nestforge-generator 0.1.0

package/templates/drizzle/test/session-auth.e2e-spec.ts

@@ -0,0 +1,163 @@
+// nestforge:feature-file:auth:password,auth:session
+import { INestApplication } from '@nestjs/common';
+import { DRIZZLE_DATABASE } from '../src/database/database.constants';
+import type { DrizzleDatabase } from '../src/database/database.types';
+import request from 'supertest';
+import { createTestApp } from './utils/e2e-setup';
+import { cleanDatabase } from './utils/clean-database';
+
+describe('Session auth (e2e)', () => {
+    let app: INestApplication;
+    let database: DrizzleDatabase;
+
+    beforeAll(async () => {
+        app = await createTestApp();
+
+        database = app.get<DrizzleDatabase>(
+            DRIZZLE_DATABASE,
+        );
+    });
+
+    beforeEach(async () => {
+        await cleanDatabase(database);
+    });
+
+    afterAll(async () => {
+        if (app) {
+            await app.close();
+        }
+    });
+
+    it('registra, autentica e encerra uma sessão protegida por CSRF', async () => {
+        const agent = request.agent(app.getHttpServer());
+
+        await agent
+            .get('/users/me')
+            .expect(401);
+
+        const csrfResponse = await agent
+            .get('/auth/csrf-token')
+            .expect(200);
+
+        const csrfToken = csrfResponse.body.csrfToken as string;
+
+        expect(csrfToken).toMatch(/^[a-f0-9]{64}$/);
+
+        // Requisições que alteram estado devem ser rejeitadas sem o token.
+        await agent
+            .post('/auth/register')
+            .send({
+                name: 'Jeiel',
+                email: 'jeiel.session@example.com',
+                password: 'senhaForte123',
+            })
+            .expect(403);
+
+        const registerResponse = await agent
+            .post('/auth/register')
+            .set('x-csrf-token', csrfToken)
+            .send({
+                name: 'Jeiel',
+                email: 'jeiel.session@example.com',
+                password: 'senhaForte123',
+            })
+            .expect(201);
+
+        expect(registerResponse.body.user).toMatchObject({
+            email: 'jeiel.session@example.com',
+        });
+
+        expect(registerResponse.headers['set-cookie']).toEqual(
+            expect.arrayContaining([
+                expect.stringContaining('nestforge.sid='),
+            ]),
+        );
+
+        const authenticatedCsrfToken =
+            registerResponse.body.csrfToken as string;
+
+        expect(authenticatedCsrfToken).toMatch(/^[a-f0-9]{64}$/);
+        expect(authenticatedCsrfToken).not.toBe(csrfToken);
+
+        const authenticatedResponse = await agent
+            .get('/users/me')
+            .expect(200);
+
+        expect(authenticatedResponse.body.email).toBe(
+            'jeiel.session@example.com',
+        );
+
+        await agent
+            .post('/auth/logout')
+            .set('x-csrf-token', authenticatedCsrfToken)
+            .expect(200);
+
+        await agent
+            .get('/users/me')
+            .expect(401);
+    });
+
+    it('realiza login e renova o token CSRF da sessão', async () => {
+        const registrationAgent = request.agent(
+            app.getHttpServer(),
+        );
+
+        const registrationCsrfResponse = await registrationAgent
+            .get('/auth/csrf-token')
+            .expect(200);
+
+        const registrationCsrfToken =
+            registrationCsrfResponse.body.csrfToken as string;
+
+        const registrationResponse = await registrationAgent
+            .post('/auth/register')
+            .set('x-csrf-token', registrationCsrfToken)
+            .send({
+                name: 'Usuário de sessão',
+                email: 'login.session@example.com',
+                password: 'senhaForte123',
+            })
+            .expect(201);
+
+        await registrationAgent
+            .post('/auth/logout')
+            .set(
+                'x-csrf-token',
+                registrationResponse.body.csrfToken,
+            )
+            .expect(200);
+
+        const loginAgent = request.agent(app.getHttpServer());
+
+        const loginCsrfResponse = await loginAgent
+            .get('/auth/csrf-token')
+            .expect(200);
+
+        const loginCsrfToken =
+            loginCsrfResponse.body.csrfToken as string;
+
+        const loginResponse = await loginAgent
+            .post('/auth/login')
+            .set('x-csrf-token', loginCsrfToken)
+            .send({
+                email: 'login.session@example.com',
+                password: 'senhaForte123',
+            })
+            .expect(200);
+
+        expect(loginResponse.body.user.email).toBe(
+            'login.session@example.com',
+        );
+
+        expect(loginResponse.body.csrfToken).toMatch(
+            /^[a-f0-9]{64}$/,
+        );
+        expect(loginResponse.body.csrfToken).not.toBe(
+            loginCsrfToken,
+        );
+
+        await loginAgent
+            .get('/users/me')
+            .expect(200);
+    });
+});

package/templates/drizzle/test/users.e2e-spec.ts

@@ -0,0 +1,212 @@
+// nestforge:feature-file:auth:password,auth:token
+import { randomUUID } from 'node:crypto';
+import {
+    INestApplication,
+} from '@nestjs/common';
+import * as bcrypt from 'bcryptjs';
+import request from 'supertest';
+import { Role } from '../src/common/constants/role.enum';
+import { DRIZZLE_DATABASE } from '../src/database/database.constants';
+import type { DrizzleDatabase } from '../src/database/database.types';
+import { users } from '../src/database/schema';
+import { createTestApp } from './utils/e2e-setup';
+import { cleanDatabase } from './utils/clean-database';
+
+describe('Users (e2e)', () => {
+    let app: INestApplication;
+    let database: DrizzleDatabase;
+
+    async function createUserWithRole(
+        email: string,
+        password: string,
+        role: Role,
+    ): Promise<void> {
+        const passwordHash = await bcrypt.hash(
+            password,
+            10,
+        );
+
+        await database.insert(users).values({
+            id: randomUUID(),
+            name: 'Usuário de teste',
+            email,
+            passwordHash,
+            role,
+            emailVerifiedAt: new Date(),
+        });
+    }
+
+    async function loginAndGetToken(
+        email: string,
+        password: string,
+    ): Promise<string> {
+        const response = await request(
+            app.getHttpServer(),
+        )
+            .post('/auth/login')
+            .send({
+                email,
+                password,
+            })
+            .expect(200);
+
+        return response.body
+            .accessToken as string;
+    }
+
+    beforeAll(async () => {
+        app = await createTestApp();
+
+        database = app.get<DrizzleDatabase>(
+            DRIZZLE_DATABASE,
+        );
+    });
+
+    beforeEach(async () => {
+        await cleanDatabase(database);
+    });
+
+    afterAll(async () => {
+        await app.close();
+    });
+
+    it('rejeita acesso sem token', async () => {
+        await request(app.getHttpServer())
+            .get('/users')
+            .expect(401);
+    });
+
+    it('ADMIN consegue criar, listar, atualizar e remover um usuário', async () => {
+        await createUserWithRole(
+            'admin.e2e@example.com',
+            'senhaForte123',
+            Role.ADMIN,
+        );
+
+        const token = await loginAndGetToken(
+            'admin.e2e@example.com',
+            'senhaForte123',
+        );
+
+        const server = app.getHttpServer();
+
+        const createResponse = await request(
+            server,
+        )
+            .post('/users')
+            .set(
+                'Authorization',
+                `Bearer ${token}`,
+            )
+            .send({
+                name: 'Novo Usuário',
+                email: 'novo.e2e@example.com',
+                password: 'senhaForte123',
+            })
+            .expect(201);
+
+        expect(
+            createResponse.body,
+        ).not.toHaveProperty('passwordHash');
+
+        const userId = createResponse.body.id;
+
+        const listResponse = await request(
+            server,
+        )
+            .get('/users')
+            .set(
+                'Authorization',
+                `Bearer ${token}`,
+            )
+            .expect(200);
+
+        expect(
+            listResponse.body.meta.total,
+        ).toBeGreaterThanOrEqual(1);
+
+        await request(server)
+            .patch(`/users/${userId}`)
+            .set(
+                'Authorization',
+                `Bearer ${token}`,
+            )
+            .send({
+                name: 'Nome Atualizado',
+            })
+            .expect(200);
+
+        await request(server)
+            .delete(`/users/${userId}`)
+            .set(
+                'Authorization',
+                `Bearer ${token}`,
+            )
+            .expect(200);
+    });
+
+    // nestforge:feature:rbac
+    it('USER consegue ler mas não consegue criar usuário', async () => {
+        await createUserWithRole(
+            'user.e2e@example.com',
+            'senhaForte123',
+            Role.USER,
+        );
+
+        const token = await loginAndGetToken(
+            'user.e2e@example.com',
+            'senhaForte123',
+        );
+
+        const server = app.getHttpServer();
+
+        await request(server)
+            .get('/users')
+            .set(
+                'Authorization',
+                `Bearer ${token}`,
+            )
+            .expect(200);
+
+        await request(server)
+            .post('/users')
+            .set(
+                'Authorization',
+                `Bearer ${token}`,
+            )
+            .send({
+                name: 'Não deveria criar',
+                email: 'bloqueado.e2e@example.com',
+                password: 'senhaForte123',
+            })
+            .expect(403);
+    });
+    // nestforge:feature:rbac:end
+
+    it('GET /users/me retorna o usuário autenticado', async () => {
+        await createUserWithRole(
+            'me.e2e@example.com',
+            'senhaForte123',
+            Role.USER,
+        );
+
+        const token = await loginAndGetToken(
+            'me.e2e@example.com',
+            'senhaForte123',
+        );
+
+        const response = await request(
+            app.getHttpServer(),
+        )
+            .get('/users/me')
+            .set(
+                'Authorization',
+                `Bearer ${token}`,
+            )
+            .expect(200);
+
+        expect(response.body.email).toBe(
+            'me.e2e@example.com',
+        );
+    });
+});

package/templates/drizzle/test/utils/clean-database.ts

@@ -0,0 +1,104 @@
+// nestforge:feature-file:auth:enabled
+import type { DrizzleDatabase } from '../../src/database/database.types';
+import {
+    oauthAccounts,
+    users,
+} from '../../src/database/schema';
+
+// nestforge:feature:auth:token
+import { refreshTokens } from '../../src/database/schema';
+// nestforge:feature:auth:token:end
+
+// nestforge:feature:redis,auth:password
+import {
+    emailVerificationTokens,
+    passwordResetTokens,
+} from '../../src/database/schema';
+// nestforge:feature:redis,auth:password:end
+
+// nestforge:feature:auth:session
+import { sessions } from '../../src/database/schema';
+// nestforge:feature:auth:session:end
+
+export async function cleanDatabase(
+    database: DrizzleDatabase,
+): Promise<void> {
+    // nestforge:feature:database:postgres
+    await database.transaction(
+        async (transaction) => {
+            // nestforge:feature:auth:session
+            await transaction.delete(sessions);
+            // nestforge:feature:auth:session:end
+
+            // nestforge:feature:auth:token
+            await transaction.delete(refreshTokens);
+            // nestforge:feature:auth:token:end
+
+            // nestforge:feature:redis,auth:password
+            await transaction.delete(
+                passwordResetTokens,
+            );
+
+            await transaction.delete(
+                emailVerificationTokens,
+            );
+            // nestforge:feature:redis,auth:password:end
+
+            await transaction.delete(oauthAccounts);
+            await transaction.delete(users);
+        },
+    );
+    // nestforge:feature:database:postgres:end
+
+    // nestforge:feature:database:mysql
+    await database.transaction(
+        async (transaction) => {
+            // nestforge:feature:auth:session
+            await transaction.delete(sessions);
+            // nestforge:feature:auth:session:end
+
+            // nestforge:feature:auth:token
+            await transaction.delete(refreshTokens);
+            // nestforge:feature:auth:token:end
+
+            // nestforge:feature:redis,auth:password
+            await transaction.delete(
+                passwordResetTokens,
+            );
+
+            await transaction.delete(
+                emailVerificationTokens,
+            );
+            // nestforge:feature:redis,auth:password:end
+
+            await transaction.delete(oauthAccounts);
+            await transaction.delete(users);
+        },
+    );
+    // nestforge:feature:database:mysql:end
+
+    // nestforge:feature:database:sqlite
+    database.transaction((transaction) => {
+        // nestforge:feature:auth:session
+        transaction.delete(sessions).run();
+        // nestforge:feature:auth:session:end
+
+        // nestforge:feature:auth:token
+        transaction.delete(refreshTokens).run();
+        // nestforge:feature:auth:token:end
+
+        // nestforge:feature:redis,auth:password
+        transaction
+            .delete(passwordResetTokens)
+            .run();
+
+        transaction
+            .delete(emailVerificationTokens)
+            .run();
+        // nestforge:feature:redis,auth:password:end
+
+        transaction.delete(oauthAccounts).run();
+        transaction.delete(users).run();
+    });
+    // nestforge:feature:database:sqlite:end
+}

package/templates/drizzle/test/utils/e2e-setup.ts

@@ -0,0 +1,77 @@
+import {
+    ClassSerializerInterceptor,
+    INestApplication,
+} from '@nestjs/common';
+import { Reflector } from '@nestjs/core';
+import { Test } from '@nestjs/testing';
+import { NestExpressApplication } from '@nestjs/platform-express';
+
+// nestforge:feature:validation
+import { ZodValidationPipe } from 'nestjs-zod';
+// nestforge:feature:validation:end
+
+import { AppModule } from '../../src/app.module';
+import { HttpExceptionFilter } from '../../src/common/filters/http-exception.filter';
+
+// nestforge:feature:auth:session
+import session from 'express-session';
+import { DrizzleSessionStore } from '../../src/auth/drizzle-session.store';
+// nestforge:feature:auth:session:end
+
+export async function createTestApp(): Promise<INestApplication> {
+    const moduleRef =
+        await Test.createTestingModule({
+            imports: [AppModule],
+        }).compile();
+
+    const app =
+        moduleRef.createNestApplication<NestExpressApplication>();
+
+    // nestforge:feature:auth:session
+    const sessionStore = app.get(
+        DrizzleSessionStore,
+    );
+
+    const sessionMaxAge = Number(
+        process.env.SESSION_MAX_AGE ??
+        7 * 24 * 60 * 60 * 1000,
+    );
+
+    app.use(
+        session({
+            name: 'nestforge.sid',
+            secret:
+                process.env.SESSION_SECRET as string,
+            resave: false,
+            saveUninitialized: false,
+            store: sessionStore,
+            cookie: {
+                httpOnly: true,
+                secure: false,
+                sameSite: 'lax',
+                maxAge: sessionMaxAge,
+            },
+        }),
+    );
+    // nestforge:feature:auth:session:end
+
+    // nestforge:feature:validation
+    app.useGlobalPipes(
+        new ZodValidationPipe(),
+    );
+    // nestforge:feature:validation:end
+
+    app.useGlobalFilters(
+        new HttpExceptionFilter(),
+    );
+
+    app.useGlobalInterceptors(
+        new ClassSerializerInterceptor(
+            app.get(Reflector),
+        ),
+    );
+
+    await app.init();
+
+    return app;
+}

package/templates/drizzle/tsconfig.build.json

@@ -0,0 +1,4 @@
+{
+  "extends": "./tsconfig.json",
+  "exclude": ["node_modules", "test", "dist", "**/*spec.ts"]
+}

package/templates/drizzle/tsconfig.json

@@ -0,0 +1,25 @@
+{
+  "compilerOptions": {
+    "module": "commonjs",
+    "declaration": true,
+    "removeComments": true,
+    "emitDecoratorMetadata": true,
+    "experimentalDecorators": true,
+    "allowSyntheticDefaultImports": true,
+    "target": "ES2022",
+    "sourceMap": true,
+    "outDir": "./dist",
+    "baseUrl": "./",
+    "incremental": true,
+    "skipLibCheck": true,
+    "strict": true,
+    "strictNullChecks": true,
+    "noImplicitAny": true,
+    "forceConsistentCasingInFileNames": true,
+    "moduleResolution": "node",
+    "esModuleInterop": true,
+    "paths": {
+      "@/*": ["src/*"]
+    }
+  }
+}

package/templates/drizzle/vitest.config.ts

@@ -0,0 +1,20 @@
+import { defineConfig } from 'vitest/config';
+import swc from 'unplugin-swc';
+
+export default defineConfig({
+  plugins: [
+    swc.vite({
+      module: { type: 'es6' },
+    }),
+  ],
+  test: {
+    globals: true,
+    root: './',
+    environment: 'node',
+    include: ['src/**/*.spec.ts'],
+    coverage: {
+      reporter: ['text', 'html'],
+      exclude: ['**/*.module.ts', '**/main.ts'],
+    },
+  },
+});

package/templates/drizzle/vitest.e2e.config.ts

@@ -0,0 +1,19 @@
+import swc from 'unplugin-swc';
+import { defineConfig } from 'vitest/config';
+
+export default defineConfig({
+    plugins: [
+        swc.vite({
+            module: { type: 'es6' },
+        }),
+    ],
+    test: {
+        globals: true,
+        root: './',
+        environment: 'node',
+        include: ['test/**/*.e2e-spec.ts'],
+        testTimeout: 30000,
+        hookTimeout: 30000,
+        fileParallelism: false,
+    },
+});

package/templates/prisma/.env.example

@@ -0,0 +1,44 @@
+# App
+NODE_ENV=development
+PORT=3000
+APP_URL=http://localhost:3000
+CORS_ORIGINS=http://localhost:5173
+
+# Database
+DATABASE_URL="postgresql://nestforge:nestforge@localhost:5432/nestforge?schema=public"
+
+# JWT
+# nestforge:feature:auth:token
+JWT_ACCESS_SECRET=troque-este-segredo-em-producao
+JWT_ACCESS_EXPIRES_IN=15m
+JWT_REFRESH_SECRET=troque-este-outro-segredo-em-producao
+JWT_REFRESH_EXPIRES_IN=7d
+# nestforge:feature:auth:token:end
+
+# Redis
+REDIS_HOST=localhost
+REDIS_PORT=6379
+
+# Mail (Mailpit em dev)
+MAIL_HOST=localhost
+MAIL_PORT=1025
+MAIL_FROM="NestForge <no-reply@nestforge.dev>"
+
+# OAuth (opcional)
+GOOGLE_CLIENT_ID=
+GOOGLE_CLIENT_SECRET=
+GITHUB_CLIENT_ID=
+GITHUB_CLIENT_SECRET=
+
+# Rate limit
+THROTTLE_TTL=60
+THROTTLE_LIMIT=100
+
+# nestforge:feature:auth:session
+# Session
+SESSION_SECRET=troque-este-segredo-de-sessao-em-producao
+SESSION_MAX_AGE=604800000
+
+# CSRF
+ENABLE_CSRF=true
+# nestforge:feature:auth:session:end