lunes-platform · Magnopiro-oficial · Jan 31, 2026
diff --git a/.jules/sentinel.md b/.jules/sentinel.md
@@ -0,0 +1,4 @@
+## 2024-05-23 - JWT Blacklist Bypass
+**Vulnerability:** The application was not checking the JWT blacklist during request authentication, allowing revoked tokens (e.g., after logout) to remain valid until expiration.
+**Learning:** Using `request.jwtVerify()` from `@fastify/jwt` only verifies the signature and expiration. It does not perform custom checks like blacklisting. A custom middleware wrapping `jwtVerify` is required.
+**Prevention:** Always implement a central authentication middleware that explicitly checks the token status against a revocation list (Redis/Database) in addition to signature verification.
diff --git a/backend/jest.config.js b/backend/jest.config.js
@@ -0,0 +1,10 @@
+module.exports = {
+  preset: 'ts-jest',
+  testEnvironment: 'node',
+  moduleFileExtensions: ['ts', 'js'],
+  testMatch: ['**/*.test.ts'],
+  transform: {
+    '^.+\\.ts$': 'ts-jest',
+  },
+  setupFiles: ['<rootDir>/jest.setup.js'],
+};
diff --git a/backend/jest.setup.js b/backend/jest.setup.js
@@ -0,0 +1,7 @@
+process.env.DATABASE_URL = 'postgresql://test:test@localhost:5432/test_db';
+process.env.JWT_SECRET = 'test-secret-for-unit-tests-only-must-be-long-enough';
+process.env.NODE_ENV = 'test';
+process.env.LUNES_RPC_URL = 'http://localhost:9933';
+process.env.CONTRACT_ADDRESS = '0x123';
+process.env.PRIVATE_KEY = '0xabc';
+process.env.REDIS_URL = 'redis://localhost:6379';
diff --git a/backend/src/modules/ama/ama.routes.ts b/backend/src/modules/ama/ama.routes.ts
@@ -1,5 +1,6 @@
 import { FastifyInstance } from 'fastify';
 import { AmaController } from './ama.controller';
+import { authenticate } from '../../shared/middleware';
 
 /**
  * Rotas para AMA (Ask Me Anything)
@@ -133,16 +134,7 @@ export const amaRoutes = async (server: FastifyInstance) => {
         }
       }
     },
-    preHandler: async (request, reply) => {
-      try {
-        await request.jwtVerify();
-      } catch (err) {
-        return reply.status(401).send({
-          success: false,
-          error: 'Token de autorização inválido'
-        });
-      }
-    }
+    preHandler: authenticate
   }, amaController.getAmaSessions.bind(amaController));
 
   // GET /ama/sessions/:id - Obter sessão AMA específica
@@ -163,16 +155,7 @@ export const amaRoutes = async (server: FastifyInstance) => {
         200: { $ref: 'amaSessionResponse#' }
       }
     },
-    preHandler: async (request, reply) => {
-      try {
-        await request.jwtVerify();
-      } catch (err) {
-        return reply.status(401).send({
-          success: false,
-          error: 'Token de autorização inválido'
-        });
-      }
-    }
+    preHandler: authenticate
   }, amaController.getAmaSession.bind(amaController));
 
   // POST /ama/sessions - Criar nova sessão AMA
@@ -187,16 +170,7 @@ export const amaRoutes = async (server: FastifyInstance) => {
         201: { $ref: 'amaSessionResponse#' }
       }
     },
-    preHandler: async (request, reply) => {
-      try {
-        await request.jwtVerify();
-      } catch (err) {
-        return reply.status(401).send({
-          success: false,
-          error: 'Token de autorização inválido'
-        });
-      }
-    }
+    preHandler: authenticate
   }, amaController.createAmaSession.bind(amaController));
 
   // PUT /ama/sessions/:id - Atualizar sessão AMA
@@ -231,16 +205,7 @@ export const amaRoutes = async (server: FastifyInstance) => {
         200: { $ref: 'amaSessionResponse#' }
       }
     },
-    preHandler: async (request, reply) => {
-      try {
-        await request.jwtVerify();
-      } catch (err) {
-        return reply.status(401).send({
-          success: false,
-          error: 'Token de autorização inválido'
-        });
-      }
-    }
+    preHandler: authenticate
   }, amaController.updateAmaSession.bind(amaController));
 
   // GET /ama/sessions/:sessionId/questions - Listar perguntas de uma sessão
@@ -291,16 +256,7 @@ export const amaRoutes = async (server: FastifyInstance) => {
         }
       }
     },
-    preHandler: async (request, reply) => {
-      try {
-        await request.jwtVerify();
-      } catch (err) {
-        return reply.status(401).send({
-          success: false,
-          error: 'Token de autorização inválido'
-        });
-      }
-    }
+    preHandler: authenticate
   }, amaController.getAmaQuestions.bind(amaController));
 
   // POST /ama/sessions/:sessionId/questions - Criar pergunta em uma sessão
@@ -329,16 +285,7 @@ export const amaRoutes = async (server: FastifyInstance) => {
         }
       }
     },
-    preHandler: async (request, reply) => {
-      try {
-        await request.jwtVerify();
-      } catch (err) {
-        return reply.status(401).send({
-          success: false,
-          error: 'Token de autorização inválido'
-        });
-      }
-    }
+    preHandler: authenticate
   }, amaController.createAmaQuestion.bind(amaController));
 
   // PUT /ama/questions/:questionId/answer - Responder pergunta
@@ -367,16 +314,7 @@ export const amaRoutes = async (server: FastifyInstance) => {
         }
       }
     },
-    preHandler: async (request, reply) => {
-      try {
-        await request.jwtVerify();
-      } catch (err) {
-        return reply.status(401).send({
-          success: false,
-          error: 'Token de autorização inválido'
-        });
-      }
-    }
+    preHandler: authenticate
   }, amaController.answerAmaQuestion.bind(amaController));
 
   // POST /ama/questions/:questionId/vote - Votar em pergunta
@@ -405,16 +343,7 @@ export const amaRoutes = async (server: FastifyInstance) => {
         }
       }
     },
-    preHandler: async (request, reply) => {
-      try {
-        await request.jwtVerify();
-      } catch (err) {
-        return reply.status(401).send({
-          success: false,
-          error: 'Token de autorização inválido'
-        });
-      }
-    }
+    preHandler: authenticate
   }, amaController.voteAmaQuestion.bind(amaController));
 
   // GET /ama/sessions/:sessionId/stats - Estatísticas da sessão
@@ -449,15 +378,6 @@ export const amaRoutes = async (server: FastifyInstance) => {
         }
       }
     },
-    preHandler: async (request, reply) => {
-      try {
-        await request.jwtVerify();
-      } catch (err) {
-        return reply.status(401).send({
-          success: false,
-          error: 'Token de autorização inválido'
-        });
-      }
-    }
+    preHandler: authenticate
   }, amaController.getAmaStats.bind(amaController));
 };
diff --git a/backend/src/modules/analytics/analytics.routes.ts b/backend/src/modules/analytics/analytics.routes.ts
@@ -1,5 +1,6 @@
 import { FastifyInstance } from 'fastify';
 import { AnalyticsController } from './analytics.controller';
+import { authenticate } from '../../shared/middleware';
 
 /**
  * Rotas para Analytics
@@ -64,16 +65,7 @@ export const analyticsRoutes = async (server: FastifyInstance) => {
         200: { $ref: 'dashboardMetricsResponse#' }
       }
     },
-    preHandler: async (request, reply) => {
-      try {
-        await request.jwtVerify();
-      } catch (err) {
-        return reply.status(401).send({
-          success: false,
-          error: 'Token de autorização inválido'
-        });
-      }
-    }
+    preHandler: authenticate
   }, analyticsController.getDashboardMetrics.bind(analyticsController));
 
   // GET /analytics/projects - Métricas de projetos
@@ -108,16 +100,7 @@ export const analyticsRoutes = async (server: FastifyInstance) => {
         }
       }
     },
-    preHandler: async (request, reply) => {
-      try {
-        await request.jwtVerify();
-      } catch (err) {
-        return reply.status(401).send({
-          success: false,
-          error: 'Token de autorização inválido'
-        });
-      }
-    }
+    preHandler: authenticate
   }, analyticsController.getProjectsMetrics.bind(analyticsController));
 
   // GET /analytics/users - Métricas de usuários (admin only)
@@ -161,21 +144,16 @@ export const analyticsRoutes = async (server: FastifyInstance) => {
       }
     },
     preHandler: async (request, reply) => {
-      try {
-        await request.jwtVerify();
-        const user = (request as any).user;
-
-        // Verificar se é admin
-        if (user.role !== 'ADMIN') {
-          return reply.status(403).send({
-            success: false,
-            error: 'Acesso negado - apenas administradores'
-          });
-        }
-      } catch (err) {
-        return reply.status(401).send({
+      await authenticate(request, reply);
+      if (reply.sent) return;
+
+      const user = (request as any).user;
+
+      // Verificar se é admin
+      if (user.role !== 'ADMIN') {
+        return reply.status(403).send({
           success: false,
-          error: 'Token de autorização inválido'
+          error: 'Acesso negado - apenas administradores'
         });
       }
     }
@@ -229,21 +207,16 @@ export const analyticsRoutes = async (server: FastifyInstance) => {
       }
     },
     preHandler: async (request, reply) => {
-      try {
-        await request.jwtVerify();
-        const user = (request as any).user;
-
-        // Verificar se é admin
-        if (user.role !== 'ADMIN') {
-          return reply.status(403).send({
-            success: false,
-            error: 'Acesso negado - apenas administradores'
-          });
-        }
-      } catch (err) {
-        return reply.status(401).send({
+      await authenticate(request, reply);
+      if (reply.sent) return;
+
+      const user = (request as any).user;
+
+      // Verificar se é admin
+      if (user.role !== 'ADMIN') {
+        return reply.status(403).send({
           success: false,
-          error: 'Token de autorização inválido'
+          error: 'Acesso negado - apenas administradores'
         });
       }
     }
@@ -287,16 +260,7 @@ export const analyticsRoutes = async (server: FastifyInstance) => {
         }
       }
     },
-    preHandler: async (request, reply) => {
-      try {
-        await request.jwtVerify();
-      } catch (err) {
-        return reply.status(401).send({
-          success: false,
-          error: 'Token de autorização inválido'
-        });
-      }
-    }
+    preHandler: authenticate
   }, analyticsController.getPerformanceMetrics.bind(analyticsController));
 
   // POST /analytics/events - Registrar evento de analytics
@@ -317,16 +281,7 @@ export const analyticsRoutes = async (server: FastifyInstance) => {
         }
       }
     },
-    preHandler: async (request, reply) => {
-      try {
-        await request.jwtVerify();
-      } catch (err) {
-        return reply.status(401).send({
-          success: false,
-          error: 'Token de autorização inválido'
-        });
-      }
-    }
+    preHandler: authenticate
   }, analyticsController.trackEvent.bind(analyticsController));
 
   await server.register(async function (server) {}, { prefix: '/analytics' });

diff --git a/backend/src/modules/auth/auth.service.ts b/backend/src/modules/auth/auth.service.ts
@@ -287,6 +287,12 @@ export class AuthService {
   // Verificar token
   async verifyToken(token: string): Promise<TokenPayload> {
     try {
+      // Verificar se o token está na blacklist
+      const isBlacklisted = await this.isTokenBlacklisted(token);
+      if (isBlacklisted) {
+        throw new Error('Token revogado ou inválido');
+      }
+
       const decoded = jwt.verify(token, this.JWT_SECRET) as TokenPayload;
 
       if (decoded.type !== 'access') {

diff --git a/backend/src/modules/projects/project.routes.ts b/backend/src/modules/projects/project.routes.ts
@@ -1,5 +1,6 @@
 import { FastifyInstance } from 'fastify';
 import { logger } from '../../shared/logger';
+import { authenticate } from '../../shared/middleware';
 
 /**
  * Rotas para gerenciamento de projetos
@@ -151,11 +152,7 @@ export const projectRoutes = async (server: FastifyInstance) => {
     server.addHook('preHandler', async (request, reply) => {
       // Aplicar apenas para métodos que precisam de autenticação
       if (['POST', 'PUT', 'DELETE'].includes(request.method)) {
-        try {
-          await request.jwtVerify();
-        } catch (err) {
-          reply.send(err);
-        }
+        await authenticate(request, reply);
       }
     });