create-forgeon 0.1.35 → 0.1.37

package/templates/module-presets/jwt-auth/apps/api/src/auth/prisma-auth-refresh-token.store.ts

@@ -0,0 +1,36 @@
+import {
+  AuthRefreshTokenStore,
+} from '@forgeon/auth-api';
+import { PrismaService } from '@forgeon/db-prisma';
+import { Injectable } from '@nestjs/common';
+
+@Injectable()
+export class PrismaAuthRefreshTokenStore implements AuthRefreshTokenStore {
+  readonly kind = 'prisma';
+
+  constructor(private readonly prisma: PrismaService) {}
+
+  async saveRefreshTokenHash(subject: string, hash: string): Promise<void> {
+    await this.prisma.user.upsert({
+      where: { email: subject },
+      create: { email: subject, refreshTokenHash: hash },
+      update: { refreshTokenHash: hash },
+      select: { id: true },
+    });
+  }
+
+  async getRefreshTokenHash(subject: string): Promise<string | null> {
+    const user = await this.prisma.user.findUnique({
+      where: { email: subject },
+      select: { refreshTokenHash: true },
+    });
+    return user?.refreshTokenHash ?? null;
+  }
+
+  async removeRefreshTokenHash(subject: string): Promise<void> {
+    await this.prisma.user.updateMany({
+      where: { email: subject },
+      data: { refreshTokenHash: null },
+    });
+  }
+}

package/templates/module-presets/jwt-auth/packages/auth-api/package.json

@@ -0,0 +1,28 @@
+{
+  "name": "@forgeon/auth-api",
+  "version": "0.1.0",
+  "private": true,
+  "main": "dist/index.js",
+  "types": "dist/index.d.ts",
+  "scripts": {
+    "build": "tsc -p tsconfig.json"
+  },
+  "dependencies": {
+    "@forgeon/auth-contracts": "workspace:*",
+    "@nestjs/common": "^11.0.1",
+    "@nestjs/config": "^4.0.2",
+    "@nestjs/jwt": "^11.0.1",
+    "@nestjs/passport": "^11.0.5",
+    "bcryptjs": "^2.4.3",
+    "class-validator": "^0.14.1",
+    "passport": "^0.7.0",
+    "passport-jwt": "^4.0.1",
+    "zod": "^3.23.8"
+  },
+  "devDependencies": {
+    "@types/bcryptjs": "^2.4.6",
+    "@types/node": "^22.10.7",
+    "@types/passport-jwt": "^4.0.1",
+    "typescript": "^5.7.3"
+  }
+}

package/templates/module-presets/jwt-auth/packages/auth-api/src/auth-config.loader.ts

@@ -0,0 +1,27 @@
+import { registerAs } from '@nestjs/config';
+import { parseAuthEnv } from './auth-env.schema';
+
+export const AUTH_CONFIG_NAMESPACE = 'auth';
+
+export interface AuthConfigValues {
+  accessSecret: string;
+  accessExpiresIn: string;
+  refreshSecret: string;
+  refreshExpiresIn: string;
+  bcryptRounds: number;
+  demoEmail: string;
+  demoPassword: string;
+}
+
+export const authConfig = registerAs(AUTH_CONFIG_NAMESPACE, (): AuthConfigValues => {
+  const env = parseAuthEnv(process.env);
+  return {
+    accessSecret: env.JWT_ACCESS_SECRET,
+    accessExpiresIn: env.JWT_ACCESS_EXPIRES_IN,
+    refreshSecret: env.JWT_REFRESH_SECRET,
+    refreshExpiresIn: env.JWT_REFRESH_EXPIRES_IN,
+    bcryptRounds: env.AUTH_BCRYPT_ROUNDS,
+    demoEmail: env.AUTH_DEMO_EMAIL.toLowerCase(),
+    demoPassword: env.AUTH_DEMO_PASSWORD,
+  };
+});

package/templates/module-presets/jwt-auth/packages/auth-api/src/auth-config.module.ts

@@ -0,0 +1,8 @@
+import { Module } from '@nestjs/common';
+import { AuthConfigService } from './auth-config.service';
+
+@Module({
+  providers: [AuthConfigService],
+  exports: [AuthConfigService],
+})
+export class AuthConfigModule {}

package/templates/module-presets/jwt-auth/packages/auth-api/src/auth-config.service.ts

@@ -0,0 +1,36 @@
+import { Injectable } from '@nestjs/common';
+import { ConfigService } from '@nestjs/config';
+import { AUTH_CONFIG_NAMESPACE } from './auth-config.loader';
+
+@Injectable()
+export class AuthConfigService {
+  constructor(private readonly configService: ConfigService) {}
+
+  get accessSecret(): string {
+    return this.configService.getOrThrow<string>(`${AUTH_CONFIG_NAMESPACE}.accessSecret`);
+  }
+
+  get accessExpiresIn(): string {
+    return this.configService.getOrThrow<string>(`${AUTH_CONFIG_NAMESPACE}.accessExpiresIn`);
+  }
+
+  get refreshSecret(): string {
+    return this.configService.getOrThrow<string>(`${AUTH_CONFIG_NAMESPACE}.refreshSecret`);
+  }
+
+  get refreshExpiresIn(): string {
+    return this.configService.getOrThrow<string>(`${AUTH_CONFIG_NAMESPACE}.refreshExpiresIn`);
+  }
+
+  get bcryptRounds(): number {
+    return this.configService.getOrThrow<number>(`${AUTH_CONFIG_NAMESPACE}.bcryptRounds`);
+  }
+
+  get demoEmail(): string {
+    return this.configService.getOrThrow<string>(`${AUTH_CONFIG_NAMESPACE}.demoEmail`);
+  }
+
+  get demoPassword(): string {
+    return this.configService.getOrThrow<string>(`${AUTH_CONFIG_NAMESPACE}.demoPassword`);
+  }
+}

package/templates/module-presets/jwt-auth/packages/auth-api/src/auth-env.schema.ts

@@ -0,0 +1,19 @@
+import { z } from 'zod';
+
+export const authEnvSchema = z
+  .object({
+    JWT_ACCESS_SECRET: z.string().trim().min(16).default('forgeon-access-secret-change-me'),
+    JWT_ACCESS_EXPIRES_IN: z.string().trim().min(2).default('15m'),
+    JWT_REFRESH_SECRET: z.string().trim().min(16).default('forgeon-refresh-secret-change-me'),
+    JWT_REFRESH_EXPIRES_IN: z.string().trim().min(2).default('7d'),
+    AUTH_BCRYPT_ROUNDS: z.coerce.number().int().min(4).max(15).default(10),
+    AUTH_DEMO_EMAIL: z.string().trim().email().default('demo@forgeon.local'),
+    AUTH_DEMO_PASSWORD: z.string().min(8).default('forgeon-demo-password'),
+  })
+  .passthrough();
+
+export type AuthEnv = z.infer<typeof authEnvSchema>;
+
+export function parseAuthEnv(input: Record<string, unknown>): AuthEnv {
+  return authEnvSchema.parse(input);
+}

package/templates/module-presets/jwt-auth/packages/auth-api/src/auth-refresh-token.store.ts

@@ -0,0 +1,23 @@
+import { Injectable } from '@nestjs/common';
+
+export const AUTH_REFRESH_TOKEN_STORE = Symbol('AUTH_REFRESH_TOKEN_STORE');
+
+export interface AuthRefreshTokenStore {
+  readonly kind: string;
+  saveRefreshTokenHash(subject: string, hash: string): Promise<void>;
+  getRefreshTokenHash(subject: string): Promise<string | null>;
+  removeRefreshTokenHash(subject: string): Promise<void>;
+}
+
+@Injectable()
+export class NoopAuthRefreshTokenStore implements AuthRefreshTokenStore {
+  readonly kind = 'none';
+
+  async saveRefreshTokenHash(): Promise<void> {}
+
+  async getRefreshTokenHash(): Promise<string | null> {
+    return null;
+  }
+
+  async removeRefreshTokenHash(): Promise<void> {}
+}

package/templates/module-presets/jwt-auth/packages/auth-api/src/auth.controller.ts

@@ -0,0 +1,71 @@
+import { AuthUser } from '@forgeon/auth-contracts';
+import {
+  Body,
+  Controller,
+  Get,
+  Post,
+  Req,
+  UseGuards,
+} from '@nestjs/common';
+import { AuthService } from './auth.service';
+import { LoginDto, RefreshDto } from './dto';
+import { JwtAuthGuard } from './jwt-auth.guard';
+import { AuthJwtPayload } from './auth.types';
+
+type RequestWithUser = { user?: AuthJwtPayload };
+
+@Controller('auth')
+export class AuthController {
+  constructor(private readonly authService: AuthService) {}
+
+  @Post('login')
+  login(@Body() body: LoginDto) {
+    return this.authService.login(body);
+  }
+
+  @Post('refresh')
+  refresh(@Body() body: RefreshDto) {
+    return this.authService.refresh(body);
+  }
+
+  @UseGuards(JwtAuthGuard)
+  @Post('logout')
+  async logout(@Req() request: RequestWithUser) {
+    const user = this.getRequestUser(request);
+    await this.authService.logout(user);
+    return {
+      status: 'ok',
+      tokenStore: this.authService.getTokenStoreKind(),
+    };
+  }
+
+  @UseGuards(JwtAuthGuard)
+  @Get('me')
+  me(@Req() request: RequestWithUser) {
+    const user = this.getRequestUser(request);
+    return {
+      user: this.toAuthUser(user),
+      tokenStore: this.authService.getTokenStoreKind(),
+    };
+  }
+
+  private getRequestUser(request: RequestWithUser): AuthJwtPayload {
+    const user = request.user;
+    if (!user || typeof user.sub !== 'string' || typeof user.email !== 'string') {
+      return {
+        sub: 'unknown',
+        email: 'unknown@invalid.local',
+        roles: ['user'],
+      };
+    }
+    return user;
+  }
+
+  private toAuthUser(payload: AuthJwtPayload): AuthUser {
+    return {
+      sub: payload.sub,
+      email: payload.email,
+      roles: Array.isArray(payload.roles) ? payload.roles : ['user'],
+    };
+  }
+}

package/templates/module-presets/jwt-auth/packages/auth-api/src/auth.service.ts

@@ -0,0 +1,166 @@
+import {
+  AUTH_ERROR_CODES,
+  AuthUser,
+  LoginResponse,
+  RefreshResponse,
+  TokenPair,
+} from '@forgeon/auth-contracts';
+import { Inject, Injectable, UnauthorizedException } from '@nestjs/common';
+import { JwtService } from '@nestjs/jwt';
+import type { JwtSignOptions } from '@nestjs/jwt';
+import { compare, hash } from 'bcryptjs';
+import {
+  AUTH_REFRESH_TOKEN_STORE,
+  AuthRefreshTokenStore,
+} from './auth-refresh-token.store';
+import { AuthConfigService } from './auth-config.service';
+import { LoginDto, RefreshDto } from './dto';
+import { AuthJwtPayload } from './auth.types';
+
+type JwtExpiresIn = NonNullable<JwtSignOptions['expiresIn']>;
+
+@Injectable()
+export class AuthService {
+  constructor(
+    private readonly jwtService: JwtService,
+    private readonly configService: AuthConfigService,
+    @Inject(AUTH_REFRESH_TOKEN_STORE)
+    private readonly refreshTokenStore: AuthRefreshTokenStore,
+  ) {}
+
+  getTokenStoreKind(): string {
+    return this.refreshTokenStore.kind;
+  }
+
+  async login(input: LoginDto): Promise<LoginResponse> {
+    const email = input.email.trim().toLowerCase();
+    if (email !== this.configService.demoEmail || input.password !== this.configService.demoPassword) {
+      throw new UnauthorizedException({
+        message: 'Invalid credentials',
+        details: { code: AUTH_ERROR_CODES.invalidCredentials },
+      });
+    }
+
+    const user: AuthUser = {
+      sub: email,
+      email,
+      roles: ['user'],
+    };
+
+    const tokens = await this.issueTokens(user);
+    return {
+      ...tokens,
+      user,
+      tokenStore: this.refreshTokenStore.kind,
+    };
+  }
+
+  async refresh(input: RefreshDto): Promise<RefreshResponse> {
+    let payload: AuthJwtPayload;
+    try {
+      payload = await this.jwtService.verifyAsync<AuthJwtPayload>(input.refreshToken, {
+        secret: this.configService.refreshSecret,
+      });
+    } catch (error) {
+      const code =
+        error instanceof Error && error.name === 'TokenExpiredError'
+          ? AUTH_ERROR_CODES.tokenExpired
+          : AUTH_ERROR_CODES.refreshInvalid;
+
+      throw new UnauthorizedException({
+        message: 'Refresh token is invalid or expired',
+        details: { code },
+      });
+    }
+
+    if (this.refreshTokenStore.kind !== 'none') {
+      const storedHash = await this.refreshTokenStore.getRefreshTokenHash(payload.sub);
+      if (!storedHash) {
+        throw new UnauthorizedException({
+          message: 'Refresh token is invalid or expired',
+          details: { code: AUTH_ERROR_CODES.refreshInvalid },
+        });
+      }
+
+      const matched = await compare(input.refreshToken, storedHash);
+      if (!matched) {
+        throw new UnauthorizedException({
+          message: 'Refresh token is invalid or expired',
+          details: { code: AUTH_ERROR_CODES.refreshInvalid },
+        });
+      }
+    }
+
+    const user = this.toAuthUser(payload);
+    const tokens = await this.issueTokens(user);
+    return {
+      ...tokens,
+      user,
+      tokenStore: this.refreshTokenStore.kind,
+    };
+  }
+
+  async logout(user: AuthJwtPayload): Promise<void> {
+    if (this.refreshTokenStore.kind === 'none') {
+      return;
+    }
+    await this.refreshTokenStore.removeRefreshTokenHash(user.sub);
+  }
+
+  getProbeStatus() {
+    return {
+      status: 'ok',
+      feature: 'jwt-auth',
+      tokenStore: this.refreshTokenStore.kind,
+      demoEmail: this.configService.demoEmail,
+    };
+  }
+
+  private async issueTokens(user: AuthUser): Promise<TokenPair> {
+    const payload: AuthJwtPayload = {
+      sub: user.sub,
+      email: user.email,
+      roles: user.roles,
+    };
+
+    const [accessToken, refreshToken] = await Promise.all([
+      this.jwtService.signAsync(payload, {
+        secret: this.configService.accessSecret,
+        expiresIn: this.toJwtExpiresIn(this.configService.accessExpiresIn),
+      }),
+      this.jwtService.signAsync(payload, {
+        secret: this.configService.refreshSecret,
+        expiresIn: this.toJwtExpiresIn(this.configService.refreshExpiresIn),
+      }),
+    ]);
+
+    if (this.refreshTokenStore.kind !== 'none') {
+      const tokenHash = await hash(refreshToken, this.configService.bcryptRounds);
+      await this.refreshTokenStore.saveRefreshTokenHash(user.sub, tokenHash);
+    }
+
+    return {
+      accessToken,
+      refreshToken,
+      tokenType: 'Bearer',
+      accessTtl: this.configService.accessExpiresIn,
+      refreshTtl: this.configService.refreshExpiresIn,
+    };
+  }
+
+  private toAuthUser(payload: AuthJwtPayload): AuthUser {
+    return {
+      sub: payload.sub,
+      email: payload.email,
+      roles: Array.isArray(payload.roles) ? payload.roles : ['user'],
+    };
+  }
+
+  private toJwtExpiresIn(value: string): JwtExpiresIn {
+    const trimmed = value.trim();
+    if (/^\d+$/.test(trimmed)) {
+      return Number(trimmed);
+    }
+    return trimmed as JwtExpiresIn;
+  }
+}

package/templates/module-presets/jwt-auth/packages/auth-api/src/auth.types.ts

@@ -0,0 +1,6 @@
+import type { AuthUser } from '@forgeon/auth-contracts';
+
+export interface AuthJwtPayload extends AuthUser {
+  iat?: number;
+  exp?: number;
+}

package/templates/module-presets/jwt-auth/packages/auth-api/src/dto/index.ts

@@ -0,0 +1,2 @@
+export * from './login.dto';
+export * from './refresh.dto';

package/templates/module-presets/jwt-auth/packages/auth-api/src/dto/login.dto.ts

@@ -0,0 +1,11 @@
+import { LoginRequest } from '@forgeon/auth-contracts';
+import { IsEmail, IsString, MinLength } from 'class-validator';
+
+export class LoginDto implements LoginRequest {
+  @IsEmail()
+  email!: string;
+
+  @IsString()
+  @MinLength(8)
+  password!: string;
+}

package/templates/module-presets/jwt-auth/packages/auth-api/src/dto/refresh.dto.ts

@@ -0,0 +1,8 @@
+import { RefreshRequest } from '@forgeon/auth-contracts';
+import { IsString, MinLength } from 'class-validator';
+
+export class RefreshDto implements RefreshRequest {
+  @IsString()
+  @MinLength(16)
+  refreshToken!: string;
+}

package/templates/module-presets/jwt-auth/packages/auth-api/src/forgeon-auth.module.ts

@@ -0,0 +1,47 @@
+import {
+  DynamicModule,
+  Module,
+  ModuleMetadata,
+  Provider,
+} from '@nestjs/common';
+import { JwtModule } from '@nestjs/jwt';
+import { PassportModule } from '@nestjs/passport';
+import {
+  AUTH_REFRESH_TOKEN_STORE,
+  NoopAuthRefreshTokenStore,
+} from './auth-refresh-token.store';
+import { AuthConfigModule } from './auth-config.module';
+import { AuthController } from './auth.controller';
+import { AuthService } from './auth.service';
+import { JwtAuthGuard } from './jwt-auth.guard';
+import { JwtStrategy } from './jwt.strategy';
+
+export interface ForgeonAuthModuleOptions {
+  imports?: ModuleMetadata['imports'];
+  refreshTokenStoreProvider?: Provider;
+}
+
+@Module({})
+export class ForgeonAuthModule {
+  static register(options: ForgeonAuthModuleOptions = {}): DynamicModule {
+    const refreshTokenStoreProvider =
+      options.refreshTokenStoreProvider ??
+      ({
+        provide: AUTH_REFRESH_TOKEN_STORE,
+        useClass: NoopAuthRefreshTokenStore,
+      } satisfies Provider);
+
+    return {
+      module: ForgeonAuthModule,
+      imports: [
+        AuthConfigModule,
+        PassportModule.register({ defaultStrategy: 'jwt' }),
+        JwtModule.register({}),
+        ...(options.imports ?? []),
+      ],
+      controllers: [AuthController],
+      providers: [AuthService, JwtStrategy, JwtAuthGuard, refreshTokenStoreProvider],
+      exports: [AuthConfigModule, AuthService, JwtAuthGuard, AUTH_REFRESH_TOKEN_STORE],
+    };
+  }
+}

package/templates/module-presets/jwt-auth/packages/auth-api/src/index.ts

@@ -0,0 +1,12 @@
+export * from './auth-env.schema';
+export * from './auth-config.loader';
+export * from './auth-config.module';
+export * from './auth-config.service';
+export * from './auth-refresh-token.store';
+export * from './auth.controller';
+export * from './auth.service';
+export * from './auth.types';
+export * from './dto';
+export * from './forgeon-auth.module';
+export * from './jwt-auth.guard';
+export * from './jwt.strategy';

package/templates/module-presets/jwt-auth/packages/auth-api/src/jwt-auth.guard.ts

@@ -0,0 +1,5 @@
+import { Injectable } from '@nestjs/common';
+import { AuthGuard } from '@nestjs/passport';
+
+@Injectable()
+export class JwtAuthGuard extends AuthGuard('jwt') {}

package/templates/module-presets/jwt-auth/packages/auth-api/src/jwt.strategy.ts

@@ -0,0 +1,20 @@
+import { Injectable } from '@nestjs/common';
+import { PassportStrategy } from '@nestjs/passport';
+import { ExtractJwt, Strategy } from 'passport-jwt';
+import { AuthConfigService } from './auth-config.service';
+import { AuthJwtPayload } from './auth.types';
+
+@Injectable()
+export class JwtStrategy extends PassportStrategy(Strategy) {
+  constructor(configService: AuthConfigService) {
+    super({
+      jwtFromRequest: ExtractJwt.fromAuthHeaderAsBearerToken(),
+      ignoreExpiration: false,
+      secretOrKey: configService.accessSecret,
+    });
+  }
+
+  validate(payload: AuthJwtPayload): AuthJwtPayload {
+    return payload;
+  }
+}

package/templates/module-presets/jwt-auth/packages/auth-api/tsconfig.json

@@ -0,0 +1,9 @@
+{
+  "extends": "../../tsconfig.base.node.json",
+  "compilerOptions": {
+    "rootDir": "src",
+    "outDir": "dist",
+    "types": ["node"]
+  },
+  "include": ["src/**/*.ts"]
+}

package/templates/module-presets/jwt-auth/packages/auth-contracts/package.json

@@ -0,0 +1,21 @@
+{
+  "name": "@forgeon/auth-contracts",
+  "version": "0.1.0",
+  "private": true,
+  "type": "module",
+  "main": "dist/index.js",
+  "types": "dist/index.d.ts",
+  "exports": {
+    ".": {
+      "types": "./dist/index.d.ts",
+      "import": "./dist/index.js"
+    }
+  },
+  "scripts": {
+    "build": "tsc -p tsconfig.json"
+  },
+  "devDependencies": {
+    "@types/node": "^22.10.7",
+    "typescript": "^5.7.3"
+  }
+}

package/templates/module-presets/jwt-auth/packages/auth-contracts/src/index.ts

@@ -0,0 +1,47 @@
+export const AUTH_API_ROUTES = {
+  login: '/api/auth/login',
+  refresh: '/api/auth/refresh',
+  logout: '/api/auth/logout',
+  me: '/api/auth/me',
+} as const;
+
+export const AUTH_ERROR_CODES = {
+  invalidCredentials: 'AUTH_INVALID_CREDENTIALS',
+  tokenExpired: 'AUTH_TOKEN_EXPIRED',
+  refreshInvalid: 'AUTH_REFRESH_INVALID',
+} as const;
+
+export type AuthErrorCode = (typeof AUTH_ERROR_CODES)[keyof typeof AUTH_ERROR_CODES];
+
+export interface AuthUser {
+  sub: string;
+  email: string;
+  roles: string[];
+}
+
+export interface LoginRequest {
+  email: string;
+  password: string;
+}
+
+export interface RefreshRequest {
+  refreshToken: string;
+}
+
+export interface TokenPair {
+  accessToken: string;
+  refreshToken: string;
+  tokenType: 'Bearer';
+  accessTtl: string;
+  refreshTtl: string;
+}
+
+export interface LoginResponse extends TokenPair {
+  user: AuthUser;
+  tokenStore: string;
+}
+
+export interface RefreshResponse extends TokenPair {
+  user: AuthUser;
+  tokenStore: string;
+}

package/templates/module-presets/jwt-auth/packages/auth-contracts/tsconfig.json

@@ -0,0 +1,9 @@
+{
+  "extends": "../../tsconfig.base.esm.json",
+  "compilerOptions": {
+    "rootDir": "src",
+    "outDir": "dist",
+    "types": ["node"]
+  },
+  "include": ["src/**/*.ts"]
+}