@ftisindia/create-app 0.1.3 → 0.1.5

package/template/src/modules/auth/application/services/password.service.ts

@@ -1,5 +1,5 @@
-import { Injectable } from "@nestjs/common";
-import * as bcrypt from "bcryptjs";
+import { Injectable } from '@nestjs/common';
+import * as bcrypt from 'bcryptjs';
 
 const PASSWORD_HASH_ROUNDS = 12;
 

package/template/src/modules/auth/application/services/token.service.ts

@@ -1,10 +1,10 @@
-import { randomBytes, createHash } from "node:crypto";
-import { InternalServerErrorException, Injectable } from "@nestjs/common";
-import { ConfigService } from "@nestjs/config";
-import { JwtService } from "@nestjs/jwt";
-import { Prisma } from "@prisma/client";
-import { PrismaService } from "../../../../database/prisma/prisma.service";
-import { JwtPayload } from "../../types/jwt-payload";
+import { randomBytes, createHash } from 'node:crypto';
+import { InternalServerErrorException, Injectable } from '@nestjs/common';
+import { ConfigService } from '@nestjs/config';
+import { JwtService } from '@nestjs/jwt';
+import { Prisma } from '@prisma/client';
+import { PrismaService } from '../../../../database/prisma/prisma.service';
+import { JwtPayload } from '../../types/jwt-payload';
 
 type TokenUser = {
   id: string;
@@ -31,17 +31,14 @@ export class TokenService {
 
     return this.jwt.signAsync(payload, {
       expiresIn: this.getAccessTokenTtl() as never,
-      algorithm: "HS256",
-      issuer: this.config.get<string>("auth.jwt.issuer"),
-      audience: this.config.get<string>("auth.jwt.audience"),
+      algorithm: 'HS256',
+      issuer: this.config.get<string>('auth.jwt.issuer'),
+      audience: this.config.get<string>('auth.jwt.audience'),
     });
   }
 
-  async createRefreshToken(
-    userId: string,
-    client: RefreshTokenStore = this.prisma,
-  ) {
-    const refreshToken = randomBytes(48).toString("base64url");
+  async createRefreshToken(userId: string, client: RefreshTokenStore = this.prisma) {
+    const refreshToken = randomBytes(48).toString('base64url');
     const tokenHash = this.hashRefreshToken(refreshToken);
     const expiresAt = this.getRefreshTokenExpiry();
 
@@ -60,15 +57,19 @@ export class TokenService {
   }
 
   hashRefreshToken(refreshToken: string) {
-    return createHash("sha256").update(refreshToken).digest("hex");
+    return createHash('sha256').update(refreshToken).digest('hex');
   }
 
   getAccessTokenTtl() {
-    return this.config.get<string>("auth.jwt.accessExpiresIn") ?? "15m";
+    return this.config.get<string>('auth.jwt.accessExpiresIn') ?? '15m';
+  }
+
+  getAccessTokenTtlSeconds() {
+    return Math.floor(parseDurationToMs(this.getAccessTokenTtl()) / 1000);
   }
 
   private getRefreshTokenExpiry() {
-    const ttl = this.config.get<string>("auth.jwt.refreshExpiresIn") ?? "7d";
+    const ttl = this.config.get<string>('auth.jwt.refreshExpiresIn') ?? '7d';
     return new Date(Date.now() + parseDurationToMs(ttl));
   }
 }
@@ -76,9 +77,7 @@ export class TokenService {
 function parseDurationToMs(value: string) {
   const match = /^(\d+)([smhdw])$/.exec(value.trim());
   if (!match) {
-    throw new InternalServerErrorException(
-      `Unsupported duration value: ${value}`,
-    );
+    throw new InternalServerErrorException(`Unsupported duration value: ${value}`);
   }
 
   const amount = Number(match[1]);

package/template/src/modules/auth/auth.module.ts

@@ -1,30 +1,31 @@
-import { MiddlewareConsumer, Module, NestModule } from "@nestjs/common";
-import { ConfigModule, ConfigService } from "@nestjs/config";
-import { JwtModule } from "@nestjs/jwt";
-import { PassportModule } from "@nestjs/passport";
-import session = require("express-session");
-import { AuthService } from "./application/services/auth.service";
-import { PasswordService } from "./application/services/password.service";
-import { TokenService } from "./application/services/token.service";
-import { GoogleAuthGuard } from "./infrastructure/passport/google-auth.guard";
-import { GoogleStrategy } from "./infrastructure/passport/google.strategy";
-import { JwtAuthGuard } from "./infrastructure/passport/jwt-auth.guard";
-import { JwtStrategy } from "./infrastructure/passport/jwt.strategy";
-import { AuthController } from "./presentation/auth.controller";
-import { GoogleOAuthExceptionFilter } from "./presentation/google-oauth-exception.filter";
+import { Module } from '@nestjs/common';
+import { ConfigModule, ConfigService } from '@nestjs/config';
+import { JwtModule } from '@nestjs/jwt';
+import { PassportModule } from '@nestjs/passport';
+import { RequestContextModule } from '../request-context/request-context.module';
+import { AuthService } from './application/services/auth.service';
+import { PasswordService } from './application/services/password.service';
+import { TokenService } from './application/services/token.service';
+import { GoogleAuthGuard } from './infrastructure/passport/google-auth.guard';
+import { GoogleStrategy } from './infrastructure/passport/google.strategy';
+import { JwtAuthGuard } from './infrastructure/passport/jwt-auth.guard';
+import { JwtStrategy } from './infrastructure/passport/jwt.strategy';
+import { AuthController } from './presentation/auth.controller';
+import { GoogleOAuthExceptionFilter } from './presentation/google-oauth-exception.filter';
 
 @Module({
   imports: [
     PassportModule,
+    RequestContextModule,
     JwtModule.registerAsync({
       imports: [ConfigModule],
       inject: [ConfigService],
       useFactory: (config: ConfigService) => ({
-        secret: config.get<string>("auth.jwt.secret") ?? "",
+        secret: config.get<string>('auth.jwt.secret') ?? '',
         signOptions: {
-          algorithm: "HS256",
-          issuer: config.get<string>("auth.jwt.issuer"),
-          audience: config.get<string>("auth.jwt.audience"),
+          algorithm: 'HS256',
+          issuer: config.get<string>('auth.jwt.issuer'),
+          audience: config.get<string>('auth.jwt.audience'),
         },
       }),
     }),
@@ -42,32 +43,4 @@ import { GoogleOAuthExceptionFilter } from "./presentation/google-oauth-exceptio
   ],
   exports: [JwtAuthGuard, PasswordService],
 })
-export class AuthModule implements NestModule {
-  constructor(private readonly config: ConfigService) {}
-
-  configure(consumer: MiddlewareConsumer) {
-    consumer
-      .apply(buildGoogleOAuthSessionMiddleware(this.config))
-      .forRoutes("auth/google", "auth/google/callback");
-  }
-}
-
-function buildGoogleOAuthSessionMiddleware(config: ConfigService) {
-  const secret =
-    config.get<string>("auth.session.secret") ||
-    "google-oauth-disabled-session-secret";
-
-  return session({
-    secret,
-    name: "oauth.sid",
-    resave: false,
-    saveUninitialized: false,
-    cookie: {
-      httpOnly: true,
-      sameSite: "lax",
-      secure: config.get<string>("app.nodeEnv") === "production",
-      maxAge: 10 * 60 * 1000,
-      path: "/auth/google",
-    },
-  });
-}
+export class AuthModule {}

package/template/src/modules/auth/dto/auth-response.dto.ts

@@ -1,25 +1,24 @@
-import { ApiProperty } from "@nestjs/swagger";
-import { ActiveUserSummaryDto } from "../../../common/dto/user-summary.dto";
+import { ApiProperty } from '@nestjs/swagger';
+import { ActiveUserSummaryDto } from '../../../common/dto/user-summary.dto';
 
 export class AuthTokensResponseDto {
   @ApiProperty({
-    description: "JWT access token for bearer authentication.",
-    example: "eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9...",
+    description: 'JWT access token for bearer authentication.',
+    example: 'eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9...',
   })
   accessToken!: string;
 
   @ApiProperty({
-    description:
-      "Opaque refresh token. Store it securely and send it only to auth endpoints.",
-    example: "rfr_9b2f4f8d2d9f4d65a1f4",
+    description: 'Opaque refresh token. Store it securely and send it only to auth endpoints.',
+    example: 'rfr_9b2f4f8d2d9f4d65a1f4',
   })
   refreshToken!: string;
 
-  @ApiProperty({ example: "Bearer" })
-  tokenType!: "Bearer";
+  @ApiProperty({ example: 'Bearer' })
+  tokenType!: 'Bearer';
 
   @ApiProperty({
-    description: "Access token lifetime in seconds.",
+    description: 'Access token lifetime in seconds.',
     example: 900,
   })
   expiresIn!: number;

package/template/src/modules/auth/dto/login.dto.ts

@@ -1,13 +1,13 @@
-import { ApiProperty } from "@nestjs/swagger";
-import { IsEmail, IsString, MaxLength, MinLength } from "class-validator";
+import { ApiProperty } from '@nestjs/swagger';
+import { IsEmail, IsString, MaxLength, MinLength } from 'class-validator';
 
 export class LoginDto {
-  @ApiProperty({ example: "owner@example.com" })
+  @ApiProperty({ example: 'owner@example.com' })
   @IsEmail()
   @MaxLength(320)
   email!: string;
 
-  @ApiProperty({ example: "dev-password-123" })
+  @ApiProperty({ example: 'dev-password-123' })
   @IsString()
   @MinLength(8)
   @MaxLength(128)

package/template/src/modules/auth/dto/logout.dto.ts

@@ -1,3 +1,3 @@
-import { RefreshTokenDto } from "./refresh-token.dto";
+import { RefreshTokenDto } from './refresh-token.dto';
 
 export class LogoutDto extends RefreshTokenDto {}

package/template/src/modules/auth/dto/oauth-exchange.dto.ts

@@ -1,11 +1,10 @@
-import { ApiProperty } from "@nestjs/swagger";
-import { IsString, Length } from "class-validator";
+import { ApiProperty } from '@nestjs/swagger';
+import { IsString, Length } from 'class-validator';
 
 export class OAuthExchangeDto {
   @ApiProperty({
-    description:
-      "One-time code returned to the frontend by the Google OAuth callback redirect.",
-    example: "DXB2rcx5HcKXy35bA3AzYdVq2e4nGsgYeG3D9M7uAQM",
+    description: 'One-time code returned to the frontend by the Google OAuth callback redirect.',
+    example: 'DXB2rcx5HcKXy35bA3AzYdVq2e4nGsgYeG3D9M7uAQM',
     minLength: 32,
     maxLength: 256,
   })

package/template/src/modules/auth/dto/refresh-token.dto.ts

@@ -1,11 +1,10 @@
-import { ApiProperty } from "@nestjs/swagger";
-import { IsString, MinLength } from "class-validator";
+import { ApiProperty } from '@nestjs/swagger';
+import { IsString, MinLength } from 'class-validator';
 
 export class RefreshTokenDto {
   @ApiProperty({
-    description:
-      "Opaque refresh token returned by signup, login, refresh, or OAuth exchange.",
-    example: "rfr_9b2f4f8d2d9f4d65a1f4",
+    description: 'Opaque refresh token returned by signup, login, refresh, or OAuth exchange.',
+    example: 'rfr_9b2f4f8d2d9f4d65a1f4',
     minLength: 32,
   })
   @IsString()

package/template/src/modules/auth/dto/signup.dto.ts

@@ -1,25 +1,19 @@
-import { ApiProperty, ApiPropertyOptional } from "@nestjs/swagger";
-import {
-  IsEmail,
-  IsOptional,
-  IsString,
-  MaxLength,
-  MinLength,
-} from "class-validator";
+import { ApiProperty, ApiPropertyOptional } from '@nestjs/swagger';
+import { IsEmail, IsOptional, IsString, MaxLength, MinLength } from 'class-validator';
 
 export class SignupDto {
-  @ApiProperty({ example: "owner@example.com" })
+  @ApiProperty({ example: 'owner@example.com' })
   @IsEmail()
   @MaxLength(320)
   email!: string;
 
-  @ApiProperty({ minLength: 8, maxLength: 128, example: "dev-password-123" })
+  @ApiProperty({ minLength: 8, maxLength: 128, example: 'dev-password-123' })
   @IsString()
   @MinLength(8)
   @MaxLength(128)
   password!: string;
 
-  @ApiPropertyOptional({ example: "Starter Owner" })
+  @ApiPropertyOptional({ example: 'Starter Owner' })
   @IsOptional()
   @IsString()
   @MaxLength(120)

package/template/src/modules/auth/infrastructure/passport/google-auth.guard.ts

@@ -1,25 +1,17 @@
-import {
-  CanActivate,
-  ExecutionContext,
-  ForbiddenException,
-  Injectable,
-} from "@nestjs/common";
-import { ConfigService } from "@nestjs/config";
-import { AuthGuard } from "@nestjs/passport";
+import { CanActivate, ExecutionContext, ForbiddenException, Injectable } from '@nestjs/common';
+import { ConfigService } from '@nestjs/config';
+import { AuthGuard } from '@nestjs/passport';
 
 @Injectable()
-export class GoogleAuthGuard
-  extends AuthGuard("google")
-  implements CanActivate
-{
+export class GoogleAuthGuard extends AuthGuard('google') implements CanActivate {
   constructor(private readonly config: ConfigService) {
     super();
   }
 
   canActivate(context: ExecutionContext) {
-    const enabled = this.config.get<boolean>("auth.providers.googleEnabled");
+    const enabled = this.config.get<boolean>('auth.providers.googleEnabled');
     if (!enabled) {
-      throw new ForbiddenException("Google authentication is disabled.");
+      throw new ForbiddenException('Google authentication is disabled.');
     }
 
     return super.canActivate(context);

package/template/src/modules/auth/infrastructure/passport/google-oauth-state.store.ts

@@ -0,0 +1,98 @@
+import { createCipheriv, createDecipheriv, createHash, randomBytes } from 'crypto';
+
+const STATE_TTL_MS = 10 * 60 * 1000;
+const IV_BYTES = 12;
+const AUTH_TAG_BYTES = 16;
+
+type StatePayload = {
+  verifier: string;
+  iat: number;
+  nonce: string;
+  state?: string;
+};
+
+type StoreCallback = (error: Error | null, state?: string) => void;
+type VerifyCallback = (error: Error | null, verifier?: false | string, state?: unknown) => void;
+
+export class GoogleOAuthStateStore {
+  private readonly key: Buffer;
+
+  constructor(secret: string) {
+    this.key = createHash('sha256').update(secret).digest();
+  }
+
+  store(
+    _request: unknown,
+    verifier: string,
+    state: unknown,
+    _meta: unknown,
+    callback: StoreCallback,
+  ) {
+    try {
+      callback(
+        null,
+        this.encode({
+          verifier,
+          iat: Date.now(),
+          nonce: randomBytes(16).toString('base64url'),
+          state: typeof state === 'string' ? state : undefined,
+        }),
+      );
+    } catch (error) {
+      callback(error instanceof Error ? error : new Error('Could not store OAuth state.'));
+    }
+  }
+
+  verify(_request: unknown, providedState: string, _meta: unknown, callback: VerifyCallback) {
+    try {
+      const payload = this.decode(providedState);
+      if (Date.now() - payload.iat > STATE_TTL_MS) {
+        callback(null, false, { message: 'OAuth state expired.' });
+        return;
+      }
+
+      callback(null, payload.verifier, payload.state);
+    } catch {
+      callback(null, false, { message: 'Invalid authorization request state.' });
+    }
+  }
+
+  private encode(payload: StatePayload) {
+    const iv = randomBytes(IV_BYTES);
+    const cipher = createCipheriv('aes-256-gcm', this.key, iv);
+    const encrypted = Buffer.concat([
+      cipher.update(JSON.stringify(payload), 'utf8'),
+      cipher.final(),
+    ]);
+    const tag = cipher.getAuthTag();
+
+    return Buffer.concat([iv, tag, encrypted]).toString('base64url');
+  }
+
+  private decode(state: string): StatePayload {
+    const input = Buffer.from(state, 'base64url');
+    if (input.length <= IV_BYTES + AUTH_TAG_BYTES) {
+      throw new Error('OAuth state is malformed.');
+    }
+
+    const iv = input.subarray(0, IV_BYTES);
+    const tag = input.subarray(IV_BYTES, IV_BYTES + AUTH_TAG_BYTES);
+    const encrypted = input.subarray(IV_BYTES + AUTH_TAG_BYTES);
+    const decipher = createDecipheriv('aes-256-gcm', this.key, iv);
+    decipher.setAuthTag(tag);
+
+    const decoded = JSON.parse(
+      Buffer.concat([decipher.update(encrypted), decipher.final()]).toString('utf8'),
+    ) as Partial<StatePayload>;
+
+    if (
+      typeof decoded.verifier !== 'string' ||
+      typeof decoded.iat !== 'number' ||
+      typeof decoded.nonce !== 'string'
+    ) {
+      throw new Error('OAuth state is invalid.');
+    }
+
+    return decoded as StatePayload;
+  }
+}

package/template/src/modules/auth/infrastructure/passport/google.strategy.ts

@@ -1,49 +1,40 @@
-import { Injectable, UnauthorizedException } from "@nestjs/common";
-import { ConfigService } from "@nestjs/config";
-import { PassportStrategy } from "@nestjs/passport";
-import { Profile, Strategy, VerifyCallback } from "passport-google-oauth20";
-import { GoogleAuthProfile } from "../../types/google-auth-profile";
+import { Injectable, UnauthorizedException } from '@nestjs/common';
+import { ConfigService } from '@nestjs/config';
+import { PassportStrategy } from '@nestjs/passport';
+import { Profile, Strategy, VerifyCallback } from 'passport-google-oauth20';
+import { GoogleAuthProfile } from '../../types/google-auth-profile';
+import { GoogleOAuthStateStore } from './google-oauth-state.store';
 
 @Injectable()
-export class GoogleStrategy extends PassportStrategy(Strategy, "google") {
+export class GoogleStrategy extends PassportStrategy(Strategy, 'google') {
   constructor(config: ConfigService) {
-    const enabled = config.get<boolean>("auth.providers.googleEnabled");
+    const enabled = config.get<boolean>('auth.providers.googleEnabled');
+    const sessionSecret =
+      config.get<string>('auth.session.secret') || 'google-oauth-disabled-session-secret';
 
     super({
-      clientID: enabled
-        ? (config.get<string>("auth.google.clientId") ?? "")
-        : "google-disabled",
+      clientID: enabled ? (config.get<string>('auth.google.clientId') ?? '') : 'google-disabled',
       clientSecret: enabled
-        ? (config.get<string>("auth.google.clientSecret") ?? "")
-        : "google-disabled",
+        ? (config.get<string>('auth.google.clientSecret') ?? '')
+        : 'google-disabled',
       callbackURL:
-        config.get<string>("auth.google.callbackUrl") ??
-        "http://localhost:3000/auth/google/callback",
+        config.get<string>('auth.google.callbackUrl') ??
+        'http://localhost:3000/auth/google/callback',
       state: true,
       pkce: true,
-      scope: ["email", "profile"],
-    });
+      store: new GoogleOAuthStateStore(sessionSecret),
+      scope: ['email', 'profile'],
+    } as never);
   }
 
-  validate(
-    _accessToken: string,
-    _refreshToken: string,
-    profile: Profile,
-    done: VerifyCallback,
-  ) {
+  validate(_accessToken: string, _refreshToken: string, profile: Profile, done: VerifyCallback) {
     const email = profile.emails?.[0]?.value?.trim().toLowerCase();
     if (!email) {
-      done(
-        new UnauthorizedException(
-          "Google account did not provide an email address.",
-        ),
-      );
+      done(new UnauthorizedException('Google account did not provide an email address.'));
       return;
     }
 
-    const profileJson = profile._json as
-      | { email_verified?: boolean }
-      | undefined;
+    const profileJson = profile._json as { email_verified?: boolean } | undefined;
     const result: GoogleAuthProfile = {
       providerUserId: profile.id,
       email,

package/template/src/modules/auth/infrastructure/passport/jwt-auth.guard.ts

@@ -1,5 +1,5 @@
-import { Injectable } from "@nestjs/common";
-import { AuthGuard } from "@nestjs/passport";
+import { Injectable } from '@nestjs/common';
+import { AuthGuard } from '@nestjs/passport';
 
 @Injectable()
-export class JwtAuthGuard extends AuthGuard("jwt") {}
+export class JwtAuthGuard extends AuthGuard('jwt') {}

package/template/src/modules/auth/infrastructure/passport/jwt.strategy.ts

@@ -1,10 +1,10 @@
-import { Injectable, UnauthorizedException } from "@nestjs/common";
-import { ConfigService } from "@nestjs/config";
-import { PassportStrategy } from "@nestjs/passport";
-import { ExtractJwt, Strategy } from "passport-jwt";
-import { PrismaService } from "../../../../database/prisma/prisma.service";
-import { AuthenticatedUser } from "../../types/authenticated-user";
-import { JwtPayload } from "../../types/jwt-payload";
+import { Injectable, UnauthorizedException } from '@nestjs/common';
+import { ConfigService } from '@nestjs/config';
+import { PassportStrategy } from '@nestjs/passport';
+import { ExtractJwt, Strategy } from 'passport-jwt';
+import { PrismaService } from '../../../../database/prisma/prisma.service';
+import { AuthenticatedUser } from '../../types/authenticated-user';
+import { JwtPayload } from '../../types/jwt-payload';
 
 @Injectable()
 export class JwtStrategy extends PassportStrategy(Strategy) {
@@ -15,10 +15,10 @@ export class JwtStrategy extends PassportStrategy(Strategy) {
     super({
       jwtFromRequest: ExtractJwt.fromAuthHeaderAsBearerToken(),
       ignoreExpiration: false,
-      algorithms: ["HS256"],
-      issuer: config.get<string>("auth.jwt.issuer"),
-      audience: config.get<string>("auth.jwt.audience"),
-      secretOrKey: config.get<string>("auth.jwt.secret") ?? "",
+      algorithms: ['HS256'],
+      issuer: config.get<string>('auth.jwt.issuer'),
+      audience: config.get<string>('auth.jwt.audience'),
+      secretOrKey: config.get<string>('auth.jwt.secret') ?? '',
     });
   }