nestforge-generator 0.1.0

package/templates/typeorm/src/auth/guards/github-auth.guard.ts

@@ -0,0 +1,10 @@
+import { Injectable } from '@nestjs/common';
+import { AuthGuard } from '@nestjs/passport';
+
+@Injectable()
+export class GithubAuthGuard extends AuthGuard('github') {
+    constructor() {
+        // API stateless (Bearer token) — não usamos sessão do Passport/Express
+        super({ session: false });
+    }
+}

package/templates/typeorm/src/auth/guards/google-auth.guard.ts

@@ -0,0 +1,10 @@
+import { Injectable } from '@nestjs/common';
+import { AuthGuard } from '@nestjs/passport';
+
+@Injectable()
+export class GoogleAuthGuard extends AuthGuard('google') {
+    constructor() {
+        // API stateless (Bearer token) — não usamos sessão do Passport/Express
+        super({ session: false });
+    }
+}

package/templates/typeorm/src/auth/guards/jwt-auth.guard.ts

@@ -0,0 +1,25 @@
+// nestforge:feature-file:auth:token
+import { ExecutionContext, Injectable } from '@nestjs/common';
+import { Reflector } from '@nestjs/core';
+import { AuthGuard } from '@nestjs/passport';
+import { IS_PUBLIC_KEY } from '../../common/decorators/public.decorator';
+
+@Injectable()
+export class JwtAuthGuard extends AuthGuard('jwt') {
+  constructor(private reflector: Reflector) {
+    super();
+  }
+
+  canActivate(context: ExecutionContext) {
+    const isPublic = this.reflector.getAllAndOverride<boolean>(IS_PUBLIC_KEY, [
+      context.getHandler(),
+      context.getClass(),
+    ]);
+
+    if (isPublic) {
+      return true;
+    }
+
+    return super.canActivate(context);
+  }
+}

package/templates/typeorm/src/auth/guards/session-auth.guard.spec.ts

@@ -0,0 +1,77 @@
+// nestforge:feature-file:auth:session
+import {
+    ExecutionContext,
+    UnauthorizedException,
+} from '@nestjs/common';
+import { Reflector } from '@nestjs/core';
+import { Request } from 'express';
+import { beforeEach, describe, expect, it, vi } from 'vitest';
+import { SessionAuthGuard } from './session-auth.guard';
+
+describe('SessionAuthGuard', () => {
+    let reflector: {
+        getAllAndOverride: ReturnType<typeof vi.fn>;
+    };
+    let guard: SessionAuthGuard;
+
+    beforeEach(() => {
+        reflector = {
+            getAllAndOverride: vi.fn(),
+        };
+
+        guard = new SessionAuthGuard(reflector as unknown as Reflector);
+    });
+
+    function createContext(user?: {
+        id: string;
+        email: string;
+        role: string;
+    }) {
+        const request = {
+            session: {
+                user,
+            },
+        } as unknown as Request;
+
+        const context = {
+            getHandler: vi.fn(),
+            getClass: vi.fn(),
+            switchToHttp: vi.fn(() => ({
+                getRequest: () => request,
+            })),
+        } as unknown as ExecutionContext;
+
+        return { context, request };
+    }
+
+    it('permite acesso a rotas públicas sem sessão', () => {
+        reflector.getAllAndOverride.mockReturnValue(true);
+        const { context } = createContext();
+
+        expect(guard.canActivate(context)).toBe(true);
+    });
+
+    it('rejeita acesso quando não existe usuário na sessão', () => {
+        reflector.getAllAndOverride.mockReturnValue(false);
+        const { context } = createContext();
+
+        expect(() => guard.canActivate(context)).toThrow(
+            UnauthorizedException,
+        );
+    });
+
+    it('permite acesso e disponibiliza o usuário autenticado', () => {
+        reflector.getAllAndOverride.mockReturnValue(false);
+
+        const user = {
+            id: 'user-1',
+            email: 'jeiel@example.com',
+            role: 'USER',
+        };
+
+        const { context, request } = createContext(user);
+
+        expect(guard.canActivate(context)).toBe(true);
+        expect(request.user).toEqual(user);
+    });
+});

package/templates/typeorm/src/auth/guards/session-auth.guard.ts

@@ -0,0 +1,37 @@
+// nestforge:feature-file:auth:session
+import {
+    CanActivate,
+    ExecutionContext,
+    Injectable,
+    UnauthorizedException,
+} from '@nestjs/common';
+import { Reflector } from '@nestjs/core';
+import { Request } from 'express';
+import { IS_PUBLIC_KEY } from '../../common/decorators/public.decorator';
+
+@Injectable()
+export class SessionAuthGuard implements CanActivate {
+    constructor(private readonly reflector: Reflector) { }
+
+    canActivate(context: ExecutionContext): boolean {
+        const isPublic = this.reflector.getAllAndOverride<boolean>(IS_PUBLIC_KEY, [
+            context.getHandler(),
+            context.getClass(),
+        ]);
+
+        if (isPublic) {
+            return true;
+        }
+
+        const request = context.switchToHttp().getRequest<Request>();
+        const user = request.session?.user;
+
+        if (!user) {
+            throw new UnauthorizedException('Sessão inválida ou expirada');
+        }
+
+        request.user = user;
+
+        return true;
+    }
+}

package/templates/typeorm/src/auth/session.service.spec.ts

@@ -0,0 +1,74 @@
+// nestforge:feature-file:auth:session
+import { Request } from 'express';
+import { beforeEach, describe, expect, it, vi } from 'vitest';
+import { SessionService, SessionUser } from './session.service';
+
+describe('SessionService', () => {
+    let sessionService: SessionService;
+
+    beforeEach(() => {
+        sessionService = new SessionService();
+    });
+
+    function createRequest() {
+        const session = {
+            user: undefined,
+            csrfToken: undefined as string | undefined,
+            regenerate: vi.fn(
+                (callback: (error?: Error) => void) => callback(),
+            ),
+            save: vi.fn(
+                (callback: (error?: Error) => void) => callback(),
+            ),
+            destroy: vi.fn(
+                (callback: (error?: Error) => void) => callback(),
+            ),
+        };
+
+        return {
+            request: { session } as unknown as Request,
+            session,
+        };
+    }
+
+    it('regenera, preenche e salva a sessão', async () => {
+        const { request, session } = createRequest();
+        const user: SessionUser = {
+            id: 'user-1',
+            email: 'jeiel@example.com',
+            role: 'USER',
+        };
+
+        const result = await sessionService.establish(request, user);
+
+        expect(session.regenerate).toHaveBeenCalledOnce();
+        expect(session.user).toEqual(user);
+        expect(session.save).toHaveBeenCalledOnce();
+        expect(session.csrfToken).toMatch(/^[a-f0-9]{64}$/);
+        expect(result).toEqual({
+            user,
+            csrfToken: session.csrfToken,
+        });
+    });
+
+    it('emite e salva um novo token CSRF', async () => {
+        const { request, session } = createRequest();
+
+        const result = await sessionService.issueCsrfToken(request);
+
+        expect(result.csrfToken).toMatch(/^[a-f0-9]{64}$/);
+        expect(session.csrfToken).toBe(result.csrfToken);
+        expect(session.save).toHaveBeenCalledOnce();
+    });
+
+    it('destrói a sessão atual', async () => {
+        const { request, session } = createRequest();
+
+        const result = await sessionService.destroy(request);
+
+        expect(session.destroy).toHaveBeenCalledOnce();
+        expect(result).toEqual({
+            message: 'Logout realizado com sucesso',
+        });
+    });
+});

package/templates/typeorm/src/auth/session.service.ts

@@ -0,0 +1,96 @@
+// nestforge:feature-file:auth:session
+import {
+    Injectable,
+    InternalServerErrorException,
+} from '@nestjs/common';
+import { Request } from 'express';
+import { randomBytes } from 'node:crypto';
+
+export interface SessionUser {
+    id: string;
+    email: string;
+    role: string;
+}
+
+@Injectable()
+export class SessionService {
+    async establish(request: Request, user: SessionUser) {
+        await this.regenerate(request);
+
+        const csrfToken = this.generateCsrfToken();
+
+        request.session.user = user;
+        request.session.csrfToken = csrfToken;
+
+        await this.save(request);
+
+        return { user, csrfToken };
+    }
+
+    async issueCsrfToken(request: Request) {
+        const csrfToken = this.generateCsrfToken();
+
+        request.session.csrfToken = csrfToken;
+
+        await this.save(request);
+
+        return { csrfToken };
+    }
+
+    private generateCsrfToken(): string {
+        return randomBytes(32).toString('hex');
+    }
+
+    async destroy(request: Request) {
+        await new Promise<void>((resolve, reject) => {
+            request.session.destroy((error) => {
+                if (error) {
+                    reject(
+                        new InternalServerErrorException(
+                            'Não foi possível encerrar a sessão',
+                        ),
+                    );
+                    return;
+                }
+
+                resolve();
+            });
+        });
+
+        return { message: 'Logout realizado com sucesso' };
+    }
+
+    private async regenerate(request: Request): Promise<void> {
+        await new Promise<void>((resolve, reject) => {
+            request.session.regenerate((error) => {
+                if (error) {
+                    reject(
+                        new InternalServerErrorException(
+                            'Não foi possível iniciar a sessão',
+                        ),
+                    );
+                    return;
+                }
+
+                resolve();
+            });
+        });
+    }
+
+    private async save(request: Request): Promise<void> {
+        await new Promise<void>((resolve, reject) => {
+            request.session.save((error) => {
+                if (error) {
+                    reject(
+                        new InternalServerErrorException(
+                            'Não foi possível salvar a sessão',
+                        ),
+                    );
+                    return;
+                }
+
+                resolve();
+            });
+        });
+    }
+}

package/templates/typeorm/src/auth/strategies/github.strategy.ts

@@ -0,0 +1,41 @@
+import { Injectable } from '@nestjs/common';
+import { PassportStrategy } from '@nestjs/passport';
+import { Strategy, Profile } from 'passport-github2';
+import { OAuthProfile } from './google.strategy';
+import { ConfigService } from '@nestjs/config';
+
+@Injectable()
+export class GithubStrategy extends PassportStrategy(Strategy, 'github') {
+    constructor(configService: ConfigService) {
+        super({
+            clientID: configService.getOrThrow<string>('GITHUB_CLIENT_ID'),
+            clientSecret: configService.getOrThrow<string>(
+                'GITHUB_CLIENT_SECRET',
+            ),
+            callbackURL: `${configService.getOrThrow<string>(
+                'APP_URL',
+            )}/auth/github/callback`,
+            scope: ['user:email'],
+        });
+    }
+
+    async validate(
+        _accessToken: string,
+        _refreshToken: string,
+        profile: Profile,
+        done: (error: unknown, user?: OAuthProfile) => void,
+    ) {
+        // o e-mail pode vir vazio se o usuário deixou o e-mail privado no GitHub
+        const email =
+            profile.emails?.[0]?.value ?? `${profile.username}@users.noreply.github.com`;
+
+        const oauthProfile: OAuthProfile = {
+            provider: 'github',
+            providerUserId: profile.id,
+            email,
+            name: profile.displayName || profile.username || 'Usuário GitHub',
+        };
+
+        done(null, oauthProfile);
+    }
+}

package/templates/typeorm/src/auth/strategies/google.strategy.ts

@@ -0,0 +1,43 @@
+import { Injectable } from '@nestjs/common';
+import { PassportStrategy } from '@nestjs/passport';
+import { Strategy, Profile, VerifyCallback } from 'passport-google-oauth20';
+import { ConfigService } from '@nestjs/config';
+
+export interface OAuthProfile {
+    provider: 'google' | 'github';
+    providerUserId: string;
+    email: string;
+    name: string;
+}
+
+@Injectable()
+export class GoogleStrategy extends PassportStrategy(Strategy, 'google') {
+    constructor(configService: ConfigService) {
+        super({
+            clientID: configService.getOrThrow<string>('GOOGLE_CLIENT_ID'),
+            clientSecret: configService.getOrThrow<string>(
+                'GOOGLE_CLIENT_SECRET',
+            ),
+            callbackURL: `${configService.getOrThrow<string>(
+                'APP_URL',
+            )}/auth/google/callback`,
+            scope: ['email', 'profile'],
+        });
+    }
+
+    async validate(
+        _accessToken: string,
+        _refreshToken: string,
+        profile: Profile,
+        done: VerifyCallback,
+    ) {
+        const oauthProfile: OAuthProfile = {
+            provider: 'google',
+            providerUserId: profile.id,
+            email: profile.emails?.[0]?.value ?? '',
+            name: profile.displayName,
+        };
+
+        done(null, oauthProfile);
+    }
+}

package/templates/typeorm/src/auth/strategies/jwt.strategy.ts

@@ -0,0 +1,25 @@
+// nestforge:feature-file:auth:token
+import { Injectable } from '@nestjs/common';
+import { PassportStrategy } from '@nestjs/passport';
+import { ExtractJwt, Strategy } from 'passport-jwt';
+
+export interface JwtPayload {
+  sub: string;
+  email: string;
+  role: string;
+}
+
+@Injectable()
+export class JwtStrategy extends PassportStrategy(Strategy) {
+  constructor() {
+    super({
+      jwtFromRequest: ExtractJwt.fromAuthHeaderAsBearerToken(),
+      ignoreExpiration: false,
+      secretOrKey: process.env.JWT_ACCESS_SECRET as string,
+    });
+  }
+
+  async validate(payload: JwtPayload) {
+    return { id: payload.sub, email: payload.email, role: payload.role };
+  }
+}

package/templates/typeorm/src/auth/token.service.ts

@@ -0,0 +1,115 @@
+// nestforge:feature-file:auth:token
+import {
+    Injectable,
+    UnauthorizedException,
+} from '@nestjs/common';
+import { InjectRepository } from '@nestjs/typeorm';
+import { JwtService } from '@nestjs/jwt';
+import type { JwtSignOptions } from '@nestjs/jwt';
+import { IsNull, Repository } from 'typeorm';
+import { createHash } from 'crypto';
+import { RefreshTokenEntity } from './entities/refresh-token.entity';
+
+@Injectable()
+export class TokenService {
+    constructor(
+        @InjectRepository(RefreshTokenEntity)
+        private readonly refreshTokensRepository: Repository<RefreshTokenEntity>,
+        private readonly jwtService: JwtService,
+    ) { }
+
+    async issueTokens(
+        userId: string,
+        email: string,
+        role: string,
+    ) {
+        const payload = { sub: userId, email, role };
+
+        const accessTokenExpiresIn = (
+            process.env.JWT_ACCESS_EXPIRES_IN ?? '15m'
+        ) as JwtSignOptions['expiresIn'];
+
+        const refreshTokenExpiresIn = (
+            process.env.JWT_REFRESH_EXPIRES_IN ?? '7d'
+        ) as JwtSignOptions['expiresIn'];
+
+        const accessToken = this.jwtService.sign(payload, {
+            secret: process.env.JWT_ACCESS_SECRET,
+            expiresIn:
+                accessTokenExpiresIn,
+        });
+
+        const refreshToken = this.jwtService.sign(payload, {
+            secret: process.env.JWT_REFRESH_SECRET,
+            expiresIn:
+                refreshTokenExpiresIn,
+        });
+
+        const expiresAt = new Date();
+        expiresAt.setDate(expiresAt.getDate() + 7);
+
+        const storedToken = this.refreshTokensRepository.create({
+            tokenHash: this.hashToken(refreshToken),
+            userId,
+            expiresAt,
+            revokedAt: null,
+        });
+
+        await this.refreshTokensRepository.save(storedToken);
+
+        return { accessToken, refreshToken };
+    }
+
+    async refresh(refreshToken: string) {
+        const tokenHash = this.hashToken(refreshToken);
+
+        const stored = await this.refreshTokensRepository.findOne({
+            where: { tokenHash },
+            relations: {
+                user: true,
+            },
+        });
+
+        if (
+            !stored ||
+            stored.revokedAt ||
+            stored.expiresAt < new Date()
+        ) {
+            throw new UnauthorizedException(
+                'Refresh token inválido ou expirado',
+            );
+        }
+
+        stored.revokedAt = new Date();
+
+        await this.refreshTokensRepository.save(stored);
+
+        return this.issueTokens(
+            stored.user.id,
+            stored.user.email,
+            stored.user.role,
+        );
+    }
+
+    async logout(refreshToken: string) {
+        const tokenHash = this.hashToken(refreshToken);
+
+        await this.refreshTokensRepository.update(
+            {
+                tokenHash,
+                revokedAt: IsNull(),
+            },
+            {
+                revokedAt: new Date(),
+            },
+        );
+
+        return { message: 'Logout realizado com sucesso' };
+    }
+
+    private hashToken(token: string): string {
+        return createHash('sha256')
+            .update(token)
+            .digest('hex');
+    }
+}

package/templates/typeorm/src/common/constants/permissions.ts

@@ -0,0 +1,8 @@
+// nestforge:feature-file:rbac
+export enum Permission {
+    UserCreate = 'user:create',
+    UserRead = 'user:read',
+    UserUpdate = 'user:update',
+    UserDelete = 'user:delete',
+    ReportRead = 'report:read',
+}

package/templates/typeorm/src/common/constants/role-permissions.ts

@@ -0,0 +1,9 @@
+// nestforge:feature-file:rbac
+import { Role } from './role.enum';
+import { Permission } from './permissions';
+
+export const ROLE_PERMISSIONS: Record<Role, Permission[]> = {
+    [Role.ADMIN]: Object.values(Permission),
+    [Role.MANAGER]: [Permission.UserRead, Permission.UserUpdate, Permission.ReportRead],
+    [Role.USER]: [Permission.UserRead],
+};

package/templates/typeorm/src/common/constants/role.enum.ts

@@ -0,0 +1,5 @@
+export enum Role {
+    ADMIN = 'ADMIN',
+    MANAGER = 'MANAGER',
+    USER = 'USER',
+}

package/templates/typeorm/src/common/decorators/current-user.decorator.ts

@@ -0,0 +1,8 @@
+import { createParamDecorator, ExecutionContext } from '@nestjs/common';
+
+export const CurrentUser = createParamDecorator(
+  (data: unknown, ctx: ExecutionContext) => {
+    const request = ctx.switchToHttp().getRequest();
+    return request.user;
+  },
+);

package/templates/typeorm/src/common/decorators/permissions.decorator.ts

@@ -0,0 +1,7 @@
+// nestforge:feature-file:rbac
+import { SetMetadata } from '@nestjs/common';
+import { Permission } from '../constants/permissions';
+
+export const PERMISSIONS_KEY = 'permissions';
+export const Permissions = (...permissions: Permission[]) =>
+    SetMetadata(PERMISSIONS_KEY, permissions);

package/templates/typeorm/src/common/decorators/public.decorator.ts

@@ -0,0 +1,4 @@
+import { SetMetadata } from '@nestjs/common';
+
+export const IS_PUBLIC_KEY = 'isPublic';
+export const Public = () => SetMetadata(IS_PUBLIC_KEY, true);

package/templates/typeorm/src/common/decorators/roles.decorator.ts

@@ -0,0 +1,6 @@
+// nestforge:feature-file:rbac
+import { SetMetadata } from '@nestjs/common';
+import { Role } from '../constants/role.enum';
+
+export const ROLES_KEY = 'roles';
+export const Roles = (...roles: Role[]) => SetMetadata(ROLES_KEY, roles);

package/templates/typeorm/src/common/filters/http-exception.filter.ts

@@ -0,0 +1,34 @@
+import {
+  ArgumentsHost,
+  Catch,
+  ExceptionFilter,
+  HttpException,
+  HttpStatus,
+} from '@nestjs/common';
+import { Request, Response } from 'express';
+
+@Catch()
+export class HttpExceptionFilter implements ExceptionFilter {
+  catch(exception: unknown, host: ArgumentsHost) {
+    const ctx = host.switchToHttp();
+    const response = ctx.getResponse<Response>();
+    const request = ctx.getRequest<Request>();
+
+    const status =
+      exception instanceof HttpException
+        ? exception.getStatus()
+        : HttpStatus.INTERNAL_SERVER_ERROR;
+
+    const message =
+      exception instanceof HttpException
+        ? exception.getResponse()
+        : 'Erro interno do servidor';
+
+    response.status(status).json({
+      statusCode: status,
+      path: request.url,
+      timestamp: new Date().toISOString(),
+      message,
+    });
+  }
+}