nestforge-generator 0.1.0

package/templates/drizzle/src/auth/drizzle-session.store.ts

@@ -0,0 +1,263 @@
+// nestforge:feature-file:auth:session
+import { Injectable } from '@nestjs/common';
+import {
+    and,
+    count,
+    eq,
+    gt,
+    isNull,
+} from 'drizzle-orm';
+import {
+    Store,
+    type SessionData,
+} from 'express-session';
+import { InjectDatabase } from '../database/database.decorators';
+import type { DrizzleDatabase } from '../database/database.types';
+import { sessions } from '../database/schema';
+
+type StoreCallback = (error?: unknown) => void;
+
+type GetCallback = (
+    error: unknown,
+    session?: SessionData | null,
+) => void;
+
+type AllCallback = (
+    error: unknown,
+    sessions?:
+        | SessionData[]
+        | Record<string, SessionData>
+        | null,
+) => void;
+
+type LengthCallback = (
+    error: unknown,
+    length?: number,
+) => void;
+
+@Injectable()
+export class DrizzleSessionStore extends Store {
+    constructor(
+        @InjectDatabase()
+        private readonly database: DrizzleDatabase,
+    ) {
+        super();
+    }
+
+    async get(
+        sessionId: string,
+        callback: GetCallback,
+    ): Promise<void> {
+        try {
+            const [storedSession] =
+                await this.database
+                    .select()
+                    .from(sessions)
+                    .where(
+                        and(
+                            eq(sessions.id, sessionId),
+                            gt(sessions.expiredAt, Date.now()),
+                            isNull(sessions.destroyedAt),
+                        ),
+                    )
+                    .limit(1);
+
+            if (!storedSession) {
+                callback(null, null);
+                return;
+            }
+
+            const sessionData = JSON.parse(
+                storedSession.json,
+            ) as SessionData;
+
+            callback(null, sessionData);
+        } catch (error) {
+            callback(error);
+        }
+    }
+
+    async set(
+        sessionId: string,
+        sessionData: SessionData,
+        callback?: StoreCallback,
+    ): Promise<void> {
+        try {
+            const values = {
+                id: sessionId,
+                expiredAt:
+                    this.resolveExpiration(sessionData),
+                json: JSON.stringify(sessionData),
+                destroyedAt: null,
+            };
+
+            // nestforge:feature:database:postgres
+            await this.database
+                .insert(sessions)
+                .values(values)
+                .onConflictDoUpdate({
+                    target: sessions.id,
+                    set: {
+                        expiredAt: values.expiredAt,
+                        json: values.json,
+                        destroyedAt: null,
+                    },
+                });
+            // nestforge:feature:database:postgres:end
+
+            // nestforge:feature:database:mysql
+            await this.database
+                .insert(sessions)
+                .values(values)
+                .onDuplicateKeyUpdate({
+                    set: {
+                        expiredAt: values.expiredAt,
+                        json: values.json,
+                        destroyedAt: null,
+                    },
+                });
+            // nestforge:feature:database:mysql:end
+
+            // nestforge:feature:database:sqlite
+            await this.database
+                .insert(sessions)
+                .values(values)
+                .onConflictDoUpdate({
+                    target: sessions.id,
+                    set: {
+                        expiredAt: values.expiredAt,
+                        json: values.json,
+                        destroyedAt: null,
+                    },
+                });
+            // nestforge:feature:database:sqlite:end
+
+            callback?.();
+        } catch (error) {
+            callback?.(error);
+        }
+    }
+
+    async destroy(
+        sessionId: string,
+        callback?: StoreCallback,
+    ): Promise<void> {
+        try {
+            await this.database
+                .delete(sessions)
+                .where(eq(sessions.id, sessionId));
+
+            callback?.();
+        } catch (error) {
+            callback?.(error);
+        }
+    }
+
+    async touch(
+        sessionId: string,
+        sessionData: SessionData,
+        callback?: StoreCallback,
+    ): Promise<void> {
+        try {
+            await this.database
+                .update(sessions)
+                .set({
+                    expiredAt:
+                        this.resolveExpiration(sessionData),
+                    json: JSON.stringify(sessionData),
+                })
+                .where(eq(sessions.id, sessionId));
+
+            callback?.();
+        } catch (error) {
+            callback?.(error);
+        }
+    }
+
+    async all(
+        callback: AllCallback,
+    ): Promise<void> {
+        try {
+            const storedSessions =
+                await this.database
+                    .select({
+                        json: sessions.json,
+                    })
+                    .from(sessions)
+                    .where(
+                        and(
+                            gt(sessions.expiredAt, Date.now()),
+                            isNull(sessions.destroyedAt),
+                        ),
+                    );
+
+            const sessionData = storedSessions.map(
+                (storedSession) =>
+                    JSON.parse(
+                        storedSession.json,
+                    ) as SessionData,
+            );
+
+            callback(null, sessionData);
+        } catch (error) {
+            callback(error);
+        }
+    }
+
+    async length(
+        callback: LengthCallback,
+    ): Promise<void> {
+        try {
+            const [result] = await this.database
+                .select({
+                    value: count(),
+                })
+                .from(sessions)
+                .where(
+                    and(
+                        gt(sessions.expiredAt, Date.now()),
+                        isNull(sessions.destroyedAt),
+                    ),
+                );
+
+            callback(null, result?.value ?? 0);
+        } catch (error) {
+            callback(error);
+        }
+    }
+
+    async clear(
+        callback?: StoreCallback,
+    ): Promise<void> {
+        try {
+            await this.database.delete(sessions);
+            callback?.();
+        } catch (error) {
+            callback?.(error);
+        }
+    }
+
+    private resolveExpiration(
+        sessionData: SessionData,
+    ): number {
+        const expires = sessionData.cookie.expires;
+
+        if (expires) {
+            return new Date(expires).getTime();
+        }
+
+        const maxAge = sessionData.cookie.maxAge;
+
+        if (
+            typeof maxAge === 'number' &&
+            maxAge > 0
+        ) {
+            return Date.now() + maxAge;
+        }
+
+        return (
+            Date.now() +
+            7 * 24 * 60 * 60 * 1000
+        );
+    }
+}

package/templates/drizzle/src/auth/dto/forgot-password.dto.ts

@@ -0,0 +1,9 @@
+// nestforge:feature-file:redis,auth:password
+import { z } from 'zod';
+import { createZodDto } from 'nestjs-zod';
+
+export const forgotPasswordSchema = z.object({
+    email: z.string().email().describe('E-mail da conta a ser recuperada'),
+});
+
+export class ForgotPasswordDto extends createZodDto(forgotPasswordSchema) { }

package/templates/drizzle/src/auth/dto/login.dto.ts

@@ -0,0 +1,10 @@
+// nestforge:feature-file:auth:password
+import { z } from 'zod';
+import { createZodDto } from 'nestjs-zod';
+
+export const loginSchema = z.object({
+  email: z.string().email().describe('E-mail do usuário'),
+  password: z.string().min(8).describe('Senha'),
+});
+
+export class LoginDto extends createZodDto(loginSchema) { }

package/templates/drizzle/src/auth/dto/refresh-token.dto.ts

@@ -0,0 +1,9 @@
+// nestforge:feature-file:auth:token
+import { z } from 'zod';
+import { createZodDto } from 'nestjs-zod';
+
+export const refreshTokenSchema = z.object({
+  refreshToken: z.string().describe('Refresh token emitido no login'),
+});
+
+export class RefreshTokenDto extends createZodDto(refreshTokenSchema) { }

package/templates/drizzle/src/auth/dto/register.dto.ts

@@ -0,0 +1,11 @@
+// nestforge:feature-file:auth:password
+import { z } from 'zod';
+import { createZodDto } from 'nestjs-zod';
+
+export const registerSchema = z.object({
+  name: z.string().min(2).describe('Nome completo do usuário'),
+  email: z.string().email().describe('E-mail do usuário'),
+  password: z.string().min(8).describe('Senha (mínimo 8 caracteres)'),
+});
+
+export class RegisterDto extends createZodDto(registerSchema) { }

package/templates/drizzle/src/auth/dto/reset-password.dto.ts

@@ -0,0 +1,10 @@
+// nestforge:feature-file:redis,auth:password
+import { z } from 'zod';
+import { createZodDto } from 'nestjs-zod';
+
+export const resetPasswordSchema = z.object({
+    token: z.string().describe('Token recebido por e-mail'),
+    password: z.string().min(8).describe('Nova senha (mínimo 8 caracteres)'),
+});
+
+export class ResetPasswordDto extends createZodDto(resetPasswordSchema) { }

package/templates/drizzle/src/auth/guards/github-auth.guard.ts

@@ -0,0 +1,10 @@
+import { Injectable } from '@nestjs/common';
+import { AuthGuard } from '@nestjs/passport';
+
+@Injectable()
+export class GithubAuthGuard extends AuthGuard('github') {
+    constructor() {
+        // API stateless (Bearer token) — não usamos sessão do Passport/Express
+        super({ session: false });
+    }
+}

package/templates/drizzle/src/auth/guards/google-auth.guard.ts

@@ -0,0 +1,10 @@
+import { Injectable } from '@nestjs/common';
+import { AuthGuard } from '@nestjs/passport';
+
+@Injectable()
+export class GoogleAuthGuard extends AuthGuard('google') {
+    constructor() {
+        // API stateless (Bearer token) — não usamos sessão do Passport/Express
+        super({ session: false });
+    }
+}

package/templates/drizzle/src/auth/guards/jwt-auth.guard.ts

@@ -0,0 +1,25 @@
+// nestforge:feature-file:auth:token
+import { ExecutionContext, Injectable } from '@nestjs/common';
+import { Reflector } from '@nestjs/core';
+import { AuthGuard } from '@nestjs/passport';
+import { IS_PUBLIC_KEY } from '../../common/decorators/public.decorator';
+
+@Injectable()
+export class JwtAuthGuard extends AuthGuard('jwt') {
+  constructor(private reflector: Reflector) {
+    super();
+  }
+
+  canActivate(context: ExecutionContext) {
+    const isPublic = this.reflector.getAllAndOverride<boolean>(IS_PUBLIC_KEY, [
+      context.getHandler(),
+      context.getClass(),
+    ]);
+
+    if (isPublic) {
+      return true;
+    }
+
+    return super.canActivate(context);
+  }
+}

package/templates/drizzle/src/auth/guards/session-auth.guard.spec.ts

@@ -0,0 +1,77 @@
+// nestforge:feature-file:auth:session
+import {
+    ExecutionContext,
+    UnauthorizedException,
+} from '@nestjs/common';
+import { Reflector } from '@nestjs/core';
+import { Request } from 'express';
+import { beforeEach, describe, expect, it, vi } from 'vitest';
+import { SessionAuthGuard } from './session-auth.guard';
+
+describe('SessionAuthGuard', () => {
+    let reflector: {
+        getAllAndOverride: ReturnType<typeof vi.fn>;
+    };
+    let guard: SessionAuthGuard;
+
+    beforeEach(() => {
+        reflector = {
+            getAllAndOverride: vi.fn(),
+        };
+
+        guard = new SessionAuthGuard(reflector as unknown as Reflector);
+    });
+
+    function createContext(user?: {
+        id: string;
+        email: string;
+        role: string;
+    }) {
+        const request = {
+            session: {
+                user,
+            },
+        } as unknown as Request;
+
+        const context = {
+            getHandler: vi.fn(),
+            getClass: vi.fn(),
+            switchToHttp: vi.fn(() => ({
+                getRequest: () => request,
+            })),
+        } as unknown as ExecutionContext;
+
+        return { context, request };
+    }
+
+    it('permite acesso a rotas públicas sem sessão', () => {
+        reflector.getAllAndOverride.mockReturnValue(true);
+        const { context } = createContext();
+
+        expect(guard.canActivate(context)).toBe(true);
+    });
+
+    it('rejeita acesso quando não existe usuário na sessão', () => {
+        reflector.getAllAndOverride.mockReturnValue(false);
+        const { context } = createContext();
+
+        expect(() => guard.canActivate(context)).toThrow(
+            UnauthorizedException,
+        );
+    });
+
+    it('permite acesso e disponibiliza o usuário autenticado', () => {
+        reflector.getAllAndOverride.mockReturnValue(false);
+
+        const user = {
+            id: 'user-1',
+            email: 'jeiel@example.com',
+            role: 'USER',
+        };
+
+        const { context, request } = createContext(user);
+
+        expect(guard.canActivate(context)).toBe(true);
+        expect(request.user).toEqual(user);
+    });
+});

package/templates/drizzle/src/auth/guards/session-auth.guard.ts

@@ -0,0 +1,37 @@
+// nestforge:feature-file:auth:session
+import {
+    CanActivate,
+    ExecutionContext,
+    Injectable,
+    UnauthorizedException,
+} from '@nestjs/common';
+import { Reflector } from '@nestjs/core';
+import { Request } from 'express';
+import { IS_PUBLIC_KEY } from '../../common/decorators/public.decorator';
+
+@Injectable()
+export class SessionAuthGuard implements CanActivate {
+    constructor(private readonly reflector: Reflector) { }
+
+    canActivate(context: ExecutionContext): boolean {
+        const isPublic = this.reflector.getAllAndOverride<boolean>(IS_PUBLIC_KEY, [
+            context.getHandler(),
+            context.getClass(),
+        ]);
+
+        if (isPublic) {
+            return true;
+        }
+
+        const request = context.switchToHttp().getRequest<Request>();
+        const user = request.session?.user;
+
+        if (!user) {
+            throw new UnauthorizedException('Sessão inválida ou expirada');
+        }
+
+        request.user = user;
+
+        return true;
+    }
+}

package/templates/drizzle/src/auth/session.service.spec.ts

@@ -0,0 +1,74 @@
+// nestforge:feature-file:auth:session
+import { Request } from 'express';
+import { beforeEach, describe, expect, it, vi } from 'vitest';
+import { SessionService, SessionUser } from './session.service';
+
+describe('SessionService', () => {
+    let sessionService: SessionService;
+
+    beforeEach(() => {
+        sessionService = new SessionService();
+    });
+
+    function createRequest() {
+        const session = {
+            user: undefined,
+            csrfToken: undefined as string | undefined,
+            regenerate: vi.fn(
+                (callback: (error?: Error) => void) => callback(),
+            ),
+            save: vi.fn(
+                (callback: (error?: Error) => void) => callback(),
+            ),
+            destroy: vi.fn(
+                (callback: (error?: Error) => void) => callback(),
+            ),
+        };
+
+        return {
+            request: { session } as unknown as Request,
+            session,
+        };
+    }
+
+    it('regenera, preenche e salva a sessão', async () => {
+        const { request, session } = createRequest();
+        const user: SessionUser = {
+            id: 'user-1',
+            email: 'jeiel@example.com',
+            role: 'USER',
+        };
+
+        const result = await sessionService.establish(request, user);
+
+        expect(session.regenerate).toHaveBeenCalledOnce();
+        expect(session.user).toEqual(user);
+        expect(session.save).toHaveBeenCalledOnce();
+        expect(session.csrfToken).toMatch(/^[a-f0-9]{64}$/);
+        expect(result).toEqual({
+            user,
+            csrfToken: session.csrfToken,
+        });
+    });
+
+    it('emite e salva um novo token CSRF', async () => {
+        const { request, session } = createRequest();
+
+        const result = await sessionService.issueCsrfToken(request);
+
+        expect(result.csrfToken).toMatch(/^[a-f0-9]{64}$/);
+        expect(session.csrfToken).toBe(result.csrfToken);
+        expect(session.save).toHaveBeenCalledOnce();
+    });
+
+    it('destrói a sessão atual', async () => {
+        const { request, session } = createRequest();
+
+        const result = await sessionService.destroy(request);
+
+        expect(session.destroy).toHaveBeenCalledOnce();
+        expect(result).toEqual({
+            message: 'Logout realizado com sucesso',
+        });
+    });
+});

package/templates/drizzle/src/auth/session.service.ts

@@ -0,0 +1,96 @@
+// nestforge:feature-file:auth:session
+import {
+    Injectable,
+    InternalServerErrorException,
+} from '@nestjs/common';
+import { Request } from 'express';
+import { randomBytes } from 'node:crypto';
+
+export interface SessionUser {
+    id: string;
+    email: string;
+    role: string;
+}
+
+@Injectable()
+export class SessionService {
+    async establish(request: Request, user: SessionUser) {
+        await this.regenerate(request);
+
+        const csrfToken = this.generateCsrfToken();
+
+        request.session.user = user;
+        request.session.csrfToken = csrfToken;
+
+        await this.save(request);
+
+        return { user, csrfToken };
+    }
+
+    async issueCsrfToken(request: Request) {
+        const csrfToken = this.generateCsrfToken();
+
+        request.session.csrfToken = csrfToken;
+
+        await this.save(request);
+
+        return { csrfToken };
+    }
+
+    private generateCsrfToken(): string {
+        return randomBytes(32).toString('hex');
+    }
+
+    async destroy(request: Request) {
+        await new Promise<void>((resolve, reject) => {
+            request.session.destroy((error) => {
+                if (error) {
+                    reject(
+                        new InternalServerErrorException(
+                            'Não foi possível encerrar a sessão',
+                        ),
+                    );
+                    return;
+                }
+
+                resolve();
+            });
+        });
+
+        return { message: 'Logout realizado com sucesso' };
+    }
+
+    private async regenerate(request: Request): Promise<void> {
+        await new Promise<void>((resolve, reject) => {
+            request.session.regenerate((error) => {
+                if (error) {
+                    reject(
+                        new InternalServerErrorException(
+                            'Não foi possível iniciar a sessão',
+                        ),
+                    );
+                    return;
+                }
+
+                resolve();
+            });
+        });
+    }
+
+    private async save(request: Request): Promise<void> {
+        await new Promise<void>((resolve, reject) => {
+            request.session.save((error) => {
+                if (error) {
+                    reject(
+                        new InternalServerErrorException(
+                            'Não foi possível salvar a sessão',
+                        ),
+                    );
+                    return;
+                }
+
+                resolve();
+            });
+        });
+    }
+}

package/templates/drizzle/src/auth/strategies/github.strategy.ts

@@ -0,0 +1,41 @@
+import { Injectable } from '@nestjs/common';
+import { PassportStrategy } from '@nestjs/passport';
+import { Strategy, Profile } from 'passport-github2';
+import { OAuthProfile } from './google.strategy';
+import { ConfigService } from '@nestjs/config';
+
+@Injectable()
+export class GithubStrategy extends PassportStrategy(Strategy, 'github') {
+    constructor(configService: ConfigService) {
+        super({
+            clientID: configService.getOrThrow<string>('GITHUB_CLIENT_ID'),
+            clientSecret: configService.getOrThrow<string>(
+                'GITHUB_CLIENT_SECRET',
+            ),
+            callbackURL: `${configService.getOrThrow<string>(
+                'APP_URL',
+            )}/auth/github/callback`,
+            scope: ['user:email'],
+        });
+    }
+
+    async validate(
+        _accessToken: string,
+        _refreshToken: string,
+        profile: Profile,
+        done: (error: unknown, user?: OAuthProfile) => void,
+    ) {
+        // o e-mail pode vir vazio se o usuário deixou o e-mail privado no GitHub
+        const email =
+            profile.emails?.[0]?.value ?? `${profile.username}@users.noreply.github.com`;
+
+        const oauthProfile: OAuthProfile = {
+            provider: 'github',
+            providerUserId: profile.id,
+            email,
+            name: profile.displayName || profile.username || 'Usuário GitHub',
+        };
+
+        done(null, oauthProfile);
+    }
+}