@mshima/generator-jhipster-nodejs 0.0.0-stage → 0.0.2

package/generators/node-server/templates/server/src/auth/guards/auth.guard.ts.ejs

@@ -0,0 +1,50 @@
+<%_ if (authenticationType === 'oauth2') { _%>
+import { ExecutionContext, Injectable, UnauthorizedException } from '@nestjs/common';
+import { AuthGuard as NestAuthGuard } from '@nestjs/passport';
+
+/**
+ * The authentication of the API, like JHipster Spring Boot with OAuth2: the session of the login (the clients of the
+ * application, their unsafe requests checked by the CsrfMiddleware), else an access token of the identity provider as
+ * bearer token (oauth2ResourceServer), else 401.
+ */
+@Injectable()
+export class AuthGuard extends NestAuthGuard('oauth2-bearer') {
+  canActivate(context: ExecutionContext): any {
+    const request = context.switchToHttp().getRequest();
+
+    if (request.session?.user) {
+      request.user = request.session.user;
+      return true;
+    }
+    // The authentication scheme is case insensitive, like HTTP gives it.
+    if (!/^bearer\s+\S/i.test(request.headers.authorization ?? '')) {
+      throw new UnauthorizedException();
+    }
+    return super.canActivate(context);
+  }
+}
+<%_ } else if (authenticationTypeSession) { _%>
+import { CanActivate, ExecutionContext, Injectable, UnauthorizedException } from '@nestjs/common';
+
+/**
+ * The authentication of the API, like JHipster Spring Boot with sessions: the user of the session of the login (its unsafe
+ * requests checked by the CsrfMiddleware), else 401.
+ */
+@Injectable()
+export class AuthGuard implements CanActivate {
+  canActivate(context: ExecutionContext): boolean {
+    const request = context.switchToHttp().getRequest();
+    if (!request.session?.user) {
+      throw new UnauthorizedException();
+    }
+    request.user = request.session.user;
+    return true;
+  }
+}
+<%_ } else { _%>
+import { Injectable } from '@nestjs/common';
+import { AuthGuard as NestAuthGuard } from '@nestjs/passport';
+
+@Injectable()
+export class AuthGuard extends NestAuthGuard('<%= authenticationType %>') {}
+<%_ } _%>

package/generators/node-server/templates/server/src/auth/guards/oauth2-login.guard.ts.ejs

@@ -0,0 +1,6 @@
+import { Injectable } from '@nestjs/common';
+import { AuthGuard as NestAuthGuard } from '@nestjs/passport';
+
+/** The login with the identity provider (authorization code with PKCE), on the login routes only. */
+@Injectable()
+export class OAuth2LoginGuard extends NestAuthGuard('oauth2') {}

package/generators/node-server/templates/server/src/auth/guards/roles.guard.ts.ejs

@@ -0,0 +1,25 @@
+import { CanActivate, ExecutionContext, Injectable } from '@nestjs/common';
+import { Reflector } from '@nestjs/core';
+import { <%= userLoginVmClass%> } from '../../users/dto/user.dto.ts';
+
+/**
+ * Allows a request when its user has one of the roles of the route, the @Roles of the handler, else the ones of its
+ * controller class, like a @PreAuthorize of JHipster Spring Boot on a method or on its class.
+ */
+@Injectable()
+export class RolesGuard implements CanActivate {
+  constructor(private readonly reflector: Reflector) {}
+
+  canActivate(context: ExecutionContext): boolean {
+    const roles = this.reflector.getAllAndOverride<string[] | undefined>('roles', [context.getHandler(), context.getClass()]);
+
+    if (!roles) {
+      return true;
+    }
+
+    const request = context.switchToHttp().getRequest();
+    const user = request.user as <%= userLoginVmClass%>;
+
+    return !!user?.authorities?.some(role => roles.includes(role));
+  }
+}

package/generators/node-server/templates/server/src/auth/index.ts.ejs

@@ -0,0 +1,8 @@
+export * from './guards/auth.guard.ts';
+export * from './guards/roles.guard.ts';
+export * from './decorators/roles.decorator.ts';
+export * from './decorators/auth-user.decorator.ts';
+<%_ if (generateUserManagement) { _%>
+export * from './password-util.ts';
+<%_ } _%>
+export * from './role-type.ts';

package/generators/node-server/templates/server/src/auth/jwt.config.spec.ts.ejs

@@ -0,0 +1,22 @@
+import { describe, expect, it } from 'vitest';
+import { ConfigService } from '@nestjs/config';
+import { JWT_MIN_KEY_BYTES, jwtSecretKey } from './jwt.config.ts';
+
+const configServiceOf = (secret: string): ConfigService =>
+  ({ getOrThrow: () => secret }) as unknown as ConfigService;
+
+describe('JWT key', () => {
+  it('is the base64 decoded secret', () => {
+    const key = Buffer.alloc(JWT_MIN_KEY_BYTES, 1);
+    expect(jwtSecretKey(configServiceOf(key.toString('base64')))).toEqual(key);
+  });
+
+  it('refuses a secret shorter than 512 bits, like the HS512 key of JHipster Spring Boot', () => {
+    const secret = Buffer.alloc(JWT_MIN_KEY_BYTES - 1, 1).toString('base64');
+    expect(() => jwtSecretKey(configServiceOf(secret))).toThrow(/too short: 504 bits/);
+  });
+
+  it('refuses a missing secret', () => {
+    expect(() => jwtSecretKey(configServiceOf(''))).toThrow(/is not set/);
+  });
+});

package/generators/node-server/templates/server/src/auth/jwt.config.ts.ejs

@@ -0,0 +1,29 @@
+import { ConfigService } from '@nestjs/config';
+
+/**
+ * The algorithm and the key of the JWTs, like JHipster Spring Boot: HS512, with the base64 decoded
+ * `jhipster.security.authentication.jwt.base64-secret` as the key, so the applications of a microservice architecture
+ * sharing that secret (a Spring Boot gateway and NodeJS microservices, or the reverse) accept each other's tokens.
+ */
+export const JWT_ALGORITHM = 'HS512';
+/** The minimum length of the key of HS512, 512 bits. */
+export const JWT_MIN_KEY_BYTES = 64;
+
+export function jwtSecretKey(configService: ConfigService): Buffer {
+  const secret = configService.getOrThrow<string>('jhipster.security.authentication.jwt.base64-secret');
+  if (!secret) {
+    // Like JHipster Spring Boot, the application does not start without a secret: the secret-samples profile has a
+    // sample for development, production sets its own.
+    throw new Error(
+      'jhipster.security.authentication.jwt.base64-secret is not set: set the JHIPSTER_SECURITY_AUTHENTICATION_JWT_BASE64SECRET environment variable, or activate the secret-samples profile',
+    );
+  }
+  const key = Buffer.from(secret, 'base64');
+  if (key.length < JWT_MIN_KEY_BYTES) {
+    // Like the HS512 key of JHipster Spring Boot (its JWT encoder refuses a shorter one).
+    throw new Error(
+      `jhipster.security.authentication.jwt.base64-secret is too short: ${key.length * 8} bits, HS512 needs at least ${JWT_MIN_KEY_BYTES * 8} bits (a base64 secret of ${JWT_MIN_KEY_BYTES} bytes or more)`,
+    );
+  }
+  return key;
+}

package/generators/node-server/templates/server/src/auth/oauth2.authorities.spec.ts.ejs

@@ -0,0 +1,24 @@
+import { describe, expect, it } from 'vitest';
+import { CLAIMS_NAMESPACE, extractAuthoritiesFromClaims } from './oauth2.authorities.ts';
+
+describe('OAuth2 authorities', () => {
+  it('should read the groups claim', () => {
+    expect(extractAuthoritiesFromClaims({ groups: ['ROLE_ADMIN', 'ROLE_USER'] })).toEqual(['ROLE_ADMIN', 'ROLE_USER']);
+  });
+
+  it('should read the roles claim', () => {
+    expect(extractAuthoritiesFromClaims({ roles: ['ROLE_USER'] })).toEqual(['ROLE_USER']);
+  });
+
+  it('should read the namespaced roles claim', () => {
+    expect(extractAuthoritiesFromClaims({ [`${CLAIMS_NAMESPACE}roles`]: ['ROLE_ADMIN'] })).toEqual(['ROLE_ADMIN']);
+  });
+
+  it('should keep only the ROLE_ values', () => {
+    expect(extractAuthoritiesFromClaims({ roles: ['ROLE_USER', 'offline_access', 'uma_authorization'] })).toEqual(['ROLE_USER']);
+  });
+
+  it('should give no authority without roles', () => {
+    expect(extractAuthoritiesFromClaims({ preferred_username: 'user' })).toEqual([]);
+  });
+});

package/generators/node-server/templates/server/src/auth/oauth2.authorities.ts.ejs

@@ -0,0 +1,33 @@
+import { <%= userLoginVmClass %> } from '../users/dto/user.dto.ts';
+
+// Claim with the roles when the provider namespaces it, like Auth0.
+export const CLAIMS_NAMESPACE = 'https://www.jhipster.tech/';
+
+/**
+ * The authorities of an OIDC user, from the claims of its token, as JHipster's Spring Boot application reads them:
+ * the "groups" claim, else "roles", else the namespaced "roles", keeping the ROLE_ ones.
+ */
+export function extractAuthoritiesFromClaims(claims: Record<string, unknown>): string[] {
+  const roles = claims.groups ?? claims.roles ?? claims[`${CLAIMS_NAMESPACE}roles`] ?? [];
+  return Array.isArray(roles) ? roles.filter((role): role is string => typeof role === 'string' && role.startsWith('ROLE_')) : [];
+}
+
+/**
+ * The user of the claims of an OIDC token (the ID token over the access token at the login, the access token of a bearer
+ * request), like the OIDC user of JHipster Spring Boot: the login of preferred_username (else sub) and the mail in lower
+ * case, the names, the language and the authorities.
+ */
+export function oidcUserOfClaims(claims: Record<string, any>): <%= userLoginVmClass %> {
+  const login = String(claims.preferred_username ?? claims.sub).toLowerCase();
+  // Without a password, nor a mail when the token has none (the login of the user saved has its fallback).
+  return Object.assign(new <%= userLoginVmClass %>(), {
+    login,
+    firstName: claims.given_name,
+    lastName: claims.family_name,
+    email: claims.email ? String(claims.email).toLowerCase() : undefined,
+    imageUrl: claims.picture ?? '',
+    activated: true,
+    langKey: typeof claims.locale === 'string' ? claims.locale.split(/[-_]/)[0] : 'en',
+    authorities: extractAuthoritiesFromClaims(claims),
+  });
+}

package/generators/node-server/templates/server/src/auth/oauth2.config.ts.ejs

@@ -0,0 +1,51 @@
+import { Injectable } from '@nestjs/common';
+import { ConfigService } from '@nestjs/config';
+
+import type { ApplicationConfig } from '../application-config.ts';
+
+const openIdProtocol = 'protocol/openid-connect';
+
+/**
+ * The endpoints of the OpenID Connect provider (jhipster.security.oauth2.client.provider.oidc.issuer-uri), Keycloak or
+ * Okta: the authorization, token and logout URLs, and the callback of the application.
+ */
+@Injectable()
+export class OAuth2Config {
+  readonly authorizationURL: string;
+  readonly tokenURL: string;
+  readonly logoutUrl: string;
+  readonly callbackURL: string;
+  /** The keys of the issuer (JWKS), the bearer tokens are verified with. */
+  readonly jwksUri: string;
+  /** The issuer of the tokens, the configured one (the browser's), not the one the application reaches from a container. */
+  readonly issuer: string;
+  /** The audiences of the access tokens the API accepts as bearer tokens, like JHipster Spring Boot. */
+  readonly audience: string[];
+  readonly isOktaProvider: boolean;
+
+  constructor(configService: ConfigService<ApplicationConfig, true>) {
+    const issuerUri = configService.get('jhipster.security.oauth2.client.provider.oidc.issuer-uri', { infer: true });
+    // The issuer the application reaches from a container (docker compose), the browser keeps the configured one.
+    const dockerIssuerUri = process.env.NODE_CLIENT_PROVIDER_OIDC_ISSUER_URI || issuerUri;
+    // Relative, like the {baseUrl}/login/oauth2/code/oidc of JHipster Spring Boot: the strategy resolves it against the
+    // URL of the request (the X-Forwarded-Proto of a proxy included), the URL the browser reaches the application at.
+    this.callbackURL = '/login/oauth2/code/oidc';
+    this.isOktaProvider = issuerUri.includes('okta');
+    this.issuer = issuerUri;
+    this.audience = String(configService.get('jhipster.security.oauth2.audience', { infer: true }) ?? '')
+      .split(',')
+      .map(audience => audience.trim())
+      .filter(Boolean);
+    if (this.isOktaProvider) {
+      this.authorizationURL = `${issuerUri}/v1/authorize`;
+      this.tokenURL = `${issuerUri}/v1/token`;
+      this.logoutUrl = `${issuerUri}/v1/logout`;
+      this.jwksUri = `${dockerIssuerUri}/v1/keys`;
+    } else {
+      this.authorizationURL = `${issuerUri}/${openIdProtocol}/auth`;
+      this.tokenURL = `${dockerIssuerUri}/${openIdProtocol}/token`;
+      this.logoutUrl = `${issuerUri}/${openIdProtocol}/logout`;
+      this.jwksUri = `${dockerIssuerUri}/${openIdProtocol}/certs`;
+    }
+  }
+}

package/generators/node-server/templates/server/src/auth/passport.jwt.strategy.ts.ejs

@@ -0,0 +1,45 @@
+import { ExtractJwt, Strategy<% if (generateBuiltInUserEntity) { %>, VerifiedCallback<% } %> } from 'passport-jwt';
+import { PassportStrategy } from '@nestjs/passport';
+import { ConfigService } from '@nestjs/config';
+import { Injectable<% if (generateBuiltInUserEntity) { %>, UnauthorizedException<% } %> } from '@nestjs/common';
+import { Payload<% if (!generateBuiltInUserEntity) { %>, payloadAuthorities<% } %> } from './payload.interface.ts';
+import { JWT_ALGORITHM, jwtSecretKey } from './jwt.config.ts';
+<%_ if (generateBuiltInUserEntity) { _%>
+import { AuthService } from './auth.service.ts';
+<%_ } else { _%>
+import { <%= userLoginVmClass %> } from '../users/dto/user.dto.ts';
+<%_ } _%>
+
+@Injectable()
+export class JwtStrategy extends PassportStrategy(Strategy) {
+<%_ if (generateBuiltInUserEntity) { _%>
+  constructor(private readonly authService: AuthService, configService: ConfigService) {
+<%_ } else { _%>
+  constructor(configService: ConfigService) {
+<%_ } _%>
+    super({
+      jwtFromRequest: ExtractJwt.fromAuthHeaderAsBearerToken(),
+      ignoreExpiration: false,
+      secretOrKey: jwtSecretKey(configService),
+      algorithms: [JWT_ALGORITHM],
+    });
+  }
+
+<%_ if (generateBuiltInUserEntity) { _%>
+ async validate(payload: Payload, done: VerifiedCallback): Promise<any> {
+    const user = await this.authService.validateUser(payload);
+    if (!user) {
+      return done(new UnauthorizedException({ message: 'user does not exist' }), false);
+    }
+
+    return done(null, user);
+  }
+<%_ } else { _%>
+  /**
+   * Without built-in User, the user is the one of the token, signed by the application issuing it (the gateway).
+   */
+  validate(payload: Payload): <%= userLoginVmClass %> {
+    return Object.assign(new <%= userLoginVmClass %>(), { login: payload.sub, authorities: payloadAuthorities(payload) });
+  }
+<%_ } _%>
+}

package/generators/node-server/templates/server/src/auth/passport.oauth2-bearer.strategy.ts.ejs

@@ -0,0 +1,32 @@
+import { Injectable } from '@nestjs/common';
+import { PassportStrategy } from '@nestjs/passport';
+import { passportJwtSecret } from 'jwks-rsa';
+import { ExtractJwt, Strategy } from 'passport-jwt';
+
+import { <%= userLoginVmClass %> } from '../users/dto/user.dto.ts';
+import { oidcUserOfClaims } from './oauth2.authorities.ts';
+import { OAuth2Config } from './oauth2.config.ts';
+
+/**
+ * The access tokens of the identity provider sent as bearer tokens, like the oauth2ResourceServer of JHipster Spring
+ * Boot: signed by the keys of the issuer (its JWKS), not expired, the user and its authorities from their claims. A
+ * gateway relays them to its microservices, the mobile clients send them.
+ */
+@Injectable()
+export class Oauth2BearerStrategy extends PassportStrategy(Strategy, 'oauth2-bearer') {
+  constructor(oauth2Config: OAuth2Config) {
+    super({
+      jwtFromRequest: ExtractJwt.fromAuthHeaderAsBearerToken(),
+      ignoreExpiration: false,
+      secretOrKeyProvider: passportJwtSecret({ jwksUri: oauth2Config.jwksUri, cache: true, rateLimit: true }),
+      algorithms: ['RS256'],
+      // Issued by the identity provider for this API, like the issuer and audience validators of JHipster Spring Boot.
+      issuer: oauth2Config.issuer,
+      audience: oauth2Config.audience,
+    });
+  }
+
+  validate(claims: Record<string, any>): <%= userLoginVmClass %> {
+    return oidcUserOfClaims(claims);
+  }
+}

package/generators/node-server/templates/server/src/auth/passport.oauth2.strategy.spec.ts.ejs

@@ -0,0 +1,27 @@
+import { describe, expect, it, vi } from 'vitest';
+import { Oauth2Strategy } from './passport.oauth2.strategy.ts';
+
+const token = (claims: object): string => `${Buffer.from('{"alg":"none"}').toString('base64url')}.${Buffer.from(JSON.stringify(claims)).toString('base64url')}.`;
+
+describe('OAuth2 login strategy', () => {
+  it('should build the user of the ID token of the token response, which passport-oauth2 gives to the verify', async () => {
+    const authService = { findUserOrSave: vi.fn() };
+    const configService = { get: () => 'value' };
+    const oauth2Config = { authorizationURL: 'http://localhost/auth', tokenURL: 'http://localhost/token', callbackURL: 'http://localhost/callback' };
+    const strategy: any = new Oauth2Strategy(authService as any, configService as any, oauth2Config as any);
+    // passport-oauth2 gives the params of the token response with a verify of 5 parameters only (4 without them).
+    expect(strategy._verify).toHaveLength(5);
+
+    const idToken = token({ sub: 'abc', preferred_username: 'User', email: 'User@Example.com', groups: ['ROLE_USER'] });
+    const user = await new Promise((resolve, reject) =>
+      strategy._verify(token({ sub: 'abc' }), 'refresh', { id_token: idToken }, undefined, (error: Error | null, result: unknown) =>
+        error ? reject(error) : resolve(result),
+      ),
+    );
+
+    expect(user).toMatchObject({ login: 'user', email: 'user@example.com', authorities: ['ROLE_USER'], idToken });
+<%_ if (generateBuiltInUserEntity) { _%>
+    expect(authService.findUserOrSave).toHaveBeenCalledWith(expect.objectContaining({ login: 'user' }));
+<%_ } _%>
+  });
+});

package/generators/node-server/templates/server/src/auth/passport.oauth2.strategy.ts.ejs

@@ -0,0 +1,44 @@
+import { jwtDecode } from 'jwt-decode';
+import Strategy from 'passport-oauth2';
+import { PassportStrategy } from '@nestjs/passport';
+import { Injectable, Logger } from '@nestjs/common';
+import { ConfigService } from '@nestjs/config';
+import { AuthService } from './auth.service.ts';
+import { <%= userLoginVmClass %> } from '../users/dto/user.dto.ts';
+import { OAuth2Config } from './oauth2.config.ts';
+import { oidcUserOfClaims } from './oauth2.authorities.ts';
+
+@Injectable()
+export class Oauth2Strategy extends PassportStrategy(Strategy, undefined, true) {
+    logger = new Logger('oauth2');
+
+    constructor(private readonly authService: AuthService, configService: ConfigService, oauth2Config: OAuth2Config) {
+        super({
+            authorizationURL: oauth2Config.authorizationURL,
+            tokenURL: oauth2Config.tokenURL,
+            clientID: `${configService.get('jhipster.security.oauth2.client.registration.oidc.client-id')}`,
+            clientSecret: `${configService.get('jhipster.security.oauth2.client.registration.oidc.client-secret')}`,
+            callbackURL: oauth2Config.callbackURL,
+            proxy: true,
+            scope: 'openid profile',
+            state: true,
+            pkce: true,
+            // The user comes from the tokens of the response (validate), not from a profile request.
+            skipUserProfile: true,
+        });
+    }
+
+    /**
+     * The user of the login, like the OIDC user of JHipster Spring Boot: the claims of the ID token over the ones of the
+     * access token (the access token of some providers, like Okta, has no login nor mail). With its 4 parameters, passport-oauth2
+     * gives it the params of the token response (the ID token): with 3, it gives the profile instead, undefined here.
+     */
+    <%- generateBuiltInUserEntity ? 'async ' : '' %>validate(accessToken: string, refreshToken: string, params: any, _profile: unknown): <%- generateBuiltInUserEntity ? `Promise<${userLoginVmClass} & { idToken?: string }>` : `${userLoginVmClass} & { idToken?: string }` %> {
+        const user = oidcUserOfClaims({ ...jwtDecode(accessToken), ...(params.id_token ? jwtDecode(params.id_token) : {}) });
+<%_ if (generateBuiltInUserEntity) { _%>
+        await this.authService.findUserOrSave(user);
+<%_ } _%>
+        // The ID token of the session, for the logout.
+        return Object.assign(user, { idToken: params.id_token });
+    }
+}

package/generators/node-server/templates/server/src/auth/password-util.ts.ejs

@@ -0,0 +1,10 @@
+import { compare, hash } from 'bcrypt';
+
+// Asynchronous: bcrypt does not block the event loop of the other requests.
+export const encodePassword = async (password: string, rounds: number): Promise<string> => {
+  return hash(password, rounds);
+};
+
+export const comparePassword = async (password: string, hash: string): Promise<boolean> => {
+  return compare(password, hash);
+};

package/generators/node-server/templates/server/src/auth/password.service.ts.ejs

@@ -0,0 +1,34 @@
+import { Injectable } from '@nestjs/common';
+import { ConfigService } from '@nestjs/config';
+
+import type { ApplicationConfig } from '../application-config.ts';
+import { comparePassword, encodePassword } from './password-util.ts';
+
+/**
+ * The passwords of the users, like the PasswordEncoder of JHipster Spring Boot: bcrypt, with the rounds of
+ * <%= nodejsPasswordRoundsProperty %>.
+ */
+@Injectable()
+export class PasswordService {
+  private readonly rounds: number;
+
+  constructor(configService: ConfigService<ApplicationConfig, true>) {
+    this.rounds = Number(configService.get('<%= nodejsPasswordRoundsProperty %>', { infer: true }));
+  }
+
+  encode(password: string): Promise<string> {
+    return encodePassword(password, this.rounds);
+  }
+
+  matches(password: string, hash: string): Promise<boolean> {
+    return comparePassword(password, hash);
+  }
+
+  /** The user with its password encoded, when it has one. */
+  async transform<const T extends { password?: string }>(user: T): Promise<T> {
+    if (user.password) {
+      user.password = await this.encode(user.password);
+    }
+    return user;
+  }
+}

package/generators/node-server/templates/server/src/auth/payload.interface.ts.ejs

@@ -0,0 +1,14 @@
+/**
+ * The claims of a JWT, like the tokens of JHipster Spring Boot: the login as the subject, and the authorities separated
+ * by spaces.
+ */
+export interface Payload {
+  sub: string;
+  auth: string;
+  userId?: <%= databaseType === 'sql' ? 'number' : 'string' %>;
+}
+
+/** The authorities of the `auth` claim. */
+export function payloadAuthorities(payload: Payload): string[] {
+  return payload.auth ? payload.auth.split(/[\s,]+/).filter(Boolean) : [];
+}

package/generators/node-server/templates/server/src/auth/role-type.ts.ejs

@@ -0,0 +1,7 @@
+'use strict';
+
+export enum RoleType {
+  USER = 'ROLE_USER',
+  ADMIN = 'ROLE_ADMIN',
+  ANONYMOUS = 'ROLE_ANONYMOUS',
+}

package/generators/node-server/templates/server/src/auth/session-user.middleware.ts.ejs

@@ -0,0 +1,33 @@
+import { Injectable, NestMiddleware } from '@nestjs/common';
+import { NextFunction, Request, Response } from 'express';
+import { <%= user.dtoClass %> } from '../users/dto/user.dto.ts';
+import { UserService } from '../users/user.service.ts';
+
+/** The user a session keeps: without its secrets, which stay in the database. */
+export function sessionUser(user: <%= user.dtoClass %>): Omit<<%= user.dtoClass %>, 'password' | 'activationKey' | 'resetKey'> {
+  const { password: _password, activationKey: _activationKey, resetKey: _resetKey, ...kept } = user;
+  return kept;
+}
+
+/**
+ * The user of a logged session, read again from the database at every request, like the user of a JWT token and the
+ * remember-me login of JHipster Spring Boot: a user removed or deactivated is logged out at its next request (its session
+ * lasting up to 31 days with remember-me), the authorities given or removed apply at once.
+ */
+@Injectable()
+export class SessionUserMiddleware implements NestMiddleware {
+  constructor(private readonly userService: UserService) {}
+
+  async use(req: Request, res: Response, next: NextFunction): Promise<void> {
+    const session = req.session as any;
+    if (session?.user) {
+      const user = await this.userService.findByFields({ where: { login: session.user.login } });
+      if (user?.activated) {
+        session.user = sessionUser(user);
+      } else {
+        await new Promise<void>(resolve => session.destroy(() => resolve()));
+      }
+    }
+    next();
+  }
+}

package/generators/node-server/templates/server/src/auth/session.entity.ts.ejs

@@ -0,0 +1,36 @@
+import { Column, Entity, Index, <%_ if (databaseTypeMongodb) { _%>ObjectIdColumn<%_ } else { _%>PrimaryColumn<%_ } _%> } from 'typeorm';
+
+/**
+ * A session of the server, kept in the database of the application by the SessionStore: the sessions outlive a restart
+ * and are shared by the instances of the application, like the HTTP sessions of a cluster of JHipster Spring Boot with
+ * Spring Session, and the remember-me logins outlive a restart like its persistent tokens.
+ */
+@Entity('<%- jhiTablePrefix %>_session')
+export class Session {
+<%_ if (databaseTypeMongodb) { _%>
+  @ObjectIdColumn({ name: '_id' })
+  _id?: string;
+
+  /** The id of the session, the one of its cookie. */
+  @Column({ unique: true })
+  sid!: string;
+<%_ } else { _%>
+  /** The id of the session, the one of its cookie. */
+  @PrimaryColumn()
+  sid!: string;
+<%_ } _%>
+
+  /** The login of the user of the session, its sessions listed by the sessions page. */
+  @Index()
+  @Column({ nullable: true })
+  login?: string;
+
+  /** The end of the session, extended by its requests. */
+  @Index()
+  @Column()
+  expires!: Date;
+
+  /** The data of the session, as JSON. */
+  @Column('text')
+  data!: string;
+}

package/generators/node-server/templates/server/src/auth/session.store.spec.ts.ejs

@@ -0,0 +1,99 @@
+import { beforeEach, describe, expect, it } from 'vitest';
+import { promisify } from 'node:util';
+import { Session } from './session.entity.ts';
+import { SessionStore } from './session.store.ts';
+
+/** The threshold of a criterion on the expiry, a LessThan of TypeORM or a $lt of MongoDB. */
+const lessThan = (criterion: any): number => new Date(criterion.value ?? criterion.$lt).getTime();
+
+/** A repository of the sessions in memory, with the queries the store makes. */
+const repository = (rows: Session[]): any => ({
+  findOne: ({ where }: any) => Promise.resolve(rows.find(row => row.sid === where.sid) ?? null),
+  find: (options?: any) => Promise.resolve(rows.filter(row => !options?.where?.login || row.login === options.where.login)),
+  save: (entity: Session) => {
+    const index = rows.findIndex(row => row.sid === entity.sid);
+    rows.splice(index < 0 ? rows.length : index, index < 0 ? 0 : 1, { ...entity });
+    return Promise.resolve(entity);
+  },
+  update: ({ sid }: any, values: Partial<Session>) => Promise.resolve(Object.assign(rows.find(row => row.sid === sid) ?? {}, values)),
+  delete: (criteria: any) => {
+    const kept = rows.filter(row => (criteria.sid ? row.sid !== criteria.sid : row.expires.getTime() >= lessThan(criteria.expires)));
+    rows.splice(0, rows.length, ...kept);
+    return Promise.resolve();
+  },
+});
+
+/** All the sessions of the store, by their ids. */
+const allOf = (store: SessionStore): Promise<Record<string, unknown>> =>
+  new Promise((resolve, reject) => store.all((error, sessions) => (error ? reject(error as Error) : resolve(sessions ?? {}))));
+
+const sessionData = (login: string | undefined, expires: Date): any => ({ cookie: { expires: expires.toISOString() }, ...(login ? { user: { login } } : {}) });
+
+describe('SessionStore', () => {
+  let rows: Session[];
+  let store: SessionStore;
+  const inOneHour = new Date(Date.now() + 60 * 60 * 1000);
+  const anHourAgo = new Date(Date.now() - 60 * 60 * 1000);
+
+  beforeEach(() => {
+    rows = [];
+    store = new SessionStore(repository(rows));
+  });
+
+  it('saves a session with the login of its user and the expiry of its cookie, and gives it back', async () => {
+    await promisify(store.set.bind(store))('s1', sessionData('user', inOneHour));
+    await promisify(store.set.bind(store))('s1', { ...sessionData('user', inOneHour), series: 'a' });
+    expect(rows).toHaveLength(1);
+    expect(rows[0]).toMatchObject({ sid: 's1', login: 'user', expires: inOneHour });
+    expect(await promisify(store.get.bind(store))('s1')).toMatchObject({ user: { login: 'user' }, series: 'a' });
+  });
+
+  it('gives no session for an expired or unknown id', async () => {
+    rows.push({ sid: 'old', login: 'user', expires: anHourAgo, data: '{}' });
+    expect(await promisify(store.get.bind(store))('old')).toBeNull();
+    expect(await promisify(store.get.bind(store))('unknown')).toBeNull();
+  });
+
+  it('extends a session its request did not change', async () => {
+    rows.push({ sid: 's1', login: 'user', expires: anHourAgo, data: '{}' });
+    await promisify(store.touch.bind(store))('s1', sessionData('user', inOneHour));
+    expect(rows[0].expires).toEqual(inOneHour);
+  });
+
+  it('ends a session', async () => {
+    rows.push({ sid: 's1', login: 'user', expires: inOneHour, data: '{}' });
+    await promisify(store.destroy.bind(store))('s1');
+    expect(rows).toHaveLength(0);
+  });
+
+  it('lists the sessions not expired, of every user and of a user', async () => {
+    rows.push(
+      { sid: 's1', login: 'user', expires: inOneHour, data: '{"a":1}' },
+      { sid: 's2', login: 'other', expires: inOneHour, data: '{}' },
+      { sid: 's3', login: 'user', expires: anHourAgo, data: '{}' },
+    );
+    expect(Object.keys(await allOf(store))).toEqual(['s1', 's2']);
+    expect(await store.sessionsOf('user')).toEqual([{ sid: 's1', data: { a: 1 } }]);
+  });
+
+  it('waits for the operations in progress before the database is closed, like a touch ending a response', async () => {
+    let finish!: () => void;
+    const slow = new SessionStore({ ...repository(rows), update: () => new Promise<void>(resolve => (finish = resolve)) });
+    let touched = false;
+    slow.touch('s1', sessionData('user', inOneHour), () => (touched = true));
+    let closed = false;
+    const closing = slow.onModuleDestroy().then(() => (closed = true));
+    await Promise.resolve();
+    expect(closed).toBe(false);
+    finish();
+    await closing;
+    expect(touched).toBe(true);
+    expect(closed).toBe(true);
+  });
+
+  it('removes the expired sessions', async () => {
+    rows.push({ sid: 's1', login: 'user', expires: inOneHour, data: '{}' }, { sid: 's2', login: 'user', expires: anHourAgo, data: '{}' });
+    await store.prune();
+    expect(rows.map(row => row.sid)).toEqual(['s1']);
+  });
+});