ta_data_mas 0.0.2

package/apps/api/package.json

@@ -0,0 +1,99 @@
+{
+  "name": "api",
+  "version": "0.0.1",
+  "description": "",
+  "author": "",
+  "private": true,
+  "license": "UNLICENSED",
+  "scripts": {
+    "build": "nest build",
+    "format": "prettier --write \"src/**/*.ts\" \"test/**/*.ts\"",
+    "start": "nest start",
+    "start:dev": "nest start --watch",
+    "start:debug": "nest start --debug --watch",
+    "start:prod": "node dist/main",
+    "db:generate": "drizzle-kit generate",
+    "db:migrate": "drizzle-kit migrate",
+    "db:push": "drizzle-kit push",
+    "db:studio": "drizzle-kit studio",
+    "lint": "eslint \"{src,apps,libs,test}/**/*.ts\" --fix",
+    "test": "jest",
+    "test:watch": "jest --watch",
+    "test:cov": "jest --coverage",
+    "test:debug": "node --inspect-brk -r tsconfig-paths/register -r ts-node/register node_modules/.bin/jest --runInBand",
+    "test:e2e": "jest --config ./test/jest-e2e.json"
+  },
+  "dependencies": {
+    "@neondatabase/serverless": "^1.1.0",
+    "@nestjs/common": "^11.0.1",
+    "@nestjs/config": "^4.0.4",
+    "@nestjs/core": "^11.0.1",
+    "@nestjs/jwt": "^11.0.2",
+    "@nestjs/platform-express": "^11.0.1",
+    "@nestjs/platform-socket.io": "^11.1.27",
+    "@nestjs/websockets": "^11.1.27",
+    "@apiDatabase/types": "workspace:*",
+    "@apiDatabase/constants": "workspace:*",
+    "bcrypt": "^6.0.0",
+    "class-transformer": "^0.5.1",
+    "class-validator": "^0.15.1",
+    "cookie-parser": "^1.4.7",
+    "dotenv": "^17.4.2",
+    "drizzle-orm": "^0.45.2",
+    "pg": "^8.22.0",
+    "reflect-metadata": "^0.2.2",
+    "resend": "^6.16.0",
+    "rxjs": "^7.8.1",
+    "slugify": "^1.6.9",
+    "socket.io": "^4.8.3",
+    "uploadthing": "^7.7.4",
+    "ws": "^8.21.0"
+  },
+  "devDependencies": {
+    "@eslint/eslintrc": "^3.2.0",
+    "@eslint/js": "^9.18.0",
+    "@nestjs/cli": "^11.0.0",
+    "@nestjs/schematics": "^11.0.0",
+    "@nestjs/testing": "^11.0.1",
+    "@types/bcrypt": "^6.0.0",
+    "@types/cookie-parser": "^1.4.10",
+    "@types/express": "^5.0.0",
+    "@types/jest": "^30.0.0",
+    "@types/node": "^24.0.0",
+    "@types/pg": "^8.20.0",
+    "@types/supertest": "^7.0.0",
+    "@types/ws": "^8.18.1",
+    "drizzle-kit": "^0.31.10",
+    "eslint": "^9.18.0",
+    "eslint-config-prettier": "^10.0.1",
+    "eslint-plugin-prettier": "^5.2.2",
+    "globals": "^17.0.0",
+    "jest": "^30.0.0",
+    "prettier": "^3.4.2",
+    "source-map-support": "^0.5.21",
+    "supertest": "^7.0.0",
+    "ts-jest": "^29.2.5",
+    "ts-loader": "^9.5.2",
+    "ts-node": "^10.9.2",
+    "tsconfig-paths": "^4.2.0",
+    "typescript": "^5.7.3",
+    "typescript-eslint": "^8.20.0"
+  },
+  "jest": {
+    "moduleFileExtensions": [
+      "js",
+      "json",
+      "ts"
+    ],
+    "rootDir": "src",
+    "testRegex": ".*\\.spec\\.ts$",
+    "transform": {
+      "^.+\\.(t|j)s$": "ts-jest"
+    },
+    "collectCoverageFrom": [
+      "**/*.(t|j)s"
+    ],
+    "coverageDirectory": "../coverage",
+    "testEnvironment": "node"
+  }
+}

package/apps/api/src/app.controller.spec.ts

@@ -0,0 +1,25 @@
+import { Test, TestingModule } from '@nestjs/testing';
+import { AppController } from './app.controller';
+import { AppService } from './app.service';
+
+describe('AppController', () => {
+  let appController: AppController;
+
+  beforeEach(async () => {
+    const app: TestingModule = await Test.createTestingModule({
+      controllers: [AppController],
+      providers: [AppService],
+    }).compile();
+
+    appController = app.get<AppController>(AppController);
+  });
+
+  describe('root', () => {
+    it('should return a healthy status', () => {
+      expect(appController.health()).toEqual({
+        status: 'ok',
+        timestamp: expect.any(String),
+      });
+    });
+  });
+});

package/apps/api/src/app.controller.ts

@@ -0,0 +1,9 @@
+import { Controller, Get } from '@nestjs/common';
+
+@Controller()
+export class AppController {
+  @Get('health')
+  health() {
+    return { status: 'ok', timestamp: new Date().toISOString() };
+  }
+}

package/apps/api/src/app.module.ts

@@ -0,0 +1,37 @@
+import { Module } from '@nestjs/common';
+import { AppController } from './app.controller';
+import { AppService } from './app.service';
+import { ConfigModule } from '@nestjs/config';
+import { DbModule } from './db/db.module';
+import { AuthModule } from './auth/auth.module';
+import { OrgsModule } from './orgs/orgs.module';
+import { MembersModule } from './members/members.module';
+import { ProjectsModule } from './projects/projects.module';
+import { TableEditorModule } from './table-editor/table-editor.module';
+import { ProjectApiModule } from './project-api/project-api.module';
+import { SqlEditorModule } from './sql-editor/sql-editor.module';
+import { RealtimeModule } from './realtime/realtime.module';
+import { StorageModule } from './storage/storage.module';
+import { ProjectAuthModule } from './project-auth/project-auth.module';
+
+@Module({
+  imports: [
+    ConfigModule.forRoot({
+      isGlobal: true,
+    }),
+    DbModule,
+    AuthModule,
+    OrgsModule,
+    MembersModule,
+    ProjectsModule,
+    TableEditorModule,
+    ProjectApiModule,
+    SqlEditorModule,
+    RealtimeModule,
+    StorageModule,
+    ProjectAuthModule,
+  ],
+  controllers: [AppController],
+  providers: [AppService],
+})
+export class AppModule {}

package/apps/api/src/app.service.ts

@@ -0,0 +1,8 @@
+import { Injectable } from '@nestjs/common';
+
+@Injectable()
+export class AppService {
+  getHello(): string {
+    return 'Hello World!';
+  }
+}

package/apps/api/src/auth/auth.controller.ts

@@ -0,0 +1,113 @@
+import {
+  Body,
+  Controller,
+  Get,
+  HttpCode,
+  Post,
+  Query,
+  Redirect,
+  Req,
+  Res,
+  UseGuards,
+} from '@nestjs/common';
+import type { Request, Response } from 'express';
+import { ConfigService } from '@nestjs/config';
+import { COOKIE_KEYS } from '@apiDatabase/constants';
+import type { JwtPayload } from '@apiDatabase/types';
+import { AuthService } from './auth.service';
+import { RegisterDto } from './dto/register.dto';
+import { LoginDto } from './dto/login.dto';
+import { JwtAuthGuard } from './guards/jwt-auth-guard';
+import { CurrentUser } from './decorators/current-user-decorator';
+import { InviteService } from 'src/members/invite.service';
+
+@Controller('auth')
+export class AuthController {
+  constructor(
+    private authService: AuthService,
+    private configService: ConfigService,
+    private inviteService: InviteService,
+  ) {}
+
+  @Post('register')
+  async register(
+    @Body() dto: RegisterDto,
+    @Res({ passthrough: true }) res: Response,
+  ) {
+    const tokens = await this.authService.register(dto);
+    this.authService.setTokenCookies(res, tokens);
+    return { message: 'Registered successfully' };
+  }
+
+  @Post('login')
+  @HttpCode(200)
+  async login(
+    @Body() dto: LoginDto,
+    @Res({ passthrough: true }) res: Response,
+  ) {
+    const tokens = await this.authService.login(dto);
+    this.authService.setTokenCookies(res, tokens);
+    return { message: 'Logged in successfully' };
+  }
+
+  @Post('logout')
+  @HttpCode(200)
+  logout(@Res({ passthrough: true }) res: Response) {
+    this.authService.clearTokenCookies(res);
+    return { message: 'Logged out successfully' };
+  }
+
+  @Post('refresh')
+  @HttpCode(200)
+  async refresh(
+    @Req() req: Request,
+    @Res({ passthrough: true }) res: Response,
+  ) {
+    const refreshToken = req.cookies[COOKIE_KEYS.REFRESH_TOKEN] as string;
+    const tokens = await this.authService.refreshTokens(refreshToken);
+    this.authService.setTokenCookies(res, tokens);
+    return { message: 'Tokens refreshed' };
+  }
+
+  @UseGuards(JwtAuthGuard)
+  @Get('me')
+  me(@CurrentUser() user: JwtPayload) {
+    return user;
+  }
+
+  @Get('google')
+  @Redirect()
+  googleLogin() {
+    return { url: this.authService.getGoogleAuthUrl() };
+  }
+
+  @Get('google/callback')
+  async googleCallback(@Query('code') code: string, @Res() res: Response) {
+    const tokens = await this.authService.handleGoogleCallback(code);
+    this.authService.setTokenCookies(res, tokens);
+    return res.redirect(
+      `${this.configService.get<string>('WEB_URL')}/dashboard`,
+    );
+  }
+
+  @Get('github')
+  @Redirect()
+  githubLogin() {
+    return { url: this.authService.getGithubAuthUrl() };
+  }
+
+  @Get('github/callback')
+  async githubCallback(@Query('code') code: string, @Res() res: Response) {
+    const tokens = await this.authService.handleGithubCallback(code);
+    this.authService.setTokenCookies(res, tokens);
+    return res.redirect(
+      `${this.configService.get<string>('WEB_URL')}/dashboard`,
+    );
+  }
+
+  @Get('invite/accept')
+  async acceptInvite(@Query('token') token: string, @Res() res: Response) {
+    await this.inviteService.acceptInvite(token);
+    return res.redirect(`${this.configService.get('WEB_URL')}/dashboard`);
+  }
+}

package/apps/api/src/auth/auth.module.ts

@@ -0,0 +1,15 @@
+import { Module } from '@nestjs/common';
+import { JwtModule } from '@nestjs/jwt';
+import { AuthService } from './auth.service';
+import { AuthController } from './auth.controller';
+import { JwtAuthGuard } from './guards/jwt-auth-guard';
+import { MembersModule } from 'src/members/members.module';
+
+@Module({
+  imports: [JwtModule.register({}), MembersModule],
+
+  providers: [AuthService, JwtAuthGuard],
+  controllers: [AuthController],
+  exports: [JwtModule, JwtAuthGuard],
+})
+export class AuthModule {}

package/apps/api/src/auth/auth.service.ts

@@ -0,0 +1,309 @@
+import {
+  ConflictException,
+  Injectable,
+  UnauthorizedException,
+} from '@nestjs/common';
+import { JwtService } from '@nestjs/jwt';
+import { ConfigService } from '@nestjs/config';
+import { Response } from 'express';
+import * as bcrypt from 'bcrypt';
+import { randomBytes } from 'crypto';
+import slugify from 'slugify';
+import { eq } from 'drizzle-orm';
+import { COOKIE_KEYS } from '@apiDatabase/constants';
+import { DrizzleService } from '../db/drizzle.service';
+import { users, organizations, orgMembers } from '../db/schema';
+import { RegisterDto } from './dto/register.dto';
+import { LoginDto } from './dto/login.dto';
+import { JwtPayload } from '@apiDatabase/types';
+
+@Injectable()
+export class AuthService {
+  constructor(
+    private drizzle: DrizzleService,
+    private jwtService: JwtService,
+    private configService: ConfigService,
+  ) {}
+
+  // Cookie helpers
+  setTokenCookies(
+    res: Response,
+    tokens: { accessToken: string; refreshToken: string },
+  ) {
+    const isProduction = this.configService.get('NODE_ENV') === 'production';
+
+    res.cookie(COOKIE_KEYS.ACCESS_TOKEN, tokens.accessToken, {
+      httpOnly: true,
+      secure: isProduction,
+      sameSite: 'lax',
+      maxAge: 15 * 60 * 1000,
+    });
+
+    res.cookie(COOKIE_KEYS.REFRESH_TOKEN, tokens.refreshToken, {
+      httpOnly: true,
+      secure: isProduction,
+      sameSite: 'lax',
+      maxAge: 7 * 24 * 60 * 60 * 1000,
+    });
+  }
+
+  clearTokenCookies(res: Response) {
+    res.clearCookie(COOKIE_KEYS.ACCESS_TOKEN);
+    res.clearCookie(COOKIE_KEYS.REFRESH_TOKEN);
+  }
+
+  // Slug helper
+  private generateOrgSlug(name: string): string {
+    const base = slugify(`${name}-org`, { lower: true, strict: true });
+    const suffix = randomBytes(3).toString('hex');
+    return `${base}-${suffix}`;
+  }
+
+  // JWT signing
+  private signTokens(userId: string, email: string) {
+    const payload = { sub: userId, email };
+
+    const accessToken = this.jwtService.sign(payload, {
+      secret: this.configService.get('JWT_ACCESS_SECRET'),
+      expiresIn: this.configService.get('JWT_ACCESS_EXPIRES_IN'),
+    });
+
+    const refreshToken = this.jwtService.sign(payload, {
+      secret: this.configService.get('JWT_REFRESH_SECRET'),
+      expiresIn: this.configService.get('JWT_REFRESH_EXPIRES_IN'),
+    });
+
+    return { accessToken, refreshToken };
+  }
+
+  // Email + Password
+  async register(dto: RegisterDto) {
+    const existing = await this.drizzle.db
+      .select()
+      .from(users)
+      .where(eq(users.email, dto.email))
+      .limit(1);
+
+    if (existing.length > 0) {
+      throw new ConflictException('Email already in use');
+    }
+
+    const passwordHash = await bcrypt.hash(dto.password, 12);
+
+    const [user] = await this.drizzle.db
+      .insert(users)
+      .values({ email: dto.email, name: dto.name, passwordHash })
+      .returning();
+
+    const [org] = await this.drizzle.db
+      .insert(organizations)
+      .values({
+        name: `${dto.name}'s Org`,
+        slug: this.generateOrgSlug(dto.name),
+      })
+      .returning();
+
+    await this.drizzle.db.insert(orgMembers).values({
+      orgId: org.id,
+      userId: user.id,
+      role: 'admin',
+    });
+
+    return this.signTokens(user.id, user.email);
+  }
+
+  async login(dto: LoginDto) {
+    const [user] = await this.drizzle.db
+      .select()
+      .from(users)
+      .where(eq(users.email, dto.email))
+      .limit(1);
+
+    if (!user || !user.passwordHash) {
+      throw new UnauthorizedException('Invalid credentials');
+    }
+
+    const passwordMatch = await bcrypt.compare(dto.password, user.passwordHash);
+    if (!passwordMatch) {
+      throw new UnauthorizedException('Invalid credentials');
+    }
+
+    return this.signTokens(user.id, user.email);
+  }
+
+  async refreshTokens(refreshToken: string) {
+    try {
+      const payload = this.jwtService.verify<JwtPayload>(refreshToken, {
+        secret: this.configService.get('JWT_REFRESH_SECRET'),
+      });
+
+      const [user] = await this.drizzle.db
+        .select()
+        .from(users)
+        .where(eq(users.id, payload.sub))
+        .limit(1);
+
+      if (!user) throw new UnauthorizedException();
+
+      return this.signTokens(user.id, user.email);
+    } catch {
+      throw new UnauthorizedException('Invalid refresh token');
+    }
+  }
+
+  // OAuth upsert helpers
+  async handleOAuthUser(profile: {
+    email: string;
+    name: string;
+    avatarUrl: string | null;
+  }) {
+    let [user] = await this.drizzle.db
+      .select()
+      .from(users)
+      .where(eq(users.email, profile.email))
+      .limit(1);
+
+    if (!user) {
+      const [newUser] = await this.drizzle.db
+        .insert(users)
+        .values({
+          email: profile.email,
+          name: profile.name,
+          avatarUrl: profile.avatarUrl,
+        })
+        .returning();
+
+      user = newUser;
+
+      const [org] = await this.drizzle.db
+        .insert(organizations)
+        .values({
+          name: `${profile.name}'s Org`,
+          slug: this.generateOrgSlug(profile.name),
+        })
+        .returning();
+
+      await this.drizzle.db.insert(orgMembers).values({
+        orgId: org.id,
+        userId: user.id,
+        role: 'admin',
+      });
+    }
+
+    return this.signTokens(user.id, user.email);
+  }
+
+  getGoogleAuthUrl() {
+    const params = new URLSearchParams({
+      client_id: this.configService.get<string>('GOOGLE_CLIENT_ID')!,
+      redirect_uri: this.configService.get<string>('GOOGLE_CALLBACK_URL')!,
+      response_type: 'code',
+      scope: 'openid email profile',
+      access_type: 'offline',
+    });
+
+    return `https://accounts.google.com/o/oauth2/v2/auth?${params.toString()}`;
+  }
+
+  async handleGoogleCallback(code: string) {
+    const tokenRes = await fetch('https://oauth2.googleapis.com/token', {
+      method: 'POST',
+      headers: { 'Content-Type': 'application/x-www-form-urlencoded' },
+      body: new URLSearchParams({
+        code,
+        client_id: this.configService.get<string>('GOOGLE_CLIENT_ID')!,
+        client_secret: this.configService.get<string>('GOOGLE_CLIENT_SECRET')!,
+        redirect_uri: this.configService.get<string>('GOOGLE_CALLBACK_URL')!,
+        grant_type: 'authorization_code',
+      }),
+    });
+
+    const tokenData = (await tokenRes.json()) as { access_token: string };
+
+    const profileRes = await fetch(
+      'https://www.googleapis.com/oauth2/v3/userinfo',
+      {
+        headers: { Authorization: `Bearer ${tokenData.access_token}` },
+      },
+    );
+
+    const profile = (await profileRes.json()) as {
+      email: string;
+      name: string;
+      picture: string | null;
+    };
+
+    return this.handleOAuthUser({
+      email: profile.email,
+      name: profile.name,
+      avatarUrl: profile.picture ?? null,
+    });
+  }
+
+  getGithubAuthUrl() {
+    const params = new URLSearchParams({
+      client_id: this.configService.get<string>('GITHUB_CLIENT_ID')!,
+      redirect_uri: this.configService.get<string>('GITHUB_CALLBACK_URL')!,
+      scope: 'read:user user:email',
+    });
+
+    return `https://github.com/login/oauth/authorize?${params.toString()}`;
+  }
+
+  async handleGithubCallback(code: string) {
+    const tokenRes = await fetch(
+      'https://github.com/login/oauth/access_token',
+      {
+        method: 'POST',
+        headers: {
+          'Content-Type': 'application/json',
+          Accept: 'application/json',
+        },
+        body: JSON.stringify({
+          client_id: this.configService.get<string>('GITHUB_CLIENT_ID'),
+          client_secret: this.configService.get<string>('GITHUB_CLIENT_SECRET'),
+          code,
+          redirect_uri: this.configService.get<string>('GITHUB_CALLBACK_URL'),
+        }),
+      },
+    );
+
+    const tokenData = (await tokenRes.json()) as { access_token: string };
+
+    const profileRes = await fetch('https://api.github.com/user', {
+      headers: {
+        Authorization: `Bearer ${tokenData.access_token}`,
+        Accept: 'application/vnd.github+json',
+      },
+    });
+
+    const profile = (await profileRes.json()) as {
+      email: string | null;
+      name: string | null;
+      login: string;
+      avatar_url: string | null;
+    };
+
+    let email = profile.email;
+    if (!email) {
+      const emailRes = await fetch('https://api.github.com/user/emails', {
+        headers: {
+          Authorization: `Bearer ${tokenData.access_token}`,
+          Accept: 'application/vnd.github+json',
+        },
+      });
+      const emails = (await emailRes.json()) as {
+        email: string;
+        primary: boolean;
+        verified: boolean;
+      }[];
+      email = emails.find((e) => e.primary && e.verified)?.email ?? null;
+    }
+
+    return this.handleOAuthUser({
+      email: email!,
+      name: profile.name ?? profile.login,
+      avatarUrl: profile.avatar_url ?? null,
+    });
+  }
+}

package/apps/api/src/auth/decorators/current-user-decorator.ts

@@ -0,0 +1,10 @@
+import { createParamDecorator, ExecutionContext } from '@nestjs/common';
+import { Request } from 'express';
+import type { JwtPayload } from '@apiDatabase/types';
+
+export const CurrentUser = createParamDecorator(
+  (_data: unknown, ctx: ExecutionContext): JwtPayload => {
+    const request = ctx.switchToHttp().getRequest<Request>();
+    return request['user'] as JwtPayload;
+  },
+);

package/apps/api/src/auth/decorators/require-org-role-decorator.ts

@@ -0,0 +1,7 @@
+import { SetMetadata } from '@nestjs/common';
+import type { OrgRole } from '@apiDatabase/types';
+
+export const ORG_ROLE_KEY = 'orgRole';
+
+export const RequireOrgRole = (role: OrgRole) =>
+  SetMetadata(ORG_ROLE_KEY, role);

package/apps/api/src/auth/dto/login.dto.ts

@@ -0,0 +1,10 @@
+import { IsEmail, IsString } from 'class-validator';
+import type { LoginInput } from '@apiDatabase/types';
+
+export class LoginDto implements LoginInput {
+  @IsEmail()
+  email!: string;
+
+  @IsString()
+  password!: string;
+}

package/apps/api/src/auth/dto/register.dto.ts

@@ -0,0 +1,14 @@
+import { IsEmail, IsString, MinLength } from 'class-validator';
+import type { RegisterInput } from '@apiDatabase/types';
+
+export class RegisterDto implements RegisterInput {
+  @IsEmail()
+  email!: string;
+
+  @IsString()
+  @MinLength(8)
+  password!: string;
+
+  @IsString()
+  name!: string;
+}