@hed-hog/core 0.0.387 → 0.0.393

package/src/challenge/challenge.service.ts

@@ -5,6 +5,7 @@ import { MailService } from "../mail/mail.service";
 import { SecurityService } from "../security/security.service";
 import { SettingService } from "../setting/setting.service";
 import { TokenService } from "../token/token.service";
+import { hasPasswordCredential } from "../user/user-credential.util";
 
 @Injectable()
 export class ChallengeService {
@@ -21,7 +22,53 @@ export class ChallengeService {
     private readonly mail: MailService,
   ) { }
 
-  async verifyMfaEmail(locale: string, userId: number, email: string) {
+  /**
+   * Resolve a chave do app (ex.: "class") a partir do header Origin da
+   * requisicao, cruzando contra a setting `app-urls` (o mesmo mapeamento ja
+   * usado para montar links de e-mail por app), em fluxos onde o frontend nao
+   * manda `app` explicitamente no corpo — o Origin ja chega sozinho em toda
+   * chamada cross-origin do browser.
+   *
+   * Nao decide mais a marca do e-mail: `{{brandName}}` vem sempre de
+   * `system-name`.
+   */
+  async resolveAppKeyFromOrigin(origin?: string): Promise<string | undefined> {
+    if (!origin) {
+      return undefined;
+    }
+
+    let originHost: string;
+    try {
+      originHost = new URL(origin).hostname;
+    } catch {
+      return undefined;
+    }
+
+    const settings = await this.setting.getSettingValues(['app-urls']);
+    const appUrls: string[] = Array.isArray(settings['app-urls']) ? settings['app-urls'] : [];
+
+    for (const entry of appUrls) {
+      const separatorIndex = entry.indexOf('=');
+      if (separatorIndex === -1) {
+        continue;
+      }
+
+      const key = entry.slice(0, separatorIndex).trim();
+      const url = entry.slice(separatorIndex + 1).trim();
+
+      try {
+        if (new URL(url).hostname === originHost) {
+          return key;
+        }
+      } catch {
+        continue;
+      }
+    }
+
+    return undefined;
+  }
+
+  async verifyMfaEmail(locale: string, userId: number, email: string, origin?: string) {
     const settings = await this.setting.getSettingValues([
       'mfa-email-code-length',
       'mfa-challenge-expiration-minutes'
@@ -75,7 +122,8 @@ export class ChallengeService {
         variables: {
           code,
           name: user.name,
-        }
+        },
+        app: await this.resolveAppKeyFromOrigin(origin),
       }
     );
 
@@ -84,7 +132,7 @@ export class ChallengeService {
     return { challengeId };
   }
 
-  async verifyEmail(locale: string, userId: number, email: string) {
+  async verifyEmail(locale: string, userId: number, email: string, app?: string, origin?: string) {
 
     const identifier = await this.prisma.user_identifier.findFirst({
       where: {
@@ -139,13 +187,70 @@ export class ChallengeService {
         variables: {
           code,
           name: user.name,
-        }
+        },
+        app: app || await this.resolveAppKeyFromOrigin(origin),
       }
     );
 
     return { challengeId: challenge.id  };
   }
 
+  /**
+   * Link de confirmação enviado no cadastro. Substitui o código de 6 dígitos que
+   * `verifyEmail` manda: no cadastro o `challengeId` nunca chegava ao frontend e
+   * nenhum app tinha tela para digitar o código, então o e-mail pedia algo
+   * impossível — e parte dos usuários respondia a mensagem com o código.
+   *
+   * `verifyEmail` continua como está porque a troca de e-mail no perfil devolve
+   * o `challengeId` e tem tela de código de verdade.
+   */
+  async sendEmailConfirmationLink(
+    locale: string,
+    userId: number,
+    email: string,
+    app?: string,
+    origin?: string,
+  ) {
+    const identifier = await this.prisma.user_identifier.findFirst({
+      where: {
+        user_id: userId,
+        type: 'email',
+        value: email,
+        verified_at: null,
+      },
+      select: { id: true },
+    });
+
+    if (!identifier) {
+      throw new NotFoundException(getLocaleText('identifierNotFound', locale, 'Email identifier not found or already verified.'));
+    }
+
+    const user = await this.prisma.user.findUnique({
+      where: { id: userId },
+      select: { name: true },
+    });
+
+    if (!user) {
+      throw new NotFoundException(getLocaleText('userNotFound', locale, 'User not found.'));
+    }
+
+    const settings = await this.setting.getSettingValues(['url', 'app-urls']);
+    const resolvedApp = app || (await this.resolveAppKeyFromOrigin(origin));
+    const token = await this.token.createEmailConfirmationToken({
+      userIdentifierId: identifier.id,
+    });
+
+    return this.mail.sendTemplatedMail(locale, {
+      email,
+      slug: 'auth-sign-up-confirm-email',
+      variables: {
+        link: `${this.resolveAppUrl(settings, resolvedApp)}/confirm-email?token=${encodeURIComponent(token)}`,
+        name: user.name,
+      },
+      app: resolvedApp,
+    });
+  }
+
   async verifyMultipleEmails(locale: string, userId: number, emails: string[]) {
 
     const settings = await this.setting.getSettingValues([
@@ -202,11 +307,15 @@ export class ChallengeService {
 
     const userIdentifier = await this.prisma.user_identifier.findFirst({
       where: { type: 'email', value: email, enabled: true },
-      include: { user: true },
+      include: { user: { include: { user_credential: true } } },
     });
 
     if (!userIdentifier) throw new BadRequestException(getLocaleText('forgot.userNotFound', locale, 'User not found'));
 
+    if (!hasPasswordCredential(userIdentifier.user)) {
+      throw new BadRequestException(getLocaleText('forgot.noPassword', locale, 'This account does not have a password set. Sign in using your organization\'s login method instead.'));
+    }
+
     const settings = await this.setting.getSettingValues([
       'mfa-challenge-expiration-minutes',
       'url',
@@ -223,16 +332,16 @@ export class ChallengeService {
       },
     });
 
-    const tokenBase64 = Buffer.from(token).toString('base64');
     this.mail.sendTemplatedMail(
       locale,
       {
         email,
         slug: 'auth-forget-password',
         variables: {
-          link: `${this.resolveAppUrl(settings, app)}/reset-password?token=${tokenBase64}`,
+          link: `${this.resolveAppUrl(settings, app)}/reset-password?token=${encodeURIComponent(token)}`,
           name: userIdentifier.user.name,
-        }
+        },
+        app,
       }
     );
 
@@ -241,9 +350,10 @@ export class ChallengeService {
 
   /**
    * Cria um challenge de convite de criação de conta vinculado a um
-   * `user_identifier` de email já existente e retorna o token em base64
-   * (mesmo formato consumido pelo fluxo de reset de senha). A validade usa a
-   * setting `account-invite-expiration-minutes` (padrão 7 dias).
+   * `user_identifier` de email já existente e retorna o token opaco (mesmo
+   * formato consumido pelo fluxo de reset de senha) — quem monta o link a
+   * partir dele deve aplicar `encodeURIComponent`. A validade usa a setting
+   * `account-invite-expiration-minutes` (padrão 7 dias).
    */
   async createAccountInviteChallenge(userIdentifierId: number): Promise<string> {
     const settings = await this.setting.getSettingValues([
@@ -264,7 +374,7 @@ export class ChallengeService {
       },
     });
 
-    return Buffer.from(token).toString('base64');
+    return token;
   }
 
   private resolveAppUrl(settings: Record<string, any>, app?: string): string {
@@ -338,7 +448,7 @@ export class ChallengeService {
     return { success: true }
   }
 
-  async sendMfaCodeByEmail(locale: string, userId: number, email: string) {
+  async sendMfaCodeByEmail(locale: string, userId: number, email: string, origin?: string) {
     const user = await this.prisma.user.findUnique({
       where: { id: userId },
       select: { name: true }
@@ -382,7 +492,8 @@ export class ChallengeService {
         variables: {
           code,
           name: user.name,
-        }
+        },
+        app: await this.resolveAppKeyFromOrigin(origin),
       }
     );
 
@@ -413,7 +524,7 @@ export class ChallengeService {
     return true;
   }
 
-  async sendMfaCodeToMultipleEmails(locale: string, userId: number, emails: string[]) {
+  async sendMfaCodeToMultipleEmails(locale: string, userId: number, emails: string[], origin?: string) {
 
     if (!emails || emails.length === 0) {
       return { success: true };
@@ -455,8 +566,10 @@ export class ChallengeService {
       }
     });
 
+    const app = await this.resolveAppKeyFromOrigin(origin);
+
     for (const email of emails) {
-      
+
       this.mail.sendTemplatedMail(
         locale,
         {
@@ -465,7 +578,8 @@ export class ChallengeService {
           variables: {
             code,
             name: user.name,
-          }
+          },
+          app,
         }
       );
     }

package/src/core.module.ts

@@ -18,7 +18,12 @@ import { FileModule } from './file/file.module';
 import { InstallModule } from './install/install.module';
 import { IntegrationModule } from './integration/integration.module';
 import { LocaleModule as CoreLocaleModule } from './locale/locale.module';
+import { MailDeliveryModule } from './mail-delivery/mail-delivery.module';
 import { MailSentModule } from './mail-sent/mail-sent.module';
+import { IncidentModule } from './incident/incident.module';
+import { LeakedPasswordModule } from './leaked-password/leaked-password.module';
+import { LeakedPasswordService } from './leaked-password/leaked-password.service';
+import { MailLayoutModule } from './mail-layout/mail-layout.module';
 import { MailModule } from './mail/mail.module';
 import { McpChatModule } from './mcp-chat/mcp-chat.module';
 import { McpModule } from './mcp/mcp.module';
@@ -26,16 +31,20 @@ import { MenuModule } from './menu/menu.module';
 import { LocaleInjectionMiddleware } from './middlewares/locale-injection.middleware';
 import { NotificationModule } from './notification/notification.module';
 import { OAuthModule } from './oauth/oauth.module';
+import { PresenceModule } from './presence/presence.module';
+import { RealtimeModule } from './realtime/realtime.module';
 import { PdfModule } from './pdf/pdf.module';
 import { ProfileModule } from './profile/profile.module';
 import { RoleModule } from './role/role.module';
 import { RouteModule } from './route/route.module';
 import { ScreenModule } from './screen/screen.module';
+import { CaptchaModule } from './captcha/captcha.module';
 import { SecurityModule } from './security/security.module';
 import { SessionModule } from './session/session.module';
 import { SettingModule } from './setting/setting.module';
 import { SettingService } from './setting/setting.service';
 import { TaskModule } from './task/task.module';
+import { UserDeviceModule } from './user-device/user-device.module';
 import { UserModule } from './user/user.module';
 import { IsEmailWithSettingsConstraint } from './validators/is-email-with-settings.validator';
 import { IsPinCodeWithSettingConstraint } from './validators/is-pin-code-with-setting.validator';
@@ -43,8 +52,13 @@ import { IsStrongPasswordWithSettingsConstraint } from './validators/is-strong-p
 import { ValidatorServiceLocator } from './validators/service-locator';
 import { AiInstructionModule } from './ai-instruction/ai-instruction.module';
 import { AuthorizeModule } from './authorize/authorize.module';
+import { ImpersonationModule } from './impersonation/impersonation.module';
+import { PairingModule } from './pairing/pairing.module';
 import { IntegrationProfileModule } from './integration-profile/integration-profile.module';
+import { MailboxModule } from './mailbox/mailbox.module';
+import { MeetingModule } from './meeting/meeting.module';
 import { WebhookIntegrationModule } from './webhook-integration/webhook-integration.module';
+import { WhatsappSenderModule } from './whatsapp-sender/whatsapp-sender.module';
 
 @Global()
 @Module({
@@ -55,6 +69,8 @@ import { WebhookIntegrationModule } from './webhook-integration/webhook-integrat
     forwardRef(() => InstallModule),
     forwardRef(() => AuthModule),
     forwardRef(() => AuthorizeModule),
+    forwardRef(() => PairingModule),
+    forwardRef(() => ImpersonationModule),
     forwardRef(() => DashboardModule),
     forwardRef(() => MailSendModule),
     forwardRef(() => MenuModule),
@@ -68,14 +84,21 @@ import { WebhookIntegrationModule } from './webhook-integration/webhook-integrat
     forwardRef(() => UserModule),
     forwardRef(() => SystemModule),
     forwardRef(() => SettingModule),
+    forwardRef(() => IncidentModule),
+    forwardRef(() => LeakedPasswordModule),
     forwardRef(() => MailModule),
+    forwardRef(() => MailLayoutModule),
     forwardRef(() => IntegrationProfileModule),
+    forwardRef(() => WhatsappSenderModule),
     forwardRef(() => MailSentModule),
+    forwardRef(() => MailDeliveryModule),
     forwardRef(() => FileModule),
     forwardRef(() => TaskModule),
     forwardRef(() => SecurityModule),
+    forwardRef(() => CaptchaModule),
     forwardRef(() => ProfileModule),
     forwardRef(() => SessionModule),
+    forwardRef(() => UserDeviceModule),
     forwardRef(() => OAuthModule),
     forwardRef(() => IntegrationModule),
     forwardRef(() => WebhookIntegrationModule),
@@ -85,12 +108,21 @@ import { WebhookIntegrationModule } from './webhook-integration/webhook-integrat
     forwardRef(() => PdfModule),
     forwardRef(() => NotificationModule),
     forwardRef(() => AccessLogModule),
+    forwardRef(() => RealtimeModule),
+    forwardRef(() => PresenceModule),
+    MailboxModule,
+
+    MeetingModule,
   ],
   exports: [
     UserModule,
     AuthModule,
+    IncidentModule,
+    LeakedPasswordModule,
     MailModule,
+    MailLayoutModule,
     IntegrationProfileModule,
+    WhatsappSenderModule,
     RouteModule,
     RoleModule,
     MenuModule,
@@ -100,16 +132,26 @@ import { WebhookIntegrationModule } from './webhook-integration/webhook-integrat
     SettingModule,
     FileModule,
     SessionModule,
+    ImpersonationModule,
+    UserDeviceModule,
     AiModule,
     AiInstructionModule,
     IntegrationModule,
+    MailDeliveryModule,
     WebhookIntegrationModule,
+    MailboxModule,
+
+    MeetingModule,
+    OAuthModule,
     IsStrongPasswordWithSettingsConstraint,
     IsEmailWithSettingsConstraint,
     IsPinCodeWithSettingConstraint,
     PdfModule,
     NotificationModule,
     AccessLogModule,
+    RealtimeModule,
+    PresenceModule,
+    CaptchaModule,
   ],
   providers: [
     Reflector,
@@ -135,12 +177,15 @@ import { WebhookIntegrationModule } from './webhook-integration/webhook-integrat
 export class CoreModule implements NestModule, OnModuleInit {
   constructor(
     @Inject(forwardRef(() => SettingService))
-    private readonly settingService: SettingService
+    private readonly settingService: SettingService,
+    @Inject(forwardRef(() => LeakedPasswordService))
+    private readonly leakedPasswordService: LeakedPasswordService
   ) {}
 
   onModuleInit() {
     // Initialize the service locator for validators
     ValidatorServiceLocator.setSettingService(this.settingService);
+    ValidatorServiceLocator.setLeakedPasswordService(this.leakedPasswordService);
   }
 
   configure(consumer: MiddlewareConsumer) {

package/src/file/file.controller.ts

@@ -2,6 +2,7 @@ import { Public, Role } from '@hed-hog/api';
 import { getLocaleText, Locale } from '@hed-hog/api-locale';
 import { Pagination } from '@hed-hog/api-pagination';
 import {
+  BadRequestException,
   Body,
   Controller,
   Delete,
@@ -13,6 +14,7 @@ import {
   ParseIntPipe,
   Post,
   Put,
+  Query,
   Req,
   Res,
   UploadedFile,
@@ -21,12 +23,21 @@ import {
 import { FileInterceptor } from '@nestjs/platform-express';
 import { Request, Response } from 'express';
 import { readFileSync } from 'fs';
+import { rm } from 'fs/promises';
 import Handlebars from 'handlebars';
+import { diskStorage } from 'multer';
+import { tmpdir } from 'os';
 import { join } from 'path';
 import { DeleteDTO } from './dto/delete.dto';
 import { UploadFileDTO } from './dto/upload.dto';
 import { FileService } from './file.service';
 
+// Teto duro do multipart, avaliado enquanto o corpo ainda está chegando. É
+// diferente do setting `storage-max-size`, que só roda depois do arquivo inteiro
+// já estar recebido e por isso nunca serviu de proteção de recurso.
+const MAX_UPLOAD_BYTES =
+  Number(process.env.STORAGE_MAX_UPLOAD_BYTES) || 2 * 1024 * 1024 * 1024;
+
 @Role()
 @Controller('file')
 export class FileController {
@@ -91,7 +102,7 @@ export class FileController {
   ) {
     const file = await this.fileService.get(id);
     const token = this.fileService.createDownloadToken(file.path, 3600);
-    const origin = `${req.protocol}://${req.get('host')}`;
+    const origin = await this.fileService.resolvePublicBaseUrl(req);
 
     return {
       url: `${origin}/file/open/${encodeURIComponent(token)}`,
@@ -105,7 +116,7 @@ export class FileController {
     ) {
       const file = await this.fileService.get(id);
       const token = this.fileService.createDownloadToken(file.path, 3600);
-      const origin = `${req.protocol}://${req.get('host')}`;
+      const origin = await this.fileService.resolvePublicBaseUrl(req);
 
     return {
         url: `${origin}/file/download/${encodeURIComponent(token)}`,
@@ -147,6 +158,11 @@ export class FileController {
     }
   }
 
+  /**
+   * `w`/`f`/`q` request a resized variant. Widths outside the configured
+   * allowlist are ignored and the original is served, so a stale URL sitting in
+   * someone's cached HTML degrades instead of failing.
+   */
   @Public()
   @Get('image/:id')
   async openImage(
@@ -154,6 +170,9 @@ export class FileController {
     @Req() req: Request,
     @Res() res: Response,
     @Locale() locale: string,
+    @Query('w') width?: string,
+    @Query('f') format?: string,
+    @Query('q') quality?: string,
   ) {
     try {
       await this.fileService.serveImageById(
@@ -161,6 +180,7 @@ export class FileController {
         id,
         req.headers['if-none-match'],
         res,
+        { width, format, quality },
       );
     } catch (error: any) {
       const html = this.renderDownloadErrorHtml(locale, error);
@@ -219,16 +239,46 @@ export class FileController {
     }
   }
 
+  // Grava o multipart em disco em vez de bufferizar na RAM: o memoryStorage padrão
+  // do multer fazia um Buffer.concat do arquivo inteiro antes de o handler rodar,
+  // o que derrubava o pod por OOM em uploads grandes (ex.: masters de vídeo do LMS
+  // de ~450 MB contra um limite de 1Gi). Daqui em diante o arquivo vai para o
+  // storage por streaming, via uploadFromPath.
   @Post()
-  @UseInterceptors(FileInterceptor('file'))
+  @UseInterceptors(
+    FileInterceptor('file', {
+      storage: diskStorage({ destination: tmpdir() }),
+      limits: { fileSize: MAX_UPLOAD_BYTES },
+    }),
+  )
   async upload(
     @UploadedFile() file: MulterFile,
     @Body() body: UploadFileDTO,
   ) {
+    if (!file?.path) {
+      throw new BadRequestException(`No file provided`);
+    }
+
     const destination = body.destination || 'files';
     const maxWidth = Number(body.maxWidth) || undefined;
     const maxHeight = Number(body.maxHeight) || undefined;
-    return this.fileService.upload(destination, file, { maxWidth, maxHeight });
+
+    try {
+      return await this.fileService.uploadFromPath(destination, file.path, {
+        originalname: file.originalname,
+        mimetype: file.mimetype,
+        size: file.size,
+        encoding: file.encoding,
+        resize: { maxWidth, maxHeight },
+      });
+    } finally {
+      // Sem isto o diskStorage troca o OOM por disk pressure no nó.
+      await rm(file.path, { force: true }).catch((error) =>
+        this.logger.warn(
+          `Failed to remove temporary upload ${file.path}: ${error?.message}`,
+        ),
+      );
+    }
   }
 
   @Delete()