nestforge-generator 0.1.0

package/templates/prisma/prisma/schema.prisma

@@ -0,0 +1,105 @@
+generator client {
+  provider = "prisma-client-js"
+}
+
+datasource db {
+  provider = "postgresql"
+  url      = env("DATABASE_URL")
+}
+
+enum Role {
+  ADMIN
+  MANAGER
+  USER
+}
+
+model User {
+  id              String    @id @default(uuid())
+  name            String
+  email           String    @unique
+  passwordHash    String?
+  role            Role      @default(USER)
+  emailVerifiedAt DateTime?
+  avatarUrl       String?
+  createdAt       DateTime  @default(now())
+  updatedAt       DateTime  @updatedAt
+
+  refreshTokens           RefreshToken[]
+  oauthAccounts           OAuthAccount[]
+  passwordResetTokens     PasswordResetToken[]
+  emailVerificationTokens EmailVerificationToken[]
+
+  @@map("users")
+}
+
+model RefreshToken {
+  id        String    @id @default(uuid())
+  tokenHash String    @unique
+  userId    String
+  user      User      @relation(fields: [userId], references: [id], onDelete: Cascade)
+  expiresAt DateTime
+  revokedAt DateTime?
+  createdAt DateTime  @default(now())
+
+  @@map("refresh_tokens")
+}
+
+model OAuthAccount {
+  id             String   @id @default(uuid())
+  provider       String // "google" | "github"
+  providerUserId String
+  userId         String
+  user           User     @relation(fields: [userId], references: [id], onDelete: Cascade)
+  createdAt      DateTime @default(now())
+
+  @@unique([provider, providerUserId])
+  @@map("oauth_accounts")
+}
+
+model PasswordResetToken {
+  id        String    @id @default(uuid())
+  tokenHash String    @unique
+  userId    String
+  user      User      @relation(fields: [userId], references: [id], onDelete: Cascade)
+  expiresAt DateTime
+  usedAt    DateTime?
+  createdAt DateTime  @default(now())
+
+  @@map("password_reset_tokens")
+}
+
+model EmailVerificationToken {
+  id        String    @id @default(uuid())
+  tokenHash String    @unique
+  userId    String
+  user      User      @relation(fields: [userId], references: [id], onDelete: Cascade)
+  expiresAt DateTime
+  usedAt    DateTime?
+  createdAt DateTime  @default(now())
+
+  @@map("email_verification_tokens")
+}
+
+// nestforge:feature:auth:session
+model Session {
+  id  String @id
+  sid String @unique
+
+  // nestforge:feature:database:mysql
+  data String @db.Text
+  // nestforge:feature:database:mysql:end
+
+  // nestforge:feature:database:postgres
+  data String
+  // nestforge:feature:database:postgres:end
+
+  // nestforge:feature:database:sqlite
+  data String
+  // nestforge:feature:database:sqlite:end
+
+  expiresAt DateTime
+
+  @@map("sessions")
+}
+
+// nestforge:feature:auth:session:end

package/templates/prisma/prisma/seed.ts

@@ -0,0 +1,46 @@
+import { PrismaClient, Role } from '@prisma/client';
+import * as bcrypt from 'bcryptjs';
+
+const prisma = new PrismaClient();
+
+interface SeedUser {
+  name: string;
+  email: string;
+  password: string;
+  role: Role;
+}
+
+const SEED_USERS: SeedUser[] = [
+  { name: 'Admin', email: 'admin@nestforge.dev', password: 'admin123', role: Role.ADMIN },
+  { name: 'Manager', email: 'manager@nestforge.dev', password: 'manager123', role: Role.MANAGER },
+  { name: 'Usuário', email: 'user@nestforge.dev', password: 'user1234', role: Role.USER },
+];
+
+async function main() {
+  for (const seedUser of SEED_USERS) {
+    const passwordHash = await bcrypt.hash(seedUser.password, 10);
+
+    await prisma.user.upsert({
+      where: { email: seedUser.email },
+      update: {},
+      create: {
+        name: seedUser.name,
+        email: seedUser.email,
+        passwordHash,
+        role: seedUser.role,
+        emailVerifiedAt: new Date(),
+      },
+    });
+
+    console.log(`Seed: ${seedUser.email} / ${seedUser.password} (${seedUser.role})`);
+  }
+}
+
+main()
+  .catch((error) => {
+    console.error(error);
+    process.exit(1);
+  })
+  .finally(async () => {
+    await prisma.$disconnect();
+  });

package/templates/prisma/src/app.module.ts

@@ -0,0 +1,72 @@
+import { MiddlewareConsumer, Module, NestModule } from '@nestjs/common';
+import { ConfigModule } from '@nestjs/config';
+import { ThrottlerModule } from '@nestjs/throttler';
+// nestforge:feature:redis
+import { BullModule } from '@nestjs/bullmq';
+// nestforge:feature:redis:end
+import { LoggerModule } from 'nestjs-pino';
+// nestforge:feature:auth:enabled
+import { AuthModule } from './auth/auth.module';
+import { UsersModule } from './users/users.module';
+// nestforge:feature:auth:enabled:end
+import { PrismaModule } from './database/prisma.module';
+// nestforge:feature:redis
+import { MailModule } from './mail/mail.module';
+// nestforge:feature:redis:end
+import { HealthModule } from './health/health.module';
+import { MetricsModule } from './metrics/metrics.module';
+// nestforge:feature:auth:session
+import { CsrfMiddleware } from './common/middleware/csrf.middleware';
+// nestforge:feature:auth:session:end
+import { validateEnv } from './config/env.validation';
+
+@Module({
+  imports: [
+    ConfigModule.forRoot({
+      isGlobal: true,
+      validate: validateEnv,
+    }),
+    LoggerModule.forRoot({
+      pinoHttp: {
+        level: process.env.NODE_ENV === 'production' ? 'info' : 'debug',
+        transport:
+          process.env.NODE_ENV === 'development'
+            ? { target: 'pino-pretty', options: { singleLine: true } }
+            : undefined,
+      },
+    }),
+    ThrottlerModule.forRoot([
+      {
+        ttl: Number(process.env.THROTTLE_TTL ?? 60) * 1000,
+        limit: Number(process.env.THROTTLE_LIMIT ?? 100),
+      },
+    ]),
+    // nestforge:feature:redis
+    BullModule.forRoot({
+      connection: {
+        host: process.env.REDIS_HOST ?? 'localhost',
+        port: Number(process.env.REDIS_PORT ?? 6379),
+      },
+    }),
+    // nestforge:feature:redis:end
+    PrismaModule,
+    // nestforge:feature:auth:enabled
+    AuthModule,
+    UsersModule,
+    // nestforge:feature:auth:enabled:end
+    // nestforge:feature:redis
+    MailModule,
+    // nestforge:feature:redis:end
+    HealthModule,
+    MetricsModule,
+  ],
+})
+export class AppModule implements NestModule {
+  configure(consumer: MiddlewareConsumer) {
+    // nestforge:feature:auth:session
+    if (process.env.ENABLE_CSRF === 'true') {
+      consumer.apply(CsrfMiddleware).forRoutes('*');
+    }
+    // nestforge:feature:auth:session:end
+  }
+}

package/templates/prisma/src/auth/auth.controller.ts

@@ -0,0 +1,283 @@
+import { Body, Controller, Get, HttpCode, HttpStatus, Post, Query, Req, UseGuards } from '@nestjs/common';
+// nestforge:feature:swagger
+import { ApiExcludeEndpoint, ApiOperation, ApiResponse, ApiTags } from '@nestjs/swagger';
+// nestforge:feature:swagger:end
+import { Request } from 'express';
+import { AuthService } from './auth.service';
+// nestforge:feature:auth:password
+import { RegisterDto } from './dto/register.dto';
+import { LoginDto } from './dto/login.dto';
+// nestforge:feature:auth:password:end
+// nestforge:feature:auth:token
+import { RefreshTokenDto } from './dto/refresh-token.dto';
+// nestforge:feature:auth:token:end
+// nestforge:feature:redis,auth:password
+import { ForgotPasswordDto } from './dto/forgot-password.dto';
+import { ResetPasswordDto } from './dto/reset-password.dto';
+// nestforge:feature:redis,auth:password:end
+import { Public } from '../common/decorators/public.decorator';
+import { GoogleAuthGuard } from './guards/google-auth.guard';
+import { GithubAuthGuard } from './guards/github-auth.guard';
+import { OAuthProfile } from './strategies/google.strategy';
+// nestforge:feature:auth:token
+import { TokenService } from './token.service';
+// nestforge:feature:auth:token:end
+// nestforge:feature:auth:session
+import { SessionService } from './session.service';
+// nestforge:feature:auth:session:end
+
+// nestforge:feature:swagger,auth:token
+const TOKENS_EXAMPLE = {
+  accessToken: 'eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9...',
+  refreshToken: 'eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9...',
+};
+// nestforge:feature:swagger,auth:token:end
+
+// nestforge:feature:swagger
+@ApiTags('auth')
+// nestforge:feature:swagger:end
+@Controller('auth')
+export class AuthController {
+  constructor(
+    private readonly authService: AuthService,
+    // nestforge:feature:auth:token
+    private readonly tokenService: TokenService,
+    // nestforge:feature:auth:token:end
+    // nestforge:feature:auth:session
+    private readonly sessionService: SessionService,
+    // nestforge:feature:auth:session:end
+  ) { }
+
+  // nestforge:feature:auth:session
+  @Public()
+  @Get('csrf-token')
+  // nestforge:feature:swagger
+  @ApiOperation({ summary: 'Emite um token CSRF vinculado à sessão' })
+  @ApiResponse({
+    status: 200,
+    description: 'Token CSRF emitido',
+    schema: {
+      example: {
+        csrfToken: 'a1b2c3d4e5f6...',
+      },
+    },
+  })
+  // nestforge:feature:swagger:end
+  getCsrfToken(@Req() request: Request) {
+    return this.sessionService.issueCsrfToken(request);
+  }
+  // nestforge:feature:auth:session:end
+
+  // nestforge:feature:auth:token,auth:password
+  @Public()
+  @Post('register')
+  // nestforge:feature:swagger
+  @ApiOperation({ summary: 'Cria uma nova conta' })
+  @ApiResponse({ status: 201, description: 'Conta criada com sucesso', schema: { example: TOKENS_EXAMPLE } })
+  @ApiResponse({ status: 409, description: 'E-mail já cadastrado', schema: { example: { statusCode: 409, message: 'E-mail já cadastrado' } } })
+  // nestforge:feature:swagger:end
+  async register(@Body() dto: RegisterDto) {
+    const user = await this.authService.register(dto);
+    return this.tokenService.issueTokens(user.id, user.email, user.role);
+  }
+
+  @Public()
+  @Post('login')
+  @HttpCode(HttpStatus.OK)
+  // nestforge:feature:swagger
+  @ApiOperation({ summary: 'Autentica e retorna access/refresh token' })
+  @ApiResponse({ status: 200, description: 'Login realizado com sucesso', schema: { example: TOKENS_EXAMPLE } })
+  @ApiResponse({ status: 401, description: 'Credenciais inválidas', schema: { example: { statusCode: 401, message: 'Credenciais inválidas' } } })
+  // nestforge:feature:swagger:end
+  async login(@Body() dto: LoginDto) {
+    const user = await this.authService.login(dto);
+    return this.tokenService.issueTokens(user.id, user.email, user.role);
+  }
+  // nestforge:feature:auth:token,auth:password:end
+
+  // nestforge:feature:auth:session
+  @Public()
+  @Post('register')
+  // nestforge:feature:swagger
+  @ApiOperation({ summary: 'Cria uma conta e inicia uma sessão' })
+  @ApiResponse({ status: 201, description: 'Conta criada e sessão iniciada' })
+  @ApiResponse({ status: 409, description: 'E-mail já cadastrado' })
+  // nestforge:feature:swagger:end
+  async registerWithSession(
+    @Body() dto: RegisterDto,
+    @Req() request: Request,
+  ) {
+    const user = await this.authService.register(dto);
+    return this.sessionService.establish(request, user);
+  }
+
+  @Public()
+  @Post('login')
+  @HttpCode(HttpStatus.OK)
+  // nestforge:feature:swagger
+  @ApiOperation({ summary: 'Autentica e inicia uma sessão por cookie' })
+  @ApiResponse({ status: 200, description: 'Sessão iniciada com sucesso' })
+  @ApiResponse({ status: 401, description: 'Credenciais inválidas' })
+  // nestforge:feature:swagger:end
+  async loginWithSession(
+    @Body() dto: LoginDto,
+    @Req() request: Request,
+  ) {
+    const user = await this.authService.login(dto);
+    return this.sessionService.establish(request, user);
+  }
+
+  @Post('logout')
+  @HttpCode(HttpStatus.OK)
+  // nestforge:feature:swagger
+  @ApiOperation({ summary: 'Encerra a sessão atual' })
+  @ApiResponse({ status: 200, description: 'Sessão encerrada com sucesso' })
+  // nestforge:feature:swagger:end
+  logoutSession(@Req() request: Request) {
+    return this.sessionService.destroy(request);
+  }
+  // nestforge:feature:auth:session:end
+
+  // nestforge:feature:auth:token
+  @Public()
+  @Post('refresh')
+  @HttpCode(HttpStatus.OK)
+  // nestforge:feature:swagger
+  @ApiOperation({ summary: 'Renova o access token usando o refresh token' })
+  @ApiResponse({ status: 200, description: 'Novo par de tokens emitido', schema: { example: TOKENS_EXAMPLE } })
+  @ApiResponse({ status: 401, description: 'Refresh token inválido, expirado ou já usado', schema: { example: { statusCode: 401, message: 'Refresh token inválido ou expirado' } } })
+  // nestforge:feature:swagger:end
+  refresh(@Body() dto: RefreshTokenDto) {
+    return this.tokenService.refresh(dto.refreshToken);
+  }
+
+  @Public()
+  @Post('logout')
+  @HttpCode(HttpStatus.OK)
+  // nestforge:feature:swagger
+  @ApiOperation({ summary: 'Revoga o refresh token informado' })
+  @ApiResponse({ status: 200, description: 'Logout realizado', schema: { example: { message: 'Logout realizado com sucesso' } } })
+  // nestforge:feature:swagger:end
+  logout(@Body() dto: RefreshTokenDto) {
+    return this.tokenService.logout(dto.refreshToken);
+  }
+  // nestforge:feature:auth:token:end
+
+  // nestforge:feature:redis,auth:password
+  @Public()
+  @Post('forgot-password')
+  @HttpCode(HttpStatus.OK)
+  // nestforge:feature:swagger
+  @ApiOperation({ summary: 'Envia um e-mail com instruções para redefinir a senha' })
+  @ApiResponse({
+    status: 200,
+    description: 'Resposta genérica — sempre a mesma, exista ou não o e-mail (evita enumeração de contas)',
+    schema: { example: { message: 'Se o e-mail existir, enviaremos instruções de redefinição de senha' } },
+  })
+  // nestforge:feature:swagger:end
+  forgotPassword(@Body() dto: ForgotPasswordDto) {
+    return this.authService.forgotPassword(dto.email);
+  }
+
+  @Public()
+  @Post('reset-password')
+  @HttpCode(HttpStatus.OK)
+  // nestforge:feature:swagger
+  @ApiOperation({ summary: 'Redefine a senha usando o token recebido por e-mail' })
+  @ApiResponse({ status: 200, description: 'Senha redefinida', schema: { example: { message: 'Senha redefinida com sucesso' } } })
+  @ApiResponse({ status: 401, description: 'Token inválido, expirado ou já usado', schema: { example: { statusCode: 401, message: 'Token de redefinição inválido ou expirado' } } })
+  // nestforge:feature:swagger:end
+  resetPassword(@Body() dto: ResetPasswordDto) {
+    return this.authService.resetPassword(dto.token, dto.password);
+  }
+
+  @Public()
+  @Get('verify-email')
+  // nestforge:feature:swagger
+  @ApiOperation({ summary: 'Confirma o e-mail usando o token recebido' })
+  @ApiResponse({ status: 200, description: 'E-mail verificado', schema: { example: { message: 'E-mail verificado com sucesso' } } })
+  @ApiResponse({ status: 401, description: 'Token inválido, expirado ou já usado', schema: { example: { statusCode: 401, message: 'Token de verificação inválido ou expirado' } } })
+  // nestforge:feature:swagger:end
+  verifyEmail(@Query('token') token: string) {
+    return this.authService.verifyEmail(token);
+  }
+  // nestforge:feature:redis,auth:password:end
+
+  @Public()
+  @Get('google')
+  @UseGuards(GoogleAuthGuard)
+  // nestforge:feature:swagger
+  @ApiOperation({ summary: 'Inicia o login via Google (redireciona)' })
+  // nestforge:feature:swagger:end
+  googleLogin() {
+    // o guard redireciona para o consentimento do Google; nada a fazer aqui
+  }
+
+  // nestforge:feature:auth:token
+  @Public()
+  @Get('google/callback')
+  @UseGuards(GoogleAuthGuard)
+  // nestforge:feature:swagger
+  @ApiExcludeEndpoint()
+  // nestforge:feature:swagger:end
+  async googleCallback(@Req() req: Request) {
+    const user = await this.authService.validateOAuthLogin(req.user as OAuthProfile);
+    return this.tokenService.issueTokens(user.id, user.email, user.role);
+  }
+  // nestforge:feature:auth:token:end
+
+  // nestforge:feature:auth:session
+  @Public()
+  @Get('google/callback')
+  @UseGuards(GoogleAuthGuard)
+  // nestforge:feature:swagger
+  @ApiExcludeEndpoint()
+  // nestforge:feature:swagger:end
+  async googleSessionCallback(@Req() request: Request) {
+    const user = await this.authService.validateOAuthLogin(
+      request.user as OAuthProfile,
+    );
+
+    return this.sessionService.establish(request, user);
+  }
+  // nestforge:feature:auth:session:end
+
+  @Public()
+  @Get('github')
+  @UseGuards(GithubAuthGuard)
+  // nestforge:feature:swagger
+  @ApiOperation({ summary: 'Inicia o login via GitHub (redireciona)' })
+  // nestforge:feature:swagger:end
+  githubLogin() {
+    // o guard redireciona para o consentimento do GitHub; nada a fazer aqui
+  }
+
+  // nestforge:feature:auth:token
+  @Public()
+  @Get('github/callback')
+  @UseGuards(GithubAuthGuard)
+  // nestforge:feature:swagger
+  @ApiExcludeEndpoint()
+  // nestforge:feature:swagger:end
+  async githubCallback(@Req() req: Request) {
+    const user = await this.authService.validateOAuthLogin(req.user as OAuthProfile);
+    return this.tokenService.issueTokens(user.id, user.email, user.role);
+  }
+  // nestforge:feature:auth:token:end
+
+  // nestforge:feature:auth:session
+  @Public()
+  @Get('github/callback')
+  @UseGuards(GithubAuthGuard)
+  // nestforge:feature:swagger
+  @ApiExcludeEndpoint()
+  // nestforge:feature:swagger:end
+  async githubSessionCallback(@Req() request: Request) {
+    const user = await this.authService.validateOAuthLogin(
+      request.user as OAuthProfile,
+    );
+
+    return this.sessionService.establish(request, user);
+  }
+  // nestforge:feature:auth:session:end
+}

package/templates/prisma/src/auth/auth.module.ts

@@ -0,0 +1,59 @@
+import { Module } from '@nestjs/common';
+// nestforge:feature:auth:token
+import { JwtModule } from '@nestjs/jwt';
+import { TokenService } from './token.service';
+// nestforge:feature:auth:token:end
+import { PassportModule } from '@nestjs/passport';
+import { APP_GUARD } from '@nestjs/core';
+// nestforge:feature:redis
+import { MailModule } from '../mail/mail.module';
+// nestforge:feature:redis:end
+import { AuthService } from './auth.service';
+import { AuthController } from './auth.controller';
+// nestforge:feature:auth:token
+import { JwtStrategy } from './strategies/jwt.strategy';
+import { JwtAuthGuard } from './guards/jwt-auth.guard';
+// nestforge:feature:auth:token:end
+import { GoogleStrategy } from './strategies/google.strategy';
+import { GithubStrategy } from './strategies/github.strategy';
+// nestforge:feature:rbac
+import { RolesGuard } from '../common/guards/roles.guard';
+import { PermissionsGuard } from '../common/guards/permissions.guard';
+// nestforge:feature:rbac:end
+// nestforge:feature:auth:session
+import { SessionAuthGuard } from './guards/session-auth.guard';
+import { SessionService } from './session.service';
+// nestforge:feature:auth:session:end
+
+@Module({
+  imports: [
+    PassportModule,
+    // nestforge:feature:auth:token
+    JwtModule.register({}),
+    // nestforge:feature:auth:token:end
+    // nestforge:feature:redis
+    MailModule,
+    // nestforge:feature:redis:end
+  ],
+  controllers: [AuthController],
+  providers: [
+    AuthService,
+    // nestforge:feature:auth:token
+    TokenService,
+    JwtStrategy,
+    { provide: APP_GUARD, useClass: JwtAuthGuard },
+    // nestforge:feature:auth:token:end
+    // nestforge:feature:auth:session
+    SessionService,
+    { provide: APP_GUARD, useClass: SessionAuthGuard },
+    // nestforge:feature:auth:session:end
+    GoogleStrategy,
+    GithubStrategy,
+    // nestforge:feature:rbac
+    { provide: APP_GUARD, useClass: RolesGuard },
+    { provide: APP_GUARD, useClass: PermissionsGuard },
+    // nestforge:feature:rbac:end
+  ],
+  exports: [AuthService],
+})
+export class AuthModule { }

package/templates/prisma/src/auth/auth.service.spec.ts

@@ -0,0 +1,53 @@
+// nestforge:feature-file:auth:password
+import { describe, expect, it, vi, beforeEach } from 'vitest';
+import { ConflictException, UnauthorizedException } from '@nestjs/common';
+import { AuthService } from './auth.service';
+import { PrismaService } from '../database/prisma.service';
+// nestforge:feature:redis
+import { MailService } from '../mail/mail.service';
+// nestforge:feature:redis:end
+
+describe('AuthService', () => {
+  let authService: AuthService;
+  let prisma: any;
+  // nestforge:feature:redis
+  let mailService: MailService;
+  // nestforge:feature:redis:end
+
+  beforeEach(() => {
+    prisma = {
+      user: { findUnique: vi.fn(), create: vi.fn() },
+      refreshToken: { create: vi.fn(), findUnique: vi.fn(), update: vi.fn(), updateMany: vi.fn() },
+    };
+
+    // nestforge:feature:redis
+    mailService = {
+      queueVerificationEmail: vi.fn(),
+      queuePasswordResetEmail: vi.fn(),
+    } as unknown as MailService;
+    // nestforge:feature:redis:end
+
+    authService = new AuthService(
+      prisma as PrismaService,
+      // nestforge:feature:redis
+      mailService,
+      // nestforge:feature:redis:end
+    );
+  });
+
+  it('deve lançar ConflictException se o e-mail já existir', async () => {
+    prisma.user.findUnique.mockResolvedValue({ id: '1', email: 'jeiel@example.com' });
+
+    await expect(
+      authService.register({ name: 'Jeiel', email: 'jeiel@example.com', password: 'senhaForte123' }),
+    ).rejects.toBeInstanceOf(ConflictException);
+  });
+
+  it('deve lançar UnauthorizedException com credenciais inválidas', async () => {
+    prisma.user.findUnique.mockResolvedValue(null);
+
+    await expect(
+      authService.login({ email: 'naoexiste@example.com', password: 'qualquer123' }),
+    ).rejects.toBeInstanceOf(UnauthorizedException);
+  });
+});