speedrun-cli 2.6.1

package/templates/orm/typeorm/src/config/env.validation.ts

@@ -0,0 +1,58 @@
+import { z } from 'zod';
+
+export const envSchema = z.object({
+  NODE_ENV: z
+    .enum(['development', 'production', 'test'])
+    .default('development'),
+  PORT: z.coerce.number().default(8080),
+
+  // Database
+  DATABASE_URL: z.string().min(1, 'Invalid DATABASE_URL'),
+  DB_TYPE: z
+    .enum(['postgres', 'mysql', 'sqlite', 'mariadb'])
+    .default('postgres'),
+
+  // JWT Secrets
+  JWT_ACCESS_SECRET: z
+    .string()
+    .min(32, 'JWT_ACCESS_SECRET must be at least 32 characters'),
+  JWT_REFRESH_SECRET: z
+    .string()
+    .min(32, 'JWT_REFRESH_SECRET must be at least 32 characters'),
+  JWT_ACCESS_EXPIRY: z
+    .string()
+    .regex(/^\d+[smhd]$/, 'JWT_ACCESS_EXPIRY must be in format: 60m, 1h, etc.')
+    .default('60m'),
+  JWT_REFRESH_EXPIRY: z
+    .string()
+    .regex(/^\d+[smhd]$/, 'JWT_REFRESH_EXPIRY must be in format: 7d, 30d, etc.')
+    .default('30d'),
+
+  // CORS
+  CORS_ORIGIN: z
+    .string()
+    .refine((val) => {
+      const origins = val.split(',').map((o) => o.trim());
+      const urlRegex = /^https?:\/\/.+/;
+      return origins.every((origin) => urlRegex.test(origin) || origin === '*');
+    }, 'CORS_ORIGIN must be valid URL(s) or "*"')
+    .default('http://localhost:3000'),
+
+  // Logging
+  LOG_LEVEL: z
+    .enum(['fatal', 'error', 'warn', 'info', 'debug', 'trace'])
+    .default('info'),
+});
+
+export type Env = z.infer<typeof envSchema>;
+
+export function validate(config: Record<string, unknown>) {
+  const result = envSchema.safeParse(config);
+  if (!result.success) {
+    const errors = result.error.issues
+      .map((e) => `${e.path.join('.')}: ${e.message}`)
+      .join('\n');
+    throw new Error(`Environment validation failed:\n${errors}`);
+  }
+  return result.data;
+}

package/templates/orm/typeorm/src/database/data-source.ts

@@ -0,0 +1,19 @@
+import { DataSource } from 'typeorm';
+import { config } from 'dotenv';
+import { User } from '../entities/user.entity';
+import { RefreshToken } from '../entities/refresh-token.entity';
+
+config();
+
+export const AppDataSource = new DataSource({
+  type: (process.env.DB_TYPE as any) || 'postgres',
+  url: process.env.DATABASE_URL,
+  entities: [User, RefreshToken],
+  migrations: ['src/database/migrations/*.ts'],
+  synchronize: false,
+  logging: process.env.NODE_ENV === 'development',
+  ssl:
+    process.env.NODE_ENV === 'production'
+      ? { rejectUnauthorized: false }
+      : false,
+});

package/templates/orm/typeorm/src/database/database.module.ts

@@ -0,0 +1,27 @@
+import { Module } from '@nestjs/common';
+import { TypeOrmModule } from '@nestjs/typeorm';
+import { ConfigModule, ConfigService } from '@nestjs/config';
+import { User } from '../entities/user.entity';
+import { RefreshToken } from '../entities/refresh-token.entity';
+
+@Module({
+  imports: [
+    TypeOrmModule.forRootAsync({
+      imports: [ConfigModule],
+      useFactory: (configService: ConfigService) => ({
+        type: configService.get<string>('DB_TYPE') as any || 'postgres',
+        url: configService.get<string>('DATABASE_URL'),
+        entities: [User, RefreshToken],
+        synchronize: configService.get<string>('NODE_ENV') !== 'production',
+        logging: configService.get<string>('NODE_ENV') === 'development',
+        ssl: configService.get<string>('NODE_ENV') === 'production' 
+          ? { rejectUnauthorized: false } 
+          : false,
+      }),
+      inject: [ConfigService],
+    }),
+    TypeOrmModule.forFeature([User, RefreshToken]),
+  ],
+  exports: [TypeOrmModule],
+})
+export class DatabaseModule {}

package/templates/orm/typeorm/src/database/seed.ts

@@ -0,0 +1,76 @@
+import { DataSource } from 'typeorm';
+import { User, UserRole } from '../entities/user.entity';
+import { RefreshToken } from '../entities/refresh-token.entity';
+import * as bcrypt from 'bcrypt';
+import * as dotenv from 'dotenv';
+
+dotenv.config();
+
+const dataSource = new DataSource({
+  type: (process.env.DB_TYPE as any) || 'postgres',
+  url: process.env.DATABASE_URL,
+  entities: [User, RefreshToken],
+  synchronize: false,
+});
+
+async function seed() {
+  console.log('🌱 Seeding database...');
+
+  await dataSource.initialize();
+
+  const userRepository = dataSource.getRepository(User);
+
+  const adminPassword = await bcrypt.hash('Admin@123', 12);
+  const userPassword = await bcrypt.hash('User@123', 12);
+
+  // Create admin user
+  let admin = await userRepository.findOne({
+    where: { email: 'admin@example.com' },
+  });
+
+  if (!admin) {
+    admin = userRepository.create({
+      email: 'admin@example.com',
+      passwordHash: adminPassword,
+      fullName: 'Admin User',
+      role: UserRole.ADMIN,
+      isActive: true,
+    });
+    await userRepository.save(admin);
+  }
+
+  // Create regular user
+  let user = await userRepository.findOne({
+    where: { email: 'user@example.com' },
+  });
+
+  if (!user) {
+    user = userRepository.create({
+      email: 'user@example.com',
+      passwordHash: userPassword,
+      fullName: 'Regular User',
+      role: UserRole.USER,
+      isActive: true,
+    });
+    await userRepository.save(user);
+  }
+
+  console.log('✅ Seeding completed');
+  console.log('\n📋 Test Credentials:');
+  console.log('===================');
+  console.log('Admin User:');
+  console.log('  Email:', admin.email);
+  console.log('  Password: Admin@123');
+  console.log('  Role:', admin.role);
+  console.log('\nRegular User:');
+  console.log('  Email:', user.email);
+  console.log('  Password: User@123');
+  console.log('  Role:', user.role);
+
+  await dataSource.destroy();
+}
+
+seed().catch((e) => {
+  console.error('❌ Seeding failed:', e);
+  process.exit(1);
+});

package/templates/orm/typeorm/src/entities/index.ts

@@ -0,0 +1,2 @@
+export * from './user.entity';
+export * from './refresh-token.entity';

package/templates/orm/typeorm/src/entities/refresh-token.entity.ts

@@ -0,0 +1,45 @@
+import {
+  Entity,
+  PrimaryGeneratedColumn,
+  Column,
+  CreateDateColumn,
+  UpdateDateColumn,
+  ManyToOne,
+  JoinColumn,
+  Index,
+} from 'typeorm';
+import { User } from './user.entity';
+
+@Entity('refresh_tokens')
+export class RefreshToken {
+  @PrimaryGeneratedColumn('uuid')
+  id: string;
+
+  // Note: No index on token column - TEXT columns can't be indexed in MySQL
+  // without specifying key length, which TypeORM doesn't support
+  @Column({ type: 'text' })
+  token: string;
+
+  @Index()
+  @Column({ name: 'user_id' })
+  userId: string;
+
+  @ManyToOne(() => User, (user) => user.refreshTokens, { onDelete: 'CASCADE' })
+  @JoinColumn({ name: 'user_id' })
+  user: User;
+
+  @Column({ name: 'device_info', type: 'varchar', length: 255, nullable: true })
+  deviceInfo: string | null;
+
+  @Column({ name: 'ip_address', type: 'varchar', length: 45, nullable: true })
+  ipAddress: string | null;
+
+  @Column({ name: 'expires_at', type: 'timestamp' })
+  expiresAt: Date;
+
+  @CreateDateColumn({ name: 'created_at' })
+  createdAt: Date;
+
+  @UpdateDateColumn({ name: 'updated_at' })
+  updatedAt: Date;
+}

package/templates/orm/typeorm/src/entities/user.entity.ts

@@ -0,0 +1,51 @@
+import {
+  Entity,
+  PrimaryGeneratedColumn,
+  Column,
+  CreateDateColumn,
+  UpdateDateColumn,
+  OneToMany,
+} from 'typeorm';
+import { RefreshToken } from './refresh-token.entity';
+
+export enum UserRole {
+  USER = 'USER',
+  ADMIN = 'ADMIN',
+}
+
+@Entity('users')
+export class User {
+  @PrimaryGeneratedColumn('uuid')
+  id: string;
+
+  @Column({ name: 'full_name', length: 100 })
+  fullName: string;
+
+  @Column({ unique: true, length: 100 })
+  email: string;
+
+  @Column({ name: 'password_hash', type: 'text' })
+  passwordHash: string;
+
+  @Column({
+    type: 'enum',
+    enum: UserRole,
+    default: UserRole.USER,
+  })
+  role: UserRole;
+
+  @Column({ name: 'refresh_token', type: 'text', nullable: true })
+  refreshToken: string | null;
+
+  @Column({ name: 'is_active', default: true })
+  isActive: boolean;
+
+  @OneToMany(() => RefreshToken, (refreshToken) => refreshToken.user)
+  refreshTokens: RefreshToken[];
+
+  @CreateDateColumn({ name: 'created_at' })
+  createdAt: Date;
+
+  @UpdateDateColumn({ name: 'updated_at' })
+  updatedAt: Date;
+}

package/templates/orm/typeorm/src/modules/auth/auth.module.ts

@@ -0,0 +1,19 @@
+import { Module } from '@nestjs/common';
+import { TypeOrmModule } from '@nestjs/typeorm';
+import { JwtModule } from '@nestjs/jwt';
+import { AuthService } from './auth.service';
+import { AuthController } from './auth.controller';
+import { User } from 'src/entities/user.entity';
+import { RefreshToken } from 'src/entities/refresh-token.entity';
+
+@Module({
+  imports: [
+    TypeOrmModule.forFeature([User, RefreshToken]),
+    JwtModule.register({
+      global: true,
+    }),
+  ],
+  controllers: [AuthController],
+  providers: [AuthService],
+})
+export class AuthModule {}

package/templates/orm/typeorm/src/modules/auth/auth.service.ts

@@ -0,0 +1,286 @@
+import {
+  Injectable,
+  ConflictException,
+  ForbiddenException,
+  UnauthorizedException,
+  NotFoundException,
+} from '@nestjs/common';
+import { InjectRepository } from '@nestjs/typeorm';
+import { Repository, MoreThanOrEqual, In } from 'typeorm';
+import * as bcrypt from 'bcrypt';
+import { JwtService } from '@nestjs/jwt';
+import { ConfigService } from '@nestjs/config';
+import { Logger } from 'nestjs-pino';
+import { SignupDto } from './dtos/signup.dto';
+import { LoginDto } from './dtos/login.dto';
+import { User } from 'src/entities/user.entity';
+import { RefreshToken } from 'src/entities/refresh-token.entity';
+
+@Injectable()
+export class AuthService {
+  constructor(
+    @InjectRepository(User)
+    private userRepository: Repository<User>,
+    @InjectRepository(RefreshToken)
+    private refreshTokenRepository: Repository<RefreshToken>,
+    private jwtService: JwtService,
+    private config: ConfigService,
+    private logger: Logger,
+  ) {}
+
+  async signup(signupDto: SignupDto) {
+    const { email, password, fullName } = signupDto;
+
+    const existingUser = await this.userRepository.findOne({
+      where: { email },
+    });
+
+    if (existingUser) {
+      throw new ConflictException('Email already in use');
+    }
+
+    const hashedPassword = await this.hashData(password);
+
+    const newUser = this.userRepository.create({
+      email,
+      passwordHash: hashedPassword,
+      fullName,
+    });
+
+    await this.userRepository.save(newUser);
+
+    this.logger.log({
+      message: 'New user registered',
+      userId: newUser.id,
+      role: newUser.role,
+    });
+
+    return {
+      user: {
+        id: newUser.id,
+        email: newUser.email,
+        fullName: newUser.fullName,
+        role: newUser.role,
+      },
+      message: 'User registered successfully',
+    };
+  }
+
+  async login(loginDto: LoginDto, deviceInfo?: string, ipAddress?: string) {
+    const { email, password } = loginDto;
+
+    const user = await this.userRepository.findOne({
+      where: { email },
+    });
+
+    const passwordHash =
+      user?.passwordHash ||
+      (await this.hashData('dummy-password-to-prevent-timing-attack'));
+    const passwordMatches = await bcrypt.compare(password, passwordHash);
+
+    if (!user || !user.isActive || !passwordMatches) {
+      throw new UnauthorizedException('Invalid email or password');
+    }
+
+    const tokens = await this.generateTokens(user);
+    const hashedRt = await this.hashData(tokens.refreshToken);
+
+    const refreshExpiry =
+      this.config.get<string>('JWT_REFRESH_EXPIRY') || '30d';
+    const expiryMs = this.parseExpiryToMilliseconds(refreshExpiry);
+    const expiresAt = new Date(Date.now() + expiryMs);
+
+    const refreshToken = this.refreshTokenRepository.create({
+      token: hashedRt,
+      userId: user.id,
+      deviceInfo: deviceInfo || 'Unknown Device',
+      ipAddress: ipAddress || 'Unknown IP',
+      expiresAt,
+    });
+
+    await this.refreshTokenRepository.save(refreshToken);
+    await this.cleanupExpiredTokens(user.id);
+
+    this.logger.log({
+      message: 'User logged in',
+      userId: user.id,
+      role: user.role,
+      timestamp: new Date().toISOString(),
+    });
+
+    return {
+      user: {
+        id: user.id,
+        email: user.email,
+        fullName: user.fullName,
+        role: user.role,
+      },
+      ...tokens,
+    };
+  }
+
+  async refreshToken(
+    userId: string,
+    rt: string,
+    deviceInfo?: string,
+    ipAddress?: string,
+  ) {
+    const user = await this.userRepository.findOne({
+      where: { id: userId },
+    });
+
+    if (!user || !user.isActive) {
+      throw new ForbiddenException('Invalid refresh token');
+    }
+
+    const storedTokens = await this.refreshTokenRepository.find({
+      where: {
+        userId: user.id,
+        expiresAt: MoreThanOrEqual(new Date()),
+      },
+    });
+
+    let isValidToken = false;
+    let validTokenId: string | null = null;
+
+    for (const storedToken of storedTokens) {
+      const matches = await bcrypt.compare(rt, storedToken.token);
+      if (matches) {
+        isValidToken = true;
+        validTokenId = storedToken.id;
+        break;
+      }
+    }
+
+    if (!isValidToken || !validTokenId) {
+      throw new UnauthorizedException('Invalid refresh token');
+    }
+
+    const tokens = await this.generateTokens(user);
+    const hashedRt = await this.hashData(tokens.refreshToken);
+
+    const refreshExpiry =
+      this.config.get<string>('JWT_REFRESH_EXPIRY') || '30d';
+    const expiryMs = this.parseExpiryToMilliseconds(refreshExpiry);
+    const expiresAt = new Date(Date.now() + expiryMs);
+
+    await this.refreshTokenRepository.update(validTokenId, {
+      token: hashedRt,
+      deviceInfo: deviceInfo || 'Unknown Device',
+      ipAddress: ipAddress || 'Unknown IP',
+      expiresAt,
+    });
+
+    return tokens;
+  }
+
+  async logout(userId: string, rt?: string) {
+    if (rt) {
+      const storedTokens = await this.refreshTokenRepository.find({
+        where: { userId },
+      });
+
+      for (const storedToken of storedTokens) {
+        const matches = await bcrypt.compare(rt, storedToken.token);
+        if (matches) {
+          await this.refreshTokenRepository.delete(storedToken.id);
+          break;
+        }
+      }
+    } else {
+      await this.refreshTokenRepository.delete({ userId });
+    }
+
+    return {
+      message: 'Logged out successfully',
+    };
+  }
+
+  async getMe(userId: string) {
+    const user = await this.userRepository.findOne({
+      where: { id: userId },
+    });
+
+    if (!user) {
+      throw new NotFoundException('User not found');
+    }
+
+    return {
+      id: user.id,
+      email: user.email,
+      fullName: user.fullName,
+      role: user.role,
+    };
+  }
+
+  // Helper Methods
+
+  async hashData(data: string): Promise<string> {
+    const salt = await bcrypt.genSalt(12);
+    return bcrypt.hash(data, salt);
+  }
+
+  async generateTokens(
+    user: User,
+  ): Promise<{ accessToken: string; refreshToken: string }> {
+    const payload = { sub: user.id, role: user.role, email: user.email };
+    const accessExpiry = this.config.get<string>('JWT_ACCESS_EXPIRY') || '15m';
+    const refreshExpiry = this.config.get<string>('JWT_REFRESH_EXPIRY') || '7d';
+
+    const [accessToken, refreshToken] = await Promise.all([
+      // @ts-expect-error - JWT library type definition issue with expiresIn accepting string
+      this.jwtService.signAsync(payload, {
+        secret: this.config.get<string>('JWT_ACCESS_SECRET'),
+        expiresIn: accessExpiry,
+      }),
+      // @ts-expect-error - JWT library type definition issue with expiresIn accepting string
+      this.jwtService.signAsync(payload, {
+        secret: this.config.get<string>('JWT_REFRESH_SECRET'),
+        expiresIn: refreshExpiry,
+      }),
+    ]);
+
+    return { accessToken, refreshToken };
+  }
+
+  private async cleanupExpiredTokens(userId: string) {
+    await this.refreshTokenRepository
+      .createQueryBuilder()
+      .delete()
+      .where('userId = :userId AND expiresAt < :now', {
+        userId,
+        now: new Date(),
+      })
+      .execute();
+
+    const tokens = await this.refreshTokenRepository.find({
+      where: { userId },
+      order: { createdAt: 'DESC' },
+      skip: 5,
+      take: 100,
+    });
+
+    if (tokens.length > 0) {
+      await this.refreshTokenRepository.delete({
+        id: In(tokens.map((t) => t.id)),
+      });
+    }
+  }
+
+  private parseExpiryToMilliseconds(expiry: string): number {
+    const match = expiry.match(/^(\d+)([smhd])$/);
+    if (!match) return 30 * 24 * 60 * 60 * 1000;
+
+    const value = parseInt(match[1], 10);
+    const unit = match[2];
+
+    const units: { [key: string]: number } = {
+      s: 1000,
+      m: 60 * 1000,
+      h: 60 * 60 * 1000,
+      d: 24 * 60 * 60 * 1000,
+    };
+
+    return value * units[unit];
+  }
+}

package/templates/orm/typeorm/src/modules/health/health.controller.ts

@@ -0,0 +1,24 @@
+import { Controller, Get } from '@nestjs/common';
+import {
+  HealthCheckService,
+  HealthCheck,
+  TypeOrmHealthIndicator,
+} from '@nestjs/terminus';
+import { Public } from 'src/common/decorators/public.decorator';
+
+@Controller('health')
+export class HealthController {
+  constructor(
+    private health: HealthCheckService,
+    private db: TypeOrmHealthIndicator,
+  ) {}
+
+  @Get()
+  @Public()
+  @HealthCheck()
+  check() {
+    return this.health.check([
+      () => this.db.pingCheck('database'),
+    ]);
+  }
+}

package/templates/orm/typeorm/src/modules/health/health.module.ts

@@ -0,0 +1,9 @@
+import { Module } from '@nestjs/common';
+import { TerminusModule } from '@nestjs/terminus';
+import { HealthController } from './health.controller';
+
+@Module({
+  imports: [TerminusModule],
+  controllers: [HealthController],
+})
+export class HealthModule {}

package/templates/orm/typeorm/src/modules/users/users.module.ts

@@ -0,0 +1,13 @@
+import { Module } from '@nestjs/common';
+import { TypeOrmModule } from '@nestjs/typeorm';
+import { UsersService } from './users.service';
+import { UsersController } from './users.controller';
+import { User } from 'src/entities/user.entity';
+import { RefreshToken } from 'src/entities/refresh-token.entity';
+
+@Module({
+  imports: [TypeOrmModule.forFeature([User, RefreshToken])],
+  controllers: [UsersController],
+  providers: [UsersService],
+})
+export class UsersModule {}