@hed-hog/core 0.0.390 → 0.0.393

package/hedhog/data/route.yaml

@@ -89,6 +89,45 @@
           slug: admin-access
       - where:
           slug: user
+# Dispositivos conhecidos do proprio usuario. Mesmos papeis das sessoes: e a
+# mesma area de seguranca da conta.
+- url: /user-device
+  method: GET
+  type: HTTP
+  relations:
+    role:
+      - where:
+          slug: admin
+      - where:
+          slug: admin-access
+      - where:
+          slug: user
+- url: /user-device/:deviceId
+  method: DELETE
+  type: HTTP
+  relations:
+    role:
+      - where:
+          slug: admin
+      - where:
+          slug: admin-access
+      - where:
+          slug: user
+# Dispositivos de OUTRO usuario (sheet do admin): so admin.
+- url: /user-device/user/:userId
+  method: GET
+  type: HTTP
+  relations:
+    role:
+      - where:
+          slug: admin
+- url: /user-device/user/:userId/:deviceId
+  method: DELETE
+  type: HTTP
+  relations:
+    role:
+      - where:
+          slug: admin
 - url: /sessions/:sessionId/revoke
   method: DELETE
   type: HTTP
@@ -427,6 +466,42 @@
           slug: admin
       - where:
           slug: admin-user
+      # A acao "simular acesso" vive na tela de usuarios, entao quem so tem o
+      # papel de simulacao ainda precisa listar usuarios.
+      - where:
+          slug: admin-impersonation
+# Simulacao de acesso. /impersonation/redeem e @Public() e /impersonation/stop e
+# /impersonation/session sao @NoRole(), entao nao entram aqui — o RoleGuard
+# retorna true antes de consultar a tabela nos tres casos.
+- url: /impersonation/start
+  method: POST
+  type: HTTP
+  relations:
+    role:
+      - where:
+          slug: admin
+      - where:
+          slug: admin-impersonation
+- url: /impersonation/history
+  method: GET
+  type: HTTP
+  relations:
+    role:
+      - where:
+          slug: admin
+      - where:
+          slug: admin-impersonation
+- url: /impersonation/apps
+  method: GET
+  type: HTTP
+  relations:
+    role:
+      - where:
+          slug: admin
+      - where:
+          slug: admin-impersonation
+# Gestao de papeis de um usuario: exige o papel dedicado admin-user-permission.
+# admin-user administra o cadastro, mas nao concede/revoga papeis (escalonamento de privilegio).
 - url: /user/:userId/role
   method: GET
   type: HTTP
@@ -435,7 +510,7 @@
       - where:
           slug: admin
       - where:
-          slug: admin-user
+          slug: admin-user-permission
 - url: /user/:userId/role/:roleId
   method: DELETE
   type: HTTP
@@ -444,7 +519,7 @@
       - where:
           slug: admin
       - where:
-          slug: admin-user
+          slug: admin-user-permission
 - url: /user/:userId/role/:roleId
   method: POST
   type: HTTP
@@ -453,7 +528,7 @@
       - where:
           slug: admin
       - where:
-          slug: admin-user
+          slug: admin-user-permission
 - url: /user/:userId
   method: GET
   type: HTTP
@@ -490,6 +565,8 @@
           slug: admin
       - where:
           slug: admin-access
+      - where:
+          slug: admin-user-permission
 - url: /user/:userId/route
   method: GET
   type: HTTP
@@ -499,6 +576,8 @@
           slug: admin
       - where:
           slug: admin-access
+      - where:
+          slug: admin-user-permission
 - url: /user
   method: POST
   type: HTTP
@@ -662,6 +741,11 @@
           slug: admin
       - where:
           slug: admin-access
+      # O editor do CMS sobe capa de post e imagem de Open Graph por aqui.
+      - where:
+          slug: admin-cms
+      - where:
+          slug: cms-editor
 - url: /file
   method: DELETE
   type: HTTP
@@ -1201,6 +1285,19 @@
           slug: admin
       - where:
           slug: admin-mail
+# Provisiona o webhook que recebe bounce/complaint/delivery do SES e devolve a
+# URL para assinar no topico SNS. O endpoint que recebe os eventos e o
+# /webhook/:uuid publico do core: ele nao entra aqui porque o RoleGuard
+# curto-circuita em IS_PUBLIC_KEY antes de ler a tabela `route`.
+- url: /mail-delivery/provision/:integrationProfileId
+  method: POST
+  type: HTTP
+  relations:
+    role:
+      - where:
+          slug: admin
+      - where:
+          slug: admin-mail
 - url: /mail-sent
   method: GET
   type: HTTP
@@ -1519,6 +1616,47 @@
           slug: admin
       - where:
           slug: admin-access
+- url: /ai/richtext/edit-html
+  method: POST
+  type: HTTP
+  relations:
+    role:
+      - where:
+          slug: admin
+      - where:
+          slug: admin-access
+      - where:
+          slug: admin-campaign
+      - where:
+          slug: admin-cms
+      - where:
+          slug: cms-editor
+      - where:
+          slug: cms-publisher
+      - where:
+          slug: admin-finance
+      - where:
+          slug: admin-finance-operator
+      - where:
+          slug: finance-statements-editor
+      - where:
+          slug: admin-inbox
+      - where:
+          slug: inbox-owner
+      - where:
+          slug: admin-lms
+      - where:
+          slug: lms-instructor
+      - where:
+          slug: admin-operations-director
+      - where:
+          slug: admin-operations-project-manager
+      - where:
+          slug: operations-collaborator
+      - where:
+          slug: admin-sac
+      - where:
+          slug: sac-agent
 - url: /integration-event-catalog
   method: GET
   type: HTTP
@@ -3357,6 +3495,37 @@
   method: POST
   type: HTTP
   relations: *core_user_roles
+# Pareamento por QR. Só as rotas que exigem sessão entram aqui: /auth/pairing/claim,
+# /auth/pairing/redeem, /auth/pairing/reverse e /auth/pairing/reverse/poll são
+# @Public() — o aparelho que as chama ainda não tem sessão nenhuma.
+- url: /auth/pairing
+  method: POST
+  type: HTTP
+  relations: *core_user_roles
+- url: /auth/pairing/:id
+  method: GET
+  type: HTTP
+  relations: *core_user_roles
+- url: /auth/pairing/:id/confirm
+  method: POST
+  type: HTTP
+  relations: *core_user_roles
+- url: /auth/pairing/:id
+  method: DELETE
+  type: HTTP
+  relations: *core_user_roles
+- url: /auth/pairing/reverse/:id
+  method: GET
+  type: HTTP
+  relations: *core_user_roles
+- url: /auth/pairing/reverse/:id/approve
+  method: POST
+  type: HTTP
+  relations: *core_user_roles
+- url: /auth/pairing/reverse/:id/reject
+  method: POST
+  type: HTTP
+  relations: *core_user_roles
 - url: /auth/roles
   method: GET
   type: HTTP

package/hedhog/data/setting_group.yaml

@@ -76,6 +76,20 @@
         subgroup_id:
           where:
             slug: general-system
+      - slug: cors-allowed-origins
+        type: array
+        component: input-tags
+        name:
+          en: Extra CORS Origins
+          pt: Origens CORS Adicionais
+        description:
+          en: 'Extra origins allowed to call the API from a browser, added to CORS_ALLOWED_ORIGINS/CORS_ALLOWED_DOMAINS and applied without a restart. Already includes the published browser extension; add your own only if you build the extension yourself.'
+          pt: 'Origens adicionais autorizadas a chamar a API pelo navegador, somadas a CORS_ALLOWED_ORIGINS/CORS_ALLOWED_DOMAINS e aplicadas sem reiniciar. Já inclui a extensão de navegador publicada; acrescente as suas apenas se você mesmo compilar a extensão.'
+        value: '["chrome-extension://ojimnolpmeegaaindaaceiodhmlbaljn"]'
+        user_override: false
+        subgroup_id:
+          where:
+            slug: general-system
       - slug: app-names
         type: array
         component: input-tags
@@ -83,8 +97,8 @@
           en: App Names
           pt: Nomes dos Aplicativos
         description:
-          en: 'Display name for specific apps, formatted as "app=Name" (one per tag). Used as the brand name shown in transactional emails when the request comes from that app, falling back to System Name otherwise.'
-          pt: 'Nome de exibição de apps específicos, no formato "app=Nome" (uma por tag). Usado como o nome de marca exibido em e-mails transacionais quando a solicitação vem desse app, usando o Nome do Sistema como alternativa.'
+          en: 'Deprecated: no longer used. Transactional emails always show the System Name. Kept for backward compatibility.'
+          pt: 'Descontinuada: não é mais usada. E-mails transacionais sempre exibem o Nome do Sistema. Mantida por compatibilidade.'
         value: '["training=Training","class=Class","partners=Partners","admin=Admin"]'
         user_override: false
         subgroup_id:
@@ -376,6 +390,34 @@
         subgroup_id:
           where:
             slug: mcp-configuration
+      - slug: richtext-ai-enabled
+        type: boolean
+        component: switch
+        name:
+          en: Enable AI in Rich Text Editor
+          pt: Habilitar IA no Editor de Texto
+        description:
+          en: Shows an AI button in the rich text editor toolbar (used across the admin), letting users rewrite the current content from a prompt.
+          pt: Exibe um botão de IA na barra de ferramentas do editor de texto rico (usado em todo o admin), permitindo reescrever o conteúdo atual a partir de um prompt.
+        value: false
+        user_override: false
+        subgroup_id:
+          where:
+            slug: richtext-ai-configuration
+      - slug: richtext-ai-profile-id
+        type: string
+        component: entity-picker
+        name:
+          en: AI Profile
+          pt: Perfil de IA
+        description:
+          en: Integration profile (type AI) used to rewrite rich text editor content from a prompt.
+          pt: Perfil de integração (tipo IA) usado para reescrever o conteúdo do editor de texto rico a partir de um prompt.
+        value: ''
+        user_override: false
+        subgroup_id:
+          where:
+            slug: richtext-ai-configuration
 - slug: authentication
   icon: lock-password
   name:
@@ -665,6 +707,20 @@
         subgroup_id:
           where:
             slug: session-management
+      - slug: impersonation-session-minutes
+        type: number
+        component: input-number
+        name:
+          en: Simulated Session Lifetime
+          pt: Duração da Sessão Simulada
+        description:
+          en: Minutes an access simulation session stays valid. It is never refreshed, so this is the hard limit.
+          pt: Minutos que uma sessão de simulação de acesso continua válida. Ela nunca é renovada, então este é o limite absoluto.
+        value: 30
+        user_override: false
+        subgroup_id:
+          where:
+            slug: session-management
 - slug: localization
   icon: world
   name:
@@ -1102,6 +1158,12 @@
               order: 10
             - value: User.ReadBasic.All
               order: 11
+            - value: Calendars.ReadWrite
+              order: 12
+            - value: OnlineMeetings.ReadWrite
+              order: 13
+            - value: OnlineMeetingRecording.Read.All
+              order: 14
         subgroup_id:
           where:
             slug: microsoft-entra-id
@@ -1133,6 +1195,106 @@
         subgroup_id:
           where:
             slug: microsoft-entra-id
+      - slug: microsoft-meeting-organizer-mode
+        type: string
+        component: radio
+        name:
+          en: Teams meeting organizer
+          pt: Organizador das reuniões Teams
+        description:
+          en: 'Who organizes the meetings this system schedules: "app" uses a fixed service account via application permissions (the instructor does not need a connected account); "delegated" uses the connected Microsoft account of whoever requested the meeting.'
+          pt: 'Quem organiza as reuniões agendadas pelo sistema: "app" usa uma conta de serviço fixa com permissões de aplicativo (o instrutor não precisa ter conta conectada); "delegated" usa a conta Microsoft conectada de quem pediu a reunião.'
+        value: app
+        user_override: false
+        relations:
+          setting_list:
+            - value: app
+              order: 0
+            - value: delegated
+              order: 1
+        subgroup_id:
+          where:
+            slug: microsoft-entra-id
+      - slug: microsoft-meeting-service-account
+        type: string
+        component: input-text
+        name:
+          en: Teams meeting service account (UPN)
+          pt: Conta de serviço das reuniões (UPN)
+        description:
+          en: UPN of the mailbox that organizes and records the meetings when the organizer is "app". Needs a Teams license, a policy allowing cloud recording, and an Application Access Policy granting this app access to it.
+          pt: UPN da caixa que organiza e grava as reuniões quando o organizador é "app". Precisa de licença do Teams, política que permita gravação na nuvem e uma Application Access Policy dando acesso a este aplicativo.
+        value: ""
+        user_override: false
+        subgroup_id:
+          where:
+            slug: microsoft-entra-id
+      - slug: microsoft-meeting-recording-poll-hours
+        type: number
+        component: input-number
+        name:
+          en: Recording lookup window (hours)
+          pt: Janela de busca da gravação (horas)
+        description:
+          en: How long after a meeting ends the system keeps looking for its recording before giving up and marking it unavailable.
+          pt: Por quanto tempo, após o fim da reunião, o sistema continua procurando a gravação antes de desistir e marcá-la como indisponível.
+        value: '48'
+        user_override: false
+        subgroup_id:
+          where:
+            slug: microsoft-entra-id
+      - slug: microsoft-meeting-recording-purge-mode
+        type: string
+        component: radio
+        name:
+          en: OneDrive recording cleanup
+          pt: Limpeza da gravação no OneDrive
+        description:
+          en: 'What to do with the recording in the organizer''s OneDrive once it is safely imported: nothing, log only, recycle bin, or permanent delete. The recycle bin still uses the account quota for up to 93 days.'
+          pt: 'O que fazer com a gravação no OneDrive do organizador depois de importada com segurança: nada, só registrar no log, mandar para a lixeira ou excluir em definitivo. A lixeira ainda consome a cota por até 93 dias.'
+        value: disabled
+        user_override: false
+        relations:
+          setting_list:
+            - value: disabled
+              order: 0
+            - value: dry_run
+              order: 1
+            - value: recycle_bin
+              order: 2
+            - value: permanent
+              order: 3
+        subgroup_id:
+          where:
+            slug: microsoft-entra-id
+      - slug: microsoft-meeting-recording-purge-grace-days
+        type: number
+        component: input-number
+        name:
+          en: Cleanup grace period (days)
+          pt: Carência antes da limpeza (dias)
+        description:
+          en: How long to wait after a successful import before deleting the recording from OneDrive. The window exists so a failed transcoding or a wrong import can still be redone from the original.
+          pt: Quanto tempo esperar após uma importação bem-sucedida antes de apagar a gravação do OneDrive. A janela existe para que uma transcodificação falha ou um import errado ainda possam ser refeitos a partir do original.
+        value: '7'
+        user_override: false
+        subgroup_id:
+          where:
+            slug: microsoft-entra-id
+      - slug: microsoft-meeting-recording-folder
+        type: string
+        component: input-text
+        name:
+          en: OneDrive recordings folder
+          pt: Pasta das gravações no OneDrive
+        description:
+          en: Name of the folder where Teams drops recordings in the organizer's OneDrive. The name follows the tenant language, and nothing outside this folder is ever deleted.
+          pt: Nome da pasta onde o Teams deposita as gravações no OneDrive do organizador. O nome acompanha o idioma da organização, e nada fora dessa pasta é apagado.
+        value: Recordings
+        user_override: false
+        subgroup_id:
+          where:
+            slug: microsoft-entra-id
       - slug: oauth-apple-profile-id
         type: string
         component: entity-picker
@@ -2095,6 +2257,20 @@
         subgroup_id:
           where:
             slug: image-optimization
+      - slug: image-resize-allowed-widths
+        type: string
+        component: input-text
+        name:
+          en: Allowed Resize Widths (px)
+          pt: Larguras Permitidas de Redimensionamento (px)
+        description:
+          en: 'JSON list of widths the public image endpoint may render via ?w=. Any other width serves the original file. An allowlist is required because the endpoint is public: an arbitrary width means arbitrary CPU per request.'
+          pt: 'Lista JSON de larguras que o endpoint público de imagens pode gerar via ?w=. Qualquer outra largura serve o arquivo original. A lista é obrigatória porque o endpoint é público: uma largura arbitrária significa CPU arbitrária por requisição.'
+        value: '[64,128,320,400,480,640,896,1200]'
+        user_override: false
+        subgroup_id:
+          where:
+            slug: image-optimization
       - slug: image-cache-ttl-seconds
         type: number
         component: input-number

package/hedhog/data/setting_subgroup.yaml

@@ -373,3 +373,11 @@
   description:
     en: Model Context Protocol configuration
     pt: Configuração do servidor MCP
+
+- slug: richtext-ai-configuration
+  name:
+    en: Rich Text AI
+    pt: IA no Editor de Texto
+  description:
+    en: AI-assisted rewriting for the shared rich text editor used across the admin
+    pt: Reescrita assistida por IA para o editor de texto rico compartilhado usado no admin

package/hedhog/frontend/app/_lib/hooks/use-core-access.test.tsx.ejs

@@ -0,0 +1,125 @@
+import { describe, it, expect, vi, beforeEach } from 'vitest';
+import { renderHook, waitFor } from '@testing-library/react';
+import { type ReactNode } from 'react';
+
+// useCoreAccess combina useApp().request/accessToken com useQuery real, igual ao
+// padrão de use-finance-access.test.tsx. A lógica determinística real está na
+// derivação de roleSlugs/canManageUserPermissions a partir da resposta.
+const { mockRequest, appState } = vi.hoisted(() => ({
+  mockRequest: vi.fn(),
+  appState: { accessToken: undefined as string | undefined },
+}));
+vi.mock('@hed-hog/next-app-provider', async () => {
+  const rq = await vi.importActual<typeof import('@tanstack/react-query')>(
+    '@tanstack/react-query',
+  );
+  return {
+    useApp: () => ({ request: mockRequest, accessToken: appState.accessToken }),
+    useQuery: rq.useQuery,
+  };
+});
+
+import { QueryClient, QueryClientProvider } from '@tanstack/react-query';
+import { useCoreAccess } from './use-core-access';
+
+function makeWrapper() {
+  const client = new QueryClient({
+    defaultOptions: { queries: { retry: false } },
+  });
+  return function Wrapper({ children }: { children: ReactNode }) {
+    return <QueryClientProvider client={client}>{children}</QueryClientProvider>;
+  };
+}
+
+describe('useCoreAccess', () => {
+  beforeEach(() => {
+    mockRequest.mockReset();
+    appState.accessToken = 'tok';
+  });
+
+  it('não dispara a query sem accessToken (enabled=false)', () => {
+    appState.accessToken = undefined;
+    const { result } = renderHook(() => useCoreAccess(), {
+      wrapper: makeWrapper(),
+    });
+
+    expect(mockRequest).not.toHaveBeenCalled();
+    expect(result.current.isLoading).toBe(false);
+    expect(result.current.roleSlugs).toEqual([]);
+    expect(result.current.canManageUserPermissions).toBe(false);
+  });
+
+  it('canManageUserPermissions é true para admin', async () => {
+    mockRequest.mockResolvedValue({ data: { roles: [{ slug: 'admin' }] } });
+    const { result } = renderHook(() => useCoreAccess(), {
+      wrapper: makeWrapper(),
+    });
+
+    await waitFor(() => expect(result.current.roleSlugs).toEqual(['admin']));
+    expect(result.current.canManageUserPermissions).toBe(true);
+  });
+
+  it('canManageUserPermissions é true para admin-user-permission', async () => {
+    mockRequest.mockResolvedValue({
+      data: { roles: [{ slug: 'admin-user-permission' }] },
+    });
+    const { result } = renderHook(() => useCoreAccess(), {
+      wrapper: makeWrapper(),
+    });
+
+    await waitFor(() =>
+      expect(result.current.roleSlugs).toEqual(['admin-user-permission']),
+    );
+    expect(result.current.canManageUserPermissions).toBe(true);
+  });
+
+  it('canManageUserPermissions é false para admin-user (deliberadamente excluído)', async () => {
+    mockRequest.mockResolvedValue({ data: { roles: [{ slug: 'admin-user' }] } });
+    const { result } = renderHook(() => useCoreAccess(), {
+      wrapper: makeWrapper(),
+    });
+
+    await waitFor(() =>
+      expect(result.current.roleSlugs).toEqual(['admin-user']),
+    );
+    expect(result.current.canManageUserPermissions).toBe(false);
+  });
+
+  it('canManageUserPermissions é false para outros papéis admin-*', async () => {
+    mockRequest.mockResolvedValue({
+      data: { roles: [{ slug: 'admin-mail' }, { slug: 'admin-access' }] },
+    });
+    const { result } = renderHook(() => useCoreAccess(), {
+      wrapper: makeWrapper(),
+    });
+
+    await waitFor(() =>
+      expect(result.current.roleSlugs).toEqual(['admin-mail', 'admin-access']),
+    );
+    expect(result.current.canManageUserPermissions).toBe(false);
+  });
+
+  it('filtra roles sem slug (vazio/undefined) da lista final', async () => {
+    mockRequest.mockResolvedValue({
+      data: { roles: [{ slug: '' }, { slug: undefined }, { slug: 'user' }] },
+    });
+    const { result } = renderHook(() => useCoreAccess(), {
+      wrapper: makeWrapper(),
+    });
+
+    await waitFor(() => expect(result.current.roleSlugs).toEqual(['user']));
+    expect(result.current.canManageUserPermissions).toBe(false);
+  });
+
+  it('sem roles na resposta devolve lista vazia', async () => {
+    mockRequest.mockResolvedValue({ data: { roles: [] } });
+    const { result } = renderHook(() => useCoreAccess(), {
+      wrapper: makeWrapper(),
+    });
+
+    await waitFor(() => expect(mockRequest).toHaveBeenCalled());
+    await waitFor(() => expect(result.current.isLoading).toBe(false));
+    expect(result.current.roleSlugs).toEqual([]);
+    expect(result.current.canManageUserPermissions).toBe(false);
+  });
+});

package/hedhog/frontend/app/_lib/hooks/use-core-access.ts.ejs

@@ -0,0 +1,29 @@
+import { useApp, useQuery } from '@hed-hog/next-app-provider';
+
+type Role = { slug?: string };
+
+export function useCoreAccess() {
+  const { request, accessToken } = useApp();
+
+  const { data, isLoading } = useQuery<{ roles: Role[] }>({
+    queryKey: ['core-roles', accessToken],
+    enabled: !!accessToken,
+    queryFn: async () => {
+      const response = await request<{ roles: Role[] }>({ url: '/auth/roles' });
+      return response.data;
+    },
+  });
+
+  const roleSlugs = (data?.roles ?? []).map((r) => r.slug || '').filter(Boolean);
+
+  return {
+    isLoading,
+    roleSlugs,
+    // Conceder/revogar papeis de outra conta e escalonamento de privilegio, entao
+    // exige o papel dedicado admin-user-permission. admin-user administra apenas
+    // o cadastro do usuario e é deliberadamente excluido daqui.
+    canManageUserPermissions:
+      roleSlugs.includes('admin') ||
+      roleSlugs.includes('admin-user-permission'),
+  };
+}