@ackplus/nest-auth 0.1.51 → 1.1.0

package/src/lib/session/repositories/redis-session.repository.ts

@@ -0,0 +1,171 @@
+import { Injectable, Inject, Optional } from '@nestjs/common';
+import { BaseSessionRepository } from './base-session.repository';
+import { NestAuthSession } from '../entities/session.entity';
+import { SessionPayload } from '../../core/interfaces/token-payload.interface';
+import { v4 as uuidv4 } from 'uuid';
+
+// Lazy load Redis to make it optional
+let Redis: any;
+let InjectRedis: any;
+
+try {
+    Redis = require('ioredis').default || require('ioredis');
+    const ioredisModule = require('@nestjs-modules/ioredis');
+    InjectRedis = ioredisModule.InjectRedis;
+} catch (e) {
+    // Redis is not installed, that's okay if not using Redis sessions
+}
+
+/**
+ * Redis implementation of session repository
+ * Stores sessions in Redis for fast access
+ *
+ * REQUIREMENTS:
+ * - npm install ioredis @nestjs-modules/ioredis
+ * - Configure Redis in NestAuthModule
+ */
+@Injectable()
+export class RedisSessionRepository extends BaseSessionRepository {
+    private readonly prefix = 'nest-auth:session:';
+    private readonly userSessionsPrefix = 'nest-auth:user-sessions:';
+    private redis: any;
+
+    constructor(
+        @Optional()
+        @Inject('REDIS_CLIENT')
+        redisClient?: any
+    ) {
+        super();
+
+        if (!redisClient) {
+            throw new Error(
+                'RedisSessionRepository requires ioredis and @nestjs-modules/ioredis packages. ' +
+                'Install them with: npm install ioredis @nestjs-modules/ioredis'
+            );
+        }
+
+        this.redis = redisClient;
+    }
+
+    private getSessionKey(sessionId: string): string {
+        return `${this.prefix}${sessionId}`;
+    }
+
+    private getUserSessionsKey(userId: string): string {
+        return `${this.userSessionsPrefix}${userId}`;
+    }
+
+    async create(session: SessionPayload): Promise<NestAuthSession> {
+        const sessionId = session.id || uuidv4();
+        const sessionKey = this.getSessionKey(sessionId);
+        const userSessionsKey = this.getUserSessionsKey(session.userId);
+
+        const sessionData: NestAuthSession = {
+            id: sessionId,
+            userId: session.userId,
+            refreshToken: session.refreshToken,
+            data: session.data,
+            expiresAt: session.expiresAt,
+            userAgent: session.userAgent,
+            deviceName: session.deviceName,
+            ipAddress: session.ipAddress,
+            lastActive: session.lastActive || new Date(),
+        } as NestAuthSession;
+
+        // Store session as hash
+        const serialized = this.serializeSession(sessionData);
+        await this.redis.hmset(sessionKey, serialized);
+
+        // Add to user's sessions set
+        await this.redis.sadd(userSessionsKey, sessionId);
+
+        // Set TTL
+        const ttl = Math.floor((session.expiresAt.getTime() - Date.now()) / 1000);
+        if (ttl > 0) {
+            await this.redis.expire(sessionKey, ttl);
+        }
+
+        return sessionData;
+    }
+
+    async findById(sessionId: string): Promise<NestAuthSession | null> {
+        const sessionKey = this.getSessionKey(sessionId);
+        const data = await this.redis.hgetall(sessionKey);
+
+        if (!data || Object.keys(data).length === 0) {
+            return null;
+        }
+
+        return this.deserializeSession(data);
+    }
+
+    async findByUserId(userId: string): Promise<NestAuthSession[]> {
+        const userSessionsKey = this.getUserSessionsKey(userId);
+        const sessionIds = await this.redis.smembers(userSessionsKey);
+
+        const sessions: NestAuthSession[] = [];
+        for (const sessionId of sessionIds) {
+            const session = await this.findById(sessionId);
+            if (session) {
+                sessions.push(session);
+            }
+        }
+
+        return sessions;
+    }
+
+    async findActiveByUserId(userId: string): Promise<NestAuthSession[]> {
+        const allSessions = await this.findByUserId(userId);
+        return this.filterActive(allSessions);
+    }
+
+    async update(sessionId: string, updates: Partial<NestAuthSession>): Promise<NestAuthSession> {
+        const sessionKey = this.getSessionKey(sessionId);
+        const serialized = this.serializeSession(updates as any);
+
+        await this.redis.hmset(sessionKey, serialized);
+
+        return await this.findById(sessionId);
+    }
+
+    async delete(sessionId: string): Promise<void> {
+        const session = await this.findById(sessionId);
+        if (!session) return;
+
+        const sessionKey = this.getSessionKey(sessionId);
+        const userSessionsKey = this.getUserSessionsKey(session.userId);
+
+        await this.redis.del(sessionKey);
+        await this.redis.srem(userSessionsKey, sessionId);
+    }
+
+    async deleteByUserId(userId: string): Promise<void> {
+        const userSessionsKey = this.getUserSessionsKey(userId);
+        const sessionIds = await this.redis.smembers(userSessionsKey);
+
+        const pipeline = this.redis.pipeline();
+        for (const sessionId of sessionIds) {
+            pipeline.del(this.getSessionKey(sessionId));
+        }
+        pipeline.del(userSessionsKey);
+
+        await pipeline.exec();
+    }
+
+    async deleteExpired(): Promise<number> {
+        // Redis automatically handles expiration via TTL
+        // This is a no-op for Redis, but we implement it for interface compliance
+        return 0;
+    }
+
+    async countActiveByUserId(userId: string): Promise<number> {
+        const activeSessions = await this.findActiveByUserId(userId);
+        return activeSessions.length;
+    }
+
+    async updateLastActive(sessionId: string): Promise<void> {
+        await this.update(sessionId, {
+            lastActive: new Date(),
+        } as any);
+    }
+}

package/src/lib/session/repositories/typeorm-session.repository.ts

@@ -0,0 +1,86 @@
+import { Injectable } from '@nestjs/common';
+import { InjectRepository } from '@nestjs/typeorm';
+import { Repository, MoreThan, LessThan } from 'typeorm';
+import { BaseSessionRepository } from './base-session.repository';
+import { NestAuthSession } from '../entities/session.entity';
+import { SessionPayload } from '../../core/interfaces/token-payload.interface';
+import { v4 as uuidv4 } from 'uuid';
+
+/**
+ * TypeORM implementation of session repository
+ * Stores sessions in PostgreSQL/MySQL database
+ */
+@Injectable()
+export class TypeORMSessionRepository extends BaseSessionRepository {
+    constructor(
+        @InjectRepository(NestAuthSession)
+        private readonly repository: Repository<NestAuthSession>,
+    ) {
+        super();
+    }
+
+    async create(session: SessionPayload): Promise<NestAuthSession> {
+        const sessionEntity = this.repository.create(session);
+
+        return await this.repository.save(sessionEntity);
+    }
+
+    async findById(sessionId: string): Promise<NestAuthSession | null> {
+        return await this.repository.findOne({
+            where: { id: sessionId },
+            relations: ['user'],
+        });
+    }
+
+    async findByUserId(userId: string): Promise<NestAuthSession[]> {
+        return await this.repository.find({
+            where: { userId },
+            order: { createdAt: 'DESC' },
+        });
+    }
+
+    async findActiveByUserId(userId: string): Promise<NestAuthSession[]> {
+        return await this.repository.find({
+            where: {
+                userId,
+                expiresAt: MoreThan(new Date()),
+            },
+            order: { lastActive: 'DESC' },
+        });
+    }
+
+    async update(sessionId: string, updates: Partial<NestAuthSession>): Promise<NestAuthSession> {
+        await this.repository.update(sessionId, updates);
+        return await this.findById(sessionId);
+    }
+
+    async delete(sessionId: string): Promise<void> {
+        await this.repository.delete(sessionId);
+    }
+
+    async deleteByUserId(userId: string): Promise<void> {
+        await this.repository.delete({ userId });
+    }
+
+    async deleteExpired(): Promise<number> {
+        const result = await this.repository.delete({
+            expiresAt: LessThan(new Date()),
+        });
+        return result.affected || 0;
+    }
+
+    async countActiveByUserId(userId: string): Promise<number> {
+        return await this.repository.count({
+            where: {
+                userId,
+                expiresAt: MoreThan(new Date()),
+            },
+        });
+    }
+
+    async updateLastActive(sessionId: string): Promise<void> {
+        await this.repository.update(sessionId, {
+            lastActive: new Date(),
+        });
+    }
+}

package/src/lib/session/services/session-manager.service.ts

@@ -0,0 +1,261 @@
+import { Injectable, UnauthorizedException, Inject } from '@nestjs/common';
+import { ISessionRepository } from '../interfaces/session-repository.interface';
+import { NestAuthSession } from '../entities/session.entity';
+import { SessionPayload } from '../../core/interfaces/token-payload.interface';
+import { AuthModuleOptions } from '../../core/interfaces/auth-module-options.interface';
+import { AuthConfigService } from '../../core/services/auth-config.service';
+import { RequestContext } from '../../request-context/request-context';
+import { NestAuthUser } from '../../user/entities/user.entity';
+import { v4 as uuidv4 } from 'uuid';
+import ms from 'ms';
+
+export const SESSION_REPOSITORY = 'SESSION_REPOSITORY';
+
+/**
+ * High-level session manager
+ * Handles session lifecycle using repository pattern
+ */
+@Injectable()
+export class SessionManagerService {
+    private options: AuthModuleOptions;
+    private readonly maxSessionsPerUser: number;
+    private readonly slidingExpiration: boolean;
+
+    constructor(
+        @Inject(SESSION_REPOSITORY)
+        private readonly repository: ISessionRepository,
+    ) {
+        this.options = AuthConfigService.getOptions();
+        this.maxSessionsPerUser = this.options.session?.maxSessionsPerUser || 10;
+        this.slidingExpiration = this.options.session?.slidingExpiration ?? true;
+    }
+
+    /**
+     * Create a new session
+     */
+    async createSession(payload: {
+        userId: string;
+        refreshToken?: string;
+        data?: any;
+        userAgent?: string;
+        deviceName?: string;
+        ipAddress?: string;
+    }): Promise<NestAuthSession> {
+        const { userId, refreshToken, data, userAgent, deviceName, ipAddress } = payload;
+
+        // Check max sessions limit
+        await this.enforceMaxSessions(userId);
+
+        const sessionPayload: SessionPayload = {
+            id: uuidv4(),
+            userId,
+            refreshToken: refreshToken || '',
+            data: data || {},
+            expiresAt: this.calculateExpiration(),
+            userAgent: userAgent || RequestContext.currentRequest()?.headers['user-agent'] || 'Unknown',
+            deviceName: deviceName || RequestContext.getDeviceInfo().deviceName,
+            ipAddress: ipAddress || RequestContext.getDeviceInfo().ipAddress,
+            lastActive: new Date(),
+        };
+
+        return await this.repository.create(sessionPayload);
+    }
+
+    /**
+     * Get session by ID and optionally refresh it
+     */
+    async getSession(sessionId: string, refreshSession = true): Promise<NestAuthSession> {
+        const session = await this.repository.findById(sessionId);
+
+        if (!session) {
+            throw new UnauthorizedException('Session not found');
+        }
+
+        // Check if expired
+        if (this.isExpired(session)) {
+            await this.repository.delete(sessionId);
+            throw new UnauthorizedException('Session expired');
+        }
+
+        // Update last active if sliding expiration enabled
+        if (refreshSession && this.slidingExpiration) {
+            await this.repository.updateLastActive(sessionId);
+        }
+
+        return session;
+    }
+
+    /**
+     * Get all sessions for a user
+     */
+    async getUserSessions(userId: string): Promise<NestAuthSession[]> {
+        return await this.repository.findByUserId(userId);
+    }
+
+    /**
+     * Get active sessions for a user
+     */
+    async getActiveSessions(userId: string): Promise<NestAuthSession[]> {
+        return await this.repository.findActiveByUserId(userId);
+    }
+
+    /**
+     * Update session data
+     */
+    async updateSession(sessionId: string, updates: Partial<NestAuthSession>): Promise<NestAuthSession> {
+        return await this.repository.update(sessionId, updates);
+    }
+
+    /**
+     * Revoke (delete) a session
+     */
+    async revokeSession(sessionId: string): Promise<void> {
+        await this.repository.delete(sessionId);
+    }
+
+    /**
+     * Revoke all sessions for a user
+     */
+    async revokeAllUserSessions(userId: string): Promise<void> {
+        await this.repository.deleteByUserId(userId);
+    }
+
+    /**
+     * Revoke all sessions except the current one
+     */
+    async revokeOtherSessions(userId: string, currentSessionId: string): Promise<void> {
+        const sessions = await this.repository.findByUserId(userId);
+
+        for (const session of sessions) {
+            if (session.id !== currentSessionId) {
+                await this.repository.delete(session.id);
+            }
+        }
+    }
+
+    /**
+     * Clean up expired sessions
+     */
+    async cleanupExpiredSessions(): Promise<number> {
+        return await this.repository.deleteExpired();
+    }
+
+    /**
+     * Extend session expiration
+     */
+    async extendSession(sessionId: string, duration?: string): Promise<NestAuthSession> {
+        const expiresAt = this.calculateExpiration(duration);
+        return await this.repository.update(sessionId, { expiresAt } as any);
+    }
+
+    /**
+     * Validate session and return it if valid
+     */
+    async validateSession(sessionId: string): Promise<NestAuthSession | null> {
+        try {
+            return await this.getSession(sessionId, true);
+        } catch {
+            return null;
+        }
+    }
+
+    /**
+     * Check if user has reached max sessions limit
+     */
+    async hasReachedMaxSessions(userId: string): Promise<boolean> {
+        const count = await this.repository.countActiveByUserId(userId);
+        return count >= this.maxSessionsPerUser;
+    }
+
+    /**
+     * Enforce max sessions per user by removing oldest sessions
+     */
+    private async enforceMaxSessions(userId: string): Promise<void> {
+        const activeSessions = await this.repository.findActiveByUserId(userId);
+
+        if (activeSessions.length >= this.maxSessionsPerUser) {
+            // Sort by lastActive (oldest first)
+            const sorted = activeSessions.sort((a, b) => {
+                const aTime = a.lastActive?.getTime() || 0;
+                const bTime = b.lastActive?.getTime() || 0;
+                return aTime - bTime;
+            });
+
+            // Remove oldest session(s)
+            const toRemove = sorted.slice(0, activeSessions.length - this.maxSessionsPerUser + 1);
+            for (const session of toRemove) {
+                await this.repository.delete(session.id);
+            }
+        }
+    }
+
+    /**
+     * Calculate session expiration date
+     */
+    private calculateExpiration(duration?: string): Date {
+        const expiryDuration = duration || this.options.session?.sessionExpiry || '7d';
+        const milliseconds = ms(expiryDuration);
+        return new Date(Date.now() + milliseconds);
+    }
+
+    /**
+     * Check if session is expired
+     */
+    private isExpired(session: NestAuthSession): boolean {
+        if (!session.expiresAt) return false;
+        return new Date() > new Date(session.expiresAt);
+    }
+
+    /**
+     * Create session from user (helper method from old BaseSessionService)
+     * For backward compatibility with AuthService
+     */
+    async createSessionFromUser(user: NestAuthUser, extraData: { isMfaVerified?: boolean } = {}): Promise<NestAuthSession> {
+        const { deviceName, ipAddress, browser } = RequestContext.getDeviceInfo();
+        const { isMfaVerified = false } = extraData;
+
+        if (!user) {
+            throw new UnauthorizedException('User not found');
+        }
+
+        const roles = await user.getRoles();
+        const permissions = await user.getPermissions();
+
+        // Create session using createSession method
+        return await this.createSession({
+            userId: user.id,
+            data: {
+                user,
+                isMfaVerified,
+                roles,
+                permissions,
+            },
+            userAgent: [browser, deviceName].join(' - '),
+            ipAddress,
+            deviceName,
+        });
+    }
+
+    /**
+     * Create new session from existing session (for refresh)
+     * For backward compatibility with AuthService
+     */
+    async createSessionFromSession(session: NestAuthSession): Promise<NestAuthSession> {
+        return await this.createSession({
+            userId: session.userId,
+            refreshToken: session.refreshToken,
+            data: session.data,
+            userAgent: session.userAgent,
+            deviceName: session.deviceName,
+            ipAddress: session.ipAddress,
+        });
+    }
+
+    /**
+     * Get current active sessions for a user
+     * For backward compatibility with AuthService
+     */
+    async getCurrentSessions(userId: string): Promise<NestAuthSession[]> {
+        return await this.getActiveSessions(userId);
+    }
+}

package/src/lib/session/session.module.ts

@@ -0,0 +1,102 @@
+import { Module, forwardRef } from '@nestjs/common';
+import { TypeOrmModule } from '@nestjs/typeorm';
+import { NestAuthSession } from './entities/session.entity';
+import { SessionManagerService, SESSION_REPOSITORY } from './services/session-manager.service';
+import { TypeORMSessionRepository } from './repositories/typeorm-session.repository';
+import { MemorySessionRepository } from './repositories/memory-session.repository';
+import { CoreModule } from '../core/core.module';
+import { SessionStorageType } from '../core/interfaces/session-options.interface';
+import { AuthConfigService } from '../core/services/auth-config.service';
+
+/**
+ * Session Module
+ *
+ * DEFAULT: Uses TypeORM (Database) for session storage
+ * OPTIONAL: Can use Redis if configured (requires ioredis packages)
+ */
+@Module({
+    imports: [
+        TypeOrmModule.forFeature([NestAuthSession]),
+        forwardRef(() => CoreModule),
+    ],
+    providers: [
+        // Repository implementations
+        TypeORMSessionRepository,
+        MemorySessionRepository,
+
+        // Session Repository Provider (dynamically chooses storage)
+        {
+            provide: SESSION_REPOSITORY,
+            useFactory: (typeormRepo: TypeORMSessionRepository) => {
+                const config = AuthConfigService.getOptions();
+                const storageType = config.session?.storageType || SessionStorageType.DATABASE;
+
+                // Handle Redis storage
+                if (storageType === SessionStorageType.REDIS) {
+                    return SessionModule.createRedisRepository(config.session?.redisUrl);
+                }
+
+                if (storageType === SessionStorageType.MEMORY) {
+                    return new MemorySessionRepository();
+                }
+
+                // Default to database storage
+                return typeormRepo;
+            },
+            inject: [TypeORMSessionRepository],
+        },
+
+        // Session Manager
+        SessionManagerService,
+    ],
+    exports: [
+        SESSION_REPOSITORY,
+        SessionManagerService,
+        TypeORMSessionRepository,
+        MemorySessionRepository,
+    ],
+})
+export class SessionModule {
+    /**
+     * Create Redis repository instance
+     * Only called if Redis storage is configured
+     */
+    private static createRedisRepository(redisUrl?: string): any {
+        let RedisSessionRepository: any;
+        let ioredisModule: any;
+        let redisClient: any;
+
+        // Try to load Redis modules
+        try {
+            // Lazy load Redis repository
+            RedisSessionRepository = require('./repositories/redis-session.repository').RedisSessionRepository;
+            ioredisModule = require('@nestjs-modules/ioredis');
+            const Redis = require('ioredis').default || require('ioredis');
+
+            // Create Redis client
+            if (redisUrl) {
+                redisClient = new Redis(redisUrl);
+            } else {
+                redisClient = new Redis(); // Uses default localhost:6379
+            }
+
+            // Return repository instance
+            return new RedisSessionRepository(redisClient);
+        } catch (error) {
+            const errorMessage = error instanceof Error ? error.message : String(error);
+
+            if (errorMessage.includes('Cannot find module')) {
+                throw new Error(
+                    '❌ Redis session storage is configured but packages are not installed.\n' +
+                    '   Install them with: npm install ioredis @nestjs-modules/ioredis\n' +
+                    '   Or change session.storageType to SessionStorageType.DATABASE'
+                );
+            }
+
+            throw new Error(
+                `❌ Failed to initialize Redis session storage: ${errorMessage}\n` +
+                '   Make sure Redis server is running and accessible.'
+            );
+        }
+    }
+}