@hed-hog/core 0.0.387 → 0.0.393

package/src/auth/auth.service.ts

@@ -1,9 +1,15 @@
-import { getLocaleText } from '@hed-hog/api-locale';
+import {
+  getLocaleFromContext,
+  getLocaleText,
+  isLocaleDetectedFromContext,
+  normalizeLocaleCode,
+} from '@hed-hog/api-locale';
 import { PrismaService } from '@hed-hog/api-prisma';
 import { User } from '@hed-hog/api-types';
 import type { PublicKeyCredentialRequestOptionsJSON } from '@simplewebauthn/server';
 import {
   BadRequestException,
+  ForbiddenException,
   forwardRef,
   Inject,
   Injectable,
@@ -17,7 +23,11 @@ import { SecurityService } from '../security/security.service';
 import { SessionService } from '../session/session.service';
 import { SettingService } from '../setting/setting.service';
 import { TokenService } from '../token/token.service';
+import { UserDeviceService } from '../user-device/user-device.service';
+import { hasPendingPasswordReset } from '../user/user-credential.util';
+import { CreateWithEmailAndPasswordDTO } from '../user/dto/create-with-email-and-password.dto';
 import { UserService } from '../user/user.service';
+import { buildSecurityEventVars } from '../utils/security-event-vars';
 import { resolveWebAuthnOrigin } from '../utils/webauthn-origin';
 import { ForgetDTO } from './dto/forget.dto';
 import { LoginDTO } from './dto/login.dto';
@@ -43,6 +53,8 @@ export class AuthService {
     private readonly user: UserService,
     @Inject(forwardRef(() => ChallengeService))
     private readonly challenge: ChallengeService,
+    @Inject(forwardRef(() => UserDeviceService))
+    private readonly userDevice: UserDeviceService,
   ) { }
 
   async getAuthenticationPayload(locale: string, userId: number, ipAddress: string, userAgent: string, browserId?: string | null) {
@@ -50,6 +62,18 @@ export class AuthService {
     const payload = { sub: userId, sessionId: session.id };
     const accessToken = await this.token.createAccessToken(payload);
     await this.prisma.user.update({ where: { id: userId }, data: { last_login_at: new Date() } });
+
+    // Unico ponto por onde todo caminho de autenticacao passa (senha, MFA,
+    // WebAuthn, recovery code, OAuth, pairing), entao e aqui que o dispositivo
+    // e aprendido. Quem checa `isNewDevice` faz isso antes de chegar aqui.
+    await this.userDevice.remember(userId, { userAgent, browserId, ipAddress });
+
+    // O idioma e aprendido junto com o dispositivo, e pelo mesmo motivo: e o
+    // unico momento em que o cliente se apresenta. Fica antes do alerta de
+    // dispositivo desconhecido (disparado por quem chamou este metodo), entao o
+    // proprio e-mail do primeiro login ja sai traduzido.
+    await this.persistDetectedLanguage(locale, userId);
+
     this.logger.debug(`[AuthService] Session created userId=${userId} sessionId=${session.id}`);
 
     return {
@@ -60,20 +84,72 @@ export class AuthService {
 
   }
 
-  async issueDesktopToken(locale: string, userId: number, ipAddress: string, userAgent: string) {
+  /**
+   * Adota o idioma do cliente como preferencia do usuario - uma unica vez.
+   *
+   * Escrita write-once de proposito: sobrescrever a cada login faria um acesso
+   * de aparelho emprestado, ou de um navegador em outro idioma, apagar a
+   * escolha que o usuario fez na tela de preferencias.
+   *
+   * Nunca lanca. Idioma e acabamento; login que falha por causa dele seria uma
+   * troca pessima.
+   */
+  private async persistDetectedLanguage(locale: string, userId: number) {
+    try {
+      // `detected` distingue a escolha do cliente do default do middleware.
+      // Sem isso, todo cliente que nao manda `Accept-Language` congelaria `en`.
+      if (!isLocaleDetectedFromContext()) {
+        return;
+      }
+
+      const code = normalizeLocaleCode(getLocaleFromContext());
+
+      if (!code) {
+        return;
+      }
+
+      // `setSettingUserValue` valida que a setting aceita override, mas nao o
+      // valor. Sem esta checagem um navegador em `de-DE` gravaria `de`, e todo
+      // e-mail seguinte procuraria um template inexistente.
+      const allowed = await this.setting.getSettingListValues('language');
+
+      if (allowed.length && !allowed.includes(code)) {
+        return;
+      }
+
+      if (await this.setting.getUserSettingValue(userId, 'language')) {
+        return;
+      }
+
+      await this.setting.setSettingUserValue(locale, userId, 'language', code);
+    } catch (error) {
+      this.logger.warn(
+        `[AuthService] Could not persist detected language for userId=${userId}: ${error}`,
+      );
+    }
+  }
+
+  async issueDesktopToken(locale: string, userId: number, ipAddress: string, userAgent: string, isImpersonating = false) {
+    // Aqui o `userId` vem de @User(), que numa simulacao e o ALVO — sem esta
+    // guarda, o operador cunharia para ele uma sessao completa, RENOVAVEL e de
+    // 30 dias, furando o teto da simulacao e saindo da trilha de auditoria. O
+    // RoleGuard ja bloqueia a rota; isto e a segunda barreira.
+    if (isImpersonating) {
+      throw new ForbiddenException(
+        getLocaleText(
+          'impersonation.restrictedRoute',
+          locale,
+          'This action is not available during an access simulation.',
+        ),
+      );
+    }
+
     const { accessToken, refreshToken } = await this.getAuthenticationPayload(locale, userId, ipAddress, userAgent);
     return { accessToken, refreshToken };
   }
 
   private hasPendingPasswordReset(user: User | any) {
-    return Boolean(
-      user?.user_credential?.some(
-        (credential) =>
-          credential.type === 'password' &&
-          credential.requires_reset === true &&
-          !credential.revoked_at,
-      ),
-    );
+    return hasPendingPasswordReset(user);
   }
 
   private async getRequiresPasswordResetByUserId(userId: number) {
@@ -90,7 +166,7 @@ export class AuthService {
     return Boolean(credential?.id);
   }
 
-  async requiresMfaForLogin(locale: string, email: string, user: any) {
+  async requiresMfaForLogin(locale: string, email: string, user: any, origin?: string) {
 
     const settings = await this.setting.getSettingValues([
       'require-mfa',
@@ -160,7 +236,8 @@ export class AuthService {
         variables: {
           code,
           name: user.name,
-        }
+        },
+        app: await this.challenge.resolveAppKeyFromOrigin(origin),
       }
     );
 
@@ -173,7 +250,7 @@ export class AuthService {
     }
   }
 
-  async requiresEmailVerificationForLogin(locale: string, email: string, user: any) {
+  async requiresEmailVerificationForLogin(locale: string, email: string, user: any, origin?: string) {
 
     const settings = await this.setting.getSettingValues([
       'require-mfa',
@@ -217,7 +294,8 @@ export class AuthService {
         variables: {
           code,
           name: user.name,
-        }
+        },
+        app: await this.challenge.resolveAppKeyFromOrigin(origin),
       }
     );
 
@@ -231,7 +309,7 @@ export class AuthService {
 
   }
 
-  async emailVerificationLoginResend(locale: string, token: string) {
+  async emailVerificationLoginResend(locale: string, token: string, origin?: string) {
 
     try {
       const payload = await this.token.verify(locale, token);
@@ -253,25 +331,25 @@ export class AuthService {
 
       const user = await this.user.findUserById(locale, challenge.user_identifier.user_id);
 
-      return await this.requiresEmailVerificationForLogin(locale, payload.email, user);
+      return await this.requiresEmailVerificationForLogin(locale, payload.email, user, origin);
 
     } catch (error: any) {
       if (error.message?.includes('jwt expired') || error.name === 'TokenExpiredError') {
-        
+
         const expiredPayload = await this.token.decodeExpiredToken(token);
         const newToken = await this.token.createAccessToken({
             challengeIdentifierId: expiredPayload.challengeIdentifierId,
             email: expiredPayload.email
           });
 
-        return this.emailVerificationLoginResend(locale, newToken);
+        return this.emailVerificationLoginResend(locale, newToken, origin);
       }
-      
+
       throw error;
     }
   }
 
-  async emailVerificationLogin(locale: string, token: string, code: string, ipAddress: string, userAgent: string, res: any, browserId?: string | null) {
+  async emailVerificationLogin(locale: string, token: string, code: string, ipAddress: string, userAgent: string, res: any, browserId?: string | null, origin?: string) {
 
     try {
       const payload = await this.token.verify(locale, token);
@@ -283,7 +361,10 @@ export class AuthService {
           user_identifier_id: true,
           user_identifier: {
             select: {
-              user_id: true
+              user_id: true,
+              // Destinatario do alerta de dispositivo novo: o endereco que o
+              // usuario de fato verificou para entrar.
+              value: true
             }
           }
         }
@@ -324,14 +405,65 @@ export class AuthService {
 
       const user = await this.user.findUserById(locale, challenge.user_identifier.user_id);
 
-      return this.login(locale, user as unknown as User, ipAddress, userAgent, res, browserId);
+      return this.login(locale, user as unknown as User, ipAddress, userAgent, res, browserId, origin, challenge.user_identifier.value);
 
     } catch (error) {
         throw error;
     }
   }
 
-  private async login(locale: string, user: User, ipAddress: string, userAgent: string, res: any, browserId?: string | null) {
+  /**
+   * Dispara o alerta de acesso de dispositivo desconhecido.
+   *
+   * O `await` aqui cobre so a resolucao do app (leitura de setting memoizada);
+   * o envio em si continua sem await de proposito, para nao somar a latencia do
+   * SMTP ao tempo de resposta do login.
+   */
+  private async sendNewDeviceLoginMail(
+    locale: string,
+    user: { name?: string } | null | undefined,
+    email: string | null | undefined,
+    ipAddress: string,
+    userAgent: string,
+    origin?: string,
+  ): Promise<void> {
+    // Tokens de desafio emitidos antes de o `email` passar a ser gravado no
+    // payload chegam aqui sem destinatario; alertar ninguem e melhor do que
+    // deixar o envio explodir dentro do fluxo de login.
+    if (!email) {
+      return;
+    }
+
+    const app = await this.challenge.resolveAppKeyFromOrigin(origin);
+
+    // As variaveis sao formatadas aqui (data e nome do pais saem do `Intl`),
+    // entao o idioma do destinatario tem que ser resolvido ANTES do envio -
+    // senao o corpo sai em portugues com a data em ingles.
+    const recipientLocale = await this.mail.resolveRecipientLocale(email, locale);
+
+    this.mail.sendTemplatedMail(recipientLocale, {
+      email,
+      slug: 'auth-login-new-device',
+      variables: {
+        name: user?.name ?? '',
+        ...buildSecurityEventVars({ ipAddress, userAgent, locale: recipientLocale }),
+      },
+      app,
+    });
+  }
+
+  private async login(locale: string, user: User, ipAddress: string, userAgent: string, res: any, browserId?: string | null, origin?: string, loginEmail?: string) {
+
+    // Conta excluída pelo próprio usuário: os identificadores já foram
+    // anonimizados, mas a checagem fecha qualquer caminho remanescente.
+    const account = await this.prisma.user.findUnique({
+      where: { id: user.id },
+      select: { deactivated_at: true },
+    });
+
+    if (account?.deactivated_at) {
+      throw new BadRequestException(getLocaleText('accessDenied', locale, 'Access denied.'));
+    }
 
     const emails = await this.prisma.user_identifier.findMany({
       where: {
@@ -345,6 +477,8 @@ export class AuthService {
       throw new BadRequestException(getLocaleText('accessDenied', locale, 'Access denied.'));
     }
 
+    const newDevice = await this.userDevice.isNewDevice(user.id, userAgent, browserId);
+
     const { accessToken, refreshToken, session } = await this.getAuthenticationPayload(
       locale,
       user.id,
@@ -353,23 +487,16 @@ export class AuthService {
       browserId,
     );
 
-    for (const emailObj of emails) {
-
-        this.mail.sendTemplatedMail(
-          locale,
-          {
-            email: emailObj.value,
-            slug: 'auth-login-new-device',
-            variables: {
-              name: user.name,
-              ipAddress,
-              userAgent,
-              location: 'Unknown',
-            }
-          }
-        );
+    if (newDevice) {
+      // So o endereco usado para entrar. Avisar todos os identificadores
+      // contava, para um e-mail secundario, que o principal tinha sido usado.
+      const wanted = (loginEmail ?? '').trim().toLowerCase();
+      const recipient =
+        emails.find((e) => e.value?.toLowerCase() === wanted)?.value ??
+        emails[0].value;
 
-      }
+      await this.sendNewDeviceLoginMail(locale, user, recipient, ipAddress, userAgent, origin);
+    }
 
     await this.user.registerUserActivity(user.id, "login")
 
@@ -391,6 +518,7 @@ export class AuthService {
     userAgent: string,
     { email, password }: LoginDTO,
     browserId?: string | null,
+    origin?: string,
   ) {
 
     const user = await this.user.findUserByEmail(locale, email);
@@ -428,11 +556,11 @@ export class AuthService {
 
       if (emailMfas.length > 0) {
         const emails = emailMfas.map(mfa => mfa.user_mfa_email[0].email);
-        await this.challenge.sendMfaCodeToMultipleEmails(locale, user.id, emails);
+        await this.challenge.sendMfaCodeToMultipleEmails(locale, user.id, emails, origin);
       }
 
-      return { 
-        requiresMfa: true, 
+      return {
+        requiresMfa: true,
         mfaToken,
         mfaMethods: mfaMethods.map(m => ({ type: m.type, id: m.id }))
       };
@@ -447,15 +575,63 @@ export class AuthService {
 
     if (settings['require-mfa'] === true && mfaMethods.length === 0) {
 
-      return this.requiresMfaForLogin(locale, email, user);
+      return this.requiresMfaForLogin(locale, email, user, origin);
 
     } else if (settings['require-email-verification'] === true && identifier?.verified_at === null) {
 
-      return this.requiresEmailVerificationForLogin(locale, email, user);
+      return this.requiresEmailVerificationForLogin(locale, email, user, origin);
+
+    }
+
+    return this.login(locale, user as unknown as User, ipAddress, userAgent, res, browserId, origin, email);
+  }
+
+  /**
+   * Cadastro por e-mail e senha.
+   *
+   * Com `require-email-verification` desligada (o default), a conta já nasce
+   * utilizável e o e-mail de confirmação é apenas informativo — devolver a
+   * pessoa para a tela de login só a obrigaria a digitar de novo o que acabou
+   * de digitar, então o cadastro já termina com a sessão emitida.
+   *
+   * Com a setting ligada, `loginWithEmailAndPassword` barraria o acesso logo em
+   * seguida; nesse caso não emitimos sessão e devolvemos `hasChallenge` para o
+   * app mandar a pessoa confirmar o endereço antes.
+   */
+  async signupWithEmailAndPassword(
+    res: any,
+    locale: string,
+    ipAddress: string,
+    userAgent: string,
+    data: CreateWithEmailAndPasswordDTO,
+    browserId?: string | null,
+    origin?: string,
+  ) {
+    const { user } = await this.user.createWithEmailAndPassword(locale, data);
+
+    const settings = await this.setting.getSettingValues([
+      'require-email-verification',
+    ]);
 
+    if (settings['require-email-verification'] === true) {
+      return { user, hasChallenge: true };
     }
 
-    return this.login(locale, user as unknown as User, ipAddress, userAgent, res, browserId);
+    // `isNewDevice` retorna false quando o usuário ainda não tem dispositivo
+    // nenhum, então o auto-login não dispara o alerta de "novo acesso" — que
+    // logo após o cadastro pareceria um aviso de invasão.
+    const session = await this.login(
+      locale,
+      user as unknown as User,
+      ipAddress,
+      userAgent,
+      res,
+      browserId,
+      origin,
+      data.email,
+    );
+
+    return { user, hasChallenge: false, ...session };
   }
 
   async verifyRoles(_locale: string, userId: number) {
@@ -473,13 +649,46 @@ export class AuthService {
     })
   }
 
-  async verifyUser(locale: string, userId: number) {
+  async verifyUser(locale: string, userId: number, sessionId?: number | null) {
     const user = await this.user.findUserById(locale, userId);
     const requiresPasswordReset = this.hasPendingPasswordReset(user);
     delete user.user_credential;
     return {
       ...user,
       requires_password_reset: requiresPasswordReset,
+      // Fonte de verdade do banner de simulacao no cliente: a sessionStorage do
+      // navegador e so cache e e gravavel por quem estiver na aba.
+      impersonation: await this.describeImpersonation(sessionId),
+    };
+  }
+
+  private async describeImpersonation(sessionId?: number | null) {
+    if (!sessionId) {
+      return null;
+    }
+
+    const session = await this.prisma.user_session.findUnique({
+      where: { id: sessionId },
+      select: {
+        impersonator_user_id: true,
+        impersonation_reason: true,
+        expires_at: true,
+      },
+    });
+
+    if (!session?.impersonator_user_id) {
+      return null;
+    }
+
+    const operator = await this.prisma.user.findUnique({
+      where: { id: session.impersonator_user_id },
+      select: { id: true, name: true },
+    });
+
+    return {
+      by: operator ?? { id: session.impersonator_user_id, name: '' },
+      reason: session.impersonation_reason,
+      expires_at: session.expires_at.toISOString(),
     };
   }
 
@@ -520,6 +729,17 @@ export class AuthService {
   }
 
   async logout(res, req, refreshToken: string) {
+    // Numa sessao simulada o cookie `rt` da mesma origem e o do OPERADOR: limpar
+    // e revogar por hash aqui derrubaria a sessao real dele. O RoleGuard ja
+    // bloqueia esta rota durante uma simulacao (impersonation-restrictions.ts);
+    // isto e a segunda barreira, no caso de a rota ser alcancada por outro
+    // caminho. Sair de uma simulacao e POST /impersonation/stop.
+    if (req?.auth?.imp === true) {
+      throw new ForbiddenException(
+        'This action is not available during an access simulation.',
+      );
+    }
+
     const result = await this.session.deleteRefreshTokenCookie(res, refreshToken);
     const logoutUserId = req.auth?.sub ?? result?.userId ?? null;
 
@@ -530,7 +750,7 @@ export class AuthService {
     return { success: true };
   }
 
-  async forgotResetPassword(locale: string, password: string, code: string, ipAddress: string, userAgent: string) {
+  async forgotResetPassword(locale: string, password: string, code: string, ipAddress: string, userAgent: string, origin?: string) {
     const challenge = await this.challenge.verifyCodePassword(locale, code);
     const userIdentifier = challenge.user_identifier;
     const passwordHash = await this.security.hashArgon2(password);
@@ -550,12 +770,13 @@ export class AuthService {
         slug: 'auth-forget-password-confirmation',
         variables: {
           name: userIdentifier.user.name,
-        }
+        },
+        app: await this.challenge.resolveAppKeyFromOrigin(origin),
       }
     );
 
     const { accessToken, refreshToken, session } = await this.getAuthenticationPayload(locale, userIdentifier.user_id, ipAddress, userAgent);
-    await this.user.registerUserActivity(userIdentifier.id, "resetPassword")
+    await this.user.registerUserActivity(userIdentifier.user_id, "resetPassword")
     return { accessToken, refreshToken, session }
   }
 
@@ -616,19 +837,160 @@ export class AuthService {
     return { userId: targetUserId, token, hasPassword: passwordCount > 0 };
   }
 
+  /**
+   * Confirma o e-mail a partir do link enviado no cadastro. Não emite sessão: o
+   * link só prova o controle da caixa, quem quiser entrar passa pelo login.
+   *
+   * Idempotente de propósito — clientes de e-mail fazem pré-fetch do link e o
+   * usuário costuma clicar de novo depois, e nesses casos ver "link inválido"
+   * assusta mais do que ajuda.
+   */
+  async confirmEmail(locale: string, token: string) {
+    const { userIdentifierId } = await this.token.verifyEmailConfirmationToken(
+      locale,
+      token,
+    );
+
+    const identifier = await this.prisma.user_identifier.findUnique({
+      where: { id: userIdentifierId },
+      include: { user: { select: { id: true, name: true } } },
+    });
+
+    if (!identifier) {
+      throw new BadRequestException(
+        getLocaleText(
+          'confirmEmail.invalidOrExpired',
+          locale,
+          'This confirmation link is invalid or has expired.',
+        ),
+      );
+    }
+
+    if (identifier.verified_at) {
+      return {
+        confirmed: true,
+        alreadyConfirmed: true,
+        email: identifier.value,
+        name: identifier.user?.name ?? null,
+      };
+    }
+
+    await this.prisma.user_identifier.update({
+      where: { id: identifier.id },
+      data: { verified_at: new Date(), enabled: true },
+    });
+
+    await this.user.registerUserActivity(identifier.user_id, 'confirmEmail');
+
+    return {
+      confirmed: true,
+      alreadyConfirmed: false,
+      email: identifier.value,
+      name: identifier.user?.name ?? null,
+    };
+  }
+
+  /**
+   * Reenvia o link de confirmação do cadastro.
+   *
+   * Responde `{ sent: true }` mesmo quando o e-mail não existe ou já está
+   * confirmado: qualquer diferença na resposta transformaria a rota num
+   * oráculo para descobrir quais endereços têm conta.
+   */
+  async resendEmailConfirmation(
+    locale: string,
+    email: string,
+    app?: string,
+    origin?: string,
+  ) {
+    try {
+      const user = await this.user.findUserByEmail(locale, email);
+
+      if (user) {
+        await this.challenge.sendEmailConfirmationLink(
+          locale,
+          user.id,
+          email,
+          app,
+          origin,
+        );
+      }
+    } catch (error: any) {
+      // `sendEmailConfirmationLink` lança NotFound quando o endereço já está
+      // verificado — e uma falha de envio não pode virar erro para o cliente,
+      // sob pena de vazar a existência da conta.
+      this.logger.warn(
+        'Resend of signup confirmation email failed: ' + (error?.message ?? error),
+      );
+    }
+
+    return { sent: true };
+  }
+
   /**
    * Valida (sem consumir) um token de convite de criação de conta e retorna os
    * dados básicos para pré-preencher o formulário no app de treinamentos.
+   * `hasAccount` diz se esse usuário já tem um jeito de entrar (senha ativa ou
+   * provedor externo vinculado) — usado pelo app para decidir entre mostrar o
+   * formulário de criação de conta ou uma tela de autorização de acesso.
    */
   async verifyAccountInvite(locale: string, code: string) {
     const challenge = await this.challenge.verifyCodePassword(locale, code);
+    const userId = challenge.user_identifier.user_id;
+
+    const [passwordCount, oauthCount] = await Promise.all([
+      this.prisma.user_credential.count({
+        where: { user_id: userId, type: 'password', revoked_at: null },
+      }),
+      this.prisma.user_account.count({ where: { user_id: userId } }),
+    ]);
+
     return {
       valid: true,
       name: challenge.user_identifier.user?.name ?? null,
       email: challenge.user_identifier.value,
+      hasAccount: passwordCount > 0 || oauthCount > 0,
     };
   }
 
+  /**
+   * Conclui um convite de acesso para quem já tem conta (senha ou provedor
+   * externo): não define senha nenhuma, só prova controle do e-mail (mesmo
+   * nível de confiança do link de reset de senha) e autentica o usuário.
+   */
+  async authorizeAccountInvite(
+    locale: string,
+    code: string,
+    ipAddress: string,
+    userAgent: string,
+  ) {
+    const challenge = await this.challenge.verifyCodePassword(locale, code);
+    const userIdentifier = challenge.user_identifier;
+
+    if (!userIdentifier.verified_at || !userIdentifier.enabled) {
+      await this.prisma.user_identifier.update({
+        where: { id: userIdentifier.id },
+        data: { verified_at: userIdentifier.verified_at ?? new Date(), enabled: true },
+      });
+    }
+
+    // Consome o challenge para impedir reuso do link.
+    await this.prisma.user_identifier_challenge.updateMany({
+      where: { id: challenge.id },
+      data: { verified_at: new Date(), expires_at: new Date() },
+    });
+
+    const { accessToken, refreshToken, session } =
+      await this.getAuthenticationPayload(
+        locale,
+        userIdentifier.user_id,
+        ipAddress,
+        userAgent,
+      );
+    await this.user.registerUserActivity(userIdentifier.user_id, 'authorizeAccountInvite');
+    return { accessToken, refreshToken, session };
+  }
+
   /**
    * Conclui a criação de conta a partir de um token de convite: cria/atualiza a
    * credencial de senha, marca o identificador como verificado, atualiza o nome
@@ -688,11 +1050,11 @@ export class AuthService {
         ipAddress,
         userAgent,
       );
-    await this.user.registerUserActivity(userIdentifier.id, 'completeAccount');
+    await this.user.registerUserActivity(userIdentifier.user_id, 'completeAccount');
     return { accessToken, refreshToken, session };
   }
 
-  async verifyMfaCode(locale: string, mfaToken: string, code: string, ipAddress: string, userAgent: string, methodType?: 'totp' | 'email' | 'recovery', browserId?: string | null) {
+  async verifyMfaCode(locale: string, mfaToken: string, code: string, ipAddress: string, userAgent: string, methodType?: 'totp' | 'email' | 'recovery', browserId?: string | null, origin?: string) {
     const payload = await this.token.verifyMfaChallengeToken(mfaToken);
     const user = await this.prisma.user.findUnique({
       where: { id: payload.userId },
@@ -788,6 +1150,8 @@ export class AuthService {
       throw new BadRequestException(getLocaleText('invalidMfaCode', locale, 'Invalid MFA code.'));
     }
 
+    const newDevice = await this.userDevice.isNewDevice(user.id, userAgent, browserId);
+
     const { accessToken, refreshToken, session } = await this.getAuthenticationPayload(
       locale,
       user.id,
@@ -796,19 +1160,9 @@ export class AuthService {
       browserId,
     );
 
-    this.mail.sendTemplatedMail(
-      locale,
-      {
-        email: payload.email,
-        slug: 'auth-login-new-device',
-        variables: {
-          name: user.name,
-          ipAddress,
-          userAgent,
-          location: 'Unknown',
-        }
-      }
-    );
+    if (newDevice) {
+      await this.sendNewDeviceLoginMail(locale, user, payload.email, ipAddress, userAgent, origin);
+    }
 
     await this.user.registerUserActivity(user.id, "login");
     const requiresPasswordReset = await this.getRequiresPasswordResetByUserId(
@@ -817,7 +1171,7 @@ export class AuthService {
     return { accessToken, refreshToken, session, requiresPasswordReset };
   }
 
-  async verifyMfaRecoveryCode(locale: string, mfaToken: string, recoveryCode: string, ipAddress: string, userAgent: string, browserId?: string | null) {
+  async verifyMfaRecoveryCode(locale: string, mfaToken: string, recoveryCode: string, ipAddress: string, userAgent: string, browserId?: string | null, origin?: string) {
     const payload = await this.token.verifyMfaChallengeToken(mfaToken);
     const user = await this.prisma.user.findUnique({
       where: { id: payload.userId },
@@ -845,6 +1199,8 @@ export class AuthService {
       throw new BadRequestException(getLocaleText('invalidRecoveryCode', locale, 'Invalid recovery code.'));
     }
 
+    const newDevice = await this.userDevice.isNewDevice(user.id, userAgent, browserId);
+
     const { accessToken, refreshToken, session } = await this.getAuthenticationPayload(
       locale,
       user.id,
@@ -853,6 +1209,12 @@ export class AuthService {
       browserId,
     );
 
+    // Entrar por codigo de recuperacao e o caminho mais sensivel dos tres, e era
+    // justamente o unico que nao avisava ninguem.
+    if (newDevice) {
+      await this.sendNewDeviceLoginMail(locale, user, payload.email, ipAddress, userAgent, origin);
+    }
+
     await this.user.registerUserActivity(user.id, "login");
     const requiresPasswordReset = await this.getRequiresPasswordResetByUserId(
       user.id,
@@ -860,7 +1222,7 @@ export class AuthService {
     return { accessToken, refreshToken, session, requiresPasswordReset };
   }
 
-  async resendMfaCode(locale: string, mfaToken: string) {
+  async resendMfaCode(locale: string, mfaToken: string, origin?: string) {
     const payload = await this.token.verifyMfaChallengeToken(mfaToken);
     
     const mfaMethods = await this.prisma.user_mfa.findMany({
@@ -883,7 +1245,7 @@ export class AuthService {
       throw new BadRequestException(getLocaleText('noEmailMfaFound', locale, 'No email MFA method found for this user.'));
     }
 
-    await this.challenge.sendMfaCodeByEmail(locale, payload.userId, emailMfa.user_mfa_email[0].email);
+    await this.challenge.sendMfaCodeByEmail(locale, payload.userId, emailMfa.user_mfa_email[0].email, origin);
     
     return { 
       success: true,
@@ -994,6 +1356,8 @@ export class AuthService {
       data: { verified_at: new Date() }
     });
 
+    const newDevice = await this.userDevice.isNewDevice(userId, userAgent, browserId);
+
     const { accessToken, refreshToken, session } = await this.getAuthenticationPayload(
       locale,
       userId,
@@ -1002,20 +1366,10 @@ export class AuthService {
       browserId,
     );
 
-    const user = await this.prisma.user.findFirst({ where: { id: userId } });
-    this.mail.sendTemplatedMail(
-      locale,
-      {
-        email: payload.email,
-        slug: 'auth-login-new-device',
-        variables: {
-          name: user.name,
-          ipAddress,
-          userAgent,
-          location: 'Unknown',
-        }
-      }
-    );
+    if (newDevice) {
+      const user = await this.prisma.user.findFirst({ where: { id: userId } });
+      await this.sendNewDeviceLoginMail(locale, user, payload.email, ipAddress, userAgent, requestOrigin);
+    }
 
     await this.user.registerUserActivity(userId, 'login');
     const requiresPasswordReset = await this.getRequiresPasswordResetByUserId(