@punks/cli 0.1.16 → 1.0.0

package/dist/skills/frameworks/nestjs/nestjs-best-practices/rules/security-use-guards.md

@@ -0,0 +1,135 @@
+---
+title: Use Guards for Authentication and Authorization
+impact: HIGH
+impactDescription: Enforces access control before handlers execute
+tags: security, guards, authentication, authorization
+---
+
+## Use Guards for Authentication and Authorization
+
+Guards determine whether a request should be handled based on authentication state, roles, permissions, or other conditions. They run after middleware but before pipes and interceptors, making them ideal for access control. Use guards instead of manual checks in controllers.
+
+**Incorrect (manual auth checks in every handler):**
+
+```typescript
+// Manual auth checks in every handler
+@Controller('admin')
+export class AdminController {
+  @Get('users')
+  async getUsers(@Request() req) {
+    if (!req.user) {
+      throw new UnauthorizedException();
+    }
+    if (!req.user.roles.includes('admin')) {
+      throw new ForbiddenException();
+    }
+    return this.adminService.getUsers();
+  }
+
+  @Delete('users/:id')
+  async deleteUser(@Request() req, @Param('id') id: string) {
+    if (!req.user) {
+      throw new UnauthorizedException();
+    }
+    if (!req.user.roles.includes('admin')) {
+      throw new ForbiddenException();
+    }
+    return this.adminService.deleteUser(id);
+  }
+}
+```
+
+**Correct (guards with declarative decorators):**
+
+```typescript
+// JWT Auth Guard
+@Injectable()
+export class JwtAuthGuard implements CanActivate {
+  constructor(
+    private jwtService: JwtService,
+    private reflector: Reflector,
+  ) {}
+
+  async canActivate(context: ExecutionContext): Promise<boolean> {
+    // Check for @Public() decorator
+    const isPublic = this.reflector.getAllAndOverride<boolean>('isPublic', [
+      context.getHandler(),
+      context.getClass(),
+    ]);
+    if (isPublic) return true;
+
+    const request = context.switchToHttp().getRequest();
+    const token = this.extractToken(request);
+
+    if (!token) {
+      throw new UnauthorizedException('No token provided');
+    }
+
+    try {
+      request.user = await this.jwtService.verifyAsync(token);
+      return true;
+    } catch {
+      throw new UnauthorizedException('Invalid token');
+    }
+  }
+
+  private extractToken(request: Request): string | undefined {
+    const [type, token] = request.headers.authorization?.split(' ') ?? [];
+    return type === 'Bearer' ? token : undefined;
+  }
+}
+
+// Roles Guard
+@Injectable()
+export class RolesGuard implements CanActivate {
+  constructor(private reflector: Reflector) {}
+
+  canActivate(context: ExecutionContext): boolean {
+    const requiredRoles = this.reflector.getAllAndOverride<Role[]>('roles', [
+      context.getHandler(),
+      context.getClass(),
+    ]);
+
+    if (!requiredRoles) return true;
+
+    const { user } = context.switchToHttp().getRequest();
+    return requiredRoles.some((role) => user.roles?.includes(role));
+  }
+}
+
+// Decorators
+export const Public = () => SetMetadata('isPublic', true);
+export const Roles = (...roles: Role[]) => SetMetadata('roles', roles);
+
+// Register guards globally
+@Module({
+  providers: [
+    { provide: APP_GUARD, useClass: JwtAuthGuard },
+    { provide: APP_GUARD, useClass: RolesGuard },
+  ],
+})
+export class AppModule {}
+
+// Clean controller
+@Controller('admin')
+@Roles(Role.Admin) // Applied to all routes
+export class AdminController {
+  @Get('users')
+  getUsers(): Promise<User[]> {
+    return this.adminService.getUsers();
+  }
+
+  @Delete('users/:id')
+  deleteUser(@Param('id') id: string): Promise<void> {
+    return this.adminService.deleteUser(id);
+  }
+
+  @Public() // Override: no auth required
+  @Get('health')
+  health() {
+    return { status: 'ok' };
+  }
+}
+```
+
+Reference: [NestJS Guards](https://docs.nestjs.com/guards)

package/dist/skills/frameworks/nestjs/nestjs-best-practices/rules/security-validate-all-input.md

@@ -0,0 +1,150 @@
+---
+title: Validate All Input with DTOs and Pipes
+impact: HIGH
+impactDescription: First line of defense against attacks
+tags: security, validation, dto, pipes
+---
+
+## Validate All Input with DTOs and Pipes
+
+Always validate incoming data using class-validator decorators on DTOs and the global ValidationPipe. Never trust user input. Validate all request bodies, query parameters, and route parameters before processing.
+
+**Incorrect (trust raw input without validation):**
+
+```typescript
+// Trust raw input without validation
+@Controller('users')
+export class UsersController {
+  @Post()
+  create(@Body() body: any) {
+    // body could contain anything - SQL injection, XSS, etc.
+    return this.usersService.create(body);
+  }
+
+  @Get()
+  findAll(@Query() query: any) {
+    // query.limit could be "'; DROP TABLE users; --"
+    return this.usersService.findAll(query.limit);
+  }
+}
+
+// DTOs without validation decorators
+export class CreateUserDto {
+  name: string;    // No validation
+  email: string;   // Could be "not-an-email"
+  age: number;     // Could be "abc" or -999
+}
+```
+
+**Correct (validated DTOs with global ValidationPipe):**
+
+```typescript
+// Enable ValidationPipe globally in main.ts
+async function bootstrap() {
+  const app = await NestFactory.create(AppModule);
+
+  app.useGlobalPipes(
+    new ValidationPipe({
+      whitelist: true,              // Strip unknown properties
+      forbidNonWhitelisted: true,   // Throw on unknown properties
+      transform: true,              // Auto-transform to DTO types
+      transformOptions: {
+        enableImplicitConversion: true,
+      },
+    }),
+  );
+
+  await app.listen(3000);
+}
+
+// Create well-validated DTOs
+import {
+  IsString,
+  IsEmail,
+  IsInt,
+  Min,
+  Max,
+  IsOptional,
+  MinLength,
+  MaxLength,
+  Matches,
+  IsNotEmpty,
+} from 'class-validator';
+import { Transform, Type } from 'class-transformer';
+
+export class CreateUserDto {
+  @IsString()
+  @IsNotEmpty()
+  @MinLength(2)
+  @MaxLength(100)
+  @Transform(({ value }) => value?.trim())
+  name: string;
+
+  @IsEmail()
+  @Transform(({ value }) => value?.toLowerCase().trim())
+  email: string;
+
+  @IsInt()
+  @Min(0)
+  @Max(150)
+  age: number;
+
+  @IsString()
+  @MinLength(8)
+  @MaxLength(100)
+  @Matches(/^(?=.*[a-z])(?=.*[A-Z])(?=.*\d)/, {
+    message: 'Password must contain uppercase, lowercase, and number',
+  })
+  password: string;
+}
+
+// Query DTO with defaults and transformation
+export class FindUsersQueryDto {
+  @IsOptional()
+  @IsString()
+  @MaxLength(100)
+  search?: string;
+
+  @IsOptional()
+  @Type(() => Number)
+  @IsInt()
+  @Min(1)
+  @Max(100)
+  limit: number = 20;
+
+  @IsOptional()
+  @Type(() => Number)
+  @IsInt()
+  @Min(0)
+  offset: number = 0;
+}
+
+// Param validation
+export class UserIdParamDto {
+  @IsUUID('4')
+  id: string;
+}
+
+@Controller('users')
+export class UsersController {
+  @Post()
+  create(@Body() dto: CreateUserDto): Promise<User> {
+    // dto is guaranteed to be valid
+    return this.usersService.create(dto);
+  }
+
+  @Get()
+  findAll(@Query() query: FindUsersQueryDto): Promise<User[]> {
+    // query.limit is a number, query.search is sanitized
+    return this.usersService.findAll(query);
+  }
+
+  @Get(':id')
+  findOne(@Param() params: UserIdParamDto): Promise<User> {
+    // params.id is a valid UUID
+    return this.usersService.findById(params.id);
+  }
+}
+```
+
+Reference: [NestJS Validation](https://docs.nestjs.com/techniques/validation)

package/dist/skills/frameworks/nestjs/nestjs-best-practices/rules/test-e2e-supertest.md

@@ -0,0 +1,178 @@
+---
+title: Use Supertest for E2E Testing
+impact: HIGH
+impactDescription: Validates the full request/response cycle
+tags: testing, e2e, supertest, integration
+---
+
+## Use Supertest for E2E Testing
+
+End-to-end tests use Supertest to make real HTTP requests against your NestJS application. They test the full stack including middleware, guards, pipes, and interceptors. E2E tests catch integration issues that unit tests miss.
+
+**Incorrect (no proper E2E setup or teardown):**
+
+```typescript
+// Only unit test controllers
+describe('UsersController', () => {
+  it('should return users', async () => {
+    const service = { findAll: jest.fn().mockResolvedValue([]) };
+    const controller = new UsersController(service as any);
+
+    const result = await controller.findAll();
+
+    expect(result).toEqual([]);
+    // Doesn't test: routes, guards, pipes, serialization
+  });
+});
+
+// E2E tests without proper setup/teardown
+describe('Users API', () => {
+  it('should create user', async () => {
+    const app = await NestFactory.create(AppModule);
+    // No proper initialization
+    // No cleanup after test
+    // Hits real database
+  });
+});
+```
+
+**Correct (proper E2E setup with Supertest):**
+
+```typescript
+// Proper E2E test setup
+import { Test, TestingModule } from '@nestjs/testing';
+import { INestApplication, ValidationPipe } from '@nestjs/common';
+import * as request from 'supertest';
+import { AppModule } from '../src/app.module';
+
+describe('UsersController (e2e)', () => {
+  let app: INestApplication;
+
+  beforeAll(async () => {
+    const moduleFixture: TestingModule = await Test.createTestingModule({
+      imports: [AppModule],
+    }).compile();
+
+    app = moduleFixture.createNestApplication();
+
+    // Apply same config as production
+    app.useGlobalPipes(
+      new ValidationPipe({
+        whitelist: true,
+        transform: true,
+        forbidNonWhitelisted: true,
+      }),
+    );
+
+    await app.init();
+  });
+
+  afterAll(async () => {
+    await app.close();
+  });
+
+  describe('/users (POST)', () => {
+    it('should create a user', () => {
+      return request(app.getHttpServer())
+        .post('/users')
+        .send({ name: 'John', email: 'john@test.com' })
+        .expect(201)
+        .expect((res) => {
+          expect(res.body).toHaveProperty('id');
+          expect(res.body.name).toBe('John');
+          expect(res.body.email).toBe('john@test.com');
+        });
+    });
+
+    it('should return 400 for invalid email', () => {
+      return request(app.getHttpServer())
+        .post('/users')
+        .send({ name: 'John', email: 'invalid-email' })
+        .expect(400)
+        .expect((res) => {
+          expect(res.body.message).toContain('email');
+        });
+    });
+  });
+
+  describe('/users/:id (GET)', () => {
+    it('should return 404 for non-existent user', () => {
+      return request(app.getHttpServer())
+        .get('/users/non-existent-id')
+        .expect(404);
+    });
+  });
+});
+
+// Testing with authentication
+describe('Protected Routes (e2e)', () => {
+  let app: INestApplication;
+  let authToken: string;
+
+  beforeAll(async () => {
+    const moduleFixture = await Test.createTestingModule({
+      imports: [AppModule],
+    }).compile();
+
+    app = moduleFixture.createNestApplication();
+    app.useGlobalPipes(new ValidationPipe({ whitelist: true }));
+    await app.init();
+
+    // Get auth token
+    const loginResponse = await request(app.getHttpServer())
+      .post('/auth/login')
+      .send({ email: 'test@test.com', password: 'password' });
+
+    authToken = loginResponse.body.accessToken;
+  });
+
+  it('should return 401 without token', () => {
+    return request(app.getHttpServer())
+      .get('/users/me')
+      .expect(401);
+  });
+
+  it('should return user profile with valid token', () => {
+    return request(app.getHttpServer())
+      .get('/users/me')
+      .set('Authorization', `Bearer ${authToken}`)
+      .expect(200)
+      .expect((res) => {
+        expect(res.body.email).toBe('test@test.com');
+      });
+  });
+});
+
+// Database isolation for E2E tests
+describe('Orders API (e2e)', () => {
+  let app: INestApplication;
+  let dataSource: DataSource;
+
+  beforeAll(async () => {
+    const moduleFixture = await Test.createTestingModule({
+      imports: [
+        ConfigModule.forRoot({
+          envFilePath: '.env.test', // Test database config
+        }),
+        AppModule,
+      ],
+    }).compile();
+
+    app = moduleFixture.createNestApplication();
+    dataSource = moduleFixture.get(DataSource);
+    await app.init();
+  });
+
+  beforeEach(async () => {
+    // Clean database between tests
+    await dataSource.synchronize(true);
+  });
+
+  afterAll(async () => {
+    await dataSource.destroy();
+    await app.close();
+  });
+});
+```
+
+Reference: [NestJS E2E Testing](https://docs.nestjs.com/fundamentals/testing#end-to-end-testing)

package/dist/skills/frameworks/nestjs/nestjs-best-practices/rules/test-mock-external-services.md

@@ -0,0 +1,179 @@
+---
+title: Mock External Services in Tests
+impact: HIGH
+impactDescription: Ensures fast, reliable, deterministic tests
+tags: testing, mocking, external-services, jest
+---
+
+## Mock External Services in Tests
+
+Never call real external services (APIs, databases, message queues) in unit tests. Mock them to ensure tests are fast, deterministic, and don't incur costs. Use realistic mock data and test edge cases like timeouts and errors.
+
+**Incorrect (calling real APIs and databases):**
+
+```typescript
+// Call real APIs in tests
+describe('PaymentService', () => {
+  it('should process payment', async () => {
+    const service = new PaymentService(new StripeClient(realApiKey));
+    // Hits real Stripe API!
+    const result = await service.charge('tok_visa', 1000);
+    // Slow, costs money, flaky
+  });
+});
+
+// Use real database
+describe('UsersService', () => {
+  beforeEach(async () => {
+    await connection.query('DELETE FROM users'); // Modifies real DB
+  });
+
+  it('should create user', async () => {
+    const user = await service.create({ email: 'test@test.com' });
+    // Side effects on shared database
+  });
+});
+
+// Incomplete mocks
+const mockHttpService = {
+  get: jest.fn().mockResolvedValue({ data: {} }),
+  // Missing error scenarios, missing other methods
+};
+```
+
+**Correct (mock all external dependencies):**
+
+```typescript
+// Mock HTTP service properly
+describe('WeatherService', () => {
+  let service: WeatherService;
+  let httpService: jest.Mocked<HttpService>;
+
+  beforeEach(async () => {
+    const module = await Test.createTestingModule({
+      providers: [
+        WeatherService,
+        {
+          provide: HttpService,
+          useValue: {
+            get: jest.fn(),
+            post: jest.fn(),
+          },
+        },
+      ],
+    }).compile();
+
+    service = module.get(WeatherService);
+    httpService = module.get(HttpService);
+  });
+
+  it('should return weather data', async () => {
+    const mockResponse = {
+      data: { temperature: 72, humidity: 45 },
+      status: 200,
+      statusText: 'OK',
+      headers: {},
+      config: {},
+    };
+
+    httpService.get.mockReturnValue(of(mockResponse));
+
+    const result = await service.getWeather('NYC');
+
+    expect(result).toEqual({ temperature: 72, humidity: 45 });
+  });
+
+  it('should handle API timeout', async () => {
+    httpService.get.mockReturnValue(
+      throwError(() => new Error('ETIMEDOUT')),
+    );
+
+    await expect(service.getWeather('NYC')).rejects.toThrow('Weather service unavailable');
+  });
+
+  it('should handle rate limiting', async () => {
+    httpService.get.mockReturnValue(
+      throwError(() => ({
+        response: { status: 429, data: { message: 'Rate limited' } },
+      })),
+    );
+
+    await expect(service.getWeather('NYC')).rejects.toThrow(TooManyRequestsException);
+  });
+});
+
+// Mock repository instead of database
+describe('UsersService', () => {
+  let service: UsersService;
+  let repo: jest.Mocked<Repository<User>>;
+
+  beforeEach(async () => {
+    const mockRepo = {
+      find: jest.fn(),
+      findOne: jest.fn(),
+      save: jest.fn(),
+      delete: jest.fn(),
+      createQueryBuilder: jest.fn(),
+    };
+
+    const module = await Test.createTestingModule({
+      providers: [
+        UsersService,
+        { provide: getRepositoryToken(User), useValue: mockRepo },
+      ],
+    }).compile();
+
+    service = module.get(UsersService);
+    repo = module.get(getRepositoryToken(User));
+  });
+
+  it('should find user by id', async () => {
+    const mockUser = { id: '1', name: 'John', email: 'john@test.com' };
+    repo.findOne.mockResolvedValue(mockUser);
+
+    const result = await service.findById('1');
+
+    expect(result).toEqual(mockUser);
+    expect(repo.findOne).toHaveBeenCalledWith({ where: { id: '1' } });
+  });
+});
+
+// Create mock factory for complex SDKs
+function createMockStripe(): jest.Mocked<Stripe> {
+  return {
+    paymentIntents: {
+      create: jest.fn(),
+      retrieve: jest.fn(),
+      confirm: jest.fn(),
+      cancel: jest.fn(),
+    },
+    customers: {
+      create: jest.fn(),
+      retrieve: jest.fn(),
+    },
+  } as any;
+}
+
+// Mock time for time-dependent tests
+describe('TokenService', () => {
+  beforeEach(() => {
+    jest.useFakeTimers();
+    jest.setSystemTime(new Date('2024-01-15'));
+  });
+
+  afterEach(() => {
+    jest.useRealTimers();
+  });
+
+  it('should expire token after 1 hour', async () => {
+    const token = await service.createToken();
+
+    // Fast-forward time
+    jest.advanceTimersByTime(61 * 60 * 1000);
+
+    expect(await service.isValid(token)).toBe(false);
+  });
+});
+```
+
+Reference: [Jest Mocking](https://jestjs.io/docs/mock-functions)