@devstroupe/devkit-nest 1.1.16 → 1.2.0-beta.1

package/dist/realtime/index.d.ts

@@ -1,3 +1,4 @@
 export * from './realtime.module';
 export * from './realtime.service';
 export * from './realtime.gateway';
+export * from './realtime.tokens';

package/dist/realtime/index.js

@@ -17,3 +17,4 @@ Object.defineProperty(exports, "__esModule", { value: true });
 __exportStar(require("./realtime.module"), exports);
 __exportStar(require("./realtime.service"), exports);
 __exportStar(require("./realtime.gateway"), exports);
+__exportStar(require("./realtime.tokens"), exports);

package/dist/realtime/realtime.gateway.d.ts

@@ -1,10 +1,13 @@
 import { OnGatewayConnection, OnGatewayDisconnect } from '@nestjs/websockets';
 import { Server, Socket } from 'socket.io';
+import type { TokenVerifier } from '../platform/security';
 export declare class RealtimeGateway implements OnGatewayConnection, OnGatewayDisconnect {
+    private readonly tokenVerifier;
     server: Server;
     private readonly logger;
     private connectedUsers;
-    handleConnection(client: Socket): void;
+    constructor(tokenVerifier: TokenVerifier);
+    handleConnection(client: Socket): Promise<void>;
     handleDisconnect(client: Socket): void;
     emitEntityChange(entityName: string, action: string, data: any, tenantId?: string): void;
     handleSubscribeEntity(entity: string, client: Socket): {

package/dist/realtime/realtime.gateway.js

@@ -1,43 +1,10 @@
 "use strict";
-var __createBinding = (this && this.__createBinding) || (Object.create ? (function(o, m, k, k2) {
-    if (k2 === undefined) k2 = k;
-    var desc = Object.getOwnPropertyDescriptor(m, k);
-    if (!desc || ("get" in desc ? !m.__esModule : desc.writable || desc.configurable)) {
-      desc = { enumerable: true, get: function() { return m[k]; } };
-    }
-    Object.defineProperty(o, k2, desc);
-}) : (function(o, m, k, k2) {
-    if (k2 === undefined) k2 = k;
-    o[k2] = m[k];
-}));
-var __setModuleDefault = (this && this.__setModuleDefault) || (Object.create ? (function(o, v) {
-    Object.defineProperty(o, "default", { enumerable: true, value: v });
-}) : function(o, v) {
-    o["default"] = v;
-});
 var __decorate = (this && this.__decorate) || function (decorators, target, key, desc) {
     var c = arguments.length, r = c < 3 ? target : desc === null ? desc = Object.getOwnPropertyDescriptor(target, key) : desc, d;
     if (typeof Reflect === "object" && typeof Reflect.decorate === "function") r = Reflect.decorate(decorators, target, key, desc);
     else for (var i = decorators.length - 1; i >= 0; i--) if (d = decorators[i]) r = (c < 3 ? d(r) : c > 3 ? d(target, key, r) : d(target, key)) || r;
     return c > 3 && r && Object.defineProperty(target, key, r), r;
 };
-var __importStar = (this && this.__importStar) || (function () {
-    var ownKeys = function(o) {
-        ownKeys = Object.getOwnPropertyNames || function (o) {
-            var ar = [];
-            for (var k in o) if (Object.prototype.hasOwnProperty.call(o, k)) ar[ar.length] = k;
-            return ar;
-        };
-        return ownKeys(o);
-    };
-    return function (mod) {
-        if (mod && mod.__esModule) return mod;
-        var result = {};
-        if (mod != null) for (var k = ownKeys(mod), i = 0; i < k.length; i++) if (k[i] !== "default") __createBinding(result, mod, k[i]);
-        __setModuleDefault(result, mod);
-        return result;
-    };
-})();
 var __metadata = (this && this.__metadata) || function (k, v) {
     if (typeof Reflect === "object" && typeof Reflect.metadata === "function") return Reflect.metadata(k, v);
 };
@@ -50,12 +17,16 @@ exports.RealtimeGateway = void 0;
 const websockets_1 = require("@nestjs/websockets");
 const socket_io_1 = require("socket.io");
 const common_1 = require("@nestjs/common");
-const jwt = __importStar(require("jsonwebtoken"));
+const realtime_tokens_1 = require("./realtime.tokens");
 let RealtimeGateway = RealtimeGateway_1 = class RealtimeGateway {
+    tokenVerifier;
     server;
     logger = new common_1.Logger(RealtimeGateway_1.name);
     connectedUsers = new Map();
-    handleConnection(client) {
+    constructor(tokenVerifier) {
+        this.tokenVerifier = tokenVerifier;
+    }
+    async handleConnection(client) {
         try {
             const token = client.handshake.auth?.token || client.handshake.headers?.authorization?.split(' ')[1];
             if (!token) {
@@ -63,8 +34,7 @@ let RealtimeGateway = RealtimeGateway_1 = class RealtimeGateway {
                 client.disconnect();
                 return;
             }
-            const secret = process.env.JWT_SECRET || 'devstroupe-secret-key-12345';
-            const decoded = jwt.verify(token, secret);
+            const decoded = await this.tokenVerifier.verify(token);
             client.data = {
                 userId: decoded.sub,
                 email: decoded.email,
@@ -130,5 +100,7 @@ exports.RealtimeGateway = RealtimeGateway = RealtimeGateway_1 = __decorate([
         },
         transports: ['websocket'],
     }),
-    (0, common_1.Injectable)()
+    (0, common_1.Injectable)(),
+    __param(0, (0, common_1.Inject)(realtime_tokens_1.REALTIME_TOKEN_VERIFIER)),
+    __metadata("design:paramtypes", [Object])
 ], RealtimeGateway);

package/dist/realtime/realtime.gateway.test.d.ts

@@ -0,0 +1 @@
+export {};

package/dist/realtime/realtime.gateway.test.js

@@ -0,0 +1,34 @@
+"use strict";
+var __importDefault = (this && this.__importDefault) || function (mod) {
+    return (mod && mod.__esModule) ? mod : { "default": mod };
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+const strict_1 = __importDefault(require("node:assert/strict"));
+const node_test_1 = __importDefault(require("node:test"));
+const realtime_gateway_1 = require("./realtime.gateway");
+function socket(token) {
+    return {
+        id: 'socket-1',
+        handshake: { auth: { token }, headers: {} },
+        data: {},
+        rooms: [],
+        disconnected: false,
+        join(room) { this.rooms.push(room); },
+        disconnect() { this.disconnected = true; },
+    };
+}
+(0, node_test_1.default)('realtime receives verification-only capability and joins trusted claim rooms', async () => {
+    const gateway = new realtime_gateway_1.RealtimeGateway({
+        verify: async () => ({ sub: 'user-1', tenantId: 'tenant-1', role: 'admin' }),
+    });
+    const client = socket('signed-token');
+    await gateway.handleConnection(client);
+    strict_1.default.equal(client.disconnected, false);
+    strict_1.default.deepEqual(client.rooms, ['user:user-1', 'role:admin', 'tenant:tenant-1']);
+});
+(0, node_test_1.default)('realtime rejects a token when the verifier fails', async () => {
+    const gateway = new realtime_gateway_1.RealtimeGateway({ verify: async () => { throw new Error('invalid'); } });
+    const client = socket('invalid-token');
+    await gateway.handleConnection(client);
+    strict_1.default.equal(client.disconnected, true);
+});

package/dist/realtime/realtime.module.d.ts

@@ -1,2 +1,9 @@
+import { DynamicModule } from '@nestjs/common';
+import type { TokenVerifier } from '../platform/security';
+export interface RealtimeModuleOptions {
+    /** Pass only verification capability; realtime never receives a signing key. */
+    tokenVerifier: TokenVerifier;
+}
 export declare class RealtimeModule {
+    static register(options: RealtimeModuleOptions): DynamicModule;
 }

package/dist/realtime/realtime.module.js

@@ -5,18 +5,29 @@ var __decorate = (this && this.__decorate) || function (decorators, target, key,
     else for (var i = decorators.length - 1; i >= 0; i--) if (d = decorators[i]) r = (c < 3 ? d(r) : c > 3 ? d(target, key, r) : d(target, key)) || r;
     return c > 3 && r && Object.defineProperty(target, key, r), r;
 };
+var RealtimeModule_1;
 Object.defineProperty(exports, "__esModule", { value: true });
 exports.RealtimeModule = void 0;
 const common_1 = require("@nestjs/common");
 const realtime_gateway_1 = require("./realtime.gateway");
 const realtime_service_1 = require("./realtime.service");
-let RealtimeModule = class RealtimeModule {
+const realtime_tokens_1 = require("./realtime.tokens");
+let RealtimeModule = RealtimeModule_1 = class RealtimeModule {
+    static register(options) {
+        return {
+            module: RealtimeModule_1,
+            global: true,
+            providers: [
+                { provide: realtime_tokens_1.REALTIME_TOKEN_VERIFIER, useValue: options.tokenVerifier },
+                realtime_gateway_1.RealtimeGateway,
+                realtime_service_1.RealtimeService,
+            ],
+            exports: [realtime_service_1.RealtimeService],
+        };
+    }
 };
 exports.RealtimeModule = RealtimeModule;
-exports.RealtimeModule = RealtimeModule = __decorate([
+exports.RealtimeModule = RealtimeModule = RealtimeModule_1 = __decorate([
     (0, common_1.Global)(),
-    (0, common_1.Module)({
-        providers: [realtime_gateway_1.RealtimeGateway, realtime_service_1.RealtimeService],
-        exports: [realtime_service_1.RealtimeService],
-    })
+    (0, common_1.Module)({})
 ], RealtimeModule);

package/dist/realtime/realtime.tokens.d.ts

@@ -0,0 +1 @@
+export declare const REALTIME_TOKEN_VERIFIER: unique symbol;

package/dist/realtime/realtime.tokens.js

@@ -0,0 +1,4 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.REALTIME_TOKEN_VERIFIER = void 0;
+exports.REALTIME_TOKEN_VERIFIER = Symbol('REALTIME_TOKEN_VERIFIER');

package/dist/storage/drivers/local.storage.js

@@ -62,8 +62,15 @@ let LocalStorageService = class LocalStorageService {
         const filename = options?.filename
             ? options.filename.replace(/[^a-zA-Z0-9._-]/g, '')
             : `${crypto.randomUUID()}${sanitizedExt}`;
+        if (!filename || filename === '.' || filename === '..') {
+            throw new Error('Invalid storage filename');
+        }
         // 3. Resolver caminho da subpasta e mitigar Directory Traversal
-        const subPath = options?.path ? path.normalize(options.path).replace(/^(\.\.(\/|\\|$))+/, '') : '';
+        const requestedPath = options?.path ?? '';
+        if (path.isAbsolute(requestedPath) || requestedPath.split(/[\\/]+/).includes('..')) {
+            throw new Error('Directory traversal attempt detected');
+        }
+        const subPath = requestedPath ? path.normalize(requestedPath) : '';
         const targetDir = path.resolve(this.storagePath, subPath);
         // Adicionamos a barra final para segurança máxima de limite de diretório
         const rootPrefix = this.storagePath.endsWith(path.sep) ? this.storagePath : this.storagePath + path.sep;

package/package.json

@@ -1,8 +1,11 @@
 {
   "name": "@devstroupe/devkit-nest",
-  "version": "1.1.16",
+  "version": "1.2.0-beta.1",
   "description": "DevsTroupe Development Kit — NestJS base classes: BaseRepository, BaseCrudController and query parsers",
   "license": "MIT",
+  "engines": {
+    "node": ">=20"
+  },
   "keywords": [
     "devstroupe",
     "devkit",
@@ -31,40 +34,41 @@
   "dependencies": {
     "@aws-sdk/client-s3": "^3.500.0",
     "@aws-sdk/s3-request-presigner": "^3.500.0",
+    "bcryptjs": "^3.0.3",
     "jsonwebtoken": "^9.0.2",
-    "@devstroupe/devkit-core": "1.1.16"
+    "@devstroupe/devkit-core": "1.2.0-beta.1"
   },
   "peerDependencies": {
     "@nestjs/common": "^10.0.0 || ^11.0.0",
     "@nestjs/core": "^10.0.0 || ^11.0.0",
+    "@nestjs/platform-socket.io": "^10.0.0 || ^11.0.0",
     "@nestjs/swagger": "^7.0.0 || ^8.0.0 || ^9.0.0 || ^10.0.0 || ^11.0.0",
     "@nestjs/websockets": "^10.0.0 || ^11.0.0",
-    "@nestjs/platform-socket.io": "^10.0.0 || ^11.0.0",
-    "socket.io": "^4.7.0",
-    "rxjs": "^7.0.0",
-    "typeorm": "^0.3.0",
-    "reflect-metadata": "^0.1.13 || ^0.2.0",
+    "class-transformer": "^0.4.0 || ^0.5.0",
     "class-validator": "^0.13.0 || ^0.14.0",
-    "class-transformer": "^0.4.0 || ^0.5.0"
+    "reflect-metadata": "^0.1.13 || ^0.2.0",
+    "rxjs": "^7.0.0",
+    "socket.io": "^4.7.0",
+    "typeorm": "^1.0.0"
   },
   "devDependencies": {
     "@nestjs/common": "^10.3.8",
     "@nestjs/core": "^10.3.8",
+    "@nestjs/platform-socket.io": "^10.3.8",
     "@nestjs/swagger": "^7.3.1",
     "@nestjs/websockets": "^10.3.8",
-    "@nestjs/platform-socket.io": "^10.3.8",
     "@types/jsonwebtoken": "^9.0.6",
     "@types/node": "^20.11.0",
+    "class-transformer": "^0.5.1",
+    "class-validator": "^0.14.1",
+    "reflect-metadata": "^0.1.13",
     "rxjs": "^7.8.1",
     "socket.io": "^4.7.5",
-    "typeorm": "^0.3.17",
-    "reflect-metadata": "^0.1.13",
-    "class-validator": "^0.14.1",
-    "class-transformer": "^0.5.1",
+    "typeorm": "^1.0.0",
     "typescript": "^5.4.5"
   },
   "scripts": {
     "build": "tsc",
-    "test": "tsc && node --test dist/**/*.test.js"
+    "test": "tsc && node --test dist"
   }
 }