fix: alinear health con API 0.21.0-2

ops: blindar reset preservando configuración estructural
ops: versionar API 0.21.0-2 para reset limpio
2026-09-05 22:27:29 -03:00 · 2026-09-05 22:17:45 -03:00 · 2026-09-05 22:15:10 -03:00 · 2026-09-05 22:12:18 -03:00
7 changed files with 176 additions and 456 deletions
@@ -1,6 +1,6 @@
 {
  "name": "dhv2-api",
-  "version": "0.21.0-1",
+  "version": "0.21.0-2",
  "private": true,
  "license": "UNLICENSED",
  "scripts": {
@@ -5,8 +5,6 @@ import { AuthorizationModule } from '../authorization/authorization.module';
 import { PhaseADataModule } from '../core-data/phase-a-data.module';
 import { AuthController } from './auth.controller';
 import { AuthService } from './auth.service';
 import { MobileAuthController } from './mobile-auth.controller';
 import { MobileAuthService } from './mobile-auth.service';
 import { AccessTokenGuard } from './guards/access-token.guard';
 import { CsrfGuard } from './guards/csrf.guard';
 import { AuthConfigService } from '../common/config/auth-config.service';
@@ -20,7 +18,6 @@ const providers = [
  PasswordService,
  TokenService,
  AuthService,
  MobileAuthService,
  AccessTokenGuard,
  CsrfGuard,
 ];
@@ -32,7 +29,7 @@ const providers = [
    AuditModule,
    AuthorizationModule,
  ],
-  controllers: [AuthController, MobileAuthController],
+  controllers: [AuthController],
  providers,
  exports: [
    AuthConfigService,
@@ -1,8 +0,0 @@
 import { IsString, MaxLength, MinLength } from 'class-validator';
 export class MobileRefreshDto {
  @IsString()
  @MinLength(32)
  @MaxLength(256)
  refreshToken!: string;
 }
@@ -1,56 +0,0 @@
 import {
  Body,
  Controller,
  HttpCode,
  Post,
  Req,
 } from '@nestjs/common';
 import { Throttle } from '@nestjs/throttler';
 import type {
  AuthPrincipal,
  RequestWithContext,
 } from '../common/http/request-context';
 import { CurrentAuth } from './decorators/current-auth.decorator';
 import { Public } from './decorators/public.decorator';
 import { SkipCsrf } from './decorators/skip-csrf.decorator';
 import { LoginDto } from './dto/login.dto';
 import { MobileRefreshDto } from './dto/mobile-refresh.dto';
 import { MobileAuthService } from './mobile-auth.service';
@Controller('auth/mobile')
 export class MobileAuthController {
  constructor(private readonly mobileAuth: MobileAuthService) {}
  @Post('login')
  @HttpCode(200)
  @Public()
  @SkipCsrf()
  @Throttle({ default: { limit: 5, ttl: 60_000, blockDuration: 60_000 } })
  login(
    @Body() dto: LoginDto,
    @Req() request: RequestWithContext,
  ) {
    return this.mobileAuth.login(dto, request);
  }
  @Post('refresh')
  @HttpCode(200)
  @Public()
  @SkipCsrf()
  @Throttle({ default: { limit: 20, ttl: 60_000 } })
  refresh(
    @Body() dto: MobileRefreshDto,
    @Req() request: RequestWithContext,
  ) {
    return this.mobileAuth.refresh(dto.refreshToken, request);
  }
  @Post('logout')
  @HttpCode(200)
  logout(
    @CurrentAuth() principal: AuthPrincipal,
    @Req() request: RequestWithContext,
  ) {
    return this.mobileAuth.logout(principal, request);
  }
 }
@@ -1,386 +0,0 @@
 import { isIP } from 'node:net';
 import {
  ForbiddenException,
  Injectable,
  UnauthorizedException,
 } from '@nestjs/common';
 import { DataSource } from 'typeorm';
 import { AuditService } from '../audit/audit.service';
 import type {
  AuthPrincipal,
  RequestWithContext,
 } from '../common/http/request-context';
 import { AuthSessionsRepository } from '../core-data/repositories/auth-sessions.repository';
 import { RolesRepository } from '../core-data/repositories/roles.repository';
 import { UsersRepository } from '../core-data/repositories/users.repository';
 import {
  AuditAction,
  AuditSource,
  AuthSession,
  User,
  UserStatus,
 } from '../database/entities';
 import type { LoginDto } from './dto/login.dto';
 import { PasswordService } from './services/password.service';
 import {
  IssuedRefreshToken,
  TokenService,
 } from './services/token.service';
 interface RequestMetadata {
  ip: string | null;
  userAgent: string | null;
 }
 interface SuccessfulAuthentication {
  user: User;
  accessToken: string;
  refreshToken: IssuedRefreshToken;
 }
 type LoginOutcome = SuccessfulAuthentication | null;
 type RefreshOutcome =
  | ({ kind: 'ok' } & SuccessfulAuthentication)
  | { kind: 'reuse' }
  | { kind: 'invalid' };
 function invalidCredentials(): UnauthorizedException {
  return new UnauthorizedException({
    code: 'INVALID_CREDENTIALS',
    message: 'Credenciales inválidas',
  });
 }
 function invalidSession(): UnauthorizedException {
  return new UnauthorizedException({
    code: 'INVALID_SESSION',
    message: 'Sesión móvil inválida o vencida',
  });
 }
 function inspectorRequired(): ForbiddenException {
  return new ForbiddenException({
    code: 'INSPECTION_INSPECTOR_ROLE_REQUIRED',
    message: 'Sólo un usuario con rol inspector puede ingresar a la aplicación móvil',
  });
 }
 function requestMetadata(request: RequestWithContext): RequestMetadata {
  const candidateIp = request.ip || request.socket.remoteAddress || '';
  const ip = isIP(candidateIp) ? candidateIp : null;
  const rawUserAgent = request.header('user-agent')?.trim();
  return {
    ip,
    userAgent: rawUserAgent ? rawUserAgent.slice(0, 2048) : null,
  };
 }
@Injectable()
 export class MobileAuthService {
  constructor(
    private readonly dataSource: DataSource,
    private readonly users: UsersRepository,
    private readonly sessions: AuthSessionsRepository,
    private readonly roles: RolesRepository,
    private readonly passwords: PasswordService,
    private readonly tokens: TokenService,
    private readonly audit: AuditService,
  ) {}
  async login(dto: LoginDto, request: RequestWithContext) {
    const identifier = dto.identifier.trim().toLowerCase();
    const candidate = await this.users.findForAuthentication(identifier);
    const metadata = requestMetadata(request);
    if (!candidate) {
      await this.passwords.verifyUnknown(dto.password);
      await this.audit.record({
        action: AuditAction.AUTH_LOGIN_FAILED,
        requestId: request.requestId,
        source: AuditSource.ANDROID,
        ...metadata,
        metadata: { identifier, reason: 'UNKNOWN_IDENTIFIER' },
      });
      throw invalidCredentials();
    }
    const outcome = await this.dataSource.transaction<LoginOutcome>(
      async (manager) => {
        const user = await manager
          .getRepository(User)
          .createQueryBuilder('user')
          .addSelect('user.passwordHash')
          .where('user.id = :id', { id: candidate.id })
          .setLock('pessimistic_write')
          .getOne();
        if (!user) return null;
        const now = new Date();
        const passwordMatches = await this.passwords.verify(
          user.passwordHash,
          dto.password,
        );
        const locked = Boolean(user.lockedUntil && user.lockedUntil > now);
        const active = user.status === UserStatus.ACTIVE;
        if (!passwordMatches || locked || !active) {
          if (!passwordMatches && active && !locked) {
            await manager.query(
              `
                UPDATE users
                SET
                  failed_login_attempts = failed_login_attempts + 1,
                  locked_until = CASE
                    WHEN failed_login_attempts + 1 >= $2
                      THEN CURRENT_TIMESTAMP + ($3 * INTERVAL '1 second')
                    ELSE locked_until
                  END,
                  updated_at = CURRENT_TIMESTAMP
                WHERE id = $1
              `,
              [
                user.id,
                this.tokens.maxLoginAttempts,
                this.tokens.lockoutSeconds,
              ],
            );
          }
          await this.audit.record(
            {
              actorUserId: user.id,
              actorUsername: user.username,
              action: AuditAction.AUTH_LOGIN_FAILED,
              entityType: 'user',
              entityId: user.id,
              requestId: request.requestId,
              source: AuditSource.ANDROID,
              ...metadata,
              metadata: {
                reason: !active
                  ? 'INACTIVE_USER'
                  : locked
                    ? 'LOCKED_USER'
                    : 'INVALID_PASSWORD',
              },
            },
            manager,
          );
          return null;
        }
        if (this.passwords.needsRehash(user.passwordHash)) {
          user.passwordHash = await this.passwords.hash(dto.password);
        }
        user.failedLoginAttempts = 0;
        user.lockedUntil = null;
        user.lastLoginAt = now;
        await manager.getRepository(User).save(user);
        const refreshToken = this.tokens.issueRefreshToken();
        const session = manager.getRepository(AuthSession).create({
          id: refreshToken.sessionId,
          userId: user.id,
          refreshTokenHash: refreshToken.tokenHash,
          expiresAt: this.tokens.refreshExpiresAt(now),
          lastUsedAt: now,
          revokedAt: null,
          replacedBySessionId: null,
          ip: metadata.ip,
          userAgent: metadata.userAgent,
          deviceLabel: dto.deviceLabel?.trim() || 'DH Android',
        });
        await manager.getRepository(AuthSession).save(session);
        const accessToken = await this.tokens.issueAccessToken({
          userId: user.id,
          sessionId: session.id,
          username: user.username,
        });
        await this.audit.record(
          {
            actorUserId: user.id,
            actorUsername: user.username,
            action: AuditAction.AUTH_LOGIN_SUCCESS,
            entityType: 'auth_session',
            entityId: session.id,
            requestId: request.requestId,
            source: AuditSource.ANDROID,
            ...metadata,
            metadata: { deviceLabel: session.deviceLabel },
          },
          manager,
        );
        return { user, accessToken, refreshToken };
      },
    );
    if (!outcome) throw invalidCredentials();
    return this.complete(outcome);
  }
  async refresh(rawToken: string, request: RequestWithContext) {
    const parsed = this.tokens.parseRefreshToken(rawToken);
    if (!parsed) throw invalidSession();
    const metadata = requestMetadata(request);
    const outcome = await this.dataSource.transaction<RefreshOutcome>(
      async (manager) => {
        const session = await manager
          .getRepository(AuthSession)
          .createQueryBuilder('session')
          .addSelect('session.refreshTokenHash')
          .where('session.id = :id', { id: parsed.sessionId })
          .setLock('pessimistic_write')
          .getOne();
        if (
          !session ||
          !this.tokens.verifyRefreshToken(rawToken, session.refreshTokenHash)
        ) {
          return { kind: 'invalid' };
        }
        const user = await manager.getRepository(User).findOne({
          where: { id: session.userId },
        });
        if (session.revokedAt) {
          await this.sessions.revokeSessionFamily(session.id, manager);
          await this.audit.record(
            {
              actorUserId: user?.id ?? null,
              actorUsername: user?.username ?? null,
              action: AuditAction.AUTH_REFRESH_REUSE_DETECTED,
              entityType: 'auth_session',
              entityId: session.id,
              requestId: request.requestId,
              source: AuditSource.ANDROID,
              ...metadata,
            },
            manager,
          );
          return { kind: 'reuse' };
        }
        const now = new Date();
        if (!user || user.status !== UserStatus.ACTIVE || session.expiresAt <= now) {
          session.revokedAt = now;
          session.lastUsedAt = now;
          await manager.getRepository(AuthSession).save(session);
          if (user?.status === UserStatus.INACTIVE) {
            await this.sessions.revokeUserSessions(user.id, undefined, manager);
          }
          return { kind: 'invalid' };
        }
        const refreshToken = this.tokens.issueRefreshToken();
        const replacement = manager.getRepository(AuthSession).create({
          id: refreshToken.sessionId,
          userId: user.id,
          refreshTokenHash: refreshToken.tokenHash,
          expiresAt: this.tokens.refreshExpiresAt(now),
          lastUsedAt: now,
          revokedAt: null,
          replacedBySessionId: null,
          ip: metadata.ip,
          userAgent: metadata.userAgent,
          deviceLabel: session.deviceLabel,
        });
        await manager.getRepository(AuthSession).save(replacement);
        session.revokedAt = now;
        session.lastUsedAt = now;
        session.replacedBySessionId = replacement.id;
        await manager.getRepository(AuthSession).save(session);
        const accessToken = await this.tokens.issueAccessToken({
          userId: user.id,
          sessionId: replacement.id,
          username: user.username,
        });
        await this.audit.record(
          {
            actorUserId: user.id,
            actorUsername: user.username,
            action: AuditAction.AUTH_REFRESH,
            entityType: 'auth_session',
            entityId: replacement.id,
            requestId: request.requestId,
            source: AuditSource.ANDROID,
            ...metadata,
            metadata: { replacedSessionId: session.id },
          },
          manager,
        );
        return { kind: 'ok', user, accessToken, refreshToken };
      },
    );
    if (outcome.kind !== 'ok') throw invalidSession();
    return this.complete(outcome);
  }
  async logout(
    principal: AuthPrincipal,
    request: RequestWithContext,
  ) {
    const metadata = requestMetadata(request);
    await this.dataSource.transaction(async (manager) => {
      await this.sessions.revokeSession(
        principal.sessionId,
        principal.userId,
        manager,
      );
      await this.audit.record(
        {
          actorUserId: principal.userId,
          actorUsername: principal.username,
          action: AuditAction.AUTH_LOGOUT,
          entityType: 'auth_session',
          entityId: principal.sessionId,
          requestId: request.requestId,
          source: AuditSource.ANDROID,
          ...metadata,
        },
        manager,
      );
    });
    return { status: 'ok' };
  }
  private async complete(authentication: SuccessfulAuthentication) {
    const [roleCodes, permissionCodes] = await Promise.all([
      this.roles.findRoleCodesForUser(authentication.user.id),
      this.roles.findPermissionCodesForUser(authentication.user.id),
    ]);
    if (!roleCodes.includes('inspector')) {
      await this.sessions.revokeSession(
        authentication.refreshToken.sessionId,
        authentication.user.id,
      );
      throw inspectorRequired();
    }
    return {
      user: {
        id: authentication.user.id,
        username: authentication.user.username,
        firstName: authentication.user.firstName,
        lastName: authentication.user.lastName,
        email: authentication.user.email,
        mustChangePassword: authentication.user.mustChangePassword,
        roles: roleCodes,
        permissions: permissionCodes,
      },
      accessToken: authentication.accessToken,
      refreshToken: authentication.refreshToken.token,
      accessExpiresInSeconds: this.tokens.accessTokenTtlSeconds,
    };
  }
 }
@@ -0,0 +1,173 @@
 import { MigrationInterface, QueryRunner } from 'typeorm';
 /**
 * One-time production reset requested before the first clean Android rollout.
 *
 * Keeps only structural product configuration plus the single `admin` account.
 * Operational/business data is removed. Recovery is intentionally performed
 * from the deploy PRE backup, not through a synthetic down migration.
 */
 export class ResetProductionOperationalData1788652800000 implements MigrationInterface {
  name = 'ResetProductionOperationalData1788652800000';
  public async up(queryRunner: QueryRunner): Promise<void> {
    const adminRows: Array<{ id: string; username: string }> = await queryRunner.query(`
      SELECT id, username
      FROM users
      WHERE lower(trim(username)) = 'admin'
      ORDER BY id
    `);
    if (adminRows.length !== 1) {
      throw new Error(
        `Production reset aborted: expected exactly one username admin, found ${adminRows.length}`,
      );
    }
    const adminId = adminRows[0].id;
    const structuralTables = [
      'roles',
      'permissions',
      'role_permissions',
      'asset_types',
      'asset_attribute_definitions',
      'asset_type_parent_rules',
      'finding_categories',
      'finding_catalog_items',
      'finding_catalog_item_asset_types',
      'finding_catalog_asset_type_profiles',
    ];
    // Snapshot structural row counts so TRUNCATE ... CASCADE can never silently
    // remove product configuration while still leaving operational tables empty.
    const structuralCounts = new Map<string, string>();
    for (const table of structuralTables) {
      const safeTable = `"${table.replace(/"/g, '""')}"`;
      const rows: Array<{ total: string }> = await queryRunner.query(
        `SELECT count(*)::text AS total FROM ${safeTable}`,
      );
      structuralCounts.set(table, rows[0]?.total ?? '0');
    }
    const adminRolesBefore: Array<{ total: string }> = await queryRunner.query(
      `SELECT count(*)::text AS total FROM user_roles WHERE user_id = $1`,
      [adminId],
    );
    const adminRoleCount = adminRolesBefore[0]?.total ?? '0';
    if (adminRoleCount === '0') {
      throw new Error('Production reset aborted: admin has no assigned role');
    }
    // Product configuration that must survive a clean operational start.
    const preservedTables = new Set([
      'typeorm_migrations',
      'users',
      'user_roles',
      ...structuralTables,
    ]);
    const tableRows: Array<{ table_name: string }> = await queryRunner.query(`
      SELECT table_name
      FROM information_schema.tables
      WHERE table_schema = 'public'
        AND table_type = 'BASE TABLE'
      ORDER BY table_name
    `);
    const operationalTables = tableRows
      .map((row) => row.table_name)
      .filter((table) => !preservedTables.has(table));
    if (operationalTables.length > 0) {
      const quoted = operationalTables
        .map((table) => `"${table.replace(/"/g, '""')}"`)
        .join(', ');
      await queryRunner.query(`TRUNCATE TABLE ${quoted} RESTART IDENTITY CASCADE`);
    }
    // Remove every user except the explicitly validated administrator.
    // user_roles for removed users follow their FK cascade.
    await queryRunner.query(`DELETE FROM users WHERE id <> $1`, [adminId]);
    // A reset must invalidate every prior login token, including admin's.
    // auth_sessions is operational and was truncated above; admin simply logs in again.
    await queryRunner.query(
      `
      UPDATE users
      SET failed_login_attempts = 0,
          locked_until = NULL,
          last_login_at = NULL,
          updated_at = CURRENT_TIMESTAMP
      WHERE id = $1
    `,
      [adminId],
    );
    const finalUsers: Array<{ total: string; admins: string }> = await queryRunner.query(`
      SELECT
        count(*)::text AS total,
        count(*) FILTER (WHERE lower(trim(username)) = 'admin')::text AS admins
      FROM users
    `);
    if (finalUsers[0]?.total !== '1' || finalUsers[0]?.admins !== '1') {
      throw new Error('Production reset verification failed: users table is not admin-only');
    }
    const finalAdminRoles: Array<{ total: string; foreign_users: string }> = await queryRunner.query(
      `
      SELECT
        count(*) FILTER (WHERE user_id = $1)::text AS total,
        count(*) FILTER (WHERE user_id <> $1)::text AS foreign_users
      FROM user_roles
    `,
      [adminId],
    );
    if (
      finalAdminRoles[0]?.total !== adminRoleCount ||
      finalAdminRoles[0]?.foreign_users !== '0'
    ) {
      throw new Error('Production reset verification failed: admin role assignments changed');
    }
    // Assert every structural table kept exactly the same number of rows.
    for (const table of structuralTables) {
      const safeTable = `"${table.replace(/"/g, '""')}"`;
      const rows: Array<{ total: string }> = await queryRunner.query(
        `SELECT count(*)::text AS total FROM ${safeTable}`,
      );
      const before = structuralCounts.get(table) ?? '0';
      if (rows[0]?.total !== before) {
        throw new Error(
          `Production reset verification failed: structural table ${table} changed (${before} -> ${rows[0]?.total ?? 'unknown'})`,
        );
      }
    }
    // Assert that every operational table is empty. This makes the migration
    // fail atomically if a table was repopulated during the reset transaction.
    for (const table of operationalTables) {
      const safeTable = `"${table.replace(/"/g, '""')}"`;
      const rows: Array<{ total: string }> = await queryRunner.query(
        `SELECT count(*)::text AS total FROM ${safeTable}`,
      );
      if (rows[0]?.total !== '0') {
        throw new Error(`Production reset verification failed: ${table} is not empty`);
      }
    }
    // Keep a concise server-side record in the migration log for deploy diagnostics.
    // eslint-disable-next-line no-console
    console.log(
      `[production-reset] kept admin=${adminRows[0].username} (${adminId}); preserved ${structuralTables.length} structural tables; cleared ${operationalTables.length} operational tables`,
    );
  }
  public async down(): Promise<void> {
    throw new Error(
      'ResetProductionOperationalData is irreversible by migration; restore the deploy PRE database backup instead.',
    );
  }
 }
@@ -1,2 +1,2 @@
-export const API_VERSION = '0.21.0-1';
+export const API_VERSION = '0.21.0-2';
 export const API_PHASE = 'F2.1';
Author	SHA1	Message	Date
admin	4c01cf6ffe	fix: alinear health con API 0.21.0-2	2026-09-05 22:27:29 -03:00
admin	66333fb5dd	ops: blindar reset preservando configuración estructural	2026-09-05 22:17:45 -03:00
admin	06f809b4c8	ops: versionar API 0.21.0-2 para reset limpio	2026-09-05 22:15:10 -03:00
admin	343c889250	ops: preparar reset limpio de datos operativos	2026-09-05 22:12:18 -03:00
`@@ -1,2 +1,2 @@`
	`export const API_VERSION = '0.21.0-1';`	`export const API_VERSION = '0.21.0-2';`
	`export const API_PHASE = 'F2.1';`	`export const API_PHASE = 'F2.1';`