@apso/cli 0.4.2 → 0.6.0

package/dist/lib/templates/guards/auth.guard.eta

@@ -0,0 +1,228 @@
+/**
+ * AuthGuard - Authentication guard for <%= it.authConfig.provider %> provider
+ *
+ * Auto-generated by Apso CLI from .apsorc auth configuration
+ * Generated at: <%= it.generatedAt %>
+ *
+ * This guard:
+ * - Validates session tokens from cookies/headers
+ * - Loads user and organization context
+ * - Attaches normalized AuthContext to requests
+ *
+ * DO NOT EDIT - Changes will be overwritten on next scaffold
+ */
+import {
+  Injectable,
+  CanActivate,
+  ExecutionContext,
+  UnauthorizedException,
+} from '@nestjs/common';
+import { Reflector } from '@nestjs/core';
+import { InjectRepository } from '@nestjs/typeorm';
+import { Repository } from 'typeorm';
+
+// Entity imports
+import { <%= it.authConfig.sessionEntity %> } from '../autogen/<%= it.authConfig.sessionEntity %>/<%= it.authConfig.sessionEntity %>.entity';
+import { <%= it.authConfig.userEntity %> } from '../autogen/<%= it.authConfig.userEntity %>/<%= it.authConfig.userEntity %>.entity';
+<% if (it.authConfig.accountUserEntity) { %>
+import { <%= it.authConfig.accountUserEntity %> } from '../autogen/<%= it.authConfig.accountUserEntity %>/<%= it.authConfig.accountUserEntity %>.entity';
+<% } %>
+
+/**
+ * Metadata key for marking routes as public (no auth required)
+ */
+export const IS_PUBLIC_KEY = 'isPublic';
+
+/**
+ * Decorator to mark a route as public (skips authentication)
+ * Usage: @Public()
+ */
+export const Public =
+  () => (target: any, key?: string, descriptor?: PropertyDescriptor) => {
+    Reflect.defineMetadata(IS_PUBLIC_KEY, true, descriptor?.value || target);
+  };
+
+/**
+ * Normalized auth context attached to authenticated requests.
+ * This is what scopeBy and RBAC consume.
+ */
+export interface AuthContext {
+  userId?: string;
+  email?: string;
+  workspaceId?: string;
+  organizationId?: string;
+  roles: string[];
+  user?: <%= it.authConfig.userEntity %>;
+  session?: <%= it.authConfig.sessionEntity %>;
+}
+
+/**
+ * Extended request type with auth context
+ */
+export interface AuthenticatedRequest extends Request {
+  auth: AuthContext;
+  user: <%= it.authConfig.userEntity %>;
+  session: <%= it.authConfig.sessionEntity %>;
+  // Legacy compatibility aliases
+  accountId?: string;
+  accountRole?: string;
+  organizationId?: string;
+}
+
+@Injectable()
+export class AuthGuard implements CanActivate {
+  constructor(
+    private reflector: Reflector,
+    @InjectRepository(<%= it.authConfig.sessionEntity %>)
+    private sessionRepository: Repository<<%= it.authConfig.sessionEntity %>>,
+    @InjectRepository(<%= it.authConfig.userEntity %>)
+    private userRepository: Repository<<%= it.authConfig.userEntity %>>,
+<% if (it.authConfig.accountUserEntity) { %>
+    @InjectRepository(<%= it.authConfig.accountUserEntity %>)
+    private accountUserRepository: Repository<<%= it.authConfig.accountUserEntity %>>,
+<% } %>
+  ) {}
+
+  async canActivate(context: ExecutionContext): Promise<boolean> {
+    // Check if route is marked as public
+    const isPublic = this.reflector.getAllAndOverride<boolean>(IS_PUBLIC_KEY, [
+      context.getHandler(),
+      context.getClass(),
+    ]);
+
+    if (isPublic) {
+      return true;
+    }
+
+    const request = context.switchToHttp().getRequest();
+    const token = this.extractToken(request);
+
+    if (!token) {
+      throw new UnauthorizedException('No session token provided');
+    }
+
+    try {
+      // Find session by token
+      const sessionRecord = await this.sessionRepository.findOne({
+        where: { token },
+      });
+
+      if (!sessionRecord) {
+        throw new UnauthorizedException('Invalid session token');
+      }
+
+      // Check if session is expired
+      if (new Date(sessionRecord.expiresAt) < new Date()) {
+        throw new UnauthorizedException('Session expired');
+      }
+
+      // Get user from session
+      const user = await this.userRepository.findOne({
+        where: { id: sessionRecord.userId },
+      });
+
+      if (!user) {
+        throw new UnauthorizedException('User not found');
+      }
+
+<% if (it.authConfig.accountUserEntity) { %>
+      // Get user's organization through <%= it.authConfig.accountUserEntity %> junction
+      const accountUser = await this.accountUserRepository.findOne({
+        where: { userId: user.id },
+      });
+
+      if (!accountUser) {
+        throw new UnauthorizedException('User not associated with any organization');
+      }
+
+      const organizationId = accountUser.<%= it.authConfig.organizationField %>;
+      const role = accountUser.<%= it.authConfig.roleField %> || 'member';
+<% } else { %>
+      // No account user entity configured - using user-level organization
+      const organizationId = (user as any).<%= it.authConfig.organizationField %> || undefined;
+      const role = (user as any).<%= it.authConfig.roleField %> || 'member';
+<% } %>
+
+      // Build normalized AuthContext
+      const authContext: AuthContext = {
+        userId: user.id,
+        email: user.email,
+        workspaceId: organizationId,
+        organizationId: organizationId,
+        roles: [role],
+        user: user,
+        session: sessionRecord,
+      };
+
+      // Attach to request
+      (request as any).auth = authContext;
+      (request as any).user = user;
+      (request as any).session = sessionRecord;
+
+      // Legacy compatibility - attach directly to request root
+      (request as any).accountId = organizationId;
+      (request as any).accountRole = role;
+      (request as any).organizationId = organizationId;
+
+      return true;
+    } catch (error) {
+      if (error instanceof UnauthorizedException) {
+        throw error;
+      }
+      console.error('Auth guard error:', error);
+      throw new UnauthorizedException('Authentication failed');
+    }
+  }
+
+  /**
+   * Extract session token from request
+   * Checks: Authorization header (Bearer), cookies, X-Session-Token header
+   */
+  private extractToken(request: any): string | undefined {
+    // Check Authorization header first (Bearer token)
+    const authHeader = request.headers.authorization;
+    if (authHeader && authHeader.startsWith('Bearer ')) {
+      return authHeader.substring(7);
+    }
+
+    // Check for session token in cookies
+    const cookies = request.cookies || {};
+<% if (it.authConfig.cookiePrefix) { %>
+    const cookieName = '<%= it.authConfig.cookiePrefix %>.session_token';
+    const sessionToken =
+      cookies[cookieName] ||
+      cookies['better-auth.session_token'] ||
+      cookies['session_token'];
+<% } else { %>
+    const sessionToken =
+      cookies['better-auth.session_token'] ||
+      cookies['session_token'];
+<% } %>
+
+    if (sessionToken) {
+      return sessionToken;
+    }
+
+    // Check X-Session-Token header
+    return request.headers['x-session-token'];
+  }
+}
+
+/**
+ * Helper function to get AuthContext from request
+ * Use this in controllers/services to access the authenticated context
+ */
+export function getAuthContext(request: any): AuthContext | undefined {
+  return request?.auth;
+}
+
+/**
+ * Helper function to require AuthContext (throws if not present)
+ */
+export function requireAuthContext(request: any): AuthContext {
+  const ctx = getAuthContext(request);
+  if (!ctx) {
+    throw new UnauthorizedException('Authentication required');
+  }
+  return ctx;
+}

package/dist/lib/templates/guards/guards.module.eta

@@ -0,0 +1,114 @@
+<%~ includeFile('../header.eta') %>
+
+import { Module, Global } from '@nestjs/common';
+import { TypeOrmModule } from '@nestjs/typeorm';
+import { APP_GUARD } from '@nestjs/core';
+
+<% if (it.scopedEntities && it.scopedEntities.length > 0) { %>
+import { ScopeGuard } from './scope.guard';
+<% } %>
+<% if (it.authConfig) { %>
+import { AuthGuard } from './auth.guard';
+<% } %>
+
+<% /* Import all entities for ScopeGuard */ %>
+<% if (it.scopedEntities && it.scopedEntities.length > 0) { %>
+// Entities for ScopeGuard
+<% it.scopedEntities.forEach((entity) => { %>
+import { <%= entity.name %> } from '../autogen/<%= entity.name %>/<%= entity.name %>.entity';
+<% }) %>
+<% } %>
+
+<% /* Import entities for AuthGuard */ %>
+<% if (it.authConfig) { %>
+// Entities for AuthGuard
+import { <%= it.authConfig.sessionEntity %> } from '../autogen/<%= it.authConfig.sessionEntity %>/<%= it.authConfig.sessionEntity %>.entity';
+import { <%= it.authConfig.userEntity %> } from '../autogen/<%= it.authConfig.userEntity %>/<%= it.authConfig.userEntity %>.entity';
+<% if (it.authConfig.accountUserEntity) { %>
+import { <%= it.authConfig.accountUserEntity %> } from '../autogen/<%= it.authConfig.accountUserEntity %>/<%= it.authConfig.accountUserEntity %>.entity';
+<% } %>
+<% } %>
+
+/**
+ * GuardsModule provides authentication and scope-based data isolation guards.
+ *
+ * Auto-generated from .apsorc configuration.
+ * Generated at: <%= it.generatedAt %>
+ *
+ * Usage:
+ * 1. Import GuardsModule in your AppModule
+ * 2. Guards are NOT enabled globally by default (for backward compatibility)
+ * 3. To enable guards globally, uncomment the APP_GUARD providers below
+ * 4. Or apply guards selectively using @UseGuards(AuthGuard, ScopeGuard) on controllers
+ *
+<% if (it.authConfig) { %>
+ * AuthGuard:
+ * - Validates session tokens from cookies/headers
+ * - Loads user and organization context
+ * - Attaches normalized AuthContext to request.auth
+ * - Provider: <%= it.authConfig.provider %>
+ *
+<% } %>
+<% if (it.scopedEntities && it.scopedEntities.length > 0) { %>
+ * ScopeGuard:
+ * - Enforces data isolation based on scopeBy config
+ * - POST requests auto-inject scope fields from request.auth
+ * - GET requests auto-filter by scope fields
+ * - GET/PUT/PATCH/DELETE by ID verify resource ownership
+ *
+<% } %>
+ * Decorators:
+ * - @Public() - Skip all guards for a route
+<% if (it.scopedEntities && it.scopedEntities.length > 0) { %>
+ * - @SkipScopeCheck() - Skip only scope checking
+<% } %>
+ */
+@Global()
+@Module({
+  imports: [
+    TypeOrmModule.forFeature([
+<% /* Collect all unique entities */ %>
+<% const allEntities = new Set(); %>
+<% if (it.scopedEntities) { it.scopedEntities.forEach(e => allEntities.add(e.name)); } %>
+<% if (it.authConfig) { %>
+<%   allEntities.add(it.authConfig.sessionEntity); %>
+<%   allEntities.add(it.authConfig.userEntity); %>
+<%   if (it.authConfig.accountUserEntity) { allEntities.add(it.authConfig.accountUserEntity); } %>
+<% } %>
+<% const entityArray = Array.from(allEntities); %>
+<% entityArray.forEach((entity, index) => { %>
+      <%= entity %><%= index < entityArray.length - 1 ? ',' : '' %>
+<% }) %>
+    ]),
+  ],
+  providers: [
+<% if (it.authConfig) { %>
+    AuthGuard,
+<% } %>
+<% if (it.scopedEntities && it.scopedEntities.length > 0) { %>
+    ScopeGuard,
+<% } %>
+    // UNCOMMENT BELOW TO ENABLE GLOBAL GUARDS
+<% if (it.authConfig) { %>
+    // {
+    //   provide: APP_GUARD,
+    //   useClass: AuthGuard,
+    // },
+<% } %>
+<% if (it.scopedEntities && it.scopedEntities.length > 0) { %>
+    // {
+    //   provide: APP_GUARD,
+    //   useClass: ScopeGuard,
+    // },
+<% } %>
+  ],
+  exports: [
+<% if (it.authConfig) { %>
+    AuthGuard,
+<% } %>
+<% if (it.scopedEntities && it.scopedEntities.length > 0) { %>
+    ScopeGuard,
+<% } %>
+  ],
+})
+export class GuardsModule {}

package/dist/lib/templates/guards/index.eta

@@ -0,0 +1,22 @@
+<%~ includeFile('../header.eta') %>
+
+<% if (it.authConfig) { %>
+export * from './auth.guard';
+<% } %>
+<% if (it.scopedEntities && it.scopedEntities.length > 0) { %>
+<% if (it.authConfig) { %>
+// When auth is configured, only export scope-specific items from scope.guard
+// to avoid duplicate exports (Public, IS_PUBLIC_KEY come from auth.guard)
+export {
+  ScopeGuard,
+  SKIP_SCOPE_CHECK,
+  SkipScopeCheck,
+  ScopeConfig,
+  ScopeField,
+  ENTITY_SCOPES,
+} from './scope.guard';
+<% } else { %>
+export * from './scope.guard';
+<% } %>
+<% } %>
+export * from './guards.module';

package/dist/lib/templates/guards/scope.guard.eta

@@ -0,0 +1,327 @@
+<%~ includeFile('../header.eta') %>
+
+import {
+  Injectable,
+  CanActivate,
+  ExecutionContext,
+  ForbiddenException,
+} from '@nestjs/common';
+import { Reflector } from '@nestjs/core';
+import { InjectRepository } from '@nestjs/typeorm';
+import { Repository } from 'typeorm';
+
+<% /* Import all entities that have scoped relationships */ %>
+<% it.scopedEntities.forEach((entity) => { %>
+import { <%= entity.name %> } from '../autogen/<%= entity.name %>/<%= entity.name %>.entity';
+<% }) %>
+
+/**
+ * Decorator to skip scope check for certain routes
+ */
+export const SKIP_SCOPE_CHECK = 'skipScopeCheck';
+export const SkipScopeCheck = () =>
+  (target: any, key?: string, descriptor?: PropertyDescriptor) => {
+    Reflect.defineMetadata(
+      SKIP_SCOPE_CHECK,
+      true,
+      descriptor?.value || target,
+    );
+  };
+
+<% if (it.authConfig) { %>
+/**
+ * Import Public decorator from auth.guard to avoid duplicate exports
+ */
+import { IS_PUBLIC_KEY, Public } from './auth.guard';
+export { IS_PUBLIC_KEY, Public };
+<% } else { %>
+/**
+ * Decorator to mark routes as public (no auth required)
+ */
+export const IS_PUBLIC_KEY = 'isPublic';
+export const Public = () =>
+  (target: any, key?: string, descriptor?: PropertyDescriptor) => {
+    Reflect.defineMetadata(
+      IS_PUBLIC_KEY,
+      true,
+      descriptor?.value || target,
+    );
+  };
+<% } %>
+
+/**
+ * Scope configuration for each entity
+ * Generated from .apsorc scopeBy definitions
+ */
+export interface ScopeConfig {
+  /** The scope fields or paths (e.g., 'workspaceId' or 'task.workspaceId') */
+  scopes: ScopeField[];
+  /** Whether to inject scope on create */
+  injectOnCreate: boolean;
+  /** Which operations to enforce scope on */
+  enforceOn: string[];
+  /** Roles that can bypass scope enforcement */
+  bypassRoles: string[];
+}
+
+export interface ScopeField {
+  /** The field name on the entity (e.g., 'workspaceId') or first segment of path */
+  field: string;
+  /** The context key to get the value from (defaults to field name) */
+  contextKey: string;
+  /** Whether this is a direct field (true) or nested path (false) */
+  direct: boolean;
+  /** For nested paths, the full path (e.g., 'task.workspaceId') */
+  path?: string;
+}
+
+/**
+ * Entity scope configuration map
+ * Auto-generated from .apsorc
+ */
+export const ENTITY_SCOPES: Record<string, ScopeConfig> = {
+<% it.scopedEntities.forEach((entity, index) => { %>
+  '<%= entity.routeName %>': {
+    scopes: [
+<% entity.scopes.forEach((scope, scopeIndex) => { %>
+      {
+        field: '<%= scope.field %>',
+        contextKey: '<%= scope.contextKey %>',
+        direct: <%= scope.direct %>,
+<% if (scope.path) { %>
+        path: '<%= scope.path %>',
+<% } %>
+      }<%= scopeIndex < entity.scopes.length - 1 ? ',' : '' %>
+<% }) %>
+    ],
+    injectOnCreate: <%= entity.injectOnCreate %>,
+    enforceOn: [<%~ entity.enforceOn.map(op => `'${op}'`).join(', ') %>],
+    bypassRoles: [<%~ entity.bypassRoles.map(role => `'${role}'`).join(', ') %>],
+  }<%= index < it.scopedEntities.length - 1 ? ',' : '' %>
+<% }) %>
+};
+
+@Injectable()
+export class ScopeGuard implements CanActivate {
+  constructor(
+    private reflector: Reflector,
+<% it.scopedEntities.forEach((entity) => { %>
+    @InjectRepository(<%= entity.name %>)
+    private <%= entity.repoName %>: Repository<<%= entity.name %>>,
+<% }) %>
+  ) {}
+
+  async canActivate(context: ExecutionContext): Promise<boolean> {
+    // Check if route should skip scope check
+    const skipCheck = this.reflector.getAllAndOverride<boolean>(
+      SKIP_SCOPE_CHECK,
+      [context.getHandler(), context.getClass()],
+    );
+
+    if (skipCheck) {
+      return true;
+    }
+
+    // Check if route is public
+    const isPublic = this.reflector.getAllAndOverride<boolean>(IS_PUBLIC_KEY, [
+      context.getHandler(),
+      context.getClass(),
+    ]);
+
+    if (isPublic) {
+      return true;
+    }
+
+    const request = context.switchToHttp().getRequest();
+
+    // Get the resource path from the request
+    const path = request.route?.path || request.path;
+    const method = request.method;
+
+    // Extract entity type from path (e.g., /Projects/:id -> projects)
+    const entityMatch = path.match(/^\/([^\/]+)/);
+    if (!entityMatch) {
+      return true;
+    }
+
+    const entityType = entityMatch[1].toLowerCase();
+
+    // Check if this is a scoped entity
+    const scopeConfig = ENTITY_SCOPES[entityType];
+    if (!scopeConfig) {
+      // Not a scoped entity, allow through
+      return true;
+    }
+
+    // Check if user has bypass role
+    const userRoles: string[] = request.user?.roles || request.roles || [];
+    if (scopeConfig.bypassRoles.some(role => userRoles.includes(role))) {
+      return true;
+    }
+
+    // Map HTTP method to operation
+    const operation = this.mapMethodToOperation(method, request.params?.id);
+
+    // Check if this operation should be enforced
+    if (!scopeConfig.enforceOn.includes(operation)) {
+      return true;
+    }
+
+    // For GET requests with an ID, verify the resource belongs to this scope
+    if ((operation === 'get' || operation === 'update' || operation === 'delete') && request.params?.id) {
+      const hasAccess = await this.verifyResourceAccess(
+        entityType,
+        request.params.id,
+        request,
+        scopeConfig,
+      );
+      if (!hasAccess) {
+        throw new ForbiddenException('You do not have access to this resource');
+      }
+    }
+
+    // For POST requests, inject scope values if configured
+    if (operation === 'create' && scopeConfig.injectOnCreate) {
+      this.injectScopeValues(request, scopeConfig);
+    }
+
+    // For GET (list) requests, add scope filter
+    if (operation === 'find') {
+      this.addScopeFilter(request, scopeConfig);
+    }
+
+    return true;
+  }
+
+  private mapMethodToOperation(method: string, hasId: boolean): string {
+    switch (method) {
+      case 'GET':
+        return hasId ? 'get' : 'find';
+      case 'POST':
+        return 'create';
+      case 'PUT':
+      case 'PATCH':
+        return 'update';
+      case 'DELETE':
+        return 'delete';
+      default:
+        return 'find';
+    }
+  }
+
+  private async verifyResourceAccess(
+    entityType: string,
+    resourceId: string,
+    request: any,
+    scopeConfig: ScopeConfig,
+  ): Promise<boolean> {
+    try {
+      const repo = this.getRepository(entityType);
+      if (!repo) {
+        return true; // Unknown entity, allow through
+      }
+
+      // Build relations array for nested scopes
+      const relations: string[] = [];
+      for (const scope of scopeConfig.scopes) {
+        if (!scope.direct && scope.path) {
+          // Extract relation name from path (e.g., 'task.workspaceId' -> 'task')
+          const relationName = scope.path.split('.')[0];
+          if (!relations.includes(relationName)) {
+            relations.push(relationName);
+          }
+        }
+      }
+
+      const entity = await repo.findOne({
+        where: { id: resourceId },
+        relations,
+      });
+
+      if (!entity) {
+        return false;
+      }
+
+      // Verify all scope conditions
+      for (const scope of scopeConfig.scopes) {
+        const expectedValue = this.getScopeValue(request, scope.contextKey);
+        if (!expectedValue) {
+          continue; // No scope value in context, skip this check
+        }
+
+        let actualValue: any;
+        if (scope.direct) {
+          actualValue = (entity as any)[scope.field];
+        } else if (scope.path) {
+          // Navigate the path (e.g., 'task.workspaceId')
+          actualValue = this.getNestedValue(entity, scope.path);
+        }
+
+        if (actualValue !== expectedValue) {
+          return false;
+        }
+      }
+
+      return true;
+    } catch (error) {
+      console.error('Scope verification error:', error);
+      return false;
+    }
+  }
+
+  private injectScopeValues(request: any, scopeConfig: ScopeConfig): void {
+    if (!request.body || typeof request.body !== 'object') {
+      return;
+    }
+
+    for (const scope of scopeConfig.scopes) {
+      if (scope.direct) {
+        const scopeValue = this.getScopeValue(request, scope.contextKey);
+        if (scopeValue && !request.body[scope.field]) {
+          request.body[scope.field] = scopeValue;
+        }
+      }
+    }
+  }
+
+  private addScopeFilter(request: any, scopeConfig: ScopeConfig): void {
+    if (!request.query) {
+      request.query = {};
+    }
+
+    for (const scope of scopeConfig.scopes) {
+      if (scope.direct) {
+        const scopeValue = this.getScopeValue(request, scope.contextKey);
+        if (scopeValue) {
+          // Add filter for @nestjsx/crud
+          request.query[`filter.${scope.field}`] = `$eq:${scopeValue}`;
+        }
+      }
+    }
+  }
+
+  private getScopeValue(request: any, contextKey: string): string | undefined {
+    // Try multiple locations for the scope value
+    return (
+      request[contextKey] ||
+      request.user?.[contextKey] ||
+      request.scope?.[contextKey] ||
+      request.context?.[contextKey]
+    );
+  }
+
+  private getNestedValue(obj: any, path: string): any {
+    return path.split('.').reduce((current, key) => current?.[key], obj);
+  }
+
+  private getRepository(entityType: string): Repository<any> | null {
+    switch (entityType) {
+<% it.scopedEntities.forEach((entity) => { %>
+      case '<%= entity.routeName %>':
+        return this.<%= entity.repoName %>;
+<% }) %>
+      default:
+        return null;
+    }
+  }
+}