nestforge-generator 0.1.0

package/templates/prisma/src/auth/auth.service.ts

@@ -0,0 +1,224 @@
+import {
+  ConflictException,
+  Injectable,
+  UnauthorizedException,
+} from '@nestjs/common';
+import * as bcrypt from 'bcryptjs';
+import { createHash, randomBytes } from 'crypto';
+import { PrismaService } from '../database/prisma.service';
+// nestforge:feature:redis,auth:password
+import { MailService } from '../mail/mail.service';
+// nestforge:feature:redis,auth:password:end
+// nestforge:feature:auth:password
+import { RegisterDto } from './dto/register.dto';
+import { LoginDto } from './dto/login.dto';
+// nestforge:feature:auth:password:end
+import { OAuthProfile } from './strategies/google.strategy';
+
+@Injectable()
+export class AuthService {
+  constructor(
+    private readonly prisma: PrismaService,
+    // nestforge:feature:redis,auth:password
+    private readonly mailService: MailService,
+    // nestforge:feature:redis,auth:password:end
+  ) { }
+
+  // nestforge:feature:auth:password
+  async register(dto: RegisterDto) {
+    const existing = await this.prisma.user.findUnique({
+      where: { email: dto.email },
+    });
+
+    if (existing) {
+      throw new ConflictException('E-mail já cadastrado');
+    }
+
+    const passwordHash = await bcrypt.hash(dto.password, 10);
+
+    const user = await this.prisma.user.create({
+      data: { name: dto.name, email: dto.email, passwordHash },
+    });
+
+    // nestforge:feature:redis
+    await this.sendEmailVerification(user.id, user.email, user.name);
+    // nestforge:feature:redis:end
+
+    return this.toAuthenticatedUser(user);
+  }
+
+  async login(dto: LoginDto) {
+    const user = await this.prisma.user.findUnique({
+      where: { email: dto.email },
+    });
+
+    if (!user || !user.passwordHash) {
+      throw new UnauthorizedException('Credenciais inválidas');
+    }
+
+    if (!(await bcrypt.compare(dto.password, user.passwordHash))) {
+      throw new UnauthorizedException('Credenciais inválidas');
+    }
+
+    return this.toAuthenticatedUser(user);
+  }
+  // nestforge:feature:auth:password:end
+
+  async validateOAuthLogin(profile: OAuthProfile) {
+    const linkedAccount = await this.prisma.oAuthAccount.findUnique({
+      where: {
+        provider_providerUserId: {
+          provider: profile.provider,
+          providerUserId: profile.providerUserId,
+        },
+      },
+      include: { user: true },
+    });
+
+    if (linkedAccount) {
+      return this.toAuthenticatedUser(linkedAccount.user);
+    }
+
+    let user = await this.prisma.user.findUnique({ where: { email: profile.email } });
+
+    if (!user) {
+      user = await this.prisma.user.create({
+        data: {
+          name: profile.name,
+          email: profile.email,
+          emailVerifiedAt: new Date(),
+        },
+      });
+    }
+
+    await this.prisma.oAuthAccount.create({
+      data: {
+        provider: profile.provider,
+        providerUserId: profile.providerUserId,
+        userId: user.id,
+      },
+    });
+
+    return this.toAuthenticatedUser(user);
+  }
+
+  // nestforge:feature:redis,auth:password
+  async forgotPassword(email: string) {
+    const user = await this.prisma.user.findUnique({ where: { email } });
+
+    // resposta genérica sempre, pra não revelar se o e-mail existe na base
+    const genericResponse = {
+      message: 'Se o e-mail existir, enviaremos instruções de redefinição de senha',
+    };
+
+    if (!user) {
+      return genericResponse;
+    }
+
+    const rawToken = randomBytes(32).toString('hex');
+    const expiresAt = new Date();
+    expiresAt.setHours(expiresAt.getHours() + 1);
+
+    await this.prisma.passwordResetToken.create({
+      data: {
+        tokenHash: this.hashToken(rawToken),
+        userId: user.id,
+        expiresAt,
+      },
+    });
+
+    await this.mailService.queuePasswordResetEmail(user.email, user.name, rawToken);
+
+    return genericResponse;
+  }
+
+  async resetPassword(rawToken: string, newPassword: string) {
+    const tokenHash = this.hashToken(rawToken);
+
+    const stored = await this.prisma.passwordResetToken.findUnique({
+      where: { tokenHash },
+    });
+
+    if (!stored || stored.usedAt || stored.expiresAt < new Date()) {
+      throw new UnauthorizedException('Token de redefinição inválido ou expirado');
+    }
+
+    const passwordHash = await bcrypt.hash(newPassword, 10);
+
+    await this.prisma.$transaction([
+      this.prisma.user.update({
+        where: { id: stored.userId },
+        data: { passwordHash },
+      }),
+      this.prisma.passwordResetToken.update({
+        where: { id: stored.id },
+        data: { usedAt: new Date() },
+      }),
+      // por segurança, revoga todas as sessões ativas ao trocar a senha
+      this.prisma.refreshToken.updateMany({
+        where: { userId: stored.userId, revokedAt: null },
+        data: { revokedAt: new Date() },
+      }),
+    ]);
+
+    return { message: 'Senha redefinida com sucesso' };
+  }
+
+  async verifyEmail(rawToken: string) {
+    const tokenHash = this.hashToken(rawToken);
+
+    const stored = await this.prisma.emailVerificationToken.findUnique({
+      where: { tokenHash },
+    });
+
+    if (!stored || stored.usedAt || stored.expiresAt < new Date()) {
+      throw new UnauthorizedException('Token de verificação inválido ou expirado');
+    }
+
+    await this.prisma.$transaction([
+      this.prisma.user.update({
+        where: { id: stored.userId },
+        data: { emailVerifiedAt: new Date() },
+      }),
+      this.prisma.emailVerificationToken.update({
+        where: { id: stored.id },
+        data: { usedAt: new Date() },
+      }),
+    ]);
+
+    return { message: 'E-mail verificado com sucesso' };
+  }
+
+  private async sendEmailVerification(userId: string, email: string, name: string) {
+    const rawToken = randomBytes(32).toString('hex');
+    const expiresAt = new Date();
+    expiresAt.setHours(expiresAt.getHours() + 24);
+
+    await this.prisma.emailVerificationToken.create({
+      data: {
+        tokenHash: this.hashToken(rawToken),
+        userId,
+        expiresAt,
+      },
+    });
+
+    await this.mailService.queueVerificationEmail(email, name, rawToken);
+  }
+  // nestforge:feature:redis,auth:password:end
+
+  private toAuthenticatedUser(user: {
+    id: string;
+    email: string;
+    role: string;
+  }) {
+    return {
+      id: user.id,
+      email: user.email,
+      role: user.role,
+    };
+  }
+
+  private hashToken(token: string): string {
+    return createHash('sha256').update(token).digest('hex');
+  }
+}

package/templates/prisma/src/auth/dto/forgot-password.dto.ts

@@ -0,0 +1,9 @@
+// nestforge:feature-file:redis,auth:password
+import { z } from 'zod';
+import { createZodDto } from 'nestjs-zod';
+
+export const forgotPasswordSchema = z.object({
+    email: z.string().email().describe('E-mail da conta a ser recuperada'),
+});
+
+export class ForgotPasswordDto extends createZodDto(forgotPasswordSchema) { }

package/templates/prisma/src/auth/dto/login.dto.ts

@@ -0,0 +1,10 @@
+// nestforge:feature-file:auth:password
+import { z } from 'zod';
+import { createZodDto } from 'nestjs-zod';
+
+export const loginSchema = z.object({
+  email: z.string().email().describe('E-mail do usuário'),
+  password: z.string().min(8).describe('Senha'),
+});
+
+export class LoginDto extends createZodDto(loginSchema) { }

package/templates/prisma/src/auth/dto/refresh-token.dto.ts

@@ -0,0 +1,9 @@
+// nestforge:feature-file:auth:token
+import { z } from 'zod';
+import { createZodDto } from 'nestjs-zod';
+
+export const refreshTokenSchema = z.object({
+  refreshToken: z.string().describe('Refresh token emitido no login'),
+});
+
+export class RefreshTokenDto extends createZodDto(refreshTokenSchema) { }

package/templates/prisma/src/auth/dto/register.dto.ts

@@ -0,0 +1,11 @@
+// nestforge:feature-file:auth:password
+import { z } from 'zod';
+import { createZodDto } from 'nestjs-zod';
+
+export const registerSchema = z.object({
+  name: z.string().min(2).describe('Nome completo do usuário'),
+  email: z.string().email().describe('E-mail do usuário'),
+  password: z.string().min(8).describe('Senha (mínimo 8 caracteres)'),
+});
+
+export class RegisterDto extends createZodDto(registerSchema) { }

package/templates/prisma/src/auth/dto/reset-password.dto.ts

@@ -0,0 +1,10 @@
+// nestforge:feature-file:redis,auth:password
+import { z } from 'zod';
+import { createZodDto } from 'nestjs-zod';
+
+export const resetPasswordSchema = z.object({
+    token: z.string().describe('Token recebido por e-mail'),
+    password: z.string().min(8).describe('Nova senha (mínimo 8 caracteres)'),
+});
+
+export class ResetPasswordDto extends createZodDto(resetPasswordSchema) { }

package/templates/prisma/src/auth/guards/github-auth.guard.ts

@@ -0,0 +1,10 @@
+import { Injectable } from '@nestjs/common';
+import { AuthGuard } from '@nestjs/passport';
+
+@Injectable()
+export class GithubAuthGuard extends AuthGuard('github') {
+    constructor() {
+        // API stateless (Bearer token) — não usamos sessão do Passport/Express
+        super({ session: false });
+    }
+}

package/templates/prisma/src/auth/guards/google-auth.guard.ts

@@ -0,0 +1,10 @@
+import { Injectable } from '@nestjs/common';
+import { AuthGuard } from '@nestjs/passport';
+
+@Injectable()
+export class GoogleAuthGuard extends AuthGuard('google') {
+    constructor() {
+        // API stateless (Bearer token) — não usamos sessão do Passport/Express
+        super({ session: false });
+    }
+}

package/templates/prisma/src/auth/guards/jwt-auth.guard.ts

@@ -0,0 +1,25 @@
+// nestforge:feature-file:auth:token
+import { ExecutionContext, Injectable } from '@nestjs/common';
+import { Reflector } from '@nestjs/core';
+import { AuthGuard } from '@nestjs/passport';
+import { IS_PUBLIC_KEY } from '../../common/decorators/public.decorator';
+
+@Injectable()
+export class JwtAuthGuard extends AuthGuard('jwt') {
+  constructor(private reflector: Reflector) {
+    super();
+  }
+
+  canActivate(context: ExecutionContext) {
+    const isPublic = this.reflector.getAllAndOverride<boolean>(IS_PUBLIC_KEY, [
+      context.getHandler(),
+      context.getClass(),
+    ]);
+
+    if (isPublic) {
+      return true;
+    }
+
+    return super.canActivate(context);
+  }
+}

package/templates/prisma/src/auth/guards/session-auth.guard.spec.ts

@@ -0,0 +1,77 @@
+// nestforge:feature-file:auth:session
+import {
+    ExecutionContext,
+    UnauthorizedException,
+} from '@nestjs/common';
+import { Reflector } from '@nestjs/core';
+import { Request } from 'express';
+import { beforeEach, describe, expect, it, vi } from 'vitest';
+import { SessionAuthGuard } from './session-auth.guard';
+
+describe('SessionAuthGuard', () => {
+    let reflector: {
+        getAllAndOverride: ReturnType<typeof vi.fn>;
+    };
+    let guard: SessionAuthGuard;
+
+    beforeEach(() => {
+        reflector = {
+            getAllAndOverride: vi.fn(),
+        };
+
+        guard = new SessionAuthGuard(reflector as unknown as Reflector);
+    });
+
+    function createContext(user?: {
+        id: string;
+        email: string;
+        role: string;
+    }) {
+        const request = {
+            session: {
+                user,
+            },
+        } as unknown as Request;
+
+        const context = {
+            getHandler: vi.fn(),
+            getClass: vi.fn(),
+            switchToHttp: vi.fn(() => ({
+                getRequest: () => request,
+            })),
+        } as unknown as ExecutionContext;
+
+        return { context, request };
+    }
+
+    it('permite acesso a rotas públicas sem sessão', () => {
+        reflector.getAllAndOverride.mockReturnValue(true);
+        const { context } = createContext();
+
+        expect(guard.canActivate(context)).toBe(true);
+    });
+
+    it('rejeita acesso quando não existe usuário na sessão', () => {
+        reflector.getAllAndOverride.mockReturnValue(false);
+        const { context } = createContext();
+
+        expect(() => guard.canActivate(context)).toThrow(
+            UnauthorizedException,
+        );
+    });
+
+    it('permite acesso e disponibiliza o usuário autenticado', () => {
+        reflector.getAllAndOverride.mockReturnValue(false);
+
+        const user = {
+            id: 'user-1',
+            email: 'jeiel@example.com',
+            role: 'USER',
+        };
+
+        const { context, request } = createContext(user);
+
+        expect(guard.canActivate(context)).toBe(true);
+        expect(request.user).toEqual(user);
+    });
+});

package/templates/prisma/src/auth/guards/session-auth.guard.ts

@@ -0,0 +1,37 @@
+// nestforge:feature-file:auth:session
+import {
+    CanActivate,
+    ExecutionContext,
+    Injectable,
+    UnauthorizedException,
+} from '@nestjs/common';
+import { Reflector } from '@nestjs/core';
+import { Request } from 'express';
+import { IS_PUBLIC_KEY } from '../../common/decorators/public.decorator';
+
+@Injectable()
+export class SessionAuthGuard implements CanActivate {
+    constructor(private readonly reflector: Reflector) { }
+
+    canActivate(context: ExecutionContext): boolean {
+        const isPublic = this.reflector.getAllAndOverride<boolean>(IS_PUBLIC_KEY, [
+            context.getHandler(),
+            context.getClass(),
+        ]);
+
+        if (isPublic) {
+            return true;
+        }
+
+        const request = context.switchToHttp().getRequest<Request>();
+        const user = request.session?.user;
+
+        if (!user) {
+            throw new UnauthorizedException('Sessão inválida ou expirada');
+        }
+
+        request.user = user;
+
+        return true;
+    }
+}

package/templates/prisma/src/auth/session.service.spec.ts

@@ -0,0 +1,74 @@
+// nestforge:feature-file:auth:session
+import { Request } from 'express';
+import { beforeEach, describe, expect, it, vi } from 'vitest';
+import { SessionService, SessionUser } from './session.service';
+
+describe('SessionService', () => {
+    let sessionService: SessionService;
+
+    beforeEach(() => {
+        sessionService = new SessionService();
+    });
+
+    function createRequest() {
+        const session = {
+            user: undefined,
+            csrfToken: undefined as string | undefined,
+            regenerate: vi.fn(
+                (callback: (error?: Error) => void) => callback(),
+            ),
+            save: vi.fn(
+                (callback: (error?: Error) => void) => callback(),
+            ),
+            destroy: vi.fn(
+                (callback: (error?: Error) => void) => callback(),
+            ),
+        };
+
+        return {
+            request: { session } as unknown as Request,
+            session,
+        };
+    }
+
+    it('regenera, preenche e salva a sessão', async () => {
+        const { request, session } = createRequest();
+        const user: SessionUser = {
+            id: 'user-1',
+            email: 'jeiel@example.com',
+            role: 'USER',
+        };
+
+        const result = await sessionService.establish(request, user);
+
+        expect(session.regenerate).toHaveBeenCalledOnce();
+        expect(session.user).toEqual(user);
+        expect(session.save).toHaveBeenCalledOnce();
+        expect(session.csrfToken).toMatch(/^[a-f0-9]{64}$/);
+        expect(result).toEqual({
+            user,
+            csrfToken: session.csrfToken,
+        });
+    });
+
+    it('emite e salva um novo token CSRF', async () => {
+        const { request, session } = createRequest();
+
+        const result = await sessionService.issueCsrfToken(request);
+
+        expect(result.csrfToken).toMatch(/^[a-f0-9]{64}$/);
+        expect(session.csrfToken).toBe(result.csrfToken);
+        expect(session.save).toHaveBeenCalledOnce();
+    });
+
+    it('destrói a sessão atual', async () => {
+        const { request, session } = createRequest();
+
+        const result = await sessionService.destroy(request);
+
+        expect(session.destroy).toHaveBeenCalledOnce();
+        expect(result).toEqual({
+            message: 'Logout realizado com sucesso',
+        });
+    });
+});

package/templates/prisma/src/auth/session.service.ts

@@ -0,0 +1,96 @@
+// nestforge:feature-file:auth:session
+import {
+    Injectable,
+    InternalServerErrorException,
+} from '@nestjs/common';
+import { Request } from 'express';
+import { randomBytes } from 'node:crypto';
+
+export interface SessionUser {
+    id: string;
+    email: string;
+    role: string;
+}
+
+@Injectable()
+export class SessionService {
+    async establish(request: Request, user: SessionUser) {
+        await this.regenerate(request);
+
+        const csrfToken = this.generateCsrfToken();
+
+        request.session.user = user;
+        request.session.csrfToken = csrfToken;
+
+        await this.save(request);
+
+        return { user, csrfToken };
+    }
+
+    async issueCsrfToken(request: Request) {
+        const csrfToken = this.generateCsrfToken();
+
+        request.session.csrfToken = csrfToken;
+
+        await this.save(request);
+
+        return { csrfToken };
+    }
+
+    private generateCsrfToken(): string {
+        return randomBytes(32).toString('hex');
+    }
+
+    async destroy(request: Request) {
+        await new Promise<void>((resolve, reject) => {
+            request.session.destroy((error) => {
+                if (error) {
+                    reject(
+                        new InternalServerErrorException(
+                            'Não foi possível encerrar a sessão',
+                        ),
+                    );
+                    return;
+                }
+
+                resolve();
+            });
+        });
+
+        return { message: 'Logout realizado com sucesso' };
+    }
+
+    private async regenerate(request: Request): Promise<void> {
+        await new Promise<void>((resolve, reject) => {
+            request.session.regenerate((error) => {
+                if (error) {
+                    reject(
+                        new InternalServerErrorException(
+                            'Não foi possível iniciar a sessão',
+                        ),
+                    );
+                    return;
+                }
+
+                resolve();
+            });
+        });
+    }
+
+    private async save(request: Request): Promise<void> {
+        await new Promise<void>((resolve, reject) => {
+            request.session.save((error) => {
+                if (error) {
+                    reject(
+                        new InternalServerErrorException(
+                            'Não foi possível salvar a sessão',
+                        ),
+                    );
+                    return;
+                }
+
+                resolve();
+            });
+        });
+    }
+}

package/templates/prisma/src/auth/strategies/github.strategy.ts

@@ -0,0 +1,41 @@
+import { Injectable } from '@nestjs/common';
+import { PassportStrategy } from '@nestjs/passport';
+import { Strategy, Profile } from 'passport-github2';
+import { OAuthProfile } from './google.strategy';
+import { ConfigService } from '@nestjs/config';
+
+@Injectable()
+export class GithubStrategy extends PassportStrategy(Strategy, 'github') {
+    constructor(configService: ConfigService) {
+        super({
+            clientID: configService.getOrThrow<string>('GITHUB_CLIENT_ID'),
+            clientSecret: configService.getOrThrow<string>(
+                'GITHUB_CLIENT_SECRET',
+            ),
+            callbackURL: `${configService.getOrThrow<string>(
+                'APP_URL',
+            )}/auth/github/callback`,
+            scope: ['user:email'],
+        });
+    }
+
+    async validate(
+        _accessToken: string,
+        _refreshToken: string,
+        profile: Profile,
+        done: (error: unknown, user?: OAuthProfile) => void,
+    ) {
+        // o e-mail pode vir vazio se o usuário deixou o e-mail privado no GitHub
+        const email =
+            profile.emails?.[0]?.value ?? `${profile.username}@users.noreply.github.com`;
+
+        const oauthProfile: OAuthProfile = {
+            provider: 'github',
+            providerUserId: profile.id,
+            email,
+            name: profile.displayName || profile.username || 'Usuário GitHub',
+        };
+
+        done(null, oauthProfile);
+    }
+}