@ackplus/nest-auth 0.1.51 → 1.1.0

package/src/lib/user/entities/identity.entity.ts

@@ -0,0 +1,31 @@
+import { Entity, PrimaryGeneratedColumn, Column, CreateDateColumn, UpdateDateColumn, ManyToOne, RelationId, JoinColumn, BaseEntity } from "typeorm";
+import { NestAuthUser } from "./user.entity";
+
+@Entity('nest_auth_identities')
+export class NestAuthIdentity extends BaseEntity {
+    @PrimaryGeneratedColumn('uuid')
+    id: string;
+
+    @Column()
+    provider: string;
+
+    @Column({ nullable: true })
+    providerId: string;
+
+    @Column({ type: 'simple-json', nullable: true, default: '{}' })
+    metadata: Record<string, any>;
+
+    @CreateDateColumn()
+    createdAt: Date;
+
+    @UpdateDateColumn()
+    updatedAt: Date;
+
+    @Column({ nullable: true })
+    @RelationId((identity: NestAuthIdentity) => identity.user)
+    userId: string;
+
+    @ManyToOne(() => NestAuthUser, { onDelete: 'CASCADE' })
+    @JoinColumn({ name: 'userId' })
+    user: NestAuthUser;
+}

package/src/lib/user/entities/user.entity.ts

@@ -0,0 +1,212 @@
+import {
+    Entity,
+    PrimaryGeneratedColumn,
+    Column,
+    CreateDateColumn,
+    UpdateDateColumn,
+    ManyToOne,
+    OneToMany,
+    BaseEntity,
+    Index,
+    BeforeInsert,
+    BeforeUpdate,
+    ManyToMany,
+    In,
+} from "typeorm";
+import * as argon2 from 'argon2';
+import { NestAuthTenant } from "../../tenant/entities/tenant.entity";
+import { NestAuthIdentity } from "./identity.entity";
+import { NestAuthSession } from "../../session/entities/session.entity";
+import { chain } from "lodash";
+import { NestAuthOTP } from "../../auth/entities/otp.entity";
+import { NestAuthMFASecret } from "../../auth/entities/mfa-secret.entity";
+import { NestAuthRole } from "../../role/entities/role.entity";
+
+@Entity('nest_auth_users')
+export class NestAuthUser extends BaseEntity {
+    @PrimaryGeneratedColumn('uuid')
+    id: string;
+
+    @Column({ nullable: true })
+    @Index()
+    email: string;
+
+    @Column({ nullable: true })
+    @Index()
+    emailVerifiedAt: Date;
+
+    @Column({ nullable: true })
+    @Index()
+    phone: string;
+
+    @Column({ nullable: true })
+    @Index()
+    phoneVerifiedAt: Date;
+
+    @Column({ nullable: true })
+    passwordHash: string;
+
+    @Column({ default: false })
+    isVerified: boolean;
+
+    @Column({ default: true })
+    isActive: boolean;
+
+    @Column({ type: 'simple-json', nullable: true, default: '{}' })
+    metadata?: Record<string, any>;
+
+    @Column({ nullable: true })
+    tenantId?: string;
+
+    @Column({ default: false })
+    isMfaEnabled: boolean;
+
+    @Column({ nullable: true })
+    mfaRecoveryCode?: string;
+
+    @ManyToOne(() => NestAuthTenant, { onDelete: 'CASCADE' })
+    tenant: NestAuthTenant;
+
+    @OneToMany(() => NestAuthIdentity, identity => identity.user)
+    identities: NestAuthIdentity[];
+
+    @OneToMany(() => NestAuthMFASecret, mfaSecret => mfaSecret.user)
+    mfaSecrets: NestAuthMFASecret[];
+
+    @OneToMany(() => NestAuthSession, session => session.user)
+    sessions: NestAuthSession[];
+
+    @OneToMany(() => NestAuthOTP, otp => otp.user)
+    otps: NestAuthOTP[];
+
+    @ManyToMany(() => NestAuthRole, role => role.users, { onDelete: 'CASCADE' })
+    roles: NestAuthRole[];
+
+    @Index('IDX_USER_EMAIL_TENANT', { unique: true })
+    @Column({ nullable: true })
+    emailTenant: string;
+
+    @Index('IDX_USER_PHONE_TENANT', { unique: true })
+    @Column({ nullable: true })
+    phoneTenant: string;
+
+    @CreateDateColumn()
+    createdAt: Date;
+
+    @UpdateDateColumn()
+    updatedAt: Date;
+
+
+    @BeforeInsert()
+    @BeforeUpdate()
+    updateTenantFields() {
+        // Normalize email to lowercase for consistency
+        if (this.email) {
+            this.email = this.email.toLowerCase().trim();
+        }
+        this.emailTenant = this.email ? `${this.email}:${this.tenantId || 'global'}` : null;
+        this.phoneTenant = this.phone ? `${this.phone}:${this.tenantId || 'global'}` : null;
+    }
+
+    async getPermissions(): Promise<string[]> {
+        if (!this.roles) {
+            this.roles = await NestAuthRole.find({
+                select: {
+                    id: true,
+                    name: true,
+                    permissions: true
+                },
+                where: { users: { id: this.id }, tenantId: this.tenantId }
+            });
+        }
+        return chain(this.roles)
+            .map(role => role.permissions)
+            .flatten()
+            .uniq()
+            .value();
+    }
+
+    async getRoles(): Promise<NestAuthRole[]> {
+        if (!this.roles) {
+            this.roles = await NestAuthRole.find({
+                select: {
+                    id: true,
+                    name: true,
+                    isSystem: true,
+                    guard: true,
+                },
+                where: { users: { id: this.id }, tenantId: this.tenantId }
+            });
+        }
+        return this.roles;
+    }
+
+    async assignRoles(roles: string | string[], guard: string): Promise<void> {
+        // Find both system roles and tenant - specific roles
+        this.roles = await NestAuthRole.find({
+            where: [
+                // System roles (tenantId is null)
+                { name: In(Array.isArray(roles) ? roles : [roles]), isSystem: true, guard },
+                // Tenant-specific roles
+                { name: In(Array.isArray(roles) ? roles : [roles]), tenantId: this.tenantId, isSystem: false, guard }
+            ]
+        });
+    }
+
+    async findOrCreateIdentity(provider: string, providerId: string) {
+        const existingIdentity = await NestAuthIdentity.findOne({
+            where: { provider, providerId, userId: this.id }
+        });
+
+        if (existingIdentity) {
+            return existingIdentity;
+        }
+
+        const identity = new NestAuthIdentity();
+        identity.provider = provider;
+        identity.providerId = providerId;
+        identity.user = this;
+
+        return identity.save();
+    }
+
+    async updateOrCreateIdentity(
+        provider: string,
+        data: Partial<NestAuthIdentity>
+    ): Promise<NestAuthIdentity> {
+        let identity = {} as NestAuthIdentity;
+        if (provider) {
+            identity = await NestAuthIdentity.findOne({
+                where: { provider, userId: this.id },
+            });
+        }
+
+        identity = NestAuthIdentity.create<NestAuthIdentity>({
+            provider,
+            ...identity,
+            ...data,
+            userId: this.id,
+        });
+        return identity.save();
+    }
+
+    async validatePassword(password: string): Promise<boolean> {
+        if (!this.passwordHash) return false;
+        try {
+            return await argon2.verify(this.passwordHash, password);
+        } catch (error) {
+            // Invalid hash format or verification error
+            return false;
+        }
+    }
+
+    async setPassword(password: string): Promise<void> {
+        // Argon2id is the recommended variant (hybrid of Argon2i and Argon2d)
+        this.passwordHash = await argon2.hash(password, {
+            type: argon2.argon2id,
+            memoryCost: 65536, // 64 MiB
+            timeCost: 3,       // 3 iterations
+            parallelism: 4     // 4 parallel threads
+        });
+    }
+}

package/src/lib/user/events/{user-created.event.d.ts → user-created.event.ts}

@@ -1,9 +1,10 @@
 import { NestAuthUser } from '../entities/user.entity';
+
 export interface UserCreatedEventPayload {
     user: NestAuthUser;
     tenantId?: string;
 }
-export declare class UserCreatedEvent {
-    readonly payload: UserCreatedEventPayload;
-    constructor(payload: UserCreatedEventPayload);
+
+export class UserCreatedEvent {
+    constructor(public readonly payload: UserCreatedEventPayload) { }
 }

package/src/lib/user/events/{user-deleted.event.d.ts → user-deleted.event.ts}

@@ -1,9 +1,12 @@
 import { NestAuthUser } from "../entities/user.entity";
+
 export interface UserDeletedEventPayload {
     user: NestAuthUser;
     tenantId?: string;
 }
-export declare class UserDeletedEvent {
-    readonly payload: UserDeletedEventPayload;
-    constructor(payload: UserDeletedEventPayload);
+
+export class UserDeletedEvent {
+    constructor(
+        public readonly payload: UserDeletedEventPayload,
+    ) { }
 }

package/src/lib/user/events/{user-updated.event.d.ts → user-updated.event.ts}

@@ -1,10 +1,13 @@
 import { NestAuthUser } from "../entities/user.entity";
+
 export interface UserUpdatedEventPayload {
     user: NestAuthUser;
     tenantId?: string;
     updatedFields: string[];
 }
-export declare class UserUpdatedEvent {
-    readonly payload: UserUpdatedEventPayload;
-    constructor(payload: UserUpdatedEventPayload);
+
+export class UserUpdatedEvent {
+    constructor(
+        public readonly payload: UserUpdatedEventPayload,
+    ) { }
 }

package/src/lib/user/index.ts

@@ -0,0 +1,11 @@
+// DTOs
+export * from './dto/requests/update-user.dto';
+
+// Services
+export * from './services/user.service';
+export * from './services/access-key.service';
+
+// Entities
+export * from './entities/user.entity';
+export * from './entities/identity.entity';
+export * from './entities/access-key.entity';

package/src/lib/user/services/access-key.service.ts

@@ -0,0 +1,145 @@
+import { Injectable, NotFoundException, BadRequestException } from '@nestjs/common';
+import { InjectRepository } from '@nestjs/typeorm';
+import { Repository } from 'typeorm';
+import { NestAuthAccessKey } from '../entities/access-key.entity';
+import { NestAuthUser } from '../entities/user.entity';
+import { EventEmitter2 } from '@nestjs/event-emitter';
+import { randomBytes, createHash } from 'crypto';
+import { NestAuthEvents } from '../../auth.constants';
+
+@Injectable()
+export class AccessKeyService {
+    constructor(
+        @InjectRepository(NestAuthAccessKey)
+        private accessKeyRepository: Repository<NestAuthAccessKey>,
+
+        @InjectRepository(NestAuthUser)
+        private userRepository: Repository<NestAuthUser>,
+        private eventEmitter: EventEmitter2
+    ) { }
+
+    private generateKeyPair(): { publicKey: string; privateKey: string } {
+        const privateKey = randomBytes(32).toString('hex');
+        const publicKey = createHash('sha256').update(privateKey).digest('hex');
+        return { publicKey, privateKey };
+    }
+
+    async createAccessKey(userId: string, name: string): Promise<NestAuthAccessKey> {
+        const user = await this.userRepository.findOne({ where: { id: userId } });
+        if (!user) {
+            throw new NotFoundException({
+                message: `User with ID ${userId} not found`,
+                code: 'USER_NOT_FOUND'
+            });
+        }
+
+        const { publicKey, privateKey } = this.generateKeyPair();
+
+        const accessKey = this.accessKeyRepository.create({
+            name,
+            publicKey,
+            privateKey,
+            userId,
+        });
+
+        const savedKey = await this.accessKeyRepository.save(accessKey);
+
+        // Emit access key created event
+        await this.eventEmitter.emitAsync(
+            NestAuthEvents.ACCESS_KEY_CREATED,
+            {
+                accessKey: savedKey,
+                userId
+            }
+        );
+
+        return savedKey;
+    }
+
+    async getAccessKey(publicKey: string): Promise<NestAuthAccessKey> {
+        const accessKey = await this.accessKeyRepository.findOne({
+            where: { publicKey },
+            relations: ['user']
+        });
+
+        if (!accessKey) {
+            throw new NotFoundException({
+                message: 'Invalid access key',
+                code: 'INVALID_ACCESS_KEY'
+            });
+        }
+
+        if (!accessKey.isActive) {
+            throw new BadRequestException({
+                message: 'Access key is inactive',
+                code: 'INACTIVE_ACCESS_KEY'
+            });
+        }
+
+        if (accessKey.expiresAt && accessKey.expiresAt < new Date()) {
+            throw new BadRequestException({
+                message: 'Access key has expired',
+                code: 'EXPIRED_ACCESS_KEY'
+            });
+        }
+
+        return accessKey;
+    }
+
+    async validateAccessKey(publicKey: string, privateKey: string): Promise<boolean> {
+        const accessKey = await this.getAccessKey(publicKey);
+        return accessKey.privateKey === privateKey;
+    }
+
+    async getUserAccessKeys(userId: string): Promise<NestAuthAccessKey[]> {
+        return this.accessKeyRepository.find({
+            where: { userId },
+            order: { createdAt: 'DESC' }
+        });
+    }
+
+    async deactivateAccessKey(publicKey: string): Promise<NestAuthAccessKey> {
+        const accessKey = await this.getAccessKey(publicKey);
+        accessKey.isActive = false;
+
+        const updatedKey = await this.accessKeyRepository.save(accessKey);
+
+        // Emit access key deactivated event
+        await this.eventEmitter.emitAsync(
+            NestAuthEvents.ACCESS_KEY_DEACTIVATED,
+            {
+                accessKey: updatedKey,
+                userId: updatedKey.userId
+            }
+        );
+
+        return updatedKey;
+    }
+
+    async updateAccessKeyLastUsed(publicKey: string): Promise<void> {
+        const accessKey = await this.getAccessKey(publicKey);
+        accessKey.lastUsedAt = new Date();
+        await this.accessKeyRepository.save(accessKey);
+    }
+
+    async setAccessKeyExpiry(publicKey: string, expiresAt: Date): Promise<NestAuthAccessKey> {
+        const accessKey = await this.getAccessKey(publicKey);
+        accessKey.expiresAt = expiresAt;
+        return this.accessKeyRepository.save(accessKey);
+    }
+
+    async deleteAccessKey(publicKey: string): Promise<void> {
+        const accessKey = await this.getAccessKey(publicKey);
+
+        // Emit access key deleted event before deletion
+        await this.eventEmitter.emitAsync(
+            NestAuthEvents.ACCESS_KEY_DELETED,
+            {
+                accessKey,
+                userId: accessKey.userId
+            }
+        );
+
+        await this.accessKeyRepository.remove(accessKey);
+    }
+}