@hed-hog/core 0.0.387 → 0.0.393

package/src/auth/dto/confirm-email.dto.ts

@@ -0,0 +1,7 @@
+import { IsNotEmpty, IsString } from 'class-validator';
+
+export class ConfirmEmailDTO {
+  @IsString()
+  @IsNotEmpty()
+  token: string;
+}

package/src/auth/dto/resend-confirmation.dto.ts

@@ -0,0 +1,20 @@
+import { getLocaleText } from '@hed-hog/api-locale';
+import { IsNotEmpty, IsOptional, IsString } from 'class-validator';
+import { IsEmailWithSettings } from '../../validators/is-email-with-settings.validator';
+
+export class ResendConfirmationDTO {
+  @IsNotEmpty({ message: (args) => getLocaleText('validation.currentEmailRequired', args.value) })
+  @IsEmailWithSettings({ message: (args) => getLocaleText('validation.currentEmailInvalid', args.value) })
+  set email(value: string) {
+    this._email = value?.trim().toLowerCase();
+  }
+  get email(): string {
+    return this._email;
+  }
+  private _email: string;
+
+  /** Chave do app de origem (ex.: "class"), usada para montar a URL do link. */
+  @IsOptional()
+  @IsString()
+  app?: string;
+}

package/src/authorize/authorize.controller.ts

@@ -85,6 +85,7 @@ export class AuthorizeController {
     @Locale() locale: string,
     @Ip() ipAddress: string,
     @Headers('user-agent') userAgent: string,
+    @Headers('x-browser-id') browserId: string,
   ) {
     return this.service.exchangeCode({
       code: body.code,
@@ -94,6 +95,7 @@ export class AuthorizeController {
       locale,
       ipAddress,
       userAgent,
+      browserId: browserId || null,
     });
   }
 }

package/src/authorize/authorize.service.spec.ts

@@ -191,6 +191,29 @@ describe('AuthorizeService', () => {
         7,
         '127.0.0.1',
         'jest',
+        undefined,
+      );
+    });
+
+    it('repassa o browserId, que identifica o dispositivo da extensão', async () => {
+      const verifier = makeVerifier();
+      deps.prisma.$queryRaw.mockResolvedValue([
+        { user_id: 7, code_challenge: sha256b64url(verifier), scope: 'vaults' },
+      ] as never);
+
+      await service.exchangeCode({
+        ...validExchangeParams('CODE', verifier),
+        browserId: 'ext-install-1',
+      });
+
+      // Sem isto o dispositivo cairia no User-Agent — o do Chrome inteiro, que
+      // muda a cada atualização do navegador.
+      expect(deps.auth.getAuthenticationPayload).toHaveBeenCalledWith(
+        'en',
+        7,
+        '127.0.0.1',
+        'jest',
+        'ext-install-1',
       );
     });
 

package/src/authorize/authorize.service.ts

@@ -168,6 +168,13 @@ export class AuthorizeService {
     locale: string;
     ipAddress: string;
     userAgent: string;
+    /**
+     * Id estavel da instalacao do cliente (header `X-Browser-ID`). Sem ele o
+     * dispositivo e identificado pelo User-Agent, que numa extensao e o do
+     * navegador inteiro — muda a cada atualizacao do Chrome e enche a lista de
+     * dispositivos do usuario de entradas repetidas.
+     */
+    browserId?: string | null;
   }) {
     const client = await this.getClient(params.clientId);
 
@@ -212,6 +219,7 @@ export class AuthorizeService {
       row.user_id,
       params.ipAddress,
       params.userAgent,
+      params.browserId,
     );
 
     return {

package/src/captcha/captcha.module.ts

@@ -0,0 +1,10 @@
+import { PrismaModule } from '@hed-hog/api-prisma';
+import { Module, forwardRef } from '@nestjs/common';
+import { CaptchaService } from './captcha.service';
+
+@Module({
+  imports: [forwardRef(() => PrismaModule)],
+  providers: [CaptchaService],
+  exports: [CaptchaService],
+})
+export class CaptchaModule {}

package/src/captcha/captcha.service.spec.ts

@@ -0,0 +1,210 @@
+import { BadRequestException } from '@nestjs/common';
+import { createHash, createHmac } from 'crypto';
+import { CaptchaService } from './captcha.service';
+
+describe('CaptchaService', () => {
+  let prisma: any;
+  let service: CaptchaService;
+  const originalFetch = global.fetch;
+
+  beforeEach(() => {
+    prisma = { integration_profile: { findFirst: jest.fn() } };
+    service = new CaptchaService(prisma);
+    global.fetch = jest.fn() as never;
+  });
+
+  afterEach(() => {
+    global.fetch = originalFetch;
+    jest.restoreAllMocks();
+  });
+
+  function mockFetch(success: boolean) {
+    (global.fetch as jest.Mock).mockResolvedValue({
+      json: async () => ({ success }),
+    });
+  }
+
+  describe('verify', () => {
+    it('rejects an empty token before calling the provider', async () => {
+      await expect(service.verify('', 'recaptcha', {})).rejects.toBeInstanceOf(
+        BadRequestException,
+      );
+      expect(global.fetch).not.toHaveBeenCalled();
+    });
+
+    it('rejects an unsupported provider', async () => {
+      await expect(
+        service.verify('token', 'hcaptcha', {}),
+      ).rejects.toThrow('Unsupported CAPTCHA provider: hcaptcha.');
+    });
+
+    describe('recaptcha', () => {
+      it('accepts a token the provider confirms', async () => {
+        mockFetch(true);
+        await expect(
+          service.verify('token', 'recaptcha', { secret_key: 'secret' }),
+        ).resolves.toBeUndefined();
+
+        const [url, init] = (global.fetch as jest.Mock).mock.calls[0];
+        expect(url).toBe('https://www.google.com/recaptcha/api/siteverify');
+        expect(init.method).toBe('POST');
+        expect(String(init.body)).toContain('secret=secret');
+        expect(String(init.body)).toContain('response=token');
+      });
+
+      it('rejects a token the provider refuses', async () => {
+        mockFetch(false);
+        await expect(
+          service.verify('token', 'recaptcha', { secret_key: 'secret' }),
+        ).rejects.toThrow('CAPTCHA validation failed.');
+      });
+    });
+
+    describe('cloudflare-turnstile', () => {
+      it('calls the turnstile endpoint', async () => {
+        mockFetch(true);
+        await service.verify('token', 'cloudflare-turnstile', {
+          secret_key: 'secret',
+        });
+
+        expect((global.fetch as jest.Mock).mock.calls[0][0]).toBe(
+          'https://challenges.cloudflare.com/turnstile/v0/siteverify',
+        );
+      });
+
+      it('rejects a refused token', async () => {
+        mockFetch(false);
+        await expect(
+          service.verify('token', 'cloudflare-turnstile', { secret_key: 's' }),
+        ).rejects.toThrow('CAPTCHA validation failed.');
+      });
+    });
+
+    describe('altcha', () => {
+      const hmacKey = 'hmac-key';
+
+      function buildToken(overrides: Partial<Record<string, unknown>> = {}) {
+        const salt = 'salt';
+        const number = 12345;
+        const challenge = createHash('sha256')
+          .update(salt + String(number))
+          .digest('hex');
+        const signature = createHmac('sha256', hmacKey)
+          .update(challenge)
+          .digest('hex');
+
+        const payload = {
+          algorithm: 'SHA-256',
+          challenge,
+          number,
+          salt,
+          signature,
+          ...overrides,
+        };
+        return Buffer.from(JSON.stringify(payload)).toString('base64');
+      }
+
+      it('accepts a correctly solved challenge', async () => {
+        await expect(
+          service.verify(buildToken(), 'altcha', { hmac_key: hmacKey }),
+        ).resolves.toBeUndefined();
+        // Altcha e verificado localmente: nenhuma chamada de rede.
+        expect(global.fetch).not.toHaveBeenCalled();
+      });
+
+      it('rejects a malformed token', async () => {
+        await expect(
+          service.verify('not-base64-json', 'altcha', { hmac_key: hmacKey }),
+        ).rejects.toThrow('Invalid CAPTCHA token format.');
+      });
+
+      it('rejects when the proof of work does not match the challenge', async () => {
+        await expect(
+          service.verify(buildToken({ number: 999 }), 'altcha', {
+            hmac_key: hmacKey,
+          }),
+        ).rejects.toThrow('CAPTCHA validation failed.');
+      });
+
+      it('rejects a challenge we did not sign', async () => {
+        await expect(
+          service.verify(buildToken(), 'altcha', { hmac_key: 'other-key' }),
+        ).rejects.toThrow('CAPTCHA validation failed.');
+      });
+    });
+  });
+
+  describe('verifyForProfile', () => {
+    it('resolves the provider from the integration profile', async () => {
+      prisma.integration_profile.findFirst.mockResolvedValue({
+        config: { secret_key: 'secret' },
+        integration_provider: { slug: 'recaptcha' },
+      });
+      mockFetch(true);
+
+      await expect(service.verifyForProfile(7, 'token')).resolves.toBeUndefined();
+      expect(prisma.integration_profile.findFirst).toHaveBeenCalledWith(
+        expect.objectContaining({ where: { id: 7 } }),
+      );
+    });
+
+    it('refuses when no profile id is configured', async () => {
+      await expect(service.verifyForProfile(null, 'token')).rejects.toThrow(
+        'CAPTCHA is enabled but no integration profile is configured.',
+      );
+    });
+
+    it('refuses when the profile does not exist', async () => {
+      prisma.integration_profile.findFirst.mockResolvedValue(null);
+      await expect(service.verifyForProfile(7, 'token')).rejects.toThrow(
+        'CAPTCHA integration profile not found.',
+      );
+    });
+  });
+
+  describe('getPublicConfig', () => {
+    it('returns the provider and site key', async () => {
+      prisma.integration_profile.findFirst.mockResolvedValue({
+        config: { site_key: 'public-key', secret_key: 'secret' },
+        integration_provider: { slug: 'cloudflare-turnstile' },
+      });
+
+      const config = await service.getPublicConfig(7);
+
+      expect(config).toEqual({
+        enabled: true,
+        provider_slug: 'cloudflare-turnstile',
+        site_key: 'public-key',
+      });
+      // O segredo nunca sai do servidor.
+      expect(JSON.stringify(config)).not.toContain('secret');
+    });
+
+    it('reports disabled when there is no profile', async () => {
+      await expect(service.getPublicConfig(null)).resolves.toEqual({
+        enabled: false,
+        provider_slug: null,
+        site_key: null,
+      });
+    });
+
+    it('reports disabled when the caller says the feature is off', async () => {
+      await expect(service.getPublicConfig(7, false)).resolves.toEqual({
+        enabled: false,
+        provider_slug: null,
+        site_key: null,
+      });
+      expect(prisma.integration_profile.findFirst).not.toHaveBeenCalled();
+    });
+  });
+
+  describe('extractSiteKey', () => {
+    it('accepts the naming variants providers use', () => {
+      expect(CaptchaService.extractSiteKey({ site_key: 'a' })).toBe('a');
+      expect(CaptchaService.extractSiteKey({ sitekey: 'b' })).toBe('b');
+      expect(CaptchaService.extractSiteKey({ public_key: 'c' })).toBe('c');
+      expect(CaptchaService.extractSiteKey({ secret_key: 'x' })).toBeNull();
+      expect(CaptchaService.extractSiteKey(null)).toBeNull();
+    });
+  });
+});

package/src/captcha/captcha.service.ts

@@ -0,0 +1,191 @@
+import { PrismaService } from '@hed-hog/api-prisma';
+import {
+  BadRequestException,
+  Inject,
+  Injectable,
+  forwardRef,
+} from '@nestjs/common';
+import { createHash, createHmac } from 'crypto';
+
+export const CAPTCHA_PROVIDERS = [
+  'recaptcha',
+  'cloudflare-turnstile',
+  'altcha',
+] as const;
+
+export type CaptchaProviderSlug = (typeof CAPTCHA_PROVIDERS)[number];
+
+export interface CaptchaPublicConfig {
+  enabled: boolean;
+  provider_slug: string | null;
+  site_key: string | null;
+}
+
+interface AltchaPayload {
+  algorithm: string;
+  challenge: string;
+  number: number;
+  salt: string;
+  signature: string;
+}
+
+/**
+ * Server-side CAPTCHA verification shared by every public form in the platform.
+ *
+ * Credentials live in an `integration_profile`, so a form only stores the profile
+ * id and never the secret itself.
+ */
+@Injectable()
+export class CaptchaService {
+  constructor(
+    @Inject(forwardRef(() => PrismaService))
+    private readonly prisma: PrismaService,
+  ) {}
+
+  /**
+   * Verifies a token against the provider configured in an integration profile.
+   * Throws `BadRequestException` when the challenge does not check out.
+   */
+  async verifyForProfile(
+    integrationProfileId: number | null | undefined,
+    token: string | null | undefined,
+  ): Promise<void> {
+    if (!integrationProfileId) {
+      throw new BadRequestException(
+        'CAPTCHA is enabled but no integration profile is configured.',
+      );
+    }
+
+    const profile = await (this.prisma as any).integration_profile.findFirst({
+      where: { id: integrationProfileId },
+      select: {
+        config: true,
+        integration_provider: { select: { slug: true } },
+      },
+    });
+
+    if (!profile) {
+      throw new BadRequestException('CAPTCHA integration profile not found.');
+    }
+
+    await this.verify(
+      token ?? '',
+      profile.integration_provider?.slug as string,
+      (profile.config ?? {}) as Record<string, string>,
+    );
+  }
+
+  /** Verifies a token against an explicit provider and its credentials. */
+  async verify(
+    token: string,
+    providerSlug: string,
+    config: Record<string, string>,
+  ): Promise<void> {
+    if (!token) {
+      throw new BadRequestException('CAPTCHA token is required.');
+    }
+
+    switch (providerSlug) {
+      case 'recaptcha':
+        await this.verifyRemote(
+          'https://www.google.com/recaptcha/api/siteverify',
+          config.secret_key,
+          token,
+        );
+        break;
+
+      case 'cloudflare-turnstile':
+        await this.verifyRemote(
+          'https://challenges.cloudflare.com/turnstile/v0/siteverify',
+          config.secret_key,
+          token,
+        );
+        break;
+
+      case 'altcha':
+        this.verifyAltcha(token, config);
+        break;
+
+      default:
+        throw new BadRequestException(
+          `Unsupported CAPTCHA provider: ${providerSlug}.`,
+        );
+    }
+  }
+
+  /**
+   * Public settings a front end needs to mount the widget. Only the site key is
+   * returned - the secret never leaves the server.
+   */
+  async getPublicConfig(
+    integrationProfileId: number | null | undefined,
+    enabled = true,
+  ): Promise<CaptchaPublicConfig> {
+    if (!enabled || !integrationProfileId) {
+      return { enabled: false, provider_slug: null, site_key: null };
+    }
+
+    const profile = await (this.prisma as any).integration_profile.findFirst({
+      where: { id: integrationProfileId },
+      select: {
+        config: true,
+        integration_provider: { select: { slug: true } },
+      },
+    });
+
+    return {
+      enabled: true,
+      provider_slug: profile?.integration_provider?.slug ?? null,
+      site_key: CaptchaService.extractSiteKey(profile?.config ?? null),
+    };
+  }
+
+  static extractSiteKey(
+    config: Record<string, unknown> | null,
+  ): string | null {
+    if (!config) return null;
+    const value = config.site_key ?? config.sitekey ?? config.public_key;
+    return value ? String(value) : null;
+  }
+
+  private async verifyRemote(
+    url: string,
+    secret: string,
+    token: string,
+  ): Promise<void> {
+    const body = new URLSearchParams({ secret, response: token });
+    const response = await fetch(url, { method: 'POST', body });
+    const json = (await response.json()) as { success: boolean };
+
+    if (!json.success) {
+      throw new BadRequestException('CAPTCHA validation failed.');
+    }
+  }
+
+  /**
+   * Altcha is verified locally: the client solves a proof-of-work, and the HMAC
+   * proves the challenge was issued by us.
+   */
+  private verifyAltcha(token: string, config: Record<string, string>): void {
+    let payload: AltchaPayload;
+    try {
+      payload = JSON.parse(Buffer.from(token, 'base64').toString('utf8'));
+    } catch {
+      throw new BadRequestException('Invalid CAPTCHA token format.');
+    }
+
+    const hash = createHash('sha256')
+      .update(payload.salt + String(payload.number))
+      .digest('hex');
+    if (hash !== payload.challenge) {
+      throw new BadRequestException('CAPTCHA validation failed.');
+    }
+
+    const hmac = createHmac('sha256', config.hmac_key)
+      .update(payload.challenge)
+      .digest('hex');
+    if (hmac !== payload.signature) {
+      throw new BadRequestException('CAPTCHA validation failed.');
+    }
+  }
+}

package/src/challenge/challenge.service.spec.ts

@@ -33,6 +33,7 @@ const makeDeps = () => {
   };
   const token = {
     createOpaqueToken: jest.fn().mockResolvedValue('tok'),
+    createEmailConfirmationToken: jest.fn().mockResolvedValue('confirm-tok'),
   };
   const mail = {
     sendTemplatedMail: jest.fn().mockResolvedValue(undefined),
@@ -129,12 +130,15 @@ describe('ChallengeService', () => {
       ).rejects.toThrow(BadRequestException);
     });
 
-    it('cria challenge e envia email com link base64', async () => {
+    it('cria challenge e envia email com link contendo o token original (sem recodificação)', async () => {
       const { service, deps } = makeService();
       deps.prisma.user_identifier_challenge.count.mockResolvedValue(0);
       deps.prisma.user_identifier.findFirst.mockResolvedValue({
         id: 10,
-        user: { name: 'Bob' },
+        user: {
+          name: 'Bob',
+          user_credential: [{ type: 'password', revoked_at: null }],
+        },
       });
       deps.setting.getSettingValues.mockResolvedValue({
         'mfa-challenge-expiration-minutes': 15,
@@ -146,19 +150,123 @@ describe('ChallengeService', () => {
       const result = await service.forgotEmail('en', 'a@b.com');
 
       expect(result).toEqual({ id: 1 });
-      const base64 = Buffer.from('tok').toString('base64');
       expect(deps.mail.sendTemplatedMail).toHaveBeenCalledWith(
         'en',
         expect.objectContaining({
           email: 'a@b.com',
           slug: 'auth-forget-password',
           variables: expect.objectContaining({
-            link: `https://app.com/reset-password?token=${base64}`,
+            link: `https://app.com/reset-password?token=${encodeURIComponent('tok')}`,
             name: 'Bob',
           }),
         }),
       );
     });
+
+    it('lança BadRequest quando usuário não possui senha cadastrada (ex: login via SSO)', async () => {
+      const { service, deps } = makeService();
+      deps.prisma.user_identifier_challenge.count.mockResolvedValue(0);
+      deps.prisma.user_identifier.findFirst.mockResolvedValue({
+        id: 10,
+        user: { name: 'Bob', user_credential: [] },
+      });
+
+      await expect(
+        service.forgotEmail('en', 'a@b.com'),
+      ).rejects.toThrow(BadRequestException);
+      expect(deps.prisma.user_identifier_challenge.create).not.toHaveBeenCalled();
+      expect(deps.mail.sendTemplatedMail).not.toHaveBeenCalled();
+    });
+
+    it('lança BadRequest quando a única credencial de senha está revogada', async () => {
+      const { service, deps } = makeService();
+      deps.prisma.user_identifier_challenge.count.mockResolvedValue(0);
+      deps.prisma.user_identifier.findFirst.mockResolvedValue({
+        id: 10,
+        user: {
+          name: 'Bob',
+          user_credential: [
+            { type: 'password', revoked_at: new Date('2026-01-01T00:00:00Z') },
+          ],
+        },
+      });
+
+      await expect(
+        service.forgotEmail('en', 'a@b.com'),
+      ).rejects.toThrow(BadRequestException);
+    });
+  });
+
+  describe('sendEmailConfirmationLink', () => {
+    const setupIdentifier = (deps: any) => {
+      deps.prisma.user_identifier.findFirst.mockResolvedValue({ id: 42 });
+      deps.prisma.user.findUnique.mockResolvedValue({ name: 'Bob' });
+      deps.setting.getSettingValues.mockResolvedValue({
+        url: 'https://admin.com',
+        'app-urls': ['training=https://train.com'],
+      });
+    };
+
+    it('envia o link de confirmação apontando para o app de origem', async () => {
+      const { service, deps } = makeService();
+      setupIdentifier(deps);
+
+      await service.sendEmailConfirmationLink('pt', 1, 'a@b.com', 'training');
+
+      expect(deps.token.createEmailConfirmationToken).toHaveBeenCalledWith({
+        userIdentifierId: 42,
+      });
+      expect(deps.mail.sendTemplatedMail).toHaveBeenCalledWith(
+        'pt',
+        expect.objectContaining({
+          email: 'a@b.com',
+          slug: 'auth-sign-up-confirm-email',
+          app: 'training',
+          variables: expect.objectContaining({
+            link: 'https://train.com/confirm-email?token=confirm-tok',
+            name: 'Bob',
+          }),
+        }),
+      );
+    });
+
+    it('não manda mais código: o e-mail de cadastro só leva o link', async () => {
+      const { service, deps } = makeService();
+      setupIdentifier(deps);
+
+      await service.sendEmailConfirmationLink('pt', 1, 'a@b.com', 'training');
+
+      const [, payload]: any = deps.mail.sendTemplatedMail.mock.calls[0];
+      expect(payload.variables.code).toBeUndefined();
+      // Sem linha em user_identifier_challenge: o token é um JWT autocontido.
+      expect(deps.prisma.user_identifier_challenge.create).not.toHaveBeenCalled();
+    });
+
+    it('cai na URL padrão quando o app não está mapeado', async () => {
+      const { service, deps } = makeService();
+      setupIdentifier(deps);
+
+      await service.sendEmailConfirmationLink('pt', 1, 'a@b.com');
+
+      expect(deps.mail.sendTemplatedMail).toHaveBeenCalledWith(
+        'pt',
+        expect.objectContaining({
+          variables: expect.objectContaining({
+            link: 'https://admin.com/confirm-email?token=confirm-tok',
+          }),
+        }),
+      );
+    });
+
+    it('lança NotFound quando o e-mail já está verificado', async () => {
+      const { service, deps } = makeService();
+      deps.prisma.user_identifier.findFirst.mockResolvedValue(null);
+
+      await expect(
+        service.sendEmailConfirmationLink('pt', 1, 'a@b.com'),
+      ).rejects.toThrow(NotFoundException);
+      expect(deps.mail.sendTemplatedMail).not.toHaveBeenCalled();
+    });
   });
 
   describe('verifyCodePassword', () => {