@hed-hog/core 0.0.387 → 0.0.393

package/dist/profile/profile.service.d.ts

@@ -1,4 +1,4 @@
-import { PrismaService, user } from '@hed-hog/api-prisma';
+import { PrismaService } from '@hed-hog/api-prisma';
 import { EventEmitter2 } from '@nestjs/event-emitter';
 import { JwtService } from '@nestjs/jwt';
 import type { PublicKeyCredentialCreationOptionsJSON, PublicKeyCredentialRequestOptionsJSON } from '@simplewebauthn/server';
@@ -10,6 +10,7 @@ import { TokenService } from '../token/token.service';
 import { UserService } from '../user/user.service';
 import { ChangeEmailDto } from './dto/change-email.dto';
 import { ChangePasswordDto } from './dto/change-password.dto';
+import { DeleteAccountDto } from './dto/delete-account.dto';
 import { EmailVerificationDto } from './dto/email-verification-confirm.dto';
 import { SendEmailVerificationDto } from './dto/send-email-verification.dto';
 import { SetPreferencesDto } from './dto/set-preferences.dto';
@@ -25,26 +26,26 @@ export declare class ProfileService {
     private readonly mail;
     private readonly eventEmitter;
     constructor(prisma: PrismaService, user: UserService, jwt: JwtService, setting: SettingService, security: SecurityService, challenge: ChallengeService, token: TokenService, mail: MailService, eventEmitter: EventEmitter2);
-    changeEmail(locale: string, userId: number, { email, password, pin }: ChangeEmailDto): Promise<{
+    changeEmail(locale: string, userId: number, { email, password, pin }: ChangeEmailDto, origin?: string): Promise<{
         requireEmailVerification: boolean;
     }>;
     updatePreferences(locale: string, userId: number, { theme, language }: SetPreferencesDto): Promise<{
         success: boolean;
     }>;
-    confirmEmailVerificationMfa(locale: string, userId: number, { pin, challengeId, name }: EmailVerificationDto): Promise<{
+    confirmEmailVerificationMfa(locale: string, userId: number, { pin, challengeId, name }: EmailVerificationDto, sessionId: number | null): Promise<{
         codes: string[];
         token: string;
     }>;
     confirmEmailVerification(locale: string, userId: number, { pin, challengeId }: EmailVerificationDto): Promise<{
         success: boolean;
     }>;
-    sendEmailVerificationMfa(locale: string, userId: number, { email }: SendEmailVerificationDto): Promise<{
+    sendEmailVerificationMfa(locale: string, userId: number, { email }: SendEmailVerificationDto, origin?: string): Promise<{
         challengeId: number;
     }>;
-    sendEmailVerification(locale: string, userId: number, { email }: SendEmailVerificationDto): Promise<{
+    sendEmailVerification(locale: string, userId: number, { email }: SendEmailVerificationDto, origin?: string): Promise<{
         challengeId: number;
     }>;
-    sendCodeToRemove(locale: any, userId: any, email: any): Promise<{
+    sendCodeToRemove(locale: any, userId: any, email: any, origin?: string): Promise<{
         challengeId: number;
     }>;
     getEmailIdentifier(userId: number): Promise<{
@@ -67,6 +68,17 @@ export declare class ProfileService {
         suspended_reason: string | null;
         deactivated_at: Date | null;
         updated_at: Date;
+    } | {
+        hasPassword: boolean;
+        id: number;
+        created_at: Date;
+        name: string;
+        photo_id: number | null;
+        suspended_until: Date | null;
+        last_login_at: Date | null;
+        suspended_reason: string | null;
+        deactivated_at: Date | null;
+        updated_at: Date;
     }>;
     getMFAMethods(userId: number): Promise<({
         user_mfa_email: {
@@ -124,19 +136,30 @@ export declare class ProfileService {
         deactivated_at: Date | null;
         updated_at: Date;
     }>;
+    /**
+     * Exclusão de conta pelo próprio usuário (exigida pelas lojas de aplicativos).
+     *
+     * Anonimiza em vez de apagar: os dados pessoais somem e o acesso é revogado
+     * em definitivo, mas as linhas continuam existindo para não quebrar registros
+     * fiscais e integridade referencial. Os identificadores (e-mail, CPF...) são
+     * embaralhados, o que libera o e-mail original para uma conta nova no futuro.
+     */
+    deleteAccount(locale: string, userId: number, { password }: DeleteAccountDto): Promise<{
+        success: boolean;
+    }>;
     updateAvatar(locale: string, userId: number, file: MulterFile): Promise<{
         id: number;
         path: string;
     }>;
-    changePassword(locale: string, userId: number, { currentPassword, newPassword }: ChangePasswordDto, ipAddress?: string, userAgent?: string): Promise<{
+    changePassword(locale: string, userId: number, { currentPassword, newPassword }: ChangePasswordDto, ipAddress?: string, userAgent?: string, origin?: string): Promise<{
         success: boolean;
     }>;
     generateRecoveryCodes(count?: number): string[];
     createMfaRecoveryCodes(userId: number): Promise<string[]>;
-    getToken(user: user): Promise<{
+    getToken(userId: number, sessionId: number | null): Promise<{
         token: string;
     }>;
-    verifyMfaTotp(locale: string, userId: number, token: string, secret: string, name?: string): Promise<{
+    verifyMfaTotp(locale: string, userId: number, token: string, secret: string, name?: string, sessionId?: number | null): Promise<{
         codes: string[];
         token: string;
     }>;
@@ -145,13 +168,13 @@ export declare class ProfileService {
         qrCode: any;
         secret: string;
     }>;
-    removeMfaTotp(locale: string, userId: number, mfaId: number, token: string): Promise<{
+    removeMfaTotp(locale: string, userId: number, mfaId: number, token: string, sessionId: number | null): Promise<{
         token: string;
     }>;
-    removeMfaEmail(locale: string, userId: number, mfaId: number, token: string, providedHash: string): Promise<{
+    removeMfaEmail(locale: string, userId: number, mfaId: number, token: string, providedHash: string, sessionId: number | null): Promise<{
         token: string;
     }>;
-    removeMfaWithRecoveryCode(locale: string, userId: number, mfaId: number, recoveryCode: string): Promise<{
+    removeMfaWithRecoveryCode(locale: string, userId: number, mfaId: number, recoveryCode: string, sessionId: number | null): Promise<{
         token: string;
     }>;
     removeMfa(locale: string, userId: number, mfaId: number, data: {
@@ -159,10 +182,10 @@ export declare class ProfileService {
         hash?: string;
         verificationType?: 'totp' | 'email' | 'recovery' | 'webauthn';
         assertionResponse?: any;
-    }, requestOrigin?: string): Promise<{
+    }, requestOrigin: string | undefined, sessionId: number | null): Promise<{
         token: string;
     }>;
-    checkMfaBeforeAdd(locale: string, userId: number): Promise<{
+    checkMfaBeforeAdd(locale: string, userId: number, origin?: string): Promise<{
         requiresVerification: boolean;
         availableMethods?: undefined;
         hasWebAuthn?: undefined;
@@ -181,7 +204,7 @@ export declare class ProfileService {
         hasRecoveryCodes: boolean;
         availableMethods?: undefined;
     }>;
-    checkMfaBeforeRemove(locale: string, userId: number): Promise<{
+    checkMfaBeforeRemove(locale: string, userId: number, origin?: string): Promise<{
         requiresVerification: boolean;
         availableMethods: ("email" | "totp")[];
         hasWebAuthn: boolean;
@@ -195,7 +218,7 @@ export declare class ProfileService {
     }, requestOrigin?: string): Promise<{
         success: boolean;
     }>;
-    sendRecoveryCodesVerification(locale: string, userId: number): Promise<{
+    sendRecoveryCodesVerification(locale: string, userId: number, origin?: string): Promise<{
         requiresVerification: boolean;
         availableMethods?: undefined;
         hasWebAuthn?: undefined;
@@ -231,7 +254,7 @@ export declare class ProfileService {
     verifyWebAuthnAuthentication(userId: number, assertionResponse: any, requestOrigin?: string): Promise<{
         success: boolean;
     }>;
-    removeWebAuthnMfa(locale: string, userId: number, mfaId: number): Promise<{
+    removeWebAuthnMfa(locale: string, userId: number, mfaId: number, assertionResponse: any, requestOrigin?: string): Promise<{
         success: boolean;
     }>;
     generateWebAuthnAuthenticationOptionsForLogin(locale: string, mfaToken: string): Promise<PublicKeyCredentialRequestOptionsJSON>;
@@ -239,7 +262,7 @@ export declare class ProfileService {
         accessToken: string;
         refreshToken: string;
     }>;
-    getUserToken(userId: number): Promise<{
+    getUserToken(userId: number, sessionId: number | null): Promise<{
         token: string;
     }>;
 }

package/dist/profile/profile.service.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"profile.service.d.ts","sourceRoot":"","sources":["../../src/profile/profile.service.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,aAAa,EAAE,IAAI,EAAE,MAAM,qBAAqB,CAAC;AAG1D,OAAO,EAAE,aAAa,EAAE,MAAM,uBAAuB,CAAC;AACtD,OAAO,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AACzC,OAAO,KAAK,EACR,sCAAsC,EACtC,qCAAqC,EAGxC,MAAM,wBAAwB,CAAC;AAShC,OAAO,EAAE,gBAAgB,EAAE,MAAM,gCAAgC,CAAC;AAClE,OAAO,EAAE,WAAW,EAAE,MAAM,sBAAsB,CAAC;AACnD,OAAO,EAAE,eAAe,EAAE,MAAM,8BAA8B,CAAC;AAC/D,OAAO,EAAE,cAAc,EAAE,MAAM,4BAA4B,CAAC;AAC5D,OAAO,EAAE,YAAY,EAAE,MAAM,wBAAwB,CAAC;AACtD,OAAO,EAAE,WAAW,EAAE,MAAM,sBAAsB,CAAC;AAEnD,OAAO,EAAE,cAAc,EAAE,MAAM,wBAAwB,CAAC;AACxD,OAAO,EAAE,iBAAiB,EAAE,MAAM,2BAA2B,CAAC;AAC9D,OAAO,EAAE,oBAAoB,EAAE,MAAM,sCAAsC,CAAC;AAC5E,OAAO,EAAE,wBAAwB,EAAE,MAAM,mCAAmC,CAAC;AAC7E,OAAO,EAAE,iBAAiB,EAAE,MAAM,2BAA2B,CAAC;AAC9D,OAAO,EAAE,SAAS,EAAE,MAAM,kBAAkB,CAAC;AAK7C,qBACa,cAAc;IAGvB,OAAO,CAAC,QAAQ,CAAC,MAAM;IACvB,OAAO,CAAC,QAAQ,CAAC,IAAI;IAErB,OAAO,CAAC,QAAQ,CAAC,GAAG;IAEpB,OAAO,CAAC,QAAQ,CAAC,OAAO;IACxB,OAAO,CAAC,QAAQ,CAAC,QAAQ;IACzB,OAAO,CAAC,QAAQ,CAAC,SAAS;IAE1B,OAAO,CAAC,QAAQ,CAAC,KAAK;IAEtB,OAAO,CAAC,QAAQ,CAAC,IAAI;IACrB,OAAO,CAAC,QAAQ,CAAC,YAAY;gBAZZ,MAAM,EAAE,aAAa,EACrB,IAAI,EAAE,WAAW,EAEjB,GAAG,EAAE,UAAU,EAEf,OAAO,EAAE,cAAc,EACvB,QAAQ,EAAE,eAAe,EACzB,SAAS,EAAE,gBAAgB,EAE3B,KAAK,EAAE,YAAY,EAEnB,IAAI,EAAE,WAAW,EACjB,YAAY,EAAE,aAAa;IAGxC,WAAW,CAAC,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,EAAE,KAAK,EAAE,QAAQ,EAAE,GAAG,EAAE,EAAE,cAAc;;;IAqFpF,iBAAiB,CAAC,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,EAAE,KAAK,EAAE,QAAQ,EAAE,EAAE,iBAAiB;;;IAWxF,2BAA2B,CAAC,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,EAAE,GAAG,EAAE,WAAW,EAAE,IAAI,EAAE,EAAE,oBAAoB;;;;IAgF5G,wBAAwB,CAAC,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,EAAE,GAAG,EAAE,WAAW,EAAE,EAAE,oBAAoB;;;IAwEnG,wBAAwB,CAAC,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,EAAE,KAAK,EAAE,EAAE,wBAAwB;;;IAI5F,qBAAqB,CAAC,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,EAAE,KAAK,EAAE,EAAE,wBAAwB;;;IAIzF,gBAAgB,CAAC,MAAM,KAAA,EAAE,MAAM,KAAA,EAAE,KAAK,KAAA;;;IAItC,kBAAkB,CAAC,MAAM,EAAE,MAAM;;;;;;;;;;IAMjC,UAAU,CAAC,MAAM,EAAE,MAAM;;;;;;;;;;;IAMzB,aAAa,CAAC,MAAM,EAAE,MAAM;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;IAc5B,SAAS,CAAC,MAAM,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,EAAE,EAAE,IAAI,EAAE,EAAE,SAAS;;;;;;;;;;IAO5D,MAAM,CAAC,MAAM,EAAE,MAAM,EAAE,EAAE,IAAI,EAAE,EAAE,SAAS;;;;;;;;;;;IAY1C,YAAY,CAAC,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,UAAU;;;;IAO7D,cAAc,CAAC,MAAM,EAAC,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,EAAC,eAAe,EAAE,WAAW,EAAC,EAAE,iBAAiB,EAAE,SAAS,CAAC,EAAE,MAAM,EAAE,SAAS,CAAC,EAAE,MAAM;;;IAmD7I,qBAAqB,CAAC,KAAK,SAAK,GAAG,MAAM,EAAE;IAYrC,sBAAsB,CAAC,MAAM,EAAE,MAAM;IAmBrC,QAAQ,CAAC,IAAI,EAAE,IAAI;;;IAInB,aAAa,CAAC,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,IAAI,CAAC,EAAE,MAAM;;;;IAoE1F,eAAe,CAAC,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM;;;;;IAiD9C,aAAa,CAAC,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM;;;IA2C1E,cAAc,CAAC,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,EAAE,YAAY,EAAE,MAAM;;;IAajG,yBAAyB,CAAC,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,EAAE,YAAY,EAAE,MAAM;;;IAwC7F,SAAS,CAAC,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,EAAE,IAAI,EAAE;QAAE,KAAK,CAAC,EAAE,MAAM,CAAC;QAAC,IAAI,CAAC,EAAE,MAAM,CAAC;QAAC,gBAAgB,CAAC,EAAE,MAAM,GAAG,OAAO,GAAG,UAAU,GAAG,UAAU,CAAC;QAAC,iBAAiB,CAAC,EAAE,GAAG,CAAA;KAAE,EAAE,aAAa,CAAC,EAAE,MAAM;;;IA+HhN,iBAAiB,CAAC,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM;;;;;;;;;;;;;;;;;;;IAmEhD,oBAAoB,CAAC,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM;;;;;;IA8CnD,kBAAkB,CACtB,MAAM,EAAE,MAAM,EACd,MAAM,EAAE,MAAM,EACd,IAAI,EAAE;QAAE,gBAAgB,CAAC,EAAE,MAAM,CAAC;QAAC,IAAI,CAAC,EAAE,MAAM,CAAC;QAAC,gBAAgB,EAAE,MAAM,GAAG,OAAO,GAAG,UAAU,GAAG,UAAU,CAAC;QAAC,iBAAiB,CAAC,EAAE,GAAG,CAAA;KAAE,EACzI,aAAa,CAAC,EAAE,MAAM;;;IA0HlB,6BAA6B,CAAC,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM;;;;;;;;;;;;;;;;;;;IAkE5D,uBAAuB,CAAC,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE;QAAE,gBAAgB,CAAC,EAAE,MAAM,CAAC;QAAC,IAAI,CAAC,EAAE,MAAM,CAAC;QAAC,gBAAgB,CAAC,EAAE,MAAM,GAAG,OAAO,GAAG,UAAU,GAAG,UAAU,CAAC;QAAC,iBAAiB,CAAC,EAAE,GAAG,CAAA;KAAE,EAAE,aAAa,CAAC,EAAE,MAAM;;;IA8H1N,mCAAmC,CAAC,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,EAAE,aAAa,CAAC,EAAE,MAAM,GAAG,OAAO,CAAC,sCAAsC,CAAC;IA6E1J,0BAA0B,CAC9B,MAAM,EAAE,MAAM,EACd,MAAM,EAAE,MAAM,EACd,IAAI,EAAE,MAAM,EACZ,mBAAmB,EAAE,GAAG,EACxB,aAAa,CAAC,EAAE,MAAM;;;;IAgElB,qCAAqC,CAAC,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,aAAa,CAAC,EAAE,MAAM,GAAG,OAAO,CAAC,qCAAqC,CAAC;IA8C7I,4BAA4B,CAAC,MAAM,EAAE,MAAM,EAAE,iBAAiB,EAAE,GAAG,EAAE,aAAa,CAAC,EAAE,MAAM;;;IA6D3F,iBAAiB,CAAC,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM;;;IA0B/D,6CAA6C,CAAC,MAAM,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,GAAG,OAAO,CAAC,qCAAqC,CAAC;IAkD/H,oCAAoC,CAAC,MAAM,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,EAAE,iBAAiB,EAAE,GAAG;;;;IAgF7F,YAAY,CAAC,MAAM,EAAE,MAAM;;;CAIlC"}
+{"version":3,"file":"profile.service.d.ts","sourceRoot":"","sources":["../../src/profile/profile.service.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,aAAa,EAAE,MAAM,qBAAqB,CAAC;AAGpD,OAAO,EAAE,aAAa,EAAE,MAAM,uBAAuB,CAAC;AACtD,OAAO,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AACzC,OAAO,KAAK,EACR,sCAAsC,EACtC,qCAAqC,EAGxC,MAAM,wBAAwB,CAAC;AAShC,OAAO,EAAE,gBAAgB,EAAE,MAAM,gCAAgC,CAAC;AAClE,OAAO,EAAE,WAAW,EAAE,MAAM,sBAAsB,CAAC;AACnD,OAAO,EAAE,eAAe,EAAE,MAAM,8BAA8B,CAAC;AAC/D,OAAO,EAAE,cAAc,EAAE,MAAM,4BAA4B,CAAC;AAC5D,OAAO,EAAE,YAAY,EAAE,MAAM,wBAAwB,CAAC;AACtD,OAAO,EAAE,WAAW,EAAE,MAAM,sBAAsB,CAAC;AAGnD,OAAO,EAAE,cAAc,EAAE,MAAM,wBAAwB,CAAC;AACxD,OAAO,EAAE,iBAAiB,EAAE,MAAM,2BAA2B,CAAC;AAC9D,OAAO,EAAE,gBAAgB,EAAE,MAAM,0BAA0B,CAAC;AAC5D,OAAO,EAAE,oBAAoB,EAAE,MAAM,sCAAsC,CAAC;AAC5E,OAAO,EAAE,wBAAwB,EAAE,MAAM,mCAAmC,CAAC;AAC7E,OAAO,EAAE,iBAAiB,EAAE,MAAM,2BAA2B,CAAC;AAC9D,OAAO,EAAE,SAAS,EAAE,MAAM,kBAAkB,CAAC;AAM7C,qBACa,cAAc;IAGvB,OAAO,CAAC,QAAQ,CAAC,MAAM;IACvB,OAAO,CAAC,QAAQ,CAAC,IAAI;IAErB,OAAO,CAAC,QAAQ,CAAC,GAAG;IAEpB,OAAO,CAAC,QAAQ,CAAC,OAAO;IACxB,OAAO,CAAC,QAAQ,CAAC,QAAQ;IACzB,OAAO,CAAC,QAAQ,CAAC,SAAS;IAE1B,OAAO,CAAC,QAAQ,CAAC,KAAK;IAEtB,OAAO,CAAC,QAAQ,CAAC,IAAI;IACrB,OAAO,CAAC,QAAQ,CAAC,YAAY;gBAZZ,MAAM,EAAE,aAAa,EACrB,IAAI,EAAE,WAAW,EAEjB,GAAG,EAAE,UAAU,EAEf,OAAO,EAAE,cAAc,EACvB,QAAQ,EAAE,eAAe,EACzB,SAAS,EAAE,gBAAgB,EAE3B,KAAK,EAAE,YAAY,EAEnB,IAAI,EAAE,WAAW,EACjB,YAAY,EAAE,aAAa;IAGxC,WAAW,CAAC,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,EAAE,KAAK,EAAE,QAAQ,EAAE,GAAG,EAAE,EAAE,cAAc,EAAE,MAAM,CAAC,EAAE,MAAM;;;IAqFrG,iBAAiB,CAAC,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,EAAE,KAAK,EAAE,QAAQ,EAAE,EAAE,iBAAiB;;;IAWxF,2BAA2B,CAAC,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,EAAE,GAAG,EAAE,WAAW,EAAE,IAAI,EAAE,EAAE,oBAAoB,EAAE,SAAS,EAAE,MAAM,GAAG,IAAI;;;;IA+EtI,wBAAwB,CAAC,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,EAAE,GAAG,EAAE,WAAW,EAAE,EAAE,oBAAoB;;;IAwEnG,wBAAwB,CAAC,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,EAAE,KAAK,EAAE,EAAE,wBAAwB,EAAE,MAAM,CAAC,EAAE,MAAM;;;IAI7G,qBAAqB,CAAC,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,EAAE,KAAK,EAAE,EAAE,wBAAwB,EAAE,MAAM,CAAC,EAAE,MAAM;;;IAI1G,gBAAgB,CAAC,MAAM,KAAA,EAAE,MAAM,KAAA,EAAE,KAAK,KAAA,EAAE,MAAM,CAAC,EAAE,MAAM;;;IAIvD,kBAAkB,CAAC,MAAM,EAAE,MAAM;;;;;;;;;;IAMjC,UAAU,CAAC,MAAM,EAAE,MAAM;;;;;;;;;;;;;;;;;;;;;;IAezB,aAAa,CAAC,MAAM,EAAE,MAAM;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;IAc5B,SAAS,CAAC,MAAM,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,EAAE,EAAE,IAAI,EAAE,EAAE,SAAS;;;;;;;;;;IAO5D,MAAM,CAAC,MAAM,EAAE,MAAM,EAAE,EAAE,IAAI,EAAE,EAAE,SAAS;;;;;;;;;;;IAYhD;;;;;;;OAOG;IACG,aAAa,CAAC,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,EAAE,QAAQ,EAAE,EAAE,gBAAgB;;;IAsE5E,YAAY,CAAC,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,UAAU;;;;IAO7D,cAAc,CAAC,MAAM,EAAC,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,EAAC,eAAe,EAAE,WAAW,EAAC,EAAE,iBAAiB,EAAE,SAAS,CAAC,EAAE,MAAM,EAAE,SAAS,CAAC,EAAE,MAAM,EAAE,MAAM,CAAC,EAAE,MAAM;;;IA4D9J,qBAAqB,CAAC,KAAK,SAAK,GAAG,MAAM,EAAE;IAYrC,sBAAsB,CAAC,MAAM,EAAE,MAAM;IAmBrC,QAAQ,CAAC,MAAM,EAAE,MAAM,EAAE,SAAS,EAAE,MAAM,GAAG,IAAI;;;IAIjD,aAAa,CAAC,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,IAAI,CAAC,EAAE,MAAM,EAAE,SAAS,CAAC,EAAE,MAAM,GAAG,IAAI;;;;IAmErH,eAAe,CAAC,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM;;;;;IAiD9C,aAAa,CAAC,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,EAAE,SAAS,EAAE,MAAM,GAAG,IAAI;;;IA2CpG,cAAc,CAAC,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,EAAE,YAAY,EAAE,MAAM,EAAE,SAAS,EAAE,MAAM,GAAG,IAAI;;;IAa3H,yBAAyB,CAAC,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,EAAE,YAAY,EAAE,MAAM,EAAE,SAAS,EAAE,MAAM,GAAG,IAAI;;;IAwCvH,SAAS,CAAC,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,EAAE,IAAI,EAAE;QAAE,KAAK,CAAC,EAAE,MAAM,CAAC;QAAC,IAAI,CAAC,EAAE,MAAM,CAAC;QAAC,gBAAgB,CAAC,EAAE,MAAM,GAAG,OAAO,GAAG,UAAU,GAAG,UAAU,CAAC;QAAC,iBAAiB,CAAC,EAAE,GAAG,CAAA;KAAE,EAAE,aAAa,EAAE,MAAM,GAAG,SAAS,EAAE,SAAS,EAAE,MAAM,GAAG,IAAI;;;IA+HrP,iBAAiB,CAAC,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,CAAC,EAAE,MAAM;;;;;;;;;;;;;;;;;;;IAmEjE,oBAAoB,CAAC,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,CAAC,EAAE,MAAM;;;;;;IA8CpE,kBAAkB,CACtB,MAAM,EAAE,MAAM,EACd,MAAM,EAAE,MAAM,EACd,IAAI,EAAE;QAAE,gBAAgB,CAAC,EAAE,MAAM,CAAC;QAAC,IAAI,CAAC,EAAE,MAAM,CAAC;QAAC,gBAAgB,EAAE,MAAM,GAAG,OAAO,GAAG,UAAU,GAAG,UAAU,CAAC;QAAC,iBAAiB,CAAC,EAAE,GAAG,CAAA;KAAE,EACzI,aAAa,CAAC,EAAE,MAAM;;;IA0HlB,6BAA6B,CAAC,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,CAAC,EAAE,MAAM;;;;;;;;;;;;;;;;;;;IAkE7E,uBAAuB,CAAC,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE;QAAE,gBAAgB,CAAC,EAAE,MAAM,CAAC;QAAC,IAAI,CAAC,EAAE,MAAM,CAAC;QAAC,gBAAgB,CAAC,EAAE,MAAM,GAAG,OAAO,GAAG,UAAU,GAAG,UAAU,CAAC;QAAC,iBAAiB,CAAC,EAAE,GAAG,CAAA;KAAE,EAAE,aAAa,CAAC,EAAE,MAAM;;;IA8H1N,mCAAmC,CAAC,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,EAAE,aAAa,CAAC,EAAE,MAAM,GAAG,OAAO,CAAC,sCAAsC,CAAC;IA6E1J,0BAA0B,CAC9B,MAAM,EAAE,MAAM,EACd,MAAM,EAAE,MAAM,EACd,IAAI,EAAE,MAAM,EACZ,mBAAmB,EAAE,GAAG,EACxB,aAAa,CAAC,EAAE,MAAM;;;;IAgElB,qCAAqC,CAAC,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,aAAa,CAAC,EAAE,MAAM,GAAG,OAAO,CAAC,qCAAqC,CAAC;IA8C7I,4BAA4B,CAAC,MAAM,EAAE,MAAM,EAAE,iBAAiB,EAAE,GAAG,EAAE,aAAa,CAAC,EAAE,MAAM;;;IA6D3F,iBAAiB,CACrB,MAAM,EAAE,MAAM,EACd,MAAM,EAAE,MAAM,EACd,KAAK,EAAE,MAAM,EACb,iBAAiB,EAAE,GAAG,EACtB,aAAa,CAAC,EAAE,MAAM;;;IA2ClB,6CAA6C,CAAC,MAAM,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,GAAG,OAAO,CAAC,qCAAqC,CAAC;IAkD/H,oCAAoC,CAAC,MAAM,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,EAAE,iBAAiB,EAAE,GAAG;;;;IAgF7F,YAAY,CAAC,MAAM,EAAE,MAAM,EAAE,SAAS,EAAE,MAAM,GAAG,IAAI;;;CAG5D"}

package/dist/profile/profile.service.js

@@ -60,7 +60,9 @@ const security_service_1 = require("../security/security.service");
 const setting_service_1 = require("../setting/setting.service");
 const token_service_1 = require("../token/token.service");
 const user_service_1 = require("../user/user.service");
+const security_event_vars_1 = require("../utils/security-event-vars");
 const webauthn_origin_1 = require("../utils/webauthn-origin");
+const profile_account_deleted_event_1 = require("./events/profile-account-deleted.event");
 const profile_avatar_updated_event_1 = require("./events/profile-avatar-updated.event");
 const profile_email_changed_event_1 = require("./events/profile-email-changed.event");
 const profile_updated_event_1 = require("./events/profile-updated.event");
@@ -76,7 +78,7 @@ let ProfileService = class ProfileService {
         this.mail = mail;
         this.eventEmitter = eventEmitter;
     }
-    async changeEmail(locale, userId, { email, password, pin }) {
+    async changeEmail(locale, userId, { email, password, pin }, origin) {
         var _a;
         const checkAlreadyExists = await this.prisma.user_identifier.findFirst({
             where: { type: 'email', value: email, enabled: true, verified_at: { not: null } },
@@ -134,7 +136,7 @@ let ProfileService = class ProfileService {
                 }
             });
             // Create verification challenge for the new email
-            await this.challenge.verifyEmail(locale, userId, email);
+            await this.challenge.verifyEmail(locale, userId, email, undefined, origin);
         });
         return {
             requireEmailVerification: settings['require-email-verification'] === true
@@ -149,7 +151,7 @@ let ProfileService = class ProfileService {
         }
         return { success: true };
     }
-    async confirmEmailVerificationMfa(locale, userId, { pin, challengeId, name }) {
+    async confirmEmailVerificationMfa(locale, userId, { pin, challengeId, name }, sessionId) {
         const user = await this.prisma.user.findUnique({
             where: { id: userId },
         });
@@ -210,9 +212,8 @@ let ProfileService = class ProfileService {
                 }
             });
         });
-        const updatedUser = await this.prisma.user.findFirst({ where: { id: user.id } });
-        const codes = await this.createMfaRecoveryCodes(user.id);
-        const newToken = await this.getToken(updatedUser);
+        const codes = await this.createMfaRecoveryCodes(userId);
+        const newToken = await this.getToken(userId, sessionId);
         return Object.assign(Object.assign({}, newToken), { codes });
     }
     async confirmEmailVerification(locale, userId, { pin, challengeId }) {
@@ -270,14 +271,14 @@ let ProfileService = class ProfileService {
         await this.user.registerUserActivity(userId, 'changeEmail');
         return { success: true };
     }
-    async sendEmailVerificationMfa(locale, userId, { email }) {
-        return this.challenge.verifyMfaEmail(locale, userId, email);
+    async sendEmailVerificationMfa(locale, userId, { email }, origin) {
+        return this.challenge.verifyMfaEmail(locale, userId, email, origin);
     }
-    async sendEmailVerification(locale, userId, { email }) {
-        return this.challenge.verifyEmail(locale, userId, email);
+    async sendEmailVerification(locale, userId, { email }, origin) {
+        return this.challenge.verifyEmail(locale, userId, email, undefined, origin);
     }
-    async sendCodeToRemove(locale, userId, email) {
-        return this.challenge.verifyEmail(locale, userId, email);
+    async sendCodeToRemove(locale, userId, email, origin) {
+        return this.challenge.verifyEmail(locale, userId, email, undefined, origin);
     }
     async getEmailIdentifier(userId) {
         return this.prisma.user_identifier.findFirst({
@@ -285,9 +286,17 @@ let ProfileService = class ProfileService {
         });
     }
     async getProfile(userId) {
-        return this.prisma.user.findUnique({
-            where: { id: userId },
-        });
+        const [user, passwordCredentials] = await Promise.all([
+            this.prisma.user.findUnique({ where: { id: userId } }),
+            this.prisma.user_credential.count({ where: { user_id: userId, type: 'password' } }),
+        ]);
+        if (!user)
+            return user;
+        // Quem entrou só por login social não tem senha para digitar. Sem este
+        // campo o cliente não tem como saber disso e acaba exigindo a senha em
+        // telas onde `deleteAccount`/`changePassword` já a dispensam — o que deixa
+        // essas contas sem caminho para excluir a própria conta.
+        return Object.assign(Object.assign({}, user), { hasPassword: passwordCredentials > 0 });
     }
     async getMFAMethods(userId) {
         return this.prisma.user_mfa.findMany({
@@ -319,6 +328,72 @@ let ProfileService = class ProfileService {
         }
         return result;
     }
+    /**
+     * Exclusão de conta pelo próprio usuário (exigida pelas lojas de aplicativos).
+     *
+     * Anonimiza em vez de apagar: os dados pessoais somem e o acesso é revogado
+     * em definitivo, mas as linhas continuam existindo para não quebrar registros
+     * fiscais e integridade referencial. Os identificadores (e-mail, CPF...) são
+     * embaralhados, o que libera o e-mail original para uma conta nova no futuro.
+     */
+    async deleteAccount(locale, userId, { password }) {
+        const user = await this.prisma.user.findUnique({ where: { id: userId } });
+        if (!user) {
+            throw new common_1.NotFoundException((0, api_locale_1.getLocaleText)('userNotFound', locale, 'User not found.'));
+        }
+        if (user.deactivated_at) {
+            throw new common_1.BadRequestException((0, api_locale_1.getLocaleText)('accessDenied', locale, 'Access denied.'));
+        }
+        const credentials = await this.prisma.user_credential.findMany({
+            where: { user_id: userId, type: 'password' },
+        });
+        // Conta com senha exige a senha; conta só de login social não tem o que pedir.
+        if (credentials.length > 0) {
+            if (!password || !(await this.security.validatePassword(locale, credentials, password))) {
+                throw new common_1.BadRequestException((0, api_locale_1.getLocaleText)('accessDenied', locale, 'Access denied.'));
+            }
+        }
+        const deletedAt = new Date();
+        const suffix = `${userId}-${deletedAt.getTime()}`;
+        await this.prisma.$transaction(async (tx) => {
+            // Identificadores primeiro: libera e-mail/CPF para reuso e impede o login,
+            // que resolve o usuário justamente por essa tabela.
+            const identifiers = await tx.user_identifier.findMany({
+                where: { user_id: userId },
+                select: { id: true, type: true },
+            });
+            for (const identifier of identifiers) {
+                await tx.user_identifier.update({
+                    where: { id: identifier.id },
+                    data: {
+                        value: `deleted-${identifier.type}-${suffix}`,
+                        enabled: false,
+                        verified_at: null,
+                    },
+                });
+            }
+            // Credenciais, sessões e segundos fatores: nada aqui pode sobreviver,
+            // ou restaria um caminho de acesso à conta anonimizada.
+            await tx.user_identifier_challenge.deleteMany({ where: { user_identifier: { user_id: userId } } });
+            await tx.user_credential.deleteMany({ where: { user_id: userId } });
+            await tx.user_session.deleteMany({ where: { user_id: userId } });
+            await tx.user_mfa_challenge.deleteMany({ where: { user_mfa: { user_id: userId } } });
+            await tx.user_mfa.deleteMany({ where: { user_id: userId } });
+            await tx.user_recovery_code.deleteMany({ where: { user_id: userId } });
+            await tx.user_account.deleteMany({ where: { user_id: userId } });
+            await tx.user.update({
+                where: { id: userId },
+                data: {
+                    name: 'Usuário removido',
+                    photo_id: null,
+                    deactivated_at: deletedAt,
+                },
+            });
+        });
+        // Cada library cuida dos seus próprios dados (assinatura, progresso, mensagens).
+        this.eventEmitter.emit(profile_account_deleted_event_1.PROFILE_ACCOUNT_DELETED, new profile_account_deleted_event_1.ProfileAccountDeletedEvent(userId, deletedAt));
+        return { success: true };
+    }
     async updateAvatar(locale, userId, file) {
         var _a;
         const result = await this.user.changeAvatar(locale, userId, file);
@@ -326,7 +401,7 @@ let ProfileService = class ProfileService {
         await this.user.registerUserActivity(userId, 'avatar_changed');
         return result;
     }
-    async changePassword(locale, userId, { currentPassword, newPassword }, ipAddress, userAgent) {
+    async changePassword(locale, userId, { currentPassword, newPassword }, ipAddress, userAgent, origin) {
         var _a, _b;
         const credential = await this.prisma.user_credential.findFirst({
             where: { user_id: userId, type: 'password' },
@@ -354,15 +429,16 @@ let ProfileService = class ProfileService {
             },
         });
         if ((_b = (_a = user === null || user === void 0 ? void 0 : user.user_identifier) === null || _a === void 0 ? void 0 : _a[0]) === null || _b === void 0 ? void 0 : _b.value) {
-            this.mail.sendTemplatedMail(locale, {
-                email: user.user_identifier[0].value,
+            const recipientEmail = user.user_identifier[0].value;
+            // Data e pais sao formatados aqui, entao o idioma tem que ser o mesmo que
+            // o corpo do e-mail vai usar - resolvido antes, nao dentro do envio.
+            const recipientLocale = await this.mail.resolveRecipientLocale(recipientEmail, locale, userId);
+            this.mail.sendTemplatedMail(recipientLocale, {
+                email: recipientEmail,
                 slug: 'auth-change-password-notification',
-                variables: {
-                    name: user.name,
-                    userAgent: userAgent || 'Unknown',
-                    ipAddress: ipAddress || 'Unknown',
-                    location: 'Unknown',
-                },
+                userId,
+                variables: Object.assign({ name: user.name }, (0, security_event_vars_1.buildSecurityEventVars)({ ipAddress, userAgent, locale: recipientLocale })),
+                app: await this.challenge.resolveAppKeyFromOrigin(origin),
             }).catch(error => {
                 console.error('Failed to send password change notification:', error);
             });
@@ -394,10 +470,10 @@ let ProfileService = class ProfileService {
         await this.prisma.user_recovery_code.createMany({ data });
         return codes;
     }
-    async getToken(user) {
-        return { token: this.jwt.sign(user) };
+    async getToken(userId, sessionId) {
+        return { token: await this.token.createAccessToken({ sub: userId, sessionId }) };
     }
-    async verifyMfaTotp(locale, userId, token, secret, name) {
+    async verifyMfaTotp(locale, userId, token, secret, name, sessionId) {
         var _a, _b;
         const settings = await this.setting.getSettingValues([
             'mfa-issuer',
@@ -455,9 +531,8 @@ let ProfileService = class ProfileService {
                 },
             });
         }
-        const updatedUser = await this.prisma.user.findFirst({ where: { id: user.id } });
-        const codes = await this.createMfaRecoveryCodes(updatedUser.id);
-        const newToken = await this.getToken(updatedUser);
+        const codes = await this.createMfaRecoveryCodes(userId);
+        const newToken = await this.getToken(userId, sessionId !== null && sessionId !== void 0 ? sessionId : null);
         return Object.assign(Object.assign({}, newToken), { codes });
     }
     async generateMfaTotp(locale, userId) {
@@ -503,7 +578,7 @@ let ProfileService = class ProfileService {
         const encodedSecret = Buffer.from(encryptedSecret, 'utf-8').toString('base64');
         return { otpauthUrl: secret.otpauth_url, qrCode, secret: encodedSecret };
     }
-    async removeMfaTotp(locale, userId, mfaId, token) {
+    async removeMfaTotp(locale, userId, mfaId, token, sessionId) {
         try {
             const user = await this.prisma.user.findFirst({
                 where: { id: userId },
@@ -534,25 +609,25 @@ let ProfileService = class ProfileService {
                     },
                 });
             });
-            return this.getUserToken(userId);
+            return this.getUserToken(userId, sessionId);
         }
         catch (error) {
             throw new common_1.BadRequestException(`Invalid code: ${error === null || error === void 0 ? void 0 : error.message}`);
         }
     }
-    async removeMfaEmail(locale, userId, mfaId, token, providedHash) {
+    async removeMfaEmail(locale, userId, mfaId, token, providedHash, sessionId) {
         try {
             await this.challenge.verifyCode(locale, userId, token, providedHash);
             await this.prisma.user_mfa.deleteMany({
                 where: { id: mfaId, user_id: userId, type: 'email' },
             });
-            return this.getUserToken(userId);
+            return this.getUserToken(userId, sessionId);
         }
         catch (error) {
             throw new common_1.BadRequestException(`Invalid code: ${error === null || error === void 0 ? void 0 : error.message}`);
         }
     }
-    async removeMfaWithRecoveryCode(locale, userId, mfaId, recoveryCode) {
+    async removeMfaWithRecoveryCode(locale, userId, mfaId, recoveryCode, sessionId) {
         try {
             const user = await this.prisma.user.findUnique({
                 where: { id: userId },
@@ -579,13 +654,13 @@ let ProfileService = class ProfileService {
             await this.prisma.user_mfa.deleteMany({
                 where: { id: mfaId, user_id: userId },
             });
-            return this.getUserToken(userId);
+            return this.getUserToken(userId, sessionId);
         }
         catch (error) {
             throw new common_1.BadRequestException(`Invalid code: ${error === null || error === void 0 ? void 0 : error.message}`);
         }
     }
-    async removeMfa(locale, userId, mfaId, data, requestOrigin) {
+    async removeMfa(locale, userId, mfaId, data, requestOrigin, sessionId) {
         try {
             const user = await this.prisma.user.findUnique({
                 where: { id: userId },
@@ -675,13 +750,13 @@ let ProfileService = class ProfileService {
             await this.prisma.user_mfa.deleteMany({
                 where: { id: mfaId, user_id: userId },
             });
-            return this.getUserToken(userId);
+            return this.getUserToken(userId, sessionId);
         }
         catch (error) {
             throw new common_1.BadRequestException(`Failed to remove MFA: ${error === null || error === void 0 ? void 0 : error.message}`);
         }
     }
-    async checkMfaBeforeAdd(locale, userId) {
+    async checkMfaBeforeAdd(locale, userId, origin) {
         try {
             const mfaMethods = await this.prisma.user_mfa.findMany({
                 where: {
@@ -706,7 +781,7 @@ let ProfileService = class ProfileService {
             }
             if (emailMfas.length > 0) {
                 const emails = emailMfas.map(mfa => mfa.user_mfa_email[0].email);
-                await this.challenge.sendMfaCodeToMultipleEmails(locale, userId, emails);
+                await this.challenge.sendMfaCodeToMultipleEmails(locale, userId, emails, origin);
                 availableMethods.push('email');
             }
             if (availableMethods.length === 0 && !webauthnMfa) {
@@ -739,7 +814,7 @@ let ProfileService = class ProfileService {
             throw new common_1.BadRequestException(`Failed to check MFA: ${error === null || error === void 0 ? void 0 : error.message}`);
         }
     }
-    async checkMfaBeforeRemove(locale, userId) {
+    async checkMfaBeforeRemove(locale, userId, origin) {
         try {
             const mfaMethods = await this.prisma.user_mfa.findMany({
                 where: {
@@ -764,7 +839,7 @@ let ProfileService = class ProfileService {
             }
             if (emailMfas.length > 0) {
                 const emails = emailMfas.map(mfa => mfa.user_mfa_email[0].email);
-                await this.challenge.sendMfaCodeToMultipleEmails(locale, userId, emails);
+                await this.challenge.sendMfaCodeToMultipleEmails(locale, userId, emails, origin);
                 availableMethods.push('email');
             }
             return {
@@ -871,7 +946,7 @@ let ProfileService = class ProfileService {
             throw new common_1.BadRequestException(`Failed to verify MFA: ${error === null || error === void 0 ? void 0 : error.message}`);
         }
     }
-    async sendRecoveryCodesVerification(locale, userId) {
+    async sendRecoveryCodesVerification(locale, userId, origin) {
         try {
             const mfaMethods = await this.prisma.user_mfa.findMany({
                 where: {
@@ -896,7 +971,7 @@ let ProfileService = class ProfileService {
             }
             if (emailMfas.length > 0) {
                 const emails = emailMfas.map(mfa => mfa.user_mfa_email[0].email);
-                await this.challenge.sendMfaCodeToMultipleEmails(locale, userId, emails);
+                await this.challenge.sendMfaCodeToMultipleEmails(locale, userId, emails, origin);
                 availableMethods.push('email');
             }
             if (availableMethods.length === 0 && !webauthnMfa) {
@@ -1244,7 +1319,7 @@ let ProfileService = class ProfileService {
             throw new common_1.BadRequestException(`Failed to verify authentication: ${error === null || error === void 0 ? void 0 : error.message}`);
         }
     }
-    async removeWebAuthnMfa(locale, userId, mfaId) {
+    async removeWebAuthnMfa(locale, userId, mfaId, assertionResponse, requestOrigin) {
         try {
             const mfa = await this.prisma.user_mfa.findFirst({
                 where: {
@@ -1256,6 +1331,17 @@ let ProfileService = class ProfileService {
             if (!mfa) {
                 throw new common_1.NotFoundException((0, api_locale_1.getLocaleText)('mfaNotFound', locale, 'MFA method not found.'));
             }
+            // Reautenticacao obrigatoria: sem isso, um token de acesso vazado bastava
+            // para remover a chave de seguranca da conta sem provar posse dela.
+            if (!assertionResponse) {
+                throw new common_1.BadRequestException((0, api_locale_1.getLocaleText)('assertionResponseRequired', locale, 'Assertion response is required for WebAuthn.'));
+            }
+            try {
+                await this.verifyWebAuthnAuthentication(userId, assertionResponse, requestOrigin);
+            }
+            catch (error) {
+                throw new common_1.BadRequestException((0, api_locale_1.getLocaleText)('invalidWebAuthn', locale, 'WebAuthn verification failed.'));
+            }
             await this.prisma.user_mfa.delete({
                 where: { id: mfaId },
             });
@@ -1383,9 +1469,8 @@ let ProfileService = class ProfileService {
             throw new common_1.BadRequestException(`Failed to verify authentication: ${error === null || error === void 0 ? void 0 : error.message}`);
         }
     }
-    async getUserToken(userId) {
-        const updatedUser = await this.prisma.user.findFirst({ where: { id: userId } });
-        return this.getToken(updatedUser);
+    async getUserToken(userId, sessionId) {
+        return this.getToken(userId, sessionId);
     }
 };
 exports.ProfileService = ProfileService;