@oondemand/oon-core-back 0.2.0 → 0.3.0

package/src/core/utils/instanceActivation.js

@@ -0,0 +1,477 @@
+const crypto = require("node:crypto");
+const mongoose = require("mongoose");
+const axios = require("axios");
+const ctx = require("../context");
+const GenericError = require("../errors/GenericError");
+const Instancia = require("../models/InstanciaEcossistema");
+const { getBaseUrl, getAppCode, getTimeout } = require("./activationProvider");
+
+const PATHS = {
+  validar: "/integracao/ativacao-instancias/validar-codigo",
+  ativar: "/integracao/ativacao-instancias/ativar",
+  concluir: "/integracao/ativacao-instancias/concluir",
+  contexto: "/integracao/ativacao-instancias/contexto",
+  heartbeat: "/integracao/ativacao-instancias/heartbeat",
+};
+
+const globalDefaults = {
+  idioma: "pt-BR",
+  timezone: "America/Sao_Paulo",
+  moeda: "BRL",
+  pais: "BR",
+  formatoData: "DD/MM/YYYY",
+};
+
+const globalFields = [
+  {
+    name: "nomeInstancia",
+    label: "Nome da instância",
+    type: "text",
+    required: true,
+  },
+  {
+    name: "ambiente",
+    label: "Ambiente",
+    type: "select",
+    required: true,
+    readOnly: true,
+    options: ["desenvolvimento", "homologacao", "producao"],
+  },
+  {
+    name: "urlPublica",
+    label: "URL pública",
+    type: "url",
+    required: true,
+  },
+  {
+    name: "idioma",
+    label: "Idioma",
+    type: "text",
+    required: true,
+    defaultValue: "pt-BR",
+  },
+  {
+    name: "timezone",
+    label: "Timezone",
+    type: "text",
+    required: true,
+    defaultValue: "America/Sao_Paulo",
+  },
+  {
+    name: "moeda",
+    label: "Moeda",
+    type: "text",
+    required: true,
+    defaultValue: "BRL",
+  },
+  {
+    name: "pais",
+    label: "País",
+    type: "text",
+    required: true,
+    defaultValue: "BR",
+  },
+  {
+    name: "formatoData",
+    label: "Formato de data",
+    type: "text",
+    required: true,
+    defaultValue: "DD/MM/YYYY",
+  },
+  {
+    name: "emailAdministrativo",
+    label: "E-mail administrativo",
+    type: "email",
+    required: true,
+  },
+];
+
+const rootFields = [
+  {
+    name: "email",
+    label: "E-mail do administrador",
+    type: "email",
+    required: true,
+    autoComplete: "email",
+  },
+  {
+    name: "senha",
+    label: "Senha",
+    type: "password",
+    required: true,
+    minLength: 8,
+    sensitive: true,
+    autoComplete: "new-password",
+  },
+];
+
+function role() {
+  return ctx.config.ecosystem?.role === "root" ? "root" : "member";
+}
+
+function ambiente() {
+  const value =
+    process.env.APP_ENVIRONMENT || process.env.NODE_ENV || "desenvolvimento";
+  return ["desenvolvimento", "homologacao", "producao"].includes(value)
+    ? value
+    : "desenvolvimento";
+}
+
+function publicUrl(req) {
+  return (
+    process.env.PUBLIC_APP_URL ||
+    `${req?.protocol || "http"}://${req?.headers?.host || "localhost"}`
+  );
+}
+
+function version() {
+  return (
+    ctx.config.serviceVersion || process.env.npm_package_version || "0.0.0"
+  );
+}
+
+function fingerprint() {
+  return crypto
+    .createHash("sha256")
+    .update(
+      `${getAppCode()}|${publicUrl()}|${process.env.HOSTNAME || "local"}`,
+    )
+    .digest("hex");
+}
+
+function event(name, data = {}) {
+  console.log(
+    JSON.stringify({ event: name, ...data, at: new Date().toISOString() }),
+  );
+}
+
+function sanitizeFields(fields = []) {
+  return fields.map(
+    ({
+      name,
+      label,
+      type,
+      required,
+      defaultValue,
+      placeholder,
+      helpText,
+      section,
+      options,
+      min,
+      max,
+      minLength,
+      maxLength,
+      pattern,
+      sensitive,
+      visibleWhen,
+      readOnly,
+      autoComplete,
+    }) => ({
+      name,
+      label,
+      type,
+      required: Boolean(required),
+      defaultValue: ["password", "secret"].includes(type)
+        ? undefined
+        : defaultValue,
+      placeholder,
+      helpText,
+      section,
+      options,
+      min,
+      max,
+      minLength,
+      maxLength,
+      pattern,
+      sensitive:
+        Boolean(sensitive) || ["password", "secret"].includes(type),
+      visibleWhen,
+      readOnly,
+      autoComplete,
+    }),
+  );
+}
+
+function activationConfig() {
+  return {
+    enabled: ctx.config.activation?.enabled !== false,
+    configurationVersion:
+      ctx.config.activation?.configurationVersion || 1,
+    fields: ctx.config.activation?.fields || [],
+    hooks: ctx.config.activation || {},
+    rootBootstrap: ctx.config.activation?.rootBootstrap,
+  };
+}
+
+async function domainHasActiveRootApp() {
+  const hasActiveRootApp = ctx.config.activation?.hasActiveRootApp;
+  if (typeof hasActiveRootApp !== "function") return null;
+  return Boolean(await hasActiveRootApp());
+}
+
+function clearInstanceIdentity(instance) {
+  instance.instanceId = undefined;
+  instance.instanceCode = undefined;
+  instance.appId = undefined;
+  instance.tenantId = undefined;
+  instance.licencaId = undefined;
+  instance.credentialEncrypted = undefined;
+  instance.credentialIv = undefined;
+  instance.credentialAuthTag = undefined;
+}
+
+async function ensureInstance() {
+  if (mongoose.connection.readyState !== 1) {
+    return {
+      ecosystemRole: role(),
+      status: "ativa",
+      appCode: getAppCode(),
+      ambiente: ambiente(),
+      save: async () => {},
+    };
+  }
+
+  let instance = await Instancia.findOne().select(
+    "+credentialEncrypted +credentialIv +credentialAuthTag",
+  );
+
+  if (!instance) {
+    instance = await Instancia.create({
+      ecosystemRole: role(),
+      status: "nao_ativada",
+      appCode: getAppCode(),
+      ambiente: ambiente(),
+      ecosystemUrl: process.env.CENTRAL_ATIVACAO_URL,
+      publicUrl: process.env.PUBLIC_APP_URL,
+      coreVersion: version(),
+      appVersion: version(),
+    });
+  }
+
+  if (instance.ecosystemRole !== role()) {
+    instance.ecosystemRole = role();
+    instance.status = "nao_ativada";
+    clearInstanceIdentity(instance);
+    await instance.save();
+  }
+
+  // Versões anteriores do Core marcavam a aplicação root como ativa sem criar
+  // o App root e o grafo mínimo do ecossistema. Quando o domínio disponibiliza
+  // o verificador, o App cadastrado passa a ser a fonte de verdade.
+  if (instance.ecosystemRole === "root" && instance.status === "ativa") {
+    const domainActive = await domainHasActiveRootApp();
+    if (domainActive === false) {
+      instance.status = "nao_ativada";
+      clearInstanceIdentity(instance);
+      await instance.save();
+    }
+  }
+
+  return instance;
+}
+
+async function hasActiveRootInstance() {
+  if (mongoose.connection.readyState !== 1) return false;
+
+  const domainActive = await domainHasActiveRootApp();
+  if (domainActive !== null) return domainActive;
+
+  return Boolean(
+    await Instancia.exists({ ecosystemRole: "root", status: "ativa" }),
+  );
+}
+
+async function claimRootBootstrap() {
+  if (role() !== "root") {
+    throw new GenericError(
+      "Somente uma aplicação root pode executar o bootstrap do ecossistema.",
+      { statusCode: 400 },
+    );
+  }
+
+  await ensureInstance();
+
+  if (await hasActiveRootInstance()) {
+    throw new GenericError("Já existe um aplicativo root ativo.", {
+      statusCode: 409,
+    });
+  }
+
+  const staleBefore = new Date(Date.now() - 5 * 60 * 1000);
+  const instance = await Instancia.findOneAndUpdate(
+    {
+      singletonKey: "default",
+      ecosystemRole: "root",
+      $or: [
+        { status: { $in: ["nao_ativada", "erro"] } },
+        { status: "configurando", updatedAt: { $lt: staleBefore } },
+      ],
+    },
+    {
+      $set: {
+        status: "configurando",
+        ultimoErro: null,
+      },
+    },
+    { new: true },
+  ).select("+credentialEncrypted +credentialIv +credentialAuthTag");
+
+  if (!instance) {
+    throw new GenericError(
+      "A ativação root já está em andamento ou não pode ser iniciada.",
+      { statusCode: 409 },
+    );
+  }
+
+  return instance;
+}
+
+function validateRootCredentials(email, password) {
+  const normalizedEmail = String(email || "").trim().toLowerCase();
+  const normalizedPassword = String(password || "");
+
+  if (!/^\S+@\S+\.\S+$/.test(normalizedEmail)) {
+    throw new GenericError("Informe um e-mail válido.", { statusCode: 400 });
+  }
+
+  if (normalizedPassword.length < 8) {
+    throw new GenericError("A senha deve possuir pelo menos 8 caracteres.", {
+      statusCode: 400,
+    });
+  }
+
+  return { email: normalizedEmail, password: normalizedPassword };
+}
+
+function key() {
+  const raw = process.env.INSTANCE_CREDENTIAL_ENCRYPTION_KEY;
+  if (!raw && ambiente() === "producao") {
+    throw new GenericError(
+      "INSTANCE_CREDENTIAL_ENCRYPTION_KEY é obrigatória em produção.",
+      { statusCode: 500 },
+    );
+  }
+  const source = raw || "oon-dev-instance-credential-key-change-me";
+  return crypto.createHash("sha256").update(source).digest();
+}
+
+function encrypt(token) {
+  const iv = crypto.randomBytes(12);
+  const cipher = crypto.createCipheriv("aes-256-gcm", key(), iv);
+  const encrypted = Buffer.concat([
+    cipher.update(token, "utf8"),
+    cipher.final(),
+  ]);
+  return {
+    credentialEncrypted: encrypted.toString("base64"),
+    credentialIv: iv.toString("base64"),
+    credentialAuthTag: cipher.getAuthTag().toString("base64"),
+  };
+}
+
+function decrypt(instance) {
+  if (!instance.credentialEncrypted) {
+    throw new GenericError("Credencial da instância indisponível.", {
+      statusCode: 423,
+    });
+  }
+  const decipher = crypto.createDecipheriv(
+    "aes-256-gcm",
+    key(),
+    Buffer.from(instance.credentialIv, "base64"),
+  );
+  decipher.setAuthTag(Buffer.from(instance.credentialAuthTag, "base64"));
+  return Buffer.concat([
+    decipher.update(Buffer.from(instance.credentialEncrypted, "base64")),
+    decipher.final(),
+  ]).toString("utf8");
+}
+
+function instanceHeaders(instance) {
+  return {
+    "x-oon-instance-id": instance.instanceId,
+    "x-oon-instance-token": decrypt(instance),
+    "x-app-code": getAppCode(),
+  };
+}
+
+function validateUrl(value) {
+  const url = new URL(value);
+  if (!["http:", "https:"].includes(url.protocol)) throw new Error();
+  return url.toString().replace(/\/$/, "");
+}
+
+function validateParams(globalParameters = {}, appParameters = {}) {
+  for (const field of globalFields) {
+    if (
+      field.required &&
+      !globalParameters[field.name] &&
+      !["ambiente"].includes(field.name)
+    ) {
+      throw new GenericError(`Campo obrigatório: ${field.label}.`, {
+        statusCode: 400,
+      });
+    }
+  }
+
+  validateUrl(
+    globalParameters.urlPublica ||
+      process.env.PUBLIC_APP_URL ||
+      "http://localhost",
+  );
+
+  for (const field of activationConfig().fields) {
+    if (field.required && !appParameters[field.name]) {
+      throw new GenericError(
+        `Campo obrigatório: ${field.label || field.name}.`,
+        { statusCode: 400 },
+      );
+    }
+  }
+}
+
+async function providerPost(req, path, payload, headers = {}) {
+  return axios.post(`${getBaseUrl(req)}${path}`, payload, {
+    timeout: getTimeout(),
+    maxRedirects: 0,
+    headers: { "Content-Type": "application/json", ...headers },
+  });
+}
+
+function providerPayload(req, codigoAtivacao, extra = {}) {
+  return {
+    codigoAtivacao,
+    appCode: getAppCode(),
+    ambiente: ambiente(),
+    urlPublica: publicUrl(req),
+    coreVersion: version(),
+    appVersion: version(),
+    fingerprint: fingerprint(),
+    ...extra,
+  };
+}
+
+module.exports = {
+  PATHS,
+  globalDefaults,
+  globalFields,
+  rootFields,
+  role,
+  ambiente,
+  publicUrl,
+  version,
+  fingerprint,
+  sanitizeFields,
+  activationConfig,
+  ensureInstance,
+  hasActiveRootInstance,
+  claimRootBootstrap,
+  validateRootCredentials,
+  encrypt,
+  decrypt,
+  instanceHeaders,
+  validateParams,
+  providerPost,
+  providerPayload,
+  event,
+};

package/src/deploy/render.js

@@ -33,7 +33,10 @@ const DEFAULTS = {
   JWT_SECRET: "",
   OMIE_APP_KEY: "",
   OMIE_APP_SECRET: "",
+  CENTRAL_ATIVACAO_URL: "",
   MEUS_APPS_BACKEND_URL: "",
+  APP_CODE: "",
+  AUTH_PROVIDER_TIMEOUT_MS: "10000",
 };
 
 const K8S_TEMPLATES = [

package/src/deploy/templates/configmap.yaml

@@ -13,4 +13,7 @@ data:
   DB_AUTH_SOURCE: "${DB_AUTH_SOURCE}"
   DB_REPLICA_SET: "${DB_REPLICA_SET}"
   DB_TSL: "${DB_TSL}"
+  CENTRAL_ATIVACAO_URL: "${CENTRAL_ATIVACAO_URL}"
   MEUS_APPS_BACKEND_URL: "${MEUS_APPS_BACKEND_URL}"
+  APP_CODE: "${APP_CODE}"
+  AUTH_PROVIDER_TIMEOUT_MS: "${AUTH_PROVIDER_TIMEOUT_MS}"