@oondemand/oon-core-back 0.5.5 → 0.6.0

package/src/modules/omie/models.js

@@ -1,377 +0,0 @@
-"use strict";
-
-const crypto = require("node:crypto");
-const mongoose = require("mongoose");
-const GenericError = require("../../core/errors/GenericError");
-
-const SECRET_PREFIX = "oon:v1";
-const DEFAULT_BASE_URL = "https://app.omie.com.br/api/v1";
-
-function encryptionSecret() {
-  return String(
-    process.env.OON_CREDENTIALS_ENCRYPTION_KEY
-    || process.env.INSTANCE_CREDENTIAL_ENCRYPTION_KEY
-    || process.env.OMIE_CREDENTIALS_ENCRYPTION_KEY
-    || "",
-  ).trim();
-}
-
-function encryptionKey() {
-  const secret = encryptionSecret();
-  if (!secret) {
-    throw new GenericError(
-      "Configure OON_CREDENTIALS_ENCRYPTION_KEY ou disponibilize INSTANCE_CREDENTIAL_ENCRYPTION_KEY para persistir credenciais Omie.",
-      { statusCode: 503 },
-    );
-  }
-  return crypto.createHash("sha256").update(secret).digest();
-}
-
-function encryptSecret(value) {
-  const clear = String(value || "");
-  if (!clear) return "";
-  const iv = crypto.randomBytes(12);
-  const cipher = crypto.createCipheriv("aes-256-gcm", encryptionKey(), iv);
-  const encrypted = Buffer.concat([cipher.update(clear, "utf8"), cipher.final()]);
-  const tag = cipher.getAuthTag();
-  return [SECRET_PREFIX, iv.toString("base64url"), tag.toString("base64url"), encrypted.toString("base64url")].join(":");
-}
-
-function decryptSecret(value) {
-  const encrypted = String(value || "");
-  if (!encrypted) return "";
-  const [namespace, version, ivValue, tagValue, payloadValue] = encrypted.split(":");
-  if (`${namespace}:${version}` !== SECRET_PREFIX || !ivValue || !tagValue || !payloadValue) {
-    throw new GenericError("Credencial Omie armazenada em formato inválido.", { statusCode: 500 });
-  }
-  const decipher = crypto.createDecipheriv(
-    "aes-256-gcm",
-    encryptionKey(),
-    Buffer.from(ivValue, "base64url"),
-  );
-  decipher.setAuthTag(Buffer.from(tagValue, "base64url"));
-  return Buffer.concat([
-    decipher.update(Buffer.from(payloadValue, "base64url")),
-    decipher.final(),
-  ]).toString("utf8");
-}
-
-function maskSecret(value) {
-  const clear = String(value || "");
-  if (!clear) return "";
-  if (clear.length <= 4) return "••••";
-  return `${clear.slice(0, 2)}${"•".repeat(Math.min(8, clear.length - 4))}${clear.slice(-2)}`;
-}
-
-function generateWebhookToken() {
-  return crypto.randomBytes(32).toString("base64url");
-}
-
-function normalizeInstanceId(value) {
-  const instanceId = String(value || "default").trim().toLowerCase();
-  if (!/^[a-z0-9][a-z0-9._-]*$/.test(instanceId)) {
-    throw new GenericError("Identificador da instância Omie inválido.", { statusCode: 422 });
-  }
-  return instanceId;
-}
-
-function configurationSchema() {
-  const schema = new mongoose.Schema({
-    instanceId: { type: String, required: true, unique: true, index: true },
-    label: { type: String, required: true, default: "Omie" },
-    active: { type: Boolean, default: true, index: true },
-    environment: { type: String, enum: ["homologation", "production"], default: "production" },
-    baseUrl: { type: String, required: true, default: DEFAULT_BASE_URL },
-    appKeyEncrypted: { type: String, default: "", select: false },
-    appSecretEncrypted: { type: String, default: "", select: false },
-    webhookTokenEncrypted: { type: String, default: "", select: false },
-    appKeyMasked: { type: String, default: "" },
-    credentialsConfigured: { type: Boolean, default: false },
-    webhookConfigured: { type: Boolean, default: false },
-    connectionStatus: { type: String, enum: ["not-tested", "ok", "error"], default: "not-tested" },
-    lastConnectionError: { type: String, default: "" },
-    lastConnectionTestAt: { type: Date, default: null },
-  }, { timestamps: true, minimize: false, strict: true });
-  return schema;
-}
-
-function listStateSchema() {
-  const schema = new mongoose.Schema({
-    provider: { type: String, default: "omie", index: true },
-    instanceId: { type: String, required: true, index: true },
-    listKey: { type: String, required: true, index: true },
-    status: { type: String, default: "not-run", index: true },
-    cursor: { type: mongoose.Schema.Types.Mixed, default: null },
-    lastStartedAt: { type: Date, default: null },
-    lastCompletedAt: { type: Date, default: null },
-    summary: { type: mongoose.Schema.Types.Mixed, default: {} },
-    diagnostic: { type: mongoose.Schema.Types.Mixed, default: {} },
-  }, { timestamps: true, minimize: false, strict: true });
-  schema.index({ provider: 1, instanceId: 1, listKey: 1 }, { unique: true });
-  return schema;
-}
-
-function getOmieModels() {
-  return {
-    Configuration: mongoose.models.OonOmieConfiguration
-      || mongoose.model("OonOmieConfiguration", configurationSchema(), "oon_omie_configurations"),
-    ListState: mongoose.models.OonOmieListState
-      || mongoose.model("OonOmieListState", listStateSchema(), "oon_omie_list_states"),
-  };
-}
-
-function instanceEnvPrefix(instanceId) {
-  return normalizeInstanceId(instanceId).replace(/[^a-z0-9]/g, "_").toUpperCase();
-}
-
-function environmentCredentials(instanceId) {
-  const normalized = normalizeInstanceId(instanceId);
-  const prefix = instanceEnvPrefix(normalized);
-  const specific = normalized === "default" ? "OMIE" : `OMIE_${prefix}`;
-  return {
-    appKey: String(process.env[`${specific}_APP_KEY`] || "").trim(),
-    appSecret: String(process.env[`${specific}_APP_SECRET`] || "").trim(),
-    webhookToken: String(process.env[`${specific}_WEBHOOK_TOKEN`] || "").trim(),
-    baseUrl: String(process.env[`${specific}_BASE_URL`] || process.env.API_OMIE || DEFAULT_BASE_URL).trim(),
-  };
-}
-
-function publicConfiguration(document) {
-  if (!document) return null;
-  const value = typeof document.toObject === "function" ? document.toObject() : { ...document };
-  value.webhookConfigured = Boolean(value.webhookConfigured || value.webhookTokenEncrypted);
-  delete value.appKeyEncrypted;
-  delete value.appSecretEncrypted;
-  delete value.webhookTokenEncrypted;
-  return value;
-}
-
-async function listOmieConfigurations() {
-  const { Configuration } = getOmieModels();
-  const persisted = await Configuration.find({})
-    .select("+webhookTokenEncrypted")
-    .sort({ label: 1, instanceId: 1 })
-    .lean();
-  if (persisted.length) return persisted.map(publicConfiguration);
-  const env = environmentCredentials("default");
-  return [{
-    instanceId: "default",
-    label: "Omie",
-    active: true,
-    environment: "production",
-    baseUrl: env.baseUrl,
-    appKeyMasked: maskSecret(env.appKey),
-    credentialsConfigured: Boolean(env.appKey && env.appSecret),
-    webhookConfigured: Boolean(env.webhookToken),
-    connectionStatus: "not-tested",
-    lastConnectionError: "",
-    lastConnectionTestAt: null,
-    source: "environment",
-  }];
-}
-
-async function saveOmieConfiguration(instanceId, input = {}) {
-  const normalized = normalizeInstanceId(instanceId);
-  const { Configuration } = getOmieModels();
-  const current = await Configuration.findOne({ instanceId: normalized })
-    .select("+appKeyEncrypted +appSecretEncrypted +webhookTokenEncrypted");
-  const update = {
-    instanceId: normalized,
-    label: String(input.label || current?.label || (normalized === "default" ? "Omie" : normalized)).trim(),
-    active: input.active !== undefined ? Boolean(input.active) : (current?.active ?? true),
-    environment: ["homologation", "production"].includes(input.environment)
-      ? input.environment
-      : (current?.environment || "production"),
-    baseUrl: String(input.baseUrl || current?.baseUrl || environmentCredentials(normalized).baseUrl || DEFAULT_BASE_URL)
-      .trim()
-      .replace(/\/+$/, ""),
-  };
-
-  const appKey = String(input.appKey || "").trim();
-  const appSecret = String(input.appSecret || "").trim();
-  const webhookToken = String(input.webhookToken || "").trim();
-  const env = environmentCredentials(normalized);
-  if (appKey) {
-    update.appKeyEncrypted = encryptSecret(appKey);
-    update.appKeyMasked = maskSecret(appKey);
-  } else if (current?.appKeyEncrypted) {
-    update.appKeyEncrypted = current.appKeyEncrypted;
-    update.appKeyMasked = current.appKeyMasked;
-  }
-  if (appSecret) update.appSecretEncrypted = encryptSecret(appSecret);
-  else if (current?.appSecretEncrypted) update.appSecretEncrypted = current.appSecretEncrypted;
-
-  const effectiveWebhookToken = webhookToken
-    || (current?.webhookTokenEncrypted ? decryptSecret(current.webhookTokenEncrypted) : env.webhookToken)
-    || generateWebhookToken();
-  update.webhookTokenEncrypted = encryptSecret(effectiveWebhookToken);
-  update.webhookConfigured = true;
-  const effectiveKey = appKey || (current?.appKeyEncrypted ? decryptSecret(current.appKeyEncrypted) : env.appKey);
-  const effectiveSecret = appSecret
-    || (current?.appSecretEncrypted ? decryptSecret(current.appSecretEncrypted) : env.appSecret);
-  update.credentialsConfigured = Boolean(effectiveKey && effectiveSecret);
-  if (update.active && !update.credentialsConfigured) {
-    throw new GenericError(
-      "Configure App Key e App Secret antes de ativar a integração Omie.",
-      { statusCode: 422 },
-    );
-  }
-  if (appKey || appSecret || input.baseUrl) {
-    update.connectionStatus = "not-tested";
-    update.lastConnectionError = "";
-    update.lastConnectionTestAt = null;
-  }
-
-  const saved = await Configuration.findOneAndUpdate(
-    { instanceId: normalized },
-    { $set: update },
-    { upsert: true, new: true, setDefaultsOnInsert: true, runValidators: true },
-  ).lean();
-  return publicConfiguration(saved);
-}
-
-async function resolveOmieConfiguration(instanceId = "default", options = {}) {
-  const normalized = normalizeInstanceId(instanceId);
-  const { Configuration } = getOmieModels();
-  let query = Configuration.findOne({ instanceId: normalized });
-  if (options.includeSecrets) {
-    query = query.select("+appKeyEncrypted +appSecretEncrypted +webhookTokenEncrypted");
-  }
-  const persisted = await query.lean();
-  const env = environmentCredentials(normalized);
-  if (!persisted) {
-    return {
-      instanceId: normalized,
-      label: normalized === "default" ? "Omie" : normalized,
-      active: true,
-      environment: "production",
-      baseUrl: env.baseUrl,
-      appKey: options.includeSecrets ? env.appKey : undefined,
-      appSecret: options.includeSecrets ? env.appSecret : undefined,
-      webhookToken: options.includeSecrets ? env.webhookToken : undefined,
-      appKeyMasked: maskSecret(env.appKey),
-      credentialsConfigured: Boolean(env.appKey && env.appSecret),
-      webhookConfigured: Boolean(env.webhookToken),
-      connectionStatus: "not-tested",
-      source: "environment",
-    };
-  }
-  const result = publicConfiguration(persisted);
-  if (options.includeSecrets) {
-    result.appKey = persisted.appKeyEncrypted ? decryptSecret(persisted.appKeyEncrypted) : env.appKey;
-    result.appSecret = persisted.appSecretEncrypted ? decryptSecret(persisted.appSecretEncrypted) : env.appSecret;
-    result.webhookToken = persisted.webhookTokenEncrypted
-      ? decryptSecret(persisted.webhookTokenEncrypted)
-      : env.webhookToken;
-  }
-  return result;
-}
-
-async function ensureOmieWebhookAccess(instanceId = "default", options = {}) {
-  const normalized = normalizeInstanceId(instanceId);
-  const rotate = Boolean(options.rotate);
-  const { Configuration } = getOmieModels();
-  const env = environmentCredentials(normalized);
-  const current = await Configuration.findOne({ instanceId: normalized })
-    .select("+appKeyEncrypted +appSecretEncrypted +webhookTokenEncrypted");
-
-  let token = !rotate && current?.webhookTokenEncrypted
-    ? decryptSecret(current.webhookTokenEncrypted)
-    : (!rotate ? env.webhookToken : "");
-  if (!token) token = generateWebhookToken();
-
-  if (!current) {
-    await saveOmieConfiguration(normalized, {
-      label: normalized === "default" ? "Omie" : normalized,
-      active: Boolean(env.appKey && env.appSecret),
-      baseUrl: env.baseUrl,
-      ...(env.appKey ? { appKey: env.appKey } : {}),
-      ...(env.appSecret ? { appSecret: env.appSecret } : {}),
-      webhookToken: token,
-    });
-  } else if (rotate || !current.webhookTokenEncrypted) {
-    await Configuration.updateOne(
-      { instanceId: normalized },
-      {
-        $set: {
-          webhookTokenEncrypted: encryptSecret(token),
-          webhookConfigured: true,
-        },
-      },
-    );
-  } else if (!current.webhookConfigured) {
-    await Configuration.updateOne(
-      { instanceId: normalized },
-      { $set: { webhookConfigured: true } },
-    );
-  }
-
-  return {
-    instanceId: normalized,
-    webhookConfigured: true,
-    rotated: rotate,
-    webhookPath: `/integrations/webhooks/omie/${encodeURIComponent(token)}`,
-  };
-}
-
-async function rotateOmieWebhookToken(instanceId = "default") {
-  return ensureOmieWebhookAccess(instanceId, { rotate: true });
-}
-
-async function updateConnectionStatus(instanceId, result = {}) {
-  const normalized = normalizeInstanceId(instanceId);
-  const { Configuration } = getOmieModels();
-  await Configuration.updateOne(
-    { instanceId: normalized },
-    {
-      $set: {
-        connectionStatus: result.ok ? "ok" : "error",
-        lastConnectionError: result.ok ? "" : String(result.error || "Falha na conexão."),
-        lastConnectionTestAt: new Date(),
-      },
-    },
-  );
-}
-
-async function resolveInstanceByWebhookToken(token) {
-  const candidate = String(token || "");
-  if (!candidate) return null;
-  const { Configuration } = getOmieModels();
-  const configurations = await Configuration.find({ active: true })
-    .select("+webhookTokenEncrypted")
-    .lean();
-  for (const configuration of configurations) {
-    if (!configuration.webhookTokenEncrypted) continue;
-    const expected = decryptSecret(configuration.webhookTokenEncrypted);
-    const left = Buffer.from(candidate);
-    const right = Buffer.from(expected);
-    if (left.length === right.length && crypto.timingSafeEqual(left, right)) {
-      return configuration.instanceId;
-    }
-  }
-  const env = environmentCredentials("default");
-  if (env.webhookToken) {
-    const left = Buffer.from(candidate);
-    const right = Buffer.from(env.webhookToken);
-    if (left.length === right.length && crypto.timingSafeEqual(left, right)) return "default";
-  }
-  return null;
-}
-
-module.exports = {
-  DEFAULT_BASE_URL,
-  decryptSecret,
-  encryptSecret,
-  ensureOmieWebhookAccess,
-  generateWebhookToken,
-  getOmieModels,
-  listOmieConfigurations,
-  maskSecret,
-  normalizeInstanceId,
-  publicConfiguration,
-  resolveInstanceByWebhookToken,
-  resolveOmieConfiguration,
-  rotateOmieWebhookToken,
-  saveOmieConfiguration,
-  updateConnectionStatus,
-};