@hed-hog/core 0.0.390 → 0.0.394

package/src/auth/auth.controller.ts

@@ -1,4 +1,4 @@
-import { NoRole, Public, User, UserOptional } from '@hed-hog/api';
+import { Impersonation, ImpersonationContext, NoRole, Public, Session, User, UserOptional } from '@hed-hog/api';
 import { Locale } from '@hed-hog/api-locale';
 import {
   Body,
@@ -19,14 +19,15 @@ import { Throttle, ThrottlerGuard } from '@nestjs/throttler';
 import type { PublicKeyCredentialRequestOptionsJSON } from '@simplewebauthn/server';
 import { TokenService } from '../token/token.service';
 import { CreateWithEmailAndPasswordDTO } from '../user/dto/create-with-email-and-password.dto';
-import { UserService } from '../user/user.service';
 import { AuthService } from './auth.service';
+import { ConfirmEmailDTO } from './dto/confirm-email.dto';
 import { ForgetDTO } from './dto/forget.dto';
 import { LoginEmailVerificationResendDTO } from './dto/login-email-verification-resend.dto';
 import { LoginEmailVerificationDTO } from './dto/login-email-verification.dto';
 import { LoginWithCodeDTO } from './dto/login-with-code.dto';
 import { LoginWithRecoveryCodeDTO } from './dto/login-with-recovery-code';
 import { LoginDTO } from './dto/login.dto';
+import { ResendConfirmationDTO } from './dto/resend-confirmation.dto';
 import { ResendMfaCodeDTO } from './dto/resend-mfa-code.dto';
 import { ResetDTO } from './dto/reset.dto';
 import { CompleteAccountDTO, VerifyAccountInviteDTO } from './dto/complete-account.dto';
@@ -40,25 +41,24 @@ export class AuthController {
     private readonly service: AuthService,
     @Inject(forwardRef(() => TokenService))
     private readonly token: TokenService,
-    @Inject(forwardRef(() => UserService))
-    private readonly user: UserService,
   ) { }
 
   @NoRole()
   @Get('verify')
-  async verify(@User() { id }, @Locale() locale: string) {
-    return this.service.verifyUser(locale, id);
+  async verify(@User() { id }, @Session() sessionId: number, @Locale() locale: string) {
+    return this.service.verifyUser(locale, id, sessionId);
   }
 
   @NoRole()
   @Get('desktop-token')
   async desktopToken(
     @User() { id },
+    @Impersonation() impersonation: ImpersonationContext,
     @Locale() locale: string,
     @Ip() ipAddress: string,
     @Headers('user-agent') userAgent: string,
   ) {
-    return this.service.issueDesktopToken(locale, id, ipAddress, userAgent);
+    return this.service.issueDesktopToken(locale, id, ipAddress, userAgent, impersonation.active);
   }
 
   @NoRole()
@@ -137,13 +137,50 @@ export class AuthController {
     return this.service.emailVerificationLoginResend(locale, token, origin);
   }
 
+  // Confirma o e-mail pelo link do cadastro. Não autentica: só marca o
+  // identificador como verificado, e repetir o clique é inofensivo.
   @Public()
+  @UseGuards(ThrottlerGuard)
+  @Throttle({ default: { limit: 10, ttl: 60_000 } })
+  @Post('confirm-email')
+  async confirmEmail(
+    @Locale() locale: string,
+    @Body() { token }: ConfirmEmailDTO,
+  ) {
+    return this.service.confirmEmail(locale, token);
+  }
+
+  // Mesmo rate-limit do login: sem ele a rota criava contas sem qualquer
+  // limite por IP. Recebe os dados de sessão porque, quando a confirmação de
+  // e-mail não é exigida, o cadastro já sai autenticado.
+  @Public()
+  @UseGuards(ThrottlerGuard)
+  @Throttle({ default: { limit: 10, ttl: 60_000 } })
   @Post('signup')
   async registerWithEmailAndPassword(
     @Locale() locale: string,
     @Body() data: CreateWithEmailAndPasswordDTO,
+    @Ip() ipAddress: string,
+    @Headers('user-agent') userAgent: string,
+    @Headers('x-browser-id') browserId: string,
+    @Headers('origin') origin: string,
+    @Res({ passthrough: true }) res,
   ) {
-    return this.user.createWithEmailAndPassword(locale, data);
+    return this.service.signupWithEmailAndPassword(res, locale, ipAddress, userAgent, data, browserId || null, origin);
+  }
+
+  // Reenvia o link de confirmação do cadastro. Limite mais apertado que o das
+  // demais rotas públicas porque cada chamada dispara um e-mail.
+  @Public()
+  @UseGuards(ThrottlerGuard)
+  @Throttle({ default: { limit: 3, ttl: 60_000 } })
+  @Post('resend-confirmation')
+  async resendConfirmation(
+    @Locale() locale: string,
+    @Body() { email, app }: ResendConfirmationDTO,
+    @Headers('origin') origin: string,
+  ) {
+    return this.service.resendEmailConfirmation(locale, email, app, origin);
   }
 
   @Public()
@@ -184,6 +221,7 @@ export class AuthController {
     @Ip() ipAddress: string,
     @Headers('user-agent') userAgent: string,
     @Headers('x-browser-id') browserId: string,
+    @Headers('origin') origin: string,
     @Res({ passthrough: true }) res,
   ) {
     const { accessToken, refreshToken, session, requiresPasswordReset } = await this.service.verifyMfaRecoveryCode(
@@ -193,6 +231,7 @@ export class AuthController {
       ipAddress,
       userAgent,
       browserId || null,
+      origin,
     );
 
     await this.token.setRefreshTokenCookie(locale, res, refreshToken, session.expires_at);

package/src/auth/auth.module.ts

@@ -15,6 +15,7 @@ import { SessionModule } from '../session/session.module';
 import { SettingModule } from '../setting/setting.module';
 import { TokenModule } from '../token/token.module';
 import { TokenService } from '../token/token.service';
+import { UserDeviceModule } from '../user-device/user-device.module';
 import { UserModule } from '../user/user.module';
 import { AuthController } from './auth.controller';
 import { AuthService } from './auth.service';
@@ -77,6 +78,7 @@ import { AuthGuard } from './guards/auth.guard';
     forwardRef(() => TokenModule),
     forwardRef(() => ChallengeModule),
     forwardRef(() => SessionModule),
+    forwardRef(() => UserDeviceModule),
     ConfigModule,
     HttpModule,
   ],

package/src/auth/auth.service.spec.ts

@@ -10,13 +10,19 @@ jest.mock('speakeasy', () => ({
   totp: { verify: (...args: any[]) => speakeasyVerify(...args) },
 }));
 
+import { localeStorage } from '@hed-hog/api-locale';
 import { AuthService } from './auth.service';
 
 const makeDeps = () => {
   const prisma = {
     user: { update: jest.fn(), findUnique: jest.fn(), findFirst: jest.fn() },
     user_credential: { findFirst: jest.fn(), updateMany: jest.fn() },
-    user_identifier: { findFirst: jest.fn(), findMany: jest.fn() },
+    user_identifier: {
+      findFirst: jest.fn(),
+      findMany: jest.fn(),
+      findUnique: jest.fn(),
+      update: jest.fn(),
+    },
     user_identifier_challenge: {
       create: jest.fn(),
       findUnique: jest.fn(),
@@ -29,8 +35,17 @@ const makeDeps = () => {
     role: { findMany: jest.fn() },
     $transaction: jest.fn(),
   };
-  const mail = { sendTemplatedMail: jest.fn().mockResolvedValue(undefined) };
-  const setting = { getSettingValues: jest.fn() };
+  const mail = {
+    sendTemplatedMail: jest.fn().mockResolvedValue(undefined),
+    // Idempotente por contrato: sem preferencia gravada, devolve o que veio.
+    resolveRecipientLocale: jest.fn(async (_email: string, locale?: string) => locale ?? 'en'),
+  };
+  const setting = {
+    getSettingValues: jest.fn(),
+    getUserSettingValue: jest.fn(async () => null),
+    getSettingListValues: jest.fn(async () => ['en', 'pt']),
+    setSettingUserValue: jest.fn(async () => ({})),
+  };
   const security = {
     generateCode: jest.fn(),
     hashWithPepper: jest.fn(),
@@ -44,6 +59,7 @@ const makeDeps = () => {
     decodeExpiredToken: jest.fn(),
     createMfaChallengeToken: jest.fn(),
     verifyMfaChallengeToken: jest.fn(),
+    verifyEmailConfirmationToken: jest.fn(),
     setRefreshTokenCookie: jest.fn(),
   };
   const session = {
@@ -55,6 +71,7 @@ const makeDeps = () => {
     findUserByEmail: jest.fn(),
     findUserById: jest.fn(),
     registerUserActivity: jest.fn(),
+    createWithEmailAndPassword: jest.fn(),
   };
   const challenge = {
     sendMfaCodeToMultipleEmails: jest.fn(),
@@ -63,8 +80,15 @@ const makeDeps = () => {
     verifyCodePassword: jest.fn(),
     verifyMfaEmailCode: jest.fn(),
     resolveAppKeyFromOrigin: jest.fn().mockResolvedValue(undefined),
+    sendEmailConfirmationLink: jest.fn(),
   };
-  return { prisma, mail, setting, security, token, session, user, challenge };
+  const userDevice = {
+    // Default false: dispositivo conhecido, nenhum alerta — o cenario esperado
+    // pela maioria dos casos, que so verificam o retorno do login.
+    isNewDevice: jest.fn().mockResolvedValue(false),
+    remember: jest.fn().mockResolvedValue(undefined),
+  };
+  return { prisma, mail, setting, security, token, session, user, challenge, userDevice };
 };
 
 const makeService = (deps = makeDeps()) => ({
@@ -77,6 +101,7 @@ const makeService = (deps = makeDeps()) => ({
     deps.session as any,
     deps.user as any,
     deps.challenge as any,
+    deps.userDevice as any,
   ),
   deps,
 });
@@ -330,6 +355,284 @@ describe('AuthService', () => {
     });
   });
 
+  describe('signupWithEmailAndPassword', () => {
+    const createdUser = { id: 9, name: 'Aluno Novo' };
+
+    it('com require-email-verification ligada, não emite sessão nem seta cookie', async () => {
+      const { service, deps } = makeService();
+      deps.user.createWithEmailAndPassword.mockResolvedValue({ user: createdUser });
+      deps.setting.getSettingValues.mockResolvedValue({
+        'require-email-verification': true,
+      });
+
+      const result = await service.signupWithEmailAndPassword(
+        {},
+        'pt-BR',
+        '1.1.1.1',
+        'UA',
+        { email: 'aluno@example.com', name: 'Aluno Novo', password: 'Sup3r$ecret' } as any,
+      );
+
+      expect(result).toEqual({ user: createdUser, hasChallenge: true });
+      expect(deps.token.setRefreshTokenCookie).not.toHaveBeenCalled();
+      expect(deps.token.createAccessToken).not.toHaveBeenCalled();
+    });
+
+    it('com require-email-verification desligada, cadastra já autenticado', async () => {
+      const { service, deps } = makeService();
+      deps.user.createWithEmailAndPassword.mockResolvedValue({ user: createdUser });
+      deps.setting.getSettingValues.mockResolvedValue({
+        'require-email-verification': false,
+      });
+      deps.prisma.user_identifier.findMany.mockResolvedValue([
+        { value: 'aluno@example.com' },
+      ]);
+      deps.session.create.mockResolvedValue({
+        token: 'refresh-9',
+        session: { id: 9, expires_at: new Date('2026-01-02') },
+      });
+      deps.token.createAccessToken.mockResolvedValue('access-9');
+
+      const result = await service.signupWithEmailAndPassword(
+        {},
+        'pt-BR',
+        '1.1.1.1',
+        'UA',
+        { email: 'aluno@example.com', name: 'Aluno Novo', password: 'Sup3r$ecret' } as any,
+      );
+
+      expect(deps.token.setRefreshTokenCookie).toHaveBeenCalled();
+      expect(result).toEqual({
+        user: createdUser,
+        hasChallenge: false,
+        accessToken: 'access-9',
+        refreshToken: 'refresh-9',
+        requiresPasswordReset: false,
+      });
+    });
+  });
+
+  describe('resendEmailConfirmation', () => {
+    it('reenvia o link quando encontra o usuário pelo e-mail', async () => {
+      const { service, deps } = makeService();
+      deps.user.findUserByEmail.mockResolvedValue({ id: 4 });
+
+      const result = await service.resendEmailConfirmation(
+        'pt-BR',
+        'aluno@example.com',
+        'class',
+        'https://class.hcode.com.br',
+      );
+
+      expect(deps.challenge.sendEmailConfirmationLink).toHaveBeenCalledWith(
+        'pt-BR',
+        4,
+        'aluno@example.com',
+        'class',
+        'https://class.hcode.com.br',
+      );
+      expect(result).toEqual({ sent: true });
+    });
+
+    it('responde sent:true mesmo sem encontrar o e-mail (evita enumeração)', async () => {
+      const { service, deps } = makeService();
+      deps.user.findUserByEmail.mockResolvedValue(null);
+
+      const result = await service.resendEmailConfirmation('pt-BR', 'inexistente@example.com');
+
+      expect(deps.challenge.sendEmailConfirmationLink).not.toHaveBeenCalled();
+      expect(result).toEqual({ sent: true });
+    });
+
+    it('responde sent:true mesmo quando o envio falha (ex.: e-mail já verificado)', async () => {
+      const { service, deps } = makeService();
+      deps.user.findUserByEmail.mockResolvedValue({ id: 4 });
+      deps.challenge.sendEmailConfirmationLink.mockRejectedValue(
+        new NotFoundException('already verified'),
+      );
+
+      const result = await service.resendEmailConfirmation('pt-BR', 'aluno@example.com');
+
+      expect(result).toEqual({ sent: true });
+    });
+  });
+
+  describe('alerta de dispositivo novo', () => {
+    // Login simples, sem MFA nem verificação de e-mail: o caminho que chega em
+    // login() e decide se manda o alerta.
+    const arrangeLogin = (deps: any, identifiers = [{ value: 'a@b.com' }]) => {
+      deps.user.findUserByEmail.mockResolvedValue({
+        id: 1,
+        name: 'John',
+        user_credential: [{ type: 'password' }],
+        user_identifier: [{ type: 'email', value: 'a@b.com', verified_at: new Date() }],
+      });
+      deps.security.validatePassword.mockResolvedValue(true);
+      deps.prisma.user_mfa.findMany.mockResolvedValue([]);
+      deps.setting.getSettingValues.mockResolvedValue({
+        'require-mfa': false,
+        'require-email-verification': false,
+      });
+      deps.prisma.user_identifier.findMany.mockResolvedValue(identifiers);
+      deps.session.create.mockResolvedValue({
+        token: 'refresh-1',
+        session: { id: 1, expires_at: new Date('2026-01-02') },
+      });
+      deps.token.createAccessToken.mockResolvedValue('access-1');
+    };
+
+    const doLogin = (service: any) =>
+      service.loginWithEmailAndPassword({}, 'pt', '8.8.8.8', 'UA', {
+        email: 'a@b.com',
+        password: 'right',
+      } as any);
+
+    it('não avisa quando o dispositivo já é conhecido', async () => {
+      const { service, deps } = makeService();
+      arrangeLogin(deps);
+      deps.userDevice.isNewDevice.mockResolvedValue(false);
+
+      await doLogin(service);
+
+      expect(deps.mail.sendTemplatedMail).not.toHaveBeenCalled();
+    });
+
+    it('avisa quando o dispositivo é desconhecido', async () => {
+      const { service, deps } = makeService();
+      arrangeLogin(deps);
+      deps.userDevice.isNewDevice.mockResolvedValue(true);
+
+      await doLogin(service);
+
+      expect(deps.userDevice.isNewDevice).toHaveBeenCalledWith(1, 'UA', undefined);
+      expect(deps.mail.sendTemplatedMail).toHaveBeenCalledTimes(1);
+      const [locale, payload] = deps.mail.sendTemplatedMail.mock.calls[0] as any[];
+      expect(locale).toBe('pt');
+      expect(payload.slug).toBe('auth-login-new-device');
+      expect(payload.email).toBe('a@b.com');
+      // Enriquecimento: nada de "Unknown" literal, e o UA cru vira browser/os.
+      expect(payload.variables).toMatchObject({ name: 'John', ipAddress: '8.8.8.8' });
+      expect(payload.variables.datetime).toEqual(expect.any(String));
+      expect(payload.variables.location).not.toBe('Unknown');
+    });
+
+    it('avisa só o e-mail usado no login, não todos os identificadores', async () => {
+      const { service, deps } = makeService();
+      arrangeLogin(deps, [{ value: 'secundario@b.com' }, { value: 'a@b.com' }]);
+      deps.userDevice.isNewDevice.mockResolvedValue(true);
+
+      await doLogin(service);
+
+      expect(deps.mail.sendTemplatedMail).toHaveBeenCalledTimes(1);
+      expect((deps.mail.sendTemplatedMail.mock.calls[0] as any[])[1].email).toBe('a@b.com');
+    });
+
+    // O idioma e aprendido no mesmo funil do dispositivo. Write-once: um login
+    // de aparelho emprestado nao pode apagar a escolha feita nas preferencias.
+    describe('preferencia de idioma detectada', () => {
+      // `detected` so e verdadeiro quando o cliente mandou um idioma suportado.
+      const loginWithDetectedLocale = (service: any, detected: boolean) =>
+        localeStorage.run({ locale: 'pt', detected }, () =>
+          service.loginWithEmailAndPassword({}, 'pt', '8.8.8.8', 'UA', {
+            email: 'a@b.com',
+            password: 'right',
+          } as any),
+        );
+
+      it('grava o idioma do cliente quando o usuario ainda nao tem preferencia', async () => {
+        const { service, deps } = makeService();
+        arrangeLogin(deps);
+        deps.userDevice.isNewDevice.mockResolvedValue(false);
+
+        await loginWithDetectedLocale(service, true);
+
+        expect(deps.setting.setSettingUserValue).toHaveBeenCalledWith(
+          'pt', 1, 'language', 'pt',
+        );
+      });
+
+      it('nao sobrescreve a preferencia ja escolhida pelo usuario', async () => {
+        const { service, deps } = makeService();
+        arrangeLogin(deps);
+        deps.userDevice.isNewDevice.mockResolvedValue(false);
+        deps.setting.getUserSettingValue.mockResolvedValue('en');
+
+        await loginWithDetectedLocale(service, true);
+
+        expect(deps.setting.setSettingUserValue).not.toHaveBeenCalled();
+      });
+
+      // Sem esta guarda, todo cliente que nao manda `Accept-Language` (o app
+      // mobile, cron, curl) congelaria o default `en` como preferencia.
+      it('nao grava quando o cliente nao declarou idioma', async () => {
+        const { service, deps } = makeService();
+        arrangeLogin(deps);
+        deps.userDevice.isNewDevice.mockResolvedValue(false);
+
+        await loginWithDetectedLocale(service, false);
+
+        expect(deps.setting.setSettingUserValue).not.toHaveBeenCalled();
+      });
+
+      // `setSettingUserValue` valida override, nao o valor: sem esta checagem
+      // um navegador em `de-DE` gravaria um idioma sem template nenhum.
+      it('nao grava idioma fora das opcoes da setting', async () => {
+        const { service, deps } = makeService();
+        arrangeLogin(deps);
+        deps.userDevice.isNewDevice.mockResolvedValue(false);
+
+        await localeStorage.run({ locale: 'de', detected: true }, () =>
+          service.loginWithEmailAndPassword({}, 'de', '8.8.8.8', 'UA', {
+            email: 'a@b.com',
+            password: 'right',
+          } as any),
+        );
+
+        expect(deps.setting.setSettingUserValue).not.toHaveBeenCalled();
+      });
+
+      it('nao derruba o login quando a gravacao falha', async () => {
+        const { service, deps } = makeService();
+        arrangeLogin(deps);
+        deps.userDevice.isNewDevice.mockResolvedValue(false);
+        deps.setting.setSettingUserValue.mockRejectedValue(new Error('db down'));
+
+        await expect(loginWithDetectedLocale(service, true)).resolves.toEqual(
+          expect.objectContaining({ accessToken: 'access-1' }),
+        );
+      });
+    });
+
+    it('checa o dispositivo antes de registrá-lo', async () => {
+      const { service, deps } = makeService();
+      arrangeLogin(deps);
+
+      await doLogin(service);
+
+      // Invertido, o registro do login atual faria todo login parecer conhecido.
+      expect(deps.userDevice.isNewDevice.mock.invocationCallOrder[0]).toBeLessThan(
+        deps.userDevice.remember.mock.invocationCallOrder[0],
+      );
+    });
+
+    it('registra o dispositivo em getAuthenticationPayload, valendo para todo caminho de login', async () => {
+      const { service, deps } = makeService();
+      deps.session.create.mockResolvedValue({
+        token: 'refresh-1',
+        session: { id: 1, expires_at: new Date('2026-01-02') },
+      });
+      deps.token.createAccessToken.mockResolvedValue('access-1');
+
+      await service.getAuthenticationPayload('pt', 7, '8.8.8.8', 'UA', 'browser-9');
+
+      expect(deps.userDevice.remember).toHaveBeenCalledWith(7, {
+        userAgent: 'UA',
+        browserId: 'browser-9',
+        ipAddress: '8.8.8.8',
+      });
+    });
+  });
+
   describe('verifyRoles / verifyUser', () => {
     it('verifyRoles delega para prisma.role.findMany', async () => {
       const { service, deps } = makeService();
@@ -830,7 +1133,7 @@ describe('AuthService', () => {
       deps.prisma.user_identifier_challenge.findUnique.mockResolvedValue({
         hash: 'matching-hash',
         user_identifier_id: 2,
-        user_identifier: { user_id: 9 },
+        user_identifier: { user_id: 9, value: 'a@b.com' },
       });
       deps.security.hashWithPepper.mockReturnValue('matching-hash');
       deps.prisma.$transaction.mockImplementation(async (cb: any) =>
@@ -886,8 +1189,82 @@ describe('AuthService', () => {
         where: { type: 'password', user_id: 1 },
         data: { hash: 'new-hash', requires_reset: false },
       });
-      expect(deps.user.registerUserActivity).toHaveBeenCalledWith(2, 'resetPassword');
+      // user_id (1), não o id do identificador (2): a atividade é do usuário.
+      expect(deps.user.registerUserActivity).toHaveBeenCalledWith(1, 'resetPassword');
       expect(result.accessToken).toBe('access-8');
     });
   });
+
+  describe('confirmEmail', () => {
+    const identifier = {
+      id: 42,
+      user_id: 7,
+      value: 'a@b.com',
+      verified_at: null,
+      user: { id: 7, name: 'Bob' },
+    };
+
+    it('marca o e-mail como verificado e não cria sessão', async () => {
+      const { service, deps } = makeService();
+      deps.token.verifyEmailConfirmationToken.mockResolvedValue({
+        userIdentifierId: 42,
+      });
+      deps.prisma.user_identifier.findUnique.mockResolvedValue(identifier);
+
+      const result = await service.confirmEmail('pt-BR', 'tok');
+
+      expect(deps.prisma.user_identifier.update).toHaveBeenCalledWith({
+        where: { id: 42 },
+        data: { verified_at: expect.any(Date), enabled: true },
+      });
+      expect(deps.user.registerUserActivity).toHaveBeenCalledWith(7, 'confirmEmail');
+      expect(deps.session.create).not.toHaveBeenCalled();
+      expect(result).toEqual({
+        confirmed: true,
+        alreadyConfirmed: false,
+        email: 'a@b.com',
+        name: 'Bob',
+      });
+    });
+
+    it('segundo clique no link responde "já confirmado" em vez de erro', async () => {
+      const { service, deps } = makeService();
+      deps.token.verifyEmailConfirmationToken.mockResolvedValue({
+        userIdentifierId: 42,
+      });
+      deps.prisma.user_identifier.findUnique.mockResolvedValue({
+        ...identifier,
+        verified_at: new Date('2026-01-01T00:00:00Z'),
+      });
+
+      const result = await service.confirmEmail('pt-BR', 'tok');
+
+      expect(result.alreadyConfirmed).toBe(true);
+      expect(deps.prisma.user_identifier.update).not.toHaveBeenCalled();
+    });
+
+    it('propaga a recusa de token inválido, expirado ou de outro propósito', async () => {
+      const { service, deps } = makeService();
+      deps.token.verifyEmailConfirmationToken.mockRejectedValue(
+        new BadRequestException('invalid'),
+      );
+
+      await expect(service.confirmEmail('pt-BR', 'tok')).rejects.toThrow(
+        BadRequestException,
+      );
+      expect(deps.prisma.user_identifier.update).not.toHaveBeenCalled();
+    });
+
+    it('lança BadRequest quando o identificador do token não existe mais', async () => {
+      const { service, deps } = makeService();
+      deps.token.verifyEmailConfirmationToken.mockResolvedValue({
+        userIdentifierId: 42,
+      });
+      deps.prisma.user_identifier.findUnique.mockResolvedValue(null);
+
+      await expect(service.confirmEmail('pt-BR', 'tok')).rejects.toThrow(
+        BadRequestException,
+      );
+    });
+  });
 });