@hed-hog/core 0.0.387 → 0.0.393

package/src/auth/auth.service.spec.ts

@@ -10,13 +10,19 @@ jest.mock('speakeasy', () => ({
   totp: { verify: (...args: any[]) => speakeasyVerify(...args) },
 }));
 
+import { localeStorage } from '@hed-hog/api-locale';
 import { AuthService } from './auth.service';
 
 const makeDeps = () => {
   const prisma = {
     user: { update: jest.fn(), findUnique: jest.fn(), findFirst: jest.fn() },
     user_credential: { findFirst: jest.fn(), updateMany: jest.fn() },
-    user_identifier: { findFirst: jest.fn(), findMany: jest.fn() },
+    user_identifier: {
+      findFirst: jest.fn(),
+      findMany: jest.fn(),
+      findUnique: jest.fn(),
+      update: jest.fn(),
+    },
     user_identifier_challenge: {
       create: jest.fn(),
       findUnique: jest.fn(),
@@ -29,8 +35,17 @@ const makeDeps = () => {
     role: { findMany: jest.fn() },
     $transaction: jest.fn(),
   };
-  const mail = { sendTemplatedMail: jest.fn().mockResolvedValue(undefined) };
-  const setting = { getSettingValues: jest.fn() };
+  const mail = {
+    sendTemplatedMail: jest.fn().mockResolvedValue(undefined),
+    // Idempotente por contrato: sem preferencia gravada, devolve o que veio.
+    resolveRecipientLocale: jest.fn(async (_email: string, locale?: string) => locale ?? 'en'),
+  };
+  const setting = {
+    getSettingValues: jest.fn(),
+    getUserSettingValue: jest.fn(async () => null),
+    getSettingListValues: jest.fn(async () => ['en', 'pt']),
+    setSettingUserValue: jest.fn(async () => ({})),
+  };
   const security = {
     generateCode: jest.fn(),
     hashWithPepper: jest.fn(),
@@ -44,6 +59,7 @@ const makeDeps = () => {
     decodeExpiredToken: jest.fn(),
     createMfaChallengeToken: jest.fn(),
     verifyMfaChallengeToken: jest.fn(),
+    verifyEmailConfirmationToken: jest.fn(),
     setRefreshTokenCookie: jest.fn(),
   };
   const session = {
@@ -55,6 +71,7 @@ const makeDeps = () => {
     findUserByEmail: jest.fn(),
     findUserById: jest.fn(),
     registerUserActivity: jest.fn(),
+    createWithEmailAndPassword: jest.fn(),
   };
   const challenge = {
     sendMfaCodeToMultipleEmails: jest.fn(),
@@ -62,8 +79,16 @@ const makeDeps = () => {
     forgotEmail: jest.fn(),
     verifyCodePassword: jest.fn(),
     verifyMfaEmailCode: jest.fn(),
+    resolveAppKeyFromOrigin: jest.fn().mockResolvedValue(undefined),
+    sendEmailConfirmationLink: jest.fn(),
   };
-  return { prisma, mail, setting, security, token, session, user, challenge };
+  const userDevice = {
+    // Default false: dispositivo conhecido, nenhum alerta — o cenario esperado
+    // pela maioria dos casos, que so verificam o retorno do login.
+    isNewDevice: jest.fn().mockResolvedValue(false),
+    remember: jest.fn().mockResolvedValue(undefined),
+  };
+  return { prisma, mail, setting, security, token, session, user, challenge, userDevice };
 };
 
 const makeService = (deps = makeDeps()) => ({
@@ -76,6 +101,7 @@ const makeService = (deps = makeDeps()) => ({
     deps.session as any,
     deps.user as any,
     deps.challenge as any,
+    deps.userDevice as any,
   ),
   deps,
 });
@@ -203,6 +229,7 @@ describe('AuthService', () => {
         'pt-BR',
         1,
         ['mfa@b.com'],
+        undefined,
       );
       expect(result).toEqual({
         requiresMfa: true,
@@ -328,6 +355,284 @@ describe('AuthService', () => {
     });
   });
 
+  describe('signupWithEmailAndPassword', () => {
+    const createdUser = { id: 9, name: 'Aluno Novo' };
+
+    it('com require-email-verification ligada, não emite sessão nem seta cookie', async () => {
+      const { service, deps } = makeService();
+      deps.user.createWithEmailAndPassword.mockResolvedValue({ user: createdUser });
+      deps.setting.getSettingValues.mockResolvedValue({
+        'require-email-verification': true,
+      });
+
+      const result = await service.signupWithEmailAndPassword(
+        {},
+        'pt-BR',
+        '1.1.1.1',
+        'UA',
+        { email: 'aluno@example.com', name: 'Aluno Novo', password: 'Sup3r$ecret' } as any,
+      );
+
+      expect(result).toEqual({ user: createdUser, hasChallenge: true });
+      expect(deps.token.setRefreshTokenCookie).not.toHaveBeenCalled();
+      expect(deps.token.createAccessToken).not.toHaveBeenCalled();
+    });
+
+    it('com require-email-verification desligada, cadastra já autenticado', async () => {
+      const { service, deps } = makeService();
+      deps.user.createWithEmailAndPassword.mockResolvedValue({ user: createdUser });
+      deps.setting.getSettingValues.mockResolvedValue({
+        'require-email-verification': false,
+      });
+      deps.prisma.user_identifier.findMany.mockResolvedValue([
+        { value: 'aluno@example.com' },
+      ]);
+      deps.session.create.mockResolvedValue({
+        token: 'refresh-9',
+        session: { id: 9, expires_at: new Date('2026-01-02') },
+      });
+      deps.token.createAccessToken.mockResolvedValue('access-9');
+
+      const result = await service.signupWithEmailAndPassword(
+        {},
+        'pt-BR',
+        '1.1.1.1',
+        'UA',
+        { email: 'aluno@example.com', name: 'Aluno Novo', password: 'Sup3r$ecret' } as any,
+      );
+
+      expect(deps.token.setRefreshTokenCookie).toHaveBeenCalled();
+      expect(result).toEqual({
+        user: createdUser,
+        hasChallenge: false,
+        accessToken: 'access-9',
+        refreshToken: 'refresh-9',
+        requiresPasswordReset: false,
+      });
+    });
+  });
+
+  describe('resendEmailConfirmation', () => {
+    it('reenvia o link quando encontra o usuário pelo e-mail', async () => {
+      const { service, deps } = makeService();
+      deps.user.findUserByEmail.mockResolvedValue({ id: 4 });
+
+      const result = await service.resendEmailConfirmation(
+        'pt-BR',
+        'aluno@example.com',
+        'class',
+        'https://class.hcode.com.br',
+      );
+
+      expect(deps.challenge.sendEmailConfirmationLink).toHaveBeenCalledWith(
+        'pt-BR',
+        4,
+        'aluno@example.com',
+        'class',
+        'https://class.hcode.com.br',
+      );
+      expect(result).toEqual({ sent: true });
+    });
+
+    it('responde sent:true mesmo sem encontrar o e-mail (evita enumeração)', async () => {
+      const { service, deps } = makeService();
+      deps.user.findUserByEmail.mockResolvedValue(null);
+
+      const result = await service.resendEmailConfirmation('pt-BR', 'inexistente@example.com');
+
+      expect(deps.challenge.sendEmailConfirmationLink).not.toHaveBeenCalled();
+      expect(result).toEqual({ sent: true });
+    });
+
+    it('responde sent:true mesmo quando o envio falha (ex.: e-mail já verificado)', async () => {
+      const { service, deps } = makeService();
+      deps.user.findUserByEmail.mockResolvedValue({ id: 4 });
+      deps.challenge.sendEmailConfirmationLink.mockRejectedValue(
+        new NotFoundException('already verified'),
+      );
+
+      const result = await service.resendEmailConfirmation('pt-BR', 'aluno@example.com');
+
+      expect(result).toEqual({ sent: true });
+    });
+  });
+
+  describe('alerta de dispositivo novo', () => {
+    // Login simples, sem MFA nem verificação de e-mail: o caminho que chega em
+    // login() e decide se manda o alerta.
+    const arrangeLogin = (deps: any, identifiers = [{ value: 'a@b.com' }]) => {
+      deps.user.findUserByEmail.mockResolvedValue({
+        id: 1,
+        name: 'John',
+        user_credential: [{ type: 'password' }],
+        user_identifier: [{ type: 'email', value: 'a@b.com', verified_at: new Date() }],
+      });
+      deps.security.validatePassword.mockResolvedValue(true);
+      deps.prisma.user_mfa.findMany.mockResolvedValue([]);
+      deps.setting.getSettingValues.mockResolvedValue({
+        'require-mfa': false,
+        'require-email-verification': false,
+      });
+      deps.prisma.user_identifier.findMany.mockResolvedValue(identifiers);
+      deps.session.create.mockResolvedValue({
+        token: 'refresh-1',
+        session: { id: 1, expires_at: new Date('2026-01-02') },
+      });
+      deps.token.createAccessToken.mockResolvedValue('access-1');
+    };
+
+    const doLogin = (service: any) =>
+      service.loginWithEmailAndPassword({}, 'pt', '8.8.8.8', 'UA', {
+        email: 'a@b.com',
+        password: 'right',
+      } as any);
+
+    it('não avisa quando o dispositivo já é conhecido', async () => {
+      const { service, deps } = makeService();
+      arrangeLogin(deps);
+      deps.userDevice.isNewDevice.mockResolvedValue(false);
+
+      await doLogin(service);
+
+      expect(deps.mail.sendTemplatedMail).not.toHaveBeenCalled();
+    });
+
+    it('avisa quando o dispositivo é desconhecido', async () => {
+      const { service, deps } = makeService();
+      arrangeLogin(deps);
+      deps.userDevice.isNewDevice.mockResolvedValue(true);
+
+      await doLogin(service);
+
+      expect(deps.userDevice.isNewDevice).toHaveBeenCalledWith(1, 'UA', undefined);
+      expect(deps.mail.sendTemplatedMail).toHaveBeenCalledTimes(1);
+      const [locale, payload] = deps.mail.sendTemplatedMail.mock.calls[0] as any[];
+      expect(locale).toBe('pt');
+      expect(payload.slug).toBe('auth-login-new-device');
+      expect(payload.email).toBe('a@b.com');
+      // Enriquecimento: nada de "Unknown" literal, e o UA cru vira browser/os.
+      expect(payload.variables).toMatchObject({ name: 'John', ipAddress: '8.8.8.8' });
+      expect(payload.variables.datetime).toEqual(expect.any(String));
+      expect(payload.variables.location).not.toBe('Unknown');
+    });
+
+    it('avisa só o e-mail usado no login, não todos os identificadores', async () => {
+      const { service, deps } = makeService();
+      arrangeLogin(deps, [{ value: 'secundario@b.com' }, { value: 'a@b.com' }]);
+      deps.userDevice.isNewDevice.mockResolvedValue(true);
+
+      await doLogin(service);
+
+      expect(deps.mail.sendTemplatedMail).toHaveBeenCalledTimes(1);
+      expect((deps.mail.sendTemplatedMail.mock.calls[0] as any[])[1].email).toBe('a@b.com');
+    });
+
+    // O idioma e aprendido no mesmo funil do dispositivo. Write-once: um login
+    // de aparelho emprestado nao pode apagar a escolha feita nas preferencias.
+    describe('preferencia de idioma detectada', () => {
+      // `detected` so e verdadeiro quando o cliente mandou um idioma suportado.
+      const loginWithDetectedLocale = (service: any, detected: boolean) =>
+        localeStorage.run({ locale: 'pt', detected }, () =>
+          service.loginWithEmailAndPassword({}, 'pt', '8.8.8.8', 'UA', {
+            email: 'a@b.com',
+            password: 'right',
+          } as any),
+        );
+
+      it('grava o idioma do cliente quando o usuario ainda nao tem preferencia', async () => {
+        const { service, deps } = makeService();
+        arrangeLogin(deps);
+        deps.userDevice.isNewDevice.mockResolvedValue(false);
+
+        await loginWithDetectedLocale(service, true);
+
+        expect(deps.setting.setSettingUserValue).toHaveBeenCalledWith(
+          'pt', 1, 'language', 'pt',
+        );
+      });
+
+      it('nao sobrescreve a preferencia ja escolhida pelo usuario', async () => {
+        const { service, deps } = makeService();
+        arrangeLogin(deps);
+        deps.userDevice.isNewDevice.mockResolvedValue(false);
+        deps.setting.getUserSettingValue.mockResolvedValue('en');
+
+        await loginWithDetectedLocale(service, true);
+
+        expect(deps.setting.setSettingUserValue).not.toHaveBeenCalled();
+      });
+
+      // Sem esta guarda, todo cliente que nao manda `Accept-Language` (o app
+      // mobile, cron, curl) congelaria o default `en` como preferencia.
+      it('nao grava quando o cliente nao declarou idioma', async () => {
+        const { service, deps } = makeService();
+        arrangeLogin(deps);
+        deps.userDevice.isNewDevice.mockResolvedValue(false);
+
+        await loginWithDetectedLocale(service, false);
+
+        expect(deps.setting.setSettingUserValue).not.toHaveBeenCalled();
+      });
+
+      // `setSettingUserValue` valida override, nao o valor: sem esta checagem
+      // um navegador em `de-DE` gravaria um idioma sem template nenhum.
+      it('nao grava idioma fora das opcoes da setting', async () => {
+        const { service, deps } = makeService();
+        arrangeLogin(deps);
+        deps.userDevice.isNewDevice.mockResolvedValue(false);
+
+        await localeStorage.run({ locale: 'de', detected: true }, () =>
+          service.loginWithEmailAndPassword({}, 'de', '8.8.8.8', 'UA', {
+            email: 'a@b.com',
+            password: 'right',
+          } as any),
+        );
+
+        expect(deps.setting.setSettingUserValue).not.toHaveBeenCalled();
+      });
+
+      it('nao derruba o login quando a gravacao falha', async () => {
+        const { service, deps } = makeService();
+        arrangeLogin(deps);
+        deps.userDevice.isNewDevice.mockResolvedValue(false);
+        deps.setting.setSettingUserValue.mockRejectedValue(new Error('db down'));
+
+        await expect(loginWithDetectedLocale(service, true)).resolves.toEqual(
+          expect.objectContaining({ accessToken: 'access-1' }),
+        );
+      });
+    });
+
+    it('checa o dispositivo antes de registrá-lo', async () => {
+      const { service, deps } = makeService();
+      arrangeLogin(deps);
+
+      await doLogin(service);
+
+      // Invertido, o registro do login atual faria todo login parecer conhecido.
+      expect(deps.userDevice.isNewDevice.mock.invocationCallOrder[0]).toBeLessThan(
+        deps.userDevice.remember.mock.invocationCallOrder[0],
+      );
+    });
+
+    it('registra o dispositivo em getAuthenticationPayload, valendo para todo caminho de login', async () => {
+      const { service, deps } = makeService();
+      deps.session.create.mockResolvedValue({
+        token: 'refresh-1',
+        session: { id: 1, expires_at: new Date('2026-01-02') },
+      });
+      deps.token.createAccessToken.mockResolvedValue('access-1');
+
+      await service.getAuthenticationPayload('pt', 7, '8.8.8.8', 'UA', 'browser-9');
+
+      expect(deps.userDevice.remember).toHaveBeenCalledWith(7, {
+        userAgent: 'UA',
+        browserId: 'browser-9',
+        ipAddress: '8.8.8.8',
+      });
+    });
+  });
+
   describe('verifyRoles / verifyUser', () => {
     it('verifyRoles delega para prisma.role.findMany', async () => {
       const { service, deps } = makeService();
@@ -655,7 +960,7 @@ describe('AuthService', () => {
 
       const result = await service.resendMfaCode('pt-BR', 'mfa-token');
 
-      expect(deps.challenge.sendMfaCodeByEmail).toHaveBeenCalledWith('pt-BR', 1, 'a@b.com');
+      expect(deps.challenge.sendMfaCodeByEmail).toHaveBeenCalledWith('pt-BR', 1, 'a@b.com', undefined);
       expect(result).toEqual({ success: true, hasEmailMfa: true });
     });
   });
@@ -828,7 +1133,7 @@ describe('AuthService', () => {
       deps.prisma.user_identifier_challenge.findUnique.mockResolvedValue({
         hash: 'matching-hash',
         user_identifier_id: 2,
-        user_identifier: { user_id: 9 },
+        user_identifier: { user_id: 9, value: 'a@b.com' },
       });
       deps.security.hashWithPepper.mockReturnValue('matching-hash');
       deps.prisma.$transaction.mockImplementation(async (cb: any) =>
@@ -884,8 +1189,82 @@ describe('AuthService', () => {
         where: { type: 'password', user_id: 1 },
         data: { hash: 'new-hash', requires_reset: false },
       });
-      expect(deps.user.registerUserActivity).toHaveBeenCalledWith(2, 'resetPassword');
+      // user_id (1), não o id do identificador (2): a atividade é do usuário.
+      expect(deps.user.registerUserActivity).toHaveBeenCalledWith(1, 'resetPassword');
       expect(result.accessToken).toBe('access-8');
     });
   });
+
+  describe('confirmEmail', () => {
+    const identifier = {
+      id: 42,
+      user_id: 7,
+      value: 'a@b.com',
+      verified_at: null,
+      user: { id: 7, name: 'Bob' },
+    };
+
+    it('marca o e-mail como verificado e não cria sessão', async () => {
+      const { service, deps } = makeService();
+      deps.token.verifyEmailConfirmationToken.mockResolvedValue({
+        userIdentifierId: 42,
+      });
+      deps.prisma.user_identifier.findUnique.mockResolvedValue(identifier);
+
+      const result = await service.confirmEmail('pt-BR', 'tok');
+
+      expect(deps.prisma.user_identifier.update).toHaveBeenCalledWith({
+        where: { id: 42 },
+        data: { verified_at: expect.any(Date), enabled: true },
+      });
+      expect(deps.user.registerUserActivity).toHaveBeenCalledWith(7, 'confirmEmail');
+      expect(deps.session.create).not.toHaveBeenCalled();
+      expect(result).toEqual({
+        confirmed: true,
+        alreadyConfirmed: false,
+        email: 'a@b.com',
+        name: 'Bob',
+      });
+    });
+
+    it('segundo clique no link responde "já confirmado" em vez de erro', async () => {
+      const { service, deps } = makeService();
+      deps.token.verifyEmailConfirmationToken.mockResolvedValue({
+        userIdentifierId: 42,
+      });
+      deps.prisma.user_identifier.findUnique.mockResolvedValue({
+        ...identifier,
+        verified_at: new Date('2026-01-01T00:00:00Z'),
+      });
+
+      const result = await service.confirmEmail('pt-BR', 'tok');
+
+      expect(result.alreadyConfirmed).toBe(true);
+      expect(deps.prisma.user_identifier.update).not.toHaveBeenCalled();
+    });
+
+    it('propaga a recusa de token inválido, expirado ou de outro propósito', async () => {
+      const { service, deps } = makeService();
+      deps.token.verifyEmailConfirmationToken.mockRejectedValue(
+        new BadRequestException('invalid'),
+      );
+
+      await expect(service.confirmEmail('pt-BR', 'tok')).rejects.toThrow(
+        BadRequestException,
+      );
+      expect(deps.prisma.user_identifier.update).not.toHaveBeenCalled();
+    });
+
+    it('lança BadRequest quando o identificador do token não existe mais', async () => {
+      const { service, deps } = makeService();
+      deps.token.verifyEmailConfirmationToken.mockResolvedValue({
+        userIdentifierId: 42,
+      });
+      deps.prisma.user_identifier.findUnique.mockResolvedValue(null);
+
+      await expect(service.confirmEmail('pt-BR', 'tok')).rejects.toThrow(
+        BadRequestException,
+      );
+    });
+  });
 });