create-zhx-monorepo 0.2.2 → 2.0.0

package/templates/monorepo-starter/server/src/modules/token/token.service.ts

@@ -1,131 +1,260 @@
-import { Injectable } from "@nestjs/common";
-import { JwtService } from "@nestjs/jwt";
-import { expiryDate } from "@utils/general.util";
-import { PrismaService } from "@modules/prisma/prisma.service";
-import { UserRole } from "@generated/prisma";
-import { EnvService } from "@modules/env/env.service";
+import { ulid } from "ulid";
+import argon2 from "argon2";
 import type { Request, Response } from "express";
-import { CookieService } from "@utils/cookie.util";
+import { SignJWT, jwtVerify, type JWTPayload } from "jose";
+import { Injectable, UnauthorizedException } from "@nestjs/common";
+import { futureDate } from "@workspace/shared/utils";
+import { Prisma, UserRole } from "@generated/prisma";
+import type { SessionUncheckedCreateInput } from "prisma/generated/models";
 
-export interface TokenPayload {
+import { CookieService } from "@/utils/cookie.util";
+import { ClientService } from "@/utils/client.utils";
+import { EnvService } from "@/modules/env/env.service";
+import { PrismaService } from "@/modules/prisma/prisma.service";
+
+type TokenType = "accessToken" | "refreshToken";
+
+export interface JwtPayload {
   sub: string;
-  roles: UserRole[];
+  sid: string;
+  rol: UserRole;
+  sts: UserStatus;
 }
 
 interface TokensType {
   accessToken: string;
   refreshToken: string;
-  tokenId: string;
+  deviceId: string;
 }
 
 @Injectable()
 export class TokenService {
+  private encoder = new TextEncoder();
+  private readonly accessSecret;
+  private readonly refreshSecret;
+
   constructor(
-    private readonly jwtService: JwtService,
     private readonly env: EnvService,
     private readonly prisma: PrismaService,
-    private readonly cookieService: CookieService
-  ) {}
-
-  async generateTokens(req: Request, payload: TokenPayload) {
-    const [accessToken, refreshToken] = await Promise.all([
-      this.jwtService.signAsync(payload, {
-        secret: this.env.get("JWT_ACCESS_SECRET"),
-        expiresIn: this.env.get("ACCESS_TOKEN_EXP"),
-      }),
-      this.jwtService.signAsync(payload, {
-        secret: this.env.get("JWT_REFRESH_SECRET"),
-        expiresIn: this.env.get("REFRESH_TOKEN_EXP"),
-      }),
-    ]);
-
-    const tokenId = req.cookies["tokenId"] || "undefined";
-    const refreshExp = expiryDate(this.env.get("REFRESH_TOKEN_EXP"), true);
-
-    const tokenData = {
-      token: refreshToken,
+    private readonly cookieService: CookieService,
+    private readonly client: ClientService,
+  ) {
+    this.accessSecret = this.encoder.encode(this.env.get("JWT_ACCESS_SECRET"));
+    this.refreshSecret = this.encoder.encode(
+      this.env.get("JWT_REFRESH_SECRET"),
+    );
+  }
+
+  async generateTokens(req: Request, user: Express.User) {
+    const ctx = await this.client.resolve(req);
+    const isTrusted = req.headers["x-trusted-device"] === "true";
+    const refreshExp = futureDate(this.env.get("REFRESH_TOKEN_EXP"));
+    const deviceId =
+      req.cookies["deviceId"] ?? req.headers["x-device-id"] ?? ulid();
+
+    const payload: JWTPayload & JwtPayload = {
+      sid: user.sessionId ?? ulid(),
+      sub: user.id,
+      rol: user.role,
+      sts: user.status,
+    };
+
+    const accessToken = await new SignJWT(payload)
+      .setProtectedHeader({ alg: "HS256" })
+      .setIssuedAt()
+      .setExpirationTime(this.env.get("ACCESS_TOKEN_EXP"))
+      .sign(this.accessSecret);
+
+    const refreshToken = await new SignJWT(payload)
+      .setProtectedHeader({ alg: "HS256" })
+      .setIssuedAt()
+      .setExpirationTime(this.env.get("REFRESH_TOKEN_EXP"))
+      .sign(this.refreshSecret);
+
+    const refreshTokenHash = await argon2.hash(refreshToken);
+
+    const tokenData: SessionUncheckedCreateInput = {
+      ...ctx,
+      deviceId,
+      id: payload.sid,
       userId: payload.sub,
-      ip: req.ip || "Unknown IP",
-      userAgent: req.headers["user-agent"] || "Unknown User Agent",
-      lastUsed: new Date(),
-      blacklisted: false,
-      isActive: true,
+      refreshTokenHash,
+      status: "active",
+      lastSeenAt: new Date(),
       expiresAt: refreshExp,
     };
 
-    const newToken = await this.prisma.refreshToken.upsert({
-      where: { id: tokenId },
+    const where = user.sessionId
+      ? { id: user.sessionId }
+      : { userId_deviceId: { userId: user.id, deviceId } };
+
+    await this.prisma.session.upsert({
+      where,
       update: tokenData,
-      create: tokenData,
+      create: { ...tokenData, isTrusted },
     });
 
-    return { accessToken, refreshToken, tokenId: newToken.id };
+    return { accessToken, refreshToken, deviceId, payload, isTrusted };
   }
 
-  async verifyToken(
-    token: string,
-    type: "access" | "refresh"
-  ): Promise<TokenPayload | null> {
+  async verifyToken(req: Request, type: TokenType): Promise<JwtPayload> {
+    const token = req.cookies[type] as string;
+
     const secret =
-      type === "access"
-        ? this.env.get("JWT_ACCESS_SECRET")
-        : this.env.get("JWT_REFRESH_SECRET");
+      type === "accessToken" ? this.accessSecret : this.refreshSecret;
+
+    if (!token) {
+      throw new UnauthorizedException({
+        errorCode:
+          type === "accessToken" ? "access_token_missing" : "session_expired",
+      });
+    }
+
     try {
-      return await this.jwtService.verifyAsync<TokenPayload>(token, { secret });
-    } catch (error) {
-      return null;
+      const { payload } = await jwtVerify<JWTPayload & JwtPayload>(
+        token,
+        secret,
+      );
+      return payload;
+    } catch {
+      throw new UnauthorizedException({
+        errorCode: "unauthorized",
+      });
     }
   }
 
-  async refreshTokens(req: Request, res: Response, payload: TokenPayload) {
+  async refreshTokens(req: Request, res: Response, payload: JwtPayload) {
     const refreshToken = req.cookies["refreshToken"];
 
-    const tokenRecord = await this.prisma.refreshToken.findUnique({
-      where: { token: refreshToken, blacklisted: false },
-    });
+    await this.prisma.$transaction(async (tx) => {
+      const session = await tx.session.findUnique({
+        where: { id: payload.sid },
+      });
 
-    if (!tokenRecord) {
-      throw new Error("Invalid or expired refresh token.");
-    }
+      if (!session || session.status !== "active") {
+        throw new UnauthorizedException({ errorCode: "session_expired" });
+      }
 
-    await this.createAuthSession(req, res, {
-      id: payload.sub,
-      roles: payload.roles,
+      if (session.expiresAt <= new Date()) {
+        await tx.session.update({
+          where: { id: payload.sid },
+          data: { status: "expired" },
+        });
+        throw new UnauthorizedException({ errorCode: "session_expired" });
+      }
+
+      const isValid = await argon2.verify(
+        session.refreshTokenHash,
+        refreshToken,
+      );
+
+      const IS_PROD = this.env.get("NODE_ENV") === "production";
+
+      if (!isValid && IS_PROD) {
+        await this.revokeSession(session.id, undefined, tx);
+        throw new UnauthorizedException({ errorCode: "session_expired" });
+      }
+
+      await this.createAuthSession(req, res, {
+        id: payload.sub,
+        role: payload.rol,
+        status: payload.sts,
+        sessionId: payload.sid,
+      });
     });
   }
 
   async createAuthSession(req: Request, res: Response, user: Express.User) {
-    const tokens = await this.generateTokens(req, {
-      sub: user.id,
-      roles: user.roles,
-    });
-    this.setAuthCookies(res, tokens);
-    return tokens;
+    const tokens = await this.generateTokens(req, user);
+    this.setAuthCookies(res, tokens, tokens.isTrusted);
+    this.attachAuthContext(req, tokens.payload);
   }
 
-  attachDecodedUser = (req: Request, decoded: TokenPayload) => {
-    if (decoded) req["user"] = { id: decoded.sub, roles: decoded.roles };
+  attachAuthContext = (req: Request, payload: JwtPayload) => {
+    req["user"] = {
+      id: payload.sub,
+      role: payload.rol,
+      status: payload.sts,
+      sessionId: payload.sid,
+    };
   };
 
-  setAuthCookies(res: Response, tokens: TokensType): void {
-    const { accessToken, refreshToken, tokenId } = tokens;
-    const accessExp = expiryDate(this.env.get("ACCESS_TOKEN_EXP"), true);
-    const refreshExp = expiryDate(this.env.get("REFRESH_TOKEN_EXP"), true);
+  setAuthCookies(res: Response, tokens: TokensType, isTrusted: boolean): void {
+    const { accessToken, refreshToken, deviceId } = tokens;
+    const accessExp = futureDate(this.env.get("ACCESS_TOKEN_EXP"));
+    const refreshExp = futureDate(this.env.get("REFRESH_TOKEN_EXP"));
 
     this.cookieService.setCookie(res, "accessToken", accessToken, {
       expires: accessExp,
     });
     this.cookieService.setCookie(res, "refreshToken", refreshToken, {
-      expires: refreshExp,
+      expires: isTrusted ? refreshExp : undefined,
     });
-    this.cookieService.setCookie(res, "tokenId", tokenId, {
-      expires: refreshExp,
+    this.cookieService.setCookie(res, "deviceId", deviceId, {
+      expires: futureDate("1y"),
     });
   }
 
   clearAuthCookies(res: Response): void {
     res.clearCookie("accessToken");
     res.clearCookie("refreshToken");
-    res.clearCookie("tokenId");
+  }
+
+  async getUserSessions(user: Express.User) {
+    const sessions = await this.prisma.session.findMany({
+      where: { userId: user.id },
+      orderBy: { lastSeenAt: "desc" },
+      select: {
+        id: true,
+        ip: true,
+        isp: true,
+        location: true,
+        timezone: true,
+        deviceType: true,
+        deviceInfo: true,
+
+        status: true,
+        isTrusted: true,
+        lastSeenAt: true,
+        createdAt: true,
+        expiresAt: true,
+        revokedAt: true,
+      },
+    });
+
+    const currentSessionId = user.sessionId;
+
+    const sortedSessions = sessions.sort((a, b) => {
+      if (a.id === currentSessionId) return -1;
+      if (b.id === currentSessionId) return 1;
+      return 0;
+    });
+
+    return { message: "Session Fetched Successfully.", data: sortedSessions };
+  }
+
+  async revokeSession(
+    sessionId: string,
+    res?: Response,
+    tx?: Prisma.TransactionClient,
+  ) {
+    if (!tx) tx = this.prisma;
+    await tx.session.updateMany({
+      where: { id: sessionId, status: "active" },
+      data: { status: "revoked", revokedAt: new Date() },
+    });
+
+    if (res) this.clearAuthCookies(res);
+
+    return { message: "Session Revoked Successfully." };
+  }
+
+  async revokeAllSessions(user: Express.User) {
+    await this.prisma.session.updateMany({
+      where: { userId: user.id, status: "active", NOT: { id: user.sessionId } },
+      data: { status: "revoked", revokedAt: new Date() },
+    });
+
+    return { message: "All Session Revoked Successfully." };
   }
 }

package/templates/monorepo-starter/server/src/modules/user/user.controller.ts

@@ -0,0 +1,21 @@
+import { type Request } from "express";
+import { Body, Controller, Get, Put } from "@nestjs/common";
+import { UserProfileDto } from "@workspace/contracts/user";
+
+import { UserService } from "./user.service";
+import { User } from "@/decorators/user.decorator";
+
+@Controller("user")
+export class UserController {
+  constructor(private readonly userService: UserService) {}
+
+  @Get()
+  async getCurrentUser(@User("id") userId: string) {
+    return this.userService.getCurrentUser(userId);
+  }
+
+  @Put()
+  async updateUserProfile(@Body() dto: UserProfileDto, req: Request) {
+    return this.userService.updateUserProfile(dto, req);
+  }
+}

package/templates/monorepo-starter/server/src/modules/user/user.module.ts

@@ -0,0 +1,12 @@
+import { Module } from "@nestjs/common";
+
+import { UserService } from "./user.service";
+import { UserController } from "./user.controller";
+import { AuthModule } from "@/modules/auth/auth.module";
+
+@Module({
+  imports: [AuthModule],
+  providers: [UserService],
+  controllers: [UserController],
+})
+export class UserModule {}

package/templates/monorepo-starter/server/src/modules/user/user.service.ts

@@ -0,0 +1,38 @@
+import { type Request } from "express";
+import { Injectable } from "@nestjs/common";
+
+import { AuthService } from "@/modules/auth/auth.service";
+import { PrismaService } from "@/modules/prisma/prisma.service";
+
+@Injectable()
+export class UserService {
+  constructor(
+    private readonly authService: AuthService,
+    private readonly prisma: PrismaService,
+  ) {}
+
+  async getCurrentUser(userId: string) {
+    const user = await this.prisma.user.findUniqueOrThrow({
+      where: { id: userId },
+      ...this.authService.userView,
+    });
+
+    return {
+      message: "User Fetched Successfully.",
+      data: user,
+    };
+  }
+
+  async updateUserProfile(dto: UserProfileDto, req: Request) {
+    const userId = req.user!.id;
+
+    await this.prisma.user.update({
+      where: { id: userId },
+      data: dto,
+    });
+
+    return {
+      message: "Profile Updated Successfully.",
+    };
+  }
+}

package/templates/monorepo-starter/server/src/types/express.d.ts

@@ -1,10 +1,14 @@
-import { UserRole } from "@generated/prisma";
+import type { UserStatus, UserRole } from "@generated/prisma";
 
 declare global {
   namespace Express {
     interface User {
       id: string;
-      roles: UserRole[];
+      role: UserRole;
+      status: UserStatus;
+      sessionId?: string;
     }
   }
 }
+
+export {};

package/templates/monorepo-starter/server/src/types/index.ts

@@ -0,0 +1,5 @@
+declare global {
+  type IdentifierType = "email" | "phone";
+}
+
+export {};

package/templates/monorepo-starter/server/tsconfig.json

@@ -1,23 +1,28 @@
 {
-  "extends": "@workspace/config/typescript/nest",
+  "extends": "@workspace/config/typescript/node",
   "compilerOptions": {
     "baseUrl": ".",
     "outDir": "dist",
     "paths": {
       "@/*": ["src/*"],
-      "@modules/*" : ["src/modules/*"],
-      "@decorators/*": ["src/lib/decorators/*"],
-      "@dto/*": ["src/lib/dto/*"],
-      "@filters/*": ["src/lib/filters/*"],
-      "@guards/*": ["src/lib/guards/*"],
-      "@interceptors/*": ["src/lib/interceptors/*"],
-      "@pipes/*": ["src/lib/pipes/*"],
-      "@schemas/*": ["src/lib/schemas/*"],
-      "@templates/*": ["src/lib/templates/*"],
-      "@utils/*": ["src/lib/utils/*"],
+      "@/decorators/*": ["src/lib/decorators/*"],
+      "@/dto/*": ["src/lib/dto/*"],
+      "@/filters/*": ["src/lib/filters/*"],
+      "@/guards/*": ["src/lib/guards/*"],
+      "@/middleware/*": ["src/lib/middleware/*"],
+      "@/interceptors/*": ["src/lib/interceptors/*"],
+      "@/pipes/*": ["src/lib/pipes/*"],
+      "@/schemas/*": ["src/lib/schemas/*"],
+      "@/templates/*": ["src/lib/templates/*"],
+      "@/utils/*": ["src/lib/utils/*"],
+      "@/constants/*": ["src/lib/constants/*"],
       "@generated/prisma": ["./prisma/generated/client"]
     }
   },
-  "include": ["**/*.ts"],
+  "include": [
+    "**/*.ts",
+    "../packages/templates/src/types/global.d.ts",
+    "../packages/contracts/src/**/*types.d.ts"
+  ],
   "exclude": ["node_modules", "dist"]
 }

package/templates/monorepo-starter/server/tsup.config.ts

@@ -3,12 +3,17 @@ import { defineConfig } from "tsup";
 export default defineConfig({
   entry: ["src/main.ts"],
   outDir: "dist",
-  target: "es2022",
+  target: "es2024",
   format: ["esm"],
   splitting: false,
   sourcemap: true,
   clean: true,
-  dts: true,
+  dts: false,
   minify: false,
   onSuccess: "node dist/main.js",
+  external: [
+    "@workspace/shared",
+    "@workspace/contracts",
+    "@workspace/templates",
+  ],
 });

package/templates/monorepo-starter/tsconfig.json

@@ -1,3 +1,3 @@
 {
-  "extends": "@workspace/config/typescript/base"
+  "extends": "@workspace/config/typescript/node"
 }

package/templates/monorepo-starter/turbo.json

@@ -5,7 +5,7 @@
     "build": {
       "dependsOn": ["^build"],
       "inputs": ["$TURBO_DEFAULT$", ".env*"],
-      "outputs": [".next/**", "!.next/cache/**"]
+      "outputs": [".next/**", "!.next/cache/**", "dist/**"]
     },
     "lint": {
       "dependsOn": ["^lint"]

package/templates/monorepo-starter/apps/web/eslint.config.mjs

@@ -1,4 +0,0 @@
-import { config } from "@workspace/config/eslint/next";
-
-/** @type {import("eslint").Linter.Config} */
-export default config;

package/templates/monorepo-starter/apps/web/src/app/(auth)/layout.tsx

@@ -1,7 +0,0 @@
-import React from "react";
-
-const AuthLayout = ({ children }: LayoutProps) => {
-  return <div>{children}</div>;
-}
-
-export default AuthLayout;

package/templates/monorepo-starter/apps/web/src/app/globals.css

@@ -1 +0,0 @@
-@import "tailwindcss";

package/templates/monorepo-starter/apps/web/src/components/ThemeSwitch.tsx

@@ -1,34 +0,0 @@
-"use client";
-
-import * as React from "react";
-import { Moon, Sun } from "lucide-react";
-import { useTheme } from "next-themes";
-import { Button, type ButtonProps } from "@workspace/ui/components/button";
-
-function ThemeSwitch(props: ButtonProps) {
-  const { setTheme, theme, systemTheme } = useTheme();
-
-  const currentTheme = theme === "system" ? systemTheme : theme;
-
-  const toggleTheme = () =>
-    setTheme(currentTheme === "dark" ? "light" : "dark");
-
-  return (
-    <Button
-      variant="outline"
-      size="icon"
-      className="rounded-full"
-      {...props}
-      onClick={toggleTheme}
-    >
-      {currentTheme === "dark" ? (
-        <Moon className="text-white" />
-      ) : (
-        <Sun className="text-black" />
-      )}
-      <span className="sr-only">Toggle theme</span>
-    </Button>
-  );
-}
-
-export default ThemeSwitch;

package/templates/monorepo-starter/apps/web/src/providers/index.tsx

@@ -1,10 +0,0 @@
-"use client";
-
-import React from "react";
-import ThemeProvider from "./theme";
-
-function Provider({ children }: { children: React.ReactNode }) {
-  return <ThemeProvider>{children}</ThemeProvider>;
-}
-
-export default Provider;

package/templates/monorepo-starter/apps/web/src/types/index.d.ts

@@ -1,16 +0,0 @@
-
-
- interface SegmentParams {
-    [key: string]: string;
-  }
-
-  type TSearchParams = Record<string, string | string[] | undefined>;
-
-  interface PageProps {
-    params: Promise<SegmentParams>;
-    searchParams: Promise<TSearchParams>;
-   }
-
-  interface LayoutProps extends PageProps {
-    children?: React.ReactNode;
-  }

package/templates/monorepo-starter/packages/config/eslint/base.js

@@ -1,31 +0,0 @@
-import js from "@eslint/js";
-import eslintConfigPrettier from "eslint-config-prettier";
-import turboPlugin from "eslint-plugin-turbo";
-import tseslint from "typescript-eslint";
-
-/** @type {import("eslint").Linter.Config} */
-export const config = [
-  js.configs.recommended,
-  eslintConfigPrettier,
-  ...tseslint.configs.recommended,
-  {
-    plugins: { turbo: turboPlugin },
-    rules: {
-      "turbo/no-undeclared-env-vars": "error",
-    },
-  },
-  {
-    ignores: [
-      "dist/**",
-      "build/**",
-      "coverage/**",
-      "node_modules/**",
-      ".next/**",
-    ],
-  },
-  {
-    languageOptions: {
-      sourceType: "module",
-    },
-  },
-];

package/templates/monorepo-starter/packages/config/eslint/nest.js

@@ -1,26 +0,0 @@
-import tseslint from "typescript-eslint";
-import globals from "globals";
-import { config as baseConfig } from "./base.js";
-
-/** @type {import("eslint").Linter.Config} */
-export const config = [
-  ...baseConfig,
-  {
-    languageOptions: {
-      globals: {
-        ...globals.node,
-      },
-      sourceType: "module",
-    },
-  },
-  {
-    rules: {
-      "@typescript-eslint/no-explicit-any": "off",
-      "@typescript-eslint/no-floating-promises": "error",
-      "@typescript-eslint/no-unsafe-argument": "error",
-    },
-  },
-  {
-    ignores: ["test/**"],
-  },
-];