return (0, http_probe_1.fail)((0, http_probe_1.describeHttpError)(token, 'Google rejected the service account.'));
+        }
+        const packageName = (0, http_probe_1.str)(config, 'package_name');
+        const app = await (0, http_probe_1.probeJson)(`https://androidpublisher.googleapis.com/androidpublisher/v3/applications/${encodeURIComponent(packageName)}/inappproducts?maxResults=1`, { headers: { Authorization: `Bearer ${token.body.access_token}` } }, ctx.signal);
+        // Credencial válida; o vínculo com o app no Play Console é outra configuração,
+        // feita no console e não aqui.
+        if (app.status === 401 || app.status === 403) {
+            return (0, http_probe_1.pass)(`Service account ${clientEmail}`, `The service account has no access to "${packageName}" in the Play Console yet.`);
+        }
+        if (app.status === 404) {
+            return (0, http_probe_1.pass)(`Service account ${clientEmail}`, `The app "${packageName}" was not found in this account.`);
+        }
+        return (0, http_probe_1.pass)(`${packageName} — ${clientEmail}`);
+    },
+};
+exports.PAYMENT_TESTERS = [
+    stripeTester,
+    mercadoPagoTester,
+    googlePlayTester,
+];
+//# sourceMappingURL=payment.testers.js.map

package/dist/integration-profile/testers/payment.testers.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"payment.testers.js","sourceRoot":"","sources":["../../../src/integration-profile/testers/payment.testers.ts"],"names":[],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;AAAA,kDAAoC;AACpC,6CAOsB;AAGtB;;;;;GAKG;AAEH,MAAM,YAAY,GAAsB;IACtC,YAAY,EAAE,QAAQ;IACtB,IAAI,EAAE,KAAK,EAAE,MAAM,EAAE,GAAG,EAAE,EAAE;;QAC1B,MAAM,OAAO,GAAG,IAAA,0BAAa,EAAC,MAAM,EAAE,CAAC,CAAC,YAAY,EAAE,YAAY,CAAC,CAAC,CAAC,CAAC;QACtE,IAAI,OAAO;YAAE,OAAO,OAAO,CAAC;QAE5B,MAAM,SAAS,GAAG,MAAM,CAAC,MAAA,MAAM,CAAC,UAAU,mCAAI,EAAE,CAAC,CAAC;QAClD,MAAM,MAAM,GAAG,MAAM,IAAA,sBAAS,EAC5B,mCAAmC,EACnC;YACE,OAAO,EAAE;gBACP,2DAA2D;gBAC3D,aAAa,EAAE,SAAS,MAAM,CAAC,IAAI,CAAC,GAAG,SAAS,GAAG,CAAC,CAAC,QAAQ,CAAC,QAAQ,CAAC,EAAE;aAC1E;SACF,EACD,GAAG,CAAC,MAAM,CACX,CAAC;QAEF,IAAI,MAAM,CAAC,MAAM,KAAK,GAAG;YAAE,OAAO,IAAA,iBAAI,EAAC,4BAA4B,CAAC,CAAC;QACrE,IAAI,CAAC,MAAM,CAAC,EAAE,EAAE,CAAC;YACf,OAAO,IAAA,iBAAI,EAAC,IAAA,8BAAiB,EAAC,MAAM,EAAE,kCAAkC,CAAC,CAAC,CAAC;QAC7E,CAAC;QAED,gFAAgF;QAChF,yCAAyC;QACzC,MAAM,QAAQ,GAAG,OAAO,CAAC,MAAA,MAAM,CAAC,IAAI,0CAAE,QAAQ,CAAC,CAAC;QAChD,MAAM,IAAI,GAAG,IAAA,gBAAG,EAAC,MAAM,EAAE,MAAM,CAAC,CAAC,WAAW,EAAE,CAAC;QAC/C,MAAM,KAAK,GAAG,YAAY,QAAQ,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,MAAM,OAAO,CAAC;QAE5D,IAAI,IAAI,KAAK,YAAY,IAAI,CAAC,QAAQ,EAAE,CAAC;YACvC,OAAO,IAAA,iBAAI,EAAC,KAAK,EAAE,8DAA8D,CAAC,CAAC;QACrF,CAAC;QACD,IAAI,IAAI,KAAK,SAAS,IAAI,QAAQ,EAAE,CAAC;YACnC,OAAO,IAAA,iBAAI,EAAC,KAAK,EAAE,2DAA2D,CAAC,CAAC;QAClF,CAAC;QACD,OAAO,IAAA,iBAAI,EAAC,KAAK,CAAC,CAAC;IACrB,CAAC;CACF,CAAC;AAEF,MAAM,iBAAiB,GAAsB;IAC3C,YAAY,EAAE,cAAc;IAC5B,IAAI,EAAE,KAAK,EAAE,MAAM,EAAE,GAAG,EAAE,EAAE;;QAC1B,MAAM,OAAO,GAAG,IAAA,0BAAa,EAAC,MAAM,EAAE,CAAC,CAAC,cAAc,EAAE,cAAc,CAAC,CAAC,CAAC,CAAC;QAC1E,IAAI,OAAO;YAAE,OAAO,OAAO,CAAC;QAE5B,MAAM,MAAM,GAAG,MAAM,IAAA,sBAAS,EAC5B,sCAAsC,EACtC,EAAE,OAAO,EAAE,EAAE,aAAa,EAAE,UAAU,MAAM,CAAC,MAAA,MAAM,CAAC,YAAY,mCAAI,EAAE,CAAC,EAAE,EAAE,EAAE,EAC7E,GAAG,CAAC,MAAM,CACX,CAAC;QAEF,IAAI,MAAM,CAAC,MAAM,KAAK,GAAG,IAAI,MAAM,CAAC,MAAM,KAAK,GAAG,EAAE,CAAC;YACnD,OAAO,IAAA,iBAAI,EAAC,oCAAoC,CAAC,CAAC;QACpD,CAAC;QACD,IAAI,CAAC,MAAM,CAAC,EAAE,EAAE,CAAC;YACf,OAAO,IAAA,iBAAI,EAAC,IAAA,8BAAiB,EAAC,MAAM,EAAE,wCAAwC,CAAC,CAAC,CAAC;QACnF,CAAC;QAED,MAAM,QAAQ,GAAG,MAAM,CAAC,MAAA,MAAA,MAAM,CAAC,IAAI,0CAAE,QAAQ,mCAAI,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC;QAC5D,MAAM,MAAM,GAAG,MAAM,CAAC,MAAA,MAAA,MAAM,CAAC,IAAI,0CAAE,OAAO,mCAAI,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC;QACzD,OAAO,IAAA,iBAAI,EACT,CAAC,QAAQ,EAAE,MAAM,CAAC,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,IAAI,sBAAsB,CACzE,CAAC;IACJ,CAAC;CACF,CAAC;AAEF,MAAM,gBAAgB,GAAsB;IAC1C,YAAY,EAAE,aAAa;IAC3B,IAAI,EAAE,KAAK,EAAE,MAAM,EAAE,GAAG,EAAE,EAAE;;QAC1B,MAAM,OAAO,GAAG,IAAA,0BAAa,EAAC,MAAM,EAAE,CAAC,CAAC,cAAc,EAAE,cAAc,CAAC,CAAC,CAAC,CAAC;QAC1E,IAAI,OAAO;YAAE,OAAO,OAAO,CAAC;QAE5B,0EAA0E;QAC1E,IAAI,WAAW,GAAG,IAAA,gBAAG,EAAC,MAAM,EAAE,cAAc,CAAC,CAAC;QAC9C,IAAI,UAAU,GAAG,MAAM,CAAC,MAAA,MAAM,CAAC,WAAW,mCAAI,EAAE,CAAC,CAAC;QAElD,MAAM,kBAAkB,GAAG,MAAM,CAAC,MAAA,MAAM,CAAC,oBAAoB,mCAAI,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC;QAC5E,IAAI,kBAAkB,EAAE,CAAC;YACvB,IAAI,CAAC;gBACH,MAAM,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,kBAAkB,CAAC,CAAC;gBAC9C,WAAW,GAAG,MAAM,CAAC,MAAA,MAAM,CAAC,YAAY,mCAAI,WAAW,CAAC,CAAC;gBACzD,UAAU,GAAG,MAAM,CAAC,MAAA,MAAM,CAAC,WAAW,mCAAI,UAAU,CAAC,CAAC;YACxD,CAAC;YAAC,WAAM,CAAC;gBACP,OAAO,IAAA,iBAAI,EAAC,6CAA6C,CAAC,CAAC;YAC7D,CAAC;QACH,CAAC;QAED,IAAI,CAAC,WAAW,IAAI,CAAC,UAAU,EAAE,CAAC;YAChC,OAAO,IAAA,iBAAI,EACT,wEAAwE,CACzE,CAAC;QACJ,CAAC;QAED,iFAAiF;QACjF,IAAI,SAAiB,CAAC;QACtB,IAAI,CAAC;YACH,MAAM,GAAG,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,GAAG,EAAE,GAAG,IAAI,CAAC,CAAC;YAC1C,SAAS,GAAG,GAAG,CAAC,IAAI,CAClB;gBACE,GAAG,EAAE,WAAW;gBAChB,KAAK,EAAE,kDAAkD;gBACzD,GAAG,EAAE,qCAAqC;gBAC1C,GAAG,EAAE,GAAG;gBACR,GAAG,EAAE,GAAG,GAAG,GAAG;aACf,EACD,UAAU,CAAC,OAAO,CAAC,MAAM,EAAE,IAAI,CAAC,EAChC,EAAE,SAAS,EAAE,OAAO,EAAE,CACvB,CAAC;QACJ,CAAC;QAAC,WAAM,CAAC;YACP,OAAO,IAAA,iBAAI,EAAC,sDAAsD,CAAC,CAAC;QACtE,CAAC;QAED,MAAM,KAAK,GAAG,MAAM,IAAA,sBAAS,EAC3B,qCAAqC,EACrC;YACE,MAAM,EAAE,MAAM;YACd,OAAO,EAAE,EAAE,cAAc,EAAE,mCAAmC,EAAE;YAChE,IAAI,EAAE,IAAI,eAAe,CAAC;gBACxB,UAAU,EAAE,6CAA6C;gBACzD,SAAS;aACV,CAAC,CAAC,QAAQ,EAAE;SACd,EACD,GAAG,CAAC,MAAM,CACX,CAAC;QAEF,IAAI,CAAC,KAAK,CAAC,EAAE,IAAI,CAAC,CAAA,MAAA,KAAK,CAAC,IAAI,0CAAE,YAAY,CAAA,EAAE,CAAC;YAC3C,MAAM,WAAW,GAAG,MAAM,CAAC,MAAA,MAAA,KAAK,CAAC,IAAI,0CAAE,iBAAiB,mCAAI,EAAE,CAAC,CAAC;YAChE,IAAI,4BAA4B,CAAC,IAAI,CAAC,WAAW,CAAC,EAAE,CAAC;gBACnD,OAAO,IAAA,iBAAI,EACT,kFAAkF,CACnF,CAAC;YACJ,CAAC;YACD,OAAO,IAAA,iBAAI,EAAC,IAAA,8BAAiB,EAAC,KAAK,EAAE,sCAAsC,CAAC,CAAC,CAAC;QAChF,CAAC;QAED,MAAM,WAAW,GAAG,IAAA,gBAAG,EAAC,MAAM,EAAE,cAAc,CAAC,CAAC;QAChD,MAAM,GAAG,GAAG,MAAM,IAAA,sBAAS,EACzB,4EAA4E,kBAAkB,CAC5F,WAAW,CACZ,6BAA6B,EAC9B,EAAE,OAAO,EAAE,EAAE,aAAa,EAAE,UAAU,KAAK,CAAC,IAAI,CAAC,YAAY,EAAE,EAAE,EAAE,EACnE,GAAG,CAAC,MAAM,CACX,CAAC;QAEF,+EAA+E;QAC/E,+BAA+B;QAC/B,IAAI,GAAG,CAAC,MAAM,KAAK,GAAG,IAAI,GAAG,CAAC,MAAM,KAAK,GAAG,EAAE,CAAC;YAC7C,OAAO,IAAA,iBAAI,EACT,mBAAmB,WAAW,EAAE,EAChC,yCAAyC,WAAW,4BAA4B,CACjF,CAAC;QACJ,CAAC;QACD,IAAI,GAAG,CAAC,MAAM,KAAK,GAAG,EAAE,CAAC;YACvB,OAAO,IAAA,iBAAI,EACT,mBAAmB,WAAW,EAAE,EAChC,YAAY,WAAW,kCAAkC,CAC1D,CAAC;QACJ,CAAC;QACD,OAAO,IAAA,iBAAI,EAAC,GAAG,WAAW,MAAM,WAAW,EAAE,CAAC,CAAC;IACjD,CAAC;CACF,CAAC;AAEW,QAAA,eAAe,GAAwB;IAClD,YAAY;IACZ,iBAAiB;IACjB,gBAAgB;CACjB,CAAC"}

package/dist/integration-profile/testers/storage.testers.d.ts

@@ -0,0 +1,3 @@
+import { IntegrationTester } from './integration-tester.types';
+export declare const STORAGE_TESTERS: IntegrationTester[];
+//# sourceMappingURL=storage.testers.d.ts.map

package/dist/integration-profile/testers/storage.testers.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"storage.testers.d.ts","sourceRoot":"","sources":["../../../src/integration-profile/testers/storage.testers.ts"],"names":[],"mappings":"AAKA,OAAO,EAAE,iBAAiB,EAA0B,MAAM,4BAA4B,CAAC;AAsNvF,eAAO,MAAM,eAAe,EAAE,iBAAiB,EAM9C,CAAC"}

package/dist/integration-profile/testers/storage.testers.js

@@ -0,0 +1,208 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.STORAGE_TESTERS = void 0;
+const client_s3_1 = require("@aws-sdk/client-s3");
+const storage_blob_1 = require("@azure/storage-blob");
+const storage_1 = require("@google-cloud/storage");
+const promises_1 = require("node:fs/promises");
+const http_probe_1 = require("./http-probe");
+/**
+ * Testadores dos providers de storage.
+ *
+ * Todos usam uma operação de LEITURA (HeadBucket, getMetadata, getProperties): provam
+ * credencial, existência do bucket/container e permissão sem escrever nada na conta
+ * do cliente.
+ */
+/** Traduz o erro dos SDKs S3 em algo que o operador consiga agir. */
+async function headS3Bucket(client, bucket, label, signal) {
+    var _a, _b, _c;
+    try {
+        await client.send(new client_s3_1.HeadBucketCommand({ Bucket: bucket }), {
+            abortSignal: signal,
+        });
+        return (0, http_probe_1.pass)(label);
+    }
+    catch (error) {
+        const err = error;
+        const status = (_a = err === null || err === void 0 ? void 0 : err.$metadata) === null || _a === void 0 ? void 0 : _a.httpStatusCode;
+        const name = String((_b = err === null || err === void 0 ? void 0 : err.name) !== null && _b !== void 0 ? _b : '');
+        if (name === 'InvalidAccessKeyId' || status === 401) {
+            return (0, http_probe_1.fail)('Invalid access key ID.');
+        }
+        if (name === 'SignatureDoesNotMatch') {
+            return (0, http_probe_1.fail)('Invalid secret access key.');
+        }
+        if (name === 'NotFound' || status === 404) {
+            return (0, http_probe_1.fail)(`Bucket "${bucket}" was not found.`);
+        }
+        if (name === 'Forbidden' || status === 403) {
+            return (0, http_probe_1.fail)(`These credentials have no permission to access the bucket "${bucket}".`);
+        }
+        if (name === 'PermanentRedirect' || status === 301) {
+            return (0, http_probe_1.fail)(`Bucket "${bucket}" lives in another region.`);
+        }
+        return (0, http_probe_1.fail)(String((_c = err === null || err === void 0 ? void 0 : err.message) !== null && _c !== void 0 ? _c : 'Could not reach the bucket.'));
+    }
+    finally {
+        client.destroy();
+    }
+}
+const localTester = {
+    providerSlug: 'local',
+    test: async (config) => {
+        var _a;
+        const basePath = (0, http_probe_1.str)(config, 'base_path') || 'storage';
+        try {
+            // Só checa permissão — escrever um arquivo de teste sujaria o storage do cliente.
+            await (0, promises_1.access)(basePath, promises_1.constants.R_OK | promises_1.constants.W_OK);
+            return (0, http_probe_1.pass)(basePath);
+        }
+        catch (error) {
+            const code = String((_a = error === null || error === void 0 ? void 0 : error.code) !== null && _a !== void 0 ? _a : '');
+            if (code === 'ENOENT') {
+                return (0, http_probe_1.fail)(`The directory "${basePath}" does not exist.`);
+            }
+            if (code === 'EACCES' || code === 'EPERM') {
+                return (0, http_probe_1.fail)(`No read/write permission on the directory "${basePath}".`);
+            }
+            return (0, http_probe_1.fail)(`Could not access the directory "${basePath}".`);
+        }
+    },
+};
+const s3Tester = {
+    providerSlug: 's3',
+    test: async (config, ctx) => {
+        var _a, _b;
+        const missing = (0, http_probe_1.requireFields)(config, [
+            ['access_key_id', 'Access key ID'],
+            ['secret_access_key', 'Secret access key'],
+            ['bucket', 'Bucket'],
+        ]);
+        if (missing)
+            return missing;
+        const region = (0, http_probe_1.str)(config, 'region') || 'us-east-1';
+        const bucket = (0, http_probe_1.str)(config, 'bucket');
+        const sessionToken = String((_a = config.session_token) !== null && _a !== void 0 ? _a : '').trim();
+        const client = new client_s3_1.S3Client({
+            region,
+            credentials: Object.assign({ accessKeyId: (0, http_probe_1.str)(config, 'access_key_id'), secretAccessKey: String((_b = config.secret_access_key) !== null && _b !== void 0 ? _b : '') }, (sessionToken ? { sessionToken } : {})),
+        });
+        return headS3Bucket(client, bucket, `${bucket} (${region})`, ctx.signal);
+    },
+};
+const s3CompatibleTester = {
+    providerSlug: 's3-compatible',
+    test: async (config, ctx) => {
+        var _a;
+        const missing = (0, http_probe_1.requireFields)(config, [
+            ['endpoint', 'Endpoint'],
+            ['access_key_id', 'Access key ID'],
+            ['secret_access_key', 'Secret access key'],
+            ['bucket', 'Bucket'],
+        ]);
+        if (missing)
+            return missing;
+        const endpoint = (0, http_probe_1.assertHttpUrl)((0, http_probe_1.str)(config, 'endpoint'), 'Endpoint');
+        const bucket = (0, http_probe_1.str)(config, 'bucket');
+        const region = (0, http_probe_1.str)(config, 'region') || 'us-east-1';
+        const client = new client_s3_1.S3Client({
+            region,
+            endpoint: endpoint.origin,
+            // Provedores compatíveis (MinIO, Ceph) raramente resolvem bucket por subdomínio.
+            forcePathStyle: true,
+            credentials: {
+                accessKeyId: (0, http_probe_1.str)(config, 'access_key_id'),
+                secretAccessKey: String((_a = config.secret_access_key) !== null && _a !== void 0 ? _a : ''),
+            },
+        });
+        return headS3Bucket(client, bucket, `${bucket} @ ${endpoint.host}`, ctx.signal);
+    },
+};
+const gcsTester = {
+    providerSlug: 'gcs',
+    test: async (config) => {
+        var _a, _b;
+        const missing = (0, http_probe_1.requireFields)(config, [
+            ['key_file_json', 'Service account JSON'],
+            ['bucket', 'Bucket'],
+        ]);
+        if (missing)
+            return missing;
+        let credentials;
+        try {
+            credentials = JSON.parse(String((_a = config.key_file_json) !== null && _a !== void 0 ? _a : ''));
+        }
+        catch (_c) {
+            return (0, http_probe_1.fail)('The service account JSON is not valid JSON.');
+        }
+        if (!(credentials === null || credentials === void 0 ? void 0 : credentials.client_email)) {
+            return (0, http_probe_1.fail)('The service account JSON has no "client_email".');
+        }
+        const bucket = (0, http_probe_1.str)(config, 'bucket');
+        try {
+            const storage = new storage_1.Storage({
+                projectId: credentials.project_id,
+                credentials: credentials,
+            });
+            const [metadata] = await storage.bucket(bucket).getMetadata();
+            return (0, http_probe_1.pass)(`${bucket}${(metadata === null || metadata === void 0 ? void 0 : metadata.location) ? ` (${metadata.location})` : ''}`);
+        }
+        catch (error) {
+            const err = error;
+            if ((err === null || err === void 0 ? void 0 : err.code) === 404)
+                return (0, http_probe_1.fail)(`Bucket "${bucket}" was not found.`);
+            if ((err === null || err === void 0 ? void 0 : err.code) === 403) {
+                return (0, http_probe_1.fail)(`The service account has no permission to access the bucket "${bucket}".`);
+            }
+            if ((err === null || err === void 0 ? void 0 : err.code) === 401)
+                return (0, http_probe_1.fail)('The service account key was rejected.');
+            return (0, http_probe_1.fail)(String((_b = err === null || err === void 0 ? void 0 : err.message) !== null && _b !== void 0 ? _b : 'Could not reach the bucket.'));
+        }
+    },
+};
+const azureBlobTester = {
+    providerSlug: 'azure-blob',
+    test: async (config) => {
+        var _a, _b;
+        const missing = (0, http_probe_1.requireFields)(config, [
+            ['account', 'Storage account'],
+            ['key', 'Access key'],
+            ['container', 'Container'],
+        ]);
+        if (missing)
+            return missing;
+        const account = (0, http_probe_1.str)(config, 'account');
+        const container = (0, http_probe_1.str)(config, 'container');
+        let credential;
+        try {
+            credential = new storage_blob_1.StorageSharedKeyCredential(account, String((_a = config.key) !== null && _a !== void 0 ? _a : ''));
+        }
+        catch (_c) {
+            // O SDK decodifica a chave em base64 na construção.
+            return (0, http_probe_1.fail)('The access key is not a valid Azure storage key.');
+        }
+        try {
+            const service = new storage_blob_1.BlobServiceClient(`https://${account}.blob.core.windows.net`, credential);
+            await service.getContainerClient(container).getProperties();
+            return (0, http_probe_1.pass)(`${account}/${container}`);
+        }
+        catch (error) {
+            const err = error;
+            if ((err === null || err === void 0 ? void 0 : err.statusCode) === 403 || (err === null || err === void 0 ? void 0 : err.code) === 'AuthenticationFailed') {
+                return (0, http_probe_1.fail)('The storage account or access key was rejected.');
+            }
+            if ((err === null || err === void 0 ? void 0 : err.statusCode) === 404 || (err === null || err === void 0 ? void 0 : err.code) === 'ContainerNotFound') {
+                return (0, http_probe_1.fail)(`Container "${container}" was not found.`);
+            }
+            return (0, http_probe_1.fail)(String((_b = err === null || err === void 0 ? void 0 : err.message) !== null && _b !== void 0 ? _b : 'Could not reach the container.'));
+        }
+    },
+};
+exports.STORAGE_TESTERS = [
+    localTester,
+    s3Tester,
+    s3CompatibleTester,
+    gcsTester,
+    azureBlobTester,
+];
+//# sourceMappingURL=storage.testers.js.map

package/dist/integration-profile/testers/storage.testers.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"storage.testers.js","sourceRoot":"","sources":["../../../src/integration-profile/testers/storage.testers.ts"],"names":[],"mappings":";;;AAAA,kDAAiE;AACjE,sDAAoF;AACpF,mDAAgD;AAChD,+CAAqD;AACrD,6CAA6E;AAG7E;;;;;;GAMG;AAEH,qEAAqE;AACrE,KAAK,UAAU,YAAY,CACzB,MAAgB,EAChB,MAAc,EACd,KAAa,EACb,MAAmB;;IAEnB,IAAI,CAAC;QACH,MAAM,MAAM,CAAC,IAAI,CAAC,IAAI,6BAAiB,CAAC,EAAE,MAAM,EAAE,MAAM,EAAE,CAAC,EAAE;YAC3D,WAAW,EAAE,MAAM;SACpB,CAAC,CAAC;QACH,OAAO,IAAA,iBAAI,EAAC,KAAK,CAAC,CAAC;IACrB,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,MAAM,GAAG,GAAG,KAIX,CAAC;QACF,MAAM,MAAM,GAAG,MAAA,GAAG,aAAH,GAAG,uBAAH,GAAG,CAAE,SAAS,0CAAE,cAAc,CAAC;QAC9C,MAAM,IAAI,GAAG,MAAM,CAAC,MAAA,GAAG,aAAH,GAAG,uBAAH,GAAG,CAAE,IAAI,mCAAI,EAAE,CAAC,CAAC;QAErC,IAAI,IAAI,KAAK,oBAAoB,IAAI,MAAM,KAAK,GAAG,EAAE,CAAC;YACpD,OAAO,IAAA,iBAAI,EAAC,wBAAwB,CAAC,CAAC;QACxC,CAAC;QACD,IAAI,IAAI,KAAK,uBAAuB,EAAE,CAAC;YACrC,OAAO,IAAA,iBAAI,EAAC,4BAA4B,CAAC,CAAC;QAC5C,CAAC;QACD,IAAI,IAAI,KAAK,UAAU,IAAI,MAAM,KAAK,GAAG,EAAE,CAAC;YAC1C,OAAO,IAAA,iBAAI,EAAC,WAAW,MAAM,kBAAkB,CAAC,CAAC;QACnD,CAAC;QACD,IAAI,IAAI,KAAK,WAAW,IAAI,MAAM,KAAK,GAAG,EAAE,CAAC;YAC3C,OAAO,IAAA,iBAAI,EACT,8DAA8D,MAAM,IAAI,CACzE,CAAC;QACJ,CAAC;QACD,IAAI,IAAI,KAAK,mBAAmB,IAAI,MAAM,KAAK,GAAG,EAAE,CAAC;YACnD,OAAO,IAAA,iBAAI,EAAC,WAAW,MAAM,4BAA4B,CAAC,CAAC;QAC7D,CAAC;QACD,OAAO,IAAA,iBAAI,EAAC,MAAM,CAAC,MAAA,GAAG,aAAH,GAAG,uBAAH,GAAG,CAAE,OAAO,mCAAI,6BAA6B,CAAC,CAAC,CAAC;IACrE,CAAC;YAAS,CAAC;QACT,MAAM,CAAC,OAAO,EAAE,CAAC;IACnB,CAAC;AACH,CAAC;AAED,MAAM,WAAW,GAAsB;IACrC,YAAY,EAAE,OAAO;IACrB,IAAI,EAAE,KAAK,EAAE,MAAM,EAAE,EAAE;;QACrB,MAAM,QAAQ,GAAG,IAAA,gBAAG,EAAC,MAAM,EAAE,WAAW,CAAC,IAAI,SAAS,CAAC;QACvD,IAAI,CAAC;YACH,kFAAkF;YAClF,MAAM,IAAA,iBAAM,EAAC,QAAQ,EAAE,oBAAS,CAAC,IAAI,GAAG,oBAAS,CAAC,IAAI,CAAC,CAAC;YACxD,OAAO,IAAA,iBAAI,EAAC,QAAQ,CAAC,CAAC;QACxB,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,MAAM,IAAI,GAAG,MAAM,CAAC,MAAC,KAA2B,aAA3B,KAAK,uBAAL,KAAK,CAAwB,IAAI,mCAAI,EAAE,CAAC,CAAC;YAC9D,IAAI,IAAI,KAAK,QAAQ,EAAE,CAAC;gBACtB,OAAO,IAAA,iBAAI,EAAC,kBAAkB,QAAQ,mBAAmB,CAAC,CAAC;YAC7D,CAAC;YACD,IAAI,IAAI,KAAK,QAAQ,IAAI,IAAI,KAAK,OAAO,EAAE,CAAC;gBAC1C,OAAO,IAAA,iBAAI,EAAC,8CAA8C,QAAQ,IAAI,CAAC,CAAC;YAC1E,CAAC;YACD,OAAO,IAAA,iBAAI,EAAC,mCAAmC,QAAQ,IAAI,CAAC,CAAC;QAC/D,CAAC;IACH,CAAC;CACF,CAAC;AAEF,MAAM,QAAQ,GAAsB;IAClC,YAAY,EAAE,IAAI;IAClB,IAAI,EAAE,KAAK,EAAE,MAAM,EAAE,GAAG,EAAE,EAAE;;QAC1B,MAAM,OAAO,GAAG,IAAA,0BAAa,EAAC,MAAM,EAAE;YACpC,CAAC,eAAe,EAAE,eAAe,CAAC;YAClC,CAAC,mBAAmB,EAAE,mBAAmB,CAAC;YAC1C,CAAC,QAAQ,EAAE,QAAQ,CAAC;SACrB,CAAC,CAAC;QACH,IAAI,OAAO;YAAE,OAAO,OAAO,CAAC;QAE5B,MAAM,MAAM,GAAG,IAAA,gBAAG,EAAC,MAAM,EAAE,QAAQ,CAAC,IAAI,WAAW,CAAC;QACpD,MAAM,MAAM,GAAG,IAAA,gBAAG,EAAC,MAAM,EAAE,QAAQ,CAAC,CAAC;QACrC,MAAM,YAAY,GAAG,MAAM,CAAC,MAAA,MAAM,CAAC,aAAa,mCAAI,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC;QAE/D,MAAM,MAAM,GAAG,IAAI,oBAAQ,CAAC;YAC1B,MAAM;YACN,WAAW,kBACT,WAAW,EAAE,IAAA,gBAAG,EAAC,MAAM,EAAE,eAAe,CAAC,EACzC,eAAe,EAAE,MAAM,CAAC,MAAA,MAAM,CAAC,iBAAiB,mCAAI,EAAE,CAAC,IACpD,CAAC,YAAY,CAAC,CAAC,CAAC,EAAE,YAAY,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,CAC1C;SACF,CAAC,CAAC;QAEH,OAAO,YAAY,CAAC,MAAM,EAAE,MAAM,EAAE,GAAG,MAAM,KAAK,MAAM,GAAG,EAAE,GAAG,CAAC,MAAM,CAAC,CAAC;IAC3E,CAAC;CACF,CAAC;AAEF,MAAM,kBAAkB,GAAsB;IAC5C,YAAY,EAAE,eAAe;IAC7B,IAAI,EAAE,KAAK,EAAE,MAAM,EAAE,GAAG,EAAE,EAAE;;QAC1B,MAAM,OAAO,GAAG,IAAA,0BAAa,EAAC,MAAM,EAAE;YACpC,CAAC,UAAU,EAAE,UAAU,CAAC;YACxB,CAAC,eAAe,EAAE,eAAe,CAAC;YAClC,CAAC,mBAAmB,EAAE,mBAAmB,CAAC;YAC1C,CAAC,QAAQ,EAAE,QAAQ,CAAC;SACrB,CAAC,CAAC;QACH,IAAI,OAAO;YAAE,OAAO,OAAO,CAAC;QAE5B,MAAM,QAAQ,GAAG,IAAA,0BAAa,EAAC,IAAA,gBAAG,EAAC,MAAM,EAAE,UAAU,CAAC,EAAE,UAAU,CAAC,CAAC;QACpE,MAAM,MAAM,GAAG,IAAA,gBAAG,EAAC,MAAM,EAAE,QAAQ,CAAC,CAAC;QACrC,MAAM,MAAM,GAAG,IAAA,gBAAG,EAAC,MAAM,EAAE,QAAQ,CAAC,IAAI,WAAW,CAAC;QAEpD,MAAM,MAAM,GAAG,IAAI,oBAAQ,CAAC;YAC1B,MAAM;YACN,QAAQ,EAAE,QAAQ,CAAC,MAAM;YACzB,iFAAiF;YACjF,cAAc,EAAE,IAAI;YACpB,WAAW,EAAE;gBACX,WAAW,EAAE,IAAA,gBAAG,EAAC,MAAM,EAAE,eAAe,CAAC;gBACzC,eAAe,EAAE,MAAM,CAAC,MAAA,MAAM,CAAC,iBAAiB,mCAAI,EAAE,CAAC;aACxD;SACF,CAAC,CAAC;QAEH,OAAO,YAAY,CAAC,MAAM,EAAE,MAAM,EAAE,GAAG,MAAM,MAAM,QAAQ,CAAC,IAAI,EAAE,EAAE,GAAG,CAAC,MAAM,CAAC,CAAC;IAClF,CAAC;CACF,CAAC;AAEF,MAAM,SAAS,GAAsB;IACnC,YAAY,EAAE,KAAK;IACnB,IAAI,EAAE,KAAK,EAAE,MAAM,EAAE,EAAE;;QACrB,MAAM,OAAO,GAAG,IAAA,0BAAa,EAAC,MAAM,EAAE;YACpC,CAAC,eAAe,EAAE,sBAAsB,CAAC;YACzC,CAAC,QAAQ,EAAE,QAAQ,CAAC;SACrB,CAAC,CAAC;QACH,IAAI,OAAO;YAAE,OAAO,OAAO,CAAC;QAE5B,IAAI,WAA2D,CAAC;QAChE,IAAI,CAAC;YACH,WAAW,GAAG,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,MAAA,MAAM,CAAC,aAAa,mCAAI,EAAE,CAAC,CAAC,CAAC;QAC/D,CAAC;QAAC,WAAM,CAAC;YACP,OAAO,IAAA,iBAAI,EAAC,6CAA6C,CAAC,CAAC;QAC7D,CAAC;QACD,IAAI,CAAC,CAAA,WAAW,aAAX,WAAW,uBAAX,WAAW,CAAE,YAAY,CAAA,EAAE,CAAC;YAC/B,OAAO,IAAA,iBAAI,EAAC,iDAAiD,CAAC,CAAC;QACjE,CAAC;QAED,MAAM,MAAM,GAAG,IAAA,gBAAG,EAAC,MAAM,EAAE,QAAQ,CAAC,CAAC;QACrC,IAAI,CAAC;YACH,MAAM,OAAO,GAAG,IAAI,iBAAO,CAAC;gBAC1B,SAAS,EAAE,WAAW,CAAC,UAAU;gBACjC,WAAW,EAAE,WAAqC;aACnD,CAAC,CAAC;YACH,MAAM,CAAC,QAAQ,CAAC,GAAG,MAAM,OAAO,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,WAAW,EAAE,CAAC;YAC9D,OAAO,IAAA,iBAAI,EAAC,GAAG,MAAM,GAAG,CAAA,QAAQ,aAAR,QAAQ,uBAAR,QAAQ,CAAE,QAAQ,EAAC,CAAC,CAAC,KAAK,QAAQ,CAAC,QAAQ,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;QACjF,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,MAAM,GAAG,GAAG,KAA4C,CAAC;YACzD,IAAI,CAAA,GAAG,aAAH,GAAG,uBAAH,GAAG,CAAE,IAAI,MAAK,GAAG;gBAAE,OAAO,IAAA,iBAAI,EAAC,WAAW,MAAM,kBAAkB,CAAC,CAAC;YACxE,IAAI,CAAA,GAAG,aAAH,GAAG,uBAAH,GAAG,CAAE,IAAI,MAAK,GAAG,EAAE,CAAC;gBACtB,OAAO,IAAA,iBAAI,EACT,+DAA+D,MAAM,IAAI,CAC1E,CAAC;YACJ,CAAC;YACD,IAAI,CAAA,GAAG,aAAH,GAAG,uBAAH,GAAG,CAAE,IAAI,MAAK,GAAG;gBAAE,OAAO,IAAA,iBAAI,EAAC,uCAAuC,CAAC,CAAC;YAC5E,OAAO,IAAA,iBAAI,EAAC,MAAM,CAAC,MAAA,GAAG,aAAH,GAAG,uBAAH,GAAG,CAAE,OAAO,mCAAI,6BAA6B,CAAC,CAAC,CAAC;QACrE,CAAC;IACH,CAAC;CACF,CAAC;AAEF,MAAM,eAAe,GAAsB;IACzC,YAAY,EAAE,YAAY;IAC1B,IAAI,EAAE,KAAK,EAAE,MAAM,EAAE,EAAE;;QACrB,MAAM,OAAO,GAAG,IAAA,0BAAa,EAAC,MAAM,EAAE;YACpC,CAAC,SAAS,EAAE,iBAAiB,CAAC;YAC9B,CAAC,KAAK,EAAE,YAAY,CAAC;YACrB,CAAC,WAAW,EAAE,WAAW,CAAC;SAC3B,CAAC,CAAC;QACH,IAAI,OAAO;YAAE,OAAO,OAAO,CAAC;QAE5B,MAAM,OAAO,GAAG,IAAA,gBAAG,EAAC,MAAM,EAAE,SAAS,CAAC,CAAC;QACvC,MAAM,SAAS,GAAG,IAAA,gBAAG,EAAC,MAAM,EAAE,WAAW,CAAC,CAAC;QAE3C,IAAI,UAAsC,CAAC;QAC3C,IAAI,CAAC;YACH,UAAU,GAAG,IAAI,yCAA0B,CAAC,OAAO,EAAE,MAAM,CAAC,MAAA,MAAM,CAAC,GAAG,mCAAI,EAAE,CAAC,CAAC,CAAC;QACjF,CAAC;QAAC,WAAM,CAAC;YACP,oDAAoD;YACpD,OAAO,IAAA,iBAAI,EAAC,kDAAkD,CAAC,CAAC;QAClE,CAAC;QAED,IAAI,CAAC;YACH,MAAM,OAAO,GAAG,IAAI,gCAAiB,CACnC,WAAW,OAAO,wBAAwB,EAC1C,UAAU,CACX,CAAC;YACF,MAAM,OAAO,CAAC,kBAAkB,CAAC,SAAS,CAAC,CAAC,aAAa,EAAE,CAAC;YAC5D,OAAO,IAAA,iBAAI,EAAC,GAAG,OAAO,IAAI,SAAS,EAAE,CAAC,CAAC;QACzC,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,MAAM,GAAG,GAAG,KAAiE,CAAC;YAC9E,IAAI,CAAA,GAAG,aAAH,GAAG,uBAAH,GAAG,CAAE,UAAU,MAAK,GAAG,IAAI,CAAA,GAAG,aAAH,GAAG,uBAAH,GAAG,CAAE,IAAI,MAAK,sBAAsB,EAAE,CAAC;gBACpE,OAAO,IAAA,iBAAI,EAAC,iDAAiD,CAAC,CAAC;YACjE,CAAC;YACD,IAAI,CAAA,GAAG,aAAH,GAAG,uBAAH,GAAG,CAAE,UAAU,MAAK,GAAG,IAAI,CAAA,GAAG,aAAH,GAAG,uBAAH,GAAG,CAAE,IAAI,MAAK,mBAAmB,EAAE,CAAC;gBACjE,OAAO,IAAA,iBAAI,EAAC,cAAc,SAAS,kBAAkB,CAAC,CAAC;YACzD,CAAC;YACD,OAAO,IAAA,iBAAI,EAAC,MAAM,CAAC,MAAA,GAAG,aAAH,GAAG,uBAAH,GAAG,CAAE,OAAO,mCAAI,gCAAgC,CAAC,CAAC,CAAC;QACxE,CAAC;IACH,CAAC;CACF,CAAC;AAEW,QAAA,eAAe,GAAwB;IAClD,WAAW;IACX,QAAQ;IACR,kBAAkB;IAClB,SAAS;IACT,eAAe;CAChB,CAAC"}

package/dist/language/en.json

@@ -26,7 +26,8 @@
   },
   "forgot": {
     "rateLimit": "Too many requests. Please try again later.",
-    "userNotFound": "User not found."
+    "userNotFound": "User not found.",
+    "noPassword": "This account does not have a password set. Please sign in using your organization's login provider (e.g. Microsoft)."
   },
   "challenge": {
     "invalidOrExpired": "The provided code is invalid or has expired."
@@ -70,7 +71,8 @@
     "minLowercase": "Password must contain at least {minLowercase} lowercase letter(s).",
     "minUppercase": "Password must contain at least {minUppercase} uppercase letter(s).",
     "minNumbers": "Password must contain at least {minNumbers} number(s).",
-    "minSymbols": "Password must contain at least {minSymbols} special character(s)."
+    "minSymbols": "Password must contain at least {minSymbols} special character(s).",
+    "leaked": "This password appears in known data breaches. Please choose another one."
   },
   "createUser": {
     "nameRequired": "Name is required."
@@ -169,6 +171,17 @@
       "not_found": "Mail template with id {id} not found."
     }
   },
+  "oauth": {
+    "callback": {
+      "codeRequired": "Authorization code is required to complete OAuth authentication.",
+      "invalidState": "OAuth callback state is invalid or expired. Start the sign-in flow again.",
+      "invalidType": "Unsupported OAuth callback type.",
+      "invalid": "OAuth callback is invalid or expired. Start the sign-in flow again.",
+      "alreadyProcessed": "This OAuth callback was already processed. Start the sign-in flow again.",
+      "inProgress": "This OAuth callback is already being processed. Wait a moment and try again.",
+      "unavailable": "Unable to complete OAuth authentication right now. Please try again."
+    }
+  },
   "mail_sent_not_found": "Mail sent record not found.",
   "validationSslugMustBeString": "Slug must be a string.",
   "sessionRevoked": "Session has been revoked or expired.",

package/dist/language/pt.json

@@ -26,7 +26,8 @@
   },
   "forgot": {
     "rateLimit": "Muitas solicitações. Por favor, tente novamente mais tarde.",
-    "userNotFound": "Usuário não encontrado."
+    "userNotFound": "Usuário não encontrado.",
+    "noPassword": "Esta conta não possui senha cadastrada. Faça login utilizando o provedor de acesso da sua organização (ex: Microsoft)."
   },
   "challenge": {
     "invalidOrExpired": "O código informado é inválido ou expirou."
@@ -70,7 +71,8 @@
     "minLowercase": "A senha deve conter pelo menos {minLowercase} letra(s) minúscula(s).",
     "minUppercase": "A senha deve conter pelo menos {minUppercase} letra(s) maiúscula(s).",
     "minNumbers": "A senha deve conter pelo menos {minNumbers} número(s).",
-    "minSymbols": "A senha deve conter pelo menos {minSymbols} caractere(s) especial(is)."
+    "minSymbols": "A senha deve conter pelo menos {minSymbols} caractere(s) especial(is).",
+    "leaked": "Esta senha aparece em vazamentos de dados conhecidos. Escolha outra."
   },
   "createUser": {
     "nameRequired": "Nome é obrigatório."
@@ -169,6 +171,17 @@
       "not_found": "Modelo de e-mail com id {id} não encontrado."
     }
   },
+  "oauth": {
+    "callback": {
+      "codeRequired": "O código de autorização é obrigatório para concluir a autenticação.",
+      "invalidState": "O retorno da autenticação é inválido ou expirou. Inicie o login novamente.",
+      "invalidType": "Tipo de retorno de autenticação não suportado.",
+      "invalid": "O retorno da autenticação é inválido ou expirou. Inicie o login novamente.",
+      "alreadyProcessed": "Este retorno de autenticação já foi processado. Inicie o login novamente.",
+      "inProgress": "Este retorno de autenticação já está sendo processado. Aguarde um instante e tente novamente.",
+      "unavailable": "Não foi possível concluir a autenticação agora. Tente novamente."
+    }
+  },
   "mail_sent_not_found": "Registro de e-mail enviado não encontrado.",
   "validationSslugMustBeString": "O slug deve ser uma string.",
   "sessionRevoked": "Sessão foi revogada ou expirou.",

package/dist/leaked-password/leaked-password.controller.d.ts

@@ -0,0 +1,24 @@
+import type { Request, Response } from 'express';
+import { LeakedPasswordService } from './leaked-password.service';
+/**
+ * Entrega o bloom filter do corpus de senhas vazadas para o cliente testar as
+ * senhas do cofre localmente.
+ *
+ * É o desenho que mantém a criptografia ponta a ponta: em vez de o navegador
+ * perguntar "esta senha vazou?" (revelando a senha, ou pelo menos um prefixo do
+ * hash dela), ele baixa o filtro inteiro uma vez e responde sozinho.
+ *
+ * Autenticado de propósito: o conteúdo é público em essência, mas são MBs por
+ * download, e o `If-None-Match` faz o navegador revalidar de graça.
+ */
+export declare class LeakedPasswordController {
+    private readonly leakedPasswordService;
+    constructor(leakedPasswordService: LeakedPasswordService);
+    filter(req: Request, res: Response): Promise<void>;
+    /** Tamanho do corpus, para a tela de configuração mostrar o que está ativo. */
+    stats(): Promise<{
+        count: number;
+        lastUpdatedAt: Date;
+    }>;
+}
+//# sourceMappingURL=leaked-password.controller.d.ts.map

package/dist/leaked-password/leaked-password.controller.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"leaked-password.controller.d.ts","sourceRoot":"","sources":["../../src/leaked-password/leaked-password.controller.ts"],"names":[],"mappings":"AAEA,OAAO,KAAK,EAAE,OAAO,EAAE,QAAQ,EAAE,MAAM,SAAS,CAAC;AACjD,OAAO,EAAE,qBAAqB,EAAE,MAAM,2BAA2B,CAAC;AAElE;;;;;;;;;;GAUG;AACH,qBAEa,wBAAwB;IAGjC,OAAO,CAAC,QAAQ,CAAC,qBAAqB;gBAArB,qBAAqB,EAAE,qBAAqB;IAIzD,MAAM,CAAQ,GAAG,EAAE,OAAO,EAAS,GAAG,EAAE,QAAQ,GAAG,OAAO,CAAC,IAAI,CAAC;IAoBtE,+EAA+E;IAEzE,KAAK;;;;CAIZ"}

package/dist/leaked-password/leaked-password.controller.js

@@ -0,0 +1,78 @@
+"use strict";
+var __decorate = (this && this.__decorate) || function (decorators, target, key, desc) {
+    var c = arguments.length, r = c < 3 ? target : desc === null ? desc = Object.getOwnPropertyDescriptor(target, key) : desc, d;
+    if (typeof Reflect === "object" && typeof Reflect.decorate === "function") r = Reflect.decorate(decorators, target, key, desc);
+    else for (var i = decorators.length - 1; i >= 0; i--) if (d = decorators[i]) r = (c < 3 ? d(r) : c > 3 ? d(target, key, r) : d(target, key)) || r;
+    return c > 3 && r && Object.defineProperty(target, key, r), r;
+};
+var __metadata = (this && this.__metadata) || function (k, v) {
+    if (typeof Reflect === "object" && typeof Reflect.metadata === "function") return Reflect.metadata(k, v);
+};
+var __param = (this && this.__param) || function (paramIndex, decorator) {
+    return function (target, key) { decorator(target, key, paramIndex); }
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.LeakedPasswordController = void 0;
+const api_1 = require("@hed-hog/api");
+const common_1 = require("@nestjs/common");
+const leaked_password_service_1 = require("./leaked-password.service");
+/**
+ * Entrega o bloom filter do corpus de senhas vazadas para o cliente testar as
+ * senhas do cofre localmente.
+ *
+ * É o desenho que mantém a criptografia ponta a ponta: em vez de o navegador
+ * perguntar "esta senha vazou?" (revelando a senha, ou pelo menos um prefixo do
+ * hash dela), ele baixa o filtro inteiro uma vez e responde sozinho.
+ *
+ * Autenticado de propósito: o conteúdo é público em essência, mas são MBs por
+ * download, e o `If-None-Match` faz o navegador revalidar de graça.
+ */
+let LeakedPasswordController = class LeakedPasswordController {
+    constructor(leakedPasswordService) {
+        this.leakedPasswordService = leakedPasswordService;
+    }
+    async filter(req, res) {
+        const filter = await this.leakedPasswordService.getFilter();
+        if (req.headers['if-none-match'] === filter.etag) {
+            res.status(304).end();
+            return;
+        }
+        res.set({
+            'Content-Type': 'application/octet-stream',
+            'Content-Length': String(filter.bytes.length),
+            ETag: filter.etag,
+            // `must-revalidate` com ETag: o navegador reusa o filtro sem baixar de novo,
+            // mas nunca serve corpus velho depois de um import.
+            'Cache-Control': 'private, max-age=0, must-revalidate',
+            'X-Leaked-Password-Count': String(filter.count),
+        });
+        res.end(filter.bytes);
+    }
+    /** Tamanho do corpus, para a tela de configuração mostrar o que está ativo. */
+    async stats() {
+        const version = await this.leakedPasswordService.getCorpusVersion();
+        return { count: version.count, lastUpdatedAt: version.lastCreatedAt };
+    }
+};
+exports.LeakedPasswordController = LeakedPasswordController;
+__decorate([
+    (0, common_1.Get)('filter'),
+    __param(0, (0, common_1.Req)()),
+    __param(1, (0, common_1.Res)()),
+    __metadata("design:type", Function),
+    __metadata("design:paramtypes", [Object, Object]),
+    __metadata("design:returntype", Promise)
+], LeakedPasswordController.prototype, "filter", null);
+__decorate([
+    (0, common_1.Get)('stats'),
+    __metadata("design:type", Function),
+    __metadata("design:paramtypes", []),
+    __metadata("design:returntype", Promise)
+], LeakedPasswordController.prototype, "stats", null);
+exports.LeakedPasswordController = LeakedPasswordController = __decorate([
+    (0, api_1.Role)(),
+    (0, common_1.Controller)('leaked-password'),
+    __param(0, (0, common_1.Inject)((0, common_1.forwardRef)(() => leaked_password_service_1.LeakedPasswordService))),
+    __metadata("design:paramtypes", [leaked_password_service_1.LeakedPasswordService])
+], LeakedPasswordController);
+//# sourceMappingURL=leaked-password.controller.js.map

package/dist/leaked-password/leaked-password.controller.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"leaked-password.controller.js","sourceRoot":"","sources":["../../src/leaked-password/leaked-password.controller.ts"],"names":[],"mappings":";;;;;;;;;;;;;;;AAAA,sCAAoC;AACpC,2CAA+E;AAE/E,uEAAkE;AAElE;;;;;;;;;;GAUG;AAGI,IAAM,wBAAwB,GAA9B,MAAM,wBAAwB;IACnC,YAEmB,qBAA4C;QAA5C,0BAAqB,GAArB,qBAAqB,CAAuB;IAC5D,CAAC;IAGE,AAAN,KAAK,CAAC,MAAM,CAAQ,GAAY,EAAS,GAAa;QACpD,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,qBAAqB,CAAC,SAAS,EAAE,CAAC;QAE5D,IAAI,GAAG,CAAC,OAAO,CAAC,eAAe,CAAC,KAAK,MAAM,CAAC,IAAI,EAAE,CAAC;YACjD,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,GAAG,EAAE,CAAC;YACtB,OAAO;QACT,CAAC;QAED,GAAG,CAAC,GAAG,CAAC;YACN,cAAc,EAAE,0BAA0B;YAC1C,gBAAgB,EAAE,MAAM,CAAC,MAAM,CAAC,KAAK,CAAC,MAAM,CAAC;YAC7C,IAAI,EAAE,MAAM,CAAC,IAAI;YACjB,6EAA6E;YAC7E,oDAAoD;YACpD,eAAe,EAAE,qCAAqC;YACtD,yBAAyB,EAAE,MAAM,CAAC,MAAM,CAAC,KAAK,CAAC;SAChD,CAAC,CAAC;QACH,GAAG,CAAC,GAAG,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;IACxB,CAAC;IAED,+EAA+E;IAEzE,AAAN,KAAK,CAAC,KAAK;QACT,MAAM,OAAO,GAAG,MAAM,IAAI,CAAC,qBAAqB,CAAC,gBAAgB,EAAE,CAAC;QACpE,OAAO,EAAE,KAAK,EAAE,OAAO,CAAC,KAAK,EAAE,aAAa,EAAE,OAAO,CAAC,aAAa,EAAE,CAAC;IACxE,CAAC;CACF,CAAA;AAjCY,4DAAwB;AAO7B;IADL,IAAA,YAAG,EAAC,QAAQ,CAAC;IACA,WAAA,IAAA,YAAG,GAAE,CAAA;IAAgB,WAAA,IAAA,YAAG,GAAE,CAAA;;;;sDAkBvC;AAIK;IADL,IAAA,YAAG,EAAC,OAAO,CAAC;;;;qDAIZ;mCAhCU,wBAAwB;IAFpC,IAAA,UAAI,GAAE;IACN,IAAA,mBAAU,EAAC,iBAAiB,CAAC;IAGzB,WAAA,IAAA,eAAM,EAAC,IAAA,mBAAU,EAAC,GAAG,EAAE,CAAC,+CAAqB,CAAC,CAAC,CAAA;qCACR,+CAAqB;GAHpD,wBAAwB,CAiCpC"}

package/dist/leaked-password/leaked-password.module.d.ts

@@ -0,0 +1,8 @@
+/**
+ * `@Global()` porque o validador de política de senha alcança este serviço pelo
+ * service locator, de fora da árvore de injeção normal (mesmo caminho do
+ * SettingService).
+ */
+export declare class LeakedPasswordModule {
+}
+//# sourceMappingURL=leaked-password.module.d.ts.map

package/dist/leaked-password/leaked-password.module.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"leaked-password.module.d.ts","sourceRoot":"","sources":["../../src/leaked-password/leaked-password.module.ts"],"names":[],"mappings":"AAKA;;;;GAIG;AACH,qBAOa,oBAAoB;CAAG"}