speedrun-cli 2.6.1

package/templates/orm/mongoose/src/modules/users/users.service.ts

@@ -0,0 +1,179 @@
+import {
+  Injectable,
+  NotFoundException,
+  ConflictException,
+} from '@nestjs/common';
+import { InjectModel } from '@nestjs/mongoose';
+import { Model } from 'mongoose';
+import * as bcrypt from 'bcrypt';
+import { User, UserDocument, UserRole } from '../../schemas/user.schema';
+import { RefreshToken, RefreshTokenDocument } from '../../schemas/refresh-token.schema';
+import { UpdateProfileDto } from './dtos/update-profile.dto';
+import { UpdateUserDto } from './dtos/update-user.dto';
+
+const SALT_ROUNDS = 12;
+
+@Injectable()
+export class UsersService {
+  constructor(
+    @InjectModel(User.name) private userModel: Model<UserDocument>,
+    @InjectModel(RefreshToken.name) private refreshTokenModel: Model<RefreshTokenDocument>,
+  ) {}
+
+  async getProfile(userId: string) {
+    const user = await this.userModel.findById(userId).select('-passwordHash');
+    if (!user) {
+      throw new NotFoundException('User not found');
+    }
+    return this.sanitizeUser(user);
+  }
+
+  async updateProfile(userId: string, updateProfileDto: UpdateProfileDto) {
+    const user = await this.userModel.findById(userId);
+    if (!user) {
+      throw new NotFoundException('User not found');
+    }
+
+    // Check if email is being changed and if it's already taken
+    if (updateProfileDto.email && updateProfileDto.email !== user.email) {
+      const existingUser = await this.userModel.findOne({
+        email: updateProfileDto.email.toLowerCase(),
+        _id: { $ne: userId },
+      });
+      if (existingUser) {
+        throw new ConflictException('Email already in use');
+      }
+    }
+
+    // Hash new password if provided
+    let passwordHash: string | undefined;
+    if (updateProfileDto.password) {
+      passwordHash = await bcrypt.hash(updateProfileDto.password, SALT_ROUNDS);
+    }
+
+    const updateData: any = {};
+    if (updateProfileDto.fullName) updateData.fullName = updateProfileDto.fullName;
+    if (updateProfileDto.email) updateData.email = updateProfileDto.email.toLowerCase();
+    if (passwordHash) updateData.passwordHash = passwordHash;
+
+    const updatedUser = await this.userModel
+      .findByIdAndUpdate(userId, updateData, { new: true })
+      .select('-passwordHash');
+
+    return this.sanitizeUser(updatedUser);
+  }
+
+  // Admin methods
+
+  async getAllUsers(page: number = 1, limit: number = 10) {
+    const skip = (page - 1) * limit;
+
+    const [usersList, total] = await Promise.all([
+      this.userModel
+        .find()
+        .select('-passwordHash')
+        .skip(skip)
+        .limit(limit)
+        .sort({ createdAt: -1 }),
+      this.userModel.countDocuments(),
+    ]);
+
+    const totalPages = Math.ceil(total / limit);
+
+    return {
+      data: usersList.map((user) => this.sanitizeUser(user)),
+      meta: {
+        total,
+        page,
+        limit,
+        totalPages,
+        hasNext: page < totalPages,
+        hasPrevious: page > 1,
+      },
+    };
+  }
+
+  async getUserById(userId: string) {
+    if (!userId) {
+      return null;
+    }
+
+    const user = await this.userModel.findById(userId).select('-passwordHash');
+    if (!user) {
+      return null;
+    }
+
+    return this.sanitizeUser(user);
+  }
+
+  async updateUserById(userId: string, updateUserDto: UpdateUserDto) {
+    // Check if user exists
+    const user = await this.userModel.findById(userId);
+    if (!user) {
+      throw new NotFoundException('User not found');
+    }
+
+    // Check if email is being changed and if it's already taken
+    if (updateUserDto.email && updateUserDto.email !== user.email) {
+      const existingUser = await this.userModel.findOne({
+        email: updateUserDto.email.toLowerCase(),
+        _id: { $ne: userId },
+      });
+      if (existingUser) {
+        throw new ConflictException('Email already in use');
+      }
+    }
+
+    // Hash new password if provided
+    let passwordHash: string | undefined;
+    if (updateUserDto.password) {
+      passwordHash = await bcrypt.hash(updateUserDto.password, SALT_ROUNDS);
+    }
+
+    const updateData: any = {};
+    if (updateUserDto.fullName) updateData.fullName = updateUserDto.fullName;
+    if (updateUserDto.email) updateData.email = updateUserDto.email.toLowerCase();
+    if (updateUserDto.role) updateData.role = updateUserDto.role;
+    if (updateUserDto.isActive !== undefined) updateData.isActive = updateUserDto.isActive;
+    if (passwordHash) updateData.passwordHash = passwordHash;
+
+    const updatedUser = await this.userModel
+      .findByIdAndUpdate(userId, updateData, { new: true })
+      .select('-passwordHash');
+
+    return this.sanitizeUser(updatedUser);
+  }
+
+  async deleteUserById(userId: string) {
+    const user = await this.userModel.findById(userId);
+    if (!user) {
+      throw new NotFoundException('User not found');
+    }
+
+    // Delete user's refresh tokens
+    await this.refreshTokenModel.deleteMany({ userId });
+
+    // Delete user
+    await this.userModel.findByIdAndDelete(userId);
+
+    return { message: 'User deleted successfully' };
+  }
+
+  // Utils
+
+  private sanitizeUser(user: UserDocument | null) {
+    if (!user) {
+      return null;
+    }
+
+    return {
+      id: user._id.toString(),
+      fullName: user.fullName,
+      email: user.email,
+      role: user.role,
+      isActive: user.isActive,
+      createdAt: user.createdAt,
+      updatedAt: user.updatedAt,
+    };
+  }
+}

package/templates/orm/mongoose/src/schemas/index.ts

@@ -0,0 +1,2 @@
+export * from './user.schema';
+export * from './refresh-token.schema';

package/templates/orm/mongoose/src/schemas/refresh-token.schema.ts

@@ -0,0 +1,55 @@
+import { Prop, Schema, SchemaFactory } from '@nestjs/mongoose';
+import { Document, Types } from 'mongoose';
+
+export type RefreshTokenDocument = RefreshToken & Document;
+
+@Schema({
+  timestamps: true,
+  toJSON: {
+    transform: (_, ret: Record<string, any>) => {
+      ret.id = ret._id.toString();
+      delete ret._id;
+      delete ret.__v;
+      return ret;
+    },
+  },
+})
+export class RefreshToken {
+  _id: Types.ObjectId;
+
+  @Prop({ required: true })
+  token: string;
+
+  @Prop({ type: Types.ObjectId, ref: 'User', required: true })
+  userId: Types.ObjectId;
+
+  @Prop({ required: true })
+  userAgent: string;
+
+  @Prop({ required: true })
+  ipAddress: string;
+
+  @Prop({ required: true })
+  expiresAt: Date;
+
+  @Prop({ default: false })
+  isRevoked: boolean;
+
+  @Prop({ default: Date.now })
+  createdAt: Date;
+
+  @Prop({ default: Date.now })
+  updatedAt: Date;
+
+  // Virtual for id
+  get id(): string {
+    return this._id.toString();
+  }
+}
+
+export const RefreshTokenSchema = SchemaFactory.createForClass(RefreshToken);
+
+// Add indexes for common queries
+RefreshTokenSchema.index({ token: 1 });
+RefreshTokenSchema.index({ userId: 1 });
+RefreshTokenSchema.index({ expiresAt: 1 }, { expireAfterSeconds: 0 }); // TTL index for auto-cleanup

package/templates/orm/mongoose/src/schemas/user.schema.ts

@@ -0,0 +1,53 @@
+import { Prop, Schema, SchemaFactory } from '@nestjs/mongoose';
+import { Document, Types } from 'mongoose';
+
+export type UserDocument = User & Document;
+
+export enum UserRole {
+  USER = 'USER',
+  ADMIN = 'ADMIN',
+}
+
+@Schema({
+  timestamps: true,
+  toJSON: {
+    transform: (_, ret: Record<string, any>) => {
+      ret.id = ret._id.toString();
+      delete ret._id;
+      delete ret.__v;
+      delete ret.passwordHash;
+      return ret;
+    },
+  },
+})
+export class User {
+  _id: Types.ObjectId;
+
+  @Prop({ required: true })
+  fullName: string;
+
+  @Prop({ required: true, unique: true, lowercase: true, trim: true })
+  email: string;
+
+  @Prop({ required: true })
+  passwordHash: string;
+
+  @Prop({ type: String, enum: UserRole, default: UserRole.USER })
+  role: UserRole;
+
+  @Prop({ default: true })
+  isActive: boolean;
+
+  @Prop({ default: Date.now })
+  createdAt: Date;
+
+  @Prop({ default: Date.now })
+  updatedAt: Date;
+
+  // Virtual for id
+  get id(): string {
+    return this._id.toString();
+  }
+}
+
+export const UserSchema = SchemaFactory.createForClass(User);

package/templates/orm/prisma/package.json

@@ -0,0 +1,102 @@
+{
+  "name": "nestjs-jwt-rbac-boilerplate",
+  "version": "0.0.1",
+  "description": "Production-ready NestJS authentication system with JWT, refresh tokens, and RBAC",
+  "author": "",
+  "private": true,
+  "license": "MIT",
+  "scripts": {
+    "build": "nest build",
+    "format": "prettier --write \"src/**/*.ts\" \"test/**/*.ts\"",
+    "start": "nest start",
+    "start:dev": "nest start --watch",
+    "start:debug": "nest start --debug --watch",
+    "start:prod": "node dist/main",
+    "lint": "eslint \"{src,apps,libs,test}/**/*.ts\" --fix",
+    "test": "jest",
+    "test:watch": "jest --watch",
+    "test:cov": "jest --coverage",
+    "test:debug": "node --inspect-brk -r tsconfig-paths/register -r ts-node/register node_modules/.bin/jest --runInBand",
+    "test:e2e": "jest --config ./test/jest-e2e.json",
+    "prisma:generate": "prisma generate",
+    "prisma:migrate": "prisma migrate dev",
+    "prisma:migrate:create": "prisma migrate dev --create-only",
+    "prisma:migrate:deploy": "prisma migrate deploy",
+    "prisma:migrate:status": "prisma migrate status",
+    "prisma:seed": "ts-node prisma/seed.ts",
+    "prisma:studio": "prisma studio",
+    "prisma:reset": "prisma migrate reset --force"
+  },
+  "prisma": {
+    "seed": "ts-node prisma/seed.ts"
+  },
+  "dependencies": {
+    "@nestjs/common": "^11.0.1",
+    "@nestjs/config": "^4.0.2",
+    "@nestjs/core": "^11.0.1",
+    "@nestjs/jwt": "^11.0.1",
+    "@nestjs/mapped-types": "*",
+    "@nestjs/platform-express": "^11.0.1",
+    "@nestjs/schedule": "^6.0.1",
+    "@nestjs/terminus": "^11.0.0",
+    "@nestjs/throttler": "^6.4.0",
+    "@prisma/client": "^6.19.0",
+    "bcrypt": "^6.0.0",
+    "class-transformer": "^0.5.1",
+    "class-validator": "^0.14.2",
+    "cookie-parser": "^1.4.7",
+    "dotenv": "^17.2.3",
+    "helmet": "^8.1.0",
+    "nestjs-pino": "^4.4.1",
+    "pino-http": "^10.5.0",
+    "pino-pretty": "^13.1.2",
+    "reflect-metadata": "^0.2.2",
+    "rxjs": "^7.8.1",
+    "zod": "^4.1.12"
+  },
+  "devDependencies": {
+    "@eslint/eslintrc": "^3.2.0",
+    "@eslint/js": "^9.18.0",
+    "@nestjs/cli": "^11.0.0",
+    "@nestjs/schematics": "^11.0.0",
+    "@nestjs/testing": "^11.0.1",
+    "@types/bcrypt": "^6.0.0",
+    "@types/cookie-parser": "^1.4.10",
+    "@types/express": "^5.0.0",
+    "@types/jest": "^30.0.0",
+    "@types/node": "^22.10.7",
+    "@types/supertest": "^6.0.2",
+    "eslint": "^9.18.0",
+    "eslint-config-prettier": "^10.0.1",
+    "eslint-plugin-prettier": "^5.2.2",
+    "globals": "^16.0.0",
+    "jest": "^30.0.0",
+    "prettier": "^3.4.2",
+    "prisma": "^6.19.0",
+    "source-map-support": "^0.5.21",
+    "supertest": "^7.0.0",
+    "ts-jest": "^29.2.5",
+    "ts-loader": "^9.5.2",
+    "ts-node": "^10.9.2",
+    "tsconfig-paths": "^4.2.0",
+    "typescript": "^5.7.3",
+    "typescript-eslint": "^8.20.0"
+  },
+  "jest": {
+    "moduleFileExtensions": [
+      "js",
+      "json",
+      "ts"
+    ],
+    "rootDir": "src",
+    "testRegex": ".*\\.spec\\.ts$",
+    "transform": {
+      "^.+\\.(t|j)s$": "ts-jest"
+    },
+    "collectCoverageFrom": [
+      "**/*.(t|j)s"
+    ],
+    "coverageDirectory": "../coverage",
+    "testEnvironment": "node"
+  }
+}

package/templates/orm/prisma/prisma/schema.prisma

@@ -0,0 +1,60 @@
+// This is your Prisma schema file,
+// learn more about it in the docs: https://pris.ly/d/prisma-schema
+
+// Looking for ways to speed up your queries, or scale easily with your serverless or edge functions?
+// Try Prisma Accelerate: https://pris.ly/cli/accelerate-init
+
+generator client {
+  provider = "prisma-client-js"
+}
+
+datasource db {
+  provider = "postgresql"
+  url      = env("DATABASE_URL")
+}
+
+// Enums
+enum UserRole {
+  USER
+  ADMIN
+}
+
+// Tables
+model User {
+  id        String   @id @default(uuid())
+  fullName  String  @db.VarChar(100)
+  email     String  @unique @db.VarChar(100)
+  passwordHash String  @db.Text
+  role      UserRole @default(USER)
+
+  refreshToken String? @db.Text  // Legacy field - kept for backward compatibility
+  isActive  Boolean  @default(true) // for soft delete
+
+  // Relations
+  refreshTokens RefreshToken[]
+
+  // add fields as required
+
+  createdAt DateTime @default(now())
+  updatedAt DateTime @updatedAt
+
+  @@map("users")
+}
+
+model RefreshToken {
+  id        String   @id @default(uuid())
+  token     String   @db.Text
+  userId    String
+  user      User     @relation(fields: [userId], references: [id], onDelete: Cascade)
+  
+  deviceInfo String? @db.VarChar(255) // Browser/device identifier
+  ipAddress  String? @db.VarChar(45)  // IPv4 or IPv6
+  
+  expiresAt DateTime
+  createdAt DateTime @default(now())
+  updatedAt DateTime @updatedAt
+
+  @@index([userId])
+  @@index([token])
+  @@map("refresh_tokens")
+}

package/templates/orm/prisma/prisma/seed.ts

@@ -0,0 +1,69 @@
+import { PrismaClient, UserRole } from '@prisma/client';
+import * as bcrypt from 'bcrypt';
+import * as dotenv from 'dotenv';
+
+// Load environment variables
+dotenv.config();
+
+const prisma = new PrismaClient();
+
+async function main() {
+  console.log('🌱 Seeding database...');
+
+  // Use 12 rounds for bcrypt as per security standards
+  const adminPassword = await bcrypt.hash('Admin@123', 12);
+  const userPassword = await bcrypt.hash('User@123', 12);
+
+  // Create admin user
+  const admin = await prisma.user.upsert({
+    where: { email: 'admin@example.com' },
+    update: {},
+    create: {
+      email: 'admin@example.com',
+      passwordHash: adminPassword,
+      fullName: 'Admin User',
+      role: UserRole.ADMIN,
+      isActive: true,
+    },
+  });
+
+  // Create regular user
+  const user = await prisma.user.upsert({
+    where: { email: 'user@example.com' },
+    update: {},
+    create: {
+      email: 'user@example.com',
+      passwordHash: userPassword,
+      fullName: 'Regular User',
+      role: UserRole.USER,
+      isActive: true,
+    },
+  });
+
+  console.log('✅ Seeding completed');
+  console.log('\n📋 Test Credentials:');
+  console.log('===================');
+  console.log('Admin User:');
+  console.log('  Email:', admin.email);
+  console.log('  Password: Admin@123');
+  console.log('  Role:', admin.role);
+  console.log('\nRegular User:');
+  console.log('  Email:', user.email);
+  console.log('  Password: User@123');
+  console.log('  Role:', user.role);
+  console.log('\n⚠️  Note: Passwords meet strong validation requirements:');
+  console.log('   - Minimum 8 characters');
+  console.log('   - At least one uppercase letter');
+  console.log('   - At least one lowercase letter');
+  console.log('   - At least one number');
+  console.log('   - At least one special character');
+}
+
+main()
+  .catch((e) => {
+    console.error('❌ Seeding failed:', e);
+    process.exit(1);
+  })
+  .finally(async () => {
+    await prisma.$disconnect();
+  });

package/templates/orm/prisma/src/app.module.ts

@@ -0,0 +1,55 @@
+import { Module, NestModule, MiddlewareConsumer } from '@nestjs/common';
+import { AuthModule } from './modules/auth/auth.module';
+import { LoggerModule } from 'nestjs-pino';
+import { PrismaModule } from './prisma/prisma.module';
+import { UsersModule } from './modules/users/users.module';
+import { HealthModule } from './modules/health/health.module';
+import { AppConfigModule } from './config/config.module';
+import { loggerConfig } from './config/logger.config';
+import { CorrelationIdMiddleware } from './common/middleware/correlation-id.middleware';
+import { RolesGuard } from './common/guards/roles.guard';
+import { AuthGuard } from './common/guards/auth.guard';
+import { ThrottlerModule, ThrottlerGuard } from '@nestjs/throttler';
+
+@Module({
+  imports: [
+    LoggerModule.forRoot(loggerConfig),
+    ThrottlerModule.forRoot([
+      {
+        name: 'default',
+        ttl: 60000, // 1 minute
+        limit: 10, // 10 requests per minute
+      },
+      {
+        name: 'strict',
+        ttl: 60000, // 1 minute
+        limit: 5, // 5 requests per minute for auth endpoints
+      },
+    ]),
+    AppConfigModule,
+    AuthModule,
+    UsersModule,
+    HealthModule,
+    PrismaModule,
+  ],
+  controllers: [],
+  providers: [
+    {
+      provide: 'APP_GUARD',
+      useClass: ThrottlerGuard,
+    },
+    {
+      provide: 'APP_GUARD',
+      useClass: AuthGuard,
+    },
+    {
+      provide: 'APP_GUARD',
+      useClass: RolesGuard,
+    },
+  ],
+})
+export class AppModule implements NestModule {
+  configure(consumer: MiddlewareConsumer) {
+    consumer.apply(CorrelationIdMiddleware).forRoutes('*');
+  }
+}

package/templates/orm/prisma/src/config/env.validation.ts

@@ -0,0 +1,56 @@
+import { z } from 'zod';
+
+export const envSchema = z.object({
+  NODE_ENV: z
+    .enum(['development', 'production', 'test'])
+    .default('development'),
+  PORT: z.coerce.number().default(8080),
+
+  // Database
+  DATABASE_URL: z.string().min(1, 'Invalid DATABASE_URL'),
+
+  // JWT Secrets
+  JWT_ACCESS_SECRET: z
+    .string()
+    .min(32, 'JWT_ACCESS_SECRET must be at least 32 characters'),
+  JWT_REFRESH_SECRET: z
+    .string()
+    .min(32, 'JWT_REFRESH_SECRET must be at least 32 characters'),
+  JWT_ACCESS_EXPIRY: z
+    .string()
+    .regex(/^\d+[smhd]$/, 'JWT_ACCESS_EXPIRY must be in format: 60m, 1h, etc.')
+    .default('60m'),
+  JWT_REFRESH_EXPIRY: z
+    .string()
+    .regex(/^\d+[smhd]$/, 'JWT_REFRESH_EXPIRY must be in format: 7d, 30d, etc.')
+    .default('30d'),
+
+  // CORS
+  CORS_ORIGIN: z
+    .string()
+    .refine((val) => {
+      // Allow comma-separated origins
+      const origins = val.split(',').map((o) => o.trim());
+      const urlRegex = /^https?:\/\/.+/;
+      return origins.every((origin) => urlRegex.test(origin) || origin === '*');
+    }, 'CORS_ORIGIN must be valid URL(s) or "*". Multiple origins: "http://localhost:3000,https://example.com"')
+    .default('http://localhost:3000'),
+
+  // Logging
+  LOG_LEVEL: z
+    .enum(['fatal', 'error', 'warn', 'info', 'debug', 'trace'])
+    .default('info'),
+});
+
+export type Env = z.infer<typeof envSchema>;
+
+export function validate(config: Record<string, unknown>) {
+  const result = envSchema.safeParse(config);
+  if (!result.success) {
+    const errors = result.error.issues
+      .map((e) => `${e.path.join('.')}: ${e.message}`)
+      .join('\n');
+    throw new Error(`Environment validation failed:\n${errors}`);
+  }
+  return result.data;
+}

package/templates/orm/prisma/src/modules/auth/auth.module.ts

@@ -0,0 +1,17 @@
+import { Module } from '@nestjs/common';
+import { AuthService } from './auth.service';
+import { AuthController } from './auth.controller';
+import { PrismaModule } from 'src/prisma/prisma.module';
+import { JwtModule } from '@nestjs/jwt';
+
+@Module({
+  imports: [
+    PrismaModule,
+    JwtModule.register({
+      global: true,
+    }),
+  ],
+  controllers: [AuthController],
+  providers: [AuthService],
+})
+export class AuthModule {}