speedrun-cli 2.6.1

package/templates/orm/typeorm/src/modules/users/users.service.ts

@@ -0,0 +1,108 @@
+import { Injectable } from '@nestjs/common';
+import { InjectRepository } from '@nestjs/typeorm';
+import { Repository } from 'typeorm';
+import { User } from 'src/entities/user.entity';
+import { RefreshToken } from 'src/entities/refresh-token.entity';
+import { UpdateProfileDto } from './dtos/update-profile.dto';
+import { UpdateUserDto } from './dtos/update-user.dto';
+
+@Injectable()
+export class UsersService {
+  constructor(
+    @InjectRepository(User)
+    private userRepository: Repository<User>,
+    @InjectRepository(RefreshToken)
+    private refreshTokenRepository: Repository<RefreshToken>,
+  ) {}
+
+  async getProfile(userId: string) {
+    const user = await this.userRepository.findOne({
+      where: { id: userId },
+    });
+
+    return this.sanitizeUser(user);
+  }
+
+  async updateProfile(userId: string, updateProfileDto: UpdateProfileDto) {
+    await this.userRepository.update(userId, updateProfileDto);
+    
+    const updatedUser = await this.userRepository.findOne({
+      where: { id: userId },
+    });
+
+    return this.sanitizeUser(updatedUser);
+  }
+
+  async getAllUsers(page: number = 1, limit: number = 10) {
+    const skip = (page - 1) * limit;
+
+    const [users, total] = await this.userRepository.findAndCount({
+      where: { isActive: true },
+      skip,
+      take: limit,
+      order: { createdAt: 'DESC' },
+    });
+
+    const sanitizedUsers = users.map((user) => this.sanitizeUser(user));
+    const totalPages = Math.ceil(total / limit);
+
+    return {
+      data: sanitizedUsers,
+      meta: {
+        total,
+        page,
+        limit,
+        totalPages,
+        hasNext: page < totalPages,
+        hasPrevious: page > 1,
+      },
+    };
+  }
+
+  async getUserById(userId: string) {
+    if (!userId) {
+      return null;
+    }
+
+    const user = await this.userRepository.findOne({
+      where: { id: userId },
+    });
+
+    if (!user) {
+      return null;
+    }
+
+    return this.sanitizeUser(user);
+  }
+
+  async updateUserById(userId: string, updateUserDto: UpdateUserDto) {
+    await this.userRepository.update(userId, updateUserDto);
+
+    const updatedUser = await this.userRepository.findOne({
+      where: { id: userId },
+    });
+
+    return this.sanitizeUser(updatedUser);
+  }
+
+  async deleteUserById(userId: string) {
+    // Soft delete: set isActive to false
+    await this.userRepository.update(userId, { isActive: false });
+
+    // Invalidate all refresh tokens for this user
+    await this.refreshTokenRepository.delete({ userId });
+
+    return { message: 'User deleted successfully' };
+  }
+
+  // Utils
+
+  sanitizeUser(user: User | null) {
+    if (!user) {
+      return null;
+    }
+
+    const { refreshToken, passwordHash, ...safeUser } = user;
+    return safeUser;
+  }
+}

package/templates/swagger/src/common/dtos/pagination.dto.ts

@@ -0,0 +1,43 @@
+import { ApiPropertyOptional } from '@nestjs/swagger';
+import { IsOptional, IsInt, Min, Max } from 'class-validator';
+import { Type } from 'class-transformer';
+
+export class PaginationDto {
+  @ApiPropertyOptional({
+    description: 'Page number',
+    example: 1,
+    minimum: 1,
+    default: 1,
+  })
+  @IsOptional()
+  @Type(() => Number)
+  @IsInt()
+  @Min(1)
+  page?: number = 1;
+
+  @ApiPropertyOptional({
+    description: 'Number of items per page',
+    example: 10,
+    minimum: 1,
+    maximum: 100,
+    default: 10,
+  })
+  @IsOptional()
+  @Type(() => Number)
+  @IsInt()
+  @Min(1)
+  @Max(100)
+  limit?: number = 10;
+}
+
+export interface PaginatedResponse<T> {
+  data: T[];
+  meta: {
+    total: number;
+    page: number;
+    limit: number;
+    totalPages: number;
+    hasNext: boolean;
+    hasPrevious: boolean;
+  };
+}

package/templates/swagger/src/main.ts

@@ -0,0 +1,116 @@
+import { NestFactory } from '@nestjs/core';
+import { AppModule } from './app.module';
+import cookieParser from 'cookie-parser';
+import helmet from 'helmet';
+import { ValidationPipe } from '@nestjs/common';
+import { ConfigService } from '@nestjs/config';
+import { ResponseInterceptor } from './common/interceptors/response.interceptor';
+import { HttpExceptionFilter } from './common/filters/http-exception.filter';
+import { Logger } from 'nestjs-pino';
+import { DocumentBuilder, SwaggerModule } from '@nestjs/swagger';
+
+async function bootstrap() {
+  const app = await NestFactory.create(AppModule, { bufferLogs: true });
+
+  // Use Pino logger
+  app.useLogger(app.get(Logger));
+
+  app.setGlobalPrefix('api/v1');
+
+  const configService = app.get(ConfigService);
+
+  const port = configService.get<number>('PORT');
+  const corsOrigins = configService.get<string>('CORS_ORIGIN')?.split(',');
+
+  app.enableCors({
+    origins: corsOrigins,
+    credentials: true,
+  });
+
+  app.use(cookieParser());
+
+  // Configure Helmet with relaxed CSP to allow Swagger UI assets
+  app.use(
+    helmet({
+      contentSecurityPolicy: {
+        directives: {
+          defaultSrc: ["'self'"],
+          styleSrc: ["'self'", "'unsafe-inline'"],
+          scriptSrc: ["'self'", "'unsafe-inline'"],
+          imgSrc: ["'self'", 'data:', 'https:'],
+        },
+      },
+      crossOriginEmbedderPolicy: false,
+      crossOriginOpenerPolicy: { policy: 'same-origin' },
+      crossOriginResourcePolicy: { policy: 'cross-origin' },
+      dnsPrefetchControl: { allow: false },
+      frameguard: { action: 'deny' },
+      hidePoweredBy: true,
+      hsts: {
+        maxAge: 31536000,
+        includeSubDomains: true,
+        preload: true,
+      },
+      ieNoOpen: true,
+      noSniff: true,
+      referrerPolicy: { policy: 'strict-origin-when-cross-origin' },
+      xssFilter: true,
+    }),
+  );
+
+  app.useGlobalPipes(
+    new ValidationPipe({
+      whitelist: true,
+      forbidNonWhitelisted: true,
+      transform: true,
+    }),
+  );
+
+  // Get logger instance
+  const logger = app.get(Logger);
+
+  // Global response interceptor for standard API responses
+  app.useGlobalInterceptors(new ResponseInterceptor());
+
+  // Global exception filter for standard error responses
+  app.useGlobalFilters(new HttpExceptionFilter(logger));
+
+  // Swagger API documentation
+  const swaggerConfig = new DocumentBuilder()
+    .setTitle('NestJS Auth API')
+    .setDescription(
+      'Production-ready NestJS authentication API with JWT, refresh tokens, and Role-Based Access Control (RBAC).',
+    )
+    .setVersion('1.0')
+    .addBearerAuth(
+      {
+        type: 'http',
+        scheme: 'bearer',
+        bearerFormat: 'JWT',
+        name: 'Authorization',
+        description: 'Enter your JWT access token',
+        in: 'header',
+      },
+      'bearer',
+    )
+    .build();
+
+  const document = SwaggerModule.createDocument(app, swaggerConfig);
+  SwaggerModule.setup('api/docs', app, document, {
+    swaggerOptions: {
+      persistAuthorization: true,
+    },
+  });
+
+  await app.listen(port || 8080);
+
+  logger.log(
+    `🚀 Application is running on: http://localhost:${port || 8080}/api/v1`,
+    'Bootstrap',
+  );
+  logger.log(
+    `📄 Swagger docs available at: http://localhost:${port || 8080}/api/docs`,
+    'Bootstrap',
+  );
+}
+void bootstrap();

package/templates/swagger/src/modules/auth/auth.controller.ts

@@ -0,0 +1,235 @@
+import {
+  Body,
+  Controller,
+  Get,
+  Post,
+  Req,
+  Res,
+  UseGuards,
+} from '@nestjs/common';
+import {
+  ApiTags,
+  ApiOperation,
+  ApiResponse,
+  ApiBearerAuth,
+} from '@nestjs/swagger';
+import { AuthService } from './auth.service';
+import { Request, Response } from 'express';
+import { RefreshTokenGuard } from 'src/common/guards/refresh-token.guard';
+import { GetUser } from 'src/common/decorators/get-user.decorator';
+import { Public } from 'src/common/decorators/public.decorator';
+import { SignupDto } from './dtos/signup.dto';
+import { LoginDto } from './dtos/login.dto';
+import { Throttle, SkipThrottle } from '@nestjs/throttler';
+import { COOKIE_CONFIG } from 'src/common/constants/cookie.config';
+import { CookieOptions } from 'express';
+
+@ApiTags('Auth')
+@Controller('auth')
+export class AuthController {
+  constructor(private readonly authService: AuthService) {}
+
+  @ApiOperation({ summary: 'Register a new user account' })
+  @ApiResponse({
+    status: 201,
+    description: 'User successfully registered.',
+    schema: {
+      example: {
+        statusCode: 201,
+        message: 'User registered successfully',
+        data: {
+          id: 'clxyz...',
+          email: 'user@example.com',
+          fullName: 'John Doe',
+          role: 'USER',
+        },
+      },
+    },
+  })
+  @ApiResponse({
+    status: 400,
+    description: 'Validation error - invalid input data.',
+  })
+  @ApiResponse({ status: 409, description: 'Conflict - email already exists.' })
+  @Throttle({ strict: { ttl: 60000, limit: 3 } })
+  @Public()
+  @Post('/signup')
+  async signup(@Body() signupDto: SignupDto) {
+    return this.authService.signup(signupDto);
+  }
+
+  @ApiOperation({ summary: 'Login with email and password' })
+  @ApiResponse({
+    status: 200,
+    description: 'User successfully logged in. Tokens set in cookies.',
+    schema: {
+      example: {
+        statusCode: 200,
+        message: 'Login successful',
+        data: {
+          user: {
+            id: 'clxyz...',
+            email: 'user@example.com',
+            fullName: 'John Doe',
+            role: 'USER',
+          },
+        },
+      },
+    },
+  })
+  @ApiResponse({
+    status: 401,
+    description: 'Unauthorized - invalid credentials.',
+  })
+  @Throttle({ strict: { ttl: 60000, limit: 5 } })
+  @Public()
+  @Post('/login')
+  async login(
+    @Body() loginDto: LoginDto,
+    @Req() req: Request,
+    @Res({ passthrough: true }) res: Response,
+  ) {
+    const deviceInfo = req.headers['user-agent'] || 'Unknown Device';
+    const ipAddress =
+      (req.headers['x-forwarded-for'] as string)?.split(',')[0] ||
+      req.ip ||
+      'Unknown IP';
+
+    const data = await this.authService.login(loginDto, deviceInfo, ipAddress);
+
+    res.cookie(
+      COOKIE_CONFIG.ACCESS_TOKEN.name,
+      data.accessToken,
+      COOKIE_CONFIG.ACCESS_TOKEN.options as CookieOptions,
+    );
+    res.cookie(
+      COOKIE_CONFIG.REFRESH_TOKEN.name,
+      data.refreshToken,
+      COOKIE_CONFIG.REFRESH_TOKEN.options as CookieOptions,
+    );
+
+    return {
+      user: data.user,
+    };
+  }
+
+  @ApiOperation({ summary: 'Refresh access and refresh tokens' })
+  @ApiResponse({
+    status: 200,
+    description: 'Tokens refreshed successfully.',
+    schema: {
+      example: {
+        statusCode: 200,
+        message: 'Tokens refreshed successfully',
+      },
+    },
+  })
+  @ApiResponse({
+    status: 401,
+    description: 'Unauthorized - invalid or expired refresh token.',
+  })
+  @Throttle({ default: { ttl: 60000, limit: 10 } })
+  @Public()
+  @UseGuards(RefreshTokenGuard)
+  @Post('/refresh')
+  async refreshToken(
+    @GetUser('sub') userId: string,
+    @Req() req: Request,
+    @Res({ passthrough: true }) res: Response,
+  ) {
+    const rt = req.cookies[COOKIE_CONFIG.REFRESH_TOKEN.name] as string;
+    const deviceInfo = req.headers['user-agent'] || 'Unknown Device';
+    const ipAddress =
+      (req.headers['x-forwarded-for'] as string)?.split(',')[0] ||
+      req.ip ||
+      'Unknown IP';
+
+    const { accessToken, refreshToken } = await this.authService.refreshToken(
+      userId,
+      rt,
+      deviceInfo,
+      ipAddress,
+    );
+
+    res.cookie(
+      COOKIE_CONFIG.ACCESS_TOKEN.name,
+      accessToken,
+      COOKIE_CONFIG.ACCESS_TOKEN.options as CookieOptions,
+    );
+    res.cookie(
+      COOKIE_CONFIG.REFRESH_TOKEN.name,
+      refreshToken,
+      COOKIE_CONFIG.REFRESH_TOKEN.options as CookieOptions,
+    );
+
+    return {
+      message: 'Tokens refreshed successfully',
+    };
+  }
+
+  @ApiOperation({ summary: 'Logout and invalidate tokens' })
+  @ApiResponse({
+    status: 200,
+    description: 'User logged out successfully.',
+    schema: {
+      example: {
+        statusCode: 200,
+        message: 'Logged out successfully',
+      },
+    },
+  })
+  @Public()
+  @UseGuards(RefreshTokenGuard)
+  @Post('/logout')
+  async logout(
+    @GetUser('sub') userId: string,
+    @Req() req: Request,
+    @Res({ passthrough: true }) res: Response,
+  ) {
+    const rt = req.cookies[COOKIE_CONFIG.REFRESH_TOKEN.name] as
+      | string
+      | undefined;
+    await this.authService.logout(userId, rt);
+
+    res.clearCookie(
+      COOKIE_CONFIG.ACCESS_TOKEN.name,
+      COOKIE_CONFIG.ACCESS_TOKEN.options as CookieOptions | undefined,
+    );
+    res.clearCookie(
+      COOKIE_CONFIG.REFRESH_TOKEN.name,
+      COOKIE_CONFIG.REFRESH_TOKEN.options as CookieOptions | undefined,
+    );
+
+    return {
+      message: 'Logged out successfully',
+    };
+  }
+
+  @ApiBearerAuth('bearer')
+  @ApiOperation({ summary: 'Get current authenticated user profile' })
+  @ApiResponse({
+    status: 200,
+    description: 'Returns the current user profile.',
+    schema: {
+      example: {
+        statusCode: 200,
+        data: {
+          id: 'clxyz...',
+          email: 'user@example.com',
+          fullName: 'John Doe',
+          role: 'USER',
+          isActive: true,
+        },
+      },
+    },
+  })
+  @ApiResponse({
+    status: 401,
+    description: 'Unauthorized - invalid or missing JWT token.',
+  })
+  @SkipThrottle()
+  @Get('/me')
+  async getMe(@GetUser('sub') userId: string) {
+    return this.authService.getMe(userId);
+  }
+}

package/templates/swagger/src/modules/auth/dtos/login.dto.ts

@@ -0,0 +1,20 @@
+import { ApiProperty } from '@nestjs/swagger';
+import { IsEmail, IsString } from 'class-validator';
+import { IsStrongPassword } from 'src/common/validators/password.validator';
+
+export class LoginDto {
+  @ApiProperty({
+    description: 'User email address',
+    example: 'user@example.com',
+  })
+  @IsEmail()
+  email: string;
+
+  @ApiProperty({
+    description: 'User password',
+    example: 'StrongP@ss1',
+  })
+  @IsString()
+  @IsStrongPassword()
+  password: string;
+}

package/templates/swagger/src/modules/auth/dtos/signup.dto.ts

@@ -0,0 +1,14 @@
+import { ApiProperty } from '@nestjs/swagger';
+import { IsString, MinLength } from 'class-validator';
+import { LoginDto } from './login.dto';
+
+export class SignupDto extends LoginDto {
+  @ApiProperty({
+    description: 'User full name',
+    example: 'John Doe',
+    minLength: 2,
+  })
+  @IsString()
+  @MinLength(2)
+  fullName: string;
+}

package/templates/swagger/src/modules/users/dtos/update-profile.dto.ts

@@ -0,0 +1,19 @@
+import { ApiPropertyOptional } from '@nestjs/swagger';
+import { IsOptional, IsString, MaxLength, MinLength } from 'class-validator';
+
+export class UpdateProfileDto {
+  @ApiPropertyOptional({
+    description: 'User full name',
+    example: 'Jane Doe',
+    minLength: 2,
+    maxLength: 100,
+  })
+  @IsOptional()
+  @IsString()
+  @MinLength(2)
+  @MaxLength(100)
+  fullName?: string;
+
+  // Email update removed - requires separate verification flow for security
+  // Implement email change in a dedicated endpoint with verification
+}

package/templates/swagger/src/modules/users/dtos/update-user.dto.ts

@@ -0,0 +1,23 @@
+import { ApiPropertyOptional } from '@nestjs/swagger';
+import { IsBoolean, IsEnum, IsOptional } from 'class-validator';
+import { UpdateProfileDto } from './update-profile.dto';
+import { UserRole } from 'src/common/guards/roles.guard';
+
+export class UpdateUserDto extends UpdateProfileDto {
+  @ApiPropertyOptional({
+    description: 'User role',
+    enum: UserRole,
+    example: 'ADMIN',
+  })
+  @IsOptional()
+  @IsEnum(UserRole, { message: 'Role must be a valid UserRole' })
+  role?: UserRole;
+
+  @ApiPropertyOptional({
+    description: 'Whether the user account is active',
+    example: true,
+  })
+  @IsOptional()
+  @IsBoolean()
+  isActive?: boolean;
+}