@mshima/generator-jhipster-nodejs 0.0.0-stage → 0.0.1

package/generators/node-server/templates/server/src/app.config.ts.ejs

@@ -0,0 +1,179 @@
+import { INestApplication, ValidationPipe } from '@nestjs/common';
+import { ConfigService } from '@nestjs/config';
+import { CorsOptions } from '@nestjs/common/interfaces/external/cors-options.interface';
+import { NextFunction, Request, Response } from 'express';
+import { NestExpressApplication } from '@nestjs/platform-express';
+<%_ if (authenticationUsesCsrf) { _%>
+import session from 'express-session';
+<%_ } _%>
+
+import type { ApplicationConfig } from './application-config.ts';
+import { HeaderUtil } from './common/header-util.ts';
+import { ProblemDetailsFilter } from './common/errors/problem-details.filter.ts';
+import { ValidationException } from './common/errors/problem.exception.ts';
+<%_ if (authenticationUsesCsrf) { _%>
+import { SESSION_MAX_AGE } from './auth/csrf.middleware.ts';
+import { SessionStore } from './auth/session.store.ts';
+<%_ } _%>
+
+type AppConfigService = ConfigService<ApplicationConfig, true>;
+
+// The paths of the API, which CORS applies to like the WebConfigurer of JHipster Spring Boot.
+const CORS_PATHS = [/^\/api\//, /^\/management\//, /^\/v3\/api-docs(\?|$)/];
+// The paths of the API as Express routes them: case insensitive, with or without a trailing slash.
+const API_PATH = /^\/(?:api|management|v3\/api-docs)(?:\/|$)/i;
+const REGEXP_SPECIAL_CHARACTERS = /[.+?^${}()|[\]\\]/g;
+
+function propertyList(value: string | undefined): string[] {
+  return String(value ?? '')
+    .split(',')
+    .map(value => value.trim())
+    .filter(Boolean);
+}
+
+/**
+ * The CORS options of the jhipster.cors properties, like the CorsConfiguration of JHipster Spring Boot: undefined when
+ * neither allowed-origins nor allowed-origin-patterns is set (CORS disabled, the default but in the dev profile).
+ * A pattern matches any value where it has a *, like https://*.githubpreview.dev; * as methods or headers allows them all.
+ */
+export function corsOptions(configService: AppConfigService): CorsOptions | undefined {
+  const cors = configService.get('jhipster.cors', { infer: true });
+  const allowedOrigins = propertyList(cors['allowed-origins']);
+  const allowedOriginPatterns = propertyList(cors['allowed-origin-patterns']).map(
+    pattern => new RegExp(`^${pattern.replace(REGEXP_SPECIAL_CHARACTERS, '\\$&').replaceAll('*', '.*')}$`),
+  );
+  if (allowedOrigins.length === 0 && allowedOriginPatterns.length === 0) {
+    return undefined;
+  }
+  const allowedMethods = propertyList(cors['allowed-methods']);
+  const allowedHeaders = propertyList(cors['allowed-headers']);
+  const maxAge = Number(cors['max-age']);
+  const credentials = String(cors['allow-credentials']) === 'true';
+  if (credentials && allowedOrigins.includes('*')) {
+    // Like the CorsConfiguration of Spring: browsers refuse * as the allowed origin of a request with credentials.
+    throw new Error(
+      'When jhipster.cors.allow-credentials is true, jhipster.cors.allowed-origins cannot contain *: list the origins, or use jhipster.cors.allowed-origin-patterns',
+    );
+  }
+  return {
+    // * allows any origin, like the allowed origins of the CorsConfiguration of Spring (cors compares the origins as given).
+    origin: allowedOrigins.includes('*') ? '*' : [...allowedOrigins, ...allowedOriginPatterns],
+    // Left out for *: the default methods of cors (all of them), the request headers echoed.
+    ...(allowedMethods.includes('*') ? {} : { methods: allowedMethods }),
+    ...(allowedHeaders.includes('*') ? {} : { allowedHeaders }),
+    exposedHeaders: propertyList(cors['exposed-headers']),
+    credentials,
+    ...(maxAge > 0 ? { maxAge } : {}),
+  };
+}
+
+/**
+ * A middleware writing the headers of every response, like the default headers of Spring Security and the headers of
+ * the SecurityConfiguration of JHipster Spring Boot<% if (!skipClient) { %> (jhipster.security.content-security-policy)<% } %>.
+ */
+function responseHeaders(<% if (!skipClient) { %>configService: AppConfigService<% } %>): (req: Request, res: Response, next: NextFunction) => void {
+<%_ if (!skipClient) { _%>
+  const contentSecurityPolicy = String(configService.get('jhipster.security.content-security-policy', { infer: true }) ?? '');
+<%_ } _%>
+  return (req, res, next) => {
+    if (API_PATH.test(req.path)) {
+      // The cache control of Spring Security on the responses of the API: not cached (the static files of the client are).
+      res.setHeader('Cache-Control', 'no-cache, no-store, max-age=0, must-revalidate');
+      res.setHeader('Pragma', 'no-cache');
+      res.setHeader('Expires', '0');
+    }
+    res.setHeader('X-Content-Type-Options', 'nosniff');
+    res.setHeader('X-XSS-Protection', '0');
+<%_ if (skipClient) { _%>
+    res.setHeader('X-Frame-Options', 'DENY');
+<%_ } else { _%>
+    if (contentSecurityPolicy) {
+      res.setHeader('Content-Security-Policy', contentSecurityPolicy);
+    }
+    res.setHeader('X-Frame-Options', 'SAMEORIGIN');
+    res.setHeader('Referrer-Policy', 'strict-origin-when-cross-origin');
+    res.setHeader(
+      'Permissions-Policy',
+      'camera=(), fullscreen=(self), geolocation=(), gyroscope=(), magnetometer=(), microphone=(), midi=(), payment=(), sync-xhr=()',
+    );
+<%_ } _%>
+    if (req.secure) {
+      // Like Spring Security, on the HTTPS requests only (the tls profile).
+      res.setHeader('Strict-Transport-Security', 'max-age=31536000 ; includeSubDomains');
+    }
+    next();
+  };
+}
+
+/**
+ * Configures the application as it runs in production: main.ts and the e2e tests call it, so the e2e tests
+ * exercise the same validation and HTTP behaviour as the started application.
+ * It has no side effect at import (main.ts starts the application when imported), and does not listen.
+ */
+/**
+ * The proxies whose X-Forwarded-* headers (the protocol, the host and the address of the client) the application trusts, the
+ * trust proxy setting of Express, like the server.forward-headers-strategy of Spring Boot: none, or native, the proxies of
+ * the local networks like the internal proxies of the RemoteIpValve of Tomcat.<% if (authenticationUsesCsrf) { %> Behind a proxy of HTTPS, the session cookie is then
+ * secure.<% } %>
+ */
+export function trustProxy(strategy: string | undefined): string | false {
+  return strategy === 'native' ? 'loopback, linklocal, uniquelocal' : false;
+}
+
+export function configureApp(app: INestApplication): INestApplication {
+  // Without the X-Powered-By: Express header, like the responses of JHipster Spring Boot.
+  app.getHttpAdapter().getInstance().disable('x-powered-by');
+  const configService = app.get<AppConfigService>(ConfigService);
+  (app as NestExpressApplication).set('trust proxy', trustProxy(configService.get('server.forward-headers-strategy', { infer: true })));
+  app.use(responseHeaders(<% if (!skipClient) { %>configService<% } %>));
+  const cors = corsOptions(configService);
+  if (cors) {
+    app.enableCors((req: Request, callback: (error: Error | null, options: CorsOptions) => void) =>
+      callback(null, CORS_PATHS.some(path => path.test(req.url)) ? cors : { origin: false }),
+    );
+  }
+<%_ if (authenticationUsesCsrf) { _%>
+  app.use(
+    session({
+      // The session cookie of JHipster Spring Boot.
+      name: 'JSESSIONID',
+      secret: configService.get('jhipster.security.session.secret', { infer: true }),
+      // The sessions in the database of the application, which outlive a restart and are shared by its instances.
+      store: app.get(SessionStore),
+      resave: false,
+      saveUninitialized: false,
+      // Like the session of JHipster Spring Boot, it expires after 30 minutes without requests.
+      rolling: true,
+      cookie: { httpOnly: true, sameSite: 'lax', secure: 'auto', maxAge: SESSION_MAX_AGE },
+    }),
+  );
+<%_ } _%>
+  app.useGlobalPipes(
+    new ValidationPipe({
+      // The errors of the fields, like JHipster Spring Boot.
+      exceptionFactory: errors => new ValidationException(errors),
+      // The body is an instance of its DTO without the properties the DTO does not declare, like JHipster Spring Boot
+      // binds a request to its DTO and ignores the unknown properties: the declared properties without validation are
+      // @Allow(). The instance keeps the properties excluded from the responses only (the password of a registration).
+      whitelist: true,
+      transform: true,
+      // https://github.com/nestjs/nest/issues/10683#issuecomment-1349614194
+      forbidUnknownValues: false,
+      // The target of an error names the objectName of its field error (ValidationException), which is not sent: Nest
+      // 12.2 leaves it out by default.
+      validationError: { target: true },
+    }),
+  );
+  // The errors as the problem details of JHipster Spring Boot.
+  app.useGlobalFilters(new ProblemDetailsFilter(app.get(HeaderUtil)));
+<%_ if (generateUserManagement) { _%>
+  // The mail of a password reset request is a text/plain body, as the JHipster clients send it.
+  (app as NestExpressApplication).useBodyParser('text');
+<%_ } _%>
+  // The JSON bodies up to 10 MB, the blobs of the entities as base64 included (the 100 KB default of Express refused an
+  // image of about 75 KB with 413).
+  (app as NestExpressApplication).useBodyParser('json', { limit: '10mb' });
+  // Disable cache.
+  app.getHttpAdapter().getInstance().set('etag', false);
+  return app;
+}

package/generators/node-server/templates/server/src/app.module.ts.ejs

@@ -0,0 +1,80 @@
+import { Module } from '@nestjs/common';
+import { ConfigModule, ConfigService } from '@nestjs/config';
+import { APP_INTERCEPTOR } from '@nestjs/core';
+import { TypeOrmModule } from '@nestjs/typeorm';
+<%_ if (generateUserManagement) { _%>
+import { ScheduleModule } from '@nestjs/schedule';
+<%_ } _%>
+import { AuthModule } from './auth/auth.module.ts';
+import { CommonModule } from './common/common.module.ts';
+import { HealthModule } from './management/health.module.ts';
+import { ManagementModule } from './management/management.module.ts';
+import { ormConfig } from './orm.config.ts';
+import { configuration } from './config.ts';
+import { LoggingInterceptor } from './common/interceptors/logging.interceptor.ts';
+<%_ if (serviceDiscoveryEureka) { _%>
+import { EurekaService } from './registry/eureka.service.ts';
+<%_ } _%>
+<%_ if (serviceDiscoveryConsul) { _%>
+import { ConsulService } from './registry/consul.service.ts';
+<%_ } _%>
+<%_ if (!skipClient) { _%>
+import { config } from './config.ts';
+import { ServeStaticModule } from '@nestjs/serve-static';
+<%_ } _%>
+// jhipster-needle-add-entity-module-to-main-import - JHipster will import entity modules here, do not remove
+// jhipster-needle-add-controller-module-to-main-import - JHipster will import controller modules here, do not remove
+// jhipster-needle-add-service-module-to-main-import - JHipster will import service modules here, do not remove
+
+@Module({
+  imports: [
+    // The configuration of the application*.yml files, read with ConfigService. main.ts loads the .env file.
+    ConfigModule.forRoot({ isGlobal: true, ignoreEnvFile: true, cache: true, load: [configuration] }),
+    CommonModule,
+  // The database of the active profiles, from the configuration (their application-{profile}.yml files and the environment).
+  TypeOrmModule.forRootAsync({
+    inject: [ConfigService],
+    useFactory: (configService: ConfigService) => ormConfig(key => configService.get(key)),
+  }),
+    <%_ if (!skipClient) { _%>
+<%_
+const spaExcludedPrefixes = ['api', 'management', 'v3/api-docs'];
+if (authenticationTypeOauth2 && (applicationTypeGateway || applicationTypeMonolith)) spaExcludedPrefixes.push('login', 'oauth2');
+if (applicationTypeGateway) spaExcludedPrefixes.push('services');
+_%>
+    ServeStaticModule.forRoot({
+        rootPath: config.getClientPath(),
+        // The index.html of the client for the paths of its routes only, like the SpaWebFilter of JHipster Spring Boot: an
+        // unknown path of the API, or a missing file (a path with a period), is not found.
+        exclude: /^\/(?:<%- spaExcludedPrefixes.map(prefix => prefix.replace('/', '\\/')).join('|') %>)|\./,
+      }),
+    <%_ } _%>
+<%_ if (generateUserManagement) { _%>
+    // The scheduled tasks, like the removal of the users not activated (@Cron of UserService).
+    ScheduleModule.forRoot(),
+<%_ } _%>
+    AuthModule,
+    HealthModule,
+    ManagementModule,
+  // jhipster-needle-add-entity-module-to-main - JHipster will add entity modules here, do not remove
+  ],
+  controllers: [
+  // jhipster-needle-add-controller-module-to-main - JHipster will add controller modules here, do not remove
+  ],
+  providers: [
+    // Logs the requests of every controller, opt out with @SkipLogging().
+    { provide: APP_INTERCEPTOR, useClass: LoggingInterceptor },
+<%_ if (serviceDiscoveryEureka) { _%>
+    // The registration in the Eureka server, started by main.ts once the application listens.
+    EurekaService,
+<%_ } _%>
+<%_ if (serviceDiscoveryConsul) { _%>
+    // The registration in Consul, started by main.ts once the application listens.
+    ConsulService,
+<%_ } _%>
+  // jhipster-needle-add-service-module-to-main - JHipster will add service modules here, do not remove
+  ],
+})
+export class AppModule  {
+
+}

package/generators/node-server/templates/server/src/application-config.ts.ejs

@@ -0,0 +1,153 @@
+import { isInt, isNotEmpty, isPort<% if (authenticationTypeOauth2 || serviceDiscoveryEureka) { %>, isURL<% } %> } from 'class-validator';
+
+/**
+ * The properties of the application the providers read with ConfigService<ApplicationConfig, true>, nested by the dotted
+ * names of the application*.yml files, like the JHipsterProperties of JHipster Spring Boot: ConfigService infers the type
+ * of a property from its path (configService.get('jhipster.cors.max-age', { infer: true }) is a number).
+ */
+export interface ApplicationConfig {
+  server: {
+    port: string | number;
+    'forward-headers-strategy': 'none' | 'native';
+    ssl: { enabled: boolean; 'key-store': string; 'key-store-password': string; 'key-store-type': string };
+  };
+  jhipster: {
+    clientApp: { name: string };
+    security: {
+      'content-security-policy': string;
+<%_ if (authenticationTypeJwt) { _%>
+      authentication: {
+        jwt: {
+          'base64-secret': string;
+          'token-validity-in-seconds': number;
+          'token-validity-in-seconds-for-remember-me': number;
+          'hash-salt-or-rounds': number;
+        };
+      };
+<%_ } _%>
+<%_ if (authenticationTypeSession) { _%>
+      authentication: {
+        'hash-salt-or-rounds': number;
+      };
+<%_ } _%>
+<%_ if (authenticationUsesCsrf) { _%>
+      session: { secret: string };
+<%_ } _%>
+<%_ if (authenticationTypeOauth2) { _%>
+      oauth2: {
+        /** The audiences of the access tokens the API accepts, comma separated. */
+        audience: string;
+        client: {
+          provider: { oidc: { 'issuer-uri': string } };
+          registration: { oidc: { 'client-id': string; 'client-secret': string } };
+        };
+      };
+<%_ } _%>
+    };
+    cors: {
+      'allowed-origins': string;
+      'allowed-origin-patterns': string;
+      'allowed-methods': string;
+      'allowed-headers': string;
+      'exposed-headers': string;
+      'allow-credentials': boolean;
+      'max-age': number;
+    };
+    mail: { from: string; 'base-url': string };
+    registry: { username?: string; password?: string };
+  };
+<%_ if (generateUserManagement) { _%>
+  mail: { host: string; port: number; username: string; password: string };
+<%_ } _%>
+<%_ if (serviceDiscoveryEureka) { _%>
+  eureka: {
+    client: {
+      enabled: boolean;
+      'service-url': { defaultZone: string };
+      'register-with-eureka': boolean;
+      'fetch-registry': boolean;
+      'registry-fetch-interval-seconds': number;
+    };
+    instance: {
+      appname: string;
+      instanceId: string;
+      'prefer-ip-address': boolean;
+      'lease-renewal-interval-in-seconds': number;
+      'lease-expiration-duration-in-seconds': number;
+    };
+  };
+<%_ } _%>
+<%_ if (serviceDiscoveryConsul) { _%>
+  cloud: {
+    consul: {
+      enabled: boolean;
+      host: string;
+      port: number;
+      discovery: {
+        'service-name': string;
+        'instance-id': string;
+        'prefer-ip-address': boolean;
+        'health-check-path': string;
+        'health-check-interval': string;
+        'health-check-timeout': string;
+      };
+    };
+  };
+<%_ } _%>
+  ipAddress: string | null;
+}
+
+/** A rule of a property: its path, the check of its value and the value it expects. */
+type Rule = [path: string, check: (value: any) => boolean, expected: string];
+
+<%_ if (authenticationTypeJwt) { _%>
+const positiveInt = (value: any): boolean => isInt(Number(value)) && Number(value) > 0;
+<%_ } _%>
+
+/**
+ * The rules of the properties, like the validation of the configuration properties of Spring Boot: the application does
+ * not start with an invalid value, the error tells the property and what it expects. The JWT secret is checked when the
+ * JWT key is created (jwt.config.ts).
+ */
+const rules: Rule[] = [
+  ['server.port', value => isPort(String(value)), 'a port'],
+  ['server.forward-headers-strategy', value => ['none', 'native'].includes(value), 'none or native'],
+  ['jhipster.clientApp.name', isNotEmpty, 'the name of the application'],
+<%_ if (authenticationTypeJwt) { _%>
+  ['jhipster.security.authentication.jwt.token-validity-in-seconds', positiveInt, 'a positive number of seconds'],
+  ['jhipster.security.authentication.jwt.token-validity-in-seconds-for-remember-me', positiveInt, 'a positive number of seconds'],
+<%_ } _%>
+<%_ if (generateUserManagement) { _%>
+  ['<%= nodejsPasswordRoundsProperty %>', value => isInt(Number(value)) && value >= 4 && value <= 31, 'bcrypt rounds, from 4 to 31'],
+<%_ } _%>
+  ['jhipster.cors.max-age', value => isInt(Number(value)) && value >= 0, 'a number of seconds'],
+<%_ if (generateUserManagement) { _%>
+  ['mail.port', value => isPort(String(value)), 'a port'],
+<%_ } _%>
+<%_ if (authenticationTypeOauth2) { _%>
+  ['jhipster.security.oauth2.client.provider.oidc.issuer-uri', value => isURL(String(value), { require_tld: false }), 'the URL of the OpenID Connect issuer'],
+<%_ } _%>
+<%_ if (authenticationUsesCsrf) { _%>
+  ['jhipster.security.session.secret', isNotEmpty, 'the secret of the sessions'],
+<%_ } _%>
+<%_ if (serviceDiscoveryEureka) { _%>
+  ['eureka.client.service-url.defaultZone', value => isURL(String(value), { require_tld: false }), 'the URL of the Eureka server'],
+<%_ } _%>
+<%_ if (serviceDiscoveryConsul) { _%>
+  ['cloud.consul.port', value => isPort(String(value)), 'a port'],
+<%_ } _%>
+];
+
+const valueOf = (configuration: Record<string, any>, path: string): unknown =>
+  path.split('.').reduce<any>((value, name) => value?.[name], configuration);
+
+/** Validates the configuration, nested by the dotted names of the properties: throws an error telling the invalid ones. */
+export function validateConfiguration<T extends Record<string, any>>(configuration: T): T {
+  const errors = rules
+    .filter(([path, check]) => !check(valueOf(configuration, path)))
+    .map(([path, , expected]) => `${path} is ${JSON.stringify(valueOf(configuration, path))}, expected ${expected}`);
+  if (errors.length > 0) {
+    throw new Error(`Invalid configuration:\n  ${errors.join('\n  ')}`);
+  }
+  return configuration;
+}

package/generators/node-server/templates/server/src/auth/account.controller.ts.ejs

@@ -0,0 +1,183 @@
+import { <%_ if (generateUserManagement) { _%> Body, Post, Query, <%_ } _%>UseGuards, Controller, Get, HttpCode, Logger, Req, UseInterceptors, ClassSerializerInterceptor, InternalServerErrorException } from '@nestjs/common';
+import { AuthGuard } from './index.ts';
+<%_ if (generateUserManagement) { _%>
+import { PasswordChangeDTO } from './dto/password-change.dto.ts';
+import { KeyAndPasswordDTO } from './dto/key-and-password.dto.ts';
+import { MailService } from '../mail/mail.service.ts';
+<%_ } _%>
+import { <% if (generateUserManagement) { %>Managed<%- userLoginVmClass %>, <% } %><%- userLoginVmClass %> } from '../users/dto/user.dto.ts';
+import { ApiBearerAuth, ApiTags, ApiResponse, ApiOperation } from '@nestjs/swagger';
+import { AuthService } from './auth.service.ts';
+
+@Controller('api')
+@UseInterceptors(ClassSerializerInterceptor)
+@ApiTags('account-resource')
+export class AccountController {
+  logger = new Logger('AccountController');
+
+  constructor(
+    private readonly authService: AuthService,
+<%_ if (generateUserManagement) { _%>
+    private readonly mailService: MailService,
+<%_ } _%>
+  ) { }
+  <%_ if (generateUserManagement) { _%>
+
+  @Post('/register')
+  @ApiOperation({ summary: 'Register user' })
+  @ApiResponse({
+    status: 201,
+    description: 'Registered user',
+    type: <%- user.dtoClass %>,
+  })
+  async registerAccount(@Req() req: { user: <%- userLoginVmClass %> }, @Body() userDTO: Managed<%- user.dtoClass %>): Promise <any> {
+    const user = await this.authService.registerNewUser(userDTO);
+    void this.mailService.sendActivationEmail(user);
+    return user;
+  }
+
+  @Get('/activate')
+  @ApiOperation({ summary: 'Activate the registered user' })
+  @ApiResponse({
+    status: 200,
+    description: 'activated',
+  })
+  @ApiResponse({ status: 500, description: 'No user was found for this activation key' })
+  async activateAccount(@Query('key') key: string): Promise<void> {
+    const user = await this.authService.activateRegistration(key);
+    if (!user) {
+      throw new InternalServerErrorException('No user was found for this activation key');
+    }
+  }
+
+  @Get('/authenticate')
+  @ApiBearerAuth()
+  @UseGuards(AuthGuard)
+  @ApiOperation({ summary: 'Check if the user is authenticated' })
+  @ApiResponse({
+    status: 200,
+    description: 'login authenticated',
+  })
+  isAuthenticated(@Req() req: { user: <%- userLoginVmClass %> }): any {
+    const { user } = req;
+    return (user).login;
+  }
+
+  @Get('/account')
+  @ApiBearerAuth()
+  @UseGuards(AuthGuard)
+  @ApiOperation({ summary: 'Get the current user.' })
+  @ApiResponse({
+    status: 200,
+    description: 'user retrieved',
+  })
+  async getAccount(@Req() req: { user: <%- userLoginVmClass %> }): Promise<any> {
+    const { user } = req;
+    const userProfileFound = await this.authService.getAccount(user.id!);
+    <%_ if (databaseType === 'mongodb') { _%>
+    if (userProfileFound && !userProfileFound.firstName) {
+        userProfileFound.firstName ='';
+    }
+    if (userProfileFound && !userProfileFound.lastName) {
+        userProfileFound.lastName ='';
+    }
+    <%_ } _%>
+    return userProfileFound;
+  }
+
+  @Post('/account')
+  @HttpCode(200)
+  @ApiBearerAuth()
+  @UseGuards(AuthGuard)
+  @ApiOperation({ summary: 'Update the current user information' })
+  @ApiResponse({
+    status: 200,
+    description: 'user info updated',
+    type: <%- user.dtoClass %>,
+  })
+  async saveAccount(@Req() req: { user: <%- userLoginVmClass %> }, @Body() newUserInfo: <%- user.dtoClass %>): Promise<any> {
+    const { user } = req;
+    return await this.authService.updateUserSettings(user.login, newUserInfo);
+  }
+
+  @Post('/account/change-password')
+  @HttpCode(200)
+  @ApiBearerAuth()
+  @UseGuards(AuthGuard)
+  @ApiOperation({ summary: 'Change current password' })
+  @ApiResponse({
+    status: 200,
+    description: 'user password changed',
+    type: PasswordChangeDTO,
+  })
+  async changePassword(@Req() req: { user: <%- userLoginVmClass %> }, @Body() passwordChange: PasswordChangeDTO): Promise<any> {
+    const { user } = req;
+    return await this.authService.changePassword(user.login, passwordChange.currentPassword, passwordChange.newPassword);
+  }
+
+  @Post('/account/reset-password/init')
+  @HttpCode(200)
+  @ApiOperation({ summary: 'Send an email to reset the password of the user' })
+  @ApiResponse({
+    status: 200,
+    description: 'Reset key given to the activated user of the mail, if any',
+  })
+  async requestPasswordReset(@Body() mail: string): Promise<void> {
+    const user = await this.authService.requestPasswordReset(String(mail));
+    if (user) {
+      void this.mailService.sendPasswordResetMail(user);
+    } else {
+      this.logger.warn('Password reset requested for non existing mail');
+    }
+  }
+
+  @Post('/account/reset-password/finish')
+  @HttpCode(200)
+  @ApiOperation({ summary: 'Finish to reset the password of the user' })
+  @ApiResponse({
+    status: 200,
+    description: 'password reset',
+  })
+  async finishPasswordReset(@Body() keyAndPassword: KeyAndPasswordDTO): Promise<void> {
+    await this.authService.completePasswordReset(keyAndPassword.newPassword, keyAndPassword.key);
+  }
+
+  <%_ } else if (authenticationType === 'oauth2') { _%>
+
+  @Get('/account')
+  @ApiBearerAuth()
+  @UseGuards(AuthGuard)
+  @ApiOperation({ summary: 'Get the current user, of the session or of the bearer token, else 401' })
+  @ApiResponse({
+    status: 200,
+    description: 'User retrieved',
+    type: <%- userLoginVmClass %>,
+  })
+  getAccount(@Req() req: { user: <%- userLoginVmClass %> }): any {
+    return this.authService.getAccount(req.user);
+  }
+
+  <%_ } else {_%>
+
+  @Get('/account')
+  @ApiBearerAuth()
+  @UseGuards(AuthGuard)
+  @ApiOperation({ summary: 'Get the current user.' })
+  @ApiResponse({
+    status: 200,
+    description: 'user retrieved',
+  })
+  <%_ if (generateBuiltInUserEntity) { _%>
+  async getAccount(@Req() req: { user: <%- userLoginVmClass %> }): Promise<any> {
+    const { user } = req;
+    return await this.authService.getAccount(user.id!);
+  }
+  <%_ } else { _%>
+  getAccount(@Req() req: { user: <%- userLoginVmClass %> }): <%- userLoginVmClass %> {
+    // The user of the token, without built-in User.
+    return req.user;
+  }
+  <%_ } _%>
+  <%_ } _%>
+
+}