@omnizap-system/omnizap 2.5.12

package/server/auth/jwt/webJwtService.js

@@ -0,0 +1,147 @@
+import jwt from 'jsonwebtoken';
+
+const parseEnvBool = (value, fallback = false) => {
+  if (value === undefined || value === null || value === '') return fallback;
+  const normalized = String(value).trim().toLowerCase();
+  if (['1', 'true', 'yes', 'y', 'on'].includes(normalized)) return true;
+  if (['0', 'false', 'no', 'n', 'off'].includes(normalized)) return false;
+  return fallback;
+};
+
+const clampInt = (value, fallback, min, max) => {
+  const parsed = Number(value);
+  if (!Number.isFinite(parsed)) return fallback;
+  return Math.max(min, Math.min(max, Math.floor(parsed)));
+};
+
+const WEB_AUTH_JWT_SECRET = String(process.env.WEB_AUTH_JWT_SECRET || '').trim();
+const WEB_AUTH_JWT_ISSUER = String(process.env.WEB_AUTH_JWT_ISSUER || 'omnizap-system').trim() || 'omnizap-system';
+const WEB_AUTH_JWT_AUDIENCE = String(process.env.WEB_AUTH_JWT_AUDIENCE || 'omnizap-web').trim() || 'omnizap-web';
+const WEB_AUTH_JWT_EXPIRES_IN = String(process.env.WEB_AUTH_JWT_EXPIRES_IN || '7d').trim() || '7d';
+const WEB_AUTH_JWT_DISABLED = parseEnvBool(process.env.WEB_AUTH_JWT_DISABLED, false);
+
+const isNonEmptyString = (value) => typeof value === 'string' && value.trim().length > 0;
+
+const normalizeGoogleSubject = (value) =>
+  String(value || '')
+    .trim()
+    .replace(/[^a-zA-Z0-9_-]/g, '')
+    .slice(0, 80);
+
+const normalizeEmail = (value) =>
+  String(value || '')
+    .trim()
+    .toLowerCase()
+    .slice(0, 255);
+
+const normalizeJid = (value) =>
+  String(value || '')
+    .trim()
+    .toLowerCase()
+    .slice(0, 255);
+
+const normalizeName = (value) =>
+  String(value || '')
+    .trim()
+    .slice(0, 120);
+
+const resolveExpiresIn = ({ expiresInSeconds = null } = {}) => {
+  if (Number.isFinite(Number(expiresInSeconds))) {
+    return clampInt(expiresInSeconds, 60, 60, 60 * 60 * 24 * 365);
+  }
+  return WEB_AUTH_JWT_EXPIRES_IN;
+};
+
+export const isWebAuthJwtEnabled = () => !WEB_AUTH_JWT_DISABLED && isNonEmptyString(WEB_AUTH_JWT_SECRET);
+
+export const extractBearerTokenFromRequest = (req) => {
+  const headerValue = req?.headers?.authorization;
+  if (typeof headerValue !== 'string') return '';
+
+  const trimmed = headerValue.trim();
+  if (!trimmed) return '';
+
+  const [scheme, token] = trimmed.split(/\s+/, 2);
+  if (!scheme || !token) return '';
+  if (scheme.toLowerCase() !== 'bearer') return '';
+
+  return token.trim();
+};
+
+export const signWebAuthJwt = ({ sub = '', sessionToken = '', ownerJid = '', ownerPhone = '', email = '', name = '', authMethod = 'google' } = {}, { expiresInSeconds = null } = {}) => {
+  if (!isWebAuthJwtEnabled()) return '';
+
+  const normalizedSub = normalizeGoogleSubject(sub);
+  const normalizedSessionToken = String(sessionToken || '')
+    .trim()
+    .slice(0, 36);
+  const normalizedOwnerJid = normalizeJid(ownerJid);
+  const normalizedOwnerPhone = String(ownerPhone || '')
+    .trim()
+    .replace(/\D+/g, '')
+    .slice(0, 20);
+  const normalizedEmail = normalizeEmail(email);
+  const normalizedName = normalizeName(name);
+
+  if (!normalizedSub) return '';
+
+  const payload = {
+    sub: normalizedSub,
+    amr:
+      String(authMethod || 'google')
+        .trim()
+        .toLowerCase() || 'google',
+  };
+
+  if (normalizedSessionToken) payload.sid = normalizedSessionToken;
+  if (normalizedOwnerJid) payload.owner_jid = normalizedOwnerJid;
+  if (normalizedOwnerPhone) payload.owner_phone = normalizedOwnerPhone;
+  if (normalizedEmail) payload.email = normalizedEmail;
+  if (normalizedName) payload.name = normalizedName;
+
+  return jwt.sign(payload, WEB_AUTH_JWT_SECRET, {
+    issuer: WEB_AUTH_JWT_ISSUER,
+    audience: WEB_AUTH_JWT_AUDIENCE,
+    expiresIn: resolveExpiresIn({ expiresInSeconds }),
+  });
+};
+
+export const verifyWebAuthJwt = (token) => {
+  if (!isWebAuthJwtEnabled()) return null;
+
+  const rawToken = String(token || '').trim();
+  if (!rawToken) return null;
+
+  try {
+    const decoded = jwt.verify(rawToken, WEB_AUTH_JWT_SECRET, {
+      issuer: WEB_AUTH_JWT_ISSUER,
+      audience: WEB_AUTH_JWT_AUDIENCE,
+    });
+
+    if (!decoded || typeof decoded !== 'object') return null;
+
+    const normalizedSub = normalizeGoogleSubject(decoded.sub);
+    if (!normalizedSub) return null;
+
+    return {
+      sub: normalizedSub,
+      sid: String(decoded.sid || '')
+        .trim()
+        .slice(0, 36),
+      owner_jid: normalizeJid(decoded.owner_jid),
+      owner_phone: String(decoded.owner_phone || '')
+        .replace(/\D+/g, '')
+        .slice(0, 20),
+      email: normalizeEmail(decoded.email),
+      name: normalizeName(decoded.name),
+      amr:
+        String(decoded.amr || '')
+          .trim()
+          .toLowerCase() || 'google',
+      exp: Number(decoded.exp || 0),
+      iat: Number(decoded.iat || 0),
+    };
+  } catch {
+    return null;
+  }
+};

package/server/auth/stickerCatalogAuthContext.js

@@ -0,0 +1,165 @@
+import { createGoogleWebAuthRuntime, normalizeGoogleSubject } from './googleWebAuth/googleWebAuthRuntime.js';
+import { isWebAuthJwtEnabled, signWebAuthJwt, verifyWebAuthJwt } from './jwt/webJwtService.js';
+import userPasswordAuthService from './userPassword/index.js';
+import { createUserPasswordRecoveryService } from './userPassword/userPasswordRecoveryService.js';
+import { createTermsAcceptanceHandler } from './termsAcceptance/termsAcceptanceHandler.js';
+import { createWebAccountAuthHandlers } from './webAccount/webAccountHandlers.js';
+import { parseTermsAcceptancePayload, parseUserPasswordLoginPayload, parseUserPasswordRecoveryRequestPayload, parseUserPasswordRecoveryVerifyPayload, parseUserPasswordUpsertPayload } from './validation/authSchemas.js';
+
+export const createStickerCatalogAuthContext = ({ executeQuery, runSqlTransaction, tables, logger, sendJson, readJsonBody, parseCookies, getCookieValuesFromRequest, appendSetCookie, buildCookieString, normalizeEmail, normalizeJid, sanitizeText, toIsoOrNull, toWhatsAppPhoneDigits, resolveWhatsAppOwnerJidFromLoginPayload, assertGoogleIdentityNotBanned, queueAutomatedEmail, queueWelcomeEmail, resolveRequestRemoteIp, toSiteAbsoluteUrl, listStickerPacksByOwner, listStickerPackEngagementByPackIds, mapPackSummary, isPackPubliclyVisible, resolveMyProfileOwnerCandidates, shouldHidePackFromMyProfileDefault, parseEnvBool, clampInt, userProfileWebPath, userPasswordResetWebPath, passwordRecoverySessionAuthMethod, passwordRecoverySessionTtlSeconds, webSessionCookieName, notAllowedErrorCode, stickerWebGoogleClientId, stickerWebGoogleAuthRequired, stickerWebGoogleSessionTtlMs, stickerApiBasePath, stickerWebPath, stickerLoginWebPath, siteOrigin }) => {
+  const enqueueGoogleWebWelcomeEmail = ({ email, name, ownerJid }) => {
+    const normalizedEmail = normalizeEmail(email);
+    if (!normalizedEmail || !normalizedEmail.includes('@')) return;
+
+    const safeName = sanitizeText(name || '', 80, { allowEmpty: true }) || '';
+    const normalizedOwnerJid = normalizeJid(ownerJid) || null;
+    const idempotencyKey = `google_web_welcome:${normalizedEmail}:${new Date().toISOString().slice(0, 10)}`;
+
+    void queueWelcomeEmail({
+      to: normalizedEmail,
+      name: safeName,
+      redirectUrl: `${siteOrigin}/user/`,
+      homeUrl: `${siteOrigin}/`,
+      metadata: {
+        trigger: 'google_web_auth',
+        owner_jid: normalizedOwnerJid,
+      },
+      idempotencyKey,
+    }).catch((error) => {
+      logger.warn('Falha ao enfileirar e-mail de boas-vindas pós-login Google Web.', {
+        action: 'google_web_welcome_email_enqueue_failed',
+        email: normalizedEmail,
+        owner_jid: normalizedOwnerJid,
+        error: error?.message,
+      });
+    });
+  };
+
+  const googleWebAuth = createGoogleWebAuthRuntime({
+    executeQuery,
+    runSqlTransaction,
+    tables,
+    logger,
+    sendJson,
+    readJsonBody,
+    parseCookies,
+    getCookieValuesFromRequest,
+    appendSetCookie,
+    buildCookieString,
+    normalizeEmail,
+    normalizeJid,
+    sanitizeText,
+    toIsoOrNull,
+    toWhatsAppPhoneDigits,
+    resolveWhatsAppOwnerJidFromLoginPayload,
+    assertGoogleIdentityNotBanned,
+    googleClientId: stickerWebGoogleClientId,
+    sessionTtlMs: stickerWebGoogleSessionTtlMs,
+    apiBasePath: stickerApiBasePath,
+    webPath: stickerWebPath,
+    loginWebPath: stickerLoginWebPath,
+    configuredSessionCookiePath: process.env.STICKER_WEB_GOOGLE_SESSION_COOKIE_PATH,
+    notAllowedErrorCode,
+    onGoogleWebSessionCreated: ({ email, name, ownerJid }) => {
+      enqueueGoogleWebWelcomeEmail({ email, name, ownerJid });
+    },
+  });
+
+  const { upsertGoogleWebUserRecord, resolveGoogleWebSessionFromRequest, mapGoogleSessionResponseData, setGoogleWebSessionCookie, issueAccessTokenForSession, createPersistedGoogleWebSessionFromIdentity, handleGoogleAuthSessionRequest, revokeGoogleWebSessionsByIdentity, buildGoogleOwnerJid } = googleWebAuth;
+
+  const userPasswordRecoveryService = createUserPasswordRecoveryService({
+    executeQuery,
+    userPasswordAuthService,
+    queueAutomatedEmail,
+    revokeWebSessionsByIdentity: revokeGoogleWebSessionsByIdentity,
+    tables,
+    logger,
+    runSqlTransaction,
+  });
+
+  const handleTermsAcceptanceRequest = createTermsAcceptanceHandler({
+    executeQuery,
+    tables,
+    logger,
+    sendJson,
+    readJsonBody,
+    parseTermsAcceptancePayload,
+    parseCookies,
+    resolveGoogleWebSessionFromRequest,
+    normalizeGoogleSubject,
+    normalizeEmail,
+    normalizeJid,
+    resolveRequestRemoteIp,
+    sanitizeText,
+    webSessionCookieName,
+  });
+
+  const { handlePasswordAuthRequest, handlePasswordRecoveryRequest, handlePasswordRecoveryVerifyRequest, handlePasswordRecoverySessionCreateRequest, handlePasswordRecoverySessionStatusRequest, handlePasswordRecoverySessionRequest, handlePasswordRecoverySessionVerifyRequest, handlePasswordLoginRequest, handleMyProfileRequest } = createWebAccountAuthHandlers({
+    sendJson,
+    readJsonBody,
+    logger,
+    parseUserPasswordUpsertPayload,
+    parseUserPasswordRecoveryRequestPayload,
+    parseUserPasswordRecoveryVerifyPayload,
+    parseUserPasswordLoginPayload,
+    resolveGoogleWebSessionFromRequest,
+    mapGoogleSessionResponseData,
+    revokeGoogleWebSessionsByIdentity,
+    createPersistedGoogleWebSessionFromIdentity,
+    setGoogleWebSessionCookie,
+    issueAccessTokenForSession,
+    userPasswordAuthService,
+    userPasswordRecoveryService,
+    resolveRequestRemoteIp,
+    normalizeEmail,
+    normalizeGoogleSubject,
+    normalizeJid,
+    isWebAuthJwtEnabled,
+    signWebAuthJwt,
+    verifyWebAuthJwt,
+    passwordRecoverySessionAuthMethod,
+    passwordRecoverySessionTtlSeconds: passwordRecoverySessionTtlSeconds,
+    userProfileWebPath: userProfileWebPath,
+    userPasswordResetWebPath: userPasswordResetWebPath,
+    toSiteAbsoluteUrl,
+    executeQuery,
+    tables,
+    toIsoOrNull,
+    sanitizeText,
+    listStickerPacksByOwner,
+    listStickerPackEngagementByPackIds,
+    mapPackSummary,
+    isPackPubliclyVisible,
+    resolveMyProfileOwnerCandidates,
+    shouldHidePackFromMyProfileDefault,
+    parseEnvBool,
+    clampInt,
+    stickerWebGoogleClientId,
+    stickerWebGoogleAuthRequired,
+    toWhatsAppPhoneDigits,
+    getActiveSocket: () => globalThis.getActiveSocketBridge?.() || null,
+    profilePictureUrlFromActiveSocket: (jid, type, timeout) => globalThis.profilePictureUrlFromActiveSocketBridge?.(jid, type, timeout) || Promise.resolve(null),
+  });
+
+  return {
+    upsertGoogleWebUserRecord,
+    resolveGoogleWebSessionFromRequest,
+    mapGoogleSessionResponseData,
+    setGoogleWebSessionCookie,
+    issueAccessTokenForSession,
+    createPersistedGoogleWebSessionFromIdentity,
+    handleGoogleAuthSessionRequest,
+    revokeGoogleWebSessionsByIdentity,
+    buildGoogleOwnerJid,
+    handleTermsAcceptanceRequest,
+    handlePasswordAuthRequest,
+    handlePasswordRecoveryRequest,
+    handlePasswordRecoveryVerifyRequest,
+    handlePasswordRecoverySessionCreateRequest,
+    handlePasswordRecoverySessionStatusRequest,
+    handlePasswordRecoverySessionRequest,
+    handlePasswordRecoverySessionVerifyRequest,
+    handlePasswordLoginRequest,
+    handleMyProfileRequest,
+  };
+};

package/server/auth/termsAcceptance/termsAcceptanceHandler.js

@@ -0,0 +1,189 @@
+import { createHash, randomUUID } from 'node:crypto';
+
+const DEFAULT_LEGAL_VERSION = '2026-03-07';
+
+const normalizeLegalDocumentKey = (value) =>
+  String(value || '')
+    .trim()
+    .toLowerCase()
+    .replace(/[^a-z0-9_-]/g, '')
+    .slice(0, 64);
+
+const normalizeLegalDocumentVersion = (value) =>
+  String(value || '')
+    .trim()
+    .slice(0, 64);
+
+const normalizeTermsAcceptanceSource = (value) =>
+  String(value || '')
+    .trim()
+    .toLowerCase()
+    .replace(/[^a-z0-9_-]/g, '')
+    .slice(0, 32);
+
+const normalizeTermsAcceptanceSessionKey = (value) =>
+  String(value || '')
+    .trim()
+    .slice(0, 80);
+
+const normalizeRequestUserAgent = (value) =>
+  String(value || '')
+    .trim()
+    .slice(0, 512) || null;
+
+const parseAcceptedAtClientDate = (value) => {
+  const parsedAt = Date.parse(String(value || '').trim());
+  if (!Number.isFinite(parsedAt)) return null;
+  return new Date(parsedAt);
+};
+
+const buildLegalDocumentVersionHash = (documentKey, documentVersion) => createHash('sha256').update(`${documentKey}:${documentVersion}`).digest('hex');
+
+const defaultSanitizeText = (value, maxLength, { allowEmpty = true } = {}) => {
+  const normalized = String(value || '')
+    .trim()
+    .slice(0, Math.max(0, Number(maxLength) || 0));
+  if (!normalized && !allowEmpty) return '';
+  return normalized;
+};
+
+export const createTermsAcceptanceHandler = ({ executeQuery, tables, logger, sendJson, readJsonBody, parseTermsAcceptancePayload, parseCookies, resolveGoogleWebSessionFromRequest, normalizeGoogleSubject, normalizeEmail, normalizeJid, resolveRequestRemoteIp, sanitizeText, webSessionCookieName = 'omnizap_sid' }) => {
+  const sanitize = typeof sanitizeText === 'function' ? sanitizeText : defaultSanitizeText;
+
+  const legalTermsVersion =
+    sanitize(process.env.LEGAL_TERMS_VERSION || DEFAULT_LEGAL_VERSION, 64, {
+      allowEmpty: false,
+    }) || DEFAULT_LEGAL_VERSION;
+  const legalPrivacyVersion =
+    sanitize(process.env.LEGAL_PRIVACY_VERSION || DEFAULT_LEGAL_VERSION, 64, {
+      allowEmpty: false,
+    }) || DEFAULT_LEGAL_VERSION;
+  const legalAupVersion =
+    sanitize(process.env.LEGAL_AUP_VERSION || DEFAULT_LEGAL_VERSION, 64, {
+      allowEmpty: false,
+    }) || DEFAULT_LEGAL_VERSION;
+  const legalDefaultAcceptanceSource =
+    sanitize(process.env.LEGAL_TERMS_ACCEPTANCE_SOURCE || 'login_web', 32, {
+      allowEmpty: false,
+    }) || 'login_web';
+  const legalDocumentRegistry = Object.freeze({
+    termos_de_uso: legalTermsVersion,
+    politica_de_privacidade: legalPrivacyVersion,
+    politica_uso_aceitavel: legalAupVersion,
+  });
+
+  const resolveTermsAcceptanceDocuments = (documents = []) => {
+    const uniqueByVersion = new Map();
+    for (const doc of Array.isArray(documents) ? documents : []) {
+      const documentKey = normalizeLegalDocumentKey(doc?.document_key);
+      if (!documentKey) continue;
+      const fallbackVersion = legalDocumentRegistry[documentKey] || '';
+      const documentVersion = normalizeLegalDocumentVersion(doc?.document_version) || fallbackVersion;
+      if (!documentVersion) continue;
+      const uniqueKey = `${documentKey}:${documentVersion}`;
+      if (uniqueByVersion.has(uniqueKey)) continue;
+      uniqueByVersion.set(uniqueKey, {
+        documentKey,
+        documentVersion,
+        documentVersionHash: buildLegalDocumentVersionHash(documentKey, documentVersion),
+        isCurrentVersion: fallbackVersion ? fallbackVersion === documentVersion : false,
+      });
+    }
+    return Array.from(uniqueByVersion.values());
+  };
+
+  return async (req, res) => {
+    if (req.method !== 'POST') {
+      sendJson(req, res, 405, { error: 'Metodo nao permitido.' });
+      return;
+    }
+
+    let payload = {};
+    try {
+      payload = await readJsonBody(req);
+    } catch (error) {
+      sendJson(req, res, Number(error?.statusCode || 400), {
+        error: error?.message || 'Body invalido.',
+      });
+      return;
+    }
+
+    try {
+      payload = parseTermsAcceptancePayload(payload);
+    } catch (error) {
+      sendJson(req, res, Number(error?.statusCode || 400), {
+        error: error?.message || 'Payload de aceite juridico invalido.',
+        code: error?.code || 'INVALID_PAYLOAD',
+        details: Array.isArray(error?.details) ? error.details : undefined,
+      });
+      return;
+    }
+
+    const acceptedDocuments = resolveTermsAcceptanceDocuments(payload.documents);
+    if (!acceptedDocuments.length) {
+      sendJson(req, res, 400, {
+        error: 'Nenhum documento valido para registrar aceite.',
+        code: 'TERMS_ACCEPTANCE_EMPTY',
+      });
+      return;
+    }
+
+    const source = normalizeTermsAcceptanceSource(payload.source) || legalDefaultAcceptanceSource;
+    const acceptedAt = new Date();
+    const acceptedAtClient = parseAcceptedAtClientDate(payload.accepted_at);
+    const cookies = parseCookies(req);
+    const sessionKey = normalizeTermsAcceptanceSessionKey(cookies[webSessionCookieName] || '');
+    const remoteIp = resolveRequestRemoteIp(req);
+    const userAgent = normalizeRequestUserAgent(req.headers?.['user-agent'] || '');
+    const session = await resolveGoogleWebSessionFromRequest(req).catch(() => null);
+
+    const normalizedGoogleSub = normalizeGoogleSubject(session?.sub || '');
+    const normalizedEmail = normalizeEmail(session?.email || '');
+    const normalizedOwnerJid = normalizeJid(session?.ownerJid || '') || '';
+    const metadata = JSON.stringify({
+      accepted: true,
+      context: payload.context || null,
+      legal_document_registry: legalDocumentRegistry,
+    });
+
+    const valueRows = acceptedDocuments.map(() => '(?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?)').join(', ');
+    const params = [];
+    for (const doc of acceptedDocuments) {
+      params.push(randomUUID(), doc.documentKey, doc.documentVersion, doc.documentVersionHash, acceptedAt, acceptedAtClient, source, normalizedGoogleSub || null, normalizedEmail || null, normalizedOwnerJid || null, sessionKey || null, remoteIp || null, userAgent, metadata);
+    }
+
+    try {
+      await executeQuery(
+        `INSERT INTO ${tables.STICKER_WEB_TERMS_ACCEPTANCE_EVENT}
+          (event_id, document_key, document_version, document_version_hash, accepted_at, accepted_at_client, source, google_sub, email, owner_jid, session_key, ip_address, user_agent, metadata)
+         VALUES ${valueRows}`,
+        params,
+      );
+
+      sendJson(req, res, 201, {
+        data: {
+          accepted: true,
+          source,
+          accepted_at: acceptedAt.toISOString(),
+          accepted_documents: acceptedDocuments.map((doc) => ({
+            document_key: doc.documentKey,
+            document_version: doc.documentVersion,
+            document_version_hash: doc.documentVersionHash,
+            current_version: doc.isCurrentVersion,
+          })),
+        },
+      });
+    } catch (error) {
+      logger.warn('Falha ao registrar aceite juridico versionado.', {
+        action: 'web_terms_acceptance_insert_failed',
+        error: error?.message,
+        source,
+        document_count: acceptedDocuments.length,
+      });
+      sendJson(req, res, Number(error?.statusCode || 500), {
+        error: 'Falha ao registrar aceite juridico.',
+        code: 'TERMS_ACCEPTANCE_INSERT_FAILED',
+      });
+    }
+  };
+};

package/server/auth/userPassword/index.js

@@ -0,0 +1,14 @@
+import { executeQuery, TABLES } from '../../../database/index.js';
+import logger from '#logger';
+
+import { createUserPasswordAuthService } from './userPasswordAuthService.js';
+
+const userPasswordAuthService = createUserPasswordAuthService({
+  executeQuery,
+  tables: TABLES,
+  logger,
+});
+
+export default userPasswordAuthService;
+export { createUserPasswordAuthService };
+export { DEFAULT_USER_PASSWORD_POLICY, hashUserPassword, resolveUserPasswordPolicy, validateUserPassword, verifyUserPasswordHash } from './userPasswordCrypto.js';