Initial commit: Full project structure
- Backend: NestJS with Docker - Frontend: Next.js with Docker - Nginx configuration for reverse proxy - PostgreSQL setup - Docker compose for orchestration - Development environment configuration
This commit is contained in:
177
backend/src/modules/auth/auth.controller.ts
Normal file
177
backend/src/modules/auth/auth.controller.ts
Normal file
@@ -0,0 +1,177 @@
|
||||
// backend/src/modules/auth/auth.controller.ts
|
||||
|
||||
import {
|
||||
Controller,
|
||||
Post,
|
||||
Body,
|
||||
UseGuards,
|
||||
Req,
|
||||
Res,
|
||||
HttpCode,
|
||||
HttpStatus,
|
||||
Get
|
||||
} from '@nestjs/common';
|
||||
import type { Response } from 'express';
|
||||
import {
|
||||
ApiTags,
|
||||
ApiOperation,
|
||||
ApiResponse,
|
||||
ApiBearerAuth,
|
||||
ApiBody,
|
||||
ApiUnauthorizedResponse,
|
||||
ApiBadRequestResponse
|
||||
} from '@nestjs/swagger';
|
||||
|
||||
import { AuthService } from './auth.service';
|
||||
import { LoginDto } from './dto/login.dto';
|
||||
import { RegisterDto } from './dto/register.dto';
|
||||
import { JwtAuthGuard } from './guards/jwt-auth.guard';
|
||||
import { LocalAuthGuard } from './guards/local-auth.guard';
|
||||
|
||||
@ApiTags('auth')
|
||||
@Controller('auth')
|
||||
export class AuthController {
|
||||
constructor(private readonly authService: AuthService) {}
|
||||
|
||||
// =========================
|
||||
// LOGIN
|
||||
// =========================
|
||||
@Post('login')
|
||||
@HttpCode(HttpStatus.OK)
|
||||
@UseGuards(LocalAuthGuard)
|
||||
@ApiOperation({ summary: 'Login with email and password' })
|
||||
@ApiBody({ type: LoginDto })
|
||||
@ApiResponse({ status: 200, description: 'Login successful' })
|
||||
@ApiUnauthorizedResponse({ description: 'Invalid credentials' })
|
||||
@ApiBadRequestResponse({ description: 'Invalid input data' })
|
||||
async login(
|
||||
@Body() loginDto: LoginDto,
|
||||
@Req() req,
|
||||
@Res({ passthrough: true }) res: Response
|
||||
) {
|
||||
console.log('Login endpoint hit');
|
||||
|
||||
const result = await this.authService.login(loginDto, req.user);
|
||||
|
||||
// ✅ SET COOKIES HERE
|
||||
this.setAuthCookies(res, result.data.accessToken, result.data.refreshToken);
|
||||
|
||||
return {
|
||||
success: true,
|
||||
data: {
|
||||
user: result.data.user,
|
||||
organizations: result.data.organizations,
|
||||
},
|
||||
};
|
||||
}
|
||||
|
||||
// =========================
|
||||
// REGISTER
|
||||
// =========================
|
||||
@Post('register')
|
||||
@ApiOperation({ summary: 'Register a new user' })
|
||||
@ApiBody({ type: RegisterDto })
|
||||
@ApiResponse({ status: 201, description: 'User registered successfully' })
|
||||
@ApiBadRequestResponse({ description: 'Invalid input data' })
|
||||
async register(
|
||||
@Body() registerDto: RegisterDto,
|
||||
@Res({ passthrough: true }) res: Response
|
||||
) {
|
||||
console.log('Register endpoint hit');
|
||||
|
||||
const result = await this.authService.register(registerDto);
|
||||
|
||||
// ✅ SET COOKIES HERE
|
||||
this.setAuthCookies(res, result.data.accessToken, result.data.refreshToken);
|
||||
|
||||
return {
|
||||
success: true,
|
||||
data: {
|
||||
user: result.data.user,
|
||||
organizations: result.data.organizations,
|
||||
},
|
||||
};
|
||||
}
|
||||
|
||||
// =========================
|
||||
// SELECT ORGANIZATION
|
||||
// =========================
|
||||
@Post('select-organization')
|
||||
@UseGuards(JwtAuthGuard)
|
||||
@ApiBearerAuth('JWT-auth')
|
||||
async selectOrganization(
|
||||
@Req() req,
|
||||
@Body('organizationId') organizationId: string,
|
||||
@Res({ passthrough: true }) res: Response
|
||||
) {
|
||||
const result = await this.authService.selectOrganization(
|
||||
req.user.id,
|
||||
organizationId
|
||||
);
|
||||
|
||||
// 🔥 Replace access token with org-scoped token
|
||||
this.setAccessToken(res, result.data.accessToken);
|
||||
|
||||
return {
|
||||
success: true,
|
||||
data: {
|
||||
organization: result.data.organization,
|
||||
},
|
||||
};
|
||||
}
|
||||
|
||||
// =========================
|
||||
// PROFILE
|
||||
// =========================
|
||||
@Get('profile')
|
||||
@UseGuards(JwtAuthGuard)
|
||||
@ApiBearerAuth('JWT-auth')
|
||||
@ApiOperation({ summary: 'Get user profile' })
|
||||
@ApiResponse({ status: 200, description: 'Profile retrieved successfully' })
|
||||
@ApiUnauthorizedResponse({ description: 'Invalid or missing JWT token' })
|
||||
async getProfile(@Req() req) {
|
||||
console.log('Profile endpoint hit');
|
||||
console.log('USER FROM JWT:', req.user);
|
||||
|
||||
return this.authService.getProfile(req.user.id);
|
||||
}
|
||||
|
||||
// =========================
|
||||
// TEST
|
||||
// =========================
|
||||
@Get('test')
|
||||
@ApiOperation({ summary: 'Test endpoint' })
|
||||
test() {
|
||||
return { message: 'Auth controller is working!' };
|
||||
}
|
||||
|
||||
// =========================
|
||||
// 🔥 COOKIE HELPERS
|
||||
// =========================
|
||||
private setAuthCookies(
|
||||
res: Response,
|
||||
accessToken: string,
|
||||
refreshToken: string
|
||||
) {
|
||||
this.setAccessToken(res, accessToken);
|
||||
this.setRefreshToken(res, refreshToken);
|
||||
}
|
||||
|
||||
private setAccessToken(res: Response, token: string) {
|
||||
res.cookie('accessToken', token, {
|
||||
httpOnly: true,
|
||||
secure: false, // ⚠️ true in production (HTTPS)
|
||||
sameSite: 'lax',
|
||||
path: '/',
|
||||
});
|
||||
}
|
||||
|
||||
private setRefreshToken(res: Response, token: string) {
|
||||
res.cookie('refreshToken', token, {
|
||||
httpOnly: true,
|
||||
secure: false,
|
||||
sameSite: 'lax',
|
||||
path: '/',
|
||||
});
|
||||
}
|
||||
}
|
||||
33
backend/src/modules/auth/auth.module.ts
Normal file
33
backend/src/modules/auth/auth.module.ts
Normal file
@@ -0,0 +1,33 @@
|
||||
// backend/src/modules/auth/auth.module.ts
|
||||
import { Module } from '@nestjs/common';
|
||||
import { JwtModule } from '@nestjs/jwt';
|
||||
import { PassportModule } from '@nestjs/passport';
|
||||
import { ConfigModule, ConfigService } from '@nestjs/config';
|
||||
import { AuthService } from './auth.service';
|
||||
import { AuthController } from './auth.controller';
|
||||
import { PrismaService } from '../../../prisma/prisma.service';
|
||||
import { LocalStrategy } from './strategies/local.strategy';
|
||||
import { JwtStrategy } from './strategies/jwt.strategy';
|
||||
|
||||
@Module({
|
||||
imports: [
|
||||
PassportModule,
|
||||
JwtModule.registerAsync({
|
||||
imports: [ConfigModule],
|
||||
useFactory: async (configService: ConfigService) => ({
|
||||
secret: configService.get('jwt.secret'),
|
||||
signOptions: { expiresIn: configService.get('jwt.expiresIn') },
|
||||
}),
|
||||
inject: [ConfigService],
|
||||
}),
|
||||
],
|
||||
controllers: [AuthController], // THIS MUST BE HERE
|
||||
providers: [
|
||||
AuthService,
|
||||
PrismaService,
|
||||
LocalStrategy,
|
||||
JwtStrategy,
|
||||
],
|
||||
exports: [AuthService],
|
||||
})
|
||||
export class AuthModule {}
|
||||
668
backend/src/modules/auth/auth.service.ts
Normal file
668
backend/src/modules/auth/auth.service.ts
Normal file
@@ -0,0 +1,668 @@
|
||||
// backend/src/modules/auth/auth.service.ts
|
||||
import {
|
||||
Injectable,
|
||||
UnauthorizedException,
|
||||
BadRequestException,
|
||||
ConflictException,
|
||||
InternalServerErrorException
|
||||
} from '@nestjs/common';
|
||||
import { JwtService } from '@nestjs/jwt';
|
||||
import { ConfigService } from '@nestjs/config';
|
||||
import * as bcrypt from 'bcrypt';
|
||||
import { PrismaService } from '../../../prisma/prisma.service';
|
||||
import { LoginDto } from './dto/login.dto';
|
||||
import { RegisterDto } from './dto/register.dto';
|
||||
import { JwtPayload } from './interfaces/jwt-payload.interface';
|
||||
|
||||
const ALL_PERMISSIONS = [
|
||||
'VIEW_PATIENTS',
|
||||
'CREATE_PATIENTS',
|
||||
'EDIT_PATIENTS',
|
||||
'DELETE_PATIENTS',
|
||||
'VIEW_ORDERS',
|
||||
'CREATE_ORDERS',
|
||||
'EDIT_ORDERS',
|
||||
'DELETE_ORDERS',
|
||||
'TRACK_ORDERS',
|
||||
'VIEW_CASES',
|
||||
'CREATE_CASES',
|
||||
'EDIT_CASES',
|
||||
'DELETE_CASES',
|
||||
'VIEW_REPORTS',
|
||||
'EXPORT_REPORTS',
|
||||
'INVITE_USERS',
|
||||
'REMOVE_USERS',
|
||||
'MANAGE_PERMISSIONS',
|
||||
'VIEW_INVOICES',
|
||||
'CREATE_INVOICES',
|
||||
'MANAGE_PAYMENTS',
|
||||
];
|
||||
|
||||
@Injectable()
|
||||
export class AuthService {
|
||||
constructor(
|
||||
private prisma: PrismaService,
|
||||
private jwtService: JwtService,
|
||||
private configService: ConfigService,
|
||||
) { }
|
||||
|
||||
/**
|
||||
* Validate user credentials (used by LocalStrategy)
|
||||
* @param email - User's email
|
||||
* @param password - User's password
|
||||
* @returns User object without passwordHash or null if invalid
|
||||
*/
|
||||
async validateUser(email: string, password: string): Promise<any> {
|
||||
try {
|
||||
const user = await this.prisma.user.findUnique({
|
||||
where: { email },
|
||||
include: {
|
||||
memberships: {
|
||||
include: {
|
||||
organization: {
|
||||
include: {
|
||||
type: true, // Include organization type (CLINIC/LAB)
|
||||
}
|
||||
},
|
||||
permissions: {
|
||||
include: {
|
||||
permission: true, // Include permission details
|
||||
},
|
||||
},
|
||||
},
|
||||
},
|
||||
},
|
||||
});
|
||||
|
||||
if (!user) {
|
||||
return null;
|
||||
}
|
||||
|
||||
// Check if user has a password (might be OAuth only, but we're not using OAuth)
|
||||
if (!user.passwordHash) {
|
||||
return null;
|
||||
}
|
||||
|
||||
const isPasswordValid = await bcrypt.compare(password, user.passwordHash);
|
||||
if (!isPasswordValid) {
|
||||
return null;
|
||||
}
|
||||
|
||||
// Remove sensitive data
|
||||
const { passwordHash, ...result } = user;
|
||||
return result;
|
||||
} catch (error) {
|
||||
throw new InternalServerErrorException('Error validating user');
|
||||
}
|
||||
}
|
||||
|
||||
/**
|
||||
* Login user and generate tokens
|
||||
* @param loginDto - Login credentials (email, password)
|
||||
* @param user - Validated user object from LocalStrategy
|
||||
* @returns Access token, refresh token, user info, and organizations
|
||||
*/
|
||||
async login(loginDto: LoginDto, user: any) {
|
||||
try {
|
||||
// Generate access token (short-lived)
|
||||
const accessPayload: JwtPayload = {
|
||||
sub: user.id,
|
||||
email: user.email,
|
||||
type: 'access'
|
||||
};
|
||||
|
||||
// Generate refresh token (long-lived)
|
||||
const refreshPayload: JwtPayload = {
|
||||
sub: user.id,
|
||||
email: user.email,
|
||||
type: 'refresh'
|
||||
};
|
||||
|
||||
const [accessToken, refreshToken] = await Promise.all([
|
||||
this.jwtService.signAsync(accessPayload, {
|
||||
secret: this.configService.get('JWT_SECRET'),
|
||||
expiresIn: this.configService.get('JWT_EXPIRES_IN'),
|
||||
}),
|
||||
this.jwtService.signAsync(refreshPayload, {
|
||||
secret: this.configService.get('JWT_REFRESH_SECRET'),
|
||||
expiresIn: this.configService.get('JWT_REFRESH_EXPIRES_IN'),
|
||||
}),
|
||||
]);
|
||||
|
||||
// Store session in database
|
||||
await this.prisma.session.create({
|
||||
data: {
|
||||
userId: user.id,
|
||||
token: accessToken,
|
||||
refreshToken: refreshToken,
|
||||
expiresAt: new Date(Date.now() + 30 * 24 * 60 * 60 * 1000), // 30 days
|
||||
},
|
||||
});
|
||||
|
||||
// Transform memberships to include organization info and permissions
|
||||
const organizations = user.memberships?.map(membership => ({
|
||||
id: membership.organization.id,
|
||||
name: membership.organization.name,
|
||||
type: membership.organization.type.name, // 'CLINIC' or 'LAB'
|
||||
isOwner: membership.isOwner,
|
||||
permissions: membership.isOwner
|
||||
? ALL_PERMISSIONS
|
||||
: membership.permissions?.map(p => p.permission.name) || [],
|
||||
})) || [];
|
||||
|
||||
return {
|
||||
success: true,
|
||||
data: {
|
||||
accessToken,
|
||||
refreshToken,
|
||||
user: {
|
||||
id: user.id,
|
||||
email: user.email,
|
||||
name: user.name,
|
||||
},
|
||||
organizations,
|
||||
},
|
||||
};
|
||||
} catch (error) {
|
||||
//throw new InternalServerErrorException('Login failed');
|
||||
console.error('🔥 LOGIN ERROR FULL:', error);
|
||||
throw error;
|
||||
}
|
||||
}
|
||||
|
||||
/**
|
||||
* Register a new user
|
||||
* @param registerDto - Registration data (email, password, name)
|
||||
* @returns Created user info without password
|
||||
*/
|
||||
async register(registerDto: RegisterDto) {
|
||||
const { email, password, name, organizationName, organizationType } = registerDto;
|
||||
|
||||
// 1. Check existing user
|
||||
const existingUser = await this.prisma.user.findUnique({
|
||||
where: { email },
|
||||
});
|
||||
|
||||
if (existingUser) {
|
||||
throw new ConflictException('User already exists');
|
||||
}
|
||||
|
||||
// 2. Hash password
|
||||
const hashedPassword = await bcrypt.hash(password, 10);
|
||||
|
||||
// 3. Transaction (IMPORTANT)
|
||||
const result = await this.prisma.$transaction(async (tx) => {
|
||||
// Create user
|
||||
const user = await tx.user.create({
|
||||
data: {
|
||||
email,
|
||||
passwordHash: hashedPassword,
|
||||
name,
|
||||
},
|
||||
});
|
||||
|
||||
// Create organization
|
||||
const organization = await tx.organization.create({
|
||||
data: {
|
||||
name: registerDto.organizationName,
|
||||
|
||||
// REQUIRED FIELDS 👇
|
||||
email: registerDto.email, // or separate org email if you have one
|
||||
|
||||
owner: {
|
||||
connect: { id: user.id },
|
||||
},
|
||||
|
||||
plan: {
|
||||
connect: { name: 'trial' }, // make sure this exists in DB
|
||||
},
|
||||
|
||||
type: {
|
||||
connect: {
|
||||
name: registerDto.organizationType, // 'CLINIC' | 'LAB'
|
||||
},
|
||||
},
|
||||
},
|
||||
});
|
||||
|
||||
// Create membership (owner)
|
||||
await tx.membership.create({
|
||||
data: {
|
||||
userId: user.id,
|
||||
organizationId: organization.id,
|
||||
isOwner: true,
|
||||
},
|
||||
});
|
||||
|
||||
return { user, organization };
|
||||
});
|
||||
|
||||
// 4. Generate tokens (reuse login logic)
|
||||
const validatedUser = await this.validateUser(email, password);
|
||||
|
||||
if (!validatedUser) {
|
||||
throw new UnauthorizedException('Auto-login failed');
|
||||
}
|
||||
|
||||
return this.login({ email, password } as any, validatedUser);
|
||||
}
|
||||
|
||||
/**
|
||||
* Get user profile with all memberships and permissions
|
||||
* @param userId - User ID from JWT token
|
||||
* @returns User profile with organizations and permissions
|
||||
*/
|
||||
async getProfile(userId: string) {
|
||||
try {
|
||||
const user = await this.prisma.user.findUnique({
|
||||
where: { id: userId },
|
||||
include: {
|
||||
memberships: {
|
||||
include: {
|
||||
organization: {
|
||||
include: {
|
||||
type: true,
|
||||
},
|
||||
},
|
||||
permissions: {
|
||||
include: {
|
||||
permission: true,
|
||||
},
|
||||
},
|
||||
},
|
||||
},
|
||||
},
|
||||
});
|
||||
|
||||
if (!user) {
|
||||
throw new UnauthorizedException('User not found');
|
||||
}
|
||||
|
||||
const { passwordHash, ...result } = user;
|
||||
|
||||
// Transform memberships for frontend consumption
|
||||
const organizations = user.memberships?.map(membership => ({
|
||||
id: membership.organization.id,
|
||||
name: membership.organization.name,
|
||||
type: membership.organization.type.name,
|
||||
isOwner: membership.isOwner,
|
||||
permissions: membership.permissions?.map(p => p.permission.name) || [],
|
||||
})) || [];
|
||||
|
||||
return {
|
||||
success: true,
|
||||
data: {
|
||||
...result,
|
||||
organizations,
|
||||
},
|
||||
};
|
||||
} catch (error) {
|
||||
throw new InternalServerErrorException('Failed to get profile');
|
||||
}
|
||||
}
|
||||
|
||||
/**
|
||||
* Logout user by invalidating their session
|
||||
* @param token - Access token to invalidate
|
||||
* @returns Success message
|
||||
*/
|
||||
async logout(token: string) {
|
||||
try {
|
||||
await this.prisma.session.deleteMany({
|
||||
where: { token },
|
||||
});
|
||||
|
||||
return {
|
||||
success: true,
|
||||
message: 'Logged out successfully',
|
||||
};
|
||||
} catch (error) {
|
||||
throw new InternalServerErrorException('Logout failed');
|
||||
}
|
||||
}
|
||||
|
||||
/**
|
||||
* Refresh access token using refresh token
|
||||
* @param refreshToken - Valid refresh token
|
||||
* @returns New access token
|
||||
*/
|
||||
async refreshToken(refreshToken: string) {
|
||||
try {
|
||||
// Verify the refresh token
|
||||
const payload = await this.jwtService.verifyAsync(refreshToken, {
|
||||
secret: this.configService.get('jwt.refreshSecret'),
|
||||
});
|
||||
|
||||
// Ensure this is a refresh token
|
||||
if (payload.type !== 'refresh') {
|
||||
throw new UnauthorizedException('Invalid token type');
|
||||
}
|
||||
|
||||
// Find session with this refresh token
|
||||
const session = await this.prisma.session.findFirst({
|
||||
where: {
|
||||
refreshToken,
|
||||
expiresAt: { gt: new Date() }
|
||||
},
|
||||
include: {
|
||||
user: {
|
||||
include: {
|
||||
memberships: {
|
||||
include: {
|
||||
organization: {
|
||||
include: {
|
||||
type: true,
|
||||
},
|
||||
},
|
||||
permissions: {
|
||||
include: {
|
||||
permission: true,
|
||||
},
|
||||
},
|
||||
},
|
||||
},
|
||||
},
|
||||
},
|
||||
},
|
||||
});
|
||||
|
||||
if (!session) {
|
||||
throw new UnauthorizedException('Invalid refresh token');
|
||||
}
|
||||
|
||||
// Generate new access token
|
||||
const newAccessPayload: JwtPayload = {
|
||||
sub: session.user.id,
|
||||
email: session.user.email,
|
||||
type: 'access',
|
||||
};
|
||||
|
||||
const newAccessToken = await this.jwtService.signAsync(newAccessPayload, {
|
||||
secret: this.configService.get('jwt.secret'),
|
||||
expiresIn: this.configService.get('jwt.expiresIn'),
|
||||
});
|
||||
|
||||
// Update session with new access token
|
||||
await this.prisma.session.update({
|
||||
where: { id: session.id },
|
||||
data: {
|
||||
token: newAccessToken,
|
||||
expiresAt: new Date(Date.now() + 7 * 24 * 60 * 60 * 1000), // 7 days
|
||||
},
|
||||
});
|
||||
|
||||
// Transform memberships for response
|
||||
const organizations = session.user.memberships?.map(membership => ({
|
||||
id: membership.organization.id,
|
||||
name: membership.organization.name,
|
||||
type: membership.organization.type.name,
|
||||
isOwner: membership.isOwner,
|
||||
permissions: membership.permissions?.map(p => p.permission.name) || [],
|
||||
})) || [];
|
||||
|
||||
return {
|
||||
success: true,
|
||||
data: {
|
||||
accessToken: newAccessToken,
|
||||
user: {
|
||||
id: session.user.id,
|
||||
email: session.user.email,
|
||||
name: session.user.name,
|
||||
},
|
||||
organizations,
|
||||
},
|
||||
};
|
||||
} catch (error) {
|
||||
if (error.name === 'JsonWebTokenError' || error.name === 'TokenExpiredError') {
|
||||
throw new UnauthorizedException('Invalid or expired refresh token');
|
||||
}
|
||||
throw new UnauthorizedException('Refresh token failed');
|
||||
}
|
||||
}
|
||||
|
||||
/**
|
||||
* Change user password
|
||||
* @param userId - User ID
|
||||
* @param oldPassword - Current password
|
||||
* @param newPassword - New password
|
||||
* @returns Success message
|
||||
*/
|
||||
async changePassword(userId: string, oldPassword: string, newPassword: string) {
|
||||
try {
|
||||
const user = await this.prisma.user.findUnique({
|
||||
where: { id: userId },
|
||||
});
|
||||
|
||||
if (!user || !user.passwordHash) {
|
||||
throw new BadRequestException('User not found or invalid password method');
|
||||
}
|
||||
|
||||
// Verify old password
|
||||
const isPasswordValid = await bcrypt.compare(oldPassword, user.passwordHash);
|
||||
if (!isPasswordValid) {
|
||||
throw new UnauthorizedException('Current password is incorrect');
|
||||
}
|
||||
|
||||
// Hash new password
|
||||
const hashedPassword = await bcrypt.hash(newPassword, 10);
|
||||
|
||||
// Update password
|
||||
await this.prisma.user.update({
|
||||
where: { id: userId },
|
||||
data: { passwordHash: hashedPassword },
|
||||
});
|
||||
|
||||
// Invalidate all sessions for this user (force re-login)
|
||||
await this.prisma.session.deleteMany({
|
||||
where: { userId },
|
||||
});
|
||||
|
||||
return {
|
||||
success: true,
|
||||
message: 'Password changed successfully. Please login again.',
|
||||
};
|
||||
} catch (error) {
|
||||
if (error instanceof UnauthorizedException || error instanceof BadRequestException) {
|
||||
throw error;
|
||||
}
|
||||
throw new InternalServerErrorException('Failed to change password');
|
||||
}
|
||||
}
|
||||
|
||||
/**
|
||||
* Get all active sessions for a user
|
||||
* @param userId - User ID
|
||||
* @returns List of active sessions
|
||||
*/
|
||||
async getUserSessions(userId: string) {
|
||||
try {
|
||||
const sessions = await this.prisma.session.findMany({
|
||||
where: {
|
||||
userId,
|
||||
expiresAt: { gt: new Date() },
|
||||
},
|
||||
orderBy: { createdAt: 'desc' },
|
||||
});
|
||||
|
||||
return {
|
||||
success: true,
|
||||
data: sessions,
|
||||
};
|
||||
} catch (error) {
|
||||
throw new InternalServerErrorException('Failed to get sessions');
|
||||
}
|
||||
}
|
||||
|
||||
/**
|
||||
* Revoke a specific session
|
||||
* @param userId - User ID
|
||||
* @param sessionId - Session ID to revoke
|
||||
* @returns Success message
|
||||
*/
|
||||
async revokeSession(userId: string, sessionId: string) {
|
||||
try {
|
||||
await this.prisma.session.delete({
|
||||
where: {
|
||||
id: sessionId,
|
||||
userId, // Ensure session belongs to user
|
||||
},
|
||||
});
|
||||
|
||||
return {
|
||||
success: true,
|
||||
message: 'Session revoked successfully',
|
||||
};
|
||||
} catch (error) {
|
||||
throw new InternalServerErrorException('Failed to revoke session');
|
||||
}
|
||||
}
|
||||
|
||||
/**
|
||||
* Revoke all sessions for a user (except current)
|
||||
* @param userId - User ID
|
||||
* @param currentToken - Current access token to keep
|
||||
* @returns Success message
|
||||
*/
|
||||
async revokeAllSessions(userId: string, currentToken: string) {
|
||||
try {
|
||||
await this.prisma.session.deleteMany({
|
||||
where: {
|
||||
userId,
|
||||
token: { not: currentToken }, // Keep current session
|
||||
},
|
||||
});
|
||||
|
||||
return {
|
||||
success: true,
|
||||
message: 'All other sessions revoked successfully',
|
||||
};
|
||||
} catch (error) {
|
||||
throw new InternalServerErrorException('Failed to revoke sessions');
|
||||
}
|
||||
}
|
||||
|
||||
/**
|
||||
* Validate token and return user
|
||||
* @param token - JWT token
|
||||
* @returns User info if token is valid
|
||||
*/
|
||||
async validateToken(token: string) {
|
||||
try {
|
||||
const payload = await this.jwtService.verifyAsync(token, {
|
||||
secret: this.configService.get('jwt.secret'),
|
||||
});
|
||||
|
||||
if (payload.type !== 'access') {
|
||||
throw new UnauthorizedException('Invalid token type');
|
||||
}
|
||||
|
||||
const session = await this.prisma.session.findFirst({
|
||||
where: {
|
||||
token,
|
||||
expiresAt: { gt: new Date() }
|
||||
},
|
||||
include: {
|
||||
user: {
|
||||
include: {
|
||||
memberships: {
|
||||
include: {
|
||||
organization: {
|
||||
include: {
|
||||
type: true,
|
||||
},
|
||||
},
|
||||
permissions: {
|
||||
include: {
|
||||
permission: true,
|
||||
},
|
||||
},
|
||||
},
|
||||
},
|
||||
},
|
||||
},
|
||||
},
|
||||
});
|
||||
|
||||
if (!session) {
|
||||
throw new UnauthorizedException('Session not found or expired');
|
||||
}
|
||||
|
||||
const { passwordHash, ...user } = session.user;
|
||||
|
||||
const organizations = session.user.memberships?.map(membership => ({
|
||||
id: membership.organization.id,
|
||||
name: membership.organization.name,
|
||||
type: membership.organization.type.name,
|
||||
isOwner: membership.isOwner,
|
||||
permissions: membership.permissions?.map(p => p.permission.name) || [],
|
||||
})) || [];
|
||||
|
||||
return {
|
||||
success: true,
|
||||
data: {
|
||||
user,
|
||||
organizations,
|
||||
},
|
||||
};
|
||||
} catch (error) {
|
||||
throw new UnauthorizedException('Invalid token');
|
||||
}
|
||||
}
|
||||
|
||||
async selectOrganization(userId: string, organizationId: string) {
|
||||
// 1. Verify membership
|
||||
const membership = await this.prisma.membership.findFirst({
|
||||
where: {
|
||||
userId,
|
||||
organizationId,
|
||||
},
|
||||
include: {
|
||||
organization: {
|
||||
include: {
|
||||
type: true,
|
||||
plan: true,
|
||||
},
|
||||
},
|
||||
permissions: {
|
||||
include: {
|
||||
permission: true,
|
||||
},
|
||||
},
|
||||
},
|
||||
});
|
||||
|
||||
if (!membership) {
|
||||
throw new UnauthorizedException('Access denied to this organization');
|
||||
}
|
||||
|
||||
// 2. Build payload WITH org context
|
||||
const payload = {
|
||||
sub: userId,
|
||||
email: membership.organization.email,
|
||||
organizationId: membership.organizationId,
|
||||
type: 'access',
|
||||
};
|
||||
|
||||
// 3. Generate new token
|
||||
const accessToken = await this.jwtService.signAsync(payload, {
|
||||
secret: this.configService.get('JWT_SECRET'),
|
||||
expiresIn: this.configService.get('JWT_EXPIRES_IN'),
|
||||
});
|
||||
|
||||
// 4. Format permissions
|
||||
const permissions = membership.permissions.map(p => p.permission.name);
|
||||
|
||||
return {
|
||||
success: true,
|
||||
data: {
|
||||
accessToken,
|
||||
organization: {
|
||||
id: membership.organization.id,
|
||||
name: membership.organization.name,
|
||||
type: membership.organization.type.name,
|
||||
},
|
||||
permissions,
|
||||
},
|
||||
};
|
||||
}
|
||||
}
|
||||
23
backend/src/modules/auth/dto/login.dto.ts
Normal file
23
backend/src/modules/auth/dto/login.dto.ts
Normal file
@@ -0,0 +1,23 @@
|
||||
// backend/src/modules/auth/dto/login.dto.ts
|
||||
import { IsEmail, IsString, MinLength } from 'class-validator';
|
||||
import { ApiProperty } from '@nestjs/swagger';
|
||||
|
||||
export class LoginDto {
|
||||
@ApiProperty({
|
||||
description: 'User email address',
|
||||
example: 'user@example.com',
|
||||
required: true,
|
||||
})
|
||||
@IsEmail({}, { message: 'Please provide a valid email address' })
|
||||
email: string;
|
||||
|
||||
@ApiProperty({
|
||||
description: 'User password (min 6 characters)',
|
||||
example: 'password123',
|
||||
required: true,
|
||||
minLength: 6,
|
||||
})
|
||||
@IsString()
|
||||
@MinLength(6, { message: 'Password must be at least 6 characters long' })
|
||||
password: string;
|
||||
}
|
||||
6
backend/src/modules/auth/dto/oauth.dto.ts
Normal file
6
backend/src/modules/auth/dto/oauth.dto.ts
Normal file
@@ -0,0 +1,6 @@
|
||||
export class OAuthUserDto {
|
||||
email: string;
|
||||
name: string;
|
||||
googleId?: string;
|
||||
facebookId?: string;
|
||||
}
|
||||
19
backend/src/modules/auth/dto/register.dto.ts
Normal file
19
backend/src/modules/auth/dto/register.dto.ts
Normal file
@@ -0,0 +1,19 @@
|
||||
import { IsEmail, IsString, MinLength, IsEnum } from 'class-validator';
|
||||
|
||||
export class RegisterDto {
|
||||
@IsEmail()
|
||||
email: string;
|
||||
|
||||
@IsString()
|
||||
@MinLength(8)
|
||||
password: string;
|
||||
|
||||
@IsString()
|
||||
name: string;
|
||||
|
||||
@IsString()
|
||||
organizationName: string;
|
||||
|
||||
@IsEnum(['CLINIC', 'LAB'])
|
||||
organizationType: 'CLINIC' | 'LAB';
|
||||
}
|
||||
10
backend/src/modules/auth/guards/jwt-auth.guard.ts
Normal file
10
backend/src/modules/auth/guards/jwt-auth.guard.ts
Normal file
@@ -0,0 +1,10 @@
|
||||
// backend/src/modules/auth/guards/jwt-auth.guard.ts
|
||||
import { Injectable } from '@nestjs/common';
|
||||
import { AuthGuard } from '@nestjs/passport';
|
||||
|
||||
/**
|
||||
* JwtAuthGuard triggers the JWT passport strategy
|
||||
* It validates the JWT token from the Authorization header
|
||||
*/
|
||||
@Injectable()
|
||||
export class JwtAuthGuard extends AuthGuard('jwt') {}
|
||||
10
backend/src/modules/auth/guards/local-auth.guard.ts
Normal file
10
backend/src/modules/auth/guards/local-auth.guard.ts
Normal file
@@ -0,0 +1,10 @@
|
||||
// backend/src/modules/auth/guards/local-auth.guard.ts
|
||||
import { Injectable } from '@nestjs/common';
|
||||
import { AuthGuard } from '@nestjs/passport';
|
||||
|
||||
/**
|
||||
* LocalAuthGuard triggers the local passport strategy
|
||||
* It validates user credentials (email/password) before login
|
||||
*/
|
||||
@Injectable()
|
||||
export class LocalAuthGuard extends AuthGuard('local') {}
|
||||
@@ -0,0 +1,7 @@
|
||||
// backend/src/modules/auth/interfaces/jwt-payload.interface.ts
|
||||
export interface JwtPayload {
|
||||
sub: string; // user id
|
||||
email: string;
|
||||
type?: 'access' | 'refresh';
|
||||
}
|
||||
|
||||
36
backend/src/modules/auth/strategies/jwt.strategy.ts
Normal file
36
backend/src/modules/auth/strategies/jwt.strategy.ts
Normal file
@@ -0,0 +1,36 @@
|
||||
// backend/src/modules/auth/strategies/jwt.strategy.ts
|
||||
import { Strategy } from 'passport-jwt';
|
||||
import { PassportStrategy } from '@nestjs/passport';
|
||||
import { Injectable, UnauthorizedException } from '@nestjs/common';
|
||||
import { ConfigService } from '@nestjs/config';
|
||||
import { PrismaService } from '../../../../prisma/prisma.service';
|
||||
import { Request } from 'express';
|
||||
|
||||
@Injectable()
|
||||
export class JwtStrategy extends PassportStrategy(Strategy) {
|
||||
constructor(
|
||||
private configService: ConfigService,
|
||||
private prisma: PrismaService,
|
||||
) {
|
||||
super({
|
||||
jwtFromRequest: (req: Request) => {
|
||||
return req?.cookies?.accessToken; // ✅ READ FROM COOKIE
|
||||
},
|
||||
ignoreExpiration: false,
|
||||
secretOrKey: configService.get('JWT_SECRET'),
|
||||
});
|
||||
}
|
||||
|
||||
async validate(payload: any) {
|
||||
const user = await this.prisma.user.findUnique({
|
||||
where: { id: payload.sub },
|
||||
});
|
||||
|
||||
if (!user) {
|
||||
throw new UnauthorizedException();
|
||||
}
|
||||
|
||||
const { passwordHash, ...result } = user;
|
||||
return result;
|
||||
}
|
||||
}
|
||||
20
backend/src/modules/auth/strategies/local.strategy.ts
Normal file
20
backend/src/modules/auth/strategies/local.strategy.ts
Normal file
@@ -0,0 +1,20 @@
|
||||
// backend/src/modules/auth/strategies/local.strategy.ts
|
||||
import { Strategy } from 'passport-local';
|
||||
import { PassportStrategy } from '@nestjs/passport';
|
||||
import { Injectable, UnauthorizedException } from '@nestjs/common';
|
||||
import { AuthService } from '../auth.service';
|
||||
|
||||
@Injectable()
|
||||
export class LocalStrategy extends PassportStrategy(Strategy) {
|
||||
constructor(private authService: AuthService) {
|
||||
super({ usernameField: 'email' }); // Use 'email' instead of 'username'
|
||||
}
|
||||
|
||||
async validate(email: string, password: string): Promise<any> {
|
||||
const user = await this.authService.validateUser(email, password);
|
||||
if (!user) {
|
||||
throw new UnauthorizedException('Invalid credentials');
|
||||
}
|
||||
return user;
|
||||
}
|
||||
}
|
||||
Reference in New Issue
Block a user