@hed-hog/core 0.0.4

package/src/task/task.service.ts

@@ -0,0 +1,55 @@
+import { Injectable, Logger } from '@nestjs/common';
+import { Cron, CronExpression } from '@nestjs/schedule';
+import { PrismaService } from '@hed-hog/api-prisma';
+
+@Injectable()
+export class TasksService {
+  private readonly logger = new Logger(TasksService.name);
+
+  constructor(private readonly prismaService: PrismaService) {
+
+  }
+
+  @Cron(CronExpression.EVERY_DAY_AT_MIDNIGHT)
+  async clear() {
+    this.logger.verbose('++++++++++++++++++++++++++++++++++');
+    this.logger.verbose('Running scheduled cleanup tasks');
+    this.logger.verbose('++++++++++++++++++++++++++++++++++');
+    this.logger.verbose('Starting cleanup of expired/verified MFA challenges');
+    let startAt = Date.now();
+    await this.prismaService.$queryRaw`
+      WITH del AS (
+        SELECT user_mfa_id
+        FROM user_mfa_challenge
+        WHERE expires_at < now()
+          OR verified_at IS NOT NULL
+        ORDER BY user_mfa_id
+        LIMIT 20000
+      )
+      DELETE FROM user_mfa_challenge c
+      USING del
+      WHERE c.user_mfa_id = del.user_mfa_id;
+    `;
+    this.logger.verbose(`Expired/verified MFA challenges cleaned up in ${Date.now() - startAt}ms`);
+    this.logger.verbose('++++++++++++++++++++++++++++++++++');
+    this.logger.verbose('Starting cleanup of expired sessions');
+    startAt = Date.now();
+    await this.prismaService.$queryRaw`
+      WITH del AS (
+      SELECT id
+      FROM user_session
+      WHERE expires_at < now()
+        AND created_at < (now() - interval '90 days')
+      ORDER BY id
+      LIMIT 20000
+      )
+      DELETE FROM user_session s
+      USING del
+      WHERE s.id = del.id;
+    `;
+    this.logger.verbose(`Expired sessions cleaned up in ${Date.now() - startAt}ms`);
+    this.logger.verbose('++++++++++++++++++++++++++++++++++');
+    this.logger.verbose('Finished scheduled cleanup tasks');
+    this.logger.verbose('++++++++++++++++++++++++++++++++++');
+  }
+}

package/src/token/token.module.ts

@@ -0,0 +1,14 @@
+import { forwardRef, Module } from "@nestjs/common";
+import { SecurityModule } from "../security/security.module";
+import { SettingModule } from "../setting/setting.module";
+import { TokenService } from "./token.service";
+
+@Module({
+  providers: [TokenService],
+  exports: [TokenService],
+  imports: [
+      forwardRef(() => SettingModule),
+      forwardRef(() => SecurityModule),
+    ]
+})
+export class TokenModule {}

package/src/token/token.service.ts

@@ -0,0 +1,110 @@
+import { getLocaleText } from "@hed-hog/api-locale";
+import { ForbiddenException, forwardRef, Inject, Injectable, OnModuleInit } from "@nestjs/common";
+import { JwtService } from "@nestjs/jwt";
+import { SecurityService } from "../security/security.service";
+import { SettingService } from "../setting/setting.service";
+
+@Injectable()
+export class TokenService implements OnModuleInit {
+
+  public settings: Record<string, any> = {};
+
+  constructor(
+    @Inject(forwardRef(() => JwtService))
+    private readonly jwt: JwtService,
+    @Inject(forwardRef(() => SecurityService))
+    private readonly security: SecurityService,
+    @Inject(forwardRef(() => SettingService))
+    private readonly setting: SettingService,
+  ) { }
+
+  async onModuleInit() {
+    this.settings = await this.setting.getSettingValues([
+      'url'
+    ]);
+  }
+
+  async verify(locale: string, token: string) {
+    try {
+      return this.jwt.verifyAsync(token, { secret: this.security.getJwtSecret() });
+    } catch (error) {
+      throw new ForbiddenException(error, getLocaleText('accessDenied', locale, 'Access denied.'));
+    }
+  }
+
+  async createAccessToken(payload: Record<string, any>) {
+    return this.jwt.signAsync(payload, {
+      secret: this.security.getJwtSecret(),
+    });
+  }
+
+  async createOpaqueToken(size = 64) {
+    return this.security.randomOpaque(size);
+  }
+
+  private getCookieDomain(): string | undefined {
+    if (this.settings['url']) {
+      try {
+        return new URL(this.settings['url']).hostname;
+      } catch {
+        return process.env.COOKIE_DOMAIN;
+      }
+    }
+    return process.env.COOKIE_DOMAIN;
+  }
+
+  async removeRefreshTokenCookie(res): Promise<void> {
+
+    const domain = this.getCookieDomain();
+    const isLocalhost = !domain || domain === 'localhost';
+    const cookieOptions: any = {
+      httpOnly: true,
+      sameSite: isLocalhost ? 'lax' : 'strict',
+    };
+    if (!isLocalhost) {
+      cookieOptions.secure = true;
+      cookieOptions.domain = domain;
+    }
+    res.clearCookie('rt', cookieOptions);
+  }
+
+  async setRefreshTokenCookie(locale: string, res, token: string, expires_at: Date): Promise<void> {
+    const domain = this.getCookieDomain();
+    const isLocalhost = !domain || domain === 'localhost';
+    const maxAge = expires_at.getTime() - Date.now();
+    const cookieOptions: any = {
+      httpOnly: true,
+      sameSite: isLocalhost ? 'lax' : 'strict',
+      maxAge,
+    };
+    if (!isLocalhost) {
+      cookieOptions.secure = true;
+      cookieOptions.domain = domain;
+    }
+    res.cookie('rt', token, cookieOptions);
+
+  }
+
+  async createMfaChallengeToken(payload: { userId: number; ipAddress: string; userAgent: string; email: string }) {
+    return this.jwt.signAsync(payload, {
+      secret: this.security.getJwtSecret(),
+      expiresIn: '10m', 
+    });
+  }
+
+  async verifyMfaChallengeToken(token: string): Promise<{ userId: number; ipAddress: string; userAgent: string; email: string }> {
+    try {
+      const payload = await this.jwt.verifyAsync(token, { 
+        secret: this.security.getJwtSecret() 
+      });
+      return {
+        userId: payload.userId,
+        ipAddress: payload.ipAddress,
+        userAgent: payload.userAgent,
+        email: payload.email
+      };
+    } catch (error) {
+      throw new ForbiddenException('Invalid or expired MFA token');
+    }
+  }
+}

package/src/types/http-method.ts

@@ -0,0 +1,8 @@
+export type HttpMethod =
+  | 'GET'
+  | 'POST'
+  | 'PUT'
+  | 'DELETE'
+  | 'PATCH'
+  | 'OPTIONS'
+  | 'HEAD';

package/src/types/multer.d.ts

@@ -0,0 +1,28 @@
+export interface MulterFile {
+  fieldname: string;
+  originalname: string;
+  encoding: string;
+  mimetype: string;
+  size: number;
+  destination: string;
+  filename: string;
+  path: string;
+  buffer: Buffer;
+}
+
+declare global {
+  interface MulterFile {
+    fieldname: string;
+    originalname: string;
+    encoding: string;
+    mimetype: string;
+    size: number;
+    destination: string;
+    filename: string;
+    path: string;
+    buffer: Buffer;
+  }
+}
+
+export { };
+

package/src/types/multer.ts

@@ -0,0 +1,28 @@
+export interface MulterFile {
+  fieldname: string;
+  originalname: string;
+  encoding: string;
+  mimetype: string;
+  size: number;
+  destination: string;
+  filename: string;
+  path: string;
+  buffer: Buffer;
+}
+
+declare global {
+  interface MulterFile {
+    fieldname: string;
+    originalname: string;
+    encoding: string;
+    mimetype: string;
+    size: number;
+    destination: string;
+    filename: string;
+    path: string;
+    buffer: Buffer;
+  }
+}
+
+export { };
+

package/src/user/constants/user.constants.ts

@@ -0,0 +1 @@
+export const SALT_ROUNDS = 10;

package/src/user/dto/create-with-email-and-password.dto.ts

@@ -0,0 +1,21 @@
+import { getLocaleText } from '@hed-hog/api-locale';
+import { IsString } from 'class-validator';
+import { IsEmailWithSettings } from '../../validators/is-email-with-settings.validator';
+import { IsStrongPasswordWithSettings } from '../../validators/is-strong-password-with-settings.validator';
+
+export class CreateWithEmailAndPasswordDTO {
+  @IsEmailWithSettings({ message: (args) => getLocaleText('validation.emailInvalid', args.value) })
+  set email(value: string) {
+    this._email = value?.trim().toLowerCase();
+  }
+  get email(): string {
+    return this._email;
+  }
+  private _email: string;
+
+  @IsStrongPasswordWithSettings()
+  password: string;
+
+  @IsString({ message: (args) => getLocaleText('validation.nameRequired', args.value) })
+  name: string;
+}

package/src/user/dto/update.dto.ts

@@ -0,0 +1,11 @@
+import { getLocaleText } from '@hed-hog/api-locale';
+import {
+    IsOptional,
+    IsString
+} from 'class-validator';
+
+export class UpdateDTO {
+  @IsString({ message: (args) => getLocaleText('validation.nameMustBeString', args.value) })
+  @IsOptional()
+  name?: string;
+}

package/src/user/user.controller.ts

@@ -0,0 +1,87 @@
+import { Role } from '@hed-hog/api';
+import { Locale } from '@hed-hog/api-locale';
+import { Pagination } from '@hed-hog/api-pagination';
+import {
+    BadRequestException,
+    Body,
+    Controller,
+    Delete,
+    Get,
+    Inject,
+    Param,
+    ParseIntPipe,
+    Patch,
+    Post,
+    UploadedFile,
+    UseInterceptors,
+    forwardRef,
+} from '@nestjs/common';
+import { FileInterceptor } from '@nestjs/platform-express';
+import { DeleteDTO } from '../dto/delete.dto';
+import { CreateWithEmailAndPasswordDTO } from './dto/create-with-email-and-password.dto';
+import { UpdateDTO } from './dto/update.dto';
+import { UserService } from './user.service';
+
+@Role()
+@Controller('user')
+export class UserController {
+  constructor(
+    @Inject(forwardRef(() => UserService))
+    private readonly userService: UserService,
+  ) { }
+
+  @Get()
+  async list(@Pagination() paginationParams) {
+    return this.userService.list(paginationParams);
+  }
+
+  @Get(':userId')
+  async get(@Param('userId', ParseIntPipe) userId: number, @Locale() locale: string) {
+    return this.userService.get(locale, userId);
+  }
+
+  @Get('email/:email')
+  async getByEmail(@Param('email') email: string) {
+
+  }
+
+  @Post()
+  async create(@Body() data: CreateWithEmailAndPasswordDTO, @Locale() locale: string) {
+    return this.userService.createWithEmailAndPassword(locale, data);
+  }
+
+  @Patch(':userId')
+  async update(
+    @Param('userId', ParseIntPipe) userId: number,
+    @Body() data: UpdateDTO,
+    @Locale() locale: string
+  ) {
+    return this.userService.update(locale, userId, data);
+  }
+
+  @UseInterceptors(
+    FileInterceptor('avatar', {
+      limits: {
+        fileSize: 1024 * 1024 * 5, // 5MB
+      },
+      fileFilter: (req, file, cb) => {
+        if (!file.mimetype.startsWith('image/')) {
+          return cb(new BadRequestException('Arquivo inválido'), false);
+        }
+        cb(null, true);
+      },
+    }),
+  )
+  @Post(':userId/avatar')
+  async changeAvatar(
+    @Param('userId', ParseIntPipe) userId: number,
+    @UploadedFile() avatar: MulterFile,
+  ) {
+    return this.userService.changeAvatar(userId, avatar)
+  }
+
+  @Delete()
+  async delete(@Body() data: DeleteDTO, @Locale() locale: string) {
+    return this.userService.delete(locale, data);
+  }
+}

package/src/user/user.module.ts

@@ -0,0 +1,34 @@
+import { PaginationModule } from '@hed-hog/api-pagination';
+import { PrismaModule } from '@hed-hog/api-prisma';
+import { Module, forwardRef } from '@nestjs/common';
+import { AuthModule } from '../auth/auth.module';
+import { ChallengeModule } from '../challenge/challenge.module';
+import { FileModule } from '../file/file.module';
+import { SecurityModule } from '../security/security.module';
+import { SettingModule } from '../setting/setting.module';
+import { IsEmailWithSettingsConstraint } from '../validators/is-email-with-settings.validator';
+import { IsPinCodeWithSettingConstraint } from '../validators/is-pin-code-with-setting.validator';
+import { IsStrongPasswordWithSettingsConstraint } from '../validators/is-strong-password-with-settings.validator';
+import { UserController } from './user.controller';
+import { UserService } from './user.service';
+
+@Module({
+  providers: [
+    UserService,
+    IsStrongPasswordWithSettingsConstraint,
+    IsEmailWithSettingsConstraint,
+    IsPinCodeWithSettingConstraint
+  ],
+  exports: [UserService],
+  controllers: [UserController],
+  imports: [
+    forwardRef(() => AuthModule),
+    forwardRef(() => PrismaModule),
+    forwardRef(() => PaginationModule),
+    forwardRef(() => SecurityModule),
+    forwardRef(() => FileModule),
+    forwardRef(() => ChallengeModule),
+    forwardRef(() => SettingModule),
+  ],
+})
+export class UserModule {}