@hed-hog/core 0.0.387 → 0.0.393

package/src/ai-instruction/dto/create-ai-instruction.dto.ts

@@ -1,12 +1,26 @@
-import { IsBoolean, IsEnum, IsObject, IsOptional, IsString, MaxLength } from 'class-validator';
-import { AiInstructionLayer } from '../types/ai-instruction.types';
+import {
+  IsBoolean,
+  IsIn,
+  IsInt,
+  IsNumber,
+  IsObject,
+  IsOptional,
+  IsString,
+  Max,
+  MaxLength,
+  Min,
+} from 'class-validator';
+import {
+  AI_INSTRUCTION_LAYERS,
+  AiInstructionLayer,
+} from '../types/ai-instruction.types';
 
 export class CreateAiInstructionDTO {
   @IsString()
   @MaxLength(255)
   slug: string;
 
-  @IsEnum(['system', 'product', 'module', 'agent', 'tool', 'output'])
+  @IsIn(AI_INSTRUCTION_LAYERS)
   layer: AiInstructionLayer;
 
   @IsString()
@@ -33,4 +47,26 @@ export class CreateAiInstructionDTO {
   @IsOptional()
   @IsBoolean()
   is_active?: boolean;
+
+  @IsOptional()
+  @IsString()
+  @MaxLength(100)
+  model?: string | null;
+
+  @IsOptional()
+  @IsNumber()
+  @Min(0)
+  @Max(2)
+  temperature?: number | null;
+
+  @IsOptional()
+  @IsInt()
+  @Min(1)
+  @Max(200000)
+  max_tokens?: number | null;
+
+  /** Save even when required variables are missing from the content. */
+  @IsOptional()
+  @IsBoolean()
+  allow_missing_variables?: boolean;
 }

package/src/ai-instruction/dto/preview-ai-instruction.dto.ts

@@ -0,0 +1,26 @@
+import { IsObject, IsOptional, IsString, MaxLength } from 'class-validator';
+
+/**
+ * Stateless render of a draft. The admin sends the content currently in the
+ * textarea — unsaved — so the editor can see the interpolated result before
+ * committing to it.
+ */
+export class PreviewAiInstructionDTO {
+  @IsString()
+  content: string;
+
+  /** Only used to look up the registry definition (guard phrases, variables). */
+  @IsOptional()
+  @IsString()
+  @MaxLength(255)
+  slug?: string;
+
+  /** Fallback when the slug is not registered in code. */
+  @IsOptional()
+  @IsObject()
+  variables_schema?: Record<string, any>;
+
+  @IsOptional()
+  @IsObject()
+  variables?: Record<string, string | number | boolean>;
+}

package/src/ai-instruction/dto/update-ai-instruction.dto.ts

@@ -1,5 +1,19 @@
-import { IsBoolean, IsObject, IsOptional, IsString, MaxLength } from 'class-validator';
+import {
+  IsBoolean,
+  IsInt,
+  IsNumber,
+  IsObject,
+  IsOptional,
+  IsString,
+  Max,
+  MaxLength,
+  Min,
+} from 'class-validator';
 
+/**
+ * `slug` and `layer` are intentionally absent — they are immutable after
+ * creation, since the calling code resolves prompts by slug.
+ */
 export class UpdateAiInstructionDTO {
   @IsOptional()
   @IsString()
@@ -32,4 +46,31 @@ export class UpdateAiInstructionDTO {
   @IsString()
   @MaxLength(500)
   change_note?: string;
+
+  @IsOptional()
+  @IsString()
+  @MaxLength(100)
+  model?: string | null;
+
+  @IsOptional()
+  @IsNumber()
+  @Min(0)
+  @Max(2)
+  temperature?: number | null;
+
+  @IsOptional()
+  @IsInt()
+  @Min(1)
+  @Max(200000)
+  max_tokens?: number | null;
+
+  /** Save even when required variables are missing from the content. */
+  @IsOptional()
+  @IsBoolean()
+  allow_missing_variables?: boolean;
+
+  /** Required to edit a record flagged `is_locked` (security-sensitive prompt). */
+  @IsOptional()
+  @IsBoolean()
+  acknowledge_security_review?: boolean;
 }

package/src/ai-instruction/types/ai-instruction.types.ts

@@ -4,7 +4,18 @@ export type AiInstructionLayer =
   | 'module'
   | 'agent'
   | 'tool'
-  | 'output';
+  | 'output'
+  | 'task';
+
+export const AI_INSTRUCTION_LAYERS: AiInstructionLayer[] = [
+  'system',
+  'product',
+  'module',
+  'agent',
+  'tool',
+  'output',
+  'task',
+];
 
 export type AiInstructionRecord = {
   id: number;
@@ -17,10 +28,22 @@ export type AiInstructionRecord = {
   module_slug: string | null;
   is_active: boolean;
   version: number;
+  /** NULL means "keep whatever the calling code already uses". */
+  model: string | null;
+  temperature: number | null;
+  max_tokens: number | null;
+  /** Editing requires an explicit acknowledgement (security-sensitive prompt). */
+  is_locked: boolean;
   created_at: Date;
   updated_at: Date;
 };
 
+export type AiInstructionListFilters = {
+  layer?: AiInstructionLayer;
+  module_slug?: string;
+  is_active?: boolean;
+};
+
 export type AiExecutionTrigger = 'manual' | 'webhook' | 'schedule' | 'tool' | 'api';
 export type AiExecutionStatus = 'running' | 'completed' | 'failed' | 'cancelled';
 export type AiExecutionStepType = 'prompt' | 'tool_call' | 'tool_result' | 'output' | 'error';

package/src/auth/auth.controller.ts

@@ -1,4 +1,4 @@
-import { NoRole, Public, User, UserOptional } from '@hed-hog/api';
+import { Impersonation, ImpersonationContext, NoRole, Public, Session, User, UserOptional } from '@hed-hog/api';
 import { Locale } from '@hed-hog/api-locale';
 import {
   Body,
@@ -19,14 +19,15 @@ import { Throttle, ThrottlerGuard } from '@nestjs/throttler';
 import type { PublicKeyCredentialRequestOptionsJSON } from '@simplewebauthn/server';
 import { TokenService } from '../token/token.service';
 import { CreateWithEmailAndPasswordDTO } from '../user/dto/create-with-email-and-password.dto';
-import { UserService } from '../user/user.service';
 import { AuthService } from './auth.service';
+import { ConfirmEmailDTO } from './dto/confirm-email.dto';
 import { ForgetDTO } from './dto/forget.dto';
 import { LoginEmailVerificationResendDTO } from './dto/login-email-verification-resend.dto';
 import { LoginEmailVerificationDTO } from './dto/login-email-verification.dto';
 import { LoginWithCodeDTO } from './dto/login-with-code.dto';
 import { LoginWithRecoveryCodeDTO } from './dto/login-with-recovery-code';
 import { LoginDTO } from './dto/login.dto';
+import { ResendConfirmationDTO } from './dto/resend-confirmation.dto';
 import { ResendMfaCodeDTO } from './dto/resend-mfa-code.dto';
 import { ResetDTO } from './dto/reset.dto';
 import { CompleteAccountDTO, VerifyAccountInviteDTO } from './dto/complete-account.dto';
@@ -40,25 +41,24 @@ export class AuthController {
     private readonly service: AuthService,
     @Inject(forwardRef(() => TokenService))
     private readonly token: TokenService,
-    @Inject(forwardRef(() => UserService))
-    private readonly user: UserService,
   ) { }
 
   @NoRole()
   @Get('verify')
-  async verify(@User() { id }, @Locale() locale: string) {
-    return this.service.verifyUser(locale, id);
+  async verify(@User() { id }, @Session() sessionId: number, @Locale() locale: string) {
+    return this.service.verifyUser(locale, id, sessionId);
   }
 
   @NoRole()
   @Get('desktop-token')
   async desktopToken(
     @User() { id },
+    @Impersonation() impersonation: ImpersonationContext,
     @Locale() locale: string,
     @Ip() ipAddress: string,
     @Headers('user-agent') userAgent: string,
   ) {
-    return this.service.issueDesktopToken(locale, id, ipAddress, userAgent);
+    return this.service.issueDesktopToken(locale, id, ipAddress, userAgent, impersonation.active);
   }
 
   @NoRole()
@@ -103,9 +103,10 @@ export class AuthController {
     @Ip() ipAddress: string,
     @Headers('user-agent') userAgent: string,
     @Headers('x-browser-id') browserId: string,
+    @Headers('origin') origin: string,
     @Res({ passthrough: true }) res,
   ) {
-    return this.service.loginWithEmailAndPassword(res, locale, ipAddress, userAgent, data, browserId || null);
+    return this.service.loginWithEmailAndPassword(res, locale, ipAddress, userAgent, data, browserId || null, origin);
   }
 
   @Public()
@@ -118,27 +119,68 @@ export class AuthController {
     @Ip() ipAddress: string,
     @Headers('user-agent') userAgent: string,
     @Headers('x-browser-id') browserId: string,
+    @Headers('origin') origin: string,
     @Res({ passthrough: true }) res,
   ) {
-    return this.service.emailVerificationLogin(locale, token, code, ipAddress, userAgent, res, browserId || null);
+    return this.service.emailVerificationLogin(locale, token, code, ipAddress, userAgent, res, browserId || null, origin);
   }
 
   @Public()
+  @UseGuards(ThrottlerGuard)
+  @Throttle({ default: { limit: 10, ttl: 60_000 } })
   @Post('login-email-verification-resend')
   async emailVerificationLoginResend(
     @Locale() locale: string,
     @Body() {token}: LoginEmailVerificationResendDTO,
+    @Headers('origin') origin: string,
+  ) {
+    return this.service.emailVerificationLoginResend(locale, token, origin);
+  }
+
+  // Confirma o e-mail pelo link do cadastro. Não autentica: só marca o
+  // identificador como verificado, e repetir o clique é inofensivo.
+  @Public()
+  @UseGuards(ThrottlerGuard)
+  @Throttle({ default: { limit: 10, ttl: 60_000 } })
+  @Post('confirm-email')
+  async confirmEmail(
+    @Locale() locale: string,
+    @Body() { token }: ConfirmEmailDTO,
   ) {
-    return this.service.emailVerificationLoginResend(locale, token);
+    return this.service.confirmEmail(locale, token);
   }
 
+  // Mesmo rate-limit do login: sem ele a rota criava contas sem qualquer
+  // limite por IP. Recebe os dados de sessão porque, quando a confirmação de
+  // e-mail não é exigida, o cadastro já sai autenticado.
   @Public()
+  @UseGuards(ThrottlerGuard)
+  @Throttle({ default: { limit: 10, ttl: 60_000 } })
   @Post('signup')
   async registerWithEmailAndPassword(
     @Locale() locale: string,
     @Body() data: CreateWithEmailAndPasswordDTO,
+    @Ip() ipAddress: string,
+    @Headers('user-agent') userAgent: string,
+    @Headers('x-browser-id') browserId: string,
+    @Headers('origin') origin: string,
+    @Res({ passthrough: true }) res,
+  ) {
+    return this.service.signupWithEmailAndPassword(res, locale, ipAddress, userAgent, data, browserId || null, origin);
+  }
+
+  // Reenvia o link de confirmação do cadastro. Limite mais apertado que o das
+  // demais rotas públicas porque cada chamada dispara um e-mail.
+  @Public()
+  @UseGuards(ThrottlerGuard)
+  @Throttle({ default: { limit: 3, ttl: 60_000 } })
+  @Post('resend-confirmation')
+  async resendConfirmation(
+    @Locale() locale: string,
+    @Body() { email, app }: ResendConfirmationDTO,
+    @Headers('origin') origin: string,
   ) {
-    return this.user.createWithEmailAndPassword(locale, data);
+    return this.service.resendEmailConfirmation(locale, email, app, origin);
   }
 
   @Public()
@@ -151,6 +193,7 @@ export class AuthController {
     @Ip() ipAddress: string,
     @Headers('user-agent') userAgent: string,
     @Headers('x-browser-id') browserId: string,
+    @Headers('origin') origin: string,
     @Res({ passthrough: true }) res,
   ) {
     const { accessToken, refreshToken, session, requiresPasswordReset } = await this.service.verifyMfaCode(
@@ -161,6 +204,7 @@ export class AuthController {
       userAgent,
       methodType,
       browserId || null,
+      origin,
     );
 
     await this.token.setRefreshTokenCookie(locale, res, refreshToken, session.expires_at);
@@ -177,6 +221,7 @@ export class AuthController {
     @Ip() ipAddress: string,
     @Headers('user-agent') userAgent: string,
     @Headers('x-browser-id') browserId: string,
+    @Headers('origin') origin: string,
     @Res({ passthrough: true }) res,
   ) {
     const { accessToken, refreshToken, session, requiresPasswordReset } = await this.service.verifyMfaRecoveryCode(
@@ -186,6 +231,7 @@ export class AuthController {
       ipAddress,
       userAgent,
       browserId || null,
+      origin,
     );
 
     await this.token.setRefreshTokenCookie(locale, res, refreshToken, session.expires_at);
@@ -193,15 +239,20 @@ export class AuthController {
   }
 
   @Public()
+  @UseGuards(ThrottlerGuard)
+  @Throttle({ default: { limit: 10, ttl: 60_000 } })
   @Post('resend-mfa-code')
   async resendMfaCode(
     @Locale() locale: string,
     @Body() { token }: ResendMfaCodeDTO,
+    @Headers('origin') origin: string,
   ) {
-    return this.service.resendMfaCode(locale, token);
+    return this.service.resendMfaCode(locale, token, origin);
   }
 
   @Public()
+  @UseGuards(ThrottlerGuard)
+  @Throttle({ default: { limit: 10, ttl: 60_000 } })
   @Post('webauthn/generate')
   async generateWebAuthnOptions(
     @Locale() locale: string,
@@ -212,6 +263,8 @@ export class AuthController {
   }
 
   @Public()
+  @UseGuards(ThrottlerGuard)
+  @Throttle({ default: { limit: 10, ttl: 60_000 } })
   @Post('webauthn/verify')
   async verifyWebAuthn(
     @Locale() locale: string,
@@ -268,8 +321,9 @@ export class AuthController {
     @Body() { password, code }: ResetDTO,
     @Ip() ipAddress: string,
     @Headers('user-agent') userAgent: string,
+    @Headers('origin') origin: string,
   ) {
-    return this.service.forgotResetPassword(locale, password, code, ipAddress, userAgent);
+    return this.service.forgotResetPassword(locale, password, code, ipAddress, userAgent, origin);
   }
 
   @Public()
@@ -291,4 +345,15 @@ export class AuthController {
   ) {
     return this.service.completeAccount(locale, { password, code, name }, ipAddress, userAgent);
   }
+
+  @Public()
+  @Post('complete-account/authorize')
+  async authorizeAccountInvite(
+    @Locale() locale: string,
+    @Body() { code }: VerifyAccountInviteDTO,
+    @Ip() ipAddress: string,
+    @Headers('user-agent') userAgent: string,
+  ) {
+    return this.service.authorizeAccountInvite(locale, code, ipAddress, userAgent);
+  }
 }

package/src/auth/auth.module.ts

@@ -15,6 +15,7 @@ import { SessionModule } from '../session/session.module';
 import { SettingModule } from '../setting/setting.module';
 import { TokenModule } from '../token/token.module';
 import { TokenService } from '../token/token.service';
+import { UserDeviceModule } from '../user-device/user-device.module';
 import { UserModule } from '../user/user.module';
 import { AuthController } from './auth.controller';
 import { AuthService } from './auth.service';
@@ -77,6 +78,7 @@ import { AuthGuard } from './guards/auth.guard';
     forwardRef(() => TokenModule),
     forwardRef(() => ChallengeModule),
     forwardRef(() => SessionModule),
+    forwardRef(() => UserDeviceModule),
     ConfigModule,
     HttpModule,
   ],