@mshima/generator-jhipster-nodejs 0.0.0-stage → 0.0.1

package/generators/node-server/templates/server/src/auth/auth.module.ts.ejs

@@ -0,0 +1,104 @@
+<%_ if (authenticationType === 'oauth2') { _%>
+import { HttpModule } from '@nestjs/axios';
+<%_ } _%>
+import { <% if (authenticationUsesCsrf) { %>MiddlewareConsumer, NestModule, <% } %>Module } from '@nestjs/common';
+import { AuthService } from './auth.service.ts';
+<%_ if (generateBuiltInUserEntity) { _%>
+import { UserModule } from '../users/user.module.ts';
+<%_ } _%>
+import { PassportModule } from '@nestjs/passport';
+<%_ if (authenticationType === 'jwt') { _%>
+  <%_ if (generateBuiltInUserEntity) { _%>
+import { JwtModule } from '@nestjs/jwt';
+import { UserJWTController} from './user.jwt.controller.ts';
+  <%_ } _%>
+import { JwtStrategy } from './passport.jwt.strategy.ts';
+<%_ } else if (authenticationType === 'oauth2') { _%>
+import { Oauth2Strategy } from './passport.oauth2.strategy.ts';
+import { Oauth2BearerStrategy } from './passport.oauth2-bearer.strategy.ts';
+import { UserOauth2Controller } from './user.oauth2.controller.ts';
+<%_ } else if (authenticationTypeSession) { _%>
+import { UserSessionController } from './user.session.controller.ts';
+import { SessionUserMiddleware } from './session-user.middleware.ts';
+<%_ } _%>
+<%_ if (authenticationUsesCsrf) { _%>
+import { CsrfMiddleware } from './csrf.middleware.ts';
+import { Session } from './session.entity.ts';
+import { SessionStore } from './session.store.ts';
+<%_ } _%>
+<%_ if (authenticationType === 'jwt' && generateBuiltInUserEntity) { _%>
+import { ConfigService } from '@nestjs/config';
+import { JWT_ALGORITHM, jwtSecretKey } from './jwt.config.ts';
+<%_ } _%>
+<%_ if (generateBuiltInAuthorityEntity || authenticationUsesCsrf) { _%>
+import { TypeOrmModule } from '@nestjs/typeorm';
+<%_ } _%>
+<%_ if (generateBuiltInAuthorityEntity) { _%>
+import { Authority } from '../users/authority.entity.ts';
+import { AuthorityController } from '../users/authority.controller.ts';
+<%_ } _%>
+<%_ if (generateBuiltInUserEntity) { _%>
+import { PublicUserController } from '../users/public.user.controller.ts';
+<%_ } else { _%>
+import { ManagementController } from '../management/management.controller.ts';
+<%_ } _%>
+import { AccountController } from './account.controller.ts';
+
+@Module({
+  imports: [
+  <%_ if (generateBuiltInAuthorityEntity || authenticationUsesCsrf) { _%>
+  TypeOrmModule.forFeature([<%- [generateBuiltInAuthorityEntity && 'Authority', authenticationUsesCsrf && 'Session'].filter(Boolean).join(', ') %>]),
+  <%_ } _%>
+  <%_ if (generateBuiltInUserEntity) { _%>
+  UserModule,
+  <%_ } _%>
+  PassportModule,
+  <%_ if (authenticationType === 'jwt' && generateBuiltInUserEntity) { _%>
+    JwtModule.registerAsync({
+      inject: [ConfigService],
+      useFactory: (configService: ConfigService) => ({
+        secret: jwtSecretKey(configService),
+        signOptions: {
+          algorithm: JWT_ALGORITHM,
+          expiresIn: Number(configService.getOrThrow('jhipster.security.authentication.jwt.token-validity-in-seconds')),
+        },
+      }),
+    }),
+  <%_ } else if (authenticationType === 'oauth2') { _%>
+  HttpModule,
+  <%_ } _%>
+  ],
+  controllers: [
+  <%_ if (authenticationType === 'jwt' && generateBuiltInUserEntity) { _%>
+  UserJWTController,
+  <%_ } else if (authenticationType === 'oauth2') { _%>
+  UserOauth2Controller,
+  <%_ } else if (authenticationTypeSession) { _%>
+  UserSessionController,
+  <%_ } _%>
+  <%_ if (generateBuiltInAuthorityEntity) { _%>
+  AuthorityController,
+  <%_ } _%>
+  <%- generateBuiltInUserEntity ? 'PublicUserController' : 'ManagementController' %>, AccountController ],
+  providers: [AuthService,
+  <%_ if (authenticationUsesCsrf) { _%>
+  SessionStore,
+  <%_ } _%>
+  <%_ if (authenticationType === 'jwt') { _%>
+  JwtStrategy
+  <%_ } else if (authenticationType === 'oauth2') { _%>
+  Oauth2Strategy,
+  Oauth2BearerStrategy
+  <%_ } _%>
+  ],
+  exports: [AuthService],
+})
+<%_ if (authenticationUsesCsrf) { _%>
+export class AuthModule implements NestModule {
+  configure(consumer: MiddlewareConsumer): void {
+    consumer.apply(<% if (authenticationTypeSession) { %>SessionUserMiddleware, <% } %>CsrfMiddleware).forRoutes('*');
+  }
+}
+<%_ } else { _%>
+export class AuthModule {}
+<%_ } _%>

package/generators/node-server/templates/server/src/auth/auth.service.ts.ejs

@@ -0,0 +1,294 @@
+import { Injectable, <%_ if (generateUserManagement) { _%> HttpException, HttpStatus, InternalServerErrorException, <%_ } _%> Logger } from '@nestjs/common';
+<%_ if (generateUserManagement) { _%>
+import { randomBytes } from 'crypto';
+<%_ } _%>
+<%_ if (generateBuiltInAuthorityEntity) { _%>
+import { InjectRepository } from '@nestjs/typeorm';
+import { Repository } from 'typeorm';
+<%_ } _%>
+<%_ if (generateUserManagement) { _%>
+import { PasswordService } from './password.service.ts';
+<%_ } _%>
+<%_ if (authenticationType === 'jwt' && generateBuiltInUserEntity) { _%>
+import { JwtService } from '@nestjs/jwt';
+import { UserLoginDTO } from './dto/user-login.dto.ts';
+import { Payload } from './payload.interface.ts';
+<%_ } _%>
+<%_ if (generateBuiltInAuthorityEntity) { _%>
+import { Authority } from '../users/authority.entity.ts';
+<%_ } _%>
+<%_ if (generateBuiltInUserEntity) { _%>
+import { UserService } from '../users/user.service.ts';
+<%_ if (generateUserManagement) { _%>
+import { EmailAlreadyUsedException, InvalidPasswordException, LoginAlreadyUsedException } from '../common/errors/problem.exception.ts';
+<%_ } _%>
+<%_ } _%>
+import { <%= userLoginVmClass %> } from '../users/dto/user.dto.ts';
+<%_ if (authenticationType === 'jwt' && generateBuiltInUserEntity) { _%>
+import { ConfigService } from '@nestjs/config';
+<%_ } _%>
+
+<%_
+const userIdType = user?.primaryKey.tsType;
+_%>
+<%_ if (generateUserManagement) { _%>
+
+/** The length of a password, like the one of the ManagedUserVM of JHipster Spring Boot. */
+const PASSWORD_MIN_LENGTH = 4;
+const PASSWORD_MAX_LENGTH = 100;
+
+function isPasswordLengthInvalid(password?: string): boolean {
+  return !password || password.length < PASSWORD_MIN_LENGTH || password.length > PASSWORD_MAX_LENGTH;
+}
+<%_ } _%>
+
+
+@Injectable()
+export class AuthService {
+    logger = new Logger('AuthService');
+  constructor(
+    <%_ if (authenticationType === 'jwt' && generateBuiltInUserEntity) { _%>
+    private readonly jwtService: JwtService,
+    private readonly configService: ConfigService,
+    <%_ } _%>
+    <%_ if (generateUserManagement) { _%>
+    private readonly passwordService: PasswordService,
+    <%_ } _%>
+    <%_ if (generateBuiltInAuthorityEntity) { _%>
+    @InjectRepository(Authority) private authorityRepository: Repository<Authority>,
+    <%_ } _%>
+    <%_ if (generateBuiltInUserEntity) { _%>
+    private userService: UserService,
+    <%_ } _%>
+  ) {}
+
+  <%_ if (generateUserManagement) { _%>
+  /** The hash an unknown login is checked with, like the timing attack protection of the DaoAuthenticationProvider of Spring Security. */
+  private unknownUserPasswordHash?: Promise<string>;
+
+  /** The activated user of a login and its password, with its authorities, else 401, like the login of JHipster Spring Boot. */
+  async authenticate(loginUserName: string, loginPassword: string): Promise<<%= user.dtoClass %>> {
+    // The logins are in lower case, like the ones of JHipster Spring Boot.
+    const userFind = await this.userService.findByFields({ where: { login: loginUserName.toLowerCase() } });
+    // An unknown login checks the password with a hash too: it answers in the time of a known one, which does not tell
+    // the logins of the users.
+    this.unknownUserPasswordHash ??= this.passwordService.encode(randomBytes(16).toString('hex'));
+    const validPassword = await this.passwordService.matches(loginPassword, userFind?.password ?? (await this.unknownUserPasswordHash));
+    if (!userFind || !validPassword) {
+      throw new HttpException('Invalid login name or password!', HttpStatus.UNAUTHORIZED);
+    }
+
+    if (userFind && !userFind.activated) {
+      throw new HttpException('Your account is not been activated!', HttpStatus.UNAUTHORIZED);
+    }
+
+    const user = await this.findUserWithAuthById(userFind.id!);
+    if (!user) {
+      throw new HttpException('Invalid login name or password!', HttpStatus.UNAUTHORIZED);
+    }
+    return user;
+  }
+  <%_ if (authenticationTypeJwt) { _%>
+
+  async login(userLogin: UserLoginDTO): Promise<any> {
+    const loginUserName = userLogin.username;
+    const loginPassword = userLogin.password;
+    if (!loginUserName || !loginPassword) {
+      throw new HttpException('Username and password are required!', HttpStatus.BAD_REQUEST);
+    }
+    const user = await this.authenticate(loginUserName, loginPassword);
+
+    const payload: Payload = { sub: user.login, auth: (user.authorities ?? []).join(' '), userId: user.id };
+
+    const expiresIn = Number(
+      userLogin.rememberMe
+        ? this.configService.getOrThrow('jhipster.security.authentication.jwt.token-validity-in-seconds-for-remember-me')
+        : this.configService.getOrThrow('jhipster.security.authentication.jwt.token-validity-in-seconds'),
+    );
+    return {
+      id_token: this.jwtService.sign(payload, { expiresIn }),
+    };
+  }
+
+  async validateUser(payload: Payload): Promise<<%= user.dtoClass %> | undefined> {
+    // The user of the token subject, like the login of JHipster Spring Boot tokens.
+    return await this.userService.findByFields({ where: { login: payload.sub } });
+  }
+  <%_ } _%>
+
+  async findUserWithAuthById(userId: <%= userIdType %>): Promise<<%= user.dtoClass %> | undefined> {
+    <%_ if (databaseType === 'mongodb') { _%>
+    const userDTO = await this.userService.findById(userId);
+    <%_ } else { _%>
+    const userDTO = await this.userService.findByFields({ where: { id: userId } });
+    <%_ } _%>
+    return userDTO;
+  }
+
+  async getAccount(userId: <%= userIdType %>): Promise<<%= user.dtoClass %> | undefined> {
+    const userDTO = await this.findUserWithAuthById(userId);
+    if (!userDTO) {
+      return;
+    }
+    return userDTO;
+  }
+
+  async changePassword(userLogin: string, currentClearTextPassword: string, newPassword: string): Promise<void> {
+    // Like the AccountResource of JHipster Spring Boot, the length of the new password.
+    if (isPasswordLengthInvalid(newPassword)) {
+      throw new InvalidPasswordException();
+    }
+    const userFind = await this.userService.findByFields({ where: { login: userLogin } });
+    if (!userFind) {
+      throw new HttpException('Invalid login name!', HttpStatus.BAD_REQUEST);
+    }
+
+    if (!(await this.passwordService.matches(currentClearTextPassword, userFind.password))) {
+      throw new InvalidPasswordException();
+    }
+    userFind.password = newPassword;
+    await this.userService.save(userFind, userLogin, true);
+    return;
+  }
+
+  /**
+   * Like JHipster Spring Boot, gives a reset key, valid one day, to the activated user of the mail: the user returned
+   * is the one the mail with the key is for, undefined for another mail.
+   */
+  async requestPasswordReset(mail: string): Promise<<%= user.dtoClass %> | undefined> {
+    const userFind = await this.userService.findByFields({ where: { email: mail.trim().toLowerCase() } });
+    if (!userFind?.activated) {
+      return undefined;
+    }
+    userFind.resetKey = randomBytes(15).toString('base64url');
+    userFind.resetDate = new Date();
+    return this.userService.save(userFind, userFind.login);
+  }
+
+  /** Like JHipster Spring Boot, sets the new password of the user of a reset key given less than one day ago. */
+  async completePasswordReset(newPassword: string, key: string): Promise<void> {
+    const userFind = await this.userService.findByFields({ where: { resetKey: key } });
+    if (!userFind?.resetDate || new Date(userFind.resetDate).getTime() < Date.now() - 24 * 60 * 60 * 1000) {
+      throw new InternalServerErrorException('No user was found for this reset key');
+    }
+    userFind.password = newPassword;
+    // null clears the columns (TypeORM leaves the undefined properties unchanged).
+    Object.assign(userFind, { resetKey: null, resetDate: null });
+    await this.userService.save(userFind, userFind.login, true);
+  }
+
+  /**
+   * Like JHipster Spring Boot, registers a user not activated, with the fields of the registration only, its login and
+   * mail in lower case, and an activation key (sent by mail): the not activated user of the same login or mail, if any,
+   * is removed first.
+   */
+  async registerNewUser(newUser: <%= user.dtoClass %>): Promise<<%= user.dtoClass %>> {
+    if (isPasswordLengthInvalid(newUser.password)) {
+      throw new InvalidPasswordException();
+    }
+    const login = newUser.login.toLowerCase();
+    const email = newUser.email.toLowerCase();
+    const userOfLogin = await this.userService.findByFields({ where: { login } });
+    if (userOfLogin && !(await this.removeNonActivatedUser(userOfLogin))) {
+      throw new LoginAlreadyUsedException();
+    }
+    const userOfEmail = await this.userService.findByFields({ where: { email } });
+    if (userOfEmail && !(await this.removeNonActivatedUser(userOfEmail))) {
+      throw new EmailAlreadyUsedException();
+    }
+    const user: <%= user.dtoClass %> = {
+      login,
+      password: newUser.password,
+      firstName: newUser.firstName,
+      lastName: newUser.lastName,
+      email,
+      imageUrl: newUser.imageUrl,
+      langKey: newUser.langKey,
+      // new user is not active
+      activated: false,
+      // new user gets registration key
+      activationKey: randomBytes(15).toString('base64url'),
+      authorities: ['ROLE_USER'],
+    };
+    return await this.userService.save(user, login, true);
+  }
+
+  /** Like JHipster Spring Boot, activates the user of an activation key, undefined for an unknown key. */
+  async activateRegistration(key: string): Promise<<%= user.dtoClass %> | undefined> {
+    const userFind = key ? await this.userService.findByFields({ where: { activationKey: key } }) : undefined;
+    if (!userFind) {
+      return undefined;
+    }
+    userFind.activated = true;
+    // null clears the column (TypeORM leaves the undefined properties unchanged).
+    Object.assign(userFind, { activationKey: null });
+    return await this.userService.save(userFind, userFind.login);
+  }
+
+  private async removeNonActivatedUser(existingUser: <%= user.dtoClass %>): Promise<boolean> {
+    if (existingUser.activated) {
+      return false;
+    }
+    await this.userService.delete(existingUser);
+    return true;
+  }
+
+  async updateUserSettings(userLogin: string, newUserInfo: <%= user.dtoClass %>) : Promise<<%= user.dtoClass %>> {
+    const userFind = await this.userService.findByFields({ where: { login: userLogin } });
+    if (!userFind) {
+      throw new HttpException('Invalid login name!', HttpStatus.BAD_REQUEST);
+    }
+    // Like JHipster Spring Boot, the mail in lower case, of no other user.
+    const email = newUserInfo.email.toLowerCase();
+    const userFindEmail = await this.userService.findByFields({ where: { email } });
+    if (userFindEmail && userFindEmail.login !== userFind.login) {
+      throw new EmailAlreadyUsedException();
+    }
+
+    userFind.firstName = newUserInfo.firstName;
+    userFind.lastName = newUserInfo.lastName;
+    userFind.email = email;
+    userFind.langKey = newUserInfo.langKey;
+    await this.userService.save(userFind, userLogin);
+    return userFind;
+  }
+
+  <%_ } else if (authenticationType === 'oauth2') { _%>
+    <%_ if (generateBuiltInUserEntity) { _%>
+    /**
+     * The user of the identity provider in the database, like the user synchronization of JHipster Spring Boot: the
+     * authorities the database misses saved first, then the user created, or updated with the names, the mail, the
+     * language and the authorities of the identity provider.
+     */
+    async findUserOrSave(loginUser: <%= userLoginVmClass %>): Promise<<%= userLoginVmClass %> | undefined> {
+        const authorities = loginUser.authorities ?? [];
+<%_ if (generateBuiltInAuthorityEntity) { _%>
+        for (const name of authorities) {
+          if (!(await this.authorityRepository.findOne({ where: { name } }))) {
+            await this.authorityRepository.save(this.authorityRepository.create({ name }));
+          }
+        }
+<%_ } _%>
+        const userFound = await this.userService.findByFields({ where: { login: loginUser.login } });
+        const email = loginUser.email ?? userFound?.email ?? `${loginUser.login}@localhost`;
+        // The values the identity provider gives, over the ones of the user found: not the undefined properties of the user of
+        // the claims (its id among them), which would make another user.
+        const claims = Object.fromEntries(Object.entries(loginUser).filter(([, value]) => value !== undefined));
+        // Activated, like the users of JHipster Spring Boot synchronized from the identity provider, without a password.
+        await this.userService.save({ ...userFound, ...claims, email, activated: true, authorities } as <%= userLoginVmClass %>, loginUser.login);
+        return loginUser;
+      }
+    <%_ } _%>
+
+  getAccount(userDTO: <%= userLoginVmClass %>): any {
+    if (!userDTO) {
+      return;
+    }
+    // Without the ID token of the session, kept for the logout only.
+    const { idToken: _idToken, ...account } = userDTO as any;
+    return account;
+  }
+
+  <%_ } _%>
+
+}

package/generators/node-server/templates/server/src/auth/csrf.middleware.spec.ts.ejs

@@ -0,0 +1,65 @@
+import { describe, expect, it, vi } from 'vitest';
+import { ForbiddenException } from '@nestjs/common';
+import { <% if (authenticationTypeSession) { %>checkLoginCsrfToken, <% } %>CsrfMiddleware } from './csrf.middleware.ts';
+
+const call = (method: string, session: any, headers: Record<string, string> = {}): { res: any; next: any } => {
+  const res = { cookie: vi.fn() };
+  const next = vi.fn();
+  new CsrfMiddleware().use({ method, headers, session } as any, res as any, next);
+  return { res, next };
+};
+
+describe('CsrfMiddleware', () => {
+<%_ if (authenticationTypeSession) { _%>
+  it('lets the requests without a logged session pass, giving a token cookie to a client without one', () => {
+    const { res, next } = call('POST', {});
+    expect(next).toHaveBeenCalled();
+    expect(res.cookie).toHaveBeenCalledWith('XSRF-TOKEN', expect.any(String), expect.objectContaining({ path: '/' }));
+    expect(call('POST', {}, { cookie: 'XSRF-TOKEN=t0k' }).res.cookie).not.toHaveBeenCalled();
+  });
+
+  it('refuses a login without the token of its cookie, like Spring Security', () => {
+    expect(() => checkLoginCsrfToken({ headers: {} } as any)).toThrow(ForbiddenException);
+    expect(() => checkLoginCsrfToken({ headers: { 'x-xsrf-token': 't0k' } } as any)).toThrow(ForbiddenException);
+    expect(() => checkLoginCsrfToken({ headers: { cookie: 'XSRF-TOKEN=t0k', 'x-xsrf-token': 'other' } } as any)).toThrow(ForbiddenException);
+  });
+
+  it('accepts a login with the token of its cookie', () => {
+    expect(() => checkLoginCsrfToken({ headers: { cookie: 'SESSION=1; XSRF-TOKEN=t0k', 'x-xsrf-token': 't0k' } } as any)).not.toThrow();
+  });
+
+  it('gives the CSRF cookie of a remember-me session its lifetime', () => {
+    const { res } = call('GET', { user: { login: 'user' }, csrfToken: 't0k', cookie: { originalMaxAge: 1000 } });
+    expect(res.cookie).toHaveBeenCalledWith('XSRF-TOKEN', 't0k', expect.objectContaining({ maxAge: 1000 }));
+  });
+<%_ } else { _%>
+  it('lets the requests without a logged session pass, without the cookie', () => {
+    const { res, next } = call('POST', {});
+    expect(next).toHaveBeenCalled();
+    expect(res.cookie).not.toHaveBeenCalled();
+  });
+<%_ } _%>
+
+  it('gives the token of a logged session back as the XSRF-TOKEN cookie on its safe requests too', () => {
+    const { res, next } = call('GET', { user: { login: 'user' }, csrfToken: 't0k' });
+    expect(next).toHaveBeenCalled();
+    expect(res.cookie).toHaveBeenCalledWith('XSRF-TOKEN', 't0k', expect.objectContaining({ path: '/', maxAge: expect.any(Number) }));
+  });
+
+  it('refuses an unsafe request of a logged session without its token, the logout too, like Spring Security', () => {
+    expect(() => call('POST', { user: { login: 'user' }, csrfToken: 't0k' })).toThrow(ForbiddenException);
+    expect(() => call('POST', { user: { login: 'user' }, csrfToken: 't0k' }, { 'x-xsrf-token': 'other' })).toThrow(ForbiddenException);
+  });
+
+  it('accepts an unsafe request of a logged session with its token', () => {
+    const { next } = call('DELETE', { user: { login: 'user' }, csrfToken: 't0k' }, { 'x-xsrf-token': 't0k' });
+    expect(next).toHaveBeenCalled();
+  });
+
+  it('creates the token of a session without one', () => {
+    const session: any = { user: { login: 'user' } };
+    const { res } = call('GET', session);
+    expect(session.csrfToken).toEqual(expect.any(String));
+    expect(res.cookie).toHaveBeenCalledWith('XSRF-TOKEN', session.csrfToken, expect.any(Object));
+  });
+});

package/generators/node-server/templates/server/src/auth/csrf.middleware.ts.ejs

@@ -0,0 +1,76 @@
+import { randomUUID } from 'crypto';
+import { ForbiddenException, Injectable, NestMiddleware } from '@nestjs/common';
+import { NextFunction, Request, Response } from 'express';
+
+/** The idle lifetime of a session, rolling: its cookie and the CSRF cookie expire together. */
+export const SESSION_MAX_AGE = 30 * 60 * 1000;
+<%_ if (authenticationTypeSession) { _%>
+
+/**
+ * The idle lifetime of a session logged in with remember-me, like the validity of the remember-me tokens of JHipster
+ * Spring Boot (31 days): kept in the database (SessionStore), the session outlives a restart like those tokens.
+ */
+export const REMEMBER_ME_MAX_AGE = 31 * 24 * 60 * 60 * 1000;
+<%_ } _%>
+
+/** The methods that change nothing, which the CSRF token does not protect, like the ones of Spring Security. */
+const SAFE_METHODS = ['GET', 'HEAD', 'OPTIONS', 'TRACE'];
+
+/** The XSRF-TOKEN cookie the clients (Angular HttpClient, axios) send back as the X-XSRF-TOKEN header. */
+export function setCsrfCookie(res: Response, token: string, maxAge = SESSION_MAX_AGE): void {
+  res.cookie('XSRF-TOKEN', token, { sameSite: 'lax', path: '/', maxAge });
+}
+<%_ if (authenticationTypeSession) { _%>
+
+/** The XSRF-TOKEN cookie of a request. */
+function csrfCookie(req: Request): string | undefined {
+  const cookie = req.headers.cookie
+    ?.split(';')
+    .map(value => value.trim())
+    .find(value => value.startsWith('XSRF-TOKEN='));
+  return cookie ? decodeURIComponent(cookie.slice('XSRF-TOKEN='.length)) : undefined;
+}
+
+/**
+ * The CSRF check of the session login, like the CookieCsrfTokenRepository of Spring Security: the X-XSRF-TOKEN header is
+ * the token of the XSRF-TOKEN cookie of the client, else 403, so another site cannot log the browser of a user into another
+ * account. Called by the login itself, whatever the path Express routes to it (its case, a trailing slash).
+ */
+export function checkLoginCsrfToken(req: Request): void {
+  const token = csrfCookie(req);
+  if (!token || req.headers['x-xsrf-token'] !== token) {
+    throw new ForbiddenException('Invalid CSRF token');
+  }
+}
+<%_ } _%>
+
+/**
+ * The CSRF protection of the sessions, like the CSRF filter of Spring Security and the CookieCsrfFilter of JHipster Spring
+ * Boot: every response of a logged session gives its token back as the XSRF-TOKEN cookie, and every unsafe request of it,
+ * the logout included, must send it as X-XSRF-TOKEN, else 403. A request with a bearer token has no session to protect.
+<%_ if (authenticationTypeSession) { _%>
+ * A client without a logged session gets a token cookie, which its login must send back (checkLoginCsrfToken).
+<%_ } _%>
+ */
+@Injectable()
+export class CsrfMiddleware implements NestMiddleware {
+  use(req: Request, res: Response, next: NextFunction): void {
+    const session = req.session as any;
+    if (!session?.user) {
+<%_ if (authenticationTypeSession) { _%>
+      if (!csrfCookie(req)) {
+        setCsrfCookie(res, randomUUID());
+      }
+<%_ } _%>
+      next();
+      return;
+    }
+    session.csrfToken ??= randomUUID();
+    // The CSRF cookie expires with the session cookie<% if (authenticationTypeSession) { %>, later for a remember-me login<% } %>.
+    setCsrfCookie(res, session.csrfToken, session.cookie?.originalMaxAge ?? SESSION_MAX_AGE);
+    if (!SAFE_METHODS.includes(req.method) && req.headers['x-xsrf-token'] !== session.csrfToken) {
+      throw new ForbiddenException('Invalid CSRF token');
+    }
+    next();
+  }
+}

package/generators/node-server/templates/server/src/auth/decorators/auth-user.decorator.ts.ejs

@@ -0,0 +1,8 @@
+import { createParamDecorator, ExecutionContext } from '@nestjs/common';
+
+export const AuthUser = createParamDecorator(
+  (data: unknown, ctx: ExecutionContext) => {
+    const request = ctx.switchToHttp().getRequest();
+    return request.user;
+  },
+);

package/generators/node-server/templates/server/src/auth/decorators/roles.decorator.ts.ejs

@@ -0,0 +1,4 @@
+import { SetMetadata } from '@nestjs/common';
+
+/** The roles a route allows, any of them, like a hasAnyAuthority of JHipster Spring Boot: a RoleType or a role of the JDL. */
+export const Roles = (...roles: string[]): any => SetMetadata('roles', roles);

package/generators/node-server/templates/server/src/auth/dto/key-and-password.dto.ts.ejs

@@ -0,0 +1,17 @@
+import { ApiProperty } from '@nestjs/swagger';
+import { IsString, IsNotEmpty, Length } from 'class-validator';
+
+/**
+ * The reset key and the new password of a password reset, like the KeyAndPasswordVM of JHipster Spring Boot.
+ */
+export class KeyAndPasswordDTO {
+  @ApiProperty({ description: 'Reset key' })
+  @IsString()
+  @IsNotEmpty()
+  readonly key!: string;
+
+  @ApiProperty({ description: 'New password' })
+  @IsString()
+  @Length(4, 100)
+  readonly newPassword!: string;
+}

package/generators/node-server/templates/server/src/auth/dto/password-change.dto.ts.ejs

@@ -0,0 +1,17 @@
+import { ApiProperty } from '@nestjs/swagger';
+import { IsString, IsNotEmpty } from 'class-validator';
+
+/**
+ * A DTO representing a password change required data - current and new password.
+ */
+export class PasswordChangeDTO {
+  @ApiProperty({ description: 'Current password' })
+  @IsString()
+  @IsNotEmpty()
+  readonly currentPassword!: string;
+
+  @ApiProperty({ description: 'New password' })
+  @IsString()
+  @IsNotEmpty()
+  readonly newPassword!: string;
+}

package/generators/node-server/templates/server/src/auth/dto/user-login.dto.ts.ejs

@@ -0,0 +1,21 @@
+import { ApiProperty } from '@nestjs/swagger';
+import { Allow, IsString } from 'class-validator';
+
+/**
+ * A DTO representing a login user.
+ */
+export class UserLoginDTO {
+
+  @ApiProperty({ description: 'User password' })
+  @IsString()
+  readonly password!: string;
+
+  @ApiProperty({ description: 'User remember login', required: false })
+  @Allow()
+  readonly rememberMe?: boolean;
+
+  @ApiProperty({ description: 'User login name' })
+  @IsString()
+  readonly username!: string;
+
+}

package/generators/node-server/templates/server/src/auth/guards/auth.guard.ts.ejs

@@ -0,0 +1,50 @@
+<%_ if (authenticationType === 'oauth2') { _%>
+import { ExecutionContext, Injectable, UnauthorizedException } from '@nestjs/common';
+import { AuthGuard as NestAuthGuard } from '@nestjs/passport';
+
+/**
+ * The authentication of the API, like JHipster Spring Boot with OAuth2: the session of the login (the clients of the
+ * application, their unsafe requests checked by the CsrfMiddleware), else an access token of the identity provider as
+ * bearer token (oauth2ResourceServer), else 401.
+ */
+@Injectable()
+export class AuthGuard extends NestAuthGuard('oauth2-bearer') {
+  canActivate(context: ExecutionContext): any {
+    const request = context.switchToHttp().getRequest();
+
+    if (request.session?.user) {
+      request.user = request.session.user;
+      return true;
+    }
+    // The authentication scheme is case insensitive, like HTTP gives it.
+    if (!/^bearer\s+\S/i.test(request.headers.authorization ?? '')) {
+      throw new UnauthorizedException();
+    }
+    return super.canActivate(context);
+  }
+}
+<%_ } else if (authenticationTypeSession) { _%>
+import { CanActivate, ExecutionContext, Injectable, UnauthorizedException } from '@nestjs/common';
+
+/**
+ * The authentication of the API, like JHipster Spring Boot with sessions: the user of the session of the login (its unsafe
+ * requests checked by the CsrfMiddleware), else 401.
+ */
+@Injectable()
+export class AuthGuard implements CanActivate {
+  canActivate(context: ExecutionContext): boolean {
+    const request = context.switchToHttp().getRequest();
+    if (!request.session?.user) {
+      throw new UnauthorizedException();
+    }
+    request.user = request.session.user;
+    return true;
+  }
+}
+<%_ } else { _%>
+import { Injectable } from '@nestjs/common';
+import { AuthGuard as NestAuthGuard } from '@nestjs/passport';
+
+@Injectable()
+export class AuthGuard extends NestAuthGuard('<%= authenticationType %>') {}
+<%_ } _%>

package/generators/node-server/templates/server/src/auth/guards/oauth2-login.guard.ts.ejs

@@ -0,0 +1,6 @@
+import { Injectable } from '@nestjs/common';
+import { AuthGuard as NestAuthGuard } from '@nestjs/passport';
+
+/** The login with the identity provider (authorization code with PKCE), on the login routes only. */
+@Injectable()
+export class OAuth2LoginGuard extends NestAuthGuard('oauth2') {}