create-tigra 1.1.0 → 2.0.1

package/template/server/src/modules/auth/session.repo.ts

@@ -0,0 +1,110 @@
+import { prisma } from '@libs/prisma.js';
+import type { Session } from '@prisma/client';
+
+export class SessionRepository {
+  /**
+   * Create a new session
+   */
+  async createSession(data: {
+    userId: string;
+    deviceInfo?: string;
+    ipAddress?: string;
+    expiresAt: Date;
+  }): Promise<Session> {
+    return prisma.session.create({
+      data: {
+        userId: data.userId,
+        deviceInfo: data.deviceInfo,
+        ipAddress: data.ipAddress,
+        expiresAt: data.expiresAt,
+      },
+    });
+  }
+
+  /**
+   * Get all active sessions for a user
+   */
+  async getUserSessions(userId: string): Promise<Session[]> {
+    return prisma.session.findMany({
+      where: {
+        userId,
+        expiresAt: {
+          gt: new Date(),
+        },
+      },
+      orderBy: {
+        lastActiveAt: 'desc',
+      },
+    });
+  }
+
+  /**
+   * Update session last active timestamp
+   */
+  async updateLastActive(sessionId: string): Promise<Session> {
+    return prisma.session.update({
+      where: { id: sessionId },
+      data: {
+        lastActiveAt: new Date(),
+      },
+    });
+  }
+
+  /**
+   * Delete a specific session
+   */
+  async deleteSession(sessionId: string): Promise<void> {
+    await prisma.session.delete({
+      where: { id: sessionId },
+    });
+  }
+
+  /**
+   * Delete all sessions for a user
+   */
+  async deleteAllUserSessions(userId: string): Promise<number> {
+    const result = await prisma.session.deleteMany({
+      where: { userId },
+    });
+    return result.count;
+  }
+
+  /**
+   * Delete expired sessions (for cleanup cron job)
+   */
+  async deleteExpiredSessions(): Promise<number> {
+    const result = await prisma.session.deleteMany({
+      where: {
+        expiresAt: {
+          lt: new Date(),
+        },
+      },
+    });
+    return result.count;
+  }
+
+  /**
+   * Get session by ID
+   */
+  async getSessionById(sessionId: string): Promise<Session | null> {
+    return prisma.session.findUnique({
+      where: { id: sessionId },
+    });
+  }
+
+  /**
+   * Count active sessions for a user
+   */
+  async countUserSessions(userId: string): Promise<number> {
+    return prisma.session.count({
+      where: {
+        userId,
+        expiresAt: {
+          gt: new Date(),
+        },
+      },
+    });
+  }
+}
+
+export const sessionRepository = new SessionRepository();

package/template/server/src/modules/users/users.controller.ts

@@ -0,0 +1,120 @@
+/**
+ * Users Controller
+ *
+ * Request handlers for user endpoints.
+ */
+
+import type { FastifyRequest, FastifyReply } from 'fastify';
+import path from 'path';
+import { usersService } from './users.service.js';
+import { validateImageFile, validateFileSize } from '@libs/storage/file-validator.js';
+import { successResponse } from '@shared/responses/successResponse.js';
+import type { GetUserAvatarParams } from './users.schemas.js';
+import type { AuthenticatedRequest } from '@shared/types/index.js';
+import { logger } from '@libs/logger.js';
+import { BadRequestError } from '@shared/errors/errors.js';
+
+/**
+ * Users Controller Class
+ *
+ * Handles HTTP requests for user operations.
+ */
+class UsersController {
+  /**
+   * Upload avatar handler
+   *
+   * POST /api/v1/users/avatar
+   * Requires: multipart/form-data with file field
+   * Auth: Required (JWT)
+   *
+   * @param request - Fastify request (authenticated)
+   * @param reply - Fastify reply
+   */
+  async uploadAvatar(request: AuthenticatedRequest, reply: FastifyReply): Promise<void> {
+    // Get uploaded file from multipart request
+    const data = await request.file();
+
+    if (!data) {
+      throw new BadRequestError('No file uploaded', 'NO_FILE');
+    }
+
+    // Validate file (MIME type, extension)
+    validateImageFile(data);
+
+    // Read file buffer
+    const buffer = await data.toBuffer();
+
+    // Validate file size
+    validateFileSize(buffer);
+
+    // Get authenticated user ID
+    const userId = request.user.userId;
+
+    logger.info({
+      msg: 'Avatar upload request',
+      userId,
+      filename: data.filename,
+      mimetype: data.mimetype,
+      size: buffer.length,
+    });
+
+    // Call service to process and save avatar
+    const updatedUser = await usersService.uploadAvatar(userId, buffer, data.filename);
+
+    return reply.send(
+      successResponse('Avatar uploaded successfully', {
+        avatarUrl: updatedUser.avatarUrl,
+      })
+    );
+  }
+
+  /**
+   * Delete avatar handler
+   *
+   * DELETE /api/v1/users/avatar
+   * Auth: Required (JWT)
+   *
+   * @param request - Fastify request (authenticated)
+   * @param reply - Fastify reply
+   */
+  async deleteAvatar(request: AuthenticatedRequest, reply: FastifyReply): Promise<void> {
+    // Get authenticated user ID
+    const userId = request.user.userId;
+
+    logger.info({ msg: 'Avatar delete request', userId });
+
+    // Call service to delete avatar
+    await usersService.deleteAvatar(userId);
+
+    return reply.send(successResponse('Avatar deleted successfully', null));
+  }
+
+  /**
+   * Get avatar handler
+   *
+   * GET /api/v1/users/:userId/avatar
+   * Auth: Not required (public endpoint)
+   *
+   * Returns the avatar file directly or 404 if not found.
+   *
+   * @param request - Fastify request
+   * @param reply - Fastify reply
+   */
+  async getAvatar(
+    request: FastifyRequest<{ Params: GetUserAvatarParams }>,
+    reply: FastifyReply
+  ): Promise<void> {
+    const { userId } = request.params;
+
+    logger.info({ msg: 'Avatar fetch request', userId });
+
+    // Get avatar file path
+    const { path: filePath } = await usersService.getAvatar(userId);
+
+    // Send file directly
+    return reply.sendFile(path.basename(filePath), path.dirname(filePath));
+  }
+}
+
+// Export singleton instance
+export const usersController = new UsersController();

package/template/server/src/modules/users/users.repo.ts

@@ -0,0 +1,77 @@
+/**
+ * Users Repository
+ *
+ * Data access layer for user operations.
+ */
+
+import { prisma } from '@libs/prisma.js';
+import type { UserRole } from '@shared/types/index.js';
+
+/**
+ * User selection fields (excludes sensitive data)
+ */
+const userSelect = {
+  id: true,
+  email: true,
+  firstName: true,
+  lastName: true,
+  role: true,
+  avatarUrl: true,
+  isActive: true,
+  createdAt: true,
+  updatedAt: true,
+} as const;
+
+export type SafeUser = {
+  id: string;
+  email: string;
+  firstName: string;
+  lastName: string;
+  role: UserRole;
+  avatarUrl: string | null;
+  isActive: boolean;
+  createdAt: Date;
+  updatedAt: Date;
+};
+
+/**
+ * Users Repository Class
+ *
+ * Handles all database operations for users.
+ */
+class UsersRepository {
+  /**
+   * Gets a user by ID
+   */
+  async getUserById(userId: string): Promise<SafeUser | null> {
+    return prisma.user.findUnique({
+      where: { id: userId, deletedAt: null },
+      select: userSelect,
+    });
+  }
+
+  /**
+   * Updates a user's avatar URL
+   */
+  async updateUserAvatar(userId: string, avatarUrl: string): Promise<SafeUser> {
+    return prisma.user.update({
+      where: { id: userId },
+      data: { avatarUrl },
+      select: userSelect,
+    });
+  }
+
+  /**
+   * Clears a user's avatar URL
+   */
+  async clearUserAvatar(userId: string): Promise<SafeUser> {
+    return prisma.user.update({
+      where: { id: userId },
+      data: { avatarUrl: null },
+      select: userSelect,
+    });
+  }
+}
+
+// Export singleton instance
+export const usersRepository = new UsersRepository();

package/template/server/src/modules/users/users.routes.ts

@@ -0,0 +1,89 @@
+/**
+ * Users Routes
+ *
+ * Defines HTTP routes for user operations.
+ */
+
+import type { FastifyInstance } from 'fastify';
+import { usersController } from './users.controller.js';
+import { GetUserAvatarSchema } from './users.schemas.js';
+import { authenticate } from '@libs/auth.js';
+
+/**
+ * Users routes plugin
+ *
+ * Endpoints:
+ * - POST   /users/avatar       - Upload avatar (authenticated)
+ * - DELETE /users/avatar       - Delete avatar (authenticated)
+ * - GET    /users/:userId/avatar - Get avatar (public)
+ *
+ * @param fastify - Fastify instance
+ */
+export async function usersRoutes(fastify: FastifyInstance): Promise<void> {
+  /**
+   * Upload avatar
+   *
+   * POST /api/v1/users/avatar
+   * Content-Type: multipart/form-data
+   * Body: { file: File }
+   * Auth: Required
+   * Rate limit: 5 requests per minute
+   */
+  fastify.post(
+    '/users/avatar',
+    {
+      preValidation: [authenticate],
+      config: {
+        rateLimit: {
+          max: 5,
+          timeWindow: '1 minute',
+        },
+      },
+    },
+    usersController.uploadAvatar.bind(usersController)
+  );
+
+  /**
+   * Delete avatar
+   *
+   * DELETE /api/v1/users/avatar
+   * Auth: Required
+   * Rate limit: 10 requests per minute
+   */
+  fastify.delete(
+    '/users/avatar',
+    {
+      preValidation: [authenticate],
+      config: {
+        rateLimit: {
+          max: 10,
+          timeWindow: '1 minute',
+        },
+      },
+    },
+    usersController.deleteAvatar.bind(usersController)
+  );
+
+  /**
+   * Get user avatar
+   *
+   * GET /api/v1/users/:userId/avatar
+   * Auth: Not required (public)
+   * Rate limit: 100 requests per minute per IP
+   */
+  fastify.get<{ Params: { userId: string } }>(
+    '/users/:userId/avatar',
+    {
+      schema: {
+        params: GetUserAvatarSchema,
+      },
+      config: {
+        rateLimit: {
+          max: 100,
+          timeWindow: '1 minute',
+        },
+      },
+    },
+    usersController.getAvatar.bind(usersController)
+  );
+}

package/template/server/src/modules/users/users.schemas.ts

@@ -0,0 +1,21 @@
+/**
+ * Users Module Zod Schemas
+ *
+ * Validation schemas for user endpoints.
+ */
+
+import { z } from 'zod';
+
+/**
+ * Schema for getting a user's avatar
+ *
+ * Validates userId parameter in URL
+ */
+export const GetUserAvatarSchema = z.object({
+  userId: z.string().uuid({ message: 'Invalid user ID format' }),
+});
+
+/**
+ * Type inference from schemas
+ */
+export type GetUserAvatarParams = z.infer<typeof GetUserAvatarSchema>;

package/template/server/src/modules/users/users.service.ts

@@ -0,0 +1,169 @@
+/**
+ * Users Service
+ *
+ * Business logic for user operations.
+ */
+
+import { usersRepository } from './users.repo.js';
+import type { SafeUser } from './users.repo.js';
+import { fileStorageService } from '@libs/storage/file-storage.service.js';
+import { imageOptimizerService } from '@libs/storage/image-optimizer.service.js';
+import { NotFoundError, BadRequestError } from '@shared/errors/errors.js';
+import { logger } from '@libs/logger.js';
+import path from 'path';
+
+/**
+ * Users Service Class
+ *
+ * Handles business logic for user avatar operations.
+ */
+class UsersService {
+  /**
+   * Uploads and sets a user's avatar
+   *
+   * Process:
+   * 1. Get user from database (need first/last name for SEO filename)
+   * 2. Optimize image (resize, compress, convert to WebP)
+   * 3. Generate SEO-friendly filename
+   * 4. Save to user-specific directory
+   * 5. Update user record with avatar URL
+   *
+   * @param userId - User's unique ID
+   * @param fileBuffer - Uploaded image buffer
+   * @param originalFilename - Original filename (for logging)
+   * @returns Updated user with new avatar URL
+   * @throws NotFoundError if user not found
+   */
+  async uploadAvatar(
+    userId: string,
+    fileBuffer: Buffer,
+    originalFilename: string
+  ): Promise<SafeUser> {
+    // Get current user
+    const user = await usersRepository.getUserById(userId);
+    if (!user) {
+      throw new NotFoundError('User not found', 'USER_NOT_FOUND');
+    }
+
+    logger.info({
+      msg: 'Processing avatar upload',
+      userId,
+      originalFilename,
+      fileSize: fileBuffer.length,
+    });
+
+    // Optimize image (resize, compress, convert to WebP)
+    const optimizedBuffer = await imageOptimizerService.optimizeAvatar(fileBuffer);
+
+    // Save to user-specific directory with SEO-friendly filename
+    const { filename, url } = await fileStorageService.saveAvatar(
+      userId,
+      optimizedBuffer,
+      user.firstName,
+      user.lastName
+    );
+
+    logger.info({
+      msg: 'Avatar file saved',
+      userId,
+      filename,
+      url,
+    });
+
+    // Update user record with avatar URL
+    const updatedUser = await usersRepository.updateUserAvatar(userId, url);
+
+    logger.info({ msg: 'Avatar upload complete', userId, avatarUrl: url });
+
+    return updatedUser;
+  }
+
+  /**
+   * Deletes a user's avatar
+   *
+   * Process:
+   * 1. Get user from database
+   * 2. Verify user has an avatar
+   * 3. Delete avatar directory from file system
+   * 4. Clear avatar URL in database
+   *
+   * @param userId - User's unique ID
+   * @throws NotFoundError if user not found
+   * @throws BadRequestError if user has no avatar to delete
+   */
+  async deleteAvatar(userId: string): Promise<void> {
+    // Get current user
+    const user = await usersRepository.getUserById(userId);
+    if (!user) {
+      throw new NotFoundError('User not found', 'USER_NOT_FOUND');
+    }
+
+    // Check if user has an avatar
+    if (!user.avatarUrl) {
+      throw new BadRequestError('User has no avatar to delete', 'NO_AVATAR');
+    }
+
+    logger.info({ msg: 'Deleting user avatar', userId, avatarUrl: user.avatarUrl });
+
+    // Delete avatar directory and all contents
+    await fileStorageService.deleteAvatar(userId);
+
+    // Clear avatar URL in database
+    await usersRepository.clearUserAvatar(userId);
+
+    logger.info({ msg: 'Avatar deleted successfully', userId });
+  }
+
+  /**
+   * Gets a user's avatar file path
+   *
+   * Process:
+   * 1. Get user from database
+   * 2. Verify user has an avatar
+   * 3. Extract filename from avatar URL
+   * 4. Build and verify file path
+   *
+   * @param userId - User's unique ID
+   * @returns Absolute file path and public URL
+   * @throws NotFoundError if user not found or has no avatar
+   */
+  async getAvatar(userId: string): Promise<{ path: string; url: string }> {
+    // Get user
+    const user = await usersRepository.getUserById(userId);
+    if (!user) {
+      throw new NotFoundError('User not found', 'USER_NOT_FOUND');
+    }
+
+    // Check if user has an avatar
+    if (!user.avatarUrl) {
+      throw new NotFoundError('User has no avatar', 'NO_AVATAR');
+    }
+
+    // Extract filename from URL (last segment)
+    // URL format: /uploads/avatars/{userId}/{filename}
+    const filename = path.basename(user.avatarUrl);
+
+    // Build full file path
+    const filePath = fileStorageService.getAvatarPath(userId, filename);
+
+    // Verify file exists on disk
+    const exists = await fileStorageService.fileExists(filePath);
+    if (!exists) {
+      logger.error({
+        msg: 'Avatar file missing from disk',
+        userId,
+        avatarUrl: user.avatarUrl,
+        filePath,
+      });
+      throw new NotFoundError('Avatar file not found on disk', 'AVATAR_FILE_NOT_FOUND');
+    }
+
+    return {
+      path: filePath,
+      url: user.avatarUrl,
+    };
+  }
+}
+
+// Export singleton instance
+export const usersService = new UsersService();