@hed-hog/core 0.0.399 → 0.0.401

package/src/ai-instruction/ai-instruction.service.ts

@@ -14,6 +14,7 @@ import {
 import { randomUUID } from 'node:crypto';
 import { DeleteDTO } from '../dto/delete.dto';
 import { createRedisPubSub, type RedisPubSub } from '../redis/redis-pubsub';
+import { AI_INSTRUCTION_SORT } from './ai-instruction.sort';
 import {
   type AiPromptDefinition,
   getAiPromptDefinition,
@@ -468,44 +469,47 @@ export class AiInstructionService implements OnModuleInit, OnModuleDestroy {
   async list(paginationParams: PaginationDTO, filters?: AiInstructionListFilters) {
     const page = Math.max(Number(paginationParams?.page || 1), 1);
     const pageSize = Math.min(Math.max(Number(paginationParams?.pageSize || 20), 1), 100);
-    const offset = (page - 1) * pageSize;
+    const skip = (page - 1) * pageSize;
     const search = String(paginationParams?.search || '').trim();
 
-    const conditions: Prisma.Sql[] = [];
+    const where: Prisma.ai_instructionWhereInput = {};
 
     if (search) {
-      conditions.push(
-        Prisma.sql`(LOWER(slug) LIKE LOWER(${`%${search}%`}) OR LOWER(name) LIKE LOWER(${`%${search}%`}))`,
-      );
+      where.OR = [
+        { slug: { contains: search, mode: 'insensitive' } },
+        { name: { contains: search, mode: 'insensitive' } },
+      ];
     }
     if (filters?.layer) {
-      conditions.push(Prisma.sql`layer = CAST(${filters.layer} AS ai_instruction_layer_enum)`);
+      where.layer = filters.layer;
     }
     if (filters?.module_slug) {
-      conditions.push(Prisma.sql`module_slug = ${filters.module_slug}`);
+      where.module_slug = filters.module_slug;
     }
     if (filters?.is_active !== undefined) {
-      conditions.push(Prisma.sql`is_active = ${filters.is_active}`);
-    }
-
-    const whereClause = conditions.length
-      ? Prisma.sql`WHERE ${Prisma.join(conditions, ' AND ')}`
-      : Prisma.empty;
-
-    const data = await this.prisma.$queryRaw<AiInstructionRecord[]>(Prisma.sql`
-      SELECT ${INSTRUCTION_COLUMNS}
-      FROM ai_instruction
-      ${whereClause}
-      ORDER BY layer, slug
-      LIMIT ${pageSize}
-      OFFSET ${offset}
-    `);
-
-    const totalResult = await this.prisma.$queryRaw<Array<{ total: bigint }>>(Prisma.sql`
-      SELECT COUNT(*) AS total FROM ai_instruction ${whereClause}
-    `);
-
-    const total = Number(totalResult?.[0]?.total || 0);
+      where.is_active = filters.is_active;
+    }
+
+    const [rows, total] = await Promise.all([
+      this.prisma.ai_instruction.findMany({
+        where,
+        orderBy: AI_INSTRUCTION_SORT.toPrismaOrderBy(paginationParams),
+        skip,
+        take: pageSize,
+      }),
+      this.prisma.ai_instruction.count({ where }),
+    ]);
+
+    // `$queryRaw` cast `temperature::float8` explicitly (Decimal serializes as
+    // string otherwise and breaks `AiInstructionRecord.temperature: number`).
+    // `variables_schema` is `jsonb`; Prisma types it as the general `JsonValue`
+    // union, but this column only ever stores an object (or null) — same as
+    // the raw-SQL path, which returned it already parsed.
+    const data: AiInstructionRecord[] = rows.map((row) => ({
+      ...row,
+      temperature: row.temperature === null ? null : Number(row.temperature),
+      variables_schema: row.variables_schema as Record<string, any> | null,
+    }));
 
     return {
       data,

package/src/ai-instruction/ai-instruction.sort.ts

@@ -0,0 +1,32 @@
+import { defineSortable } from '@hed-hog/api-pagination';
+
+/**
+ * Campos ordenáveis de `ai_instruction` (`AiInstructionService.list`).
+ *
+ * `model`/`temperature`/`max_tokens` (coluna "Parâmetros" da tela, concatenados
+ * em `renderModelParams`) e o estado calculado a partir do registry + flags
+ * (coluna "Estado") ficam de fora: nenhum dos dois é uma coluna única — não há
+ * como declarar um `orderBy` que corresponda ao que a célula mostra.
+ *
+ * Desempate: o `$queryRaw` antigo tinha `ORDER BY layer, slug` fixo (as duas
+ * sempre ascendentes, sem opção de inverter). O default abaixo reproduz isso
+ * com `default: 'layer', defaultOrder: 'asc'` e `tiebreaker: 'slug'` fixado em
+ * `'asc'` (em vez do `id` padrão do `defineSortable`) — mais fiel ao
+ * comportamento anterior do que cair no id como desempate.
+ */
+export const AI_INSTRUCTION_SORT = defineSortable(
+  {
+    slug: true,
+    name: true,
+    layer: true,
+    module_slug: true,
+    version: true,
+    updated_at: { initialOrder: 'desc' },
+  },
+  {
+    default: 'layer',
+    defaultOrder: 'asc',
+    tiebreaker: 'slug',
+    tiebreakerOrder: 'asc',
+  },
+);

package/src/ai-instruction/ai-prompt-resolver.service.spec.ts

@@ -2,6 +2,7 @@ import {
   applyClaudeModelParams,
   applyGeminiModelParams,
   applyOpenAiModelParams,
+  applyOpenAiResponsesParams,
   AiPromptResolverService,
   mergeModelParams,
   type ResolvedPrompt,
@@ -279,6 +280,49 @@ describe('mergeModelParams', () => {
   });
 });
 
+describe('applyOpenAiResponsesParams', () => {
+  const input = [{ role: 'user', content: [{ type: 'input_text', text: 'oi' }] }];
+
+  it('não adiciona nada quando o registro e os defaults estão vazios', () => {
+    const body = applyOpenAiResponsesParams({ input }, resolved(), {
+      model: 'gpt-4o',
+    });
+
+    expect(body).toEqual({ model: 'gpt-4o', input });
+  });
+
+  // Os três renames do endpoint moram só nesta função.
+  it('usa max_output_tokens, nunca max_tokens', () => {
+    const body = applyOpenAiResponsesParams({ input }, resolved({ maxTokens: 500 }), {
+      model: 'gpt-4o',
+    });
+
+    expect(body.max_output_tokens).toBe(500);
+    expect(body).not.toHaveProperty('max_tokens');
+    expect(body).not.toHaveProperty('max_completion_tokens');
+  });
+
+  it('põe o json_object sob text.format', () => {
+    const body = applyOpenAiResponsesParams({ input }, resolved(), {
+      model: 'gpt-4o',
+      jsonObject: true,
+    });
+
+    expect(body.text).toEqual({ format: { type: 'json_object' } });
+    expect(body).not.toHaveProperty('response_format');
+  });
+
+  it('o modelo do registro vence o default do código', () => {
+    const body = applyOpenAiResponsesParams(
+      { input },
+      resolved({ model: 'gpt-4.1', temperature: 0.3 }),
+      { model: 'gpt-4o' },
+    );
+
+    expect(body).toMatchObject({ model: 'gpt-4.1', temperature: 0.3 });
+  });
+});
+
 describe('applyOpenAiModelParams', () => {
   const messages = [{ role: 'user', content: 'oi' }];
 

package/src/ai-instruction/ai-prompt-resolver.service.ts

@@ -255,6 +255,35 @@ export function applyOpenAiModelParams(
   return result;
 }
 
+/**
+ * Same as `applyOpenAiModelParams`, but for `POST /v1/responses`.
+ *
+ * That endpoint renames three things, and this is the single place the rename
+ * lives: the messages array is `input`, `max_tokens` is `max_output_tokens`,
+ * and `response_format` moved under `text.format`. The system prompt is not a
+ * message either — it is the top-level `instructions`, handled by the caller.
+ *
+ * Same contract as the sibling: a key is only written when there is a value, so
+ * a body built with no params stays exactly `{ model, input }`.
+ */
+export function applyOpenAiResponsesParams(
+  body: Record<string, unknown>,
+  params: ModelParams,
+  defaults: OpenAiParamDefaults,
+): Record<string, unknown> {
+  const model = params.model || defaults.model;
+  const temperature = params.temperature ?? defaults.temperature;
+  const maxTokens = params.maxTokens ?? defaults.maxTokens;
+
+  const result: Record<string, unknown> = { model, ...body };
+
+  if (temperature != null) result.temperature = temperature;
+  if (maxTokens != null) result.max_output_tokens = maxTokens;
+  if (defaults.jsonObject) result.text = { format: { type: 'json_object' } };
+
+  return result;
+}
+
 export function applyGeminiModelParams(
   payload: Record<string, unknown>,
   params: ModelParams,

package/src/auth/auth.module.ts

@@ -8,6 +8,7 @@ import { JwtModule } from '@nestjs/jwt';
 import cookieParser from 'cookie-parser';
 import { ChallengeModule } from '../challenge/challenge.module';
 import { ChallengeService } from '../challenge/challenge.service';
+import { OAuthMetadataService } from '../authorize/oauth-metadata.service';
 import { MailSentModule } from '../mail-sent/mail-sent.module';
 import { MailModule } from '../mail/mail.module';
 import { SecurityModule } from '../security/security.module';
@@ -88,12 +89,18 @@ import { AuthGuard } from './guards/auth.guard';
     AuthService,
     TokenService,
     ChallengeService,
+    // Declarado aqui, e nao em AuthorizeModule (onde o arquivo mora), porque o
+    // AuthGuard abaixo e um APP_GUARD deste modulo: um provider de outro modulo
+    // so seria resolvido importando AuthorizeModule, que por sua vez importa
+    // AuthModule — circulo. Como este modulo e @Global, exportar aqui atende
+    // tambem o McpAuthGuard, sem ninguem precisar importar nada.
+    OAuthMetadataService,
     {
       provide: APP_GUARD,
       useClass: AuthGuard,
     },
   ],
-  exports: [AuthService],
+  exports: [AuthService, OAuthMetadataService],
 })
 export class AuthModule {
   configure(consumer: MiddlewareConsumer) {

package/src/auth/auth.service.spec.ts

@@ -63,6 +63,7 @@ const makeDeps = () => {
     setRefreshTokenCookie: jest.fn(),
   };
   const session = {
+    peekByRefreshToken: jest.fn<any>().mockResolvedValue({ id: 2, user_id: 9, audience: null, oauth_client_id: null, revoked_at: null, expires_at: new Date('2099-01-01') }),
     create: jest.fn(),
     refresh: jest.fn(),
     deleteRefreshTokenCookie: jest.fn(),
@@ -120,7 +121,7 @@ describe('AuthService', () => {
 
       const result = await service.getAuthenticationPayload('pt-BR', 1, '1.2.3.4', 'UA', 'browser-1');
 
-      expect(deps.session.create).toHaveBeenCalledWith('pt-BR', 1, '1.2.3.4', 'UA', 'browser-1');
+      expect(deps.session.create).toHaveBeenCalledWith('pt-BR', 1, '1.2.3.4', 'UA', 'browser-1', undefined);
       expect(deps.prisma.user.update).toHaveBeenCalledWith({
         where: { id: 1 },
         data: { last_login_at: expect.any(Date) },
@@ -202,6 +203,37 @@ describe('AuthService', () => {
       ).rejects.toThrow(BadRequestException);
     });
 
+    it('recusa a senha de credencial revogada', async () => {
+      // A revogação é o que o convite de acesso enterprise usa para trocar
+      // "autorize o acesso" por "crie sua conta e defina a senha"
+      // (`notifyAdminAccess` com `resetPassword`). Antes deste filtro, o login
+      // ignorava `revoked_at` e a senha antiga continuava entrando — enquanto o
+      // "esqueci minha senha", que sempre exigiu credencial ativa, dizia que a
+      // conta não tinha senha.
+      const { service, deps } = makeService();
+      deps.user.findUserByEmail.mockResolvedValue({
+        id: 1,
+        user_credential: [{ type: 'password', revoked_at: new Date() }],
+        user_identifier: [{ type: 'email', value: 'a@b.com' }],
+      });
+      deps.security.validatePassword.mockResolvedValue(false);
+
+      await expect(
+        service.loginWithEmailAndPassword({}, 'pt-BR', '1.1.1.1', 'UA', {
+          email: 'a@b.com',
+          password: 'a-senha-revogada',
+        } as any),
+      ).rejects.toThrow(BadRequestException);
+
+      // Sem credencial ativa não há o que verificar: a lista chega vazia, e é isso
+      // que garante que nenhum hash revogado é comparado.
+      expect(deps.security.validatePassword).toHaveBeenCalledWith(
+        'pt-BR',
+        [],
+        'a-senha-revogada',
+      );
+    });
+
     it('retorna requiresMfa quando existem métodos MFA verificados, enviando código para emails MFA', async () => {
       const { service, deps } = makeService();
       deps.user.findUserByEmail.mockResolvedValue({
@@ -680,6 +712,81 @@ describe('AuthService', () => {
         session: { id: 2, user_id: 9 },
       });
     });
+
+    // Sem esta recusa, um cliente externo trocaria o refresh token restrito por
+    // uma sessao com acesso a API inteira, e o audience binding nao valeria nada.
+    it('recusa renovar uma sessao de conector (com audience)', async () => {
+      const { service, deps } = makeService();
+      deps.session.peekByRefreshToken.mockResolvedValue({
+        id: 2,
+        user_id: 9,
+        audience: 'https://hub-api.example.com/mcp',
+        oauth_client_id: 'claude-connector',
+        revoked_at: null,
+        expires_at: new Date('2099-01-01'),
+      });
+
+      await expect(
+        service.refreshAccessToken('pt-BR', 'connector-refresh', '1.1.1.1', 'UA'),
+      ).rejects.toThrow(UnauthorizedException);
+
+      expect(deps.token.createAccessToken).not.toHaveBeenCalled();
+    });
+
+    /**
+     * REGRESSAO: a recusa acontecia DEPOIS de session.refresh(), que ja commitou
+     * o compare-and-swap — o cliente ficava com um token morto em 30s e sem
+     * substituto. Negar um pedido nao pode destruir a sessao.
+     */
+    it('nao gira o refresh token quando vai recusar', async () => {
+      const { service, deps } = makeService();
+      deps.session.peekByRefreshToken.mockResolvedValue({
+        id: 2,
+        user_id: 9,
+        audience: 'https://hub-api.example.com/mcp',
+        oauth_client_id: 'claude-connector',
+        revoked_at: null,
+        expires_at: new Date('2099-01-01'),
+      });
+
+      await expect(
+        service.refreshAccessToken('pt-BR', 'connector-refresh', '1.1.1.1', 'UA'),
+      ).rejects.toThrow(UnauthorizedException);
+
+      expect(deps.session.refresh).not.toHaveBeenCalled();
+    });
+  });
+
+  describe('getAuthenticationPayload - fluxo OAuth com resource', () => {
+    it('emite aud, iss, scope e cid e marca a sessao', async () => {
+      const { service, deps } = makeService();
+      deps.session.create.mockResolvedValue({
+        token: 'refresh-token',
+        session: { id: 5, expires_at: new Date('2026-01-02') },
+      });
+      deps.token.createAccessToken.mockResolvedValue('access-token');
+
+      await service.getAuthenticationPayload('pt-BR', 1, '1.2.3.4', 'UA', null, {
+        audience: 'https://hub-api.example.com/mcp',
+        scope: 'mcp',
+        clientId: 'claude-connector',
+        issuer: 'https://hub-api.example.com',
+        ttlMinutes: 10080,
+      });
+
+      expect(deps.token.createAccessToken).toHaveBeenCalledWith({
+        sub: 1,
+        sessionId: 5,
+        aud: 'https://hub-api.example.com/mcp',
+        iss: 'https://hub-api.example.com',
+        scope: 'mcp',
+        cid: 'claude-connector',
+      });
+      expect(deps.session.create).toHaveBeenCalledWith(
+        'pt-BR', 1, '1.2.3.4', 'UA', null,
+        { audience: 'https://hub-api.example.com/mcp', clientId: 'claude-connector', ttlMinutes: 10080 },
+      );
+    });
   });
 
   describe('forgotPassword / logout', () => {

package/src/auth/auth.service.ts

@@ -24,7 +24,7 @@ import { SessionService } from '../session/session.service';
 import { SettingService } from '../setting/setting.service';
 import { TokenService } from '../token/token.service';
 import { UserDeviceService } from '../user-device/user-device.service';
-import { hasPendingPasswordReset } from '../user/user-credential.util';
+import { hasPendingPasswordReset, isActivePasswordCredential } from '../user/user-credential.util';
 import { CreateWithEmailAndPasswordDTO } from '../user/dto/create-with-email-and-password.dto';
 import { UserService } from '../user/user.service';
 import { buildSecurityEventVars } from '../utils/security-event-vars';
@@ -57,9 +57,40 @@ export class AuthService {
     private readonly userDevice: UserDeviceService,
   ) { }
 
-  async getAuthenticationPayload(locale: string, userId: number, ipAddress: string, userAgent: string, browserId?: string | null) {
-    const { token: refreshToken, session } = await this.session.create(locale, userId, ipAddress, userAgent, browserId);
-    const payload = { sub: userId, sessionId: session.id };
+  /**
+   * `oauth` so vem preenchido quando a troca do authorization code pediu um
+   * `resource` (RFC 8707). Nesse caso o access token nasce amarrado aquele
+   * recurso — e o TokenService passa a recusa-lo em qualquer outro lugar. Sem o
+   * parametro, o token e o de sempre: sem `aud`, valido na API inteira.
+   */
+  async getAuthenticationPayload(
+    locale: string,
+    userId: number,
+    ipAddress: string,
+    userAgent: string,
+    browserId?: string | null,
+    oauth?: { audience: string; scope: string; clientId: string; issuer: string; ttlMinutes?: number },
+  ) {
+    const { token: refreshToken, session } = await this.session.create(
+      locale,
+      userId,
+      ipAddress,
+      userAgent,
+      browserId,
+      oauth
+        ? { audience: oauth.audience, clientId: oauth.clientId, ttlMinutes: oauth.ttlMinutes }
+        : undefined,
+    );
+    const payload = oauth
+      ? {
+          sub: userId,
+          sessionId: session.id,
+          aud: oauth.audience,
+          iss: oauth.issuer,
+          scope: oauth.scope,
+          cid: oauth.clientId,
+        }
+      : { sub: userId, sessionId: session.id };
     const accessToken = await this.token.createAccessToken(payload);
     await this.prisma.user.update({ where: { id: userId }, data: { last_login_at: new Date() } });
 
@@ -525,7 +556,11 @@ export class AuthService {
 
     if (!user) throw new BadRequestException(getLocaleText('accessDenied', locale, 'Access denied.'));
 
-    const credentials = (user as unknown as User).user_credential?.filter((c) => c.type === 'password') || [];
+    // Revogada não vale: sem o `revoked_at` aqui, revogar a senha (o que o convite
+    // de acesso enterprise faz para forçar a definição de uma nova) não impedia o
+    // login com a senha antiga. Mesmo critério de `hasPasswordCredential`, que é
+    // o que decide se o "esqueci minha senha" pode seguir.
+    const credentials = (user as unknown as User).user_credential?.filter(isActivePasswordCredential) || [];
 
     const identifier = user.user_identifier?.find((i) => i.type === 'email' && i.value === email);
 
@@ -692,6 +727,13 @@ export class AuthService {
     };
   }
 
+  /**
+   * POST /auth/refresh e publico e devolve um token SEM `aud`. Se aceitasse o
+   * refresh token de um conector, o cliente externo trocaria seu token restrito
+   * por uma sessao com acesso a API inteira e todo o audience binding viraria
+   * enfeite. A renovacao dele e o grant_type=refresh_token do /auth/token, que
+   * reaplica o `aud`.
+   */
   async refreshAccessToken(locale: string, refreshToken: string, ipAddress: string, userAgent: string, browserId?: string | null) {
 
     if (!refreshToken) {
@@ -701,6 +743,18 @@ export class AuthService {
 
     this.logger.debug(`[AuthService] refreshAccessToken ip=${ipAddress} ua=${userAgent?.slice(0, 40)}`);
 
+    // ANTES de girar. `session.refresh()` commita a rotacao assim que roda, com
+    // apenas 30s de graca para o token anterior — recusar depois dela deixaria o
+    // cliente sem o token novo e com o antigo prestes a morrer, ou seja,
+    // destruiria a sessao em vez de negar o pedido.
+    const existing = await this.session.peekByRefreshToken(refreshToken);
+    if (existing?.audience) {
+      this.logger.warn(
+        `[AuthService] refreshAccessToken rejected: sessionId=${existing.id} userId=${existing.user_id} belongs to resource ${existing.audience}`,
+      );
+      throw new UnauthorizedException(getLocaleText('accessDenied', locale, 'Access denied.'));
+    }
+
     const { session, token } = await this.session.refresh(
       locale,
       refreshToken,

package/src/auth/guards/auth.guard.ts

@@ -11,6 +11,7 @@ import {
 import { Reflector } from '@nestjs/core';
 import { Request } from 'express';
 import { ALLOW_MCP_TOKEN } from '../../mcp/decorators/allow-mcp-token.decorator';
+import { OAuthMetadataService } from '../../authorize/oauth-metadata.service';
 import { SecurityService } from '../../security/security.service';
 import { TokenService } from '../../token/token.service';
 
@@ -23,6 +24,7 @@ export class AuthGuard implements CanActivate {
     private reflector: Reflector,
     private prisma: PrismaService,
     private security: SecurityService,
+    private oauthMetadata: OAuthMetadataService,
   ) { }
 
   async canActivate(context: ExecutionContext): Promise<boolean> {
@@ -89,7 +91,13 @@ export class AuthGuard implements CanActivate {
     }
 
     try {
-      const payload = await this.token.verify(locale, token);
+      // So o /mcp e um "recurso" com audiencia propria. Em todo o resto o terceiro
+      // argumento fica ausente de proposito: e a ausencia que faz um token de
+      // conector ser recusado no REST.
+      const allowedAudience = allowMcpToken
+        ? await this.oauthMetadata.getMcpResource()
+        : undefined;
+      const payload = await this.token.verify(locale, token, allowedAudience);
 
       request['auth'] = payload;
     } catch (error) {