@omnizap-system/omnizap 2.5.12

package/server/http/clientIp.js

@@ -0,0 +1,95 @@
+import { isIP } from 'node:net';
+
+const parseEnvBool = (value, fallback = false) => {
+  if (value === undefined || value === null || value === '') return fallback;
+  const normalized = String(value).trim().toLowerCase();
+  if (['1', 'true', 'yes', 'y', 'on'].includes(normalized)) return true;
+  if (['0', 'false', 'no', 'n', 'off'].includes(normalized)) return false;
+  return fallback;
+};
+
+const TRUST_PROXY_HEADERS = parseEnvBool(process.env.APP_TRUST_PROXY, parseEnvBool(process.env.RATE_LIMIT_TRUST_PROXY, false));
+const LOOPBACK_IPS = new Set(['127.0.0.1', '::1', '::ffff:127.0.0.1']);
+
+const normalizeIpCandidate = (value) => {
+  let raw = String(value || '').trim();
+  if (!raw) return '';
+
+  if (raw.startsWith('for=')) raw = raw.slice(4).trim();
+  if (raw.startsWith('"') && raw.endsWith('"') && raw.length > 1) raw = raw.slice(1, -1).trim();
+  if (raw === 'unknown') return '';
+
+  if (raw.startsWith('[')) {
+    const closeBracketIndex = raw.indexOf(']');
+    if (closeBracketIndex > 1) {
+      raw = raw.slice(1, closeBracketIndex).trim();
+    }
+  }
+
+  const ipv4WithPortMatch = raw.match(/^(\d{1,3}(?:\.\d{1,3}){3}):\d+$/);
+  if (ipv4WithPortMatch?.[1]) raw = ipv4WithPortMatch[1];
+
+  const zoneIndex = raw.indexOf('%');
+  if (zoneIndex > 0) raw = raw.slice(0, zoneIndex);
+
+  if (raw.startsWith('::ffff:') && isIP(raw.slice(7)) === 4) raw = raw.slice(7);
+
+  return isIP(raw) ? raw : '';
+};
+
+const pickFirstValidIpFromCommaList = (value) => {
+  const raw = Array.isArray(value) ? value.join(',') : String(value || '');
+  if (!raw.trim()) return '';
+
+  for (const part of raw.split(',')) {
+    const ip = normalizeIpCandidate(part);
+    if (ip) return ip;
+  }
+
+  return '';
+};
+
+const pickFirstValidIpFromForwardedHeader = (value) => {
+  const raw = Array.isArray(value) ? value.join(',') : String(value || '');
+  if (!raw.trim()) return '';
+
+  const entries = raw.split(',');
+  for (const entry of entries) {
+    const directives = entry.split(';');
+    for (const directive of directives) {
+      const trimmed = String(directive || '').trim();
+      if (!trimmed || !trimmed.toLowerCase().startsWith('for=')) continue;
+      const ip = normalizeIpCandidate(trimmed);
+      if (ip) return ip;
+    }
+  }
+
+  return '';
+};
+
+const shouldTrustForwardedHeaders = (socketIp = '', explicitTrustProxy = undefined) => {
+  if (typeof explicitTrustProxy === 'boolean') return explicitTrustProxy;
+  if (TRUST_PROXY_HEADERS) return true;
+  return LOOPBACK_IPS.has(socketIp);
+};
+
+export const resolveClientIp = (req, { fallback = 'unknown', trustProxy = undefined } = {}) => {
+  const socketIp = normalizeIpCandidate(req?.socket?.remoteAddress);
+
+  if (shouldTrustForwardedHeaders(socketIp, trustProxy)) {
+    const cfConnectingIp = normalizeIpCandidate(req?.headers?.['cf-connecting-ip']);
+    if (cfConnectingIp) return cfConnectingIp;
+
+    const xRealIp = normalizeIpCandidate(req?.headers?.['x-real-ip']);
+    if (xRealIp) return xRealIp;
+
+    const forwardedFor = pickFirstValidIpFromCommaList(req?.headers?.['x-forwarded-for']);
+    if (forwardedFor) return forwardedFor;
+
+    const forwarded = pickFirstValidIpFromForwardedHeader(req?.headers?.forwarded);
+    if (forwarded) return forwarded;
+  }
+
+  if (socketIp) return socketIp;
+  return fallback;
+};

package/server/http/httpRequestUtils.js

@@ -0,0 +1,262 @@
+import { resolveClientIp } from './clientIp.js';
+import { resolveCookieDomainForRequest } from './siteRoutingUtils.js';
+
+const parseEnvBool = (value, fallback = false) => {
+  if (value === undefined || value === null || value === '') return fallback;
+  const normalized = String(value).trim().toLowerCase();
+  if (['1', 'true', 'yes', 'y', 'on'].includes(normalized)) return true;
+  if (['0', 'false', 'no', 'n', 'off'].includes(normalized)) return false;
+  return fallback;
+};
+
+const LOOPBACK_IPS = new Set(['127.0.0.1', '::1', '::ffff:127.0.0.1']);
+
+const shouldTrustForwardedProtoHeader = (req) => {
+  const trustProxyHeaders = parseEnvBool(process.env.APP_TRUST_PROXY, parseEnvBool(process.env.RATE_LIMIT_TRUST_PROXY, false));
+  if (trustProxyHeaders) return true;
+
+  const socketIp = resolveClientIp(req, { fallback: '', trustProxy: false });
+  return LOOPBACK_IPS.has(socketIp);
+};
+
+export const sendJson = (req, res, statusCode, payload) => {
+  const body = JSON.stringify(payload)
+    .replace(/</g, '\\u003c')
+    .replace(/>/g, '\\u003e')
+    .replace(/&/g, '\\u0026')
+    .replace(/\u2028/g, '\\u2028')
+    .replace(/\u2029/g, '\\u2029');
+  res.statusCode = statusCode;
+  res.setHeader('Content-Type', 'application/json; charset=utf-8');
+  res.setHeader('Cache-Control', 'no-store');
+  res.setHeader('X-Robots-Tag', 'noindex, nofollow');
+  if (req.method === 'HEAD') {
+    res.end();
+    return;
+  }
+  res.end(body);
+};
+
+export const sendText = (req, res, statusCode, body, contentType) => {
+  res.statusCode = statusCode;
+  res.setHeader('Content-Type', contentType);
+  if (req.method === 'HEAD') {
+    res.end();
+    return;
+  }
+  res.end(body);
+};
+
+/**
+ * Envia buffer binário (asset estático) com headers básicos de cache.
+ * @param {import('node:http').IncomingMessage} req
+ * @param {import('node:http').ServerResponse} res
+ * @param {Buffer} buffer
+ * @param {string} [mimetype]
+ * @param {string} [cacheControl]
+ * @returns {void}
+ */
+export const sendAsset = (req, res, buffer, mimetype = 'application/octet-stream', cacheControl = 'public, max-age=86400') => {
+  res.statusCode = 200;
+  res.setHeader('Content-Type', mimetype);
+  res.setHeader('Content-Length', String(Buffer.byteLength(buffer)));
+  res.setHeader('Cache-Control', cacheControl);
+  if (req.method === 'HEAD') {
+    res.end();
+    return;
+  }
+  res.end(buffer);
+};
+
+export const parseCookies = (req) => {
+  const raw = String(req?.headers?.cookie || '');
+  if (!raw) return {};
+  return raw.split(';').reduce((acc, chunk) => {
+    const [k, ...rest] = chunk.split('=');
+    const key = String(k || '').trim();
+    if (!key) return acc;
+    const value = rest.join('=').trim();
+    try {
+      acc[key] = decodeURIComponent(value);
+    } catch {
+      acc[key] = value;
+    }
+    return acc;
+  }, {});
+};
+
+export const getCookieValuesFromRequest = (req, cookieName) => {
+  const target = String(cookieName || '').trim();
+  if (!target) return [];
+  const raw = String(req?.headers?.cookie || '');
+  if (!raw) return [];
+
+  const values = [];
+  for (const chunk of raw.split(';')) {
+    const trimmed = String(chunk || '').trim();
+    if (!trimmed) continue;
+    const separatorIndex = trimmed.indexOf('=');
+    if (separatorIndex <= 0) continue;
+    const key = trimmed.slice(0, separatorIndex).trim();
+    if (key !== target) continue;
+    const encodedValue = trimmed.slice(separatorIndex + 1).trim();
+    if (!encodedValue) continue;
+    let decodedValue = encodedValue;
+    try {
+      decodedValue = decodeURIComponent(encodedValue);
+    } catch (error) {
+      if (error) decodedValue = encodedValue;
+    }
+    const normalizedValue = String(decodedValue || '').trim();
+    if (!normalizedValue) continue;
+    if (!values.includes(normalizedValue)) values.push(normalizedValue);
+  }
+  return values;
+};
+
+export const isRequestSecure = (req) => {
+  const socketEncrypted = Boolean(req?.socket?.encrypted);
+  const proto = String(req?.headers?.['x-forwarded-proto'] || '')
+    .split(',')[0]
+    .trim()
+    .toLowerCase();
+  if (proto && shouldTrustForwardedProtoHeader(req)) {
+    return proto === 'https';
+  }
+  return socketEncrypted;
+};
+
+export const resolveRequestRemoteIp = (req) => resolveClientIp(req, { fallback: null });
+
+/**
+ * Converte um valor para string ISO ou null se inválido.
+ * @param {any} value
+ * @returns {string|null}
+ */
+export const toIsoOrNull = (value) => (value ? new Date(value).toISOString() : null);
+
+/**
+ * Formata duração em segundos para HH:MM:SS ou Dd HH:MM:SS.
+ * @param {number} totalSeconds
+ * @returns {string}
+ */
+export const formatDuration = (totalSeconds) => {
+  const total = Math.max(0, Math.floor(Number(totalSeconds) || 0));
+  const days = Math.floor(total / 86400);
+  const hours = Math.floor((total % 86400) / 3600);
+  const minutes = Math.floor((total % 3600) / 60);
+  const seconds = total % 60;
+  const hhmmss = [hours, minutes, seconds].map((value) => String(value).padStart(2, '0')).join(':');
+  return days > 0 ? `${days}d ${hhmmss}` : hhmmss;
+};
+
+/**
+ * Normaliza caminho base garantindo barra inicial e removendo barra final.
+ * @param {string} value
+ * @param {string} fallback
+ * @returns {string}
+ */
+export const normalizeBasePath = (value, fallback) => {
+  const raw = String(value || '').trim() || fallback;
+  const withLeadingSlash = raw.startsWith('/') ? raw : `/${raw}`;
+  const withoutTrailingSlash = withLeadingSlash.length > 1 && withLeadingSlash.endsWith('/') ? withLeadingSlash.slice(0, -1) : withLeadingSlash;
+  return withoutTrailingSlash || fallback;
+};
+
+/**
+ * Envolve uma promessa com um tempo limite.
+ * @param {Promise<any>} promise
+ * @param {number} timeoutMs
+ * @returns {Promise<any>}
+ */
+export const withTimeout = (promise, timeoutMs) =>
+  Promise.race([
+    promise,
+    new Promise((_, reject) => {
+      setTimeout(() => reject(new Error(`timeout_${timeoutMs}ms`)), timeoutMs);
+    }),
+  ]);
+
+export const normalizeCatalogVisibility = (value) => {
+  const normalized = String(value || '')
+    .trim()
+    .toLowerCase();
+  if (normalized === 'all') return 'all';
+  if (normalized === 'unlisted') return 'unlisted';
+  return 'public';
+};
+
+/**
+ * Normaliza o caminho de uma visita web.
+ * @param {string} raw
+ * @returns {string}
+ */
+export const normalizeVisitPath = (raw) => {
+  const normalized = String(raw || '')
+    .trim()
+    .replace(/\s+/g, '')
+    .slice(0, 255);
+  if (!normalized) return '/';
+  return normalized.startsWith('/') ? normalized : `/${normalized}`;
+};
+
+export const appendSetCookie = (res, cookieValue) => {
+  const current = res.getHeader('Set-Cookie');
+  if (!current) {
+    res.setHeader('Set-Cookie', cookieValue);
+    return;
+  }
+  if (Array.isArray(current)) {
+    res.setHeader('Set-Cookie', [...current, cookieValue]);
+    return;
+  }
+  res.setHeader('Set-Cookie', [String(current), cookieValue]);
+};
+
+export const buildCookieString = (name, value, req, options = {}) => {
+  const parts = [`${name}=${encodeURIComponent(String(value ?? ''))}`];
+  parts.push(`Path=${options.path || '/'}`);
+  const cookieDomain = options.domain === false ? '' : String(options.domain || resolveCookieDomainForRequest(req)).trim();
+  if (cookieDomain) parts.push(`Domain=${cookieDomain}`);
+  if (options.httpOnly !== false) parts.push('HttpOnly');
+  parts.push(`SameSite=${options.sameSite || 'Lax'}`);
+  if (isRequestSecure(req)) parts.push('Secure');
+  if (Number.isFinite(options.maxAgeSeconds)) parts.push(`Max-Age=${Math.max(0, Math.floor(options.maxAgeSeconds))}`);
+  return parts.join('; ');
+};
+
+export const readJsonBody = async (req, { maxBytes = 64 * 1024 } = {}) =>
+  new Promise((resolve, reject) => {
+    const chunks = [];
+    let total = 0;
+
+    req.on('data', (chunk) => {
+      total += chunk.length;
+      if (total > maxBytes) {
+        const error = new Error('Payload excedeu limite permitido.');
+        error.statusCode = 413;
+        reject(error);
+        req.destroy();
+        return;
+      }
+      chunks.push(chunk);
+    });
+
+    req.on('end', () => {
+      const raw = Buffer.concat(chunks).toString('utf8').trim();
+      if (!raw) {
+        resolve({});
+        return;
+      }
+
+      try {
+        resolve(JSON.parse(raw));
+      } catch {
+        const error = new Error('JSON invalido.');
+        error.statusCode = 400;
+        reject(error);
+      }
+    });
+
+    req.on('error', (error) => reject(error));
+  });

package/server/http/httpRequestUtils.test.js

@@ -0,0 +1,80 @@
+import assert from 'node:assert/strict';
+import test from 'node:test';
+
+import { isRequestSecure } from './httpRequestUtils.js';
+
+const withEnv = (overrides, fn) => {
+  const previous = new Map();
+  for (const [key, value] of Object.entries(overrides)) {
+    previous.set(key, Object.prototype.hasOwnProperty.call(process.env, key) ? process.env[key] : null);
+    if (value === undefined || value === null) {
+      delete process.env[key];
+    } else {
+      process.env[key] = String(value);
+    }
+  }
+
+  try {
+    return fn();
+  } finally {
+    for (const [key, value] of previous.entries()) {
+      if (value === null) {
+        delete process.env[key];
+      } else {
+        process.env[key] = value;
+      }
+    }
+  }
+};
+
+const buildReq = ({ forwardedProto = '', remoteAddress = '203.0.113.10', encrypted = false } = {}) => ({
+  headers: forwardedProto ? { 'x-forwarded-proto': forwardedProto } : {},
+  socket: {
+    remoteAddress,
+    encrypted,
+  },
+});
+
+test('isRequestSecure ignores x-forwarded-proto for untrusted remote proxy', () => {
+  withEnv({ APP_TRUST_PROXY: 'false', RATE_LIMIT_TRUST_PROXY: 'false' }, () => {
+    const req = buildReq({
+      forwardedProto: 'https',
+      remoteAddress: '203.0.113.42',
+      encrypted: false,
+    });
+    assert.equal(isRequestSecure(req), false);
+  });
+});
+
+test('isRequestSecure accepts x-forwarded-proto over trusted loopback proxy', () => {
+  withEnv({ APP_TRUST_PROXY: 'false', RATE_LIMIT_TRUST_PROXY: 'false' }, () => {
+    const req = buildReq({
+      forwardedProto: 'https',
+      remoteAddress: '127.0.0.1',
+      encrypted: false,
+    });
+    assert.equal(isRequestSecure(req), true);
+  });
+});
+
+test('isRequestSecure accepts x-forwarded-proto when trust proxy is enabled', () => {
+  withEnv({ APP_TRUST_PROXY: 'true', RATE_LIMIT_TRUST_PROXY: 'false' }, () => {
+    const req = buildReq({
+      forwardedProto: 'https',
+      remoteAddress: '198.51.100.5',
+      encrypted: false,
+    });
+    assert.equal(isRequestSecure(req), true);
+  });
+});
+
+test('isRequestSecure falls back to socket encryption without trusted forwarded proto', () => {
+  withEnv({ APP_TRUST_PROXY: 'false', RATE_LIMIT_TRUST_PROXY: 'false' }, () => {
+    const req = buildReq({
+      forwardedProto: 'http',
+      remoteAddress: '198.51.100.5',
+      encrypted: true,
+    });
+    assert.equal(isRequestSecure(req), true);
+  });
+});

package/server/http/httpServer.js

@@ -0,0 +1,180 @@
+import http from 'node:http';
+
+import logger from '#logger';
+import { getMetricsServerConfig, isMetricsEnabled, recordHttpRequest, resolveRouteGroup } from '../../app/observability/metrics.js';
+import { applyCachePolicy } from '../middleware/cachePolicy.js';
+import { applySensitiveRouteRateLimit } from '../middleware/endpointRateLimit.js';
+import { applySecurityHeaders } from '../middleware/securityHeaders.js';
+import { getIndexRouteConfigs, routeRequest } from '../routes/indexRouter.js';
+import { parseRequestUrl, normalizeRequestId } from './requestContext.js';
+
+let server = null;
+let serverStarted = false;
+
+const sanitizePathForLogs = (pathname) => {
+  const rawPath = String(pathname || '').trim();
+  if (!rawPath) return null;
+
+  const marker = '/auth/password/recovery/session/';
+  const lower = rawPath.toLowerCase();
+  const markerIndex = lower.indexOf(marker);
+  if (markerIndex < 0) return rawPath;
+
+  const tokenStart = markerIndex + marker.length;
+  const suffix = rawPath.slice(tokenStart);
+  const nextSlashIndex = suffix.indexOf('/');
+  if (nextSlashIndex < 0) {
+    const rawSegment = String(suffix || '')
+      .trim()
+      .toLowerCase();
+    if (rawSegment === 'request' || rawSegment === 'verify') {
+      return rawPath;
+    }
+    return `${rawPath.slice(0, tokenStart)}[redacted]`;
+  }
+  return `${rawPath.slice(0, tokenStart)}[redacted]${suffix.slice(nextSlashIndex)}`;
+};
+
+export const startHttpServer = () => {
+  if (!isMetricsEnabled() || serverStarted) return;
+
+  const { host, port, path: metricsPath } = getMetricsServerConfig();
+
+  server = http.createServer(async (req, res) => {
+    const requestStartedAt = Date.now();
+    const requestId = normalizeRequestId(req.headers['x-request-id']);
+    res.setHeader('X-Request-Id', requestId);
+
+    const parsedUrl = parseRequestUrl(req, host, port);
+    const pathname = parsedUrl.pathname;
+
+    let routeConfigs = null;
+    try {
+      routeConfigs = await getIndexRouteConfigs();
+    } catch (error) {
+      logger.error('Erro ao carregar configuracao de rotas.', {
+        error: error?.message,
+      });
+    }
+
+    let routeGroup = resolveRouteGroup({
+      pathname,
+      metricsPath,
+      catalogConfig: routeConfigs?.stickerConfig || null,
+      userConfig: routeConfigs?.userConfig || null,
+      systemAdminConfig: routeConfigs?.systemAdminConfig || null,
+    });
+
+    res.once('finish', () => {
+      recordHttpRequest({
+        durationMs: Date.now() - requestStartedAt,
+        method: req.method,
+        statusCode: res.statusCode,
+        routeGroup,
+      });
+    });
+
+    try {
+      applySecurityHeaders(req, res);
+      applyCachePolicy(req, res, { pathname });
+      const allowedByRateLimit = await applySensitiveRouteRateLimit(req, res, { pathname });
+      if (!allowedByRateLimit) return;
+
+      await routeRequest(req, res, {
+        pathname,
+        url: parsedUrl,
+        metricsPath,
+        configs: routeConfigs,
+      });
+
+      routeGroup = resolveRouteGroup({
+        pathname,
+        metricsPath,
+        catalogConfig: routeConfigs?.stickerConfig || null,
+        userConfig: routeConfigs?.userConfig || null,
+        systemAdminConfig: routeConfigs?.systemAdminConfig || null,
+      });
+    } catch (error) {
+      logger.error('Falha ao processar request HTTP.', {
+        path: sanitizePathForLogs(pathname),
+        method: req.method,
+        error: error?.message,
+      });
+
+      if (!res.writableEnded) {
+        res.statusCode = 500;
+        res.setHeader('Content-Type', 'application/json; charset=utf-8');
+        res.end(JSON.stringify({ error: 'Internal Server Error' }));
+      }
+    }
+  });
+
+  server.listen(port, host, () => {
+    serverStarted = true;
+    logger.info('Servidor HTTP iniciado', {
+      host,
+      port,
+      metrics_path: metricsPath,
+    });
+
+    getIndexRouteConfigs()
+      .then(({ userConfig, systemAdminConfig, stickerConfig }) => {
+        if (userConfig?.webPath) {
+          logger.info('Rotas web de usuario habilitadas', {
+            web_path: userConfig.webPath,
+            api_base_path: userConfig.apiBasePath,
+            host,
+            port,
+          });
+        }
+
+        if (systemAdminConfig?.webPath) {
+          logger.info('Rotas system admin habilitadas', {
+            web_path: systemAdminConfig.webPath,
+            legacy_web_path: systemAdminConfig.legacyWebPath,
+            api_admin_base_path: systemAdminConfig.apiAdminBasePath,
+            host,
+            port,
+          });
+        }
+
+        if (stickerConfig?.enabled && stickerConfig?.webPath) {
+          logger.info('Catalogo web de sticker packs habilitado', {
+            web_path: stickerConfig.webPath,
+            api_base_path: stickerConfig.apiBasePath,
+            orphan_api_path: stickerConfig.orphanApiPath,
+            data_public_path: stickerConfig.dataPublicPath,
+            data_public_dir: stickerConfig.dataPublicDir,
+            host,
+            port,
+          });
+        }
+      })
+      .catch((error) => {
+        logger.warn('Nao foi possivel carregar configuracao das rotas na inicializacao.', {
+          error: error?.message,
+        });
+      });
+  });
+
+  server.on('error', (error) => {
+    logger.error('Falha ao iniciar servidor HTTP', { error: error?.message });
+  });
+};
+
+export const stopHttpServer = async () => {
+  if (!serverStarted || !server) return;
+
+  const current = server;
+  server = null;
+  serverStarted = false;
+  await new Promise((resolve, reject) => {
+    current.close((error) => {
+      if (error) {
+        reject(error);
+        return;
+      }
+      resolve();
+    });
+  });
+};

package/server/http/requestContext.js

@@ -0,0 +1,20 @@
+import { randomUUID } from 'node:crypto';
+import { URL } from 'node:url';
+
+export const normalizeRequestId = (value) => {
+  const token = String(value || '')
+    .trim()
+    .replace(/[^a-zA-Z0-9._:-]/g, '')
+    .slice(0, 120);
+  return token || randomUUID();
+};
+
+export const parseRequestUrl = (req, host, port) => {
+  const fallbackHost = `${host}:${port}`;
+  const requestHost = req.headers.host || fallbackHost;
+  try {
+    return new URL(req.url || '/', `http://${requestHost}`);
+  } catch {
+    return new URL(req.url || '/', 'http://localhost');
+  }
+};