create-zhx-monorepo 0.2.2 → 2.0.0

package/templates/monorepo-starter/server/src/modules/auth/auth.service.ts

@@ -1,84 +1,33 @@
 import {
   BadRequestException,
+  ForbiddenException,
   Injectable,
   UnauthorizedException,
 } from "@nestjs/common";
-import type { Request, Response } from "express";
 import argon2 from "argon2";
-import { PrismaService } from "@modules/prisma/prisma.service";
-import {
-  ChangeIdentifierDto,
-  RequestOtpDto,
-  ResetPasswordDto,
-  SignInDto,
-  SignUpDto,
-  ValidateOtpDto,
-} from "@dto/auth.dto";
-import { TokenService } from "@modules/token/token.service";
-import { Prisma, type User } from "@generated/prisma";
+import type { Request, Response } from "express";
+import type { UserStatus } from "@generated/prisma";
+
 import { OtpService } from "./otp.service";
-import { NotificationService } from "@modules/notification/notification.service";
-import { LoggerService } from "@modules/logger/logger.service";
-import { InjectLogger } from "@decorators/logger.decorator";
+import { PrismaService } from "@/modules/prisma/prisma.service";
+import { TokenService } from "@/modules/token/token.service";
+import { NotificationService } from "@/modules/notification/notification.service";
 
 @Injectable()
 export class AuthService {
-  @InjectLogger()
-  private readonly logger!: LoggerService;
-
   constructor(
     private readonly prisma: PrismaService,
     private readonly tokenService: TokenService,
     private readonly otpService: OtpService,
-    private readonly notifyService: NotificationService
+    private readonly notifyService: NotificationService,
   ) {}
 
   async signUp(dto: SignUpDto) {
-    const { key, value, query } = this.parseIdentifier(dto.identifier);
-    this.logger.log(`🔐 Sign-up attempt`, {
-      identifier: dto.identifier,
-    });
-
-    const existingUser = await this.prisma.user.findUnique({
-      where: query,
-    });
-
-    if (existingUser) {
-      throw new BadRequestException(`${key} already in use.`);
+    if (!dto.password) {
+      throw new BadRequestException("Password should not be empty.");
     }
 
-    const hashedPassword = await this.hashPassword(dto.password);
-
-    const newUser = await this.prisma.user.create({
-      data: {
-        [key]: value,
-        password: hashedPassword,
-        firstName: dto.firstName,
-        lastName: dto.lastName,
-        displayName: `${dto.firstName} ${dto.lastName}`.trim(),
-        username: dto.username,
-        roles: { create: [{ role: "customer" }] },
-      },
-    });
-
-    await this.otpService.sendOtp({
-      userId: newUser.id,
-      identifier: value,
-      purpose: "verifyIdentifier",
-      metadata: { user: newUser },
-    });
-
-    await this.notifyService.sendNotification({
-      userId: newUser.id,
-      purpose: "signup",
-      to: value,
-      metadata: { user: newUser },
-    });
-
-    this.logger.log(`✅ Sign-up success`, {
-      userId: newUser.id,
-      identifier: dto.identifier,
-    });
+    const { key } = await this.createUser(dto, "customer");
 
     return {
       message: `User created successfully. Please verify your ${key}.`,
@@ -86,61 +35,55 @@ export class AuthService {
   }
 
   async signIn(dto: SignInDto, req: Request, res: Response) {
-    const { user, key, value } = await this.findUserByIdentifier(
+    const { user, key, value, meta } = await this.findUserFail404(
       dto.identifier,
-      {
-        roles: true,
-        securitySetting: true,
-      }
     );
 
-    this.logger.log(`🔐 Sign-in attempt`, {
-      identifier: dto.identifier,
-    });
-
-    if (!user.password) {
+    if (!meta.password) {
       await this.otpService.sendOtp({
-        userId: user.id,
-        purpose: "setPassword",
+        purpose: "authSetPassword",
         identifier: value,
-        type: "token",
-        metadata: { user },
+        type: "secureToken",
+        meta: { user },
       });
 
       throw new UnauthorizedException(
-        "Password not set. Please set your password to continue."
+        "Password not set. Please set your password to continue.",
       );
     }
 
+    if (!dto.password) {
+      throw new BadRequestException("Password should not be empty.");
+    }
+
     const isPasswordValid = await this.verifyPassword(
       dto.password,
-      user.password
+      meta.password,
     );
 
     if (!isPasswordValid) {
       throw new UnauthorizedException("Invalid credentials");
     }
 
+    this.checkUserStatus(user.status);
     await this.checkVerificationStatus(user, key, value, "unverified");
 
-    if (user.securitySetting?.isMfaEnabled) {
-      const otp = await this.otpService.sendOtp({
-        userId: user.id,
+    if (user.preferredMfa) {
+      await this.otpService.sendOtp({
         identifier: value,
-        purpose: "verifyMfa",
-        metadata: { user },
+        purpose: "authVerifyMfa",
+        meta: { user },
       });
       return {
         message: "MFA code sent. Please verify to complete login.",
-        data: { secret: otp.secret },
+        action: "verifyMfa",
       };
     }
 
-    const roles = user.roles.map((r) => r.role);
-
     await this.tokenService.createAuthSession(req, res, {
       id: user.id,
-      roles: roles,
+      role: user.role,
+      status: user.status,
     });
 
     await this.prisma.user.update({
@@ -148,111 +91,114 @@ export class AuthService {
       data: { lastLoginAt: new Date() },
     });
 
-    await this.notifyService.sendNotification({
-      userId: user.id,
-      purpose: "signin",
-      to: value,
-      metadata: { user },
-    });
+    if (user.loginAlerts) {
+      await this.notifyService.sendNotification({
+        purpose: "authSignIn",
+        to: value,
+        meta: { user },
+      });
+    }
 
-    this.logger.log(`✅ Sign-in success`, {
-      userId: user.id,
-      identifier: dto.identifier,
-    });
     return {
       message: "Signed in successfully",
-      data: { id: user.id, roles: roles },
     };
   }
 
-  async signOut(req: Request, res: Response) {
-    const refreshToken = req.cookies.refreshToken;
-    const tokenId = req.cookies.tokenId;
-
-    if (refreshToken && tokenId) {
-      await this.prisma.refreshToken.update({
-        where: { token: refreshToken, id: tokenId },
-        data: { blacklisted: true },
-      });
-    }
-
-    this.tokenService.clearAuthCookies(res);
-    this.logger.log("🚪 User signed out", { tokenId });
-
+  async signOut(sessionId: string, res: Response) {
+    await this.tokenService.revokeSession(sessionId, res);
     return { message: "Signed out successfully" };
   }
 
   async requestOtp(dto: RequestOtpDto) {
-    const { user, key, value } = await this.findUserByIdentifier(
+    const { user, key, value, meta } = await this.findUserFail404(
       dto.identifier,
-      { securitySetting: true }
     );
 
-    if (dto.purpose === "verifyIdentifier") {
-      await this.checkVerificationStatus(user, key, value, "verified");
-      await this.otpService.sendOtp({
-        userId: user.id,
-        identifier: value,
-        purpose: dto.purpose,
-        metadata: { user },
-      });
-      return { message: `Verification OTP sent.` };
-    }
+    console.log("request received", dto.purpose);
 
-    if (dto.purpose.includes("Password")) {
-      if (dto.purpose === "setPassword" && user.password) {
-        throw new BadRequestException(
-          "Password already set. Use resetPassword."
-        );
-      } else if (dto.purpose === "resetPassword" && !user.password) {
-        throw new BadRequestException("No password set. Use setPassword.");
-      }
+    switch (dto.purpose) {
+      case "authVerifyIdentifier": {
+        await this.checkVerificationStatus(user, key, value, "verified");
 
-      await this.otpService.sendOtp({
-        userId: user.id,
-        identifier: value,
-        purpose: dto.purpose,
-        metadata: { user },
-      });
-      return { message: `${dto.purpose} OTP sent.` };
-    }
+        await this.otpService.sendOtp({
+          identifier: value,
+          purpose: dto.purpose,
+          meta: { user },
+        });
 
-    if (dto.purpose === "changeIdentifier") {
-      await this.otpService.sendOtp({
-        userId: user.id,
-        identifier: value,
-        purpose: dto.purpose,
-        metadata: { user },
-      });
-      return { message: `Change ${key} Otp Send` };
-    }
+        return { message: "Verification OTP sent." };
+      }
 
-    if (dto.purpose.includes("Mfa")) {
-      if (dto.purpose === "enableMfa") {
-        if (user.securitySetting?.isMfaEnabled) {
-          throw new BadRequestException("MFA is already enabled.");
+      case "authSetPassword":
+      case "authResetPassword": {
+        if (dto.purpose === "authSetPassword" && meta.password) {
+          throw new BadRequestException(
+            "Password already set. Use resetPassword.",
+          );
         }
-      } else if (dto.purpose === "disableMfa") {
-        if (!user.securitySetting?.isMfaEnabled) {
+
+        await this.otpService.sendOtp({
+          identifier: value,
+          purpose: dto.purpose,
+          meta: { user },
+        });
+
+        return { message: `${dto.purpose} OTP sent.` };
+      }
+
+      case "authUpdateIdentifier": {
+        await this.otpService.sendOtp({
+          identifier: value,
+          purpose: dto.purpose,
+          meta: { user },
+        });
+
+        return { message: `Update ${key} OTP sent.` };
+      }
+
+      case "authUpdateMfa": {
+        await this.otpService.sendOtp({
+          identifier: value,
+          purpose: dto.purpose,
+          meta: { user },
+        });
+
+        return {
+          message: `Mfa ${user.preferredMfa ? "Change" : "Enable"} OTP sent.`,
+        };
+      }
+
+      case "authDisableMfa": {
+        if (!user.preferredMfa) {
           throw new BadRequestException("MFA is already disabled.");
         }
+
+        await this.otpService.sendOtp({
+          identifier: value,
+          purpose: dto.purpose,
+          meta: { user },
+        });
+
+        return { message: "disableMfa OTP sent." };
+      }
+
+      case "authVerifyMfa": {
+        await this.otpService.sendOtp({
+          identifier: value,
+          purpose: dto.purpose,
+          meta: { user },
+        });
+
+        return { message: "verifyMfa OTP sent." };
       }
-      await this.otpService.sendOtp({
-        userId: user.id,
-        identifier: value,
-        purpose: dto.purpose,
-        metadata: { user },
-      });
-      return { message: `${dto.purpose} OTP sent.` };
-    }
 
-    throw new BadRequestException(`Invalid purpose: ${dto.purpose}`);
+      default:
+        throw new BadRequestException(`Invalid purpose: ${dto.purpose}`);
+    }
   }
 
   async validateOtp(dto: ValidateOtpDto, req: Request, res: Response) {
-    const { key, value, user } = await this.findUserByIdentifier(
-      dto.identifier
-    );
+    const { key, value, user } = await this.findUserFail404(dto.identifier);
 
     await this.otpService.verifyOtp({
       userId: user.id,
@@ -261,102 +207,114 @@ export class AuthService {
       type: dto.type,
     });
 
-    if (dto.purpose === "verifyIdentifier") {
-      await this.prisma.user.update({
-        where: { id: user.id },
-        data:
-          key === "email"
-            ? { isEmailVerified: true }
-            : { isPhoneVerified: true },
-      });
+    switch (dto.purpose) {
+      case "authVerifyIdentifier": {
+        await this.prisma.user.update({
+          where: { id: user.id },
+          data:
+            key === "email"
+              ? { isEmailVerified: true }
+              : { isPhoneVerified: true },
+        });
 
-      return { message: `${key} verified successfully.` };
-    }
+        return { message: `${key} verified successfully.` };
+      }
 
-    if (dto.purpose.includes("Password")) {
-      const otp = await this.otpService.sendOtp({
-        userId: user.id,
-        identifier: value,
-        purpose: dto.purpose,
-        type: "token",
-        notify: false,
-        metadata: { user },
-      });
-      return {
-        message: "OTP validated successfully.",
-        data: { secret: otp.secret },
-      };
-    }
+      case "authSetPassword":
+      case "authResetPassword": {
+        const otp = await this.otpService.sendOtp({
+          identifier: value,
+          purpose: dto.purpose,
+          type: "secureToken",
+          notify: false,
+          meta: { user },
+        });
 
-    if (dto.purpose === "changeIdentifier") {
-      const otp = await this.otpService.sendOtp({
-        userId: user.id,
-        identifier: value,
-        purpose: dto.purpose,
-        type: "token",
-        notify: false,
-        metadata: { user },
-      });
+        return {
+          message: "OTP validated successfully.",
+          meta: { secret: otp.secret },
+        };
+      }
 
-      return {
-        message: "OTP validated successfully.",
-        data: { secret: otp.secret },
-      };
-    }
+      case "authUpdateIdentifier": {
+        const otp = await this.otpService.sendOtp({
+          identifier: value,
+          purpose: dto.purpose,
+          type: "secureToken",
+          notify: false,
+          meta: { user },
+        });
+
+        return {
+          message: "OTP validated successfully.",
+          meta: { secret: otp.secret },
+        };
+      }
+
+      case "authUpdateMfa": {
+        const otp = await this.otpService.sendOtp({
+          identifier: value,
+          purpose: dto.purpose,
+          type: "secureToken",
+          notify: false,
+          meta: { user },
+        });
 
-    if (dto.purpose.includes("Mfa")) {
-      //TODO add logic enable mfa
-      if (dto.purpose === "enableMfa") {
-        await this.prisma.securitySetting.update({
-          where: { userId: user.id },
-          data: { isMfaEnabled: true }, // TODO add mfa method details
+        return {
+          message: "OTP verified. Setup MFA details.",
+          meta: { secret: otp.secret },
+        };
+      }
+
+      case "authDisableMfa": {
+        await this.prisma.user.update({
+          where: { id: user.id },
+          data: { preferredMfa: null },
         });
-      } else if (dto.purpose === "disableMfa") {
-        await this.prisma.securitySetting.update({
-          where: { userId: user.id },
-          data: { isMfaEnabled: false },
+
+        await this.notifyService.sendNotification({
+          to: dto.identifier,
+          purpose: dto.purpose,
+          meta: { user },
         });
-      } else if (dto.purpose === "verifyMfa") {
-        const roles = user.roles.map((r) => r.role);
+
+        return { message: "disableMfa successfully." };
+      }
+
+      case "authVerifyMfa": {
+        this.checkUserStatus(user.status);
 
         await this.tokenService.createAuthSession(req, res, {
           id: user.id,
-          roles: roles,
+          role: user.role,
+          status: user.status,
+        });
+
+        await this.prisma.user.update({
+          where: { id: user.id },
+          data: { lastLoginAt: new Date() },
         });
 
         return {
           message: "MFA verified. Signed in successfully.",
-          data: { id: user.id, roles: roles },
         };
       }
 
-      await this.notifyService.sendNotification({
-        userId: user.id,
-        to: dto.identifier,
-        purpose: dto.purpose,
-        metadata: { user },
-      });
-
-      return { message: `${dto.purpose} Successfully` };
+      default:
+        throw new BadRequestException(`Invalid purpose: ${dto.purpose}`);
     }
-
-    throw new BadRequestException(`Invalid purpose: ${dto.purpose}`);
   }
 
   async resetPassword(dto: ResetPasswordDto) {
-    const { user } = await this.findUserByIdentifier(dto.identifier);
+    const { user } = await this.findUserFail404(dto.identifier);
 
-    const isTokenValid = await this.otpService.verifyOtp({
+    await this.otpService.verifyOtp({
       userId: user.id,
       purpose: dto.purpose,
       secret: dto.secret,
-      type: "token",
+      type: "secureToken",
     });
 
-    if (!isTokenValid) {
-      throw new BadRequestException("Invalid Token");
-    }
-
     const hashedPassword = await this.hashPassword(dto.newPassword);
 
     await this.prisma.user.update({
@@ -365,127 +323,215 @@ export class AuthService {
     });
 
     await this.notifyService.sendNotification({
-      userId: user.id,
       to: dto.identifier,
       purpose: dto.purpose,
-      metadata: { user },
+      meta: { user },
     });
 
-    this.logger.log(`🔑 Password reset successful`, { userId: user.id });
-
-    return { message: "Password reset successfully" };
+    return {
+      message: `Password ${dto.purpose.split("Password")[0]} successfully`,
+    };
   }
 
-  async changeIdentifierReq(dto: ChangeIdentifierDto) {
-    const { user } = await this.findUserByIdentifier(dto.identifier);
+  async updateMfa(dto: UpdateMfaDto) {
+    const { user } = await this.findUserFail404(dto.identifier);
 
-    const {
-      key: newKey,
-      value: newValue,
-      query: newQuery,
-    } = this.parseIdentifier(dto.newIdentifier);
+    await this.otpService.verifyOtp({
+      userId: user.id,
+      purpose: dto.purpose,
+      secret: dto.secret,
+      type: "secureToken",
+    });
+
+    await this.prisma.user.update({
+      where: { id: user.id },
+      data: { preferredMfa: dto.preferredMfa },
+    });
 
-    const existingUser = await this.prisma.user.findFirst({
-      where: newQuery,
+    await this.notifyService.sendNotification({
+      to: dto.identifier,
+      purpose: dto.purpose,
+      meta: { user },
     });
 
-    if (existingUser) {
-      throw new BadRequestException(`${newKey} already in use.`);
-    }
+    return {
+      message: `Mfa ${user.preferredMfa ? "Updated" : "Enabled"} successfully.`,
+    };
+  }
 
-    const isTokenValid = await this.otpService.verifyOtp({
+  async requestUpdateIdentifier(dto: UpdateIdentifierDto) {
+    const { user, key, value } = await this.findUserFail404(dto.identifier);
+
+    const { key: newKey, value: newValue } = await this.findUserFail200(
+      dto.newIdentifier,
+    );
+
+    await this.otpService.verifyOtp({
       userId: user.id,
       purpose: dto.purpose,
       secret: dto.secret,
-      type: "token",
+      type: "secureToken",
     });
 
-    if (!isTokenValid) {
-      throw new BadRequestException("Invalid Token");
-    }
+    const isSameType = key === newKey;
+    const action = isSameType ? "change" : "update";
 
     await this.otpService.sendOtp({
-      userId: user.id,
       identifier: newValue,
       purpose: dto.purpose,
-      metadata: { user },
-    });
-
-    this.logger.log("🔄 Identifier change requested", {
-      userId: user.id,
-      newIdentifier: dto.newIdentifier,
+      type: "secureToken",
+      meta: { user, identifier: value, newIdentifier: newValue },
     });
 
     return {
-      message: `Link sent to new ${newKey}. Please verify to complete the change.`,
+      message: `Link sent to new ${newKey}. Please verify to complete the ${action}.`,
     };
   }
 
-  async changeIdentifier(dto: ChangeIdentifierDto) {
-    const { user, key } = await this.findUserByIdentifier(dto.identifier);
+  async verifyUpdateIdentifier(dto: UpdateIdentifierDto) {
+    const { user } = await this.findUserFail404(dto.identifier);
 
-    await this.otpService.verifyOtp({
+    const otp = await this.otpService.verifyOtp({
       userId: user.id,
       purpose: dto.purpose,
       secret: dto.secret,
-      type: "token",
+      type: "secureToken",
     });
 
+    const newIdentifier = (otp.meta as Record<string, string>)?.newIdentifier;
+
+    if (!newIdentifier || newIdentifier !== dto.newIdentifier) {
+      throw new BadRequestException("Invalid identifier update token.");
+    }
+
+    const { key } = this.parseIdentifier(newIdentifier);
+
     await this.prisma.user.update({
       where: { id: user.id },
-      data: { [key]: dto.newIdentifier },
+      data: {
+        [key]: newIdentifier,
+      },
     });
 
-    await this.prisma.refreshToken.updateMany({
-      where: { userId: user.id },
-      data: { blacklisted: true },
+    await this.tokenService.revokeAllSessions(user);
+    await this.notifyService.sendNotification({
+      to: dto.identifier,
+      purpose: dto.purpose,
+      meta: {
+        user,
+        identifier: dto.identifier,
+        newIdentifier: dto.newIdentifier,
+      },
     });
 
     await this.notifyService.sendNotification({
-      userId: user.id,
       to: dto.newIdentifier,
       purpose: dto.purpose,
-      metadata: {
+      meta: {
         user,
         identifier: dto.identifier,
         newIdentifier: dto.newIdentifier,
       },
     });
 
-    this.logger.log("✅ Identifier changed successfully", { userId: user.id });
-
     return { message: `${key} changed successfully.` };
   }
 
-  private async hashPassword(password: string): Promise<string> {
+  async createUser(dto: SignUpDto, role: UserRole) {
+    const { key, value } = await this.findUserFail200(dto.identifier);
+
+    const hashedPassword = dto.password
+      ? await this.hashPassword(dto.password)
+      : undefined;
+
+    const user = await this.prisma.user.create({
+      data: {
+        [key]: value,
+        password: hashedPassword,
+        firstName: dto.firstName,
+        lastName: dto.lastName,
+        displayName: `${dto.firstName} ${dto.lastName}`.trim(),
+        role,
+      },
+      ...this.userView,
+    });
+
+    await this.notifyService.sendNotification({
+      purpose: "authSignUp",
+      to: value,
+      meta: { user },
+    });
+
+    await this.otpService.sendOtp({
+      identifier: value,
+      purpose: "authVerifyIdentifier",
+      meta: { user },
+    });
+
+    return { user, key };
+  }
+
+  async hashPassword(password: string): Promise<string> {
     return argon2.hash(password);
   }
 
   private async verifyPassword(
     password: string,
-    hash: string
+    hash: string,
   ): Promise<boolean> {
     return argon2.verify(hash, password);
   }
 
-  private async findUserByIdentifier(
-    identifier: string,
-    include: Prisma.UserInclude = {}
-  ) {
-    const { key, value, query } = this.parseIdentifier(identifier);
+  async findUserFail404(i: string) {
+    const { key, value, query } = this.parseIdentifier(i);
+
+    const user = await this.prisma.user.findUniqueOrThrow({
+      where: query,
+    });
+
+    if (!user) {
+      throw new BadRequestException("User Not Found");
+    }
+
+    const { password, ...reset } = user;
+    return {
+      key,
+      value,
+      user: reset,
+      meta: { password },
+    };
+  }
+
+  private findUserFail200 = async (i: string) => {
+    const { key, value, query } = this.parseIdentifier(i);
     const user = await this.prisma.user.findUnique({
       where: query,
-      include,
     });
-    if (!user) throw new BadRequestException("User not found");
-    return { user, key, value };
+
+    if (user) {
+      throw new BadRequestException(`${key} already in use.`);
+    }
+
+    return { key, value };
+  };
+
+  checkUserStatus(status: UserStatus) {
+    if (status === "pending") {
+      throw new ForbiddenException(
+        "Your account is pending approval. Please contact support.",
+      );
+    } else if (status === "suspended") {
+      throw new ForbiddenException(
+        "Your account has been suspended. Contact support for assistance.",
+      );
+    }
   }
 
   private async checkVerificationStatus(
-    user: User,
-    key: IdentifierKey,
+    user: SafeUser,
+    key: IdentifierType,
     value: string,
-    check: "verified" | "unverified"
+    check: "verified" | "unverified",
   ) {
     const isVerified =
       key === "email" ? user.isEmailVerified : user.isPhoneVerified;
@@ -496,30 +542,31 @@ export class AuthService {
 
     if (check === "unverified" && !isVerified) {
       await this.otpService.sendOtp({
-        userId: user.id,
         identifier: value,
-        purpose: "verifyIdentifier",
-        metadata: { user },
+        purpose: "authVerifyIdentifier",
+        meta: { user },
       });
-      this.logger.log(
-        "📨 Auto-sent verification OTP due to unverified identifier",
-        { userId: user.id, key, value }
-      );
 
-      throw new UnauthorizedException(`${key} not verified`);
+      throw new UnauthorizedException({
+        message: `${key} not verified`,
+        action: "verifyIdentifier",
+      });
     }
   }
 
-  private parseIdentifier(identifier: string): {
-    key: IdentifierKey;
-    value: string;
-    query: Prisma.UserWhereUniqueInput;
-  } {
-    const isEmail = identifier.includes("@");
-    const key = isEmail ? "email" : "phone";
-    const value = isEmail ? identifier.toLowerCase() : identifier;
+  parseIdentifier(i: string) {
+    const isEmail = i.includes("@");
+    const key: IdentifierType = isEmail ? "email" : "phone";
+    const value = isEmail ? i.toLowerCase() : i;
     const query = key === "email" ? { email: value } : { phone: value };
 
     return { key, value, query };
   }
+
+  userView = {
+    omit: { password: true },
+    include: {
+      image: { include: { uploadedBy: { omit: { password: true } } } },
+    },
+  };
 }