ta_data_mas 0.0.2

package/apps/api/src/project-auth/project-auth.controller.ts

@@ -0,0 +1,111 @@
+import { Body, Controller, Get, Param, Post, Query, Res } from '@nestjs/common';
+import type { Response } from 'express';
+import { ConfigService } from '@nestjs/config';
+import { ProjectAuthService } from './project-auth.service';
+import { SignUpDto } from './dto/signup.dto';
+import { SignInDto } from './dto/signin.dto';
+import { MagicLinkDto } from './dto/magic-link.dto';
+
+@Controller('projects/:projectSlug/auth')
+export class ProjectAuthController {
+  constructor(
+    private projectAuthService: ProjectAuthService,
+    private configService: ConfigService,
+  ) {}
+
+  @Post('signup')
+  signUp(@Param('projectSlug') projectSlug: string, @Body() dto: SignUpDto) {
+    return this.projectAuthService.signUp(projectSlug, dto);
+  }
+
+  @Post('signin')
+  signIn(@Param('projectSlug') projectSlug: string, @Body() dto: SignInDto) {
+    return this.projectAuthService.signIn(projectSlug, dto);
+  }
+
+  @Post('magic-link')
+  sendMagicLink(
+    @Param('projectSlug') projectSlug: string,
+    @Body() dto: MagicLinkDto,
+  ) {
+    return this.projectAuthService.sendMagicLink(projectSlug, dto.email);
+  }
+
+  @Get('magic-link/verify')
+  verifyMagicLink(
+    @Param('projectSlug') projectSlug: string,
+    @Query('token') token: string,
+  ) {
+    return this.projectAuthService.verifyMagicLink(projectSlug, token);
+  }
+
+  @Get('google')
+  async googleLogin(
+    @Param('projectSlug') projectSlug: string,
+    @Res() res: Response,
+  ) {
+    const settings =
+      await this.projectAuthService.getOAuthSettings(projectSlug);
+    if (!settings.googleClientId) {
+      return res.status(400).json({ message: 'Google OAuth not configured' });
+    }
+
+    const apiUrl = this.configService.get<string>('API_URL');
+    const redirectUri = `${apiUrl}/projects/${projectSlug}/auth/google/callback`;
+    const url = this.projectAuthService.buildGoogleAuthUrl(
+      settings.googleClientId,
+      redirectUri,
+    );
+    return res.redirect(url);
+  }
+
+  @Get('google/callback')
+  async googleCallback(
+    @Param('projectSlug') projectSlug: string,
+    @Query('code') code: string,
+    @Res() res: Response,
+  ) {
+    const result = await this.projectAuthService.handleGoogleCallback(
+      projectSlug,
+      code,
+    );
+    const webUrl =
+      await this.projectAuthService.getSiteUrlForProject(projectSlug);
+    return res.redirect(`${webUrl}/?access_token=${result.accessToken}`);
+  }
+
+  @Get('github')
+  async githubLogin(
+    @Param('projectSlug') projectSlug: string,
+    @Res() res: Response,
+  ) {
+    const settings =
+      await this.projectAuthService.getOAuthSettings(projectSlug);
+    if (!settings.githubClientId) {
+      return res.status(400).json({ message: 'GitHub OAuth not configured' });
+    }
+
+    const apiUrl = this.configService.get<string>('API_URL');
+    const redirectUri = `${apiUrl}/projects/${projectSlug}/auth/github/callback`;
+    const url = this.projectAuthService.buildGithubAuthUrl(
+      settings.githubClientId,
+      redirectUri,
+    );
+    return res.redirect(url);
+  }
+
+  @Get('github/callback')
+  async githubCallback(
+    @Param('projectSlug') projectSlug: string,
+    @Query('code') code: string,
+    @Res() res: Response,
+  ) {
+    const result = await this.projectAuthService.handleGithubCallback(
+      projectSlug,
+      code,
+    );
+    const webUrl =
+      await this.projectAuthService.getSiteUrlForProject(projectSlug);
+    return res.redirect(`${webUrl}/?access_token=${result.accessToken}`);
+  }
+}

package/apps/api/src/project-auth/project-auth.module.ts

@@ -0,0 +1,13 @@
+import { Module } from '@nestjs/common';
+import { JwtModule } from '@nestjs/jwt';
+import { ProjectAuthService } from './project-auth.service';
+import { ProjectAuthController } from './project-auth.controller';
+import { ProjectAuthDashboardController } from './project-auth-dashboard.controller';
+import { AuthModule } from '../auth/auth.module';
+
+@Module({
+  imports: [JwtModule.register({}), AuthModule],
+  providers: [ProjectAuthService],
+  controllers: [ProjectAuthController, ProjectAuthDashboardController],
+})
+export class ProjectAuthModule {}

package/apps/api/src/project-auth/project-auth.service.ts

@@ -0,0 +1,440 @@
+import {
+  BadRequestException,
+  ConflictException,
+  Injectable,
+  NotFoundException,
+  UnauthorizedException,
+} from '@nestjs/common';
+import { JwtService } from '@nestjs/jwt';
+import { ConfigService } from '@nestjs/config';
+import { Resend } from 'resend';
+import * as bcrypt from 'bcrypt';
+import { eq, sql } from 'drizzle-orm';
+import { DrizzleService } from '../db/drizzle.service';
+import { projects } from '../db/schema';
+import { AUTH_PROVIDERS, MAGIC_LINK_EXPIRES_IN } from '@apiDatabase/constants';
+import type { SignUpInput, SignInInput } from '@apiDatabase/types';
+
+interface ProjectAuthTokenPayload {
+  sub: string;
+  email: string;
+  projectId: string;
+}
+
+@Injectable()
+export class ProjectAuthService {
+  private resend: Resend;
+
+  constructor(
+    private drizzle: DrizzleService,
+    private jwtService: JwtService,
+    private configService: ConfigService,
+  ) {
+    this.resend = new Resend(this.configService.get<string>('RESEND_API_KEY'));
+  }
+
+  private async getProject(projectSlug: string) {
+    const [project] = await this.drizzle.db
+      .select()
+      .from(projects)
+      .where(eq(projects.slug, projectSlug))
+      .limit(1);
+
+    if (!project) throw new NotFoundException('Project not found');
+    return project;
+  }
+
+  // not every project needs Auth
+  private async ensureAuthUsersTable(dbSchema: string): Promise<void> {
+    await this.drizzle.db.execute(
+      sql.raw(`
+      CREATE TABLE IF NOT EXISTS "${dbSchema}"."auth_users" (
+        id UUID DEFAULT gen_random_uuid() PRIMARY KEY,
+        email TEXT NOT NULL UNIQUE,
+        password_hash TEXT,
+        email_verified BOOLEAN NOT NULL DEFAULT FALSE,
+        provider TEXT NOT NULL DEFAULT 'email',
+        created_at TIMESTAMPTZ NOT NULL DEFAULT now()
+      )
+    `),
+    );
+  }
+
+  private signToken(
+    userId: string,
+    email: string,
+    projectId: string,
+    secret: string,
+  ): string {
+    return this.jwtService.sign(
+      { sub: userId, email, projectId } satisfies ProjectAuthTokenPayload,
+      { secret, expiresIn: '7d' },
+    );
+  }
+
+  async signUp(projectSlug: string, dto: SignUpInput) {
+    const project = await this.getProject(projectSlug);
+    await this.ensureAuthUsersTable(project.dbSchema);
+
+    const existing = await this.drizzle.db.execute<{ id: string }>(sql`
+      SELECT id FROM ${sql.identifier(project.dbSchema)}.auth_users
+      WHERE email = ${dto.email}
+    `);
+
+    if (existing.rows.length > 0) {
+      throw new ConflictException('Email already registered');
+    }
+
+    const passwordHash = await bcrypt.hash(dto.password, 12);
+
+    const result = await this.drizzle.db.execute<{
+      id: string;
+      email: string;
+    }>(sql`
+      INSERT INTO ${sql.identifier(project.dbSchema)}.auth_users
+        (email, password_hash, provider)
+      VALUES (${dto.email}, ${passwordHash}, ${AUTH_PROVIDERS.EMAIL})
+      RETURNING id, email
+    `);
+
+    const user = result.rows[0];
+    const accessToken = this.signToken(
+      user.id,
+      user.email,
+      project.id,
+      project.authJwtSecret,
+    );
+
+    return { user: { id: user.id, email: user.email }, accessToken };
+  }
+
+  async signIn(projectSlug: string, dto: SignInInput) {
+    const project = await this.getProject(projectSlug);
+    await this.ensureAuthUsersTable(project.dbSchema);
+
+    const result = await this.drizzle.db.execute<{
+      id: string;
+      email: string;
+      password_hash: string | null;
+    }>(sql`
+      SELECT id, email, password_hash
+      FROM ${sql.identifier(project.dbSchema)}.auth_users
+      WHERE email = ${dto.email}
+    `);
+
+    const user = result.rows[0];
+
+    if (!user?.password_hash) {
+      throw new UnauthorizedException('Invalid credentials');
+    }
+
+    const match = await bcrypt.compare(dto.password, user.password_hash);
+    if (!match) throw new UnauthorizedException('Invalid credentials');
+
+    const accessToken = this.signToken(
+      user.id,
+      user.email,
+      project.id,
+      project.authJwtSecret,
+    );
+
+    return { user: { id: user.id, email: user.email }, accessToken };
+  }
+
+  async sendMagicLink(projectSlug: string, email: string) {
+    const project = await this.getProject(projectSlug);
+    await this.ensureAuthUsersTable(project.dbSchema);
+
+    const existing = await this.drizzle.db.execute<{ id: string }>(sql`
+      SELECT id FROM ${sql.identifier(project.dbSchema)}.auth_users
+      WHERE email = ${email}
+    `);
+
+    if (existing.rows.length === 0) {
+      await this.drizzle.db.execute(sql`
+        INSERT INTO ${sql.identifier(project.dbSchema)}.auth_users
+          (email, provider, email_verified)
+        VALUES (${email}, ${AUTH_PROVIDERS.EMAIL}, true)
+      `);
+    }
+
+    const linkToken = this.jwtService.sign(
+      { email, projectId: project.id },
+      { secret: project.authJwtSecret, expiresIn: MAGIC_LINK_EXPIRES_IN },
+    );
+
+    const apiUrl = this.configService.get<string>('API_URL');
+    const magicLinkUrl = `${apiUrl}/projects/${projectSlug}/auth/magic-link/verify?token=${linkToken}`;
+
+    await this.resend.emails.send({
+      from: 'Supavolt <onboarding@resend.dev>',
+      to: email,
+      subject: 'Your magic link',
+      html: `
+        <p>Click to sign in (expires in 15 minutes):</p>
+        <a href="${magicLinkUrl}">Sign in</a>
+      `,
+    });
+
+    return { message: 'Magic link sent' };
+  }
+
+  async verifyMagicLink(projectSlug: string, token: string) {
+    const project = await this.getProject(projectSlug);
+
+    let payload: { email: string; projectId: string };
+    try {
+      payload = this.jwtService.verify(token, {
+        secret: project.authJwtSecret,
+      });
+    } catch {
+      throw new BadRequestException('Invalid or expired magic link');
+    }
+
+    const result = await this.drizzle.db.execute<{ id: string; email: string }>(
+      sql`
+        SELECT id, email FROM ${sql.identifier(project.dbSchema)}.auth_users
+        WHERE email = ${payload.email}
+      `,
+    );
+
+    const user = result.rows[0];
+    if (!user) throw new NotFoundException('User not found');
+
+    const accessToken = this.signToken(
+      user.id,
+      user.email,
+      project.id,
+      project.authJwtSecret,
+    );
+
+    return { user: { id: user.id, email: user.email }, accessToken };
+  }
+
+  buildGoogleAuthUrl(clientId: string, redirectUri: string): string {
+    const params = new URLSearchParams({
+      client_id: clientId,
+      redirect_uri: redirectUri,
+      response_type: 'code',
+      scope: 'openid email profile',
+    });
+    return `https://accounts.google.com/o/oauth2/v2/auth?${params.toString()}`;
+  }
+
+  buildGithubAuthUrl(clientId: string, redirectUri: string): string {
+    const params = new URLSearchParams({
+      client_id: clientId,
+      redirect_uri: redirectUri,
+      scope: 'user:email',
+    });
+    return `https://github.com/login/oauth/authorize?${params.toString()}`;
+  }
+
+  async handleGoogleCallback(projectSlug: string, code: string) {
+    const project = await this.getProject(projectSlug);
+    await this.ensureAuthUsersTable(project.dbSchema);
+
+    if (!project.googleClientId || !project.googleClientSecret) {
+      throw new BadRequestException(
+        'Google OAuth not configured for this project',
+      );
+    }
+
+    const apiUrl = this.configService.get<string>('API_URL');
+    const redirectUri = `${apiUrl}/projects/${projectSlug}/auth/google/callback`;
+
+    const tokenRes = await fetch('https://oauth2.googleapis.com/token', {
+      method: 'POST',
+      headers: { 'Content-Type': 'application/x-www-form-urlencoded' },
+      body: new URLSearchParams({
+        code,
+        client_id: project.googleClientId,
+        client_secret: project.googleClientSecret,
+        redirect_uri: redirectUri,
+        grant_type: 'authorization_code',
+      }),
+    });
+
+    const tokenData = (await tokenRes.json()) as { access_token: string };
+
+    const profileRes = await fetch(
+      'https://www.googleapis.com/oauth2/v3/userinfo',
+      { headers: { Authorization: `Bearer ${tokenData.access_token}` } },
+    );
+
+    const profile = (await profileRes.json()) as { email: string };
+    return this.findOrCreateOAuthUser(
+      project,
+      profile.email,
+      AUTH_PROVIDERS.GOOGLE,
+    );
+  }
+
+  async handleGithubCallback(projectSlug: string, code: string) {
+    const project = await this.getProject(projectSlug);
+    await this.ensureAuthUsersTable(project.dbSchema);
+
+    if (!project.githubClientId || !project.githubClientSecret) {
+      throw new BadRequestException(
+        'GitHub OAuth not configured for this project',
+      );
+    }
+
+    const apiUrl = this.configService.get<string>('API_URL');
+    const redirectUri = `${apiUrl}/projects/${projectSlug}/auth/github/callback`;
+
+    const tokenRes = await fetch(
+      'https://github.com/login/oauth/access_token',
+      {
+        method: 'POST',
+        headers: {
+          'Content-Type': 'application/json',
+          Accept: 'application/json',
+        },
+        body: JSON.stringify({
+          client_id: project.githubClientId,
+          client_secret: project.githubClientSecret,
+          code,
+          redirect_uri: redirectUri,
+        }),
+      },
+    );
+
+    const tokenData = (await tokenRes.json()) as { access_token: string };
+
+    const profileRes = await fetch('https://api.github.com/user/emails', {
+      headers: {
+        Authorization: `Bearer ${tokenData.access_token}`,
+        Accept: 'application/vnd.github+json',
+      },
+    });
+
+    const emails = (await profileRes.json()) as Array<{
+      email: string;
+      primary: boolean;
+    }>;
+
+    const primary = emails.find((e) => e.primary) ?? emails[0];
+    if (!primary?.email) {
+      throw new BadRequestException('Could not read email from GitHub');
+    }
+
+    return this.findOrCreateOAuthUser(
+      project,
+      primary.email,
+      AUTH_PROVIDERS.GITHUB,
+    );
+  }
+
+  private async findOrCreateOAuthUser(
+    project: typeof projects.$inferSelect,
+    email: string,
+    provider: string,
+  ) {
+    const existing = await this.drizzle.db.execute<{
+      id: string;
+      email: string;
+    }>(
+      sql`
+        SELECT id, email FROM ${sql.identifier(project.dbSchema)}.auth_users
+        WHERE email = ${email}
+      `,
+    );
+
+    let user = existing.rows[0];
+
+    if (!user) {
+      const result = await this.drizzle.db.execute<{
+        id: string;
+        email: string;
+      }>(
+        sql`
+          INSERT INTO ${sql.identifier(project.dbSchema)}.auth_users
+            (email, provider, email_verified)
+          VALUES (${email}, ${provider}, true)
+          RETURNING id, email
+        `,
+      );
+      user = result.rows[0];
+    }
+
+    const accessToken = this.signToken(
+      user.id,
+      user.email,
+      project.id,
+      project.authJwtSecret,
+    );
+
+    return { user: { id: user.id, email: user.email }, accessToken };
+  }
+
+  async getUsers(projectSlug: string) {
+    const project = await this.getProject(projectSlug);
+    await this.ensureAuthUsersTable(project.dbSchema);
+
+    const result = await this.drizzle.db.execute<{
+      id: string;
+      email: string;
+      email_verified: boolean;
+      provider: string;
+      created_at: string;
+    }>(sql`
+      SELECT id, email, email_verified, provider, created_at
+      FROM ${sql.identifier(project.dbSchema)}.auth_users
+      ORDER BY created_at DESC
+    `);
+
+    return result.rows.map((row) => ({
+      id: row.id,
+      email: row.email,
+      emailVerified: row.email_verified,
+      provider: row.provider,
+      createdAt: row.created_at,
+    }));
+  }
+
+  async getOAuthSettings(projectSlug: string) {
+    const project = await this.getProject(projectSlug);
+    return {
+      siteUrl: project.siteUrl,
+      googleClientId: project.googleClientId,
+      googleClientSecret: project.googleClientSecret,
+      githubClientId: project.githubClientId,
+      githubClientSecret: project.githubClientSecret,
+    };
+  }
+
+  resolveSiteUrl(project: typeof projects.$inferSelect): string {
+    return (
+      project.siteUrl ??
+      this.configService.get<string>('WEB_URL') ??
+      'http://localhost:3001'
+    );
+  }
+
+  async getSiteUrlForProject(projectSlug: string): Promise<string> {
+    const project = await this.getProject(projectSlug);
+    return this.resolveSiteUrl(project);
+  }
+
+  async updateOAuthSettings(
+    projectSlug: string,
+    settings: {
+      siteUrl?: string;
+      googleClientId?: string;
+      googleClientSecret?: string;
+      githubClientId?: string;
+      githubClientSecret?: string;
+    },
+  ) {
+    const project = await this.getProject(projectSlug);
+
+    const [updated] = await this.drizzle.db
+      .update(projects)
+      .set(settings)
+      .where(eq(projects.id, project.id))
+      .returning();
+
+    return updated;
+  }
+}

package/apps/api/src/projects/dto/create-project.dto.ts

@@ -0,0 +1,9 @@
+import { IsString, MinLength, MaxLength } from 'class-validator';
+import type { CreateProjectInput } from '@apiDatabase/types';
+
+export class CreateProjectDto implements CreateProjectInput {
+  @IsString()
+  @MinLength(2)
+  @MaxLength(50)
+  name!: string;
+}

package/apps/api/src/projects/projects.controller.ts

@@ -0,0 +1,34 @@
+import { Body, Controller, Get, Param, Post, UseGuards } from '@nestjs/common';
+import { ProjectsService } from './projects.service';
+import { CreateProjectDto } from './dto/create-project.dto';
+import { JwtAuthGuard } from '../auth/guards/jwt-auth-guard';
+import { OrgRoleGuard } from '../auth/guards/org-role.guards';
+import { RequireOrgRole } from '../auth/decorators/require-org-role-decorator';
+import { CurrentUser } from '../auth/decorators/current-user-decorator';
+import type { JwtPayload } from '@apiDatabase/types';
+
+@Controller('orgs/:slug/projects')
+@UseGuards(JwtAuthGuard, OrgRoleGuard)
+export class ProjectsController {
+  constructor(private projectsService: ProjectsService) {}
+
+  @Get()
+  getProjects(@Param('slug') slug: string, @CurrentUser() user: JwtPayload) {
+    return this.projectsService.getProjectsForOrg(slug, user.sub);
+  }
+
+  @Get(':projectSlug')
+  getProject(
+    @Param('slug') slug: string,
+    @Param('projectSlug') projectSlug: string,
+    @CurrentUser() user: JwtPayload,
+  ) {
+    return this.projectsService.getProjectBySlug(slug, projectSlug, user.sub);
+  }
+
+  @Post()
+  @RequireOrgRole('admin')
+  createProject(@Param('slug') slug: string, @Body() dto: CreateProjectDto) {
+    return this.projectsService.createProject(slug, dto);
+  }
+}

package/apps/api/src/projects/projects.module.ts

@@ -0,0 +1,12 @@
+import { Module } from '@nestjs/common';
+import { JwtModule } from '@nestjs/jwt';
+import { ProjectsService } from './projects.service';
+import { ProjectsController } from './projects.controller';
+
+@Module({
+  imports: [JwtModule.register({})],
+  providers: [ProjectsService],
+  controllers: [ProjectsController],
+  exports: [ProjectsService],
+})
+export class ProjectsModule {}