@shadimakhoul/ggcoach 1.0.0

package/middleware/admin-auth.ts

@@ -0,0 +1,93 @@
+import { AccountType, IApiResponse } from "../types";
+import { Request, Response, NextFunction } from "express";
+
+export const requireAdmin = (
+  req: Request,
+  res: Response,
+  next: NextFunction,
+) => {
+  try {
+    const user = req.user;
+
+    if (!user) {
+      return res.status(401).json({
+        success: false,
+        error: "Unauthorized: User not authenticated",
+      } as IApiResponse);
+    }
+
+    if (user.accountType !== AccountType.Admin && user.accountType !== AccountType.SuperAdmin) {
+      return res.status(403).json({
+        success: false,
+        error: "Forbidden: Admin access required",
+      } as IApiResponse);
+    }
+
+    return next();
+  } catch (error: any) {
+    return res.status(500).json({
+      success: false,
+      error: "Authorization check failed",
+    } as IApiResponse);
+  }
+};
+
+export const requireSuperAdmin = (
+  req: Request,
+  res: Response,
+  next: NextFunction,
+) => {
+  try {
+    const user = req.user;
+
+    if (!user) {
+      return res.status(401).json({
+        success: false,
+        error: "Unauthorized: User not authenticated",
+      } as IApiResponse);
+    }
+
+    if (user.accountType !== AccountType.SuperAdmin) {
+      return res.status(403).json({
+        success: false,
+        error: "Forbidden: Super admin access required",
+      } as IApiResponse);
+    }
+
+    return next();
+  } catch (error: any) {
+    return res.status(500).json({
+      success: false,
+      error: "Authorization check failed",
+    } as IApiResponse);
+  }
+};
+
+// export const requirePermission = (permission: string) => {
+//   return (req: Request, res: Response, next: NextFunction) => {
+//     try {
+//       const user = req.user;
+
+//       if (!user) {
+//         return res.status(401).json({
+//           success: false,
+//           error: "Unauthorized: User not authenticated",
+//         } as IApiResponse);
+//       }
+
+//       if (!user.permissions || !user.permissions.includes(permission)) {
+//         return res.status(403).json({
+//           success: false,
+//           error: `Forbidden: Permission '${permission}' required`,
+//         } as IApiResponse);
+//       }
+
+//       return next();
+//     } catch (error: any) {
+//       return res.status(500).json({
+//         success: false,
+//         error: "Permission check failed",
+//       } as IApiResponse);
+//     }
+//   };
+// };

package/middleware/auth.ts

@@ -0,0 +1,100 @@
+import { Request, Response, NextFunction } from "express";
+import jwt from "jsonwebtoken";
+
+import { logger } from "../utils";
+import { getRedisClient } from "../config";
+
+import { JWTPayload } from "../types";
+
+const JWT_SECRET =
+  process.env.JWT_SECRET || "your-super-secret-jwt-key-change-in-production";
+const TOKEN_VERSION_PREFIX = "auth:token-version:";
+
+export const authenticateToken = async (
+  req: Request,
+  res: Response,
+  next: NextFunction,
+): Promise<void> => {
+  const authHeader = req.headers["authorization"];
+  const token = authHeader && authHeader.split(" ")[1]; // Bearer TOKEN
+
+  if (!token) {
+    res.status(401).json({
+      success: false,
+      message: "Access token required",
+    });
+    return;
+  }
+
+  try {
+    const decoded = jwt.verify(token, JWT_SECRET, {
+      issuer: "ggcoach-auth-service",
+      audience: "ggcoach-app",
+    }) as JWTPayload;
+
+    const isValid = await validateTokenWithRedis(decoded);
+    if (!isValid) {
+      res.status(403).json({
+        success: false,
+        message: "Invalid or expired token",
+      });
+      return;
+    }
+
+    req.user = decoded;
+    next();
+  } catch (error) {
+    res.status(403).json({
+      success: false,
+      message: "Invalid or expired token",
+    });
+  }
+};
+
+const validateTokenWithRedis = async (decoded: JWTPayload): Promise<boolean> => {
+  try {
+    const client = getRedisClient();
+    const cacheKey = `${TOKEN_VERSION_PREFIX}${decoded.id}`;
+    const cached = await client.get(cacheKey);
+    
+    if (cached === null) {
+      return false;
+    }
+
+    const cachedVersion = Number(cached);
+    const tokenVersion = decoded.tokenVersion ?? 0;
+    return Number.isFinite(cachedVersion) && cachedVersion === tokenVersion;
+  } catch (error) {
+    const err = error instanceof Error ? error : new Error(String(error));
+    logger.warn(`Token version cache read failed: ${err.message}`);
+    return false;
+  }
+};
+
+export const optionalAuth = async (
+  req: Request,
+  _res: Response,
+  next: NextFunction,
+): Promise<void> => {
+  const authHeader = req.headers["authorization"];
+  const token = authHeader && authHeader.split(" ")[1];
+
+  if (token) {
+    try {
+      const decoded = jwt.verify(token, JWT_SECRET, {
+        issuer: "ggcoach-auth-service",
+        audience: "ggcoach-app",
+      }) as JWTPayload;
+      const isValid = await validateTokenWithRedis(decoded);
+      if (isValid) {
+        req.user = decoded;
+      }
+    } catch (error) {
+      // Token is invalid, but we continue without user info
+      const err = error instanceof Error ? error : new Error(String(error));
+      logger.warn(`Invalid token in optional auth: ${err.message}`);
+    }
+  }
+
+  next();
+};

package/middleware/cors.ts

@@ -0,0 +1,48 @@
+import cors from "cors";
+
+export const corsOptions = {
+  origin: (
+    origin: string | undefined,
+    callback: (err: Error | null, allow?: boolean) => void
+  ) => {
+    const defaultOrigins = [
+      "http://localhost:4000",
+      "http://localhost:4001",
+      "http://localhost:4002",
+      "http://localhost:4003",
+      "http://localhost:4004",
+      "http://localhost:4005",
+      "http://localhost:8080",
+      "http://localhost:3000",
+      "http://localhost:3001",
+      "https://gg.staging.brainexy.com",
+      "https://gg.register.brainexy.com",
+    ];
+    const envOrigins = process.env.ALLOWED_ORIGINS?.split(",").map(o => o.trim()) || [];
+    const allowedOrigins = Array.from(
+      new Set([...defaultOrigins, ...envOrigins].map(o => o.toLowerCase()))
+    );
+
+    // Allow no-origin requests (Postman, mobile apps)
+    if (!origin) return callback(null, true);
+    if (allowedOrigins.includes(origin.toLowerCase())) {
+      return callback(null, true);
+    }
+
+    return callback(new Error("Not allowed by CORS"));
+  },
+
+  credentials: true,
+  methods: ["GET", "POST", "PUT", "DELETE", "PATCH", "OPTIONS"],
+  allowedHeaders: [
+    "Content-Type",
+    "Authorization",
+    "X-Requested-With",
+    "X-Request-ID",
+  ],
+  exposedHeaders: ["X-Request-ID"], // optional but useful
+  preflightContinue: false,
+  optionsSuccessStatus: 200,
+};
+
+export const corsMiddleware = cors(corsOptions);

package/middleware/errorHandler.ts

@@ -0,0 +1,62 @@
+import { Request, Response, NextFunction } from 'express';
+import { logger } from '../utils';
+
+export const errorHandler = (err: any, req: Request, res: Response, next: NextFunction): void => {
+  logger.error(`Error: ${err}`);
+
+  // Handle specific error types
+  if (err.code === 'ECONNREFUSED') {
+    res.status(503).json({
+      success: false,
+      message: 'Service temporarily unavailable',
+      code: 'SERVICE_UNAVAILABLE'
+    });
+    return;
+  }
+
+  if (err.code === 'ETIMEDOUT') {
+    res.status(504).json({
+      success: false,
+      message: 'Gateway timeout',
+      code: 'GATEWAY_TIMEOUT'
+    });
+    return;
+  }
+
+  if (err.name === 'ValidationError') {
+    res.status(400).json({
+      success: false,
+      message: 'Validation error',
+      errors: err.details || [err.message]
+    });
+    return;
+  }
+
+  if (err.name === 'SequelizeValidationError') {
+    res.status(400).json({
+      success: false,
+      message: 'Validation error',
+      errors: err.errors.map((e: any) => e.message)
+    });
+    return;
+  }
+
+  if (err.name === 'SequelizeUniqueConstraintError') {
+    res.status(409).json({
+      success: false,
+      message: 'Resource already exists',
+      field: err.errors[0]?.path || 'unknown'
+    });
+    return;
+  }
+
+  res.status(err.status || 500).json({
+    success: false,
+    message: err.message || 'Internal server error',
+    code: err.code || 'INTERNAL_ERROR',
+    ...(process.env.NODE_ENV === 'development' && { 
+      stack: err.stack,
+      requestId: req.headers['x-request-id']
+    })
+  });
+};

package/middleware/index.ts

@@ -0,0 +1,8 @@
+export * from './auth';
+export * from './validation';
+export * from './errorHandler';
+export * from './cors';
+export * from './rateLimiter';
+export * from './swagger';
+export * from './internalAuth';
+export * from './admin-auth';

package/middleware/internalAuth.ts

@@ -0,0 +1,25 @@
+import { Request, Response, NextFunction } from 'express';
+
+export const requireInternalToken = (req: Request, res: Response, next: NextFunction): void => {
+  if (process.env.ALLOW_DIRECT_ACCESS === 'true') {
+    next();
+    return;
+  }
+
+  const token = process.env.INTERNAL_SERVICE_TOKEN;
+  if (!token) {
+    // If token isn't set, reject to be safe
+    res.status(403).json({ success: false, message: 'Internal access token not configured' });
+    return;
+  }
+
+  const incoming = (req.headers['x-internal-token'] as string) || '';
+  if (incoming !== token) {
+    res.status(403).json({ success: false, message: 'Forbidden' });
+    return;
+  }
+
+  next();
+};
+
+export default requireInternalToken;

package/middleware/rateLimiter.ts

@@ -0,0 +1,18 @@
+import rateLimit from 'express-rate-limit';
+
+export const createRateLimiter = (windowMs: number = 15 * 60 * 1000, max: number = 1000) => {
+  return rateLimit({
+    windowMs,
+    max,
+    message: {
+      success: false,
+      message: 'Too many requests from this IP, please try again later.',
+      retryAfter: `${Math.ceil(windowMs / 60000)} minutes`
+    },
+    standardHeaders: true,
+    legacyHeaders: false,
+  });
+};
+
+export const authRateLimiter = createRateLimiter(15 * 60 * 1000, 5); // 5 attempts per 15 minutes for auth
+export const generalRateLimiter = createRateLimiter(15 * 60 * 1000, 1000); // 1000 requests per 15 minutes

package/middleware/swagger.ts

@@ -0,0 +1,69 @@
+import { Express } from 'express';
+import swaggerUi from 'swagger-ui-express';
+import { swaggerUiOptions } from '../config/swagger-ui';
+import { logger } from '../utils';
+
+type OpenApiSpec = Record<string, unknown>;
+
+type SwaggerUiUrl = {
+  name: string;
+  url: string;
+};
+
+type SwaggerSetupOptions = {
+  basePath?: string;
+  spec?: OpenApiSpec;
+  getSpec?: () => Promise<OpenApiSpec> | OpenApiSpec;
+  swaggerUiUrls?: SwaggerUiUrl[];
+  swaggerUiPrimaryName?: string;
+};
+
+const resolveSpec = async (options: SwaggerSetupOptions): Promise<OpenApiSpec> => {
+  if (options.getSpec) {
+    return await options.getSpec();
+  }
+
+  if (options.spec) {
+    return options.spec;
+  }
+
+  return {};
+};
+
+export const setupSwagger = (app: Express, options: SwaggerSetupOptions = {}) => {
+  const basePath = options.basePath ?? '/api-docs';
+
+  app.get(`${basePath}/swagger.json`, async (_req, res) => {
+    try {
+      const spec = await resolveSpec(options);
+      res.setHeader('Content-Type', 'application/json');
+      res.send(spec);
+    } catch (error) {
+      const err = error instanceof Error ? error : new Error(String(error));
+      logger.error(`Failed to build swagger spec: ${err.message}`);
+      res.status(500).json({ success: false, message: 'Failed to build swagger spec' });
+    }
+  });
+
+  app.use(
+    basePath,
+    swaggerUi.serve,
+    swaggerUi.setup(undefined, {
+      ...swaggerUiOptions,
+      swaggerOptions: {
+        ...(options.swaggerUiUrls && options.swaggerUiUrls.length > 0
+          ? {
+              urls: options.swaggerUiUrls,
+              ...(options.swaggerUiPrimaryName
+                ? { urlsPrimaryName: options.swaggerUiPrimaryName }
+                : {}),
+            }
+          : { url: `${basePath}/swagger.json` }),
+      },
+    })
+  );
+
+  logger.info(
+    `📚 Swagger documentation available at: http://localhost:${process.env.PORT || 4000}${basePath}`
+  );
+};

package/middleware/validation.ts

@@ -0,0 +1,24 @@
+import { Request, Response, NextFunction } from 'express';
+import Joi from 'joi';
+
+export const validateRequest = (schema: Joi.ObjectSchema) => {
+  return (req: Request, res: Response, next: NextFunction): void => {
+    const { error, value } = schema.validate(req.body, {
+      abortEarly: false,
+      stripUnknown: true
+    });
+
+    if (error) {
+      const errorMessages = error.details.map(detail => detail.message);
+      res.status(400).json({
+        success: false,
+        message: 'Validation error',
+        errors: errorMessages
+      });
+      return;
+    }
+
+    req.body = value;
+    next();
+  };
+};

package/package.json

@@ -0,0 +1,43 @@
+{
+  "name": "@shadimakhoul/ggcoach",
+  "version": "1.0.0",
+  "description": "Shared utilities and types for GGCoach microservices",
+  "main": "./dist/index.js",
+  "types": "./dist/index.d.ts",
+  "type": "commonjs",
+  "scripts": {
+    "build": "tsc",
+    "dev": "tsc --watch",
+    "test": "jest",
+    "lint": "eslint src/**/*.ts",
+    "lint:fix": "eslint src/**/*.ts --fix"
+  },
+  "dependencies": {
+    "express-list-endpoints": "^6.0.0",
+    "redis": "^4.6.10",
+    "helmet": "^7.1.0",
+    "express-rate-limit": "^7.1.5",
+    "winston": "^3.11.0",
+    "dotenv": "^16.3.1",
+    "cors": "^2.8.5",
+    "express": "^4.18.2",
+    "joi": "^17.11.0",
+    "jsonwebtoken": "^9.0.2",
+    "morgan": "^1.10.0",
+    "mysql2": "^3.15.3",
+    "swagger-jsdoc": "^6.2.8",
+    "swagger-ui-express": "^5.0.0",
+    "tsconfig-paths": "^4.2.0"
+  },
+  "keywords": [
+    "shared",
+    "utilities",
+    "types",
+    "microservices"
+  ],
+  "author": "Shadi Makhoul",
+  "license": "ISC",
+  "devDependencies": {
+    "@types/express-list-endpoints": "^6.0.0"
+  }
+}

package/public/swagger.css

@@ -0,0 +1,114 @@
+/* Hide top bar */
+.swagger-ui .topbar {
+  display: none;
+}
+
+/* Global */
+body,
+.swagger-ui {
+  background-color: #020617;
+  color: #f1f5f9;
+}
+
+/* Main titles */
+.swagger-ui .info .title {
+  color: #f8fafc;
+  font-weight: 700;
+}
+
+.swagger-ui h1,
+.swagger-ui h2,
+.swagger-ui h3,
+.swagger-ui h4 {
+  color: #e5e7eb;
+}
+
+/* Description text */
+.swagger-ui .info p,
+.swagger-ui .info li,
+.swagger-ui .markdown p,
+.swagger-ui .markdown li {
+  color: #d1d5db;
+}
+
+/* Labels & small text */
+.swagger-ui label,
+.swagger-ui .parameter__name,
+.swagger-ui .parameter__type,
+.swagger-ui .parameter__deprecated,
+.swagger-ui .response-col_status {
+  color: #e5e7eb;
+}
+
+/* Scheme / auth container */
+.swagger-ui .scheme-container {
+  background: #020617;
+  padding: 10px;
+  border-radius: 6px;
+  border: 1px solid #1e293b;
+}
+
+/* Operation blocks */
+.swagger-ui .opblock,
+.swagger-ui .opblock-summary {
+  background: #020617;
+  border-color: #1e293b;
+}
+
+/* Tables */
+.swagger-ui table {
+  color: #e5e7eb;
+}
+
+.swagger-ui table thead th {
+  color: #f8fafc;
+  border-bottom: 1px solid #334155;
+}
+
+.swagger-ui table tbody td {
+  color: #d1d5db;
+  border-bottom: 1px solid #1e293b;
+}
+
+/* Inputs */
+.swagger-ui input,
+.swagger-ui select,
+.swagger-ui textarea {
+  background: #020617;
+  color: #f8fafc;
+  border: 1px solid #334155;
+}
+
+/* Placeholders */
+.swagger-ui input::placeholder,
+.swagger-ui textarea::placeholder {
+  color: #94a3b8;
+}
+
+/* Buttons */
+.swagger-ui .btn {
+  background: #1e293b;
+  color: #f8fafc;
+  border: 1px solid #334155;
+}
+
+.swagger-ui .btn:hover {
+  background: #334155;
+}
+
+/* Code blocks */
+.swagger-ui pre,
+.swagger-ui code {
+  background: #020617;
+  color: #f8fafc;
+  border: 1px solid #1e293b;
+}
+
+/* Links */
+.swagger-ui a {
+  color: #38bdf8;
+}
+
+.swagger-ui a:hover {
+  color: #7dd3fc;
+}

package/tsconfig.json

@@ -0,0 +1,10 @@
+{
+  "extends": "../tsconfig.json",
+  "compilerOptions": {
+    "outDir": "./dist",
+    "rootDir": "./",
+    "composite": false
+  },
+  "include": ["**/*.ts"],
+  "exclude": ["node_modules", "dist"]
+}

package/types/admin-auth.ts

@@ -0,0 +1,47 @@
+export interface IAdminUser {
+  id: string;
+  email: string;
+  name: string;
+  role: string;
+  isActive: boolean;
+  permissions: string[];
+}
+
+export interface IPermission {
+  id: string;
+  name: string;
+  description: string;
+  module: string;
+  action: string;
+}
+
+export interface IAppRole {
+  id: string;
+  name: string;
+  description: string;
+  permissions: string[];
+  isActive: boolean;
+  usersCount?: number;
+  createdAt: Date;
+  updatedAt: Date;
+}
+
+export interface IPaginationQuery {
+  page: number;
+  limit: number;
+  sortBy?: string;
+  sortOrder?: "ASC" | "DESC";
+  search?: string;
+}
+
+export interface IApiResponse<T = any> {
+  success: boolean;
+  data?: T;
+  message?: string;
+  error?: string;
+  meta?: {
+    page?: number;
+    limit?: number;
+    total?: number;
+  };
+}