speedrun-cli 2.6.1

package/templates/orm/mongoose/src/config/env.validation.ts

@@ -0,0 +1,55 @@
+import { z } from 'zod';
+
+export const envSchema = z.object({
+  NODE_ENV: z
+    .enum(['development', 'production', 'test'])
+    .default('development'),
+  PORT: z.coerce.number().default(8080),
+
+  // Database
+  DATABASE_URL: z.string().min(1, 'DATABASE_URL is required'),
+
+  // JWT Secrets
+  JWT_ACCESS_SECRET: z
+    .string()
+    .min(32, 'JWT_ACCESS_SECRET must be at least 32 characters'),
+  JWT_REFRESH_SECRET: z
+    .string()
+    .min(32, 'JWT_REFRESH_SECRET must be at least 32 characters'),
+  JWT_ACCESS_EXPIRY: z
+    .string()
+    .regex(/^\d+[smhd]$/, 'JWT_ACCESS_EXPIRY must be in format: 60m, 1h, etc.')
+    .default('15m'),
+  JWT_REFRESH_EXPIRY: z
+    .string()
+    .regex(/^\d+[smhd]$/, 'JWT_REFRESH_EXPIRY must be in format: 7d, 30d, etc.')
+    .default('7d'),
+
+  // CORS
+  CORS_ORIGIN: z
+    .string()
+    .refine((val) => {
+      const origins = val.split(',').map((o) => o.trim());
+      const urlRegex = /^https?:\/\/.+/;
+      return origins.every((origin) => urlRegex.test(origin) || origin === '*');
+    }, 'CORS_ORIGIN must be valid URL(s) or "*"')
+    .default('http://localhost:3000'),
+
+  // Logging
+  LOG_LEVEL: z
+    .enum(['fatal', 'error', 'warn', 'info', 'debug', 'trace'])
+    .default('info'),
+});
+
+export type Env = z.infer<typeof envSchema>;
+
+export function validate(config: Record<string, unknown>) {
+  const result = envSchema.safeParse(config);
+  if (!result.success) {
+    const errors = result.error.issues
+      .map((e) => `${e.path.join('.')}: ${e.message}`)
+      .join('\n');
+    throw new Error(`Environment validation failed:\n${errors}`);
+  }
+  return result.data;
+}

package/templates/orm/mongoose/src/database/database.module.ts

@@ -0,0 +1,19 @@
+import { Module } from '@nestjs/common';
+import { MongooseModule } from '@nestjs/mongoose';
+import { ConfigModule, ConfigService } from '@nestjs/config';
+
+@Module({
+  imports: [
+    MongooseModule.forRootAsync({
+      imports: [ConfigModule],
+      useFactory: (configService: ConfigService) => ({
+        uri: configService.get<string>('DATABASE_URL'),
+        // Connection options
+        retryWrites: true,
+        w: 'majority',
+      }),
+      inject: [ConfigService],
+    }),
+  ],
+})
+export class DatabaseModule {}

package/templates/orm/mongoose/src/database/seed.ts

@@ -0,0 +1,107 @@
+import { connect, connection } from 'mongoose';
+import * as bcrypt from 'bcrypt';
+import * as dotenv from 'dotenv';
+
+// Load environment variables
+dotenv.config();
+
+const SALT_ROUNDS = 12;
+
+interface UserDoc {
+  fullName: string;
+  email: string;
+  passwordHash: string;
+  role: 'USER' | 'ADMIN';
+  isActive: boolean;
+  createdAt: Date;
+  updatedAt: Date;
+}
+
+async function seed() {
+  const databaseUrl = process.env.DATABASE_URL;
+
+  if (!databaseUrl) {
+    console.error('❌ DATABASE_URL is not defined in environment variables');
+    process.exit(1);
+  }
+
+  console.log('🌱 Starting database seed...\n');
+
+  try {
+    // Connect to MongoDB
+    await connect(databaseUrl);
+    console.log('✓ Connected to MongoDB');
+
+    const db = connection.db;
+    if (!db) {
+      throw new Error('Failed to get database instance from connection');
+    }
+    const usersCollection = db.collection('users');
+
+    // Check if admin already exists
+    const existingAdmin = await usersCollection.findOne({ email: 'admin@example.com' });
+    
+    if (existingAdmin) {
+      console.log('⚠️  Admin user already exists, skipping...');
+    } else {
+      // Create admin user
+      const adminPasswordHash = await bcrypt.hash('Admin@123', SALT_ROUNDS);
+      const now = new Date();
+      
+      const adminUser: UserDoc = {
+        fullName: 'Admin User',
+        email: 'admin@example.com',
+        passwordHash: adminPasswordHash,
+        role: 'ADMIN',
+        isActive: true,
+        createdAt: now,
+        updatedAt: now,
+      };
+
+      await usersCollection.insertOne(adminUser);
+      console.log('✓ Created admin user');
+      console.log('  Email:    admin@example.com');
+      console.log('  Password: Admin@123');
+    }
+
+    // Check if regular user already exists
+    const existingUser = await usersCollection.findOne({ email: 'user@example.com' });
+    
+    if (existingUser) {
+      console.log('⚠️  Regular user already exists, skipping...');
+    } else {
+      // Create regular user
+      const userPasswordHash = await bcrypt.hash('User@123', SALT_ROUNDS);
+      const now = new Date();
+      
+      const regularUser: UserDoc = {
+        fullName: 'Regular User',
+        email: 'user@example.com',
+        passwordHash: userPasswordHash,
+        role: 'USER',
+        isActive: true,
+        createdAt: now,
+        updatedAt: now,
+      };
+
+      await usersCollection.insertOne(regularUser);
+      console.log('✓ Created regular user');
+      console.log('  Email:    user@example.com');
+      console.log('  Password: User@123');
+    }
+
+    // Create indexes
+    console.log('\n📇 Creating indexes...');
+    await usersCollection.createIndex({ email: 1 }, { unique: true });
+    console.log('✓ Created unique index on users.email');
+
+    console.log('\n✅ Database seed completed successfully!\n');
+  } catch (error) {
+    console.error('❌ Seed failed:', error);
+    process.exit(1);
+  } finally {
+    await connection.close();
+  }
+}
+
+seed();

package/templates/orm/mongoose/src/modules/auth/auth.module.ts

@@ -0,0 +1,21 @@
+import { Module } from '@nestjs/common';
+import { JwtModule } from '@nestjs/jwt';
+import { MongooseModule } from '@nestjs/mongoose';
+import { AuthController } from './auth.controller';
+import { AuthService } from './auth.service';
+import { User, UserSchema } from '../../schemas/user.schema';
+import { RefreshToken, RefreshTokenSchema } from '../../schemas/refresh-token.schema';
+
+@Module({
+  imports: [
+    MongooseModule.forFeature([
+      { name: User.name, schema: UserSchema },
+      { name: RefreshToken.name, schema: RefreshTokenSchema },
+    ]),
+    JwtModule.register({}),
+  ],
+  controllers: [AuthController],
+  providers: [AuthService],
+  exports: [AuthService, JwtModule],
+})
+export class AuthModule {}

package/templates/orm/mongoose/src/modules/auth/auth.service.ts

@@ -0,0 +1,272 @@
+import {
+  Injectable,
+  UnauthorizedException,
+  ConflictException,
+  ForbiddenException,
+  NotFoundException,
+} from '@nestjs/common';
+import { ConfigService } from '@nestjs/config';
+import { JwtService } from '@nestjs/jwt';
+import { InjectModel } from '@nestjs/mongoose';
+import { Model } from 'mongoose';
+import * as bcrypt from 'bcrypt';
+import { User, UserDocument, UserRole } from '../../schemas/user.schema';
+import { RefreshToken, RefreshTokenDocument } from '../../schemas/refresh-token.schema';
+import { SignupDto } from './dtos/signup.dto';
+import { LoginDto } from './dtos/login.dto';
+
+const SALT_ROUNDS = 12;
+
+@Injectable()
+export class AuthService {
+  constructor(
+    @InjectModel(User.name) private userModel: Model<UserDocument>,
+    @InjectModel(RefreshToken.name) private refreshTokenModel: Model<RefreshTokenDocument>,
+    private jwtService: JwtService,
+    private configService: ConfigService,
+  ) {}
+
+  async signup(signupDto: SignupDto) {
+    const { fullName, email, password } = signupDto;
+
+    // Check if user already exists
+    const existingUser = await this.userModel.findOne({ email: email.toLowerCase() });
+    if (existingUser) {
+      throw new ConflictException('User with this email already exists');
+    }
+
+    // Hash password and create user
+    const passwordHash = await bcrypt.hash(password, SALT_ROUNDS);
+    const user = await this.userModel.create({
+      fullName,
+      email: email.toLowerCase(),
+      passwordHash,
+      role: UserRole.USER,
+    });
+
+    return {
+      id: user._id.toString(),
+      fullName: user.fullName,
+      email: user.email,
+      role: user.role,
+    };
+  }
+
+  async login(loginDto: LoginDto, deviceInfo?: string, ipAddress?: string) {
+    const { email, password } = loginDto;
+
+    // Find user
+    const user = await this.userModel.findOne({ email: email.toLowerCase() });
+    if (!user) {
+      throw new UnauthorizedException('Invalid email or password');
+    }
+
+    // Check if user is active
+    if (!user.isActive) {
+      throw new UnauthorizedException('Account is deactivated');
+    }
+
+    // Verify password
+    const isPasswordValid = await bcrypt.compare(password, user.passwordHash);
+    if (!isPasswordValid) {
+      throw new UnauthorizedException('Invalid email or password');
+    }
+
+    // Generate tokens
+    const tokens = await this.generateTokens(user);
+
+    // Store refresh token in database
+    await this.storeRefreshToken(
+      tokens.refreshToken,
+      user._id.toString(),
+      deviceInfo || 'Unknown Device',
+      ipAddress || 'Unknown IP',
+    );
+
+    // Clean up expired tokens for this user
+    await this.cleanupExpiredTokens(user._id.toString());
+
+    return {
+      user: {
+        id: user._id.toString(),
+        fullName: user.fullName,
+        email: user.email,
+        role: user.role,
+      },
+      ...tokens,
+    };
+  }
+
+  async logout(userId: string, refreshToken?: string) {
+    if (refreshToken) {
+      // Find and revoke the specific refresh token by comparing hashes
+      const storedTokens = await this.refreshTokenModel.find({ userId });
+
+      for (const storedToken of storedTokens) {
+        const matches = await bcrypt.compare(refreshToken, storedToken.token);
+        if (matches) {
+          await this.refreshTokenModel.updateOne(
+            { _id: storedToken._id },
+            { isRevoked: true },
+          );
+          break;
+        }
+      }
+    } else {
+      // Logout from all devices - revoke all refresh tokens for this user
+      await this.refreshTokenModel.updateMany(
+        { userId, isRevoked: false },
+        { isRevoked: true },
+      );
+    }
+
+    return { message: 'Logged out successfully' };
+  }
+
+  async refreshToken(
+    userId: string,
+    rt: string,
+    deviceInfo?: string,
+    ipAddress?: string,
+  ) {
+    // Find the user
+    const user = await this.userModel.findById(userId);
+    if (!user) {
+      throw new ForbiddenException('Invalid refresh token');
+    }
+
+    // Find matching refresh token in database by comparing hashes
+    const storedTokens = await this.refreshTokenModel.find({
+      userId,
+      isRevoked: false,
+      expiresAt: { $gt: new Date() },
+    });
+
+    let validToken: RefreshTokenDocument | null = null;
+    for (const storedToken of storedTokens) {
+      const matches = await bcrypt.compare(rt, storedToken.token);
+      if (matches) {
+        validToken = storedToken;
+        break;
+      }
+    }
+
+    if (!validToken) {
+      throw new UnauthorizedException('Invalid refresh token');
+    }
+
+    // Revoke old refresh token (token rotation)
+    await this.refreshTokenModel.updateOne(
+      { _id: validToken._id },
+      { isRevoked: true },
+    );
+
+    // Generate new tokens
+    const tokens = await this.generateTokens(user);
+
+    // Store new refresh token
+    await this.storeRefreshToken(
+      tokens.refreshToken,
+      user._id.toString(),
+      deviceInfo || 'Unknown Device',
+      ipAddress || 'Unknown IP',
+    );
+
+    return tokens;
+  }
+
+  async getMe(userId: string) {
+    const user = await this.userModel.findById(userId);
+    if (!user) {
+      throw new NotFoundException('User not found');
+    }
+
+    return {
+      id: user._id.toString(),
+      fullName: user.fullName,
+      email: user.email,
+      role: user.role,
+    };
+  }
+
+  // Helper Methods
+
+  async hashData(data: string): Promise<string> {
+    return bcrypt.hash(data, SALT_ROUNDS);
+  }
+
+  async generateTokens(user: UserDocument): Promise<{ accessToken: string; refreshToken: string }> {
+    const payload = {
+      sub: user._id.toString(),
+      email: user.email,
+      role: user.role,
+    };
+
+    const accessExpiry = (this.configService.get<string>('JWT_ACCESS_EXPIRY') || '15m') as any;
+    const refreshExpiry = (this.configService.get<string>('JWT_REFRESH_EXPIRY') || '7d') as any;
+
+    const [accessToken, refreshToken] = await Promise.all([
+      this.jwtService.signAsync(payload, {
+        secret: this.configService.get<string>('JWT_ACCESS_SECRET'),
+        expiresIn: accessExpiry,
+      }),
+      this.jwtService.signAsync(payload, {
+        secret: this.configService.get<string>('JWT_REFRESH_SECRET'),
+        expiresIn: refreshExpiry,
+      }),
+    ]);
+
+    return { accessToken, refreshToken };
+  }
+
+  private async storeRefreshToken(
+    token: string,
+    userId: string,
+    userAgent: string,
+    ipAddress: string,
+  ) {
+    const expiresIn = this.configService.get<string>('JWT_REFRESH_EXPIRY') || '7d';
+    const expiresAt = this.calculateExpiry(expiresIn);
+
+    // Hash the refresh token before storing
+    const hashedToken = await this.hashData(token);
+
+    await this.refreshTokenModel.create({
+      token: hashedToken,
+      userId,
+      userAgent,
+      ipAddress,
+      expiresAt,
+    });
+  }
+
+  private calculateExpiry(expiresIn: string): Date {
+    const match = expiresIn.match(/^(\d+)([smhd])$/);
+    if (!match) {
+      return new Date(Date.now() + 7 * 24 * 60 * 60 * 1000); // Default 7 days
+    }
+
+    const value = parseInt(match[1], 10);
+    const unit = match[2];
+
+    const multipliers: Record<string, number> = {
+      s: 1000,
+      m: 60 * 1000,
+      h: 60 * 60 * 1000,
+      d: 24 * 60 * 60 * 1000,
+    };
+
+    return new Date(Date.now() + value * multipliers[unit]);
+  }
+
+  private async cleanupExpiredTokens(userId: string) {
+    // Remove expired/revoked refresh tokens for this user
+    await this.refreshTokenModel.deleteMany({
+      userId,
+      $or: [
+        { isRevoked: true },
+        { expiresAt: { $lt: new Date() } },
+      ],
+    });
+  }
+}

package/templates/orm/mongoose/src/modules/auth/dtos/login.dto.ts

@@ -0,0 +1,10 @@
+import { IsEmail, IsString, MinLength } from 'class-validator';
+
+export class LoginDto {
+  @IsEmail()
+  email: string;
+
+  @IsString()
+  @MinLength(6)
+  password: string;
+}

package/templates/orm/mongoose/src/modules/auth/dtos/signup.dto.ts

@@ -0,0 +1,8 @@
+import { IsString, MinLength } from 'class-validator';
+import { LoginDto } from './login.dto';
+
+export class SignupDto extends LoginDto {
+  @IsString()
+  @MinLength(2)
+  fullName: string;
+}

package/templates/orm/mongoose/src/modules/health/health.controller.ts

@@ -0,0 +1,26 @@
+import { Controller, Get } from '@nestjs/common';
+import { Connection } from 'mongoose';
+import { InjectConnection } from '@nestjs/mongoose';
+import { Public } from '../../common/decorators/public.decorator';
+
+@Controller('health')
+export class HealthController {
+  constructor(@InjectConnection() private connection: Connection) {}
+
+  @Public()
+  @Get()
+  async check() {
+    const dbStatus = this.connection.readyState === 1 ? 'healthy' : 'unhealthy';
+
+    return {
+      status: dbStatus === 'healthy' ? 'ok' : 'error',
+      timestamp: new Date().toISOString(),
+      services: {
+        database: {
+          status: dbStatus,
+          type: 'mongodb',
+        },
+      },
+    };
+  }
+}

package/templates/orm/mongoose/src/modules/health/health.module.ts

@@ -0,0 +1,7 @@
+import { Module } from '@nestjs/common';
+import { HealthController } from './health.controller';
+
+@Module({
+  controllers: [HealthController],
+})
+export class HealthModule {}

package/templates/orm/mongoose/src/modules/users/dtos/update-profile.dto.ts

@@ -0,0 +1,24 @@
+import {
+  IsEmail,
+  IsOptional,
+  IsString,
+  MaxLength,
+  MinLength,
+} from 'class-validator';
+
+export class UpdateProfileDto {
+  @IsOptional()
+  @IsString()
+  @MinLength(2)
+  @MaxLength(100)
+  fullName?: string;
+
+  @IsOptional()
+  @IsEmail()
+  email?: string;
+
+  @IsOptional()
+  @IsString()
+  @MinLength(6)
+  password?: string;
+}

package/templates/orm/mongoose/src/modules/users/dtos/update-user.dto.ts

@@ -0,0 +1,13 @@
+import { IsBoolean, IsEnum, IsOptional } from 'class-validator';
+import { UpdateProfileDto } from './update-profile.dto';
+import { UserRole } from '../../../schemas/user.schema';
+
+export class UpdateUserDto extends UpdateProfileDto {
+  @IsOptional()
+  @IsEnum(UserRole, { message: 'Role must be a valid UserRole' })
+  role?: UserRole;
+
+  @IsOptional()
+  @IsBoolean()
+  isActive?: boolean;
+}

package/templates/orm/mongoose/src/modules/users/users.module.ts

@@ -0,0 +1,19 @@
+import { Module } from '@nestjs/common';
+import { MongooseModule } from '@nestjs/mongoose';
+import { UsersController } from './users.controller';
+import { UsersService } from './users.service';
+import { User, UserSchema } from '../../schemas/user.schema';
+import { RefreshToken, RefreshTokenSchema } from '../../schemas/refresh-token.schema';
+
+@Module({
+  imports: [
+    MongooseModule.forFeature([
+      { name: User.name, schema: UserSchema },
+      { name: RefreshToken.name, schema: RefreshTokenSchema },
+    ]),
+  ],
+  controllers: [UsersController],
+  providers: [UsersService],
+  exports: [UsersService],
+})
+export class UsersModule {}