@hed-hog/core 0.0.387 → 0.0.393

package/src/integration-profile/integration-profile.module.spec.ts

@@ -0,0 +1,51 @@
+import { describe, expect, it } from '@jest/globals';
+import { IntegrationProfileModule } from './integration-profile.module';
+import { IntegrationProfileService } from './integration-profile.service';
+import { IntegrationCredentialCryptoService } from './integration-credential-crypto.service';
+import { BUILTIN_INTEGRATION_TESTERS } from './testers';
+import { IntegrationTesterRegistry } from './testers/integration-tester.registry';
+
+/**
+ * O `IntegrationTesterRegistry` é injetado no service e consumido de fora (a library
+ * fiscal registra o tester do nfse-national). Esquecer de declará-lo em `providers`
+ * ou `exports` só falharia no boot da API — este teste antecipa isso.
+ */
+describe('IntegrationProfileModule', () => {
+  const providers = Reflect.getMetadata('providers', IntegrationProfileModule) ?? [];
+  const exports = Reflect.getMetadata('exports', IntegrationProfileModule) ?? [];
+
+  it('declara e exporta tudo que o service e as libraries externas precisam', () => {
+    for (const dependency of [
+      IntegrationProfileService,
+      IntegrationCredentialCryptoService,
+      IntegrationTesterRegistry,
+    ]) {
+      expect(providers).toContain(dependency);
+      expect(exports).toContain(dependency);
+    }
+  });
+
+  it('registra todos os testers embutidos no boot', () => {
+    const registry = new IntegrationTesterRegistry();
+    const module = new IntegrationProfileModule(registry);
+
+    module.onModuleInit();
+
+    expect(registry.list()).toEqual(
+      [...BUILTIN_INTEGRATION_TESTERS.map((t) => t.providerSlug)].sort(),
+    );
+    // Amostra de cada tipo, para o teste falhar se um grupo inteiro sumir do index.
+    for (const slug of [
+      'smtp',
+      'whatsapp-official',
+      's3',
+      'openai',
+      'google-oauth',
+      'stripe',
+      'recaptcha',
+      'digitalocean',
+    ]) {
+      expect(registry.has(slug)).toBe(true);
+    }
+  });
+});

package/src/integration-profile/integration-profile.module.ts

@@ -1,10 +1,12 @@
 import { PaginationModule } from '@hed-hog/api-pagination';
 import { PrismaModule } from '@hed-hog/api-prisma';
-import { forwardRef, Module } from '@nestjs/common';
+import { forwardRef, Module, OnModuleInit } from '@nestjs/common';
 import { SecurityModule } from '../security/security.module';
 import { IntegrationCredentialCryptoService } from './integration-credential-crypto.service';
 import { IntegrationProfileController } from './integration-profile.controller';
 import { IntegrationProfileService } from './integration-profile.service';
+import { BUILTIN_INTEGRATION_TESTERS } from './testers';
+import { IntegrationTesterRegistry } from './testers/integration-tester.registry';
 
 @Module({
   imports: [
@@ -13,7 +15,24 @@ import { IntegrationProfileService } from './integration-profile.service';
     forwardRef(() => SecurityModule),
   ],
   controllers: [IntegrationProfileController],
-  providers: [IntegrationProfileService, IntegrationCredentialCryptoService],
-  exports: [IntegrationProfileService, IntegrationCredentialCryptoService],
+  providers: [
+    IntegrationProfileService,
+    IntegrationCredentialCryptoService,
+    IntegrationTesterRegistry,
+  ],
+  exports: [
+    IntegrationProfileService,
+    IntegrationCredentialCryptoService,
+    IntegrationTesterRegistry,
+  ],
 })
-export class IntegrationProfileModule {}
+export class IntegrationProfileModule implements OnModuleInit {
+  constructor(private readonly testerRegistry: IntegrationTesterRegistry) {}
+
+  onModuleInit() {
+    // Libraries externas (fiscal) registram os seus depois, no boot dos próprios módulos.
+    for (const tester of BUILTIN_INTEGRATION_TESTERS) {
+      this.testerRegistry.register(tester);
+    }
+  }
+}

package/src/integration-profile/integration-profile.secrets.ts

@@ -20,13 +20,18 @@ export const INTEGRATION_SECRET_KEYS: Record<string, string[]> = {
   gmail: ['client_secret', 'refresh_token'],
   ses: ['secret_access_key'],
   resend: ['api_token', 'webhook_secret'],
+  // IMAP e um perfil de RECEBIMENTO: a senha (ou senha de app, no Google
+  // Workspace e no M365) da acesso de leitura a caixa inteira.
+  imap: ['password'],
   // Mensageria
   'evolution-api': ['token'],
   // app_secret assina o HMAC do webhook (X-Hub-Signature-256) e verify_token é
   // comparado no handshake da Meta: quem tem qualquer um dos dois forja eventos.
   'whatsapp-official': ['access_token', 'app_secret', 'verify_token'],
   // Storage
-  s3: ['secret_access_key'],
+  // session_token acompanha credenciais temporárias (STS) usadas pelo upload em
+  // massa do LMS: vale como credencial completa enquanto não expira.
+  s3: ['secret_access_key', 'session_token'],
   gcs: ['key_file_json'],
   'azure-blob': ['key'],
   's3-compatible': ['secret_access_key'],
@@ -34,6 +39,9 @@ export const INTEGRATION_SECRET_KEYS: Record<string, string[]> = {
   openai: ['api_key'],
   gemini: ['api_key'],
   claude: ['api_key'],
+  deepseek: ['api_key'],
+  // Geração de vídeo
+  luma: ['api_key'],
   // OAuth
   'google-oauth': ['client_secret'],
   'github-oauth': ['client_secret'],
@@ -47,6 +55,9 @@ export const INTEGRATION_SECRET_KEYS: Record<string, string[]> = {
   // Pagamento
   stripe: ['secret_key', 'webhook_secret'],
   mercado_pago: ['access_token', 'webhook_secret'],
+  // A service account do Google Play assina o JWT trocado por access token: tanto
+  // o JSON inteiro quanto a private_key avulsa dão acesso à API do app.
+  google_play: ['service_account_json', 'private_key'],
   // Captcha
   recaptcha: ['secret_key'],
   'cloudflare-turnstile': ['secret_key'],

package/src/integration-profile/integration-profile.service.spec.ts

@@ -0,0 +1,279 @@
+import { beforeEach, describe, expect, it, jest } from '@jest/globals';
+import { BadRequestException } from '@nestjs/common';
+import { IntegrationProfileService } from './integration-profile.service';
+import { IntegrationCredentialCryptoService } from './integration-credential-crypto.service';
+import { IntegrationTesterRegistry } from './testers/integration-tester.registry';
+import { IntegrationTester } from './testers/integration-tester.types';
+
+/**
+ * Cobre o despacho de `POST /integration-profile/test`: o que o tester recebe, o que
+ * é gravado no perfil e o que volta para a UI. As garantias aqui são de segurança e
+ * de integridade de dados, não de comportamento de um provider específico.
+ */
+
+const SMTP_PROVIDER = {
+  slug: 'smtp',
+  integration_type: { slug: 'email' },
+};
+
+function makeService({
+  tester,
+  storedConfig = null,
+  provider = SMTP_PROVIDER,
+}: {
+  tester?: IntegrationTester;
+  storedConfig?: Record<string, unknown> | null;
+  provider?: unknown;
+} = {}) {
+  const stored = storedConfig ? { id: 42, config: storedConfig } : null;
+
+  const prismaService = {
+    integration_type: { findUnique: jest.fn<any>().mockResolvedValue({ id: 1 }) },
+    integration_provider: {
+      findUnique: jest.fn<any>().mockResolvedValue(provider),
+    },
+    integration_profile: {
+      findUnique: jest.fn<any>().mockResolvedValue(stored),
+      update: jest.fn<any>().mockResolvedValue({}),
+    },
+  };
+
+  // O crypto real: `mergeKeepingStoredSecrets` e `encryptConfig` fazem parte do que
+  // está sendo verificado, então mocká-los esconderia justamente as regressões.
+  const credentialCrypto = new IntegrationCredentialCryptoService({
+    encrypt: (value: string) => `cipher(${value})`,
+    decrypt: (value: string) => value,
+  } as any);
+
+  const registry = new IntegrationTesterRegistry();
+  if (tester) registry.register(tester);
+
+  const service = new IntegrationProfileService(
+    prismaService as any,
+    {} as any,
+    credentialCrypto,
+    registry,
+  );
+  // `validateTypeAndProvider` só confirma a existência das FKs; não é o alvo aqui.
+  jest
+    .spyOn(service as any, 'validateTypeAndProvider')
+    .mockResolvedValue(undefined as never);
+
+  return { service, prismaService, registry };
+}
+
+const baseInput = {
+  slug: 'meu-smtp',
+  name: 'Meu SMTP',
+  type_id: 1,
+  provider_id: 10,
+  config: { host: 'smtp.acme.com', from_email: 'envio@acme.com' },
+};
+
+describe('IntegrationProfileService.test', () => {
+  beforeEach(() => {
+    jest.clearAllMocks();
+  });
+
+  it('recusa providers sem tester registrado', async () => {
+    const { service } = makeService();
+
+    await expect(service.test({ ...baseInput } as any)).rejects.toThrow(
+      'Connection test is not available for provider "smtp".',
+    );
+  });
+
+  it('entrega ao tester o segredo armazenado no lugar da máscara', async () => {
+    const seen: Array<Record<string, unknown>> = [];
+    const tester: IntegrationTester = {
+      providerSlug: 'smtp',
+      test: async (config) => {
+        seen.push(config);
+        return { ok: true, info: 'smtp.acme.com:587' };
+      },
+    };
+    const { service } = makeService({
+      tester,
+      storedConfig: { password: 'senha-real-armazenada' },
+    });
+
+    await service.test({
+      ...baseInput,
+      config: { ...baseInput.config, password: '********' },
+    } as any);
+
+    expect(seen[0].password).toBe('senha-real-armazenada');
+  });
+
+  it('resolve o perfil por profile_id quando ele vem, para o slug renomeado não perder os segredos', async () => {
+    const tester: IntegrationTester = {
+      providerSlug: 'smtp',
+      test: async () => ({ ok: true }),
+    };
+    const { service, prismaService } = makeService({
+      tester,
+      storedConfig: { password: 'stored' },
+    });
+
+    await service.test({ ...baseInput, slug: 'novo-slug', profile_id: 42 } as any);
+
+    expect(prismaService.integration_profile.findUnique).toHaveBeenCalledWith(
+      expect.objectContaining({ where: { id: 42 } }),
+    );
+  });
+
+  it('grava o resultado sobre o config ARMAZENADO, nunca sobre o que veio no formulário', async () => {
+    const tester: IntegrationTester = {
+      providerSlug: 'smtp',
+      test: async () => ({ ok: true, info: 'smtp.acme.com:587' }),
+    };
+    const { service, prismaService } = makeService({
+      tester,
+      storedConfig: { host: 'smtp.antigo.com', password: 'stored' },
+    });
+
+    await service.test({
+      ...baseInput,
+      config: { host: 'smtp.ainda-nao-salvo.com', from_email: 'x@y.com' },
+    } as any);
+
+    const written = prismaService.integration_profile.update.mock
+      .calls[0][0] as any;
+    // O host digitado e não salvo não pode entrar no banco de carona no teste.
+    expect(written.data.config.host).toBe('smtp.antigo.com');
+    expect(written.data.config).not.toHaveProperty('from_email');
+    expect(written.data.config.last_validation_status).toBe('ok');
+    expect(written.data.config.last_validation_info).toBe('smtp.acme.com:587');
+    expect(written.data.config.last_error).toBeNull();
+    expect(written.data.config.last_validated_at).toEqual(expect.any(String));
+    // O segredo é recifrado (com envelope) ao gravar.
+    expect(written.data.config.password).toBe('enc.v1.cipher(stored)');
+  });
+
+  it('registra a falha e devolve 400 com a mensagem do tester', async () => {
+    const tester: IntegrationTester = {
+      providerSlug: 'smtp',
+      test: async () => ({ ok: false, error: 'SMTP authentication failed.' }),
+    };
+    const { service, prismaService } = makeService({
+      tester,
+      storedConfig: { password: 'stored' },
+    });
+
+    await expect(service.test({ ...baseInput } as any)).rejects.toThrow(
+      BadRequestException,
+    );
+
+    const written = prismaService.integration_profile.update.mock
+      .calls[0][0] as any;
+    expect(written.data.config.last_validation_status).toBe('error');
+    expect(written.data.config.last_error).toBe('SMTP authentication failed.');
+  });
+
+  it('não grava nada quando o perfil ainda não existe, e avisa na resposta', async () => {
+    const tester: IntegrationTester = {
+      providerSlug: 'smtp',
+      test: async () => ({ ok: true, info: 'ok' }),
+    };
+    const { service, prismaService } = makeService({ tester });
+
+    const result = await service.test({ ...baseInput } as any);
+
+    expect(prismaService.integration_profile.update).not.toHaveBeenCalled();
+    expect(result.persisted).toBe(false);
+  });
+
+  it('uma falha ao gravar não transforma um teste bem-sucedido em erro', async () => {
+    const tester: IntegrationTester = {
+      providerSlug: 'smtp',
+      test: async () => ({ ok: true, info: 'ok' }),
+    };
+    const { service, prismaService } = makeService({
+      tester,
+      storedConfig: { password: 'stored' },
+    });
+    prismaService.integration_profile.update.mockRejectedValue(
+      new Error('deadlock') as never,
+    );
+
+    const result = await service.test({ ...baseInput } as any);
+
+    expect(result.ok).toBe(true);
+    expect(result.persisted).toBe(false);
+  });
+
+  it('não vaza segredo quando o tester lança com a credencial na mensagem', async () => {
+    const tester: IntegrationTester = {
+      providerSlug: 'smtp',
+      test: async () => {
+        throw new Error('Provider echoed back senha-super-secreta-123');
+      },
+    };
+    const { service } = makeService({ tester });
+
+    const failure = await service
+      .test({
+        ...baseInput,
+        config: { ...baseInput.config, password: 'senha-super-secreta-123' },
+      } as any)
+      .catch((error) => error as BadRequestException);
+
+    expect(failure).toBeInstanceOf(BadRequestException);
+    expect(failure.message).not.toContain('senha-super-secreta-123');
+    expect(failure.message).toContain('***');
+  });
+
+  it('devolve o contrato legado (success/destination) junto dos campos novos', async () => {
+    const tester: IntegrationTester = {
+      providerSlug: 'smtp',
+      test: async () => ({ ok: true, info: 'smtp.acme.com:587', warning: 'heads up' }),
+    };
+    const { service } = makeService({ tester });
+
+    const result = await service.test({ ...baseInput } as any);
+
+    expect(result).toMatchObject({
+      success: true,
+      // A tela de e-mail depende de `destination` ser o remetente.
+      destination: 'envio@acme.com',
+      ok: true,
+      provider: 'smtp',
+      info: 'smtp.acme.com:587',
+      warning: 'heads up',
+      persisted: false,
+    });
+    expect(result.tested_at).toEqual(expect.any(String));
+  });
+
+  it('usa a evidência do tester como destination quando o tipo não é e-mail', async () => {
+    const tester: IntegrationTester = {
+      providerSlug: 's3',
+      test: async () => ({ ok: true, info: 'meu-bucket (us-east-1)' }),
+    };
+    const { service } = makeService({
+      tester,
+      provider: { slug: 's3', integration_type: { slug: 'storage' } },
+    });
+
+    const result = await service.test({
+      ...baseInput,
+      config: { bucket: 'meu-bucket' },
+    } as any);
+
+    expect(result.destination).toBe('meu-bucket (us-east-1)');
+  });
+
+  it('interrompe um tester que ignora o AbortSignal, em vez de segurar a requisição', async () => {
+    const tester: IntegrationTester = {
+      providerSlug: 'smtp',
+      timeoutMs: 10,
+      // Nunca resolve: é o transporter do nodemailer segurando o socket.
+      test: () => new Promise(() => {}),
+    };
+    const { service } = makeService({ tester });
+
+    await expect(service.test({ ...baseInput } as any)).rejects.toThrow(
+      /Timed out/,
+    );
+  });
+});