@ackplus/nest-auth 0.1.51 → 1.1.0

package/src/lib/admin-console/controllers/admin-users.controller.ts

@@ -0,0 +1,379 @@
+import {
+  Body,
+  Controller,
+  Delete,
+  Get,
+  Param,
+  Patch,
+  Post,
+  Query,
+  UseGuards,
+} from '@nestjs/common';
+import { NotFoundException } from '@nestjs/common';
+import { InjectRepository } from '@nestjs/typeorm';
+import { Repository } from 'typeorm';
+import { AdminSessionGuard } from '../guards/admin-session.guard';
+import { AdminCreateUserDto, AdminUpdateUserDto } from '../dto/admin-user.dto';
+import { UserService } from '../../user/services/user.service';
+import { TenantService } from '../../tenant/services/tenant.service';
+import { NestAuthUser } from '../../user/entities/user.entity';
+import { NestAuthMFASecret } from '../../auth/entities/mfa-secret.entity';
+import { DEFAULT_GUARD_NAME, EMAIL_AUTH_PROVIDER, PHONE_AUTH_PROVIDER } from '../../auth.constants';
+import { FindOptionsWhere, Like } from 'typeorm';
+import { MfaService } from '../../auth/services/mfa.service';
+import { SessionManagerService } from '../../session/services/session-manager.service';
+import { NestAuthSession } from '../../session/entities/session.entity';
+
+@Controller('auth/admin/api/users')
+@UseGuards(AdminSessionGuard)
+export class AdminUsersController {
+  constructor(
+    private readonly users: UserService,
+    private readonly tenantService: TenantService,
+    private readonly mfaService: MfaService,
+    private readonly sessionManager: SessionManagerService,
+    @InjectRepository(NestAuthMFASecret)
+    private readonly mfaSecretRepository: Repository<NestAuthMFASecret>,
+  ) { }
+
+  private async ensureUserExists(id: string): Promise<NestAuthUser> {
+    const user = await this.users.getUserById(id);
+    if (!user) {
+      throw new NotFoundException('User not found');
+    }
+    return user;
+  }
+
+  private toSessionResponse(session: NestAuthSession) {
+    return {
+      id: session.id,
+      deviceName: session.deviceName || 'Unknown device',
+      userAgent: session.userAgent,
+      ipAddress: session.ipAddress,
+      lastActive: session.lastActive,
+      createdAt: session.createdAt,
+      expiresAt: session.expiresAt,
+    };
+  }
+
+  private buildStatusFilter(status?: string): Partial<FindOptionsWhere<NestAuthUser>> {
+    if (!status) return {};
+    switch (status) {
+      case 'active':
+        return { isActive: true };
+      case 'inactive':
+        return { isActive: false };
+      case 'verified':
+        return { isVerified: true };
+      case 'unverified':
+        return { isVerified: false };
+      default:
+        return {};
+    }
+  }
+
+  private escapeLikePattern(value: string): string {
+    return value.replace(/[%_\\]/g, '\\$&');
+  }
+
+  @Get()
+  async listUsers(
+    @Query('page') page?: string,
+    @Query('limit') limit?: string,
+    @Query('search') search?: string,
+    @Query('status') status?: string,
+  ) {
+    // Validate and sanitize pagination parameters
+    let pageNum = parseInt(page || '1', 10);
+    let limitNum = parseInt(limit || '10', 10);
+
+    // Ensure page is at least 1
+    if (isNaN(pageNum) || pageNum < 1) {
+      pageNum = 1;
+    }
+
+    // Ensure limit is positive and capped at 100
+    if (isNaN(limitNum) || limitNum <= 0) {
+      limitNum = 10;
+    }
+    if (limitNum > 100) {
+      limitNum = 100;
+    }
+
+    const skip = (pageNum - 1) * limitNum;
+
+    // Build where clause with proper TypeORM typing
+    let where: FindOptionsWhere<NestAuthUser>[] | FindOptionsWhere<NestAuthUser> = {};
+
+    // Apply search filter with proper OR conditions using array syntax
+    if (search && search.trim()) {
+      const escapedSearch = this.escapeLikePattern(search.trim());
+      const searchPattern = `%${escapedSearch}%`;
+
+      // Base status filter if present
+      const baseFilter: FindOptionsWhere<NestAuthUser> = {
+        ...this.buildStatusFilter(status),
+      };
+
+      // Create OR conditions for search
+      where = [
+        { ...baseFilter, email: Like(searchPattern) },
+        { ...baseFilter, phone: Like(searchPattern) },
+        { ...baseFilter, tenantId: Like(searchPattern) },
+      ];
+    } else {
+      // Apply status filter without search
+      Object.assign(where as FindOptionsWhere<NestAuthUser>, this.buildStatusFilter(status));
+    }
+
+    // Get users and total count in a single query
+    const [users, total] = await this.users.getUsersAndCount({
+      where,
+      relations: ['roles'],
+      order: { createdAt: 'DESC' },
+      skip,
+      take: limitNum,
+    });
+
+    return {
+      data: users.map((user) => this.toSafeUser(user)),
+      meta: {
+        page: pageNum,
+        limit: limitNum,
+        total,
+        totalPages: Math.ceil(total / limitNum),
+      },
+    };
+  }
+
+  @Post()
+  async createUser(@Body() dto: AdminCreateUserDto) {
+    const tenantId = await this.tenantService.resolveTenantId(dto.tenantId);
+    const user = await this.users.createUser({
+      email: dto.email,
+      phone: dto.phone,
+      tenantId,
+      metadata: dto.metadata ?? {},
+      isActive: dto.isActive ?? true,
+      isVerified: dto.isVerified ?? false,
+    });
+
+    if (dto.password) {
+      await user.setPassword(dto.password);
+      await user.save();
+    }
+
+    if (dto.roles?.length) {
+      await user.assignRoles(dto.roles, DEFAULT_GUARD_NAME);
+      await user.save();
+    }
+
+    return { user: this.toSafeUser(user) };
+  }
+
+  @Get(':id')
+  async getUser(@Param('id') id: string) {
+    const user = await this.users.getUserById(id, {
+      relations: ['roles', 'mfaSecrets', 'identities']
+    });
+    if (!user) {
+      throw new NotFoundException('User not found');
+    }
+
+    const availableMethods = this.mfaService.getAvailableMethods();
+    const [enabledMethods, sessions] = await Promise.all([
+      this.mfaService.getEnabledMethods(user.id),
+      this.sessionManager.getUserSessions(user.id),
+    ]);
+
+    const sortedSessions = sessions
+      .sort((a, b) => {
+        const aTime = a.lastActive?.getTime() ?? a.updatedAt?.getTime() ?? 0;
+        const bTime = b.lastActive?.getTime() ?? b.updatedAt?.getTime() ?? 0;
+        return bTime - aTime;
+      })
+      .map((session) => this.toSessionResponse(session));
+
+    return {
+      user: this.toSafeUser(user),
+      loginMethods: {
+        emailEnabled: !!user.email && !!user.emailVerifiedAt,
+        phoneEnabled: !!user.phone && !!user.phoneVerifiedAt,
+        hasPassword: !!user.passwordHash,
+      },
+      mfa: {
+        isEnabled: user.isMfaEnabled,
+        allowUserToggle: this.mfaService.mfaConfig?.allowUserToggle ?? false,
+        availableMethods,
+        enabledMethods,
+        hasRecoveryCode: !!user.mfaRecoveryCode,
+        totpDevices: user.mfaSecrets?.map((device) => ({
+          id: device.id,
+          deviceName: device.deviceName || 'Authenticator',
+          verified: device.verified,
+          lastUsedAt: device.lastUsedAt,
+          createdAt: device.createdAt,
+        })) || [],
+      },
+      sessions: sortedSessions,
+    };
+  }
+
+  @Patch(':id')
+  async updateUser(@Param('id') id: string, @Body() dto: AdminUpdateUserDto) {
+    let user = await this.users.getUserById(id, { relations: ['roles', 'identities'] });
+    if (!user) {
+      throw new NotFoundException('User not found');
+    }
+
+    // Apply basic field updates if provided
+    if (dto.isActive !== undefined || dto.isVerified !== undefined || dto.metadata !== undefined ||
+      dto.isMfaEnabled !== undefined) {
+      const updates: Partial<NestAuthUser> = {};
+      if (dto.isActive !== undefined) updates.isActive = dto.isActive;
+      if (dto.isVerified !== undefined) updates.isVerified = dto.isVerified;
+      if (dto.metadata !== undefined) updates.metadata = dto.metadata;
+      if (dto.isMfaEnabled !== undefined) updates.isMfaEnabled = dto.isMfaEnabled;
+
+      user = await this.users.updateUser(id, updates);
+    }
+
+    // Enable/disable email login
+    if (dto.emailLoginEnabled !== undefined) {
+      if (dto.emailLoginEnabled) {
+        if (!user.email) {
+          throw new NotFoundException('User has no email address');
+        }
+        user.emailVerifiedAt = user.emailVerifiedAt || new Date();
+        // Ensure identity exists
+        await user.findOrCreateIdentity(EMAIL_AUTH_PROVIDER, user.email);
+      } else {
+        user.emailVerifiedAt = null;
+        // Remove email identity if exists
+        const emailIdentity = user.identities?.find(i => i.provider === EMAIL_AUTH_PROVIDER);
+        if (emailIdentity) {
+          await emailIdentity.remove();
+        }
+      }
+    }
+
+    // Enable/disable phone login
+    if (dto.phoneLoginEnabled !== undefined) {
+      if (dto.phoneLoginEnabled) {
+        if (!user.phone) {
+          throw new NotFoundException('User has no phone number');
+        }
+        user.phoneVerifiedAt = user.phoneVerifiedAt || new Date();
+        // Ensure identity exists
+        await user.findOrCreateIdentity(PHONE_AUTH_PROVIDER, user.phone);
+      } else {
+        user.phoneVerifiedAt = null;
+        // Remove phone identity if exists
+        const phoneIdentity = user.identities?.find(i => i.provider === PHONE_AUTH_PROVIDER);
+        if (phoneIdentity) {
+          await phoneIdentity.remove();
+        }
+      }
+    }
+
+    // Apply password change in-memory
+    if (dto.password) {
+      await user.setPassword(dto.password);
+    }
+
+    // Apply role changes in-memory
+    if (dto.roles) {
+      await user.assignRoles(dto.roles, DEFAULT_GUARD_NAME);
+    }
+
+    // Save all changes
+    await user.save();
+
+    return { user: this.toSafeUser(user) };
+  }
+
+  @Delete(':id/totp-devices/:deviceId')
+  async deleteTotpDevice(@Param('id') id: string, @Param('deviceId') deviceId: string) {
+    const user = await this.users.getUserById(id);
+    if (!user) {
+      throw new NotFoundException('User not found');
+    }
+
+    const device = await this.mfaSecretRepository.findOne({
+      where: { id: deviceId, userId: user.id },
+    });
+
+    if (!device) {
+      throw new NotFoundException('TOTP device not found');
+    }
+
+    await this.mfaSecretRepository.remove(device);
+    return { message: 'TOTP device deleted successfully' };
+  }
+
+  @Get(':id/sessions')
+  async listSessions(@Param('id') id: string) {
+    const user = await this.ensureUserExists(id);
+    const sessions = await this.sessionManager.getUserSessions(user.id);
+    return {
+      data: sessions
+        .sort((a, b) => {
+          const aTime = a.lastActive?.getTime() ?? a.updatedAt?.getTime() ?? 0;
+          const bTime = b.lastActive?.getTime() ?? b.updatedAt?.getTime() ?? 0;
+          return bTime - aTime;
+        })
+        .map((session) => this.toSessionResponse(session)),
+    };
+  }
+
+  @Delete(':id/sessions/:sessionId')
+  async revokeSession(@Param('id') id: string, @Param('sessionId') sessionId: string) {
+    const user = await this.ensureUserExists(id);
+
+    try {
+      const session = await this.sessionManager.getSession(sessionId, false);
+      if (session.userId !== user.id) {
+        throw new NotFoundException('Session not found for this user');
+      }
+    } catch {
+      throw new NotFoundException('Session not found for this user');
+    }
+
+    await this.sessionManager.revokeSession(sessionId);
+    return { message: 'Session revoked successfully' };
+  }
+
+  @Delete(':id/sessions')
+  async revokeAllSessions(@Param('id') id: string) {
+    const user = await this.ensureUserExists(id);
+    await this.sessionManager.revokeAllUserSessions(user.id);
+    return { message: 'All sessions revoked successfully' };
+  }
+
+  @Delete(':id')
+  async deleteUser(@Param('id') id: string) {
+    await this.users.deleteUser(id);
+    return { message: 'User removed' };
+  }
+
+  private toSafeUser(user: NestAuthUser | null) {
+    if (!user) {
+      return null;
+    }
+    return {
+      id: user.id,
+      email: user.email,
+      phone: user.phone,
+      tenantId: user.tenantId,
+      isActive: user.isActive,
+      isVerified: user.isVerified,
+      metadata: user.metadata ?? {},
+      roles: user.roles?.map((role) => role.name) ?? [],
+      createdAt: user.createdAt,
+      updatedAt: user.updatedAt,
+      emailVerifiedAt: user.emailVerifiedAt,
+      phoneVerifiedAt: user.phoneVerifiedAt,
+      isMfaEnabled: user.isMfaEnabled,
+    };
+  }
+}

package/src/lib/admin-console/decorators/current-admin.decorator.ts

@@ -0,0 +1,9 @@
+import { createParamDecorator, ExecutionContext } from '@nestjs/common';
+import { AdminUser } from '../entities/admin-user.entity';
+
+export const CurrentAdmin = createParamDecorator(
+  (data: unknown, context: ExecutionContext): AdminUser | undefined => {
+    const request = context.switchToHttp().getRequest();
+    return request.adminUser as AdminUser | undefined;
+  },
+);

package/src/lib/admin-console/dto/admin-permission.dto.ts

@@ -0,0 +1,106 @@
+import { IsString, IsNotEmpty, IsOptional, IsObject, MaxLength, MinLength } from 'class-validator';
+import { ApiProperty } from '@nestjs/swagger';
+
+export class AdminCreatePermissionDto {
+    @ApiProperty({
+        description: 'Permission name (must be unique per guard)',
+        example: 'users.create',
+        minLength: 1,
+        maxLength: 255,
+    })
+    @IsString()
+    @IsNotEmpty()
+    @MinLength(1)
+    @MaxLength(255)
+    name: string;
+
+    @ApiProperty({
+        description: 'Guard name (defaults to "web" if not provided)',
+        required: false,
+        example: 'web',
+    })
+    @IsOptional()
+    @IsString()
+    guard?: string;
+
+    @ApiProperty({
+        description: 'Optional description of what this permission allows',
+        required: false,
+        example: 'Allows creating new user accounts',
+    })
+    @IsOptional()
+    @IsString()
+    description?: string;
+
+    @ApiProperty({
+        description: 'Optional category to group permissions (e.g., "users", "posts", "admin")',
+        required: false,
+        example: 'users',
+    })
+    @IsOptional()
+    @IsString()
+    category?: string;
+
+    @ApiProperty({
+        description: 'Optional metadata for additional permission information',
+        required: false,
+        example: { level: 'write', resource: 'users' },
+    })
+    @IsOptional()
+    @IsObject()
+    metadata?: Record<string, any>;
+}
+
+export class AdminUpdatePermissionDto {
+    @ApiProperty({
+        description: 'Permission name (must be unique per guard if changed). If changed, can optionally update in all roles.',
+        required: false,
+        example: 'users.create',
+    })
+    @IsOptional()
+    @IsString()
+    @MinLength(1)
+    @MaxLength(255)
+    name?: string;
+
+    @ApiProperty({
+        description: 'Guard name',
+        required: false,
+        example: 'web',
+    })
+    @IsOptional()
+    @IsString()
+    guard?: string;
+
+    @ApiProperty({
+        description: 'Whether to update permission name in all roles that use it (only if name is being changed)',
+        required: false,
+        default: false,
+    })
+    @IsOptional()
+    updateInRoles?: boolean;
+
+    @ApiProperty({
+        description: 'Optional description of what this permission allows',
+        required: false,
+    })
+    @IsOptional()
+    @IsString()
+    description?: string;
+
+    @ApiProperty({
+        description: 'Optional category to group permissions',
+        required: false,
+    })
+    @IsOptional()
+    @IsString()
+    category?: string;
+
+    @ApiProperty({
+        description: 'Optional metadata',
+        required: false,
+    })
+    @IsOptional()
+    @IsObject()
+    metadata?: Record<string, any>;
+}

package/src/lib/admin-console/dto/admin-role.dto.ts

@@ -0,0 +1,45 @@
+import {
+  IsArray,
+  IsBoolean,
+  IsNotEmpty,
+  IsOptional,
+  IsString,
+} from 'class-validator';
+
+export class AdminCreateRoleDto {
+  @IsString()
+  @IsNotEmpty()
+  name: string;
+
+  @IsString()
+  @IsNotEmpty()
+  guard: string;
+
+  @IsOptional()
+  @IsString()
+  tenantId?: string;
+
+  @IsOptional()
+  @IsBoolean()
+  isSystem?: boolean;
+
+  @IsOptional()
+  @IsArray()
+  @IsString({ each: true })
+  permissions?: string[];
+}
+
+export class AdminUpdateRoleDto {
+  @IsOptional()
+  @IsString()
+  name?: string;
+
+  @IsOptional()
+  @IsString()
+  guard?: string;
+
+  @IsOptional()
+  @IsArray()
+  @IsString({ each: true })
+  permissions?: string[];
+}

package/src/lib/admin-console/dto/admin-tenant.dto.ts

@@ -0,0 +1,43 @@
+import { IsNotEmpty, IsObject, IsOptional, IsString, Matches } from 'class-validator';
+
+export class AdminCreateTenantDto {
+  @IsString()
+  @IsNotEmpty()
+  name: string;
+
+  @IsString()
+  @IsNotEmpty()
+  @Matches(/^[a-z0-9]+(?:-[a-z0-9]+)*$/, {
+    message: 'Slug must be lowercase alphanumeric with hyphens, no leading/trailing or consecutive hyphens'
+  })
+  slug: string;
+
+  @IsOptional()
+  @IsString()
+  description?: string;
+
+  @IsOptional()
+  @IsObject()
+  metadata?: Record<string, any>;
+}
+
+export class AdminUpdateTenantDto {
+  @IsOptional()
+  @IsString()
+  name?: string;
+
+  @IsOptional()
+  @IsString()
+  @Matches(/^[a-z0-9]+(?:-[a-z0-9]+)*$/, {
+    message: 'Slug must be lowercase alphanumeric with hyphens, no leading/trailing or consecutive hyphens'
+  })
+  slug?: string;
+
+  @IsOptional()
+  @IsString()
+  description?: string;
+
+  @IsOptional()
+  @IsObject()
+  metadata?: Record<string, any>;
+}

package/src/lib/admin-console/dto/admin-user.dto.ts

@@ -0,0 +1,87 @@
+import {
+  IsArray,
+  IsBoolean,
+  IsEmail,
+  IsNotEmpty,
+  IsOptional,
+  IsString,
+  Matches,
+  MinLength,
+} from 'class-validator';
+
+export class AdminCreateUserDto {
+  @IsEmail()
+  email: string;
+
+  @IsOptional()
+  @IsString()
+  phone?: string;
+
+  @IsOptional()
+  @IsString()
+  @MinLength(8)
+  @Matches(
+    /^(?=.*[a-z])(?=.*[A-Z])(?=.*\d)(?=.*[@$!%*?&])[A-Za-z\d@$!%*?&]+$/,
+    { message: 'Password must contain uppercase, lowercase, number, and special character' }
+  )
+  password?: string;
+
+  @IsString()
+  @IsNotEmpty()
+  tenantId: string;
+
+  @IsOptional()
+  @IsBoolean()
+  isActive?: boolean;
+
+  @IsOptional()
+  @IsBoolean()
+  isVerified?: boolean;
+
+  @IsOptional()
+  @IsArray()
+  @IsString({ each: true })
+  roles?: string[];
+
+  @IsOptional()
+  metadata?: Record<string, any>;
+}
+
+export class AdminUpdateUserDto {
+  @IsOptional()
+  @IsBoolean()
+  isActive?: boolean;
+
+  @IsOptional()
+  @IsBoolean()
+  isVerified?: boolean;
+
+  @IsOptional()
+  @IsString()
+  @MinLength(8)
+  @Matches(
+    /^(?=.*[a-z])(?=.*[A-Z])(?=.*\d)(?=.*[@$!%*?&])[A-Za-z\d@$!%*?&]+$/,
+    { message: 'Password must contain uppercase, lowercase, number, and special character' }
+  )
+  password?: string;
+
+  @IsOptional()
+  @IsArray()
+  @IsString({ each: true })
+  roles?: string[];
+
+  @IsOptional()
+  metadata?: Record<string, any>;
+
+  @IsOptional()
+  @IsBoolean()
+  isMfaEnabled?: boolean;
+
+  @IsOptional()
+  @IsBoolean()
+  emailLoginEnabled?: boolean;
+
+  @IsOptional()
+  @IsBoolean()
+  phoneLoginEnabled?: boolean;
+}

package/src/lib/admin-console/dto/create-dashboard-admin.dto.ts

@@ -0,0 +1,34 @@
+import { IsEmail, IsNotEmpty, IsOptional, IsString, Matches, MinLength } from 'class-validator';
+
+export class CreateDashboardAdminDto {
+  @IsEmail()
+  email: string;
+
+  @IsString()
+  @IsNotEmpty()
+  @MinLength(8)
+  @Matches(
+    /^(?=.*[a-z])(?=.*[A-Z])(?=.*\d)(?=.*[@$!%*?&])[A-Za-z\d@$!%*?&]+$/,
+    { message: 'Password must contain uppercase, lowercase, number, and special character' }
+  )
+  password: string;
+
+  @IsOptional()
+  @IsString()
+  name?: string;
+}
+
+export class UpdateDashboardAdminDto {
+  @IsOptional()
+  @IsString()
+  name?: string;
+
+  @IsOptional()
+  @IsString()
+  @MinLength(8)
+  @Matches(
+    /^(?=.*[a-z])(?=.*[A-Z])(?=.*\d)(?=.*[@$!%*?&])[A-Za-z\d@$!%*?&]+$/,
+    { message: 'Password must contain uppercase, lowercase, number, and special character' }
+  )
+  password?: string;
+}