@omnizap-system/omnizap 2.5.12

package/server/controllers/system/storageController.js

@@ -0,0 +1,154 @@
+import fs from 'node:fs/promises';
+import path from 'node:path';
+import { normalizeBasePath, sendAsset, sendJson } from '../../http/httpRequestUtils.js';
+import logger from '#logger';
+
+const STICKER_DATA_PUBLIC_PATH = normalizeBasePath(process.env.STICKER_DATA_PUBLIC_PATH, '/data');
+const STICKER_DATA_PUBLIC_DIR = path.resolve(process.env.STICKER_DATA_PUBLIC_DIR || path.join(process.cwd(), 'data'));
+const MAX_DATA_SCAN_FILES = Number(process.env.STICKER_DATA_SCAN_MAX_FILES || 10000);
+const DATA_IMAGE_EXTENSIONS = new Set(['.webp', '.png', '.jpg', '.jpeg', '.gif', '.avif', '.bmp']);
+
+const normalizeRelativePath = (value) =>
+  String(value || '')
+    .split(path.sep)
+    .join('/')
+    .replace(/^\/+/, '');
+
+const isAllowedDataImageFile = (filePath) => DATA_IMAGE_EXTENSIONS.has(path.extname(filePath).toLowerCase());
+
+const isInsideDataPublicRoot = (targetPath) => targetPath === STICKER_DATA_PUBLIC_DIR || targetPath.startsWith(`${STICKER_DATA_PUBLIC_DIR}${path.sep}`);
+
+const buildDataAssetUrl = (relativePath) =>
+  `${STICKER_DATA_PUBLIC_PATH}/${String(relativePath)
+    .split('/')
+    .map((segment) => encodeURIComponent(segment))
+    .join('/')}`;
+
+export const toPublicDataUrlFromStoragePath = (storagePath) => {
+  if (!storagePath) return null;
+  const absolutePath = path.resolve(String(storagePath));
+  if (!isInsideDataPublicRoot(absolutePath)) return null;
+
+  const relativePath = normalizeRelativePath(path.relative(STICKER_DATA_PUBLIC_DIR, absolutePath));
+  if (!relativePath || relativePath.startsWith('..')) return null;
+  return buildDataAssetUrl(relativePath);
+};
+
+export const toImageMimeType = (filePath) => {
+  const extension = path.extname(filePath).toLowerCase();
+  if (extension === '.png') return 'image/png';
+  if (extension === '.jpg' || extension === '.jpeg') return 'image/jpeg';
+  if (extension === '.gif') return 'image/gif';
+  if (extension === '.avif') return 'image/avif';
+  if (extension === '.bmp') return 'image/bmp';
+  return 'image/webp';
+};
+
+export const listDataImageFiles = async () => {
+  const files = [];
+  const queue = [STICKER_DATA_PUBLIC_DIR];
+
+  while (queue.length && files.length < MAX_DATA_SCAN_FILES) {
+    const currentDir = queue.shift();
+    let entries = [];
+    try {
+      entries = await fs.readdir(currentDir, { withFileTypes: true });
+    } catch (error) {
+      if (error?.code === 'ENOENT') break;
+      throw error;
+    }
+
+    for (const entry of entries) {
+      const absolutePath = path.join(currentDir, entry.name);
+
+      if (!isInsideDataPublicRoot(absolutePath)) continue;
+      if (entry.isDirectory()) {
+        queue.push(absolutePath);
+        continue;
+      }
+
+      if (!entry.isFile()) continue;
+      if (!isAllowedDataImageFile(entry.name)) continue;
+
+      const relativePath = normalizeRelativePath(path.relative(STICKER_DATA_PUBLIC_DIR, absolutePath));
+      if (!relativePath || relativePath.startsWith('..')) continue;
+
+      let stat = null;
+      try {
+        stat = await fs.stat(absolutePath);
+      } catch {
+        stat = null;
+      }
+
+      files.push({
+        name: path.basename(relativePath),
+        relative_path: relativePath,
+        size_bytes: stat?.size ?? null,
+        updated_at: stat?.mtime ? stat.mtime.toISOString() : null,
+        created_at: stat?.ctime ? stat.ctime.toISOString() : null,
+        url: buildDataAssetUrl(relativePath),
+      });
+
+      if (files.length >= MAX_DATA_SCAN_FILES) break;
+    }
+  }
+
+  files.sort((left, right) => {
+    const leftTime = left.updated_at ? Date.parse(left.updated_at) : 0;
+    const rightTime = right.updated_at ? Date.parse(right.updated_at) : 0;
+    return rightTime - leftTime;
+  });
+
+  return files;
+};
+
+export const handlePublicDataAssetRequest = async (req, res, pathname) => {
+  const suffix = pathname.slice(STICKER_DATA_PUBLIC_PATH.length).replace(/^\/+/, '');
+  if (!suffix) {
+    sendJson(req, res, 400, {
+      error: 'Informe o caminho do arquivo. Exemplo: /data/stickers/arquivo.webp',
+    });
+    return true;
+  }
+
+  const decodedSegments = suffix
+    .split('/')
+    .filter(Boolean)
+    .map((segment) => {
+      try {
+        return decodeURIComponent(segment);
+      } catch {
+        return segment;
+      }
+    });
+
+  const relativePath = normalizeRelativePath(decodedSegments.join('/'));
+  if (!relativePath || relativePath.includes('..') || !isAllowedDataImageFile(relativePath)) {
+    sendJson(req, res, 400, { error: 'Caminho de imagem invalido.' });
+    return true;
+  }
+
+  const absolutePath = path.resolve(STICKER_DATA_PUBLIC_DIR, relativePath);
+  if (!isInsideDataPublicRoot(absolutePath)) {
+    sendJson(req, res, 403, { error: 'Acesso negado.' });
+    return true;
+  }
+
+  try {
+    const buffer = await fs.readFile(absolutePath);
+    sendAsset(req, res, buffer, toImageMimeType(absolutePath));
+    return true;
+  } catch (error) {
+    if (error?.code === 'ENOENT') {
+      sendJson(req, res, 404, { error: 'Imagem nao encontrada.' });
+      return true;
+    }
+
+    logger.error('Falha ao servir imagem da pasta data.', {
+      action: 'sticker_catalog_data_asset_failed',
+      error: error?.message,
+      relative_path: relativePath,
+    });
+    return false;
+  }
+};

package/server/controllers/system/systemController.js

@@ -0,0 +1,135 @@
+import logger from '#logger';
+import { executeQuery, TABLES } from '../../../database/index.js';
+import { getActiveSocket, getJidUser, normalizeJid, profilePictureUrlFromActiveSocket } from '../../../app/config/index.js';
+import { getSystemMetrics } from '../../../app/utils/systemMetrics/systemMetricsModule.js';
+import { createStickerCatalogSystemContext } from './stickerCatalogSystemContext.js';
+import { createStickerCatalogNonCatalogHandlers } from '../sticker/nonCatalogHandlers.js';
+import { sendJson, sendText, normalizeCatalogVisibility, normalizeVisitPath } from '../../http/httpRequestUtils.js';
+import { fetchGitHubProjectSummary } from './githubController.js';
+import { fetchPrometheusSummary } from './systemMetricsController.js';
+import { buildBotContactInfo, buildSupportInfo, resolveCatalogBotPhone } from './contactController.js';
+import { buildAdminMenu, buildAiMenu, buildAnimeMenu, buildMediaMenu, buildMenuCaption, buildQuoteMenu, buildStatsMenu, buildStickerMenu } from '../../../app/modules/menuModule/common.js';
+import { trackWebVisitMetric } from './visitController.js';
+
+const SYSTEM_SUMMARY_CACHE_SECONDS = Number(process.env.SYSTEM_SUMMARY_CACHE_SECONDS || 20);
+const README_SUMMARY_CACHE_SECONDS = Number(process.env.README_SUMMARY_CACHE_SECONDS || 1800);
+const README_MESSAGE_TYPE_SAMPLE_LIMIT = Number(process.env.README_MESSAGE_TYPE_SAMPLE_LIMIT || 25000);
+const README_COMMAND_PREFIX = process.env.README_COMMAND_PREFIX || process.env.COMMAND_PREFIX || '/';
+const GLOBAL_RANK_REFRESH_SECONDS = Number(process.env.GLOBAL_RANK_REFRESH_SECONDS || 600);
+const MARKETPLACE_GLOBAL_STATS_CACHE_SECONDS = Number(process.env.MARKETPLACE_GLOBAL_STATS_CACHE_SECONDS || 45);
+const GITHUB_PROJECT_CACHE_SECONDS = Number(process.env.GITHUB_PROJECT_CACHE_SECONDS || 300);
+
+const SYSTEM_SUMMARY_CACHE = { expiresAt: 0, value: null, pending: null };
+const README_SUMMARY_CACHE = { expiresAt: 0, value: null, pending: null };
+const GLOBAL_RANK_CACHE = { expiresAt: 0, value: null, pending: null };
+const MARKETPLACE_GLOBAL_STATS_CACHE = { expiresAt: 0, value: null, pending: null };
+
+const resolveSocketReadyState = (activeSocket) => {
+  const raw = activeSocket?.ws?.readyState;
+  if (typeof raw === 'number' && Number.isFinite(raw)) return raw;
+  const normalized = String(raw || '')
+    .trim()
+    .toLowerCase();
+  if (normalized === 'open') return 1;
+  if (normalized === 'connecting') return 0;
+  if (normalized === 'closing') return 2;
+  if (normalized === 'closed') return 3;
+  return null;
+};
+
+const resolveActiveSocketBotJid = (sock) => {
+  if (!sock) return '';
+  const candidates = [sock?.user?.id, sock?.authState?.creds?.me?.id, sock?.authState?.creds?.me?.lid];
+  for (const candidate of candidates) {
+    const resolved = normalizeJid(candidate);
+    if (resolved) return resolved;
+  }
+  return '';
+};
+
+export const systemContext = createStickerCatalogSystemContext({
+  executeQuery,
+  tables: TABLES,
+  logger,
+  getSystemMetrics,
+  getActiveSocket,
+  resolveSocketReadyState,
+  resolveActiveSocketBotJid,
+  resolveCatalogBotPhone,
+  fetchPrometheusSummary,
+  metricsEndpoint: process.env.METRICS_ENDPOINT,
+  systemSummaryCache: SYSTEM_SUMMARY_CACHE,
+  systemSummaryCacheSeconds: SYSTEM_SUMMARY_CACHE_SECONDS,
+  readmeSummaryCache: README_SUMMARY_CACHE,
+  readmeSummaryCacheSeconds: README_SUMMARY_CACHE_SECONDS,
+  readmeMessageTypeSampleLimit: README_MESSAGE_TYPE_SAMPLE_LIMIT,
+  readmeCommandPrefix: README_COMMAND_PREFIX,
+  buildMenuCaption,
+  buildStickerMenu,
+  buildMediaMenu,
+  buildQuoteMenu,
+  buildAnimeMenu,
+  buildAiMenu,
+  buildStatsMenu,
+  buildAdminMenu,
+  profilePictureUrlFromActiveSocket,
+  normalizeJid,
+  getJidUser,
+  globalRankCache: GLOBAL_RANK_CACHE,
+  globalRankRefreshSeconds: GLOBAL_RANK_REFRESH_SECONDS,
+  marketplaceGlobalStatsCache: MARKETPLACE_GLOBAL_STATS_CACHE,
+  marketplaceGlobalStatsCacheSeconds: MARKETPLACE_GLOBAL_STATS_CACHE_SECONDS,
+});
+
+const { getSystemSummaryCached, getReadmeSummaryCached, resolveBotUserCandidates, sanitizeRankingPayloadByBot, getGlobalRankingSummaryCached, scheduleGlobalRankingPreload, getMarketplaceGlobalStatsCached } = systemContext;
+
+const resolveVisitPathFromReferrer = (req) => {
+  const rawReferrer = String(req?.headers?.referer || req?.headers?.referrer || '').trim();
+  if (!rawReferrer) return '/';
+  try {
+    const parsed = new URL(rawReferrer);
+    const requestHost = req.headers.host;
+    if (requestHost && parsed.host && parsed.host.toLowerCase() !== requestHost.toLowerCase()) return '/';
+    return normalizeVisitPath(parsed.pathname || '/');
+  } catch {
+    return '/';
+  }
+};
+
+export const systemHandlers = createStickerCatalogNonCatalogHandlers({
+  sendJson,
+  sendText,
+  logger,
+  getSystemSummaryCached,
+  systemSummaryCache: SYSTEM_SUMMARY_CACHE,
+  systemSummaryCacheSeconds: SYSTEM_SUMMARY_CACHE_SECONDS,
+  getReadmeSummaryCached,
+  readmeSummaryCache: README_SUMMARY_CACHE,
+  readmeSummaryCacheSeconds: README_SUMMARY_CACHE_SECONDS,
+  getGlobalRankingSummaryCached,
+  globalRankRefreshSeconds: GLOBAL_RANK_REFRESH_SECONDS,
+  globalRankCache: GLOBAL_RANK_CACHE,
+  sanitizeRankingPayloadByBot,
+  getActiveSocket,
+  resolveBotUserCandidates,
+  getMarketplaceGlobalStatsCached,
+  marketplaceGlobalStatsCacheSeconds: MARKETPLACE_GLOBAL_STATS_CACHE_SECONDS,
+  marketplaceGlobalStatsCache: MARKETPLACE_GLOBAL_STATS_CACHE,
+  githubRepoInfo: { fullName: process.env.GITHUB_REPOSITORY || 'Omnizap-System/omnizap' },
+  githubProjectCacheSeconds: GITHUB_PROJECT_CACHE_SECONDS,
+  fetchGitHubProjectSummary,
+  buildSupportInfo,
+  buildBotContactInfo,
+  trackWebVisitMetric,
+  resolveVisitPathFromReferrer,
+  normalizeCatalogVisibility,
+  stickerWebGoogleClientId: process.env.STICKER_WEB_GOOGLE_CLIENT_ID,
+  homeBootstrapExposeContact: process.env.HOME_BOOTSTRAP_EXPOSE_CONTACT !== 'false',
+  // Estas serão injetadas via bridge para evitar circular dependency
+  getMarketplaceStatsCached: (vis) => globalThis.getMarketplaceStatsCachedBridge?.(vis),
+  resolveGoogleWebSessionFromRequest: (req) => globalThis.resolveGoogleWebSessionFromRequestBridge?.(req),
+  mapGoogleSessionResponseData: (sess, opts) => globalThis.mapGoogleSessionResponseDataBridge?.(sess, opts),
+  isAuthenticatedGoogleSession: (sess) => Boolean(sess?.sub && (sess?.ownerJid || sess?.ownerPhone || sess?.email)),
+});
+
+export { scheduleGlobalRankingPreload };

package/server/controllers/system/systemMetricsController.js

@@ -0,0 +1,156 @@
+import { formatDuration } from '../../http/httpRequestUtils.js';
+
+const METRICS_ENDPOINT = process.env.METRICS_ENDPOINT || `http://127.0.0.1:${process.env.METRICS_PORT || 9102}${process.env.METRICS_PATH || '/metrics'}`;
+const METRICS_TOKEN = String(process.env.METRICS_TOKEN || process.env.METRICS_API_KEY || '').trim();
+const METRICS_SUMMARY_TIMEOUT_MS = Number(process.env.STICKER_SYSTEM_METRICS_TIMEOUT_MS || 1200);
+
+const parsePrometheusLabels = (raw) => {
+  if (!raw) return {};
+  const labels = {};
+  const regex = /(\w+)="((?:\\.|[^"\\])*)"/g;
+  let match;
+  while ((match = regex.exec(raw)) !== null) {
+    labels[match[1]] = match[2].replace(/\\"/g, '"');
+  }
+  return labels;
+};
+
+const parsePrometheusText = (text) => {
+  const series = new Map();
+  const lines = String(text || '').split('\n');
+  for (const line of lines) {
+    const trimmed = line.trim();
+    if (!trimmed || trimmed.startsWith('#')) continue;
+
+    const [metricPart, valuePart] = trimmed.split(/\s+/, 2);
+    if (!metricPart || !valuePart) continue;
+    const value = Number(valuePart);
+    if (!Number.isFinite(value)) continue;
+
+    let name = metricPart;
+    let labels = {};
+    const labelStart = metricPart.indexOf('{');
+    if (labelStart !== -1) {
+      name = metricPart.slice(0, labelStart);
+      const labelBody = metricPart.slice(labelStart + 1, metricPart.lastIndexOf('}'));
+      labels = parsePrometheusLabels(labelBody);
+    }
+
+    const list = series.get(name) || [];
+    list.push({ labels, value });
+    series.set(name, list);
+  }
+  return series;
+};
+
+const pickMetricValue = (series, name) => {
+  const list = series.get(name) || [];
+  return list.length ? list[0].value : null;
+};
+
+const sumMetricValues = (series, name) => {
+  const list = series.get(name) || [];
+  return list.reduce((sum, entry) => sum + (Number.isFinite(entry.value) ? entry.value : 0), 0);
+};
+
+const sumMetricValuesByLabel = (series, name, matchLabels = {}) => {
+  const list = series.get(name) || [];
+  return list.reduce((sum, entry) => {
+    if (!Number.isFinite(entry.value)) return sum;
+    for (const [labelKey, expectedValue] of Object.entries(matchLabels || {})) {
+      if (String(entry?.labels?.[labelKey] || '') !== String(expectedValue)) return sum;
+    }
+    return sum + entry.value;
+  }, 0);
+};
+
+const estimateHistogramQuantileMs = (series, metricBaseName, quantile = 0.95) => {
+  const bucketSeries = series.get(`${metricBaseName}_bucket`) || [];
+  if (!bucketSeries.length) return null;
+
+  const cumulativeByLe = new Map();
+  for (const entry of bucketSeries) {
+    const leRaw = String(entry?.labels?.le || '').trim();
+    if (!leRaw) continue;
+    const le = leRaw === '+Inf' ? Number.POSITIVE_INFINITY : Number(leRaw);
+    if (!Number.isFinite(le) && le !== Number.POSITIVE_INFINITY) continue;
+    cumulativeByLe.set(le, (cumulativeByLe.get(le) || 0) + Number(entry.value || 0));
+  }
+
+  const sorted = Array.from(cumulativeByLe.entries()).sort((left, right) => left[0] - right[0]);
+  if (!sorted.length) return null;
+
+  const total = Number(sorted[sorted.length - 1]?.[1] || 0);
+  if (!Number.isFinite(total) || total <= 0) return null;
+  const target = total * Math.max(0, Math.min(1, Number(quantile) || 0.95));
+
+  for (const [upperBound, cumulative] of sorted) {
+    if (cumulative >= target) {
+      if (!Number.isFinite(upperBound)) return null;
+      return Number(upperBound.toFixed(2));
+    }
+  }
+
+  return null;
+};
+
+const buildMetricsRequestOptions = (signal = null) => {
+  const headers = {};
+  if (METRICS_TOKEN) {
+    headers.Authorization = `Bearer ${METRICS_TOKEN}`;
+  }
+
+  return {
+    ...(signal ? { signal } : {}),
+    ...(Object.keys(headers).length > 0 ? { headers } : {}),
+  };
+};
+
+export const fetchPrometheusSummary = async () => {
+  if (typeof globalThis.fetch !== 'function') {
+    throw new Error('fetch indisponivel');
+  }
+
+  const controller = typeof globalThis.AbortController === 'function' ? new globalThis.AbortController() : null;
+  const timeout = setTimeout(() => controller?.abort(), METRICS_SUMMARY_TIMEOUT_MS);
+
+  try {
+    const response = await globalThis.fetch(METRICS_ENDPOINT, buildMetricsRequestOptions(controller?.signal || null));
+    if (!response.ok) {
+      throw new Error(`HTTP ${response.status}`);
+    }
+
+    const text = await response.text();
+    const series = parsePrometheusText(text);
+
+    const processStart = pickMetricValue(series, 'omnizap_process_start_time_seconds');
+    const nowSeconds = Date.now() / 1000;
+    const processUptimeSeconds = Number.isFinite(processStart) ? Math.max(0, nowSeconds - processStart) : null;
+
+    const lagP99 = pickMetricValue(series, 'omnizap_nodejs_eventloop_lag_p99_seconds');
+    const dbTotal = sumMetricValues(series, 'omnizap_db_query_total');
+    const dbSlow = sumMetricValues(series, 'omnizap_db_slow_queries_total');
+    const http5xx = sumMetricValuesByLabel(series, 'omnizap_http_requests_total', {
+      status_class: '5xx',
+    });
+    const httpLatencyP95 = estimateHistogramQuantileMs(series, 'omnizap_http_request_duration_ms', 0.95);
+
+    const queueDepthSeries = series.get('omnizap_queue_depth') || [];
+    const queuePeak = queueDepthSeries.reduce((max, entry) => {
+      if (!Number.isFinite(entry.value)) return max;
+      return Math.max(max, entry.value);
+    }, 0);
+
+    return {
+      process_uptime: processUptimeSeconds !== null ? formatDuration(processUptimeSeconds) : 'n/a',
+      lag_p99_ms: Number.isFinite(lagP99) ? Number((lagP99 * 1000).toFixed(2)) : null,
+      db_total: Math.round(dbTotal || 0),
+      db_slow: Math.round(dbSlow || 0),
+      http_5xx_total: Math.round(http5xx || 0),
+      http_latency_p95_ms: Number.isFinite(httpLatencyP95) ? Number(httpLatencyP95) : null,
+      queue_peak: Math.round(queuePeak || 0),
+    };
+  } finally {
+    clearTimeout(timeout);
+  }
+};

package/server/controllers/system/visitController.js

@@ -0,0 +1,90 @@
+import { randomUUID } from 'node:crypto';
+import { executeQuery, TABLES } from '../../../database/index.js';
+import { appendSetCookie, buildCookieString, normalizeVisitPath, parseCookies } from '../../http/httpRequestUtils.js';
+import { toRequestHost } from '../../http/siteRoutingUtils.js';
+
+const WEB_VISITOR_COOKIE_NAME = 'omnizap_vid';
+const WEB_SESSION_COOKIE_NAME = 'omnizap_sid';
+const WEB_VISITOR_COOKIE_TTL_SECONDS = Number(process.env.WEB_VISITOR_COOKIE_TTL_SECONDS || 60 * 60 * 24 * 365);
+const WEB_SESSION_COOKIE_TTL_SECONDS = Number(process.env.WEB_SESSION_COOKIE_TTL_SECONDS || 60 * 60 * 24 * 30);
+
+const normalizeVisitToken = (raw) =>
+  String(raw || '')
+    .trim()
+    .replace(/[^a-zA-Z0-9_-]+/g, '')
+    .slice(0, 80);
+
+const normalizeVisitSource = (raw) =>
+  String(raw || '')
+    .trim()
+    .toLowerCase()
+    .replace(/[^a-z0-9._-]+/g, '')
+    .slice(0, 32) || 'web';
+
+const normalizeVisitReferrer = (raw) =>
+  String(raw || '')
+    .trim()
+    .slice(0, 1024) || null;
+
+const normalizeVisitUserAgent = (raw) =>
+  String(raw || '')
+    .trim()
+    .slice(0, 512) || null;
+
+const resolveVisitPathFromReferrer = (req) => {
+  const rawReferrer = String(req?.headers?.referer || req?.headers?.referrer || '').trim();
+  if (!rawReferrer) return '/';
+  try {
+    const parsed = new URL(rawReferrer);
+    const requestHost = toRequestHost(req);
+    if (requestHost && parsed.host && parsed.host.toLowerCase() !== requestHost.toLowerCase()) return '/';
+    return normalizeVisitPath(parsed.pathname || '/');
+  } catch {
+    return '/';
+  }
+};
+
+const ensureWebVisitCookies = (req, res) => {
+  const cookies = parseCookies(req);
+  const currentVisitor = normalizeVisitToken(cookies[WEB_VISITOR_COOKIE_NAME]);
+  const currentSession = normalizeVisitToken(cookies[WEB_SESSION_COOKIE_NAME]);
+  const visitorKey = currentVisitor || randomUUID();
+  const sessionKey = currentSession || randomUUID();
+
+  if (!currentVisitor) {
+    appendSetCookie(
+      res,
+      buildCookieString(WEB_VISITOR_COOKIE_NAME, visitorKey, req, {
+        maxAgeSeconds: WEB_VISITOR_COOKIE_TTL_SECONDS,
+      }),
+    );
+  }
+
+  appendSetCookie(
+    res,
+    buildCookieString(WEB_SESSION_COOKIE_NAME, sessionKey, req, {
+      maxAgeSeconds: WEB_SESSION_COOKIE_TTL_SECONDS,
+    }),
+  );
+
+  return { visitorKey, sessionKey };
+};
+
+export const trackWebVisitMetric = (req, res, { pagePath = '/', source = 'web' } = {}) => {
+  if ((req.method || '').toUpperCase() === 'HEAD') return Promise.resolve(false);
+  const { visitorKey, sessionKey } = ensureWebVisitCookies(req, res);
+  const safePath = normalizeVisitPath(pagePath || resolveVisitPathFromReferrer(req));
+  const safeSource = normalizeVisitSource(source);
+  const safeReferrer = normalizeVisitReferrer(req?.headers?.referer || req?.headers?.referrer || '');
+  const safeUserAgent = normalizeVisitUserAgent(req?.headers?.['user-agent'] || '');
+
+  return executeQuery(
+    `INSERT INTO ${TABLES.WEB_VISIT_EVENT}
+      (visitor_key, session_key, page_path, referrer, user_agent, source)
+     VALUES (?, ?, ?, ?, ?, ?)`,
+    [visitorKey, sessionKey, safePath, safeReferrer, safeUserAgent, safeSource],
+  ).catch((error) => {
+    if (error?.code === 'ER_NO_SUCH_TABLE') return false;
+    throw error;
+  });
+};

package/server/controllers/userController.js

@@ -0,0 +1,145 @@
+import fs from 'node:fs/promises';
+import path from 'node:path';
+
+import logger from '#logger';
+import { DEFAULT_LEGACY_STICKER_API_BASE_PATH, DEFAULT_USER_API_BASE_PATH, isUserApiPath, normalizeBasePath, resolveLegacyUserApiPath } from '../routes/user/userApiPaths.js';
+
+const LEGACY_STICKER_API_BASE_PATH = normalizeBasePath(process.env.STICKER_API_BASE_PATH, DEFAULT_LEGACY_STICKER_API_BASE_PATH);
+const USER_API_BASE_PATH = normalizeBasePath(process.env.USER_API_BASE_PATH || process.env.AUTH_API_BASE_PATH, DEFAULT_USER_API_BASE_PATH);
+const STICKER_LOGIN_WEB_PATH = normalizeBasePath(process.env.STICKER_LOGIN_WEB_PATH, '/login');
+const USER_PROFILE_WEB_PATH = normalizeBasePath(process.env.USER_PROFILE_WEB_PATH, '/user');
+const USER_PASSWORD_RESET_WEB_PATH = normalizeBasePath(process.env.USER_PASSWORD_RESET_WEB_PATH, '/user/password-reset');
+const USER_DASHBOARD_TEMPLATE_PATH = path.join(process.cwd(), 'public', 'pages', 'user.html');
+const USER_PASSWORD_RESET_TEMPLATE_PATH = path.join(process.cwd(), 'public', 'pages', 'user-password-reset.html');
+
+const hasPathPrefix = (pathname, prefix) => pathname === prefix || pathname.startsWith(`${prefix}/`);
+const escapeHtmlAttribute = (value) =>
+  String(value || '')
+    .replace(/&/g, '&')
+    .replace(/"/g, '"')
+    .replace(/</g, '&lt;')
+    .replace(/>/g, '&gt;');
+const replaceDataAttribute = (html, attributeName, value) => String(html || '').replace(new RegExp(`(${attributeName}=")([^"]*)(")`, 'i'), `$1${escapeHtmlAttribute(value)}$3`);
+
+const remapUrlPathname = (url, pathname) => {
+  if (!url || !pathname) return url;
+  try {
+    const remappedUrl = new URL(String(url?.href || url));
+    remappedUrl.pathname = pathname;
+    return remappedUrl;
+  } catch {
+    return url;
+  }
+};
+
+const isSupportedUserApiPath = (pathname) => isUserApiPath(pathname, USER_API_BASE_PATH) || isUserApiPath(pathname, LEGACY_STICKER_API_BASE_PATH, { legacyCompatible: true });
+
+const mapUserApiPathToLegacy = (pathname) =>
+  resolveLegacyUserApiPath(pathname, {
+    apiBasePath: USER_API_BASE_PATH,
+    legacyApiBasePath: LEGACY_STICKER_API_BASE_PATH,
+    legacyCompatible: true,
+  }) ||
+  resolveLegacyUserApiPath(pathname, {
+    apiBasePath: LEGACY_STICKER_API_BASE_PATH,
+    legacyApiBasePath: LEGACY_STICKER_API_BASE_PATH,
+    legacyCompatible: true,
+  });
+
+const renderUserDashboardHtml = async ({ passwordReset = false } = {}) => {
+  const templatePath = passwordReset ? USER_PASSWORD_RESET_TEMPLATE_PATH : USER_DASHBOARD_TEMPLATE_PATH;
+  const template = await fs.readFile(templatePath, 'utf8');
+  const dataAttributes = {
+    'data-api-base-path': USER_API_BASE_PATH,
+    'data-login-path': STICKER_LOGIN_WEB_PATH,
+    'data-password-reset-web-path': USER_PASSWORD_RESET_WEB_PATH,
+  };
+
+  let html = template;
+  for (const [attributeName, value] of Object.entries(dataAttributes)) {
+    html = replaceDataAttribute(html, attributeName, value);
+  }
+
+  return html;
+};
+
+let stickerCatalogControllerPromise = null;
+const loadStickerCatalogController = async () => {
+  if (!stickerCatalogControllerPromise) {
+    stickerCatalogControllerPromise = import('./sticker/stickerCatalogController.js');
+  }
+  return stickerCatalogControllerPromise;
+};
+
+const sendHtml = (req, res, html) => {
+  res.statusCode = 200;
+  res.setHeader('Content-Type', 'text/html; charset=utf-8');
+  res.setHeader('Cache-Control', 'no-store');
+  res.setHeader('X-Robots-Tag', 'noindex, nofollow');
+  if (req.method === 'HEAD') {
+    res.end();
+    return;
+  }
+  res.end(html);
+};
+
+const sendJson = (req, res, statusCode, payload) => {
+  const body = JSON.stringify(payload);
+  res.statusCode = statusCode;
+  res.setHeader('Content-Type', 'application/json; charset=utf-8');
+  res.setHeader('Cache-Control', 'no-store');
+  res.setHeader('X-Robots-Tag', 'noindex, nofollow');
+  if (req.method === 'HEAD') {
+    res.end();
+    return;
+  }
+  res.end(body);
+};
+
+export const getUserRouteConfig = () => ({
+  webPath: USER_PROFILE_WEB_PATH,
+  loginPath: STICKER_LOGIN_WEB_PATH,
+  passwordResetWebPath: USER_PASSWORD_RESET_WEB_PATH,
+  apiBasePath: USER_API_BASE_PATH,
+  legacyApiBasePath: LEGACY_STICKER_API_BASE_PATH,
+});
+
+export const maybeHandleUserRequest = async (req, res, { pathname, url }) => {
+  if (!['GET', 'HEAD', 'POST', 'PATCH', 'DELETE'].includes(req.method || '')) return false;
+
+  const isUserHomePath = pathname === USER_PROFILE_WEB_PATH || pathname === `${USER_PROFILE_WEB_PATH}/`;
+  const isPasswordResetPath = hasPathPrefix(pathname, USER_PASSWORD_RESET_WEB_PATH);
+
+  if (isUserHomePath || isPasswordResetPath) {
+    if (!['GET', 'HEAD'].includes(req.method || '')) return false;
+    try {
+      const html = await renderUserDashboardHtml({ passwordReset: isPasswordResetPath });
+      sendHtml(req, res, html);
+    } catch (error) {
+      if (error?.code === 'ENOENT') {
+        sendJson(req, res, 404, { error: 'Template da pagina de usuario nao encontrado.' });
+        return true;
+      }
+      logger.error('Falha ao renderizar pagina de usuario.', {
+        action: 'user_page_render_failed',
+        path: pathname,
+        error: error?.message,
+      });
+      sendJson(req, res, 500, { error: 'Falha interna ao renderizar pagina de usuario.' });
+    }
+    return true;
+  }
+
+  if (isSupportedUserApiPath(pathname)) {
+    const routedPathname = mapUserApiPathToLegacy(pathname) || pathname;
+
+    const controller = await loadStickerCatalogController();
+    if (typeof controller?.maybeHandleStickerCatalogRequest !== 'function') return false;
+    return controller.maybeHandleStickerCatalogRequest(req, res, {
+      pathname: routedPathname,
+      url: remapUrlPathname(url, routedPathname),
+    });
+  }
+
+  return false;
+};