nestforge-generator 0.1.0

package/templates/drizzle/src/auth/strategies/google.strategy.ts

@@ -0,0 +1,43 @@
+import { Injectable } from '@nestjs/common';
+import { PassportStrategy } from '@nestjs/passport';
+import { Strategy, Profile, VerifyCallback } from 'passport-google-oauth20';
+import { ConfigService } from '@nestjs/config';
+
+export interface OAuthProfile {
+    provider: 'google' | 'github';
+    providerUserId: string;
+    email: string;
+    name: string;
+}
+
+@Injectable()
+export class GoogleStrategy extends PassportStrategy(Strategy, 'google') {
+    constructor(configService: ConfigService) {
+        super({
+            clientID: configService.getOrThrow<string>('GOOGLE_CLIENT_ID'),
+            clientSecret: configService.getOrThrow<string>(
+                'GOOGLE_CLIENT_SECRET',
+            ),
+            callbackURL: `${configService.getOrThrow<string>(
+                'APP_URL',
+            )}/auth/google/callback`,
+            scope: ['email', 'profile'],
+        });
+    }
+
+    async validate(
+        _accessToken: string,
+        _refreshToken: string,
+        profile: Profile,
+        done: VerifyCallback,
+    ) {
+        const oauthProfile: OAuthProfile = {
+            provider: 'google',
+            providerUserId: profile.id,
+            email: profile.emails?.[0]?.value ?? '',
+            name: profile.displayName,
+        };
+
+        done(null, oauthProfile);
+    }
+}

package/templates/drizzle/src/auth/strategies/jwt.strategy.ts

@@ -0,0 +1,25 @@
+// nestforge:feature-file:auth:token
+import { Injectable } from '@nestjs/common';
+import { PassportStrategy } from '@nestjs/passport';
+import { ExtractJwt, Strategy } from 'passport-jwt';
+
+export interface JwtPayload {
+  sub: string;
+  email: string;
+  role: string;
+}
+
+@Injectable()
+export class JwtStrategy extends PassportStrategy(Strategy) {
+  constructor() {
+    super({
+      jwtFromRequest: ExtractJwt.fromAuthHeaderAsBearerToken(),
+      ignoreExpiration: false,
+      secretOrKey: process.env.JWT_ACCESS_SECRET as string,
+    });
+  }
+
+  async validate(payload: JwtPayload) {
+    return { id: payload.sub, email: payload.email, role: payload.role };
+  }
+}

package/templates/drizzle/src/auth/token.service.ts

@@ -0,0 +1,175 @@
+// nestforge:feature-file:auth:token
+import {
+    Injectable,
+    UnauthorizedException,
+} from '@nestjs/common';
+import { JwtService } from '@nestjs/jwt';
+import type { JwtSignOptions } from '@nestjs/jwt';
+import {
+    and,
+    eq,
+    isNull,
+} from 'drizzle-orm';
+import {
+    createHash,
+    randomUUID,
+} from 'node:crypto';
+import { InjectDatabase } from '../database/database.decorators';
+import type { DrizzleDatabase } from '../database/database.types';
+import {
+    refreshTokens,
+    users,
+} from '../database/schema';
+
+@Injectable()
+export class TokenService {
+    constructor(
+        @InjectDatabase()
+        private readonly database: DrizzleDatabase,
+        private readonly jwtService: JwtService,
+    ) { }
+
+    async issueTokens(
+        userId: string,
+        email: string,
+        role: string,
+    ) {
+        const payload = {
+            sub: userId,
+            email,
+            role,
+        };
+
+        const refreshPayload = {
+            ...payload,
+            jti: randomUUID(),
+        };
+
+        const accessTokenExpiresIn = (
+            process.env.JWT_ACCESS_EXPIRES_IN ??
+            '15m'
+        ) as JwtSignOptions['expiresIn'];
+
+        const refreshTokenExpiresIn = (
+            process.env.JWT_REFRESH_EXPIRES_IN ??
+            '7d'
+        ) as JwtSignOptions['expiresIn'];
+
+        const accessToken = this.jwtService.sign(
+            payload,
+            {
+                secret: process.env.JWT_ACCESS_SECRET,
+                expiresIn: accessTokenExpiresIn,
+            },
+        );
+
+        const refreshToken = this.jwtService.sign(
+            refreshPayload,
+            {
+                secret: process.env.JWT_REFRESH_SECRET,
+                expiresIn: refreshTokenExpiresIn,
+            },
+        );
+
+        const expiresAt = new Date();
+        expiresAt.setDate(expiresAt.getDate() + 7);
+
+        await this.database
+            .insert(refreshTokens)
+            .values({
+                id: randomUUID(),
+                tokenHash:
+                    this.hashToken(refreshToken),
+                userId,
+                expiresAt,
+                revokedAt: null,
+            });
+
+        return {
+            accessToken,
+            refreshToken,
+        };
+    }
+
+    async refresh(refreshToken: string) {
+        const tokenHash =
+            this.hashToken(refreshToken);
+
+        const [stored] = await this.database
+            .select({
+                id: refreshTokens.id,
+                userId: refreshTokens.userId,
+                expiresAt: refreshTokens.expiresAt,
+                revokedAt: refreshTokens.revokedAt,
+                userEmail: users.email,
+                userRole: users.role,
+            })
+            .from(refreshTokens)
+            .innerJoin(
+                users,
+                eq(refreshTokens.userId, users.id),
+            )
+            .where(
+                eq(refreshTokens.tokenHash, tokenHash),
+            )
+            .limit(1);
+
+        if (
+            !stored ||
+            stored.revokedAt ||
+            stored.expiresAt < new Date()
+        ) {
+            throw new UnauthorizedException(
+                'Refresh token inválido ou expirado',
+            );
+        }
+
+        await this.database
+            .update(refreshTokens)
+            .set({
+                revokedAt: new Date(),
+            })
+            .where(
+                and(
+                    eq(refreshTokens.id, stored.id),
+                    isNull(refreshTokens.revokedAt),
+                ),
+            );
+
+        return this.issueTokens(
+            stored.userId,
+            stored.userEmail,
+            stored.userRole,
+        );
+    }
+
+    async logout(refreshToken: string) {
+        const tokenHash =
+            this.hashToken(refreshToken);
+
+        await this.database
+            .update(refreshTokens)
+            .set({
+                revokedAt: new Date(),
+            })
+            .where(
+                and(
+                    eq(
+                        refreshTokens.tokenHash,
+                        tokenHash,
+                    ),
+                    isNull(refreshTokens.revokedAt),
+                ),
+            );
+
+        return {
+            message: 'Logout realizado com sucesso',
+        };
+    }
+
+    private hashToken(token: string): string {
+        return createHash('sha256')
+            .update(token)
+            .digest('hex');
+    }
+}

package/templates/drizzle/src/common/constants/permissions.ts

@@ -0,0 +1,8 @@
+// nestforge:feature-file:rbac
+export enum Permission {
+    UserCreate = 'user:create',
+    UserRead = 'user:read',
+    UserUpdate = 'user:update',
+    UserDelete = 'user:delete',
+    ReportRead = 'report:read',
+}

package/templates/drizzle/src/common/constants/role-permissions.ts

@@ -0,0 +1,9 @@
+// nestforge:feature-file:rbac
+import { Role } from './role.enum';
+import { Permission } from './permissions';
+
+export const ROLE_PERMISSIONS: Record<Role, Permission[]> = {
+    [Role.ADMIN]: Object.values(Permission),
+    [Role.MANAGER]: [Permission.UserRead, Permission.UserUpdate, Permission.ReportRead],
+    [Role.USER]: [Permission.UserRead],
+};

package/templates/drizzle/src/common/constants/role.enum.ts

@@ -0,0 +1,5 @@
+export enum Role {
+    ADMIN = 'ADMIN',
+    MANAGER = 'MANAGER',
+    USER = 'USER',
+}

package/templates/drizzle/src/common/decorators/current-user.decorator.ts

@@ -0,0 +1,8 @@
+import { createParamDecorator, ExecutionContext } from '@nestjs/common';
+
+export const CurrentUser = createParamDecorator(
+  (data: unknown, ctx: ExecutionContext) => {
+    const request = ctx.switchToHttp().getRequest();
+    return request.user;
+  },
+);

package/templates/drizzle/src/common/decorators/permissions.decorator.ts

@@ -0,0 +1,7 @@
+// nestforge:feature-file:rbac
+import { SetMetadata } from '@nestjs/common';
+import { Permission } from '../constants/permissions';
+
+export const PERMISSIONS_KEY = 'permissions';
+export const Permissions = (...permissions: Permission[]) =>
+    SetMetadata(PERMISSIONS_KEY, permissions);

package/templates/drizzle/src/common/decorators/public.decorator.ts

@@ -0,0 +1,4 @@
+import { SetMetadata } from '@nestjs/common';
+
+export const IS_PUBLIC_KEY = 'isPublic';
+export const Public = () => SetMetadata(IS_PUBLIC_KEY, true);

package/templates/drizzle/src/common/decorators/roles.decorator.ts

@@ -0,0 +1,6 @@
+// nestforge:feature-file:rbac
+import { SetMetadata } from '@nestjs/common';
+import { Role } from '../constants/role.enum';
+
+export const ROLES_KEY = 'roles';
+export const Roles = (...roles: Role[]) => SetMetadata(ROLES_KEY, roles);

package/templates/drizzle/src/common/filters/http-exception.filter.ts

@@ -0,0 +1,34 @@
+import {
+  ArgumentsHost,
+  Catch,
+  ExceptionFilter,
+  HttpException,
+  HttpStatus,
+} from '@nestjs/common';
+import { Request, Response } from 'express';
+
+@Catch()
+export class HttpExceptionFilter implements ExceptionFilter {
+  catch(exception: unknown, host: ArgumentsHost) {
+    const ctx = host.switchToHttp();
+    const response = ctx.getResponse<Response>();
+    const request = ctx.getRequest<Request>();
+
+    const status =
+      exception instanceof HttpException
+        ? exception.getStatus()
+        : HttpStatus.INTERNAL_SERVER_ERROR;
+
+    const message =
+      exception instanceof HttpException
+        ? exception.getResponse()
+        : 'Erro interno do servidor';
+
+    response.status(status).json({
+      statusCode: status,
+      path: request.url,
+      timestamp: new Date().toISOString(),
+      message,
+    });
+  }
+}

package/templates/drizzle/src/common/guards/permissions.guard.spec.ts

@@ -0,0 +1,54 @@
+// nestforge:feature-file:rbac
+import { describe, expect, it, vi } from 'vitest';
+import { ExecutionContext } from '@nestjs/common';
+import { Reflector } from '@nestjs/core';
+import { Role } from '../constants/role.enum';
+import { Permission } from '../constants/permissions';
+import { PermissionsGuard } from './permissions.guard';
+
+function createContext(user?: { role: Role }): ExecutionContext {
+    return {
+        switchToHttp: () => ({ getRequest: () => ({ user }) }),
+        getHandler: () => ({}),
+        getClass: () => ({}),
+    } as unknown as ExecutionContext;
+}
+
+describe('PermissionsGuard', () => {
+    it('libera acesso quando a rota não exige nenhuma permissão', () => {
+        const reflector = { getAllAndOverride: vi.fn().mockReturnValue(undefined) } as unknown as Reflector;
+        const guard = new PermissionsGuard(reflector);
+
+        expect(guard.canActivate(createContext({ role: Role.USER }))).toBe(true);
+    });
+
+    it('libera acesso quando a role do usuário tem a permissão exigida', () => {
+        const reflector = {
+            getAllAndOverride: vi.fn().mockReturnValue([Permission.UserRead]),
+        } as unknown as Reflector;
+        const guard = new PermissionsGuard(reflector);
+
+        expect(guard.canActivate(createContext({ role: Role.USER }))).toBe(true);
+    });
+
+    it('bloqueia acesso quando a role do usuário não tem a permissão exigida', () => {
+        const reflector = {
+            getAllAndOverride: vi.fn().mockReturnValue([Permission.UserDelete]),
+        } as unknown as Reflector;
+        const guard = new PermissionsGuard(reflector);
+
+        expect(guard.canActivate(createContext({ role: Role.USER }))).toBe(false);
+    });
+
+    it('exige todas as permissões quando mais de uma é requisitada', () => {
+        const reflector = {
+            getAllAndOverride: vi.fn().mockReturnValue([Permission.UserRead, Permission.UserUpdate]),
+        } as unknown as Reflector;
+        const guard = new PermissionsGuard(reflector);
+
+        // MANAGER tem user:read e user:update
+        expect(guard.canActivate(createContext({ role: Role.MANAGER }))).toBe(true);
+        // USER só tem user:read
+        expect(guard.canActivate(createContext({ role: Role.USER }))).toBe(false);
+    });
+});

package/templates/drizzle/src/common/guards/permissions.guard.ts

@@ -0,0 +1,28 @@
+// nestforge:feature-file:rbac
+import { CanActivate, ExecutionContext, Injectable } from '@nestjs/common';
+import { Reflector } from '@nestjs/core';
+import { Role } from '../constants/role.enum';
+import { PERMISSIONS_KEY } from '../decorators/permissions.decorator';
+import { Permission } from '../constants/permissions';
+import { ROLE_PERMISSIONS } from '../constants/role-permissions';
+
+@Injectable()
+export class PermissionsGuard implements CanActivate {
+    constructor(private reflector: Reflector) { }
+
+    canActivate(context: ExecutionContext): boolean {
+        const requiredPermissions = this.reflector.getAllAndOverride<Permission[]>(
+            PERMISSIONS_KEY,
+            [context.getHandler(), context.getClass()],
+        );
+
+        if (!requiredPermissions || requiredPermissions.length === 0) {
+            return true;
+        }
+
+        const { user } = context.switchToHttp().getRequest();
+        const userPermissions = ROLE_PERMISSIONS[user?.role as Role] ?? [];
+
+        return requiredPermissions.every((permission) => userPermissions.includes(permission));
+    }
+}

package/templates/drizzle/src/common/guards/roles.guard.spec.ts

@@ -0,0 +1,37 @@
+// nestforge:feature-file:rbac
+import { describe, expect, it, vi } from 'vitest';
+import { ExecutionContext } from '@nestjs/common';
+import { Reflector } from '@nestjs/core';
+import { Role } from '../constants/role.enum';
+import { RolesGuard } from './roles.guard';
+
+function createContext(user?: { role: Role }): ExecutionContext {
+    return {
+        switchToHttp: () => ({ getRequest: () => ({ user }) }),
+        getHandler: () => ({}),
+        getClass: () => ({}),
+    } as unknown as ExecutionContext;
+}
+
+describe('RolesGuard', () => {
+    it('libera acesso quando a rota não exige nenhuma role', () => {
+        const reflector = { getAllAndOverride: vi.fn().mockReturnValue(undefined) } as unknown as Reflector;
+        const guard = new RolesGuard(reflector);
+
+        expect(guard.canActivate(createContext({ role: Role.USER }))).toBe(true);
+    });
+
+    it('libera acesso quando o usuário tem a role exigida', () => {
+        const reflector = { getAllAndOverride: vi.fn().mockReturnValue([Role.ADMIN]) } as unknown as Reflector;
+        const guard = new RolesGuard(reflector);
+
+        expect(guard.canActivate(createContext({ role: Role.ADMIN }))).toBe(true);
+    });
+
+    it('bloqueia acesso quando o usuário não tem a role exigida', () => {
+        const reflector = { getAllAndOverride: vi.fn().mockReturnValue([Role.ADMIN]) } as unknown as Reflector;
+        const guard = new RolesGuard(reflector);
+
+        expect(guard.canActivate(createContext({ role: Role.USER }))).toBe(false);
+    });
+});

package/templates/drizzle/src/common/guards/roles.guard.ts

@@ -0,0 +1,24 @@
+// nestforge:feature-file:rbac
+import { CanActivate, ExecutionContext, Injectable } from '@nestjs/common';
+import { Reflector } from '@nestjs/core';
+import { Role } from '../constants/role.enum';
+import { ROLES_KEY } from '../decorators/roles.decorator';
+
+@Injectable()
+export class RolesGuard implements CanActivate {
+  constructor(private reflector: Reflector) {}
+
+  canActivate(context: ExecutionContext): boolean {
+    const requiredRoles = this.reflector.getAllAndOverride<Role[]>(ROLES_KEY, [
+      context.getHandler(),
+      context.getClass(),
+    ]);
+
+    if (!requiredRoles || requiredRoles.length === 0) {
+      return true;
+    }
+
+    const { user } = context.switchToHttp().getRequest();
+    return requiredRoles.includes(user?.role);
+  }
+}

package/templates/drizzle/src/common/interceptors/logging.interceptor.ts

@@ -0,0 +1,23 @@
+import {
+  CallHandler,
+  ExecutionContext,
+  Injectable,
+  NestInterceptor,
+} from '@nestjs/common';
+import { Observable, tap } from 'rxjs';
+
+@Injectable()
+export class LoggingInterceptor implements NestInterceptor {
+  intercept(context: ExecutionContext, next: CallHandler): Observable<unknown> {
+    const request = context.switchToHttp().getRequest();
+    const { method, url } = request;
+    const start = Date.now();
+
+    return next.handle().pipe(
+      tap(() => {
+        const duration = Date.now() - start;
+        console.log(`[${method}] ${url} - ${duration}ms`);
+      }),
+    );
+  }
+}

package/templates/drizzle/src/common/middleware/csrf.middleware.spec.ts

@@ -0,0 +1,97 @@
+// nestforge:feature-file:auth:session
+import { ForbiddenException } from '@nestjs/common';
+import { NextFunction, Request, Response } from 'express';
+import { beforeEach, describe, expect, it, vi } from 'vitest';
+import { CsrfMiddleware } from './csrf.middleware';
+
+describe('CsrfMiddleware', () => {
+    let middleware: CsrfMiddleware;
+    let response: Response;
+    let next: ReturnType<typeof vi.fn>;
+
+    beforeEach(() => {
+        middleware = new CsrfMiddleware();
+        response = {} as Response;
+        next = vi.fn();
+    });
+
+    function createRequest(
+        method: string,
+        sessionToken?: string,
+        headerToken?: string,
+    ): Request {
+        return {
+            method,
+            session: {
+                csrfToken: sessionToken,
+            },
+            get: vi.fn((header: string) => {
+                if (header.toLowerCase() === 'x-csrf-token') {
+                    return headerToken;
+                }
+
+                return undefined;
+            }),
+        } as unknown as Request;
+    }
+
+    it.each(['GET', 'HEAD', 'OPTIONS'])(
+        'permite o método seguro %s sem token',
+        (method) => {
+            const request = createRequest(method);
+
+            middleware.use(
+                request,
+                response,
+                next as unknown as NextFunction,
+            );
+
+            expect(next).toHaveBeenCalledOnce();
+        },
+    );
+
+    it('rejeita uma requisição sem token CSRF', () => {
+        const request = createRequest('POST');
+
+        expect(() =>
+            middleware.use(
+                request,
+                response,
+                next as unknown as NextFunction,
+            ),
+        ).toThrow(ForbiddenException);
+
+        expect(next).not.toHaveBeenCalled();
+    });
+
+    it('rejeita quando o token do header é diferente da sessão', () => {
+        const request = createRequest(
+            'PATCH',
+            'session-token',
+            'invalid-token',
+        );
+
+        expect(() =>
+            middleware.use(
+                request,
+                response,
+                next as unknown as NextFunction,
+            ),
+        ).toThrow(ForbiddenException);
+
+        expect(next).not.toHaveBeenCalled();
+    });
+
+    it('permite quando o token corresponde ao valor da sessão', () => {
+        const token = 'a'.repeat(64);
+        const request = createRequest('DELETE', token, token);
+
+        middleware.use(
+            request,
+            response,
+            next as unknown as NextFunction,
+        );
+
+        expect(next).toHaveBeenCalledOnce();
+    });
+});

package/templates/drizzle/src/common/middleware/csrf.middleware.ts

@@ -0,0 +1,46 @@
+// nestforge:feature-file:auth:session
+import {
+    ForbiddenException,
+    Injectable,
+    NestMiddleware,
+} from '@nestjs/common';
+import { timingSafeEqual } from 'node:crypto';
+import { NextFunction, Request, Response } from 'express';
+
+const SAFE_METHODS = new Set(['GET', 'HEAD', 'OPTIONS']);
+const CSRF_HEADER = 'x-csrf-token';
+
+@Injectable()
+export class CsrfMiddleware implements NestMiddleware {
+    use(request: Request, _response: Response, next: NextFunction) {
+        if (SAFE_METHODS.has(request.method)) {
+            next();
+            return;
+        }
+
+        const sessionToken = request.session?.csrfToken;
+        const headerToken = request.get(CSRF_HEADER);
+
+        if (
+            !sessionToken ||
+            !headerToken ||
+            !this.tokensMatch(sessionToken, headerToken)
+        ) {
+            throw new ForbiddenException(
+                'Token CSRF inválido ou ausente',
+            );
+        }
+
+        next();
+    }
+
+    private tokensMatch(expected: string, received: string): boolean {
+        const expectedBuffer = Buffer.from(expected, 'utf8');
+        const receivedBuffer = Buffer.from(received, 'utf8');
+
+        return (
+            expectedBuffer.length === receivedBuffer.length &&
+            timingSafeEqual(expectedBuffer, receivedBuffer)
+        );
+    }
+}

package/templates/drizzle/src/common/utils/avatar-storage.util.ts

@@ -0,0 +1,32 @@
+import { BadRequestException } from '@nestjs/common';
+import { randomUUID } from 'crypto';
+import { diskStorage } from 'multer';
+import { extname } from 'path';
+
+const ALLOWED_MIME_TYPES = ['image/png', 'image/jpeg', 'image/webp'];
+
+export const avatarStorage = diskStorage({
+    destination: './uploads/avatars',
+    filename: (_req, file, callback) => {
+        const uniqueName = `${randomUUID()}${extname(file.originalname)}`;
+        callback(null, uniqueName);
+    },
+});
+
+export function avatarFileFilter(
+    _req: unknown,
+    file: Express.Multer.File,
+    callback: (error: Error | null, acceptFile: boolean) => void,
+) {
+    if (!ALLOWED_MIME_TYPES.includes(file.mimetype)) {
+        callback(
+            new BadRequestException('Formato de imagem não suportado (use PNG, JPEG ou WEBP)'),
+            false,
+        );
+        return;
+    }
+
+    callback(null, true);
+}
+
+export const AVATAR_MAX_SIZE_BYTES = 2 * 1024 * 1024; // 2MB