@ackplus/nest-auth 0.1.51 → 1.1.0

package/project.json

@@ -0,0 +1,86 @@
+{
+  "name": "nest-auth",
+  "$schema": "../../node_modules/nx/schemas/project-schema.json",
+  "sourceRoot": "packages/nest-auth/src",
+  "projectType": "library",
+  "release": {
+    "version": {
+      "manifestRootsToUpdate": [
+        "dist/{projectRoot}"
+      ],
+      "currentVersionResolver": "git-tag",
+      "fallbackCurrentVersionResolver": "disk"
+    }
+  },
+  "tags": [],
+  "targets": {
+    "build": {
+      "executor": "@nx/js:tsc",
+      "outputs": [
+        "{options.outputPath}"
+      ],
+      "inputs": [
+        "production",
+        "^production",
+        "!{projectRoot}/src/lib/admin-console/static/**"
+      ],
+      "options": {
+        "outputPath": "dist/packages/nest-auth",
+        "tsConfig": "packages/nest-auth/tsconfig.lib.json",
+        "packageJson": "packages/nest-auth/package.json",
+        "main": "packages/nest-auth/src/index.ts",
+        "assets": [
+          "packages/nest-auth/*.md",
+          "packages/nest-auth/src/lib/admin-console/static/**"
+        ]
+      }
+    },
+    "swagger": {
+      "executor": "nx:run-commands",
+      "outputs": [
+        "{workspaceRoot}/apps/docs/public/api/nest-auth.json",
+        "{workspaceRoot}/apps/docs/src/data/openapi/nest-auth.json",
+        "{workspaceRoot}/packages/nest-auth/ui/src/data/nest-auth.json"
+      ],
+      "dependsOn": [
+        "build"
+      ],
+      "inputs": [
+        "production",
+        "^production",
+        "!{workspaceRoot}/apps/docs/public/api/nest-auth.json",
+        "!{workspaceRoot}/apps/docs/src/data/openapi/nest-auth.json",
+        "!{workspaceRoot}/packages/nest-auth/ui/src/data/nest-auth.json"
+      ],
+      "cache": true,
+      "options": {
+        "command": "node tools/scripts/generate-nest-auth-swagger.mjs"
+      }
+    },
+    "nx-release-publish": {
+      "options": {
+        "packageRoot": "dist/{projectRoot}"
+      }
+    },
+    "build-admin-console": {
+      "executor": "nx:run-commands",
+      "outputs": [
+        "{projectRoot}/src/lib/admin-console/static"
+      ],
+      "dependsOn": [
+        "swagger"
+      ],
+      "inputs": [
+        "production",
+        "^production",
+        "!{projectRoot}/src/lib/admin-console/static/**",
+        "{projectRoot}/ui/**"
+      ],
+      "cache": true,
+      "options": {
+        "command": "npm run build",
+        "cwd": "packages/nest-auth/ui"
+      }
+    }
+  }
+}

package/src/index.ts

@@ -0,0 +1,30 @@
+export * from './lib/nest-auth.module';
+
+export * from './lib/auth.constants';
+
+// Modules
+export * from './lib/auth';
+export * from './lib/session';
+export * from './lib/user';
+export * from './lib/role';
+export * from './lib/tenant';
+export * from './lib/core';
+export * from './lib/request-context';
+
+// Types and interfaces for configuration
+export {
+  AuthModuleOptions,
+  AuthModuleAsyncOptions,
+  AuthModuleOptionsFactory,
+  DefaultTenantOptions,
+  AdminConsoleOptions,
+} from './lib/core/interfaces/auth-module-options.interface';
+
+// Static configuration service
+export { AuthConfigService } from './lib/core/services/auth-config.service';
+
+// Debug logging
+export { DebugLoggerService, DebugLogLevel, DebugLogOptions } from './lib/core/services/debug-logger.service';
+
+// Admin console exports
+export { AdminUser as NestAuthAdminUser } from './lib/admin-console/entities/admin-user.entity';

package/src/lib/admin-console/admin-console.module.ts

@@ -0,0 +1,62 @@
+import { Module, forwardRef } from '@nestjs/common';
+import { TypeOrmModule } from '@nestjs/typeorm';
+import { AdminUser } from './entities/admin-user.entity';
+import { AdminUserService } from './services/admin-user.service';
+import { AdminAuthService } from './services/admin-auth.service';
+import { AdminSessionService } from './services/admin-session.service';
+import { AdminConsoleController } from './controllers/admin-console.controller';
+import { AdminAuthController } from './controllers/admin-auth.controller';
+import { AdminSessionGuard } from './guards/admin-session.guard';
+import { UserModule } from '../user/user.module';
+import { RoleModule } from '../role/role.module';
+import { TenantModule } from '../tenant/tenant.module';
+import { AdminUsersController } from './controllers/admin-users.controller';
+import { AdminRolesController } from './controllers/admin-roles.controller';
+import { AdminTenantsController } from './controllers/admin-tenants.controller';
+import { AdminPermissionsController } from './controllers/admin-permissions.controller';
+import { AdminConsoleConfigService } from './services/admin-console-config.service';
+import { AuthModule } from '../auth/auth.module';
+import { NestAuthMFASecret } from '../auth/entities/mfa-secret.entity';
+import { NestAuthUser } from '../user/entities/user.entity';
+import { PermissionModule } from '../permission/permission.module';
+import { SessionModule } from '../session/session.module';
+import { NestAuthRole } from '../role/entities/role.entity';
+
+@Module({
+  imports: [
+    TypeOrmModule.forFeature([AdminUser, NestAuthMFASecret, NestAuthUser, NestAuthRole]),
+    forwardRef(() => AuthModule),
+    forwardRef(() => UserModule),
+    forwardRef(() => RoleModule),
+    forwardRef(() => TenantModule),
+    forwardRef(() => SessionModule),
+    PermissionModule,
+  ],
+  providers: [
+    AdminUserService,
+    AdminAuthService,
+    AdminSessionService,
+    AdminConsoleConfigService,
+    AdminSessionGuard,
+  ],
+  controllers: [
+    // Register API controllers FIRST so they match before the UI catch-all route
+    // More specific routes must be registered before less specific ones
+    AdminAuthController,
+    AdminUsersController,
+    AdminRolesController,
+    AdminTenantsController,
+    AdminPermissionsController,
+    // UI controller LAST - it has catch-all routes that should only match non-API paths
+    AdminConsoleController,
+  ],
+  exports: [
+    AdminUserService,
+    AdminAuthService,
+    AdminSessionService,
+    AdminConsoleConfigService,
+    AdminSessionGuard,
+    TypeOrmModule,
+  ],
+})
+export class AdminConsoleModule { }

package/src/lib/admin-console/controllers/admin-auth.controller.ts

@@ -0,0 +1,339 @@
+import {
+  BadRequestException,
+  Body,
+  Controller,
+  Delete,
+  ForbiddenException,
+  Get,
+  Param,
+  Patch,
+  Post,
+  Res,
+  UnauthorizedException,
+  UseGuards,
+} from '@nestjs/common';
+import { Response } from 'express';
+import { AdminAuthService } from '../services/admin-auth.service';
+import { AdminSessionService } from '../services/admin-session.service';
+import { AdminConsoleConfigService } from '../services/admin-console-config.service';
+import { AdminLoginDto } from '../dto/login.dto';
+import { AdminResetPasswordDto } from '../dto/reset-password.dto';
+import { AdminSignupDto } from '../dto/signup.dto';
+import { AdminSessionGuard } from '../guards/admin-session.guard';
+import { CurrentAdmin } from '../decorators/current-admin.decorator';
+import { AdminUser } from '../entities/admin-user.entity';
+import { CreateDashboardAdminDto, UpdateDashboardAdminDto } from '../dto/create-dashboard-admin.dto';
+import { AdminUserService } from '../services/admin-user.service';
+import type { AdminConsoleOptions } from '../../core/interfaces/auth-module-options.interface';
+import { compareKeys } from '../../utils/security.util';
+import { UserService } from '../../user/services/user.service';
+import { RoleService } from '../../role/services/role.service';
+import { TenantService } from '../../tenant/services/tenant.service';
+import { InjectRepository } from '@nestjs/typeorm';
+import { Repository } from 'typeorm';
+import { NestAuthUser } from '../../user/entities/user.entity';
+import { MoreThanOrEqual } from 'typeorm';
+
+@Controller('auth/admin')
+export class AdminAuthController {
+  constructor(
+    private readonly adminAuth: AdminAuthService,
+    private readonly sessions: AdminSessionService,
+    private readonly config: AdminConsoleConfigService,
+    private readonly adminUsers: AdminUserService,
+    private readonly userService: UserService,
+    private readonly roleService: RoleService,
+    private readonly tenantService: TenantService,
+    @InjectRepository(NestAuthUser)
+    private readonly userRepository: Repository<NestAuthUser>,
+  ) { }
+
+  private getCookieOptions() {
+    const opts = this.config.getCookieOptions();
+    const maxAge = this.sessions.getMaxAge();
+    if (maxAge) {
+      opts.maxAge = maxAge;
+    }
+    return opts;
+  }
+
+  @Post('signup')
+  async signup(@Body() dto: AdminSignupDto) {
+    this.config.ensureEnabled();
+
+    // Validate secret key using constant-time comparison to prevent timing attacks
+    const secretKey = this.config.getSecretKey();
+    console.log('secretKey', secretKey);
+    console.log('dto.secretKey', dto.secretKey);
+    if (!secretKey) {
+      throw new BadRequestException({
+        message: 'Admin console secret key is not configured. Please configure adminConsole.secretKey in AuthModuleOptions.',
+        code: 'ADMIN_CONSOLE_SECRET_NOT_CONFIGURED',
+      });
+    }
+
+    if (!compareKeys(dto.secretKey, secretKey)) {
+      throw new UnauthorizedException({
+        message: 'Invalid secret key',
+        code: 'INVALID_SECRET_KEY',
+      });
+    }
+
+    // Create admin user - allows multiple admins (no restriction like initialize)
+    const admin = await this.adminUsers.createAdmin({
+      email: dto.email,
+      password: dto.password,
+      name: dto.name,
+      metadata: dto.metadata || {},
+    });
+
+    return {
+      message: 'Admin user created successfully',
+      admin: this.toSafeAdmin(admin),
+    };
+  }
+
+  @Post('login')
+  async login(@Body() dto: AdminLoginDto, @Res({ passthrough: true }) res: Response) {
+    this.config.ensureEnabled();
+    const admin = await this.adminAuth.validateCredentials(dto.email, dto.password);
+    const token = this.sessions.createSession(admin);
+    res.cookie(this.sessions.getCookieName(), token, this.getCookieOptions());
+    return {
+      message: 'Signed in successfully',
+      admin: this.toSafeAdmin(admin),
+    };
+  }
+
+  @Post('logout')
+  @UseGuards(AdminSessionGuard)
+  async logout(@CurrentAdmin() admin: AdminUser, @Res({ passthrough: true }) res: Response) {
+    // Invalidate server-side session if session ID is available
+    try {
+      await this.sessions.invalidateSessionForAdmin(admin.id);
+    } catch (error) {
+      // Log error but continue with logout to ensure client cookie is cleared
+      console.error('Failed to invalidate admin session:', error);
+    }
+
+    res.cookie(this.sessions.getCookieName(), '', {
+      ...this.getCookieOptions(),
+      maxAge: 0,
+    });
+    return { message: 'Signed out' };
+  }
+
+  @Get('me')
+  @UseGuards(AdminSessionGuard)
+  async me(@CurrentAdmin() admin: AdminUser) {
+    return this.toSafeAdmin(admin);
+  }
+
+  @Get('config')
+  async publicConfig() {
+    // Only return properties that are actually used by the UI
+    return {
+      allowAdminManagement: this.config.allowAdminManagement(),
+    };
+  }
+
+  @Get('api/stats')
+  @UseGuards(AdminSessionGuard)
+  async getDashboardStats() {
+    // Get total counts efficiently
+    const [totalUsers, activeUsers, verifiedUsers] = await Promise.all([
+      this.userService.countUsers(),
+      this.userService.countUsers({ where: { isActive: true } }),
+      this.userService.countUsers({ where: { isVerified: true } }),
+    ]);
+
+    // Get roles and tenants counts
+    const roles = await this.roleService.getRoles();
+    const tenants = await this.tenantService.getTenants({ order: { createdAt: 'DESC' } });
+
+    // Calculate recent signups (last 7 days) - server-side
+    const sevenDaysAgo = new Date();
+    sevenDaysAgo.setDate(sevenDaysAgo.getDate() - 7);
+    sevenDaysAgo.setHours(0, 0, 0, 0);
+
+    const recentSignups = await this.userService.countUsers({
+      where: { createdAt: MoreThanOrEqual(sevenDaysAgo) },
+    });
+
+    // Calculate signups per day for the last 7 days using SQL aggregation
+    const dayNames = ['Sun', 'Mon', 'Tue', 'Wed', 'Thu', 'Fri', 'Sat'];
+    const activityData: Array<{ name: string; users: number }> = [];
+
+    // Initialize with 0 for each day
+    for (let i = 6; i >= 0; i--) {
+      const date = new Date();
+      date.setDate(date.getDate() - i);
+      date.setHours(0, 0, 0, 0);
+      const dayName = dayNames[date.getDay()];
+      activityData.push({ name: dayName, users: 0 });
+    }
+
+    // Query signups per day - fetch all signups from last 7 days and group in memory
+    // This is more database-agnostic than using DATE() which varies by DB type
+    const sevenDaysAgoStart = new Date();
+    sevenDaysAgoStart.setDate(sevenDaysAgoStart.getDate() - 7);
+    sevenDaysAgoStart.setHours(0, 0, 0, 0);
+
+    const recentUsers = await this.userRepository.find({
+      where: { createdAt: MoreThanOrEqual(sevenDaysAgoStart) },
+      select: ['createdAt'],
+    });
+
+    // Group signups by day in memory
+    recentUsers.forEach((user) => {
+      const signupDate = new Date(user.createdAt);
+      signupDate.setHours(0, 0, 0, 0);
+      const today = new Date();
+      today.setHours(0, 0, 0, 0);
+      const daysDiff = Math.floor((today.getTime() - signupDate.getTime()) / (1000 * 60 * 60 * 24));
+      if (daysDiff >= 0 && daysDiff <= 6) {
+        const index = 6 - daysDiff;
+        if (index >= 0 && index < activityData.length) {
+          activityData[index].users += 1;
+        }
+      }
+    });
+
+    return {
+      stats: {
+        totalUsers,
+        activeUsers,
+        verifiedUsers,
+        totalRoles: roles.length,
+        totalTenants: tenants.length,
+        recentSignups,
+      },
+      activityData,
+    };
+  }
+
+  @Get('setup-status')
+  async getSetupStatus() {
+    this.config.ensureEnabled();
+
+    // Check if nest-auth requires setup
+    const userCount = await this.userService.countUsers();
+    const rolesCount = await this.roleService.getRoles();
+
+    const needsSetup = userCount === 0 || rolesCount.length === 0;
+
+    return {
+      needsSetup,
+      stats: {
+        usersCount: userCount,
+        rolesCount: rolesCount.length,
+      },
+      setupSteps: [
+        {
+          id: 'roles',
+          title: 'Create Roles',
+          description: 'Set up roles and permissions for your users',
+          completed: rolesCount.length > 0,
+        },
+        {
+          id: 'users',
+          title: 'Create Users',
+          description: 'Add users to your system',
+          completed: userCount > 0,
+        },
+      ],
+    };
+  }
+
+  @Get('admins')
+  @UseGuards(AdminSessionGuard)
+  async listAdmins() {
+    if (!this.config.allowAdminManagement()) {
+      throw new ForbiddenException('Admin management disabled');
+    }
+    const admins = await this.adminUsers.listAdmins();
+    return {
+      data: admins.map((admin) => this.toSafeAdmin(admin)),
+    };
+  }
+
+  @Post('admins')
+  @UseGuards(AdminSessionGuard)
+  async createAdmin(@Body() dto: CreateDashboardAdminDto) {
+    if (!this.config.allowAdminManagement()) {
+      throw new ForbiddenException('Admin management disabled');
+    }
+    const admin = await this.adminUsers.createAdmin(dto);
+    return { admin: this.toSafeAdmin(admin) };
+  }
+
+  @Patch('admins/:id')
+  @UseGuards(AdminSessionGuard)
+  async updateAdmin(@Param('id') id: string, @Body() dto: UpdateDashboardAdminDto) {
+    if (!this.config.allowAdminManagement()) {
+      throw new ForbiddenException('Admin management disabled');
+    }
+    const admin = await this.adminUsers.updateAdmin(id, dto);
+    return { admin: this.toSafeAdmin(admin) };
+  }
+
+  @Delete('admins/:id')
+  @UseGuards(AdminSessionGuard)
+  async deleteAdmin(@Param('id') id: string) {
+    if (!this.config.allowAdminManagement()) {
+      throw new ForbiddenException('Admin management disabled');
+    }
+    await this.adminUsers.deleteAdmin(id);
+    return { message: 'Admin deleted successfully' };
+  }
+
+  @Post('reset-password')
+  async resetPassword(@Body() dto: AdminResetPasswordDto) {
+    this.config.ensureEnabled();
+
+    // Validate secret key using constant-time comparison to prevent timing attacks
+    const secretKey = this.config.getSecretKey();
+    if (!secretKey) {
+      throw new UnauthorizedException({
+        message: 'Admin console secret key not configured',
+        code: 'SECRET_KEY_NOT_CONFIGURED',
+      });
+    }
+
+    if (!compareKeys(dto.secretKey, secretKey)) {
+      throw new UnauthorizedException({
+        message: 'Invalid secret key',
+        code: 'INVALID_SECRET_KEY',
+      });
+    }
+
+    // Find the admin by email
+    const admin = await this.adminUsers.findByEmail(dto.email);
+    if (!admin) {
+      // Return generic error to avoid revealing if email exists
+      throw new UnauthorizedException({
+        message: 'Invalid credentials',
+        code: 'INVALID_CREDENTIALS',
+      });
+    }
+
+    // Update the password
+    await this.adminUsers.updateAdmin(admin.id, { password: dto.newPassword });
+
+    return {
+      message: 'Password reset successfully',
+    };
+  }
+
+  private toSafeAdmin(admin: AdminUser) {
+    return {
+      id: admin.id,
+      email: admin.email,
+      name: admin.name,
+      metadata: admin.metadata ?? {},
+      lastLoginAt: admin.lastLoginAt,
+      createdAt: admin.createdAt,
+      updatedAt: admin.updatedAt,
+    };
+  }
+}

package/src/lib/admin-console/controllers/admin-console.controller.ts

@@ -0,0 +1,82 @@
+import { Controller, Get, Logger, OnModuleInit, Param, Res } from '@nestjs/common';
+import { Response } from 'express';
+import { join } from 'path';
+import { existsSync, readFileSync } from 'fs';
+import { AdminConsoleConfigService } from '../services/admin-console-config.service';
+
+const candidateStaticRoots = [
+  // When the library itself is built (dist/packages/nest-auth/...)
+  join(__dirname, '..', 'static'),
+  // When the library is consumed via ts-node/tsconfig paths during development
+  join(process.cwd(), 'packages', 'nest-auth', 'src', 'lib', 'admin-console', 'static'),
+  // When the consumer (apps/nest-examples) compiles everything into dist/apps/...
+  join(process.cwd(), 'dist', 'apps', 'nest-examples', 'packages', 'nest-auth', 'src', 'lib', 'admin-console', 'static'),
+  // Generic fallback: dist/packages/... in monorepo root
+  join(process.cwd(), 'dist', 'packages', 'nest-auth', 'src', 'lib', 'admin-console', 'static'),
+];
+
+function resolveStaticRoot(): string {
+  for (const root of candidateStaticRoots) {
+    if (existsSync(join(root, 'index.html'))) {
+      return root;
+    }
+  }
+  return candidateStaticRoots[1];
+}
+
+@Controller('auth/admin')
+export class AdminConsoleController implements OnModuleInit {
+  private readonly logger = new Logger(AdminConsoleController.name);
+  private cachedIndexHtml: string | null = null;
+  private staticRoot = resolveStaticRoot();
+  private readonly indexPath = join(this.staticRoot, 'index.html');
+
+  constructor(private readonly config: AdminConsoleConfigService) { }
+
+  onModuleInit() {
+    if (!existsSync(this.indexPath)) {
+      this.logger.error('Admin console index.html not found at startup', { path: this.indexPath });
+      throw new Error(`Admin console index.html not found at ${this.indexPath}`);
+    }
+    try {
+      this.cachedIndexHtml = readFileSync(this.indexPath, 'utf8');
+      this.logger.log('Admin console index.html cached successfully');
+    } catch (error) {
+      this.logger.error('Failed to read admin console index.html on startup', { path: this.indexPath, message: error.message }, error.stack);
+    }
+  }
+
+  @Get()
+  async serveIndex(@Res() res: Response) {
+    this.config.ensureEnabled();
+
+    if (!this.cachedIndexHtml) {
+      this.logger.error('Cached index.html is not available');
+      res.status(500).send('Internal Server Error');
+      return;
+    }
+
+    try {
+      let content = this.cachedIndexHtml;
+
+      const basePath = this.config.getBasePath();
+      const config = { basePath };
+      const js = `window.__NEST_AUTH_CONFIG__ = ${JSON.stringify(config)};`;
+
+      // Inject external config script tag to satisfy CSP (no inline script)
+      const configScriptTag = `<script>${js}</script>`;
+
+      // Insert config script before closing </head> tag or at the start of <body>
+      if (content.includes('<head>')) {
+        content = content.replace('<head>', `${configScriptTag}<head>`);
+      }
+
+      res.setHeader('Content-Type', 'text/html');
+      res.send(content);
+    } catch (error) {
+      this.logger.error('Failed to serve admin console index.html', { path: this.indexPath, message: error.message }, error.stack);
+      res.status(500).send('Internal Server Error');
+    }
+  }
+
+}