speedrun-cli 2.6.1

package/templates/orm/prisma/src/modules/auth/auth.service.ts

@@ -0,0 +1,308 @@
+import {
+  Injectable,
+  ConflictException,
+  ForbiddenException,
+  UnauthorizedException,
+  NotFoundException,
+} from '@nestjs/common';
+
+import { PrismaService } from 'src/prisma/prisma.service';
+import * as bcrypt from 'bcrypt';
+import { JwtService } from '@nestjs/jwt';
+import { ConfigService } from '@nestjs/config';
+import { User } from '@prisma/client';
+import { Logger } from 'nestjs-pino';
+import { SignupDto } from './dtos/signup.dto';
+import { LoginDto } from './dtos/login.dto';
+
+@Injectable()
+export class AuthService {
+  constructor(
+    private prisma: PrismaService,
+    private jwtService: JwtService,
+    private config: ConfigService,
+    private logger: Logger,
+  ) {}
+
+  async signup(signupDto: SignupDto) {
+    const { email, password, fullName } = signupDto;
+
+    const existingUser = await this.prisma.user.findUnique({
+      where: { email },
+    });
+
+    if (existingUser) {
+      throw new ConflictException('Email already in use');
+    }
+
+    const hashedPassword = await this.hashData(password);
+
+    const newUser = await this.prisma.user.create({
+      data: {
+        email,
+        passwordHash: hashedPassword,
+        fullName,
+      },
+    });
+
+    // Log without PII (email address)
+    this.logger.log({
+      message: 'New user registered',
+      userId: newUser.id,
+      role: newUser.role,
+    });
+
+    return {
+      user: {
+        id: newUser.id,
+        email: newUser.email,
+        fullName: newUser.fullName,
+        role: newUser.role,
+      },
+      message: 'User registered successfully',
+    };
+  }
+
+  async login(loginDto: LoginDto, deviceInfo?: string, ipAddress?: string) {
+    const { email, password } = loginDto;
+
+    const user = await this.prisma.user.findUnique({
+      where: { email },
+    });
+
+    // Prevent timing attacks by always hashing, even if user doesn't exist
+    const passwordHash =
+      user?.passwordHash ||
+      (await this.hashData('dummy-password-to-prevent-timing-attack'));
+    const passwordMatches = await bcrypt.compare(password, passwordHash);
+
+    // Use consistent error message to prevent account enumeration
+    if (!user || !user.isActive || !passwordMatches) {
+      throw new UnauthorizedException('Invalid email or password');
+    }
+
+    const tokens = await this.generateTokens(user);
+    const hashedRt = await this.hashData(tokens.refreshToken);
+
+    // Store refresh token with device info for multi-device support
+    const refreshExpiry =
+      this.config.get<string>('JWT_REFRESH_EXPIRY') || '30d';
+    const expiryMs = this.parseExpiryToMilliseconds(refreshExpiry);
+    const expiresAt = new Date(Date.now() + expiryMs);
+
+    await this.prisma.refreshToken.create({
+      data: {
+        token: hashedRt,
+        userId: user.id,
+        deviceInfo: deviceInfo || 'Unknown Device',
+        ipAddress: ipAddress || 'Unknown IP',
+        expiresAt,
+      },
+    });
+
+    // Clean up expired tokens for this user
+    await this.cleanupExpiredTokens(user.id);
+
+    this.logger.log({
+      message: 'User logged in',
+      userId: user.id,
+      role: user.role,
+      timestamp: new Date().toISOString(),
+    });
+
+    return {
+      user: {
+        id: user.id,
+        email: user.email,
+        fullName: user.fullName,
+        role: user.role,
+      },
+      ...tokens,
+    };
+  }
+
+  async refreshToken(
+    userId: string,
+    rt: string,
+    deviceInfo?: string,
+    ipAddress?: string,
+  ) {
+    const user = await this.prisma.user.findUnique({
+      where: { id: userId },
+    });
+
+    if (!user || !user.isActive) {
+      throw new ForbiddenException('Invalid refresh token');
+    }
+
+    // Find matching refresh token in database
+    const storedTokens = await this.prisma.refreshToken.findMany({
+      where: {
+        userId: user.id,
+        expiresAt: { gte: new Date() },
+      },
+    });
+
+    let isValidToken = false;
+    let validTokenId: string | null = null;
+
+    // Check if provided token matches any stored token
+    for (const storedToken of storedTokens) {
+      const matches = await bcrypt.compare(rt, storedToken.token);
+      if (matches) {
+        isValidToken = true;
+        validTokenId = storedToken.id;
+        break;
+      }
+    }
+
+    if (!isValidToken || !validTokenId) {
+      throw new UnauthorizedException('Invalid refresh token');
+    }
+
+    // Generate new tokens
+    const tokens = await this.generateTokens(user);
+    const hashedRt = await this.hashData(tokens.refreshToken);
+
+    // Update the refresh token (rotation)
+    const refreshExpiry =
+      this.config.get<string>('JWT_REFRESH_EXPIRY') || '30d';
+    const expiryMs = this.parseExpiryToMilliseconds(refreshExpiry);
+    const expiresAt = new Date(Date.now() + expiryMs);
+
+    await this.prisma.refreshToken.update({
+      where: { id: validTokenId },
+      data: {
+        token: hashedRt,
+        deviceInfo: deviceInfo || 'Unknown Device',
+        ipAddress: ipAddress || 'Unknown IP',
+        expiresAt,
+        updatedAt: new Date(),
+      },
+    });
+
+    return tokens;
+  }
+
+  async logout(userId: string, rt?: string) {
+    if (rt) {
+      // Find and delete the specific refresh token
+      const storedTokens = await this.prisma.refreshToken.findMany({
+        where: { userId },
+      });
+
+      for (const storedToken of storedTokens) {
+        const matches = await bcrypt.compare(rt, storedToken.token);
+        if (matches) {
+          await this.prisma.refreshToken.delete({
+            where: { id: storedToken.id },
+          });
+          break;
+        }
+      }
+    } else {
+      // Logout from all devices
+      await this.prisma.refreshToken.deleteMany({
+        where: { userId },
+      });
+    }
+
+    return {
+      message: 'Logged out successfully',
+    };
+  }
+
+  async getMe(userId: string) {
+    const user = await this.prisma.user.findUnique({
+      where: { id: userId },
+    });
+
+    if (!user) {
+      throw new NotFoundException('User not found');
+    }
+
+    const safeUser = {
+      id: user.id,
+      email: user.email,
+      fullName: user.fullName,
+      role: user.role,
+    };
+
+    return safeUser;
+  }
+
+  // Helper Methods
+
+  async hashData(data: string): Promise<string> {
+    const salt = await bcrypt.genSalt(12); // Use 12 rounds for 2025 security standards
+    return bcrypt.hash(data, salt);
+  }
+
+  async generateTokens(
+    user: User,
+  ): Promise<{ accessToken: string; refreshToken: string }> {
+    const payload = { sub: user.id, role: user.role, email: user.email };
+    const accessExpiry = this.config.get<string>('JWT_ACCESS_EXPIRY') || '15m';
+    const refreshExpiry = this.config.get<string>('JWT_REFRESH_EXPIRY') || '7d';
+
+    const [accessToken, refreshToken] = await Promise.all([
+      // @ts-expect-error - JWT library type definition issue with expiresIn accepting string
+      this.jwtService.signAsync(payload, {
+        secret: this.config.get<string>('JWT_ACCESS_SECRET'),
+        expiresIn: accessExpiry,
+      }),
+      // @ts-expect-error - JWT library type definition issue with expiresIn accepting string
+      this.jwtService.signAsync(payload, {
+        secret: this.config.get<string>('JWT_REFRESH_SECRET'),
+        expiresIn: refreshExpiry,
+      }),
+    ]);
+    return {
+      accessToken,
+      refreshToken,
+    };
+  }
+
+  private async cleanupExpiredTokens(userId: string) {
+    // Remove expired refresh tokens for this user
+    await this.prisma.refreshToken.deleteMany({
+      where: {
+        userId,
+        expiresAt: { lt: new Date() },
+      },
+    });
+
+    // Optional: Limit to 5 most recent tokens per user
+    const tokens = await this.prisma.refreshToken.findMany({
+      where: { userId },
+      orderBy: { createdAt: 'desc' },
+      skip: 5,
+      take: 100,
+    });
+
+    if (tokens.length > 0) {
+      await this.prisma.refreshToken.deleteMany({
+        where: {
+          id: { in: tokens.map((t) => t.id) },
+        },
+      });
+    }
+  }
+
+  private parseExpiryToMilliseconds(expiry: string): number {
+    const match = expiry.match(/^(\d+)([smhd])$/);
+    if (!match) return 30 * 24 * 60 * 60 * 1000; // default 30 days
+
+    const value = parseInt(match[1], 10);
+    const unit = match[2];
+
+    const units: { [key: string]: number } = {
+      s: 1000,
+      m: 60 * 1000,
+      h: 60 * 60 * 1000,
+      d: 24 * 60 * 60 * 1000,
+    };
+
+    return value * units[unit];
+  }
+}

package/templates/orm/prisma/src/modules/health/health.controller.ts

@@ -0,0 +1,26 @@
+import { Controller, Get } from '@nestjs/common';
+import {
+  HealthCheckService,
+  HealthCheck,
+  PrismaHealthIndicator,
+} from '@nestjs/terminus';
+import { PrismaService } from 'src/prisma/prisma.service';
+import { Public } from 'src/common/decorators/public.decorator';
+
+@Controller('health')
+export class HealthController {
+  constructor(
+    private health: HealthCheckService,
+    private prismaHealth: PrismaHealthIndicator,
+    private prisma: PrismaService,
+  ) {}
+
+  @Get()
+  @Public()
+  @HealthCheck()
+  check() {
+    return this.health.check([
+      () => this.prismaHealth.pingCheck('database', this.prisma),
+    ]);
+  }
+}

package/templates/orm/prisma/src/modules/health/health.module.ts

@@ -0,0 +1,10 @@
+import { Module } from '@nestjs/common';
+import { TerminusModule } from '@nestjs/terminus';
+import { HealthController } from './health.controller';
+import { PrismaModule } from 'src/prisma/prisma.module';
+
+@Module({
+  imports: [TerminusModule, PrismaModule],
+  controllers: [HealthController],
+})
+export class HealthModule {}

package/templates/orm/prisma/src/modules/users/users.module.ts

@@ -0,0 +1,11 @@
+import { Module } from '@nestjs/common';
+import { UsersService } from './users.service';
+import { UsersController } from './users.controller';
+import { PrismaModule } from 'src/prisma/prisma.module';
+
+@Module({
+  imports: [PrismaModule],
+  controllers: [UsersController],
+  providers: [UsersService],
+})
+export class UsersModule {}

package/templates/orm/prisma/src/modules/users/users.service.ts

@@ -0,0 +1,105 @@
+import { Injectable } from '@nestjs/common';
+import { PrismaService } from 'src/prisma/prisma.service';
+import { UpdateProfileDto } from './dtos/update-profile.dto';
+import { User } from '@prisma/client';
+import { UpdateUserDto } from './dtos/update-user.dto';
+
+@Injectable()
+export class UsersService {
+  constructor(private readonly prisma: PrismaService) {}
+
+  async getProfile(userId: string) {
+    const user = await this.prisma.user.findFirst({
+      where: { id: userId },
+    });
+
+    return this.sanitizeUser(user);
+  }
+
+  async updateProfile(userId: string, updateProfileDto: UpdateProfileDto) {
+    const updatedUser = await this.prisma.user.update({
+      where: { id: userId },
+      data: { ...updateProfileDto },
+    });
+    return this.sanitizeUser(updatedUser);
+  }
+
+  // admin methods
+  async getAllUsers(page: number = 1, limit: number = 10) {
+    const skip = (page - 1) * limit;
+
+    const [users, total] = await Promise.all([
+      this.prisma.user.findMany({
+        where: { isActive: true },
+        skip,
+        take: limit,
+        orderBy: { createdAt: 'desc' },
+      }),
+      this.prisma.user.count({ where: { isActive: true } }),
+    ]);
+
+    const sanitizedUsers = users.map((user) => this.sanitizeUser(user));
+    const totalPages = Math.ceil(total / limit);
+
+    return {
+      data: sanitizedUsers,
+      meta: {
+        total,
+        page,
+        limit,
+        totalPages,
+        hasNext: page < totalPages,
+        hasPrevious: page > 1,
+      },
+    };
+  }
+
+  async getUserById(userId: string) {
+    if (!userId) {
+      return null;
+    }
+    const user = await this.prisma.user.findUnique({
+      where: { id: userId },
+    });
+    if (!user) {
+      return null;
+    }
+    return this.sanitizeUser(user);
+  }
+
+  async updateUserById(userId: string, updateUserDto: UpdateUserDto) {
+    const updatedUser = await this.prisma.user.update({
+      where: { id: userId },
+      data: { ...updateUserDto },
+    });
+
+    return this.sanitizeUser(updatedUser);
+  }
+
+  async deleteUserById(userId: string) {
+    // Soft delete: set isActive to false instead of hard delete
+    await this.prisma.user.update({
+      where: { id: userId },
+      data: { isActive: false },
+    });
+
+    // Also invalidate all refresh tokens for this user
+    await this.prisma.refreshToken.deleteMany({
+      where: { userId },
+    });
+
+    return { message: 'User deleted successfully' };
+  }
+
+  // utils
+
+  sanitizeUser(user: User | null) {
+    if (!user) {
+      return null;
+    }
+
+    // eslint-disable-next-line @typescript-eslint/no-unused-vars
+    const { refreshToken, passwordHash, ...safeUser } = user;
+    return safeUser;
+  }
+}

package/templates/orm/prisma/src/prisma/prisma.module.ts

@@ -0,0 +1,9 @@
+import { Module } from '@nestjs/common';
+import { PrismaService } from './prisma.service';
+
+@Module({
+  exports: [PrismaService],
+  controllers: [],
+  providers: [PrismaService],
+})
+export class PrismaModule {}

package/templates/orm/prisma/src/prisma/prisma.service.ts

@@ -0,0 +1,16 @@
+import { Injectable, OnModuleDestroy, OnModuleInit } from '@nestjs/common';
+import { PrismaClient } from '@prisma/client';
+
+@Injectable()
+export class PrismaService
+  extends PrismaClient
+  implements OnModuleInit, OnModuleDestroy
+{
+  async onModuleInit() {
+    await this.$connect();
+  }
+
+  async onModuleDestroy() {
+    await this.$disconnect();
+  }
+}

package/templates/orm/typeorm/package.json

@@ -0,0 +1,100 @@
+{
+  "name": "nestjs-jwt-rbac-boilerplate",
+  "version": "0.0.1",
+  "description": "Production-ready NestJS authentication system with JWT, refresh tokens, and RBAC",
+  "author": "",
+  "private": true,
+  "license": "MIT",
+  "scripts": {
+    "build": "nest build",
+    "format": "prettier --write \"src/**/*.ts\" \"test/**/*.ts\"",
+    "start": "nest start",
+    "start:dev": "nest start --watch",
+    "start:debug": "nest start --debug --watch",
+    "start:prod": "node dist/main",
+    "lint": "eslint \"{src,apps,libs,test}/**/*.ts\" --fix",
+    "test": "jest",
+    "test:watch": "jest --watch",
+    "test:cov": "jest --coverage",
+    "test:debug": "node --inspect-brk -r tsconfig-paths/register -r ts-node/register node_modules/.bin/jest --runInBand",
+    "test:e2e": "jest --config ./test/jest-e2e.json",
+    "typeorm": "ts-node -r tsconfig-paths/register ./node_modules/typeorm/cli.js",
+    "migration:generate": "npm run typeorm -- migration:generate -d src/database/data-source.ts",
+    "migration:run": "npm run typeorm -- migration:run -d src/database/data-source.ts",
+    "migration:revert": "npm run typeorm -- migration:revert -d src/database/data-source.ts",
+    "schema:sync": "npm run typeorm -- schema:sync -d src/database/data-source.ts",
+    "seed": "ts-node src/database/seed.ts"
+  },
+  "dependencies": {
+    "@nestjs/common": "^11.0.1",
+    "@nestjs/config": "^4.0.2",
+    "@nestjs/core": "^11.0.1",
+    "@nestjs/jwt": "^11.0.1",
+    "@nestjs/mapped-types": "*",
+    "@nestjs/platform-express": "^11.0.1",
+    "@nestjs/schedule": "^6.0.1",
+    "@nestjs/terminus": "^11.0.0",
+    "@nestjs/throttler": "^6.4.0",
+    "@nestjs/typeorm": "^11.0.0",
+    "typeorm": "^0.3.20",
+    "pg": "^8.11.3",
+    "mysql2": "^3.9.1",
+    "better-sqlite3": "^9.4.3",
+    "bcrypt": "^6.0.0",
+    "class-transformer": "^0.5.1",
+    "class-validator": "^0.14.2",
+    "cookie-parser": "^1.4.7",
+    "dotenv": "^17.2.3",
+    "helmet": "^8.1.0",
+    "nestjs-pino": "^4.4.1",
+    "pino-http": "^10.5.0",
+    "pino-pretty": "^13.1.2",
+    "reflect-metadata": "^0.2.2",
+    "rxjs": "^7.8.1",
+    "zod": "^4.1.12"
+  },
+  "devDependencies": {
+    "@eslint/eslintrc": "^3.2.0",
+    "@eslint/js": "^9.18.0",
+    "@nestjs/cli": "^11.0.0",
+    "@nestjs/schematics": "^11.0.0",
+    "@nestjs/testing": "^11.0.1",
+    "@types/bcrypt": "^6.0.0",
+    "@types/cookie-parser": "^1.4.10",
+    "@types/express": "^5.0.0",
+    "@types/jest": "^30.0.0",
+    "@types/node": "^22.10.7",
+    "@types/supertest": "^6.0.2",
+    "eslint": "^9.18.0",
+    "eslint-config-prettier": "^10.0.1",
+    "eslint-plugin-prettier": "^5.2.2",
+    "globals": "^16.0.0",
+    "jest": "^30.0.0",
+    "prettier": "^3.4.2",
+    "source-map-support": "^0.5.21",
+    "supertest": "^7.0.0",
+    "ts-jest": "^29.2.5",
+    "ts-loader": "^9.5.2",
+    "ts-node": "^10.9.2",
+    "tsconfig-paths": "^4.2.0",
+    "typescript": "^5.7.3",
+    "typescript-eslint": "^8.20.0"
+  },
+  "jest": {
+    "moduleFileExtensions": [
+      "js",
+      "json",
+      "ts"
+    ],
+    "rootDir": "src",
+    "testRegex": ".*\\.spec\\.ts$",
+    "transform": {
+      "^.+\\.(t|j)s$": "ts-jest"
+    },
+    "collectCoverageFrom": [
+      "**/*.(t|j)s"
+    ],
+    "coverageDirectory": "../coverage",
+    "testEnvironment": "node"
+  }
+}

package/templates/orm/typeorm/src/app.module.ts

@@ -0,0 +1,55 @@
+import { Module, NestModule, MiddlewareConsumer } from '@nestjs/common';
+import { AuthModule } from './modules/auth/auth.module';
+import { LoggerModule } from 'nestjs-pino';
+import { DatabaseModule } from './database/database.module';
+import { UsersModule } from './modules/users/users.module';
+import { HealthModule } from './modules/health/health.module';
+import { AppConfigModule } from './config/config.module';
+import { loggerConfig } from './config/logger.config';
+import { CorrelationIdMiddleware } from './common/middleware/correlation-id.middleware';
+import { RolesGuard } from './common/guards/roles.guard';
+import { AuthGuard } from './common/guards/auth.guard';
+import { ThrottlerModule, ThrottlerGuard } from '@nestjs/throttler';
+
+@Module({
+  imports: [
+    LoggerModule.forRoot(loggerConfig),
+    ThrottlerModule.forRoot([
+      {
+        name: 'default',
+        ttl: 60000,
+        limit: 10,
+      },
+      {
+        name: 'strict',
+        ttl: 60000,
+        limit: 5,
+      },
+    ]),
+    AppConfigModule,
+    DatabaseModule,
+    AuthModule,
+    UsersModule,
+    HealthModule,
+  ],
+  controllers: [],
+  providers: [
+    {
+      provide: 'APP_GUARD',
+      useClass: ThrottlerGuard,
+    },
+    {
+      provide: 'APP_GUARD',
+      useClass: AuthGuard,
+    },
+    {
+      provide: 'APP_GUARD',
+      useClass: RolesGuard,
+    },
+  ],
+})
+export class AppModule implements NestModule {
+  configure(consumer: MiddlewareConsumer) {
+    consumer.apply(CorrelationIdMiddleware).forRoutes('*');
+  }
+}